Skip to content

fix(deps): reject malformed TOML exponents in 0.5.1 #164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abruption merged 2 commits into from
Oct 27, 2026
Merged

fix(deps): reject malformed TOML exponents in 0.5.1 #164

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
62ef9ba
fix(deps): reject malformed TOML exponents and prepare 0.5.1
abruption Oct 27, 2026
4004290
docs(release): record current 0.5.1 settings checks and exception
abruption Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions PARITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,22 @@
# Python compatibility and npm migration

## 0.5.1 parser correctness patch — 2026-10-27 KST

Issue #163 updates only the TOML parser dependency from 1.9.0 to 1.9.1.
Malformed repeated exponent signs such as `numeric_setting = 3e++20` previously
parsed successfully and could make configuration inspection return `default`.
The corrected parser rejects that input, so doctor reports
`unknown / codex_config_unreadable` and Codex send/dry-run refuse before queueing.
Valid exponent signs and the explicit root `sqlite_home` refusal are preserved.
This is a reproduced parser-correctness fix; no storage-relocation bypass or
published vulnerability is claimed.

The exact 0.5.1 doctor row preserves the four profiles accepted by 0.5.0;
all historical rows and immutable skill pins are unchanged. SSH endpoints must
both use exactly 0.5.1. Unsupported platform/native/automatic-ACK cells and
excluded experiments/reporter/harness remain outside the patch.


## 0.5.0 release scope — 2026-10-20 KST

The 0.5.0 source carries platform-qualification groundwork. It does not activate additional observation or
Expand Down
16 changes: 8 additions & 8 deletions README.ja.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@

<!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.1.0 -->

**文書・ソースのバージョン: 0.5.0。** インストール前に、選択したリリースとレジストリのメタデータを確認してください。日付付きの準備・検証記録は [VALIDATION.md](VALIDATION.md)、リリース手順は [RELEASING.md](RELEASING.md) にあります。SSH の両端には同じ TypeScript クライアントのバージョンが必要で、0.3.6 と 0.5.0 は互いの SSH 事前確認を拒否します。
**文書・ソースのバージョン: 0.5.1。** インストール前に、選択したリリースとレジストリのメタデータを確認してください。日付付きの準備・検証記録は [VALIDATION.md](VALIDATION.md)、リリース手順は [RELEASING.md](RELEASING.md) にあります。SSH の両端には同じ TypeScript クライアントのバージョンが必要で、0.3.6 と 0.5.1 は互いの SSH 事前確認を拒否します。

**0.4.0 handoff の範囲:** 任意の native 観測は macOS arm64 の厳密な Codex 0.160.1/0.162.1 に限定し、明示的な `operator_confirmed` 受領確認には対応する POSIX ledger を使います。Linux・Windows の native 観測と自動 ACK 収集は未対応です。 0.5.0 のソースは選択できない Linux arm64 の Codex 0.162.1 候補（固定された上流 `aarch64-unknown-linux-musl` 実行ファイル、スキーマ、注入テスト 1 回）を記録しますが、Linux 観測を有効化しません。Linux の native 観測は引き続き未対応です。
**0.4.0 handoff の範囲:** 任意の native 観測は macOS arm64 の厳密な Codex 0.160.1/0.162.1 に限定し、明示的な `operator_confirmed` 受領確認には対応する POSIX ledger を使います。Linux・Windows の native 観測と自動 ACK 収集は未対応です。 0.5.1 のソースは選択できない Linux arm64 の Codex 0.162.1 候補（固定された上流 `aarch64-unknown-linux-musl` 実行ファイル、スキーマ、注入テスト 1 回）を記録しますが、Linux 観測を有効化しません。Linux の native 観測は引き続き未対応です。

**実行中の Claude Code・Codex セッションを見つけ、ローカルまたは SSH でメッセージを送信します。**
Python 不要の Node.js クライアントです。パッケージ名とコマンド名は `session-peer` です。
Expand Down Expand Up @@ -57,15 +57,15 @@ SSH は既存の鍵・ホスト信頼設定と両端の**同じバージョン
`Get-Command session-peer -All` で PATH を確認してください。利用する実装を選び、
別の管理ツールのファイルを `--force` で上書きしないでください。

**0.5.0 のインストール:** npm の導入・更新例を実行する前に、レジストリで公開状況と選択したリリースを確認してください。利用できない場合は[レビュー済みソースビルド](docs/guide.ja.md#ソースからビルド)を使います。
**0.5.1 のインストール:** npm の導入・更新例を実行する前に、レジストリで公開状況と選択したリリースを確認してください。利用できない場合は[レビュー済みソースビルド](docs/guide.ja.md#ソースからビルド)を使います。

```sh
npm view session-peer@0.5.0 version dist.integrity
npm install --global --ignore-scripts session-peer@0.5.0
npm view session-peer@0.5.1 version dist.integrity
npm install --global --ignore-scripts session-peer@0.5.1
session-peer --version
```

期待する出力: `session-peer 0.5.0 (typescript)`。分離インストール・ソースビルド・
期待する出力: `session-peer 0.5.1 (typescript)`。分離インストール・ソースビルド・
Windows・削除の手順は以下の詳細ガイドを参照してください。

任意の `sp` 短縮名は 0.3.0 以降に含まれ（0.2.1 以前にはありません）、自動では有効になりません。
Expand All @@ -74,12 +74,12 @@ Windows・削除の手順は以下の詳細ガイドを参照してください
### Update

npm で導入したクライアントは npm で更新します。タグと対象バージョンを確認してから
正確なバージョンを指定してください。以下は古い npm 版を選択した 0.5.0 に更新する例です。
正確なバージョンを指定してください。以下は古い npm 版を選択した 0.5.1 に更新する例です。
CLI は更新をインストールせず、`session-peer update --check` は確認のみ行います。

```sh
npm view session-peer dist-tags
npm install --global --ignore-scripts session-peer@0.5.0
npm install --global --ignore-scripts session-peer@0.5.1
session-peer --version
```

Expand Down
16 changes: 8 additions & 8 deletions README.ko.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,9 @@ Python을 설치하지 않아도 Node.js에서 실행되는 TypeScript 클라이

<!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.1.0 -->

**문서·소스 기준 버전: 0.5.0.** 설치 전에 선택한 릴리스와 레지스트리 메타데이터를 확인하세요. 날짜별 준비·검증 기록은 [VALIDATION.md](VALIDATION.md), 릴리스 절차는 [RELEASING.md](RELEASING.md)에 있습니다. SSH 양쪽에는 같은 TypeScript 클라이언트 버전이 필요하며, 0.3.6과 0.5.0은 서로의 SSH 사전 확인을 거부합니다.
**문서·소스 기준 버전: 0.5.1.** 설치 전에 선택한 릴리스와 레지스트리 메타데이터를 확인하세요. 날짜별 준비·검증 기록은 [VALIDATION.md](VALIDATION.md), 릴리스 절차는 [RELEASING.md](RELEASING.md)에 있습니다. SSH 양쪽에는 같은 TypeScript 클라이언트 버전이 필요하며, 0.3.6과 0.5.1은 서로의 SSH 사전 확인을 거부합니다.

**0.4.0 handoff 범위:** 선택 기능인 native 관측은 macOS arm64의 정확한 Codex 0.160.1/0.162.1에 한정되며, 명시적 `operator_confirmed` 수령 확인에는 지원되는 POSIX ledger를 사용합니다. Linux·Windows의 native 관측과 자동 ACK 수집은 미지원입니다. 0.5.0 소스는 선택할 수 없는 Linux arm64 Codex 0.162.1 후보(고정된 업스트림 `aarch64-unknown-linux-musl` 실행 파일, 스키마, 주입 테스트 1회)를 기록하며 Linux 관측을 활성화하지 않습니다. Linux native 관측은 계속 미지원입니다.
**0.4.0 handoff 범위:** 선택 기능인 native 관측은 macOS arm64의 정확한 Codex 0.160.1/0.162.1에 한정되며, 명시적 `operator_confirmed` 수령 확인에는 지원되는 POSIX ledger를 사용합니다. Linux·Windows의 native 관측과 자동 ACK 수집은 미지원입니다. 0.5.1 소스는 선택할 수 없는 Linux arm64 Codex 0.162.1 후보(고정된 업스트림 `aarch64-unknown-linux-musl` 실행 파일, 스키마, 주입 테스트 1회)를 기록하며 Linux 관측을 활성화하지 않습니다. Linux native 관측은 계속 미지원입니다.

<a id="demo"></a>
## 시연
Expand Down Expand Up @@ -66,15 +66,15 @@ PowerShell에서는 `Get-Command session-peer -All`로 PATH(명령 검색 경로
실행 파일을 찾는지 확인하세요. 사용할 구현을 선택하고 다른 패키지 관리자가 설치한
파일을 `--force`로 덮어쓰지 마세요. 설치와 갱신은 사용자가 npm으로 직접 수행합니다.

**0.5.0 설치:** npm 설치·업데이트 예시를 실행하기 전에 레지스트리 제공 여부와 선택한 릴리스를 확인하세요. 해당 버전이 제공되지 않으면 [검토한 소스 빌드](docs/guide.ko.md#소스에서-빌드)를 사용하세요.
**0.5.1 설치:** npm 설치·업데이트 예시를 실행하기 전에 레지스트리 제공 여부와 선택한 릴리스를 확인하세요. 해당 버전이 제공되지 않으면 [검토한 소스 빌드](docs/guide.ko.md#소스에서-빌드)를 사용하세요.

```sh
npm view session-peer@0.5.0 version dist.integrity
npm install --global --ignore-scripts session-peer@0.5.0
npm view session-peer@0.5.1 version dist.integrity
npm install --global --ignore-scripts session-peer@0.5.1
session-peer --version
```

예상 결과는 `session-peer 0.5.0 (typescript)`입니다. 별도 경로에 설치하거나,
예상 결과는 `session-peer 0.5.1 (typescript)`입니다. 별도 경로에 설치하거나,
소스에서 빌드하거나, Windows에서 설치·제거하는 방법은 [사용자 가이드](docs/guide.ko.md#설치)를 참고하세요.

선택 사항인 `sp` 단축 명령은 0.3.0 이상에 포함되며(0.2.1 이하에는 없음) 자동으로
Expand All @@ -85,13 +85,13 @@ session-peer --version
### 업데이트

npm으로 설치한 클라이언트는 사용자가 직접 npm으로 업데이트합니다. 사용 가능한 배포 태그
(dist-tag)와 대상 버전을 확인한 뒤 해당 버전을 지정해 설치하세요. 아래 예시는 이전 npm 설치본을 선택한 0.5.0으로
(dist-tag)와 대상 버전을 확인한 뒤 해당 버전을 지정해 설치하세요. 아래 예시는 이전 npm 설치본을 선택한 0.5.1으로
업데이트합니다. `session-peer` CLI는 업데이트를 설치하지 않습니다. `session-peer
update --check`는 새 버전이 있는지 확인할 뿐입니다.

```sh
npm view session-peer dist-tags
npm install --global --ignore-scripts session-peer@0.5.0
npm install --global --ignore-scripts session-peer@0.5.1
session-peer --version
```

Expand Down
16 changes: 8 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@

<!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.1.0 -->

**Documentation and source version: 0.5.0.** Review the selected release and registry metadata before installation. Dated preparation and validation records are in [VALIDATION.md](VALIDATION.md); release procedures are in [RELEASING.md](RELEASING.md). SSH endpoints require the same TypeScript client version; 0.3.6 and 0.5.0 refuse each other’s SSH preflight.
**Documentation and source version: 0.5.1.** Review the selected release and registry metadata before installation. Dated preparation and validation records are in [VALIDATION.md](VALIDATION.md); release procedures are in [RELEASING.md](RELEASING.md). SSH endpoints require the same TypeScript client version; 0.3.6 and 0.5.1 refuse each other’s SSH preflight.

**0.4.0 handoff scope:** opt-in native observation is limited to exact Codex 0.160.1/0.162.1 on macOS arm64; explicit `operator_confirmed` receipts use supported POSIX ledgers. Linux/Windows native observation and automatic ACK collection remain unsupported. The 0.5.0 source records a non-selectable Linux arm64 Codex 0.162.1 candidate (pinned upstream `aarch64-unknown-linux-musl` executable, schema and one injection test); it does not enable Linux observation. Linux native observation remains unsupported.
**0.4.0 handoff scope:** opt-in native observation is limited to exact Codex 0.160.1/0.162.1 on macOS arm64; explicit `operator_confirmed` receipts use supported POSIX ledgers. Linux/Windows native observation and automatic ACK collection remain unsupported. The 0.5.1 source records a non-selectable Linux arm64 Codex 0.162.1 candidate (pinned upstream `aarch64-unknown-linux-musl` executable, schema and one injection test); it does not enable Linux observation. Linux native observation remains unsupported.

**Find and message running Claude Code and Codex sessions, locally or over SSH.**
A Node.js client that runs without Python. Package and command: `session-peer`.
Expand Down Expand Up @@ -57,15 +57,15 @@ Check `type -a session-peer` on macOS/Linux or `Get-Command session-peer -All`
in PowerShell before installing. Choose the intended PATH entry; do not use
`--force` to overwrite another manager’s files.

**Version 0.5.0 installation:** check registry availability and review the chosen release before running the npm install/update examples. If that version is unavailable, use the [reviewed source build](docs/guide.md#build-from-source).
**Version 0.5.1 installation:** check registry availability and review the chosen release before running the npm install/update examples. If that version is unavailable, use the [reviewed source build](docs/guide.md#build-from-source).

```sh
npm view session-peer@0.5.0 version dist.integrity
npm install --global --ignore-scripts session-peer@0.5.0
npm view session-peer@0.5.1 version dist.integrity
npm install --global --ignore-scripts session-peer@0.5.1
session-peer --version
```

Expected: `session-peer 0.5.0 (typescript)`. For isolated installation, source
Expected: `session-peer 0.5.1 (typescript)`. For isolated installation, source
builds, Windows and removal, see the detailed guide below.

