fix(brainstorm-server): validate Host header to defeat DNS rebinding - #1553

Closed

aaronjmars wants to merge 107 commits into

aaronjmars:security/host-header-validation

Commits on May 6, 2026

docs: turned the dash in "- Jesse" into an escape sequence (#1474)
robotsnh
authored
b4363df
Spec: lift drill into superpowers as evals/

obra
authored and
arittr
committed
81472cc
Spec: address adversarial review findings

obra
authored and
arittr
committed
58f8213
Plan: lift drill into superpowers as evals/

obra
authored and
arittr
committed
2e46e95
Lift drill into evals/ at 013fcb8b7dbefd6d3fa4653493e5d2ec8e7f985b

obra
authored and
arittr
committed
3b412a3
evals: default SUPERPOWERS_ROOT to parent of evals/ if unset

obra
authored and
arittr
committed
be0357f
evals: drop SUPERPOWERS_ROOT from codex/gemini required_env

obra
authored and
arittr
committed
fd5b53c
evals: drop SUPERPOWERS_ROOT setup step from README/CLAUDE

obra
authored and
arittr
committed
6f0adeb
tests: remove skill-triggering bash prompts (covered by drill triggering-* scenarios)

obra
authored and
arittr
committed
371f415
tests: remove run-claude-describes-sdd.sh (covered by drill mid-conversation-skill-invocation)

obra
authored and
arittr
committed
f10cdda
tests: remove subagent-driven-dev fixtures (covered by drill sdd-go-fractals + sdd-svelte-todo)

obra
authored and
arittr
committed
c0a65f1
tests: remove test-document-review-system.sh (covered by drill spec-reviewer-catches-planted-flaws)

obra
authored and
arittr
committed
f1d2005
tests: remove test-requesting-code-review.sh (covered by drill code-review-catches-planted-bugs)

obra
authored and
arittr
committed
39d29a6
tests: annotate three kept bash tests with drill coverage notes

obra
authored and
arittr
committed
45c7dc2
docs: annotate dated artifacts referencing lifted bash tests

obra
authored and
arittr
committed
f5175fb
docs: introduce evals/ as the canonical skill-behavior eval harness

obra
authored and
arittr
committed
f7c5312
Address adversarial review findings

obra
authored and
arittr
committed
0bf3749
evals: remove unreleased wave scenarios
arittr
committed
3dc0ea6
evals: drop drill source marker
arittr
committed
58082d0
evals: add Gemini 2.5 Flash backend
arittr
committed
35e42a1
evals: use pre-commit hooks
arittr
committed
7f02ccd

Commits on May 11, 2026

fix(writing-skills): use markdown link for testing methodology reference

stablegenius49
authored and
arittr
committed
d4cf61b

Commits on May 12, 2026

fix: remove stale Cursor plugin refs

fuleinist
authored and
arittr
committed
9088f56
fix(using-git-worktrees): repair skipped Step 2 numbering (#1522)
arittr
authored
491df73
fix: remove global worktree path fallback (#1476)
arittr
authored
3dfb376

Commits on May 13, 2026

Commits on May 14, 2026

Phase A: agent-neutral prose + CSO → SDO + spec

obra
authored and
arittr
committed
d0e413b
Phase B: config-file refs + per-platform tool refs + spec

obra
authored and
arittr
committed
5c04027
Phase C: alphabetize README platform listings + spec

obra
authored and
arittr
committed
e47d6f4
Phase D: cross-runtime tweaks (visual-companion, executing-plans, test)

obra
authored and
arittr
committed
b87a5e4
Phase E: action-language tool vocabulary

obra
authored and
arittr
committed
01034bc
Tighten cross-platform tool references
arittr
committed
d4d9911
docs: plan pi extension and evals work

obra
authored and
arittr
committed
da35948
feat: add pi superpowers package extension

obra
authored and
arittr
committed
cafbc5a
chore: keep pi extension under .pi

obra
authored and
arittr
committed
452f1ed
Bump evals submodule for Pi backend
arittr
committed
4bd0973
Align Pi mapping with action vocabulary
arittr
committed
49bf5ad
[codex] support native Codex plugin hooks (#1540)
arittr
authored
201f945
Bump superpowers-evals submodule
arittr
committed
8c1f7c5

Commits on May 21, 2026

@mhat reported that his claude got confused about 'debugging' being named as a skill in the bootstrap

obra
authored and
arittr
committed
180f009

Commits on May 23, 2026

Commits on May 24, 2026

Commits on May 29, 2026

fix(sync-to-codex-plugin): exclude /.pi/ so the pi extension doesn't leak into the Codex plugin
obra
committed
e63e44b

Commits on Jun 1, 2026

docs: add 'Porting Superpowers to a New Harness' guide

obra
authored and
arittr
committed
deceaec
feat: add Antigravity CLI (agy) support

obra
authored and
arittr
committed
da00e59
fix(finishing-a-development-branch): detect remote platform before creating PR/MR

authored and
arittr
committed
ff213eb
fix(finishing-a-development-branch): remove gh-specific PR creation instruction

authored and
arittr
committed
c879454
fix: foreground mode saves node PID and clears OWNER_PID on Windows/MSYS2
nestorluiscamachopaz
authored
81c3052
docs(windows): update polyglot hook docs
arimu1
authored
9d3e68a
docs(windows): trim polyglot hook implementation copy
arittr
committed
7301c81
feat(subagent-dev): add TDD RED evidence to implementer report format
mvanhorn
authored
f776394

