fix(system): sanitize relay-derived terminal output by nicodes · Pull Request #70 · nicodes/ormos

nicodes · 2026-08-23T19:35:11Z

Summary

sanitize relay error/status text before live-terminal login errors and headless log echo, with a fixed non-empty fallback
sanitize pairing code/URL at the relay boundary and reject values that become empty
add reachable output-path tests and a narrow AST source gate with an explicit %q allowlist

Risk

Risk: high — untrusted relay data crosses live terminal and headless log output boundaries.

Acceptance contract

Implements only the final Correction (2026-08-23): active batch contract on nicodes/ormos-be#420. The earlier unusable batch section remains untouched. audit.jsonl bidi handling remains explicitly out of scope, and no backend API behavior changes.

Links nicodes/ormos-be#420
Epic: nicodes/ormos-be#493

Verification

mise exec -- go test -count=1 ./internal/system -run '^(TestRelayDerivedOutputGate|TestLoginErrorOutputSanitisesRelayText|TestDeviceStartRejectsValuesEmptyAfterSanitising|TestHeadlessPortsPollEchoSanitisesRelayStatus)$'
test -z "$(mise exec -- gofmt -l .)"
mise exec -- go vet ./...
mise exec -- go test -race -count=1 ./...
mise exec -- govulncheck ./... (0 reachable vulnerabilities)
release cross-build/archive/version gate for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64
platform-selection gate for unsupported targets and supported Linux/Darwin builds

Deliberate source-gate failure proof

Temporary reachable mutation after performLogin in runSystem:

fmt.Fprintln(os.Stderr, err) // deliberate relay-output gate failure proof

Command (exact parameters):

mise exec -- go test -count=1 ./internal/system -run '^TestRelayDerivedOutputGate$'

Observed complete failure:

--- FAIL: TestRelayDerivedOutputGate (0.00s)
    relay_output_gate_test.go:54: relay output gate: run.go:169: runSystem relay-derived err reaches a terminal output without sanitizeRelayOutput or the explicit %q allowlist
FAIL
FAIL github.com/nicodes/ormos/internal/system 0.006s
FAIL

The mutation was reverted, and the identical command passed.

Controls and reachability

login tests obtain errors from a real HTTP /device/start response and pass them through the exact writer used after TUI teardown; a local configuration error is the known-good sibling
headless tests run the immediate pollPorts tick through fetchConfiguredPorts and logf's echo writer; a local tunnel log is the known-good sibling
empty pairing tests use the real HTTP decode and deviceStart validation path; a printable code/URL response is the control
%q for the relay-chosen registered system name is the gate's explicit proven-safe formatting allowlist

nicodes · 2026-08-23T19:40:13Z

Review 1A

BLOCKING TEST GAP

internal/system/relay_output_gate_test.go:46-57, 228-234 — the required source gate does not track even a local alias of relay-derived login errors. In runSystem, a reachable regression such as relayErr := err; fmt.Fprintln(os.Stderr, relayErr) inside the existing performLogin error branch would print hostile relay content to the restored terminal, but the gate only searches for the identifier err and would pass. This does not meet the active contract’s requirement that the narrow gate cover every in-scope relay-derived output site rather than be a same-symbol assertion. Make the bounded analysis alias-aware (or reject unsanitized terminal sinks in that branch with explicit literal/safe exceptions), and demonstrate that this alias mutation fails the exact gate command before reverting it.

Review method and scope

Risk: high — relay-controlled data reaches live-terminal stderr and headless echoed logs.

Reviewed the complete pinned diff from c86552e77fad9b8d0f568a043682704bb159fd21 to b7b15471e9e30f675959de12361aa154dfd9c4ae, including all seven changed files and surrounding login, polling, logging, TUI sanitization, and output-call sites. Verified the PR head/base SHAs and exact-head GitHub checks via gh.

I ran:

git diff --check <base>..<head>
mise exec -- go test -count=1 ./internal/system -run '^(TestRelayDerivedOutputGate|TestLoginErrorOutputSanitisesRelayText|TestDeviceStartRejectsValuesEmptyAfterSanitising|TestHeadlessPortsPollEchoSanitisesRelayStatus)$'
mise exec -- go vet ./...
mise exec -- go test -race -count=1 ./...

All passed. I did not mutate the worktree; the supplied direct-err deliberate-failure evidence was consistent with the gate’s current implementation.

The reachable HTTP controls correctly exercise login-error writing, immediate pollPorts echoing, and post-sanitize pairing validation. Printable text, C0/ESC, C1, bidi/format characters, and empty-after-sanitize cases are covered. The current %q system-name site is safe, but its allowlist check is also syntactic rather than argument-position aware.

Residual risk: audit.jsonl bidi handling remains out of scope as required by the active contract.

NEEDS ATTENTION

nicodes · 2026-08-23T19:40:15Z

Review 1B

INCOMPLETE

The required reviewer-kimi-k3-256k invocation returned this complete result before inspecting the pinned diff:

Subagent failed: You've reached your usage limit for this billing cycle. Your quota will be refreshed in the next cycle. To continue now, purchase extra usage or upgrade your plan.

No approval or code finding is inferred from an incomplete review slot.

nicodes · 2026-08-23T19:40:16Z

Initial high-risk review wave — aggregate

Pinned unchanged head: b7b15471e9e30f675959de12361aa154dfd9c4ae

Review 1A: NEEDS ATTENTION with one BLOCKING TEST GAP: the source gate follows the identifier err but not a local alias, so it does not yet satisfy the contract's non-same-symbol requirement.
Review 1B: INCOMPLETE because the required Kimi K3-256K reviewer hit its billing-cycle usage limit before review.

Disposition: accept Review 1A's test-gap finding for batch remediation, but do not edit yet. Review policy requires the full unchanged-head wave, so work is blocked until the original Review 1B slot can complete (or the user explicitly selects an allowed alternative). No other findings or follow-ups are available to deduplicate yet.

nicodes · 2026-08-23T20:44:19Z

Replacement Review 1B — Grok 4.6

The main orchestrator selected reviewer-grok-4.6 after durable verification of the genuine Kimi K3-256K quota blocker. This was the orchestrator's explicit replacement assignment, not an automatic fallback and not a claim of user model authorization. The prior incomplete Review 1B record remains part of the durable history.

Review 1B

Risk: high — untrusted relay data crosses live-terminal stderr and headless log-echo boundaries.

BLOCKING TEST GAP

internal/system/relay_output_gate_test.go:46-56, 64-77, 216-249 — the required source gate still matches identifier names, not relay-derived values. In the in-scope runSystem performLogin error branch it only inspects calls whose AST still contains the ident err. A reachable regression in that same restored-terminal block:
```
relayErr := err
fmt.Fprintln(os.Stderr, relayErr)
```
would print the hostile device-start body (e.Error / e.Detail / resp.Status) after the pairing TUI has torn down the alt screen. The gate would not fail: gateCallHasIdent(call, "err") is false on the Fprintln, so the sink is never checked. The same name-only rule is used for writeLoginError and for pollPorts’s logf (ident == "err").

That is a same-symbol assertion over the current local, not coverage of every in-scope relay-derived output site. The test comment’s guarantee that “adding another raw print in one of those blocks therefore fails the gate” is false for this edit. The supplied direct-err mutation (fmt.Fprintln(os.Stderr, err)) only proves the name-matched case.

Acceptance: a local alias of the login err (and of pollPorts’s fetch error) printed to the in-scope terminal/echo sink must fail mise exec -- go test -count=1 ./internal/system -run '^TestRelayDerivedOutputGate$' with a site-specific message; revert and rerun green. Bounded alias tracking, or rejecting unsanitized terminal sinks in those blocks with explicit literal/writeLoginError/%q exceptions, is enough. A same-symbol or dead-code check is not.

FOLLOW-UP

internal/system/relay_output_gate_test.go:110-117, 259-275 — the %q allowlist is a format-string substring, not a verb-to-argument check. strings.Contains(gateFormat(call), "%q") treats fmt.Fprintf(os.Stderr, "Registered this system as %s (%q).\n", out.Name, "x") and even a %%q leftover as proven-safe. Today login.go:87 really does format out.Name with %q, so this is not a live hole.

Acceptance: the gate must fail unless the verb that consumes out.Name is %q; a %q on another operand or a %%q substring must not allowlist a raw %s/%v of out.Name.

