Replace minutes-based task sizing with context-window percentage sizing.
Add planner_authority_limits section prohibiting difficulty-based scope
decisions. Expand decision coverage matrix to multi-source audit covering
GOAL, REQ, RESEARCH, and CONTEXT artifacts. Add Source Audit gap handling
to plan-phase orchestrator (step 9c). Update plan-checker to detect
time/complexity language in scope reduction scans. Add 374 CI regression
tests preventing prohibited language from leaking back into artifacts.
Closes#2091Closes#2092
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
When CONTEXT_WINDOW < 200000, executor and planner agent prompts strip
extended examples and anti-pattern lists into reference files for
on-demand @ loading, reducing static overhead by ~40% while preserving
behavioral correctness for standard (200K-500K) and enriched (500K+) tiers.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add /gsd:extract-learnings command and backing workflow that extracts
decisions, lessons, patterns, and surprises from completed phase artifacts
into a structured LEARNINGS.md file with YAML frontmatter metadata.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add optional cross-AI delegation step that lets execute-phase delegate
plans to external AI runtimes via stdin-based prompt delivery. Activated
by --cross-ai flag, plan frontmatter cross_ai: true, or config key
workflow.cross_ai_execution. Adds 3 config keys, template defaults,
and 18 tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds workflow.code_review_command config key that allows solo devs to
plug external AI review tools into the ship flow. When configured, the
ship workflow generates a diff, builds a review prompt with stats and
phase context, pipes it to the command via stdin, and parses JSON output
with verdict/confidence/issues. Handles timeout (120s) and failures
gracefully by falling through to the existing manual review flow.
Closes#1876
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add plan bounce feature that allows plans to be refined through an external
script between plan-checker approval and requirements coverage gate. Activated
via --bounce flag or workflow.plan_bounce config. Includes backup/restore
safety (pre-bounce.md), YAML frontmatter validation, and checker re-run on
bounced plans.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add CURSOR_SESSION_ID env var detection in review.md so Cursor skips
itself as a reviewer (matching the CLAUDE_CODE_ENTRYPOINT pattern).
Add Qwen Review and Cursor Review sections to the REVIEWS.md template.
Update ja-JP and ko-KR FEATURES.md to include --opencode, --qwen, and
--cursor flags in the /gsd-review command signature.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Before framework-specific research, phase-researcher now maps each
capability to its architectural tier owner (browser, frontend server,
API, database, CDN). The planner sanity-checks task assignments against
this map, and plan-checker enforces tier compliance as Dimension 7c.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Allow users to control where GSD writes its managed CLAUDE.md sections
via a `claude_md_path` setting in .planning/config.json, enabling
separation of GSD content from team-shared CLAUDE.md in shared repos.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds `skill-manifest` command that scans a skills directory, extracts
frontmatter and trigger conditions from each SKILL.md, and outputs a
compact JSON manifest. This reduces per-agent skill discovery from 36
Read operations (~6,000 tokens) to a single manifest read (~1,000 tokens).
Closes#1976
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Move GSD temp file writes from os.tmpdir() root to os.tmpdir()/gsd
subdirectory. This limits reapStaleTempFiles() scan to only GSD files
instead of scanning the entire system temp directory.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Removes the .next-call-count counter file guard (which fired on clean usage and missed
real incomplete work) and replaces it with a scan of all prior phases for plans without
summaries, unoverridden VERIFICATION.md failures, and phases with CONTEXT.md but no plans.
When gaps are found, shows a structured report with Continue/Stop/Force options; the
Continue path writes a formal 999.x backlog entry and commits it before routing. Clean
projects route silently with no interruption.
Closes#2089
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Display examples showing 'cd $TARGET_PATH' and 'cd $WORKSPACE_PATH/repo1'
were unquoted, causing path splitting when project paths contain spaces
(e.g. Windows paths like C:\Users\First Last\...).
Quote all path variable references in user-facing guidance blocks so
the examples shown to users are safe to copy-paste directly.
