Skip to content

fix(signals): preserve optional globstar cap semantics#1560

Closed
JSONbored wants to merge 1 commit into
mainfrom
codex/propose-fix-for-globstar-pattern-vulnerability
Closed

fix(signals): preserve optional globstar cap semantics#1560
JSONbored wants to merge 1 commit into
mainfrom
codex/propose-fix-for-globstar-pattern-vulnerability

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Motivation

  • Fix a regression where the capped expansion for repeated **/ patterns dropped the zero-depth (root) alternative once the alternatives count hit the cap, producing false negatives for manifest path matching and allowing path-gated checks to be skipped.

Description

  • Adjust expandGlobstarSlash so the rewrite to ${prefix}*/ and the push of the root prefix occur only when canKeepRootAlternatives is true, preserving the optional zero-segment branch; also update the targeted regression test in test/unit/focus-manifest.test.ts to assert that a bounded repeated **/ pattern still matches a valid nested path.

Testing

  • Ran the focused unit suite: npx vitest run test/unit/focus-manifest.test.ts and the updated "bounds repeated **/ expansion" test passed; a local tsc --noEmit run reported unrelated missing @sentry/node types in this environment and a coverage remapping step failed due to a local js-tokens dependency mismatch, both of which are environmental and unrelated to the logic change.

Codex Task

@dosubot dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Jun 26, 2026
@superagent-security superagent-security Bot removed the size:XS This PR changes 0-9 lines, ignoring generated files. label Jun 26, 2026
@superagent-security

Copy link
Copy Markdown

Superagent didn't find any vulnerabilities or security issues in this PR.

@codecov

codecov Bot commented Jun 26, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.37%. Comparing base (9de2106) to head (bee4cd8).
⚠️ Report is 8 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1560   +/-   ##
=======================================
  Coverage   95.37%   95.37%           
=======================================
  Files         198      198           
  Lines       21514    21515    +1     
  Branches     7776     7776           
=======================================
+ Hits        20520    20521    +1     
  Misses        416      416           
  Partials      578      578           
Files with missing lines Coverage Δ
src/signals/focus-manifest.ts 98.19% <100.00%> (+<0.01%) ⬆️
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@gittensory-orb

gittensory-orb Bot commented Jun 27, 2026

Copy link
Copy Markdown

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review — safe to merge

2 files · 1 AI reviewers · no blockers · readiness 48/100 · CI green · blocked

✅ Approved — safe to merge

Signal Result Evidence
Code review ✅ No blockers 1 reviewers, synthesized
Linked issue ⚠️ Missing No linked issue or no-issue rationale found.
Related work ⚠️ 3 scoped overlaps Top overlaps are listed below; lower-confidence bulk is hidden.
Review load ❌ 8/20 Readiness component derived from cached public PR metadata and labels.
Validation evidence ❌ 5/25 Cached preflight status is hold.
Open PR queue ❌ 3/10 48 open PR(s), 9 likely reviewable, 39 unlinked.
Contributor context ✅ Confirmed Gittensor contributor JSONbored; Gittensor profile; 81 PR(s), 261 issue(s).
Gate result ✅ Passing No configured blocker found.
Nits — 2 non-blocking
  • Repository config was not parsed
  • No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
Review context
  • Author: JSONbored
  • Role context: owner (maintainer lane)
  • Public audience mode: oss maintainer
  • Lane context: Repository registration is not available in the local Gittensory cache.
  • Public profile languages: not available
  • Official Gittensor activity: 81 PR(s), 261 issue(s).
  • Related work: Titles/paths share 6 meaningful terms. (PR #1391, PR #1492)
  • Related work: Titles/paths share 6 meaningful terms. (PR #1396, PR #1492)
  • Related work: Titles/paths share 7 meaningful terms. (PR #1398, PR #1492)
  • Additional title-only matches omitted; title-only overlap does not block.
Contributor next steps
  • Treat this as maintainer-lane context rather than normal contributor-lane activity.
  • Explain no-issue PR.
  • Review top overlaps.
  • Add scope summary.
  • Fix blocker.
  • Expect slower review.
  • Refresh registry data or choose a registered active repo.
  • Link the issue being solved, or explicitly explain why this is a no-issue PR.
  • Check active issues and PRs before submitting.
Signal definitions
  • Related work = same linked issue, overlapping active PRs, or title/path similarity.
  • Review load = cached public PR metadata such as size labels, changed paths, and preflight status.
  • Open PR queue = repo-wide review pressure; it is not a PR quality failure.
  • Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed


💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

  • Re-run Gittensory review

@gittensory-orb gittensory-orb Bot added gittensor Gittensor contributor context gittensor:bug Gittensor-scored bug fix - worth 0.5x multiplier. labels Jun 27, 2026
@JSONbored

Copy link
Copy Markdown
Owner Author

Closing — this is a reversal of intentional same-day work, not a fix. The globstar cap branch (focus-manifest.ts:1000-1005) and its test were authored hours earlier by #1426 (c732bea3, "preserve segment boundaries for globstar paths"), which deliberately fixed the over-cap result to false. Under the cap the two are byte-identical; they diverge only in the pathological >64-alternative case (no real-world pattern), and the PR flips #1426's test assertion false→true to lock in the opposite arm. Rewriting a fresh, deliberate spec on a can't-happen-in-practice edge isn't a bug fix.

@JSONbored JSONbored closed this Jun 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark codex gittensor:bug Gittensor-scored bug fix - worth 0.5x multiplier. gittensor Gittensor contributor context

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant