skills/pbakaus_impeccable
1
0
Fork 0
mirror of https://github.com/pbakaus/impeccable.git synced 2026-09-21 18:47:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

Only the lease holder may answer an agent target; leave a plain bar alone

Browse Source 
Review found that /agent-target-result checked the shared helper token
and nothing else, so any connected overlay could resolve a target it
never claimed. A result post now names the overlay (`clientId`), and
while the target is pending only its lease holder's word lands: a
bystander gets 409 (not_holder, or unclaimed when nobody holds it) and
the request stays pending. The overlay sends its client id with every
result. Every protocol case now answers from the tab that actually
holds the claim.

Also: the helper-wide bar preference is applied on every connected
frame, and restoring wrote an empty display value, which dropped the
bar's own inline flex layout for a plain live session that never asked
for anything. Hiding remembers the bar's display value, restoring puts
exactly that back, and a restore on a visible bar is a no-op. A plain
boot through the launcher keeps display: flex after connect and its
payload carries none of the lane's keys.

Written with AI assistance (Claude).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Abdul Wahab
2026-09-15 05:45:49 +05:00
committed by Abdul Wahab
co-authored by Claude Fable 5
parent 1a699913e4
commit 65c8089182
7 changed files with 156 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/live-browser-source.test.mjs
+10
View File
@@ -903,6 +903,11 @@ describe('live-browser source contracts', () => {
/body\.error === 'agent_target_already_served' && msg\.type === 'generate'\s*&& msg\.id && msg\.id === currentSessionId\) \{\s*abandonSupersededGo\(msg\.id\);\s*return null;/,
'a Go the helper refused as already served drops this page\'s local session instead of leaving it generating for nothing',
);
assert.match(
SOURCE,
/function postAgentTargetResult\(targetId, result\) \{[\s\S]{0,600}?JSON\.stringify\(\{ token: TOKEN, targetId, clientId: AGENT_TARGET_CLIENT_ID, \.\.\.result \}\)/,
'a result post names this page, so the helper can refuse a bystander answering for the holder',
);
assert.match(
SOURCE,
/case 'connected':\s*applyLiveBarPreference\(msg\.hideLiveBar === true\);/,
@@ -924,6 +929,11 @@ describe('live-browser source contracts', () => {
'a bar built after the helper spoke still ends up hidden',
);
assert.ok(!/sessionStorage\.getItem\('impeccable-live:hide-bar/.test(SOURCE), 'no per-tab memory: the helper is the single source of truth');
assert.match(
SOURCE,
/function setLiveBarHidden\(hidden\) \{[\s\S]{0,700}?if \(globalBarEl\.style\.display === 'none'\) \{\s*globalBarEl\.style\.display = globalBarEl\.dataset\.liveBarDisplay \|\| 'flex';/,
'restoring puts the bar\'s own display value back and is a no-op on a bar that is not hidden, so a plain live session\'s connected frame changes nothing',
);
assert.ok(!/releaseHiddenLiveBar/.test(SOURCE), 'no session end brings the bar back: the accept and the bake that follows stay bar-free');
const teardownBody = SOURCE.match(/function teardown\(\) \{[\s\S]*?\n \}/)?.[0] || '';
assert.match(teardownBody, /liveBarHiddenByHelper = false;/, 'only the helper stopping resets it');