Security-motivated migration of all stale repository and npm-scope references. Three categories of changes (58 files, 174 substitutions): 1. gsd-build → open-gsd (security-critical): - .github/workflows/release-sdk.yml — npm token comment, tarball filename pattern - .github/workflows/hotfix.yml — same - .changeset/fix-3406-detect-stale-sdk-shadow.md — @gsd-build/sdk → @open-gsd/sdk - .changeset/sharp-quails-leap.md — same - get-shit-done/workflows/update.md — CHANGELOG raw GitHub URL 2. GSD-redux org slug → open-gsd (canonical rename): - package.json + sdk/package.json — repository/homepage/bugs metadata - All README.*.md — live badge and link sections - CONTRIBUTING.md, CONTEXT.md, QUICK-WINS-CONFIRMED-BUGS.md - .coderabbit.yaml, .release-monitor.sh, scripts/sync-rulesets.sh - docs/** — all live agent/ADR/user-facing documentation - tests/** — repo slug assertions and test fixtures - scripts/changeset/cli.cjs + github-release-notes.cjs - .github/ISSUE_TEMPLATE/*, .github/pull_request_template.md - bin/install.js, get-shit-done/bin/lib/model-catalog.cjs - sdk/HANDOVER-*.md, sdk/src/*.test.ts 3. CLAUDE.md (gitignored local file — not in this commit): Updated separately outside git: --repo gsd-build/get-shit-done → --repo open-gsd/get-shit-done-redux with security warning. Intentionally unchanged: CHANGELOG.md, docs/RELEASE-*.md, .changeset/README.md, .changeset/build-hooks-atomic-write.md, README.md migration table (historical fork record), tests/changeset-serialize.test.cjs line 78 (serialization fixture). The gsd-build/get-shit-done repo is compromised (rug-pull documented in README.md). Do not push to or interact with that repo. Closes #120
99 lines
3.6 KiB
TypeScript
99 lines
3.6 KiB
TypeScript
/**
|
|
* Contract test: every `gsd-sdk query agent-skills <slug>` invocation in
|
|
* `get-shit-done/workflows/**\/*.md` must reference a slug that exists as
|
|
* `agents/<slug>.md` at the repository root.
|
|
*
|
|
* A mismatch produces a silent no-op at runtime — the SDK returns `""` for an
|
|
* unknown key, and the workflow interpolates the empty string into the spawn
|
|
* prompt, so any `agent_skills.<correct-slug>` configuration in
|
|
* `.planning/config.json` is silently ignored. This test prevents regression.
|
|
*
|
|
* Related: https://github.com/open-gsd/get-shit-done-redux/issues/2615
|
|
*/
|
|
import { describe, it, expect } from 'vitest';
|
|
import { readFileSync, readdirSync, statSync } from 'node:fs';
|
|
import { dirname, join, relative } from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
const repoRoot = join(__dirname, '..', '..');
|
|
const workflowsDir = join(repoRoot, 'get-shit-done', 'workflows');
|
|
const agentsDir = join(repoRoot, 'agents');
|
|
|
|
/**
|
|
* Matches a full `gsd-sdk query agent-skills <slug>` invocation and captures
|
|
* the slug. Requires a token boundary before `gsd-sdk` and a word boundary
|
|
* after the slug so that prose references (e.g. documentation mentioning the
|
|
* string "agent-skills") do not produce false positives. The `\s+` between
|
|
* tokens accepts newlines, so commands wrapped across lines still match.
|
|
*/
|
|
const QUERY_KEY_PATTERN = /\bgsd-sdk\s+query\s+agent-skills\s+([a-z][a-z0-9-]*)\b/g;
|
|
|
|
interface QueryUsage {
|
|
readonly file: string;
|
|
readonly line: number;
|
|
readonly slug: string;
|
|
}
|
|
|
|
/** Recursively collects all `.md` file paths under `dir`. */
|
|
function walkMarkdown(dir: string): string[] {
|
|
const out: string[] = [];
|
|
for (const entry of readdirSync(dir)) {
|
|
const full = join(dir, entry);
|
|
if (statSync(full).isDirectory()) {
|
|
out.push(...walkMarkdown(full));
|
|
} else if (entry.endsWith('.md')) {
|
|
out.push(full);
|
|
}
|
|
}
|
|
return out;
|
|
}
|
|
|
|
/** Returns the set of agent slugs defined by `<slug>.md` files in `dir`. */
|
|
function collectAgentSlugs(dir: string): Set<string> {
|
|
return new Set(
|
|
readdirSync(dir)
|
|
.filter((name) => name.endsWith('.md'))
|
|
.map((name) => name.replace(/\.md$/, '')),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Extracts every `gsd-sdk query agent-skills <slug>` usage from the given
|
|
* markdown files. