mirror of https://github.com/garrytan/gstack.git synced 2026-09-16 18:05:31 +02:00

Files

T

Garry TanandOpenAI Codex 9f81911136 v1.86.0.0 feat: route outside reviews by harness (#2850 )

* feat: add a restricted and supervised Claude Code runner

Preserve configured authentication and models while enforcing tool access, strict completion JSON, bounded output and process cleanup. Cover argv, failure handling, session metadata and Windows process containment.

* feat: route outside reviews by harness and migrate wrapper installs

Use Claude Code from Codex and Codex from other supported hosts, with shared invocation rendering, positive gate validation and per-phase provenance. Rename /claude to /claude-code, repair managed shared and copied installations safely, and generate native Kiro skills. Add installed-workflow, failure-injection and live cross-harness regression coverage.

* test: recognize CEO mode labels without terminal spacing

The paid workflow rendered SCOPEEXPANSION at option 4, but its driver required a literal space. Match the leading mode title without cursor-spacing artifacts and ignore adjacent preview text. Preserve missing-target failures and downstream posture assertions.

* test: isolate plan-count fixtures before starting review workflows

Seed the complete test plan in a private git repository before launching Claude, so a bare slash command cannot review the live workspace while a delayed fixture message remains queued. Preserve count thresholds, parsers and budgets. Add initial-context and installed-discovery tests, and retain startup/terminal diagnostics on failed evaluations.

* test: stabilize review fixtures and Claude eval startup

Preserve source boundaries in workflow judge inputs, isolate CEO mode plans, and wait for interactive trust input readiness. Keep startup failure evidence and retain existing models, budgets, and assertions.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test: classify collapsed review modes and isolate seeded findings

Keep review questions out of the setup count when terminal cursor positioning removes spaces. State existing webhook safeguards so the five-finding control measures its seeded defects without accidental extra security and concurrency gaps. Preserve question bands and the paired control.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test: isolate browser daemon state across free shards

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test: stabilize native review counting and interactive navigation

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: prepare v1.82.0.0 release

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix: eliminate browser and process-cleanup test flakes

Pin every CI surface to Bun 1.4.0 to avoid extra-stdio finalizers closing
reused live sockets. Add an isolated GC/listener regression that fails on
Bun 1.3.13, and prevent coordinated rollback to an affected CI runtime.

Check renderer cleanup against the render's own staging directory so
concurrent renders cannot invalidate the assertion. Make the no-pgrep
process-tree walk tolerate disappearing /proc entries, and synchronize
its test fixture through child readiness and pipe EOF instead of sleeps.

Validation: 9,157 passed, 31 skipped, zero failures across 556 files with
retries disabled. Build, all-host generation freshness, and skill checks
passed. All three races have failing-before/passing-after regressions.

* fix: count completed native review questions in evals

* fix: drive review navigation from confirmed native choices

* fix: require complete section-loading eval reports

* test: isolate telemetry HTTP transport from local assertions

* fix: keep review input on the active native question

* test: let tunnel revocation daemon choose an available port

* test: allocate available ports for pairing and watchdog fixtures

* fix: stabilize planning eval navigation and phase reporting

* test: isolate installed runtime paths in planning evals

* test: stabilize review evidence and concurrent refresh fixtures

* fix: resolve design findings before editing the plan

* fix: honor and persist disabled outside plan reviews

* fix: preserve planning decisions and terminal evidence

Load installed host reviews at autoplan phase entry and wait for completed
reviewers and saved artifacts. Reuse approved remedies while preserving
individual finding decisions.

Drive interactive evals from the current terminal viewport, bind native
questions across scrolling, and require complete native report evidence.
Cover captured stale menus, permission lifecycles, setup classification,
and disabled-review tool availability with deterministic regressions.

Advance release metadata and the upgrade migration to the unclaimed
1.83.0.0 slot.

* fix: drive native review questions and preserve current plans

Use the native single-choice keyboard protocol and current terminal viewport,
with per-question navigation inside packets and completed-call coverage.
Keep permissions, multi-select menus, and Submit controls distinct.

Send Autoplan reviewers the amended implementation plan, keep its review record
separate, and supply retained application contracts in the chain fixture.
Clarify individual DevEx decisions and complete CEO fix options; use one active
plan destination for the section-loading report.

* fix: preserve complete plan-review decisions

* fix: recognize native plan dialogs and reviewer controls

* fix: preserve review decisions and phase completion

* fix: recognize completed reviews without losing findings

* fix: preserve review continuity and native eval completion

* test: fix native review completion and eval retry isolation

* test: handle native review menus and complete eval fixtures

* test: fix native review setup, completion, and isolation failures

* test: limit native skill discovery to runtime assets

* fix: bind Autoplan reviews to full ordered phase inputs

* test: fix planning eval routing, counting, and timeout handling

* chore: advance queued release to v1.84.0.0

* fix: preserve complete review inputs and planning decisions

* fix: reconcile review approvals and preserve phase obligations

* fix: preserve review obligations and unblock eval permissions

Carry recorded Autoplan requirements into blind phase inputs, require Eng
review approvals before exit, and exercise combined asynchronous flows in
CEO reviews. Correct native finding and handoff classification and unblock
repeated report edits using scoped request identities.

* fix: retain plan requirements and complete native review dialogs

* fix: complete native review prompts and retain plan references

* fix: preserve review inputs and classify native eval evidence

* fix: check competing completion orders in CEO reviews

* fix: recognize review decisions and require phase methodology

Require the current phase methodology before Autoplan snapshots. Correct
substantive decision, closed handoff, and cache-finding classification, and
honor the recommended implementation approach in native review dialogs.

Add captured-transcript regressions without changing review thresholds,
provider models, retries, or deadlines.

* test: bind native review decisions and close completed handoffs

* fix: complete review dialogs and verify methodology delivery

* fix: preserve review evidence and unblock native eval prompts

* fix: handle native review question completions

* fix: recognize native review narration and controls

* fix: count native review decisions and isolate eval fixtures

* test: verify seeded review coverage and current artifact permissions

* test: isolate model and brain-aware skill renders

* fix: repair native workflow evaluation and clarify review steps

* fix: stabilize workflow eval evidence and review guidance

* test: repair native workflow observation and fixture isolation

* fix: recognize completed workflow evidence and owned skill reads

* test: repair seeded workflow delivery and completion evidence

* test: recognize current review evidence across native forms

* test: handle native review variants and permission redraws

* fix: honor review preferences and recognize native eval evidence

* test: recognize completed review decisions and queued permissions

* test: match current review contracts and partial-line edits

* test: recognize completed workflow evidence and bounded human waits

* fix: preserve review entry gates and native eval interactions

* fix: recognize native workflow evidence and preserve review gates

* test: recognize current review evidence and preconfigure workflow fixtures

* test: recognize completed review findings and scoped artifact permissions

* fix: stabilize native workflow review and permission evidence

* fix: recognize current review evidence and scoped edit confirmations

Clarify Design and engineering review entry instructions and Design scoring.
Recognize required legacy coverage and public Autoplan completion recaps.
Bind the pending Edit confirmation to its exact file, ordered digest, and
one-request approval when a preceding command display remains visible.
Keep reviews within their existing size limits and preserve scope gates
when extracting workflow fixtures from either supported preamble header.

Keep failure outcomes, review thresholds, provider choices, and eval budgets.

* fix: recover review workflow progress and eval evidence

* fix: recognize valid review evidence and scope selection

* test: fix review evidence parsing and repeated artifact prompts

* test: recognize valid review decisions and pending native cards

* fix(plan-eng-review): keep final navigation consistent with approved tasks

* test: recognize valid review evidence and bind legacy diff requests

* fix: stabilize review eval evidence and harness repair guidance

* docs: update project documentation for v1.85.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test: fix Windows CI fixtures and credential scan

Rebase captured JSON values and filesystem evidence using the appropriate
path convention. Compile native fake CLIs on Windows and synchronize pipe
holder readiness, with cleanup retained when assertions fail.

Assemble synthetic credential fixtures at runtime so the added-line scan
keeps enforcing the same gate without flagging its own rejection controls.

Discover generated skills directly for the empty-find regression check,
avoiding a recursive scan through saved evaluation artifacts and dependencies.

* fix: preserve source renders on Windows

Compare canonical generator paths using native separators so an output
sidecar pointing at the source cannot overwrite its skill or metadata.
Keep the regression fixture isolated from the real checkout and expose
freshness diagnostics before asserting subprocess status.

Detach Windows drain-test pipe holders from the fake provider's automatic
child cleanup while preserving the enclosing runner job and its assertions.

* fix: clarify outside review fallback and CEO decisions

Render one applicable own-harness fallback path and retain native review,
disabled policy, and missing-coverage semantics. Align report field names
and mode labels, and make the existing per-cut scope approval explicit.

Regenerate skill outputs and keep the workflow judge's model, thresholds,
and retry policy unchanged.

* chore: move release to free version slot (v1.86.0.0)

PR #2852 now claims v1.85.0.0. Align the release metadata and
rename migration so upgrades from that version still receive it.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix: include engineering review prerequisites and restore branch context

* fix: recognize coverage diagrams and clarify design review instructions

* fix: preserve file identities and join Windows test processes

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>

2026-09-14 14:32:45 -07:00

9.3 KiB

Raw Blame History

gstack — AI Engineering Workflow

gstack is a collection of SKILL.md files that give AI agents structured roles for software development. Each skill is a specialist: CEO reviewer, eng manager, designer, QA lead, release engineer, debugger, and more.

Available skills

Skills live in .agents/skills/ (or ~/.claude/skills/gstack/ on Claude Code). Invoke them by name (e.g., /office-hours).

Plan-mode reviews

Skill	What it does
`/office-hours`	Start here. Reframes your product idea before you write code.
`/plan-ceo-review`	CEO-level review: find the 10-star product in the request.
`/plan-eng-review`	Lock architecture, data flow, edge cases, and tests.
`/plan-design-review`	Rate each design dimension 0-10, explain what a 10 looks like.
`/plan-devex-review`	DX-mode review: TTHW, magical moments, friction points, persona traces.
`/plan-tune`	Self-tune AskUserQuestion sensitivity per question.
`/autoplan`	One command runs CEO → design → DX → eng review (eng always last).
`/design-consultation`	Build a complete design system from scratch.
`/spec`	Turn vague intent into a precise, executable spec in five phases. Files a GitHub issue, optionally spawns a Claude Code agent in a fresh worktree, and lets `/ship` close the source issue on merge.

Implementation + review

Skill	What it does
`/review`	Pre-landing PR review. Finds bugs that pass CI but break in prod.
`/codex`	Second opinion via OpenAI Codex. Review, challenge, or consult modes. Available outside the Codex harness.
`/claude-code`	Second opinion via Claude Code. Review, challenge, or consult modes. Available outside the Claude Code harness.
`/investigate`	Systematic root-cause debugging. No fixes without investigation.
`/design-review`	Live-site visual audit + fix loop with atomic commits.
`/design-shotgun`	Generate multiple AI design variants, comparison board, iterate.
`/design-html`	Generate production-quality Pretext-native HTML/CSS.
`/devex-review`	Live developer experience audit (TTHW measured against the real flow).
`/qa`	Open a real browser, find bugs, fix them, re-verify.
`/qa-only`	Same methodology as /qa but report only — no code changes.
`/scrape`	Pull data from a web page in your Aside browser, with your real logged-in state. Read-only. On the fallback browser a codified browser-skill answers a repeat intent in ~200ms.
`/skillify`	Codify the most recent successful `/scrape` flow into a permanent browser-skill (fallback browser only).

Release + deploy

Skill	What it does
`/ship`	Run tests, review, push, open PR. Workspace-aware version queue.
`/land-and-deploy`	Merge the PR, wait for CI and deploy, verify production health.
`/canary`	Post-deploy monitoring loop in your Aside browser (or gstack's own when Aside is absent).
`/landing-report`	Read-only dashboard for the workspace-aware ship queue.
`/document-release`	Update all docs to match what you just shipped.
`/document-generate`	Generate Diataxis docs (tutorial / how-to / reference / explanation) from code.
`/setup-deploy`	One-time deploy config detection (Fly.io, Render, Vercel, etc.).
`/gstack-upgrade`	Update gstack to the latest version.

Operational + memory

Skill	What it does
`/context-save`	Save working context (git state, decisions, remaining work).
`/context-restore`	Resume from a saved context, even across Conductor workspaces.
`/learn`	Manage what gstack learned across sessions.
`/retro`	Weekly retro with per-person breakdowns and shipping streaks.
`/health`	Code quality dashboard (type checker, linter, tests, dead code).
`/benchmark`	Performance regression detection (page load, Core Web Vitals).
`/benchmark-models`	Cross-model benchmark for skills (Claude, GPT, Gemini side-by-side).
`/cso`	OWASP Top 10 + STRIDE security audit.
`/setup-gbrain`	Set up gbrain for cross-machine session memory sync.
`/sync-gbrain`	Keep gbrain current with this repo's code; refresh agent search guidance in CLAUDE.md.

Browser + agent integration

Every browser skill drives the Aside AI browser first (macOS 15+, aside.com) — the user's real browser with their real sessions, through aside repl scripts; gstack never installs it. When Aside is not installed or not running (Linux, Windows, a closed Aside app) the same skills fall back automatically to gstack's own headless Chromium ($B), which is where the three skills under /browse apply.

Skill	What it does
`/browse`	Drive a browser: open a page, read it, click through a flow, screenshots, console errors. Aside first; gstack's own Chromium (~100ms/command) as the fallback. Every other browser skill stands on it.
`/open-gstack-browser`	Launch the visible GStack Browser with sidebar + stealth — the headed face of the fallback engine.
`/setup-browser-cookies`	Import cookies from your real browser into the fallback engine for authenticated testing. Unnecessary on Aside.
`/pair-agent`	Pair a remote AI agent (OpenClaw, Codex, etc.) with gstack's own browser over a scoped tunnel.

iOS QA — drive real iPhones over USB or Tailscale (v1.43.0.0+)

Skill	What it does
`/ios-qa`	Live-device iOS QA via USB CoreDevice tunnel + embedded StateServer. Optionally exposes the device over Tailscale so remote agents can drive it.
`/ios-fix`	Autonomous iOS bug fixer with regression snapshot capture.
`/ios-design-review`	Designer's-eye QA on a real iPhone — 10-dimension Apple HIG rubric.
`/ios-clean`	Convenience: strip DebugBridge + #if DEBUG wiring before a Release build.
`/ios-sync`	Regenerate the iOS debug bridge against the latest upstream templates.

Companion CLIs (run on the Mac that's plugged into the device):

Command	What it does
`gstack-ios-qa-daemon`	Mac-side broker. Loopback by default; `--tailnet` adds a Tailscale-facing listener with capability tiers and audit logging.
`gstack-ios-qa-mint`	Owner-grant CLI for the tailnet allowlist (`grant`/`revoke`/`list`).
`gstack-ios-qa-regen`	Regenerate the canonical local DebugBridge package and typed accessors (`--app-source` / `--bridge-dir`).

End-to-end walkthrough: docs/howto-ios-testing-with-gstack.md.

Safety + scoping

Skill	What it does
`/careful`	Warn before destructive commands (rm -rf, DROP TABLE, force-push).
`/freeze`	Lock edits to one directory. Hard block, not just a warning.
`/guard`	Activate both careful + freeze at once.
`/unfreeze`	Remove directory edit restrictions.
`/make-pdf`	Turn any markdown file into a publication-quality PDF. Renders through Aside, or gstack's own browser when Aside is absent.
`/diagram`	English in, diagram out: mermaid source + editable .excalidraw + SVG/PNG, offline. Renders through Aside, or gstack's own browser when Aside is absent.

Build commands

bun install              # install dependencies
bun run test             # run free tests via the strict shard runner (no API spend, ~90-100s)
bun run test:windows     # curated Windows-safe subset (runs on windows-latest)
bun run build            # generate docs + compile binaries
bun run gen:skill-docs   # regenerate SKILL.md files from templates
bun run skill:check      # health dashboard for all skills

Platform support

macOS + Linux: full test suite supported.
Windows: curated Windows-safe subset runs on windows-latest via the windows-free-tests CI job. Setup script (./setup) requires Git Bash or MSYS today; native PowerShell support is a future expansion. The bin/gstack-paths helper resolves state roots through CLAUDE_PLUGIN_DATA / GSTACK_HOME so plugin installs work on every platform.
Browser and renderer: the browser skills, /make-pdf, and /diagram drive the Aside browser first, which is macOS 15+ only. On Linux and Windows (or a Mac with Aside closed) the readiness check says so once and the same skills use gstack's own bundled browser, built by ./setup.

Key conventions

SKILL.md files are generated from .tmpl templates. Edit the template, not the output.
Run bun run gen:skill-docs --host codex to regenerate Codex-specific output.
Browser steps in skills are aside repl scripts per scripts/resolvers/aside.ts (Aside first), each with a $B equivalent for the fallback engine — $B <command> is the browse binary and is a legitimate tool when the Aside probe does not print READY. Local HTML renders through bin/gstack-render.ts, which picks the same way.
Safety skills (careful, freeze, guard) use inline advisory prose — always confirm before destructive operations.
State paths resolve via bin/gstack-paths (sourced via eval "$(...)"). Honors GSTACK_HOME, CLAUDE_PLUGIN_DATA, CLAUDE_PLANS_DIR.
The claude CLI binary resolves via lib/claude-bin.ts (re-exported from browse/src/claude-bin.ts for browse internals; Bun.which() + GSTACK_CLAUDE_BIN override). Set GSTACK_CLAUDE_BIN=wsl plus GSTACK_CLAUDE_BIN_ARGS='["claude"]' to run Claude through WSL on Windows.

9.3 KiB Raw Blame History