From 19e08004433037169a7ce9b8d3bc4ee8c050ce38 Mon Sep 17 00:00:00 2001 From: garrytan Date: Mon, 26 Oct 2026 02:32:03 +0000 Subject: [PATCH] docs: name the update check's conditional compare-API request bin/gstack-update-check also GETs api.github.com's compare endpoint when the remote VERSION equals the local one but main has moved; the README privacy summary and docs/privacy.md now list it beside the ls-remote and VERSION fetch (documentation audit). --- README.md | 2 +- docs/privacy.md | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index abf1177af..f116e276a 100644 --- a/README.md +++ b/README.md @@ -256,7 +256,7 @@ On Windows without Developer Mode (MSYS2 / Git Bash), `setup` falls back to file ## Privacy & Telemetry -gstack sends nothing about how you use it unless you opt in. Telemetry is off by default and asked about once; the update check (two GitHub requests, a `git ls-remote` and a fetch of `VERSION`; with telemetry on it also reports your gstack version and OS; on by default) turns off with `gstack-config set update_check false`; outside reviews send code to Codex or Claude Code under your own login and turn off with `gstack-config set codex_reviews disabled`. Every off-machine send writes a receipt you can audit with `gstack-egress list`. The full account, including the exact fields telemetry carries and the local state that is not telemetry: [docs/privacy.md](docs/privacy.md). +gstack sends nothing about how you use it unless you opt in. Telemetry is off by default and asked about once; the update check (two or three GitHub requests: a `git ls-remote`, a fetch of `VERSION` and, when that version equals yours but `main` has moved, a compare-API call; with telemetry on it also reports your gstack version and OS; on by default) turns off with `gstack-config set update_check false`; outside reviews send code to Codex or Claude Code under your own login and turn off with `gstack-config set codex_reviews disabled`. Every off-machine send writes a receipt you can audit with `gstack-egress list`. The full account, including the exact fields telemetry carries and the local state that is not telemetry: [docs/privacy.md](docs/privacy.md). ## Troubleshooting diff --git a/docs/privacy.md b/docs/privacy.md index 31e49e228..f5e2dc082 100644 --- a/docs/privacy.md +++ b/docs/privacy.md @@ -33,9 +33,11 @@ no, and `gstack-config set telemetry off` turns it off at any time. skill start runs `gstack-update-check`. When its cache is stale (60 minutes after an up-to-date result, 12 hours while an upgrade is pending, 10 minutes after a failure) it asks GitHub for the latest version: a `git ls-remote` of -`github.com/garrytan/gstack` and a GET of the `VERSION` file from -`raw.githubusercontent.com`. GitHub sees your IP address; nothing about you or -your code is sent. With telemetry on, the same check also posts your gstack +`github.com/garrytan/gstack`, a GET of the `VERSION` file from +`raw.githubusercontent.com` and, when that version equals yours but `main` has +moved past your checkout, a GET of `api.github.com`'s compare endpoint for the +two commit SHAs. GitHub sees your IP address; nothing about you or your code is +sent. With telemetry on, the same check also posts your gstack version and OS to gstack's Supabase. Turn the check off with `gstack-config set update_check false`.