~bigbes/agents-dev · parade

main · last commit 13 days ago · 7g0stsfu

← Back to the parade

ah-1cx.6 config: validate vikunja.url and web_url as http(s) at load, like the other URL fields Past Stand

status: closed P4 bug milestone:v0.2.0
bd reopen ah-1cx.6
Created byEugene Blikh
Ownerbigbes@gmail.com
Created2026-07-19T23:37:51Z
Started2026-08-04T23:32:44Z
Updated2026-08-04T23:41:52Z
Closed2026-08-04T23:41:52Z
Description
validate() only checks Vikunja.URL for non-emptiness (config.go:587-589) while agentsview/yonote/mem0/ntfy/telegram all get validateHTTPURL; web_url is never checked at all. A malformed board URL loads cleanly and fails one layer later at vikunja.New with different diagnostics. Run validateHTTPURL on Vikunja.URL and the explicit WebURL in validate() for consistent config-time errors. Adapter audit 2026-07-20.

Depends on

  • ah-1cx — Hardening: post-audit bug sweep (2026-07-20) parent-child open

Depended on by

Nothing depends on this issue.

No comments.

Close reason

Fixed in a8f264e (same commit as ah-1cx.3 — the hunks interleave in config.go). validate() checked vikunja.url for non-emptiness only while agentsview/yonote/mem0/ntfy/telegram all ran their base URLs through the existing validateHTTPURL helper, and vikunja.web_url was never checked at all; a malformed board URL loaded cleanly and failed one layer later inside vikunja.New, with different wording and no config-file context. The required-check is now strings.TrimSpace(...)=='' (so a blank url still reports 'vikunja.url is required' rather than a confusing scheme error) and the non-empty path REUSES validateHTTPURL — no second implementation was introduced. web_url is validated in the same branch rather than beside it because resolve DERIVES web_url from url when the key is omitted: checking it unconditionally would make one bad url report itself twice under two names. Ruling url out first guarantees the derived value is valid, so anything reported against vikunja.web_url is an explicit key the operator actually wrote. Cover: TestLoadVikunjaURLValidation — scheme-less url, non-http scheme, host-less url, blank url, explicit bad web_url, accepted explicit web_url, and an assertion that a bad url does NOT also echo as vikunja.web_url.
  • Eugene Blikh added under epic ah-1cx · 2026-07-20T02:37:50Z
  • Eugene Blikh created the issue · 2026-07-20T02:37:50Z
  • Eugene Blikh added label milestone:hardening · 2026-07-20T03:08:20Z
  • Eugene Blikh removed label milestone:hardening · 2026-07-20T03:10:16Z
  • Eugene Blikh added label milestone:v0.1.0 · 2026-07-20T03:11:24Z
  • Eugene Blikh removed label milestone:v0.1.0 · 2026-07-20T03:13:46Z
  • Eugene Blikh added label milestone:v0.2.0 · 2026-07-20T03:13:46Z
  • Eugene Blikh changed status to in_progress · 2026-08-05T02:32:44Z
  • Eugene Blikh closed the issue · 2026-08-05T02:41:51Z
    Fixed in a8f264e (same commit as ah-1cx.3 — the hunks interleave in config.go). validate() checked vikunja.url for non-emptiness only while agentsview/yonote/mem0/ntfy/telegram all ran their base URLs through the existing validateHTTPURL helper, and vikunja.web_url was never checked at all; a malformed board URL loaded cleanly and failed one layer later inside vikunja.New, with different wording and no config-file context. The required-check is now strings.TrimSpace(...)=='' (so a blank url still reports 'vikunja.url is required' rather than a confusing scheme error) and the non-empty path REUSES validateHTTPURL — no second implementation was introduced. web_url is validated in the same branch rather than beside it because resolve DERIVES web_url from url when the key is omitted: checking it unconditionally would make one bad url report itself twice under two names. Ruling url out first guarantees the derived value is valid, so anything reported against vikunja.web_url is an explicit key the operator actually wrote. Cover: TestLoadVikunjaURLValidation — scheme-less url, non-http scheme, host-less url, blank url, explicit bad web_url, accepted explicit web_url, and an assertion that a bad url does NOT also echo as vikunja.web_url.
Stored rows — what this pane was built from, as read
issues 1 row
id ah-1cx.6
content_hash d01a5e8265bcd3209e0b76c2b266cc18e3074a5c3393aa9e0624d33d2e7eca68
title config: validate vikunja.url and web_url as http(s) at load, like the other URL fields
description validate() only checks Vikunja.URL for non-emptiness (config.go:587-589) while agentsview/yonote/mem0/ntfy/telegram all get validateHTTPURL; web_url is never checked at all. A malformed board URL loads cleanly and fails one layer later at vikunja.New with different diagnostics. Run validateHTTPURL on Vikunja.URL and the explicit WebURL in validate() for consistent config-time errors. Adapter audit 2026-07-20.
design
acceptance_criteria
notes
status closed
priority 4
issue_type bug
assignee NULL
estimated_minutes NULL
created_at 2026-07-19T23:37:51Z
created_by Eugene Blikh
owner bigbes@gmail.com
updated_at 2026-08-04T23:41:52Z
closed_at 2026-08-04T23:41:52Z
closed_by_session
external_ref NULL
spec_id
compaction_level 0
compacted_at NULL
compacted_at_commit NULL
original_size NULL
sender
ephemeral 0
wisp_type
pinned 0
is_template 0
mol_type
work_type
source_system
metadata �{}
source_repo
close_reason Fixed in a8f264e (same commit as ah-1cx.3 — the hunks interleave in config.go). validate() checked vikunja.url for non-emptiness only while agentsview/yonote/mem0/ntfy/telegram all ran their base URLs through the existing validateHTTPURL helper, and vikunja.web_url was never checked at all; a malformed board URL loaded cleanly and failed one layer later inside vikunja.New, with different wording and no config-file context. The required-check is now strings.TrimSpace(...)=='' (so a blank url still reports 'vikunja.url is required' rather than a confusing scheme error) and the non-empty path REUSES validateHTTPURL — no second implementation was introduced. web_url is validated in the same branch rather than beside it because resolve DERIVES web_url from url when the key is omitted: checking it unconditionally would make one bad url report itself twice under two names. Ruling url out first guarantees the derived value is valid, so anything reported against vikunja.web_url is an explicit key the operator actually wrote. Cover: TestLoadVikunjaURLValidation — scheme-less url, non-http scheme, host-less url, blank url, explicit bad web_url, accepted explicit web_url, and an assertion that a bad url does NOT also echo as vikunja.web_url.
event_kind
actor
target
payload
await_type
await_id
timeout_ns 0
waiters
hook_bead
role_bead
agent_state
last_activity NULL
role_type
rig
due_at NULL
defer_until NULL
no_history 0
started_at 2026-08-04T23:32:44Z
is_blocked 0
labels 1 row
issue_id ah-1cx.6
label milestone:v0.2.0
dependencies 1 row
id 1415d288-38af-5a39-b087-ed5c38be5c5f
issue_id ah-1cx.6
type parent-child
created_at 2026-07-20T02:37:50Z
created_by Eugene Blikh
metadata �{}
thread_id
depends_on_issue_id ah-1cx
depends_on_wisp_id NULL
depends_on_external NULL
events 8 rows
id 019f7cbe-405a-747c-99eb-bc77ac70e6d2
issue_id ah-1cx.6
event_type created
actor Eugene Blikh
old_value
new_value
comment NULL
created_at 2026-07-20T02:37:50Z
id 019f7cda-2a1e-75ff-9891-444911d1748c
issue_id ah-1cx.6
event_type label_added
actor Eugene Blikh
old_value NULL
new_value NULL
comment Added label: milestone:hardening
created_at 2026-07-20T03:08:20Z
id 019f7cdb-f00e-7860-b1c0-cc84aab5ac65
issue_id ah-1cx.6
event_type label_removed
actor Eugene Blikh
old_value NULL
new_value NULL
comment Removed label: milestone:hardening
created_at 2026-07-20T03:10:16Z
id 019f7cdc-faeb-7989-a784-772c4908bffd
issue_id ah-1cx.6
event_type label_added
actor Eugene Blikh
old_value NULL
new_value NULL
comment Added label: milestone:v0.1.0
created_at 2026-07-20T03:11:24Z
id 019f7cdf-23e1-7572-b938-4c877a2143b0
issue_id ah-1cx.6
event_type label_removed
actor Eugene Blikh
old_value NULL
new_value NULL
comment Removed label: milestone:v0.1.0
created_at 2026-07-20T03:13:46Z
id 019f7cdf-24e8-7514-b552-d70f4743d05a
issue_id ah-1cx.6
event_type label_added
actor Eugene Blikh
old_value NULL
new_value NULL
comment Added label: milestone:v0.2.0
created_at 2026-07-20T03:13:46Z
id 019fcf1f-51ad-7055-83d7-8670e48c7551
issue_id ah-1cx.6
event_type status_changed
actor Eugene Blikh
old_value {"id":"ah-1cx.6","title":"config: validate vikunja.url and web_url as http(s) at load, like the other URL fields","description":"validate() only checks Vikunja.URL for non-emptiness (config.go:587-589) while agentsview/yonote/mem0/ntfy/telegram all get validateHTTPURL; web_url is never checked at all. A malformed board URL loads cleanly and fails one layer later at vikunja.New with different diagnostics. Run validateHTTPURL on Vikunja.URL and the explicit WebURL in validate() for consistent config-time errors. Adapter audit 2026-07-20.","status":"open","priority":4,"issue_type":"bug","owner":"bigbes@gmail.com","created_at":"2026-07-19T23:37:51Z","created_by":"Eugene Blikh","updated_at":"2026-07-19T23:37:51Z","labels":["milestone:v0.2.0"]}
new_value {"status":"in_progress"}
comment NULL
created_at 2026-08-05T02:32:44Z
id 019fcf27-ac17-72ce-87e5-681f3b9a2ae7
issue_id ah-1cx.6
event_type closed
actor Eugene Blikh
old_value
new_value Fixed in a8f264e (same commit as ah-1cx.3 — the hunks interleave in config.go). validate() checked vikunja.url for non-emptiness only while agentsview/yonote/mem0/ntfy/telegram all ran their base URLs through the existing validateHTTPURL helper, and vikunja.web_url was never checked at all; a malformed board URL loaded cleanly and failed one layer later inside vikunja.New, with different wording and no config-file context. The required-check is now strings.TrimSpace(...)=='' (so a blank url still reports 'vikunja.url is required' rather than a confusing scheme error) and the non-empty path REUSES validateHTTPURL — no second implementation was introduced. web_url is validated in the same branch rather than beside it because resolve DERIVES web_url from url when the key is omitted: checking it unconditionally would make one bad url report itself twice under two names. Ruling url out first guarantees the derived value is valid, so anything reported against vikunja.web_url is an explicit key the operator actually wrote. Cover: TestLoadVikunjaURLValidation — scheme-less url, non-http scheme, host-less url, blank url, explicit bad web_url, accepted explicit web_url, and an assertion that a bad url does NOT also echo as vikunja.web_url.
comment NULL
created_at 2026-08-05T02:41:51Z