From 3e3c723050659d0ae8271c7a2828d75b5a7cb50c Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Tue, 1 Sep 2026 16:47:45 +0000 Subject: [PATCH] docs: cross-model doc review fixes for v1.78.0.0 CONTRIBUTING.md: the day-to-day example now edits the .tmpl (SKILL.md is generated); the OSV row states the explicit --config load and the reasoned, expiring ignore contract. BROWSER.md: stop row mentions the identity-checked Chromium reap; env table gains CHROMIUM_PROFILE and GSTACK_DISABLE_GPU rows. Co-Authored-By: Claude Fable 5 --- BROWSER.md | 4 +++- CONTRIBUTING.md | 7 ++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/BROWSER.md b/BROWSER.md index 64811387d..76dce207f 100644 --- a/BROWSER.md +++ b/BROWSER.md @@ -331,7 +331,7 @@ from `snapshot`, or `@c` refs from `snapshot -C`. Full table: | Command | Description | |---------|-------------| | `status` | Daemon health + mode (headless / headed / cdp) | -| `stop` | Shut down daemon (succeeds even if the daemon already died — never boots one just to stop it) | +| `stop` | Shut down daemon (succeeds even if the daemon already died — never boots one just to stop it; reaps a surviving recorded headless Chromium after identity checks) | | `restart` | Restart daemon | | `connect` | Launch headed GStack Browser with Side Panel extension | | `disconnect` | Close headed Chrome, return to headless | @@ -1279,6 +1279,8 @@ the global `~/.gstack/browser-skills/foo/` only inside project-a. | `BROWSE_HEADLESS_SKIP` | 0 | Skip Chromium launch entirely (test harness only) | | `BROWSE_TUNNEL` | 0 | Activate the dual-listener tunnel architecture (requires `NGROK_AUTHTOKEN`) | | `BROWSE_TUNNEL_LOCAL_ONLY` | 0 | Test-only — bind both listeners locally without ngrok | +| `CHROMIUM_PROFILE` | unset | Explicit Chromium profile directory (used by gbrowser's gbd per-workspace); honored by both launch and profile-lock cleanup | +| `GSTACK_DISABLE_GPU` | unset | Set to `off` to skip the macOS headless GPU-taming flag set (applied by default on Darwin to stop runaway GPU-process spin) | | `GSTACK_BROWSE_MAX_HTML_BYTES` | 52428800 (50MB) | `load-html` size cap | | `GSTACK_SECURITY_OFF` | unset | Emergency kill switch — disable ML classifier | | `GSTACK_STEALTH` | unset | Set to `extended` (also accepts `1`/`true`) to layer six aggressive patches (WebGL spoof, faked plugins, mediaDevices) on top of Layer C. Actively lies; can break sites. | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2486da6ab..17305c0ad 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -98,8 +98,9 @@ prefer namespaced names (`/gstack-review`, `/gstack-ship`). # 1. Enter dev mode bin/dev-setup -# 2. Edit a skill -vim review/SKILL.md +# 2. Edit a skill template (SKILL.md files are generated — edit the .tmpl) +vim review/SKILL.md.tmpl +bun run gen:skill-docs # or: bun run dev:skill (watch mode, auto-regen on change) # 3. Test it in Claude Code — changes are live # > /review @@ -304,7 +305,7 @@ Supply-chain gates run alongside it: - **Quality gate** (`.github/workflows/quality-gate.yml`, every PR and push) — scans the diff's added lines for credentials using gstack's own redact engine (`.github/scripts/gate-secret-scan.mjs`). HIGH findings fail the job; MEDIUM findings surface as an advisory count. Fails closed if the scan can't produce a report. Also gates critical dependency advisories and runs ShellCheck on the setup/build boundaries. - **Dependency review** (`.github/workflows/dependency-review.yml`) — reviews dependency changes on PRs that touch lockfiles or workflow files. -- **OSV scanner** (`.github/workflows/osv-scanner.yml`) — weekly vulnerability scan against the OSV database (config in `.osv-scanner.toml`). +- **OSV scanner** (`.github/workflows/osv-scanner.yml`) — weekly vulnerability scan against the OSV database. Config lives in `.osv-scanner.toml` and is loaded via an explicit `--config` flag (OSV does not auto-discover that filename); every ignore entry needs a reason and an `ignoreUntil` expiry, enforced by `test/osv-config-wiring.test.ts`. - **Dependabot** (`.github/dependabot.yml`) — grouped dependency update PRs. The supply-chain workflows pin their third-party actions to commit SHAs. The PR template (`.github/PULL_REQUEST_TEMPLATE.md`) asks for evidence — tests run, eval output — not promises.