* fix(test): host-config goldens self-provision .agents/.factory artifacts
Fixes#2532. The codex/factory golden tests read gitignored artifacts that
only gen-skill-docs.test.ts (serial tree-mutating phase) produces, so the
file failed in isolation and on clean clones (the #2536 "3 failures then 0"
symptom). beforeAll now generates a host's artifacts iff its ship SKILL.md
is missing — never overwriting existing ones, so stale artifacts still fail
the golden. The file is also classified TREE_MUTATING so its provisioning
runs in the serial window, not racing parallel readers.
Verified: full pass with .agents/ and .factory/ deleted (74/74 in isolation).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): exempt the live repo tree from hermetic-wiring's operator-~/.claude ban
The skill-seeding tripwire asserted every seeded symlink target must NOT
start with ~/.claude — but on the default global-git install the repo
itself lives at ~/.claude/skills/gstack, so every CORRECT symlink (which
must resolve into the live repo tree, as the very next assertion requires)
carried the banned prefix. The test could never pass on a default install:
pristine v1.64.1.0 (c118e240) fails it in any worktree under
~/.claude/skills/ and passes elsewhere (verified 2026-08-15).
Exempt targets that realpath into the resolved repo ROOT before applying
the operatorClaude ban — realpath both sides so a symlinked HOME can't
dodge the tripwire. Genuine escapes (a target under ~/.claude but outside
the repo) still fail with the escape message.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen-skill-docs): quote YAML inline scalars containing '...' (Bun strict parser breaks on bare ellipsis)
A bare ... inside a plain YAML scalar is a document-end marker that strict
YAML parsers (Bun.YAML among them) reject mid-scalar. catalog-trim truncation
appends '...' to any description whose lead exceeds 200 chars, so any
truncated description would generate a SKILL.md with unparseable frontmatter.
Add the ellipsis test to toYamlInlineScalar's needsQuote so such scalars are
emitted double-quoted, plus unit coverage for the quoting rules.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen-skill-docs): throw when a template contains {{PREAMBLE}} twice
Hardens the #2508/#2362 class: a second {{PREAMBLE}} occurrence — even a
prose mention, which is exactly how spec/SKILL.md.tmpl re-expanded the full
~12K-token preamble mid-document — now fails generation with the template
path instead of silently shipping a doubled preamble. Pure exported guard
(assertSinglePreamble) called from resolvePlaceholders, unit-tested with the
original prose-mention shape.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): classify catalog-trim.test.ts as tree-mutating
Discovered while landing the duplicate-{{PREAMBLE}} guard: importing
scripts/gen-skill-docs.ts executes its top-level body, which regenerates the
entire claude host (71 GENERATED files) at import time. catalog-trim.test.ts
does that import from a PARALLEL shard — the same read-during-regeneration
hazard class as #2532, invisible only because the regen is byte-identical on
a fresh tree. Move it to the serial tree-mutating window.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): prepush hook test builds PATH with a POSIX-only separator
`test/redact-prepush-hook.test.ts` shadows `git` with a stub by prepending a
temp dir to PATH, built as `${stubDir}:${process.env.PATH}`. On Windows the
separator is `;`, so that produces one unparseable entry, the stub is never
found, and the REAL git runs — the diff succeeds, `gitStrict` never throws, and
the hook exits 0 where the test expects 1. It fails as a wrong assertion rather
than as a portability problem, which is what made it hard to place.
Replace it with a `prependPath` helper mirroring the one already in
test/gstack-brain-context-load.test.ts, which handles both platform details:
`path.delimiter`, and a case-insensitive lookup of the existing env key —
Windows commonly spells it `Path`, and adding a second `PATH` alongside an
inherited `Path` leaves the winner up to the spawn implementation.
On POSIX the helper resolves to `{ PATH: binDir + ":" + process.env.PATH }`,
byte-identical to the expression it replaces, so behaviour there is unchanged.
Fixing the separator alone does not make the test pass on Windows, and it
cannot: the premise is that a signal-killed child yields `spawnSync`
status === null, and Windows has no equivalent (a force-killed process reports
a non-zero exit code). The stub is also a `#!/bin/sh` file named `git`, which
Windows will not execute, since process creation resolves through PATHEXT and
ignores the shebang. A Windows variant would assert the non-zero-exit branch
instead — a different branch than the test name claims — so the test is gated
with test.skipIf(process.platform === "win32"), matching
test/session-runner-timeout.test.ts and test/setup-emoji-font.test.ts.
Windows before: 14 pass, 1 fail. After: 14 pass, 1 skip, 0 fail (3 consecutive
runs). Unchanged on POSIX, where it should still run and pass — worth
confirming in CI, since I can only verify the Windows half here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(artifacts): sync the decision store, which no allowlist glob matched
gstack-decision-log enqueues projects/<slug>/decisions.jsonl after every write,
but none of the 16 managed globs matched it, so compute_paths_to_stage rejected
every one at its "must match at least one allowlist glob" check.
The writer and the syncer disagreed silently: enabling artifacts sync backed up
learnings, plans, designs and timelines -- everything except the durable decision
ledger -- and nothing reported a miss, because a dropped path prints exactly what
a synced one does when the queue is otherwise empty.
Add the three decisions.* globs and class them artifact so they also sync in
artifacts-only mode.
The test reads the heredocs out of the script rather than executing it:
gstack-artifacts-init.test.ts drives the real script through #!/bin/bash shims and
a colon-separated PATH, so it cannot run on Windows -- the platform where the
companion slug bug bit.
* fix(windows): resolve the project slug natively when gstack-slug cannot spawn
bin/gstack-slug is a `#!/usr/bin/env bash` script with no file extension. Windows
honors neither the shebang nor PATHEXT for an explicit path, so spawnSync fails
ENOENT and resolveSlug returned its literal fallback, "unknown".
Every decision on the machine was therefore filed under
~/.gstack/projects/unknown/ -- one bucket shared by every project -- while the
bash-side Context Recovery preamble resolved the real slug, found no
decisions.active.json there, and skipped through a bare `if [ -f ... ]` with no
else.
Nothing failed. Both decision bins (log and search) missed identically, so writes
and searches stayed consistent with each other, and the only component that
resolved correctly was silent by design. Measured on one machine: 62 decisions
accumulated over 10 days and 170 skill runs, surfaced zero times.
shell:true is not the fix here, unlike #1731 -- cmd.exe cannot run a bash script
either. Nor is re-spawning through `bash`: on Windows that frequently resolves to
WSL, whose $HOME and /mnt/c paths yield a different slug AND a different cache
directory, trading one split store for another.
Instead, port gstack-slug's own three steps (cache -> git remote -> basename),
keeping its alphabet and its MSYS-form cache key so both paths agree. The
fallback is win32-gated, so POSIX behaviour is byte-identical.
Tests exercise the fallback on every platform (only the gating is win32-specific),
so POSIX CI catches a regression that would otherwise surface only on a Windows
user's disk, plus a static gate pinning the platform check.
* fix(security): guard brain-sync arithmetic against injected .brain-last-pull; sanitize _GBRAIN_HOST
Re-derived from PR #2588 under the generated-file screening rule (resolver
hunks taken; SKILL.md files regenerated, not accepted). A poisoned
.brain-last-pull could reach bash arithmetic ($(( ))) — a code-execution
vector from a writable state file; the timestamp is now validated numeric
before use. _GBRAIN_HOST from ~/.claude.json is clamped to hostname-safe
characters before echo. Ship goldens refreshed to the regenerated output.
Co-authored-by: sneakygriff <89592870+sneakygriff@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(sync): run gstack-brain-sync through bash, not cmd.exe, on Windows
The brain-sync stage failed on EVERY Windows run with "is not
recognized as an internal or external command", so /sync-gbrain always
reported ERR brain-sync among otherwise green stages.
#1731 gave these spawns shell: NEEDS_SHELL_ON_WINDOWS. That is correct
for the gbrain.cmd shim and does nothing here: shell:true routes through
cmd.exe, which resolves .cmd/.bat via PATHEXT but has no concept of a
shebang, so an extension-less bash script is rejected outright. A .cmd
shim needs a shell; a shebang script needs an interpreter. The two cases
look identical and are not.
The failure was quiet rather than loud. artifacts_sync_mode defaults to
pushing curated artifacts to git, so a Windows user's learnings piled up
uncommitted in ~/.gstack indefinitely while the sync report showed one
red line out of four.
New bashScriptInvocation() resolves Git for Windows' bash explicitly and
passes the script as argv[0]. It prefers Git bash over a bare `bash` on
PATH because WindowsApps ships a bash.exe that is the WSL launcher, which
would read C:\... as a Linux path; GSTACK_BASH overrides for unusual
installs; forward slashes because bash treats backslashes as escapes; and
it returns null when no bash exists so the stage says so plainly instead
of surfacing an unactionable spawn error.
The #1731 tripwire asserted the shape that does not work, so it now
asserts the opposite (never a raw spawnSync(brainSyncPath, ...)) and six
unit tests cover the resolver.
Verified on Windows: the stage now reports "OK brain-sync curated
artifacts pushed (4.2s)" and the artifacts repo committed + pushed on its
own. Affected-test set unchanged at 14 pre-existing failures before and
after, with 6 new passing tests.
* fix(gbrain): quote cmd.exe arguments at a single gbrain invocation seam
Fixes#2471. With shell:true on Windows, node/bun join argv into one cmd.exe
string without quoting, so a repo path with a space — the default
C:\Users\First Last\ layout — split into two arguments and every gbrain call
carrying a path silently targeted the wrong location (worst: `sources add
--path`). All gbrain CLI invocations now build their (cmd, argv, shell)
triple through gbrainInvocation(), which quotes risky arguments for cmd.exe's
re-parse (embedded quotes doubled). The four direct spawn sites in
lib/gbrain-sources.ts route through the seam; the #1731 static invariant is
upgraded for seamed files (any direct "gbrain" opener is the violation) and
kept as-is for lib/gbrain-local-status.ts. POSIX behavior unchanged
(shell:false, passthrough argv).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(brain-sync): classify queue entries, rewrite surgically, re-push stranded commits
Fixes#2549 (P0 data loss). Every drain exit previously truncated the WHOLE
queue (six `: > "$QUEUE"` sites), which (a) destroyed privacy/mode-held
entries while misattributing them as "no allowlisted changes", (b) destroyed
entries enqueued concurrently during the drain, and (c) left push-failed
commits stranded locally with nothing ever re-pushing them until unrelated
new work arrived.
Now: compute_paths_to_stage classifies every entry (stageable / retained
privacy-held / dropped skipped-invalid-unmatched-missing); rewrite_queue
re-reads the LIVE queue at mv time and removes only this drain's processed
paths (retained + concurrent appends + unparseable lines survive; atomic
tmp+mv); an unpushed-commit detector at run start re-pushes stranded local
commits (receipted fail-closed; a receipt refusal skips the retry rather
than wedging the drain; guards missing origin/<branch>; runs inside the
existing lock). Status lines carry counts; full drop paths go to a 0600
sidecar (.brain-sync-drops.json) so filenames stay out of transcripts.
--drop-queue remains the one intentional truncation.
Matrix added: privacy retention, unmatched/missing counted drops + sidecar
mode, unparseable-line preservation, surgical same-drain retention, push-fail
commit retention + detector re-delivery on an EMPTY queue, receipt-refusal
skip. 35/35 in test/brain-sync.test.ts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gbrain): make --full do a full code walk, not a delta one
`runCodeImport()` walked with a bare `gbrain sync --strategy code --source X`.
The strategy is right, but that walk is incremental: it only revisits files
changed since the source's checkpoint. A file missed at the ORIGINAL import is
therefore never revisited and stays out of the index indefinitely.
The reindex-code pass below cannot rescue it. It re-chunks pages that already
exist and never walks the filesystem — the same property the comment directly
above already relies on when explaining why the walk has to run first. That fix
landed one flag short: it made a fresh source get pages at all, but left
`--full` unable to discover a file the first walk skipped.
Net effect: `/sync-gbrain --full` did not perform a full walk, and re-running it
never re-detected the gap.
The failure is silent, which is what makes it expensive. Nothing errors, nothing
warns, and the verdict block still reports OK while `gbrain search` and
`gbrain code-def` answer out of a partial index. It reads as "gbrain is weak at
code questions" rather than "the index is incomplete".
Measured on two local code sources before and after this change, counting
exported functions resolvable via `gbrain code-def`: one went from 61/201 (30%)
to 180/201 (89%), importing 79 files that had no page at all; the other had
whole source files missing entirely and reached 93%. Both had been serving
search from a partial index for weeks.
Scoped to `--full` so incremental runs stay fast. `--yes` because this spawns
non-interactively and a full walk otherwise prompts to confirm import cost.
Anyone can check their own brain without applying this:
gbrain sync --source <id> --strategy code --full --dry-run
and compare "N file(s) would be imported" against that source's page_count.
Worth knowing while doing so: the default strategy is markdown and --strategy
is per-invocation, never persisted on the source, so dropping the flag reports
strategy=markdown and a handful of files.
* fix(brain-cache): honest 'missing' instead of fabricated-empty digests on gbrain failure
A gbrain-unreachable failure in fetchRecentDecisions and fetchSalience
used to be converted into a cached 'successful' empty digest ("_No prior
skill runs recorded._" / "_No salient pages in last 14d._") that
refreshEntity stamped with last_refresh. The false negative then
survived every subsequent TTL cycle, indistinguishable from a genuine
zero-rows result. Now failure returns null, so cmdGet's existing
missing/stale-fallback machinery reports the true state — matching what
fetchGoals and fetchSimplePage already do on failure.
Also adds an Array.isArray guard in fetchRecentDecisions so a malformed
payload ({pages: {}} etc.) classifies as failure instead of crashing
refreshEntity mid-refresh; a genuinely empty pages array still renders
the honest empty digest.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): give the schema-mismatch rebuild test a load-proof budget
The rebuild path refreshes every per-project entity against the real gbrain
CLI; with an unreachable brain each spawn runs to its own timeout, and under
machine load the stack exceeds bun's 5s default (observed 5.2-5.4s,
identically on pre-#2587 binaries — a load flake, not a regression). 30s
budget matches the sibling brain-sync suite's convention.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(memory-ingest): parse the current Codex response_item rollout shape
Fixes#2105. Codex rollout JSONL moved to
{ type: 'response_item', payload: { type: 'message', role, content: [...] } };
the parser's legacy payload.message branch never fired on it, so every Codex
session imported as an empty shell (message_count: 0 — 243/243 sessions on
the reporting machine). Both shapes now parse; non-message response_items
(reasoning etc.) are ignored. parseTranscriptJsonl exported for direct unit
tests (CLI path unchanged — import.meta.main guard).
Note: #2104's staging-in-gitignored-tree half is already defended on main
(--include-gitignored + GIT_CEILING_DIRECTORIES, #2144, plus the #2486
reconcile guard) — verified, no change needed; it moves to the close-only
roster.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): refresh codex/factory ship goldens from post-#2588 regeneration
The #2588 absorb refreshed all three ship goldens, but `bun run
gen:skill-docs` regenerates the CLAUDE host only — the codex/factory goldens
were copied from artifacts rendered before the resolver change and failed
against a fresh external-host regen in the serial test phase. Re-rendered
with --host codex / --host factory and re-copied.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(make-pdf): boolean flags no longer swallow the next positional argument
Fixes#2514. The parser treated any non-flag token after a flag as its value,
so `$P generate --toc essay.md` ate essay.md as --toc's value and failed with
"missing input" — the skill's own documented usage only worked when two
boolean flags happened to be adjacent. BOOLEAN_FLAGS enumerates the no-value
flags; value flags (--watermark, --to, --title, ...) are unchanged. main()
now runs behind import.meta.main so tests import the parser directly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(repo-mode): probe GNU stat before BSD so Git Bash stops crashing
Fixes#2195. On GNU coreutils `stat -f` SUCCEEDS (filesystem status, not a
format string), so the BSD-first fallback chain never fell over — it fed
multi-word filesystem output into the cache-age arithmetic and crashed under
set -u on Windows Git Bash. GNU `stat -c` fails cleanly on BSD/macOS, making
GNU-first deterministic on both; the mtime is numeric-validated before
arithmetic as a last line of defense.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(retro): point the prior-retros context query at files /retro actually writes
Fixes#2552's live half. The gbrain context-query glob targeted
~/.gstack/projects/<slug>/retros/*.md — a directory and extension nothing
writes — so prior-retro recall was dead on every brain-aware run. /retro
saves to .context/retros/*.json (repo-local); the query now reads that. The
issue's second defect (quoted-tilde orphan sweep) is already fixed on main —
the preamble sweeps with "$HOME/..." — verified, no change needed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(sync-gbrain): remove the capability-check page file left in the user's repo
Fixes#2503. On worktree-pinned brains `gbrain put` materializes the checked
page as _capability_check_<pid>.md in the current directory (the user's
repo), and `gbrain delete` removes the page but not the file — every
/sync-gbrain run left a stray file in the repo root. The check now deletes
the materialized file explicitly after the page delete.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(browse): warn that hover scrolls and the daemon tab persists across sessions
Fixes#2445. Both behaviors are by design but produced confidently wrong
verification output: hovering a below-the-fold element scrolls the page
before a "rest state" screenshot (exit 0, wrong section), and the daemon's
tab survives sessions so a bare `reload` can act on whatever earlier work
left open. The screenshot-evidence section now names both traps with the
concrete guards (assert window.scrollY; always goto before verifying).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gitattributes): pin *.txt to LF
.gitattributes pins LF for every other text format in the repo (*.md,
*.tmpl, *.yml, *.yaml, *.json, *.toml, *.sh, *.ts, extensionless scripts,
even the hash-pinned diagram-render dist files). *.txt is the one text
format left unpinned.
On Windows with core.autocrlf=true, that means the two tracked .txt files
are rewritten to CRLF at checkout and then read as permanently modified:
gstack/llms.txt +174 bytes
make-pdf/test/fixtures/combined-gate.expected.txt +20 bytes
git status is never clean, and /gstack-upgrade's 'git stash' step saves a
phantom stash on every upgrade — one that pops back to an empty diff.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(setup): install every skill runtime asset for the Claude host
On a fresh Claude install, link_claude_skill_dirs installed only SKILL.md
(+ sections/) per skill. Every skill that reads a sibling runtime file at
.claude/skills/<name>/<file> was broken out of the box: /review stopped at
'Read .claude/skills/review/checklist.md' (file never installed), and qa's
templates/references, plan-devex-review's dx-hall-of-fame.md,
gstack-upgrade's migrations/, and careful/freeze's bin/ hooks were all
silently missing. Codex/Factory/OpenCode/Kiro installers already copied
these; the primary host never did.
Fix: a shared _link_skill_runtime_assets helper installs EVERYTHING a skill
ships next to its SKILL.md, with an explicit exclusion list (F7):
node_modules, dist, test, *.tmpl, hidden files. Exclusion-list polarity
means a newly added asset installs by default instead of being silently
dropped. Assets refresh unconditionally on re-run (rm + relink/copy), so
Windows real-dir copies pick up changes after git pull.
New free test runs the real installer functions against the live repo into
a temp skills dir with a TWO-CLASS referenced-paths assertion (ENG-OV7):
alias-relative refs (.claude/skills/<name>/<path>) must exist under the
install; repo-anchored refs (~/.claude/skills/gstack/<path>) must exist in
the tree modulo an explicit built-artifact allowlist (browse/design/
make-pdf dist + the compiled gstack-global-discover). Known-broken class-2
refs (#2250 bare bin names) are ratcheted: the test fails if they quietly
start existing without the entry being removed.
Fixes#2317Fixes#2454
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): alias skills install as rewritten copies, never symlinks
The two back-compat alias dirs — _gstack-command (root router) and
connect-chrome (→ open-gstack-browser) — symlinked the canonical SKILL.md
verbatim, so each alias re-served the canonical frontmatter name:. Claude
Code keys skills on that name and requires global uniqueness: the
connect-chrome duplicate silently shadowed /open-gstack-browser (whichever
readdir returned first won), and the _gstack-command duplicate could drop
the ENTIRE personal-skills set — every /gstack command vanished until the
user hand-deleted the alias dirs, and the next setup re-broke it.
Fix: copy-then-rewrite. A shared _install_alias_skill_md helper reads the
SOURCE SKILL.md and writes a fresh copy with name: rewritten to the alias
dir's own name (_gstack-command / connect-chrome / gstack-connect-chrome).
sed never edits in place: on Unix the old install was a symlink into the
repo, and an in-place rewrite through it would have corrupted the generated
source (eng review E2). bin/gstack-relink gets the same treatment for its
root-alias helper, and its discovery loop now skips symlinked source dirs
so the connect-chrome repo symlink can't re-mint the duplicate.
Tests assert: installed aliases are NOT symlinks, carry their own unique
names, all installed frontmatter names are globally unique, re-runs refresh
cleanly, legacy symlinked aliases are replaced not written through, and the
source files stay byte-intact.
Fixes#2511Fixes#2201
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): Windows re-runs refresh installed skills for codex/factory/opencode hosts
On Windows (Git Bash / MSYS2, no Developer Mode), _link_or_copy installs
REAL directory copies. The install guards in link_codex_skill_dirs,
link_factory_skill_dirs, link_opencode_skill_dirs, and create_agents_sidecar
only ran the copy when the target was a symlink or missing — true on the
first install, never again. Every subsequent ./setup after a git pull
reported 'gstack ready (codex).' and exited 0 while silently refreshing
nothing: users ran stale SKILL.md forever. (link_claude_skill_dirs already
handled this; the other hosts never got the treatment.)
Fix: all five guard sites bypass the symlink-or-missing check when
IS_WINDOWS=1 — _link_or_copy rm -rf's the destination first, so the real-dir
copy refreshes in place. Unix behavior is unchanged (symlinks still pass the
guard via -L and serve updates without re-copying).
The new bash-fixture test drives the REAL extracted functions through the
install → upstream change → re-run cycle under IS_WINDOWS=1 (v1 must become
v2), pins the sidecar-skip behavior, checks the Unix path stayed a symlink,
and statically asserts the bypass at all five sites so factory/opencode
can't regress. Registered in the Windows-safe curated list
(KNOWN_WINDOWS_SAFE) so it actually runs on the windows-latest CI lane —
the 'bin/' pattern hit is a fixture path segment, not a shebang spawn.
Fixes#2444
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(uninstall): remove real-directory skill installs, gated on provenance
On Windows, setup installs skills as REAL directory copies (cp -R via
_link_or_copy). gstack-uninstall's per-skill loop filtered on [ -L ], so
every copy was skipped: --force exited 0 and printed 'gstack uninstalled.'
while leaving ~52 gstack-* directories plus _gstack-command/ behind in
~/.claude/skills. The same filter also missed the standard Unix shape (real
dir + symlinked SKILL.md), which was left as a dangling-symlink husk.
Fix: the loop now handles all three install shapes. Symlink entries keep
the existing readlink check. Real dirs with a SYMLINKED SKILL.md are removed
when the link points into gstack (same semantics as setup's cleanup
helpers). Real dirs with a REAL-FILE SKILL.md — the Windows copy shape — are
removed ONLY when both provenance gates pass (F8): (a) the directory name is
in gstack's skill inventory (source dir names, frontmatter names, gstack-
prefixed variants, and the alias dirs), and (b) the SKILL.md carries the
existing generated banner '<!-- AUTO-GENERATED from' (ENG-OV10: every
pre-v1.67 copy already carries it; a NEW marker would refuse to delete
legitimate old installs, recreating the bug). Anything failing a gate is
listed to stderr and never deleted — a user's own skill that happens to
share a name with a gstack skill survives.
Tests: a fake-tree fixture covers removed/kept/listed for every shape
(including the F8 name-collision row), and a census test asserts every
installable skill's generated SKILL.md carries the banner so the gate can't
strand a bannerless skill. Registered in the Windows-safe curated list —
the copy shape is exactly what windows-latest exercises.
Fixes#2563
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(setup): wire --host cursor through the full install path
'./setup --host cursor' was accepted by the flag parser and then did
nothing: no INSTALL_CURSOR branch existed, so the script built binaries,
printed no 'ready' line, and installed zero skills — Cursor users had no
way to install gstack at all.
Full install slice, re-derived from PR #2547 by @szsunyuan onto the
current installers: generate .cursor/ skill docs (host config already
existed), create a minimal ~/.cursor/skills/gstack runtime root (root
SKILL.md + bin/lib/browse assets + review checklist pair + ETHOS.md +
supabase config — bin and lib travel together because bin scripts import
../lib), link the generated gstack-* skills, and plant the repo-local
.cursor/skills/gstack sidecar WITHOUT ever wiping the generated SKILL.md
files it shares a directory with (link-before-sidecar ordering keeps the
generation fallback alive). Auto mode detects Cursor via the cursor
binary or the ~/.cursor footprint. gstack-uninstall removes
~/.cursor/skills/gstack* and per-project .cursor/skills/gstack* — and
never rmdir's .cursor itself, where Cursor stores user rules.
Re-derivation deltas from the PR: the link guards carry the #2444
IS_WINDOWS bypass (re-runs refresh real-dir copies), lib/ and
supabase/config.sh ride along like every other runtime root, and the
hosts/cursor.ts sidecar field is omitted (HostConfig no longer carries
one — sidecar behavior lives in setup).
Fixes#1358
Co-authored-by: Yuan Sun <forrest.sun527@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(settings): include command in add-event dedup key (#2382)
Fixes#2382.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(setup): render the gbrain :user variant to an out-dir — global installs stay git-clean
On a global-git install with gbrain, ./setup and 'gstack-config
gbrain-refresh' ran gen:skill-docs:user IN PLACE inside the install
checkout, rewriting ~16 TRACKED SKILL.md files. The checkout stayed
permanently dirty, every /gstack-upgrade 'git stash' saved a redundant
snapshot of generated content, and the growing stash list invited a 'git
stash pop' that would lay stale instruction markdown from an older gstack
over the current version — a quiet wrong-rules failure mode.
Fix, wired through machinery that already existed (gen-skill-docs
--out-dir + the symlink install layer): brain-aware SKILL.md now renders
into the untracked ~/.gstack/render/claude, and both Claude installers
serve the render when present — setup's link_claude_skill_dirs prefers
$GSTACK_HOME/render/claude/<skill>/SKILL.md, and bin/gstack-relink does
the same so a later config change can't silently flip skills back to the
blockless canonical source. setup wipes and rebuilds the render each run,
repoints installed skills after a successful render, and removes a stale
render (re-linking canonical) when gbrain is gone. gbrain-refresh renders
to the out-dir and repoints via relink; its 'this dirties the install's
git tree' caveat is retired because it no longer does.
A one-time upgrade migration (gstack-upgrade/migrations/v1.67.0.0.sh, F12)
restores the legacy dirt: unstaged modifications to SKILL.md / sections/
*.md files in the install checkout are git-checkout'd back to canonical;
anything outside that footprint (user edits, untracked files, staged work)
is left alone and reported. Idempotent, non-fatal, symlinked installs
skipped.
Tests: render-preference behavior for both installers, static pins that
every executable :user invocation carries --out-dir and the caveat text is
gone, migration fixture (restore/leave/idempotent/no-op matrix), and the
existing out-dir render test now asserts 'git status --porcelain' gains
zero new entries across a full :user render.
Fixes#2569
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): close the remaining #1946 fail-opens — detection coverage + one-time consent
Two of #1946's reported gaps were still open after the v1.64 fail-closed
work (the git-error and oversized-diff paths in bin/gstack-redact-prepush
are already strict, chunked, and pinned by tests):
1. Detection fail-open: env.kv required an UPPERCASE name with an '='
assignment, so 'api_key=…', 'apiKey: "…"', and 'password: …' — the
most common real config shapes — produced NO finding at all. The pattern
is now case-insensitive, accepts ':' (YAML/JSON) as well as '='
assignment, and handles quoted JSON keys. It stays MEDIUM and
entropy-gated per the calibration rule (a generic net that cries wolf
gets bypassed), with pinned cases for each closed shape plus the
placeholder/entropy negatives.
2. Install fail-open: nothing ever offered the guard, so a plain 'git
push' scanned nothing and users believing themselves protected weren't.
setup now asks ONCE for consent on a real interactive terminal
(maintainer decision 6): an explicit answer is recorded to the existing
redact_prepush_hook key and never re-asked; a timeout or non-interactive
run changes nothing and keeps the hint-only posture. Default stays
FALSE, and setup still never installs the hook itself — /ship owns the
per-repo install (the wrong-repo invariant is pinned by the existing
'setup carries the hint only' test).
Tests: per-shape pattern cases, prompt gating statics (key-absence + TTY +
timed default-N read), timeout-persists-nothing, non-interactive stays
hint-only with no key write, and recorded-answer-is-silent behavior runs.
Contributes to #1946 (the pre-push guard's fail-closed scan paths landed
in earlier releases; this closes the coverage and consent gaps it names).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(hooks): Stop hook closes dangling timeline entries — fail-open
The preamble writes event:'started' to the project timeline at every skill
start, but the matching 'completed' write lives in prose at the END of the
skill workflow — unenforceable. An interrupted session, a context blowout,
or an agent that simply stops leaked started > completed forever, and the
leak was unrepairable after the fact (observed live in #2553).
New hosts/claude/hooks/timeline-stop-hook (+ .ts, question-log-hook shim
pattern): on Claude Code's Stop event it appends event:'completed' with
outcome 'unknown' and source 'stop-hook' for every 'started' entry in the
project timeline that has no matching completion. setup registers it via
gstack-settings-hook add-event (Stop was already an accepted event) under
its own source tag, idempotently; --no-team and gstack-uninstall remove it.
FAIL-OPEN contract (F5), pinned by tests: ALWAYS exits 0 — corrupt
timeline (bad lines skipped individually, valid ones still repaired),
missing timeline, garbage/empty stdin, bun missing from PATH (the shim
'|| true's), and an over-cap timeline (10MB skip) all repair nothing and
block nothing; errors land in ~/.gstack/hook-errors.log best-effort. The
write path is append-only with a ~2s internal budget, and a second Stop is
a no-op (already-closed entries never re-close). Correlation is
project-scoped by design — the preamble's session id is shell-local, so a
concurrent same-project session's entry may close early as a traceable
source:'stop-hook' row rather than a silent leak; the header documents the
trade-off.
Fixes#2553
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ios-qa: guard DebugBridgeTouch.m on DEBUG, not just TARGET_OS_IOS
DebugBridgeTouch.m and its header both promise the code is DEBUG-only and
never shipped:
"Uses these private UIKit selectors (DEBUG-only; never shipped to App Store)"
"DEBUG-only — never link in Release."
Nothing enforced it. The only guard was `#if TARGET_OS_IOS`, so a Release build
for iOS compiled the entire implementation in, private API and all.
Measured on a real app (an iOS Release build, `nm -j` on the app binary):
DebugBridge symbols 15
IOHIDEventCreateDigitizer 2
AXSSetAutomationEnabled 1 symbol, 2 strings
IOKit.framework 4 strings
including +[DebugBridgeTouch sendTapAtPoint:inWindow:] and
_OBJC_CLASS_$_DebugBridgeTouch. That is a Guideline 2.5.1 private-API exposure
in a shippable binary, and it fails Package.swift's own stated CI invariant:
nm -j build/Release/<binary> | grep -q DebugBridge && exit 1
WHY THE EXISTING GUARD DOES NOT COVER THIS
Package.swift documents the protection as `.when(configuration: .debug)` on the
consuming target's dependency. That works for SwiftPM consumers. It cannot be
expressed by an app that integrates DebugBridge as a local package inside an
.xcodeproj: Xcode's Filters column under Frameworks, Libraries, and Embedded
Content offers platform conditions only — iOS, macOS, visionOS — never build
configuration. So for xcodeproj consumers the documented guard silently does
nothing, which is precisely the case that was measured.
The Swift targets were already safe: all four .swift files are `#if DEBUG`
guarded and Package.swift defines DEBUG for them via swiftSettings. Only the
Objective-C target, the one that actually links private API, was unguarded.
THE FIX
1. DebugBridgeTouch.m.template now branches `#if !defined(DEBUG)` first and
emits nothing at all in Release, falling through to the existing iOS and
non-iOS branches only in Debug.
2. Package.swift.template declares DEBUG explicitly for the ObjC target:
cSettings: [.define("DEBUG", .when(configuration: .debug))]
The two Swift targets already did this. Relying on SwiftPM's implicit DEBUG
for C-family targets is not worth betting a private-API exposure on.
VERIFIED, by compiling the generated file for iOS both ways:
xcrun -sdk iphoneos clang -c DebugBridgeTouch.m -arch arm64 ...
Release (no -DDEBUG) 0 DebugBridge symbols, 0 private-API symbols, 448 B
Debug (-DDEBUG=1) 7 DebugBridge symbols, 6 private-API symbols, 13104 B
The harness is unchanged in Debug. Release now emits an empty translation unit.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(ios-qa): bridges search front-most presented content first
A presented sheet sits AFTER the screen it covers in window.subviews, so
the elements walk emitted the covered screen first — a client taking the
first match for a label activated a control the user cannot reach, and
the agent saw a success (measured on a real app: the sheet's 'Create'
button ranked 210th behind 35+ covered-screen entries). Menus, alerts and
action sheets were worse: each gets its OWN UIWindow, so keying off
isKeyWindow missed them entirely — absent from /elements, dropped from
/screenshot, untappable via /tap.
Re-derived from PR #2397 by @IDSTUK onto the current bridge templates
(the SwiftUI tap-reliability rework had moved underneath the PR):
ScreenshotBridgeImpl gains orderedWindows(in:) (visible windows front-most
first by windowLevel then insertion order, PassThroughWindow overlays
still filtered), frontmostWindow(), and searchRoots() (per window, the
top-most presented view controller's view before the window itself).
/elements walks those roots in order through the existing shared
visited-set + budget, so overlapping roots emit each view once at its
front-most position; /tap targets frontmostWindow() for both the
accessibility-activation and synthesized-touch paths; /type and /swipe
search the roots in order; /screenshot composites every window
back-to-front at the existing 1x scale. The two now-dead private
activeScene/activeKeyWindow copies in ElementsBridgeImpl and
MutationBridgeImpl are removed.
Fixture mirror synced byte-for-byte; verified with a full
'xcodebuild build -scheme FixtureApp-Package -destination
generic/platform=iOS Simulator' (BUILD SUCCEEDED, DEBUG guard from the
previous commit included).
Co-authored-by: IDST UK <IDSTUK@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup-gbrain): invoke gstack-memory-ingest/gstack-gbrain-sync via bun run + .ts
/setup-gbrain's transcript-ingest steps told the agent to run
bin/gstack-memory-ingest and bin/gstack-gbrain-sync by BARE name. Neither
exists — only the .ts files ship (mode 644, no bin alias) — so the agent
dutifully reported 'script missing at install root' and the ingest/full-
sync steps dead-ended on every host (hit live under Codex; the Claude
render carries the same text).
All four template sites (probe, silent-bulk, post-answer full sync, the
preamble-hook incremental mention) and the four memory.md reference-doc
sites now use the repo's established form: 'bun run <path>/gstack-memory-
ingest.ts …' / 'bun run <path>/gstack-gbrain-sync.ts …' — matching what
sync-gbrain already does. Generated SKILL.md regenerated from the template
in the same commit.
Re-derived from PR #2409 by @SomSamantray per the wave's screening rule
(the PR edited the generated SKILL.md directly; the generated file must
come from gen:skill-docs). The contributor's structural test rides along
as-is: bare-invocation regexes with negative .ts lookahead and backslash-
continuation coverage pin every site, so the drift can't return. The
referenced-paths ratchet in test/setup-claude-skill-assets.test.ts drops
its two #2250 known-broken entries — the class-2 assertion now guards
these paths again.
Verified against #2250's site list (template lines 690/735/784-area, all
covered) plus a fresh grep: zero bare invocations remain in the template
or memory.md; the one prose mention ('gstack-memory-ingest now persists…')
is not an invocation and stays.
Fixes#2250Fixes#2393
Co-authored-by: SomSamantray <SomSamantray@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): update four main-side assertions to the T3 installer contracts
Integration drift from the T3 lane: three static assertions pinned the OLD
implementation shapes that T3 legitimately replaced — the gbrain-refresh
branch no longer self-documents a reset --hard cycle (#2569 renders to an
untracked out-dir instead; the test now pins THAT), setup's regen block
renamed to the render form (re-anchored, same exit-code-propagation
invariant), and sections/ linking generalized into _link_skill_runtime_assets
(the _link_or_copy routing assertion moved into the helper). Fourth: the
uninstall neutral-target test asserted against os.tmpdir(), which reads
$TMPDIR at call time — a shard neighbor can leave it gstack-containing,
making the "neutral" symlink target match the provenance substring; the test
now falls back to a fixed neutral root and asserts neutrality explicitly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: whitelist engine-locked at all three gbrain-usable gates (#2456)
#2194 taught the classifier to report a PGLite lock held by a live
\`gbrain serve\` as engine-locked instead of broken-config, but none of the
three "is gbrain usable?" gates accepted the new status — so the symptom
moved from a wrong error to a quieter wrong suppression: gbrain-refresh
stripped GBRAIN_CONTEXT_LOAD / GBRAIN_SAVE_RESULTS blocks out of every
generated SKILL.md after every upgrade, on the RECOMMENDED /setup-gbrain
default (PGLite + local-stdio MCP spawns gbrain serve at session start).
engine-locked is the same class as timeout (#1964): the engine is
installed and healthy, a legitimate holder has the lock. All three gates
now agree:
- bin/gstack-gbrain-detect --is-ok exits 0 on engine-locked
- bin/gstack-config gbrain-refresh case arm renders instead of suppressing
- scripts/gen-skill-docs.ts --respect-detection treats it as detected
Test mirrors the existing timeout case in
test/gbrain-detection-override.test.ts (engine-locked renders brain
blocks; the sibling no-cli case still proves suppression works).
Applies the reporter's patch + test from the issue.
Fixes#2456
Co-authored-by: Mateus Moraes <mmoraes@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: detect bearer-token thin clients via host MCP registration (#2520)
The #2051 thin-client fix keys detection on the remote_mcp marker in
~/.gbrain/config.json — but that marker is only written by the OAuth path
(gbrain init --mcp-only). Bearer-token installs (gbrain connect <url>
--token, gbrain's own recommended default for local/personal use) never
touch config.json, so they fell through to the local probe, failed against
the dead-or-absent local engine, and landed on missing-config / broken-db /
broken-config / engine-locked — silently suppressing brain blocks for a
fully-working remote brain.
New evidence source: hasRemoteOnlyGbrainMcp() reads ~/.claude.json MCP
registrations (user scope AND project scope) with the same classification
rules as gstack-gbrain-detect's tier-3 fallback. File-read only — no
subprocess, no network (a classifier network probe is the #1964 pathology).
Wired at two sites in freshClassify:
- missing-config branch: a bearer thin client may never have run a local
init; if the host's only gbrain registration is remote-HTTP, that
registration IS the brain → thin-client.
- post-probe-failure demotion: broken-db / broken-config / engine-locked
reclassify to thin-client when the only gbrain registration is remote.
A local-stdio sibling registration blocks the demotion (federation
guard: a user running a local engine plus a remote team brain keeps
precise local statuses). "timeout" is excluded — already usable, and
may be a genuinely healthy slow local engine.
7 new unit tests in test/gbrain-local-status.test.ts: user-scope, project-
scope, engine-locked/broken-db demotion, federation guard, no-registration
discriminator, end-to-end --is-ok gate (35 pass total in the file).
Root-cause analysis by @d-danielsun in #2520.
Fixes#2520
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: resolve GBRAIN_HOME with gbrain's parent-dir semantics (#2521)
gstack treated GBRAIN_HOME as the config directory; gbrain's configDir()
treats it as the PARENT and always appends `.gbrain` itself (the contract
is explicit in gbrain's source: GBRAIN_HOME=/tmp/x → /tmp/x/.gbrain/
config.json). With GBRAIN_HOME set, gstack classified engine status from
a file gbrain never reads — the probe's two halves (file checks vs the
spawned `gbrain sources list`) looked at DIFFERENT installs, so any
resulting status was arbitrary: missing-config/broken-config against
healthy installs, or a thin-client marker gstack saw that gbrain itself
reported as "No brain configured".
New shared resolver `gbrainConfigDir()` in lib/gbrain-exec.ts is the
single source of truth. All seven gstack sites route through the contract:
- lib/gbrain-local-status.ts gbrainConfigPath (the classifier's file half)
- bin/gstack-gbrain-detect GBRAIN_CONFIG + readRemoteMcpUrl
- lib/gbrain-exec.ts buildGbrainEnv (the probe's DATABASE_URL seed —
fixing only the classifier would have left the split-brain in the
spawn half, flagged by the reporter)
- lib/gbrain-guards.ts gbrainHome (clones-dir + autopilot-lock paths)
- lib/gstack-memory-helpers.ts gbrainConfigPath (engine-tier fallback)
- bin/gstack-gbrain-install pre-doctor config check (shell)
Unit tests cover GBRAIN_HOME set (config found at $GBRAIN_HOME/.gbrain),
the old flat layout explicitly NOT read (both classifier and
buildGbrainEnv), and unset (~/.gbrain unchanged). Existing fixtures that
encoded the deviant flat layout are updated to gbrain's contract.
Root-cause analysis by @d-danielsun in #2521.
Deviation from the 3-site plan spec: the same deviant resolution existed
in four more sites (buildGbrainEnv, gbrain-guards, memory-helpers,
gbrain-install); fixing only three would have left gstack disagreeing
with itself as well as with gbrain, so the whole class moved to the
shared resolver in one change.
Fixes#2521
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: read project-scoped MCP registrations in gbrain detection (#2499)
Claude Code registers MCP servers at two scopes in ~/.claude.json: user
scope (.mcpServers) and project scope (.projects["/abs/path"].mcpServers
— what `claude mcp add` WITHOUT --scope user writes). Every gbrain
detection site read only user scope, so a correctly configured
project-scoped brain was invisible: brain-aware blocks suppressed,
remote-mode artifacts sync never recognised, and detectEndpointHash fell
through to the 'local' literal — two different project-scoped brains
hashed identically, so switching between them never invalidated the
cache, the exact scenario the function's docstring says it exists to
catch. Nothing errored; the features just quietly were not there.
Two sites fixed:
- scripts/resolvers/preamble/generate-brain-sync-block.ts: the shared
detection block (rendered into every tier-2+ SKILL.md) now resolves the
gbrain entry ONCE into _GBRAIN_MCP_ENTRY — user scope first, then the
nearest-ancestor project entry for $PWD that actually carries a gbrain
server (longest matching key with a path-boundary check: /a/repo never
matches /a/repo2; a nested project WITHOUT gbrain doesn't shadow its
parent's registration). _GBRAIN_MCP_TYPE and _GBRAIN_HOST extract from
the resolved entry, so claude.json is parsed once per skill start. All
SKILL.md files regenerated in this commit; the ship golden fixtures and
three carve-guard skeleton caps (plan-eng-review, plan-devex-review,
office-hours; ~1.5KB rendered growth per skill) are refreshed with
measured values.
- bin/gstack-brain-cache detectEndpointHash: same resolution order in TS
(user scope, else nearest-ancestor project entry by cwd, both path
separators for Windows keys).
Tests: rendered-output tests in test/gen-skill-docs.test.ts pin the
regenerated block (static markers + a FUNCTIONAL run of the exact
rendered lines against a fixture ~/.claude.json with only a
project-scoped registration, plus an outside-cwd discriminator);
detectEndpointHash unit tests in test/brain-cache-roundtrip.test.ts cover
project-scope resolve, path-boundary, nearest-ancestor distinct hashes,
and user-scope precedence.
Root-cause analysis by @samporter-31 in #2499.
Fixes#2499
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: /sync-gbrain respects an existing valid .gbrain-source pin (#2417)
/sync-gbrain always derived a new worktree-scoped source ID, even when
the repository already carried a valid .gbrain-source pin created through
the native GBrain source workflow — silently bypassing the selected
source boundary, registering a duplicate federated source, and routing
later dream/cycle checks to the wrong source.
Now a local pin is reused when it passes the fail-closed identity checks:
the ID is syntactically valid, the source is registered, and the
registered path realpath-resolves to the current checkout (so a stale or
copied dotfile can't redirect a sync into another repo's source). A
confirmed pin is treated as user-managed — synced and attached without
add/remove, legacy migration, or federation changes. Dry-run stays
spawn-free (reads only the local marker for previews). Missing, invalid,
stale, or unreadable pins fall back to the existing generated source ID.
Absorbs PR #2417 by @exGeni (applied via git am -3; 42 tests pass in
test/gstack-gbrain-sync.test.ts including the new pin-respecting
coverage: spawn-free dry-run, symlink-equivalent registered paths,
non-dry-run sync/attach with no add/remove, dream routing, unreadable
markers, config-backed env use).
Co-authored-by: Evgenii Lopatin <e75533@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: gstack-gbrain-install --dry-run no longer requires the network (#2540)
The GitHub reachability probe (curl --head, 10s max) was gated only on
--validate-only, so a --dry-run — which prints a plan and exits without
ever cloning — could fail with exit 3 "cannot reach https://github.com"
whenever the curl lost a race for sockets/DNS. Reproducible at ~15% by
running 60 dry-runs concurrently, and the cause of intermittent red in
the D5 detect-first tests, which call this exact path.
The probe now also skips under --dry-run: requiring the network for a
plan-print buys nothing and costs a real failure mode. Real installs
still fail fast when offline rather than hanging git clone.
Absorbs PR #2540 by @CarringtonCreative (applied via git am -3;
26 tests pass across test/gbrain-detect-install.test.ts +
test/egress-receipt-wiring.test.ts).
Fixes the offline/flake half of #2536.
Co-authored-by: Carrington Dennis <carrdenn3@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: accept 3-digit semver + package.json version sources (#2501)
Two version-source shapes failed CLOSED in a way that silently disabled
/ship's queue-collision check:
1. A --version-path / .gstack/version-path target that is a package.json
was read as raw text: the whitespace strip turned the JSON into
'{"name":"frontend",... which parseVersion rejected, so every read —
local, `git show`, and rival PRs' claims through the GitHub/GitLab
Contents APIs — fell back to 0.0.0.0 and competing claims were dropped
as "malformed".
2. parseVersion required exactly four components, so gstack-next-version
exited 2 on EVERY invocation in a 3-digit repo. That CLI IS the
queue-collision check; /ship then took its documented offline path of
naive local arithmetic, two branches cut from the same base picked the
same version, and git merged the duplicate without a conflict.
New lib/version-source.ts holds the shared semantics so both CLIs agree
by construction: parseVersion accepts 3- or 4-digit (3 pads the micro
slot for uniform comparison), versionWidth/fmtVersion keep a 3-digit repo
3-digit through bumping and formatting, micro coerces to patch on 3-digit
repos (with a warning in the output), and extractVersion reads a .json
version-path as JSON (.version) from any byte source. gstack-version-bump
treats a package.json version-path as that repo's single source of truth
(written in place, DRIFT_* states can't arise — no second file to drift
from). Detection is by shape, not new configuration.
Scope per the wave plan's version-tooling end-state spec (decision 11,
ENG-OV1): this is the READING capability + 3-digit acceptance ONLY.
gstack's own VERSION file stays the 4-digit source of truth; nothing here
flips authority to package.json. The PR's bundled fix for the
.gstack/version-path pin being ignored by classify's base read lands
separately (#2462) — these tests drive the JSON version-path through the
explicit --version-path flag.
Re-derived from PR #2501 by @YiftahR (73 tests pass across
test/gstack-version-bump.test.ts, test/gstack-next-version.test.ts,
test/ship-version-sync.test.ts).
Fixes#2501
Co-authored-by: YR <work.yiftah.rottem@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: write/repair sync npm lockfiles' version fields (#2567)
npm records the package version twice in its lockfiles — top-level
`version` and, in lockfileVersion >= 2, `packages[""].version` (the entry
describing the root package itself) — and `npm install` keeps both in
step. gstack-version-bump write/repair updated VERSION + package.json but
left the lockfile behind, so every /ship bump in an npm repo drifted one
field per release until someone ran npm, dirtying the tree on the next
`npm install` far from the cause.
write and repair now mirror the version into package-lock.json AND
npm-shrinkwrap.json (which shares the format and, when present, is what
npm actually honors) as a pure JSON edit — no npm spawn, no
dependency-tree churn, dependency entries untouched. Per the wave plan's
version-tooling end-state spec (decision 11): synced ONLY when the file
already exists, never created (gstack itself is bun-only). A failed
manifest/lockfile write keeps the existing exit-3 half-write semantics so
classify reports DRIFT_STALE_PKG on re-run instead of hiding the drift.
Tests: 5 new cases in test/gstack-version-bump.test.ts — both lockfile
version fields synced with deps untouched, repair heals a stale lockfile,
lockfileVersion 1 (no packages map) doesn't crash, npm-shrinkwrap.json
synced without inventing a package-lock.json, malformed lockfile exits 3
loudly (26 pass total in the file).
Re-derived from PR #2568 by @ortonom under decision 11.
Fixes#2567
Co-authored-by: ortonom <3261546+ortonom@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: subdirectory manifests + npm-valid version mirror (#2531)
Two gaps in gstack-version-bump's manifest handling, resolved to the wave
plan's version-tooling end-state spec (decision 11):
1. Subdirectory manifests. A repo whose only Node package lives in web/,
app/, or frontend/ has no ROOT package.json, so join(cwd,
"package.json") reported pkgExists:false and every bump silently wrote
VERSION alone — leaving the manifest to be bumped by hand, which is
exactly the drift this tool exists to prevent, in the one layout where
it silently did nothing. All three subcommands now resolve the
manifest as --package-json-path → .gstack/package-json-path →
./package.json (mirroring resolveVersionPath).
2. npm-valid mirror. VERSION is 4-digit MAJOR.MINOR.PATCH.MICRO; npm's
semver is 3-component and rejects a fourth, so mirroring the raw form
breaks `npm ci` in any repo npm actually manages. The manifest and its
lockfiles now carry the npm-valid 3-digit translation (1.67.0.0 →
1.67.0) via npmVersion() in lib/version-source.ts. VERSION stays the
4-digit source of truth. classify judges drift against the TRANSLATED
form — a correctly-synced `0.1.25` no longer reads as eternal drift
against `0.1.25.0` — and grandfathers the pre-v1.67 1:1 four-digit
mirror as in-sync (flagging it DRIFT_UNEXPECTED would hard-stop /ship
on every existing repo on upgrade day; the next write migrates the
manifest to the translated form). Lockfiles are synced beside the
resolved manifest — including beside a pinned JSON version-path — and
only when they already exist.
classify output gains pkgPath and expectedPkgVersion for observability;
write/repair report packageJsonPath + packageJsonVersion. The /ship Step
12 prose (ship/SKILL.md.tmpl) documents the resolution chain and the
translation; SKILL.md files regenerated and ship golden fixtures
refreshed in this commit.
Tests: subdirectory pin + --package-json-path override, translated-form
classify (FRESH/ALREADY_BUMPED, no false drift), grandfathered 1:1
mirror, genuine divergence still drifts, repair to the npm-valid form
(33 pass in test/gstack-version-bump.test.ts; 526 pass across the five
affected files including goldens and parity).
Re-derived from PR #2531 by @CarringtonCreative on top of the 3-digit/
JSON version-source work, under decision 11 (which resolves the PR's
lockfile-gated translation in favor of an unconditional npm-valid
mirror).
Co-authored-by: Carrington Dennis <carrdenn3@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: git-based version allocator when the PR queue is unreachable (#2545)
When the host query (gh/glab) failed, gstack-next-version returned
offline:true with an EMPTY claim set, and /ship's documented fallback was
local BUMP_LEVEL arithmetic. Local arithmetic cannot see a sibling's
claim, so the fallback allocated a version another open PR already held —
observed in a downstream repo where two merged PRs both read v0.1.57.0
(and an audit found four such duplicate pairs over three weeks).
New fetchGitClaimed() degrades the QUEUE VIEW without degrading the
ALLOCATION: git already knows what the API was asked for. It reads every
remote-tracking branch's pinned version file (through extractVersion, so
JSON version-paths resolve on remote refs too and each branch's own digit
width is preserved) plus the versions already shipped in the base's last
400 commit subjects (3- or 4-digit; the cap announces itself in warnings
when it truncates). The fallback runs only when the host told us nothing
— the online path is untouched — and the output gains a load-bearing
`fallback: "git" | null` field that /ship can branch on, plus explicit
warnings for both the recovered-from-git and the nothing-found cases.
Tests: end-to-end stub-gh offline contract (fallback:'git' + a valid
version + the warning), sibling-claim discovery from remote-tracking
refs, the pick advancing past the sibling's claim, shipped-subject
scanning, JSON version-path claims on remote refs, and non-repo
degradation to a warning (45 pass in test/gstack-next-version.test.ts).
Re-derived from PR #2545 by @CarringtonCreative under the wave plan's
version-tooling end-state spec; the PR's own VERSION/CHANGELOG stamping
is stripped (release stamping happens at /ship time, not per commit).
Co-authored-by: Carrington Dennis <carrdenn3@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: version-bump honors the .gstack/version-path pin in versionRel (#2462)
cmdClassify's current-version read already resolved the
.gstack/version-path pin, but versionRel — the repo-relative path fed to
`git show origin/<base>:<path>` — was derived from the CLI flag alone
(`argVal(args, "--version-path") ?? "VERSION"`). In a pinned repo with no
explicit flag, base and current therefore read DIFFERENT files: current
from the pinned file, base from the root VERSION. On a repo with no root
VERSION, the base always read 0.0.0.0 — and the pinned-JSON handling
never engaged, so a pinned package.json was read as raw text
(currentVersion 0.0.0.0) and `write` would have overwritten the manifest
with a bare version string.
New resolveVersionRel() resolves the pin's REPO-RELATIVE form once
(flag → .gstack/version-path first line → "VERSION"); classify, write,
and repair all derive both the relative and absolute paths from it, so
base and current reads can no longer diverge. The old resolveVersionPath
(which returned an absolute path `git show` cannot use) is folded in.
Unit tests (the ENG-OV6 spec case plus write/repair coverage): pin set +
no flag → classify reads base AND current from the SAME pinned file
(plain-text sub/VERSION and pinned frontend/package.json, both against a
real git base with NO root VERSION anywhere), write updates the pinned
manifest in place without inventing a root VERSION, repair treats the
pinned JSON as single-source, and the explicit flag still overrides the
pin (38 pass in test/gstack-version-bump.test.ts).
Re-spec'd per ENG-OV6 from the report in #2462 (the originally-filed
classify-read hypothesis was already handled; the live bug was the :138
versionRel derivation). Same fix shape independently identified in
PR #2501 by @YiftahR.
Fixes#2462
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: diff-scope glob coverage, honest exit contract, dirty-tree visibility (#2526, #2455, #2299)
Three silent-skip classes in bin/gstack-diff-scope, each of which quietly
disabled scope-gated reviewers in /ship and /review:
1. Pattern gaps (#2526, #2455). `*/api/*` required a path segment BEFORE
api/, so a root-level api/ layout (Vercel serverless, Next.js pages/api
at root) never set SCOPE_API — 63 serverless functions in the
reporter's payments repo, none ever classified, the API-contract
specialist silently skipped on every payment PR (it found a CRITICAL
when run by hand). Same for root-level migrations/. And the Rails
data_migrate gem's db/data/ data migrations — arbitrary Ruby run
unattended against production data — fell through to plain BACKEND, so
the [NEVER_GATE] data-migration specialist never got the chance to
run. Added: api/*, migrations/*, db/data/*, data_migrations/*.
2. All-false was indistinguishable from "could not look" (#2526). New
contract: empty change set → all false exit 0; >=1 match → flags
exit 0; changed files with ZERO matches → SCOPE_ERROR=unmatched + the
unmatched paths as comment lines + exit 2 (a new top-level layout now
trips loudly instead of invisibly disabling reviewers); unresolvable
base ref (shallow CI checkout) → SCOPE_ERROR=no_base + exit 2 instead
of a green that means "we could not look". Every output line stays a
shell-safe assignment or comment for sourcing consumers, which
tolerate the nonzero exit today (source ... || true / eval).
3. Uncommitted work was invisible (#2299). /ship detects scope in Step 9,
BEFORE it commits in Step 15, so the common start-work-then-ship flow
ran the classifier against an empty diff and skipped every reviewer.
The change set is now the UNION of committed diff + working tree +
untracked files. Also from #2299: the single first-match-wins case
made the nine flags mutually exclusive (Button.test.jsx set FRONTEND
but not TESTS; util.test.ts the opposite) — each category now gets its
own case, with BACKEND deliberately still excluding frontend
component/view files. And file listing is NUL-safe (git diff -z), so
non-ASCII paths no longer defeat extension globs via octal quoting.
Deliberate behavior change (flagged in #2299): with independent flags, a
backend test file sets BACKEND and TESTS, which can trip the security
specialist's SCOPE_BACKEND gate on test-only PRs — errs toward more
review, not less.
Table-driven tests cover every glob class (root api/, nested api/,
controllers, openapi, root/nested/prisma/db-migrate/db-data migrations,
dual-category test files, auth, prompts, docs, plain classes), the
four-state exit contract, dirty-tree + untracked visibility, and the
non-ASCII path case (39 pass in test/diff-scope.test.ts).
Fixes shaped by the reporters' patches: @grant-ship-it (#2526),
@mkyed (#2455), @ShahriarLak (#2299).
Fixes#2526Fixes#2455Fixes#2299
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact-prepush): don't re-scan commits a catch-up merge brought in
`remoteSha..localSha` is "everything new on this branch", which is not the
same as "everything new to the remote". Merge origin/main into a feature
branch and every commit main gained since that branch's last push becomes
an added line — content that is already published, already scanned, and
not this push's doing.
Two consequences, both observed:
· FALSE HIGH FINDINGS. A placeholder connection string in a fixture
someone else had already merged blocked an unrelated push as
db.url_with_password, telling the operator to rotate a credential
over a file they never touched. A guard that cries wolf on catch-up
merges is one people learn to bypass reflexively — which is exactly
how a real secret gets through.
· OVERSIZED SCANS. The SCAN_CHUNK_BYTES comment already records a
1,146,782-byte diff from "a feature branch catching up to a busy
main" blowing the engine's 1 MiB cap. Same root cause, treated there
as a size problem. Narrowing the range fixes the size too.
A two-dot range cannot express this: after merging main, neither the
remote tip nor the merge-base with main is an ancestor of the other, so
no single base excludes both.
The narrowed range is `rev-list localSha --not remoteSha --remotes`.
remoteSha STAYS the base — it is what git tells us the remote has, and is
authoritative in a way --remotes is not, since tracking refs can be
absent or stale. Using --remotes alone excludes nothing in a repo without
them, so every commit ever made reads as new. That is the same false
positive from the other direction, and it is what the existing test
"only NEW content is scanned (remote..local), not pre-existing" catches.
When excluding tracking refs changes nothing, this push has no catch-up
commits and the plain range already describes it exactly — so we defer to
it. That keeps every non-catch-up push on the original gitStrict diff
path, which is what #1946's fail-closed regression test exercises. A
narrowing that silently retired that test would be a worse trade than the
false positives it set out to fix.
Each commit is diffed alone. A merge's combined diff shows only content
present in no parent, so a secret introduced while resolving a conflict
is still caught while an ordinary merge contributes nothing.
Tests: 22/22 existing prepush tests still pass (two of them fail without
the remoteSha base and the defer-to-plain-range guard respectively —
verified by mutation). 5 new tests build real repositories on disk and
pin both directions: a catch-up merge no longer re-scans published
content, and secrets in new commits, in merge resolutions, and in
repos with no remote are all still scanned.
Absorbs PR #2592 by @Two-Six-Alpha-1115 (applied via git am -3; 5 new
tests pass in test/redact-prepush-scan-range.test.ts). Also narrows the
range for the rebased-force-push shape reported in #2573 — proven by the
follow-up regression test.
Co-authored-by: Scott <scott@peninsulaminerals.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): parcel IDs are not phone numbers
A county tax-map parcel ID (APN) reads as a national-format phone number
to `pii.phone.e164` — the same collision class as the digit-only UUID
that `insideUuid` already guards. `12-3456789.000` matches, and so does
its normalized `123456789000`.
This is not a rare edge. Land, title and property-tax repos carry APNs
by the hundred; a single title branch pushed 2 MEDIUM findings, and the
same shape recurs in every fixture, mart and smoke in the domain. A
guardrail that cries wolf on the domain's primary identifier is one
people learn to wave through, which is how a real HIGH finding
eventually gets ignored.
The guard is deliberately narrow, in two tiers:
1. The DOTTED form is exempt on its own shape. No phone convention puts
a dot before a trailing 3-4 digit group after a 4-8 digit middle.
Hyphen-only variants (22-0001-000) are NOT shape-exempted — those
genuinely are phone-shaped.
2. A DIGITS-ONLY span is phone-shaped in isolation, so it earns the
exemption only by evidence: it must be the exact digit-normalization
of a punctuated APN within the surrounding window. Fixtures and marts
carry the pair; a real phone number has no such twin. This reads the
document's own evidence instead of guessing from digits.
Verified against the unmodified engine over inputs spanning every rule
family (AWS, PEM, GitHub PAT, email, IP, credit card, SSN, timestamp,
UUID, nine phone formats): exactly one behavior changed, the APN pair.
The new test pins both directions and was proven red under mutation —
stubbing the guard to `return true` (the dangerous blanket-exemption
failure) fails 12 of 15; `return false` fails 3.
Absorbs PR #2591 by @Two-Six-Alpha-1115 (applied via git am -3; 96 tests
pass across test/redact-parcel-id-false-positive.test.ts +
test/redact-engine.test.ts, and the pattern-lint / CLI / prepush-hook /
autoredact suites stay green).
Co-authored-by: Scott <scott@peninsulaminerals.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: prove the rebased force-push shape is scanned correctly (#2573)
#2573: after `git rebase origin/main`, the feature branch's remote tip
still exists locally (the pre-rebase tip) but is no longer an ancestor of
HEAD, so the old `remoteSha..localSha` range swept in every upstream
commit rebased onto — 1.14 MiB scanned instead of 0.27 MiB on the
reported repo, tripping the engine's 1 MiB cap and blocking the push
with engine.input_too_large (a HIGH that meant "the engine never ran",
not a finding).
The catch-up-merge narrowing (`rev-list localSha --not remoteSha
--remotes`) covers this shape too: the upstream commits are reachable
from origin/main's remote-tracking ref, which exists by construction —
you cannot have rebased onto origin/main without it. No residual gap
found; this lands the proof alone, end-to-end through the actual hook
binary with the real pre-push stdin protocol:
- fixture sanity: the pre-rebase tip exists locally, is NOT an ancestor,
and the OLD two-dot range would have swept in the upstream credential
- a clean rebased force-push passes — someone else's already-published
HIGH-shaped fixture no longer blocks it
- coverage is not narrowed: a HIGH in a rebased commit of our own still
blocks
- the scanned commit set is exactly the rebased own commits, so scan
size is proportional to OUR work, not to how busy main was
Analyzed non-gap, recorded in the test header: upstream commits in NO
remote-tracking ref cannot arise from the standard flow — rebasing onto
origin/<branch> requires the tracking ref, and rebasing onto a purely
local branch means the "upstream" content was never published, so
scanning it is correct.
Fixes#2573
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): ratchet four skeleton-size caps for the wave's preamble growth
The #2499 project-scoped-MCP jq entry-resolution adds ~340 bytes to every
brain-sync preamble block, and the wave's doc additions push four skills
3-91 bytes past their v1.64/v1.65 parity caps. Re-measured per the ratchet
protocol: plan-ceo-review 92,531 → cap 93,000; document-release 56,571 →
57,000; design-consultation 70,003 → 70,500; cso 75,891 → 76,400.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(todos): file the v1.67 fix-wave deferrals + ZeroEntropy sunset deadline
The wave plan's "Cut from this wave" list becomes a durable next-wave queue:
Windows omnibus mining, AskUserQuestion numbering redesign, typecheck infra,
Chromium profile migration, triggers-frontmatter decision, release-tag
upgrade semantics, and the 15-PR feature triage queue. ZeroEntropy's Sept 4
2026 shutdown is filed P1 (calendar-driven — gbrain's default embedding
provider).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* deps(browse): bump playwright + playwright-core to 1.62.1 (P0 #2554 vehicle)
Split from dependabot #2582 per plan OV3: this commit bumps ONLY
playwright (^1.58.2 -> ^1.62.1, lock resolves playwright@1.62.1 +
playwright-core@1.62.1 exactly). puppeteer-core, @huggingface/transformers,
marked, and socks are deliberately NOT bumped here — they land separately
(73b) gated on the ONNX sidecar smoke.
Why: bun.lock pinned playwright(-core)@1.58.2, whose Chromium build
macOS XProtect now kills on launch — browse is dead on macOS (#2554).
