mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-01 19:25:10 +02:00
7e96fe299b
* fix(security): validateOutputPath symlink bypass — check file-level symlinks validateOutputPath() previously only resolved symlinks on the parent directory. A symlink at /tmp/evil.png → /etc/crontab passed the parent check (parent is /tmp, which is safe) but the write followed the symlink outside safe dirs. Add lstatSync() check: if the target file exists and is a symlink, resolve through it and verify the real target is within SAFE_DIRECTORIES. ENOENT (file doesn't exist yet) falls through to the existing parent-dir check. Closes #921 Co-Authored-By: Yunsu <Hybirdss@users.noreply.github.com> * fix(security): shell injection in bin/ scripts — use env vars instead of interpolation gstack-settings-hook interpolated $SETTINGS_FILE directly into bun -e double-quoted blocks. A path containing quotes or backticks breaks the JS string context, enabling arbitrary code execution. Replace direct interpolation with environment variables (process.env). Same fix applied to gstack-team-init which had the same pattern. Systematic audit confirmed only these two scripts were vulnerable — all other bin/ scripts already use stdin piping or env vars. Closes #858 Co-Authored-By: Gus <garagon@users.noreply.github.com> * fix(security): cookie-import path validation bypass + hardcoded /tmp Two fixes: 1. cookie-import relative path bypass (#707): path.isAbsolute() gated the entire validation, so relative paths like "sensitive-file.json" bypassed the safe-directory check entirely. Now always resolves to absolute path with realpathSync for symlink resolution, matching validateOutputPath(). 2. Hardcoded /tmp in cookie-import-browser (#708): openDbFromCopy used /tmp directly instead of os.tmpdir(), breaking Windows support. Also adds explicit imports for SAFE_DIRECTORIES and isPathWithin in write-commands.ts (previously resolved implicitly through bundler). Closes #852 Co-Authored-By: Toby Morning <urbantech@users.noreply.github.com> * fix(security): redact form fields with sensitive names, not just type=password Form redaction only applied to type="password" fields. Hidden and text fields named csrf_token, api_key, session_id, etc. were exposed unredacted in LLM context, leaking secrets. Extend redaction to check field name and id against sensitive patterns: token, secret, key, password, credential, auth, jwt, session, csrf, sid, api_key. Uses the same pattern style as SENSITIVE_COOKIE_NAME. Closes #860 Co-Authored-By: Gus <garagon@users.noreply.github.com> * fix(security): restrict session file permissions to owner-only Design session files written to /tmp with default umask (0644) were world-readable on shared systems. Sessions contain design prompts and feedback history. Set mode 0o600 (owner read/write only) on both create and update paths. Closes #859 Co-Authored-By: Gus <garagon@users.noreply.github.com> * fix(security): enforce frozen lockfile during setup bun install without --frozen-lockfile resolves ^semver ranges from npm on every run. If an attacker publishes a compromised compatible version of any dependency, the next ./setup pulls it silently. Add --frozen-lockfile with fallback to plain install (for fresh clones where bun.lock may not exist yet). Matches the pattern already used in the .agents/ generation block (line 237). Closes #614 Co-Authored-By: Alberto Martinez <halbert04@users.noreply.github.com> * fix: remove duplicate recursive chmod on /tmp in Dockerfile.ci chmod -R 1777 /tmp recursively sets sticky bit on files (no defined behavior), not just the directory. Deduplicate to single chmod 1777 /tmp. Closes #747 Co-Authored-By: Maksim Soltan <Gonzih@users.noreply.github.com> * fix(security): learnings input validation + cross-project trust gate Three fixes to the learnings system: 1. Input validation in gstack-learnings-log: type must be from allowed list, key must be alphanumeric, confidence must be 1-10 integer, source must be from allowed list. Prevents injection via malformed fields. 2. Prompt injection defense: insight field checked against 10 instruction-like patterns (ignore previous, system:, override, etc.). Rejected with clear error message. 3. Cross-project trust gate in gstack-learnings-search: AI-generated learnings from other projects are filtered out. Only user-stated learnings cross project boundaries. Prevents silent prompt injection across codebases. Also adds trusted field (true for user-stated source, false for AI-generated) to enable the trust gate at read time. Closes #841 Co-Authored-By: Ziad Al Sharif <Ziadstr@users.noreply.github.com> * feat(security): track cookie-imported domains and scope cookie imports Foundation for origin-pinned JS execution (#616). Tracks which domains cookies were imported from so the JS/eval commands can verify execution stays within imported origins. Changes: - BrowserManager: new cookieImportedDomains Set with track/get/has methods - cookie-import: tracks imported cookie domains after addCookies - cookie-import-browser: tracks domains on --domain direct import - cookie-import-browser --all: new explicit opt-in for all-domain import (previously implicit behavior, now requires deliberate flag) Closes #615 Co-Authored-By: Alberto Martinez <halbert04@users.noreply.github.com> * feat(security): pin JS/eval execution to cookie-imported origins When cookies have been imported for specific domains, block JS execution on pages whose origin doesn't match. Prevents the attack chain: 1. Agent imports cookies for github.com 2. Prompt injection navigates to attacker.com 3. Agent runs js document.cookie → exfiltrates github cookies assertJsOriginAllowed() checks the current page hostname against imported cookie domains with subdomain matching (.github.com allows api.github.com). When no cookies are imported, all origins allowed (nothing to protect). about:blank and data: URIs are allowed (no cookies at risk). Depends on #615 (cookie domain tracking). Closes #616 Co-Authored-By: Alberto Martinez <halbert04@users.noreply.github.com> * feat(security): add persistent command audit log Append-only JSONL audit trail for all browse server commands. Unlike in-memory ring buffers, the audit log persists across restarts and is never truncated. Each entry records: timestamp, command, args (truncated to 200 chars), page origin, duration, status, error (truncated to 300 chars), hasCookies flag, connection mode. All writes are best-effort — audit failures never block command execution. Log stored at ~/.gstack/.browse/browse-audit.jsonl. Closes #617 Co-Authored-By: Alberto Martinez <halbert04@users.noreply.github.com> * fix(security): block hex-encoded IPv4-mapped IPv6 metadata bypass URL constructor normalizes ::ffff:169.254.169.254 to ::ffff:a9fe:a9fe (hex form), which was not in the blocklist. Similarly, ::169.254.169.254 normalizes to ::a9fe:a9fe. Add both hex-encoded forms to BLOCKED_METADATA_HOSTS so they're caught by the direct hostname check in validateNavigationUrl. Closes #739 Co-Authored-By: Osman Mehmood <mehmoodosman@users.noreply.github.com> * chore: bump version and changelog (v0.16.4.0) Security wave 3: 12 fixes, 7 contributors. Cookie origin pinning, command audit log, domain tracking. Symlink bypass, path validation, shell injection, form redaction, learnings injection, IPv6 SSRF, session permissions, frozen lockfile. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Yunsu <Hybirdss@users.noreply.github.com> Co-authored-by: Gus <garagon@users.noreply.github.com> Co-authored-by: Toby Morning <urbantech@users.noreply.github.com> Co-authored-by: Alberto Martinez <halbert04@users.noreply.github.com> Co-authored-by: Maksim Soltan <Gonzih@users.noreply.github.com> Co-authored-by: Ziad Al Sharif <Ziadstr@users.noreply.github.com> Co-authored-by: Osman Mehmood <mehmoodosman@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
193 lines
6.7 KiB
Bash
Executable File
193 lines
6.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gstack-team-init — generate repo-level bootstrap files for team mode
|
|
#
|
|
# Usage:
|
|
# gstack-team-init optional # gentle CLAUDE.md suggestion, one-time offer
|
|
# gstack-team-init required # CLAUDE.md enforcement + PreToolUse hook
|
|
#
|
|
# Run from the root of your team's repo (not from the gstack directory).
|
|
|
|
set -euo pipefail
|
|
|
|
MODE="${1:-}"
|
|
|
|
if [ "$MODE" != "optional" ] && [ "$MODE" != "required" ]; then
|
|
echo "Usage: gstack-team-init {optional|required}" >&2
|
|
echo "" >&2
|
|
echo " optional — suggest gstack install once per developer (gentle)" >&2
|
|
echo " required — enforce gstack install, block work without it" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Must be in a git repo
|
|
if ! git rev-parse --show-toplevel >/dev/null 2>&1; then
|
|
echo "Error: not in a git repository. Run from your project root." >&2
|
|
exit 1
|
|
fi
|
|
|
|
REPO_ROOT=$(git rev-parse --show-toplevel)
|
|
CLAUDE_MD="$REPO_ROOT/CLAUDE.md"
|
|
GENERATED=()
|
|
|
|
# ── Migrate vendored copy if present ──────────────────────────
|
|
|
|
if [ -d "$REPO_ROOT/.claude/skills/gstack" ] && [ ! -L "$REPO_ROOT/.claude/skills/gstack" ]; then
|
|
if [ -f "$REPO_ROOT/.claude/skills/gstack/VERSION" ] || [ -d "$REPO_ROOT/.claude/skills/gstack/.git" ]; then
|
|
echo " Found vendored gstack copy at $REPO_ROOT/.claude/skills/gstack"
|
|
echo " Team mode uses the global install — removing vendored copy..."
|
|
( cd "$REPO_ROOT" && git rm -r --cached .claude/skills/gstack/ 2>/dev/null ) || true
|
|
if [ -f "$REPO_ROOT/.gitignore" ]; then
|
|
if ! grep -qF '.claude/skills/gstack/' "$REPO_ROOT/.gitignore" 2>/dev/null; then
|
|
echo '.claude/skills/gstack/' >> "$REPO_ROOT/.gitignore"
|
|
fi
|
|
else
|
|
echo '.claude/skills/gstack/' > "$REPO_ROOT/.gitignore"
|
|
fi
|
|
rm -rf "$REPO_ROOT/.claude/skills/gstack"
|
|
GENERATED+=(".gitignore")
|
|
echo " Removed vendored copy and added .claude/skills/gstack/ to .gitignore"
|
|
fi
|
|
fi
|
|
|
|
# ── CLAUDE.md snippet ──────────────────────────────────────────
|
|
|
|
if [ "$MODE" = "optional" ]; then
|
|
SNIPPET='## gstack (recommended)
|
|
|
|
This project uses [gstack](https://github.com/garrytan/gstack) for AI-assisted workflows.
|
|
Install it for the best experience:
|
|
|
|
```bash
|
|
git clone --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack
|
|
cd ~/.claude/skills/gstack && ./setup --team
|
|
```
|
|
|
|
Skills like /qa, /ship, /review, /investigate, and /browse become available after install.
|
|
Use /browse for all web browsing. Use ~/.claude/skills/gstack/... for gstack file paths.'
|
|
else
|
|
SNIPPET='## gstack (REQUIRED — global install)
|
|
|
|
**Before doing ANY work, verify gstack is installed:**
|
|
|
|
```bash
|
|
test -d ~/.claude/skills/gstack/bin && echo "GSTACK_OK" || echo "GSTACK_MISSING"
|
|
```
|
|
|
|
If GSTACK_MISSING: STOP. Do not proceed. Tell the user:
|
|
|
|
> gstack is required for all AI-assisted work in this repo.
|
|
> Install it:
|
|
> ```bash
|
|
> git clone --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack
|
|
> cd ~/.claude/skills/gstack && ./setup --team
|
|
> ```
|
|
> Then restart your AI coding tool.
|
|
|
|
Do not skip skills, ignore gstack errors, or work around missing gstack.
|
|
|
|
Using gstack skills: After install, skills like /qa, /ship, /review, /investigate,
|
|
and /browse are available. Use /browse for all web browsing.
|
|
Use ~/.claude/skills/gstack/... for gstack file paths (the global path).'
|
|
fi
|
|
|
|
# Check if CLAUDE.md already has a gstack section
|
|
if [ -f "$CLAUDE_MD" ] && grep -q "## gstack" "$CLAUDE_MD" 2>/dev/null; then
|
|
echo "CLAUDE.md already has a gstack section. Skipping CLAUDE.md update."
|
|
echo " To replace it, remove the existing ## gstack section and re-run."
|
|
else
|
|
if [ -f "$CLAUDE_MD" ]; then
|
|
echo "" >> "$CLAUDE_MD"
|
|
fi
|
|
echo "$SNIPPET" >> "$CLAUDE_MD"
|
|
GENERATED+=("CLAUDE.md")
|
|
echo " + CLAUDE.md — added gstack $MODE section"
|
|
fi
|
|
|
|
# ── Required mode: enforcement hook ────────────────────────────
|
|
|
|
if [ "$MODE" = "required" ]; then
|
|
HOOKS_DIR="$REPO_ROOT/.claude/hooks"
|
|
SETTINGS="$REPO_ROOT/.claude/settings.json"
|
|
|
|
# Create enforcement hook script
|
|
mkdir -p "$HOOKS_DIR"
|
|
cat > "$HOOKS_DIR/check-gstack.sh" << 'HOOK_EOF'
|
|
#!/bin/bash
|
|
# Block skill usage when gstack is not installed globally.
|
|
|
|
if [ ! -d "$HOME/.claude/skills/gstack/bin" ]; then
|
|
cat >&2 <<'MSG'
|
|
BLOCKED: gstack is not installed globally.
|
|
|
|
gstack is required for AI-assisted work in this repo.
|
|
|
|
Install it:
|
|
git clone --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack
|
|
cd ~/.claude/skills/gstack && ./setup --team
|
|
|
|
Then restart your AI coding tool.
|
|
MSG
|
|
echo '{"permissionDecision":"deny","message":"gstack is required but not installed. See stderr for install instructions."}'
|
|
exit 0
|
|
fi
|
|
|
|
echo '{}'
|
|
HOOK_EOF
|
|
chmod +x "$HOOKS_DIR/check-gstack.sh"
|
|
GENERATED+=(".claude/hooks/check-gstack.sh")
|
|
echo " + .claude/hooks/check-gstack.sh — enforcement hook"
|
|
|
|
# Add hook to project-level settings.json
|
|
if command -v bun >/dev/null 2>&1; then
|
|
GSTACK_SETTINGS_PATH="$SETTINGS" bun -e "
|
|
const fs = require('fs');
|
|
const settingsPath = process.env.GSTACK_SETTINGS_PATH;
|
|
|
|
let settings = {};
|
|
try { settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8')); } catch {}
|
|
|
|
if (!settings.hooks) settings.hooks = {};
|
|
if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
|
|
|
|
// Dedup
|
|
const exists = settings.hooks.PreToolUse.some(entry =>
|
|
entry.matcher === 'Skill' &&
|
|
entry.hooks && entry.hooks.some(h => h.command && h.command.includes('check-gstack'))
|
|
);
|
|
|
|
if (!exists) {
|
|
settings.hooks.PreToolUse.push({
|
|
matcher: 'Skill',
|
|
hooks: [{
|
|
type: 'command',
|
|
command: '\"\$CLAUDE_PROJECT_DIR/.claude/hooks/check-gstack.sh\"'
|
|
}]
|
|
});
|
|
}
|
|
|
|
const tmp = settingsPath + '.tmp';
|
|
fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
|
|
fs.renameSync(tmp, settingsPath);
|
|
" 2>/dev/null
|
|
GENERATED+=(".claude/settings.json")
|
|
echo " + .claude/settings.json — PreToolUse hook registered"
|
|
else
|
|
echo " ! bun not found — manually add the PreToolUse hook to .claude/settings.json"
|
|
fi
|
|
fi
|
|
|
|
# ── Summary ────────────────────────────────────────────────────
|
|
|
|
echo ""
|
|
echo "Team mode ($MODE) initialized."
|
|
echo ""
|
|
if [ ${#GENERATED[@]} -gt 0 ]; then
|
|
echo "Commit the generated files:"
|
|
echo " git add ${GENERATED[*]}"
|
|
echo " git commit -m \"chore: require gstack for AI-assisted work\""
|
|
fi
|
|
echo ""
|
|
echo "Each developer then runs:"
|
|
echo " git clone --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack"
|
|
echo " cd ~/.claude/skills/gstack && ./setup --team"
|