CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-11 23:49:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: pre-landing review fixes (27 specialist findings, 3 critical)

Browse Source 
Specialist army findings, all quote-verified before fixing:

Security: careful force-push guard now catches git's plus-refspec force
syntax (git push origin +main carried force with no flag — silently allowed
before) and refspec-form targets (HEAD:main); default-branch matching is
tokenized FIXED-STRING comparison on the full branch path (slashed defaults
like release/2.0 work; no ERE interpolation), glob-safe via noglob. HIGH rm
tier is tokenized too: trailing long options (--no-preserve-root) and /* are
root-class. Stored evidence fingerprints are 40-hex re-validated before
reaching git argv. normalizeForDetection sweeps ALL Unicode format chars
(\p{Cf}: soft hyphens, bidi marks, tag chars) instead of five enumerated
zero-widths. The wiring scanner gains flagless gh pr/issue view patterns. The
release-body banner tripwire diffs against the fetched original so a hostile
pre-existing banner string can't permanently DoS doc updates. Ship/land
evidence checks now pass --expect-cmd (a green `echo ok` recorded under the
label can never mint FRESH); package.json stays allow-listed with the
residual documented.

Performance: gstack-wtree seeds its temp index by COPYING the real index
(stat cache preserved — measured 40x faster than read-tree seeding, identical
hash) with read-tree fallback; evidence uses findLast and one gstack-slug
spawn; the stream pump honors backpressure via drain; careful's pattern block
short-circuits before slug resolution when no pattern file exists.

Testing: the gh-failure envelope test was VACUOUS (killing PATH killed the
bun shebang before the code under test ran) — replaced with a PATH gh shim
that exercises the real branch, plus shimmed happy paths (issue/pr-body/
unparseable JSON); evidence check --all + empty ledger + non-numeric
--max-age (now a usage error, was silent fail-open) covered; HIGH-tier
variants pinned; hook analytics respect GSTACK_HOME so tests stop writing the
operator's real skill-usage.jsonl.

Maintainability: dead exit ternary removed; flagValue deduped into
bin-context; sentinel defusal derived from the banner constants (no invisible
literals — \u escapes only); scratch-repo git fixture extracted to
test/helpers/scratch-repo.ts (one hermetic incantation, three consumers);
shared gstack_hook_log_fire in hook-extract.sh; the dashboard/land diff-scoped
row lists are aligned (codex-review) and drift-pinned.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-16 08:19:14 -07:00
co-authored by Claude Fable 5
parent 2398fb7295
commit a171029e6b
27 changed files with 470 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
document-release/sections/release-body.md
+13 -2
View File
@@ -220,13 +220,18 @@ near the write-back.
**If GitHub:**
```bash
gh pr view --json body -q .body > /tmp/gstack-pr-body-$$.md
cp /tmp/gstack-pr-body-$$.md /tmp/gstack-pr-body-orig-$$.md
```
**If GitLab:**
```bash
glab mr view -F json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('description',''))" > /tmp/gstack-pr-body-$$.md
cp /tmp/gstack-pr-body-$$.md /tmp/gstack-pr-body-orig-$$.md
```
(The `-orig` snapshot feeds the write-side banner tripwire at step 4b — it
distinguishes markup WE added from text that was already in the body.)
1b. Read the body FOR CONTEXT through the trust envelope (this is the copy you
read; the raw tempfile is the copy the pipeline edits):
@@ -275,7 +280,13 @@ REDACT_VIS=$(~/.claude/skills/gstack/bin/gstack-config get redact_repo_visibilit
reach the live PR/MR. If the composed section leaked it, ABORT the update:
```bash
if grep -q "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md; then
# Compare against the fetched original: only a NEW banner occurrence aborts.
# (A hostile body that already contained the literal banner string must not
# permanently DoS every future doc update — pre-existing occurrences pass
# through unchanged; only markup WE would be adding trips the wire.)
_ORIG_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md 2>/dev/null || echo 0)
_NEW_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md 2>/dev/null || echo 0)
if [ "$_NEW_BANNERS" -gt "$_ORIG_BANNERS" ]; then
echo "ABORT: envelope banner leaked into the outgoing PR/MR body — recompose the Documentation section from your own outputs, not from the enveloped rendering." >&2
else
echo "banner tripwire clean"
@@ -301,7 +312,7 @@ MRBODY
5. Clean up the tempfile:
```bash
rm -f /tmp/gstack-pr-body-$$.md
rm -f /tmp/gstack-pr-body-$$.md /tmp/gstack-pr-body-orig-$$.md
```
6. If `gh pr view` / `glab mr view` fails (no PR/MR exists): skip with message "No PR/MR found — skipping body update."
document-release/sections/release-body.md.tmpl
+13 -2
View File
@@ -218,13 +218,18 @@ near the write-back.
**If GitHub:**
```bash
gh pr view --json body -q .body > /tmp/gstack-pr-body-$$.md
cp /tmp/gstack-pr-body-$$.md /tmp/gstack-pr-body-orig-$$.md
```
**If GitLab:**
```bash
glab mr view -F json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('description',''))" > /tmp/gstack-pr-body-$$.md
cp /tmp/gstack-pr-body-$$.md /tmp/gstack-pr-body-orig-$$.md
```
(The `-orig` snapshot feeds the write-side banner tripwire at step 4b — it
distinguishes markup WE added from text that was already in the body.)
1b. Read the body FOR CONTEXT through the trust envelope (this is the copy you
read; the raw tempfile is the copy the pipeline edits):
@@ -273,7 +278,13 @@ REDACT_VIS=$(~/.claude/skills/gstack/bin/gstack-config get redact_repo_visibilit
reach the live PR/MR. If the composed section leaked it, ABORT the update:
```bash
if grep -q "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md; then
# Compare against the fetched original: only a NEW banner occurrence aborts.
# (A hostile body that already contained the literal banner string must not
# permanently DoS every future doc update — pre-existing occurrences pass
# through unchanged; only markup WE would be adding trips the wire.)
_ORIG_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md 2>/dev/null || echo 0)
_NEW_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md 2>/dev/null || echo 0)
if [ "$_NEW_BANNERS" -gt "$_ORIG_BANNERS" ]; then
echo "ABORT: envelope banner leaked into the outgoing PR/MR body — recompose the Documentation section from your own outputs, not from the enveloped rendering." >&2
else
echo "banner tripwire clean"
@@ -299,7 +310,7 @@ MRBODY
5. Clean up the tempfile:
```bash
rm -f /tmp/gstack-pr-body-$$.md
rm -f /tmp/gstack-pr-body-$$.md /tmp/gstack-pr-body-orig-$$.md
```
6. If `gh pr view` / `glab mr view` fails (no PR/MR exists): skip with message "No PR/MR found — skipping body update."