Garry Tan and capy-ai[bot]
4c6fa89cdc
v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) ( #3312 )
...
* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml
Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a
cwd bunfig.toml preload before the program starts. gstack runs inside the repo
it audits, so a committed .env could steer state roots, the claude binary or
spend caps, and a bunfig preload ran arbitrary code in every bin and hook.
Every bun shebang, shell and skill caller, TypeScript spawn and compiled build
now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(),
--no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture
regressions.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test: name the directly executed scripts in the isolation ratchet
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test: plan-mode render pattern accepts the isolation flags
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
2026-10-20 00:24:28 +00:00
..
2026-10-17 17:19:52 +00:00
2026-10-19 07:26:49 +00:00
2026-10-06 18:07:50 +00:00
2026-10-19 18:26:20 +00:00
2026-08-29 10:10:35 -07:00
2026-09-06 08:54:25 -07:00
2026-10-03 07:54:09 -07:00
2026-09-25 13:27:07 -04:00
2026-10-16 22:00:32 +00:00
2026-10-06 18:07:50 +00:00
2026-09-22 14:57:52 -04:00
2026-09-29 08:58:49 -07:00
2026-09-29 08:58:49 -07:00
2026-09-22 14:57:52 -04:00
2026-10-16 23:09:23 +00:00
2026-10-11 19:09:12 +00:00
2026-10-08 17:40:06 +00:00
2026-10-18 06:03:18 +00:00
2026-09-22 14:57:52 -04:00
2026-09-22 14:57:52 -04:00
2026-10-06 23:42:19 +00:00
2026-10-16 23:09:23 +00:00
2026-09-05 14:45:28 -07:00
2026-09-09 08:57:21 -07:00
2026-10-08 17:40:06 +00:00
2026-09-29 06:07:35 -07:00
2026-10-03 18:49:34 -07:00
2026-10-05 01:29:54 +00:00
2026-05-26 16:50:03 -07:00
2026-08-27 09:50:31 -07:00
2026-05-26 16:50:03 -07:00
2026-08-31 08:55:30 -07:00
2026-10-14 17:36:39 +00:00
2026-06-07 19:13:24 -07:00
2026-10-16 23:09:23 +00:00
2026-09-22 14:57:52 -04:00
2026-10-05 01:29:54 +00:00
2026-10-04 07:58:41 -07:00
2026-10-01 13:55:16 -07:00
2026-10-04 07:58:41 -07:00
2026-10-01 13:55:16 -07:00
2026-10-06 18:07:50 +00:00
2026-10-06 18:07:50 +00:00
2026-10-05 01:29:54 +00:00
2026-10-01 11:57:48 -07:00
2026-10-01 13:55:16 -07:00
2026-10-01 11:57:48 -07:00
2026-10-01 11:57:48 -07:00
2026-10-01 11:57:48 -07:00
2026-10-04 07:58:41 -07:00
2026-09-22 14:57:52 -04:00
2026-10-03 07:54:09 -07:00
2026-10-04 07:58:41 -07:00
2026-10-03 18:49:34 -07:00
2026-10-19 18:26:20 +00:00
2026-10-19 18:26:20 +00:00
2026-10-06 18:07:50 +00:00
2026-10-07 23:29:05 +00:00
2026-10-19 18:26:20 +00:00
2026-10-19 19:22:29 +00:00
2026-09-25 12:06:45 -04:00
2026-10-19 07:26:49 +00:00
2026-10-03 07:54:09 -07:00
2026-09-29 08:58:49 -07:00
2026-09-25 12:06:45 -04:00
2026-10-06 10:32:19 -07:00
2026-10-06 23:42:19 +00:00
2026-10-03 01:19:03 -07:00
2026-09-29 06:07:35 -07:00
2026-10-18 00:37:43 +00:00
2026-10-18 00:37:43 +00:00
2026-10-18 00:37:43 +00:00
2026-10-19 09:52:57 +00:00
2026-09-14 14:32:45 -07:00
2026-10-05 01:29:54 +00:00
2026-10-05 01:29:54 +00:00
2026-10-19 18:26:20 +00:00
2026-10-19 18:26:20 +00:00
2026-08-24 08:55:58 -07:00
2026-09-14 14:32:45 -07:00
2026-10-06 18:07:50 +00:00
2026-10-06 18:07:50 +00:00
2026-10-06 18:07:50 +00:00
2026-10-19 18:26:20 +00:00
2026-10-18 01:37:29 +00:00
2026-10-18 01:37:29 +00:00
2026-09-14 14:32:45 -07:00
2026-10-11 16:33:10 +00:00
2026-10-01 13:55:16 -07:00
