* docs(designs): add fix wave 2026-10-15 plan (revision 3, approved)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(cso): invoke docker as argv0 docker so OrbStack's multicall binary dispatches
executable() returns the canonical path, and OrbStack installs docker as a
symlink to docker-tools, which dispatches on argv[0] and exits 127 with
'unsupported argv0 "docker-tools"'. Every Docker call failed, so doctor
reported local-docker-isolation and every scanner missing and setup could
not preload the qualified images.
runProcess takes an argv0 option; docker.ts routes every Docker call
through runDocker, which passes 'docker'. The native watchdog's execve
calls pass "docker" as argv[0] too, so its container cleanup works on the
same installs. The executed file is still the verified canonical path.
Fixes#3187
* test(cso): cover Docker and watchdog invocation through a multicall binary
A compiled fake that refuses any argv[0] but docker stands in for
OrbStack's docker-tools. Both behavior tests fail on the previous code.
Refs #3187
* fix(cso): bound the argv0 test's socket helper and probe images through OrbStack's multicall docker (#3187)
Follow-up to #3188 by Bryan Stone (@aegixx):
- the python3 spawnSync that binds the fake daemon socket gets a 30 s
timeout; without it test/spawnsync-timeout-tripwire.test.ts fails.
- reviewer test: dockerExactImagePresent, a production probe, admits an
image when the endpoint's canonical executable is a multicall binary
that refuses any argv0 other than "docker". It fails on 47d639a
(returns false) and passes with #3188.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(autoplan): own the conversation after a Claude Code 2.1.300 compaction
Claude Code 2.1.300 keeps a compaction's last records in place and lists
them in compactMetadata.preservedMessages. The segment's tail, which is
also the boundary's logicalParentUuid, is written after the boundary
under the compact summary, so the parent links form a cycle that the
owned causal order never reaches. Every record after the compaction was
dropped, and the publication guard denied each later phase entry with
close_incomplete.
Such a boundary now continues from the last preserved record that is a
node of the file and not its own descendant. Boundaries without that
metadata, with a foreign preserved uuid, or with nothing kept in place
still supply no ownership.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(autoplan): report a compaction-explained unreachable component as unrecognized_shape (#3194)
Follow-up to #3196 by vilano93. After the ownership walk, an owned node
the walk never reached was silently dropped, and the phase guard answered
the next phase entry with close_incomplete, which the user cannot satisfy.
When the unreachable node's ancestry ends in a cycle through a compact
boundary's logical parent, ownedCausalOrder now returns
unrecognized_shape:compaction_unreachable, the guard's existing
unverified disposition (allow with a visible warning and a guard-log
row). Orphans whose ancestor is missing (not flushed yet) and other roots
keep today's behaviour, so the fail-open surface does not widen beyond
compaction. Each node is walked once.
Gate-integrity edit: a close_incomplete denial becomes an unverified
allow for that shape only. Negative controls kept: the existing guard,
hook, guard-reasons and captured-fixture tests still deny (356 pass), and
a new case with the boundary not yet flushed still denies close_incomplete.
Intentional pin changes in #3196's own test file: the three "fails
closed" cases (tail-only segment, missing preserved metadata, foreign
preserved uuid) and the "without compactMetadata" case now expect
unrecognized_shape:compaction_unreachable instead of close_incomplete or
a silently cut transcript.
Reviewer tests: three compactions in one session stay owned and pass the
next phase entry; a 50k-record history with three compactions is decided
in ~300 ms (budget 1000 ms), so descends needs no memo.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* feat(lib): one echo sanitizer for external strings, with a Bash twin
lib/sanitize-echo.ts and bin/gstack-sanitize-echo.sh flatten CR/LF/TAB to
spaces, remove every other ASCII control byte (ESC included) and DEL,
collapse runs of spaces, and cap the result at 200 bytes of valid UTF-8
with no leading or trailing space. Every external string gstack echoes
into a message, a log line or a key=value state file goes through it
(fix wave 2026-10-15, plan rev 3 DX F8). test/sanitize-echo.test.ts runs
both twins on one table under bash, bash --posix and zsh, including a
"\nstages=" injection, ESC sequences and UTF-8 characters cut by the cap.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(bun-version): judge the Bun floor under zsh and hold on an unreadable version (#3195)
Reported by mochafreddo. _gstack_bun_below word-split $_gb_core, which
zsh does not do: `[ -ne ]` errored and every error path read as "not
below", so /gstack-upgrade Step 4 accepted Bun 1.3.2 in a zsh tool shell.
- _gstack_bun_below copies the release's parsed fields into quoted
positional parameters and compares with $((10#...)); no new _gb_*
globals. It returns 2 when either side cannot be parsed.
- gstack_bun_status prints malformed for an unparseable version or floor
(never ok); gstack_bun_incoming_hold holds on it with
bun-version-unreadable: ... (BUN_VERSION_UNREADABLE), the bun path and
its output passed through gstack_sanitize_echo. setup's own malformed
warning is unchanged.
- /gstack-upgrade Step 4 runs the check through `bash -c` and stops on
BUN_VERSION_UNREADABLE with a reinstall fix (never "bun upgrade").
- New result code BUN_VERSION_UNREADABLE with its troubleshooting entry;
bin/gstack-doctor-components.sh regenerated from the table.
test/bun-version-shells.test.ts: one version table (1.3.2,
1.3.3-canary.1, 1.3.3, 1.3.14, 1.4.2, 1.10.0, 01.04.02, 2.0.0, garbage)
drives bash, bash --posix, zsh and the TypeScript twin's below();
`zsh -c '. bin/gstack-bun-version.sh; gstack_bun_status 1.3.2'` printed
ok on 47d639a and prints too-old now.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* style(cso): format #3188's runDocker call so format:cso:check passes (#3187)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(cso): keep scanner JSON reports parseable after redaction (#3185)
Reported in #3185. The scanner path splices redactions into raw JSON, and
redactFindingSpans replaced a bare 10+ digit number
("max_memory_bytes":1145427776, an epoch) with an unquoted marker, so
JSON.parse failed and every non-trivial Semgrep run was INVALID_OUTPUT.
- lib/redact-engine.ts: redactJsonFindingSpans, a string- and
escape-aware lexical tokenizer over one or more top-level values
(NDJSON included). A span inside a number replaces that whole token
(-, fraction, exponent) with the quoted marker, number by number; a
span inside a string keeps the in-string marker, widened to whole
escapes; a span touching several tokens, whitespace, a literal or a
structural character returns null (withhold). Non-JSON text gets the
plain splice. redactFindingSpans is unchanged for every other caller.
- The scan operation's declared format rides the real capture path:
scanner-executor (scan stdout, or the report file read for outputPath
plans) -> DockerGroup.execCapture -> runProcess -> spliceRedaction,
which redacts the concatenated stdout once and maps each interleaved
run onto it. Version probes and stderr stay plain; marker-only
withholding and the cross-stream views check are kept, and the output
is a fixpoint of that check.
Behavior change: a redacted number in a scanner report is now the string
"<REDACTED-...>" instead of an unquoted marker; non-JSON streams keep the
unquoted form (test/cso-eval.test.ts unchanged).
Intentional pin change: test/cso-scanner-release.test.ts pinned the
report read as capture(['/bin/cat', plan.outputPath]); it now pins
capture(['/bin/cat', plan.outputPath], plan.format), so the read also
carries the declared JSON format (stricter, not weaker).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(browse): recover when the last tab is closed outside the CLI
Closing the last tab outside browse (for example, closing the headed
Chromium window) left the daemon wedged: the page 'close' handler removed
the tab and set activeTabId to 0, and executeCommand called
getActiveSession() first, so every later command (goto, status, even stop)
failed with "No active page" until the daemon PID was killed by hand.
closeTab() already opens a blank tab when the last tab closes; the external
close path never did. Add BrowserManager.ensureActiveTab(), which reselects
a remaining tab or opens one blank tab (concurrent callers share one
recovery), and call it before resolving the active session in
executeCommand.
Fixes#3167
* fix(browse): status and stop answer after an external close; recovery says what it did (#3167)
Follow-up to #3179 by aftabkh4n, which reopens a tab on demand.
- BrowserManager.ensureCommandTab runs before every command: status,
stop and restart never open a tab, so a daemon whose browser or context
is gone can still report and be stopped; any other command gets an
active tab. A failed recovery is BROWSE_TAB_UNRECOVERABLE carrying the
restart command (cause passed through sanitizeEcho), and a command that
ran on a newly opened tab prints a one-line warning first.
- server.ts reads the session inside the read and write branches instead
of before dispatch (2223 lines, cap 2224) and exposes browserManager
and handleCommandInternal on __testInternals__ for the dispatch test.
- meta-commands.ts: handleMetaCommand no longer reads the active session
before its switch (only snapshot and resume used it), and status prints
getCurrentUrl() so it works with zero tabs. This file is outside the
lane's listed ownership; no other lane or #3190 touches browse/.
- New result code BROWSE_TAB_UNRECOVERABLE and troubleshooting entries
for it and for the old "No active page" wedge.
Reviewer test browse/test/tab-external-close-dispatch.test.ts drives the
real dispatch in a child process: status, text, goto and stop after an
external close, and the closed-context case. On 47d639a (with only the
test seam added) all five fail with "No active page".
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* docs(troubleshooting): /cso INVALID_OUTPUT on Semgrep reports and OrbStack's argv0 refusal (#3185, #3187)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(session-update): name the reinstall fix when an unreadable Bun holds the auto-update (#3195)
Item 11 makes every caller of gstack_bun_incoming_hold treat a Bun
version it cannot read as a hold (bun-version-unreadable,
BUN_VERSION_UNREADABLE). The session-start banner only knew
bun-too-old, so the new reason fell through to "git pull did not
finish ... gstack is not updating" with a pull-and-setup fix that does
not help.
- bin/gstack-session-update: a bun-version-unreadable banner case with
the reinstall fix and the troubleshooting anchor; the comment that
said a malformed version passes is corrected.
Intentional pin change: test/session-update-stages.test.ts "supported
or unparseable Bun (bun-dev (local build)) proceeds: setup decides" is
split. 1.3.14 still proceeds; bun-dev (local build) now holds with
BUN_VERSION_UNREADABLE, leaves the checkout and setup untouched, and
the banner names the reinstall fix. The fixture installs
bin/gstack-sanitize-echo.sh beside the floor helper, as a real install
of this release does. The new case fails on 47d639a.
Ownership exception granted by the coordinator for Lane A
(bin/gstack-session-update is Lane B's file; PR 1b stacks on 1a).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(session-update): recover a conflicting autostash by its unmerged files
The auto-updater fast-forwards with `merge --ff-only --autostash`. When
the carried-over local edits conflict with the incoming revision, git
2.56 still exits 0 from that merge, pops the edits with conflict markers
into the live checkout, and keeps the stash entry. The recovery only ran
on a non-zero exit with "autostash" in stderr, so on git 2.56 it never
ran: the updater logged UPDATED and ran setup over a half-merged tree,
in the directory Claude Code runs hooks from. When it did run, it had two
more problems:
- `git checkout -- .` refuses unmerged paths ("error: path 'f' is
unmerged", exit 1), so it left the markers in place anyway.
- `git stash drop` dropped stash@{0}, whatever that was. refs/stash is
shared with every worktree of the repository, and when
refs/stash.lock is held git cannot store the autostash at all, so the
top entry can be someone else's.
Now the merge is judged by `git ls-files -u`, whatever its exit code.
On unmerged files after the fast-forward, autostash_recover finds the
autostash commit by the id git prints ("cannot store <id>" first, then
"Created autostash: <id>", with the merge run under LC_ALL=C and
core.abbrev=40). A moved refs/stash is only the fallback. When that id
is not a stash entry, it is anchored under refs/gstack-autostash/<UTC>.
The tree is reset to the fast-forwarded revision, which the hook check
already passed, and the stash is kept. The log line is
AUTOSTASH_CONFLICT_RECOVERED tree_reset=1 kept_stash=<id> kept_ref=<ref>.
The update then continues, so the regenerable patches are re-rendered
and setup runs as for any other move. If the commit cannot be found,
nothing is reset: the markers stay for a person, the run logs
PULL_FAILED, and setup does not run.
Files that are already unmerged before the update, from someone's own
merge, rebase or stash pop, now hold the update with PULL_FAILED
"unmerged files ...". Without that check, the recovery would take them
for its own and reset them away.
core.abbrev=40, not "no": "no" is accepted from git 2.31.0 (its release
notes), and `merge --autostash` exists from 2.27.0, so "no" would fail
every update on git 2.27-2.30.
Files:
- bin/gstack-session-update: autostash_recover, the unmerged-files check
before the merge, the C-locale merge with its stdout kept for the id,
and removal of the old grep-and-drop block.
- test/session-update-autostash.test.ts: 7 cases in a new describe block.
A conflicting pop leaves no markers, keeps the edits and still runs
setup. A user's own stash entry survives. A held refs/stash.lock gets
the edits anchored. With a git whose merge prints nothing, a moved
refs/stash still finds the edits; with the lock held as well, nothing
is reset. Pre-existing unmerged files hold the checkout. A
non-conflicting edit rides over the update (control).
Tests, on upstream 15ebd85cd:
- 5 of the 7 new cases fail against the previous session-update; the
unmerged-files guard and the control pass on both.
- Two mutants are each caught by one new case: dropping the refs/stash
fallback, and resetting when the edits cannot be found.
- session-update-autostash, session-update-stages,
session-update-hook-hold and team-mode pass 63/0 with
`--timeout 60000`. At bun's 5 s default under heavy load (one
reading: load average 169), the three shared files timed out 8 tests
on this branch and 17 with the previous script.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(session-update): trust only git's autostash id; owe setup on a stop
An independent review of the autostash recovery (Codex gpt-6-astra,
high effort, verdict BLOCK high=1 med=2) found three defects on its rare
paths. All three are fixed here, each with a case that failed first.
- [high] The refs/stash fallback could erase local edits. When git's
messages were unavailable, recovery took any change to refs/stash as
its own autostash. refs/stash is shared with every worktree: if a
sibling pushed a stash while refs/stash.lock kept git from storing
this one, recovery took the sibling's entry and reset the checkout,
erasing edits nothing held. Now only git's own printed id counts. A
missing id resets nothing: the markers stay, the run logs
PULL_FAILED. Recovery needs git's messages, so when the temp file for
them cannot be created the update is held before the merge
(HELD temp-file-unavailable), not merged blind.
- [med] A stop after the checkout moved lost the setup it owed. The
failure recorded only the pull reason. Once the person resolved the
conflict, the next check saw an unchanged HEAD and no pending stage,
logged UP_TO_DATE, and never set up the new revision. Now a failure
after HEAD moved records `setup` as a pending stage, retried at once.
The unmerged-files check holds it until the conflict is resolved, and
the pull reason is the stage's reason, so the session-start line says
what to resolve.
- [med] An unreadable index read as "no conflicts". Both `git ls-files
-u` checks discarded the exit status, so a failed read after a
conflicting pop (which git exits 0 for) let setup run over the markers.
Now a failed read stops the update with PULL_FAILED "cannot read the
index", before the merge or after it.
Files:
- bin/gstack-session-update: autostash_recover drops the refs/stash
fallback (and STASH_BEFORE). The temp-file hold. The ls-files exit
status checked at both points. The pending setup stage on a failure
after HEAD moved.
- test/session-update-autostash.test.ts: a shim(fx, name, tool, body)
helper; the fallback case now expects a refusal; the refusal case runs
on through resolution to setup; three new cases (unreadable index
before and after the merge, no temp file for git's messages).
Tests, on upstream 15ebd85cd:
- The 5 changed or new cases failed on the previous commit, each on its
defect: refs/stash trusted and recovered; UP_TO_DATE with no setup
after resolution; UPDATED over an unreadable index, before and after
the merge; a blind merge with no temp file.
- Against upstream's own session-update, 8 of the block's 10 cases fail.
- session-update-autostash, session-update-stages,
session-update-hook-hold and team-mode pass 66/0 with
`--timeout 90000`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(session-update): reap heartbeat and its sleeper on exit
The lock heartbeat subshell left its sleep 300 child orphaned when the
updater exited, so heartbeats accumulated across sessions. Track and
reap the heartbeat job (with a job-table fallback for signals between
fork and $!), give the subshell its own exit trap that kills and waits
its sleeper, and map HUP/INT/TERM to exits so the EXIT trap always runs.
Adds a fixture-driven regression test.
* test(session-update): repin the lock trap and heartbeat to #3191's cleanup shape
Intentional pin change: test/session-update-autostash.test.ts 'reclaim is
TOCTOU-safe' and 'EXIT trap is ownership-checked' pinned the one-line
EXIT trap and the 'while :; do sleep 300; ...' loop that #3191 (Jess
Sullivan) replaces with cleanup_session_update and a 'sleep 300 & wait'
heartbeat. The pins still assert the ownership-checked rm -rf, the EXIT
trap, MYPID, and that the heartbeat is killed.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(session-update): move installs only through gstack-ff-update; extract hooks without tar (#3184)
Item 2 (#3189, #3191 adopted in the previous commits) and item 3 of the
fix-wave plan.
bin/gstack-ff-update <dir> <rev> is now the only code that moves an
install's tree. Inside an install-scoped lock (absolute git common dir,
the updater's TTL and mv-aside reap, a heartbeat reaped on exit) it
captures the working tree and the staged state through private indexes,
carries edits that merge cleanly (as an autostash pop would), lets the
regenerable SKILL.md/sections footprint take the target when it
conflicts, and shelves any other conflicting edit, staged change or
unmerged file into refs/gstack/rescue/<oid> (first parent the pre-update
HEAD, second the staged state; compare-and-create; gstack rescue
identity). The move is a two-way read-tree on the private index, so a
late edit or an untracked file in the way refuses with
autostash-unrecoverable and changes nothing. It sources nothing so the
held-install recovery can fetch it from the new revision.
gstack-session-update calls it instead of merge --autostash, holds a
checkout with unmerged files (unmerged-files:), and names shelved edits
at session start at most once a day with inspect, export-the-delta and
delete commands. The incoming revision is extracted for the hook check
through a private index and checkout-index with core.symlinks=false,
never tar (MSYS tar cannot create connect-chrome before its target), and
the held reason carries the failing command's flattened, control-free
stderr. Held lines print before the stage line, one case per reason
with its anchor, every path shell-quoted, no setup fix while unmerged
files exist. docs/troubleshooting.md gains the held-install recovery
forms (Git Bash, PowerShell 5.1, trial and go-back) and entries for each
new line.
design: kept_ref is refs/gstack/rescue/<oid>, refs/stash is never
touched, the quiet-merge cases become a pre-existing-ref refusal and its
recovery, pre-existing unmerged files are a HELD unmerged-files, and the
git shim pins the real binary through git --exec-path.
