@amg555/frameforge-mcp 2.7.6 → 2.7.7

package/.agent/skills/gstack-browse/src/routes/tunnel.ts

@@ -1,62 +0,0 @@
-/**
- * POST /tunnel/start — start the ngrok tunnel on demand (root-only).
- *
- * Dual-listener model: binds a SECOND Bun.serve listener on an ephemeral
- * 127.0.0.1 port dedicated to tunnel traffic, then points ngrok.forward() at
- * THAT port. The local listener (which serves /extension-token,
- * /cookie-picker, /inspector/*, welcome, etc.) is never exposed to ngrok.
- * Hard fail if the tunnel listener bind fails — NEVER fall back to the local
- * port, which would silently defeat the whole security property.
- */
-
-import { json, jsonError, type RouteEntry } from './table';
-import { isPairAgentEnabled } from '../config';
-
-export const tunnelRoutes: RouteEntry[] = [
-  {
-    method: 'POST', path: '/tunnel/start', auth: 'root-token', surfaces: ['local'],
-    handler: async (_req, _r, ctx) => {
-      if (!isPairAgentEnabled()) {
-        // Consent-on-first-use: the /pair-agent skill asks once and sets the
-        // key; a direct API caller gets the same hint instead of a tunnel.
-        return jsonError(403, 'pair-agent is off (tunnel exposes this browser beyond the machine)', {
-          hint: 'enable once with: gstack-config set pair_agent on — or run /pair-agent, which asks for consent and sets it',
-        });
-      }
-      const tunnel = ctx.tunnel.state();
-      if (tunnel.active && tunnel.url && tunnel.hasListener) {
-        // Verify tunnel is still alive before returning cached URL.
-        // Probe GET /connect (the only unauth-reachable path on the tunnel
-        // surface); /health is NOT tunnel-reachable under dual-listener.
-        try {
-          const probe = await fetch(`${tunnel.url}/connect`, {
-            method: 'GET',
-            headers: { 'ngrok-skip-browser-warning': 'true' },
-            signal: AbortSignal.timeout(5000),
-          });
-          if (probe.ok) return json({ url: tunnel.url, already_active: true });
-        } catch {}
-        // Tunnel is dead — tear down cleanly before restarting
-        console.warn('[browse] Cached tunnel is dead, restarting...');
-        await ctx.tunnel.close();
-      }
-
-      // 1) Resolve ngrok authtoken from env / .gstack / native config
-      const authtoken = ctx.tunnel.resolveAuthtoken();
-      if (!authtoken) {
-        return jsonError(400, 'No ngrok authtoken found', { hint: 'Run: ngrok config add-authtoken YOUR_TOKEN' });
-      }
-
-      // 2) Bind the tunnel listener + open ngrok via the shared startTunnel
-      //    helper (hard-fails the bind, cleans up both ngrok and the Bun
-      //    listener on any post-bind failure).
-      const started = await ctx.tunnel.start(authtoken);
-      if (!started.ok) {
-        return jsonError(500, started.stage === 'bind'
-          ? `Failed to bind tunnel listener: ${started.error.message}`
-          : `Failed to open ngrok tunnel: ${started.error.message}`);
-      }
-      return json({ url: started.url });
-    },
-  },
-];

package/.agent/skills/gstack-browse/src/sanitize.ts

@@ -1,49 +0,0 @@
-// Lone Unicode surrogate sanitization.
-//
-// Lone surrogates (\uD800-\uDFFF without a matching pair) are valid UTF-16
-// but invalid UTF-8, so JSON.stringify produces output the Claude API rejects
-// with HTTP 400 "no low surrogate in string". Page captures from real-world
-// HTML hit this when content contains broken emoji bytes or mid-emoji splits.
-//
-// Two sanitizers are needed because both forms appear in browse responses:
-//   - Raw UTF-16 surrogates in text/plain bodies (pre-stringify state).
-//   - JSON \uXXXX escape sequences after JSON.stringify already ran.
-// Both replace lone surrogates with U+FFFD (replacement character).
-
-const LONE_SURROGATE_HIGH = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])/g;
-const LONE_SURROGATE_LOW = /(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
-
-export function stripLoneSurrogates(s: string): string {
-  return s.replace(LONE_SURROGATE_HIGH, '�').replace(LONE_SURROGATE_LOW, '�');
-}
-
-/**
- * JSON.stringify replacer that strips lone UTF-16 surrogates from string
- * values before they get escape-encoded. Pair with stringify when the
- * consumer will JSON.parse the payload back into JS strings (SSE clients
- * do this). Required at every JSON/SSE egress that ships page-content-derived
- * fields — see CLAUDE.md "Unicode sanitization at server egress".
