Skip to content

v1.3.0 — the syntax floor (P2)

Choose a tag to compare

View all tags
@null0xxx null0xxx released this 22 Jul 22:23
· 127 commits to main since this release
v1.3.0
3eec75f

The syntax floor (P2). A hermetic, argv-only, parse-only deterministic lens (Lens 5c) folded into the VERIFIED gate exactly like astlens: before running your tests, it checks each changed file is grammatically valid in its language — Ruby, PHP, Go, shell — plus in-process JSON/TOML config validation.

It is parse-only by construction — it can never execute untrusted repo code (argv-only, never sh -c; ruby -cw not ruby -w; a child environment built from scratch = {PATH,HOME,LANG,TMPDIR} only; a fresh-tempdir cwd) — and it never false-blocks a valid repo (fail-open unless the tool's error names our own materialized file).

The one hard call: JavaScript syntax is NOT covered

Six rounds of the plugin's own 6-lens — running adversarial code against its own new floor — proved node --check cannot distinguish valid JSX/Flow (which ships pervasively inside .js files) from invalid JS, so checking it would false-block the entire React/Flow ecosystem. So JS syntax-checking was dropped. JS is still verified via the P1 run-signal floor (its tests must run and pass); only the unreliable syntax check is gone. Disclosed like the blueprint's other residuals.

Added

  • scripts/nativefloor.py — hermetic argv-only parse runner (from-scratch env, fresh-tempdir cwd, signature-gated defects, cgroup-or-uncapped + wall-clock bounded, monkeypatchable tool_path seam).
  • scripts/syntaxlens.py — the sole consumer: Ruby/PHP/Go/shell dispatch + an explicit _STRICT_CONFIG basename→parser map (tsconfig.json JSONC, opaque lockfiles, and arbitrary data files are never blocking). Folded into VERIFIED as Lens 5c.
  • Optional CI lane (.github/workflows/native-floor.yml) running the non-execution red-team against real node/ruby/php/go.

Changed

  • proccap._launch_and_wait gained an optional hermetic env (byte-equivalent when None). The FROZEN verdict.merge/gate, the P1 run-signal floor, and sast are all untouched.

Verification

Plan-challenge (17 findings folded) → subagent-driven build (4 tasks, per-task review) → whole-branch review → 6 rounds of the plugin's own empirical 6-lens that caught a /dev/zero DoS, three false-block classes, and two of its own vacuous security tests. Test suite 1073 → 1151.

Full detail in CHANGELOG.md.

Install: /plugins install https://github.com/null0xxx/kimi-atlas

Assets 2
Loading