mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-08 01:38:10 +01:00
Garry Tanandcapy-ai[bot]
e75a69c9e1
* fix: keep the gbrain database URL off argv; redact more credential formats (GST-1747) /setup-gbrain runs gstack-gbrain-source-wireup without --database-url; the helper reads ~/.gbrain/config.json once at startup and pins the URL. A new guard test keeps setup-gbrain docs from passing the URL on argv. lib/redact-patterns.ts adds HIGH patterns for OpenRouter keys, GitHub App ghu_/ghr_ tokens, Stripe live restricted keys, Supabase sb_secret_ and sbp_ tokens, and matches temporary ASIA AWS key IDs in aws.access_key. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore: name the changelog fragment after the branch (GST-1747) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes Clear GBRAIN_DATABASE_URL and DATABASE_URL for the setup-gbrain source wireup call so the helper pins the ~/.gbrain/config.json URL, as the --database-url flag did before. Guard test added; changelog fragment scoped to the wireup step. Review-Finding: p1/specialist-batched#1 reader=security Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: match full-length GitHub refresh tokens in the redaction gate github.refresh now accepts a body of 36 or more characters, so the 76-character refresh tokens GitHub issues match and are masked whole. Test samples use a 76-character body; the 35-character near-miss stays negative. Review-Finding: p3/adversarial-native#1 reader=adversarial-native Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
CHANGELOG fragments
A PR adds its CHANGELOG entry here as changelog.d/<branch-slug>.md: the entry text only, with no ## [x] heading, and bump: minor or bump: major front matter only when the change warrants more than a patch, and important: security|regression|data-loss|blocker only when it must reach stable within about a day (docs/releases.md#the-daily-check). It never edits VERSION, package.json's version or a released CHANGELOG section. The merge step (gstack-ship-queue land, or train land in a stamped train) assigns the version (under merge: direct, the release PR from gstack-release-stamp open does), folds every fragment into one CHANGELOG section and deletes the files. This README is skipped. See docs/ship-policy.md#changelog-fragments.