fix(scripts): kimi skipped in --parallel, stale progress idx, --path multi-tool guard, rm -rf slug guard (#825)

Four install/convert bugs reported by @sunilkumarvalmiki (#817-#820), each
verified in a sandbox before and after the change.

- convert.sh --tool all --parallel silently skipped kimi: the parallel batch
  listed 11 tools and the sequential batch 2, so the 14th tool ran in neither
  (kimi output: 0 files vs 273 for every other tool). Add kimi to the parallel
  batch — it writes to its own integrations/kimi/<slug>/ dir so it is
  parallel-safe. (#817)
- The sequential batch's progress counter was hardcoded idx=8, stale from an
  older batch size, printing "aider (8/14)" instead of 12/14. Derive it from
  the parallel list length so it can never drift again; now prints 13/14 and
  14/14. Same root cause as #817. (#818)
- --path is a documented single-destination override; with several --tool
  values every tool resolved to the same directory and clobbered each other.
  Refuse --path with more than one tool. Deliberately NOT restricting the path
  itself: the override is the supported way to redirect installs (e.g. to a
  sandbox), and validating it against an expected dir would break that. (#819)
- clean_tool_output runs rm -rf on $OUT_DIR/$1. The tool name is validated
  upstream so this is not reachable today, but a plain-slug guard on $1 makes a
  future direct caller unable to steer it outside $OUT_DIR via "../" or "/".
  A prefix check would not do: "$OUT_DIR/../x" still starts with the prefix. (#820)

Fixes #817
Fixes #818
Fixes #819
Fixes #820

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Michael Sitarzewski
2026-09-02 20:04:22 -05:00
committed by GitHub
co-authored by Claude Fable 5.1
parent 3c9588880b
commit 91d37aa3af
2 changed files with 11 additions and 2 deletions
+6
View File
@@ -1258,6 +1258,12 @@ main() {
$duplicate || _cleaned+=("$_t")
done
_tool_list=("${_cleaned[@]}")
# --path is a single-destination override; with several tools every one of
# them would land in the same directory and clobber each other.
if [[ -n "$OVERRIDE_PATH" && ${#_tool_list[@]} -gt 1 ]]; then
err "--path sets ONE destination; use it with exactly one --tool (got ${#_tool_list[@]}: ${_tool_list[*]})."
exit 1
fi
fi
# Decide whether to show interactive UI