neilenatarajan
diff --git a/‎.gitignore‎
Lines changed: 1 addition & 1 deletion b/‎.gitignore‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎BROWSER.md‎
Lines changed: 50 additions & 0 deletions b/‎BROWSER.md‎
Lines changed: 50 additions & 0 deletions
diff --git a/‎CHANGELOG.md‎
Lines changed: 17 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 17 additions & 0 deletions
diff --git a/‎CONTRIBUTING.md‎
Lines changed: 1 addition & 1 deletion b/‎CONTRIBUTING.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎README.md‎
Lines changed: 343 additions & 97 deletions b/‎README.md‎
Lines changed: 343 additions & 97 deletions
diff --git a/‎SKILL.md‎
Lines changed: 69 additions & 2 deletions b/‎SKILL.md‎
Lines changed: 69 additions & 2 deletions
diff --git a/‎VERSION‎
Lines changed: 1 addition & 1 deletion b/‎VERSION‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎autoplan/SKILL.md‎
Lines changed: 49 additions & 0 deletions b/‎autoplan/SKILL.md‎
Lines changed: 49 additions & 0 deletions
diff --git a/‎benchmark/SKILL.md‎
Lines changed: 49 additions & 0 deletions b/‎benchmark/SKILL.md‎
Lines changed: 49 additions & 0 deletions
@@ -4,7 +4,7 @@ dist/
 browse/dist/
 design/dist/
 research/dist/
-bin/gstack-global-discover
+bin/nstack-global-discover
 .gstack/
 .claude/skills/
 .agents/
 
@@ -113,6 +113,56 @@ Element crop accepts CSS selectors (`.class`, `#id`, `[attr]`) or `@e`/`@c` refs
 
 Mutual exclusion: `--clip` + selector and `--viewport` + `--clip` both throw errors. Unknown flags (e.g. `--bogus`) also throw.
 
+### Batch endpoint
+
+`POST /batch` sends multiple commands in a single HTTP request. This eliminates per-command round-trip latency — critical for remote agents where each HTTP call costs 2-5s (e.g., Render → ngrok → laptop).
+
+```json
+POST /batch
+Authorization: Bearer <token>
+
+{
+  "commands": [
+    {"command": "text", "tabId": 1},
+    {"command": "text", "tabId": 2},
+    {"command": "snapshot", "args": ["-i"], "tabId": 3},
+    {"command": "click", "args": ["@e5"], "tabId": 4}
+  ]
+}
+```
+
+Response:
+```json
+{
+  "results": [
+    {"index": 0, "status": 200, "result": "...page text...", "command": "text", "tabId": 1},
+    {"index": 1, "status": 200, "result": "...page text...", "command": "text", "tabId": 2},
+    {"index": 2, "status": 200, "result": "...snapshot...", "command": "snapshot", "tabId": 3},
+    {"index": 3, "status": 403, "result": "{\"error\":\"Element not found\"}", "command": "click", "tabId": 4}
+  ],
+  "duration": 2340,
+  "total": 4,
+  "succeeded": 3,
+  "failed": 1
+}
+```
+
+**Design decisions:**
+- Each command routes through `handleCommandInternal` — full security pipeline (scope checks, domain validation, tab ownership, content wrapping) enforced per command
+- Per-command error isolation: one failure doesn't abort the batch
+- Max 50 commands per batch
+- Nested batches rejected
+- Rate limiting: 1 batch = 1 request against the per-agent limit (individual commands skip rate check)
+- Ref scoping is already per-tab — no changes needed
+
+**Usage pattern** (agent crawling 20 pages):
+```
+# Step 1: Open 20 tabs (via individual newtab commands or batch)
+# Step 2: Read all 20 pages at once
+POST /batch → [{"command": "text", "tabId": 5}, {"command": "text", "tabId": 6}, ...]
+# → 20 page contents in ~2-3 seconds total vs ~40-100 seconds serial
+```
+
 ### Authentication
 
 Each server session generates a random UUID as a bearer token. The token is written to the state file (`.nstack/browse.json`) with chmod 600. Every HTTP request must include `Authorization: Bearer <token>`. This prevents other processes on the machine from controlling the browser.
 
@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.16.4.0] - 2026-04-10
+
+### Added
+
+- **Upstream sync from garrytan/gstack.** Pulled 25 upstream commits including browser data platform, 4-layer prompt injection defense, TabSession extraction, team install mode, community security fixes, ship re-run verification, and OpenClaw integration v2. All gstack references renamed to nstack automatically.
+- **git rerere enabled.** Conflict resolutions from this sync are recorded. Future upstream merges will auto-resolve repeated rename conflicts.
+
+### Fixed
+
+- Untracked the 61MB compiled `bin/nstack-global-discover` binary from git. The setup script builds from source, so the checked-in binary was redundant. The "no compiled binaries in git" tests now pass.
+- Fixed `bin/nstack-learnings-search` using old `GSTACK_SEARCH_*` environment variable names.
+- Fixed `pair-agent/SKILL.md.tmpl` description tag from `(gstack)` to `(nstack)`.
+- Removed orphaned `supabase/migrations/` directory left over from telemetry removal.
+- Renamed 5 upstream `bin/gstack-*` scripts to `bin/nstack-*`.
+- Renamed openclaw files and skill directories from gstack to nstack naming.
+- Updated telemetry tests to check for session timeline (which replaced telemetry).
+
 ## [0.16.3.0] - 2026-04-10
 
 ### Changed
 
@@ -367,7 +367,7 @@ to `nstack/...`, so they'll resolve to the global install automatically.
 
 ### Switching prefix mode
 
-If you vendored nstack with one prefix setting and want to switch:
+If you installed nstack with one prefix setting and want to switch:
 
 ```bash
 cd .claude/skills/nstack && ./setup --no-prefix   # switch to /qa, /ship
 
@@ -62,6 +62,16 @@ fi
 _ROUTING_DECLINED=$(~/.claude/skills/nstack/bin/nstack-config get routing_declined 2>/dev/null || echo "false")
 echo "HAS_ROUTING: $_HAS_ROUTING"
 echo "ROUTING_DECLINED: $_ROUTING_DECLINED"
+# Vendoring deprecation: detect if CWD has a vendored nstack copy
+_VENDORED="no"
+if [ -d ".claude/skills/nstack" ] && [ ! -L ".claude/skills/nstack" ]; then
+  if [ -f ".claude/skills/nstack/VERSION" ] || [ -d ".claude/skills/nstack/.git" ]; then
+    _VENDORED="yes"
+  fi
+fi
+echo "VENDORED_NSTACK: $_VENDORED"
+# Detect spawned session (OpenClaw or other orchestrator)
+[ -n "$OPENCLAW_SESSION" ] && echo "SPAWNED_SESSION: true" || true
 ```
 
 If `PROACTIVE` is `"false"`, do not proactively suggest nstack skills AND do not
@@ -153,6 +163,45 @@ Say "No problem. You can add routing rules later by running `nstack-config set r
 
 This only happens once per project. If `HAS_ROUTING` is `yes` or `ROUTING_DECLINED` is `true`, skip this entirely.
 
