[yiftach-armis]

Related Issue

• PPSC-1799 (subtask of PPSC-1788)

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement

Problem

mcp doctor --deep scans a throwaway file to test the real scan_file path. The scratch repo was created with git init only, so it had no commit. The scanner runs git diff HEAD -- <file> to find the changed lines, and that failed on every run:

WARNING: scan_file: git diff failed for .../.armis-doctor-.../armis_doctor_probe.py: git diff failed: fatal: bad revision 'HEAD'

The scan then fell back to scanning the whole file. So the probe never took the path an editor scan takes for an edited file in a repo, and anyone following mcp doctor --watch saw a git failure that came from the doctor's own probe. I found this while verifying main against v1.25.0.

Solution

initDeepProbeRepo now runs git init, commits an empty armis_doctor_probe.py, and then the probe code is written as an uncommitted change. git diff HEAD now succeeds and returns the probe's two lines as additions.

The scratch commit sets its own identity, commit.gpgsign=false, a nonexistent core.hooksPath, and --no-verify. That way a machine with no git identity, required signing, or global hooks (including an Armis scan hook) can't break it. Setup is still best effort: if git is missing or a step fails, the scan falls back as before.

Testing

Automated Tests

• Unit tests added/updated
• Integration tests added/updated
• All tests passing locally

TestDeepProbeFileDiffsAgainstHEAD points GIT_CONFIG_GLOBAL at a config that requires signing and has a pre-commit hook that always fails. It then checks that git diff HEAD in the probe repo exits 0 and shows the probe content as added lines, and that close() removes the directory. On unfixed main the test fails with fatal: bad revision 'HEAD'.

go test ./...: 3695 passed, 0 failed, 4 skipped. make lint: 0 issues. make build: OK.

Manual Testing

Built the branch and ran it in a sandboxed HOME (no .gitconfig) against the prod API, with MCP server v1.4.1 installed for Cursor:

• armis-cli install cursor --non-interactive, then armis-cli mcp doctor --deep --verbose: 15 passed, 0 warnings, 0 failed, and scan_file succeeded in 2.32s.
• server.log shows Running: git diff HEAD --diff-filter=d --no-ext-diff -U0 -- armis_doctor_probe.py with no git diff failed warning. Before the fix, every --deep run logged that warning once per editor.
• The .armis-doctor-* scratch directory is gone after the run.

Reviewer Notes

• --deep hasn't been released yet and is already under Unreleased in the CHANGELOG, so this PR doesn't add a separate entry.
• The 10-second context that covered the old git init call now covers all three git calls.

Checklist

• Code follows project style guidelines
• Pre-commit hooks pass
• Self-review performed
• Documentation updated (if needed)
• Breaking changes documented (if applicable)
• No new warnings generated

Screenshots (if applicable)

N/A

[github-actions]

 Security Scan Results

✅ No issues

[Copilot]

🟢 Approval recommended

It is a small, isolated, best-effort bug fix whose core behavior and cross-platform -c config handling I verified directly, with accompanying test coverage and no identified issues.

No open issues 🎉

What changed in this PR

This PR fixes a bug in armis-cli mcp doctor --deep. The deep probe scans a throwaway file to exercise the MCP server's real scan_file path, which runs git diff HEAD -- <file> to find edited lines. Previously the scratch repo was created with only git init (no commit), so git diff HEAD failed with fatal: bad revision 'HEAD', the scan silently fell back to scanning the whole file, and users watching mcp doctor --watch saw a spurious git failure originating from the doctor's own probe. The fix seeds the scratch repo with an empty committed probe file before writing the probe code as an uncommitted change, so git diff HEAD succeeds and returns the probe's lines as additions.

Changes:

• Extract repo setup into initDeepProbeRepo, which runs git init, commits an empty armis_doctor_probe.py, then lets the probe content be written as an uncommitted edit.
• Harden the scratch commit against hostile global git config via -c overrides (identity, commit.gpgsign=false, nonexistent core.hooksPath) and --no-verify; keep setup best-effort with a single 10s context covering all three git calls.
• Add TestDeepProbeFileDiffsAgainstHEAD, which forces a signing-required global config plus a failing pre-commit hook and asserts git diff HEAD succeeds with the probe content as added lines and that close() removes the dir.

File	Description
internal/​install/​doctor.go	Adds deepProbeName + initDeepProbeRepo to commit an empty probe file so git diff HEAD succeeds; updates the deepProbeFile doc comment.
internal/​install/​doctor_stall_test.go	New test verifying the probe repo diffs against HEAD under a hostile global git config and that close() cleans up.

_{Review effort: Balanced}