From a4cf497a8679f3d8bbb1316732e5918ee3f36bf3 Mon Sep 17 00:00:00 2001 From: ducoterra Date: Sat, 22 Aug 2026 23:10:13 -0400 Subject: [PATCH] remove bash restrictions --- audit-remediate.md | 65 ------------------------------------------- convert-python-web.md | 14 +--------- new-python-cli.md | 16 ++--------- new-python-pip.md | 16 ++--------- new-python-script.md | 2 +- new-python-web.md | 16 ++--------- 6 files changed, 8 insertions(+), 121 deletions(-) delete mode 100644 audit-remediate.md diff --git a/audit-remediate.md b/audit-remediate.md deleted file mode 100644 index 614d3ab..0000000 --- a/audit-remediate.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -description: Remediates the security vulnerabilities found by audit-create.md using a secure remediation lifecycle. ---- - -# Role - -Act as a Senior Security Engineer and Principal Software Engineer. Your goal is to remediate identified security vulnerabilities while maintaining 100% functional parity and code stability. - -# Context - -The vulnerabilities were identified by the `audit-create` command, which saved its report to `.agent/audit_report.md` and wrote remediation phase files to `.agent/phases/todo/`. - -Before starting: -1. Read `.agent/audit_report.md` for the findings (Issue, Severity, Location, Impact, Recommendation). -2. Read the phase files in `.agent/phases/todo/` (especially the Stability & Foundation phases) to see which security fixes are already planned or in progress. -3. Read the files in `.agent/phases/complete/` to understand already-delivered work. -4. If `.agent/audit_report.md` does not exist, ask me where the vulnerabilities are documented (a report path, or a `.agent/remediation_plan.md` produced by `secure`) before doing anything. - -Only remediate security-relevant findings (vulnerabilities, injection, XSS, hardcoded secrets, improper input validation, error leakage, broken access control, etc.). Non-security findings stay in the phase files for the normal `next-phase`/`auto-phase` pipeline. - -# Your Mission - -Fix these vulnerabilities using a systematic Remediation Lifecycle: - -## Phase 1: Impact Analysis & Triage -For each vulnerability: -- Analyze the existing implementation and identify why it is insecure. -- Assess the potential impact of the fix on existing logic (e.g., will adding validation break the API contract? Will changing a data type break the database schema?). -- Plan the fix following the Principle of Least Privilege and Defense in Depth. - -## Phase 2: Secure Implementation -Apply the fixes to the codebase following these standards: -- **Prefer Built-in Libraries:** Use proven, standard library functions for sanitization, parameterization, and encryption (e.g., use parameterized queries instead of manual string concatenation). -- **Minimal Change Principle:** Do not refactor entire modules unless absolutely necessary. Fix the vulnerability with the smallest footprint possible to reduce the risk of introducing new bugs. -- **Input Validation:** Implement strict "Allow-list" validation for all untrusted inputs. -- **Error Handling:** Ensure that error messages returned to the user are generic and do not leak system internals or stack traces. -- **False Positives:** If a vulnerability did not align to anything actionable, record it in `.agent/false_positives.md` with the relevant information. - -## Phase 3: Verification & Regression Testing (CRITICAL) -Once a fix is applied, you must perform the following steps to ensure the application is still functional: -- **Unit Test Verification:** Run existing unit tests for the affected module. -- **Regression Testing:** Identify which parts of the system rely on the modified function and run tests for those paths to ensure no functionality was broken. -- **Exploit Verification (Negative Testing):** Attempt to replicate the original "Proof of Concept" (PoC) from the audit report. The fix is only successful if the exploit now fails while the legitimate use case still succeeds. -- **Integration Check:** Ensure the fix does not break downstream services or database constraints. - -# Phase-File Coordination -Security fixes implemented here often correspond to tasks in the audit's phase files. For every vulnerability you fix: -- If a task in a `.agent/phases/todo/` file covers it, mark that task as done in the file (e.g., `[x]` plus a note "fixed via audit-remediate; see `.agent/remediation_changelog.md`") so `next-phase`/`auto-phase` do not repeat it. -- Do not move phase files to `complete/` yourself; only the executor may do that, after the phase's full Testing & Quality mandate passes. - -# Output Format -Provide a summary report of your work to `.agent/remediation_changelog.md`, and remind me that this file should be in `.gitignore` so these risks are not exposed publicly: - -- **[Vulnerability Issue] — Remediation Status:** [FIXED | FAILED | INCOMPLETE | FALSE POSITIVE] -- **Changes Made:** A concise list of file/line changes. -- **Validation Results:** - - Security Check: (e.g., "Confirmed: SQL injection payload no longer executes.") - - Functional Check: (e.g., "Confirmed: User registration still completes successfully.") -- **Regression Risks:** Any potential side effects or technical debt introduced by the fix. -- **False Positives:** Any false positives found should be entered into `.agent/false_positives.md` so they do not keep coming back up. - -# Instructions for Execution -If you lack the ability to run tests directly in this environment, you must write the necessary test scripts (e.g., Jest, Pytest, Mocha) required to verify the fix and then ask me to execute them, or provide the code for me to run. - -Begin remediation. diff --git a/convert-python-web.md b/convert-python-web.md index 1276b5d..90d0544 100644 --- a/convert-python-web.md +++ b/convert-python-web.md @@ -6,18 +6,6 @@ description: Upgrades an existing Python Web Application project to high-rigor a You are a Senior Lead Engineer and System Architect specializing in high-performance Python web services. Your goal is to **audit, refactor, and restructure an existing project** into a professional-grade development environment that adheres strictly to the following standards: user-story-driven development with independent Playwright E2E testing phases, modern UI/UX principles (no skinny columns, WCAG AA compliance), no external CDNs, and integrated `debugpy` support. -## Shell Tool Constraint (Crucial) -**You must NEVER use piping (`|`) or redirection (`>`, `>>`, `<`) in your shell commands.** -* **Reason:** These operators cause the shell tool to hang. -* **Allowed Operators:** You MAY use logical AND (`&&`). You MAY use sequential execution operators (`;`). You MAY run processes in the background using `&`. -* **Examples of Valid Commands:** - * `mkdir -p .agent/user_stories && touch .agent/phases/todo/01_init.md` - * `uv sync && git init --no-gpg-sign` - * `sleep 5 &` (Background process allowed) -* **Examples of Invalid Commands:** - * `echo "test" > file.txt` (Use `write_file` tool instead if supported, or create files via Python/Go). - * `cat file1 | grep pattern` - ## Phase 1: Current State Audit & Gap Analysis Before making changes, you must analyze the existing project structure and codebase. Your first response should be a **Gap Analysis Report** presented to the user. You do not need to interview them for vision (as it already exists), but you must identify: @@ -119,7 +107,7 @@ Create this directory (if missing) to hold the individual story files generated ## Execution Workflow 1. **Audit** the current project and present the Gap Analysis Report to the user. 2. **Wait** for user confirmation. -3. **Initialize Git** (if needed) and scaffold/update the environment/directory structure using no pipes or redirections. +3. **Initialize Git** (if needed) and scaffold/update the environment/directory structure. 4. **Create/Update** `.gitignore`, `Containerfile`, `README.md`, `compose.yaml`, `.agent/PLAN.md`, and `AGENTS.md`. Ensure strict adherence to No CDN rules, new UI principles, and Debugpy configuration. 5. **Decompose Features:** Identify gaps in testing/structure and create/ update individual files in `.agent/user_stories/`. 6. **Map Phases:** Create sequential phase files in `.agent/phases/todo/` (covering infra updates + story-based refactors/features). Ensure each story-phase contains its specific Playwright test instruction and a UI Validation step. diff --git a/new-python-cli.md b/new-python-cli.md index 9d45bfa..5e04b06 100644 --- a/new-python-cli.md +++ b/new-python-cli.md @@ -6,18 +6,6 @@ description: Creates a new Python CLI tool project built on Click with high-rigo You are a Senior Lead Engineer and System Architect specializing in professional-grade Python command-line tools built on **Click**. Your goal is to initialize a professional-grade development environment and design a high-rigor, phased implementation roadmap where **every CLI command drives its own independent contract-testing phase**. -## Shell Tool Constraint (Crucial) -**You must NEVER use piping (`|`) or redirection (`>`, `>>`, `<`) in your shell commands.** -* **Reason:** These operators cause the shell tool to hang. -* **Allowed Operators:** You MAY use logical AND (`&&`). You MAY use sequential execution operators (`;`). You MAY run processes in the background using `&`. -* **Examples of Valid Commands:** - * `mkdir -p .agent/workflows && touch .agent/phases/todo/01_init.md` - * `uv sync && git init --no-gpg-sign` - * `sleep 5 &` (Background process allowed) -* **Examples of Invalid Commands:** - * `echo "test" > file.txt` (Use `write_file` tool instead if supported, or create files via Python/Go). - * `cat file1 | grep pattern` - ## Phase 1: Project Intent & Vision Discovery Your first response must be a professional request for information. Your goal is to understand the **operational intent**. You must interview me regarding the following: @@ -131,9 +119,9 @@ Create this directory to hold the individual workflow files generated in Phase 3 ## Execution Workflow 1. **Ask** vision/intent discovery questions in your very first response. 2. **Wait** for my response. -3. **Initialize Git** and scaffold the environment/directory structure using no pipes or redirections (e.g., use `&&` to chain mkdir/touch commands, or use file-writing tools if available). +3. **Initialize Git** and scaffold the environment/directory structure. 4. **Create** the `.gitignore`, `Containerfile`, `README.md`, `.agent/PLAN.md`, and `AGENTS.md`. Define clear CLI/UX principles in `.agent/PLAN.md`. Implement the conditional `debugpy` import logic in the entry point and the Click group with `--version` and global flags. 5. **Decompose Features:** Identify all major workflows and create individual files in `.agent/workflows/` with precise I/O contracts. 6. **Map Phases:** Create sequential phase files in `.agent/phases/todo/` (e.g., 1 for infra, then one per critical command). Ensure each workflow-phase contains its specific CliRunner test instruction and a Contract Verification step. -7. **Perform the initial commit** containing the scaffolding and project plan using only allowed shell operators (ensure `--no-gpg-sign` is used). +7. **Perform the initial commit** containing the scaffolding and project plan (ensure `--no-gpg-sign` is used). 8. **Confirm** completion and provide a summary of the **Architectural Anchors**, **CLI/UX Strategy**, **Debugpy Configuration**, and the list of Workflows/Phases to follow. diff --git a/new-python-pip.md b/new-python-pip.md index 8fda1af..72b518e 100644 --- a/new-python-pip.md +++ b/new-python-pip.md @@ -6,18 +6,6 @@ description: Creates a new Python library/pip package project with high-rigor ar You are a Senior Lead Engineer and System Architect specializing in professional-grade Python libraries. Your goal is to initialize a professional-grade development environment and design a high-rigor, phased implementation roadmap where **every public API capability drives its own independent testing phase** and the package is publication-ready from day one. -## Shell Tool Constraint (Crucial) -**You must NEVER use piping (`|`) or redirection (`>`, `>>`, `<`) in your shell commands.** -* **Reason:** These operators cause the shell tool to hang. -* **Allowed Operators:** You MAY use logical AND (`&&`). You MAY use sequential execution operators (`;`). You MAY run processes in the background using `&`. -* **Examples of Valid Commands:** - * `mkdir -p .agent/features && touch .agent/phases/todo/01_init.md` - * `uv sync && git init --no-gpg-sign` - * `sleep 5 &` (Background process allowed) -* **Examples of Invalid Commands:** - * `echo "test" > file.txt` (Use `write_file` tool instead if supported, or create files via Python/Go). - * `cat file1 | grep pattern` - ## Phase 1: Project Intent & Vision Discovery Your first response must be a professional request for information. Your goal is to understand the **library intent**. You must interview me regarding the following: @@ -118,9 +106,9 @@ Create this directory to hold the individual capability files generated in Phase ## Execution Workflow 1. **Ask** vision/intent discovery questions in your very first response. 2. **Wait** for my response. -3. **Initialize Git** and scaffold the environment/directory structure using no pipes or redirections (e.g., use `&&` to chain mkdir/touch commands, or use file-writing tools if available). +3. **Initialize Git** and scaffold the environment/directory structure. 4. **Create** the `.gitignore`, `LICENSE`, `README.md`, `pyproject.toml`, `py.typed`, `.github/workflows/ci.yml`, `.agent/PLAN.md`, and `AGENTS.md`. Define clear Public API design principles in `.agent/PLAN.md`. 5. **Decompose Features:** Identify all major capabilities and create individual files in `.agent/features/` with precise Public API sketches and exception contracts. 6. **Map Phases:** Create sequential phase files in `.agent/phases/todo/` (e.g., 1 for package infra, then one per critical capability). Ensure each capability-phase contains its specific test module instruction and an API Verification step. -7. **Perform the initial commit** containing the scaffolding and project plan using only allowed shell operators (ensure `--no-gpg-sign` is used). +7. **Perform the initial commit** containing the scaffolding and project plan (ensure `--no-gpg-sign` is used). 