# gstack 1.72.0.0

- Product: gstack (https://whatsnew.fyi/product/gstack)
- Vendor: gstack
- Date: 2026-08-28
- Version: 1.72.0.0
- Original notes: https://raw.githubusercontent.com/garrytan/gstack/main/CHANGELOG.md
- Permalink: https://whatsnew.fyi/product/gstack/releases/1.72.0.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Third-party web actions contract with Aside AI browser as recommended driver, including runtime detection probe, detection-conditional consent options, step-wise drive discipline, and error-quoting failure path with fresh consent fallback
- **added** — Test file test/third-party-actions.test.ts with 21 pin tests covering the contract and repo-wide tripwires
- **added** — Test file test/skill-e2e-third-party-actions.test.ts with five hermetic gate-tier E2E cases
- **changed** — Credential boundaries hardened with secret-minimization preference, Apple credential creation banned as a drive target in every skill, and vendor help/skill text explicitly scoped to operational syntax
- **changed** — Driver recommendation superseded from gstack's own browser stack to explicit user directive naming Aside as the recommended product
- **changed** — Setup flow's bun-installer checksum verification now resolves sha256sum before shasum for coreutils-only Linux
- **fixed** — restrictDirectoryPermissions no longer chmods shared sticky directories, foreign-owned directories, symlinked state dirs, or world-writable mounts when running as root
- **fixed** — Refusals from restrictDirectoryPermissions warn once per process instead of failing silent
- **fixed** — gstack-config resolve-user-slug exit 127 on Linux distros without perl's shasum by resolving sha256sum first and falling back to shasum -a 256
- **fixed** — Path-validation test that assumed /etc/crontab exists now uses /etc/passwd
- **changed** — test/helpers/fs-caps.ts functional capability probes replace uid-0-only guards across 14 chmod-based test files
- **added** — Five tpa-* entries registered across E2E_TOUCHFILES/E2E_TIERS with template-level deps

Third-Party Web Actions contract names the Aside AI browser as the recommended driver with runtime detection probe, detection-conditional consent options, step-wise drive discipline, and failure path that quotes errors and falls back with fresh consent.
Credential boundaries hardened: secret-minimization preference, Apple credential creation banned as a drive target in every skill, and vendor help/skill text explicitly scoped to operational syntax.
Added test/third-party-actions.test.ts with 21 pin tests covering the contract and repo-wide tripwires.
Added test/skill-e2e-third-party-actions.test.ts with five hermetic gate-tier E2E cases.
The v1.65.0.0 stance of driving only gstack's own browser stack is superseded by explicit user directive: Aside is the recommended product.
The setup flow's bun-installer checksum verification resolves sha256sum before shasum for coreutils-only Linux.
restrictDirectoryPermissions no longer chmods shared sticky directories, foreign-owned directories, symlinked state dirs, or world-writable mounts when running as root; refusals warn once per process instead of failing silent.
gstack-config resolve-user-slug exited 127 on Linux distros without perl's shasum; both hashing call sites now resolve sha256sum first and fall back to shasum -a 256.
A path-validation test assumed /etc/crontab exists; it now uses /etc/passwd.
test/helpers/fs-caps.ts functional capability probes replace uid-0-only guards across 14 chmod-based test files.
Five tpa-* entries registered across E2E_TOUCHFILES/E2E_TIERS with template-level deps.