fix: restore task #0040 and renumber review follow-up to #0042#45
Merged
fix: restore task #0040 and renumber review follow-up to #0042#45
Conversation
fazxes
added a commit
that referenced
this pull request
Apr 5, 2026
This was referenced Apr 6, 2026
fazxes
added a commit
that referenced
this pull request
Apr 6, 2026
…x false-green Pentest findings (session #86): Finding 2 (CONFIRMED, FIXED): ALERT_CONTENT in daemon.sh was sanitized for </prompt_alert> but not </pentest_data>. A diff of daemon.sh appearing in the alert file (e.g. from a pentest-agent modification that touched the pentest_data wrapper lines) would contain the literal closing tag, breaking the XML boundary in the next builder prompt. Added a second sed -e expression to strip </pentest_data> to [/pentest_data], matching the existing PENTEST_REPORT sanitization at line 238. Finding 1 (CONFIRMED, TASK CREATED -- #169, urgent): extract_result_summary only parses Claude's {"type":"result"} JSONL events. Codex emits {"type":"item.completed","item":{"type":"agent_message",...}}. PENTEST_AGENT defaults to $AGENT, so Codex daemon runs always produce an empty PENTEST_REPORT (false-green). Task #169 is urgent and describes the fix + required test coverage. Task priority upgrades (3 security/reliability issues mislabeled low): #45 low->normal: shell injection pattern in cleanup_old_logs/cleanup_orphan_branches #84 low->normal: path traversal guard missing in readiness.py file reads #85 low->normal: latent IndexError crash in readiness display formatting
fazxes
added a commit
that referenced
this pull request
Apr 7, 2026
…_THINKING validation
Pentest-2026-04-06 fix-now: two confirmed findings fixed in one comprehensive pass.
1. Five functions (cleanup_old_logs, cleanup_orphan_branches, run_evaluation,
should_evaluate, notify_human) interpolated $log_dir, $REPO_DIR, ${REPO_DIR:-.},
or $agent directly into python3 -c "..." strings. Converted all five to the
established heredoc+sys.argv / env-var pattern matching cleanup_healer_log.
Closes task #45. (pentest fix-now)
2. NIGHTSHIFT_CODEX_THINKING is validated against ^[a-z_]+$ at startup immediately
after it is set. A double-quote in the value would break the shell string in
'codex exec -c "reasoning_effort=\"$CODEX_THINKING\""' and produce an opaque
failure. Invalid values now fail fast with a clear error. Closes task #189.
(pentest fix-now)
All 1121 tests pass. bash -n clean. validate-docs clean.
fazxes
added a commit
that referenced
this pull request
Apr 7, 2026
… -c blocks (#183) Three daemons (daemon.sh, daemon-review.sh, daemon-overseer.sh) each interpolated shell variables directly into python3 -c strings in their SESSION_COST, CUMULATIVE, and OVER_BUDGET blocks. A file path containing a single-quote (or a poisoned NIGHTSHIFT_BUDGET value) could corrupt the Python source string silently. Fix pattern (matching lib-agent.sh convention from task #45): - All shell vars passed via prefixed env vars (_NS_*) read by os.environ - OVER_BUDGET float comparison moved to awk -v to remove python3 entirely Affected vars: $PENTEST_LOG_FILE, $LOG_FILE, $COST_FILE, $SESSION_ID, $AGENT, $PENTEST_AGENT (SESSION_COST); $COST_FILE (CUMULATIVE); $CUMULATIVE/$BUDGET (OVER_BUDGET). 11 unsafe interpolations fixed total. Fixes task #183 (expanded scope to cover full 376-428 range + deprecated daemons, not just $PENTEST_AGENT/$AGENT as originally scoped).
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan