CHANGELOG.md

Changelog

[0.7.0] - 2026-07-24 — Leaner skills for Claude 5 and GPT-5.6

Changed

• Skystack now gets to work with 69% less generated Claude skill context. The root skill is a small router, browser syntax comes from live --help, and workflow skills keep the decisions and safety boundaries that affect results without repeatedly loading process tutorials.
• QA, review, and security respect the requested outcome. QA reports findings unless fixes were requested; reviews and security audits remain read-only by default. When fixes are requested, each workflow still verifies the exact behavior it changed.
• /pm has two meaningful checkpoints instead of constant ceremony. You approve product direction, then Skystack works autonomously through planning, implementation, and verification until the final publish decision.
• /publish follows the repository instead of imposing a release framework. It discovers the project's existing checks, preserves unrelated work, creates bisectable commits, and crosses push, PR, release, or deployment boundaries only when requested.
• Large workflows use parallel specialists only when the work is genuinely independent. Normal reviews and plans stay cohesive; broad security, performance, or UI work can still fan out with explicit ownership.
• The Claude /codex skill now uses GPT-5.6 Sol through the current Codex CLI. Review, challenge, and consultation modes are fresh, read-only by default, and no longer maintain a separate long-lived session layer.

Removed

• Global session tracking, vocabulary policing, mandatory plan approval, and automatic test-framework bootstrapping no longer tax every workflow. The relevant behavior now lives in the skill that owns it, or is inferred from the repository when needed.
• Root and browser skills no longer duplicate the complete command and snapshot reference. $B --help remains the single current command interface.

For contributors

• Claude and Codex generation, health checks, watch mode, and validation now use one canonical skill catalog covering 24 Claude skills and 12 Codex skills.
• Paid E2E infrastructure can run Claude Fable 5 and GPT-5.6 Sol in isolated homes with explicit provider, model, effort, CLI, prompt, and skill identity.
• Diff-based eval selection now includes committed, staged, unstaged, and untracked changes while excluding retired prompt-coupled scenarios.
• Generated Claude skill content is guarded by a 30,000-word footprint budget.

[0.6.11.1] - 2026-04-10

Fixed

• Codex plan review now actually runs during /pm planning. Claude's plan mode was silently blocking the codex exec call — it'd "plan" the review instead of executing it. Now dispatched via a subagent that runs outside plan mode, so it fires every time.
• Codex code review scoped to your feature, not the whole branch. Previously, codex review --base main reviewed every commit on the branch — including work from before your /pm session. Now pipes only the feature's diff (from build start to HEAD) to codex exec, so codex sees exactly what you built.
• Plan and spec content embedded inline for codex. Instead of telling codex to read files (which let it wander the repo reviewing unrelated code), the plan and spec are now passed directly in the prompt. Codex stays focused on the review.
• Build start SHA vs batch base SHA distinguished. Multi-batch builds now track an immutable "build start SHA" for the final cross-model review, separate from the per-batch SHA that gets updated after each batch. Previously, the final review would only cover the last batch's changes.

[0.6.11.0] - 2026-04-10 — Autonomous Multi-Model Review Pipeline

Added

• /pm now runs Codex + Claude review gates automatically. After the plan is written, Codex independently reviews it before implementation begins. After all code is built and verified, /review specialists and Codex run in parallel for a cross-model code review. Findings from both models get synthesized — issues found by both get high confidence, unique finds still surface. Auto-fixable items get fixed on the spot; the rest appear in your build summary. The whole flow runs without asking you anything.
• Graceful degradation when Codex isn't installed. The new review gates skip silently if you don't have the codex CLI — /pm works exactly as before. Install codex to unlock the cross-model pipeline.
• Smart gate calibration. Only CRITICAL findings or 3+ IMPORTANT items shift the publish recommendation. Minor and taste issues stay advisory — no more over-gating on trivial stuff.
• INCOMPLETE review status. If Codex times out or a review source fails, the synthesizer flags it as INCOMPLETE instead of silently passing. You'll know the review was partial.
• Evidence-required plan reviews. Codex plan review findings now require citations (plan_ref, spec_ref, repo evidence) — no more vague "this might be wrong" without proof.

[0.6.10.2] - 2026-04-09

Fixed

• README and docs now list all 19 skills. Five skills (/benchmark, /canary, /checkpoint, /health, /skystack-upgrade) were missing from the README tools table. Four were missing from the install and troubleshooting skill lists. Seven were missing from the docs/skills.md deep dives page. All synced.

[0.6.10.1] - 2026-04-09

Fixed

• /codex review now actually works. The codex CLI treats --base and custom instructions as mutually exclusive arguments — skystack was passing both, causing every review to fail with exit code 2 and enter a retry spiral. Now uses the right invocation for each case: codex review --base for default reviews, codex exec with a full prompt when you provide custom instructions.
• No more background polling loops. Codex commands now run in the foreground with a clean 5-minute timeout instead of being backgrounded and polled with sleep loops (which produced empty output).

[0.6.10.0] - 2026-04-09 — Self-Learning, Token Optimization, Security Hardening

Added

• Self-learning infrastructure. Skills now remember what worked and what broke across sessions. Two new binaries (skystack-learnings-log, skystack-learnings-search) store per-project learnings as append-only JSONL with confidence decay and cross-project discovery. 13 skills wired into the learn-and-recall loop.
• Operational self-improvement. Every skill session now reflects on failures and project-specific quirks at the end, logging them for future sessions. Preamble shows top 3 learnings when you have more than 5 — your agents get smarter with every run.
• Automatic model selection for subagents. Skills now assign opus/sonnet/haiku to each subagent based on task complexity. Planning and review subagents use opus; implementation uses sonnet; test runners use haiku. ~45% cost reduction on subagent-heavy workflows like /pm.
• Worktree safety checks. New {{WORKTREE_SAFETY}} resolver warns you before subagents spawn from uncommitted state. Asks to commit or stash first — prevents the bug where worktree-isolated agents can't see your latest changes.
• Code index MCP setup. New reference doc and bin/skystack-setup-code-index script for jCodeMunch MCP — AST-based code indexing that cuts codebase exploration tokens by ~95%.
• Snapshot dropdown/popover detection. snapshot -i now auto-enables -C and detects floating containers (Radix popovers, React portals). Dropdown items show up as @c refs tagged popover-child. 8 new tests.
• Confidence calibration resolver. Review-producing skills now include honest confidence scoring — findings are graded 1-10 so you can trust the severity ratings.

Fixed

• Cookie picker auth hardened. One-time code exchange (Jupyter-style) replaces unauthenticated access. The master auth token never appears in HTML or browser history. Session cookies with 1-hour TTL.
• Symlink bypass in path validation. validateOutputPath now resolves symlinks via realpathSync — a symlink inside /tmp pointing outside can no longer bypass the path check.
• Directory permissions hardened. State directories created with mode: 0o700 (owner-only).
• Snapshot floating container walk. Fixed bug where the parent walk started at the element itself, incorrectly tagging fixed-position elements as popover-child. Added WeakMap cache to avoid O(N*M) getComputedStyle calls on deep DOMs.
• Cross-project learnings detection. Fixed unreliable detection that grepped line content for the project slug. Now uses file provenance tagging.

[0.6.9.0] - 2026-04-01 — gstack Port: New Skills, Browse Commands, QA Hardening

Added

• /checkpoint — save and resume session context. Captures git state, decisions made, and remaining work to a file. Resume exactly where you left off, even after switching branches or closing the session. Commands: save, resume, list.
• /health — code quality dashboard. Wraps your existing tools (tsc, eslint, tests, dead code detection) into a weighted 0-10 composite score. Tracks trends over time so you can see if quality is improving or degrading. Read-only — reports, never fixes.
• /canary — post-deploy monitoring. Watches your live app after a deploy using the browse daemon. Screenshots every 60 seconds, compares against baselines, alerts on new console errors or performance regressions. Includes baseline capture mode (--baseline) for before-deploy snapshots.
• /devops skill now registered in the doc generator and listed in README/CLAUDE.md.
• cleanup browse command. Removes ads, cookie banners, sticky overlays, and social widgets from a page for cleaner snapshots. Targets specific known frameworks (OneTrust, CookieBot, Google Ads) to avoid false positives.
• prettyscreenshot browse command. Screenshot with auto-cleanup — runs cleanup first, then captures. Supports --hide <selector> and --width <N> flags.
• frame browse command. Switch to an iframe context so all subsequent commands (text, snapshot, click, etc.) operate inside the frame. Use frame main to return. All read/write commands are now frame-aware.
• state browse command. Save and load browser state (cookies + localStorage + open pages) to named files. Uses Playwright's built-in storageState() for complete persistence including IndexedDB.

Changed

• QA self-regulation is now continuous. WTF-likelihood tracking runs after every fix (was every 5). Hard gate at 20% with explicit user prompt. WTF% now appears in commit message suffixes. 50-fix hard cap has explicit enforcement and defers remaining issues to TODOS.md.
• Browse commands are frame-aware. When a frame is active, text, html, links, forms, accessibility, js, eval, css, attrs, is, click, fill, select, hover, scroll, and wait all operate within the frame context. Page-level commands (goto, screenshot, cookies) still target the page.

Fixed

• Cleanup selectors no longer match false positives. Replaced overly broad selectors like [class*="ad-"] (matched "gradient-", "padding-") and [id*="cookie"] (matched cookie recipe sites) with specific framework selectors.
• Cleanup no longer scans every DOM element. Replaced querySelectorAll('*') with targeted container queries (div, section, aside, footer, [role="dialog"]) for fixed/sticky position detection. Faster on heavy pages.

[0.6.8.0] - 2026-03-29 — Voice, Taste Memory, Dual-Model Review, and Process Upgrades

Added

• Every skill now speaks in a consistent voice. A centralized voice directive bans AI-sounding vocabulary ("delve", "crucial", "robust" and 20+ more), kills filler phrases, and requires every finding to connect to what the real user will experience. Two tiers: conversational skills (review, design, pm, codex) get the full treatment, utility skills (browse, research) get a lightweight version.
• Skills remember your preferences across sessions. Taste memory persists your design aesthetic, review focus areas, codex mode preferences, and communication style to ~/.skystack/projects/$SLUG/taste.json. Future invocations start from your baseline instead of from scratch. Preferences older than 90 days get a staleness warning.
• /codex now prevents Codex from reading skill files. A filesystem boundary directive is prepended to every Codex prompt, keeping it focused on your code instead of wandering into skystack's own templates. Rabbit-hole detection warns you if Codex got distracted anyway.
• /codex cross-model analysis now classifies decisions. When both Claude and Codex agree your approach should change, findings are presented as structured "User Challenges" with what you said, what they recommend, why, what they might be missing, and the cost if they're wrong. You always decide.
• /publish now audits plan completion before shipping. Cross-references your Claude Code plan file against the diff — classifies each plan item as DONE, PARTIAL, CHANGED, or NOT DONE with evidence. Unfinished items get flagged before PR creation.
• /publish has a progressive trust ladder. First run walks you through everything (teacher mode). After that, it runs efficiently. If your config changes, it re-validates. Trust state persists per-project.
• /publish enforces configurable test coverage thresholds. Add a ## Test Coverage section to CLAUDE.md with Minimum/Target percentages. Above target passes silently, between min and target asks, below minimum is a hard gate.
• Review logs now track where reviews came from. Every review JSONL entry includes a via field (standalone, publish, pm, codex) so /retro can show review patterns.
• /pm reviewers now show you what good and bad looks like. Spec and code quality reviewers include calibrated few-shot examples (PASS, FAIL, borderline) so they grade consistently instead of guessing.
• UI code now gets checked for AI slop during review. Code quality reviews flag generic AI patterns (purple gradients, vague hero copy, stock card grids) when a batch includes UI work.
• Review gates now have hard-fail categories. Missing accessibility labels, untested conditionals, OWASP top 5 security issues, and broken builds automatically fail a batch — no soft passes on safety-critical issues.
• Long /pm and /qa sessions hand off gracefully. Context checkpoints save progress to a file and start a fresh session when context gets heavy, keeping quality high on complex features.

Fixed

• Browse skill now warns about untrusted page content. Pages fetched via goto/text/html/js are explicitly marked as data to inspect, not commands to execute. Prompt injection attempts from page content get flagged.
• QA examples no longer leak test credentials. Hardcoded test@example.com/password123 replaced with $TEST_EMAIL/$TEST_PASSWORD environment variables.
• Cookie import now has a safety callout. Warns about plaintext storage and importing only from controlled browsers.
• zsh glob compatibility across 6 skill templates. Added setopt +o nomatch guards before bare glob patterns that would fail in zsh with no matches.

[0.6.7.0] - 2026-03-24 — Worktree Isolation and Subagent Patterns

Added

• Parallel agents no longer step on each other's toes. /pm now runs independent implementation tasks in isolated git worktrees, so parallel agents can write code without conflicting on shared files. Each agent gets its own copy of the repo.
• /publish runs tests and coverage analysis simultaneously. Test execution and the coverage audit now dispatch as parallel subagents instead of running one after the other.
• New "Subagent & Worktree Patterns" guide in CLAUDE.md. Documents when skills should use subagents, when to use worktree isolation, and when neither is appropriate. Makes it easy for new skill authors to follow established patterns.
• "One decision per question" rule (ported from upstream). Every skill now follows the rule: never combine multiple independent decisions into a single question. Each decision gets its own focused prompt. Batch-ask patterns for related findings (like review results) are still fine.

[0.6.6.0] - 2026-03-23 — Codex CLI, Security Audits, and Performance Benchmarks

Added

• /codex — get an independent second opinion from OpenAI's Codex CLI. Three modes: /codex review runs a code review with pass/fail gate, /codex challenge goes adversarial (tries to break your code), and /codex opens a conversation with session continuity. Cross-model comparison shows where Claude and Codex agree and disagree. Results persist to the review dashboard so /publish knows a second opinion ran.
• /security — infrastructure-first security audit. 14-phase scan covering secrets archaeology (git history), dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain, OWASP Top 10, and STRIDE threat modeling. Two modes: daily (8/10 confidence gate, zero noise) and comprehensive (2/10 bar, surfaces everything). Every finding includes a concrete exploit scenario and gets independently verified by a subagent. Trend tracking across audit runs.
• /benchmark — performance regression detection. Uses the browse daemon to collect real Core Web Vitals, resource timing, and bundle sizes from running pages. Captures baselines, compares before/after with regression thresholds, grades against industry performance budgets, and tracks trends over time.
• /review now detects scope drift before reviewing code quality. Phase 1.5 compares the files changed against the stated intent (from commit messages, PR description, TODOS.md). Catches "while I was in there" scope creep and flags missing requirements. Informational — doesn't block the review.
• /publish now has a Verification Gate (Step 6.5). Before pushing, if any code changed after the test run (review fixes, generated coverage tests), tests must be re-run. No more "should work now" — confidence is not evidence.

Changed

• /review now verifies its own claims. New rules: if you claim "this is safe" → cite the line. If you claim "this is handled elsewhere" → read and cite the code. Never say "likely handled" — verify or flag as unknown. Also searches for current best practices before recommending fix patterns.
• /diagnose now searches the web when stuck. WebSearch added to allowed tools. When a bug doesn't match known patterns, the skill searches for the error (sanitized — no hostnames, IPs, or customer data). On hypothesis failure, searches again before forming the next guess. Also adds a Scope Advisory after forming the root cause hypothesis to keep edits focused.

[0.6.5.0] - 2026-03-19

Added

• /research now runs 4 parallel subagents — one per reference file. Instead of doing all research sequentially in the main conversation, it dispatches designer, dev, tester, and planner specialists simultaneously. Each subagent returns structured diffs (section-by-section ADD/UPDATE/SKIP) rather than rewriting files wholesale, preserving any customizations you've made. Subagents cite their sources inline so guidance is traceable.
• /review now runs 3 parallel specialist reviewers before the main pass. A security specialist, a performance specialist, and a test-coverage specialist each read the diff independently and return structured FINDINGS blocks. Their output is synthesized and deduplicated before Phase 3 classification — catching more issues with higher signal-to-noise than a single-pass review.
• /qa now dispatches a verification subagent after all fixes are committed. Instead of trusting that a fix worked based on a single re-test, a fresh subagent re-navigates each affected page, reproduces the original repro steps, takes a screenshot, and returns CONFIRMED_FIXED / STILL_BROKEN / COULD_NOT_VERIFY per issue. Broken fixes are flagged prominently in the Phase 5 report.

[0.6.4.1] - 2026-03-18

Added

• Skills now discoverable via natural language. All 12 skills that were missing explicit trigger phrases now have them — say "deploy this" and Claude finds /ship, say "check my diff" and it finds /review. Following Anthropic's best practice: "the description field is not a summary — it's when to trigger."

[0.6.4.0] - 2026-03-17

Added

• /plan-design-review is now interactive — rates 0-10, fixes the plan. Instead of producing a report with letter grades, the designer now works like CEO and Eng review: rates each design dimension 0-10, explains what a 10 looks like, then edits the plan to get there. One AskUserQuestion per design choice. The output is a better plan, not a document about the plan.
• CEO review now calls in the designer. When /plan-ceo-review detects UI scope in a plan, it activates a Design & UX section (Section 11) covering information architecture, interaction state coverage, AI slop risk, and responsive intention. For deep design work, it recommends /plan-design-review.
• 14 of 15 skills now have full test coverage (E2E + LLM-judge + validation). Added LLM-judge quality evals for 10 skills that were missing them: ship, retro, qa-only, plan-ceo-review, plan-eng-review, plan-design-review, design-review, design-consultation, document-release, skystack-upgrade. Added real E2E test for skystack-upgrade (was a .todo). Added design-consultation to command validation.
• Bisect commit style. CLAUDE.md now requires every commit to be a single logical change — renames separate from rewrites, test infrastructure separate from test implementations.

Changed

• /qa-design-review renamed to /design-review — the "qa-" prefix was confusing now that /plan-design-review is plan-mode. Updated across all 22 files.

[0.6.3.0] - 2026-03-17

Added

• Every PR touching frontend code now gets a design review automatically. /review and /ship apply a 20-item design checklist against changed CSS, HTML, JSX, and view files. Catches AI slop patterns (purple gradients, 3-column icon grids, generic hero copy), typography issues (body text < 16px, blacklisted fonts), accessibility gaps (outline: none), and !important abuse. Mechanical CSS fixes are auto-applied; design judgment calls ask you first.
• skystack-diff-scope categorizes what changed in your branch. Run eval $(skystack-diff-scope main) and get SCOPE_FRONTEND=true/false, SCOPE_BACKEND, SCOPE_PROMPTS, SCOPE_TESTS, SCOPE_DOCS, SCOPE_CONFIG. Design review uses it to skip silently on backend-only PRs. Ship pre-flight uses it to recommend design review when frontend files are touched.
• Design review shows up in the Review Readiness Dashboard. The dashboard now distinguishes between "LITE" (code-level, runs automatically in /review and /ship) and "FULL" (visual audit via /plan-design-review with browse binary). Both show up as Design Review entries.
• E2E eval for design review detection. Planted CSS/HTML fixtures with 7 known anti-patterns (Papyrus font, 14px body text, outline: none, !important, purple gradient, generic hero copy, 3-column feature grid). The eval verifies /review catches at least 4 of 7.

[0.6.2.0] - 2026-03-17

Added

• Plan reviews now think like the best in the world. /plan-ceo-review applies 14 cognitive patterns from Bezos (one-way doors, Day 1 proxy skepticism), Grove (paranoid scanning), Munger (inversion), Horowitz (wartime awareness), Chesky/Graham (founder mode), and Altman (leverage obsession). /plan-eng-review applies 15 patterns from Larson (team state diagnosis), McKinley (boring by default), Brooks (essential vs accidental complexity), Beck (make the change easy), Majors (own your code in production), and Google SRE (error budgets). /plan-design-review applies 12 patterns from Rams (subtraction default), Norman (time-horizon design), Zhuo (principled taste), Gebbia (design for trust, storyboard the journey), and Ive (care is visible).
• Latent space activation, not checklists. The cognitive patterns name-drop frameworks and people so the LLM draws on its deep knowledge of how they actually think. The instruction is "internalize these, don't enumerate them" — making each review a genuine perspective shift, not a longer checklist.

[0.6.1.0] - 2026-03-17

Added

• E2E and LLM-judge tests now only run what you changed. Each test declares which source files it depends on. When you run bun run test:e2e, it checks your diff and skips tests whose dependencies weren't touched. A branch that only changes /retro now runs 2 tests instead of 31. Use bun run test:e2e:all to force everything.
• bun run eval:select previews which tests would run. See exactly which tests your diff triggers before spending API credits. Supports --json for scripting and --base <branch> to override the base branch.
• Completeness guardrail catches forgotten test entries. A free unit test validates that every testName in the E2E and LLM-judge test files has a corresponding entry in the TOUCHFILES map. New tests without entries fail bun test immediately — no silent always-run degradation.

Changed

• test:evals and test:e2e now auto-select based on diff (was: all-or-nothing)
• New test:evals:all and test:e2e:all scripts for explicit full runs

0.6.1 — 2026-03-17 — Boil the Lake

Every skystack skill now follows the Completeness Principle: always recommend the full implementation when AI makes the marginal cost near-zero. No more "Choose B because it's 90% of the value" when option A is 70 lines more code.

• Completeness scoring: every AskUserQuestion option now shows a completeness score (1-10), biasing toward the complete solution
• Dual time estimates: effort estimates show both human-team and CC+skystack time (e.g., "human: ~2 weeks / CC: ~1 hour") with a task-type compression reference table
• Anti-pattern examples: concrete "don't do this" gallery in the preamble so the principle isn't abstract
• First-time onboarding: new users see a one-time introduction linking to the essay, with option to open in browser
• Review completeness gaps: /review now flags shortcut implementations where the complete version costs <30 min CC time
• Lake Score: CEO and Eng review completion summaries show how many recommendations chose the complete option vs shortcuts
• CEO + Eng review dual-time: temporal interrogation, effort estimates, and delight opportunities all show both human and CC time scales

0.6.0.1 — 2026-03-17

• /skystack-upgrade now catches stale vendored copies automatically. If your global skystack is up to date but the vendored copy in your project is behind, /skystack-upgrade detects the mismatch and syncs it. No more manually asking "did we vendor it?" — it just tells you and offers to update.
• Upgrade sync is safer. If ./setup fails while syncing a vendored copy, skystack restores the previous version from backup instead of leaving a broken install.

For contributors

• Standalone usage section in skystack-upgrade/SKILL.md.tmpl now references Steps 2 and 4.5 (DRY) instead of duplicating detection/sync bash blocks. Added one new version-comparison bash block.
• Update check fallback in standalone mode now matches the preamble pattern (global path → local path → || true).

0.6.0 — 2026-03-17

• 100% test coverage is the key to great vibe coding. skystack now bootstraps test frameworks from scratch when your project doesn't have one. Detects your runtime, researches the best framework, asks you to pick, installs it, writes 3-5 real tests for your actual code, sets up CI/CD (GitHub Actions), creates TESTING.md, and adds test culture instructions to CLAUDE.md. Every Claude Code session after that writes tests naturally.
• Every bug fix now gets a regression test. When /qa fixes a bug and verifies it, Phase 8e.5 automatically generates a regression test that catches the exact scenario that broke. Tests include full attribution tracing back to the QA report. Auto-incrementing filenames prevent collisions across sessions.
• Ship with confidence — coverage audit shows what's tested and what's not. /ship Step 3.4 builds a code path map from your diff, searches for corresponding tests, and produces an ASCII coverage diagram with quality stars (★★★ = edge cases + errors, ★★ = happy path, ★ = smoke test). Gaps get tests auto-generated. PR body shows "Tests: 42 → 47 (+5 new)".
• Your retro tracks test health. /retro now shows total test files, tests added this period, regression test commits, and trend deltas. If test ratio drops below 20%, it flags it as a growth area.
• Design reviews generate regression tests too. /qa-design-review Phase 8e.5 skips CSS-only fixes (those are caught by re-running the design audit) but writes tests for JavaScript behavior changes like broken dropdowns or animation failures.

For contributors

• Added generateTestBootstrap() resolver to gen-skill-docs.ts (~155 lines). Registered as {{TEST_BOOTSTRAP}} in the RESOLVERS map. Inserted into qa, ship (Step 2.5), and qa-design-review templates.
• Phase 8e.5 regression test generation added to qa/SKILL.md.tmpl (46 lines) and CSS-aware variant to qa-design-review/SKILL.md.tmpl (12 lines). Rule 13 amended to allow creating new test files.
• Step 3.4 test coverage audit added to ship/SKILL.md.tmpl (88 lines) with quality scoring rubric and ASCII diagram format.
• Test health tracking added to retro/SKILL.md.tmpl: 3 new data gathering commands, metrics row, narrative section, JSON schema field.
• qa-only/SKILL.md.tmpl gets recommendation note when no test framework detected.
• qa-report-template.md gains Regression Tests section with deferred test specs.
• ARCHITECTURE.md placeholder table updated with {{TEST_BOOTSTRAP}} and {{REVIEW_DASHBOARD}}.
• WebSearch added to allowed-tools for qa, ship, qa-design-review.
• 26 new validation tests, 2 new E2E evals (bootstrap + coverage audit).
• 2 new P3 TODOs: CI/CD for non-GitHub providers, auto-upgrade weak tests.

0.5.4 — 2026-03-17

• Engineering review is always the full review now. /plan-eng-review no longer asks you to choose between "big change" and "small change" modes. Every plan gets the full interactive walkthrough (architecture, code quality, tests, performance). Scope reduction is only suggested when the complexity check actually triggers — not as a standing menu option.
• Ship stops asking about reviews once you've answered. When /ship asks about missing reviews and you say "ship anyway" or "not relevant," that decision is saved for the branch. No more getting re-asked every time you re-run /ship after a pre-landing fix.

For contributors

• Removed SMALL_CHANGE / BIG_CHANGE / SCOPE_REDUCTION menu from plan-eng-review/SKILL.md.tmpl. Scope reduction is now proactive (triggered by complexity check) rather than a menu item.
• Added review gate override persistence to ship/SKILL.md.tmpl — writes ship-review-override entries to $BRANCH-reviews.jsonl so subsequent /ship runs skip the gate.
• Updated 2 E2E test prompts to match new flow.

0.5.3 — 2026-03-17

• You're always in control — even when dreaming big. /plan-ceo-review now presents every scope expansion as an individual decision you opt into. EXPANSION mode recommends enthusiastically, but you say yes or no to each idea. No more "the agent went wild and added 5 features I didn't ask for."

• New mode: SELECTIVE EXPANSION. Hold your current scope as the baseline, but see what else is possible. The agent surfaces expansion opportunities one by one with neutral recommendations — you cherry-pick the ones worth doing. Perfect for iterating on existing features where you want rigor but also want to be tempted by adjacent improvements.

• Your CEO review visions are saved, not lost. Expansion ideas, cherry-pick decisions, and 10x visions are now persisted to ~/.skystack/projects/{repo}/ceo-plans/ as structured design documents. Stale plans get archived automatically. If a vision is exceptional, you can promote it to docs/designs/ in your repo for the team.

• Smarter ship gates. /ship no longer nags you about CEO and Design reviews when they're not relevant. Eng Review is the only required gate (and you can disable even that with skystack-config set skip_eng_review true). CEO Review is recommended for big product changes; Design Review for UI work. The dashboard still shows all three — it just won't block you for the optional ones.

For contributors

• Added SELECTIVE EXPANSION mode to plan-ceo-review/SKILL.md.tmpl with cherry-pick ceremony, neutral recommendation posture, and HOLD SCOPE baseline.
• Rewrote EXPANSION mode's Step 0D to include opt-in ceremony — distill vision into discrete proposals, present each as AskUserQuestion.
• Added CEO plan persistence (0D-POST step): structured markdown with YAML frontmatter (status: ACTIVE/ARCHIVED/PROMOTED), scope decisions table, archival flow.
• Added docs/designs promotion step after Review Log.
• Mode Quick Reference table expanded to 4 columns.
• Review Readiness Dashboard: Eng Review required (overridable via skip_eng_review config), CEO/Design optional with agent judgment.
• New tests: CEO review mode validation (4 modes, persistence, promotion), SELECTIVE EXPANSION E2E test.

