BitSquare/Codeman
2
0 Fork 0
mirror of https://github.com/Ark0N/Codeman.git synced 2026-11-15 02:49:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: retire the OpenCode Console breach notice

Browse Source 
A new install has no seen list, so every new OpenCode user was still warned about
an October incident that is long over. The mechanism stays for the next notice;
an empty list is now a valid file, and the validators keep running over whatever
it holds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Codeman maintainer committed 2026-11-04 16:51:56 +01:00
1 parent 0dbfc8dc2d
commit 7b8e295647
3 files changed
+7 -40
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/security-notices.test.ts
+5 -18
View File
@@ -333,8 +333,7 @@ describe('the shipped security-notices.json', () => {
const nonBlank = (value: unknown) => typeof value === 'string' && value.trim().length > 0;
it('is a list of notices with unique, stable ids', () => {
expect(Array.isArray(notices)).toBe(true);
expect(notices.length).toBeGreaterThan(0);
expect(Array.isArray(notices)).toBe(true); // empty is fine: every notice has been retired
const all = notices.map((n) => n.id);
expect(new Set(all).size).toBe(all.length);
for (const id of all) expect(id).toMatch(/^[a-z0-9][a-z0-9-]*$/);
@@ -383,22 +382,10 @@ describe('the shipped security-notices.json', () => {
}
});
it('shows the OpenCode notice, with its title, only to OpenCode users', () => {
const breach = notices.find((n) => n.id === 'opencode-console-breach-2026-10');
expect(breach?.cli).toBe('opencode');
const [shown] = core.select(notices, { available: { opencode: true }, now: NOW });
expect(shown).toMatchObject({
id: 'opencode-console-breach-2026-10',
title: 'OpenCode Console breach: check your API keys',
label: "Read OpenCode's notice",
url: 'https://x.com/opencode/status/2111519637049319818',
});
expect(core.select(notices, { available: { opencode: true }, now: NOW, lang: 'zh-CN' })[0].title).toBe(
'OpenCode Console 遭入侵：请检查你的 API 密钥'
);
expect(core.select(notices, { available: { opencode: false, claude: true }, now: NOW })).toEqual([]);
expect(core.select(notices, { available: {}, now: NOW })).toEqual([]);
expect(core.select(notices, { available: { opencode: true }, now: at(2027, 1, 1) })).toEqual([]);
it('no longer ships the retired OpenCode Console notice, even to a fresh OpenCode install', () => {
// It stayed in the file past its use, and a new install has no seen list, so everyone got it.
expect(notices.map((n) => n.id)).not.toContain('opencode-console-breach-2026-10');
expect(core.select(notices, { available: { opencode: true }, seen: [], now: NOW })).toEqual([]);
});
it('is fetched by the page and never generated by the release script', () => {