mirror of
https://github.com/block/buzz.git
synced 2026-10-29 21:41:33 +00:00
05b496eda4
B1 (F2 — codex v1.1.7 command/file-change approvals):
- Add two extraction paths to `description_from_request_permission`:
4. `params.toolCall.rawInput.command` — codex v1.1.7 command execution
(no title; command string in rawInput). Wire shape cited from tag v1.1.7.
5. `params._meta.codex.params.reason` — codex v1.1.7 file-change
(no title or rawInput; reason in codex metadata). Wire shape cited.
- Two new Rust tests use verbatim v1.1.7 wire shapes from
`buildCommandPermissionRequest` / `buildFileChangePermissionRequest`
in `codex-acp tag v1.1.7 CodexApprovalHandler.ts`. Both go red if the
extraction pointers are changed back.
- Three new PermissionRequestCardBlock component tests (Carl's F2 bar):
hostile markup renders as inert text (no <script>/<b> created),
control characters render safely, description accessible to AT
(not aria-hidden).
B2 (F3 — MessageRow call-site mutation protection):
- Replace `hasPermissionRequestCard` with `selectPermissionRequest` in
`permissionRequestAuthPubkey.ts`: computes the full card payload ONCE,
folding in channelId + isAgent + signer trust + computePermissionRequest.
Returns `PermissionRequestSelection | null` so prose suppression and the
card block share a single result — prose suppressed iff card renders,
by construction.
- MessageRow now calls `selectPermissionRequest(message, isKnownAgentPubkey,
channelId)` once (line 382), uses `permReq !== null` as the prose gate
(line 431), and passes `permReq` to `PermissionRequestCardBlock`.
- Add `MessageRowProseGate.test.mjs`: renders the REAL MessageRow with
a forged-signer sentinel (signerPubkey ≠ registered agent). Asserts
the sentinel body nonce appears in DOM prose. Goes red when line 431
is mutated from `permReq !== null` to `isPermissionRequestSentinel(body)`
(Thufir's exact mutation). Stubs `useAppNavigation` (used by markdown.tsx
and SentFromThreadLine via router hooks) and `MessageActionBar` so the
test runs in JSDOM without a live RouterProvider.
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>