From 7ebc4d0ccd9a3808b877ffb645536cb9a2eb9494 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Al=C3=A7ada=20Padez?= Date: Fri, 14 Aug 2026 19:16:41 +0000 Subject: [PATCH] note the totality/route-table drift for later Co-Authored-By: Claude Opus 5 --- TODO.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/TODO.md b/TODO.md index 7931a76a..edd4c8aa 100644 --- a/TODO.md +++ b/TODO.md @@ -80,6 +80,16 @@ the owner's OS user and can never be granted. Indirection there really is accide lookup, the role cache and the fail-closed catches is exercised only by hand. It is the file standing between a Member and a shell. +- [ ] **`assertCapabilityTotality` checks the wrong list, and `registry.test.ts` has been red since + 2026-08-13.** It is fed `Object.keys(handlers)` from `server.tsx`, but Bun serves the *route table*. + Those diverged when the cliamp/desktop/vault plugins were switched off: `/api/cliamp/ws` and + `/api/cliamp/audio/ws` are still live routes with their handlers and registry claims commented out. + Not exploitable — `isWsProviderAllowed` finds no capability and 403s a member; the owner upgrades onto + a dead socket. But the boot check that exists to stop exactly this cannot see it. Two fixes: point + totality at the route table, and either delete the dead routes or restore their claims. The 8 failing + tests in `registry.test.ts` are the same drift — `REAL_WS` still lists all nine providers as served, + which is why nobody noticed. Found 2026-08-14. + - [ ] **No empty state for a denied screen.** A member who reaches a route their role lacks gets a broken panel or an endless spinner rather than a clean refusal.