@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-upgrade/migrations/v1.37.0.0.sh

@@ -1,104 +0,0 @@
-#!/usr/bin/env bash
-# Migration: v1.37.0.0 — split-engine gbrain (remote MCP brain + optional
-#   local PGLite for code search per worktree).
-#
-# Per plan D5: prints a ONE-TIME discoverability notice for existing
-# Path 4 users who don't yet have a local engine. They learn that
-# symbol-aware code search (gbrain code-def / code-refs / code-callers)
-# is now available via /setup-gbrain Step 4.5 if they want it.
-#
-# When to print the notice (state match — all conditions must hold):
-#   - ~/.claude.json declares mcpServers.gbrain.{type|transport} = http|sse|url
-#     OR mcpServers.gbrain.url is set (remote-http MCP active)
-#   - ~/.gbrain/config.json is absent (no local engine yet)
-#   - User has not previously opted out via:
-#       ~/.claude/skills/gstack/bin/gstack-config set local_code_index_offered true
-#
-# When silent: anything else (Path 1/2/3 users, anyone already on PGLite,
-# anyone who opted out, anyone without remote-http MCP).
-#
-# Idempotency: writes a touchfile at ~/.gstack/.migrations/v1.37.0.0.done
-# on completion. Re-running this script is silent if the touchfile exists,
-# OR if local_code_index_offered=true.
-
-# Heredoc delivery guard. bash 5.2+ writes a heredoc body <=64KiB through a
-# pipe in the forked child before exec, with no reader on the other end. On
-# macOS under pipe-KVA pressure a fresh pipe gets a 512-byte buffer, so any
-# body >=512B blocks write() forever and the script hangs at startup with no
-# output. Compat level 50 restores the tempfile path. These scripts are
-# bash-3.2-clean, so the compat level costs them nothing. Not exported: the
-# guard is per-script, and it survives `bash script.sh` call sites that
-# bypass the shebang.
-BASH_COMPAT=50
-
-set -euo pipefail
-
-if [ -z "${HOME:-}" ]; then
-  echo "  [v1.37.0.0] HOME is unset — skipping migration." >&2
-  exit 0
-fi
-
-_gstack_migration_dir="${BASH_SOURCE[0]//\\//}"; _gstack_migration_dir="${_gstack_migration_dir%/*}"
-. "${_gstack_migration_dir}/../../bin/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: ${_gstack_migration_dir}/../../bin/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
-gstack_state_root_select; GSTACK_HOME="$_gstack_sr_root"
-MIGRATIONS_DIR="$GSTACK_HOME/.migrations"
-DONE_TOUCH="$MIGRATIONS_DIR/v1.37.0.0.done"
-CONFIG_BIN="$HOME/.claude/skills/gstack/bin/gstack-config"
-CLAUDE_JSON="$HOME/.claude.json"
-GBRAIN_CONFIG="$HOME/.gbrain/config.json"
-
-mkdir -p "$MIGRATIONS_DIR"
-
-# Idempotency: already-ran skips silently.
-if [ -f "$DONE_TOUCH" ]; then
-  exit 0
-fi
-
-# User opt-out skips silently AND records done.
-if [ -x "$CONFIG_BIN" ]; then
-  if [ "$("$CONFIG_BIN" get local_code_index_offered 2>/dev/null)" = "true" ]; then
-    touch "$DONE_TOUCH"
-    exit 0
-  fi
-fi
-
-# State match: remote-http MCP active?
-is_remote_http_mcp() {
-  [ -f "$CLAUDE_JSON" ] || return 1
-  command -v jq >/dev/null 2>&1 || return 1
-  local mtype murl
-  mtype=$(jq -r '.mcpServers.gbrain.type // .mcpServers.gbrain.transport // empty' "$CLAUDE_JSON" 2>/dev/null)
-  murl=$(jq -r '.mcpServers.gbrain.url // empty' "$CLAUDE_JSON" 2>/dev/null)
-  case "$mtype" in
-    url|http|sse) return 0 ;;
-  esac
-  [ -n "$murl" ] && return 0
-  return 1
-}
-
-# State match: local engine absent?
