garrytan-gstack

mirror of https://github.com/garrytan/gstack.git synced 2026-07-07 18:28:44 +08:00

Files

Garry Tan 028cb52ca8 feat(redact): six new credential patterns — GitLab, HuggingFace, npm, DigitalOcean, Bearer, GCP SA (#1946 )

Coverage gaps from the #1946 security review, including token types for
tooling gstack itself drives (glab):

HIGH (block): gitlab.token (glpat-/glptt-/gldt-), huggingface.token (hf_),
npm.token (npm_), digitalocean.token (dop_v1_), gcp.service_account (the
JSON-escaped "private_key" form that dodges pem.private_key's literal-block
match when minified, confirmed by "private_key_id" proximity).

MEDIUM (warn): auth.bearer — the most FP-prone shape in the set (docs are
full of "Authorization: Bearer <token>"), so it requires header-context
proximity and the same entropy>=3.0 + placeholder validator recipe as
env.kv. "Bearer YOUR_TOKEN_HERE" never fires; calibration over coverage,
per the cries-wolf principle.

All shapes are linear-time; test/redact-pattern-lint.test.ts covers them
automatically. Engine tests add positive + placeholder-negative cases per
pattern.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-11 20:58:58 -07:00

bin-context.ts

v1.57.5.0 feat: cross-session decision memory + gbrain dream-stage call graph (#1910 )

2026-06-08 06:20:58 -07:00

conductor-env-shim.ts

v1.39.2.0 feat: GSTACK_* env-shim for Conductor + gbrain/gstack setup docs (#1534 )

2026-05-16 12:32:33 -07:00

gbrain-exec.ts

fix(gbrain): stop forcing GBRAIN_PREPARE on transaction-mode poolers (#1965 )

2026-06-11 20:20:36 -07:00

gbrain-guards.ts

v1.57.5.0 feat: cross-session decision memory + gbrain dream-stage call graph (#1910 )