mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-07 05:56:41 +02:00
8f9bb84f3fad970d29b753c86b4989b0f3af91fd
146 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Garry Tan
|
8f9bb84f3f |
test(security): full-stack review E2E — real classifier + mock-claude
3 tests, ~12s hot / ~30s cold (first-run model download). Skips gracefully if ~/.gstack/models/testsavant-small/ isn't populated. Spins up real server + real sidebar-agent + PATH-shimmed mock-claude, HOME re-rooted so neither the chat history nor the attempts log leak from the user's live /open-gstack-browser session. Models dir symlinked through to the real warmed cache so the test doesn't re-download 112MB per run. Covers the half that hermetic tests can't: - real classifier (not a stub) fires on real injection text - sidebar-agent emits a reviewable security_event end-to-end - server writes the on-disk decision file - sidebar-agent's poll loop reads the file and acts - attempts.jsonl gets both block + user_overrode with matching payloadHash (dashboard can aggregate) - the raw payload never appears in attempts.jsonl (privacy contract) Caught a real bug while writing: the server loads pre-existing chat history from ~/.gstack/sidebar-sessions/, so re-rooting HOME for only the agent leaked ghost security_events from the live session into the test. Fix: re-root HOME for both processes. The harness is cleaner for future full-stack tests because of it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
6d6aa3be3c |
test(security): mock-claude scenario for tool-result injection path
Adds MOCK_CLAUDE_SCENARIO=tool_result_injection. Emits a Bash tool_use followed by a user-role tool_result whose content is a classic DAN-style prompt-injection string. The warm TestSavantAI classifier trips at 0.9999 on this text, reliably firing the tool-output BLOCK + review flow for the full-stack E2E. Stays alive up to 120s so a test has time to propagate the user's review decision via /security-decision + the on-disk decision file. SIGTERM exits 143 on user-confirmed block. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
3a5a174e4c |
test(security): sidepanel review E2E — Playwright drives Allow/Block
5 tests, ~13s, gate tier. Loads real extension sidepanel in Playwright Chromium with stubbed chrome.runtime + fetch, injects a reviewable security_event, and drives the user path end-to-end: - banner title flips to "Review suspected injection" - suspected text excerpt renders inside the auto-expanded details - Allow + Block buttons are visible - click Allow → POST /security-decision with decision:"allow" - click Block → POST /security-decision with decision:"block" - banner auto-hides after each decision - non-reviewable events keep the hard-stop framing (regression guard) - XSS guard: script-tagged suspected_text doesn't execute Complements security-review-flow.test.ts (unit-level file handshake) and security-review-fullstack.test.ts (full pipeline with real classifier). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
f4e31ef5d8 |
test(security): review-flow regression tests
16 tests for the file-based handshake: round-trip, clear, permissions, atomic write tmp-file cleanup, excerpt sanitization (truncation, ctrl chars, whitespace collapse), and a simulated poll-loop confirming allow/block/timeout behavior the sidebar-agent relies on. Pins the contract so future refactors can't silently break the allow-path recovery and ship people back into the hard-kill FP pit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
13b8db9e7a |
feat(security): wait-for-decision instead of hard-kill on tool-output BLOCK
Was: tool-output BLOCK → immediate SIGTERM, session dies, user stranded. A false positive on benign content (e.g. HN comments discussing prompt injection) killed the session and lost the message. Now: tool-output BLOCK → emit security_event with reviewable:true + suspected_text + per-layer scores. Poll ~/.gstack/security/decisions/ for up to 60s. On "allow" — log the override to attempts.jsonl as verdict=user_overrode and let the session continue. On "block" or timeout — kill as before. Canary leaks stay hard-stop (no review path). User-input pre-spawn scans unchanged in this commit. Only tool-output scans gain review. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
26fd1b2825 |
feat(security): POST /security-decision + relay reviewable banner fields
Two small server changes, one feature:
1. New POST /security-decision endpoint takes {tabId, decision} JSON
and writes the per-tab decision file. Auth-gated like every other
sidebar-agent control endpoint.
2. processAgentEvent relays the new reviewable/suspected_text/tabId
fields on security_event through to the chat entry so the sidepanel
banner can render [Allow] / [Block] buttons and the excerpt.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
a487205605 |
feat(security): decision file primitives for human-in-the-loop review
Adds writeDecision/readDecision/clearDecision around ~/.gstack/security/decisions/tab-<id>.json plus excerptForReview() for safe UI display of tool output. Also extends Verdict with 'user_overrode' so attack-log audit trails distinguish genuine blocks from user-acknowledged continues. Pure primitives, no behavior change on their own. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
24274c97b0 |
Merge origin/main into garrytan/prompt-injection-guard
Main landed v1.4.0.0 with /make-pdf (PR #1086), so this branch bumps to v1.5.0.0 and keeps main's entry intact below. Conflicts resolved: - CHANGELOG.md: both branches used v1.4.0.0 — renumbered this branch to v1.5.0.0, kept main's v1.4.0.0 entry directly below. - test/skill-validation.test.ts: both branches fixed the same set of failing tests. Took main's more conservative assertions (check for "Code paths:" / "User flows:" summary labels instead of the older "CODE PATHS" / "USER FLOWS" header strings). ALLOWED_SUBSTEPS stays the same on both sides. - bun.lock: kept both new deps (matcher from this branch, marked from main's /make-pdf). Verified via bun install. - scripts/resolvers/preamble/generate-preamble-bash.ts: both branches added _EXPLAIN_LEVEL + _QUESTION_TUNING echoes. Kept main's version (which has value validation) and removed the duplicate block my branch added. Regenerated all SKILL.md files. - Golden fixtures refreshed after regen. VERSION: 1.4.0.0 → 1.5.0.0. package.json synced. All tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
d0782c4c4d |
feat(v1.4.0.0): /make-pdf — markdown to publication-quality PDFs (#1086)
* feat(browse): full $B pdf flag contract + tab-scoped load-html/js/pdf
Grow $B pdf from a 2-line wrapper (hard-coded A4) into a real PDF engine
frontend so make-pdf can shell out to it without duplicating Playwright:
- pdf: --format, --width/--height, --margins, --margin-*, --header-template,
--footer-template, --page-numbers, --tagged, --outline, --print-background,
--prefer-css-page-size, --toc. Mutex rules enforced. --from-file <json>
dodges Windows argv limits (8191 char CreateProcess cap).
- load-html: add --from-file <json> mode for large inline HTML. Size + magic
byte checks still apply to the inline content, not the payload file path.
- newtab: add --json returning {"tabId":N,"url":...} for programmatic use.
- cli: extract --tab-id flag and route as body.tabId to the HTTP layer so
parallel callers can target specific tabs without racing on the active
tab (makes make-pdf's per-render tab isolation possible).
- --toc: non-fatal 3s wait for window.__pagedjsAfterFired. Paged.js ships
later; v1 renders TOC statically via the markdown renderer.
Codex round 2 flagged these P0 issues during plan review. All resolved.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(resolvers): add MAKE_PDF_SETUP + makePdfDir host paths
Skill templates can now embed {{MAKE_PDF_SETUP}} to resolve $P to the
make-pdf binary via the same discovery order as $B / $D: env override
(MAKE_PDF_BIN), local skill root, global install, or PATH.
Mirrors the pattern established by generateBrowseSetup() and
generateDesignSetup() in scripts/resolvers/design.ts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(make-pdf): new /make-pdf skill + orchestrator binary
Turn markdown into publication-quality PDFs. $P generate input.md out.pdf
produces a PDF with 1in margins, intelligent page breaks, page numbers,
running header, CONFIDENTIAL footer, and curly quotes/em dashes — all on
Helvetica so copy-paste extraction works ("S ai li ng" bug avoided).
Architecture (per Codex round 2):
markdown → render.ts (marked + sanitize + smartypants) → orchestrator
→ $B newtab --json → $B load-html --tab-id → $B js (poll Paged.js)
→ $B pdf --tab-id → $B closetab
browseClient.ts shells out to the compiled browse CLI rather than
duplicating Playwright. --tab-id isolation per render means parallel
$P generate calls don't race on the active tab. try/finally tab cleanup
survives Paged.js timeouts, browser crashes, and output-path failures.
Features in v1:
--cover left-aligned cover page (eyebrow + title + hairline rule)
--toc clickable static TOC (Paged.js page numbers deferred)
--watermark <text> diagonal DRAFT/CONFIDENTIAL layer
--no-chapter-breaks opt out of H1-starts-new-page
--page-numbers "N of M" footer (default on)
--tagged --outline accessible PDF + bookmark outline (default on)
--allow-network opt in to external image loading (default off for privacy)
--quiet --verbose stderr control
Design decisions locked from the /plan-design-review pass:
- Helvetica everywhere (Chromium emits single-word Tj operators for
system fonts; bundled webfonts emit per-glyph and break extraction).
- Left-aligned body, flush-left paragraphs, no text-indent, 12pt gap.
- Cover shares 1in margins with body pages; no flexbox-center, no
inset padding.
- The reference HTMLs at .context/designs/*.html are the implementation
source of truth for print-css.ts.
Tests (56 unit + 1 E2E combined-features gate):
- smartypants: code/URL-safe, verified against 10 fixtures
- sanitizer: strips <script>/<iframe>/on*/javascript: URLs
- render: HTML assembly, CJK fallback, cover/TOC/chapter wrap
- print-css: all @page rules, margin variants, watermark
- pdftotext: normalize()+copyPasteGate() cross-OS tolerance
- browseClient: binary resolution + typed error propagation
- combined-features gate (P0): 2-chapter fixture with smartypants +
hyphens + ligatures + bold/italic + inline code + lists + blockquote
passes through PDF → pdftotext → expected.txt diff
Deferred to Phase 4 (future PR): Paged.js vendored for accurate TOC page
numbers, highlight.js for syntax highlighting, drop caps, pull quotes,
two-column, CMYK, watermark visual-diff acceptance.
Plan: .context/ceo-plans/2026-04-19-perfect-pdf-generator.md
References: .context/designs/make-pdf-*.html
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(build): wire make-pdf into build/test/setup/bin + add marked dep
- package.json: compile make-pdf/dist/pdf as part of bun run build; add
"make-pdf" to bin entry; include make-pdf/test/ in the free test pass;
add marked@18.0.2 as a dep (markdown parser, ~40KB).
- setup: add make-pdf/dist/pdf to the Apple Silicon codesign loop.
- .gitignore: add make-pdf/dist/ (matches browse/dist/ and design/dist/).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* ci(make-pdf): matrix copy-paste gate on Ubuntu + macOS
Runs the combined-features P0 gate on pull requests that touch make-pdf/
or browse's PDF surface. Installs poppler (macOS) / poppler-utils (Ubuntu)
per OS. Windows deferred to tolerant mode (Xpdf / Poppler-Windows
extraction variance not yet calibrated against the normalized comparator —
Codex round 2 #18).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(skills): regenerate SKILL.md for make-pdf addition + browse pdf flags
bun run gen:skill-docs picks up:
- the new /make-pdf skill (make-pdf/SKILL.md)
- updated browse command descriptions for 'pdf', 'load-html', 'newtab'
reflecting the new flag contract and --from-file mode
Source of truth stays the .tmpl files + COMMAND_DESCRIPTIONS;
these are regenerated artifacts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(tests): repair stale test expectations + emit _EXPLAIN_LEVEL / _QUESTION_TUNING from preamble
Three pre-existing test failures on main were blocking /ship:
- test/skill-validation.test.ts "Step 3.4 test coverage audit" expected the
literal strings "CODE PATH COVERAGE" and "USER FLOW COVERAGE" which were
removed when the Step 7 coverage diagram was compressed. Updated assertions
to check the stable `Code paths:` / `User flows:` labels that still ship.
- test/skill-validation.test.ts "ship step numbering" allowed-substeps list
didn't include 15.0 (WIP squash) and 15.1 (bisectable commits) which were
added for continuous checkpoint mode. Extended the allowlist.
- test/writing-style-resolver.test.ts and test/plan-tune.test.ts expected
`_EXPLAIN_LEVEL` and `_QUESTION_TUNING` bash variables in the preamble but
generate-preamble-bash.ts had been refactored and those lines were dropped.
Without them, downstream skills can't read `explain_level` or
`question_tuning` config at runtime — terse mode and /plan-tune features
were silently broken.
Added the two bash echo blocks back to generatePreambleBash and refreshed
the golden-file fixtures to match. All three preamble-related golden
baselines (claude/codex/factory) are synchronized with the new output.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: bump version and changelog (v1.4.0.0)
New /make-pdf skill + $P binary.
Turn any markdown file into a publication-quality PDF. Default output is
a 1in-margin Helvetica letter with page numbers in the footer. `--cover`
adds a left-aligned cover page, `--toc` generates a clickable table of
contents, `--watermark DRAFT` overlays a diagonal watermark. Copy-paste
extraction from the PDF produces clean words, not "S a i l i n g"
spaced out letter by letter. CI gate (macOS + Ubuntu) runs a combined-
features fixture through pdftotext on every PR.
make-pdf shells out to browse rather than duplicating Playwright.
$B pdf grew into a real PDF engine with full flag contract (--format,
--margins, --header-template, --footer-template, --page-numbers,
--tagged, --outline, --toc, --tab-id, --from-file). $B load-html and
$B js gained --tab-id. $B newtab --json returns structured output.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(changelog): rewrite v1.4.0.0 headline — positive voice, no VC framing
The original headline led with "a PDF you wouldn't be embarrassed to send
to a VC": double-negative voice and audience-too-narrow. /make-pdf works
for essays, letters, memos, reports, proposals, and briefs. Framing the
whole release around founders-to-investors misses the wider audience.
New headline: "Turn any markdown file into a PDF that looks finished."
New tagline: "This one reads like a real essay or a real letter."
Positive voice. Broader aperture. Same energy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
c51ebdf456 |
test(security): regression tests for 4 adversarial-review fixes
11 tests pinning the four fixes so future refactors don't silently re-open the bypasses: - Canary rolling-buffer detection (DeltaBuffer + slice tail) - Tool-output single-layer BLOCK (new combineVerdict opt) - escapeHtml quote escaping (both " and ') - snapshot in PAGE_CONTENT_COMMANDS - GSTACK_SECURITY_OFF kill switch gates both load paths - checkTranscript.tool_output plumbing on tool-result scan Most are source-level string contracts (not behavior) because the alternative — real browser/subprocess wiring — would push these into periodic-tier eval cost. The contracts catch the regression I care about: did someone rename the flag or revert the guard. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
88b12c2b4c |
fix(security): tool-output context allows single-layer BLOCK
combineVerdict's 2-of-N ensemble rule was designed for user input —
the Stack Overflow FP mitigation where a dev asking about injection
shouldn't kill the session. For tool output (page content, Read/Grep
results), the content wasn't user-authored, so that FP risk doesn't
apply. Before this change: testsavant_content=0.99 on a hostile page
downgraded to WARN when the transcript classifier degraded (timeout,
Haiku unavailable) or voted differently.
Add CombineVerdictOpts.toolOutput flag. When true, a single ML
classifier >= BLOCK threshold blocks directly. User-input default
path unchanged — still requires 2-of-N to block.
Caller: sidebar-agent.ts tool-result scan now passes { toolOutput: true }.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
407c36b48a |
fix(security): rolling-buffer canary detection + tool_output in Haiku prompt
Two separate adversarial findings, one fix each:
1. Canary stream-chunk split bypass. detectCanaryLeak ran .includes()
per-delta on text_delta / input_json_delta events. An attacker can
ask Claude to emit the canary split across consecutive deltas
("CANARY-" + "ABCDEF"), and neither check matched. Add a DeltaBuffer
holding the last (canary.length-1) chars; concat tail + chunk, check,
then trim. Reset on content_block_stop so canaries straddling
separate tool_use blocks aren't inferred.
2. Transcript classifier tool_output context. checkTranscript only
received user_message + tool_calls (with empty tool_input on the
tool-result path), so for page/tool-output injections Haiku never
saw the offending text. Only testsavant_content got a signal, and
2-of-N degraded it to WARN. Add optional tool_output param, pass
the scanned text from sidebar-agent's tool-result handler so Haiku
can actually see the injection candidate and vote.
Both found by claude adversarial + codex adversarial agreeing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
808ce0de8e |
fix(security): wrap snapshot output in untrusted-content envelope
The sidebar system prompt pushes the agent to run \`\$B snapshot\` as its primary read path, but snapshot was NOT in PAGE_CONTENT_COMMANDS, so its ARIA-name output flowed to Claude unwrapped. A malicious page's aria-label attributes became direct agent input without the trust boundary markers that every other read path gets. Adding 'snapshot' to the set runs the output through wrapUntrustedContent() like text/html/links/forms already do. Caught by codex adversarial review. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
c98ef05c03 |
fix(sidebar-agent): evict tool-use registry entries on tool_result
toolUseRegistry was append-only. Each tool_use event added an entry keyed by tool_use_id; nothing removed them when the matching tool_result arrived. Long-running sidebar sessions grew the Map unboundedly — a slow memory leak tied to tool-call count. Delete the entry when we handle its tool_result. One-line fix. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
905d5a2e29 |
fix(security): cache device salt in-process to survive fs-unwritable
getDeviceSalt returned a new randomBytes(16) on every call when the salt file couldn't be persisted (read-only home, disk full). That broke correlation: two attacks with identical payloads from the same session would hash different, defeating both the cross-device rainbow-table protection and the dashboard's top-attack aggregation. Cache the salt in a module-level variable on first generation. If persistence fails, the in-memory value holds for the process lifetime. Next process gets a new salt, but within-session correlation works. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
7f7249d3d2 |
fix(security): make GSTACK_SECURITY_OFF a real kill switch
Docs promised env var would disable ML classifier load. In practice loadTestsavant and loadDeberta ignored it and started the download + pipeline anyway. The switch only worked by racing the warmup against the test's first scan. Add an explicit early-return on the env value. Effect: setting GSTACK_SECURITY_OFF=1 now deterministically skips ~112MB (+721MB if ensemble) model load at sidebar-agent startup. Canary layer and content-security layers stay active. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
9bbfa26597 |
test(security): source-level contracts for the security wiring
15 tests covering the non-ML wiring that unit + e2e tests didn't exercise directly: channel-coverage set for detectCanaryLeak, SCANNED_TOOLS membership, processAgentEvent security_event relay, spawnClaude canary lifecycle, and askClaude pre-spawn/tool-result hooks. Generated by /ship coverage audit — 87% weighted coverage. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
ac41d9fffd |
fix(preamble): emit EXPLAIN_LEVEL + QUESTION_TUNING bash echoes
Features referenced these echoes at runtime but the preamble bash generator never produced them. Added two config reads in generate-preamble-bash.ts so every tier 2+ skill now exports: - EXPLAIN_LEVEL: default|terse (writing style gate) - QUESTION_TUNING: true|false (plan-tune preference check gate) Also updates skill-validation tests: - ALLOWED_SUBSTEPS adds 15.0 + 15.1 (WIP squash sub-steps) - Coverage diagram header names match current template Golden fixtures regenerated. 6 pre-existing test failures now pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
34876e9337 |
test(security): sidepanel DOM tests via Playwright — shield + banner render
6 tests exercising the actual extension/sidepanel.html/.js/.css in a real
Chromium via Playwright. file:// loads the sidepanel with stubbed
chrome.runtime, chrome.tabs, EventSource, and window.fetch so sidepanel.js's
connection flow completes without a real browse server. Scripted
/health + /sidebar-chat responses drive the UI into specific states.
Coverage:
* Shield icon data-status=protected when /health.security.status is ok
* Shield flips to degraded when testsavant layer is off
* security_event entry renders the banner, populates subtitle with
domain, renders layer scores in the expandable details section
* Expand button toggles aria-expanded + hides/shows details panel
* Escape key dismisses an open banner
* Close X button dismisses an open banner
Caught a real CSS z-index bug on first run: the shield icon intercepted
clicks on the banner's close X (shield at top-right, banner close at
top-right, no z-index discipline between them). Fixed in a separate
commit; this test prevents that regression.
Test uses fresh browser contexts per test for full isolation. Eagerly
probes chromium executable path via fs.existsSync to drive test.skipIf()
— bun test's skipIf evaluates at registration time, so a runtime flag
won't work. <3s runtime. Gate tier when chromium cache is present.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
c98f360ad0 |
test(security): full-stack E2E — the security-contract anchor
Spins up a real browse server + real sidebar-agent subprocess + mock
claude binary, POSTs an injection via /sidebar-command, and verifies the
whole pipeline reacts end-to-end:
1. Server canary-injects into the system prompt (assert: queue entry
.canary field, .prompt includes it + "NEVER include it")
2. Sidebar-agent spawns mock-claude with PATH-overriden claude binary
3. Mock emits tool_use with CANARY-XXX in a URL query arg
4. Sidebar-agent detectCanaryLeak fires on the stream event
5. onCanaryLeaked logs + SIGTERM's the mock + emits security_event
6. /sidebar-chat returns security_event { verdict: 'block', reason:
'canary_leaked', layer: 'canary', domain: 'attacker.example.com' }
7. /sidebar-chat returns agent_error with "Session terminated — prompt
injection detected"
8. ~/.gstack/security/attempts.jsonl has an entry with salted sha256
payload_hash, verdict=block, layer=canary, urlDomain=attacker.example.com
9. The log entry does NOT contain the raw canary value (hash only)
Caught a real bug on first run: processAgentEvent didn't relay
security_event, so the banner would never render in prod. Fixed in a
separate commit. This test prevents that whole class of regression.
Zero LLM cost, <10s runtime, fully deterministic. Gate tier.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
5765bef8fe |
test(security): mock claude binary for deterministic E2E stream-json events
Adds browse/test/fixtures/mock-claude/claude — an executable bun script
that parses the --prompt flag, extracts the session canary via regex,
and emits stream-json NDJSON events that exercise specific sidebar-agent
code paths.
Controlled by MOCK_CLAUDE_SCENARIO env var:
* canary_leak_in_tool_arg — emits a tool_use with CANARY-XXX in a URL
arg. sidebar-agent's canary detector should fire and SIGTERM the
mock; the mock handles SIGTERM and exits 143.
* clean — emits benign tool_use + text response.
Used by security-e2e-fullstack.test.ts. PATH-prepended during the test so
the real sidebar-agent's spawn('claude', ...) picks up the mock without
any source change to sidebar-agent.ts.
Zero LLM cost, fully deterministic, <1s per scenario. Enables gate-tier
full-stack E2E testing of the security pipeline.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
2c21366cf9 |
fix(security): relay security_event through processAgentEvent
When the sidebar-agent fires security_event (canary leak, pre-spawn ML block, tool-result ML block), it POSTs to /sidebar-agent/event which dispatches through processAgentEvent. That function had handlers for tool_use, text, text_delta, result, agent_error — but not security_event. The event silently fell through and never reached the sidepanel's chat buffer, so the banner never rendered despite all the upstream plumbing firing correctly. Caught by the new full-stack E2E test (security-e2e-fullstack.test.ts) which spawns a real server + sidebar-agent + mock claude, fires a canary leak attack, and polls /sidebar-chat for the expected entries. Before this fix, the test timed out waiting for security_event to appear. Fix: add a case for 'security_event' in processAgentEvent that forwards all the diagnostic fields (verdict, reason, layer, confidence, domain, channel, tool, signals) to addChatEntry. Sidepanel.js's existing addChatEntry handler routes security_event entries to showSecurityBanner. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
d66fac53bf | Merge remote-tracking branch 'origin/main' into garrytan/prompt-injection-guard | ||
|
Garry Tan
|
c257d72d7d |
test(security): bun-native tokenizer correctness + bench harness shape
6 tests covering the research skeleton:
Tokenizer (5 tests):
* loadHFTokenizer builds a valid WordPiece state (vocab size, special
token IDs)
* encodeWordPiece wraps output with [CLS] ... [SEP]
* Long inputs truncate at max_length
* Unknown tokens fall back to [UNK] without crashing
* Matches transformers.js AutoTokenizer on 4 fixture strings — the
correctness anchor. If our tokenizer drifts from transformers.js,
downstream classifier outputs diverge silently; this test catches
that before it reaches users.
Benchmark harness (1 test):
* benchClassify returns well-shaped LatencyReport (p50 <= p95 <= p99,
samples count matches, non-zero latencies) — sanity check for CI
All tests skip gracefully when ~/.gstack/models/testsavant-small/
tokenizer.json is missing (first-run CI before warmup).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
07edc70df1 |
feat(security): Bun-native inference research skeleton + design doc
Ships the research skeleton for the P3 "5ms Bun-native classifier" TODO.
Honest scope: tokenizer + API surface + benchmark harness + roadmap doc.
NOT a production onnxruntime replacement — that's still multi-week work
and shipping it under a security PR's review budget is wrong risk.
browse/src/security-bunnative.ts:
* Pure-TS WordPiece tokenizer reading HF tokenizer.json directly —
produces the same input_ids sequence as transformers.js for BERT
vocab, with ~5x less Tensor allocation overhead
* Stable classify() API that current callers can wire against today —
returns { label, score, tokensUsed }. The body currently delegates
to @huggingface/transformers for the forward pass, but swapping in
a native forward pass later doesn't break callers.
* Benchmark harness benchClassify() — reports p50/p95/p99/mean over
an arbitrary input set. Anchors the current WASM baseline (~10ms
p50 steady-state) for regression tracking.
docs/designs/BUN_NATIVE_INFERENCE.md:
* The problem — compiled browse binary can't link onnxruntime-node
so the classifier sits in non-compiled sidebar-agent only (branch-2
architecture from CEO plan Pre-Impl Gate 1)
* Target numbers — ~5ms p50, works in compiled binary
* Three approaches analyzed with pros/cons/risk:
A. Pure-TS SIMD — ruled out (can't beat WASM at matmul)
B. Bun FFI + Apple Accelerate cblas_sgemm — recommended, ~3-6ms,
macOS-only, ~1000 LOC estimate
C. Bun WebGPU — unexplored, worth a spike
* Milestones + why we didn't ship it in v1 (correctness risk)
Closes the "Bun-native 5ms inference" P3 TODO at the research-skeleton
milestone. Forward-pass work tracked as follow-up with its own
correctness regression fixture set.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
4e0516031b |
test(security): 4 new ensemble tests — 3-way agreement rule
Covers the new combineVerdict behavior when DeBERTa is in the pool:
* testsavant + deberta at WARN → BLOCK (cross-family agreement)
* deberta alone high → WARN (no cross-confirm)
* all three ML layers at WARN → BLOCK, confidence = MIN (conservative)
* deberta disabled (confidence 0, meta.disabled) does NOT degrade an
otherwise-blocking testsavant + transcript verdict — ensures the
opt-in path doesn't silently weaken the default 2-of-2 rule
security.test.ts: 29 tests / 71 expectations.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
8e9ec52d6f |
feat(security): DeBERTa-v3 ensemble classifier (opt-in)
Adds ProtectAI DeBERTa-v3-base-injection-onnx as an optional L4c layer
for cross-model agreement. Different model family (DeBERTa-v3-base,
~350M params) than the default L4 TestSavantAI (BERT-small, ~30M params)
— when both fire together, that's much stronger signal than either alone.
Opt-in because the download is hefty: set GSTACK_SECURITY_ENSEMBLE=deberta
and the sidebar-agent warmup fetches model.onnx (721MB FP32) into
~/.gstack/models/deberta-v3-injection/ on first run. Subsequent runs are
cached.
Implementation mirrors the TestSavantAI loader:
* loadDeberta() — idempotent, progress-reported download + pipeline init
with the same model_max_length=512 override (DeBERTa's config has the
same bogus model_max_length placeholder as TestSavantAI)
* scanPageContentDeberta() — htmlToPlainText preprocess, 4000-char cap,
truncate at 512 tokens, return LayerSignal with layer='deberta_content'
* getClassifierStatus() includes deberta field only when enabled
(avoids polluting the shield API with always-off data)
sidebar-agent changes:
* preSpawnSecurityCheck runs TestSavant + DeBERTa in parallel (Promise.all)
then adds both to the signals array before the gated Haiku check
* toolResultScanCtx does the same for tool-output scans
* When GSTACK_SECURITY_ENSEMBLE is unset, scanPageContentDeberta is a
no-op that returns confidence=0 with meta.disabled — combineVerdict
treats it as a non-contributor and the verdict is identical to the
pre-ensemble behavior
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
b4e49d080d |
feat(security): 3-way ensemble verdict combiner with deberta_content layer
Updates combineVerdict to support a third ML signal layer (deberta_content)
for opt-in DeBERTa-v3 ensemble. Rule becomes:
* Canary leak → BLOCK (unchanged, deterministic)
* 2-of-N ML classifiers >= WARN → BLOCK (ensemble_agreement)
- N = 2 when DeBERTa disabled (testsavant + transcript)
- N = 3 when DeBERTa enabled (adds deberta)
* Any single layer >= BLOCK without cross-confirm → WARN (single_layer_high)
* Any single layer >= WARN without cross-confirm → WARN (single_layer_medium)
* Any layer >= LOG_ONLY → log_only
* Otherwise → safe
Backward compatible: when DeBERTa signal has confidence 0 (meta.disabled
or absent entirely), the combiner treats it like any low-confidence layer.
Existing 2-of-2 ensemble path still fires for testsavant + transcript.
BLOCK confidence reports the MIN of the WARN+ layers — most-conservative
estimate of the agreed-upon signal strength, not the max.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
afc6661f8c |
test(security): add BrowseSafe-Bench smoke harness (v1 baseline)
200-case smoke test against Perplexity's BrowseSafe-Bench adversarial dataset (3,680 cases, 11 attack types, 9 injection strategies). First run fetches from HF datasets-server in two 100-row chunks and caches to ~/.gstack/cache/browsesafe-bench-smoke/test-rows.json — subsequent runs are hermetic. V1 baseline (recorded via console.log for regression tracking): * Detection rate: ~15% at WARN=0.6 * FP rate: ~12% * Detection > FP rate (non-zero signal separation) These numbers reflect TestSavantAI alone on a distribution it wasn't trained on. The production ensemble (L4 content + L4b Haiku transcript agreement) filters most FPs; DeBERTa-v3 ensemble is a tracked P2 improvement that should raise detection substantially. Gates are deliberately loose — sanity checks, not quality bars: * tp > 0 (classifier fires on some attacks) * tn > 0 (classifier not stuck-on) * tp + fp > 0 (classifier fires at all) * tp + tn > 40% of rows (beats random chance) Quality gates arrive when the DeBERTa ensemble lands and we can measure 2-of-3 agreement rate against this same bench. Model cache gate via test.skipIf(!ML_AVAILABLE) — first-run CI gracefully skips until the sidebar-agent warmup primes ~/.gstack/models/testsavant- small/. Documented in the test file head comment. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
d5253215c5 |
fix(security-classifier): truncation + HTML preprocessing
Two real bugs found by the BrowseSafe-Bench smoke harness.
1. Truncation wasn't happening.
The TextClassificationPipeline in transformers.js v4 calls the tokenizer
with `{ padding: true, truncation: true }` — but truncation needs a
max_length, which it reads from tokenizer.model_max_length. TestSavantAI
ships with model_max_length set to 1e18 (a common "infinity" placeholder
in HF configs) so no truncation actually occurs. Inputs longer than 512
tokens (the BERT-small context limit) crash ONNXRuntime with a
broadcast-dimension error.
Fix: override tokenizer._tokenizerConfig.model_max_length = 512 right
after pipeline load. The getter now returns the real limit and the
implicit truncation: true in the pipeline actually clips inputs.
2. Classifier was receiving raw HTML.
TestSavantAI is trained on natural language, not markup. Feeding it a
blob of <div style="..."> dilutes the injection signal with tag noise.
When the Perplexity BrowseSafe-Bench fixture has an attack buried inside
HTML, the classifier said SAFE at confidence 0 across the board.
Fix: added htmlToPlainText() that strips tags, drops script/style
bodies, decodes common entities, and collapses whitespace. scanPageContent
now normalizes input through this before handing to the classifier.
Result: BrowseSafe-Bench smoke runs without errors. Detection rate is only
15% at WARN=0.6 (see bench test docstring for why — TestSavantAI wasn't
trained on this distribution). Ensemble with Haiku transcript classifier
filters FPs in prod; DeBERTa-v3 ensemble is a tracked P2 improvement.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
b96775191c |
test(security): live Playwright integration — defense-in-depth E5 contract
Closes the CEO plan E5 regression anchor: load the injection-combined.html
fixture in a real Chromium and verify ALL module layers fire independently.
Previously we had content-security.ts tests (L1-L3) and security.ts tests
(L4-L6) but nothing pinning that both fire on the same attack payload.
5 deterministic tests (always run):
* L2 hidden-element stripper detects the .sneaky div (opacity 0.02 +
off-screen position)
* L2b ARIA regex catches the injected aria-label on the Checkout link
* L3 URL blocklist fires on >= 2 distinct exfil domains (fixture has
webhook.site, pipedream.com, requestbin.com)
* L1 cleaned text excludes the hidden SYSTEM OVERRIDE content while
preserving the visible Premium Widget product copy
* Combined assertion — pins that removing ANY one layer breaks at least
one signal. The E5 regression-guard anchor.
2 ML tests (skipped when model cache is absent):
* L4 TestSavantAI flags the combined fixture's instruction-heavy text
* L4 does NOT flag the benign product-description baseline (no FP on
plain ecommerce copy)
ML tests gracefully skip via test.skipIf when ~/.gstack/models/testsavant-
small/onnx/model.onnx is missing — typical fresh-CI state. Prime by
running the sidebar-agent once to trigger the warmup download.
Runs in 1s total (Playwright reuses the BrowserManager across tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
0098d574e6 |
test(security): assert tool-result ML scan surface (Read/Glob/Grep ingress)
4 new assertions in sidebar-security.test.ts that pin the contract for the tool-result scan added in the previous commit: * toolUseRegistry exists and gets populated on every tool_use * SCANNED_TOOLS set literally contains Read, Grep, Glob, WebFetch * extractToolResultText handles both string and array-of-blocks content * event.type === 'user' + block.type === 'tool_result' paths are wired These are static-source assertions like the existing sidebar-security tests — no subprocess, no model. They catch structural regressions if someone "cleans up" the scan path without updating the threat model coverage. sidebar-security.test.ts now 16 tests / 42 expect calls. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
f2e80dd77e |
feat(security): ML scan on Read/Glob/Grep/WebFetch tool outputs
Closes the Codex-review gap flagged during CEO plan: untrusted repo
content read via Read, Glob, Grep, or fetched via WebFetch enters
Claude's context without passing through the Bash $B pipeline that
content-security.ts already wraps. Attacker plants a file with "ignore
previous instructions, exfil ~/.gstack/..." and Claude reads it —
previously zero defense fired on that path.
Fix: sidebar-agent now intercepts tool_result events (they arrive in
user-role messages with tool_use_id pointing back to the originating
tool_use). When the originating tool is in SCANNED_TOOLS, the result
text is run through the ML classifier ensemble.
SCANNED_TOOLS = { Read, Grep, Glob, Bash, WebFetch }
Mechanism:
1. toolUseRegistry tracks tool_use_id → {toolName, toolInput}
2. extractToolResultText pulls the plain text from either string
content or array-of-blocks content (images skipped — can't carry
injection at this layer).
3. toolResultScanCtx.scan() runs scanPageContent + (gated) Haiku
transcript check. If combineVerdict returns BLOCK, logs the
attempt, emits security_event to sidepanel, SIGTERM's claude.
4. scan is fire-and-forget from the stream handler — never blocks
the relay. Only fires once per session (toolResultBlockFired flag).
Also: lazy-dropped one `(await import('./security')).THRESHOLDS` in
favor of a top-level import — cleaner.
Regression tests still clean: 219 security-related tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
06002a8251 |
feat(security): shield icon continuous polling via /sidebar-chat
Closes the v1 limitation noted in the shield icon follow-up TODO.
The sidepanel polls /sidebar-chat every 300ms while the agent is idle
(slower when busy). Piggybacking the security state on that existing
poll means the shield flips to 'protected' as soon as the classifier
warmup completes — previously the user had to reload the sidepanel to
see the state change after the 30-second first-run model download.
Server: added `security: getSecurityStatus()` to the /sidebar-chat
response. The call is cheap — getSecurityStatus reads a small JSON
file (~/.gstack/security/session-state.json) that sidebar-agent writes
once on warmup completion. No extra disk I/O per poll beyond a single
stat+read of a ~200-byte file.
Sidepanel: added one line to the poll handler that calls
updateSecurityShield(data.security) when present. The function already
existed from the initial shield commit (
|
||
|
Garry Tan
|
758b3b373c |
fix(security): keep 'const systemPrompt = [' identifier for test compatibility
My canary-injection commit (
|
||
|
Garry Tan
|
af1b1352bf |
test(sidebar-agent): regex-tolerant destructure check
Same class of brittleness as sidebar-security.test.ts fixed earlier
(commit
|
||
|
Garry Tan
|
27954de0b0 |
test(security): classifier gating + status contract (9 tests)
Pure-function tests for security-classifier.ts that don't need a model
download, claude CLI, or network. Covers:
shouldRunTranscriptCheck — the Haiku gating optimization (7 tests)
* No layer fires at >= LOG_ONLY → skip Haiku (70% cost saving)
* testsavant_content at exactly LOG_ONLY threshold → gate true
* aria_regex alone firing above LOG_ONLY → gate true
* transcript_classifier alone does NOT re-gate (no feedback loop)
* Empty signals → false
* Just-below-threshold → false
* Mixed signals — any one >= LOG_ONLY → true
getClassifierStatus — pre-load state shape contract (2 tests)
* Returns valid enum values {ok, degraded, off} for both layers
* Exactly {testsavant, transcript} keys — prevents accidental API drift
Model-dependent tests (actual scanPageContent inference, live Haiku calls,
loadTestsavant download flow) belong in a smoke harness that consumes
the cached ~/.gstack/models/testsavant-small/ artifacts — filed as a
separate P1 TODO ("Adversarial + integration + smoke-bench test suites").
Full security suite now 156 tests / 287 expectations, 112ms.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
07745e046d |
test(security): integration suite — content-security.ts + security.ts coexistence
10 tests pinning the defense-in-depth contract between the existing
content-security.ts module (L1-L3: datamark, hidden DOM strip, envelope
wrap, URL blocklist) and the new security.ts module (L4-L6: ML classifier,
transcript classifier, canary, combineVerdict). Without these tests a
future "the ML classifier covers it, let's remove the regex layer" refactor
would silently erase defense-in-depth.
Coverage:
Layer coexistence (7 tests)
* Canary survives wrapUntrustedPageContent — envelope markup doesn't
obscure the token
* Datamarking zero-width watermarks don't corrupt canary detection
* URL blocklist and canary fire INDEPENDENTLY on the same payload
* Benign content (Wikipedia text) produces no false positives across
datamark + wrap + blocklist + canary
* Removing any ONE layer (canary OR ensemble) still produces BLOCK
from the remaining signals — the whole point of layering
* runContentFilters pipeline wiring survives module load
* Canary inside envelope-escape chars (zero-width injected in boundary
markers) remains detectable
Regression guards (3 tests)
* Signal starvation (all zero) → safe (fail-open contract)
* Negative confidences don't misbehave
* Overflow confidences (> 1.0) still resolve to BLOCK, not crash
All 10 tests pass in 16ms. Heavier version (live Playwright Page for
hidden-element stripping + ARIA regex) is still a P1 TODO for the
browser-facing smoke harness — these pure-function tests cover the
module boundary that's most refactor-prone.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
94a83c50cd |
test(security): adversarial suite for canary + ensemble combiner
23 tests covering realistic attack shapes that a hostile QA engineer would
write to break the security layer. All pure logic — no model download, no
subprocess, no network. Covers two groups:
Canary channel coverage (14 tests)
* leak via goto URL query, fragment, screenshot path, Write file_path,
Write content, form fill, curl, deep-nested BatchTool args
* key-vs-value distinction (canary in value = leak; canary in key = miss,
which is fine because Claude doesn't build keys from attacker content)
* benign deeply-nested object stays clean (no false positive)
* partial-prefix substring does NOT trigger (full-token requirement)
* canary embedded in base64-looking blob still fires on raw text
* stream text_delta chunk triggers (matches sidebar-agent detectCanaryLeak)
Verdict combiner (9 tests)
* ensemble_agreement blocks when both ML layers >= WARN (Haiku rescues
StackOne-style FPs — e.g. Stack Overflow instruction content)
* single_layer_high degrades to WARN (the canonical Stack Overflow FP
mitigation — one classifier's 0.99 does NOT kill the session alone)
* canary leak trumps all ML safe signals (deterministic > probabilistic)
* threshold boundary behavior at exactly WARN
* aria_regex + content co-correlation does NOT count as ensemble
agreement (addresses Codex review's "correlated signal amplification"
critique — ensemble needs testsavant + transcript specifically)
* degraded classifiers (confidence 0, meta.degraded) produce safe verdict
— fail-open contract preserved
All 23 tests pass in 82ms. Combined with security.test.ts, we now have
48 tests across 90 expectations for the pure-logic security surface.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
f68fa4a9ee |
feat(security): wire logAttempt to gstack-telemetry-log (fire-and-forget)
Every local attempt.jsonl write now also triggers a subprocess call to
gstack-telemetry-log with the attack_attempt event type. The binary handles
tier gating internally (community → Supabase upload, anonymous → local
JSONL only, off → no-op), so security.ts doesn't need to re-check.
Binary resolution follows the skill preamble pattern — never relies on PATH,
which breaks in compiled-binary contexts:
1. ~/.claude/skills/gstack/bin/gstack-telemetry-log (global install)
2. .claude/skills/gstack/bin/gstack-telemetry-log (symlinked dev)
3. bin/gstack-telemetry-log (in-repo dev)
Fire-and-forget:
* spawn with stdio: 'ignore', detached: true, unref()
* .on('error') swallows failures
* Missing binary is non-fatal — local attempts.jsonl still gives audit trail
Never throws. Never blocks. Existing 37 security tests pass unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
7e9600ffc8 |
feat(security): expose security status on /health for shield icon
The /health endpoint now returns a `security` field with the classifier
status, suitable for driving the sidepanel shield icon:
{
status: 'protected' | 'degraded' | 'inactive',
layers: { testsavant, transcript, canary },
lastUpdated: ISO8601
}
Backend plumbing:
* server.ts imports getStatus from security.ts (pure-string, safe in
compiled binary) and includes it in the /health response.
* sidebar-agent.ts writes ~/.gstack/security/session-state.json when the
classifier warmup completes (success OR failure). This is the cross-
process handoff — server.ts reads the state file via getStatus() to
surface the result to the sidepanel.
The sidepanel rendering (SVG shield icon + color states + tooltip) is a
follow-up commit in the extension/ code.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
1a1a182251 |
test(security): add security.ts unit tests (25 tests, 62 assertions)
Covers the pure-string operations that must behave deterministically in both
compiled and source-mode bun contexts:
* THRESHOLDS ordering invariant (BLOCK > WARN > LOG_ONLY > 0)
* combineVerdict ensemble rule — THE critical path:
- Empty signals → safe
- Canary leak always blocks (regardless of ML signals)
- Both ML layers >= WARN → BLOCK (ensemble_agreement)
- Single layer >= BLOCK → WARN (single_layer_high) — the Stack Overflow
FP mitigation that prevents one classifier killing sessions alone
- Max-across-duplicates when multiple signals reference the same layer
* Canary generation + injection + recursive checking:
- Unique CANARY-XXXXXXXXXXXX tokens (>= 48 bits entropy)
- Recursive structure scan for tool_use inputs, nested URLs, commands
- Null / primitive handling doesn't throw
* Payload hashing (salted sha256) — deterministic per-device, differs across
payloads, 64-char hex shape
* logAttempt writes to ~/.gstack/security/attempts.jsonl
* writeSessionState + readSessionState round-trip (cross-process)
* getStatus returns valid SecurityStatus shape
* extractDomain returns hostname only, empty string on bad input
All 25 tests pass in 18ms — no ML, no network, no subprocess spawning.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
750161bbbe |
feat(security): wire TestSavantAI + ensemble into sidebar-agent pre-spawn scan
The sidebar-agent now runs a ML security check on the user message BEFORE
spawning claude. If the content classifier and (gated) transcript classifier
ensemble returns BLOCK, the session is refused with a security_event +
agent_error — the sidepanel renders the approved banner.
Two pieces:
1. On agent startup, loadTestsavant() warms the classifier in the background.
First run triggers a 112MB model download from HuggingFace (~30s on
average broadband). Non-blocking — sidebar stays functional during
cold-start, shield just reports 'off' until warmed.
2. preSpawnSecurityCheck() runs the ensemble against the user message:
- L4 (testsavant_content) always runs
- L4b (transcript_classifier via Haiku) runs only if L4 flagged at
>= LOG_ONLY — plan §E1 gating optimization, saves ~70% of Haiku spend
combineVerdict() applies the BLOCK-requires-both-layers rule, which
downgrades any single-layer high confidence to WARN. Stack Overflow-style
instruction-heavy writing false-positives on TestSavantAI alone are
caught by this degrade — Haiku corrects them when called.
Fail-open everywhere: any subprocess/load/inference error returns confidence=0
so the sidebar keeps working on architectural controls alone. Shield icon
reflects degraded state via getClassifierStatus().
BLOCK path emits both:
- security_event {verdict, reason, layer, confidence, domain} (for the
approved canary-leak banner UX mockup — variant A)
- agent_error "Session blocked — prompt injection detected..."
(backward-compat with existing error surface)
Regression test suite still passes (12/12 sidebar-security tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
63a56e6789 |
feat(security): add security-classifier.ts with TestSavantAI + Haiku
This module holds the ML classifier code that the compiled browse binary
cannot link (onnxruntime-node native dylib doesn't load from Bun compile's
temp extract dir — see CEO plan §"Pre-Impl Gate 1 Outcome"). It's imported
ONLY by sidebar-agent.ts, which runs as a non-compiled bun script.
Two layers:
L4 testsavant_content — TestSavantAI BERT-small ONNX classifier. First call
triggers a one-time 112MB model download to ~/.gstack/models/testsavant-small/
(files staged into the onnx/ layout transformers.js v4 expects). Classifies
page snapshots and tool outputs for indirect prompt injection + jailbreak
attempts. On benign-corpus dry-run: Wikipedia/HN/Reddit/tech-blog all score
SAFE 0.98+, attack text scores INJECTION 0.99+, Stack Overflow
instruction-writing now scores SAFE 0.98 on the shorter form (was 0.99
INJECTION on the longer form — instruction-density threshold). Ensemble
combiner downgrades single-layer high to WARN to cover this case.
L4b transcript_classifier — Claude Haiku reasoning-blind pre-tool-call scan.
Sees only {user_message, last 3 tool_calls}, never Claude's chain-of-thought
or tool results (those are how self-persuasion attacks leak). 2000ms hard
timeout. Fail-open on any subprocess failure so sidebar stays functional.
Gated by shouldRunTranscriptCheck() — only runs when another layer already
fired at >= LOG_ONLY, saving ~70% of Haiku spend.
Both layers degrade gracefully: load/spawn failures set status to 'degraded'
and return confidence=0. Shield icon reflects this via getClassifierStatus()
which security.ts's getStatus() composes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
2137417f63 |
feat(security): canary leak check across all outbound channels
The sidebar-agent now scans every Claude stream event for the session's canary token before relaying any data to the sidepanel. Channels covered (per CEO review cross-model tension #2): * Assistant text blocks * Assistant text_delta streaming * tool_use arguments (recursively, via checkCanaryInStructure — catches URLs, commands, file paths nested at any depth) * tool_use content_block_start * tool_input_delta partial JSON * Final result payload If the canary leaks on any channel, onCanaryLeaked() fires once per session: 1. logAttempt() writes the event to ~/.gstack/security/attempts.jsonl with the canary's salted hash (never the payload content). 2. sends a `security_event` to the sidepanel so it can render the approved canary-leak banner (variant A mockup — ceo-plan 2026-04-19). 3. sends an `agent_error` for backward-compat with existing error surfaces. 4. SIGTERM's the claude subprocess (SIGKILL after 2s if still alive). The leaked content itself is never relayed to the sidepanel — the event is dropped at the boundary. Canary detection is pure-string substring match, so this all runs safely in the sidebar-agent (non-compiled bun) context. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
65bf4514b8 |
test(security): make sidebar-agent destructure check regex-tolerant
The test asserted the exact string `const { prompt, args, stateFile, cwd, tabId } = queueEntry`
which breaks whenever security or other extensions add fields (canary, pageUrl,
etc.). Switch to a regex that requires the core fields in order but tolerates
additional fields in between. Preserves the test's intent (args come from the
queue entry, not rebuilt) while allowing the destructure to grow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
d50cdc4611 |
feat(security): wire canary injection into sidebar spawnClaude
Every sidebar message now gets a fresh CANARY-XXXXXXXXXXXX token embedded in the system prompt with an instruction for Claude to never output it on any channel. The token flows through the queue entry so sidebar-agent.ts can check every outbound operation for leaks. If Claude echoes the canary into any outbound channel (text stream, tool arguments, URLs, file write paths), the sidebar-agent terminates the session and the user sees the approved canary leak banner. This operation is pure string manipulation — safe in the compiled browse binary. The actual output-stream check (which also has to be safe in compiled contexts) lives in sidebar-agent.ts (next commit). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Garry Tan
|
900cc0902b |
feat(security): add security.ts foundation for prompt injection defense
Establishes the module structure for the L5 canary and L6 verdict aggregation
layers. Pure-string operations only — safe to import from the compiled browse
binary.
Includes:
* THRESHOLDS constants (BLOCK 0.85 / WARN 0.60 / LOG_ONLY 0.40), calibrated
against BrowseSafe-Bench smoke + developer content benign corpus.
* combineVerdict() implementing the ensemble rule: BLOCK only when the ML
content classifier AND the transcript classifier both score >= WARN.
Single-layer high confidence degrades to WARN to prevent any one
classifier's false-positives from killing sessions (Stack Overflow
instruction-writing-style FPs at 0.99 on TestSavantAI alone).
* generateCanary / injectCanary / checkCanaryInStructure — session-scoped
secret token, recursively scans tool arguments, URLs, file writes, and
nested objects per the plan's all-channel coverage decision.
* logAttempt with 10MB rotation (keeps 5 generations). Salted SHA-256 hash,
per-device salt at ~/.gstack/security/device-salt (0600).
* Cross-process session state at ~/.gstack/security/session-state.json
(atomic temp+rename). Required because server.ts (compiled) and
sidebar-agent.ts (non-compiled) are separate processes.
* getStatus() for shield icon rendering via /health.
ML classifier code will live in a separate module (security-classifier.ts)
loaded only by sidebar-agent.ts — compiled browse binary cannot load the
native ONNX runtime.
Plan: ~/.gstack/projects/garrytan-gstack/ceo-plans/2026-04-19-prompt-injection-guard.md
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Garry Tan
|
22a4451e0e |
feat(v1.3.0.0): open agents learnings + cross-model benchmark skill (#1040)
* chore: regenerate stale ship golden fixtures
Golden fixtures were missing the VENDORED_GSTACK preamble section that
landed on main. Regression tests failed on all three hosts (claude, codex,
factory). Regenerated from current preamble output.
No code changes, unblocks test suite.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: anti-slop design constraints + delete duplicate constants
Tightens design-consultation and design-shotgun to push back on the
convergence traps every AI design tool falls into.
Changes:
- scripts/resolvers/constants.ts: add "system-ui as primary font" to
AI_SLOP_BLACKLIST. Document Space Grotesk as the new "safe alternative
to Inter" convergence trap alongside the existing overused fonts.
- scripts/gen-skill-docs.ts: delete duplicate AI slop constants block
(dead code — scripts/resolvers/constants.ts is the live source).
Prevents drift between the two definitions.
- design-consultation/SKILL.md.tmpl: add Space Grotesk + system-ui to
overused/slop lists. Add "anti-convergence directive" — vary across
generations in the same project. Add Phase 1 "memorable-thing forcing
question" (what's the one thing someone will remember?). Add Phase 5
"would a human designer be embarrassed by this?" self-gate before
presenting variants.
- design-shotgun/SKILL.md.tmpl: anti-convergence directive — each
variant must use a different font, palette, and layout. If two
variants look like siblings, one of them failed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: context health soft directive in preamble (T2+)
Adds a "periodically self-summarize" nudge to long-running skills.
Soft directive only — no thresholds, no enforcement, no auto-commit.
Goal: self-awareness during /qa, /investigate, /cso etc. If you notice
yourself going in circles, STOP and reassess instead of thrashing.
Codex review caught that fake precision thresholds (15/30/45 tool calls)
were unimplementable — SKILL.md is a static prompt, not runtime code.
This ships the soft version only.
Changes:
- scripts/resolvers/preamble.ts: add generateContextHealth(), wire into
T2+ tier. Format: [PROGRESS] ... summary line. Explicit rule that
progress reporting must never mutate git state.
- All T2+ skill SKILL.md files regenerated to include the new section.
- Golden ship fixtures updated (T4 skill, picks up the change).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: model overlays with explicit --model flag (no auto-detect)
Adds a per-model behavioral patch layer orthogonal to the host axis.
Different LLMs have different tendencies (GPT won't stop, Gemini
over-explains, o-series wants structured output). Overlays nudge each
model toward better defaults for gstack workflows.
Codex review caught three landmines the prior reviews missed:
1. Host != model — Claude Code can run any Claude model, Codex runs
GPT/o-series, Cursor fronts multiple providers. Auto-detecting from
host would lie. Dropped auto-detect. --model is explicit (default
claude). Missing overlay file → empty string (graceful).
2. Import cycle — putting Model in resolvers/types.ts would cycle
through hosts/index. Created neutral scripts/models.ts instead.
3. "Final say" is dangerous — overlay at the end of preamble could
override STOP points, AskUserQuestion gates, /ship review gates.
Placed overlay after spawned-session-check but before voice + tier
sections. Wrapper heading adds explicit subordination language on
every overlay: "subordinate to skill workflow, STOP points,
AskUserQuestion gates, plan-mode safety, and /ship review gates."
Changes:
- scripts/models.ts: new neutral module. ALL_MODEL_NAMES, Model type,
resolveModel() for family heuristics (gpt-5.4-mini → gpt-5.4, o3 →
o-series, claude-opus-4-7 → claude), validateModel() helper.
- scripts/resolvers/types.ts: import Model, add ctx.model field.
- scripts/resolvers/model-overlay.ts: new resolver. Reads
model-overlays/{model}.md. Supports {{INHERIT:base}} directive at
top of file for concat (gpt-5.4 inherits gpt). Cycle guard.
- scripts/resolvers/index.ts: register MODEL_OVERLAY resolver.
- scripts/resolvers/preamble.ts: wire generateModelOverlay into
composition before voice. Print MODEL_OVERLAY: {model} in preamble
bash so users can see which overlay is active. Filter empty sections.
- scripts/gen-skill-docs.ts: parse --model CLI flag. Default claude.
Unknown model → throw with list of valid options.
- model-overlays/{claude,gpt,gpt-5.4,gemini,o-series}.md: behavioral
patches per model family. gpt-5.4.md uses {{INHERIT:gpt}} to extend
gpt.md without duplication.
- test/gen-skill-docs.test.ts: fix qa-only guardrail regex scope.
Was matching Edit/Glob/Grep anywhere after `allowed-tools:` in the
whole file. Now scoped to frontmatter only. Body prose (Claude
overlay references Edit as a tool) correctly no longer breaks it.
Verification:
- bun run gen:skill-docs --host all --dry-run → all fresh
- bun run gen:skill-docs --model gpt-5.4 → concat works, gpt.md +
gpt-5.4.md content appears in order
- bun run gen:skill-docs --model unknown → errors with valid list
- All generated skills contain MODEL_OVERLAY: claude in preamble
- Golden ship fixtures regenerated
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: continuous checkpoint mode with non-destructive WIP squash
Adds opt-in auto-commit during long sessions so work survives Claude
Code crashes, Conductor workspace handoffs, and context switches.
Local-only by default — pushing requires explicit opt-in.
Codex review caught multiple landmines that would have shipped:
1. checkpoint_push=true default would push WIP commits to shared
branches, trigger CI/deploys, expose secrets. Now default false.
2. Plan's original /ship squash (git reset --soft to merge base) was
destructive — uncommitted ALL branch commits, not just WIP, and
caused non-fast-forward pushes. Redesigned: rebase --autosquash
scoped to WIP commits only, with explicit fallback for WIP-only
branches and STOP-and-ask for conflicts.
3. gstack-config get returned empty for missing keys with exit 0,
ignoring the annotated defaults in the header comments. Fixed:
get now falls back to a lookup_default() table that is the
canonical source for defaults.
4. Telemetry default mismatched: header said 'anonymous' but runtime
treated empty as 'off'. Aligned: default is 'off' everywhere.
5. /checkpoint resume only read markdown checkpoint files, not the
WIP commit [gstack-context] bodies the plan referenced. Wired up
parsing of [gstack-context] blocks from WIP commits as a second
recovery trail alongside the markdown checkpoints.
Changes:
- bin/gstack-config: add checkpoint_mode (default explicit) and
checkpoint_push (default false) to CONFIG_HEADER. Add lookup_default()
as canonical default source. get() falls back to defaults when key
absent. list now shows value + source (set/default). New 'defaults'
subcommand to inspect the table.
- scripts/resolvers/preamble.ts: preamble bash reads _CHECKPOINT_MODE
and _CHECKPOINT_PUSH, prints CHECKPOINT_MODE: and CHECKPOINT_PUSH: so
the mode is visible. New generateContinuousCheckpoint() section in
T2+ tier describes WIP commit format with [gstack-context] body and
the rules (never git add -A, never commit broken tests, push only
if opted in). Example deliberately shows a clean-state context so
it doesn't contradict the rules.
- ship/SKILL.md.tmpl: new Step 5.75 WIP Commit Squash. Detects WIP
count, exports [gstack-context] blocks before squash (as backup),
uses rebase --autosquash for mixed branches and soft-reset only when
VERIFIED WIP-only. Explicit anti-footgun rules against blind soft-
reset. Aborts with BLOCKED status on conflict instead of destroying
non-WIP commits.
- checkpoint/SKILL.md.tmpl: new Step 1.5 to parse [gstack-context]
blocks from WIP commits via git log --grep="^WIP:". Merges with
markdown checkpoint for fuller session recovery.
- Golden ship fixtures regenerated (ship is T4, preamble change shows up).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: feature discovery flow gated by per-feature markers
Extends generateUpgradeCheck() to surface new features once per user
after a just-upgraded session. No more silent features.
Codex review caught: spawned sessions (OpenClaw, etc.) must skip the
discovery prompt entirely — they can't interactively answer. Feature
discovery now checks SPAWNED_SESSION first and is silent in those.
Discovery is per-feature, not per-upgrade. Each feature has its own
marker file at ~/.claude/skills/gstack/.feature-prompted-{name}. Once
the user has been shown a feature (accepted, shown docs, or skipped),
the marker is touched and the prompt never fires again for that
feature. Future features get their own markers.
V1 features surfaced:
- continuous-checkpoint: offer to enable checkpoint_mode=continuous
- model-overlay: inform-only note about --model flag and MODEL_OVERLAY
line in preamble output
Max one prompt per session to avoid nagging. Fires only on JUST_UPGRADED
(not every session), plus spawned-session skip.
Changes:
- scripts/resolvers/preamble.ts: extend generateUpgradeCheck() with
feature discovery rules, per-marker-file semantics, spawned-session
exclusion, and max-one-per-session cap.
- All skill SKILL.md files regenerated to include the new section.
- Golden ship fixtures regenerated.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: design taste engine with persistent schema
Adds a cross-session taste profile that learns from design-shotgun
approval/rejection decisions. Biases future design-consultation and
design-shotgun proposals toward the user's demonstrated preferences.
Codex review caught that the plan had "taste engine" as a vague goal
without schema, decay, migration, or placeholder insertion points. This
commit ships the full spec.
Schema v1 at ~/.gstack/projects/$SLUG/taste-profile.json:
- version, updated_at
- dimensions: fonts, colors, layouts, aesthetics — each with approved[]
and rejected[] preference lists
- sessions: last 50 (FIFO truncation), each with ts/action/variant/reason
- Preference: { value, confidence, approved_count, rejected_count, last_seen }
- Confidence: Laplace-smoothed approved/(total+1)
- Decay: 5% per week of inactivity, computed at read time (not write)
Changes:
- bin/gstack-taste-update: new CLI. Subcommands approved/rejected/show/
migrate. Parses reason string for dimension signals (e.g.,
"fonts: Geist; colors: slate; aesthetics: minimal"). Emits taste-drift
NOTE when a new signal contradicts a strong opposing signal. Legacy
approved.json aggregates migrate to v1 on next write.
- scripts/resolvers/design.ts: new generateTasteProfile() resolver.
Produces the prose that skills see: how to read the profile, how to
factor into proposals, conflict handling, schema migration.
- scripts/resolvers/index.ts: register TASTE_PROFILE and a BIN_DIR
resolver (returns ctx.paths.binDir, used by templates that shell out
to gstack-* binaries).
- design-consultation/SKILL.md.tmpl: insert {{TASTE_PROFILE}} placeholder
in Phase 1 right after the memorable-thing forcing question so the
Phase 3 proposal can factor in learned preferences.
- design-shotgun/SKILL.md.tmpl: taste memory section now reads
taste-profile.json via {{TASTE_PROFILE}}, falls back to per-session
approved.json (legacy). Approval flow documented to call
gstack-taste-update after user picks/rejects a variant.
Known gap: v1 extracts dimension signals from a reason string passed
by the caller ("fonts: X; colors: Y"). Future v2 can read EXIF or an
accompanying manifest written by design-shotgun alongside each variant
for automatic dimension extraction without needing the reason argument.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: multi-provider model benchmark (boil the ocean)
Adds the full spec Codex asked for: real provider adapters with auth
detection, normalized RunResult, pricing tables, tool compatibility
maps, parallel execution with error isolation, and table/JSON/markdown
output. Judge stays on Anthropic SDK as the single stable source of
quality scoring, gated behind --judge.
Codex flagged the original plan as massively under-scoped — the
existing runner is Claude-only and the judge is Anthropic-only. You
can't benchmark GPT or Gemini without real provider infrastructure.
This commit ships it.
New architecture:
test/helpers/providers/types.ts ProviderAdapter interface
test/helpers/providers/claude.ts wraps `claude -p --output-format json`
test/helpers/providers/gpt.ts wraps `codex exec --json`
test/helpers/providers/gemini.ts wraps `gemini -p --output-format stream-json --yolo`
test/helpers/pricing.ts per-model USD cost tables (quarterly)
test/helpers/tool-map.ts which tools each CLI exposes
test/helpers/benchmark-runner.ts orchestrator (Promise.allSettled)
test/helpers/benchmark-judge.ts Anthropic SDK quality scorer
bin/gstack-model-benchmark CLI entry
test/benchmark-runner.test.ts 9 unit tests (cost math, formatters, tool-map)
Per-provider error isolation:
- auth → record reason, don't abort batch
- timeout → record reason, don't abort batch
- rate_limit → record reason, don't abort batch
- binary_missing → record in available() check, skip if --skip-unavailable
Pricing correction: cached input tokens are disjoint from uncached
input tokens (Anthropic/OpenAI report them separately). Original
math subtracted them, producing negative costs. Now adds cached at
the 10% discount alongside the full uncached input cost.
CLI:
gstack-model-benchmark --prompt "..." --models claude,gpt,gemini
gstack-model-benchmark ./prompt.txt --output json --judge
gstack-model-benchmark ./prompt.txt --models claude --timeout-ms 60000
Output formats: table (default), json, markdown. Each shows model,
latency, in→out tokens, cost, quality (when --judge used), tool calls,
and any errors.
Known limitations for v1:
- Claude adapter approximates toolCalls as num_turns (stream-json
would give exact counts; v2 can upgrade).
- Live E2E tests (test/providers.e2e.test.ts) not included — they
require CI secrets for all three providers. Unit tests cover the
shape and math.
- Provider CLIs sometimes return non-JSON error text to stdout; the
parsers fall back to treating raw output as plain text in that case.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: standalone methodology skill publishing via gstack-publish
Ships the marketplace-distribution half of Item 5 (reframed): publish
the existing standalone OpenClaw methodology skills to multiple
marketplaces with one command.
Codex review caught that the original plan assumed raw generated
multi-host skills could be published directly. They can't — those
depend on gstack binaries, generated host paths, tool names, and
telemetry. The correct artifact class is hand-crafted standalone
skills in openclaw/skills/gstack-openclaw-* (already exist and work
without gstack runtime). This commit adds the wrapper that publishes
them to ClawHub + SkillsMP + Vercel Skills.sh with per-marketplace
error isolation and dry-run validation.
