chore(beads): file the CSWSH hole, the records-mode minibuffer exit, and route vvl3's assertions

Browse Source

From WU-I (PR #21) and WU-G (PR #27) hand-backs. Searched the open backlog
first; none of these duplicates an existing bead.

  improvise-kc7n  P2 — improvise-ws-server never checks Origin. Verified
                  independently: `grep -rni origin crates/improvise-ws-server/src/`
                  returns nothing. A WebSocket handshake is exempt from the
                  same-origin policy, so any page an allowed user visits can
                  drive their session from their own allowed address — the
                  attack an IP allow-list structurally cannot see, because the
                  request genuinely is from an allowed client. Loopback is not
                  exempt and has no proxy in front of it, so the local path is
                  the least protected. Related to improvise-kpnr rather than
                  blocked by it: authentication and CSWSH are different
                  questions and an answer to either leaves the other open.

  improvise-sihr  P2 — every minibuffer mode entered from records mode exits to
                  plain Normal while the layout is still records. Affects `:`,
                  Ctrl-E and Ctrl-W; only the last is new. Declined in PR #27
                  because fixing one arm of a three-arm rule is not a fix, and
                  characterized there instead.

improvise-vvl3 also gains the four assertions improvise-taxx's fix owes, so
that ticket need not re-derive them — including the one that must fail against
the previous unconditional close handler, which is the guard and not the
decoration. Recorded there because vvl3 now owns the JS test-infrastructure
decision that PR #21 declined.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

...

This commit is contained in:

Edward Langley

2026-09-19 23:21:28 -07:00

parent f45240c2e9

commit 553b2cb90d

1 changed files with 8 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

.beads/issues.jsonl

+8 -2

File diff suppressed because one or more lines are too long