* fix: check for bun before running setup (#147) Users without bun installed got a cryptic "command not found" error. Now prints a clear message with install instructions. Closes #147 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: block SSRF via URL validation in browse commands (#17) Adds validateNavigationUrl() that blocks non-HTTP(S) schemes (file://, javascript:, data:) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Applied to goto, diff, and newTab commands. Localhost and private IPs remain allowed for local dev QA. Closes #17 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: replace eval $(gstack-slug) with source <(...) (#133) Eliminates unnecessary use of eval across all skill templates and generated files. source <(...) has identical behavior without the shell injection surface. Also hardens gstack-diff-scope usage. Closes #133 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: rename /debug to /investigate to avoid Claude Code conflict (#190) Claude Code has a built-in /debug command that shadows the gstack skill. Renaming to /investigate which better reflects the systematic root-cause investigation methodology. Closes #190 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: add unit tests for path validation helpers validateOutputPath() and validateReadPath() are security-critical functions with zero test coverage. Adds 14 tests covering safe paths, traversal attacks, and prefix collision edge cases. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: bump version and changelog (v0.8.3) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * docs: update /debug → /investigate references in docs CLAUDE.md, README.md, and docs/skills.md still referenced the old /debug skill name after the rename. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: harden URL validation against hostname bypasses (Codex P1) Codex review found that metadata IPs could be reached via hex (0xA9FEA9FE), decimal (2852039166), octal, trailing dot, and IPv6 bracket forms. Now normalizes hostnames before checking the blocklist and probes numeric IP representations via URL constructor. Also moves URL validation before page allocation in newTab() to prevent zombie tabs on rejection (Codex P3). 5 new test cases for bypass variants. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
6.5 KiB
Design Review Checklist (Lite)
Subset of DESIGN_METHODOLOGY — when adding items here, also update
generateDesignMethodology()inscripts/gen-skill-docs.ts, and vice versa.
Instructions
This checklist applies to source code in the diff — not rendered output. Read each changed frontend file (full file, not just diff hunks) and flag anti-patterns.
Trigger: Only run this checklist if the diff touches frontend files. Use gstack-diff-scope to detect:
source <(~/.claude/skills/gstack/bin/gstack-diff-scope <base> 2>/dev/null)
If SCOPE_FRONTEND=false, skip the entire design review silently.
DESIGN.md calibration: If DESIGN.md or design-system.md exists in the repo root, read it first. All findings are calibrated against the project's stated design system. Patterns explicitly blessed in DESIGN.md are NOT flagged. If no DESIGN.md exists, use universal design principles.
Confidence Tiers
Each item is tagged with a detection confidence level:
- [HIGH] — Reliably detectable via grep/pattern match. Definitive findings.
- [MEDIUM] — Detectable via pattern aggregation or heuristic. Flag as findings but expect some noise.
- [LOW] — Requires understanding visual intent. Present as: "Possible issue — verify visually or run /design-review."
Classification
AUTO-FIX (mechanical CSS fixes only — HIGH confidence, no design judgment needed):
outline: nonewithout replacement → addoutline: revertor&:focus-visible { outline: 2px solid currentColor; }!importantin new CSS → remove and fix specificityfont-size< 16px on body text → bump to 16px
ASK (everything else — requires design judgment):
- All AI slop findings, typography structure, spacing choices, interaction state gaps, DESIGN.md violations
LOW confidence items → present as "Possible: [description]. Verify visually or run /design-review." Never AUTO-FIX.
Output Format
Design Review: N issues (X auto-fixable, Y need input, Z possible)
**AUTO-FIXED:**
- [file:line] Problem → fix applied
**NEEDS INPUT:**
- [file:line] Problem description
Recommended fix: suggested fix
**POSSIBLE (verify visually):**
- [file:line] Possible issue — verify with /design-review
If no issues found: Design Review: No issues found.
If no frontend files changed: skip silently, no output.
Categories
1. AI Slop Detection (6 items) — highest priority
These are the telltale signs of AI-generated UI that no designer at a respected studio would ship.
-
[MEDIUM] Purple/violet/indigo gradient backgrounds or blue-to-purple color schemes. Look for
linear-gradientwith values in the#6366f1–#8b5cf6range, or CSS custom properties resolving to purple/violet. -
[LOW] The 3-column feature grid: icon-in-colored-circle + bold title + 2-line description, repeated 3x symmetrically. Look for a grid/flex container with exactly 3 children that each contain a circular element + heading + paragraph.
-
[LOW] Icons in colored circles as section decoration. Look for elements with
border-radius: 50%+ a background color used as decorative containers for icons. -
[HIGH] Centered everything:
text-align: centeron all headings, descriptions, and cards. Grep fortext-align: centerdensity — if >60% of text containers use center alignment, flag it. -
[MEDIUM] Uniform bubbly border-radius on every element: same large radius (16px+) applied to cards, buttons, inputs, containers uniformly. Aggregate
border-radiusvalues — if >80% use the same value ≥16px, flag it. -
[MEDIUM] Generic hero copy: "Welcome to [X]", "Unlock the power of...", "Your all-in-one solution for...", "Revolutionize your...", "Streamline your workflow". Grep HTML/JSX content for these patterns.
2. Typography (4 items)
-
[HIGH] Body text
font-size< 16px. Grep forfont-sizedeclarations onbody,p,.text, or base styles. Values below 16px (or 1rem when base is 16px) are flagged. -
[HIGH] More than 3 font families introduced in the diff. Count distinct
font-familydeclarations. Flag if >3 unique families appear across changed files. -
[HIGH] Heading hierarchy skipping levels:
h1followed byh3without anh2in the same file/component. Check HTML/JSX for heading tags. -
[HIGH] Blacklisted fonts: Papyrus, Comic Sans, Lobster, Impact, Jokerman. Grep
font-familyfor these names.
3. Spacing & Layout (4 items)
-
[MEDIUM] Arbitrary spacing values not on a 4px or 8px scale, when DESIGN.md specifies a spacing scale. Check
margin,padding,gapvalues against the stated scale. Only flag when DESIGN.md defines a scale. -
[MEDIUM] Fixed widths without responsive handling:
width: NNNpxon containers withoutmax-widthor@mediabreakpoints. Risk of horizontal scroll on mobile. -
[MEDIUM] Missing
max-widthon text containers: body text or paragraph containers with nomax-widthset, allowing lines >75 characters. Check formax-widthon text wrappers. -
[HIGH]
!importantin new CSS rules. Grep for!importantin added lines. Almost always a specificity escape hatch that should be fixed properly.
4. Interaction States (3 items)
-
[MEDIUM] Interactive elements (buttons, links, inputs) missing hover/focus states. Check if
:hoverand:focusor:focus-visiblepseudo-classes exist for new interactive element styles. -
[HIGH]
outline: noneoroutline: 0without a replacement focus indicator. Grep foroutline:\s*noneoroutline:\s*0. This removes keyboard accessibility. -
[LOW] Touch targets < 44px on interactive elements. Check
min-height/min-width/paddingon buttons and links. Requires computing effective size from multiple properties — low confidence from code alone.
5. DESIGN.md Violations (3 items, conditional)
Only apply if DESIGN.md or design-system.md exists:
-
[MEDIUM] Colors not in the stated palette. Compare color values in changed CSS against the palette defined in DESIGN.md.
-
[MEDIUM] Fonts not in the stated typography section. Compare
font-familyvalues against DESIGN.md's font list. -
[MEDIUM] Spacing values outside the stated scale. Compare
margin/padding/gapvalues against DESIGN.md's spacing scale.
Suppressions
Do NOT flag:
- Patterns explicitly documented in DESIGN.md as intentional choices
- Third-party/vendor CSS files (node_modules, vendor directories)
- CSS resets or normalize stylesheets
- Test fixture files
- Generated/minified CSS