diff --git a/scripts/addons/suites.json b/scripts/addons/suites.json index 49b4b6a351..bdce7750cd 100644 --- a/scripts/addons/suites.json +++ b/scripts/addons/suites.json @@ -435,7 +435,42 @@ "a type that is no media type", "a repeated type", "too many types", - "reads files from JSON and refuses an unknown field in it" + "reads files from JSON and refuses an unknown field in it", + "is valid for a tool that shadows bash", + "is valid with a key, its values and a default among them", + "refuses a bad key, bad values and a default that is not allowed", + "refuses a repeated key and too many settings", + "fixes the values and the default of a role the host reads", + "answers whether a value is allowed", + "is tools.write for a tool that is not a read, in an add-on that holds a credential", + "is empty for a read, and for any tool of an add-on without a credential", + "names a capability in the closed list", + "accepts roles and known permissions", + "refuses an unknown or repeated permission", + "refuses too many roles or permissions, a bad role ID and a repeated role", + "describes every capability, and never makes a sensitive one usual", + "never grants a sensitive capability to a role", + "keeps only declared, distinct roles of a message", + "needs a connector kind to hold the binding", + "is refused with a bad kind, a repeated or extra slot or a bad argument name", + "are allowed when they name the resource with the slot argument", + "never take the host resource argument", + "must require the slot argument", + "refuse an approval value the host does not know", + "are the only change a credential allows: schema, create and action tools are refused", + "are refused in an add-on without a credential when they lack resourceId", + "accept the approval field on a write tool only", + "may be checked on their own with ValidateCredentialedToolSchema", + "makes a tool require the resource argument as a string", + "round trips through the manifest and rejects a spelling of another case", + "returns the key of the argument", + "refuses a missing or non-string key", + "finds nothing in a tool that does not declare the argument", + "carries a resource key and a credential", + "refuses a resource key with a control character or too long, and a huge credential", + "is found through wrapping and keeps its wait in bounds", + "accepts agentOptional and keeps it through a JSON round trip", + "accepts a thread history" ] }, { @@ -621,7 +656,13 @@ "proves every source block and local reference without Git or network", "installs unchanged PDF helpers and their license with a build-time fixture check", "declares and packages a loadable, receipt-verified skill without shadows", - "rejects a missing skill, mismatched frontmatter, and scripts" + "rejects a missing skill, mismatched frontmatter, and scripts", + "has consistent package files for github", + "writes the zip of a verified layout with a digest manifest and a sha256 file", + "audits actual host calls and strict package contract for github", + "lists every release platform with its runner", + "enables a platform exactly when its native check is recorded", + "has a catalog template" ] }, { @@ -736,7 +777,8 @@ "keeps a sources.json the admin already has", "does not add the default again after the admin removed it", "seeds only once per instance", - "refuses an entry two of your sources list, and excludes disabled sources" + "refuses an entry two of your sources list, and excludes disabled sources", + "reports the id of a skipped entry" ], "report": ".cache/addons/logs/catalog.json" }, @@ -806,7 +848,32 @@ "still installs a single manifest and refuses a different digest", "persists model actions and typed declarations together separately and absent in verified immutable manifests and receipts", "refuses unsupported typed candidates without changing the previous package bytes digest or receipt", - "discards only the creating installer's unpublished single use stage" + "discards only the creating installer's unpublished single use stage", + "stages a zip like a library package and records that it is unsigned", + "describes a zip without writing it", + "parent directory", + "nested parent directory", + "absolute path", + "backslash", + "drive letter", + "current directory prefix", + "double slash", + "NUL byte", + "refuses a path that repeats, also when the case differs", + "refuses a symbolic link", + "refuses an executable bit on a file that is not the executable", + "refuses a zip whose digest list does not match", + "refuses a missing and an extra file", + "refuses a size in the list that the file does not have", + "refuses a zip for another platform before it writes anything", + "refuses a manifest.json that disagrees with the digest manifest", + "refuses a file that is not a zip, and a zip without a digest manifest", + "refuses a zip above the size limit", + "refuses files that together expand past the limit", + "refuses a file that compresses like a bomb", + "refuses more files than the limit", + "refuses a path that is a file in one entry and a directory in another", + "does not read a path through a symbolic link planted in the staging area" ], "report": ".cache/addons/logs/packages.json" }, @@ -911,7 +978,36 @@ "reads the library again when the startup refresh failed", "cancels status lookup while a lifecycle writer holds the journal lock", "refuses an unknown phase or event with an error instead of panicking", - "drops the oldest finished views once too many pile up" + "drops the oldest finished views once too many pile up", + "follows install and uninstall without the manager lock", + "installs through the manager and records an unsigned local file", + "never installs a file from the plain typed install, which a key or a tool can make", + "keeps a file for the user that uploaded it", + "refuses a file for another platform when it is uploaded, and leaves nothing staged", + "refuses an install when the administrator is not one", + "upgrades to a higher version through the same generation machinery", + "refuses the same version", + "refuses a lower version unless the downgrade is confirmed", + "grants only what the administrator approved for the digest of the file", + "previews only the files of the calling user", + "refuses an install that needs an operation nobody approved, and says to approve it", + "grants only what was approved, declared and registered, and counts it after completion", + "never admits another package with the approval of one digest", + "refuses a required operation that is denied, and installs with a denied optional one degraded", + "holds an upgrade that needs more required operations while the old version stays", + "runs an upgrade with a new optional operation degraded, and shrinks nothing when fewer are asked", + "removes the pending entry of an operation that fails after the grants were written", + "fails the install when the grants cannot be written, and keeps nothing", + "deletes the grants of an add-on when it is uninstalled", + "keeps the add-on installed and its grants when the grants cannot be deleted at uninstall", + "holds an upgrade that comes from another library or signer until it is approved", + "never approves in an automatic upgrade, and does not retry the same candidate", + "lets the blanket switch grant the required operations of an automatic upgrade", + "never lets the blanket switch grant a denied operation", + "tells the Apps listing which operations are held and which are denied", + "keeps a deployment that grants the prefix in the policy file working as before", + "is safe to read the grants while installs and changes run", + "stops a running add-on that loses a required operation and starts it again on a grant" ], "report": ".cache/addons/logs/lifecycle.json" }, @@ -1009,7 +1105,11 @@ "malformed/artifact payload", "success", "timeout", - "cancels an admitted observation when the runtime withdraws" + "cancels an admitted observation when the runtime withdraws", + "opens an endpoint for a declared operation that is not granted, and a later grant works with no restart", + "types the add-on's own 429 answer with its wait, never as an outage", + "keeps the wait between one second and the bound", + "leaves a 429 with another body an outage: only the add-on's own word counts" ] }, { @@ -1045,7 +1145,8 @@ "closes the runtime with a bounded context before it exits, once", "exits when the owner closes the startup channel", "still exits when the runtime does not return in time", - "exits at once for a runtime with nothing to close" + "exits at once for a runtime with nothing to close", + "answers 429 with the wait in Retry-After and a fixed body" ] } ] @@ -1246,7 +1347,79 @@ "keeps a refusal apart from an outage", "refuses a handle for a kind that declared no files, and without a table", "refuses a media or send_file call that carries no handle", - "serves exactly one routing payload per request" + "serves exactly one routing payload per request", + "names what an upgrade adds, using the installed package to tell what is held", + "says why an add-on is stopped, and carries its library and new optional access", + "keeps a blanket grant as the administrator's own, so revoking the blanket grants leaves it", + "is not reachable: a dispatch of a host access action is forbidden on the owner", + "forwards a write that carries the human mark and lets both frontends read the one revision", + "refuses at the owner a write that the frontend did not mark, whatever else it holds", + "lets the typed refusals of the owner through unchanged", + "never lets a frontend with its own service or flags decide: it forwards", + "reports an owner without host access calls as unavailable with its reason, never as an unknown outcome", + "signs the human mark so it cannot be added after the fact", + "does not carry the mark on a call that is not a host access call", + "registers the handle for the call and gives the host's size and hash, not the add-on's", + "drops an answer for a file the add-on did not finish", + "refuses a handle on an op that moves no file, and an outbound handle with no content", + "fails closed with the unavailable answer and leaves the document unchanged", + "asks the manager to re-sync after an edit that only removes", + "asks the manager to re-sync after a revoke", + "asks the manager to re-sync after a deny is added and after it is removed", + "asks the manager to re-sync when the blanket grants are revoked", + "does not ask again for a replayed operation", + "gives the add-on the credential and the host ID of an allowed resource", + "refuses a resource that is not on the list before the add-on is called", + "refuses a call without the resource argument", + "gives a tool without a resource argument the credential and no resource", + "drops a credential, a key or a resource that the caller put in the request", + "fails closed when the owner has no credential source", + "reports an outage of the source as unavailable", + "denies a stale generation as a denial, never as an outage of the owner", + "does not touch an add-on that declares no credentials", + "reads the floor, the deny rules and the state of each add-on, with a file deny shown as blocked", + "refuses a non-administrator before it reads anything", + "lists the verified request with its status and a nonce", + "shows a deny winning over everything, and cannot install a blocked required operation", + "marks what a deployment prefix holds, and an operation granted before an uninstall as a hint only", + "says when the blanket switch would grant on install", + "passes the approval to the manager and answers the operation", + "refuses without the human surface and never reaches the manager", + "refuses a stale revision as 409 revision_conflict", + "uses the nonce once, lets the same operation replay, and binds it to the credential and the digest", + "expires a nonce", + "types the decisions of the manager", + "rejects an upgrade with one pin, an unknown field and a body that names another operation", + "grants a declared operation, shows it, and revokes it again", + "refuses a stale revision with 409 and an operation replayed with another body with 409", + "refuses an operation the manifest does not declare or the host does not register, and one that is denied", + "does not grant an entry from a package with another identity", + "lists a grant the manifest no longer asks for, and relabels blanket grants on request", + "revoke of an unknown add-on is 404 and of one without grants changes nothing", + "refuses every write without the human surface, and when the deployment locks the store", + "needs the typed text, stated for the scope", + "grants the installed add-ons what they declare, never a denied one, and skips what is blocked", + "covers only official add-ons in official mode", + "keeps the grants it made when turned off, or revokes them all when asked", + "is refused when the deployment fixes the mode, and reads as set by the deployment", + "rejects options that do not fit the mode", + "shows what a rule takes before it applies and what makes an add-on stop", + "refuses an invalid rule, a stale revision, and the dry run needs no human surface but a write does", + "writes an audit line for each change, with the credential kind and never a request body", + "moves a file in chunks and keeps its digest", + "moves a file in chunks and keeps its digest", + "cuts an upload that goes over the limit and keeps nothing", + "cuts an upload that goes over the limit and keeps nothing", + "passes the rule a refused file broke to the caller", + "passes the rule a refused file broke to the caller", + "aborts when the client's stream breaks, and rejects an empty file", + "aborts when the client's stream breaks, and rejects an empty file", + "binds a staged file to the user that uploaded it", + "binds a staged file to the user that uploaded it", + "lets a second frontend read the file the first one uploaded", + "needs no human mark to stage a file, and never changes the policy by it", + "stages nothing while the deployment locks the UI host grants", + "answers unavailable when the owner has no file service" ] }, { @@ -1364,7 +1537,56 @@ "returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator", "logs the cause of a failed install and types it for the client", "logs the reason behind a generic denial and leaves the response unchanged", - "names every typed cause of a failed install in the 403 of the dispatch route" + "names every typed cause of a failed install in the 403 of the dispatch route", + "not JSON", + "empty", + "lets an administrator's session write and refuses the same administrator's API key", + "gives the default to a person who has not chosen", + "stores a declared value and reads it back", + "repeats a write with the same result", + "a value that is not allowed", + "an empty value", + "a key nobody declared", + "an extra field", + "answers 404 for an add-on that is not there, with the same words for a bad name", + "gives an empty list to an add-on that declares none", + "an API key header", + "an x-api-key header", + "no confirmation header", + "the confirmation of another add-on", + "a cross-site request", + "a navigation instead of a fetch", + "a tool call", + "answers 503 and does not guess when the store is down", + "answers 503 when the owner cannot say what the add-on declares", + "treats a stored value that the manifest no longer allows as the default", + "keeps one person's choice from another", + "serves the reads to an administrator by API key as well", + "answers the shapes the React client reads", + "an API key", + "an x-api-key header", + "the legacy token cookie", + "an MCP session", + "a tool call", + "an agent run", + "a cross-site page", + "a navigation", + "a missing confirm header", + "a confirm header for another operation", + "a foreign Origin without fetch metadata", + "accepts a plain-HTTP tab that names this host in Origin when the browser sends no fetch metadata", + "edits, replays the same operation and refuses a stale revision with 409", + "answers the typed refusals of a bad write", + "revokes with the revision in the query", + "previews, then installs with the nonce, and refuses the same approval from the wrong surface", + "needs the typed text for the blanket, and a human surface for a deny, but not for its dry run", + "stages a file and answers with its digest", + "accepts an administrator's API key to stage a file, as the command line does", + "refuses a cross-site or unproven request that rides a session cookie", + "refuses a request without a file part", + "types a file over the limit and a file that broke a rule", + "does not let a script install a staged file: the install keeps its human surface rule", + "lets administrators stage a file and keeps it from everyone else" ] }, { @@ -1521,7 +1743,11 @@ "does not refuse a message that reached the transcript when the turn is stopped meanwhile", "refuses a message when too many wait, before it reaches the transcript", "refuses a message when the waiting ones are too big", - "keeps the waiting messages when the turn is stopped and sends them with the next one" + "keeps the waiting messages when the turn is stopped and sends them with the next one", + "mounts the first at home and the others by name, each capped by the fence", + "skips a folder outside the fence instead of widening it", + "names two folders with the same name apart and never takes a reserved name", + "refuses a path that climbs out of a mounted folder" ] } ] @@ -1680,7 +1906,23 @@ "refuses an identity that does not fit the mode", "refuses a held add-on as unavailable, and serves it again after the release", "refuses an empty add-on ID and a nil work function", - "is reached through the gateway provider" + "is reached through the gateway provider", + "stores a proposal that awaits a person, with the credential in the preview and never at rest", + "does not let a chat turn apply it, and lets the person do it with a fresh credential", + "does not let a chat turn confirm it when the chat and the browser share one credential", + "refuses a repository that is not on the list before the add-on is called", + "refuses the call when the write mode was lowered before the confirmation, and keeps the proposal pending", + "refuses a call that names the host resource itself", + "never runs a write while the mode is off", + "is unavailable when the host has no credential source", + "lets a chat turn apply the proposal it just stored", + "keeps a proposal for a person when the tool declares approval always", + "falls back to a person when the mode dropped to propose before the apply", + "does not let another user confirm", + "names the connection it was previewed with", + "applies with that very connection, even if the chat selects another one meanwhile", + "refuses the apply when that connection is gone, and sends nothing", + "refuses to propose when no connection is selected" ], "report": ".cache/addons/logs/policy.json" }, @@ -1853,7 +2095,23 @@ "refuses an identity that does not fit the mode", "refuses a held add-on as unavailable, and serves it again after the release", "refuses an empty add-on ID and a nil work function", - "is reached through the gateway provider" + "is reached through the gateway provider", + "stores a proposal that awaits a person, with the credential in the preview and never at rest", + "does not let a chat turn apply it, and lets the person do it with a fresh credential", + "does not let a chat turn confirm it when the chat and the browser share one credential", + "refuses a repository that is not on the list before the add-on is called", + "refuses the call when the write mode was lowered before the confirmation, and keeps the proposal pending", + "refuses a call that names the host resource itself", + "never runs a write while the mode is off", + "is unavailable when the host has no credential source", + "lets a chat turn apply the proposal it just stored", + "keeps a proposal for a person when the tool declares approval always", + "falls back to a person when the mode dropped to propose before the apply", + "does not let another user confirm", + "names the connection it was previewed with", + "applies with that very connection, even if the chat selects another one meanwhile", + "refuses the apply when that connection is gone, and sends nothing", + "refuses to propose when no connection is selected" ] }, { @@ -1971,7 +2229,56 @@ "returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator", "logs the cause of a failed install and types it for the client", "logs the reason behind a generic denial and leaves the response unchanged", - "names every typed cause of a failed install in the 403 of the dispatch route" + "names every typed cause of a failed install in the 403 of the dispatch route", + "not JSON", + "empty", + "lets an administrator's session write and refuses the same administrator's API key", + "gives the