From f00191bf8e0a20cb578aab08dfdf6a7de6c8f872 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 24 Aug 2026 19:31:45 +0200 Subject: docs(specs): guard the signature splice against deleting the user's text Finding a "-- " delimiter is not enough to authorise removing what follows it. The block is replaced only when its text matches one of the signatures on disk; otherwise the new signature is inserted and nothing is removed. "-- " can reach the buffer without the user ever choosing a signature, most plausibly pasted in with quoted text from another client, and the unguarded scan would have deleted everything after it silently. The failure is now directional: a block that matches is replaced, and one that does not produces a second signature, visible in the editor and one undo away. A wrong guess adds text rather than losing it. Two markers were considered for the same problem and refused, both recorded with the reasons. A zero-width character ships in the sent message, fingerprinting the client in outgoing mail, and has to survive the draft round trip through GMime, quoted-printable and MimeParser, which is the pipeline that normalises such characters away. A doubled delimiter is not the RFC 3676 separator, so no receiving client would recognise the signature, and it would not have caught the pasted-text case that prompted it. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01KEcn3u19xPqv6ggD15PG4c --- .../superpowers/plans/2026-08-03-post-0.1.0-usability.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'docs/superpowers/plans') diff --git a/docs/superpowers/plans/2026-08-03-post-0.1.0-usability.md b/docs/superpowers/plans/2026-08-03-post-0.1.0-usability.md index c91884e..15f8654 100644 --- a/docs/superpowers/plans/2026-08-03-post-0.1.0-usability.md +++ b/docs/superpowers/plans/2026-08-03-post-0.1.0-usability.md @@ -1356,6 +1356,22 @@ clients offer it. The scan needed the quote-aware clause for `above_quote` anyway, so the key is roughly ten lines rather than one, and a naive tail rule would have eaten the quote under the other placement. +**A delimiter alone must not authorise a deletion.** The block after `-- ` is +replaced only when its text matches one of the signatures on disk; otherwise +the new one is inserted and nothing is removed. `-- ` can reach the buffer +pasted in with quoted text from another client, and the unguarded scan would +have silently deleted everything after it. The failure is now directional: a +wrong guess adds a visible duplicate rather than losing the user's writing. +Raised by the user against the first draft of this design. + +Two markers were considered for the same problem and refused. A zero-width +character SHIPS in the sent message, fingerprinting the client in outgoing +mail, and must survive the draft round trip through GMime, quoted-printable +and `MimeParser`, which is exactly what normalises such characters away. A +doubled delimiter (`--` plus two spaces) is not the RFC 3676 separator, so no +receiving client would fold or strip the signature, and trailing whitespace is +unreliable through the same pipeline. + **Two things the design refuses.** No signature editor: the directory is edited with the user's own editor, and a text editor inside a mail client is not this project's to build. And a resumed draft seeds nothing, because the -- cgit v1.2.3