Files
HAL9000 a07f4a8afb
CI / lint (pull_request) Successful in 32s
CI / push-validation (pull_request) Successful in 31s
CI / build (pull_request) Successful in 34s
CI / helm (pull_request) Successful in 34s
CI / quality (pull_request) Successful in 54s
CI / typecheck (pull_request) Successful in 1m0s
CI / security (pull_request) Successful in 1m13s
CI / unit_tests (pull_request) Failing after 4m48s
CI / coverage (pull_request) Has been skipped
CI / docker (pull_request) Has been skipped
CI / integration_tests (pull_request) Successful in 9m15s
CI / status-check (pull_request) Failing after 3s
fix(agents): plumb allowed_base_dir through ContextService and BDD fixtures
The previous attempt fixed only two BDD steps (scenarios at lines 17 and
40 of context_analysis_graph_coverage.feature), leaving four more
scenarios still rejecting absolute /tmp paths under the new path-
traversal sandbox: scenarios 24 + 32 of the same file, plus broken
scenarios in context_analysis_coverage_boost.feature,
context_analysis_new_coverage.feature, and the service-level scenarios
80 + 97 of context_service_coverage_gaps.feature.

Production fix: ContextService._get_context_agent now accepts an
allowed_base_dir argument; analyze_context, analyze_context_async,
analyze_context_streaming, and analyze_context_streaming_async all
pass str(project.path) so the agent's sandbox boundary matches the
project workspace. Files inside the project are accepted; traversal
outside it is rejected — the security goal is preserved.

Test fixtures: the _ensure_agent helpers in graph_coverage and
agent_coverage step files, the bare ContextAnalysisAgent constructors
in new_coverage and coverage_boost step files, and the custom-LLM
constructor in graph_coverage all now default allowed_base_dir to
Path("/tmp").resolve(). Every temp file in these fixtures lands under
/tmp via tempfile.mkdtemp / NamedTemporaryFile, so the sandbox now
accepts the absolute paths the tests pass.

ISSUES CLOSED: #9093
2026-06-03 01:47:25 -04:00
..