Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Refuse text that is not UTF-8 or holds a NUL at every entry point, the CLI's own flags and create's decoded fields among them, and keep backtraces out of every answer Intent: The maintainer: "yeah, adversarial testing on a scratch repo would be good". The adversarial triage found, as its finding 3, that text that is not UTF-8 or holds a NUL got no reasoned refusal: the CGI crashed and answered 200 with an empty body, and a NUL's refusal carried a 33-line Crystal backtrace with the program's absolute paths, sent to anonymous users. As its finding 4, it found that one bad MCP argument killed the stdio server and got a 500 over HTTP, an edit's old of 200 000 characters among them ("regular expression is too large"). Review then found a NUL written as the JSON escape \u0000 inside create's fields reaching a node, and the CLI's --user and --repository, its tool name and option names, never checked. Expression: Command.read refuses, before any tool reads it, a field name or value that is not UTF-8 or holds a NUL, as "TOOL: FIELD is not UTF-8 text without NUL" (CLI and CGI). Mcp.answer applies the same check to every text an argument holds once its JSON escapes are decoded, the names of nested objects' fields among them (MCP over stdio, HTTP and the Ollama agent), with one walk of a JSON value in Command that create also runs over its fields and a pattern's JSON block before anything is written. The CLI checks its own flags, the tool's name and an unknown option's name, as "ocx2: user is not UTF-8 text without NUL". A failed operation's refusal keeps only the first line of its error, so the child's backtrace that comes after a process fails to start is dropped. edit and wiki_edit count old by splitting the text, not with a regex. Demonstrates: spec/ocx/command_spec.cr, spec/ocx/create_spec.cr, spec/ocx/mcp_http_spec.cr, spec/ocx/checkout_tools_spec.cr; crystal run ci.cr green: 387 examples, 0 failures; coverage 100.0%. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | agent-tools |
| Files: | files | file ages | folders |
| SHA3-256: |
720b6b5cf3dc243cd073cf74dddfd3a5 |
| User & Date: | opus-ocx2 2026-10-18 18:43:23.937 |
Context
|
2026-10-18
| ||
| 18:57 | Refuse a path through a link that leads nowhere or back to itself, and leave links out of find Intent: The maintainer: "yeah, adversarial testing on a scratch repo would be good". The adversarial triage found, as its finding 2, that edit wrote outside the checkout through a link to a file not there yet, and that a path under a link to a directory not there failed with an internal "File exists" message. Review then found a path under a link that leads back to itself failing with an internal message that carried the checkout's absolute path, and find listing and reading a file outside the checkout through a link to it, which read refuses. Expression: CheckoutFiles.inside! refuses, as "PATH leads outside the checkout", a path any part of which, not there, is a link, or cannot be looked at because its links lead back to themselves; nothing is written where such a link leads. CheckoutFiles.walk, which find searches, passes over links, as it passes over hidden files. Demonstrates: spec/ocx/checkout_tools_spec.cr: edit on a link to nothing, on a path under a link to nothing and on a path under a link to itself answers "PATH leads outside the checkout" and creates nothing; find passes over a link to a file outside the checkout; crystal run ci.cr green: 387 examples, 0 failures; coverage 100.0%. check-in: 898527c82d user: opus-ocx2 tags: agent-tools | |
| 18:43 | Refuse text that is not UTF-8 or holds a NUL at every entry point, the CLI's own flags and create's decoded fields among them, and keep backtraces out of every answer Intent: The maintainer: "yeah, adversarial testing on a scratch repo would be good". The adversarial triage found, as its finding 3, that text that is not UTF-8 or holds a NUL got no reasoned refusal: the CGI crashed and answered 200 with an empty body, and a NUL's refusal carried a 33-line Crystal backtrace with the program's absolute paths, sent to anonymous users. As its finding 4, it found that one bad MCP argument killed the stdio server and got a 500 over HTTP, an edit's old of 200 000 characters among them ("regular expression is too large"). Review then found a NUL written as the JSON escape \u0000 inside create's fields reaching a node, and the CLI's --user and --repository, its tool name and option names, never checked. Expression: Command.read refuses, before any tool reads it, a field name or value that is not UTF-8 or holds a NUL, as "TOOL: FIELD is not UTF-8 text without NUL" (CLI and CGI). Mcp.answer applies the same check to every text an argument holds once its JSON escapes are decoded, the names of nested objects' fields among them (MCP over stdio, HTTP and the Ollama agent), with one walk of a JSON value in Command that create also runs over its fields and a pattern's JSON block before anything is written. The CLI checks its own flags, the tool's name and an unknown option's name, as "ocx2: user is not UTF-8 text without NUL". A failed operation's refusal keeps only the first line of its error, so the child's backtrace that comes after a process fails to start is dropped. edit and wiki_edit count old by splitting the text, not with a regex. Demonstrates: spec/ocx/command_spec.cr, spec/ocx/create_spec.cr, spec/ocx/mcp_http_spec.cr, spec/ocx/checkout_tools_spec.cr; crystal run ci.cr green: 387 examples, 0 failures; coverage 100.0%. check-in: 720b6b5cf3 user: opus-ocx2 tags: agent-tools | |
| 17:16 | The owner draft, revised by an adversarial review: one owner per release root, the parent of each run's process, waking by receipt lines Intent: The maintainer, 2026-10-18: "please keep codex-cloud-2 performing adversarial reviews for you", "do try to keep event driven scheduling, rather than polling", "i never opposed the idempotent daemon". Three adversarial reviewers (races; the whole replacement counted; Fossil and Unix as they behave) found the first text breaking its own invariant: a trigger waiting forever on a starting owner, wakes past 4096 bytes interleaving in the pipe, a sweep at every start against decision 39, a failed write waiting with no bound, and Node.end_left removed though 2.13 needs it. Expression: docs/protocol-v2-draft-owner.md: one owner per release root (refusal 7 counts every repository's runs); it is the parent of each run's process, with no worker process; a wake is one line of at most 4096 bytes naming a repository and a receipt range, or check; the owner keeps the receipts it acted on and acts on each once; no trigger waits for the lock or becomes the owner; the owner opens its inbox before it tries the lock; nothing sweeps at an owner's start, as decision 39 says; a write met by an outside writer is tried again after the busy timeout and at each wake; each run's note names its process group for the deliberate check; one task per run writes its answers; what goes, what comes, what callers lose, the demonstrations owed; and two open questions, one of which, whether an owner's death is found without a person asking, would reverse decision 39. Demonstrates: spec/guards/delineation_spec.cr, spec/guards/documents_spec.cr, spec/guards/size_spec.cr; crystal run ci.cr green. check-in: 7d41e87bc6 user: opus-ocx2 tags: agent-tools | |
Changes
Changes to spec/ocx/checkout_tools_spec.cr.
Changes to spec/ocx/command_spec.cr.
Changes to spec/ocx/create_spec.cr.
Changes to spec/ocx/mcp_http_spec.cr.
Changes to src/ocx/cli.cr.
Changes to src/ocx/command.cr.
Changes to src/ocx/commands/create.cr.
Changes to src/ocx/commands/editing.cr.
Changes to src/ocx/commands/sharing.cr.
Changes to src/ocx/log.cr.
Changes to src/ocx/mcp.cr.