fix: close 2026-09 audit findings (B01-B06) and follow-ups - #74
Conversation
…on, and links - config writer: a key shadowed by a trailing `config-file` include is also appended at the end so the saved value is what the reader resolves (B01) - config watcher: track `config-file` includes (transitive, optional-absent included) via new `noa_config::config_include_paths` (B02) - ipc token: publish via tmp + hard_link (create-if-absent); concurrent first-run provisioners converge on one token (B03) - grid modes: `ModeState::is_tracked` allowlist; unknown modes are no longer retained in the linear-scanned set (B04) - session: 16 MiB file cap and 128-level JSON depth cap so a corrupt file fails as "no session" instead of overflowing the stack at launch (B05) - link_open: reap the `open` child for URIs on a detached thread (B06) Claude-Session: https://claude.ai/code/session_01GBe292wmocEXM8SjBzjGq7
…nd token staging - config_reload: re-derive include watch list on every detected change so includes added/removed by an edit whose reload fails are still tracked - writer: skip the post-include append for repeatable keys (font-family, palette, keybind, ...) so consecutive saves do not accumulate stale entries - ipc auth: retry the staging temp file on AlreadyExists (stale file from a reused PID) and unify the unix/non-unix publish path Claude-Session: https://claude.ai/code/session_01GBe292wmocEXM8SjBzjGq7
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c2aa079f8f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let existing = fs::read_to_string(path).ok()?; | ||
| let trimmed = existing.trim(); | ||
| if trimmed.is_empty() { | ||
| let _ = fs::remove_file(path); |
There was a problem hiding this comment.
When two processes encounter the same pre-existing empty or whitespace-only token file, both can finish read_to_string before either removes it; after the first process removes the empty file and successfully publishes token A, the second process can execute this unconditional remove_file, unlink token A, and then publish token B. Both calls consequently return success with different tokens, so if the first process wins the server bind it authenticates with token A while clients read token B from disk. Removing/replacing the empty file must use an atomic operation that cannot delete a nonempty file published since it was inspected.
Useful? React with 👍 / 👎.
1 participant
Summary
config-fileinclude write-through/watching, ipc tokenhard_linkpublishing,is_tracked, session cap, open-handle reapingfont-family,palette,keybind, …) after an include, avoiding stale accumulated entries on consecutive savesAlreadyExists(stale temp file from a reused PID) and unifies the unix/non-unix publish pathTest plan
cargo test -p noa-config -p noa-app(1211 + 212 pass)cargo test -p noa-ipcoutside sandbox (loopback bind required) — all pass incl. newtoken_staging_collisioncargo clippy --workspace— no new warnings (pre-existing 4 in noa-pty/noa-app untouched)https://claude.ai/code/session_01GBe292wmocEXM8SjBzjGq7