Three template one-liners: land-and-deploy reads the squash-merge result
from the merge commit instead of the stale branch tip; review/landing-report
/land-and-deploy templates call bin/gstack-next-version via its installed
path instead of a bare repo-relative one; setup-gbrain quotes
GBRAIN_EMBED_FLAGS so zsh word-splitting stops silently dropping
voyage-code-3 flags. Regenerated output included.
Contributed by @stormeoio (PR #2011), @rjmurillo (PR #1820) and
@trevorhstandridge (PR #1817).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two small setup papercuts: the Playwright platform probe now recognizes
Ubuntu 26.04 instead of falling to the generic-Linux path, and macOS
installs stop warning about a codesign "failure" that was actually the
expected unsigned-adhoc path (the real signature check already gates
binary launch).
Contributed by @nuga0718 (PR #2113) and @lucascaro (PR #1758).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The /claude skill's auth probe only recognized env-var/API-key auth, so
macOS subscription installs (keychain-backed, where `claude -p` works fine)
were told they had no auth. Detection now uses host invocation.
Fixes#1890.
Contributed by @xing-qnex (PR #2411); PR #2548 by @shawnacalia covered the
keychain case.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
actionlint.yml and skill-docs.yml trigger on both push and pull_request
with no concurrency group, so every push to an active branch left the
previous (now-obsolete) runs queued or running — twice per commit on
same-repo PR branches. Add the same cancel-in-progress concurrency
groups the heavier workflows already use, plus a free static tripwire
test that fails CI if a push+pull_request workflow ever ships again
without cancel-in-progress.
Contributed by @jbetala7 (PR #2053).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gstack-model-benchmark fed --timeout-ms straight through parseInt, so
"abc" became NaN and "0"/"-1" passed through — a NaN or non-positive
timeout silently disables the per-provider watchdog. Reject anything
that isn't a positive (optionally +-prefixed) safe integer with a clear
error and exit 1.
Closes#1726.
Contributed by @jbetala7 (PR #1727).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gstack-paths emitted bare KEY=VALUE lines, so the documented
eval "$(gstack-paths)" re-parsed the values: backslashes were eaten as
escapes (Windows $TMP C:\Users\... became C:Users...) and a space
word-split the assignment, leaving the variable empty. Emit each value
with printf %q so eval round-trips byte-for-byte; plain POSIX paths are
unchanged. Round-trip regression tests cover backslashes, spaces, and
embedded quotes.
Closes#2374.
Contributed by @fangearhq-boop (PR #2376); same fix independently by
@yannickspiess (PR #1580).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The telemetry_events columns exist and bin/gstack-telemetry-log already
sends error_message + failed_step, but the Supabase ingest function dropped
both fields on insert — every error report arrived with no message and no
failing step. Map them through with the same bounded-length sanitization as
error_class (500/100 chars). The completion-status resolver now also passes
--error-message/--failed-step in the generated skill telemetry block, with
instructions to leave them empty on success.
Resolver only for the template side; generated SKILL.md files regenerate
from this source in the docs lane.
Contributed by @sunnnybala (PR #769).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
get/list read values with awk '{print $2}' | tr -d '[:space:]', which
truncated any value containing spaces ("/Users/x/Conductor Workspaces"
came back as "/Users/x/Conductor") and set wrote the unfiltered raw value
on the append path. New read_config_value() strips only the "key:" prefix
and trailing whitespace (cut-style parse), and set appends the same
newline-stripped value the in-place edit path uses.
Closes#1782.
Contributed by @jbetala7 (PR #1783).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A title that was nothing but a version ("v1.2.3" — the form ship uses for
version-only bumps) matched neither the "v<NEW_VERSION> " literal case nor
the trailing-space strip regex, fell through to the prepend path, and came
out as "v1.2.3.4 v1.2.3" — which pr-title-sync.yml then wrote back via
gh pr edit. Handle the bare form in both the no-change case and the
prefix-strip regex, and emit a bare new version when nothing follows.
Closes#1886.
Contributed by @jbetala7 (PR #1887).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The --write user-origin gate documents exit 2 as "rejected, do not retry"
(profile poisoning defense), but a source outside both the allowed and the
explicitly-rejected lists fell through to exit 1 — the generic validation
code callers treat as retryable. Unknown sources now exit 2 with the same
do-not-retry rejection message as the known non-user-originated ones.
Closes#2390.
Contributed by @gregario (PR #2429).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
POSIX bracket ranges like a-z follow the active collation order; under GNU
grep with tr_TR.UTF-8 the range excludes the ASCII letter i, so every key
containing i (skill_prefix, explain_level, ...) was rejected as invalid.
Pin both get/set validators to LC_ALL=C, with a source-level tripwire test
since macOS BSD grep doesn't reproduce the bug.
Closes#2494.
Contributed by @Math1987 (PR #2506).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bare 14-digit runs like 20260727202423 (YYYYMMDDHHMMSS backup/log stamps)
matched the phone regex and produced MEDIUM PII findings. Reject a
separator-free 14-digit span whose fields parse as a plausible date-time;
real numbers carry a + or spacing, so phone coverage is unchanged.
Contributed by @abkrim (PR #2428).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The /override[:\s]/i pattern flagged any prose containing "override " or
"override:" — CLI flags (--port-override -1), tfvars notes, and plain
"you can override the default region" all tripped the injection guard.
Require an instruction-shaped continuation: "override (all)? previous |
prior | above | the rules/instructions/system prompt". Genuine attempts
like "Override: ignore all previous instructions" still block via the
ignore-previous pattern.
Closes#2401, #1934.
Contributed by @Masashi-Ono0611 (PR #2424); same fix independently by
@JonasFocus (PR #1940).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gstack-artifacts-init unconditionally rewrote the push remote to SSH and
hard-failed setup for users whose gh/glab auth is HTTPS-only. Now:
- provider-created remotes follow `gh config get git_protocol` /
`glab config get git_protocol` (HTTPS when unset — the gh default)
- explicit/existing/manual remotes keep their given protocol; unknown
URL forms (local bare paths, file://, self-hosted) pass through
- new --push-protocol auto|https|ssh flag overrides the inference
- the unreachable-remote error names the actual protocol and points at
--push-protocol instead of assuming a missing SSH key
Closes#1348.
Contributed by @time-attack (PR #2225).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Codex reads AGENTS.md, but its generated skills still told agents to read
CLAUDE.md in 8 places — instructions Codex hosts cannot follow. The host
config now maps the memory-file name per host; all three ship goldens
refreshed from the regenerated output.
Contributed by @exGeni (PR #1996).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Asking setup for help RAN the full installer — Playwright download and all.
Standard help flags now short-circuit to usage.
Contributed by @saen-ai (PR #1219).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Setting update_check:false stopped the update-check BINARY from running,
but every skill preamble still shipped the upgrade-handling instruction
prose unconditionally — burning tokens on instructions that could never
fire and confusing agents into probing for upgrades anyway. The resolver
now suppresses the upgrade-flow prose when the config disables checks.
Fixes#2001.
Contributed by @jc0d35 (PR #2022).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The description-trim regex treated the first period as end-of-sentence, so
skill descriptions with embedded periods (e.g. file extensions, version
numbers) truncated mid-thought in the generated catalog — the discovery
surface every host loads. Trim now respects the full first sentence;
diagram's description regenerates to its intended text.
Contributed by @sneakygriff (PR #2171).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A tilde inside double quotes never expands, so the generated
`_BRAIN_SYNC_BIN="~/..."` assignments resolved to a literal ./~ path and
the Artifacts Sync + telemetry-finalize blocks silently no-op'd in every
skill that carried them (regression of #785). The preamble resolvers now
emit $HOME-based paths; all generated SKILL.md files regenerate identically
from the fixed templates, and a static tripwire fails the suite if a
quoted-tilde assignment ever reappears in generated output.
Fixes#1656, #1715.
Contributed by @jawadakram20 (PR #2333).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closes#2496, #2524, #2477 — three defects in the class "a guard that
reports success while doing nothing", all in codex/SKILL.md.tmpl:
(a) Review sandbox. The default `codex review` path was the only codex call
with no sandbox override, inheriting ~/.codex/config.toml's default — write
access on a trusted project — while Important Rules claimed read-only.
Top-level `codex review` has no -s/--sandbox flag (verified on 0.147.0), so
the invocation now pins `-c 'sandbox_mode="read-only"'`, the same form the
consult-resume path already uses.
(b) Fail-closed verdict gate. The old rule ("no [P1] found → PASS") could
not fail on the default path: native `codex review` output carries no
bracketed tags, and a non-zero exit, expired auth, timeout, or empty result
also contains no [P1] — all read as PASS. The gate is now an ordered,
fail-closed check: non-zero exit → FAIL; empty output → FAIL; [P0]/[P1]
(bracketed or codex's native labels) → FAIL with count; NO severity tags at
all → FAIL requiring a human read; PASS is only reachable through the
explicit tagged-advisory-only branch. [P0] is recognized as blocking, and
the review-log findings count includes it.
(c) Bash gate above the wrapper. Step 2A instructed `timeout: 300000` under
a 330s wrapper, and Challenge's 300s gate sat under a 600s wrapper — the
harness killed the call before the wrapper could emit its diagnosable
exit-124 message. Every Bash gate now sits strictly ABOVE its wrapper:
360000 over the 330s review wrapper, 660000 over the 600s challenge/consult
wrappers, with the ordering rationale stated at each site.
Also from #2477/#2524: a new Error Handling entry for the model-entitlement
400 ("The '<model>' model is not supported...") pointing at the `model =`
pin and `[notice.model_migrations]` in ~/.codex/config.toml and saying
exactly which override to retry with (-m for exec-based modes,
`-c model="..."` for review mode, which rejects -m); the Model & Reasoning
section no longer documents `-m` for `/codex review`.
Static assertions in test/codex-hardening.test.ts pin (a)-(c) across both
the .tmpl and the generated SKILL.md: every scoped review invocation carries
sandbox_mode="read-only" and never -s; the default-PASS sentence is banned
and the fail-closed branches are present; and per-section, every Bash
`timeout: N` is strictly greater than every wrapper budget, with 2A/2B/2C
all required to be inspected. Generated SKILL.md regenerated via
gen:skill-docs in this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The `_gstack_codex_timeout_wrapper` added in #1056 was wired into
codex/SKILL.md but never into the /review and /ship diff passes, which kept
running under a bare 5-minute Bash gate. An unwrapped stall returns no exit
code and no output, which downstream reads as "Codex reviewed and found
nothing" — a truncated pass silently became a clean bill. Measured on
codex-cli 0.145.0: a pass was killed at 287s of a 300s budget mid-tool-call,
and the same prompt completed in 336s.
Both passes in scripts/resolvers/review.ts (adversarial `codex exec` and the
structured `codex review --base` pass) now re-source gstack-codex-probe and
run under `_gstack_codex_timeout_wrapper 540`, with the Bash tool gate raised
to 600000 ms so the wrapper fires FIRST and a stall surfaces as a diagnosable
exit 124. The timeout guidance now says a timed-out pass is MISSING COVERAGE,
not a clean result, and points at the run's rollout log under
~/.codex/sessions/ for partial output. The stale "timeout doesn't exist on
macOS" claim is gone — the wrapper resolves gtimeout, then timeout, then runs
unwrapped, so it is safe without coreutils.
Static guards in test/codex-hardening.test.ts pin all three sites (resolver,
review/SKILL.md, ship/sections/adversarial.md): both calls wrapped, wrapper
budget strictly under the Bash gate, and no reappearance of the macOS claim
that steered these call sites away from the wrapper in the first place. The
Claude-output path guard in test/gen-skill-docs.test.ts now scrubs
~/.codex/sessions/ (a user-facing Codex CLI path, same class as the
~/.codex/logs/ exemption) before banning Codex host paths. Generated files
regenerated via gen:skill-docs; factory golden refreshed.
Contributed by @aegixx (PR #2379).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`codex review` takes its scope ONLY from --base/--commit/--uncommitted. The
positional [PROMPT] is mutually exclusive with all three, and a prompt-only
`codex review "<text>"` silently falls back to the uncommitted working-tree
scope (verified on 0.144.1: it runs `git status --short; git diff` and
reviews that) — so the previous prompt-based scoping produced a
confidently-worded review of the WRONG changes and read "no changes" on a
clean tree. Every diff pass now invokes `codex review --base <base>` with no
prompt argument: /codex Step 2A default path, the /review structured pass,
and the /ship adversarial-section pass (all via scripts/resolvers/review.ts).
Custom review instructions keep their own `codex exec` path (the CLI rejects
prompt + scope flag together), with the filesystem boundary preserved there.
Two new Error Handling entries teach the failure shapes: the argv-parse
error, and the "review says no changes on a branch full of changes" symptom.
Tests updated to pin the new invariant instead of banning the fix: the old
assertions required the diff range in prompt text and banned the
`--base <base> -c '...'` substring, which the correct scoped form contains.
Also deletes test/fixtures/golden-ship-claude.md — a 2,565-line orphaned
fixture referenced by zero tests (the live goldens are in
test/fixtures/golden/, compared by test/host-config.test.ts); the factory
golden is refreshed from the regenerated output. Generated SKILL.md files
regenerated via gen:skill-docs in this commit.
Contributed by @fangearhq-boop (PR #2513).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
BSD mktemp (macOS) does not substitute an X-run that has a suffix after it:
`mktemp "$TMP_ROOT/codex-err-XXXXXX.txt"` creates a LITERAL
codex-err-XXXXXX.txt on the first call (exit 0) and every later call fails
with `mkstemp failed: File exists` — so /codex breaks from the SECOND run on
every Mac, masquerading as a model stall. busybox mktemp (Alpine) rejects the
template on the first run. Fixes#2091, #2370.
Union of both community fixes, compared at the diff level:
- PR #2372: all 11 source sites with a suffix after the X-run — codex
SKILL.md.tmpl (5), claude SKILL.md.tmpl (3), bin/gstack-developer-profile
(2, suffix folded into the prefix: .json.tmp.XXXXXX), and the office-hours
codex pass in scripts/resolvers/review.ts (1).
- PR #2103: the second half of #2091 — bin/gstack-paths now strips the
trailing slash from TMP_ROOT at the source (macOS $TMPDIR ends in `/`),
plus runtime tests pinning that normalization.
New repo-wide tripwire in test/regression-issue2091-bsd-mktemp.test.ts:
every .tmpl, every SKILL.md, and every scripts/resolvers/*.ts is swept —
no mktemp template may carry a suffix after the X-run, with a self-test so
the detector can't be quietly blinded. Generated SKILL.md files regenerated
via gen:skill-docs in this commit.
Contributed by @ShuratCode (PR #2103) and @noron12234 (PR #2372); PR #2285 by @cathrynlavery covered a subset.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
setup piped doc generation through `tail -3`, so a generator crash kept the
pipe's exit 0 and installs completed "successfully" with broken or missing
SKILL.md files. Capture the real exit status at BOTH sites (the main
gen:skill-docs step and the gbrain-detected gen:skill-docs:user regen —
the second drifted in after the PR and its own test caught it), print the
tail for UX, and fail loudly.
Contributed by @DavidMiserak (PR #1898; VERSION/CHANGELOG collateral
stripped; extended to the second pipe site).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Windows can't execute an extensionless bash script directly — registering
the bare gstack-session-update path made the hook pop the "Select an app"
dialog on every session start (or silently never run), so team-mode
auto-upgrade was dead on Windows installs. Companion to the hooks'
spawn-bin routing: same defect class at the registration site.
Contributed by @NikhileshNanduri (PR #1813; VERSION/CHANGELOG collateral
stripped).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Distinct from the lib/-beside-bin/ defect: gstack-telemetry-sync,
gstack-update-check, gstack-security-dashboard and
gstack-community-dashboard all source $GSTACK_DIR/supabase/config.sh to
resolve GSTACK_SUPABASE_URL, where GSTACK_DIR is the installed root
(parent of bin/). The [ -f ... ] guard means a root without the file
degrades SILENTLY — telemetry and update checks just stop resolving the
project URL on non-Claude installs. Closes#2215.
setup now links supabase/config.sh (file-level on purpose — migrations/
and functions/ are dev-only) via _link_or_copy at all five host-install
sites: the PR's four (Codex, Factory, OpenCode runtime roots + the Kiro
block) plus the .agents sidecar, whose bin/ resolves the same relative
path and which the PR predates covering.
The runtime-root test now asserts supabase/config.sh is present in
every built root, on both the symlink and Windows-copy branches.
Contributed by @jizusun (PR #2216).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bin/ scripts import shared modules via ../lib (gstack-learnings-log →
lib/jsonl-store.ts is the reported case), so any runtime root that
exposes bin/ without lib/ breaks 13 bin/ commands — learnings-log,
decision-log, telemetry and friends fail with "Cannot find module
.../lib/jsonl-store.ts" on every non-Claude install, silently from the
skills' perspective.
All five host-install sites now carry lib/ next to bin/, each through
the existing _link_or_copy helper (never raw ln — the static invariant
in test/setup-windows-fallback.test.ts enforces this):
- .agents sidecar (create_agents_sidecar asset loop)
- Codex runtime root (create_codex_runtime_root)
- Factory runtime root (create_factory_runtime_root)
- OpenCode runtime root (create_opencode_runtime_root)
- Kiro install block
New test/setup-runtime-lib-command.test.ts executes the real setup shell
for each root in a sandbox (both the symlink branch and the Windows copy
branch of _link_or_copy) and runs gstack-learnings-log end-to-end from
the installed root, asserting the learning lands in
~/.gstack/projects/<slug>/learnings.jsonl — plus a negative control
proving a bin-without-lib root fails exactly the way the bug report did.
gen-skill-docs.test.ts's setup-validation block pins the lib link at
every site. Cross-checked against PRs #2433, #2410 and #2198: all three
cover subsets of these sites; nothing they fix is missing here.
Contributed by @fedster99 (PR #2262); overlapping fixes by @gregario, @lsendel and @netkurt.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three-bug chain behind the Windows terminal-agent leak (console window
strobing every 60s, one orphaned agent per watchdog tick until the box
ran out of committable memory):
1. isProcessAlive shelled out to `tasklist /FI "PID eq <pid>"` on Windows
with a 3s timeout. A Bun.spawnSync that hits its timeout still RETURNS
with partial stdout, so the `.includes()` PID match read a LIVE agent
as dead — killAgentByRecord skipped the kill, the watchdog respawned
around the survivor, and every orphan slowed the next tasklist enough
to produce the next false negative. Now: `process.kill(pid, 0)` on
every platform (Node and Bun both map signal 0 to an OpenProcess
existence check on Windows), with EPERM counted as alive. No
subprocess, no timeout, no console window.
2. The respawn circuit-breaker was mathematically unreachable — verified
in this tree: RESPAWN_GUARD_WINDOW_MS was a fixed 60_000 against a
60_000ms default tick, and each tick pushes at most one respawn
timestamp, so three pushes span ~120s and can never coexist inside a
60s window (eviction is strict `>`, and setInterval drift plus
per-tick work always ages the prior entry past the boundary). The
guard could not fire at the default tick rate and a steady
one-per-tick leak ran unbounded. The window now scales with the tick:
max(60_000, tick * (RESPAWN_GUARD_MAX + 2)), so "3 crashes in quick
succession → stop" holds at any tick value.
3. The tasklist probe popped a visible console per tick (no windowsHide).
Removing the shell-out kills that site; the agent-spawn site itself
already passes windowsHide: true (landed with the bun-polyfill
windowsHide commit — PR #2414's terminal-agent-control.ts hunk is
reconciled there rather than duplicated).
New browse/test/process-liveness-windows.test.ts pins all three: no
subprocess from the probe, a static tripwire against reintroducing
`tasklist` + `PID eq` liveness checks in src/, the spawnTerminalAgent
windowsHide + stdio contract, and the window-derived-from-tick
arithmetic. terminal-agent-watchdog.test.ts test 4 now pins the
window/tick relationship instead of the fixed literal that let this
ship. Also converts `new URL(import.meta.url).pathname` to
`import.meta.path` across the static-grep tests it touches — the
pathname form yields /C:/... on Windows and breaks path.resolve.
Contributed by @SYKhayyat (PR #2414).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
model-overlays/ had no entry for the current Claude generation, so every
session on a Claude 5 family or Opus 4.8 model fell through to the generic
claude.md nudges. Adds the three overlays with resolver mappings and
per-overlay tests; generated output for the default host is unchanged
(overlays activate by detected model).
Closes#2509.
Contributed by @chrisquorum (PRs #2246, #2243, #2247).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The plan-tune hooks resolved bin scripts via new URL(import.meta.url).pathname
(which doubles the drive letter on Windows: /C:/C:/...) and spawnSync'd
extensionless bash scripts directly (unrunnable without a shell association)
— so question logging, preferences, and the error fallback all silently
no-op'd on Windows, and /plan-tune collected no data. A single spawn-bin.ts
helper now owns bin resolution (fileURLToPath) and win32 bash routing for
every hook, with static tripwires so a future hook can't reintroduce the
raw pattern. This is the one Windows-spawn idiom for hook code.
Fixes#2356.
Contributed by @rafassousa (PR #2504; supersedes PR #2399 by @chuchu2781).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gstack-slug derived everything from pwd, so a session in a subdirectory got
the subdir's basename as its slug (or an outer monorepo's remote), misfiling
reviews/decisions/learnings under a phantom project — and the per-pwd cache
made the wrong answer permanent. The resolver now walks up from pwd:
outermost STRONG marker wins (.git, package.json, pyproject.toml, Cargo.toml,
Gemfile, go.mod, .project.yaml), weak content markers (README, LICENSE) catch
non-code project folders, deploy artifacts are deliberately not markers, and
GSTACK_PROJECT_SLUG remains the escape hatch. The cache self-heals on
mismatch. Main-side invariants preserved on top: the unconditional
[a-zA-Z0-9._-] re-sanitize before echo and slash→dash branch canonicalization.
Fixes#1125.
Contributed by @ajeenkya (PR #1702; rebased over the sanitize and
branch-canonicalization work that landed after it).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Branch-name sanitization disagreed across gstack (four incompatible rules),
so reviews for the same slash-named branch landed in multiple files and the
ship dashboard missed entries. gstack-slug now canonicalizes / to - in one
place, and ship's review lookup routes through it; goldens regenerated
against the current templates.
Fixes#1127, #2550.
Contributed by @ShuratCode (PR #2465; duplicate fixes by @xrfael-dev and
two others in PRs #1851/#1699/#1621, credited).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Current Claude Code returns AskUserQuestion results as an OBJECT map keyed
by question text ({answers: {question: label}}); the hook only handled the
legacy array shapes, so 86% of live records carried user_choice __unknown__
— and the bin then scored every one as followed_recommendation false,
silently poisoning plan-tune metrics. Adds the object-map extraction (exact
+ whitespace-normalized + single-question pairing, multiSelect joins,
annotations as free_text), strips the (Recommended) suffix from BOTH sides
of the comparison, skips the computation entirely on extraction failure,
and logs unrecognized shapes to hook-errors.log instead of embedding them
in the record.
Fixes#2336, #2206.
Based on the working patch in #2336 by @yijisoo; suffix comparison fix
contributed by @chuchu2781 (PR #2400).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
On a normal install the tracked files ARE locally patched (skill-prefix
name rewrites, gbrain-refresh blocks), so the bare `git pull --ff-only`
refused on every run and auto-upgrade froze forever — observed as 308
consecutive PULL_FAILED entries with the reason discarded by 2>/dev/null.
Pull now runs --autostash (local patches ride over the update and pop back),
stderr is captured into the log so a genuine failure names its cause, an
autostash pop conflict recovers to a clean tree and re-renders the patches
(gstack-patch-names + gbrain-refresh, both idempotent), and a successful
pull re-renders them as a self-heal. Behavioral tests cover the wedge shape
and the reason logging.
Fixes#2566.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pages stage into ~/.gstack/.staging-ingest-*/ inside a repo whose .gitignore
is `*`, and gbrain import honours .gitignore — so it collected 0 files,
imported nothing, and the ingest still reported "written: N" from the STAGED
count while advancing state, meaning no future run ever retried. Three
layers now: (1) pass --include-gitignored (root cause); (2) if the installed
gbrain predates the flag, retry without it (subcommand --help is generic, so
the attempt is the only probe) with an upgrade pointer; (3) reconcile
gbrain's imported+unchanged accounting against the staged count and REFUSE
to advance state on a shortfall, naming the gitignore collision.
Fixes#2144, #2104.
Contributed by @gawievanblerk (PR #2560) and @Charles-Grant (PR #2486).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bun test runs every file in ONE process, so a 500ms setTimeout(process.exit(0))
armed in afterAll fired mid-way through a LATER file and killed the entire
suite with exit 0 and no summary — only ~16 of 434 files ran, and every
downstream failure was invisible (observed live throughout this wave's
enumeration). Changes, all guarded by fault injection:
- Replace every delayed-exit teardown with a time-boxed close of the file's
own browser (8 files across browse/ and design/); stub the daemon
/shutdown timer instead of letting its unconditional process.exit tear
the runner down.
- test/no-suicide-exit.test.ts: static tripwire — no *.test.ts may schedule
a delayed process.exit again.
- test/exit-propagation.test.ts + fixtures: fault injection with REAL bun
output proves the truncation shape (exit 0, no summary) and that
scripts/test-free-shards.ts now detects it: a shard exiting 0 WITHOUT
bun's final summary line is treated as FAILED (exit code alone is not
evidence of completion).
- handoff: the three headed-mode integration tests are darwin-skipped with
a pointer to the known macOS headed-launch breakage (#2242/#2554); they
keep running on Linux CI. Un-skip in the browse-daemon wave.
- feedback-roundtrip: repair the handler call sites unmasked by the fix —
handlers take (command, args, session, bm); passing the manager where a
session belongs broke all six tests.
- user-slug-fallback: HOME isolation makes endpoint_hash deterministic.
Fixes#2421, #2435.
Contributed by @sneakygriff (PR #2172) with repairs from @time-attack
(PR #2230 feedback-roundtrip hunks); supersedes PR #2252 by @whd4 (same
defect, credited).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gstack-update-check signals "up to date" with SILENCE, and it runs under
set -e — so any unguarded mid-script failure exited quietly and was
indistinguishable from a current install. Observed live as a 45-release
silent-staleness incident. An ERR trap (with -E so it propagates into
functions) now emits a CHECK_FAILED sentinel naming the line and status,
and exits 0 so caller `|| true` guards can't eat it. Behavioral tests cover
both the crash and the healthy-silent paths; egress-receipt wiring is
untouched and still pinned by test/egress-receipt-wiring.test.ts.
Fixes#1974. (#2378's HEAD-SHA staleness half was already fixed on main by
the ls-remote + SHA-pinned VERSION resolution — close as already-fixed.)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The not-authed flow told the user to paste their ngrok authtoken into the
chat so the agent could run `ngrok config add-authtoken` — putting a live
credential in the transcript, tool-call argv, and anything the transcript
syncs to. The user now runs the auth command in their own terminal; the
agent only verifies via `ngrok config check`, and a pasted token triggers a
rotate-and-reauth instruction. A static test pins that no agent-run bash
fence ever contains add-authtoken again.
Fixes#2335.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three ways the pushed diff escaped scanning: (1) a user-level diff.external
or textconv driver replaced the diff with its own output — zero '+' lines,
so the scan saw nothing (now --no-ext-diff --no-textconv); (2) an added
content line whose text begins with "++" renders as "+++…" and the blanket
header skip dropped it (now hunk-aware header detection); (3) a pre-push
ref line that failed to parse was silently skipped, leaving that ref
unscanned (now fails closed with the offending line named).
Minimal reimplementation of the two confirmed bypasses from PR #2498 by
@lubosxyz (the full PR overlaps the chunked-scan work absorbed separately),
plus the unparseable-ref hardening.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The chaining wrapper captured stdin with $(cat), which strips the trailing
newline — a chained shell hook built on `while read` then never entered its
loop for the final (usually only) ref line and exited 0, failing OPEN. Use
the printf-x sentinel so the byte-exact input reaches the chained hook, with
tests covering both the pass-through and the short-circuit paths.
Contributed by @francis-eye (PR #2358).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
When the remote default branch is not main/master (or origin/HEAD is unset),
the merge-base guess failed and the hook fell back to scanning the ENTIRE
repository as added lines — re-attributing long-pushed secrets to the
current push and, on any real repo, tripping the engine byte cap so the push
blocked having scanned nothing. Derive the base from commits reachable from
no remote-tracking branch, keep the empty-tree path only for genuinely fresh
repos, and split the block message so an unscannable diff is reported as
"could not scan (fail closed)" rather than "credential found — rotate it".
Contributed by @stormeoio (PR #2398).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GOCSPX-prefixed client secrets and <bot_id>:<35-char> Telegram tokens are
never-publishable credential shapes with unambiguous formats — both now
block at HIGH like the other live-format credentials.
Contributed by @francis-eye (PR #2357).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The prepush guard blocked any push whose added lines exceeded the engine's
1 MiB cap with engine.input_too_large — a size error naming no credential —
which trains people onto GSTACK_REDACT_PREPUSH=skip. Scan in 768 KiB
line-aligned slices instead (no pattern is multi-line, so a boundary cannot
bisect a secret); a single oversized line still goes to the engine intact and
fails closed. Also suppress card/phone matches whose span sits ENTIRELY
inside a UUID — digit-only UUID fixtures were 14 of 21 MEDIUM findings on an
ordinary branch, the noise level that stops people reading MEDIUM at all.
Fixes#2304.
Contributed by @luckywenapere (PR #2543).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The investigate skill's PreToolUse hooks and Scope Lock probe resolved
check-freeze.sh via ${CLAUDE_SKILL_DIR}, which does not exist when
frontmatter hooks run — the || exit 0 tail then failed open, so the debug
scope boundary silently never engaged (#1871 follow-up). Anchor all four
sites on $HOME/.claude/skills/gstack/ like careful/freeze, and add a static
test asserting no frontmatter command: line in the guard-family skills ever
references CLAUDE_SKILL_DIR again.
Fixes#2469; closes the last live half of #1459 together with the
freeze/careful hookSpecificOutput fix. The broader portable-install-root
rewrite stays #1882 (its own focused PR per the TODOS.md decision).
Reported with a fix by @maxpetrusenkoagent (PR #1873; absorbed narrowly —
the cwd-walk rewrite belongs to #1882).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude Code v2.1.198 made subagents run in the background by default, which
inverted the old "do not use the flag" guidance: review-army specialists and
autoplan dual voices silently launched in the background and the merge step
could proceed before they completed — regressing the #497 fix. The generated
guidance now instructs an explicit run_in_background: false, and a static
tripwire fails the free suite if the inert inverted phrasing ever returns to
any generated SKILL.md.
Fixes#2440.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The grep-based command extractor stopped at the first escaped quote, so any
quoted argument truncated the command before the pattern checks ran —
`git commit -m "wip" && rm -rf /` was silently allowed. Replace it with a
python3/node JSON parse that fails CLOSED on unreadable payloads, add an
IFS/base64-to-shell obfuscation tripwire, and stop multi-line commands from
riding the single-line safe-exception whitelist (line-based grep would have
approved `rm -rf /` when a later line matched node_modules — a hazard the
real newline decoding exposed).
Contributed by @wtamminga (PR #2426; the -R hunk was dropped — it landed in
v1.61.0.0 — and output shapes updated to the nested hookSpecificOutput form).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The generated check-gstack.sh emitted a flat permissionDecision payload and
exited 0, which Claude Code ignores — required mode enforced nothing. The
generated hook now nests the deny under hookSpecificOutput and exits 2 so
the block holds even if the JSON schema drifts again. Adds a temp-repo
regression test that runs the generated hook under both installed and
missing-gstack homes.
