feat: add config-health — runtime config integrity monitoring#2496
feat: add config-health — runtime config integrity monitoring#2496YuhaoLin2005 wants to merge 3 commits into
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds documentation for the Config Health runtime monitoring layer, including its checks, hook timing, delivery-gate integration, installation configuration, and script coverage. ChangesConfig Health
Estimated code review effort: 1 (Trivial) | ~3 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
| Filename | Overview |
|---|---|
| skills/config-health/SKILL.md | Adds the config-health skill documentation and hook install instructions. |
Reviews (3): Last reviewed commit: "fix: clarify boundary naming + add insta..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
daltino
left a comment
daltino
left a comment
There was a problem hiding this comment.
This PR adds a new skill, config-health, for runtime configuration integrity monitoring. The SKILL.md file is clear, well-structured, and adheres to the contribution guidelines, with a descriptive name, a concise summary of its purpose, and metadata specifying its origin. The addition complements existing functionality (delivery-gate) effectively, providing a proactive layer for identifying issues during the session. No issues spotted with the implementation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/config-health/SKILL.md`:
- Around line 8-22: Add canonical ## When to Activate, ## How It Works, and ##
Examples sections to the config-health skill documentation. Under When to
Activate, specify concrete conditions such as session start, before high-risk
tool calls, and guard-script maintenance checks; under How It Works, describe
the monitoring workflow and responses; under Examples, provide representative
configuration-health scenarios.
- Around line 24-38: Update the Install section in SKILL.md so the hook
configuration is explicitly merged into existing Claude settings rather than
replacing the full hooks object. Add instructions to provision or copy
config-health.py into ~/.claude/scripts/config-health.py and verify that the
file exists before enabling the hooks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: eb49f71c-1f5a-4ce1-8048-609fa90d2e45
📒 Files selected for processing (1)
skills/config-health/SKILL.md
📜 Review details
⏰ Context from checks skipped due to timeout. (28)
- GitHub Check: CodeRabbit / Review
- GitHub Check: Test (macos-latest, Node 20.x, npm)
- GitHub Check: Test (macos-latest, Node 22.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 20.x, bun)
- GitHub Check: Test (macos-latest, Node 18.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 20.x, yarn)
- GitHub Check: Test (macos-latest, Node 20.x, bun)
- GitHub Check: Test (ubuntu-latest, Node 22.x, pnpm)
- GitHub Check: Test (windows-latest, Node 18.x, yarn)
- GitHub Check: Test (macos-latest, Node 18.x, npm)
- GitHub Check: Test (windows-latest, Node 20.x, npm)
- GitHub Check: Test (windows-latest, Node 18.x, pnpm)
- GitHub Check: Test (windows-latest, Node 20.x, yarn)
- GitHub Check: Test (windows-latest, Node 22.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 22.x, npm)
- GitHub Check: Test (windows-latest, Node 18.x, npm)
- GitHub Check: Test (windows-latest, Node 20.x, pnpm)
- GitHub Check: Test (windows-latest, Node 22.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 22.x, bun)
- GitHub Check: Test (ubuntu-latest, Node 22.x, yarn)
- GitHub Check: Test (windows-latest, Node 22.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 18.x, bun)
- GitHub Check: Test (ubuntu-latest, Node 18.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 18.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 20.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 18.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 20.x, pnpm)
- GitHub Check: Coverage
🧰 Additional context used
📓 Path-based instructions (4)
skills/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Skills should be formatted as Markdown with clear sections for When to Use, How It Works, and Examples.
Files:
skills/config-health/SKILL.md
{agents,skills,commands}/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Use lowercase filenames with hyphens (e.g.,
python-reviewer.md,tdd-workflow.md) for agents, skills, and commands.
Files:
skills/config-health/SKILL.md
skills/**
📄 CodeRabbit inference engine (AGENTS.md)
New workflow contributions should land in
skills/first;skills/is the canonical workflow surface.
Files:
skills/config-health/SKILL.md
{skills,commands,agents,rules}/**
⚙️ CodeRabbit configuration file
{skills,commands,agents,rules}/**: Focus on prompt-injection resilience, tool-permission scope, destructive action guards, and secret exfiltration risks.
