Tom Boucher
b37c487325
feat(security): package legitimacy gate against slopsquatting (#3215)
* feat(security): package legitimacy gate against slopsquatting (#2827)
GSD's research → plan → execute pipeline had no install-time legitimacy
gate: a hallucinated package name that passes `npm view` could flow all
the way to `gsd-executor` running `npm install <malicious-pkg>` with no
human checkpoint. This PR closes that gap.
Changes:
- gsd-phase-researcher: runs slopcheck on every recommended package;
emits `## Package Legitimacy Audit` table; strips [SLOP] packages;
ecosystem-specific verification (pip/npm/cargo); WebSearch-sourced
packages tagged [ASSUMED]; ctx7 fallback uses `command -v` guard
instead of `npx --yes`
- gsd-planner: injects `checkpoint:human-verify` before [ASSUMED]/[SUS]
installs; adds T-{phase}-SC STRIDE row to <threat_model> template;
ctx7 fallback also uses `command -v` guard
- gsd-executor: RULE 3 excludes package installs from auto-fix; failed
installs surface as checkpoints, never silent substitutions
- tests/package-legitimacy-gate.test.cjs: 24 structural assertions
covering the full gate (node:test + node:assert, no raw .includes())
- docs: USER-GUIDE, COMMANDS, ARCHITECTURE updated with gate description
- .changeset: Security fragment for v1.51 release notes
Closes #2827
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: expand Package Legitimacy Gate documentation
Add full user-facing depth to the gate docs across USER-GUIDE,
COMMANDS, and ARCHITECTURE:
- USER-GUIDE: rewrite gate section with concrete RESEARCH.md/PLAN.md
examples, slopcheck verdict table, [ASSUMED] WebSearch tagging
explanation, slopcheck-unavailable troubleshooting, and graceful
degradation behavior
- COMMANDS.md: expand /gsd-plan-phase gate note with verdict bullets;
add install-failure checkpoint behavior to /gsd-execute-phase
- ARCHITECTURE.md: expand gate section with threat model rationale,
layer table, claim provenance integration, ecosystem coverage, and
graceful degradation semantics
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(security): harden package legitimacy checkpoint semantics
* fix(planner): satisfy size gates and tighten package gate wording
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-08 09:08:06 -04:00
..
2026-04-25 10:50:54 -04:00
2026-04-04 14:29:03 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 10:50:54 -04:00
2026-04-11 03:39:29 -07:00
2026-04-20 09:31:34 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-11 03:30:05 -07:00
2026-04-07 17:27:20 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 14:29:03 -04:00
2026-04-25 10:50:54 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 07:24:31 -04:00
2026-04-11 08:50:44 -04:00
2026-04-07 08:13:52 -04:00
2026-04-05 17:49:20 -04:00
2026-05-02 11:45:33 -04:00
2026-04-05 18:05:32 -04:00
2026-04-05 18:20:11 -04:00
2026-04-19 16:35:32 -05:00
2026-04-25 11:34:55 -04:00
2026-04-22 12:04:06 -04:00
2026-04-07 17:19:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-10 10:48:00 -04:00
2026-05-01 19:50:10 -04:00
2026-04-11 03:37:34 -07:00
2026-04-10 10:50:17 -04:00
2026-04-10 11:19:32 -04:00
2026-04-10 11:25:55 -04:00
2026-04-10 11:15:59 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 15:42:46 -04:00
2026-04-15 14:58:41 -04:00
2026-04-23 11:58:06 -04:00
2026-04-17 09:20:26 -04:00
2026-05-04 23:18:41 -04:00
2026-04-22 10:41:58 -04:00
2026-04-25 12:02:58 -04:00
2026-04-17 09:20:42 -04:00
2026-04-29 07:56:51 -04:00
2026-04-20 18:37:42 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-20 10:09:33 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-30 00:43:47 -04:00
2026-05-01 19:50:10 -04:00
2026-04-20 10:11:00 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-20 10:08:46 -04:00
2026-05-01 19:50:10 -04:00
2026-05-04 21:49:41 -04:00
2026-04-21 09:46:01 -04:00
2026-05-01 19:50:10 -04:00
2026-04-21 21:20:27 -04:00
2026-04-21 10:10:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-22 12:09:12 -04:00
2026-04-22 10:41:58 -04:00
2026-04-21 20:33:43 -04:00
2026-05-03 16:31:48 -04:00
2026-04-21 21:18:58 -04:00
2026-05-06 15:19:34 -04:00
2026-05-05 13:19:10 -04:00
2026-04-22 12:04:17 -04:00
2026-05-01 19:50:10 -04:00
2026-04-22 12:03:56 -04:00
2026-04-22 12:04:06 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 12:09:27 -04:00
2026-04-24 18:05:10 -04:00
2026-04-24 18:10:45 -04:00
2026-04-24 18:05:33 -04:00
2026-04-29 22:56:59 -04:00
2026-04-24 18:05:18 -04:00
2026-05-02 09:27:23 -04:00
2026-04-24 20:22:17 -04:00
2026-04-24 20:22:29 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 12:10:01 -04:00
2026-04-25 12:16:04 -04:00
2026-04-25 12:10:01 -04:00
2026-04-25 12:15:39 -04:00
2026-05-02 09:27:23 -04:00
2026-05-01 19:50:10 -04:00
2026-04-28 18:28:53 -04:00
2026-04-27 12:31:43 -04:00
2026-04-27 12:31:49 -04:00
2026-05-01 19:50:10 -04:00
2026-04-27 12:31:15 -04:00
2026-05-01 19:50:10 -04:00
2026-04-27 12:31:26 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-28 20:37:47 -04:00
2026-04-28 20:22:59 -04:00
2026-04-28 20:23:32 -04:00
2026-04-28 20:16:27 -04:00
2026-05-02 09:27:23 -04:00
2026-04-28 20:21:44 -04:00
2026-04-29 21:52:20 -04:00
2026-04-28 20:21:48 -04:00
2026-04-28 20:23:29 -04:00
2026-05-01 19:50:10 -04:00
2026-04-29 07:59:30 -04:00
2026-05-01 19:50:10 -04:00
2026-04-29 08:00:17 -04:00
2026-05-02 09:27:23 -04:00
2026-04-29 07:56:32 -04:00
2026-04-29 21:52:20 -04:00
2026-04-29 21:51:58 -04:00
2026-04-29 23:27:27 -04:00
2026-04-30 17:30:19 -04:00
2026-04-30 21:08:26 -04:00
2026-04-30 21:57:27 -04:00
2026-05-01 09:23:02 -04:00
2026-05-01 09:22:13 -04:00
2026-05-02 09:27:23 -04:00
2026-05-01 11:25:26 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 11:25:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 13:04:39 -04:00
2026-05-01 16:10:30 -04:00
2026-05-01 17:25:20 -04:00
2026-05-01 15:15:20 -04:00
2026-05-01 15:15:20 -04:00
2026-05-02 00:29:34 -04:00
2026-05-02 00:29:45 -04:00
2026-05-06 15:41:27 -04:00
2026-05-01 17:25:20 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 17:25:20 -04:00
2026-05-01 21:13:25 -04:00
2026-05-01 17:39:35 -04:00
2026-05-02 00:29:43 -04:00
2026-05-02 00:29:31 -04:00
2026-05-02 00:29:34 -04:00
2026-05-02 00:29:34 -04:00
2026-05-01 21:14:14 -04:00
2026-05-02 09:38:34 -04:00
2026-05-02 09:30:58 -04:00
2026-05-02 11:45:30 -04:00
2026-05-02 11:45:36 -04:00
2026-05-02 11:45:33 -04:00
2026-05-02 11:45:39 -04:00
2026-05-02 17:23:44 -04:00
2026-05-06 21:55:45 -04:00
2026-05-02 17:44:52 -04:00
2026-05-04 23:27:38 -04:00
2026-05-04 22:06:22 -04:00
2026-05-04 23:34:57 -04:00
2026-05-04 23:30:35 -04:00
2026-05-04 23:28:52 -04:00
2026-05-04 22:52:30 -04:00
2026-05-05 15:02:03 -04:00
2026-05-04 23:18:41 -04:00
2026-05-05 15:02:23 -04:00
2026-05-05 15:02:26 -04:00
2026-05-05 15:02:19 -04:00
2026-05-05 15:02:11 -04:00
2026-05-05 15:02:30 -04:00
2026-05-05 15:02:07 -04:00
2026-05-05 15:02:15 -04:00
2026-05-05 15:01:59 -04:00
2026-05-05 15:02:38 -04:00
2026-05-05 18:53:35 -04:00
2026-05-06 21:51:38 -04:00
2026-05-06 21:51:38 -04:00
2026-05-06 15:38:53 -04:00
2026-05-06 11:56:27 -04:00
2026-05-06 15:00:08 -04:00
2026-05-06 22:06:56 -04:00
2026-05-06 21:51:32 -04:00
2026-05-06 21:51:42 -04:00
2026-05-08 08:40:53 -04:00
2026-05-08 08:40:41 -04:00
2026-05-08 08:40:47 -04:00
2026-05-08 08:40:36 -04:00
2026-05-08 09:06:37 -04:00
2026-05-01 19:50:10 -04:00
2026-04-23 08:36:03 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 18:12:20 -04:00
2026-05-01 18:12:20 -04:00
2026-05-01 18:12:20 -04:00
2026-05-01 18:12:20 -04:00
2026-05-01 18:12:20 -04:00
2026-05-01 18:12:20 -04:00
2026-05-01 19:50:10 -04:00
2026-04-11 09:15:36 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-20 09:31:34 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-12 08:10:30 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-02 11:45:30 -04:00
2026-05-05 16:06:29 -04:00
2026-04-29 22:56:59 -04:00
2026-05-01 19:50:10 -04:00
2026-04-05 17:02:20 -04:00
2026-04-10 10:56:09 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 11:34:55 -04:00
2026-04-07 17:25:11 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 15:19:34 -04:00
2026-04-15 16:46:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-30 01:04:41 -04:00
2026-05-06 15:34:29 -04:00
2026-05-04 22:51:15 -04:00
2026-04-11 09:20:27 -04:00
2026-04-04 14:29:03 -04:00
2026-05-01 19:50:10 -04:00
2026-05-05 15:44:59 -04:00
2026-04-05 09:15:41 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 11:34:55 -04:00
2026-05-01 19:50:10 -04:00
2026-04-27 09:03:36 -04:00
2026-04-01 08:47:31 -06:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 16:26:15 -04:00
2026-05-05 15:44:59 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 21:51:29 -04:00
2026-04-25 14:23:40 -04:00
2026-04-22 12:04:21 -04:00
2026-04-29 08:14:11 -04:00
2026-05-05 10:51:10 -04:00
2026-04-30 01:04:41 -04:00
2026-04-30 00:48:49 -04:00
2026-05-06 11:59:53 -04:00
2026-05-06 21:51:38 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 12:04:16 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 21:51:38 -04:00
2026-05-01 19:50:10 -04:00
2026-05-05 16:06:29 -04:00
2026-04-22 20:49:52 -04:00
2026-05-02 16:33:16 -04:00
2026-05-02 23:12:50 -04:00
2026-05-02 13:19:15 -04:00
2026-05-02 14:26:35 -04:00
2026-05-02 15:24:26 -04:00
2026-04-05 18:33:17 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-26 21:40:38 -04:00
2026-05-01 19:50:10 -04:00
2026-05-02 17:44:52 -04:00
2026-05-06 21:51:38 -04:00
2026-05-02 09:27:23 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 21:01:25 -04:00
2026-05-06 21:51:38 -04:00
2026-05-01 19:50:10 -04:00
2026-05-05 18:34:42 -04:00
2026-04-15 22:46:31 -04:00
2026-04-04 14:37:54 -04:00
2026-04-04 14:29:03 -04:00
2026-05-02 11:45:33 -04:00
2026-04-30 22:48:08 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 14:29:03 -04:00
2026-04-20 09:31:34 -04:00
2026-05-02 09:27:23 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 20:27:33 -04:00
2026-04-15 14:59:07 -04:00
2026-05-04 23:03:10 -04:00
2026-04-27 12:31:49 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-02 17:44:52 -04:00
2026-05-01 22:37:48 -04:00
2026-04-23 11:53:51 -04:00
2026-04-15 14:59:24 -04:00
2026-05-01 19:50:10 -04:00
2026-04-20 09:39:05 -04:00
2026-04-20 09:39:05 -04:00
2026-05-01 19:50:10 -04:00
2026-04-26 13:33:54 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-05 19:09:14 -04:00
2026-04-30 11:38:13 -04:00
2026-04-14 17:57:38 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 14:29:03 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 11:34:55 -04:00
2026-05-01 19:50:10 -04:00
2026-05-04 23:29:45 -04:00
2026-04-26 11:48:47 -04:00
2026-04-25 12:09:27 -04:00
2026-04-30 22:48:08 -04:00
2026-05-06 21:51:38 -04:00
2026-05-06 21:51:38 -04:00
2026-05-06 21:51:38 -04:00
2026-04-05 18:05:32 -04:00
2026-05-06 21:51:38 -04:00
2026-04-07 08:13:46 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 16:10:30 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 11:34:55 -04:00
2026-05-01 19:50:10 -04:00
2026-05-08 09:08:06 -04:00
2026-04-06 15:13:23 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-16 17:15:29 -04:00
2026-04-04 14:29:03 -04:00
2026-04-11 15:02:55 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-04 23:54:44 -04:00
2026-04-30 14:10:28 -04:00
2026-04-04 14:29:03 -04:00
2026-04-25 12:02:58 -04:00
2026-05-06 21:51:38 -04:00
2026-05-01 19:50:10 -04:00
2026-04-25 14:18:34 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 21:51:38 -04:00
2026-04-30 11:38:13 -04:00
2026-05-01 19:50:10 -04:00
2026-04-30 12:13:55 -04:00
2026-04-30 14:19:46 -04:00
2026-04-30 14:19:46 -04:00
2026-05-01 19:50:10 -04:00
2026-05-08 09:06:43 -04:00
2026-04-04 14:29:03 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 21:51:38 -04:00
2026-04-16 17:22:31 -04:00
2026-05-01 19:50:10 -04:00
2026-05-04 23:28:20 -04:00
2026-04-30 21:57:27 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 10:23:41 -04:00
2026-05-01 19:50:10 -04:00
2026-04-11 11:19:47 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 14:29:03 -04:00
2026-05-01 19:50:10 -04:00
2026-04-16 17:22:31 -04:00
2026-04-30 00:43:47 -04:00
2026-04-30 00:43:47 -04:00
2026-04-26 13:33:45 -04:00
2026-04-30 14:10:28 -04:00
2026-05-06 21:51:38 -04:00
2026-04-23 11:53:20 -04:00
2026-05-04 23:03:10 -04:00
2026-04-15 14:59:56 -04:00
2026-05-01 19:50:10 -04:00
2026-04-01 16:53:20 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-02 09:27:23 -04:00
2026-04-20 10:08:18 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 07:10:21 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-10 13:55:27 -04:00
2026-05-08 09:06:43 -04:00
2026-04-11 15:02:55 -04:00
2026-05-04 23:10:26 -04:00
2026-05-06 21:51:38 -04:00
2026-05-01 19:50:10 -04:00
2026-04-11 15:39:50 -04:00
2026-04-11 09:15:00 -04:00
2026-05-01 19:50:10 -04:00
2026-04-05 17:49:20 -04:00
2026-05-01 19:50:10 -04:00
2026-05-05 15:44:59 -04:00
2026-05-02 16:33:16 -04:00
2026-04-20 10:08:18 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 09:22:13 -04:00
2026-04-30 01:04:41 -04:00
2026-04-12 17:56:19 -04:00
2026-04-25 16:26:15 -04:00
2026-05-06 21:51:38 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 21:51:38 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 14:29:03 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 14:29:03 -04:00
2026-04-06 08:40:37 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-06 21:51:38 -04:00
2026-04-30 00:43:47 -04:00
2026-04-02 21:36:36 -05:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-05-01 19:50:10 -04:00
2026-04-04 14:29:03 -04:00