1.62.1 ships Chromium 151.0.7922.34 (headless shell v1234), which
launches clean.
Verification: bunx playwright install chromium (Chrome Headless Shell
151.0.7922.34 downloaded), then the full browse suite from browse/:
2016 pass / 32 skip / 2 fail across 129 files (133.9s). Both fails are
playwright-independent: data-platform.test.ts "rejects paths in cwd"
expects <cwd>/package.json to exist (browse/ has none; passes from repo
root, the shard runner's cwd — 15/15), and stealth-webdriver.test.ts
passes standalone (15/15) — a 5s-timeout flake under full-suite parallel
load.
Fixes the vehicle half of #2554 (self-heal lands next commit).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): XProtect launch-kill self-heal — classify, quarantine-clear, bounded reinstall (P0 #2554)
macOS XProtect definition updates can start SIGKILLing the exact Chromium
revision the lockfile pins (xprotectd killed revision 1208's headless shell
at spawn; the failure surfaced as a generic launch timeout). New
browse/src/xprotect-heal.ts heals it, once per process:
- Classifier (F9): positive signatures sourced from the #2554 report +
Playwright's launch-error format (signal=SIGKILL process-exit lines, and
launch timeout WITH a <launched> marker), negative-checked FIRST against
missing executable, spawn EACCES/EPERM, Linux sandbox denials, and plain
exitCode=1 crashes. darwin-gated.
- Heal (F4 one-shot, in-memory flag): clears com.apple.quarantine via
`xattr -dr` on chromium* revision dirs in the Playwright cache ONLY —
never a GSTACK_CHROMIUM_PATH bundle (probePoisonedChromiumBundle's scope
contract, double-gated at the call sites via usesCustomExecutable).
- Reinstall (E1/ENG-OV3): `bunx playwright install --force chromium` run
FROM THE GSTACK INSTALL ROOT — the root whose
node_modules/playwright-core/browsers.json pins the SAME chromium
revision our embedded playwright-core expects (a cwd-resolved bunx would
fetch latest and heal to the wrong revision). Bounded at 120s with a
process-GROUP SIGKILL on timeout; on any heal failure the caller gets the
ORIGINAL launch error + manual `bunx playwright install chromium`
guidance — the CLI never hangs.
- Verification (F9): post-install asserts the REGISTRY-derived executable
path exists (the revision dir playwright-core 1.62.1 expects), not merely
install exit 0.
- Logging (F11): every action emits one structured stderr line
([browse:xprotect-heal] JSON).
All three launch sites in browser-manager.ts (headless launch, headed
launchPersistentContext, handoff relaunch) route through
launchWithXProtectHeal with one post-heal retry. setup's
ensure_playwright_browser failure path gains the same quarantine-clear
(_clear_playwright_quarantine, Darwin-only, Playwright cache scope) before
its Chromium reinstall.
Tests: browse/test/xprotect-heal.test.ts — 33 pass (classifier both
polarities, one-shot guard incl. failed-heal consumption, custom-executable
scope, registry-revision expectation vs playwright-core browsers.json,
install-root revision matching, quarantine-clear scope, wrapper retry +
guidance surfacing). browser-manager unit/custom-chromium: 36 pass.
bridge-chromium-e2e real-launch smoke: 3 pass. setup-windows-fallback
ln-invariant: 9 pass. bash -n setup: clean.
Fixes#2554.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): daemon owns signal policy — handleSIG*:false at launch sites + SIGHUP shutdown (#2220)
Playwright's default handleSIGINT/handleSIGTERM/handleSIGHUP handlers close
Chromium the moment the DAEMON process receives a signal — which fights the
deliberate headless SIGTERM-ignore in server.ts (Claude Code's Bash sandbox
fires SIGTERM when the parent shell exits between tool invocations; the
daemon survives it by design, but Playwright's handler killed its browser
out from under it). All three flags are now false at all three launch sites
(headless launch, headed launchPersistentContext, handoff relaunch).
ENG-OV4: the daemon had NO process-level SIGHUP handler (only SIGINT and
the mode-aware SIGTERM handler), so flipping handleSIGHUP:false alone would
remove the ONLY Chromium cleanup on hangup. server.ts now routes SIGHUP to
activeShutdown — the same shutdown path SIGINT uses (closes Chromium,
releases ports, removes the state file).
Static tripwire (browse/test/launch-signal-flags.test.ts, house
grep-style): every chromium.launch/launchPersistentContext site must carry
the three flags (site count pinned at 3 so a NEW launch site trips it),
server.ts must keep the SIGHUP→activeShutdown route, and the deliberate
headless SIGTERM-ignore must still exist (the reason handleSIGTERM:false is
safe — pinned in the test's header comment).
Tests: launch-signal-flags 3 pass; browser-manager-unit 28 pass;
bridge-chromium-e2e real-launch smoke 3 pass.
Fixes#2220.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): absorb #2414 residuals — EPERM-alive liveness + Windows-dead test tripwires (re-derived)
Re-derive of PR #2414 (SYKhayyat) onto current main. Most of the PR already
landed in earlier waves: the tick-derived RESPAWN_GUARD_WINDOW_MS, the
spawnTerminalAgent windowsHide flag, the process-liveness regression tests,
and the browse/test import.meta.path sweep are all on main. Two pieces
remained:
1. isProcessAlive EPERM semantics (error-handling.ts): on the signal-0 path,
EPERM means the process EXISTS but we lack rights to signal it — that is
ALIVE. Returning false made callers that validate liveness before killing
(killAgentByRecord, the terminal-agent watchdog) skip the kill and respawn
around a survivor — the self-reinforcing one-leak-per-tick chain from
#2414/#2295. Matters for cross-user PID checks.
2. Six test/ files ADDED SINCE the PR reintroduced the exact Windows bug its
second commit fixed: `new URL(import.meta.url).pathname` yields
`/C:/Users/...` on Windows, so path.resolve prepends the cwd drive and
every tripwire ENOENTs instead of asserting anything (egress-receipt,
egress-lib, egress-receipt-wiring, gstack-egress-cli,
pty-skill-seeding-wiring, skill-census). All six now use
import.meta.path — Bun's absolute native path, identical arity.
The remaining #2414 piece — replacing the Windows tasklist probe with
signal-0 — lands as its own commit (#1952) on top of this shape.
Tests: the 6 touched test files 47 pass; process-liveness-windows +
error-handling 13 pass.
Re-derived from PR #2414 by @SYKhayyat. Fixes the residual of #2295.
Co-authored-by: SYKhayyat <shaulyoelkhayyat@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): isProcessAlive uses signal-0 on every platform — no more tasklist probe (#1952)
Replace the Windows tasklist shell-out in isProcessAlive with
process.kill(pid, 0), unifying all platforms on the POSIX idiom. Node maps
signal-0 to an OpenProcess existence check on Windows — and the Windows
daemon runs under Node (dist/server-node.mjs + bun-polyfill, the documented
oven-sh/bun#4253 fallback) — so the probe is portable.
Why the shell-out had to go, beyond the cosmetic conhost flash the watchdog
blinked into the foreground every 60s (#1952): a Bun.spawnSync that hits
its timeout still RETURNS with partial stdout, so the `.includes()` PID
match answered "dead" for LIVE processes under load — the false-negative
half of the #2414/#2295 leak chain. Signal 0 spawns nothing, cannot time
out, and is ~5 orders of magnitude faster (measurements in #2414). EPERM
still reports alive (process exists, we just can't signal it).
Layered on the post-#2414-absorb shape: test 3 in
process-liveness-windows.test.ts now asserts the probe is subprocess-free
on ANY platform (win32 exemption dropped), test 4's static tripwire loses
its error-handling.ts exemption (a `tasklist … PID eq` existence probe
anywhere in src/ now fails CI), and windows-spawn-hide.test.ts drops its
tasklist-in-error-handling needle (nothing spawns, which is stronger than
hiding the window).
Tests: process-liveness-windows + windows-spawn-hide + error-handling —
17 pass, 0 fail.
Fixes#1952.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): windowsHide sweep — flag every residual child_process site + full-census tripwire (#2160, #2415)
Add windowsHide:true at every remaining direct child_process call in
browse/src that could flash a console window on Windows:
- project-slug.ts (execSync gstack-slug)
- browser-skills.ts (cp.spawnSync git rev-parse)
- security-sidecar-client.ts (spawn — the LONG-LIVED Node sidecar, whose
missing flag parked a console window on the taskbar for the daemon's
whole lifetime)
- find-security-sidecar.ts (execFileSync node --version)
- meta-commands.ts (execSync git rev-parse in inbox + the osascript
activate call)
- browse-client.ts (cp.spawnSync git rev-parse)
- file-permissions.ts (execFileSync whoami.exe — Windows-only, ran bare)
- cli.ts (nodeSpawn osascript)
windows-spawn-hide.test.ts gains a SWEEP test on top of the existing
needles: it censuses EVERY child_process binding in src/ (static imports
incl. aliases, `await import()` / require destructures, and `import * as
cp` namespaces — 15 call sites across 10 files today) and fails CI on any
call without windowsHide within its options window. Exemptions carry
reasons — the one today is domain-skill-commands' interactive $EDITOR
spawn (stdio:'inherit'; CREATE_NO_WINDOW would detach a console editor
into an invisible console).
Tests: windows-spawn-hide 5 pass; file-permissions 19 pass; browse-client
28 pass; browser-skill-commands 29 pass (81/81 combined).
Fixes the app-side half of #2160; closes out #2415's residuals.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): fail-fast busy-daemon semantics — never auto-kill an alive pid, add --force-restart (#2219)
The CLI killed live-but-busy daemons: a heavy dev-mode page (cold-compiling
Next.js route, timed-out navigation still churning) kept the daemon from
answering /health longer than the old ~1s probe window (3 × 250ms), so the
connection-error path declared it dead, SIGTERMed a healthy process, and
every kill lost the session's tabs, cookies, and logins (reproduced 4/4 in
the #2219 report).
New contract (decision 9 / F10):
- probeHealthWithBackoff is budget-based: ~8s total
(HEALTH_PROBE_TOTAL_BUDGET_MS), 500ms intervals, each probe self-bounded
at 2s — sized to the observed busy windows.
- decideDaemonRestart (pure, exported, unit-tested) encodes the IRON RULE:
healthy-after-probe → retry the SAME daemon; alive+unhealthy →
"daemon busy — retry or --force-restart" + NONZERO exit, daemon untouched;
only a DEAD pid (or an explicit --force-restart) reaches kill+restart.
- --force-restart global flag (extractGlobalFlags): the one consent path
that replaces a live daemon, always announcing the state it costs.
- Wired at all three kill sites: sendCommand's connection-error branch,
ensureServer's stale-state path (which previously killServer'd any alive
pid whose single 2s health probe missed), and connect — which used to
"Kill ANY existing server" and now refuses to replace a healthy daemon
without 'browse disconnect' or --force-restart. pair-agent's internal
headed switch passes --force-restart explicitly (the mode switch is that
command's stated purpose), preserving its behavior.
E5 IRON RULE regression tests (busy-daemon-iron-rule.test.ts, real spawned
CLI + fake daemons + live sleep-pid stand-ins per the
busy-daemon-recovery.test.ts pattern): healthy daemon SURVIVES connect
(refused with guidance, pid alive, state file untouched); wedged-alive
daemon + plain command → busy report, nonzero exit, pid alive; wedged
daemon + --force-restart IS killed and a real replacement daemon serves the
command. Plus pure-function coverage of all four decision outcomes and the
~8s budget pin.
Tests: busy-daemon-iron-rule 8 pass (16.7s, includes a real daemon
lifecycle); busy-daemon-recovery + proxy-config + daemon-mismatch-refuse +
cli-lock + cli-start-final-healthcheck + cli-setsid-daemonize 39 pass.
Fixes#2219.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): `stop` on a dead daemon is success — never boots a daemon to stop it (#2254)
Two changes, one contract:
- Pre-server short-circuit: `browse stop` is handled BEFORE ensureServer().
No daemon state → "nothing to stop", exit 0. Stale state (dead pid AND
dead port) → clean the state file, exit 0. The old flow routed stop
through ensureServer(), which started a fresh daemon + Chromium
(multi-second boot, resource churn) purely so it could be told to shut
down — or crashed on the stale state.
- Reconnect branch: a connection error while sending `stop` where the pid
turns out dead (daemon died mid-flight, between the short-circuit check
and the send) is treated as SUCCESS — the desired end state (no daemon)
already holds — instead of the crash-restart path.
Integration tests (stop-dead-daemon.test.ts, real spawned CLI + scratch
BROWSE_STATE_FILE): stop with no state exits 0 and spawns nothing (a
spawned daemon would have written the state file); stop with a stale state
file (dead pid + verified-closed port) exits 0, cleans the state, and
spawns nothing.
Tests: stop-dead-daemon 2 pass; busy-daemon-iron-rule 8 pass;
busy-daemon-recovery 1 pass (11/11 combined).
Fixes#2254.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(upgrade): /gstack-upgrade stops a stale daemon — deferring to a busy one (#2551)
A browse daemon started before an upgrade keeps serving the OLD binary's
code after `git reset --hard` + `./setup` — the running process holds the
old executable, so users on the "new" version kept getting pre-upgrade
behavior (and config-mismatch refusals against the new CLI) until they
happened to stop it by hand.
New unconditional Step 4.8 in gstack-upgrade/SKILL.md.tmpl (+ regen, same
commit): compare the running daemon's recorded binaryVersion (the
readVersionHash git-SHA the server stamps into its state file) against the
freshly built browse/dist/.version.
- Stale + responsive → `browse stop` (graceful), telling the user
old→new hash; the next command boots a daemon on the new binary.
- Stale + BUSY → DEFER (decision 10): never kill a busy daemon during
upgrade. Print the old→new hash and the escape hatch —
`browse stop` when it finishes, or `browse --force-restart stop` now.
- Dead pid / matching hash / no state → silent no-op.
Tests: skill-validation + gen-skill-docs 731 pass after regen.
Fixes#2551.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): terminal-agent allocates from the fixed port scan range, not port:0 (#2314)
The terminal-agent bound `Bun.serve({ port: 0 })` and kept that OS-assigned
port for its whole (weeks-long) lifetime. `port: 0` draws from the OS
EPHEMERAL range (49152-65535 on macOS) — the exact pool every short-lived
`app.listen(0)` test server draws from — so the agent squatted ports that
test suites expected to receive and silently absorbed their traffic as
phantom 404s (two squatting daemons verified in the report).
Fix per decision 8: extract the main server's port allocation into
browse/src/port-allocator.ts (checkPortAvailable / isPortAvailable /
findAvailablePort + the 10000-60000 range constants and the actionable
sandbox-vs-occupied error formatters, all verbatim from server.ts) and make
BOTH long-lived listeners use it — server.ts's findPort is now a thin
findAvailablePort(BROWSE_PORT) wrapper, and terminal-agent's buildServer
takes a pre-allocated port from the same range. No terminal-port consumer
carries a range assumption (they read the port file), verified by grep.
Tests: terminal-agent-port-range (new — allocator stays inside
10000-60000 and below the 49152 ephemeral floor, explicit-port honored,
occupied-explicit throws, static tripwires pin no-port:0 in
terminal-agent.ts and the shared wrapper in server.ts) + findport +
terminal-agent-integration/session-routing/detach-reattach +
dual-listener: 67 pass, 0 fail.
Fixes#2314.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): capture daemon stdout/stderr to browse-daemon.log + Windows polyfill spawn fixes (re-derived from #2461)
The detached daemon's stdout/stderr were wired to 'ignore' on every
platform, so every console.error('[browse] FATAL: ...') from a Chromium
crash, uncaughtException, or unhandledRejection was discarded at the OS
level — a crash-and-respawn looked identical to every other dropped
session, with nothing on disk recording why. Both spawn paths now redirect
to <stateDir>/browse-daemon.log (append mode, accumulates across respawns):
the Unix path via an fd from openDaemonLogSink(), the Windows path by
opening the fd INSIDE the node -e launcher string (an fd opened in cli.ts
would not cross the spawn boundary). Unwritable state dir falls back to
'ignore' rather than failing the launch.
Capturing daemon output is what surfaced the PR's second fix, still valid
on current main: bun-polyfill.cjs's Bun.spawn/spawnSync called Node's
child_process with a bare command name, which Windows can't resolve without
PATHEXT lookup ("spawn bun ENOENT" from the terminal-agent respawn path).
Routed through cross-spawn on win32 (now a direct dependency; already in
the tree transitively via @modelcontextprotocol/sdk) — the PR verified
empirically that shell:true does NOT neutralize cmd.exe metacharacters
reachable via `$B skill run` arg passthrough, and that Node refuses .cmd
spawns without a shell (CVE-2024-27980), so cross-spawn's combined PATHEXT
resolution + argument escaping is the only correct shape. The PR's third
fix (resolveDisconnectCause throwing "browser?.process is not a function")
already landed on main via the #2085 typeof guard — not re-applied.
F6 log hygiene (daemon-log-hygiene.test.ts): needle tests pin the log
wiring on both spawn paths (and that stdio 'ignore','ignore','ignore'
never returns), that bun-polyfill stays on cross-spawn with no shell:true,
that NO console.* call in src/ passes a token value (interpolated or bare
arg), and that the page-content carrier modules (tab-session, buffers,
content-security, activity) stay console-free — so neither AUTH_TOKEN nor
unsanitized page-derived strings can reach browse-daemon.log.
Tests: daemon-log-hygiene + bun-polyfill + windows-spawn-hide +
cli-setsid-daemonize 21 pass; stop-dead-daemon + busy-daemon-iron-rule
(exercises a REAL daemon boot through the new log-fd wiring) 10 pass.
Re-derived from PR #2461 by @phuttimatebenchanakatkul.
Co-authored-by: phuttimatebenchanakatkul <phuttimatebenchanakatkul@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: raise gbrain version-probe timeout to 10s on Windows
On Windows the gbrain CLI is a .cmd shim that runs `bun run cli.ts`.
A cold spawn takes over the 2s timeout in resolveGbrainBin (warm runs
are ~700ms), so the probe times out, localEngineStatus classifies the
engine as "no-cli", and the 60s status cache then serves that false
negative to every skill preamble and sync run. /sync-gbrain skips the
memory stage with "gbrain CLI not on PATH" even though the CLI works.
Give the shim 10s of headroom, gated on NEEDS_SHELL_ON_WINDOWS so
POSIX keeps the cheap 2s probe. Applies to both resolveGbrainBin and
readGbrainVersion.
Observed on Windows 11, bun 1.3.14, gbrain 0.42.59.0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): remove the dead security shield + unfed /health.security (re-derived from #2557)
The sidebar's SEC shield has been dead UI since the PTY terminal rewrite:
nothing set its data-status, nothing unhid it, and the /health.security
field behind it read getStatus() off ~/.gstack/security/session-state.json
— a file whose ONLY writer (sidebar-agent.ts) was deleted with the chat
path. /health therefore reported a permanent 'inactive', or a stale
FALSE-GREEN 'protected' wherever an old state file survived on disk (a
single unit-test run was enough to plant one). A green shield sourced from
leftover state reads as "no threats detected" when the real state is "not
measured" — the same fail-open class as #2026.
Removed (dead surfaces only): the shield markup/CSS and the stale
sidepanel.js comment; the /health security field and server.ts's getStatus
import; getStatus / SecurityStatus / StatusDetail / SessionState /
read+writeSessionState (and security.ts's dead child_process import); the
session-state + getStatus unit tests — including the round-trip test that
wrote real fixture data into ~/.gstack and left /health green forever.
(The PR's security-sidepanel-dom.test.ts deletion already happened on main
via #2230; its resolveDisconnectCause guard landed via the #2085 typeof
fix. Neither re-applied.)
Kept, per ENG-OV9 — security.ts has LIVE consumers: the pure combiner
(combineVerdict + THRESHOLDS), canary utilities, and extractDomain stay;
server.ts's /pty-inject-scan L4 path (isSidecarAvailable + scanWithSidecar)
is untouched. browse/test/server-security-surface.test.ts pins BOTH
directions: the dead surface stays dead (no /health security field, no
getStatus import, no reader of the security session-state file, shield
markup gone) and the live half stays live (sidecar wiring in server.ts,
combiner/canary exports in security.ts, /health carries no token — the
v1.63 regression wall). A future re-feed from LIVE signals must update
that test deliberately rather than resurrect the state-file path.
F13 (same commit): CLAUDE.md's Sidebar security stack section, ARCHITECTURE.md's
prompt-injection Visibility + critical-constraint paragraphs, and
BROWSER.md's security section now describe the removed surfaces as history,
not live features.
Net -166 lines. Tests: server-security-surface + security +
security-adversarial(+fixes) + security-integration + server-auth 114 pass;
sidepanel-* + extension-token + extension-sender-auth 58 pass / 2 skip.
Re-derived from PR #2557 by @frederik-kaster-noygear.
Co-authored-by: Frederik Kaster <frederik.kaster@noygear.ai>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): capture browser-skill subprocess output via temp files, not pipes (core of #2559)
Under a loaded parent, the FIRST piped Bun.spawn in a process
intermittently yields an empty stderr even though the child wrote it and
exited 0 — measured identically with readers-attached-before-exit and with
a manual getReader() drain, so it's loss inside the async pipe plumbing,
not read ordering. It flaked `$B skill test` (bun test writes its banner to
stdout and the pass/fail summary to stderr, so a dropped stderr silently
degraded the result to just the banner) and would blank a skill's JSON
result on `$B skill run` while still reporting success.
New runToFiles() points the child's stdout/stderr at temp files via
Bun.file() (never raw fds — closing self-opened fds around a spawn tripped
Bun's fd bookkeeping into a stray epoll_ctl EBADF), awaits exit, then reads
the files: the kernel has flushed everything by child exit, so the
post-exit read is complete, and chatty children can't stall on a full pipe
buffer. Both handleTest and spawnSkill route through it (timeout + capped
read preserved via timeoutMs/maxStdoutBytes). Bun.spawnSync would also
capture reliably but would deadlock: a spawned skill calls back into this
same daemon on GSTACK_PORT.
The `tests passed for "<name>"` fallback is gone — a passing bun test
always prints a summary, so exit 0 with no output means the run was NOT
captured, and handleTest now throws instead of fabricating success. The
E2E assertion checks both stream halves (banner + summary + "Ran N tests")
instead of the loose alternation whose `tests passed` branch matched the
synthetic fallback vacuously. A static tripwire pins the structure:
runToFiles owns the module's ONLY Bun.spawn, and no site reads child
output via stdout:'pipe' / new Response(proc.stdout) / getReader().
Scope: the PR's repo-wide test-file sweep is deliberately not absorbed —
this is the core only, per the wave plan.
Tests: browser-skill-commands + browser-skills-e2e + browser-skill-write
74 pass, 0 fail.
Re-derived from PR #2559 by @frederik-kaster-noygear.
Co-authored-by: Frederik Kaster <frederik.kaster@noygear.ai>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(browse): allow Emulation.setEmulatedMedia on the CDP allowlist (re-derived from #2419)
Adds Emulation.setEmulatedMedia to the deny-default CDP allowlist:
tab-scoped, trusted output (returns an empty result — no page content).
Unlocks media type/feature overrides (prefers-color-scheme,
prefers-reduced-motion, prefers-contrast, forced-colors) via `$B cdp`, so
dark-mode and a11y CSS branches are testable without a headed toggle. Like
setUserAgentOverride, the override persists on the tab until cleared with
an empty features array — noted in the entry's justification.
Registry test pins the entry (allowed + tab scope + trusted output); the
PR's VERSION/CHANGELOG stamping is stripped per wave convention (versioning
happens at /ship).
Tests: cdp-allowlist 7 pass, 0 fail.
Re-derived from PR #2419 by @meshailabs.
Co-authored-by: meshailabs <devsupport@meshai.dev>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): create node bundle output directory
* fix(deps): bun-patch playwright-core 1.62.1 — windowsHide at launch + taskkill (#2160, #1989)
The repo's first patchedDependencies entry. playwright-core's bundled
process launcher (lib/coreBundle.js in the 1.62.x layout) spawns browser
children without windowsHide — Node defaults it to FALSE for
child_process.spawn — so Chromium children could flash a console window on
Windows, and its force-kill path shells `taskkill /pid <pid> /T /F`
through cmd.exe with the same omission. Both sites now pass
windowsHide: true via patches/playwright-core@1.62.1.patch (generated with
`bun patch` / `bun patch --commit`).
Coherence verified end-to-end: rm -rf node_modules && bun install applies
the patch cleanly (both sites present in the reinstalled tree), and a real
chromium.launch() through the patched bundle works.
browse/test/playwright-core-patch.test.ts pins the three-legged invariant
statically — package.json's patchedDependencies key is VERSION-KEYED
against the installed playwright-core, the patch file exists and carries
both sites, bun.lock records the patch, and the installed bundle actually
has it applied — so a future playwright bump that forgets to re-target the
patch fails CI with the exact key to regenerate (revert pairing: dropping
the c25 bump requires dropping this patch too).
Tests: playwright-core-patch 4 pass, 0 fail.
Fixes#2160, #1989.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(preamble): probe AGENTS.md for skill routing; team-init resolves GSTACK_ROOT (#2500)
The HAS_ROUTING preamble probe only checked CLAUDE.md, so repos that route
skills via AGENTS.md (the cross-harness convention for Codex, Cursor, and
generic agent hosts) reported HAS_ROUTING: no and got nagged to create
CLAUDE.md. The probe now iterates CLAUDE.md and AGENTS.md.
gstack-team-init's required-mode enforcement (the CLAUDE.md verification
snippet and the generated .claude/hooks/check-gstack.sh) hardcoded
~/.claude/skills/gstack, false-blocking installs living at any other host's
global root or the migrated ~/.gstack/repos/gstack location. Both sites now
resolve the install root: GSTACK_ROOT env first, then every registered
host's globalRoot, then the migrated repo path. Install instructions keep
pointing at the canonical Claude location.
test/routing-probe.test.ts pins both: rendered-preamble assertions plus a
live execution of the extracted probe block (AGENTS.md-only repo => yes),
and a drift test that requires every hosts-registry globalRoot to appear in
team-init's probe list.
Re-derived from PR #2500 onto current code (the PR's 52-file regen was
discarded and regenerated here). Contributed by @gamerey43.
Fixes#2500
Co-authored-by: gamerey43 <gamerey43@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(resolvers): empty find must not fall through to cwd (#2483)
find ... | xargs ls -t runs ls with NO operands when find matches nothing —
GNU xargs still invokes the command once, and ls -t with no operands lists
the current directory. Three sites misfired on fresh installs (no ceo-plans /
checkpoints / plans yet), exactly where a wrong answer is least likely to be
recognized: review.ts's plan fallback silently adopted a random cwd .md as
"the plan", and Context Recovery listed unrelated cwd files as RECENT
ARTIFACTS / LATEST_CHECKPOINT.
All three now use xargs -r ls -t, mirroring the shape the sibling
bin/gstack-codex-session-import fix (#2482) landed with: -r pins the BSD
skip-on-empty behavior on GNU too, and BSD xargs accepts -r as a no-op.
test/empty-find-fallthrough.test.ts pins it four ways: no bare xargs ls -t
in scripts/ or bin/, both rendered Context Recovery sites guarded, a live
execution proving an empty checkpoints dir yields no checkpoint (not a decoy
cwd file), and a rendered-SKILL.md sweep.
Re-derived from PR #2483 onto current code. Contributed by @tranthanhnhatkhoa.
Fixes#2483
Co-authored-by: tranthanhnhatkhoa <tranthanhnhatkhoa@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(codex): retire deprecated web-search flag behind one CODEX_WEB_SEARCH_FLAG constant (#2525)
codex >=0.144 deprecates the legacy --enable-based web_search_cached
spelling (web search is on by default; --enable <FEATURE> now means
-c features.<name>=true, verified against codex 0.147.0's exec --help).
Every gstack codex invocation now passes -c 'web_search="cached"' instead.
The flag previously lived inline at 19 raw sites. Per ENG-OV11a the 10
template-inline sites (autoplan/SKILL.md.tmpl x4, codex/SKILL.md.tmpl x6)
convert to a shared {{CODEX_WEB_SEARCH_FLAG}} token first, so ONE resolver
constant (CODEX_WEB_SEARCH_FLAG in scripts/resolvers/constants.ts) now
covers all sites: review.ts x5, design.ts x3, the token resolver in
utility.ts, and the tool-map helper comment.
codex/SKILL.md.tmpl's web-search prose guarantee is corrected: the -c form
explicitly overrides a top-level web_search config (the legacy flag yielded
to it), and native codex review disables web search regardless of
configuration, so the flag is a no-op on the default Review path.
test/codex-web-search-flag.test.ts is the safety net: repo-wide grep
tripwires assert NO rendered SKILL.md/section/golden and NO source file
carries the deprecated spelling, and that the token resolves in rendered
output.
Fixes#2525
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(question-tuning): interpolate the absolute question-registry path (#2489)
The Question Tuning preamble pointed agents at a RELATIVE
scripts/question-registry.ts in the same sentence whose ${bin} path renders
absolute. Agents run with cwd in the USER'S project — the relative lookup
never resolves, silently fails, and the documented {skill}-{slug} fallback
fabricates a singleton question_id every time (one observed
/plan-eng-review session: 21/21 unregistered ids, so no per-question
preference can ever attach).
The resolver now interpolates ctx.paths.skillRoot the way sibling resolvers
interpolate bin paths: ~/.claude/skills/gstack/scripts/question-registry.ts
on Claude, $GSTACK_ROOT/scripts/question-registry.ts on env-var hosts.
test/question-tuning-registry-path.test.ts asserts the rendered path per
host, forbids the bare relative shape, and checks the target file exists in
the install tree.
Fixes#2489
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(resolvers): slug-canonical branch form in file-path positions (#2550, #1851)
Branch-name-to-filename had incompatible rules across writer and readers:
gstack-review-log WRITES <branch>-reviews.jsonl with the gstack-slug
canonical form (tr '/' '-' then tr -cd 'a-zA-Z0-9._-', bin/gstack-slug:178),
but Context Recovery PROBED it with raw $_BRANCH from git branch
--show-current — so for any branch containing a '/' the REVIEWS line never
fired (#1851's reader half of #1127). The probe now uses ${BRANCH:-unknown},
the canonical value the gstack-slug eval on the block's first line already
sets. review.ts's plan content-search BRANCH gains the missing tr -cd half
so it matches the same canonical pipeline.
Full audit of the 5 raw $_BRANCH interpolation sites in scripts/resolvers/
(E3): generate-context-recovery.ts:16 (reviews.jsonl path) -> canonical
BRANCH; :19/:21 (timeline.jsonl content greps) KEEP raw $_BRANCH because the
timeline writer (preamble's gstack-timeline-log call) stores the raw branch
in the "branch" field — slugging the reader would break that pairing;
generate-preamble-bash.ts:29 (display echo) and :97 (timeline data write)
keep raw by design. The *-$BRANCH-design-*.md family (review.ts:313 + 3
plan-review templates) is a consistent tr '/' '-' writer/reader pair and is
deliberately untouched.
test/branch-slug-hygiene.test.ts pins the discipline: a rendered-output
sweep forbids raw $_BRANCH adjacent to a path separator or as a filename
prefix in ANY generated SKILL.md/section, and a live round-trip on a
feat/slash branch proves gstack-review-log's write is found by the rendered
probe (with the raw-form shape as a negative control).
Reader-side fix folded from PR #1851. Contributed by @harjothkhara.
Fixes#2550Fixes#1127
Co-authored-by: harjothkhara <harjothkhara@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ship): review fix loop stays in one invocation, bounded at 3 cycles (#2391)
The pre-landing review committed its fixes, then STOPPED and told the user
to run /ship again — 5-10 manual invocations on a branch with a few
auto-fixable findings, violating /ship's fully-automated contract. There is
no user decision between those invocations; each rerun just repeats the
workflow until a review pass produces no fixes.
ship/sections/review-army.md.tmpl item 7 now makes the loop explicit: after
committing fixes, re-run the test suite (Step 5) and this review (Step 9
items 2-6) in the SAME invocation, repeating until one full pass applies
zero fixes, then continue to Step 12. Bounded at 3 fix cycles — a review
that will not converge STOPs with a report of which findings keep
reappearing (a genuine blocker), never with a rerun request.
test/ship-review-loop.test.ts asserts no rendered ship surface (section +
all three host goldens) carries the STOP-and-rerun shape and that the
bounded loop language renders.
