mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-13 20:07:08 +01:00
Garry Tanandcapy-ai[bot]
4c6fa89cdc
* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a cwd bunfig.toml preload before the program starts. gstack runs inside the repo it audits, so a committed .env could steer state roots, the claude binary or spend caps, and a bunfig preload ran arbitrary code in every bin and hook. Every bun shebang, shell and skill caller, TypeScript spawn and compiled build now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(), --no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture regressions. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: name the directly executed scripts in the isolation ratchet Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: plan-mode render pattern accepts the isolation flags Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
21 lines
1.0 KiB
Bash
Executable File
21 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Bash shim — Claude Code hooks run `command` strings via /bin/sh, so this
|
|
# wrapper makes the TypeScript hook executable via bun. Settings.json
|
|
# references this file directly (registered by bin/gstack-memorable enable,
|
|
# never by ./setup).
|
|
#
|
|
# FAIL-OPEN: a third-party recall bridge must never block a prompt. Every
|
|
# failure path — bun missing, script crash — still exits 0 with empty stdout.
|
|
#
|
|
# bun runs as a job, not a foreground child: bash holds a SIGTERM until a
|
|
# foreground child exits, so a host that terminates this shim would leave the
|
|
# vendor process running with the prompt on its stdin. Forwarded, the signal
|
|
# reaches the .ts, which kills the vendor's process group on its way out.
|
|
# `<&0` keeps stdin: bash hands background jobs /dev/null otherwise.
|
|
HERE="$(cd "$(dirname "$0")" && pwd)" || exit 0
|
|
bun --no-env-file --config=/dev/null "$HERE/memorable-user-prompt-hook.ts" <&0 &
|
|
_child=$!
|
|
trap 'kill -TERM "$_child" 2>/dev/null' TERM INT HUP
|
|
wait "$_child" 2>/dev/null || wait "$_child" 2>/dev/null || true
|
|
exit 0
|