CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-21 04:10:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge codex/gstack-2 into gstack2-runtime-integration

Browse Source 
Reconcile the four integrated v2 runtime implementations (unified execution
result contract, execution profiles, capability readiness, GitHub security)
with main's browser-provider hardening.

Conflict resolutions:
- runtimeContract() generator: keep new execution-result + doctor-capability
  paragraphs, adopt main's `[matching browser flags]` fallback wording;
  regenerate the six RUNTIME.md.
- package.json: keep the strict isolated test:gstack2 runner and marked 18.0.6
  security bump; adopt main's playwright-core alias.
- bun.lock: regenerated via bun install.
- release-hardening.test.ts: adopt main's browser-provider assertions
  (resolveServerLaunchTarget, --browser managed smoke loop).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Sinabina
2026-07-21 13:15:03 -07:00
co-authored by Claude Opus 4.8
parent 37144e8b05 a84a6e233d
commit cb1792fc58
160 changed files with 4397 additions and 522 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/gstack-2/ARCHITECTURE.md
+1 -1
View File
@@ -85,7 +85,7 @@ judgment. This prevents an alias from drifting away from the canonical source.
The standard Agent Skills tree is the unit of distribution:
```bash
npx skills add time-attack/gstack
npx skills add time-attack/gstack/skills
```
The installer—not GStack—owns host detection, project/global scope, destination
docs/gstack-2/HOST-COMPATIBILITY.md
+2 -2
View File
@@ -18,7 +18,7 @@ bundle.
## Canonical installation
```bash
npx skills add time-attack/gstack
npx skills add time-attack/gstack/skills
```
The standards installer owns host detection, destination paths, project/global
@@ -32,7 +32,7 @@ Examples supported by the installer interface:
npx skills add time-attack/gstack/skills --skill qa
# Installer-managed global scope
npx skills add time-attack/gstack -g
npx skills add time-attack/gstack/skills -g
```
Run `npx skills add --help` for the installed CLI version before scripting
docs/gstack-2/JUDGMENT-PARITY.md
+1 -1
View File
@@ -2,7 +2,7 @@
Parity is executable, not a prose claim. Run `bun run scripts/gstack2/run-parity.ts` or the dedicated Bun tests.
The pinned release inventory passes **4,833 checks** across 55 specialist sources, 16 carved sections, 25 routing scenarios, 16 regression ports, and **78 assets**.
The pinned release inventory passes **4,836 checks** across 55 specialist sources, 16 carved sections, 25 routing scenarios, 16 regression ports, and **78 assets**.
The suite verifies:
docs/gstack-2/JUDGMENT-PROVENANCE.json
+16 -16
View File
@@ -83,7 +83,7 @@
"source_path": "office-hours/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "8568fe73cca76a80805fab3092cacd10db7e1d7f",
"normalized_render_sha256": "1a5c9dbda769631df4c3e909fde6b97917780f6a7e9eca5a4edc8c2d0f302052",
"normalized_render_sha256": "ebb8816907a17722d1e1d227de782684870805368fcdc07f69347f32d907a9ba",
"target": "skills/plan/references/legacy/office-hours.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -1416,7 +1416,7 @@
"source_path": "design-consultation/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "64af56ecdbd132cb7c28344e8e4ecb2e5dacf811",
"normalized_render_sha256": "d323457820291635bc4c46e4559ce6f4d194b940607b76208e95df0c86ffcb0b",
"normalized_render_sha256": "13d5aa11be43cf78f7d77b9f8da081c5fedd3b7e767815ff9d650c6bc5d0738b",
"target": "skills/design/references/legacy/design-consultation.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -1591,7 +1591,7 @@
"source_path": "design-html/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "3cdec9a14d62d2e046ed924c972efc30a7d43aca",
"normalized_render_sha256": "40682d97ac83aa9178487348d5abf176334fd439e2d12f8e5cda1f8b20cd2c30",
"normalized_render_sha256": "775dfc9fdcc6b96d6e267f2b8c5e7eedcf8a1d98b764c134d7111a39f3f07301",
"target": "skills/design/references/legacy/design-html.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -1820,7 +1820,7 @@
"source_path": "design-review/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "bdcda48e29b489a1cc49faa333922412251d4b41",
"normalized_render_sha256": "fe15a4fae62fba41432ae18bbf4ef5620058b784b7bf9768304d0d1dd17bf45b",
"normalized_render_sha256": "9d6828dd60fbe4ab9647c5f4456b0953c514ce22ddb1a9c1c3e572c70491f900",
"target": "skills/design/references/legacy/design-review.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2162,7 +2162,7 @@
"source_path": "qa/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "11997f7b878282c34b6bfd3d4b7a8131f9ad4da8",
"normalized_render_sha256": "e7cd5615adaf54413daa97838cb364810317dd7d661cec5cc4ed40eb48192e55",
"normalized_render_sha256": "63135ad3f73ea195fffc535166396bbf66bc223378686670c6d7d362f80e5848",
"target": "skills/qa/references/legacy/qa.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2288,7 +2288,7 @@
"source_path": "qa-only/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "75c4123cc5c406ffdd36c71a094335c137135b1e",
"normalized_render_sha256": "376eff42459f5b8755bd95934cce615db0fca16504c8e82f84b2704c63f62af3",
"normalized_render_sha256": "601eded52ee9e7c5c5ad7c0ce8a7d63377aa64cdaa56a90c0fe40f972939794a",
"target": "skills/qa/references/legacy/qa-only.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2466,7 +2466,7 @@
"source_path": "devex-review/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "081d4f35bbdec0c6b3da8ae71615ec4d41a84551",
"normalized_render_sha256": "4a907c759b6cf4202fbacaea504b1eb601a53dd35b206109d6c5105168ade7e1",
"normalized_render_sha256": "6b26b22ae5cbe9483a10ad084cd6b1e8ea32d2c01e482f75b9f8b32944287d0e",
"target": "skills/qa/references/legacy/devex-review.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2565,7 +2565,7 @@
"source_path": "benchmark/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "038f16f5fba4ae4e9eae922e3276bba8ef88149e",
"normalized_render_sha256": "05ac1b123a605201546a7e95899a5b55708ca7fbb7569c58b4d755c52b45a92d",
"normalized_render_sha256": "5fd14a7da7e31c24451c26d9123fcbcc376b7875c1a723bf7b69a1474e4f1c6d",
"target": "skills/qa/references/legacy/benchmark.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2631,7 +2631,7 @@
"source_path": "canary/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "d1eb2950aba2fa2b09d90f13143492c60d46793c",
"normalized_render_sha256": "89be5f218da2bd812303c87b8c177081727727e5e0d2dc74eb7a73299794d5ef",
"normalized_render_sha256": "b7f753ba0b98d8c7378dc797dca5950b14ebe26565bac25b5bbaa56b8ea8e13b",
"target": "skills/qa/references/legacy/canary.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2710,7 +2710,7 @@
"source_path": "browse/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "9a159e4c9820172c229e2174d4a62a8f9668ab93",
"normalized_render_sha256": "1b532bd904b1fa1686113e8c96b70015ea6b2e6df7319a72c299de901fe5e81b",
"normalized_render_sha256": "fee4ae0bd69412a6c3b1fd6737064301240b39731695b53fa10096ba48495019",
"target": "skills/qa/references/legacy/browse.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2798,7 +2798,7 @@
"source_path": "open-gstack-browser/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "ef91a527890a3ac3622cc7dc84bad1ff7b64443b",
"normalized_render_sha256": "df626d71b8cea4a02d2fb7aef3169563dd132bf17a9d6d84f287894cad84d2cf",
"normalized_render_sha256": "f32ab85292ae920d811f4014480c48941d9b34d3ad8141840b4fd33bfdccc7dd",
"target": "skills/qa/references/legacy/open-gstack-browser.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2873,7 +2873,7 @@
"source_path": "setup-browser-cookies/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "f812d9f56f27c32fb5f102083bbe418344c1a652",
"normalized_render_sha256": "04c161a58c1a9010efe38095b383b0e1d445a2b678e5bf931a1281d45196940d",
"normalized_render_sha256": "9e8ee39b557d1fbd032a94f5fbe16b675bdd89fe64b1c85a9af6a2ebe54aa976",
"target": "skills/qa/references/legacy/setup-browser-cookies.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -2934,7 +2934,7 @@
"source_path": "pair-agent/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "75ed42d590f99c46cd0883c37bb1f2f9f499211c",
"normalized_render_sha256": "8557ca390d0b6548f956d2c0e9316f1cf137689d4dc17d40a4525d19f22bc457",
"normalized_render_sha256": "e75661246495412102632a49d626bc313875ef479d2c570002ec66a2ccd2757a",
"target": "skills/qa/references/legacy/pair-agent.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -4136,7 +4136,7 @@
"source_path": "land-and-deploy/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "98976ad020d541d251cc7e34802a13458ddc88e2",
"normalized_render_sha256": "6920f3d97ce474b8f20c8b3e38ca9d3c03973e47af33103a60bab7c02eb867bd",
"normalized_render_sha256": "405924730c4e328c1a45de26576cda686d0d7da1fc4a36e840458683e1396aa2",
"target": "skills/ship/references/legacy/land-and-deploy.md",
"disposition": "BUG_FIX",
"overlays": [
@@ -4552,7 +4552,7 @@
"source_path": "gstack-upgrade/SKILL.md.tmpl",
"base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
"blob_sha": "5402a1da3c857cbf50668085fce53172b72bba0d",
"normalized_render_sha256": "a913cf77f76c4d68c576a06190b498e3d8d3b60b85498a68f173b23a7f800828",
"normalized_render_sha256": "2c8cf9e505b7da27730bf646a33ee38e8092259f3335a524c71e57ba5b602541",
"target": "skills/ship/references/legacy/gstack-upgrade.md",
"disposition": "DUPLICATE_INFRASTRUCTURE",
"overlays": [
@@ -5775,7 +5775,7 @@
"owner_tree": "qa",
"consumer_tree": "ship",
"target": "skills/ship/references/legacy/canary.md",
"sha256": "9fcf4fdea7d52113c8f5b5cc81c1fb36df591cf9e07bcc38c4ee106b15245997",
"sha256": "155174e829ef7895707ff1fad1f130fc1c7150bad9fb3598428a2efc939c5ad6",
"disposition": "SHARED_MODULE"
},
{
docs/gstack-2/RELEASE-INTEGRITY.md
+14 -5
View File
@@ -5,10 +5,11 @@ GStack has two explicit version identities during the 2.0 migration:
- `VERSION` and `package.json.version` are the repository/package release
counter. They remain byte-equal and retain the existing four-slot format so
the 1.x compatibility ship queue does not silently fail open.
- `package.json.gstack.runtimeVersion`, `runtime/index.js`,
`runtime/install.js`, and every standards-installed bootstrap declare the
managed-runtime protocol release `2.0.0`. The official artifact tag and
manifest use that value.
- `package.json.gstack.runtimeVersion`, `runtime/index.js`, and
`runtime/install.js` declare the managed-runtime protocol release `2.0.0`.
Each standards-installed bootstrap separately pins one immutable artifact
release tag. Candidate bootstraps use `v2.0.0-rc.N`; the manifest and bundle
remain runtime-compatible with `2.0.0`. Stable bootstraps use `v2.0.0`.
They are intentionally different namespaces. CI fails if either identity
drifts inside its own namespace.
@@ -24,6 +25,14 @@ linux-arm64 linux-x64 (glibc)
windows-arm64 windows-x64
```
Both `v2.0.0-rc.*` and `v2.0.0` tags use the same build, signing, manifest,
attestation, and smoke path. RC tags publish GitHub prereleases so the exact
fresh-machine production bootstrap can be exercised before the stable tag is
created. Runtime compatibility and release-channel identity are deliberately
separate: archive names and manifest `version` remain `2.0.0`, while URLs and
Sigstore certificate identity bind to the immutable RC or stable tag that
actually published them.
Each archive has one `gstack/` root and no symlinks. CI records an exact byte
count and SHA-256, signs the archive keylessly with Cosign, emits a Sigstore
bundle, and also creates a GitHub build-provenance attestation. The release
@@ -31,7 +40,7 @@ manifest contains only official GitHub Release URLs and the fixed workflow
certificate identity.
Browser-capable archives include the Playwright-managed Chromium directory at
`.gstack-runtime-browsers`. The builder runs `playwright install chromium`
`.gstack-runtime-browsers`. The builder runs `playwright-core install chromium`
only—never `--with-deps` or `sudo`—copies physical files into the immutable
slot, and launch-smokes that exact Chromium on every native release runner.
The stable capability launcher sets `PLAYWRIGHT_BROWSERS_PATH` to the active
docs/gstack-2/STATUS.md
+16 -4
View File
@@ -57,13 +57,13 @@ PR, or PR-ready claim is authorized by this status.
three retained Claude Haiku live samples are classified `REGRESSION`; they
are preserved as noisy supplemental evidence, never cherry-picked as a
primary gate or represented as green.
- [x] The current macOS GStack 2 suite is green: 151 pass / 0 fail and 1,194
assertions across 16 files.
- [x] The current macOS GStack 2 suite is green: 218 pass / 0 fail and 2,229
assertions across 20 files.
- [x] Optional host-neutral runtime implemented with canonical paths,
repo/worktree state identity, locks, atomic writes, effect claims,
doctor/config/state/cleanup, migrations, upgrade/rollback, and uninstall.
- [x] Managed runtime installer coverage is green at 25 pass / 0 fail and 341
assertions. The deterministic clean macOS arm64 managed-bundle audit records
- [x] Managed runtime installer coverage is green at 34 pass / 0 fail. The
deterministic clean macOS arm64 managed-bundle audit records
110 components, 1,829 files, 450,044,315 bytes, and 50 capability launchers.
This is a platform-specific bundle measurement, not a universal byte count;
platform-native package payloads differ. Setup installs frozen
@@ -75,6 +75,18 @@ PR, or PR-ready claim is authorized by this status.
production-only install with the development SDK absent, completed a local
browser journey and Sharp full-page screenshot, and uninstalled while
preserving state.
- [x] Browser-backed setup now fails closed until the user explicitly chooses
GStack-managed Chromium or one detected installed Chromium executable. The
local-only options step performs no network or state mutation; the signed
preview reports exact incremental bytes before a separate install approval;
only a successful install persists the host-neutral choice. Installed-browser
mode keeps the Playwright adapter while omitting managed Chromium payloads.
Visible extension-bearing GStack Browser remains managed-only. Focused setup
UX coverage is green at 22 pass / 0 fail, including no-network refusal,
provider-aware component planning, launcher propagation, and doctor launch.
The official live bootstrap remains pending until the corresponding signed
`v2.0.0-rc.6` component release is published; deterministic local evidence
does not relabel that production gate as passed.
- [x] The current candidate additionally captures a runtime-owned Bun 1.3.14
executable under `.gstack-runtime-tools`, records its path/version in the
bundle manifest, vendors the tagged license/source notices, and routes the
docs/gstack-2/TEST-EVIDENCE.md
+3 -2
View File
@@ -10,7 +10,7 @@ pass from deterministic, offline, or filesystem-only evidence.
| Command / probe | Observed result | What it proves / does not prove |
|---|---|---|
| Earlier focused macOS `bun test test/gstack2-*.test.ts` candidate run | **Exit 0: 136 pass / 0 fail**, 1,128 assertions across 15 files. Log: `/tmp/gstack2-test-command-candidate-final2.log`. | Historical focused checkpoint retained rather than overwritten. |
| Current macOS `bun run test:gstack2` | **Exit 0: 151 pass / 0 fail**, 1,194 assertions across 16 files. | Current generated freshness, routing, runtime, privacy, installer, upgrade, parity, and adversarial-harness surface is green. Native and broad evidence are recorded separately; this working-tree result is not attributed to the earlier native-CI commit. |
| Current macOS direct `bun test --timeout 60000 test/gstack2-*.test.ts` | **Exit 0: 218 pass / 0 fail**, 2,229 assertions across 20 files. | Current routing, runtime, privacy, installer, upgrade, parity, browser-provider setup, and adversarial-harness surface is green. The `test:gstack2` wrapper's generated-cleanliness precheck remains a commit-time gate, so this row records the direct underlying suite rather than relabeling that wrapper. |
| `bun test --timeout 30000 test/gstack2-skills.test.ts test/gstack2-skills-routing.test.ts` after regeneration | **Exit 0: 3 pass / 0 fail**, 81 assertions. | The pinned corpus/parity test and both 25-scenario structured-routing tests are green. This remains structural/fixture evidence, not specialist live execution. |
| `bun run scripts/gstack2/run-parity.ts`, 2026-07-17 rerun | **Exit 0: 4,681 checks passed**; 55 modules, 16 sections, 25 scenarios, 16 regressions, 78 assets. | Current source/render/provenance/contract/asset/fixture parity is green. It is deterministic parity, not live-host behavior. |
| Earlier regenerated structural parity checkpoint | **Exit 0: 2,403 checks passed** with the then-current 55/16/25/16/45 inventory. | Historical candidate checkpoint before later thin-prelude and asset coverage; superseded by the current 4,681-check rerun. |
@@ -30,7 +30,8 @@ pass from deterministic, offline, or filesystem-only evidence.
| `gstack context smoke --url https://www.context.dev --json` | **PASS:** the official `/web/scrape/markdown` endpoint returned `ok: true` and credit metadata. | The verified key entered through protected stdin/environment worked. The temporary secrets file was mode `0600`, the isolated home was removed, and the safe output did not contain the key. Committed redacted artifact: [`evals/context-dev/live-smoke-2026-07-17.json`](../../evals/context-dev/live-smoke-2026-07-17.json). |
| Standard installer matrix | **PASS: 510/510 checks**, 18 install cases, two removal cases, `skills` CLI 1.5.19. | Project/global installs pass for seven hosts, including Kimi Code CLI through the standard `.agents/skills` path; selected-skill and opt-in compatibility-alias cases, copies, and hashes pass. This remains installer/filesystem evidence. Committed artifact: [`evals/installation/install-matrix.json`](../../evals/installation/install-matrix.json). |
| Standard Agent Skills install + actual runtime-absent Codex invocation | **PASS.** Root `--list` returned exactly six. The selected source was `time-attack/gstack/skills --skill qa`; despite `skills` 1.5.19's pre-filter display counting hidden aliases, exactly one skill (`qa`) installed byte-identically. Codex exited 0 with `gstack` absent, reported `NEEDS_SETUP` and one approval prompt, changed no files, and created no runtime/browser/external-service activity. | Closes the actual-host runtime-absent judgment gate for Codex without overstating seven-host UI coverage. Artifact: [`standard-codex-runtime-absent-2026-07-17.json`](../../evals/installation/standard-codex-runtime-absent-2026-07-17.json). |
| `bun test test/gstack2-runtime-install.test.ts` | **Exit 0: 25 pass / 0 fail**, 341 assertions. | Managed allowlist, hashes, spaces, source/internal-link rejection, production-only frozen dependencies, deterministic exact Sharp/ngrok platform closure, native-load rollback smoke, rollback/recovery, stable launchers, wrapper neutrality, and state-preserving uninstall pass. |
| `bun test --timeout 30000 test/gstack2-runtime-install.test.ts` | **Exit 0: 41 pass / 0 fail.** | Managed allowlist, hashes, spaces, source/internal-link rejection, production-only frozen dependencies, deterministic exact Sharp/ngrok platform closure, native-load rollback smoke, atomic browser-choice rollback/recovery, provider-aware stable launchers, wrapper neutrality, and state-preserving uninstall pass. |
| `bun test --timeout 30000 test/gstack2-runtime-setup-ux.test.ts` | **Exit 0: 29 pass / 0 fail.** | Explicit managed/installed/later browser selection fails closed before network, local options do not mutate, signed previews remain provider-identical across same- and cross-release capability additions, developer-source provider switches replace the exact retained set, visible extension Chromium remains managed-only, and launcher/doctor paths honor the persisted selection. This is deterministic local evidence, not native Windows or every installed Chrome-family build. |
| Deterministic clean macOS arm64 managed runtime bundle audit | **110 components, 1,829 files, 450,044,315 bytes, 50 capability launchers.** | This is a platform-specific bundle measurement, not a universal byte count; platform-native package payloads differ. Setup includes the Sharp/ngrok closure and excludes the development-only Claude Agent SDK. The Hugging Face sidecar is outside the bundle and its package is development-only, so production setup installs neither its inference runtime nor model weights; the L4 capability reports unavailable. The standard skill installer remains Markdown-only. Committed artifact: [`evals/runtime-bundle/darwin-arm64.json`](../../evals/runtime-bundle/darwin-arm64.json); reproduce with `bun run scripts/gstack2/audit-runtime-bundle.ts --output evals/runtime-bundle/darwin-arm64.json`. |
| Earlier declared Linux Dev Container plus `bun run test:gstack2` inside it | **Exit 0: 136 pass / 0 fail, 1,127 assertions across 15 files.** Log: `/tmp/gstack2-devcontainer-gate-candidate-final4.log`. | Historical container checkpoint retained rather than overwritten; the current 150-test container result is recorded in the native-CI row below. |
| `scripts/gstack2/runtime-install-smoke.sh` in the clean Linux arm64 container | **Pass:** production-only frozen dependencies installed with the development Agent SDK and Hugging Face/ONNX runtime absent; the managed Anthropic SDK, Sharp, and ngrok imports passed; prebuilt capabilities rebuilt; setup/doctor/version/design/PDF passed; a local-browser journey and Sharp full-page screenshot passed; uninstall preserved state. | Proves a source copy with spaces can build and complete the managed runtime lifecycle without Git history, an executable local-model stack, or Darwin-only iOS artifacts. It is not native Windows evidence. |
docs/gstack-2/UPGRADE-AND-ROLLBACK.md
+1 -1
View File
@@ -10,7 +10,7 @@ Install the canonical Agent Skills source, then use that installer's tracked
source and lock metadata for discovery, updates, and removal:
```bash
npx skills add time-attack/gstack
npx skills add time-attack/gstack/skills
npx skills update # interactive scope
npx skills update -p # project installs only
npx skills update -g # global installs only