mirror of https://github.com/garrytan/gstack.git
a7593d70ef
* fix: cookie picker auth token leak (CVE — CVSS 7.8) GET /cookie-picker served HTML that inlined the master bearer token without authentication. Any local process could extract it and use it to call /command, executing arbitrary JS in the browser context. Fix: Jupyter-style one-time code exchange. The picker URL now includes a one-time code that is consumed via 302 redirect, setting an HttpOnly session cookie. The master AUTH_TOKEN never appears in HTML. The session cookie is isolated from the scoped token system (not valid for /command). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: bump version and changelog (v0.15.17.0) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: browse-snapshot E2E turn budget too tight (7 → 9) The agent consistently uses 8 turns for 5 snapshot commands because it reads the saved annotated PNG to verify it was created. All 3 CI attempts hit error_max_turns at exactly 8. Bumping to 9 gives headroom. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| fixtures | ||
| helpers | ||
| analytics.test.ts | ||
| audit-compliance.test.ts | ||
| codex-e2e.test.ts | ||
| diff-scope.test.ts | ||
| gemini-e2e.test.ts | ||
| gen-skill-docs.test.ts | ||
| global-discover.test.ts | ||
| hook-scripts.test.ts | ||
| host-config.test.ts | ||
| learnings-injection.test.ts | ||
| learnings.test.ts | ||
| relink.test.ts | ||
| review-log.test.ts | ||
| skill-e2e-bws.test.ts | ||
| skill-e2e-cso.test.ts | ||
| skill-e2e-deploy.test.ts | ||
| skill-e2e-design.test.ts | ||
| skill-e2e-learnings.test.ts | ||
| skill-e2e-plan.test.ts | ||
| skill-e2e-qa-bugs.test.ts | ||
| skill-e2e-qa-workflow.test.ts | ||
| skill-e2e-review-army.test.ts | ||
| skill-e2e-review.test.ts | ||
| skill-e2e-session-intelligence.test.ts | ||
| skill-e2e-sidebar.test.ts | ||
| skill-e2e-workflow.test.ts | ||
| skill-e2e.test.ts | ||
| skill-llm-eval.test.ts | ||
| skill-parser.test.ts | ||
| skill-routing-e2e.test.ts | ||
| skill-validation.test.ts | ||
| team-mode.test.ts | ||
| telemetry.test.ts | ||
| timeline.test.ts | ||
| touchfiles.test.ts | ||
| uninstall.test.ts | ||
| worktree.test.ts | ||