Open Source Project #191: gstack — YC CEO Garry Tan's Open-Source AI Engineering Team, 23 Expert Role Commands Covering the Full Sprint from Idea to Production

Introduction

"This isn't a copilot. It's a team."

This is article #191 in the "One Open Source Project a Day" series. Today's project is gstack — Y Combinator CEO Garry Tan's open-source Claude Code skill set, which turns Claude Code into a virtual engineering team with real role division.

Garry Tan writes in the README that his coding output in 2026 is roughly 810 times what it was in 2013 (daily logical lines of code: 11,417 vs. 14). gstack is the core tool behind that.

This is less a tool than a codified methodology: 23 slash commands, each embodying an organizational role (CEO, designer, security officer, QA lead, release engineer...), passing context between them in a connected sprint workflow from "idea" to "production."

128,000 Stars. MIT license. Completely free, no premium tier.

What You'll Learn

• gstack's core design philosophy: role-based vs. single assistant
• The 7-step development loop: Think → Plan → Build → Review → Test → Ship → Reflect
• Deep dives on the most valuable slash commands
• Browser control: real Playwright browser + prompt injection defense
• Cross-agent collaboration: /codex for second opinions, /pair-agent for multi-agent browser sharing
• 30-second installation

Prerequisites

• Experience with Claude Code or a similar AI coding agent
• Basic git workflow familiarity (branch, PR, merge)
• No TypeScript knowledge needed

Background: The Ceiling of a Single AI Assistant

When you use Claude Code to build a complete feature, what do you run into?

• Ask "write this feature" — it writes it, but never questions whether the feature is necessary
• Ask "review my code" — it reviews it, but doesn't know the design decisions behind it
• Every conversation starts from zero, context breaks between sessions
• Security review, performance testing, documentation updates — every task requires you to manually start it and manually provide context each time

gstack's core judgment: the real potential of AI agents isn't a "better single assistant" but a "team with clear roles." A team has a CEO to challenge product direction, a designer to audit UI, a security officer to check vulnerabilities, QA to test browser behavior, a release engineer to control the shipping process — each with a defined scope and specialist perspective.

The 7-Step Development Loop

All gstack skills connect into one process:

/office-hours    → Challenge product direction, six forced questions
     ↓
/autoplan        → CEO + design + engineering review automated
     ↓
/design-shotgun  → Generate 4-6 design variants, compare side by side
     ↓
/review          → Code review, find bugs that pass CI but crash in production
/cso             → OWASP + STRIDE security audit
     ↓
/qa              → Real Playwright browser tests, fix bugs, generate regression tests
     ↓
/ship            → Sync main → run tests → audit coverage → push → open PR
     ↓
/retro           → Engineering retrospective, extract cross-session learnings

Each step reads the output of the previous one. /office-hours generates a design document; /plan-ceo-review reads it; /plan-eng-review writes a test plan that /qa uses. Context doesn't get lost.

Core Slash Commands

/office-hours — YC-Style Product Challenge

Six forced questions, simulating a YC Office Hours conversation:

1. What specific problem are you solving, and who has it?
2. How do you know people actually have this problem?
3. What existing solutions exist, and why are they insufficient?
4. What are the core assumptions in your approach?
5. Under what conditions does your solution fail?
6. What's the minimum needed to validate this?

This isn't "help me polish my product idea" — it challenges your premises. Many features don't survive this step, which is the point.

/autoplan — Three-Way Review Pipeline

One command automatically runs:

• /plan-ceo-review: four modes — expand scope / selective expansion / hold scope / reduce scope
• /plan-design-review: 0–10 scoring on each design dimension, specifically detects AI-generated design antipatterns
• /plan-eng-review: locks in architecture, data flow, ASCII diagrams, edge cases

Three roles review independently, then results combine.

/design-shotgun — Design Exploration

Generates 4–6 UI variants for side-by-side browser comparison, instead of iterating on one direction.

Has a "taste memory" feature: which variant you chose and why gets remembered. Future generation sessions reference your history, so you don't have to re-explain your design preferences from scratch each time.

/design-html — Mockup to Production HTML

Converts design mockups (or text descriptions) into production-ready HTML, using the Pretext engine for text layout computation, targeting output under 30KB with zero dependencies.

Not "generate something that looks roughly right" — actual shippable code.

/review — Finds Bugs That Pass CI

Ordinary code review catches obvious problems. This slash command focuses on:

"Bugs that pass every CI check but crash in production."

