# gstack 1.64.0.0 — Ninety fixes in one wave

- Product: gstack (https://whatsnew.fyi/product/gstack)
- Vendor: gstack
- Date: 2026-08-14
- Version: 1.64.0.0
- Original notes: https://raw.githubusercontent.com/garrytan/gstack/main/CHANGELOG.md
- Permalink: https://whatsnew.fyi/product/gstack/releases/1.64.0.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Enforcement guards /freeze, /careful, and team-init required mode now block requests
- **changed** — /careful now parses tool payload with real JSON parser and handles quoted arguments
- **added** — /careful asks on IFS/base64 obfuscation and fails closed on unreadable input
- **fixed** — Investigate scope lock resolves check-freeze via $HOME
- **changed** — Specialist review agents run with run_in_background: false
- **changed** — Pre-push scanning improved with line-aligned chunked scans and real push-base resolution
- **changed** — Pre-push scanning uses byte-exact stdin for chained hooks
- **added** — Pre-push scanning implements --no-ext-diff/--no-textconv flags
- **changed** — Pre-push scanning uses hunk-aware header parsing and fail-closed ref parsing
- **added** — pair-agent walks through ngrok auth in user terminal
- **security** — Extension denies token/port reads to content scripts and foreign extensions
- **changed** — diff upgraded to 9.0.0
- **security** — OpenAI key file written 0600-at-create
- **fixed** — Injection-denylist and phone-pattern false positives calibrated
- **fixed** — All delayed process.exit teardown bombs removed with static no-suicide tripwire
- **changed** — design/test/ joins free suite and sharded runner
- **fixed** — Orphaned sidebar chat-queue suites removed
- **fixed** — Fork PRs skip eval jobs deterministically
- **fixed** — memory-ingest imports gitignored staging and reconciles counts

Enforcement guards /freeze, /careful, and team-init required mode now actually block. /careful parses tool payload with real JSON parser, handles quoted arguments, asks on IFS/base64 obfuscation, fails closed on unreadable input. Investigate scope lock resolves check-freeze via $HOME. Specialist review agents run with run_in_background: false. Pre-push scanning improved with line-aligned chunked scans, real push-base resolution, byte-exact stdin for chained hooks, --no-ext-diff/--no-textconv, hunk-aware header parsing, fail-closed ref parsing. pair-agent walks through ngrok auth in user terminal. Extension denies token/port reads to content scripts and foreign extensions. diff upgraded to 9.0.0. OpenAI key file written 0600-at-create. Injection-denylist and phone-pattern false positives calibrated. All delayed process.exit teardown bombs removed with static no-suicide tripwire. design/test/ joins free suite and sharded runner. Orphaned sidebar chat-queue suites removed. Fork PRs skip eval jobs deterministically. memory-ingest imports gitignored staging and reconciles counts. lib/ ships beside bin/ on every host install. Native AskUserQuestion answers parse correctly with (Recommended) suffix support. Autoplan task aggregator returns real tasks. Auto-upgrade pulls with --autostash over locally-patched installs. gstack-slug resolves project root by marker walk-up and canonicalizes slash branches. Design image generation fixed with honest timeout reporting. Windows icacls grants by SID. windowsHide forwarded through every spawn shim. All plan-tune hooks spawn bins through shared Windows-aware helper. mktemp templates keep X-run trailing for /codex on macOS. codex review receives explicit diff args with timeouts. Review mode runs sandboxed read-only. Artifacts Sync and telemetry-finalize un-deadened in 49 skills. update_check:false silences preamble prose. Codex hosts read AGENTS.md. setup --help prints help. Model overlays for current Claude generation. Plus ~20 more small fixes for deploy-config, artifacts-init, keychain auth, catalog description, tracked-file tests, update-check, Ubuntu detection, CRLF generation, telemetry errors, server-lock diagnostics, shell-quoted paths, benchmark validation.