Review method and scope

Reviewed the complete pinned diff c86552e77fad9b8d0f568a043682704bb159fd21..b7b15471e9e30f675959de12361aa154dfd9c4ae (seven files) and the surrounding login, TUI pairing, poll/log, and sanitize paths. Confirmed worktree HEAD is b7b15471e9e30f675959de12361aa154dfd9c4ae. Contract used: only the final Correction (2026-08-23): active batch contract on nicodes/ormos-be#420.

Commands actually run:

git diff --check c86552e77fad9b8d0f568a043682704bb159fd21..b7b15471e9e30f675959de12361aa154dfd9c4ae — clean
mise exec -- go test -count=1 ./internal/system -run '^(TestRelayDerivedOutputGate|TestLoginErrorOutputSanitisesRelayText|TestDeviceStartRejectsValuesEmptyAfterSanitising|TestHeadlessPortsPollEchoSanitisesRelayStatus)$' — pass (ok in 0.017s)

I did not mutate the worktree. I did not rerun the deliberate fmt.Fprintln(os.Stderr, err) proof; I checked that the analyzer as written would flag that exact shape (ident err + os.Stderr print) and would not flag the alias above. Focused research via explorer-grok-4.6 was used only to enumerate other Fprint*/logf sites and to read Go 1.25.13 net/http Client.Do (no ctx.Err() check before RoundTrip when the client has no Timeout); I verified those points against the local sources.

Changed-file sweep:

login.go — sanitizes pairing display fields at deviceStart and rejects empty-after-sanitize with a fixed local error; postRelayJSON sanitizes error/detail/status/body before wrapping.
run.go — login failures go through writeLoginError → sanitizeRelayOutput(err.Error()) on the caller-supplied writer (os.Stderr in production).
system.go — pollPorts sanitizes the fetch error before logf; fetchConfiguredPorts sanitizes resp.Status; echoWriter is a test seam defaulting to os.Stderr.
tui.go — sanitizeRelayOutput is sanitize plus the fixed non-empty fallback; pairing still uses sanitize, not the fallback.
login_test.go / system_test.go — reachable HTTP controls for login-error writing, post-sanitize pairing rejection, and the immediate pollPorts echo, each with a local-input sibling. The ports test’s cancelled context still hits the non-OK status branch because the stub Transport returns 599 and Go 1.25.13 Client.Do does not abort before RoundTrip here.
relay_output_gate_test.go — the insufficient gate above.

Production behavior for the two named sinks and the pairing degradation matches the contract. Printable text is preserved; ESC/C0, C1, bidi/format, and empty-after-sanitize are covered on those paths. No backend API change and no general log normalization. The #61 correction comment in login_test.go is intact.

Residual risks

audit.jsonl bidi remains out of scope. Other logf sites (tunnel dial, stream headers, relayDo errors rendered by the TUI) were not widened by this PR and were not treated as in-scope. The ports-echo test depends on a Transport that ignores request cancellation; a context-honoring client would not exercise the status branch.

NEEDS ATTENTION

nicodes · 2026-08-23T20:44:20Z

Completed initial high-risk review wave — deduplicated aggregate

Pinned unchanged head: b7b15471e9e30f675959de12361aa154dfd9c4ae

The main orchestrator explicitly selected Grok 4.6 as replacement Review 1B after durable verification of the genuine Kimi K3-256K quota blocker. This is not a claim that the user authorized the model replacement. The earlier Kimi INCOMPLETE record is retained.

Deduplicated findings

BLOCKING TEST GAP — accepted. Terra 1A and Grok replacement 1B independently found that the source gate follows the symbol err, not aliases of relay-derived values. Batch remediation will make the bounded gate reject unsanitized terminal/log sinks throughout each in-scope reachable block (with explicit safe exceptions), then prove reachable login-error and ports-error alias mutations fail before reverting.
FOLLOW-UP — applicable and accepted into this remediation. Grok found the %q allowlist checks only for a substring and does not map the verb to out.Name. Because this is small, directly related to the acceptance contract's explicit allowlist, and prevents a false-green gate, remediation will make format parsing argument-position aware and add focused checker tests/proofs. No separate follow-up issue will be needed if resolved here.

