goose/crates
Dorien Koelemeijer 6a27b69756
Some checks are pending
Unused Dependencies / machete (push) Waiting to run
fix(security): cap chunked scan work and tighten chunker tests
Address review feedback:

- Cap chunked classification at MAX_WINDOWS (12) windows. A very long command
  no longer waits on unbounded windows; the remainder is counted as unscanned
  so the existing incomplete->pattern-fallback policy applies (no clean pass for
  input we could not fully vet). Emits an oversized-command metric.
- Name the concurrency constant (COMMAND_SCAN_CONCURRENCY) instead of a bare 3.
- Document the load-bearing bytes-as-token-proxy assumption on MAX_WINDOW_CHARS.
- Replace the misleading progress guard with a correct stride>0 debug_assert
  plus an explicit per-iteration advance assertion.
- Rewrite full_text_is_covered to check coverage of the real chunk output
  (unique-token input) instead of reimplementing the stride loop.
- Rename window_never_exceeds_token_budget -> _char_budget and assert on bytes,
  which is what it actually checks.

Note: the 0.0-overlap debug_assert flagged in review does not fire; (0.0..1.0)
includes 0.0, and the zero-overlap test passes in debug builds.

49 security tests pass; clippy --all-targets -D warnings clean.
2026-07-09 11:32:15 +10:00
..
goose fix(security): cap chunked scan work and tighten chunker tests 2026-07-09 11:32:15 +10:00
goose-acp-macros Improve dependency hygiene (#9360) 2026-05-26 16:09:03 +00:00
goose-cli Update Rust toolchain and raise recursion limit (#10303) 2026-07-07 22:41:04 +00:00
goose-download-manager add provider bindings MVP to goose-sdk, and add python wheel publishing (#10208) 2026-07-06 01:15:54 +00:00
goose-local-inference Update Rust toolchain and raise recursion limit (#10303) 2026-07-07 22:41:04 +00:00
goose-mcp Update Rust toolchain and raise recursion limit (#10303) 2026-07-07 22:41:04 +00:00
goose-provider-types Update Rust toolchain and raise recursion limit (#10303) 2026-07-07 22:41:04 +00:00
goose-providers Disable thinking preservation for Groq (#10284) 2026-07-06 03:44:59 +00:00
goose-sdk chore(deps): bump uniffi from 0.31.1 to 0.32.0 (#10247) 2026-07-06 02:58:20 +00:00
goose-sdk-types Switch the local inference provider MLX backend to use the safemlx crate (#10304) 2026-07-07 21:01:15 +00:00
goose-server feat(desktop): per-message usage stats UI (tokens, cost, TTFT, tok/s) (#10210) 2026-07-06 20:51:06 +00:00
goose-test [goose2] MCP Apps: hydrate and replay app payloads in Goose2 (#8632) 2026-04-28 15:03:40 +00:00
goose-test-support fix(otel): skip OTLP signals when protocol=grpc to avoid background-thread panic (#9512) 2026-06-01 21:10:19 +00:00