220da8e487
* feat(#2529): /gsd-settings-integrations — third-party integrations command Adds /gsd-settings-integrations for configuring API keys, code-review CLI routing, and agent-skill injection. Distinct from /gsd-settings (workflow toggles) because these are connectivity, not pipeline shape. Three sections: - Search Integrations: brave_search / firecrawl / exa_search API keys, plus search_gitignored toggle. - Code Review CLI Routing: review.models.{claude,codex,gemini,opencode} shell-command strings. - Agent Skills Injection: agent_skills.<agent-type> free-text input, validated against [a-zA-Z0-9_-]+. Security: - New secrets.cjs module with ****<last-4> masking convention. - cmdConfigSet now masks value/previousValue in CLI output for secret keys. - Plaintext is written only to .planning/config.json; never echoed to stdout/stderr, never written to audit/log files by this flow. - Slug validators reject path separators, whitespace, shell metacharacters. Tests (tests/settings-integrations.test.cjs — 25 cases): - Artifact presence / frontmatter. - Field round-trips via gsd-tools config-set for all four search keys, review.models.<cli>, agent_skills.<agent-type>. - Config-merge safety: unrelated keys preserved across writes. - Masking: config-set output never contains plaintext sentinel. - Logging containment: plaintext secret sentinel appears only in config.json under .planning/, nowhere else on disk. - Negative: path-traversal, shell-metachar, and empty-slug rejected. - /gsd:settings workflow mentions /gsd:settings-integrations. Docs: - docs/COMMANDS.md: new command entry with security note. - docs/CONFIGURATION.md: integration settings section (keys, routing, skills injection) with masking documentation. - docs/CLI-TOOLS.md: reviewer CLI routing and secret-handling sections. - docs/INVENTORY.md + INVENTORY-MANIFEST.json regenerated. Closes #2529 * fix(#2529): mask secrets in config-get; address CodeRabbit review cmdConfigGet was emitting plaintext for brave_search/firecrawl/exa_search. Apply the same isSecretKey/maskSecret treatment used by config-set so the CLI surface never echoes raw API keys; plaintext still lives only in config.json on disk. Also addresses CodeRabbit review items in the same PR area: - #3127146188: config-get plaintext leak (root fix above) - #3127146211: rename test sentinels to concat-built markers so secret scanners stop flagging the test file. Behavior preserved. - #3127146207: add explicit 'text' language to fenced code blocks (MD040). - nitpick: unify masked-value wording in read_current legend ('****<last-4>' instead of '**** already set'). - nitpick: extend round-trip test to cover search_gitignored toggle. New regression test 'config-get masks secrets and never echoes plaintext' verifies the fix for all three secret keys. * docs(#2529): bump INVENTORY counts post-rebase (commands 84→85, workflows 82→83) * fix(test): bump CLI Modules count 27→28 after rebase onto main (CI #24811455435) PR #2604 was rebased onto main before #2605 (drift.cjs) merged. The pull_request CI runs against the merge ref (refs/pull/2604/merge), which now contains 28 .cjs files in get-shit-done/bin/lib/, but docs/INVENTORY.md headline still said "(27 shipped)". inventory-counts.test.cjs failed with: AssertionError: docs/INVENTORY.md "CLI Modules (27 shipped)" disagrees with get-shit-done/bin/lib/ file count (28) Rebased branch onto current origin/main (picks up drift.cjs row, which was already added by #2605) and bumped the headline to 28. Full suite: 5200/5200 pass.
45 lines
1.6 KiB
Markdown
45 lines
1.6 KiB
Markdown
---
|
|
name: gsd:settings-integrations
|
|
description: Configure third-party API keys, code-review CLI routing, and agent-skill injection
|
|
allowed-tools:
|
|
- Read
|
|
- Write
|
|
- Bash
|
|
- AskUserQuestion
|
|
---
|
|
|
|
<objective>
|
|
Interactive configuration of GSD's third-party integration surface:
|
|
- Search API keys: `brave_search`, `firecrawl`, `exa_search`, and
|
|
the `search_gitignored` toggle
|
|
- Code-review CLI routing: `review.models.{claude,codex,gemini,opencode}`
|
|
- Agent-skill injection: `agent_skills.<agent-type>`
|
|
|
|
API keys are stored plaintext in `.planning/config.json` but are masked
|
|
(`****<last-4>`) in every piece of interactive output. The workflow never
|
|
echoes plaintext to stdout, stderr, or any log.
|
|
|
|
This command is deliberately distinct from `/gsd:settings` (workflow toggles)
|
|
and any `/gsd:settings-advanced` tuning surface. It handles *connectivity*,
|
|
not pipeline shape.
|
|
</objective>
|
|
|
|
<execution_context>
|
|
@~/.claude/get-shit-done/workflows/settings-integrations.md
|
|
</execution_context>
|
|
|
|
<process>
|
|
**Follow the settings-integrations workflow** from
|
|
`@~/.claude/get-shit-done/workflows/settings-integrations.md`.
|
|
|
|
The workflow handles:
|
|
1. Resolving `$GSD_CONFIG_PATH` (flat vs workstream)
|
|
2. Reading current integration values (masked for display)
|
|
3. Section 1 — Search Integrations: Brave / Firecrawl / Exa / search_gitignored
|
|
4. Section 2 — Review CLI Routing: review.models.{claude,codex,gemini,opencode}
|
|
5. Section 3 — Agent Skills Injection: agent_skills.<agent-type>
|
|
6. Writing values via `gsd-sdk query config-set` (which merges, preserving
|
|
unrelated keys)
|
|
7. Masked confirmation display
|
|
</process>
|