Repository navigation
fix(security): approval binding, chip authorship and task lifecycle follow-ups (#97 #106 #111) - #135
Conversation
Held-send invalidation, session-chip authorship, and task records still had the gaps ThinkFlowLab#97/ThinkFlowLab#106/ThinkFlowLab#111 named after ThinkFlowLab#52/ThinkFlowLab#53/ThinkFlowLab#54. Pin sender-side Chief replacement, refuse unknown invalidateFor fields, and re-check in-flight approves before dispatch. Gate chips on answer-question and schedule-create, key schedule-create authz off target, and strip chips from Bot group posts. Link holds per task, protect result-ready from prune, and allow-list task endpoints. Clarification and workBotId wait on ThinkFlowLab#55. Co-authored-by: Danyang Chen <birfychen@gmail.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f7195c414a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (typeof text !== 'string' || !text.includes('dsh-session:')) return text | ||
| return text | ||
| .replace(/@\[((?:\\.|[^\]\\])*)\]\(dsh-session:[A-Za-z0-9_-]+\)/g, (_, label) => `@${String(label).replace(/\\([\\\]])/g, '$1')}`) | ||
| .replace(/dsh-session:[A-Za-z0-9_-]+/g, '') |
There was a problem hiding this comment.
When a Bot posts a nested marker such as @[secret](dsh-sessiondsh-session:x:ImQi), the canonical-chip replacement does not match, and this one-shot replacement removes only the inner dsh-session:x, yielding the valid canonical chip @[secret](dsh-session:ImQi). postToRoom then puts that result into the group's user-shaped message, so DSH can attach session d's snapshot and bypass the shared-room privacy gate; neutralize the marker until stable (or escape it) and add a nested-marker regression.
AGENTS.md reference: AGENTS.md:L18-L18
Useful? React with 👍 / 👎.
| return ok(await rt.scheduleEndpoint(endpoint, body)) | ||
| case 'schedule-create': { | ||
| await rt.load() | ||
| const leaked = unshareableReference(actor, [body.title, body.prompt].filter(part => typeof part === 'string').join('\n')) |
There was a problem hiding this comment.
When either newly guarded path receives a real menu-generated reference, session a is represented by sessionMention() as dsh-session:ImEi, but unshareableReference passes ImEi directly to sessionOwnedBy rather than base64url-decoding it to a. Consequently an owner referencing their own chat is rejected as bot/forbidden by schedule-create and answer-question; reuse the canonical decoder already present in hooks.js and test encoded chips rather than raw IDs.
AGENTS.md reference: AGENTS.md:L18-L18
Useful? React with 👍 / 👎.
…oads - stripSessionChips loops until stable so nested dsh-session markers cannot reconstitute a valid chip in group posts (ThinkFlowLab#106 Codex P1). - unshareableReference base64url-decodes menu chip payloads before sessionOwnedBy, so schedule-create / answer-question accept own chips (ThinkFlowLab#106 Codex P2). Co-authored-by: Danyang Chen <birfychen@gmail.com>
Follow-ups for #97, #106 and #111.
#97 approval binding
setMaininvalidation, not astaleReasoncause.invalidateForthrows on an unknownfield.approvedrecords are included in invalidation andrelease()re-checks right beforedispatch().#106 chip resolution
answer-questionandschedule-create;schedule-createauthz keys offbody.target.postToRoomstripsdsh-session:chips from Bot-authored group posts.#111 task lifecycle
meta.taskId, or the Bot's only working task); rejecting one card no longer cancels all.result-readytasks are protected from pruning.task-*prefix.workBotId(need [Team] Recover task handoffs without duplicate work #55 exchange wiring).Verified:
ARCH_DOCS_BASE=upstream/main npm run verifypasses.