3 Commits

Author	SHA1	Message	Date
Lex Christopherson	f53011c9e2	fix(#429): prevent API keys from being committed via map-codebase ... Defense-in-depth approach: Layer 1 - Prevention: - Add <forbidden_files> section to gsd-codebase-mapper agent - Explicitly prohibit reading .env, credentials, keys, secrets - Agent can note file existence but never quote contents Layer 2 - Detection: - Add scan_for_secrets step before commit in map-codebase workflow - Regex patterns catch: sk-*, ghp_*, AKIA*, xox*-*, JWTs, private keys - Halts with alert if secrets detected, requires user confirmation Layer 3 - Documentation: - Add Security section to README - Document Claude Code deny rules for sensitive files - Recommend defense-in-depth approach Closes #429 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-05 13:13:22 -06:00
Lex Christopherson	8251879aab	refactor: remove /gsd:execute-plan command ... /gsd:execute-phase handles single and multiple plans. All references updated to use execute-phase. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-16 17:16:42 -06:00
Lex Christopherson	411b5a369b	feat(gsd): add dedicated codebase mapper agent ... Reduces context exhaustion during /gsd:map-codebase by having agents write documents directly instead of returning findings to orchestrator. - Create gsd-codebase-mapper agent with embedded templates - Agent understands downstream consumers (plan-phase, execute-plan) - Parameterized by focus: tech, arch, quality, concerns - Each focus writes specific documents directly to .planning/codebase/ - Orchestrator receives only confirmation + line counts Context savings: ~40 lines returned vs potentially thousands of lines of exploration findings previously transferred back to orchestrator. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-15 17:16:02 -06:00