Files:
skills/config-health/SKILL.md
🧠 Learnings (2)
📚 Learning: 2026-03-15T19:02:43.245Z
Learnt from: imrobinsingh
Repo: affaan-m/everything-claude-code PR: 503
File: skills/data-scraper-agent/SKILL.md:1-748
Timestamp: 2026-03-15T19:02:43.245Z
Learning: In this repository, skill folders should use a lowercase-hyphen name (e.g., data-scraper-agent, claude-api) and the skill description file inside each folder should be named SKILL.md (uppercase). Do not flag SKILL.md as a naming violation; treat SKILL.md as the canonical file name inside each skill directory.
Applied to files:
skills/config-health/SKILL.md
📚 Learning: 2026-04-15T15:52:59.963Z
Learnt from: manja316
Repo: affaan-m/everything-claude-code PR: 1360
File: skills/security-bounty-hunter/SKILL.md:11-18
Timestamp: 2026-04-15T15:52:59.963Z
Learning: In this repository’s skills documentation (skills/**/SKILL.md), use the canonical auto-activation skill section header `## When to Activate`—do not use `## When to Use`. CONTRIBUTING.md and docs/SKILL-DEVELOPMENT-GUIDE.md confirm the required header, and existing skills follow this convention. This header is important for the auto-activation mechanism to detect the correct section.
Applied to files:
skills/config-health/SKILL.md
🔇 Additional comments (2)
skills/config-health/SKILL.md (2)
1-10: LGTM!
40-60: LGTM!
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/config-health/SKILL.md`:
- Line 26: Clarify the boundary statement so `config-health` only warns on
config drift, while `delivery-gate` is explicitly identified as the component
that blocks missing `growth-log` state.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2ff94822-affa-4327-ba92-cddb7123b940
📒 Files selected for processing (1)
skills/config-health/SKILL.md
📜 Review details
⏰ Context from checks skipped due to timeout. (28)
- GitHub Check: CodeRabbit / Review
- GitHub Check: Test (windows-latest, Node 20.x, npm)
- GitHub Check: Test (windows-latest, Node 22.x, yarn)
- GitHub Check: Test (macos-latest, Node 20.x, bun)
- GitHub Check: Test (ubuntu-latest, Node 20.x, bun)
- GitHub Check: Test (macos-latest, Node 22.x, npm)
- GitHub Check: Test (windows-latest, Node 22.x, npm)
- GitHub Check: Test (windows-latest, Node 22.x, pnpm)
- GitHub Check: Test (windows-latest, Node 18.x, yarn)
- GitHub Check: Test (macos-latest, Node 22.x, bun)
- GitHub Check: Test (windows-latest, Node 20.x, pnpm)
- GitHub Check: Test (windows-latest, Node 20.x, yarn)
- GitHub Check: Test (macos-latest, Node 18.x, yarn)
- GitHub Check: Test (windows-latest, Node 18.x, pnpm)
- GitHub Check: Test (macos-latest, Node 18.x, pnpm)
- GitHub Check: Test (windows-latest, Node 18.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 22.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 22.x, bun)
- GitHub Check: Test (ubuntu-latest, Node 22.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 20.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 18.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 18.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 20.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 18.x, bun)
- GitHub Check: Test (ubuntu-latest, Node 22.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 18.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 20.x, npm)
- GitHub Check: Coverage
🧰 Additional context used
📓 Path-based instructions (4)
skills/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Skills should be formatted as Markdown with clear sections for When to Use, How It Works, and Examples.
Files:
skills/config-health/SKILL.md
{agents,skills,commands}/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Use lowercase filenames with hyphens (e.g.,
python-reviewer.md,tdd-workflow.md) for agents, skills, and commands.
Files:
skills/config-health/SKILL.md
skills/**
📄 CodeRabbit inference engine (AGENTS.md)
New workflow contributions should land in
skills/first;skills/is the canonical workflow surface.
Files:
skills/config-health/SKILL.md
{skills,commands,agents,rules}/**
⚙️ CodeRabbit configuration file
{skills,commands,agents,rules}/**: Focus on prompt-injection resilience, tool-permission scope, destructive action guards, and secret exfiltration risks.
