gstack

mirror of https://github.com/garrytan/gstack.git synced 2026-05-05 05:05:08 +02:00

Files

T

Garry Tan 4b9fb4a3db fix(security): validateOutputPath symlink bypass — check file-level symlinks

validateOutputPath() previously only resolved symlinks on the parent directory.
A symlink at /tmp/evil.png → /etc/crontab passed the parent check (parent is
/tmp, which is safe) but the write followed the symlink outside safe dirs.

Add lstatSync() check: if the target file exists and is a symlink, resolve
through it and verify the real target is within SAFE_DIRECTORIES. ENOENT
(file doesn't exist yet) falls through to the existing parent-dir check.

Closes #921

Co-Authored-By: Yunsu <Hybirdss@users.noreply.github.com>

2026-04-13 09:32:38 -07:00

bin

feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226 )

2026-03-19 18:20:50 -07:00

scripts

fix: Windows support — Node.js server fallback for Playwright (#255 )

2026-03-20 12:22:11 -07:00

src

fix(security): validateOutputPath symlink bypass — check file-level symlinks

2026-04-13 09:32:38 -07:00

test

refactor: AI slop reduction with cross-model quality review (v0.16.3.0) (#941 )