mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 22:14:25 +01:00
* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a cwd bunfig.toml preload before the program starts. gstack runs inside the repo it audits, so a committed .env could steer state roots, the claude binary or spend caps, and a bunfig preload ran arbitrary code in every bin and hook. Every bun shebang, shell and skill caller, TypeScript spawn and compiled build now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(), --no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture regressions. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: name the directly executed scripts in the isolation ratchet Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: plan-mode render pattern accepts the isolation flags Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
132 lines
4.6 KiB
TypeScript
132 lines
4.6 KiB
TypeScript
#!/usr/bin/env -S bun --no-env-file --config=/dev/null
|
|
/**
|
|
* List eval runs from the project eval dir (~/.gstack/projects/<slug>/evals;
|
|
* legacy fallback ~/.gstack-dev/evals)
|
|
*
|
|
* Usage: bun run eval:list [--branch <name>] [--tier e2e|llm-judge] [--limit N]
|
|
*/
|
|
|
|
import * as fs from 'fs';
|
|
import { evalEntryOutcome, getProjectEvalDir, listEvalJsonFiles } from '../test/helpers/eval-store';
|
|
|
|
const EVAL_DIR = getProjectEvalDir();
|
|
|
|
// Parse args
|
|
const args = process.argv.slice(2);
|
|
let filterBranch: string | null = null;
|
|
let filterTier: string | null = null;
|
|
let limit = 20;
|
|
|
|
function parseLimit(raw: string | undefined): number {
|
|
if (!raw || !/^[1-9]\d*$/.test(raw)) {
|
|
console.error('eval:list: --limit requires a positive integer');
|
|
process.exit(1);
|
|
}
|
|
const parsed = Number(raw);
|
|
if (!Number.isSafeInteger(parsed)) {
|
|
console.error('eval:list: --limit requires a positive integer');
|
|
process.exit(1);
|
|
}
|
|
return parsed;
|
|
}
|
|
|
|
for (let i = 0; i < args.length; i++) {
|
|
if (args[i] === '--branch' && args[i + 1]) { filterBranch = args[++i]; }
|
|
else if (args[i] === '--tier' && args[i + 1]) { filterTier = args[++i]; }
|
|
else if (args[i] === '--limit') { limit = parseLimit(args[++i]); }
|
|
}
|
|
|
|
// Read eval files (flat dir plus one level of shards/<slug>/)
|
|
const files = listEvalJsonFiles(EVAL_DIR);
|
|
|
|
if (files.length === 0) {
|
|
console.log('No eval runs yet. Run: bun run eval:bg:pr');
|
|
process.exit(0);
|
|
}
|
|
|
|
// Parse top-level fields from each file
|
|
interface RunSummary {
|
|
file: string;
|
|
timestamp: string;
|
|
branch: string;
|
|
tier: string;
|
|
version: string;
|
|
passed: number;
|
|
manual: Array<{ name: string; approvedBy: string; approvalUrl: string }>;
|
|
total: number;
|
|
cost: number;
|
|
duration: number;
|
|
turns: number;
|
|
}
|
|
|
|
const runs: RunSummary[] = [];
|
|
for (const file of files) {
|
|
try {
|
|
const data = JSON.parse(fs.readFileSync(file, 'utf-8'));
|
|
if (filterBranch && data.branch !== filterBranch) continue;
|
|
if (filterTier && data.tier !== filterTier) continue;
|
|
const totalTurns = (data.tests || []).reduce((s: number, t: any) => s + (t.turns_used || 0), 0);
|
|
const tests = Array.isArray(data.tests) ? data.tests : null;
|
|
const final = tests ? [...new Map<string, any>(tests.map((t: any) => [t.name, t] as const)).values()] : [];
|
|
const manual = final.filter((t: any) => evalEntryOutcome(t) === 'manual-review').map((t: any) => ({
|
|
name: t.name, approvedBy: t.manual_review.approval.approved_by, approvalUrl: t.manual_review.approval.approval_url,
|
|
}));
|
|
runs.push({
|
|
file,
|
|
timestamp: data.timestamp || '',
|
|
branch: data.branch || 'unknown',
|
|
tier: data.tier || 'unknown',
|
|
version: data.version || '?',
|
|
passed: tests ? tests.filter((t: any) => evalEntryOutcome(t) === 'passed').length : data.passed || 0,
|
|
manual,
|
|
total: data.total_tests || 0,
|
|
cost: data.total_cost_usd || 0,
|
|
duration: data.total_duration_ms || 0,
|
|
turns: totalTurns,
|
|
});
|
|
} catch { continue; }
|
|
}
|
|
|
|
// Sort by timestamp descending
|
|
runs.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
|
|
|
|
// Apply limit
|
|
const displayed = runs.slice(0, limit);
|
|
|
|
// Print table
|
|
console.log('');
|
|
console.log(`Eval History (${runs.length} total runs)`);
|
|
console.log('═'.repeat(105));
|
|
console.log(
|
|
' ' +
|
|
'Date'.padEnd(17) +
|
|
'Branch'.padEnd(25) +
|
|
'Tier'.padEnd(12) +
|
|
'Pass'.padEnd(8) +
|
|
'Cost'.padEnd(8) +
|
|
'Turns'.padEnd(7) +
|
|
'Duration'.padEnd(10) +
|
|
'Version'
|
|
);
|
|
console.log('─'.repeat(105));
|
|
|
|
for (const run of displayed) {
|
|
const date = run.timestamp.replace('T', ' ').slice(0, 16);
|
|
const branch = run.branch.length > 23 ? run.branch.slice(0, 20) + '...' : run.branch.padEnd(25);
|
|
const pass = `${run.passed}/${run.total}`.padEnd(8);
|
|
const cost = `$${run.cost.toFixed(2)}`.padEnd(8);
|
|
const turns = run.turns > 0 ? `${run.turns}t`.padEnd(7) : ''.padEnd(7);
|
|
const dur = run.duration > 0 ? `${Math.round(run.duration / 1000)}s`.padEnd(10) : ''.padEnd(10);
|
|
const manual = run.manual.map(entry => `MANUAL/unscored ${entry.name}: approved by ${entry.approvedBy} (${entry.approvalUrl})`).join('; ');
|
|
console.log(` ${date.padEnd(17)}${branch}${run.tier.padEnd(12)}${pass}${cost}${turns}${dur}v${run.version}${manual ? ` ${manual}` : ''}`);
|
|
}
|
|
|
|
console.log('─'.repeat(105));
|
|
|
|
const totalCost = runs.reduce((s, r) => s + r.cost, 0);
|
|
const totalDur = runs.reduce((s, r) => s + r.duration, 0);
|
|
const totalTurns = runs.reduce((s, r) => s + r.turns, 0);
|
|
console.log(` ${runs.length} runs | $${totalCost.toFixed(2)} total | ${totalTurns} turns | ${Math.round(totalDur / 1000)}s | Showing: ${displayed.length}`);
|
|
console.log(` Dir: ${EVAL_DIR}`);
|
|
console.log('');
|