Connect start: pin the app-secret gate on every managed provider, refuse blank targets #9
2026-11-09
Connection targets are an allowlist: a letter or a number that is not an invisible filler
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Tests first: a target must hold a letter or a number; marks, private-use, unassigned, surrogate and null-symbol targets are blank
Fail on bda14e3: the blocklist accepts U+0300, U+E000, U+0378, a lone surrogate, U+16FE4, U+1D159 and U+F0000 (201 where 400 is wanted; custody_only where refused).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Widen the blank-target predicate; answer the app-secret gate before the target checks
isUsableConnectionTarget now rejects targets made only of whitespace, controls, default-ignorable code points and U+2800. The blank-target and creator_connection_required refusals move after the app-secret gate, so a caller without the secret gets 401. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Tests first: invisible fillers and controls are blank; the secret gate answers before the blank check
Fails on this commit (7 of 107 selected): the blank-target start accepts U+2800 with a 201 for twitch, youtube and joystick; a blank target without the app's secret answers 400, not 401; the callback mint returns custody_only for U+2800. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-08
Pin the blank-target refusal for every connection kind
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Blank connection targets are refused; pin the app-secret gate on every managed provider
A connect start naming a connection target already needed the app's own secret, but the gate was pinned for Joystick only and a whitespace or zero-width targetId passed both the start gate and the callback mint. One predicate now serves both; the gate is pinned for twitch, youtube and joystick, and the note for StreamPixels says what its redeem must do. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>