golem15/msd-core
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,340 Commits 4 Branches 2 Tags
bb9c190ac8cc5010ee2e4e348261e1a29d5f4e2b
Commit Graph

5 Commits

Author SHA1 Message Date
Tom Boucher
62db008570 security: add prompt injection guards, path traversal prevention, and input validation 
Defense-in-depth security hardening for a codebase where markdown files become
LLM system prompts. Adds centralized security module, PreToolUse hook for
injection detection, and CI-ready codebase scan.

New files:
- security.cjs: path traversal prevention, prompt injection scanner/sanitizer,
  safe JSON parsing, field name validation, shell arg validation
- gsd-prompt-guard.js: PreToolUse hook scans .planning/ writes for injection
- security.test.cjs: 62 unit tests for all security functions
- prompt-injection-scan.test.cjs: CI scan of all agent/workflow/command files

Hardened code paths:
- readTextArgOrFile: path traversal guard (--prd, --text-file)
- cmdStateUpdate/Patch: field name validation prevents regex injection
- cmdCommit: sanitizeForPrompt strips invisible chars from commit messages
- gsd-tools --fields: safeJsonParse wraps unprotected JSON.parse
- cmdFrontmatterGet/Set: null byte rejection
- cmdVerifyPathExists: null byte rejection
- install.js: registers prompt guard hook, updates uninstaller

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-20 11:38:26 -04:00
0Shard
7156f02ed5 fix: semver 3+ segment parsing and CRLF frontmatter corruption recovery 
- fix(core): getMilestoneInfo() version regex `\d+\.\d+` only matched
  2-segment versions (v1.2). Changed to `\d+(?:\.\d+)+` to support
  3+ segments (v1.2.1, v2.0.1). Same fix in roadmap.cjs milestone
  extraction pattern.

- fix(state): stripFrontmatter() used `^---\n` (LF-only) which failed
  to strip CRLF frontmatter blocks. When STATE.md had dual frontmatter
  blocks from prior CRLF corruption, each writeStateMd() call preserved
  the stale block and prepended a new wrong one. Now handles CRLF and
  strips all stacked frontmatter blocks.

- fix(frontmatter): extractFrontmatter() always used the first ---
  block. When dual blocks exist from corruption, the first is stale.
  Now uses the last block (most recent sync).
 2026-03-17 17:18:48 +02:00
Tom Boucher
2842f076ea fix: CRLF frontmatter parsing, duplicate cwd crash, STATE.md phase transitions (#1105) 
- fix(frontmatter): handle CRLF line endings in extractFrontmatter,
  spliceFrontmatter, and parseMustHavesBlock — fixes wave parsing on
  Windows where all plans reported as wave 1 (#1085)

- fix(hooks): remove duplicate const cwd declaration in
  gsd-context-monitor.js that caused SyntaxError on every PostToolUse
  invocation (#1091, #1092, #1094)

- feat(state): add 'state begin-phase' command that updates STATUS,
  Last Activity, Current focus, Current Position, and plan counts
  when a new phase starts executing (#1102, #1103, #1104)

- docs(workflow): add state begin-phase call to execute-phase workflow
  validate_phase step so STATE.md is current from the start
 2026-03-16 13:40:21 -06:00
Tom Boucher
460f92e727 feat: normalize generated markdown for markdownlint compliance (#1112) 
Add normalizeMd() utility that fixes common markdownlint violations
in GSD-generated .planning/ files, improving IDE readability:

  MD022 — Blank lines around headings
  MD031 — Blank lines around fenced code blocks
  MD032 — Blank lines around lists
  MD012 — No multiple consecutive blank lines (collapsed to max 2)
  MD047 — Files end with a single newline

Applied at key write points:
  - state.cjs: writeStateMd() normalizes STATE.md on every write
  - frontmatter.cjs: frontmatter set/merge commands normalize output
  - template.cjs: template fill normalizes generated plan/summary files
  - milestone.cjs: MILESTONES.md archive writes normalized

Includes 14 new tests covering all rules, edge cases (CRLF, frontmatter,
ordered lists, code blocks, real-world STATE.md patterns).

Closes #1040
 2026-03-16 13:39:34 -06:00
Tyler Satre
c67ab759a7 refactor: split gsd-tools.cjs into 11 domain modules under bin/lib/ 
Break the 5324-line monolith into focused modules:
- core.cjs: shared utilities, constants, internal helpers
- frontmatter.cjs: YAML frontmatter parsing/serialization/CRUD
- state.cjs: STATE.md operations + progression engine
- phase.cjs: phase CRUD, query, and lifecycle
- roadmap.cjs: roadmap parsing and updates
- verify.cjs: verification suite + consistency/health validation
- config.cjs: config ensure/set/get
- template.cjs: template selection and fill
- milestone.cjs: milestone + requirements lifecycle
- commands.cjs: standalone utility commands
- init.cjs: compound init commands for workflow bootstrapping

gsd-tools.cjs is now a thin CLI router (~550 lines including
JSDoc) that imports from lib/ modules. All 81 tests pass.
Also updates package.json test script to point to tests/.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-20 10:40:45 -05:00