opengstack 0.13.7 → 0.13.8

package/bin/opengstack.js

@@ -1,91 +1,37 @@
 #!/usr/bin/env node
 
 /**
- * OpenGStack CLI - Run skills directly from command line
- * Usage: opengstack <skill-name> [args...]
- * Example: opengstack ship
+ * OpenGStack CLI - Install and manage AI workflow skills
+ * Usage: opengstack [options]
+ * Example: opengstack --install
  */
 
 const fs = require('fs');
 const path = require('path');
 
 const PKG_DIR = path.dirname(__dirname);
-const SKILLS_DIR = path.join(process.env.HOME || process.env.USERPROFILE, '.claude', 'skills');
-
-// Map of skill names to their directories
-const skillMap = {
-  'ship': 'ship',
-  'qa': 'qa',
-  'qa-only': 'qa-only',
-  'review': 'review',
-  'investigate': 'investigate',
-  'design-review': 'design-review',
-  'plan-ceo-review': 'plan-ceo-review',
-  'plan-eng-review': 'plan-eng-review',
-  'plan-design-review': 'plan-design-review',
-  'office-hours': 'office-hours',
-  'design-consultation': 'design-consultation',
-  'design-shotgun': 'design-shotgun',
-  'document-release': 'document-release',
-  'retro': 'retro',
-  'browse': 'browse',
-  'setup-browser-cookies': 'setup-browser-cookies',
-  'setup-deploy': 'setup-deploy',
-  'careful': 'careful',
-  'freeze': 'freeze',
-  'guard': 'guard',
-  'unfreeze': 'unfreeze',
-  'autoplan': 'autoplan',
-  'codex': 'codex',
-  'canary': 'canary',
-  'benchmark': 'benchmark',
-  'cso': 'cso',
-  'connect-chrome': 'connect-chrome',
-  'land-and-deploy': 'land-and-deploy',
-  'gstack-upgrade': 'gstack-upgrade'
-};
+const SKILLS_SOURCE = path.join(PKG_DIR, 'skills');
+
+function getSkillDescription(skillName) {
+  const skillPath = path.join(SKILLS_SOURCE, skillName, 'SKILL.md');
+  if (!fs.existsSync(skillPath)) return '';
+  
+  const content = fs.readFileSync(skillPath, 'utf8');
+  const match = content.match(/description:\s*\|?\s*([^\n]+)/);
+  return match ? match[1].trim() : '';
+}
 
 function showHelp() {
   console.log(`
 OpenGStack - AI Engineering Workflow Skills
 
-Usage: opengstack <command> [options]
-
-Commands:
-  ship              Ship workflow: test, review, push, PR
-  qa                Open browser, find bugs, fix, verify
-  qa-only           QA report only — no code changes
-  review            Pre-landing PR review
-  investigate       Root-cause debugging
-  design-review     Design audit + fix loop
-  plan-ceo-review   CEO-level strategic review
-  plan-eng-review   Lock architecture & edge cases
-  plan-design-review Rate design decisions 0-10
-  office-hours      Brainstorm before building
-  design-consultation Build a design system from scratch
-  design-shotgun    Generate multiple AI design variants
-  document-release  Update docs post-ship
-  retro             Weekly engineering retrospective
-  browse            Headless browser (real Chromium)
-  setup-browser-cookies Import cookies for auth testing
-  setup-deploy      Configure deployment settings
-  careful           Warn before destructive ops
-  freeze            Lock edits to one directory
-  guard             Activate careful + freeze
-  unfreeze          Remove directory restrictions
-  autoplan          Run all reviews auto-decisioned
-  codex             OpenAI Codex CLI wrapper
-  canary            Post-deploy monitoring
-  benchmark         Performance regression detection
-  cso               Security audit
-  connect-chrome    Launch Chrome with Side Panel
-  land-and-deploy   Merge PR, deploy, verify health
-  gstack-upgrade    Upgrade gstack to latest version
+Usage: opengstack [options]
 
 Options:
   -h, --help        Show this help message
   -l, --list        List all available skills
-  -i, --install     Install skills to ~/.claude/skills/
+  -i, --install     Install skills to ~/.config/opencode/skills/,
+                    ~/.claude/skills/, and ~/.agents/skills/
 
 In opencode/Claude, use /slash commands:
   /ship, /qa, /review, etc.
@@ -94,18 +40,24 @@ In opencode/Claude, use /slash commands:
 
 function listSkills() {
   console.log('\nAvailable skills:\n');
-  Object.entries(skillMap).forEach(([cmd, dir]) => {
-    const skillPath = path.join(SKILLS_DIR, dir, 'SKILL.md');
+  
+  if (!fs.existsSync(SKILLS_SOURCE)) {
+    console.error('❌ No skills/ folder found');
+    process.exit(1);
+  }
+  
+  fs.readdirSync(SKILLS_SOURCE).forEach(skillName => {
+    const skillPath = path.join(SKILLS_SOURCE, skillName, 'SKILL.md');
+    if (!fs.existsSync(skillPath)) return;
+    
+    const content = fs.readFileSync(skillPath, 'utf8');
+    const match = content.match(/description:\s*\|?\s*([^\n]+)/);
     let description = '';
-    if (fs.existsSync(skillPath)) {
-      const content = fs.readFileSync(skillPath, 'utf8');
-      const match = content.match(/description:\s*\|?\s*([^\n]+)/);
-      if (match) {
-        description = match[1].trim().substring(0, 60);
-        if (description.length === 60) description += '...';
-      }
+    if (match) {
+      description = match[1].trim().substring(0, 60);
+      if (description.length === 60) description += '...';
     }
-    console.log(`  ${cmd.padEnd(20)} ${description}`);
+    console.log(`  ${skillName.padEnd(20)} ${description}`);
   });
   console.log('');
 }
@@ -134,21 +86,14 @@ function main() {
     process.exit(0);
   }
 
-  const skillDir = skillMap[command];
-  if (!skillDir) {
+  // Check if skill exists in package
+  const skillPath = path.join(SKILLS_SOURCE, command, 'SKILL.md');
+  if (!fs.existsSync(skillPath)) {
     console.error(`Unknown command: ${command}`);
     console.error('Run "opengstack --help" for available commands');
     process.exit(1);
   }
 
-  // Check if skill is installed
-  const skillPath = path.join(SKILLS_DIR, skillDir, 'SKILL.md');
-  if (!fs.existsSync(skillPath)) {
-    console.error(`Skill "${command}" not installed.`);
-    console.error('Run: opengstack --install');
-    process.exit(1);
-  }
-
   // Print instructions for using the skill
   console.log(`\n🎯 Skill: ${command}`);
   console.log(`📍 Location: ${skillPath}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opengstack",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "private": false,
   "description": "AI Engineering Workflow - SKILL.md files that give AI agents structured roles for software development. Forked from gstack but scrubbed clean of all the YC/Garry Tan cruft and telemetry.",
   "keywords": [
@@ -35,8 +35,7 @@
     "CLAUDE.md",
     "AGENTS.md",
     "README.md",
-    "**/SKILL.md",
-    "**/SKILL.md.tmpl",
+    "skills/",
     "scripts/",
     "docs/",
     "bin/"

package/scripts/install-skills.js

@@ -1,74 +1,45 @@
 #!/usr/bin/env node
-
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 
-const SKILLS_DIRS = [
-  path.join(process.env.HOME || process.env.USERPROFILE, '.claude', 'skills'),
-  path.join(process.env.HOME || process.env.USERPROFILE, '.config', 'opencode', 'skills')
-];
-const PKG_DIR = path.dirname(__dirname);
-
-// List of skill directories
-const skills = [
-  'autoplan', 'benchmark', 'browse', 'canary', 'careful', 'codex',
-  'connect-chrome', 'cso', 'design-consultation', 'design-review',
-  'design-shotgun', 'document-release', 'freeze', 'gstack-upgrade',
-  'guard', 'investigate', 'land-and-deploy', 'office-hours',
-  'plan-ceo-review', 'plan-design-review', 'plan-eng-review',
-  'qa', 'qa-only', 'retro', 'review', 'setup-browser-cookies',
-  'setup-deploy', 'ship', 'unfreeze'
+const SKILLS_SOURCE = path.join(__dirname, '..', 'skills');
+const TARGET_DIRS = [
+  path.join(os.homedir(), '.config', 'opencode', 'skills'),     // OpenCode native
+  path.join(os.homedir(), '.claude', 'skills'),                 // Claude compat
+  path.join(os.homedir(), '.agents', 'skills')                  // other agents
 ];
 
-console.log('🔗 Installing OpenGStack skills...');
-
-// Install to all skill directories
-for (const SKILLS_DIR of SKILLS_DIRS) {
-  console.log(`\n📁 Installing to ${SKILLS_DIR}...`);
-  
-  // Ensure skills directory exists
-  if (!fs.existsSync(SKILLS_DIR)) {
-    fs.mkdirSync(SKILLS_DIR, { recursive: true });
+function copySkills() {
+  if (!fs.existsSync(SKILLS_SOURCE)) {
+    console.error('❌ No skills/ folder found in package');
+    process.exit(1);
   }
 
-  // Create symlinks for each skill
-  let installed = 0;
-  let skipped = 0;
+  TARGET_DIRS.forEach(target => {
+    if (!fs.existsSync(target)) {
+      fs.mkdirSync(target, { recursive: true });
+    }
 
-  for (const skill of skills) {
-    const srcPath = path.join(PKG_DIR, skill);
-    const destPath = path.join(SKILLS_DIR, skill);
+    fs.readdirSync(SKILLS_SOURCE).forEach(skillName => {
+      const src = path.join(SKILLS_SOURCE, skillName);
+      const dest = path.join(target, skillName);
 
-    if (!fs.existsSync(srcPath)) {
-      console.warn(`⚠️  Skill not found: ${skill}`);
-      skipped++;
-      continue;
-    }
+      // Skip if not a directory
+      if (!fs.statSync(src).isDirectory()) return;
 
-    try {
-      // Remove existing if it's a symlink
-      if (fs.existsSync(destPath)) {
-        const stat = fs.lstatSync(destPath);
-        if (stat.isSymbolicLink()) {
-          fs.unlinkSync(destPath);
-        } else {
-          console.log(`⏭️  Skipping ${skill} (already exists)`);
-          skipped++;
-          continue;
-        }
+      if (fs.existsSync(dest)) {
+        console.log(`⚠️  Skill ${skillName} already exists — skipping`);
+        return;
       }
 
-      // Create symlink
-      fs.symlinkSync(srcPath, destPath, 'dir');
-      console.log(`✓ ${skill}`);
-      installed++;
-    } catch (err) {
-      console.error(`✗ ${skill}: ${err.message}`);
-      skipped++;
-    }
-  }
+      fs.cpSync(src, dest, { recursive: true, force: true });
+      console.log(`✅ Installed skill: /${skillName}`);
+    });
+  });
 
-  console.log(`\n✅ Installed ${installed} skills, skipped ${skipped}`);
+  console.log('\n🎉 Skills installed! Restart OpenCode (just quit and restart the TUI).');
+  console.log('Now just type /qa directly — no /skills menu needed.');
 }
 
-console.log('\n🎯 Skills are now available in opencode/Claude');
+copySkills();

package/skills/browse/bin/find-browse

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Shim: delegates to compiled find-browse binary, falls back to basic discovery.
+# The compiled binary handles git root detection for workspace-local installs.
+DIR="$(cd "$(dirname "$0")/.." && pwd)/dist"
+if test -x "$DIR/find-browse"; then
+  exec "$DIR/find-browse" "$@"
+fi
+# Fallback: basic discovery with priority chain
+ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
+for MARKER in .codex .agents .claude; do
+  if [ -n "$ROOT" ] && test -x "$ROOT/$MARKER/skills/gstack/browse/dist/browse"; then
+    echo "$ROOT/$MARKER/skills/gstack/browse/dist/browse"
+    exit 0
+  fi
+  if test -x "$HOME/$MARKER/skills/gstack/browse/dist/browse"; then
+    echo "$HOME/$MARKER/skills/gstack/browse/dist/browse"
+    exit 0
+  fi
+done
+echo "ERROR: browse binary not found. Run: cd <skill-dir> && ./setup" >&2
+exit 1

package/skills/browse/bin/remote-slug

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Output the remote slug (owner-repo) for the current git repo.
+# Used by SKILL.md files to derive project-specific paths in ~/.gstack/projects/.
+set -e
+URL=$(git remote get-url origin 2>/dev/null || true)
+if [ -n "$URL" ]; then
+  # Strip trailing .git if present, then extract owner/repo
+  URL="${URL%.git}"
+  # Handle both SSH (git@host:owner/repo) and HTTPS (https://host/owner/repo)
+  OWNER_REPO=$(echo "$URL" | sed -E 's#.*[:/]([^/]+)/([^/]+)$#\1-\2#')
+  echo "$OWNER_REPO"
+else
+  basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+fi