Fixes#2391
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(codex): model round-trip probe — an unusable configured model fails fast with guidance (#2477)
The auth probe accepts 'auth exists' as readiness, but a ChatGPT account
with a stale model pin in ~/.codex/config.toml passes it and then EVERY
mode dies with an HTTP 400 ('The <model> model is not supported when using
Codex with a ChatGPT account') and no pointer to where the model came from
— one report burned ~40 minutes and four invocations plus a strings dump
of the binary before finding the one-line config fix.
bin/gstack-codex-probe gains _gstack_codex_model_probe: a short
codex exec 'reply OK' round trip with the configured model, gated behind
the cheap auth probe at all three preflight sites (codex Step 0.5, the
shared codexPreflight in scripts/resolvers/constants.ts — which grows a
model_unusable CODEX_MODE branch — and autoplan's availability chain).
Verdicts: MODEL_OK (cached 1h, keyed on config.toml + auth.json mtimes so
a pin edit or re-login re-probes immediately), MODEL_UNUSABLE (exit 1,
prints the rejection plus HINTs at the model= pin and the
[notice.model_migrations] table), MODEL_PROBE_INCONCLUSIVE (timeout or
transient: FAIL-OPEN so network luck never wedges codex mode).
The 'Model not supported (HTTP 400)' Error Handling entry already shipped
in v1.64.0.0; Step 0.5's prose now routes MODEL_UNUSABLE to it.
test/codex-model-probe.test.ts drives all four behaviors against a stubbed
codex binary (invocation-counted cache hit, hint content, fail-open
polarity, mtime invalidation).
Fixes#2477
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(review): skip nested codex spawns when already running under a Codex host (#2519)
/review executed inside a Codex host spawned the codex specialist passes
anyway — the same model reviewing itself, at multiplied cost (observed:
15M tokens for a single /review).
Detection per maintainer decision 7: a presence probe of the Codex session
env. A live Codex session exports CODEX_THREAD_ID and CODEX_SANDBOX into
every shell it spawns — verified during implementation against a live
`codex exec 'env | grep -i codex'` capture on codex 0.147.0
(CODEX_THREAD_ID, CODEX_SANDBOX=seatbelt, CODEX_SANDBOX_NETWORK_DISABLED=1,
CODEX_CI=1). The shared codexPreflight in scripts/resolvers/constants.ts
(consumed by all three review.ts army blocks: adversarial, codex plan
review, codex doc review) now yields CODEX_MODE=under_codex and instructs
exactly one printed notice — '[running under Codex — nested codex passes
skipped; set GSTACK_FORCE_CODEX_REVIEW=1 to force]'. The override env var
forces the nested passes for users who really want them. codex/SKILL.md.tmpl
Step 0.5 gains the same probe: /codex under a Codex host stops with a
one-line notice, since its whole value is a SECOND model's opinion.
test/codex-under-codex-detection.test.ts runs the rendered preflight bash
under all four env combinations (thread-id only, sandbox only, forced,
clean) and asserts the probe + notice render in the three preflight
consumers and the codex skill.
Fixes#2519
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(build): convert MSYS paths for Bun in the Windows server-bundle build (#2452)
browse/scripts/build-node-server.sh resolves GSTACK_DIR with pwd, which
under MSYS/Git Bash yields a /c/... style absolute path that Bun cannot
open ('FileNotFound opening root directory') — the Windows Node-server
bundle build died at the first bun build. Convert via cygpath -m on
MINGW/MSYS/CYGWIN before deriving SRC_DIR/DIST_DIR.
Re-derived from PR #2452, taking only the cygpath build half — the PR's
icacls principal-ambiguity half already landed on main
(browse/src/file-permissions.ts's SID-form principal). Verified the build
bug still exists on current code before absorbing (build-node-server.sh:10
had no conversion). Contributed by @chiragborse1.
Co-authored-by: chiragborse1 <chiragborse1@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): update four main-side gen-skill-docs assertions to the T6 contracts
Three contracts moved under this theme and the assertions pinned the old
shapes:
- The routing-probe assertion expected the single-file
'grep ... CLAUDE.md' shape; #2500 made the probe iterate CLAUDE.md AND
AGENTS.md, so it now asserts the for-loop + quoted $_RF shape.
- The three Claude-output Codex-path bans tripped on ~/.codex/config.toml,
which the shared codexPreflight's model_unusable branch (#2477) now
documents in rendered output. That path is the Codex CLI's own config
file — the same user-facing class as the already-exempt
~/.codex/sessions/ — so it is scrubbed before the host-path ban, with the
reasoning recorded next to the existing exemptions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(sync-gbrain): dream pack-capability WARN anchors to the graph phase
Fixes#2341. classifyDreamOutcome matched the bare phrase "does not declare
this phase", but gbrain's only emitters are the CONTENT phases
(extract_atoms, synthesize_concepts) — which the default base packs
legitimately skip while resolve_symbol_edges still runs. Every base-pack
brain therefore got the pack-capability WARN with its wrong, costly
remediation ("switch schema packs"), masking real graph problems. The match
now anchors to the graph phase (resolve_symbol_edges/extract_code_symbols);
a base-pack run with a built graph is clean, and a resolved-0 run gets the
honest 0-edge diagnosis.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): install office-hours into the external-host runtime roots
Fixes#2449. plan-eng-review's inline office-hours step reads
$GSTACK_ROOT/office-hours/SKILL.md, but the codex/factory/opencode runtime
roots never installed it — the documented path pointed at nothing on every
external-host install (Codex on Windows was the reported repro). Each
runtime-root creator now links its host-rendered gstack-office-hours
SKILL.md at office-hours/SKILL.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gbrain-install): name the real fix when an npm-installed bun breaks the shim
Fixes#2487. `npm i -g bun` puts POSIX/cmd/ps1 shims on %PATH% but never
bun.exe — and the gbrain.exe shim that `bun link` generates resolves bun.exe
specifically, so link succeeds and every gbrain call dies with bun's
misleading "bun is not installed in %PATH%" (which suggests installing a
second parallel bun). The D19 validation failure paths now detect the
condition on Windows and print the actual remediation: bun's own
process.execPath IS the hidden bun.exe — add its directory to PATH.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(ios-qa): document the bridge compatibility preflight and non-SwiftPM fallback
Re-derived from PR #2581 under the generated-file screening rule (template
hunk taken; SKILL.md regenerated). Prevents the agent from inventing project
wiring on apps the bridge doesn't support (ObservableObject-style or
non-SwiftPM apps): the preflight now names the compatibility check and the
manual fallback path.
Co-authored-by: Tim White <itstimwhite@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(deps): force adm-zip past CVE-2026-39244 via an override
Re-derived from PR #2485 as a resolution override rather than its direct-dep
bump: adm-zip reaches the tree only transitively (onnxruntime-node pins
^0.5.16), so a top-level copy at 0.6.0 would leave onnxruntime-node loading
the vulnerable 0.5.17 — which is exactly what the scanner PR's own lockfile
showed. The override forces every resolution to ^0.6.0.
Co-authored-by: anupamme <anupamme@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* deps: remove unused puppeteer-core; bump transformers/marked/socks
Completes the #2582 split (ENG-OV8). puppeteer-core had ZERO imports
repo-wide — a dead direct dependency whose only footprint was its CVE-prone
transitive chain (puppeteer-core > @puppeteer/browsers > proxy-agent >
get-uri > basic-ftp) and the pin test + basic-ftp override that existed
solely to guard it. Removing the dependency removes the surface: the
basic-ftp override and test/basic-ftp-security-pin.test.ts retire with it
(the lockfile resolves zero basic-ftp copies now). transformers ^4.2.0,
marked ^18.0.9, socks ^2.8.9 land per the dependabot group, gated on the
ONNX sidecar load+classify smoke passing with the bumped transformers
(28/28 sidecar+classifier+security tests green post-bump).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore(deps): bump the github-actions group across 1 directory with 10 updates
Bumps the github-actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [docker/login-action](https://github.com/docker/login-action) | `3` | `4` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` |
| [oven-sh/setup-bun](https://github.com/oven-sh/setup-bun) | `1` | `2` |
| [actions/cache](https://github.com/actions/cache) | `4` | `6` |
| [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) | `3adb4b14a2b0623876d18d863a498b785fb3752d` | `f4cfcc01edc9c8b756a9b873b7a623ca674da51e` |
Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v4...v7)
Updates `docker/login-action` from 3 to 4
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3...v4)
Updates `docker/setup-buildx-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)
Updates `docker/build-push-action` from 6 to 7
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6...v7)
Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294)
Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)
Updates `actions/download-artifact` from 4 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v8)
Updates `oven-sh/setup-bun` from 1 to 2
- [Release notes](https://github.com/oven-sh/setup-bun/releases)
- [Commits](https://github.com/oven-sh/setup-bun/compare/v1...v2)
Updates `actions/cache` from 4 to 6
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v6)
Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 3adb4b14a2b0623876d18d863a498b785fb3752d to f4cfcc01edc9c8b756a9b873b7a623ca674da51e
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](https://github.com/google/osv-scanner-action/compare/3adb4b14a2b0623876d18d863a498b785fb3752d...f4cfcc01edc9c8b756a9b873b7a623ca674da51e)
* fix(test): scope rendered-output tripwires to repo sources; stop cdp-e2e's env leak
Two hermeticity holes surfaced by the wave's final gate. (1) The three T6
tripwires (branch-slug, codex-flag, empty-find) enumerated the whole tree
including the workspace-local .claude/ install, which is not generated
output and can carry dangling symlinks from unrelated sessions — one ENOENT
there failed all three. They now scan repo sources only. (2)
browse/test/cdp-e2e.test.ts mutated process.env.GSTACK_HOME at module scope
without restore; in one-process shard runs that leaks into every later test
file — observed baking cdp-e2e's temp render path into artifacts that
outlived it (53 dangling SKILL.md symlinks in a workspace install). The
original value is now restored in afterAll. The exact test that performed
the polluted relink remains unattributed; both known leak vectors are
closed and the workspace was repaired via an explicit gstack-relink.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): honest budget for the suite's one headed persistent-context launch
The launchHeaded/handoff parity test cold-launches a HEADED Chromium — 8-25s
on macOS, worse on the first launch of a freshly downloaded bundle (XProtect
scans it, the #2554 class) and under shard concurrency. bun's 5s default made
it the suite's most reliable false negative: it timed out identically on the
pre-wave baseline run of pristine main. 45s budget; passes 15/15.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): assemble redact fixtures at runtime — the guard caught its own wave
The pre-push redact guard BLOCKED this branch's first push: the wave's new
scan-range tests carried live-FORMAT fake credentials as literals (3 AWS key
shapes + a password-bearing DB URL), and the guard scans pushed diff bytes.
Same dogfood moment as the v1.64 wave, same rule: assemble the fixture at
runtime so the diff never carries a credential shape, never bypass the guard.
Runtime strings stay live-format for the hook under test. The guard works.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): sync ios-qa fixture mirrors with the #2585 DEBUG-guard templates
The #2585 absorb updated DebugBridgeTouch.m.template and
Package.swift.template but not their FixtureApp mirrors, failing the
template↔fixture parity gate. DebugBridgeTouch.m syncs byte-for-byte; the
fixture Package.swift takes only the template's new cSettings DEBUG define on
the Touch target (the fixture's own testTarget is fixture-only content the
parity normalization deliberately ignores — a naive full copy breaks the
XCTest invariant). 23/23 including the real swift build.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(slug): env-override runs never persist to the cwd cache; cache is GSTACK_HOME-aware
Found while closing the wave's eval gate: a test exporting
GSTACK_PROJECT_SLUG from the repo root persisted the override into the cwd
slug cache, silently rebinding the ENTIRE repo's session state (evals,
decisions, timelines) to the test's slug for every later env-less run. The
escape hatch is per-invocation by contract — it no longer writes the cache.
The cache dir also hardcoded $HOME while lib/bin-context.ts's native port
(#2561) reads it GSTACK_HOME-aware, so temp-home test runs littered the real
~/.gstack (observed: 2,528 stale temp-cwd entries, swept). Writer and reader
now key the same GSTACK_HOME-aware cache; regression tests pin both
behaviors.
Also raises the cso --diff eval budget (240s/25t → 360s/40t):
transcript-verified, the wave's legitimately-grown audit session completes
the report and dies in closing telemetry at ~215s under the old budget; the
full-audit sibling already runs at 300s.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): pin GSTACK_HOME in the slug walk-up cache tests
The cache dir became GSTACK_HOME-aware; these tests seed and assert cache
files under a temp HOME but spread the ambient env, so a sibling test
leaking process.env.GSTACK_HOME in a shared-process shard pointed the bin at
a different cache than the one under assertion (AC-2/AC-6 failed in shard
context, passed solo). The env now pins GSTACK_HOME to the temp home —
verified identical results with and without a simulated ambient leak.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): the cache-hygiene test strips ambient GSTACK_PROJECT_SLUG
Its env-less contract must be env-less: any ambient override leaking into a
shared-process shard flips the run into override mode, which correctly skips
the cache write the test asserts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): ratchet ship's skeleton cap for the v1.66.1 merge union
Merging main's v1.66.1.0 (evidence-ledger prose in ship's template) on top of
the wave's growth lands ship at 90,333 bytes, 333 over its cap. Re-measured
per the ratchet protocol: cap 90,800.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(brain-sync): throttle + bound the detector push; empty-queue fast path
Review-army findings on the #2549 detector. (1) The preamble runs --once at
every skill boundary, so an unthrottled retry paid a full network push
attempt per boundary in exactly the steady states it targets (offline,
broken auth) — a captive-portal push can block 30-75s against the header's
"<1s when idle" promise. Attempts now stamp .brain-last-push-attempt and
retry at most every 10 minutes; the push never prompts (GIT_TERMINAL_PROMPT=0)
and bounds stalled transfers via git's low-speed limits (portable — stock
macOS has no timeout binary). (2) Author-scoped: only gstack-brain-sync's own
commits retry; a user's manual commit in ~/.gstack rides along on real drains
as before, never auto-published by the detector. (3) Empty-queue fast path
exits before the compute/rewrite python spawns — the steady state is now
cheaper than the pre-wave truncation code. (4) The queue rewrite warns on
failure instead of silently letting the status claim a drain that didn't
happen, counts held unparseable lines, and collapses duplicate lines on
rewrite. Throttle + delivery matrix cases added (37/37).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(version-bump): JSON version-paths get the npm translation; honest recovery messages
Review-army findings. A repo whose package.json carries the legacy 4-digit
mirror and pins it via .gstack/version-path would get "1.67.0.1" written into
a manifest npm rejects forever, with no drift state to catch it (a JSON
source is self-consistent by construction) — the JSON branch now writes the
npm-valid translation, warns when translation occurred, and surfaces the
requested form. Lockfile-failure messages now match reality per failure
point: classify never reads lockfiles, so "re-run and repair" was a false
promise when package.json was written and only the lockfile threw. Both
malformed-version messages read MAJOR.MINOR.PATCH[.MICRO], matching the
3-digit contract this wave ships.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(extension): remove the orphaned security-banner block; repair two dead CSS tokens
Design-review findings. The 197-line .security-banner component (incl. its
keyframes) had no producer — no JS has created the element since the
chat-path rip, the same dead-hidden-security-UI class as the #2557 shield
this wave removed; a tombstone comment points at git history if the banner
UX returns. Two pre-existing token bugs in the mem-toast styles: --zinc-700
was never defined so the button hover computed to transparent (now carries a
fallback), and --font-sans doesn't exist (now --font-system, which :root
defines).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(brain-sync): detector pushes only when ALL unpushed commits are its own; lock released on every exit
The unpushed-commit detector's author check was existential: any bot-authored
commit in origin/<branch>..HEAD armed a push of HEAD, silently publishing
interleaved user-authored commits in ~/.gstack. Now the gate requires the
author-scoped count to equal the total unpushed count — one user commit
disables the autonomous retry entirely (user commits still ride along when a
real drain pushes). Detached HEAD is excluded (origin/HEAD usually resolves,
making the retry a 10-minutely doomed push).
The lock-release trap now installs immediately after lock acquisition instead
of after the empty-queue fast path — the steady state at every skill boundary
leaked the lock dir and relied on stale-PID detection, which PID reuse defeats.
An INT during the detector's network push is covered too.
Matrix test: interleaved user commit blocks the detector, then a real drain
delivers everything.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(version-bump): version-path and package-json-path pins cannot escape the repository
.gstack/version-path and .gstack/package-json-path are repo-controlled
content. A cloned repo pinning '../../victim.json' — or an in-repo symlink
pointing outside — turned a routine bump into an arbitrary file overwrite
outside the repository. assertRepoContained rejects absolute paths, lexical
.. escapes, and symlink escapes (deepest existing ancestor realpath'd, so a
not-yet-created VERSION file is checked through its parent). Lockfiles that
are symlinks resolving outside the repo are skipped with a warning instead
of written through.
Six containment tests including the not-over-broad control (subdirectory
pins keep working).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): port allocator range actually stays below the ephemeral floor; terminal-agent retries a raced bind
RANDOM_PORT_MAX was 60000 while the module header documents 49152-65535 as
the pool to avoid — ~22% of allocations landed back inside it, preserving
the phantom-404 squatting class for both the daemon and the weeks-lived
terminal-agent. The cap is now 49151 and the range test pins the true
property (< 49152) instead of the old <= 60000 tautology.
terminal-agent boot also re-allocates and retries up to 5 times when
Bun.serve throws in the probe-then-bind TOCTOU window — previously a
concurrent bind killed the boot with no retry via main().catch → exit 1.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(codex-probe): bash-native watchdog when no timeout binary exists; negative-cache the deterministic model 400
Stock macOS ships neither coreutils gtimeout nor timeout(1); the wrapper's
fallback ran the command unwrapped, so a hung codex exec blocked the probe
and the calling workflow indefinitely. The fallback now backgrounds the
command, TERMs it at the deadline, and mirrors timeout(1)'s exit-124
contract — with the watchdog's stdout detached so an early finish never
blocks a caller's $(...) capture on the orphaned sleep.
MODEL_UNUSABLE is now negative-cached for 15 minutes (same exit-1 + hints
from cache). The deterministic 400 is config-driven, so re-probing every
preflight charged the affected user a 30s round trip plus real tokens per
review section, forever. Editing config.toml — the fix — changes the cache
signature and re-probes immediately; MODEL_PROBE_INCONCLUSIVE stays uncached.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): xprotect heal resolves the install root via os.homedir and keeps guidance on a failed retry
With HOME unset, the global-install candidate became the RELATIVE path
.claude/skills/gstack under the daemon's cwd — often an untrusted repo being
QA'd, whose planted node_modules would then be where the heal runs the
playwright install (repo-controlled code execution). os.homedir() plus an
absolute-or-skip guard closes the class.
launchWithXProtectHeal also wraps the post-heal retry: a second classified
failure previously propagated raw, dropping the manual-remediation guidance
exactly when the automatic path had just proven insufficient.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(make-pdf): --strict and --confidential join BOOLEAN_FLAGS; the guard test derives the set from source
Both flags are read as '=== true' booleans but were missing from
BOOLEAN_FLAGS, so 'generate --strict essay.md' still ate essay.md as the
flag's value — the exact #2514 failure the set exists to prevent. The
completeness guard hardcoded six names and could not catch it; it now
derives every boolean read from cli.ts itself (direct reads plus
booleanFlag pairs), so the next boolean flag fails the suite until it
joins the set.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(todos): file the v1.67 adversarial-review residuals + coverage-audit test-gap backlog
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* v1.67.0.0: version bump (MINOR — full-tracker fix wave, pre-approved)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(changelog): v1.67.0.0 release summary + itemized changes with contributor credits
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(todos): mark the 2026-08-14 tracker-audit waves shipped in v1.67; re-file the four residuals
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(uninstall): provenance-gate the shape-2 and cursor sweeps; document the alias-name coupling
Three ways gstack-uninstall could touch a user's own skills:
- Shape 2 (real dir + symlinked SKILL.md) matched the link target against a
bare *gstack* substring, so a skill symlinked from ~/tools/gstack-fork/ was
wiped on uninstall. The gate now requires "gstack" as an anchored path
segment (gstack/*|*/gstack/*, same pattern as shape 1) AND the dir name in
gstack's skill inventory (parity with shape 3); anything else is listed to
stderr, never deleted.
- The new Cursor removals (~/.cursor/skills/gstack* and repo-local
.cursor/skills/gstack*) rm -rf'd any glob match with no provenance check,
so a hand-written ~/.cursor/skills/gstack-fork-notes was swept. Real dirs
now require the AUTO-GENERATED banner in SKILL.md; non-matching dirs are
kept and listed. Legacy codex/factory/kiro globs are untouched (tracked in
TODOS as a follow-up).
- The _INVENTORY seed list hardcodes alias names created by setup's
_install_alias_skill_md; both sites now carry mirrored keep-in-sync
comments so a renamed alias can't silently strand its dir.
The skipped-entry report moves to the end of the run so cursor skips are
listed alongside the Claude ones.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): env.kv stops flagging cacheKey-style names; prepush exclusion scoped to the push remote
Two calibration/coverage fixes in the redaction guard:
- env.kv's zero-or-more-prefix regex fired on ANY identifier ending in a
credential suffix, so ordinary code (cacheKey:, sortKey:, partitionKey:,
hotkey:, even monkey:) with an 8+-char entropic value hit a MEDIUM confirm
prompt — a gate that cries wolf gets ignored. A name now only counts when
its shape is credential-semantic: suffix separated by _/-/. (api_key,
x-access-key, AUTH.TOKEN), a bare suffix (key:, token:), ALL-CAPS env style
(APIKEY=, MY_APIKEY=), or a camel compound with a credential prefix
(apiKey, authToken, clientSecret). The value stays capture group 1, so the
shape check lives in validate (isCredentialShapedEnvName), not the regex.
- gstack-redact-prepush's narrowing excluded commits reachable from ANY
remote (`--not --remotes`), so a secret that had only ever reached a
private/local-path remote was never scanned when later pushed to a PUBLIC
remote. The exclusion is now scoped to the push target
(`--remotes=<name>/*`) via the remote name git hands pre-push as $1 (the
installed wrapper already forwards "$@"); stdin/CLI invocations and URL
pushes without a configured name fall back to the historical all-remotes
behavior. #2592's catch-up-merge fix is unaffected: upstream commits come
from the same remote being pushed to.
New coverage: env.kv negative controls (cacheKey/sortKey/partitionKey/
hotkey/monkey/idempotencyKey) + positive controls for all four name shapes;
end-to-end hook tests proving a second-remote secret blocks a push to origin
while origin-published catch-up content still doesn't, plus both fallbacks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): honest probe budget, bounded daemon log, single refusal source, liveness + reinstall coverage
Five hardening items in the browse CLI and its tests:
- probeHealthWithBackoff's advertised ~8s budget could really run ~10s: the
final 2s probe could start 1ms before the deadline, and every call site
had JUST run a failed probe yet the loop re-probed immediately.
Iterations now start with the sleep and each probe's timeout clamps to
the remaining budget (isServerHealthy takes an injectable timeout).
- browse-daemon.log is append-mode across every respawn with no size cap,
so a crash-respawn loop fills the disk. The path is now built in one
place (daemonLogPath — the Unix fd path and the Windows launcher string
had two spellings) and daemon start rotates a >10MB log to
browse-daemon.log.1, single generation, matching the repo's 10MB
rotation convention. Rotation is exported + injectable and behaviorally
unit-tested.
- The two "healthy daemon already running" refusal blocks in connect had
already drifted (one lost the tabs/cookies/logins explainer) — extracted
refuseHeadedOverLiveDaemon as the single source.
- process-liveness: pinned the EPERM-means-alive contract (PID 1 on POSIX,
PID 4 on Windows — signalable-or-EPERM, both alive). A probe that reads
EPERM as dead is the false negative that leaked agents.
- runBoundedChromiumReinstall had zero coverage: now exercised end-to-end
against a stub bunx on a prepended PATH — exit 0, install-exit-N with
stderr tail, the detached group-kill timeout path (child of the child
dies too), and spawn-error.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(hooks): timeline Stop hook reads a 256KB tail instead of the whole file
The Stop hook runs on EVERY Claude Code turn machine-wide and re-read +
JSON-parsed the entire timeline each time, scaling to the 10MB size cap
(~100-300ms per turn of pure overhead). It now reads only the last 256KB
via fstat + positioned read, discarding the first partial line when the
window starts mid-file.
Semantics: a dangling "started" older than the last 256KB of appends
belongs to a session long gone — beyond repair interest. The window can
never fabricate a dangling entry ("completed" is always appended AFTER its
"started", so any started inside the window has its completion inside the
window too), so idempotency holds. The fail-open contract is unchanged:
exit 0 always, size cap kept, deadline re-checked before the write.
New test: a >256KB timeline where a recent dangling entry still gets
repaired while an old out-of-window dangler is left alone; all existing
fail-open cases pass unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): Windows runtime-asset copies prune nested gitignored build output
_link_skill_runtime_assets' exclusion list filters DIRECT children only, so
the Windows cp -R real-copy path swept NESTED gitignored build output into
the installed skill dirs — concretely, ios-qa/scripts/gen-accessors-tool/
.build is 252MB per install. The IS_WINDOWS real-copy branch now prunes
nested node_modules/.build/dist post-copy (find -prune -exec rm -rf).
Scoped to _link_skill_runtime_assets ONLY: the generic _link_or_copy stays
untouched because runtime roots (browse/, design/) intentionally copy their
dist/ binaries. On Unix the assets are symlinks into the working tree, and
the prune is gated on the real-copy shape so it can never delete build
output from the repo through a link — both directions pinned in
test/setup-windows-rerun-refresh.test.ts with fixture trees.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(upgrade): migrations see the real install dir; stash can no longer resurrect stale renders
Two ways the v1.67 render-dirt cleanup was inert in the wired upgrade flow:
- Both migration runners invoked `bash "$migration"` without
GSTACK_INSTALL_DIR, so migrations that clean the INSTALL (v1.67.0.0.sh
defaults to ~/.claude/skills/gstack when unset) silently no-oped for
repo-local installs. setup now passes "$SOURCE_GSTACK_DIR" and the
/gstack-upgrade Step 4.75 runner passes the detected "$INSTALL_DIR".
- /gstack-upgrade Step 4 ran `git stash` BEFORE reset+setup, so the tree
was always clean by the time the migration ran, the legacy render dirt
landed in stash@{0}, and Step 4's own note then told the user to
`git stash pop` — restoring stale generated SKILL.md over the fresh
checkout permanently. Step 4 now discards the render footprint
(generated SKILL.md and sections/*.md modifications only, the same
classification as migrations/v1.67.0.0.sh) BEFORE stashing, so the stash
only ever carries real user changes; the stash-pop note says the render
dirt was discarded and regenerates. The migration stays for manual
git-pull flows.
Template change regenerated for all 3 hosts (claude tree checked in;
codex/factory trees are gitignored render outputs).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): stop --force-restart kills the live daemon directly instead of booting a fresh one
`browse stop --force-restart` on a live-but-busy daemon fell through the
stop short-circuit into ensureServer(), whose force-restart path kills the
daemon and then STARTS A FRESH ONE (daemon + Chromium, multi-second churn)
just so sendCommand('stop') can shut it down again — the #2254 churn in
force clothing. gstack-upgrade's Step 4.8 sends users down exactly this
path when a stale daemon is busy after an upgrade.
The stop short-circuit now handles it: live pid + --force-restart → kill
the daemon (tree-kill on Windows, TERM→KILL on POSIX), reap the orphaned
Chromium + clear profile locks, remove the state file, exit 0 — no server
is ever started. Pinned in stop-dead-daemon.test.ts: a wedged live "daemon"
is killed, the state file stays gone (a booted daemon would have rewritten
it), and no Starting/Restarting output appears.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(hooks): timeline repair counts started vs completed per key instead of set-masking
The dangling-event repair kept only the FIRST "started" entry per
skill+session key and treated "completed" as a set, so any key where one
run completed and another dangles was never repaired — and keys are not
unique per run: legacy entries with no session field all share the
bare-skill key, and the preamble's "$$-epoch" session ids collide within
the same second. One old completion masked every future dangler forever.
The hook now counts started vs completed per key and appends completions
for the DIFFERENCE. Idempotency holds by construction: the appended
completions balance the counts, so the next Stop appends nothing. Pinned
with the two-runs-one-dangling case plus a re-run no-op assertion; all
existing fail-open cases pass unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(setup): Windows refresh bypass no longer deletes a user's own skill dirs
The #2444 IS_WINDOWS refresh bypass (link_codex/factory/opencode/cursor
_skill_dirs) rm -rf's the destination before re-copying — and the host
skills dirs are SHARED namespaces, so the gstack* glob can land on a
user's OWN real directory (e.g. ~/.cursor/skills/gstack-notes). Every
./setup re-run silently deleted it — the ownership guard the comments
still claimed (#2142). The sidecar installers had the same shape against
a hand-written skill squatting on the canonical .../skills/gstack root,
and create_cursor_runtime_root wiped that root unconditionally on every
platform.
Same provenance model as bin/gstack-uninstall (#2563):
- _owned_for_windows_refresh: a real dir is only replaced when its
SKILL.md carries the AUTO-GENERATED banner; symlinks and missing
targets always pass. Non-matching dirs are kept and listed to stderr.
Wired into all four *_skill_dirs loops.
- _sidecar_root_user_owned: a root whose SKILL.md exists WITHOUT the
banner is the user's — create_agents_sidecar, create_cursor_sidecar,
and create_cursor_runtime_root skip it entirely instead of writing
into (or wiping) someone else's skill. A root with no SKILL.md stays
presumed ours (the documented install location; old/partial installs
look like that).
Pinned by a static census (every bypass site must carry its gate) plus
behavior fixtures: a bannerless user dir survives the Windows re-run
while a bannered install still refreshes, and a squatted sidecar root is
left untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(render): a failed brain-aware render can no longer vanish the installed skill set
Both render sites (setup's gbrain step and gstack-config gbrain-refresh)
ran `rm -rf` on the LIVE render dir BEFORE invoking gen:skill-docs:user.
Installed skills symlink into that dir (relink prefers it), so one
transient render failure — bun error, disk full, broken template — left
every brain-aware skill's SKILL.md symlink dangling: the whole skill set
vanished from Claude Code until a successful re-render.
Both sites now render into "$RENDER_DIR.tmp.$$" and swap it in only on
SUCCESS via a shared-contract _swap_in_render helper (mv old away, mv tmp
in, drop old — links into the live path stay valid because the path never
changes). The failure branch removes only the tmp dir and says so: the
previous render, and every link into it, stays fully intact. The
deliberate wipe on the gbrain-GONE path (stale render shadowing canonical
files) is unchanged.
Pinned in test/user-render-out-dir-install.test.ts: static shape (render
targets the TMP dir, never the live dir), _swap_in_render driven
behaviorally from BOTH files, and an end-to-end failure-branch fixture
proving a pre-existing render plus an installed symlink survive a failed
render.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test+docs: codex probe cache invalidation coverage, make-pdf --no-* structural pin, file the review-batch deferrals
- test/codex-model-probe.test.ts: the 1h TTL and the auth.json half of the
mtime signature had no coverage — a regression in either would silently
serve a stale MODEL_OK after re-login or forever. Added TTL-expiry
(backdated cache line re-probes) and auth.json-mtime invalidation cases,
mirroring the existing config.toml case.
- make-pdf/test/cli-args.test.ts: structural assertion derived from the
commands.ts registry — every --no-* flag must be in BOOLEAN_FLAGS, so a
new negation flag can't silently re-open #2514 (swallowing the next
positional).
- TODOS.md: filed five review-batch deferrals under the v1.67 queue with
rationale and effort: setup host-function dedup, cmd.exe %VAR% quoting in
gbrainInvocation (cross-spawn direction), make-pdf flag registry metadata
(derive BOOLEAN_FLAGS), legacy codex/factory/kiro uninstall provenance
gating (parity with the cursor gate), and cursor auto-detect breadth
(product call).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): package.json version check accepts the decision-11 npm translation
The bump wrote the npm-valid 3-digit manifest version for the first time
this release; the old assertion demanded byte-equality with the 4-digit
VERSION. Accept the translation plus the grandfathered pre-v1.67 mirror,
matching gstack-version-bump's own drift contract.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: sync project documentation with the v1.67.0.0 fix wave
Port range 10000-49151 + busy-vs-dead daemon semantics + XProtect launch
heal + browse-daemon.log in BROWSER.md/ARCHITECTURE.md; #2557 dead security
surface (shield, L4b Haiku, DeBERTa ensemble, canary injector) marked
removed in README/ARCHITECTURE per CLAUDE.md's do-not-redocument note;
runtime-asset installs + alias copies in CONTRIBUTING/CLAUDE.md; manual
uninstall fixed for asset-bearing dirs, alias copies, cursor/opencode
roots, and the timeline Stop hook; gbrain-refresh out-dir render path;
npm-valid package.json version translation documented in CLAUDE.md;
patches/ in the project tree; two CHANGELOG accuracy fixes (-272 net
lines, upgrade-time quarantine-clear) + release-summary em-dash polish.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(browse): findAvailablePort comment matches the 49151 range cap
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci-image): the dependency layer carries patches/ — bun install needs the patch files the lock declares
bun.lock's patchedDependencies (playwright-core windowsHide) made
'bun install --frozen-lockfile' fail inside the image build: the Dockerfile
copied package.json + bun.lock but not patches/. The image-tag hash in all
three workflows (ci-image, evals, evals-periodic — kept in lockstep) now
includes patches/** so editing a patch rebuilds the layer instead of
serving a stale cache.
Verified: the exact COPY set (package.json + bun.lock + patches) installs
clean in a Linux container; without patches it reproduces the CI failure.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(codex-probe): cache signature uses GNU-first stat with numeric validation
On GNU stat, -f means FILESYSTEM mode — the BSD-first form emitted a
multi-line filesystem block on Linux, so the cache signature never matched
its own cache line and the model-probe cache missed on every read (each
preflight re-paid the probe). Same class and same fix as #2195: GNU -c %Y
first, BSD -f %m fallback, non-numeric residue coerced to 0.
Verified: the probe test file passes 7/7 under real GNU stat in a Linux
container (it failed 2/7 on Linux CI before).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): first cross-platform run of the wave's tests — Linux tmp portability + Windows-lane truthfulness
Four platform holes from the lanes' first full run over the v1.67 tests:
- uninstall neutral-root fallback hardcoded /private/tmp (macOS-only) and
ENOENT'd on Linux CI, where the shard TMPDIR is the gstack-containing
path that forces the fallback — now realpath'd literal /tmp.
- uninstall's kept-and-listed assertion demanded a backslash path on
Windows while the bash uninstall prints POSIX paths — now
separator-insensitive.
- setup-rerun's IS_WINDOWS=0 sub-case and the iron rule's force-restart
consent path are Unix-shaped by construction (Git Bash ln -snf copies
without Developer Mode; the consent path boots a real replacement daemon
the browserless Windows lane cannot host) — gated off win32 with the
reasons in place; the Windows-relevant halves still run there.
- codex-under-codex-detection drives rendered bash under a hardcoded POSIX
PATH, so every case saw empty output on Windows — moved to
KNOWN_WINDOWS_INCOMPATIBLE with the run receipt.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci-image): stage patches/ into the narrow build context in all three workflows
The image builds from context .github/docker, into which a staging step
copies package.json + bun.lock — the previous fix added COPY patches to the
Dockerfile but not patches/ to that staging, so buildx failed computing the
COPY checksum ('/patches: not found'). All three workflows (ci-image, evals,
evals-periodic) stage identically, in lockstep with the shared tag hash.
Verified: a build over the exact staged context resolves both COPY layers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Stefan Andrei <89592870+sneakygriff@users.noreply.github.com>
Co-authored-by: Lucky Wenapere <luckydio10@gmail.com>
Co-authored-by: H M Ibtihal Utsho <ibtihal.utsho.ai@gmail.com>
Co-authored-by: ShahriarLak <shahriar.lak1@gmail.com>
Co-authored-by: Mike Laniak <mike.laniak@gmail.com>
Co-authored-by: Yuan Sun <forrest.sun527@gmail.com>
Co-authored-by: Greg Jackson <gregj64@gmail.com>
Co-authored-by: Sebastian Totté <sebastiantotte@gmail.com>
Co-authored-by: IDST UK <IDSTUK@users.noreply.github.com>
Co-authored-by: SomSamantray <SomSamantray@users.noreply.github.com>
Co-authored-by: Mateus Moraes <mmoraes@users.noreply.github.com>
Co-authored-by: Evgenii Lopatin <e75533@gmail.com>
Co-authored-by: Carrington Dennis <carrdenn3@gmail.com>
Co-authored-by: YR <work.yiftah.rottem@gmail.com>
Co-authored-by: ortonom <3261546+ortonom@users.noreply.github.com>
Co-authored-by: Scott <scott@peninsulaminerals.com>
Co-authored-by: SYKhayyat <shaulyoelkhayyat@gmail.com>
Co-authored-by: phuttimatebenchanakatkul <phuttimatebenchanakatkul@gmail.com>
Co-authored-by: vaston-viji <215998886+vaston-viji@users.noreply.github.com>
Co-authored-by: Frederik Kaster <frederik.kaster@noygear.ai>
Co-authored-by: meshailabs <devsupport@meshai.dev>
Co-authored-by: ming <silverchris@foxmail.com>
Co-authored-by: gamerey43 <gamerey43@users.noreply.github.com>
Co-authored-by: tranthanhnhatkhoa <tranthanhnhatkhoa@users.noreply.github.com>
Co-authored-by: harjothkhara <harjothkhara@users.noreply.github.com>
Co-authored-by: chiragborse1 <chiragborse1@users.noreply.github.com>
Co-authored-by: Tim White <itstimwhite@users.noreply.github.com>
Co-authored-by: anupamme <anupamme@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci: bump CI image Bun 1.3.10 -> 1.3.13
Matches the local toolchain and brings native `bun test --shard=M/N` /
--parallel to CI (needed by the free-test lane and shard runner work).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: stop version bumps rebuilding the eval Docker image (cache key trio)
Three coupled fixes, atomic because any subset is worse than none:
1. Image tag keys on hashFiles(Dockerfile.ci, bun.lock) — package.json is
out: its version field changed on 60/60 recent commits, forcing a ~2min
image rebuild per PR for a dependency set only bun.lock determines.
2. ci-image.yml now pushes that same content-hash tag (previously only
:latest/:sha, so the weekly prebuild never warmed the tag the eval
matrix actually looks up) and both eval workflows get registry layer
cache (cache-to export gated to same-repo runs; fork tokens cannot
write GHCR).
3. Dockerfile bakes /opt/node_modules_cache/.bun.lock and the runtime
Restore-deps guard diffs bun.lock instead of package.json — otherwise
every version-only bump made all 14 matrix jobs fall back to a live
bun install, which is slower than today's behavior.
Worst-case failure mode is self-healing: a missing tag or cache falls
back to exactly the previous rebuild-and-install path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: stop double-running lint + skill-docs on every PR commit
Both fired on unrestricted push AND pull_request, so each PR push ran
them twice (12 duplicate (headSha, workflow) pairs in the last 200 runs).
push is now main-only; pull_request covers PR branches.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: run actionlint from the prebuilt image (16s -> ~2s)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: right-size five single-core jobs to ubicloud-standard-2
actionlint, skill-docs, version-gate, pr-title-sync, and the evals report
job never exceed one core; standard-8 was ~4x the cost for zero wall-clock.
build-image and the eval matrix keep standard-8.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: fix workflow_dispatch concurrency collisions (head_ref || run_id)
head_ref is empty on workflow_dispatch, so every manual dispatch of these
four workflows shared one empty-suffix group and cancelled each other.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(windows): cache bun installs; run the curated suite, not a hand list
- actions/cache on ~/.bun/install/cache keyed on bun.lock (install was
35-45s of both 55-64s jobs, all network) and Bun pinned to 1.3.13 to
match the other lanes.
- windows-free-tests now runs `bun run test:windows` (the runner's
--windows-only curation) instead of a hand-listed 13-file subset that
had drifted from the registry it sampled. POSIX-bound tests get
excluded in ONE place (the curation patterns), not two.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: retry 1, not 2, on every paid path
Measured on the llm-judge shard: --retry 2 amplified 25 tests into 46
executions (+84%), with retried runs at 138s vs a 10-12s baseline (429
backoff), and a permanently-failing test paying 3x. One retry still
absorbs one-off flakes; chronic flakes become visible fix-work instead
of silent wall-clock.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: split skill-e2e-review into three per-file CI shards
Bun runs describe blocks as concurrency barriers, so the e2e-review CI
job executed its tests serially: 741s of an 860s PR critical path for
tests whose slowest member is 224s. The per-file matrix is the repo's
parallelism unit, so the split moves:
- Retro E2E + retro-base-branch -> test/skill-e2e-retro.test.ts
- review/ship base-branch + Review Dashboard Via Attribution
-> test/skill-e2e-review-attribution.test.ts
- sql-injection / enum-completeness / design-lite stay in
test/skill-e2e-review.test.ts
One 741s job becomes three ~180-250s jobs. Locally the worst paid shard
drops from 1705s (94.7% of the 1800s kill) to under 700s. Test names,
bodies, suite strings, and eval-store collectors are unchanged, so
baselines carry over. Matrix rows added to both eval workflows
(attribution is gate-only, so no periodic row); the report job's
hardcoded runner count is gone (drift-proof).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: gate security-bench on SECURITY_BENCH=1, not model-cache existence
The existsSync gate ran ~12s of ONNX inference (plus a HuggingFace
dataset fetch) on every free-suite run on any dev box that had ever
warmed the classifier, while CI (no cache) silently skipped it. Now
explicit opt-in: SECURITY_BENCH=1 bun test browse/test/security-bench.test.ts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: watchdog E2E in 1.5s instead of 22.7s (tunable poll interval)
server.ts gains BROWSE_WATCHDOG_INTERVAL_MS (floor 50ms, default 15s
unchanged). The #994 stay-alive test runs a 250ms tick and waits for the
stay-alive log line instead of blind-sleeping 2s + 20s past the
production interval.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: dedupe coverage gates; route both walks through skill-census
skill-coverage-floor duplicated two matrix assertions (registry
completeness, gate-tier floor) with a DIFFERENT hand-rolled directory
walk — matrix's skipped nothing, floor's skipped node_modules/docs/test.
Two 'same' gates disagreeing on the census is the bug class
test/helpers/skill-census.ts was written to kill. Registry assertions
now live in matrix only (with floor's better error message), both files
walk via skillCensus().authoredSkills, and floor keeps the per-skill
structural checks it owns.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: EVALS_JOBS for shard processes; explicit within-shard concurrency
EVALS_CONCURRENCY was overloaded: the legacy bun-test path used it as
--max-concurrency (default 15) while the sharded runner read it as the
process count — exporting the legacy value gave 15 concurrent Bun
processes each spawning claude (the 429 storm). Now: EVALS_JOBS = shard
processes (default 4); EVALS_CONCURRENCY = bun --max-concurrency inside
a shard (default 4, explicit in shard args — omitting it made
within-shard parallelism silently differ from the legacy path). Stale
49/59 header math replaced with the live-count rule.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: enforce detach-timeout floor from the live shard census
New free tripwire: eval:bg:gate / eval:bg:periodic --timeout must cover
ceil(shards/jobs) x shard-timeout x 1.05, recomputed from the actual paid
test census every run. Hand-derived numbers go stale every time a paid
file lands — the review split just proved it: periodic's 28800s dropped
BELOW its new 32130s worst case (raised to 32400s here). An undersized
watchdog kills healthy runs and the tail reports never-started.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: preflight ping once in the sharded parent, not per shard
The Anthropic fail-fast ping ran at module load in every paid test file
importing e2e-helpers — ~30 paid claude -p calls (30s timeout each) per
full sharded run for one bit of information. The parent now pings once
before spawning shards and sets EVALS_PREFLIGHT_OK=1; the module-load
path honors the flag. Extracted to test/helpers/anthropic-preflight.ts
(injectable spawn seam) with regression pins in both directions: the
flag must skip, its absence must ping exactly once, dead API must throw.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: split touchfiles into pure data + selection logic + facade
touchfiles.ts listed ITSELF in GLOBAL_TOUCHFILES, so adding one test's
dep entry forced the full ~$38 / 30-45min suite — measured on 21.9% of
recent commits (42/192). The self-reference existed because data and
logic shared a file: any edit COULD be a selection-logic change.
Now: touchfiles-data.ts (the four maps, literals only, zero imports —
the future map-diff target), test-selection.ts (matchGlob/detectBase
Branch/getChangedFiles/selectTests), and touchfiles.ts as a re-export
facade so all ~12 import sites are untouched. GLOBAL_TOUCHFILES drops
the self-ref, adds test-selection.ts (logic stays maximally
conservative), and TEMPORARILY adds touchfiles-data.ts until the
map-diff change lands. New free test pins the literal-only property
(comment-aware state-machine scan with a self-test) and facade export
parity (===), so neither can silently rot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: free runner — strict output, parallel execution, stable shard indices
Three coupled changes to scripts/test-free-shards.ts:
1. STRICT OUTPUT: runFreeShard streams through the paid runner's
BunTestOutputClassifier — exit 0 without bun's 'Ran N tests across M
files' summary, with (fail) lines, or with a wrong file count is a
FAILURE (anti-truncation backstop at the runner layer), plus an
external wall-clock timeout that SIGKILLs the process group
(timed-out distinct from failed; exit 124 vs 1). Also fixes a latent
shard-bleed: file selectors now use exactTestFileSelectors (relative
paths were substring filters that matched sibling roots).
2. PARALLEL: full-suite mode is one 'bun test --parallel' invocation
(Bun 1.3.13). Measured semantics recorded in the header: per-file
worker isolation, standard summary, and mid-suite process.exit
surfaces as a crashed-worker FAIL with exit 1 — strictly safer than
serial, where the same exit truncates silently. No static weight
lists; --shards M --shard i keeps deterministic hash partitioning for
CI matrices (native --shard rejected: round-robin renumbers when
files land). Spawned shards get throwaway GSTACK_HOME/TMPDIR so
parallel shards can't contend on real state. Per-shard epilogue
prints files/seconds/status every run.
3. Stable indices: assignFilesToShards no longer drops empty shards, so
a shard's index depends only on the file hash and requested count —
an empty CI matrix slot is a fast no-op success, not a renumbering.
package.json 'test' now delegates to the runner (TEST_ROOTS becomes the
single source of truth for roots; slop:diff tail preserved; the runner
inherits the 30s per-test timeout the old glob passed inline).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: Linux free-test lane — ~400 files get CI coverage for the first time
New required, secretless free-tests job: the canonical runner's single
'bun test --parallel' invocation with strict-output classification on
ubicloud-standard-8. The free suite previously ran on NO Linux CI — only
a curated Windows subset ran anywhere — so every 'tests pass' claim
about main rested on contributors running them locally.
Secretless by design (no API keys; fork PRs finally get real test
signal) and pinned by test/free-tests-workflow-wiring.test.ts: canonical
runner invoked, zero secrets.* references, pull_request never
pull_request_target, and matrix-count/--shards agreement if anyone
switches to the sharded fallback.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: map-diff selection — a touchfiles-data edit runs only what changed
Editing the eval dep-list data no longer forces the full ~$38 /
30-45min suite (measured on 21.9% of recent commits). When
touchfiles-data.ts is in the diff, selection now evaluates the BASE
version (git show -> mkdtemp -> spawnSync bun child printing the four
maps as JSON — sync because e2e-helpers selects at module scope) and
JSON-diffs per key: added entries, edited dep lists, and tier flips are
selected; keys removed from all maps are reported, never silently
dropped; a GLOBAL_TOUCHFILES edit still runs everything.
FAIL-CLOSED with named causes: missing-base-ref, git-show-failed,
import-failed, shape-mismatch each degrade to run-all and print
'selection: global — touchfiles-data changed (<cause>)' (D9 — silently
expensive beats silently wrong, but never silently). eval:select prints
'selected N of M, reason: ...' + removed tests; --base scopes the
map-diff too.
The temporary conservative GLOBAL entry for touchfiles-data.ts is gone —
its changes route through the map-diff. 23 new free tests: pure-core
fixtures, selectTests wiring incl. a poison-injection guard, and a temp
git repo exercising every fail-closed cause end-to-end.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: selection sees uncommitted work; git errors fail closed
getChangedFiles is now the deduped union of committed (base...HEAD),
staged+unstaged (git diff HEAD), and untracked (git status --porcelain
--untracked-files=all) — an agent that edits files and runs evals
BEFORE committing no longer gets the full $38 suite every time because
the committed diff looked empty. Clean tree still returns [] (run-all
by design for main-branch/periodic runs).
Git failures now THROW with the failing command, stderr, and 'set
EVALS_ALL=1 to deliberately run the full suite' — the old return []
silently became run-all, which is silently expensive. 11 new free tests
cover every source, dedupe, quoted paths, and both failure shapes via
an injectable spawn seam.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: revert GSTACK_HOME injection in the free runner — shared mutable state
The first full run under the strict runner surfaced 12 failures with one
root cause: injecting a single throwaway GSTACK_HOME per invocation made
6,900 tests share a MUTABLE scratch home. gstack-config tests wrote keys
into it; relink and update-check tests then read them (e.g. relink saw
skill_prefix left behind by a config test and produced prefixed names).
All 12 pass when run directly.
TMPDIR isolation stays (mkdtemp inside it is still per-call unique).
Tests needing GSTACK_HOME isolation mkdtemp their own per test — the
repo convention — and hermetic-env covers E2E children. The env-dump pin
now asserts GSTACK_HOME passes through UNTOUCHED so the injection can't
come back.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: rebase parity baseline to v1.64.0.0; fix capture-vs-check drift
The parity ratchet had quietly failed for 7 skills — v1.58-v1.64 growth
landed past the v1.57.7.0 anchors and nothing caught it because this
test had no CI lane (verified pre-existing: SKILL.md content is
byte-identical to origin/main). Same rebase protocol as
v1.53->v1.57.7.0; old baseline retained for the audit trail.
Root-caused a second latent bug while rebasing: captureBaseline recorded
SKELETON-ONLY bytes while the checker compares UNION bytes (skeleton +
carved sections/*.md), so a fresh capture read carved skills at ~2x
ratio (ship: 82KB captured vs 183KB checked). captureBaseline now takes
sectionedSkills and records unions for carved skills — capture and check
measure the same thing, so the NEXT rebase can't hit this. Four
CARVE_GUARDS skeleton caps re-ratcheted to current +headroom
(plan-ceo 92K, plan-eng 70K, office-hours 100K, design-consultation
70K), annotated inline.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: package.json version matches VERSION (1.64.0.0)
v1.64.0.0 shipped with VERSION bumped but package.json left at 1.63.0.0
— the 'package.json version matches VERSION file' test fails on
origin/main today. Nothing caught it because that test had no CI lane
until this branch's free-tests job.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: fix variants-retry-after HTTP-date flake (TODOS P2)
toUTCString() truncates to whole seconds, so a +3000ms Retry-After date
could mean an effective wait of ~2001ms — flaking against the 2500ms
assertion floor ~1-2 in 9 runs under suite load. +4000ms puts the
truncation floor at 3001ms with the assertion floor safely below it.
Pulled forward from U4 because the free-tests lane is now a required
check and this flake would randomly block PRs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: skill-fixture helper — extract SKILL.md sections, don't copy files
extractSkillSections (fence-aware H2 scanner, loud-throw on missing
sections with available-heading list), extractSkillBody (drops the
shared generated preamble), extractSkillHead (frontmatter + first 30
lines, for routing fixtures). Pinned section lists per consumer, and
free-tier real-skill pins so a gen-skill-docs heading rename fails the
FREE suite instead of a paid run. skill-fixture.ts joins
GLOBAL_TOUCHFILES (fail-safe polarity: over-select).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): review E2E fixtures extract sections — 1871 -> 207 lines
CLAUDE.md's extract-don't-copy rule, applied: the three review fixtures
carry only the sections the sql-injection/enum/design-lite prompts and
judges exercise (89% cut). Full-file copies made claude -p read 1871
lines per test — the direct cause of the 1705s worst shard (94.7% of
the 1800s kill).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): retro E2E fixtures extract sections — 1821 -> 757 lines
Keeps every section the retro flow exercises incl. base-branch detect;
drops preamble, Global Retrospective Mode, Compare Mode (58% cut).
retro-base-branch was the single slowest CI test at 224s.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): review-army fixture extracts sections — 1871 -> 650 lines
CS1's set plus Step 1.5 (PLAN COMPLETION AUDIT machinery) and Step 4.5
(army dispatch, quality_score, findings schema) that the 7 army tests
assert on. Pin test guards the three load-bearing strings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): skillify fixtures via extractSkillBody — 63-83% smaller
Tests follow all 11 skillify steps, so the whole body stays; only the
shared generated preamble drops (skillify 1239->453, scrape 958->167).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): context-skills fixtures via extractSkillBody — 74-82% smaller
context-save 1037->267 lines, context-restore 952->168; the 8 tests
exercise full save/restore/list flows so the body stays, preamble drops.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): opus-47 discovery fixtures via extractSkillHead — ~95% smaller
Routing/fanout tests only read frontmatter + opening lines of the 14
installed skills (review 1871->54, office-hours 1706->80).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): codex runner gains sections option — review variant 88% smaller
runCodexSkill/installSkillToTempHome accept sections?: string[] routed
through extractSkillSections; codex-review-findings wired (1465->181
lines). codex-discover-skill deliberately keeps the FULL copy — its
stderr assertions validate that the real generated artifact loads.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): routing fixture installs skill HEADS, not ~18 full SKILL.md
Routing reads frontmatter only; extractSkillHead per skill (root
611->48, ship 1435->54 lines). This was the single worst fixture bloat
site: one fixture dir holding ~18 full skills.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: parent-side shard skipping — a one-test diff runs 3 of 44 shards
The sharded runner spawned every shard regardless of diff; only the
child self-skipped, so a typical single-skill change still paid 44 Bun
boots + container-equivalent setup for shards with zero selected tests.
The parent now computes selection once (mirroring e2e-helpers exactly:
EVALS_ALL -> run-all, empty union -> run-all, git errors propagate the
fail-closed throw) and drops shards where no selected test name maps in.
Mapping = quoted E2E map keys in the file's source UNION keys whose dep
list registers the file (constructed-name families need the second
direction). FAIL-OPEN everywhere it matters: run-all, non-skill-e2e
files, unreadable source, zero mapped names all keep the shard — the
child filter stays authoritative, so a parent bug can only run extra.
New taxonomy status skipped-by-diff (never conflated with
never-started); selection banner prints once; --list is selection-aware.
C6 lands in the same commit: a HARD tier-alignment test — every paid
skill-e2e file must be parent-mappable or provably fail-open-safe.
Note: this change-set's 14 dep-list registrations in touchfiles-data.ts
rode along in f945c841 (concurrent-agent staging); they belong to this
change logically.
Demo: selection of one test -> 'running 3 of 44 shards, 41
skipped-by-diff'. 13 new $0 tests via injected seams.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: fix context-save-list test that was 0-for-26 ($5.28, zero passes)
Disposition for the eval store's only permanently-red test. Root cause:
the hide-other-branches assertions scanned the FULL output surface
(incl. bash tool_results), so any agent that ran ls on the checkpoints
dir — the natural first step of a list flow — surfaced all three seeded
filenames and failed, even when its user-facing listing filtered
correctly. The test punished the agent for looking at the directory.
The hide-assertions now scan the agent's FINAL TEXT (the listing the
user sees); showsMain keeps the broad surface for its documented reason.
Validated live in the final gate run rather than quarantined: the test
guards real behavior (branch filtering) and the assertion was the bug.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: wire 12 orphaned test files into the free suite (D3a)
ios-qa/daemon/test (10 files), ios-qa/scripts/gen-accessors.test.ts, and
browser-skills/hackernews-frontpage/script.test.ts ran under NO script
or CI — written coverage catching nothing. All 174 tests green on
arrival (4.6s), zero quarantines needed. TODOS P2 closed: main wired
design/test in v1.64, the variants-retry-after flake it named is fixed
on this branch, and this commit lands the remaining orphans.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: supabase-provision runs in-process — 16.5s -> 0.45s
bin/gstack-gbrain-supabase-provision (482-line bash) becomes a 26-line
bun-shebang entry over a new importable lib/gbrain-supabase-provision.ts
with an injected-deps seam (fetch/env/stdout/sleep — D7: args, never
env-mutation-before-import). The 33 spawn-per-test cases run in-process
against the same Bun.serve mocks; exactly one spawn smoke keeps the
shebang/CLI/receipt contract covered.
Byte-compat proven by a 25-case differential harness (old bash bin from
git vs new, same mock): stdout, stderr, exit codes identical across all
subcommands, JSON/plain modes, and error paths. Egress receipts stay
per-attempt, receipt-before-send, fail-closed (scanner updated:
SHELL_SINKS -> MODULE_SINKS). No-op sleep injection makes retry/backoff
paths instant.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: kill the 3,372-line zombie monolith; revive 4 never-run tests
test/skill-e2e.test.ts survived the v1.56 split as a zombie: the paid
glob needs the skill-e2e-* hyphen, so with EVALS=1 NOTHING has executed
it for ~8 releases — and it held the ONLY implementations of four
map-registered tests: review-coverage-audit (gate), plan-eng-coverage-
audit (gate), ship-triage (gate), ship-idempotency (periodic). Three
gate tests silently never ran — the exact 0%-execution class this
branch exists to kill.
Rehomed into test/skill-e2e-coverage-audit.test.ts, -triage.test.ts, and
-ship-idempotency-sdk.test.ts with bodies byte-identical modulo collector
wiring and fixture extraction (drift observed in the skills since v1.56
is DOCUMENTED in each header, not fixed — their first paid run in 8
releases must attribute failures to drift, not to this move). All 24
other monolith names were true duplicates of the split files — dropped
with the monolith. Matrix rows added to both eval workflows; the paid
glob's zombie-exclusion is now a commented regression pin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: fix two parallelism-exposed flakes (probe re-run, live-tree census)
Both pass solo and on main but flaked under the parallel runner:
1. gstack-brain-context-load probed 'gbrain --version' PER QUERY with a
500ms budget — a cold probe on a saturated box timed out (observed
505ms), branding gbrain 'missing' for one query while siblings
passed. The probe is now memoized (availability can't change
mid-invocation) with a generous one-time 5s budget; query calls keep
the tight timeout.
2. skill-size-budget's catalog estimate read the LIVE tree, so a
concurrent worker's transient skill-shaped scratch dirs exactly
doubled it (8356 vs 4177). The ratchet now counts git-TRACKED skills
only — the catalog that ships, immune to sibling workers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: demote 4 expensive posture tests to periodic (D2a)
design-consultation-research ($0.91/304s) and -preview ($0.89/481s) —
the two most expensive gate tests — plus office-hours-forcing-energy
(LLM-judge posture score; its sibling was already demoted) and
cso-full-audit (250s/$0.57; the targeted cso tests stay gate). Saves
~$8-12 and 10-15 min per gate run. The plan-*-finding-floor tests stay
gate deliberately: cheap insurance on the most-edited skill surface.
Housing files have no whole-file self-gates, so the runtime E2E_TIERS
filter handles both tiers; tier-alignment tripwire green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: judge default Sonnet -> Haiku 4.5 (D1a)
The 25 doc-quality judges are rubric-scoring calls — a duty Haiku is
already proven at in this repo (pty hung/working classifier,
first-task-scaffold, hermetic-canary). Tests needing a stronger judge
pass a model explicitly. Note: eval-store judge costs were hardcoded
synthetic (0.02), so no baseline distortion. Re-baselined by the
periodic run in this branch's final verification.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: SDK runner default Opus -> Sonnet (D1a)
agent-sdk-runner defaulted to Opus 4.7 while session-runner (the claude
-p path) defaulted to Sonnet — an inconsistency between the two runners,
not a decision anyone made. Unpinned tests were implicitly asserting the
expensive model. The 30+ tests that genuinely need Opus already pin it
via opts.model. Re-baselined by the periodic run in this branch's final
verification; regressors get explicit Opus pins.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: CLAUDE.md tells the truth about the free suite; make-pdf gate is macOS-only
The '<2s' claim was off by two orders of magnitude (measured 454s serial
at v1.63; ~90-100s now under the parallel runner), and the bare
'bun test' guidance walked the whole repo, loading paid eval files and
missing the strict classifier. Commands now say 'bun run test' with real
numbers, document the strict-output invariant, the EVALS_JOBS /
EVALS_CONCURRENCY split, the computed detach-timeout floor, and the
required free-tests lane. make-pdf-gate drops its Linux leg (redundant
with the free lane running make-pdf tests on every PR); macOS rendering
coverage stays.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: catalog ratchet reads committed content; SDK unit pins follow D1a default
Two follow-ups from the verification runs:
1. skill-size-budget's catalog estimate still flaked under --parallel
(8356, then 8041, vs 4177 solo) even after filtering to tracked
skills: sibling workers REGENERATE real SKILL.md files mid-run, so
any live-tree read is a moving target. The ratchet now reads each
tracked skill's frontmatter from git show HEAD: — the catalog that
ships — which no concurrent worker can perturb.
2. agent-sdk-runner unit pins asserted the old Opus default through the
default-flow fixtures; flipped to the Sonnet default (the explicit-
override pass-through pins keep Opus — that path is unchanged).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): SIGKILL abandoned Chromium on close-race timeout (suite wedge)
close()'s launched-mode path raced browser.close() against 5s and on
timeout ABANDONED the child: this.browser nulled, process handle lost,
Chromium alive holding keep-alive connections into test servers whose
stop() then waits forever. Reproduced twice as an intermittent (~50%)
whole-suite wedge — a 44min 0.1%-CPU hang pinned by a leaked LISTEN
socket, and a 400s hang with commands.test.ts teardown in flight.
The child handle is now captured BEFORE the race and SIGKILLed on
race-timeout (launched mode only; headed keeps context.close). Race
timers are unref'd so a successful close stops pinning the caller's
event loop for the window. The four browse test servers force-close
keep-alives (stop(true)) as belt-and-braces.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: delete two dead-architecture security contract tests
browse/test/security-source-contracts.test.ts and sidebar-security.test.ts
read browse/src/sidebar-agent.ts at module scope — a file deleted (on main
too) when the sidebar chat-queue path was ripped in favor of the terminal
PTY. Both files have errored on load ever since: the old truncating suite
never surfaced it, and no CI lane ran them. Their subjects (queue-spawn
canary injection, preSpawnSecurityCheck, queued args, chat system prompt)
no longer exist; server.ts retains processAgentEvent only in a comment.
Live security coverage continues in security.test.ts (canary/verdict),
content-security.test.ts (L1-L3), server-sanitize-surrogates.test.ts,
and the security-bench suite. If the terminal-agent path should inherit
any of the deleted contracts, that is a separately scoped piece of work
against the component that actually exists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): calibrate placeholder recognition for code and doc shapes
Three pushed-secret false positives blocked this branch's push; each is
now recognized as a placeholder in the url_with_password/basic_auth_url
validators, with real passwords still blocking (all pinned):
- ${camelCase} JS template interpolations (the old check only skipped
uppercase env-style ${DB_PASS}, so the supabase-provision bash->TS
port's `postgresql://${dbUser}:${dbPass}@...` flagged as two
pushed secrets).
- The literal PASSWORD/pass placeholder in URL-format doc comments.
- The provision lib's doc comments now use <PASSWORD>/PASSWORD forms.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: opt-in gate for live-playwright ML tests; ios-qa build hygiene
security-live-playwright's L4 tests dlopen onnxruntime inside a bun
--parallel worker whenever the dev box has a warm model cache — the
source of the intermittent 'panic: Segmentation fault' + crashed-worker
retries (and likely the residual run wedges). Same SECURITY_BENCH=1
opt-in as security-bench.test.ts; the L1-L3 tests in the file still run
everywhere.
Also: gitignore the ios-qa gen-accessors-tool Swift .build/ output (a
side-effect of running its tests that kept polluting git status) and
commit its Package.resolved so tool builds resolve reproducibly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: free runner output contract — name the failure, quiet the noise
Diagnosing a red run used to mean re-running with output captured to a
file and grepping past ~1000 lines of tab-close spam and ASCII art —
several runs today ended with no way to even NAME the failing test, and
a wall-timeout kill said nothing about which file wedged.
New contract: the full child stream ALWAYS lands in a per-run log file
(path printed up front); the console shows only runner lines, (fail)
results, crash markers, and the terminal summary (--verbose restores
the firehose; the strict classifier consumes the full stream in every
mode). After every run a stable epilogue names the outcome:
[test:free] FAIL — k failing test(s) in j file(s), c crashed
worker(s). Full log: <path>
✗ <file> — <test name>
⚠ crashed+retried: <file>
⏱ in flight at kill: <files> (timeout only — the wedge suspects)
Attribution rides bun --parallel's per-file output grouping
(ANSI-stripped — color codes defeated a plain grep today). 12 new pins:
epilogue formats, crash surfacing, quiet/verbose console policy, log
completeness, in-flight-at-kill on a real hang.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: quarantine 5 pre-existing env failures individually (receipts in-file)
Three snapshot tests (stale-ref error, snapshot -D diff, annotation
cleanup) and two extension-sender-auth behavioral tests fail identically
on origin/main v1.64.1.0, solo, on dev machines — verified per the blame
protocol. Main's CI lane skip-lists both FILES wholesale; quarantining
only the five failing tests keeps the other 60 guarding. Each carries
the un-skip condition.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: stealth-webdriver launch gets parallel-load headroom (120s)
Playwright's default 30s launch timeout dies under the full-suite
--parallel run when ~400 workers contend for Chromium launches — bun
reports the hook death as an '(unnamed)' 30006ms failure (named on
sight by the new runner epilogue). Both launch sites get explicit 120s
timeouts; the runner's external wall-clock still bounds the ceiling.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: free-runner wall timeout 15min -> 6min (faster wedge diagnosis)
The suite completes in ~100-160s; a wedge used to mean 15 minutes of
silence before the kill-and-name epilogue fired. 6min keeps ~3.5x
headroom over the slowest observed clean run while naming wedge
suspects in minutes. --wall-timeout <secs> overrides per run.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: run worker-hostile files in a serial child (first entry: security-live-playwright)
The residual full-suite wedge, named by the new epilogue: Bun 1.3.13
segfaults running browse/test/security-live-playwright.test.ts in a
--parallel worker ('panic: Segmentation fault ... a bug in Bun'), and
the crashed-worker retry then wedges the whole invocation past the wall
clock. The file passes serially.
New WORKER_HOSTILE placement list: full-suite mode excludes listed files
from the parallel invocation and runs them in their own strict-classified
serial child afterward — execution placement, not a skip; each entry
carries its reason and removal condition.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: gate compare-board's file-level hooks too — the intermittent staller
Skipped describes do NOT skip file-level hooks: the quarantined
compare-board file still ran its top-level beforeAll (PNG fixtures +
Bun.serve + a BrowserManager launch — exactly the 'needs a
display-shaped env' code) on every run, and under parallel load that
setup wedges. Caught red-handed by the runner's in-flight-at-kill
epilogue: '⏱ in flight at kill: browse/test/compare-board.test.ts'.
This was the suite's intermittent staller. Hooks now honor the same
GSTACK_COMPARE_BOARD_TESTS gate; the gated file drops from 3.7s of live
setup to 0.4s of pure skips.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: full suite runs as N shard processes; scrub spec-sync child env
Two fixes from the wedge-hunt endgame:
1. Full-suite mode switches from one 'bun test --parallel' invocation to
N concurrent shard PROCESSES, serial within each (the paid runner's
proven model; N = min(6, cpus-2)). The single-invocation strategy hit
three distinct Bun 1.3.13 worker pathologies in one day — a segfault
whose crashed-worker retry wedged the run, a quarantined file's
still-running file-level hooks stalling a worker, and spawn-heavy
files hanging under load — and each one stalled the WHOLE invocation.
Process shards isolate any wedge to its own shard. First full run
under this model: no wedge, six epilogues, one real failure named.
WORKER_HOSTILE stays as the paper trail; --parallel remains available
per-shard for a future Bun.
2. That one real failure: spec-template-sync regenerates SKILL.md via a
child that inherited the shard process's env — an earlier test's
GSTACK_*/GBRAIN_* mutations changed generator output (failed in-suite,
passed solo on an identical tree). The child now gets a scrubbed env:
generator output must be a function of the templates, not of whichever
test ran before.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: tree-mutating tests run after the parallel shards; scrub relink env
The flake family's root cause, finally: five test files REGENERATE
shared repo artifacts in place (catalog-mode-full rewrites every
SKILL.md in full-catalog mode; spec-sync and idempotency regenerate all
skills; gen-skill-docs and skill-validation rewrite .agents/). Any
concurrent shard reading those files sees a moving target — this one
family produced the exactly-doubled catalog estimate, the golden-file
drift, and the spec-sync mismatch chased earlier today. Full-suite mode
now runs TREE_MUTATING files in one serial shard AFTER the parallel
shards complete; CI's matrix is unaffected (per-runner checkouts).
Also: relink's run() helper spread process.env into its children, so a
sibling file's leaked GSTACK_HOME made the 'fresh install' test see a
neighbor's skill_prefix. GSTACK_HOME is now dropped unless the test
passes it explicitly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: gbrain-detection-override joins TREE_MUTATING (mutator #6)
It regenerates SKILL.md in place with --respect-detection (the gbrain
variant adds ~1-3KB per carved skeleton) and git-restores afterward —
its own header documents the approach. During that window the parity
suite in a concurrent shard read inflated skeletons and failed 4 caps.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: tree-ratchet readers join the serial phase (quiet tree by construction)
Two consecutive runs failed the parity caps with byte-identical inflated
skeletons (+~2KB gbrain-variant blocks) while the tree was clean before
and after — some concurrent regen window keeps escaping the mutator
census. Rather than hunt every present and future mutator, the tests
that MEASURE the shared tree (parity caps, size budgets, carve guards)
now run in the serial phase after the parallel shards: a quiet tree by
construction, immune to any regen we haven't found.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: judge default back to Sonnet — Haiku regressed the rubric family (A/B receipts)
The partial-diff rehearsal was the Haiku judge default's first live run
and it failed all three selected doc-rubric judges. Controlled A/B on
the identical health-rubric prompt: Haiku 2/2/2 vs Sonnet 4/3/4, both
with coherent reasoning — Haiku is simply a harsher grader on
long-document rubrics, and every >=4 threshold in skill-llm-eval was
calibrated against months of Sonnet baselines. Per D1a's
pin-on-regressors protocol the default reverts; a new
GSTACK_EVAL_MODEL_JUDGE override makes future recalibration a one-var
experiment. Haiku keeps the classifier-grade duties (pty hung/working,
warmup, distill via lib/eval-model.ts) and D1a's capture->Sonnet stands.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test-runner): per-origin classifier buffers — interleaved pipes can't shear lines
stdout and stderr are independent pipes; a chunk from one can arrive
between two halves of a line from the other. The single shared
pending-buffer glued those fragments into garbled lines: a sheared
(fail) line went uncounted (defeating the exit-0-with-failures
backstop) and a sheared terminal summary read as truncation.
Counters stay shared; line assembly is now per-stream, and both
runners tag the stream origin. Also drops the dead ChildProcess
type import left by the killProcessGroup move.
* fix(test-runner): real carve-guard keys in TREE_MUTATING; census pins; size-scaled wall deadlines
TREE_MUTATING listed 'test/carve-guard-checks.test.ts' — a file that
has never existed (the real ratchet readers are
carve-guard-completeness and carve-section-ordering), so the intended
serialization was silently absent. New census pin tests fail on any
key that doesn't name a real free test file, and on a TEST_ROOTS
entry that stops contributing files. Full-suite wall deadlines now
scale with shard size (max(6min, files x 5s)) so a jobs=1 machine or
the ~130-file Windows shards can't false-timeout a healthy run;
explicit --wall-timeout disables scaling. Stale --parallel wording in
the dry-run message, jsdoc, and the TREE_MUTATING ordering comment
corrected to the shipped process-shard model.
* fix(evals): selection under-selection fixes — duplicate keys, self-paths, quotePath
Three under-selection holes: (1) duplicate E2E_TOUCHFILES keys
(ship-plan-completion/-verification) — JS keeps the LAST duplicate, so
the earlier dep lists were dead; pair deleted and a duplicate-key scan
added to the literal-only tripwire. (2) The five rehomed e2e files
didn't list themselves in their own dep lists, so editing the test
never selected it. (3) git C-escapes non-ASCII paths without
core.quotePath=false, so an accented filename matched no glob and
deselected its tests. Also updates the stale --retry cost comment.
* fix(evals): destructive-actions guard actually inspects Bash commands
The rehomed guard filtered on typeof input === 'string', but
session-runner records tool inputs as objects ({command} for Bash) —
the filter matched nothing and the assertion could never fail, even
against a real 'git push'. Now extracts the command from the object
shape, same as the usedGitDiff check above it.
* fix(redact): interpolation allowance can't swallow a real $word password
The placeholder calibration used optional braces on both sides, which
also suppressed bare $lowercase — a real password starting with '$'
would have passed the HIGH gate. Interpolation now means ${identifier}
(braced, any case) or bare $UPPER_SNAKE only; both connection-string
patterns share one validator so they can't drift. Pins added for the
bare-$word block, $UPPER allowance, and mismatched-brace block.
* fix(gbrain): wait --timeout validates up front instead of polling forever on NaN
Number('abc') is NaN, NaN comparisons are always false, and the
poll loop never hit its deadline — an infinite 5s loop where the bash
predecessor errored immediately. die(2) at parse time, with a test.
* ci: least-privilege tokens on the two lanes that execute PR-controlled code
free-tests runs PR code (install lifecycle scripts + the suite) with
whatever the repo-default GITHUB_TOKEN grant is, persisted into
.git/config by checkout. Now: permissions contents:read,
persist-credentials false, pinned by the wiring test. actionlint gets
the same treatment plus a digest pin on the third-party Docker Hub
image (a tag is repointable with no GitHub-side audit trail, and the
image sees the mounted checkout). restore-keys added to both caches so
a lockfile bump warms from the previous cache; stale --parallel header
wording corrected.
* test(browse): unit coverage for the close() SIGKILL fallback
The wedge fix (capture the Chromium child before the close race,
SIGKILL on timeout) shipped without a test of the branch it added —
the coverage audit flagged it as the diff's one regression-gap. The
5s race window becomes an injectable closeRaceMs field, and four unit
tests pin: SIGKILL on hang, no SIGKILL on clean close, no SIGKILL on
an already-exited child, SIGKILL on a rejecting close.
* docs: CLAUDE.md describes the shipped shard-process model, not the abandoned --parallel probe
* fix(test-runner): cancellation terminates the run; win32 kills the whole tree
Installing SIGINT/SIGTERM forwarders suppresses Node's default
terminate-on-signal, so a cancelled run killed the current child and
kept LAUNCHING shards — observed as paid runs continuing to burn API
spend after Ctrl-C (codex adversarial, repro'd ALIVE_AFTER_SIGTERM).
The first signal now also schedules the parent's own exit after the
children's SIGKILL grace, and both shard pools consult
isTerminationRequested() before taking new work. On win32,
killProcessGroup uses taskkill /T /F — detached:true creates no
killable group there, and a bare child.kill orphaned every grandchild
(ports, locks, and the inherited pipes that kept close from firing).
Also: the tree-mutating serial shard prints dirty generated artifacts
when it dies mid-regeneration, and --shard CI-matrix mode gets the
same size-scaled wall deadline as full-suite mode.
* fix(evals): preflight fails fast on spawn error, timeout, and exit 127
The ping only grepped stdout for two connection strings — a missing
claude binary, a 30s timeout kill, or command-not-found all returned
'ok', and the fleet then burned ~30 shard timeouts discovering the
outage one child at a time. Cross-model finding (testing specialist +
codex adversarial). Other non-zero exits stay deliberately fail-open:
a flaky preflight must not block a runnable suite; pinned both ways.
* fix(redact): lowercase 'password'/'pass' at the URL-password position blocks
The case-insensitive placeholder words waved postgres://admin:password@host
through the HIGH gate as a doc placeholder (codex adversarial,
verified zero findings pre-fix). URL-password position is now stricter
than generic placeholder detection: ALL-CAPS doc convention
(USER:PASSWORD), ${identifier} interpolations, bare $UPPER_SNAKE, and
structural shapes (<your-password>) suppress; lowercase dictionary
words block. Pinned in both directions.
* fix(gbrain): DSNs percent-encode the password; body reads retry; stdout drains
Three codex-adversarial findings in the provision port: (1) raw DB_PASS
interpolation — a reserved character (/ # ? % @) restructured the URI,
provisioning succeeded, and every consumer then failed to parse the DSN
(unusable billable orphan); now encodeURIComponent, round-trip pinned.
(2) await res.text() sat outside the transport try — a server that sent
headers then reset the stream was an uncaught exit 1 instead of a
retry-then-exit-8. (3) The bin entrypoint called process.exit() after
unawaited stdout writes, truncating piped JSON; exitCode lets writes
drain.
* fix(evals): selection-path helpers join GLOBAL_TOUCHFILES; base-branch keys self-register
The three-file split moved test-selection.ts into the globals but
dropped the facade — an edit to test/helpers/touchfiles.ts (executable
selection-path code imported by every consumer) selected ZERO paid
tests, the exact invisible-non-execution class this branch exists to
kill (claude adversarial, finding 1). e2e-helpers.ts (the harness every
paid test imports) and paid-test-set.ts (paid-vs-free classification)
had the same gap. The review/ship base-branch keys also register
test/skill-e2e-review-attribution.test.ts so editing those tests
selects them.
* ci(free-tests): PR-number concurrency, failure-log artifact, main-push runs
Three red-team/adversarial findings on the new required lane:
(1) concurrency keyed on bare head_ref — two forks with the same
branch name shared one group, so a push to fork B cancelled fork A's
in-flight REQUIRED check (merge-pipeline DoS with no code fault); key
on the PR number. (2) The runner's full logs die with the runner in
os.tmpdir() — a red check named WHICH test failed but never why;
upload the shard logs as an artifact on failure. (3) PR-only trigger
meant two individually-green PRs could merge into a red main with
nothing running the suite there; add push: branches: [main].
* ci: PR-number concurrency keying on the eval and Windows lanes too
Same fork-branch-name collision as free-tests.yml: bare head_ref
carries no owner prefix, so same-name branches from different forks
shared a cancel-in-progress group.
* test(evals): retro E2E passes require the report on disk
Both retro tests passed with zero work product: error_max_turns
counted as success and the content assertion was guarded by
fs.existsSync — a run that burned 30 turns and wrote nothing recorded
green (red team). The report is now load-bearing for pass/fail.
* chore: bump version and changelog (v1.66.0.0)
Test/evals/CI speedup pass: release summary + itemized changes in
CHANGELOG.md; TODOS.md marks the free-suite exit-code P1 complete and
files the review-army follow-ups.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): fully-braced ${...} interpolations are code, whatever they contain
The identifier-only braced form flagged the DSN builder's own
${encodeURIComponent(dbPass)} call site as a pushed secret — a scan
that cries wolf on the fix for the previous finding. Any ${...}
spanning the whole password segment is template code; bare $word
stays uppercase-only so $hunter2 still blocks. The mismatched-brace
negative fixture assembles at runtime so this file's own pushed bytes
carry no blockable URL shape.
* test(gbrain): assemble the pooler expected-URL from parts (scan-clean pushed bytes)
* docs: sync docs for v1.66.0.0 (test/evals/CI speedup)
CONTRIBUTING.md, AGENTS.md, and ARCHITECTURE.md still taught bare
`bun test` for the suite; the shipped runner deprecates it (walks the
whole repo, loads paid eval files, misses the strict classifier). All
suite-level references now say `bun run test`, the Tier 1 section
describes the strict shard runner (~90-100s, --verbose, --wall-timeout),
the sharded paid-runner paragraph documents diff-based shard skipping
and the EVALS_JOBS / EVALS_CONCURRENCY split, the Tier 3 row points at
the actual judge-only invocation, and GSTACK_EVAL_MODEL_JUDGE is
documented at the judge it overrides.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(free-tests): restore the PR-number concurrency + failure-log artifact; truth-fix stale comments
The workspace-revert incident that hit CHANGELOG/TODOS mid-ship also
caught free-tests.yml between edits: commit 8d6c2ff8's message claims
PR-number concurrency + artifact upload + main-push runs, but only the
push trigger survived to the commit (caught by the /document-release
doc-vs-code audit). Both re-applied. Also: eval-model.ts header said
capture defaults to Opus (it's Sonnet per D1a), paid-shards' header
pinned a stale 44/63 shard census, and two CHANGELOG phrases
over-claimed ('six' -> 'up to six' shard processes; retry-1 scoped to
retry-bearing paid paths).
* ci: setup-buildx before every cache-exporting image build
First live run of the cache trio failed at flag-parse time: the
default buildx `docker` driver hard-errors on cache-to registry
export ('Cache export is not supported for the docker driver'), which
failed build-image on PR #2593 and skipped the entire gate eval
matrix behind it. docker/setup-buildx-action creates the
docker-container builder that supports registry cache export; all
three build sites (evals, evals-periodic, ci-image) get it.
* fix(browse): Xvfb identity is argv[0]'s basename, not a cmdline substring
First Linux CI run: isOurXvfb identified the TEST RUNNER as our Xvfb —
the suite's own argv contains 'xvfb.test.ts', the substring match over
the whole cmdline passed, and the start-time check matched because the
pid was real. Any process whose ARGUMENTS mention xvfb (a runner, an
editor) was killable — the sibling-kill class the identity check
exists to prevent. Identity now rests on argv[0]'s basename ('Xvfb'),
with a sh-$0 regression pin. isDisplayFree falls back to the X
socket/lock files when xdpyinfo isn't installed (x11-utils is absent
on some images that ship Xvfb).
* fix(test-runner): strip GHA ::group:: wrappers before file attribution
On GitHub Actions bun wraps each file's log section in ::group::. The
un-stripped header failed FILE_HEADER_RE, failures attributed to the
PREVIOUS file, and the terminal recap's re-printed (fail) lines landed
under a phantom second file — the first Linux run reported 5 real
failures as 10 across 2 files (one of them innocent). Strip the prefix
before matching; the existing file+test dedupe then absorbs the recap.
* test: first-Linux-run environment fixes — bun-only PATH shim, claude gate, darwin-scoped pdf gates
Three environmental assumptions the Linux lane exposed:
(1) gbrain-detect's deterministic SAFE_PATH lacked the bun runtime, so
every env-shebang spawn exited 127 on CI; a scratch dir holding ONLY a
bun symlink joins the PATH (appending bun's real dir would leak its
siblings — dev boxes keep gbrain there too).
(2) host-config's 'detect finds claude' assumed a claude binary; the
secretless lane deliberately has none — gated on Bun.which.
(3) The four make-pdf render gates hard-required prerequisites on ANY
CI, but the make-pdf gate workflow is macOS-only by decision and the
Linux lane doesn't build dist/pdf — hard-require scoped to darwin.
* ci(free-tests): run the suite under xvfb-run
Headed-browser tests (handoff, extension sidepanel DOM) need a real
DISPLAY; the first Linux run died on Playwright's 'headed browser
without an XServer' banner. xvfb-run -a provides the display; x11-utils
ships xdpyinfo for display probing.
* fix(test-runner): bun's headerless failure recap can't invent a phantom failing file
Round-3 CI showed the remaining half of the recap bug: bun prints
'N tests failed:' then re-prints every (fail) line with NO file
headers, so they attributed to the stale currentFile — an innocent
file (test/uninstall.test.ts) was charged with another file's 5
failures. The recap marker now ends attribution (currentFile=null,
chunk closed) and recap re-prints of already-recorded test names
dedupe; a recap-only failure the main run never attributed still
records, unattributed, as belt and braces.
* test(browse): sidepanel DOM suite launches with --no-sandbox on CI + console capture
The suite's raw chromium.launch had no --no-sandbox — every browse
test that goes through gstack's launcher (which always passes it)
survived the Linux lane, while this file's sandboxed renderer died on
first navigation: waitForFunction hung to the 15s test timeout, then
every newContext failed with Target.createBrowserContext. Also wires
pageerror/console-error capture at all six pages so a page-side
failure reads as itself in CI logs instead of a bare timeout.
* test(browse): delete the sidepanel security-DOM suite — it tests UI removed in v1.14
Another member of the never-ran class: the file skipped everywhere
(Playwright chromium absent locally, no Linux CI until this branch),
so it rotted invisibly through THREE contract changes — the v1.63
/extension-token bootstrap, the endpoint growth (/memory,
/pty-session, /sse-session), and finally the v1.14 sidebar-REPL
rewrite that removed the security shield/banner UI it asserts on
(#security-shield survives in sidepanel.html as a dead hidden stub
with no JS driver; sidepanel.js:87 and :1317 document the removal).
The Linux lane executed it for the first time and it can never pass:
the behavior is gone. The L1-L3 security filters it name-checked stay
covered by the ~83 unit/behavioral security tests. The free-tests
lane also vendors xterm assets (bun run vendor:xterm) so the
sidepanel terminal scripts load for any future DOM coverage.
* ci(evals): per-row retry override — two receipted rows keep the third attempt
Three PR rounds of receipts: pty-plan-smoke failed attempt 2 in two
consecutive rounds with ROTATING members (plan-design-review, then
plan-eng-review) and e2e-workflow's document-release timed out on
attempt 2 in round 4 — while both families pass on branches still
running three attempts, and every other row stayed green at --retry 1
across all rounds. Matrix rows gain an optional retries field
(default 1); only these two rows set 2, keeping the measured
retry-amplification win everywhere else.
* test(windows): curate the seven POSIX-bound files the expanded lane surfaced; fix flag-utils path embedding
First full run of the expanded Windows lane (13 -> ~258 files, PR #2593
run 31918591602) failed in exactly 8 files. One was a real test bug,
fixed: design-flag-utils embedded a raw Windows ROOT into a bun -e
string where backslashes act as escapes (D:\a\gstack imported as
D:agstack) — forward slashes work on every platform. The other seven
are POSIX-bound in ways the content patterns cannot see (sed/ln/bash
ARE their subject, a shebang shim arrives via variable, wall-clock
retry bounds on the slowest runner) — each gets a receipted
KNOWN_WINDOWS_INCOMPATIBLE entry, and the census pin now covers that
list so a renamed file fails the suite instead of silently keeping a
stale exclusion.
* test(windows): curate skill-census + browser-manager-unit; surface unhandled errors in the epilogue
Round-2 Windows census (zero failing TESTS — the first curation wave
held): shard 1 failed on an unhandled module-load throw in
skill-census (the skills-tree symlink layout needs Developer Mode CI
runners lack) and shard 2 wedged to its wall deadline inside
browser-manager-unit — both get receipted exclusions; macOS + Linux
lanes keep covering the files. The unhandled-error class also exposed
an epilogue gap: it fails the shard via the strict classifier but
produces no (fail) lines, so the epilogue read 'FAIL — 0 failing
test(s)' with no culprit. The reporter now attributes each
'# Unhandled error between tests' marker to its chunk and the FAIL
line carries the count.
* docs: file the two Windows-lane follow-ups (browser-manager wedge, skill-census symlinks)
* test(windows): round-3 curation — seven files the round-2 wedge had been truncating
The browser-manager-unit wedge was cutting shard 2 short, so each
Windows round revealed the next segment of never-run files. With the
wedge excluded, shard 2 completes (50s) and shows its real failures:
seven more POSIX-environment files (PID/cmdline identity probing,
bash scripts as the subject under test, env-scrubbed bun spawns).
Shards 1 and 3 (including all tree-mutators) now PASS on
windows-latest — this should be the fixed point: ~234 files of real
Windows coverage vs the 13 hand-picked before.
* test(windows): round-4 curation (spawnSkill env, symlink fixtures) + shard-log artifact
Shard 2 ran all 132 files with zero (fail) lines yet bun exited 1 —
unhandled errors in a shape neither counter names, and the Windows
lane had no log artifact to attribute them. Statically attributed and
excluded: browser-skill-commands (spawnSkill spawns bun with a
constructed env; resolution fails under Windows spawn) and
security-audit-r2 (evil-link symlink fixtures need Developer Mode).
The lane now uploads its shard logs on failure like free-tests.yml,
with os.tmpdir() pointed at runner.temp so the glob can find them.
* evals: Opus pin on the spec AUQ-matrix entry — D1a regressor, receipts in-file
The periodic re-baseline for the capture default (Opus -> Sonnet)
found exactly one regressor across the seven-entry AUQ behavioral
matrix: spec failed twice under Sonnet ('never reached a question in
budget', 242s) while its six siblings passed; the controlled Opus
re-run passed cleanly (7/7 format, substance 5, 160s), and a second
run through the new per-entry model plumbing confirms. MatrixSkill
gains an optional model field wired into captureFirstAuq; only spec
sets it. TODOS gains the re-baseline receipts for the never-baselined
periodic tail (three setup-gbrain files + ship-idempotency, all
local-only).
* test(evals): scope-gate assertion carries its evidence tail; file the detector-flake TODO
The plan-design-review member fails ONLY scopeGateQuestionObserved
intermittently on unchanged code (PR #2593: red rounds 3/11 + rerun,
green rounds 5/6 — every attempt terminal, no plan-mode leak), and a
bare Expected-true/Received-false is undiagnosable from CI logs. The
check now throws with the last-2KB visible evidence, so the next
failure distinguishes a detector-sensitivity miss from a real silent
bypass. TODO filed with the full receipt trail.
* test(evals): review-dashboard-via budget 300s -> 360s — third ratchet of the same contention story
PR #2472 documented the 180s deterministic 0-turn startup timeouts and
ratcheted to 300s; PR #2593 hit 302s timeouts on attempt 2 in two
consecutive runs while five sibling rounds passed — marginal at 300s
under 40-way in-shard concurrency. Same headroom its contention-class
sibling (retro-base-branch) carries; outer bun timeout rises to 480s.
* test(evals): document-release budget 180s -> 300s — same contention ratchet, receipts in-file
Timed out at exactly 180s on its final attempt twice on PR #2593
(rounds 4 and 13) while passing four other rounds — a 30-turn
multi-step doc workflow is marginal at 180s under 40-way in-shard CI
concurrency. Same story and same fix as review-dashboard-via and
retro-base-branch; outer bun timeout rises to 360s.
* docs: file the systemic in-shard-concurrency follow-up behind the timeout-flake family
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): skill-docs freshness gate covers all 10 hosts and can actually fail
The Codex/Factory gates ran 'git diff --exit-code -- .agents/' / '-- .factory/',
but both paths are gitignored (.gitignore:16-17) — git diff on ignored untracked
paths is always empty, so those two gates were structurally incapable of failing
and 7 of 10 hosts had no gate at all.
New shape: one 'gen:skill-docs --host all' pass (the generator hard-fails on any
per-host error, gating all 10 hosts on generates-cleanly), byte-freshness via
git diff for tracked output, plus a porcelain check that fails on untracked
generated strays (git diff can't see brand-new files). The gitignored-hosts
byte-freshness limitation is documented in the workflow comment.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): exorcise the sidebar-agent ghost from the test suite
browse/src/sidebar-agent.ts was deleted in the v1.14 sidebar refactor, but the
test suite kept testing it for 48 versions. Nothing noticed because the free
suite runs in no CI job and Bun-era module-load errors were suppressed in the
Windows shard runner via an exclusion pattern whose own comment documented the
breakage ('broken on every platform since v1.14 ... exit 0').
- Delete sidebar-security.test.ts + security-source-contracts.test.ts: crashed
at module load (unguarded readFileSync of the deleted file); per-assertion
triage confirmed every SERVER_SRC pin targeted the deleted chat prompt
builder (zero hits in today's server.ts) — nothing to port.
- Delete sidebar-integration.test.ts: 11 of 13 tests exercised deleted
endpoints (/sidebar-command queue, /sidebar-agent/event, chat buffer); the 2
passing tests pinned only the blanket auth gate, covered by
server-auth.test.ts + dual-listener.test.ts.
- Delete test/skill-e2e-sidebar.test.ts: E2E for the deleted queue flow.
- sidebar-ux.test.ts 1,669 -> 830 lines: 20 dead-chat describes + 15 dead
tests removed (incl. 10 vacuous passes asserting on empty indexOf slices);
2 stale pins on LIVE features fixed (content.js typed-catch CSSOM fallback,
arrow-hint window widened). 95 pass / 0 fail.
- sidebar-tabs.test.ts: both failures were stale pins, not regressions —
forceRestart's deliberate ws.close(4001) and the terminal-agent spawn that
moved into spawnTerminalAgent() (identity-based kill refactor). 28 pass.
- touchfiles.ts: drop the three sidebar E2E entries from BOTH maps
(E2E_TOUCHFILES + E2E_TIERS) — they pointed diff-selection at the deleted
file, so those tests were unreachable by any diff.
- test-free-shards.ts: remove the now-dead sidebar-agent exclusion pattern.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(ci): run the free test suite in CI (it ran nowhere)
The full free suite (bun test: browse/test/ + test/ + make-pdf/test/) had no CI
job on any Linux/macOS runner — only Windows curated shards, paid evals, and
doc-freshness gates existed. That's how two module-load-crashing test files
survived 48 versions.
Same cached Dockerfile.ci image and container wiring as evals.yml (deps
restore, build, Chromium verify). Includes a module-load-error guard: older
Bun reported test-file import crashes with exit 0 on macOS/Linux, so the job
also fails on any nonzero 'N errors' count in the summary — future crash-class
regressions can't hide from the exact job built to catch them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(test): validate touchfile dependency paths exist on disk
New guard in touchfiles.test.ts: every non-glob dep path must exist, and every
glob's anchor directory must exist. This is the axis the 181-key two-map sync
discipline never covered — an entry can point at a long-deleted file and
diff-based selection then silently never triggers those tests (the sidebar
trio sat rotted for 48 versions).
First run immediately caught a fourth rotted entry: 'spec authored quality'
referenced test/fixtures/spec/** (directory does not exist) and selected for a
judge test that exists nowhere in the repo. Removed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(security): remove deleted /sidebar-chat endpoint from tunnel allowlist
TUNNEL_PATHS is the audited tunnel attack surface — its own comment says every
addition widens it. '/sidebar-chat' stayed in the set after the endpoint was
deleted with the chat-queue path, meaning any future route matching that path
would have been silently tunnel-exposed. The set is now exactly the pair
ceremony (/connect) and the scoped command endpoint (/command), and the
dual-listener closed-set pin enforces that.
Also repairs a pre-existing red pin in dual-listener.test.ts: v1.63.0.0 made
the tunnel allowlist args-aware (canDispatchOverTunnel gained a second param)
without updating the test — red on main since then, invisible because the free
suite had no CI job.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(security): delete chain's shadow dispatcher that skipped every security gate
meta-commands.ts carried a 'CLI mode' fallback that re-implemented command
routing without the server pipeline's gates: no scope check, no domain check,
no tab ownership, no rate limit, no hidden-element stripping, no scoped-token
enveloping — and it called handleReadCommand without a BrowserManager, which
also skipped the JS-origin cookie-exfiltration assertion. It was unreachable
in production (server.ts always passes executeCommand) and one boolean away
from being live.
chain now hard-errors without a server context. handleReadCommand's bm param
is required and assertJsOriginAllowed runs unconditionally. The chain tests
that exercised the deleted fallback now route through a server-shaped
executeCommand adapter (real handlers + trust wrapping + {status,result}
envelope), so their behavioral coverage — sequencing, trust markers, pipe
format, aliases, error reporting — survives on the production-shaped path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(extension): delete the dead chat-queue client surface
The sidebar-command handler in background.js POSTed to a server endpoint that
no longer exists (deleted with the chat queue) — ~35 lines of fully-wired dead
code including error handling for the permanent 404, plus its allowlist entry.
No sender in the extension ever emitted the message type.
chatEnabled leaves the /health contract (server hardcoded false, background.js
re-derived it, nothing consumed it — the chat input element it guarded is gone
from sidepanel.html). BROWSE_SIDEBAR_CHAT env flag had zero readers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(security): delete dead exports the ripped chat path left behind
Three-way split by importer class:
(a) Zero importers, deleted: the whole attack-attempt logging cluster in
security.ts (logAttempt, AttemptRecord, salted hashPayload + device-salt,
attempts.jsonl rotation, telemetry spawn plumbing incl.
buildTelemetrySpawnCommand/resolveBashBinary — the LIVE attempts.jsonl writer
is tunnel-denial-log.ts with its own rotation); the decision-file handshake
(writeDecision/readDecision/clearDecision/excerptForReview — written for
sidebar-agent's poll loop, which no longer exists); sidebar-utils.ts (whole
module — its sanitizeExtensionUrl 'sanitized before embedding in a prompt'
for the deleted prompt builder); 8 dead server.ts imports (sanitizeExtensionUrl,
generateCanary, injectCanary, writeDecision, rotateRoot, serializeRegistry,
restoreRegistry, clearAgentRecord); buildPtyClearCookie + buildSseClearCookie;
WEBDRIVER_MASK_SCRIPT (orphaned by the D7 stealth narrowing — applyStealth
never used it).
