CodeVetter · Repo Unpack · Feature catalog
garrytan/gstack
The user-facing surface is ~40 slash skills plus a set of compiled/shell CLIs. Skills cluster into plan-mode reviews, implementation+review, release+deploy, ops/memory, browser automation, iOS QA, and safety rails. Under the skills, the browse daemon exposes ~60 commands partitioned into read/write/meta sets, and separate CLIs handle PDF rendering, AI design generation, iOS device bridging, and utility functions (telemetry, config, decisions, learnings, gbrain sync).
- The root SKILL.md.tmpl is a router skill that maps natural-language requests to the right skill (e.g. 'test this site' → /qa, 'ship it' → /ship) and records a ROUTE_OUTCOME telemetry event via bin/gstack-telemetry-log; it honors a persisted PROACTIVE gstack-config flag.
- Plan-mode review skills: /office-hours, /plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, /plan-tune, /autoplan (CEO → design → DX → eng pipeline), /design-consultation, and /spec (five-phase spec → GitHub issue, optional agent spawn).
- Implementation+review skills: /review (pre-landing PR review), /codex and /claude-code (cross-model second opinions), /investigate (root-cause debugging), /design-review, /design-shotgun, /design-html, /devex-review, /qa and /qa-only (browser QA with fix loop), /scrape + /skillify (codify a scrape into a browser-skill).
- Release+deploy skills: /ship (tests → review → version bump → CHANGELOG → commit → push → PR, with explicit STOP gates enumerated in its template), /land-and-deploy, /canary, /landing-report, /document-release, /document-generate, /setup-deploy, /gstack-upgrade (with migrations/ dir).
- Ops/memory skills: /context-save, /context-restore, /learn, /retro, /health, /benchmark, /benchmark-models, /cso (OWASP+STRIDE audit with a native helper built by scripts/build-cso.sh), /setup-gbrain, /sync-gbrain.
- Browser skills: /browse (Aside first, $B fallback), /open-gstack-browser (headed mode + sidebar), /setup-browser-cookies (import real-browser cookies), /pair-agent (scoped ngrok tunnel for a remote agent); connect-chrome is a kept symlink alias to open-gstack-browser.
- iOS skills /ios-qa, /ios-fix, /ios-design-review, /ios-clean, /ios-sync drive real iPhones over USB CoreDevice + an embedded StateServer, optionally exposed over Tailscale; companion CLIs gstack-ios-qa-daemon, gstack-ios-qa-mint (owner-grant allowlist), gstack-ios-qa-regen ship in bin/.
- Safety skills /careful, /freeze, /guard, /unfreeze install PreToolUse hooks (careful/bin/check-careful.sh warns on destructive commands, freeze/bin/check-freeze.sh hard-blocks edits outside a directory; shared helpers in careful/bin/hook-extract.sh).
- The browse command surface is defined by three sets in browse/src/commands.ts — READ_COMMANDS (text/html/links/js/eval/console/network/...), WRITE_COMMANDS (goto/click/fill/cookie-import-browser/...), META_COMMANDS (tabs/snapshot/pdf/chain/skill/domain-skill/cdp/...) — with a load-time validation loop forcing COMMAND_DESCRIPTIONS to cover exactly the union.
- `$B snapshot` produces an ARIA-tree text view with @e refs (and @c cursor-interactive refs via -C) that later commands resolve to Playwright Locators — no DOM mutation, so it survives CSP, shadow DOM, and framework hydration; refs clear on navigation and resolveRef() does a count() staleness check.
- `$B cdp` is a deny-default raw CDP escape hatch: only methods enumerated with scope + output + justification in browse/src/cdp-allowlist.ts are reachable; untrusted outputs get the UNTRUSTED envelope, enforced by browse/test/cdp-allowlist.test.ts.
- Browser-skills are deterministic Playwright scripts (SKILL.md + script.ts + _lib + fixtures) resolved through a 3-tier project > global > bundled lookup under .gstack/browser-skills/, spawned with a read+write scoped daemon token (never root) and tombstone-based deletion; the sibling `domain-skill` command is a per-site notes store with a quarantine→auto-promote→promote-to-global trust lifecycle tied to the L4 injection classifier.
- make-pdf is a compiled CLI (make-pdf/src/cli.ts) with a strict output contract — stdout carries only the output path, exit codes 0/1/2/3/4 distinguish bad args, render error, Paged.js timeout, and no-browser — embedding lib/aside-render.ts for the two-engine render.
- The design CLI (design/src/cli.ts) is a stateless binary for AI image/design generation against the OpenAI API — commands include generate, variants, compare, iterate, evolve, serve, gallery, daemon — with auth resolved from ~/.gstack/openai.json then OPENAI_API_KEY.
- bin/ ships ~80 utility executables the skills invoke from bash blocks — gstack-config, gstack-detach (detached long-job runner), gstack-egress (ledger inspect/verify), gstack-render.ts (local-HTML render), gstack-design-detect.ts, gstack-design-md.ts, gstack-context-bill, gstack-team-init, the gstack-brain-* sync family, and gstack-learnings-*.