Intentional pin changes in existing tests:
- test/session-update-stages.test.ts: printed paths are shell-quoted;
the bun-too-old fix runs gstack-ff-update instead of git pull.
- test/session-update-hook-hold.test.ts: the order pin looks for
'bash "$FF_UPDATE"' instead of 'merge --ff-only'; the
hook-check-unavailable fix no longer recommends git pull --autostash;
installedUpdater copies gstack-ff-update beside the updater.
Reported by wengweiling (#3184).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(gstack-upgrade): Step 4 fast-forwards through gstack-ff-update (#3189)
Item 2 of the fix-wave plan, kept in its own commit so PR 1b can be
rebased onto PR 1a (which edits only Step 4's Bun floor-check line).
Step 4's `git pull --ff-only --autostash` had the same hole the
auto-updater had: a conflicting autostash exits 0 and leaves conflict
markers in the install, and the skill printed FF_OK. It now runs
bin/gstack-ff-update . origin/main after the fetch and the floor check:
exit 0 runs setup (a rescued line is relayed with its inspect, export
and delete commands), exit 4 (not a fast-forward) is the only way into
the gated reset fallback, and any other refusal stops with nothing
changed. The footprint discard moves to the reset fallback, ahead of
its stash, where the warning text already promised it.
Intentional pin changes:
- test/upgrade-template-pins.test.ts: the ff-before-reset pin looks for
'bash bin/gstack-ff-update . origin/main'.
- test/gstack-upgrade-fresh-shell.test.ts: the C9 fence marker is
'bash bin/gstack-ff-update'; the gstack-like fixture ships the bin.
- test/upgrade-setup-recovery.test.ts: the git-path fixtures ship
gstack-ff-update (a stub where git itself is a stub).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(setup.ps1): run under Windows PowerShell 5.1's legacy argument passing (#3130)
Item 4 of the fix-wave plan. Windows PowerShell 5.1 strips the double
quotes inside native arguments, so the bash -c script setup.ps1 handed
Git Bash arrived broken ("unexpected EOF while looking for matching").
The script now holds no double quote: `set -f; IFS=; mapfile -d '' -t
argv < $1; rm -f -- $1; exec ./setup ${argv[@]}` (empty IFS and no
globbing keep $1 and each argv entry whole). That form drops an empty
argument, so setup.ps1 refuses one before anything runs
(SETUP_PS1_EMPTY_ARGUMENT, with its troubleshooting entry).
test/setup-ps1.test.ts runs the adversarial arguments under legacy
passing (pwsh with $PSNativeCommandArgumentPassing = 'Legacy', and
powershell.exe itself on Windows) with a space in TMPDIR, plus the
empty-argument refusal. Intentional pin change: the pinned bash -c
line in "passes arguments NUL-separated through a private file to a
constant bash script" now names the quote-free script and asserts it
holds no double quote.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(setup): register hooks at the $HOME path when CLAUDE_CONFIG_DIR links back to it
A per-session CLAUDE_CONFIG_DIR whose skills symlink to ~/.claude/skills
passed the split-brain guard, so its temporary path was written into the
global settings.json and the hooks broke once the session directory was
removed. Fall back to $HOME/.claude/skills/gstack whenever both spellings
resolve to the same tree.
Fixes#3180
* fix(setup): one sourced helper picks the hook root for setup and gstack-memorable (#3180)
bin/gstack-memorable carried a verbatim copy of setup's old canonical-root
block, so `gstack-memorable enable` under a per-session CLAUDE_CONFIG_DIR
still baked the session path into settings.json after #3181 fixed setup.
The choice now lives in bin/gstack-claude-root.sh
(gstack_canonical_claude_root), sourced by both.
Intentional test changes:
- test/setup-hook-canonical-paths.test.ts: #3181's source-slicing block
test is rewritten to source the helper (with a spawnSync timeout, which
the sliced version lacked and the tripwire flags); the
"honors CLAUDE_CONFIG_DIR" pin moves from setup to the helper, and a new
pin requires both callers to source it. Adds a no-$HOME-install case.
- test/setup-hook-syntax-gate.test.ts: the hook-section slice starts at the
new assignment and the harness sources the helper.
- test/setup-claude-code-migration.test.ts, test/team-mode.test.ts: the
partial-checkout fixtures copy the new helper setup sources.
Reviewer test: gstack-memorable enable under a per-session config dir that
links back to ~/.claude registers the $HOME path (fails on main).
Builds on #3181 by NetrioGit.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(setup): remove 1.31-era unprefixed Cursor skill folders (#3133)
A 1.31 setup run from a checkout under ~/.cursor/skills linked unprefixed
<skill>/ folders there, each holding a SKILL.md symlink into the checkout.
Current setup links gstack-<skill>/ folders, and the retired-skill prune
only looks at gstack-* names, so the old folders stayed: Cursor loaded
autoplan, review and the rest twice, or kept dangling links once the
checkout moved.
Run the Claude flat-name cleanup on ~/.cursor/skills as well. Cursor
installs only gstack-* names, so no prefix gate is needed, and the helper
removes only entries proven to link into gstack (#2119), so user-owned
folders stay. It runs after linking, so a run that fails before the new
links exist keeps the old folders. Reported by @andrewkjankowski in #3084.
Fixes#3133
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(setup): name the skills dir in the flat-name cleanup line (#3133)
`./setup --host cursor` now runs the flat-name cleanup on
~/.cursor/skills as well as ~/.claude/skills, so the "cleaned up old
entries" line says which directory the folders were removed from.
Reviewer test for #3152 (szsunyuan): a real dir whose SKILL.md links into
gstack loses only that link and keeps the user's file; SKILL.md links into
a sibling repo named gstack-fork, a relative link, and a dangling link
outside any gstack checkout are all kept; the printed line names the
removed folders and the Cursor skills dir.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(setup): install Chromium with `bun x`, and name exit 127 for what it is (#3131)
A Bun installed with winget ships no `bunx`, so setup's
`bunx playwright install chromium` exited 127 and was reported as
"offline, proxy, or blocked download?". setup now runs
`bun_cmd x playwright install chromium` through its existing bun resolver
($BUN_CMD), and bin/gstack-browser-ensure runs the bun it found on PATH
with `x`. Exit 127 gets its own text naming the resolved bun, Bun from
bun.sh, and the skip commands for Git Bash and PowerShell; other codes
keep the network hint. New troubleshooting entry:
#chromium-install-exit-127.
Intentional test changes:
- test/setup-playwright-best-effort.test.ts: the installer stub is now a
`bun_cmd()` stub (was `bunx()`), its mark renamed bun-x-called and now
records the args; the block under test calls bun_cmd. New winget-shaped
cases (bun on PATH, no bunx anywhere) run setup's real bun_cmd.
- test/gstack-browser-ensure.test.ts: the fixture is winget-shaped (the
`bun` stub handles `x`, no `bunx` on PATH); the exit-7 pin now reads
`<stub>/bun x playwright install chromium exited 7 (...)`.
--help in gstack-browser-ensure prints the comment header only (3,24p).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(windows): prove setup.ps1 on PowerShell 5.1 and the held-install recovery natively (#3130, #3184)
windows-setup job:
- setup.ps1 joins the path filter (with bin/gstack-ff-update,
bin/gstack-claude-root.sh, bin/gstack-browser-ensure,
docs/troubleshooting.md and test/setup-ps1.test.ts).
- powershell.exe must be Windows PowerShell 5; test/setup-ps1.test.ts runs
with a space in TEMP and must report exactly 4 pass, 0 fail, 1 skip
(the Linux-only missing-prerequisite case).
- A copy of the built checkout under a path with a space installs through
`powershell.exe -File setup.ps1 --host codex`.
held-install-journey job (new, parallel):
- origin's main is this PR's tree on top of the v1.91.101.0 tree
(47d639abf); fix-branch adds one file.
- A prefix-mode v1.91.101.0 install at the runner's ~/.claude path in
three states (clean, dirty-conflicting, already-unmerged), with
auto_upgrade=true and the throttle cleared: the old updater must log
`HELD hook-check-unavailable`; the PowerShell recovery form, read
verbatim from docs/troubleshooting.md and run under powershell.exe,
must reach main with every local edit (only those) in one rescue ref.
The dirty state runs it with its .\setup.ps1; the others replace that
step with a marker.
- The trial and go-back forms move the install to fix-branch (detached)
and back to main.
- Only then a later release whose symlink sorts before its target is
pushed, and the new updater must log UPDATED and reach it.
- Both jobs assert the exact list of cases that ran.
The journey steps ran locally on Linux with pwsh in Legacy argument
mode as powershell.exe, a git exec-path whose ../../../bin/bash.exe is
bash, and a failing tar standing in for MSYS tar (all 9 cases passed);
the windows-latest run itself happens on the PR.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(ff-update): a killed step-4 run fails the status check instead of the type check
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(windows): the held-install job runs without the bun cache step
The cache key line is a secret-scanner false positive on added lines
(env.kv); the fixture's own setup installs its packages either way.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(fixtures): register #3191's heartbeat fixture as free
test/free-fixtures.test.ts failed on the frozen-branch Ubicloud run:
test/fixtures/session-update-heartbeat.sh (adopted with #3191) was in no
paid touchfile and not in FREE_FIXTURES. Its only consumer is
test/session-update-heartbeat.test.ts.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(session-update): leave the bun-version-unreadable banner case to item 11 (PR 1a)
PR 1a owns the bun-version-unreadable hold (BUN_VERSION_UNREADABLE), its
banner case and its troubleshooting entry; this branch is rebased onto 1a.
Drops the case, the docs entry and the banner test this branch had added.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(setup.ps1): resolve Git Bash in the shared order, with GSTACK_BASH as an alias and a BASH_UNAVAILABLE refusal
Follows lib/script-invocation.ts (Lane C, PR 2): GSTACK_GIT_BASH is the
override and GSTACK_BASH its deprecated alias at the same precedence;
when both are set and differ GSTACK_GIT_BASH wins and one warning prints.
An override that does not exist is refused, never skipped. Without one:
the install git --exec-path belongs to (behind a scoop shim, or a
portable Git), the folders around git.exe, %LOCALAPPDATA%\Programs\Git,
%ProgramFiles%\Git, and last a bash on PATH whose uname -s reports MSYS;
WSL's bash (System32, WindowsApps) is rejected. A miss lists every
candidate with its rejection, then the PowerShell user-variable and
~/.claude/settings.json env recipes (BASH_UNAVAILABLE, #bash-unavailable).
test/setup-ps1.test.ts gains a 14-row pwsh-on-Linux table with every
location injected (override, alias, both set, missing override and alias,
scoop shim, per-user, portable and machine-wide Git, MSYS PATH bash, WSL
and non-MSYS rejections, missing); 11 rows fail on main. The rows mirror
Lane C's table in test/script-invocation.test.ts; they are not wired to
it, since that branch is not available here. The Windows job's expected
skip count for this file moves from 1 to 15 (the table is Linux-only).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(setup.ps1): give the empty-argument refusal its result code (SETUP_PS1_EMPTY_ARGUMENT)
Adds the row to lib/result-codes.ts (anchor #setup-ps1-empty-argument,
which setup.ps1 already prints). bin/gstack-doctor-components.sh is
regenerated from the table (generated; resolved by regeneration at merge).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(windows): silence SC2016 on the PowerShell version probe (the $ is PowerShell's, not bash's)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(windows-setup): give tar a POSIX path for the spaced checkout
MSYS tar reads `D:\a\_temp/...` as host:path (rsh syntax) and fails with
'Cannot open: No such file or directory' before setup.ps1 runs. The copy
target now goes through cygpath -u; setup.ps1 still gets the Windows form.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(windows-setup): dereference symlinks when copying the spaced checkout
MSYS tar cannot extract connect-chrome, a symlink that precedes its target
(the #3184 failure mode), so the copy died before setup.ps1 ran. tar -h
stores the target instead.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(windows): one Git Bash resolver for gstack's shebang bins (#3197)
Windows has no shebangs, and gstack had three conflicting bash lookups:
the hooks fell back to a bare PATH `bash` (often WSL's launcher), the
gbrain sync checked three fixed paths, and setup.ps1 walked up from
git.exe. lib/script-invocation.ts is now the only TypeScript resolver:
GSTACK_GIT_BASH (GSTACK_BASH as a deprecated alias, same precedence,
warning when they differ, a missing value refused), bash next to
`git --exec-path` (scoop, per-user, portable Git), the known install
paths, then a PATH bash only when `uname -s` reports MSYS/MINGW. WSL
launchers are rejected unprobed. A miss is BASH_UNAVAILABLE, listing
every candidate with its rejection reason.
Bun-shebang bins run under Bun (process.execPath, or the PATH bun inside
a compiled binary). Hooks' runBin resolves through a state-root cache
keyed by git.exe path and mtime, written by temp file plus rename, so
the hot path spawns nothing extra; the override is never cached.
wtreeFingerprint({cwd, timeoutMs}) returns {tree} | {error, kind} with
GIT_OPTIONAL_LOCKS=0 and 40-64 hex ids; the consumers move next.
Intentional pin change: test/gbrain-spawn-windows-shell.test.ts expects
forward-slashed bash paths (WIN_BASH and the GSTACK_BASH override), the
form the shared resolver returns because Bun's spawnSync on Windows
returns ENOENT for a backslash exe path containing spaces.
The copied-tree adapters in test/timeline-stop-hook-slug.test.ts and
test/plan-tune-cathedral.test.ts list the two modules spawn-bin.ts now
imports; the new fixture is registered in test/helpers/free-fixtures-data.ts. bin/gstack-doctor-components.sh is
regenerated for the new result-code row.
Reported by @exGeni.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(windows): fingerprint and gstack bins through the shared invocation (#3197)
bin/gstack-wtree was spawned by path in lib/regen.ts, lib/gate-diff/git.ts,
lib/restamp.ts and bin/gstack-evidence; gstack-slug in restamp, gate-diff
and evidence; gstack-redact in the pregate secrets check; and a bare
`bash -c` in regen, the lane selection manifest and gstack-evidence run.
On Windows each one failed to launch. All now go through
lib/script-invocation.ts, and each fingerprint consumer keeps its fail
direction while saying why:
- gstack-regen check: incomplete, `cannot fingerprint the working tree
(gstack-wtree exited 1: <helper's own repair>)` instead of
`(gstack-wtree failed)`; write keeps the registry label as its run id.
- gstack-gate-diff: `+nowtree` candidate, with the cause.
- gstack-restamp: RESTAMP_CONFLICT carrying the launch or exit detail
(Windows printed `()` before).
- gstack-evidence: records without wtree (grades STALE) and warns once;
SHA-256 repositories now get a 64-hex fingerprint.
lib/regen.ts keeps a string-returning wtreeFingerprint(repoRoot) wrapper
for lib/pregate/context.ts and lib/pregate/index.ts (files #3190 changes);
item 10b migrates them. test/script-invocation-tripwire.test.ts fails on a
new by-path or bare-bash spawn under lib/, hosts/ or a Bun bin; five sites
outside this change are listed with their owners and may only shrink.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): keep framework route paths from a selection manifest (#3176)
laneFileSet parsed manifest output with `[\w.-]+` path segments, so
`app/(shop)/[id]/page.test.ts` came back as `page.test.ts`. The selected
test then matched no platform lane, its remote receipt obligation
vanished and it fell back to a local run. manifestTestPaths keeps route
segments whole (`(group)`, `[id]`, `[...slug]`, `[[lang]]`, `@slot`,
`$param`, `+page`), reads every path-shaped token on a line (JSON
arrays, quoted, `path:line`, parenthesized), and decides what is a test
file with the import graph's own isTestFile, so a test-file rule change
there (bats, #3177) reaches manifests without a second regex. A manifest
that cannot start is "unknown" (widens), like a non-zero exit.
This is the manifest-parser half of #3176 by @vocodestudios; the
import-graph half (tsconfig aliases, Next.js route mapping) ships in a
separate PR. test/pregate-manifest-paths.test.ts drives the CLI with a
bracketed route test in the fixture's Windows-only lane and asserts its
requires-remote obligation; it failed on main (requires_remote was []).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(windows): windows-pregate-e2e drives the #3197 paths natively
A windows-latest job (Bun 1.4.2) builds a fixture repository and runs
gstack-restamp --dry-run, gstack-regen check and write, gstack-evidence
run and gstack-gate-diff from their TypeScript entry points, asserting a
real tree fingerprint each time; times a question-log hook cold and warm
and checks it cached its Git Bash resolution; and checks that a missing
GSTACK_GIT_BASH refuses with BASH_UNAVAILABLE and lists the candidate.
The journey runs twice: under the runner's Git for Windows and under a
pinned PortableGit 2.56.0.2 (SHA-256 verified), found only through
`git --exec-path`. gstack-pregate run joins it with item 10b. The workflow is registered in
scripts/test-pr-profile.ts FREE_ONLY_PR_FILES (no paid case reads it), recorded
as a non-behavioral HARNESS_VERSION decision in scripts/harness-version.json.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(setup.ps1): resolve Git Bash by the shared fixture table (#3197)
test/setup-ps1.test.ts now drives setup.ps1 through every row of
test/fixtures/windows-bash-resolution.json, the table that pins
lib/script-invocation.ts, instead of a hand-mirrored copy. Two rows
failed and are fixed here:
- an override and alias that differ only in slash direction no longer
print the differ warning;
- the root git --exec-path names is also searched for usr\bin\bash.exe
(Git for Windows on arm64).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(windows): isolate the no-bash case and launch pregate as the product does (#3197, #3176)
windows-free-tests run 38813751242 failed two tests this layer added. Both
were fixture defects on a real Windows host, not product defects:
- gbrain-spawn-windows-shell "returns null when Windows has no bash" stubbed
only `exists`. The resolver's PATH step asks the real Bun.which and found
the runner's MSYS bash, which is correct. The case now also stubs
`which` and `gitExecPath`, so it really means "no bash anywhere".
