@bendyline/gilde 0.1.51 → 0.1.53

package/data/craftbook-templates/au/auth-flow/versions/1.0.3/craftbook.json

@@ -0,0 +1,279 @@
+{
+  "id": "auth-flow",
+  "name": "Auth / Session Implementation",
+  "description": "Implement an authentication and session flow — login, session/token issuance, verification, and logout — with the security fundamentals baked in. Threat-models FIRST to lock the security requirements — credential hashing, token/session strategy, expiry, CSRF/XSS posture, and the attacks in scope — then implements registration/login/verify/logout to those requirements, then a security-minded reviewer audits for the classic auth pitfalls. Covers password hashing (bcrypt/argon2), session vs JWT, token expiry/refresh, secure cookie flags, timing-safe comparison, CSRF protection, and brute-force throttling.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Threat scope (planner) — lock the security requirements and threats in scope → gated on artifact `{{workPath}}/threat-scope.md` (markdown-notes)\n2. Build the auth flow (developer) — implement register/login/verify/logout securely → gated on `src/auth.js` (code-module)\n3. Security review (reviewer) — audit for the classic auth pitfalls → gated on artifact `{{workPath}}/review.md` (markdown-notes)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n",
+  "entryStepId": "threat-scope",
+  "triggers": [
+    "implement login",
+    "build an auth flow",
+    "session handling",
+    "add authentication",
+    "jwt or session auth"
+  ],
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "threat-scope",
+      "name": "Threat scope",
+      "description": "lock the security requirements and threats in scope",
+      "prompt": "Lock the security requirements before implementing auth — auth done casually is a vulnerability. Step 1: Decide the session strategy: server sessions vs JWT, where the token lives (httpOnly cookie vs header), and expiry/refresh. Step 2: Lock credential handling: passwords hashed with a strong adaptive function (bcrypt/argon2) and never stored or logged in plaintext, with timing-safe verification. Step 3: Enumerate the threats in scope and the mitigations: brute force (throttling/lockout), CSRF (token or SameSite cookie), XSS (httpOnly), session fixation (rotate on login), and enumeration (uniform error messages). Step 4: Write a numbered acceptance-criteria checklist of 6-9 items (e.g. 'passwords are hashed, never plaintext', 'wrong password and unknown user return the same error', 'sessions expire and rotate on login', 'logout invalidates the session', 'cookies are httpOnly/secure/SameSite'). `write_task_note` the requirements + threat list + checklist and write the same to the produces path.\n\nThe deliverable `{{workPath}}/threat-scope.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "planner",
+      "advanceWhen": {
+        "file": "{{workPath}}/threat-scope.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/threat-scope.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/threat-scope.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "threat-scope",
+        "maxAttempts": 3
+      },
+      "next": "build",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      }
+    },
+    {
+      "id": "build",
+      "name": "Build the auth flow",
+      "description": "implement register/login/verify/logout securely",
+      "prompt": "Implement the auth flow to the security requirements. Step 1: Registration — hash passwords with the chosen adaptive function and a per-user salt; never store/log plaintext. Step 2: Login — look up the user and verify with a timing-safe comparison; on success issue the session/token with expiry and set the cookie with httpOnly/secure/SameSite (rotate the session id to prevent fixation). Step 3: Use a UNIFORM error for both unknown-user and wrong-password to avoid enumeration; add basic brute-force throttling. Step 4: Verify — middleware/function that validates the session/token and rejects expired/invalid ones. Step 5: Logout — invalidate the session server-side and clear the cookie. Add CSRF protection for state-changing routes. Write the implementation to the produces path. On a loop-back, fix only the flagged issue. `write_task_note` the file path and which criteria now pass.",
+      "suggestedRole": "developer",
+      "advanceWhen": {
+        "file": "src/auth.js",
+        "minBytes": 1,
+        "sniff": "nonempty"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "src/auth.js",
+            "bytes": 200
+          },
+          {
+            "kind": "sniff",
+            "file": "src/auth.js",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "esmImports",
+            "file": "src/auth.js"
+          },
+          {
+            "kind": "sourceParses",
+            "file": "src/auth.js"
+          }
+        ],
+        "onReject": "build",
+        "maxAttempts": 3
+      },
+      "next": "review",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "team-management",
+          "videos",
+          "web"
+        ],
+        "outputMedium": "workspace",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      }
+    },
+    {
+      "id": "review",
+      "name": "Security review",
+      "description": "audit for the classic auth pitfalls",
+      "prompt": "Audit the auth implementation against the threat scope and the classic pitfalls. Step 1: Confirm passwords are hashed with a strong adaptive function (not MD5/SHA-1/plaintext) and never logged. Step 2: Confirm login uses timing-safe comparison and that unknown-user vs wrong-password are indistinguishable (no enumeration). Step 3: Confirm sessions/tokens expire, rotate on login, and are invalidated on logout, and that cookies carry httpOnly/secure/SameSite. Step 4: Confirm CSRF protection on state-changing routes and that brute force is throttled. Step 5: Look for secrets hardcoded in source. Write an audit note listing each threat and PASS/FAIL with the specific finding to the produces path.\n\nThe deliverable `{{workPath}}/review.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "{{workPath}}/review.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "src/auth.js",
+            "bytes": 200
+          },
+          {
+            "kind": "sniff",
+            "file": "src/auth.js",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "esmImports",
+            "file": "src/auth.js"
+          },
+          {
+            "kind": "sourceParses",
+            "file": "src/auth.js"
+          }
+        ],
+        "onReject": "review",
+        "maxAttempts": 4
+      },
+      "next": "evaluate",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact"
+      }
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Exercise the auth flow and audit the code. For EACH acceptance criterion: confirm passwords are hashed (never plaintext/logged), confirm unknown-user and wrong-password return identical errors, confirm sessions expire/rotate and logout invalidates, confirm cookies are httpOnly/secure/SameSite, and confirm CSRF + brute-force protections exist. Write PASS/FAIL per criterion; plaintext passwords or user enumeration is an automatic FAIL.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"build\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "src/auth.js"
+        }
+      ],
+      "next": "build",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      }
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "terminal": true,
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      }
+    }
+  ],
+  "version": "1.0.3",
+  "releasedAt": "2026-09-01T20:00:00Z",
+  "minGezelVersion": "1.26233"
+}