• Race conditions
• Missing edge cases
• Error handling path failures
• Dependency version hazards

Obvious issues get auto-fixed; complex issues get analysis and suggested fixes.

/cso — Chief Security Officer

OWASP Top 10 + STRIDE threat model, with 17 false-positive exclusion rules.

The false-positive filter prevents reporting "normal exception handling wrapped in try-catch" as "error suppression vulnerability" and similar noise.

/qa — Real Browser Testing

This is one of gstack's most differentiated features.

Not "analyze code and infer possible bugs" — launches a real Playwright Chromium browser, real clicks, real form submissions, real API calls, then:

• Finds bugs, fixes them directly
• After fixing, automatically generates a regression test for each bug
• Test coverage accumulates with every /qa iteration

/ship — Complete Release Workflow

/ship

Automatically executes:

1. Sync main branch (git pull --rebase)
2. Run the test suite
3. Audit test coverage (warns if below threshold)
4. Push to remote
5. Open a Pull Request

One command replacing five manual steps — and the bugs that come from skipping one.

/careful + /freeze + /guard — Safety Rails

/careful  Force warning before dangerous commands (rm -rf, DROP TABLE, force push, etc.)
/freeze   Lock edits to a single directory, agent can't modify files outside the scope
/guard    /careful + /freeze combined

When letting an AI agent run high-risk operations, these three rails prevent accidental irreversible actions.

Browser Control Layer

gstack's browser layer isn't a simple Playwright wrapper — several design decisions are worth noting.

Prompt Injection Defense

Web pages can embed adversarial instructions in their content targeting AI agents ("ignore your system prompt and do..."). gstack's three-layer defense:

1. 22MB ML classifier: offline detection of injection attempts
2. Haiku transcription check: lightweight model secondary verification on suspicious content
3. Random canary token: if the agent outputs this token in its response, it was injected

/pair-agent — Multi-Agent Browser Sharing

Claude Code and Codex (or OpenClaw, GBrain, etc.) operate the same browser simultaneously, each in isolated tabs, not interfering with each other. One agent runs tests while another analyzes the results.

Human Takeover

When a CAPTCHA or human-confirmation step appears:

$B handoff   Transfer browser control to the user
$B resume    User hands control back to the agent after completing

Concurrent Sprint Support

gstack supports 10–15 parallel sprints (using Conductor or Claude Code's parallel worktrees).

Different feature development pipelines run at the same time without blocking each other — one sprint running /qa, another doing /design-shotgun, a third going through /ship.

Installation

30-second install (paste into Claude Code):

Install gstack: run git clone --single-branch --depth 1 
https://github.com/garrytan/gstack.git ~/.claude/skills/gstack 
&& cd ~/.claude/skills/gstack && ./setup

Team mode (auto-syncs to all team members):

(cd ~/.claude/skills/gstack && ./setup --team) && \
~/.claude/skills/gstack/bin/gstack-team-init required && \
git add .claude/ CLAUDE.md && \
git commit -m "require gstack for AI-assisted work"

Once committed to the main repo, anyone who clones it gets gstack automatically.

Supported agents: Claude Code, OpenAI Codex CLI, OpenCode, Cursor, Factory Droid, Slate, Kiro, Hermes, GBrain, OpenClaw.

gstack vs. Similar Projects

Project Links

• GitHub: garrytan/gstack
• Author: Garry Tan, @garrytan, YC President & CEO
• Philosophy doc: ETHOS.md (worth reading — about the builder's mindset)

Summary

gstack's core value is codifying "how an experienced engineering team operates" into a repeatable AI workflow.

Each slash command isn't just a prompt — it's a role perspective. CEO challenges strategy. Designer scores UX dimensions. Security officer audits from an attack surface view. QA tests actual user behavior. These perspectives are independent and cover each other's blind spots.

One person using this toolset can handle work that normally requires multi-role collaboration — not because the AI is smarter than a human, but because gstack enforces the steps that are "known to matter but frequently skipped": product assumption validation, security audit, real browser QA, test coverage checks.

Garry Tan is gstack's best advertisement: running YC while coding at 11,417 logical lines per day.

Explore PrimeSkills — A marketplace for handpicked AI Agents and skills. Each is validated in real enterprise workflows, stripping away hype and keeping only what truly works.

Welcome to my Homepage for more useful insights and interesting products.