-is_local_engine_missing() {
-  [ ! -f "$GBRAIN_CONFIG" ]
-}
-
-if is_remote_http_mcp && is_local_engine_missing; then
-  cat <<'NOTICE'
-
-  ┌──────────────────────────────────────────────────────────────────┐
-  │  gstack v1.37.0.0 — split-engine gbrain                          │
-  │                                                                  │
-  │  Symbol-aware code search is now available on this machine.      │
-  │  Your remote brain at gbrain MCP keeps working as today; you can │
-  │  add a tiny local PGLite (~30s, no accounts) for `gbrain         │
-  │  code-def` / `code-refs` / `code-callers` queries per worktree.  │
-  │                                                                  │
-  │  Run /setup-gbrain to opt in at Step 4.5. Or skip this notice    │
-  │  permanently:                                                    │
-  │    gstack-config set local_code_index_offered true               │
-  └──────────────────────────────────────────────────────────────────┘
-
-NOTICE
-fi
-
-# Always touch done so we don't print again, regardless of state-match outcome.
-touch "$DONE_TOUCH"

package/.agent/skills/gstack-upgrade/migrations/v1.38.1.0.sh

@@ -1,104 +0,0 @@
-#!/usr/bin/env bash
-# Migration: v1.38.1.0 — add root-level design + test-plan patterns to
-# .brain-allowlist, .brain-privacy-map.json, and .gitattributes (#1452).
-#
-# Why a migration: gstack-artifacts-init regenerates these files but also
-# does `git commit + push` on ~/.gstack/, which would clobber user state on
-# upgrade. Instead, we do targeted per-file in-place repairs.
-#
-# Per-file independent — if one file is missing we still repair the others.
-#
-# Idempotent: each insertion is gated on `not already present` so re-running
-# the migration is a no-op.
-
-# No `set -e` — we intentionally tolerate per-file failures so other repairs
-# still run. `set -u` is fine.
-set -u
-
-_gstack_migration_dir="${BASH_SOURCE[0]//\\//}"; _gstack_migration_dir="${_gstack_migration_dir%/*}"
-. "${_gstack_migration_dir}/../../bin/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: ${_gstack_migration_dir}/../../bin/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
-gstack_state_root_select; GSTACK_HOME="$_gstack_sr_root"
-ALLOWLIST="${GSTACK_HOME}/.brain-allowlist"
-PRIVACY="${GSTACK_HOME}/.brain-privacy-map.json"
-GITATTRS="${GSTACK_HOME}/.gitattributes"
-
-MIGRATION_DIR="${GSTACK_HOME}/.migrations"
-DONE="${MIGRATION_DIR}/v1.38.1.0.done"
-
-mkdir -p "${MIGRATION_DIR}" 2>/dev/null || true
-if [ -f "${DONE}" ]; then
-  exit 0
-fi
-
-NEW_PATTERNS=(
-  'projects/*/*-design-*.md'
-  'projects/*/*-test-plan-*.md'
-)
-
-added_any=0
-
-# ----- .brain-allowlist ---------------------------------------------------
-if [ -f "${ALLOWLIST}" ]; then
-  for PATTERN in "${NEW_PATTERNS[@]}"; do
-    if ! grep -Fq -- "${PATTERN}" "${ALLOWLIST}" 2>/dev/null; then
-      # Insert before USER ADDITIONS marker. BSD sed (-i.bak) compat for macOS;
-      # the backup file is removed afterward.
-      if grep -q '^# ---- USER ADDITIONS BELOW' "${ALLOWLIST}" 2>/dev/null; then
-        sed -i.bak "/^# ---- USER ADDITIONS BELOW/i\\
-${PATTERN}
-" "${ALLOWLIST}" && rm -f "${ALLOWLIST}.bak"
-        added_any=1
-      else
-        # Marker missing — append at end of file as a fallback. User may have
-        # custom-edited the file; better to add than skip silently.
-        printf '%s\n' "${PATTERN}" >> "${ALLOWLIST}"
-        added_any=1
-      fi
-    fi
-  done
-fi
-
-# ----- .brain-privacy-map.json -------------------------------------------
-# Uses jq to preserve JSON validity. Skips with a warning if jq is missing.
