• Joined on 2026-02-08
clawbot commented on pull request sneak/lora.vegas#37 2026-08-09 18:59:09 +02:00
#14: add a Cloudflare Pages _headers file with baseline security headers (closes #14)

Review: FAIL — needs-rework

static/_headers is correct and needs no change. Both blocking defects are in TODO.md; the fix is an edit plus an amend.

Blocking

**1. TODO.md,…

clawbot pushed to next at sneak/prompts 2026-08-09 18:56:36 +02:00
61448b0c4e Keep in-repo agent scratch out of the build context and out of git (closes #27)
clawbot commented on issue sneak/vaultik#106 2026-08-09 18:56:03 +02:00
Startup banner goes to stdout and --json does not suppress it, so every --json document is preceded by three lines of prose

Implementation plan, on branch fix-json-banner off main.

1. The design question — extend bannerSuppressedInArgs, do not move the banner.

Moving the banner after parsing costs more…

clawbot commented on issue sneak/lora.vegas#14 2026-08-09 18:51:57 +02:00
Add a Cloudflare Pages _headers file with baseline security headers

Implemented in sneak/lora.vegas#37 (branch issue-14-security-headers, one commit on top of main).

static/_headers added with Strict-Transport-Security,…

clawbot created pull request sneak/lora.vegas#37 2026-08-09 18:51:38 +02:00
#14: add a Cloudflare Pages _headers file with baseline security headers (closes #14)
clawbot pushed to issue-14-security-headers at sneak/lora.vegas 2026-08-09 18:50:46 +02:00
8d639aa258 Add a Cloudflare Pages _headers file with baseline security headers (closes #14)
clawbot created branch issue-14-security-headers in sneak/lora.vegas 2026-08-09 18:50:46 +02:00
clawbot commented on issue sneak/prompts#27 2026-08-09 18:48:03 +02:00
canonical .dockerignore omits .claude/, so agent worktrees land in the Docker build context

Implementation plan, following the Implementation brief above.

Working on next in a private clone; this lands as a fourth commit on the open [PR #34](https://git.eeqj.de/sneak/prompts/pulls/…

clawbot commented on pull request sneak/rgoue#40 2026-08-09 18:46:56 +02:00
test: drive the autosave race test to a condition, not a turn count (closes #36)

Diagnosis confirmation

The captured finding on sneak/rgoue#36 holds, and I reproduced it rather than assuming it.

Instrumenting driveUntilDone to report the turns…

clawbot created pull request sneak/rgoue#40 2026-08-09 18:46:24 +02:00
test: drive the autosave race test to a condition, not a turn count (closes #36)
clawbot commented on pull request sneak/AutistMask#185 2026-08-09 18:46:23 +02:00
test: containerized Chrome end-to-end harness that drives the real popup (closes #181)

Manager note. Fourth review verdict PASS. Label set to merge-ready, assigned to sneak for merge. Reviewer's results: sneak/AutistMask#185 (comment)

##…

clawbot opened issue sneak/AutistMask#188 2026-08-09 18:46:04 +02:00
test: assert the DoD items from #150 and #151 that the harness does not yet cover
clawbot opened issue sneak/AutistMask#187 2026-08-09 18:45:47 +02:00
test: an empty-array POST body escapes the e2e unstubbed-request guard
clawbot pushed to fix/autosave-turn-budget-36 at sneak/rgoue 2026-08-09 18:45:39 +02:00
cb7ddfdb67 test: drive the autosave race test to a condition, not a turn count (closes #36)
clawbot created branch fix/autosave-turn-budget-36 in sneak/rgoue 2026-08-09 18:45:39 +02:00
clawbot commented on issue sneak/lora.vegas#14 2026-08-09 18:44:56 +02:00
Add a Cloudflare Pages _headers file with baseline security headers

Implementation plan

Re-confirmed the "before" state from the comment above with curl -sSI https://lora.vegas/ just now (2026-08-09): the live response carries `x-content-type-options:…

clawbot commented on pull request sneak/AutistMask#185 2026-08-09 18:44:50 +02:00
test: containerized Chrome end-to-end harness that drives the real popup (closes #181)

Review (fourth reviewer, fresh; head 82c40e0): PASS

Scope as instructed: verify the three reworked items from sneak/AutistMask#185 (comment) by execution, p…

clawbot commented on issue sneak/prompts#29 2026-08-09 18:44:33 +02:00
SECURITY: canonical .dockerignore does not exclude .env, *.pem or *.key, so local secrets ship into the Docker build context

Second-pass findings folded in. 533fc61 -> fd78aeb, amended and force-pushed with --force-with-lease; origin/next verified at 533fc61 immediately before the push, and 51c3945 /…

clawbot commented on issue sneak/vaultik#106 2026-08-09 18:44:19 +02:00
Startup banner goes to stdout and --json does not suppress it, so every --json document is preceded by three lines of prose

Scope addition — one more item lands with this, from the PR #107 review.

AGENTS.md policy 9 (lines 86-87) is now false. It states the…

clawbot pushed to main at sneak/vaultik 2026-08-09 18:43:58 +02:00
c16ef476a9 Log to stderr and stop discarding With attributes (closes #82)