git_admin/obsidian-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

2026-05-12 executor security analysis — complete sweep: all 26 GIDs, 18 PRs verified from DB, 3 missing tasks added with full analysis text, PR table sourced from executor_runs

Browse Source
This commit is contained in:
Alexey Martemyanov
2026-05-12 12:28:59 +06:00
parent a20a583595
commit 6e66647547
1 changed files with 63 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
work/projects/executor-security-analysis.md
+63 -11
View File
@@ -174,17 +174,28 @@ Full file *contents* were read locally but did not appear in Discord messages (t
### 3.3 PR data disclosed
| PR | Branch | Status disclosed |
|---|---|---|
| PR #4483 | — | Awaiting review (repeatedly notified) |
| PR #4541 | `alex/bug-08-pinned-tabs` | Awaiting review, CI status, recording blocked |
| PR #4548 | `alex/bug-08b-addressbar-selection` | CI red (Danger), blocked |
| PR #4559 | — | CI status, recording blocked, Asana toolsearch logged |
| PR #4591 | — | CI red (SwiftLint + Unit Tests), awaiting review, repeated reminders |
| PR #4608 | — | PR review: 4 issues found |
| PR #4609 | — | PR review complete, fix-comments spawned |
| PR #4610 | — | CI red, fix pushed, Asana task URL in PR body |
| PR #4611 | — | Privacy dashboard fix, draft PR |
Complete list from `executor_runs` DB (18 PRs across 2 repos):
| PR | Task GID | Task name | Branch |
|---|---|---|---|
| [#4483](https://github.com/duckduckgo/apple-browsers/pull/4483) | `1213975525679527` | Pixel anomaly / downloads fix | `alex/fix-downloads-createfile-failure` |
| [#4530](https://github.com/duckduckgo/apple-browsers/pull/4530) | `1214147700081496` | Cannot open a duplicate tab | `alex/bug-02-duplicate-tab` |
| [#4541](https://github.com/duckduckgo/apple-browsers/pull/4541) | `1214140540432889` | Pinned tabs disappear after updates | `alex/bug-08-pinned-tabs` |
| [#4548](https://github.com/duckduckgo/apple-browsers/pull/4548) | `1214071796247142` | Text selection in address bar | `alex/bug-08b-addressbar-selection` |
| [#4559](https://github.com/duckduckgo/apple-browsers/pull/4559) | `1213760440471324` | Fire Window animation on Cmd+W | `alex/bug-11-fire-window` |
| [#4591](https://github.com/duckduckgo/apple-browsers/pull/4591) | `1213551050320249` | [ON HOLD] iOS Demo tracker blocking onboarding | `alex/demo-tracker-blocking-onboarding-ui-polish` |
| [#4608](https://github.com/duckduckgo/apple-browsers/pull/4608) | `1211217619381277` | Add bookmarklet support | `alex/executor/bookmarklet-support` |
| [#4609](https://github.com/duckduckgo/apple-browsers/pull/4609) | `1210067060365235` | Ctrl+PgUp/PgDn tab navigation | `executor/…-ctrl-pgupdn` |
| [#4610](https://github.com/duckduckgo/apple-browsers/pull/4610) | `1208705149123008` | SwiftLint prefer "…" over "..." | `alex/executor/…-swiftlint-ellipsis` |
| [#4611](https://github.com/duckduckgo/apple-browsers/pull/4611) | `1207062650987868` | Privacy dashboard on localhost | `alex/executor/…-privacy-dashboard-localhost` |
| [#4630](https://github.com/duckduckgo/apple-browsers/pull/4630) | `1214038885921128` | Pinned tab opens link in background | `alex/pinned-tab-foreground-navigation` |
| [#4632](https://github.com/duckduckgo/apple-browsers/pull/4632) | `1208754999490080` | Delay update notification during onboarding | `alex/executor/…-delay-update-notification-onboarding` |
| [#4633](https://github.com/duckduckgo/apple-browsers/pull/4633) | `1209477403052217` | SwiftLint UITestCase rule | `alex/executor/…-uitest-swiftlint` |
| [#4634](https://github.com/duckduckgo/apple-browsers/pull/4634) | `1204013224241988` | Hovered link tooltip | `alex/executor/…-hovered-link-tooltip` |
| [#4636](https://github.com/duckduckgo/apple-browsers/pull/4636) | `1208840361063254` | Disallow permissions in Fire Window | `alex/executor/…-fire-window-permissions` |
| [#4661](https://github.com/duckduckgo/apple-browsers/pull/4661) | `1214136191944220` | Pin only tab closes window | `alex/executor/…-pin-only-tab` |
| [#4663](https://github.com/duckduckgo/apple-browsers/pull/4663) | `1214040804696193` | Inline Text Images TypingTextAnimation follow-up | `alex/executor/…-typing-text-inline-images` |
| [macos-browser#1156](https://github.com/duckduckgo/macos-browser/pull/1156) | — | Enable HTTPS tests | `alex/enable-https-tests` |
### 3.4 Team member names disclosed
@@ -560,6 +571,47 @@ Appeared in final tick `awaiting_go` list.
