Commit Graph

159 Commits

Author SHA1 Message Date
Logan
fbf30792f3 docs: authoritative shipped-surface inventory with filesystem-backed parity tests (#2390)
* docs: finish trust-bug fixes in user guide and commands

Correct load-bearing defects in the v1.36.0 docs corpus so readers stop
acting on wrong defaults and stale exhaustiveness claims.

- README.md: drop "Complete feature"/"Every command"/"All 18 agents"
  exhaustiveness claims; replace version-pinned "What's new in v1.32"
  bullet with a CHANGELOG pointer.
- CONFIGURATION.md: fix `claude_md_path` default (null/none -> `./CLAUDE.md`)
  in both Full Schema and core settings table; correct `workflow.tdd_mode`
  provenance from "Added in v1.37" to "Added in v1.36".
- USER-GUIDE.md: fix `workflow.discuss_mode` default (`standard` ->
  `discuss`) in the workflow-toggles table AND in the abbreviated Full
  Schema JSON block above it; align the Options cell with the shipped
  enum.
- COMMANDS.md: drop "Complete command syntax" subtitle overclaim to
  match the README posture.
- AGENTS.md: weaken "All 21 specialized agents" header to reflect that
  the `agents/` filesystem is authoritative (shipped roster is 31).

Part 1 of a stacked docs refresh series (PR 1/4).

* docs: refresh shipped surface coverage for v1.36

Close the v1.36.0 shipped-surface gaps in the docs corpus.

- COMMANDS.md: add /gsd-graphify section (build/query/status/diff) and
  its config gate; expand /gsd-quick with --validate flag and list/
  status/resume subcommands; expand /gsd-thread with list --open, list
  --resolved, close <slug>, status <slug>.
- CLI-TOOLS.md: replace the hardcoded "15 domain modules" count with a
  pointer to the Module Architecture table; add a graphify verb-family
  section (build/query/status/diff/snapshot); add Graphify and Learnings
  rows to the Module Architecture table.
- FEATURES.md: add TOC entries for #116 TDD Pipeline Mode and #117
  Knowledge Graph Integration; add the #117 body with REQ-GRAPH-01..05.
- CONFIGURATION.md: move security_enforcement / security_asvs_level /
  security_block_on from root into `workflow.*` in Full Schema to match
  templates/config.json and the gsd-sdk runtime reads; update Security
  Settings table to use the workflow.* prefix; add planning.sub_repos
  to Full Schema and description table; add a Graphify Settings section
  documenting graphify.enabled and graphify.build_timeout.

Note: VALID_CONFIG_KEYS in bin/lib/config.cjs does not yet include
workflow.security_* or planning.sub_repos, so config-set currently
rejects them. That is a pre-existing validator gap that this PR does
not attempt to fix; the docs now correctly describe where these keys
live per the shipped template and runtime reads.

Part 2 of a stacked docs refresh series (PR 2/5), based on PR 1.

* docs: make inventory authoritative and reconcile architecture

Upgrade docs/INVENTORY.md from "complete for agents, selective for others"
to authoritative across all six shipped-surface families, and reconcile
docs/ARCHITECTURE.md against the new inventory so the PR that introduces
INVENTORY does not also introduce an INVENTORY/ARCHITECTURE contradiction.

- docs/AGENTS.md: weaken "21 specialized agents" header to 21 primary +
  10 advanced (31 shipped); add new "Advanced and Specialized Agents"
  section with concise role cards for the 10 previously-omitted shipped
  agents (pattern-mapper, debug-session-manager, code-reviewer,
  code-fixer, ai-researcher, domain-researcher, eval-planner,
  eval-auditor, framework-selector, intel-updater); footnote the Agent
  Tool Permissions Summary as primary-agents-only so it no longer
  misleads.

- docs/INVENTORY.md (rewritten to be authoritative):
  * Full 31-agent roster with one-line role + spawner + primary-doc
    status per agent (unchanged from prior partial work).
  * Commands: full 75-row enumeration grouped by Core Workflow, Phase &
    Milestone Management, Session & Navigation, Codebase Intelligence,
    Review/Debug/Recovery, and Docs/Profile/Utilities — each row
    carries a one-line role derived from the command's frontmatter and
    a link to the source file.
  * Workflows: full 72-row enumeration covering every
    get-shit-done/workflows/*.md, with a one-line role per workflow and
    a column naming the user-facing command (or internal orchestrator)
    that invokes it.
  * References: full 41-row enumeration grouped by Core, Workflow,
    Thinking-Model clusters, and the Modular Planner decomposition,
    matching the groupings docs/ARCHITECTURE.md already uses; notes
    the few-shot-examples subdirectory separately.
  * CLI Modules and Hooks: unchanged — already full rosters.
  * Maintenance section rewritten to describe the drift-guard test
    suite that will land in PR4 (inventory-counts, commands-doc-parity,
    agents-doc-parity, cli-modules-doc-parity, hooks-doc-parity).

- docs/ARCHITECTURE.md reconciled against INVENTORY:
  * References block: drop the stale "(35 total)" count; point at
    INVENTORY.md#references-41-shipped for the authoritative count.
  * CLI Tools block: drop the stale "19 domain modules" count; point
    at INVENTORY.md#cli-modules-24-shipped for the authoritative roster.
  * Agent Spawn Categories: relabel as "Primary Agent Spawn Categories"
    and add a footer naming the 10 advanced agents and pointing at
    INVENTORY.md#agents-31-shipped for the full 31-agent roster.

- docs/CONFIGURATION.md: preserve the six model-profile rows added in
  the prior partial work, and tighten the fallback note so it names the
  13 shipped agents without an explicit profile row, documents
  model_overrides as the escape hatch, and points at INVENTORY.md for
  the authoritative 31-agent roster.

Part 3 of a stacked docs refresh series (PR 3/4). Remaining consistency
work (USER-GUIDE config-section delete-and-link, FEATURES.md TOC
reorder, ARCHITECTURE.md Hook-table expansion + installation-layout
collapse, CLI-TOOLS.md module-row additions, workflow-discuss-mode
invocation normalization, and the five doc-parity tests) lands in PR4.

* test(docs): add consistency guards and remove duplicate refs

Consolidates USER-GUIDE.md's command/config duplicates into pointers to
COMMANDS.md and CONFIGURATION.md (kills a ghost `resolve_model_ids` key
and a stale `discuss_mode: standard` default); reorders FEATURES.md TOC
chronologically so v1.32 precedes v1.34/1.35/1.36; expands
ARCHITECTURE.md's Hook table to the 11 shipped hooks
(gsd-read-injection-scanner, gsd-check-update-worker) and collapses
the installation-layout hook enumeration to the *.js/*.sh pattern form;
adds audit/gsd2-import/intel rows and state signal-*, audit-open,
from-gsd2 verbs to CLI-TOOLS.md; normalizes workflow-discuss-mode.md
invocations to `node gsd-tools.cjs config-set`.

Adds five drift guards anchored on docs/INVENTORY.md as the
authoritative roster: inventory-counts (all six families),
commands/agents/cli-modules/hooks parity checks that every shipped
surface has a row somewhere.

* fix(convergence): thread --ws to review agent; add stall and max-cycles behavioral tests

- Thread GSD_WS through to review agent spawn in plan-review-convergence
  workflow (step 5a) so --ws scoping is symmetric with planning step
- Add behavioral stall detection test: asserts workflow compares
  HIGH_COUNT >= prev_high_count and emits a stall warning
- Add behavioral --max-cycles 1 test: asserts workflow reaches escalation
  gate when cycle >= MAX_CYCLES with HIGH > 0 after a single cycle
- Include original PR files (commands, workflow, tests) as the branch
  predated the PR commits

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(docs,config): PR #2390 review — security_* config keys and REQ-GRAPH-02 scope

Addresses trek-e's review items that don't require rebase:

- config.cjs: add workflow.security_enforcement, workflow.security_asvs_level,
  workflow.security_block_on to VALID_CONFIG_KEYS so gsd-sdk config-set accepts
  them (closed the gap where docs/CONFIGURATION.md listed keys the validator
  rejected).
- core.cjs: add matching CONFIG_DEFAULTS entries (true / 1 / 'high') so the
  canonical defaults table matches the documented values.
- config.cjs: wire the three keys into the new-project workflow defaults so
  fresh configs inherit them.
- planning-config.md: document the three keys in the Workflow Fields table,
  keeping the CONFIG_DEFAULTS ↔ doc parity test happy.
- config-field-docs.test.cjs: extend NAMESPACE_MAP so the flat keys in
  CONFIG_DEFAULTS resolve to their workflow.* doc rows.
- FEATURES.md REQ-GRAPH-02: split the slash-command surface (build|query|
  status|diff) from the CLI surface which additionally exposes `snapshot`
  (invoked automatically at the tail of `graphify build`). The prior text
  overstated the slash-command surface.

* docs(inventory): refresh rosters and counts for post-rebase drift

origin/main accumulated surfaces since this PR was authored:

- Agents: 31 → 33 (+ gsd-doc-classifier, gsd-doc-synthesizer)
- Commands: 76 → 82 (+ ingest-docs, ultraplan-phase, spike, spike-wrap-up,
  sketch, sketch-wrap-up)
- Workflows: 73 → 79 (same 6 names)
- References: 41 → 49 (+ debugger-philosophy, doc-conflict-engine,
  mandatory-initial-read, project-skills-discovery, sketch-interactivity,
  sketch-theme-system, sketch-tooling, sketch-variant-patterns)

Adds rows in the existing sub-groupings, introduces a Sketch References
subsection, and bumps all four headline counts. Roles are pulled from
source frontmatter / purpose blocks for each file. All 5 parity tests
(inventory-counts, agents-doc-parity, commands-doc-parity,
cli-modules-doc-parity, hooks-doc-parity) pass against this state —
156 assertions, 0 failures.

Also updates the 'Coverage note' advanced-agent count 10 → 12 and the
few-shot-examples footnote "41 top-level references" → "49" to keep the
file internally consistent.

* docs(agents): add advanced stubs for gsd-doc-classifier and gsd-doc-synthesizer

Both agents ship on main (spawned by /gsd-ingest-docs) but had no
coverage in docs/AGENTS.md. Adds the "advanced stub" entries (Role,
property table, Key behaviors) following the template used by the other
10 advanced/specialized agents in the same section.

Also updates the Agent Tool Permissions Summary scope note from
"10 advanced/specialized agents" to 12 to reflect the two new stubs.

* docs(commands): add entries for ingest-docs, ultraplan-phase, plan-review-convergence

These three commands ship on main (plan-review-convergence via trek-e's
4b452d29 commit on this branch) but had no user-facing section in
docs/COMMANDS.md — they lived only in INVENTORY.md. The commands-doc-parity
test already passes via INVENTORY, but the user-facing doc was missing
canonical explanations, argument tables, and examples.

- /gsd-plan-review-convergence → Core Workflow (after /gsd-plan-phase)
- /gsd-ultraplan-phase → Core Workflow (after plan-review-convergence)
- /gsd-ingest-docs → Brownfield (after /gsd-import, since both consume
  the references/doc-conflict-engine.md contract)

Content pulled from each command's frontmatter and workflow purpose block.

