[data-bot-coasys]

Stacked on #1164. Implements my review 5327106399 on it.

Changes:

• Wrong-code counter grows without limit (blocking, capabilities/mod.rs:381). A wrong code counts only while the request id has a permitted request (requests_map::has_requests_for). A made-up id returns the error and records nothing. The lockout removes the entry together with the request's codes. The call that triggers the lockout now returns "Too many wrong codes"; later calls get "Can't find permitted request", so I adjusted a_request_stops_accepting_codes_after_too_many_wrong_ones to match.
  Tests: made_up_request_ids_leave_no_attempt_entries (10k made-up ids, 0 entries left; 10000 on fix(events): keep app tokens, webhook secrets and other users' perspectives out of broadcasts #1164's head) and a_locked_out_request_leaves_no_attempt_entry. Both fail on fix(events): keep app tokens, webhook secrets and other users' perspectives out of broadcasts #1164's head.
• Exception deny-list (events_ws.rs:665). exception_visible parses ExceptionInfo and matches ExceptionType with no _ arm. Unknown types go to approvers only. Test: exceptions_of_an_unknown_type_reach_only_sessions_that_can_approve_apps (fails on fix(events): keep app tokens, webhook secrets and other users' perspectives out of broadcasts #1164's head).
• Sync-state DID resolved once (events_ws.rs:162). s_sync uses LazyDid. Test: sync_state_reaches_a_socket_opened_before_the_did_resolved goes through build_event_stream, opens the stream before the DID exists, and checks that only the main agent's event arrives. It fails on fix(events): keep app tokens, webhook secrets and other users' perspectives out of broadcasts #1164's head, and would also fail with broadcast_stream!.

Not done:

• agent_ws.rs:501, use guards::refuse_user_session from fix(api): keep user sessions off node operations; sign as the user #1167. That needs both PRs merged first.

Tests: cargo test --release -p ad4m-executor --lib with filters _tests:: (518 passed), capabilities:: (25 passed) and events_ws:: (25 passed).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 910249e2-0989-4b7f-82fe-0043363e9d35

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}