Repository navigation
hardening: 3 latent Hypatia findings (unsafe SAFETY comments, setup-deno SHA-pin, secret presence-gate) #655
Description
Context
Surfaced by the Hypatia security-scan comment on PR #651 (a docs-only PR). Per .claude/CLAUDE.md, that comment reports findings across the whole repo and is treated as noise unless a finding is a delta in the PR's changed files — none of these are; they are pre-existing and outside #651's changeset (NAVIGATION.adoc, tutorial/lesson-01-hello.adoc, STATE.a2ml). Filing here so the genuine ones are tracked rather than lost in the recurring scan output. The gating Hypatia check-run is separate and unaffected.
Items
-
unsafeblocks missingSAFETY:comments (CWE-676):runtime/src/panic.rs(2),runtime/src/alloc.rs(1),runtime/src/ffi.rs(3). Add a// SAFETY:justification to each. -
denoland/setup-deno@v2unpinned in.github/workflows/publish-jsr.yml— pin to a full commit SHA, per the repo's "pin everyuses:to a SHA" rule (also avoids the tag-pinned-refstartup_failureclass). -
secret_action_without_presence_gate(high) in.github/workflows/instant-sync.yml— gate thepeter-evans/repository-dispatchstep on presence of its secret.
Explicitly NOT in scope (documented exemptions / accepted)
packages/affinescript-cli/mod.jsjs_exec_sync— approved Runtime Exemption (distribution-shimnode:child_process); see CLAUDE.md.packages/affine-vscode/mod.js,affinescript-vite/src/affine-plugin-improved.jsjs_exec_sync— JS carve-outs / tooling shims.expect_in_hot_pathinaffinescriptiser/src/codegen/{wasm_gen,affine_gen}.rs—expect()with messages in codegen is acceptable; lower priority, can revisit separately.
Follow-up
The scan reported 2 "critical" findings not enumerated in the comment's truncated JSON. Confirming/triaging those needs the full Hypatia finding set — separate task; can be pulled on request.
Activity
hyperpolymath commentedon Jun 21, 2026
The 2 "critical" findings — identified and triaged (no action needed)
Followed up on the unenumerated criticals noted above. Hypatia's comment/artifact/log never list them (only an aggregate
critical=2+ a 10-item sample that excluded both), so I identified them deductively against Hypatia's rule source:Both are
code_safetyrule:unwrap_dangerous_default(~r/\.unwrap_or\(0\)/, CWE-754,severity: :critical):tools/affinescript-lsp/src/main.rs:155tools/affinescript-lsp/src/handlers.rs:575Conclusive: exactly two
.unwrap_or(0)exist repo-wide (=critical=2); every other critical pattern checked returns zero (transmute,Obj.magic/Obj.repr, CoqAdmitted/admit, JSeval(, hardcoded-secret);tools/is in-scope; and neither site is in.hypatia-ignore(which only coverstools/res-to-affine/**.resfixtures) and there is no.hypatia-baseline.json. So they necessarily produce the 2 criticals and nothing else does.Disposition: false positives — no AffineScript change.
.unwrap_or(0)is the panic-free, idiomatic-safe form:handlers.rs:575—0is the correct start-of-line word-boundary default.main.rs:155— defaultsversionto0, then explicitly checksif version < 1 || version > 2and falls back gracefully; the exceptional case is handled, so CWE-754 doesn't apply.The rule itself is miscalibrated (it rates the panic-free form
critical/"DoS via panic" while rating.unwrap()onlyhigh), and the reporting gap (criticals counted but never surfaced) is the reason this needed manual reconstruction. Both are filed against Hypatia: hyperpolymath/hypatia#521.This resolves the "2 critical (follow-up)" item; the three checklist items above remain the only actionable hardening work here.
Generated by Claude Code
fix(code_safety): demote unwrap_or(0) off critical severity (false po…
policy: Bun is tier 1, Deno is being removed — correct local CLAUDE.md
fix(cli): restore a publishable manifest and a real bin entry point (#…
Fix remaining parser, face, module, and CI issues