fix(web,gateway): close P3 re-review#3 findings — sanitize command errors, harden turn-lock & caps

2026-08-10 14:21:52 -05:00
parent 48bb19310d
commit d46a2d675a
7 changed files with 350 additions and 166 deletions
@@ -234,6 +234,27 @@ describe('CommandsPanel', () => {
    expect(container?.textContent).toContain('Command failed.');
  });

+  it('bounds an oversized command result message at the render site as defense-in-depth', async () => {
+    const hostileMessage = 'y'.repeat(50_000);
+    await render(
+      <CommandsPanel
+        manifest={null}
+        results={[
+          { conversationId: 'c1', command: 'model', success: false, message: hostileMessage },
+        ]}
+        approval={null}
+        pendingApproval={null}
+        hasConversation={false}
+        onExecute={vi.fn()}
+        onApprove={vi.fn()}
+        onRunApproved={vi.fn()}
+      />,
+    );
+
+    const text = container?.textContent ?? '';
+    expect(text.length).toBeLessThan(hostileMessage.length);
+  });
+
  it('does not throw when the manifest fields are malformed (non-array commands/skills)', async () => {
    const manifest = {
      commands: 'not-an-array',