mirror of https://github.com/garrytan/gstack.git
2 Commits
| Author | SHA1 | Message | Date |
|---|---|---|---|
Garry Tan
|
1d41ee3ab3
|
v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541)
* test(helpers): shared skill-census helper with three explicit counts
physicalSkillFiles (symlinked dirs included, root router included),
authoredSkills (realpath-deduped, router excluded), registryEntries
(what ./setup registers: unique frontmatter names + _gstack-command).
One counting authority for the hermetic seeder, context-bill ground
truth, and the catalog-budget test — connect-chrome's dir symlink and
the root router otherwise produce three subtly different hand-rolled
censuses. Ported-wave foundation (C11).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(evals): stop the harness grading itself
findPreviousRun excluded only the file being written, by name, so every
suite compared against _partial-e2e.json — the current run's own
accumulator, relabelled with the current tier just before each flush.
That is why every block read '+$0.00, +0s, Stable run, no regressions.'
This harness has never been able to detect a regression, and reassuring
output that cannot fail is worse than none. In-progress runs are now
excluded by role, and a run with nothing to compare against says NO
BASELINE instead of claiming stability.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit f3140b5245221fff7fb9411c7ec07c2ca11587b5)
* refactor(evals): shared partial-run predicate + finalized-run lookup
isPartialEval(data, filename) is the one place that decides what counts
as an in-progress accumulator (the _partial flag OR a _partial-prefixed
filename), and findLatestFinalizedRun(evalDir, tier) is the one place
that finds the newest real run — scanning the eval dir plus one level of
shards/<slug>/ subdirs, where the sharded paid runner points each
shard's collector. skill-budget-regression.test.ts's hand-rolled
findLatestRun (flag-blind: a flagged-but-renamed accumulator passed its
name check) is replaced by the shared helper.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit b55fcf6966366fd21a8cdc46de61aab6e1b1d100)
* feat(evals): register shipped skills for hermetic PTY children
Hermetic children get a config dir that deliberately seeds no skills —
right for children that install their own, fatal for the PTY family that
TYPES /office-hours or /plan-ceo-review: claude rejects the command as
Unknown before any model turn, so the plan-family gate smokes measure
nothing. hermeticSkillsConfigDir() is a second, opt-in config dir under
the same runRoot that mirrors ./setup's registration exactly (real dir
per registry name, SKILL.md + sections/ symlinks, frontmatter-name
resolution, _gstack-command root alias), driven by the shared
skill-census so connect-chrome's dir symlink collapses the same way
setup's idempotent overwrite does.
Ported from fork commit 03c4eca2, tree walk rewritten for the upstream
layout (top-level <skill>/SKILL.md dirs, no skills/ tree). Unit tests
are new: seed shape, census parity, symlink resolution, connect-chrome
collapse, idempotence, no-API-key seed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 93dae6107b30ce453a07c2d342b60262bba6ce0b)
* feat(evals): seedSkills opt-in for PTY slash-command tests + tripwire
Wire ClaudePtyOptions.seedSkills through launchClaudePty: when set (and
hermetic, and no per-test CLAUDE_CONFIG_DIR override), the child gets
hermeticSkillsConfigDir() so typed /skill slash commands resolve instead
of dying as Unknown command before any model turn. Opted in at the three
runPlanSkill* helpers and the four direct-launch slash-command tests
(plan-design-with-ui, plan-ceo-mode-routing, autoplan-chain,
ship-idempotency).
New static tripwire (test/pty-skill-seeding-wiring.test.ts): any test
file that sends a slash command over the PTY must route through a
runPlanSkill* helper or pass seedSkills: true — an unseeded slash-command
test spends money and measures nothing. hermetic-wiring.test.ts now
blesses the repo-tree seeding path explicitly (config dir under runRoot,
symlinks into the repo checkout, never operator ~/.claude).
The CI "Register gstack skills for PTY smoke" step keeps a keep-me note:
container cross-mount symlinks defeat the TUI scanner and HOME is not
hermeticized, so the real-file copies there must survive this change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 63c52269daaffb833b3105ea9b4b99be6df8fec7)
* refactor(evals): single shared paid-test-set module
test/helpers/paid-test-set.ts is now the one definition of which test
files are paid (the exact globs package.json's test:gate expands).
scripts/test-free-shards.ts derives its free/paid exclusion from it
instead of a private regex list, dropping the dead
browse/test/security-review-fullstack.test.ts pattern (file no longer
exists). The sharded paid runner derives its enumeration from the same
module, so a file added to one list can no longer silently miss the
other.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit a7f36479a6a1f3656452370f5883371f3cb65623)
* feat(evals): env-driven lazy eval dir + shard-aware store and tooling
Importing eval-store no longer spawns the gstack-slug subprocess: the
module-level DEFAULT_EVAL_DIR constant is now a memoized defaultEvalDir()
resolved at collector construction. Resolution order: explicit
constructor arg, then GSTACK_EVAL_DIR, then slug detection — so the
sharded paid runner can point each shard child at its own
<evalDir>/shards/<slug>/ dir with plain env, no --preload.
Runs collected under a shards/ subdir record their slug in the eval
JSON (EvalResult.shard). findPreviousRun scans one shards/<slug>/ level
and prefers same-slug priors, so each shard baselines against its own
history instead of whichever shard flushed last. eval:list,
eval:summary, and eval:compare enumerate the same one level of shard
subdirs; eval:compare's no-arg mode also stops picking an in-progress
accumulator as the after-run.
eval-watch stays flat (documented follow-up): it tails a single dir for
live progress and gains nothing from per-shard baselines until the
runner emits a merged stream.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit e1f53f7d9c7fe6b65877d843f2e25bd2e2d12ffd)
* feat(evals): sharded paid tier runner
scripts/test-paid-shards.ts runs the gate/periodic tier one Bun process
per test file, with an EXTERNAL wall-clock timeout that SIGKILLs the
shard's detached process group and an aggregate that distinguishes
passed / failed / timed-out / never-started — partial execution can no
longer read as a pass. Bun's native --shard/--isolate covers none of
this: no process-group kill (hung claude/codex PTY grandchildren
survive in-process isolation), no never-started taxonomy, no per-shard
env. Each shard child gets GSTACK_EVAL_DIR=<evalDir>/shards/<slug>/
(slug = test filename sans extension, stable across runs) so shard
baselines compare against their own prior runs.
Output classification lives in scripts/test-strict-output.ts (strict
exit-code derivation, incremental fail-line classifier, child signal
forwarding) so the runner and any future strict bun-test wrapper share
one implementation. Enumeration derives from the shared paid-test-set
module; tier exclusion fires only on an explicit whole-file
EVALS_TIER === '<other>' guard.
package.json gains test:gate:sharded / test:periodic:sharded, and
eval:bg:gate / eval:bg:periodic now run the sharded scripts with detach
timeouts sized to the worst case (gate: 49 shards x 30min / 4 jobs ~
6.2h -> 25200s; periodic: 59 -> 28800s).
test/paid-shards.test.ts pins enumeration, tier classification, and the
kill-and-continue property with a real busy-loop shard.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 5e76bd5931836257f896cedfe4e93912cb759c70)
* feat(security): hash-chained egress receipt ledger (core)
Port lib/egress-receipt from the v2 fork as TypeScript: writeReceipt
(sync, fail-closed via typed EGRESS_RECEIPT_FAILED), best-effort
writeOutcome, readLedger/listReceipts/verifyLedger, GSTACK_HOME ->
GSTACK_STATE_DIR -> ~/.gstack resolution, 0600 ledger under a 0700
security dir, and an mkdir spin lock (2.5s budget) with documented
>10s-mtime stale-lock reclaim.
Changes vs the fork:
- lastRawLine tail-reads the final 4KB instead of loading the whole
ledger, so appends stay O(1) as the file grows.
- WARN-at-size: past 25MB writeReceipt emits one self-explanatory
stderr warning per process (what the ledger is, how to inspect it,
rotation TODO); verifyLedger gains a sizeWarning field. Rotation
TODO carries the chain-genesis sketch (new generation's first record
embeds the prior file's tail hash).
bin/gstack-egress-receipt is a bun script bridging shell callers:
write|outcome subcommands, exit 3 + EGRESS_RECEIPT_FAILED on stderr on
failure; --no-payload records sha256:null for git-class ops.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 619726a3d77d987a2e50151a5727b3faaaf5fc6a)
* chore(bin): delete dead brain-consumer/reader scripts
bin/gstack-brain-consumer and bin/gstack-brain-reader are byte-identical
dead scripts that POST the repo URL + a Bearer token to a /ingest-repo
endpoint gbrain removed (docs/gbrain-sync.md already documents the
removal in past tense). No live references remain; CHANGELOG mentions
are historical.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 254ddc69fc5a0270fcc973e36b6a81766d835d2d)
* feat(security): shared shell receipt helpers
bin/gstack-egress-lib.sh (sourced library, gstack-gbrain-lib.sh
precedent) provides _receipted_curl and _receipted_git: write the
egress receipt BEFORE the send via gstack-egress-receipt, hand curl the
SAME payload file via --data-binary @file so the receipt hash matches
the wire bytes exactly, then append a best-effort outcome. Per-call
fail policy: 'closed' refuses the send (return 3, problem/cause/fix
message on stderr) and 'open' warns and proceeds. Payload temp files
are consumed immediately per call — no EXIT traps, since callers like
gstack-telemetry-sync own their own EXIT trap and a sourced trap would
clobber it.
Tested end-to-end against a local Bun.serve listener: receipt sha256
equals the sha256 of the bytes the listener received, fail-closed
refusal never touches the network and carries the problem/cause/fix
stderr shape, fail-open warns and proceeds.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 6d067dce2d4c8815dec98be551763c85a3671357)
* feat(security): receipt core shell sinks
Wire the three core bash egress sinks through gstack-egress-lib.sh:
- gstack-telemetry-sync: the batch POST now writes the payload to a
temp file, receipts those exact bytes fail-closed, and hands curl the
SAME file. On refusal nothing is sent and the cursor does not
advance, so the batch stays buffered for the next run. The HTTP
status is recorded as the receipt outcome.
- gstack-update-check: fail-open receipts (warn + proceed) on the
Supabase ping POST, both VERSION curls (via a local
_receipted_version_fetch helper that skips non-network schemes), and
git ls-remote. The ping receipt is written inside the backgrounded
subshell, so it can never block the script's exit.
- gstack-brain-sync: fail-closed git-class receipts. The push receipt
is written BEFORE the commit consumes the queue, so a refused receipt
leaves the queue intact and the next run retries the whole drain
(pinned by a new queue-intact-on-refusal test, including the
problem/cause/fix refusal message shape). The retry-path fetch and
retry push carry their own fail-closed receipts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 3c60f699acceaf1c92a218874711e05fc17dca5d)
* feat(security): receipt TS module sinks + tunnel
writeReceipt (fail-closed, sha256:null — a subprocess or SDK owns the
wire bytes) before every TS-module network-bearing operation:
- bin/gstack-gbrain-sync.ts: before the gbrain code walk that ships
repo content to the user's gbrain DB (may be remote Postgres). A
refused receipt fails the stage with status refused-egress-receipt.
- bin/gstack-memory-ingest.ts: before the gbrain batch import of
transcript pages. A refused receipt returns a system_error verdict
without spawning the import.
