Breadway/breadclip
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: report crashes and freezes to breadbug (pilot) #19

Merged
Breadway merged 8 commits from feature/breadbug-pilot into main 2026-10-19 00:20:31 +08:00
Conversation 13 Commits 8 Files changed 12 +508 -82
Breadway commented 2026-10-09 21:54:25 +08:00
Owner
Copy link

Pilot for ECO-68 (rollout) and the acceptance example for BREAD-16. bread-utils is pinned to the released tag v0.8.1, which carries the bug module (bread-ecosystem PR #68), so the lockfile resolves against a tag instead of a feature branch.

What

breadclipd calls BreadClient::enable_bug_reporting and ticks from its main loop:

  • the strictest configuration, because clipboard text is exactly the kind of data that must not leak into a report: panic_message = false (a formatted panic message could contain copied text) and forward_logs = false. A report from this app still carries the location, the stack (module + offset + build-id) and freeze detection.
  • the tick is in the main thread's keep-alive loop (1 s), not in the watcher threads, which are legitimately idle whenever nothing is copied; so this detects a stopped or wedged process, not a stuck watcher. Worth knowing before copying the pattern.
  • Everything is a no-op without breadd; Cargo.lock updated.

Checked

Builds, 31 tests pass. I did not run breadclipd end to end: it needs a Wayland session and would watch the live clipboard. The underlying behaviour is tested in bread-utils with real panics and a real SIGSEGV.

For the rest of the rollout

Per app: bump bread-utils to the new tag, add enable_bug_reporting after startup, tick from the main loop (GTK apps: attach_glib_main_loop() under the gtk feature), set panic_message = false / forward_logs = false for apps that handle private text (breadsearch, breadpad, breadclip). Optionally bread_utils::bug::has_build_id().

Pilot for ECO-68 (rollout) and the acceptance example for BREAD-16. bread-utils is pinned to the released tag v0.8.1, which carries the `bug` module (bread-ecosystem PR #68), so the lockfile resolves against a tag instead of a feature branch. ## What `breadclipd` calls `BreadClient::enable_bug_reporting` and ticks from its main loop: - the **strictest configuration**, because clipboard text is exactly the kind of data that must not leak into a report: `panic_message = false` (a formatted panic message could contain copied text) and `forward_logs = false`. A report from this app still carries the location, the stack (module + offset + build-id) and freeze detection. - the tick is in the main thread's keep-alive loop (1 s), not in the watcher threads, which are legitimately idle whenever nothing is copied; so this detects a stopped or wedged process, not a stuck watcher. Worth knowing before copying the pattern. - Everything is a no-op without breadd; `Cargo.lock` updated. ## Checked Builds, 31 tests pass. I did not run `breadclipd` end to end: it needs a Wayland session and would watch the live clipboard. The underlying behaviour is tested in bread-utils with real panics and a real SIGSEGV. ## For the rest of the rollout Per app: bump bread-utils to the new tag, add `enable_bug_reporting` after startup, tick from the main loop (GTK apps: `attach_glib_main_loop()` under the `gtk` feature), set `panic_message = false` / `forward_logs = false` for apps that handle private text (breadsearch, breadpad, breadclip). Optionally `bread_utils::bug::has_build_id()`.
feat: report crashes and freezes to breadbug (pilot)
All checks were successful
check / check (push) Successful in 3m29s
Details
14445a36b9 
breadclipd enables bread-utils' bug reporting: a panic hook and native crash
handlers that send the stack to breadd (local socket only), plus a heartbeat
ticked from the main loop so a wedged process is noticed. Because breadclip
handles clipboard contents it uses the strictest settings: the panic message
is withheld (a formatted message could contain copied text) and no logs are
forwarded.

Depends on bread-utils' feature/breadbug-client branch until that is tagged;
do not merge before then.

Refs ECO-68
Breadway commented 2026-10-15 12:56:23 +08:00
Author
Owner
Copy link

Independent review of PR 19 at exact head 14445a36b9, base main 2957b20499 (mergeable, single commit). Expected head matched live head; no staleness.

CI: required check "check / check (push)" is success at this exact SHA (Actions run 84, 3m29s). That workflow is clippy (--workspace --all-targets --locked -- -D warnings) plus cargo test (--workspace --locked). No branch protections, no outstanding reviews. Independent local run in scratch worktree: cargo build --locked --offline -p breadclipd ok; cargo test --locked --offline --workspace ok (breadclipd 31 passed, breadclip-core 19 passed).

Criterion mapping (CLIP-19 card plus BREAD-16 pilot acceptance):

  1. enable_bug_reporting with strictest config: PASS. breadclipd/src/main.rs sets BugOptions::new(version) with panic_message=false and forward_logs=false, leaving panic_hook, native_crashes and tick-gated heartbeat on. Runtime proof with the exact pinned bread-utils rev and identical call sequence (stub socket harness): induced panic carrying fake clipboard text produced bug.marker kind=panic with message "(message omitted by the app)", location present, 24 frames each with module plus offset plus build_id, and zero bytes of the panic payload anywhere on the wire. forward_logs=false means no log sender thread exists, so no log path can carry clipboard text.
  2. Tick from main keep-alive loop (1s), not watcher threads: PASS. Code ticks then sleeps 1s on the main thread. Runtime proof: 4 bug.heartbeat messages (app clip, pid, interval_ms 2000) arrived while ticking. Defaults keep heartbeat_unconditional=false, so a wedged main thread goes quiet as intended.
  3. Report still carries location, stack and freeze detection: PASS (see evidence in 1 and 2).
  4. No-op without breadd: PASS. Harness pointed at a socket with no listener: process panicked normally (exit 101), hook did not hang or error, no output written.
  5. Induced panic produces a breadd store entry: PARTIALLY VERIFIED, not fully. Proven: the exact wire payload this code emits (app clip, kind panic, message omitted, location, 24 build-id frames) deserializes into breadd Marker (all fields optional/defaulted except kind; ipc_marker defaults t) and record_marker stores it whenever the app is not excluded (exclusion is opt-in; clip is not excluded by default). Not observed live: no isolated breadd was started (live breadd pid 2572 must not be touched; a second instance attempt via --help blocked and was abandoned), and the real breadclipd binary cannot run here (live singleton held by pid 2454; running it would watch the live clipboard). The author likewise discloses no end-to-end run in the PR body. Store persistence itself is breadd-side code outside this diff.

Pin finding (merge-relevant, not silent): Cargo.toml uses branch feature/breadbug-client as the card announces, but Cargo.lock resolves to b2614ba0e1b48f25cd40a09e184b721f512f5408, which predates all bread-ecosystem PR68 repair and the merge 94ea374. The bug/ diff between them is 1618 insertions / 353 deletions including a new scrub.rs. b2614ba is the rev that drew independent findings (shutdown hang, SIGSEGV disposition, no scrubbing, drop-newest log queue). With forward_logs=false and the message omitted, the leak-relevant paths are inert at this rev, but CI tested known-stale code. Re-pin to the bread-utils tag once cut, then fresh CI plus fresh review.

Scope notes: --capture-once short-lived processes intentionally return before enable_bug_reporting, so panics there are not reported; acceptable for this pilot but worth knowing. No unrelated source churn (lock plus the two intended files only).

Verdict: blocked (no code rework needed now; do not merge). Blockers: (1) bread-utils tag decision, then re-pin Cargo.toml plus lock from branch/b2614ba to the tag; (2) after re-pin, green check at the new head, fresh exact-head review, and a live induced-panic store-entry observation. Next action: coordinator to hold for the tag, re-pin, rerun CI, and request fresh review. Scratch worktree used: ~/.worktrees/breadclip/fix/muse-review-clip19 (detached at reviewed head; primary checkout untouched).

