Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RC14 rejected upstream's captured terminal because its two DATA bytes were mistaken for a two-byte full plaintext. Upstream
_real_plain("0000")prepends CMD 07 / SUCCESS 01; the complete captured response is therefore four bytes. Its 11-page encrypted replay ends with that marker. This patch accepts exactly that validated wrapped marker, after opcode/status validation; the generic upstreamlen(data) < 4fallback is not adopted.Base: accepted RC14
5bb8f4fa97f0b53f33b7713b5d1658ee1554fe4concodex/rc14-access-foundations, preserving the 0.1.11 transport lineage and existing draft PR #5. New head:fda4233d3fb15ed256f5aa66ebd0f971587e4e9e. Do not merge or publish.The S31 observed four-byte SUCCESS on page 1 at cursor 336, after one decoded PIN. Its remaining bytes were NOT supplied and are NOT assumed.
pin_short_end_marker_matchesexposes only true/false/null, with no raw bytes or hashes, and reports successful exact termination as well as unmatched short replies. Enumeration completion still leaves PIN access coverage incomplete because unused offline/batch PINs may be omitted. All other four-byte SUCCESS payloads, wrong opcodes, failed status and malformed 3/5-byte responses remain rejected. No new credential writes, services or identity attribution.Validation: 349 SDK tests pass, 97.53% coverage; Ruff/formatting and strict mypy (41 files) pass. Tests cover every other two-byte data value (65,535 rejected), one/multiple entries, legacy two-byte endings, early malformed endings, cursor repetition/cap, timeout, cancellation, secret-free metadata and real encrypted fake-BLE/admin/cleanup traversal. No live credentials or hardware were accessed. S31 confirmation remains a separately controlled read-only test.
Evidence: upstream
8025f57cebc7de63a66035fd19e1efb042d0208f,tests/test_commands.py(_real_plain, terminal fixture),tests/test_client_ble.py(test_get_passcodes_full_real_capture). The GPL JavaScript reference at8c84cda63828d7f36f464ff02ad680de76dd1d57independently treats a zero two-byte DATA length as an empty result; no GPL code was copied. Original MIT authorship is preserved.Hosted CI 39784132908 and CodeQL 39784133022 passed at exact head
fda4233d3fb15ed256f5aa66ebd0f971587e4e9e, with 349 tests / 97.53% coverage. The branch remains one ahead / zero behind the exact RC14 base; update-pr-branch skipped. Integration draft #7 pins this SHA and passes 499 local/hosted tests, HACS, hassfest and CodeQL. No release or merge performed; S31 confirmation remains pending.