fleet/fleetd
3
0
Fork 0
Code Issues 102 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

A direct fleet_send to a lead pane skips the prompt-box gate #793

New Issue
Open
opened 2026-10-06 06:23:16 +02:00 by ltms · 0 comments
ltms commented 2026-10-06 06:23:16 +02:00
Owner
Copy Link
Copy Source

Found by the #790 worker, and I read the code paths it named.

PromptBox.clearToSubmit has three callers: ReplyPushLoop, LeadCoordLoop and LeadHeartbeatLoop (the ticket nudge, coord mail and heartbeat). A direct fleet_send{sessionId: <lead terminal>} goes MessageService → Injector, and the Injector has no box check. So a send to a lead's pane from a collaborator, a peer lead on this host, an architect, or (after #790) any observer pane can paste and submit while the operator is typing. That submits their half-written line.

The CLAUDE.md block (invariant 4) lists only the heartbeat, the ticket nudge and lead-to-lead mail as box-gated, so it does not claim this path is covered. But a reader takes "a lead's own pane has a second gate" as covering all delivery to a lead.

Mitigation that exists today: a lead that runs the fleet mod is mod-served, so it collects its mail through fleet_inbox and nothing is pasted (#788, install in #791).

Wanted: the Injector holds a paste to a configured lead's pane until PromptBox.clearToSubmit says yes, with the same retry and warning behaviour as the three loops. A mod-served pane is not affected. Member panes are not affected.

Found by the #790 worker, and I read the code paths it named. `PromptBox.clearToSubmit` has three callers: `ReplyPushLoop`, `LeadCoordLoop` and `LeadHeartbeatLoop` (the ticket nudge, coord mail and heartbeat). A direct `fleet_send{sessionId: <lead terminal>}` goes `MessageService` → `Injector`, and the `Injector` has no box check. So a send to a lead's pane from a collaborator, a peer lead on this host, an architect, or (after #790) any observer pane can paste and submit while the operator is typing. That submits their half-written line. The CLAUDE.md block (invariant 4) lists only the heartbeat, the ticket nudge and lead-to-lead mail as box-gated, so it does not claim this path is covered. But a reader takes "a lead's own pane has a second gate" as covering all delivery to a lead. Mitigation that exists today: a lead that runs the fleet mod is mod-served, so it collects its mail through `fleet_inbox` and nothing is pasted (#788, install in #791). Wanted: the Injector holds a paste to a configured lead's pane until `PromptBox.clearToSubmit` says yes, with the same retry and warning behaviour as the three loops. A mod-served pane is not affected. Member panes are not affected.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
blocked
Cannot start until something else lands. The body says what.
 needs-live-proof
Merged and green, but never shown working on the running daemon. Not the same as done.
 ready-to-delegate
Scope, files and acceptance criteria are written. A worker can be briefed from the body alone.
 silent-default
A feature that compiles, passes tests, and ships turned off. Nine recurrences and counting.
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent kevin ltms
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fleet/fleetd#793
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?