mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-16 01:45:29 +02:00
Garry TanandClaude Fable 5.1
60758c5ddf
Pre-landing review findings (security + checklist), all reproduced before the fix:
- A checked-out branch could commit `.claude/skills/impeccable/scripts/bin/<os>-<arch>/impeccable`
and the probe would report READY and `scan` would run it, with the agent's full
environment. Launchers and sibling engines under the repo or cwd now count as
"skill present" only (IMPECCABLE_NOT_CACHED: repository-local install, and the
hint never names a repository-local launcher to run); only HOME-rooted installs,
IMPECCABLE_BIN, the cache, and PATH entries outside the repo qualify, all by
realpath. The engine now sees a minimal environment (PATH, HOME, TMPDIR, locale,
IMPECCABLE_*), never the agent's tokens.
- `scan --changed <base>` pushed git-derived paths without the allow-list, so a
committed symlink with a frontend extension handed a file outside the repo to
the engine. Derived targets now go through the same allow-list as explicit ones
and symlinks named by git are refused outright.
- A repo-controlled `scripts/VERSION` with embedded newlines forged probe lines;
the version is trusted only when it is semver, and every printed version is
sanitized. Engine text containing the untrusted-content fence or a
`SENTINEL:` prefix is neutralized with a zero-width space
(neutralizeSentinels in the contract), so page text cannot close the envelope
or forge a probe line.
- A failing `git diff <base>...HEAD` (unknown or unfetched base) was swallowed
and read as "no frontend changes"; it is now DETECT_REFUSED with exit 1.
- The scan allow-list root follows `${GSTACK_HOME:-$HOME/.gstack}` like the
templates and gstack-slug (config.yaml keeps gstack-config's STATE_ROOT
precedence); a quoted or commented design_detector value reads correctly.
Smaller: raw engine chunks are kept only in --format raw; diagnostics are
capped (200 kept, 20 echoed); the engine identity hash reads size + 4 MB, not
the whole binary; PROBE_STEP and ENGINE_STDERR are contract sentinels; the
--verbose gate covers every probe step; analytics use one sentinel vocabulary;
bare limits live in DETECT_LIMITS. The fake engine's knobs are IMPECCABLE_FAKE_*
(so they pass the minimal env) and a shared test helper installs it. New tests
cover each item above plus clean runs, `{}` parse errors, missing paths, and the
50 MB stdout cap.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
20 lines
854 B
TypeScript
20 lines
854 B
TypeScript
/**
|
|
* Install test/fixtures/fake-impeccable.ts as an executable `impeccable` in a
|
|
* fresh temp dir OUTSIDE any repo (the wrapper refuses an in-repo IMPECCABLE_BIN
|
|
* by design). Shared by the unit and E2E suites so the shim is set up one way.
|
|
*/
|
|
import * as fs from 'fs';
|
|
import * as os from 'os';
|
|
import * as path from 'path';
|
|
|
|
export const IMPECCABLE_FAKE_SRC = path.join(import.meta.dir, '..', 'fixtures', 'fake-impeccable.ts');
|
|
export const DETECT_SAMPLE = path.join(import.meta.dir, '..', 'fixtures', 'impeccable-detect-sample.json');
|
|
|
|
export function installFakeImpeccable(prefix = 'gstack-fake-impeccable-'): { dir: string; bin: string } {
|
|
const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
|
|
const bin = path.join(dir, 'impeccable');
|
|
fs.copyFileSync(IMPECCABLE_FAKE_SRC, bin);
|
|
fs.chmodSync(bin, 0o755);
|
|
return { dir, bin };
|
|
}
|