RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
gstack/bin
History
Scott 258e6a1452 fix(redact-prepush): don't re-scan commits a catch-up merge brought in 
`remoteSha..localSha` is "everything new on this branch", which is not the
same as "everything new to the remote". Merge origin/main into a feature
branch and every commit main gained since that branch's last push becomes
an added line — content that is already published, already scanned, and
not this push's doing.

Two consequences, both observed:

  · FALSE HIGH FINDINGS. A placeholder connection string in a fixture
    someone else had already merged blocked an unrelated push as
    db.url_with_password, telling the operator to rotate a credential
    over a file they never touched. A guard that cries wolf on catch-up
    merges is one people learn to bypass reflexively — which is exactly
    how a real secret gets through.
  · OVERSIZED SCANS. The SCAN_CHUNK_BYTES comment already records a
    1,146,782-byte diff from "a feature branch catching up to a busy
    main" blowing the engine's 1 MiB cap. Same root cause, treated there
    as a size problem. Narrowing the range fixes the size too.

A two-dot range cannot express this: after merging main, neither the
remote tip nor the merge-base with main is an ancestor of the other, so
no single base excludes both.

The narrowed range is `rev-list localSha --not remoteSha --remotes`.
remoteSha STAYS the base — it is what git tells us the remote has, and is
authoritative in a way --remotes is not, since tracking refs can be
absent or stale. Using --remotes alone excludes nothing in a repo without
them, so every commit ever made reads as new. That is the same false
positive from the other direction, and it is what the existing test
"only NEW content is scanned (remote..local), not pre-existing" catches.

When excluding tracking refs changes nothing, this push has no catch-up
commits and the plain range already describes it exactly — so we defer to
it. That keeps every non-catch-up push on the original gitStrict diff
path, which is what #1946's fail-closed regression test exercises. A
narrowing that silently retired that test would be a worse trade than the
false positives it set out to fix.

Each commit is diffed alone. A merge's combined diff shows only content
present in no parent, so a secret introduced while resolving a conflict
is still caught while an ordinary merge contributes nothing.

Tests: 22/22 existing prepush tests still pass (two of them fail without
the remoteSha base and the defer-to-plain-range guard respectively —
verified by mutation). 5 new tests build real repositories on disk and
pin both directions: a catch-up merge no longer re-scans published
content, and secrets in new commits, in merge resolutions, and in
repos with no remote are all still scanned.
 		2026-08-15 18:12:52 -05:00
..
dev-setup v1.57.9.0 feat: source-clean gbrain render (dev-setup --out-dir + machine-wide gbrain-refresh) (#1951) 2026-06-09 22:29:23 -07:00
dev-teardown v1.57.9.0 feat: source-clean gbrain render (dev-setup --out-dir + machine-wide gbrain-refresh) (#1951) 2026-06-09 22:29:23 -07:00
gstack-analytics feat: opt-in usage telemetry + community intelligence platform (v0.8.6) (#210) 2026-03-19 17:21:05 -07:00
gstack-artifacts-init v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-artifacts-url v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642) 2026-05-21 21:21:07 -07:00
gstack-brain-cache v1.57.6.0 fix wave: 8 community bugs (4 security guards failing open) (#1911) 2026-06-08 06:39:38 -07:00
gstack-brain-context-load.ts v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-brain-enqueue v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351) 2026-05-06 19:37:53 -07:00
gstack-brain-restore v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-brain-sync v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-brain-uninstall v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351) 2026-05-06 19:37:53 -07:00
gstack-builder-profile feat: gstack v1 — simpler prompts + real LOC receipts (v1.0.0.0) (#1039) 2026-04-18 15:05:42 +08:00
gstack-code-intelligence v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-codex-probe codex + Apple Silicon hardening wave (v0.18.4.0) (#1056) 2026-04-18 12:30:54 +08:00
gstack-codex-session-import v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572) 2026-08-15 09:37:04 -07:00
gstack-community-dashboard v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-config v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-context-bill v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-decision-log v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-decision-search v1.57.5.0 feat: cross-session decision memory + gbrain dream-stage call graph (#1910) 2026-06-08 06:20:58 -07:00
gstack-detach v1.58.1.0 feat: hermetic local E2E + Conductor prose AskUserQuestion (#2004) 2026-06-14 11:40:57 -07:00
gstack-developer-profile v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-diff-scope v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-distill-apply v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741) 2026-05-28 18:21:09 -07:00
gstack-distill-free-text v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-egress v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-egress-lib.sh v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-egress-receipt v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-extension feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517) 2026-03-26 11:15:24 -06:00
gstack-first-task-detect v1.58.5.0 feat: first-run activation scaffold + gstack router front door (#2078) 2026-06-25 09:42:45 -07:00
gstack-gbrain-detect v1.61.0.0 fix wave: guards failing open / silent failures (9 fixes, 4 community PRs absorbed) (#2472) 2026-08-08 09:28:45 -07:00
gstack-gbrain-install v1.55.0.0 fix wave: gbrain data-loss guards + browser crash-loop + 6 more (#1808) 2026-05-30 14:57:07 -07:00
gstack-gbrain-lib.sh v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642) 2026-05-21 21:21:07 -07:00
gstack-gbrain-mcp-verify v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-gbrain-repo-policy v1.12.0.0 feat: /setup-gbrain — coding-agent onboarding for gbrain (#1183) 2026-04-24 01:38:21 -07:00
gstack-gbrain-source-wireup v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351) 2026-05-06 19:37:53 -07:00
gstack-gbrain-supabase-provision v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-gbrain-supabase-verify v1.12.0.0 feat: /setup-gbrain — coding-agent onboarding for gbrain (#1183) 2026-04-24 01:38:21 -07:00
gstack-gbrain-sync.ts v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-global-discover.ts v1.41.1.0 fix wave: 7 HIGH bugs from external audit + regression tests (PR #1169 follow-up) (#1592) 2026-05-20 06:56:41 -07:00
gstack-ios-qa-daemon v1.43.0.0 feat: iOS device-farm (5 skills, Mac daemon, Tailscale) (#1574) 2026-05-21 16:09:26 -07:00
gstack-ios-qa-mint v1.43.0.0 feat: iOS device-farm (5 skills, Mac daemon, Tailscale) (#1574) 2026-05-21 16:09:26 -07:00
gstack-ios-qa-regen fix(ios-qa): generate app-owned bridge accessors deterministically 2026-07-14 16:35:30 -07:00
gstack-jsonl-merge v1.55.0.0 fix wave: gbrain data-loss guards + browser crash-loop + 6 more (#1808) 2026-05-30 14:57:07 -07:00
gstack-learnings-log v1.58.4.0 fix: high-priority community bug wave + PTY plan-mode smoke gate (#2077) 2026-06-21 07:15:19 -07:00
gstack-learnings-search v1.57.6.0 fix wave: 8 community bugs (4 security guards failing open) (#1911) 2026-06-08 06:39:38 -07:00
gstack-memory-ingest.ts v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-model-benchmark v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-next-version v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-patch-names fix: ship idempotency + skill prefix name patching (v0.14.3.0) (#693) 2026-03-30 22:25:46 -06:00
gstack-paths v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-pr-title-rewrite.sh v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-question-log v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-question-preference v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-redact v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-redact-prepush fix(redact-prepush): don't re-scan commits a catch-up merge brought in 2026-08-15 18:12:52 -05:00
gstack-relink v1.43.2.0 fix wave: post-Daegu paper-cut — 18 fixes, 28 bisect commits (#1642) 2026-05-21 21:21:07 -07:00
gstack-repo-mode fix(repo-mode): reuse canonical cached project slug (#2212) 2026-07-10 03:09:13 -07:00
gstack-review-log feat(v1.9.0.0): gbrain-sync — cross-machine gstack memory (#1151) 2026-04-23 17:54:54 -07:00
gstack-review-read fix: gstack-slug bash compatibility — source to eval (#354) 2026-03-22 21:02:01 -07:00
gstack-security-dashboard v1.63.0.0 feat: GStack 2 fork port wave — egress receipts, context-bill, sharded gate, /health fix (#2541) 2026-08-14 09:28:56 -07:00
gstack-session-kind v1.57.2.0 feat: AskUserQuestion prose fallback when the tool fails at runtime (#1908) 2026-06-07 21:38:21 -07:00
gstack-session-update v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572) 2026-08-15 09:37:04 -07:00
gstack-settings-hook v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-slug v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-specialist-stats feat: adaptive gating + cross-review dedup for review army (v0.15.2.0) (#760) 2026-04-04 22:46:21 -07:00
gstack-taste-update feat(v1.3.0.0): open agents learnings + cross-model benchmark skill (#1040) 2026-04-19 17:50:31 +08:00
gstack-team-init v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-telemetry-log v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-telemetry-sync v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-timeline-log v1.27.0.0 feat: /setup-gbrain Path 4 (remote MCP) + brain → artifacts rename (#1351) 2026-05-06 19:37:53 -07:00
gstack-timeline-read v1.44.1.0 fix wave: post-windhoek paper-cut — 9 community PRs in one bundle (#1682) 2026-05-25 10:57:15 -07:00
gstack-uninstall v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741) 2026-05-28 18:21:09 -07:00
gstack-update-check v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571) 2026-08-14 22:02:07 -07:00
gstack-verify-gate v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577) 2026-08-15 11:42:19 -07:00
gstack-version-bump v1.54.0.0 feat: carve /ship into skeleton + on-demand sections (-59% always-loaded) (#1806) 2026-05-30 12:09:10 -07:00