Garry TanandClaude Opus 4.7 6896f8b429 fix(browse): block direct IPv6 link-local navigation ...

URL validation centralises link-local (fe80::/10) into BLOCKED_IPV6_PREFIXES
alongside ULA (fc00::/7), so direct `http://[fe80::N]/` URLs are rejected
the same way `http://[fc00::]/` already was. Previously the link-local
guard only fired during DNS AAAA resolution, leaving direct-literal URLs
to slip through.

Prefix range covers fe80::-febf::: ['fe8','fe9','fea','feb'].

Regression test: validateNavigationUrl('http://[fe80::2]/') now throws
with /cloud metadata/i.

Contributed by @hiSandog (#1249).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-10 11:06:43 -07:00

..

activity.ts

feat: content security — 4-layer prompt injection defense for pair-agent (#815)

2026-04-06 14:41:06 -07:00

audit.ts

feat(browse): Puppeteer parity — load-html, screenshot --selector, viewport --scale, file:// (v1.1.0.0) (#1062)

2026-04-18 23:25:33 +08:00

browse-client.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

browser-manager.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

browser-skill-commands.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

browser-skill-write.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

browser-skills.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

buffers.ts

feat: Phase 3.5 — cookie import, QA testing, team retro (v0.3.1) (#29)

2026-03-13 00:31:41 -07:00

bun-polyfill.cjs

fix: Windows support — Node.js server fallback for Playwright (#255)

2026-03-20 12:22:11 -07:00

cdp-allowlist.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

cdp-bridge.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

cdp-commands.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

cdp-inspector.ts

refactor: AI slop reduction with cross-model quality review (v0.16.3.0) (#941)

2026-04-10 17:13:15 -10:00

claude-bin.ts

v1.24.0.0 feat: cross-platform hardening — curated Windows lane + Bun.which resolver + path-portability helper (#1252)

2026-05-01 07:21:28 -07:00

cli.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

commands.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

config.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

content-security.ts

security: tunnel dual-listener + SSRF + envelope + path wave (v1.6.0.0) (#1137)

2026-04-21 21:58:27 -07:00

cookie-import-browser.ts

security: tunnel dual-listener + SSRF + envelope + path wave (v1.6.0.0) (#1137)

2026-04-21 21:58:27 -07:00

cookie-picker-routes.ts

community wave: 6 PRs + hardening (v0.18.1.0) (#1028)

2026-04-17 00:45:13 -07:00

cookie-picker-ui.ts

fix: cookie picker auth token leak (v0.15.17.0) (#904)

2026-04-08 10:10:13 -07:00

domain-skill-commands.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

domain-skills.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

error-handling.ts

refactor: AI slop reduction with cross-model quality review (v0.16.3.0) (#941)

2026-04-10 17:13:15 -10:00

file-permissions.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

find-browse.ts

v1.24.0.0 feat: cross-platform hardening — curated Windows lane + Bun.which resolver + path-portability helper (#1252)

2026-05-01 07:21:28 -07:00

media-extract.ts

feat: browser data platform for AI agents (v0.16.0.0) (#907)

2026-04-08 00:41:55 -07:00

meta-commands.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

network-capture.ts

feat: browser data platform for AI agents (v0.16.0.0) (#907)

2026-04-08 00:41:55 -07:00

path-security.ts

fix: security wave 3 — 12 fixes, 7 contributors (v0.16.4.0) (#988)

2026-04-13 07:49:37 -10:00

platform.ts

fix: Windows support — Node.js server fallback for Playwright (#255)

2026-03-20 12:22:11 -07:00

project-slug.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

proxy-config.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

proxy-redact.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

pty-session-cookie.ts

feat: gstack browser sidebar = interactive Claude Code REPL with live tab awareness (v1.14.0.0) (#1216)

2026-04-25 22:52:15 -07:00

read-commands.ts

fix: security wave 3 — 12 fixes, 7 contributors (v0.16.4.0) (#988)

2026-04-13 07:49:37 -10:00

security-bunnative.ts

feat(security): ML prompt injection defense for sidebar (v1.4.0.0) (#1089)

2026-04-20 22:18:37 +08:00

security-classifier.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

security.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

server.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

sidebar-utils.ts

fix: sidebar agent uses real tab URL instead of stale Playwright URL (v0.12.6.0) (#544)

2026-03-26 22:07:03 -06:00

skill-token.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

snapshot.ts

security: tunnel dual-listener + SSRF + envelope + path wave (v1.6.0.0) (#1137)

2026-04-21 21:58:27 -07:00

socks-bridge.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

sse-session-cookie.ts

security: tunnel dual-listener + SSRF + envelope + path wave (v1.6.0.0) (#1137)

2026-04-21 21:58:27 -07:00

stealth.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

tab-session.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

telemetry.ts

v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233)

2026-04-28 20:08:04 -07:00

terminal-agent.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

token-registry.ts

fix(token-registry): UTF-8 byte-length short-circuit before timingSafeEqual

2026-05-10 11:04:54 -07:00

tunnel-denial-log.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

url-validation.ts

fix(browse): block direct IPv6 link-local navigation

2026-05-10 11:06:43 -07:00

welcome.html

feat: GStack Browser — double-click AI browser with anti-bot stealth (#695)

2026-04-04 10:17:05 -07:00

write-commands.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

xvfb.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00