This repository was archived by the owner on Sep 28, 2026. It is now read-only.
Repository navigation
ctx-wire: fix ATOAT redaction gap, correct MTP fixtures, add dotnet-publish/pack filters - #30
Merged
Conversation
acli.toml (security): the `AT[A-Z]TT` redaction pattern required a literal `TT` in positions 4-5, so it structurally could not match `ATOAT…` OAuth tokens — they reached agent context in the clear. Widen to `AT(?:ATT|CTT|OAT)…` (covers ATATT API / ATCTT scoped / ATOAT OAuth) and use a generic `AT***REDACTED***` label that no longer leaks which token class was present. Add an ATOAT regression test; update ATATT/ATCTT expecteds. dotnet-test.toml / dotnet-run.toml (fixture accuracy): the MTP summary block uses `succeeded:` (EN) and `réussie :` (FR past participle), not `passed:` / `réussite :`. Corrected the fixtures and header docs, and added native `dotnet test` MTP-integration fixtures (per-app status line + summary block). All strings verified empirically against .NET 10.0.301 with the Microsoft.Testing.Platform runner in both en and fr locales. The audited-for `Test summary:` (no "run") trigger variant was NOT added: the native `dotnet test` runner emits `Test run summary:` (with "run") in every path checked — single project, solution, and multi-project roll-up — and the no-"run" string occurs in neither the .NET 10 SDK nor the MTP assemblies, so adding it would be dead regex. The existing trigger already covers it. Conformance suite: 44/44 pass (41 -> 44). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gYzfFg4y7yEDdFJo3uUMS
…uild gaps Rounds out the dotnet filter set after checking every command in the team's workflow (build/test/run/restore/tool already covered) against a real .NET 10.0.301 SDK. New filters (EN+FR, strings verified empirically): - dotnet-publish: `dotnet publish` shares build's restore preamble but prints NO `Build succeeded.` summary in .NET 10 — its success marker is the `-> …/publish/` artifact line. Strip filter that drops restore/build chrome, keeps the publish path, and preserves trim/AOT `warning IL####` lines (must not be hidden). Used by the docker-image-create skill. - dotnet-pack: collapse a clean pack to `dotnet pack: ok` on `Successfully created package` / `Création réussie du package`; keep build and NU#### packaging errors. Deliberately NOT added, with rationale recorded in the README table: - dotnet format: silent on success (the hook path), and its diagnostics (`error WHITESPACE:` / analyzer IDs) must reach context — nothing to collapse. - dotnet list package: `--outdated` / `--vulnerable` tables are the payload to keep, not chrome to strip. Also verified (and noted): `dotnet build` still emits the classic `Build succeeded.` / `0 Error(s)` summary on .NET 10 (piped, PTY, --tl:off), so the existing dotnet-build filter remains correct. Conformance suite: 54/54 pass (44 -> 54). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gYzfFg4y7yEDdFJo3uUMS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit and correction of the
token-diet/ctx-wire/filters.ddotnet + acli filter pack. Every string was verified empirically against a real .NET 10.0.301 SDK (MTP runner, EN + FR locales), not guessed.Security fix
AT[A-Z]TTredaction pattern structurally could not matchATOAT…(OAuth) tokens — they reached agent context in the clear. Widened toAT(?:ATT|CTT|OAT)…(ATATT API / ATCTT scoped / ATOAT OAuth) with a genericAT***REDACTED***label that no longer leaks the token class. Added an ATOAT regression test.Fixture accuracy (dotnet-test, dotnet-run)
succeeded:(EN) andréussie :(FR past participle), notpassed:/réussite :. Corrected fixtures + docs; added nativedotnet testMTP-integration fixtures.Test run summary:(with "run") in every path — single project, solution, multi-project roll-up — so noTest summary:trigger variant was needed (it exists in no SDK/MTP assembly; adding it would be dead regex).New filters (EN + FR)
publishprints noBuild succeeded.on .NET 10; success marker is the-> …/publish/artifact line. Strip filter that drops restore/build chrome, keeps the publish path, and preserves trim/AOTwarning IL####lines.dotnet pack: okonSuccessfully created package/Création réussie du package; keeps build +NU####errors.Verified, deliberately not added
Build succeeded./0 Error(s)on .NET 10 (piped, PTY,--tl:off) — existing filter remains correct.--outdated/--vulnerabletables are the payload to keep.Validation
dotnet test/publish/packoutput (EN + FR) piped through the filters produces the expected collapses/preservations.🤖 Generated with Claude Code
https://claude.ai/code/session_014gYzfFg4y7yEDdFJo3uUMS
Generated by Claude Code