fix(cloud): harden setup lifecycle and remove obsolete prompts

Merged
BI
1mo ago
+493-4948

User description

Summary

Cloud setup could overwrite existing runtime files before rejecting an incompatible configuration, ignore a custom CODEX_HOME, or leave maintenance unable to recover from invalid command shims. This change validates output targets and tool versions before writes, stages generated files, respects CODEX_HOME, and falls back to full setup when maintenance cannot repair the shims.

It also fixes Python PATH filtering for home paths containing shell-pattern characters, bounds diagnostic version probes, and removes three obsolete imported Cloud prompts plus their instruction-check exemptions. The supported legacy runbook remains available.

Areas touched: Delivery and assurance; Knowledge and records

Verification

Completed before publication:

  • 203 tests passed across the final five Cloud suites, including setup, policy harness, diagnostics, GitHub lifecycle, and remote contracts.
  • Regression cases reproduced the failures before the fixes and passed afterward.
  • Shell syntax, formatting, static Cloud contracts, changed-test integrity, instruction and retirement checks, decision records, documentation links, and repository snapshot checks passed.
  • CI-safe structural privacy/readiness checks passed during the earlier repair pass; expected missing-configuration warnings remained.

For this commit/push/PR request, readiness checks were not rerun and hosted CI was not monitored, following the repository's bare-publication procedure. Push skipped only the format/static readiness guards; the auto-merge ownership guard remained enabled.

Risk and rollout

  • Risk: Changes affect opt-in legacy Cloud setup, generated configuration, command discovery, and diagnostics. Regression tests cover rejection without overwriting existing files and maintenance recovery.
  • Rollback: Revert this commit.
  • Provider or production effects: No production settings, host credentials, or host environment configuration were changed. The raw environment preflight was not modified.

Notes

The inherited host GH_TOKEN issue remains unresolved. These repository fixes do not sanitize the running agent parent or establish a fresh-task raw-boundary PASS. The matching runtime artifact from the handover identifies an injection artifact, while its upstream writer/configuration remains unconfirmed and requires host/operator access.

GitHub publication used the existing authorized integration without copying credentials into repository configuration. No auto-merge is enabled.

RAG impact: no retrieval behaviour change; setup tooling, tests, and documentation only.

Summary by cubic

Hardens Cloud setup so it validates CODEX_HOME, output targets, and Node/npm/npx versions before replacing any files, preserving the existing runtime profile when setup is rejected or a write fails. Maintenance now reruns full setup when generated shims are missing, broken, or incompatible, and setup also repairs a mismatched bundled npx.

  • Setup writes exclusions to the selected CODEX_HOME/config.toml and stages config and profile candidates before atomic replacement.
  • Shim installation validates every target before replacing any wrapper and bounds version probes with a timeout.
  • Python PATH filtering removes cached venv entries via literal comparison, handling home paths with brackets or spaces.
  • Removed three obsolete imported Cloud prompts and their scanner exemptions; the supported legacy runbook remains.

Summary by CodeRabbit

  • Bug Fixes
    • Cloud setup now respects the selected configuration directory, validates setup paths and tool versions before replacing existing files, and preserves the current runtime profile if setup fails.
    • Shim installation validates all commands before updating them; maintenance retries full setup if validation fails.
    • Python selection avoids stale virtual-environment paths, and diagnostic version checks stop after five seconds.
  • Documentation
    • Updated Cloud setup guidance and added a decision record.
    • Removed three obsolete review prompts and refreshed the documentation index.

CodeAnt-AI Description

Protect Cloud setup files and recover broken tool shims

What Changed

  • Setup applies shell exclusions to the selected CODEX_HOME and rejects invalid paths or file targets before writing. Existing runtime profiles are preserved when setup is rejected or a candidate write fails.
  • Setup validates bundled and fallback npm/npx versions before replacing shims. Maintenance reruns setup when shims are missing, broken, or incompatible.
  • Python selection skips cached virtual-environment paths even when home-directory names contain spaces or brackets. Unresponsive version checks now time out.
  • Removed three obsolete imported review prompts; the maintained task prompt and Cloud operating guidance remain available.

Impact

✅ Existing Cloud profiles preserved when setup is rejected
✅ Maintenance recovers from broken Node shims
✅ Cloud exclusions written to the selected CODEX_HOME

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.