Accept a session label character newer than this build's Unicode tables

bc3 refuses exactly control, format, private-use, surrogate and line or
paragraph separator characters in a launch label, and no longer refuses
unassigned code points: a host's Unicode tables can be newer than the
server's, and a refused label costs the launch its whole token. The local
check now refuses the same set, named category by category, since Go's
unicode.C table also covers code points it doesn't know.

Author: jeremy

internal/auth/agent_launch.go

@@ -88,16 +88,15 @@ func ValidateSession(id, label string) error {
 	return nil
 }
 
-// labelRune reports whether r may appear in a session label: an assigned
-// character outside the "other" category (control, format, private use,
-// surrogate) and the line and paragraph separators. The label is shown to
-// people, so nothing that reorders, hides or breaks the text around it.
+// labelRune reports whether r may appear in a session label: anything but
+// the "other" category (control, format, private use, surrogate) and the
+// line and paragraph separators — exactly the set bc3 refuses. The label is
+// shown to people, so nothing that reorders, hides or breaks the text around
+// it. Unassigned code points are deliberately allowed: a host's Unicode
+// tables can be newer than this build's or the server's, and a label refused
+// over that skew costs the launch its whole token.
 func labelRune(r rune) bool {
-	if unicode.In(r, unicode.C, unicode.Zl, unicode.Zp) {
-		return false
-	}
-	// Unassigned code points are in no category table at all.
-	return unicode.In(r, unicode.L, unicode.M, unicode.N, unicode.P, unicode.S, unicode.Zs)
+	return !unicode.In(r, unicode.Cc, unicode.Cf, unicode.Co, unicode.Cs, unicode.Zl, unicode.Zp)
 }
 
 // addTo puts the session on a client_credentials form. A nil launch is the

internal/auth/agent_launch_test.go

@@ -183,17 +183,16 @@ func TestSessionTokenNeedsAnAgentProfile(t *testing.T) {
 // server holds a session to are checked before anything goes out.
 func TestSessionTokenValidatesItsIdentityBeforeSending(t *testing.T) {
 	for name, tc := range map[string]struct{ id, label string }{
-		"empty id":             {"", "coworker@box"},
-		"short id":             {"0123456789abcdef", ""},
-		"uppercase id":         {strings.ToUpper(testSessionID), ""},
-		"non-hex id":           {"0123456789abcdef0123456789abcdeg", ""},
-		"label too long":       {testSessionID, strings.Repeat("x", 101)},
-		"blank label":          {testSessionID, "   "},
-		"control in label":     {testSessionID, "coworker\nbox"},
-		"bidi override":        {testSessionID, "coworker\u202ebox"},
-		"line separator":       {testSessionID, "coworker\u2028box"},
-		"invalid utf-8 label":  {testSessionID, "coworker\xffbox"},
-		"unassigned codepoint": {testSessionID, "coworker\U000E0080box"},
+		"empty id":            {"", "coworker@box"},
+		"short id":            {"0123456789abcdef", ""},
+		"uppercase id":        {strings.ToUpper(testSessionID), ""},
+		"non-hex id":          {"0123456789abcdef0123456789abcdeg", ""},
+		"label too long":      {testSessionID, strings.Repeat("x", 101)},
+		"blank label":         {testSessionID, "   "},
+		"control in label":    {testSessionID, "coworker\nbox"},
+		"bidi override":       {testSessionID, "coworker\u202ebox"},
+		"line separator":      {testSessionID, "coworker\u2028box"},
+		"invalid utf-8 label": {testSessionID, "coworker\xffbox"},
 	} {
 		t.Run(name, func(t *testing.T) {
 			as := startDeviceAS(t)
@@ -209,4 +208,9 @@ func TestSessionTokenValidatesItsIdentityBeforeSending(t *testing.T) {
 
 	assert.NoError(t, ValidateSession(testSessionID, strings.Repeat("é", 100)), "100 characters, not bytes")
 	assert.NoError(t, ValidateSession(testSessionID, "claude · coworker"))
+	// A character newer than this build's Unicode tables is accepted, as bc3
+	// accepts it: refusing it would cost the launch its whole token over a
+	// table the two sides need not share.
+	assert.NoError(t, ValidateSession(testSessionID, "coworker \U0001FAE9"))
+	assert.NoError(t, ValidateSession(testSessionID, "coworker\U000E0080box"))
 }