310 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
aweiker	0be601de2a	Merge pull request 'Removing intermediate files' (#160) from ci/cleanup into main ... Reviewed-on: #160 Reviewed-by: security-review-bot <10+security-review-bot@noreply.gitea.weiker.me>	2026-05-19 02:20:06 +00:00
Rodin	e560781c87	Removing intermediate files	2026-05-19 02:15:06 +00:00
rodin	9673a9d53c	Merge pull request 'fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass' (#152) from issue-150 into main ... fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass	2026-05-18 19:09:30 +00:00
Rodin	eb0ff3aa69	nit(#150): clarify why resolved != symlinkPath in InRepoSymlinkAllowed test ... Add a comment explaining that validateDocmapPath calls EvalSymlinks internally, so the returned path is always the fully-resolved real path and can never equal the symlink entry itself. Addresses sonnet bot NIT (review 4810) against d6bab7a9.	2026-05-15 16:23:11 -07:00
Rodin	c76e7dcd2e	fix(#150): add os.SameFile check after open to close Lstat→open TOCTOU window ... After getting the resolved path from validateDocmapPath, Lstat the path immediately before os.Open, then compare with f.Stat() after open using os.SameFile. If the file was swapped between validation and open (e.g., replaced with a symlink pointing outside the repo), the inode comparison catches it and returns an error. Also changes defer f.Close() // nolint:errcheck to defer func() { _ = f.Close() }() to follow the project convention of explicit ignores over suppressor comments. Addresses security bot finding (review 4812) against d6bab7a9.	2026-05-15 16:23:07 -07:00
Rodin	d6bab7a9cf	fix(#150): close residual TOCTOU with LimitedReader at docmap open	2026-05-15 16:11:15 -07:00
Rodin	4359518e50	nit(#150): report original --docmap flag value in parse error, not resolved path	2026-05-15 16:10:42 -07:00
Rodin	6e11107c77	nit(#150): fix misleading 'this is unreachable' in Lstat comment	2026-05-15 16:10:27 -07:00
aweiker	7f31475330	Merge pull request 'fix(#157): add never-close constraint to spec, S9 invariant, and regression test' (#158) from issue-157 into main ... Reviewed-on: #158 Reviewed-by: security-review-bot <10+security-review-bot@noreply.gitea.weiker.me> Reviewed-by: Aaron Weiker <aaron@weiker.org>	2026-05-15 22:56:44 +00:00
Rodin	ec6fdbff42	fix(#158): address bot feedback — correct S8/S10 description, fix §9 prose break	2026-05-15 15:40:53 -07:00
aweiker	89596516d7	Merge pull request 'refactor(#154): extract baseSubprocessArgs helper in main_test.go subprocess tests' (#155) from issue-154 into main ... Reviewed-on: #155 Reviewed-by: security-review-bot <10+security-review-bot@noreply.gitea.weiker.me> Reviewed-by: Aaron Weiker <aaron@weiker.org>	2026-05-15 21:28:41 +00:00
Rodin	f883f39dbf	fix(#158): address NIT feedback — clarify enforcement split, clean §9 prose	2026-05-15 11:06:49 -07:00
Rodin	345f9a5aac	test(#150): add positive test for in-repo symlink allowed by EvalSymlinks fix ... Finding 5 [NIT] from self-review: TestValidateDocmapPath_InRepoSymlinkAllowed verifies that a file-level symlink inside the repo root whose resolved target is also within the root is accepted by validateDocmapPath. This is the positive case for the issue #150 behavioral change (commit 4dce8e4): only symlinks whose resolved destination escapes the root are rejected. Intra-repo symlinks are permitted and their resolved path is returned to the caller. The test also asserts that the returned path is the resolved real file, not the symlink entry itself (i.e., EvalSymlinks did its job).	2026-05-15 11:06:11 -07:00