* test: remove redundant ARCHITECTURE.md count tests

tests/architecture-counts.test.cjs and tests/command-count-sync.test.cjs
were added when docs/ARCHITECTURE.md carried hardcoded counts for commands/
workflows/agents. With the PR #2390 cleanup, ARCHITECTURE.md no longer
owns those numbers — docs/INVENTORY.md does, enforced by
tests/inventory-counts.test.cjs (scans the same filesystem directories
with the same readdirSync filter).

Keeping these ARCHITECTURE-specific tests would re-introduce the hardcoded
counts they guard, defeating trek-e's review point. The single-source-of-
truth parity tests already catch the same drift scenarios.

Related: #2257 (the regression this replaced).

---------

Co-authored-by: Tom Boucher <trekkie@nomorestars.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 09:31:34 -04:00
Jeremy McSpadden
3856b53098 Merge remote-tracking branch 'origin/main' into fix/2406-ship-read-injection-scanner
# Conflicts:
#	CHANGELOG.md
2026-04-18 11:37:47 -05:00
Tom Boucher
381c138534 feat(sdk): make checkAgentsInstalled runtime-aware (#2402) (#2413) 2026-04-18 12:22:36 -04:00
Jeremy McSpadden
8ac02084be fix(sdk): point checkAgentsInstalled at ~/.claude/agents (#2401) 2026-04-18 12:11:07 -04:00
Tom Boucher
e208e9757c refactor(agents): consolidate emphasis-marker density in top 4 agents (#2368) (#2412) 2026-04-18 12:10:22 -04:00
Jeremy McSpadden
13a96ee994 fix(build): include gsd-read-injection-scanner in hooks/dist (#2406)
The scanner was added in #2201 but never added to the HOOKS_TO_COPY
allowlist in scripts/build-hooks.js, so it never landed in hooks/dist/.
install.js reads from hooks/dist/, so every install on 1.37.0/1.37.1
emitted "Skipped read injection scanner hook — not found at target"
and the read-time prompt-injection scanner was silently disabled.

- Add gsd-read-injection-scanner.js to HOOKS_TO_COPY
- Add it to EXPECTED_ALL_HOOKS regression test in install-hooks-copy

Fixes #2406

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-18 08:42:36 -05:00
Jeremy McSpadden
d5f849955b Merge remote-tracking branch 'origin/main' into feat/2387-ingest-docs-clean
# Conflicts:
#	CHANGELOG.md
2026-04-17 21:46:39 -05:00
Jeremy McSpadden
b96255cf0c test(ingest-docs): add structural tests and CHANGELOG entry
- tests/ingest-docs.test.cjs — 40 structural assertions guarding the
  contract: command/workflow/agent/reference files exist; frontmatter
  shape; --mode/--manifest/--resolve/path parsing; path traversal
  guard; 50-doc cap; auto mode-detect via planning_exists; directory
  conventions for ADR/PRD/SPEC; parallel classifier + synthesizer
  spawns; BLOCKER/WARNING/INFO severity and the no-write safety gate;
  gsd-roadmapper routing; --resolve interactive reserved-for-future;
  INGEST-CONFLICTS.md writing. Classifier covers 5 types, JSON schema,
  Accepted-only locking. Synthesizer covers precedence ordering,
  LOCKED-vs-LOCKED block in both modes, three-bucket report, cycle
  detection, variant preservation, SYNTHESIS.md entry point. Plus a
  regression guard that /gsd-import still consumes the shared
  doc-conflict-engine reference (refactor drift check).

- CHANGELOG.md — Unreleased "Added" entry for /gsd-ingest-docs (#2387).

Full suite: 4151/4151 passing.

Refs #2387

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-17 17:12:34 -05:00
Jeremy McSpadden
b2fcacda1b fix(install): auto-install @gsd-build/sdk so gsd-sdk is on PATH (#2385)
Every /gsd-* command shells out to `gsd-sdk query …`, but the SDK was
never installed by bin/install.js — the `--sdk` flag documented in
README was never implemented. Users upgrading to 1.36+ hit
"command not found: gsd-sdk" on every command.

- Implement SDK install in finishInstall's finalize path
- Default on; --no-sdk to skip; --sdk to force when already present
- Idempotent probe via `which gsd-sdk` before reinstalling
- Failures are warnings, not fatal — install hint printed

Closes #2385

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-17 15:56:35 -05:00
Lex Christopherson
d32e5bd461 docs: update changelog for v1.37.1
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-17 10:38:47 -06:00
Lex Christopherson
bbcec632b6 docs: update changelog for v1.37.0
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-17 09:52:59 -06:00
Tom Boucher
c5e77c8809 feat(agents): enforce size budget + extract duplicated boilerplate (#2361) (#2362)
Adds tiered agent-size-budget test to prevent unbounded growth in agent
definitions, which are loaded verbatim into context on every subagent
dispatch. Extracts two duplicated blocks (mandatory-initial-read,
project-skills-discovery) to shared references under
get-shit-done/references/ and migrates the 5 top agents (planner,
executor, debugger, verifier, phase-researcher) to @file includes.

Also fixes two broken relative @planner-source-audit.md references in
gsd-planner.md that silently disabled the planner's source audit
discipline.

Closes #2361

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-17 10:47:08 -04:00
Tom Boucher
4a912e2e45 feat(debugger): extract philosophy block to shared reference (#2363) (#2364)
The gsd-debugger philosophy block contains 76 lines of evergreen
debugging disciplines (user-as-reporter, meta-debugging, cognitive
biases, restart protocol) that are not debugger-specific workflow
and are paid in context on every debugger dispatch.

Extracts to get-shit-done/references/debugger-philosophy.md, replaces
the inline block with a single @file include. Behavior-preserving.

Closes #2363

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-17 10:23:18 -04:00
Rezolv
d3a79917fa feat: Phase 2 caller migration — gsd-sdk query in workflows, agents, commands (#2179)
* feat: Phase 2 caller migration — gsd-sdk query in workflows (#2122)

Cherry-picked orchestration rewrites from feat/sdk-foundation (#2008, 4018fee) onto current main, resolving conflicts to keep upstream worktree guards and post-merge test gate. SDK stub registry omitted (out of Phase 2 scope per #2122).

Refs: #2122 #2008
Made-with: Cursor

* docs: add gsd-sdk query migration blurb

Made-with: Cursor

* docs(workflows): extend Phase 2 gsd-sdk query caller migration

- Swap node gsd-tools.cjs for gsd-sdk query in review, plan-phase, execute-plan,
  ship, extract_learnings, ai-integration-phase, eval-review, next, thread
- Document graphify CJS-only in gsd-planner; dual-path in CLI-TOOLS and ARCHITECTURE
- Update tests: workstreams gsd-sdk path, thread frontmatter.get, workspace init.*,
  CRLF-safe autonomous frontmatter parse
- CHANGELOG: Phase 2 caller migration scope

Made-with: Cursor

* docs(phase2): USER-GUIDE + remaining gsd-sdk query call sites

- USER-GUIDE: dual-path CLI section; state validate/sync use full CJS path
- Commands: debug (config-get+tdd), quick (security note), intel Task prompt
- Agent: gsd-debug-session-manager resolve-model via jq
- Workflows: milestone-summary, forensics, next, complete-milestone/verify-work
  (audit-open CJS notes), discuss-phase, progress, verify-phase, add/insert/remove
  phase, transition, manager, quick workflow; remove-phase commit without --files
- Test: quick-session-management accepts frontmatter.get
- CHANGELOG: Phase 2 follow-up bullet

Made-with: Cursor

* docs(phase2): align gsd-sdk query examples in commands and agents

- init.* query names; frontmatter.get uses positional field name
- state.* handlers use positional args; commit uses positional paths
- CJS-only notes for from-gsd2 and graphify; learnings.query wording
- CHANGELOG: Phase 2 orchestration doc pass

Made-with: Cursor

* docs(phase2): normalize gsd-sdk query commit to positional file paths

- Strip --files from commit examples in workflows, references, commands
- Keep commit-to-subrepo ... --files (separate handler)
- git-planning-commit.md: document positional args
- Tests: new-project commit line, state.record-session, gates CRLF, roadmap.analyze
- CHANGELOG [Unreleased]

Made-with: Cursor

* feat(sdk): gsd-sdk query parity with gsd-tools and PR 2179 registry fixes

- Route query via longest-prefix match and dotted single-token expansion; fall back
  to runGsdToolsQuery (same argv as node gsd-tools.cjs) for full CLI coverage.
- Parse gsd-sdk query permissively so gsd-tools flags (--json, --verify, etc.) are
  not rejected by strict parseArgs.
- resolveGsdToolsPath: honor GSD_TOOLS_PATH; prefer bundled get-shit-done copy
  over project .claude installs; export runGsdToolsQuery from the SDK.
- Fix gsd-tools audit-open (core.output; pass object for --json JSON).
- Register summary-extract as alias of summary.extract; fix audit-fix workflow to
  call audit-uat instead of invalid init.audit-uat (PR review).

Updates QUERY-HANDLERS.md and CHANGELOG [Unreleased].

Made-with: Cursor

* fix(sdk): Phase 2 scope — Trek-e review (#2179, #2122)

- Remove gsd-sdk query passthrough to gsd-tools.cjs; drop GSD_TOOLS_PATH
- Consolidate argv routing in resolveQueryArgv(); update USAGE and QUERY-HANDLERS
- Surface @file: read failures in GSDTools.parseOutput
- execute-plan: defer Task Commit Protocol to gsd-executor
- stale-colon-refs: skip .planning/ and root CLAUDE.md (gitignored overlays)
- CHANGELOG [Unreleased]: maintainer review and routing notes

Made-with: Cursor
2026-04-15 22:46:31 -04:00
Tom Boucher
50f61bfd9a fix(hooks): complete stale-hooks false-positive fix — stamp .sh version headers + fix detector regex (#2224)
* fix(hooks): stamp gsd-hook-version in .sh hooks and fix stale detection regex (#2136, #2206)

Three-part fix for the persistent "⚠ stale hooks — run /gsd-update" false
positive that appeared on every session after a fresh install.

Root cause: the stale-hook detector (gsd-check-update.js) could only match
the JS comment syntax // in its version regex — never the bash # syntax used
in .sh hooks. And the bash hooks had no version header at all, so they always
landed in the "unknown / stale" branch regardless.

Neither partial fix (PR #2207 regex only, PR #2215 install stamping only) was
sufficient alone:
  - Regex fix without install stamping: hooks install with literal
    "{{GSD_VERSION}}", the {{-guard silently skips them, bash hook staleness
    permanently undetectable after future updates.
  - Install stamping without regex fix: hooks are stamped correctly with
    "# gsd-hook-version: 1.36.0" but the detector's // regex can't read it;
    still falls to the unknown/stale branch on every session.

