CalvinBackup/gstack

0 Fork 0

mirror of https://github.com/garrytan/gstack.git synced 2026-10-31 22:14:25 +01:00

Files

T

28f1385eac v1.91.32.0 fix: Codex works from zsh, free text never enters shell commands, honest failures (#3057 )

* fix: sourced helpers locate themselves under zsh (#3024)

Skill blocks source bin/gstack-codex-probe and bin/gstack-egress-lib.sh into
the host's shell. Under zsh (macOS default) BASH_SOURCE is empty, so Codex
model selection resolved /../scripts/... and every outside pass reported
CODEX_MODEL: invalid; the egress lib resolved to the caller's cwd. Resolve
the file once at source time (BASH_SOURCE under bash, %x under zsh), and
replace the bash-only ${!name} indirection in the auth probe. A free test
derives every sourced helper from the generated skills and sources each
under bash and zsh.

Co-authored-by: marcosdetry <marcosdetry@users.noreply.github.com>
Co-authored-by: akshaykalia <akshaykalia@users.noreply.github.com>
Co-authored-by: scottgigante-hubflow <scottgigante-hubflow@users.noreply.github.com>
Co-authored-by: woodsonl <woodsonl@users.noreply.github.com>
Co-authored-by: bezdekt <bezdekt@users.noreply.github.com>

* fix: reply and issue templates never pass untrusted text in double quotes (#3046)

greptile-triage's reply APIs posted -f body="<reply text>" while the
templates quote SHAs and diff code in backticks; in double quotes bash ran
each span (replies posted as 'Fixed in .', and diff or reviewer text ran as
a command). The pre-existing-failure issue template and /spec's issue title
had the same shape. All three now go through quoted heredocs. The
generated-bash lint gains untrusted-in-quotes and now also covers runtime
reference docs in skill directories (review/greptile-triage.md).

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix: a Codex usage limit is its own state, not 'inconclusive; proceeding' (#3051)

The model probe matched only model and broken-install errors, so a usage or
rate limit fell through to MODEL_PROBE_INCONCLUSIVE: Codex's own message
(with the reset time) was dropped, the hint pointed at model config, and
every later skill re-probed for 30 s. The probe now returns
MODEL_QUOTA_EXHAUSTED (exit 4) on a failed, non-timeout call that names a
usage limit, rate limit, insufficient_quota or 429, relays Codex's line
verbatim and caches it for 15 minutes. Preflights map it to
CODEX_MODE: quota_exhausted (missing coverage, no further Codex calls), and
classifyOutsideReview reports a mid-run limit as unavailable (quota) with
its own troubleshooting anchor.

Co-authored-by: venkatareddyg <venkatareddyg@users.noreply.github.com>

* test: record ship/review union sizes after the quota branch and issue template

* fix: Codex watchdog freezes the command before reaping its children

The bash-native watchdog (stock macOS, no timeout binary) ran pkill -P on
the command's children and then killed the command. Between the two, the
command continued past its killed child and printed output after its
deadline. Stop it first. The test's minimal PATH also lacked pkill, which
the watchdog uses to reap children (stock macOS ships it), so the orphaned
child held stdout open and the capture waited out its sleep.

* fix(autoplan): an oversize session journal is a hard too_large denial, not a retryable identity failure (#3050)

The guard capped journal reads at 32 MiB and reported a longer journal as
'identity', which the hook treats as deny-and-retry. A journal only grows,
so /autoplan could never enter Phase 1 in a long session, and the
troubleshooting row sent people chasing symlinks. Oversize journals now
report too_large as a hard cause that names the size and the supported
fallback (run the reviews by hand or start a new session).

Co-authored-by: venkatareddyg <venkatareddyg@users.noreply.github.com>

* fix(deps): clear the weekly OSV findings (#3040)

Raise overrides to fixed releases: ip-address 10.7.3 (our own pin was the
vulnerable 10.3.1; reachable through socks in browse's proxy path),
fast-uri 3.1.8, hono 4.13.13, proxy-addr 2.0.8, @modelcontextprotocol/sdk
1.31.0, sharp 0.35.5, and in lib/diagram-render dompurify 3.4.16 (bundled
by mermaid) and source-map-js 1.2.2; the render page is rebuilt. Three
advisories without a usable fix get justified, expiring ignores: braces
(build-time only, excalidraw -> sass -> chokidar; a test checks the page
carries no chokidar code), sprintf-js (roarr's constant-format logger) and
katex (needs pre-existing prototype pollution; fix outside mermaid's range).
osv-scanner with the repo config: no issues found.

* fix(autoplan): name a shell-built snapshot init as the cause of the missing-evidence denial (#3045)

The guard binds a phase entry only to a literal snapshot-init Bash call.
When the model resolved the tool path into a variable, chained or piped the
call, init ran and succeeded but the denial said 'Complete the existing
snapshot init step', which reads as already done, so the run gave up. When
no init binds but a Bash call looks like one, the denial now says the shape
cannot be bound and prints the literal re-run (answers reused:true). The
binding rule is unchanged, and the skill says to run init on its own.

Co-authored-by: CharlesBerg85 <CharlesBerg85@users.noreply.github.com>

* fix(browse): chain reads piped stdin synchronously, so Windows runs the flow (#3039)

On Windows, an awaited Bun.stdin.text() inside the CLI's un-awaited main()
let the process exit 0 before reading stdin: a replayed flow reported
success with nothing sent to the daemon. Read fd 0 synchronously (skipped
for a terminal); empty input now gets the server's usage error and a
non-zero exit.

