mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-01 06:24:41 +01:00
Garry Tanandcapy-ai[bot]
4c6fa89cdc
* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a cwd bunfig.toml preload before the program starts. gstack runs inside the repo it audits, so a committed .env could steer state roots, the claude binary or spend caps, and a bunfig preload ran arbitrary code in every bin and hook. Every bun shebang, shell and skill caller, TypeScript spawn and compiled build now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(), --no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture regressions. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: name the directly executed scripts in the isolation ratchet Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: plan-mode render pattern accepts the isolation flags Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
46 lines
2.2 KiB
Bash
Executable File
46 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gstack-timeline-log — append a timeline event to the project timeline
|
|
# Usage: gstack-timeline-log '{"skill":"review","event":"started","branch":"main"}'
|
|
#
|
|
# Session timeline: local by default. If the user enables `artifacts_sync_mode`
|
|
# with the `full` (not `artifacts-only`) privacy tier — via the first-run
|
|
# stop-gate from `gstack-artifacts-init` or the preamble — timeline events are
|
|
# published to the user's private GBrain sync repo. See docs/gbrain-sync.md.
|
|
# Required fields: skill, event (started|completed).
|
|
# Optional: branch, outcome, duration_s, session, ts.
|
|
# Validation failure → skip silently (non-blocking).
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
eval "$("$SCRIPT_DIR/gstack-slug" 2>/dev/null)"
|
|
. "$(dirname "$0")/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: $(dirname "$0")/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
|
|
gstack_state_root_select
|
|
GSTACK_HOME="$_gstack_sr_root"
|
|
mkdir -p "$GSTACK_HOME/projects/$SLUG"
|
|
|
|
INPUT="$1"
|
|
|
|
# Validate: input must be parseable JSON with required fields
|
|
if ! printf '%s' "$INPUT" | bun --no-env-file --config=/dev/null -e "
|
|
const j = JSON.parse(await Bun.stdin.text());
|
|
if (!j.skill || !j.event) process.exit(1);
|
|
" 2>/dev/null; then
|
|
exit 0 # skip silently, non-blocking
|
|
fi
|
|
|
|
# Inject timestamp if not present
|
|
if ! printf '%s' "$INPUT" | bun --no-env-file --config=/dev/null -e "const j=JSON.parse(await Bun.stdin.text()); if(!j.ts) process.exit(1)" 2>/dev/null; then
|
|
INPUT=$(printf '%s' "$INPUT" | bun --no-env-file --config=/dev/null -e "
|
|
const j = JSON.parse(await Bun.stdin.text());
|
|
j.ts = new Date().toISOString();
|
|
console.log(JSON.stringify(j));
|
|
" 2>/dev/null) || true
|
|
fi
|
|
|
|
echo "$INPUT" >> "$GSTACK_HOME/projects/$SLUG/timeline.jsonl"
|
|
|
|
# gbrain-sync: enqueue for cross-machine sync (no-op if sync is off). Finish
|
|
# the enqueue before returning: gstack-skill-end drains right after this
|
|
# logger, and a backgrounded enqueue can let that drain miss the new event.
|
|
# The helper keeps its off/unattended gates and silent-failure behavior.
|
|
"$SCRIPT_DIR/gstack-brain-enqueue" "projects/$SLUG/timeline.jsonl" 2>/dev/null || true
|