Rodin	0fedefad3f	fix(#150): return resolved path from validateDocmapPath to close TOCTOU gap ... Finding 4 [MINOR] from self-review: Previously, validateDocmapPath validated *docmapFlag then returned error only, leaving the caller to re-open the original (unresolved) path via ParseDocMapConfig. In theory, the path could change between validation and use (check-then-use race). Change validateDocmapPath to return (string, error): on success it returns the filepath.EvalSymlinks-resolved absolute path. The caller now passes resolvedDocmap to ParseDocMapConfig instead of the original *docmapFlag string, eliminating any check-then-use window. Also update the test for TestValidateDocmapPath_DirSymlinkBypass to use the new two-value return: _ for the resolved path, err for the error. Low-risk in ephemeral CI but correct by construction.	2026-05-15 11:04:35 -07:00
Rodin	20e9899835	docs(#150): fix stale comments in validateDocmapPath — reflect new in-repo-symlink semantic ... Findings 1-3 from self-review (4dce8e4): Finding 1 [NIT]: remove dead ModeSymlink check and its misleading 'defense-in-depth' comment. After filepath.EvalSymlinks, resolvedPath is guaranteed symlink-free; fi.Mode()&os.ModeSymlink can never be set. Dropped the unreachable branch; updated Lstat comment to say so. Finding 2 [MINOR]: update validateDocmapPath godoc — invariant #2 now reads 'The resolved path is within resolvedRoot' instead of 'The path is not a symlink'. In-repo file-level symlinks whose resolved target stays within the root are allowed; the confinement check enforces the actual invariant. Finding 3 [MINOR]: update inline comment in runValidateDocmap — the bulleted list item now says 'Resolved target stays within the root (in-repo symlinks allowed...)' instead of 'Is not a symlink'.	2026-05-15 11:04:35 -07:00
aweiker	d3b9027da3	Merge pull request 'feat(#141): validate-docmap subcommand' (#156) from issue-141 into main ... Reviewed-on: #156 Reviewed-by: security-review-bot <10+security-review-bot@noreply.gitea.weiker.me>	2026-05-15 17:43:05 +00:00
Rodin	fb7d8d5e3b	fix(#158): add S10 invariant to spec, fix enforcement wording in §8 ... Address MINOR and NIT findings from Sonnet and GPT review of PR #158. MINOR (Sonnet + GPT): No static invariant for 'no close-PR in worker templates'. - Add S10 to §6 Safety Invariants table: checks that no worker template contains close-PR API calls AND every template contains NEVER-close constraint text. - Symmetric to S8 (no merge in worker templates) and S9 (no close in dispatch). NIT (GPT): Enforcement mapping sentence in §8 was ambiguous. - Rewrite to explicitly map: S1+S9 cover dispatch; S8+S10 cover worker templates. NIT (Sonnet): The 'all 7 templates contain NEVER-close text' claim is now verified by S10 (grep-based), not just prose. Implementation: S10 added to check-invariants.sh + Bug-157-S10 regression tests added to dispatch.bats (in rodin/workspace). All 11 invariants pass.	2026-05-15 10:26:14 -07:00
Rodin	bacb25e029	nit(#141): fix stale-docs error message phrasing ... "ERROR: stale docmap docs: entries" had a vestigial "docs:" fragment that reads awkwardly (looks like a YAML reference). Change to: "ERROR: stale docmap entries (paths do not exist):" Addresses NIT finding in review #4175.	2026-05-15 08:15:45 -07:00
