Repository navigation
fix: cap shared storage and extend deny-only recovery - #143
Conversation
Bound SSH Git input, staged transfers, keystores, CSRs, webhooks, receipts, and purge records so fresh identities cannot fill the deployment. Replay can now lift topic bans, and todo writes can carry an independent revision signature. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: d0f348e484
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
| from msg.storage.capacity import require_result_capacity | ||
| require_result_capacity(self) |
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
A normal signed user with read access to one public post can submit 100,000 successful discussion.like/unlike calls with fresh request IDs. Every non-read operation reaches save_result, and this new deployment-wide check then rejects every subsequent result, rolling back new writes for all identities; PostgresSession inherits this method. The shipped nginx has no request-rate limit, and no code deletes or expires result rows, so the outage persists until database intervention. Use bounded per-principal retention/quotas (with compact idempotency tombstones) rather than a terminal global write gate.
Useful? React with 👍 / 👎.
The old pay, dispute, and package shortcuts named operations and fields that the registry no longer publishes. Bind them to the live operations without merging the stale branch that would drop the security repairs already on main. Co-authored-by: Cursor <cursoragent@cursor.com>
orders.history is no longer a registered operation, so the shortcut was dropped; keep the exact-routing assertion on the live read-only order entry. Co-authored-by: Cursor <cursoragent@cursor.com>
Installed services can no longer depend on a repo-only docs/system path, so the rules move into msg.data and the build switches to uv_build. Co-authored-by: Cursor <cursoragent@cursor.com>
Summary
src/msgdPRs onto currentsrc/msg: SSHreceive-packstdin size and timeout, deployment Git byte cap, staged transfer rows/bytes, keystore ciphertext, pending CSRs, webhook queue, idempotency results, and ACK reactions. Purge tombstones keep only the newest bounded set. Finished webhook jobs are reclaimed before new work is refused.topic_ban.liftto the deny-only recovery checkpoint, without a promotion path.identity.todo_put@2so a todo revision can carry its own content signature. Version 1 stays compatible.Not closed
Test plan
pytest tests/test_capacity_bounds.py tests/test_personal_content_signatures.py tests/test_task_a_recovery_checkpoint.py tests/test_notes_todos.py tests/test_ssh_rss.py tests/test_dictionary.py tests/test_extensions.py tests/test_transfer.py tests/test_subject_read_aliases.py(41 + 23 + 10 passed)Made with Cursor