Commit Graph

550 Commits

Author SHA1 Message Date
Tom Boucher
5eed6973b8 Merge pull request #1447 from rahuljordashe/fix/phase-complete-roadmap-rollup
fix: cmdPhaseComplete updates Plans column and plan checkboxes
2026-04-01 17:20:14 -04:00
Tom Boucher
ce5fbc5d73 Merge pull request #1445 from Tibsfox/feat/discuss-phase-chain-1327
feat(discuss): add --chain flag for interactive discuss with auto plan+execute
2026-04-01 17:17:17 -04:00
Tom Boucher
dbb3239675 Merge pull request #1444 from Tibsfox/feat/autonomous-only-flag-1383
feat(autonomous): add --only N flag for single-phase parallel execution
2026-04-01 17:16:56 -04:00
Tom Boucher
1d97a03a36 Merge pull request #1442 from Tibsfox/fix/complete-phase-reference-1441
fix(next): remove reference to non-existent /gsd:complete-phase
2026-04-01 17:16:13 -04:00
Tom Boucher
1cf97fd9cb Merge pull request #1386 from gsd-build/fix/schema-drift-detection-1381
feat: schema drift detection prevents false-positive verification
2026-04-01 17:15:43 -04:00
Tom Boucher
dbc54b8386 Merge pull request #1439 from Tibsfox/fix/todo-done-vs-completed-1438
fix(todos): rename todos/done to todos/completed in workflows and docs
2026-04-01 17:12:47 -04:00
Tom Boucher
02c41940c7 Merge pull request #1432 from j2h4u/fix/verifier-human-needed-status
fix(verifier): enforce human_needed status when human verification items exist
2026-04-01 17:11:06 -04:00
Tom Boucher
53c7c1c993 Merge pull request #1518 from ElliotDrel/feat/full-flag-refactor
feat(quick): make --full include all phases, add --validate flag
2026-04-01 16:59:52 -04:00
Tibsfox
5e88db9577 feat(discuss): add --chain flag for interactive discuss with auto plan+execute
Adds --chain flag to /gsd:discuss-phase that provides the middle ground
between fully manual and fully automatic workflows:

  /gsd:discuss-phase 5 --chain

  - Discussion is fully interactive (user answers questions)
  - After context is captured, auto-advances to plan → execute
  - Same pipeline as --auto, but without auto-answering

This addresses the community request for per-phase automation where
users want to control discuss decisions but skip manual advancement
between plan and execute steps.

Workflow: discuss (interactive) → plan (auto) → execute (auto)

Changes:
- Workflow: --chain flag triggers auto_advance without auto-answering
- Workflow: chain flag synced alongside --auto in ephemeral config
- Workflow: next-phase suggestion preserves --chain vs --auto
- Command: argument-hint and description updated
- Success criteria updated

Closes #1327

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-01 13:56:20 -07:00
Tom Boucher
7f11543691 feat: add schema drift detection to prevent false-positive verification
GSD agents silently skip database schema push — verification passes but
production breaks because TypeScript types come from config, not the live
database. This adds two layers of protection:

1. Plan-phase template detection (step 5.7): When the planner detects
   schema-relevant file patterns in the phase scope, it injects a mandatory
   [BLOCKING] schema push task into the plan with the appropriate push
   command for the detected ORM.

2. Post-execution drift detection gate: After execution completes but
   before verification marks success, scans for schema-relevant file
   changes and checks if a push command was executed. Blocks verification
   with actionable guidance if drift is detected.

Supports Payload CMS, Prisma, Drizzle, Supabase, and TypeORM.
Override with GSD_SKIP_SCHEMA_CHECK=true.

