[PR #2947] [CLOSED] test(clients): enforce OpenCode setup-plan containment #5510

New issue

Closed

opened 2026-10-31 01:07:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:07:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2947
Author: @AICodeLion
Created: 10/13/2026
Status: ❌ Closed

Base: main ← Head: codex/opencode-plan-containment

📝 Commits (1)

ce6214d test(clients): enforce OpenCode setup-plan containment

📊 Changes

1 file changed (+3 additions, -1 deletions)

View changed files

📝 scripts/verify-opencode-client.mjs (+3 -1)

📄 Description

Fixes #2582. The OpenCode verifier's prefix check accepts sibling directories such as reverse-engineer-anything-sibling. Reuse the existing host-aware isPathWithinRoot owner to admit the selected configuration file, managed skill directory and its descendants.

Validation: a real compiled setup --client opencode --dry-run --json plan from disposable Windows account/profile roots is admitted. The actual verifier predicate accepts the root and nested Unicode skill paths, while rejecting an injected sibling, an escaping path and a configuration-file sibling. The old predicate admits the injected sibling. check:fast, changed-file formatting and git diff --check pass on Node 24.18.0/npm 11.16.0.

The native OpenCode client lane remains POSIX-only and was not run on this Windows host; this does not claim Windows OpenCode client compatibility. Production setup authority is unchanged. The previously attempted full check on the identical pinned main baseline is blocked by formatting in docs/readme/README_tr.md and scripts/lib/clean-linux-hopper-runtime.mjs; no unrelated files were changed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2947 **Author:** [@AICodeLion](https://github.com/AICodeLion) **Created:** 10/13/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `codex/opencode-plan-containment` --- ### 📝 Commits (1) - [`ce6214d`](https://github.com/morluto/rea/commit/ce6214d4aa83ca7422f36ba870418f6178a8b115) test(clients): enforce OpenCode setup-plan containment ### 📊 Changes **1 file changed** (+3 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `scripts/verify-opencode-client.mjs` (+3 -1) </details> ### 📄 Description Fixes #2582. The OpenCode verifier's prefix check accepts sibling directories such as reverse-engineer-anything-sibling. Reuse the existing host-aware isPathWithinRoot owner to admit the selected configuration file, managed skill directory and its descendants. Validation: a real compiled setup --client opencode --dry-run --json plan from disposable Windows account/profile roots is admitted. The actual verifier predicate accepts the root and nested Unicode skill paths, while rejecting an injected sibling, an escaping path and a configuration-file sibling. The old predicate admits the injected sibling. check:fast, changed-file formatting and git diff --check pass on Node 24.18.0/npm 11.16.0. The native OpenCode client lane remains POSIX-only and was not run on this Windows host; this does not claim Windows OpenCode client compatibility. Production setup authority is unchanged. The previously attempted full check on the identical pinned main baseline is blocked by formatting in docs/readme/README_tr.md and scripts/lib/clean-linux-hopper-runtime.mjs; no unrelated files were changed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:07:11 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:44:13 +00:00

[PR #5510] [CLOSED] fix(metadata): isolate Go build-info validation #6944

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5510

No description provided.

Rows
Columns