Co-authored-by: VaibDeveloper <VaibDeveloper@users.noreply.github.com>

* fix(browse): clearer config-mismatch refusal and a WebGL note for the macOS GPU flags (#3030)

A plain call refused because another session started the daemon with
--headed/--proxy was told to 'apply --proxy/--headed', flags it never
passed. It now says who started the daemon and offers both remedies. The
BROWSER.md env table notes that the default macOS GPU flags disable WebGL
and that GSTACK_DISABLE_GPU=off restores it for WebGL QA.

Co-authored-by: Hagetino <Hagetino@users.noreply.github.com>

* fix(ship): skip Greptile triage when no PR exists yet (#3020)

/ship's first run on a branch dispatched a triage subagent only to learn
there was no PR. Step 10 now checks for a PR inline (gh's 'no pull requests
found') and records that Greptile runs on the PR once it exists; other gh
errors still dispatch so the child can report unavailable.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix(router): route only to loaded skills, and say when not to invoke (#3018)

The root router listed every skill and ended 'When in doubt, invoke the
skill'. Current Claude models follow that literally: they tried to invoke
skills a user had turned off in Claude Code's skillOverrides (which gstack's
own disabled_skills render cannot see), and borderline requests tipped into
full workflows. The router now routes only to skills in the session's
available-skills list and names when to answer directly; the CLAUDE.md
routing block skill-start offers says the same.

Co-authored-by: Rekin226 <Rekin226@users.noreply.github.com>

* fix: spawned sessions never auto-grant consent or publish off the machine (#3016)

Spawned sessions auto-choose the recommended option except for destructive
or irreversible choices. Main already withholds the artifacts-sync consent
prompt from spawned sessions; the remaining gap was any other prompt whose
recommended option grants a consent or syncs data off the machine. Every
spawned directive (skill-start's block, the escape sentence, the Conductor
deny reason and the AUQ-error fallback) now names that as irreversible. A
consent the user already gave interactively stays in force.

Co-authored-by: ekson73 <ekson73@users.noreply.github.com>

* test: fix the spawned-block slice and type the #3045 re-init events

* fix(redact): TypeScript types and JSX expressions are code, not env.kv secrets (#3048)

A credential-named parameter or prop with an unquoted code value
(`session: SessionState,`, `key={turn.requestId + turn.role}`,
`apiKey={settings.apiKey}`) cleared the entropy gate and blocked pushes as
a MEDIUM env.kv finding. One rule replaces the PR's two keyword heuristics:
a value that reads as a code name (no digits, word-like camelCase or dotted
parts) with a code terminator, or a brace expression of such names with no
quoted literal, is source syntax. Paired controls keep firing on quoted,
brace-wrapped, concatenated, YAML-bare and random-letter literals.

Co-authored-by: tianxchen <tianxchen@users.noreply.github.com>

* fix(setup): refuse to register a hook that does not parse (#3032)

Claude Code runs gstack's hook shims through /bin/sh; a shim that does not
parse exits 2, which for a PreToolUse hook blocks the tool call in every
session until someone finds the file. Before any hook registration is
healed or written, setup now runs bash -n on each registered shim and a Bun
parse of its TypeScript entry, and stops with the file, line and fix. A
lean rewrite of the PR's idea (one gate block plus a test that runs it).

Co-authored-by: BenjaminDSmithy <BenjaminDSmithy@users.noreply.github.com>

* fix(browse): Windows runtime roots start the server from the source checkout's bundle (#3026)

On Windows a host runtime root (~/.codex/skills/gstack and the other
env-var hosts) holds file copies of browse/dist and no node_modules, so
its server-node.mjs could not import playwright and every browser skill
died (the module-scope server.ts half was fixed in v1.91.19.0). setup now
records the source checkout in every runtime root's .source-path, and the
CLI runs that checkout's bundle when the adjacent one cannot reach
playwright. Verified by unit layout tests and the Windows CI lane, not
live on Windows.

Co-authored-by: ubay887 <ubay887@users.noreply.github.com>

* fix(copilot): on Windows, run bash blocks in Git for Windows Bash (#3047)

Copilot CLI on Windows ran gstack's extensionless helpers straight from
PowerShell, which opened an app picker, and bare bash can resolve to WSL.
The Copilot tool glossary (rendered into every Copilot skill) now says to
run each bash block in Git for Windows Bash by its full path and never to
translate a block into PowerShell. The PR's PowerShell repair skill and
README section are not taken.

Co-authored-by: nareshh74 <nareshh74@users.noreply.github.com>

* test: record ship's union size after the Greptile no-PR check

* fix: keep issue numbers out of model-read Copilot text; seed the new routing sentence in the autoplan fixture

* docs: Oct 6 fix-wave plan, reviewed through /autoplan

* fix(autoplan): every oversize-journal path reports too_large with a recovery that keeps the work

Review follow-up to the #3050 fix. The summed batch read and the narrowed
parent loop now report too_large with the real size instead of a plain
error naming a hard-coded 32 MiB. The denial names the size and the cap,
and gives the recovery that keeps work (/context-save, new session,
/context-restore, /autoplan) with a docs anchor. A test seam that can only
lower the cap replaces the 33 MiB fixture.

* test(autoplan): negative controls and more shapes for the shell-built init denial

* fix(redact): decide TS/JSX source syntax by file context, not by value shape

Review follow-up to the #3048 fix. The word-shape heuristic also exempted
real secrets made of words (API_KEY=VelvetRiverOrbitSunset; in a .env).
The scanner now takes the file path (ScanOptions.sourcePath): the pre-push
hook scans the pushed diff per file with its +++ b/ path, and gstack-redact
--from-file passes its path. Only in a TypeScript/JSX file is an unquoted
value after ':' or a JSX brace of names treated as source; the same line in
.env/YAML, or with no path, is scanned as a literal, and the jwt pattern
still fires in .ts files.

