Repository navigation
finding(service-automation): engine.ts's five name-shaped splices — author-metadata / caller-supplied identifiers interpolated into log messages with no newline constraint #6654
Description
Activity
Triage:
finding+domain:services.- Grade: observation class by the card's own harm model — the newline must be author/caller-supplied, unlike the closed driver/SDK-text class; finding(service-automation): engine.ts has 13 MORE log messages splicing uncontrolled thrown text — #6299's "last batch" premise was wrong, and persistSuspendedRun sits 25 lines from one it fixed #6499 already recorded these as "reported, not fixed" and finding(service-automation): engine.ts's trigger-fired-run callback still splices the AutomationResult.error envelope into a logger.error message — the one same-class site #6499's sweep left, on the fired-run path #6587 deliberately excluded them. No user hit today. The A/B/C disposition belongs to a findings-triage round (option C "accept and record" is a live outcome, so this is not auto-queueable).
- Routing: the five sites land in the service-automation flow engine (
packages/services/service-automation—engine.ts), ⇒domain:services. If option B (schema-level control-character constraint) were ruled, that half would transfer todomain:specas an acceptance change — do not route-flip preemptively. - Dedup: split out of finding(service-automation): engine.ts's trigger-fired-run callback still splices the AutomationResult.error envelope into a logger.error message — the one same-class site #6499's sweep left, on the fired-run path #6587 at PR fix(service-automation): trigger-fired-run failure log keeps the AutomationResult.error envelope in meta, not the message (#6587) #6623 acceptance exactly as committed there; family chain finding(service-automation): engine.ts 还剩三处同形的 warn message 拼接 —— forgetSuspendedRun / cancelRun / listSuspendedRunsDurable,是 #5912+#6230 之后该文件的最后一批 #6299 → finding(service-automation): engine.ts has 13 MORE log messages splicing uncontrolled thrown text — #6299's "last batch" premise was wrong, and persistSuspendedRun sits 25 lines from one it fixed #6499/fix(service-automation): engine.ts residual log-splice sweep — 13 foreign-text seams + the self-authored 14th, per-site #4632 verdicts (#6499) #6568 → finding(service-automation): engine.ts's trigger-fired-run callback still splices the AutomationResult.error envelope into a logger.error message — the one same-class site #6499's sweep left, on the fired-run path #6587/fix(service-automation): trigger-fired-run failure log keeps the AutomationResult.error envelope in meta, not the message (#6587) #6623 all closed or in flight, none covers these five sites.
本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
CLAIM — services-lane PM session
session_01USNUyHEr7uaU6MoEWXitei, branchclaude/issue-6654-name-splice-sweep.Dispatching under the findings-triage promotion (2026-08-08 10:22Z, maintainer-directed sweep): option A — mechanical five-site sweep onto the family idiom (single-line message, identifier to structured meta). Option B (spec-level constraint) stays off the table per the promotion note; no site changes level. The triage re-verification's corrected locations govern (one site is in
screen-input-contract.ts, not engine.ts; body line numbers stale — locate by content).Serialization note: #6667 (same file, engine boundary) is deliberately held until this card's PR merges — engine.ts overlap rule.
Generated by Claude Code
Split out of #6587 at its PR (#6623) acceptance, exactly as that card's promotion comment committed — so closing #6587 (the envelope site) does not bury this tail. Recorded unassigned for triage by the services-lane PM (
session_01USNUyHEr7uaU6MoEWXitei). Original measurement: PR #6568's residual sweep (the #6499 dev's full-file audit).The five sites (post-#6568 positions;⚠️ they drift — locate by content)
None of these splices thrown text or an envelope — that class is now fully closed in this file (#6299 → #6499/#6568 → #6587/#6623). These interpolate names/identifiers that originate outside the engine's control and are not schema-constrained to reject newlines:
:2719— record id from user data, in the re-entrancy guard's message;:3365— engine-internal variable names from the caller's resume signal;:3598— screen-input refusal summary, embeds user-submitted keys viaUnknown screen field "…";:4209— node type names from flow metadata;:4899— computed branch label (potentially record-derived) + edge labels.Why this is a separate, weaker class
The family's harm model (one
ObjectLogger.write()head per call; newlines shred the record; boot-quiet stdout drops headless continuations) applies only if one of these identifiers actually carries a newline. Unlike driver/SDK error text — where multi-line is a documented convention (Postgresdetail:/hint:) — a newline in a record id, field key, or node type name requires an author or caller to put one there. Possible (none is schema-constrained against it), but a step less likely than the closed class. That is why #6499 named them "reported, not fixed" and #6587 explicitly excluded them.Options for triage (not self-decided)
The PM records no recommendation; the per-site #4632 level question does not arise here (no site changes level under A).
Related
#6587 / PR #6623 (the envelope site, whose acceptance splits this out), #6499 / PR #6568 (the measurement), #6299 / PR #6498, #4632, #5912.