diff --git a/BROWSER.md b/BROWSER.md index 071bd5ce3..20ce73954 100644 --- a/BROWSER.md +++ b/BROWSER.md @@ -267,7 +267,7 @@ flow, and a layered prompt-injection defense — all behind a compiled CLI that prints plain text to stdout. ~100-200ms per call. Zero context-token overhead. It runs whenever the probe above does not print `READY`, and `$B` is a legitimate tool in that context; on a Mac with Aside open the skills never -reach for it. +reach for it. Its HTTPS trust has a known gap: see [TLS trust](#tls-trust-the-bundled-chromiums-root-store). --- @@ -311,7 +311,7 @@ $B connect # headed Chromium + Side Panel extension 9. [Side Panel + sidebar agent](#side-panel--sidebar-agent) 10. [Pair-agent — remote agents over an ngrok tunnel](#pair-agent) 11. [Authentication + tokens](#authentication) -12. [Prompt-injection security stack (L1–L6)](#security-stack) +12. [Prompt-injection security stack (L1–L6)](#security-stack) — including [TLS trust: the bundled Chromium's root store](#tls-trust-the-bundled-chromiums-root-store) 13. [Screenshots, PDFs, visual inspection](#screenshots-pdfs-visual) 14. [Local HTML — `goto file://` vs `load-html`](#local-html) 15. [Batch endpoint](#batch-endpoint) @@ -562,7 +562,7 @@ from `snapshot`, or `@c` refs from `snapshot -C`. Full table: |---------|-------------| | `cookie =` | Set cookie on current page domain | | `cookie-import ` | Import cookies from JSON file | -| `cookie-import-browser [browser] [--domain d] [--profile p] [--all] [--clear-storage] [--verify-auth]` | Copy selected browser cookies; picker by default, explicit scoped or all-domain import, optional storage reset and sign-in assertion | +| `cookie-import-browser [browser] [--domain d] [--profile p] [--all] [--clear-storage] [--verify-auth]` | Copy selected browser cookies; picker by default, explicit scoped or all-domain import, optional storage reset and sign-in assertion. The imported session rides on the fallback browser's root store ([TLS trust](#tls-trust-the-bundled-chromiums-root-store)) | | `header :` | Set custom request header (sensitive values auto-redacted) | | `useragent ` | Set user agent (triggers context recreation, invalidates refs) | @@ -673,7 +673,7 @@ pass `--force-restart` to replace it explicitly (see "Daemon lifecycle" above). | Command | Description | |---------|-------------| -| `handoff [reason]` | Open visible Chrome at current page for user takeover (CAPTCHA, MFA, complex auth) | +| `handoff [reason]` | Open visible Chrome at current page for user takeover (CAPTCHA, MFA, complex auth). What you type there trusts the bundled Chromium's root store ([TLS trust](#tls-trust-the-bundled-chromiums-root-store)) | | `resume` | Re-snapshot after user takeover, return control to AI | ### Meta + chains @@ -1296,6 +1296,39 @@ only writer when the chat-path agent was removed, so they reported stale or empty data. The live defenses report through their own call sites. See ARCHITECTURE.md § "Prompt injection defense" for the full threat model. +### TLS trust: the bundled Chromium's root store + +The fallback engine checks HTTPS certificates against the root store built into +its bundled Playwright Chromium. Its default headless browser launches with +Playwright's `--disable-component-update`, so it never receives the CRLSet +revocation updates Chrome pushes to running browsers. Aside uses your own +browser's trust store and updates. + +**Known gap: the compromised eMudhra intermediates +([#3338](https://github.com/garrytan/gstack/issues/3338)).