No other blocking findings, test gaps, or follow-ups were reported. Remediation will now be batched in one changed head; all prior approvals are invalidated, and both reviewer contexts must approve the same final green head.

nicodes · 2026-08-23T20:48:14Z

Batched remediation pushed

Final candidate head: 73e332c9c1dee7f44bd66f11deb18a4d679cbda3
Prior reviewed head: b7b15471e9e30f675959de12361aa154dfd9c4ae
Remediation delta: b7b15471e9e30f675959de12361aa154dfd9c4ae..73e332c9c1dee7f44bd66f11deb18a4d679cbda3

Dispositions

BLOCKING TEST GAP (Terra 1A + Grok replacement 1B): fixed. The bounded live-login and ports-poll regions now reject every unsafe dynamic terminal/log sink rather than following the symbol err, so local aliases cannot evade the gate.
FOLLOW-UP (%q argument mapping, Grok replacement 1B): fixed in scope. The allowlist now parses ordinary format directives, ignores %%, maps verbs to their consuming arguments, and conservatively rejects explicit indexes/star operands. Focused cases cover %q on the relay argument, on another argument, escaped %%q, and conservative rejection.

Deliberate remediation-gate failure proofs

Exact command for every mutation:

mise exec -- go test -count=1 ./internal/system -run '^TestRelayDerivedOutputGate$'

Reachable login alias mutation after performLogin:

relayErr := err
fmt.Fprintln(os.Stderr, relayErr)

Complete failure:

--- FAIL: TestRelayDerivedOutputGate (0.00s)
    relay_output_gate_test.go:53: relay output gate: run.go:170: runSystem relay-derived dynamic value in the performLogin branch reaches a terminal output without sanitizeRelayOutput or the explicit %q allowlist
FAIL
FAIL github.com/nicodes/ormos/internal/system 0.008s
FAIL

Reachable ports-poll alias mutation in the existing error branch:

relayErr := err
d.logf("ports poll failed: %v", relayErr)

Complete failure:

--- FAIL: TestRelayDerivedOutputGate (0.00s)
    relay_output_gate_test.go:75: relay output gate: system.go:280: pollPorts relay-derived dynamic value reaches a terminal output without sanitizeRelayOutput or the explicit %q allowlist
FAIL
FAIL github.com/nicodes/ormos/internal/system 0.006s
FAIL

Misapplied %q mutation at the explicit registration-name allowlist:

fmt.Fprintf(os.Stderr, "Registered this system as %s (%q).\n", out.Name, "control")

Complete failure:

--- FAIL: TestRelayDerivedOutputGate (0.00s)
    relay_output_gate_test.go:110: relay output gate: login.go:87: performLogin relay-derived out.Name (only %q is allowlisted) reaches a terminal output without sanitizeRelayOutput or the explicit %q allowlist
FAIL
FAIL github.com/nicodes/ormos/internal/system 0.006s
FAIL

Each mutation was reverted. The identical gate command passed green afterward. Local gofmt, diff check, go vet ./..., go test -race -count=1 ./..., govulncheck ./... (0 reachable vulnerabilities), and platform-selection/supported-build gates passed on the final candidate.

nicodes · 2026-08-23T20:53:31Z

Final Review 1A — Terra remediation verification

No BLOCKING, BLOCKING TEST GAP, or FOLLOW-UP findings.

Prior blocker verified resolved:

The bounded performLogin and pollPorts regions now reject every dynamic sink argument, so a local alias is rejected regardless of identifier name.
%q validation now maps the verb to out.Name’s actual argument and rejects escaped-percent, misplaced %q, indexed, and star forms. Focused parser tests cover these cases.

Reviewed complete final diff c86552e77fad9b8d0f568a043682704bb159fd21..73e332c9c1dee7f44bd66f11deb18a4d679cbda3 and remediation delta b7b15471e9e30f675959de12361aa154dfd9c4ae..73e332c9c1dee7f44bd66f11deb18a4d679cbda3. The remediation changes only the source gate and its focused tests; the original output sanitization behavior remains intact.

Verified exact head and green GitHub checks. Ran git diff --check, focused system tests including TestRelayDerivedOutputGate and TestGatePercentQAppliesToTheRelayArgument, mise exec -- go vet ./..., and mise exec -- go test -race -count=1 ./...; all passed.

Residual risk remains intentionally bounded: audit.jsonl bidi behavior is out of scope under the active issue correction, and the source gate is deliberately limited to the identified relay-output regions.

