mirror of
https://github.com/alirezarezvani/claude-skills.git
synced 2026-09-07 08:26:02 +00:00
7eb198ff42
A tenth review pass, after confirming all nine prior rounds of fixes hold up under independent re-reading, found two more low-severity gaps and offered to accept a follow-up -- fixed both now for consistency with how every prior round's findings were handled: 1. schedule had no confirmation gate at the CLI layer. The "confirm with the user before schedule" safeguard (deviation #15) lived only in commands/skillopt-sleep.md's agent-facing instructions -- cmd_schedule() called scheduler.schedule() directly and installed a real crontab entry immediately. Fine for the documented Claude Code agent workflow (which confirms in chat first), but anyone invoking `python -m skillopt_sleep schedule` directly bypassed it entirely. Fixed: schedule now requires --yes; an interactive terminal without it gets a [y/N] prompt, a non-interactive one refuses outright (exit 2) pointing at --yes. commands/skillopt-sleep.md updated so the driving agent passes --yes once it has confirmed with the user in chat -- that's what --yes records, not a redundant re-prompt that would hang forever with no TTY inside a non-interactive Bash tool call. 2. mkdir-then-chmod wasn't atomic in write_staging()/SleepState.save(), leaving a brief window where a freshly-created sensitive directory sat at the process's default umask. Fixed: the os.makedirs() calls creating the state dir, staging leaf dir, and backup dir now pass mode=0o700 directly, on top of (not instead of) the existing post-creation chmod calls, which still matter for intermediate parent dirs and pre-existing directories that mode= doesn't cover. The equivalent race for individual files was judged a larger rewrite (every open() call site would need os.open() with an explicit mode) than this specific low-severity finding warranted -- documented as a known, narrower residual gap rather than silently claimed as fully closed. Verified: non-interactive schedule without --yes refuses with exit 2, with --yes it proceeds to the same scheduler.schedule() call as before; a synthetic run confirms state dir/state.json/staging leaf still land at 0700/0600/0700 after the mode= change. Added as README deviations #22-23 and reconciled the count across all three documents to 23 (6 cosmetic, 17 safety/hardening) across ten review rounds -- cross-checked with grep. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TX374i2YGrjNV4Yi3AmaKS |
||
|---|---|---|
| .. | ||
| experiments | ||
| __init__.py | ||
| __main__.py | ||
| backend.py | ||
| budget.py | ||
| config.py | ||
| consolidate.py | ||
| cycle.py | ||
| dream.py | ||
| gate.py | ||
| harvest.py | ||
| harvest_codex.py | ||
| harvest_sources.py | ||
| judges.py | ||
| llm_miner.py | ||
| memory.py | ||
| mine.py | ||
| replay.py | ||
| rollout.py | ||
| scheduler.py | ||
| slow_update.py | ||
| staging.py | ||
| state.py | ||
| tasks_file.py | ||
| types.py | ||