- pregate-manifest-paths spawned the extensionless bin/gstack-pregate
directly. CreateProcess cannot exec a shebang, so nothing ran and stdout
was "". It now launches through lib/script-invocation's runScriptSync,
gstack's own Windows invocation, so the case runs the manifest lane end
to end on Windows instead of being excluded.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(windows): the missing-bash step survives the refusal it expects (#3197)
GitHub runs `shell: bash` as `bash -eo pipefail`, and the step's own
`set -uo pipefail` does not turn -e off. So when gstack-restamp refused, as
the step expects, `OUT=$(...)` aborted the script before `CODE=$?` and before
any output was printed: exit 1 after 0.5 s with nothing in the log (PR #3209,
job 116729693492). The capture is now `OUT=$(...) && CODE=0 || CODE=$?`.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(pregate): the manifest-lane case expects the host's own remote lanes (#3176)
Once 8b2f297cc made the case run on Windows, windows-free-tests run
38824886195 (shard 4) showed the expectation itself was Linux-only. pregate
owes a lane remotely when its runner platform is not the host's
(lib/pregate/workflows.ts). On a Windows host the fixture's Windows lane
runs locally, and the Ubuntu `free-tests.yml/unit` lane is the remote
obligation; that is the record Windows produced.
The case now derives the owed lanes from the host the same way. On Windows
it also requires `ran: node --test 'app/(shop)/[id]/page.test.js'`: there the
route reaches the local run only through the manifest's whole path. With a
cut manifest path (page.test.js) the local set is empty, checked through
buildContext({ platform: 'win32' }) + selectLanes.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(windows-setup): expect 31 skipped setup.ps1 cases now that the shared table drives it
Layer 2 drives setup.ps1 through the 16 shared rows of
test/fixtures/windows-bash-resolution.json; like the 14 existing resolution
rows they run under pwsh on Linux and skip on Windows. The case list is still
asserted exactly (4 pass, 0 fail, 31 skip).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(ship-measure): give the CLI tests a private HOME (#3162)
Every bun run test left ~/.gstack/projects/ship-measure-cli-*/evals and
sweep-cli-fake-*/evals in the developer's real home, and the free-suite
runner flagged them ("real home changed ... Give the writer a private
HOME/GSTACK_HOME"). ship-measure's diagnostic-dir check calls
getProjectEvalDir(), which builds the eval dir from os.homedir(), and
these two CLI tests passed the real HOME while overriding only the
state root.
Both now set HOME and USERPROFILE to the test's own state dir. The
sweep test also runs on the Windows lane, where os.homedir() reads
USERPROFILE. test/ship-measure.test.ts:79 already gives its config test
a private HOME the same way. getProjectEvalDir() itself is unchanged:
whether eval history should follow GSTACK_HOME is left open in #3162.
Fixes#3162
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(ship-measure): prove the sweep CLI never writes under the parent HOME (#3162)
Reviewer test for #3163 (adopted from y$un_, forrest.sun527): points the
parent HOME at a sentinel with a stub global gstack-slug and asserts no
.gstack dir appears there. Fails on 47d639a (the sentinel gets
.gstack/projects/leaked-slug/evals); passes with #3163.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(redact): isolate fixture git from inherited hooks
Fixture git was spawned with the parent environment, so a developer's
core.hooksPath ran on the local push and rejected it (#2967). The
helper blanks the global and system files and drops GIT_CONFIG_COUNT
and GIT_CONFIG_PARAMETERS. A hooksPath set in the fixture repo still runs.
* test(redact): blank GIT_CONFIG_GLOBAL with /dev/null on every platform (#2967)
Follow-up to #3156 (adopted from Lockyer228): Git for Windows rejects
GIT_CONFIG_GLOBAL=NUL (the repo convention is EMPTY_GLOBAL_GIT_CONFIG =
'/dev/null' in lib/cso/process.ts), so both fixture helpers use /dev/null
everywhere. Reviewer test: a hooksPath in the default global files under
HOME/.gitconfig and XDG_CONFIG_HOME/git/config cannot reject the fixture
push; it fails with the inherited environment (the 47d639a behavior) and
passes with the isolated env.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix: gstack-config compares whole root paths and prints a runnable recovery command
- report_root_disagreement compared word-split values, so two variables naming
the same directory with a space were reported as disagreeing. Compare each
complete value instead.
- The privacy-key recovery hint single-quoted the root and left the script
path bare; an apostrophe or space made it unrunnable. Quote with printf %q.
- On Bash 3.2 (macOS /bin/bash) a failed `.` under set -e exits before the
`||` fallback, so a missing gstack-state-root.sh exited 1 silently and
test/state-root-resolver-failure.test.ts failed there. Check readability first.
- The merge fixture now lives under a path with a space and an apostrophe,
executes the printed command, and asserts same-directory variables agree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(config): pin the %q-quoted recovery command and run it from a spaced install path
Follow-up to #3186 (adopted from davidfragnoli-lang). Intentional pin
change: the fix line's GSTACK_STATE_ROOT='<legacy>' pin becomes the exact
bash printf %q form of the legacy root (the PR loosened it to a prefix
check; this restores an exact pin) and the original test name is kept.
Reviewer test: copy bin/ to a path containing a space and an apostrophe;
the printed fix: command runs cleanly and flips the merged value. Fails on
47d639a (unquoted $_SELF), passes with #3186.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(gstack-gbrain-sync): fail when a star gitignore already ignores the pin
ensureGbrainSourceGitignored appends .gbrain-source even when git
check-ignore already excludes that path. The extra line dirties a
tracked ignore-everything gitignore.
* fix(gstack-gbrain-sync): skip the pin line when git already ignores it
ensureGbrainSourceGitignored asked only for a literal .gbrain-source
line. An ignore-everything star already excludes the pin, and the extra
line left the tracked gitignore dirty.
* fix(gbrain-sync): only a tracked .gitignore can stand in for the pin line
Follow-up to #3178 (adopted from KuroChen). The skip now requires
`git -c core.excludesFile= check-ignore -v` to name a tracked .gitignore
(not global excludes, not .git/info/exclude, not a negation), so a pin
ignored only on this machine still gets the shared line teammates need
(#1384). Tests: the two git init spawns get timeouts (they failed the
spawnSync tripwire), fixtures isolate HOME/XDG_CONFIG_HOME, and the PR's
star-gitignore fixture stages its .gitignore (intentional fixture change:
the contract is a tracked file). Reviewer tests: global excludes only,
info/exclude only, an untracked star .gitignore, and a re-include each
still append; all three fail on the PR head.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(skill-end): log the completion event before the final drain (#3198)
gstack-skill-end drained and pushed before it appended its own completed
timeline event, and gstack-timeline-log backgrounded its enqueue, so a
full-tier end boundary returned with its latest event unpushed. The
completion log now runs before the drain and the logger waits for its
enqueue (one config read and a spool write; it exits early when sync is
off or the session is unattended). Every consent, secret-scan and
queue-lock gate is unchanged; the stale "local-only, never sent anywhere"
comment is replaced.
Patch and regression test from Kkkkkuro (#3198): 2 pass / 5 fail on
47d639a, 8/8 with the fix. Reviewer test: with artifacts_sync_mode off the
completion is written locally with no queue entry and no push.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): map Next.js route paths and tsconfig path aliases to their tests
QUOTED excluded ( ) [ ] +, so a test naming app/(app)/page.tsx in a string
never matched. resolveRef never read tsconfig compilerOptions.paths, so an
import through @/ resolved to nothing. Both were PREGATE_NO_LANE false
negatives in a Next.js App Router repo whose tests did name the files.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): TypeScript alias precedence, relative extends and a no-lane explanation
Follow-up to #3176 (adopted from vocodestudios). Path aliases now follow
TypeScript's choice: an exact pattern, else the wildcard with the longest
prefix, targets tried in order. When the chosen pattern resolves nothing,
every plausible reading (other matching patterns, baseUrl, the repo root)
gains the edge, so uncertainty selects more tests, never fewer. Relative
extends chains are followed up to MAX_TSCONFIG_EXTENDS (4) hops, with
baseUrl and paths resolved against the config that declares them.
Trailing commas are dropped by the JSONC tokenizer (never inside a string)
instead of a whole-text regex.
A touched file with no lane now gets explain lines naming the import
specifiers in test files that resolved to no repo file, any extends hop
that was not followed (with the limit), and the hint to declare the file
under dependencies or report the resolver gap. The lines ride testsFor's
provenance, which lanes already pushes to --explain.
Reviewer tests: overlapping aliases in both key orders, exact vs
wildcard, target fallback, the union case, a two-hop extends chain, a
string containing ',]', and the depth-limit explanation. Five fail on the
PR head; all 12 pass. The manifest-parser half of #3176's follow-up
(lane-selection.ts) ships in PR 2.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(browse): reap PTY children on agent shutdown
* fix(browse): reap a terminal-agent PTY's whole process group at shutdown (#3147)
Follow-up to #3148 (adopted from Y4NN777). The PTY child leads its own
session and process group; its identity (pgid, sid, leader start time) is
recorded at spawn and stays checkable after the leader exits. Disposal
schedules a group reap after PTY_SHUTDOWN_GRACE_MS that, unlike the
direct-child SIGKILL fallback, is not cancelled when the leader exits, and
shutdown reaps every pending group before exiting, so descendants that
ignore SIGHUP no longer outlive the agent. Only proven members are
signalled: same pgid and sid, started no earlier than the leader, and
nothing at all when the leader's PID is held by a process with another
start time. Linux only (/proc); other platforms keep the direct-child
behavior. During the shutdown grace the server answers 503 and no new PTY
is spawned.
Test changes to the PR's own test (intentional): the agent is spawned
with process.execPath and the PTY child traps INT TERM HUP, so the case
proves the SIGKILL fallback instead of passing on the kernel hangup.
Reviewer tests: a HUP-immune grandchild is dead within the grace plus 1 s;
an early-exiting leader's surviving descendant is reaped; a session that
completed before shutdown still has its group reaped; unit cases for a
foreign group and a reused leader PID. All four integration cases fail on
47d639a; three fail on the PR head.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* build(deps): bump the github-actions group with 5 updates
Bumps the github-actions group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |
Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9)
Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333)
Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1)
Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e)
Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: actions/download-artifact
dependency-version: 8.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: actions/setup-node
dependency-version: 7.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: ossf/scorecard-action
dependency-version: 2.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.38.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(model-policy): track the upload-artifact v7.0.2 pin from #3175
Intentional pin change: test/model-policy-workflow.test.ts asserted
actions/upload-artifact@043fb46d…; dependabot #3175 moves the workflow to
cf430e03… (v7.0.2, verified against the upstream tag). The pin tracks the
workflow. #3175's free-tests.yml hunk is left out of this PR (free-tests.yml
is a #3190 file; it is re-bumped in PR 5).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(model-policy): its upload-artifact pin matches the eval workflows' pin
Reviewer test for dependabot #3175: the model-policy workflow's single
upload-artifact pin equals the pin evals.yml, evals-periodic.yml and
windows-free-tests.yml use, so a group bump that misses one workflow (or
the hard-coded pin above) is caught here.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* build(deps): hold Playwright minor/major bumps behind the windowsHide patch (#2923)
Dependabot #2923 bumped playwright to ^1.64.0 and dropped the
patchedDependencies entry keyed to playwright-core@1.62.1, which keeps
windowsHide on Windows (#2160, #1989). The bun ecosystem now ignores only
semver-minor and semver-major updates for playwright and playwright-core;
patch updates still flow. The 1.64 migration (re-key the patch, the
Dia/cookie qualification pins, the arm64 artifact name) is filed with
owner Garry, revisit 2026-11-15. Test fails on 47d639a (no ignore rule).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* docs(readme): drop the stale skill lists users pasted into CLAUDE.md (#3169)
README's install prompt and troubleshooting block each carried a skill
list for CLAUDE.md; both were stale (18 shipped skills missing) and they
disagreed. Claude Code lists installed skills itself, so both now keep
only the /browse rule, and the troubleshooting entry says to delete an
old pasted list. New free test: any comma-separated skill list in
README.md or CLAUDE.md must name exactly the shipped skills (with a
negative control for the detector). Fails on 47d639a; passes now.
Reported by the #3169 issue author. The matching doctor warning for
pasted lists ships in PR 5.
Intentional pin change: test/test-value-bar.test.ts no longer expects the
README skill list to name /test-audit twice; it now expects that list to
be gone (0 occurrences), the registration this commit removes on purpose.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* chore(osv): image-size has a fix; html-to-docx's ^1.0.0 pin blocks it (#2753)
The image-size ledger said no fixed release exists. OSV lists 2.0.3 as
fixed for GHSA-5p2g-fcmc-qvqq and GHSA-w3rx-r6r6-pgpr (checked against
api.osv.dev), but html-to-docx@1.8.0 pins image-size ^1.0.0 and there is
no fixed 1.x, so the fix is a cross-major override. Both entries now say
so and name the upgrade trigger; the 2026-11-30 expiry is kept. New test
checks the wording and that bun.lock still shows the stated pin (it fails
on 47d639a). Correction first raised on #2753 by sonukapoor.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* feat(ios-qa): forward GSTACK_IOS_LAUNCH_ENV to devicectl launches (#1796)
Reimplements only the launch-environment half of #1796 (credit
Bmathews721; the session-cache half is superseded by #3132's design and
had state-root and symlink-write problems). devicectl.ts parses
GSTACK_IOS_LAUNCH_ENV as a JSON object of string to string;
launchEnvArgs() returns the --environment-variables argv (empty when
unset or {}) and launchApp passes it before the bundle id. Invalid JSON, a
non-object, a non-string value, a bad name or a key in the debug bridge's
reserved GSTACK_ namespace refuses before any launch with the new result
code IOS_LAUNCH_ENV_INVALID (the detail names keys and types, never
values). launchEnvArgs is exported for the forced-relaunch path in
tunnel-bootstrap.ts.
Adds the result-code row (bin/gstack-doctor-components.sh regenerated by
gen:skill-docs), a troubleshooting entry under its exact text, the
pregate-no-lane entry's explain note, and the how-to section with an
example. New test fails on 47d639a (module load: no parseLaunchEnv).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(deps): declare sharp and clear two transitive advisories
sharp is imported in four files, including browse/src/screenshot-size-guard.ts,
and test/dependency-security.test.ts asserts a >=0.35.4 floor on it and loads
it. It was declared in no dependency field, reaching the tree only through
@huggingface/transformers with the overrides pin forcing the version. Declare it
at ^0.35.4, matching the floor that test already asserts.
Upgrade @huggingface/transformers to ^4.3.0, which clears sprintf-js@1.1.3 and
aligns the sharp override with what the parent declares: 4.2.0 declared
sharp ^0.34.5 while the override pins 0.35.5, which is outside that range, and
4.3.0 declares ^0.35.4.
Upgrade @anthropic-ai/claude-agent-sdk to 0.2.141, which clears
@anthropic-ai/sdk@0.81.0.
The existing overrides entry for sharp is left in place.
* test(deps): sharp is declared and its override satisfies every asking range
Reviewer test for #3145 (adopted from sonukapoor): sharp must be a
declared dependency, and the pinned overrides.sharp must satisfy both
that declaration and every lockfile package that depends on sharp
(@huggingface/transformers included). Fails on 47d639a (sharp not
declared; transformers 4.2.0 asked for ^0.34.5 against a 0.35.5 pin).
Classifier smoke on the changed tree (transformers 4.3.0,
onnxruntime-node 1.30.0, sharp 0.35.5, claude-agent-sdk 0.2.141): the real
sidecar entry bundled for Node with a private state root, and the
classifier in-process under Bun, each downloaded the TestSavantAI model
fresh, reported testsavant: ok, and returned scores identical to
47d639a's tree on five inputs, including a >512-token input that
exercises the truncation override. dependency-security, deps-smoke,
overlay-sdk-cancel-eof, security-classifier and screenshot-size-guard
pass; typecheck:test reports no new diagnostics.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(gbrain-sync): the no-bash skip names GSTACK_GIT_BASH and how to set it (#3197)
The brain-sync stage's Windows skip line told users to set GSTACK_BASH.
After the fix wave the canonical override is GSTACK_GIT_BASH, with
GSTACK_BASH as a deprecated alias (plan correction 9). The summary is now
the exported NO_BASH_SUMMARY: it names GSTACK_GIT_BASH first and GSTACK_BASH
as the old name, and gives the two recipes that reach Claude Code (a
PowerShell user environment variable plus a Claude Code restart, or the
"env" block of ~/.claude/settings.json).
Minimal on purpose: once PR 2 lands, this switches to
lib/script-invocation.ts noBashMessage(). Until then lib/gbrain-exec.ts
still reads only GSTACK_BASH, so this line is accurate only with PR 2
merged first.
New test test/gbrain-sync-no-bash-message.test.ts fails on the previous
commit (NO_BASH_SUMMARY not exported) and passes now.
Handoff from Lane C (PR 2).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(ios-qa): the forced relaunch carries GSTACK_IOS_LAUNCH_ENV too (#1796)
bootstrapTunnel's relaunchApp (an app whose boot token an earlier daemon
consumed is relaunched once with --terminate-existing) built its own
devicectl argv and dropped GSTACK_IOS_LAUNCH_ENV, so an env-gated debug
bridge vanished after the one relaunch the howto says carries it. It now
uses launchEnvArgs(); an invalid value refuses the relaunch with
launch_failed and the IOS_LAUNCH_ENV_INVALID detail before anything is
terminated.
Two new tests in ios-qa/daemon/test/devicectl-launch-env.test.ts drive
bootstrapTunnel through a consumed-token device: both fail on the previous
commit (relaunch argv lacks --environment-variables; the invalid value
still terminates and relaunches) and pass now. ios-qa daemon: 167 pass.
tunnel-bootstrap.ts was assigned to Lane D by the coordinator for this fix.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* ci(version-gate): check the version queue only on PRs into main
Stacked layer PRs carry no VERSION stamp by design (the release layer stamps
once), so the queue check failed on any layer touching package.json. The
queue and its collision rule only describe main; a PR into main is still
checked exactly as before.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(browse): scope the SIGTERM PTY-reap case to POSIX signals (#3147)
windows-free-tests run 38813751242 (shard 6) failed "SIGTERM reaps every
active PTY child before terminal-agent exits" with "timed out waiting for
pty-child.pid", serially and on retry.
Diagnosis: invalid test expectation on Windows, not an agent defect the
test can observe. The contract under test is the agent's graceful
shutdown, its process.on('SIGTERM'/'SIGINT') cleanup in terminal-agent.ts.
On Windows, Bun's subprocess.kill('SIGTERM') is libuv's TerminateProcess,
so that handler never runs there; and the PTY fixture is an extension-less
`#!/bin/bash` script, which CreateProcess cannot launch, so the child never
starts (the timeout is at the pid file, after the port, token, grant and
WebSocket all succeeded). The file's other integration cases were already
Linux-scoped; this one now skips only on win32 and still runs on Linux and
macOS. The pure ownership unit tests in the file keep running on Windows.
Open, not covered by any test: whether a ConPTY child outlives a
hard-terminated agent on Windows. Testing it needs a Windows-launchable
terminal fixture, which BROWSE_TERMINAL_BINARY (one executable, fixed argv)
cannot express without a product change.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(plan-review): bound the native outside voice without TaskOutput (#3182)
Claude Code 2.1.277 removed TaskOutput, so the plan-review native fallback's
preflight always failed and users without the Codex CLI never got a second
voice. The fallback now uses primitives the host still enforces: a background
`sleep 300` Bash timer (its exit re-invokes the parent; the 2.1.300 sleep block
applies only to foreground commands), a background Plan dispatch whose
completion arrives as a <task-notification>, and TaskStop for whichever task
loses. Only a matching completed notification that beats the timer counts;
interim ("is waiting on its own background work"), turn-limit, foreground and
late results get no credit. The "[Subagent hand-back]" header (2.1.277) is
treated as framing.
The unavailable line now names its cause and fix, ends with
OUTSIDE_VOICE_UNAVAILABLE (new result code + troubleshooting entry), and the
review-log row carries unavailable_reason. The bounded-wait prose was
tightened so plan-ceo-review and plan-eng-review stay under their existing
size ceilings (no ratchet raise for this item).
Intentional pin change: test/run-in-background-guidance.test.ts
hasBoundedOutsideVoiceWait and the dispatch-contract cases now pin the
timer/notification/TaskStop contract instead of TaskOutput's envelope.
bin/gstack-doctor-components.sh is regenerated from lib/result-codes.ts.
Reported by HuellintonMota in #3182.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* feat(bin): gstack-ceo-plan-find locates the CEO plan for a branch (#280)
/plan-ceo-review saves its scope decisions under the state root's
ceo-plans/, but no plan review can find them: only /design-html reads
that directory, newest file first. This helper is the CEO-plan sibling of
gstack-design-doc-find, so /plan-eng-review can call one command instead
of a glob in prose.
It prints the newest top-level plan whose "Branch:" header names the
branch, compared the way gstack-slug writes BRANCH (feat/x matches
feat-x), else the newest plan, else nothing. Subdirectories are not
read. A usage error exits 2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(plan-eng-review): read the CEO plan in the Design Doc Check (#280)
/plan-eng-review never looked in ceo-plans/, so an eng review after
/plan-ceo-review ran without the scope that review accepted, deferred or
skipped. capy-ai closed#414 asking for this focused fix, and TODOS.md
scopes it as a gstack-ceo-plan-find sibling of gstack-design-doc-find.
The Design Doc Check now prints "CEO plan found: <path>" or "No CEO plan
found" after the design doc line, and the prose says what to read the
plan for. The data-not-instructions rule names the CEO plan too, since
another agent may have written it. Only plan-eng-review changes: the
shared {{DESIGN_DOC_DISCOVERY}} block and the branch-scoped review log
are untouched. Reported by @chancheuklap in #280.
main left plan-eng-review 4 bytes under its parity cap, so the +325
bytes raise maxSizeRatio to the measured 1.2196, noted the way earlier
growth was.
Fixes#280
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(plan-eng-review): disclose a CEO plan borrowed from another branch (#280)
Review changes on top of #3159 (szsunyuan / y$un_):
- gstack-ceo-plan-find keeps stdout a bare path or empty; when it falls back
to another branch's plan it prints one stderr line,
"CEO plan found (from branch <b>, not <current>): <path>", with control
characters stripped from the plan header ("unknown" when it has none).
- The Design Doc Check tells an interactive reviewer to ask before using such
a plan, and a spawned session to use it and quote the disclosure.
- The Design Doc Check prose is tightened so plan-eng-review fits the
owner-approved 1.2196 ceiling (measured 151,950 / 124,597 = 1.2195).
Reviewer tests: test/ceo-plan-find-cross-branch.test.ts (5 of 7 fail on the
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
#3159 head). The design-doc finder's matching disclosure stays deferred.
* fix(test): credit abutting section chunks whose edge bytes repeat (#3182)
detectSectionReads trims the longest suffix/prefix overlap between
consecutive Bash outputs. Two chunks that abut exactly (tail -c +N after a
chunk ending at N-1) can share an edge byte by chance; the trim then drops a
real byte and a fully printed section reads as incomplete. #3182's
review-sections edit moved plan-ceo-review's 66,999-byte boundary onto
"cur|rent", which turned the existing byte-range test red. The detector now
also checks the plain concatenation; a gap still refuses.
Detector/fixture defect, not a product change. New regression case in
test/section-capture-native-tools.test.ts fails without the fix.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* docs(changelog): fix wave 2026-10-15 release notes
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* v1.91.104.0 fix: the 2026-10-15 issue wave
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(qa): probe each documented input rule, not only its boundary values
The paid gate's qa-functional-cli-report run (38829994639) probed zero and an
unsafe integer but never a non-digit amount, so it missed the planted
parseInt defect ("Amounts contain only ASCII digits") and reported no
defect. The functional contract map's invalid-input row now asks for one
probe per documented input rule (allowed characters, format, sign, range,
arity).
test/qa-functional-prompt.test.ts replays a captured CI Read of
system-functional.md; its completed-method variant now feeds the current
section bytes, so the validator check keeps its omitted/pending negative
controls without pinning the old wording.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* v1.91.106.0: restamp the fix wave above v1.91.105.0
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(release): keep the wave's dependency bumps through the main merge
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: Bryan Stone <aegixx@gmail.com>
Co-authored-by: vilano93 <244097767+vilano93@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: aftabkh4n <akobkz@gmail.com>
Co-authored-by: Benjamin D. Smith <benjamin.smith@binarysword.com>
Co-authored-by: Jess Sullivan <jess@sulliwood.org>
Co-authored-by: NetrioGit <5wngh@naver.com>
Co-authored-by: y$un_ <forrest.sun527@gmail.com>
Co-authored-by: Lockyer <135391289+Lockyer228@users.noreply.github.com>
Co-authored-by: davidfragnoli-lang <249433777+davidfragnoli-lang@users.noreply.github.com>
Co-authored-by: KuroChen <kurochen_macmini@KuroChendeMac-mini.local>
Co-authored-by: AV <vo.quanganh@gmail.com>
Co-authored-by: Y4NN777 <171065166+Y4NN777@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sonu Kapoor <sonukapoor@gmail.com>
* feat: add optional Memorable workflow memory
(cherry picked from commit 6bd5d477b2)
* fix: refuse the second registration, and say what leaves the machine
Two things the first cut got wrong.
Memorable's own installer registers the same UserPromptSubmit hook, under its
own name and outside gstack's table. `memorable start`, `memorable setup` and
`memorable install-hooks` all do it, and that is the documented way to install
the CLI, so on most machines it is already there before gstack is asked.
Registering ours beside it ran the same command twice on every prompt: context
injected twice, and the session captured twice against the user's own
extraction allowance. `enable` now looks for it and refuses, naming the entry
and the file it lives in; `status` says who registered it rather than reporting
none. Matched on the command rather than on a tag, for the reason the hook
table already gives: Claude Code rewrites settings and private tags do not
survive it.
The removal instruction says to delete the entry by hand because Memorable has
no command that removes its own hook. `uninstall-hooks` is not a command in
0.5.18; it answers "unknown command".
The README said "Memorable, not gstack, owns the captured data and any network
access", which answers the question by pointing away from it. It now carries a
per-command table of exactly what leaves the machine, in the shape the adopted
gbrain section uses, and it is explicit that the hook makes no network call of
its own, that every row is the third-party CLI acting under its own consent,
and that `gstack-egress` will therefore not show any of it. Under it, the split
between what gstack pin-tests (the gating and the wiring) and what is
Memorable's claim (storage, sending, and what disable and forget erase).
The CHANGELOG entry is removed. This file has never carried an [Unreleased]
heading; every entry is a version and a date, written at release. The text is
in the pull request for whoever cuts the next one.
Three tests added: enable refuses and touches neither consent nor settings when
Memorable already holds the hook, status names that registration, and a foreign
UserPromptSubmit hook is not mistaken for Memorable's.
(cherry picked from commit e0899afa8c)
* docs: a guide for the Memorable bridge, in the gbrain-sync shape
README carries the section and the egress table; this is the page it links to
for anyone who wants the whole thing. Same shape as docs/gbrain-sync.md, which
is the closest thing in the repo: an optional integration whose interesting
questions are all about what leaves the machine and how to turn it off.
What it covers that the README cannot at that length: that the hook sees every
Claude Code prompt rather than only the ones a skill produced; that capture is
a separate consent from this bridge, so turning the bridge off does not turn
capture off; what to do when Memorable has already registered the hook itself,
which is the common case because its own installer does it; and why the hook
has no loud failure path.
The egress table is repeated here rather than linked, because the sentence it
is answering ("what does this send") is the one somebody arrives on this page
already asking.
Co-authored-by: Advaiyt Sane <advaiyt.sane@gmail.com>
Co-authored-by: Nikhil Krishnaswamy <krishnaswamynikhil@gmail.com>
(cherry picked from commit 5c108cc0f7)
* feat(settings-hook): identity-aware remove-source + read-only list-items
remove-source used to inspect only entries still carrying the
_gstack_source tag. Claude Code strips that tag when it rewrites
settings.json, so an off switch built on remove-source alone silently
no-oped on exactly the entries it was written for. Removal is now driven
by KNOWN_HOOKS identity for the requested source (tagged or not), keeps
the tagged-single-item legacy-stray rule, never touches another source's
items, and leaves entries with nothing of ours byte-identical.
list-items is the read-only view of the same identity table: one JSON
string literal per matching hook command, filters (--owned-by,
--command-regex as a JavaScript RegExp) applied inside the JS, empty
stdout for no match, and the mutating verbs' exit codes (1 usage, 3
unparseable settings, 4 unexpected shape) so callers can decide
mutations from its output without parsing raw command strings.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* feat(config): memorable_recall consent key (on|off, default off, reject-and-preserve)
The gstack-side gate for the Memorable UserPromptSubmit bridge. `on` lets
a Claude Code hook hand every prompt to a third-party binary, so the key
follows the codex_reviews rule: an invalid value is rejected and the
stored value kept, never coerced in either direction. Registered in all
four places gstack-config keeps in sync (annotated header, DEFAULTS
table, the set validator, and both enumeration loops). Memorable's own
capture consent (`memorable enable`) is a separate thing gstack never
sets.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* feat(hooks): memorable-user-prompt-hook.ts — consent gate, deny veto, HIGH-tier pre-scan, fail-closed receipt, trust envelope; runExternal in spawn-bin
The PR's hook exec'd the vendor binary with the full environment and
passed its stdout to Claude verbatim. It is now the house pattern: a
fail-open bash shim over a .ts twin that (1) gates on the memorable_recall
consent key, (2) skips repos whose trust policy is deny or read-only,
(3) scans the prompt (raw bytes and decoded string leaves) and refuses to
hand over a HIGH-tier credential shape, (4) writes a fail-closed egress
receipt naming the local executable it ran, (5) spawns the vendor in its
own process group with an allowlisted environment and group-kills it on
timeout, (6) accepts only a string additionalContext back, caps it at
8 KiB on a UTF-8 boundary and wraps it in the trust envelope, and (7)
records an `output-written` outcome after the stdout write completes.
One deadline clock (4.5 s) undercuts Claude Code's 5 s kill and bounds
both ledger writes through the new lockBudgetMs option on
writeReceipt/writeOutcome (default unchanged).
spawn-bin gains runExternal for external executables (detached group,
stderr drained, stdin EPIPE handled, stdout capped, win32 refused).
The wiring test pins the sink fail-closed and sweeps hosts/.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(gstack-memorable): canonical hook path, no vendor consent, --timeout 5, identity-based status, verified disable, lifecycle lock
enable used to bake the hook path from whatever tree the CLI ran in and
to run the vendor's own `memorable enable` (its consent for storing AND
uploading session traces) before registering anything. It now resolves
the canonical install like setup does and refuses when that install does
not carry this bridge (version and hook-twin check), registers through
the canonical hook manager with --timeout 5, records gstack's own consent
in memorable_recall, never executes the vendor, and restores the captured
prior state if consent cannot be recorded. disable flips the gate first,
removes the entry by identity (tag or no tag), verifies both states and
reports partial failure instead of a blended success. status reads only:
resolution path, gate, registration by identity (gstack / vendor-own /
both / unknown), mismatch lines, receipt count, recent hook errors. enable
and disable serialise under a lock with stale takeover. Windows is
refused (TODOS.md D21). Exit codes mirror the hook manager (3/4/5).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(setup): --no-team sweep keeps the opt-in gstack-memorable hook
`./setup --no-team` finishes its teardown with `prune-stale --all`, which
removes every KNOWN_HOOKS item. The Memorable bridge hook is a
user-registered opt-in unrelated to team mode, exactly like verify-gate,
so it joins the sweep exclusion list. The verify-gate pin now accepts the
comma-extended list; a schema-aware case proves the exclusion keeps both
opt-ins (tagged or tag-stripped) while the uninstall sweep still removes
them.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(uninstall): named gstack-memorable arm, vendor-consent notice, honest kept config
The identity sweep already removed the Memorable bridge hook as an
unnamed stray. It now has a named arm like every other source, so the
summary says what went, and says plainly that Memorable's own consent
(if the user granted it) is theirs to revoke. Under --keep-state the kept
config is set memorable_recall=off so it never claims a hook that is
gone. The canonical-paths pins cover the sixth KNOWN_HOOKS row and the
new uninstall source.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* feat(egress): memorable-recall row in gstack-egress grants
`gstack-egress grants` promises every standing consent in force with the
command that revokes it. The Memorable bridge's memorable_recall key is
one, so it gets a row: off by default, granted only when
`gstack-memorable enable` set it, revoked by `gstack-memorable disable`.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(memorable): accurate bridge guide; README row, Docs table, privacy pointer; PROJECT_STRUCTURE
The README section becomes one row in the Standalone binaries table (the
shape every other binary uses) plus a Docs-table row and one Privacy
bullet saying that optional third-party bridges are off by default and
receipted. The guide now separates the two consents, says what gstack
hands to the vendor binary and what the receipt can and cannot attest,
attributes every statement about the vendor's network activity to the
vendor, describes the hook manager accurately (identity via KNOWN_HOOKS,
list-items vs list-sources, rollback is whole-file), states the Claude
Code hot-reload behaviour, adds a troubleshooting runbook, and keeps the
contributors' credit in the CHANGELOG idiom.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* chore(todos): Memorable bridge follow-ups
Filed from the CEO and eng reviews of the bridge fix-up: the generic
third-party hook seam, Windows support (deferred whole), the envelope
kind parameter, a vendor payload-minimization contract, a latency and
timeout revisit, resolver and canonical-root consolidation, a
non-interactive MEDIUM-tier redaction policy for hooks, and adopting
list-items at setup's plan-tune check.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(settings-hook): list-items --owned-by with --command-regex intersects
When both filters are given, an item must satisfy both: owned by the
requested source AND matching the pattern. Before, the regex branch
skipped every owned row, so the combination could never match.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(gstack-memorable): compat_check reads list-items output before grepping
Under pipefail, piping the probe straight into grep -q let a non-zero
probe exit mask the match, so a hook manager without list-items was
sometimes reported as compatible. Capture the output, then grep.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: coverage for the memorable bridge (remove-source regression for every KNOWN_HOOKS source)
- settings-hook: identity removal pinned for each source in KNOWN_HOOKS;
list-items unknown flag and combined --owned-by/--command-regex
- gstack-memorable: enable/disable failure paths (lock give-up exit 5
with the test-only lock timeout override, consent-write failures
guarded by canRevokeWrites, canonical-version mismatch, no-bun status)
- hook: non-object JSON, missing cwd, non-ASCII bytes, held-open stdin,
shim without bun, stripControl, resolveVendor, runExternal ENOENT
- egress-receipt: lockBudgetMs 0 and writeOutcome on garbage input
- uninstall: no memorable entry present reports nothing removed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(memorable): gbrain backend note and the settings-rewrite race
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* perf(redact-engine): line/col by binary search over a per-scan line index
lineColAt walked the input from offset 0 for every finding, so a match-dense
input (a pasted log full of emails and IPs) cost O(findings x bytes): 128 KiB
took ~400 ms and 900 KiB tens of seconds. The line starts are now indexed once
per scan, on the first finding, and each finding is a binary search.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* feat(gbrain-repo-policy-client): repoPolicyTier accepts a spawn timeout
The policy script spawn was fixed at 10 s, more than twice the memorable
hook's whole budget. Callers on their own deadline pass what they can afford;
a timeout reads as unreadable and polarity stays the caller's.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(spawn-bin): runExternal resolves on the child's exit, keeps stdin errors advisory
- A vendor that exits 0 but leaves a background child holding its pipes was
held to the deadline, group-killed and reported as a timeout with its
answer dropped. 'exit' now starts a short stdout drain, then resolves with
the real exit code and kills whatever still holds the group.
- EPIPE on the child's stdin (it answered before reading a large input) is
reported as stdinError, separate from error, so a delivered answer is not
classified as a spawn failure.
- Stdio streams are destroyed and the child unref'd on resolve so a straggler
cannot pin the hook process; tail/grace/drain sizes are named constants.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(hooks): memorable hook closes the review army's gaps
- Vendor failures are logged even with empty stderr (a silently hanging
vendor taxed every prompt invisibly); the stderr tail is withheld when the
redaction engine finds a credential or PII shape in it; hook-errors.log is
created 0600.
- Trust-policy veto fails closed when git cannot run or answer in time (it
read as 'no remote' before); the policy script spawn is bounded by the
hook's clock; a payload cwd that is not a directory falls back.
- Each secret scan is admitted by the deadline clock (the engine's cost grows
with match density); stdin is decoded once.
- The pre-spawn gate re-check logs a config failure instead of swallowing it;
an incomplete stdin read is named as such, not as 'not JSON'.
- Carriage returns are stripped with the other controls.
- The vendor env allowlist adds the standard proxy, TLS and XDG variables so
a vendor behind a corporate proxy or private CA still reaches its service.
- A stdin EPIPE on a delivered answer is recorded in the outcome, not treated
as a spawn error.
- Stage caps and the truncation marker are named constants; a test-only
GSTACK_MEMORABLE_TEST_BUDGET_MS can shorten (never widen) the budget.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(gstack-memorable): lock staleness from the directory mtime; honest messages
- A contender that looked between the holder's mkdir and its ts write read a
missing ts as 0, called the lock stale and reclaimed it; staleness now comes
from the lock directory's own mtime (the settings-hook idiom).
- The ensure-event failure is no longer labelled 'warning'; the consent-write
rollback message says what was actually kept; a removal that left no entry
is reported on stdout, not as an error; receipts are counted from the
filtered JSON array, not a formatting artefact; the resolution order and
lock tuning are named once.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(uninstall): memorable_recall goes off whether or not state is kept
gstack-config resolves its root through GSTACK_STATE_ROOT/GSTACK_HOME, which
can differ from the STATE_DIR uninstall removes; a full uninstall could leave
memorable_recall=on in a config that survived. Flipped only when currently on.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: pin the review-army fixes for the memorable bridge
Nonce-scoped orphan checks (the system-wide ps grep could see another
shard's sleeper); exit-with-lingering-grandchild; advisory stdin EPIPE;
withheld stderr; vendor timeout logged with empty stderr; CR stripping;
budget seam; rate-limit expiry and 0600 log; unreadable policy store fails
closed; file-as-cwd fallback; mtime-based lock staleness and the mkdir gap.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(memorable): vendor environment allowlist and stderr policy; two follow-ups
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(hooks): memorable hook second-pass review fixes
- Trust-policy lookup fails closed on any git failure that is not 'no such
remote' or 'not a git repository' (a corrupt or unreadable .git/config and
dubious ownership exit 128 and used to read as 'no remote').
- pickAdditionalContext takes the first complete top-level JSON object, so a
vendor whose background helper appends a line to stdout (or prints a banner
first) does not lose its answer.
- The hook-errors.log rate limiter keys on a stable string (a vendor's
timestamped stderr no longer defeats it); the log is chmod 0600 on every
append because sibling hooks create the same file without a mode.
- Scan admission is sized by payload bytes (scan() is uninterruptible).
- The receipt payload class is a stable token; the prose moved to the docs.
- Header, constants and comments match the behaviour (silent skips vs logged
refusals; HIGH/MEDIUM withholding; STAGE_CAP_MS scope; runExternal in the
spawn-bin header; the ledger lock budget doc).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(gstack-memorable): stale-lock takeover by atomic rename; comments match behaviour
Two contenders that both saw a stale lock could both reclaim it with rm -rf;
the settings-hook idiom (mv to a private name, exactly one winner) is used
instead. The hook-manager fallback comment now says every verb falls back.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: second-pass coverage for the memorable bridge
Policy lookup outcomes (plain dir, repo without policy, corrupt .git/config
fails closed); repoPolicyTier timeoutMs; line/col at line starts, after blank
lines, CRLF and first char; tolerant first-JSON-object parsing; keyed rate
limit; uninstall never creates a config just to say off and flips consent in
a GSTACK_STATE_ROOT outside the removed state dir.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(memorable): silent skips vs logged refusals; payload class token; D21/D24 anchors
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(hooks): memorable hook survives host termination and brace-bearing banners
- The bash shim runs bun as a job and forwards SIGTERM/SIGINT/SIGHUP (bash
holds a signal until a foreground child exits); the .ts kills the in-flight
vendor's process group on the way out (runExternal exposes the group kill
through onSpawn), so a hook the host terminates cannot leave the vendor
running with the prompt on its stdin.
- The tolerant stdout parser tries every complete top-level object (bounded)
and takes the first carrying a string additionalContext, so a banner with
braces or quotes, or a progress object, no longer costs the answer.
- git runs with LC_ALL=C and the not-a-repository check is anchored to the
start of its message: a localized git or a repository path containing the
phrase can no longer flip the lookup.
- The rate limiter remembers up to 32 live keys, so alternating failures cost
two lines, not one per prompt.
- Unicode format characters (bidi overrides, zero-width spaces) are stripped
from vendor text at egress; the zero-width joiner stays for emoji.
- A killed child (timeout, ENOBUFS) resolves on exit without the stdout drain,
and the post-kill grace is 100 ms, so the timeout outcome fits the reserve.
- The ledger size warning, which the host discards from an exit-0 hook's
stderr, is logged where status looks.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(gstack-memorable): failed stale-lock takeover reaches the give-up; disable runs without gstack-config; status shows ledger size
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: host termination kills the vendor group; brace banners, decoys and format characters; non-reclaimable stale lock gives up; ledger line in status
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(memorable): the vendor dies with a terminated hook
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: deterministic stdin EPIPE case for runExternal (child closes stdin, stays alive)
Under parallel shard load a child that merely exits fast raced the write and
the EPIPE was not always observed; closing the read end first makes it so.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(hooks): outside-model review fixes for the memorable hook and runExternal
- Nothing in the vendor's process group outlives the call: the group is
killed on every resolve, the clean 'close' path included (a helper the
vendor forked with redirected stdio ran on unsupervised before).
- A child that already exited when the deadline fires keeps its result; the
deadline only ends the drain instead of rewriting a completed exit as a
timeout.
- The decoded-leaf scan reports when its node/depth bound cut the walk short
and the hook refuses the hand-off as unscanned; object keys are scanned too.
- git for the trust-policy lookup runs without inherited GIT_* selectors
(GIT_DIR, GIT_WORK_TREE, GIT_CONFIG_*), so it inspects the session's
repository and no other; a host cancellation kills that git as well.
- An unmatched brace in a vendor banner no longer hides the answer after it.
- The stderr tail is scanned whole before it is cropped for the log, so a
credential's prefix cannot be cropped away from its secret half.
- The vendor override reads an empty GSTACK_MEMORABLE_BIN as unset, exactly
as bin/gstack-memorable does, so enable checks the binary the hook runs.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(gstack-memorable): stale-lock reclaim checks the inode it judged and the owner's liveness; status reports a failed receipt query as unknown
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(uninstall): revoke memorable_recall independently of the hook manager and name a failed revocation
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: group kill on clean close, walk exhaustion refused, GIT_DIR cannot bypass the deny, unmatched-brace banner, whole-tail scan, empty-override parity, uninstall revocation without the hook manager
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(memorable): the process-group guarantee and its setsid boundary
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* chore(release): v1.83.0.0 — Memorable recall bridge, identity-aware hook removal, faster redaction line/col
CHANGELOG entry for the Memorable workflow-memory bridge (opt-in, off by
default, Claude Code only), the identity-aware remove-source and read-only
list-items in the hook manager, the memorable-recall egress sink, runExternal,
lockBudgetMs, and the binary-search line/col index in the redaction engine.
No migration. Contributed by @AdvaiytSane and @NIkhil-cmd-cmd (#2831).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: stdin EPIPE observation is scheduling-dependent under shard load; pin the invariant instead
A delivered answer is never reclassified as a spawn error; when the EPIPE is
observed it is reported as stdinError. Whether it is observed before the
child's exit resolves the call is not something the test can force.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs: list the memorable-recall sink among the fail-closed egress sinks
CLAUDE.md and ARCHITECTURE.md enumerate the receipt sinks that refuse to
send when the ledger cannot be written; the Memorable bridge's per-prompt
hand-off is pinned fail-closed in test/egress-receipt-wiring.test.ts but
was missing from both lists.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: memorable bridge tests pass on a runner that enforces file modes; scanner-proof key fixture
- The consent-write-failure tests make the state dir read-only, which also
blocked the bridge lock directory (exit 5 before the path under test);
the locks dir is pre-created so only the consent write fails.
- The unreadable-store test leaves a 0600 directory behind (the policy
script chmods the store path); cleanup restores the search bit and the
suite's afterEach reopens directories before removing.
- The AWS-key-shaped fixture is built by concatenation, as every sibling
test does, so the CI credential gate does not read it as a live key.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(gstack-memorable): name an unwritable state directory when the lock cannot be created
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: AdvaiytSane <advaiyt.sane@gmail.com>
Co-authored-by: Nikhil Krishnaswamy <krishnaswamynikhil@gmail.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(hooks): nest freeze/careful permissionDecision under hookSpecificOutput
Claude Code ignores a top-level permissionDecision, so the /freeze deny and
/careful ask guards silently allowed everything. Nest both under
hookSpecificOutput with permissionDecisionReason, update the shape-blind
tests to pin the nested form, and document the constraint in both skill
templates (regen included).
Closes half of #1459 (freeze enforcement chain).
Contributed by @jawadakram20 (PR #2331; team-init hunk deferred to the
dedicated team-init fix).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(team-init): required-mode hook blocks with nested schema + exit 2
The generated check-gstack.sh emitted a flat permissionDecision payload and
exited 0, which Claude Code ignores — required mode enforced nothing. The
generated hook now nests the deny under hookSpecificOutput and exits 2 so
the block holds even if the JSON schema drifts again. Adds a temp-repo
regression test that runs the generated hook under both installed and
missing-gstack homes.
Fixes#2413, #2296.
Contributed by @Masashi-Ono0611 (PR #2423).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(careful): close three check-careful bypasses via real JSON extraction
The grep-based command extractor stopped at the first escaped quote, so any
quoted argument truncated the command before the pattern checks ran —
`git commit -m "wip" && rm -rf /` was silently allowed. Replace it with a
python3/node JSON parse that fails CLOSED on unreadable payloads, add an
IFS/base64-to-shell obfuscation tripwire, and stop multi-line commands from
riding the single-line safe-exception whitelist (line-based grep would have
approved `rm -rf /` when a later line matched node_modules — a hazard the
real newline decoding exposed).
Contributed by @wtamminga (PR #2426; the -R hunk was dropped — it landed in
v1.61.0.0 — and output shapes updated to the nested hookSpecificOutput form).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(review,autoplan): require explicit run_in_background: false on specialist agents
Claude Code v2.1.198 made subagents run in the background by default, which
inverted the old "do not use the flag" guidance: review-army specialists and
autoplan dual voices silently launched in the background and the merge step
could proceed before they completed — regressing the #497 fix. The generated
guidance now instructs an explicit run_in_background: false, and a static
tripwire fails the free suite if the inert inverted phrasing ever returns to
any generated SKILL.md.
Fixes#2440.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(investigate): anchor the scope-lock freeze hook on $HOME, not CLAUDE_SKILL_DIR
The investigate skill's PreToolUse hooks and Scope Lock probe resolved
check-freeze.sh via ${CLAUDE_SKILL_DIR}, which does not exist when
frontmatter hooks run — the || exit 0 tail then failed open, so the debug
scope boundary silently never engaged (#1871 follow-up). Anchor all four
sites on $HOME/.claude/skills/gstack/ like careful/freeze, and add a static
test asserting no frontmatter command: line in the guard-family skills ever
references CLAUDE_SKILL_DIR again.
Fixes#2469; closes the last live half of #1459 together with the
freeze/careful hookSpecificOutput fix. The broader portable-install-root
rewrite stays #1882 (its own focused PR per the TODOS.md decision).
Reported with a fix by @maxpetrusenkoagent (PR #1873; absorbed narrowly —
the cwd-walk rewrite belongs to #1882).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): scan large diffs in line-aligned slices; stop digit-UUIDs matching as cards/phones
The prepush guard blocked any push whose added lines exceeded the engine's
1 MiB cap with engine.input_too_large — a size error naming no credential —
which trains people onto GSTACK_REDACT_PREPUSH=skip. Scan in 768 KiB
line-aligned slices instead (no pattern is multi-line, so a boundary cannot
bisect a secret); a single oversized line still goes to the engine intact and
fails closed. Also suppress card/phone matches whose span sits ENTIRELY
inside a UUID — digit-only UUID fixtures were 14 of 21 MEDIUM findings on an
ordinary branch, the noise level that stops people reading MEDIUM at all.
Fixes#2304.
Contributed by @luckywenapere (PR #2543).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(redact): block Google OAuth client secrets and Telegram bot tokens at HIGH
GOCSPX-prefixed client secrets and <bot_id>:<35-char> Telegram tokens are
never-publishable credential shapes with unambiguous formats — both now
block at HIGH like the other live-format credentials.
Contributed by @francis-eye (PR #2357).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact-prepush): resolve the real push base instead of EMPTY_TREE whole-repo scans
When the remote default branch is not main/master (or origin/HEAD is unset),
the merge-base guess failed and the hook fell back to scanning the ENTIRE
repository as added lines — re-attributing long-pushed secrets to the
current push and, on any real repo, tripping the engine byte cap so the push
blocked having scanned nothing. Derive the base from commits reachable from
no remote-tracking branch, keep the empty-tree path only for genuinely fresh
repos, and split the block message so an unscannable diff is reported as
"could not scan (fail closed)" rather than "credential found — rotate it".
Contributed by @stormeoio (PR #2398).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact-prepush): preserve the trailing newline handed to chained pre-push.local
The chaining wrapper captured stdin with $(cat), which strips the trailing
newline — a chained shell hook built on `while read` then never entered its
loop for the final (usually only) ref line and exited 0, failing OPEN. Use
the printf-x sentinel so the byte-exact input reaches the chained hook, with
tests covering both the pass-through and the short-circuit paths.
Contributed by @francis-eye (PR #2358).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact-prepush): close the ext-diff, header-lookalike, and ref-parse bypasses
Three ways the pushed diff escaped scanning: (1) a user-level diff.external
or textconv driver replaced the diff with its own output — zero '+' lines,
so the scan saw nothing (now --no-ext-diff --no-textconv); (2) an added
content line whose text begins with "++" renders as "+++…" and the blanket
header skip dropped it (now hunk-aware header detection); (3) a pre-push
ref line that failed to parse was silently skipped, leaving that ref
unscanned (now fails closed with the offending line named).
Minimal reimplementation of the two confirmed bypasses from PR #2498 by
@lubosxyz (the full PR overlaps the chunked-scan work absorbed separately),
plus the unparseable-ref hardening.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(pair-agent): keep the ngrok authtoken out of the transcript and shell argv
The not-authed flow told the user to paste their ngrok authtoken into the
chat so the agent could run `ngrok config add-authtoken` — putting a live
credential in the transcript, tool-call argv, and anything the transcript
syncs to. The user now runs the auth command in their own terminal; the
agent only verifies via `ngrok config check`, and a pasted token triggers a
rotate-and-reauth instruction. A static test pins that no agent-run bash
fence ever contains add-authtoken again.
Fixes#2335.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(update-check): crash emits CHECK_FAILED instead of reading as up-to-date
gstack-update-check signals "up to date" with SILENCE, and it runs under
set -e — so any unguarded mid-script failure exited quietly and was
indistinguishable from a current install. Observed live as a 45-release
silent-staleness incident. An ERR trap (with -E so it propagates into
functions) now emits a CHECK_FAILED sentinel naming the line and status,
and exits 0 so caller `|| true` guards can't eat it. Behavioral tests cover
both the crash and the healthy-silent paths; egress-receipt wiring is
untouched and still pinned by test/egress-receipt-wiring.test.ts.
Fixes#1974. (#2378's HEAD-SHA staleness half was already fixed on main by
the ls-remote + SHA-pinned VERSION resolution — close as already-fixed.)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(deps): bump diff 7.0.0 → 9.0.0 (GHSA-73rr-hh4g-fpgx parsePatch DoS)
The advisory affects diff 6.x–8.0.2. The only API this repo uses is
Diff.diffLines (browse/src/snapshot.ts:571, browse/src/meta-commands.ts:728),
which is unchanged across the major hop; snapshot tests pass against 9.0.0.
Closes#1588.
Contributed by @genisis0x (PR #1599; VERSION collateral stripped, lockfile
regenerated fresh).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(evals): skip eval jobs deterministically on fork PRs
Fork PRs never receive repository secrets, so every API-calling eval failed
at SDK auth — but only when Docker-cache luck let the jobs start at all,
making fork PRs randomly red or grey. Skip the eval and report jobs
explicitly for fork-origin PRs, keep the image BUILD (validates
Dockerfile.ci changes) without the push a fork token can't perform, and
leave full coverage for same-repo PRs, pushes, and dispatches.
Contributed by @andrey-esipov (PR #2345).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(extension): deny token/port reads to content-script and foreign senders
background.js answered getPort — port, connected state, AND the browse
server auth token — to any sender that passed the type allowlist,
including content scripts running in web-page context and, behind only
the sender.id check, anything without extension-page provenance. The
getToken sender.tab restriction covered getToken alone, and only after
getPort had already handed out the token.
Single decision point now: extension/sender-auth.js classifies each
message type; the eight privileged types (getPort, setPort, getServerUrl,
getToken, fetchRefs, command, sidebar-command, getTabState) require an
own-extension-page sender (chrome-extension://<own id>/ URL, no
sender.tab, own sender.id). Denied senders get { error: 'unauthorized' }
and nothing else — never the token, never the port. Content-script flows
(elementPicked, pickerCancelled, inspectResult, openSidePanel) are
untouched, and the sidepanel/popup keep the getPort token field their
connect path reads. The policy mirrors the v1.63 server-side model:
AUTH_TOKEN is released only to the pinned extension Origin via
POST /extension-token, so the extension must not re-leak it to contexts
the server would never have trusted.
browse/test/extension-sender-auth.test.ts drives the real background.js
onMessage listener under a chrome stub with four sender shapes (own
extension page, own content script, foreign extension id, missing
sender.url) and pins that denied responses carry no token/port fields,
that a denied setPort never persists, that a denied command never
reaches the network, and that the inspector + tab-state flows keep
working. The helper is loaded via importScripts in the classic service
worker and require()-able from bun tests.
Contributed by @punksterlabs (PR #1822; reimplemented against the v1.63 POST /extension-token pinned-origin model).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(update-check): fixture links gstack-egress-lib.sh — all 38 tests failed on main
v1.63.0.0 made bin/gstack-update-check source bin/gstack-egress-lib.sh
unconditionally, but the test fixture's GSTACK_DIR only linked gstack-config
— every test died at the source line (0/38 pass on pristine main,
verified). The suite-truncation bug hid it: the runner was killed by an
earlier file's delayed process.exit before this file ran. Link the lib like
the real install layout the script assumes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): capture active-tab state before close() — last-tab auto-create raced the close event
closeTab checked `tabId === this.activeTabId` AFTER awaiting page.close(),
but the page 'close' event handler can fire during that await and reassign
activeTabId — losing the race meant the last-tab auto-create never ran,
leaving the manager with zero tabs. Capture wasActive before closing, and
only reassign activeTabId when it no longer points at a live tab.
Part of the test-integrity repairs unmasked by the suite-truncation fix.
Contributed by @time-attack (PR #2230, browser-manager hunk).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(browse): delete the orphaned sidebar chat-queue suite; align sidebar-ux/tabs with the PTY-only sidebar
browse/test/sidebar-integration.test.ts tested the /sidebar-command queue
path ripped in v1.14 (34 references to removed endpoints — 11 permanent
failures masked by suite truncation). sidebar-ux.test.ts carried 73 failures
pinning the same dead surface (pickSidebarModel, ANALYSIS_WORDS); the trim
keeps its 108 live tests, including the background.js token/allowlist gates.
sidebar-tabs gets the two matching expectation updates.
Closes#2420, #1980.
Contributed by @time-attack (PR #2230, sidebar hunks; the
security-sidepanel-dom deletion was NOT taken — that suite pins the live
sidepanel DOM surface and passes).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(browse): align dual-listener and terminal-agent static guards with the current source
Two static-grep guards pinned superseded source shapes and failed once the
suite actually ran them: the tunnel dispatch gate is args-aware since the
--out disk-write ban (canDispatchOverTunnel takes command AND args), and
lazy PTY spawn routes through the maybeSpawnPty helper since v1.44. The
updated assertions pin the current, stricter shapes (open() never spawns;
the helper is the only spawnClaude caller).
Contributed by @time-attack (PR #2230, dual-listener + terminal-agent hunks).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): remove all 8 delayed process.exit teardown bombs — the tier-1 gate can finally fail
bun test runs every file in ONE process, so a 500ms setTimeout(process.exit(0))
armed in afterAll fired mid-way through a LATER file and killed the entire
suite with exit 0 and no summary — only ~16 of 434 files ran, and every
downstream failure was invisible (observed live throughout this wave's
enumeration). Changes, all guarded by fault injection:
- Replace every delayed-exit teardown with a time-boxed close of the file's
own browser (8 files across browse/ and design/); stub the daemon
/shutdown timer instead of letting its unconditional process.exit tear
the runner down.
- test/no-suicide-exit.test.ts: static tripwire — no *.test.ts may schedule
a delayed process.exit again.
- test/exit-propagation.test.ts + fixtures: fault injection with REAL bun
output proves the truncation shape (exit 0, no summary) and that
scripts/test-free-shards.ts now detects it: a shard exiting 0 WITHOUT
bun's final summary line is treated as FAILED (exit code alone is not
evidence of completion).
- handoff: the three headed-mode integration tests are darwin-skipped with
a pointer to the known macOS headed-launch breakage (#2242/#2554); they
keep running on Linux CI. Un-skip in the browse-daemon wave.
- feedback-roundtrip: repair the handler call sites unmasked by the fix —
handlers take (command, args, session, bm); passing the manager where a
session belongs broke all six tests.
- user-slug-fallback: HOME isolation makes endpoint_hash deterministic.
Fixes#2421, #2435.
Contributed by @sneakygriff (PR #2172) with repairs from @time-attack
(PR #2230 feedback-roundtrip hunks); supersedes PR #2252 by @whd4 (same
defect, credited).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: include design/test/ in the free suite and the sharded runner
design/test was absent from both the package.json test globs and TEST_ROOTS
in scripts/test-free-shards.ts — its tests (including one of the teardown
bombs removed in the previous commit) never ran in any CI or local free
run, so design fixes could ship without their unit tests executing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(make-pdf): reject directories when resolving the browse binary
access(X_OK) is true for directories (they carry the execute/traverse
bit on POSIX and pass the Windows existence check too), so cwd-dependent
resolution could pick the ~/.claude/skills/browse alias DIRECTORY as the
browse binary. Every browse call then exited 4 with empty stderr, which
make-pdf surfaced as "Chromium failed to launch" against a perfectly
healthy Chromium (#2156). Guard isExecutable with statSync().isFile()
so only regular files qualify.
Contributed by @jwilk-hrep (PR #2538).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(make-pdf): write browse-bound temp files under the safe-dirs allowlist
os.tmpdir() on macOS resolves to /var/folders/..., which fails browse's
safe-dirs validation ([/tmp, cwd]) since the v1.6.0.0 --from-file
tightening. Default PDF output (generate with no -o), the preview HTML,
tmpFile() scratch files, and setup's smoke-test fixture/output all wrote
there, so browse rejected the paths it was asked to read or write.
Export PAYLOAD_TMP_DIR from browseClient (the existing TEMP_DIR
convention: os.tmpdir() on Windows, /tmp elsewhere) and route
orchestrator.ts and setup.ts temp files through it.
Contributed by @lvthewah (PR #2505; the browse-binary directory guard
from that PR landed separately via PR #2538).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(make-pdf): stop URLs swallowing smartypants placeholders
A bare autolinked URL (<a href="X">X</a>) has zero whitespace between
the URL text and its own closing tag. TAG_RE carves that </a> into a
NUL-delimited SMARTPANTS_PRESERVED placeholder BEFORE the URL pass
runs, and URL_RE's \S+ swallowed the adjacent placeholder into the URL
match. The restore pass is single-shot, so the inner placeholder never
restored: raw "SMARTPANTS_PRESERVED_N" text leaked into the rendered
link, the </a> vanished, and link-blue styling bled into the rest of
the document (#2084). Excluding the NUL sentinel (\u0000) from the URL
character class stops the match from crossing into an already-carved
zone.
Contributed by @marshaung (PR #2280; PR #2339 by @BrendaB24 covered the
same smartypants defect).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(make-pdf): no blank first page when content precedes the first H1
Two paths put invisible content ahead of the first H1 and cost users a
blank page 1 (#1904):
- A visually-empty preamble (leading <style> block, HTML comment)
became its own .chapter. That section took the `.chapter:first-of-type
{ break-before: auto }` exception, so the first real chapter inherited
`break-before: page` and started on page 2. Non-rendering preambles
now fold into the first real chapter (markup preserved, no page
break); real text preambles keep their own chapter.
- Leading YAML frontmatter rendered as a literal paragraph of body text
on its own first page (marked has no frontmatter awareness). It is
now stripped before parsing; a `---` thematic break elsewhere is
untouched.
Contributed by @jbetala7 (PR #1913).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): allow about:blank so a restarted daemon can initialise
The daemon opens its own first tab on about:blank, so blocking it in
validateNavigationUrl meant a restarted daemon could never recreate the
blank tab it starts from — and `browse newtab about:blank`, which
`make-pdf setup` runs as its Chromium smoke test, failed and surfaced
as "Chromium failed to launch" against a healthy browser.
Allow about:blank ONLY, never the about: scheme: about:blank has no
origin, loads nothing and runs nothing, while about:config and friends
are real surfaces. Exact href match (lower-cased, since the URL parser
normalises the protocol but not the opaque part), so about:blankfoo
stays blocked.
Contributed by @jwilk-hrep (PR #2537).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(design): drop gpt-image-2 tool model that 400s under the gpt-4o orchestrator
The Responses API rejects pairing a gpt-4o orchestrator with an
image_generation tool spec'd as model: "gpt-image-2" (400
invalid_request_error), which took every design image call offline —
generate, variants, iterate (both threaded and fresh paths), evolve,
and /design-shotgun (#1771). gpt-image-2 is only valid under a gpt-5
orchestrator; with gpt-4o the tool must omit the model field (defaults
to gpt-image-1).
Remove the model field at all five call sites and add a static-grep
tripwire test (design/test/image-gen-pairing.test.ts) that fails CI if
any design/src module reintroduces the gpt-4o + gpt-image-2 pairing.
Re-enabling gpt-image-2 later requires bumping the orchestrator off
gpt-4o in the same diff, which the tripwire permits.
Contributed by @Pablosinyores (PR #1773).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(design): variants AbortError message reports the real 240s timeout
generateVariant arms its abort at 240_000 ms but the AbortError branch
returned "Timeout (120s)" — off by 2x, so a user staring at the failure
could not tell whether to bump the timeout, retry, or drop the call.
Report the actual configured bound, and pin it with a test that forces
the abort path (fast-forwarding only the 240_000 ms timer) and asserts
the surfaced string matches.
Contributed by @vryahn (PR #1774).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(memory-ingest): stop silently ingesting 0 pages — include gitignored staging, reconcile counts
Pages stage into ~/.gstack/.staging-ingest-*/ inside a repo whose .gitignore
is `*`, and gbrain import honours .gitignore — so it collected 0 files,
imported nothing, and the ingest still reported "written: N" from the STAGED
count while advancing state, meaning no future run ever retried. Three
layers now: (1) pass --include-gitignored (root cause); (2) if the installed
gbrain predates the flag, retry without it (subcommand --help is generic, so
the attempt is the only probe) with an upgrade pointer; (3) reconcile
gbrain's imported+unchanged accounting against the staged count and REFUSE
to advance state on a shortfall, naming the gitignore collision.
Fixes#2144, #2104.
Contributed by @gawievanblerk (PR #2560) and @Charles-Grant (PR #2486).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(autoplan): task aggregator returned zero tasks on every run — jq scope bug
Inside ($commits | split("|") | ...) the "." context is the split ARRAY, so
the filter's bare .commit raised "Cannot index array with string" on every
record — and the 2>/dev/null swallowed it, so aggregation silently produced
zero tasks no matter how many the reviews emitted. Bind .commit to $c before
the pipe. Reproduced live before the fix; regenerated autoplan/SKILL.md.
Fixes#2018.
Contributed by @kkroo (PR #2416; regenerated against the current template).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(session-update): un-wedge auto-upgrade — autostash over local patches, log the pull's real reason
On a normal install the tracked files ARE locally patched (skill-prefix
name rewrites, gbrain-refresh blocks), so the bare `git pull --ff-only`
refused on every run and auto-upgrade froze forever — observed as 308
consecutive PULL_FAILED entries with the reason discarded by 2>/dev/null.
Pull now runs --autostash (local patches ride over the update and pop back),
stderr is captured into the log so a genuine failure names its cause, an
autostash pop conflict recovers to a clean tree and re-renders the patches
(gstack-patch-names + gbrain-refresh, both idempotent), and a successful
pull re-renders them as a self-heal. Behavioral tests cover the wedge shape
and the reason logging.
Fixes#2566.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: raise the free-suite per-test timeout to 30s
bun's 5s default is fine for a file run solo, but the monolithic free suite
shares one process across 100+ files whose browser instances contend for
launch slots — Playwright tests that pass in isolation time out mid-suite.
30s matches the ceiling the enumeration runs used; the sharded runner
(test:free) is unaffected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(question-log): parse native AskUserQuestion answers — every native answer logged as __unknown__
Current Claude Code returns AskUserQuestion results as an OBJECT map keyed
by question text ({answers: {question: label}}); the hook only handled the
legacy array shapes, so 86% of live records carried user_choice __unknown__
— and the bin then scored every one as followed_recommendation false,
silently poisoning plan-tune metrics. Adds the object-map extraction (exact
+ whitespace-normalized + single-question pairing, multiSelect joins,
annotations as free_text), strips the (Recommended) suffix from BOTH sides
of the comparison, skips the computation entirely on extraction failure,
and logs unrecognized shapes to hook-errors.log instead of embedding them
in the record.
Fixes#2336, #2206.
Based on the working patch in #2336 by @yijisoo; suffix comparison fix
contributed by @chuchu2781 (PR #2400).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(slug): canonicalize slash branches to dash form — review history stops splitting
Branch-name sanitization disagreed across gstack (four incompatible rules),
so reviews for the same slash-named branch landed in multiple files and the
ship dashboard missed entries. gstack-slug now canonicalizes / to - in one
place, and ship's review lookup routes through it; goldens regenerated
against the current templates.
Fixes#1127, #2550.
Contributed by @ShuratCode (PR #2465; duplicate fixes by @xrfael-dev and
two others in PRs #1851/#1699/#1621, credited).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(slug): resolve the project root by marker walk-up — subdirectory sessions stop misfiling state
gstack-slug derived everything from pwd, so a session in a subdirectory got
the subdir's basename as its slug (or an outer monorepo's remote), misfiling
reviews/decisions/learnings under a phantom project — and the per-pwd cache
made the wrong answer permanent. The resolver now walks up from pwd:
outermost STRONG marker wins (.git, package.json, pyproject.toml, Cargo.toml,
Gemfile, go.mod, .project.yaml), weak content markers (README, LICENSE) catch
non-code project folders, deploy artifacts are deliberately not markers, and
GSTACK_PROJECT_SLUG remains the escape hatch. The cache self-heals on
mismatch. Main-side invariants preserved on top: the unconditional
[a-zA-Z0-9._-] re-sanitize before echo and slash→dash branch canonicalization.
Fixes#1125.
Contributed by @ajeenkya (PR #1702; rebased over the sanitize and
branch-canonicalization work that landed after it).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(hooks): shared spawn-bin helper — all three AskUserQuestion hooks were inert on Windows
The plan-tune hooks resolved bin scripts via new URL(import.meta.url).pathname
(which doubles the drive letter on Windows: /C:/C:/...) and spawnSync'd
extensionless bash scripts directly (unrunnable without a shell association)
— so question logging, preferences, and the error fallback all silently
no-op'd on Windows, and /plan-tune collected no data. A single spawn-bin.ts
helper now owns bin resolution (fileURLToPath) and win32 bash routing for
every hook, with static tripwires so a future hook can't reintroduce the
raw pattern. This is the one Windows-spawn idiom for hook code.
Fixes#2356.
Contributed by @rafassousa (PR #2504; supersedes PR #2399 by @chuchu2781).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(model-overlays): add fable-5, opus-4-8, and sonnet-5 overlays + resolver mappings
model-overlays/ had no entry for the current Claude generation, so every
session on a Claude 5 family or Opus 4.8 model fell through to the generic
claude.md nudges. Adds the three overlays with resolver mappings and
per-overlay tests; generated output for the default host is unchanged
(overlays activate by detected model).
Closes#2509.
Contributed by @chrisquorum (PRs #2246, #2243, #2247).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(windows): grant icacls ACEs by *SID, not unqualified username
An unqualified username handed to icacls is ambiguous: on a machine whose
hostname equals the username (a common Windows setup), it resolves to the
MACHINE account instead of the user. Combined with /inheritance:r, that
leaves ~/.gstack with a single ACE matching nobody — the process that just
"secured" the directory locks itself out, and icacls still reports success.
Both icacls sites in the repo (restrictFilePermissions and
restrictDirectoryPermissions in browse/src/file-permissions.ts — the only
icacls call sites; setup has none) now grant via icacls' literal-SID form
`*<SID>`, resolved once per process from System32\whoami.exe (pinned to
System32 because a bare `whoami` under a bash-flavoured PATH picks up the
MSYS build, which rejects /user). Fallback when the SID can't be resolved
is the domain-qualified `USERDOMAIN\username` name, which is unambiguous
where the bare username was not.
Windows-only regression tests assert the hardened directory stays usable
by the calling process (readdir + write), which is exactly the check that
a not-toThrow assertion sailed past before.
Contributed by @asizux2 (PR #2479); the same defect was independently fixed by @Icandi40, @chiragborse1, @IntegriGit and @voltapix26.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(windows): forward windowsHide through the bun-polyfill spawn shims
windowsHide is the one spawn option where Node's default is the opposite
of Bun's: Node shows the child's console window, Bun.spawn hides it.
The polyfill's spawn and spawnSync shims dropped the option entirely, so
the Node fallback path (dist/bun-polyfill.cjs) silently inverted the
behavior on the one platform the shim exists to serve — every watchdog
respawn of the terminal agent popped a visible bun.exe console window.
Three sites fixed:
- Bun.spawnSync shim: forwards windowsHide with Bun-matching default true
- Bun.spawn shim: same (stdio:'ignore' silences output but does NOT
suppress the console window on Windows)
- spawnTerminalAgent in terminal-agent-control.ts: explicit
windowsHide: true, so the Node fallback path behaves like Bun-native
An explicit windowsHide: false is honored at both shims. Three focused
tests pin the default-true, default-true-sync, and explicit-false paths
by intercepting child_process in a subprocess; the test file's require
path now uses forward slashes so it survives interpolation into a JS
string literal on Windows.
Supersedes PRs #2523, #2294 and #2290, which each covered a subset of
these sites.
Contributed by @jerrynicholsai (PR #2539); earlier fixes by @jwilk-hrep, @rroojrooj and @WimvandenHeijkant covered subsets of the same sites.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(watchdog): signal-0 liveness, tick-scaled respawn guard, windowsHide
Three-bug chain behind the Windows terminal-agent leak (console window
strobing every 60s, one orphaned agent per watchdog tick until the box
ran out of committable memory):
1. isProcessAlive shelled out to `tasklist /FI "PID eq <pid>"` on Windows
with a 3s timeout. A Bun.spawnSync that hits its timeout still RETURNS
with partial stdout, so the `.includes()` PID match read a LIVE agent
as dead — killAgentByRecord skipped the kill, the watchdog respawned
around the survivor, and every orphan slowed the next tasklist enough
to produce the next false negative. Now: `process.kill(pid, 0)` on
every platform (Node and Bun both map signal 0 to an OpenProcess
existence check on Windows), with EPERM counted as alive. No
subprocess, no timeout, no console window.