package/data/craftbook-templates/au/auth-flow/versions/1.0.3/test.json

@@ -0,0 +1,143 @@
+{
+  "schemaVersion": 1,
+  "title": "Secure auth-flow module",
+  "objective": "Measure whether the auth-flow craftbook scopes threats before writing a password/session flow with basic security controls.",
+  "tags": [
+    "code"
+  ],
+  "prompt": "In the `Auth Flow Eval` project, write `src/auth.js`: a small dependency-free ESM module for a session-based email/password login flow. Include registration, login, logout, session creation/validation, password hashing with Node crypto pbkdf2 or scrypt, CSRF token generation/validation, rate-limit bookkeeping, and safe error messages. Also write `tasks/eval/review.md` with a concise security review that covers password storage, session expiry, CSRF, rate limiting, and what is intentionally out of scope. Do not use live network services or real credentials.",
+  "setup": {
+    "projectName": "Auth Flow Eval",
+    "about": "Self-contained eval project for auth-flow. Deliverables are workspace/src/auth.js and workspace/notes/review.md.",
+    "missionObjectives": "Build a small local auth module and a threat/security review covering storage, sessions, CSRF, and rate limiting.",
+    "files": [],
+    "worker": {
+      "name": "Sander",
+      "role": "Developer"
+    },
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "src/auth.js implements a local auth module and tasks/eval/review.md covers the required security controls.",
+    "deliverables": [
+      {
+        "path": "src/auth.js",
+        "kind": "code-module",
+        "minBytes": 1800,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "pbkdf2|scrypt|crypto",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "register",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "login",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "logout",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "session",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "csrf",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "rate|attempt",
+            "flags": "i"
+          }
+        ]
+      },
+      {
+        "path": "tasks/eval/review.md",
+        "kind": "markdown-notes",
+        "minBytes": 350,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "password|hash",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "session|expiry|expiration",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "csrf",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "rate limit|rate-limit|attempt",
+            "flags": "i"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "src/auth.js",
+      "kind": "typescript"
+    },
+    "axes": [
+      {
+        "name": "correctness",
+        "description": "The module does what the requirements ask, with sensible edge handling."
+      },
+      {
+        "name": "verification",
+        "description": "Self-tests exercise real behavior, not trivial truths."
+      },
+      {
+        "name": "clarity",
+        "description": "Exports, naming, and structure make the module usable without reading every line."
+      },
+      {
+        "name": "robustness",
+        "description": "Invalid input and boundary cases fail loudly rather than silently."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "security scoping",
+    "session flow",
+    "review notes"
+  ]
+}