GStack Investigate vs Incident Investigate vs Canary Watch
Side-by-side comparison· 把候选放在一起看更容易选
| Editor's Pick· 编辑首选 GStack Investigate | Incident Investigate | Canary Watch | |
|---|---|---|---|
| Rank· 排名 | #2Editor's Pick · 编辑首选 | #1 | #4 |
| In a sentence· 一句话 | No fixes until the root cause is real. 根因没坐实之前，不急着动手修。 | No fixes until the cause is real. 原因还没坐实之前，不急着修。 | Verify the live deploy before users tell you it is broken. 抢在用户之前，确认这次上线真的没问题。 |
| Editor rating· 编辑评分 | |||
| Stars· 星标数 | 123k | 10k | 8.2k |
| Platforms· 运行平台 | CodexClaude CodeLocal terminals | CodexClaude Codelocal terminals | CodexCloudflare PagesVercel |
| Risk· 风险 | Low risk · 低风险 | Low risk · 低风险 | Medium risk · 中风险 |
| Author· 作者 | |||
| Updated· 最近更新 | 2026-04-22 | 2026-04-19 | 2026-04-18 |
| Why pick this· 为什么选它 | Best when the bug lives inside the code itself, not in operational state. Same "no fixes until the root cause is real" discipline as incident-investigate, but biased toward static code investigation: reads suspect modules, builds a hypothesis tree, asks for a failing test or repro before proposing a change. Strongest on flaky tests and intermittent failures where shallow patches make things worse. For ops-side incidents (logs, traffic, infra), incident-investigate fits better. bug 是在代码里而不是在运行态时，它最合适。和 incident-investigate 一样有「根因没明确前不修复」的纪律，但更偏静态代码调查：读可疑模块、建假设树、要求先有失败测试或复现，才允许改代码。在 flaky test 和间歇性故障这种「浅修反而更糟」的场景里最强。运维侧事故（日志、流量、基础设施）用 incident-investigate 更合适。 | Best for incidents where the fastest reflex would be the wrong fix. Forces an evidence-before-action loop: collect logs, list candidate hypotheses, verify each, only then propose a change. Pays for itself the moment it catches the kind of incident where "just restart it" would have masked a real data-integrity problem. Skip it for obviously cosmetic regressions — the cost of slowing down outweighs the cost of a re-deploy there. 在那种「第一反应反而是错的」事故里它最有用。强制走「证据—假设—验证—再动手」的顺序：先收集日志，列出候选假设，逐个验证，最后才提修复方案。只要救下一次本该用「重启就好」掩盖掉的真实数据完整性问题，回报就够了。但纯样式回归就别用它了，等回滚比慢思考更划算。 | Best for the 10–30 minutes right after a deploy hits production, when "we already verified in staging" starts to wear thin. Hits a curated list of critical routes, watches for console errors, broken pages, and visual diffs against baseline. Lightweight by design — it is not a synthetic monitoring platform. Pair with release-briefing for the comms side. Don't use it as a substitute for pre-merge QA; that's qa-loop or gstack-qa's job. 上线刚结束的 10-30 分钟最适合用它——「我们在 staging 验过了」这话在生产开始撑不住的那段时间。会按预设的关键路由清单走一遍，盯控制台错误、坏页面、和基线对比的视觉 diff。设计上很轻——不是 synthetic monitoring 平台。和 release-briefing 配合做发布沟通侧。别拿它替代合并前 QA，那是 qa-loop 或 gstack-qa 的活。 |
| Why skip· 为什么不选 | Workflows that require stronger human review than this catalog entry documents. 快速文案改动 | Quick cosmetic fixes 快速样式修补 | Workflows that require stronger human review than this catalog entry documents. 合并前评审 |
| Install· 安装命令 | $codex /investigate | $codex /investigate | $codex /canary |
If you can only install one如果你只能装一个
Best when the bug lives inside the code itself, not in operational state. Same "no fixes until the root cause is real" discipline as incident-investigate, but biased toward static code investigation: reads suspect modules, builds a hypothesis tree, asks for a failing test or repro before proposing a change. Strongest on flaky tests and intermittent failures where shallow patches make things worse. For ops-side incidents (logs, traffic, infra), incident-investigate fits better.
bug 是在代码里而不是在运行态时，它最合适。和 incident-investigate 一样有「根因没明确前不修复」的纪律，但更偏静态代码调查：读可疑模块、建假设树、要求先有失败测试或复现，才允许改代码。在 flaky test 和间歇性故障这种「浅修反而更糟」的场景里最强。运维侧事故（日志、流量、基础设施）用 incident-investigate 更合适。
Larger teams with stricter security: combine the picks above; their coverage complements rather than overlaps.团队大、安全要求高？把首选和其它候选搭配使用——它们覆盖互补而不是替代。