@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/src/tunnel-denial-log.ts

@@ -1,97 +0,0 @@
-/**
- * Append-only log of tunnel-surface auth denials.
- *
- * Records every time a tunneled request is rejected by enforceTunnelPolicy
- * (root token sent over tunnel, missing scoped token, disallowed command, etc).
- * Gives operators visibility into who is actually probing their tunneled
- * daemons so the next security wave can be driven by real attack data.
- *
- * Design notes:
- * - Async via fs.promises.appendFile. NEVER appendFileSync — blocking the event
- *   loop on every denial during a flood is exactly what an attacker wants.
- *   (Prior learning: sync-audit-log-io, 10/10 confidence.)
- * - Rate-capped at 60 writes/minute globally. Excess denials are counted in
- *   memory but not written to disk — prevents disk DoS.
- * - Writes to ~/.gstack/security/attempts.jsonl, shared with the prompt-injection
- *   attempt log. File rotation is handled by the existing security pipeline.
- */
-import { promises as fsp } from 'fs';
-import * as path from 'path';
-import { mkdirSecure } from './file-permissions';
-import { resolveStateRoot } from '../../lib/state-root';
-
-const RATE_CAP = 60; // writes per minute
-const WINDOW_MS = 60_000;
-
-const writeTimestamps: number[] = [];
-let droppedSinceLastWrite = 0;
-let ensuredDir: string | null = null;
-
-async function ensureDir(dir: string): Promise<void> {
-  if (ensuredDir === dir) return;
-  try {
-    // Sync mkdir is fine here — runs once per process at first denial. The
-    // (OI)(CI) inheritance set on Windows means subsequent fsp.appendFile
-    // writes pick up the owner-only ACL automatically.
-    mkdirSecure(dir);
-    ensuredDir = dir;
-  } catch {
-    // Swallow — log writes are best-effort. Failure to mkdir just means
-    // subsequent appends will also fail and be caught below.
-  }
-}
-
-export interface TunnelDenialEntry {
-  reason: string;
-  path: string;
-  method: string;
-  sourceIp: string;
-}
-
-export function logTunnelDenial(req: Request, url: URL, reason: string): void {
-  const now = Date.now();
-  // Drop stale timestamps
-  while (writeTimestamps.length && writeTimestamps[0] < now - WINDOW_MS) {
-    writeTimestamps.shift();
-  }
-  if (writeTimestamps.length >= RATE_CAP) {
-    droppedSinceLastWrite += 1;
-    return;
-  }
-  writeTimestamps.push(now);
-
-  const sourceIp =
-    req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown';
-
-  const entry: Record<string, unknown> = {
-    ts: new Date(now).toISOString(),
-    kind: 'tunnel_auth_denial',
-    reason,
-    path: url.pathname,
-    method: req.method,
-    sourceIp,
-  };
-  if (droppedSinceLastWrite > 0) {
-    entry.droppedSinceLastWrite = droppedSinceLastWrite;
-    droppedSinceLastWrite = 0;
-  }
-
-  // Fire and forget. Never await, never block the request path.
-  void (async () => {
-    try {
-      const dir = path.join(resolveStateRoot(), 'security');
-      await ensureDir(dir);
-      await fsp.appendFile(path.join(dir, 'attempts.jsonl'), JSON.stringify(entry) + '\n');
-    } catch {
-      // Swallow — log writes are best-effort. If disk is full or ACLs block
-      // us, we don't want to crash the server.
-    }
-  })();
-}
-
-// Test-only reset. Never called in production.
-export function __resetTunnelDenialLog(): void {
-  writeTimestamps.length = 0;
-  droppedSinceLastWrite = 0;
-  ensuredDir = null;
-}

package/.agent/skills/gstack-browse/src/url-validation.ts

@@ -1,299 +0,0 @@
-/**
- * URL validation for navigation commands — blocks dangerous schemes and cloud metadata endpoints.
- * Localhost and private IPs are allowed (primary use case: QA testing local dev servers).
- */
-
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import { validateReadPath } from './path-security';
-
-/** Metadata services reached by name rather than address. */
-const BLOCKED_METADATA_HOSTNAMES = new Set([
-  'metadata.google.internal', // GCP metadata
-  'metadata.azure.internal',  // Azure IMDS
-]);
-
-/**
- * Classify one host literal (URL hostname, cookie domain, or a resolved A/AAAA
- * answer). Returns null when the host is not an IP literal. Single source of
- * truth for navigation (literal, DNS answers, redirects, page-driven
- * navigations) and for session-persist's cookie-domain guard.
- *
- * - 'blocked': IPv4 link-local 169.254.0.0/16 (cloud metadata and container
- *   credential services such as 169.254.170.2), Alibaba's 100.100.100.200,
- *   IPv6 link-local fe80::/10 and ULA fc00::/7, and any of these embedded in
- *   IPv4-mapped (::ffff:), IPv4-compatible (::) or NAT64 (64:ff9b::) IPv6.
- * - 'loopback': 127.0.0.0/8 and ::1.
- * - 'other': every other address (RFC 1918 dev servers stay allowed).
- *
- * The URL parser canonicalizes decimal, octal and hex IPv4 forms
- * (2852039166, 0251.0376.0251.0376, 0xA9FEA9FE) and IPv6 spellings first.
- */
-export function classifyAddress(host: string): 'blocked' | 'loopback' | 'other' | null {
-  let h = host.trim().toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
-  if (!h) return null;
-  if (h.includes(':')) {
-    try { h = new URL(`http://[${h}]/`).hostname.slice(1, -1); } catch { return null; }
-    const groups = expandIpv6(h);
-    if (!groups) return null;
-    const head = groups.slice(0, 6).map(g => g.toString(16)).join(':');
-    if (head === '0:0:0:0:0:ffff' || head === '64:ff9b:0:0:0:0' || (head === '0:0:0:0:0:0' && groups[6] !== 0)) {
-      return classifyIpv4([groups[6] >> 8, groups[6] & 255, groups[7] >> 8, groups[7] & 255]);
-    }
-    if (groups.every((g, i) => g === (i === 7 ? 1 : 0))) return 'loopback';
-    if ((groups[0] & 0xfe00) === 0xfc00 || (groups[0] & 0xffc0) === 0xfe80) return 'blocked';
-    return 'other';
-  }
-  try { h = new URL(`http://${h}/`).hostname; } catch { return null; }
-  const m = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(h);
-  return m ? classifyIpv4(m.slice(1).map(Number)) : null;
-}
-
-function classifyIpv4([a, b, c, d]: number[]): 'blocked' | 'loopback' | 'other' {
-  if (a === 169 && b === 254) return 'blocked';
-  if (a === 100 && b === 100 && c === 100 && d === 200) return 'blocked';
-  return a === 127 ? 'loopback' : 'other';
-}
-
-/** Expand a canonical IPv6 literal to eight 16-bit groups. */
-function expandIpv6(addr: string): number[] | null {
-  const halves = addr.split('::');
-  if (halves.length > 2) return null;
-  const parse = (part: string) => (part ? part.split(':') : []).map(g => parseInt(g, 16));
-  const head = parse(halves[0]);
-  const tail = halves.length === 2 ? parse(halves[1]) : [];
-  const fill = 8 - head.length - tail.length;
-  if (fill < 0 || (halves.length === 1 && fill !== 0)) return null;
-  const groups = [...head, ...Array(fill).fill(0), ...tail];
-  return groups.every(g => Number.isInteger(g) && g >= 0 && g <= 0xffff) ? groups : null;
-}
-
-/**
- * Resolve a hostname and report whether any A or AAAA answer is blocked.
- * Each family is tried independently; a missing family is not a risk. DNS
- * infrastructure failure fails open. Connection-time rebinding (a different
- * answer when Chromium connects) is out of scope.
