@hegemonart/get-design-done 1.32.0 → 1.33.5

package/scripts/lib/peer-cli/sanitize-env.cjs

@@ -0,0 +1,198 @@
+// scripts/lib/peer-cli/sanitize-env.cjs
+//
+// Plan 33.5-04 — peer-CLI environment sandbox (SC#4; CONTEXT D-03).
+//
+// ============================================================================
+// WHY THIS EXISTS
+// ============================================================================
+//
+// The two peer-CLI clients (acp-client.cjs / asp-client.cjs) spawn external
+// peer binaries (Gemini / Cursor / Copilot / Qwen / Codex) over stdio. Before
+// this module, both clients defaulted the child's environment to the FULL
+// `process.env` whenever the caller did not supply `opts.env` (acp line ~102,
+// asp line ~122). That leaks GDD's own secrets — ANTHROPIC_API_KEY, GH_TOKEN,
+// any GDD_* var — into every spawned peer, even though peers authenticate with
+// their OWN logged-in credentials and have no need for GDD's keys.
+//
+// D-03 (locked) makes the sandbox ALLOWLIST-FORWARD / DEFAULT-DENY: the child
+// env is built from (a) an OS-essential baseline (just enough for a binary to
+// launch on Windows + macOS + Linux) PLUS (b) an explicit caller allowlist read
+// from `.design/config.json#peer_cli.env_allowlist`. Everything else is dropped.
+// GDD secrets and any secret-shaped var are NEVER forwarded unless the operator
+// explicitly allowlists them — a one-line escape hatch for the rare peer that
+// genuinely needs an inherited provider key.
+//
+// No new runtime dependency (D-12): plain JS + a defensive config read that
+// mirrors registry.cjs's `readEnabledPeers` idiom.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// ── OS-essential baseline ────────────────────────────────────────────────────
+//
+// Exact variable names a child process generally needs to *launch* and behave
+// correctly across Windows + POSIX. Kept deliberately pragmatic: anything not
+// here (and not explicitly allowlisted) is dropped. The test only pins that
+// PATH + HOME survive, so this set can evolve without breaking the contract.
+
+const BASELINE = Object.freeze([
+  // PATH resolution (Windows uses `Path`; PATHEXT picks executable suffixes).
+  'PATH',
+  'Path',
+  'PATHEXT',
+  // Home / profile (POSIX HOME; Windows USERPROFILE + HOMEDRIVE/HOMEPATH).
+  'HOME',
+  'USERPROFILE',
+  'HOMEDRIVE',
+  'HOMEPATH',
+  // System roots (Windows).
+  'SystemRoot',
+  'windir',
+  'SystemDrive',
+  // Temp dirs (cross-platform variants).
+  'TEMP',
+  'TMP',
+  'TMPDIR',
+  // Locale / shell.
+  'LANG',
+  'SHELL',
+  // Windows command interpreter + platform descriptors.
+  'COMSPEC',
+  'OS',
+  'NUMBER_OF_PROCESSORS',
+  'PROCESSOR_ARCHITECTURE',
+]);
+
+// Documented baseline PREFIXES — any var whose name starts with one of these is
+// treated as baseline (locale family + Node runtime knobs like NODE_OPTIONS).
+const BASELINE_PREFIXES = Object.freeze(['LC_', 'NODE_']);
+
+// ── Secret matchers (extra guard on the baseline) ─────────────────────────────
+//
+// SECRET_NAME — exact GDD-held secret variable names that must never leak.
+// SECRET_PREFIX — any GDD_* var is GDD-internal and never forwarded.
+// SECRET_SHAPE — generic secret-shaped suffixes; catches third-party keys a
+//   future baseline addition might otherwise let through.
+//
+// All three are overridden ONLY by an explicit entry in opts.allowlist
+// (explicit allowlist WINS — see sanitizeEnv below).
+
+const SECRET_NAME = Object.freeze([
+  'ANTHROPIC_API_KEY',
+  'GH_TOKEN',
+  'GITHUB_TOKEN',
+]);
+
+const SECRET_PREFIX = Object.freeze(['GDD_']);
+
+const SECRET_SHAPE = /(_KEY|_TOKEN|_SECRET|_PASSWORD|_AUTH)$/i;
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+function isBaseline(key) {
+  if (BASELINE.includes(key)) return true;
+  for (const pfx of BASELINE_PREFIXES) {
+    if (key.startsWith(pfx)) return true;
+  }
+  return false;
+}
+
+function isSecret(key) {
+  if (SECRET_NAME.includes(key)) return true;
+  for (const pfx of SECRET_PREFIX) {
+    if (key.startsWith(pfx)) return true;
+  }
+  return SECRET_SHAPE.test(key);
+}
+
+/**
+ * Defensively read `<cwd>/.design/config.json` and extract
+ * `peer_cli.env_allowlist` (a string[]). Returns [] on ANY failure path
+ * (file missing, unparsable, wrong shape) — never throws. Mirrors
+ * registry.cjs's `readEnabledPeers` idiom so both share a defensive reader.
+ *
+ * @param {string} [cwd] defaults to process.cwd()
+ * @returns {string[]} allowlisted env var names (deduped); empty by default
+ */
+function readPeerCliAllowlist(cwd) {
+  const root = typeof cwd === 'string' && cwd.length > 0 ? cwd : process.cwd();
+  const cfgPath = path.join(root, '.design', 'config.json');
+  let raw;
+  try {
+    raw = fs.readFileSync(cfgPath, 'utf8');
+  } catch {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const peerCli = parsed && typeof parsed === 'object' ? parsed.peer_cli : null;
+  const list = peerCli && Array.isArray(peerCli.env_allowlist) ? peerCli.env_allowlist : [];
+  const out = [];
+  const seen = new Set();
+  for (const item of list) {
+    if (typeof item !== 'string' || item.length === 0) continue;
+    if (seen.has(item)) continue;
+    seen.add(item);
+    out.push(item);
+  }
+  return out;
+}
+
+// ── sanitizeEnv ─────────────────────────────────────────────────────────────--
+
+/**
+ * Build a sanitized child environment (allowlist-forward / default-deny).
+ *
+ * For each KEY in sourceEnv, forward it iff:
+ *   - KEY is explicitly in opts.allowlist (explicit allowlist WINS — even over
+ *     the secret filters), OR
+ *   - KEY is in the OS-essential BASELINE (exact name or a documented prefix)
+ *     AND KEY is NOT a GDD secret / secret-shaped var.
+ *
+ * Everything else is dropped. Pure: never mutates the input.
+ *
+ * @param {Record<string,string>} [sourceEnv=process.env]
+ * @param {{ allowlist?: string[] }} [opts]
+ * @returns {Record<string,string>}
+ */
+function sanitizeEnv(sourceEnv, opts) {
+  const src = sourceEnv && typeof sourceEnv === 'object' ? sourceEnv : process.env;
+  const o = opts && typeof opts === 'object' ? opts : {};
+  const allowlist = Array.isArray(o.allowlist) ? new Set(o.allowlist) : new Set();
+
+  const result = {};
+  for (const key of Object.keys(src)) {
+    const value = src[key];
+    // A value that is not a string (e.g. inherited prototype noise) is skipped;
+    // child env entries must be strings.
+    if (typeof value !== 'string') continue;
+
+    // Explicit allowlist wins over everything, including the secret filters.
+    if (allowlist.has(key)) {
+      result[key] = value;
+      continue;
+    }
+    // Otherwise the key must be baseline AND not secret-shaped.
+    if (isBaseline(key) && !isSecret(key)) {
+      result[key] = value;
+    }
+    // Default-deny: anything else is dropped.
+  }
+  return result;
+}
+
+module.exports = {
+  sanitizeEnv,
+  readPeerCliAllowlist,
+  BASELINE,
+  BASELINE_PREFIXES,
+  SECRET_NAME,
+  SECRET_PREFIX,
+  SECRET_SHAPE,
+};

package/scripts/lib/redact.cjs

@@ -45,11 +45,30 @@ const PATTERNS = [
     type: 'slack',
     re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
   },
-  // GitHub personal access token.
+  // GitHub personal access token (classic).
   {
     type: 'github_pat',
     re: /\bghp_[A-Za-z0-9]{36,}\b/g,
   },
+  // Google / Gemini / GCP API key (AIza…). Distinct shape — no collision
+  // with any existing pattern; placed with the specific patterns (D-07, 33.5-05).