Independent review of PR 19 at exact head 14445a36b9b58f3d96342673ac156c70c7b15ddf, base main 2957b20499e08786eb03d5005fd0634683990d0b (mergeable, single commit). Expected head matched live head; no staleness. CI: required check "check / check (push)" is success at this exact SHA (Actions run 84, 3m29s). That workflow is clippy (--workspace --all-targets --locked -- -D warnings) plus cargo test (--workspace --locked). No branch protections, no outstanding reviews. Independent local run in scratch worktree: cargo build --locked --offline -p breadclipd ok; cargo test --locked --offline --workspace ok (breadclipd 31 passed, breadclip-core 19 passed). Criterion mapping (CLIP-19 card plus BREAD-16 pilot acceptance): 1. enable_bug_reporting with strictest config: PASS. breadclipd/src/main.rs sets BugOptions::new(version) with panic_message=false and forward_logs=false, leaving panic_hook, native_crashes and tick-gated heartbeat on. Runtime proof with the exact pinned bread-utils rev and identical call sequence (stub socket harness): induced panic carrying fake clipboard text produced bug.marker kind=panic with message "(message omitted by the app)", location present, 24 frames each with module plus offset plus build_id, and zero bytes of the panic payload anywhere on the wire. forward_logs=false means no log sender thread exists, so no log path can carry clipboard text. 2. Tick from main keep-alive loop (1s), not watcher threads: PASS. Code ticks then sleeps 1s on the main thread. Runtime proof: 4 bug.heartbeat messages (app clip, pid, interval_ms 2000) arrived while ticking. Defaults keep heartbeat_unconditional=false, so a wedged main thread goes quiet as intended. 3. Report still carries location, stack and freeze detection: PASS (see evidence in 1 and 2). 4. No-op without breadd: PASS. Harness pointed at a socket with no listener: process panicked normally (exit 101), hook did not hang or error, no output written. 5. Induced panic produces a breadd store entry: PARTIALLY VERIFIED, not fully. Proven: the exact wire payload this code emits (app clip, kind panic, message omitted, location, 24 build-id frames) deserializes into breadd Marker (all fields optional/defaulted except kind; ipc_marker defaults t) and record_marker stores it whenever the app is not excluded (exclusion is opt-in; clip is not excluded by default). Not observed live: no isolated breadd was started (live breadd pid 2572 must not be touched; a second instance attempt via --help blocked and was abandoned), and the real breadclipd binary cannot run here (live singleton held by pid 2454; running it would watch the live clipboard). The author likewise discloses no end-to-end run in the PR body. Store persistence itself is breadd-side code outside this diff. Pin finding (merge-relevant, not silent): Cargo.toml uses branch feature/breadbug-client as the card announces, but Cargo.lock resolves to b2614ba0e1b48f25cd40a09e184b721f512f5408, which predates all bread-ecosystem PR68 repair and the merge 94ea374. The bug/ diff between them is 1618 insertions / 353 deletions including a new scrub.rs. b2614ba is the rev that drew independent findings (shutdown hang, SIGSEGV disposition, no scrubbing, drop-newest log queue). With forward_logs=false and the message omitted, the leak-relevant paths are inert at this rev, but CI tested known-stale code. Re-pin to the bread-utils tag once cut, then fresh CI plus fresh review. Scope notes: --capture-once short-lived processes intentionally return before enable_bug_reporting, so panics there are not reported; acceptable for this pilot but worth knowing. No unrelated source churn (lock plus the two intended files only). Verdict: blocked (no code rework needed now; do not merge). Blockers: (1) bread-utils tag decision, then re-pin Cargo.toml plus lock from branch/b2614ba to the tag; (2) after re-pin, green check at the new head, fresh exact-head review, and a live induced-panic store-entry observation. Next action: coordinator to hold for the tag, re-pin, rerun CI, and request fresh review. Scratch worktree used: ~/.worktrees/breadclip/fix/muse-review-clip19 (detached at reviewed head; primary checkout untouched).
Breadway commented 2026-10-15 13:01:23 +08:00
Author
Owner
Copy link

Independent review of Breadway/breadclip PR 19 at exact head 14445a36 (base 2957b204): verdict blocked, no author rework needed now, do not merge.

Verified with runtime evidence: strictest config (panic_message=false, forward_logs=false) redacts an induced panic carrying fake clipboard text to "(message omitted by the app)" with location plus 24 build-id frames and zero payload bytes on the wire; 1s main-loop ticks emit bug.heartbeat; absent breadd is a clean no-op (exit 101, no hang). Required CI check is success at this exact SHA; local locked build plus workspace tests pass (31 plus 19). Full mapping: #19 (comment)

Blockers: (1) bread-utils tag decision, then re-pin from branch lock b2614ba (pre-repair, predates merged 94ea374 by 1618+/353- in bug/) to the tag; (2) after re-pin, green CI, fresh exact-head review, and a live induced-panic store-entry observation (socket delivery proven here; live store write not observable without touching the live desktop/daemon). Next action: hold for tag, re-pin, rerun CI, request fresh review.

Independent review of Breadway/breadclip PR 19 at exact head 14445a36 (base 2957b204): verdict blocked, no author rework needed now, do not merge. Verified with runtime evidence: strictest config (panic_message=false, forward_logs=false) redacts an induced panic carrying fake clipboard text to "(message omitted by the app)" with location plus 24 build-id frames and zero payload bytes on the wire; 1s main-loop ticks emit bug.heartbeat; absent breadd is a clean no-op (exit 101, no hang). Required CI check is success at this exact SHA; local locked build plus workspace tests pass (31 plus 19). Full mapping: https://git.breadway.dev/Breadway/breadclip/pulls/19#issuecomment-5082 Blockers: (1) bread-utils tag decision, then re-pin from branch lock b2614ba (pre-repair, predates merged 94ea374 by 1618+/353- in bug/) to the tag; (2) after re-pin, green CI, fresh exact-head review, and a live induced-panic store-entry observation (socket delivery proven here; live store write not observable without touching the live desktop/daemon). Next action: hold for tag, re-pin, rerun CI, request fresh review.
chore: pin bread-utils to the v0.8.1 tag
All checks were successful
check / check (push) Successful in 35s
Details
a55d015f0c 
bread-utils now carries the bug module from the tagged release, so
breadclipd no longer needs the feature branch. Cargo.lock updated.
Breadway commented 2026-10-17 15:37:41 +08:00
Author
Owner
Copy link

bread-utils tag cut and pilot re-pinned.

Tag: bread-ecosystem v0.8.1 pushed to origin (tag object cfe4a4ab, commit c6442cabb6c02acd1380dcd0d17189c4e22def03, workspace version 0.8.1, the +0.0.1 bump from stable v0.8.0).
Release verified on the dl channel: index.json and index.json.minisig both 200, bakery 0.8.1 and bread-theme 0.8.1 binaries, sha256 and bakery.toml all 200, index regenerated 2026-10-17T07:09:19Z. The failing tagged runs are the GitHub-mirror upload step (stale PAT) and the Arch package job (separate pacman channel), not the dl publish.

breadclip PR19: breadclipd now pins bread-utils to tag v0.8.1 (was branch feature/breadbug-client), Cargo.lock resolved to tag=v0.8.1#c6442cab, PR body updated to drop the pre-tag caveat. New head a55d015f0c, check / check (push) success in 35s. Workspace tests 19+31 pass, clippy -D warnings clean.

Note: breadclip-core and breadclip still pin bread-utils v0.7.2, so the lock carries two bread-utils versions; only breadclipd needed the bug module for this pilot. Awaiting a fresh independent exact-head review (prior pass at 14445a3 was blocked only on the tag).

bread-utils tag cut and pilot re-pinned. Tag: bread-ecosystem v0.8.1 pushed to origin (tag object cfe4a4ab, commit c6442cabb6c02acd1380dcd0d17189c4e22def03, workspace version 0.8.1, the +0.0.1 bump from stable v0.8.0). Release verified on the dl channel: index.json and index.json.minisig both 200, bakery 0.8.1 and bread-theme 0.8.1 binaries, sha256 and bakery.toml all 200, index regenerated 2026-10-17T07:09:19Z. The failing tagged runs are the GitHub-mirror upload step (stale PAT) and the Arch package job (separate pacman channel), not the dl publish. breadclip PR19: breadclipd now pins bread-utils to tag v0.8.1 (was branch feature/breadbug-client), Cargo.lock resolved to tag=v0.8.1#c6442cab, PR body updated to drop the pre-tag caveat. New head a55d015f0cdf1b6e1736a4432de628f516d8fac2, check / check (push) success in 35s. Workspace tests 19+31 pass, clippy -D warnings clean. Note: breadclip-core and breadclip still pin bread-utils v0.7.2, so the lock carries two bread-utils versions; only breadclipd needed the bug module for this pilot. Awaiting a fresh independent exact-head review (prior pass at 14445a3 was blocked only on the tag).
Breadway commented 2026-10-18 22:21:10 +08:00
Author
Owner
Copy link

Independent exact-head review: CHANGES REQUESTED. Reviewed a55d015f0c against main 2957b20499. Actual PR branch is feature/breadbug-pilot, not supplied fix/clip-19-tag-v081. CLIP-19 is this PR-type card; all 15 PRs and all 3 changed files reconciled. Full actual diff reviewed. No merge.

Criteria:

  1. PASS: breadclipd/Cargo.toml:14 pins tag=v0.8.1, no branch/rev. Remote ls-remote confirms annotated tag cfe4a4abe8bbb50df969d5a282f93ba9363fba20 peels to c6442cabb6c02acd1380dcd0d17189c4e22def03. Cargo.lock:149-164 records tag=v0.8.1 at that commit.
  2. PASS: breadclip/Cargo.toml:13 and breadclip-core/Cargo.toml:12 remain v0.7.2, unchanged; lock resolves their bread-utils to 0.7.2 and daemon to 0.8.1.
  3. FAIL overall: stale tag caveat removed, but strict privacy claim is false with the new client. See CLIP-20 / #20.
  4. FAIL overall: cargo fmt --check exits 1 (pre-existing drift, CLIP-21 / #21). cargo clippy --locked --all-targets -- -D warnings exits 0; cargo test --locked exits 0 (19 core + 31 daemon); cargo build --locked exits 0. These ran independently in a lone remote clone at the exact head, no sibling ecosystem or path patches, fresh target directory, existing Cargo download cache. Only global Cargo config is git-fetch-with-cli. Tracked files and lock remain unchanged.
  5. Required CI PASS: check / check (push), exact a55d015f0c, Actions run 85 job 0 success in 35s. Read all workflow definitions: check runs locked clippy/test, not fmt; release workflows do not apply to this branch. Branch protections and formal reviews both empty. Prior blocking review comments 5082/5090 remain relevant: no induced-panic store observation supplied.

Repair checklist:

  • HIGH: breadclipd/src/main.rs:417,425 and all connect sites :229,:254-289. With tagged v0.8.1, enable_bug_reporting removes LIVE and returns a custom guard. The second connect starts automatic reporting again, overwrites panic options with panic_message=true, starts default log forwarding, and drops app_version. Use nonautomatic connections consistently for sensitive paths and retain strict reporting. Add behavioral regression tests covering later command clients and capture subprocesses.
  • Runtime reproduction using pinned library and dependency versions matching the exact head: strict setup then synthetic panic sends message=(message omitted by the app), version=0.3.0, no synthetic bytes. Same setup plus the second connect sends message=CLIP19_SYNTHETIC_PRIVATE_TEXT_7f42, version=null. Both exit 101. Private HOME/runtime socket only; no live clipboard/desktop/breadd access. Probe and wire evidence: /tmp/opencode/clip19-review/{probe.py,privacy-probe/src/main.rs,strict-only.wire.jsonl,second-connect.wire.jsonl}. This is a library call-sequence reproduction, not an end-to-end daemon/store test.
  • Restore requested formatting check: breadclip/src/main.rs:4-12 and others listed in CLIP-21. Pre-existing failure is distinguished, not waived.
  • BREAD-16 and ECO-68 explicitly require a pilot induced-panic store entry (ECO-68 specifies release build). Existing comments never demonstrate it. Supply isolated real-daemon/store evidence after repair, including synthetic payload exclusion, version/location/frames and heartbeat/no-daemon behavior. Prior evidence from b2614ba cannot prove the new tagged integration.

Preserve PR and branch. Return CLIP-19 to todo for coordinator repair, not done. Fresh exact-head review and green checks required before any authorized merge.

Independent exact-head review: CHANGES REQUESTED. Reviewed a55d015f0cdf1b6e1736a4432de628f516d8fac2 against main 2957b20499e08786eb03d5005fd0634683990d0b. Actual PR branch is feature/breadbug-pilot, not supplied fix/clip-19-tag-v081. CLIP-19 is this PR-type card; all 15 PRs and all 3 changed files reconciled. Full actual diff reviewed. No merge. Criteria: 1. PASS: breadclipd/Cargo.toml:14 pins tag=v0.8.1, no branch/rev. Remote ls-remote confirms annotated tag cfe4a4abe8bbb50df969d5a282f93ba9363fba20 peels to c6442cabb6c02acd1380dcd0d17189c4e22def03. Cargo.lock:149-164 records tag=v0.8.1 at that commit. 2. PASS: breadclip/Cargo.toml:13 and breadclip-core/Cargo.toml:12 remain v0.7.2, unchanged; lock resolves their bread-utils to 0.7.2 and daemon to 0.8.1. 3. FAIL overall: stale tag caveat removed, but strict privacy claim is false with the new client. See CLIP-20 / #20. 4. FAIL overall: cargo fmt --check exits 1 (pre-existing drift, CLIP-21 / #21). cargo clippy --locked --all-targets -- -D warnings exits 0; cargo test --locked exits 0 (19 core + 31 daemon); cargo build --locked exits 0. These ran independently in a lone remote clone at the exact head, no sibling ecosystem or path patches, fresh target directory, existing Cargo download cache. Only global Cargo config is git-fetch-with-cli. Tracked files and lock remain unchanged. 5. Required CI PASS: check / check (push), exact a55d015f0cdf1b6e1736a4432de628f516d8fac2, Actions run 85 job 0 success in 35s. Read all workflow definitions: check runs locked clippy/test, not fmt; release workflows do not apply to this branch. Branch protections and formal reviews both empty. Prior blocking review comments 5082/5090 remain relevant: no induced-panic store observation supplied. Repair checklist: - HIGH: breadclipd/src/main.rs:417,425 and all connect sites :229,:254-289. With tagged v0.8.1, enable_bug_reporting removes LIVE and returns a custom guard. The second connect starts automatic reporting again, overwrites panic options with panic_message=true, starts default log forwarding, and drops app_version. Use nonautomatic connections consistently for sensitive paths and retain strict reporting. Add behavioral regression tests covering later command clients and capture subprocesses. - Runtime reproduction using pinned library and dependency versions matching the exact head: strict setup then synthetic panic sends message=(message omitted by the app), version=0.3.0, no synthetic bytes. Same setup plus the second connect sends message=CLIP19_SYNTHETIC_PRIVATE_TEXT_7f42, version=null. Both exit 101. Private HOME/runtime socket only; no live clipboard/desktop/breadd access. Probe and wire evidence: /tmp/opencode/clip19-review/{probe.py,privacy-probe/src/main.rs,strict-only.wire.jsonl,second-connect.wire.jsonl}. This is a library call-sequence reproduction, not an end-to-end daemon/store test. - Restore requested formatting check: breadclip/src/main.rs:4-12 and others listed in CLIP-21. Pre-existing failure is distinguished, not waived. - BREAD-16 and ECO-68 explicitly require a pilot induced-panic store entry (ECO-68 specifies release build). Existing comments never demonstrate it. Supply isolated real-daemon/store evidence after repair, including synthetic payload exclusion, version/location/frames and heartbeat/no-daemon behavior. Prior evidence from b2614ba cannot prove the new tagged integration. Preserve PR and branch. Return CLIP-19 to todo for coordinator repair, not done. Fresh exact-head review and green checks required before any authorized merge.
Breadway commented 2026-10-18 22:21:12 +08:00
Author
Owner
Copy link

Independent exact-head review: CHANGES REQUESTED. Reviewed a55d015f0c against main 2957b20499. Actual PR branch is feature/breadbug-pilot, not supplied fix/clip-19-tag-v081. CLIP-19 is this PR-type card; all 15 PRs and all 3 changed files reconciled. Full actual diff reviewed. No merge.

