jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-10-30 05:51:46 +00:00

Files

Duncan d70558f576 fix(acp): implement expanded findings F1-F4 + routing hazard

F1 — Combined ≤200 UTF-8 byte description with known-key extraction
and secret-bearing key redaction. summarize_raw_input extracts
command > file/path keys > cwd > reason > compact-JSON-fallback from
rawInput; keys matching SECRET_KEY_PREFIXES are replaced with
"<redacted>" in the fallback and excluded from named paths.
DESCRIPTION_COMBINED_MAX_BYTES (200) replaces the independent
DESCRIPTION_RAW_INPUT_BYTES (120) budget so the combined title+context
string always fits in one sentinel field. Truncation appends '…'.
New tests: scalar/empty-object rawInput → title only; token/password
redaction; command priority over path; combined-bound invariant;
production-seam sentinel-level bound verification.

F2 — RESOLVED_DELIVERY_WINDOW_SECS raised 60→300s (aligned with
relay card-maximum and PERMISSION_ASK_TIMEOUT_SECS admission window).
New tests: bounded-exit on channel-close (terminal path); same event
ID across clones verified.

F3 — Cross-layer test: acp_read event with all four adapter option
kinds driven through buildTranscript reducer → LifecycleActivity
render, asserting exactly 2 buttons (allow_once + reject_once).
Rust read-loop coverage: allow_always and reject_always decisions are
silently ignored by the card_actions allowlist; only allow_once is
accepted and resolves the entry.

F4 — Existing early_decision_first_wins test retained; read-loop
coverage now includes the allow_always/reject_always rejection path.

Routing hazard (same-channel multi-thread) — handle_permission_decision_control
now fans out to ALL tasks with matching channel_id instead of finding
the first one. The nonce is unguessable so the owning read loop accepts
it while siblings drop it on mismatch. Two regression tests:
two_threads_same_channel_fan_out_routes_to_owning_thread (Thread B
installed first, Thread A's decision still reaches A) and
two_threads_same_channel_thread_b_not_stranded (Thread B receives its
own decision independently after Thread A's is handled).

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-09-01 11:09:21 -04:00