** Chrome blocked +eight eMudhra intermediate CAs by CRLSet on 2026-10-17, the day their key +compromise was reported, and scheduled the removal of their root, emSign ECC +Root CA - G3, from the Chrome Root Store for 2026-10-27. The root store built +into gstack's pinned Playwright 1.62.1 (Chromium 151) still trusts that root, so +the headless browser accepts certificates those intermediates issued. That lasts +until gstack moves to the first Playwright release whose Chromium is +158.0.8115.0 or later, the first Chrome for Testing build measured to refuse +them. Until then, don't do signed-in work in this engine on a network you do not +trust, and prefer Aside for signed-in work where you have it. + +To check a build, run it on a network that does not inspect TLS, because a +captive portal or an intercepting proxy can fail some or all sites with the +same error. Run `$B stop`, confirm in the default headless mode that a +known-good HTTPS site such as `$B goto https://example.com/` loads, then run +`$B goto https://dv-g3b-emudhra.we-have-a-problem.com/`. Only +`ERR_CERT_AUTHORITY_INVALID` there means the root store no longer trusts them. +Any other error proves nothing. + +Caveats that depend on your environment (proxy variables, headed and +per-project profiles, `GSTACK_CHROMIUM_PATH` and `BROWSE_EXTENSIONS_DIR` +builds, and CRLSet timing in headed mode and `handoff`) are tracked in +[#3440](https://github.com/garrytan/gstack/issues/3440). + --- ## Screenshots, PDFs, visual diff --git a/CHANGELOG.md b/CHANGELOG.md index a750e493a..b64f4629b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## [1.91.239.0] - 2026-10-26 + +**BROWSER.md now says that gstack's own browser still trusts the compromised eMudhra intermediates, and how to check (#3338).** Chrome blocked eight eMudhra intermediate CAs by CRLSet on 2026-10-17, the day their key compromise was reported, and scheduled the removal of their root, emSign ECC Root CA - G3, from the Chrome Root Store for 2026-10-27. gstack's default headless browser gets neither: it launches with Playwright's `--disable-component-update`, so it receives no CRLSet updates, and the root store built into the bundled Chromium still trusts the root. On 2026-10-24, `$B goto https://dv-g3b-emudhra.we-have-a-problem.com/` loaded the test page on gstack's pinned Playwright 1.62.1 (Chromium 151.0.7922.34), and Chrome for Testing builds from 158.0.8115.0 fail it with `ERR_CERT_AUTHORITY_INVALID`, so the Playwright bump waits for a release that bundles one of those builds. + +### Changed +- **`BROWSER.md`**: a new "TLS trust: the bundled Chromium's root store" section, at the end of the security stack, gives the warning, the plan (move to the first Playwright release whose Chromium is 158.0.8115.0 or later; until then, no signed-in work in this engine on an untrusted network) and the check: on a network that does not inspect TLS, after `$B stop` and once a known-good HTTPS site loads in headless mode, only `ERR_CERT_AUTHORITY_INVALID` on the test host means a build is fixed. Environment-dependent caveats (proxy variables, profiles, custom builds, headed CRLSet timing) are tracked in #3440. The table of contents, the fallback-engine introduction and the `cookie-import-browser` and `handoff` command rows link to the section. Aside is unaffected, because it is your own browser with its own updates. + +### For contributors +- The edits above the cookie workflow excerpt change no line count, so the `setup-browser-cookies/SKILL.md workflow` judge input is byte-identical (prompt SHA-256 `c851e635…`, 12,805 bytes, before and after). + ## [1.91.238.0] - 2026-10-26 **Five /ship frictions the unattended lanes hit (GSTA-102).** Each fix is one commit. diff --git a/VERSION b/VERSION index f0fd49ce8..eba7262e2 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.91.238.0 +1.91.239.0 diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md index 4e37f81ef..67ef04da7 100644 --- a/agents-digest/gstack-AGENTS.md +++ b/agents-digest/gstack-AGENTS.md @@ -1,4 +1,4 @@ -# gstack digest v1.91.238.0 — regenerate/re-copy after upgrading gstack +# gstack digest v1.91.239.0 — regenerate/re-copy after upgrading gstack Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed for agent hosts without a full skill install. The full skills add workflows, diff --git a/package.json b/package.json index 724e1332f..d3f51e9d3 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.91.238", + "version": "1.91.239", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module",