-if [ -f "${PRIVACY}" ]; then
-  if command -v jq >/dev/null 2>&1; then
-    for PATTERN in "${NEW_PATTERNS[@]}"; do
-      if ! jq -e --arg p "${PATTERN}" 'map(select(.pattern == $p)) | length > 0' "${PRIVACY}" >/dev/null 2>&1; then
-        if jq --arg p "${PATTERN}" '. += [{"pattern": $p, "class": "artifact"}]' "${PRIVACY}" > "${PRIVACY}.tmp" 2>/dev/null; then
-          mv "${PRIVACY}.tmp" "${PRIVACY}"
-          added_any=1
-        else
-          rm -f "${PRIVACY}.tmp"
-          echo "  [v1.38.1.0] WARN: jq failed to patch ${PRIVACY}; skipping pattern ${PATTERN}." >&2
-        fi
-      fi
-    done
-  else
-    echo "  [v1.38.1.0] WARN: jq not found; skipping privacy-map repair. Install jq and re-run gstack-upgrade, or run gstack-artifacts-init manually." >&2
-  fi
-fi
-
-# ----- .gitattributes -----------------------------------------------------
-if [ -f "${GITATTRS}" ]; then
-  for PATTERN in "${NEW_PATTERNS[@]}"; do
-    RULE="${PATTERN} merge=union"
-    if ! grep -Fq -- "${RULE}" "${GITATTRS}" 2>/dev/null; then
-      printf '%s\n' "${RULE}" >> "${GITATTRS}"
-      added_any=1
-    fi
-  done
-fi
-
-# Mark done. Even if no patches were applied (already-current install), we
-# write the touchfile so the migration runs once.
-touch "${DONE}"
-
-if [ "${added_any}" = "1" ]; then
-  echo "  [v1.38.1.0] allowlist/privacy-map/gitattributes patched for root-level design + test-plan artifacts (idempotent)" >&2
-fi
-
-# NEVER `git commit + push` from this migration. The user controls when the
-# patches ship into their federated artifacts repo (next gstack-brain-sync
-# --once or a manual commit).
-
-exit 0

package/.agent/skills/gstack-upgrade/migrations/v1.40.0.0.sh

@@ -1,144 +0,0 @@
-#!/usr/bin/env bash
-# Migration: v1.40.0.0 — add eng-review-test-plan project-root pattern to
-# .brain-allowlist, .brain-privacy-map.json, and .gitattributes (#1452 follow-on).
-#
-# Why a second migration: v1.38.1.0 shipped two of three filenames for #1452
-# (`*-design-*.md` and `*-test-plan-*.md`) but missed `/plan-eng-review`'s
-# actual filename: `*-eng-review-test-plan-*.md`. The v1.38.1.0 migration has
-# a done-marker, so a "fix v1.38.1.0 and re-run" approach silently no-ops on
-# existing users. v1.40.0.0 needs its own migration to patch installs that
-# already ran v1.38.1.0.
-#
-# Per-file independent — if one file is missing we still repair the others.
-#
-# Idempotent: each insertion is gated on `not already present` so re-running
-# the migration is a no-op.
-#
-# Done-marker discipline (#1581): the marker is only written when every
-# required repair either succeeded or was provably unnecessary. Tracking
-# happens via the `incomplete` flag; on any failure path (missing jq, broken
-# JSON, append failure, mv failure) we set `incomplete=1` and skip the touch
-# so the migration runner retries on the next /gstack-upgrade.
