# Feature catalog — garrytan/gstack

> Canonical page: https://codevetter.com/unpack/gstack/feature-catalog

# Feature catalog — garrytan/gstack

Scanned commit 35dd014c580037d1c009776d8b0584587c1bd42c (2026-09-21). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The user-facing surface is ~40 slash skills plus a set of compiled/shell CLIs. Skills cluster into plan-mode reviews, implementation+review, release+deploy, ops/memory, browser automation, iOS QA, and safety rails. Under the skills, the browse daemon exposes ~60 commands partitioned into read/write/meta sets, and separate CLIs handle PDF rendering, AI design generation, iOS device bridging, and utility functions (telemetry, config, decisions, learnings, gbrain sync).
- The root SKILL.md.tmpl is a router skill that maps natural-language requests to the right skill (e.g. 'test this site' → /qa, 'ship it' → /ship) and records a ROUTE_OUTCOME telemetry event via bin/gstack-telemetry-log; it honors a persisted PROACTIVE gstack-config flag. — [SKILL.md.tmpl#L21-80](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/SKILL.md.tmpl#L21-L80)
- Plan-mode review skills: /office-hours, /plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, /plan-tune, /autoplan (CEO → design → DX → eng pipeline), /design-consultation, and /spec (five-phase spec → GitHub issue, optional agent spawn). — [AGENTS.md](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/AGENTS.md) [docs/PROJECT_STRUCTURE.md#L51-60](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/docs/PROJECT_STRUCTURE.md#L51-L60)
- Implementation+review skills: /review (pre-landing PR review), /codex and /claude-code (cross-model second opinions), /investigate (root-cause debugging), /design-review, /design-shotgun, /design-html, /devex-review, /qa and /qa-only (browser QA with fix loop), /scrape + /skillify (codify a scrape into a browser-skill). — [AGENTS.md](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/AGENTS.md) [docs/PROJECT_STRUCTURE.md#L46-50](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/docs/PROJECT_STRUCTURE.md#L46-L50)
- Release+deploy skills: /ship (tests → review → version bump → CHANGELOG → commit → push → PR, with explicit STOP gates enumerated in its template), /land-and-deploy, /canary, /landing-report, /document-release, /document-generate, /setup-deploy, /gstack-upgrade (with migrations/ dir). — [ship/SKILL.md.tmpl#L37-60](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/ship/SKILL.md.tmpl#L37-L60) [gstack-upgrade/migrations](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/gstack-upgrade/migrations) [AGENTS.md](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/AGENTS.md)
- Ops/memory skills: /context-save, /context-restore, /learn, /retro, /health, /benchmark, /benchmark-models, /cso (OWASP+STRIDE audit with a native helper built by scripts/build-cso.sh), /setup-gbrain, /sync-gbrain. — [AGENTS.md](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/AGENTS.md) [cso/SKILL.md.tmpl](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/cso/SKILL.md.tmpl) [scripts/build-cso.sh](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/scripts/build-cso.sh)
- Browser skills: /browse (Aside first, $B fallback), /open-gstack-browser (headed mode + sidebar), /setup-browser-cookies (import real-browser cookies), /pair-agent (scoped ngrok tunnel for a remote agent); connect-chrome is a kept symlink alias to open-gstack-browser. — [AGENTS.md](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/AGENTS.md) [docs/PROJECT_STRUCTURE.md#L72-74](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/docs/PROJECT_STRUCTURE.md#L72-L74)
- iOS skills /ios-qa, /ios-fix, /ios-design-review, /ios-clean, /ios-sync drive real iPhones over USB CoreDevice + an embedded StateServer, optionally exposed over Tailscale; companion CLIs gstack-ios-qa-daemon, gstack-ios-qa-mint (owner-grant allowlist), gstack-ios-qa-regen ship in bin/. — [AGENTS.md](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/AGENTS.md) [ios-qa/daemon/src/index.ts](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/ios-qa/daemon/src/index.ts) [ios-qa/daemon/src/auth-mint.ts](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/ios-qa/daemon/src/auth-mint.ts)
- Safety skills /careful, /freeze, /guard, /unfreeze install PreToolUse hooks (careful/bin/check-careful.sh warns on destructive commands, freeze/bin/check-freeze.sh hard-blocks edits outside a directory; shared helpers in careful/bin/hook-extract.sh). — [careful/bin/check-careful.sh](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/careful/bin/check-careful.sh) [freeze/bin/check-freeze.sh](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/freeze/bin/check-freeze.sh) [docs/PROJECT_STRUCTURE.md#L62-64](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/docs/PROJECT_STRUCTURE.md#L62-L64)
- The browse command surface is defined by three sets in browse/src/commands.ts — READ_COMMANDS (text/html/links/js/eval/console/network/...), WRITE_COMMANDS (goto/click/fill/cookie-import-browser/...), META_COMMANDS (tabs/snapshot/pdf/chain/skill/domain-skill/cdp/...) — with a load-time validation loop forcing COMMAND_DESCRIPTIONS to cover exactly the union. — [browse/src/commands.ts#L13-51](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/browse/src/commands.ts#L13-L51) [browse/src/commands.ts#L190-198](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/browse/src/commands.ts#L190-L198)
- `$B snapshot` produces an ARIA-tree text view with @e refs (and @c cursor-interactive refs via -C) that later commands resolve to Playwright Locators — no DOM mutation, so it survives CSP, shadow DOM, and framework hydration; refs clear on navigation and resolveRef() does a count() staleness check. — [ARCHITECTURE.md#L239-287](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/ARCHITECTURE.md#L239-L287) [browse/src/snapshot.ts](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/browse/src/snapshot.ts)
- `$B cdp` is a deny-default raw CDP escape hatch: only methods enumerated with scope + output + justification in browse/src/cdp-allowlist.ts are reachable; untrusted outputs get the UNTRUSTED envelope, enforced by browse/test/cdp-allowlist.test.ts. — [browse/src/cdp-allowlist.ts#L1-30](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/browse/src/cdp-allowlist.ts#L1-L30) [browse/src/commands.ts#L186-187](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/browse/src/commands.ts#L186-L187)
- Browser-skills are deterministic Playwright scripts (SKILL.md + script.ts + _lib + fixtures) resolved through a 3-tier project > global > bundled lookup under .gstack/browser-skills/, spawned with a read+write scoped daemon token (never root) and tombstone-based deletion; the sibling `domain-skill` command is a per-site notes store with a quarantine→auto-promote→promote-to-global trust lifecycle tied to the L4 injection classifier. — [browse/src/browser-skills.ts#L1-21](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/browse/src/browser-skills.ts#L1-L21) [browse/src/commands.ts#L183-185](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/browse/src/commands.ts#L183-L185)
- make-pdf is a compiled CLI (make-pdf/src/cli.ts) with a strict output contract — stdout carries only the output path, exit codes 0/1/2/3/4 distinguish bad args, render error, Paged.js timeout, and no-browser — embedding lib/aside-render.ts for the two-engine render. — [make-pdf/src/cli.ts#L1-12](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/make-pdf/src/cli.ts#L1-L12) [docs/PROJECT_STRUCTURE.md#L76](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/docs/PROJECT_STRUCTURE.md#L76)
- The design CLI (design/src/cli.ts) is a stateless binary for AI image/design generation against the OpenAI API — commands include generate, variants, compare, iterate, evolve, serve, gallery, daemon — with auth resolved from ~/.gstack/openai.json then OPENAI_API_KEY. — [design/src/cli.ts#L1-34](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/design/src/cli.ts#L1-L34)
- bin/ ships ~80 utility executables the skills invoke from bash blocks — gstack-config, gstack-detach (detached long-job runner), gstack-egress (ledger inspect/verify), gstack-render.ts (local-HTML render), gstack-design-detect.ts, gstack-design-md.ts, gstack-context-bill, gstack-team-init, the gstack-brain-* sync family, and gstack-learnings-*. — [bin/gstack-detach](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/bin/gstack-detach) [bin/gstack-context-bill](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/bin/gstack-context-bill) [bin/gstack-render.ts](https://github.com/garrytan/gstack/blob/35dd014c580037d1c009776d8b0584587c1bd42c/bin/gstack-render.ts)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)