- browse/src/server.ts: before both ngrok.forward call sites (start-up
BROWSE_TUNNEL=1 path and the /tunnel/start endpoint). A receipt
failure lands in the existing catch that tears the tunnel listener
back down and refuses the start.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 5677d618a48fcd0ae2b068bf868781d90f809cb5)
* feat(design): receipted fetch for OpenAI calls
design/src/receipted-fetch.ts wraps every api.openai.com call: a
content-free egress receipt (sink design-openai, sha256 of the JSON
body — hash only, never the body) is written BEFORE the send. Polarity
is FAIL-OPEN: user-facing generation must not die because an audit log
hiccuped, so a receipt failure warns on stderr and the call proceeds.
Streams pass through untouched (response bodies returned as-is;
non-string request bodies receipted as sha256:null rather than drained
to hash).
All ten call sites converted with per-command payload classes:
generate, variants (injected fetchFn passes through), iterate (both
threaded and fresh paths), evolve (image + screenshot analysis), check,
diff, design-to-code, memory.
Unit-tested with injected fetch: receipt-before-send ordering, stream
passthrough, and fail-open on an unwritable ledger.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit c0e5ff6639414ac2fd98e8ac3affb51401746b55)
* feat(security): receipt admin scripts + user git-ops (zero exceptions)
Wire the remaining shell egress through gstack-egress-lib.sh:
- gstack-gbrain-mcp-verify: both JSON-RPC probe POSTs (initialize +
tools/list) receipted fail-closed via payload files (hash == wire
bytes). A refused receipt lands in the NETWORK class — no send.
- gstack-security-dashboard / gstack-community-dashboard: the
community-pulse GETs receipted fail-open (read-only stats must not
break over an audit hiccup).
- gstack-gbrain-supabase-provision: api_call receipted fail-closed.
Each retry attempt hands the helper a fresh copy of the body file
(the helper consumes its payload). The receipt hashes the request
body only — the PAT never reaches the ledger or any log. Refusal
exits 8 without retrying.
- git-class sha256:null receipts, fail-open: gstack-artifacts-init
(ls-remote, initial push, fetch/pull recovery, retry push),
gstack-brain-restore (staging clone, existing-repo fetch),
gstack-session-update (self-update pull).
gstack-team-init needs no wiring: every git clone in it is inside an
echoed instruction string, not an executed command.
The lib now self-locates with shell builtins only (no dirname), so
sourcing works under the whitelist-PATH test harnesses.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit b8c5e2055b21ab72878b3e46f8047782ee65a11c)
* test(security): egress wiring tripwire + polarity contract
Static-grep tripwire pinning the egress-receipt wiring (threat model in
the header: the ledger is forensic observability of ATTEMPTED egress,
not an exfiltration control):
- Per-sink assertions: every wired TS module imports egress-receipt and
calls writeReceipt; every wired shell sink sources
gstack-egress-lib.sh with each network op under a receipt;
ngrok-proximity check for server.ts; every design api.openai.com call
routes through receiptedFetch.
- Absence assertions: the dead brain-consumer/reader scripts stay
deleted (lstat, so a dangling symlink also fails).
- Polarity table pinned as data (fail-closed: brain-sync,
memory-ingest, gbrain-sync, telemetry-sync, ngrok, mcp-verify,
supabase-provision; fail-open: design-openai, update-check,
dashboards, git-class user ops, context-bill --exact) plus per-file
polarity spot-checks.
- NEW-SINK SCANNER with zero KNOWN_UNWIRED: sweeps bin/, lib/,
scripts/, design/src, browse/src for curl, absolute-URL fetch(, and
git remote ops (never local rev-parse/get-url; heredoc bodies and
message strings excluded) and requires every hit to be receipted or
in a REASONED exemption list where each entry carries its why.
Preamble-generated skill prose documented out-of-scope in the header.
- Shebang tripwire: no bin/gstack-* file may carry a node shebang.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit ff69ceeafaf9c017d539b6ad77ff8f95b680b979)
* feat(cli): gstack-egress reader
bin/gstack-egress (bun) — the auditor's view of the receipts ledger:
- list: one row per receipt (what gstack ATTEMPTED to send), with
--since/--host/--sink filters and --json.
- verify: recompute the hash chain; exit 3 on tamper naming the first
broken line; prints the sizeWarning when the ledger passes 25MB.
- grants: what CAN leave, built on the upstream config keys only
(telemetry, artifacts_sync_mode, redact_repo_visibility,
redact_prepush_hook via gstack-config get) — each grant names its
file, key, and the exact revoke command.
CLI smoke tests spawn the real bin against a temp GSTACK_HOME,
including a broken-chain fixture asserting exit 3.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 9e24eca0f1069fea2ea69e7df4e9b256e93d59a3)
* feat(cli): context-bill — token bill-of-materials (stripped port)
lib/context-bill.ts, ported from the v2 fork and STRIPPED to the tiers
this repo's skills can exercise: ALWAYS-ON (per-skill frontmatter bytes
with dead-key and foreign-host-file flags), EAGER (SKILL.md + any
forced 'for every invocation' references), on-disk totals, --diff,
--budget, and --exact with the calibration table. The fork's
CONDITIONAL/TRANSITIVE/LAZY/FAST-PATH parsers understand only its
dispatcher layout and were dropped; the tier fields stay in the report
shape (empty/zero/null) so re-adding a parser is additive.
TOKEN_DIVISORS and their provenance docblock kept; --help notes
recalibration via --exact's calibration block.
Three upstream fixes over the fork:
(a) findSkillDirs treats the walk ROOT as a container — the repo root's
router SKILL.md is billed AND its children are walked (the fork
short-circuited and billed one skill); walkMd skips node_modules
and dot-directories.
(b) installed-tree layout: subdirs that are their own repo checkout
(a gstack/ clone inside ~/.claude/skills, detected by .git) are
skipped, and directory symlinks (connect-chrome) are followed with
a container-recursion cycle guard.
(c) ROUTER_KEYS widened to the upstream frontmatter contract {name,
description, version, allowed-tools, triggers, preamble-tier}.
--exact writes an egress receipt (sink context-bill-exact, host
api.anthropic.com) BEFORE any count_tokens POST; if the receipt cannot
be written the run degrades to the offline estimate with a warning —
nothing is sent unrecorded. bin/gstack-context-bill is the bun shim.
Tests: fixture-tree ledgers, the three fixes, --diff/--budget exit
codes, --exact with injected fetch (envelope subtraction, receipt
ordering, fail-open degradation), CLI smoke test, and ground truth
against THIS repo via test/helpers/skill-census.ts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 675c19876b87ec927b555f5f64c7f93130b3de90)
* test(catalog): aggregate discovery-surface budget with ratchet protocol
Every host loads every skill's frontmatter name + description at
discovery, every session. applyCatalogTrim in scripts/gen-skill-docs.ts
shapes each description and the 160KB per-file warn covers body size,
but nothing capped the aggregate frontmatter — the catalog could grow
one reasonable-looking description at a time. This test is that
enforcement layer.
Measures the catalog via test/helpers/skill-census.ts authoredSkills
(symlink-deduped, root router counted separately as the _gstack-command
alias line item): 53 skills + router = 4,420 bytes = 1,105
token-equivalents today, asserted <= 1,150 (~4% headroom). Per-skill
sub-cap of 260 bytes (largest today: design-consultation at 229), plus
a non-empty-description check.
Failure messages are self-service ratchets: they print the new total,
the delta, and the update protocol (bump the constant AND the
derivation comment in the same commit; trim instead of grow for
existing descriptions). Parser handles folded block scalars
(description: >-) for fork parity; import-free by design so it
survives generator refactors.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit c106fb36f768181b80c257e5cff1cde4f435f9c0)
* fix(browse): extension token bootstrap moves to pinned-origin POST; /health carries no token
GET /health is now liveness/status only in every mode — both token
carve-outs (headed-mode disjunct AND chrome-extension:// Origin
disjunct) are removed. Token bootstrap is POST /extension-token on the
local listener: the Origin header must be exactly
chrome-extension://<GSTACK_EXTENSION_ID> and the Host header's hostname
must parse to 127.0.0.1 or localhost (parsed via new URL, never literal
equality — Host arrives as '127.0.0.1:34567'). Wrong origin/host → 403
with no detail. The tunnel surface 404s the endpoint (not in
TUNNEL_PATHS, verified by test).
The extension ID is pinned by a new "key" field (RSA public key) in
extension/manifest.json; browse/scripts/extension-id.ts reproduces the
ID derivation (first 16 bytes of SHA-256 of the DER public key, hex
mapped 0-9a-f → a-p). The private key is not committed anywhere —
unpacked/baked-in loads only need the public key.
Extension side: background.js bootstraps and refreshes the token via
POST /extension-token (403 → disconnected state); sidepanel.js direct
connect path does the same; sidepanel-terminal.js's dead /health token
fallback (read AUTH_TOKEN/authToken keys the server never sent,
hardcoded port) is replaced with the window.gstackAuthToken path.
MIGRATION NOTE: the manifest key pins the extension ID, so existing
installs' side-panel local state (saved port, snoozes) resets once —
explained in-product via a one-time notice (flag
gstack_id_migrated_v162). After upgrading the server, restart the
browser so the old service worker stops polling for a token GET /health
no longer serves.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit e9a0b6847a2d17fe6656a4686b4efd0c8380eb09)
* docs: correct stale compiled-binaries claim; file three egress/eval follow-ups
CLAUDE.md's compiled-binaries section claimed browse/dist binaries are
tracked by git and appear as modified in git status — false since
|
|
|
Garry Tan
|
0570ef93a5
|
v1.24.0.0 feat: cross-platform hardening — curated Windows lane + Bun.which resolver + path-portability helper (#1252)
* feat(paths): bin/gstack-paths helper + migrate 8 skills off inline state-root chains
New bin/gstack-paths emits GSTACK_STATE_ROOT, PLAN_ROOT, TMP_ROOT exports for
skill bash blocks to source via eval. Honors GSTACK_HOME → CLAUDE_PLUGIN_DATA →
$HOME/.gstack → .gstack (and parallel chains for plan/tmp roots) so skills work
the same in plugin installs, global installs, and CI containers without HOME.
Eight skills migrate off inline ${CLAUDE_PLUGIN_DATA:-...} or ${GSTACK_HOME:-...}
chains: careful, freeze, guard, unfreeze, investigate, context-save,
context-restore, learn, office-hours, plan-tune, codex. Resolved values are
identical, so existing tests cover correctness; the win is consolidating 11
copy-pasted fallback chains behind one helper.
codex/SKILL.md.tmpl gets a new Step 0.6 Resolve portable roots that sources
gstack-paths once, then replaces hardcoded ~/.claude/plans/*.md and
/tmp/codex-*-XXXXXX.txt with "$PLAN_ROOT"/*.md and "$TMP_ROOT/codex-*-XXXXXX.txt".
Hardening direction credited to the McGluut/gstack fork; this is upstream's
factoring of the per-skill chain the fork inlined.
Tests: test/gstack-paths.test.ts covers all three fallback chains with 8 unit
tests (HOME unset, CLAUDE_PLUGIN_DATA set, GSTACK_HOME wins, etc).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(claude-bin): Bun.which wrapper for cross-platform claude resolution
Replaces 75 LOC of fork-side reimplementation (PATH parsing, Windows PATHEXT,
case-insensitive Path/PATH, X_OK) with a thin wrapper around Bun.which() — the
runtime built-in that already does all of it. New file is ~70 LOC including
the override + arg-prefix logic the runtime doesn't cover.
Override branch fixed: GSTACK_CLAUDE_BIN=wsl now resolves through Bun.which()
just like a bare claude lookup would. The McGluut fork's claude-bin.ts only
handled absolute-path overrides; bare commands silently returned null. Passing
the override value through Bun.which fixes the documented use case for free.
Five hardcoded claude spawn sites rewired through resolveClaudeCommand:
- browse/src/security-classifier.ts:396 — version probe
- browse/src/security-classifier.ts:496 — Haiku transcript classifier
- scripts/preflight-agent-sdk.ts — preflight binary pinning
- test/helpers/providers/claude.ts — LLM judge availability + run
- test/helpers/agent-sdk-runner.ts — SDK harness binary resolver
All retain their existing degrade-on-missing semantics.
Tests: browse/test/claude-bin.test.ts has 9 unit tests including the
override-PATH-resolution case the fork's version got wrong.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs+test: AGENTS.md/docs/skills.md inventory sync + private-path leak detector
Inventory sync (codex-flagged drift):
- /debug → /investigate (skill renamed in v1.0.1.0)
- AGENTS.md grows from 21 to 40+ skills, organized by category (plan reviews,
implementation, release, operational, browser, safety)
- docs/skills.md gains 11 missing entries: /plan-devex-review, /devex-review,
/plan-tune, /context-save, /context-restore, /health, /landing-report,
/benchmark-models, /pair-agent, /setup-gbrain, /make-pdf
- Stale "<5s bun test" claim dropped — slim-preamble harness + new tests means
no realistic universal claim to make
- Adds explicit "Mac + Linux full, curated Windows lane" platform statement +
"Git Bash / MSYS today, native PowerShell future" install note
New invariants in test/skill-validation.test.ts (~80 LOC):
- Private-path leak detector scans every SKILL.md / SKILL.md.tmpl for known
maintainer-only filenames (coordination-board.md, SEEKING_LOG.md,
RATIONAL_SUBJECT.md, VALUE_SIGNAL_LOOP.md, C:\LLM Playground\go).
Adapted from the McGluut fork's skill-contract-audit.ts; we don't take
the script wholesale because most of its checks are already covered by
test/gen-skill-docs.test.ts:1668-2074 and test/skill-validation.test.ts:1419
— only the private-path scan and doc-inventory cross-check are new.
- Doc-inventory cross-check: every skill directory with a SKILL.md.tmpl must
appear in both AGENTS.md and docs/skills.md. Catches the inventory drift
this commit is fixing — without this test it would just drift again.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(windows): curated windows-free-tests CI job + test-free-shards curation
Codex's v1.18.0.0 review flagged that a windows-latest matrix entry on the
existing Linux-container evals.yml workflow can't work as a drop-in, and that
the free test suite has POSIX-bound dependencies a sharded runner doesn't fix
on its own. This commit takes McGluut's test-free-shards.ts (190 LOC), adds a
Windows-fragility scan, and runs the curated subset on a separate non-container
windows-latest job.
scripts/test-free-shards.ts:
- Enumeration + paid-eval filtering + stable-hash sharding (FNV-1a). Adapted
from McGluut/gstack fork.
- Upstream-original: --windows-only filter scans each test's content for
POSIX-bound patterns: hardcoded /bin/sh, spawn('sh', ...), bash -c, raw
/tmp/, chmod, xargs, which claude. Files matching are excluded with the
reason logged. Currently filters 25 of 128 free tests; remaining 103 run
on windows-latest.
.github/workflows/windows-free-tests.yml:
- Separate non-container job (NOT a matrix entry on evals.yml). Runs:
bun run test:windows # curated subset
bun test browse/test/claude-bin.test.ts # PATHEXT+overrides on Windows
bun test test/gstack-paths.test.ts # state-root resolution
package.json: new test:free + test:windows scripts.
Honest about scope (codex-flagged): this does NOT make the full free suite
Windows-safe. The 25 excluded tests need POSIX-only surfaces ported off shell
primitives (test/ship-version-sync.test.ts:72 hardcodes /bin/bash, etc).
Tracked as a P4 follow-up TODO. Full Windows parity is the next wave; this
release ships the curated lane.
Tests: test/test-free-shards.test.ts has 14 unit tests covering enumeration,
paid-eval filtering, Windows-fragility detection (POSIX patterns + safe code),
and stable sharding determinism.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(release): v1.20.0.0 — cross-platform hardening, curated Windows lane
Cross-platform hardening. Mac + Linux full, curated Windows lane added.
Workspace-aware queue at ship time:
- v1.17.0.0 claimed by garrytan/setup-gbrain-run (PR #1234)
- v1.19.0.0 claimed by garrytan/browserharness (PR #1233)
- This branch claims v1.20.0.0 (next available slot)
(Initially bumped to v1.18.0.0 during plan-mode implementation; rebumped to
v1.20.0.0 at /ship time when gstack-next-version detected the queue had moved.)
Headline numbers (full release-note in CHANGELOG.md):
- 2 new shared resolvers: bin/gstack-paths (61 LOC), browse/src/claude-bin.ts (73 LOC)
- 8 skills migrated off inline state-root chains
- 5 hardcoded claude spawn sites rewired through the shared resolver
- 75 LOC of fork-side reimplementation replaced by Bun.which()
- 103 of 128 free tests run on windows-latest (curated, ~80%)
- +31 new unit tests + 3 new invariants
- AGENTS.md inventory grows from 21 to 40+ skills
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): configure git identity + extend Windows-fragility curation
First windows-free-tests CI run surfaced 34 failures across two patterns:
1. Tests that init a temp git repo via execSync('git commit ...') — Windows
runner has no default git user.email/user.name, so the commit fails.
Fix: add a "Configure git identity" step to .github/workflows/windows-free-tests.yml
that sets a CI-only identity globally.
2. Tests that use POSIX-only APIs unconditionally:
- file-mode bitmask checks (`stat.mode & 0o600`, `mode & 0o111`) — Windows
fakes mode bits and these assertions don't compose
- hardcoded forward-slash path assertions (`file.endsWith('/tab-42.json')`)
— Windows path separators are '\\'
Fix: extend WINDOWS_FRAGILE_PATTERNS in scripts/test-free-shards.ts to
detect both. 8 additional tests now excluded from the curated Windows
subset with logged reasons:
- browse/test/security-review-flow.test.ts (file mode)
- browse/test/security-sidepanel-dom.test.ts (forward-slash path)
- browse/test/url-validation.test.ts (forward-slash path)
- test/gbrain-repo-policy.test.ts (file mode)
- test/relink.test.ts (file mode)
- test/skill-validation.test.ts (file mode — single assertion at :934)
- test/team-mode.test.ts (file mode — also kills its 30 git-init beforeEach failures)
- test/upgrade-migration-v1.test.ts (file mode)
Curated Windows subset: 103 → 95 tests (still ~74% of free suite). All
14 test-free-shards unit tests still pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): enforce LF + build server-node.mjs in CI
Second round of windows-free-tests fixes after the first push. Curated subset
went from 386/34 to 58/4 fails. Remaining 4 fails + 1 error trace to two root
causes:
1. Line-ending sensitivity. Windows checkout with core.autocrlf=true converts
.md/.tmpl files to CRLF. Tests that parse YAML frontmatter with
`/^---\n([\\s\\S]+?)\n---/` then return zero matches — skill-collision-
sentinel.test.ts:120 enumerated 0 skills on Windows, cascading into 3
downstream test failures (sanity, KNOWN_COLLISIONS, /checkpoint resolved).
Fix: add .gitattributes that pins LF for .md/.tmpl/.yml/.json/.toml/.sh/
.ts/.tsx/.js/.mjs/.cjs/.bash. Root-cause fix; prevents future similar
tests from hitting the same trap. Also keeps bash scripts LF on Linux
runners (CRLF in shebangs produces "bad interpreter" errors).
2. Module-level Windows assertion in browse/src/cli.ts:82 throws if
browse/dist/server-node.mjs is missing. Any test that transitively loads
cli.ts (e.g., browse/test/tab-isolation.test.ts via shard mate imports)
then fails to even start. server-node.mjs is generated by bash
browse/scripts/build-node-server.sh, which `bun run build` calls but
`bun install` does not.
Fix: add a "Build server-node.mjs" step to .github/workflows/
windows-free-tests.yml. Calls only the node-server build script, not
full `bun run build` — we don't need the compiled binaries for tests
and the full build is slow.
Expected: skill-collision-sentinel goes 0→3 pass (sanity, KNOWN_COLLISIONS,
/checkpoint resolved). tab-isolation's "unhandled error between tests"
disappears. Remaining tests should be green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): platform-aware claude-bin test + curate bin/ shebang spawns
Round 3 of windows-free-tests fixes. Round 2 (LF gitattributes + server-node.mjs
build) cleared shard 1 entirely (skill-collision-sentinel and tab-isolation
green). Shard 2 surfaced two more issues:
1. browse/test/claude-bin.test.ts:50 — the "PATH-resolvable override" test
creates a fake binary 'fake-claude-cli' (no extension) and expects
Bun.which to find it. On Windows, Bun.which probes PATHEXT extensions
(.cmd, .exe, .bat) — a bare-name file is not discoverable. Production
behavior is correct; the test was Mac/Linux-shaped.
Fix: branch on process.platform. On Windows, write 'fake-claude-cli.cmd'
with a Windows batch payload instead of a POSIX shebang script.
2. test/gstack-question-log.test.ts (and 18 sibling tests) — spawn a bash
shebang script via spawnSync(BIN, args). Git Bash on Windows can run
`bash /path/to/script` but spawnSync invokes CreateProcess directly,
which doesn't parse #!/usr/bin/env bash. All these tests are
Windows-fragile and can't run as-is.
Fix: extend WINDOWS_FRAGILE_PATTERNS with `path.join(.., 'bin', ..)`
detector. Curates 19 additional tests (benchmark-cli, brain-sync,
builder-profile, explain-level-config, gbrain-*, gstack-question-*,
hook-scripts, learnings, plan-tune, review-log, secret-sink-harness,
taste-engine, telemetry, timeline, uninstall).
Curated Windows subset: 95 → 76 tests (~59% of free suite). Still
meaningful Windows coverage. The 52 excluded tests are tracked as a
follow-up TODO for full Windows parity (shebang-bin spawns + POSIX file
modes + raw /tmp/ etc).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): curate Playwright-launching tests
Round 4 of windows-free-tests fixes. Round 3 cleared shard 2 except for
browse/test/batch.test.ts:35 which calls `await bm.launch()` and triggers
Playwright Chromium launch. The windows-latest runner doesn't have
Chromium installed (browser bring-up is a separate concern, tracked by
PR #1238 windows-pty-bun-pty-fix).
Fix: extend WINDOWS_FRAGILE_PATTERNS with `await \\w+\\.launch\\(` matcher.
Catches batch.test.ts plus 7 sibling tests (commands, compare-board,
content-security, handoff, security-live-playwright, security-sidepanel-dom,
snapshot — most already excluded by other patterns).
Curated Windows subset: 76 → 72 tests (~56% of free suite). Net curation
across all 4 rounds: 56 of 128 free tests excluded, each with a logged
reason. The 56 excluded fall into 6 buckets — POSIX shells, raw /tmp/,
chmod/xargs, file mode bitmasks, forward-slash path assertions, bin/
shebang spawns, and Playwright launches — all tracked as a P4 follow-up
TODO for full Windows parity.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): catch destructured join() bin-spawns + browse server tests
Round 5 of windows-free-tests fixes. Round 4 caught Playwright launchers
but two more failure shapes appeared in shard 5:
1. test/diff-scope.test.ts uses `import { join }` (destructured) and
`join(import.meta.dir, '..', 'bin', 'gstack-diff-scope')`. My round-3
pattern only matched `path.join(...)` — the destructured form slipped
through. Tightened the pattern to match the literal `, 'bin', '<name>'`
path-segment shape regardless of whether it's `path.join` or `join`
directly.
2. browse/test/sidebar-integration.test.ts spawns the browse server via
`spawn(['bun', 'run', server.ts])` with BROWSE_HEADLESS_SKIP=1. The
Bun-run-server.ts path is the same Playwright-on-Windows broken path
that the windows-free-tests job intentionally avoids — the server-node.mjs
route only kicks in for the compiled binary, not direct Bun runs of the
TypeScript source. Added a BROWSE_HEADLESS_SKIP / spawn-bun-run pattern.
Curated Windows subset: 72 → 73 tests (~57% of free suite). Net up by 1
because the tightened bin pattern released one test that was a false
positive in the loose `path\\.join` form.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): broaden bin/ pattern to match path.join(ROOT, 'bin')
Round 6. Round 5 tightened the bin/ pattern to require a script-name segment
after 'bin', which inadvertently released test/brain-sync.test.ts that uses:
const BIN = path.join(ROOT, 'bin');
const full = bin.startsWith('/') ? bin : path.join(BIN, bin);
The 'bin' segment is the LAST argument to path.join — there's no literal
script name to match. The earlier looser pattern caught this; round 5
broke that.
Fix: revert to `,\\s*['"]bin['"]\\s*[,)]` which matches both forms:
- `, 'bin', 'script-name')` (path.join with name) — typical
- `, 'bin')` (path.join ending at bin) — brain-sync style
Curated subset: 73 → 66 tests (~52% of free suite). The 7 additional
exclusions are all bin-script tests that were misclassified by the round-5
tightening.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(find-browse): guard main() with import.meta.main
Round 7 of windows-free-tests fixes (and a genuine bug fix beyond Windows).
browse/src/find-browse.ts called main() unconditionally at module load.
main() calls process.exit(1) when no compiled `browse` binary exists at the
known install paths. Any test that imports `locateBinary` from this module
then exits the entire test process before any tests run.
This affected the windows-free-tests CI lane because the runner intentionally
doesn't compile the browse binary (only server-node.mjs is built — full
binary compilation is slow and not needed for the curated subset). It would
also affect any Mac/Linux contributor who runs tests in a fresh checkout
before running ./setup, though the symptom is rarer there.
Fix: wrap `main()` in `if (import.meta.main) { main() }`. The CLI invocation
(via the find-browse binary or `bun run browse/src/find-browse.ts`) still
runs main() and emits the path. Imports get only the named exports.
Verified locally:
- `bun run browse/src/find-browse.ts` still prints the binary path.
- `import { locateBinary } from '...'` no longer exits the process.
- `bun test browse/test/find-browse.test.ts` passes 4/4 (was crashing
at module load).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): pin LF on extensionless executables (setup, bin/*, scripts/*)
Round 8 of windows-free-tests fixes. Round 7 cleared find-browse + most
shards; one fail left in shard 7:
test/setup-codesign.test.ts > codesign shell snippet is syntactically valid
expect(received).toBeTruthy() — match was null
The test extracts a bash codesign block from the `setup` file via a
\\n-anchored regex, then syntax-checks it with `bash -n`. On Windows the
regex returned null because the `setup` file was checked out with CRLF
endings — my round-2 .gitattributes only covered files matched by extension
patterns (*.md, *.sh, *.ts) and `setup` is extensionless.
Fix: extend .gitattributes with explicit rules for extensionless executables:
setup text eol=lf
bin/* text eol=lf
**/scripts/* text eol=lf
This also LF-pins all the bash bin/ scripts (gstack-paths, gstack-slug,
gstack-codex-probe, ...) which would otherwise break with "bad interpreter"
errors on Linux if a Windows contributor accidentally committed CRLF
versions. Defense in depth.
Verified locally: `git check-attr eol setup bin/gstack-paths` reports
`eol: lf` for both. Renormalized via `git add --renormalize` so any
already-LF files in the repo stay LF after the .gitattributes change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): gen:skill-docs in workflow + known-bad list for env-specific tests
Round 9 of windows-free-tests fixes. Round 8 cleared shard 7; shard 8
surfaced 4 fails:
1+2. test/gen-skill-docs.test.ts golden-file regression for Codex + Factory
ship skills failed with ENOENT on `.agents/skills/gstack-ship/SKILL.md`
and `.factory/skills/gstack-ship/SKILL.md`. These are gitignored
gen-skill-docs outputs that the Mac/Linux CI workflows already
regenerate elsewhere — the windows-free-tests lane never did.
Fix: add `bun run gen:skill-docs --host all` step to
windows-free-tests.yml after `bun install`.
3. test/host-config.test.ts:377 "detect finds claude" asserts the `claude`
binary is on PATH. True when running inside Claude Code; false on a
bare CI runner.
4. browse/test/findport.test.ts:117 asserts Bun.serve.stop() is
fire-and-forget (returns undefined). Bun's Windows behavior for this
polyfill differs; the assertion is Bun-on-non-Windows-specific.
Both 3 and 4 are environment/runtime-specific failures that don't fit a
regex pattern. Added a KNOWN_WINDOWS_INCOMPATIBLE explicit list to
scripts/test-free-shards.ts so they're curated by exact path, with a
reason string. The list is for cases where pattern matching can't infer
the failure shape from the source file alone.
Curated subset: 66 → 64 tests (~50% of free suite). 14 unit tests in
test/test-free-shards.test.ts still pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): curate pre-existing breakage from v1.14.0.0 sidebar refactor
Round 10 of windows-free-tests fixes. Round 9 cleared shards 7+8; shard 9
surfaced ENOENT for browse/src/sidebar-agent.ts. That file was DELETED in
v1.14.0.0 (sidebar REPL refactor — sidebar-agent.ts and the chat queue
path were ripped in favor of the interactive xterm.js PTY). 10 security
tests still reference it via top-level fs.readFileSync and fail on import.
Verified locally: `bun test browse/test/security-source-contracts.test.ts`
on this branch reports 0 pass, 1 fail, 1 error. Mac/Linux CI exits 0
because Bun reports module-load failures as "error" not "fail" and the
exit code is 0; Windows CI exits 1 (stricter). Same pre-existing
breakage on every platform — just only visible in shard 9 of the
Windows lane.
Fix: add WINDOWS_FRAGILE_PATTERNS entry matching `sidebar-agent.ts` /
`src/sidebar-agent` references. Curates browse/test/sidebar-ux.test.ts
(other 9 likely caught by paid-eval filter or earlier patterns).
Tracked as a follow-up TODO: update or delete the 10 security tests that
reference deleted source. Out of scope for v1.20.0.0 portability wave.
Curated subset: 64 → 63 tests (~49% of free suite).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(windows-ci): broaden sidebar-agent.ts pattern to catch all references
* fix(windows-ci): catch ./bin/<name> direct path spawns
* fix(windows-ci): scope Windows job to v1.20.0.0 new portability work
12 rounds of curation revealed that gstack has a long tail of tests with
environment-specific assumptions (POSIX paths, /tmp, mode bits, bash
spawns, deleted v1.14 sidebar refs, HOME=unset guards, Bun polyfill
specifics). Each round of pattern-matching curation caught 1-2 new
buckets but kept surfacing more.
Honest scope for v1.20.0.0: this PR delivers two new portability
primitives (bin/gstack-paths + browse/src/claude-bin.ts). The Windows
CI job should verify those primitives work on Windows. Full-suite
Windows parity is a P4 follow-up that requires touching many tests
that aren't part of this PR's scope.
Change: windows-free-tests.yml now runs:
bun test test/gstack-paths.test.ts \\
browse/test/claude-bin.test.ts \\
test/test-free-shards.test.ts
That's 31 tests targeting exactly the new code paths shipped here.
The release-note headline ("curated Windows lane added") becomes
truthful when this passes — we have a real Windows CI gate on the
new portability work, not a rebadged failure-tolerant attempt at the
full suite.
Retained: scripts/test-free-shards.ts curation logic (informational
output via `--list`, useful for future expansion of the Windows lane
when contributors port specific tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(test): invoke bin/gstack-paths via bash (Windows shebang fix)
Round 13 of windows-free-tests fixes. Round 12 (scope pivot) revealed all
8 gstack-paths tests fail on Windows because the test invokes the bash
shebang script directly:
spawnSync(BIN, []) # BIN = path.join(ROOT, 'bin', 'gstack-paths')
Windows CreateProcess can't parse `#!/usr/bin/env bash` from the file.
The script never runs on Windows via this invocation path.
Fix: change to `spawnSync('bash', [BIN], ...)`. This matches production
usage — the script is sourced from inside skill bash blocks via
`eval "$(~/.claude/skills/gstack/bin/gstack-paths)"`, where bash is
always the executor. Mac/Linux behavior is identical (bash invocation
of a bash script).
Verified locally: 8/8 tests still pass on macOS.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(release): rebump v1.20.0.0 → v1.22.0.0 (queue drift)
Version-gate workflow rejected v1.20.0.0 because the queue moved during
the windows-free-tests fix loop:
v1.16.0.0 → garrytan/gbrowser-unleashed (PR #1253) [new since last bump]
v1.17.0.0 → garrytan/setup-gbrain-run (PR #1234)
v1.19.0.0 → garrytan/browserharness (PR #1233)
v1.21.1.0 → garrytan/pty-plan-mode-e2e (PR #1255) [new since last bump]
Two new sibling PRs landed slot claims while we iterated on Windows.
Next free MINOR slot is v1.22.0.0.
Updated VERSION, package.json, CHANGELOG header + body. Also pushing the
round-13 windows-fix in parallel (test invokes bin/gstack-paths via bash
to handle Windows shebang).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(test): clear USERPROFILE alongside HOME (Git Bash auto-populates HOME)
Final Windows fix. 29/31 pass; 2 fail in gstack-paths HOME-unset tests:
(fail) CWD fallback when HOME also unset (container env)
(fail) PLAN_ROOT chain: GSTACK_PLAN_DIR > CLAUDE_PLANS_DIR > HOME > CWD
Root cause: Git Bash on Windows auto-populates `HOME` from `USERPROFILE`
at shell startup if HOME is empty/unset. Passing `HOME: ''` to spawnSync
does set HOME='' for the child, but Git Bash overwrites it from
USERPROFILE during init, so the script sees `${HOME:-}` as non-empty
(C:\\Users\\runneradmin) and never reaches the CWD-fallback branch.
Fix: clear USERPROFILE='' too. On Linux/Mac it's a no-op (env var doesn't
exist in normal env); on Windows Git Bash it stops the HOME auto-populate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(test): skip HOME-unset assertions on Windows (Git Bash auto-populates)
29/31 → 31/31 expected on Windows. Final fix:
The 2 still-failing gstack-paths tests assert CWD-fallback behavior when
HOME is genuinely unset (Linux container scenario). On Windows Git Bash,
HOME gets auto-derived from USERPROFILE → HOMEDRIVE+HOMEPATH → /c/Users/<user>
during shell startup. Clearing all three of those env vars in the spawn
still results in HOME being non-empty by the time the script runs.
The bash script's CWD-fallback logic IS correct — it just isn't exercisable
through the Git Bash test surface. Skip those specific assertions on
Windows; they continue to verify on Linux/Mac.
This is the only platform-specific test guard introduced; it's narrowly
scoped to the unreachable code path, not a bypass of the real check.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|