Lap Tran
bc7daf8590
- **Restore 82 completed tasks** from tasks/complete/ back to tasks/ top level (all <7 days old per the cleanup policy; premature bulk archive was fixed). - **Dashboard: fix scroll-reset on auto-refresh** — renderBoard rebuilds the board via innerHTML every 2s, destroying each column-body's scrollTop. Now snapshots column-body scrollTop + board.scrollLeft + view.scrollTop before rebuild and restores after (matched by PHASE_GROUPS index). - **Dashboard UI additions** (pre-existing unstaged work): approval section cards, transition buttons, inline artifact editor (textarea for writing missing SPEC/VERDICT/etc from the detail modal). - **Bind ornith as Implement model** — config.md: Model explicit to omlx/Ornith-1.0-35B-4bit-mlx, context window 32768. Interactive autopilot already used ornith via opencode default; now explicit. - **Fix cleanup stub** — automaton-cleanup.sh had a stale --project arg pointing at a pytest temp dir (test isolation leak). Rewired to point at ~/.automaton. - **Fix plist-isolation test** — test asserted host plist doesn't exist, but a real install creates it. Now snapshots mtime before run, asserts unchanged after (only a write during the test counts as bleed). - **New Playwright smoke test** (tests/test_dashboard_ui.py) — 2 tests: board renders tasks, column scroll survives auto-refresh tick. Verified the test fails without the scroll fix (scrollTop resets to 0). Skipped via importorskip when playwright is absent (main CI stays green). - **Clarify SI loop scope in README** — new-project onboarding section documents the framework-scoped self-improvement loop and options (leave/pause/create project loop). - **CHANGELOG** documents all changes including the known model-divergence gap (mde tasks marked complete but per-role model binding was never implemented).
4.2 KiB
ADVERSARIAL_BUG_REPORT: add-goal-mode
Attack the goal-mode extensions as a hostile work source or verifier would: find ways to escape work-source dispatch, inflate task creation, or leak token content.
Attack vectors tried
A1 -- Can a hostile work_source.kind value crash the runner?
No. _find_work checks _FIND_WORK_DISPATCH.get(kind); unknown kinds log a WARNING and fall back to single. No crash, no escape. PASS
A2 -- Can _find_work_audit be coerced into creating arbitrary tasks?
_find_work_audit calls status.py --create-task <slug> only when a violation has no task field. The slug is derived from _slugify(violation["message"]), which strips non-alphanumeric chars. A hostile audit JSON with message: "rm -rf /" would slugify to rm-rf (harmless task name). The --create-task call itself is sandboxed by status.py's own task-creation logic (validates names, creates dirs under tasks/). No shell injection. PASS
A3 -- Can _find_work_backlog read arbitrary files?
The backlog path is constructed as <project_dir>/design/<area>/BACKLOG.md where area comes from work_source.area in loop.json. A hostile area value like ../../etc would resolve to <project>/design/../../etc/BACKLOG.md = <project>/../etc/BACKLOG.md -- a path outside the project. However, the file must exist and contain - [ ] lines to produce a task name. The attacker would need write access to place a BACKLOG.md there, which already implies filesystem access. The runner doesn't write to the backlog path; it only reads. PASS (config-trust model: loop.json is operator-controlled).
A4 -- Can token substitution leak task_brief content into a visible argv?
_substitute replaces {task_brief} in the harness command template. If the command template includes {task_brief} as a CLI arg (e.g. --brief {task_brief}), the full task brief text appears in the process argv, visible via ps on multi-user systems. This is a config decision (the operator chose to pass it as a CLI arg). The default command does not include {task_brief}. The recommended pattern (task 6) is to have the prompt file itself contain {task_brief} -- but the runner doesn't substitute into prompt file content, only into the command template. PASS (operator config responsibility).
A5 -- Can a hostile --audit --json output inject a task name that escapes the tasks/ dir?
_find_work_audit uses the task field directly as current_task. If a hostile audit JSON returns task: "../../../etc/passwd", the runner sets state["current_task"] = "../../../etc/passwd". Downstream, _task_dir_for(name, project_dir) constructs <tasks_dir>/../../../etc/passwd -- a path outside tasks/. However, the runner only reads from this path (_read_task_brief checks f.exists() before reading) and passes the name as a substitution token. No writes occur. The orchestrator might call status.py --task ../../../etc/passwd but status.py's own validation would reject the path. PASS (defense in depth: runner is read-only on task dirs; status.py validates).
A6 -- Can acceptance_criteria with a huge string OOM the runner?
_acceptance_criteria_text joins list items with newlines, then _truncate_tokens caps at 2000 tokens (8000 chars). A 10MB acceptance_criteria string is truncated to ~8k chars. No OOM. PASS
A7 -- Can _find_work_audit loop infinitely on create-task failures?
No loop. _find_work_audit calls --create-task once (fire-and-forget, timeout=15s) and returns the slug. If create-task fails, the slug is returned anyway. Next tick, --audit sees the same violation, tries create-task again. Each tick is one attempt. The OS scheduler interval rate-limits. No infinite loop within a single tick. PASS
Hardening recommendations (for BACKLOG)
- Validate
work_source.areaagainst a whitelist or path-traversal check (reject..components). Low priority since loop.json is operator-controlled. - Validate
current_taskfrom audit JSON against a path-traversal check (reject..and/). Same priority.
Both are defense-in-depth; neither blocks v1.
Verdict
PASS -- no exploitable escape. Work-source dispatch is bounded; token substitution is config-gated; audit JSON consumption is read-only and slug-sanitized.