The actual bash execution blocks (git worktree add, rm -rf, etc.) were
already correctly quoted — this fixes only the display examples.
Fixes#2088
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
When a user selects "Other" in AskUserQuestion with no text body, the
answer_validation block was treating the empty result as a generic empty
response and retrying the question — causing 2-3 cascading question rounds
instead of pausing for freeform user input as intended by the Other handling
on line 795.
Add an explicit exception in answer_validation: "Other" + empty text signals
freeform intent, not a missing answer. The workflow must output one prompt line
and stop rather than retry or generate more questions.
Fixes#2085
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Review feedback from @trek-e — address scope gaps:
1. **--dry-run mode** — New flag that computes what would be pruned
without modifying STATE.md. Returns structured output showing
per-section counts so users can verify before committing.
2. **Resolved blocker pruning** — In addition to decisions and
recently-completed entries, now prunes entries in the Blockers
section that are marked resolved (~~strikethrough~~ or [RESOLVED]
prefix) AND reference a phase older than the cutoff. Unresolved
blockers are preserved regardless of age.
3. **Tests** — Added tests/state-prune.test.cjs (4 cases):
- Prunes decisions older than cutoff, keeps recent
- --dry-run reports changes without modifying STATE.md
- Prunes resolved blockers, keeps unresolved regardless of age
- Returns pruned:false when nothing exceeds cutoff
Scope items still deferred (to be filed as follow-up):
- Performance Metrics "By Phase" table row pruning — needs different
regex handling than prose lines
- Auto-prune via workflow.auto_prune_state at phase completion — needs
integration into cmdPhaseComplete
Also: the pre-existing test failure (2918/2919) is
tests/stale-colon-refs.test.cjs:83:3 "No stale /gsd: colon references
(#1748)". Verified failing on main, not introduced by this PR.
Add `gsd-tools state prune --keep-recent N` that moves old decisions
and recently-completed entries to STATE-ARCHIVE.md. Entries from phases
older than (current - N) are archived; the N most recent are kept.
STATE.md sections grow unboundedly in long-lived projects. A 20+ phase
project accumulates hundreds of historical decisions that every agent
loads into context. Pruning removes stale entries from the hot path
while preserving them in a recoverable archive.
Usage: gsd-tools state prune --keep-recent 3
Default: keeps 3 most recent phases
Closes#1970
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Review feedback from @trek-e — three blocking issues and one style fix:
1. **Symlink escape guard** — Added validatePath() call on the resolved
global skill path with allowAbsolute: true. This routes the path
through the existing symlink-resolution and containment logic in
security.cjs, preventing a skill directory symlinked to an arbitrary
location from being injected. The name regex alone prevented
traversal in the literal name but not in the underlying directory.
2. **5 new tests** covering the global: code path:
- global:valid-skill resolves and appears in output
- global:invalid!name rejected by regex, skipped without crash
- global:missing-skill (directory absent) skipped gracefully
- Mix of global: and project-relative paths both resolve
- global: with empty name produces clear warning and skips
3. **Explicit empty-name guard** — Added before the regex check so
"global:" produces "empty skill name" instead of the confusing
'Invalid global skill name ""'.
4. **Style fix** — Hoisted require('os') and globalSkillsBase
calculation out of the loop, alongside the existing validatePath
import at the top of buildAgentSkillsBlock.
All 16 agent-skills tests pass.
Add global: prefix for agent_skills config entries that resolve to
~/.claude/skills/<name>/SKILL.md instead of the project root. This
allows injecting globally-installed skills (e.g., shadcn, supabase)
into GSD sub-agents without duplicating them into every project.
Example config:
"agent_skills": {
"gsd-executor": ["global:shadcn", "global:supabase-postgres"]
}
Security: skill names are validated against /^[a-zA-Z0-9_-]+$/ to
prevent path traversal. The ~/.claude/skills/ directory is a trusted
runtime-controlled location. Project-relative paths continue to use
validatePath() containment checks as before.
