mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-18 10:52:24 +02:00
fix(gen): resolver registry describes the template language again
Seven registered {{PLACEHOLDER}}s had zero uses in any .tmpl (checked in both
bare and :arg forms): REDACT_TAXONOMY_TABLE, TEST_COVERAGE_AUDIT_REVIEW,
MODEL_OVERLAY, QUESTION_PREFERENCE_CHECK, QUESTION_LOG, INLINE_TUNE_FEEDBACK,
MAKE_PDF_SETUP. The last two of those families are invoked programmatically by
preamble.ts (functions kept, registry entries dropped); the question-tuning
trio and the review coverage-audit wrapper were documented by their own module
as existing 'for unit testing' that no test performed — deleted, along with
generateRedactTaxonomyTable + its EXAMPLE/TIER_BLURB constants (its '/cso
renders the full table' comment was itself stale) and its test describe.
Also deletes the gated-resolver mechanism (ResolverEntry/appliesTo/
unwrapResolver + test/resolver-entry.test.ts): fully built, fully tested,
used by zero of the 65 registry entries — the generator loop simplifies to a
direct function call. CLAUDE.md's redact-doc line stops advertising the dead
token.
Proof: zero-diff regen (0 SKILL.md changed); gen-skill-docs + skill-validation
737 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
co-authored by
Claude Fable 5
Claude Fable 5
parent
5c806a4bd7
commit
7933a38aa8
@@ -14,92 +14,6 @@
|
||||
* changes land here once. test/redact-doc-resolver.test.ts golden-pins the output.
|
||||
*/
|
||||
import type { TemplateContext } from './types';
|
||||
import { PATTERNS, type Tier } from '../../lib/redact-patterns';
|
||||
|
||||
// Representative example/prefix per pattern for the human-readable table. Keeps
|
||||
// lib/redact-patterns clean (no doc strings) while ensuring the recognizable
|
||||
// prefixes (AKIA, ghp_, sk-ant-, sk-, BEGIN) appear in the generated docs.
|
||||
const EXAMPLE: Record<string, string> = {
|
||||
'aws.access_key': 'AKIA…',
|
||||
'aws.secret_key': '40-char base64 near aws_secret_access_key',
|
||||
'github.pat': 'ghp_…',
|
||||
'github.oauth': 'gho_…',
|
||||
'github.server': 'ghs_…',
|
||||
'github.fine_grained': 'github_pat_…',
|
||||
'anthropic.key': 'sk-ant-…',
|
||||
'openai.key': 'sk-… / sk-proj-…',
|
||||
'sendgrid.key': 'SG.x.y',
|
||||
'stripe.secret': 'sk_live_…',
|
||||
'slack.token': 'xoxb-/xoxp-…',
|
||||
'slack.webhook': 'hooks.slack.com/services/…',
|
||||
'discord.webhook': 'discord.com/api/webhooks/…',
|
||||
'twilio.auth_token': '32-hex near an AC… SID',
|
||||
'pem.private_key': '-----BEGIN … PRIVATE KEY-----',
|
||||
'db.url_with_password': 'postgres://user:pw@host',
|
||||
'creds.basic_auth_url': 'https://user:pw@host',
|
||||
'stripe.publishable': 'pk_live_…',
|
||||
'google.api_key': 'AIza…',
|
||||
'jwt': 'eyJ….eyJ….sig',
|
||||
'env.kv': 'FOO_SECRET=<high-entropy>',
|
||||
'pii.email': 'name@host.tld',
|
||||
'pii.phone.e164': '+1 415 555 0123',
|
||||
'pii.ssn': '123-45-6789',
|
||||
'pii.cc': 'Luhn-valid 13-19 digits',
|
||||
'pii.ip_public': 'public IPv4',
|
||||
'pii.wallet': '0x… / bc1… / 1…',
|
||||
'internal.hostname': 'host.corp / host.internal',
|
||||
'internal.url_private': 'http://localhost:PORT/path',
|
||||
'legal.nda_marker': 'CONFIDENTIAL / UNDER NDA',
|
||||
'legal.named_criticism': 'negative judgment + a full name',
|
||||
'internal.user_path': '/Users/<name>/… , /home/<name>/…',
|
||||
'hygiene.todo': 'TODO(owner)',
|
||||
};
|
||||
|
||||
const TIER_BLURB: Record<Tier, string> = {
|
||||
HIGH: 'HIGH — genuinely-secret credentials. Blocks dispatch/file/edit/commit.',
|
||||
MEDIUM:
|
||||
'MEDIUM — PII, legal/damaging, internal-leak, and high-FP credential-shaped ' +
|
||||
'patterns. AskUserQuestion to confirm (sterner on public repos); never auto-blocked.',
|
||||
LOW: 'LOW — surfaced as an FYI, never blocks.',
|
||||
};
|
||||
|
||||
export function generateRedactTaxonomyTable(_ctx: TemplateContext, args?: string[]): string {
|
||||
// Compact mode: HIGH-tier rows only (the credentials that BLOCK), one line of
|
||||
// prose for MEDIUM/LOW. For skills that RUN redaction (e.g. /spec) but aren't
|
||||
// the security catalog — they need to know what blocks + where the full list
|
||||
// is, not inline all ~30 patterns. /cso renders the full table.
|
||||
const compact = args?.[0] === 'compact';
|
||||
const out: string[] = [];
|
||||
|
||||
const tiers: Tier[] = compact ? ['HIGH'] : ['HIGH', 'MEDIUM', 'LOW'];
|
||||
for (const tier of tiers) {
|
||||
out.push(`**${TIER_BLURB[tier]}**`, '');
|
||||
out.push('| ID | Catches | Example |');
|
||||
out.push('|----|---------|---------|');
|
||||
for (const p of PATTERNS.filter((x) => x.tier === tier)) {
|
||||
out.push(`| \`${p.id}\` | ${p.description} | ${EXAMPLE[p.id] ?? '—'} |`);
|
||||
}
|
||||
out.push('');
|
||||
}
|
||||
|
||||
if (compact) {
|
||||
out.push(
|
||||
'MEDIUM (PII / legal / internal + high-FP credential shapes like ' +
|
||||
'`pk_live_`/`AIza`/JWT/`*_KEY=`) confirms via AskUserQuestion; LOW surfaces ' +
|
||||
'as an FYI. Full taxonomy: `lib/redact-patterns.ts` (or `/cso`).',
|
||||
);
|
||||
} else {
|
||||
out.push(
|
||||
'Calibration: a gate that cries wolf gets ignored, so context-variable / ' +
|
||||
'high-FP credential shapes (Stripe publishable `pk_live_`, Google `AIza`, ' +
|
||||
'JWTs, env-style `*_KEY=`) sit at MEDIUM, not HIGH. The full taxonomy lives ' +
|
||||
'in `lib/redact-patterns.ts` and this table is generated from it.',
|
||||
);
|
||||
}
|
||||
return out.join('\n');
|
||||
}
|
||||
|
||||
// ── Invocation block (scan-at-sink) ──────────────────────────────────────────
|
||||
|
||||
interface SinkSpec {
|
||||
/** What is being scanned, for the prose. */
|
||||
|
||||
Reference in New Issue
Block a user