APPROVE

nicodes · 2026-08-23T20:53:33Z

Final replacement Review 1B — Grok 4.6 remediation verification

Review 1B (remediation)

Risk: high — untrusted relay data still crosses live-terminal stderr and headless log-echo boundaries.

No remaining BLOCKING or BLOCKING TEST GAP findings. The prior follow-up is resolved; no new follow-ups.

Prior findings

BLOCKING TEST GAP — resolved. relay_output_gate_test.go:36-55, 70-76, 266-288 no longer require the ident err. The performLogin branch rejects every os.Stderr/logf sink whose data arguments are not a literal, a direct sanitizeRelayOutput(...), or a %q that consumes that same argument. pollPorts applies the same rule to every logf. relayErr := err; fmt.Fprintln(os.Stderr, relayErr) and msg := err.Error(); d.logf("ports poll failed: %s", msg) are therefore unsafe dynamic sinks. I did not rerun those mutations; the analyzer as written rejects them, and the supplied exact-command failures (run.go:170, system.go:280) match that shape. Current production sites still pass: writeLoginError is the named exception and itself wraps err.Error(); pollPorts passes sanitizeRelayOutput(err.Error()); fmt.Fprintln(os.Stderr, "pairing cancelled") is a literal.
FOLLOW-UP (%q substring) — resolved. gateSelectorVerb / gateFormatVerbs map ordinary verbs onto consuming arguments, ignore %%, and refuse explicit indexes and stars. TestGatePercentQAppliesToTheRelayArgument covers %q on out.Name, %s with a later %q, %%q, %q on a later argument, and %[1]q. login.go:87 still formats out.Name with %q. The supplied %s/%q mutation failing at login.go:87 matches this check.

Remediation and final diff

Production files are unchanged from b7b15471e9e30f675959de12361aa154dfd9c4ae. The delta is only internal/system/relay_output_gate_test.go. Login-error sanitization, headless ports echo, post-sanitize pairing rejection, and the non-empty fallback are the same reachable paths reviewed on the previous head. No backend API change and no general log normalization.

Review method and scope

Follow-up on unchanged production behavior plus the gate remediation. Pinned final head 73e332c9c1dee7f44bd66f11deb18a4d679cbda3; prior head b7b15471e9e30f675959de12361aa154dfd9c4ae; base c86552e77fad9b8d0f568a043682704bb159fd21. Inspected git diff of both ranges. Contract: only the final Correction (2026-08-23): active batch contract on nicodes/ormos-be#420.

Commands actually run:

git rev-parse HEAD — 73e332c9c1dee7f44bd66f11deb18a4d679cbda3
git diff --check c86552e77fad9b8d0f568a043682704bb159fd21..73e332c9c1dee7f44bd66f11deb18a4d679cbda3 — clean
mise exec -- go test -count=1 ./internal/system -run '^(TestRelayDerivedOutputGate|TestGatePercentQAppliesToTheRelayArgument|TestLoginErrorOutputSanitisesRelayText|TestDeviceStartRejectsValuesEmptyAfterSanitising|TestHeadlessPortsPollEchoSanitisesRelayStatus)$' — pass (ok in 0.018s)

Did not mutate the worktree. Did not rerun the three deliberate gate-failure proofs; those were checked against the analyzer and the supplied messages.

Changed-file sweep of the final seven-file diff: login.go, run.go, system.go, tui.go, login_test.go, and system_test.go are unchanged since the initial review; only the gate test was edited.

Residual risks

audit.jsonl bidi remains out of scope. The gate is still a bounded sink check, not a general taint analyzer: it treats Fprint*/Print* to os.Stderr and logf as the in-scope sinks. The ports-echo functional test still depends on a Transport that ignores request cancellation.

APPROVE

nicodes · 2026-08-23T20:53:34Z

Final remediation review aggregate

Exact approved head: 73e332c9c1dee7f44bd66f11deb18a4d679cbda3

Terra Review 1A: APPROVE, no remaining findings.
Grok replacement Review 1B: APPROVE, prior blocker and follow-up resolved, no new findings.
Every initial finding is fixed and dispositioned.
No applicable FOLLOW-UP remains, so no follow-up issue is required before merge.

