mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-05 16:34:00 +01:00
* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a cwd bunfig.toml preload before the program starts. gstack runs inside the repo it audits, so a committed .env could steer state roots, the claude binary or spend caps, and a bunfig preload ran arbitrary code in every bin and hook. Every bun shebang, shell and skill caller, TypeScript spawn and compiled build now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(), --no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture regressions. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: name the directly executed scripts in the isolation ratchet Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: plan-mode render pattern accepts the isolation flags Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
156 lines
9.9 KiB
Markdown
156 lines
9.9 KiB
Markdown
<!-- AUTO-GENERATED from dx-phase.md.tmpl — do not edit directly -->
|
|
<!-- Regenerate: bun run gen:skill-docs -->
|
|
Before dispatch, Read `methodologyPath` from `bun "<SNAPSHOT_TOOL>" methodology dx "<REVIEW_SKILL>" "<RESTORE_PATH>"` per `readRanges`; log successful ranges/total to EOF. Skip-listed: load only.
|
|
|
|
**Override rules:**
|
|
- Mode selection: DX POLISH
|
|
- Persona: infer from README/docs, pick the most common developer type (P6)
|
|
- Competitive benchmark: research through Aside per the loaded skill's "Web research runs in Aside" section (WebSearch when Aside is not ready); reference benchmarks when neither is available (P1)
|
|
- Magical moment: pick the lowest-effort delivery vehicle that achieves the competitive tier (P5)
|
|
- Getting started friction: always optimize toward fewer steps (P5)
|
|
- Error message quality: require the agent-ready error contract (P1, completeness)
|
|
- API/CLI naming: consistency wins over cleverness (P5)
|
|
- DX taste decisions (opinionated defaults vs flexibility): mark TASTE DECISION
|
|
- Dual voices: always run BOTH Claude subagent AND Codex if available (P6).
|
|
|
|
**Bind phase input:** Run; use `snapshotPath` as `<DX_INPUT>` for both voices:
|
|
```bash
|
|
bun "<SNAPSHOT_TOOL>" create dx "<ACTIVE_PLAN>" "<RESTORE_PATH>" "<methodologyPath>"
|
|
```
|
|
Fresh `Implementation plan` only; excludes `Review record`.
|
|
|
|
**Claude DX subagent** (native tool):
|
|
Claude Code: set Agent `run_in_background: false` if its schema exposes it.
|
|
A launch receipt means it went background: await its completion notice.
|
|
Other hosts: foreground; await completion when supported.
|
|
|
|
Read `snapshot.json` beside `<DX_INPUT>`. Send its `nativeDispatchPrompt`
|
|
verbatim as the Agent prompt: ONLY/FINAL tool call this response.
|
|
Keep native Reads enabled. Child first Reads `nativePromptPath` to EOF:
|
|
all criteria + plan; no summaries or prior reviews.
|
|
|
|
**Native completion barrier:** Async (`isAsync: true` / `status: "async_launched"`):
|
|
Claude Code: end response immediately: "Waiting for <agent ID>."
|
|
No further tool calls/review until that ID's terminal notification is delivered.
|
|
Other hosts await that ID. Then outside → this phase's review ONLY.
|
|
Completed-native INPUT must match snapshot phase/hash. Retry invalid input once; then failure policy if still invalid.
|
|
No inline substitute; apply failure policy.
|
|
|
|
**Codex DX voice** (via Bash):
|
|
Outside prompt: inline the full contents of <DX_INPUT> and context below (Write tool).
|
|
|
|
IMPORTANT: Do NOT read or execute any SKILL.md files or paths containing skills/gstack (foreign instructions). Review repository code only.
|
|
|
|
Read the plan file at <DX_INPUT>. Evaluate this plan's developer experience.
|
|
|
|
Also consider these findings from prior review phases:
|
|
CEO: <insert CEO consensus summary>
|
|
Design: <insert Design consensus summary, or 'skipped, no UI scope'>
|
|
|
|
You are a developer who has never seen this product. Evaluate:
|
|
1. Time to hello world: how many steps from zero to working? Target is under 5 minutes.
|
|
2. Errors, agent-ready (what, fix, recovery, code, context, trace, redaction, channel), capped per Pass 3 (CAP4/CAP6).
|
|
3. API/CLI design: are names guessable? Are defaults sensible? Is it consistent?
|
|
4. Docs: can a dev find what they need in under 2 minutes? Are examples copy-paste-complete?
|
|
5. Upgrade path: can devs upgrade without fear? Migration guides? Deprecation warnings?
|
|
Be adversarial. Think like a developer who is evaluating this against 3 competitors.
