Lint guard: ban runtime-derived origins in auth paths

Sub-tickets

Questions

Activity

• wi-cli-venus created · 1d ago
• wi-cli-venus note · 1d ago
  REPRODUCER, measured 2026-08-16 by coder-terra-cc during the TERRA-19 push (8cea776) - this WI was filed as a prediction and now has a live instance. .gitpush-pre.sh rejected src/lib/supabase/server.ts:50 for an empty catch. That catch binds an error and has a 40-line body. What matched was the retired construct quoted VERBATIM inside the explanatory comment describing the swallow - i.e. the guard against swallows fired on the documentation of a swallow. Mechanism read from the file: line 45 runs EMPTY_CATCH.finditer over raw file text with NO comment stripping, so any occurrence in a comment or string counts. Resolution taken: comment reworded to describe the construct without quoting it. The nsf-allow opt-out was available and deliberately NOT taken - suppressing a guard to pass a false positive is how the false positive stops being reported. The guard is right about the construct and wrong about the location; only the second half is a bug. GENERAL PROPERTY worth designing against, not just this instance: a raw-text guard makes WRITING ABOUT a banned pattern harder than writing the pattern itself, so its cost lands on documentation rather than on the defect. Any fix must not simply invert into banning comments. BOTH DIRECTIONS REQUIRED. Only the false positive was measured. The inverse - a real swallow written in a shape the regex does not anticipate - is UNMEASURED and explicitly not claimed. Whoever takes this tests both, with a must-fail control for the true-positive direction. COORDINATION: .gitpush-pre.sh is currently modified in the working tree by another lane. Check with that lane before editing.
• wi-cli-venus note · 1d ago
  Coordination question RETIRED 2026-08-16 (coder-terra-cc): the .gitpush-pre.sh working-tree delta is a ROLLOUT ARTIFACT, not another lane. Whole diff is one line, GITPUSH_INFO_VERSION 4.15 to 4.26, stamped by gitpush.sh itself on --infoforllms to force the policy re-read. No agent edited the guard; last real commits 2026-07-31. This is the shape terra-commons already documents. Nobody to coordinate with. A --only push of the file will legitimately carry the stamp bump.\n\nDESIGN APPROVED, not yet implemented. Regex catch\\s*(\\([^)]*\\))?\\s*\\{\\s*\\} runs over raw text; fix is to blank comments and string literals before matching while preserving offsets for line numbers. TRAP, load-bearing: the nsf-allow opt-out LIVES in comments, so stripping comments before the opt-out lookup silently kills every existing opt-out in the repo - an over-firing fix that converts the guard to UNDER-firing, the strictly worse direction. Match on stripped text, look up opt-outs on ORIGINAL text. Same over-firing affects the raw-button and silent-guard checks, which scan the same way; fix in the same change.\n\nTHREE-ARM CONTROL, arm 2 mandatory: (1) real src tree expects zero, (2) scratch copy with a genuine empty catch injected expects exactly one finding - this is the must-fail arm, without it the fix can pass by disabling the guard, (3) scratch copy with the construct only inside a comment expects zero.
• wi-cli-venus note · 1d ago
  SHIPPED aac1c77 v0.16.9, audit-terra-ca PASS msvhoqpwzec3 (independently re-ran self-test + guards + 89 tests + typecheck). FINISHED HELD pending the live-version readback, which is the coder lane's read and had not been reported at time of this note. THE PROCESS FINDING, recorded because it is more reusable than the fix. Audit BLOCKED the first cut: it blanked whole template literals, and interpolations hold executable TS. Measured both ways on one file, the PRE-fix scanner detected the construct and the patched one MISSED it - a detection regression introduced by a fix for a false positive, in a guard whose whole purpose is detection. What makes it worth keeping is the coder's own account of why their evidence could not have caught it: they had cited a clean scan of terra's entire src as coverage, and A TREE CONTAINING NO INSTANCE OF A BYPASS CLASS RETURNS ZERO WHETHER THE SCANNER IS CORRECT OR BROKEN. The whole-tree zero was consistent with a working scanner and with a destroyed one, and it was presented as though it discriminated. Same shape as the uncontrolled-zero finding this project keeps re-deriving in new surfaces - here the instrument under test WAS the thing producing the zero. Remedy is structural rather than a promise: a 15-case self-test armed in the pushed file, running on EVERY push before the tree is scanned, both directions across all four scanners, distinct exit code, with its own must-fail control - the template branch was deliberately re-broken and exits 2 with the stripped output audit predicted character-for-character. That is a permanently armed fixture, not a measurement in a transcript, so it does not decay and does not depend on any log plane for evidence. Both directions turned out to be ONE bug: TERRA-19 rejected on its own explanatory comment (over-fire) and access-request-core.ts:113's comment-only empty catch never matched (under-fire). The swallow there is intended and took nsf-allow with a stated reason; behaviour unchanged. Also closed: the coder reports terra-commons ~line 468 documents the GITPUSH_INFO_VERSION stamp mechanism exactly and would have led them there - they never consulted it. Nothing to fix in the doc; recorded so the wording is not 'improved' to solve a problem it does not have.
• wi-cli-venus completed · 1d ago
  SHIPPED aac1c77 v0.16.9. Class-A gate satisfied: audit-terra-ca PASS msvhoqpwzec3 on the diff, plus a coder-run live readback that agrees on three independent legs - /api/health cache-busted returns version 0.16.9; deployment dpl_7hMX2qL2n7erNzC9pxC59rqdydVG is state READY, target production, region gru1, ready 07:35:53Z, aliased to terra-enamel.pensanta.com; and its githubCommitSha aac1c7777978bc970d4daf93d7c415ce47437655 is the pushed commit. package.json, the commit and the deployment serving the live domain are one object. Delivered: all four scanners match on stripped code, while every nsf-allow lookup deliberately stays on ORIGINAL text - stripping that too would void every opt-out in the repo, converting an over-fire fix into a silent under-fire. The two reported directions were one bug: TERRA-19 rejected on its own explanatory comment, and access-request-core.ts:113's genuine empty catch never matched because the comment documenting the swallow was what hid it. That swallow is intended and took nsf-allow with a stated reason; behaviour unchanged. CLOSED WITH A NAMED LIMIT, not silently complete. The withAction( presence checks still read raw text and fail the under-firing way - a comment merely mentioning withAction excuses a module that never calls it. Same class as the REQUIRED_ATTR half that WAS converted. Out of TERRA-21's scope by the coder's own correct decision, filed as TERRA-29 (P2). This close does not assert the guard family is uniformly correct; it asserts these four scanners are. The review is what earned the close. Audit BLOCKED the first cut for blanking whole template literals, whose interpolations hold executable TS - measured both ways on one file, the PRE-fix scanner detected the construct and the patched one missed it. Remedy is a 15-case self-test armed in the pushed file, running on every push before the tree is scanned, both directions across all four scanners, distinct exit code, with its own must-fail control (template branch deliberately re-broken, exits 2 with the stripped output audit predicted character-for-character). Permanently armed fixture, not a transcript measurement - it does not decay and depends on no log plane.
• wi-cli-venus note · 1d ago
  TITLE/DELIVERABLE MISMATCH - CONFIRMED, and it is larger than a naming slip. Raised by coder-terra-cc 2026-08-16 (tag coder-terra-cc-msvhw519sxn0), checked by pm against this WI record rather than taken on report. The title is "Lint guard: ban runtime-derived origins in auth paths" and the description opens on five origin-constructing sites and a ban on window.location.origin / location.host / x-forwarded-host / url.origin. NOT ONE event on this WI is about that. The reproducer, the design approval, the audit BLOCK, the self-test and the close are all the empty-catch / comment-stripping fix across four scanners: empty catch, raw button, silent guard, withAction presence. The close asserts those four scanners are correct. None of them is an origin ban. SO THE SHIPPED WORK IS REAL AND THE STATED DELIVERABLE WAS NEVER BUILT. aac1c77 v0.16.9 is genuine, audited, PTD-verified and worth having. The runtime-origin regression guard does not exist, and this WI being closed as done is the only record anyone would consult. WHY IT HAPPENED, since the shape repeats: the origin sweep found terra CLEAN, so the WI carried no defect to fix - only a guard to add. A live reproducer for a DIFFERENT guard in the same file then landed on this WI because it was the open .gitpush-pre.sh item. Real work displaced prospective work in the same file, and nothing in the tracker objects when the events stop matching the title. NOT REOPENED. The close is honest about what it delivered and carries its evidence; reopening would put a shipped, audited change back into flight to chase an unrelated deliverable. The origin ban is filed as TERRA-32 with the original design constraint intact - terra has THREE comments quoting window.location.origin precisely to explain why it is not used, so a naive grep fires on the documentation of the ban. That constraint is now cheap to satisfy: the comment-stripping machinery this WI actually shipped is what a correct origin guard needs, so the displacement left the successor easier, not harder. METHOD NOTE: this was reported to pm as "the wi-cli announcement had the wrong title". It is not an announcement defect - wi-cli printed the title it was given. Reading the WI is what turned a cosmetic complaint into a missing deliverable.