- *
- * The replacer must run INSIDE the encoding pipeline: post-stringify regex
- * is a no-op because JSON.stringify has already converted \uD800 into the
- * literal escape text "\\ud800" before a regex could see the surrogate.
- */
-export function sanitizeReplacer(_key: string, value: unknown): unknown {
-  return typeof value === 'string' ? stripLoneSurrogates(value) : value;
-}
-
-// Matches \uD8XX-\uDFXX escape text where the pair is not completed by an
-// adjacent \uDC00-\uDFFF (high) or preceded by \uD800-\uDBFF (low).
-const LONE_SURROGATE_HIGH_ESCAPE = /\\u[Dd][89ABab][0-9A-Fa-f]{2}(?!\\u[Dd][C-Fc-f][0-9A-Fa-f]{2})/g;
-const LONE_SURROGATE_LOW_ESCAPE = /(?<!\\u[Dd][89ABab][0-9A-Fa-f]{2})\\u[Dd][C-Fc-f][0-9A-Fa-f]{2}/g;
-
-export function stripLoneSurrogateEscapes(s: string): string {
-  return s.replace(LONE_SURROGATE_HIGH_ESCAPE, '\\uFFFD').replace(LONE_SURROGATE_LOW_ESCAPE, '\\uFFFD');
-}
-
-// Pick the right sanitizer based on whether the body has already been JSON-stringified.
-// For application/json bodies, run both passes: raw first (in case the JSON encoder
-// emitted surrogates as-is rather than escaping), then escape-text.
-export function sanitizeBody(body: string, isJson: boolean): string {
-  return isJson ? stripLoneSurrogateEscapes(stripLoneSurrogates(body)) : stripLoneSurrogates(body);
-}

package/.agent/skills/gstack-browse/src/screenshot-size-guard.ts

@@ -1,106 +0,0 @@
-/**
- * Screenshot size guard — keep full-page screenshots ≤ 2000px max-dim.
- *
- * The Anthropic vision API rejects images whose longest dimension exceeds
- * 2000 image-pixels (post deviceScaleFactor). Full-page screenshots of long
- * pages routinely exceed that, silently bricking the session: the agent
- * burns turns on a base64 blob that errors model-side with no useful
- * stderr surfacing on the browse side.
- *
- * This module centralizes the "after page.screenshot, check dimensions and
- * downscale if too big" path so every full-page caller in browse/src can
- * share the same enforcement. The cap is image-pixels, not CSS pixels,
- * matching the Anthropic API's own threshold.
- *
- * Used by: snapshot.ts (annotated, heatmap), meta-commands.ts (screenshot),
- * write-commands.ts (prettyscreenshot). See test/snapshot-meta-write-guard.test.ts.
- *
- * Closes #1214.
- */
-
-import { writeFileSync, readFileSync } from "fs";
-
-const MAX_DIMENSION_PX = 2000;
-
-export interface SizeGuardResult {
-  /** True if the input image exceeded MAX_DIMENSION_PX and was downscaled. */
-  resized: boolean;
-  /** Final width and height (pixels) of the image as written/returned. */
-  width: number;
-  height: number;
-  /** Original dimensions before any downscale. */
-  originalWidth: number;
-  originalHeight: number;
-}
-
-/**
- * Inspect an image buffer and downscale if its longest side exceeds the
- * 2000px Anthropic vision API cap. Preserves aspect ratio. Encodes back
- * to PNG. Returns the resulting buffer plus a diagnostic shape.
- *
- * Imports sharp lazily so the module load cost only hits screenshot paths
- * (sharp's native binding is non-trivial to initialize).