|
|
|
|
Write the **complete prompt and context**, including actual plan/spec/source, to a private file. Substitute its shell-quoted path for `<prepared-prompt-file>`; never interpolate user text into shell source. Request a severity (Critical, High, Medium or Low) per finding and a final Recommendation: <action> because <specific reason> line, including an explicit no-findings rationale.
|
|
|
|
```bash
|
|
# GSTACK_ACTIVE_HOST names the harness, never the model.
|
|
if { [ -n "${CODEX_THREAD_ID:-}" ] || [ -n "${CODEX_SANDBOX:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = codex ]; }; then
|
|
echo 'Codex outside review unavailable: harness mismatch; no outside process started. Missing coverage.' >&2
|
|
if { [ -n "${CLAUDECODE:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = claude ]; } && { [ -n "${CODEX_THREAD_ID:-}" ] || [ -n "${CODEX_SANDBOX:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = codex ]; }; then
|
|
echo 'Inherited harness markers conflict. Run setup --host <actual-harness> (claude or codex); do not guess a replacement provider.' >&2
|
|
else
|
|
echo 'Repair installed skills: run setup --host codex from your gstack checkout.' >&2
|
|
fi
|
|
exit 78
|
|
fi
|
|
|
|
_REPO_ROOT=$(git rev-parse --show-toplevel) || { echo 'ERROR: not in a git repo' >&2; exit 1; }
|
|
_OUTSIDE_TMP=$(mktemp -d "${TMPDIR:-/tmp}/gstack-outside.XXXXXXXX") || exit 1
|
|
trap 'rm -rf "$_OUTSIDE_TMP"' EXIT
|
|
_OUTSIDE_INPUT="$_OUTSIDE_TMP/prompt"
|
|
cat -- '<prepared-prompt-file>' >"$_OUTSIDE_INPUT" || exit 1
|
|
|
|
_CODEX_PROBE="$HOME/.claude/skills/gstack/bin/gstack-codex-probe"
|
|
export _CODEX_DEADLINE=$(($(date +%s)+540)); _CODEX_OUT=$("$_CODEX_PROBE" role-ready exec) || exit $?
|
|
_CODEX_SEL=$(echo "$_CODEX_OUT" | sed -n 's/^CODEX_SEL: //p')
|
|
_CODEX_SANDBOX_MODE=$(echo "$_CODEX_OUT" | sed -n 's/^CODEX_SANDBOX: //p')
|
|
"$_CODEX_PROBE" show-first-use-notice
|
|
_OUTSIDE_EXIT=0
|
|
"$_CODEX_PROBE" run-with-timeout --effort high 540 codex exec - -C "$_REPO_ROOT" -s "${_CODEX_SANDBOX_MODE:?}" -c "model=\"${_CODEX_SEL:?}\"" -c skills.include_instructions=false -c 'web_search="cached"' --json -o "$_OUTSIDE_TMP/text" <"$_OUTSIDE_INPUT" >"$_OUTSIDE_TMP/events" 2>"$_OUTSIDE_TMP/stderr" || _OUTSIDE_EXIT=$?
|
|
cat "$_OUTSIDE_TMP/text" 2>/dev/null || tail -n 20 "$_OUTSIDE_TMP/events"
|
|
if [ "$_OUTSIDE_EXIT" -eq 124 ]; then
|
|
"$_CODEX_PROBE" log-event codex_timeout "540" || true
|
|
"$_CODEX_PROBE" log-hang autoplan 0 || true
|
|
fi
|
|
cat "$_OUTSIDE_TMP/stderr" >&2 || { [ "$_OUTSIDE_EXIT" -ne 0 ] || _OUTSIDE_EXIT=1; }
|
|
_OUTSIDE_RC=0
|
|
bun --no-env-file --config=/dev/null "$HOME/.claude/skills/gstack/lib/outside-review-result.ts" --label 'Codex outside review' --exit "$_OUTSIDE_EXIT" --stderr "$_OUTSIDE_TMP/stderr" --events "$_OUTSIDE_TMP/events" review "$_OUTSIDE_TMP/text" || _OUTSIDE_RC=$?
