Skip to content

fix: edge checks back, and verify through a symlink - #26

Merged
rmotafreitas merged 2 commits into
mainfrom
ci/verify-hardening
Nov 4, 2026
Merged

rmotafreitas merged 2 commits into
mainfrom
ci/verify-hardening

Conversation

@rmotafreitas

@rmotafreitas rmotafreitas commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

Follow-up to #25, from its council review.

  • Edge checks restored. trackFromMetadata(null) from a JavaScript caller returns null again instead of throwing. getBinary reads a Response-like answer from an injected FetchLike that has no headers as having no content type. Both checks are kept with an oxlint-disable-next-line … -- reason, as RNAP does for checks of caller input. Tests cover both (a FetchLike answer without headers, or with headers that lack get).
  • verify through a symlink. The "run as a script" check compared import.meta.url with the unresolved argv[1]. Started through a symlinked path, verify ran nothing and exited 0, a silent pass for what is now the only CI gate. It now compares real paths, and a subprocess test runs it directly and through a symlink. The test fails with the old check.

Verification

  • pnpm run check:ci: all 9 steps pass (tooling tests 15, 248 unit tests)

Council review

Covers #25 (merged before review) and this follow-up.

Rounds: 2

Delegate Round 1 Round 2
Claude Opus 5.5 8.5/10 9/10
GPT-6.1 Sol 9/10 9.5/10
Gemini 4 Argon no score no score

Gemini could not be reached (OpenCode Go subscription required); no other provider stood in. Nothing was blocking in either round; both reviewers are satisfied for merge. This PR is round 1's findings for the API; the getBinary test is round 2's.

…othing again

The type-aware cleanup took out two checks at the library's edges that its
types rule out but a JavaScript caller or an injected FetchLike can still
reach: trackFromMetadata(null) returns null again, and getBinary reads a
response without headers as no content type. Both are disabled on their
line with the reason, as the player library does.

verify runs when its path comes through a symlink, which before made it
skip every step and exit 0; a test runs it both ways.
…t type

Pins the restored guard: without it, an injected FetchLike that answers
without headers, or with headers that have no get(), throws again.
@rmotafreitas
rmotafreitas merged commit f64f6cf into main Nov 4, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant