[hyperpolymath]

Summary

On main, network-repair --help exits 1 on every distribution in Distribution Matrix Tests and in Tests:

src/main.sh: line 17: .../src/utils/utils/privileges.sh: No such file or directory

Every module that src/main.sh sources starts by assigning the global SCRIPT_DIR to its own directory. That covers utils/logging.sh and everything in diagnostics/ and repairs/. Once main.sh has sourced utils/logging.sh, SCRIPT_DIR is src/utils, so main.sh's next source resolves under src/utils/utils/.

Changes

• 8800119. Each sourced module resolves the directory it needs into its own name and leaves SCRIPT_DIR to main.sh:
  • NR_UTILS_DIR is always src/utils, whichever module sets it.
  • repairs/routing.sh sets NR_REPAIRS_DIR, because two of its functions re-source interfaces.sh at run time.
• 7895d9c (CodeRabbit):
  • Diagnostics that find issues no longer abort diagnose under set -e.
  • The safe-mode test reads diagnose's output once.
  • The colour test accepts empty colours when stdout is not a terminal.
  • Two ShellCheck warnings are fixed.
• 45da73d (CodeRabbit): comments in repairs/routing.sh.
• 4270e56: a regression test. Sourcing any module from a fresh shell must leave the caller's SCRIPT_DIR alone. The test fails on main.

Testing

Check	main	this PR
./network-repair --help / --version	exit 1	exit 0
tests/run-tests.sh	20/25	25/25
tests/test-utils.sh	fails	passes
shellcheck -S warning on src/	2 warnings	clean
CI: Unit Tests, ShellCheck, Integration (ubuntu 20.04/22.04/24.04, debian:12), most distro jobs	red	green

Still red here, fixed elsewhere

• lint-workflows: fixed by fix(ci): SPDX check accepts the licence after the actions-lock banner #80 (SPDX) and fix(ci): the pinning check accepts refs that actions.lock resolves #81 (pinning).
• Debian 11, Rocky/Alma 9 and openSUSE installs: fixed by fix(ci): distro jobs install their packages again #82.
• scan / * and hypatia: these need the estate re-pin of the standards workflows (75bd599).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 920be1aa-6aa6-4421-8f5d-739e033f56c4

📥 Commits

Reviewing files that changed from the base of the PR and between 8800119 and 4270e56.

📒 Files selected for processing: 7

• src/diagnostics/connectivity.sh
• src/diagnostics/interfaces.sh
• src/main.sh
• src/repairs/routing.sh
• src/utils/privileges.sh
• tests/run-tests.sh
• tests/test-utils.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 26

• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets
• GitHub Check: lint
• GitHub Check: archlinux
• GitHub Check: Runtime Policy
• GitHub Check: ubuntu-22.04
• GitHub Check: rockylinux-9
• GitHub Check: ubuntu-24.04
• GitHub Check: alpine-3.19
• GitHub Check: alpine-3.20
• GitHub Check: ubuntu-20.04
• GitHub Check: fedora-40
• GitHub Check: debian-11
• GitHub Check: fedora-39
• GitHub Check: almalinux-9
• GitHub Check: opensuse-tumbleweed
• GitHub Check: antipattern-check
• GitHub Check: opensuse-leap-15.5
• GitHub Check: debian-12
• GitHub Check: check
• GitHub Check: check
• GitHub Check: Network Namespace Integration Tests
• GitHub Check: analyze (actions, none)
• GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline: 8

GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt: fix: sourced modules no longer overwrite the caller's SCRIPT_DIR

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]lockfile verification did not produce a result for this action. Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action

GitHub Actions: Hypatia Security Scan / hypatia _ Hypatia Neurosymbolic Analysis: fix: sourced modules no longer overwrite the caller's SCRIPT_DIR

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]lockfile verification did not produce a result for this action. Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action

GitHub Actions: Secret Scanner / 0_scan _ shell-secrets.txt: fix: sourced modules no longer overwrite the caller's SCRIPT_DIR

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ shell-secrets: fix: sourced modules no longer overwrite the caller's SCRIPT_DIR

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / 1_scan _ gitleaks.txt: fix: sourced modules no longer overwrite the caller's SCRIPT_DIR

