[AdaWorldAPI]

What

SealedTransport is now a thin frame layer over ogar_encryption::stream::SealedStream (OGAR #360, merged), the generic form of this module's own transport. Wire form and nonce layout are unchanged: [direction:1][counter:8 LE][ciphertext || tag], FRAME_VERSION as associated data.

Security fix: reflected frames

open_frame took the direction from the sealed blob and never compared it with the transport's own. Both directions use the session key, so a server's own NodeDelta reflected back at its up transport opened and was accepted as a client frame. It is now refused with TransportError::WrongDirection (a_reflected_frame_is_refused).

API changes

• seal_frame returns Result<Vec<u8>, TransportError>: the send counter refuses to wrap (CounterExhausted) instead of overflowing. DesktopSession::render maps it to DesktopError::Transport.
• TransportError gains WrongDirection and CounterExhausted.
• Direction is re-exported from ogar-encryption; same variants, same byte values.

Cargo.lock moves ogar-encryption (and the other OGAR crates on the same branch) to current main.

Verification

• cargo test (workspace): green. cargo clippy --all-targets -- -D warnings: clean. cargo fmt --check: clean.
• Disable run: wiring the receiving half to the wrong direction fails six transport tests, including the reflection test.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T05:59:59.910242Z	316d99a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d70c6056-ba44-4623-9c9c-aba96358a204

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}