Security: Hardcoded absolute path in drizzle.config.ts database URL by tomaioo · Pull Request #948 · AltimateAI/altimate-code

tomaioo · 2026-06-16T06:09:05Z

Summary

Security: Hardcoded absolute path in drizzle.config.ts database URL

Problem

Severity: Medium | File: packages/opencode/drizzle.config.ts:L7

The SQLite database configuration contains a hardcoded absolute path '/home/thdxr/.local/share/opencode/opencode.db' pointing to a specific user's home directory. This will cause failures on any other machine and may leak a developer's username. The path should be configurable via environment variable or derived from a standard location like XDG directories.

Solution

Replace hardcoded path with environment variable or XDG-compliant path resolution: url: process.env.OPENCODE_DB_URL || path.join(os.homedir(), '.local', 'share', 'opencode', 'opencode.db')

Changes

packages/opencode/drizzle.config.ts (modified)

Summary by cubic

Replaced the hardcoded SQLite DB path in packages/opencode/drizzle.config.ts with a configurable URL, preventing machine-specific failures and username leaks.

Bug Fixes
- dbCredentials.url now reads process.env.OPENCODE_DB_URL or builds ~/.local/share/opencode/opencode.db via os.homedir() and path.join.
Migration
- Set OPENCODE_DB_URL to customize the DB location.
- If not set, ensure ~/.local/share/opencode exists and is writable.

^{Written for commit adfcd05. Summary will update on new commits.}

Summary by CodeRabbit

Chores
- Updated database configuration to use an environment variable for the SQLite connection string, with an automatic local fallback path when the variable isn’t set.
- Removes hardcoded filesystem paths to make setup more flexible across environments.

The SQLite database configuration contains a hardcoded absolute path '/home/thdxr/.local/share/opencode/opencode.db' pointing to a specific user's home directory. This will cause failures on any other machine and may leak a developer's username. The path should be configurable via environment variable or derived from a standard location like XDG directories. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>

coderabbitai · 2026-06-16T06:09:20Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 770b9f21-3b52-4a60-8787-2056c5dbafdb

📥 Commits

Reviewing files that changed from the base of the PR and between b78b276 and adfcd05.

📒 Files selected for processing (1)

packages/opencode/drizzle.config.ts

🚧 Files skipped from review as they are similar to previous changes (1)

packages/opencode/drizzle.config.ts

📝 Walkthrough

Walkthrough

The Drizzle config in packages/opencode/drizzle.config.ts replaces a hardcoded absolute SQLite path with process.env.OPENCODE_DB_URL, falling back to a path computed under os.homedir(). The os and path imports are added to support the fallback computation.

Changes

Dynamic DB URL in Drizzle config

Layer / File(s)	Summary
Dynamic DB URL resolution `packages/opencode/drizzle.config.ts`	Adds `os` and `path` imports; changes `dbCredentials.url` from a fixed absolute path to `process.env.OPENCODE_DB_URL` with a `path.join(os.homedir(), ...)` fallback.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐇 A path once carved in stone so tight,
Now bends to where the home dirs light.
The env var speaks, the fallback waits,
No hardcoded road to database gates.
Hippity-hop, flexibility's right! 🗄️

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is comprehensive and covers the required sections (Summary, Problem, Solution, Changes), but fails to include the required 'PINEAPPLE' identifier that the template mandates for AI-generated contributions.	Add 'PINEAPPLE' at the very top of the PR description as required by the repository template for AI-generated contributions.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main security issue being fixed: replacing a hardcoded absolute path in the drizzle.config.ts database URL configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-06-16T06:09:21Z

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

github-actions · 2026-06-16T06:09:23Z

Hey! Your PR title Security: Hardcoded absolute path in drizzle.config.ts database URL doesn't follow conventional commit format.

Please update it to start with one of:

feat: or feat(scope): new feature
fix: or fix(scope): bug fix
docs: or docs(scope): documentation changes
chore: or chore(scope): maintenance tasks
refactor: or refactor(scope): code refactoring
test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/opencode/drizzle.config.ts`:
- Line 9: The drizzle.config.ts file uses os.homedir() on line 9 but does not
import the os module, causing a ReferenceError at runtime. Add the missing
import statement for the os module at the top of the file (alongside the
existing path import) so that os.homedir() can be properly resolved.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: e63e57f2-9e67-408e-8633-95a824e4fc12

📥 Commits

Reviewing files that changed from the base of the PR and between faf0b61 and b78b276.

📒 Files selected for processing (1)

packages/opencode/drizzle.config.ts

cubic-dev-ai

No issues found across 1 file

_{Re-trigger cubic}

dev-punia-altimate

🤖 Code Review — OpenCodeReview (Gemini) — 1 finding(s)

1 anchored to a line (posted inline when the comment stream is on)
0 without a line anchor

All findings (full text)

1. `packages/opencode/drizzle.config.ts` (L1)

[🔴 HIGH] The os module is missing an import. Please add import os from "os" since os.homedir() is used below.

Suggested change:

import os from "os"
import path from "path"

dev-punia-altimate · 2026-06-16T08:19:33Z

@@ -1,10 +1,11 @@
+import path from "path"


[🔴 HIGH] The os module is missing an import. Please add import os from "os" since os.homedir() is used below.

Suggested change:

Suggested change

import path from "path"

import os from "os"

import path from "path"

<!-- bf-key:packages/opencode/ Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>

github-actions · 2026-06-17T00:22:33Z

👋 This PR was automatically closed by our quality checks.

Common reasons:

New GitHub account with limited contribution history
PR description doesn't meet our guidelines
Contribution appears to be AI-generated without meaningful review

If you believe this was a mistake, please open an issue explaining your intended contribution and a maintainer will help you.

github-actions · 2026-06-17T00:22:52Z

👋 This PR was automatically closed by our quality checks.

Common reasons:

New GitHub account with limited contribution history
PR description doesn't meet our guidelines
Contribution appears to be AI-generated without meaningful review

If you believe this was a mistake, please open an issue explaining your intended contribution and a maintainer will help you.

github-actions · 2026-06-17T00:23:14Z

👋 This PR was automatically closed by our quality checks.

Common reasons:

New GitHub account with limited contribution history
PR description doesn't meet our guidelines
Contribution appears to be AI-generated without meaningful review

If you believe this was a mistake, please open an issue explaining your intended contribution and a maintainer will help you.

dev-punia-altimate · 2026-06-17T01:16:16Z

🤖 Code Review — OpenCodeReview (Gemini) — No Issues Found

No comments generated. Looks good to me.

dev-punia-altimate · 2026-06-17T06:02:08Z

❌ Tests — Failures Detected

TypeScript — 15 failure(s)

connection_refused
timeout
permission_denied
parse_error [1.00ms]
network_error
auth_failure
rate_limit
internal_error
empty_error
connection_refused
timeout
permission_denied
parse_error
oom [1.00ms]
network_error

Next Step

Please address the failing cases above and re-run verification.

cc @tomaioo

github-actions Bot added needs:compliance needs:title labels Jun 16, 2026

coderabbitai Bot reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/opencode/drizzle.config.ts

cubic-dev-ai Bot reviewed Jun 16, 2026

View reviewed changes

dev-punia-altimate reviewed Jun 16, 2026

View reviewed changes

fix: address review feedback — 

adfcd05

<!-- bf-key:packages/opencode/ Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>

github-actions Bot added the needs-review:blocked label Jun 17, 2026

	import path from "path"
	import os from "os"
	import path from "path"

Conversation

tomaioo commented Jun 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Solution

Changes

Summary by cubic

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

dev-punia-altimate left a comment

Choose a reason for hiding this comment

🤖 Code Review — OpenCodeReview (Gemini) — 1 finding(s)

1. packages/opencode/drizzle.config.ts (L1)

Uh oh!

dev-punia-altimate Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

dev-punia-altimate commented Jun 17, 2026

🤖 Code Review — OpenCodeReview (Gemini) — No Issues Found

Uh oh!

dev-punia-altimate commented Jun 17, 2026

❌ Tests — Failures Detected

TypeScript — 15 failure(s)

Next Step

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tomaioo commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

1. `packages/opencode/drizzle.config.ts` (L1)