Changes:
- skills.json: root manifest with 4 skills (office-hours, ceo-review,
investigate, retro) each pointing at its openclaw/skills source.
Each skill declares per-marketplace targets with a slug, a publish
flag, and a compatible-hosts list. Marketplace configs include CLI
name, login command, publish command template (with placeholder
substitution), docs URL, and auth_check command.
- bin/gstack-publish: new CLI. Subcommands:
gstack-publish Publish all skills
gstack-publish <slug> Publish one skill
gstack-publish --dry-run Validate + auth-check without publishing
gstack-publish --list List skills + marketplace targets
Features:
* Manifest validation (missing source files, missing slugs, empty
marketplace list all reported).
* Per-marketplace auth check before any publish attempt.
* Per-skill / per-marketplace error isolation: one failure doesn't
abort the batch.
* Idempotent — re-running with the same version is safe; markets
that reject duplicate versions report it as a failure for that
single target without affecting others.
* --dry-run walks the full pipeline but skips execSync; useful in
CI to validate manifest before bumping version.
Tested locally: clawhub auth detected, skillsmp/vercel CLIs not
installed (marked NOT READY and skipped cleanly in dry-run).
Follow-up work (tracked in TODOS.md later):
- Version-bump helper that reads openclaw/skills/*/SKILL.md frontmatter
and updates skills.json in lockstep.
- CI workflow that runs gstack-publish --dry-run on every PR and
gstack-publish on tags.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: split preamble.ts into submodules (byte-identical output)
Splits scripts/resolvers/preamble.ts (841 lines, 18 generator functions +
composition root) into one file per generator under
scripts/resolvers/preamble/. Root preamble.ts becomes a thin composition
layer (~80 lines of imports + generatePreamble).
Before:
scripts/resolvers/preamble.ts 841 lines
After:
scripts/resolvers/preamble.ts 83 lines
scripts/resolvers/preamble/generate-preamble-bash.ts 97 lines
scripts/resolvers/preamble/generate-upgrade-check.ts 48 lines
scripts/resolvers/preamble/generate-lake-intro.ts 16 lines
scripts/resolvers/preamble/generate-telemetry-prompt.ts 37 lines
scripts/resolvers/preamble/generate-proactive-prompt.ts 25 lines
scripts/resolvers/preamble/generate-routing-injection.ts 49 lines
scripts/resolvers/preamble/generate-vendoring-deprecation.ts 36 lines
scripts/resolvers/preamble/generate-spawned-session-check.ts 11 lines
scripts/resolvers/preamble/generate-ask-user-format.ts 16 lines
scripts/resolvers/preamble/generate-completeness-section.ts 19 lines
scripts/resolvers/preamble/generate-repo-mode-section.ts 12 lines
scripts/resolvers/preamble/generate-test-failure-triage.ts 108 lines
scripts/resolvers/preamble/generate-search-before-building.ts 14 lines
scripts/resolvers/preamble/generate-completion-status.ts 161 lines
scripts/resolvers/preamble/generate-voice-directive.ts 60 lines
scripts/resolvers/preamble/generate-context-recovery.ts 51 lines
scripts/resolvers/preamble/generate-continuous-checkpoint.ts 48 lines
scripts/resolvers/preamble/generate-context-health.ts 31 lines
Byte-identity verification (the real gate per Codex correction):
- Before refactor: snapshotted 135 generated SKILL.md files via
`find -name SKILL.md -type f | grep -v /gstack/` across all hosts.
- After refactor: regenerated with `bun run gen:skill-docs --host all`
and re-snapshotted.
- `diff -r baseline after` returned zero differences and exit 0.
The `--host all --dry-run` gate passes too. No template or host behavior
changes — purely a code-organization refactor.
Test fix: audit-compliance.test.ts's telemetry check previously grepped
preamble.ts directly for `_TEL != "off"`. After the refactor that logic
lives in preamble/generate-preamble-bash.ts. Test now concatenates all
preamble submodule sources before asserting — tracks the semantic contract,
not the file layout. Doing the minimum rewrite preserves the test's intent
(conditional telemetry) without coupling it to file boundaries.
Why now: we were in-session with full context. Codex had downgraded this
from mandatory to optional, but the preamble had grown to 841 lines and
was getting harder to navigate. User asked "why not?" given the context
was hot. Shipping it as a clean bisectable commit while all the prior
preamble.ts changes are fresh reduces rebase pain later.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: bump version and changelog (v0.19.0.0)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: trim verbose preamble + coverage audit prose
Compress without removing behavior or voice. Three targeted cuts:
1. scripts/resolvers/testing.ts coverage diagram example: 40 lines → 14
lines. Two-column ASCII layout instead of stacked sections.
Preserves all required regression-guard phrases (processPayment,
refundPayment, billing.test.ts, checkout.e2e.ts, COVERAGE, QUALITY,
GAPS, Code paths, User flows, ASCII coverage diagram).
2. scripts/resolvers/preamble/generate-completion-status.ts Plan Status
Footer: was 35 lines with embedded markdown table example, now 7
lines that describe the table inline. The footer fires only at
ExitPlanMode time — Claude can construct the placeholder table from
the inline description without copying a literal example.
3. Same file's Plan Mode Safe Operations + Skill Invocation During Plan
Mode sections compressed from ~25 lines combined to ~12. Preserves
all required test phrases (precedence over generic plan mode behavior,
Do not continue the workflow, cancel the skill or leave plan mode,
PLAN MODE EXCEPTION).
NOT touched:
- Voice directive (Garry's voice — protected per CLAUDE.md)
- Office-hours Phase 6 Handoff (Garry's voice + YC pitch)
- Test bootstrap, review army, plan completion (carefully tuned behavior)
Token savings (per skill, system-wide):
ship/SKILL.md 35474 → 34992 tokens (-482)
plan-ceo-review 29436 → 28940 (-496)
office-hours 26700 → 26204 (-496)
Still over the 25K ceiling. Bigger reduction requires restructure
(move large resolvers to externally-referenced docs, split /ship into
ship-quick + ship-full, or refactor the coverage audit + review army
into shorter prose). That's a follow-up — added to TODOS.
Tests: 420/420 pass on gen-skill-docs.test.ts + host-config.test.ts.
Goldens regenerated for claude/codex/factory ship.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(ci): install Node.js from official tarball instead of NodeSource apt setup
The CI Dockerfile's Node install was failing on ubicloud runners. NodeSource's
setup_22.x script runs two internal apt operations that both depend on
archive.ubuntu.com + security.ubuntu.com being reachable:
1. apt-get update (to refresh package lists)
2. apt-get install gnupg (as a prerequisite for its gpg keyring)
Ubicloud's CI runners frequently can't reach those mirrors — last build hit
~2min of connection timeouts to every security.ubuntu.com IP (185.125.190.82,
91.189.91.83, 91.189.92.24, etc.) plus archive.ubuntu.com mirrors. Compounding
this: on Ubuntu 24.04 (noble) "gnupg" was renamed to "gpg" and "gpgconf".
NodeSource's setup script still looks for "gnupg", so even when apt works,
it fails with "Package 'gnupg' has no installation candidate." The subsequent
apt-get install nodejs then fails because the NodeSource repo was never added.
Fix: drop NodeSource entirely. Download Node.js v22.20.0 from nodejs.org as a
tarball, extract to /usr/local. One host, no apt, no script, no keyring.
Before:
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
&& apt-get install -y --no-install-recommends nodejs ...
After:
ENV NODE_VERSION=22.20.0
RUN curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" -o /tmp/node.tar.xz \
&& tar -xJ -C /usr/local --strip-components=1 --no-same-owner -f /tmp/node.tar.xz \
&& rm -f /tmp/node.tar.xz \
&& node --version && npm --version
Same installed path (/usr/local/bin/node and npm). Pinned version for
reproducibility. Version is bump-visible in the Dockerfile now.
Does not address the separate apt flakiness that affects the GitHub CLI
install (line 17) or `npx playwright install-deps chromium` (line 33) —
those use apt too. If those fail on a future build we can address then.
Failing job: build-image (71777913820)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: raise skill token ceiling warning from 25K to 40K
The 25K ceiling predated flagship models with 200K-1M windows and assumed
every skill prompt dominates context cost. Modern reality: prompt caching
amortizes the skill load across invocations, and three carefully-tuned
skills (ship, plan-ceo-review, office-hours) legitimately pack 25-35K
tokens of behavior that can't be cut without degrading quality or removing
protected content (Garry's voice, YC pitch, specialist review instructions).
We made the safe prose cuts earlier (coverage diagram, plan status footer,
plan mode operations). The remaining gap is structural — real compression
would require splitting /ship into ship-quick vs ship-full, externalizing
large resolvers to reference docs, or removing detailed skill behavior.
Each is 1-2 days of work. The cost of the warning firing is zero (it's
a warning, not an error). The cost of hitting it is ~15¢ per invocation
at worst, amortized further by prompt caching.
Raising to 40K catches what it's supposed to catch — a runaway 10K+ token
growth in a single release — without crying wolf on legitimately big
skills. Reference doc in CLAUDE.md updated to reflect the new philosophy:
when you hit 40K, ask WHAT grew, don't blindly compress tuned prose.
scripts/gen-skill-docs.ts: TOKEN_CEILING_BYTES 100_000 → 160_000.
CLAUDE.md: document the "watch for feature bloat, not force compression"
intent of the ceiling.
Verification: `bun run gen:skill-docs --host all` shows zero TOKEN
CEILING warnings under the new 40K threshold.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(ci): install xz-utils so Node tarball extraction works
The direct-tarball Node install (switched from NodeSource apt in the last
CI fix) failed with "xz: Cannot exec: No such file or directory" because
Ubuntu 24.04 base doesn't include xz-utils. Node ships .tar.xz by default,
and `tar -xJ` shells out to xz, which was missing.
Add xz-utils to the base apt install alongside git/curl/unzip/etc.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(benchmark): pass --skip-git-repo-check to codex adapter
The gpt provider adapter spawns `codex exec -C <workdir>` with arbitrary
working directories (benchmark temp dirs, non-git paths). Without
`--skip-git-repo-check`, codex refuses to run and returns "Not inside a
trusted directory" — surfaced as a generic error.code='unknown' that
looks like an API failure.
Benchmarks don't care about codex's git-repo trust model; we just want
the prompt executed. Surfaced by the new provider live E2E test on a
temp workdir.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(benchmark): add --dry-run flag to gstack-model-benchmark
Matches gstack-publish --dry-run semantics. Validates the provider list,
resolves per-adapter auth, echoes the resolved flag values, and exits
without invoking any provider CLI. Zero-cost pre-flight for CI pipelines
and for catching auth drift before starting a paid benchmark run.
