[openvoiceos-bot]

🤖 Auto-generated by Claude Fable 5.1 (claude-fable-5-1) via Claude Code — NOT human-reviewed. Verify before acting.

hivemind/binary.py decode() read the 5-bit message-type field of a binary frame and returned whatever value it found (0-31) unvalidated, and returned the metadata block as raw, unparsed bytes that no caller ever decoded as JSON. This PR adds a MalformedBinaryFrame error, raised for an unassigned message-type code, a metadata length that overruns the remaining bytes, non-JSON metadata, or a truncated frame, and changes the metadata field to decode to the parsed JSON object ({} for a zero-length block). The one caller in hivemind/client.py now catches the new error, logs it, and drops the frame without closing the connection.

HIVEMIND-WIRE-1 §4.2: "Code 11 and codes 13–31 are unassigned. A sender MUST NOT emit them, and a receiver MUST reject a frame carrying one as malformed rather than mapping it to any type." Assigned codes are 0–10 and 12.

HIVEMIND-WIRE-1 §4.1: "A receiver MUST decode the block as a UTF-8 JSON object, and MUST treat a zero-length block as an equivalent empty field set without attempting to parse it."

Verified by execution:

# fail-before, unmodified decode() on an unassigned code (13):
UNFIXED decode of unassigned code 13 did NOT raise: 13

# fail-before, new test module against unmodified binary.py:
ImportError: cannot import name 'MalformedBinaryFrame' from 'hivemind.binary'

# after the fix:
test/test_binary.py .......... [12 passed]

# full suite:
85 passed, 5 warnings, 24 subtests passed in 44.99s

The 85 total is the pre-existing 78 plus 7 new tests (three unassigned-code rejections, an over-long metadata length, a truncated frame, a non-JSON metadata block, and a 200-iteration fuzz test asserting nothing but MalformedBinaryFrame or a clean decode ever escapes). No test was skipped. The pre-existing TestLegacyFallback suite and the legacy password-handshake fallback in client.py are untouched; that fallback is a separate, tracked backcompat decision, not part of this change.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: fa4b9eaa-03d3-455d-81b7-790dada1b6bd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}