Closes#1992
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add _diskScanCache.delete(cwd) at the start of writeStateMd before
buildStateFrontmatter is called. This prevents stale reads if multiple
state-mutating operations occur within the same Node process — the
write may create new PLAN/SUMMARY files that the next frontmatter
computation must see.
Matters for:
- SDK callers that require() gsd-tools.cjs as a module
- Future dispatcher extensions handling compound operations
- Tests that import state.cjs directly
Adds tests/bug-1967-cache-invalidation.test.cjs which exercises two
sequential writes in the same process with a new phase directory
created between them, asserting the second write sees the new disk
state (total_phases: 2, completed_phases: 1) instead of the cached
pre-write snapshot (total_phases: 1, completed_phases: 0).
Review feedback on #2054 from @trek-e.
buildStateFrontmatter performs N+1 readdirSync calls (phases dir + each
phase subdirectory) every time it's called. Multiple state writes within
a single gsd-tools invocation repeat the same scan unnecessarily.
Add a module-level Map cache keyed by cwd that stores the disk scan
results. The cache auto-clears when the process exits since each
gsd-tools CLI invocation is a short-lived process running one command.
Closes#1967
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Two correctness bugs from @trek-e review:
1. Grep pattern `^<task` only matched unindented task tags, missing
indented tasks in PLAN.md templates that use indentation. Fixed to
`^\s*<task[[:space:]>]` which matches at any indentation level and
avoids false positives on <tasks> or </task>.
2. Threshold=0 was documented to disable inline routing but the
condition `TASK_COUNT <= INLINE_THRESHOLD` evaluated 0<=0 as true,
routing empty plans inline even when the feature was disabled.
Fixed by guarding with `INLINE_THRESHOLD > 0`.
Added tests/inline-plan-threshold.test.cjs (8 tests) covering:
- config-set accepts the key and threshold=0
- VALID_CONFIG_KEYS and planning-config.md contain the entry
- Routing pattern matches indented tasks and rejects <tasks>/</task>
- Inline routing is guarded by INLINE_THRESHOLD > 0
Review feedback on #2061 from @trek-e.
Plans with 1-2 tasks now execute inline (Pattern C) instead of spawning
a subagent (Pattern A). This avoids ~14K token subagent spawn overhead
and preserves the orchestrator's prompt cache for small plans.
The threshold is configurable via workflow.inline_plan_threshold
(default: 2). Set to 0 to always spawn subagents. Plans above the
threshold continue to use checkpoint-based routing as before.
Closes#1979
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Per approved spec in #1969, the planner must include CONTEXT.md and
SUMMARY.md from any phases listed in the current phase's 'Depends on:'
field in ROADMAP.md, in addition to the 3 most recent completed phases.
This ensures explicit dependencies are always visible to the planner
regardless of recency — e.g., Phase 7 declaring 'Depends on: Phase 2'
always sees Phase 2's context, not just when Phase 2 is among the 3
most recent.
Review feedback on #2058 from @trek-e.
When CONTEXT_WINDOW >= 500000 (1M models), the planner loaded ALL prior
phase CONTEXT.md and SUMMARY.md files for cross-phase consistency. On
projects with 20+ phases, this consumed significant context budget with
diminishing returns — decisions from phase 2 are rarely relevant to
phase 22.
Limit to the 3 most recent completed phases, which provides enough
cross-phase context for consistency while keeping the planner's context
budget focused on the current phase's plans.
Closes#1969
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace 11 fs.writeFileSync calls with atomicWriteFileSync in three
files that write to .planning/ artifacts (ROADMAP.md, REQUIREMENTS.md,
MILESTONES.md, and frontmatter updates). This prevents partial writes
from corrupting planning files on crash or power loss.
Skipped low-risk writes: .gitkeep (empty files) and archive directory
writes (new files, not read-modify-write).