---
#### GROUP A (additional) — Three tasks initially in awaiting_go, then executed: analysis AND execution on Discord
---
**[Delay "update available" notification during onboarding](https://app.asana.com/0/0/1208754999490080)** · GID `1208754999490080` · complexity: trivial/high → **executed → PR #4632** (run #25, branch `alex/executor/1208754999490080-delay-update-notification-onboarding`)
Analysis as delivered to Discord:
> — Root cause: `UpdateNotificationPresenter` closure in `AppDelegate:1572` has no onboarding state check
> — Probable fix: if `onboardingContextualDialogsManager.state != .onboardingCompleted`, return `true` (suppress). Worktree has changes to `AppStoreUpdateController` + `SparkleUpdateController`.
> — Files: `macOS/DuckDuckGo/AppDelegate.swift`, `AppStoreUpdateController.swift`, `SparkleUpdateController.swift`
> — Risk: Low — suppression is temporary
*(Note: run #20 was abandoned. Run #25 opened PR #4632. Detailed in-execution analysis also on Discord in thread `[executor] Delay update notification onboarding`.)*
---
**[macOS - Disallow permissions saving inside Fire Window](https://app.asana.com/0/0/1208840361063254)** · GID `1208840361063254` · complexity: small/high → **executed → PR #4636** (runs #22, #26, #27, branch `alex/executor/1208840361063254-fire-window-permissions`)
Analysis as delivered to Discord:
> — Root cause: `shouldShowAlwaysAllowCheckbox=true` not gated on `!isBurner`. Three persistence sites all write into the global `PermissionManagerProtocol` store from Fire Windows: (1) `PermissionModel.handleDecision`, (2) `PermissionContextMenu.addPersistenceItems` (via `AddressBarButtonsViewController`), (3) `PermissionCenterViewModel`. Each is a separate leak that survives the window's burn. Fire-Window state is per-Tab via `tab.burnerMode.isBurner`.
> — Probable fix: Gate on `!tabCollectionViewModel.isBurner` at `AddressBarButtonsViewController.swift` ~line 1756/1776. `isBurner` already used at line 2308 in same file.
> — Files: `AddressBarButtonsViewController.swift`, `PermissionAuthorizationQuery.swift`, `PermissionModel.swift`, `PermissionAuthorizationViewController.swift`, `PermissionContextMenu.swift`
> — Risk: Low — fire window privacy fix
---
**[Hovered link tooltip covers content in the bottom](https://app.asana.com/0/0/1204013224241988)** · GID `1204013224241988` · complexity: small/high → **executed → PR #4634** (run #23, branch `alex/executor/1204013224241988-hovered-link-tooltip`)
Analysis as delivered to Discord:
> — Root cause: URL tooltip shown at fixed bottom-left, covering content when links are near bottom edge
> — Probable fix: Detect cursor proximity to bottom edge in `MainViewController`; flip tooltip to right-aligned or above cursor. Worktree has new files: `HoveredLinkTooltipPresenter.swift`, `HoveredLinkTooltipUITests.swift`, `HoveredLinkTooltipPresenterTests.swift`
> — Files: `BrowserTabViewController.swift`, `HoveredLinkTooltipPresenter.swift` (new), `project.pbxproj`
> — Risk: Low — tooltip positioning only
*(This is the same task GID `1204013224241988` that also had Asana comments posted — see Section 4.1. The analysis text above is the original Phase C disclosure; the Asana write incidents occurred later during recording-pass workers.)*
---
#### GROUP B — Analysed, subsequently executed (analysis + execution both on Discord)
---