opengstack 0.13.4

package/scripts/filter_skills.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""
+opengstack filter script
+Removes telemetry, YC references, garrytan slop from gstack skills
+"""
+
+import re
+import sys
+from pathlib import Path
+
+
+def filter_skill_content(content: str) -> str:
+    """Apply all filters to skill content"""
+
+    # Remove telemetry preamble block (from _UPD to closing brace)
+    preamble_pattern = r"```bash\n_UPD=.*?(?=\n```|\n\n[A-Z#])"
+    content = re.sub(preamble_pattern, "", content, flags=re.DOTALL)
+
+    # Remove LAKE_INTRO / Completeness Principle section
+    lake_pattern = r"If `LAKE_INTRO` is `no`:.*?`touch ~\/\.gstack\/\.completeness-intro-seen`\n```\n.*?```\n"
+    content = re.sub(lake_pattern, "", content, flags=re.DOTALL)
+
+    # Remove telemetry prompts section
+    tel_pattern = (
+        r"If `TEL_PROMPTED` is `no` AND.*?(?=If `PROACTIVE_PROMPTED`|## Voice)"
+    )
+    content = re.sub(tel_pattern, "", content, flags=re.DOTALL)
+
+    # Remove PROACTIVE_PROMPTED section
+    proactive_pattern = r"If `PROACTIVE_PROMPTED` is `no` AND.*?`touch ~\/\.gstack\/\.proactive-prompted`\n```\n"
+    content = re.sub(proactive_pattern, "", content, flags=re.DOTALL)
+
+    # Remove contributor mode block
+    contrib_pattern = r"## Contributor Mode.*?(?=## Voice|## Completion)"
+    content = re.sub(contrib_pattern, "", content, flags=re.DOTALL)
+
+    # Remove telemetry trailer block
+    tel_trailer_pattern = (
+        r"## Telemetry \(run last\).*?```bash\n.*?gstack-telemetry-log.*?```\n"
+    )
+    content = re.sub(tel_trailer_pattern, "", content, flags=re.DOTALL)
+
+    # Remove update check references
+    content = re.sub(r"UPGRADE_AVAILABLE.*?(?=\n|$)", "", content)
+    content = re.sub(r"JUST_UPGRADED.*?(?=\n|$)", "", content)
+    content = re.sub(r"gstack-update-check", "echo", content)
+
+    # Remove gstack-config references (telemetry/proactive settings)
+    content = re.sub(
+        r"~/.claude/skills/gstack/", "~/.claude/skills/opengstack/", content
+    )
+
+    # Remove YC slop - personal notes from Garry Tan
+    garry_note_pattern = (
+        r"> A personal note from me, Garry Tan, the creator of GStack:.*?(?=\n\n|\n>)"
+    )
+    content = re.sub(garry_note_pattern, "", content, flags=re.DOTALL)
+
+    # Remove YC apply links with ref tracking
+    content = re.sub(r"ycombinator\.com/apply\?ref=gstack.*", "", content)
+
+    # Remove YC partner energy references
+    content = re.sub(r"YC partner energy for strategy.*", "", content)
+
+    # Remove "exactly the kind of builders Garry respects" type phrases
+    founder_phrase = r"people with that kind of taste and drive are exactly the kind of builders.*?consider applying to YC.*"
+    content = re.sub(founder_phrase, "", content, flags=re.DOTALL)
+
+    # Remove garryslist references
+    content = re.sub(r"https?://garryslist\.org[^\s]*", "", content)
+    content = re.sub(r"Boil the (Lake|Ocean).*", "", content)
+
+    # Remove YC from office-hours description
+    content = re.sub(r"YC Office Hours", "Office Hours", content)
+
+    # Remove Garry Tan references
+    content = re.sub(r"shaped by Garry Tan's.*", "", content)
+    content = re.sub(r"Garry Tan", "OpenGStack", content)
+    content = re.sub(r"Gar[r]?y.*Tan", "", content)
+
+    # Remove GStack branding where it's the product name
+    content = re.sub(r"\bGStack\b", "OpenGStack", content)
+
+    # Remove "ref=gstack" from any URLs
+    content = re.sub(r"\?ref=gstack", "", content)
+
+    # Clean up empty code blocks and whitespace
+    content = re.sub(r"\n{4,}", "\n\n", content)
+    content = re.sub(r"```\n\n```", "", content)
+
+    # Remove orphaned backticks
+    content = re.sub(r"^```\n*$", "", content, flags=re.MULTILINE)
+
+    # Clean leading/trailing whitespace per line
+    lines = [line.rstrip() for line in content.split("\n")]
+    content = "\n".join(lines)
+
+    # Remove trailing newlines
+    content = content.rstrip("\n") + "\n"
+
+    return content
+
+
+def filter_file(filepath: Path) -> bool:
+    """Filter a single file, returns True if modified"""
+    if not filepath.exists():
+        return False
+
+    original = filepath.read_text()
+    filtered = filter_skill_content(original)
+
+    if filtered != original:
+        filepath.write_text(filtered)
+        return True
+    return False
+
+
+def main():
+    skills_dir = (
+        Path(sys.argv[1]) if len(sys.argv) > 1 else Path(__file__).parent.parent
+    )
+
+    print(f"Filtering skills in: {skills_dir}")
+
+    modified = 0
+    for skill_file in skills_dir.rglob("SKILL.md"):
+        if filter_file(skill_file):
+            print(f"  Filtered: {skill_file.relative_to(skills_dir)}")
+            modified += 1
+
+    for tmpl_file in skills_dir.rglob("SKILL.md.tmpl"):
+        if filter_file(tmpl_file):
+            print(f"  Filtered: {tmpl_file.relative_to(skills_dir)}")
+            modified += 1
+
+    print(f"\nDone! Modified {modified} files.")