Fixes #1381

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-01 16:53:20 -04:00
Tom Boucher
8502c11d97 Merge pull request #1501 from Tibsfox/fix/discuss-incremental-saves-1485
fix(discuss): incremental checkpoint saves to prevent answer loss on interrupt
2026-04-01 12:17:54 -04:00
Tom Boucher
4add6d2f42 Merge pull request #1408 from Tibsfox/fix/decimal-phase-regex-1402
fix(branching): capture decimal phase numbers in commit regex
2026-04-01 12:15:16 -04:00
Tom Boucher
d70ca3ee95 Merge pull request #1397 from bshiggins/feat/project-code-prefix
feat: add project_code config for phase directory prefixing
2026-04-01 12:14:48 -04:00
Tom Boucher
1dc0d90c6e Merge pull request #1394 from Tibsfox/fix/issue-triage-batch-1392-1391-1389
fix: trailing slash, slug newlines, and duplicate command registration
2026-04-01 12:12:37 -04:00
Tom Boucher
cdf8d08b60 Merge pull request #1380 from Bantuson/feat/security-first-layer
feat: security-first enforcement layer with threat-model-anchored verification
2026-04-01 12:12:04 -04:00
Luka Fagundes
067d411c9b feat: add /gsd:docs-update command for verified documentation generation (#1532)
* docs(01-02): complete gsd-doc-writer agent skeleton plan

- SUMMARY.md for plan 01-02
- STATE.md advanced to plan 2/2, progress 50%
- ROADMAP.md updated with phase 1 plan progress
- REQUIREMENTS.md marked DOCG-01 and DOCG-08 complete

* feat(01-01): create lib/docs.cjs with cmdDocsInit and detection helpers

- Add cmdDocsInit following cmdInitMapCodebase pattern
- Add hasGsdMarker(), scanExistingDocs(), detectProjectType()
- Add detectDocTooling(), detectMonorepoWorkspaces() private helpers
- GSD_MARKER constant for generated-by tracking
- Only Node.js built-ins and local lib requires used

* feat(01-01): wire docs-init into gsd-tools.cjs and register gsd-doc-writer model profile

- Add const docs = require('./lib/docs.cjs') to gsd-tools.cjs
- Add case 'docs-init' routing to docs.cmdDocsInit
- Add docs-init to help text and JSDoc header
- Register gsd-doc-writer in MODEL_PROFILES (quality:opus, balanced:sonnet, budget:haiku)
- Fix docs.cjs: inline withProjectRoot logic via checkAgentsInstalled (private in init.cjs)

* docs(01-01): complete docs-init command plan

- SUMMARY.md documenting cmdDocsInit, detection helpers, wiring
- STATE.md advanced, progress updated to 100%
- ROADMAP.md phase 1 marked Complete
- REQUIREMENTS.md INFRA-01, INFRA-02, CONS-03 marked complete

* feat(01-02): create gsd-doc-writer agent skeleton

- YAML frontmatter with name, description, tools, color: purple
- role block with doc_assignment receiving convention
- create_mode and update_mode sections
- 9 stub template sections (readme, architecture, getting_started, development, testing, api, configuration, deployment, contributing)
- Each template has Required Sections list and Phase 3 TODO
- critical_rules prohibiting GSD methodology and CHANGELOG
- success_criteria checklist
- No GSD methodology leaks in template sections

* feat(02-01): add docs-update workflow Steps 1-6 — init, classify, route, resolve, detect

- init_context step calling docs-init with @file: handling and agent-skills loading
- validate_agents step warns on missing gsd-doc-writer without halting
- classify_project step maps project_type signals to 5 primary labels plus conditional docs
- build_doc_queue step with always-on 6 docs and conditional API/CONTRIBUTING/DEPLOYMENT routing
- resolve_modes step with doc-type to canonical path mapping and create/update detection
- detect_runtime_capabilities step with Task tool detection and sequential fallback routing

* docs(02-01): complete docs-update workflow plan — 13-step orchestration for parallel doc generation

- 02-01-SUMMARY.md: plan results, decisions, file inventory
- STATE.md: advanced to last plan, progress 100%, decisions recorded
- ROADMAP.md: Phase 2 marked Complete (1/1 plans with summary)
- REQUIREMENTS.md: marked INFRA-04, DOCG-03, DOCG-04, CONS-01, CONS-02, CONS-04 complete

* docs(03-02): complete command entry point and workflow extension plan

- 03-02-SUMMARY.md: plan results, decisions, file inventory
- STATE.md: advanced to plan 2, progress 100%, decisions recorded
- ROADMAP.md: Phase 3 marked Complete (2/2 plans with summaries)
- REQUIREMENTS.md: marked INFRA-03, EXIST-01, EXIST-02, EXIST-04 complete

* feat(03-01): fill all 9 doc templates, add supplement mode and per-package README template