Criteria:

  1. PASS: breadclipd/Cargo.toml:14 pins tag=v0.8.1, no branch/rev. Remote ls-remote confirms annotated tag cfe4a4abe8bbb50df969d5a282f93ba9363fba20 peels to c6442cabb6c02acd1380dcd0d17189c4e22def03. Cargo.lock:149-164 records tag=v0.8.1 at that commit.
  2. PASS: breadclip/Cargo.toml:13 and breadclip-core/Cargo.toml:12 remain v0.7.2, unchanged; lock resolves their bread-utils to 0.7.2 and daemon to 0.8.1.
  3. FAIL overall: stale tag caveat removed, but strict privacy claim is false with the new client. See CLIP-20 / #20.
  4. FAIL overall: cargo fmt --check exits 1 (pre-existing drift, CLIP-21 / #21). cargo clippy --locked --all-targets -- -D warnings exits 0; cargo test --locked exits 0 (19 core + 31 daemon); cargo build --locked exits 0. These ran independently in a lone remote clone at the exact head, no sibling ecosystem or path patches, fresh target directory, existing Cargo download cache. Only global Cargo config is git-fetch-with-cli. Tracked files and lock remain unchanged.
  5. Required CI PASS: check / check (push), exact a55d015f0c, Actions run 85 job 0 success in 35s. Read all workflow definitions: check runs locked clippy/test, not fmt; release workflows do not apply to this branch. Branch protections and formal reviews both empty. Prior blocking review comments 5082/5090 remain relevant: no induced-panic store observation supplied.

Repair checklist:

  • HIGH: breadclipd/src/main.rs:417,425 and all connect sites :229,:254-289. With tagged v0.8.1, enable_bug_reporting removes LIVE and returns a custom guard. The second connect starts automatic reporting again, overwrites panic options with panic_message=true, starts default log forwarding, and drops app_version. Use nonautomatic connections consistently for sensitive paths and retain strict reporting. Add behavioral regression tests covering later command clients and capture subprocesses.
  • Runtime reproduction using pinned library and dependency versions matching the exact head: strict setup then synthetic panic sends message=(message omitted by the app), version=0.3.0, no synthetic bytes. Same setup plus the second connect sends message=CLIP19_SYNTHETIC_PRIVATE_TEXT_7f42, version=null. Both exit 101. Private HOME/runtime socket only; no live clipboard/desktop/breadd access. Probe and wire evidence: /tmp/opencode/clip19-review/{probe.py,privacy-probe/src/main.rs,strict-only.wire.jsonl,second-connect.wire.jsonl}. This is a library call-sequence reproduction, not an end-to-end daemon/store test.
  • Restore requested formatting check: breadclip/src/main.rs:4-12 and others listed in CLIP-21. Pre-existing failure is distinguished, not waived.
  • BREAD-16 and ECO-68 explicitly require a pilot induced-panic store entry (ECO-68 specifies release build). Existing comments never demonstrate it. Supply isolated real-daemon/store evidence after repair, including synthetic payload exclusion, version/location/frames and heartbeat/no-daemon behavior. Prior evidence from b2614ba cannot prove the new tagged integration.

Preserve PR and branch. Return CLIP-19 to todo for coordinator repair, not done. Fresh exact-head review and green checks required before any authorized merge.

Independent exact-head review: CHANGES REQUESTED. Reviewed a55d015f0cdf1b6e1736a4432de628f516d8fac2 against main 2957b20499e08786eb03d5005fd0634683990d0b. Actual PR branch is feature/breadbug-pilot, not supplied fix/clip-19-tag-v081. CLIP-19 is this PR-type card; all 15 PRs and all 3 changed files reconciled. Full actual diff reviewed. No merge. Criteria: 1. PASS: breadclipd/Cargo.toml:14 pins tag=v0.8.1, no branch/rev. Remote ls-remote confirms annotated tag cfe4a4abe8bbb50df969d5a282f93ba9363fba20 peels to c6442cabb6c02acd1380dcd0d17189c4e22def03. Cargo.lock:149-164 records tag=v0.8.1 at that commit. 2. PASS: breadclip/Cargo.toml:13 and breadclip-core/Cargo.toml:12 remain v0.7.2, unchanged; lock resolves their bread-utils to 0.7.2 and daemon to 0.8.1. 3. FAIL overall: stale tag caveat removed, but strict privacy claim is false with the new client. See CLIP-20 / #20. 4. FAIL overall: cargo fmt --check exits 1 (pre-existing drift, CLIP-21 / #21). cargo clippy --locked --all-targets -- -D warnings exits 0; cargo test --locked exits 0 (19 core + 31 daemon); cargo build --locked exits 0. These ran independently in a lone remote clone at the exact head, no sibling ecosystem or path patches, fresh target directory, existing Cargo download cache. Only global Cargo config is git-fetch-with-cli. Tracked files and lock remain unchanged. 5. Required CI PASS: check / check (push), exact a55d015f0cdf1b6e1736a4432de628f516d8fac2, Actions run 85 job 0 success in 35s. Read all workflow definitions: check runs locked clippy/test, not fmt; release workflows do not apply to this branch. Branch protections and formal reviews both empty. Prior blocking review comments 5082/5090 remain relevant: no induced-panic store observation supplied. Repair checklist: - HIGH: breadclipd/src/main.rs:417,425 and all connect sites :229,:254-289. With tagged v0.8.1, enable_bug_reporting removes LIVE and returns a custom guard. The second connect starts automatic reporting again, overwrites panic options with panic_message=true, starts default log forwarding, and drops app_version. Use nonautomatic connections consistently for sensitive paths and retain strict reporting. Add behavioral regression tests covering later command clients and capture subprocesses. - Runtime reproduction using pinned library and dependency versions matching the exact head: strict setup then synthetic panic sends message=(message omitted by the app), version=0.3.0, no synthetic bytes. Same setup plus the second connect sends message=CLIP19_SYNTHETIC_PRIVATE_TEXT_7f42, version=null. Both exit 101. Private HOME/runtime socket only; no live clipboard/desktop/breadd access. Probe and wire evidence: /tmp/opencode/clip19-review/{probe.py,privacy-probe/src/main.rs,strict-only.wire.jsonl,second-connect.wire.jsonl}. This is a library call-sequence reproduction, not an end-to-end daemon/store test. - Restore requested formatting check: breadclip/src/main.rs:4-12 and others listed in CLIP-21. Pre-existing failure is distinguished, not waived. - BREAD-16 and ECO-68 explicitly require a pilot induced-panic store entry (ECO-68 specifies release build). Existing comments never demonstrate it. Supply isolated real-daemon/store evidence after repair, including synthetic payload exclusion, version/location/frames and heartbeat/no-daemon behavior. Prior evidence from b2614ba cannot prove the new tagged integration. Preserve PR and branch. Return CLIP-19 to todo for coordinator repair, not done. Fresh exact-head review and green checks required before any authorized merge.
fix: keep breadclip panic reporting private
Some checks failed
check / check (push) Failing after 35s
Details
efb51ef84c
ci: disambiguate bread-utils dependency updates
All checks were successful
check / check (push) Successful in 2m47s
Details
1fff8f1cf4
Breadway commented 2026-10-18 22:39:24 +08:00
Author
Owner
Copy link

Independent exact-head re-review: CHANGES REQUESTED. Reviewed 1fff8f1cf4 against main 2957b20499. Expected head matches. Re-read prior comment 5403 and CLIP-19/20/21, BREAD-16 and ECO-68. Enumerated all 15 PRs and all 10 changed files; reviewed complete actual diff. No merge, tags, deployment or live clipboard/desktop access.

Verified repairs:

  1. CLIP-20 implementation PASS: all eight daemon client construction sites now use connect_without_bug_reporting (breadclipd/src/main.rs:229,254,259,274,281,290,418,426). Independently rebuilt release-mode synthetic-panic probes from setup blocks extracted from a55d015 and this new head, using pinned v0.8.1/c6442cab and matching dependency versions. Old setup plus later client: exit101, synthetic private text transmitted, app_version=null. New identical setup sequence plus later client: exit101, zero synthetic text on wire, message=(message omitted by the app), app_version=0.3.0, location present, 15 module/offset/build-id frames. New probe emitted three heartbeats over four seconds. Absent daemon: normal exit101 without hang. This is a call-sequence probe, not the actual breadclipd executable.
  2. CLIP-21 PASS: cargo fmt --check exit0. All five files in formatter-only commit fb827074a8 are byte-for-byte rustfmt output of their parent versions. No logic smuggled into that commit.
  3. Pins PASS: manifests and Cargo.lock unchanged since a55d015. breadclipd v0.8.1 resolves c6442cabb6c02acd1380dcd0d17189c4e22def03; breadclip/core remain v0.7.2. Remote annotated v0.8.1 peels to c6442cab. Branch CI fix legitimately qualifies both package versions, retains pin lint, and does not weaken stable/RC locked builds. However the same repair is missing from dev-release; see checklist below.
  4. Local exact-head commands all exit0: cargo fmt --check; cargo clippy --locked --all-targets -- -D warnings; cargo test --locked (19 core +31 daemon +1 integration); cargo build --locked (cached target,23.44s). No path patches; global Cargo config only git-fetch-with-cli. Review worktree remains clean.
  5. CI PASS: exact SHA check / check (push), Actions87/job0, success in2m47s. Branch protections and formal reviews empty. CI uses main-patched dev dependencies, so separate local locked checks above are essential evidence for the actual tag pins.
  6. Real store observation achieved in isolation: release-mode new-head call-sequence probe sent its panic to a real breadd built from integrated bread commit90cd7b4b6fae1b4dd99e2f9830d42a05e7f3c036. Private HOME and all XDG directories; every adapter disabled, builtin modules disabled, uploads/watchdog disabled, no user config or live socket used. Store apps/clip/markers.jsonl contains panic, omitted message, app_version0.3.0, location and15 build-id frames. Asserted synthetic payload absent throughout the store. Daemon terminated cleanly. This proves real store integration for the extracted setup sequence, not the ECO-68 requirement for an induced panic in the actual app release executable. That full gate remains UNVERIFIED; I did not run the real clipboard daemon or claim the harness was it.

Remaining repair checklist:

  • CLIP-22, .forgejo/workflows/dev-release.yml:44-48 versus check.yml:54-73: main publication still invokes unpatched dev-deps.sh. Remote ecosystem main c6442cab still builds unqualified -p bread-utils. Reproduced cargo update --offline -p bread-utils --dry-run on this lock: ambiguous, suggesting0.7.2 and0.8.1. Apply a shared qualification repair to both workflows or integrate upstream repair; verify main dev-resolution in isolation without publishing. Branch-only green is insufficient for safe main integration.
  • CLIP-20, breadclipd/tests/privacy_regression.rs:6-16: this test never panics, observes no socket payload, does not assert app_version, and does not disable log forwarding. Its sole assertion searches source text for one spelling. Prior request for behavioral regression coverage is still unmet. Add isolated subprocess/wire assertions for later clients and capture/command paths, with private runtime/config and strict options; demonstrate old failure/new pass. The reviewer probe above is evidence of current behavior, not durable repository regression coverage.
  • Full pilot acceptance remains unverified: provide a safe isolated release-app panic/store fixture, with live clipboard inaccessible, then fresh exact-head review. Current real-store probe substantially narrows the gap but cannot honestly close it.

Evidence directory: /tmp/opencode/clip19-rereview (probe.py, old/new-probe/src/main.rs, old/new.wire.jsonl, probe-results.txt, store/state/bread/bugstore/apps/clip/markers.jsonl, command logs and API snapshots). Note probe-results initially searched clip/ rather than apps/clip/; subsequent direct file inspection and assertions verified the actual marker above.

Preserve PR/branch, no merge. Changes-requested policy returns card to todo for coordinator repair, not done. After repair, request fresh exact-head review; after any eventual accepted merge, keep review for coordinator verification. No merge SHA or parents exist for this review.

Independent exact-head re-review: CHANGES REQUESTED. Reviewed 1fff8f1cf44a31aa7707de189649c289d9c069fc against main 2957b20499e08786eb03d5005fd0634683990d0b. Expected head matches. Re-read prior comment 5403 and CLIP-19/20/21, BREAD-16 and ECO-68. Enumerated all 15 PRs and all 10 changed files; reviewed complete actual diff. No merge, tags, deployment or live clipboard/desktop access. Verified repairs: 1. CLIP-20 implementation PASS: all eight daemon client construction sites now use connect_without_bug_reporting (breadclipd/src/main.rs:229,254,259,274,281,290,418,426). Independently rebuilt release-mode synthetic-panic probes from setup blocks extracted from a55d015 and this new head, using pinned v0.8.1/c6442cab and matching dependency versions. Old setup plus later client: exit101, synthetic private text transmitted, app_version=null. New identical setup sequence plus later client: exit101, zero synthetic text on wire, message=(message omitted by the app), app_version=0.3.0, location present, 15 module/offset/build-id frames. New probe emitted three heartbeats over four seconds. Absent daemon: normal exit101 without hang. This is a call-sequence probe, not the actual breadclipd executable. 2. CLIP-21 PASS: cargo fmt --check exit0. All five files in formatter-only commit fb827074a8e2c11547166ee627b4eafccbd8def0 are byte-for-byte rustfmt output of their parent versions. No logic smuggled into that commit. 3. Pins PASS: manifests and Cargo.lock unchanged since a55d015. breadclipd v0.8.1 resolves c6442cabb6c02acd1380dcd0d17189c4e22def03; breadclip/core remain v0.7.2. Remote annotated v0.8.1 peels to c6442cab. Branch CI fix legitimately qualifies both package versions, retains pin lint, and does not weaken stable/RC locked builds. However the same repair is missing from dev-release; see checklist below. 4. Local exact-head commands all exit0: cargo fmt --check; cargo clippy --locked --all-targets -- -D warnings; cargo test --locked (19 core +31 daemon +1 integration); cargo build --locked (cached target,23.44s). No path patches; global Cargo config only git-fetch-with-cli. Review worktree remains clean. 5. CI PASS: exact SHA check / check (push), Actions87/job0, success in2m47s. Branch protections and formal reviews empty. CI uses main-patched dev dependencies, so separate local locked checks above are essential evidence for the actual tag pins. 6. Real store observation achieved in isolation: release-mode new-head call-sequence probe sent its panic to a real breadd built from integrated bread commit90cd7b4b6fae1b4dd99e2f9830d42a05e7f3c036. Private HOME and all XDG directories; every adapter disabled, builtin modules disabled, uploads/watchdog disabled, no user config or live socket used. Store apps/clip/markers.jsonl contains panic, omitted message, app_version0.3.0, location and15 build-id frames. Asserted synthetic payload absent throughout the store. Daemon terminated cleanly. This proves real store integration for the extracted setup sequence, not the ECO-68 requirement for an induced panic in the actual app release executable. That full gate remains UNVERIFIED; I did not run the real clipboard daemon or claim the harness was it. Remaining repair checklist: - CLIP-22, .forgejo/workflows/dev-release.yml:44-48 versus check.yml:54-73: main publication still invokes unpatched dev-deps.sh. Remote ecosystem main c6442cab still builds unqualified -p bread-utils. Reproduced cargo update --offline -p bread-utils --dry-run on this lock: ambiguous, suggesting0.7.2 and0.8.1. Apply a shared qualification repair to both workflows or integrate upstream repair; verify main dev-resolution in isolation without publishing. Branch-only green is insufficient for safe main integration. - CLIP-20, breadclipd/tests/privacy_regression.rs:6-16: this test never panics, observes no socket payload, does not assert app_version, and does not disable log forwarding. Its sole assertion searches source text for one spelling. Prior request for behavioral regression coverage is still unmet. Add isolated subprocess/wire assertions for later clients and capture/command paths, with private runtime/config and strict options; demonstrate old failure/new pass. The reviewer probe above is evidence of current behavior, not durable repository regression coverage. - Full pilot acceptance remains unverified: provide a safe isolated release-app panic/store fixture, with live clipboard inaccessible, then fresh exact-head review. Current real-store probe substantially narrows the gap but cannot honestly close it. Evidence directory: /tmp/opencode/clip19-rereview (probe.py, old/new-probe/src/main.rs, old/new.wire.jsonl, probe-results.txt, store/state/bread/bugstore/apps/clip/markers.jsonl, command logs and API snapshots). Note probe-results initially searched clip/ rather than apps/clip/; subsequent direct file inspection and assertions verified the actual marker above. Preserve PR/branch, no merge. Changes-requested policy returns card to todo for coordinator repair, not done. After repair, request fresh exact-head review; after any eventual accepted merge, keep review for coordinator verification. No merge SHA or parents exist for this review.
Breadway commented 2026-10-18 22:39:39 +08:00
Author
Owner
Copy link

