Files

T

kyleandClaude Opus 5.5 5e55fe4c66 M3b plan: every task's git add includes Cargo.lock

Task 04 added dependencies to toolkit and its git add line left out the lock
file, so the driver stopped on an unclean tree. The lock change is folded into
task 04's commit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-23 00:00:12 -07:00

2.2 KiB

Raw Blame History

M3b task 03: a grant path that cannot be mounted is invalid

Branch: m3b (run git switch m3b; git status --short must be empty, otherwise stop) Commit subject: Refuse grant paths that cannot be mounted

Goal

From M3b, a grant's paths are mounted into the tool container as --volume=<path>:<path>:ro. In that argument : and , are separators, so a path containing either would be read as something else. A grant with such a path is invalid, which (as for every invalid grant) makes the whole set invalid and denies every call until it is fixed.

Files

Copy: crates/brokerd/tests/grants_mount.rs
Modify: crates/brokerd/src/grants.rs, docs/implementer-log.md

The rule

In check_grant, the loop over inner.constraints.paths has two cases today: the path is /, or it is not a valid path. Add a third, checked only when the first two did not apply (a path that is already reported as invalid is not reported twice):

} else if path.contains([':', ',']) {
    // Mounted as `--volume=<path>:<path>:ro`, where both are separators.
    push(problems, file.clone(), None,
         format!("{:?} cannot be mounted: it contains ':' or ','", path));
}

So a grant file with paths = ["/home/kyle/a:b"] gives exactly one problem, for that file, whose text contains cannot be mounted. Other punctuation (space, ;, =, ., -, _) stays fine.

Steps

1. Copy. git switch m3b, then cp docs/plans/M3b/files/crates/brokerd/tests/grants_mount.rs crates/brokerd/tests/
2. See it fail. cargo test -p brokerd --test grants_mount. Expected: 1 of 2 fails (a_path_with_a_colon_or_a_comma_makes_the_set_invalid).
3. Add the rule. Run cargo fmt --all.
4. See it pass. cargo test -p brokerd --test grants_mount --test grants. Expected: 2 and 17 passed.
5. Run the gate. make gate. Expected last line: gate: ok.
6. Log and commit. git add crates/brokerd docs/implementer-log.md Cargo.lock && git commit

Done when

Both suites pass; make gate prints gate: ok.

Stop and report if

A given test wants a path with : or , to be accepted, or wants two problems for one path.

2.2 KiB Raw Blame History