mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-10-05 11:18:24 +00:00
Claude
4fa619d2a2
Three read-only sweeps over commons (feeds, relayClient, model, viewmodels, services) and commonsUI produced 44 candidates; each was re-read in the source, 38 held up, 34 are fixed here, 4 are deferred with rationale in commons/plans/2026-09-12-audit-findings.md. Correctness highlights: - SecureKeyStorage (jvm): AES-GCM was initialised with IvParameterSpec, which every JDK rejects, so the no-keyring fallback never worked. GCMParameterSpec. - OnionLocationInterceptor cached any Onion-Location header and re-pointed all Tor traffic at it for 24h over plain http; only .onion targets now. - BasicBundledInsert wedged forever after one exception (no finally). - CachedRichTextParser keyed parses on a 32-bit hash without checking inputs. - noProtocolUrlValidator backtracked exponentially per composer keystroke. - Base83 indexed a 255-entry table with any char code from an imeta tag. - MetadataRateLimiter never flushed a batch smaller than 20 pubkeys. - FeedMetadataCoordinator mutated six HashSets from two threads and marked pubkeys 101+ as requested without asking for them. - Note: two discarded boolean/relay expressions, an NPE window in flow(), removeReport leaving empty buckets, unlocked read-modify-write on replies/boosts/edits/reactions/reports/labels. - EventCollectionState restarted its flush timer on every insert. - Chatroom prune outside the lock; top-zappers publish outside the mutex; hashCode used as dedup/feed keys; OnlyLatestVersionSet.addAll always true. - UI: ClickableTexts remembered a stale onClick, ZonedSwipeModifier a stale openDrawer, two robohash light-theme predicates thrashed one cache, a chess remember key summed two counters. Performance: user-cache search off the Compose dispatcher, regexes hoisted in SearchResultSorter, frame-rate animation reads moved out of composition in Shimmer/LoadingAnimation/BunkerHeartbeat, GlowingCard allocations cached, emoji inlineContent remembered, itemsIndexed in the search pickers. Ten regression tests added (rate limiter flush/dedup/rate, GCM round trip, regex timing, Base83 bounds, CosineCache key). Verified: commons and commonsUI jvmTest, compiles of cli, desktopApp, nappletHost, amethyst. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N56KzPSYiN5edMRamvKEgD