fix(adhoc-sweep-fixes): CU-86akn96pk 3 review findings across 3 files

[flamingo]

Closes 3 review findings across 3 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 90 high	clone_repository leaves target_dir cleanup inconsistent between shallow and full clone failure paths	codewiki/src/fe/github_processor.py:66
2	🟢 90 high	repo_validator.py silently swallows all exceptions when reading git metadata, hiding real errors	codewiki/cli/utils/repo_validator.py:144
3	🟡 75 medium	serve_generated_docs path-traversal guard only checks parents/equality, not symlink resolution, and differs from visualise_docs.py's is_relative_to check	codewiki/src/fe/routes.py:245

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 90e36f49-f8c5-4b9a-a9b0-2d911418acb4

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akn96pk CodeWiki review findings sweep (9 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

3 finding(s) fixed in this draft — 3 explained inline on the diff.

[flamingo]

🦩 🟠 clone_repository leaves target_dir cleanup inconsistent between shallow and full clone failure paths

In GitHubRepoProcessor.clone_repository, added shutil.rmtree(target_dir, ignore_errors=True) cleanup (guarded by os.path.isdir(target_dir)) to both the commit_id branch's initial git clone failure path and the shallow-clone branch's git clone failure path, matching the existing cleanup behavior already present in the checkout-failure path and the outer except Exception handler. This ensures partial/corrupted clone directories are removed consistently on any clone failure.

🤖 Prompt for AI agents

In codewiki/src/fe/github_processor.py around line 66, review and complete this code-review fix: clone_repository leaves target_dir cleanup inconsistent between shallow and full clone failure paths.
What the draft fix changed: In GitHubRepoProcessor.clone_repository, added `shutil.rmtree(target_dir, ignore_errors=True)` cleanup (guarded by `os.path.isdir(target_dir)`) to both the commit_id branch's initial `git clone` failure path and the shallow-clone branch's `git clone` failure path, matching the existing cleanup behavior already present in the checkout-failure path and the outer `except Exception` handler. This ensures partial/corrupted clone directories are removed consistently on any clone failure.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 repo_validator.py silently swallows all exceptions when reading git metadata, hiding real errors

In get_git_commit_hash and get_git_branch, added logger.debug(..., exc_info=True) calls in the except Exception: blocks before returning "", and added a module-level logger = logging.getLogger(__name__) plus import logging. This logs the swallowed exception details at debug level so real errors (corrupted .git, missing dependency, permissions) are traceable without changing observable behavior (still returns empty string).

🤖 Prompt for AI agents

In codewiki/cli/utils/repo_validator.py around line 144, review and complete this code-review fix: repo_validator.py silently swallows all exceptions when reading git metadata, hiding real errors.
What the draft fix changed: In `get_git_commit_hash` and `get_git_branch`, added `logger.debug(..., exc_info=True)` calls in the `except Exception:` blocks before returning `""`, and added a module-level `logger = logging.getLogger(__name__)` plus `import logging`. This logs the swallowed exception details at debug level so real errors (corrupted .git, missing dependency, permissions) are traceable without changing observable behavior (still returns empty string).
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 serve_generated_docs path-traversal guard only checks parents/equality, not symlink resolution, and differs from visualise_docs.py's is_relative_to check

In serve_generated_docs (routes.py), replaced the docs_path_resolved != file_path and docs_path_resolved not in file_path.parents containment check with file_path.is_relative_to(docs_path_resolved), matching the approach used in visualise_docs.py's serve_doc. Added a .md extension allowlist check on filename before resolving paths, and wrapped the .resolve() calls plus containment check in a try/except that raises HTTPException(400, "Invalid file path") on any exception, mirroring the defensive try/except pattern in visualise_docs.py. This brings the two nearly-identical handlers into alignment. Risk: I did not verify whether existing callers rely on serving non-.md files (e.g. module_tree.json/metadata.json are loaded separately via file_manager.load_json, not through this served-file path, so this should be safe) — the reviewer should confirm no legitimate non-.md filenames are ever routed through this endpoint before merging.

🤖 Prompt for AI agents

In codewiki/src/fe/routes.py around line 245, review and complete this code-review fix: serve_generated_docs path-traversal guard only checks parents/equality, not symlink resolution, and differs from visualise_docs.py's is_relative_to check.
What the draft fix changed: In `serve_generated_docs` (routes.py), replaced the `docs_path_resolved != file_path and docs_path_resolved not in file_path.parents` containment check with `file_path.is_relative_to(docs_path_resolved)`, matching the approach used in visualise_docs.py's `serve_doc`. Added a `.md` extension allowlist check on `filename` before resolving paths, and wrapped the `.resolve()` calls plus containment check in a try/except that raises `HTTPException(400, "Invalid file path")` on any exception, mirroring the defensive try/except pattern in visualise_docs.py. This brings the two nearly-identical handlers into alignment. Risk: I did not verify whether existing callers rely on serving non-`.md` files (e.g. `module_tree.json`/`metadata.json` are loaded separately via `file_manager.load_json`, not through this served-file path, so this should be safe) — the reviewer should confirm no legitimate non-`.md` filenames are ever routed through this endpoint before merging.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 75 medium — react 👍/👎 to teach the reviewer