Mike Swanson
ded99c5882
Independent reviews of server/agent/dashboard by Gemini 3.1 Pro and Grok 4.3, each reading source via its own read_file tool, plus a Claude synthesis and a phased remediation plan. Top convergent finding: secrets/tokens in WebSocket URL query strings across agent + dashboard. See SYNTHESIS-three-way.md and REMEDIATION-PLAN.md.
17 lines
1.4 KiB
Bash
17 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# run-review.sh <gemini|grok> <subsystem> <files-list> <out-file>
|
|
set -uo pipefail
|
|
TOOL="$1"; SUB="$2"; LIST="$3"; OUT="$4"
|
|
ROOT="/d/claudetools"
|
|
case "$TOOL" in
|
|
gemini) SCRIPT="$ROOT/.claude/skills/agy/scripts/ask-gemini.sh" ;;
|
|
grok) SCRIPT="$ROOT/.claude/skills/grok/scripts/ask-grok.sh" ;;
|
|
*) echo "bad tool"; exit 2 ;;
|
|
esac
|
|
INSTR="You are doing an independent code review of the GuruConnect ${SUB} (a Rust/TypeScript remote-support/remote-control platform: agent <-> relay server <-> browser viewer, protobuf wire protocol, JWT auth, support-code session binding). Review ONLY the files provided. Produce a prioritized findings list. For EACH finding give: [SEVERITY: CRITICAL/HIGH/MEDIUM/LOW], file:line, the problem, and a concrete fix. Focus on: (1) security — auth/JWT, session takeover, support-code binding, input validation, SQL injection, secret handling, IDOR/authorization, rate-limit bypass; (2) correctness & concurrency — relay/session state races, deadlocks, panics/unwraps, error handling, resource leaks; (3) protocol/wire integrity; (4) architecture & maintainability. Be concrete and skeptical. End with a short overall assessment and the single most important thing to fix."
|
|
mapfile -t FILES < "$LIST"
|
|
echo "# GuruConnect ${SUB} review — ${TOOL} — 2026-06-05" > "$OUT"
|
|
echo "" >> "$OUT"
|
|
bash "$SCRIPT" review-files -i "$INSTR" "${FILES[@]}" >> "$OUT" 2>> "${OUT}.err"
|
|
echo "EXIT=$? files=${#FILES[@]}" >> "${OUT}.err"
|