Commits on Jun 2, 2026

feat: add Kimi Code plugin manifest

wbxl2000
authored and
obra
committed
2a8e547
fix: align Kimi manifest with supported fields

arittr
authored and
obra
committed
7fec40b
fix: wire Kimi plugin into release metadata

arittr
authored and
obra
committed
6b76158
docs: simplify Kimi README install steps

arittr
authored and
obra
committed
773bbf6
docs: restore Kimi direct install command

arittr
authored and
obra
committed
c74c22d
Tighten Kimi plugin porting coverage

arittr
authored and
obra
committed
16a1719
Add shell lint script

arittr
authored and
obra
committed
f3f0789
fix(brainstorming): cap websocket frame payloads

therahul-yo
authored and
arittr
committed
d7c260a
chore(evals): bump submodule to antigravity rate-limit fix (79f9963)

arittr
and
claude
committed
617168a

Commits on Jun 3, 2026

chore(evals): bump submodule to --scenarios filter (ff3ee83)

arittr
and
claude
committed
ae1eefb

Commits on Jun 9, 2026

Require contributors to disclose authoring environment and target dev
obra
committed
f55642e

Commits on Jun 10, 2026

chore(evals): bump submodule for Claude Haiku target

arittr
authored and
obra
committed
0cb1960

Commits on Jun 11, 2026

feat(writing-skills): form-selection table + micro-test wording method

obra
authored and
arittr
committed
3e565ca
fix(writing-skills): scope empirical claims, honest noise reporting, conditionalize micro-test checklist line

obra
authored and
arittr
committed
b148b64
fix(writing-skills): hang backfire mechanism on the separated prohibition-vs-recipe comparison (NEW-4); control comparison stated as trend

obra
authored and
arittr
committed
74f85a7
chore(evals): bump submodule to SUP-333 boundary + plumbing scenarios (7f8e80c)

arittr
and
claude
committed
e6c9838
fix(brainstorm-server): ignore macOS resource-fork dotfiles

obra
authored and
arittr
committed
88fe1e7
fix(brainstorm-server): verify PID ownership before stopping

obra
authored and
arittr
committed
9b00cc2
feat(brainstorm-server): 4h configurable idle timeout; close WS on shutdown

obra
authored and
arittr
committed
c292421
feat(brainstorm-companion): resilient reconnect, live status, paused overlay

obra
authored and
arittr
committed
31a0de8
feat(brainstorm-server): reuse the same port on session restart

obra
authored and
arittr
committed
13da997
feat(brainstorm-server): opt-in auto-open of the browser on the first screen

obra
authored and
arittr
committed
0d37ff6
feat(brainstorming): offer the visual companion just-in-time; harden lifecycle guidance

obra
authored and
arittr
committed
daa41c0
fix(brainstorm-server): address adversarial review findings

obra
authored and
arittr
committed
bac46a5
fix(brainstorm-server): tie stop-server PID check to the session's port

obra
authored and
arittr
committed
eee4f87
docs(brainstorm): catalog visual companion issues; choose session-key for security

obra
authored and
arittr
committed
de05e02
feat(brainstorm-server): gate every endpoint behind a per-session key

obra
authored and
arittr
committed
c64c4ea
test(brainstorm-server): thread session key through tests after auth merge

obra
authored and
arittr
committed
4341c3f
fix(brainstorm-server): fix auth-integration bugs from full-branch review

obra
authored and
arittr
committed
f4d1788
Document visual companion auth hardening plan
arittr
committed
fe812c4
Harden brainstorm companion auth regressions
arittr
committed
a2e67bb
Harden companion Windows lifecycle coverage
arittr
committed
c7d7e35
Document visual companion final hardening fixup
arittr
committed
4f88b89
Tighten visual companion hardening spec
arittr
committed
7bb6af2
Plan visual companion final hardening fixup
arittr
committed
5f3b317
Harden root screen containment
arittr
committed
c4cde1e
Fix server test fallback cleanup
arittr
committed
2bab677
Isolate companion fallback tokens
arittr
committed
8034176
Harden companion stop ownership proof
arittr
committed
a6a4cd8
Fix companion lifecycle test ownership metadata
arittr
committed
5eea0d0
Harden companion platform tests
arittr
committed
377192f
Fix companion test cleanup and argv assertions
arittr
committed
441335e
Align visual companion docs with shipped scope
arittr
committed
1c21a91
Fix Windows lifecycle validation
arittr
committed
5415cb8
Harden Windows browser launcher
arittr
committed
e9ee6c5
Fix companion stop metadata and token permissions
arittr
committed
93f2ce9

Commits on Jun 12, 2026

fix(brainstorm-server): validate Host header to defeat DNS rebinding
aaronjmars
committed
e46c998