(b) Dead-pin tests edited with their exports: the 'still exported' pin in
stealth-layer-c, the string-content describe in stealth-webdriver (its live
applyStealth behavioral coverage untouched), the clear-cookie assertions,
security-review-flow.test.ts deleted whole (all 4 describes exercised the
dead decision mechanism, incl. a 'simulated sidebar-agent poll loop').
(c) KEPT deliberately: leaseCount (live behavioral coverage),
extractPtyCookie + validatePtySessionToken (extractPtyCookie is adopted by
the terminal-agent cookie-parse unification later in this wave),
resetSessionMarker + clearContentFilters (test-support API for the live
content-security layer).
Also fixes two pre-existing red pins found while here, invisible until the
free suite got a CI job: the v1.44 spawnClaude->maybeSpawnPty rename in
terminal-agent.test.ts, and a cross-file test-isolation bug where
content-security.test.ts's clearContentFilters() wiped the auto-registered
url-blocklist filter for every later file in the same bun process
(security-integration.test.ts failed on co-run; afterAll now restores it).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(security): delete the dead ML layers — transcript classifier and DeBERTa ensemble
The L4b Haiku transcript classifier and the opt-in DeBERTa ensemble
(GSTACK_SECURITY_ENSEMBLE=deberta, a documented 721MB download) had ZERO
production callers since the chat-path agent that invoked them was ripped.
The only live ML path is scanPageContent (testsavant) inside the security
sidecar subprocess. Deleted by import graph:
- security-classifier.ts 614 -> 265 lines: HAIKU_MODEL, checkTranscript,
shouldRunTranscriptCheck, loadDeberta, scanPageContentDeberta, ToolCallInput,
all DEBERTA_* consts + load state. Header now states the live truth
(imported only by security-sidecar-entry.ts). downloadFile kept, name
intact — it is an enumerated egress sink (HF model download).
- security-bunnative.ts + test: a research skeleton self-described as 'NOT a
production replacement', shipped into src/ with zero importers.
- security-bench-ensemble{,-live}.test.ts + the Haiku response fixture: a
paid live-model benchmark for a layer that could not fire. The
security-classifier-tdz test's only case exercised checkTranscript — gone.
- security.ts: layer-model header rewritten to the live architecture;
StatusDetail.layers -> {testsavant, canary}; getStatus() no longer requires
the impossible transcript==='ok' for 'protected' (old on-disk session state
with a transcript key is tolerated on read, never re-emitted).
- security-sidecar-entry.ts needed zero changes: it serializes
getClassifierStatus() verbatim and no consumer read .transcript (verified
in sidecar-client + server.ts).
- BROWSER.md security section matches reality (ensemble knob gone, 112MB not
22MB, sidecar hosting documented). combineVerdict/THRESHOLDS retained as
the pure, tested combiner of record — comments now flag transcript/deberta
votes as producer-less.
Net: 26 pass in security.test.ts incl. a NEW regression test for stale-
transcript disk tolerance; egress-receipt tripwire green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: scrub the sidebar-agent ghost from comments and CLAUDE.md
20+ comments across 10 files still described the deleted sidebar-agent.ts as a
live process — including load-bearing architecture claims ('IMPORTED ONLY BY
sidebar-agent.ts', 'sidebar-agent fills this in on first prompt-injection
load', 'kill sidebar-agent' in shutdown docs) and ~60 lines of tombstone
blocks in server.ts enumerating deleted identifiers by name (a false grep
surface: searching processAgentEvent hit server.ts and looked live).
CLAUDE.md's security-stack section now documents the LIVE architecture: L1-L3
content filters + testsavant via the security sidecar subprocess; the
L4b/ensemble rows, the GSTACK_SECURITY_ENSEMBLE knob, and the 721MB DeBERTa
download are gone (deleted as dead code this wave) with an explicit
do-not-re-document note; attempts.jsonl is correctly attributed to
tunnel-denial-log.ts; the no-live-writer status of classifierStatus is stated.
Comments that survive now describe what IS, not what WAS: the promotion gate
in domain-skills.ts explains why classifier_score>0 is load-bearing given no
L4 load-time scan exists; file-permissions.ts names real sensitive files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen): delete the codex-helpers shadow module
gen-skill-docs.ts imported externalSkillName (unaliased) from
resolvers/codex-helpers.ts at line 21 and then re-declared the same function
locally — the import was silently shadowed, and the imported copy was the
STALE one (it lacked the frontmatterName param the local copy grew). Three
more functions were byte-identical duplicates, imported only under _-prefixed
aliases to keep the module 'referenced', and transformFrontmatter was a
superseded hardcoded-Codex variant. Nothing else imported the module.
Also drops three dead top-of-file imports (COMMAND_DESCRIPTIONS,
SNAPSHOT_FLAGS — which pulled the whole browse/src module graph into every
generator run for nothing — and an unused review-resolver trio).
Proof: bun run gen:skill-docs exits 0 with a byte-identical tree (zero-diff
regen); gen-skill-docs.test.ts 405/405 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(server): delete ServerConfig.idleTimeoutMs + chromiumProfile — documented, never read
Both fields carried JSDoc asserting embedder behavior that did not exist:
the idle check reads the module-level IDLE_TIMEOUT_MS env constant, and both
resolveChromiumProfile() call sites pass no argument. Worse than absent — an
embedder passing idleTimeoutMs: 5000 silently got 30 minutes.
Wiring them honestly is impossible today: the idle timer, activity state, and
shutdown target are module-global, so a per-factory value would lie for any
process running more than one handler. Deleted instead, with a ServerConfig
note pointing at the deferred singleton/route-table refactor where real
support belongs. BROWSE_IDLE_TIMEOUT and CHROMIUM_PROFILE env remain the
honest knobs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(security): wire appendSecureFile at the four real log-append sites
file-permissions.ts carries a 24-line rationale for why POSIX mode bits are
insufficient on Windows and implements appendSecureFile (0600 at create,
Windows ACL on first write only) — but its single caller was the dead
logAttempt, while the four REAL page-content log writers (console/network/
dialog logs in server.ts, the command audit log) used raw fs.appendFileSync
with no mode. Page-content-derived logs now get owner-only permissions from
birth on every platform.
Verified before wiring: mode applies atomically at create via appendFileSync
{mode}, and the ACL pass runs only on first write — no per-append subprocess
cost on the hot console-log path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(stealth): handoff() uses the shared profile resolution + lock cleanup
The headless-to-headed handoff path hardcoded ~/.gstack/chromium-profile,
silently ignoring $CHROMIUM_PROFILE and $GSTACK_HOME (gbrowser's gbd sets
per-workspace profiles), and skipped cleanSingletonLocks() — so a handoff
into a profile with a stale SingletonLock could hang where launchHeaded()
would have recovered.
This was the third live drift between the three Chromium launch paths; the
first two are documented in comments as shipped stealth regressions. Minimal
targeted fix — the full buildLaunchConfig() extraction stays in the deferred
queue.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen): resolver registry describes the template language again
Seven registered {{PLACEHOLDER}}s had zero uses in any .tmpl (checked in both
bare and :arg forms): REDACT_TAXONOMY_TABLE, TEST_COVERAGE_AUDIT_REVIEW,
MODEL_OVERLAY, QUESTION_PREFERENCE_CHECK, QUESTION_LOG, INLINE_TUNE_FEEDBACK,
MAKE_PDF_SETUP. The last two of those families are invoked programmatically by
preamble.ts (functions kept, registry entries dropped); the question-tuning
trio and the review coverage-audit wrapper were documented by their own module
as existing 'for unit testing' that no test performed — deleted, along with
generateRedactTaxonomyTable + its EXAMPLE/TIER_BLURB constants (its '/cso
renders the full table' comment was itself stale) and its test describe.
Also deletes the gated-resolver mechanism (ResolverEntry/appliesTo/
unwrapResolver + test/resolver-entry.test.ts): fully built, fully tested,
used by zero of the 65 registry entries — the generator loop simplifies to a
direct function call. CLAUDE.md's redact-doc line stops advertising the dead
token.
Proof: zero-diff regen (0 SKILL.md changed); gen-skill-docs + skill-validation
737 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen): wire boundaryInstruction from host config; drop three no-op binDir ternaries
hosts/codex.ts declared boundaryInstruction and nothing read it — review.ts
kept its own byte-identical CODEX_BOUNDARY literal (verified equal + trailing
escaped newlines). The resolver now reads the config, so the boundary has one
owner. (autoplan's template carries deliberately generic variants, enforced by
gen-skill-docs.test.ts:1358 — untouched by design.)
The 'ctx.host === codex ? $GSTACK_BIN : ctx.paths.binDir' ternary appeared in
three resolvers and could never change the result: resolvers/types.ts already
sets binDir to $GSTACK_BIN for every usesEnvVars host including codex.
Proof: zero-diff regen for claude AND codex hosts; gen-skill-docs +
host-config suites green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test-infra): judge uses resolveClaudeBinary; eval:watch reads the real partials dir
judgePtyState spawned the bare string 'claude' three definitions below the
resolveClaudeBinary() helper this same file exports — broken under hermetic
PATHs where every other launch in the file resolves correctly.
eval:watch read _partial-e2e.json from the legacy global ~/.gstack-dev/evals/
while EvalCollector writes it into the per-project eval dir (or
GSTACK_EVAL_DIR) — so the dashboard's completed-tests panel was empty
whenever slug detection succeeded, i.e. the normal case. The heartbeat and
per-run progress logs stay global by design (session-runner.ts: 'heartbeat
stays global'). The three eval-CLI docstrings stop claiming the legacy dir
is the primary location.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): delete the superseded SDK ship-idempotency suite and three orphaned fixtures
test/skill-e2e-ship-idempotency.test.ts's own header documented that the
monolith's SDK-harness version tests a synthetic prompt while it exercises
the real /ship skill — the author knew the old suite was superseded and left
both running, two paid LLM runs for one behavior. The weaker copy is gone;
its 'ship-idempotency' diff-selection key goes with it (the dedicated file is
periodic-tier, which always runs under EVALS_ALL — the key had no remaining
consumer).
Fixture rot: test/fixtures/golden-ship-claude.md was a 128KB zero-reader
orphan that had drifted 46KB from its live successor
(test/fixtures/golden/claude-ship-SKILL.md) while looking authoritative;
parity-baseline-v1.46.0.0.json and v1.53.0.0.json had zero readers (three
tests pin three OTHER baseline versions — consolidation is queued, deletion
of the unreferenced two is free).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(bin): delete zero-caller scripts; make host-config-export's docstring honest
- bin/gstack-open-url (14 lines): announced in a CHANGELOG entry, wired into
nothing, ever. bin/gstack-platform-detect (27 lines): zero callers, and its
hand-rolled host list was already stale (SLATE_HOST.md cites it as a
problem). Note: the deprecated gstack-brain-consumer/reader pair the audit
flagged was already deleted upstream in v1.63 with a stay-deleted tripwire.
- scripts/task-emission-schema.ts (61 lines): a typed schema module nothing
imported; the tasks-section comment now documents the JSONL fields inline.
- scripts/host-config-export.ts claimed to be the 'shell bridge for the bash
setup script' — setup never calls it (its hand-rolled host lists drifting
is a known follow-up). Docstring now states what it IS: a standalone,
test-pinned query CLI not yet wired into setup. Its validateValue +
CLI_REGEX/PATH_REGEX internals were dead (defined for a guarantee the
header claimed but nothing enforced).
- KEPT deliberately: scripts/preflight-agent-sdk.ts — a documented manual
diagnostic (CONTRIBUTING.md + USING_GBRAIN_WITH_GSTACK.md reference it).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(server): one lone-surrogate sanitizer, one sanitizeReplacer, one startTunnel
Three copies of the surrogate sanitizer existed with two algorithms
(sanitize.ts regex vs a hand-rolled charCodeAt walk in server.ts — verified
byte-identical across 11 edge cases before converging) plus two identical
sanitizeReplacer definitions each wrapping a different copy. sanitize.ts is
now the single source of truth; the runs-INSIDE-JSON.stringify egress
invariant is unchanged at every call site and its pin tests were adapted to
the new import shape without losing intent.
The ngrok tunnel-start sequence existed three times in server.ts — the
/tunnel/start route and the BROWSE_TUNNEL=1 autostart were line-for-line
equivalent (a comment admitted 'Same cleanup as /tunnel/start's error path').
One startTunnel() now owns the ephemeral loopback bind, the pre-send egress
receipt, the state-file RMW via tmpStatePath(), and the ordered error-path
cleanup; callers keep their distinct response surfaces. The
BROWSE_TUNNEL_LOCAL_ONLY test path shares nothing (no ngrok, different state
field) and deliberately stays separate.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(security): one session-cookie registry implementation, two instances
pty-session-cookie.ts and sse-session-cookie.ts were byte-identical modulo
the cookie name — mint/validate/parse/prune/TTL, the exact code a security
fix would have to land in twice (and a third hand-rolled cookie parse in
terminal-agent.ts had already diverged; unified next commit).
createSessionCookieStore() owns the implementation; both modules become thin
instantiations keeping every exported name, their distinct threat-model
docstrings, and separate token spaces (an SSE-read cookie must never grant
PTY access). pty-session-lease.ts deliberately stays out — different contract
(sessionId/secret split, refresh, env TTL).
The factory imports nothing from token-registry (cookie-picker-auth-isolation
invariant, still pinned by sse-session-cookie.test.ts).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(security): terminal-agent uses the shared PTY cookie parser
The /ws upgrade's cookie fallback hand-parsed the Cookie header inline — the
fourth copy of the session-cookie parse, and the one that had already
diverged from the others. Parsing now goes through extractPtyCookie;
validation deliberately stays against the agent's own in-process validTokens
map (the server's registry lives in a different process). The ws-handler pin
test now pins the shared-parser call instead of the raw cookie-name literal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(hosts): defineHost() factory — 10 copy-paste host files become declarations
hosts/*.ts were ten copies of one file: runtimeRoot byte-identical in 9/10,
pathRewrites mechanically derivable from the host name for 7/10, the 11-entry
toolRewrites map byte-identical between openclaw and gbrain, and every asset
change a 10-file edit (cursor and slate had already fallen out of three other
hand-maintained lists). defineHost() owns the defaults; each host file now
declares only what makes it different (slate/cursor: 8 lines each). Shared
constants: CROSS_MODEL_RESOLVERS, GBRAIN_RESOLVERS, EXEC_STYLE_TOOL_REWRITES.
Genuinely-different things stayed explicit: codex/factory $GSTACK_ROOT
rewrites, hermes's tool vocabulary, claude's denylist+prefixable install,
opencode's wider runtimeRoot.
Proof: JSON.stringify(ALL_HOST_CONFIGS) dump-diff before/after EMPTY (and a
runtime walk confirmed no function-valued or undefined-keyed fields, so the
JSON diff is complete); gen:skill-docs --host all zero-diff; host-config +
gen-skill-docs + idempotency suites 485/485. Host files 595 -> 285 lines.
docs/ADDING_A_HOST.md teaches the factory pattern.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(lib): fs-atomic — one atomic-write implementation, with the race actually fixed
Atomic tmp-write-then-rename was reimplemented ~20 times across lib/, bin/,
and browse/src with three tmp-suffix conventions. One of them was a latent
bug this commit closes: lib/worktree.ts used a bare '.tmp' suffix — the
deterministic-tmp collision race browse/src/server.ts documents having hit
in production (its fix, pid+random, was trapped in a comment at one site).
lib/fs-atomic.ts: atomicWriteSync (always throws, best-effort tmp cleanup,
pid+random suffix, optional mode applied at tmp creation so the file never
exists with looser permissions) + atomicWriteQuiet (shutdown paths only).
Unit tests pin the throw/quiet contracts, 0600 mode, tmp-name uniqueness
(captured via the read-only-dir failure path — Bun's fs exports are
readonly, no monkeypatching), and no-stray-tmp cleanup.
Migrated: lib/worktree.ts (the bare-.tmp bug), lib/gstack-decision.ts
(snapshot + compact log), lib/gbrain-local-status.ts (probe cache). browse
sites follow separately.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(lib): jsonl-store's docstring stops lying; mode option added; lib bypasses adopted
The header claimed 'single source of truth... the ONLY copy' with write-time
injection REJECTION — while appendJsonl never screened anything, only 1 of
~10 JSONL stores imported it, and a bypass appender lived in the same
directory. Now: the contract is explicit (screening is the CALLER's job via
hasInjection/firstInjectionMatch; the enforcing callers are named), a
option applies 0600 at create for sensitive stores, and the lib bypasses are
adopted (gstack-memory-helpers ×2, redact-audit-log — which keeps its chmod
backstop for files created looser by pre-mode versions). browse/src keeps
its own appenders by design (compiled-binary surface, own secure-append
helper) and the header now says so. gstack-decision's batched archive append
stays deliberate (single-write crash-window semantics appendJsonl's
one-record contract can't express).
New pins: 0600-at-create, and a test that documents appendJsonl does NOT
self-screen — so nobody can re-document it as self-screening without making
it true.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): migrate hand-rolled atomic writes to lib/fs-atomic
Seven sites, each audited for its existing throw-vs-swallow contract before
migrating: writeSessionState + the four fire-and-forget tab/state writers use
atomicWriteQuiet (they swallowed before); writeAgentRecord + the boot-time
port-file write use atomicWriteSync (they threw before — and writeAgentRecord
previously leaked its tmp file on rename failure, which the helper cleans).
All carry {mode: 0o600} plus restrictFilePermissions after successful writes,
preserving the Windows ACL hardening that writeSecureFile provided (mode bits
are POSIX-only). server.ts untouched: its three state writes route through
tmpStatePath(), pinned by server-tmp-state-path.test.ts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(hosts): delete five dead HostConfig fields
metadataFormat (generator hardcodes openai.yaml), sidecar (behavior lives in
setup's create_agents_sidecar — knowledge preserved as a comment in codex.ts),
install.prefixable (skill_prefix is implemented entirely in bin/gstack-config),
staticFiles (docstring cited a SOUL.md that never existed anywhere), and
adapter (its only would-be consumer, openclaw-adapter.ts, was fully dead —
with a test asserting the field was undefined). Kept: learningsMode (wired
next), linkingStrategy (validation reads it), coAuthorTrailer (consumed by
resolvers/utility.ts).
Proof: JSON dump diff shows ONLY the deleted keys vanishing; zero-diff regen
across all 10 hosts; host-config + gen-skill-docs suites green. Note: this
commit also carries chunk-23 edits to the shared hosts/claude.ts +
define-host.ts + host-config.test.ts files (skipSkills collapse, stale
line-number comment drops) — pathspec commits, concurrent prep.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen): preamble tiers are explicit; silent ?? 4 default becomes an error; spec stops rendering its preamble twice
Eight skills (scrape, diagram, spec, skillify, pair-agent, landing-report,
open-gstack-browser + its connect-chrome symlink) silently received the
HEAVIEST tier-4 preamble because a missing frontmatter field defaulted to 4.
Tiers are now declared in every {{PREAMBLE}} template's frontmatter and a
missing declaration throws at generation time with the template path (the 5
templates without {{PREAMBLE}} never invoke the resolver). The stale
hand-written tier-map comment (wrong in 3 of 4 rows) is gone.
Bonus bug fixed: spec/SKILL.md.tmpl mentioned {{PREAMBLE}} in prose, so the
generator inlined the ENTIRE preamble a second time — spec/SKILL.md shrinks
127,462 -> 80,924 bytes (-46,538) from de-duplication alone. skill-size-budget
gains a reasoned INTENTIONAL_SHRINKS entry (its frozen baseline had measured
the doubled-preamble bug). New tests: missing-tier throw carries the path;
every {{PREAMBLE}} template declares a tier. (Carries chunk-23 edits in the
shared test/gen-skill-docs.test.ts.)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen): learningsMode is read from host config, not a hardcoded host name
resolvers/learnings.ts branched on ctx.host === 'codex' while every host
declared learningsMode — the field was decorative, and the 7 hosts configured
'basic' (cursor, slate, kiro, opencode, openclaw, hermes, gbrain) silently
received the 'full' cross-project flow their runtimes can't execute (it
depends on AskUserQuestion + gstack-config plumbing). Output now matches
declaration: basic hosts get the project-scoped search block.
Blast radius proof: all committed Claude SKILL.md files and the three golden
fixtures are byte-identical; the behavior diff lands only in the gitignored
external-host trees (hand-verified: .cursor review's learnings section swaps
the cross-project AskUserQuestion block for the project-scoped search).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gen): small config scrubs — openclaw blobs to real files, setup host drift, dead artifacts
- The three openclaw markdown blobs hardcoded inside gen-skill-docs.ts (which
silently reverted any hand edit to their tracked outputs on regen) move to
openclaw/templates/*.md source files; output shasums byte-identical.
- setup's --host allowlists gain cursor + slate — both fully registered hosts
with generated output, but './setup --host cursor' exited 1 because two
hand-rolled lists in setup had drifted from hosts/index.ts.
- scripts/proactive-suggestions.json deleted: 31KB regenerated on every run,
read by nobody (the catalog-trim design's reader was never built); its
emitter and three determinism tests (which guaranteed a file nothing reads
didn't churn) retired with stays-retired pins.
- claude/SKILL.md.tmpl deleted: a complete 8.9KB skill that never generated
output (directory name collides with the host id 'claude'), in no registry.
Recoverable from git if ever wanted under a non-colliding name.
- openclaw's frozen extraFields.version '0.15.2.0' stamp dropped;
includeSkills: [] no-ops omitted (the generator treats [] as absent);
llms.txt 55 -> 54 skills.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(gen): correct preamble tiers for the 8 silently-heaviest skills
With tiers now explicit, set them RIGHT by analogy to the tiered population:
scrape/diagram/open-gstack-browser (+ the connect-chrome symlink) -> tier 1
(launchers and artifact generators, like browse and make-pdf);
landing-report/pair-agent/skillify -> tier 2 (dashboards and session tools,
like health and canary); spec -> tier 3 (interactive planning, like the
plan-*-review family). Each tier-1 skill sheds 271 lines of onboarding
prose it never needed; tier-2 shed 20 each.
Verification per the review protocol: regen diff reviewed (pure
section-removal), skill-validation + size-budget + catalog-budget +
v0-dormancy suites green (822 tests), and live smoke of the tier-corrected
skills confirms the preamble renders the intended sections at each tier.
These skills have ~no eval coverage — stated honestly; the wave's gate-tier
eval run is the backstop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(test): e2e-gate — one tier-gate implementation, side-effect-free, with the trap pinned
The EVALS/EVALS_TIER gate was copy-pasted into ~40 test files and had drifted
into six different predicates — the drift that made 'eval:bg:all runs
everything' silently false. test/helpers/e2e-gate.ts owns the semantics now:
describeE2ETier(tier) + e2eTierEnabled(tier), env read at call time, zero
side effects (the existing e2e-helpers module runs a ~30s claude ping at
import under EVALS=1, so the gate lives in its own module; purity is pinned
by tests that scan imports and comment-stripped source).
The unit matrix pins all four env combos — including EVALS=1 with EVALS_TIER
unset -> SKIP, the exact trap that made eval:bg:all a non-run. The
tier-alignment tripwire gains a second regex for the helper shape (old shape
still detected — stragglers can't hide), and the sharded paid runner's
PRE-SPAWN tier classifier learns the helper shape too: without that, every
gate-sharded run would have spawned all 28 periodic shards just to skip them,
each paying the e2e-helpers import ping (~15 min of dead wall clock in the
CI-blocking lane). Verified: gate runs exclude the 29 periodic files,
periodic excludes the 8 gate files — identical to pre-migration.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(test): migrate the 36 tier-gated eval files to describeE2ETier
Mechanical two-liner swap in 34 files (each keeping its declared tier — all
36 predicates verified against E2E_TIERS before migrating); the two files
with compound gates (overlay-harness's EvalCollector feed, codex-e2e's
CODEX_AVAILABLE) keep their extra conditions via e2eTierEnabled. Tier
rationale comments preserved. codex-e2e/gemini-e2e/benchmark-providers keep
their distinct stderr-message gate shapes by design.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(test): skill-e2e + skill-llm-eval adopt the shared selection machinery
Both files re-implemented the diff-selection machinery e2e-helpers already
exported. The helper gained computeDiffSelection() (extracted, identical
behavior) and a trailing optional selection param on the *IfSelected helpers
(defaults preserve all 30+ existing importers). skill-e2e.test.ts drops ~120
duplicated lines; skill-llm-eval keeps its LLM_JUDGE_TOUCHFILES selection and
test.concurrent semantics via testConcurrentIfSelected.
Deliberate deltas, stated: skill-e2e.test.ts now honors the EVALS_TIER
intersection its local copy lacked (affects only direct bun test invocations
of that file — it matches no eval-script glob); its recordE2E gains the
helper's three diagnostic fields; skill-llm-eval sharded solo now runs
e2e-helpers' module-scope preflight it already ran in combined processes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): kill the silent-truncation race; exempt the tier-corrected shrinks
The full-suite shakeout (budgeted by the plan) surfaced both immediately:
1. server-embedder-terminal-port.test.ts stubbed process.exit and restored
the REAL exit in its finally — but shutdown() schedules async work that
can call process.exit AFTER restoration, killing the entire bun process
mid-suite with exit 0 and NO summary. This is the silent-truncation class
the new free-suite CI job guards against, reproduced locally on the first
full run. Exit now stays a logging no-op between tests (late async exits
become visible stderr lines, not process death); the true exit returns in
afterAll.
2. The 80%-of-baseline shrink guard correctly flagged the six tier-corrected
skills — their baseline was measured at the silent tier-4 default. Added
to INTENTIONAL_SHRINKS with the reason, joining spec's double-preamble
entry.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* release: v1.64.0.0 — the code-smell fix wave
35 commits, one PR: guard repairs (free suite in CI per-file, all-host
freshness gates, tunnel allowlist, diff-selection validation), the
sidebar-agent ghost exorcism (dead ML layers, dead endpoints, dead exports,
ghost comments), config honesty (defineHost factory, dead fields deleted,
preamble tiers explicit, spec double-render fixed), and dedup with safety
nets (session-cookie factory, fs-atomic, jsonl-store contract, one eval
tier-gate). Net -24,943 lines across 183 files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): free-tests step runs under bash (container sh rejects pipefail)
Maiden-voyage shakeout, exactly as budgeted: the CI container's default
shell is dash, which errors on 'set -o pipefail' before the first test ran.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): free-tests curates 8 container-incompatible files with reasons
Second maiden-voyage shakeout round: 376 of 384 files ran green in the
container on the first completed pass. The 8 that can't run there yet are
excluded the same way the Windows shards curate POSIX-bound files — each
with its reason inline (headed-Chrome handoff, real-PTY round-trip, X server
management, extension-origin identity, the job's own TMPDIR override, and
three pre-existing env failures that fail on dev machines too). Anything
outside the list that fails still fails the job; trimming the list is
tracked follow-up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): gstack-config-key-locale — suppress the skill_prefix auto-relink side effect
The test invokes the repo's own bin/gstack-config, whose 'set skill_prefix'
auto-runs $(dirname $0)/gstack-relink — resolving the install dir to the
repo itself. In any environment where the loop shares a working tree (the
free-tests CI container, a fresh-HOME run), gstack-patch-names rewrote all
52 tracked SKILL.md names to gstack- prefixed, poisoning five unrelated
suites downstream (hermetic-skills-seeding, host-config golden, skill-census,
skill-validation, spec-template-sync). GSTACK_SETUP_RUNNING=1 is the
documented suppression; relink behavior stays covered by relink.test.ts's
mock install.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(bin): gstack-codex-session-import — empty sessions dir exits 0 on Linux
GNU xargs runs 'ls -t' once even on empty input, listing the cwd and
producing a bogus LATEST from the repo root; BSD xargs (macOS) skips the
run, which is why the NO_SESSIONS path only broke on Linux. xargs -r pins
the BSD behavior on both platforms.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(parity): rebaseline v1.57.7.0 → v1.64.1.0 + skeleton-cap headroom
The two parallel v1.64 waves (code-smell fix wave + main's #2571) each
added shared-preamble prose, pushing document-release / design-consultation
/ cso past their size ratios on the v1.57.7.0 anchor and four carved
skeletons (plan-ceo-review, plan-eng-review, office-hours,
design-consultation) 22-280 B over their absolute caps. New baseline is
union-normalized (skeleton + sections/*.md, matching what the harness
measures); caps get +~1 KB headroom each with per-cap rationale. The
v1.57.7.0 fixture stays in test/fixtures/ for the audit trail, and
capture-parity-baseline.ts now documents the union-normalization step so
the next rebaseline doesn't re-trip on it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): free-tests container parity — tools, pinned bun, git identity, mutation tripwire
- Dockerfile.ci: add python3 (gstack-jsonl-merge/brain-sync/detach shell out
to it), file (skill-validation's binary check), poppler-utils (make-pdf
e2e gates hard-require pdftotext/pdffonts/pdfinfo), fonts-noto-color-emoji
(emoji render gate, mirrors make-pdf-gate.yml). Fix the bun pin: the
bun.sh installer ignores a BUN_VERSION env var, so the old form silently
installed latest on every rebuild (observed 1.3.13/1.3.14 drift vs the
1.3.10 devs run locally); pass the version as the positional arg.
- free-tests.yml: git identity + safe.directory for the git-exercising
tests (container checkout is owned by a different uid than runner);
post-loop tree-mutation tripwire that names a tracked-file-mutating test
instead of letting downstream collateral confuse the report; skip the
documented variants-retry-after timing flake.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(bin): gstack-session-update — detached updater owns its stdio (SIGPIPE)
The backgrounded update subshell inherited the session hook's stdout/stderr
pipes. Once the hook exits and the caller closes them, any child that writes
— git pull's autostash notice, setup output — dies of SIGPIPE, logged as
PULL_FAILED exit=141 with an empty stderr capture (observed in the free-tests
container, and reachable by any production hook runner that closes stdio
promptly). Redirect the fork to /dev/null; all observability already flows
through the session-update log file.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): gstack-decision-bins — explicit branch context for the scope filter
CI checks out a detached HEAD, where gitBranch() returns undefined on both
the log and search sides, so an implicitly branch-scoped decision can never
surface (filterByScope requires a matching non-empty ctx.branch). Pass the
branch explicitly on both sides — the filter logic is what's under test, not
git branch detection.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): ring-buffer lease interplay — same TTL window, not same millisecond
Two back-to-back mintLease() calls each stamp Date.now() + TTL; when they
straddle a millisecond boundary the exact-equality assertion flakes
(observed in CI: expiries of ...525 vs ...526). Assert the expiries are
within a 50 ms window instead — the invariant under test is that leases
share a TTL policy, not that they mint in the same clock tick.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: Layer C stealth — chrome.*, Notification, per-install hardware, toString Proxy (gbrowser T1+T3+D6)
Three additions stacked into the existing applyStealth() init script
to close the visible automation tells that today push GBrowser users
into Google's /sorry/index captcha and similar:
T1 — Strip Playwright's automation default args:
--enable-automation (kills "Chrome is being
controlled" infobar)
--disable-popup-blocking, --disable-component-update,
--disable-default-apps (Patchright's list — each
is a documented tell)
Now centralized in STEALTH_IGNORE_DEFAULT_ARGS export, used by BOTH
launchHeaded() and handoff() (the headless → headed re-launch path).
D6 — Drop "GStackBrowser" UA branding suffix:
Real Chrome's UA ends `Safari/537.36`, not `Safari/537.36 GStackBrowser`.
The branded suffix was a high-entropy classifier for any vendor that
grep'd UA for known automation/test-browser strings. Branding still
lives in the wrapper .app name + Dock icon + tray — does not need
to leak via the UA string for the product to be "GBrowser." Resolves
the "looks like Chrome but identifies as GStackBrowser" contradiction
codex review #18 flagged.
T3 — Layer C init-script additions in stealth.ts:
1. Function.prototype.toString Proxy (must run first). Wraps every
patched getter / function in a WeakSet so they report
`function NAME() { [native code] }` at every recursion depth,
defeating the depth-3+ integrity check
(fn.toString.toString.toString().includes('[native code]')).
2. window.chrome.runtime / chrome.app / chrome.csi / chrome.loadTimes
restoration with full enum shape (OnInstalledReason, PlatformArch,
PlatformOs, etc.) + method bodies. Real Chrome ships these; their
absence is universally checked. Vendor research (gbrowser plan
deep-dive on Cloudflare + DataDome) confirmed both vendors probe
this shape directly.
3. Notification.permission aligned to 'default'. The existing inline
addInitScript already spoofs permissions.query({name:'notifications'})
to return 'prompt' — Notification.permission being 'denied' while
Permissions returns 'prompt' is a cross-source inconsistency that
detectors flag specifically.
