Skip to content

fix(#268): align qa-* test from_session with ntok-bound alias — restore 13/13 L1 green #269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
s2agi merged 1 commit into from
Jun 28, 2026
Merged

fix(#268): align qa-* test from_session with ntok-bound alias — restore 13/13 L1 green #269

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions tests/qa-dash-08-cross-account-views/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,9 +86,9 @@ mcp_call "$ALICE_NTOK" "report_status" "$ARG" | jq -e '.ok == true' >/dev/null \
|| { echo "FAIL: alice report_status"; exit 1; }
# dispatch + reply (so /api/completions gets a row)
ARG=$(jq -nc --arg net "$ALICE_NET" \
'{alias:"alice-secret-agent",task:"alice-confidential-task",priority:"normal",network_id:$net,from_session:"alice"}')
'{alias:"alice-secret-agent",task:"alice-confidential-task",priority:"normal",network_id:$net,from_session:"alice-secret-agent"}')

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the from_name probe seeded with a matching sender

With this change, the seeded alice-confidential-task row is written with from_name=alice-secret-agent because send_task stores from_session as the task sender, but step [7] still queries /api/tasks?from_name=alice and looks for that content. The /api/tasks handler applies an exact from_name = ? predicate (server/src/index.ts:1979), so this probe now returns zero rows even if the documented from_name=alice dashboard IDOR path regresses; seed this row through Alice's UTOK or update the probe to match the actual sender.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Seed a real completion before checking completion isolation

Now that this setup gets past send_task, the /api/completions probe still has no Alice completion to protect: send_reply only updates the task/reply path, while completion rows are inserted by report_completion (server/src/tools.ts:442-463). As a result step [5] passes with an empty .completions array even if /api/completions stops applying tenant scope; add a report_completion call for Alice before Bob's /api/completions check.

Useful? React with 👍 / 👎.

TASK_ID=$(mcp_call "$ALICE_NTOK" "send_task" "$ARG" | jq -r '.message_id')
[[ -n "$TASK_ID" ]] || { echo "FAIL: no task id"; exit 1; }
[[ -n "$TASK_ID" && "$TASK_ID" != "null" ]] || { echo "FAIL: no task id"; exit 1; }
ARG=$(jq -nc --arg t "$TASK_ID" \
'{alias:"alice",text:"alice-private-reply-text",in_reply_to:$t,status:"replied",from_session:"alice-secret-agent"}')
mcp_call "$ALICE_NTOK" "send_reply" "$ARG" | jq -e '.ok == true' >/dev/null \
Expand Down
2 changes: 1 addition & 1 deletion tests/qa-dash-10-incremental-poll/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ mcp_call "$NTOK" "report_status" "$ARG" | jq -e '.ok == true' >/dev/null \
do_send() {
local text="$1"
ARG=$(jq -nc --arg net "$NET_ID" --arg t "$text" \
'{alias:"dash10-agent",task:$t,priority:"normal",network_id:$net,from_session:"admin"}')
'{alias:"dash10-agent",task:$t,priority:"normal",network_id:$net,from_session:"dash10-agent"}')
mcp_call "$NTOK" "send_task" "$ARG" | jq -r '.message_id'
}

Expand Down
2 changes: 1 addition & 1 deletion tests/qa-hub-06b-cross-user-isolation/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ mcp_call "$ALICE_NTOK" "report_status" "$ARG" | jq -e '.ok == true' >/dev/null \

echo "[3] alice sends a 'top-secret-alice' task to alice-agent"
ARG=$(jq -nc --arg a "alice-agent" --arg t "top-secret-alice-payload" --arg net "$ALICE_NET" \
'{alias:$a,task:$t,priority:"normal",network_id:$net,from_session:"alice"}')
'{alias:$a,task:$t,priority:"normal",network_id:$net,from_session:"alice-agent"}')
mcp_call "$ALICE_NTOK" "send_task" "$ARG" | jq -e '.message_id' >/dev/null \
|| { echo "FAIL: alice send_task"; exit 1; }

Expand Down
4 changes: 2 additions & 2 deletions tests/qa-hub-09-task-state-machine/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ echo "[5] BRANCH cancelled: send → cancel_task"
T_CXL=$(send_task "$UTOK" "$NET_ID" "agent-09" "task-cancelled")
[[ "$(task_field "$UTOK" "$NET_ID" "$T_CXL" status)" == "delivered" ]] || \
{ echo "FAIL: cancel PRE != delivered"; exit 1; }
ARG=$(jq -nc --arg t "$T_CXL" '{task_id:$t,reason:"user changed mind",from_session:"admin"}')
ARG=$(jq -nc --arg t "$T_CXL" '{task_id:$t,reason:"user changed mind",from_session:"agent-09"}')
# cancel_task needs a network-scoped writer (canWrite). Use NTOK (which is
# bound to NET_ID) — agent-09 cancelling a task targeted at itself.
CXL_RESP=$(mcp_call "$NTOK" "cancel_task" "$ARG")
Expand Down Expand Up @@ -163,7 +163,7 @@ sleep 0.2
{ echo "FAIL: terminal task.status changed on second send_reply"; exit 1; }

echo "[8] PIN: cancel_task on already-cancelled task returns ok:false"
ARG=$(jq -nc --arg t "$T_CXL" '{task_id:$t,reason:"again",from_session:"admin"}')
ARG=$(jq -nc --arg t "$T_CXL" '{task_id:$t,reason:"again",from_session:"agent-09"}')
CXL2=$(mcp_call "$NTOK" "cancel_task" "$ARG")
# cancel_task's WHERE excludes terminal states → changes=0 → ok:false
echo "$CXL2" | jq -e '.ok == false' >/dev/null \
Expand Down
Loading