- Replace all 9 template stubs with full content guidance (Required Sections, Content Discovery, Format Notes)
- Add shared doc_tooling_guidance block for Docusaurus, VitePress, MkDocs, Storybook routing
- Add supplement_mode block: append-only strategy with heading comparison and safety rules
- Add template_readme_per_package for monorepo per-package README generation
- Update role block to list supplement as third mode; add rule 7 to critical_rules
- Add supplement mode check to success_criteria
- Remove all Phase 3 TODO stubs and placeholder comments

* feat(03-02): add docs-update command entry point with --force and --verify-only flags

- YAML frontmatter with name, argument-hint, allowed-tools
- objective block documents flag semantics with literal-token enforcement pattern
- execution_context references docs-update.md workflow
- context block passes $ARGUMENTS and documents flag derivation rules
- --force takes precedence over --verify-only when both present

* feat(03-02): extend docs-update workflow with preservation_check, monorepo dispatch, and verify-only

- preservation_check step between resolve_modes and detect_runtime_capabilities
- preservation_check skips on --force, --verify-only, or no hand-written docs
- per-file AskUserQuestion choice: preserve/supplement/regenerate with fallback default to preserve
- dispatch_monorepo_packages step after collect_wave_2 for per-package READMEs
- verify_only_report early-exit step with VERIFY marker count and Phase 4 deferral message
- preservation_mode field added to all doc_assignment blocks in dispatch_wave_1, dispatch_wave_2
- sequential_generation extended with monorepo per-package section
- commit_docs updated to include per-package README files pattern
- report extended with per-package README rows and preservation decisions
- success_criteria updated with preservation, --force, --verify-only, and monorepo checks

* feat(04-01): create gsd-doc-verifier agent with claim extraction and filesystem verification

- YAML frontmatter with name, description, tools, and color fields
- claim_extraction section with 5 categories: file paths, commands, API endpoints, functions, dependencies
- skip_rules section for VERIFY markers, placeholders, example prefixes, and diff blocks
- verification_process with 6 steps using filesystem tools only (no self-consistency checks)
- output_format with exact JSON shape per D-01
- critical_rules enforcing filesystem-only verification and read-only operation

* feat(04-01): add fix_mode to gsd-doc-writer with surgical correction instructions

- Add fix_mode section after supplement_mode in modes block
- Document fix mode as valid option in role block mode list
- Add failures field to doc_assignment fields (fix mode only)
- fix_mode enforces surgical precision: only correct listed failing lines
- VERIFY marker fallback when correct value cannot be determined

* test(04-03): add docs-init integration test suite

- 13 tests across 4 describe blocks covering JSON output shape, project type
  detection, existing doc scanning, GSD marker detection, and doc tooling
- Tests use node:test + node:assert/strict with beforeEach/afterEach lifecycle
- All 13 tests pass with `node --test tests/docs-update.test.cjs`

* feat(04-02): add verify_docs, fix_loop, scan_for_secrets steps to docs-update workflow

- verify_docs step spawns gsd-doc-verifier per generated doc and collects structured JSON results
- fix_loop step bounded at 2 iterations with regression detection (D-05/D-06)
- scan_for_secrets step uses exact map-codebase grep pattern before commit (D-07/D-08)
- verify_only_report updated to invoke real gsd-doc-verifier instead of VERIFY marker count stub
- success_criteria updated with 4 new verification gate checklist items

* docs(04-02): complete verification gate workflow steps plan

- SUMMARY.md: verify_docs, fix_loop, scan_for_secrets, and updated verify_only_report
- STATE.md: advanced to ready_for_verification, 100% progress, decisions logged
- ROADMAP.md: phase 4 marked Complete (3/3 plans with SUMMARYs)
- REQUIREMENTS.md: VERF-01, VERF-02, VERF-03 all marked complete

* refactor(profiles): Adds 'gsd-doc-verifier' to the 'MODEL_PROFILES'

* feat(agents): Add critical rules for file creation and update install test

* docs(05): create phase plan for docs output refinement

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(05-01): make scanExistingDocs recursive into docs/ subdirectories

- Replace flat docs/ scan with recursive walkDir helper (MAX_DEPTH=4)
- Add SKIP_DIRS filtering at every level of recursive walk
- Add fallback to documentation/ or doc/ when docs/ does not exist
- Update JSDoc to reflect recursive scanning behavior

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(05-01): update gsd-doc-writer default path guidance to docs/

- Change "No tooling detected" guidance to default to docs/ directory
- Add README.md and CONTRIBUTING.md as root-level exceptions
- Add instruction to create docs/ directory if it does not exist

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(05-02): invert path table to default docs to docs/ directory

- Invert resolve_modes path table: docs/ is primary for all types except readme and contributing
- Add mkdir -p docs/ instruction before agent dispatch
- Update all downstream path references: collect_wave_1, collect_wave_2, commit_docs, report, verify tables
- Update sequential_generation wave_1_outputs and resolved path references
- Update success criteria and verify_only_report examples to use docs/ paths

* feat(05-02): add CONTRIBUTING confirmation gate and existing doc review queue

- Add CONTRIBUTING.md user confirmation prompt in build_doc_queue (skipped with --force or when file exists)
- Add review_queue for non-canonical existing docs (verification only, not rewriting)
- Add review_queue verification in verify_docs step with fix_loop exclusion
- Add existing doc accuracy review section to report step with manual correction guidance

* docs(05-02): complete path table inversion and doc queue improvements plan

- Add 05-02-SUMMARY.md with execution results
- Update STATE.md with position, decisions, and metrics
- Update ROADMAP.md with phase 05 plan progress

* fix(05): replace plain text y/n prompts with AskUserQuestion in docs-update workflow

Three prompts were using plain text (y/n) instead of GSD's standard
AskUserQuestion pattern: CONTRIBUTING.md confirmation, doc queue
proceed gate, and secrets scan confirmation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(05): structure-aware paths, non-canonical doc fixes, and gap detection

- resolve_modes now inspects existing doc directory structure and places
  new docs in matching subdirectories (e.g., docs/architecture/ if that
  pattern exists), instead of dumping everything flat into docs/
- Non-canonical docs with inaccuracies are now sent to gsd-doc-writer
  in fix mode for surgical corrections, not just reported
- Added documentation gap detection step that scans the codebase for
  undocumented areas and prompts user to create missing docs
- Added type: custom support to gsd-doc-writer with template_custom
  section for gap-detected documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(05): smarter structure-aware path resolution for grouped doc directories

When a project uses grouped subdirectories (docs/architecture/,
docs/api/, docs/guides/), ALL canonical docs must be placed in
appropriate groups — none left flat in docs/. Added resolution
chain per doc type with fallback creation. Filenames now match
existing naming style (lowercase-kebab vs UPPERCASE). Queue
presentation shows actual resolved paths, not defaults.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(05): restore mode resolution table as primary queue presentation

The table showing resolved paths, modes, and sources for each doc
must be displayed before the proceed/abort confirmation. It was
replaced by a simple list — now restored as the canonical queue view.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(05): use table format for existing docs review queue presentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(05): add work manifest for structured handoffs between workflow steps

Root cause from smoke test: orchestrator forgot to verify 45 non-canonical
docs because the review_queue had no structural scaffolding — it existed
only in orchestrator memory. Fix:

1. Write docs-work-manifest.json to .planning/tmp/ after resolve_modes
   with all canonical_queue, review_queue, and gap_queue items
2. Every subsequent step (dispatch, collect, verify, fix_loop, report)
   MUST read the manifest first — single source of truth
3. Restructured verify_docs into explicit Phase 1 (canonical) and
   Phase 2 (non-canonical) with separate dispatch for each
4. Both queues now eligible for fix_loop corrections
5. Added manifest read instructions to all dispatch/collect steps

Follows the same pattern as execute-phase's phase-plan-index for
tracking work items across multi-step orchestration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs(05): update workflow purpose to reflect full command scope

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor(05): remove redundant steps from docs-update workflow

- Remove validate_agents step (if command is available, agents are installed)
- Remove agents_installed/missing_agents extraction from init_context
- Remove available_agent_types block (agent types specified in each Task call)
- Remove detect_runtime_capabilities step (runtime knows its own tools)
- Replace hardcoded flat paths in collect_wave_1/2 with manifest resolved_paths

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(05): restore available_agent_types section required by test suite

Test enforces that workflows spawning named agents must declare them
in an <available_agent_types> block. Added back with both gsd-doc-writer
and gsd-doc-verifier listed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-01 08:47:31 -06:00
Elliot Drel
5217b7b74a feat(quick): make --full include all phases, add --validate flag
--full now enables discussion + research + plan-checking + verification.
New --validate flag covers what --full previously did (plan-checking +
verification only). All downstream workflow logic uses $VALIDATE_MODE.

Closes #1498

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-31 09:07:08 -04:00
Tibsfox
c056a43285 fix(discuss): incremental checkpoint saves to prevent answer loss on interrupt
When discuss-phase is interrupted mid-session (usage limit, crash,
network drop), all user answers were lost — the workflow only wrote
CONTEXT.md and DISCUSSION-LOG.md at the very end. Users had to redo
entire discussion sessions from scratch.

Changes:
- Write DISCUSS-CHECKPOINT.json after each grey area completes,
  capturing all decisions, completed/remaining areas, deferred ideas,
  and canonical refs
- check_existing step now detects checkpoint files and offers "Resume"
  or "Start fresh" — skips already-completed areas on resume
- Checkpoint cleaned up after successful CONTEXT.md write
- Works in both interactive and --auto modes

Closes #1485

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-30 13:55:33 -07:00
Rahul Jordashe
32b2c52729 fix: cmdPhaseComplete now updates Plans column and plan checkboxes in ROADMAP.md
cmdPhaseComplete updated Status and Completed columns in the progress
table but skipped the Plans Complete column and plan-level checkboxes.
If update-plan-progress was missed for any plan, the phase completion
safety net didn't catch it, leaving ROADMAP.md inconsistent.

Fixes #1446

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 14:46:42 +05:30
Tibsfox
3e8c8f6f39 feat(autonomous): add --only N flag for single-phase execution
Adds --only N flag to /gsd:autonomous that restricts execution to a
single phase, enabling safe parallel execution across terminals:

  Terminal 1: /gsd:autonomous --only 16
  Terminal 2: /gsd:autonomous --only 17
  Terminal 3: /gsd:autonomous --only 18

Changes:
- Step 1: Parse --only N alongside --from N (also sets FROM_PHASE)
- Step 2: Filter phase list to exact match when --only active
- Step 4: Skip iteration — single phase does not loop
- Step 5: Skip lifecycle — audit/complete/cleanup only for full runs
- Step 6: Resume message uses --only when active
- Success criteria updated with --only N requirements

Parallel safety: each phase operates in its own .planning/phases/NN-*
directory. ROADMAP.md and STATE.md are read-only during phase execution.

Closes #1383

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 01:21:04 -07:00
Tibsfox
18111f91c5 fix(next): remove reference to non-existent /gsd:complete-phase
The next.md workflow Route 5 referenced `/gsd:complete-phase` which
doesn't exist — only `/gsd:complete-milestone` does. After verify-work
completes for a phase, Route 6 handles advancement to the next phase
automatically, so the dangling reference is simply removed.

Closes #1441

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 00:22:11 -07:00
Tibsfox
447d17a9fc fix(todos): rename todos/done to todos/completed in workflows and docs
The CLI (commands.cjs, init.cjs) uses `todos/completed/` but three
workflow files and three FEATURES.md docs referenced `todos/done/`.
This caused completed todos to land in different directories depending
on whether the CLI command or the workflow instructions were followed.

Closes #1438

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 22:23:09 -07:00
j2h4u
655d455466 fix(verifier): enforce human_needed status when human verification items exist
The verifier agent could set status: passed even when the report contained
a non-empty "Human Verification Required" section. This bypassed the
human_needed → HUMAN-UAT.md → user approval gate, allowing phases to be
marked complete without human testing.

Replace the advisory status descriptions with an ordered decision tree
(most restrictive first): gaps_found → human_needed → passed. The passed
status is now only valid when zero human verification items exist.

Synced the same decision tree in the verify-phase workflow.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 01:16:43 +05:00
Tibsfox
c1fd72f81f fix(branching): capture decimal phase numbers in commit regex
The phase-extraction regex /(\d+)-/ only matched the last integer
segment before a dash, so decimal phases like 45.14 were misresolved
to phase 14 — silently switching to the wrong branch.

Closes #1402

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 19:42:19 -07:00
Brandon Higgins
1f34965717 feat: add project_code config for phase directory prefixing
When project_code is set (e.g., "CK"), phase directories are prefixed
with the code: CK-01-foundation, CK-02-api, etc. This disambiguates
phases across multiple GSD projects in the same session.

