Maniacs_Mansion/MealQuest
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Withhold unsafe recipe sources from idea job results (BASE-01) #170

Merged
approver_agent merged 2 commits from task/ideas-source-safety_c15ed4b5-25ae-43c6-8d36-f4a6dd51e5af into dev 2026-10-09 19:04:45 -04:00
Conversation 3 Commits 2 Files Changed 10
+399 -94
orchestrator-agent commented 2026-10-09 18:11:16 -04:00
Member
Copy Link
Copy Source

Maestro task c15ed4b5-25ae-43c6-8d36-f4a6dd51e5af. Fixes the pre-existing HIGH leak (BASE-01) where Feature 18 idea results returned raw source_url/site_name: the source is now produced only by the dinners package's SourceOf (same secrecy rules), so a token-bearing URL or host-derived name never reaches a client. See the developer report on the PR.

Maestro task c15ed4b5-25ae-43c6-8d36-f4a6dd51e5af. Fixes the pre-existing HIGH leak (BASE-01) where Feature 18 idea results returned raw source_url/site_name: the source is now produced only by the dinners package's SourceOf (same secrecy rules), so a token-bearing URL or host-derived name never reaches a client. See the developer report on the PR.
orchestrator-agent added 1 commit 2026-10-09 18:11:16 -04:00
Withhold unsafe recipe sources from idea job results
CI / ci (push) Successful in 6m10s
Details
CI / ci (pull_request) Successful in 7m2s
Details
1eafe812ec 
Cook from what I have and Quick dinners ideas returned the grounded
recipe's raw source_url and site_name, so a link carrying a token in its
query or userinfo, or a stored name taken from its host, reached the
client in the job response (BASE-01).

dinners.SourceOf is now the one way a fetched recipe's source reaches a
client: the dinner detail and both idea result builders use it. An
idea's source_url and site_name are null when they could leak a secret,
and a source that does not parse fails the job instead of being shown.

Task: c15ed4b5-25ae-43c6-8d36-f4a6dd51e5af

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent requested changes 2026-10-09 18:18:23 -04:00
Dismissed
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
overseer added 1 commit 2026-10-09 18:34:01 -04:00
Show idea job results' sources safely on every read
CI / ci (push) Successful in 6m23s
Details
CI / ci (pull_request) Successful in 6m37s
Details
c961d65092 
GET /jobs/{id} served a succeeded idea job's stored result as it was, so
a result stored before sources were made safe still showed a
token-bearing source_url and a site_name taken from the link's host
(BASE-01-R1). jobs.Kind.FailedResult becomes ShownResult, applied to
every stored result with the job's status: ideas_from_ingredients and
quick_ideas results show no ideas when failed and, otherwise, each
idea's source through dinners.SourceOf, the one rule, so no job old or
new serves an unsafe source. Other kinds' results are untouched.

dinners.SourceOf now parses the link before reading the site name, so a
link that does not parse is an error with or without a stored name, and
an idea job grounded in one fails instead of succeeding (BASE-01-R2).

Task: c15ed4b5-25ae-43c6-8d36-f4a6dd51e5af

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent requested changes 2026-10-09 18:41:02 -04:00
Dismissed
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: APPROVED for this exact commit.

Independent Codex gpt-6-sol review: APPROVED for this exact commit.
approver_agent merged commit 4dcfc3c27d into dev 2026-10-09 19:04:45 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
review_agent
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
approver_agent (The Approver) chatgpt claude-ai Claude-Code codex (Codex) dev_agent grok opencode orchestrator-agent overseer (Joshua) review_agent (The Reviewer)
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#170