Fix:
  1. Add "# gsd-hook-version: {{GSD_VERSION}}" header to
     gsd-phase-boundary.sh, gsd-session-state.sh, gsd-validate-commit.sh
  2. Extend install.js (both bundled and Codex paths) to substitute
     {{GSD_VERSION}} in .sh files at install time (same as .js hooks)
  3. Extend gsd-check-update.js versionMatch regex to handle bash "#"
     comment syntax: /(?:\/\/|#) gsd-hook-version:\s*(.+)/

Tests: 11 new assertions across 5 describe blocks covering all three fix
parts independently plus an E2E install+detect round-trip. 3885/3885 pass.

Approach credit: PR #2207 (j2h4u / Maxim Brashenko) for the regex fix;
PR #2215 (nitsan2dots) for the install.js substitution approach.

Closes #2136, #2206, #2209, #2210, #2212

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(hooks): extract check-update worker to dedicated file, eliminating template-literal regex escaping

Move stale-hook detection logic from inline `node -e '<template literal>'` subprocess
to a standalone gsd-check-update-worker.js. Benefits:
- Regex is plain JS with no double-escaping (root cause of the (?:\\/\\/|#) confusion)
- Worker is independently testable and can be read directly by tests
- Uses execFileSync (array args) to satisfy security hook that blocks execSync
- MANAGED_HOOKS now includes gsd-check-update-worker.js itself

Update tests to read worker file instead of main hook for regex/configDir assertions.
All 3886 tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-14 17:57:38 -04:00
Lex Christopherson
73c7281a36 docs: update changelog and README for v1.36.0
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-14 08:26:17 -06:00
Rezolv
6f79b1dd5e feat(sdk): Phase 1 typed query foundation (gsd-sdk query) (#2118)
* feat(sdk): add typed query foundation and gsd-sdk query (Phase 1)

Add sdk/src/query registry and handlers with tests, GSDQueryError, CLI query wiring, and supporting type/tool-scoping hooks. Update CHANGELOG. Vitest 4 constructor mock fixes in milestone-runner tests.

Made-with: Cursor

* chore: gitignore .cursor for local-only Cursor assets

Made-with: Cursor

* fix(sdk): harden query layer for PR review (paths, locks, CLI, ReDoS)

- resolvePathUnderProject: realpath + relative containment for frontmatter and key_links

- commitToSubrepo: path checks + sanitizeCommitMessage

- statePlannedPhase: readModifyWriteStateMd (lock); MUTATION_COMMANDS + events

- key_links: regexForKeyLinkPattern length/ReDoS guard; phase dirs: reject .. and separators

- gsd-sdk: strip --pick before parseArgs; strict parser; QueryRegistry.commands()

- progress: static GSDError import; tests updated

Made-with: Cursor

* feat(sdk): query follow-up — tests, QUERY-HANDLERS, registry, locks, intel depth

Made-with: Cursor

* docs(sdk): use ASCII punctuation in QUERY-HANDLERS.md

Made-with: Cursor
2026-04-12 18:15:04 -04:00
Bhaskoro Muthohar
5a802e4fd2 feat: add flow diagram directive to phase researcher agent (#2139) (#2147)
Architecture diagrams generated by gsd-phase-researcher now enforce
data-flow style (conceptual components with arrows) instead of
file-listing style. The directive is language-agnostic and applies
to all project types.

Changes:
- agents/gsd-phase-researcher.md: add System Architecture Diagram
  subsection in Architecture Patterns output template
- get-shit-done/templates/research.md: add matching directive in
  both architecture_patterns template sections
- tests/phase-researcher-flow-diagram.test.cjs: 8 tests validating
  directive presence, content, and ordering in agent and template

Closes #2139
2026-04-12 15:56:20 -04:00
Tom Boucher
002bcf2a8a fix(2137): skip worktree isolation when .gitmodules detected (#2144)
* feat(sdk): add typed query foundation and gsd-sdk query (Phase 1)

Add sdk/src/query registry and handlers with tests, GSDQueryError, CLI query wiring, and supporting type/tool-scoping hooks. Update CHANGELOG. Vitest 4 constructor mock fixes in milestone-runner tests.

Made-with: Cursor

* fix(2137): skip worktree isolation when .gitmodules detected

When a project contains git submodules, worktree isolation cannot
correctly handle submodule commits — three separate gaps exist in
worktree setup, executor commit protocol, and merge-back. Rather
than patch each gap individually, detect .gitmodules at phase start
and fall back to sequential execution, which handles submodules
transparently (Option B).

Affected workflows: execute-phase.md, quick.md

---------

Co-authored-by: David Sienkowski <dave@sienkowski.com>
2026-04-12 08:33:04 -04:00
Tom Boucher
6c2795598a docs: release notes and documentation updates for v1.35.0 (#2079)
Closes #2080
2026-04-10 22:29:06 -04:00
Maxim Brashenko
cc04baa524 feat(statusline): surface GSD milestone/phase/status when no active todo (#1990)
When no in_progress todo is active, fill the middle slot of
gsd-statusline.js with GSD state read from .planning/STATE.md.

Format: <milestone> · <status> · <phase name> (N/total)

- Add readGsdState() — walks up from workspace dir looking for
  .planning/STATE.md (bounded at 10 levels / home dir)
- Add parseStateMd() — reads YAML frontmatter (status, milestone,
  milestone_name) and Phase line from body; falls back to body Status:
  parsing for older STATE.md files without frontmatter
- Add formatGsdState() — joins available parts with ' · ', degrades
  gracefully when fields are missing
- Wrap stdin handler in runStatusline() and export helpers so unit
  tests can require the file without triggering the script behavior

Strictly additive: active todo wins the slot (unchanged); missing
STATE.md leaves the slot empty (unchanged). Only the "no active todo
AND STATE.md present" path is new.