- */
-async function resolvesToBlockedIp(hostname: string): Promise<boolean> {
-  try {
-    const { resolve4, resolve6 } = (await import('node:dns')).promises;
-    const check = (lookup: Promise<string[]>) => lookup.then(
-      (addresses) => addresses.some(addr => classifyAddress(addr) === 'blocked'),
-      () => false,
-    );
-    const [v4, v6] = await Promise.all([check(resolve4(hostname)), check(resolve6(hostname))]);
-    return v4 || v6;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Why an http(s) navigation target is refused, or null when it is allowed.
- * Applied to explicit navigations (validateNavigationUrl) and to every
- * navigation request the browser makes, including redirect hops and
- * page-driven navigations (BrowserManager's navigation guard).
- */
-export async function blockedNavigationReason(url: string): Promise<string | null> {
-  let parsed: URL;
-  try { parsed = new URL(url); } catch { return null; }
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null;
-  const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
-  const kind = classifyAddress(hostname);
-  if (kind === 'blocked' || BLOCKED_METADATA_HOSTNAMES.has(hostname)) {
-    return `Blocked: ${parsed.hostname} is a cloud metadata or link-local address. Access is denied for security.`;
-  }
-  if (kind !== null || hostname === 'localhost') return null;
-  if (await resolvesToBlockedIp(hostname)) {
-    return `Blocked: ${parsed.hostname} resolves to a cloud metadata or link-local address. Possible DNS rebinding attack.`;
-  }
-  return null;
-}
-
-/**
- * Normalize non-standard file:// URLs into absolute form before the WHATWG URL parser
- * sees them. Handles cwd-relative, home-relative, and bare-segment shapes that the
- * standard parser would otherwise mis-interpret as hostnames.
- *
- *   file:///abs/path.html       → unchanged
- *   file://./<rel>              → file://<cwd>/<rel>
- *   file://~/<rel>              → file://<HOME>/<rel>
- *   file://<single-segment>/... → file://<cwd>/<single-segment>/...  (cwd-relative)
- *   file://localhost/<abs>      → unchanged
- *   file://<host-like>/...      → unchanged (caller rejects via host heuristic)
- *
- * Rejects empty (file://) and root-only (file:///) URLs — these would silently
- * trigger Chromium's directory listing, which is a different product surface.
- */
-export function normalizeFileUrl(url: string): string {
-  if (!url.toLowerCase().startsWith('file:')) return url;
-
-  // Split off query + fragment BEFORE touching the path — SPAs + fixture URLs rely
-  // on these. path.resolve would URL-encode `?` and `#` as `%3F`/`%23` (and
-  // pathToFileURL drops them entirely), silently routing preview URLs to the
-  // wrong fixture. Extract, normalize the path, reattach at the end.
-  //
-  // Parse order: `?` before `#` per RFC 3986 — '?' in a fragment is literal.
-  // Find the FIRST `?` or `#`, whichever comes first, and take everything
-  // after (including the delimiter) as the trailing segment.
-  const qIdx = url.indexOf('?');
-  const hIdx = url.indexOf('#');
-  let delimIdx = -1;
-  if (qIdx >= 0 && hIdx >= 0) delimIdx = Math.min(qIdx, hIdx);
-  else if (qIdx >= 0) delimIdx = qIdx;
-  else if (hIdx >= 0) delimIdx = hIdx;
-
-  const pathPart = delimIdx >= 0 ? url.slice(0, delimIdx) : url;
-  const trailing = delimIdx >= 0 ? url.slice(delimIdx) : '';
-
-  const rest = pathPart.slice('file:'.length);
-
-  // file:/// or longer → standard absolute; pass through unchanged (caller validates path).
-  if (rest.startsWith('///')) {
-    // Reject bare root-only (file:/// with nothing after)
-    if (rest === '///' || rest === '////') {
-      throw new Error('Invalid file URL: file:/// has no path. Use file:///<absolute-path>.');
-    }
-    return pathPart + trailing;
-  }
-
-  // Everything else: must start with // (we accept file://... only)
-  if (!rest.startsWith('//')) {
-    throw new Error(`Invalid file URL: ${url}. Use file:///<absolute-path> or file://./<rel> or file://~/<rel>.`);
-  }
-
-  const afterDoubleSlash = rest.slice(2);
-
-  // Reject empty (file://) and trailing-slash-only (file://./ listing cwd).
-  if (afterDoubleSlash === '') {
-    throw new Error('Invalid file URL: file:// is empty. Use file:///<absolute-path>.');
-  }
-  if (afterDoubleSlash === '.' || afterDoubleSlash === './') {
-    throw new Error('Invalid file URL: file://./ would list the current directory. Use file://./<filename> to render a specific file.');
-  }
-  if (afterDoubleSlash === '~' || afterDoubleSlash === '~/') {
-    throw new Error('Invalid file URL: file://~/ would list the home directory. Use file://~/<filename> to render a specific file.');
-  }
-
-  // Home-relative: file://~/<rel>
-  if (afterDoubleSlash.startsWith('~/')) {
-    const rel = afterDoubleSlash.slice(2);
-    const absPath = path.join(os.homedir(), rel);
-    return pathToFileURL(absPath).href + trailing;
-  }
-
-  // cwd-relative with explicit ./ : file://./<rel>
-  if (afterDoubleSlash.startsWith('./')) {
-    const rel = afterDoubleSlash.slice(2);
-    const absPath = path.resolve(process.cwd(), rel);
-    return pathToFileURL(absPath).href + trailing;
-  }
-
-  // localhost host explicitly allowed: file://localhost/<abs> (pass through to standard parser).
-  if (afterDoubleSlash.toLowerCase().startsWith('localhost/')) {
-    return pathPart + trailing;
-  }
-
-  // Ambiguous: file://<segment>/<rest> — treat as cwd-relative ONLY if <segment> is a
-  // simple path name (no dots, no colons, no backslashes, no percent-encoding, no
-  // IPv6 brackets, no Windows drive letter pattern).
-  const firstSlash = afterDoubleSlash.indexOf('/');
-  const segment = firstSlash === -1 ? afterDoubleSlash : afterDoubleSlash.slice(0, firstSlash);
-
-  // Reject host-like segments: dotted names (docs.v1), IPs (127.0.0.1), IPv6 ([::1]),
-  // drive letters (C:), percent-encoded, or backslash paths.
-  const looksLikeHost = /[.:\\%]/.test(segment) || segment.startsWith('[');
-  if (looksLikeHost) {
-    throw new Error(
-      `Unsupported file URL host: ${segment}. Use file:///<absolute-path> for local files (network/UNC paths are not supported).`
-    );
-  }
-
-  // Simple-segment cwd-relative: file://docs/page.html → cwd/docs/page.html
-  const absPath = path.resolve(process.cwd(), afterDoubleSlash);
-  return pathToFileURL(absPath).href + trailing;
-}
-
-/**
- * Validate a navigation URL and return a normalized version suitable for page.goto().
- *
- * Callers MUST use the return value — normalization of non-standard file:// forms
- * only takes effect at the navigation site, not at the original URL.
- *
- * Callers (keep this list current, grep before removing):
- *   - write-commands.ts:goto
- *   - meta-commands.ts:diff (both URL args)
- *   - browser-manager.ts:newTab
- *   - browser-manager.ts:restoreState
- */
-export async function validateNavigationUrl(url: string): Promise<string> {
-  // Normalize non-standard file:// shapes before the URL parser sees them.
-  let normalized = url;
-  if (url.toLowerCase().startsWith('file:')) {
-    normalized = normalizeFileUrl(url);
-  }
-
-  let parsed: URL;
-  try {
-    parsed = new URL(normalized);
-  } catch {
-    throw new Error(`Invalid URL: ${url}`);
-  }
-
-  // file:// path: validate against safe-dirs and allow; otherwise defer to http(s) logic.
-  if (parsed.protocol === 'file:') {
-    // Reject non-empty non-localhost hosts (UNC / network paths).
-    if (parsed.host !== '' && parsed.host.toLowerCase() !== 'localhost') {
-      throw new Error(
-        `Unsupported file URL host: ${parsed.host}. Use file:///<absolute-path> for local files.`
-      );
-    }
-
-    // Convert URL → filesystem path with proper decoding (handles %20, %2F, etc.)
-    // fileURLToPath strips query + hash; we reattach them after validation so SPA
-    // fixture URLs like file:///tmp/app.html?route=home#login survive intact.
-    let fsPath: string;
-    try {
-      fsPath = fileURLToPath(parsed);
-    } catch (e: any) {
-      throw new Error(`Invalid file URL: ${url} (${e.message})`);
-    }
-
-    // Reject path traversal after decoding — e.g. file:///tmp/safe%2F..%2Fetc/passwd
-    // Note: fileURLToPath doesn't collapse .., so a literal '..' in the decoded path
-    // is suspicious. path.resolve will normalize it; check the result against safe dirs.
-    validateReadPath(fsPath);
-
-    // Return the canonical file:// URL derived from the filesystem path + original
-    // query + hash. This guarantees page.goto() gets a well-formed URL regardless
-    // of input shape while preserving SPA route/query params.
-    return pathToFileURL(fsPath).href + parsed.search + parsed.hash;
-  }
-
-  // about:blank ONLY — the canonical empty page, and the one the daemon opens its own
-  // first tab on. Blocking it meant `browse newtab about:blank` failed, which is what
-  // `make-pdf setup` runs as its Chromium smoke test: make-pdf reported "Chromium failed
-  // to launch" against a perfectly healthy Chromium, and any browse session whose daemon
-  // restarted could never recreate the blank tab it starts from.
-  //
-  // Deliberately not the whole `about:` scheme. about:blank has no origin, loads nothing
-  // and runs nothing; about:config, about:net-internals and friends are real surfaces.
-  // Exact href match, not a prefix test, so `about:blankfoo` stays blocked.
-  // Compared lower-cased: the URL parser normalises the PROTOCOL but not the opaque part,
-  // so `ABOUT:BLANK` parses to href `about:BLANK` and an exact === would reject it.
-  if (parsed.protocol === 'about:' && parsed.href.toLowerCase() === 'about:blank') {
-    return 'about:blank';
-  }
-
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-    throw new Error(
-      `Blocked: scheme "${parsed.protocol}" is not allowed. Only http:, https:, file:, and about:blank URLs are permitted.`
-    );
-  }
-
-  const blocked = await blockedNavigationReason(parsed.href);
-  if (blocked) throw new Error(blocked);
-
-  return url;
-}

package/.agent/skills/gstack-browse/src/welcome.html

@@ -1,237 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>GStack Browser</title>
-<link href="https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
-<link href="https://api.fontshare.com/v2/css?f[]=satoshi@700,900&display=swap" rel="stylesheet">
-<style>
-  :root {
-    --amber-400: #FBBF24;
-    --amber-500: #F59E0B;
-    --zinc-400: #A1A1AA;
-    --zinc-600: #52525B;
-    --zinc-800: #27272A;
-    --surface: #141414;
-    --base: #0C0C0C;
-    --border: #262626;
-  }
-  * { margin: 0; padding: 0; box-sizing: border-box; }
-  html, body { height: 100%; overflow: hidden; }
-  body {
-    background: var(--base);
-    color: #e4e4e7;
-    font-family: 'DM Sans', sans-serif;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-  }
-  body::after {
-    content: '';
-    position: fixed;
-    top: 0; left: 0; right: 0; bottom: 0;
-    pointer-events: none;
-    z-index: 9999;
-    opacity: 0.03;
-    background-image: url("data:image/svg+xml,%3Csvg viewBox='0 0 256 256' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.85' numOctaves='4' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23n)'/%3E%3C/svg%3E");
-    background-size: 128px 128px;
-  }
-  .page { width: 100%; max-width: 1060px; padding: 0 40px; }
-
-  /* Sidebar prompt — points RIGHT toward where sidebar opens */
-  .sidebar-prompt {
-    position: fixed;
-    top: 80px;
-    right: 20px;
-    z-index: 100;
-    display: flex;
-    align-items: center;
-    gap: 10px;
-    transition: opacity 300ms ease-out;
-  }
-  .sidebar-prompt .bubble {
-    background: var(--amber-500);
-    color: #000;
-    font-size: 13px;
-    font-weight: 600;
-    padding: 10px 16px;
-    border-radius: 10px;
-    max-width: 220px;
-    text-align: left;
-    line-height: 1.4;
-  }
-  .sidebar-prompt .arrow-right {
-    font-size: 28px;
-    color: var(--amber-500);
-    animation: nudge 1.5s ease-in-out infinite;
-  }
-  @keyframes nudge {
-    0%, 100% { transform: translateX(0); }
-    50% { transform: translateX(6px); }
-  }
-  .sidebar-prompt.hidden { opacity: 0; pointer-events: none; }
-
-  /* Hero */
-  .hero { margin-bottom: 36px; }
-  .logo-row { display: inline-flex; align-items: center; gap: 10px; margin-bottom: 10px; }
-  .logo-dot {
-    width: 10px; height: 10px; border-radius: 50%; background: var(--amber-500);
-    animation: pulse 2s ease-in-out infinite;
-  }
-  @keyframes pulse {
-    0%, 100% { opacity: 1; box-shadow: 0 0 0 0 rgba(245,158,11,0.4); }
-    50% { opacity: 0.8; box-shadow: 0 0 0 6px rgba(245,158,11,0); }
-  }
-  .logo-text { font-family: 'Satoshi', sans-serif; font-weight: 900; font-size: 28px; color: #fff; letter-spacing: -0.5px; }
-  .tagline { font-size: 15px; color: var(--zinc-400); max-width: 560px; line-height: 1.6; }
-
-  /* Feature cards — 3 columns for 6 cards */
-  .features { display: grid; grid-template-columns: 1fr 1fr 1fr; gap: 14px; margin-bottom: 28px; }
-  .feat {
-    background: var(--surface);
-    border: 1px solid var(--border);
-    border-radius: 12px;
-    padding: 20px;
-  }
-  .feat-title {
-    font-family: 'Satoshi', sans-serif;
-    font-weight: 700;
-    font-size: 15px;
-    color: #fff;
-    margin-bottom: 6px;
-  }
-  .feat p { font-size: 13px; color: var(--zinc-400); line-height: 1.5; }
-  .feat .hl { color: #e4e4e7; font-weight: 500; }
-  .feat code {
-    font-family: 'JetBrains Mono', monospace;
-    font-size: 12px;
-    color: var(--amber-400);
-    background: rgba(245,158,11,0.08);
-    padding: 1px 5px;
-    border-radius: 3px;
-  }
-
-  /* Try it strip */
-  .try-strip {
-    background: var(--surface);
-    border: 1px solid var(--border);
-    border-radius: 12px;
-    padding: 20px 24px;
-    margin-bottom: 24px;
-  }
-  .try-title {
-    font-family: 'JetBrains Mono', monospace;
-    font-size: 12px;
-    color: var(--amber-400);
-    text-transform: uppercase;
-    letter-spacing: 0.5px;
-    margin-bottom: 12px;
-  }
-  .try-items { display: flex; flex-direction: column; gap: 8px; }
-  .try-item {
-    font-size: 13px;
-    color: var(--zinc-400);
-    line-height: 1.5;
-    padding-left: 16px;
-    position: relative;
-  }
-  .try-item::before {
-    content: '';
-    position: absolute;
-    left: 0;
-    top: 8px;
-    width: 6px;
-    height: 6px;
-    border-radius: 50%;
-    background: var(--zinc-600);
-  }
-  .try-item .hl { color: #e4e4e7; font-weight: 500; }
-
-  /* Footer */
-  .footer {}
-  .footer p { font-size: 12px; color: var(--zinc-600); }
-  .footer a { color: var(--zinc-400); text-decoration: none; }
-  .footer a:hover { color: var(--amber-400); }
-
-  @media (max-width: 900px) {
-    .features { grid-template-columns: 1fr 1fr; }
-  }
-  @media (max-width: 600px) {
-    .features { grid-template-columns: 1fr; }
-    html, body { overflow: auto; }
-    .sidebar-prompt { right: 40px; }
-  }
-</style>
-</head>
-<body>
-
-<div class="sidebar-prompt" id="sidebar-prompt">
-  <div class="bubble">Open the sidebar to get started. Click the puzzle piece icon in the toolbar, then pin gstack browse.</div>
-  <span class="arrow-right">&#x2192;</span>
-</div>
-
-<div class="page">
-  <header class="hero">
-    <div class="logo-row">
-      <div class="logo-dot"></div>
-      <span class="logo-text">GStack Browser</span>
-    </div>
-    <p class="tagline">This browser is connected to your Claude Code session. The sidebar is your co-pilot: it can control this window, read pages, edit CSS, and pass everything back to your terminal.</p>
-  </header>
-
-  <div class="features">
-    <div class="feat">
-      <div class="feat-title">Talk to the sidebar</div>
-      <p>The sidebar chat is a Claude instance that <span class="hl">controls this browser</span>. Say "go to my app and check if login works" and watch it navigate, click, fill forms, and report back.</p>
-    </div>
-    <div class="feat">
-      <div class="feat-title">Or use your main agent</div>
-      <p>Your Claude Code terminal <span class="hl">also controls this browser</span>. Run <code>/qa</code>, <code>/design-review</code>, or any skill and watch every action happen here. Two agents, one browser.</p>
-    </div>
-    <div class="feat">
-      <div class="feat-title">Import your cookies</div>
-      <p>Click <span class="hl">🍪 Cookies</span> in the sidebar to import login sessions from Chrome, Arc, or Brave. Browse authenticated pages <span class="hl">without logging in again</span>.</p>
-    </div>
-    <div class="feat">
-      <div class="feat-title">Clean up any page</div>
-      <p>Click <span class="hl">Cleanup</span> in the sidebar. AI identifies overlays, paywalls, cookie banners, and clutter, then <span class="hl">removes them</span>. Articles become readable.</p>
-    </div>
-    <div class="feat">
-      <div class="feat-title">Smart screenshots</div>
-      <p>The <span class="hl">Screenshot</span> button captures a cleaned screenshot and sends it to your Claude Code session as context. "What's wrong with this page?" now has a visual answer.</p>
-    </div>
-    <div class="feat">
-      <div class="feat-title">Modify any page</div>
-      <p>The sidebar can <span class="hl">edit CSS and DOM</span> on any page. "Make the header sticky" or "change the font to Inter." Changes happen live, reported back to your terminal.</p>
-    </div>
-  </div>
-
-  <div class="try-strip">
-    <div class="try-title">Try it now</div>
-    <div class="try-items">
-      <div class="try-item">Open the sidebar and type: <span class="hl">"Go to news.ycombinator.com, open the top story, clean up the article, and summarize the key points back to my terminal"</span></div>
-      <div class="try-item">On any article page, click <span class="hl">Cleanup</span> to strip away the noise</div>
-      <div class="try-item">Click <span class="hl">Screenshot</span> to capture the page and send it to your Claude Code session</div>
-      <div class="try-item">Ask the sidebar: <span class="hl">"Inspect the CSS on this page and send the color palette to my terminal"</span></div>
-      <div class="try-item">From your Claude Code terminal: <span class="hl">"Navigate to my app, extract the full CSS design system, and write it to DESIGN.md"</span></div>
-    </div>
-  </div>
-
-  <footer class="footer">
-    <p><a href="https://github.com/garrytan/gstack">gstack</a> is open source. Built by <a href="https://x.com/garrytan">Garry Tan</a>.</p>
-  </footer>
-</div>
-
-<script>
-// Hide sidebar prompt ONLY when the sidebar is actually opened.
-// The content script dispatches 'gstack-extension-ready' when it receives
-// a 'sidebarOpened' message from the side panel (via background.js).
-// This means the arrow stays visible until the user actually opens the sidebar.
-document.addEventListener('gstack-extension-ready', () => {
-  const prompt = document.getElementById('sidebar-prompt');
-  if (prompt) prompt.classList.add('hidden');
-});
-</script>
-</body>
-</html>