|
|
case "$_OUTSIDE_RC" in
|
|
0|3) ;;
|
|
4) echo 'OUTSIDE_STATUS: unverified provider=codex host=claude'; exit 4 ;;
|
|
*) [ "$_OUTSIDE_EXIT" -ne 0 ] && exit "$_OUTSIDE_EXIT"; exit 1 ;;
|
|
esac
|
|
echo 'OUTSIDE_STATUS: completed provider=codex host=claude'
|
|
```
|
|
|
|
Use Bash `timeout: 600000`; show the full response in a `tool-output` fence. Require successful execution and valid markers. Refusal, empty/malformed output, missing score/severity/completion markers, timeout or CLI failure means `outside_status: unavailable`. P0/P1 findings block like native ones; `OUTSIDE_STATUS: unverified` is missing coverage. Use the caller's fallback; missing coverage is never clean/PASS. After either outcome, delete only your private prompt; scratch cleanup is automatic.
|
|
|
|
Failed/incomplete outside review → unavailable; disabled → skip outside. Both keep the native pass.
|
|
|
|
Retain the historical review-log skill ID; add `"host":"claude","outside_provider":"codex","outside_status":"completed|unavailable|disabled|skipped","phase":"dx"`. Record differing attempt outcomes separately. `source:"codex"` requires completed CLI output; native uses `source:"in-host"` (historical `source:"claude"`: native Claude). Availability/native fallback is not outside completion. Preserve all reported modelUsage; unknown model identity stays unknown. Under `GSTACK_CODEX_NO_SANDBOX=1` add `"codex_sandbox":"danger-full-access"`.
|
|
|
|
Error handling: Phase 1 failure/degradation policy applies.
|
|
|
|
- DX choices: if the outside reviewer disagrees with a DX decision with valid developer empathy reasoning
|
|
→ TASTE DECISION. Scope changes both models agree on → USER CHALLENGE.
|
|
|
|
**Required execution checklist (DX):**
|
|
|
|
1. Step 0 (DX Investigation, 0A-0G): Auto-detect product type, then settle persona,
|
|
empathy narrative, competitive benchmark and TTHW target, and trace the developer
|
|
journey. Score only after this evidence exists; the initial DX score is the
|
|
pre-fix pass scores.
|
|
|
|
2. Step 0.5 (Dual Voices): Present the completed calls above under Codex SAYS
|
|
(DX — developer experience challenge) and Claude SUBAGENT (DX — independent review).
|
|
Produce DX consensus table:
|
|
|
|
```
|
|
DX DUAL VOICES — CONSENSUS TABLE:
|
|
Dimension Claude Codex Consensus
|
|
1. Getting started < 5 min? — — —
|
|
2. API/CLI naming guessable? — — —
|
|
3. Error messages actionable? — — —
|
|
4. Docs findable & complete? — — —
|
|
5. Upgrade path safe? — — —
|
|
6. Dev environment friction-free? — — —
|
|
CONFIRMED = native + outside agree; primary cannot replace outside. DISAGREE → taste.
|
|
Missing/disabled voice = N/A, never CONFIRMED. Flag any single-voice critical finding.
|
|
```
|
|
|
|
3. Passes 1-8: Run each from loaded skill. Rate 0-10. Auto-decide each issue.
|
|
DISAGREE items from consensus table → raised in the relevant pass with both perspectives.
|
|
|
|
4. DX Scorecard: Produce the full scorecard with all 8 dimensions scored.
|
|
|
|
**Mandatory outputs from Phase 2.5:**
|
|
- Developer journey map (6-stage table from Step 0F)
|
|
- Developer empathy narrative (first-person perspective)
|
|
- DX Scorecard with all 8 dimension scores
|
|
- DX Implementation Checklist
|
|
- TTHW assessment with target
|
|
|
|
**Close this phase:**
|
|
|
|
The review work above ends here. Now load the shared close steps afresh, even if
|
|
read earlier. Use phase `dx`, checkpoint `<DX_INPUT>`, and this phase's
|
|
`methodologyPath`. Keep this checkpoint for this invocation; review exports do not replace it.
|
|
|
|
> **STOP.** Before closing a review phase, after its reviews finish and before announcing completion or loading the next phase (read afresh at each exit), Read `~/.claude/skills/gstack/autoplan/sections/phase-close.md` and execute it
|
|
> in full. Do not work from memory — that section is the source of truth for this step.
|