Garry Tan and Claude Fable 5.1
60758c5ddf
fix(design-detect): never execute a repository-controlled engine; allow-list --changed targets; sanitize engine text
...
Pre-landing review findings (security + checklist), all reproduced before the fix:
- A checked-out branch could commit `.claude/skills/impeccable/scripts/bin/<os>-<arch>/impeccable`
and the probe would report READY and `scan` would run it, with the agent's full
environment. Launchers and sibling engines under the repo or cwd now count as
"skill present" only (IMPECCABLE_NOT_CACHED: repository-local install, and the
hint never names a repository-local launcher to run); only HOME-rooted installs,
IMPECCABLE_BIN, the cache, and PATH entries outside the repo qualify, all by
realpath. The engine now sees a minimal environment (PATH, HOME, TMPDIR, locale,
IMPECCABLE_*), never the agent's tokens.
- `scan --changed <base>` pushed git-derived paths without the allow-list, so a
committed symlink with a frontend extension handed a file outside the repo to
the engine. Derived targets now go through the same allow-list as explicit ones
and symlinks named by git are refused outright.
- A repo-controlled `scripts/VERSION` with embedded newlines forged probe lines;
the version is trusted only when it is semver, and every printed version is
sanitized. Engine text containing the untrusted-content fence or a
`SENTINEL:` prefix is neutralized with a zero-width space
(neutralizeSentinels in the contract), so page text cannot close the envelope
or forge a probe line.
- A failing `git diff <base>...HEAD` (unknown or unfetched base) was swallowed
and read as "no frontend changes"; it is now DETECT_REFUSED with exit 1.
- The scan allow-list root follows `${GSTACK_HOME:-$HOME/.gstack}` like the
templates and gstack-slug (config.yaml keeps gstack-config's STATE_ROOT
precedence); a quoted or commented design_detector value reads correctly.
Smaller: raw engine chunks are kept only in --format raw; diagnostics are
capped (200 kept, 20 echoed); the engine identity hash reads size + 4 MB, not
the whole binary; PROBE_STEP and ENGINE_STDERR are contract sentinels; the
--verbose gate covers every probe step; analytics use one sentinel vocabulary;
bare limits live in DETECT_LIMITS. The fake engine's knobs are IMPECCABLE_FAKE_*
(so they pass the minimal env) and a shared test helper installs it. New tests
cover each item above plus clean runs, `{}` parse errors, missing paths, and the
50 MB stdout cap.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-09-08 17:31:30 +00:00
..
2026-09-08 17:31:30 +00:00
2026-09-08 17:31:30 +00:00
2026-08-15 22:20:30 -07:00
2026-08-29 10:10:35 -07:00
2026-03-18 23:57:59 -05:00
2026-08-15 22:20:30 -07:00
2026-08-29 10:10:35 -07:00
2026-08-16 19:34:41 -07:00
2026-08-31 08:55:30 -07:00
2026-09-06 08:54:25 -07:00
2026-09-06 08:54:25 -07:00
2026-09-06 08:54:25 -07:00
2026-09-01 11:15:11 -07:00
2026-08-27 09:50:31 -07:00
2026-08-29 10:10:35 -07:00
2026-08-29 09:06:54 -07:00
2026-04-19 17:50:31 +08:00
2026-08-31 08:55:30 -07:00
2026-06-21 07:15:19 -07:00
2026-08-31 08:55:30 -07:00
2026-08-19 11:42:55 -07:00
2026-08-19 11:42:55 -07:00
2026-05-29 08:35:00 -07:00
2026-08-19 11:42:55 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-16 19:34:41 -07:00
2026-05-20 07:35:01 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-05-29 08:35:00 -07:00
2026-06-07 19:13:24 -07:00
2026-06-07 19:13:24 -07:00
2026-08-29 09:06:54 -07:00
2026-06-07 19:13:24 -07:00
2026-08-14 09:28:56 -07:00
2026-08-29 09:06:54 -07:00
2026-08-16 19:34:41 -07:00
2026-08-15 22:20:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-08-15 11:42:19 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-08-16 19:34:41 -07:00
2026-08-31 08:55:30 -07:00
2026-08-16 19:34:41 -07:00
2026-08-31 08:55:30 -07:00
2026-05-16 12:32:33 -07:00
2026-08-31 08:55:30 -07:00
2026-08-27 09:50:31 -07:00
2026-08-08 09:28:45 -07:00
2026-06-07 19:13:24 -07:00
2026-08-15 09:37:04 -07:00