2. The respawn circuit-breaker was mathematically unreachable — verified
in this tree: RESPAWN_GUARD_WINDOW_MS was a fixed 60_000 against a
60_000ms default tick, and each tick pushes at most one respawn
timestamp, so three pushes span ~120s and can never coexist inside a
60s window (eviction is strict `>`, and setInterval drift plus
per-tick work always ages the prior entry past the boundary). The
guard could not fire at the default tick rate and a steady
one-per-tick leak ran unbounded. The window now scales with the tick:
max(60_000, tick * (RESPAWN_GUARD_MAX + 2)), so "3 crashes in quick
succession → stop" holds at any tick value.
3. The tasklist probe popped a visible console per tick (no windowsHide).
Removing the shell-out kills that site; the agent-spawn site itself
already passes windowsHide: true (landed with the bun-polyfill
windowsHide commit — PR #2414's terminal-agent-control.ts hunk is
reconciled there rather than duplicated).
New browse/test/process-liveness-windows.test.ts pins all three: no
subprocess from the probe, a static tripwire against reintroducing
`tasklist` + `PID eq` liveness checks in src/, the spawnTerminalAgent
windowsHide + stdio contract, and the window-derived-from-tick
arithmetic. terminal-agent-watchdog.test.ts test 4 now pins the
window/tick relationship instead of the fixed literal that let this
ship. Also converts `new URL(import.meta.url).pathname` to
`import.meta.path` across the static-grep tests it touches — the
pathname form yields /C:/... on Windows and breaks path.resolve.
Contributed by @SYKhayyat (PR #2414).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(terminal-agent): tie agent lifetime to its owning browse server PID
The terminal agent is intentionally detached so it survives the
short-lived CLI launcher, but its real owner is the persistent browse
server. If that server crashed or was killed before running normal
shutdown, the agent was adopted by PID 1 and lived forever (#2019).
spawnTerminalAgent now requires an ownerPid and exports it to the agent
as BROWSE_OWNER_PID; all three spawn sites pass the server PID (cli.ts
cold-start, cli.ts supervisor respawn, server.ts watchdog). The agent
polls the owner with signal 0 every 15s (GSTACK_TERMINAL_OWNER_WATCHDOG_MS
to tune) on an unref'd timer and, when the owner disappears, exits
through the SAME cleanup path as an intentional SIGTERM shutdown — now
re-entrancy-guarded and also removing the terminal-internal-token file
alongside the port file and agent record.
Runtime test spawns a real agent tied to a throwaway owner process,
kills the owner, and asserts the agent exits and its discovery files
(terminal-agent-pid, terminal-port) are gone.
Reconciled with the watchdog commit's spawnTerminalAgent contract test
(process-liveness-windows.test.ts now passes ownerPid and pins the
BROWSE_OWNER_PID env forwarding).
Closes#2019.
Contributed by @csarigoz (PR #2530).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(windows): give the bun-polyfill spawn shim a real `exited` promise
Bun.spawn exposes `proc.exited` as a Promise resolving to the exit code.
The Node fallback shim (dist/bun-polyfill.cjs) returned no such field, so
every `await proc.exited` on the Windows path resolved instantly to
undefined — the Windows cookie picker (cookie-import-browser.ts races
proc.exited at three sites) read stdout before the child produced it and
silent-failed; browser-skill-commands and terminal-agent hit the same
class.
The shim now:
- drains stdout/stderr eagerly into capped in-memory buffers (Node's
Readables are pull-based; without draining, a child writing past the
OS pipe buffer blocks in write() and 'exit' never fires), replaying
them as fresh single-shot Web ReadableStreams so reads work before or
after awaiting exit;
- caps the buffer at 16 MB (GSTACK_SPAWN_MAX_BUFFER to override), still
draining past the cap so a runaway child can't wedge or OOM;
- resolves `exited` with Bun-matching codes (exit code, 128+signal, 1 on
spawn error) after both pipes finish, and resolves on 'error' too —
Node fires 'error' without 'exit' when the binary is missing, which
otherwise hangs the await forever.
Six tests pin exit codes, the read-after-exit ordering, spawn-failure
resolution, the buffer cap, and the large-output drain. Adapted to the
current test file (require path goes through the requirePath variable
from the windowsHide commit), and the 1 MB drain test's child now exits
in the write callback — on modern Node a pipe write past the OS buffer
is async and process.exit() straight after write() truncates at ~64 KB
even with a live reader, which fails the test for reasons unrelated to
the shim.
Contributed by @punksterlabs (PR #1743).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): BROWSE_BIN carries the .exe suffix on Windows
On Windows, `bun build --compile` emits browse.exe, but setup's
BROWSE_BIN pointed at the suffixless path — so the post-build gate
(`[ ! -x "$BROWSE_BIN" ]` → "browse binary missing") could never pass on
Windows even after a fully successful build, while the build step itself
reported success. Closes#2291.
Applied the PR's override after the IS_WINDOWS detection, and also to
the second BROWSE_BIN assignment the PR predates: the direct-Codex-
install migration path re-derives BROWSE_BIN from the migrated dir and
would otherwise drop the suffix again on Windows.
Contributed by @rroojrooj (PR #1714).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): link lib/ beside bin/ at all five host-install sites
bin/ scripts import shared modules via ../lib (gstack-learnings-log →
lib/jsonl-store.ts is the reported case), so any runtime root that
exposes bin/ without lib/ breaks 13 bin/ commands — learnings-log,
decision-log, telemetry and friends fail with "Cannot find module
.../lib/jsonl-store.ts" on every non-Claude install, silently from the
skills' perspective.
All five host-install sites now carry lib/ next to bin/, each through
the existing _link_or_copy helper (never raw ln — the static invariant
in test/setup-windows-fallback.test.ts enforces this):
- .agents sidecar (create_agents_sidecar asset loop)
- Codex runtime root (create_codex_runtime_root)
- Factory runtime root (create_factory_runtime_root)
- OpenCode runtime root (create_opencode_runtime_root)
- Kiro install block
New test/setup-runtime-lib-command.test.ts executes the real setup shell
for each root in a sandbox (both the symlink branch and the Windows copy
branch of _link_or_copy) and runs gstack-learnings-log end-to-end from
the installed root, asserting the learning lands in
~/.gstack/projects/<slug>/learnings.jsonl — plus a negative control
proving a bin-without-lib root fails exactly the way the bug report did.
gen-skill-docs.test.ts's setup-validation block pins the lib link at
every site. Cross-checked against PRs #2433, #2410 and #2198: all three
cover subsets of these sites; nothing they fix is missing here.
Contributed by @fedster99 (PR #2262); overlapping fixes by @gregario, @lsendel and @netkurt.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): ship supabase/config.sh with every host runtime root
Distinct from the lib/-beside-bin/ defect: gstack-telemetry-sync,
gstack-update-check, gstack-security-dashboard and
gstack-community-dashboard all source $GSTACK_DIR/supabase/config.sh to
resolve GSTACK_SUPABASE_URL, where GSTACK_DIR is the installed root
(parent of bin/). The [ -f ... ] guard means a root without the file
degrades SILENTLY — telemetry and update checks just stop resolving the
project URL on non-Claude installs. Closes#2215.
setup now links supabase/config.sh (file-level on purpose — migrations/
and functions/ are dev-only) via _link_or_copy at all five host-install
sites: the PR's four (Codex, Factory, OpenCode runtime roots + the Kiro
block) plus the .agents sidecar, whose bin/ resolves the same relative
path and which the PR predates covering.
The runtime-root test now asserts supabase/config.sh is present in
every built root, on both the symlink and Windows-copy branches.
Contributed by @jizusun (PR #2216).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(windows): curate the fix-wave regression tests into the windows-latest run
The windows-free-tests curated set is derived (POSIX-fragility regex scan
+ explicit deny list), and two of this wave's Windows regression files
were auto-excluded on false-positive pattern hits:
- browse/test/file-permissions.test.ts tripped the POSIX-mode-bitmask
pattern, but every `mode & 0o777` assertion is platform-guarded — and
the file carries the win32-only icacls-by-SID regression tests, which
can only ever execute on windows-latest.
- browse/test/terminal-agent-owner-watchdog.test.ts tripped the
spawn(['bun','run',...]) pattern whose reason is the Playwright-bound
browse server; it actually spawns terminal-agent.ts (fs/path/crypto +
local helpers only, no Playwright at module scope), and the owner-PID
orphan leak it pins was reported on Windows (#2019).
Adds a KNOWN_WINDOWS_SAFE force-include list (mirror of
KNOWN_WINDOWS_INCOMPATIBLE, each entry carrying its false-positive
rationale) consulted before the pattern scan, and makes the
owner-watchdog test's throwaway owner process Windows-portable
(process.execPath instead of `sleep`, which a bare runner may not have).
The wave's other new files need no wiring: process-liveness-windows and
the bun-polyfill windowsHide/exited tests pass curation automatically;
setup-runtime-lib-command self-skips on win32 by design (its Windows
branch is exercised by simulating IS_WINDOWS=1 under bash), so
force-including it would add a permanently-skipped file.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): register the SessionStart hook with a bash prefix on Windows
Windows can't execute an extensionless bash script directly — registering
the bare gstack-session-update path made the hook pop the "Select an app"
dialog on every session start (or silently never run), so team-mode
auto-upgrade was dead on Windows installs. Companion to the hooks'
spawn-bin routing: same defect class at the registration site.
Contributed by @NikhileshNanduri (PR #1813; VERSION/CHANGELOG collateral
stripped).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): stop piping gen:skill-docs through tail — generator failures were masked
setup piped doc generation through `tail -3`, so a generator crash kept the
pipe's exit 0 and installs completed "successfully" with broken or missing
SKILL.md files. Capture the real exit status at BOTH sites (the main
gen:skill-docs step and the gbrain-detected gen:skill-docs:user regen —
the second drifted in after the PR and its own test caught it), print the
tail for UX, and fail loudly.
Contributed by @DavidMiserak (PR #1898; VERSION/CHANGELOG collateral
stripped; extended to the second pipe site).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mktemp): move the X-run to the end of every temp-file template (BSD/busybox safe)
BSD mktemp (macOS) does not substitute an X-run that has a suffix after it:
`mktemp "$TMP_ROOT/codex-err-XXXXXX.txt"` creates a LITERAL
codex-err-XXXXXX.txt on the first call (exit 0) and every later call fails
with `mkstemp failed: File exists` — so /codex breaks from the SECOND run on
every Mac, masquerading as a model stall. busybox mktemp (Alpine) rejects the
template on the first run. Fixes#2091, #2370.
Union of both community fixes, compared at the diff level:
- PR #2372: all 11 source sites with a suffix after the X-run — codex
SKILL.md.tmpl (5), claude SKILL.md.tmpl (3), bin/gstack-developer-profile
(2, suffix folded into the prefix: .json.tmp.XXXXXX), and the office-hours
codex pass in scripts/resolvers/review.ts (1).
- PR #2103: the second half of #2091 — bin/gstack-paths now strips the
trailing slash from TMP_ROOT at the source (macOS $TMPDIR ends in `/`),
plus runtime tests pinning that normalization.
New repo-wide tripwire in test/regression-issue2091-bsd-mktemp.test.ts:
every .tmpl, every SKILL.md, and every scripts/resolvers/*.ts is swept —
no mktemp template may carry a suffix after the X-run, with a self-test so
the detector can't be quietly blinded. Generated SKILL.md files regenerated
via gen:skill-docs in this commit.
Contributed by @ShuratCode (PR #2103) and @noron12234 (PR #2372); PR #2285 by @cathrynlavery covered a subset.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(codex,review,ship): scope codex review with an explicit --base flag, never prompt text
`codex review` takes its scope ONLY from --base/--commit/--uncommitted. The
positional [PROMPT] is mutually exclusive with all three, and a prompt-only
`codex review "<text>"` silently falls back to the uncommitted working-tree
scope (verified on 0.144.1: it runs `git status --short; git diff` and
reviews that) — so the previous prompt-based scoping produced a
confidently-worded review of the WRONG changes and read "no changes" on a
clean tree. Every diff pass now invokes `codex review --base <base>` with no
prompt argument: /codex Step 2A default path, the /review structured pass,
and the /ship adversarial-section pass (all via scripts/resolvers/review.ts).
Custom review instructions keep their own `codex exec` path (the CLI rejects
prompt + scope flag together), with the filesystem boundary preserved there.
Two new Error Handling entries teach the failure shapes: the argv-parse
error, and the "review says no changes on a branch full of changes" symptom.
Tests updated to pin the new invariant instead of banning the fix: the old
assertions required the diff range in prompt text and banned the
`--base <base> -c '...'` substring, which the correct scoped form contains.
Also deletes test/fixtures/golden-ship-claude.md — a 2,565-line orphaned
fixture referenced by zero tests (the live goldens are in
test/fixtures/golden/, compared by test/host-config.test.ts); the factory
golden is refreshed from the regenerated output. Generated SKILL.md files
regenerated via gen:skill-docs in this commit.
Contributed by @fangearhq-boop (PR #2513).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(review,ship): run the codex diff passes under the timeout wrapper (#1036)
The `_gstack_codex_timeout_wrapper` added in #1056 was wired into
codex/SKILL.md but never into the /review and /ship diff passes, which kept
running under a bare 5-minute Bash gate. An unwrapped stall returns no exit
code and no output, which downstream reads as "Codex reviewed and found
nothing" — a truncated pass silently became a clean bill. Measured on
codex-cli 0.145.0: a pass was killed at 287s of a 300s budget mid-tool-call,
and the same prompt completed in 336s.
Both passes in scripts/resolvers/review.ts (adversarial `codex exec` and the
structured `codex review --base` pass) now re-source gstack-codex-probe and
run under `_gstack_codex_timeout_wrapper 540`, with the Bash tool gate raised
to 600000 ms so the wrapper fires FIRST and a stall surfaces as a diagnosable
exit 124. The timeout guidance now says a timed-out pass is MISSING COVERAGE,
not a clean result, and points at the run's rollout log under
~/.codex/sessions/ for partial output. The stale "timeout doesn't exist on
macOS" claim is gone — the wrapper resolves gtimeout, then timeout, then runs
unwrapped, so it is safe without coreutils.
Static guards in test/codex-hardening.test.ts pin all three sites (resolver,
review/SKILL.md, ship/sections/adversarial.md): both calls wrapped, wrapper
budget strictly under the Bash gate, and no reappearance of the macOS claim
that steered these call sites away from the wrapper in the first place. The
Claude-output path guard in test/gen-skill-docs.test.ts now scrubs
~/.codex/sessions/ (a user-facing Codex CLI path, same class as the
~/.codex/logs/ exemption) before banning Codex host paths. Generated files
regenerated via gen:skill-docs; factory golden refreshed.
Contributed by @aegixx (PR #2379).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(codex): sandbox the review path, fail the gate closed, order timeouts wrapper-first
Closes#2496, #2524, #2477 — three defects in the class "a guard that
reports success while doing nothing", all in codex/SKILL.md.tmpl:
(a) Review sandbox. The default `codex review` path was the only codex call
with no sandbox override, inheriting ~/.codex/config.toml's default — write
access on a trusted project — while Important Rules claimed read-only.
Top-level `codex review` has no -s/--sandbox flag (verified on 0.147.0), so
the invocation now pins `-c 'sandbox_mode="read-only"'`, the same form the
consult-resume path already uses.
(b) Fail-closed verdict gate. The old rule ("no [P1] found → PASS") could
not fail on the default path: native `codex review` output carries no
bracketed tags, and a non-zero exit, expired auth, timeout, or empty result
also contains no [P1] — all read as PASS. The gate is now an ordered,
fail-closed check: non-zero exit → FAIL; empty output → FAIL; [P0]/[P1]
(bracketed or codex's native labels) → FAIL with count; NO severity tags at
all → FAIL requiring a human read; PASS is only reachable through the
explicit tagged-advisory-only branch. [P0] is recognized as blocking, and
the review-log findings count includes it.
(c) Bash gate above the wrapper. Step 2A instructed `timeout: 300000` under
a 330s wrapper, and Challenge's 300s gate sat under a 600s wrapper — the
harness killed the call before the wrapper could emit its diagnosable
exit-124 message. Every Bash gate now sits strictly ABOVE its wrapper:
360000 over the 330s review wrapper, 660000 over the 600s challenge/consult
wrappers, with the ordering rationale stated at each site.
Also from #2477/#2524: a new Error Handling entry for the model-entitlement
400 ("The '<model>' model is not supported...") pointing at the `model =`
pin and `[notice.model_migrations]` in ~/.codex/config.toml and saying
exactly which override to retry with (-m for exec-based modes,
`-c model="..."` for review mode, which rejects -m); the Model & Reasoning
section no longer documents `-m` for `/codex review`.
Static assertions in test/codex-hardening.test.ts pin (a)-(c) across both
the .tmpl and the generated SKILL.md: every scoped review invocation carries
sandbox_mode="read-only" and never -s; the default-PASS sentence is banned
and the fail-closed branches are present; and per-section, every Bash
`timeout: N` is strictly greater than every wrapper budget, with 2A/2B/2C
all required to be inspected. Generated SKILL.md regenerated via
gen:skill-docs in this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(preamble): quoted tilde made Artifacts Sync and telemetry-finalize dead code in 49 skills
A tilde inside double quotes never expands, so the generated
`_BRAIN_SYNC_BIN="~/..."` assignments resolved to a literal ./~ path and
the Artifacts Sync + telemetry-finalize blocks silently no-op'd in every
skill that carried them (regression of #785). The preamble resolvers now
emit $HOME-based paths; all generated SKILL.md files regenerate identically
from the fixed templates, and a static tripwire fails the suite if a
quoted-tilde assignment ever reappears in generated output.
Fixes#1656, #1715.
Contributed by @jawadakram20 (PR #2333).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen-skill-docs): stop the catalog trim chopping descriptions at embedded periods
The description-trim regex treated the first period as end-of-sentence, so
skill descriptions with embedded periods (e.g. file extensions, version
numbers) truncated mid-thought in the generated catalog — the discovery
surface every host loads. Trim now respects the full first sentence;
diagram's description regenerates to its intended text.
Contributed by @sneakygriff (PR #2171).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(preamble): update_check:false gates the prose, not just the binary
Setting update_check:false stopped the update-check BINARY from running,
but every skill preamble still shipped the upgrade-handling instruction
prose unconditionally — burning tokens on instructions that could never
fire and confusing agents into probing for upgrades anyway. The resolver
now suppresses the upgrade-flow prose when the config disables checks.
