Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Refuse a path through a link that leads nowhere or back to itself, and leave links out of find Intent: The maintainer: "yeah, adversarial testing on a scratch repo would be good". The adversarial triage found, as its finding 2, that edit wrote outside the checkout through a link to a file not there yet, and that a path under a link to a directory not there failed with an internal "File exists" message. Review then found a path under a link that leads back to itself failing with an internal message that carried the checkout's absolute path, and find listing and reading a file outside the checkout through a link to it, which read refuses. Expression: CheckoutFiles.inside! refuses, as "PATH leads outside the checkout", a path any part of which, not there, is a link, or cannot be looked at because its links lead back to themselves; nothing is written where such a link leads. CheckoutFiles.walk, which find searches, passes over links, as it passes over hidden files. Demonstrates: spec/ocx/checkout_tools_spec.cr: edit on a link to nothing, on a path under a link to nothing and on a path under a link to itself answers "PATH leads outside the checkout" and creates nothing; find passes over a link to a file outside the checkout; crystal run ci.cr green: 387 examples, 0 failures; coverage 100.0%. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | agent-tools |
| Files: | files | file ages | folders |
| SHA3-256: |
898527c82d725e811607f1c18757e30b |
| User & Date: | opus-ocx2 2026-10-18 18:57:27.079 |
Context
|
2026-10-18
| ||
| 20:09 | Index a post a failed write left before the next write or round, in one turn, and name every clone write whose push failed Intent: The maintainer: "yeah, adversarial testing on a scratch repo would be good". The adversarial triage found, as its finding 1, that a forum write could be stored but never indexed when a writer outside OCX held the repository between the put and the index (on the served repository: create, a node's report; in a clone: post): the answer named no hash, a retry posted twice, and poll --check wrote a second ended; and, as its finding 6, that a clone write whose push met an outside lock was reported failed with no hash although the next sync sent it. Review then found a watcher's ended left so answered again as lost, a node's report whose push failed never sent, the stored post sent on by a later push while the clone never read it, another of OCX's writers able to take a post between its put and its index, and the verdict, wiki page and bundle pushes failing on a lock with no hash. Expression: Place's put_post holds one turn at the repository from its look for stored posts to its index, the turn taken again at once by the fiber holding it (Fossil.turn). Place#index_stored_posts indexes each forum post stored and not indexed, as Fossil's rebuild would; put_post runs it first and answers the hash of the one that is this same post written again (the same cards but the D and Z cards), putting nothing, and a failed index says "the post HASH is stored here but not indexed", why, and that the next post written here indexes it. Node.round and Node.check mend before they decide: they index such posts, and on a clone push what a failed push left. Place#push answers a push fossil failed as one that did not reach the server, so post, ticket comment, verdict, wiki page, bundle, save and a node's report name what the clone holds. A failed poll round appends its hook-log line with its reason, failure. A stand-in fossil for specs (spec/support/stand_in_fossil.cr) fails a chosen command once, or has another writer wait for the next turn after it. Demonstrates: spec/ocx/fossil_spec.cr: a writer waiting for the turn after a post's put finds that post indexed; spec/ocx/post_spec.cr: a post left unindexed is answered by the same post written next, never by another text of its length or the same text to another post, and the next post indexes it, so the clone and the server show the same posts; a post and a change whose push met a lock name their hashes, and a later post sends both; spec/ocx/create_spec.cr: create names the run left unindexed, and run again it indexes it, leaving one post; spec/ocx/watcher_spec.cr: a watcher's ended left unindexed is read by the node's check, which writes no lost; spec/ocx/remote_node_spec.cr: poll rounds whose report was left unpushed or unindexed log why, and the next polls send and index each, one ended each on the server; spec/ocx/verdict_spec.cr, spec/ocx/checkout_tools_spec.cr and spec/ocx/sync_spec.cr: a verdict, a save, a wiki page and a bundle whose push met a lock name the check-in, page or check-ins; crystal run ci.cr green: 393 examples, 0 failures; coverage 100.0%. check-in: ef10d7e83b user: opus-ocx2 tags: agent-tools | |
| 18:57 | Refuse a path through a link that leads nowhere or back to itself, and leave links out of find Intent: The maintainer: "yeah, adversarial testing on a scratch repo would be good". The adversarial triage found, as its finding 2, that edit wrote outside the checkout through a link to a file not there yet, and that a path under a link to a directory not there failed with an internal "File exists" message. Review then found a path under a link that leads back to itself failing with an internal message that carried the checkout's absolute path, and find listing and reading a file outside the checkout through a link to it, which read refuses. Expression: CheckoutFiles.inside! refuses, as "PATH leads outside the checkout", a path any part of which, not there, is a link, or cannot be looked at because its links lead back to themselves; nothing is written where such a link leads. CheckoutFiles.walk, which find searches, passes over links, as it passes over hidden files. Demonstrates: spec/ocx/checkout_tools_spec.cr: edit on a link to nothing, on a path under a link to nothing and on a path under a link to itself answers "PATH leads outside the checkout" and creates nothing; find passes over a link to a file outside the checkout; crystal run ci.cr green: 387 examples, 0 failures; coverage 100.0%. check-in: 898527c82d user: opus-ocx2 tags: agent-tools | |
| 18:43 | Refuse text that is not UTF-8 or holds a NUL at every entry point, the CLI's own flags and create's decoded fields among them, and keep backtraces out of every answer Intent: The maintainer: "yeah, adversarial testing on a scratch repo would be good". The adversarial triage found, as its finding 3, that text that is not UTF-8 or holds a NUL got no reasoned refusal: the CGI crashed and answered 200 with an empty body, and a NUL's refusal carried a 33-line Crystal backtrace with the program's absolute paths, sent to anonymous users. As its finding 4, it found that one bad MCP argument killed the stdio server and got a 500 over HTTP, an edit's old of 200 000 characters among them ("regular expression is too large"). Review then found a NUL written as the JSON escape \u0000 inside create's fields reaching a node, and the CLI's --user and --repository, its tool name and option names, never checked. Expression: Command.read refuses, before any tool reads it, a field name or value that is not UTF-8 or holds a NUL, as "TOOL: FIELD is not UTF-8 text without NUL" (CLI and CGI). Mcp.answer applies the same check to every text an argument holds once its JSON escapes are decoded, the names of nested objects' fields among them (MCP over stdio, HTTP and the Ollama agent), with one walk of a JSON value in Command that create also runs over its fields and a pattern's JSON block before anything is written. The CLI checks its own flags, the tool's name and an unknown option's name, as "ocx2: user is not UTF-8 text without NUL". A failed operation's refusal keeps only the first line of its error, so the child's backtrace that comes after a process fails to start is dropped. edit and wiki_edit count old by splitting the text, not with a regex. Demonstrates: spec/ocx/command_spec.cr, spec/ocx/create_spec.cr, spec/ocx/mcp_http_spec.cr, spec/ocx/checkout_tools_spec.cr; crystal run ci.cr green: 387 examples, 0 failures; coverage 100.0%. check-in: 720b6b5cf3 user: opus-ocx2 tags: agent-tools | |
Changes
Changes to spec/ocx/checkout_tools_spec.cr.
Changes to src/ocx/checkout_files.cr.