mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-16 01:02:13 +08:00
* fix(browse): sanitize lone Unicode surrogates at commandResult chokepoint + /batch envelope (#1440) Page captures with mixed-script Unicode round-trip cleanly to the Claude API. Two new utilities in browse/src/sanitize.ts: stripLoneSurrogates for raw UTF-16 strings, stripLoneSurrogateEscapes for \uXXXX JSON escape text. sanitizeBody picks the right pass based on cr.json. buildCommandResponse is extracted from handleCommand (now exported) and applies sanitization before new Response(). /batch was bypassing this chokepoint via direct JSON.stringify, so it sanitizes each cr.result before pushing AND wraps the envelope with stripLoneSurrogateEscapes. Defense in depth wraps at getCleanText, getCleanTextWithStripping, html, accessibility, and snapshot.ts return points so downstream consumers (datamarking, envelope wrapping) see sanitized text before the response is built. 25 new unit tests across sanitize.test.ts and build-command-response.test.ts. content-security.test.ts updated to accept either pre- or post-sanitize form of the snapshot scoped branch (source-level regression check). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat: bug fix wave v1.36.0.0 — Implementation Tasks, allowlist patterns, surrogate-safe page captures (#1440 #1452 #1454) Three filed issues land together: #1440 — Page captures from real-world HTML hit 'API Error 400: no low surrogate in string'. Sanitizers + buildCommandResponse extraction shipped in the prior commit; this commit adds the migration script that patches existing brain-allowlist/privacy-map/gitattributes installs and the supporting tests. #1452 — Federation sync was silently skipping root-level design and test-plan docs. bin/gstack-artifacts-init adds two patterns to all three managed blocks (.brain-allowlist, .brain-privacy-map.json, .gitattributes). Idempotent migration v1.36.0.0.sh repairs existing installs in place via jq (preserves JSON validity) — no commit + push from the migration. #1454 — All four review skills (CEO/design/eng/DX) emit an Implementation Tasks markdown section AND write a jq-built JSONL artifact per phase. /autoplan reads all four files, scopes by current branch + 5-commit window, dedupes on exact (component, sorted(files), title), and renders an aggregated list in the Final Approval Gate. New tests: - browse/test/sanitize.test.ts (18 cases) - browse/test/build-command-response.test.ts (7 cases) - test/artifacts-init-migration.test.ts (7 cases) VERSION → 1.36.0.0. Skips the v1.34.x slot taken by 'gstack consumable as submodule' and the v1.35.0.0 slot taken by /document-generate. #1428 was shipped separately by v1.34.2.0 with a different approach; follow-up #1503 filed for the bare-path filesystem boundary concern surfaced during our analysis. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: bump to v1.38.1.0 VERSION + package.json + CHANGELOG header + migration filename + test reference all consistently at v1.38.1.0. Migration renamed: gstack-upgrade/migrations/v1.38.0.0.sh -> v1.38.1.0.sh. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
62 lines
2.5 KiB
TypeScript
62 lines
2.5 KiB
TypeScript
/**
|
|
* Schema reference for the per-skill Implementation Tasks JSONL artifact (#1454).
|
|
*
|
|
* Each review skill (plan-ceo-review, plan-design-review, plan-eng-review,
|
|
* plan-devex-review) writes one JSONL line per task during its synthesis step
|
|
* to `~/.gstack/projects/$SLUG/tasks-{phase}-{datetime}.jsonl`.
|
|
*
|
|
* `/autoplan`'s Phase 4 aggregator reads ALL phase JSONL files, scopes them
|
|
* by branch + commit window, dedupes by exact (component, sorted(files), title),
|
|
* and renders an `## Implementation Tasks (aggregated across phases)` section
|
|
* inside the Final Approval Gate output.
|
|
*
|
|
* Wire format: one JSON object per line. Build via `jq -nc` from bash — never
|
|
* by hand-rolled echo/printf, because task titles and source findings may
|
|
* contain quotes, newlines, and backslashes.
|
|
*/
|
|
|
|
export type TaskPhase = 'ceo-review' | 'design-review' | 'eng-review' | 'devex-review';
|
|
export type TaskPriority = 'P1' | 'P2' | 'P3';
|
|
|
|
/**
|
|
* One row in tasks-{phase}-{datetime}.jsonl. All fields required unless noted.
|
|
*/
|
|
export interface ImplementationTask {
|
|
/** Which review phase produced this task. */
|
|
phase: TaskPhase;
|
|
/** Unique run identifier for this phase invocation (timestamp + pid suffix). */
|
|
run_id: string;
|
|
/** Branch the review ran on. Aggregator filters by this. */
|
|
branch: string;
|
|
/** HEAD commit at review time. Aggregator filters by commit-window proximity. */
|
|
commit: string;
|
|
/** Short task id, unique within a single run_id (T1, T2, ...). */
|
|
id: string;
|
|
priority: TaskPriority;
|
|
/** Coarse component label (e.g., `browse/sanitizer`, `auth/login`). */
|
|
component: string;
|
|
/** Files the task touches. Aggregator sorts this and uses it in the dedup key. */
|
|
files: string[];
|
|
/** Human-team effort estimate (e.g., "2h", "1 day"). */
|
|
effort_human: string;
|
|
/** CC+gstack effort estimate (e.g., "15min"). */
|
|
effort_cc: string;
|
|
/** Action-oriented title in imperative form ("Add commandResult-level sanitization"). */
|
|
title: string;
|
|
/** Free-text reference to the finding that motivated this task. */
|
|
source_finding: string;
|
|
}
|
|
|
|
/**
|
|
* Dedup key for the aggregator. Two tasks collapse into one ONLY when this
|
|
* tuple is identical (per `D13 finding 9`). Near-duplicates surface as
|
|
* separate tasks with a `possible-duplicate-of: <id>` note.
|
|
*/
|
|
export function dedupKey(t: Pick<ImplementationTask, 'component' | 'files' | 'title'>): string {
|
|
return JSON.stringify({
|
|
component: t.component,
|
|
files: [...t.files].sort(),
|
|
title: t.title,
|
|
});
|
|
}
|