* test(#1488): add failing tests for methodology artifact type
- Test artifact-types.md exists with methodology type documented
- Test shape, lifecycle, location fields are present
- Test discuss-phase-assumptions.md consumes METHODOLOGY.md
- Test pause-work.md Required Reading includes METHODOLOGY.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(#1488): add methodology artifact type with consumption mechanisms
- Create get-shit-done/references/artifact-types.md documenting all GSD
artifact types including the new methodology type
- Methodology artifact: standing reference of named interpretive lenses,
located at .planning/METHODOLOGY.md, lifecycle Created → Active → Superseded
- Add load_methodology step to discuss-phase-assumptions.md so active lenses
are read before assumption analysis and applied to surfaced findings
- Add METHODOLOGY.md to pause-work.md Required Reading template so resuming
agents inherit the project's analytical orientation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(planner): add reachability_check step to prevent unreachable code
Closes#1495
* fix: trim gsd-planner.md below 50000-char limit after rebase
The reachability_check addition pushed the file to 50,275 chars when
merged with the assign_waves additions from #1600. Condense both sections
while preserving all logic; file is now 49,859 chars.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(security): normalize CRLF before prompt-stuffing length check
On Windows, git checks out files with CRLF line endings. JavaScript's
String.length counts \r characters, so a 49,859-byte file measures as
51,126 chars on Windows — falsely tripping the 50,000-char security
scanner. Normalize CRLF → LF before measuring in security.cjs and in
the reachability-check test.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: trim gsd-planner.md to stay under 50000-char limit after merge with main
After rebasing onto main (which added mcp_tool_usage block), combined content
reached 50031 chars. Remove suggested log format from assign_waves rule to
bring file to 49972 chars, well under the 50000-char security scanner limit.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(agents): explicitly instruct agents to use available MCP tools
GSD executor and planner agents were not mentioning available MCP servers
in their task instructions, causing subagents to skip Context7 and other
configured MCP tools even when available.
Closes#1388
* fix(tests): make copilot executor tool assertion dynamic
Hardcoded tools: ['read', 'edit', 'execute', 'search'] assertion broke
when mcp__context7__* was added to gsd-executor.md frontmatter. Replace
with per-tool presence checks so adding new tools never breaks the test.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a .clinerules file at the repo root so Cline (VS Code AI extension)
understands GSD's architecture, coding standards, and workflow constraints.
Closes#1509
When Playwright-MCP is available in the session, GSD UI verification
steps can be automated via screenshot comparison instead of manual
checkbox review. Falls back to manual flow when Playwright is not
configured.
Closes#1420
Analyzes ROADMAP.md phases for file overlap and semantic dependencies,
then suggests Depends on entries before running /gsd:manager. Complements
the files_modified overlap detection added in the executor (PR #1600).
Closes#1530
* ci: re-run CI with Windows pointer lifecycle fix in main
* fix: orchestrator owns STATE.md/ROADMAP.md writes in parallel worktree mode (#1571)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: correct STATE.md progress counter fields during plan/phase completion (#1589)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* ci: re-run CI with Windows pointer lifecycle fix in main
* fix: orchestrator owns STATE.md/ROADMAP.md writes in parallel worktree mode (#1571)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: detect files_modified overlap and enforce wave ordering for dependent plans (#1587)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: trim gsd-planner.md below 50000-char prompt-injection limit
The assign_waves section added in this branch pushed agents/gsd-planner.md
to 50271 chars, triggering the security scanner's prompt-stuffing check on
all CI platforms. Condense prose while preserving all logic and validation
rules; file is now 49754 chars.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
On Windows, path.resolve returns whatever case the caller supplied while
fs.realpathSync.native returns the OS-canonical case. These produce
different SHA-1 hashes and therefore different session tmpdir slots —
the test checks one slot while the implementation writes to another,
causing pointer lifecycle assertions to always fail.
Fix: use realpathSync.native with a fallback to path.resolve when the
planning directory does not yet exist.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: correct STATE.md progress counter fields during plan/phase completion (#1589)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* ci: re-run CI with Windows pointer lifecycle fix in main
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Copilot installs agent files as gsd-*.agent.md (not gsd-*.md), so
checkAgentsInstalled() always returned agents_installed=false for Copilot.
- checkAgentsInstalled() now recognises both .md and .agent.md formats
- getAgentsDir() respects GSD_AGENTS_DIR env override for testability
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: clear phases directory when creating new milestone (#1588)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* ci: re-run CI with Windows pointer lifecycle fix in main
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Explicitly check that the directory is empty before removing it rather
than relying on rmdirSync throwing ENOTEMPTY when siblings remain.
On Windows that error is not raised reliably, causing the session tmp
directory to be deleted prematurely when sibling pointer files exist.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Commit 512a80b changed new-project.md to use \$INSTRUCTION_FILE
(AGENTS.md for Codex, CLAUDE.md for all other runtimes) instead of
hardcoding CLAUDE.md. Two test assertions still checked for the
hardcoded string and failed on CI.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- fix(#1572): phase complete now marks bold-wrapped plan checkboxes in ROADMAP.md
(`- [ ] **01-01**` format) by allowing optional `**` around plan IDs in the
planCheckboxPattern regex in both phase.cjs and roadmap.cjs
- fix(#1569): manager init no longer recommends 999.x (BACKLOG) phases as next
actions; add guard in cmdManagerInit that skips phases matching /^999(?:\.|$)/
- fix(#1568): add regression tests confirming init execute-phase respects
model_overrides for executor_model, including when resolve_model_ids is 'omit'
- fix(#1533): reject session_id values containing path traversal sequences
(../, /, \) in gsd-context-monitor and gsd-statusline before constructing
/tmp file paths; add security tests covering both hooks
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Copilot agents use vscode_askquestions as the equivalent of AskUserQuestion.
Without explicit guidance they sometimes omit questioning steps that depend
on AskUserQuestion, causing extra billing and incomplete workflows.
- Add <runtime_note> to plan-phase, discuss-phase, execute-phase, and
new-project commands mapping vscode_askquestions to AskUserQuestion
- Add AskUserQuestion to plan-phase allowed-tools (was missing, causing
the planner orchestrator to skip user questions in some runtimes)
Closes#1476
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When EnterWorktree creates a branch from main instead of the current HEAD
(a known issue on Windows), executor agents now detect the mismatch and
reset their branch base to the correct commit before starting work.
- execute-phase: capture EXPECTED_BASE before spawning, inject
<worktree_branch_check> block into executor prompts
- execute-plan: document Pattern A worktree_branch_check requirement
- quick.md: inject worktree_branch_check into executor prompt
- diagnose-issues: inject worktree_branch_check into debugger prompts
- settings: add workflow.use_worktrees option so Windows users can
disable worktree isolation via /gsd:settings without editing files
Closes#1510
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Detect runtime from execution_context path or env vars at workflow start,
then set INSTRUCTION_FILE (AGENTS.md for Codex, CLAUDE.md for all others).
Pass --output $INSTRUCTION_FILE to generate-claude-md so the helper writes
to the correct file instead of always defaulting to CLAUDE.md.
Also add .codex to skipDirs in init.cjs so Codex runtime directories are
not mistaken for project content during brownfield codebase analysis.
Closes#1521
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- PR template: move "Closes #" to top as required field with explicit
warning that PRs without a linked issue are closed without review
- CONTRIBUTING.md: add mandatory issue-first policy with clear rationale
- Add require-issue-link.yml workflow: checks PR body for a closing
keyword (Closes/Fixes/Resolves #NNN) on open/edit/reopen/sync events;
posts a comment and fails CI if no reference is found
PR body is bound to an env var before shell use (injection-safe).
The github-script step uses the API SDK, not shell interpolation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The development installation instructions were missing the `npm run
build:hooks` step, which is required when installing from a git clone.
Without it, hooks/dist/ doesn't exist and the installer silently skips
hook copying while still registering them in settings.json, causing
hook errors at runtime.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove the unused JSONC helper and duplicate test export so the installer only keeps the shipped fixes. This closes the remaining code-level review feedback after the Kilo support sync.
Keep Kilo skill path rewrites consistent and avoid rewriting valid string-valued OpenCode permission configs while preserving resolved config-dir handling.
Addresses review feedback — checks if opencode output file is
non-empty after invocation, writes a failure message if empty
to prevent blank sections in REVIEWS.md.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove --copilot alias to avoid collision with existing Copilot concept
- Remove hardcoded model (-m) and variant flags; let user's OpenCode
config determine the model, consistent with other reviewer CLIs
- Use generic "OpenCode Review" section header since model varies by config
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Address review feedback: sanitize manager.flags values to allow only
CLI-safe tokens (--flag patterns and alphanumeric values). Invalid
tokens are dropped with a stderr warning. Prevents prompt injection
via compromised config.json.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds `manager.flags.{discuss,plan,execute}` config keys so users can
configure flags that /gsd:manager passes to each step when dispatching.
For example, `manager.flags.discuss: "--auto --analyze"` makes every
discuss dispatched from the manager include those flags.
Closes#1400
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds a new `audit_test_quality` step between `scan_antipatterns` and
`identify_human_verification` that catches test-level deceptions:
- Disabled tests (it.skip/xit/test.todo) covering phase requirements
- Circular tests (system generating its own expected values)
- Weak assertions (existence-only when value-level proof needed)
- Expected value provenance tracking for parity/migration phases
Any blocker from this audit forces `gaps_found` status, preventing
phases from being marked complete with inadequate test evidence.
Fixes#1457
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
