Garry TanandClaude Fable 5 e86dcd6a22 fix(version-bump): version-path and package-json-path pins cannot escape the repository ...

.gstack/version-path and .gstack/package-json-path are repo-controlled
content. A cloned repo pinning '../../victim.json' — or an in-repo symlink
pointing outside — turned a routine bump into an arbitrary file overwrite
outside the repository. assertRepoContained rejects absolute paths, lexical
.. escapes, and symlink escapes (deepest existing ancestor realpath'd, so a
not-yet-created VERSION file is checked through its parent). Lockfiles that
are symlinks resolving outside the repo are skipped with a warning instead
of written through.

Six containment tests including the not-over-broad control (subdirectory
pins keep working).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-16 13:27:27 -07:00

..

dev-setup

v1.57.9.0 feat: source-clean gbrain render (dev-setup --out-dir + machine-wide gbrain-refresh) (#1951)

2026-06-09 22:29:23 -07:00

dev-teardown

v1.57.9.0 feat: source-clean gbrain render (dev-setup --out-dir + machine-wide gbrain-refresh) (#1951)

2026-06-09 22:29:23 -07:00

gstack-analytics

feat: opt-in usage telemetry + community intelligence platform (v0.8.6) (#210)

2026-03-19 17:21:05 -07:00

gstack-artifacts-init

fix(artifacts): sync the decision store, which no allowlist glob matched

2026-08-16 08:45:13 -07:00

gstack-artifacts-url

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-brain-cache

fix: read project-scoped MCP registrations in gbrain detection (#2499)

2026-08-16 10:02:31 -07:00

gstack-brain-context-load.ts

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-brain-enqueue

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-brain-restore

v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541)

2026-08-14 09:28:56 -07:00

gstack-brain-sync

fix(brain-sync): detector pushes only when ALL unpushed commits are its own; lock released on every exit

2026-08-16 13:23:48 -07:00

gstack-brain-uninstall

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-builder-profile

feat: gstack v1 — simpler prompts + real LOC receipts (v1.0.0.0) (#1039)

2026-04-18 15:05:42 +08:00

gstack-code-intelligence

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-codex-probe

feat(codex): model round-trip probe — an unusable configured model fails fast with guidance (#2477)

2026-08-16 10:59:35 -07:00

gstack-codex-session-import

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

gstack-community-dashboard

v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541)

2026-08-14 09:28:56 -07:00

gstack-config

fix: whitelist engine-locked at all three gbrain-usable gates (#2456)

2026-08-16 10:01:44 -07:00

gstack-context-bill

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-decision-log

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-decision-search

v1.57.5.0 feat: cross-session decision memory + gbrain dream-stage call graph (#1910)

2026-06-08 06:20:58 -07:00

gstack-detach

v1.58.1.0 feat: hermetic local E2E + Conductor prose AskUserQuestion (#2004)

2026-06-14 11:40:57 -07:00

gstack-developer-profile

v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571)

2026-08-14 22:02:07 -07:00

gstack-diff-scope

fix: diff-scope glob coverage, honest exit contract, dirty-tree visibility (#2526, #2455, #2299)

2026-08-16 10:02:33 -07:00

gstack-distill-apply

v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)

2026-05-28 18:21:09 -07:00

gstack-distill-free-text

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-egress

v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541)

2026-08-14 09:28:56 -07:00

gstack-egress-lib.sh

v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541)

2026-08-14 09:28:56 -07:00

gstack-egress-receipt

v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541)

2026-08-14 09:28:56 -07:00

gstack-evidence

v1.66.1.0 feat: content binding — evidence ledger, wtree staleness, tracker trust envelope, fail-closed hooks (#2603)

2026-08-16 09:53:31 -07:00

gstack-extension

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

gstack-first-task-detect

v1.58.5.0 feat: first-run activation scaffold + gstack router front door (#2078)

2026-06-25 09:42:45 -07:00

gstack-gbrain-detect

fix: resolve GBRAIN_HOME with gbrain's parent-dir semantics (#2521)

2026-08-16 10:01:44 -07:00

gstack-gbrain-install

fix(gbrain-install): name the real fix when an npm-installed bun breaks the shim

2026-08-16 11:04:49 -07:00

gstack-gbrain-lib.sh

v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642)

2026-05-21 21:21:07 -07:00

gstack-gbrain-mcp-verify

v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541)

2026-08-14 09:28:56 -07:00

gstack-gbrain-repo-policy

v1.12.0.0 feat: /setup-gbrain — coding-agent onboarding for gbrain (#1183)

2026-04-24 01:38:21 -07:00

gstack-gbrain-source-wireup

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-gbrain-supabase-provision

v1.66.0.0 feat: test/evals/CI speedup — 90s truthful free suite, diff-billed evals, required Linux lane (#2593)

2026-08-15 22:20:30 -07:00

gstack-gbrain-supabase-verify

v1.12.0.0 feat: /setup-gbrain — coding-agent onboarding for gbrain (#1183)

2026-04-24 01:38:21 -07:00

gstack-gbrain-sync.ts

fix(sync-gbrain): dream pack-capability WARN anchors to the graph phase

2026-08-16 11:01:51 -07:00

gstack-global-discover.ts

v1.41.1.0 fix wave: 7 HIGH bugs from external audit + regression tests (PR #1169 follow-up) (#1592)

2026-05-20 06:56:41 -07:00

gstack-ios-qa-daemon

v1.43.0.0 feat: iOS device-farm (5 skills, Mac daemon, Tailscale) (#1574)

2026-05-21 16:09:26 -07:00

gstack-ios-qa-mint

v1.43.0.0 feat: iOS device-farm (5 skills, Mac daemon, Tailscale) (#1574)

2026-05-21 16:09:26 -07:00

gstack-ios-qa-regen

fix(ios-qa): generate app-owned bridge accessors deterministically

2026-07-14 16:35:30 -07:00

gstack-issue-guard

v1.66.1.0 feat: content binding — evidence ledger, wtree staleness, tracker trust envelope, fail-closed hooks (#2603)

2026-08-16 09:53:31 -07:00

gstack-jsonl-merge

v1.55.0.0 fix wave: gbrain data-loss guards + browser crash-loop + 6 more (#1808)

2026-05-30 14:57:07 -07:00

gstack-learnings-log

v1.58.4.0 fix: high-priority community bug wave + PTY plan-mode smoke gate (#2077)

2026-06-21 07:15:19 -07:00

gstack-learnings-search

v1.57.6.0 fix wave: 8 community bugs (4 security guards failing open) (#1911)

2026-06-08 06:39:38 -07:00

gstack-memory-ingest.ts

fix(memory-ingest): parse the current Codex response_item rollout shape

2026-08-16 09:07:27 -07:00

gstack-model-benchmark

v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571)

2026-08-14 22:02:07 -07:00

gstack-next-version

feat: git-based version allocator when the PR queue is unreachable (#2545)

2026-08-16 10:02:32 -07:00

gstack-patch-names

fix: ship idempotency + skill prefix name patching (v0.14.3.0) (#693)

2026-03-30 22:25:46 -06:00

gstack-paths

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-pr-title-rewrite.sh

v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571)

2026-08-14 22:02:07 -07:00

gstack-question-log

v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571)

2026-08-14 22:02:07 -07:00

gstack-question-preference

v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571)

2026-08-14 22:02:07 -07:00

gstack-redact

v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571)

2026-08-14 22:02:07 -07:00

gstack-redact-prepush

fix(redact-prepush): don't re-scan commits a catch-up merge brought in

2026-08-16 10:02:33 -07:00

gstack-relink

fix(setup): render the gbrain :user variant to an out-dir — global installs stay git-clean

2026-08-16 09:49:31 -07:00

gstack-repo-mode

fix(repo-mode): probe GNU stat before BSD so Git Bash stops crashing

2026-08-16 09:20:14 -07:00

gstack-review-log

v1.66.1.0 feat: content binding — evidence ledger, wtree staleness, tracker trust envelope, fail-closed hooks (#2603)

2026-08-16 09:53:31 -07:00

gstack-review-read

v1.66.1.0 feat: content binding — evidence ledger, wtree staleness, tracker trust envelope, fail-closed hooks (#2603)

2026-08-16 09:53:31 -07:00

gstack-security-dashboard

v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541)

2026-08-14 09:28:56 -07:00

gstack-session-kind

v1.57.2.0 feat: AskUserQuestion prose fallback when the tool fails at runtime (#1908)

2026-06-07 21:38:21 -07:00

gstack-session-update

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

gstack-settings-hook

fix(settings): include command in add-event dedup key (#2382)

2026-08-16 09:49:31 -07:00

gstack-slug

fix(slug): env-override runs never persist to the cwd cache; cache is GSTACK_HOME-aware

2026-08-16 12:25:08 -07:00

gstack-specialist-stats

feat: adaptive gating + cross-review dedup for review army (v0.15.2.0) (#760)

2026-04-04 22:46:21 -07:00

gstack-taste-update

feat(v1.3.0.0): open agents learnings + cross-model benchmark skill (#1040)

2026-04-19 17:50:31 +08:00

gstack-team-init

fix(preamble): probe AGENTS.md for skill routing; team-init resolves GSTACK_ROOT (#2500)

2026-08-16 10:59:33 -07:00

gstack-telemetry-log

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-telemetry-sync

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-timeline-log

v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351)

2026-05-06 19:37:53 -07:00

gstack-timeline-read

v1.44.1.0 fix wave: post-windhoek paper-cut — 9 community PRs in one bundle (#1682)

2026-05-25 10:57:15 -07:00

gstack-uninstall

feat(hooks): Stop hook closes dangling timeline entries — fail-open

2026-08-16 09:49:32 -07:00

gstack-update-check

v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571)

2026-08-14 22:02:07 -07:00

gstack-verify-gate

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

gstack-version-bump

fix(version-bump): version-path and package-json-path pins cannot escape the repository

2026-08-16 13:27:27 -07:00

gstack-wtree

v1.66.1.0 feat: content binding — evidence ledger, wtree staleness, tracker trust envelope, fail-closed hooks (#2603)

2026-08-16 09:53:31 -07:00