2026-09-22 14:57:52 -04:00
2026-10-19 18:26:20 +00:00
2026-10-05 01:29:54 +00:00
2026-08-28 11:43:13 -07:00
2026-10-10 22:33:01 +00:00
2026-10-19 07:26:49 +00:00
2026-10-06 23:42:19 +00:00
2026-10-02 11:11:00 -07:00
2026-10-04 07:58:41 -07:00
2026-10-14 17:36:39 +00:00
2026-09-22 14:57:52 -04:00
2026-10-05 01:29:54 +00:00
2026-10-03 18:49:34 -07:00
2026-10-07 23:29:05 +00:00
2026-10-19 07:26:49 +00:00
2026-10-19 22:55:42 +00:00
2026-10-01 11:57:48 -07:00
2026-10-07 23:29:05 +00:00
2026-10-05 01:29:54 +00:00
2026-10-05 01:29:54 +00:00
2026-10-19 21:55:24 +00:00
2026-10-19 21:55:24 +00:00
2026-10-04 07:58:41 -07:00
2026-09-29 06:07:35 -07:00
2026-09-14 14:32:45 -07:00
2026-10-06 18:07:50 +00:00
2026-10-06 18:07:50 +00:00
2026-10-06 18:07:50 +00:00
2026-09-22 14:57:52 -04:00
2026-09-22 14:57:52 -04:00
2026-09-22 14:57:52 -04:00
2026-09-22 14:57:52 -04:00
2026-10-05 01:29:54 +00:00
2026-10-19 22:55:42 +00:00
2026-10-06 18:07:50 +00:00
2026-10-13 15:38:41 +00:00
2026-09-24 01:53:58 -04:00
2026-10-19 07:26:49 +00:00
2026-10-03 07:54:09 -07:00
2026-09-14 14:32:45 -07:00
2026-09-24 01:53:58 -04:00
2026-09-22 14:57:52 -04:00
2026-10-04 07:58:41 -07:00
2026-10-04 07:58:41 -07:00
2026-10-19 07:26:49 +00:00
2026-09-14 14:32:45 -07:00
2026-10-03 01:19:03 -07:00
2026-10-03 01:19:03 -07:00
2026-09-29 08:58:49 -07:00
2026-09-29 08:58:49 -07:00
2026-10-01 13:55:16 -07:00
2026-09-14 14:32:45 -07:00
2026-10-01 13:55:16 -07:00
2026-09-22 14:57:52 -04:00
2026-10-06 23:42:19 +00:00
2026-09-22 14:57:52 -04:00
2026-10-17 04:36:00 +00:00
2026-10-11 03:10:06 +00:00
2026-10-03 07:54:09 -07:00
2026-10-05 01:29:54 +00:00
2026-10-06 18:07:50 +00:00
2026-10-01 11:57:48 -07:00
2026-09-14 14:32:45 -07:00
2026-10-19 09:52:57 +00:00
2026-10-18 00:37:43 +00:00
2026-10-03 18:49:34 -07:00
2026-10-20 00:24:28 +00:00
2026-10-18 00:37:43 +00:00
2026-10-04 07:58:41 -07:00
2026-10-16 23:09:23 +00:00
2026-10-03 01:19:03 -07:00
2026-10-01 13:55:16 -07:00
2026-10-03 18:49:34 -07:00
2026-10-19 09:52:57 +00:00
2026-09-29 08:58:49 -07:00
2026-09-29 08:58:49 -07:00
2026-10-17 04:36:00 +00:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-10-03 18:49:34 -07:00
2026-10-07 23:29:05 +00:00
2026-09-29 08:58:49 -07:00
2026-04-24 01:38:21 -07:00
2026-09-29 06:07:35 -07:00
2026-10-19 18:26:20 +00:00
2026-09-23 08:54:53 -04:00
2026-10-19 18:26:20 +00:00
2026-09-22 14:57:52 -04:00
2026-09-22 14:57:52 -04:00
2026-10-01 13:55:16 -07:00
2026-10-19 07:26:49 +00:00
2026-09-29 06:07:35 -07:00
2026-10-04 07:58:41 -07:00
2026-09-24 01:53:58 -04:00
2026-10-19 07:26:49 +00:00
2026-10-19 07:26:49 +00:00
2026-10-06 23:42:19 +00:00
2026-10-17 03:32:16 +00:00
2026-10-19 10:29:44 +00:00
2026-09-29 06:07:35 -07:00
2026-10-03 01:19:03 -07:00
2026-10-03 01:19:03 -07:00
2026-10-03 01:19:03 -07:00
2026-08-14 09:28:56 -07:00
2026-10-19 22:55:42 +00:00
2026-09-22 14:57:52 -04:00
2026-09-22 14:57:52 -04:00
2026-10-17 03:32:16 +00:00
2026-10-05 01:29:54 +00:00
2026-09-22 14:57:52 -04:00
2026-09-22 14:57:52 -04:00
2026-10-01 13:55:16 -07:00
2026-10-01 13:55:16 -07:00
2026-10-01 13:55:16 -07:00
2026-10-03 01:19:03 -07:00
2026-10-19 07:26:49 +00:00
2026-09-06 08:54:25 -07:00
2026-09-29 08:58:49 -07:00
2026-10-20 00:24:28 +00:00
2026-08-15 22:20:30 -07:00
2026-10-03 07:54:09 -07:00
2026-10-19 07:26:49 +00:00
2026-10-03 01:19:03 -07:00
2026-10-06 18:07:50 +00:00
2026-10-11 00:32:15 +00:00