mirror of https://github.com/garrytan/gstack.git
8c8e3b9e52
Review army findings (1 critical, auto-fixed with regression tests):
- CRITICAL (security specialist, verified live): redactFindingSpans spliced
only the regex capture span, and pem.private_key / gcp.service_account
capture just the BEGIN-header — the key body survived "redaction" and
shipped via telemetry. Marker-only patterns now drop the whole payload
(null, fail closed). Overlapping spans (Bearer+JWT on the same bytes) are
coalesced before splicing so stale offsets can't leave partial secret
bytes behind.
- gitStrict: drop the dead `|| r.status === null` disjunct (null !== 0
already covers it); add the signal-kill/null-status regression test the
docstring promised.
- security-dashboard human mode flags stale snapshots ("figures may be out
of date") instead of presenting frozen counts as current.
- community-dashboard marker check uses jq when available — the grep-only
variant misclassified whitespaced/reserialized bodies as legacy.
- telemetry fail-closed test now shadows bun with a failing stub
(deterministic on any host layout); stale "five status cases" describe
title renamed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| bin-context.ts | ||
| conductor-env-shim.ts | ||
| gbrain-exec.ts | ||
| gbrain-guards.ts | ||
| gbrain-local-status.ts | ||
| gbrain-sources.ts | ||
| gstack-decision-semantic.ts | ||
| gstack-decision.ts | ||
| gstack-memory-helpers.ts | ||
| jsonl-store.ts | ||
| redact-audit-log.ts | ||
| redact-engine.ts | ||
| redact-patterns.ts | ||
| staging-guard.ts | ||
| worktree.ts | ||