gatherthreadBLOCK

if ([".git", ".codex", ".dsh", ".ssh", ".npmrc", ".netrc", ".ds_store"].includes(lower)) return false;

return !/\.(?:pem|p12|pfx|key)$/iu.test(lower) && !/^(?:id_rsa|id_ed25519)(?:\.|$)/iu.test(lower);

".env" ... WebSocket

GATHERTHREAD_PUBLIC_BASE_URL=http://127.0.0.1:18787

GATHERTHREAD_WEB_API_ORIGIN=http://127.0.0.1:18787

configuredPublicBaseUrl || `http://127.0.0.1:${port}`,

options: { baseURL: "http://127.0.0.1:8787/v1", apiKey: "local" },

token: "gta_fixture-long-lived-device-token",

token: "gta_fixture-long-lived-device-token",

token: "PRIVATE_PAYLOAD_TOKEN",

() => parseDshHostConfig({ ...enabledConfig, token: "must-not-be-accepted" }),

const secret = "gta_01234567890123456789012345678901";

.node-version

const sha = (text: string) => createHash("sha1").update(text).digest("hex");

if (locale === "zh-CN") console.log(`${name}: ${width}x${height} pointer/scroll/password checks passed`);

for name in [".git/config", ".ssh/id_rsa", ".aws/config", ".workbench/state", ".local/state",

".env", ".env.local", ".env.production", ".git-credentials", ".netrc", ".npmrc",

"authorized_keys", "known_hosts", "id_rsa", "id_ed25519", "secret.pem", "secret.key",

for (const path of ["../escape", "a/../../x", "/tmp/x", "a\\x", "A/.GIT/config", ".gatherthread/state", ".env", "a/.codex/auth.json", "x.key", "aux.txt", "a/CON", "a.", "a:stream", "a".repeat(256), "汉

import type { CodeRepository } from "../../src/code-repository.js";

import { CollaborationDatabase } from "../../src/database.js";

import { HostedAgent, type HostedAgentOptions } from "../../src/hosted-agent.js";

import { HostedRepositoryRunner } from "../../src/hosted-repository-runner.js";

Set `GATHERTHREAD_ALLOWED_ORIGINS` to a comma-separated exact Origin allowlist when the browser is hosted separately, for example `http://127.0.0.1:4173`. Cross-origin requests are denied by default.

const value = new TextDecoder("utf-8", { fatal: true }).decode(Uint8Array.from(atob(base64), (c) => c.charCodeAt(0)));