Files changed:
- milestone.cjs: 5 sites (REQUIREMENTS.md, MILESTONES.md)
- phase.cjs: 5 sites (ROADMAP.md, REQUIREMENTS.md)
- frontmatter.cjs: 2 sites (arbitrary .planning/ files)
Closes#1972
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
cmdValidateHealth read the phases directory four separate times for
checks 6 (naming), 7 (orphaned plans), 7b (validation artifacts), and
8 (roadmap cross-reference). Hoist the directory listing into a single
readdirSync call with a shared Map of per-phase file lists.
Reduces syscalls from ~3N+1 to N+1 where N is the number of phase
directories.
Closes#1973
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a new command and CLI subcommand that converts a GSD-2 `.gsd/`
project back to GSD v1 `.planning/` format — the reverse of the forward
migration GSD-2 ships.
Closes#2069
Maps GSD-2's Milestone → Slice → Task hierarchy to v1's flat
Milestone sections → Phase → Plan structure. Slices are numbered
sequentially across all milestones; tasks become numbered plans within
their phase. Completion state, research files, and summaries are
preserved.
New files:
- `get-shit-done/bin/lib/gsd2-import.cjs` — parser, transformer, writer
- `commands/gsd/from-gsd2.md` — slash command definition
- `tests/gsd2-import.test.cjs` — 41 tests, 99.21% statement coverage
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Closes#2070
Two-layer fix for the bug where executor agents in worktree isolation mode
could leave SUMMARY.md uncommitted, then have it silently destroyed by
`git worktree remove --force` during post-wave cleanup.
Layer 1 — Clarify executor instruction (execute-phase.md):
Added explicit REQUIRED note to the <parallel_execution> block making
clear that SUMMARY.md MUST be committed before the agent returns,
and that the git_commit_metadata step in execute-plan.md handles the
SUMMARY.md-only commit path automatically in worktree mode.
Layer 2 — Orchestrator safety net (execute-phase.md):
Before force-removing each worktree, check for any uncommitted SUMMARY.md
files. If found, commit them on the worktree branch and re-merge into the
main branch before removal. This prevents data loss even when an executor
skips the commit step due to misinterpreting the "do not modify
orchestrator files" instruction.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(review): add Qwen Code and Cursor CLI as peer reviewers (#1938, #1960)
Add qwen and cursor to the /gsd-review pipeline following the
established pattern from CodeRabbit and OpenCode integrations:
- CLI detection via command -v
- --qwen and --cursor flags
- Invocation blocks with empty-output fallback
- Install help URLs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(review): correct qwen/cursor invocations and add doc surfaces (#1966)
Address review feedback from trek-e, kturk, and lawsontaylor:
- Use positional form for qwen (qwen "prompt") — -p flag is deprecated
upstream and will be removed in a future version
- Fix cursor invocation to use cursor agent -p --mode ask --trust
instead of cursor --prompt which launches the editor GUI
- Add --qwen and --cursor flags to COMMANDS.md, FEATURES.md, help.md,
commands/gsd/review.md, and localized docs (ja-JP, ko-KR)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The deviation rules and task commit protocol were duplicated between
gsd-executor.md (agent definition) and execute-plan.md (workflow).
The copies had diverged: the agent had scope boundary and fix attempt
limits the workflow lacked; the workflow had 3 extra commit types
(perf, docs, style) the agent lacked.
Consolidate gsd-executor.md as the single source of truth:
- Add missing commit types (perf, docs, style) to gsd-executor.md
- Replace execute-plan.md's ~90 lines of duplicated content with
concise references to the agent definition
Saves ~1,600 tokens per workflow spawn and eliminates maintenance
drift between the two copies.
