fix: untrack binary, Docker chmod, os.tmpdir (#779, #709, #708)

.github/docker/Dockerfile.ci

@@ -60,4 +60,4 @@ RUN useradd -m -s /bin/bash runner \
     && mkdir -p /home/runner/.gstack && chown -R runner:runner /home/runner/.gstack \
     && chmod 1777 /tmp \
     && mkdir -p /home/runner/.bun && chown -R runner:runner /home/runner/.bun \
-    && chmod -R 1777 /tmp
+    && find /tmp -type d -exec chmod 1777 {} +

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.15.4.1] - 2026-04-04 — Community Fixes: Docker, Binary Tracking, Cross-Platform Temp Paths
+
+Three fixes from the open issue tracker. Every clone is now ~58MB smaller, the Docker CI image sets permissions correctly, and cookie import works on any platform.
+
+### Fixed
+
+- **58MB tracked binary removed.** `bin/gstack-global-discover` was committed despite `.gitignore`. `git rm --cached` stops tracking it. The TypeScript source remains, and `./setup` compiles it locally. (#779)
+- **Docker sticky bit on files.** `chmod -R 1777 /tmp` in the CI Dockerfile applied the sticky bit to files (meaningless). Now uses `find -type d` to only chmod directories. (#709)
+- **Hardcoded `/tmp` in cookie import.** `cookie-import-browser.ts` used `/tmp` directly instead of `os.tmpdir()`. Now portable. On macOS this resolves to a per-user temp directory, which is actually more secure. (#708)
+
 ## [0.15.4.0] - 2026-04-03 — Autoplan DX Integration + Docs
 
 `/autoplan` now auto-detects developer-facing plans and runs `/plan-devex-review` as Phase 3.5, with full dual-voice adversarial review (Claude subagent + Codex). If your plan mentions APIs, CLIs, SDKs, agent actions, or anything developers integrate with, the DX review kicks in automatically. No extra commands needed.

VERSION

@@ -1 +1 @@
-0.15.4.0
+0.15.4.1

browse/src/cookie-import-browser.ts

@@ -386,7 +386,7 @@ function openDb(dbPath: string, browserName: string): Database {
 }
 
 function openDbFromCopy(dbPath: string, browserName: string): Database {
-  const tmpPath = `/tmp/browse-cookies-${browserName.toLowerCase()}-${crypto.randomUUID()}.db`;
+  const tmpPath = path.join(os.tmpdir(), `browse-cookies-${browserName.toLowerCase()}-${crypto.randomUUID()}.db`);
   try {
     fs.copyFileSync(dbPath, tmpPath);
     // Also copy WAL and SHM if they exist (for consistent reads)