Treat the report as what it is, and cut the setup prose #13

2026-08-28T21:44:35-07:00

dejima-agent commented

2026-08-28 21:44:35 -07:00

Summary generated by LLM agent

A security fix and a prose pass, from reviewing the two together.

The report is an untrusted document

Alert bodies are composed here from counts, and that rule held. But the alert exists to say go and read the report, and the report is the devbox's own words: file paths, unit names, whatever ssh had to say. A path is a filename, and a filename may contain an escape sequence.

dejima-guard report cats that to a terminal, on the machine holding the SSH key to the box the report is about. ESC[2K ESC[A erases the line above and writes over it, so a compromised devbox could name a file such that the evidence of it scrolls past as an all-clear. Every byte of that path came from the machine under suspicion. I confirmed the sequences survive sha256sum into the state output unmodified.

Control characters are replaced with ? as the text is collected. Replaced rather than deleted, because a filename containing an escape sequence is itself a finding and one that vanished silently would be the second thing this got wrong. Sanitised on the way in rather than at display, so the baseline and every diff computed against it are clean too. Printable bytes are untouched, so a legitimate non-ASCII path still reads as itself rather than becoming a difference that never goes away.

Prose

The setup sections lost a third of their words without losing a step: a paragraph duplicating step 2 in full, the Alpine rationale that is already a comment in the Dockerfile, trust-host explained at length twice, and a second copy of "sent is not received" that What it does not do already makes.

The rewrite turned up a real defect: the install block never installed dejima-guard-install-key, which the instructions tell you to run. A test now holds the two together.

Tested: 76 passing. The four sanitiser tests were run against the previous version and fail on it.

**Summary generated by LLM agent** A security fix and a prose pass, from reviewing the two together. ## The report is an untrusted document Alert bodies are composed here from counts, and that rule held. But the alert exists to say *go and read the report*, and the report is the devbox's own words: file paths, unit names, whatever ssh had to say. A path is a filename, and a filename may contain an escape sequence. `dejima-guard report` cats that to a terminal, on the machine holding the SSH key to the box the report is about. `ESC[2K ESC[A` erases the line above and writes over it, so a compromised devbox could name a file such that the evidence of it scrolls past as an all-clear. Every byte of that path came from the machine under suspicion. I confirmed the sequences survive `sha256sum` into the state output unmodified. Control characters are replaced with `?` as the text is collected. Replaced rather than deleted, because a filename containing an escape sequence is itself a finding and one that vanished silently would be the second thing this got wrong. Sanitised on the way in rather than at display, so the baseline and every diff computed against it are clean too. Printable bytes are untouched, so a legitimate non-ASCII path still reads as itself rather than becoming a difference that never goes away. ## Prose The setup sections lost a third of their words without losing a step: a paragraph duplicating step 2 in full, the Alpine rationale that is already a comment in the `Dockerfile`, `trust-host` explained at length twice, and a second copy of "sent is not received" that *What it does not do* already makes. The rewrite turned up a real defect: the install block never installed `dejima-guard-install-key`, which the instructions tell you to run. A test now holds the two together. Tested: 76 passing. The four sanitiser tests were run against the previous version and fail on it.

dejima-agent added 1 commit 2026-08-28 21:44:36 -07:00

Treat the report as what it is, and cut the setup prose a21be2e4b4

THE REPORT IS AN UNTRUSTED DOCUMENT. Alert bodies are composed here from counts
and that rule held, but the alert exists to say go and read the report, and the
report is the devbox's own words: file paths, unit names, whatever ssh said. A
path is a filename and a filename may contain an escape sequence.

`dejima-guard report` cats that to a terminal on the machine holding the SSH key
to the box under suspicion. ESC[2K ESC[A erases the line above and writes over
it, so a compromised devbox could name a file such that the evidence of it
scrolls past as an all-clear. Control characters are replaced with "?" as the
text is collected - replaced rather than deleted, since a filename containing an
escape sequence is itself a finding, and sanitised on the way in rather than on
display, so the baseline and every diff against it are clean too. Printable
bytes are untouched, so a legitimate non-ASCII path still reads as itself.

The setup sections lost a third of their words without losing a step: a
paragraph duplicating step 2 in full, the Alpine rationale that is already in
the Dockerfile, trust-host explained twice at length, and a second copy of "sent
is not received" that What it does not do already makes.

The rewrite found the install block never installed dejima-guard-install-key,
which the instructions tell you to run. A test now holds the two together.

branderson approved these changes 2026-08-28 22:05:44 -07:00

branderson merged commit d87e8d5e6d into main

2026-08-28 22:05:49 -07:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-guard#13