chore: upgrade gstack v1.5.1.0 → v1.6.0.0 (security wave)

[steadyfall]

Summary

Vendored gstack tooling upgrade — v1.5.1.0 → v1.6.0.0. No fspeek application code changed; all modifications are under `.claude/skills/`.

Security: Dual-listener HTTP architecture for `pair-agent`. The ngrok tunnel now forwards only a locked port with a 17-command allowlist. `/health`, `/cookie-picker`, and `/inspector/*` are physically unreachable over the tunnel (not gated — the HTTP request never arrives). Root tokens over the tunnel return 403.

Auth hardening: SSE endpoints (`/activity/stream`, `/inspector/events`) replace `?token=` query params with a 30-minute HttpOnly `gstack_sse` cookie minted via `POST /sse-session`. Tokens no longer leak to logs, referer headers, or browser history.

Bug fixes: SSRF protection on download+scrape paths, envelope sentinel escape in snapshots, hidden-element detection extended to all DOM-reading channels, `--from-file` path validation added for parity with direct API paths.

Test Coverage

All new code paths are in gstack's browser TypeScript source (`.claude/skills/gstack/browse/`), covered by 4 new test files added upstream:

• `dual-listener.test.ts` — tunnel isolation behavioral tests
• `sse-session-cookie.test.ts` — SSE cookie flag and scope tests
• `pair-agent-e2e.test.ts` — 12 E2E behavioral tests (~220ms, no network)
• `from-file-path-validation.test.ts` — path validation tests

fspeek Go tests: All pass (6 packages, 0 failures). No Go code changed.

Pre-Landing Review

No issues found. All 72 changed files are under `.claude/skills/` (gstack skill docs + browser TypeScript source). No SQL, no race conditions, no LLM trust boundaries in the fspeek Go codebase — unchanged.

Adversarial Review (Claude)

Reviewed vendored gstack TypeScript source. No credentials or secrets in diff. Findings are all upstream gstack issues — not introduced by this PR, not fixable without diverging from upstream. Should be reported to garrytan/gstack.

#	Severity	Finding	Status
1	HIGH	eval in TUNNEL_COMMANDS grants JS execution to remote paired agents (contradicts browser-driving-only goal)	Upstream issue
2	MEDIUM	Incomplete state reset in /tunnel/start error path — tunnelUrl/tunnelActive not cleared on failure	Upstream issue
3	LOW	x-forwarded-for trusted as source IP in tunnel denial log (attacker-controllable)	Upstream issue
4	LOW	GET and POST /connect share rate limit bucket — sustained GET flood can block POST pairing	Upstream issue
5	RISK	sse-session-cookie.ts + tunnel-denial-log.ts appeared untracked during review	RESOLVED — both files are committed (agent ran before commit)
6	INFO	SKILL.md symlinks expose local filesystem paths (/Users/himankdave/...) in git	Pre-existing pattern
7	LOW	Envelope sentinel escape bypassable via Unicode lookalike characters	Upstream issue
8	LOW	GSTACK_SKILL_ROOT traversal guard doesn't check symlinks	Acknowledged non-goal in code

Scope Drift

Scope Check: CLEAN. Intent: upgrade gstack from v1.5.1.0 to v1.6.0.0. Delivered: exactly that — skill SKILL.md updates, browser TypeScript security improvements, and 4 new test files.

Plan Completion

No plan file detected.

TODOS

No TODOS.md in repo.

Test plan

• All Go tests pass (6 packages, 0 failures)
• No compiled binaries committed (browse/dist, design/dist excluded)
• gstack.bak backup cleaned up before commit
• VERSION bumped 0.2.3.1 → 0.2.4.0
• sse-session-cookie.ts + tunnel-denial-log.ts confirmed committed

🤖 Generated with Claude Code