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ gitleaks: fix: sourced modules no longer overwrite the caller's SCRIPT_DIR

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / 2_scan _ rust-secrets.txt: fix: sourced modules no longer overwrite the caller's SCRIPT_DIR

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ rust-secrets: fix: sourced modules no longer overwrite the caller's SCRIPT_DIR

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

🧰 Additional context used

📚 Code guidelines: 1

CLAUDE.md — unknown

📓 Path-based instructions: 2

Source excerpt: Create diagnostic function in `src/diagnostics/`

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• src/diagnostics/interfaces.sh
• src/diagnostics/connectivity.sh

Source excerpt: Create repair function in `src/repairs/`

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• src/repairs/routing.sh

🔇 Additional comments: 3

src/utils/privileges.sh: 1

46-46: LGTM!

src/main.sh: 1

134-134: 🎯 Functional Correctness

The failure-aggregation concern is refuted. Although errexit is disabled inside functions called on the left side of ||, check_dns_cache explicitly returns 0, so it cannot cause diagnose_dns to report a false pass. Its preceding commands also handle expected failures.

The unrecorded routing and NetworkManager checks likewise explicitly return 0. All checks that can report issues are already added to total_issues.

tests/run-tests.sh: 1

255-259: LGTM!

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Improved reliability when running diagnostics and repair tools from different locations by correcting how shared tools are found.
  • Diagnostics now collect failure results across checks rather than stopping before the overall result is reported.
  • Improved handling of duplicate-IP checks and privilege cleanup, and corrected a network probe argument.
• Documentation
  • Clarified guidance on how sourced modules locate their directories and documented repair outcomes and failure conditions.

Diagnostic and repair modules now resolve shared paths through NR_UTILS_DIR and NR_REPAIRS_DIR. The main script collects diagnostic failure statuses. The changes also update diagnostic checks, repair comments, a privilege trap, and shell tests.

Changes: Module paths and diagnostic handling

Layer / File(s)	Summary
Resolve utility and repair imports src/diagnostics/*.sh, src/repairs/*.sh, src/utils/logging.sh, src/main.sh, tests/test-utils.sh	Diagnostic and repair scripts use NR_UTILS_DIR for utility imports. Repair routing uses NR_REPAIRS_DIR for interfaces.sh. logging.sh uses NR_UTILS_DIR to locate colors.sh. A test checks that module sourcing does not change SCRIPT_DIR.
Collect diagnostic results src/main.sh, src/diagnostics/connectivity.sh, src/diagnostics/interfaces.sh, tests/run-tests.sh	run_all_diagnostics records non-zero diagnostic statuses instead of exiting before collecting them. Duplicate-IP detection handles an unset map entry, and the MTU probe quotes its ping argument. The safe-mode test checks one captured command result and the diagnostic summary.
Update repair notes and shell checks src/repairs/routing.sh, src/utils/privileges.sh, tests/test-utils.sh	Repair routing comments describe documented outcomes and conditions. The require_root EXIT trap defers expansion of SUDO_KEEPER_PID. Colour tests check variable definition and disabled-colour values.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 4270e

Sourced modules no longer overwrite the caller's SCRIPT_DIR, so path resolution is fixed. Nothing actionable blocks merge.

Security architecture risk: 🟡 Moderate · up to 4270e

Restoring CLI execution exposes two existing control gaps: repeated repairs can leave sudo-refresh workers running after exit, and dry-run repairs can change host networking. Both require a local invocation with sufficient sudo or root authority; no unauthenticated remote privilege bypass is established.

Retained concerns

• Medium · security · inferred: The restored CLI exposes repeated credential-worker creation without corresponding ownership of every worker. For example, --apply-fixes repair-network calls require_root in repair_interfaces and again in repair_down_interfaces. Each successful non-root call starts another sudo-refresh loop and replaces the shared PID and EXIT trap; cleanup targets only the newest worker. Earlier workers may therefore continue refreshing the invoking user's credentials after the repair session, depending on sudo policy. The mechanism predates this PR, but the base CLI failed before dispatch. Root execution creates no keepers, and successful sudo authorization remains required.
• Medium · security · inferred: The restored CLI also exposes a preview-to-mutation control gap. With --dry-run repair-network, require_apply_fixes permits execution without APPLY_FIXES. The interface-repair flow then reaches interface_up, which executes a real privileged ip link set operation when an interface is down; neither that operation nor run_privileged enforces dry-run behavior. Thus an authorized operator requesting a preview can change host networking. This implementation predates the PR, but normal CLI reachability is restored by this change.

