Claude/cpu guard script dn d8u - #132
Merged
Merged
Conversation
…eout Telegraf's long-polling uses getUpdates with timeout=50 (Telegram holds the connection for up to 50 seconds waiting for new updates). The callApi patch was wrapping ALL methods — including getUpdates — with globalThrottle, which has a hard 15-second race. This fired on every poll cycle, throwing 'rateLimiter: API call timed out after 15000ms', causing bot.launch() to reject and systemd to enter an infinite restart loop. Fix: add getUpdates (and Telegraf startup/lifecycle calls: getMe, deleteWebhook, setWebhook, getWebhookInfo, close, logOut) to the _MANAGED bypass set so they call the original callApi directly without the timeout wrapper. All 60 unit tests pass. Bot loads cleanly in CI mode. https://claude.ai/code/session_01WpEqAiDbpqnBywMjYXJHf4
…hod sets Two fixes: 1. index.js — ensureQaArtifacts(), persistQaProviderState(), ensureQaDirs(): All QA file writes are now wrapped in try/catch and treated as non-fatal. The bot service runs as the 'runewager' system user but qa/ is owned by root, so writeFileSync was throwing EACCES on every startup, which was caught by startBot()'s outer try/catch and called process.exit(1). 2. telegramSafe.js — callApi bypass list refactored (code review feedback): The inline _MANAGED set is replaced with three named, exported constants: - LONG_POLL_METHODS : getUpdates (must bypass 15 s timeout) - LIFECYCLE_METHODS : getMe, deleteWebhook, setWebhook, etc. - INDIVIDUALLY_PATCHED_METHODS : sendMessage, sendPhoto, etc. Combined into CALLAPI_BYPASS_METHODS used by the callApi patch. All sets are exported so test suites can assert bypass membership without requiring a live Telegraf instance. All 60 unit tests pass. Module loads cleanly in CI mode. https://claude.ai/code/session_01WpEqAiDbpqnBywMjYXJHf4
…e conflict Addresses code review feedback: index.js: - Added QA_FS_SUPPRESS constant (EACCES, EPERM, EROFS, EEXIST) — the set of expected error codes when qa/ is owned by root but the service runs as the runewager user. Defined once, shared by all three QA helpers. - ensureQaDirs: replace silent catch-all with per-directory loop; unexpected error codes (e.g. ENOENT, ENOMEM) are logged as warnings so they remain visible; permission codes are silently skipped. - persistQaProviderState: catch checks err.code — returns silently for permission errors, logs a warning for any other code (e.g. JSON failure). - ensureQaArtifacts: same pattern — unexpected errors are logged at warn level; permission errors (EACCES/EPERM/EROFS) are intentionally silent. telegramSafe.js: - Resolved merge conflict: kept the CALLAPI_BYPASS_METHODS module-level constants introduced in the previous commit; dropped the inline _MANAGED block that arrived from main during the merge. All 60 unit tests pass. https://claude.ai/code/session_01WpEqAiDbpqnBywMjYXJHf4
External code or tests could accidentally mutate the exported Sets (LONG_POLL_METHODS, LIFECYCLE_METHODS, etc.) which would silently alter runtime bypass behavior in callApi. Export frozen array snapshots instead — callers can still iterate and use .includes() for membership checks; the internal module-level Sets remain mutable for runtime use by the callApi patch. All 60 unit tests pass. https://claude.ai/code/session_01WpEqAiDbpqnBywMjYXJHf4
…=false, UMask=0022
ProtectSystem=strict makes the ENTIRE filesystem read-only (including /var),
requiring every directory Node.js touches to be explicitly listed in
ReadWritePaths. This caused silent crashes under systemd while manual
`node index.js` worked fine (no sandbox).
Changes:
- ProtectSystem=strict → full
/usr, /boot, /etc stay read-only; /var (where the app lives) is fully
writable. No more brittle per-directory ReadWritePaths maintenance.
- ProtectHome=true → false
Service runs as root; /root is root's home. Node/npm use /root for
internal caches and temp files — blocking it caused subtle startup
failures that only appeared under systemd sandboxing.
- UMask=0077 → 0022
0077 (owner-only) made log files mode 600, unreadable by log-tailing
utilities running as non-root. 0022 gives the standard 644/755.
- ReadWritePaths kept as belt-and-suspenders documentation; functionally
redundant under ProtectSystem=full but makes intent explicit and guards
against future tightening.
- Expanded inline comments explain each directive's rationale so the next
operator understands the trade-off before changing settings.
All 60 unit tests pass.
https://claude.ai/code/session_01WpEqAiDbpqnBywMjYXJHf4
…s catch blocks
EEXIST fix:
fs.mkdirSync with { recursive: true } never throws EEXIST for an existing
directory — it silently succeeds. The only way EEXIST reaches these catch
blocks is if a *file* exists at the expected directory path, which is a real
misconfiguration that will silently swallow all QA artifact writes. Removing
EEXIST from QA_FS_SUPPRESS lets that case surface as a logged warning.
Comment updated to explain the exclusion.
Non-Error guard fix:
JavaScript allows any value to be thrown, so a catch block's `e` is not
guaranteed to be an Error instance. All three QA fs catch blocks now use
optional chaining (e?.code, e?.message) and fall back to String(e) for the
message field, preventing secondary TypeErrors during error logging.
All 60 tests pass; node --check clean.
https://claude.ai/code/session_01WpEqAiDbpqnBywMjYXJHf4
Merge conflicts (5 hunks in index.js): - Keep HEAD QA_FS_SUPPRESS without EEXIST (correct: recursive mkdirSync never throws EEXIST for dirs, so EEXIST means misconfiguration) - Keep HEAD optional-chaining (e?.code / e?.message ?? String(e)) throughout Review comment — centralize QA_FS_SUPPRESS: - Added authoritative JSDoc explaining the set is the single source of suppression semantics for all QA fs helpers; adding a code here propagates to every caller automatically Review comment — stack trace behind debug flag: - All QA logEvent warn calls now spread stack: e?.stack when LOG_LEVEL=debug Review comment — independent artifact writes in ensureQaArtifacts: - Extracted tryWriteQaJson() helper: each artifact write is now guarded independently so one serialization/path failure cannot block the others - ensureQaArtifacts() restructured to call tryWriteQaJson per file Review comment — runewager.service hardening: - ProtectHome=false → ProtectHome=true; added /root/.npm and /root/.cache to ReadWritePaths so Node/npm caches work without blanket /root access - UMask=0022 → UMask=0027 (files 640, dirs 750): blocks world-readable artifacts while keeping group-read for log-tailing utilities https://claude.ai/code/session_01WpEqAiDbpqnBywMjYXJHf4
runewager.service: - UMask=0022 → UMask=0077; files now default to 600, dirs to 700 - Updated comment documenting per-call mode strategy and noting that systemd StandardOutput/StandardError logs are opened by systemd (not the process) and thus unaffected by UMask; group access via usermod -aG or setfacl is the documented mechanism for those files index.js — explicit mode on every writeFileSync / appendFileSync: - writeFileAtomic (temp file): mode 0o600 — sensitive data (runtime-state.json) - adminLog → adminEventsLogFile: mode 0o640 — log file, group-readable - appendBonusAdminLog → bonusAdminLogFile: mode 0o640 — log file, group-readable - writeQaLog daily log files: mode 0o640 — observability, group-readable - persistQaProviderState → qaProviderStateFile: mode 0o600 — private state - tryWriteQaJson → QA artifact files: mode 0o600 — private artifacts - sshv editor save → session.editorMode.filePath: mode 0o600 — private draft https://claude.ai/code/session_01WpEqAiDbpqnBywMjYXJHf4
…k loops Root cause: step 11 "God-Mode Heal" duplicated the same wait_for_health (20 attempts × 2s = 40s) + systemctl restart block FIVE times back-to-back, totalling up to ~3.5 minutes of wasted waiting even on a clean boot. Changes: - Extracted `_kill_port_squatters()` helper (lsof-first, SIGTERM→SIGKILL) - Step 9c: two-pass aggressive port clear with xargs SIGKILL fallback runs BEFORE systemd restart so the service never races a squatter - Step 11: replaced 5 duplicated heal blocks with a single 30s health probe (15×2s), one optional auto-recovery restart, and a final 20s probe (10×2s) - Telegram notification uses read_env_value() (no raw grep), log capped at 3.5k chars Result: cold-start completes in ~15-35s instead of 3-5 minutes.
