From 9613ff8f172dfc56331014afb2bc2c2220ed61e6 Mon Sep 17 00:00:00 2001 From: garrytan Date: Tue, 6 Oct 2026 21:02:06 +0000 Subject: [PATCH] fix(sync-gbrain): orchestrator flags must match an allowlisted grammar Co-authored-by: dgrant --- sync-gbrain/SKILL.md | 13 +++++++++---- sync-gbrain/SKILL.md.tmpl | 13 +++++++++---- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/sync-gbrain/SKILL.md b/sync-gbrain/SKILL.md index b9147f2e2..505b86481 100644 --- a/sync-gbrain/SKILL.md +++ b/sync-gbrain/SKILL.md @@ -587,8 +587,13 @@ Other memory types sync whatever the answer. Details: ## Step 2: Run the orchestrator -Pass user args to the orchestrator. Do not paraphrase them — pass through -as-is. +Pass the user's flags to the orchestrator as ``, unchanged (empty for a +plain run). Use them only when every word is one of `--incremental`, `--full`, +`--dry-run`, `--quiet`, `--no-code`, `--no-memory`, `--no-brain-sync`, +`--code-only`, `--dream`, `--no-dream`, `--allow-reclone`, +`--prune-gone-worktrees`, or `--sources` followed by one comma-separated list of +lowercase memory types (or `all`). Any other value is not used: do not run the +command; tell the user which value was rejected. ```bash bun run ~/.claude/skills/gstack/bin/gstack-gbrain-sync.ts @@ -729,8 +734,8 @@ Capability check: bun run ~/.claude/skills/gstack/bin/gstack-gbrain-read-capability.ts ``` -`` are the same flags this /sync-gbrain invocation passed to Step 2, -unchanged (empty for a plain run). The helper needs no other input: run it once +`` are the same checked flags this /sync-gbrain invocation passed to +Step 2, unchanged (empty for a plain run). The helper needs no other input: run it once and use its JSON result; do not inspect its source or the gbrain CLI first. The helper reports JSON `status: ready` only after the successful code sync's diff --git a/sync-gbrain/SKILL.md.tmpl b/sync-gbrain/SKILL.md.tmpl index 7cca07cf0..746efce7e 100644 --- a/sync-gbrain/SKILL.md.tmpl +++ b/sync-gbrain/SKILL.md.tmpl @@ -263,8 +263,13 @@ Other memory types sync whatever the answer. Details: ## Step 2: Run the orchestrator -Pass user args to the orchestrator. Do not paraphrase them — pass through -as-is. +Pass the user's flags to the orchestrator as ``, unchanged (empty for a +plain run). Use them only when every word is one of `--incremental`, `--full`, +`--dry-run`, `--quiet`, `--no-code`, `--no-memory`, `--no-brain-sync`, +`--code-only`, `--dream`, `--no-dream`, `--allow-reclone`, +`--prune-gone-worktrees`, or `--sources` followed by one comma-separated list of +lowercase memory types (or `all`). Any other value is not used: do not run the +command; tell the user which value was rejected. ```bash bun run ~/.claude/skills/gstack/bin/gstack-gbrain-sync.ts @@ -405,8 +410,8 @@ Capability check: bun run ~/.claude/skills/gstack/bin/gstack-gbrain-read-capability.ts ``` -`` are the same flags this /sync-gbrain invocation passed to Step 2, -unchanged (empty for a plain run). The helper needs no other input: run it once +`` are the same checked flags this /sync-gbrain invocation passed to +Step 2, unchanged (empty for a plain run). The helper needs no other input: run it once and use its JSON result; do not inspect its source or the gbrain CLI first. The helper reports JSON `status: ready` only after the successful code sync's