mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-13 08:29:04 +02:00
fix: adversarial review fixes (Claude + Codex cross-model passes)
Both adversarial passes ran against the wave; every FIXABLE finding landed with a regression test: - probeTimeoutMs clamps to >=1ms: a fractional override floored to 0, and execFileSync treats timeout:0 as NO timeout — the probe that exists to bound hangs could hang forever (found by both models independently). - /ship silent hook install now requires the hooks dir to live inside .git: with core.hooksPath (husky's COMMITTED .husky/), the chaining installer would have renamed the team's committed pre-push and written a machine-local wrapper into the working tree (found by both models). - gstack-config gbrain-refresh accepts the "timeout" status — the last consumer still gating on literal "ok" (Codex); gstack-gbrain-detect's config-derived fields honor GBRAIN_HOME so the detection JSON can't report status ok alongside config_exists false (Codex). - prepush: a remote sha absent locally (shallow clone / stale fetch) falls back to the merge-base/empty-tree range — scans MORE, never blocks a legitimate push into training users toward --no-verify. - dashboards: curl's own 000 no longer doubles to "HTTP 000000"; the community dashboard flags stale snapshots like the security one; array sections parse via jq (the sed/grep loops truncated at the first ']'); the no-jq marker grep tolerates whitespace. - telemetry: multi-line redactor output nulls the field instead of corrupting the JSONL record; setup's hint fires only when the config key is genuinely unset (an explicit false is a recorded decline); the /ship prompt marker honors GSTACK_HOME. Kept as designed (cross-model tension noted): Bearer stays MEDIUM in the prepush gate — a HIGH Bearer would block every docs example; the entropy validator can't eliminate that FP class, and MEDIUM warns visibly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
co-authored by
Claude Fable 5
Claude Fable 5
parent
8c8e3b9e52
commit
201e46b230
@@ -38,7 +38,11 @@ trap 'rm -f "$TMPBODY"' EXIT
|
||||
HTTP_CODE="$(curl -s --max-time 15 -w '%{http_code}' -o "$TMPBODY" \
|
||||
"${SUPABASE_URL}/functions/v1/community-pulse" \
|
||||
-H "apikey: ${ANON_KEY}" \
|
||||
2>/dev/null || echo "000")"
|
||||
2>/dev/null || true)"
|
||||
# curl prints its own 000 before a non-zero exit — a `|| echo` here would
|
||||
# double it to "000000" in user-facing output. Normalize to the last 3 chars.
|
||||
HTTP_CODE="$(printf '%s' "$HTTP_CODE" | tr -d '[:space:]' | tail -c 3)"
|
||||
[ -n "$HTTP_CODE" ] || HTTP_CODE="000"
|
||||
DATA="$(cat "$TMPBODY" 2>/dev/null || echo "")"
|
||||
|
||||
echo "gstack community dashboard"
|
||||
@@ -57,15 +61,21 @@ WEEKLY="$(echo "$DATA" | grep -o '"weekly_active":[0-9]*' | grep -o '[0-9]*' ||
|
||||
CHANGE="$(echo "$DATA" | grep -o '"change_pct":[0-9-]*' | grep -o '[0-9-]*' || echo "0")"
|
||||
|
||||
echo "Weekly active installs: ${WEEKLY}"
|
||||
# Marker check: jq when available (whitespace/reserialization-proof); grep
|
||||
# fallback only matches the compact form the edge function emits today.
|
||||
# Marker check: jq when available (whitespace/reserialization-proof); the
|
||||
# grep fallback tolerates optional whitespace around the colon.
|
||||
_STALE="false"
|
||||
if command -v jq >/dev/null 2>&1; then
|
||||
_MARKER="$(printf '%s' "$DATA" | jq -r '.status // empty' 2>/dev/null)"
|
||||
_STALE="$(printf '%s' "$DATA" | jq -r '.stale // false' 2>/dev/null)"
|
||||
else
|
||||
_MARKER="$(printf '%s' "$DATA" | grep -q '"status":"ok"' && echo ok || true)"
|
||||
_MARKER="$(printf '%s' "$DATA" | grep -Eq '"status"[[:space:]]*:[[:space:]]*"ok"' && echo ok || true)"
|
||||
fi
|
||||
if [ "$_MARKER" != "ok" ]; then
|
||||
echo " (unverified — legacy backend response; deploy the latest community-pulse for verified figures)"
|
||||
elif [ "$_STALE" = "true" ]; then
|
||||
# Backend serves its last good snapshot when recompute fails — real but
|
||||
# frozen figures must not read as current (matches security-dashboard).
|
||||
echo " (stale snapshot — backend recompute failing; figures may be out of date)"
|
||||
fi
|
||||
if [ "$CHANGE" -gt 0 ] 2>/dev/null; then
|
||||
echo " Change: +${CHANGE}%"
|
||||
|
||||
+4
-2
@@ -411,8 +411,10 @@ case "${1:-}" in
|
||||
fi
|
||||
|
||||
case "$STATUS" in
|
||||
ok)
|
||||
echo "Detected gbrain v$VERSION."
|
||||
ok|timeout)
|
||||
# "timeout" = slow-but-healthy engine (#1964) — same treatment as
|
||||
# "ok", matching gstack-gbrain-detect --is-ok and gen-skill-docs.
|
||||
echo "Detected gbrain v$VERSION (local-status: $STATUS)."
|
||||
# Render brain-aware blocks INTO the global install so EVERY project's
|
||||
# Claude sessions get them (other projects read SKILL.md + sections from
|
||||
# ~/.claude/skills/gstack via absolute paths baked at gen time). Guards
|
||||
|
||||
@@ -48,7 +48,13 @@ import { isTransactionModePooler } from "../lib/gbrain-exec";
|
||||
const STATE_DIR = process.env.GSTACK_HOME || join(userHome(), ".gstack");
|
||||
const SCRIPT_DIR = __dirname;
|
||||
const CONFIG_BIN = join(SCRIPT_DIR, "gstack-config");
|
||||
const GBRAIN_CONFIG = join(userHome(), ".gbrain", "config.json");
|
||||
// Honors GBRAIN_HOME — must stay consistent with lib/gbrain-local-status's
|
||||
// config resolution, or the detect JSON reports gbrain_local_status "ok"
|
||||
// alongside gbrain_config_exists false for relocated-home users.
|
||||
const GBRAIN_CONFIG = join(
|
||||
process.env.GBRAIN_HOME || join(userHome(), ".gbrain"),
|
||||
"config.json",
|
||||
);
|
||||
const CLAUDE_JSON = join(userHome(), ".claude.json");
|
||||
|
||||
function userHome(): string {
|
||||
|
||||
@@ -64,6 +64,12 @@ function gitStrict(args: string[]): string {
|
||||
return r.stdout ?? "";
|
||||
}
|
||||
|
||||
/** True when the object exists in the local odb (cat-file -e signals via exit code). */
|
||||
function objectExists(sha: string): boolean {
|
||||
const r = spawnSync("git", ["cat-file", "-e", sha], { encoding: "utf8" });
|
||||
return r.status === 0;
|
||||
}
|
||||
|
||||
function defaultRemoteBranch(): string {
|
||||
// origin/HEAD → origin/main, fall back to main/master.
|
||||
const sym = git(["symbolic-ref", "refs/remotes/origin/HEAD"]).trim();
|
||||
@@ -83,6 +89,13 @@ function addedLinesFor(localSha: string, remoteSha: string): string {
|
||||
// branch content is scanned as added — fail-safe (scans more, never less).
|
||||
const base = git(["merge-base", localSha, defaultRemoteBranch()]).trim();
|
||||
range = base ? `${base}..${localSha}` : `${EMPTY_TREE}..${localSha}`;
|
||||
} else if (!objectExists(remoteSha)) {
|
||||
// Remote tip object absent locally (shallow clone, force-push without a
|
||||
// prior fetch, CI checkout): remote..local can't resolve. Fall back to
|
||||
// the merge-base/empty-tree path — scans MORE, never less — instead of
|
||||
// hard-blocking a legitimate push (adversarial review finding 8).
|
||||
const base = git(["merge-base", localSha, defaultRemoteBranch()]).trim();
|
||||
range = base ? `${base}..${localSha}` : `${EMPTY_TREE}..${localSha}`;
|
||||
} else {
|
||||
// Existing branch (incl. force-push): net new content remote..local.
|
||||
range = `${remoteSha}..${localSha}`;
|
||||
|
||||
@@ -49,7 +49,11 @@ trap 'rm -f "$TMPBODY"' EXIT
|
||||
HTTP_CODE="$(curl -s --max-time 15 -w '%{http_code}' -o "$TMPBODY" \
|
||||
"${SUPABASE_URL}/functions/v1/community-pulse" \
|
||||
-H "apikey: ${ANON_KEY}" \
|
||||
2>/dev/null || echo "000")"
|
||||
2>/dev/null || true)"