2026-05-28 18:21:09 -07:00
2026-09-01 11:15:11 -07:00
2026-09-08 16:15:57 +00:00
2026-09-08 15:34:24 +00:00
2026-09-08 17:31:30 +00:00
2026-08-31 08:55:30 -07:00
2026-09-08 16:28:40 +00:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-08-16 19:34:41 -07:00
2026-05-30 12:09:10 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-05-21 21:21:07 -07:00
2026-06-07 19:13:24 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-28 11:43:13 -07:00
2026-09-08 16:01:18 +00:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-08-15 22:20:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-15 22:20:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-08-14 22:02:07 -07:00
2026-08-29 09:06:54 -07:00
2026-05-20 07:35:01 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-09-08 16:38:46 +00:00
2026-08-28 11:43:13 -07:00
2026-08-31 08:55:30 -07:00
2026-08-15 11:42:19 -07:00
2026-06-08 06:20:58 -07:00
2026-08-31 08:55:30 -07:00
2026-06-21 07:15:19 -07:00
2026-08-29 09:06:54 -07:00
2026-08-16 19:34:41 -07:00
2026-08-31 08:55:30 -07:00
2026-06-08 06:20:58 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-05-21 21:21:07 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-08-16 19:34:41 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-05-17 08:26:36 -07:00
2026-08-31 08:55:30 -07:00
2026-05-30 14:57:07 -07:00
2026-08-08 09:28:45 -07:00
2026-08-16 19:34:41 -07:00
2026-08-15 22:20:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-09-06 08:54:25 -07:00
2026-09-08 16:27:37 +00:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-15 11:42:19 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-09-08 16:01:18 +00:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-06-08 06:20:58 -07:00
2026-06-08 06:20:58 -07:00
2026-09-08 17:31:30 +00:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-09-06 08:54:25 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-09-06 08:54:25 -07:00
2026-08-31 08:55:30 -07:00
2026-08-27 09:50:31 -07:00
2026-05-29 08:35:00 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-08-19 11:42:55 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-05-14 17:20:48 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-04-26 13:55:13 -07:00
2026-08-31 08:55:30 -07:00
2026-08-14 09:28:56 -07:00
2026-09-01 11:15:11 -07:00
2026-09-05 14:45:28 -07:00
2026-08-14 22:02:07 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-09-08 16:14:03 +00:00
2026-08-14 22:02:07 -07:00
2026-08-17 07:50:37 -07:00
2026-08-31 08:55:30 -07:00
2026-08-15 11:42:19 -07:00
2026-07-14 16:35:30 -07:00
2026-06-14 11:40:57 -07:00
2026-04-18 15:05:42 +08:00
2026-05-30 14:57:07 -07:00
2026-08-15 09:37:04 -07:00
2026-09-01 11:15:11 -07:00
2026-05-21 21:21:07 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-05-07 20:14:59 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-05-20 07:35:01 -07:00
2026-05-30 14:57:07 -07:00
2026-04-19 08:38:19 +08:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-14 22:02:07 -07:00
2026-08-27 09:50:31 -07:00
2026-04-25 11:52:48 -07:00
2026-08-14 22:02:07 -07:00
2026-08-14 22:02:07 -07:00
2026-08-14 22:02:07 -07:00
2026-08-31 08:55:30 -07:00
2026-08-14 22:02:07 -07:00
2026-08-27 09:50:31 -07:00
2026-08-08 09:28:45 -07:00
2026-04-17 00:45:13 -07:00
2026-09-01 11:15:11 -07:00
2026-09-06 08:54:25 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-14 22:02:07 -07:00
2026-05-26 16:50:03 -07:00
2026-05-30 12:09:10 -07:00
2026-08-15 09:37:04 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-05-06 19:37:53 -07:00
2026-08-31 08:55:30 -07:00
2026-06-07 22:04:18 -07:00
2026-08-30 20:45:19 -07:00
2026-08-31 08:55:30 -07:00
2026-08-14 09:28:56 -07:00
2026-08-16 19:34:41 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-16 19:34:41 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-15 09:37:04 -07:00
2026-09-01 11:15:11 -07:00
2026-05-30 08:54:46 -07:00
2026-09-01 11:15:11 -07:00
2026-08-16 19:34:41 -07:00
2026-05-30 08:54:46 -07:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-05-30 08:54:46 -07:00