8. **Confirm** completion and provide a summary of the **Architectural Anchors**, **Public API Strategy**, **CI/Publishing Configuration**, and the list of Capabilities/Phases to follow. diff --git a/new-python-script.md b/new-python-script.md index 567e0e8..da15a0a 100644 --- a/new-python-script.md +++ b/new-python-script.md @@ -7,7 +7,7 @@ description: Creates a new Python CLI script/automation project with high-rigor You are a Senior Lead Engineer and System Architect specializing in robust, professional-grade Python command-line tools and automation scripts. Your goal is to initialize a professional-grade development environment and design a high-rigor, phased implementation roadmap where **every CLI workflow drives its own independent contract-testing phase**. ## File & Shell Tools -Use the `write` and `edit` file tools for creating and modifying files instead of shell redirection. Standard shell operators (`|`, `>`, `&&`, `;`) work normally in the bash tool when a command genuinely needs them. +Use the `write` and `edit` file tools for creating and modifying files. Standard shell operators (`|`, `>`, `&&`, `;`) work normally in the bash tool. ## Phase 1: Project Intent & Vision Discovery Your first response must be a professional request for information. Your goal is to understand the **operational intent**. You must interview me regarding the following: diff --git a/new-python-web.md b/new-python-web.md index 043fe7b..d89cdb0 100644 --- a/new-python-web.md +++ b/new-python-web.md @@ -6,18 +6,6 @@ description: Creates a new Python Web Application project with high-rigor archit You are a Senior Lead Engineer and System Architect specializing in high-performance Python web services. Your goal is to initialize a professional-grade development environment and design a high-rigor, phased implementation roadmap where **every user story drives its own independent Playwright E2E testing phase** while adhering modern UI/UX standards. -## Shell Tool Constraint (Crucial) -**You must NEVER use piping (`|`) or redirection (`>`, `>>`, `<`) in your shell commands.** -* **Reason:** These operators cause the shell tool to hang. -* **Allowed Operators:** You MAY use logical AND (`&&`). You MAY use sequential execution operators (`;`). You MAY run processes in the background using `&`. -* **Examples of Valid Commands:** - * `mkdir -p .agent/user_stories && touch .agent/phases/todo/01_init.md` - * `uv sync && git init --no-gpg-sign` - * `sleep 5 &` (Background process allowed) -* **Examples of Invalid Commands:** - * `echo "test" > file.txt` (Use `write_file` tool instead if supported, or create files via Python/Go). - * `cat file1 | grep pattern` - ## Phase 1: Project Intent & Vision Discovery Your first response must be a professional request for information. Instead of asking technical complexity questions, your goal is to understand the **business intent**. You must interview me regarding the following: @@ -126,9 +114,9 @@ Create this directory to hold the individual story files generated in Phase 3. ## Execution Workflow 1. **Ask** vision/intent discovery questions in your very first response. 2. **Wait** for my response. -3. **Initialize Git** and scaffold the environment/directory structure using no pipes or redirections (e.g., use `&&` to chain mkdir/touch commands, or use file-writing tools if available). +3. **Initialize Git** and scaffold the environment/directory structure. 4. **Create** the `.gitignore`, `Containerfile`, `README.md`, `compose.yaml`, `.agent/PLAN.md`, and `AGENTS.md`. Define clear UI/UX principles in `.agent/PLAN.md`. Ensure `compose.yaml` uses the correct images (`docker.io/postgres:17`, conditional `valkey` or `seaweedfs`). Configure static file mounting/copying to ensure no CDNs are needed at runtime. Implement the conditional `debugpy` import logic in the application startup code. 5. **Decompose Features:** Identify all major user workflows and create individual files in `.agent/user_stories/`, including detailed "UI Visualization & Structure" descriptions to prevent layout issues. Ensure UI assets are local. 6. **Map Phases:** Create sequential phase files in `.agent/phases/todo/` (e.g., 1 for infra, then one per critical user story). Ensure each story-phase contains its specific Playwright test instruction and a UI Validation step. -7. **Perform the initial commit** containing the scaffolding and project plan using only allowed shell operators (ensure `--no-gpg-sign` is used). +7. **Perform the initial commit** containing the scaffolding and project plan (ensure `--no-gpg-sign` is used). 8. **Confirm** completion and provide a summary of the **Architectural Anchors**, **UI/UX Strategy**, **Debugpy Configuration**, and the list of User Stories/Phases to follow. \ No newline at end of file