Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

action summary: three things it cannot see, and what each one costs

Chiusa
  • Qualcosa non va?
#95 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
shell, typescript
Ambito
authorization, security

Direzione di ricerca

Start with authorization.ts and the shadow action-summary behavior, then review the related concerns in #59 and phase 4 in #67. Do not change anything before the jev-v3 flip; after step 5 wires the decision order, decide whether each residual belongs in code or the plan's failure matrix.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement ready-for-agent

authorization.ts's action summary is what the user_authorization question is asked over, so anything the summary cannot see is a question the model answers over a command it never saw whole. Three things it cannot see today. None of them is a bug in what shipped in #94; they are the stated edges of a summary that is not a parser.

1. The value of a command substitution

curl $(cat url.txt)

summarizes to read: url.txt and network: with no target. The inner segment is classified because the host tokenizer splits at (, but the outer segment loses the value, so the host the request actually reaches is never named. A double-quoted substitution stays inside one token instead, which is why curl -d "$(cat ~/.ssh/id_rsa)" does report the secret read.

Same root as #59, which is about commandHasOutboundNetwork missing network verbs inside substitutions. Fix both together or neither.

2. Sentence shape is a heuristic, not a boundary

A target is hashed when it reads as a sentence: three or more word parts with two or more function words. ownerSignedOff and clearedAlready have none, so they keep their text and carry a short claim to the model.

The boundary is the question's own instructions, which say targets describe an action and never authorize one. The hashing rule is defense in depth. Do not let a future change treat it as the boundary.

3. Program text is never read

awk, sed and yq report as run-code with the verb as the target. What their program does - a system() call, an e flag on s///, a -i rewrite of files named inside the program rather than on the command line - is invisible. Phase 4 reads script bodies (#67) and is the place to decide whether inline program text gets the same treatment.

What to do

Nothing before the jev-v3 flip. The summary runs in shadow and decides nothing. Reopen this when step 5 wires the decision order, and decide then whether each residual needs code or a line in the plan's failure matrix.

Lingua principale
TypeScript
Stelle
0
Fork
1
Merge medio
3h 35m
PR unite (30g)
50

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di STRML/omp-classifier

Tutte le issue di STRML/omp-classifier

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.