mirror of
https://github.com/block/buzz.git
synced 2026-11-09 02:41:57 +00:00
f858cabb26
- formatTimelineMessages: after isAuthorizedMessageEdit passes, add sentinel
check — if target content parses as a permission sentinel (v:1), only an edit
signed by the original agent (byte-equal to target.pubkey) may replace the
body. Owner/attacker edits of sentinels are silently dropped, leaving the
authenticated pending body and editSignerPubkey unset. Generic owner-edit
behavior for non-sentinel messages is unchanged.
- 4 integration regression tests in formatTimelineMessages.test.mjs drive the
full formatTimelineMessages → computePermissionRequest path:
1. agent-signed pending + owner-signed resolved edit → pending preserved
2. edit-before-original arrival order → same result
3. attacker-signed edit → pending preserved
4. agent-signed resolved edit → card retires to resolved
- permission-request-card.tsx:1-15: reword doc comment from stale fence-protocol
framing to version-1 bare-JSON sentinel; document wire format and the new
formatTimelineMessages edit gate as a security invariant
- All 4637 desktop tests pass; all 6 gates green
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>