Repository navigation
Conversation
Nothing checked a change before it was merged: vet, the Go tests and the rest ran when someone remembered to. A workflow now runs them on every pull request and on main. The helper job runs on macOS, the only system the helper ships for (it builds for Linux as well, not for Windows): go vet, the tests under the race detector, staticcheck and govulncheck. Both linters are clean today, so both block. The extension job syntax-checks every script, parses the manifest and runs the new test. The workflow may read the repository and nothing else, and a newer push cancels the run it supersedes. The parsers that read bytes chosen by someone else get native fuzz targets: the HLS rewriter and the playlist scan (any web server; the DASH rewriter's target comes with its rewrite in the relay security change), the mDNS parser, the Cast frame reader, its message decoder and the check of the auth reply (any machine on the LAN), and the native-messaging reader (the browser). Each asserts only that the parser returns, without panicking, and keeps to the limits it documents. Their seeds run with go test; 20 s of fuzzing each found nothing. The native-messaging target holds every handler slot while it runs, so a well-formed request is answered BUSY and never acted on: a fuzzer must not be able to start a real scan or cast. sw.js gets its first test. node:test runs it in a vm context with a stub chrome object, plays the helper and checks what the popup is told: media reports are dated, the duration is carried forward (and 0 is a value, not a gap), a disconnect clears it, a final IDLE ends the cast, and senders other than our own pages get no answer. No dependencies, so there is still no package.json. .gitignore now covers host/host, the binary a bare `go build` leaves behind. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 of 3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
New files only, plus one line in
.gitignore. No runtime code changes..github/workflows/ci.ymlruns on every pull request and onmain:go vet,go test -race, staticcheck, govulncheck. Both linters are clean today, so both block.node --checkon every script, the manifest parses,node --testonextension/test/.permissions: contents: read; a newer push cancels the run it supersedes.host/fuzz_test.go: native Go fuzz targets for everything that parses bytes someone else chose. Each asserts only that the parser returns, does not panic, and keeps to its documented limits.FuzzRewriteHLS,FuzzScanHLSFuzzParseCastRecordsFuzzDecodeMsg,FuzzCastReadLoopFuzzVerifyAuthReplyFuzzNativeFraming20 s of fuzzing each found no crash and no hang. The seeds run with
go testand add under a second.FuzzNativeFramingholds every handler slot while it runs, so a well-formed request is answered BUSY and never acted on: a fuzzer must not be able to start a real scan or cast.The DASH rewriter's fuzz target is not here: #7 replaces that rewriter and carries its own target, so the two can merge in either order.
extension/test/sw.test.mjs: the service worker's first test,node:testplusnode:vmwith a stubchrome, no dependencies (still nopackage.json). Six cases: media reports are dated; the duration is carried forward;duration: 0is a value, not a gap; a disconnect clears it; a final IDLE ends the cast; senders other than our own pages get no answer. Breakingsw.jsseven different ways made the tests fail each time..gitignore:host/host, the binary a barego buildleaves behind.Testing
go vet,go test -race, staticcheck, govulncheck locally (the last two withGOTOOLCHAIN=go1.27.1, which is whathost/go.modpins and what CI installs)Found along the way
GOOS=linux go buildandgo vetpass.GOOS=windows go buildfails inmain.go(syscall.Setrlimit) andmdns.go(SetsockoptInet4Addrtakes aHandle), so a Windows port needs code changes, not just an installer.🤖 Generated with Claude Code