Uses the YAML frontmatter added for #628, completing the statusline
display that issue originally proposed.

Closes #1989
2026-04-10 15:56:19 -04:00
chudeemeke
7e2217186a feat(review): add per-CLI model selection via config (#1859)
* feat(review): add per-CLI model selection via config

- Add review.models.<cli> dynamic config keys to VALID_CONFIG_KEYS
- Update review.md to read model preferences via config-get at runtime
- Null/missing values fall back to CLI defaults (backward compatible)
- Add key suggestion for common typo (review.model)
- Update planning-config reference doc

Closes #1849

* fix(review): handle absent and null model config gracefully

Address PR #1859 review feedback from @trek-e:

1. Add `|| true` to all four config-get subshell invocations in
   review.md so that an absent review.models.<cli> key does not
   produce a non-zero exit from the subshell. cmdConfigGet calls
   error() (process.exit(1)) when the key path is missing; the
   2>/dev/null suppresses the message but the exit code was still
   discarded silently. The || true makes the fall-through explicit
   and survives future set -e adoption.

2. Add `&& [ "$VAR" != "null" ]` to all four if guards. cmdConfigSet
   does not parse the literal 'null' as JSON null — it stores the
   string 'null' — and cmdConfigGet --raw returns the literal text
   'null' for that value. Without the extra guard the workflow would
   pass `-m "null"` to the CLI, which crashes. The issue spec
   documents null as the "fall back to CLI default" sentinel, so this
   restores the contract.

3. Add tests/review-model-config.test.cjs covering all five cases
   trek-e listed:
   - isValidConfigKey accepts review.models.gemini (via config-set)
   - isValidConfigKey accepts review.models.codex (via config-set)
   - review.model is rejected and suggests review.models.<cli-name>
   - config-set then config-get round-trip with a model ID
   - config-set then config-get round-trip with null (returns "null")

   Tests follow the node:test + node:assert/strict pattern from
   tests/agent-skills.test.cjs and use runGsdTools from helpers.cjs.

Closes #1849
2026-04-10 10:44:15 -04:00
Lex Christopherson
c7de05e48f fix(engines): lower Node.js minimum to 22
Node 22 is still in Active LTS until October 2026 and Maintenance LTS
until April 2027. Raising the engines floor to >=24.0.0 unnecessarily
locked out a fully-supported LTS version and produced EBADENGINE
warnings on install. Restore Node 22 support, add Node 22 to the CI
matrix, and update CONTRIBUTING.md to match.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 14:54:12 -06:00
Lex Christopherson
4463ee4f5b docs: update changelog for v1.34.1
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 14:16:45 -06:00
Tom Boucher
d14e336793 chore: bump to 1.34.0
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-06 15:34:34 -04:00
Rezolv
e107b4e225 feat(config): add execution context profiles for mode-specific agent output (#1827)
* feat(config): add execution context profiles for mode-specific agent output

* fix(config): add enum validation for context config key

Validate context values against allowed enum (dev, research, review)
in cmdConfigSet before writing to config.json, matching the pattern
used for model_profile validation. Add rejection test for invalid
context values.
2026-04-05 19:09:19 -04:00
Rezolv
7b369d2df3 feat(intel): add queryable codebase intelligence system (#1728)
* feat(intel): add queryable codebase intelligence system

Add persistent codebase intelligence that reduces context overhead:

- lib/intel.cjs: 654-line CLI module with 13 exports (query, status,
  diff, snapshot, patch-meta, validate, extract-exports, and more).
  Reads config.json directly (not via config-get which hard-exits on
  missing keys). Default is DISABLED (user must set intel.enabled: true).
- gsd-tools.cjs: intel case routing with 7 subcommand dispatches
- /gsd-intel command: 4 modes (query, status, diff, refresh). Config
  gate uses Read tool. Refresh spawns gsd-intel-updater agent via Task().
- gsd-intel-updater agent: writes 5 artifacts to .planning/intel/
  (files.json, apis.json, deps.json, stack.json, arch.md). Uses
  gsd-tools intel CLI calls. Completion markers registered in
  agent-contracts.md.
- agent-contracts.md: updated with gsd-intel-updater registration

* docs(changelog): add intel system entry for #1688

* test(intel): add comprehensive tests for intel.cjs

Cover disabled gating, query (keys, values, case-insensitive, multi-file,
arch.md text), status (fresh, stale, missing), diff (no baseline, added,
changed), snapshot, validate (missing files, invalid JSON, complete store),
patch-meta, extract-exports (CJS, ESM named, ESM block, missing file),
and gsd-tools CLI routing for intel subcommands.

38 test cases across 10 describe blocks.

* fix(intel): address review feedback — merge markers, redundant requires, gate docs, update route

- Remove merge conflict markers from CHANGELOG.md
- Replace redundant require('path')/require('fs') in isIntelEnabled with top-level bindings
- Add JSDoc notes explaining why intelPatchMeta and intelExtractExports skip isIntelEnabled gate
- Add 'intel update' CLI route in gsd-tools.cjs and update help text
- Fix stale /gsd: colon reference in intelUpdate return message
2026-04-05 18:33:15 -04:00
Tom Boucher
b602c1ddc7 fix: remove editorial parenthetical descriptions from product names (#1778)
Community PRs repeatedly add marketing commentary in parentheses next to
product names (licensing model, parent company, architecture). Product
listings should contain only the product name.

Cleaned across 8 files in 5 languages (EN, KO, JA, ZH, PT) plus
install.js code comments and CHANGELOG. Added static analysis guard
test that prevents this pattern from recurring.

