39 lines
3.7 KiB
Markdown
39 lines
3.7 KiB
Markdown
# R4 independent verdict
|
|
|
|
Reviewer: Filbert. Author: Darkwing.
|
|
|
|
Verdict: NOT APPROVED. Request changes.
|
|
|
|
Reviewed only the frozen `2026-09-07_tmux-transport-r4-export/` candidate under Jason's transport-only contract. R2/R3 remain NOT APPROVED; their application-delivery failures are not reclassified as successes.
|
|
|
|
Manifest SHA-256: `343099f890ad4e3db14ffae7603bf49b9383aa8f40c5123b524361371874026f`. All eight listed hashes passed before and after testing. Tests used a disposable copy, fake commands, and private scratch tmux sockets. No live-seat sends, source edits, deployment, or commits.
|
|
|
|
## Blocking finding R4-F1: remote argument injection defeats the transport contract
|
|
|
|
The final remote `ssh` invocation in `tools/tmux/agent-send.sh` interpolates `DST_TARGET` and `RETRIES` inside literal single quotes without escaping embedded quotes. Neither input is restricted enough to make that safe. Local validation of `-r` in the shipped sender cannot protect shell parsing that occurs before the sender runs.
|
|
|
|
Independent reproductions replaced ssh with a local stub that executes its final command using `bash -c`, with the shipped script still on stdin. Tmux was a recording fake, so no remote connection or real pane was involved.
|
|
|
|
- Session argument `x'; printf 'UNAUTHORIZED_EXTRA_EFFECT\n'; #` returned exit 0 and printed the injected marker. There were zero tmux calls and no application-acceptance-unknown output. Exit 0 therefore did not establish even the approved transport sequence.
|
|
- Retry argument `2'; printf 'UNAUTHORIZED_EXTRA_EFFECT\n'; #` returned exit 0, performed the normal transport calls, then executed the extra command. The compatibility option can cause effects beyond one paste and one Enter.
|
|
|
|
This is a transport failure and extra-effect defect, not a demand for application confirmation. README's claim that base64 avoids all shell-quoting hazards does not hold for these non-body arguments.
|
|
|
|
Required correction: shell-quote every remote argument independently, validate retry syntax before invoking ssh, and add executable remote-shell regression tests for quote-bearing arguments. A stub that merely records the ssh string misses this defect. Keep the frozen R4 export unchanged; corrections need a new candidate.
|
|
|
|
## Verification and limits
|
|
|
|
Evidence directory: `/tmp/filbert-r4-CPbHGs/`. Reproducer: `probe.py`; observed results: `probe.log`. Run with `python3 /tmp/filbert-r4-CPbHGs/probe.py`.
|
|
|
|
All five supplied entry points independently returned 0, with separate logs named after each script:
|
|
|
|
- `test-send-message-transport.sh`, target/load/paste/key failures and success, Unicode/multiline body, `-r 999`, verbose metadata, no capture calls, at most one paste/key.
|
|
- `agent-send.test.sh`, wrapper grammar and sender identity.
|
|
- `test-send-message-socket.sh`, real private named/default sockets, concurrent buffers, exact/prefix targets, ambiguity, and routing.
|
|
- `test-agent-send-socket-live.sh`, C1-C6 and sabotage controls.
|
|
- `test-send-message-verdict.sh`, compatibility delegation to transport tests, not an additional screen-verdict test.
|
|
|
|
The direct sender checks each transport operation, pins the resolved pane ID, attempts named-buffer cleanup on exit, and does not parse a screen or issue retry keys. Its normal success wording correctly leaves application acceptance unknown. No application acknowledgement is inferred. A separate real hidden-draft application fixture, forced cleanup failure, and pane replacement race were not run in this review; the remote injection already blocks approval. Supplied passing suites do not cover the demonstrated remote-shell execution defect.
|
|
|
|
Jason retains issue closure and user acceptance. This verdict grants no push or deployment authority.
|