fix(security): fail closed on hostile clipboard throw values

[seonghobae]

Scope

Test-first repair for #349 on Inkspan's deterministic local SafeClipboard failure-containment boundary only. No transport, persistence, auth, tenancy, credential, model/provider, network, deployment, retention, durable-audit, or clipboard-exfiltration authority is added.

Current authority

• Live protected shipped truth: main@3b38ead2d00f44eb578d0689087b9293b3dabe1e.
• Historical branch-base metadata: e8109ec2a17de8bd6594487aa12c8c8a93cb2c03; do not mistake it for the live protected tip.
• Historical pre-synchronization Draft head: 3460f2d4233177a29607dd9b181ff4fad3d363bf.
• Exact current Draft head: 61936f2d9e26373115fed1dee1ce93387ebcfc12 on fix/clipboard-hostile-throw-349.
• GitHub reports the Draft mechanically mergeable; mergeability is not authorization.

RED → GREEN lineage

• RED 758c36c05f104be0cc6b608acd5c753ea5b9b709: hosted CI 31901402934 reached the real ProseMirror transform after immutable setup/typecheck and failed because a hostile thrown Proxy's prototype trap escaped.
• GREEN ce8223071aa658d70edfde6b70df936eb7e77e77 / 3f963bfe0cb0e96366ad3eb42ed4546c197cfeaf: replace instanceof classification of unknown thrown values with module-owned WeakSet identity branding for genuine ClipboardSanitizationError instances; all unknown values normalize directly to stable payload-redacted boundaries without prototype/property/string coercion.
• e54c7769feecffe62734a7e18bd5a3f440d98358 preserves the remaining unique direct-sanitizer hostile-configuration regression from closed stale fix(reliability): bound rich clipboard resource preflight #164 before that duplicate lane was retired.
• Pre-synchronization head 3460f2d4233177a29607dd9b181ff4fad3d363bf adds a real adapter regression where the host config getter throws a primitive string; Inkspan returns '', emits one stable invalid_html observation, and does not leak the primitive.
• Synchronization merge 61936f2d9e26373115fed1dee1ce93387ebcfc12 incorporates protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e without changing the intended SafeClipboard ownership boundary.

Review contradiction resolved

The prior Cursor CHANGES_REQUESTED review asserted that WeakSet.prototype.has(primitive) throws. That premise conflicts with the ECMAScript weak-collection contract: when the candidate cannot be held weakly, WeakSet.prototype.has returns false. The branch also guards primitives before the set lookup and proves the primitive-string path through the real adapter regression. The factually invalid review is dismissed, explicitly not converted into an approval; its inline thread is resolved/outdated.

This does not relax the product contract or governance. Unknown thrown values still must not be stringified, enumerated, coerced, or prototype-inspected merely to classify them.

Scope ownership

Stale #164 mixed resource preflight, release-control history, and hostile-throw containment. Current ownership is split intentionally:

• fix(security): fail closed on hostile clipboard throw values #351 owns hostile thrown-value containment (fix(security): fail closed on hostile clipboard sanitizer throw values #349);
• fix(reliability): preflight clipboard size and traversal budget #359 owns SafeClipboard resource preflight (fix(reliability): reject obviously oversized rich clipboard HTML before UTF-8 encoding #163/fix(reliability): bound rich-clipboard traversal queue before allocation #327);
• fix(reliability): harden public Markdown and local serialization boundaries #176 remains the canonical SafeLink/Markdown writer;
• protected main owns current release-control files.

Do not create a competing writer or reintroduce unrelated SafeLink/release-control changes here.

Exact-current-head evidence

For exact head 61936f2d9e26373115fed1dee1ce93387ebcfc12 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e, at the latest fresh refetch:

• CI 32438908748: completed / success;
• Security Scan 32438908692: completed / success;
• SAST Semgrep 32438908699: completed / success;
• effective formal CHANGES_REQUESTED: 0 after dismissal of the factually invalid predecessor review;
• unresolved inline review threads: 0;
• qualifying approving reviews: 0.

All observed repository-owned exact-head workflows are terminal success. The older successful 31960596587 / 31960596547 / 31960596548 generations are predecessor evidence for 3460f2d4233177a29607dd9b181ff4fad3d363bf and do not transfer. Repository-local technical success does not substitute for separately applicable central workflows, fresh live-base reconciliation, or qualifying independent approval. Absent approval remains non-passing.

Integration boundary

Keep Draft/unmerged while #118 owns exact protected v0.6.0 publication/provenance/digest operational acceptance. Before any later Ready/merge transition, refetch the unchanged exact head, live protected tip, ancestry/mergeability, formal reviews/threads, live governance and every applicable repository/central workflow. Do not force-push, destructively rebase, self-approve, transfer predecessor evidence, weaken gates, or fabricate release identity.

Refs #349

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Draft #351 correctly moves throw-value recognition off instanceof prototype inspection and keeps the change on current main@e8109ec. Do not merge 1518a5684c37dbe02c23e758823d501629d50bb5 until the brand helper is primitive-safe.

CLIPBOARD_SANITIZATION_ERRORS.has(value as object) throws for null, strings, and numbers. The new catch sites therefore fail open on primitive throws that the previous instanceof path contained.

Keep this PR scoped to #349. Resource preflight (#163, #327) is #359. Keep Draft while #118 owns the exact v0.6.0 publication identity.

  

_{Sent by Cursor Automation: Fix Issues}

Dismissed as factually invalid, not as approval. ECMAScript WeakSet.prototype.has returns false when CanBeHeldWeakly(value) is false; it does not throw for null/string/number inputs. Exact head 3460f2d also carries a real adapter regression for a primitive string throw and repository CI/Security/SAST are terminal-success. #351 remains Draft, unmerged, and still requires fresh live-base/central-workflow/governance evidence plus qualifying independent approval before any lifecycle transition.

[seonghobae]

Addressed the outstanding primitive-safety review in commit 9529b81: isClipboardSanitizationError now guards object/function values before consulting the WeakSet, with a direct string/number/null regression. Exact-head verification passed: SafeClipboard extension suite 12 files / 44 tests, targeted SafeClipboard.ts coverage 100% statements/branches/functions/lines, and tsc --noEmit. The PR remains Draft and unmerged pending fresh review and protected gates.

[seonghobae]

@opencode-agent review exact current head 9529b81e4091a88dac3b2e22f54faf5b213accf7 against base e8109ec2a17de8bd6594487aa12c8c8a93cb2c03. Re-check the primitive-safe isClipboardSanitizationError boundary and the 44-test/100%-coverage evidence after the fix. Submit a formal current-head verdict only after required Checks settle; do not transfer the dismissed predecessor review or bypass Draft/protected gates.