gstack - Moses Yebei

Abstract

Use Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA

The Problem

A single developer with Claude Code gets a blank prompt and ad-hoc habits. No structured roles, no enforced review, no repeatable release process. The result is AI-generated code that ships without design review, QA, or security checks — fast but sloppy. gstack addresses this by turning Claude Code into a virtual engineering organization with defined roles and gates.

What This Does

gstack is a set of 23 Claude Code slash-command "specialists" (CEO, Eng Manager, Designer, QA, Release Manager, Security Officer) plus 8 power tools, all implemented as Markdown skill files and TypeScript CLIs. The bin/ directory holds 82 gstack-* executables covering everything from bin/gstack-verify-gate (CI gates) to bin/gstack-ios-qa-daemon (mobile QA). The browse/ directory (240 files) implements a real browser automation layer via CDP — browse/src/browser-manager.ts, browse/src/cdp-bridge.ts — so QA agents can open actual pages, not mocks. The autoplan/ directory contains the planning pipeline with phase documents (ceo-phase.md, design-phase.md, eng-phase.md).

The README claims the author ships at ~810× their 2013 pace using this tooling, with a methodology doc at docs/ON_THE_LOC_CONTROVERSY.md.

How It Is Wired

Control flow starts in Claude Code, which loads skill files (SKILL.md templates in autoplan/, browse/, design/). Those skills invoke the bin/gstack-* CLI scripts. Three main entry points matter: browse/src/cli.ts (browser automation CLI), browse/src/server.ts (local HTTP server for browser sessions), and design/src/cli.ts (design review). The browser server manages Chrome via CDP, handles cookies, screenshots, and network capture — it touches the filesystem for session persistence (browse/src/session-persist.ts) and the network for CDP traffic.

The wiring is extensive but not yet fully mapped for this briefing. The test/ directory (482 files) and 723 total test files suggest the tooling tests itself heavily. CI runs through both .gitlab-ci.yml and 14 GitHub workflow files covering quality gates, dependency review, and OSV scanning.

How To Use It

Setup requires Claude Code, Git, and Bun v1.0+. From the README:

git clone --single-branch --depth 1 https://github.com/garrytan/gstack

Then inside Claude Code, run /office-hours to describe the project, /plan-ceo-review for feature planning, /review on a branch, and /qa on a staging URL. Configuration lives in .env.example; the bin/gstack-config script manages settings.

Real-World Use

A solo founder building a SaaS product: run /office-hours to define scope, /plan-ceo-review to get architecture decisions, iterate with the engineer role, then run /review before merging. The QA specialist launches a real browser via browse/src/server.ts, clicks through the staging URL, and files issues. The release manager produces the PR. This replaces a 5-person team's process for one person.

Code Health & Issues

Static analysis flagged one issue:

Low — lib/diagram-render/package.json declares dependencies without a lockfile, making builds non-reproducible.

The repo otherwise shows strong hygiene: 723 test files, 14 CI workflows, OSV scanner config, dependency review, and a secret-scan gate (.github/scripts/gate-secret-scan.mjs). The docs/ directory (49 files) and ARCHITECTURE.md suggest maintained documentation. The 82 CLI scripts in bin/ are a maintenance surface — each is a potential integration point that can drift.

The Bottom Line

gstack is a serious, opinionated toolkit for AI-assisted development with real engineering discipline behind it: tests, CI, security scanning, and structured roles. It is a fork of a 130K-star repository and carries that lineage's maturity. It is not a library you import — it is a workflow you adopt, and its value depends entirely on how closely you align with Garry Tan's process. Worth trying if you live in Claude Code and ship solo; overkill if you already have a team process.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,444 files

TypeScript856
Markdown217
JSON39
HTML29
Shell25
YAML19

ReactDocker

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["test 430 modules"] g1["browse 206 modules"] g2["scripts 72 modules"] g3["lib 35 modules"] g4["design 33 modules"] g5["make-pdf 26 modules"] g6["ios-qa 24 modules"] g0 -->|82| g2 g0 -->|47| g3 g2 -->|14| g0 g0 -->|12| g1 g0 -->|8| g6 g2 -->|4| g1 g1 -->|3| g3 g4 -->|3| g1 g4 -->|2| g3 g1 -->|1| g4 g2 -->|1| g3 g0 -->|1| g4

Module dependencies

The 10 most depended-upon modules of 862, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_scripts_resolvers_types["types"] n1_test_helpers_e2e_gate["e2e-gate"] n2_test_helpers_session_runner["session-runner"] n3_test_helpers_e2e_helpers["e2e-helpers"] n4_browse_src_browser_manager["browser-manager"] n5_st_helpers_claude_pty_runner["claude-pty-runner"] n6_test_helpers_eval_store["eval-store"] n7_test_helpers_touchfiles["touchfiles"] n8_browse_src_commands["commands"] n9_lib_egress_receipt["egress-receipt"] n3_test_helpers_e2e_helpers --> n2_test_helpers_session_runner n3_test_helpers_e2e_helpers --> n6_test_helpers_eval_store n3_test_helpers_e2e_helpers --> n7_test_helpers_touchfiles n2_test_helpers_session_runner --> n6_test_helpers_eval_store classDef cyc stroke:#ef4444,stroke-width:2px; class n4_browse_src_browser_manager cyc;

Dependencies

3 of 17 declared dependencies are a major version behind. Resolved 17 of 17 against the registry.

Package	Declared	Latest	Behind
`@excalidraw/mermaid-to-excalidraw`	1.1.2	2.2.2	1 major
`react`	18.3.1	19.2.8	1 major
`react-dom`	18.3.1	19.2.8	1 major

Findings

LowDependencies declared without a lockfile - non-reproducible builds lib/diagram-render/package.json

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium4

low1

Pin third-party GitHub Actions to a commit SHAhigh4 occurrences

.github/workflows

docker/login-action@v4, docker/setup-buildx-action@v4, docker/build-push-action@v7, oven-sh/setup-bun@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/windows-free-tests.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Pin the container base image by digestmedium

.github/docker/Dockerfile.ci

ubuntu:24.04

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium

lib/diagram-render/dist/diagram-render.html

1 blobs over 5MB: diagram-render.html 9.2MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/actionlint.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.