Repository navigation
mono - chore: sync defense-in-depth files from agentic - #79
Conversation
Refresh the Safe Chain bootstrap script and the stale Safe Chain section in AGENTS.md, and add the missing template sections, from agentic ea156c0. Co-authored-by: Jared Wray <me@jaredwray.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #79 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 3 3
Lines 19 19
Branches 1 1
=========================================
Hits 19 19 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates AGENTS.md with comprehensive guidelines on Safe Chain shims, Simplified Technical English, test auditing, and pull request workflows. It also modifies scripts/setup-cloud-environment.sh to support Claude Code and Codex cloud environments, introducing environment-specific shim persistence. Feedback on the script highlights that the updated path-matching logic in persist_shim_path is overly strict and could cause duplicate entries in shell configuration files, recommending a more flexible grep check instead.
| if [[ -f "$rc" ]] && grep -Fqx -- "$line" "$rc"; then | ||
| return 0 | ||
| fi |
There was a problem hiding this comment.
Using grep -Fqx with the exact expanded path ($line) is prone to false negatives. For example, if a developer uses $HOME or ~ instead of the absolute path (e.g., export PATH="$HOME/.safe-chain/shims..."), or if there are minor formatting differences (such as trailing comments or different quoting), grep -Fqx will fail to match and the script will repeatedly append duplicate export lines to the startup files (like .bashrc or .profile). Reverting to a more flexible check, such as checking for the presence of .safe-chain/shims in the file, prevents duplicate entries.
| if [[ -f "$rc" ]] && grep -Fqx -- "$line" "$rc"; then | |
| return 0 | |
| fi | |
| if [[ -f "$rc" ]] && grep -Fq ".safe-chain/shims" "$rc"; then | |
| return 0 | |
| fi |
There was a problem hiding this comment.
This file is a verbatim copy of skills/security/defense-in-depth-nodejs/scripts/setup-cloud-environment.sh at ea156c03785398c8c156caa046ca954595f396c8. That revision replaced grep -Fq ".safe-chain/shims" with the exact-line check at scripts/setup-cloud-environment.sh:19. A substring match treats any mention of .safe-chain/shims as already configured, including a comment or a different PATH order. Changing it here would make this copy diverge from upstream again.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 36e3220717
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # and runs CLAUDE_ENV_FILE before every command instead. A failed SessionStart hook does not stop | ||
| # the session, so the shims go on its PATH before anything here can fail, holding stubs that | ||
| # refuse to run until Safe Chain's setup-ci replaces them. | ||
| if [[ -n "${CLAUDE_ENV_FILE:-}" ]]; then |
There was a problem hiding this comment.
In Claude Code on the web, this block runs only if another hook starts the script. The target tree has no tracked .claude hook or other Claude caller. Thus, later package-manager commands can bypass Safe Chain. Add and track the SessionStart hook.
AGENTS.md reference: AGENTS.md:L42-L50
Useful? React with 👍 / 👎.
| if [[ ! -e "${SAFE_CHAIN_SHIMS}/${cmd}" ]]; then | ||
| printf '#!/bin/sh\necho "error: Safe Chain is not set up, so %s is blocked; run bash ./scripts/setup-cloud-environment.sh" >&2\nexit 1\n' \ | ||
| "$cmd" > "${SAFE_CHAIN_SHIMS}/${cmd}" |
There was a problem hiding this comment.
When a prior Claude setup stops before Corepack creates pnpm, the next command sources the persisted shim path. command -v pnpm then finds this blocker, so the Corepack branch does not run. Safe Chain replaces the blocker but has no real pnpm for pnpm install, so setup cannot recover. Ignore this stub during the pnpm prerequisite check.
Useful? React with 👍 / 👎.
| chmod +x "${SAFE_CHAIN_SHIMS}/${cmd}" | ||
| fi | ||
| done | ||
| persist_shim_path "$CLAUDE_ENV_FILE" |
There was a problem hiding this comment.
When Safe Chain 1.5.15 already exists from normal setup, the installer exits before it runs setup-ci. These new blocker files remain in the persisted path, so pnpm safe-chain-verify stops instead of using Safe Chain. Run safe-chain setup-ci even when the installer reports the same version.
AGENTS.md reference: AGENTS.md:L42-L47
Useful? React with 👍 / 👎.
2 participants
Please check if the PR fulfills these requirements
What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
Chore. Syncs copied defense-in-depth files with jaredwray/agentic.
Summary
The Safe Chain bootstrap script and the Safe Chain section in
AGENTS.mdwere behindjaredwray/agentic. This refreshes those copies and adds the template sections that were missing.DEFENSE_IN_DEPTH.mdis not changed.Changes
scripts/setup-cloud-environment.shwith the copy atea156c03785398c8c156caa046ca954595f396c8. It now writes Safe Chain shims intoCLAUDE_ENV_FILEbefore setup can fail.## Safe Chainsection inAGENTS.md(it matched agentic8ec1c46) with the section at that same commit.## Simplified Technical English,## Test audit, and## Pull requests.Verification
bash -n scripts/setup-cloud-environment.shCatalog
DEFENSE_IN_DEPTH.mdis behind the upstream scaffold. This PR does not edit it. Rundefense-in-depth-nodejsto re-audit. Upstream item lines that the local catalog does not have:/.claude/and/.codex/.claude/hooks/session-start.shbash ./scripts/setup-cloud-environment.shmalware-list.aikido.devLocal sections that are not in the template were left as they are: Package Manager, Development Guidelines, and Common Development Tasks.