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Reviewer's GuideStrengthens restart reliability and post-deploy health checks, tightens filesystem error handling, and standardizes secure file permissions for logs and QA artifacts. Sequence diagram for aggressive port clearing and single-pass post-start health checksequenceDiagram
participant prod_run_sh
participant lsof as lsof_or_port_listener_pids
participant port_squatter as port_squatter_processes
participant systemd as systemd_service
participant node_app as node_app
participant health as health_endpoint
participant telegram as telegram_api
%% Pre-start aggressive port clear
prod_run_sh->>prod_run_sh: read_env_value PORT
prod_run_sh->>prod_run_sh: is_port_listening PORT_PRESTART
alt port_in_use
prod_run_sh->>lsof: list PIDs listening on PORT_PRESTART
lsof-->>prod_run_sh: PIDs
loop each_pid
prod_run_sh->>port_squatter: kill -TERM pid
prod_run_sh->>port_squatter: if still alive kill -KILL pid
end
prod_run_sh->>prod_run_sh: sleep 1
prod_run_sh->>prod_run_sh: is_port_listening PORT_PRESTART
alt still_in_use
prod_run_sh->>lsof: lsof -t -iTCP:PORT_PRESTART
lsof-->>prod_run_sh: remaining PIDs
prod_run_sh->>port_squatter: kill -9 remaining PIDs
prod_run_sh->>prod_run_sh: sleep 1
end
end
%% (Service start happens via systemd earlier in script)
prod_run_sh->>systemd: systemctl restart APP_NAME.service (if available)
systemd->>node_app: start
%% Post-start health check single pass
prod_run_sh->>prod_run_sh: HEALTH_URL = resolve_health_url()
prod_run_sh->>prod_run_sh: derive HEALTH_PORT
prod_run_sh->>systemd: systemctl is-active APP_NAME.service
systemd-->>prod_run_sh: SYSTEMD_ACTIVE
prod_run_sh->>health: wait_for_health(HEALTH_URL, 15, 2)
alt health_ok_initial
health-->>prod_run_sh: healthy
prod_run_sh->>prod_run_sh: HEALTH_STATUS = healthy
else health_failed_initial
health-->>prod_run_sh: unhealthy
prod_run_sh->>prod_run_sh: HEALTH_STATUS = unhealthy
prod_run_sh->>prod_run_sh: is_port_listening HEALTH_PORT
alt port_still_squatted
prod_run_sh->>port_squatter: _kill_port_squatters(HEALTH_PORT, PID)
prod_run_sh->>prod_run_sh: sleep 1
alt systemd_available
prod_run_sh->>systemd: systemctl restart APP_NAME.service
else no_systemd
prod_run_sh->>node_app: kill PID (if set)
prod_run_sh->>node_app: nohup node index.js &
end
prod_run_sh->>prod_run_sh: sleep 3
prod_run_sh->>prod_run_sh: PID = get_bot_pid()
end
prod_run_sh->>health: wait_for_health(HEALTH_URL, 10, 2)
alt health_ok_after_recovery
health-->>prod_run_sh: healthy
prod_run_sh->>prod_run_sh: HEALTH_STATUS = healthy
else still_unhealthy
health-->>prod_run_sh: unhealthy
prod_run_sh->>prod_run_sh: HEALTH_STATUS = unhealthy
end
end
%% Final port status and Telegram report
prod_run_sh->>prod_run_sh: is_port_listening HEALTH_PORT
alt listening
prod_run_sh->>prod_run_sh: PORT_STATUS = listening
else not_listening
prod_run_sh->>prod_run_sh: PORT_STATUS = not-listening
end
prod_run_sh->>prod_run_sh: _ADMIN_IDS = read_env_value ADMIN_IDS
prod_run_sh->>prod_run_sh: _BOT_TOKEN = read_env_value TELEGRAM_BOT_TOKEN
alt has_telegram_config
prod_run_sh->>prod_run_sh: _REPORT = last log lines (bounded)
loop each_admin_id
prod_run_sh->>telegram: sendMessage(health, port, PID)
telegram-->>prod_run_sh: 200 OK (ignored)
end
else no_telegram_config
prod_run_sh->>prod_run_sh: skip Telegram notification
end
Flow diagram for QA filesystem helpers and artifact persistenceflowchart TD
A[start ensureQaArtifacts] --> B[ensureQaDirs]
B --> C{mkdirSync for each QA dir}
C -->|success| D[dirs ensured]
C -->|error e| E{QA_FS_SUPPRESS has e.code?}
E -->|yes| F[ignore permission error]
E -->|no| G[logEvent warn ensureQaDirs unexpected error]
F --> D
G --> D
D --> H[tryWriteQaJson qaRepoInfoFile]
H --> I{fs.writeFileSync repo_info}
I -->|success| J[repo_info written mode 0600]
I -->|error e| K{QA_FS_SUPPRESS has e.code?}
K -->|yes| L[ignore suppressed error]
K -->|no| M[logEvent warn ensureQaArtifacts repo_info unexpected error]
L --> N[next artifact]
M --> N
N --> O[tryWriteQaJson qaCapabilitiesFile]
O --> P{fs.writeFileSync capabilities}
P -->|success| Q[capabilities written mode 0600]
P -->|error e| R{QA_FS_SUPPRESS has e.code?}
R -->|yes| S[ignore suppressed error]
R -->|no| T[logEvent warn ensureQaArtifacts capabilities unexpected error]
S --> U[persistQaProviderState]
T --> U
U --> V[ensureQaDirs]
V --> W{mkdirSync for each QA dir}
W -->|success or suppressed| X[dirs ensured for state]
W -->|unexpected error| Y[logEvent warn ensureQaDirs unexpected error]
X --> Z{fs.writeFileSync qaProviderStateFile}
Z -->|success| AA[state written mode 0600]
Z -->|error e| AB{QA_FS_SUPPRESS has e.code?}
AB -->|yes| AC[return silently nonfatal]
AB -->|no| AD[logEvent warn persistQaProviderState unexpected error]
J --> N
Q --> U
AC --> AE[end ensureQaArtifacts]
AD --> AE
AA --> AE
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe changes tighten file permissions (0o600, 0o640), introduce centralized QA artifact writing helpers (tryWriteQaJson, ensureQaArtifacts), adjust error suppression logic in QA_FS_SUPPRESS by removing EEXIST, replace multi-stage health checks with simplified single-pass logic and Telegram deployment notifications, and harden systemd service security through ProtectHome and UMask changes. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~40 minutes Possibly related PRs
Suggested labels
Poem
✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Sequence DiagramThe PR hardens pre-start port clearing, simplifies the post-start health probe into a single-pass auto-recovery (clear squatters + one restart), and reports a concise Telegram summary. The diagram shows the core deploy script interactions during restart and health verification. sequenceDiagram
participant Deployer as prod-run.sh
participant Port as PortSquatter
participant Service as Systemd/Node
participant Health as HealthEndpoint
participant Telegram as Telegram API
Deployer->>Port: Detect listening on configured port
Deployer->>Port: Terminate listeners (TERM then KILL fallback)
Deployer->>Service: Restart service (systemctl or nohup)
Service->>Health: Serve health endpoint
Deployer->>Health: Probe health (bounded single-pass)
alt healthy
Deployer->>Telegram: Send concise "Deploy complete: OK" (trimmed logs)
else unhealthy
Deployer->>Port: If still occupied, clear squatters and restart once
Deployer->>Service: Restart service (one auto-recovery)
Deployer->>Health: Final health probe
Deployer->>Telegram: Send concise "Deploy complete: FAILED" (trimmed logs)
end
Generated by CodeAnt AI |
codeant-ai
Bot
added
the
size:L
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- In the post-start Telegram notification block,
_REPORTis constructed but never used; either remove the unused variable or incorporate the log excerpt into the message payload to avoid dead code. - The
xargs -rusage in the_kill_port_squattersfollow-up SIGKILL path may not be portable to all environments (e.g., some BSDxargsdo not support-r); consider a more portable pattern such as guardingxargswith anifor usingxargs kill -9with an input check.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In the post-start Telegram notification block, `_REPORT` is constructed but never used; either remove the unused variable or incorporate the log excerpt into the message payload to avoid dead code.
- The `xargs -r` usage in the `_kill_port_squatters` follow-up SIGKILL path may not be portable to all environments (e.g., some BSD `xargs` do not support `-r`); consider a more portable pattern such as guarding `xargs` with an `if` or using `xargs kill -9` with an input check.
## Individual Comments
### Comment 1
<location path="prod-run.sh" line_range="523-531" />
<code_context>
- done
-fi
-
-SYSTEMD_ACTIVE="$(systemctl is-active "${APP_NAME}.service" 2>/dev/null || echo inactive)"
-HEALTH_URL="$(resolve_health_url)"
-HEALTH_PORT="${HEALTH_URL#*://127.0.0.1:}"
-HEALTH_PORT="${HEALTH_PORT%%/*}"
-
-if wait_for_health "$HEALTH_URL" 20 2; then
- HEALTH_STATUS="healthy"
-else
- HEALTH_STATUS="unhealthy"
-fi
-
</code_context>
<issue_to_address>
**issue (bug_risk):** SYSTEMD_ACTIVE can become stale after the auto-recovery restart branch.
Because SYSTEMD_ACTIVE is set only once and reused in the final summary, the reported status may not match the actual state after `systemctl restart` runs in the auto-recovery path. Please either move the `systemctl is-active` call to just before the final summary, or recompute SYSTEMD_ACTIVE after the restart so the final line reflects the post-heal state.
</issue_to_address>
### Comment 2
<location path="prod-run.sh" line_range="550-551" />
<code_context>
+_ADMIN_IDS="$(read_env_value ADMIN_IDS || true)"
+_BOT_TOKEN="$(read_env_value TELEGRAM_BOT_TOKEN || true)"
+if [[ -n "$_BOT_TOKEN" && -n "$_ADMIN_IDS" ]]; then
+ _REPORT="$(( tail -n 30 "$MAIN_LOG"; tail -n 20 "$ERROR_LOG" ) 2>/dev/null \
+ | sed 's/"/\\"/g' | head -c 3500)"
+ for _AID in ${_ADMIN_IDS//,/ }; do
+ curl -s -X POST "https://api.telegram.org/bot${_BOT_TOKEN}/sendMessage" \
</code_context>
<issue_to_address>
**issue:** _REPORT is computed but never used in the Telegram notification.
`_REPORT` is built from the log tails but never used in the `curl` request. Please either remove this construction or wire it into the Telegram payload (or a separate message) if the intent is to send recent logs to admins.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
523
to
531
| HEALTH_STATUS="healthy" | ||
| else | ||
| HEALTH_STATUS="unhealthy" | ||
|
|
||
| # Auto-recover from port conflicts, then retry health once. | ||
| # One auto-recovery: clear any squatter and restart once | ||
| if is_port_listening "$HEALTH_PORT"; then | ||
| free_port_if_conflicted "$HEALTH_PORT" "$PID" || true | ||
| warn "Port $HEALTH_PORT still squatted after start — forcing clear + one restart" | ||
| _kill_port_squatters "$HEALTH_PORT" "${PID:-}" | ||
| sleep 1 | ||
| if command -v systemctl >/dev/null 2>&1 && [[ -f "$SERVICE_FILE" ]]; then | ||
| systemctl restart "${APP_NAME}.service" 2>/dev/null || true |
There was a problem hiding this comment.
issue (bug_risk): SYSTEMD_ACTIVE can become stale after the auto-recovery restart branch.
Because SYSTEMD_ACTIVE is set only once and reused in the final summary, the reported status may not match the actual state after systemctl restart runs in the auto-recovery path. Please either move the systemctl is-active call to just before the final summary, or recompute SYSTEMD_ACTIVE after the restart so the final line reflects the post-heal state.
Comment on lines
+550
to
+551
| _REPORT="$(( tail -n 30 "$MAIN_LOG"; tail -n 20 "$ERROR_LOG" ) 2>/dev/null \ | ||
| | sed 's/"/\\"/g' | head -c 3500)" |
There was a problem hiding this comment.
issue: _REPORT is computed but never used in the Telegram notification.
_REPORT is built from the log tails but never used in the curl request. Please either remove this construction or wire it into the Telegram payload (or a separate message) if the intent is to send recent logs to admins.
Nitpicks 🔍
|
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
Comment on lines
+550
to
+556
| _REPORT="$(( tail -n 30 "$MAIN_LOG"; tail -n 20 "$ERROR_LOG" ) 2>/dev/null \ | ||
| | sed 's/"/\\"/g' | head -c 3500)" | ||
| for _AID in ${_ADMIN_IDS//,/ }; do | ||
| curl -s -X POST "https://api.telegram.org/bot${_BOT_TOKEN}/sendMessage" \ | ||
| -d chat_id="$_AID" \ | ||
| -d parse_mode="Markdown" \ | ||
| -d text="Deploy complete: Health $( [[ "$HEALTH_STATUS" == healthy ]] && echo OK || echo FAILED) Port: $HEALTH_PORT PID: ${PID:-none}" >/dev/null 2>&1 || true |
There was a problem hiding this comment.
Suggestion: The Telegram deploy notification block attempts to build a log snippet using arithmetic expansion ($(( ... ))) instead of command substitution ($( ... )), so the tail commands are never executed as commands, and the resulting _REPORT content is meaningless and never included in the message body; switch to proper command substitution and append _REPORT to the text payload so admins actually receive the intended log excerpt. [logic error]
Severity Level: Critical 🚨
- ❌ prod-run.sh exits when Telegram alerts are configured.
- ⚠️ Telegram deploy messages lack intended log context.
Suggested change
| _REPORT="$(( tail -n 30 "$MAIN_LOG"; tail -n 20 "$ERROR_LOG" ) 2>/dev/null \ | |
| | sed 's/"/\\"/g' | head -c 3500)" | |
| for _AID in ${_ADMIN_IDS//,/ }; do | |
| curl -s -X POST "https://api.telegram.org/bot${_BOT_TOKEN}/sendMessage" \ | |
| -d chat_id="$_AID" \ | |
| -d parse_mode="Markdown" \ | |
| -d text="Deploy complete: Health $( [[ "$HEALTH_STATUS" == healthy ]] && echo OK || echo FAILED) Port: $HEALTH_PORT PID: ${PID:-none}" >/dev/null 2>&1 || true | |
| _REPORT="$( ( tail -n 30 "$MAIN_LOG"; tail -n 20 "$ERROR_LOG" ) 2>/dev/null \ | |
| | sed 's/"/\\"/g' | head -c 3500)" | |
| for _AID in ${_ADMIN_IDS//,/ }; do | |
| curl -s -X POST "https://api.telegram.org/bot${_BOT_TOKEN}/sendMessage" \ | |
| -d chat_id="$_AID" \ | |
| -d parse_mode="Markdown" \ | |
| -d text="Deploy complete: Health $( [[ "$HEALTH_STATUS" == healthy ]] && echo OK || echo FAILED) Port: $HEALTH_PORT PID: ${PID:-none}\n\n${_REPORT}" >/dev/null 2>&1 || true | |
| done |
Steps of Reproduction ✅
1. Ensure Telegram notifications are configured by setting `TELEGRAM_BOT_TOKEN` and
`ADMIN_IDS` in `.env`, which are read by `read_env_value` at `prod-run.sh:547-548`.
2. Deploy using the documented entrypoint, e.g. run `npm run prod` (which invokes
`./prod-run.sh` per `package.json:14`) or execute `bash prod-run.sh` from the project
root.
3. After the bot is restarted and the health check passes/finalizes (logic at
`prod-run.sh:514-542`), execution reaches the Telegram admin notification block at
`prod-run.sh:546-557`.
4. With `set -euo pipefail` enabled at `prod-run.sh:9`, the line `_REPORT="$(( tail -n 30
"$MAIN_LOG"; tail -n 20 "$ERROR_LOG" ) 2>/dev/null \` at `prod-run.sh:550-551` is parsed
as arithmetic expansion: `tail`/`sed` tokens are not valid arithmetic, causing a Bash
"syntax error in expression" and immediate script exit before any `tail` commands run or
any `curl` notification is sent; even if `set -e` were relaxed, `_REPORT` would not
contain the intended log snippet and is never interpolated into the `text` field at
`prod-run.sh:556`, so admins would receive at most a bare status line without logs.Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** prod-run.sh
**Line:** 550:556
**Comment:**
*Logic Error: The Telegram deploy notification block attempts to build a log snippet using arithmetic expansion (`$(( ... ))`) instead of command substitution (`$( ... )`), so the `tail` commands are never executed as commands, and the resulting `_REPORT` content is meaningless and never included in the message body; switch to proper command substitution and append `_REPORT` to the `text` payload so admins actually receive the intended log excerpt.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
|
CodeAnt AI finished reviewing your PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Summary by Sourcery
Improve deployment robustness and QA observability by hardening port conflict handling, simplifying the post-start health/notification flow, and tightening file permissions and error handling for logs and QA artifacts.
Enhancements:
CodeAnt-AI Description
Harden startup, observability, and file safety; avoid crashes from QA writes; aggressively clear port conflicts and simplify health reporting
What Changed
Impact
✅ Fewer startup restarts due to port conflicts✅ Clearer deploy health status for admins✅ Lower risk of sensitive file exposure💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
Release Notes
New Features
Bug Fixes
Chores