gstack

mirror of https://github.com/garrytan/gstack.git synced 2026-05-06 21:46:40 +02:00

Files

T

Garry Tan 2137417f63 feat(security): canary leak check across all outbound channels

The sidebar-agent now scans every Claude stream event for the session's
canary token before relaying any data to the sidepanel. Channels covered
(per CEO review cross-model tension #2):

  * Assistant text blocks
  * Assistant text_delta streaming
  * tool_use arguments (recursively, via checkCanaryInStructure — catches
    URLs, commands, file paths nested at any depth)
  * tool_use content_block_start
  * tool_input_delta partial JSON
  * Final result payload

If the canary leaks on any channel, onCanaryLeaked() fires once per session:

  1. logAttempt() writes the event to ~/.gstack/security/attempts.jsonl
     with the canary's salted hash (never the payload content).
  2. sends a `security_event` to the sidepanel so it can render the approved
     canary-leak banner (variant A mockup — ceo-plan 2026-04-19).
  3. sends an `agent_error` for backward-compat with existing error surfaces.
  4. SIGTERM's the claude subprocess (SIGKILL after 2s if still alive).

The leaked content itself is never relayed to the sidepanel — the event is
dropped at the boundary. Canary detection is pure-string substring match,
so this all runs safely in the sidebar-agent (non-compiled bun) context.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-19 18:51:18 +08:00

bin

feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226 )

2026-03-19 18:20:50 -07:00

scripts

fix: ngrok Windows build + close CI error-swallowing gap (v0.18.0.1) (#1024 )

2026-04-16 13:49:04 -07:00

src

feat(security): canary leak check across all outbound channels

2026-04-19 18:51:18 +08:00

test

test(security): make sidebar-agent destructure check regex-tolerant