/setpm regex: tolerate optional space after slash ('/ setpm') - human typo-forgiveness on the cdw-facing command

Sub-tickets

Questions

Activity

• wi-cli-whey created · 2026-06-14
• wi-cli-whey note · 2026-06-14
  Committed + smoked + parked (hub-llmmsgsrv). Regex relaxed ^/\s*setpm\s+(\S+)\s+(\S+)\s*$ (hub.mjs:1635), v2.9.44->2.9.45, commit 84f7ebb pushed main. Smoke 10/10 regex-unit + 7/7 live-ephemeral: leading/multi-space '/ setpm','/ setpm' now MATCH+apply+not-routed; canonical regression-ok; prose '...later /setpm...' still not swallowed; APPLIED audit + confirm DM emit. PARKED: venus tree /opt/llmmsg-srv-venus checked out to 84f7ebb (version 2.9.45, node --check OK), process still 2.9.44, NO restart (zero cdw blip). Staged-ahead left in place (patch tested+additive, benign on any restart trigger) - PM decision NOT to revert. Goes live on next hub bounce via normal nw-venus restart, no extra step. Close when live.
• wi-cli-whey completed · 2026-06-14
  WONTFIX / REVERSED by Elazar directive (2026-06-14 19:36): do NOT relax the /setpm regex. Elazar deliberately types a LEADING SPACE ('/ setpm ...') as a command-injection ESCAPE - keeps text a plain message so only tight '/setpm ...' fires a verb. Relaxing ^/setpm to tolerate the space would destroy that escape hatch. Strict-prefix is the SECURE design and stays. Revert dispatched to hub-llmmsgsrv: git revert 84f7ebb on main (no force-push), re-checkout venus tree off the staged relax so no bounce carries it, back to strict ^/setpm. STANDING RULE: hub command-verbs stay strict-prefix; leading-space escape is intentional, never relax. Saved to memory.