Optional `sp` shorthand ships with 0.3.0 and later (not 0.2.1 or earlier) and is
Expand All @@ -75,12 +75,12 @@ never enabled automatically. See [explicit activation and collisions](docs/short

Use npm for an npm-managed installation. Check the available tags and review
the target version, then install that exact version; this example updates an
older npm installation to the selected 0.5.0 release. The CLI does not install updates;
older npm installation to the selected 0.5.1 release. The CLI does not install updates;
`session-peer update --check` only reports them.

```sh
npm view session-peer dist-tags
npm install --global --ignore-scripts session-peer@0.5.0
npm install --global --ignore-scripts session-peer@0.5.1
session-peer --version
```

Expand Down
16 changes: 8 additions & 8 deletions README.zh-CN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@

<!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.1.0 -->

**文档和源码版本：0.5.0。** 安装前，请审核所选发布版本和注册表元数据。按日期记录的准备与验证结果见 [VALIDATION.md](VALIDATION.md)，发布流程见 [RELEASING.md](RELEASING.md)。SSH 两端必须使用相同的 TypeScript 客户端版本；0.3.6 与 0.5.0 会拒绝彼此的 SSH 预检。
**文档和源码版本：0.5.1。** 安装前，请审核所选发布版本和注册表元数据。按日期记录的准备与验证结果见 [VALIDATION.md](VALIDATION.md)，发布流程见 [RELEASING.md](RELEASING.md)。SSH 两端必须使用相同的 TypeScript 客户端版本；0.3.6 与 0.5.1 会拒绝彼此的 SSH 预检。

**0.4.0 handoff 范围：** 可选 native 观测仅限 macOS arm64 上精确 Codex 0.160.1/0.162.1 版本；明确的 `operator_confirmed` 收件确认使用受支持的 POSIX ledger。Linux、Windows 的 native 观测和自动 ACK 收集仍不支持。 0.5.0 源码记录了不可选用的 Linux arm64 Codex 0.162.1 候选（固定的上游 `aarch64-unknown-linux-musl` 可执行文件、schema 及一次注入测试），但不启用 Linux 观测；Linux native 观测仍不支持。
**0.4.0 handoff 范围：** 可选 native 观测仅限 macOS arm64 上精确 Codex 0.160.1/0.162.1 版本；明确的 `operator_confirmed` 收件确认使用受支持的 POSIX ledger。Linux、Windows 的 native 观测和自动 ACK 收集仍不支持。 0.5.1 源码记录了不可选用的 Linux arm64 Codex 0.162.1 候选（固定的上游 `aarch64-unknown-linux-musl` 可执行文件、schema 及一次注入测试），但不启用 Linux 观测；Linux native 观测仍不支持。

**发现正在运行的 Claude Code 和 Codex 会话，并在本机或通过 SSH 发送消息。**
这是不需要 Python 的 Node.js 客户端。包名与命令名均为 `session-peer`。
Expand Down Expand Up @@ -55,15 +55,15 @@ session-peer send --to CLAUDE_PID --message '请检查 API 契约并回复。' -
`Get-Command session-peer -All` 检查 PATH。选择所需实现，不要用 `--force`
覆盖其他安装管理器的文件。

**安装 0.5.0：** 运行 npm 安装或更新示例前，请确认注册表可用性并审核所选发布版本。如该版本不可用，请使用[已审核的源码构建](docs/guide.zh-CN.md#从源码构建)。
**安装 0.5.1：** 运行 npm 安装或更新示例前，请确认注册表可用性并审核所选发布版本。如该版本不可用，请使用[已审核的源码构建](docs/guide.zh-CN.md#从源码构建)。

```sh
npm view session-peer@0.5.0 version dist.integrity
npm install --global --ignore-scripts session-peer@0.5.0
npm view session-peer@0.5.1 version dist.integrity
npm install --global --ignore-scripts session-peer@0.5.1
session-peer --version
```

预期输出：`session-peer 0.5.0 (typescript)`。隔离安装、源码构建、Windows 和
预期输出：`session-peer 0.5.1 (typescript)`。隔离安装、源码构建、Windows 和
卸载步骤见下方详细指南。

可选的 `sp` 简写包含在 0.3.0 及更高版本中（0.2.1 及更早版本没有），不会自动启用。
Expand All @@ -72,11 +72,11 @@ session-peer --version
### Update

使用 npm 更新由 npm 管理的安装。先检查标签并审阅目标版本，再安装指定版本。
下面示例将旧 npm 安装更新至所选的 0.5.0。CLI 不会安装更新，`session-peer update --check` 只做检查。
下面示例将旧 npm 安装更新至所选的 0.5.1。CLI 不会安装更新，`session-peer update --check` 只做检查。

```sh
npm view session-peer dist-tags
npm install --global --ignore-scripts session-peer@0.5.0
npm install --global --ignore-scripts session-peer@0.5.1
session-peer --version
```

Expand Down
Loading
Loading