* refactor(tests): standardize to node:assert/strict and t.after() per CONTRIBUTING.md
- Replace require('node:assert') with require('node:assert/strict') across
all 73 test files to enforce strict equality (no type coercion)
- Replace try/finally cleanup blocks with t.after() hooks in core.test.cjs
and hooks-opt-in.test.cjs per the test lifecycle standards
- Utility functions in codex-config and security-scan retain try/finally
as that is appropriate for per-function resource guards, not lifecycle hooks
Closes#1674
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* perf(tests): add --test-concurrency=4 to test runner for parallel file execution
Node.js --test-concurrency controls how many test files run as parallel child
processes. Set to 4 by default, configurable via TEST_CONCURRENCY env var.
Fixes tests at a known level rather than inheriting os.availableParallelism()
which varies across CI environments.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(security): allowlist verify.test.cjs in prompt-injection scanner
tests/verify.test.cjs uses <human>...</human> as GSD phase task-type
XML (meaning "a human should verify this step"), which matches the
scanner's fake-message-boundary pattern for LLM APIs. This is a
false positive — add it to the allowlist alongside the other test files
that legitimately contain injection-adjacent patterns.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): add response_language config for cross-phase language consistency
Adds `response_language` config key that propagates through all init
outputs via withProjectRoot(). Workflows read this field and instruct
agents to present user-facing questions in the configured language,
solving the problem of language preference resetting at phase boundaries.
Usage: gsd-tools config-set response_language "Portuguese"
Closes#1399
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test(security): allowlist discuss-phase.md for size threshold
discuss-phase.md legitimately exceeds 50K chars due to power mode
and i18n directives — not prompt stuffing.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- fix(#1572): phase complete now marks bold-wrapped plan checkboxes in ROADMAP.md
(`- [ ] **01-01**` format) by allowing optional `**` around plan IDs in the
planCheckboxPattern regex in both phase.cjs and roadmap.cjs
- fix(#1569): manager init no longer recommends 999.x (BACKLOG) phases as next
actions; add guard in cmdManagerInit that skips phases matching /^999(?:\.|$)/
- fix(#1568): add regression tests confirming init execute-phase respects
model_overrides for executor_model, including when resolve_model_ids is 'omit'
- fix(#1533): reject session_id values containing path traversal sequences
(../, /, \) in gsd-context-monitor and gsd-statusline before constructing
/tmp file paths; add security tests covering both hooks
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Address review feedback: sanitize manager.flags values to allow only
CLI-safe tokens (--flag patterns and alphanumeric values). Invalid
tokens are dropped with a stderr warning. Prevents prompt injection
via compromised config.json.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds `manager.flags.{discuss,plan,execute}` config keys so users can
configure flags that /gsd:manager passes to each step when dispatching.
For example, `manager.flags.discuss: "--auto --analyze"` makes every
discuss dispatched from the manager include those flags.
Closes#1400
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes from trek-e's review on PR #1282:
1. Add missing withProjectRoot() wrapper on output — all other cmdInit*
functions include project_root in JSON, manager was the only one without it.
2. Add getMilestonePhaseFilter() to directory scan — prevents stale phase
directories from prior milestones appearing as phantom dashboard entries.
3. Replace hardcoded .planning/ paths with planningPaths(cwd) — forward
compatibility with workstream scoping (#1268).
4. Add 3 new tests:
- Conflict filter blocks dependent phase execution when dep is active
- Conflict filter allows independent phase execution in parallel
- Output includes project_root field
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add /gsd:manager — a single-terminal dashboard for managing milestones.
Shows all phases with visual status indicators (D/P/E columns), computes
recommended next actions, and dispatches discuss inline while plan/execute
run as background agents.
Key behaviors:
- Recommendation engine prioritizes execute > plan > discuss
- Filters parallel execute/plan when phases share dependency chains
- Independent phases (no direct or transitive dep relationship) CAN
run in parallel — dependent phases are serialized
- Dashboard shows compact Deps column for at-a-glance dependency view
- Sliding window limits discuss to one phase at a time
- Activity detection via file mtime (5-min window) for is_active flag
New files:
- commands/gsd/manager.md — skill definition
- get-shit-done/workflows/manager.md — full workflow spec
- get-shit-done/bin/lib/init.cjs — cmdInitManager() with phase parsing,
dependency graph traversal, and recommendation filtering
- get-shit-done/bin/gsd-tools.cjs — route 'init manager' to new command
- tests/init-manager.test.cjs — 16 tests covering status detection,
deps, sliding window, recommendations, and edge cases
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
