From 4dea0846ed949dcbb1b75d8846fd89485e61dba3 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sat, 25 Apr 2026 13:17:19 -0700 Subject: [PATCH] docs(readme): browser-harness-js plug + domain-skills section New "Domain skills + raw CDP escape hatch" section under "The sprint" covering both v1.8.0.0 features. Plugs browser-use/browser-harness-js as the no-rails alternative for users who want raw CDP without gstack's security stack. Co-Authored-By: Claude Opus 4.7 (1M context) --- README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/README.md b/README.md index 1d63004d..3177d56c 100644 --- a/README.md +++ b/README.md @@ -240,6 +240,15 @@ Beyond the slash-command skills, gstack ships standalone CLIs for workflows that Set `gstack-config set checkpoint_mode continuous` and skills auto-commit your work as you go with a `WIP:` prefix plus a structured `[gstack-context]` body (decisions, remaining work, failed approaches). Survives crashes and context switches. `/context-restore` reads those commits to reconstruct session state. `/ship` filter-squashes WIP commits before the PR (preserving non-WIP commits) so bisect stays clean. Push is opt-in via `checkpoint_push=true` — default is local-only so you don't trigger CI on every WIP commit. +### Domain skills + raw CDP escape hatch + +Two new browser primitives compound the gstack agent over time: + +- **`$B domain-skill save`** — agent saves a per-site note (e.g., "LinkedIn's Apply button lives in an iframe") that fires automatically next time it visits that hostname. Quarantined → active after 3 successful uses → optional cross-project promotion via `$B domain-skill promote-to-global`. Storage lives alongside `/learn`'s per-project learnings file. Full reference: **[docs/domain-skills.md](docs/domain-skills.md)**. +- **`$B cdp `** — raw Chrome DevTools Protocol escape hatch for the rare case curated commands miss. Deny-default: methods must be explicitly added to `browse/src/cdp-allowlist.ts` with a one-line justification. Two-tier mutex serializes browser-scoped CDP calls against per-tab work. Output for data-exfil methods is wrapped in the UNTRUSTED envelope. + +> Want raw CDP with no rails, no allowlist, no daemon — just thin transport from agent to Chrome? [browser-use/browser-harness-js](https://github.com/browser-use/browser-harness-js) is a different philosophy (agent-authored helpers vs gstack's curated commands) and a good fit if you don't want gstack's security stack. The two can coexist: gstack's `$B cdp` and harness can both attach to the same Chrome via Playwright's `newCDPSession`. + **[Deep dives with examples and philosophy for every skill →](docs/skills.md)** ### Karpathy's four failure modes? Already covered.