Garry Tan 4bc4bfedfd fix(bin): pass search params via env vars (RCE fix) (#819) ...

Replace shell string interpolation with process.env in gstack-learnings-search
to prevent arbitrary code execution via crafted learnings entries. Also fixes
the CROSS_PROJECT interpolation that the original PR missed.

Adds 3 regression tests verifying no shell interpolation remains in the bun -e block.

Co-authored-by: garagon <garagon@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-05 11:44:07 -07:00

..

fixtures

feat: OpenClaw integration v2 — prompt is the bridge (v0.15.9.0) (#816)

2026-04-05 02:23:59 -07:00

helpers

feat: Session Intelligence Layer — /checkpoint + /health + context recovery (v0.15.0.0) (#733)

2026-04-01 00:50:42 -06:00

analytics.test.ts

feat: safety hook skills + skill usage telemetry (v0.7.1) (#189)

2026-03-18 23:57:59 -05:00

audit-compliance.test.ts

fix: security audit round 2 (v0.13.4.0) (#640)

2026-03-29 22:46:33 -06:00

codex-e2e.test.ts

feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)

2026-03-23 23:05:22 -07:00

diff-scope.test.ts

feat: Review Army — parallel specialist reviewers for /review (v0.14.3.0) (#692)

2026-03-30 22:07:50 -06:00

gemini-e2e.test.ts

feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)

2026-03-23 23:05:22 -07:00

gen-skill-docs.test.ts

feat: declarative multi-host platform + OpenCode, Slate, Cursor, OpenClaw (v0.15.5.0) (#793)

2026-04-04 15:32:20 -07:00

global-discover.test.ts

fix: close redundant PRs + friendly error on all design commands (v0.15.8.1) (#817)

2026-04-05 02:02:06 -07:00

hook-scripts.test.ts

feat: safety hook skills + skill usage telemetry (v0.7.1) (#189)

2026-03-18 23:57:59 -05:00

host-config.test.ts

feat: native OpenClaw skills + ClaHub publishing (v0.15.10.0) (#832)

2026-04-05 10:07:03 -07:00

learnings-injection.test.ts

fix(bin): pass search params via env vars (RCE fix) (#819)

2026-04-05 11:44:07 -07:00

learnings.test.ts

feat: GStack Learns — per-project self-learning infrastructure (v0.13.4.0) (#622)

2026-03-29 17:02:01 -06:00

relink.test.ts

fix: top-level skill dirs so Claude discovers unprefixed names (#761)

2026-04-02 18:34:00 -07:00

review-log.test.ts

fix: community PRs + security hardening + E2E stability (v0.12.7.0) (#552)

2026-03-26 23:21:27 -06:00

skill-e2e-bws.test.ts

feat: recursive self-improvement — operational learning + full skill wiring (v0.13.8.0) (#647)

2026-03-31 23:08:22 -06:00

skill-e2e-cso.test.ts

feat: /cso v2 — infrastructure-first security audit (v0.11.6.0) (#384)

2026-03-23 06:57:22 -07:00

skill-e2e-deploy.test.ts

feat: /land-and-deploy first-run dry run + staging-first + trust ladder (v0.12.2.0) (#518)

2026-03-26 11:08:31 -07:00

skill-e2e-design.test.ts

feat: CI evals on Ubicloud — 12 parallel runners + Docker image (v0.11.10.0) (#360)

2026-03-23 10:17:33 -07:00

skill-e2e-learnings.test.ts

feat: recursive self-improvement — operational learning + full skill wiring (v0.13.8.0) (#647)

2026-03-31 23:08:22 -06:00

skill-e2e-plan.test.ts

test: E2E tests for plan review report and Codex offering (v0.11.15.0) (#449)

2026-03-24 07:30:24 -07:00

skill-e2e-qa-bugs.test.ts

feat: CI evals on Ubicloud — 12 parallel runners + Docker image (v0.11.10.0) (#360)

2026-03-23 10:17:33 -07:00

skill-e2e-qa-workflow.test.ts

feat: CI evals on Ubicloud — 12 parallel runners + Docker image (v0.11.10.0) (#360)

2026-03-23 10:17:33 -07:00

skill-e2e-review-army.test.ts

feat: Review Army — parallel specialist reviewers for /review (v0.14.3.0) (#692)

2026-03-30 22:07:50 -06:00

skill-e2e-review.test.ts

fix: community PRs + security hardening + E2E stability (v0.12.7.0) (#552)

2026-03-26 23:21:27 -06:00

skill-e2e-session-intelligence.test.ts

feat: Session Intelligence Layer — /checkpoint + /health + context recovery (v0.15.0.0) (#733)

2026-04-01 00:50:42 -06:00

skill-e2e-sidebar.test.ts

feat: declarative multi-host platform + OpenCode, Slate, Cursor, OpenClaw (v0.15.5.0) (#793)

2026-04-04 15:32:20 -07:00

skill-e2e-workflow.test.ts

feat: 2-tier E2E test system — granular touchfiles + gate/periodic split (v0.11.16.0) (#450)

2026-03-24 15:24:00 -07:00

skill-e2e.test.ts

feat: recursive self-improvement — operational learning + full skill wiring (v0.13.8.0) (#647)

2026-03-31 23:08:22 -06:00

skill-llm-eval.test.ts

feat: voice directive for all skills (v0.12.3.0) (#520)

2026-03-26 17:31:53 -06:00

skill-parser.test.ts

feat: SKILL.md template system, 3-tier testing, DX tools (v0.3.3) (#41)

2026-03-13 21:08:12 -07:00

skill-routing-e2e.test.ts

feat: composable skills — INVOKE_SKILL resolver + factoring infrastructure (v0.13.7.0) (#644)

2026-03-29 23:35:17 -06:00

skill-validation.test.ts

feat: native OpenClaw skills + ClaHub publishing (v0.15.10.0) (#832)

2026-04-05 10:07:03 -07:00

telemetry.test.ts

feat: community wave — 7 fixes, relink, sidebar Write, discoverability (v0.13.5.0) (#641)

2026-03-29 21:43:36 -06:00

timeline.test.ts

feat: Session Intelligence Layer — /checkpoint + /health + context recovery (v0.15.0.0) (#733)

2026-04-01 00:50:42 -06:00

touchfiles.test.ts

feat: recursive self-improvement — operational learning + full skill wiring (v0.13.8.0) (#647)

2026-03-31 23:08:22 -06:00

uninstall.test.ts

feat: community PRs — faster install, skill namespacing, uninstall, Codex fallback, Windows fix, Python patterns (v0.12.9.0) (#561)

2026-03-27 00:44:37 -06:00

worktree.test.ts

feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)

2026-03-23 23:05:22 -07:00