gstack 1.97.0.0’s browser stops trusting compromised certificates, and /investigate can demand a root cause

In gstack 1.97, the bundled browser stops trusting certificates from eight eMudhra authorities whose keys were compromised. It now pins Playwright 1.65, which ships Chromium 158.

Slide text

gstack 1.97.0.0’s browser stops trusting compromised certificates, and /investigate can demand a root cause

Playwright 1.65.0 Chromium 158

Eight eMudhra intermediate CAs had their keys compromised.

Browser Gates /ship Fixes

garrytan/gstack · CHANGELOG.md · 1.97.0.0

Chrome had already dropped that root, but the old Chromium still carried it and gets no revocation updates, so anyone holding those keys could impersonate a site. Now the test site fails.

The browse audit log used to save a password you filled into a page in plain text. Now every typed value is saved as redacted, and selectors and cookie names stay readable.

Page URLs in the audit and network logs now drop query values and passwords. A goto command still keeps its full URL, and older log lines keep what they already saved.

Gates for two skills.

On Opus 5.5, the /investigate skill alone got its root cause step followed zero times in 46 runs. The new gate blocks source edits until the session writes down a root cause.

Opus often edits through the shell, so the old gate, which watched only Edit and Write, missed those changes. This one catches a sed or a redirect, puts the file back and reports it.

A second gate holds /plan-ceo-review until its review file has a numbered list of top risks. After three blocks it lets the session finish. Both gates are off by default.

Shipping.

The docs, coverage and plan audits in /ship ran on Sonnet 5.5 whatever you set. Now they use your preferred model at low effort.

A reviewer brief rendered on its own, like the Red Team's, now gets the same exclusions as the rest. Before, one Red Team refused a 30 megabyte diff while the other readers read 2 megabytes.

A docs audit's own edits, a policy change that touches none of your files, and a closing line like none of these rises to critical no longer send a pull request back for review.

On a results repo of almost 200,000 files, the review plan took over two and a half minutes. It now takes about 30 seconds, because its git calls no longer grow with the tree.

Smaller fixes.

Brain sync stops calling a rejected push an auth error when the remote's address contains author. The browse daemon stops losing its port while Chromium starts. The agents file shrinks to skill names.

The redact scanner flagged code like config.prod as a leaked internal host, and /ship then asked you to confirm. In TypeScript, Dart and Python files, a property read now counts as code.

The stable channel now checks every day. A fix marked security, regression, data loss or blocker reaches stable a day after it lands, and stable falls at most a week behind.

If you use /investigate on Opus, I'd turn the new gate on, because it makes the root cause step happen. Setup is in the gstack changelog.