The branch is behind current main. Per stack policy, the next step is gh stack sync; any changed head invalidates these approvals. The replay will be verified against the approved diff, exact-head CI rerun, and both original reviewer contexts resumed again before merge.

nicodes · 2026-08-23T20:57:35Z

Post-sync Final Review 1A — Terra

No BLOCKING, BLOCKING TEST GAP, or FOLLOW-UP findings.

Post-sync verification completed for head 9f0dc7fb9835eae8392c00df684e15958f5c49e9 against base 6b3acae676d0b6ff24020cd0f3697ef4538d48a2.

Confirmed both binary-diff SHA-256 values are 2c372f14224e5f2b8dbeceeb801f2cbe078950a7fe91471613c05452ab675581; the approved remediation diff replayed byte-for-byte.
Reviewed the complete current PR diff and changed-file sweep: the same seven internal/system files remain changed.
Reviewed the three new main commits: they only add/modify relay protocol contract tests (relay/contract_test.go, relay/protocol_test.go) and do not interact with the terminal-output sanitization or source gate.
Confirmed the prior alias blocker and %q argument-mapping follow-up remain fixed by the unchanged replay.
Verified exact-head GitHub Actionlint, Linux CI, and Darwin CI checks are successful. Ran git diff --check on the current PR diff successfully.

Residual risk remains the deliberately bounded audit.jsonl bidi scope specified by the active acceptance contract.

APPROVE

nicodes · 2026-08-23T20:57:36Z

Post-sync Final replacement Review 1B — Grok 4.6

Review 1B (post-sync)

Risk: high — untrusted relay data still crosses live-terminal stderr and headless log-echo boundaries.

No BLOCKING, BLOCKING TEST GAP, or FOLLOW-UP findings on this head.

Replay

gh stack sync rebased the same two commits onto origin/main 6b3acae676d0b6ff24020cd0f3697ef4538d48a2. Current head 9f0dc7fb9835eae8392c00df684e15958f5c49e9 vs prior approved head 73e332c9c1dee7f44bd66f11deb18a4d679cbda3.

Independently recomputed:

git diff --binary 6b3acae676d0b6ff24020cd0f3697ef4538d48a2..9f0dc7fb9835eae8392c00df684e15958f5c49e9 | sha256sum
git diff --binary c86552e77fad9b8d0f568a043682704bb159fd21..73e332c9c1dee7f44bd66f11deb18a4d679cbda3 | sha256sum

Both are 2c372f14224e5f2b8dbeceeb801f2cbe078950a7fe91471613c05452ab675581. Stable patch-ids of the two-commit ranges also match. This is a trivial replay; the reviewed bytes did not change.

Intervening main

c86552e..6b3acae is #68 only: c4e09f4 / 2c4ee40 / merge 6b3acae. Touched files are relay/contract_test.go and relay/protocol_test.go (wire-literal pins). No overlap with this PR’s seven files. Those tests do not alter login-error writing, pollPorts echo, pairing validation, or sanitizeRelayOutput.

Durable history (unchanged dispositions)

Original BLOCKING TEST GAP: identifier-only tracking missed relayErr := err / ports aliases. Remains resolved by rejecting every unsafe dynamic sink in the bounded performLogin and pollPorts regions (relay_output_gate_test.go:36-76, 266-288).
Original FOLLOW-UP: %q substring was not mapped to out.Name’s verb. Remains resolved by gateSelectorVerb / gateFormatVerbs and TestGatePercentQAppliesToTheRelayArgument.
Production paths are the same: writeLoginError → sanitizeRelayOutput(err.Error()); pollPorts sanitizes before logf; deviceStart sanitizes then rejects empty pairing code/URL; %q remains on out.Name.

No new evidence to relitigate those dispositions.

Review method and scope

Post-sync verification of an unchanged binary diff after rebase onto current main. Contract: only the final Correction (2026-08-23): active batch contract on nicodes/ormos-be#420.

Commands actually run:

git rev-parse HEAD — 9f0dc7fb9835eae8392c00df684e15958f5c49e9
git rev-parse origin/main — 6b3acae676d0b6ff24020cd0f3697ef4538d48a2
SHA-256 of both binary diffs, as above — identical
git diff --name-only overlap of intervening main vs this PR — empty
mise exec -- go test -count=1 ./internal/system -run '^(TestRelayDerivedOutputGate|TestGatePercentQAppliesToTheRelayArgument|TestLoginErrorOutputSanitisesRelayText|TestDeviceStartRejectsValuesEmptyAfterSanitising|TestHeadlessPortsPollEchoSanitisesRelayStatus)$' — pass (ok in 0.017s)

Did not mutate the worktree. Did not rerun deliberate gate-failure mutations; the analyzer text is byte-identical to the approved head.