default to a person who has not chosen", + "stores a declared value and reads it back", + "repeats a write with the same result", + "a value that is not allowed", + "an empty value", + "a key nobody declared", + "an extra field", + "answers 404 for an add-on that is not there, with the same words for a bad name", + "gives an empty list to an add-on that declares none", + "an API key header", + "an x-api-key header", + "no confirmation header", + "the confirmation of another add-on", + "a cross-site request", + "a navigation instead of a fetch", + "a tool call", + "answers 503 and does not guess when the store is down", + "answers 503 when the owner cannot say what the add-on declares", + "treats a stored value that the manifest no longer allows as the default", + "keeps one person's choice from another", + "serves the reads to an administrator by API key as well", + "answers the shapes the React client reads", + "an API key", + "an x-api-key header", + "the legacy token cookie", + "an MCP session", + "a tool call", + "an agent run", + "a cross-site page", + "a navigation", + "a missing confirm header", + "a confirm header for another operation", + "a foreign Origin without fetch metadata", + "accepts a plain-HTTP tab that names this host in Origin when the browser sends no fetch metadata", + "edits, replays the same operation and refuses a stale revision with 409", + "answers the typed refusals of a bad write", + "revokes with the revision in the query", + "previews, then installs with the nonce, and refuses the same approval from the wrong surface", + "needs the typed text for the blanket, and a human surface for a deny, but not for its dry run", + "stages a file and answers with its digest", + "accepts an administrator's API key to stage a file, as the command line does", + "refuses a cross-site or unproven request that rides a session cookie", + "refuses a request without a file part", + "types a file over the limit and a file that broke a rule", + "does not let a script install a staged file: the install keeps its human surface rule", + "lets administrators stage a file and keeps it from everyone else" ] } ] @@ -2202,7 +2509,79 @@ "keeps a refusal apart from an outage", "refuses a handle for a kind that declared no files, and without a table", "refuses a media or send_file call that carries no handle", - "serves exactly one routing payload per request" + "serves exactly one routing payload per request", + "names what an upgrade adds, using the installed package to tell what is held", + "says why an add-on is stopped, and carries its library and new optional access", + "keeps a blanket grant as the administrator's own, so revoking the blanket grants leaves it", + "is not reachable: a dispatch of a host access action is forbidden on the owner", + "forwards a write that carries the human mark and lets both frontends read the one revision", + "refuses at the owner a write that the frontend did not mark, whatever else it holds", + "lets the typed refusals of the owner through unchanged", + "never lets a frontend with its own service or flags decide: it forwards", + "reports an owner without host access calls as unavailable with its reason, never as an unknown outcome", + "signs the human mark so it cannot be added after the fact", + "does not carry the mark on a call that is not a host access call", + "registers the handle for the call and gives the host's size and hash, not the add-on's", + "drops an answer for a file the add-on did not finish", + "refuses a handle on an op that moves no file, and an outbound handle with no content", + "fails closed with the unavailable answer and leaves the document unchanged", + "asks the manager to re-sync after an edit that only removes", + "asks the manager to re-sync after a revoke", + "asks the manager to re-sync after a deny is added and after it is removed", + "asks the manager to re-sync when the blanket grants are revoked", + "does not ask again for a replayed operation", + "gives the add-on the credential and the host ID of an allowed resource", + "refuses a resource that is not on the list before the add-on is called", + "refuses a call without the resource argument", + "gives a tool without a resource argument the credential and no resource", + "drops a credential, a key or a resource that the caller put in the request", + "fails closed when the owner has no credential source", + "reports an outage of the source as unavailable", + "denies a stale generation as a denial, never as an outage of the owner", + "does not touch an add-on that declares no credentials", + "reads the floor, the deny rules and the state of each add-on, with a file deny shown as blocked", + "refuses a non-administrator before it reads anything", + "lists the verified request with its status and a nonce", + "shows a deny winning over everything, and cannot install a blocked required operation", + "marks what a deployment prefix holds, and an operation granted before an uninstall as a hint only", + "says when the blanket switch would grant on install", + "passes the approval to the manager and answers the operation", + "refuses without the human surface and never reaches the manager", + "refuses a stale revision as 409 revision_conflict", + "uses the nonce once, lets the same operation replay, and binds it to the credential and the digest", + "expires a nonce", + "types the decisions of the manager", + "rejects an upgrade with one pin, an unknown field and a body that names another operation", + "grants a declared operation, shows it, and revokes it again", + "refuses a stale revision with 409 and an operation replayed with another body with 409", + "refuses an operation the manifest does not declare or the host does not register, and one that is denied", + "does not grant an entry from a package with another identity", + "lists a grant the manifest no longer asks for, and relabels blanket grants on request", + "revoke of an unknown add-on is 404 and of one without grants changes nothing", + "refuses every write without the human surface, and when the deployment locks the store", + "needs the typed text, stated for the scope", + "grants the installed add-ons what they declare, never a denied one, and skips what is blocked", + "covers only official add-ons in official mode", + "keeps the grants it made when turned off, or revokes them all when asked", + "is refused when the deployment fixes the mode, and reads as set by the deployment", + "rejects options that do not fit the mode", + "shows what a rule takes before it applies and what makes an add-on stop", + "refuses an invalid rule, a stale revision, and the dry run needs no human surface but a write does", + "writes an audit line for each change, with the credential kind and never a request body", + "moves a file in chunks and keeps its digest", + "moves a file in chunks and keeps its digest", + "cuts an upload that goes over the limit and keeps nothing", + "cuts an upload that goes over the limit and keeps nothing", + "passes the rule a refused file broke to the caller", + "passes the rule a refused file broke to the caller", + "aborts when the client's stream breaks, and rejects an empty file", + "aborts when the client's stream breaks, and rejects an empty file", + "binds a staged file to the user that uploaded it", + "binds a staged file to the user that uploaded it", + "lets a second frontend read the file the first one uploaded", + "needs no human mark to stage a file, and never changes the policy by it", + "stages nothing while the deployment locks the UI host grants", + "answers unavailable when the owner has no file service" ] }, { @@ -2320,7 +2699,56 @@ "returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator", "logs the cause of a failed install and types it for the client", "logs the reason behind a generic denial and leaves the response unchanged", - "names every typed cause of a failed install in the 403 of the dispatch route" + "names every typed cause of a failed install in the 403 of the dispatch route", + "not JSON", + "empty", + "lets an administrator's session write and refuses the same administrator's API key", + "gives the default to a person who has not chosen", + "stores a declared value and reads it back", + "repeats a write with the same result", + "a value that is not allowed", + "an empty value", + "a key nobody declared", + "an extra field", + "answers 404 for an add-on that is not there, with the same words for a bad name", + "gives an empty list to an add-on that declares none", + "an API key header", + "an x-api-key header", + "no confirmation header", + "the confirmation of another add-on", + "a cross-site request", + "a navigation instead of a fetch", + "a tool call", + "answers 503 and does not guess when the store is down", + "answers 503 when the owner cannot say what the add-on declares", + "treats a stored value that the manifest no longer allows as the default", + "keeps one person's choice from another", + "serves the reads to an administrator by API key as well", + "answers the shapes the React client reads", + "an API key", + "an x-api-key header", + "the legacy token cookie", + "an MCP session", + "a tool call", + "an agent run", + "a cross-site page", + "a navigation", + "a missing confirm header", + "a confirm header for another operation", + "a foreign Origin without fetch metadata", + "accepts a plain-HTTP tab that names this host in Origin when the browser sends no fetch metadata", + "edits, replays the same operation and refuses a stale revision with 409", + "answers the typed refusals of a bad write", + "revokes with the revision in the query", + "previews, then installs with the nonce, and refuses the same approval from the wrong surface", + "needs the typed text for the blanket, and a human surface for a deny, but not for its dry run", + "stages a file and answers with its digest", + "accepts an administrator's API key to stage a file, as the command line does", + "refuses a cross-site or unproven request that rides a session cookie", + "refuses a request without a file part", + "types a file over the limit and a file that broke a rule", + "does not let a script install a staged file: the install keeps its human surface rule", + "lets administrators stage a file and keeps it from everyone else" ] } ] @@ -2454,7 +2882,7 @@ "reads the library on demand when the startup refresh has not filled the cache", "reads the library again when the startup refresh failed", "writes the owner and storage only, with no address", - "loads when only the address changed", + "loads when only the address changed", "refuses a changed owner ID", "refuses a changed storage ID", "copies every capability field of the manifest, so a new field cannot be forgotten", @@ -2485,7 +2913,36 @@ "keeps an explicitly empty startup policy immutable", "publishes identical bytes and digests with sorted archive entries for unchanged inputs and transforms", "refuses an unknown phase or event with an error instead of panicking", - "drops the oldest finished views once too many pile up" + "drops the oldest finished views once too many pile up", + "follows install and uninstall without the manager lock", + "installs through the manager and records an unsigned local file", + "never installs a file from the plain typed install, which a key or a tool can make", + "keeps a file for the user that uploaded it", + "refuses a file for another platform when it is uploaded, and leaves nothing staged", + "refuses an install when the administrator is not one", + "upgrades to a higher version through the same generation machinery", + "refuses the same version", + "refuses a lower version unless the downgrade is confirmed", + "grants only what the administrator approved for the digest of the file", + "previews only the files of the calling user", + "refuses an install that needs an operation nobody approved, and says to approve it", + "grants only what was approved, declared and registered, and counts it after completion", + "never admits another package with the approval of one digest", + "refuses a required operation that is denied, and installs with a denied optional one degraded", + "holds an upgrade that needs more required operations while the old version stays", + "runs an upgrade with a new optional operation degraded, and shrinks nothing when fewer are asked", + "removes the pending entry of an operation that fails after the grants were written", + "fails the install when the grants cannot be written, and keeps nothing", + "deletes the grants of an add-on when it is uninstalled", + "keeps the add-on installed and its grants when the grants cannot be deleted at uninstall", + "holds an upgrade that comes from another library or signer until it is approved", + "never approves in an automatic upgrade, and does not retry the same candidate", + "lets the blanket switch grant the required operations of an automatic upgrade", + "never lets the blanket switch grant a denied operation", + "tells the Apps listing which operations are held and which are denied", + "keeps a deployment that grants the prefix in the policy file working as before", + "is safe to read the grants while installs and changes run", + "stops a running add-on that loses a required operation and starts it again on a grant" ] }, { @@ -2554,7 +3011,11 @@ "malformed/artifact payload", "success", "timeout", - "cancels an admitted observation when the runtime withdraws" + "cancels an admitted observation when the runtime withdraws", + "opens an endpoint for a declared operation that is not granted, and a later grant works with no restart", + "types the add-on's own 429 answer with its wait, never as an outage", + "keeps the wait between one second and the bound", + "leaves a 429 with another body an outage: only the add-on's own word counts" ] }, { @@ -2672,7 +3133,56 @@ "returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator", "logs the cause of a failed install and types it for the client", "logs the reason behind a generic denial and leaves the response unchanged", - "names every typed cause of a failed install in the 403 of the dispatch route" + "names every typed cause of a failed install in the 403 of the dispatch route", + "not JSON", + "empty", + "lets an administrator's session write and refuses the same administrator's API key", + "gives the default to a person who has not chosen", + "stores a declared value and reads it back", + "repeats a write with the same result", + "a value that is not allowed", + "an empty value", + "a key nobody declared", + "an extra field", + "answers 404 for an add-on that is not there, with the same words for a bad name", + "gives an empty list to an add-on that declares none", + "an API key header", + "an x-api-key header", + "no confirmation header", + "the confirmation of another add-on", + "a cross-site request", + "a navigation instead of a fetch", + "a tool call", + "answers 503 and does not guess when the store is down", + "answers 503 when the owner cannot say what the add-on declares", + "treats a stored value that the manifest no longer allows as the default", + "keeps one person's choice from another", + "serves the reads to an administrator by API key as well", + "answers the shapes the React client reads", + "an API key", + "an x-api-key header", + "the legacy token cookie", + "an MCP session", + "a tool call", + "an agent run", + "a cross-site page", + "a navigation", + "a missing confirm header", + "a confirm header for another operation", + "a foreign Origin without fetch metadata", + "accepts a plain-HTTP tab that names this host in Origin when the browser sends no fetch metadata", + "edits, replays the same operation and refuses a stale revision with 409", + "answers the typed refusals of a bad write", + "revokes with the revision in the query", + "previews, then installs with the nonce, and refuses the same approval from the wrong surface", + "needs the typed text for the blanket, and a human surface for a deny, but not for its dry run", + "stages a file and answers with its digest", + "accepts an administrator's API key to stage a file, as the command line does", + "refuses a cross-site or unproven request that rides a session cookie", + "refuses a request without a file part", + "types a file over the limit and a file that broke a rule", + "does not let a script install a staged file: the install keeps its human surface rule", + "lets administrators stage a file and keeps it from everyone else" ] } ] @@ -3528,7 +4038,12 @@ "go: is empty for every tool of an add-on without a credential", "go: reaches the chat as the add-on declared it", "go: falls back to the add-on's title for a manifest that declares none", - "go: lists the skills that need isolation for the add-on that owns the commands tool" + "go: lists the skills that need isolation for the add-on that owns the commands tool", + "go: states the connection and the repository in a read result", + "go: states it on a refusal too, so the person sees whose list refused", + "go: states it on a proposal card", + "go: says nothing when the call carries no connection", + "go: turns a missing selection into a note the model can relay" ] }, "tables-admin": { @@ -4038,7 +4553,28 @@ "package.sh refuses a sandbox release build without SANDBOX_GUEST_IMAGE", "package.sh stamps the sandbox executable with a guest image in a local check", "go: packages all four document slots with the actual validator and no core fallback", - "go: proves every source block and local reference without Git or network" + "go: proves every source block and local reference without Git or network", + "go: writes the zip of a verified layout with a digest manifest and a sha256 file", + "go: audits actual host calls and strict package contract for face", + "go: audits actual host calls and strict package contract for fine-tuning", + "go: audits actual host calls and strict package contract for github", + "go: audits actual host calls and strict package contract for memory", + "go: audits actual host calls and strict package contract for office", + "go: audits actual host calls and strict package contract for quantization", + "go: audits actual host calls and strict package contract for sandbox", + "go: audits actual host calls and strict package contract for slack", + "go: audits actual host calls and strict package contract for studio", + "go: audits actual host calls and strict package contract for tables", + "go: audits actual host calls and strict package contract for talk", + "go: audits actual host calls and strict package contract for telegram", + "go: audits actual host calls and strict package contract for voice", + "go: audits actual host calls and strict package contract for web", + "go: loads exactly the historical grants through the actual host loader", + "go: explicitly selects the shipped policy in the final Docker runtime stage", + "go: lists every release platform with its runner", + "go: enables a platform exactly when its native check is recorded", + "go: has a catalog template", + "go: has consistent package files for github" ] }, "updates": { @@ -4341,7 +4877,31 @@ "fails closed at the retained correlation bound without restricting ordinary operations", "keeps authenticated pending inbound callbacks denied while another endpoint works", "refuses an authorized decoded callback paused across endpoint Stop", - "stops without waiting for a handler that ignores cancellation" + "stops without waiting for a handler that ignores cancellation", + "matches the prefix rule of the broker", + "does not follow later changes to the map it was built from", + "describes every supported operation, and only those", + "uses the first engine of the tag in gallery order when no backend is named", + "accepts a named engine that carries the tag, and refuses one that does not", + "refuses a start with no backend when none is installed", + "does not mix the families", + "applies a revoke to the next call", + "answers the same to a denied and a not granted operation", + "lets a running call finish after the revoke", + "refuses everything without an authority", + "is safe under concurrent calls and changes", + "start passes the same user key as the route", + "start refuses a field that is not in the tool schema", + "get of another user's job is not found", + "moves 20 MB in and 20 MB out with bounded memory", + "resumes at the offset the host has after a gap", + "refuses an oversize file and drops the partial one", + "refuses a file whose last chunk says it is short of the bytes sent, an empty file, and a write after final", + "refuses another add-on, an unknown handle and the wrong direction with one answer", + "does not let a handle be used for two calls", + "expires a handle that sees no call and removes the partial file", + "refuses a file the scan hook rejects", + "refuses an outbound handle whose content changed size and an offset past the end" ], "report": ".cache/addons/logs/host-admission.json" }