C1 (CRITICAL, caught by the PM's independent reviewer; masked by a test that
hard-coded the id): the popup sends id:'' for NEW items — the personal add_item
handler mints one via new_item_id(), but handleOrgAddItem used item.id verbatim.
Every new org item therefore wrote items/<collection>/.enc, so the 2nd add to a
collection OVERWROTE the first (blob data loss) + accumulated duplicate empty-id
manifest entries. Fix: mint the id with w.new_item_id() and use it for the blob
path, the manifest entry, and the encrypted item.
Also:
- m4: sanitize the device name in buildSigner (strip CR/LF/<>) + derive a safe
email local-part, so a crafted device name can't malform the signed commit's
author line.
- m1: add update/delete ungranted-collection refusal tests (parity with add).
- Regression test: org_add_item with id:'' now asserts a real 16-hex id lands in
the path + manifest entry (the test that masked C1 is fixed to mint the id).
- m3 is eliminated by the C1 fix; m2 (TOCTOU dual-read) + m5 (zero-grant +new /
push-rejection copy) tracked as non-blocking follow-ups.
Full extension suite 584/584; build:all clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LKBbrAjmpVXMEK15pNi3Ha
df2954dd26