Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,999 Commits 1 Branch 2 Tags
master
Commit Graph
53 Commits
Author SHA1 Message Date
CopilotSisyphusnaiba
 		9ec6164f58 fix(security): harden server and service deletion lifecycle (#1220) 
* test: TDD regression tests for GHSA-jx78-55p5-rwv5 stream quota enforcement

* Apply remaining changes

* fix: update action SHA allowlist and test assertions to match dependabot bump

* fix: close GHSA-jx78-55p5-rwv5 incomplete fix of GHSA-qjpp-gffx-2wm9

Finding 1 (Moderate): nil-guard reporterServer in delayCheck and notifyCheck.
ServerShared has its own lock independent of serviceResponseDataStoreLock, so
m := ServerShared.GetList() taken inside the worker can return a nil entry for
the reporter if the server was concurrently deleted. Previously this caused an
unrecovered SIGSEGV in the worker goroutine (and in the gRPC layer with no
recovery interceptor), taking down the whole instance.

Finding 2 (Low): nil-guard ss.services[id] in ServiceSentinel.Delete().
A caller-supplied id that is absent from the registry caused
ss.services[id].CronJobID to panic, aborting the Delete loop and leaving every
subsequent valid id as a zombie service (DB row deleted, in-memory entry kept,
cron probe still running).

Regression tests added for both findings following the existing
servicesentinel_lifecycle_test.go patterns.

* Apply remaining changes

* chore: replace commit hashes with version tags in test.yml

* fix(server): serialize authoritative lifecycle changes

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(service): bind reports to reporter lifecycle

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(rpc): reject results from stale task streams

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(agentcompat): allow version-tagged actions

* fix(agentcompat): allow literal checkout refs

* refactor(agentcompat): remove SHA resolver policy

* test(agentcompat): remove resolver SHA fixtures

* test(agentcompat): remove mutable ref fixtures

* test(agentcompat): use tagged actions in secure fixtures

* test(agentcompat): update credential fixtures for tags

* test(agentcompat): update reusable action fixtures

* test(agentcompat): update artifact redaction fixtures

* test(agentcompat): finish artifact fixture tag migration

* test(agentcompat): update workflow validation fixtures

* test(agentcompat): update dependency workflow fixture

* ci(agentcompat): stop pinning cross-repository revisions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: naiba <hi@nai.ba>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-08-01 15:45:20 +08:00
naibaandnaiba/CloudCode 479fcac11c test(agentcompat): wire FD diagnostics into stress 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 22:11:21 +00:00
naibaandnaiba/CloudCode 11eb339540 test(agentcompat): exercise real FD lifecycle diagnostics 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 22:10:29 +00:00
naibaandnaiba/CloudCode b204e3dda4 test(agentcompat): verify FD diagnostic collection 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 22:09:39 +00:00
naibaandnaiba/CloudCode 970d2ae672 test(agentcompat): model FD diagnostic lifecycles 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 22:08:01 +00:00
naibaandnaiba/CloudCode 1e67f4017a test(agentcompat): preserve default sampler evidence 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 22:07:09 +00:00
naibaandnaiba/CloudCode e78af86164 test(agentcompat): capture FD observations in process samples 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 22:06:19 +00:00
naibaandnaiba/CloudCode 8b352484d8 test(agentcompat): preserve existing CRLF workflow data 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:32:49 +00:00
naibaandnaiba/CloudCode 926f2ca632 chore(agentcompat): document intentional scanner findings 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:07:04 +00:00
naibaandnaiba/CloudCode 0332b1e212 fix(agentcompat): root workflow file reads 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:06:40 +00:00
naibaandnaiba/CloudCode 24c7a898cf test(agentcompat): cover CRLF workflow mutations 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:06:14 +00:00
naibaandnaiba/CloudCode 153dfeb569 fix(agentcompat): retain transfer sentinel handles 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:05:52 +00:00
naibaandnaiba/CloudCode 393f49aa59 fix(agentcompat): retain reconnect sentinel handles 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:05:29 +00:00
naibaandnaiba/CloudCode 20930aaf9f fix(agentcompat): root filesystem guard reads 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:05:10 +00:00
naibaandnaiba/CloudCode 23763c8210 fix(agentcompat): secure legacy file manager boundaries 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:04:52 +00:00
naibaandnaiba/CloudCode 029d458f50 fix(agentcompat): root scenario config reads 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:04:34 +00:00
naibaandnaiba/CloudCode e157304475 fix(agentcompat): root workspace log creation 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:04:16 +00:00
naibaandnaiba/CloudCode 9bc3068d14 fix(agentcompat): resolve trusted Go executable 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:03:55 +00:00
naibaandnaiba/CloudCode e20197fdcc fix(agentcompat): root proc resource reads 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:03:37 +00:00
naibaandnaiba/CloudCode 57f9564ce1 fix(agentcompat): decode inotify events safely 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:03:20 +00:00
naibaandnaiba/CloudCode b92ab9a60f fix(agentcompat): snapshot evidence through rooted handles 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:02:58 +00:00
naibaandnaiba/CloudCode 454c577968 fix(agentcompat): secure credentialed agent workspaces 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:02:37 +00:00
naibaandnaiba/CloudCode c7799854b9 fix(agentcompat): validate supervised executable paths 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 17:02:21 +00:00
naibaandnaiba/CloudCode 8a0382478b test(agentcompat): lock Agent stress preparation 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:16:31 +00:00
naibaandnaiba/CloudCode 396a0fcb21 ci: prepare dashboard inputs for stress 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:16:00 +00:00
naibaandnaiba/CloudCode 620bebbf8e test(agentcompat): find repository root across platforms 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:15:31 +00:00
naibaandnaiba/CloudCode 589b06b63d test(agentcompat): probe credential execution support 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:15:10 +00:00
naibaandnaiba/CloudCode dcab0d2245 fix(agentcompat): classify Windows absolute paths 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:14:37 +00:00
naibaandnaiba/CloudCode 866ddddef1 test(agentcompat): make dedicated fixtures platform-native 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:13:41 +00:00
naibaandnaiba/CloudCode 3bdbfd2593 test(agentcompat): use native validation paths 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:13:41 +00:00
naibaandnaiba/CloudCode ccfee605bf test(agentcompat): use native evidence metadata paths 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:13:08 +00:00
naibaandnaiba/CloudCode a60924b6c7 test(agentcompat): use native contract paths 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:12:38 +00:00
naibaandnaiba/CloudCode 56671d5509 test(agentcompat): define Windows evidence mode semantics 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:11:44 +00:00
naibaandnaiba/CloudCode 1c881ed6d2 test(agentcompat): isolate Unix evidence mode checks 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:11:16 +00:00
naibaandnaiba/CloudCode ffbb8bed09 fix(agentcompat): validate evidence modes by platform 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:10:40 +00:00
naibaandnaiba/CloudCode 381eee0cec fix(agentcompat): constrain command harness to Linux 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 14:09:20 +00:00
naibaandnaiba/CloudCode 5d7fef6408 test(agentcompat): isolate stress resource sampling 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 08:04:17 +00:00
naibaandnaiba/CloudCode a7cf600bd7 test(agentcompat): configure connection count sampling 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 08:02:45 +00:00
naibaandnaiba/CloudCode 02ccdf038c test(agentcompat): expose connection count fixture option 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 08:02:19 +00:00
naibaandnaiba/CloudCode d96b34b0d4 ci: require agentcompat stress validation 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:55:20 +00:00
naibaandnaiba/CloudCode d501f23473 test(agentcompat): add exact stress scenario 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:54:03 +00:00
naibaandnaiba/CloudCode 64daa6e9ae test(agentcompat): add scenario CLI wiring 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:52:28 +00:00
naibaandnaiba/CloudCode 9af3720bf0 test(agentcompat): add integration scenarios 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:51:20 +00:00
naibaandnaiba/CloudCode b3b3d92895 test(agentcompat): add evidence validation 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:50:03 +00:00
naibaandnaiba/CloudCode 1c3e926819 test(agentcompat): add protocol clients 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:48:15 +00:00
naibaandnaiba/CloudCode 8a0e84b214 test(agentcompat): add dashboard runtime harness 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:46:55 +00:00
naibaandnaiba/CloudCode 2a3245c412 test(agentcompat): add agent runtime harness 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:45:05 +00:00
naibaandnaiba/CloudCode 3a9e0c7887 test(agentcompat): add process supervision harness 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:43:28 +00:00
naibaandnaiba/CloudCode 0543995ec3 test(agentcompat): harden deterministic fixtures 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:42:03 +00:00
naibaandnaiba/CloudCode fcf58b0b4b test(agentcompat): define integration contracts 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-07-20 04:39:48 +00:00