14 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
claw	e414471a16	fix(github): address review feedback on Retry-After implementation ... - Fix data race: copy retryBackoff slice per-request to prevent concurrent doRequest calls from racing on shared state - Fix parseRetryAfter: trim whitespace before parsing for robustness - Fix parseRetryAfter: treat delta-seconds of 0 as valid per RFC 7231 - Add bounded read on success path (10 MB limit) for defense-in-depth - Clean up TestDoRequest_429_RetryAfter_IntegerSeconds: remove dead code block and commented-out reasoning - Fix import ordering: context before errors (goimports compliance)	2026-05-13 05:54:06 -07:00
claw	41e1d48b54	feat(github): support HTTP-date format in Retry-After header ... Implement the github package client with Retry-After header parsing that supports both integer seconds (e.g. "Retry-After: 120") and HTTP-date format (e.g. "Retry-After: Thu, 01 Dec 2025 16:00:00 GMT") per RFC 7231 §7.1.3. Key design decisions: - Use http.ParseTime which handles RFC 1123, RFC 850, and ASCTIME formats - Cap maximum retry delay at 60s (maxRetryAfter) to prevent stalling - If HTTP-date is in the past, use delay of 0 (retry immediately) - Inject time.Now via c.now field for deterministic testing Closes #94	2026-05-13 05:10:52 -07:00
claw	b9b7be3b4e	fix: address review #2888 findings (comment clarity, test cleanup) ... - Clarify depth-aware short-circuit comment to unambiguously describe the relationship between current depth and previous validation depth - Add comment to MappingValueNode case explaining intentional depth+2 behavior from parent MappingNode perspective - Restructure unmarshalYAMLWithDepthLimit doc comment as bullet list covering all three safety checks (depth, multi-doc, strict fields) - Replace t.Error with t.Fatal in TestYAMLEmptyFileRejection to remove redundant nil guard on subsequent err.Error() call	2026-05-12 19:06:52 -07:00
claw	baa917f228	fix: handle MergeKeyNode explicitly in depth check, add size limit to ParsePersonaBytes ... - Add explicit case for *ast.MergeKeyNode in checkYAMLDepth switch to make it clear this is an intentional leaf (no children to recurse) rather than relying on the default case. Prevents future library changes from silently bypassing depth checks. - Add MaxPersonaFileSize bound check at the top of ParsePersonaBytes. While callers already check size, the public API should defend itself (defense in depth) against arbitrarily large inputs that could cause excessive memory/CPU before AST validation runs. - Add tests for both behaviors. Addresses review #2879 findings.	2026-05-12 18:45:48 -07:00
claw	b0352ba1c9	docs: address review findings on YAML depth validation ... - Add safety note on Strict() decoder not expanding aliases recursively, since alias resolution uses the pre-validated AST (finding #1) - Document that ast.Node map keys rely on pointer identity, which holds because all goccy/go-yaml AST types are pointer receivers (finding #2) - Clarify AnchorNode comment: effective depth budget is reduced for anchor+alias pairs, not literally halved (finding #3) - Improve test depth trace comment for accuracy (finding #4) - Add HTML comment in CONVENTIONS.md referencing #91 for the two-step process deviation (finding #5)	2026-05-12 17:39:38 -07:00
claw	0b16c4143a	test: use per-subtest TempDir in TestYAMLEmptyFileRejection ... Move t.TempDir() inside each subtest for idiomatic test isolation, as suggested by reviewers.	2026-05-12 15:22:27 -07:00
claw	493349e11a	fix: correct comment accuracy and improve trailing-content check clarity ... - Fix validated map comment: says 'minimum depth' but stores the maximum depth at which a node was validated (overwritten on deeper visits). - Replace dec.More() with explicit dec.Decode check for trailing JSON content. More() is documented for use inside arrays/objects; the explicit EOF check is clearer at the top-level stream.	2026-05-12 14:51:49 -07:00
claw	5cedeee9f4	address self-review findings on PR #89 ... MINOR fixes: - docs/DESIGN-57-yaml-persona.md: fix Error Cases table entry to reflect custom AST walk (checkYAMLDepth) instead of stale library-level reference - review/persona.go: add EOF check after JSON decode to reject trailing garbage after a valid JSON object (prevents silent acceptance of malformed input like '{"name":"x"}garbage') - review/persona_test.go: add TestJSONTrailingContentRejected test NIT fixes: - review/persona.go: add default case to checkYAMLDepth switch with explanatory comment about scalar leaf nodes - review/persona.go: document AnchorNode depth+1 conservative asymmetry - review/persona.go: simplify redundant if-guard in ListBuiltinPersonas	2026-05-12 14:42:22 -07:00