0.5.2 — 2026-03-17

• Your design consultant now takes creative risks. /design-consultation doesn't just propose a safe, coherent system — it explicitly breaks down SAFE CHOICES (category baseline) vs. RISKS (where your product stands out). You pick which rules to break. Every risk comes with a rationale for why it works and what it costs.
• See the landscape before you choose. When you opt into research, the agent browses real sites in your space with screenshots and accessibility tree analysis — not just web search results. You see what's out there before making design decisions.
• Preview pages that look like your product. The preview page now renders realistic product mockups — dashboards with sidebar nav and data tables, marketing pages with hero sections, settings pages with forms — not just font swatches and color palettes.

0.5.1 — 2026-03-17

• Know where you stand before you ship. Every /plan-ceo-review, /plan-eng-review, and /plan-design-review now logs its result to a review tracker. At the end of each review, you see a Review Readiness Dashboard showing which reviews are done, when they ran, and whether they're clean — with a clear CLEARED TO SHIP or NOT READY verdict.
• /ship checks your reviews before creating the PR. Pre-flight now reads the dashboard and asks if you want to continue when reviews are missing. Informational only — it won't block you, but you'll know what you skipped.
• One less thing to copy-paste. The SLUG computation (that opaque sed pipeline for computing owner-repo from git remote) is now a shared bin/skystack-slug helper. All 14 inline copies across templates replaced with eval $(skystack-slug). If the format ever changes, fix it once.
• Screenshots are now visible during QA and browse sessions. When skystack takes screenshots, they now show up as clickable image elements in your output — no more invisible /tmp/browse-screenshot.png paths you can't see. Works in /qa, /qa-only, /plan-design-review, /qa-design-review, /browse, and /skystack.

For contributors

• Added {{REVIEW_DASHBOARD}} resolver to gen-skill-docs.ts — shared dashboard reader injected into 4 templates (3 review skills + ship).
• Added bin/skystack-slug helper (5-line bash) with unit tests. Outputs SLUG= and BRANCH= lines, sanitizes / to -.
• New TODOs: smart review relevance detection (P3), /merge skill for review-gated PR merge (P2).

0.5.0 — 2026-03-16

• Your site just got a design review. /plan-design-review opens your site and reviews it like a senior product designer — typography, spacing, hierarchy, color, responsive, interactions, and AI slop detection. Get letter grades (A-F) per category, a dual headline "Design Score" + "AI Slop Score", and a structured first impression that doesn't pull punches.
• It can fix what it finds, too. /qa-design-review runs the same designer's eye audit, then iteratively fixes design issues in your source code with atomic style(design): commits and before/after screenshots. CSS-safe by default, with a stricter self-regulation heuristic tuned for styling changes.
• Know your actual design system. Both skills extract your live site's fonts, colors, heading scale, and spacing patterns via JS — then offer to save the inferred system as a DESIGN.md baseline. Finally know how many fonts you're actually using.
• AI Slop detection is a headline metric. Every report opens with two scores: Design Score and AI Slop Score. The AI slop checklist catches the 10 most recognizable AI-generated patterns — the 3-column feature grid, purple gradients, decorative blobs, emoji bullets, generic hero copy.
• Design regression tracking. Reports write a design-baseline.json. Next run auto-compares: per-category grade deltas, new findings, resolved findings. Watch your design score improve over time.
• 80-item design audit checklist across 10 categories: visual hierarchy, typography, color/contrast, spacing/layout, interaction states, responsive, motion, content/microcopy, AI slop, and performance-as-design. Distilled from Vercel's 100+ rules, Anthropic's frontend design skill, and 6 other design frameworks.

For contributors

• Added {{DESIGN_METHODOLOGY}} resolver to gen-skill-docs.ts — shared design audit methodology injected into both /plan-design-review and /qa-design-review templates, following the {{QA_METHODOLOGY}} pattern.
• Added ~/.skystack-dev/plans/ as a local plans directory for long-range vision docs (not checked in). CLAUDE.md and TODOS.md updated.
• Added /setup-design-md to TODOS.md (P2) for interactive DESIGN.md creation from scratch.

0.4.5 — 2026-03-16

• Review findings now actually get fixed, not just listed. /review and /ship used to print informational findings (dead code, test gaps, N+1 queries) and then ignore them. Now every finding gets action: obvious mechanical fixes are applied automatically, and genuinely ambiguous issues are batched into a single question instead of 8 separate prompts. You see [AUTO-FIXED] file:line Problem → what was done for each auto-fix.
• You control the line between "just fix it" and "ask me first." Dead code, stale comments, N+1 queries get auto-fixed. Security issues, race conditions, design decisions get surfaced for your call. The classification lives in one place (review/checklist.md) so both /review and /ship stay in sync.

Fixed

• $B js "const x = await fetch(...); return x.status" now works. The js command used to wrap everything as an expression — so const, semicolons, and multi-line code all broke. It now detects statements and uses a block wrapper, just like eval already did.
• Clicking a dropdown option no longer hangs forever. If an agent sees @e3 [option] "Admin" in a snapshot and runs click @e3, skystack now auto-selects that option instead of hanging on an impossible Playwright click. The right thing just happens.
• When click is the wrong tool, skystack tells you. Clicking an <option> via CSS selector used to time out with a cryptic Playwright error. Now you get: "Use 'browse select' instead of 'click' for dropdown options."

For contributors

• Gate Classification → Severity Classification rename (severity determines presentation order, not whether you see a prompt).
• Fix-First Heuristic section added to review/checklist.md — the canonical AUTO-FIX vs ASK classification.
• New validation test: Fix-First Heuristic exists in checklist and is referenced by review + ship.
• Extracted needsBlockWrapper() and wrapForEvaluate() helpers in read-commands.ts — shared by both js and eval commands (DRY).
• Added getRefRole() to BrowserManager — exposes ARIA role for ref selectors without changing resolveRef return type.
• Click handler auto-routes [role=option] refs to selectOption() via parent <select>, with DOM tagName check to avoid blocking custom listbox components.
• 6 new tests: multi-line js, semicolons, statement keywords, simple expressions, option auto-routing, CSS option error guidance.

0.4.4 — 2026-03-16

• New releases detected in under an hour, not half a day. The update check cache was set to 12 hours, which meant you could be stuck on an old version all day while new releases dropped. Now "you're up to date" expires after 60 minutes, so you'll see upgrades within the hour. "Upgrade available" still nags for 12 hours (that's the point).
• /skystack-upgrade always checks for real. Running /skystack-upgrade directly now bypasses the cache and does a fresh check against GitHub. No more "you're already on the latest" when you're not.

For contributors

• Split last-update-check cache TTL: 60 min for UP_TO_DATE, 720 min for UPGRADE_AVAILABLE.
• Added --force flag to bin/skystack-update-check (deletes cache file before checking).
• 3 new tests: --force busts UP_TO_DATE cache, --force busts UPGRADE_AVAILABLE cache, 60-min TTL boundary test with utimesSync.

0.4.3 — 2026-03-16

• New /document-release skill. Run it after /ship but before merging — it reads every doc file in your project, cross-references the diff, and updates README, ARCHITECTURE, CONTRIBUTING, CHANGELOG, and TODOS to match what you actually shipped. Risky changes get surfaced as questions; everything else is automatic.
• Every question is now crystal clear, every time. You used to need 3+ sessions running before skystack would give you full context and plain English explanations. Now every question — even in a single session — tells you the project, branch, and what's happening, explained simply enough to understand mid-context-switch. No more "sorry, explain it to me more simply."
• Branch name is always correct. skystack now detects your current branch at runtime instead of relying on the snapshot from when the conversation started. Switch branches mid-session? skystack keeps up.

