mirror of
https://github.com/block/buzz.git
synced 2026-10-31 06:21:34 +00:00
e6014bea2c
Thufir pass 1/3 flagged that the sentinel forwarded the adapter's raw option list, letting a durable allow_always surface as an actionable button (F1); the harness admitted up to 16 options while the desktop parser rejected >10 (F2); and requestNonce/optionId/label keys and count/chosenOptionId were unbounded (F3). The three share one root, so freeze the contract end-to-end instead of patching each. select_card_actions picks exactly one allow_once + one reject_once (fail closed if either is absent or ambiguous) and the harness emits only those two; the read-loop decision gate now accepts an option via CardActions::accepts (kind-checked) rather than mere snapshot membership. The desktop parser enforces exactly-two bounded, unique option IDs, bounded nonce, exact label-key count, and chosenOptionId membership. With no allow_always ever surfaced, the hasDurableRule / durableRuleNote disclosure fields are removed. Also fixes the removed PermissionMode::BypassPermissions test reference that broke Rust Lint and Windows Rust (F4), and adds resolved-payload correlation in computePermissionRequest: a resolved edit must name this card (originalEventId === message.id) and its nonce/session/turn must match the pending body it overlays, so a same-signer agent cannot cross-apply a resolution meant for another of its cards (F5). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>