Repository navigation
fix(local-tracker): keep new report files and folders to their owner - #1700
Merged
Merged
Conversation
test_one_timeout_does_not_block_the_others ran both stub reviewers with a one-second budget, and the one meant to answer is a Python process that has to start first. On a loaded machine (the parallel pre-commit pytest run) start-up alone took longer, so the answering reviewer timed out too and the test failed. Give it five seconds; the other stub still sleeps for a minute, so the timeout case is unchanged. Generated-by: Claude Opus 5
Two more runner tests measured wall-clock time against bounds that left little room for starting the Python stubs, and one failed under the parallel pre-commit pytest run (3.03 s against 2.8 s): - the parallel run sleeps 3 s per reviewer and must finish under 5.5 s (6 s one after the other), not 1.5 s under 2.8 s; - a finished answer with a lingering helper must arrive under 8 s with a 10 s timeout, not under 4 s with 5 s. Each test still tells the behaviour apart from its failure mode. Generated-by: Claude Opus 5
The local tracker created report files with mode 0644 and their folders with 0755, so under the usual umask any other user on the machine could read an embargoed report and list the report folders, whose names carry the title slug (CodeQL py/overly-permissive-file). Files and folders the tracker creates are now 0600 and 0700; it never touches the mode of a file that already exists. Also drops an assignment in metadata._has_inline_comment that every branch overwrote before reading it (CodeQL py/multiple-definition). Generated-by: Claude Opus 5
github-actions
Bot
added
family:tools
potiuk
added a commit
that referenced
this pull request
Oct 19, 2026
Hand-sync of tools/spec-loop/specs/ with the functionality that landed between 43e4c6e and ccb53a3. Specs changed: - adapters: Gmail drafting through the gmail-plaintext MCP tools, not the CLI (93051d5, #1681); the Jira CLI's explicit --deployment and the tracker backends shipped as generated plugin copies (1cf5cee, #1683); local-tracker report files and folders created 0600 / 0700 (68ec4a3, #1700). - agent-isolation-sandbox: agent-guard unwrapping env / command and refusing env -S (b00d4b5, #1691; 4aea234, #1694); the macOS touch overlay shown whether or not activation is granted (0d9c168, #1697); the sandbox-lint workflow refusing a tracked .claude/settings.local.json (51a610b, #1692) and sandbox-lint refusing the Gmail token path in allowRead (93051d5, #1681). - vetted-command-surface: the spelling guard refusing a quoted ~, the right spelling behind env / command, and other spellings of the eval wrapper (b00d4b5, #1691). - adoption-and-setup: the tracker-backend question on every first setup and the Jira label mapping and doctor gate (1cf5cee, #1683). - .last-sync bumped to ccb53a3. No spec change needed (specs already updated in the commit itself): ccb53a3, 9a8ec5f, 9955d7d, c9f34cc, 76cc6e8, 1d773a8, 16014a2. No functional change for the specs: d4b7dc3 (review-body wording), 77e8145 (test timing), 8d606d6 (eval fixtures), a04891f (the previous sync). Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #1699 (its two test commits are the first two here; this PR's own change is the last commit).
The local tracker created report files with mode
0644and their folders with0755.Under the usual umask that let any other user on the machine read an embargoed report and list the report folders, whose names carry the title slug.
0600and0700(CodeQLpy/overly-permissive-file, alert 141). The mode of a file that already exists is never changed.metadata._has_inline_commentthat every branch overwrote before reading it (CodeQLpy/multiple-definition, alert 142).0600, the folder0700.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 5) following the guidelines
🤖 Generated with Claude Code