claude
650363ce67
One real bug. tool.Exec built argv as append(t.Cmd, args...), so an enabled row with an empty Cmd made args[0] the program name. The len(argv) == 0 guard never fired, because args is non-empty exactly when there is spoken text. That is free text reaching a mutating call, in the one place that is literally exec. It needed no compromise to reach. A proposal drafted with no cmd gets TierDestructive from RiskOf, so one да clears the confirm, and then the tail of the utterance runs as a program. Exec now refuses with ErrNotEnabled before it builds argv, and TestExecEmptyCmdRefuses pins it. Three smaller things. CapabilityOf hand-parsed a Home Assistant entity id where smarthome.DomainOf owns that format. GroupByDomain recomputed its map key twice per row. The zenmoney and Home Assistant clients both read a capped body before the status check that throws it away, so the status check moved ahead of it. Checked and found already right: risk.go reads Hexis rather than deriving and sends unknown tiers up, smarthome.CallService drops spoken args and validates the service against the controllable table, and zenmoney reads currency per instrument rather than assuming one. (V-581)