🧃 feat: Add Opt-In RTK Shell Output Filtering - #41
Conversation
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
danny-avila
changed the title
7de33dd to
13b5915
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 13b5915b1d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f09636c30f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Match parameter or array expansion rather than a literal mention in a | ||
| # comment or string. The wrapper only needs to preserve file execution | ||
| # when the script actually depends on Bash's source-file metadata. | ||
| if ! grep -qE '\$\{BASH_SOURCE([^[:alnum:]_]|$)|\$BASH_SOURCE([^[:alnum:]_]|$)|(^|[^[:alnum:]_])BASH_SOURCE\[' -- "$1" 2>/dev/null; then |
There was a problem hiding this comment.
At the confirmed current head f09636c30f2c4ca081773dddc66e9d1d60ad6650, fresh evidence shows that the revised guard still misses valid prefix-operator forms such as ${#BASH_SOURCE} because the pattern requires { to be followed immediately by BASH_SOURCE. For an opted-in script using this expansion, file execution reports the source path's nonzero length, whereas the rewritten bash -c path reports 0, so filtering silently changes program behavior. Extend the guard to recognize Bash prefix operators as well, or avoid executing rewritten scripts via a command string.
Useful? React with 👍 / 👎.
2 participants
Summary
I added request-scoped RTK output filtering for Bash executions while preserving raw execution as the default and keeping all command rewriting inside the sandbox boundary.
shell_output_filter: "raw" | "rtk"to the public and internal execution contracts with Bash-only validation at both trust boundaries.Change Type
Testing
cd api && bun run build.cd service && bun run build; the existing Rollup export/circular-dependency warnings remain unchanged.cd api && bun test src/bash-run.test.ts src/job-helpers.test.ts(69 passed).cd service && bun test src/config.spec.ts(17 passed).bash -n docker/bash-run.sh docker/package-init.sh.rtk-buildertarget from both Dockerfiles on linux/arm64 and verifiedrtk 0.45.0.git status && git difftortk git status && rtk git diff, honors the ephemeral RTK environment, and creates no files under sandbox HOME.AWS_CA_BUNDLEtrips existing hardened-startup fixtures. No focused RTK test failed.Test Configuration:
Checklist