mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 22:14:25 +01:00
86091dd7f5
* fix(upgrade): accept a Git Bash checkout whose toplevel Git spells C:/… bin/gstack-upgrade compared `git rev-parse --show-toplevel` (C:/x from Git for Windows) with `pwd -P` (/c/x in Git Bash) as strings, so every Windows Git Bash install was refused as "not a gstack checkout", and the doctor's recovery line points at this command. Compare the two through gstack_path_same (bin/gstack-path-spelling.sh); a tree nested inside another repository is still refused. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(redact): a catalog field named <schema word>_key is not a credential (#3208) env.kv accepted every separated name ending in _key, so a catalog entry `"input_key": "expected_media_rate_bits_per_second_ingress"` failed pregate's never-downgradable secrets check as MEDIUM env.kv [secret]. The camelCase twins (cacheKey, sortKey, partitionKey, idempotencyKey) were already rejected for having no credential prefix; the snake/kebab/dotted forms of those data-model words now are too. ALL-CAPS env names (INPUT_KEY=) and credential-word names (signing_key, stripe_key, input_secret) still fire. Reported by @brentyates-swx. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(cso): build the git-hardening fixture repo once per file Each test built its fixture repo with five /usr/bin/git spawns inside its own 5 s budget. On macOS that binary is the Xcode shim, and on a cold runner those spawns cost far more than the code under test: in run 38800592772 the first test timed out at 5 s before readGitMetadata got past its first lstat, and afterEach then tore the fixture down under it. Build the repo once in beforeAll, under the same 30 s bound each fixture spawn already declares, and give every test a fresh copy. The assertions and the code under test are unchanged, and each test keeps its full 5 s for the code under test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(browse): rule 3 treats wizard steps as writes and reads back sets before saving (#3216) On a non-local target a wizard or dialog step (Next, Step N, a menu item that opens a dialog) now counts as mutating until its handler or network effect shows otherwise, and its Cancel proves nothing. Before any Save or Submit, every programmatic set is read back and the flow stops on a mismatch. The cookbook's silent-failures list adds the skip-path precondition probe. Redundant clauses in rules 2, 3, 7, 8, 9, 10 and READY are tightened so the shared setup grows by 3 bytes and every browsing skill stays under its parity cap. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(plan-design-review): keep the Completion Summary out of the regenerated report (#3219) The design review saved its Completion Summary inside the terminal GSTACK REVIEW REPORT section, which the next plan review deletes from its heading to the next "## " heading. The summary, deferred list and unresolved decisions now go in their own "## Design Review Completion Summary" section above the report, and the template says everything under the report heading is regenerated by the next review. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(redact): exempt a schema field only when its name and value both say so (#3208) Review (GPT-6.1 Sol outside voice): the name-only exemption also silenced real secrets, e.g. Azure's cosmosdb_primary_key and any longer name such as api_cache_key. Now the whole name must be one data-model word plus _key (primary/secondary dropped) and the value two or more lowercase identifier words; an entropic value, a longer name or a credential name still fires in .env, YAML, JSON and TOML. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(upgrade): the Git shim delegates with the unshimmed PATH A PATH-searching git wrapper found the shim again and recursed until the test timed out. The shim now restores the host PATH before running git. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(pregate): secrets scans each file with its type and never reads an emptied diff as clean (#3211) addedLines() flattened every file into one added.txt, so gstack-redact never saw a .ts path and the #3048 source-expression exemption never ran: TS properties such as `token: credentials.token,` failed the gate as MEDIUM env.kv. Two false negatives predate this wave: the `+++` header filter dropped added content lines that begin with "++", and `git diff` honoured diff.external/textconv, so an external driver that prints nothing made a branch carrying a real AWS key pass with "no added lines". Added lines are now parsed hunk-aware per file (the pre-push hook's rules), with --no-ext-diff --no-textconv, and each file is scanned as <tmp>/<i>/<basename> so its type survives; findings name the file. Reported by @brentyates-swx. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(plan-devex-review): keep the DX Scorecard out of the regenerated report (#3219) The DX Scorecard had the same placement gap as the design Completion Summary: with no rule, it could land inside GSTACK REVIEW REPORT, which the next plan review deletes. It now goes in its own "## DX Review Scorecard" section above the report. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.109.0 fix: wave 5 — pregate secrets false negatives (#3211), Windows gstack-upgrade, env.kv schema keys (#3208), browse rule 3 (#3216), review summaries (#3219) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> Co-authored-by: Scott Gigante <scott@gethubflow.ai> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>