gstack — Ship Like a Team of Twenty

YC-style forcing questions before you write a line of code. Pushes back on your framing, challenges premises, explores alternatives, and writes a design doc that feeds every downstream skill.

Founder-mode plan review. Finds the 10-star product hiding in your request, challenges scope, and pushes the plan toward maximum ambition or maximum focus — your choice.

Eng manager-mode plan review. Locks in architecture, data flow diagrams, edge cases, test coverage, and failure modes before any code is written.

Designer's eye review of a plan before implementation. Rates each design dimension 0–10, explains what a 10 looks like, then edits the plan to get there.

Runs CEO, design, and engineering reviews sequentially with auto-decisions using 6 built-in principles. Surfaces only the taste decisions that need your input. One command, fully reviewed plan.

Staff engineer-level PR review. Finds bugs that pass CI but blow up in production — SQL safety, LLM trust boundaries, conditional side effects, race conditions. Auto-fixes the obvious ones.

Systematic root-cause debugging with four phases: investigate, analyze, hypothesize, implement. Iron Law: no fixes without root cause. Stops after 3 failed hypotheses and escalates.

Opens a real Chromium browser and tests your app the way a user would. Finds bugs, fixes them with atomic commits, generates regression tests for every fix, and gives you a before/after health score.

Same real-browser methodology as /qa but produces a structured bug report with health score and repro steps without making any code changes. Pure signal, no side effects.

Gives Claude a real Chromium browser. Navigate URLs, click elements, verify page state, take annotated screenshots, test forms, check responsive layouts — 100ms per command.

Launches your actual Chrome browser controlled by gstack, with a Side Panel extension showing a live activity feed of every action. Watch Claude navigate in real time.

Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD security, OWASP Top 10, and STRIDE threat modelling. Zero noise — 8/10 confidence gate, 17 false positive exclusions. Every finding includes a concrete exploit scenario.

Syncs main, runs tests, audits coverage, bumps VERSION, updates CHANGELOG, pushes the branch, and opens the PR. One command from ready code to open pull request.

Merges the PR, waits for CI to pass, deploys to production, and verifies production health via canary checks. One command from approved PR to verified live deploy.

Watches the live app after a deploy for console errors, performance regressions, and page failures. Takes periodic screenshots, compares against pre-deploy baselines, and alerts on anomalies.

Establishes baselines for page load times, Core Web Vitals, and resource sizes. Compares before/after on every PR and tracks performance trends over time.

Builds a complete design system from scratch — aesthetic direction, typography, color palette, layout, spacing, and motion. Researches your product space, proposes creative risks, and writes DESIGN.md.

Generates multiple visual design variants, opens a browser comparison board, collects structured feedback, and iterates toward an approved direction. Taste memory biases future variants toward your preferences.

Finds visual inconsistency, spacing issues, hierarchy problems, and AI slop patterns on a live site — then fixes them. Commits each fix atomically with before/after screenshots.

Generates production-quality HTML where text actually reflows on resize and heights compute dynamically. Accepts mockups, CEO plans, or design reviews as input. Zero dependencies.

Reads every doc file in your project, cross-references the diff, and updates README, ARCHITECTURE, CONTRIBUTING, CLAUDE.md, and CHANGELOG to match what just shipped.

Weekly engineering retro with persistent history and trend tracking. Per-person breakdowns, commit analysis, test health trends, shipping streaks, and growth opportunities. Works across all your projects.

Independent code review from OpenAI Codex CLI — a completely different AI reviewing the same diff. Three modes: code review with pass/fail gate, adversarial challenge, or open consultation.

Manages what gstack has learned across sessions — project-specific patterns, pitfalls, and preferences. Review, search, prune, and export learnings. Compounds over time.

Saves your current git state, decisions made, and remaining work so you can resume exactly where you left off — even across sessions or workspace handoffs.

Wraps your existing project tools — type checker, linter, test runner, dead code detector, shell linter — into a weighted composite 0–10 health score with trend tracking over time.

Warns before running rm -rf, DROP TABLE, force-push, git reset --hard, kubectl delete, and similar destructive operations. You can override each warning. Scoped to the current session.

Restricts all file edits to a single directory for the session. Blocks Edit and Write operations outside the allowed path — prevents accidentally changing unrelated code while debugging.

Combines /careful (warns before destructive commands) and /freeze (locks edits to one directory) in a single command. Maximum safety for production work or high-stakes debugging.

Clears the directory restriction set by /freeze, allowing edits across all directories again without ending the session.

One-time setup for /land-and-deploy. Detects your deploy platform (Fly.io, Render, Vercel, Netlify, Heroku, GitHub Actions, custom), production URL, and health check endpoints.

Imports cookies from your real Chrome, Arc, Brave, or Edge browser into the headless browse session. Lets Claude test authenticated pages without you having to log in again.

Upgrades gstack to the latest version. Detects whether you have a global or vendored install, syncs both, and shows you what changed.