+If `VENDORED_NSTACK` is `yes`: This project has a vendored copy of nstack at
+`.claude/skills/nstack/`. Vendoring is deprecated. We will not keep vendored copies
+up to date, so this project's nstack will fall behind.
+
+Use AskUserQuestion (one-time per project, check for `~/.nstack/.vendoring-warned-$SLUG` marker):
+
+> This project has nstack vendored in `.claude/skills/nstack/`. Vendoring is deprecated.
+> We won't keep this copy up to date, so you'll fall behind on new features and fixes.
+>
+> Want to migrate to team mode? It takes about 30 seconds.
+
+Options:
+- A) Yes, migrate to team mode now
+- B) No, I'll handle it myself
+
+If A:
+1. Run `git rm -r .claude/skills/nstack/`
+2. Run `echo '.claude/skills/nstack/' >> .gitignore`
+3. Run `~/.claude/skills/nstack/bin/nstack-team-init required` (or `optional`)
+4. Run `git add .claude/ .gitignore CLAUDE.md && git commit -m "chore: migrate nstack from vendored to team mode"`
+5. Tell the user: "Done. Each developer now runs: `cd ~/.claude/skills/nstack && ./setup --team`"
+
+If B: say "OK, you're on your own to keep the vendored copy up to date."
+
+Always run (regardless of choice):
+```bash
+eval "$(~/.claude/skills/nstack/bin/nstack-slug 2>/dev/null)" 2>/dev/null || true
+touch ~/.nstack/.vendoring-warned-${SLUG:-unknown}
+```
+
+This only happens once per project. If the marker file exists, skip entirely.
+
+If `SPAWNED_SESSION` is `"true"`, you are running inside a session spawned by an
+AI orchestrator (e.g., OpenClaw). In spawned sessions:
+- Do NOT use AskUserQuestion for interactive prompts. Auto-choose the recommended option.
+- Do NOT run upgrade checks, telemetry prompts, routing injection, or lake intro.
+- Focus on completing the task and reporting results via prose output.
+- End with a completion report: what shipped, decisions made, anything uncertain.
+
 ## Voice
 
 **Tone:** direct, concrete, sharp, never corporate, never academic. Sound like a builder, not a consultant. Name the file, the function, the command. No filler, no throat-clearing.
@@ -589,21 +638,30 @@ $B css ".button" "background-color"
 ## Snapshot System
 
 The snapshot is your primary tool for understanding and interacting with pages.
+`$B` is the browse binary (resolved from `$_ROOT/.claude/skills/nstack/browse/dist/browse` or `~/.claude/skills/nstack/browse/dist/browse`).
+
+**Syntax:** `$B snapshot [flags]`
 
 ```
--i        --interactive           Interactive elements only (buttons, links, inputs) with @e refs
+-i        --interactive           Interactive elements only (buttons, links, inputs) with @e refs. Also auto-enables cursor-interactive scan (-C) to capture dropdowns and popovers.
 -c        --compact               Compact (no empty structural nodes)
 -d <N>    --depth                 Limit tree depth (0 = root only, default: unlimited)
 -s <sel>  --selector              Scope to CSS selector
 -D        --diff                  Unified diff against previous snapshot (first call stores baseline)
 -a        --annotate              Annotated screenshot with red overlay boxes and ref labels
 -o <path> --output                Output path for annotated screenshot (default: <temp>/browse-annotated.png)
--C        --cursor-interactive    Cursor-interactive elements (@c refs — divs with pointer, onclick)
+-C        --cursor-interactive    Cursor-interactive elements (@c refs — divs with pointer, onclick). Auto-enabled when -i is used.
 ```
 
 All flags can be combined freely. `-o` only applies when `-a` is also used.
 Example: `$B snapshot -i -a -C -o /tmp/annotated.png`
 
+**Flag details:**
+- `-d <N>`: depth 0 = root element only, 1 = root + direct children, etc. Default: unlimited. Works with all other flags including `-i`.
+- `-s <sel>`: any valid CSS selector (`#main`, `.content`, `nav > ul`, `[data-testid="hero"]`). Scopes the tree to that subtree.
+- `-D`: outputs a unified diff (lines prefixed with `+`/`-`/` `) comparing the current snapshot against the previous one. First call stores the baseline and returns the full tree. Baseline persists across navigations until the next `-D` call resets it.
+- `-a`: saves an annotated screenshot (PNG) with red overlay boxes and @ref labels drawn on each interactive element. The screenshot is a separate output from the text tree — both are produced when `-a` is used.
+
 **Ref numbering:** @e refs are assigned sequentially (@e1, @e2, ...) in tree order.
 @c refs from `-C` are numbered separately (@c1, @c2, ...).
 
