Skip to content

fix(cli): reject empty channel messages - #6493

Open
oletillmann wants to merge 2 commits into
block:mainfrom
oletillmann:fix/empty-message-input
Open

fix(cli): reject empty channel messages#6493
oletillmann wants to merge 2 commits into
block:mainfrom
oletillmann:fix/empty-message-input

Conversation

@oletillmann

@oletillmann oletillmann commented Aug 21, 2026

Copy link
Copy Markdown

Summary

  • bound buzz messages send --content - reads from completely idle non-terminal stdin so an inherited open pipe cannot block indefinitely
  • reject channel/forum message envelopes that contain neither non-whitespace text nor media
  • preserve interactive terminal input, slow producers, and media-only messages

Why

An agent process can inherit an open stdin descriptor and invoke --content - without attaching a producer. The CLI currently waits forever for the first byte. If the descriptor is eventually closed, an empty message can continue to the signer and relay.

This change adds two independent protections:

  1. Non-terminal stdin gets five seconds to produce its first byte. After that first byte, the CLI waits normally for the producer to finish; terminal stdin remains intentionally interactive.
  2. CLI, SDK, and desktop message builders reject empty/whitespace-only envelopes unless media is attached.

Tests

  • regression test with an open pipe whose writer stays alive without writing or closing
  • delayed-producer test that waits three seconds before writing valid content
  • literal-empty and immediate-EOF rejection tests
  • non-empty stdin path test
  • SDK and desktop builder tests, including media-only messages
  • cargo test -p buzz-cli
  • cargo test -p buzz-sdk
  • cargo clippy -p buzz-sdk -p buzz-cli --all-targets -- -D warnings
  • just desktop-tauri-test
  • just ci

Bound non-interactive stdin reads so inherited open pipes cannot block agent sends indefinitely. Reject empty message envelopes at CLI, SDK, and desktop builder boundaries while preserving media-only messages.

Co-authored-by: oletillmann <ole@tillmann.com>
Signed-off-by: oletillmann <ole@tillmann.com>
@oletillmann
oletillmann requested a review from a team as a code owner August 21, 2026 16:31
Limit the guard to initial stdin inactivity. Once the first byte arrives, allow the producer to take as long as needed to finish, and cover both delayed producers and permanently idle pipes.

Co-authored-by: oletillmann <ole@tillmann.com>
Signed-off-by: oletillmann <ole@tillmann.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant