Garry Tan bc80c4fae5 fix(security): cookie-import path validation bypass + hardcoded /tmp ... Two fixes: 1. cookie-import relative path bypass (#707): path.isAbsolute() gated the entire validation, so relative paths like "sensitive-file.json" bypassed the safe-directory check entirely. Now always resolves to absolute path with realpathSync for symlink resolution, matching validateOutputPath(). 2. Hardcoded /tmp in cookie-import-browser (#708): openDbFromCopy used /tmp directly instead of os.tmpdir(), breaking Windows support. Also adds explicit imports for SAFE_DIRECTORIES and isPathWithin in write-commands.ts (previously resolved implicitly through bundler). Closes #852 Co-Authored-By: Toby Morning <urbantech@users.noreply.github.com>		2026-04-13 09:33:48 -07:00
..
bin	feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226)	2026-03-19 18:20:50 -07:00
scripts	fix: Windows support — Node.js server fallback for Playwright (#255)	2026-03-20 12:22:11 -07:00
src	fix(security): cookie-import path validation bypass + hardcoded /tmp	2026-04-13 09:33:48 -07:00
test	fix(security): cookie-import path validation bypass + hardcoded /tmp	2026-04-13 09:33:48 -07:00
PLAN-snapshot-dropdown-interactive.md	fix: snapshot -i auto-detects dropdown/popover interactive elements (#845)	2026-04-05 22:57:45 -07:00
SKILL.md	feat: browser data platform for AI agents (v0.16.0.0) (#907)	2026-04-08 00:41:55 -07:00
SKILL.md.tmpl	feat: sidebar CSS inspector + per-tab agents (v0.13.9.0) (#650)	2026-03-30 12:51:05 -06:00