Merge remote-tracking branch 'origin/main' into time-attack/wave-test-infra-isolated-review

Author: test22345

bin/gstack-config

@@ -134,12 +134,12 @@ lookup_default() {
     redact_repo_visibility) echo "" ;; # empty → fall through to gh/glab detection
     redact_prepush_hook) echo "false" ;;
     # Brain-aware planning (v1.48 / T5+T10+T16). Defaults documented inline:
-    #   brain_trust_policy@<hash>  — unset on fresh install; setup-gbrain
+    #   brain_trust_policy@<endpoint-id>  — unset on fresh install; setup-gbrain
     #                                writes 'personal' for local engines,
     #                                asks the user for remote-ambiguous.
     #   salience_allowlist          — empty falls through to
     #                                SALIENCE_DEFAULT_ALLOWLIST (D9).
-    #   user_slug_at_<hash>         — empty triggers resolve-user-slug
+    #   user_slug_at_<endpoint-id>  — empty triggers resolve-user-slug
     #                                fallback chain (D4 A3) on first call.
     brain_trust_policy*) echo "unset" ;;
     salience_allowlist) echo "" ;;
@@ -260,14 +260,16 @@ resolve_user_slug() {
 case "${1:-}" in
   get)
     KEY="${2:?Usage: gstack-config get <key>}"
-    # Validate key (alphanumeric + underscore + optional @<hash> suffix for
-    # endpoint-namespaced keys introduced by the brain-aware planning layer)
-    if ! printf '%s' "$KEY" | grep -qE '^[a-zA-Z0-9_]+(@[a-f0-9]+)?$'; then
-      echo "Error: key must contain only alphanumeric characters, underscores, and an optional @<hex-hash> suffix" >&2
+    # Validate key (alphanumeric + underscore + optional @<endpoint-id> suffix for
+    # endpoint-namespaced keys introduced by the brain-aware planning layer).
+    # Endpoint ids are sha8/sha16 hex for remote MCP URLs, or the literal
+    # "local" for stdio/PGLite engines (see endpoint_hash).
+    if ! printf '%s' "$KEY" | grep -qE '^[a-zA-Z0-9_]+(@[a-zA-Z0-9]+)?$'; then
+      echo "Error: key must contain only alphanumeric characters, underscores, and an optional @<endpoint-id> suffix" >&2
       exit 1
     fi
-    # Use literal match for keys containing @ (sha hashes), regex otherwise
-    VALUE=$(grep -F "${KEY}:" "$CONFIG_FILE" 2>/dev/null | grep -E "^${KEY%@*}(@[a-f0-9]+)?:" | grep -F "${KEY}:" | tail -1 | awk '{print $2}' | tr -d '[:space:]' || true)
+    # Use literal match for keys containing @ (endpoint ids), regex otherwise
+    VALUE=$(grep -F "${KEY}:" "$CONFIG_FILE" 2>/dev/null | grep -E "^${KEY%@*}(@[a-zA-Z0-9]+)?:" | grep -F "${KEY}:" | tail -1 | awk '{print $2}' | tr -d '[:space:]' || true)
     if [ -z "$VALUE" ]; then
       VALUE=$(lookup_default "$KEY")
     fi
@@ -276,9 +278,10 @@ case "${1:-}" in
   set)
     KEY="${2:?Usage: gstack-config set <key> <value>}"
     VALUE="${3:?Usage: gstack-config set <key> <value>}"
-    # Validate key (alphanumeric + underscore + optional @<hash> suffix)
-    if ! printf '%s' "$KEY" | grep -qE '^[a-zA-Z0-9_]+(@[a-f0-9]+)?$'; then
-      echo "Error: key must contain only alphanumeric characters, underscores, and an optional @<hex-hash> suffix" >&2
+    # Validate key (alphanumeric + underscore + optional @<endpoint-id> suffix).
+    # Accepts hex hashes and the literal "local" from endpoint_hash.
+    if ! printf '%s' "$KEY" | grep -qE '^[a-zA-Z0-9_]+(@[a-zA-Z0-9]+)?$'; then
+      echo "Error: key must contain only alphanumeric characters, underscores, and an optional @<endpoint-id> suffix" >&2
       exit 1
     fi
     # Validate brain_trust_policy value domain (D4 / D11)

bin/gstack-gbrain-detect

@@ -18,7 +18,7 @@
  *     "gstack_brain_sync_mode": "off"|"artifacts-only"|"full",
  *     "gstack_brain_git": true|false,
  *     "gstack_artifacts_remote": "https://..." | "",
- *     "gbrain_local_status": "ok"|"no-cli"|"missing-config"|"broken-config"|"broken-db"|"timeout",
+ *     "gbrain_local_status": "ok"|"no-cli"|"missing-config"|"broken-config"|"broken-db"|"engine-locked"|"timeout",
  *     "gbrain_pooler_mode": "transaction"|"session"|null
  *   }
  *

bin/gstack-gbrain-sync.ts

@@ -717,6 +717,7 @@ function dreamMarkerPid(): number | null {
  *   missing-config → "no local engine; run /setup-gbrain to add local PGLite"
  *   broken-config  → "config file at ~/.gbrain/config.json is malformed; see /setup-gbrain Step 1.5"
  *   broken-db      → "config points at unreachable DB; see /setup-gbrain Step 1.5"
+ *   engine-locked  → PGLite is busy; stop its holder or sync outside the live session
  *   timeout        → kept for Record totality; stages PROCEED on timeout (#1964)
  *                    via the gate's warnProbeTimeout path, never this skip.
  */
@@ -733,6 +734,8 @@ function skipStageForLocalStatus(
       "config at ~/.gbrain/config.json is malformed; see /setup-gbrain Step 1.5",
     "broken-db":
       "config points at unreachable DB; see /setup-gbrain Step 1.5",
+    "engine-locked":
+      "PGLite is busy (often held by gbrain serve); stop the holding process or run /sync-gbrain outside the live Claude session, then retry",
     "timeout":
       "engine probe timed out; raise GSTACK_GBRAIN_PROBE_TIMEOUT_MS if your pooler is slow",
   };

bin/gstack-repo-mode

@@ -12,13 +12,20 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-# Compute SLUG directly (avoid eval of gstack-slug — branch names can contain shell metacharacters)
+# Keep the no-remote early exit before consulting gstack-slug. gstack-slug falls
+# back to the directory basename when origin is missing, which would incorrectly
+# make local-only repos eligible for classification.
 REMOTE_URL=$(git remote get-url origin 2>/dev/null || true)
 if [ -z "$REMOTE_URL" ]; then
   echo "REPO_MODE=unknown"
   exit 0
 fi
-SLUG=$(echo "$REMOTE_URL" | sed 's|.*[:/]\([^/]*/[^/]*\)\.git$|\1|;s|.*[:/]\([^/]*/[^/]*\)$|\1|' | tr '/' '-')
+# Consume the canonical cached slug from gstack-slug (sed, never eval — branch
+# names can contain shell metacharacters). Invoke from the git root so the
+# PWD-keyed slug cache matches other gstack project-state writers.
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || true)
+[ -z "${REPO_ROOT:-}" ] && { echo "REPO_MODE=unknown"; exit 0; }
+SLUG=$(cd "$REPO_ROOT" && "$SCRIPT_DIR/gstack-slug" | sed -n 's/^SLUG=//p' | head -1)
 [ -z "${SLUG:-}" ] && { echo "REPO_MODE=unknown"; exit 0; }
 
 # Validate: only allow known values (prevent shell injection via source <(...))

browse/src/content-security.ts

@@ -338,19 +338,28 @@ const BLOCKLIST_DOMAINS = [
 export function urlBlocklistFilter(content: string, url: string, _command: string): ContentFilterResult {
   const warnings: string[] = [];
 
+  // Matching is case-insensitive. Hostnames and URL schemes are
+  // case-insensitive (RFC 3986), so an uppercased sink like
+  // https://WEBHOOK.SITE/x must not slip past the blocklist. Normalize the
+  // haystack to lowercase; BLOCKLIST_DOMAINS entries are lowercase by
+  // construction, so a direct compare then holds.
+
   // Check page URL
+  const normalizedUrl = url.toLowerCase();
   for (const domain of BLOCKLIST_DOMAINS) {
-    if (url.includes(domain)) {
+    if (normalizedUrl.includes(domain)) {
       warnings.push(`Page URL matches blocklisted domain: ${domain}`);
     }
   }
 
-  // Check for blocklisted URLs in content (links, form actions)
-  const urlPattern = /https?:\/\/[^\s"'<>]+/g;
+  // Check for blocklisted URLs in content (links, form actions). The `i` flag
+  // keeps an uppercased scheme (HTTPS://) from evading URL extraction.
+  const urlPattern = /https?:\/\/[^\s"'<>]+/gi;
   const contentUrls = content.match(urlPattern) || [];
   for (const contentUrl of contentUrls) {
+    const normalizedContentUrl = contentUrl.toLowerCase();
     for (const domain of BLOCKLIST_DOMAINS) {
-      if (contentUrl.includes(domain)) {
+      if (normalizedContentUrl.includes(domain)) {
         warnings.push(`Content contains blocklisted URL: ${contentUrl.slice(0, 100)}`);
         break;
       }

browse/test/content-security.test.ts

@@ -151,6 +151,44 @@ describe('Content filter hooks', () => {
     expect(result.warnings.length).toBe(0);
   });
 
+  // Regression: issue #2190 — case-sensitive matching let an uppercased
+  // exfiltration domain bypass the blocklist.
+  test('URL blocklist is case-insensitive on the page URL', () => {
+    const result = urlBlocklistFilter('', 'https://WEBHOOK.SITE/steal', 'text');
+    expect(result.safe).toBe(false);
+    expect(result.warnings.some(w => w.includes('webhook.site'))).toBe(true);
+  });
+
+  test('URL blocklist is case-insensitive on content URLs', () => {
+    const result = urlBlocklistFilter(
+      '<a href="https://WEBHOOK.SITE/a1b2c3-steal">click</a>',
+      'https://docs.example.com/article',
+      'links',
+    );
+    expect(result.safe).toBe(false);
+    expect(result.warnings.some(w => w.includes('WEBHOOK.SITE'))).toBe(true);
+  });
+
+  test('URL blocklist catches an uppercased scheme in content', () => {
+    const result = urlBlocklistFilter(
+      'Exfil via HTTPS://Requestbin.com/r/abc please',
+      'https://example.com',
+      'text',
+    );
+    expect(result.safe).toBe(false);
+    expect(result.warnings.some(w => w.toLowerCase().includes('requestbin.com'))).toBe(true);
+  });
+
+  test('URL blocklist does not over-block legitimate uppercase domains', () => {
+    const result = urlBlocklistFilter(
+      '<a href="https://GitHub.com/acme/project">source</a>',
+      'https://DOCS.EXAMPLE.COM/help',
+      'links',
+    );
+    expect(result.safe).toBe(true);
+    expect(result.warnings.length).toBe(0);
+  });
+
   test('custom filter can be registered and runs', () => {
     registerContentFilter((content, url, cmd) => {
       if (content.includes('SECRET')) {

browse/test/gstack-config.test.ts

@@ -108,6 +108,13 @@ describe('gstack-config', () => {
     expect(existsSync(join(nestedDir, 'config.yaml'))).toBe(true);
   });
 
+  test('brain trust policy accepts local endpoint suffix', () => {
+    const { exitCode, stderr } = run(['set', 'brain_trust_policy@local', 'personal']);
+    expect(exitCode).toBe(0);
+    expect(stderr).toBe('');
+    expect(run(['get', 'brain_trust_policy@local']).stdout).toBe('personal');
+  });
+
   // ─── list ─────────────────────────────────────────────────
   test('list shows all keys', () => {
     writeFileSync(join(stateDir, 'config.yaml'), 'auto_upgrade: true\nupdate_check: false\n');
@@ -139,6 +146,12 @@ describe('gstack-config', () => {
     expect(stderr).toContain('alphanumeric');
   });
 
+  test('set rejects endpoint suffix with punctuation', () => {
+    const { exitCode, stderr } = run(['set', 'brain_trust_policy@local-dev', 'personal']);
+    expect(exitCode).toBe(1);
+    expect(stderr).toContain('endpoint-id');
+  });
+
   test('set preserves value with sed special chars', () => {
     run(['set', 'test_special', 'a/b&c\\d']);
     const { stdout } = run(['get', 'test_special']);

bun.lock

@@ -19,6 +19,8 @@
  * Broken-config → config exists but `gbrain sources list` fails with config parse error
  *                 (or any non-recognized error — defensive default per codex #8).
  * Broken-db → config exists, DB unreachable per stderr classification.
+ * Engine-locked → PGLite probe hit gbrain's own connect timeout, usually
+ *                 because another `gbrain serve` process owns the embedded DB.
  * Timeout → probe exceeded GSTACK_GBRAIN_PROBE_TIMEOUT_MS (default 15s) with no
  *           recognized error — engine is likely healthy but slow (e.g. a cold
  *           pooler connection, #1964). Consumers treat this as usable.
@@ -47,6 +49,7 @@ export type LocalEngineStatus =
   | "missing-config"
   | "broken-config"
   | "broken-db"
+  | "engine-locked"
   | "timeout";
 
 export interface ClassifyOptions {
@@ -118,6 +121,15 @@ function gbrainConfigPath(env?: NodeJS.ProcessEnv): string {
   return join(gbrainHome, "config.json");
 }
 
+function configuredEngine(env?: NodeJS.ProcessEnv): "pglite" | "postgres" | null {
+  try {
+    const parsed = JSON.parse(readFileSync(gbrainConfigPath(env), "utf-8")) as { engine?: string };
+    return parsed.engine === "pglite" || parsed.engine === "postgres" ? parsed.engine : null;
+  } catch {
+    return null;
+  }
+}
+
 function hashPath(p: string): string {
   return createHash("sha256").update(p).digest("hex").slice(0, 16);
 }
@@ -281,6 +293,7 @@ function freshClassify(env?: NodeJS.ProcessEnv): LocalEngineStatus {
       stderr?: Buffer | string;
       killed?: boolean;
       signal?: NodeJS.Signals | null;
+      status?: number | null;
     };
     const stderr = (e.stderr ? e.stderr.toString() : "") || "";
 
@@ -292,6 +305,14 @@ function freshClassify(env?: NodeJS.ProcessEnv): LocalEngineStatus {
     if (stderr.includes("Cannot connect to database")) return "broken-db";
     if (stderr.includes("config.json")) return "broken-config";
 
+    // PGLite is single-process. A long-lived `gbrain serve` can own the
+    // embedded database, causing the CLI to finish with its own exit 124 and
+    // "connect timed out" message. This is neither our watchdog timeout nor
+    // evidence that the valid config is malformed (#2194).
+    if (stderr.includes("connect timed out") || e.status === 124) {
+      return configuredEngine(env) === "pglite" ? "engine-locked" : "broken-db";
+    }
+
     // Probe killed by the timeout with no recognized error: the engine is
     // most likely healthy but slow (cold pooler connections measured at
     // 6.9-10.7s in #1964). Don't tell the user their config is malformed.

lib/gbrain-local-status.ts

@@ -76,5 +76,8 @@
     "@anthropic-ai/sdk": "^0.78.0",
     "xterm": "5",
     "xterm-addon-fit": "^0.8.0"
+  },
+  "overrides": {
+    "basic-ftp": "5.3.1"
   }
 }