Skip to content

fix(research): prevent premature completion + security guardrails - #5

Merged
intellegix merged 6 commits into
masterfrom
feature/security-guardrails
Feb 23, 2026
Merged

fix(research): prevent premature completion + security guardrails#5
intellegix merged 6 commits into
masterfrom
feature/security-guardrails

Conversation

@intellegix

Copy link
Copy Markdown
Owner

Summary

  • Add CI workflows, branch protection config, PR security checklist, Dependabot, and CodeQL
  • Fix premature research/labs completion: DOM guard thresholds, growth-polling confirmation, stability layer min-elapsed guard
  • Fix slash command mode preservation during query submission (keyboard.type vs native setter)
  • Add min-elapsed guard to vision path — Haiku was accepting "complete" at ~51s bypassing all CSS fallback guards
  • Double all stability thresholds (2x) as safety margin: DOM guard 240s/360s, stability 240s/300s

Test plan

  • Syntax check passes on both council_config.py and council_browser.py
  • Research query verified: completed at 292.3s (past 240s minimum floor)
  • Vision path logs "ignoring early complete" when elapsed < threshold
  • Labs query verification (6 min minimum floor)

🤖 Generated with Claude Code

Austin Kidwell and others added 6 commits February 23, 2026 08:43
…onfirmation

Previous fix (45s guard + 10s confirm = 55s) matched the exact truncation point.
Perplexity pauses 15-60s between research sections, so the 10s confirm passed
during a pause. Now: 120s DOM guard, 30s growth-polling window (5s intervals),
3000 char minimum, stop button detection, and expanded streaming selectors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…bility thresholds

Layer 3 (text stability) was triggering at 47-66s during Perplexity's
"thinking" pauses between research sections. Root cause: stability had
no minimum elapsed time guard, so 50s of stable text at 3000+ chars
would declare completion while Perplexity was still processing.

Changes:
- BROWSER_STABLE_MS_RESEARCH: 50s → 120s (match DOM guard minimum)
- BROWSER_STABLE_MS_LABS: 60s → 150s
- Layer 3 now requires dom_min_elapsed before trusting stability
- Earliest possible completion is now 120s (research) / 180s (labs)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
page.fill() and native value setters clobber React's internal state,
deactivating /research or /council mode after activation. Replaced
with keyboard.type() which dispatches real keystrokes through React's
event pipeline, preserving the slash command mode flag.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… for modes

Native setter is faster for plain queries. keyboard.type() only used
when a slash command mode (research/labs/council) is active, since
native setter and page.fill() clobber React's mode flag.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…re query

The slash command mode (/research, /council, /labs) is activated and
confirmed before submit_query runs. The native setter (fast paste)
is safe because it only sets query text in an already-activated input.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…holds

Vision path (_wait_vision_research) had zero min-elapsed guard — Haiku
reported "complete" at ~51s and the 2x-consecutive check accepted it
immediately, bypassing CSS fallback guards entirely.

Fix: apply dom_min_elapsed guard to vision path (resets consecutive_complete
counter if elapsed < threshold). Double all stability thresholds (2x) to
prevent recurrence: DOM guard 240s/360s, stability 240s/300s.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@intellegix
intellegix merged commit 40ca35c into master Feb 23, 2026
5 of 6 checks passed
@intellegix
intellegix deleted the feature/security-guardrails branch February 25, 2026 19:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant