Garry Tan a8591f88c8 harden(sync): close staging-guard TOCTOU + fail hard on marker write (#1802 C5) ...

checkOwnedStagingDir() now returns the realpath-resolved canonicalPath on a
pass, and cleanupStagingDir() rmSync's that instead of the raw input — closing
the gap where the input is a symlink swapped between the ownership check and the
delete. makeStagingDir() tears down the partial dir and rethrows if the marker
write fails, so a marker-less dir (which the guard would refuse forever) can
never leak.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 07:21:58 -07:00

..

chrome-cdp

fix: security audit round 2 (v0.13.4.0) (#640)

2026-03-29 22:46:33 -06:00

dev-setup

v1.53.1.0 fix: non-interactive-safe plan-tune hook install (flags + smart defaults) (#1805)

2026-05-30 11:42:13 -07:00

dev-teardown

feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226)

2026-03-19 18:20:50 -07:00

gstack-analytics

feat: opt-in usage telemetry + community intelligence platform (v0.8.6) (#210)

2026-03-19 17:21:05 -07:00

gstack-artifacts-init

v1.40.0.0 fix wave: gbrain sync hardening (8 community PRs + migration) (#1547)

2026-05-17 08:26:36 -07:00

gstack-artifacts-url

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-brain-cache

v1.52.1.0 feat: brain-aware planning — 5 skills read structured gbrain context before asking (#1742)

2026-05-29 08:35:00 -07:00

gstack-brain-consumer

v1.17.0.0: setup-gbrain wireup ships the gbrain federation surface (#1234)

2026-04-28 01:17:54 -07:00

gstack-brain-context-load.ts

v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594)

2026-05-20 07:35:01 -07:00

gstack-brain-enqueue

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-brain-reader

feat(v1.9.0.0): gbrain-sync — cross-machine gstack memory (#1151)

2026-04-23 17:54:54 -07:00

gstack-brain-restore

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-brain-sync

v1.44.1.0 fix wave: post-windhoek paper-cut — 9 community PRs in one bundle (#1682)

2026-05-25 10:57:15 -07:00

gstack-brain-uninstall

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-builder-profile

feat: gstack v1 — simpler prompts + real LOC receipts (v1.0.0.0) (#1039)

2026-04-18 15:05:42 +08:00

gstack-codex-probe

codex + Apple Silicon hardening wave (v0.18.4.0) (#1056)

2026-04-18 12:30:54 +08:00

gstack-codex-session-import

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-community-dashboard

fix: Supabase telemetry security lockdown (v0.11.16.0) (#460)

2026-03-24 15:01:31 -07:00

gstack-config

v1.53.1.0 fix: non-interactive-safe plan-tune hook install (flags + smart defaults) (#1805)

2026-05-30 11:42:13 -07:00

gstack-developer-profile

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-diff-scope

v1.44.1.0 fix wave: post-windhoek paper-cut — 9 community PRs in one bundle (#1682)

2026-05-25 10:57:15 -07:00

gstack-distill-apply

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-distill-free-text

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-extension

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

gstack-gbrain-detect

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-gbrain-install

v1.55.0.0 fix wave: gbrain data-loss guards + browser crash-loop + 6 more (#1808)

2026-05-30 14:57:07 -07:00

gstack-gbrain-lib.sh

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-gbrain-mcp-verify

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-gbrain-repo-policy

v1.12.0.0 feat: /setup-gbrain — coding-agent onboarding for gbrain (#1183)

2026-04-24 01:38:21 -07:00

gstack-gbrain-source-wireup

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-gbrain-supabase-provision

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-gbrain-supabase-verify

v1.12.0.0 feat: /setup-gbrain — coding-agent onboarding for gbrain (#1183)

2026-04-24 01:38:21 -07:00

gstack-gbrain-sync.ts

fix(sync): fail-closed staging-dir ownership guard — prevent rm -rf of repo (#1802)

2026-06-03 07:18:19 -07:00

gstack-global-discover.ts

v1.41.1.0 fix wave: 7 HIGH bugs from external audit + regression tests (PR #1169 follow-up) (#1592)

2026-05-20 06:56:41 -07:00

gstack-ios-qa-daemon

v1.43.0.0 feat: iOS device-farm (5 skills, Mac daemon, Tailscale) (#1574)

2026-05-21 16:09:26 -07:00

gstack-ios-qa-mint

v1.43.0.0 feat: iOS device-farm (5 skills, Mac daemon, Tailscale) (#1574)

2026-05-21 16:09:26 -07:00

gstack-jsonl-merge

v1.55.0.0 fix wave: gbrain data-loss guards + browser crash-loop + 6 more (#1808)

2026-05-30 14:57:07 -07:00

gstack-learnings-log

v1.34.2.0 fix wave: /codex review on CLI 0.130+, /investigate learnings, /sync-gbrain on Supabase (3 community-reported bugs) (#1478)

2026-05-14 11:11:52 -04:00

gstack-learnings-search

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-memory-ingest.ts

harden(sync): close staging-guard TOCTOU + fail hard on marker write (#1802 C5)

2026-06-03 07:21:58 -07:00

gstack-model-benchmark

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-next-version

v1.44.1.0 fix wave: post-windhoek paper-cut — 9 community PRs in one bundle (#1682)

2026-05-25 10:57:15 -07:00

gstack-open-url

feat: community wave — 7 fixes, relink, sidebar Write, discoverability (v0.13.5.0) (#641)

2026-03-29 21:43:36 -06:00

gstack-patch-names

fix: ship idempotency + skill prefix name patching (v0.14.3.0) (#693)

2026-03-30 22:25:46 -06:00

gstack-paths

v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594)

2026-05-20 07:35:01 -07:00

gstack-platform-detect

feat: declarative multi-host platform + OpenCode, Slate, Cursor, OpenClaw (v0.15.5.0) (#793)

2026-04-04 15:32:20 -07:00

gstack-pr-title-rewrite.sh

v1.23.0.0 feat: always prefix PR titles with v<VERSION> (#1284)

2026-05-01 07:06:37 -07:00

gstack-question-log

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-question-preference

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-redact

v1.53.0.0 feat: smarter redaction — PII/secrets/legal guard across /spec, /ship, /cso, /document-* (#1797)

2026-05-30 08:54:46 -07:00

gstack-redact-prepush

v1.53.0.0 feat: smarter redaction — PII/secrets/legal guard across /spec, /ship, /cso, /document-* (#1797)

2026-05-30 08:54:46 -07:00

gstack-relink

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-repo-mode

feat: test coverage catalog — shared audit across plan/ship/review (v0.10.1.0) (#259)

2026-03-22 11:28:16 -07:00

gstack-review-log

feat(v1.9.0.0): gbrain-sync — cross-machine gstack memory (#1151)

2026-04-23 17:54:54 -07:00

gstack-review-read

fix: gstack-slug bash compatibility — source to eval (#354)

2026-03-22 21:02:01 -07:00

gstack-security-dashboard

feat(security): ML prompt injection defense for sidebar (v1.4.0.0) (#1089)

2026-04-20 22:18:37 +08:00

gstack-session-update

feat: team-friendly gstack install mode (v0.15.7.0) (#809)

2026-04-05 23:49:03 -07:00

gstack-settings-hook

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-slug

v1.55.1.0 fix: telemetry consent accuracy + gstack-slug cache sanitization (#1848)

2026-06-02 22:36:34 -07:00

gstack-specialist-stats

feat: adaptive gating + cross-review dedup for review army (v0.15.2.0) (#760)

2026-04-04 22:46:21 -07:00

gstack-taste-update

feat(v1.3.0.0): open agents learnings + cross-model benchmark skill (#1040)

2026-04-19 17:50:31 +08:00

gstack-team-init

fix: security wave 3 — 12 fixes, 7 contributors (v0.16.4.0) (#988)

2026-04-13 07:49:37 -10:00

gstack-telemetry-log

feat(security): ML prompt injection defense for sidebar (v1.4.0.0) (#1089)

2026-04-20 22:18:37 +08:00

gstack-telemetry-sync

v1.41.1.0 fix wave: 7 HIGH bugs from external audit + regression tests (PR #1169 follow-up) (#1592)

2026-05-20 06:56:41 -07:00

gstack-timeline-log

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-timeline-read

v1.44.1.0 fix wave: post-windhoek paper-cut — 9 community PRs in one bundle (#1682)

2026-05-25 10:57:15 -07:00

gstack-uninstall

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-update-check

v1.34.1.0 fix: gstack-update-check resists stale GitHub raw CDN + adds semver-order guard (#1475)

2026-05-13 13:37:31 -04:00

gstack-version-bump

v1.54.0.0 feat: carve /ship into skeleton + on-demand sections (-59% always-loaded) (#1806)

2026-05-30 12:09:10 -07:00