RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
gstack/browse/src
History
Garry Tan a2751b7cf2
fix(browse): extension token bootstrap moves to pinned-origin POST; /health carries no token 
GET /health is now liveness/status only in every mode — both token
carve-outs (headed-mode disjunct AND chrome-extension:// Origin
disjunct) are removed. Token bootstrap is POST /extension-token on the
local listener: the Origin header must be exactly
chrome-extension://<GSTACK_EXTENSION_ID> and the Host header's hostname
must parse to 127.0.0.1 or localhost (parsed via new URL, never literal
equality — Host arrives as '127.0.0.1:34567'). Wrong origin/host → 403
with no detail. The tunnel surface 404s the endpoint (not in
TUNNEL_PATHS, verified by test).

The extension ID is pinned by a new "key" field (RSA public key) in
extension/manifest.json; browse/scripts/extension-id.ts reproduces the
ID derivation (first 16 bytes of SHA-256 of the DER public key, hex
mapped 0-9a-f → a-p). The private key is not committed anywhere —
unpacked/baked-in loads only need the public key.

Extension side: background.js bootstraps and refreshes the token via
POST /extension-token (403 → disconnected state); sidepanel.js direct
connect path does the same; sidepanel-terminal.js's dead /health token
fallback (read AUTH_TOKEN/authToken keys the server never sent,
hardcoded port) is replaced with the window.gstackAuthToken path.

MIGRATION NOTE: the manifest key pins the extension ID, so existing
installs' side-panel local state (saved port, snoozes) resets once —
explained in-product via a one-time notice (flag
gstack_id_migrated_v162). After upgrading the server, restart the
browser so the old service worker stops polling for a token GET /health
no longer serves.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit e9a0b6847a2d17fe6656a4686b4efd0c8380eb09)
 		2026-08-12 15:31:49 -07:00
..
activity.ts feat: content security — 4-layer prompt injection defense for pair-agent (#815) 2026-04-06 14:41:06 -07:00
audit.ts feat(browse): Puppeteer parity — load-html, screenshot --selector, viewport --scale, file:// (v1.1.0.0) (#1062) 2026-04-18 23:25:33 +08:00
browse-client.ts v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391) 2026-05-09 08:06:47 -07:00
browser-manager.ts fix(browse): extension token bootstrap moves to pinned-origin POST; /health carries no token 2026-08-12 15:31:49 -07:00
browser-skill-commands.ts v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233) 2026-04-28 20:08:04 -07:00
browser-skill-write.ts v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391) 2026-05-09 08:06:47 -07:00
browser-skills.ts v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233) 2026-04-28 20:08:04 -07:00
buffers.ts feat: Phase 3.5 — cookie import, QA testing, team retro (v0.3.1) (#29) 2026-03-13 00:31:41 -07:00
bun-polyfill.cjs fix: Windows support — Node.js server fallback for Playwright (#255) 2026-03-20 12:22:11 -07:00
cdp-allowlist.ts v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233) 2026-04-28 20:08:04 -07:00
cdp-bridge.ts v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751) 2026-05-27 16:09:38 -07:00
cdp-commands.ts v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233) 2026-04-28 20:08:04 -07:00
cdp-inspector.ts v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751) 2026-05-27 16:09:38 -07:00
claude-bin.ts v1.24.0.0 feat: cross-platform hardening — curated Windows lane + Bun.which resolver + path-portability helper (#1252) 2026-05-01 07:21:28 -07:00
cli.ts v1.55.0.0 fix wave: gbrain data-loss guards + browser crash-loop + 6 more (#1808) 2026-05-30 14:57:07 -07:00
commands.ts v1.57.8.0 feat: browse js/eval --out render-to-file (canonical Chromium for offline rendering) (#1929) 2026-06-09 21:02:30 -07:00
config.ts v1.34.0.0 feat: gstack consumable as submodule (factory-export API + AUTH_TOKEN env + import.meta.main gate) (#1472) 2026-05-13 12:22:30 -04:00
content-security.ts fix(browse): case-insensitive exfiltration-domain blocklist matching 2026-07-10 14:39:32 -07:00
cookie-import-browser.ts security: tunnel dual-listener + SSRF + envelope + path wave (v1.6.0.0) (#1137) 2026-04-21 21:58:27 -07:00
cookie-picker-routes.ts community wave: 6 PRs + hardening (v0.18.1.0) (#1028) 2026-04-17 00:45:13 -07:00
cookie-picker-ui.ts fix: cookie picker auth token leak (v0.15.17.0) (#904) 2026-04-08 10:10:13 -07:00
domain-skill-commands.ts v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233) 2026-04-28 20:08:04 -07:00
domain-skills.ts v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391) 2026-05-09 08:06:47 -07:00
error-handling.ts refactor: AI slop reduction with cross-model quality review (v0.16.3.0) (#941) 2026-04-10 17:13:15 -10:00
file-permissions.ts v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391) 2026-05-09 08:06:47 -07:00
find-browse.ts v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594) 2026-05-20 07:35:01 -07:00
find-security-sidecar.ts v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594) 2026-05-20 07:35:01 -07:00
media-extract.ts feat: browser data platform for AI agents (v0.16.0.0) (#907) 2026-04-08 00:41:55 -07:00
memory-command.ts v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751) 2026-05-27 16:09:38 -07:00
memory-snapshot.ts v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751) 2026-05-27 16:09:38 -07:00
meta-commands.ts v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751) 2026-05-27 16:09:38 -07:00
network-capture.ts feat: browser data platform for AI agents (v0.16.0.0) (#907) 2026-04-08 00:41:55 -07:00
path-security.ts fix: security wave 3 — 12 fixes, 7 contributors (v0.16.4.0) (#988) 2026-04-13 07:49:37 -10:00
platform.ts fix: Windows support — Node.js server fallback for Playwright (#255) 2026-03-20 12:22:11 -07:00
project-slug.ts v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233) 2026-04-28 20:08:04 -07:00
proxy-config.ts v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363) 2026-05-07 20:14:59 -07:00
proxy-redact.ts v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363) 2026-05-07 20:14:59 -07:00
pty-session-cookie.ts feat: gstack browser sidebar = interactive Claude Code REPL with live tab awareness (v1.14.0.0) (#1216) 2026-04-25 22:52:15 -07:00
pty-session-lease.ts v1.44.0.0 feat: long-lived sidebar — keepalive, restart, re-attach, scrollback replay (#1678) 2026-05-24 01:43:51 -07:00
read-commands.ts v1.57.8.0 feat: browse js/eval --out render-to-file (canonical Chromium for offline rendering) (#1929) 2026-06-09 21:02:30 -07:00
sanitize.ts v1.38.1.0 fix wave: surrogate-safe page captures (#1440), Implementation Tasks across review skills (#1454), root-level artifact patterns (#1452) (#1504) 2026-05-14 21:46:50 -07:00
screenshot-size-guard.ts v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594) 2026-05-20 07:35:01 -07:00
security-bunnative.ts feat(security): ML prompt injection defense for sidebar (v1.4.0.0) (#1089) 2026-04-20 22:18:37 +08:00
security-classifier.ts v1.41.1.0 fix wave: 7 HIGH bugs from external audit + regression tests (PR #1169 follow-up) (#1592) 2026-05-20 06:56:41 -07:00
security-sidecar-client.ts v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594) 2026-05-20 07:35:01 -07:00
security-sidecar-entry.ts v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594) 2026-05-20 07:35:01 -07:00
security.ts v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391) 2026-05-09 08:06:47 -07:00
server.ts fix(browse): extension token bootstrap moves to pinned-origin POST; /health carries no token 2026-08-12 15:31:49 -07:00
sidebar-utils.ts fix: sidebar agent uses real tab URL instead of stale Playwright URL (v0.12.6.0) (#544) 2026-03-26 22:07:03 -06:00
skill-token.ts v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233) 2026-04-28 20:08:04 -07:00
snapshot.ts v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594) 2026-05-20 07:35:01 -07:00
socks-bridge.ts v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363) 2026-05-07 20:14:59 -07:00
sse-helpers.ts v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751) 2026-05-27 16:09:38 -07:00
sse-session-cookie.ts security: tunnel dual-listener + SSRF + envelope + path wave (v1.6.0.0) (#1137) 2026-04-21 21:58:27 -07:00
stealth.ts v1.58.3.0 feat: gbrowser anti-detection Layer C stealth (#2047) 2026-06-18 10:45:05 -07:00
tab-session.ts v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391) 2026-05-09 08:06:47 -07:00
telemetry.ts v1.20.0.0 feat: browser-skills runtime + gbrain-support carryover (#1233) 2026-04-28 20:08:04 -07:00
terminal-agent-control.ts v1.44.0.0 feat: long-lived sidebar — keepalive, restart, re-attach, scrollback replay (#1678) 2026-05-24 01:43:51 -07:00
terminal-agent.ts v1.44.0.0 feat: long-lived sidebar — keepalive, restart, re-attach, scrollback replay (#1678) 2026-05-24 01:43:51 -07:00
token-registry.ts v1.39.0.0 feat: buildFetchHandler factory unblocks gbrowser submodule consumption (#1511) 2026-05-14 21:55:29 -07:00
tunnel-denial-log.ts v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391) 2026-05-09 08:06:47 -07:00
url-validation.ts v1.32.0.0 fix wave: 7 community PRs + 5 gate-eval hardenings (#1431) 2026-05-11 12:16:26 -07:00
welcome.html feat: GStack Browser — double-click AI browser with anti-bot stealth (#695) 2026-04-04 10:17:05 -07:00
write-commands.ts v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751) 2026-05-27 16:09:38 -07:00
xvfb.ts v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363) 2026-05-07 20:14:59 -07:00