feat: Phase 3.5 — cookie import, QA testing, team retro (v0.3.1) (#29)

[stoll]

• Phase 2: Enhanced browser — dialog handling, upload, state checks, snapshots

• CircularBuffer O(1) ring buffer for console/network/dialog (was O(n) array+shift)
• Async buffer flush with Bun.write() (was appendFileSync)
• Dialog auto-accept/dismiss with buffer + prompt text support
• File upload command (upload <file...>)
• Element state checks (is visible/hidden/enabled/disabled/checked/editable/focused)
• Annotated screenshots with ref labels overlaid (-a flag)
• Snapshot diffing against previous snapshot (-D flag)
• Cursor-interactive element scan for non-ARIA clickables (-C flag)
• Snapshot scoping depth limit (-d N flag)
• Health check with page.evaluate + 2s timeout
• Playwright error wrapping — actionable messages for AI agents
• Fix useragent — context recreation preserves cookies/storage/URLs
• wait --networkidle / --load / --domcontentloaded flags
• console --errors filter (error + warning only)
• cookie-import with auto-fill domain from page URL
• 166 integration tests (was ~63)

• Phase 2: Rewrite SKILL.md as QA playbook + command reference

Reorient SKILL.md files from raw command reference to QA-first playbook with 10 workflow patterns (test user flows, verify deployments, dogfood features, responsive layouts, file upload, forms, dialogs, compare pages). Compact command reference tables at the bottom.

• Phase 3: /qa skill — systematic QA testing with health scores

New /qa skill for systematic web app QA testing. Three modes:

• full: 5-10 documented issues with screenshots and repro steps
• quick: 30-second smoke test with health score
• regression: compare against saved baseline

Includes issue taxonomy (7 categories, 4 severity levels), structured report template, health score rubric (weighted across 7 categories), framework detection guidance (Next.js, Rails, WordPress, SPA).

Also adds browse/bin/find-browse (DRY binary discovery using git rev-parse), .gstack/ to .gitignore, and updated TODO roadmap.

• Bump to v0.3.0 — Phase 2 + Phase 3 changelog

• feat: cookie-import-browser — Chromium cookie decryption module + tests

Pure logic module for reading and decrypting cookies from macOS Chromium browsers (Comet, Chrome, Arc, Brave, Edge). Supports v10 AES-128-CBC encryption with macOS Keychain access, PBKDF2 key derivation, and per-browser key caching. 18 unit tests with encrypted cookie fixtures.

• feat: cookie picker web UI + route handler

Two-panel dark-theme picker served from the browse server. Left panel shows source browser domains with search and import buttons. Right panel shows imported domains with trash buttons. No cookie values exposed. 6 API endpoints, importedDomains Set tracking, inline clearCookies.

• feat: wire cookie-import-browser into browse server

Add cookie-picker route dispatch (no auth, localhost-only), add cookie-import-browser to WRITE_COMMANDS and CHAIN_WRITE, add serverPort property to BrowserManager, add write command with two modes (picker UI vs --domain direct import), update CLI help text.

• chore: /setup-browser-cookies skill + docs (Phase 3.5)

• chore: bump version and changelog (v0.3.1)

• security: redact sensitive values from command output (PR Security: Redact sensitive values from command output garrytan/gstack#21)

type no longer echoes text (reports character count), cookie redacts value with ****, header redacts Authorization/Cookie/X-API-Key/X-Auth-Token, storage set drops value, forms redacts password fields. Prevents secrets from persisting in LLM transcripts. 7 new tests.

Credit: fredluz (PR garrytan#21)

• security: path traversal prevention for screenshot/pdf/eval (PR fix: path traversal security vulnerability in screenshot/pdf/eval commands garrytan/gstack#26)

Add validateOutputPath() for screenshot/pdf/responsive (restricts to /tmp and cwd) and validateReadPath() for eval (blocks .. sequences and absolute paths outside safe dirs). 7 new tests.

Credit: Jah-yee (PR garrytan#26)

• fix: auto-install Playwright Chromium in setup (PR Fix browse setup when Playwright Chromium is missing garrytan/gstack#22)

Setup now verifies Playwright can launch Chromium, and auto-installs it via bunx playwright install chromium if missing. Exits non-zero if build or Chromium launch fails.

Credit: AkbarDevop (PR garrytan#22)

• security: fix path validation bypass, CORS restriction, cookie-import path check

• startsWith('/tmp') matched '/tmpevil' — now requires trailing slash
• CORS Access-Control-Allow-Origin changed from * to http://127.0.0.1:
• cookie-import now validates file paths (was missing validateReadPath)
• 3 new tests for prefix collision and cookie-import path traversal

• fix: address review informational issues + add regression tests

• Add cookie-import to CHAIN_WRITE set for chain command routing
• Add path validation to snapshot -a -o output path
• Fix package.json version to match 0.3.1
• Use crypto.randomUUID() for temp DB paths (unpredictable filenames)
• Add regression tests for chain cookie-import and snapshot path validation

• docs: add /qa, /setup-browser-cookies to README + update BROWSER.md

• Add /qa and /setup-browser-cookies to skills table, install/update/uninstall blurbs
• Add dedicated README sections for both new skills with usage examples
• Update demo workflow to show cookie import → QA → browse flow
• Update BROWSER.md: cookie import commands, new source files, test count (203)
• Update skill count from 6 to 8

• feat: team-aware /retro v2.0 — per-person praise and growth opportunities

• Identify current user via git config, orient narrative as "you" vs teammates
• Add per-author metrics: commits, LOC, focus areas, commit type mix, sessions
• New "Your Week" section with personal deep-dive for whoever runs the command
• New "Team Breakdown" with per-person praise and growth opportunities
• Track AI-assisted commits via Co-Authored-By trailers
• Personal + team shipping streaks
• Tone: praise like a 1:1, growth like investment advice, never compare negatively

• docs: add Conductor parallel sessions section to README

---