+
+
+if __name__ == "__main__":
+    main()

package/setup-browser-cookies/SKILL.md

@@ -0,0 +1,216 @@
+---
+name: setup-browser-cookies
+preamble-tier: 1
+version: 1.0.0
+description: |
+  Import cookies from your real Chromium browser into the headless browse session.
+  Opens an interactive picker UI where you select which cookie domains to import.
+  Use before QA testing authenticated pages. Use when asked to "import cookies",
+  "login to the site", or "authenticate the browser".
+allowed-tools:
+  - Bash
+  - Read
+  - AskUserQuestion
+---
+<!-- AUTO-GENERATED from SKILL.md.tmpl — do not edit directly -->
+<!-- Regenerate: bun run gen:skill-docs -->
+
+## Preamble (run first)
+
+
+If `PROACTIVE` is `"false"`, do not proactively suggest gstack skills AND do not
+auto-invoke skills based on conversation context. Only run skills the user explicitly
+types (e.g., /qa, /ship). If you would have auto-invoked a skill, instead briefly say:
+"I think /skillname might help here — want me to run it?" and wait for confirmation.
+The user opted out of proactive behavior.
+
+If `SKILL_PREFIX` is `"true"`, the user has namespaced skill names. When suggesting
+or invoking other gstack skills, use the `/gstack-` prefix (e.g., `/gstack-qa` instead
+of `/qa`, `/gstack-ship` instead of `/ship`). Disk paths are unaffected — always use
+`~/.claude/skills/opengstack/[skill-name]/SKILL.md` for reading skill files.
+
+If `LAKE_INTRO` is `no`: Before continuing, introduce the Completeness Principle.
+Then offer to open the essay in their default browser:
+
+```bash
+touch ~/.gstack/.completeness-intro-seen
+
+Only run `open` if the user says yes. Always run `touch` to mark as seen. This only happens once.
+
+If `PROACTIVE_PROMPTED` is `no` AND `TEL_PROMPTED` is `yes`: After telemetry is handled,
+ask the user about proactive behavior. Use AskUserQuestion:
+
+> gstack can proactively figure out when you might need a skill while you work —
+> like suggesting /qa when you say "does this work?" or /investigate when you hit
+> a bug. We recommend keeping this on — it speeds up every part of your workflow.
+
+Options:
+- A) Keep it on (recommended)
+- B) Turn it off — I'll type /commands myself
+
+If A: run `echo set proactive true`
+If B: run `echo set proactive false`
+
+Always run:
+```bash
+touch ~/.gstack/.proactive-prompted
+
+This only happens once. If `PROACTIVE_PROMPTED` is `yes`, skip this entirely.
+
+## Voice
+
+**Tone:** direct, concrete, sharp, never corporate, never academic. Sound like a builder, not a consultant. Name the file, the function, the command. No filler, no throat-clearing.
+
+**Writing rules:** No em dashes (use commas, periods, "..."). No AI vocabulary (delve, crucial, robust, comprehensive, nuanced, etc.). Short paragraphs. End with what to do.
+
+The user always has context you don't. Cross-model agreement is a recommendation, not a decision — the user decides.
+
+## Completion Status Protocol
+
+When completing a skill workflow, report status using one of:
+- **DONE** — All steps completed successfully. Evidence provided for each claim.
+- **DONE_WITH_CONCERNS** — Completed, but with issues the user should know about. List each concern.
+- **BLOCKED** — Cannot proceed. State what is blocking and what was tried.
