a63684c222
* fix(#1577): isolate WebFetch/WebSearch ingress + opt-in injection blocking Split A of #1573 (security-critical). Scans WebFetch/WebSearch output (the largest untrusted channel) in gsd-read-injection-scanner; shared untrusted-input-boundary reference @-included by the 8 ingest agents (randomized per-wrap delimiters, in-prompt self-scan guard, task-anchoring); opt-in security.injection_blocking (default advisory — non-breaking). arXiv: 2506.05739 (PPA), 2507.15219 (PromptArmor), 2504.20472 (Referencing), 2503.00061 (defense-in-depth). * fix(#1577): address review — honest blocking docs, config key, ADR, property test, revert localized - A1: rewrote the opt-in-blocking doc + Security changeset honestly — the PostToolUse hook is a circuit-breaker (halts the agent's next step), NOT a redactor; it does not scrub content already in the transcript. The prompt-level data/instruction boundary is the primary control. - A2: registered security.injection_blocking in the config schema + defaults manifests (default false) + an e2e config-roundtrip test; the dotted setter writes the nested shape the hook reads. - A3: reverted the 4 hand-edited localized security-model.md (canonical EN only, per convention). - A5: ADR-1577 (untrusted-input boundary + opt-in blocking; redaction-vs-circuit-breaker rationale). - A6: property test — scanner never crashes / only emits valid JSON on unicode/large/malformed input. - Also: inventory (untrusted-input-boundary.md) + agent-size baseline (8 ingest agents) + drift-guard matcher update (Read -> Read|WebFetch|WebSearch). A7 (content<20 early-exit) left as the noted pre-existing follow-up. * fix(#1577): allowlist untrusted-input-boundary.md in injection-scan CI gate The new reference quotes injection phrases ('ignore previous instructions', 'you are now…') as examples agents must NOT comply with, tripping the repo's own prompt-injection-scan.sh diff gate (the standalone 'security' CI job, red on HEAD). Allowlist it alongside the other security docs (security-model.md, TEST-EXAMPLES.md) that legitimately demonstrate injection patterns. The JS scanner test doesn't scan references/, so only the shell gate needed it. Verified: scan --diff origin/next -> 0 findings; scanner JS test 15/15. * fix(#1577): cover AC #2's gsd-ui-researcher + gsd-assumptions-analyzer trek-e Major 1: the @-included set dropped two AC #2 agents. Restore them so no named web-ingress agent is uncovered, keeping the two justified additions (gsd-ai-researcher, gsd-domain-researcher). Final set = AC's 8 + 2 = 10. - gsd-ui-researcher carries the full WebSearch/WebFetch + MCP-fetch toolset. - gsd-assumptions-analyzer reads 5-15 codebase source files (external/source- document ingress per the boundary), though it has no web tools. INGEST_AGENTS in the isolation test now asserts all 10; size baselines regenerated (+60 bytes each, both well under the DEFAULT cap); changeset reworded 8 -> 10. Verified: untrusted-input-isolation 14/14; agent-size-budget 39/39. * docs(#1577): document security.injection_blocking + boundary seam trek-e Major 2 + Minor: - docs/CONFIGURATION.md: add the top-level security.injection_blocking key to the Full Schema and a Security Settings subsection, distinguishing it from the workflow.security_* namespace; honest circuit-breaker-not-redactor framing matching ADR-1577 / security-model. - CONTEXT.md: add the 'Untrusted-input boundary' seam glossary entry. Verified: lint:docs ok; config-field-docs + contributor-standards green. * test(#1577): make read-injection property test git-text, not binary trek-e nit (and more): the file embedded a raw U+FFFF AND a raw NUL byte as degenerate-edge inputs. The NUL is what actually made git classify it binary (git binary = NUL in first 8K). Replace both with text-safe escapes that keep the identical runtime values: '\\x00' and String.fromCodePoint(0xFFFF). File now diffs/blames line-by-line. Verified: property test 2/2; no NUL/raw-noncharacter bytes remain. * docs(#1577): align untrusted boundary docs Name all 10 ingress agents in INVENTORY/security-model and allowlist the intentional read-injection property corpus for the prompt-injection scanner. * docs(#1577): align ADR ingest agent count Update ADR-1577 from 8 to 10 ingest agents so it matches the actual boundary include set and the rest of the docs. --------- Co-authored-by: Tom Boucher <trekkie@nomorestars.com>
182 lines
6.0 KiB
JSON
182 lines
6.0 KiB
JSON
{
|
|
"_comment": "Canonical schema manifest for valid config key paths. This manifest is the single CJS source of truth for valid config keys; dynamicKeyPatterns source strings are recompiled to RegExp at runtime by config-schema.cjs. runtimeStateKeys mirrors RUNTIME_STATE_KEYS.",
|
|
"validKeys": [
|
|
"mode",
|
|
"granularity",
|
|
"parallelization",
|
|
"commit_docs",
|
|
"model_profile",
|
|
"search_gitignored",
|
|
"brave_search",
|
|
"firecrawl",
|
|
"exa_search",
|
|
"workflow.plan_check",
|
|
"workflow.verifier",
|
|
"workflow.auto_advance",
|
|
"workflow.node_repair",
|
|
"workflow.node_repair_budget",
|
|
"workflow.human_verify_mode",
|
|
"workflow.text_mode",
|
|
"workflow.research_before_questions",
|
|
"workflow.discuss_mode",
|
|
"workflow.skip_discuss",
|
|
"workflow.auto_prune_state",
|
|
"workflow.use_worktrees",
|
|
"workflow.worktree_skip_hooks",
|
|
"workflow.code_review_command",
|
|
"workflow.plan_bounce",
|
|
"workflow.plan_bounce_script",
|
|
"workflow.plan_bounce_passes",
|
|
"workflow.plan_chunked",
|
|
"workflow.plan_review_convergence",
|
|
"code_quality.fallow.enabled",
|
|
"code_quality.fallow.scope",
|
|
"code_quality.fallow.profile",
|
|
"code_quality.fallow.mcp",
|
|
"ship.pr_body_sections",
|
|
"git.branching_strategy",
|
|
"git.base_branch",
|
|
"git.create_tag",
|
|
"git.phase_branch_template",
|
|
"git.milestone_branch_template",
|
|
"git.quick_branch_template",
|
|
"planning.commit_docs",
|
|
"planning.search_gitignored",
|
|
"planning.sub_repos",
|
|
"review.ollama_host",
|
|
"review.lm_studio_host",
|
|
"review.llama_cpp_host",
|
|
"review.default_reviewers",
|
|
"review.max_prompt_tokens",
|
|
"review.max_prompt_tokens_per_reviewer",
|
|
"workflow.cross_ai_execution",
|
|
"workflow.cross_ai_command",
|
|
"workflow.cross_ai_timeout",
|
|
"workflow.subagent_timeout",
|
|
"workflow.test_command",
|
|
"workflow.build_command",
|
|
"workflow.mvp_mode",
|
|
"workflow.context_guard_mode",
|
|
"executor.stall_detect_interval_minutes",
|
|
"executor.stall_threshold_minutes",
|
|
"workflow.inline_plan_threshold",
|
|
"hooks.context_warnings",
|
|
"hooks.workflow_guard",
|
|
"workflow.context_coverage_gate",
|
|
"statusline.show_last_command",
|
|
"statusline.context_position",
|
|
"workflow.max_discuss_passes",
|
|
"features.thinking_partner",
|
|
"context",
|
|
"features.global_learnings",
|
|
"learnings.max_inject",
|
|
"project_code",
|
|
"phase_id_convention",
|
|
"phase_naming",
|
|
"manager.flags.discuss",
|
|
"manager.flags.plan",
|
|
"manager.flags.execute",
|
|
"response_language",
|
|
"context_window",
|
|
"graphify.build_timeout",
|
|
"graphify.auto_update",
|
|
"claude_md_path",
|
|
"claude_md_assembly.mode",
|
|
"runtime",
|
|
"resolve_model_ids",
|
|
"effort.default",
|
|
"fast_mode.enabled",
|
|
"plan_review.source_grounding",
|
|
"plan_review.source_grounding_authority",
|
|
"model_policy.provider",
|
|
"model_policy.budget",
|
|
"model_policy.high",
|
|
"model_policy.medium",
|
|
"model_policy.low",
|
|
"agent_skills_security.trusted_global_roots",
|
|
"capabilities.strict_known_registries",
|
|
"capabilities.auto_update",
|
|
"security.injection_blocking"
|
|
],
|
|
"runtimeStateKeys": [
|
|
"workflow._auto_chain_active"
|
|
],
|
|
"dynamicKeyPatterns": [
|
|
{
|
|
"topLevel": "agent_skills",
|
|
"source": "^agent_skills\\.[a-zA-Z0-9_-]+$",
|
|
"description": "agent_skills.<agent-type>"
|
|
},
|
|
{
|
|
"topLevel": "review",
|
|
"source": "^review\\.models\\.[a-zA-Z0-9_-]+$",
|
|
"description": "review.models.<cli-name>"
|
|
},
|
|
{
|
|
"topLevel": "features",
|
|
"source": "^features\\.[a-zA-Z0-9_]+$",
|
|
"description": "features.<feature_name>"
|
|
},
|
|
{
|
|
"topLevel": "claude_md_assembly",
|
|
"source": "^claude_md_assembly\\.blocks\\.[a-zA-Z0-9_]+$",
|
|
"description": "claude_md_assembly.blocks.<section>"
|
|
},
|
|
{
|
|
"topLevel": "model_profile_overrides",
|
|
"source": "^model_profile_overrides\\.[a-zA-Z0-9_-]+\\.(opus|sonnet|haiku)$",
|
|
"description": "model_profile_overrides.<runtime>.<opus|sonnet|haiku>"
|
|
},
|
|
{
|
|
"topLevel": "models",
|
|
"source": "^models\\.(planning|discuss|research|execution|verification|completion)$",
|
|
"description": "models.<planning|discuss|research|execution|verification|completion>"
|
|
},
|
|
{
|
|
"topLevel": "granularities",
|
|
"source": "^granularities\\.(planning|discuss|research|execution|verification|completion)$",
|
|
"description": "granularities.<planning|discuss|research|execution|verification|completion>"
|
|
},
|
|
{
|
|
"topLevel": "dynamic_routing",
|
|
"source": "^dynamic_routing\\.(enabled|escalate_on_failure|max_escalations|tier_models\\.(light|standard|heavy))$",
|
|
"description": "dynamic_routing.<enabled|escalate_on_failure|max_escalations|tier_models.<light|standard|heavy>>"
|
|
},
|
|
{
|
|
"topLevel": "model_overrides",
|
|
"source": "^model_overrides\\.[a-zA-Z0-9_-]+$",
|
|
"description": "model_overrides.<agent-id>"
|
|
},
|
|
{
|
|
"topLevel": "effort",
|
|
"source": "^effort\\.routing_tier_defaults\\.(light|standard|heavy)$",
|
|
"description": "effort.routing_tier_defaults.<light|standard|heavy>"
|
|
},
|
|
{
|
|
"topLevel": "effort",
|
|
"source": "^effort\\.agent_overrides\\.[a-zA-Z0-9_-]+$",
|
|
"description": "effort.agent_overrides.<agent-id>"
|
|
},
|
|
{
|
|
"topLevel": "fast_mode",
|
|
"source": "^fast_mode\\.routing_tier_defaults\\.(light|standard|heavy)$",
|
|
"description": "fast_mode.routing_tier_defaults.<light|standard|heavy>"
|
|
},
|
|
{
|
|
"topLevel": "fast_mode",
|
|
"source": "^fast_mode\\.agent_overrides\\.[a-zA-Z0-9_-]+$",
|
|
"description": "fast_mode.agent_overrides.<agent-id>"
|
|
},
|
|
{
|
|
"topLevel": "review",
|
|
"source": "^review\\.max_prompt_tokens_per_reviewer\\.[a-zA-Z0-9_-]+$",
|
|
"description": "review.max_prompt_tokens_per_reviewer.<reviewer-slug>"
|
|
},
|
|
{
|
|
"topLevel": "model_policy",
|
|
"source": "^model_policy\\.runtime_tiers\\.[a-zA-Z0-9_-]+\\.(opus|sonnet|haiku)$",
|
|
"description": "model_policy.runtime_tiers.<runtime>.<opus|sonnet|haiku>"
|
|
}
|
|
]
|
|
}
|