Files:
skills/config-health/SKILL.md
🧠 Learnings (2)
📚 Learning: 2026-03-15T19:02:43.245Z
Learnt from: imrobinsingh
Repo: affaan-m/everything-claude-code PR: 503
File: skills/data-scraper-agent/SKILL.md:1-748
Timestamp: 2026-03-15T19:02:43.245Z
Learning: In this repository, skill folders should use a lowercase-hyphen name (e.g., data-scraper-agent, claude-api) and the skill description file inside each folder should be named SKILL.md (uppercase). Do not flag SKILL.md as a naming violation; treat SKILL.md as the canonical file name inside each skill directory.
Applied to files:
skills/config-health/SKILL.md
📚 Learning: 2026-04-15T15:52:59.963Z
Learnt from: manja316
Repo: affaan-m/everything-claude-code PR: 1360
File: skills/security-bounty-hunter/SKILL.md:11-18
Timestamp: 2026-04-15T15:52:59.963Z
Learning: In this repository’s skills documentation (skills/**/SKILL.md), use the canonical auto-activation skill section header `## When to Activate`—do not use `## When to Use`. CONTRIBUTING.md and docs/SKILL-DEVELOPMENT-GUIDE.md confirm the required header, and existing skills follow this convention. This header is important for the auto-activation mechanism to detect the correct section.
Applied to files:
skills/config-health/SKILL.md
🪛 SkillSpector (2.3.7)
skills/config-health/SKILL.md
[warning] 18: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
(Rogue Agent (RA2))
🔇 Additional comments (5)
skills/config-health/SKILL.md (5)
45-54: The install snippet still needs additive merging and script provisioning.This repeats the prior finding: pasting the standalone
hooksobject can overwrite existing hooks such asdelivery-gate, and~/.claude/scripts/config-health.pyis referenced without instructions to install or verify it.
3-18: LGTM!
20-25: LGTM!
28-43: LGTM!
56-67: LGTM!
| rule "双池强制触发" last fired 15 sessions ago → WARN: may be dead | ||
|
|
||
| ## Install | ||
| **Important:** Merge these hook entries into your existing `hooks` object — do not replace it, or you will lose hooks like delivery-gate. Also copy `scripts/config-health.py` to `~/.claude/scripts/config-health.py` and verify it exists before enabling. |
There was a problem hiding this comment.
scripts/config-health.py before enabling the hooks, but this change still does not include that source script. When a user follows the instructions, there is no file to copy into ~/.claude/scripts/config-health.py, so the SessionStart and PreToolUse commands still run a nonexistent Python file instead of starting the config-health monitor.
Rule Used: Review for prompt injection, tool-permission creep... (source)
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
skills/config-health/SKILL.md (1)
51-52: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winLower these hook timeouts
timeoutis in seconds here, so5000and3000make these hooks wait for hours instead of a few seconds. Use5and3if that’s the intended limit.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/config-health/SKILL.md` around lines 51 - 52, Update the timeout values in the SessionStart and PreToolUse hook configurations to use seconds as intended: change 5000 to 5 and 3000 to 3, while preserving the existing commands and hook structure.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@skills/config-health/SKILL.md`:
- Around line 51-52: Update the timeout values in the SessionStart and
PreToolUse hook configurations to use seconds as intended: change 5000 to 5 and
3000 to 3, while preserving the existing commands and hook structure.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3cbd8010-fa65-4dea-bdd5-d2c6fbeb8d14
📒 Files selected for processing (1)
skills/config-health/SKILL.md
📜 Review details
⏰ Context from checks skipped due to timeout. (28)
- GitHub Check: CodeRabbit
- GitHub Check: Test (ubuntu-latest, Node 22.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 20.x, npm)
- GitHub Check: Test (windows-latest, Node 18.x, npm)
- GitHub Check: Test (windows-latest, Node 20.x, npm)
- GitHub Check: Test (macos-latest, Node 20.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 20.x, pnpm)
- GitHub Check: Test (windows-latest, Node 20.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 18.x, npm)
- GitHub Check: Test (windows-latest, Node 18.x, yarn)
- GitHub Check: Test (windows-latest, Node 20.x, pnpm)
- GitHub Check: Test (macos-latest, Node 18.x, yarn)
- GitHub Check: Test (windows-latest, Node 22.x, pnpm)
- GitHub Check: Test (windows-latest, Node 22.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 22.x, yarn)
- GitHub Check: Test (windows-latest, Node 22.x, yarn)
- GitHub Check: Test (macos-latest, Node 18.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 18.x, bun)
- GitHub Check: Test (macos-latest, Node 18.x, npm)
- GitHub Check: Test (macos-latest, Node 20.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 20.x, yarn)
- GitHub Check: Test (ubuntu-latest, Node 22.x, npm)
- GitHub Check: Test (ubuntu-latest, Node 18.x, yarn)
- GitHub Check: Test (windows-latest, Node 18.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 18.x, pnpm)
- GitHub Check: Test (ubuntu-latest, Node 20.x, bun)
- GitHub Check: Test (ubuntu-latest, Node 22.x, bun)
- GitHub Check: Coverage
🧰 Additional context used
📓 Path-based instructions (4)
skills/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Skills should be formatted as Markdown with clear sections for When to Use, How It Works, and Examples.
Files:
skills/config-health/SKILL.md
{agents,skills,commands}/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Use lowercase filenames with hyphens (e.g.,
python-reviewer.md,tdd-workflow.md) for agents, skills, and commands.
Files:
skills/config-health/SKILL.md
skills/**
📄 CodeRabbit inference engine (AGENTS.md)
New workflow contributions should land in
skills/first;skills/is the canonical workflow surface.
Files:
skills/config-health/SKILL.md
{skills,commands,agents,rules}/**
⚙️ CodeRabbit configuration file
{skills,commands,agents,rules}/**: Focus on prompt-injection resilience, tool-permission scope, destructive action guards, and secret exfiltration risks.
Files:
skills/config-health/SKILL.md
🧠 Learnings (2)
📚 Learning: 2026-03-15T19:02:43.245Z
Learnt from: imrobinsingh
Repo: affaan-m/everything-claude-code PR: 503
File: skills/data-scraper-agent/SKILL.md:1-748
Timestamp: 2026-03-15T19:02:43.245Z
Learning: In this repository, skill folders should use a lowercase-hyphen name (e.g., data-scraper-agent, claude-api) and the skill description file inside each folder should be named SKILL.md (uppercase). Do not flag SKILL.md as a naming violation; treat SKILL.md as the canonical file name inside each skill directory.
Applied to files:
skills/config-health/SKILL.md
📚 Learning: 2026-04-15T15:52:59.963Z
Learnt from: manja316
Repo: affaan-m/everything-claude-code PR: 1360
File: skills/security-bounty-hunter/SKILL.md:11-18
Timestamp: 2026-04-15T15:52:59.963Z
Learning: In this repository’s skills documentation (skills/**/SKILL.md), use the canonical auto-activation skill section header `## When to Activate`—do not use `## When to Use`. CONTRIBUTING.md and docs/SKILL-DEVELOPMENT-GUIDE.md confirm the required header, and existing skills follow this convention. This header is important for the auto-activation mechanism to detect the correct section.
Applied to files:
skills/config-health/SKILL.md
🪛 SkillSpector (2.3.7)
skills/config-health/SKILL.md
[warning] 18: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
(Rogue Agent (RA2))
[warning] 18: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
(Rogue Agent (RA2))
2 participants
What
A new skill that adds runtime configuration integrity monitoring to Claude Code — complementing the existing delivery-gate (session-end hard block) with session-duration soft monitoring.
Why
delivery-gate (#2378) checks whether work is complete at session end. But by then, subtle config problems (broken hook wiring, dead rules, guard script staleness) have already affected the entire session. config-health catches these during the session — when they're still cheap to fix.
Defense in Depth
The boundary: "Can this be fixed retroactively?" Config drift = yes → config-health warns. Missing growth-log = no → delivery-gate blocks.
What It Monitors
Design
Integration
Composes with existing ECC skills — not a replacement. Specifically designed to complement delivery-gate (#2378) and growth-log (#2377).