Skip to content

Engine's buildFocusManifestGuidance leaks maintainer-authored wantedPaths/preferredLabels into public findings #6770

Description

@JSONbored

Context

packages/loopover-engine/src/focus-manifest/guidance.ts:154-184 interpolates manifest.wantedPaths/matchedWantedPaths/manifest.preferredLabels unfiltered into public-facing findings and publicNextSteps, even though this same function already applies isFocusManifestPublicSafe to testExpectations/publicNotes. Both are freeform maintainer-authored strings with no content restriction at parse time. The identical bug in the sibling host file src/signals/focus-manifest.ts was found and fixed two days ago (commit 4076df12, PR #5967, closing #5945: "filter public-unsafe wantedPaths/preferredLabels from manifest findings") — that fix was never ported to the engine's independent reimplementation. scripts/check-engine-parity.ts's NAMED_TWIN_PAIRS does not register this host/engine pair, so CI's drift tripwire never catches this class of divergence for this file. No test file exists for this module under packages/loopover-engine/test/.

Requirements

  • Filter manifest.wantedPaths through isFocusManifestPublicSafe before interpolating into the manifest_off_focus finding detail (mirror the host's safeWantedPaths fix).
  • Filter matchedWantedPaths through isFocusManifestPublicSafe before interpolating into the manifest_preferred_path finding detail.
  • Filter manifest.preferredLabels through isFocusManifestPublicSafe before interpolating into both the manifest_missing_preferred_label finding detail and the corresponding publicNextSteps entry.

Deliverables

  • Public-safety filtering applied to wantedPaths/preferredLabels in guidance.ts
  • New test file for this module asserting a forbidden term never appears verbatim in any returned finding/publicNextSteps/summary

Test Coverage Requirements

99%+ Codecov patch coverage on every changed line and branch, plus a regression test that reproduces the exact failure mode described above and asserts it's fixed.

Expected Outcome

The engine's manifest-guidance builder can never leak a maintainer-private term into a public-facing finding, matching the already-fixed host behavior.

Links & Resources

packages/loopover-engine/src/focus-manifest/guidance.ts:109-112,154-184,207,230, host fix: src/signals/focus-manifest.ts (commit 4076df12, PR #5967, #5945).

Metadata

Metadata

Assignees

No one assigned

    Labels

    gittensor:bugGittensor-scored bug fix — scores a 0.05x multiplier.help wantedExtra attention is needed

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions