mosaicstack/stack
20
0
Fork 1
Code Issues 335 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

fix: coord review remediations (path traversal, JSON parse, race condition) #81

Merged
jason.woltje merged 1 commits from fix/coord-review-remediations into main 2026-03-13 03:43:50 +00:00
Conversation 0 Commits 1 Files Changed 5
+86 -34
jason.woltje commented 2026-03-13 03:43:44 +00:00
Owner
Copy Link
Copy Source

Addresses code review findings from P2-005 coord migration.

Changes

  • Validate projectPath against allowed workspace roots (path traversal fix)
  • Guard JSON.parse with try/catch in loadMission, readActiveSession, readSessionLock
  • Add delay after stale lock removal to reduce race window
  • Add @Inject(CoordService) per project guideline
  • Eliminate double loadMission in getTaskStatus via shared buildStatusSummary
  • Fix fragile prompt-inclusion check to test original command for {prompt}
  • Add mkdir to writeAtomic for consistency

Test plan

  • All 19 existing tests pass
  • typecheck, lint, format:check all green

Closes #80

Addresses code review findings from P2-005 coord migration. ## Changes - Validate projectPath against allowed workspace roots (path traversal fix) - Guard JSON.parse with try/catch in loadMission, readActiveSession, readSessionLock - Add delay after stale lock removal to reduce race window - Add @Inject(CoordService) per project guideline - Eliminate double loadMission in getTaskStatus via shared buildStatusSummary - Fix fragile prompt-inclusion check to test original command for {prompt} - Add mkdir to writeAtomic for consistency ## Test plan - All 19 existing tests pass - typecheck, lint, format:check all green Closes #80
jason.woltje added 1 commit 2026-03-13 03:43:44 +00:00
fix: coord review remediations — path traversal, JSON parse, race condition 4de23e238a 
Addresses code review findings from P2-005:
- Validate projectPath against allowed workspace roots (path traversal)
- Guard JSON.parse with try/catch in loadMission, readActiveSession, readSessionLock
- Add delay after stale lock removal to reduce race window
- Add @Inject(CoordService) per project guideline (no emitDecoratorMetadata)
- Eliminate double loadMission in getTaskStatus via shared buildStatusSummary
- Fix fragile prompt-inclusion check to test original command for {prompt}
- Add mkdir to writeAtomic for consistency with other atomic helpers

Closes #80

Co-Authored-By: Claude Opus 4.6 <[email protected]>
jason.woltje merged commit 8da2759fec into main 2026-03-13 03:43:50 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#81