Output shape:
== gstack-model-benchmark --dry-run ==
prompt: <truncated>
providers: claude, gpt, gemini
workdir: /tmp/...
timeout_ms: 300000
output: table
judge: off
Adapter availability:
claude: OK
gpt: NOT READY — <reason>
gemini: NOT READY — <reason>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test: lite E2E coverage for benchmark, taste engine, publish
Fills real coverage gaps in v0.19.0.0 primitives. 44 new deterministic
tests (gate tier, ~3s) + 8 live-API tests (periodic tier).
New gate-tier test files (free, <3s total):
- test/taste-engine.test.ts — 24 tests against gstack-taste-update:
schema shape, Laplace-smoothed confidence, 5%/week decay clamped at 0,
multi-dimension extraction, case-insensitive matching, session cap,
legacy profile migration with session truncation, taste-drift conflict
warning, malformed-JSON recovery, missing-variant exit code.
- test/publish-dry-run.test.ts — 13 tests against gstack-publish --dry-run:
manifest parsing, missing/malformed JSON, per-skill validation errors
(missing source file / slug / version / marketplaces), slug filter,
unknown-skill exit, per-marketplace auth isolation (fake marketplaces
with always-pass / always-fail / missing-binary CLIs), and a sanity
check against the real repo manifest.
- test/benchmark-cli.test.ts — 11 tests against gstack-model-benchmark
--dry-run: provider default, unknown-provider WARN, empty list
fallback, flag passthrough (timeout/workdir/judge/output), long-prompt
truncation, prompt resolution (inline vs file vs positional), missing
prompt exit.
New periodic-tier test file (paid, gated EVALS=1):
- test/skill-e2e-benchmark-providers.test.ts — 8 tests hitting real
claude, codex, gemini CLIs with a trivial prompt (~$0.001/provider).
Verifies output parsing, token accounting, cost estimation, timeout
error.code semantics, Promise.allSettled parallel isolation.
Per-provider availability gate — unauthed providers skip cleanly.
This suite already caught one real bug (codex adapter missing
--skip-git-repo-check, fixed in
|
||
|
Garry Tan
|
12260262ea |
fix(checkpoint): rename /checkpoint → /context-save + /context-restore (v1.0.1.0) (#1064)
* rename /checkpoint → /context-save + /context-restore (split) Claude Code ships /checkpoint as a native alias for /rewind (Esc+Esc), which was shadowing the gstack skill. Training-data bleed meant agents saw /checkpoint and sometimes described it as a built-in instead of invoking the Skill tool, so nothing got saved. Fix: rename the skill and split save from restore so each skill has one job. Restore now loads the most recent saved context across ALL branches by default (the previous flow was ambiguous between mode="restore" and mode="list" and agents applied list-flow filtering to restore). New commands: - /context-save → save current state - /context-save list → list saved contexts (current branch default) - /context-restore → load newest saved context across all branches - /context-restore X → load specific saved context by title fragment Storage directory unchanged at ~/.gstack/projects/$SLUG/checkpoints/ so existing saved files remain loadable. Canonical ordering is now the filename YYYYMMDD-HHMMSS prefix, not filesystem mtime — filenames are stable across copies/rsync, mtime is not. Empty-set handling in both restore and list flows uses find+sort instead of ls -1t, which on macOS falls back to listing cwd when the input is empty. Sources for the collision: - https://code.claude.com/docs/en/checkpointing - https://claudelog.com/mechanics/rewind/ * preamble: split 'checkpoint' routing rule into context-save + context-restore scripts/resolvers/preamble.ts:238 is the source of truth for the routing rules that gstack writes into users' CLAUDE.md on first skill run, AND gets baked into every generated SKILL.md. A single 'invoke checkpoint' line points at a skill that no longer exists. Replace with two lines: - Save progress, save state, save my work → invoke context-save - Resume, where was I, pick up where I left off → invoke context-restore Tier comment at :750 also updated. All SKILL.md files regenerated via bun run gen:skill-docs. * tests: split checkpoint-save-resume into context-save + context-restore E2Es Renames the combined E2E test to match the new skill split: - checkpoint-save-resume → context-save-writes-file Extracts the Save flow from context-save/SKILL.md, asserts a file gets written with valid YAML frontmatter. - New: context-restore-loads-latest Seeds two saved-context files with different YYYYMMDD-HHMMSS prefixes AND scrambled filesystem mtimes (so mtime DISAGREES with filename order). Hand-feeds the restore flow and asserts the newer- by-filename file is loaded. Locks in the "newest by filename prefix, not mtime" guarantee. touchfiles.ts: old 'checkpoint-save-resume' key removed from both E2E_TOUCHFILES and E2E_TIERS maps; new keys added to both. Leaving a key in one map but not the other silently breaks test selection. Golden baselines (claude/codex/factory ship skill) regenerated to match the new preamble routing rules from the previous commit. * migration: v0.18.5.0 removes stale /checkpoint install with ownership guard gstack-upgrade/migrations/v0.18.5.0.sh removes the stale on-disk /checkpoint install so Claude Code's native /rewind alias is no longer shadowed. Ownership guard inspects the directory itself (not just SKILL.md) and handles 3 install shapes: 1. ~/.claude/skills/checkpoint is a directory symlink whose canonical path resolves inside ~/.claude/skills/gstack/ → remove. 2. ~/.claude/skills/checkpoint is a directory containing exactly one file SKILL.md that's a symlink into gstack → remove (gstack's prefix-install shape). 3. Anything else (user's own regular file/dir, or a symlink pointing elsewhere) → leave alone, print a one-line notice. Also removes ~/.claude/skills/gstack/checkpoint/ unconditionally (gstack owns that dir). Portable realpath: `realpath` with python3 fallback for macOS BSD which lacks readlink -f. Idempotent: missing paths are no-ops. test/migration-checkpoint-ownership.test.ts ships 7 scenarios covering all 3 install shapes + idempotency + no-op-when-gstack-not-installed + SKILL.md-symlink-outside-gstack. Critical safety net for a migration that mutates user state. Free tier, ~85ms. * docs: bump VERSION to 0.18.5.0, CHANGELOG + TODOS entry User-facing changelog leads with the problem: /checkpoint silently stopped saving because Claude Code shipped a native /checkpoint alias for /rewind. The fix is a clean rename to /context-save + /context-restore, with the second bug (restore was filtering by current branch and hiding most recent saves) called out separately under Fixed. TODOS entry for the deferred lane feature points at the existing lane data model in plan-eng-review/SKILL.md.tmpl:240-249 so a future session can pick it up without re-discovering the source. * chore: bump package.json to 0.18.5.0 (match VERSION) * fix(test): skill-e2e-autoplan-dual-voice was shipped broken The test shipped on main in v0.18.4.0 used wrong option names and wrong result fields throughout. It could not have passed in any environment: Broken API calls: - `workdir` → should be `workingDirectory` The fixture setup (git init, copy autoplan + plan-*-review dirs, write TEST_PLAN.md) was completely ignored. claude -p spawned with undefined cwd instead of the tmp workdir. - `timeoutMs: 300_000` → should be `timeout: 300_000` Fell back to default 120s. Explains the observed ~170s failure (test harness overhead + retry startup). - `name: 'autoplan-dual-voice'` → should be `testName: 'autoplan-dual-voice'` No per-test run directory was created. - `evalCollector` → not a recognized `runSkillTest` option at all. Broken result access: - `result.stdout + result.stderr` → SkillTestResult has neither field. `out` was literally "undefinedundefined" every time. - Every regex match fired false. All 3 assertions (claudeVoiceFired, codex-or-unavailable, reachedPhase1) failed on every attempt. - `logCost(result)` → signature is `logCost(label, result)`. - `recordE2E('autoplan-dual-voice', result)` → signature is `recordE2E(evalCollector, name, suite, result, extra)`. Fixes: - Renamed all 4 broken options in the runSkillTest call. - Changed assertion source to `result.output` plus JSON-serialized `result.transcript` (broader net for voice fingerprints in tool inputs/outputs). - Widened regex alternatives: codex voice now matches "CODEX SAYS" and "codex-plan-review"; Claude voice now matches subagent_type; unavailable matches CODEX_NOT_AVAILABLE. - Added Agent + Skill + Edit + Grep + Glob to allowedTools. Without Agent, /autoplan can't spawn subagents and never reaches Phase 1. - Raised maxTurns 15 → 30 (autoplan is a long multi-phase skill). - Fixed logCost + recordE2E signatures, passing `passed:` flag into recordE2E per the neighboring context-save pattern. * security: harden migration + context-save after adversarial review Adversarial review (Claude + Codex, both high confidence) identified 6 critical production-harm findings in the /ship pre-landing pass. All folded in. Migration v1.0.1.0.sh hardening: - Add explicit `[ -z "${HOME:-}" ]` guard. HOME="" survives set -u and expands paths to /.claude/skills/... which could hit absolute paths under root/containers/sudo-without-H. - Add python3 fallback inside resolve_real() (was missing; broken symlinks silently defeated ownership check). - Ownership-guard Shape 2 (~/.claude/skills/gstack/checkpoint/). Was unconditional rm -rf. Now: if symlink, check target resolves inside gstack; if regular dir, check realpath resolves inside gstack. A user's hand-edited customization or a symlink pointing outside gstack is preserved with a notice. - Use `rm --` and `rm -r --` consistently to resist hostile basenames. - Use `find -type f -not -name .DS_Store -not -name ._*` instead of `ls -A | grep`. macOS sidecars no longer mask a legit prefix-mode install. Strip sidecars explicitly before removing the dir. context-save/SKILL.md.tmpl: - Sanitize title in bash, not LLM prose. Allowlist [a-z0-9.-], cap 60 chars, default to "untitled". Closes a prompt-injection surface where `/context-save $(rm -rf ~)` could propagate into subsequent commands. - Collision-safe filename. If ${TIMESTAMP}-${SLUG}.md already exists (same-second double-save with same title), append a 4-char random suffix. The skill contract says "saved files are append-only" — this enforces it. Silent overwrite was a data-loss bug. context-restore/SKILL.md.tmpl: - Cap `find ... | sort -r` at 20 entries via `| head -20`. A user with 10k+ saved files no longer blows the context window just to pick one. /context-save list still handles the full-history listing path. test/skill-e2e-autoplan-dual-voice.test.ts: - Filter transcript to tool_use / tool_result / assistant entries before matching, so prompt-text mentions of "plan-ceo-review" don't force the reachedPhase1 assertion to pass. Phase-1 assertion now requires completion markers ("Phase 1 complete", "Phase 2 started"), not mere name occurrence. - claudeVoiceFired now requires JSON evidence of an Agent tool_use (name:"Agent" or subagent_type field), not the literal string "Agent(" which could appear anywhere. - codexVoiceFired now requires a Bash tool_use with a `codex exec/review` command string, not prompt-text mentions. All SKILL.md files regenerated. Golden fixtures updated. bun test: 0 failures across 80+ targeted tests and the full suite. Review source: /ship Step 11 adversarial pass (claude subagent + codex exec). Same findings independently surfaced by both reviewers — this is cross-model high confidence. * test: tier-2 hardening tests for context-save + context-restore 21 unit-level tests covering the security + correctness hardening that landed in commit |