gstack/browse
Garry Tan 8f9bb84f3f
test(security): full-stack review E2E — real classifier + mock-claude
3 tests, ~12s hot / ~30s cold (first-run model download). Skips
gracefully if ~/.gstack/models/testsavant-small/ isn't populated.

Spins up real server + real sidebar-agent + PATH-shimmed mock-claude,
HOME re-rooted so neither the chat history nor the attempts log leak
from the user's live /open-gstack-browser session. Models dir
symlinked through to the real warmed cache so the test doesn't
re-download 112MB per run.

Covers the half that hermetic tests can't:
- real classifier (not a stub) fires on real injection text
- sidebar-agent emits a reviewable security_event end-to-end
- server writes the on-disk decision file
- sidebar-agent's poll loop reads the file and acts
- attempts.jsonl gets both block + user_overrode with matching
  payloadHash (dashboard can aggregate)
- the raw payload never appears in attempts.jsonl (privacy contract)

Caught a real bug while writing: the server loads pre-existing chat
history from ~/.gstack/sidebar-sessions/, so re-rooting HOME for only
the agent leaked ghost security_events from the live session into the
test. Fix: re-root HOME for both processes. The harness is cleaner for
future full-stack tests because of it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 20:55:45 +08:00
..
bin feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226) 2026-03-19 18:20:50 -07:00
scripts fix: ngrok Windows build + close CI error-swallowing gap (v0.18.0.1) (#1024) 2026-04-16 13:49:04 -07:00
src feat(security): wait-for-decision instead of hard-kill on tool-output BLOCK 2026-04-20 20:25:20 +08:00
test test(security): full-stack review E2E — real classifier + mock-claude 2026-04-20 20:55:45 +08:00
PLAN-snapshot-dropdown-interactive.md fix: snapshot -i auto-detects dropdown/popover interactive elements (#845) 2026-04-05 22:57:45 -07:00
SKILL.md feat(v1.4.0.0): /make-pdf — markdown to publication-quality PDFs (#1086) 2026-04-20 13:20:30 +08:00
SKILL.md.tmpl feat(browse): Puppeteer parity — load-html, screenshot --selector, viewport --scale, file:// (v1.1.0.0) (#1062) 2026-04-18 23:25:33 +08:00