For contributors

• Merged ELI16 rules into base AskUserQuestion format — one format instead of two, no _SESSIONS >= 3 conditional.
• Added _BRANCH detection to preamble bash block (git branch --show-current with fallback).
• Added regression guard tests for branch detection and simplification rules.

0.4.2 — 2026-03-16

• $B js "await fetch(...)" now just works. Any await expression in $B js or $B eval is automatically wrapped in an async context. No more SyntaxError: await is only valid in async functions. Single-line eval files return values directly; multi-line files use explicit return.
• Contributor mode now reflects, not just reacts. Instead of only filing reports when something breaks, contributor mode now prompts periodic reflection: "Rate your skystack experience 0-10. Not a 10? Think about why." Catches quality-of-life issues and friction that passive detection misses. Reports now include a 0-10 rating and "What would make this a 10" to focus on actionable improvements.
• Skills now respect your branch target. /ship, /review, /qa, and /plan-ceo-review detect which branch your PR actually targets instead of assuming main. Stacked branches, Conductor workspaces targeting feature branches, and repos using master all just work now.
• /retro works on any default branch. Repos using master, develop, or other default branch names are detected automatically — no more empty retros because the branch name was wrong.
• New {{BASE_BRANCH_DETECT}} placeholder for skill authors — drop it into any template and get 3-step branch detection (PR base → repo default → fallback) for free.
• 3 new E2E smoke tests validate base branch detection works end-to-end across ship, review, and retro skills.

For contributors

• Added hasAwait() helper with comment-stripping to avoid false positives on // await in eval files.
• Smart eval wrapping: single-line → expression (...), multi-line → block {...} with explicit return.
• 6 new async wrapping unit tests, 40 new contributor mode preamble validation tests.
• Calibration example framed as historical ("used to fail") to avoid implying a live bug post-fix.
• Added "Writing SKILL templates" section to CLAUDE.md — rules for natural language over bash-isms, dynamic branch detection, self-contained code blocks.
• Hardcoded-main regression test scans all .tmpl files for git commands with hardcoded main.
• QA template cleaned up: removed REPORT_DIR shell variable, simplified port detection to prose.
• skystack-upgrade template: explicit cross-step prose for variable references between bash blocks.

0.4.1 — 2026-03-16

• skystack now notices when it screws up. Turn on contributor mode (skystack-config set skystack_contributor true) and skystack automatically writes up what went wrong — what you were doing, what broke, repro steps. Next time something annoys you, the bug report is already written. Fork skystack and fix it yourself.
• Juggling multiple sessions? skystack keeps up. When you have 3+ skystack windows open, every question now tells you which project, which branch, and what you were working on. No more staring at a question thinking "wait, which window is this?"
• Every question now comes with a recommendation. Instead of dumping options on you and making you think, skystack tells you what it would pick and why. Same clear format across every skill.
• /review now catches forgotten enum handlers. Add a new status, tier, or type constant? /review traces it through every switch statement, allowlist, and filter in your codebase — not just the files you changed. Catches the "added the value but forgot to handle it" class of bugs before they ship.

For contributors

• Renamed {{UPDATE_CHECK}} to {{PREAMBLE}} across all 11 skill templates — one startup block now handles update check, session tracking, contributor mode, and question formatting.
• DRY'd plan-ceo-review and plan-eng-review question formatting to reference the preamble baseline instead of duplicating rules.
• Added CHANGELOG style guide and vendored symlink awareness docs to CLAUDE.md.

0.4.0 — 2026-03-16

Added

• QA-only skill (/qa-only) — report-only QA mode that finds and documents bugs without making fixes. Hand off a clean bug report to your team without the agent touching your code.
• QA fix loop — /qa now runs a find-fix-verify cycle: discover bugs, fix them, commit, re-navigate to confirm the fix took. One command to go from broken to shipped.
• Plan-to-QA artifact flow — /plan-eng-review writes test-plan artifacts that /qa picks up automatically. Your engineering review now feeds directly into QA testing with no manual copy-paste.
• {{QA_METHODOLOGY}} DRY placeholder — shared QA methodology block injected into both /qa and /qa-only templates. Keeps both skills in sync when you update testing standards.
• Eval efficiency metrics — turns, duration, and cost now displayed across all eval surfaces with natural-language Takeaway commentary. See at a glance whether your prompt changes made the agent faster or slower.
• generateCommentary() engine — interprets comparison deltas so you don't have to: flags regressions, notes improvements, and produces an overall efficiency summary.
• Eval list columns — bun run eval:list now shows Turns and Duration per run. Spot expensive or slow runs instantly.
• Eval summary per-test efficiency — bun run eval:summary shows average turns/duration/cost per test across runs. Identify which tests are costing you the most over time.
• judgePassed() unit tests — extracted and tested the pass/fail judgment logic.
• 3 new E2E tests — qa-only no-fix guardrail, qa fix loop with commit verification, plan-eng-review test-plan artifact.
• Browser ref staleness detection — resolveRef() now checks element count to detect stale refs after page mutations. SPA navigation no longer causes 30-second timeouts on missing elements.
• 3 new snapshot tests for ref staleness.

Changed

• QA skill prompt restructured with explicit two-cycle workflow (find → fix → verify).
• formatComparison() now shows per-test turns and duration deltas alongside cost.
• printSummary() shows turns and duration columns.
• eval-store.test.ts fixed pre-existing _partial file assertion bug.

Fixed

• Browser ref staleness — refs collected before page mutation (e.g. SPA navigation) are now detected and re-collected. Eliminates a class of flaky QA failures on dynamic sites.

0.3.9 — 2026-03-15

Added

• bin/skystack-config CLI — simple get/set/list interface for ~/.skystack/config.yaml. Used by update-check and upgrade skill for persistent settings (auto_upgrade, update_check).
• Smart update check — 12h cache TTL (was 24h), exponential snooze backoff (24h → 48h → 1 week) when user declines upgrades, update_check: false config option to disable checks entirely. Snooze resets when a new version is released.
• Auto-upgrade mode — set auto_upgrade: true in config or GSTACK_AUTO_UPGRADE=1 env var to skip the upgrade prompt and update automatically.
• 4-option upgrade prompt — "Yes, upgrade now", "Always keep me up to date", "Not now" (snooze), "Never ask again" (disable).
• Vendored copy sync — /skystack-upgrade now detects and updates local vendored copies in the current project after upgrading the primary install.
• 25 new tests: 11 for skystack-config CLI, 14 for snooze/config paths in update-check.

Changed

• README upgrade/troubleshooting sections simplified to reference /skystack-upgrade instead of long paste commands.
• Upgrade skill template bumped to v1.1.0 with Write tool permission for config editing.
• All SKILL.md preambles updated with new upgrade flow description.

0.3.8 — 2026-03-14

Added

• TODOS.md as single source of truth — merged TODO.md (roadmap) and TODOS.md (near-term) into one file organized by skill/component with P0-P4 priority ordering and a Completed section.
• /ship Step 5.5: TODOS.md management — auto-detects completed items from the diff, marks them done with version annotations, offers to create/reorganize TODOS.md if missing or unstructured.
• Cross-skill TODOS awareness — /plan-ceo-review, /plan-eng-review, /retro, /review, and /qa now read TODOS.md for project context. /retro adds Backlog Health metric (open counts, P0/P1 items, churn).
• Shared review/TODOS-format.md — canonical TODO item format referenced by /ship and /plan-ceo-review to prevent format drift (DRY).
• Greptile 2-tier reply system — Tier 1 (friendly, inline diff + explanation) for first responses; Tier 2 (firm, full evidence chain + re-rank request) when Greptile re-flags after a prior reply.
• Greptile reply templates — structured templates in greptile-triage.md for fixes (inline diff), already-fixed (what was done), and false positives (evidence + suggested re-rank). Replaces vague one-line replies.
• Greptile escalation detection — explicit algorithm to detect prior GStack replies on comment threads and auto-escalate to Tier 2.
• Greptile severity re-ranking — replies now include **Suggested re-rank:** when Greptile miscategorizes issue severity.
• Static validation tests for TODOS-format.md references across skills.

Fixed

• .gitignore append failures silently swallowed — ensureStateDir() bare catch {} replaced with ENOENT-only silence; non-ENOENT errors (EACCES, ENOSPC) logged to .skystack/browse-server.log.

Changed

• TODO.md deleted — all items merged into TODOS.md.
• /ship Step 3.75 and /review Step 5 now reference reply templates and escalation detection from greptile-triage.md.
• /ship Step 6 commit ordering includes TODOS.md in the final commit alongside VERSION + CHANGELOG.
• /ship Step 8 PR body includes TODOS section.

0.3.7 — 2026-03-14

Added

• Screenshot element/region clipping — screenshot command now supports element crop via CSS selector or @ref (screenshot "#hero" out.png, screenshot @e3 out.png), region clip (screenshot --clip x,y,w,h out.png), and viewport-only mode (screenshot --viewport out.png). Uses Playwright's native locator.screenshot() and page.screenshot({ clip }). Full page remains the default.
• 10 new tests covering all screenshot modes (viewport, CSS, @ref, clip) and error paths (unknown flag, mutual exclusion, invalid coords, path validation, nonexistent selector).

0.3.6 — 2026-03-14

Added

• E2E observability — heartbeat file (~/.skystack-dev/e2e-live.json), per-run log directory (~/.skystack-dev/e2e-runs/{runId}/), progress.log, per-test NDJSON transcripts, persistent failure transcripts. All I/O non-fatal.
• bun run eval:watch — live terminal dashboard reads heartbeat + partial eval file every 1s. Shows completed tests, current test with turn/tool info, stale detection (>10min), --tail for progress.log.
• Incremental eval saves — savePartial() writes _partial-e2e.json after each test completes. Crash-resilient: partial results survive killed runs. Never cleaned up.
• Machine-readable diagnostics — exit_reason, timeout_at_turn, last_tool_call fields in eval JSON. Enables jq queries for automated fix loops.
• API connectivity pre-check — E2E suite throws immediately on ConnectionRefused before burning test budget.
• is_error detection — claude -p can return subtype: "success" with is_error: true on API failures. Now correctly classified as error_api.
• Stream-json NDJSON parser — parseNDJSON() pure function for real-time E2E progress from claude -p --output-format stream-json --verbose.
• Eval persistence — results saved to ~/.skystack-dev/evals/ with auto-comparison against previous run.
• Eval CLI tools — eval:list, eval:compare, eval:summary for inspecting eval history.
• All 9 skills converted to .tmpl templates — plan-ceo-review, plan-eng-review, retro, review, ship now use {{UPDATE_CHECK}} placeholder. Single source of truth for update check preamble.
• 3-tier eval suite — Tier 1: static validation (free), Tier 2: E2E via claude -p ($3.85/run), Tier 3: LLM-as-judge ($0.15/run). Gated by EVALS=1.
• Planted-bug outcome testing — eval fixtures with known bugs, LLM judge scores detection.
• 15 observability unit tests covering heartbeat schema, progress.log format, NDJSON naming, savePartial, finalize, watcher rendering, stale detection, non-fatal I/O.
• E2E tests for plan-ceo-review, plan-eng-review, retro skills.
• Update-check exit code regression tests.
• test/helpers/skill-parser.ts — getRemoteSlug() for git remote detection.

Fixed

• Browse binary discovery broken for agents — replaced find-browse indirection with explicit browse/dist/browse path in SKILL.md setup blocks.
• Update check exit code 1 misleading agents — added || true to prevent non-zero exit when no update available.
• browse/SKILL.md missing setup block — added {{BROWSE_SETUP}} placeholder.
• plan-ceo-review timeout — init git repo in test dir, skip codebase exploration, bump timeout to 420s.
• Planted-bug eval reliability — simplified prompts, lowered detection baselines, resilient to max_turns flakes.

Changed

• Template system expanded — {{UPDATE_CHECK}} and {{BROWSE_SETUP}} placeholders in gen-skill-docs.ts. All browse-using skills generate from single source of truth.
• Enriched 14 command descriptions with specific arg formats, valid values, error behavior, and return types.
• Setup block checks workspace-local path first (for development), falls back to global install.
• LLM eval judge upgraded from Haiku to Sonnet 4.6.
• generateHelpText() auto-generated from COMMAND_DESCRIPTIONS (replaces hand-maintained help text).

0.3.3 — 2026-03-13

Added

• SKILL.md template system — .tmpl files with {{COMMAND_REFERENCE}} and {{SNAPSHOT_FLAGS}} placeholders, auto-generated from source code at build time. Structurally prevents command drift between docs and code.
• Command registry (browse/src/commands.ts) — single source of truth for all browse commands with categories and enriched descriptions. Zero side effects, safe to import from build scripts and tests.
• Snapshot flags metadata (SNAPSHOT_FLAGS array in browse/src/snapshot.ts) — metadata-driven parser replaces hand-coded switch/case. Adding a flag in one place updates the parser, docs, and tests.
• Tier 1 static validation — 43 tests: parses $B commands from SKILL.md code blocks, validates against command registry and snapshot flag metadata
• Tier 2 E2E tests via Agent SDK — spawns real Claude sessions, runs skills, scans for browse errors. Gated by SKILL_E2E=1 env var (~$0.50/run)
• Tier 3 LLM-as-judge evals — Haiku scores generated docs on clarity/completeness/actionability (threshold ≥4/5), plus regression test vs hand-maintained baseline. Gated by ANTHROPIC_API_KEY
• bun run skill:check — health dashboard showing all skills, command counts, validation status, template freshness
• bun run dev:skill — watch mode that regenerates and validates SKILL.md on every template or source file change
• CI workflow (.github/workflows/skill-docs.yml) — runs gen:skill-docs on push/PR, fails if generated output differs from committed files
• bun run gen:skill-docs script for manual regeneration
• bun run test:eval for LLM-as-judge evals
• test/helpers/skill-parser.ts — extracts and validates $B commands from Markdown
• test/helpers/session-runner.ts — Agent SDK wrapper with error pattern scanning and transcript saving
• ARCHITECTURE.md — design decisions document covering daemon model, security, ref system, logging, crash recovery
• Conductor integration (conductor.json) — lifecycle hooks for workspace setup/teardown
• .env propagation — bin/dev-setup copies .env from main worktree into Conductor workspaces automatically
• .env.example template for API key configuration

Changed

• Build now runs gen:skill-docs before compiling binaries
• parseSnapshotArgs is metadata-driven (iterates SNAPSHOT_FLAGS instead of switch/case)
• server.ts imports command sets from commands.ts instead of declaring inline
• SKILL.md and browse/SKILL.md are now generated files (edit the .tmpl instead)

0.3.2 — 2026-03-13

Fixed

• Cookie import picker now returns JSON instead of HTML — jsonResponse() referenced url out of scope, crashing every API call
• help command routed correctly (was unreachable due to META_COMMANDS dispatch ordering)
• Stale servers from global install no longer shadow local changes — removed legacy ~/.claude/skills/skystack fallback from resolveServerScript()
• Crash log path references updated from /tmp/ to .skystack/

Added

• Diff-aware QA mode — /qa on a feature branch auto-analyzes git diff, identifies affected pages/routes, detects the running app on localhost, and tests only what changed. No URL needed.
• Project-local browse state — state file, logs, and all server state now live in .skystack/ inside the project root (detected via git rev-parse --show-toplevel). No more /tmp state files.
• Shared config module (browse/src/config.ts) — centralizes path resolution for CLI and server, eliminates duplicated port/state logic
• Random port selection — server picks a random port 10000-60000 instead of scanning 9400-9409. No more CONDUCTOR_PORT magic offset. No more port collisions across workspaces.
• Binary version tracking — state file includes binaryVersion SHA; CLI auto-restarts the server when the binary is rebuilt
• Legacy /tmp cleanup — CLI scans for and removes old /tmp/browse-server*.json files, verifying PID ownership before sending signals
• Greptile integration — /review and /ship fetch and triage Greptile bot comments; /retro tracks Greptile batting average across weeks
• Local dev mode — bin/dev-setup symlinks skills from the repo for in-place development; bin/dev-teardown restores global install
• help command — agents can self-discover all commands and snapshot flags
• Version-aware find-browse with META signal protocol — detects stale binaries and prompts agents to update
• browse/dist/find-browse compiled binary with git SHA comparison against origin/main (4hr cached)
• .version file written at build time for binary version tracking
• Route-level tests for cookie picker (13 tests) and find-browse version check (10 tests)
• Config resolution tests (14 tests) covering git root detection, BROWSE_STATE_FILE override, ensureStateDir, readVersionHash, resolveServerScript, and version mismatch detection
• Browser interaction guidance in CLAUDE.md — prevents Claude from using mcp__claude-in-chrome__* tools
• CONTRIBUTING.md with quick start, dev mode explanation, and instructions for testing branches in other repos

Changed

• State file location: .skystack/browse.json (was /tmp/browse-server.json)
• Log files location: .skystack/browse-{console,network,dialog}.log (was /tmp/browse-*.log)
• Atomic state file writes: .json.tmp → rename (prevents partial reads)
• CLI passes BROWSE_STATE_FILE to spawned server (server derives all paths from it)
• SKILL.md setup checks parse META signals and handle META:UPDATE_AVAILABLE
• /qa SKILL.md now describes four modes (diff-aware, full, quick, regression) with diff-aware as the default on feature branches
• jsonResponse/errorResponse use options objects to prevent positional parameter confusion
• Build script compiles both browse and find-browse binaries, cleans up .bun-build temp files
• README updated with Greptile setup instructions, diff-aware QA examples, and revised demo transcript

Removed

• CONDUCTOR_PORT magic offset (browse_port = CONDUCTOR_PORT - 45600)
• Port scan range 9400-9409
• Legacy fallback to ~/.claude/skills/skystack/browse/src/server.ts
• DEVELOPING_GSTACK.md (renamed to CONTRIBUTING.md)

0.3.1 — 2026-03-12

Phase 3.5: Browser cookie import

• cookie-import-browser command — decrypt and import cookies from real Chromium browsers (Comet, Chrome, Arc, Brave, Edge)
• Interactive cookie picker web UI served from the browse server (dark theme, two-panel layout, domain search, import/remove)
• Direct CLI import with --domain flag for non-interactive use
• /setup-browser-cookies skill for Claude Code integration
• macOS Keychain access with async 10s timeout (no event loop blocking)
• Per-browser AES key caching (one Keychain prompt per browser per session)
• DB lock fallback: copies locked cookie DB to /tmp for safe reads
• 18 unit tests with encrypted cookie fixtures

0.3.0 — 2026-03-12

Phase 3: /qa skill — systematic QA testing

• New /qa skill with 6-phase workflow (Initialize, Authenticate, Orient, Explore, Document, Wrap up)
• Three modes: full (systematic, 5-10 issues), quick (30-second smoke test), regression (compare against baseline)
• Issue taxonomy: 7 categories, 4 severity levels, per-page exploration checklist
• Structured report template with health score (0-100, weighted across 7 categories)
• Framework detection guidance for Next.js, Rails, WordPress, and SPAs
• browse/bin/find-browse — DRY binary discovery using git rev-parse --show-toplevel

Phase 2: Enhanced browser

• Dialog handling: auto-accept/dismiss, dialog buffer, prompt text support
• File upload: upload <sel> <file1> [file2...]
• Element state checks: is visible|hidden|enabled|disabled|checked|editable|focused <sel>
• Annotated screenshots with ref labels overlaid (snapshot -a)
• Snapshot diffing against previous snapshot (snapshot -D)
• Cursor-interactive element scan for non-ARIA clickables (snapshot -C)
• wait --networkidle / --load / --domcontentloaded flags
• console --errors filter (error + warning only)
• cookie-import <json-file> with auto-fill domain from page URL
• CircularBuffer O(1) ring buffer for console/network/dialog buffers
• Async buffer flush with Bun.write()
• Health check with page.evaluate + 2s timeout
• Playwright error wrapping — actionable messages for AI agents
• Context recreation preserves cookies/storage/URLs (useragent fix)
• SKILL.md rewritten as QA-oriented playbook with 10 workflow patterns
• 166 integration tests (was ~63)

0.0.2 — 2026-03-12

• Fix project-local /browse installs — compiled binary now resolves server.ts from its own directory instead of assuming a global install exists
• setup rebuilds stale binaries (not just missing ones) and exits non-zero if the build fails
• Fix chain command swallowing real errors from write commands (e.g. navigation timeout reported as "Unknown meta command")
• Fix unbounded restart loop in CLI when server crashes repeatedly on the same command
• Cap console/network buffers at 50k entries (ring buffer) instead of growing without bound
• Fix disk flush stopping silently after buffer hits the 50k cap
• Fix ln -snf in setup to avoid creating nested symlinks on upgrade
• Use git fetch && git reset --hard instead of git pull for upgrades (handles force-pushes)
• Simplify install: global-first with optional project copy (replaces submodule approach)
• Restructured README: hero, before/after, demo transcript, troubleshooting section
• Six skills (added /retro)

0.0.1 — 2026-03-11

Initial release.

• Five skills: /plan-ceo-review, /plan-eng-review, /review, /ship, /browse
• Headless browser CLI with 40+ commands, ref-based interaction, persistent Chromium daemon
• One-command install as Claude Code skills (submodule or global clone)
• setup script for binary compilation and skill symlinking