gstack’s browser moves to Chromium 156, and /ship stops pushing merge conflicts

gstack's browser now runs Chromium 156, closing a macOS sandbox escape that Chromium 151 still had. Your next setup or gstack upgrade downloads it.

Slide text

gstack’s browser moves to Chromium 156, and /ship stops pushing merge conflicts

Chromium 151 Chromium 156

Fixes CVE-2026-106378, a macOS sandbox escape. Your next ./setup or /gstack-upgrade downloads the new browser.

Browser Pushes Reviews Skills Fewer stops

garrytan/gstack · CHANGELOG.md · 1.94.31.0

Pushes.

A new guard reads every line your branch adds and stops the push on a leftover conflict marker, even one inside a template string that still passes its tests. Markdown blocks showing git output are skipped.

/ship now runs the cheap checks, stale generated files and the repo's own guards, before every push. A failing one prints its fix and pushes nothing. In gbrain, checks like these turned 64 of 93 heads red.

When a guard's exact command already passed at the same tree, /ship carries that pass instead of running it again. Where the test suites are guards, that saves about six minutes a ship.

A new ship policy, merge direct, lands each ready pull request at the commit that went green, with no merge train. It refuses unless every check there passed and GitHub calls the pull request clean.

Reviews.

Any executable now counts as code, whatever its name or folder, so a script called prune in a logs folder gets read for risk. Across main's last 200 commits, three reviews went from light to full.

Code that spends money, eval scorers, and docs that could print a secret now count as risk and get every reviewer. A risk class you declare yourself can only raise the depth.

Touch a few lines after review, and /ship can hand that diff to one reader and keep your receipt. A rebased branch, or more than twenty changed paths, still needs a full ship.

A stacked parent landing on main, a base merge beside reviewed lines, or a switch to a changelog fragment no longer sends unchanged code back for review.

Skills.

Claude Code's catalog shows only a skill's first sentence, so four skills now lead with when to use them. With that sentence, GPT-6.1 Sol opened /investigate nearly three times as often.

The contract hook, still off by default, no longer counts an install as running the tests, waits while agents are still working, and prints a waive command that actually runs.

A new principle says every skill, step and default must prove it helps on frontier models. The first fair test found /investigate made no difference on Opus 5.5, so it is a candidate to cut.

Fewer stops.

The lease each skill takes was never released, so a finished /ship blocked gstack upgrade for two hours. Now the skill's end closes its run. A run another session still holds keeps blocking.

Three false stops are gone: real files named probe flagged as scratch, lane names with a space going missing, and a ten-minute test limit preflight couldn't raise.

If you run gstack with Claude Code on a Mac, I would upgrade today for the browser fix alone. Every change is in the gstack changelog.