mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 22:14:25 +01:00
Garry Tanandcapy-ai[bot]
4c6fa89cdc
* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a cwd bunfig.toml preload before the program starts. gstack runs inside the repo it audits, so a committed .env could steer state roots, the claude binary or spend caps, and a bunfig preload ran arbitrary code in every bin and hook. Every bun shebang, shell and skill caller, TypeScript spawn and compiled build now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(), --no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture regressions. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: name the directly executed scripts in the isolation ratchet Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: plan-mode render pattern accepts the isolation flags Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
47 lines
2.3 KiB
Bash
Executable File
47 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gstack-review-read — read review log and config for dashboard
|
|
# Usage: gstack-review-read
|
|
#
|
|
# Emits, in order: reviews JSONL with computed review_freshness, ---CONFIG--- (skip_eng_review),
|
|
# ---HEAD--- (short sha), ---WTREE--- (current working-tree fingerprint from
|
|
# bin/gstack-wtree, or "unknown"), ---TREE--- (HEAD tree, informational) and
|
|
# ---DIRTY--- (tracked-file dirty flag). Consumers grade diff-scoped review
|
|
# rows using review_freshness; legacy or uncaptured diff evidence cannot fall
|
|
# back to HEAD equality. Plan rows are unchanged.
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
case "$(uname -s)" in
|
|
MINGW*|MSYS*|CYGWIN*) command -v cygpath >/dev/null 2>&1 && SCRIPT_DIR="$(cygpath -m "$SCRIPT_DIR")" ;;
|
|
esac
|
|
eval "$("$SCRIPT_DIR/gstack-slug" 2>/dev/null)"
|
|
. "$(dirname "$0")/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: $(dirname "$0")/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
|
|
gstack_state_root_select
|
|
GSTACK_HOME="$_gstack_sr_root"
|
|
WTREE=$("$SCRIPT_DIR/gstack-wtree" 2>/dev/null || echo "unknown")
|
|
if [ -f "$GSTACK_HOME/projects/$SLUG/$BRANCH-reviews.jsonl" ]; then
|
|
GSTACK_REVIEW_LIB="$SCRIPT_DIR/../lib/review-evidence.ts" GSTACK_REVIEW_WTREE="$WTREE" bun --no-env-file --config=/dev/null -e '
|
|
const { reviewFreshness } = await import(process.env.GSTACK_REVIEW_LIB);
|
|
for (const line of (await Bun.stdin.text()).split("\n").filter(Boolean)) {
|
|
try {
|
|
const rec = JSON.parse(line);
|
|
delete rec.review_freshness;
|
|
const freshness = reviewFreshness(rec, process.env.GSTACK_REVIEW_WTREE);
|
|
if (freshness) rec.review_freshness = freshness;
|
|
console.log(JSON.stringify(rec));
|
|
} catch { console.error("gstack-review-read: skipping malformed review row"); }
|
|
}
|
|
' < "$GSTACK_HOME/projects/$SLUG/$BRANCH-reviews.jsonl"
|
|
else
|
|
echo "NO_REVIEWS"
|
|
fi
|
|
echo "---CONFIG---"
|
|
"$SCRIPT_DIR/gstack-config" get skip_eng_review 2>/dev/null || echo "false"
|
|
echo "---HEAD---"
|
|
git rev-parse --short HEAD 2>/dev/null || echo "unknown"
|
|
echo "---WTREE---"
|
|
echo "$WTREE"
|
|
echo "---TREE---"
|
|
git rev-parse 'HEAD^{tree}' 2>/dev/null || echo "unknown"
|
|
echo "---DIRTY---"
|
|
if [ -n "$(git status --porcelain -uno 2>/dev/null | head -1)" ]; then echo "true"; else echo "false"; fi
|