Skip to content

Commit 5d97d84

Browse files
Jonathan D.A. Jewellclaude
Jonathan D.A. Jewell
and
claude
committed
fix(security): resolve panic-attack findings and implement TODO stubs
Security fixes from panic-attack assail scan: - Sanitize string interpolation in inspectFlag() to prevent code injection - Replace Js.Dict.unsafeGet + Option.getExn with safe pattern matching - Narrow Deno --allow-all to specific permissions (read/write/net/run/env) - Fix unsafe glob in shell test expression using find Implement TODO stubs: - Full JSON parser for parseFlagDatabase in DatabaseUpdater.res (was returning empty hardcoded database) - Performance metrics collection in sidebar.js export (was returning null) Housekeeping: - Replace AI.djot with AI.a2ml (merged content, fixed paths) - Fix .machine_readable/ references (was .machines_readable/6scm/) Weak points: 10 → 7 (remaining are false positives: DevTools API eval, env var names, SVG xmlns, heredoc vars) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent d641b48 commit 5d97d84

9 files changed

Lines changed: 285 additions & 144 deletions

File tree

‎.containerization/build.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,10 @@ fi
7777
# Stage 4: Post-build validation
7878
run_stage "post-build-validation" "Validating built extension"
7979

80-
if [ -f "$PROJECT_ROOT/build-output/web-ext-artifacts"/*.xpi ]; then
80+
XPI_FILE=$(find "$PROJECT_ROOT/build-output/web-ext-artifacts" -maxdepth 1 -name '*.xpi' -print -quit 2>/dev/null)
81+
if [ -n "$XPI_FILE" ] && [ -f "$XPI_FILE" ]; then
8182
echo "Checking .xpi integrity..."
82-
unzip -t "$PROJECT_ROOT/build-output/web-ext-artifacts"/*.xpi > /dev/null
83+
unzip -t "$XPI_FILE" > /dev/null
8384
echo " ✓ .xpi file is valid"
8485

8586
echo "Verifying checksums..."

‎.screenshots/capture-screenshots.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/usr/bin/env -S deno run --allow-all
1+
#!/usr/bin/env -S deno run --allow-read --allow-write --allow-net --allow-run --allow-env
22
// SPDX-License-Identifier: PMPL-1.0-or-later
33
// Automated screenshot capture for FireFlag extension
44

‎.screenshots/generate-mockups.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,6 @@ echo "Mockups generated in: $MOCKUP_DIR/"
405405
echo ""
406406
echo "Next steps:"
407407
echo " 1. Review mockups"
408-
echo " 2. Capture real screenshots: deno run --allow-all .screenshots/capture-screenshots.js"
408+
echo " 2. Capture real screenshots: deno run --allow-read --allow-write --allow-net --allow-run --allow-env .screenshots/capture-screenshots.js"
409409
echo " 3. Replace mockups with real screenshots"
410410
echo ""

‎AI.a2ml‎

Lines changed: 102 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,112 @@
1+
# AI Assistant Specification
12

2-
# AI Assistant Instructions
3+
## Machine-Readable Artefacts
4+
5+
The `.machine_readable/` directory contains structured metadata required for automated reasoning and project introspection.
6+
7+
- `STATE.scm`: Current project state, milestones, and progress.
8+
- `META.scm`: Architecture decisions, development methodology, and rationale.
9+
- `ECOSYSTEM.scm`: Ecosystem placement, upstream/downstream relationships, and interoperability.
10+
- `AGENTIC.scm`: AI agent interaction patterns, affordances, and constraints.
11+
- `NEUROSYM.scm`: Neurosymbolic integration configuration and hybrid reasoning settings.
12+
- `PLAYBOOK.scm`: Operational runbook, workflows, and incident procedures.
313

414
## Repository Focus
5-
- `rsr-template-repo` is treated as a Rhodium Standard Repository; obey the Rhodium policies, maintain `.bot_directives`, and keep `.machines_readable/6scm/` authoritative.
15+
16+
- `fireflag` is treated as a Rhodium Standard Repository; obey the Rhodium policies, maintain `.bot_directives`, and keep `.machine_readable/` authoritative.
617
- Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing.
718

819
## Workflow
9-
1. Inspect `.machines_readable/6scm/STATE.scm` for blockers and next actions.
10-
2. Respect any constraints listed inside `.machines_readable/6scm/AGENTIC.scm` when tooling changes are requested.
20+
21+
1. Inspect `.machine_readable/STATE.scm` for blockers and next actions.
22+
2. Respect any constraints listed inside `.machine_readable/AGENTIC.scm` when tooling changes are requested.
1123
3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message.
1224