4. Per-install hardware values via GSTACK_HW_CONCURRENCY /
GSTACK_DEVICE_MEMORY env vars (set by gbd's host_profile.go from
system_profiler + sysctl). Reporting real host values within the
Chrome shape avoids the cross-user GBrowser fingerprint cluster
that hardcoded defaults would create. Codex review #10 flagged
hardcoding as creating contradictions across Apple Silicon / Intel
/ UA-CH architecture.
5. Selenium 25-global cleanup + PhantomJS + NightmareJS + Watir +
Playwright (__pwInitScripts, __playwright__binding__) static-name
deletion. The inline block continues to handle the dynamic
cdc_/__webdriver/__selenium/__driver prefixes.
D7 (codex correction) kept: still do NOT fake navigator.plugins or
navigator.languages. Synthesizing those triggers MORE consistency
flags from modern fingerprinters than letting Chromium surface them
natively.
Test coverage:
- 15 new tests in stealth-layer-c.test.ts covering: launch-flag
exports, script structure, toString-Proxy installs first, every
spoof present, hardware values interpolated from input (not
hardcoded), Selenium global cleanup spot-check, no GStackBrowser
leak in stealth payload, backwards-compat exports preserved.
- All 8 existing stealth-webdriver tests still pass.
- All 2 existing browser-manager-unit tests still pass.
For GBrowser specifically: this is the gstack-side half of Phase 1 / T1
+ T3 + D6 in the anti-detection plan. The gbrowser repo's submodule
pointer bump will land alongside this.
* feat: buildGStackLaunchArgs — Pack 1 cmdline-switch construction for gbrowser
New stealth.ts export that turns the GSTACK_* env vars (already populated
by gbrowser's gbd from host_profile.go) into the --gstack-* cmdline
switches the Pack 1 Chromium patches read at WebGL getParameter,
NavigatorUA::userAgentData, NavigatorConcurrentHardware::hardwareConcurrency,
and NavigatorDeviceMemory::deviceMemory time.
Wired into all three launchArgs sites: launch() (headless), launchHeaded()
(real product path), and handoff() (headless → headed re-launch).
Mapping:
GSTACK_GPU_VENDOR → --gstack-gpu-vendor
GSTACK_GPU_RENDERER → --gstack-gpu-renderer
GSTACK_PLATFORM → --gstack-ua-platform (with mapping:
MacARM/MacIntel → macOS, Win32 → Windows,
Linux x86_64 → Linux)
GSTACK_GPU_CHIPSET → --gstack-ua-model
GSTACK_HW_CONCURRENCY → --gstack-hw-concurrency
GSTACK_DEVICE_MEMORY → --gstack-device-memory
Each switch is emitted only when its env var is non-empty — empty
values fall through to the patch's "no override" path, which returns
the real Chromium native value. Safe to ship on Chromium builds
without the Pack 1 patches applied (zero behavior change).
The patches themselves live in the gbrowser repo at chromium/patches/
{webgl-vendor-spoof,ua-client-hints-stealth,worker-navigator-stealth}.patch.
Both halves (gstack arg construction + gbrowser C++ patches) must
land + Chromium rebuild before the spoof reaches the WebGL/UA-CH/
hardware accessors. Currently dormant until then.
Tests (browse/test/stealth-layer-c.test.ts):
7 new buildGStackLaunchArgs cases — empty env, all-populated, partial,
platform mapping (MacARM/MacIntel/Win32/Linux), unrecognized platform
fallthrough, vendor-with-spaces escape-safety.
All 32 stealth/browser-manager tests pass.
For GBrowser specifically: gstack-side half of the Pack 1 flag plumbing.
gbrowser repo will bump the submodule pointer to this commit, then re-run
bun run test/anti-bot/evidence-run.ts to verify creepjs's "33% headless"
score drops after Pack 1 + Chromium rebuild.
* feat: buildGStackLaunchArgs adds --gstack-suppress-prepare-stack-trace
Pack 2 / B11 flag plumbing for the new
error-preparestacktrace-stealth.patch in gbrowser/chromium/patches/.
Always emit --gstack-suppress-prepare-stack-trace unless the caller
explicitly sets GSTACK_CDP_STEALTH=off in the environment. Off by
default in patch behavior (no-op without the C++ patch), so this is
safe on stock Playwright Chromium too.
Closes the Cloudflare canary trick where a page sets
Error.prepareStackTrace and watches for it to fire during CDP
serialization of a logged Error object.
Tests:
All 33 stealth/browser-manager tests pass. New cases:
- GSTACK_CDP_STEALTH=off disables suppression
- empty env still emits the always-on flag (count=1)
- all-populated env now emits 7 flags (was 6)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(browse): enable Chromium sandbox on headed launchPersistentContext
Mirrors v1.40.0.1 from main lineage (PR #1617). Cherry-picked onto
gbrowser-anti-detection so the GBrowser submodule can consume the fix
without waiting for main to merge.
Playwright auto-adds --no-sandbox whenever chromiumSandbox !== true
(playwright-core/lib/server/chromium/chromium.js:291-292). The headless
chromium.launch() site set the option; the two headed sites
(launchHeaded() and handoff()) did not. Every headed launch on macOS
and Linux showed Chromium's yellow "unsupported command-line flag:
--no-sandbox" infobar.
shouldEnableChromiumSandbox() centralizes the Win32 / CI / CONTAINER /
root heuristic that previously lived only in the headless path's
explicit --no-sandbox push at :225. All three launch sites now use the
helper, and six unit tests pin the policy across darwin, linux, win32,
CI, CONTAINER, and root.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* v1.40.0.2 fix(browse): Cmd+Q on managed Chromium stops triggering supervisor respawn
Three browser.on('disconnected') handlers in browse/src/browser-manager.ts
(launch, launchHeaded, handoff) each exited with a non-zero code on every
disconnect, regardless of cause. Process supervisors that consume our exit
code (gbrowser's gbd HealthMonitor in cmd/gbd/health.go) treated user
Cmd+Q identical to a Chromium crash and respawned with exponential
backoff, so the visible browser kept reappearing after the user closed it.
Add resolveDisconnectCause(browser) that reads the underlying ChildProcess
exitCode + signalCode (waiting up to 1s for the exit event if the
disconnected event fired first). Exit code 0 + no signal = clean user
quit; anything else = crash, signal-kill, or OOM.
Wire the resolver into all three disconnect handlers:
- launch() (headless): clean → exit 0, crash → exit 1 (was always 1)
- launchHeaded() (headed): clean → exit 0, crash → exit 2 (was always 2)
onDisconnect() cleanup callback still runs in both cases.
- handoff() (re-launch): same as launch() via the helper.
Preserve the per-path crash codes (1 vs 2) so any supervisor that
differentiated headed vs headless crashes keeps working.
Seven new unit tests in browse-manager-unit.test.ts cover the resolver
across already-exited, signal-killed (SIGSEGV / SIGKILL), async exits,
and null-browser inputs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(browse): apply stealth on every launch path + share automation-artifact cleanup
handoff() built cmdline args but never called applyStealth, so a handed-off
browser had no JS stealth (no webdriver mask, no chrome.* shape, no toString
proxy). And the cdc_/Permissions cleanup shim lived inline in launchHeaded()
only, so headless launch() reported Notification.permission='default' without
the matching permissions.query='prompt' answer — the exact cross-source
inconsistency the shim exists to prevent.
Move the cleanup into AUTOMATION_ARTIFACT_CLEANUP_SCRIPT inside applyStealth so
all three launch paths (launch, launchHeaded, handoff) get identical stealth,
and call applyStealth(newContext) in handoff() before restoreState() navigates.
A static tripwire in browser-manager-unit.test.ts fails CI if any launch path
drops the applyStealth call again.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(browse): make --gstack-suppress-prepare-stack-trace opt-in, not default-on
buildGStackLaunchArgs() pushed the flag unless GSTACK_CDP_STEALTH=off, i.e.
on-by-default — contradicting its own comment ("off by default, only for
gbrowser builds"). The switch is read by a C++ patch that only exists in
gbrowser; on stock Playwright Chromium it is an unknown switch.
Flip to opt-in: emit only when GSTACK_CDP_STEALTH is on/1/true. gbd opts in by
exporting GSTACK_CDP_STEALTH=on; stock installs leave it unset so the flag
never reaches a Chromium that wouldn't understand it. Comment now matches code.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(browse): correct stale stealth comments
The file-level stealth.ts docstring claimed "we DON'T fake navigator.plugins"
while the same file now ships EXTENDED_STEALTH_SCRIPT, which does fake plugins
when GSTACK_STEALTH=extended. Clarify that Layer C (the always-on default)
doesn't fake plugins and the opt-in extended mode does, as the documented
"actively lies, may break sites" escape hatch.
Also fix the launch()/launchHeaded() comments that said "mask navigator.webdriver
only" — applyStealth (Layer C) also restores window.chrome.*, aligns
Notification.permission, and sets per-install hardware.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(browse): runtime + extended-mode coverage for the stealth blend
The stealth tests were all static string-shape assertions; nothing executed
the script in a real page. Add real-Chromium runtime checks via applyStealth +
page.evaluate:
- Layer C runtime: window.chrome.* rich shape, Notification.permission='default'
paired with permissions.query notifications='prompt' (guards the shim now
running on every path), and patched getters reporting [native code].
- Per-install hardware: navigator.hardwareConcurrency/deviceMemory reflect the
GSTACK_* env profile.
- Extended-mode blend: navigator.plugins is faked when GSTACK_STEALTH=extended,
Layer C still wins window.chrome.runtime, and navigator.webdriver stays false
(own-prop getter survives extended's prototype delete).
- Persistent-context (launchHeaded/handoff) parity now uses a page created
AFTER applyStealth — the old test checked pages()[0], which predates the init
script, so webdriver was false only via the launch arg, not Layer C.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(browse): handoff() + launchHeaded() spread the shared STEALTH_LAUNCH_ARGS
handoff() built its launch args from only ['--hide-crash-restore-bubble',
...buildGStackLaunchArgs()], omitting STEALTH_LAUNCH_ARGS — so a handed-off
browser kept the --disable-blink-features=AutomationControlled tell that
launch() and launchHeaded() strip. launchHeaded() also hardcoded the flag as a
literal. Both now spread the shared constant, so the AutomationControlled flag
lives in one place across all three launch paths.
Tripwires: STEALTH_LAUNCH_ARGS spread into >= 3 sites (no inline literal) and
STEALTH_IGNORE_DEFAULT_ARGS wired into both persistent-context paths.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(browse): drop dead HostProfile.platform, export test internals
HostProfile.platform was set by readHostProfile but never read by
buildStealthScript — the platform spoof is owned by the UA-CH cmdline switch in
buildGStackLaunchArgs (which reads GSTACK_PLATFORM directly). Remove the dead
field. Export readHostProfile and AUTOMATION_ARTIFACT_CLEANUP_SCRIPT so their
clamp/shape invariants can be unit-tested. Correct the stale "25 Selenium
globals" count comment and note the extended cdc_ scan is redundant-but-retained
for standalone use.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(browse): cover readHostProfile clamp, toString depth-3, chrome.* calls
Pre-landing review coverage gaps:
- readHostProfile clamps 0/negative/NaN/missing env to 8 (a deviceMemory=0 or
NaN would be a glaring bot tell) — now asserted.
- toString proxy survives the depth-3 recursion trick
(fn.toString.toString.toString().includes('[native code]')), the headline
claim that was only tested at depth-1.
- chrome.csi() and chrome.loadTimes() are invoked (not just typeof-checked) and
runtime.connect() throws the native-shaped "No matching signature" error.
- AUTOMATION_ARTIFACT_CLEANUP_SCRIPT static shape (cdc_/__webdriver strip +
notifications->prompt) as a hermetic backup for the live-Chromium pairing test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(browse): recreateContext() re-applies stealth (closes 4th un-stealth path)
useragent and viewport --scale route through recreateContext(), which rebuilds
the BrowserContext via newContext() — a fresh context with no init scripts. It
never called applyStealth, so a routine useragent/viewport-scale command
silently dropped webdriver masking, window.chrome.* shape, hardware spoof, and
the cdc/Permissions cleanup on every restored page. Caught by the cross-model
adversarial review (Codex) after the Claude pass and eng review missed it.
Both the main and fallback paths now call applyStealth before any page is
created. The launch-path tripwire is raised to >= 4 sites and now asserts the
recreateContext() body specifically, so the regression class can't recur.
Also documents the load-bearing trust assumption on buildGStackLaunchArgs /
readHostProfile (GSTACK_* must be gbd-sourced, never page/remote data — the
injection-safety argument depends on it) and the notifications-permission
spoof tradeoff.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: bump version and changelog (v1.58.3.0)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: sync browser stealth docs to Layer C (v1.58.3.0)
BROWSER.md "Stealth scope" still described the default as navigator.webdriver
masking only; Layer C is now the always-on default across all four
context-creation paths. Update the stealth-scope prose, the "What GStack
Browser means" blurb (stock-Chrome UA, no GStackBrowser suffix, captchas can
still get through at the CDP layer), the stealth.ts source-map line, and the
env-vars table (GSTACK_STEALTH, GSTACK_CDP_STEALTH, GSTACK_GPU_*, GSTACK_PLATFORM,
GSTACK_HW_CONCURRENCY/GSTACK_DEVICE_MEMORY + the explicit --gstack-* switches and
ignoreDefaultArgs stripping). Correct the stale "narrows to navigator.webdriver
masking only" premise on the open CDP-patch TODO (the TODO itself stays open —
the CDP-protocol layer is still unaddressed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(browse): SOCKS5 bridge with auth + cred redaction helper
Adds browse/src/socks-bridge.ts: a 127.0.0.1-only SOCKS5 listener that
accepts unauthenticated connections from Chromium and relays them through
an authenticated upstream proxy. Chromium does not prompt for SOCKS5 auth
at launch, so this bridge is the workaround for using auth-required
residential SOCKS5 upstreams.
- startSocksBridge({ upstream, port: 0 }) → ephemeral 127.0.0.1 listener
- testUpstream({ upstream, retries: 3, backoffMs: 500, budgetMs: 5000 })
pre-flight that connects to a known endpoint (default 1.1.1.1:443)
- Stream-error policy: kill affected client + upstream sockets on any
error mid-stream; no transport retries (a transport-layer retry can
corrupt browser traffic)
Adds browse/src/proxy-redact.ts: single source of truth for redacting
credentials in any logged proxy URL or upstream config. Every code path
that prints proxy config goes through this helper.
Adds the socks npm dep (~30KB) and 16 tests covering: 127.0.0.1-only
bind, byte-for-byte round trip through the bridge, auth rejection,
mid-stream upstream drop kills client conn, listener teardown,
testUpstream success + retry-exhaust paths, redaction of every
credential shape.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(browse): --proxy and --headed flags wire bridge into daemon
Adds the global --proxy <url> and --headed flags to the browse CLI.
Resolves cred policy and routes the daemon launch through the SOCKS5
bridge (or pass-through for HTTP/HTTPS) before chromium.launch().
CLI (cli.ts):
- extractGlobalFlags() strips --proxy/--headed from argv, parses URL via
Node URL class, validates D9 cred-mixing (env BROWSE_PROXY_USER/PASS
+ URL creds → exit 1 with hint), composes canonical proxy URL with
resolved creds, computes a stable configHash for daemon-mismatch
- ensureServer() now reads existing daemon's configHash from state file
and refuses (exit 1 with disconnect hint) if --proxy/--headed mismatch
the existing daemon. No silent restart that would drop tab state.
- All proxy-related stderr lines go through redactProxyUrl
proxy-config.ts (new):
- parseProxyConfig() — URL parser + D9 cred-mixing detector + scheme allowlist
- computeConfigHash() — stable hash of (proxy URL minus creds + headed flag)
- toUpstreamConfig() — map ParsedProxyConfig → socks-bridge.UpstreamConfig
Server (server.ts):
- Reads BROWSE_PROXY_URL at startup; for SOCKS5+auth, runs testUpstream
pre-flight (5s budget, 3 retries, 500ms backoff) and exits 1 on failure
with redacted error
- Spawns startSocksBridge() on 127.0.0.1:<ephemeral> and points
Chromium at it via socks5://127.0.0.1:<port>
- HTTP/HTTPS or unauth SOCKS5 → pass-through to chromium.launch
proxy.server (with username/password if present)
- State file gains optional configHash for daemon-mismatch check
- Bridge tears down via process.on('exit')
Browser manager (browser-manager.ts):
- New setProxyConfig({ server, username, password }) called by server.ts
before launch
- chromium.launch() and both launchPersistentContext sites pass the
proxy config through when set
Tests: 22 new across proxy-config (parse + cred-mixing + hash stability)
and extractGlobalFlags (flag stripping + cred-mixing rejection + cred
rotation hash stability + redaction).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(browse): Xvfb auto-spawn with PID + start-time validation
Adds browse/src/xvfb.ts: a Linux-only Xvfb auto-spawn module for
running headed Chromium in containers without DISPLAY. The module
walks a display range to pick a free one (never hardcodes :99) and
validates orphan PIDs by BOTH /proc/<pid>/cmdline matching 'Xvfb' AND
start-time matching the recorded value before sending any signal.
Defends against PID reuse — refuses to kill anything that doesn't
match both checks.
- shouldSpawnXvfb(env, platform) — pure decision: skip on macOS/Windows,
on Linux skip when DISPLAY or WAYLAND_DISPLAY is set (codex F2)
- pickFreeDisplay(99..120) — probes via xdpyinfo
- spawnXvfb(display) — returns { pid, startTime, display } handle
- isOurXvfb(pid, startTime) — both-checks validator
- cleanupXvfb(state) — best-effort, validates ownership before SIGTERM
Wired into server.ts startup: when shouldSpawnXvfb says yes, picks a
free display, spawns Xvfb, sets DISPLAY for chromium.launchHeaded, and
records xvfbPid/xvfbStartTime/xvfbDisplay in the state file. Cleanup
runs on process.on('exit'). The CLI's disconnect path also runs
cleanupXvfb() in the force-cleanup branch when the server is dead.
Disconnect now applies to any non-default daemon (headed mode OR
configHash-tagged daemon — i.e. one started with --proxy/--headed),
not just headed mode.
Adds xvfb + x11-utils to .github/docker/Dockerfile.ci so CI exercises
the Linux container --headed path on every run. Without it the most
common production path would go untested.
Tests: 17 new across decision logic, PID validation defenses
(cmdline mismatch, start-time mismatch), no-op safety on bad inputs,
and a Linux+Xvfb-installed gate for the spawn → validate → cleanup
round trip. Tests skip on macOS/Windows automatically.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(browse): webdriver-mask stealth + Chromium-through-bridge e2e
D7 (codex narrowing): mask navigator.webdriver only via addInitScript.
The wintermute approach (fake plugins=[1..5], fake languages=['en-US',
'en'], stub window.chrome) is intentionally NOT applied — modern
fingerprinters check consistency between plugins.length, languages,
userAgent, and platform, and synthesizing fixed values can flag MORE
bot-like, not less. The honest minimum is webdriver, which Chromium
exposes as a known automation tell.
Adds browse/src/stealth.ts: single source of truth for the stealth
init script and launch args. Both browser-manager.launch() (headless)
and launchHeaded() (persistent context with extension) call
applyStealth(context) and pass STEALTH_LAUNCH_ARGS into chromium.launch.
The pre-existing launchHeaded stealth that did fake plugins/languages
is removed for the same reason. The cdc_/__webdriver runtime cleanup
and Permissions API patch are kept — they remove automation-injected
artifacts, not synthesize fake natural-browser values.
Adds bridge-chromium-e2e.test.ts (codex F3): the test that proves the
FEATURE works. Real Chromium with proxy.server = 'socks5://127.0.0.1:
<bridgePort>' navigates to a local HTTP fixture; the auth upstream's
connect counter and the HTTP fixture's hit counter both increment,
proving traffic actually traversed bridge → auth-upstream → destination.
Without this test, we could ship a working byte-relay and a broken
Chromium integration and never know.
Adds bridge-port-restart.test.ts (codex F1, reframed): old test
assumed two daemons coexist, which contradicts D2 single-daemon model.
Reframed as restart-then-restart, asserting fresh ephemeral ports
(never the hardcoded 1090) on each spin-up.
Adds stealth-webdriver.test.ts: navigator.webdriver=false in both
fresh contexts and persistent contexts; navigator.plugins/languages
are NOT replaced with the wintermute fake list (D7 verification).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(gstack): generate llms.txt — single-file capability index for AI agents
Adds scripts/gen-llms-txt.ts: produces gstack/llms.txt at repo root,
indexing every skill (47), every browse command (75), and design
commands when the design CLI is present. Per the llmstxt.org
convention, agents can read one file to learn what gstack offers
instead of crawling 47 SKILL.md files.
Sources:
- skill SKILL.md.tmpl frontmatter (name + description block scalar)
- browse/src/commands.ts COMMAND_DESCRIPTIONS (sorted by category)
- design/src/commands.ts COMMAND_DESCRIPTIONS if present (best-effort)
Wired into scripts/gen-skill-docs.ts as a post-step so it regenerates
on every `bun run gen:skill-docs` (the same script that re-emits all
SKILL.md files). Failures are non-fatal warnings, not build breaks —
the generator never blocks SKILL.md regen.
Strict mode (--strict, also used by tests) throws when a skill is
missing name or description in its frontmatter, catching missing
metadata before it ships.
Tests: shape (top-level sections, sort order, single-line summary
discipline), every-skill-and-command-appears, strict-mode rejection of
incomplete frontmatter, and freshness check that the committed
gstack/llms.txt matches what the generator produces now.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(browse): --navigate flag on download for browser-triggered files
Adds the --navigate strategy from community PR #1355 (originally from
@garrytan-agents). When set, download navigates to the URL with
waitUntil:'commit' and captures the resulting browser download via
page.waitForEvent('download'), then saves via download.saveAs().
Handles URLs that trigger files via Content-Disposition headers,
multi-hop CDN redirects requiring browser cookies, or anti-bot CDN
chains where page.request.fetch() can't follow the auth/redirect
chain.
Defaults still use the existing direct-fetch strategy. --navigate is
opt-in.
Goes through the same validateNavigationUrl SSRF gate as goto, so
download --navigate cannot reach IPv4 metadata endpoints (AWS IMDSv1,
GCP/Azure equivalents) or arbitrary internal hosts.
Inferred content type from suggested filename for common extensions
(epub, pdf, zip, gz, mp3/mp4, jpg/jpeg/png, txt, html, json) — falls
back to application/octet-stream. Same 200MB cap as Strategy 1.
Frames the use case generically (anti-bot CDN, Content-Disposition,
redirect chains) rather than naming any specific site, per project
voice rules.
Co-Authored-By: @garrytan-agents
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs: v1.28.0.0 — browse SKILL section + VERSION + CHANGELOG
VERSION 1.27.1.0 → 1.28.0.0 (MINOR — substantial new capability:
five new flags/features, ~600 LOC added, new socks dep, multiple
new modules).
browse/SKILL.md.tmpl: new "Headed Mode + Proxy + Anti-Bot Sites"
section between User Handoff and Snapshot Flags. Documents
--headed (auto-Xvfb on Linux), --proxy (with embedded SOCKS5
bridge for auth), download --navigate, the cred-mixing policy,
daemon-discipline (refuse-on-mismatch), the narrowed
webdriver-only stealth, container support caveats, and the
fail-fast/no-retry failure modes.
CHANGELOG entry follows the release-summary format from CLAUDE.md:
two-line headline, lead paragraph, "The numbers that matter"
table tied to specific test files that prove each capability,
"What this means for AI agents" closing tied to a real workflow
shift, then itemized Added/Changed/Fixed/For-contributors
sections.
Browse SKILL.md regenerated via bun run gen:skill-docs.
gstack/llms.txt regenerated automatically from the same pipeline.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(browse): integration coverage for daemon mismatch + proxy fail-fast
Adds two integration tests that exercise the full process boundary,
not just the module-level wiring.
daemon-mismatch-refuse.test.ts (D2):
- Stubs a healthy state file with a fake configHash and a fake /health
HTTP server, runs the actual cli.ts binary with a mismatching
--proxy, asserts exit 1 + 'different config' / 'browse disconnect'
hint in stderr.
- Same shape with the plain-daemon-meets---headed case.
- Positive case: matching configHash → CLI does NOT emit the mismatch
hint (regardless of whether the actual command succeeds).
server-proxy-fail-fast.test.ts:
- Starts the rejecting SOCKS5 upstream, spawns server.ts with
BROWSE_PROXY_URL pointing at it, BROWSE_HEADLESS_SKIP=1 to skip
Chromium launch.
- Asserts exit 1, 'FAIL upstream' in stderr (testUpstream pre-flight
ran), no raw credential leakage in any output (redaction works on
the failure path), and exit within 30s upper bound.
Both tests use the existing spawn-bun-cli pattern from
commands.test.ts so they run on the same CI infrastructure as the
rest of the bun test suite.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(gen-skill-docs): keep module sync so test require() still works
Two regressions caught by the full test suite after the v1.28.0.0
landing pass:
1) package.json version mismatch — VERSION was bumped to 1.28.0.0
but package.json still pinned to 1.27.1.0.
test/gen-skill-docs.test.ts asserts they match.
2) Top-level await in scripts/gen-llms-txt.ts (CLI entry block) and
scripts/gen-skill-docs.ts (post-step) made gen-skill-docs an
async module. test/gen-skill-docs.test.ts uses require() to pull
extractVoiceTriggers/processVoiceTriggers from gen-skill-docs,
which Bun rejects on async modules with:
"TypeError: require() async module ... unsupported.
use 'await import()' instead."
Fix: wrap the await blocks in void IIFEs so the modules remain sync
from a require() perspective.
After fix: all 379 gen-skill-docs tests pass, all 77 new feature
tests pass (3 skipped on macOS — Linux+Xvfb gates).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(browse): apply codex adversarial findings on the new lifecycle
Codex outside-voice review caught five real production-failure modes in
the v1.28.0.0 proxy/headed lifecycle. Fixed:
1) `browse disconnect` skip-graceful for proxy-only daemons
(browse/src/cli.ts). The graceful /command POST went out with stray
`domains,` shorthand and (even fixed) the server's disconnect handler
only tears down headed mode — proxy-only daemons returned 200 "Not
in headed mode" while leaving the bridge running. Now disconnect
short-circuits to force-cleanup for non-headed daemons, which kicks
process.on('exit') in server.ts to close the bridge + Xvfb.
2) sendCommand crash retry preserves --proxy / --headed
(browse/src/cli.ts). The ECONNRESET retry path called startServer()
with no extraEnv, silently dropping the proxied flags. A daemon that
died mid-command would silently restart in default direct/headless
mode and bypass the SOCKS bridge. Now reapplies BROWSE_PROXY_URL,
BROWSE_HEADED, and BROWSE_CONFIG_HASH from the resolved global flags.
3) `connect` honors --proxy (browse/src/cli.ts). The headed-mode
`connect` command built its own serverEnv that didn't include
BROWSE_PROXY_URL, so `browse --proxy <url> connect` launched headed
Chromium without the proxy. Now threads proxyUrl + configHash into
the connect serverEnv.
4) SOCKS5 bridge handles fragmented TCP frames
(browse/src/socks-bridge.ts). Previously used once('data') and
parsed each chunk as a complete SOCKS5 frame — TCP doesn't preserve
message boundaries and split greetings/CONNECT requests caused
intermittent handshake failures. Replaced with a single state
machine that buffers chunks and uses size predicates on the SOCKS5
header to know when a complete frame has arrived. Pauses the client
socket during upstream connect and replays any remainder bytes
into the upstream on success.
5) Xvfb cleanup-then-state-delete ordering
(browse/src/server.ts). emergencyCleanup() previously deleted the
state file BEFORE any Xvfb cleanup could read it, orphaning Xvfb
on uncaughtException / unhandledRejection. Now reads the state
file first, calls cleanupXvfb() (which validates cmdline +
start-time before kill), then deletes the state file.
Adds a regression test for #4: writes the SOCKS5 greeting + CONNECT
one byte at a time with 5ms ticks, asserts a clean round trip after
the fragmented handshake.
Codex's sixth finding (bridge advertises NO_AUTH on 127.0.0.1, so any
co-located process can use the authenticated upstream) is documented
as a known limitation — gstack's threat model assumes single-user
hosts. Adding bridge-side auth is a separate change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs: update BROWSER.md + TODOS.md for v1.28.0.0
BROWSER.md picks up a "Headed mode + proxy + browser-native downloads
(v1.28.0.0)" subsection inside Real-browser mode plus the new source-map
entries (socks-bridge.ts, proxy-config.ts, proxy-redact.ts, xvfb.ts,
stealth.ts). TODOS.md anti-bot-stealth item updated to reflect the v1.28
narrowing — the "fake plugins" line is no longer accurate.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(ci): include bun.lock in image build for deterministic install
CI evals all failed on PR #1363 with:
error: Could not resolve: "smart-buffer". Maybe you need to "bun install"?
error: Could not resolve: "ip-address". Maybe you need to "bun install"?
at /opt/node_modules_cache/socks/build/client/socksclient.js:15
The cached node_modules layer in the pre-baked Docker image had
`socks` (the new dep) but was missing its transitive deps (smart-buffer,
ip-address). The image build copied only package.json into the build
context — without bun.lock, `bun install` resolved a different tree
than local `bun install` did, dropping required transitive deps.
Reproduces locally as 229 packages (correct) when bun.lock is present
or absent. Why CI diverged isn't fully understood — possibly Docker
layer cache reuse across image rebuilds — but the deterministic fix is
to include the lockfile in the image build context and use
`--frozen-lockfile`, matching what every CI doc recommends.
Changes:
- .github/docker/Dockerfile.ci: COPY bun.lock alongside package.json,
switch `bun install` → `bun install --frozen-lockfile` so any future
lockfile drift fails loudly during image build instead of producing
a partially-installed cache that breaks downstream eval jobs.
- .github/workflows/evals.yml: include bun.lock in the image-tag hash
so adding/removing a dep invalidates the image, AND copy bun.lock
into the docker context alongside package.json.
- .github/workflows/evals-periodic.yml: same updates.
- .github/workflows/ci-image.yml: rebuild trigger now fires on bun.lock
changes too; build context includes bun.lock.
Image hash changes → fresh image gets built on next CI run → install
matches the lockfile exactly → no missing transitive deps.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(ci): use hardlink copy instead of symlink for node_modules cache
After the bun.lock fix landed, the eval matrix STILL failed identically:
Could not resolve: "smart-buffer" / "ip-address"
at /opt/node_modules_cache/socks/build/client/socksclient.js
But the hash-tagged image actually contains smart-buffer + ip-address +
socks all flat in /opt/node_modules_cache (verified by pulling and
inspecting the image). 207 packages, all present.
Root cause: the workflow used `ln -s /opt/node_modules_cache node_modules`
to restore deps. Bun build (and Node module resolution generally) walks
a file's realpath to find sibling deps. From the symlinked
/workspace/node_modules/socks/build/client/socksclient.js, realpath
resolves to /opt/node_modules_cache/socks/build/client/socksclient.js,
and walking up to find a node_modules/smart-buffer dir fails — there's
no `node_modules` segment in the realpath.
Switch `ln -s` → `cp -al` (hardlink-copy). Each file in the cache becomes
a hardlink at /workspace/node_modules/<pkg>, sharing inodes (no data
copy). Realpath of /workspace/node_modules/socks/.../socksclient.js
stays inside /workspace/node_modules, so sibling deps resolve correctly.
Speed is comparable to symlink — `cp -al` on ~200 packages on tmpfs is
sub-second. Same caching story preserved.
Both evals.yml and evals-periodic.yml updated.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(ci): cp -r instead of cp -al — /opt and /workspace are different filesystems
The hardlink-copy fix landed and immediately broke with:
cp: cannot create hard link 'node_modules/<file>' to
'/opt/node_modules_cache/<file>': Invalid cross-device link
GitHub Actions runners mount the workspace volume at /workspace
(overlay-fs layered onto the runner image), and /opt is the runner
image's own filesystem. Cross-filesystem hardlinks aren't supported.
Switch `cp -al` → `cp -r`. Cost: ~5s for ~200 packages of small JS
files vs ~0s for the broken symlink. Still cheaper than the ~15s
`bun install` fallback. Realpath of /workspace/node_modules/<pkg>/...
stays inside /workspace, so bun build's sibling-dep resolution works.
Both evals.yml and evals-periodic.yml updated.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
