Fork ports, pass-2 category actions, DAI safeguards (2.90.1) - #681
Merged
Conversation
- Clip DAI core spans on the lower-priority survivor fragment in split_conflicting_action_span's precedence branch, and log fully nested discards instead of dropping them silently - Merge gates compare effective actions (pattern-overrides-keep) so a pattern-defined keep never fuses with a plain keep before the split's precedence can protect the plain keep's audio - Plain confirmations (no confirmed_span) skip fragment dedup: every matching fragment auto-accepts as before, so no part of a confirmed ad loses its cut - Boundary adjustments judge false-positive conflicts against the adjusted bounds with mutual 50% coverage, so a rejection extending past the asserted span survives - Kept-span exclusion screens pass-2 conflicts against false-positive corrections before holding them for review - cut_barriers thread through the pass-1 render and manual recut so kept audio is protected from cut merging and end-extension on every render path, not only the pass-2 recut
…parately A boundary_adjustment correction still clamps a re-detection to its approved bounds and auto-accepts, but no longer grants the validation.user_confirmed reviewer bypass, so a stale adjustment cannot pin a cut on a drifted DAI timeline. Audio a wider re-detection covers beyond both the reviewed bounds and the approved span is split into its own marker and validated on its own merits instead of vanishing with the clamp.
Closes the seven open CodeQL path-injection findings on storage.py: episode artwork reads, stale-extension cleanup, and cleanup_podcast_dir now use _safe_join_under (resolve-and-verify) instead of raw joins. All three sites were already guarded by input validation; this makes the containment provable to the scanner and adds traversal regression tests. A traversal slug at feed deletion degrades to False instead of raising mid-delete.
README gains a short Contributing section above the disclaimer. Issue forms for bug reports, feature requests/enhancements, and general feedback, plus a PR template with the local test checklist. The bug form reminds reporters to scrub keys, domains, and private feed URLs before pasting logs.
ttlequals0
changed the title
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Version
2.90.1
Test plan