Co-authored-by: tianxchen <tianxchen@users.noreply.github.com>

* docs: gstack's own CLAUDE.md routing block matches the new router wording

Live check (Claude Code 2.1.284): a skill set to "off" in skillOverrides
is absent from the session's skill list while its sibling is listed, and
both are listed without the override, so 'route only to skills in your
available-skills list' holds.

* fix(sync-gbrain): don't offer a call-graph build for a source with no code pages (#3029)

Step 3.5 offered --dream for any source with pages, including one that
holds only markdown (synced with gbrain's default strategy), where a build
cannot help, and the injected CLAUDE.md guidance told future sessions to run
--dream for any count: 0. On gbrain >= 0.60, code-def for an impossible
symbol answers .status (probed live against gbrain 0.60.96: ready for a
code source, out_of_scope for a markdown-only one). Step 3.5 now probes the
pinned source first, reports the cause instead of asking on out_of_scope,
and keeps today's offer when the probe is unknown (older gbrain, an error).
gstack's own sync uses --strategy code, so the PR's soft-delete claim does
not apply to gstack's path.

Co-authored-by: syong <syong@users.noreply.github.com>

* fix(setup): register the hooks that parse, refuse the rest with file:line (#3032)

The landed gate stopped setup before any registration, so one unparseable
hook left every other hook unregistered. On the Claude install the canonical
root is the checkout Claude Code runs hooks from, so there is no staged swap
to abort: setup now registers the hooks that parse, refuses the ones that do
not with file and line, finishes the install and exits non-zero, saying it
is a gstack bug and that a skipped hook keeps running from the checkout.

bin/gstack-hook-check derives its list from setup's _hook_command_path calls
plus the autoplan phase-publication hook (a test keeps them equal), parses
each shim with its shebang's interpreter, and bundles each TypeScript entry
with its local imports (packages external) into a temp dir, so a broken or
missing import, or a missing entry, fails.

Co-authored-by: BenjaminDSmithy <BenjaminDSmithy@users.noreply.github.com>

* fix(auto-update): hold an update whose hooks do not parse, before the checkout moves

bin/gstack-session-update fast-forwards the live checkout before setup runs,
and Claude Code runs hooks straight from it, so setup's gate cannot protect
an auto-update. After the Bun floor check the updater extracts the incoming
revision with git archive and runs bin/gstack-hook-check on it; a failure
holds the update like bun-too-old, records hook-does-not-parse with file:line
in the update status, and the next session start says the current hooks keep
running. Fixture-remote tests cover a broken shim, a broken imported module
and a parseable control.

Co-authored-by: BenjaminDSmithy <BenjaminDSmithy@users.noreply.github.com>

* fix(browse): chain with no flow is a usage error before any daemon boots (#3039)

Empty piped input, a terminal with no arguments, and a readFileSync(0)
error (EAGAIN, EOF) now print the chain usage with the cause and its
troubleshooting link and exit 1 before ensureServer(), instead of sending
an empty argument to a daemon the CLI booted for it. Tests run the real CLI
with no daemon and no browser, plus the stub-daemon flow.

Co-authored-by: VaibDeveloper <VaibDeveloper@users.noreply.github.com>

* fix(browse): refuse a runtime-root CLI and checkout server from different builds (#3026)

A Windows runtime root runs the source checkout's Node server bundle through
.source-path. When the root's CLI and the checkout's bundle carry different
browse/dist/.version builds (the checkout was rebuilt without refreshing the
root), the CLI now refuses to start the server with both builds, the
./setup fix and its troubleshooting anchor. Unversioned dev builds are not
called skew.

Co-authored-by: ubay887 <ubay887@users.noreply.github.com>

* ci(windows): real isolated ./setup install, then a piped chain flow through the installed browse

windows-setup-e2e built the checkout but never ran ./setup. It now installs
the codex host into an isolated HOME (a runtime root copy with no
node_modules), then from an unrelated directory pipes a two-command chain
flow at a loopback page into the installed browse and asserts the page text,
and that empty piped input exits 1 with the usage error. Covers the
checkout-bundle path and the piped-stdin path end to end.

* test(lint): free text never enters a generated command (structural rule)

The generated-bash lint's untrusted-in-quotes rule (gh/glab/git/curl text
flags in double quotes only) becomes free-text-placeholder: any <placeholder>
anywhere in any command, in double, single or no quotes, and in heredoc
bodies (quoted or not), unless it is on the reviewed identifier allowlist
(test/helpers/placeholder-allowlist.ts) with the grammar a value must match.
Quoted-only identifiers (URLs, selectors, paths printed by gstack) must sit
inside quotes. Backslash-newline continuations now read as one command, so
a flag and its value on separate lines are still seen together.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix: reply, issue and spec text travel as agent-written files, never through a heredoc

Replaces the quoted-heredoc bodies with CEO-12's file mechanism: a bash
block creates a private mktemp file in the project's .gstack/tmp/ (kept out
of git through .git/info/exclude), the agent writes the text with its
file-write tool, and the next block posts with -F body=@file, --body-file
or "$(cat file)". A heredoc ends early at any body line equal to its
delimiter; a file has no such line. When the file was never written the
block refuses with the path and the command to send it by hand, and it
deletes the file after a successful post.

- review/greptile-triage.md: replies; the fetched JSON moves from fixed
  /tmp/greptile_*.json paths to a mktemp directory; REPO and PR are
  re-derived per block instead of read from a previous shell.
- Test-failure issues: title and body files, platform case on
  github/gitlab, assignee only when it is a valid login.
- /spec: one draft file feeds the audit hash, every redaction scan, the
  issue and the archive; the archive no longer expands <title>/<body>
  inside an unquoted heredoc; the decision-log JSON is built by jq from
  files.

Location verified against Claude Code 2.1.284 (Dockerfile.ci pin):
project-local .gstack/tmp is writable under acceptEdits with no prompt and
keeps mode 0600; $TMPDIR and the gstack state root prompt even under
acceptEdits.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix(ship): Greptile triage runs only when a PR exists; every other case says why

PR: unknown (gh missing, not logged in, a non-GitHub remote, or a failed
lookup) used to dispatch the triage child anyway. The Step 10 check now
tests gh, its login, the remote and the PR in that order, and every case
but 'PR: exists' skips the dispatch and records
'Greptile: not run (<reason>); runs on the PR once it exists'.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix: question-tuning commands carry no free text

The question log took the summary in single quotes and the preference write
took the user's own words; an apostrophe ended the quote and the rest ran as
shell. The summary is now a kebab-case slug (an identifier with a grammar),
and the optional free_text field is no longer passed from skills (the
binary still accepts it).

* fix(cso): Windows finds docker.exe only under known-folder roots and says transport is unsupported (#3028)

On Windows /cso looked for docker only in Git's directory and System32, so
Docker Desktop was never found and the gap read as 'not installed'. It now
resolves Program Files, Program Files (x86) and the Windows directory through
PowerShell's [Environment]::GetFolderPath (not the process environment),
checks each candidate's real path against those roots and rejects reparse
points. lib/cso/docker.ts admits only unix:/// endpoints, so a trusted
docker.exe reports 'native Windows Docker transport is not supported yet;
static assessment only'; one outside the roots is refused as outside the
trusted install locations, not overridable. Both carry an anchor. Native
named-pipe transport is not implemented.

* fix: sourced helpers share one self-locate block and fail loudly when they cannot locate themselves (#3024 rework)

The codex probe and the egress lib now carry one byte-identical block:
BASH_SOURCE under bash or %x under zsh, made absolute with $PWD, else a set
GSTACK_ROOT that holds the helper. Anything else (dash, sh, a shell that
cannot name the file) prints "gstack: cannot locate <helper> (shell: ...)"
with the docs/troubleshooting.md#sourced-helper-location URL and returns
before any bash- or zsh-only syntax. The Claude-only default path and the
$(pwd) fallback are gone.

The generated Codex preflight dot-sources the probe and, when it cannot load,
reports CODEX_MODE: helper_unavailable with the helper's own line instead of
falling through to not_authed. The class guard enumerates nested sources,
makes real resolver, auth, state-root and egress-home calls under bash and
zsh (absolute, relative then cd, bare name via PATH), covers dash and an
unknown shell, runs the full preflight, and lints BASH_SOURCE to the shared
block plus other bash-only constructs.

Co-authored-by: marcosdetry <marcosdetry@users.noreply.github.com>
Co-authored-by: akshaykalia <akshaykalia@users.noreply.github.com>
Co-authored-by: scottgigante-hubflow <scottgigante-hubflow@users.noreply.github.com>
Co-authored-by: woodsonl <woodsonl@users.noreply.github.com>
Co-authored-by: bezdekt <bezdekt@users.noreply.github.com>

* fix(cso): a Maven or Gradle repository is Java, not Python (#3028)

With no supported stack metadata, preparation defaulted to Python and asked
a Java repository for requirements.txt. A root pom.xml, build.gradle or
build.gradle.kts now names the stack as Java (unsupported for runtime
preparation, so the prerequisite says so), and Python helper scripts or a
root requirements.txt beside it no longer make it Python.

* fix(browse): BROWSER.md says plainly how to enable WebGL; the mismatch refusal links Daemon discipline (#3030)

The GSTACK_DISABLE_GPU row now states the effect and the switch: set
GSTACK_DISABLE_GPU=off to enable WebGL (off is the only recognized value).
The reworded config-mismatch refusal links BROWSER.md's Daemon discipline
section. Free tests pin both.

Co-authored-by: Hagetino <Hagetino@users.noreply.github.com>

* test(windows): name the B2, B4, B5 and B12 tests in the curated Windows lane

The runtime-root bundle tests lived in browse/test/config.test.ts and the
Copilot glossary test in test/host-config.test.ts, both excluded from the
Windows lane, so the two Windows-only fixes were never checked on Windows.
Move each into its own Windows-safe file (unchanged assertions) and list it,
the piped-stdin chain test and the /cso docker.exe discovery test as named
Windows coverage in scripts/lib/windows-curation.ts.

* fix: the free-text block exits loudly when mktemp fails; spec and redact tests follow the file mechanism

The redact resolver test, the #2679 mktemp guard test, the /spec invariant
and the spec secret-sink harness pinned the heredoc transport. They now pin
the agent-written file: the harness runs the draft-file block, writes the
draft the way the file-write tool would, then runs the real scan fence, with
every HIGH/MEDIUM/scanner-failure assertion unchanged.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* test: hostile payloads through the generated posting blocks, identifier grammars, every quoting shape

- The lint reads a whole command, so an unquoted multi-word placeholder is
  caught; negative controls cover double, single and no quotes, quoted and
  unquoted heredocs, continuation lines, and quoted-only identifiers used
  unquoted.
- Every allowlisted grammar rejects quote-breaking characters (and shell
  operators and whitespace when used unquoted); git accepts 'fix;id' and
  'fix`id`' as branch names, the ref grammar does not.
- Greptile replies, test-failure issues (GitHub and GitLab) and /spec filing
  and archive run from the real generated text with stub gh/glab: a body
  with backticks, $(...), an apostrophe and lines equal to EOF and the old
  heredoc delimiters arrives byte for byte, nothing in it runs, and the temp
  file is gone. An unwritten file is refused with its path and the manual
  command, and nothing is sent.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* test(ship): the PR check precedes the Greptile dispatch, and each skip names its reason

Runs Step 10's generated check against stub gh for gh missing, not logged
in, a non-GitHub remote, no PR, a failed lookup and an existing PR. Fails on
the previous text (which printed PR: unknown and dispatched).

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* feat(ship): ship-measure runner for the measure-then-fix loop (A6)

scripts/ship-measure.ts owns /ship's diagnostic measurement of a red eval
case: per-kind aggregation (rule trials; behavior panels of 3, each at its
own 2 of 3 plus 90% of trials; judge outputs scored by 3-sample panels,
standalone judge ids accepted), one artifact directory per baseline,
repair round and trial, a diagnostic label with verdict null that refuses
the eval history dir, an estimated admission budget that reserves every
concurrent trial and reconciles actual cost, the ask-once rule, the
repair-round limit, the unmeasured skip and the per-case PR table.

Free-suite flakes (CEO-1): 'free' reruns one shard's exact file list N
times, rerun 1 alone as the baseline and the rest in parallel at
max(1, floor(cores / shard concurrency)), each with its own HOME, state
root and flake ledger, GSTACK_FREE_RETRY_FLAKY=0, under a wall cap that
reports a partial count. test:ubicloud --diagnostic runs the same on one
VM with the retry off.

bin/gstack-config gains the DX-7 keys with their CEO-9 defaults and
rejecting validators. Free tests drive every kind, the budget stop, the
unmeasured skip and the free reruns with fake runners.

* fix: a Codex usage limit is quota_exhausted, a plain 429 is rate_limited, and only Codex's own error lines count (#3051 rework)

The probe's quota signature used to treat any rate limit, "too many
requests" or 429 as quota, and read the whole output, which echoes the
prompt. Now only Codex's trailing ERROR: / stream error lines are read.
A usage-limit or insufficient_quota line is MODEL_QUOTA_EXHAUSTED (exit 4,
cached 15 minutes; quota wins over a 429 that names insufficient_quota); a
plain 429 is MODEL_PROBE_RATE_LIMITED (exit 0, state rate_limited, never
cached), reported as CODEX_MODE: unverified (rate_limited) so the review
still runs and decides.

The quota HINT says how many minutes gstack skips Codex and how to retry
now (GSTACK_CODEX_PROBE_RETRY=1 skips the negative cache for that probe, or
delete <state root>/.codex-model-probe), with the full troubleshooting URL.
classifyOutsideReview reads the same trailing lines: a mid-review quota is
unavailable (quota_exhausted), a mid-review 429 unavailable (rate_limited).
New gate row rate_limited and docs anchor codex-rate-limited; the quota row
documents the retry. Tests cover each line shape, the echoed prompt, exit
0, timeout, retry recovery, probe/classifier parity, and two fresh-shell
preflight blocks where the second makes no paid Codex call.

Co-authored-by: venkatareddyg <venkatareddyg@users.noreply.github.com>

* ci: the eval image installs zsh, and the macOS lane sources the Codex probe from zsh

Dockerfile.ci adds zsh so the sourced-helper guard runs (and fails loudly
when zsh is missing) inside the eval container too. The macOS named
regressions job sources bin/gstack-codex-probe from zsh in an unrelated
directory and runs _gstack_codex_select_model exec (no paid call), then runs
the sourced-helper guard on the macOS runner. A free test pins both lanes and
runs the macOS step's script locally.

* test: deterministic regression for the Codex watchdog freezing the command before reaping its children

The existing stubborn-child test caught the reap-then-kill race only some of
the time (2 of 3 runs on the pre-fix watchdog). A pkill that sleeps after
reaping widens the window between reaping the children and killing the
command, so a watchdog that does not SIGSTOP the command first always lets
it print "late" after the deadline. Fails 3 of 3 on the pre-fix watchdog,
passes 3 of 3 on the current one.

* test: live codex smokes run codex in a private HOME and CODEX_HOME

codex-resume-flag-semantics and codex-e2e-sol-scope probe the codex CLI (the
latter at module load, in every free run), and every codex run writes
$CODEX_HOME/tmp/arg0, so with a real codex on PATH they wrote into the
developer's ~/.codex. Both now give codex a private HOME and CODEX_HOME and
remove it afterwards. A free test runs each file against a stub codex that
records HOME and CODEX_HOME and asserts neither is the caller's.

* feat(ship): a red eval runs classify, measure, fix, re-measure, gate once (A6)

Step 6 no longer stops at the first red paid eval: it reads the new lazily
loaded measure section and runs the loop for each red case, and Step 5
measures a failed free-suite shard (diagnostic reruns, retry off) before
the triage can call it pre-existing. The section states the diagnostic-
not-verdict rule, the per-kind table, the ask-once and named-red stops,
the unmeasured label and the honest-fix wording (observed k/n after fix
at <cause>). A free test pins the steps and their order in the generated
skill and checks every command and flag it names exists in the runner.

Ship's parity cap rises to 1.455 (measured 272,944 / 187,706 = 1.4541).

* docs(testing): diagnostic measurement is not a verdict; per-kind measure table (A6)

* test(ship): seeded-flake paid case for the measure loop (A6, periodic, behavior)

A fixture repo with no remote documents a single-case eval command and a
gate command, both free local stubs. queue-priorities claims trial slots
with atomic mkdir (reset per ship-measure round) and fails slots 2, 5 and
9 while src/priorities.js leaves its seed-shuffled list unsorted, printing
failure_cause and failure_detail that name the line. The paid case gives
/ship's generated Step 6 and measure section to a live session and asserts
it measured the case alone, fixed the named line without touching the
eval, re-measured at least 10 passing trials on the sorted file, and only
then ran the gate once; any question other than the spend question is a
contract violation.

A free test measures the fixture through the real ship-measure CLI: 7/10
unsorted, 7/10 after an unrelated edit with the gate still red (ENG-13's
negative control), 10/10 after the sort with the gate green.

* test(cso): the missing-scanner case points Docker at a dead socket

'an optional scanner prerequisite does not turn completed manual coverage
partial' assumed no usable Docker. On a machine with Docker and a pulled
gitleaks image the scan completed and the test failed (also on main). The
scan step now gets a DOCKER_HOST that cannot connect, which is the
prerequisite-missing condition the test describes.

* fix: Aside prompts travel as agent-written files, never inside the command

The open-ended reading recipe (browse, devex-review), scrape's fuzzy-intent
read and the shared web-research block put the model's question, query and
reply format inside a double-quoted _aside_exec argument, where backticks and
$(...) from page or repo text would run. The agent now writes the prompt into
a private .gstack/tmp file; the send block rebuilds the path from the printed
basename, refuses when the file is empty, and passes "$(cat "$PROMPT_FILE")".
The fixed read-only sentence stays in the shell source.

aside-driver pins move from the inline prompt to the file-based send block.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix: design briefs and approval feedback travel as agent-written files

Design briefs went into $D variants/generate/check as a double-quoted
argument, and approval feedback was spliced into a single-quoted echo of JSON,
so a quote, backtick or $(...) in either broke the command or ran. The agent
now writes each brief into a private .gstack/tmp file and the block passes
--brief "$(cat "$BRIEF_FILE")" (the CLI's --brief-file expects a JSON
brief, so plain text uses --brief). variants and the later check reuse the
same brief file. approved.json is built with jq -n from --arg values and
--rawfile feedback, so the feedback is data. The office-hours mockup flow
creates its brief and feedback files in one block.

design-approval-flow now writes the feedback file (with quotes, backticks and
$(...) in it) instead of substituting <FEEDBACK>, and checks the file is
removed after the save.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix: carve office-hours on every host to stay under the 160,000-byte ceiling

With its brief, feedback and research prompts moved into files, the inlined
office-hours render is 161,329 bytes on Codex and 160,302 on Factory, over
SKILL_BYTE_CEILING, so gen-skill-docs --host all fails. Per the C4 policy
(carve every skill whose external render exceeds the ceiling), office-hours
joins ship and plan-ceo-review in CARVED_ON_EVERY_HOST. The Claude render is
unchanged; external hosts read its sections relative to the installed skill.
external-host-carve and qa-lazy-sections now include office-hours in their
carved-skill lists.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* chore: regenerate after the free-text mktemp guard

* fix(codex): prompts and review focus travel as agent-written files

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

Challenge and consult prompts, and the /codex review focus text, are written
by the agent into private .gstack/tmp files and fed to Codex on stdin or read
back with cat; no heredoc carries them. Consult's new and resumed runs share
one block (and one parser) so no placeholder stands in for the parser; a
resumed run reads its session id from .context/codex-session-id and checks it.
Adds the A3 group 2 placeholder allowlist block.

* fix(benchmark-models): an inline prompt goes through a prompt file

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix(land-and-deploy): PR head repository and branch travel as data

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

The branch check reads headRepository/headRefName from gh's JSON into quoted
shell variables; ls-remote, the confirm-first delete and the local delete use
those variables instead of model-substituted names. The postfail test now pins
the variable form it replaces.

* fix(office-hours): the reviewer receipt must match the receipt grammar before the check runs

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix(setup-gbrain): cleanup-orphans collects the PAT with read_secret_to_env

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix(ship): PR body drafts and rejected test paths are agent-written files

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

The PR body is written into two private drafts (through ## Documentation, and
from ## Test plan on); the scan block splices Step 14.5's section between them
into the scanned temp file and deletes the drafts. Rejected test paths are read
from a written list, and paths outside the repository are skipped. Tests that
ran the old heredoc blocks now write the drafts and list first.

* fix(sync-gbrain): orchestrator flags must match an allowlisted grammar

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix: the gbrain page save and external-host placeholders pass the free-text rule

The gbrain save block passed the whole page through a quoted heredoc inside
--content; the agent now writes it to a mktemp file and gbrain put reads it
on stdin. The Claude Code outside-voice runtime root and session mode, and
the feature slug, join the allowlist with grammars; unused entries are
dropped, and a test keeps every allowlisted placeholder tied to a real use.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix: skill-specific Aside research queries travel as prompt files

investigate, office-hours, plan-ceo-review, review, plan-eng-review,
design-consultation Phase 2, the shared test bootstrap (B2) and QA's test
bootstrap each carried their own _aside_exec call with the model-filled query
inside a double-quoted argument. Skills that already carry the Web research
block now give only the prompt-file text and use that block to create, write
and send it; design-consultation, the shared bootstrap and QA create the file
and send it with the new {{ASIDE_RESEARCH_SEND}} resolver, which is the same
send block the research section uses (read-only sentence stays in the shell).

aside-driver's B2 pin and qa-browser-preservation's bootstrap contract move
from the inline call to the prompt file and the shared send resolver.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* fix: prose design commands pass briefs and feedback as data

The DESIGN_SETUP command list taught `iterate --feedback "..."`, and
design-consultation's late-change and plan-design-review's slop-regenerate
lines showed `--feedback "<feedback>"` / `"..."`; design-shotgun's retry
showed `generate --brief "<brief>"` and `evolve --brief "<brief>"`. Feedback
now reads "$(cat "$FEEDBACK_FILE")" from an agent-written mktemp file
(the setup note says how), and the shotgun retry reads the variant's own brief
out of briefs.json with jq instead of retyping it.

Co-authored-by: dgrant <dgrant@users.noreply.github.com>

* test: record parity sizes after the free-text file mechanism; refresh ship goldens

Measured union and skeleton sizes for ship, plan-eng-review,
plan-design-review, office-hours, design-consultation, review, qa, browse
and design-shotgun after every posting, prompt and brief site moved to
agent-written mktemp files; the ship goldens pick up the question-tuning
slug and the dropped free_text field.

* test: parity caps for the combined wave head (rounded up past the measured ratio)

* fix(plan-ceo-review): the mode handoff helper reminds the model to lead its chat with the line (#3038)

Periodic run 37272185151's auto-decide-preserved red replays as the Step 0E
handoff-line class: the model ran gstack-ceo-mode-handoff --auto, got the
exact line, then opened its chat with a heading and a paraphrase, so the
user never saw the auto-decide line (the terminal collapses tool output)
and the detector saw no outcome. The helper now prints a one-line reminder
on stderr beside the line; the detector accepts the line followed by that
reminder and nothing else. The ship Greptile check test reads its template
(test-of-test ratchet).

* test: every troubleshooting link in shipped code resolves, relative or full URL

* docs(todos): Oct 6 fix-wave follow-ups

* v1.91.32.0 release notes: Codex works from zsh, free text never enters shell commands, honest failures

* fix(plan-ceo-review): show the mode handoff line through a PostToolUse hook, not model compliance (#3038)

The stderr reminder beside the handoff line measured 1/10 on
auto-decide-preserved: the model still opened its chat with a paraphrase
('I've set review mode to HOLD SCOPE...'), so the user never saw the line and
the detector saw no outcome. /plan-ceo-review now declares a Claude-only
PostToolUse hook that shows the helper's exact line as a system message.
Diagnostic measurement on this head: 10/10, the line visible in every trial
while no trial's chat led with it. The reminder is reverted.

* fix: type the handoff hook's line filter

* fix: repairs from the integrated free suite

- The self-locate markers looked like heredocs to the pipe-deadlock guard;
  they are plain comment fences now.
- The spawned block keeps the canonical 'conservative non-destructive'
  phrase the cross-surface drift guard pins.
- The free-text block's mktemp refusal says 'mktemp failed', as every
  /codex temp file must.
- The batch transcript read reports sizes in MiB.
- docs/TESTING_INTERNALS.md gets a real 'Ship measure' heading for its
  anchor.
- The early-question harness admits /plan-ceo-review's handoff hook by its
  exact command (it only adds a system message); any other PostToolUse Bash
  hook is still refused.
- Paid file count and the unconsumed-file example follow the new seeded
  case; ship goldens refreshed.
- The CSO scanner test points Docker at a dead socket, so a machine with the
  pulled image does not scan.

* test(cso): a host with no Docker binary is also a no-scan host

The missing-image scan test failed on a Docker-less VM (docker is not
installed in a trusted directory). Every accepted message is a reason the
scan cannot run here; the not_assessed, helper-owned artifact assertions are
unchanged.

* ci: split the USERPROFILE assignment from export (SC2155)

* fix(browse): Windows runtime roots read .source-path as a native path (#3026)

The new windows-setup-e2e journey showed the installed browse could not
start its server. setup runs under Git Bash and wrote .source-path as an
MSYS path (/d/a/gstack); Node read it as \d\a\gstack on the current drive,
found nothing, and fell back to the root's own bundle, which cannot import
playwright. setup now writes cygpath -m, and the CLI maps an MSYS drive path
for installs written by an older setup. The journey prints the daemon and
startup logs when the chain fails.

* fix(ship-measure): defects from the parallel #3034 plan review

- A trial passes only with a JUnit testcase that executed and passed; a
  --case that selected nothing also exits 0.
- measure runs a no-cost --list preflight that must plan the case's own
  file before any paid trial.
- Diagnostic trials drop EVALS_CACHE_DIR/EVALS_CACHE_RUNTIME_ID, so they
  never reuse a stored judge pass or publish one the gate could reuse.
- Gate once: when CI runs the gate on push, the push is the gate run; the
  skill no longer also starts eval:bg:pr (a second paid gate).
- ubi-runner: down fails unless the VM is confirmed gone, and nothing
  sweeps other runners' VMs by default (UBI_GC_HOURS opt-in).

* test(windows): the seeded-flake fixture drives a POSIX shell stub, so it stays off the Windows lane

CreateProcess cannot exec the fixture's ./evals.sh shebang script (status
null on windows-free-shard 6). The measure runner is covered on Windows by
ship-measure.test.ts, which uses in-process fake runners.

* fix: the free-text block refuses an unset temp dir instead of writing at /

The rendered block ran mktemp "$_GT/..." with _GT unset in the portability
test; on Linux that fails at /, but Git Bash on Windows can write to its
install root, so the block went on (windows-free-shard 3). It now uses
${_GT:?}, so an unset directory always fails closed with the mktemp
message.

* test: pin the guarded ${_GT:?} temp-file form

* test: the Greptile check's gh stub uses a portable shebang

On Windows the absolute bash path has a space, so the stub never ran and
every case read 'gh not logged in' (windows-free-shard 1).

* test: the Greptile check runs with the native PATH and the gh stub first

The PATH-only stub bin could not run its stub on Windows (every case read
'gh not logged in'). Stub cases now keep the real PATH with the stub first;
only the no-gh case drops directories holding a real gh.

---------

Co-authored-by: marcosdetry <marcosdetry@users.noreply.github.com>
Co-authored-by: akshaykalia <akshaykalia@users.noreply.github.com>
Co-authored-by: scottgigante-hubflow <scottgigante-hubflow@users.noreply.github.com>
Co-authored-by: woodsonl <woodsonl@users.noreply.github.com>
Co-authored-by: bezdekt <bezdekt@users.noreply.github.com>
Co-authored-by: dgrant <dgrant@users.noreply.github.com>
Co-authored-by: venkatareddyg <venkatareddyg@users.noreply.github.com>
Co-authored-by: CharlesBerg85 <CharlesBerg85@users.noreply.github.com>
Co-authored-by: VaibDeveloper <VaibDeveloper@users.noreply.github.com>
Co-authored-by: Hagetino <Hagetino@users.noreply.github.com>
Co-authored-by: Rekin226 <Rekin226@users.noreply.github.com>
Co-authored-by: ekson73 <ekson73@users.noreply.github.com>
Co-authored-by: tianxchen <tianxchen@users.noreply.github.com>
Co-authored-by: BenjaminDSmithy <BenjaminDSmithy@users.noreply.github.com>
Co-authored-by: ubay887 <ubay887@users.noreply.github.com>
Co-authored-by: nareshh74 <nareshh74@users.noreply.github.com>
Co-authored-by: syong <syong@users.noreply.github.com>

2026-10-06 23:42:19 +00:00

39 KiB

Raw Blame History

Troubleshooting gstack messages

Find the message you saw, then follow its fix. Every check gstack runs ends in one of three states:

ran: the check executed. It may still have found problems.
not run: gstack chose not to run it (you turned it off, or nothing applied).
unavailable: gstack tried and could not run it. This is missing coverage, never a pass.

A message that is not ran has this shape:

<check>: not run (<reason>). Fix: <command>
<check> unavailable: <reason> (<detail>). No review ran; this is missing coverage, not a pass. Fix: <command>
<check>: ran, verdict unverified (<reason>). Fix: read the output above

Search this page for the words after unavailable: or not run (. Each section has a stable link anchor; the reason codes and anchors come from lib/gate-outcomes.ts, and a free test fails if a code has no section here.

Outside reviews (Codex and Claude Code)

Outside reviews send your diff, plan or question to a second AI provider. Their verdict comes from lib/outside-review-result.ts, which prints VERDICT: clean|findings|unverified|unavailable. A findings verdict with a P0 or P1 finding blocks exactly like a native P0/P1. unverified and unavailable are missing coverage: /ship and /review continue, show the gap in the readiness dashboard and the PR body, and never count it as a pass.

`gstack: cannot locate gstack-codex-probe (shell: ...)` / `CODEX_MODE: helper_unavailable`

Meaning. Skill blocks load gstack's shell helpers (gstack-codex-probe, gstack-egress-lib.sh) into the shell your agent runs. A helper finds its own directory from bash (BASH_SOURCE) or zsh (%x). In any other shell (dash, sh), or when the shell cannot say which file it is reading, the helper stops instead of guessing a path. The message names the shell it saw.

Fix. Run the skill from bash or zsh (the macOS and Linux defaults). If the shell cannot be changed, tell the helper where gstack is installed:

export GSTACK_ROOT=~/.claude/skills/gstack   # your install dir; it holds bin/

If the message says cannot load ..., the helper file is missing: re-run ./setup from your gstack checkout.

Expected result. zsh -c 'source ~/.claude/skills/gstack/bin/gstack-codex-probe && _gstack_codex_select_model exec' prints CODEX_MODEL: <model> (exec; source: ...), and preflights print a CODEX_MODE other than helper_unavailable.

`Codex outside review unavailable: Codex's sandbox could not start here (...)`

Meaning. Codex runs every command inside a Linux sandbox (bubblewrap). In many containers and devcontainers the kernel does not allow unprivileged user namespaces, so the sandbox cannot start and every command Codex tries fails. gstack reports this instead of trusting a review that read nothing. CODEX_MODE: sandbox_unavailable is the same condition found by the free preflight before any paid call.

What is kept. Nothing was sent for review, or the review was discarded. Your code and files are unchanged.

Fix. Enable unprivileged user namespaces for the container (for Docker, a seccomp profile that allows them), or, inside a container you trust, run Codex without its sandbox for this shell:

export GSTACK_CODEX_NO_SANDBOX=1

Expected result. With namespaces enabled, the next review prints OUTSIDE_STATUS: completed. With GSTACK_CODEX_NO_SANDBOX=1, every review prints WARNING: GSTACK_CODEX_NO_SANDBOX=1: ... because Codex can then read and write anything your user can. Only the exact value 1 works, and only from your shell environment.

`... outside review unavailable: the reviewer could not run commands or read the diff (...)`

Meaning. The reviewer tried to run commands but none succeeded, or its answer says it could not run commands or read the diff. A "no issues found" written after that is not a review.

What is kept. Nothing; the answer is shown above but not counted.

Fix. Read the reviewer's stderr above, repair what it names, and re-run.

Expected result. OUTSIDE_STATUS: completed with a VERDICT: line.

`... outside review unavailable: the reviewer process failed (exit N: ...)`

Meaning. The provider CLI exited non-zero. The first stderr line is in the parentheses.

What is kept. Partial output is shown above; it is not counted.

Fix. Repair the cause in the provider diagnosis (log in again, fix the model, check the network), then re-run.