3 people 87801b6da7 v1.94.31.0 fix(browse): Playwright 1.64.1 (Chromium 156) for the macOS sandbox-escape CVE; handoff honors GSTACK_CHROMIUM_PATH (#3947) ...

* test(browse): failing tests for #3907 (handoff ignores GSTACK_CHROMIUM_PATH; bundled Chromium predates CVE-2026-106378 fix)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(browse): handoff honors GSTACK_CHROMIUM_PATH (#3907)

handoff() always launched Playwright's bundled Chromium, so a GSTACK_CHROMIUM_PATH browser dropped back to the bundle at handoff. It now passes executablePath like launch() and launchHeaded(), skips the poisoned-bundle probe and XProtect heal for a custom path, and never loads the extension into a build that bakes it in.

Co-authored-by: merit-blake <265362871+merit-blake@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(deps): Playwright 1.64.1 (Chromium 156) for CVE-2026-106378 (#3907)

Playwright 1.62.1 bundled Chromium 151.0.7922.34, which lacks the macOS GPU-process TCC fix (Chromium 0c2f3e54b265, crbug.com/507596239). 1.64.1 bundles 156.0.8078.4, which has it. The playwright-core patch is regenerated from our 1.62.1 patch: the launch windowsHide and TcpPortRandomizationWin hunks carry over unchanged; the taskkill hunk is dropped because 1.64 passes windowsHide there upstream.

Co-authored-by: merit-blake <265362871+merit-blake@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* chore(pregate): map patches/** to the playwright-core patch test

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test(browse): name the 1.64.1 patch file in the TcpPortRandomizationWin check

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* docs(changelog): fragment for Playwright 1.64.1 and handoff GSTACK_CHROMIUM_PATH (#3907)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* docs(troubleshooting): GSTACK_CHROMIUM_PATH covers headed browse and handoff

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test(browse): the retired 1.62.1 patch stays deleted

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: merit-blake <265362871+merit-blake@users.noreply.github.com>

2026-11-03 18:34:14 +00:00

..

app

…

harness-pins

v1.94.20.0 test(review): one file per review and harness pin, so independent repins merge cleanly (GST-1084) (#3903)

2026-11-03 15:04:56 +00:00

lib

v1.94.17.0 ci-carry: guard carry, jobs-mapped lanes, aliases, per-file carry of runner-skipped files, path-skipped jobs (GST-1186, GST-1189, GST-1190) (#3929)

2026-11-03 14:14:50 +00:00

resolvers

v1.94.22.0 feat(skills): when-to-use descriptions, wider triggers and contract blocks for /investigate, /review, /qa, /verify (GST-1088 lane B) (#3909)

2026-11-03 15:21:29 +00:00

ubicloud

v1.92.53.0 fix(ubicloud): reap destroys only the caller's own VMs (GST-573) (#3756)

2026-11-02 03:11:57 +00:00

analytics.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

archetypes.ts

…

brain-cache-spec.ts

v1.91.8.0 test: smaller suite, derived paid selection, retired never-green evals (#2994)

2026-09-29 08:58:49 -07:00

build-app.sh

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

build-cso-windows.ps1

v1.91.19.0 fix: severe fix wave (truthful gates, no lost memory, every host finds gstack) (#3025)

2026-10-04 07:58:41 -07:00

build-cso.sh

v1.91.227.0 fix(windows): shell bins pass NUL as Bun's empty config when MSYS path conversion is off (#3415) (#3431)

2026-10-26 04:32:27 +00:00

build.sh

v1.91.65.0 fix(install): skills only for the agents you installed, every runtime-root file their skills read (#3080)

2026-10-08 16:17:18 +00:00

bump-harness-version.ts

v1.94.20.0 test(review): one file per review and harness pin, so independent repins merge cleanly (GST-1084) (#3903)

2026-11-03 15:04:56 +00:00

capture-baseline.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

census-arms.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

ci-tree-reuse.ts

v1.92.39.0 ci: main pushes reuse the merged PR's verified run of the same tree; dispatch-ci and --from-run go through the run verifier (GSTA-156 P3b) (#3709)

2026-11-01 20:30:10 +00:00

compare-pr-version.ts

v1.91.353.0 fix(ship): Step 12 keeps VERSION on --keep-current, adds bump never, and waits for the owner's answer before an unattended bump (GST-380) (#3666)

2026-10-31 06:07:36 +00:00

cso-attestation-evidence.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-eval-output-redaction.ts

v1.91.75.0 fix(cso-eval): fail producer receipts only on credential-class output, naming the rules (#3120)

2026-10-11 01:18:11 +00:00

cso-eval-producer.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-eval-protocol.ts

v1.91.124.0 feat(cso): helper run clock (remainingSeconds), /cso time discipline, content-free producer tool timeline (#3242)

2026-10-17 17:19:52 +00:00

cso-eval.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-image-matrix.ts

v1.91.378.0 fix(cso): pin scout-sbom-indexer source to 1.24.0, refuse floating source tags (GST-495) (#3699)

2026-10-31 18:12:53 +00:00

cso-native-evidence.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-public-ghcr.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-requalification.ts

v1.91.176.0 cso: ignore the compiled helpers' leading #! line in the release contract's preparationSha256 (both sides) (#3333)

2026-10-21 19:22:49 +00:00

cso-runtime-promotion.ts

v1.91.176.0 cso: ignore the compiled helpers' leading #! line in the release contract's preparationSha256 (both sides) (#3333)

2026-10-21 19:22:49 +00:00

cso-sbom-packages-check.jq

v1.91.27.0 fix(cso): runtime staging can finish and a qualified scanner catalog can ship (#3041)

2026-10-05 10:00:47 -07:00

cso-sbom-packages.jq

v1.91.27.0 fix(cso): runtime staging can finish and a qualified scanner catalog can ship (#3041)

2026-10-05 10:00:47 -07:00

cso-scanner-catalog.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-scanner-matrix.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-staging-run.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-verify-runtime-base.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

declared-annotation.ts

v1.91.11.0 refactor: one state-root rule, browse route table, shared shard engine, PTY harness split, MECE review resolvers (#3002)

2026-10-01 11:57:48 -07:00

detect-bump.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

dev-skill.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

discover-skills.ts

v1.87.6.0 fix: make checks reliable and everyday validation faster (#2898)

2026-09-22 14:57:52 -04:00

e2e-shard-reuse.ts

v1.91.149.0 feat(evals): Codex host for gate cases, sol weekly and Fable/Astra monthly census arms (GSTA-49 TM2) (#3292)

2026-10-19 18:26:20 +00:00

eval-bg.ts

v1.91.219.0 fix(eval-bg): local lanes export EVALS_RUN_ID so native-capture cases start (GSTA-70) (#3391)

2026-10-25 21:33:43 +00:00

eval-compare.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-flake-rank.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-input-cache.ts

v1.91.12.0 v1.91.12.0: audit fix wave, ~11-minute paid eval lanes, eval reliability policy (#2999)

2026-10-01 13:55:16 -07:00

eval-list.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-readiness.ts

v1.91.278.0 fix(ship-queue): readiness takes dispatched Free Tests, stamp paths accept tentative key versions, ready and train build read the base overlap, pr-wait --exclude, restamp prints the corrected order (#3514)

2026-10-27 15:11:13 +00:00

eval-select.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-summary.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-trial-series.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

exercised-map.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

external-skill-names.ts

v1.91.2.0 fix: consolidate gstack reliability wave (#2959)

2026-09-26 18:57:53 -04:00

free-test-durations-windows.json

v1.92.30.0 test(free): split files over the 60 s seed ceiling and the Windows doctor file, then reseed (GSTA-151 A) (#3585)

2026-11-01 14:23:49 +00:00

free-test-durations.json

v1.92.30.0 test(free): split files over the 60 s seed ceiling and the Windows doctor file, then reseed (GSTA-151 A) (#3585)

2026-11-01 14:23:49 +00:00

free-test-seed-allowlist.json

v1.91.147.0 test(seed): refresh the free-suite duration seeds (#3289)

2026-10-19 15:17:57 +00:00

garry-output-comparison.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gate-cost-replay.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gate-diff-calibrate.ts

feat: honest work and gate integrity — gate-edit detector, review/ship gate pass, zero-run green, claims-need-evidence kernel (#3114)

2026-10-10 22:33:01 +00:00

gate-reuse.ts

v1.91.163.0 feat(evals): the gate reruns failed cases once and reports a flaky green (GSTA-49 F1) (#3315)

2026-10-20 04:47:11 +00:00

gen-agents-digest.ts

v1.91.276.0 feat(preamble): tier 2+ skills load the shared preamble once per session (GSTA-96) (#3434)

2026-10-27 13:28:18 +00:00

gen-doctor-components.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gen-llms-txt.ts

v1.91.305.0 feat: render gstack per model with modules left out, measured before any model gets less (GSTA-140 PR 1a) (#3554)

2026-10-29 04:22:41 +00:00

gen-ship-goldens.ts

v1.91.77.0 feat(ship): two-stage gstack-pregate, gstack-regen generated-file registry, intent-based issue links (multi-agent wave C-pregate) (#3121)

2026-10-11 01:57:16 +00:00

gen-skill-docs.ts

v1.93.12.0 fix(loadouts): lite install keeps gbrain detection and disabled_skills; pin the evidence rule (GST-944) (#3874)

2026-11-02 18:05:23 +00:00

gstack-schema-pack.ts

v1.52.1.0 feat: brain-aware planning — 5 skills read structured gbrain context before asking (#1742)

2026-05-29 08:35:00 -07:00

harness-version.json

v1.94.20.0 test(review): one file per review and harness pin, so independent repins merge cleanly (GST-1084) (#3903)

2026-11-03 15:04:56 +00:00

host-config-export.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

host-config.ts

v1.91.317.0 feat(harness): trigger-first skill descriptions, hybrid OpenClaw layout, opt-in --context block (GSTA-135) (#3555)

2026-10-29 13:28:08 +00:00

jargon-list.json

…

judge-calibration-configs.ts

v1.91.232.0 test(judge-calibration): cookie-workflow corpus and comparison-1 result, recorded as held (GSTA-91) (#3416)

2026-10-26 06:55:30 +00:00

judge-calibration.ts

v1.92.2.0 evals: no-gstack arms for the model panel, arm-benchmark, safety and routing evals (#3708)

2026-10-31 22:41:36 +00:00

judge-controls.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

measure-journal-read.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

model-policy-freshness.ts

v1.91.45.0 feat: configurable model tiers and advisory freshness (#3073)

2026-10-08 08:00:08 +00:00

models.ts

v1.91.144.0 feat(evals): Opus 5.5 is the paid gate's model under test; judge stays Fable (GSTA-49 TM1) (#3275)

2026-10-19 07:26:49 +00:00

modules-cli.ts

v1.93.0.0 wave(browse): #3700 #3773 #3779 #3817 #3842 (#3858)

2026-11-02 14:49:46 +00:00

modules-install.ts

v1.93.12.0 fix(loadouts): lite install keeps gbrain detection and disabled_skills; pin the evidence rule (GST-944) (#3874)

2026-11-02 18:05:23 +00:00

modules-render.ts

v1.93.0.0 wave(browse): #3700 #3773 #3779 #3817 #3842 (#3858)

2026-11-02 14:49:46 +00:00

modules.ts

v1.93.0.0 wave(browse): #3700 #3773 #3779 #3817 #3842 (#3858)

2026-11-02 14:49:46 +00:00

one-way-doors.ts

v1.61.0.0 fix wave: guards failing open / silent failures (9 fixes, 4 community PRs absorbed) (#2472)

2026-08-08 09:28:45 -07:00

paid-test-durations.json

v1.92.15.0 feat: plan reviews check facts and keep one task list; /office-hours hands its wireframe to design review (#340, #513, #973, #1048, #1791) (#3775)

2026-11-01 06:11:17 +00:00

pr-dependencies.ts

v1.93.0.0 wave(browse): #3700 #3773 #3779 #3817 #3842 (#3858)

2026-11-02 14:49:46 +00:00

preflight-agent-sdk.ts

v1.93.10.0 wave(docs): #3590 #3591 #3819 #3618 #3824 #3828 (#3847)

