Lap Tran
bc7daf8590
- **Restore 82 completed tasks** from tasks/complete/ back to tasks/ top level (all <7 days old per the cleanup policy; premature bulk archive was fixed). - **Dashboard: fix scroll-reset on auto-refresh** — renderBoard rebuilds the board via innerHTML every 2s, destroying each column-body's scrollTop. Now snapshots column-body scrollTop + board.scrollLeft + view.scrollTop before rebuild and restores after (matched by PHASE_GROUPS index). - **Dashboard UI additions** (pre-existing unstaged work): approval section cards, transition buttons, inline artifact editor (textarea for writing missing SPEC/VERDICT/etc from the detail modal). - **Bind ornith as Implement model** — config.md: Model explicit to omlx/Ornith-1.0-35B-4bit-mlx, context window 32768. Interactive autopilot already used ornith via opencode default; now explicit. - **Fix cleanup stub** — automaton-cleanup.sh had a stale --project arg pointing at a pytest temp dir (test isolation leak). Rewired to point at ~/.automaton. - **Fix plist-isolation test** — test asserted host plist doesn't exist, but a real install creates it. Now snapshots mtime before run, asserts unchanged after (only a write during the test counts as bleed). - **New Playwright smoke test** (tests/test_dashboard_ui.py) — 2 tests: board renders tasks, column scroll survives auto-refresh tick. Verified the test fails without the scroll fix (scrollTop resets to 0). Skipped via importorskip when playwright is absent (main CI stays green). - **Clarify SI loop scope in README** — new-project onboarding section documents the framework-scoped self-improvement loop and options (leave/pause/create project loop). - **CHANGELOG** documents all changes including the known model-divergence gap (mde tasks marked complete but per-role model binding was never implemented).
38 lines
4.2 KiB
Markdown
38 lines
4.2 KiB
Markdown
# ADVERSARIAL_BUG_REPORT: add-goal-mode
|
|
|
|
Attack the goal-mode extensions as a hostile work source or verifier would: find ways to escape work-source dispatch, inflate task creation, or leak token content.
|
|
|
|
## Attack vectors tried
|
|
|
|
### A1 -- Can a hostile `work_source.kind` value crash the runner?
|
|
No. `_find_work` checks `_FIND_WORK_DISPATCH.get(kind)`; unknown kinds log a WARNING and fall back to `single`. No crash, no escape. PASS
|
|
|
|
### A2 -- Can `_find_work_audit` be coerced into creating arbitrary tasks?
|
|
`_find_work_audit` calls `status.py --create-task <slug>` only when a violation has no `task` field. The slug is derived from `_slugify(violation["message"])`, which strips non-alphanumeric chars. A hostile audit JSON with `message: "rm -rf /"` would slugify to `rm-rf` (harmless task name). The `--create-task` call itself is sandboxed by status.py's own task-creation logic (validates names, creates dirs under `tasks/`). No shell injection. PASS
|
|
|
|
### A3 -- Can `_find_work_backlog` read arbitrary files?
|
|
The backlog path is constructed as `<project_dir>/design/<area>/BACKLOG.md` where `area` comes from `work_source.area` in `loop.json`. A hostile `area` value like `../../etc` would resolve to `<project>/design/../../etc/BACKLOG.md` = `<project>/../etc/BACKLOG.md` -- a path outside the project. However, the file must exist and contain `- [ ]` lines to produce a task name. The attacker would need write access to place a BACKLOG.md there, which already implies filesystem access. The runner doesn't write to the backlog path; it only reads. PASS (config-trust model: loop.json is operator-controlled).
|
|
|
|
### A4 -- Can token substitution leak task_brief content into a visible argv?
|
|
`_substitute` replaces `{task_brief}` in the harness command template. If the command template includes `{task_brief}` as a CLI arg (e.g. `--brief {task_brief}`), the full task brief text appears in the process argv, visible via `ps` on multi-user systems. This is a config decision (the operator chose to pass it as a CLI arg). The default command does not include `{task_brief}`. The recommended pattern (task 6) is to have the prompt file itself contain `{task_brief}` -- but the runner doesn't substitute into prompt file content, only into the command template. PASS (operator config responsibility).
|
|
|
|
### A5 -- Can a hostile `--audit --json` output inject a task name that escapes the tasks/ dir?
|
|
`_find_work_audit` uses the `task` field directly as `current_task`. If a hostile audit JSON returns `task: "../../../etc/passwd"`, the runner sets `state["current_task"] = "../../../etc/passwd"`. Downstream, `_task_dir_for(name, project_dir)` constructs `<tasks_dir>/../../../etc/passwd` -- a path outside tasks/. However, the runner only reads from this path (`_read_task_brief` checks `f.exists()` before reading) and passes the name as a substitution token. No writes occur. The orchestrator might call `status.py --task ../../../etc/passwd` but status.py's own validation would reject the path. PASS (defense in depth: runner is read-only on task dirs; status.py validates).
|
|
|
|
### A6 -- Can `acceptance_criteria` with a huge string OOM the runner?
|
|
`_acceptance_criteria_text` joins list items with newlines, then `_truncate_tokens` caps at 2000 tokens (8000 chars). A 10MB acceptance_criteria string is truncated to ~8k chars. No OOM. PASS
|
|
|
|
### A7 -- Can `_find_work_audit` loop infinitely on create-task failures?
|
|
No loop. `_find_work_audit` calls `--create-task` once (fire-and-forget, timeout=15s) and returns the slug. If create-task fails, the slug is returned anyway. Next tick, `--audit` sees the same violation, tries create-task again. Each tick is one attempt. The OS scheduler interval rate-limits. No infinite loop within a single tick. PASS
|
|
|
|
## Hardening recommendations (for BACKLOG)
|
|
|
|
1. **Validate `work_source.area`** against a whitelist or path-traversal check (reject `..` components). Low priority since loop.json is operator-controlled.
|
|
2. **Validate `current_task` from audit JSON** against a path-traversal check (reject `..` and `/`). Same priority.
|
|
|
|
Both are defense-in-depth; neither blocks v1.
|
|
|
|
## Verdict
|
|
|
|
PASS -- no exploitable escape. Work-source dispatch is bounded; token substitution is config-gated; audit JSON consumption is read-only and slug-sanitized.
|