Skip to content

fix(codebuddy): make scaffold scanning linear - #575

Open
luvs01 wants to merge 11 commits into
devfrom
codex/fix-codebuddy-vulnerability-causing-dos
Open

luvs01 wants to merge 11 commits into
devfrom
codex/fix-codebuddy-vulnerability-causing-dos

Conversation

@luvs01

@luvs01 luvs01 commented Sep 20, 2026

Copy link
Copy Markdown
Owner

Motivation

  • A newly added CodeBuddy scaffold guard synced and lowercased full remaining suffixes at every line start, producing O(n^2) CPU work and enabling event-loop DoS on large multi-line deltas.

Description

  • Replace repeated suffix lowercasing with a single text.toLowerCase() per scan and perform offset-based, marker-sized comparisons to make the scanner linear-time.
  • Change prefixAtEnd to accept a pre-lowercased buffer and test only the small marker-sized slice instead of lowercasing the entire suffix.
  • Use loweredText.startsWith(marker, index) and bounded prefixAtEnd checks for all marker and invoke-prefix matching paths.
  • Add a regression test in tests/providers/codebuddy-adapter.test.ts that emits a large harmless multiline delta to ensure the scan completes quickly and the output is forwarded unchanged.

Testing

  • Ran bun test tests/providers/codebuddy-adapter.test.ts and the focused CodeBuddy adapter suite passed (41 tests).
  • Ran bun run typecheck and bun run structure:check which both passed.
  • Ran bun run privacy:scan which passed.
  • Attempted the full suite (bun run test) but the parallel full run surfaced unrelated existing failures in other integration tests; the targeted focused tests above validate the change for this adapter.

Codex Task


Devin Review

@coderabbitai

coderabbitai Bot commented Sep 20, 2026

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 459f1833-3dd3-4303-8d10-ea6e4e843c40


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 20, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-20T13:01:15.140014Z 4489d68 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4489d68bd0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

initialFence: "`" | "~" | null,
initialLineStart: boolean,
): ScanResult {
const loweredText = text.toLowerCase();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve original offsets when normalizing scaffold text

When an earlier character expands during Unicode lowercasing, the scanner still advances with offsets from text but searches loweredText at those offsets. For example, İ\n<||DSML|| calls>\n<||DSML|| invoke name="exec">... gains an extra code unit when İ becomes , so the DSML lines are missed and forwarded instead of producing vendor_scaffold_detected; partial markers after such a character can also be released prematurely. Lowercase only the bounded candidate slices or use an offset-preserving ASCII-insensitive comparison.

AGENTS.md reference: src/AGENTS.md:L19-L19

Useful? React with 👍 / 👎.

devin-ai-integration[bot]

This comment was marked as resolved.

@github-actions github-actions Bot added the bug Something isn't working label Sep 20, 2026
@github-actions

Copy link
Copy Markdown

Deterministic PR hygiene checks passed.

…forwarded role (lidge-jun#5334 follow-up)

lidge-jun#5334 made the developer wire role tri-state: an undeclared destination folds
it to system. Two suites asserting role:"developer" on the Chat wire were
missed because they are about tool-result repair ordering and document parts,
not role selection — declare the destination, per the convention the change
established.

Verified: both files fail on dev@600075d2 with system-for-developer wire roles
and pass with the declaration.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…ment suite

lidge-jun#5334 made foldDeveloperRoleToSystem tri-state: unset now folds developer to
system, and only an explicit false records a destination that accepts the role.
This suite's chatProvider fixture declared nothing, so its developer-turn
assertion folded and failed on the PR merge. Record acceptance, matching the
conformance-fixture fix in lidge-jun#5341.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…toolcalls suite

lidge-jun#5334 made foldDeveloperRoleToSystem tri-state: unset now folds developer to
system, and only an explicit false records a destination that accepts the role.
This suite's provider fixture declared nothing, so its deferred-barrier
assertions folded and T1/T5/T6 failed on the PR merge. Record acceptance,
matching the inline-document and conformance-fixture updates.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The widget job builds the desktop app without TAURI_SIGNING_PRIVATE_KEY,
but tauri.conf.json sets bundle.createUpdaterArtifacts and an updater
pubkey, which makes updater signing mandatory and fails the bundler with
'A public key has been found, but no private key'.

Override createUpdaterArtifacts off via tauri build --config so the
unsigned CI build produces only the .app it verifies. Release builds keep
producing signed updater artifacts through release.yml.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Resolve clerical overlap in the two role-acceptance test suites: both sides
add foldDeveloperRoleToSystem: false to the same provider fixtures; keep
dev's canonical wording.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
luvs01 and others added 4 commits September 21, 2026 01:04
Co-Authored-By: Epinephrine <luvs01@hanmail.net>
Unicode lowercasing can expand a code point (e.g. İ -> i+combining dot), which shifted loweredText positions away from text offsets and let a calls+invoke scaffold slip through unflagged. Compare markers with ASCII-only folding so indices stay aligned, and replace the wall-clock perf assertion with a scaled-input check plus an expansion regression test.

Co-Authored-By: Epinephrine <luvs01@hanmail.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark bug Something isn't working codex

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant