fix: sync hardening + env-gate from the shipped plugin (incl. answer-question.sh injection fix)#2
Merged
Merged
Conversation
Brings the public repo to parity with the shipped plugin (which is the source of truth): UNTRUSTED-title guardrails in INCORPORATE/TRIAGE/tasks, stop-hook set -e resilience, create-task lock fix (always take the internal mkdir lock), archive-task single project-wide lock (fixes a cross-month rewrite race), create-question parameter-expansion trim, digest mktemp temp files, init-project non-git guard + first_task_description + env-status gitignore, env-gate writes in BUILD/DEPLOY/VERIFY, deterministic steering write path (add-steering.sh + steer/pause/stop/status wiring), edit-schedule.sh, AGENTS.md, and a hardened answer-question.sh replacing the awk -v variant (which expanded escape sequences from --answer; the replacement enforces single-line answers). Adds the bats CI workflow and the missing test files; bats tests/ = 193/193. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reverse-sync from the shipped plugin source, which is the source of truth — the public repo had fallen behind it everywhere. Highlights:
answer-question.sh(added in 4c4b682) — that version passed--answerthroughawk -v, which expands escape sequences, letting a crafted answer forge new### Q-…/- **Answer:**blocks ininbox.md. The replacement enforces single-line answers and writes the canonical shape. Also adds the UNTRUSTED-title paraphrase guardrails to INCORPORATE/TRIAGE//redeye:tasks.archive-task.shnow holds one project-wide lock across read-range → append → rewrite (the per-month lock raced thetasks.mdrewrite);create-task.shalways takes its internal mkdir lock (the lock.sh-exists shortcut left ID allocation racing);digest.shusesmktemptemp names.set -euo pipefail;init-project.shworks in non-git directories, supportsfirst_task_description, and gitignores.redeye/env-status.json..redeye/env-status.jsonstable:falseon entry; VERIFY marksstable:trueonly when assessed healthy.add-steering.sh(+ steer/pause/stop/status wiring),edit-schedule.sh,AGENTS.md.Test plan
bats tests/193/193 on this tree🤖 Generated with Claude Code