package/skills/browse/scripts/build-node-server.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Build a Node.js-compatible server bundle for Windows.
+#
+# On Windows, Bun can't launch or connect to Playwright's Chromium
+# (oven-sh/bun#4253, #9911). This script produces a server bundle
+# that runs under Node.js with Bun API polyfills.
+
+set -e
+
+GSTACK_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+SRC_DIR="$GSTACK_DIR/browse/src"
+DIST_DIR="$GSTACK_DIR/browse/dist"
+
+echo "Building Node-compatible server bundle..."
+
+# Step 1: Transpile server.ts to a single .mjs bundle (externalize runtime deps)
+bun build "$SRC_DIR/server.ts" \
+  --target=node \
+  --outfile "$DIST_DIR/server-node.mjs" \
+  --external playwright \
+  --external playwright-core \
+  --external diff \
+  --external "bun:sqlite"
+
+# Step 2: Post-process
+# Replace import.meta.dir with a resolvable reference
+perl -pi -e 's/import\.meta\.dir/__browseNodeSrcDir/g' "$DIST_DIR/server-node.mjs"
+# Stub out bun:sqlite (macOS-only cookie import, not needed on Windows)
+perl -pi -e 's|import { Database } from "bun:sqlite";|const Database = null; // bun:sqlite stubbed on Node|g' "$DIST_DIR/server-node.mjs"
+
+# Step 3: Create the final file with polyfill header injected after the first line
+{
+  head -1 "$DIST_DIR/server-node.mjs"
+  echo '// ── Windows Node.js compatibility (auto-generated) ──'
+  echo 'import { fileURLToPath as _ftp } from "node:url";'
+  echo 'import { dirname as _dn } from "node:path";'
+  echo 'const __browseNodeSrcDir = _dn(_dn(_ftp(import.meta.url))) + "/src";'
+  echo '{ const _r = createRequire(import.meta.url); _r("./bun-polyfill.cjs"); }'
+  echo '// ── end compatibility ──'
+  tail -n +2 "$DIST_DIR/server-node.mjs"
+} > "$DIST_DIR/server-node.tmp.mjs"
+
+mv "$DIST_DIR/server-node.tmp.mjs" "$DIST_DIR/server-node.mjs"
+
+# Step 4: Copy polyfill to dist/
+cp "$SRC_DIR/bun-polyfill.cjs" "$DIST_DIR/bun-polyfill.cjs"
+
+echo "Node server bundle ready: $DIST_DIR/server-node.mjs"

package/skills/browse/src/activity.ts

@@ -0,0 +1,208 @@
+/**
+ * Activity streaming — real-time feed of browse commands for the Chrome extension Side Panel
+ *
+ * Architecture:
+ *   handleCommand() ──► emitActivity(command_start)
+ *                   ──► emitActivity(command_end)
+ *   wirePageEvents() ──► emitActivity(navigation)
+ *
+ *   GET /activity/stream?after=ID ──► SSE via ReadableStream
+ *   GET /activity/history?limit=N ──► REST fallback
+ *
+ * Privacy: filterArgs() redacts passwords, auth tokens, and sensitive query params.
+ * Backpressure: subscribers notified via queueMicrotask (never blocks command path).
+ * Gap detection: client sends ?after=ID, server detects if ring buffer overflowed.
+ */
+
+import { CircularBuffer } from './buffers';
+
+// ─── Types ──────────────────────────────────────────────────────
+
+export interface ActivityEntry {
+  id: number;
+  timestamp: number;
+  type: 'command_start' | 'command_end' | 'navigation' | 'error';
+  command?: string;
+  args?: string[];
+  url?: string;
+  duration?: number;
+  status?: 'ok' | 'error';
+  error?: string;
+  result?: string;
+  tabs?: number;
+  mode?: string;
+}
+
+// ─── Buffer & Subscribers ───────────────────────────────────────
+
+const BUFFER_CAPACITY = 1000;
+const activityBuffer = new CircularBuffer<ActivityEntry>(BUFFER_CAPACITY);
+let nextId = 1;
+
+type ActivitySubscriber = (entry: ActivityEntry) => void;
+const subscribers = new Set<ActivitySubscriber>();
+
+// ─── Privacy Filtering ─────────────────────────────────────────
+
+const SENSITIVE_COMMANDS = new Set(['fill', 'type', 'cookie', 'header']);
+const SENSITIVE_PARAM_PATTERN = /\b(password|token|secret|key|auth|bearer|api[_-]?key)\b/i;
+
+/**
+ * Redact sensitive data from command args before streaming.
+ */
+export function filterArgs(command: string, args: string[]): string[] {
+  if (!args || args.length === 0) return args;
+
+  // fill: redact the value (last arg) for password-type fields
+  if (command === 'fill' && args.length >= 2) {
+    const selector = args[0];
+    // If the selector suggests a password field, redact the value
+    if (/password|passwd|secret|token/i.test(selector)) {
+      return [selector, '[REDACTED]'];
+    }
+    return args;
+  }
+
+  // header: redact Authorization and other sensitive headers
+  if (command === 'header' && args.length >= 1) {
+    const headerLine = args[0];
+    if (/^(authorization|x-api-key|cookie|set-cookie)/i.test(headerLine)) {
+      const colonIdx = headerLine.indexOf(':');
+      if (colonIdx > 0) {
+        return [headerLine.substring(0, colonIdx + 1) + '[REDACTED]'];
+      }
+    }
+    return args;
+  }
+
+  // cookie: redact cookie values
+  if (command === 'cookie' && args.length >= 1) {
+    const cookieStr = args[0];
+    const eqIdx = cookieStr.indexOf('=');
+    if (eqIdx > 0) {
+      return [cookieStr.substring(0, eqIdx + 1) + '[REDACTED]'];
+    }
+    return args;
+  }
+
+  // type: always redact (could be a password field)
+  if (command === 'type') {
+    return ['[REDACTED]'];
+  }
+
+  // URL args: redact sensitive query params
+  return args.map(arg => {
+    if (arg.startsWith('http://') || arg.startsWith('https://')) {
+      try {
+        const url = new URL(arg);
+        let redacted = false;
+        for (const key of url.searchParams.keys()) {
+          if (SENSITIVE_PARAM_PATTERN.test(key)) {
+            url.searchParams.set(key, '[REDACTED]');
+            redacted = true;
+          }
+        }
+        return redacted ? url.toString() : arg;
+      } catch {
+        return arg;
+      }
+    }
+    return arg;
+  });
+}
+
+/**
+ * Truncate result text for streaming (max 200 chars).
+ */
+function truncateResult(result: string | undefined): string | undefined {
+  if (!result) return undefined;
+  if (result.length <= 200) return result;
+  return result.substring(0, 200) + '...';
+}
+
+// ─── Public API ─────────────────────────────────────────────────
+
+/**
+ * Emit an activity event. Backpressure-safe: subscribers notified asynchronously.
+ */
+export function emitActivity(entry: Omit<ActivityEntry, 'id' | 'timestamp'>): ActivityEntry {
+  const full: ActivityEntry = {
+    ...entry,
+    id: nextId++,
+    timestamp: Date.now(),
+    args: entry.args ? filterArgs(entry.command || '', entry.args) : undefined,
+    result: truncateResult(entry.result),
+  };
+  activityBuffer.push(full);
+
+  // Notify subscribers asynchronously — never block the command path
+  for (const notify of subscribers) {
+    queueMicrotask(() => {
+      try { notify(full); } catch { /* subscriber error — don't crash */ }
+    });
+  }
+
+  return full;
+}
+
+/**
+ * Subscribe to live activity events. Returns unsubscribe function.
+ */
+export function subscribe(fn: ActivitySubscriber): () => void {
+  subscribers.add(fn);
+  return () => subscribers.delete(fn);
+}
+
+/**
+ * Get recent activity entries after the given cursor ID.
+ * Returns entries and gap info if the buffer has overflowed.
+ */
+export function getActivityAfter(afterId: number): {
+  entries: ActivityEntry[];
+  gap: boolean;
+  gapFrom?: number;
+  availableFrom?: number;
+  totalAdded: number;
+} {
+  const total = activityBuffer.totalAdded;
+  const allEntries = activityBuffer.toArray();
+
+  if (afterId === 0) {
+    return { entries: allEntries, gap: false, totalAdded: total };
+  }
+
+  // Check for gap: if afterId is too old and has been evicted
+  const oldestId = allEntries.length > 0 ? allEntries[0].id : nextId;
+  if (afterId < oldestId) {
+    return {
+      entries: allEntries,
+      gap: true,
+      gapFrom: afterId + 1,
+      availableFrom: oldestId,
+      totalAdded: total,
+    };
+  }
+
+  // Filter to entries after the cursor
+  const filtered = allEntries.filter(e => e.id > afterId);
+  return { entries: filtered, gap: false, totalAdded: total };
+}
+
+/**
+ * Get the N most recent activity entries.
+ */
+export function getActivityHistory(limit: number = 50): {
+  entries: ActivityEntry[];
+  totalAdded: number;
+} {
+  const allEntries = activityBuffer.toArray();
+  const sliced = limit < allEntries.length ? allEntries.slice(-limit) : allEntries;
+  return { entries: sliced, totalAdded: activityBuffer.totalAdded };
+}
+
+/**
+ * Get subscriber count (for debugging/health).
+ */
+export function getSubscriberCount(): number {
+  return subscribers.size;
+}