everything-claude-code

fix: cover remaining gateguard tokenizer bypasses

Affaan Mustafa · 2026-05-13 02:30:06 -04:00

25ea9a771d

fix: address PR #1853 review feedback (force-if-includes, switch, subshell, +refspec)

Five additional review findings on top of the round-1 tokenizer fix.
Combined patch surface is small (one push branch, new switch branch,
exploded subshell handling); all six review issues are now closed.

P1 — --force --force-if-includes still destructive (Greptile, line 217):
  Previous logic treated --force-if-includes as a safety guarantee
  alongside --force-with-lease. Per git-scm.com/docs/git-push,
  --force-if-includes is a no-op WITHOUT --force-with-lease, so a
  combination of --force --force-if-includes is just --force. Push
  branch now treats only --force-with-lease as a lease, and reports
  force when --force / -f is present.

P2 — git switch destructive forms not detected (Greptile, line 234):
  Added a switch branch to isDestructiveGit covering:
    --discard-changes   (explicit discard)
    --force / -f        (ignore conflicts, overwrite)
    -C <branch>         (force-create, overwrites existing branch)

P0 — backtick + $(...) subshell bypass (CodeRabbit, line 64):
  Added explodeSubshells() that promotes `...` and $(...) contents
  to top-level segment separators. Run on both the SQL/dd regex
  input and the per-segment shell tokenizer input. Loops up to 4
  passes to catch a layer of nesting. Without this,
  `echo y | $(rm -rf /tmp)` slipped past the segment splitter
  because the destructive command lived inside a sub-expression.

P0 — +refspec force push (CodeRabbit, line 217):
  `git push origin +main`, `+refs/heads/main:refs/heads/main`, etc.
  force a non-fast-forward update of that specific ref. Push branch
  now also flags any positional arg starting with `+` that matches
  a refspec shape. Excludes bare `+` and numeric-only tokens.

P2 — missing --force --force-if-includes regression test
  (Greptile, line 1202): added.

Tests (+10 on top of the round-1 +10):
  Bypass-now-blocked:
    - git push --force --force-if-includes (force-if-includes is no-op
      without lease — bare force is still in effect)
    - git push origin +main (+refspec bare branch)
    - git push origin +refs/heads/main:refs/heads/main (+refspec full)
    - git switch --discard-changes
    - git switch --force
    - git switch -f (short form)
    - git switch -C (force-create)
    - echo y | `rm -rf /tmp` (backtick subshell)
    - echo y | $(rm -rf /tmp) (dollar-paren subshell)
  Still-allowed:
    - git switch feature (plain)

67/67 in gateguard-fact-force.test.js. 2380/2380 across the full
suite. yarn lint clean. All seven CI validators pass.

Refs #1843.

Jamkris · 2026-05-13 15:26:03 +09:00

12353c52c4

fix: close gateguard destructive-bash regex bypasses with tokenizer

Six classes of bypass in scripts/hooks/gateguard-fact-force.js
DESTRUCTIVE_BASH regex, plus a separate false-positive class.
Same shape of issue as the block-no-verify holes addressed in
#1843: a single-regex shell parser can never cover the flag-order
variations git and rm allow.

Real bypasses observed locally (all ALLOW today, should BLOCK):

  git push -f origin main                       (short form of --force)
  git -c core.foo=bar reset --hard              (intervening -c global)
  rm -fr /tmp/junk                              (reverse flag order)
  rm -r -f /tmp/junk                            (split flag form)
  git reset HEAD --hard                         (intervening ref token)
  git clean -fd                                 (combined -f + -d flag)

False positive observed locally (BLOCK today, should ALLOW):

  git commit -m "fix: rm -rf race in worker"   (destructive phrase
                                                inside quoted message)

Behavior fix that comes along: --force-if-includes is now exempted
alongside --force-with-lease. Both are safety-checked variants;
the previous regex used a negative lookahead that only spelled out
--with-lease, so --force-if-includes blocked under the old code
even though it is the safer-not-harder choice.

Fix shape (mirrors block-no-verify #1843):

  - DESTRUCTIVE_SQL_DD regex kept for `drop table`, `delete from`,
    `truncate`, `dd if=` — these are stable keyword phrases. Quoted
    strings are stripped before the regex runs so the phrase is not
    matched inside a commit message body.
  - isDestructiveBash() tokenizes the command into segments at
    unquoted ; | & boundaries, then per segment:
      * isDestructiveRm  — detects `rm` with both r and f set
        across combined or split flag tokens.
      * isDestructiveGit — finds the git subcommand after skipping
        global options (-c key=val, -C path, --git-dir=, etc.),
        then handles reset, checkout --, clean -f*, push --force
        (with --force-with-lease / --force-if-includes exemption),
        commit --amend, and rm -r* preservation.
  - Command tokens go through commandBasename() so /usr/bin/rm,
    rm.exe, and RM all normalize to "rm".

Tests (+10 in tests/hooks/gateguard-fact-force.test.js):

  Bypass-now-blocked (7):
    - denies short-form git push -f
    - denies git reset --hard with intervening -c global option
    - denies rm -fr (reverse flag order)
    - denies rm -r -f (split flag form)
    - denies git reset HEAD --hard
    - denies git clean -fd
    - denies destructive command in second chained segment

  False-positive-now-allowed (3):
    - allows destructive phrase inside `-m` commit message (rm -rf)
    - allows SQL phrase inside `-m` commit message (drop table)
    - allows --force-if-includes as a safety-checked variant

Local verification:
  yarn lint                                                 clean
  scripts/ci/validate-*  (agents/commands/rules/skills/hooks/
                          install-manifests/no-personal-paths)  pass
  node tests/run-all.js                              2380/2380 pass

Caveat (unrelated): yarn test still fails at check-unicode-safety
on skills/windows-desktop-e2e/SKILL.md (U+2605) per #1843's
caveat — independent of this change.

Provenance: discovered during a security pass on ECC after PR
#1843 (block-no-verify shell-words rewrite) landed. Same class of
regex-based shell parser issue, same shape of fix.

Refs #1843.

Jamkris · 2026-05-13 14:54:27 +09:00

231c1fdbe8

ci: disable checkout credential persistence in privileged workflows (#1851 )

Affaan Mustafa · 2026-05-13 01:15:49 -04:00

209abd403b

docs: gate ECC progress sync readiness

Make the ECC 2.0 GitHub/Linear/handoff/roadmap progress-sync model part of the local observability readiness gate instead of leaving it as roadmap prose only.

- add `docs/architecture/progress-sync-contract.md` for GitHub, Linear, handoff, roadmap, and work-items sync
- add a `Tracker Sync` check to `scripts/observability-readiness.js`
- update observability tests with passing and missing-contract coverage
- update observability and GA roadmap docs so the local readiness gate is now 18/18 and records #1848 supply-chain hardening evidence

Validation:
- node tests/scripts/observability-readiness.test.js (9 passed, 0 failed)
- npm run observability:ready -- --format json (18/18, ready true)
- npx markdownlint-cli 'docs/architecture/progress-sync-contract.md' 'docs/architecture/observability-readiness.md' 'docs/ECC-2.0-GA-ROADMAP.md'
- git diff --check
- node tests/docs/ecc2-release-surface.test.js (18 passed)
- node tests/run-all.js (2378 passed, 0 failed)
- GitHub CI for #1849 green across Ubuntu, Windows, and macOS

No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

Affaan Mustafa · 2026-05-13 00:38:18 -04:00

63f9bfc33f

docs: add supply-chain incident response playbook

Add a repo-level supply-chain incident response playbook for npm/GitHub Actions package-registry incidents, anchored on the May 2026 TanStack compromise and prior Shai-Hulud-style npm incidents.

- add `docs/security/supply-chain-incident-response.md` with exposure checks, immediate response steps, workflow rules, publication rules, and escalation triggers
- link the playbook from `SECURITY.md`
- reject `pull_request_target` workflows that restore or save shared dependency caches
- add a regression test for the new `pull_request_target + actions/cache` guardrail

Validation:
- node tests/ci/validate-workflow-security.test.js (12 passed, 0 failed)
- node scripts/ci/validate-workflow-security.js (validated 7 workflow files)
- npx markdownlint-cli 'SECURITY.md' 'docs/security/supply-chain-incident-response.md'
- npx markdownlint-cli '**/*.md' --ignore node_modules
- git diff --check
- node tests/run-all.js (2377 passed, 0 failed)
- GitHub CI for #1848 green across Ubuntu, Windows, and macOS

No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

Affaan Mustafa · 2026-05-13 00:22:28 -04:00

cbecf5689d

ci: require npm audit signature checks

Require npm registry signature verification wherever workflow npm audit checks run.

- add npm audit signatures to CI Security Scan and maintenance security audit jobs
- teach the workflow security validator to reject npm audit without signature verification
- keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior

Validation:
- node tests/run-all.js (2376 passed, 0 failed)
- CI current-head matrix green on #1846

Affaan Mustafa · 2026-05-12 23:48:56 -04:00

797f283036

feat: add GitHub Copilot prompt support

Adds GitHub Copilot VS Code instruction and prompt files for ECC workflows, with VS Code prompt frontmatter/settings aligned to current docs and tests covering the surface.

Co-authored-by: Girish Kanjiyani <girish.kanjiyani5040@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Girish Kanjiyani · 2026-05-12 23:00:00 -04:00

766f4ee1d8

fix: close block-no-verify bypass holes

Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

SeungHyun · 2026-05-12 22:28:12 -04:00

6be241a463

ci: harden workflow install boundaries

- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk

Affaan Mustafa · 2026-05-12 21:55:36 -04:00

daf0355531

ci: ignore install scripts in release workflows (#1839 )

Affaan Mustafa · 2026-05-12 21:36:36 -04:00

33db548be3

docs: add deep-analyzer evaluator scenario

Affaan Mustafa · 2026-05-12 18:52:09 -04:00

37c27a60fd

docs: add skill-quality evaluator scenario

Affaan Mustafa · 2026-05-12 18:36:25 -04:00

337ced0828

docs: add AgentShield policy exception evaluator scenario

Affaan Mustafa · 2026-05-12 18:19:49 -04:00

b25d4770f5

docs: add evaluator harness config scenario

Affaan Mustafa · 2026-05-12 18:03:30 -04:00

3dddfc8270

docs: add evaluator CI failure scenario (#1826 )

Affaan Mustafa · 2026-05-12 17:44:00 -04:00

cd90c84c32

docs: add evaluator billing readiness scenario (#1825 )

Affaan Mustafa · 2026-05-12 17:24:34 -04:00

863519eecf

docs: add evaluator rag prototype (#1824 )

Affaan Mustafa · 2026-05-12 17:04:39 -04:00

dcf5668b27

docs: record rc1 publication dry-run evidence (#1822 )

Affaan Mustafa · 2026-05-12 16:27:52 -04:00

bfacf37715

docs: add HUD status control contract (#1821 )

Affaan Mustafa · 2026-05-12 16:09:18 -04:00

0598af70a5

docs: record stale salvage gap pass (#1818 )

Affaan Mustafa · 2026-05-12 15:18:13 -04:00

4f5f612b61

feat: salvage code-reviewer false-positive guardrails (#1817 )

Affaan Mustafa · 2026-05-12 15:01:46 -04:00

df60af9619

feat: salvage frontend design guidance (#1816 )

Affaan Mustafa · 2026-05-12 14:44:17 -04:00

ab0f0187de

feat: salvage cost tracking and skill scout (#1815 )

Affaan Mustafa · 2026-05-12 14:23:46 -04:00

65c1502ecd

docs: map stale PR salvage sources (#1813 )

Affaan Mustafa · 2026-05-12 13:42:36 -04:00

5d3ed622c6

feat: salvage Django Celery workflow (#1812 )

Source: maintainer-owned salvage of useful Django reviewer/build-resolver/Celery work from stale PR #1310 by mrigank2seven.

