open/repo-mailbox
1
0
Fork 0
Code Issues Releases 1 Activity

fix(engine): never deliver a broadcast back to its own sender

Browse source 
A --broadcast landed in _broadcast/inbox with no seen-set entry for the
sender, so the announcing repo got its own announcement injected at its
next session start. Pure noise: the sender already knows its own news.

coord-send now records the delivered filename in _broadcast/seen/<sender>
at delivery time, reusing the existing per-repo seen set rather than
introducing a second exclusion mechanism. Filtering on the from: field at
read time was rejected: from: is sender-controlled, so it would let any
repo suppress a broadcast for another by forging the field.

The seen file is keyed by the RAW sender name because coord-inbox keys it
by the unsanitized repo name; using SAFE_FROM would silently miss for
names like "my repo". A raw name in a path needs a guard, so senders
containing a slash or equal to . / .. skip the marking instead.

Selftest 64 -> 68 checks.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CvTviFeoMCKJcALATRempy
This commit is contained in:
Kjell Tore Guttormsen 2026-07-25 06:11:26 +02:00
commit 9aa9e07d75
2 changed files with 32 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/coord-send.sh
View file

@ -131,6 +131,21 @@ fi
echo "coord-send: delivered to $TARGET_LABEL ($FNAME)"
# A broadcast reaches every repo INCLUDING the sender, so mark it seen for the
# sender now: the announcing repo already knows its own news, and re-injecting
# it would burn operator attention at every session start. Keyed by the RAW
# sender name, because coord-inbox keys the seen file by the unsanitized repo
# name - using SAFE_FROM here would silently miss for names like "my repo".
# Raw means it must be a safe path component: skip rather than escape the dir.
if [ "$BROADCAST" -eq 1 ]; then
case "$FROM" in
*/*|.|..) : ;;
*) SEEN_DIR="$COORD/_broadcast/seen"
mkdir -p "$SEEN_DIR" 2>/dev/null &&
printf '%s\n' "$FNAME" >> "$SEEN_DIR/$FROM" 2>/dev/null ;;
esac
fi
# --- Reply mode: mark the original handled ---
if [ -n "$REPLY_ORIG" ]; then
"$(dirname "$0")/coord-done.sh" --repo "$FROM" "$REPLYTO" >/dev/null 2>&1