Commit Graph
2 Commits
Author SHA1 Message Date
thanhnvandClaude Opus 4.8 8c06a55aed feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)
- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s)
  schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts,
  dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode.
- SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line
  injection) while keeping tab and visible text.
- SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes
  outside the allowed root.

Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-06 22:39:18 +09:00
thanhnvandClaude Opus 4.8 1b61d7f381 feat(log): unified CASAN_LOG_LEVEL across Boss, agent step, harness wrapper
Add a shared log taxonomy (error<warn<info<debug<trace, default info) wired
through all three layers, plus a machine-readable per-step run log.

- scripts/casan-log.mjs + .specify/scripts/bash/casan-log.sh: shared logger
  ([LEVEL] ts [component] msg), stderr-only so stdout contracts and exit codes
  are byte-identical. Node side includes trace-level redaction (secret/PII).
- run-casan-pipeline.mjs: per-STEP info line, loop-activation warnings
  (BACK-TO-PLAN, FAIL->STEP6), debug harness rc + trace_id, trace payload
  excerpt, end-of-run 13-STEP summary table, and one JSONL line/step in
  .specify/logs/pipeline-run.jsonl. New --dry-run stubs all agents but keeps
  the real wrapper in the loop (deterministic, offline, full 13 STEP + loops).
- casan-step.mjs: debug logs for judge verdict, checkpoint, rollback; logger
  import degrades to noop when the file is copied standalone (T1 test).
- casan-harness.sh: debug-log each phase H4-in -> H5 -> [H2-gate] -> H6-exec
  -> H4-out with its rc; optional CASAN_PHASE_REPORT JSON for the Boss.

Default level (info) keeps output close to before; behavior opt-in via env.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 10:04:55 +09:00