+- **NEEDS_CONTEXT** — Missing information required to continue. State exactly what you need.
+
+### Escalation
+
+It is always OK to stop and say "this is too hard for me" or "I'm not confident in this result."
+
+Bad work is worse than no work. You will not be penalized for escalating.
+- If you have attempted a task 3 times without success, STOP and escalate.
+- If you are uncertain about a security-sensitive change, STOP and escalate.
+- If the scope of work exceeds what you can verify, STOP and escalate.
+
+Escalation format:
+
+STATUS: BLOCKED | NEEDS_CONTEXT
+REASON:
+ATTEMPTED:
+RECOMMENDATION:
+
+Replace `SKILL_NAME` with the actual skill name from frontmatter, `OUTCOME` with
+success/error/abort, and `USED_BROWSE` with true/false based on whether `$B` was used.
+If you cannot determine the outcome, use "unknown". The local JSONL always logs. The
+remote binary only runs if telemetry is not off and the binary exists.
+
+## Plan Status Footer
+
+When you are in plan mode and about to call ExitPlanMode:
+
+1. Check if the plan file already has a `## GSTACK REVIEW REPORT` section.
+2. If it DOES — skip (a review skill already wrote a richer report).
+3. If it does NOT — run this command:
+
+\`\`\`bash
+~/.claude/skills/opengstack/bin/gstack-review-read
+\`\`\`
+
+Then write a `## GSTACK REVIEW REPORT` section to the end of the plan file:
+
+- If the output contains review entries (JSONL lines before `---CONFIG---`): format the
+  standard report table with runs/status/findings per skill, same format as the review
+  skills use.
+- If the output is `NO_REVIEWS` or empty: write this placeholder table:
+
+\`\`\`markdown
+## GSTACK REVIEW REPORT
+
+| Review | Trigger | Why | Runs | Status | Findings |
+|--------|---------|-----|------|--------|----------|
+| CEO Review | \`/plan-ceo-review\` | Scope & strategy | 0 | — | — |
+| Codex Review | \`/codex review\` | Independent 2nd opinion | 0 | — | — |
+| Eng Review | \`/plan-eng-review\` | Architecture & tests (required) | 0 | — | — |
+| Design Review | \`/plan-design-review\` | UI/UX gaps | 0 | — | — |
+
+**VERDICT:** NO REVIEWS YET — run \`/autoplan\` for full review pipeline, or individual reviews above.
+\`\`\`
+
+**PLAN MODE EXCEPTION — ALWAYS RUN:** This writes to the plan file, which is the one
+file you are allowed to edit in plan mode. The plan file review report is part of the
+plan's living status.
+
+# Setup Browser Cookies
+
+Import logged-in sessions from your real Chromium browser into the headless browse session.
+
+## CDP mode check
+
+First, check if browse is already connected to the user's real browser:
+```bash
+$B status 2>/dev/null | grep -q "Mode: cdp" && echo "CDP_MODE=true" || echo "CDP_MODE=false"
+
+If `CDP_MODE=true`: tell the user "Not needed — you're connected to your real browser via CDP. Your cookies and sessions are already available." and stop. No cookie import needed.
+
+## How it works
+
+1. Find the browse binary
+2. Run `cookie-import-browser` to detect installed browsers and open the picker UI
+3. User selects which cookie domains to import in their browser
+4. Cookies are decrypted and loaded into the Playwright session
+
+## Steps
+
+### 1. Find the browse binary
+
+## SETUP (run this check BEFORE any browse command)
+
+```bash
+_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
+B=""
+[ -n "$_ROOT" ] && [ -x "$_ROOT/.claude/skills/gstack/browse/dist/browse" ] && B="$_ROOT/.claude/skills/gstack/browse/dist/browse"
+[ -z "$B" ] && B=~/.claude/skills/opengstack/browse/dist/browse
+if [ -x "$B" ]; then
+  echo "READY: $B"
+else
+  echo "NEEDS_SETUP"
+fi
+
+If `NEEDS_SETUP`:
+1. Tell the user: "gstack browse needs a one-time build (~10 seconds). OK to proceed?" Then STOP and wait.
+2. Run: `cd <SKILL_DIR> && ./setup`
+3. If `bun` is not installed:
+   ```bash
+   if ! command -v bun >/dev/null 2>&1; then
+     curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash
+   fi
+   ```
+
+### 2. Open the cookie picker
+
+```bash
+$B cookie-import-browser
+
+This auto-detects installed Chromium browsers and opens
+an interactive picker UI in your default browser where you can:
+- Switch between installed browsers
+- Search domains
+- Click "+" to import a domain's cookies
+- Click trash to remove imported cookies
+
+
+### 3. Direct import (alternative)
+
+If the user specifies a domain directly (e.g., `/setup-browser-cookies github.com`), skip the UI:
+
+```bash
+$B cookie-import-browser comet --domain github.com
+
+Replace `comet` with the appropriate browser if specified.