Fixes#2001.
Contributed by @jc0d35 (PR #2022).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): sidebar Terminal — drop the duplicate WS subprotocol header, stop doubling CJK IME input
The terminal client passed the auth token as the WS subprotocol AND echoed
it in a second header, which some Chromium builds reject; and composition
events double-sent CJK input (each IME commit arrived once from the
composition handler and once from the data handler). One auth path, one
input path; also fixes the terminal-agent test that failed on clean main.
Contributed by @mindsurf0176 (PR #2515).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): -h/--help prints usage instead of running the installer
Asking setup for help RAN the full installer — Playwright download and all.
Standard help flags now short-circuit to usage.
Contributed by @saen-ai (PR #1219).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(hosts): Codex-generated skills reference AGENTS.md, not CLAUDE.md
Codex reads AGENTS.md, but its generated skills still told agents to read
CLAUDE.md in 8 places — instructions Codex hosts cannot follow. The host
config now maps the memory-file name per host; all three ship goldens
refreshed from the regenerated output.
Contributed by @exGeni (PR #1996).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(retro,ship): count tracked files for the test-file metric, not the working tree
The test-file count ran find over the working tree, sweeping untracked
build output — a Rails repo reported 623 test files when git tracks 17
(37x), skewing retro narratives and ship dashboards. Count via git ls-files
instead; includes the one-line Python-glob widening so non-JS repos stop
undercounting.
Fixes#2307, #1999.
Contributed by @joshRpowell (PR #2308).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(land-and-deploy,gen): auto-merge diagnosis + CRLF-stable generation
Two small hardenings: land-and-deploy Step 4 no longer misdiagnoses a
failed `gh pr merge --auto` as a permissions problem when the real cause is
the merge-method mismatch the command names; and gen-skill-docs normalizes
CRLF at the template entry point so Windows checkouts with autocrlf produce
byte-identical generated output to CI instead of silently skipping the
\n-anchored transforms.
Contributed by @Jmeg8r (PR #2437) and @1ncludeSteven (PR #1051).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(land-and-deploy): stop greedy sed from eating the URL scheme in deploy-config parsing
The deploy-config bootstrap parsed "Production URL: https://x.com" with
sed 's/.*: *//', which cuts at the LAST colon — the one in "https:" —
yielding "//x.com". Cut at the first ": " instead (s/^[^:]*: *//).
Resolver only; the generated land-and-deploy/SKILL.md regenerates from
this source in the docs lane.
Contributed by @briascoi (PRs #2555/#2493).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(artifacts-init): honor the provider CLI's git_protocol instead of forcing SSH
gstack-artifacts-init unconditionally rewrote the push remote to SSH and
hard-failed setup for users whose gh/glab auth is HTTPS-only. Now:
- provider-created remotes follow `gh config get git_protocol` /
`glab config get git_protocol` (HTTPS when unset — the gh default)
- explicit/existing/manual remotes keep their given protocol; unknown
URL forms (local bare paths, file://, self-hosted) pass through
- new --push-protocol auto|https|ssh flag overrides the inference
- the unreachable-remote error names the actual protocol and points at
--push-protocol instead of assuming a missing SSH key
Closes#1348.
Contributed by @time-attack (PR #2225).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): skip the .gitignore append when git already ignores .gstack/
ensureStateDir appended ".gstack/" to a tracked .gitignore even when git
already ignored the directory via global excludes, .git/info/exclude, or a
parent .gitignore — dirtying the working tree on every daemon start. Run
`git check-ignore -q -- .gstack/` first and return early when git says it's
covered; git-missing/not-a-repo/timeout all fall through to the existing
text-check append (the safe default).
Closes#2385.
Contributed by @gregario (PR #2430).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): guard browser.process() in resolveDisconnectCause
`.process()` only exists on browsers Playwright launched itself; a browser
from connectOverCDP() (or a test stub) has no such method, so the blind call
threw "browser?.process is not a function" inside the disconnect handler and
took down the daemon. Type-check the method before calling it and treat the
no-method case as no process handle.
Closes#2085.
Contributed by @elan2002 (PR #2434).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(lib): narrow the override injection denylist to instruction-shaped phrases
The /override[:\s]/i pattern flagged any prose containing "override " or
"override:" — CLI flags (--port-override -1), tfvars notes, and plain
"you can override the default region" all tripped the injection guard.
Require an instruction-shaped continuation: "override (all)? previous |
prior | above | the rules/instructions/system prompt". Genuine attempts
like "Override: ignore all previous instructions" still block via the
ignore-previous pattern.
Closes#2401, #1934.
Contributed by @Masashi-Ono0611 (PR #2424); same fix independently by
@JonasFocus (PR #1940).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): stop the E.164 phone pattern flagging compact timestamps
Bare 14-digit runs like 20260727202423 (YYYYMMDDHHMMSS backup/log stamps)
matched the phone regex and produced MEDIUM PII findings. Reject a
separator-free 14-digit span whose fields parse as a plausible date-time;
real numbers carry a + or spacing, so phone coverage is unchanged.
Contributed by @abkrim (PR #2428).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(design): create the OpenAI key file owner-only, closing the write-then-chmod race
saveApiKey wrote ~/.gstack/openai.json at the default umask and tightened to
0600 afterwards, leaving the API key briefly world-readable between write and
chmod (CWE-377/367). Pass mode 0o600 at create; the trailing chmodSync stays
as a backstop to tighten a pre-existing loose file.
Contributed by @bunlongheng (PR #2468).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(config): make gstack-config key validation locale-independent
POSIX bracket ranges like a-z follow the active collation order; under GNU
grep with tr_TR.UTF-8 the range excludes the ASCII letter i, so every key
containing i (skill_prefix, explain_level, ...) was rejected as invalid.
Pin both get/set validators to LC_ALL=C, with a source-level tripwire test
since macOS BSD grep doesn't reproduce the bug.
Closes#2494.
Contributed by @Math1987 (PR #2506).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(resolvers): stop env-var hosts from doubling $HOME in the binary fallback path
The browse/design/make-pdf setup resolvers built the fallback binary path as
"$HOME" + dir.replace(/^~/, ''), which is only correct for ~-rooted dirs.
Env-var hosts carry an absolute $GSTACK_* dir, so the generated fallback
became $HOME$GSTACK_.../browse — a path that never exists. New toShellPath()
in scripts/resolvers/types.ts expands ~ to $HOME and passes absolute
env-var dirs through untouched; all five call sites route through it.
Claude-host generated output is byte-identical, so no SKILL.md regeneration
is needed here.
Closes#2055.
Contributed by @simjak (PR #2056).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(settings-hook): respect CLAUDE_CONFIG_DIR when resolving settings.json
gstack-settings-hook hardcoded $HOME/.claude/settings.json, so users running
Claude Code with a relocated CLAUDE_CONFIG_DIR had hooks written to a config
file Claude never reads. Resolve ${CLAUDE_CONFIG_DIR:-$HOME/.claude} first;
the explicit GSTACK_SETTINGS_FILE override still wins.
Partial #349.
Contributed by @andrefogelman (PR #2239).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): dispatch a change event after fill for change-only validators
Playwright's Locator.fill() dispatches `input` but never `change`, so
frameworks that validate on change (AngularJS ng-change, debounced
strength/match checks) never saw the filled value — correct in the DOM,
failing the framework's own validation. `browse fill` now dispatches
`change` after the fill. Failing-first regression test with a
change-only password-match fixture included.
Contributed by @intelliot (PR #2475).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(safety): unknown question-preference source exits the documented 2, not 1
The --write user-origin gate documents exit 2 as "rejected, do not retry"
(profile poisoning defense), but a source outside both the allowed and the
explicitly-rejected lists fell through to exit 1 — the generic validation
code callers treat as retryable. Unknown sources now exit 2 with the same
do-not-retry rejection message as the known non-user-originated ones.
Closes#2390.
Contributed by @gregario (PR #2429).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(pr-title): stop duplicating the version prefix on bare-version titles
A title that was nothing but a version ("v1.2.3" — the form ship uses for
version-only bumps) matched neither the "v<NEW_VERSION> " literal case nor
the trailing-space strip regex, fell through to the prepend path, and came
out as "v1.2.3.4 v1.2.3" — which pr-title-sync.yml then wrote back via
gh pr edit. Handle the bare form in both the no-change case and the
prefix-strip regex, and emit a bare new version when nothing follows.
Closes#1886.
Contributed by @jbetala7 (PR #1887).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(build): escape literal braces in the bun:sqlite stub regex
Perl >= 5.26 treats an unescaped literal `{` in a pattern as fatal
("Unescaped left brace in regex is illegal"), so build-node-server.sh
died at the bun:sqlite stub substitution on modern perl. Escape both
braces; the replacement output is unchanged.
Closes#2300.
Contributed by @nuga0718 (PR #2111).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(config): preserve spaces in gstack-config values
get/list read values with awk '{print $2}' | tr -d '[:space:]', which
truncated any value containing spaces ("/Users/x/Conductor Workspaces"
came back as "/Users/x/Conductor") and set wrote the unfiltered raw value
on the append path. New read_config_value() strips only the "key:" prefix
and trailing whitespace (cut-style parse), and set appends the same
newline-stripped value the in-place edit path uses.
Closes#1782.
Contributed by @jbetala7 (PR #1783).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): recover a late-healthy detached daemon instead of a false "Server failed to start"
startServer spawns the daemon detached + unref'd, then polls health for a
fixed budget. On a loaded machine the budget can elapse in the gap between
the loop's last tick and the daemon becoming ready — the CLI reported
"Server failed to start within Ns" while the very next `browse status`
showed a healthy server. Add a final readState()+isServerHealthy() re-check
before the timeout throw, and make the budget env-overridable via
BROWSE_START_TIMEOUT (BROWSE_* tunable convention). Structural + behavioral
tests pin both invariants.
Closes#1846.
Contributed by @harjothkhara (PR #1847).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): daemon resilience on loaded machines — Bun conn errors, stop/restart flush, startup + git-root budgets
Four load-sensitivity fixes in the daemon lifecycle:
- sendCommand only recognized Node's ECONNREFUSED/ECONNRESET; the compiled
CLI runs on Bun, which reports 'ConnectionRefused'/'ConnectionClosed'
("Unable to connect..."), so daemon crashes leaked the raw error and
exited 1 instead of entering the busy-check/restart path. Match both.
- stop/restart called shutdown() inline, which exits before the HTTP
response flushes — the CLI saw a dropped socket (and would now
crash-retry a fresh daemon just to stop it). Defer shutdown ~100ms so
the 200 lands first.
- Non-CI POSIX startup budget raised 8s -> 15s (cold Chromium measured
~5.7s at load avg 10; load 12+ blew the old budget while the detached
daemon was still booting).
- getGitRoot's 2s git rev-parse timeout returned null under load (6.3s
spikes measured), scattering state files across cwds into split-brain
daemons. Raise to 8s, still bounded.
Contributed by @mplatts (PR #1732).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(telemetry): ingest keeps error_message/failed_step instead of dropping them
The telemetry_events columns exist and bin/gstack-telemetry-log already
sends error_message + failed_step, but the Supabase ingest function dropped
both fields on insert — every error report arrived with no message and no
failing step. Map them through with the same bounded-length sanitization as
error_class (500/100 chars). The completion-status resolver now also passes
--error-message/--failed-step in the generated skill telemetry block, with
instructions to leave them empty on success.
Resolver only for the template side; generated SKILL.md files regenerate
from this source in the docs lane.
Contributed by @sunnnybala (PR #769).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): surface non-EEXIST errors in acquireServerLock instead of masking them
acquireServerLock caught every open failure as if the lock were held:
EACCES/EROFS/ENOENT surfaced as phantom "another process holds the lock"
(null return, no diagnostics), and a failed stale-lock read or unlink was
swallowed the same way. Each failure class now logs a coded, pathed
diagnostic: non-EEXIST open errors, holder-PID read errors (ENOENT retries
the acquire — the holder released between open and read), and stale-lock
unlink errors. Four-case unit test included.
Closes#1084.
Contributed by @jbetala7 (PR #1725); same fix independently by
@JiayuuWang (PR #1097).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(paths): shell-quote gstack-paths output so eval round-trips values
gstack-paths emitted bare KEY=VALUE lines, so the documented
eval "$(gstack-paths)" re-parsed the values: backslashes were eaten as
escapes (Windows $TMP C:\Users\... became C:Users...) and a space
word-split the assignment, leaving the variable empty. Emit each value
with printf %q so eval round-trips byte-for-byte; plain POSIX paths are
unchanged. Round-trip regression tests cover backslashes, spaces, and
embedded quotes.
Closes#2374.
Contributed by @fangearhq-boop (PR #2376); same fix independently by
@yannickspiess (PR #1580).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* security(browse): drop .svg from the load-html extension allowlist
SVG is a script-capable format (inline <script>, event handlers, foreign
objects), so allowing it through load-html's HTML allowlist let a local
.svg execute script in the browse session context. The allowlist is now
.html/.htm/.xhtml only; regression test asserts .svg is rejected.
Contributed by @garagon (PR #1153).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(benchmark): validate --timeout-ms as a positive integer
gstack-model-benchmark fed --timeout-ms straight through parseInt, so
"abc" became NaN and "0"/"-1" passed through — a NaN or non-positive
timeout silently disables the per-provider watchdog. Reject anything
that isn't a positive (optionally +-prefixed) safe integer with a clear
error and exit 1.
Closes#1726.
Contributed by @jbetala7 (PR #1727).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore(fixtures): clean terminology in the security-bench replay fixture
Two spots in browse/test/fixtures/security-bench-haiku-responses.json
referred to real-world HVAC project naming; replace with the generic
"mechanical services" wording. Fixture stays valid JSON; replay tests
unchanged.
Contributed by @apex-system (PR #2131).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: cancel superseded actionlint and skill-docs runs
actionlint.yml and skill-docs.yml trigger on both push and pull_request
with no concurrency group, so every push to an active branch left the
previous (now-obsolete) runs queued or running — twice per commit on
same-repo PR branches. Add the same cancel-in-progress concurrency
groups the heavier workflows already use, plus a free static tripwire
test that fails CI if a push+pull_request workflow ever ships again
without cancel-in-progress.
Contributed by @jbetala7 (PR #2053).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(make-pdf): correct CJK rendering — NUL sentinel hardening, SC-first fonts, CJK quote context
Three CJK fixes in the PDF pipeline:
- smartypants strips stray input NULs up front so document text can never
forge the U+0000 placeholder sentinel and leak a preserved-zone marker
into the output.
- The CJK font stack led with Japanese families, so Simplified-Chinese
text rendered han glyphs with JP variants. Lead with PingFang SC /
Heiti SC / Noto Sans CJK SC / Source Han Sans SC before the JP
fallbacks.
- Quote-smartening only recognized ASCII openers as "start of quote"
context; the fullwidth colon and CJK brackets now count, so quotes
after them curl the right way.
Contributed by @rssprivacy-commits (PR #2012).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: regenerate skill output for the quick-win resolver changes
Regen for the deploy-config URL-scheme fix (utility resolver), telemetry
completion-status resolver, and $HOME-doubling binary-resolver fix; ship
goldens refreshed to match. Generated-output-only commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(slug): cached identity is sticky — heal ONLY the provable subdir-cache bug shape
The walk-up rewrite recomputed the slug on every run and "healed" the cache
toward the fresh value, which broke the #2212 continuity contract: a project
that used gstack before adopting a git remote would be silently renamed to
the remote-derived slug, orphaning everything under ~/.gstack/projects/.
Cached identity now wins, with one precise exception: when the cached value
equals THIS pwd's basename while the walk-up proves pwd is not the project
root, the entry came from the pre-walk-up subdirectory bug (#1125) and is
recomputed. All four slug contracts pass together (repo-mode #2212,
walk-up #1125, sanitize, user-slug).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(claude): stop false-blocking macOS keychain subscription auth in host detection
The /claude skill's auth probe only recognized env-var/API-key auth, so
macOS subscription installs (keychain-backed, where `claude -p` works fine)
were told they had no auth. Detection now uses host invocation.
Fixes#1890.
Contributed by @xing-qnex (PR #2411); PR #2548 by @shawnacalia covered the
keychain case.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): Ubuntu 26.04 Playwright platform detect + silence the codesign false alarm
Two small setup papercuts: the Playwright platform probe now recognizes
Ubuntu 26.04 instead of falling to the generic-Linux path, and macOS
installs stop warning about a codesign "failure" that was actually the
expected unsigned-adhoc path (the real signature check already gates
binary launch).
Contributed by @nuga0718 (PR #2113) and @lucascaro (PR #1758).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(skills): land-and-deploy squash readback, next-version paths, embed-flags quoting
Three template one-liners: land-and-deploy reads the squash-merge result
from the merge commit instead of the stale branch tip; review/landing-report
/land-and-deploy templates call bin/gstack-next-version via its installed
path instead of a bare repo-relative one; setup-gbrain quotes
GBRAIN_EMBED_FLAGS so zsh word-splitting stops silently dropping
voyage-code-3 flags. Regenerated output included.
Contributed by @stormeoio (PR #2011), @rjmurillo (PR #1820) and
@trevorhstandridge (PR #1817).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* release: v1.64.0.0 — fix wave CHANGELOG, VERSION, deferred-wave TODOs
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: refresh ship goldens for the telemetry error-field resolver output
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(redact-prepush): assemble the fake AWS key at runtime — the literal blocked our own push
The hook's fixtures carried a live-format AKIA literal, and the repo's own
pre-push scanner (hardened in this wave) correctly blocked pushing it. The
placeholder-suppressed docs key would defeat the detection tests, so the
fixtures now concatenate the key at runtime: tests still exercise real
detection, and the pushed diff never contains a scannable credential shape.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(slug): terminate the marker walk-up on dirname's fixed point — hung every bin on Windows
Under git-bash on Windows a mixed-form path walks C:/Users -> C: -> . -> .
forever: dirname's fixed point there is never "/", so the walk-up loop spun
and every bin that evals gstack-slug (learnings-log first among them) hung
until spawn timeout. Caught by windows-free-tests CI on the wave PR. Break
on the fixed point itself with a depth cap for exotic forms; regression
tests drive the extracted function with hostile path shapes under a hard
timeout.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
