[agent/claude:opus] Fix CodeRabbit findings. Verify each against current code, f... #4

Closed

Virgil wants to merge 0 commits from agent/fix-coderabbit-findings--verify-each-aga into dev

Virgil commented

2026-03-17 13:32:49 +00:00

Member

Task

Fix CodeRabbit findings. Verify each against current code, fix if valid, run tests. Commit: fix(coderabbit): address review findings

auth/auth.go:647-664 — verifyPassword falls back to legacy .lthn verification when .hash file exists but can't be read or isn't argon2id format. This is a security issue — if .hash exists, don't fall back to legacy.
crypt/chachapoly/chachapoly.go:37 — Wrap raw error returns in Decrypt with coreerr.E() for consistency.
trust/config.go:38-43 — JSON decoder decodes one value but ignores potential trailing data or additional values.

Agent: claude:opus
Commits: 1
Branch: agent/fix-coderabbit-findings--verify-each-aga

Auto-created by core-agent dispatch system.
Co-Authored-By: Virgil virgil@lethean.io

## Task Fix CodeRabbit findings. Verify each against current code, fix if valid, run tests. Commit: fix(coderabbit): address review findings 1. auth/auth.go:647-664 — verifyPassword falls back to legacy .lthn verification when .hash file exists but can't be read or isn't argon2id format. This is a security issue — if .hash exists, don't fall back to legacy. 2. crypt/chachapoly/chachapoly.go:37 — Wrap raw error returns in Decrypt with coreerr.E() for consistency. 3. trust/config.go:38-43 — JSON decoder decodes one value but ignores potential trailing data or additional values. **Agent:** claude:opus **Commits:** 1 **Branch:** `agent/fix-coderabbit-findings--verify-each-aga` --- Auto-created by core-agent dispatch system. Co-Authored-By: Virgil <virgil@lethean.io>

Virgil added 1 commit 2026-03-17 13:32:50 +00:00

fix(coderabbit): address review findings

Security Scan / security (pull_request) Failing after 8s

Details

Test / test (pull_request) Failing after 4m46s

Details

36bf16b06e

- auth: prevent legacy .lthn fallback when .hash file exists but is
  unreadable or has unexpected format (security fix in verifyPassword
  and Login)
- chachapoly: wrap raw error returns in Decrypt with coreerr.E()
- trust: reject trailing data in LoadPolicies JSON decoder

Co-Authored-By: Virgil <virgil@lethean.io>

Virgil commented

2026-03-17 13:33:28 +00:00

Author

Member

Verification Failed

Command: go test ./...

ok  	forge.lthn.ai/core/go-crypt/auth	37.723s
?   	forge.lthn.ai/core/go-crypt/cmd/crypt	[no test files]
--- FAIL: TestShortenPackageName (0.00s)
    output_test.go:10: 
        	Error Trace:	/Users/snider/Code/host-uk/core/.core/workspace/go-crypt-1773753716/src/cmd/testcmd/output_test.go:10
        	Error:      	Not equal: 
        	            	expected: "pkg/foo"
        	            	actual  : "foo"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -1 +1 @@
        	            	-pkg/foo
        	            	+foo
        	Test:       	TestShortenPackageName

  [1m[38;2;59;130;246mcmd.test.coverage_by_package[0m
    a-very-very-very-very-very-long-package-name-that-might-cause-issues  [38;2;34;197;94m80.0%[0m
    short                                                                 [38;2;34;197;94m100.0%[0m

    [1m[38;2;59;130;246mcmd.test.label.average[0m                                                [38;2;34;197;94m90.0%[0m
FAIL
FAIL	forge.lthn.ai/core/go-crypt/cmd/testcmd	0.406s
ok  	forge.lthn.ai/core/go-crypt/crypt	2.424s
ok  	forge.lthn.ai/core/go-crypt/crypt/chachapoly	0.654s
ok  	forge.lthn.ai/core/go-crypt/crypt/lthn	1.511s
ok  	forge.lthn.ai/core/go-crypt/crypt/openpgp	3.956s
ok  	forge.lthn.ai/core/go-crypt/crypt/pgp	3.744s
ok  	forge.lthn.ai/core/go-crypt/crypt/rsa	2.478s
ok  	forge.lthn.ai/core/go-crypt/trust	2.565s
FAIL

Exit code: 1

PR will not be auto-merged.

## Verification Failed **Command:** `go test ./...` ``` ok forge.lthn.ai/core/go-crypt/auth 37.723s ? forge.lthn.ai/core/go-crypt/cmd/crypt [no test files] --- FAIL: TestShortenPackageName (0.00s) output_test.go:10: Error Trace: /Users/snider/Code/host-uk/core/.core/workspace/go-crypt-1773753716/src/cmd/testcmd/output_test.go:10 Error: Not equal: expected: "pkg/foo" actual : "foo" Diff: --- Expected +++ Actual @@ -1 +1 @@ -pkg/foo +foo Test: TestShortenPackageName [1m[38;2;59;130;246mcmd.test.coverage_by_package[0m a-very-very-very-very-very-long-package-name-that-might-cause-issues [38;2;34;197;94m80.0%[0m short [38;2;34;197;94m100.0%[0m [1m[38;2;59;130;246mcmd.test.label.average[0m [38;2;34;197;94m90.0%[0m FAIL FAIL forge.lthn.ai/core/go-crypt/cmd/testcmd 0.406s ok forge.lthn.ai/core/go-crypt/crypt 2.424s ok forge.lthn.ai/core/go-crypt/crypt/chachapoly 0.654s ok forge.lthn.ai/core/go-crypt/crypt/lthn 1.511s ok forge.lthn.ai/core/go-crypt/crypt/openpgp 3.956s ok forge.lthn.ai/core/go-crypt/crypt/pgp 3.744s ok forge.lthn.ai/core/go-crypt/crypt/rsa 2.478s ok forge.lthn.ai/core/go-crypt/trust 2.565s FAIL ``` **Exit code:** 1 PR will not be auto-merged.