Fixes#2413, #2296.
Contributed by @Masashi-Ono0611 (PR #2423).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude Code ignores a top-level permissionDecision, so the /freeze deny and
/careful ask guards silently allowed everything. Nest both under
hookSpecificOutput with permissionDecisionReason, update the shape-blind
tests to pin the nested form, and document the constraint in both skill
templates (regen included).
Closes half of #1459 (freeze enforcement chain).
Contributed by @jawadakram20 (PR #2331; team-init hunk deferred to the
dedicated team-init fix).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(helpers): shared skill-census helper with three explicit counts
physicalSkillFiles (symlinked dirs included, root router included),
authoredSkills (realpath-deduped, router excluded), registryEntries
(what ./setup registers: unique frontmatter names + _gstack-command).
One counting authority for the hermetic seeder, context-bill ground
truth, and the catalog-budget test — connect-chrome's dir symlink and
the root router otherwise produce three subtly different hand-rolled
censuses. Ported-wave foundation (C11).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(evals): stop the harness grading itself
findPreviousRun excluded only the file being written, by name, so every
suite compared against _partial-e2e.json — the current run's own
accumulator, relabelled with the current tier just before each flush.
That is why every block read '+$0.00, +0s, Stable run, no regressions.'
This harness has never been able to detect a regression, and reassuring
output that cannot fail is worse than none. In-progress runs are now
excluded by role, and a run with nothing to compare against says NO
BASELINE instead of claiming stability.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit f3140b5245221fff7fb9411c7ec07c2ca11587b5)
* refactor(evals): shared partial-run predicate + finalized-run lookup
isPartialEval(data, filename) is the one place that decides what counts
as an in-progress accumulator (the _partial flag OR a _partial-prefixed
filename), and findLatestFinalizedRun(evalDir, tier) is the one place
that finds the newest real run — scanning the eval dir plus one level of
shards/<slug>/ subdirs, where the sharded paid runner points each
shard's collector. skill-budget-regression.test.ts's hand-rolled
findLatestRun (flag-blind: a flagged-but-renamed accumulator passed its
name check) is replaced by the shared helper.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit b55fcf6966366fd21a8cdc46de61aab6e1b1d100)
* feat(evals): register shipped skills for hermetic PTY children
Hermetic children get a config dir that deliberately seeds no skills —
right for children that install their own, fatal for the PTY family that
TYPES /office-hours or /plan-ceo-review: claude rejects the command as
Unknown before any model turn, so the plan-family gate smokes measure
nothing. hermeticSkillsConfigDir() is a second, opt-in config dir under
the same runRoot that mirrors ./setup's registration exactly (real dir
per registry name, SKILL.md + sections/ symlinks, frontmatter-name
resolution, _gstack-command root alias), driven by the shared
skill-census so connect-chrome's dir symlink collapses the same way
setup's idempotent overwrite does.
Ported from fork commit 03c4eca2, tree walk rewritten for the upstream
layout (top-level <skill>/SKILL.md dirs, no skills/ tree). Unit tests
are new: seed shape, census parity, symlink resolution, connect-chrome
collapse, idempotence, no-API-key seed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 93dae6107b30ce453a07c2d342b60262bba6ce0b)
* feat(evals): seedSkills opt-in for PTY slash-command tests + tripwire
Wire ClaudePtyOptions.seedSkills through launchClaudePty: when set (and
hermetic, and no per-test CLAUDE_CONFIG_DIR override), the child gets
hermeticSkillsConfigDir() so typed /skill slash commands resolve instead
of dying as Unknown command before any model turn. Opted in at the three
runPlanSkill* helpers and the four direct-launch slash-command tests
(plan-design-with-ui, plan-ceo-mode-routing, autoplan-chain,
ship-idempotency).
New static tripwire (test/pty-skill-seeding-wiring.test.ts): any test
file that sends a slash command over the PTY must route through a
runPlanSkill* helper or pass seedSkills: true — an unseeded slash-command
test spends money and measures nothing. hermetic-wiring.test.ts now
blesses the repo-tree seeding path explicitly (config dir under runRoot,
symlinks into the repo checkout, never operator ~/.claude).
The CI "Register gstack skills for PTY smoke" step keeps a keep-me note:
container cross-mount symlinks defeat the TUI scanner and HOME is not
hermeticized, so the real-file copies there must survive this change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 63c52269daaffb833b3105ea9b4b99be6df8fec7)
* refactor(evals): single shared paid-test-set module
test/helpers/paid-test-set.ts is now the one definition of which test
files are paid (the exact globs package.json's test:gate expands).
scripts/test-free-shards.ts derives its free/paid exclusion from it
instead of a private regex list, dropping the dead
browse/test/security-review-fullstack.test.ts pattern (file no longer
exists). The sharded paid runner derives its enumeration from the same
module, so a file added to one list can no longer silently miss the
other.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit a7f36479a6a1f3656452370f5883371f3cb65623)
* feat(evals): env-driven lazy eval dir + shard-aware store and tooling
Importing eval-store no longer spawns the gstack-slug subprocess: the
module-level DEFAULT_EVAL_DIR constant is now a memoized defaultEvalDir()
resolved at collector construction. Resolution order: explicit
constructor arg, then GSTACK_EVAL_DIR, then slug detection — so the
sharded paid runner can point each shard child at its own
<evalDir>/shards/<slug>/ dir with plain env, no --preload.
Runs collected under a shards/ subdir record their slug in the eval
JSON (EvalResult.shard). findPreviousRun scans one shards/<slug>/ level
and prefers same-slug priors, so each shard baselines against its own
history instead of whichever shard flushed last. eval:list,
eval:summary, and eval:compare enumerate the same one level of shard
subdirs; eval:compare's no-arg mode also stops picking an in-progress
accumulator as the after-run.
eval-watch stays flat (documented follow-up): it tails a single dir for
live progress and gains nothing from per-shard baselines until the
runner emits a merged stream.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit e1f53f7d9c7fe6b65877d843f2e25bd2e2d12ffd)
* feat(evals): sharded paid tier runner
scripts/test-paid-shards.ts runs the gate/periodic tier one Bun process
per test file, with an EXTERNAL wall-clock timeout that SIGKILLs the
shard's detached process group and an aggregate that distinguishes
passed / failed / timed-out / never-started — partial execution can no
longer read as a pass. Bun's native --shard/--isolate covers none of
this: no process-group kill (hung claude/codex PTY grandchildren
survive in-process isolation), no never-started taxonomy, no per-shard
env. Each shard child gets GSTACK_EVAL_DIR=<evalDir>/shards/<slug>/
(slug = test filename sans extension, stable across runs) so shard
baselines compare against their own prior runs.
Output classification lives in scripts/test-strict-output.ts (strict
exit-code derivation, incremental fail-line classifier, child signal
forwarding) so the runner and any future strict bun-test wrapper share
one implementation. Enumeration derives from the shared paid-test-set
module; tier exclusion fires only on an explicit whole-file
EVALS_TIER === '<other>' guard.
package.json gains test:gate:sharded / test:periodic:sharded, and
eval:bg:gate / eval:bg:periodic now run the sharded scripts with detach
timeouts sized to the worst case (gate: 49 shards x 30min / 4 jobs ~
6.2h -> 25200s; periodic: 59 -> 28800s).
test/paid-shards.test.ts pins enumeration, tier classification, and the
kill-and-continue property with a real busy-loop shard.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 5e76bd5931836257f896cedfe4e93912cb759c70)
* feat(security): hash-chained egress receipt ledger (core)
Port lib/egress-receipt from the v2 fork as TypeScript: writeReceipt
(sync, fail-closed via typed EGRESS_RECEIPT_FAILED), best-effort
writeOutcome, readLedger/listReceipts/verifyLedger, GSTACK_HOME ->
GSTACK_STATE_DIR -> ~/.gstack resolution, 0600 ledger under a 0700
security dir, and an mkdir spin lock (2.5s budget) with documented
>10s-mtime stale-lock reclaim.
Changes vs the fork:
- lastRawLine tail-reads the final 4KB instead of loading the whole
ledger, so appends stay O(1) as the file grows.
- WARN-at-size: past 25MB writeReceipt emits one self-explanatory
stderr warning per process (what the ledger is, how to inspect it,
rotation TODO); verifyLedger gains a sizeWarning field. Rotation
TODO carries the chain-genesis sketch (new generation's first record
embeds the prior file's tail hash).
bin/gstack-egress-receipt is a bun script bridging shell callers:
write|outcome subcommands, exit 3 + EGRESS_RECEIPT_FAILED on stderr on
failure; --no-payload records sha256:null for git-class ops.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 619726a3d77d987a2e50151a5727b3faaaf5fc6a)
* chore(bin): delete dead brain-consumer/reader scripts
bin/gstack-brain-consumer and bin/gstack-brain-reader are byte-identical
dead scripts that POST the repo URL + a Bearer token to a /ingest-repo
endpoint gbrain removed (docs/gbrain-sync.md already documents the
removal in past tense). No live references remain; CHANGELOG mentions
are historical.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 254ddc69fc5a0270fcc973e36b6a81766d835d2d)
* feat(security): shared shell receipt helpers
bin/gstack-egress-lib.sh (sourced library, gstack-gbrain-lib.sh
precedent) provides _receipted_curl and _receipted_git: write the
egress receipt BEFORE the send via gstack-egress-receipt, hand curl the
SAME payload file via --data-binary @file so the receipt hash matches
the wire bytes exactly, then append a best-effort outcome. Per-call
fail policy: 'closed' refuses the send (return 3, problem/cause/fix
message on stderr) and 'open' warns and proceeds. Payload temp files
are consumed immediately per call — no EXIT traps, since callers like
gstack-telemetry-sync own their own EXIT trap and a sourced trap would
clobber it.
Tested end-to-end against a local Bun.serve listener: receipt sha256
equals the sha256 of the bytes the listener received, fail-closed
refusal never touches the network and carries the problem/cause/fix
stderr shape, fail-open warns and proceeds.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 6d067dce2d4c8815dec98be551763c85a3671357)
* feat(security): receipt core shell sinks
Wire the three core bash egress sinks through gstack-egress-lib.sh:
- gstack-telemetry-sync: the batch POST now writes the payload to a
temp file, receipts those exact bytes fail-closed, and hands curl the
SAME file. On refusal nothing is sent and the cursor does not
advance, so the batch stays buffered for the next run. The HTTP
status is recorded as the receipt outcome.
- gstack-update-check: fail-open receipts (warn + proceed) on the
Supabase ping POST, both VERSION curls (via a local
_receipted_version_fetch helper that skips non-network schemes), and
git ls-remote. The ping receipt is written inside the backgrounded
subshell, so it can never block the script's exit.
- gstack-brain-sync: fail-closed git-class receipts. The push receipt
is written BEFORE the commit consumes the queue, so a refused receipt
leaves the queue intact and the next run retries the whole drain
(pinned by a new queue-intact-on-refusal test, including the
problem/cause/fix refusal message shape). The retry-path fetch and
retry push carry their own fail-closed receipts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 3c60f699acceaf1c92a218874711e05fc17dca5d)
* feat(security): receipt TS module sinks + tunnel
writeReceipt (fail-closed, sha256:null — a subprocess or SDK owns the
wire bytes) before every TS-module network-bearing operation:
- bin/gstack-gbrain-sync.ts: before the gbrain code walk that ships
repo content to the user's gbrain DB (may be remote Postgres). A
refused receipt fails the stage with status refused-egress-receipt.
- bin/gstack-memory-ingest.ts: before the gbrain batch import of
transcript pages. A refused receipt returns a system_error verdict
without spawning the import.
- browse/src/server.ts: before both ngrok.forward call sites (start-up
BROWSE_TUNNEL=1 path and the /tunnel/start endpoint). A receipt
failure lands in the existing catch that tears the tunnel listener
back down and refuses the start.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 5677d618a48fcd0ae2b068bf868781d90f809cb5)
* feat(design): receipted fetch for OpenAI calls
design/src/receipted-fetch.ts wraps every api.openai.com call: a
content-free egress receipt (sink design-openai, sha256 of the JSON
body — hash only, never the body) is written BEFORE the send. Polarity
is FAIL-OPEN: user-facing generation must not die because an audit log
hiccuped, so a receipt failure warns on stderr and the call proceeds.
Streams pass through untouched (response bodies returned as-is;
non-string request bodies receipted as sha256:null rather than drained
to hash).
All ten call sites converted with per-command payload classes:
generate, variants (injected fetchFn passes through), iterate (both
threaded and fresh paths), evolve (image + screenshot analysis), check,
diff, design-to-code, memory.
Unit-tested with injected fetch: receipt-before-send ordering, stream
passthrough, and fail-open on an unwritable ledger.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit c0e5ff6639414ac2fd98e8ac3affb51401746b55)
* feat(security): receipt admin scripts + user git-ops (zero exceptions)
Wire the remaining shell egress through gstack-egress-lib.sh:
- gstack-gbrain-mcp-verify: both JSON-RPC probe POSTs (initialize +
tools/list) receipted fail-closed via payload files (hash == wire
bytes). A refused receipt lands in the NETWORK class — no send.
- gstack-security-dashboard / gstack-community-dashboard: the
community-pulse GETs receipted fail-open (read-only stats must not
break over an audit hiccup).
- gstack-gbrain-supabase-provision: api_call receipted fail-closed.
Each retry attempt hands the helper a fresh copy of the body file
(the helper consumes its payload). The receipt hashes the request
body only — the PAT never reaches the ledger or any log. Refusal
exits 8 without retrying.
- git-class sha256:null receipts, fail-open: gstack-artifacts-init
(ls-remote, initial push, fetch/pull recovery, retry push),
gstack-brain-restore (staging clone, existing-repo fetch),
gstack-session-update (self-update pull).
gstack-team-init needs no wiring: every git clone in it is inside an
echoed instruction string, not an executed command.
The lib now self-locates with shell builtins only (no dirname), so
sourcing works under the whitelist-PATH test harnesses.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit b8c5e2055b21ab72878b3e46f8047782ee65a11c)
* test(security): egress wiring tripwire + polarity contract
Static-grep tripwire pinning the egress-receipt wiring (threat model in
the header: the ledger is forensic observability of ATTEMPTED egress,
not an exfiltration control):
- Per-sink assertions: every wired TS module imports egress-receipt and
calls writeReceipt; every wired shell sink sources
gstack-egress-lib.sh with each network op under a receipt;
ngrok-proximity check for server.ts; every design api.openai.com call
routes through receiptedFetch.
- Absence assertions: the dead brain-consumer/reader scripts stay
deleted (lstat, so a dangling symlink also fails).
- Polarity table pinned as data (fail-closed: brain-sync,
memory-ingest, gbrain-sync, telemetry-sync, ngrok, mcp-verify,
supabase-provision; fail-open: design-openai, update-check,
dashboards, git-class user ops, context-bill --exact) plus per-file
polarity spot-checks.
- NEW-SINK SCANNER with zero KNOWN_UNWIRED: sweeps bin/, lib/,
scripts/, design/src, browse/src for curl, absolute-URL fetch(, and
git remote ops (never local rev-parse/get-url; heredoc bodies and
message strings excluded) and requires every hit to be receipted or
in a REASONED exemption list where each entry carries its why.
Preamble-generated skill prose documented out-of-scope in the header.
- Shebang tripwire: no bin/gstack-* file may carry a node shebang.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit ff69ceeafaf9c017d539b6ad77ff8f95b680b979)
* feat(cli): gstack-egress reader
bin/gstack-egress (bun) — the auditor's view of the receipts ledger:
- list: one row per receipt (what gstack ATTEMPTED to send), with
--since/--host/--sink filters and --json.
- verify: recompute the hash chain; exit 3 on tamper naming the first
broken line; prints the sizeWarning when the ledger passes 25MB.
- grants: what CAN leave, built on the upstream config keys only
(telemetry, artifacts_sync_mode, redact_repo_visibility,
redact_prepush_hook via gstack-config get) — each grant names its
file, key, and the exact revoke command.
CLI smoke tests spawn the real bin against a temp GSTACK_HOME,
including a broken-chain fixture asserting exit 3.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 9e24eca0f1069fea2ea69e7df4e9b256e93d59a3)
* feat(cli): context-bill — token bill-of-materials (stripped port)
lib/context-bill.ts, ported from the v2 fork and STRIPPED to the tiers
this repo's skills can exercise: ALWAYS-ON (per-skill frontmatter bytes
with dead-key and foreign-host-file flags), EAGER (SKILL.md + any
forced 'for every invocation' references), on-disk totals, --diff,
--budget, and --exact with the calibration table. The fork's
CONDITIONAL/TRANSITIVE/LAZY/FAST-PATH parsers understand only its
dispatcher layout and were dropped; the tier fields stay in the report
shape (empty/zero/null) so re-adding a parser is additive.
TOKEN_DIVISORS and their provenance docblock kept; --help notes
recalibration via --exact's calibration block.
Three upstream fixes over the fork:
(a) findSkillDirs treats the walk ROOT as a container — the repo root's
router SKILL.md is billed AND its children are walked (the fork
short-circuited and billed one skill); walkMd skips node_modules
and dot-directories.
(b) installed-tree layout: subdirs that are their own repo checkout
(a gstack/ clone inside ~/.claude/skills, detected by .git) are
skipped, and directory symlinks (connect-chrome) are followed with
a container-recursion cycle guard.
(c) ROUTER_KEYS widened to the upstream frontmatter contract {name,
description, version, allowed-tools, triggers, preamble-tier}.
--exact writes an egress receipt (sink context-bill-exact, host
api.anthropic.com) BEFORE any count_tokens POST; if the receipt cannot
be written the run degrades to the offline estimate with a warning —
nothing is sent unrecorded. bin/gstack-context-bill is the bun shim.
Tests: fixture-tree ledgers, the three fixes, --diff/--budget exit
codes, --exact with injected fetch (envelope subtraction, receipt
ordering, fail-open degradation), CLI smoke test, and ground truth
against THIS repo via test/helpers/skill-census.ts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 675c19876b87ec927b555f5f64c7f93130b3de90)
* test(catalog): aggregate discovery-surface budget with ratchet protocol
Every host loads every skill's frontmatter name + description at
discovery, every session. applyCatalogTrim in scripts/gen-skill-docs.ts
shapes each description and the 160KB per-file warn covers body size,
but nothing capped the aggregate frontmatter — the catalog could grow
one reasonable-looking description at a time. This test is that
enforcement layer.
Measures the catalog via test/helpers/skill-census.ts authoredSkills
(symlink-deduped, root router counted separately as the _gstack-command
alias line item): 53 skills + router = 4,420 bytes = 1,105
token-equivalents today, asserted <= 1,150 (~4% headroom). Per-skill
sub-cap of 260 bytes (largest today: design-consultation at 229), plus
a non-empty-description check.
Failure messages are self-service ratchets: they print the new total,
the delta, and the update protocol (bump the constant AND the
derivation comment in the same commit; trim instead of grow for
existing descriptions). Parser handles folded block scalars
(description: >-) for fork parity; import-free by design so it
survives generator refactors.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit c106fb36f768181b80c257e5cff1cde4f435f9c0)
* fix(browse): extension token bootstrap moves to pinned-origin POST; /health carries no token
GET /health is now liveness/status only in every mode — both token
carve-outs (headed-mode disjunct AND chrome-extension:// Origin
disjunct) are removed. Token bootstrap is POST /extension-token on the
local listener: the Origin header must be exactly
chrome-extension://<GSTACK_EXTENSION_ID> and the Host header's hostname
must parse to 127.0.0.1 or localhost (parsed via new URL, never literal
equality — Host arrives as '127.0.0.1:34567'). Wrong origin/host → 403
with no detail. The tunnel surface 404s the endpoint (not in
TUNNEL_PATHS, verified by test).
The extension ID is pinned by a new "key" field (RSA public key) in
extension/manifest.json; browse/scripts/extension-id.ts reproduces the
ID derivation (first 16 bytes of SHA-256 of the DER public key, hex
mapped 0-9a-f → a-p). The private key is not committed anywhere —
unpacked/baked-in loads only need the public key.
Extension side: background.js bootstraps and refreshes the token via
POST /extension-token (403 → disconnected state); sidepanel.js direct
connect path does the same; sidepanel-terminal.js's dead /health token
fallback (read AUTH_TOKEN/authToken keys the server never sent,
hardcoded port) is replaced with the window.gstackAuthToken path.
MIGRATION NOTE: the manifest key pins the extension ID, so existing
installs' side-panel local state (saved port, snoozes) resets once —
explained in-product via a one-time notice (flag
gstack_id_migrated_v162). After upgrading the server, restart the
browser so the old service worker stops polling for a token GET /health
no longer serves.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit e9a0b6847a2d17fe6656a4686b4efd0c8380eb09)
* docs: correct stale compiled-binaries claim; file three egress/eval follow-ups
CLAUDE.md's compiled-binaries section claimed browse/dist binaries are
tracked by git and appear as modified in git status — false since
64d5a3e4 (v0.11.16.0) untracked them, and actively harmful: it trained
agents to ignore dist binaries in git status. The section now states
the truth (untracked + gitignored; a dist binary in git status means
someone force-added it) and covers make-pdf/dist too.
TODOS.md gains the three follow-ups filed by the v1.62 port-wave
reviews: ledger rotation with chain-genesis records, launch-nonce
token bootstrap, and eval-watch shard-awareness.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: pre-landing review fixes for the v2 port wave
Review army (checklist + 5 specialists) + coverage/plan audits on the
assembled branch. Genuine correctness/security/hygiene fixes:
- test-paid-shards: strictTestExitCode now receives expectedFiles on the
real bun path, so a shard that runs fewer files than planned (harness
crash, nothing loaded) with exit 0 is no longer recorded 'passed' — the
invisible-non-execution class the runner exists to kill. Pinned by the
new test/strict-output.test.ts (also covers the chunk-boundary classifier).
- test-paid-shards: EVALS_TIER env is validated (gate|periodic) like the
--tier flag, so a typo can't self-skip every test and exit 0 green.
- package.json: test:periodic:sharded sets EVALS_ALL=1, restoring the
full-tier semantics the pre-shard script had (CI already set it; local
eval:bg:periodic silently under-measured without it).
- brain-sync.test: run() pins HOME to the temp home so gstack-artifacts-init
stops writing/clobbering the operator's real ~/.gstack-artifacts-remote.txt
every free-suite run; afterEach now also scrubs the current filename.
- egress-receipt: cap each receipt field at 512B so a serialized line always
fits the 4KB tail-read window — a longer line would make the next append
hash a truncated prior line and verifyLedger report a permanent false
TAMPER. warnLedgerSize short-circuits before statSync once fired (append
hot path).
- gstack-egress: import.meta.dir (Windows-safe) instead of new URL().pathname
so grants doesn't silently report defaults on Windows; strip control chars
from ledger-derived fields on render so a crafted receipt can't spoof the
auditor's view.
- extension/background.js + CLAUDE.md: renumber the identity-pin migration
refs v1.62 -> v1.63 (main claimed 1.62.0.0; this wave queue-advances).
- egress-receipt-wiring: pin lib/context-bill.ts unconditionally (both land
together now); drop the dead RunShardsOptions.tier field.
All fix-affected test files green; gate failures triaged as external-env
(codex/gemini CLI drift) or pre-existing (hermetic-canary fails identically
on base). Deferred polish tracked in the PR body + decision store.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore: bump version and changelog (v1.63.0.0)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: file TODO to harden plan-design-with-ui PTY detection
The v1.63 seedSkills change made this gate test execute for the first
time; it reliably times out because its terminal scraper can't parse the
(correctly-rendered) scope-gate AskUserQuestion out of a spinner-mangled
PTY buffer. Shipped skill behavior is correct — test-harness limitation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore: re-slot release as v1.62.1.0 (PATCH per user)
Main claimed 1.62.0.0 while the wave was in flight; the user chose the
PATCH slot over queue-advancing MINOR. Renumbers the identity-pin
migration notice (now version-free flag name so a re-slot never orphans
an already-set flag), the CLAUDE.md /health note, the CHANGELOG heading,
and the TODOS section titles.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): stop hard-requiring the literal ok) case label in gbrain-refresh guards
The extractor grepped for 'ok)' but the case label grew to
ok|timeout|thin-client) (#1964, #2051), so the whole file errored on
import — the free suite's only red for months. The extractor now matches
any label starting with ok and its alternations; all 7 guard assertions
run again.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): hermetic-canary probes with ${VAR:-} so nounset shells can't fail success
The probe echoed bare $CONDUCTOR_WORKSPACE_PATH — when scrubbing WORKS
the var is unset, and under a nounset shell the echo errors, failing the
canary exactly when isolation succeeds. Defaulted expansions assert
identically under any shell. Fails identically on base; fixed here.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(evals): absorb codex/gemini CLI drift; external-service tests go periodic-tier
- codex exec gains --skip-git-repo-check: newer CLIs refuse exec in an
untrusted non-git dir (our temp skill dirs) — empirically verified.
- gemini: --skip-trust was removed in gemini-cli 0.34 (argv parse error);
dropped from the session runner and the benchmark adapter. A present-
but-unusable CLI (deprecated individual code-assist auth path) now
classifies as SKIP, not a false adapter failure; the benchmark live
smoke skips on auth/rate_limit error codes (environmental) while still
failing on timeout/unknown (the drift classes it exists to catch).
- codex-e2e, gemini-e2e, and benchmark-providers gain the canonical
whole-file EVALS_TIER === 'periodic' guard per CLAUDE.md tiering rule 3
(external service -> periodic) — the sharded gate runner now excludes
all three (gate: 45 -> 42 shards).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(evals): parse single-logical-line AskUserQuestions in the PTY runner
When the PTY reflows a boxed AUQ, ALL options land on ONE logical line
after stripAnsi — parseNumberedOptions parsed one option per line, found
only '1.', and the >=2 check failed forever while the correct question
sat on screen (plan-design-with-ui timed out this way twice, with the
rendered scope-gate AUQ visible in both failure buffers). The cursor
line is now parsed as a stream of ascending N. tokens; DEC cursor-
visibility residue is stripped before matching; plan-design-with-ui's
budgets grow to fit observed ~6min preamble+thinking latency. Pinned by
test/pty-auq-single-line.test.ts using the real failure buffers; all 142
existing parser-consumer unit tests still green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore: restore v1.63.0.0 (MINOR — user-confirmed final slot)
The wave ships new capability (egress receipts + two CLIs, sharded paid
runner, hermetic skill seeding) at ~8K lines — MINOR scale per the
scale-aware bump rules. Supersedes the brief v1.62.1.0 re-slot; the
version-free migration flag means no state churn from the renumber.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: spell out AskUserQuestion in the PTY single-line fixture
Rename test/pty-auq-single-line.test.ts to
test/pty-askuserquestion-single-line.test.ts and expand the AUQ
abbreviation in identifiers and comments. House style writes
AskUserQuestion in full in filenames, identifiers, and comments.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: sync every doc surface with the v1.63 release
/document-release audit (4-lane, all claims verified against branch code):
- README: gstack-egress + gstack-context-bill rows in the standalone-binaries
table; Privacy & Telemetry gains the receipted-egress bullet (attempted-
egress framing per the shipped threat model).
- ARCHITECTURE: /health is liveness-only, POST /extension-token endpoint row
+ bootstrap mechanics paragraph; new Egress receipt ledger subsection under
Security model; eval persistence covers the sharded runner, GSTACK_EVAL_DIR,
and the finalized-run baseline rule.
- CLAUDE.md: sharded test scripts in Commands; sharded semantics in the
detached-evals section; PTY skill seeding in the hermetic section; egress
invariant block beside the other server-egress invariants; catalog-budget
ceiling beside the 160KB token ceiling; project-tree entries for
lib/egress-receipt.ts, lib/context-bill.ts, scripts/test-paid-shards.ts.
- CONTRIBUTING: seedSkills + live-tree seeding in the hermetic paragraph;
sharded runner in detached runs; catalog-budget in the Tier 1 list.
- BROWSER: extension token bootstrap section, tunnel egress receipts section,
identity-pin migration note in manual install.
- REMOTE_BROWSER_ACCESS: tunnel-start receipt bullet in the security model.
- gbrain docs: /sync-gbrain + brain-sync egress-receipt behavior documented;
dead consumer-token instructions removed (consumer machinery deleted this
release); new fail-closed refusal added to the error catalog.
- CHANGELOG: measured-vs-ceiling catalog numbers, contributor notes for the
external-service tier move and the PTY single-line AskUserQuestion parser,
release date.
- TODOS: /health token-distribution TODO resolved by this release, removed;
port-wave follow-up sections re-labeled to the shipped version.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: sweep drift that predates this release
Surfaced by the /document-release audit; every fix verified against the
current binaries:
- gstack-brain-init was replaced by gstack-artifacts-init in v1.27.0.0
(hard-delete, no compat shim), but README, USING_GBRAIN_WITH_GSTACK,
docs/gbrain-sync.md, and docs/gbrain-sync-errors.md still instructed
users to run it — command-not-found on every follow. Same sweep updates
~/.gstack-brain-remote.txt to the canonical ~/.gstack-artifacts-remote.txt
(legacy name still honored on restore, noted where users copy the file).
- gbrain-sync-errors.md headings re-matched to the literal messages the
binaries print today (the doc's whole value is grep-by-exact-message):
'gstack-artifacts-init: ~/.gstack/ is already a git repo pointing at:',
'Remote not reachable via SSH:', 'Failed to create or find ...'. The
already-a-repo fix now leads with the command's own set-url suggestion.
- docs/gbrain-sync.md 'Under the hood' linked a plan file that does not
exist in the repo; replaced with the decisions themselves.
- SIDEBAR_MESSAGE_FLOW startup timeline: /pty-session responds with
{terminalPort, sessionId, attachToken, leaseExpiresAt} (v1.44 shape,
verified at browse/src/server.ts:1860), not the retired
{terminalPort, ptySessionToken} pair.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: fold the Codex accuracy review of the release docs
Six findings, all verified against source before fixing:
1. 'Every send writes a receipt' overclaimed — fail-open sinks proceed with
a stderr warning when the receipt write fails, so a fail-open send can go
unrecorded (lib/egress-receipt.ts:8-14). Descriptive prose now says so;
the receipted framing keeps 'attempted'.
2. 'Receipts hash the request body' is wrong for subprocess-owned sends —
git pushes record sha256: null (lib/egress-receipt.ts:71).
3. 'grants shows every consent in force' overclaimed — it reports the four
standing config settings (bin/gstack-egress:139-181). Reworded in
README, ARCHITECTURE, and the CHANGELOG entry.
4. 'Zero-exception scanner' vs reality: the new-sink scanner carries a
reasoned SCANNER_EXEMPT list (user-directed fetches, probes, instruction
strings, skill prose). CLAUDE.md now names it.
5. Error-catalog cause/fix for the receipt refusal: the writer mkdirs the
ledger dir itself, so 'missing' isn't a cause and bare chmod fails when
it is absent — cause reworded, fix is mkdir -p && chmod.
6. gbrain-sync first-run steps described the retired binary's behavior:
default repo is gstack-artifacts-$USER, and init PRINTS the gbrain
hookup command (never auto-executes; bin/gstack-artifacts-init:384-419).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Sinabina <sinabina@Sinabinas-MacBook-Pro-4.local>
Garry Tan