Fixes #1777

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-05 12:41:17 -04:00
Tom Boucher
949da16dbc chore(release): v1.33.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-05 09:25:43 -04:00
Tom Boucher
27bc736661 chore: release v1.32.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-04 08:19:43 -04:00
Tom Boucher
94a8005f97 docs: update documentation for v1.31.0 release
- CHANGELOG.md: 13 added, 1 changed, 21 fixed entries
- README.md: quick mode flags, --chain, security/schema features, commands table
- docs/FEATURES.md: v1.29-v1.31 feature sections (#56-#68)
- docs/CONFIGURATION.md: 5 new config options, Security Settings section
- Localized READMEs: ja-JP, ko-KR, zh-CN, pt-BR synced with English changes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-01 18:17:26 -04:00
Elliot Drel
5217b7b74a feat(quick): make --full include all phases, add --validate flag
--full now enables discussion + research + plan-checking + verification.
New --validate flag covers what --full previously did (plan-checking +
verification only). All downstream workflow logic uses $VALIDATE_MODE.

Closes #1498

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-31 09:07:08 -04:00
Lex Christopherson
0e63cd798f docs: update README and changelog for v1.30.0 2026-03-26 22:08:36 -06:00
Lex Christopherson
5286f1d76f docs: update changelog for v1.29.0
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-25 17:25:24 -06:00
Lex Christopherson
c75248c26d docs: update changelog for v1.28.0 2026-03-22 09:44:40 -06:00
Lex Christopherson
0ea6ebe87d docs: update changelog for v1.27.0
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-20 10:08:19 -06:00
Tom Boucher
62db008570 security: add prompt injection guards, path traversal prevention, and input validation
Defense-in-depth security hardening for a codebase where markdown files become
LLM system prompts. Adds centralized security module, PreToolUse hook for
injection detection, and CI-ready codebase scan.

New files:
- security.cjs: path traversal prevention, prompt injection scanner/sanitizer,
  safe JSON parsing, field name validation, shell arg validation
- gsd-prompt-guard.js: PreToolUse hook scans .planning/ writes for injection
- security.test.cjs: 62 unit tests for all security functions
- prompt-injection-scan.test.cjs: CI scan of all agent/workflow/command files

Hardened code paths:
- readTextArgOrFile: path traversal guard (--prd, --text-file)
- cmdStateUpdate/Patch: field name validation prevents regex injection
- cmdCommit: sanitizeForPrompt strips invisible chars from commit messages
- gsd-tools --fields: safeJsonParse wraps unprotected JSON.parse
- cmdFrontmatterGet/Set: null byte rejection
- cmdVerifyPathExists: null byte rejection
- install.js: registers prompt guard hook, updates uninstaller

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-20 11:38:26 -04:00
jecanore
24626ad320 docs: add advisor mode entry to CHANGELOG.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 20:09:10 -05:00
jecanore
60a76ae06e feat: add verification debt tracking and /gsd:audit-uat command
Prevent silent loss of UAT/verification items when projects advance.
Surfaces outstanding items across all prior phases so nothing is forgotten.

New command:
- /gsd:audit-uat — cross-phase audit with categorized report and test plan

New capabilities:
- Cross-phase health check in /gsd:progress (Step 1.6)
- status: partial for incomplete UAT sessions
- result: blocked with blocked_by tag for dependency-gated tests
- human_needed items persisted as trackable HUMAN-UAT.md files
- Phase completion and transition warnings for verification debt

Files: 4 new, 14 modified (9 feature + 5 docs)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 00:05:05 -05:00
Lex Christopherson
9bf78719b6 docs: update changelog for v1.26.0
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 10:08:49 -06:00
Tom Boucher
a75c1d1f67 feat: cross-phase regression gate in execute-phase pipeline (#945) (#1120)
Add regression_gate step between executor completion and verification
in execute-phase workflow. Runs prior phases' test suites to catch
cross-phase regressions before they compound.

- Discovers prior VERIFICATION.md files and extracts test file paths
- Detects project test runner (jest/vitest/cargo/pytest)
- Reports pass/fail with options to fix, continue, or abort
- Skips silently for first phase or when no prior tests exist

Changes:
- execute-phase.md: New regression_gate step
- CHANGELOG.md: Document regression gate feature
- docs/FEATURES.md: Add REQ-EXEC-09

Fixes #945

Co-authored-by: TÂCHES <afromanguy@me.com>
2026-03-18 10:02:34 -06:00
Tom Boucher
0f095ac3d0 feat: requirements coverage gate in plan-phase pipeline (#984) (#1121)
Add step 13 (Requirements Coverage Gate) to plan-phase workflow.
After plans pass the checker, verifies all phase requirements are
covered by at least one plan before declaring planning complete.

- Extracts REQ-IDs from plan frontmatter and compares against
  phase_req_ids from ROADMAP
- Cross-checks CONTEXT.md features against plan objectives to
  detect silently dropped scope
- Reports gaps with options: re-plan, defer, or proceed
- Skips when phase_req_ids is null/TBD (no requirements mapped)

Fixes #984

Co-authored-by: TÂCHES <afromanguy@me.com>
2026-03-18 10:02:02 -06:00
Tom Boucher
f54f3df776 feat: structured session handoff artifact for cross-session continuity (#940) (#1122)
Enhance /gsd:pause-work to write .planning/HANDOFF.json alongside
.continue-here.md. The JSON provides machine-readable state that
/gsd:resume-work can parse for precise resumption.

HANDOFF.json includes:
- Task position (phase, plan, task number, status)
- Completed and remaining tasks with commit hashes
- Blockers with type classification (technical/human_action/external)
- Human actions pending (API keys, approvals, manual testing)
- Uncommitted files list
- Context notes for mental model restoration

Resume-work changes:
- HANDOFF.json is primary resumption source (highest priority)
- Surfaces blockers and human actions immediately on session start
- Validates uncommitted files against git status
- Deletes HANDOFF.json after successful resumption
- Falls back to .continue-here.md if no JSON exists

Also checks for placeholder content in SUMMARY.md files to catch
false completions (frontmatter claims complete but body has TBD).

Fixes #940
2026-03-18 10:01:25 -06:00
Tom Boucher
a97e4c2c6f feat: /gsd:ship command for PR creation from verified phase work (#829) (#1123)
* feat: /gsd:ship command for PR creation from verified phase work (#829)

New command that bridges local completion → merged PR, closing the
plan → execute → verify → ship loop.

Workflow (workflows/ship.md):
1. Preflight: verification passed, clean tree, correct branch, gh auth
2. Push branch to remote
3. Auto-generate rich PR body from planning artifacts:
   - Phase goal from ROADMAP.md
   - Changes from SUMMARY.md files
   - Requirements addressed (REQ-IDs)
   - Verification status
   - Key decisions
4. Create PR via gh CLI (supports --draft)
5. Optional code review request
6. Update STATE.md with shipping status

Files:
- commands/gsd/ship.md: New command entry point
- get-shit-done/workflows/ship.md: Full workflow implementation
- get-shit-done/workflows/help.md: Add ship to help output
- docs/COMMANDS.md: Command reference
- docs/FEATURES.md: Feature spec with REQ-SHIP-01 through 05
- docs/USER-GUIDE.md: Add to command table
- CHANGELOG.md: Document new command

Fixes #829

* fix(tests): update expected skill count from 39 to 40 for new ship command

The Copilot install E2E tests hardcode the expected number of skill
directories and manifest entries. Adding commands/gsd/ship.md increased
the count from 39 to 40.
2026-03-18 10:01:08 -06:00
Tom Boucher
80605d2051 docs: add developer profiling, execution hardening, and idempotent mark-complete to docs (#1108)
Update documentation for features added since v1.25.1:

- CHANGELOG.md: Add [Unreleased] entries for developer profiling pipeline,
  execution hardening (pre-wave check, cross-plan contracts, export
  spot-check), and idempotent requirements mark-complete

- README.md: Add /gsd:profile-user command to utilities table

- docs/COMMANDS.md: Add full /gsd:profile-user command documentation
  with flags, generated artifacts, and usage examples

- docs/FEATURES.md: Add Feature 33 (Developer Profiling) with 8
  behavioral dimensions, pipeline modules, and requirements; add
  Feature 34 (Execution Hardening) with 3 quality components

- docs/AGENTS.md: Add gsd-user-profiler agent documentation and
  tool permissions entry
2026-03-16 13:39:52 -06:00
Lex Christopherson
78ebdc32e3 docs: update changelog for v1.25.0 2026-03-16 09:02:55 -06:00
Berkay Karaman
a5f5d50f14 feat: add Antigravity runtime support (#1058)
* feat: add Antigravity runtime support

Add full installation support for the Antigravity AI agent, bringing
get-shit-done capabilities to the new runtime alongside Claude Code,
OpenCode, Gemini, Codex, and Copilot.

- New runtime installation capability in bin/install.js
- Commands natively copied to the unified skills directory
- New test integration suite: tests/antigravity-install.test.cjs
- Refactored copy utility to accommodate Antigravity syntax
- Documentation added into README.md

Co-authored-by: Antigravity <noreply@google.com>

* fix: add missing processAttribution call in copyCommandsAsAntigravitySkills

Antigravity SKILL.md files were written without commit attribution metadata,
inconsistent with the Copilot equivalent (copyCommandsAsCopilotSkills) which
calls processAttribution on each skill's content before writing it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: update Copilot install test assertions for 3 new UI agents

* docs: update CHANGELOG for Antigravity runtime support

---------

Co-authored-by: Antigravity <noreply@google.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-15 19:31:01 -06:00
Lex Christopherson
a31641d2f3 docs: update changelog for v1.24.0
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-15 11:52:46 -06:00
TÂCHES
ddb9923df2 feat(quick): add --research flag for focused pre-planning research (#317) (#1063)
Add composable --research flag to /gsd:quick that spawns a focused
gsd-phase-researcher before planning. Investigates implementation
approaches, library options, and pitfalls for the task.

Addresses the middle-ground gap between quick (no quality agents) and
full milestone workflows. All three flags are composable:
--discuss --research --full gives the complete quality pipeline.

Made-with: Cursor

Co-authored-by: ralberts3 <ralberts3@gatech.edu>
2026-03-15 11:45:25 -06:00
TÂCHES
5d703954c9 fix: use absolute paths for gsd-tools.cjs in all install types (#820) (#1062)
Local installs wrote $HOME/.claude/get-shit-done/bin/gsd-tools.cjs into
workflow files, which breaks when GSD is installed outside $HOME (e.g.
external drives, symlinked projects) and when spawned subagents have an
empty $HOME environment variable.

- pathPrefix now always resolves to an absolute path via path.resolve()
- All $HOME/.claude/ replacements use the absolute prefix directly
- Codex installer uses absolute path for get-shit-done prefix
- Removed unused toHomePrefix() function

Tested: 535/535 existing tests pass, verified local install produces
correct absolute paths, verified global install unchanged, verified
empty $HOME scenario resolves correctly.

Closes #820

Made-with: Cursor

Co-authored-by: ralberts3 <ralberts3@gatech.edu>
2026-03-15 11:44:25 -06:00