gstack

mirror of https://github.com/garrytan/gstack.git synced 2026-06-17 15:20:11 +02:00

Files

T

Garry Tan 79f7a24eb4 fix(token-registry): UTF-8 byte-length short-circuit before timingSafeEqual

Constant-time compare on the root token now compares UTF-8 byte lengths
before crypto.timingSafeEqual, which throws on length-mismatched buffers.
A multibyte input whose JS string length matches but byte length differs
no longer crashes on the auth path; isRootToken returns false instead.

Tests cover the four interesting cases: multibyte byte-length mismatch,
extra-prefix length mismatch, same-length last-byte flip, and empty input
against a set root.

Contributed by @RagavRida (#1416).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-10 11:04:54 -07:00

bin

feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226 )

2026-03-19 18:20:50 -07:00

scripts

fix: ngrok Windows build + close CI error-swallowing gap (v0.18.0.1) (#1024 )

2026-04-16 13:49:04 -07:00

src

fix(token-registry): UTF-8 byte-length short-circuit before timingSafeEqual

2026-05-10 11:04:54 -07:00

test

fix(token-registry): UTF-8 byte-length short-circuit before timingSafeEqual