xxnbyy 7c217b80b0 fix(security): address issues #97-100 — hooks consent, sanitize, loop escape, privacy disclosure ...

## Issue #97 — Hooks fire without user consent
- PreCompact hook now checks for PUA activation markers before writing files
- Stop feedback hook skips if PUA was never triggered this session

## Issue #98 — Session sanitization incomplete
- Sanitize script upgraded; rate limiting migration added (0003_feedback_rate_limiting.sql)

## Issue #99 — PUA Loop no in-session escape
- Default max iterations changed from unlimited to 30
- Added <loop-abort> (terminate) and <loop-pause> (pause for manual intervention) signals
- Loop hook supports active:false for pause state; session self-binding on resume
- Added /cancel-pua-loop command; guide.html and README updated
- PUA pressure escalation injected per iteration via system message

## Issue #100 — Upload endpoint undisclosed PII
- Privacy/data-usage disclosure added to contribute.html (ZH+EN bilingual)
- Contribute.tsx updated with same disclosure

## Additional fixes
- Rename commands/loop.md → commands/pua-loop.md; add cancel-pua-loop.md
- Replace "Ralph Loop × PUA" with "PUA Loop" across all user-facing docs
- Fix nav active-state highlighting on all sub-pages
- Fix logout button (GET method); redirect to /contribute.html
- Add JA language support to leaderboard.html
- Add "how to find session file" guide to contribute.html
- Unify nav-r gap (1rem) across all pages

Closes #97
Closes #98
Closes #99
Closes #100

2026-03-22 18:54:58 +08:00

..

setup-pua-loop.sh

fix(security): address issues #97-100 — hooks consent, sanitize, loop escape, privacy disclosure

2026-03-22 18:54:58 +08:00