Exact-head re-review: changes_requested at 1fff8f1cf4. Full criterion mapping and repair checklist: #19 (comment). Privacy implementation verified old-fail/new-pass on wire, version preserved; formatting verified formatter-only; fmt/clippy --locked/test --locked/build --locked all pass; exact CI green in2m47s. Real isolated breadd store entry observed from release-mode extracted-call-sequence harness, with redacted message and15 build-id frames. Actual release-app induced panic remains unverified. Remaining defects: CLIP-22 main dev-release workflow lacks dependency-ambiguity fix; CLIP-20 committed test asserts source text rather than panic payload/version and lacks isolated behavioral coverage. No merge, no tags, no live clipboard access. Keep existing PR/branch for repair; changes-requested policy requires todo rather than review until reworked. Never done.

Exact-head re-review: changes_requested at 1fff8f1cf44a31aa7707de189649c289d9c069fc. Full criterion mapping and repair checklist: https://git.breadway.dev/Breadway/breadclip/pulls/19#issuecomment-5411. Privacy implementation verified old-fail/new-pass on wire, version preserved; formatting verified formatter-only; fmt/clippy --locked/test --locked/build --locked all pass; exact CI green in2m47s. Real isolated breadd store entry observed from release-mode extracted-call-sequence harness, with redacted message and15 build-id frames. Actual release-app induced panic remains unverified. Remaining defects: CLIP-22 main dev-release workflow lacks dependency-ambiguity fix; CLIP-20 committed test asserts source text rather than panic payload/version and lacks isolated behavioral coverage. No merge, no tags, no live clipboard access. Keep existing PR/branch for repair; changes-requested policy requires todo rather than review until reworked. Never done.
test: verify breadclip panic privacy over isolated IPC
All checks were successful
check / check (push) Successful in 2m7s
Details
6a7e2c3c9e
Breadway commented 2026-10-18 22:59:40 +08:00
Author
Owner
Copy link

Independent exact-head re-review: CHANGES REQUESTED. Reviewed 6a7e2c3c9e against main 2957b20499. Re-read comments 5403 and 5411, CLIP-19/20/21/22, BREAD-16 and ECO-68 plus dependencies. All 15 PRs and all 11 changed files enumerated; complete diff and CI definitions reviewed. Expected head matches. No merge or tags.

Criterion mapping:

  1. Privacy implementation PASS: breadclipd/src/main.rs:229,254-290,418,426 uses nonautomatic clients; strict panic_message=false and forward_logs=false retained. Independently rebuilt release-mode probes extracting setup blocks from a55d015 and this head with pinned v0.8.1. Old: exit101, synthetic private text on wire, app_version=null. New: exit101, synthetic text absent across wire, omitted message, app_version=0.3.0, location and15 module/offset/build-id frames, three heartbeats. Absent daemon: exit101 without hang. This is an extracted-call-sequence probe, not the actual daemon.
  2. CLIP-20 regression coverage FAIL, despite substantial improvement. breadclipd/tests/privacy_regression.rs:13-29 genuinely panics in an isolated subprocess and observes Unix IPC; :95-104 asserts redaction/version/location and :106-165 demonstrates the old library sequence leaks. It is not a source-text assertion or a tautological payload assertion. But both constructors and version are hard-coded in the test, independent of production code. Decisive reproduction: copied this test unchanged into a detached clone at vulnerable a55d015f0c; cargo test --locked -p breadclipd --test privacy_regression PASSED (1/1). It therefore does NOT fail on the old app head. No actual capture/command code is invoked. The requested durable app regression protection is not met.
  3. CLIP-22 PASS: dev-release.yml:44-73 now runs pin lint and qualifies both bread-utils@0.7.2 and bread-utils@0.8.1. Fresh remote clone at reviewed SHA plus fresh ecosystem main: executed the exact extracted dev-resolution shell block, pin lint PASS across4 manifests, qualified cargo update exit0. No build publication performed. Manifests and Cargo.lock byte-identical to a55d015; daemon v0.8.1 resolves c6442cabb6c02acd1380dcd0d17189c4e22def03; core/UI retain v0.7.2. Remote annotated tag still peels to c6442cab.
  4. ECO-68/BREAD-16 actual release-app panic/store gate UNVERIFIED. Evidence is partial overall, not acceptance passed. Inspected supplied isolated history.db: one synthetic text/plain clipboard row; no markers.jsonl in that fixture. main.rs:361-364 returns from --capture-once before bug reporting setup at418. A SQLite clipboard-history write cannot prove a panic marker in breadd bugstore. Prior real-breadd store evidence from an extracted release probe remains useful but is not a panic from the actual long-lived breadclipd executable. Still unproven: induced panic from that release app, persisted marker in isolated real breadd store, with app version/location/build-id frames and private payload excluded. Lack of a supported trigger is a verification blocker, not a waiver or a demand for a production panic switch.
  5. CLIP-21 and local quality checks PASS: cargo fmt --check; cargo clippy --locked --all-targets -- -D warnings; cargo test --locked (19 core+31 daemon+1 integration); cargo build --locked (cached1.18s), all exit0. Clean exact-head clone, no path patches, existing Cargo/build caches.
  6. CI PASS: check / check (push), exact reviewed SHA, Actions88/job0 success in2m7s. Earlier pending records are superseded by that success. Required branch workflow reviewed; stable/RC locked builds unchanged. Authenticated branch protections and formal reviews empty. Fresh final metadata read still matches head/base, open and mergeable. Prior review comments resolved only as mapped above.

Repair checklist:

  • CLIP-20, privacy_regression.rs:13-29 and95-104: bind the behavioral fixture to production privacy setup/client construction and cover actual later command/capture paths. Keep private HOME/XDG and no live clipboard access. Demonstrate unchanged assertions fail against the vulnerable production constructors and pass against the repaired ones; do not merely assert that a separate hard-coded old sequence leaks.
  • Preserve ECO-68 actual release-app induced-panic/store gate until safe isolated evidence exists. Do not substitute clipboard history or the extracted-call-sequence probe.

Evidence: /tmp/opencode/clip19-finalreview/{full.diff,results.txt,fmt.log,clippy.log,test.log,build.log,old-head-regression.log,dev-resolution.log,probe.py,probe-results.txt,old.wire.jsonl,new.wire.jsonl,API snapshots}. Reviewed clone ~/.worktrees/breadclip/fix/review-6a7e2c3 remains clean. No commits, pushes, tags, deployment, remote machines or live desktop access. No merge SHA or parents. Preserve PR/branch. The changes-requested rule requires todo for coordinator repair, rather than review; never done. Fresh exact-head review required after repair.

