harden performance and safety - #18
Merged
Merged
Conversation
…coverage - Pin every GitHub Action to a commit SHA in the CI, docs, and composite action workflows to prevent tag-repointing supply-chain attacks. - Add a supply-chain job that runs `cargo audit --deny warnings`, and wire cargo-audit plus an MSRV toolchain build/test into the flake checks. - Run the verification workflow on both ubuntu-latest and macos-latest. - Cover the new CI contract with an action_contract regression test.
takeokunn
force-pushed
the
feat/harden-performance-and-safety
branch
2 times, most recently
from
July 18, 2026 00:26
ae2f190 to
202a184
Compare
- Replace in-place writes with staged temp-file + atomic-exchange writes that roll back on failure, guarded against symlink and TOCTOU attacks via device and inode identity checks (FilesystemIdentity) and cap-std capability access. - Preserve extended attributes (xattr) and, on macOS, ACLs when rewriting files. - Cap source input at MAX_SOURCE_INPUT_BYTES and content-hash artifacts (blake3). - Skip symlinks during workspace discovery and expose skip counts through an encapsulated Discovery API (files()/into_files()/read_file()). - Relax unsafe_code from forbid to deny so the isolated macOS ACL FFI module can opt in locally; add cap-std, xattr, blake3, and libc dependencies. - Expand the packaging include list and cover symlink refusal with tests.
Untrusted symbol names, paths, and error messages can carry ANSI escapes, bidirectional overrides, and other control characters that spoof or corrupt terminal output. Introduce a terminal_safe wrapper and safe_text! macro that escape these code points, route error chains through terminal_safe_error_chain, and apply the wrapper across every CLI render and workflow path. Add a terminal_output_safety integration test.
…med input - Turn parser panics and silent failures into explicit ParseError variants (DanglingSingleEscape, MissingReaderForm) and bound discarded-form recursion with MAX_DISCARDED_FORM_STACK_FRAMES to resist resource-exhaustion inputs. - Make span replacement bounds- and overflow-checked (replace_span_checked) and propagate Result through Edit::replace and downstream refactorings. - Let the syntax tree own its source text so selections and renames no longer require the caller to re-thread the original input. - Cap diff computation (LCS cells, line/op/output limits) to avoid pathological blowups on adversarial inputs. - Refresh domain and CLI regression tests for the new signatures and errors.
Restructure similarity report collection to reduce redundant traversal and allocation when gathering candidate forms, and preserve collection errors instead of discarding them.
takeokunn
force-pushed
the
feat/harden-performance-and-safety
branch
from
July 18, 2026 00:40
202a184 to
d8c7a85
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要 / Summary
pareditの安全性と性能をハードニングする変更です。信頼できない入力（悪意あるシンボル名・パス・深いネスト・シンボリックリンク）や書き込み中の失敗に対する堅牢性を高め、CI のサプライチェーンを固めます。全体で 199 files, +18,870 / −2,981。テーマ別に 5 コミットへ整理しています。変更内容 / What changed
1.
ci:サプライチェーン / MSRV / macOS 対応cargo audit --deny warningsの supply-chain ジョブを追加、flake checks に cargo-audit と MSRV ツールチェーンのビルド/テストを組み込みaction_contract）で担保2.
feat(io):原子的書き込み + workspace discovery 強化FilesystemIdentity）と cap-std のケーパビリティアクセスを導入MAX_SOURCE_INPUT_BYTESで上限化、成果物を blake3 でハッシュunsafe_codeをforbid → denyに緩和3.
feat(cli):端末出力の制御文字エスケープterminal_safeラッパとsafe_text!マクロで全 CLI 出力パスでエスケープterminal_safe_error_chain経由にterminal_output_safety統合テストを追加4.
refactor(domain):パーサ / リファクタリングエンジンの堅牢化ParseError化、MAX_DISCARDED_FORM_STACK_FRAMESで再帰を有界化（リソース枯渇対策）replace_span_checked）、Resultを伝播5.
perf(similarity):similarity レポート収集の高速化検証 / Verification
cargo build✅ /cargo test✅ 1088 passed, 0 failed /cargo clippy --all-targets✅ /cargo fmt --check✅