Skip to content

mcpx(searchpath): a ~name search-path entry is silently resolved under the caller's own home — ~alice/scripts becomes $HOME/alice/scripts #1702

New issue
New issue
Closed
#2967
Closed
mcpx(searchpath): a ~name search-path entry is silently resolved under the caller's own home — ~alice/scripts becomes $HOME/alice/scripts#1702
#2967
Assignees
dezren39
Labels
app/mcpxPackage/app: mcpx (pkgs/ or apps/ in this repo)effort/sSmall: expected under 2 hours of workkind/bugSomething isn't working (prefixed form of the classic bug label)priority/normalOrdinary priority (the default)source/creatorFiled by the new-issue-creator jobtask/triageQueue packet kind: verify, reproduce, and route this item

Description

@dezren39
dezren39
opened on Oct 28, 2026

Problem

searchpath.Resolve expands any entry starting with ~ into the caller's own home directory. A ~name entry — which in every shell and in the usual ~user convention names that user's home — is silently rewritten to a subdirectory of the caller's home, and a directory literally named ~scratch relative to the working directory can never be named at all.

Evidence (verified this run on main 211aa58f)

  • pkgs/mcpx/internal/searchpath/searchpath.go:117-125 (absolute): strings.HasPrefix(path, "~") matches every leading ~, then filepath.Join(home, strings.TrimPrefix(path, "~")) splices the remainder under the caller's home. There is no distinction between ~, ~/… and ~name[/…].
  • Probe executed this run on the laptop (~/git/fleet/probe-2026-10-28-lanea-searchpath/, searchpath.go copied verbatim, sha256 92c048ed…; log in the goal's hidden_files/probe-2026-10-28-laneA-searchpath/probe.log), with HOME=/home/testhome:
    • ~alice/scripts → /home/testhome/alice/scripts
    • ~nosuchuser/scripts → /home/testhome/nosuchuser/scripts
    • ~scratch → /home/testhome/scratch
    • Controls correct: ~/scripts → /home/testhome/scripts, ~ → /home/testhome
  • The resolved list is what actually gets searched: internal/cli/scripts.go:58 (scriptPath, from the paths.scripts setting / MCPX_PATHS_SCRIPTS), internal/cli/scripts.go:164 (PlaceholderFiles, paths.placeholders), and internal/daemon/consumer.go:145 (recipeDirs) all pass configured entries through Resolve.
  • searchpath_test.go has no ~ test at all, so neither the correct control cases nor the ~name misresolution are pinned.
  • Describe() (searchpath.go:259) renders the already-rewritten absolute path, so the "why is it not finding my script" diagnostic confidently shows a directory the user never wrote.

Why it matters

Configured search paths are user-typed configuration. A user who writes ~alice/scripts (a shared/team account's scripts) is silently searched in a lookalike directory under their own home instead — scripts are not found, and if $HOME/alice/scripts happens to exist, the wrong scripts are found and run with no hint why. Silent misresolution in a path that decides which code executes is worse than an error.

Acceptance criteria

  • ~ and ~/… keep expanding to the caller's home (existing correct behaviour, now pinned by tests).
  • A ~name[/…] entry is not resolved under the caller's home: triage pins the rule — expand to that user's home where the platform supports it, or leave the entry unexpanded/refuse it with a clear diagnostic — and the chosen rule is documented at absolute.
  • Regression tests in internal/searchpath cover ~alice/scripts, a ~name for a nonexistent user, ~, and ~/scripts.
  • Describe() output for a ~name entry matches the locations Find/List actually search.
  • Existing internal/searchpath, internal/cli and internal/daemon tests keep passing.

Activity

  1. dezren39
    added
    kind/bugSomething isn't working (prefixed form of the classic bug label)
    task/triageQueue packet kind: verify, reproduce, and route this item
    status/needs-triageNot yet triaged; needs a first look
    source/creatorFiled by the new-issue-creator job
    priority/normalOrdinary priority (the default)
    queue/queuedHas a queued task in the Supabase agent queue
    on Oct 28, 2026

  2. developing-today commented on Oct 28, 2026

    @developing-today
    developing-todayBot
    on Oct 28, 2026 – with developing.today
    Contributor

    CODE-682

  3. dezren39
    added
    app/mcpxPackage/app: mcpx (pkgs/ or apps/ in this repo)
    effort/sSmall: expected under 2 hours of work
    on Oct 28, 2026

  4. dezren39 commented on Oct 28, 2026

    @dezren39
    dezren39
    on Oct 28, 2026
    MemberAuthor

    🤖 Agent note · filed

    • Agent: new-issue-creator (new-issue-creator-code-a)
    • Session / ID: new-issue-creator-code-a cron run 2026-10-28T15:05Z
    • Found via: filed this run
    • Task: Triage the ~name search-path misresolution in internal/searchpath (absolute rewrites any leading ~ under the caller's home) and pin the ~name rule.
    • Expectation: effort/s; done when ~ and ~/ still expand, ~name is no longer spliced under the caller's home, and regression tests cover all four shapes.
    • Links: probe on laptop ~/git/fleet/probe-2026-10-28-lanea-searchpath/ (log: goal hidden_files/probe-2026-10-28-laneA-searchpath/probe.log)

  5. dezren39 commented on Oct 28, 2026

    @dezren39
    dezren39
    on Oct 28, 2026
    MemberAuthor

    Cross-link: companion issue filed this run in the same package — #1704 (List reports a shadowed name as ambiguous although Find resolves it). Different defect (List/Find disagreement vs this issue's absolute() name misresolution); both verified by the same laptop probe (/git/fleet/probe-2026-10-28-lanea-searchpath/).

  6. github-actions
    assigned
    dezren39
    on Oct 28, 2026
  7. dezren39
    added
    work/assignedQueue worker lifecycle state
    and removed
    status/needs-triageNot yet triaged; needs a first look
    queue/queuedHas a queued task in the Supabase agent queue
    on Oct 31, 2026

  8. 14 remaining items

  9. dezren39
    removed
    queue/claimedQueue worker lifecycle state
    on Oct 31, 2026

  10. dezren39 commented on Oct 31, 2026

    @dezren39
    dezren39
    on Oct 31, 2026
    MemberAuthor

    🤖 Agent note · parked

  11. dezren39 commented on Oct 31, 2026

    @dezren39
    dezren39
    on Oct 31, 2026
    MemberAuthor

    🤖 Agent note · parked

  12. dezren39
    added
    queue/claimedQueue worker lifecycle state
    status/in-progressQueue worker lifecycle state
    and removed
    status/parkedDeliberately paused with a recorded resume condition
    queue/parkedQueue task is parked (waiting on CI, time, or an event)
    on Oct 31, 2026

  13. dezren39 commented on Oct 31, 2026

    @dezren39
    dezren39
    on Oct 31, 2026
    MemberAuthor

    🤖 Agent note · picked up

  14. dezren39
    added a commit that references this issue on Oct 31, 2026

    fix(mcpx): searchpath expands only ~ and ~/ — ~name stays a literal r…

    6bee50a
  15. dezren39
    closed this as completedin #2967on Oct 31, 2026

  16. dezren39 commented on Oct 31, 2026

    @dezren39
    dezren39
    on Oct 31, 2026
    MemberAuthor

    🤖 Agent note · done

  17. dezren39
    removed
    status/in-progressQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    on Oct 31, 2026
  18. dezren39
    added a commit that references this issue on Nov 2, 2026

    fix(mcpx): source abs() expands home only for bare ~ and ~/ (#2988) (#…

    fa28f49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

app/mcpxPackage/app: mcpx (pkgs/ or apps/ in this repo)effort/sSmall: expected under 2 hours of workkind/bugSomething isn't working (prefixed form of the classic bug label)priority/normalOrdinary priority (the default)source/creatorFiled by the new-issue-creator jobtask/triageQueue packet kind: verify, reproduce, and route this item

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions