* fix: require fresh phase verification before transition
* no-mistakes(review): Fix canonical verification closeout gates
* no-mistakes(review): Fix verify-work frontmatter promotion command
* no-mistakes(review): Fix stale verification gates
* no-mistakes(review): Fix canonical verification routing gates
* no-mistakes(review): Fix verification dependency and runtime routing gates
* no-mistakes(review): Block stale verification bypasses
* fix: handle large init manager outputs in verification workflows
* chore: update changeset pr number
* fix(verify-work): use fresh verification.status for stale gate
The stale check after UAT used phase_completion.verification_status from
session-start INIT while human_needed promotion already queried fresh
verification.status. Align the stale gate with the canonical query so
mid-session verification refresh is not ignored.
* fix(init): skip roadmap-checked phases when selecting next_phase
Roadmap-only phases without a disk directory were still promoted to
next_phase when their checkbox was already checked. Exclude
checkboxComplete phases so progress routing does not point at work the
roadmap already marks done.
* fix: gaps_found not overridden by stale, transition uses canonical verification
- verification.cts: check gaps_found before stale so gap-closure routing
is not masked by a newer summary mtime
- phase.cts: remove redundant findStaleVerificationSummary — readVerificationStatus
already handles stale detection
- transition.md: replace raw grep on file content with verification.status query
to avoid false-positive blocks from body text matching
* ci: retrigger tests after rebase
* fix(transition): replace gsd_run advisory check with awk frontmatter extraction
The runtime launcher is not defined until the update_roadmap_and_state step
bash block (~line 165). The early verify_completion block used gsd_run to
query verification.status, which violated the runtime-launcher-parity test:
'preamble appears AFTER the first gsd_run reference'.
Replace the gsd_run call with an awk-based frontmatter extractor that reads
only the status: field between the two --- fences. This avoids both the
preamble-ordering constraint and the original false-positive grep bug where
body text like 'previous_status: gaps_found' would match a full-text regex.
The phase.complete gate at update_roadmap_and_state is the canonical
enforcement point; this early check is advisory only.
Also update workflow-size-baseline.json for the updated transition.md size.
Fixes: runtime-launcher-parity test (B)
Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
* fix: re-check verification under planning lock in phase complete
Move readVerificationStatus into withPlanningLock so stale verification
cannot slip through when a SUMMARY.md is written between the gate and
the roadmap/state mutation. Return the blocked status from the lock
callback and emit the error after release to avoid leaving .lock behind.
* fix(transition): gate on canonical verification.status including stale
Replace awk frontmatter read with verification.status query so transition
blocks when summaries are newer than VERIFICATION.md, matching phase.complete
and other workflows (autonomous, progress, verify-work).
* Fix workflow verification gates for yolo transition and stale routing
Require VERIFY_STATUS passed before yolo/interactive transition advance.
Route stale verification recovery to verify-work, matching canonical projection.
* fix(transition): use verification.status query for stale-aware advisory check
The awk-based check read raw frontmatter status: passed, which misses the
stale case where summaries are newer than the VERIFICATION.md file even
though the frontmatter still says passed. The stale status is computed from
file modification times, not stored in frontmatter.
Move the preamble to the verify_completion bash block (the first block with
a gsd_run call) so gsd_run query verification.status can be used for the
advisory check. This gives the full readVerificationStatus logic including
mtime-based staleness detection, matching the enforcement gate at phase.complete.
Capture full JSON (VERIFY_JSON) so next_action can be included in the
advisory output alongside the status.
Also update workflow-size-baseline.json for the updated transition.md size.
Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
* ci: trigger test matrix for 525b946
Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
* fix(transition): restore awk frontmatter extraction for pre-shim verification check
The gsd_run launcher shim is not defined until line ~163 of transition.md,
so the verification debt check at line ~80 cannot use gsd_run. Restore the
awk-based frontmatter extraction that correctly reads status without needing
the runtime, and restore the shim at its proper location before
phase.complete.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(#1522): clarify transition verification gate wording
* fix(#1522): update transition workflow size baseline
* fix(#1522): update workflow-size-baseline after rebase onto next
Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
* fix(#1522): guard findStaleVerificationSummary FS calls + thread opts.fs seam (review)
Address review blocker B1 on #1548: findStaleVerificationSummary ran fs.readdirSync
and two fs.statSync calls unguarded between readVerificationStatus's try/catch sections,
so a TOCTOU race (a SUMMARY listed by scanPhasePlans then removed before statSync) or any
FS error threw uncaught into callers NOT under the planning lock (init.manager /
init.progress / uat-predicate). Wrap the body in try/catch degrading to 'not stale', and
thread the injectable opts.fs seam (add statSync to FsLike, pass fsImpl from the caller)
for parity with readVerificationStatus's no-throw contract and testability. Also adds the
Verification Module glossary entry to CONTEXT.md (review B3).
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Tom Boucher <trekkie@nomorestars.com>
* fix(3687): update insert-phase docs and roadmapper to use --insert flag
Updates stale references in insert-phase.md workflow and
gsd-roadmapper.md agent to use the consolidated /gsd:phase --insert
command syntax instead of the retired /gsd-insert-phase and
/gsd:phase insert forms.
Closes#3687
* refactor(tests): consolidate Init Command Module — 7 files → 5
Closes#3755
Merges `tests/init-manager-deps.test.cjs` (#2267 regression) into
`tests/init-manager.test.cjs` (718 LOC), and
`sdk/src/query/init-progress-precedence.test.ts` (#2674 regression)
into `sdk/src/query/init-complex.test.ts` (788 LOC).
The 800 LOC ceiling prevents further consolidation:
- `tests/init.test.cjs` is pre-existing at 1630 LOC
- `sdk/src/query/init.test.ts` is at 791 LOC
- `sdk/src/query/init-workstream-milestone-op.test.ts` is a distinct
seam testing initMilestoneOp, roadmapAnalyze, and
resolveQueryRuntimeContext workstream resolution.
Also adds Init Command Module Glossary entry to CONTEXT.md.
Allowlist update deferred to rebase after #3738 merges (allowlist
file does not exist on origin/main).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(init): initExecutePhase preserves same-milestone archived phase dir (#3469)
When `phases clear` archives current-milestone phases into
`.planning/milestones/<version>-phases/` but the workflow is still on
that same milestone, `shouldDropArchivedPhaseMatch` was unconditionally
dropping the archived dir match. This caused `phase_dir: null` when the
phase was still executing in the current milestone.
Fix: detect when `phaseInfo.archived === currentMilestone` (read from
STATE.md) and skip the drop. The #2391 regression guard is safe because
that scenario involves archived.version != current milestone.
Also corrects two tests in `initRemoveWorkspace` to expect thrown
GSDError instead of `{ data: { error } }` — the production code was
intentionally changed to throw for CLI non-zero exit propagation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: arya rizky <aryarizkyardhipratama@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
The sliding-window pattern serialized discuss to one phase at a time
even when phases had no dependency relationship. Replaced it with a
simple predicate: every undiscussed phase whose dependencies are
satisfied is marked is_next_to_discuss, letting the user pick any of
them from the manager's recommended_actions list.
Closes#2268
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* test(2129): add failing tests for 999.x backlog phase exclusion
Bug A: phase complete reports 999.1 as next phase instead of 3
Bug B: init manager returns all_complete:false when only 999.x is incomplete
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(2129): exclude 999.x backlog phases from next-phase scan and all_complete check
In cmdPhaseComplete, backlog phases (999.x) on disk were picked as the
next phase when intervening milestone phases had no directory yet. Now
the filesystem scan skips any directory whose phase number starts with 999.
In cmdInitManager, all_complete compared completed count against the full
phase list including 999.x stubs, making it impossible to reach true when
backlog items existed. Now the check uses only non-backlog phases.
Closes#2129
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(tests): standardize to node:assert/strict and t.after() per CONTRIBUTING.md
- Replace require('node:assert') with require('node:assert/strict') across
all 73 test files to enforce strict equality (no type coercion)
- Replace try/finally cleanup blocks with t.after() hooks in core.test.cjs
and hooks-opt-in.test.cjs per the test lifecycle standards
- Utility functions in codex-config and security-scan retain try/finally
as that is appropriate for per-function resource guards, not lifecycle hooks
Closes#1674
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* perf(tests): add --test-concurrency=4 to test runner for parallel file execution
Node.js --test-concurrency controls how many test files run as parallel child
processes. Set to 4 by default, configurable via TEST_CONCURRENCY env var.
Fixes tests at a known level rather than inheriting os.availableParallelism()
which varies across CI environments.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(security): allowlist verify.test.cjs in prompt-injection scanner
tests/verify.test.cjs uses <human>...</human> as GSD phase task-type
XML (meaning "a human should verify this step"), which matches the
scanner's fake-message-boundary pattern for LLM APIs. This is a
false positive — add it to the allowlist alongside the other test files
that legitimately contain injection-adjacent patterns.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): add response_language config for cross-phase language consistency
Adds `response_language` config key that propagates through all init
outputs via withProjectRoot(). Workflows read this field and instruct
agents to present user-facing questions in the configured language,
solving the problem of language preference resetting at phase boundaries.
Usage: gsd-tools config-set response_language "Portuguese"
Closes#1399
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test(security): allowlist discuss-phase.md for size threshold
discuss-phase.md legitimately exceeds 50K chars due to power mode
and i18n directives — not prompt stuffing.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- fix(#1572): phase complete now marks bold-wrapped plan checkboxes in ROADMAP.md
(`- [ ] **01-01**` format) by allowing optional `**` around plan IDs in the
planCheckboxPattern regex in both phase.cjs and roadmap.cjs
- fix(#1569): manager init no longer recommends 999.x (BACKLOG) phases as next
actions; add guard in cmdManagerInit that skips phases matching /^999(?:\.|$)/
- fix(#1568): add regression tests confirming init execute-phase respects
model_overrides for executor_model, including when resolve_model_ids is 'omit'
- fix(#1533): reject session_id values containing path traversal sequences
(../, /, \) in gsd-context-monitor and gsd-statusline before constructing
/tmp file paths; add security tests covering both hooks
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Address review feedback: sanitize manager.flags values to allow only
CLI-safe tokens (--flag patterns and alphanumeric values). Invalid
tokens are dropped with a stderr warning. Prevents prompt injection
via compromised config.json.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds `manager.flags.{discuss,plan,execute}` config keys so users can
configure flags that /gsd:manager passes to each step when dispatching.
For example, `manager.flags.discuss: "--auto --analyze"` makes every
discuss dispatched from the manager include those flags.
Closes#1400
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes from trek-e's review on PR #1282:
1. Add missing withProjectRoot() wrapper on output — all other cmdInit*
functions include project_root in JSON, manager was the only one without it.
2. Add getMilestonePhaseFilter() to directory scan — prevents stale phase
directories from prior milestones appearing as phantom dashboard entries.
3. Replace hardcoded .planning/ paths with planningPaths(cwd) — forward
compatibility with workstream scoping (#1268).
4. Add 3 new tests:
- Conflict filter blocks dependent phase execution when dep is active
- Conflict filter allows independent phase execution in parallel
- Output includes project_root field
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add /gsd:manager — a single-terminal dashboard for managing milestones.
Shows all phases with visual status indicators (D/P/E columns), computes
recommended next actions, and dispatches discuss inline while plan/execute
run as background agents.
Key behaviors:
- Recommendation engine prioritizes execute > plan > discuss
- Filters parallel execute/plan when phases share dependency chains
- Independent phases (no direct or transitive dep relationship) CAN
run in parallel — dependent phases are serialized
- Dashboard shows compact Deps column for at-a-glance dependency view
- Sliding window limits discuss to one phase at a time
- Activity detection via file mtime (5-min window) for is_active flag
New files:
- commands/gsd/manager.md — skill definition
- get-shit-done/workflows/manager.md — full workflow spec
- get-shit-done/bin/lib/init.cjs — cmdInitManager() with phase parsing,
dependency graph traversal, and recommendation filtering
- get-shit-done/bin/gsd-tools.cjs — route 'init manager' to new command
- tests/init-manager.test.cjs — 16 tests covering status detection,
deps, sliding window, recommendations, and edge cases
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