Independent exact-head re-review: CHANGES REQUESTED. Reviewed 6a7e2c3c9ef6df40ef20581ebfb31c49961c56b1 against main 2957b20499e08786eb03d5005fd0634683990d0b. Re-read comments 5403 and 5411, CLIP-19/20/21/22, BREAD-16 and ECO-68 plus dependencies. All 15 PRs and all 11 changed files enumerated; complete diff and CI definitions reviewed. Expected head matches. No merge or tags. Criterion mapping: 1. Privacy implementation PASS: breadclipd/src/main.rs:229,254-290,418,426 uses nonautomatic clients; strict panic_message=false and forward_logs=false retained. Independently rebuilt release-mode probes extracting setup blocks from a55d015 and this head with pinned v0.8.1. Old: exit101, synthetic private text on wire, app_version=null. New: exit101, synthetic text absent across wire, omitted message, app_version=0.3.0, location and15 module/offset/build-id frames, three heartbeats. Absent daemon: exit101 without hang. This is an extracted-call-sequence probe, not the actual daemon. 2. CLIP-20 regression coverage FAIL, despite substantial improvement. breadclipd/tests/privacy_regression.rs:13-29 genuinely panics in an isolated subprocess and observes Unix IPC; :95-104 asserts redaction/version/location and :106-165 demonstrates the old library sequence leaks. It is not a source-text assertion or a tautological payload assertion. But both constructors and version are hard-coded in the test, independent of production code. Decisive reproduction: copied this test unchanged into a detached clone at vulnerable a55d015f0cdf1b6e1736a4432de628f516d8fac2; cargo test --locked -p breadclipd --test privacy_regression PASSED (1/1). It therefore does NOT fail on the old app head. No actual capture/command code is invoked. The requested durable app regression protection is not met. 3. CLIP-22 PASS: dev-release.yml:44-73 now runs pin lint and qualifies both bread-utils@0.7.2 and bread-utils@0.8.1. Fresh remote clone at reviewed SHA plus fresh ecosystem main: executed the exact extracted dev-resolution shell block, pin lint PASS across4 manifests, qualified cargo update exit0. No build publication performed. Manifests and Cargo.lock byte-identical to a55d015; daemon v0.8.1 resolves c6442cabb6c02acd1380dcd0d17189c4e22def03; core/UI retain v0.7.2. Remote annotated tag still peels to c6442cab. 4. ECO-68/BREAD-16 actual release-app panic/store gate UNVERIFIED. Evidence is partial overall, not acceptance passed. Inspected supplied isolated history.db: one synthetic text/plain clipboard row; no markers.jsonl in that fixture. main.rs:361-364 returns from --capture-once before bug reporting setup at418. A SQLite clipboard-history write cannot prove a panic marker in breadd bugstore. Prior real-breadd store evidence from an extracted release probe remains useful but is not a panic from the actual long-lived breadclipd executable. Still unproven: induced panic from that release app, persisted marker in isolated real breadd store, with app version/location/build-id frames and private payload excluded. Lack of a supported trigger is a verification blocker, not a waiver or a demand for a production panic switch. 5. CLIP-21 and local quality checks PASS: cargo fmt --check; cargo clippy --locked --all-targets -- -D warnings; cargo test --locked (19 core+31 daemon+1 integration); cargo build --locked (cached1.18s), all exit0. Clean exact-head clone, no path patches, existing Cargo/build caches. 6. CI PASS: check / check (push), exact reviewed SHA, Actions88/job0 success in2m7s. Earlier pending records are superseded by that success. Required branch workflow reviewed; stable/RC locked builds unchanged. Authenticated branch protections and formal reviews empty. Fresh final metadata read still matches head/base, open and mergeable. Prior review comments resolved only as mapped above. Repair checklist: - [ ] CLIP-20, privacy_regression.rs:13-29 and95-104: bind the behavioral fixture to production privacy setup/client construction and cover actual later command/capture paths. Keep private HOME/XDG and no live clipboard access. Demonstrate unchanged assertions fail against the vulnerable production constructors and pass against the repaired ones; do not merely assert that a separate hard-coded old sequence leaks. - [ ] Preserve ECO-68 actual release-app induced-panic/store gate until safe isolated evidence exists. Do not substitute clipboard history or the extracted-call-sequence probe. Evidence: /tmp/opencode/clip19-finalreview/{full.diff,results.txt,fmt.log,clippy.log,test.log,build.log,old-head-regression.log,dev-resolution.log,probe.py,probe-results.txt,old.wire.jsonl,new.wire.jsonl,API snapshots}. Reviewed clone ~/.worktrees/breadclip/fix/review-6a7e2c3 remains clean. No commits, pushes, tags, deployment, remote machines or live desktop access. No merge SHA or parents. Preserve PR/branch. The changes-requested rule requires todo for coordinator repair, rather than review; never done. Fresh exact-head review required after repair.
Breadway commented 2026-10-18 22:59:56 +08:00
Author
Owner
Copy link

Independent exact-head re-review at 6a7e2c3c9e: changes_requested. Full mapping and repair checklist: #19 (comment) . Privacy implementation passes independent old/new release wire probes; CLIP-22 fresh-clone dev resolution and unchanged tag pins pass; fmt/clippy/test/cached build pass; exact CI Actions88 check success2m7s. Remaining CLIP-20 defect: new test is behavioral but duplicates setup, so copied unchanged onto vulnerable a55d015 it still PASSES. Bind it to actual app setup and command/capture paths and prove old-head failure. ECO-68 actual long-lived release-app induced-panic store entry remains unverified; supplied SQLite clipboard row is not a bugstore marker. No merge or tags. Preserve PR/branch, return todo under changes-requested policy for coordinator repair, never done. Evidence /tmp/opencode/clip19-finalreview.

Independent exact-head re-review at 6a7e2c3c9ef6df40ef20581ebfb31c49961c56b1: changes_requested. Full mapping and repair checklist: https://git.breadway.dev/Breadway/breadclip/pulls/19#issuecomment-5423 . Privacy implementation passes independent old/new release wire probes; CLIP-22 fresh-clone dev resolution and unchanged tag pins pass; fmt/clippy/test/cached build pass; exact CI Actions88 check success2m7s. Remaining CLIP-20 defect: new test is behavioral but duplicates setup, so copied unchanged onto vulnerable a55d015 it still PASSES. Bind it to actual app setup and command/capture paths and prove old-head failure. ECO-68 actual long-lived release-app induced-panic store entry remains unverified; supplied SQLite clipboard row is not a bugstore marker. No merge or tags. Preserve PR/branch, return todo under changes-requested policy for coordinator repair, never done. Evidence /tmp/opencode/clip19-finalreview.
test: bind privacy regression to production clients
All checks were successful
check / check (push) Successful in 1m28s
Details
ec4e1b1fea
Breadway commented 2026-10-19 00:20:02 +08:00
Author
Owner
Copy link

Independent exact-head review: PASS at ec4e1b1fea, base main 2957b20499. Prior comments 5403, 5411 and 5423 re-read. This review is a different model from the pin author. No live clipboard, desktop, or breadd access.

