- Third-party web actions contract with Aside AI browser as recommended driver, including runtime detection probe, detection-conditional consent options, step-wise drive discipline, and error-quoting failure path with fresh consent fallback
- Test file test/third-party-actions.test.ts with 21 pin tests covering the contract and repo-wide tripwires
- Test file test/skill-e2e-third-party-actions.test.ts with five hermetic gate-tier E2E cases
- Five tpa-* entries registered across E2E_TOUCHFILES/E2E_TIERS with template-level deps
- Credential boundaries hardened with secret-minimization preference, Apple credential creation banned as a drive target in every skill, and vendor help/skill text explicitly scoped to operational syntax
- Driver recommendation superseded from gstack's own browser stack to explicit user directive naming Aside as the recommended product
- Setup flow's bun-installer checksum verification now resolves sha256sum before shasum for coreutils-only Linux
- test/helpers/fs-caps.ts functional capability probes replace uid-0-only guards across 14 chmod-based test files
- restrictDirectoryPermissions no longer chmods shared sticky directories, foreign-owned directories, symlinked state dirs, or world-writable mounts when running as root
- Refusals from restrictDirectoryPermissions warn once per process instead of failing silent
- gstack-config resolve-user-slug exit 127 on Linux distros without perl's shasum by resolving sha256sum first and falling back to shasum -a 256
- Path-validation test that assumed /etc/crontab exists now uses /etc/passwd
From gstack
Third-Party Web Actions contract names the Aside AI browser as the recommended driver with runtime detection probe, detection-conditional consent options, step-wise drive discipline, and failure path that quotes errors and falls back with fresh consent. Credential boundaries hardened: secret-minimization preference, Apple credential creation banned as a drive target in every skill, and vendor help/skill text explicitly scoped to operational syntax. Added test/third-party-actions.test.ts with 21 pin tests covering the contract and repo-wide tripwires. Added test/skill-e2e-third-party-actions.test.ts with five hermetic gate-tier E2E cases. The v1.65.0.0 stance of driving only gstack's own browser stack is superseded by explicit user directive: Aside is the recommended product. The setup flow's bun-installer checksum verification resolves sha256sum before shasum for coreutils-only Linux. restrictDirectoryPermissions no longer chmods shared sticky directories, foreign-owned directories, symlinked state dirs, or world-writable mounts when running as root; refusals warn once per process instead of failing silent. gstack-config resolve-user-slug exited 127 on Linux distros without perl's shasum; both hashing call sites now resolve sha256sum first and fall back to shasum -a 256. A path-validation test assumed /etc/crontab exists; it now uses /etc/passwd. test/helpers/fs-caps.ts functional capability probes replace uid-0-only guards across 14 chmod-based test files. Five tpa-* entries registered across E2E_TOUCHFILES/E2E_TIERS with template-level deps.