- add django-reviewer and django-build-resolver agents

- add django-celery skill with timezone-aware scheduling example

- update catalog counts to 60 agents / 221 skills and record the May 12 salvage gap pass

Co-authored-by: MRIGANK GUPTA <mrigank2seven@users.noreply.github.com>

Affaan Mustafa · 2026-05-12 13:20:33 -04:00

f239379ebf

docs: inventory workspace legacy repos (#1789 )

Affaan Mustafa · 2026-05-12 04:08:34 -04:00

68229a8996

docs: publish stale PR salvage ledger (#1788 )

Affaan Mustafa · 2026-05-12 03:50:34 -04:00

8cbf6763c4

docs: inventory legacy artifacts (#1787 )

Affaan Mustafa · 2026-05-12 03:34:18 -04:00

de559bddd2

docs: add release publication readiness gate (#1786 )

Affaan Mustafa · 2026-05-12 03:16:22 -04:00

008ce3081b

docs: add data-backed harness adapter scorecard (#1785 )

* docs: add data-backed harness adapter scorecard

* fix: normalize adapter matrix line endings

* test: avoid doubled CRLF simulation

Affaan Mustafa · 2026-05-12 02:59:52 -04:00

cdf1b03779

docs: add harness adapter compliance matrix (#1784 )

Affaan Mustafa · 2026-05-12 02:24:04 -04:00

969acd9078

test: harden InsAIts wrapper fake Python shim

Affaan Mustafa · 2026-05-12 01:13:01 -04:00

22aabf7d4f

test: stabilize MCP stderr probe timeout

Affaan Mustafa · 2026-05-12 01:13:01 -04:00

901e41997b

feat: add ECC statusline observability hooks

Salvages the useful statusline/context monitor work from stale PR #1504 while preserving the current continuous-learning hook runner wiring.

Adds the metrics bridge, context monitor, statusline script, shared cost/session bridge utilities, and tests. Fixes the reviewed false loop-detection hash collision for non-file tools, avoids default-session cost inflation, sanitizes statusline task lookup, and records hook payload session IDs in cost-tracker.

Affaan Mustafa · 2026-05-11 23:44:06 -04:00

940135ea47

feat: add Astraflow provider support

Affaan Mustafa · 2026-05-11 23:21:46 -04:00

e9c8845833

fix: scope SessionStart context injection

Affaan Mustafa · 2026-05-11 22:56:29 -04:00

03108bea62

test: harden mcp health port readiness

Affaan Mustafa · 2026-05-11 22:40:19 -04:00

67a8b914ee

fix: harden opencode project file probes

Affaan Mustafa · 2026-05-11 22:40:19 -04:00

6d613f67dd

docs: salvage F# agent and language guidance

Affaan Mustafa · 2026-05-11 21:43:17 -04:00

fd9453f6ee

test: relax InsAIts monitor timeout

Affaan Mustafa · 2026-05-11 19:38:21 -04:00

4220f1b064

feat: salvage windows desktop e2e skill

Reintroduce the Windows desktop E2E testing skill from stale PR #1334 with current manifest wiring, package publish coverage, catalog counts, and sanitized environment-path guidance.

Affaan Mustafa · 2026-05-11 19:15:02 -04:00

14816289ba

fix: salvage stale PR plugin install fixes

Affaan Mustafa · 2026-05-11 18:48:23 -04:00

9b385c9e30

feat: add observability readiness gate

Affaan Mustafa · 2026-05-11 18:33:14 -04:00

8aa8c32d2a

fix: tune machine learning workflow routing

Divyesh Thirukonda · 2026-05-11 18:11:05 -04:00

ab6e998383

feat: add machine learning engineering workflow

(cherry picked from commit 4b0eeacd66)

Divyesh Thirukonda · 2026-05-11 17:55:50 -04:00

240d52d27f

fix: salvage remaining stale queue fixes (#1754 )

Affaan Mustafa · 2026-05-11 16:41:08 -04:00

c45aeee57f

feat: sync GitHub queue into work items

Affaan Mustafa · 2026-05-11 13:07:29 -04:00

fd820d6306

feat: add status exit code gate

Affaan Mustafa · 2026-05-11 12:38:59 -04:00

9887ba6123

feat: add work items CLI

Affaan Mustafa · 2026-05-11 12:24:12 -04:00

b1e67788f7

531 Commits