2026-11-02 17:44:00 +00:00

preflight-codex-overlap.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

prompt-audit-manifest.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

psychographic-signals.ts

v1.93.6.0 feat: /plan-tune learns from ad-hoc question ids that carry a signal hint (#3442) (#3868)

2026-11-02 16:20:02 +00:00

qid-marker.ts

v1.93.6.0 feat: /plan-tune learns from ad-hoc question ids that carry a signal hint (#3442) (#3868)

2026-11-02 16:20:02 +00:00

question-registry.ts

v1.93.33.0 wave(review): #3705 #3744 #3745 #3764 #3765 #3795 (#3852)

2026-11-03 01:40:07 +00:00

recover-receipts.ts

v1.91.162.0 feat(evals): merge-train workflow side, inert behind the train policy block (GSTA-49 T1b) (#3279)

2026-10-20 02:13:39 +00:00

release-cut.ts

v1.91.292.0 Stable channel: a regression exception beside the security one, and the stale weekly wording (#3533)

2026-10-28 09:59:40 +00:00

replay-pr-selection.ts

v1.91.129.0 fix(pr-selection): scan shebang and .ts imports, fail closed on scan errors, report cost per run (#3257)

2026-10-18 01:22:15 +00:00

resolve-codex-generation-model.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

retired-command.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

review-dispatch-compare.ts

v1.94.30.0 review: risk-scaled review depth, today's panel by default (GSTA-258 build C) (#3920)

2026-11-03 18:22:59 +00:00

sandbox-doctor.sh

v1.75.0.0 feat: ponytail import wave — simplification review lens, arm benchmark, reuse ladder, instruction-tier digest (#2722)

2026-08-29 10:10:35 -07:00

setup-scc.sh

…

ship-measure-sweep.ts

v1.91.33.0 feat(ship): measurement bar with explained-red and pooled decisions, weekly flaky-test sweep on main (#3059)

2026-10-07 14:00:06 +00:00

ship-measure.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

size-ledger.ts

v1.91.286.0 feat(ship-queue): the ship size cap composes across a merge train; verify refuses a stale all-merged train (#3519) (#3522)

2026-10-28 00:27:22 +00:00

skill-bin-drift.ts

v1.91.287.0 feat(write-skill): write, change and diet skills; /learn at half its template size (#3524)

2026-10-28 02:58:29 +00:00

skill-check.ts

v1.91.276.0 feat(preamble): tier 2+ skills load the shared preamble once per session (GSTA-96) (#3434)

2026-10-27 13:28:18 +00:00

slop-diff.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

test-free-shards.ts

v1.93.14.0 ci: each free-suite job's timeout follows the plan's runner wall (#3850) (#3877)

2026-11-02 19:11:00 +00:00

test-health-report.ts

test:health and factory scorecard: leave reused main pushes out of free-suite flake counts (#3725) (#3822)

2026-11-02 05:24:30 +00:00

test-paid-shards.ts

v1.91.183.0 fix(evals): a rejected API key is INFRA, never 131 assertion reds and reruns (#3361)

2026-10-23 18:05:39 +00:00

test-pr-profile.ts

v1.94.10.0 ci: run Windows checks by path (ship-90-90 plan D, GST-1135) (#3904)

2026-11-03 08:43:28 +00:00

test-strict-output.ts

v1.91.11.0 refactor: one state-root rule, browse route table, shared shard engine, PTY harness split, MECE review resolvers (#3002)

2026-10-01 11:57:48 -07:00

train-backstop.ts

v1.91.339.0 ship-queue: stamped merge-train prefixes and train land (GSTA-154 PR B) (#3595)

2026-10-30 19:23:01 +00:00

train-gate.ts

v1.91.339.0 ship-queue: stamped merge-train prefixes and train land (GSTA-154 PR B) (#3595)

2026-10-30 19:23:01 +00:00

typecheck-test-baseline.json

v1.94.31.0 fix(browse): Playwright 1.64.1 (Chromium 156) for the macOS sandbox-escape CVE; handoff honors GSTACK_CHROMIUM_PATH (#3947)

2026-11-03 18:34:14 +00:00

typecheck-test.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

write-version-files.sh

v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594)

2026-05-20 07:35:01 -07:00