Changed-file sweep of 6b3acae..9f0dc7f: the same seven files as the approved review (login.go, login_test.go, relay_output_gate_test.go, run.go, system.go, system_test.go, tui.go).

Residual risks

audit.jsonl bidi remains out of scope. The gate is still a bounded sink check (Fprint*/Print* to os.Stderr, and logf), not a general taint analyzer. The ports-echo functional test still depends on a Transport that ignores request cancellation.

APPROVE

nicodes · 2026-08-23T20:57:37Z

Post-sync final approval aggregate

Exact final head: 9f0dc7fb9835eae8392c00df684e15958f5c49e9
Base: 6b3acae676d0b6ff24020cd0f3697ef4538d48a2

Terra Review 1A: APPROVE, no findings.
Grok replacement Review 1B: APPROVE, no findings.
Approved pre-sync and post-sync binary diffs are byte-identical (sha256:2c372f14224e5f2b8dbeceeb801f2cbe078950a7fe91471613c05452ab675581).
Exact-head Actionlint, Linux CI, and Darwin CI are green.
All initial findings are resolved; no applicable follow-up remains, so no follow-up issue is required.

Merge gates are satisfied for this exact head.

nicodes marked this pull request as ready for review August 23, 2026 19:36

nicodes added 2 commits August 23, 2026 14:53

fix(system): sanitize relay-derived terminal output

50fe9d9

test(system): harden relay output gate

9f0dc7f

nicodes force-pushed the issue/420-sanitize-relay-output branch from 73e332c to 9f0dc7f Compare August 23, 2026 20:53

nicodes merged commit 35aa236 into main Aug 23, 2026
4 checks passed

nicodes mentioned this pull request Aug 23, 2026

fix: discover listening ports on macOS #69

Merged

Navigation Menu

fix(system): sanitize relay-derived terminal output - #70

fix(system): sanitize relay-derived terminal output#70
nicodes merged 2 commits into
mainfrom
issue/420-sanitize-relay-output

nicodes commented Aug 23, 2026 •

edited

Loading

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

nicodes commented Aug 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

nicodes commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Risk

Acceptance contract

Verification

Deliberate source-gate failure proof

Controls and reachability

Uh oh!

nicodes commented Aug 23, 2026

Review 1A

BLOCKING TEST GAP

Review method and scope

Uh oh!

nicodes commented Aug 23, 2026

Review 1B

Uh oh!

nicodes commented Aug 23, 2026

Initial high-risk review wave — aggregate

Uh oh!

nicodes commented Aug 23, 2026

Replacement Review 1B — Grok 4.6

Review 1B

BLOCKING TEST GAP

FOLLOW-UP

Review method and scope

Residual risks

Uh oh!

nicodes commented Aug 23, 2026

Completed initial high-risk review wave — deduplicated aggregate

Deduplicated findings

Uh oh!

nicodes commented Aug 23, 2026

Batched remediation pushed

Dispositions

Deliberate remediation-gate failure proofs

Uh oh!

nicodes commented Aug 23, 2026

Final Review 1A — Terra remediation verification

Uh oh!

nicodes commented Aug 23, 2026

Final replacement Review 1B — Grok 4.6 remediation verification

Review 1B (remediation)

Prior findings

Remediation and final diff

Review method and scope

Residual risks

Uh oh!

nicodes commented Aug 23, 2026

Final remediation review aggregate

Uh oh!

nicodes commented Aug 23, 2026

Post-sync Final Review 1A — Terra

Uh oh!

nicodes commented Aug 23, 2026

Post-sync Final replacement Review 1B — Grok 4.6

Review 1B (post-sync)

Replay

Intervening main

Durable history (unchanged dispositions)

Review method and scope

Residual risks

Uh oh!

nicodes commented Aug 23, 2026

Post-sync final approval aggregate

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

nicodes commented Aug 23, 2026 •

edited

Loading