- */
-export async function guardScreenshotBuffer(input: Buffer): Promise<{ buffer: Buffer; result: SizeGuardResult }> {
-  const sharpModule = await import("sharp");
-  const sharp = sharpModule.default ?? sharpModule;
-  const image = sharp(input);
-  const metadata = await image.metadata();
-  const width = metadata.width ?? 0;
-  const height = metadata.height ?? 0;
-
-  const longest = Math.max(width, height);
-  if (longest <= MAX_DIMENSION_PX) {
-    return {
-      buffer: input,
-      result: {
-        resized: false,
-        width,
-        height,
-        originalWidth: width,
-        originalHeight: height,
-      },
-    };
-  }
-
-  const scale = MAX_DIMENSION_PX / longest;
-  const newWidth = Math.round(width * scale);
-  const newHeight = Math.round(height * scale);
-
-  const resized = await image
-    .resize(newWidth, newHeight, { fit: "inside" })
-    .png()
-    .toBuffer();
-
-  process.stderr.write(
-    `[screenshot-size-guard] image ${width}x${height} exceeded ${MAX_DIMENSION_PX}px max-dim; ` +
-      `downscaled to ${newWidth}x${newHeight} to fit Anthropic vision API\n`,
-  );
-
-  return {
-    buffer: resized,
-    result: {
-      resized: true,
-      width: newWidth,
-      height: newHeight,
-      originalWidth: width,
-      originalHeight: height,
-    },
-  };
-}
-
-/**
- * File-mode variant: read the image at the given path, downscale if
- * needed, and write the result back to the same path. Returns the
- * diagnostic shape. Use this after `await page.screenshot({ path, ... })`.
- */
-export async function guardScreenshotPath(filePath: string): Promise<SizeGuardResult> {
-  const input = readFileSync(filePath);
-  const { buffer, result } = await guardScreenshotBuffer(input);
-  if (result.resized) {
-    writeFileSync(filePath, buffer);
-  }
-  return result;
-}
-
-export const SCREENSHOT_MAX_DIMENSION_PX = MAX_DIMENSION_PX;

package/.agent/skills/gstack-browse/src/security-classifier.ts

@@ -1,258 +0,0 @@
-/**
- * Security classifier — ML prompt injection detection (L4, TestSavantAI).
- *
- * This module is IMPORTED ONLY BY security-sidecar-entry.ts and runs inside
- * the security sidecar subprocess (plain Node, spawned lazily by
- * security-sidecar-client.ts). It CANNOT be imported by server.ts or any
- * other module that ends up in the compiled browse binary, because
- * @huggingface/transformers requires onnxruntime-node at runtime and that
- * native module fails to dlopen from Bun's compiled-binary temp extraction
- * dir.
- *
- * See: 2026-04-19-prompt-injection-guard.md Pre-Impl Gate 1 outcome.
- *
- * Layer:
- *   L4 (testsavant_content) — TestSavantAI BERT-small ONNX classifier on page
- *                              snapshots and tool outputs. Detects indirect
- *                              prompt injection + jailbreak attempts.
- *
- * The classifier degrades gracefully — if the model fails to load, the layer
- * reports status 'degraded' and returns verdict 'safe' (fail-open). The
- * caller (server.ts's /pty-inject-scan path) falls through to its
- * L1-L3-only verdict; only the extra ML defense disappears.
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-import { mkdirSecure } from './file-permissions';
-import { type LayerSignal } from './security';
-import { resolveStateRoot } from '../../lib/state-root';
-
-// ─── Model location + packaging ──────────────────────────────
-
-/**
- * TestSavantAI prompt-injection-defender-small-v0-onnx.
- *
- * The HuggingFace repo stores model.onnx at the root, but @huggingface/transformers
- * v4 expects it under an `onnx/` subdirectory. We stage the files into the expected
- * layout at ~/.gstack/models/testsavant-small/ on first use.
- *
- * Files (fetched from HF on first use, cached for lifetime of install):
- *   config.json
- *   tokenizer.json
- *   tokenizer_config.json
- *   special_tokens_map.json
- *   vocab.txt
- *   onnx/model.onnx  (~112MB)
- */
-const MODELS_DIR = path.join(resolveStateRoot(), 'models');
-const TESTSAVANT_DIR = path.join(MODELS_DIR, 'testsavant-small');
-const TESTSAVANT_HF_URL = 'https://huggingface.co/testsavantai/prompt-injection-defender-small-v0-onnx/resolve/main';
-const TESTSAVANT_FILES = [
-  'config.json',
-  'tokenizer.json',
-  'tokenizer_config.json',
-  'special_tokens_map.json',
-  'vocab.txt',
-];
-
-// ─── Load state ──────────────────────────────────────────────
-
-type LoadState = 'uninitialized' | 'loading' | 'loaded' | 'failed';
-
-let testsavantState: LoadState = 'uninitialized';
-let testsavantClassifier: any = null;
-let testsavantLoadError: string | null = null;
-
-export interface ClassifierStatus {
-  testsavant: 'ok' | 'degraded' | 'off';
-}
-
-export function getClassifierStatus(): ClassifierStatus {
-  const testsavant =
-    testsavantState === 'loaded' ? 'ok' :
-    testsavantState === 'failed' ? 'degraded' :
-    'off';
-  return { testsavant };
-}
-
-// ─── Model download + staging ────────────────────────────────
-
-export async function downloadFile(url: string, dest: string): Promise<void> {
-  const res = await fetch(url);
-  if (!res.ok || !res.body) {
-    throw new Error(`Failed to fetch ${url}: ${res.status} ${res.statusText}`);
-  }
-  const tmp = `${dest}.tmp.${process.pid}`;
-  const writer = fs.createWriteStream(tmp);
-  // @ts-ignore — Node stream compat
-  const reader = res.body.getReader();
-  try {
-    let done = false;
-    while (!done) {
-      const chunk = await reader.read();
-      if (chunk.done) { done = true; break; }
-      writer.write(chunk.value);
-    }
-    await new Promise<void>((resolve, reject) => {
-      writer.end((err?: Error | null) => (err ? reject(err) : resolve()));
-    });
-    fs.renameSync(tmp, dest);
-  } catch (err) {
-    // Drop the half-written tmp so we don't ship a truncated model file to
-    // a retry's renameSync. Wait for the writer to close fully before
-    // unlinking: Node's createWriteStream lazily opens the FD and flushes
-    // buffered writes during destroy(), so a naive unlinkSync hits ENOENT
-    // first and the writer re-creates the file on the next tick.
-    await new Promise<void>((resolve) => {
-      writer.once('close', () => resolve());
-      writer.destroy();
-    });
-    try { fs.unlinkSync(tmp); } catch { /* nothing to clean */ }
-    throw err;
-  }
-}
-
-async function ensureTestsavantStaged(onProgress?: (msg: string) => void): Promise<void> {
-  mkdirSecure(path.join(TESTSAVANT_DIR, 'onnx'));
-
-  // Small config/tokenizer files
-  for (const f of TESTSAVANT_FILES) {
-    const dst = path.join(TESTSAVANT_DIR, f);
-    if (fs.existsSync(dst)) continue;
-    onProgress?.(`downloading ${f}`);
-    await downloadFile(`${TESTSAVANT_HF_URL}/${f}`, dst);
-  }
-
-  // Large model file — only download if missing. Put under onnx/ to match the
-  // layout @huggingface/transformers v4 expects.
-  const modelDst = path.join(TESTSAVANT_DIR, 'onnx', 'model.onnx');
-  if (!fs.existsSync(modelDst)) {
-    onProgress?.('downloading model.onnx (112MB) — first run only');
-    await downloadFile(`${TESTSAVANT_HF_URL}/model.onnx`, modelDst);
-  }
-}
-
-// ─── L4: TestSavantAI content classifier ─────────────────────
-
-/**
- * Load the TestSavantAI classifier. Idempotent — concurrent calls share the
- * same in-flight promise. Sets state to 'loaded' on success or 'failed' on error.
- *
- * Called by the sidecar on the first scan-page-content request to warm up.
- * First call triggers the model download (~112MB from HuggingFace).
- * Subsequent calls reuse the cached instance.
- */
-let loadPromise: Promise<void> | null = null;
-
-export function loadTestsavant(onProgress?: (msg: string) => void): Promise<void> {
-  if (process.env.GSTACK_SECURITY_OFF === '1') {
-    testsavantState = 'failed';
-    testsavantLoadError = 'GSTACK_SECURITY_OFF=1 — ML classifier kill switch engaged';
-    return Promise.resolve();
-  }
-  if (testsavantState === 'loaded') return Promise.resolve();
-  if (loadPromise) return loadPromise;
-  testsavantState = 'loading';
-  loadPromise = (async () => {
-    try {
-      await ensureTestsavantStaged(onProgress);
-      // Dynamic import — keeps the module boundary clean so static analyzers
-      // don't pull @huggingface/transformers into compiled contexts.
-      onProgress?.('initializing classifier');
-      const { pipeline, env } = await import('@huggingface/transformers');
-      env.allowLocalModels = true;
-      env.allowRemoteModels = false;
-      env.localModelPath = MODELS_DIR;
-      testsavantClassifier = await pipeline(
-        'text-classification',
-        'testsavant-small',
-        { dtype: 'fp32' },
-      );
-      // TestSavantAI's tokenizer_config.json ships with model_max_length
-      // set to a huge placeholder (1e18) which disables automatic truncation
-      // in the TextClassificationPipeline. The underlying BERT-small has
-      // max_position_embeddings: 512 — passing anything longer throws a
-      // broadcast error. Override via _tokenizerConfig (the internal source
-      // the computed model_max_length getter reads from) so the pipeline's
-      // implicit truncation: true actually kicks in.
-      const tok = testsavantClassifier?.tokenizer as any;
-      if (tok?._tokenizerConfig) {
-        tok._tokenizerConfig.model_max_length = 512;
-      }
-      testsavantState = 'loaded';
-    } catch (err: any) {
-      testsavantState = 'failed';
-      testsavantLoadError = err?.message ?? String(err);
-      console.error('[security-classifier] Failed to load TestSavantAI:', testsavantLoadError);
-    }
-  })();
-  return loadPromise;
-}
-
-/**
- * Strip HTML tags and collapse whitespace. TestSavantAI was trained on
- * plain text, not markup — feeding it raw HTML massively reduces recall
- * because all the tag noise dilutes the injection signal. Callers that
- * already have plain text (page snapshot innerText, tool output strings)
- * get no-op behavior; callers with HTML get the markup stripped.
- */
-function htmlToPlainText(input: string): string {
-  // Fast path: if no angle brackets, it's already plain text.
-  if (!input.includes('<')) return input;
-  return input
-    .replace(/<(script|style)[^>]*>[\s\S]*?<\/\1>/gi, ' ') // drop script/style bodies entirely
-    .replace(/<[^>]+>/g, ' ')                               // drop tags
-    .replace(/&nbsp;/g, ' ')
-    .replace(/&amp;/g, '&')
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>')
-    .replace(/&quot;/g, '"')
-    .replace(/\s+/g, ' ')
-    .trim();
-}
-
-/**
- * Scan text content for prompt injection. Intended for page snapshots, tool
- * outputs, and other untrusted content blocks.
- *
- * Returns a LayerSignal. On load failure or classification error, returns
- * confidence=0 with status flagged degraded — the verdict combiner in
- * security.ts then falls through to 'safe' (fail-open by design).
- *
- * Note: TestSavantAI returns {label: 'INJECTION'|'SAFE', score: 0-1}. When
- * label is 'SAFE', we return confidence=0 to the combiner. When label is
- * 'INJECTION', we return the score directly.
- */
-export async function scanPageContent(text: string): Promise<LayerSignal> {
-  if (!text || text.length === 0) {
-    return { layer: 'testsavant_content', confidence: 0 };
-  }
-  if (testsavantState !== 'loaded') {
-    return { layer: 'testsavant_content', confidence: 0, meta: { degraded: true } };
-  }
-  try {
-    // Normalize to plain text first — the classifier is trained on natural
-    // language, not HTML markup. A page with an injection buried in tag
-    // soup won't fire until we strip the noise.
-    const plain = htmlToPlainText(text);
-    // Character-level cap to avoid pathological memory use. The pipeline
-    // applies tokenizer truncation at 512 tokens (the BERT-small context
-    // limit — enforced via the model_max_length override in loadTestsavant)
-    // so the 4000-char cap is just a cheap upper bound. Real-world
-    // injection signals land in the first few hundred tokens anyway.
-    const input = plain.slice(0, 4000);
-    const raw = await testsavantClassifier(input);
-    const top = Array.isArray(raw) ? raw[0] : raw;
-    const label = top?.label ?? 'SAFE';
-    const score = Number(top?.score ?? 0);
-    if (label === 'INJECTION') {
-      return { layer: 'testsavant_content', confidence: score, meta: { label } };
-    }
-    return { layer: 'testsavant_content', confidence: 0, meta: { label, safeScore: score } };
-  } catch (err: any) {
-    testsavantState = 'failed';
-    testsavantLoadError = err?.message ?? String(err);
-    return { layer: 'testsavant_content', confidence: 0, meta: { degraded: true, error: testsavantLoadError } };
-  }
-}