Skip to content

[Routine - QP] fix: avoid logging full backup file path in PromptManager#49

Draft
winterdrive wants to merge 1 commit into
masterfrom
routine/qp-fix-backup-log-path-leak-260708
Draft

[Routine - QP] fix: avoid logging full backup file path in PromptManager#49
winterdrive wants to merge 1 commit into
masterfrom
routine/qp-fix-backup-log-path-leak-260708

Conversation

@winterdrive

Copy link
Copy Markdown
Owner

1. Pre-flight Check

Open PRs / active branches checked (as of 2026-07-08):

This PR only touches src/core/PromptManager.ts (a single log line in createBackup()), which does not overlap with any file above. It also does not overlap topically with recently closed duplicate-attempt PRs (#33–35, #39–41), which covered substr deprecation, non-array JSON guards, and corrupted-JSON handling — this change is purely about log output, not parsing/validation logic.

2. Changes

PromptManager.createBackup() previously logged the full absolute path of the corruption backup file (console.error('[PromptManager] Created backup: ' + backupPath)), which embeds the user's workspace directory (and often their OS username via the home directory). This PR logs only path.basename(backupPath) instead, keeping the log useful (still shows the backup filename/timestamp) without leaking the local filesystem layout.

  • No MCP tool schemas, names, or parameters were touched (mcp-server/src/tools/ untouched).
  • No dependencies added/removed; package.json / package-lock.json untouched.
  • CHANGELOG.md untouched (per routine PR policy).

3. Safety Verification

Commands run locally, all passed:

  • npx tsc -p ./ — no errors
  • npm run test:coverage — 7 test suites, 107 tests, all passed

4. CI / Release Gate Note

This is a daily routine Draft PR. Package version bump and CHANGELOG consolidation are intentionally deferred to the weekend release/integration PR. If CI fails solely due to the repository's version-bump release gate, that is expected release-readiness behavior for a routine PR, not a code validation failure.

Log only the basename when reporting a created prompts.json backup,
since the full path embeds the user's local workspace/home directory.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant