4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	4f95cb6a37	docs: update TODO.md Workflow and Status for the next branching model (closes #106) ... The Workflow section of TODO.md still told contributors to branch from main and merge there. It now describes the current model: one branch per issue cut from next, a PR based on next, an independent reviewer, a squash-merge into next by the manager, and only the owner merging next into main through the milestone PR. The Status paragraph no longer claims work is green on main. Disclosure: only the wrong lines are touched; reflowing the whole file is left to #100. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 19:59:51 +02:00
clawbot	6f416eac31	test: cover redirect SSRF and semaphore release in httpfetcher (closes #78) ... internal/httpfetcher had only helper-level tests. This adds tests of the full Fetch path, with no non-test code changed: a redirect to a private address is refused and never dialed while public redirects and a two-hop chain still work; the per-host semaphore is released on error, after a full read and after a partial read; an oversized body yields ErrResponseTooLarge; non-2xx and disallowed content types are rejected; the dialer blocks private, link-local and loopback targets. What a reader would trip over: the upstream host in the tests is the TEST-NET-1 literal 192.0.2.10, which the private-IP check treats as public; a recording dialer routes it to the local test server and records every dial. Disclosure: DNS rebinding is not simulated end to end (it would mean changing the global resolver under parallel race tests); the dial-time re-resolution is tested directly instead. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 19:59:26 +02:00
clawbot	b95ef1eb69	fix: script/test conditional-verbose-rerun with -cover (closes #59) ... script/test now runs the suite quietly first (with -race and -cover, 30s timeout) and re-runs it with -v only when that run fails, then exits non-zero. This is the pattern REPO_POLICIES.md mandates; before, every green run printed full per-test output. What a reader would trip over: the whole compound command is passed as one string to run_with_cgo_deps, so it behaves the same on the host path and under the nix-shell fallback. -cover is on the first run only; the verbose rerun exists for diagnostics. Disclosure: no test was written for the wrapper script itself; the failure path was exercised by hand by author and reviewer. Disclosure: the nix-shell fallback is kept; moving tests into Docker belongs to #101 and #104. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 19:43:21 +02:00
clawbot	a96eba8083	CSRF protection on the login and URL-generator forms (closes #93) ... Adds CSRF protection to the two cookie-authenticated form posts, POST / (login) and POST /generate, using github.com/gorilla/csrf, the recorded default for this job. The token key is derived from signing_key with its own HKDF salt, so it needs no new config and survives restarts. The token cookie is separate from the session cookie, which also covers login CSRF, where no session exists yet. Both templates carry the hidden token field. What a reader would trip over: outside debug mode the library enforces its https Referer origin check, so the TLS-terminating proxy must preserve the Host and Referer headers from the browser or form posts are rejected. Disclosure: one nolint:gosec on a test constant holding the library field name (G101 false positive). Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 19:26:18 +02:00