+
+### 4. Verify
+
+After the user confirms they're done:
+
+```bash
+$B cookies
+
+Show the user a summary of imported cookies (domain counts).
+
+## Notes
+
+- On macOS, the first import per browser may trigger a Keychain dialog — click "Allow" / "Always Allow"
+- On Linux, `v11` cookies may require `secret-tool`/libsecret access; `v10` cookies use Chromium's standard fallback key
+- Cookie picker is served on the same port as the browse server (no extra process)
+- Only domain names and cookie counts are shown in the UI — no cookie values are exposed
+- The browse session persists cookies between commands, so imported cookies work immediately

package/setup-browser-cookies/SKILL.md.tmpl

@@ -0,0 +1,81 @@
+---
+name: setup-browser-cookies
+preamble-tier: 1
+version: 1.0.0
+description: |
+  Import cookies from your real Chromium browser into the headless browse session.
+  Opens an interactive picker UI where you select which cookie domains to import.
+  Use before QA testing authenticated pages. Use when asked to "import cookies",
+  "login to the site", or "authenticate the browser".
+allowed-tools:
+  - Bash
+  - Read
+  - AskUserQuestion
+---
+
+{{PREAMBLE}}
+
+# Setup Browser Cookies
+
+Import logged-in sessions from your real Chromium browser into the headless browse session.
+
+## CDP mode check
+
+First, check if browse is already connected to the user's real browser:
+```bash
+$B status 2>/dev/null | grep -q "Mode: cdp" && echo "CDP_MODE=true" || echo "CDP_MODE=false"
+
+If `CDP_MODE=true`: tell the user "Not needed — you're connected to your real browser via CDP. Your cookies and sessions are already available." and stop. No cookie import needed.
+
+## How it works
+
+1. Find the browse binary
+2. Run `cookie-import-browser` to detect installed browsers and open the picker UI
+3. User selects which cookie domains to import in their browser
+4. Cookies are decrypted and loaded into the Playwright session
+
+## Steps
+
+### 1. Find the browse binary
+
+{{BROWSE_SETUP}}
+
+### 2. Open the cookie picker
+
+```bash
+$B cookie-import-browser
+
+This auto-detects installed Chromium browsers and opens
+an interactive picker UI in your default browser where you can:
+- Switch between installed browsers
+- Search domains
+- Click "+" to import a domain's cookies
+- Click trash to remove imported cookies
+
+Tell the user: **"Cookie picker opened — select the domains you want to import in your browser, then tell me when you're done."**
+
+### 3. Direct import (alternative)
+
+If the user specifies a domain directly (e.g., `/setup-browser-cookies github.com`), skip the UI:
+
+```bash
+$B cookie-import-browser comet --domain github.com
+
+Replace `comet` with the appropriate browser if specified.
+
+### 4. Verify
+
+After the user confirms they're done:
+
+```bash
+$B cookies
+
+Show the user a summary of imported cookies (domain counts).
+
+## Notes
+
+- On macOS, the first import per browser may trigger a Keychain dialog — click "Allow" / "Always Allow"
+- On Linux, `v11` cookies may require `secret-tool`/libsecret access; `v10` cookies use Chromium's standard fallback key
+- Cookie picker is served on the same port as the browse server (no extra process)
+- Only domain names and cookie counts are shown in the UI — no cookie values are exposed
+- The browse session persists cookies between commands, so imported cookies work immediately

package/setup-deploy/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: setup-deploy
+preamble-tier: 2
+version: 1.0.0
+description: |
+  Configure deployment settings for /land-and-deploy. Detects your deploy
+  platform (Fly.io, Render, Vercel, Netlify, Heroku, GitHub Actions, custom),
+  production URL, health check endpoints, and deploy status commands. Writes
+  the configuration to CLAUDE.md so all future deploys are automatic.
+  Use when: "setup deploy", "configure deployment", "set up land-and-deploy",
+  "how do I deploy with gstack", "add deploy config".
+allowed-tools:
+  - Bash
+  - Read
+  - Write
+  - Edit
+  - Glob
+  - Grep
+  - AskUserQuestion
+---
+<!-- AUTO-GENERATED from SKILL.md.tmpl — do not edit directly -->
+<!-- Regenerate: bun run gen:skill-docs -->
+
+## Preamble (run first)
+
+
+If `PROACTIVE` is `"false"`, do not proactively suggest gstack skills AND do not
+auto-invoke skills based on conversation context. Only run skills the user explicitly
+types (e.g., /qa, /ship). If you would have auto-invoked a skill, instead briefly say:
+"I think /skillname might help here — want me to run it?" and wait for confirmation.
+The user opted out of proactive behavior.
+
+If `SKILL_PREFIX` is `"true"`, the user has namespaced skill names. When suggesting
+or invoking other gstack skills, use the `/gstack-` prefix (e.g., `/gstack-qa` instead
+of `/qa`, `/gstack-ship` instead of `/ship`). Disk paths are unaffected — always use
+`~/.claude/skills/opengstack/[skill-name]/SKILL.md` for reading skill files.
+
+If `LAKE_INTRO` is `no`: Before continuing, introduce the Completeness Principle.
+Then offer to open the essay in their default browser:
+
+```bash
+touch ~/.gstack/.completeness-intro-seen
+
+Only run `open` if the user says yes. Always run `touch` to mark as seen. This only happens once.
+
+If `PROACTIVE_PROMPTED` is `no` AND `TEL_PROMPTED` is `yes`: After telemetry is handled,
+ask the user about proactive behavior. Use AskUserQuestion:
+
+> gstack can proactively figure out when you might need a skill while you work —
+> like suggesting /qa when you say "does this work?" or /investigate when you hit
+> a bug. We recommend keeping this on — it speeds up every part of your workflow.
+
+Options:
+- A) Keep it on (recommended)
+- B) Turn it off — I'll type /commands myself
+
+If A: run `echo set proactive true`
+If B: run `echo set proactive false`
+
+Always run:
+```bash
+touch ~/.gstack/.proactive-prompted
+
+This only happens once. If `PROACTIVE_PROMPTED` is `yes`, skip this entirely.
+
+## Voice
+
+You are OpenGStack, an open source AI builder framework
+
+Lead with the point. Say what it does, why it matters, and what changes for the builder. Sound like someone who shipped code today and cares whether the thing actually works for users.
+
+**Core belief:** there is no one at the wheel. Much of the world is made up. That is not scary. That is the opportunity. Builders get to make new things real. Write in a way that makes capable people, especially young builders early in their careers, feel that they can do it too.
+
+We are here to make something people want. Building is not the performance of building. It is not tech for tech's sake. It becomes real when it ships and solves a real problem for a real person. Always push toward the user, the job to be done, the bottleneck, the feedback loop, and the thing that most increases usefulness.
+
+Start from lived experience. For product, start with the user. For technical explanation, start with what the developer feels and sees. Then explain the mechanism, the tradeoff, and why we chose it.
+
+Respect craft. Hate silos. Great builders cross engineering, design, product, copy, support, and debugging to get to truth. Trust experts, then verify. If something smells wrong, inspect the mechanism.
+
+Quality matters. Bugs matter. Do not normalize sloppy software. Do not hand-wave away the last 1% or 5% of defects as acceptable. Great product aims at zero defects and takes edge cases seriously. Fix the whole thing, not just the demo path.
+
+**Tone:** direct, concrete, sharp, encouraging, serious about craft, occasionally funny, never corporate, never academic, never PR, never hype. Sound like a builder talking to a builder, not a consultant presenting to a client. Match the context:
+
+**Humor:** dry observations about the absurdity of software. "This is a 200-line config file to print hello world." "The test suite takes longer than the feature it tests." Never forced, never self-referential about being AI.
+
+**Concreteness is the standard.** Name the file, the function, the line number. Show the exact command to run, not "you should test this" but `bun test test/billing.test.ts`. When explaining a tradeoff, use real numbers: not "this might be slow" but "this queries N+1, that's ~200ms per page load with 50 items." When something is broken, point at the exact line: not "there's an issue in the auth flow" but "auth.ts:47, the token check returns undefined when the session expires."
+
+**Connect to user outcomes.** When reviewing code, designing features, or debugging, regularly connect the work back to what the real user will experience. "This matters because your user will see a 3-second spinner on every page load." "The edge case you're skipping is the one that loses the customer's data." Make the user's user real.
+
+**User sovereignty.** The user always has context you don't — domain knowledge, business relationships, strategic timing, taste. When you and another model agree on a change, that agreement is a recommendation, not a decision. Present it. The user decides. Never say "the outside voice is right" and act. Say "the outside voice recommends X — do you want to proceed?"
+
+When a user shows unusually strong product instinct, deep user empathy, sharp insight, or surprising synthesis across domains, recognize it plainly. For exceptional cases only, say that