Rodin	92efd1af2b	fix(#141): strip leading './' from coverage-check paths ... Non-git tools (e.g. `find`, `ls`) can emit paths with a "./" prefix. Without stripping this, "./cmd/foo.go" would not match the glob "cmd/**", producing a false-positive uncovered-file failure. Fix: add strings.TrimPrefix(f, "./") after backslash normalization. Test: TestRunValidateDocmap_DotSlashPrefix Addresses MINOR finding in review #4175.	2026-05-15 08:15:33 -07:00
Rodin	7adb296523	fix(#141): reject non-regular files in validateDocmapPath ... Add IsRegular() check after Lstat so directories, FIFOs, and device nodes produce a clear error ("docmap must be a regular file") instead of a confusing downstream parse error. Test: TestValidateDocmapPath_NonRegularFile Addresses MINOR finding in review #4175.	2026-05-15 08:15:14 -07:00
Rodin	282b6e0e86	nit(#154): add t.Fatal guard if baseSubprocessArgs flag not found ... Address sonnet NIT: if --repo or --pr is ever removed from baseSubprocessArgs(), the mutation loop silently no-ops and the test becomes meaningless. Adding a found guard and t.Fatal makes the regression immediately visible.	2026-05-15 08:06:18 -07:00
Rodin	6cefbb070e	fix(#157): add S9 invariant and never-close constraint to dev-loop spec ... - Add S9 to §6 Safety Invariants: zero close-PR API calls in dispatch - Document worker ABSOLUTE CONSTRAINTS in §8 Worker Templates - Add §9 entry for Issue #157 explaining the fix All worker templates already contain the NEVER-close constraint from a prior session. This commit makes the spec authoritative. Companion changes in rodin/workspace: - check-invariants.sh: add S9 static check - dispatch.bats: add Bug-157-regression test	2026-05-15 14:47:54 +00:00
Rodin	838a34aa12	chore: cycle status 2026-05-15 14:42	2026-05-15 14:42:27 +00:00
Rodin	6fa3cb9e13	chore(dev-loop): cycle status checkpoint — 2026-05-15 14:26 UTC — steady state, all systems operational	2026-05-15 14:27:28 +00:00
Rodin	8ab45becec	chore(dev-loop): cycle status checkpoint — 2026-05-15 14:18 UTC — steady state, all systems nominal	2026-05-15 14:18:55 +00:00
Rodin	4311ccfa8f	chore(dev-loop): cycle checkpoint — 2026-05-15 13:54 UTC — steady state, all PRs merged, 76.7% coverage	2026-05-15 13:54:48 +00:00
Rodin	fb899ab13e	chore(dev-loop): cycle status checkpoint — 2026-05-15 13:42 UTC — all systems operational, ready for next sprint	2026-05-15 13:42:29 +00:00
Rodin	da7a5224d6	chore(dev-loop): checkpoint 2026-05-15 13:14 UTC — v0.4.0 release prepared, all tests passing, ready for next sprint	2026-05-15 13:15:10 +00:00
Rodin	80b04d1118	chore(dev-loop): cycle status checkpoint — 2026-05-15 13:14 UTC — all systems nominal, ready for next work	2026-05-15 13:14:50 +00:00
rodin	9615519386	chore(release): update CHANGELOG for v0.4.0 v0.4.0	2026-05-15 13:05:07 +00:00
Rodin	166078ba46	chore(dev-loop): final cycle status — all 4 PRs merged, 76.7% coverage, repo ready	2026-05-15 12:31:38 +00:00
Rodin	eeff3ea936	chore(dev-loop): cycle complete — 4 PRs merged, tests passing, 76.7% coverage	2026-05-15 12:17:26 +00:00
Rodin	39cade6dd9	chore(dev-loop): all 4 PRs merged — 2026-05-15 12:15 UTC	2026-05-15 12:10:10 +00:00
rodin	1f58c658ce	Merge pull request 'feat(#143): fetch doc-map config from trusted VCS ref' (#153) from issue-143 into main ... feat(#143): fetch doc-map config from trusted VCS ref Closes #143	2026-05-15 12:09:19 +00:00
Rodin	02dfc12141	fix(#143): skip local doc-map validation when --doc-map-trusted-ref is set ... When --doc-map-trusted-ref is provided, the --doc-map value is used as a VCS API path parameter, not a local filesystem path. The early call to validateWorkspacePath (which requires the file to exist locally) blocked the trusted-ref code path when the doc-map did not exist in the local checkout — defeating the feature's purpose in sparse checkouts or when the file is only on the default branch. Fix: guard the early validation with `&& *docMapTrustedRef == ""`. Also fixes: - review/docmap.go: correct ParseDocMapConfigContent godoc example to match actual source format "owner/repo@ref:path" - cmd/review-bot/main_test.go: add TestMainSubprocess_DocMapTrustedRefSkipsLocalValidation to prevent regression	2026-05-15 12:08:13 +00:00
Rodin	b01e3c487f	feat(#143): fetch doc-map config from trusted VCS ref ... The doc-map YAML config was previously read from the local workspace (the PR branch checkout). A malicious PR author could modify .review-bot/doc-map.yml to map any path glob to sensitive design docs, causing review-bot to fetch and inject those docs into the LLM prompt. Fix: add --doc-map-trusted-ref (DOC_MAP_TRUSTED_REF) flag. When set to a trusted ref (e.g. 'main'), the doc-map config is fetched from the VCS API at that ref instead of from local workspace. A 404 from VCS is a hard error (no silent fallback to local copy). When unset, the local workspace is used with a security warning in the logs pointing operators to the new flag. Changes: - review/docmap.go: add ParseDocMapConfigContent + parseDocMapBytes helper to parse from in-memory content (fetched via VCS API) - cmd/review-bot/main.go: add --doc-map-trusted-ref flag; Step 6c branches on trusted-ref to fetch vs local-workspace load - .gitea/actions/review/action.yml: add doc-map-trusted-ref input - README.md: document new input - CHANGELOG.md: security and feature entries Tests: - TestParseDocMapConfigContent_Valid/Empty/InvalidYAML/UnknownKeys in review/docmap_test.go Coverage: 53.0% cmd/review-bot	2026-05-15 12:08:13 +00:00
rodin	b09f12b8ff	Merge pull request 'test(#146): add TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile' (#151) from issue-146 into main ... test(#146): clarify t.TempDir() evaluation in subprocess env setup Closes #146	2026-05-15 12:07:28 +00:00
Rodin	430e61fdbd	test(#146): clarify t.TempDir() evaluation in subprocess env setup	2026-05-15 12:06:59 +00:00
Rodin	b8aa63e7ba	chore(dev-loop): cycle status 2026-05-15 11:58 UTC — 3 PRs ready, 2 awaiting ai-review	2026-05-15 11:59:22 +00:00
Rodin	d855064765	chore(dev-loop): cycle status 2026-05-15 11:44 UTC — 3 PRs ready, 2 awaiting ai-review	2026-05-15 11:45:27 +00:00
Rodin	38bb01b4b4	chore(dev-loop): cycle status 2026-05-15 11:23 UTC	2026-05-15 11:24:15 +00:00
Rodin	c96ebcc6e0	chore(dev-loop): cycle status 2026-05-15 11:09 UTC — 3 PRs ready, 2 awaiting ai-review	2026-05-15 11:10:22 +00:00
Rodin	34ff4c5c17	chore(dev-loop): cycle status 2026-05-15 10:52 UTC — 4 PRs ready for review, 76.7% coverage	2026-05-15 10:52:11 +00:00
Rodin	eb3770e18c	chore(fmt): align test comments in gitea/ipcheck_test.go	2026-05-15 10:23:11 +00:00
Rodin	77a7f667cb	refactor(#154): extract baseSubprocessArgs helper in main_test.go subprocess tests	2026-05-15 10:18:34 +00:00
Rodin	76b6493628	fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass	2026-05-15 10:18:04 +00:00
Rodin	98479c97cf	test(#146): add TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile	2026-05-15 10:17:39 +00:00
Rodin	3ce606b14a	chore(dev-loop): cycle summary — 4 issues ready for review, 77.1% coverage	2026-05-15 09:38:16 +00:00
Rodin	ffbbdf52d8	chore(dev-loop): status update 2026-05-15 09:37 UTC — 77.1% coverage, 4 PRs ready for review	2026-05-15 09:37:58 +00:00
Rodin	165034351b	chore: dev-loop cycle complete — clean & ready for next sprint	2026-05-15 09:24:20 +00:00