[undivisible]

Summary

Four audit tracks on undivisible/vro, with findings kept separate from high-confidence scoped fixes. Speculative refactors and large performance rewrites were intentionally deferred.

Validation evidence

• v fmt -verify main.v input.v syntax.v syntax_test.v syntax_embedded.v — pass
• v -gc none -check . — pass
• v -gc none test . — pass (syntax_test.v, includes new expand-cap test)
• v -gc none -prod -o vro . && ./vro -version → vro 1.2.3
• bash -n install.sh — pass
• Live release check: vro-linux-x86_64.sha256 → 200 + checksum matches tarball; vro-linux-x86_64.tar.gz.sha256 → 404 (root cause of broken verified installs)

---

Track 1 — Security & vulnerabilities

Findings (not all fixed)

Sev	Finding	Action
Critical*	Installer fetched ${ASSET}.sha256 but releases publish vro-<platform>.sha256	Fixed
Medium	Archive extract did not validate members / reject symlink vro	Fixed
Medium	rm -rf / cp could follow planted symlinks in install paths	Fixed
Medium	expand_regex_groups unbounded → DoS via untrusted local syntax/*.yaml	Fixed (cap 256 / depth 12)
Medium	Release Windows V zip had no checksum; unix V floats on master	Partial — Windows zip SHA pinned; unix pin deferred (needs shared commit policy)
Medium	curl|bash install + checksum ≠ signature	Docs note only
Info	Floating Actions tags (@v4/@v2)	Deferred (Dependabot/SHA pins)

*Operational criticality for verified one-liner installs.

Changes

• install.sh: correct checksum asset name; member allowlist (vro, syntax/**); require regular non-symlink binary; symlink-safe install/remove helpers
• syntax.v: capped alternation expansion (fail closed to original pattern)
• scripts/gen_embedded.v: reject unsafe syntax basenames before codegen

---

Track 2 — Performance & memory/async

Findings (high confidence; many deferred)

Impact	Finding	Action
High	Dirty-tail HL carry always rescanned to EOF	Fixed early-exit when leave-carry matches next enter state
High	Full-buffer undo snapshot on find/save	Fixed skip snap for Ctrl-F / Ctrl-S
High	-gc none + no frees → RSS growth	Deferred (needs GC/reuse strategy)
High	Hot-path bytestr() / per-byte group strings	Deferred
Medium	Word-count full rescan; per-byte paste; insert/delete full carry invalidate	Deferred

Changes

• main.v: hl_carry_states_equal + early break in dirty-tail path; conditional undo snapshot

---

Track 3 — DevOps & CI

Findings

Sev	Finding	Action
Critical	Checksum filename mismatch (install vs release)	Fixed in install
High	Windows release used fmt -w (mutated sources)	Fixed → fmt -verify
High	Publish uploaded bare colliding vro binaries	Fixed — archives + .sha256 only
High	Workflow-wide contents: write	Fixed — read default; write on publish only
Medium	print-release-shas.sh omitted linux-aarch64	Fixed
Medium	CI matrix lacks windows/arm; no action SHA pins	Deferred
Medium	AGENTS fmt file list stale	Fixed in docs commit

Changes

• .github/workflows/ci.yml: permissions: contents: read
• .github/workflows/release.yml: least privilege; Windows verify; Windows V zip SHA256 pin 705bda7f…619f; release-assets/ publish filter
• scripts/print-release-shas.sh: include linux-aarch64

---

Track 4 — Code hygiene & refactoring

Findings → fixes

• Remove unused YamlPat / YamlReg and dead hl_apply_region
• Collapse editor_open → editor_open_into_buffer
• compile_maybe_re → wrap compile_one_re
• Reuse app_command_parts + editor_clear_screen in command runner
• Fix misleading Usage: split <path>
• Surface save I/O err.msg()
• Sync AGENTS.md (five fmt files; input.v stub note) and v.mod → 1.2.3
• Test: test_expand_regex_groups_basic_and_cap

Intentionally not changed

• Delete empty input.v (kept for fmt/historical layout; documented)
• Wire unused detect.filename (product decision)
• Large main.v splits / undo rope redesign

---

Commits

1. fix(security,ci): harden installer and release pipeline
2. fix(editor): cap regex expand, early-exit HL carry, hygiene cleanup
3. docs: sync AGENTS fmt list and v.mod version with 1.2.3

  

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_704c36e0-13de-462a-9dcc-03f6572b5a66)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[chatgpt-codex-connector]

💡 Codex Review

vro/syntax.v

Lines 375 to 376 in 3fe2a41

	if depth > expand_regex_groups_max_depth || out.len >= expand_regex_groups_max {
	return false

Preserve large flat bundled alternations

When loading bundled definitions such as syntax/css.yaml:14 or syntax/nginx.yaml:9, their ordinary flat alternations exceed 256 branches, so this condition aborts expansion and returns the original multi-kilobyte pattern. That bypasses the existing per-alternative compilation workaround; if V's regex engine rejects the oversized pattern, compile_syntax_from_yaml silently skips the entire rule, removing highlighting for CSS properties and many nginx directives. Limit combinatorial/nested expansion without rejecting large flat alternation lists shipped by the repository.

---

vro/.github/workflows/release.yml

Lines 74 to 79 in 3fe2a41

	- name: Verify vfmt
	shell: bash
	run: |
	set -euo pipefail
	cd "${GITHUB_WORKSPACE}"
	"${V}" fmt -verify main.v input.v syntax.v syntax_test.v syntax_embedded.v

Align Windows vfmt with the CI compiler revision

In the inspected release workflow, the Windows setup remains pinned to V 0.5.1 while Unix and normal CI build V from master, but this newly shared step now runs fmt -verify with the pinned Windows formatter too. Whenever those formatter revisions disagree on layout, sources formatted exactly as required by CI will fail the Windows matrix job, and because publish needs the complete build matrix, the entire tag release is blocked before any assets are published. Run verification with the same V revision used to establish the repository's formatting.

AGENTS.md reference: AGENTS.md:L27-L29

---

vro/install.sh

Line 166 in 3fe2a41

tar -xzf "${TMP}/vro.tgz" -C "$TMP" vro syntax

Extract the optional syntax directory conditionally

For a valid binary-only archive, such as one supplied through VRO_GITHUB_REPO or an older release without bundled syntax data, validation accepts the sole vro member but this command asks tar to extract a nonexistent syntax member. Both GNU tar and bsdtar return an error for that request, and set -e aborts the installer before the binary is installed, making the subsequent if [ -d "${TMP}/syntax" ] optional handling unreachable. Extract vro first and request syntax only when the member listing shows it is present.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_29a0232c-a6d7-4ec4-88a5-9b5ec6a6c03e)

[undivisible]

Closing as unmergeable under current CI. Two blockers found while rebasing:

1. Compile error: compile_maybe_re used or { none } for a ?regex.RE return (fixed locally as or { return none }).
2. vfmt: CI builds bleeding-edge vlang from source each run (.github/workflows/ci.yml clones vlang master + make), so its v fmt rules drift. The branch's main.v/syntax_test.v don't match that moving target; a local older v (0.5.1) can't reproduce it.
   The security value (installer checksum asset fix, regex-group DoS cap) is real. Re-open after re-running v fmt -w with the CI's exact vlang commit and confirming v -gc none test ..