-
-set -u
-
-_gstack_migration_dir="${BASH_SOURCE[0]//\\//}"; _gstack_migration_dir="${_gstack_migration_dir%/*}"
-. "${_gstack_migration_dir}/../../bin/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: ${_gstack_migration_dir}/../../bin/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
-gstack_state_root_select; GSTACK_HOME="$_gstack_sr_root"
-ALLOWLIST="${GSTACK_HOME}/.brain-allowlist"
-PRIVACY="${GSTACK_HOME}/.brain-privacy-map.json"
-GITATTRS="${GSTACK_HOME}/.gitattributes"
-
-MIGRATION_DIR="${GSTACK_HOME}/.migrations"
-DONE="${MIGRATION_DIR}/v1.40.0.0.done"
-
-mkdir -p "${MIGRATION_DIR}" 2>/dev/null || true
-if [ -f "${DONE}" ]; then
-  exit 0
-fi
-
-NEW_PATTERNS=(
-  'projects/*/*-eng-review-test-plan-*.md'
-)
-
-added_any=0
-incomplete=0
-
-# ----- .brain-allowlist ---------------------------------------------------
-if [ -f "${ALLOWLIST}" ]; then
-  for PATTERN in "${NEW_PATTERNS[@]}"; do
-    if ! grep -Fq -- "${PATTERN}" "${ALLOWLIST}" 2>/dev/null; then
-      if grep -q '^# ---- USER ADDITIONS BELOW' "${ALLOWLIST}" 2>/dev/null; then
-        if sed -i.bak "/^# ---- USER ADDITIONS BELOW/i\\
-${PATTERN}
-" "${ALLOWLIST}" 2>/dev/null; then
-          rm -f "${ALLOWLIST}.bak"
-          added_any=1
-        else
-          echo "  [v1.40.0.0] WARN: failed to insert ${PATTERN} into ${ALLOWLIST}; will retry on next upgrade." >&2
-          rm -f "${ALLOWLIST}.bak" 2>/dev/null || true
-          incomplete=1
-        fi
-      else
-        if printf '%s\n' "${PATTERN}" >> "${ALLOWLIST}" 2>/dev/null; then
-          added_any=1
-        else
-          echo "  [v1.40.0.0] WARN: failed to append ${PATTERN} to ${ALLOWLIST}; will retry on next upgrade." >&2
-          incomplete=1
-        fi
-      fi
-    fi
-  done
-fi
-
-# ----- .brain-privacy-map.json -------------------------------------------
-if [ -f "${PRIVACY}" ]; then
-  if command -v jq >/dev/null 2>&1; then
-    # Validate JSON shape up front. We won't try to repair a corrupt file —
-    # bail out and leave for manual fix.
-    if ! jq -e . "${PRIVACY}" >/dev/null 2>&1; then
-      echo "  [v1.40.0.0] WARN: ${PRIVACY} is not valid JSON; skipping privacy-map repair. Fix manually or run gstack-artifacts-init." >&2
-      incomplete=1
-    else
-      for PATTERN in "${NEW_PATTERNS[@]}"; do
-        if ! jq -e --arg p "${PATTERN}" 'map(select(.pattern == $p)) | length > 0' "${PRIVACY}" >/dev/null 2>&1; then
-          tmp=$(mktemp "${PRIVACY}.tmp.XXXXXX" 2>/dev/null)
-          if [ -z "${tmp}" ] || [ ! -f "${tmp}" ]; then
-            echo "  [v1.40.0.0] WARN: failed to create tempfile for ${PRIVACY}; skipping pattern ${PATTERN}." >&2
-            incomplete=1
-            continue
-          fi
-          if jq --arg p "${PATTERN}" '. += [{"pattern": $p, "class": "artifact"}]' "${PRIVACY}" > "${tmp}" 2>/dev/null; then
-            if mv "${tmp}" "${PRIVACY}" 2>/dev/null; then
-              added_any=1
-            else
-              echo "  [v1.40.0.0] WARN: failed to rewrite ${PRIVACY}; skipping pattern ${PATTERN}." >&2
-              rm -f "${tmp}"
-              incomplete=1
-            fi
-          else
-            echo "  [v1.40.0.0] WARN: jq mutation failed for ${PRIVACY}; skipping pattern ${PATTERN}." >&2
-            rm -f "${tmp}"
-            incomplete=1
-          fi
-        fi
-      done
-    fi
-  else
-    echo "  [v1.40.0.0] WARN: jq not found; skipping privacy-map repair. Install jq and re-run gstack-upgrade, or run gstack-artifacts-init manually." >&2
-    incomplete=1
-  fi
-fi
-
-# ----- .gitattributes -----------------------------------------------------
-if [ -f "${GITATTRS}" ]; then
-  for PATTERN in "${NEW_PATTERNS[@]}"; do
-    RULE="${PATTERN} merge=union"
-    if ! grep -Fq -- "${RULE}" "${GITATTRS}" 2>/dev/null; then
-      if printf '%s\n' "${RULE}" >> "${GITATTRS}" 2>/dev/null; then
-        added_any=1
-      else
-        echo "  [v1.40.0.0] WARN: failed to append rule to ${GITATTRS}; will retry on next upgrade." >&2
-        incomplete=1
-      fi
-    fi
-  done
-fi
-
-if [ "${incomplete}" = "0" ]; then
-  # Mark done — every required repair either succeeded or was provably
-  # unnecessary. A fresh-init user's bin/gstack-artifacts-init now writes the
-  # pattern directly, so re-runs no-op. The touchfile keeps the migration
-  # runner from looping.
-  touch "${DONE}"
-  if [ "${added_any}" = "1" ]; then
-    echo "  [v1.40.0.0] allowlist/privacy-map/gitattributes patched for /plan-eng-review test plans (idempotent)" >&2
-  fi
-else
-  echo "  [v1.40.0.0] INFO: marker not written; gstack-upgrade will retry once prerequisites are met." >&2
-fi
-
-# NEVER `git commit + push` from this migration. The user controls when the
-# patches ship into their federated artifacts repo.
-
-exit 0

package/.agent/skills/gstack-upgrade/migrations/v1.58.0.0.sh

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-# Migration: v1.58.0.0 — register the PreToolUse AskUserQuestion hook for
-# existing Conductor installs.
-#
-# Why a migration: v1.58 makes the PreToolUse question-preference-hook also
-# deny the flaky Conductor AskUserQuestion and redirect to a prose decision
-# brief. But setup's hook-install block skips silently in non-interactive
-# (conductor/CI) setups, and existing users who previously declined plan-tune
-# hooks would never pick up the new Conductor backstop. This re-registers the
-# hook for Conductor users so layer 3 actually deploys.
-#
-# Affected: users who run gstack inside Conductor and don't already have the
-# PreToolUse hook installed.
-#
-# Scope guard: only acts inside a Conductor session (CONDUCTOR_* present) and
-# never overrides an explicit `plan_tune_hooks` opt-out.
-#
-# Idempotent: gstack-settings-hook dedupes by (event, matcher, source), and a
-# .done touchfile gates re-runs.
-
-set -u
-
-_gstack_migration_dir="${BASH_SOURCE[0]//\\//}"; _gstack_migration_dir="${_gstack_migration_dir%/*}"
-. "${_gstack_migration_dir}/../../bin/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: ${_gstack_migration_dir}/../../bin/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
-gstack_state_root_select; GSTACK_HOME="$_gstack_sr_root"
-MIGRATION_DIR="${GSTACK_HOME}/.migrations"
-DONE="${MIGRATION_DIR}/v1.58.0.0.done"
-mkdir -p "${MIGRATION_DIR}" 2>/dev/null || true
-[ -f "${DONE}" ] && exit 0
-
-# Only relevant inside Conductor — the prose-default behavior is Conductor-scoped.
-if [ -z "${CONDUCTOR_WORKSPACE_PATH:-}" ] && [ -z "${CONDUCTOR_PORT:-}" ]; then
-  touch "${DONE}"
-  exit 0
-fi
-
-SCRIPT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
-SETTINGS_HOOK="${SCRIPT_DIR}/bin/gstack-settings-hook"
-PREF_HOOK="${SCRIPT_DIR}/hosts/claude/hooks/question-preference-hook"
-CONFIG_BIN="${SCRIPT_DIR}/bin/gstack-config"
-
-# Respect an explicit opt-out — don't force a hook on a user who said no.
-_PT=$("${CONFIG_BIN}" get plan_tune_hooks 2>/dev/null || echo "")
-_PT=$(printf '%s' "${_PT}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
-case "${_PT}" in
-  n|no|false|skip|off|0)
-    echo "  [v1.58.0.0] plan_tune_hooks opted out — leaving Conductor on guidance-only prose." >&2
-    touch "${DONE}"
-    exit 0
-    ;;
-esac
-
-if [ -x "${SETTINGS_HOOK}" ] && [ -x "${PREF_HOOK}" ]; then
-  "${SETTINGS_HOOK}" add-event \
-    --event PreToolUse \
-    --matcher '(AskUserQuestion|mcp__.*__AskUserQuestion)' \
-    --command "${PREF_HOOK}" \
-    --source plan-tune-cathedral \
-    --timeout 5 2>/dev/null \
-    && echo "  [v1.58.0.0] Conductor AskUserQuestion prose hook registered (PreToolUse)." >&2 \
-    || echo "  [v1.58.0.0] WARN: could not register the PreToolUse hook; run ./setup --plan-tune-hooks." >&2
-fi
-
-touch "${DONE}"
-exit 0

package/.agent/skills/gstack-upgrade/migrations/v1.65.0.0.sh

@@ -1,152 +0,0 @@
-#!/usr/bin/env bash
-# Migration: v1.65.0.0 — repair Chrome-for-Testing bundles poisoned by the
-# old in-place rebrand (#2242).
-#
-# Why a migration: pre-v1.64 launchHeaded() rewrote the Chromium .app's
-# Info.plist ("Google Chrome for Testing" → "GStack Browser") and overwrote
-# its Resources/*.icns — inside the SHARED Playwright cache. That broke the
-# codesign seal (GPU process exit_code=5; headed mode dead on macOS 26) and
-# poisoned the cache for the user's OTHER Playwright projects too. Deleting
-# the rebrand code fixes fresh installs only; every existing macOS install
-# still has the mutated bundle on disk. This migration removes poisoned
-# bundles and re-fetches a clean one so the upgrade doesn't leave the user
-# with zero working browser (the browse launch path also self-heals, as the
-# belt to this suspenders, for installs that never run migrations).
-#
-# Removal scope: `playwright install chromium` treats the revision dir's
-# INSTALLATION_COMPLETE marker as "is already downloaded" — removing only
-# the .app strands the user with a marker, no browser, and a re-fetch that
-# no-ops. So when the poisoned .app sits in the standard cache layout
-# (chromium-<rev>/chrome-mac/<name>.app) the WHOLE revision dir goes;
-# otherwise the .app plus its sibling INSTALLATION_COMPLETE /
-# DEPENDENCIES_VALIDATED markers go. A revision dir already stranded in
-# exactly that state (markers present, .app missing) is detected and
-# removed too, so the re-fetch actually downloads.
-#
-# Affected: macOS installs that ever ran headed mode before v1.64.
-#
-# Idempotent: detection is content-based (plist contains "GStack Browser");
-# a clean cache is a no-op, and the .done touchfile gates re-runs. After a
-# removal, .done is only written once the end state is VERIFIED (a real
-# Chromium executable exists in the cache) — a removal followed by a failed
-# re-fetch (e.g. offline) leaves the migration pending, with a needs-refetch
-# sentinel so the next run retries the download.
-
-set -u
-
-_gstack_migration_dir="${BASH_SOURCE[0]//\\//}"; _gstack_migration_dir="${_gstack_migration_dir%/*}"
-. "${_gstack_migration_dir}/../../bin/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: ${_gstack_migration_dir}/../../bin/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
-gstack_state_root_select; GSTACK_HOME="$_gstack_sr_root"
-MIGRATION_DIR="${GSTACK_HOME}/.migrations"
-DONE="${MIGRATION_DIR}/v1.65.0.0.done"
-# Written when a removal happened but the verified end state (a Chromium
-# executable in the cache) wasn't reached — e.g. the re-fetch failed
-# offline. Its presence re-triggers the re-fetch on the next run even when
-# the scans below find nothing left to remove.
-NEEDS_REFETCH="${MIGRATION_DIR}/v1.65.0.0.needs-refetch"
-mkdir -p "${MIGRATION_DIR}" 2>/dev/null || true
-[ -f "${DONE}" ] && exit 0
-
-# macOS only: the mutation targeted .app bundle plists.
-if [ "$(uname -s 2>/dev/null)" != "Darwin" ]; then
-  touch "${DONE}"
-  exit 0
-fi
-
-PW_CACHE="${PLAYWRIGHT_BROWSERS_PATH:-${HOME}/Library/Caches/ms-playwright}"
-REMOVED=0
-[ -f "${NEEDS_REFETCH}" ] && REMOVED=1
-
-is_revision_dir() {
-  # Standard Playwright cache revision dir name: chromium-<digits>.
-  printf '%s' "$(basename "$1")" | grep -Eq '^chromium-[0-9]+$'
-}
-
-if [ -d "${PW_CACHE}" ]; then
-  # 1. Content-based poison scan: every Chrome-for-Testing bundle in the
-  #    cache (one per pinned chromium build) whose plist carries the rebrand.
-  while IFS= read -r plist; do
-    if grep -q "GStack Browser" "${plist}" 2>/dev/null; then
-      app_dir="$(dirname "$(dirname "${plist}")")"
-      case "${app_dir}" in
-        "${PW_CACHE}"/*.app|"${PW_CACHE}"/*/*.app|"${PW_CACHE}"/*/*/*.app)
-          rev_dir="$(dirname "$(dirname "${app_dir}")")"
-          if is_revision_dir "${rev_dir}"; then
-            # Remove the WHOLE revision dir: Playwright's
-            # INSTALLATION_COMPLETE marker lives beside chrome-mac/, and
-            # `playwright install chromium` treats its presence as "already
-            # downloaded" — removing only the .app would make the re-fetch
-            # below a no-op and leave the user with NO browser.
-            echo "  [v1.65.0.0] removing rebrand-poisoned revision dir (incl. install markers): ${rev_dir}" >&2
-            rm -rf "${rev_dir}"
-          else
-            echo "  [v1.65.0.0] removing rebrand-poisoned bundle: ${app_dir}" >&2
-            rm -rf "${app_dir}"
-            rm -f "$(dirname "${app_dir}")/INSTALLATION_COMPLETE" \
-                  "$(dirname "${app_dir}")/DEPENDENCIES_VALIDATED" 2>/dev/null || true
-          fi
-          REMOVED=1
-          ;;
-        *)
-          echo "  [v1.65.0.0] WARNING: poisoned plist outside the Playwright cache shape, skipping: ${plist}" >&2
-          ;;
-      esac
-    fi
-  done < <(find "${PW_CACHE}" -maxdepth 5 -name "Info.plist" -path "*.app/Contents/Info.plist" 2>/dev/null)
-
-  # 2. Stranded-state scan: an earlier version of this migration removed
-  #    only the poisoned .app, leaving the revision dir with its
-  #    INSTALLATION_COMPLETE marker — the exact state that makes
-  #    `playwright install chromium` no-op while the user has NO browser.
-  #    A chromium revision dir without any .app inside is that strand;
-  #    remove it whole so the re-fetch actually downloads.
-  for rev_dir in "${PW_CACHE}"/chromium-*; do
-    [ -d "${rev_dir}" ] || continue
-    is_revision_dir "${rev_dir}" || continue
-    if [ -z "$(find "${rev_dir}" -maxdepth 2 -name '*.app' -print 2>/dev/null | head -1)" ]; then
-      echo "  [v1.65.0.0] removing stranded revision dir (install markers without a browser): ${rev_dir}" >&2
-      rm -rf "${rev_dir}"
-      REMOVED=1
-    fi
-  done
-fi
-
-if [ "${REMOVED}" = "1" ]; then
-  # Re-fetch immediately: migrations run AFTER ./setup, so without this the
-  # user finishes the upgrade with no working browser at all (headless AND
-  # headed use the same bundle). Run from the gstack install root so bunx
-  # resolves the repo-pinned playwright version — an arbitrary migration-
-  # runner cwd could resolve a different playwright and populate a revision
-  # the pinned one never launches (same subshell-cd pattern as ./setup's
-  # Chromium install block).
-  SCRIPT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
-  echo "  [v1.65.0.0] re-fetching a clean Chromium (bunx playwright install chromium)..." >&2
-  if command -v bunx >/dev/null 2>&1 && (cd "${SCRIPT_DIR}" && bunx playwright install chromium >&2); then
-    echo "  [v1.65.0.0] playwright install finished." >&2
-  else
-    echo "  [v1.65.0.0] WARNING: automatic re-fetch failed." >&2
-  fi
-
-  # Gate .done on the VERIFIED end state, not the installer's exit code:
-  # `playwright install` exits 0 even when it skips the download, and a
-  # successful removal followed by a failed/offline fetch must not be
-  # recorded as done — that would strand the user with no browser and a
-  # success message.
-  CHROME_EXE="$(find "${PW_CACHE}" -maxdepth 6 -type f -perm -u+x -path "*/chromium-*/*.app/Contents/MacOS/*" 2>/dev/null | head -1)"
-  if [ -n "${CHROME_EXE}" ]; then
-    echo "  [v1.65.0.0] verified working Chromium at: ${CHROME_EXE}" >&2
-    rm -f "${NEEDS_REFETCH}" 2>/dev/null || true
-  else
-    touch "${NEEDS_REFETCH}" 2>/dev/null || true
-    echo "  [v1.65.0.0] WARNING: no Chromium executable present after removing the poisoned bundle." >&2
-    echo "  [v1.65.0.0] Headless AND headed browsing are unavailable until it is re-fetched. Run:" >&2
-    echo "  [v1.65.0.0]   cd ${SCRIPT_DIR} && bunx playwright install chromium" >&2
-    echo "  [v1.65.0.0] Leaving this migration pending — it retries on the next run." >&2
-    exit 0
-  fi
-else
-  echo "  [v1.65.0.0] no rebrand-poisoned bundles found — no-op." >&2
-fi
-
-touch "${DONE}"
-exit 0

package/.agent/skills/gstack-upgrade/migrations/v1.67.0.0.sh

@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-# Migration: v1.67.0.0 — restore tracked files dirtied by the legacy in-place
-# gbrain render (#2569, F12).
-#
-# Why a migration: pre-v1.67, gbrain-enabled setups ran `gen:skill-docs:user
-# --host claude` IN PLACE inside the global install checkout
-# (~/.claude/skills/gstack), rewriting ~16 TRACKED SKILL.md files. The
-# checkout stayed permanently dirty, and every /gstack-upgrade `git stash`
-# saved a redundant snapshot of generated content — stashes that invite a
-# dangerous `git stash pop` of stale instruction markdown over a newer
-# version. v1.67 renders to an untracked out-dir (~/.gstack/render/claude)
-# instead, so this migration does the ONE-TIME cleanup of the legacy dirt:
-# `git checkout --` on the modified generated files.
-#
-# Restore scope is deliberately narrow: only UNSTAGED MODIFIED files whose
-# path is a SKILL.md or lives under a sections/ directory — the exact
-# footprint of the legacy render. Anything else a user changed by hand
-# (untracked files, staged work, non-generated edits) is left alone and
-# reported. setup's gbrain step re-renders the brain-aware variant into the
-# out-dir immediately after migrations run, so no capability is lost.
-#
-# Affected: global-git installs that ever ran ./setup or `gstack-config
-# gbrain-refresh` with gbrain detected, before v1.67.0.0.
-#
-# Idempotent: a clean checkout is a no-op. Non-fatal throughout.
-set -u
-
-INSTALL_DIR="${GSTACK_INSTALL_DIR:-$HOME/.claude/skills/gstack}"
-
-# Only operate on a real (non-symlink) git checkout that looks like gstack.
-[ -d "$INSTALL_DIR" ] || exit 0
-[ -L "$INSTALL_DIR" ] && exit 0
-[ -f "$INSTALL_DIR/VERSION" ] || exit 0
-git -C "$INSTALL_DIR" rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
-
-_DIRTY="$(git -C "$INSTALL_DIR" status --porcelain 2>/dev/null || true)"
-[ -n "$_DIRTY" ] || exit 0
-
-_RESTORED=0
-_LEFT=0
-while IFS= read -r _LINE; do
-  [ -n "$_LINE" ] || continue
-  _CODE="${_LINE:0:2}"
-  _PATH="${_LINE:3}"
-  # Legacy render footprint: unstaged modifications to generated markdown.
-  case "$_CODE" in
-    " M")
-      case "$_PATH" in
-        SKILL.md|*/SKILL.md|*/sections/*.md)
-          if git -C "$INSTALL_DIR" checkout -- "$_PATH" 2>/dev/null; then
-            _RESTORED=$((_RESTORED + 1))
-          else
-            _LEFT=$((_LEFT + 1))
-          fi
-          ;;
-        *) _LEFT=$((_LEFT + 1)) ;;
-      esac
-      ;;
-    *) _LEFT=$((_LEFT + 1)) ;;
-  esac
-done <<EOF_DIRTY
-$_DIRTY
-EOF_DIRTY
-
-if [ "$_RESTORED" -gt 0 ]; then
-  echo "  v1.67.0.0: restored $_RESTORED tracked file(s) dirtied by the legacy in-place gbrain render (#2569)."
-  echo "  Brain-aware blocks now render to ~/.gstack/render/claude — the checkout stays clean from here on."
-fi
-if [ "$_LEFT" -gt 0 ]; then
-  echo "  v1.67.0.0: left $_LEFT non-render change(s) in $INSTALL_DIR untouched (not the legacy render footprint)."
-fi
-
-exit 0