fix: TOCTOU race in personal file delete + IndexError on whitespace cmd (#2228)

1. routes/personal_routes.py: os.path.exists() then os.remove() is a
   classic TOCTOU race — another request or cleanup can delete the
   file between the check and the remove, raising FileNotFoundError.
   Replace with try/except FileNotFoundError.

2. src/tool_implementations.py: cmd.split()[0] crashes with IndexError
   when cmd is a non-empty whitespace-only string (split() returns []).
   Guard with (cmd.split() or [''])[0].

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Wes Huber
2026-06-07 07:44:26 -07:00
committed by GitHub
parent 12cb39cbd9
commit 706ea6a7b7
2 changed files with 7 additions and 4 deletions
+1 -1
View File
@@ -2662,7 +2662,7 @@ async def _cookbook_register_task(session_id: str, model: str, host: str,
placeholder = (
f"Launched via agent — waiting for tmux output…\n"
f" session: {session_id}\n"
f" target: {target}{cmd.split()[0] if cmd else ''}\n"
f" target: {target}{(cmd.split() or [''])[0] if cmd else ''}\n"
f" cmd: {cmd[:200]}{'' if len(cmd) > 200 else ''}"
)
tasks.append({