claw	01b6af03a8	fix(review): address review 2792 feedback ... - Document nodeCount overcounting as intentional conservative behavior (bounds total validation work, not unique nodes) - Improve TestYAMLDeeplyNestedRejection comment with concrete depth trace - Replace outdated gopkg.in/yaml.v3 pseudocode in design doc with reference to authoritative implementation - Update PR description to clarify pre-approval via issue #57	2026-05-12 14:24:06 -07:00
claw	80091fb080	fix(review): address feedback from reviews 2788, 2789, 2791 ... - Move nodeCount increment after cycle detection to avoid over-counting cyclic references (sonnet #2) - Use underscores in test case names used as filenames (sonnet #3) - Fix function comment: 'prevent silent data loss' → 'prevent confusing behavior where additional documents are silently ignored' (sonnet #4) - Mark design doc pseudocode as historical since implementation uses goccy/go-yaml ast.Node, not gopkg.in/yaml.v3 yaml.Node (sonnet #5)	2026-05-12 14:13:59 -07:00
claw	b5f17ddfc4	fix(security): prevent alias depth bypass in YAML validator ... The global 'seen' set allowed anchored subtrees validated at a shallow depth to be skipped when later referenced via alias at a greater depth. This could let effective nesting exceed MaxYAMLDepth, enabling DoS. Fix: replace the single 'seen' set with two tracking maps: - validated (node -> min depth): only short-circuits when current depth <= previously validated depth; re-checks at deeper contexts. - visiting (node -> bool): per-path recursion stack for true cycle detection (breaks alias loops without suppressing depth checks). Add TestYAMLAliasDepthBypass that constructs a document with an anchored 15-level subtree referenced via alias under 6 levels of nesting, verifying the combined effective depth (22) is rejected. Addresses security-review-bot findings on review #2774.	2026-05-12 14:07:05 -07:00
claw	45d009dd06	fix(review): address review feedback on persona YAML handling ... - Reorder empty doc check before multi-doc check for natural flow - Detect nil-body docs (whitespace-only, comment-only input) - Add explanatory comment on pointer identity for cycle detection map - Improve depth-counting test comment with AST walker specifics - Add TestYAMLEmptyFileRejection covering empty/whitespace/comment inputs Addresses MINOR and NIT findings from sonnet, gpt, and security reviews. MAJOR (allowlist violation) tracked in issue #91.	2026-05-12 13:38:48 -07:00
claw	8991260333	fix(deps): replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml ... Fixes #87. PR #58 incorrectly added gopkg.in/yaml.v3 (abandoned library) instead of github.com/goccy/go-yaml as required by issue #57. Changes: - Replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml v1.19.2 - Update review/persona.go to use goccy/go-yaml API: - parser.ParseBytes for AST-based depth/node count checking - yaml.Strict() decoder option instead of KnownFields(true) - ast.Node types instead of yaml.Node for tree walking - Update review/persona_test.go to use ast types for cycle tests - Remove gopkg.in/yaml.v3 from go.mod and go.sum All existing YAML tests pass with the new library.	2026-05-12 13:27:30 -07:00
claw	db479d0ff4	fix: retry on transient LLM response body truncation ... Addresses intermittent 'unexpected end of JSON input' failures where the LLM response body is truncated in transit between the proxy and client. Root cause: network-level truncation where io.ReadAll returns partial data (observed in 3/50 CI runs through HAI proxy). The response body reading was already using io.ReadAll correctly, but transient network issues between the proxy and client can still cause partial reads. Changes: - Add Content-Length validation in doRequest: detect when fewer bytes arrive than the server declared, triggering a retry - Add retry logic in Complete: retries once on retryable errors (body read failures, content-length mismatches) with a 500ms backoff - Add parse-level retry in main: if ParseResponse fails, re-requests from the LLM once before giving up (defensive, since retries always succeed per issue evidence) - Improve ParseResponse error diagnostics: log raw vs cleaned lengths and a preview of the cleaned content to aid future debugging Does NOT retry on API errors (4xx/5xx) or structural issues — only transient body read problems. Closes #47	2026-05-07 00:44:32 -07:00