From 748e14489861bc0c40bee32244715281c9d8c105 Mon Sep 17 00:00:00 2001 From: Renn F Date: Fri, 19 Jun 2026 11:03:12 +0200 Subject: [PATCH] fix(grok): default args/usage paths via tempfile.gettempdir() (bandit B108) bandit B108 (hardcoded_tmp_directory) flagged the literal /tmp defaults for GROK_ARGS_PATH and USAGE_OUT_PATH, failing 'make quality' (2 medium issues -> Error 1) on master. Use tempfile.gettempdir() so there is no /tmp string literal; the runtime path is unchanged (gettempdir() is /tmp in the Linux agent container, matching the entrypoint's own ROBOCO_GROK_ARGS_FILE / tmp default). Not silenced with # nosec. Verified: bandit -r roboco/ -ll now exits 0. --- roboco/llm/providers/grok_cli_config.py | 8 +++++++- roboco/llm/providers/grok_cli_usage.py | 5 ++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/roboco/llm/providers/grok_cli_config.py b/roboco/llm/providers/grok_cli_config.py index bf1181cb..8213d364 100644 --- a/roboco/llm/providers/grok_cli_config.py +++ b/roboco/llm/providers/grok_cli_config.py @@ -30,6 +30,7 @@ from __future__ import annotations import json import os +import tempfile from pathlib import Path from typing import Any @@ -64,7 +65,12 @@ BASH_GUARD_HOOK = os.environ.get( "ROBOCO_BASH_GUARD_HOOK", "/app/scripts/bash-guard-hook.sh" ) # The entrypoint reads the computed flags (one token per line) from this file. -GROK_ARGS_PATH = Path(os.environ.get("ROBOCO_GROK_ARGS_FILE", "/tmp/roboco-grok-args")) +# Defaults under the system temp dir (not a hardcoded /tmp literal) — the +# entrypoint reads the same ROBOCO_GROK_ARGS_FILE / tmp default. +GROK_ARGS_PATH = Path( + os.environ.get("ROBOCO_GROK_ARGS_FILE") + or Path(tempfile.gettempdir()) / "roboco-grok-args" +) # Hard ceiling on agentic turns (loop guard). Operator-tunable. _DEFAULT_MAX_TURNS = 200 diff --git a/roboco/llm/providers/grok_cli_usage.py b/roboco/llm/providers/grok_cli_usage.py index f74d62cb..0d524f10 100644 --- a/roboco/llm/providers/grok_cli_usage.py +++ b/roboco/llm/providers/grok_cli_usage.py @@ -28,6 +28,7 @@ from __future__ import annotations import contextlib import json import os +import tempfile from pathlib import Path from typing import Any from urllib.parse import quote @@ -35,8 +36,10 @@ from urllib.parse import quote from roboco.billing.pricing import calculate_cost # Where the entrypoint writes the captured usage for the orchestrator to read. +# Defaults under the system temp dir (not a hardcoded /tmp literal). USAGE_OUT_PATH = Path( - os.environ.get("ROBOCO_GROK_USAGE_FILE", "/tmp/roboco-grok-usage.json") + os.environ.get("ROBOCO_GROK_USAGE_FILE") + or Path(tempfile.gettempdir()) / "roboco-grok-usage.json" )