[DeyangChan]

What this changes

Adds vstack:design-review, released as 6.10.0. It is a MINOR bump because it is a new skill.

• The skill. It audits the current work at a polish level the owner chooses: Clean, Refined or Showcase. It writes the findings as one page and opens that page in vstack:review for comments. Product code stays unchanged until Approve & finish or the owner says to build. It then builds one slice at a time. Later rounds mark each earlier area as Landed, Landed but broken, or Moved.
• Skill boundaries. design-review is for an audit with proposals. review is for commenting with no audit. Each description now names the other.
• Proofread. Running design-review counts as the request proofread needs, for new UI copy only. If proofread stops, nothing is sent and the build continues. The description, README and changelog all say that UI copy goes to ChatGPT.
• Host rules. The skill names Host ops only. It has a fallback for when browser_capture is not available.
• Bug fix in the stream watcher. Approve closes the server 350ms after writing its sentinel, and the watcher polls once a second. The watcher checked for a closed server first, so an approval usually arrived as CLOSED … the tab went away with no APPROVED. The build step depends on that event. The first drive of this skill hit the bug.

How it was tested

Host: Claude Code. An agent followed the skill files from this branch by hand in a scratch project, with the demo todo app as the target:

• Captured screenshots and measurements with Playwright, including a long-title stress test. That test found a real overflow.
• Built a self-contained review page with a red-box screenshot and a before and after comparison.
• Ran the real review server and watcher. A scripted reviewer commented in the real workspace in headless Chromium. The comment was applied to the review page and published as v2.
• Confirmed the product file was unchanged until approval, then built the slices.
• Ran a second round with Landed and Landed, broken marks. After the fix, its live approval produced APPROVED and then CLOSED.

Also run:

• All test suites and the shell check. review-lifecycle.mjs has a new regression test, which failed before the fix.
• cucumber-js under both hosts: 45 of 45 scenarios pass on each.
• claude plugin validate --strict on both manifests.
• A sandbox install. plugin details lists 5 skills, including design-review.

Not exercised:

• A live proofread send. Chrome was not connected, so the run took the stop-and-continue path.
• browser_capture through Claude in Chrome. Playwright did the capture.
• A fresh session invoking /vstack:design-review, or a human reviewer.
• Codex and Grok, beyond the Codex e2e profile.
• gitleaks locally. CI runs it.

Checklist

• Installed the plugin from this branch and drove the affected skill end to end. See the limits above.
• Nothing writes outside the user's project, and nothing transmits anywhere, unless that is the skill's stated purpose. New UI copy going to ChatGPT is stated in the description.
• Per-machine state lands under .vstack/local/<tool>/. The skill names .vstack/local/design-review/ in its instructions and has no engine code.
• Pages stay self-contained. No external requests at runtime.
• Edited lib/shell/: not applicable.
• Added or renamed a plugin: not applicable.
• Renamed a tool: not applicable.
• Changed something under plugins/, and raised version in both host manifests with a matching CHANGELOG.md entry. Merging this publishes it.
• Every security scan passes: pending CI.
• Added a step that uses an action: not applicable.

🤖 Generated with Claude Code