chore(security): add agent verification skill and input dispatch CI guard

[devswha]

Change

Make this repo more agent-trustworthy following Lauren Tan's approach: agents must prove work by running the app; give them a feature map; seal bad shortcuts with mechanical CI checks rather than prose rules.

1. Verification skill (.cursor/skills/verify-herdr-web-ui/)

Teaches agents how to:

• Build and run herdr-web-ui in test mode
• Drive it in a real browser via Playwright/Chrome DevTools Protocol
• Capture evidence (screenshots, console errors, network failures, optionally performance traces)

Reuses the repo's existing browser regression scripts and harness (scripts/ci-browser.sh, scripts/ui-regression.ts, the *-regression.ts scripts) instead of inventing new infra.

Verification of the skill (ran locally):

$ bun run build
$ bun scripts/demo-build.ts "$HERDR_DEMO_BUILD"
$ HERDR_DEMO_BUILD="$HERDR_DEMO_BUILD" bun scripts/settings-pages-demo-regression.ts
PASS fuzzy commands and offscreen keyboard selection (390px)
PASS every Settings page and key bar fit a 390px phone (en); 2189ms
PASS every Settings page and key bar fit a 320px phone (en); 2107ms
PASS every Settings page and key bar fit a 320px phone (ko); 1906ms
PASS every Settings page and key bar fit a 320px phone (ja); 1979ms
PASS every Settings page and key bar fit a 320px phone (zh); 2078ms
PASS Back on a phone leaves the key bar editor...
PASS the Back control in the dialog and the system Back button share one history
PASS the X from the key bar editor and a reload leave no Settings entry
PASS on a desktop Back closes Settings in one step...
PASS a window that changes width with Settings open keeps Back

2. Feature map (.cursor/skills/verify-herdr-web-ui/feature-map.md)

Documents how to reach each major feature with stable selectors/data attributes actually present in the code:

• Routes (/?pane={id}, /?settings, /?new, etc.)
• Keyboard shortcuts (Mod+Shift+K for palette, etc.)
• Data attributes (data-workspace, data-pane, data-status, etc.)
• ARIA labels for getByRole queries
• CSS classes for state
• Viewport breakpoints and phone test viewports
• Wait patterns for WebSocket frames

3. CI guard against input dispatch bypass (scripts/input-guard-check.ts)

Static analysis that fails CI when a new paneSendText or paneSendKeys call bypasses the authorization guard. This pattern appeared in:

• Issue server: queued chat delivery (paste and Enter) skips #624's write-time authority check #666: queued chat messages via dispatchPendingText, fixed by PR fix(chat): steer Claude with Ctrl+Enter, guard pending writes, restore a stopped send #760
• The security model: paneSendText/paneSendKeys accept an optional guard function called right before herdr receives the write; without it, a sender's permission can lapse during Bun.connect() (fix(terminal): recheck the sender's right to type right before herdr is written to #624, server: queued chat delivery (paste and Enter) skips #624's write-time authority check #666, fix(chat): steer Claude with Ctrl+Enter, guard pending writes, restore a stopped send #760)

How the guard works:

1. Scans all server/**/*.ts for paneSendText/paneSendKeys calls
2. Checks if each call passes a guard parameter (4th argument)
3. Allows exceptions for:
   • Test files (run against owned panes)
   • HTTP POST handlers (synchronous request context)
   • prompt.ts (uses its own authorization model)
   • Secret input Enter (server: a secret's authority is not rechecked for a replaced pty or a role switch during the screen read #589: must follow paste immediately)
   • submitText (authorize() called synchronously before each send)
4. Fails with clear error message and fix instructions

Wired into bun run check fast lane.

Tests (scripts/input-guard-check.test.ts):

• Passes when all calls have guards
• Fails when paneSendText is called without a guard
• Fails when paneSendKeys is called without a guard
• Allows unguarded calls in test files
• Reports file and line number of violations

Validation

• bun run typecheck: pass
• bun run build: pass
• bun run test:unit: 2554 pass, 8 skip, 0 fail
• bun scripts/input-guard-check.ts: pass (30 call sites, 10 with guards, 20 in allowed exceptions)
• Demo browser script (settings-pages-demo-regression.ts): all PASS

  

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[devswha]

Closing. The skill doc repeats commands already kept in docs/development.md and AGENTS.md (which ask not to copy them) and assumes a Cursor workspace. The input guard problem is real (#624, #666, #760), but a regex scan with a pattern allowlist is brittle and already allowlists a known unguarded path (submitText). A sturdier fix is to make the guard a required parameter of paneSendText/paneSendKeys so the type checker finds every call, with explicit, explained opt-outs for the HTTP handlers and tests; that can come as its own PR.