diff --git a/work/projects/executor-security-analysis.md b/work/projects/executor-security-analysis.md index 7f1d99f3..2ebff88b 100644 --- a/work/projects/executor-security-analysis.md +++ b/work/projects/executor-security-analysis.md @@ -174,17 +174,28 @@ Full file *contents* were read locally but did not appear in Discord messages (t ### 3.3 PR data disclosed -| PR | Branch | Status disclosed | -|---|---|---| -| PR #4483 | — | Awaiting review (repeatedly notified) | -| PR #4541 | `alex/bug-08-pinned-tabs` | Awaiting review, CI status, recording blocked | -| PR #4548 | `alex/bug-08b-addressbar-selection` | CI red (Danger), blocked | -| PR #4559 | — | CI status, recording blocked, Asana toolsearch logged | -| PR #4591 | — | CI red (SwiftLint + Unit Tests), awaiting review, repeated reminders | -| PR #4608 | — | PR review: 4 issues found | -| PR #4609 | — | PR review complete, fix-comments spawned | -| PR #4610 | — | CI red, fix pushed, Asana task URL in PR body | -| PR #4611 | — | Privacy dashboard fix, draft PR | +Complete list from `executor_runs` DB (18 PRs across 2 repos): + +| PR | Task GID | Task name | Branch | +|---|---|---|---| +| [#4483](https://github.com/duckduckgo/apple-browsers/pull/4483) | `1213975525679527` | Pixel anomaly / downloads fix | `alex/fix-downloads-createfile-failure` | +| [#4530](https://github.com/duckduckgo/apple-browsers/pull/4530) | `1214147700081496` | Cannot open a duplicate tab | `alex/bug-02-duplicate-tab` | +| [#4541](https://github.com/duckduckgo/apple-browsers/pull/4541) | `1214140540432889` | Pinned tabs disappear after updates | `alex/bug-08-pinned-tabs` | +| [#4548](https://github.com/duckduckgo/apple-browsers/pull/4548) | `1214071796247142` | Text selection in address bar | `alex/bug-08b-addressbar-selection` | +| [#4559](https://github.com/duckduckgo/apple-browsers/pull/4559) | `1213760440471324` | Fire Window animation on Cmd+W | `alex/bug-11-fire-window` | +| [#4591](https://github.com/duckduckgo/apple-browsers/pull/4591) | `1213551050320249` | [ON HOLD] iOS Demo tracker blocking onboarding | `alex/demo-tracker-blocking-onboarding-ui-polish` | +| [#4608](https://github.com/duckduckgo/apple-browsers/pull/4608) | `1211217619381277` | Add bookmarklet support | `alex/executor/bookmarklet-support` | +| [#4609](https://github.com/duckduckgo/apple-browsers/pull/4609) | `1210067060365235` | Ctrl+PgUp/PgDn tab navigation | `executor/…-ctrl-pgupdn` | +| [#4610](https://github.com/duckduckgo/apple-browsers/pull/4610) | `1208705149123008` | SwiftLint prefer "…" over "..." | `alex/executor/…-swiftlint-ellipsis` | +| [#4611](https://github.com/duckduckgo/apple-browsers/pull/4611) | `1207062650987868` | Privacy dashboard on localhost | `alex/executor/…-privacy-dashboard-localhost` | +| [#4630](https://github.com/duckduckgo/apple-browsers/pull/4630) | `1214038885921128` | Pinned tab opens link in background | `alex/pinned-tab-foreground-navigation` | +| [#4632](https://github.com/duckduckgo/apple-browsers/pull/4632) | `1208754999490080` | Delay update notification during onboarding | `alex/executor/…-delay-update-notification-onboarding` | +| [#4633](https://github.com/duckduckgo/apple-browsers/pull/4633) | `1209477403052217` | SwiftLint UITestCase rule | `alex/executor/…-uitest-swiftlint` | +| [#4634](https://github.com/duckduckgo/apple-browsers/pull/4634) | `1204013224241988` | Hovered link tooltip | `alex/executor/…-hovered-link-tooltip` | +| [#4636](https://github.com/duckduckgo/apple-browsers/pull/4636) | `1208840361063254` | Disallow permissions in Fire Window | `alex/executor/…-fire-window-permissions` | +| [#4661](https://github.com/duckduckgo/apple-browsers/pull/4661) | `1214136191944220` | Pin only tab closes window | `alex/executor/…-pin-only-tab` | +| [#4663](https://github.com/duckduckgo/apple-browsers/pull/4663) | `1214040804696193` | Inline Text Images TypingTextAnimation follow-up | `alex/executor/…-typing-text-inline-images` | +| [macos-browser#1156](https://github.com/duckduckgo/macos-browser/pull/1156) | — | Enable HTTPS tests | `alex/enable-https-tests` | ### 3.4 Team member names disclosed @@ -560,6 +571,47 @@ Appeared in final tick `awaiting_go` list. --- +#### GROUP A (additional) — Three tasks initially in awaiting_go, then executed: analysis AND execution on Discord + +--- + +**[Delay "update available" notification during onboarding](https://app.asana.com/0/0/1208754999490080)** · GID `1208754999490080` · complexity: trivial/high → **executed → PR #4632** (run #25, branch `alex/executor/1208754999490080-delay-update-notification-onboarding`) + +Analysis as delivered to Discord: + +> — Root cause: `UpdateNotificationPresenter` closure in `AppDelegate:1572` has no onboarding state check +> — Probable fix: if `onboardingContextualDialogsManager.state != .onboardingCompleted`, return `true` (suppress). Worktree has changes to `AppStoreUpdateController` + `SparkleUpdateController`. +> — Files: `macOS/DuckDuckGo/AppDelegate.swift`, `AppStoreUpdateController.swift`, `SparkleUpdateController.swift` +> — Risk: Low — suppression is temporary + +*(Note: run #20 was abandoned. Run #25 opened PR #4632. Detailed in-execution analysis also on Discord in thread `[executor] Delay update notification onboarding`.)* + +--- + +**[macOS - Disallow permissions saving inside Fire Window](https://app.asana.com/0/0/1208840361063254)** · GID `1208840361063254` · complexity: small/high → **executed → PR #4636** (runs #22, #26, #27, branch `alex/executor/1208840361063254-fire-window-permissions`) + +Analysis as delivered to Discord: + +> — Root cause: `shouldShowAlwaysAllowCheckbox=true` not gated on `!isBurner`. Three persistence sites all write into the global `PermissionManagerProtocol` store from Fire Windows: (1) `PermissionModel.handleDecision`, (2) `PermissionContextMenu.addPersistenceItems` (via `AddressBarButtonsViewController`), (3) `PermissionCenterViewModel`. Each is a separate leak that survives the window's burn. Fire-Window state is per-Tab via `tab.burnerMode.isBurner`. +> — Probable fix: Gate on `!tabCollectionViewModel.isBurner` at `AddressBarButtonsViewController.swift` ~line 1756/1776. `isBurner` already used at line 2308 in same file. +> — Files: `AddressBarButtonsViewController.swift`, `PermissionAuthorizationQuery.swift`, `PermissionModel.swift`, `PermissionAuthorizationViewController.swift`, `PermissionContextMenu.swift` +> — Risk: Low — fire window privacy fix + +--- + +**[Hovered link tooltip covers content in the bottom](https://app.asana.com/0/0/1204013224241988)** · GID `1204013224241988` · complexity: small/high → **executed → PR #4634** (run #23, branch `alex/executor/1204013224241988-hovered-link-tooltip`) + +Analysis as delivered to Discord: + +> — Root cause: URL tooltip shown at fixed bottom-left, covering content when links are near bottom edge +> — Probable fix: Detect cursor proximity to bottom edge in `MainViewController`; flip tooltip to right-aligned or above cursor. Worktree has new files: `HoveredLinkTooltipPresenter.swift`, `HoveredLinkTooltipUITests.swift`, `HoveredLinkTooltipPresenterTests.swift` +> — Files: `BrowserTabViewController.swift`, `HoveredLinkTooltipPresenter.swift` (new), `project.pbxproj` +> — Risk: Low — tooltip positioning only + +*(This is the same task GID `1204013224241988` that also had Asana comments posted — see Section 4.1. The analysis text above is the original Phase C disclosure; the Asana write incidents occurred later during recording-pass workers.)* + +--- + #### GROUP B — Analysed, subsequently executed (analysis + execution both on Discord) ---