@@ -647,11 +705,20 @@ Refs are invalidated on navigation — run `snapshot` again after `goto`.
 | Command | Description |
 |---------|-------------|
 | `accessibility` | Full ARIA tree |
+| `data [--jsonld|--og|--meta|--twitter]` | Structured data: JSON-LD, Open Graph, Twitter Cards, meta tags |
 | `forms` | Form fields as JSON |
 | `html [selector]` | innerHTML of selector (throws if not found), or full page HTML if no selector given |
 | `links` | All links as "text → href" |
+| `media [--images|--videos|--audio] [selector]` | All media elements (images, videos, audio) with URLs, dimensions, types |
 | `text` | Cleaned page text |
 
+### Extraction
+| Command | Description |
+|---------|-------------|
+| `archive [path]` | Save complete page as MHTML via CDP |
+| `download <url|@ref> [path] [--base64]` | Download URL or media element to disk using browser cookies |
+| `scrape <images|videos|media> [--selector sel] [--dir path] [--limit N]` | Bulk download all media from page. Writes manifest.json |
+
 ### Interaction
 | Command | Description |
 |---------|-------------|
 
@@ -1 +1 @@
-0.16.3.0
+0.16.4.0
@@ -72,6 +72,16 @@ fi
 _ROUTING_DECLINED=$(~/.claude/skills/nstack/bin/nstack-config get routing_declined 2>/dev/null || echo "false")
 echo "HAS_ROUTING: $_HAS_ROUTING"
 echo "ROUTING_DECLINED: $_ROUTING_DECLINED"
+# Vendoring deprecation: detect if CWD has a vendored nstack copy
+_VENDORED="no"
+if [ -d ".claude/skills/nstack" ] && [ ! -L ".claude/skills/nstack" ]; then
+  if [ -f ".claude/skills/nstack/VERSION" ] || [ -d ".claude/skills/nstack/.git" ]; then
+    _VENDORED="yes"
+  fi
+fi
+echo "VENDORED_NSTACK: $_VENDORED"
+# Detect spawned session (OpenClaw or other orchestrator)
+[ -n "$OPENCLAW_SESSION" ] && echo "SPAWNED_SESSION: true" || true
 ```
 
 If `PROACTIVE` is `"false"`, do not proactively suggest nstack skills AND do not
@@ -163,6 +173,45 @@ Say "No problem. You can add routing rules later by running `nstack-config set r
 
 This only happens once per project. If `HAS_ROUTING` is `yes` or `ROUTING_DECLINED` is `true`, skip this entirely.
 
+If `VENDORED_NSTACK` is `yes`: This project has a vendored copy of nstack at
+`.claude/skills/nstack/`. Vendoring is deprecated. We will not keep vendored copies
+up to date, so this project's nstack will fall behind.
+
+Use AskUserQuestion (one-time per project, check for `~/.nstack/.vendoring-warned-$SLUG` marker):
+
+> This project has nstack vendored in `.claude/skills/nstack/`. Vendoring is deprecated.
+> We won't keep this copy up to date, so you'll fall behind on new features and fixes.
+>
+> Want to migrate to team mode? It takes about 30 seconds.
+
+Options:
+- A) Yes, migrate to team mode now
+- B) No, I'll handle it myself
+
+If A:
+1. Run `git rm -r .claude/skills/nstack/`
+2. Run `echo '.claude/skills/nstack/' >> .gitignore`
+3. Run `~/.claude/skills/nstack/bin/nstack-team-init required` (or `optional`)
+4. Run `git add .claude/ .gitignore CLAUDE.md && git commit -m "chore: migrate nstack from vendored to team mode"`
+5. Tell the user: "Done. Each developer now runs: `cd ~/.claude/skills/nstack && ./setup --team`"
+
+If B: say "OK, you're on your own to keep the vendored copy up to date."
+
+Always run (regardless of choice):
+```bash
+eval "$(~/.claude/skills/nstack/bin/nstack-slug 2>/dev/null)" 2>/dev/null || true
+touch ~/.nstack/.vendoring-warned-${SLUG:-unknown}
+```
+
+This only happens once per project. If the marker file exists, skip entirely.
+
+If `SPAWNED_SESSION` is `"true"`, you are running inside a session spawned by an
+AI orchestrator (e.g., OpenClaw). In spawned sessions:
+- Do NOT use AskUserQuestion for interactive prompts. Auto-choose the recommended option.
+- Do NOT run upgrade checks, telemetry prompts, routing injection, or lake intro.
+- Focus on completing the task and reporting results via prose output.
+- End with a completion report: what shipped, decisions made, anything uncertain.
+
 ## Voice
 
 You are NStack, an open source AI builder framework shaped by Garry Tan's product, startup, and engineering judgment. Encode how he thinks, not his biography.
 
@@ -65,6 +65,16 @@ fi
 _ROUTING_DECLINED=$(~/.claude/skills/nstack/bin/nstack-config get routing_declined 2>/dev/null || echo "false")
 echo "HAS_ROUTING: $_HAS_ROUTING"
 echo "ROUTING_DECLINED: $_ROUTING_DECLINED"
+# Vendoring deprecation: detect if CWD has a vendored nstack copy
+_VENDORED="no"
+if [ -d ".claude/skills/nstack" ] && [ ! -L ".claude/skills/nstack" ]; then
+  if [ -f ".claude/skills/nstack/VERSION" ] || [ -d ".claude/skills/nstack/.git" ]; then
+    _VENDORED="yes"
+  fi
+fi
+echo "VENDORED_NSTACK: $_VENDORED"
+# Detect spawned session (OpenClaw or other orchestrator)
+[ -n "$OPENCLAW_SESSION" ] && echo "SPAWNED_SESSION: true" || true
 ```
 
 If `PROACTIVE` is `"false"`, do not proactively suggest nstack skills AND do not
@@ -156,6 +166,45 @@ Say "No problem. You can add routing rules later by running `nstack-config set r
 
 This only happens once per project. If `HAS_ROUTING` is `yes` or `ROUTING_DECLINED` is `true`, skip this entirely.
 
+If `VENDORED_NSTACK` is `yes`: This project has a vendored copy of nstack at
+`.claude/skills/nstack/`. Vendoring is deprecated. We will not keep vendored copies
+up to date, so this project's nstack will fall behind.
+
+Use AskUserQuestion (one-time per project, check for `~/.nstack/.vendoring-warned-$SLUG` marker):
+
+> This project has nstack vendored in `.claude/skills/nstack/`. Vendoring is deprecated.
+> We won't keep this copy up to date, so you'll fall behind on new features and fixes.
+>
+> Want to migrate to team mode? It takes about 30 seconds.
+
+Options:
+- A) Yes, migrate to team mode now
+- B) No, I'll handle it myself
+
+If A:
+1. Run `git rm -r .claude/skills/nstack/`
+2. Run `echo '.claude/skills/nstack/' >> .gitignore`
+3. Run `~/.claude/skills/nstack/bin/nstack-team-init required` (or `optional`)
+4. Run `git add .claude/ .gitignore CLAUDE.md && git commit -m "chore: migrate nstack from vendored to team mode"`
+5. Tell the user: "Done. Each developer now runs: `cd ~/.claude/skills/nstack && ./setup --team`"
+
+If B: say "OK, you're on your own to keep the vendored copy up to date."
+
+Always run (regardless of choice):
+```bash
+eval "$(~/.claude/skills/nstack/bin/nstack-slug 2>/dev/null)" 2>/dev/null || true
+touch ~/.nstack/.vendoring-warned-${SLUG:-unknown}
+```
+
+This only happens once per project. If the marker file exists, skip entirely.
+
+If `SPAWNED_SESSION` is `"true"`, you are running inside a session spawned by an
+AI orchestrator (e.g., OpenClaw). In spawned sessions:
+- Do NOT use AskUserQuestion for interactive prompts. Auto-choose the recommended option.
+- Do NOT run upgrade checks, telemetry prompts, routing injection, or lake intro.
+- Focus on completing the task and reporting results via prose output.
+- End with a completion report: what shipped, decisions made, anything uncertain.
+
 ## Voice
 
 **Tone:** direct, concrete, sharp, never corporate, never academic. Sound like a builder, not a consultant. Name the file, the function, the command. No filler, no throat-clearing.