mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-03 07:18:03 +01:00
Garry Tanandcapy-ai[bot]
4c6fa89cdc
* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a cwd bunfig.toml preload before the program starts. gstack runs inside the repo it audits, so a committed .env could steer state roots, the claude binary or spend caps, and a bunfig preload ran arbitrary code in every bin and hook. Every bun shebang, shell and skill caller, TypeScript spawn and compiled build now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(), --no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture regressions. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: name the directly executed scripts in the isolation ratchet Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: plan-mode render pattern accepts the isolation flags Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
68 lines
2.5 KiB
Bash
Executable File
68 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gstack-specialist-stats — compute per-specialist hit rates from review history
|
|
# Usage: gstack-specialist-stats
|
|
#
|
|
# Reads all *-reviews.jsonl files across branches, parses specialist fields,
|
|
# and outputs hit rates. Tags specialists as GATE_CANDIDATE (0 findings in 10+
|
|
# dispatches) or NEVER_GATE (security, data-migration, state-machines — insurance policy).
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
eval "$("$SCRIPT_DIR/gstack-slug" 2>/dev/null)"
|
|
. "$(dirname "$0")/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: $(dirname "$0")/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
|
|
gstack_state_root_select
|
|
GSTACK_HOME="$_gstack_sr_root"
|
|
PROJECT_DIR="$GSTACK_HOME/projects/$SLUG"
|
|
|
|
if [ ! -d "$PROJECT_DIR" ]; then
|
|
echo "SPECIALIST_STATS: 0 reviews analyzed"
|
|
exit 0
|
|
fi
|
|
|
|
# Collect all review JSONL files (strip ---CONFIG--- and ---HEAD--- footers)
|
|
COMBINED=""
|
|
for f in "$PROJECT_DIR"/*-reviews.jsonl; do
|
|
[ -f "$f" ] || continue
|
|
COMBINED="$COMBINED$(sed '/^---/,$d' "$f" 2>/dev/null)
|
|
"
|
|
done
|
|
|
|
if [ -z "$COMBINED" ]; then
|
|
echo "SPECIALIST_STATS: 0 reviews analyzed"
|
|
exit 0
|
|
fi
|
|
|
|
printf '%s' "$COMBINED" | bun --no-env-file --config=/dev/null -e "
|
|
const lines = (await Bun.stdin.text()).trim().split('\n').filter(Boolean);
|
|
const NEVER_GATE = new Set(['security', 'data-migration', 'state-machines']);
|
|
const stats = {};
|
|
let reviewed = 0;
|
|
|
|
for (const line of lines) {
|
|
try {
|
|
const e = JSON.parse(line);
|
|
if (!e.specialists) continue;
|
|
reviewed++;
|
|
for (const [name, info] of Object.entries(e.specialists)) {
|
|
if (!stats[name]) stats[name] = { dispatched: 0, findings: 0 };
|
|
if (info.dispatched) {
|
|
stats[name].dispatched++;
|
|
stats[name].findings += (info.findings || 0);
|
|
}
|
|
}
|
|
} catch {}
|
|
}
|
|
|
|
console.log('SPECIALIST_STATS: ' + reviewed + ' reviews analyzed');
|
|
const sorted = Object.entries(stats).sort((a, b) => a[0].localeCompare(b[0]));
|
|
for (const [name, s] of sorted) {
|
|
const pct = s.dispatched > 0 ? Math.round(100 * s.findings / s.dispatched) : 0;
|
|
let tag = '';
|
|
if (NEVER_GATE.has(name)) {
|
|
tag = ' [NEVER_GATE]';
|
|
} else if (s.dispatched >= 10 && s.findings === 0) {
|
|
tag = ' [GATE_CANDIDATE]';
|
|
}
|
|
console.log(name + ': ' + s.dispatched + '/' + reviewed + ' dispatched, ' + s.findings + ' findings (' + pct + '%)' + tag);
|
|
}
|
|
" 2>/dev/null || { echo "SPECIALIST_STATS: 0 reviews analyzed"; exit 0; }
|