fix: add debug logging to silently swallowed catch blocks

[devin-ai-integration]

Summary

10 bare catch {} blocks across 4 files silently discard all error context, making failures in audit logging, git config resolution, and rules policy loading invisible even when debugging. This adds a shared debugError(context, error) helper that emits CC Safety Net debug: ... messages to stderr when CC_SAFETY_NET_DEBUG=1 is set, consistent with the existing debug logging pattern in hook/common.ts and pi/tool-call.ts.

// env.ts — new helper
export function debugError(context: string, error: unknown): void {
  if (envTruthy(ENV_FLAGS.debug)) {
    console.error(`CC Safety Net debug: ${context}: ${error instanceof Error ? error.message : String(error)}`);
  }
}

Catch blocks changed from bare catch {} / catch { return null } to catch (error) { debugError('...', error); } in:

• audit.ts — audit log write failures (previously "silently ignore errors")
• git/config.ts — resolveGitDirFromDotGit, resolveCommonGitDir, gitConfigFileEnablesRecursiveSubmodules
• rules/policy/sync.ts — repairLocalRulesScope
• rules/policy/scope-policy.ts — isSameConfigPath, legacyRulesConfigNeedsMigration, getRulebookMigratedFrom

All fallback return values are preserved (no behavioral change without CC_SAFETY_NET_DEBUG=1).

Link to Devin session: https://app.devin.ai/sessions/1580eeec7c9c4bbeb8e18289b09f0db3
Requested by: @kenryu42

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[codecov]

Codecov Report

❌ Patch coverage is 42.30769% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.31%. Comparing base (14ec035) to head (feaafa4).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/core/git/config.ts	14.28%	6 Missing ⚠️
src/core/rules/policy/scope-policy.ts	42.85%	4 Missing ⚠️
src/core/env.ts	50.00%	3 Missing ⚠️
src/core/audit.ts	66.66%	1 Missing ⚠️
src/core/rules/policy/sync.ts	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #65      +/-   ##
==========================================
- Coverage   97.40%   97.31%   -0.10%     
==========================================
  Files          94       94              
  Lines       10341    10359      +18     
==========================================
+ Hits        10073    10081       +8     
- Misses        268      278      +10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[greptile-apps]

Greptile Summary

This PR instruments 10 previously bare catch {} blocks across audit.ts, git/config.ts, rules/policy/sync.ts, and rules/policy/scope-policy.ts by introducing a shared debugError(context, error) helper in env.ts that emits a formatted message to stderr when CC_SAFETY_NET_DEBUG=1. All existing fallback return values are preserved and there is no behavioural change when the flag is unset.

• New helper (src/core/env.ts): debugError gates on the existing CC_SAFETY_NET_DEBUG flag and calls console.error, consistent with the project's debug-logging pattern.
• Catch-block updates: All 10 sites — covering audit-log writes, git-dir resolution, submodule-config reading, legacy-config migration checks, and local-scope repair — are updated uniformly; no fallback logic is altered.
• Dist bundles updated: dist/bin/cc-safety-net.js, dist/index.js, and dist/pi/index.js reflect the same changes.

Confidence Score: 4/5

Safe to merge — purely additive instrumentation behind a debug flag, with no change to runtime behaviour when the flag is off.

The change is narrow and well-scoped: every fallback return value is preserved, the new helper is gated behind an existing env flag, and the pattern matches the rest of the codebase. The only open question is whether error.message alone is sufficient for the debug use-case, or whether error.stack would be more actionable.

src/core/env.ts — the new debugError helper is the only file worth a second look, specifically around what error detail is surfaced to the developer.

Important Files Changed

Filename	Overview
src/core/env.ts	Adds debugError helper that writes to stderr behind the CC_SAFETY_NET_DEBUG flag; implementation is correct but omits the error stack trace
src/core/audit.ts	Replaces bare catch {} in writeAuditLog with debugError; fallback behaviour (no-op) is preserved correctly
src/core/git/config.ts	Three catch blocks in git-dir resolution and config parsing are now instrumented; all original return values are unchanged
src/core/rules/policy/scope-policy.ts	Three catch blocks in config-path comparison and migration-check helpers are instrumented; return values preserved
src/core/rules/policy/sync.ts	Bare catch {} in repairLocalRulesScope is instrumented; void function, no return-value concern

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[catch block fires] --> B{CC_SAFETY_NET_DEBUG=1?}
    B -- No --> C[Silent fallback\nreturn null / return false / no-op]
    B -- Yes --> D["console.error(\nCC Safety Net debug: {context}: {message}\n)"]
    D --> C

    subgraph Callers
        E[audit.ts]
        F[git/config.ts resolveGitDirFromDotGit]
        G[git/config.ts resolveCommonGitDir]
        H[git/config.ts gitConfigFileEnablesRecursiveSubmodules]
        I[scope-policy.ts isSameConfigPath]
        J[scope-policy.ts legacyRulesConfigNeedsMigration]
        K[scope-policy.ts getRulebookMigratedFrom]
        L[sync.ts repairLocalRulesScope]
    end

    Callers --> A

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[catch block fires] --> B{CC_SAFETY_NET_DEBUG=1?}
    B -- No --> C[Silent fallback\nreturn null / return false / no-op]
    B -- Yes --> D["console.error(\nCC Safety Net debug: {context}: {message}\n)"]
    D --> C

    subgraph Callers
        E[audit.ts]
        F[git/config.ts resolveGitDirFromDotGit]
        G[git/config.ts resolveCommonGitDir]
        H[git/config.ts gitConfigFileEnablesRecursiveSubmodules]
        I[scope-policy.ts isSameConfigPath]
        J[scope-policy.ts legacyRulesConfigNeedsMigration]
        K[scope-policy.ts getRulebookMigratedFrom]
        L[sync.ts repairLocalRulesScope]
    end

    Callers --> A

Loading

_{Reviews (1): Last reviewed commit: "fix: add debug logging to silently swall..." | Re-trigger Greptile}

[greptile-apps]

Using error.stack (when available) gives the full call chain, which is more actionable when the same catch site can be reached from multiple paths. error.stack already includes the message in all major JS runtimes, so there is no duplication.

Suggested change

	console.error(
	`CC Safety Net debug: ${context}: ${error instanceof Error ? error.message : String(error)}`,
	);
	console.error(
	`CC Safety Net debug: ${context}: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`,
	);

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!