Repository navigation
Sandbox the page, fix the hook and the Codex install, and release 0.3.1 - #6
Merged
Merged
Conversation
Playwright turns Chromium's sandbox off unless asked, and assay also passed --no-sandbox, so every page ran outside the sandbox. assay now asks for it. Where the sandbox can't start, such as when running as root or in some containers, assay runs the page without it, prints a warning on stderr and sets "sandboxed": false in --json. The local server was Python's stock file server, which serves hidden files and follows symlinks. A page under test could read .env or .git/config, or a file a symlink points to outside the folder, and send it anywhere. The server now answers 404 for all of those. SECURITY.md and the plugin's SECURITY.md describe both boundaries.
The hook printed nothing when assay crashed or Chromium couldn't be installed, so a page that was never checked looked the same as a turn that changed none. Both cases now print a line naming the page. hooks.json set no timeout, so each harness used its own default. Factory Droid's is 60 seconds and GitHub Copilot CLI's is 30, which cuts off most checks and loses the report. hooks.json now sets 600 seconds, and the hook spends at most 540 on checks, so its report always gets out. A page left without time is reported as not checked. The hook kept its last-run time in .git only when the working directory was the top of the repository. In a subfolder or a worktree it wrote .assay-last-run into the project. It now finds the repository's git directory from any folder in it.
--one-line quotes labels and error messages from the page, and agents repeat it verbatim. A newline in one let the page add a line of its own, such as a false "nothing flagged". Page text is now collapsed to one line of printable characters.
…f Cursor Codex rejected .agents/plugins/marketplace.json because its policy values aren't ones Codex accepts, so `codex plugin marketplace add awss1i/assay` failed. The file now uses AVAILABLE and ON_INSTALL, drops fields Codex doesn't read, and files assay under Developer Tools. Cursor reads hooks/hooks.json from a plugin unless the manifest names another file, and that file is in Claude Code's format, which Cursor doesn't document for plugins. The Cursor manifest now points at an empty hooks file, so Cursor gets the skill alone, and it names the plugin's logo. .codexignore is removed because Codex doesn't read it, and the Codex description no longer says assay needs no network. A test pins these manifests so a bad value can't stop a marketplace loading again.
The docs said Codex, Grok Build CLI and Cursor had no plugin, but the repository ships one for each and all three install it, so each now has its own section. The DeepSeek Harness reads the skill from .agents/skills/ as well as running the hook, and opencode's section now uses the same folder. The hook is listed for the harnesses that run it, which are Claude Code, Codex, Grok Build CLI, Devin CLI, Factory Droid, GitHub Copilot CLI and the DeepSeek Harness. The README no longer says assay makes no network calls or writes nothing to disk, and it says the planted-bug score is in-sample. Every change is in all four translations.
pyproject.toml lists 3.11 as supported, but the test matrix skipped it.
The report writer and the Chromium download had no tests. links_of and Surface.unavailable were never read. The end-to-end test that shadows eval now writes it directly.
Sets the version to 0.3.1 in pyproject.toml, uv.lock and the three plugin manifests.
github-actions
Bot
added
documentation
2 of 8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch fixes security gaps, hook bugs and install steps found in a review of assay, and sets the version to 0.3.1.
Security
"sandboxed": falsein--json..envor.git/config, or a file a symlink points to outside the folder. Before this change, a test page could read both and send them anywhere.Hook
hooks.jsonsets a 600-second timeout, and the hook spends at most 540 seconds on checks. Factory Droid and GitHub Copilot CLI cut a hook off after 60 and 30 seconds by default, which lost the report.--one-linekeeps page text on one line, so a page can't add lines to the report an agent repeats.Plugins and docs
codex plugin marketplace add awss1i/assayfailed. It now loads.Checks