mirror of
https://github.com/block/buzz.git
synced 2026-10-30 05:51:46 +00:00
d70558f576
F1 — Combined ≤200 UTF-8 byte description with known-key extraction and secret-bearing key redaction. summarize_raw_input extracts command > file/path keys > cwd > reason > compact-JSON-fallback from rawInput; keys matching SECRET_KEY_PREFIXES are replaced with "<redacted>" in the fallback and excluded from named paths. DESCRIPTION_COMBINED_MAX_BYTES (200) replaces the independent DESCRIPTION_RAW_INPUT_BYTES (120) budget so the combined title+context string always fits in one sentinel field. Truncation appends '…'. New tests: scalar/empty-object rawInput → title only; token/password redaction; command priority over path; combined-bound invariant; production-seam sentinel-level bound verification. F2 — RESOLVED_DELIVERY_WINDOW_SECS raised 60→300s (aligned with relay card-maximum and PERMISSION_ASK_TIMEOUT_SECS admission window). New tests: bounded-exit on channel-close (terminal path); same event ID across clones verified. F3 — Cross-layer test: acp_read event with all four adapter option kinds driven through buildTranscript reducer → LifecycleActivity render, asserting exactly 2 buttons (allow_once + reject_once). Rust read-loop coverage: allow_always and reject_always decisions are silently ignored by the card_actions allowlist; only allow_once is accepted and resolves the entry. F4 — Existing early_decision_first_wins test retained; read-loop coverage now includes the allow_always/reject_always rejection path. Routing hazard (same-channel multi-thread) — handle_permission_decision_control now fans out to ALL tasks with matching channel_id instead of finding the first one. The nonce is unguessable so the owning read loop accepts it while siblings drop it on mismatch. Two regression tests: two_threads_same_channel_fan_out_routes_to_owning_thread (Thread B installed first, Thread A's decision still reaches A) and two_threads_same_channel_thread_b_not_stranded (Thread B receives its own decision independently after Thread A's is handled). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>