hookified - chore: defense - bootstrap Aikido Safe Chain for cloud agents - #185
Conversation
Install Safe Chain shims in Codespaces and Cursor Cloud Agents before any frozen-lockfile install. Co-authored-by: Jared Wray <me@jaredwray.com>
Co-authored-by: Jared Wray <me@jaredwray.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #185 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 5 5
Lines 433 433
Branches 109 109
=========================================
Hits 433 433 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e0459a6468
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| persist_shim_path() { | ||
| local rc="$1" | ||
| local line="export PATH=\"${SAFE_CHAIN_SHIMS}:${SAFE_CHAIN_BIN}:\$PATH\"" | ||
| if [[ -f "$rc" ]] && grep -Fq ".safe-chain/shims" "$rc"; then |
There was a problem hiding this comment.
When an existing rc file merely mentions .safe-chain/shims—for example, in a commented/stale entry or an assignment that appends the directory after the existing PATH—this substring check returns without writing the canonical leading export. A subsequent shell can therefore resolve an unwrapped package manager ahead of the shim even though bootstrap succeeded; validate or replace the effective PATH assignment so the shim directory is first.
AGENTS.md reference: AGENTS.md:L73-L74
Useful? React with 👍 / 👎.
2 participants
Summary
Bootstrap Aikido Safe Chain on Codespaces and Cursor Cloud Agents (section 2).
Status update:
DEFENSE_IN_DEPTH.md: Safe Chain cloud bootstrap → (PR pending); CODEOWNERS → PR #184Changes
scripts/setup-cloud-environment.sh(pinned Safe Chain installer, SHA-256 verified,--cishims, frozen lockfile)..devcontainer/devcontainer.jsonand.cursor/environment.jsonso both environments run the bootstrap.AGENTS.md.SECURITY.md.Verification
environment.jsonare valid JSON and invokebash ./scripts/setup-cloud-environment.shAGENTS.mddocuments not bypassing shimsReference: defense-in-depth-nodejs § 2
Please check if the PR fulfills these requirements
What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
chore / security