mirror of https://github.com/garrytan/gstack.git
a7593d70ef
* fix: cookie picker auth token leak (CVE — CVSS 7.8) GET /cookie-picker served HTML that inlined the master bearer token without authentication. Any local process could extract it and use it to call /command, executing arbitrary JS in the browser context. Fix: Jupyter-style one-time code exchange. The picker URL now includes a one-time code that is consumed via 302 redirect, setting an HttpOnly session cookie. The master AUTH_TOKEN never appears in HTML. The session cookie is isolated from the scoped token system (not valid for /command). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: bump version and changelog (v0.15.17.0) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: browse-snapshot E2E turn budget too tight (7 → 9) The agent consistently uses 8 turns for 5 snapshot commands because it reads the saved annotated PNG to verify it was created. All 3 CI attempts hit error_max_turns at exactly 8. Bumping to 9 gives headroom. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| activity.ts | ||
| browser-manager.ts | ||
| buffers.ts | ||
| bun-polyfill.cjs | ||
| cdp-inspector.ts | ||
| cli.ts | ||
| commands.ts | ||
| config.ts | ||
| content-security.ts | ||
| cookie-import-browser.ts | ||
| cookie-picker-routes.ts | ||
| cookie-picker-ui.ts | ||
| find-browse.ts | ||
| media-extract.ts | ||
| meta-commands.ts | ||
| network-capture.ts | ||
| path-security.ts | ||
| platform.ts | ||
| read-commands.ts | ||
| server.ts | ||
| sidebar-agent.ts | ||
| sidebar-utils.ts | ||
| snapshot.ts | ||
| tab-session.ts | ||
| token-registry.ts | ||
| url-validation.ts | ||
| welcome.html | ||
| write-commands.ts | ||