Closes#1968
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
`intel.enabled` is the documented opt-in for the intel subsystem
(see commands/gsd/intel.md and docs/CONFIGURATION.md), but it was
missing from VALID_CONFIG_KEYS in config.cjs, so the canonical
command failed:
$ gsd-tools config-set intel.enabled true
Error: Unknown config key: "intel.enabled"
Add the key to the whitelist, document it under a new "Intel Fields"
section in planning-config.md alongside the other namespaced fields,
and cover it with a config-set test.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(workflow): offer recommendation instead of hard redirect when UI-SPEC.md missing
When plan-phase detects frontend indicators but no UI-SPEC.md, replace the
AskUserQuestion hard-exit block with an offer_next-style recommendation that
displays /gsd-ui-phase as the primary next step and /gsd-plan-phase --skip-ui
as the bypass option. Also registers --skip-ui as a parsed flag so it silently
bypasses the UI gate.
Closes#2011
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* ci: retrigger CI — resolve stale macOS check
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
AskUserQuestion is a Claude Code-only tool. When running GSD on OpenAI Codex,
Gemini CLI, or other non-Claude runtimes, the model renders the tool call as a
markdown code block instead of executing it, so the interactive TUI never
appears and the session stalls without collecting user input.
The workflow.text_mode / --text flag mechanism already handles this in 5 of
the 37 affected workflows. This commit adds the same TEXT_MODE fallback
instruction to all remaining 32 workflows so that, when text_mode is enabled,
every AskUserQuestion call is replaced with a plain-text numbered list that
any runtime can handle.
Fixes#2012
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds ios-scaffold.md reference that explicitly prohibits Package.swift +
.executableTarget for iOS apps (produces macOS CLI, not iOS app bundle),
requires project.yml + xcodegen generate to create a proper .xcodeproj,
and documents SwiftUI API availability tiers (iOS 16 vs 17). Adds iOS
anti-patterns 28-29 to universal-anti-patterns.md and wires the reference
into gsd-executor.md so executors see the guidance during iOS plan execution.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(worktree): use reset --hard in worktree_branch_check to correctly set base (#2015)
The worktree_branch_check in execute-phase.md and quick.md used
git reset --soft as the fallback when EnterWorktree created a branch
from main/master instead of the current feature branch HEAD. --soft
moves the HEAD pointer but leaves working tree files from main unchanged,
so the executor worked against stale code and produced commits containing
the entire feature branch diff as deletions.
Fix: replace git reset --soft with git reset --hard in both workflow files.
--hard resets both the HEAD pointer and the working tree to the expected
base commit. It is safe in a fresh worktree that has no user changes.
Adds 4 regression tests (2 per workflow) verifying that the check uses
--hard and does not contain --soft.
* fix(worktree): executor deletion verification and pre-merge deletion block (#1977)
- Remove Windows-only qualifier from worktree_branch_check in execute-plan.md
(the EnterWorktree base-branch bug affects all platforms, not just Windows)
- Add post-commit --diff-filter=D deletion check to gsd-executor.md task_commit_protocol
so unexpected file deletions are flagged immediately after each task commit
- Add pre-merge --diff-filter=D deletion guard to execute-phase.md worktree cleanup
so worktree branches containing file deletions are blocked before fast-forward merge
- Add regression test tests/worktree-safety.test.cjs covering all three behaviors
Fixes#1977
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
After complete_session in verify-work.md, when final_status==complete and
issues==0, the workflow now executes transition.md inline (mirroring the
execute-phase pattern) to mark the phase complete in ROADMAP.md and STATE.md.
Security gate still gates the transition: if enforcement is enabled and no
SECURITY.md exists, the workflow suggests /gsd-secure-phase instead.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
The worktree_branch_check in execute-phase.md and quick.md used
git reset --soft as the fallback when EnterWorktree created a branch
from main/master instead of the current feature branch HEAD. --soft
moves the HEAD pointer but leaves working tree files from main unchanged,
so the executor worked against stale code and produced commits containing
the entire feature branch diff as deletions.
Fix: replace git reset --soft with git reset --hard in both workflow files.
--hard resets both the HEAD pointer and the working tree to the expected
base commit. It is safe in a fresh worktree that has no user changes.
Adds 4 regression tests (2 per workflow) verifying that the check uses
--hard and does not contain --soft.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
