nvidia-holoscan / holoscan-cli / 28717205656

77%

main: 77%

Pull #198

github

fix: add destructive-boundary guard to clear-cache

`clear-cache` fed shutil.rmtree() with directories derived from
env-overridable roots (HOLOSCAN_CLI_BUILD_PARENT_DIR / _DATA_DIR) and
repo-root globs, with no safety boundary. A hostile or fat-fingered
value such as `HOLOSCAN_CLI_BUILD_PARENT_DIR=/` made the command report
`Would remove: /` and, without --dryrun under root, would wipe the
filesystem.

Add `_is_safe_to_remove()`: canonicalize each candidate and refuse it
unless it is (1) not a critical anchor (`/`, $HOME, the repo root) or an
ancestor of one, and (2) at or under an approved cache root (the repo
tree, the build parent dir, or the data dir). Refused paths print a
`Refusing to remove:` notice and are skipped.

Also fix the policy regression where `test --clear-cache` forwarded the
test namespace directly: with build/data/install unset, clear-cache
treated it as "clear everything" including downloaded data. Select
build/install explicitly, matching historical HoloHub behavior.

Add destructive-boundary tests covering /, $HOME, the repo root, an
ancestor of the repo root, the happy path, and data preservation on
`test --clear-cache`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

21 of 22 new or added lines in 2 files covered. (95.45%)

2983 of 3855 relevant lines covered (77.38%)

0.77 hits per line