dd77632d0e
Some checks failed
lakehouse/auditor 10 blocking issues: cloud: claim not backed — "Verified live (current synthetic data):"
Lands 2 of the 3 BLOCKs from the auto-reset commit's audit: 1. static.ts:67-130 — backtick state-machine ordering `inMultilineBacktick` was updated AFTER pattern checks ran on a line, so any block-pattern hit on a line that opened a backtick block was evaluated under stale "outside-backtick" semantics. Net effect: false-positive BLOCK findings on hardcoded-string patterns sitting inside multi-line template literals (where they are legitimately quoted, not executed). Fix: compute state-at-line-start BEFORE pattern checks; carry state-at-line-end forward for the next iteration. Pattern checks now use `stateAtLineStart` consistently. 2. static.ts:223-228 — parentStructHasSerdeDerive bounds check The function walked backward from `fieldLineIdx` without validating it against `lines.length`. If a malformed diff fed in an out-of-range fieldLineIdx, the loop's implicit upper bound (`fieldLineIdx - 80`) could still be > 0, leading to undefined- slot reads or silently wrong results. Fix: defensive bail (`if (fieldLineIdx < 0 || >= lines.length) return false`) before the loop runs. SKIPPED with rationale: - BLOCK on types.ts:96 (requireSha256 "optional-chaining bypass") Investigated: requireString correctly catches null/undefined/object via `typeof !== "string"`; the call site at line 96 is just an invocation of the function defined at line 81-88. The full code paths (null, undefined, object, short string, valid hex) all produce correct error/success outcomes. Kimi's rationale was truncated at 200 chars; no bypass found in the actual code. Treating as a confabulation. Verification: bun build auditor/checks/static.ts compiles Daemon restart needed to activate; auto-reset cap will fire [1/3] on the new SHA. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>