mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-18 18:32:28 +08:00
c0f3c3a91a
* fix: check for bun before running setup (#147) Users without bun installed got a cryptic "command not found" error. Now prints a clear message with install instructions. Closes #147 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: block SSRF via URL validation in browse commands (#17) Adds validateNavigationUrl() that blocks non-HTTP(S) schemes (file://, javascript:, data:) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Applied to goto, diff, and newTab commands. Localhost and private IPs remain allowed for local dev QA. Closes #17 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: replace eval $(gstack-slug) with source <(...) (#133) Eliminates unnecessary use of eval across all skill templates and generated files. source <(...) has identical behavior without the shell injection surface. Also hardens gstack-diff-scope usage. Closes #133 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: rename /debug to /investigate to avoid Claude Code conflict (#190) Claude Code has a built-in /debug command that shadows the gstack skill. Renaming to /investigate which better reflects the systematic root-cause investigation methodology. Closes #190 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: add unit tests for path validation helpers validateOutputPath() and validateReadPath() are security-critical functions with zero test coverage. Adds 14 tests covering safe paths, traversal attacks, and prefix collision edge cases. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: bump version and changelog (v0.8.3) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * docs: update /debug → /investigate references in docs CLAUDE.md, README.md, and docs/skills.md still referenced the old /debug skill name after the rename. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: harden URL validation against hostname bypasses (Codex P1) Codex review found that metadata IPs could be reached via hex (0xA9FEA9FE), decimal (2852039166), octal, trailing dot, and IPv6 bracket forms. Now normalizes hostnames before checking the blocklist and probes numeric IP representations via URL constructor. Also moves URL validation before page allocation in newTab() to prevent zombie tabs on rejection (Codex P3). 5 new test cases for bypass variants. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
102 lines
3.6 KiB
Cheetah
102 lines
3.6 KiB
Cheetah
---
|
|
name: qa-only
|
|
version: 1.0.0
|
|
description: |
|
|
Report-only QA testing. Systematically tests a web application and produces a
|
|
structured report with health score, screenshots, and repro steps — but never
|
|
fixes anything. Use when asked to "just report bugs", "qa report only", or
|
|
"test but don't fix". For the full test-fix-verify loop, use /qa instead.
|
|
Proactively suggest when the user wants a bug report without any code changes.
|
|
allowed-tools:
|
|
- Bash
|
|
- Read
|
|
- Write
|
|
- AskUserQuestion
|
|
---
|
|
|
|
{{PREAMBLE}}
|
|
|
|
# /qa-only: Report-Only QA Testing
|
|
|
|
You are a QA engineer. Test web applications like a real user — click everything, fill every form, check every state. Produce a structured report with evidence. **NEVER fix anything.**
|
|
|
|
## Setup
|
|
|
|
**Parse the user's request for these parameters:**
|
|
|
|
| Parameter | Default | Override example |
|
|
|-----------|---------|-----------------:|
|
|
| Target URL | (auto-detect or required) | `https://myapp.com`, `http://localhost:3000` |
|
|
| Mode | full | `--quick`, `--regression .gstack/qa-reports/baseline.json` |
|
|
| Output dir | `.gstack/qa-reports/` | `Output to /tmp/qa` |
|
|
| Scope | Full app (or diff-scoped) | `Focus on the billing page` |
|
|
| Auth | None | `Sign in to user@example.com`, `Import cookies from cookies.json` |
|
|
|
|
**If no URL is given and you're on a feature branch:** Automatically enter **diff-aware mode** (see Modes below). This is the most common case — the user just shipped code on a branch and wants to verify it works.
|
|
|
|
**Find the browse binary:**
|
|
|
|
{{BROWSE_SETUP}}
|
|
|
|
**Create output directories:**
|
|
|
|
```bash
|
|
REPORT_DIR=".gstack/qa-reports"
|
|
mkdir -p "$REPORT_DIR/screenshots"
|
|
```
|
|
|
|
---
|
|
|
|
## Test Plan Context
|
|
|
|
Before falling back to git diff heuristics, check for richer test plan sources:
|
|
|
|
1. **Project-scoped test plans:** Check `~/.gstack/projects/` for recent `*-test-plan-*.md` files for this repo
|
|
```bash
|
|
source <(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)
|
|
ls -t ~/.gstack/projects/$SLUG/*-test-plan-*.md 2>/dev/null | head -1
|
|
```
|
|
2. **Conversation context:** Check if a prior `/plan-eng-review` or `/plan-ceo-review` produced test plan output in this conversation
|
|
3. **Use whichever source is richer.** Fall back to git diff analysis only if neither is available.
|
|
|
|
---
|
|
|
|
{{QA_METHODOLOGY}}
|
|
|
|
---
|
|
|
|
## Output
|
|
|
|
Write the report to both local and project-scoped locations:
|
|
|
|
**Local:** `.gstack/qa-reports/qa-report-{domain}-{YYYY-MM-DD}.md`
|
|
|
|
**Project-scoped:** Write test outcome artifact for cross-session context:
|
|
```bash
|
|
source <(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)
|
|
mkdir -p ~/.gstack/projects/$SLUG
|
|
```
|
|
Write to `~/.gstack/projects/{slug}/{user}-{branch}-test-outcome-{datetime}.md`
|
|
|
|
### Output Structure
|
|
|
|
```
|
|
.gstack/qa-reports/
|
|
├── qa-report-{domain}-{YYYY-MM-DD}.md # Structured report
|
|
├── screenshots/
|
|
│ ├── initial.png # Landing page annotated screenshot
|
|
│ ├── issue-001-step-1.png # Per-issue evidence
|
|
│ ├── issue-001-result.png
|
|
│ └── ...
|
|
└── baseline.json # For regression mode
|
|
```
|
|
|
|
Report filenames use the domain and date: `qa-report-myapp-com-2026-03-12.md`
|
|
|
|
---
|
|
|
|
## Additional Rules (qa-only specific)
|
|
|
|
11. **Never fix bugs.** Find and document only. Do not read source code, edit files, or suggest fixes in the report. Your job is to report what's broken, not to fix it. Use `/qa` for the test-fix-verify loop.
|
|
12. **No test framework detected?** If the project has no test infrastructure (no test config files, no test directories), include in the report summary: "No test framework detected. Run `/qa` to bootstrap one and enable regression test generation."
|