garrytan and capy-ai[bot]
660484ee99
security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml
...
Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a
cwd bunfig.toml preload before the program starts. gstack runs inside the repo
it audits, so a committed .env could steer state roots, the claude binary or
spend caps, and a bunfig preload ran arbitrary code in every bin and hook.
Every bun shebang, shell and skill caller, TypeScript spawn and compiled build
now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(),
--no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture
regressions.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
2026-10-19 20:48:49 +00:00
..
2026-10-08 16:17:18 +00:00
2026-06-09 22:29:23 -07:00
2026-10-04 07:58:41 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-07 23:29:05 +00:00
2026-09-21 12:27:25 -04:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-10 23:26:08 +00:00
2026-10-07 23:29:05 +00:00
2026-10-07 23:29:05 +00:00
2026-10-19 20:48:49 +00:00
2026-10-17 21:17:39 +00:00
2026-10-17 21:17:39 +00:00
2026-10-19 20:48:49 +00:00
2026-04-18 15:05:42 +08:00
2026-10-16 23:09:23 +00:00
2026-10-17 02:40:45 +00:00
2026-10-17 01:52:40 +00:00
2026-10-04 07:58:41 -07:00
2026-10-16 22:00:32 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-16 22:00:32 +00:00
2026-10-19 20:48:49 +00:00
2026-10-11 00:32:15 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-07 23:29:05 +00:00
2026-10-04 07:58:41 -07:00
2026-10-16 22:00:32 +00:00
2026-10-19 20:48:49 +00:00
2026-10-03 07:54:09 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-03 16:13:45 -07:00
2026-10-19 20:48:49 +00:00
2026-10-04 07:58:41 -07:00
2026-10-19 20:48:49 +00:00
2026-08-31 08:55:30 -07:00
2026-10-19 20:48:49 +00:00
2026-08-16 19:34:41 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 10:29:44 +00:00
2026-10-19 20:48:49 +00:00
2026-10-06 23:42:19 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-03-26 11:15:24 -06:00
2026-10-16 22:00:32 +00:00
2026-06-25 09:42:45 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-05-21 21:21:07 -07:00
2026-10-04 07:58:41 -07:00
2026-10-19 20:48:49 +00:00
2026-10-01 11:57:48 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-04-24 01:38:21 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-14 17:36:39 +00:00
2026-10-19 20:48:49 +00:00
2026-10-08 20:05:06 +00:00
2026-10-11 16:48:11 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-04 07:58:41 -07:00
2026-10-19 20:48:49 +00:00
2026-10-08 15:43:32 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-17 01:52:40 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-17 00:41:41 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-03-30 22:25:46 -06:00
2026-10-11 16:48:11 +00:00
2026-10-03 07:54:09 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-07 23:29:05 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-02 11:11:00 -07:00
2026-10-04 07:58:41 -07:00
2026-10-19 20:48:49 +00:00
2026-10-01 11:57:48 -07:00
2026-10-19 20:48:49 +00:00
2026-10-04 07:58:41 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-01 13:55:16 -07:00
2026-10-16 22:00:32 +00:00
2026-10-04 07:58:41 -07:00
2026-10-10 23:26:08 +00:00
2026-10-16 22:00:32 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-17 03:32:16 +00:00
2026-10-17 01:52:40 +00:00
2026-10-07 23:29:05 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-01 11:57:48 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-01 11:57:48 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-08 20:05:06 +00:00
2026-10-17 03:32:16 +00:00
2026-10-17 00:06:43 +00:00
2026-10-01 11:57:48 -07:00
2026-10-19 20:48:49 +00:00
2026-10-19 20:48:49 +00:00
2026-10-11 16:48:11 +00:00