Claude/cpu guard script dn d8u

[gamblecodezcom]

User description

Summary by Sourcery

Improve robustness and safety of backend process management, logging, and webhook handling, plus adjust CPU guard whitelisting.

Bug Fixes:

• Ensure autofix webhook fails fast with a clear error when rawBody is missing or misconfigured instead of proceeding with an invalid payload.
• Prevent backend logging from failing when streams are destroyed or unwritable by falling back safely to console output.

Enhancements:

• Fallback backend endpoint logs to /tmp when the configured log directory is not writable.
• Tighten backend restart logic by targeting pkill to the project-specific backend.js path and re-checking/freeing the endpoint port before nohup fallback restarts.
• Extend the CPU guard whitelist to protect the gcz_cpu_guard monitoring script from termination.

---

CodeAnt-AI Description

Improve backend reliability: safer logging, strict webhook validation, cleaner restart behavior, and CPU-guard protections

What Changed

• Backend logging now avoids writing to destroyed or unwritable streams; log write errors are caught and messages fall back to console so the server doesn't crash when log files fail.
• Autofix webhook now rejects requests if the original raw request body is missing or not a buffer, returns a 500 error, and logs a clear error instead of proceeding with an invalid payload.
• Startup script falls back to /tmp for endpoint logs when the configured log directory is not writable, clears any process holding the endpoint port before restarting, and re-checks/frees the port before launching a nohup fallback; pkill now targets the project path to avoid killing unrelated Node processes.
• Service unit pre-start runs with root escalation and attempts graceful termination (SIGTERM then SIGKILL) of any process holding the endpoint port to prevent immediate crash-restart loops.
• CPU-guard whitelist extended to protect sibling monitoring scripts (gcz_cpu_guard) from being terminated.

Impact

✅ Clearer webhook failure errors
✅ Fewer endpoint crash-restart loops
✅ Fewer lost or fatal log-write failures

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[sourcery-ai]

Reviewer's Guide

Adjusts endpoint startup robustness, backend logging resilience, webhook signature validation safety, and CPU guard whitelisting to improve reliability and avoid killing monitoring scripts.

Sequence diagram for autofix webhook signature validation

sequenceDiagram
    actor Client
    participant ExpressApp
    participant WebhookHandler
    participant Logger
    participant SignatureVerifier

    Client->>ExpressApp: POST /autofix/webhook (body)
    ExpressApp->>ExpressApp: Middleware parses body
    ExpressApp->>ExpressApp: Set req.rawBody (Buffer)
    ExpressApp->>WebhookHandler: Invoke handler with req, res

    WebhookHandler->>WebhookHandler: Read headers x-autofix-signature or x-hub-signature-256
    WebhookHandler->>WebhookHandler: Read req.rawBody as rawBody

    WebhookHandler->>WebhookHandler: Check rawBody exists and is Buffer
    alt rawBody missing or not Buffer
        WebhookHandler->>Logger: error(autofix.webhook, Missing rawBody, { requestId })
        Logger-->>WebhookHandler: Logged error
        WebhookHandler-->>Client: 500 JSON { ok: false, error: Internal server error, requestId }
    else rawBody valid
        WebhookHandler->>SignatureVerifier: verifySignature(rawBody, signature)
        SignatureVerifier-->>WebhookHandler: result
        alt AUTOFIX_SECRET missing or signature invalid
            WebhookHandler-->>Client: Error response (unauthorized or misconfigured)
        else Signature valid
            WebhookHandler-->>Client: 200 JSON { ok: true, ... }
        end
    end

Loading

Class diagram for backend logger utility

classDiagram
    class Logger {
        +info(eventType, msg, extra)
        +error(eventType, msg, extra)
        +debug(eventType, msg, extra)
        +_write(streams, obj)
    }

    class Stream {
        +destroyed : boolean
        +writable : boolean
        +write(line)
    }

    Logger "1" --> "*" Stream : writes to

    class AutofixWebhookHandler {
        +handle(req, res)
    }

    class ExpressRequest {
        +id
        +headers
        +rawBody
    }

    class ExpressResponse {
        +status(code)
        +json(body)
    }

    class SignatureVerifier {
        +verifySignature(rawBody, signature)
    }

    AutofixWebhookHandler --> Logger : uses
    AutofixWebhookHandler --> ExpressRequest : receives
    AutofixWebhookHandler --> ExpressResponse : responds via
    AutofixWebhookHandler --> SignatureVerifier : calls

Loading

File-Level Changes

Change	Details	Files
Make endpoint log file initialization robust to unwritable log directories by falling back to /tmp.	Replace unconditional touch of endpoint log files with a guarded touch that checks for failure On failure, log a warning and redirect endpoint logs to /tmp paths Ensure new /tmp log files are created if possible	prod-run.sh
Harden nohup fallback restart logic for the backend service, including more precise process killing and port conflict handling.	Tighten pkill patterns to only match node processes running the backend.js in the current PROJECT_DIR Before nohup fallback, re-check the endpoint port and free it if another process is listening Apply the more specific pkill pattern both for systemd restart fallback and no-systemd path	prod-run.sh
Improve backend logger stream handling to avoid writing to invalid streams and fall back cleanly to stdout.	Filter logger streams to only those that are non-null, not destroyed, and writable before writing log lines Wrap individual stream writes in try/catch and log write errors to console.error Fallback to console.log when no writable streams are available	backend.js
Make the Autofix webhook handler robust to missing or invalid rawBody, avoiding signature verification on undefined data.	Read rawBody directly from req.rawBody without defaulting to an empty buffer Validate that rawBody is present and is a Buffer before proceeding Log an explicit error and return a 500 response if rawBody is missing or misconfigured	backend.js
Extend CPU guard whitelist to ensure sibling monitoring scripts are never killed.	Add gcz_cpu_guard to the whitelist patterns alongside rw_cpu_guard Clarify comment that both the guard and sibling monitoring scripts are untouchable	scripts/rw_cpu_guard.sh

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 1 minutes and 43 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between b090755 and 63bfc3b.

📒 Files selected for processing (3)

• backend.js
• prod-run.sh
• runewager-endpoint.service

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch claude/cpu-guard-script-DnD8u

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

CodeAnt AI finished reviewing your PR.