Skip to content

Fix CDPATH breaking all bin/ scripts + fragile JSON stripping via sed#853

Open
urbantech wants to merge 1 commit intogarrytan:mainfrom
urbantech:fix/824-710-shell-hardening
Open

Fix CDPATH breaking all bin/ scripts + fragile JSON stripping via sed#853
urbantech wants to merge 1 commit intogarrytan:mainfrom
urbantech:fix/824-710-shell-hardening

Conversation

@urbantech
Copy link
Copy Markdown

Summary

#824 — CDPATH breaks all bin/ scripts

Every shell script uses SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" to find its location. When CDPATH is set (common in power-user dotfiles), cd prints the target directory to stdout, prepending garbage to the captured path.

Fix: CDPATH= cd — unsets CDPATH for the subshell. Standard POSIX fix.

23 files across bin/, scripts/, browse/scripts/, setup, supabase/.

#710 — Fragile JSON manipulation via sed in telemetry sync

gstack-telemetry-sync stripped JSON fields using sed patterns like s/,"_repo_slug":"[^"]*"//g. This breaks on:

  • Values containing escaped quotes (\")
  • Fields in first position (no leading comma)
  • Nested objects as values

Fix: Replace with bun -e JSON.parse/delete/stringify. Falls back to the original line on parse failure. Bun is guaranteed available.

Test Plan

  • CDPATH fix verified: CDPATH="/usr:/var" SCRIPT_DIR="$(CDPATH= cd ... && pwd)" returns correct path
  • JSON stripping verified: input with _repo_slug, _branch, repo fields correctly stripped
  • Fallback on invalid JSON verified: original line preserved

Fixes #824, fixes #710

CDPATH (garrytan#824):
All 23 shell scripts use SCRIPT_DIR="$(cd ... && pwd)" to find
their location. When CDPATH is set, cd prints the target directory
to stdout, corrupting the captured path. Fix: prefix with CDPATH=
to unset it for the subshell.

Affected: 22 files in bin/, scripts/, browse/scripts/, setup, supabase/

Telemetry JSON (garrytan#710):
gstack-telemetry-sync stripped JSON fields via sed patterns that
break on escaped quotes and edge-positioned fields. Replace with
bun -e JSON.parse/delete/stringify for correct handling. Falls
back to original line on parse failure.

Fixes garrytan#824, fixes garrytan#710
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant