Commit Graph

1131 Commits

Author SHA1 Message Date
Tibsfox
3e8c8f6f39 feat(autonomous): add --only N flag for single-phase execution
Adds --only N flag to /gsd:autonomous that restricts execution to a
single phase, enabling safe parallel execution across terminals:

  Terminal 1: /gsd:autonomous --only 16
  Terminal 2: /gsd:autonomous --only 17
  Terminal 3: /gsd:autonomous --only 18

Changes:
- Step 1: Parse --only N alongside --from N (also sets FROM_PHASE)
- Step 2: Filter phase list to exact match when --only active
- Step 4: Skip iteration — single phase does not loop
- Step 5: Skip lifecycle — audit/complete/cleanup only for full runs
- Step 6: Resume message uses --only when active
- Success criteria updated with --only N requirements

Parallel safety: each phase operates in its own .planning/phases/NN-*
directory. ROADMAP.md and STATE.md are read-only during phase execution.

Closes #1383

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 01:21:04 -07:00
Tibsfox
18111f91c5 fix(next): remove reference to non-existent /gsd:complete-phase
The next.md workflow Route 5 referenced `/gsd:complete-phase` which
doesn't exist — only `/gsd:complete-milestone` does. After verify-work
completes for a phase, Route 6 handles advancement to the next phase
automatically, so the dangling reference is simply removed.

Closes #1441

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 00:22:11 -07:00
Tibsfox
447d17a9fc fix(todos): rename todos/done to todos/completed in workflows and docs
The CLI (commands.cjs, init.cjs) uses `todos/completed/` but three
workflow files and three FEATURES.md docs referenced `todos/done/`.
This caused completed todos to land in different directories depending
on whether the CLI command or the workflow instructions were followed.

Closes #1438

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 22:23:09 -07:00
j2h4u
655d455466 fix(verifier): enforce human_needed status when human verification items exist
The verifier agent could set status: passed even when the report contained
a non-empty "Human Verification Required" section. This bypassed the
human_needed → HUMAN-UAT.md → user approval gate, allowing phases to be
marked complete without human testing.

Replace the advisory status descriptions with an ordered decision tree
(most restrictive first): gaps_found → human_needed → passed. The passed
status is now only valid when zero human verification items exist.

Synced the same decision tree in the verify-phase workflow.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 01:16:43 +05:00
Tibsfox
c1fd72f81f fix(branching): capture decimal phase numbers in commit regex
The phase-extraction regex /(\d+)-/ only matched the last integer
segment before a dash, so decimal phases like 45.14 were misresolved
to phase 14 — silently switching to the wrong branch.

Closes #1402

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 19:42:19 -07:00
Brandon Higgins
1f34965717 feat: add project_code config for phase directory prefixing
When project_code is set (e.g., "CK"), phase directories are prefixed
with the code: CK-01-foundation, CK-02-api, etc. This disambiguates
phases across multiple GSD projects in the same session.

Changes:
- Add project_code to VALID_CONFIG_KEYS and buildNewProjectConfig defaults
- Add project_code to loadConfig in core.cjs
- Prepend prefix in cmdPhaseAdd and cmdPhaseInsert
- Update searchPhaseInDir, cmdFindPhase, comparePhaseNum, and
  normalizePhaseName to strip prefix before matching/sorting
- Support {project} placeholder in git.phase_branch_template
- Add 4 tests covering prefixed add, null code, find, and sort

Closes #1019

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 08:43:05 -06:00
Tibsfox
b5cbd47373 fix(commands): remove duplicate workstreams.md from plugin directory
get-shit-done/commands/gsd/workstreams.md was identical to
commands/gsd/workstreams.md, causing Claude Code to register
every gsd:* command twice as gsd:gsd:* when scanning plugin
directories.

Fixes gsd-build/get-shit-done#1389

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 01:16:44 -07:00
Tibsfox
9647c719c4 fix(slug): add --raw flag to generate-slug callers and cap length
add-backlog and thread commands called generate-slug without --raw,
capturing JSON output (with newlines) as the directory name. Also
cap slugs at 60 chars to prevent absurdly long directory names.

Fixes gsd-build/get-shit-done#1391

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 01:16:01 -07:00
Bantuson
9f45682aa3 fix: address adversarial review — tag name and verify-work gate
- gsd-security-auditor.md: replace <threat_register> with <threat_model>
  (stale tag name inconsistent with every other file in the PR)
- verify-work.md: parse threats_open from SECURITY.md frontmatter when
  file exists; block if > 0, matching execute-phase.md gate logic

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-26 08:21:03 +02:00
Tom Boucher
566d3cb287 Merge pull request #1385 from gsd-build/fix/autonomous-ui-phase-1375
fix: add ui-phase and ui-review to autonomous workflow
2026-03-25 15:09:10 -04:00
Tom Boucher
7a35c7319d fix: add ui-phase and ui-review steps to autonomous workflow
The autonomous workflow ran discuss -> plan -> execute per phase but
skipped ui-phase (design contract) and ui-review (visual audit) for
frontend phases. This adds two conditional steps that match the UI
detection logic already in plan-phase step 5.6:

- Step 3a.5: generates UI-SPEC before planning if frontend indicators
  are detected and no UI-SPEC exists
- Step 3d.5: runs advisory UI review after successful execution if a
  UI-SPEC is present

Both steps respect workflow.ui_phase and workflow.ui_review config
toggles and skip silently for non-frontend phases.

Fixes #1375

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-25 15:02:06 -04:00
Bantuson
2154e6bb07 feat: add security-first enforcement layer with threat-model-anchored verification
Adds /gsd:secure-phase command and gsd-security-auditor agent as a
threat-model-anchored security gate parallel to Nyquist validation.

New files:
- agents/gsd-security-auditor.md — verifies PLAN.md threat mitigations
  exist in implemented code; SECURED/OPEN_THREATS/ESCALATE returns
- commands/gsd/secure-phase.md — retroactive command, mirrors validate-phase
- get-shit-done/workflows/secure-phase.md — enforcing gate: threats_open > 0
  blocks phase advancement; accepted risks log prevents resurface
- get-shit-done/templates/SECURITY.md — per-phase threat register artifact

Modified:
- config.json — security_enforcement (absent=enabled), security_asvs_level,
  security_block_on parallel to nyquist_validation pattern
- VALIDATION.md — Threat Ref + Secure Behavior columns in verification map
- gsd-planner.md — <threat_model> block in PLAN.md format + quality gate
- gsd-executor.md — Rule 2 threat model reference + ## Threat Flags scan
- gsd-phase-researcher.md — ## Security Domain mandatory research section
- plan-phase.md — step 5.55 Security Threat Model Gate
- execute-phase.md — security gate announcement in aggregate step
- verify-work.md — /gsd:secure-phase surfaced in completion routing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-25 11:18:30 +02:00
Tom Boucher
ef290664cf Merge pull request #1372 from gsd-build/fix/agent-install-validation-1371
fix: detect missing GSD agents to prevent silent subagent_type fallback
2026-03-24 21:19:59 -04:00
Tom Boucher
bc352a66c0 fix: detect missing GSD agents and warn when subagent_type falls back to general-purpose
When GSD agents are not installed in .claude/agents/, Task(subagent_type="gsd-*")
silently falls back to general-purpose, losing specialized instructions, structured
outputs, and verification protocols.

What changed:
- Added checkAgentsInstalled() to core.cjs that validates all expected agents exist on disk
- All init commands now include agents_installed and missing_agents in their output
- Health check (validate health) reports W010 when agents are missing or incomplete
- New validate agents subcommand for standalone agent installation diagnostics

Fixes #1371

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 21:10:25 -04:00
Tom Boucher
7e41822706 Merge pull request #1370 from gsd-build/fix/begin-phase-preserves-fields-1365
fix: preserve Current Position fields during begin-phase
2026-03-24 19:27:37 -04:00
Tom Boucher
43d1787670 fix: preserve Status/LastActivity/Progress in Current Position during begin-phase
cmdStateBeginPhase replaced the entire ## Current Position section with only
Phase and Plan lines, destroying Status, Last activity, and Progress fields.
cmdStateAdvancePlan then failed to update these fields since they no longer
existed.

Now begin-phase updates individual lines within Current Position instead of
replacing the whole section. Also adds updateCurrentPositionFields helper so
advance-plan keeps the Current Position body in sync with bold frontmatter
fields.

Fixes #1365

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 19:25:14 -04:00
Noah Rasheta
41ee44ae92 docs: update repository references from glittercowboy to gsd-build
The repository was transferred from the glittercowboy org to gsd-build,
but several files still referenced the old org in URLs. This updates all
repository URL references across READMEs (all languages), package.json,
and the update workflow. Also removes a duplicate language selector in
the main README header.

Files intentionally unchanged:
- CHANGELOG.md (historical entries)
- CODEOWNERS, FUNDING.yml, SECURITY.md (reference @glittercowboy as a
  GitHub username/handle, not a repo URL)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 16:57:15 -06:00
Tom Boucher
db3eeb8fe4 feat: agent skill injection via config (#1355)
Add agent_skills config section that maps agent types to skill directory
paths. At spawn time, workflows load configured skills and inject them
as <agent_skills> blocks in Task() prompts, giving subagents access to
project-specific skill files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 16:47:40 -04:00
Tom Boucher
4ef309e0e4 Merge pull request #1364 from gsd-build/fix/workspace-project-root-1362
fix: workspace project_root resolves to child repo, not parent
2026-03-24 16:32:55 -04:00
Tom Boucher
c16b874aaa fix: findProjectRoot returns startDir when it already has .planning/
When cwd is a git repo inside a GSD workspace, findProjectRoot() walked
up and returned the workspace parent (which also has .planning/) instead
of the cwd itself. This caused all init commands to resolve project_root
to the workspace root, making phase/roadmap lookups fail with "Phase not
found" errors.

The fix adds an early return: if startDir already contains a .planning/
directory, it is the project root — no need to walk up to a parent.

Fixes #1362

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 15:59:42 -04:00
Tom Boucher
3b778f146f Merge pull request #1360 from gsd-build/fix/clear-agent-recognition-1357
fix: add <available_agent_types> to all agent-spawning workflows
2026-03-24 13:28:39 -04:00
Tom Boucher
b5738adcbf Merge pull request #1359 from gsd-build/fix/1356-frontmatter-must-haves-indent
fix: parseMustHavesBlock handles any YAML indentation width
2026-03-24 13:27:57 -04:00
Tom Boucher
0ce31ae882 fix: add <available_agent_types> to all workflows spawning named agents
PR #1139 added <available_agent_types> sections to execute-phase.md and
plan-phase.md to prevent /clear from causing silent fallback to
general-purpose. However, 14 other workflows and 2 commands that also
spawn named GSD agents were missed, leaving them vulnerable to the same
regression after /clear.

Added <available_agent_types> listing to: research-phase, quick,
audit-milestone, diagnose-issues, discuss-phase-assumptions,
execute-plan, map-codebase, new-milestone, new-project, ui-phase,
ui-review, validate-phase, verify-work (workflows) and debug,
research-phase (commands).

Added regression test that enforces every workflow/command spawning
named subagent_type must have a matching <available_agent_types>
section listing all spawned types.

Fixes #1357

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 13:17:18 -04:00
Tom Boucher
1d97626729 fix: parseMustHavesBlock now handles any YAML indentation width
The parser hardcoded 4/6/8/10-space indent levels for must_haves
sub-blocks, but standard YAML uses 2-space indentation. This caused
"No must_haves.key_links found in frontmatter" for valid plan files.

The fix dynamically detects the actual indent of must_haves: and its
sub-blocks instead of assuming fixed column positions.

Fixes #1356

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 13:16:10 -04:00
Tom Boucher
e03a9edd44 fix: replace invalid \Z regex anchor and remove redundant pattern
The original PR (#1337) used \Z in a JavaScript regex, which is a
Perl/Python/Ruby anchor — JavaScript interprets it as a literal match
for the character 'Z', silently truncating expected text containing
that letter. Replace with a two-pass approach: try next-key lookahead
first, fall back to greedy match to end-of-string.

Also remove the redundant `to=all:` pattern in sanitizeForDisplay()
since it is a subset of the existing `to=[^:\s]+:` pattern.

Add regression tests proving the Z-truncation bug and verifying
expected blocks at end-of-section parse correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 22:19:49 -04:00
Tom Boucher
763c6cc642 Merge pull request #1345 from gsd-build/fix/windows-shell-robustness-stdin-projectroot
fix: Windows hook stdin, workflow shell robustness, and project_root detection (#1343)
2026-03-23 20:28:31 -04:00
Tom Boucher
58c2b1f502 fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)
Address 4 root causes of Windows + Claude Code reliability issues:

1. Workflow shell robustness: add || true guards to informational commands
   (ls, grep, find, cat) that return non-zero on "no results", preventing
   workflow step failures under strict execution models. Guard glob loops
   with [ -e "$var" ] || continue to handle empty glob expansion.

2. Hook stdin handling: replace readFileSync('/dev/stdin') with async
   process.stdin + timeout in agent templates (gsd-verifier.md). Existing
   JS hooks already have timeout guards.

3. project_root detection: fix isInsideGitRepo() to check .git at the
   candidate parent level (not just below it), enabling correct detection
   when .git and .planning/ are siblings at the same directory level —
   the common single-repo case from a subdirectory.

4. @file: handoff: add missing @file: handlers to autonomous.md and
   manager.md workflows that call gsd-tools init but lacked the handler
   for large output payloads.

Fixes #1343

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 20:20:15 -04:00
Tom Boucher
a6939f135f fix: add permissionMode: acceptEdits to worktree agents (#1334)
Worktree agents (gsd-executor, gsd-debugger) prompt for edit permissions
on every new directory they touch, even when the user has "accept edits"
enabled. This is caused by Claude Code's directory-scoped permission
model not propagating to worktree paths.

Setting permissionMode: acceptEdits in the agent frontmatter tells Claude
Code to auto-approve file edits for these agents, bypassing the per-
directory prompts. This is safe because these agents are already granted
Write/Edit in their tools list and are spawned in isolated worktrees.

- Add permissionMode: acceptEdits to gsd-executor.md frontmatter
- Add permissionMode: acceptEdits to gsd-debugger.md frontmatter
- Add regression tests verifying worktree agents have the field
- Add test ensuring all isolation="worktree" spawns are covered

Upstream: anthropics/claude-code#29110, anthropics/claude-code#28041

Fixes #1334

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 14:05:33 -04:00
3metaJun
aaaa8e96fe Harden verify-work checkpoint rendering 2026-03-23 14:05:33 -04:00
monokoo
d908bfd4ad Modify codex command in review.md
Updated the codex command to include 'exec' and skip git repo check.
2026-03-23 14:05:33 -04:00
Tom Boucher
dbc5b2ab87 fix: expand brownfield project detection to cover Android, Kotlin, Gradle, and 15+ additional ecosystems
The code/package detection in cmdInitNewProject only recognized 7 file
extensions and 5 package files, missing Android (Kotlin + Gradle), Flutter
(Dart + pubspec.yaml), C/C++, C#, Ruby, PHP, Scala, and others. This caused
new-project to treat brownfield projects in those ecosystems as greenfield,
skipping the codebase mapping step.

Added 18 code extensions and 11 package/build files to the detection lists.

Fixes #1325

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 14:19:30 -04:00
Tom Boucher
d86c3a9e35 fix: list OpenCode as runtime with Task tool support in map-codebase
OpenCode has a `task` tool that supports spawning subagents, but
map-codebase workflow incorrectly listed it under "Runtimes WITHOUT
Task tool". This caused the agent to skip parallel mapping and fall
back to sequential mode, wasting tokens when it self-corrected.

Move OpenCode to the "with Task tool" list and clarify that either
`Task` or `task` (case-insensitive) qualifies. Add regression test.

Fixes #1316

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 11:27:59 -04:00
Ghadi Saab
a74e6b1e94 fix: add text_mode support to plan-phase workflow
`workflow.text_mode: true` (or `--text` flag) now applies to
plan-phase, not just discuss-phase. Fixes #1313.

Changes:
- `init plan-phase` now exposes `text_mode` from config in its JSON output
- plan-phase workflow parses `--text` flag and resolves TEXT_MODE from
  init JSON or flag, whichever is set
- All four AskUserQuestion call sites (no-context gate, research prompt,
  UI design contract gate, requirements coverage gap) now conditionally
  present as plain-text numbered lists when TEXT_MODE is active
- `--text` added to plan-phase command argument-hint and flags docs
- Tests added for init output and workflow references

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-22 11:21:43 -04:00
Tom Boucher
5eb3c04bce fix: respect .planning/ in linked worktrees before resolving to main repo
resolveWorktreeRoot() unconditionally resolved linked worktrees to the main
repo root. When a linked worktree has its own independent .planning/ directory
(e.g., Conductor workspaces), all GSD commands read/wrote the wrong planning
state. Add an early return that checks for a local .planning/ before falling
through to main repo resolution.

The caller in gsd-tools.cjs already had this guard (added in #1283), but the
function itself should be correct regardless of call site. This is defense-in-
depth for any future callers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 10:58:24 -04:00
Tom Boucher
7c762058e1 fix: address post-merge review concerns from PR #1268
Three non-blocking findings from the adversarial re-review of the
workstream namespacing PR, addressed as a follow-up:

1. setActiveWorkstream now validates names with the same regex used
   at CLI entry and cmdWorkstreamSet — defense-in-depth so future
   callers can't poison the active-workstream file

2. Replaced tautological test assertion (result.success || !result.success
   was always true) with actual validation that cmdWorkstreamSet returns
   invalid_name error for path traversal attempts. Added 8 new tests
   for setActiveWorkstream's own validation.

3. Updated stale comment in copilot-install.test.cjs (said 31, actual 56)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 10:47:55 -04:00
Tom Boucher
dafb4a9816 Merge pull request #1268 from SalesTeamToolbox/workstreams-v2
feat: workstream namespacing for parallel Claude Code instances
2026-03-22 10:42:45 -04:00
Tom Boucher
aeec10acf9 Merge pull request #1319 from gsd-build/fix/enforce-worktree-isolation-agents
fix: enforce worktree isolation for code-writing agents
2026-03-22 10:41:35 -04:00
Tom Boucher
8380f31e16 fix: enforce worktree isolation for code-writing agents
All code-writing agents (gsd-executor, gsd-debugger) were dispatched
without isolation: "worktree", causing branch pollution when agents
switched branches in the shared working tree during concurrent work.

Added isolation="worktree" to all Task() dispatch sites:
- execute-phase.md: executor agent dispatch
- execute-plan.md: Pattern A executor reference
- quick.md: quick task executor dispatch
- diagnose-issues.md: debugger agent dispatch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 10:31:55 -04:00
Tom Boucher
9e592e1558 Merge pull request #1318 from gsd-build/feat/ui-phase-detection-1312
feat: auto-detect UI-heavy phases and surface /gsd:ui-phase
2026-03-22 10:20:57 -04:00
Tom Boucher
d93bbb5bb2 feat(workflow): surface /gsd:ui-phase recommendation for UI-heavy phases
- new-project Step 9: suggest /gsd:ui-phase when Phase 1 has UI hint
- progress Route B: show /gsd:ui-phase in options when current phase has UI
- progress Route C: show /gsd:ui-phase in options when next phase has UI
- Detection uses **UI hint**: yes annotation from roadmapper output

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 10:17:20 -04:00
Tom Boucher
0a1820e177 Merge pull request #1311 from gsd-build/docs/non-claude-model-profiles-1310
docs: clarify model profiles for non-Claude runtimes
2026-03-22 03:15:24 -04:00
Tom Boucher
d478e7f485 docs: clarify model profile setup for non-Claude runtimes
Document resolve_model_ids: "omit" (set automatically by installer for
non-Claude runtimes), explain model_overrides with non-Claude model IDs,
and add a decision table for choosing between inherit, omit, and
overrides. Updates CONFIGURATION.md, USER-GUIDE.md, and the
model-profiles.md skill reference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 03:05:36 -04:00
Tom Boucher
2205a855ef Merge pull request #1305 from gsd-build/feat/forensics-1303
feat: add /gsd:forensics — post-mortem workflow investigation
2026-03-21 18:30:46 -04:00
Tom Boucher
ee219e7726 fix: address review findings on forensics PR #1305
1. Resolve read-only contradiction: critical_rules now explicitly allows
   STATE.md session tracking alongside the forensic report write
2. Add label existence check before gh issue create --label "bug" to
   handle repos without a "bug" label gracefully

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 18:21:41 -04:00
SalesTeamToolbox
1ad5ab8097 fix: use planningRoot in setActiveWorkstream and add path traversal tests
Address review feedback on PR #1268:
- setActiveWorkstream now uses planningRoot(cwd) instead of hardcoded
  path, matching getActiveWorkstream for consistency
- Add 33 path traversal rejection tests covering all entry points:
  CLI --ws flag, GSD_WORKSTREAM env var, cmdWorkstreamSet, and
  poisoned active-workstream file

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 15:21:13 -07:00
SalesTeamToolbox
415a094d26 refactor: add parseMultiwordArg helper and fix scaffold/milestone arg parsing
Add parseMultiwordArg() to collect multi-token --flag values until the next
flag. Replace manual name-collection loops in milestone complete and scaffold
cases. Also fixes a bug in scaffold where args.slice() would include trailing
flags in the name value.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-21 15:21:13 -07:00
SalesTeamToolbox
5f95fea4d7 refactor: extract shared utilities to reduce duplication across codebase
- core.cjs: add filterPlanFiles, filterSummaryFiles, getPhaseFileStats,
  readSubdirectories helpers; use them in searchPhaseInDir and getArchivedPhaseDirs
- gsd-tools.cjs: add parseNamedArgs() helper; replace ~50 repetitive indexOf/ternary
  patterns in state record-metric, add-decision, add-blocker, record-session,
  begin-phase, signal-waiting, template fill, and frontmatter subcommands
- phase.cjs: decompose 250-line cmdPhaseRemove into renameDecimalPhases(),
  renameIntegerPhases(), and updateRoadmapAfterPhaseRemoval(); import readSubdirectories
- workstream.cjs: import stateExtractField from state.cjs and shared helpers from
  core.cjs; replace all inline regex state parsing and readdirSync+filter+map patterns

All 1062 tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-21 15:21:13 -07:00
SalesTeamToolbox
e3a427252d fix: prevent path traversal via workstream name sanitization
Validates workstream name at all entry points — CLI --ws flag,
GSD_WORKSTREAM env var, active-workstream file, and cmdWorkstreamSet —
blocking names that don't match [a-zA-Z0-9_-]+. Also fixes
getActiveWorkstream to use planningRoot() consistently and validates
names read from the active-workstream file before using them in path
joins.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-21 15:21:13 -07:00
SalesTeamToolbox
c83b69bbb5 feat: workstream namespacing for parallel milestone work
Enable multiple Claude Code instances to work on the same codebase
simultaneously by scoping .planning/ state into workstreams.

Core changes:
- planningDir(cwd, ws?) and planningPaths(cwd, ws?) are now workstream-aware
  via GSD_WORKSTREAM env var (auto-detected from --ws flag or active-workstream file)
- All bin/lib modules use planningDir(cwd) for scoped paths (STATE.md, ROADMAP.md,
  phases/, REQUIREMENTS.md) and planningRoot(cwd) for shared paths (milestones/,
  PROJECT.md, config.json, codebase/)
- New workstream.cjs module: create, list, status, complete, set, get, progress
- gsd-tools.cjs: --ws flag parsing with priority chain
  (--ws > GSD_WORKSTREAM env > active-workstream file > flat mode)
- Collision detection: transition.md checks for other active workstreams before
  suggesting next-milestone continuation (prevents WS A from trampling WS B)
- ${GSD_WS} routing propagation across all 9 workflow files ensures workstream
  scope chains automatically through the workflow lifecycle

New files:
- get-shit-done/bin/lib/workstream.cjs (CRUD + collision detection)
- get-shit-done/commands/gsd/workstreams.md (slash command)
- get-shit-done/references/workstream-flag.md (documentation)
- tests/workstream.test.cjs (20 tests covering CRUD, env var routing, --ws flag)

All 1062 tests passing (1042 existing + 20 new workstream tests).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 15:21:13 -07:00
Tom Boucher
2b31a8d3e1 feat: add workflow.skip_discuss setting to bypass discuss-phase in autonomous mode
When enabled, /gsd:autonomous chains directly from plan-phase to execute-phase,
skipping smart discuss. A minimal CONTEXT.md is auto-generated from the ROADMAP
phase goal so downstream agents have valid input. Manual /gsd:discuss-phase still
works regardless of the setting.

Changes:
- config.cjs: add workflow.skip_discuss to VALID_CONFIG_KEYS and hardcoded defaults (false)
- autonomous.md: check workflow.skip_discuss before smart_discuss, write minimal CONTEXT.md when skipping
- settings.md: add Skip Discuss toggle to interactive settings UI and global defaults
- config.test.cjs: 6 regression tests for the new config key

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 18:13:31 -04:00