Security review details

Security Blast Radius

• inferred — The demonstrated exposure is local to the invoking user's sudo credential lifecycle and the host's network interfaces. Credential reuse remains bounded by sudo policy; the inspected paths do not establish authority over other users, tenants or remote services.

Security Findings and Attack Paths

• inferred — A successful non-root repair-network invocation reaches nested privilege requests before completing interface inspection. Multiple workers are consequently possible even without repeated CLI commands, while normal exit cleanup targets only the most recently recorded PID.
• inferred — An authorized local operator can request --dry-run repair-network yet reach a real interface-state change. The guard treats dry-run as permission to enter repairs, but the demonstrated mutation sink does not distinguish preview from execution.

Trust Boundaries and Controls

• observed — Default configuration disables APPLY_FIXES. The direct interface-repair command checks the shared guard, but that guard also permits DRY_RUN. Sudo authentication remains a separate authority check, and root callers skip credential-worker creation entirely.

Resilience and Maintainability Implications

• inferred — For one successful privilege request without later PID mutation, EXIT cleanup targets its worker. Repeated requests lack equivalent ownership of earlier workers. Interruption and alternate shell execution contexts remain unvalidated; the function registers only EXIT cleanup.

Hardening Proposals

• proposed — Give credential refresh a single, idempotent lifecycle owner, and enforce preview behavior at the privileged mutation boundary rather than relying solely on entrypoint admission.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: sourced modules no longer overwrite the caller's SCRIPT_DIR.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 15 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The pull request description directly explains the SCRIPT_DIR path-resolution failure, the module changes, regression tests, and reported test results. It matches the changeset.

✨ Finishing Touches

🛠️ Fix failing CI checks

• Commit to this branch
• Create a new PR

📝 Generate docstrings

• 🤖 Coding Agent task started for docstring generation.
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-19T18:43:37.274698Z	8800119	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autofix

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ Checks skipped: 2 · already failing on `main` (not caused by this PR)

• GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt
• GitHub Actions: Distribution Matrix Tests / 0_Matrix Summary.txt

[coderabbitai]

🤖 Completed: Generate docstrings for PR #79 — View commit 45da73d

[hyperpolymath]

CI status at 4270e56. Unit Tests, ShellCheck, Integration Tests (ubuntu 20.04/22.04/24.04, debian:12) and most distro jobs pass, with 4270e56 adding a SCRIPT_DIR regression test. Every remaining failure stops before any test runs, in a service this PR does not touch:

Check	Failure	Fix
scan / gitleaks, scan / shell-secrets, scan / rust-secrets, hypatia	invalid lockfile pin for actions/checkout@3d3c42e…, inside the standards reusables at the old pin	Waits on the estate re-pin to standards 75bd599 (owner's decision).
lint-workflows	The SPDX check reads only line 1, where gh actions-lock puts its banner. The SHA-pin check rejects tag refs that actions.lock resolves.	#80 (SPDX) and #81 (pinning), both copied from the template.
debian-11, Integration Tests - debian:11	bullseye-security returns 404 for every package; Debian 11 is past end of life.	#82 drops debian:11.
rockylinux-9, almalinux-9	dnf refuses to replace the image's curl-minimal with curl.	#82: dnf install -y --allowerasing …
opensuse-leap-15.5, opensuse-tumbleweed	actions/checkout cannot find tar in the image.	#82 installs tar and gzip before checkout.
Matrix Summary	Aggregates the distro jobs above.	Goes green with #82.

#80–#82 are workflow-only fixes, each in its own PR. Once they merge, I'll merge main into this branch. The scan and hypatia checks stay red until the standards re-pin. No job was re-run: these failures are deterministic.

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud