Files

T

CI / build (push) Has been cancelled

Details

Fix 10 audit bugs: path prefix matching, verdict parsing, CORS, stale-task detection, phase mapping

Batch 1 (High severity):
- Bug 1: --audit cat3 now checks .automaton/tasks/ paths
- Bug 4: Verdict PASS/FAIL uses structured ## Status: line parsing
- Bug 5: register-guards.sh checks .json/.jsonc, writes plugin key, strips comments
- Bug 7: --can-edit/--scope-check path prefix uses os.sep boundary

Batch 2 (Medium/Low severity):
- Bug 2: migrate-project.sh find command parentheses for -prune binding
- Bug 3: vram_detect model prefix matching with known-suffix whitelist
- Bug 6: dashboard reads .state file before artifact heuristic fallback
- Bug 8: removed wildcard CORS, added security headers (nosniff, DENY)
- Bug 9: stale-task detection uses .state.lastedit instead of .state mtime
- Bug 10: TEST_PLAN.md maps to test_design (was implement)

249 tests pass (up from 235). All 10 tasks driven through full workflow to completion.

2026-06-22 10:40:58 -04:00

817 B

Raw Blame History

Verdict: fix-can-edit-path-prefix

Status: PASS

Completion Date: 2026-06-22

Summary

The fix correctly prevents sibling-directory bypass at all 5 locations in status.py. All tests pass.

Findings

str(file_path).startswith(proj_str + os.sep) or str(file_path) == proj_str correctly handles path boundaries.
All 5 affected locations use the same consistent pattern.
Bug Finder found no bugs. Adversarial Bug Finder confirmed no issues with symlinks, trailing slashes, or case sensitivity.
No contradictions between the two reports.
Test coverage added: TestCanEditPathPrefix (3 tests covering sibling rejection, subdirectory acceptance, and can-edit-task).
All 242 tests pass.

Tasks for Review / Tie-Breaks

None.

Remaining Issues

None.

Score

+10 (PASS)

817 B Raw Blame History