Criteria:

  1. PASS. breadclipd/Cargo.toml:14 pins bread-utils tag v0.8.1 with no branch or rev. Cargo.lock:149-161 resolves bread-utils 0.8.1 to c6442cabb6c02acd1380dcd0d17189c4e22def03. Remote annotated tag cfe4a4abe8bbb50df969d5a282f93ba9363fba20 peels to that commit. breadclip/Cargo.toml:13 and breadclip-core/Cargo.toml:12 stay v0.7.2; lock:137-147 and lock:164-199 keep those crates on 0.7.2 and the daemon on 0.8.1.
  2. PASS. check.yml:54-73 and dev-release.yml:44-69 both lint pins, then qualify bread-utils@0.7.2 and bread-utils@0.8.1, and refuse if the shared updater format changed. release.yml and rc-release.yml stay locked and were not weakened.
  3. PASS. Every daemon client goes through privacy_clients::client (main.rs:223,248,252,267,274,283,416), which calls connect_without_bug_reporting. enable_reporting (privacy_clients.rs:15-19) sets panic_message=false and forward_logs=false, and main.rs:408-436 uses that guard and ticks it from the 1s main loop. Production sources contain no panic or signal trigger (the only panic! is the cfg(test) unit test). Release-mode probe compiled the production module inside the breadclipd 0.3.0 crate against pinned v0.8.1/c6442cab, private HOME and XDG dirs only: strict setup plus a later client, exit 101, wire message "(message omitted by the app)", app_version 0.3.0, location present, 15 frames of module/offset/build_id only, synthetic text absent from the wire, one heartbeat, no log payload. Absent socket: exit 101, zero wire bytes, no hang. The committed integration test on this head also asserts the same redaction and version.
  4. PASS. breadclipd/tests/privacy_regression.rs:11-12 includes the production file breadclipd/src/privacy_clients.rs, the same module main.rs:3 declares. It is not a private copy. On this head cargo test --locked passes it. A throwaway copy with only production client() changed to BreadClient::connect, test file unchanged, fails that exact test: left CLIP19_SYNTHETIC_PRIVATE_TEXT_7f42, right "(message omitted by the app)". Reviewed worktree was not modified.
  5. Delegated, not a CLIP-19 blocker: an actual release-breadclipd induced panic persisted in the real breadd store belongs to ECO-68 and BREAD-17. No production panic trigger was added.

Local checks at this exact head, no path patches, global cargo config only git-fetch-with-cli: cargo fmt --check exit 0; cargo clippy --locked --all-targets -- -D warnings exit 0; cargo test --locked exit 0 (core 19, daemon 32, privacy integration 2); cargo build --locked --release -p breadclipd exit 0 in 35.91s. Required CI: check / check (push) success at this SHA, Actions run 89, "Successful in 1m28s". Earlier pending statuses on the same SHA are superseded. Branch protections empty. Formal reviews empty. Prior change requests 5403/5411/5423 are resolved by the repairs above.

Merge is authorized for this pass and will follow a fresh head, base, review and mergeability read.

Independent exact-head review: PASS at ec4e1b1feaf99ea8f7b46d7ad0e137847a47d5b9, base main 2957b20499e08786eb03d5005fd0634683990d0b. Prior comments 5403, 5411 and 5423 re-read. This review is a different model from the pin author. No live clipboard, desktop, or breadd access. Criteria: 1. PASS. breadclipd/Cargo.toml:14 pins bread-utils tag v0.8.1 with no branch or rev. Cargo.lock:149-161 resolves bread-utils 0.8.1 to c6442cabb6c02acd1380dcd0d17189c4e22def03. Remote annotated tag cfe4a4abe8bbb50df969d5a282f93ba9363fba20 peels to that commit. breadclip/Cargo.toml:13 and breadclip-core/Cargo.toml:12 stay v0.7.2; lock:137-147 and lock:164-199 keep those crates on 0.7.2 and the daemon on 0.8.1. 2. PASS. check.yml:54-73 and dev-release.yml:44-69 both lint pins, then qualify bread-utils@0.7.2 and bread-utils@0.8.1, and refuse if the shared updater format changed. release.yml and rc-release.yml stay locked and were not weakened. 3. PASS. Every daemon client goes through privacy_clients::client (main.rs:223,248,252,267,274,283,416), which calls connect_without_bug_reporting. enable_reporting (privacy_clients.rs:15-19) sets panic_message=false and forward_logs=false, and main.rs:408-436 uses that guard and ticks it from the 1s main loop. Production sources contain no panic or signal trigger (the only panic! is the cfg(test) unit test). Release-mode probe compiled the production module inside the breadclipd 0.3.0 crate against pinned v0.8.1/c6442cab, private HOME and XDG dirs only: strict setup plus a later client, exit 101, wire message "(message omitted by the app)", app_version 0.3.0, location present, 15 frames of module/offset/build_id only, synthetic text absent from the wire, one heartbeat, no log payload. Absent socket: exit 101, zero wire bytes, no hang. The committed integration test on this head also asserts the same redaction and version. 4. PASS. breadclipd/tests/privacy_regression.rs:11-12 includes the production file breadclipd/src/privacy_clients.rs, the same module main.rs:3 declares. It is not a private copy. On this head cargo test --locked passes it. A throwaway copy with only production client() changed to BreadClient::connect, test file unchanged, fails that exact test: left CLIP19_SYNTHETIC_PRIVATE_TEXT_7f42, right "(message omitted by the app)". Reviewed worktree was not modified. 5. Delegated, not a CLIP-19 blocker: an actual release-breadclipd induced panic persisted in the real breadd store belongs to ECO-68 and BREAD-17. No production panic trigger was added. Local checks at this exact head, no path patches, global cargo config only git-fetch-with-cli: cargo fmt --check exit 0; cargo clippy --locked --all-targets -- -D warnings exit 0; cargo test --locked exit 0 (core 19, daemon 32, privacy integration 2); cargo build --locked --release -p breadclipd exit 0 in 35.91s. Required CI: check / check (push) success at this SHA, Actions run 89, "Successful in 1m28s". Earlier pending statuses on the same SHA are superseded. Branch protections empty. Formal reviews empty. Prior change requests 5403/5411/5423 are resolved by the repairs above. Merge is authorized for this pass and will follow a fresh head, base, review and mergeability read.
Breadway commented 2026-10-19 00:20:02 +08:00
Author
Owner
Copy link

Independent exact-head review PASS at ec4e1b1fea. Full mapping is on PR 19. Pins, dual-version CI resolution, privacy wire probe, and production-module regression binding all pass. Actual release-daemon store panic remains delegated to ECO-68 and BREAD-17, not a CLIP-19 blocker. Merge authorized and will use a fresh head check. Card stays in review for coordinator verification.

Independent exact-head review PASS at ec4e1b1feaf99ea8f7b46d7ad0e137847a47d5b9. Full mapping is on PR 19. Pins, dual-version CI resolution, privacy wire probe, and production-module regression binding all pass. Actual release-daemon store panic remains delegated to ECO-68 and BREAD-17, not a CLIP-19 blocker. Merge authorized and will use a fresh head check. Card stays in review for coordinator verification.
Breadway commented 2026-10-19 00:20:46 +08:00
Author
Owner
Copy link

Merged to main. Merge commit 7d1d3bcddb, parents 2957b20499 and ec4e1b1fea. Expected head matched at merge time. Branch feature/breadbug-pilot kept. CLIP-19 stays in review for coordinator verification of the integrated result. The actual release-breadclipd panic store entry remains delegated to ECO-68 and BREAD-17.

Merged to main. Merge commit 7d1d3bcddbf1c3ea4ca1e2e5d1e8507effafbdef, parents 2957b20499e08786eb03d5005fd0634683990d0b and ec4e1b1feaf99ea8f7b46d7ad0e137847a47d5b9. Expected head matched at merge time. Branch feature/breadbug-pilot kept. CLIP-19 stays in review for coordinator verification of the integrated result. The actual release-breadclipd panic store entry remains delegated to ECO-68 and BREAD-17.
Breadway commented 2026-10-19 00:20:46 +08:00
Author
Owner
Copy link

Merged. SHA 7d1d3bcddb, parents 2957b204 (main) and ec4e1b1 (reviewed head). Card left in review for coordinator verification. Do not mark done from this review. Release-daemon store panic stays with ECO-68 and BREAD-17.

Merged. SHA 7d1d3bcddbf1c3ea4ca1e2e5d1e8507effafbdef, parents 2957b204 (main) and ec4e1b1 (reviewed head). Card left in review for coordinator verification. Do not mark done from this review. Release-daemon store panic stays with ECO-68 and BREAD-17.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
ci

   
enhancement
No labels
ci
enhancement
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/breadclip!19
No description provided.