fix: HTTPS-only URLs, quieter logs, pipe fail-closed, CI lockstep by summeroff · Pull Request #22 · summeroff/qiuckprompts

summeroff · 2026-08-12T20:23:15Z

Summary

Hardening from the v1.0.5 architecture/security review (items 1–5). No merge — leave open for Copilot + human.

HTTPS-only URLs
- IsHttpsUrl on binding url=, default_ai_url, update_url, --ai-url, --update-url, and workflow navigate.
- Updater uses WINHTTP_OPTION_REDIRECT_POLICY_DISALLOW_HTTPS_TO_HTTP.
- Companion prepareAndPaste / prepare reject non-https and origins outside manifest.json host_permissions.
Quieter logs
- Default log_level=info (code + shipped template).
- Editor capture: length at INFO, preview at DEBUG (same as CONTEXT/payload).
CI lockstep
- Tag portable zip copies stamped build/RelWithDebInfo/extension (fallback: repo + stamp_extension_version.cmake).
- Format job installs clang-format-18 and sets CLANG_FORMAT.
Pipe fail-closed
- Do not create the named pipe if SDDL setup fails.
- After connect: GetNamedPipeClientProcessId + image name must be this exe (tray dummy connect or --native-messaging-host).
Docs
- --help and README match shipped hotkeys (J/K/L/I/O/M), AppData config, hidden top-level HWND, https-only URLs.

Existing AppData qiuckprompts.ini is not overwritten. If it still has log_level=debug, change it locally and restart.

Test plan

scripts/build.bat Debug compile of all touched .cpp
--self-test exit 0 (new cases: default Info, IsHttpsUrl accept/reject, --ai-url http rejected / https accepted)
After merge: Reload unpacked companion (background.js origin allowlist)
Existing AppData log_level=debug still wins until edited

Reject non-https binding and update URLs; updater denies HTTPS-to-HTTP redirects. Default log_level=info; editor/clipboard previews stay at DEBUG. Named pipe fails closed if SDDL setup fails and accepts only this exe as a client. Tag zip stamps the companion to PE X.Y.Z; CI pins clang-format 18. --help and README match the shipped product. Co-authored-by: Hermes/grok-4.6/m3rcur1al <hermes-m3rcur1al@local>

Copilot

Pull request overview

Hardens URL handling, extension IPC, logging defaults, release packaging, and user documentation.

Changes:

Enforces HTTPS URLs and extension origin allowlisting.
Reduces sensitive INFO logs and secures named-pipe clients.
Aligns CI packaging, formatting, help text, and documentation.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`src/workflow.cpp`	Validates URLs and quiets capture logs.
`src/util.cpp`	Adds HTTPS URL validation.
`src/updater.cpp`	Prevents insecure feeds and redirects.
`src/main.cpp`	Updates CLI help.
`src/ext_bridge.cpp`	Hardens named-pipe setup and clients.
`src/config.cpp`	Validates configured and CLI URLs.
`src/app.cpp`	Extends self-tests and config guidance.
`scripts/format.sh`	Prefers clang-format 18.
`README.md`	Documents current behavior and paths.
`include/util.hpp`	Declares URL validation API.
`include/config.hpp`	Changes default logging to Info.
`extension/background.js`	Restricts companion navigation origins.
`config/qiuckprompts.ini`	Ships quieter logging defaults.
`.github/workflows/ci.yml`	Pins formatting and stamps packaged extensions.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

summeroff · 2026-08-12T20:35:19Z

 {
    std::wstring logPath;
-    LogLevel logLevel = LogLevel::Debug;
+    LogLevel logLevel = LogLevel::Info;


Fixed in f5d5bc7 — after LoadConfigFile we re-apply --log-level (CLI wins) then Logger::SetLevel so AppData log_level is actually used.

summeroff · 2026-08-12T20:35:21Z

+    const std::wstring s = Trim(url);
+    constexpr wchar_t kPrefix[] = L"https://";


Fixed in f5d5bc7 — IsHttpsUrl now rejects outer whitespace; CLI/INI Trim first and store the trimmed URL.

summeroff · 2026-08-12T20:35:22Z

+    const wchar_t host0 = s[kPrefixLen];
+    if (host0 == L'/' || host0 == L'\\' || host0 == L'?' || host0 == L'#')
+        return false;
+    return true;


Fixed in f5d5bc7 — skip userinfo, require host to start with alnum or [. https://:443/path is rejected; https://[::1]/ still ok.

summeroff · 2026-08-12T20:35:23Z

+    const std::wstring want = FileLeaf(GetExePath());
+    const std::wstring got = FileLeaf(img);
+    return !want.empty() && _wcsicmp(want.c_str(), got.c_str()) == 0;


Fixed in f5d5bc7 — compare GetFullPathName of this exe vs client image path (case-insensitive). Same-PID dummy connect still allowed.

After LoadConfigFile, re-apply --log-level and SetLevel so AppData log_level=debug still wins unless CLI overrides. IsHttpsUrl rejects outer whitespace and empty hosts (https://:443/…). CLI stores the trimmed URL. Pipe clients must match this exe's full path, not just the leaf name. Co-authored-by: Hermes/grok-4.6/m3rcur1al <hermes-m3rcur1al@local>

summeroff · 2026-08-12T20:35:38Z

Addressed Copilot in f5d5bc7 (4/4):

INI log_level now applied via SetLevel after load; --log-level still wins.
IsHttpsUrl rejects outer whitespace; CLI/INI store the trimmed URL.
Empty host (https://:443/…) rejected; IPv6 [::1] still ok.
Pipe client identity is full path, not leaf name.

Self-test rebuilt green. Left open.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/util.cpp:436

The bracket branch only checks the first character, so malformed authorities such as https://[]/ and https://[/ are accepted even though they have no hostname. These values then pass the new config/CLI/workflow guards and fail later during navigation. Validate a non-empty, closed bracketed host (and any following port) before returning true.

    const wchar_t host0 = url[i];
    if (!(iswalnum(host0) || host0 == L'['))
        return false;
    return true;

summeroff requested a balanced review from Copilot August 12, 2026 20:25

Copilot started reviewing on behalf of summeroff August 12, 2026 20:25 View session

Copilot AI reviewed Aug 12, 2026

View reviewed changes

summeroff requested a balanced review from Copilot August 12, 2026 20:36

Copilot started reviewing on behalf of summeroff August 12, 2026 20:36 View session

Copilot AI reviewed Aug 12, 2026

View reviewed changes

summeroff merged commit f72e348 into master Aug 12, 2026
9 checks passed

summeroff deleted the fix/review-hardening-https-logs-ci branch August 12, 2026 20:43

Navigation Menu

Repository navigation

fix: HTTPS-only URLs, quieter logs, pipe fail-closed, CI lockstep - #22

fix: HTTPS-only URLs, quieter logs, pipe fail-closed, CI lockstep#22
summeroff merged 2 commits into
masterfrom
fix/review-hardening-https-logs-ci

summeroff commented Aug 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

summeroff Aug 12, 2026

Uh oh!

summeroff Aug 12, 2026

Uh oh!

summeroff Aug 12, 2026

Uh oh!

summeroff Aug 12, 2026

Uh oh!

summeroff commented Aug 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		const std::wstring s = Trim(url);
		constexpr wchar_t kPrefix[] = L"https://";

Conversation

summeroff commented Aug 12, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

summeroff Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

summeroff Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

summeroff Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

summeroff Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

summeroff commented Aug 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants