Remove hardcoded local paths and internal session artifacts - #4
Merged
Merged
Conversation
Several files carried absolute paths from one developer's machine, exposing a
username and directory layout for no benefit, and two files were internal
operational artifacts that should not have survived the public release.
Paths replaced with values that actually work anywhere:
smoke-{provenance,substrate,variety}-e2e.sh resolve the corpus relative to
the script rather than to one machine, and all three now honour a PROD_DB
override (substrate previously hardcoded it with no way to override)
scripts/backup-globi-to-nas.sh SOURCE_DB derived from the
script location; cron example genericised
prompts/role-agent-interactive.md repo-relative path
.claude/agents/planner-migration-auditor.md refers to the PolyCrop checkout
by name instead of by one machine's absolute path
Removed as internal session exhaust, referenced by nothing that ships:
recovery-939-prompt.txt a one-off prompt for an unattended recovery
run, describing internal pipeline state
GUAM-REINGEST-RESUME.md an internal campaign hand-off playbook
Two comments that pointed at the removed playbook were updated rather than left
dangling (.gitignore, scripts/fetch-uog-ceo-pdfs.cjs).
No credentials were exposed at any point: the NAS backup script already kept
host, user and key in an untracked ~/.agroeco-backup.conf and shipped only
REPLACE_WITH_* placeholders. All four shell scripts still parse.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Several files carried absolute paths from one developer's machine, exposing a username and directory layout for no benefit. Two others were internal operational artifacts that should not have survived the public release.
Paths replaced with values that work anywhere
smoke-{provenance,substrate,variety}-e2e.shscripts/backup-globi-to-nas.shSOURCE_DBderived from the script location; cron example genericisedprompts/role-agent-interactive.md.claude/agents/planner-migration-auditor.mdsmoke-substrate-e2e.shpreviously hardcodedPROD_DBwith no way to override it; all three smoke scripts now accept the samePROD_DBenvironment override, so this is a small usability fix as well as a cleanup.Removed as internal session exhaust
recovery-939-prompt.txt— a one-off prompt written for an unattended recovery run, describing internal pipeline state. Referenced by nothing.GUAM-REINGEST-RESUME.md— an internal ingestion-campaign hand-off playbook.Two comments pointing at the removed playbook were updated rather than left dangling (
.gitignore,scripts/fetch-uog-ceo-pdfs.cjs).No credentials were exposed
Worth stating explicitly, since the file names suggest otherwise: the NAS backup script already kept host, user and key in an untracked
~/.agroeco-backup.confand shipped onlyREPLACE_WITH_*placeholders. A scan for tokens, keys and private material across the tree found nothing — the only real exposure was the username and directory layout.Verification
All four shell scripts pass
bash -n; the modified Node script passesnode --check. A sweep of every tracked file for absolute home paths, other-repo references and personal identifiers now returns nothing.Related, not fixed here
Around twenty public files reference internal-only documents that this repository does not ship (
CLAUDE.md,.okf/,docs/superpowers/, phase histories). Those are dangling references rather than leaked information, so they are left for a separate pass.