2026-05-30 12:09:10 -07:00
2026-06-07 06:51:10 -07:00
2026-08-27 09:50:31 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 11:15:11 -07:00
2026-09-01 11:15:11 -07:00
2026-09-01 11:15:11 -07:00
2026-09-05 14:45:28 -07:00
2026-05-30 12:09:10 -07:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-05-29 08:35:00 -07:00
2026-09-01 11:15:11 -07:00
2026-08-31 08:55:30 -07:00
2026-09-01 16:42:11 -07:00
2026-08-29 09:06:54 -07:00
2026-05-29 08:35:00 -07:00
2026-08-31 08:55:30 -07:00
2026-05-29 08:35:00 -07:00
2026-04-24 01:38:21 -07:00
2026-06-04 11:14:43 -07:00
2026-06-21 07:15:19 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-07-09 23:49:09 -07:00
2026-08-31 08:55:30 -07:00
2026-09-05 14:45:28 -07:00
2026-09-06 08:54:25 -07:00
2026-09-05 14:45:28 -07:00
2026-09-05 14:45:28 -07:00
2026-09-05 14:45:28 -07:00
2026-08-14 22:02:07 -07:00
2026-08-18 17:00:04 -07:00
2026-09-05 14:45:28 -07:00
2026-09-05 14:45:28 -07:00
2026-08-27 09:50:31 -07:00
2026-08-27 09:50:31 -07:00
2026-08-24 08:55:58 -07:00
2026-08-19 16:53:19 -07:00
2026-09-05 14:45:28 -07:00
2026-09-06 08:54:25 -07:00
2026-08-31 08:55:30 -07:00
2026-09-05 14:45:28 -07:00
2026-09-06 08:54:25 -07:00
2026-08-14 22:02:07 -07:00
2026-08-16 19:34:41 -07:00
2026-09-01 11:15:11 -07:00
2026-09-05 14:45:28 -07:00
2026-09-05 14:45:28 -07:00
2026-08-15 11:42:19 -07:00
2026-08-30 20:45:19 -07:00
2026-05-30 12:09:10 -07:00
2026-08-16 19:34:41 -07:00
2026-05-30 12:09:10 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 10:10:35 -07:00
2026-09-01 11:15:11 -07:00
2026-08-14 09:28:56 -07:00
2026-08-16 19:34:41 -07:00
2026-06-04 11:14:43 -07:00
2026-04-19 08:38:19 +08:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-09-06 08:54:25 -07:00
2026-08-27 09:50:31 -07:00
2026-08-29 10:10:35 -07:00
2026-09-06 08:54:25 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 10:10:35 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-09-06 08:54:25 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-09-06 08:54:25 -07:00
2026-09-08 16:38:46 +00:00
2026-09-06 08:54:25 -07:00
2026-08-30 20:45:19 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-07-14 16:35:30 -07:00
2026-08-29 09:06:54 -07:00
2026-08-19 11:42:55 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-15 09:37:04 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-09-06 08:54:25 -07:00
2026-09-06 08:54:25 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 10:10:35 -07:00
2026-08-31 08:55:30 -07:00
2026-09-08 17:31:30 +00:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-09-01 16:42:11 -07:00
2026-08-31 08:55:30 -07:00
2026-08-29 09:06:54 -07:00
2026-09-06 08:54:25 -07:00
2026-08-29 09:06:54 -07:00
2026-09-06 08:54:25 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-09-06 08:54:25 -07:00
2026-08-29 09:06:54 -07:00
2026-09-06 08:54:25 -07:00
2026-09-06 08:54:25 -07:00
2026-05-29 08:35:00 -07:00
2026-08-31 08:55:30 -07:00
2026-09-06 08:54:25 -07:00
2026-09-06 08:54:25 -07:00
2026-08-29 09:06:54 -07:00
2026-08-31 08:55:30 -07:00
2026-08-27 09:50:31 -07:00
2026-08-29 09:06:54 -07:00
2026-09-06 08:54:25 -07:00
2026-08-31 08:55:30 -07:00
2026-05-29 08:35:00 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-08-31 08:55:30 -07:00
2026-09-05 14:45:28 -07:00
2026-05-30 12:09:10 -07:00
2026-06-08 05:41:07 -07:00
2026-08-29 10:10:35 -07:00
2026-08-31 08:55:30 -07:00
2026-09-06 08:54:25 -07:00
2026-08-28 11:43:13 -07:00
2026-08-31 08:55:30 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-09-06 08:54:25 -07:00
2026-08-31 08:55:30 -07:00
2026-08-16 09:53:31 -07:00
2026-05-30 12:09:10 -07:00
2026-08-16 19:34:41 -07:00
2026-08-31 08:55:30 -07:00
2026-08-14 22:02:07 -07:00
2026-08-31 08:55:30 -07:00
2026-08-19 11:42:55 -07:00
2026-09-05 14:45:28 -07:00
2026-08-28 11:43:13 -07:00
2026-08-15 09:37:04 -07:00
2026-08-19 16:53:19 -07:00
2026-08-29 09:06:54 -07:00
2026-08-14 22:02:07 -07:00
2026-08-31 08:55:30 -07:00
2026-08-27 09:50:31 -07:00