|
||||
# curl prints its own 000 before a non-zero exit — a `|| echo` here would
|
||||
# double it to "000000" in user-facing output. Normalize to the last 3 chars.
|
||||
HTTP_CODE="$(printf '%s' "$HTTP_CODE" | tr -d '[:space:]' | tail -c 3)"
|
||||
[ -n "$HTTP_CODE" ] || HTTP_CODE="000"
|
||||
DATA="$(cat "$TMPBODY" 2>/dev/null || echo "")"
|
||||
|
||||
# Classify the response:
|
||||
@@ -119,40 +123,36 @@ elif [ "$TOTAL" = "0" ]; then
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Top attacked domains — parse objects inside top_attack_domains array
|
||||
DOMAINS="$(echo "$DATA" | sed -n 's/.*"top_attack_domains":\(\[[^]]*\]\).*/\1/p' | head -1)"
|
||||
if [ -n "$DOMAINS" ] && [ "$DOMAINS" != "[]" ]; then
|
||||
# Array sections — jq is guaranteed past the state gate; the old sed/grep
|
||||
# parsing truncated at the first ']' and dropped entries on any nesting
|
||||
# (the same bug class as the "every count is 7" TOTAL grep).
|
||||
DOMAINS="$(echo "$DATA" | jq -r '.security.top_attack_domains[]? | "\(.domain)\t\(.count)"' 2>/dev/null)"
|
||||
if [ -n "$DOMAINS" ]; then
|
||||
echo "Top attacked domains"
|
||||
echo "────────────────────"
|
||||
echo "$DOMAINS" | grep -o '{[^}]*}' | head -10 | while read -r OBJ; do
|
||||
DOMAIN="$(echo "$OBJ" | grep -o '"domain":"[^"]*"' | awk -F'"' '{print $4}')"
|
||||
COUNT="$(echo "$OBJ" | grep -o '"count":[0-9]*' | grep -o '[0-9]*')"
|
||||
printf '%s\n' "$DOMAINS" | head -10 | while IFS="$(printf '\t')" read -r DOMAIN COUNT; do
|
||||
[ -n "$DOMAIN" ] && [ -n "$COUNT" ] && printf " %-40s %s attempts\n" "$DOMAIN" "$COUNT"
|
||||
done
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# Which layer catches attacks
|
||||
LAYERS="$(echo "$DATA" | sed -n 's/.*"top_attack_layers":\(\[[^]]*\]\).*/\1/p' | head -1)"
|
||||
if [ -n "$LAYERS" ] && [ "$LAYERS" != "[]" ]; then
|
||||
LAYERS="$(echo "$DATA" | jq -r '.security.top_attack_layers[]? | "\(.layer)\t\(.count)"' 2>/dev/null)"
|
||||
if [ -n "$LAYERS" ]; then
|
||||
echo "Top detection layers"
|
||||
echo "────────────────────"
|
||||
echo "$LAYERS" | grep -o '{[^}]*}' | while read -r OBJ; do
|
||||
LAYER="$(echo "$OBJ" | grep -o '"layer":"[^"]*"' | awk -F'"' '{print $4}')"
|
||||
COUNT="$(echo "$OBJ" | grep -o '"count":[0-9]*' | grep -o '[0-9]*')"
|
||||
printf '%s\n' "$LAYERS" | while IFS="$(printf '\t')" read -r LAYER COUNT; do
|
||||
[ -n "$LAYER" ] && [ -n "$COUNT" ] && printf " %-28s %s\n" "$LAYER" "$COUNT"
|
||||
done
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# Verdict distribution
|
||||
VERDICTS="$(echo "$DATA" | sed -n 's/.*"verdict_distribution":\(\[[^]]*\]\).*/\1/p' | head -1)"
|
||||
if [ -n "$VERDICTS" ] && [ "$VERDICTS" != "[]" ]; then
|
||||
VERDICTS="$(echo "$DATA" | jq -r '.security.verdict_distribution[]? | "\(.verdict)\t\(.count)"' 2>/dev/null)"
|
||||
if [ -n "$VERDICTS" ]; then
|
||||
echo "Verdict distribution"
|
||||
echo "────────────────────"
|
||||
echo "$VERDICTS" | grep -o '{[^}]*}' | while read -r OBJ; do
|
||||
VERDICT="$(echo "$OBJ" | grep -o '"verdict":"[^"]*"' | awk -F'"' '{print $4}')"
|
||||
COUNT="$(echo "$OBJ" | grep -o '"count":[0-9]*' | grep -o '[0-9]*')"
|
||||
printf '%s\n' "$VERDICTS" | while IFS="$(printf '\t')" read -r VERDICT COUNT; do
|
||||
[ -n "$VERDICT" ] && [ -n "$COUNT" ] && printf " %-14s %s\n" "$VERDICT" "$COUNT"
|
||||
done
|
||||
echo ""
|
||||
|
||||
@@ -200,7 +200,9 @@ if (out === null) process.exit(1);
|
||||
console.log(JSON.stringify(out.slice(0, 200)));
|
||||
" 2>/dev/null)" || ERR_MSG_FIELD="null"
|
||||
case "$ERR_MSG_FIELD" in
|
||||
\"*\") ;; # JSON string — safe to embed
|
||||
*"
|
||||
"*) ERR_MSG_FIELD="null" ;; # embedded newline would corrupt the JSONL record
|
||||
\"*\") ;; # single-line JSON string — safe to embed
|
||||
*) ERR_MSG_FIELD="null" ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user