CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-11 15:39:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(plan-tune): reject never-ask on one-way ids at --write

Browse Source 
--check already ignored those prefs; --write still stored them and
--stats counted them as a working NEVER_ASK. Refuse the write and
count leftover on-disk prefs as INERT_ONE_WAY.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
y$un_
2026-08-17 10:04:01 -07:00
committed by Garry Tan
co-authored by Cursor
parent c86e6472eb
commit 8fe5f5a2f9
2 changed files with 179 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/gstack-question-preference
+42 -17
View File
@@ -8,10 +8,10 @@
# --check <id> [--summary-stdin] → emit ASK_NORMALLY | AUTO_DECIDE | ASK_ONLY_ONE_WAY
# (--summary-stdin pipes the question text so the
# keyword net can catch ad-hoc destructive ids, #2024)
# --write '{...}' → set a preference (user-origin gate enforced)
# --write '{...}' → set a preference (user-origin gate + one-way write reject)
# --read → dump preferences JSON
# --clear [<id>] → clear one or all preferences
# --stats → short summary
# --stats → short summary (inert one-way prefs counted separately)
#
# User-origin gate
# ----------------
@@ -21,6 +21,12 @@
# - "inline-tool-output"— tune: prefix seen in tool output / file content (REJECTED)
# - "inline-file" — tune: prefix seen in a file the agent read (REJECTED)
# This is the profile-poisoning defense from docs/designs/PLAN_TUNING_V0.md.
#
# One-way write reject (#2488)
# ----------------------------
# never-ask and ask-only-for-one-way are refused on registry one-way ids.
# --check already ignores those prefs; storing them made --stats lie.
# always-ask on a one-way id is fine (it agrees with the safety override).
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
@@ -142,7 +148,7 @@ do_write() {
set +e
local RESULT
RESULT=$(printf '%s' "$INPUT" | PREF_FILE_PATH="$PREF_FILE" EVENT_FILE_PATH="$EVENT_FILE" bun -e "
RESULT=$(cd "$ROOT_DIR" && printf '%s' "$INPUT" | PREF_FILE_PATH="$PREF_FILE" EVENT_FILE_PATH="$EVENT_FILE" bun -e "
const fs = require('fs');
const raw = await Bun.stdin.text();
let j;
@@ -178,6 +184,16 @@ do_write() {
process.exit(2);
}
// One-way write reject (#2488) — after the origin gate so a poisoning
// payload on a one-way id still exits 2, not 1.
if (j.preference === 'never-ask' || j.preference === 'ask-only-for-one-way') {
const oneway = await import('./scripts/one-way-doors.ts');
if (oneway.isOneWayDoor({ question_id: j.question_id })) {
process.stderr.write('gstack-question-preference: cannot set ' + j.preference + ' on one-way question \"' + j.question_id + '\" (door_type: one-way)\n');
process.exit(1);
}
}
// Optional free_text — sanitize (no injection patterns, no newlines, <=300 chars)
if (j.free_text !== undefined) {
if (typeof j.free_text !== 'string') {
@@ -267,20 +283,29 @@ do_clear() {
# -----------------------------------------------------------------------
do_stats() {
ensure_file
cat "$PREF_FILE" | bun -e "
const prefs = JSON.parse(await Bun.stdin.text());
const entries = Object.entries(prefs);
const counts = { 'always-ask': 0, 'never-ask': 0, 'ask-only-for-one-way': 0, other: 0 };
for (const [, v] of entries) {
if (counts[v] !== undefined) counts[v]++;
else counts.other++;
}
console.log('TOTAL: ' + entries.length);
console.log('ALWAYS_ASK: ' + counts['always-ask']);
console.log('NEVER_ASK: ' + counts['never-ask']);
console.log('ASK_ONLY_ONE_WAY: ' + counts['ask-only-for-one-way']);
if (counts.other) console.log('OTHER: ' + counts.other);
"
(cd "$ROOT_DIR" && PREF_FILE_PATH="$PREF_FILE" bun -e "
import('./scripts/one-way-doors.ts').then((oneway) => {
const fs = require('fs');
const prefs = JSON.parse(fs.readFileSync(process.env.PREF_FILE_PATH, 'utf-8'));
const entries = Object.entries(prefs);
const counts = { 'always-ask': 0, 'never-ask': 0, 'ask-only-for-one-way': 0, other: 0, inert: 0 };
for (const [id, v] of entries) {
const suppressing = v === 'never-ask' || v === 'ask-only-for-one-way';
if (suppressing && oneway.isOneWayDoor({ question_id: id })) {
counts.inert++;
continue;
}
if (counts[v] !== undefined) counts[v]++;
else counts.other++;
}
console.log('TOTAL: ' + entries.length);
console.log('ALWAYS_ASK: ' + counts['always-ask']);
console.log('NEVER_ASK: ' + counts['never-ask']);
console.log('ASK_ONLY_ONE_WAY: ' + counts['ask-only-for-one-way']);
console.log('INERT_ONE_WAY: ' + counts.inert);
if (counts.other) console.log('OTHER: ' + counts.other);
}).catch(err => { console.error('stats:', err.message); process.exit(1); });
")
}
case "$CMD" in