skills/pbakaus_impeccable
1
0
Fork 0
mirror of https://github.com/pbakaus/impeccable.git synced 2026-09-21 10:36:27 +03:00
Code Issues Packages Projects Releases Wiki Activity

Only the lease holder may answer an agent target; leave a plain bar alone

Browse Source 
Review found that /agent-target-result checked the shared helper token
and nothing else, so any connected overlay could resolve a target it
never claimed. A result post now names the overlay (`clientId`), and
while the target is pending only its lease holder's word lands: a
bystander gets 409 (not_holder, or unclaimed when nobody holds it) and
the request stays pending. The overlay sends its client id with every
result. Every protocol case now answers from the tab that actually
holds the claim.

Also: the helper-wide bar preference is applied on every connected
frame, and restoring wrote an empty display value, which dropped the
bar's own inline flex layout for a plain live session that never asked
for anything. Hiding remembers the bar's display value, restoring puts
exactly that back, and a restore on a visible bar is a no-op. A plain
boot through the launcher keeps display: flex after connect and its
payload carries none of the lane's keys.

Written with AI assistance (Claude).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Abdul Wahab
2026-09-15 05:45:49 +05:00
committed by Abdul Wahab
co-authored by Claude Fable 5
parent 1a699913e4
commit 65c8089182
7 changed files with 156 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skill/scripts/live-browser.js
+15 -2
View File
@@ -7129,7 +7129,7 @@
fetch('http://localhost:' + PORT + '/agent-target-result?token=' + TOKEN, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ token: TOKEN, targetId, ...result }),
body: JSON.stringify({ token: TOKEN, targetId, clientId: AGENT_TARGET_CLIENT_ID, ...result }),
}).catch(() => { /* server gone; nothing to report to */ });
}
@@ -7229,9 +7229,22 @@
setLiveBarHidden(liveBarHiddenByHelper);
}
// A plain live session must never notice this code: hiding remembers the
// bar's own display value and restoring puts exactly that back, and a
// restore on a bar that is not hidden is a no-op, so the `connected`
// frame every session receives changes nothing unless the lane asked.
function setLiveBarHidden(hidden) {
if (!globalBarEl) return;
globalBarEl.style.display = hidden ? 'none' : '';
if (hidden) {
if (globalBarEl.style.display !== 'none') {
globalBarEl.dataset.liveBarDisplay = globalBarEl.style.display || 'flex';
globalBarEl.style.display = 'none';
}
return;
}
if (globalBarEl.style.display === 'none') {
globalBarEl.style.display = globalBarEl.dataset.liveBarDisplay || 'flex';
}
}
function claimAgentTarget(targetId, report) {