Changes:
- Add project_code to VALID_CONFIG_KEYS and buildNewProjectConfig defaults
- Add project_code to loadConfig in core.cjs
- Prepend prefix in cmdPhaseAdd and cmdPhaseInsert
- Update searchPhaseInDir, cmdFindPhase, comparePhaseNum, and
  normalizePhaseName to strip prefix before matching/sorting
- Support {project} placeholder in git.phase_branch_template
- Add 4 tests covering prefixed add, null code, find, and sort

Closes #1019

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 08:43:05 -06:00
Tibsfox
b5cbd47373 fix(commands): remove duplicate workstreams.md from plugin directory
get-shit-done/commands/gsd/workstreams.md was identical to
commands/gsd/workstreams.md, causing Claude Code to register
every gsd:* command twice as gsd:gsd:* when scanning plugin
directories.

Fixes gsd-build/get-shit-done#1389

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 01:16:44 -07:00
Tibsfox
9647c719c4 fix(slug): add --raw flag to generate-slug callers and cap length
add-backlog and thread commands called generate-slug without --raw,
capturing JSON output (with newlines) as the directory name. Also
cap slugs at 60 chars to prevent absurdly long directory names.

Fixes gsd-build/get-shit-done#1391

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 01:16:01 -07:00
Bantuson
9f45682aa3 fix: address adversarial review — tag name and verify-work gate
- gsd-security-auditor.md: replace <threat_register> with <threat_model>
  (stale tag name inconsistent with every other file in the PR)
- verify-work.md: parse threats_open from SECURITY.md frontmatter when
  file exists; block if > 0, matching execute-phase.md gate logic

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-26 08:21:03 +02:00
Tom Boucher
566d3cb287 Merge pull request #1385 from gsd-build/fix/autonomous-ui-phase-1375
fix: add ui-phase and ui-review to autonomous workflow
2026-03-25 15:09:10 -04:00
Tom Boucher
7a35c7319d fix: add ui-phase and ui-review steps to autonomous workflow
The autonomous workflow ran discuss -> plan -> execute per phase but
skipped ui-phase (design contract) and ui-review (visual audit) for
frontend phases. This adds two conditional steps that match the UI
detection logic already in plan-phase step 5.6:

- Step 3a.5: generates UI-SPEC before planning if frontend indicators
  are detected and no UI-SPEC exists
- Step 3d.5: runs advisory UI review after successful execution if a
  UI-SPEC is present

Both steps respect workflow.ui_phase and workflow.ui_review config
toggles and skip silently for non-frontend phases.

Fixes #1375

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-25 15:02:06 -04:00
Bantuson
2154e6bb07 feat: add security-first enforcement layer with threat-model-anchored verification
Adds /gsd:secure-phase command and gsd-security-auditor agent as a
threat-model-anchored security gate parallel to Nyquist validation.

New files:
- agents/gsd-security-auditor.md — verifies PLAN.md threat mitigations
  exist in implemented code; SECURED/OPEN_THREATS/ESCALATE returns
- commands/gsd/secure-phase.md — retroactive command, mirrors validate-phase
- get-shit-done/workflows/secure-phase.md — enforcing gate: threats_open > 0
  blocks phase advancement; accepted risks log prevents resurface
- get-shit-done/templates/SECURITY.md — per-phase threat register artifact

Modified:
- config.json — security_enforcement (absent=enabled), security_asvs_level,
  security_block_on parallel to nyquist_validation pattern
- VALIDATION.md — Threat Ref + Secure Behavior columns in verification map
- gsd-planner.md — <threat_model> block in PLAN.md format + quality gate
- gsd-executor.md — Rule 2 threat model reference + ## Threat Flags scan
- gsd-phase-researcher.md — ## Security Domain mandatory research section
- plan-phase.md — step 5.55 Security Threat Model Gate
- execute-phase.md — security gate announcement in aggregate step
- verify-work.md — /gsd:secure-phase surfaced in completion routing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-25 11:18:30 +02:00
Tom Boucher
ef290664cf Merge pull request #1372 from gsd-build/fix/agent-install-validation-1371
fix: detect missing GSD agents to prevent silent subagent_type fallback
2026-03-24 21:19:59 -04:00
Tom Boucher
bc352a66c0 fix: detect missing GSD agents and warn when subagent_type falls back to general-purpose
When GSD agents are not installed in .claude/agents/, Task(subagent_type="gsd-*")
silently falls back to general-purpose, losing specialized instructions, structured
outputs, and verification protocols.

What changed:
- Added checkAgentsInstalled() to core.cjs that validates all expected agents exist on disk
- All init commands now include agents_installed and missing_agents in their output
- Health check (validate health) reports W010 when agents are missing or incomplete
- New validate agents subcommand for standalone agent installation diagnostics

Fixes #1371

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 21:10:25 -04:00
Tom Boucher
7e41822706 Merge pull request #1370 from gsd-build/fix/begin-phase-preserves-fields-1365
fix: preserve Current Position fields during begin-phase
2026-03-24 19:27:37 -04:00
Tom Boucher
43d1787670 fix: preserve Status/LastActivity/Progress in Current Position during begin-phase
cmdStateBeginPhase replaced the entire ## Current Position section with only
Phase and Plan lines, destroying Status, Last activity, and Progress fields.
cmdStateAdvancePlan then failed to update these fields since they no longer
existed.

Now begin-phase updates individual lines within Current Position instead of
replacing the whole section. Also adds updateCurrentPositionFields helper so
advance-plan keeps the Current Position body in sync with bold frontmatter
fields.

Fixes #1365

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 19:25:14 -04:00
Noah Rasheta
41ee44ae92 docs: update repository references from glittercowboy to gsd-build
The repository was transferred from the glittercowboy org to gsd-build,
but several files still referenced the old org in URLs. This updates all
repository URL references across READMEs (all languages), package.json,
and the update workflow. Also removes a duplicate language selector in
the main README header.

Files intentionally unchanged:
- CHANGELOG.md (historical entries)
- CODEOWNERS, FUNDING.yml, SECURITY.md (reference @glittercowboy as a
  GitHub username/handle, not a repo URL)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 16:57:15 -06:00
Tom Boucher
db3eeb8fe4 feat: agent skill injection via config (#1355)
Add agent_skills config section that maps agent types to skill directory
paths. At spawn time, workflows load configured skills and inject them
as <agent_skills> blocks in Task() prompts, giving subagents access to
project-specific skill files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 16:47:40 -04:00
Tom Boucher
4ef309e0e4 Merge pull request #1364 from gsd-build/fix/workspace-project-root-1362
fix: workspace project_root resolves to child repo, not parent
2026-03-24 16:32:55 -04:00
Tom Boucher
c16b874aaa fix: findProjectRoot returns startDir when it already has .planning/
When cwd is a git repo inside a GSD workspace, findProjectRoot() walked
up and returned the workspace parent (which also has .planning/) instead
of the cwd itself. This caused all init commands to resolve project_root
to the workspace root, making phase/roadmap lookups fail with "Phase not
found" errors.

The fix adds an early return: if startDir already contains a .planning/
directory, it is the project root — no need to walk up to a parent.

Fixes #1362

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 15:59:42 -04:00
Tom Boucher
3b778f146f Merge pull request #1360 from gsd-build/fix/clear-agent-recognition-1357
fix: add <available_agent_types> to all agent-spawning workflows
2026-03-24 13:28:39 -04:00
Tom Boucher
b5738adcbf Merge pull request #1359 from gsd-build/fix/1356-frontmatter-must-haves-indent
fix: parseMustHavesBlock handles any YAML indentation width
2026-03-24 13:27:57 -04:00
Tom Boucher
0ce31ae882 fix: add <available_agent_types> to all workflows spawning named agents
PR #1139 added <available_agent_types> sections to execute-phase.md and
plan-phase.md to prevent /clear from causing silent fallback to
general-purpose. However, 14 other workflows and 2 commands that also
spawn named GSD agents were missed, leaving them vulnerable to the same
regression after /clear.

Added <available_agent_types> listing to: research-phase, quick,
audit-milestone, diagnose-issues, discuss-phase-assumptions,
execute-plan, map-codebase, new-milestone, new-project, ui-phase,
ui-review, validate-phase, verify-work (workflows) and debug,
research-phase (commands).

Added regression test that enforces every workflow/command spawning
named subagent_type must have a matching <available_agent_types>
section listing all spawned types.

Fixes #1357

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 13:17:18 -04:00
Tom Boucher
1d97626729 fix: parseMustHavesBlock now handles any YAML indentation width
The parser hardcoded 4/6/8/10-space indent levels for must_haves
sub-blocks, but standard YAML uses 2-space indentation. This caused
"No must_haves.key_links found in frontmatter" for valid plan files.

The fix dynamically detects the actual indent of must_haves: and its
sub-blocks instead of assuming fixed column positions.

Fixes #1356

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 13:16:10 -04:00
Tom Boucher
e03a9edd44 fix: replace invalid \Z regex anchor and remove redundant pattern
The original PR (#1337) used \Z in a JavaScript regex, which is a
Perl/Python/Ruby anchor — JavaScript interprets it as a literal match
for the character 'Z', silently truncating expected text containing
that letter. Replace with a two-pass approach: try next-key lookahead
first, fall back to greedy match to end-of-string.

Also remove the redundant `to=all:` pattern in sanitizeForDisplay()
since it is a subset of the existing `to=[^:\s]+:` pattern.

Add regression tests proving the Z-truncation bug and verifying
expected blocks at end-of-section parse correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 22:19:49 -04:00
Tom Boucher
763c6cc642 Merge pull request #1345 from gsd-build/fix/windows-shell-robustness-stdin-projectroot
fix: Windows hook stdin, workflow shell robustness, and project_root detection (#1343)
2026-03-23 20:28:31 -04:00
Tom Boucher
58c2b1f502 fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)
Address 4 root causes of Windows + Claude Code reliability issues:

1. Workflow shell robustness: add || true guards to informational commands
   (ls, grep, find, cat) that return non-zero on "no results", preventing
   workflow step failures under strict execution models. Guard glob loops
   with [ -e "$var" ] || continue to handle empty glob expansion.

2. Hook stdin handling: replace readFileSync('/dev/stdin') with async
   process.stdin + timeout in agent templates (gsd-verifier.md). Existing
   JS hooks already have timeout guards.

3. project_root detection: fix isInsideGitRepo() to check .git at the
   candidate parent level (not just below it), enabling correct detection
   when .git and .planning/ are siblings at the same directory level —
   the common single-repo case from a subdirectory.

4. @file: handoff: add missing @file: handlers to autonomous.md and
   manager.md workflows that call gsd-tools init but lacked the handler
   for large output payloads.

Fixes #1343

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 20:20:15 -04:00
Tom Boucher
a6939f135f fix: add permissionMode: acceptEdits to worktree agents (#1334)
Worktree agents (gsd-executor, gsd-debugger) prompt for edit permissions
on every new directory they touch, even when the user has "accept edits"
enabled. This is caused by Claude Code's directory-scoped permission
model not propagating to worktree paths.

Setting permissionMode: acceptEdits in the agent frontmatter tells Claude
Code to auto-approve file edits for these agents, bypassing the per-
directory prompts. This is safe because these agents are already granted
Write/Edit in their tools list and are spawned in isolated worktrees.

- Add permissionMode: acceptEdits to gsd-executor.md frontmatter
- Add permissionMode: acceptEdits to gsd-debugger.md frontmatter
- Add regression tests verifying worktree agents have the field
- Add test ensuring all isolation="worktree" spawns are covered

Upstream: anthropics/claude-code#29110, anthropics/claude-code#28041

Fixes #1334

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 14:05:33 -04:00
3metaJun
aaaa8e96fe Harden verify-work checkpoint rendering 2026-03-23 14:05:33 -04:00
monokoo
d908bfd4ad Modify codex command in review.md
Updated the codex command to include 'exec' and skip git repo check.
2026-03-23 14:05:33 -04:00
Tom Boucher
dbc5b2ab87 fix: expand brownfield project detection to cover Android, Kotlin, Gradle, and 15+ additional ecosystems
The code/package detection in cmdInitNewProject only recognized 7 file
extensions and 5 package files, missing Android (Kotlin + Gradle), Flutter
(Dart + pubspec.yaml), C/C++, C#, Ruby, PHP, Scala, and others. This caused
new-project to treat brownfield projects in those ecosystems as greenfield,
skipping the codebase mapping step.

Added 18 code extensions and 11 package/build files to the detection lists.

Fixes #1325

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 14:19:30 -04:00