mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-10 20:17:02 +01:00
Krzysztof kuhy Rudnicki
0f824c441e
Two halves of the same ask: the message database is private and must stay that way. The database was already gitignored, and the event table is pinned by a test that asserts its exact column set so no message body can be quietly added. What was missing was any defence against a binary reaching this *public* repo at all -- and the proof it was missing was sitting in the tree: three `bottles/**/indexeddb.sqlite` files, committed in "register the bot as its own Signal account". Their contents turned out to be harmless (one row, 120 bytes, a userPreferences store from developer.android.com), but the path into history was real. So the shared gate from ~/utils is wired in, the three files are untracked, and .gitignore now blocks *.sqlite3 along with its -wal and -shm companions rather than only the one filename. The second half is the attachment envelope, captured from the live API rather than assumed -- which is what 0.0.3 taught. A caption-less PNG posted in the real group confirmed `attachments[].contentType`, and settled something that was not guessable: a photo with no caption sends `message: null`. That is exactly the frame `should_count` used to value at zero. Verified end to end on production data, not a fixture: the frame at 19:31:16 was recorded as media_kind=image, media_count=1, char_len=0, filed under 2026-08-30 hour 19. The doc also records the fields nothing reads yet, and one open question left deliberately open: `caption` is a field on the attachment and was null here, so whether a captioned photo puts its text in `message` or in `attachments[].caption` has not been observed. If it is the latter, char_len is recording 0 for those. DEBUG stays on until a `caption: str` settles it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015d48t4qsQLBJnDwDeo2Nom
27 lines
775 B
Bash
Executable File
27 lines
775 B
Bash
Executable File
#!/bin/bash
|
|
|
|
# ============================================================================
|
|
# Thin delegate to the shared gate in ~/utils.
|
|
#
|
|
# Copying the logic here is what lets one repo's idea of the rule drift from
|
|
# every other repo's, so this script only locates the shared checker and
|
|
# forwards its arguments.
|
|
# ============================================================================
|
|
|
|
set -euo pipefail
|
|
|
|
readonly SHARED_GATE="${UTILS_ROOT:-$HOME/utils}/scripts/check_no_binaries.sh"
|
|
|
|
main() {
|
|
if [[ ! -x "$SHARED_GATE" ]]; then
|
|
echo "Error: shared gate not found at $SHARED_GATE" >&2
|
|
echo " Clone github.com/kuhyx/utils to ~/utils, or set" >&2
|
|
echo " UTILS_ROOT to where it lives." >&2
|
|
exit 1
|
|
fi
|
|
|
|
exec bash "$SHARED_GATE" "$@"
|
|
}
|
|
|
|
main "$@"
|