1325
## Delivery Promises
26+
1427
- Mention in summaries whether STATE, `contractiles/`, or `.bot_directives/` changed.
15-
- Keep this file in sync with the repository’s status; update it if the governance changes.
28+
- Keep this file in sync with the repository's status; update it if the governance changes.
29+
30+
## Repository Roots
31+
32+
- Local repository root: `/var/mnt/eclipse/repos`
33+
- Remote mapping: `https://github.com/hyperpolymath/<name>`
34+
- Repository names are lowercase; dots (`.`) are replaced with hyphens (`-`).
35+
- If a repository is missing locally, check the remote and synchronize before proceeding.
36+
37+
## AI CLI Standards
38+
39+
- Include `ai-cli-crash-capture/` and `contractiles/` from this template in all new repositories.
40+
- Mirror all 6SCM files into `.machine_readable/`.
41+
- Before generating code, inspect `/var/mnt/eclipse/repos/proven` for the current Idris "unbreakable" library status.
42+
- If the project depends on the unbreakable Idris library, add an *Idris Inside* badge to the repository.
43+
- When new bindings are required, create them under `/var/mnt/eclipse/repos/proven` using the naming pattern `idris2-zig-<language>`.
44+
- If new code implies additional unbreakable Idris modules, add them to `/var/mnt/eclipse/repos/proven` and update binders across all supported languages.
45+
46+
## Language Policy
47+
48+
### Allowed Languages and Tools
49+
50+
| Language/Tool | Use Case | Notes |
51+
|---------------|----------|-------|
52+
| ReScript | Application code | Type-safe, compiles to JS |
53+
| Deno | Runtime and package management | Replaces Node/npm/bun |
54+
| Rust | Systems, performance-critical, WASM | Preferred for CLI tools |
55+
| Tauri 2.0+ | Mobile apps (iOS/Android) | Rust backend + web UI |
56+
| Dioxus | Mobile apps (native UI) | Pure Rust, React-like |
57+
| Gleam | Backend services | BEAM or JS targets |
58+
| Bash/POSIX Shell | Automation scripts | Keep minimal |
59+
| JavaScript | Only where ReScript cannot | MCP glue, Deno APIs |
60+
| Nickel | Configuration | Complex config logic |
61+
| Guile Scheme | Metadata/state files | For all `.scm` artefacts |
62+
| Julia | Batch/data processing | Per RSR |
63+
| OCaml | AffineScript compiler | Language-specific |
64+
| Ada | Safety-critical systems | Where required |
65+
66+
### Banned Languages and Tools
67+
68+
| Banned | Replacement |
69+
|--------|-------------|
70+
| TypeScript | ReScript |
71+
| Node.js | Deno |
72+
| npm | Deno |
73+
| Bun | Deno |
74+
| pnpm/yarn | Deno |
75+
| Go | Rust |
76+
| Python | Julia / Rust / ReScript |
77+
| Java/Kotlin | Rust / Tauri / Dioxus |
78+
| Swift | Tauri / Dioxus |
79+
| React Native | Tauri / Dioxus |
80+
| Flutter/Dart | Tauri / Dioxus |
81+
82+
## Mobile Development Policy
83+
84+
A strict Rust-first approach applies.
85+
86+
- Use **Tauri 2.0+** for web UI (ReScript) + Rust backend.
87+
- Use **Dioxus** for pure Rust native UI.
88+
89+
Both are FOSS with independent governance.
90+
91+
## Enforcement Rules
92+
93+
- Do not create new TypeScript files; convert existing TS to ReScript.
94+
- Do not use `package.json` for runtime dependencies; use `deno.json` imports.
95+
- Do not include `node_modules` in production; Deno handles dependency caching.
96+
- Do not use Go; use Rust.
97+
- Do not use Python; use Julia (data/batch), Rust (systems), or ReScript (apps).
98+
- Do not use Kotlin/Swift; use Tauri 2.0+ or Dioxus for mobile.
99+
100+
## Package Management
101+
102+
- Primary: Guix (`guix.scm`)
103+
- Fallback: Nix (`flake.nix`)
104+
- JavaScript dependencies: Deno (`deno.json` imports)
105+
106+
## Security Requirements
107+
108+
- Do not use MD5 or SHA-1; use SHA-256 or stronger.
109+
- Use HTTPS only.
110+
- Do not hardcode secrets.
111+
- Pin all dependencies by SHA.
112+
- Include SPDX license headers in all files.

‎AI.djot‎

Lines changed: 0 additions & 100 deletions
This file was deleted.

‎extension/devtools/panel.js‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -213,10 +213,12 @@ function analyzeImpact(before, after) {
213213

214214
// Inspect specific flag
215215
async function inspectFlag(key) {
216+
// Sanitize key to prevent code injection via string interpolation
217+
const sanitizedKey = key.replace(/[\\"'`$]/g, '');
216218
const code = `
217219
(function() {
218220
// Check if flag affects this page
219-
const flagKey = "${key}";
221+
const flagKey = ${JSON.stringify(sanitizedKey)};
220222
console.log("Inspecting flag:", flagKey);
221223
222224
// Return any relevant page state
@@ -229,7 +231,7 @@ async function inspectFlag(key) {
229231
`;
230232

231233
const [result] = await browser.devtools.inspectedWindow.eval(code);
232-
logToConsole(`Inspected flag: ${key} on ${result.url}`, 'info');
234+
logToConsole(`Inspected flag: ${escapeHtml(key)} on ${result.url}`, 'info');
233235
}
234236

235237
// Export DevTools data

0 commit comments

Comments
 (0)