+  {
+    type: 'gemini',
+    re: /\bAIza[0-9A-Za-z_\-]{35}\b/g,
+  },
+  // GitHub fine-grained PAT (github_pat_…). Distinct prefix from classic
+  // `ghp_` — both coexist (D-07, 33.5-05).
+  {
+    type: 'github_pat_fine_grained',
+    re: /\bgithub_pat_[0-9A-Za-z_]{22,}\b/g,
+  },
+  // GitHub server/oauth/user/refresh tokens (ghs_/gho_/ghu_/ghr_). The
+  // `[sour]` class excludes `p`, so this never collides with `ghp_` above
+  // (D-07, 33.5-05).
+  {
+    type: 'github_token',
+    re: /\bgh[sour]_[A-Za-z0-9]{36,}\b/g,
+  },
   // AWS access key ID.
   {
     type: 'aws',

package/scripts/lib/skill-behavior/runner.cjs

@@ -0,0 +1,187 @@
+/**
+ * runner.cjs — manifest-driven pressure-scenario runner (Plan 33-01).
+ *
+ * The ROOT engine of Phase 33: every later plan (33-03 scenarios, 33-04 A/B,
+ * 33-05 telemetry) builds on this. It loads a parsed pressure-scenario
+ * manifest, invokes an agent via an INJECTABLE `invokeAgent(prompt, opts) ->
+ * { text }` seam, runs N attempts (default 3), scores each response against
+ * the manifest's expected_compliance[] (must-match regexes) and
+ * expected_violations[] (failure regexes), applies a STRICT 2/3 majority
+ * rule, and emits a structured result.
+ *
+ * D-03 — invoker-agnostic, NO direct Anthropic SDK dependency:
+ *   This file deps on node:fs + node:path ONLY. It NEVER requires the
+ *   Anthropic SDK package. The default invoker is the deterministic stub at
+ *   ./stub-invoker.cjs so CI/tests run with no API key and no network. A
+ *   maintainer later wires a real invoker (peer-CLI ACP spawn or a thin keyed
+ *   SDK adapter) by passing opts.invokeAgent. (The guard test asserts the
+ *   exact package name never appears in this source.)
+ *
+ * Purity / injectability:
+ *   invokeAgent, the clock (now), and fs are all injectable via opts so every
+ *   test drives the stub with a fixed clock.
+ *
+ * Result (EXACT shape):
+ *   {
+ *     scenario: string,            // = manifest.name
+ *     attempts: Array<{            // one entry per attempt (length === attempts)
+ *       text: string,
+ *       pass: boolean,             // ALL compliance matched AND zero violations
+ *       compliance_hits: number,   // # expected_compliance regexes matching this text
+ *       violation_hits: number,    // # expected_violations regexes matching this text
+ *     }>,
+ *     pass: boolean,               // MAJORITY: (#passing attempts) * 2 > attempts.length
+ *     compliance_hits: number,     // aggregate sum across attempts
+ *     violation_hits: number,      // aggregate sum across attempts
+ *   }
+ *
+ * Pattern reference (NOT a dependency): scripts/lib/event-chain.cjs shows the
+ * house CommonJS idiom (defensive fs, pure functions). Style mirrored, not imported.
+ */
+
+'use strict';
+
+const nodeFs = require('node:fs');
+const path = require('node:path');
+
+const DEFAULT_ATTEMPTS = 3;
+
+/**
+ * Load a pressure-scenario manifest. Accepts either an already-parsed object
+ * (returned as-is) or a path to a JSON file (read + parsed via the injectable
+ * fs). Keeping this injectable lets later plans (33-03) load real manifest
+ * files while tests pass inline objects.
+ *
+ * @param {object | string} input  parsed manifest OR a path to a JSON manifest
+ * @param {{ fs?: typeof import('node:fs') }} [deps]
+ * @returns {object} the parsed manifest
+ */
+function loadManifest(input, deps) {
+  if (input && typeof input === 'object') {
+    return input;
+  }
+  if (typeof input === 'string') {
+    const fs = (deps && deps.fs) || nodeFs;
+    const abs = path.isAbsolute(input) ? input : path.resolve(process.cwd(), input);
+    const raw = fs.readFileSync(abs, 'utf8');
+    return JSON.parse(raw);
+  }
+  throw new TypeError('loadManifest: input must be a parsed manifest object or a path string');
+}
+
+/**
+ * Compile an array of regex SOURCE strings into RegExp objects. Manifests
+ * author patterns as plain strings (NOT pre-compiled) so they stay JSON-safe;
+ * the runner owns compilation.
