Verify harness changes end-to-end without docker — drive the real pinned CLI against a header-capturing stub server with the exact env resolve_auth_env() produces.
インストール方法を見るインストールする前に、エージェントに与えられる指示の中身を確認できます。
The pipeline's real surface is the in-container claude -p process and its
outbound API requests. Without docker, drive the same pinned CLI binary
directly with the env dict the harness would inject via docker -e.
harness/agent_image.py:CLAUDE_CODE_VERSION):
npm install --no-save @anthropic-ai/claude-code@<pin> in a temp dir →
binary at node_modules/@anthropic-ai/claude-code/bin/claude.exe (the
.exe name is the real native-binary entry on Linux too, filled in by the
package's postinstall — not a Windows leftover).invalid_request_error
(non-retryable, so the CLI exits fast; exit=1 is expected).python3 -c "from harness.auth import resolve_auth_env; ..." and dump to
an export-lines file with shlex.quote (values contain newlines —
NEVER pass via env $(...), word-splitting mangles them; source the file).unset ANTHROPIC_CUSTOM_HEADERS (and any
other ambient var not in the resolved dict) before sourcing — a Claude
Code session in this repo injects .claude/settings.json env into shells,
which containers never see.ANTHROPIC_BASE_URL=http://127.0.0.1:<port> CLAUDECODE= IS_SANDBOX=1 timeout 30 <cli> -p hi --model claude-sonnet-4-5 --max-turns 1, then read
the captured JSONL.tests/test_patch.py / tests/test_patch_grade.py need
docker and fail on docker-less hosts — pre-existing, not your change.-e injection leg itself can't be exercised without docker;
it's the same mechanism that carries ANTHROPIC_API_KEY in production..claude/settings.json into a
fresh temp dir and run the host claude from there (with ambient
ANTHROPIC_CUSTOM_HEADERS unset so settings.json is the only source).まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Adapt this C/C++ ASAN vulnerability pipeline to a different vulnerability class, target shape, language, or detection mechanism. Use when the user wants to port, migrate, retarget, customize, or fork the pipeline for something other than C/C++ memory-safety bugs — web apps, smart contracts, deserialization, ML systems, or any other domain.
日本語の概要は準備中です。原文の説明を表示しています。
Proactive threat hunt over web/application logs — no alert in hand. Profiles the corpus, runs a hypothesis-driven hunt loop with a mandatory written ledger, confirms suspects in source, detonates a local PoC, and writes INCIDENTS.json + INCIDENT_REPORT.md. Use when asked to "hunt the logs", "find the campaign", "look for signs of compromise", or "run dnr-hunt". The no-alert entry to the detection & response track; /dnr-respond is the lead-in-hand entry.
日本語の概要は準備中です。原文の説明を表示しています。
Incident response workup for a lead in hand — an alert, an IOC, or a /dnr-hunt finding. Scopes the lead across the logs, verdicts whether the attack succeeded, quantifies blast radius, confirms root cause in source with a local PoC, and writes a proposed (never executed) containment/remediation/recovery plan. Use when asked to "respond to this alert", "work this incident", "how bad is this", or "run dnr-respond". /dnr-hunt is the no-alert entry to the same track.
日本語の概要は準備中です。原文の説明を表示しています。
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, INCIDENTS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified `vuln-pipeline patch` ladder; static-analysis input gets a per-finding patch subagent + independent reviewer and is written as inert diffs for human review. Writes PATCHES/bug_NN/{patch.diff,patch_result.json}, PATCHES.md, and PATCHES.json. Use when asked to "fix the findings", "patch these vulns", "generate fixes", or "close the loop on triage".
日本語の概要は準備中です。原文の説明を表示しています。
The front door for this repo. With no argument: a 30-second intro, then an offer to walk you through your first run on the canary target. With a question: answers it from this repo's own docs and source, cites where it looked, and hands you the next command. Use for "how do I…", "why does…", "where is…", "can this…", or just "/quickstart" to get oriented.
日本語の概要は準備中です。原文の説明を表示しています。
Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available; "bootstrap-then-interview" chains the two when both owner and codebase are present. All write THREAT_MODEL.md in a shared schema. Use when asked to "threat model", "build a threat model", "map the attack surface", or "what should we be worried about in this codebase".
日本語の概要は準備中です。原文の説明を表示しています。