Fix audit findings F01–F07 (render, paths, CLI I/O, mix scan) - #108
Conversation
Branch by element type in Chromium surface measurement, protect relative and forward-slash Windows paths plus Markdown reference labels, keep exact line endings and strict UTF-8 stdin, add --text/--file, and remove per-candidate whole-document hashing. Historical evidence files stay untouched; replacement measurements live under evidence/audit-fixes-2026-08-27/. Co-authored-by: Byte271 <byte271@users.noreply.github.com>
Co-authored-by: Byte271 <byte271@users.noreply.github.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Path.write_text converts newlines on Windows, which made --file mode look like it rewrote endings when the fixture already stored CRLF. Co-authored-by: Byte271 <byte271@users.noreply.github.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 76a5b06c6b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| def _normalize_markdown_label(label: str) -> str: | ||
| return " ".join(label.split()).casefold() |
There was a problem hiding this comment.
When a collapsed or shortcut reference uses an escaped punctuation character, such as [foo\*][] with [foo*]: https://example.com, Markdown resolves both labels to the same normalized value, but this function compares the raw backslash forms. The use label is therefore left unprotected, hidden carriers are inserted into it, and the transformed document no longer resolves the link. Decode Markdown backslash escapes (and equivalent label normalization such as character references) before comparing labels.
Useful? React with 👍 / 👎.
2 participants
Summary
Implements the open FuckMark audit findings F01–F07 against baseline
be6ae7645fda8b39d1d308722ac249f519e68de5(package 0.4.0). Historical evidence files and their SHA-256 sums are not rewritten. Product limitations L01–L04 remain documented limitations, not silent bug closures.This PR is the delivery vehicle for review. No merge, tag, or release is requested here.
Fixes
textarea.value/contenteditable.textContent. Missing browser →UNKNOWN, neverVERIFIED. Replacement measurement inevidence/audit-fixes-2026-08-27/invalidates blank-div contenteditable VERIFIED rows from 2026-08-26.src/main.py,docs/README.md) and Windows paths using/(C:/Users/...) with exact byte preservation. Does not treatand/ororinput/outputas paths.-o, stdout, and--visible.--text/--file. Ordinary sentences and decimals are literal text. Slash-looking operands still need--textwhen they are not files.Algorithm / freeze attribution
u034f-ufe00-letter-alt-v1output hashes when a newly protected span is present.cycle8-mix-freeze-v1still pins historicalletter_mix_source_sha256b1ceec24…. Liveletter_mix.pyis intentionally different.release-cli-v5. Package version remains0.4.0.Verification
Local full suite: 1853 passed, 15 skipped (1868 collected).
Skipped because optional research deps / artifacts are absent (
scipy,transformers,torch,fonttools, external SynthID refs, local freeze artifacts, MidDev matrix workflow). Chromium contenteditable/textarea controls ran on this host (Google Chrome 148.0.7778.96, DejaVu Sans Mono).CI also adds a
cli-iojob onubuntu-latestandwindows-latestfor real file/stdin/stdout coverage.CI note: first Windows
cli-iorun failed becausePath.write_textrewrote the space-filename fixture to CRLF. Fixed inb5d17e0by writing raw LF bytes.Walkthrough evidence
F01 contenteditable now shows distinct text (AAAA vs BBBB), not blank divs:
contenteditable AAAA
contenteditable BBBB
Render status matrix and CLI demos for F02–F06:
See
/opt/cursor/artifacts/f01_render_results.jsonand/opt/cursor/artifacts/audit_fix_cli_demo.txt.Out of scope (still L01–L04)
To show artifacts inline, enable in settings.