fix(root_policy): allow /var paths when temp indexing is opted in by XaviCode1000 · Pull Request #643 · justrach/codedb

XaviCode1000 · 2026-07-03T11:16:11Z

Summary

Move /var and /private/var from the unconditional system_prefixes block list into the tempIndexingAllowed() guard, matching the existing behavior of /tmp and /private/tmp.

This lets Fedora Silverblue and CoreOS users index projects under /var/home/... by setting CODEDB_ALLOW_TEMP=1, without compromising the safe default.

Motivation

On Fedora Silverblue and CoreOS, the user home directory lives at /var/home/<user> instead of /home/<user>. The current blanket block on /var prevents codedb from indexing any project under these homes, even when the user explicitly opts in via CODEDB_ALLOW_TEMP.

Changes

File	Change
`src/root_policy.zig`	Move `/var` and `/private/var` from `system_prefixes` to the `!tempIndexingAllowed()` guard block

Test Plan

Default behavior: /var paths are still denied (existing + new tests)
With CODEDB_ALLOW_TEMP=1: /var/home/<user>/project is indexable
zig build test passes (pre-existing failures unrelated to this change)
zig build -Doptimize=ReleaseSafe compiles successfully

Design Rationale

Reusing CODEDB_ALLOW_TEMP instead of adding a new env var keeps the configuration surface small. Users on affected distros set ONE env var (or pass --allow-temp once) and it covers both the /tmp and /var cases.

Closes #642

github-actions · 2026-07-03T11:16:19Z

👋 Thanks for the contribution! Quick heads-up: this repo lands changes on the current release/* branch, not main.

Please retarget this PR via Edit → base branch to the active release branch (currently release/0.2.5825).

(Automated hint — reply here if you need a hand.)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a7df97c9a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-03T11:18:29Z

    if (!tempIndexingAllowed()) {
        if (isExactOrChild(path, "/private/tmp")) return false;
        if (isExactOrChild(path, "/tmp")) return false;
+        if (isExactOrChild(path, "/private/var")) return false;
+        if (isExactOrChild(path, "/var")) return false;


Keep system /var paths blocked when temp opt-in is set

With CODEDB_ALLOW_TEMP=1 or --allow-temp, this guard is skipped and /var plus /private/var now fall through because they were removed from system_prefixes. That means an opted-in CI/SWE-bench run (or an MCP project argument) can index /var/log, /var/lib, or /private/var/log; the existing issue-407 test documents those paths as containing logs/secrets and never being valid project roots. Please narrow the opt-in to the intended Fedora home/project case (for example /var/home/...) or keep non-home /var subtrees unconditionally denied.

Useful? React with 👍 / 👎.

Move /var and /private/var from unconditionally blocked system_prefixes to the tempIndexingAllowed guard, so they become indexable when CODEDB_ALLOW_TEMP=1 is set. On Fedora Silverblue and CoreOS, user home directories live under /var/home instead of /home. Blanket-blocking /var prevents legitimate use cases like indexing projects in ~/Projects on these systems. The safe default is preserved: /var is still blocked when CODEDB_ALLOW_TEMP is unset, preventing accidental indexing of /var/tmp, /var/log, etc. Users on affected distros simply set CODEDB_ALLOW_TEMP=1 to opt in. (cherry picked from commit 4a7df97)

justrach · 2026-07-04T00:51:52Z

Thanks again for the report and the PR, @XaviCode1000 — this is landing.

What I did (using the maintainer-edit access on the PR): your branch was based on main and targeted release/0.2.5825, which has already shipped, so I retargeted the PR at release/0.2.5828 (the next release branch) and rebased your commit onto it — authorship preserved. Two integration notes:

fix(root_policy): index /var/home projects on OSTree without opt-in (#642) #644 landed first on the release branch: /var/home/<user>/<project> (the OSTree/Silverblue home) is now indexable with no opt-in at all — your normal home projects just work, no env var needed.
Your change rides on top for everything else under /var: --allow-temp / CODEDB_ALLOW_TEMP=1 now unblocks /var and /private/var exactly like /tmp, which also fixes macOS TMPDIR (/private/var/folders/...) and CI workspaces under /var/lib for harnesses that already set the flag. One assertion in your test flipped accordingly (/var/home/xavi/project is now expected indexable by default), and I renamed it to issue-642 to match the issue being fixed.

The ordering matters: the /var/home carve-out is checked before the temp-guard so the no-opt-in path can't be shadowed by the default /var deny.

Validation on the rebased branch: zig build test all green (865 tests), e2e_mcp_test.py 20/20. Merging — ships in 0.2.5828.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76475eecc4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-04T00:53:49Z

+    // (footgun guard) but allowed when temp indexing is opted in (#538, #642)
+    // — CI/SWE-bench harnesses clone into /tmp, and macOS TMPDIR resolves
+    // under /private/var/folders.
+    if (!tempIndexingAllowed()) {


Keep /var/home itself denied under temp opt-in

When CODEDB_ALLOW_TEMP=1 or --allow-temp skips this block, /var/home no longer matches the earlier /var/home/ project rule and /var is no longer in system_prefixes, so isIndexableRoot("/var/home") returns true. On OSTree systems that path is the container for users' home directories; the existing issue-642 expectations deny it by default, while the new opt-in test only checks /var/home/xavi, so an opted-in run that resolves /home to /var/home can scan all homes instead of a project. Please keep /var/home itself denied while allowing only user/project descendants.

Useful? React with 👍 / 👎.

XaviCode1000 mentioned this pull request Jul 3, 2026

--allow-temp flag does not work for paths under /var/ on OSTree systems (Fedora Silverblue/Nobara) #642

Closed

chatgpt-codex-connector Bot reviewed Jul 3, 2026

View reviewed changes

XaviCode1000 changed the base branch from main to release/0.2.5825 July 3, 2026 11:21

justrach mentioned this pull request Jul 3, 2026

fix(root_policy): index /var/home projects on OSTree without opt-in (#642) #644

Merged

justrach changed the base branch from release/0.2.5825 to release/0.2.5828 July 4, 2026 00:41

justrach force-pushed the fix/var-home-is-indexable-with-allow-temp branch from 4a7df97 to 76475ee Compare July 4, 2026 00:51

justrach merged commit 6e1e239 into justrach:release/0.2.5828 Jul 4, 2026

chatgpt-codex-connector Bot reviewed Jul 4, 2026

View reviewed changes

justrach mentioned this pull request Jul 4, 2026

Add Windows warm daemon IPC #641

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(root_policy): allow /var paths when temp indexing is opted in - #643

fix(root_policy): allow /var paths when temp indexing is opted in#643
justrach merged 1 commit into
justrach:release/0.2.5828from
XaviCode1000:fix/var-home-is-indexable-with-allow-temp

XaviCode1000 commented Jul 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 3, 2026

Uh oh!

justrach commented Jul 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

XaviCode1000 commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Changes

Test Plan

Design Rationale

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

justrach commented Jul 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

XaviCode1000 commented Jul 3, 2026 •

edited

Loading