Skip to content

fix(init): refuse to index the filesystem root or $HOME - #337

Merged
zzet merged 1 commit into
zzet:mainfrom
vitaliyslion:feat/init-refuse-unsafe-root
Jul 25, 2026
Merged

fix(init): refuse to index the filesystem root or $HOME#337
zzet merged 1 commit into
zzet:mainfrom
vitaliyslion:feat/init-refuse-unsafe-root

Conversation

@vitaliyslion

Copy link
Copy Markdown
Contributor

Summary

gortex init had no guard against being pointed at a dangerous root — running it against $HOME (or /) walks the entire tree by default, since --skills defaults to on. gortex track already refused these paths via indexer.UnsafeIndexRootReason; init never called it. This wires the same guard into init, checked before the wizard, any indexing, or any file writes.

Changes

  • cmd/gortex/init.go: runInit now resolves absRoot immediately after parsing the [path] arg and, unless --force is set, calls indexer.UnsafeIndexRootReason(absRoot) before doing anything else (wizard, indexing, or writes). Refuses with the reason plus ; pass --force to init it anyway when the target is the filesystem root, a Windows drive root, or exactly $HOME. Removed the now-redundant later filepath.Abs(root) recomputation. Updated the --force flag help text to mention the new bypass.
  • cmd/gortex/init_integration_test.go: added TestInitRefusesHomeDirectory (asserts the refusal, its error message, and that no .gortex/ marker is written) and TestInitForceBypassesHomeDirectoryGuard (asserts --force still proceeds).

Testing

  • New tests added for new functionality (TestInitRefusesHomeDirectory, TestInitForceBypassesHomeDirectoryGuard)
  • go test ./cmd/gortex/... -run TestInit — all init/init-wizard tests pass
  • go build ./cmd/gortex/...
  • Manually verified with a built binary: gortex init "$HOME" --yes refuses with the home-directory message; gortex init "$HOME" --yes --force proceeds
  • Full go test -race ./... not run (scoped to the touched package; happy to run the full suite before merge if wanted)
  • Benchmarks — not performance-relevant

Checklist

  • Code follows existing patterns in the codebase (mirrors the unsafeRootBlocked/pass force to track it anyway convention already used by gortex track)
  • No unnecessary abstractions added
  • Language extractor includes Meta["methods"] for interfaces (not applicable)
  • Methods have EdgeMemberOf edges to their containing type (not applicable)

@zzet

zzet commented Jul 25, 2026

Copy link
Copy Markdown
Owner

@vitaliyslion can you please check the failed test?

UPD: Looks like a flaky test

@zzet
zzet merged commit a18e00f into zzet:main Jul 25, 2026
21 of 23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants