test: cover cursor decoding and script integrity metrics

internal/domain/cursor_test.go

@@ -72,3 +72,24 @@ func TestCursorInputBounds_BH_CTL_01(t *testing.T) {
 		}
 	}
 }
+
+// FuzzDecodeCursorBounded_SEC_CTL_02 exercises the token boundary shared by
+// every cursor-resumable control read. Decode must reject malformed or forged
+// input without panicking or allocating past its documented token ceiling.
+func FuzzDecodeCursorBounded_SEC_CTL_02(f *testing.F) {
+	codec, err := NewCursorCodec(bytes.Repeat([]byte{0x42}, 32))
+	if err != nil {
+		f.Fatal(err)
+	}
+	filters := HashCursorFilters([]byte("client=host-1\x00streams=stdout"))
+	valid, err := codec.Encode(Cursor{Kind: CursorKindOutput, FilterHash: filters, Position: []byte("event/offset"), SnapshotBoundary: []byte("upper-event")})
+	if err != nil {
+		f.Fatal(err)
+	}
+	for _, seed := range []string{"", "***", valid, strings.Repeat("a", 4096)} {
+		f.Add(seed)
+	}
+	f.Fuzz(func(t *testing.T, token string) {
+		_, _ = codec.Decode(token, CursorKindOutput, filters)
+	})
+}

internal/server/control/service.go

@@ -256,6 +256,7 @@ func (service *Service) RunCommand(ctx context.Context, request *rvboxv1.RunComm
 		descriptor := spec.GetScript()
 		digest := sha256.Sum256(request.GetScriptContent())
 		if descriptor == nil || uint64(len(request.GetScriptContent())) != descriptor.GetSizeBytes() || !bytes.Equal(digest[:], descriptor.GetSha256()) {
+			service.incMetric("script_verification_failure")
 			return nil, controlError(codes.InvalidArgument, rvboxv1.ControlError_INVALID_ARGUMENT, "script_content does not match the script descriptor")
 		}
 	}

internal/server/control/service_test.go

@@ -11,6 +11,7 @@ import (
 	rvboxv1 "github.com/rvbox/rvbox/gen/go/rvbox/v1"
 	"github.com/rvbox/rvbox/internal/agentproto"
 	"github.com/rvbox/rvbox/internal/domain"
+	"github.com/rvbox/rvbox/internal/observability"
 	"github.com/rvbox/rvbox/internal/server/store"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -70,6 +71,8 @@ func TestControlListAndGetViews_HP_CONTROL_01(t *testing.T) {
 func TestRunCommandRequestIDIdempotencyAndValidation_BH_CONTROL_02(t *testing.T) {
 	service, persistence := newTestService(t)
 	defer persistence.Close()
+	metrics := observability.New()
+	service.metrics = metrics
 	ctx := context.Background()
 	registerControlClient(t, persistence, "win-a", rvboxv1.Platform_PLATFORM_WINDOWS, rvboxv1.ShellType_SHELL_POWERSHELL, 3)
 	issue := fixedIssue(0xa2)
@@ -102,6 +105,10 @@ func TestRunCommandRequestIDIdempotencyAndValidation_BH_CONTROL_02(t *testing.T)
 	if _, err := service.RunCommand(ctx, badScript); status.Code(err) != codes.InvalidArgument {
 		t.Fatalf("mismatched script code = %v", status.Code(err))
 	}
+	_, _, counters := metrics.Snapshot()
+	if counters["script_verification_failure"] != 1 {
+		t.Fatalf("script verification metrics = %#v", counters)
+	}
 	badTTL := proto.Clone(request).(*rvboxv1.RunCommandRequest)
 	badTTL.RequestId = fixedIssue(0xa4).String()
 	badTTL.QueueTtl = durationpb.New(-time.Second)