Commit Graph

6 Commits

Author SHA1 Message Date
Tom Boucher
62db008570 security: add prompt injection guards, path traversal prevention, and input validation
Defense-in-depth security hardening for a codebase where markdown files become
LLM system prompts. Adds centralized security module, PreToolUse hook for
injection detection, and CI-ready codebase scan.

New files:
- security.cjs: path traversal prevention, prompt injection scanner/sanitizer,
  safe JSON parsing, field name validation, shell arg validation
- gsd-prompt-guard.js: PreToolUse hook scans .planning/ writes for injection
- security.test.cjs: 62 unit tests for all security functions
- prompt-injection-scan.test.cjs: CI scan of all agent/workflow/command files

Hardened code paths:
- readTextArgOrFile: path traversal guard (--prd, --text-file)
- cmdStateUpdate/Patch: field name validation prevents regex injection
- cmdCommit: sanitizeForPrompt strips invisible chars from commit messages
- gsd-tools --fields: safeJsonParse wraps unprotected JSON.parse
- cmdFrontmatterGet/Set: null byte rejection
- cmdVerifyPathExists: null byte rejection
- install.js: registers prompt guard hook, updates uninstaller

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-20 11:38:26 -04:00
Tom Boucher
a6ba3e268e feat: PreToolUse workflow guard hook for rogue edit prevention (#678) (#1197)
New opt-in PreToolUse hook that warns when Claude edits files outside
a GSD workflow context (no active /gsd: command or subagent).

Soft guard — advises, does not block. The edit proceeds but Claude
sees a reminder to use /gsd:fast or /gsd:quick for state tracking.

Enable: set hooks.workflow_guard: true in .planning/config.json
Default: disabled (false)

Allows without warning:
- .planning/ files (GSD state management)
- Config files (.gitignore, .env, CLAUDE.md, settings.json)
- Subagent contexts (executor, planner, etc.)

Includes 3s stdin timeout guard and silent fail-safe.

Closes #678
2026-03-18 17:36:07 -04:00
Tom Boucher
14c1dd845b fix(build): add syntax validation to hook build script (#1165)
Prevents shipping hooks with JavaScript SyntaxError (like the duplicate
const cwd declaration that caused PostToolUse errors for all users in
v1.25.1).

The build script now validates each hook file's syntax via vm.Script
before copying to dist/. If any hook has a SyntaxError, the build fails
with a clear error message and exits non-zero, blocking npm publish.

Refs #1107, #1109, #1125, #1161
2026-03-18 09:56:51 -06:00
vinicius-tersi
7542d364b4 feat: context window monitor hook with agent-side WARNING/CRITICAL alerts
Adds PostToolUse hook that reads context metrics from statusline bridge file and injects alerts into agent conversation when context is low.

Features:
- Two-tier alerts: WARNING (<=35% remaining) and CRITICAL (<=25%)
- Smart debounce: 5 tool uses between warnings, severity escalation bypasses
- Silent fail: never blocks tool execution
- Security: session_id sanitized to prevent path traversal

Ref #212
2026-02-20 14:40:08 -06:00
Lex Christopherson
d1fda80c7f revert: remove codebase intelligence system
Rolled back the intel system due to overengineering concerns:
- 1200+ line hook with SQLite graph database
- 21MB sql.js dependency
- Entity generation spawning additional Claude calls
- Complex system with unclear value

Removed:
- /gsd:analyze-codebase command
- /gsd:query-intel command
- gsd-intel-index.js, gsd-intel-session.js, gsd-intel-prune.js hooks
- gsd-entity-generator, gsd-indexer agents
- entity.md template
- sql.js dependency

Preserved:
- Model profiles feature
- Statusline hook
- All other v1.9.x improvements

-3,065 lines removed

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-21 10:28:53 -06:00
Lex Christopherson
cdad7b8ad7 fix: update build script to use gsd-statusline.js
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-20 12:11:08 -06:00