Files
gstack/scripts/eval-list.ts
T
Garry Tanandcapy-ai[bot] 4c6fa89cdc v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)
* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml

Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a
cwd bunfig.toml preload before the program starts. gstack runs inside the repo
it audits, so a committed .env could steer state roots, the claude binary or
spend caps, and a bunfig preload ran arbitrary code in every bin and hook.

Every bun shebang, shell and skill caller, TypeScript spawn and compiled build
now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(),
--no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture
regressions.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test: name the directly executed scripts in the isolation ratchet

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test: plan-mode render pattern accepts the isolation flags

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
2026-10-20 00:24:28 +00:00

132 lines
4.6 KiB
TypeScript

#!/usr/bin/env -S bun --no-env-file --config=/dev/null
/**
* List eval runs from the project eval dir (~/.gstack/projects/<slug>/evals;
* legacy fallback ~/.gstack-dev/evals)
*
* Usage: bun run eval:list [--branch <name>] [--tier e2e|llm-judge] [--limit N]
*/
import * as fs from 'fs';
import { evalEntryOutcome, getProjectEvalDir, listEvalJsonFiles } from '../test/helpers/eval-store';
const EVAL_DIR = getProjectEvalDir();
// Parse args
const args = process.argv.slice(2);
let filterBranch: string | null = null;
let filterTier: string | null = null;
let limit = 20;
function parseLimit(raw: string | undefined): number {
if (!raw || !/^[1-9]\d*$/.test(raw)) {
console.error('eval:list: --limit requires a positive integer');
process.exit(1);
}
const parsed = Number(raw);
if (!Number.isSafeInteger(parsed)) {
console.error('eval:list: --limit requires a positive integer');
process.exit(1);
}
return parsed;
}
for (let i = 0; i < args.length; i++) {
if (args[i] === '--branch' && args[i + 1]) { filterBranch = args[++i]; }
else if (args[i] === '--tier' && args[i + 1]) { filterTier = args[++i]; }
else if (args[i] === '--limit') { limit = parseLimit(args[++i]); }
}
// Read eval files (flat dir plus one level of shards/<slug>/)
const files = listEvalJsonFiles(EVAL_DIR);
if (files.length === 0) {
console.log('No eval runs yet. Run: bun run eval:bg:pr');
process.exit(0);
}
// Parse top-level fields from each file
interface RunSummary {
file: string;
timestamp: string;
branch: string;
tier: string;
version: string;
passed: number;
manual: Array<{ name: string; approvedBy: string; approvalUrl: string }>;
total: number;
cost: number;
duration: number;
turns: number;
}
const runs: RunSummary[] = [];
for (const file of files) {
try {
const data = JSON.parse(fs.readFileSync(file, 'utf-8'));
if (filterBranch && data.branch !== filterBranch) continue;
if (filterTier && data.tier !== filterTier) continue;
const totalTurns = (data.tests || []).reduce((s: number, t: any) => s + (t.turns_used || 0), 0);
const tests = Array.isArray(data.tests) ? data.tests : null;
const final = tests ? [...new Map<string, any>(tests.map((t: any) => [t.name, t] as const)).values()] : [];
const manual = final.filter((t: any) => evalEntryOutcome(t) === 'manual-review').map((t: any) => ({
name: t.name, approvedBy: t.manual_review.approval.approved_by, approvalUrl: t.manual_review.approval.approval_url,
}));
runs.push({
file,
timestamp: data.timestamp || '',
branch: data.branch || 'unknown',
tier: data.tier || 'unknown',
version: data.version || '?',
passed: tests ? tests.filter((t: any) => evalEntryOutcome(t) === 'passed').length : data.passed || 0,
manual,
total: data.total_tests || 0,
cost: data.total_cost_usd || 0,
duration: data.total_duration_ms || 0,
turns: totalTurns,
});
} catch { continue; }
}
// Sort by timestamp descending
runs.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
// Apply limit
const displayed = runs.slice(0, limit);
// Print table
console.log('');
console.log(`Eval History (${runs.length} total runs)`);
console.log('═'.repeat(105));
console.log(
' ' +
'Date'.padEnd(17) +
'Branch'.padEnd(25) +
'Tier'.padEnd(12) +
'Pass'.padEnd(8) +
'Cost'.padEnd(8) +
'Turns'.padEnd(7) +
'Duration'.padEnd(10) +
'Version'
);
console.log('─'.repeat(105));
for (const run of displayed) {
const date = run.timestamp.replace('T', ' ').slice(0, 16);
const branch = run.branch.length > 23 ? run.branch.slice(0, 20) + '...' : run.branch.padEnd(25);
const pass = `${run.passed}/${run.total}`.padEnd(8);
const cost = `$${run.cost.toFixed(2)}`.padEnd(8);
const turns = run.turns > 0 ? `${run.turns}t`.padEnd(7) : ''.padEnd(7);
const dur = run.duration > 0 ? `${Math.round(run.duration / 1000)}s`.padEnd(10) : ''.padEnd(10);
const manual = run.manual.map(entry => `MANUAL/unscored ${entry.name}: approved by ${entry.approvedBy} (${entry.approvalUrl})`).join('; ');
console.log(` ${date.padEnd(17)}${branch}${run.tier.padEnd(12)}${pass}${cost}${turns}${dur}v${run.version}${manual ? ` ${manual}` : ''}`);
}
console.log('─'.repeat(105));
const totalCost = runs.reduce((s, r) => s + r.cost, 0);
const totalDur = runs.reduce((s, r) => s + r.duration, 0);
const totalTurns = runs.reduce((s, r) => s + r.turns, 0);
console.log(` ${runs.length} runs | $${totalCost.toFixed(2)} total | ${totalTurns} turns | ${Math.round(totalDur / 1000)}s | Showing: ${displayed.length}`);
console.log(` Dir: ${EVAL_DIR}`);
console.log('');