jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-11-13 12:51:34 +00:00

Files

ss-dev-01 60642ca333 fix(desktop): keep quoted literals in agent-activity send previews

An agent posting ordinary markdown lost the text of its own message in the
activity view. `--content 'Fixed `labelForStatus` in the rail'` renders with no
message in it, while the same send in plain prose renders fine.

The cause is that the guard added by #2201 tests characters, not meaning. It
rejects any `--content` containing `$` or a backtick so that
`--content "$(cat file)"` and `"$MESSAGE"` can never be displayed as if the
unexpanded shell expression were the sent text. That intent is right and is kept.
But `tokenizeShellCommand` discards quoting, so by the time the guard runs a
single-quoted literal backtick -- ordinary markdown the shell never touches --
is indistinguishable from a real substitution, and both are dropped. Since
agents write markdown by default, the rejected case is the common one.

Quote context is therefore preserved through tokenization. Each token now
carries `hasSubstitution`, set only where the shell could actually expand
something: `$` and a backtick unquoted or inside double quotes. Inside single
quotes, or after a backslash, they are literal text and the preview survives.
The guard reads that flag instead of scanning characters, so it still rejects
every substitution #2201 was about -- `$(cat file)`, `$MESSAGE`, bare and
prefixed, and a token that concatenates a quoted literal with an unquoted
variable -- and those four tests continue to pin it.

The `$` rule stays deliberately conservative: any unescaped `$` outside single
quotes flags the token, including places bash would leave it literal. Showing a
shell expression as the sent message is the failure being prevented, so it errs
towards dropping the preview.

Verified against bash rather than against a reading of it: for nine command
lines, `bash` was asked for the real argv entry it passes as `--content`. Every
preserved preview is byte-identical to that argv, and every case where the shell
changed the text yields `null`.

Three mutants, each producing a distinct failure set: restoring the character
test fails the four new quoted-literal tests; making substitution tracking never
fire fails eight, four of them #2201's own; and making single quotes stop
protecting fails four. `tokenizeShellCommand` is kept as a string-returning
wrapper so #2201's tokenizer test still exercises the same path.

Not addressed here, and still open in #6834: the rail's missing event-fetch
fallback (part b, gated on a design call) and the latent dot/underscore
`isBuzzMessageSend` mismatch, which has no user-visible path on main.

Desktop suite 5516 passing / 0 failing; typecheck, check and the file-size
ratchet clean.

Refs #6834

Signed-off-by: ss-dev-01 <11939edb7df583f855dbef923f2358f1184538f88ca452e19e7e35e42ad6d796@buzz.block.builderlab.xyz>
Co-authored-by: Bradley Axen <baxen@squareup.com>
Signed-off-by: Bradley Axen <baxen@squareup.com>

2026-08-25 17:47:46 -07:00