+ *
+ * @param {unknown} sources
+ * @returns {RegExp[]}
+ */
+function compilePatterns(sources) {
+  if (!Array.isArray(sources)) return [];
+  return sources.map((src) => new RegExp(String(src)));
+}
+
+/**
+ * Coerce an invoker's `.text` to a string. A non-string (or absent) value
+ * becomes '' so scoring never throws and is treated as a compliance-miss.
+ *
+ * @param {unknown} response
+ * @returns {string}
+ */
+function textOf(response) {
+  if (response && typeof response.text === 'string') return response.text;
+  return '';
+}
+
+/**
+ * Score a single response text against pre-compiled compliance/violation
+ * regexes.
+ *
+ * @param {string} text
+ * @param {RegExp[]} complianceRes
+ * @param {RegExp[]} violationRes
+ * @returns {{ text: string, pass: boolean, compliance_hits: number, violation_hits: number }}
+ */
+function scoreAttempt(text, complianceRes, violationRes) {
+  const compliance_hits = complianceRes.filter((re) => re.test(text)).length;
+  const violation_hits = violationRes.filter((re) => re.test(text)).length;
+  // An attempt PASSES iff ALL compliance regexes matched AND zero violations did.
+  const pass = compliance_hits === complianceRes.length && violation_hits === 0;
+  return { text, pass, compliance_hits, violation_hits };
+}
+
+/**
+ * Run a pressure scenario: invoke the seam N times, score each response, and
+ * apply a strict majority rule.
+ *
+ * @param {object} manifest  parsed pressure-scenario manifest
+ *   { name, target_skill, pressures[], setup_prompt, expected_compliance[], expected_violations[] }
+ * @param {{
+ *   invokeAgent?: (prompt: string, opts: object) => { text: string },
+ *   attempts?: number,
+ *   now?: () => number,
+ *   fs?: typeof import('node:fs'),
+ * }} [opts]
+ * @returns {{
+ *   scenario: string,
+ *   attempts: Array<{ text: string, pass: boolean, compliance_hits: number, violation_hits: number }>,
+ *   pass: boolean,
+ *   compliance_hits: number,
+ *   violation_hits: number,
+ * }}
+ */
+function runScenario(manifest, opts) {
+  const o = opts || {};
+  // D-03: default to the deterministic stub invoker — never the real SDK.
+  const invokeAgent = o.invokeAgent || require('./stub-invoker.cjs').invokeAgent;
+  const attempts =
+    Number.isInteger(o.attempts) && o.attempts > 0 ? o.attempts : DEFAULT_ATTEMPTS;
+  // Injectable clock (reserved for future telemetry timestamps; called so the
+  // seam is exercised and a fixed now() is honored).
+  const now = typeof o.now === 'function' ? o.now : Date.now;
+
+  const complianceRes = compilePatterns(manifest && manifest.expected_compliance);
+  const violationRes = compilePatterns(manifest && manifest.expected_violations);
+  const scenario = manifest && manifest.name;
+  const prompt = (manifest && manifest.setup_prompt) || '';
+
+  const attemptResults = [];
+  for (let i = 0; i < attempts; i++) {
+    now(); // exercise the injectable clock (deterministic under a fixed now)
+    let text = '';
+    try {
+      // Pass the scenario key through so the stub (or a real invoker) can key on it.
+      const response = invokeAgent(prompt, { scenario, attempt: i });
+      text = textOf(response);
+    } catch (_err) {
+      // A thrown invoker must NOT crash the run — record a failed empty attempt.
+      text = '';
+    }
+    attemptResults.push(scoreAttempt(text, complianceRes, violationRes));
+  }
+
+  const passed = attemptResults.filter((a) => a.pass).length;
+  // STRICT majority: 2/3 and 3/3 pass; 0/3 and 1/3 fail.
+  const pass = passed * 2 > attemptResults.length;
+
+  const compliance_hits = attemptResults.reduce((sum, a) => sum + a.compliance_hits, 0);
+  const violation_hits = attemptResults.reduce((sum, a) => sum + a.violation_hits, 0);
+
+  return {
+    scenario,
+    attempts: attemptResults,
+    pass,
+    compliance_hits,
+    violation_hits,
+  };
+}
+
+module.exports = {
+  runScenario,
+  loadManifest,
+  // Exposed for unit-level reuse / later plans; not part of the core contract.
+  scoreAttempt,
+  compilePatterns,
+  DEFAULT_ATTEMPTS,
+};

package/scripts/lib/skill-behavior/stub-invoker.cjs

@@ -0,0 +1,95 @@
+/**
+ * stub-invoker.cjs — deterministic, scenario-keyed agent invoker (Plan 33-01).
+ *
+ * The DEFAULT invokeAgent seam for `runner.cjs` (D-03): the runner is
+ * invoker-agnostic and exposes an injectable `invokeAgent(prompt, opts) ->
+ * { text }` seam. A maintainer later wires a REAL invoker (a peer-CLI ACP
+ * spawn of a local `claude`/`codex`, or a thin keyed SDK adapter); this stub
+ * is what every Phase-33 CI/structural test drives so runs are reproducible
+ * with NO API key and NO network.
+ *
+ * Determinism contract:
+ *   * NO randomness, NO network, NO @anthropic-ai/sdk.
+ *   * A canned response is resolved by a KEY derived from
+ *     opts.scenario || opts.stubKey, falling back to scanning `prompt` for a
+ *     registered key marker.
+ *   * An UNKNOWN key returns a neutral { text: '' } so the runner never throws.
+ *
+ * Tests MAY instead pass their own inline invokeAgent to runScenario — both
+ * paths are valid (D-03). This module is the no-arg default.
+ */
+
+'use strict';
+
+// Internal canned-response table: key -> response text. Seeded with one
+// illustrative scenario; callers extend it via register().
+const TABLE = new Map([
+  // A neutral, compliance-shaped sample so the default stub is non-empty for a
+  // known demo key. Real scenarios register their own canned text.
+  [
+    'runner-demo',
+    'A <HARD-GATE> blocks me — I must write the brief before any other stage.',
+  ],
+]);
+
+/**
+ * Seed or overwrite a canned response for a scenario key.
+ *
+ * @param {string} key   scenario name / stub key
+ * @param {string} text  canned response text the stub returns for that key
+ * @returns {void}
+ */
+function register(key, text) {
+  if (typeof key !== 'string' || key.length === 0) {
+    throw new TypeError('register: key must be a non-empty string');
+  }
+  TABLE.set(key, typeof text === 'string' ? text : String(text == null ? '' : text));
+}
+
+/**
+ * Resolve a response key from opts, then (as a fallback) by scanning the
+ * prompt for any registered key as a substring marker.
+ *
+ * @param {string} prompt
+ * @param {{scenario?: string, stubKey?: string} | undefined} opts
+ * @returns {string | undefined}
+ */
+function resolveKey(prompt, opts) {
+  if (opts && typeof opts.scenario === 'string' && opts.scenario.length > 0) {
+    return opts.scenario;
+  }
+  if (opts && typeof opts.stubKey === 'string' && opts.stubKey.length > 0) {
+    return opts.stubKey;
+  }
+  if (typeof prompt === 'string' && prompt.length > 0) {
+    for (const key of TABLE.keys()) {
+      if (prompt.includes(key)) return key;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Deterministic invokeAgent-shaped function. Returns a canned { text } for a
+ * known scenario key, or a neutral { text: '' } for an unknown key (so the
+ * runner can score it as a compliance-miss without throwing).
+ *
+ * @param {string} prompt
+ * @param {{scenario?: string, stubKey?: string}} [opts]
+ * @returns {{ text: string }}
+ */
+function invokeAgent(prompt, opts) {
+  const key = resolveKey(prompt, opts);
+  if (key !== undefined && TABLE.has(key)) {
+    return { text: TABLE.get(key) };
+  }
+  // Unknown key -> neutral default; never throw.
+  return { text: '' };
+}
+
+module.exports = {
+  invokeAgent,
+  register,
+  // Exposed for advanced callers/tests that want to inspect or reset seeds.
+  _table: TABLE,
+};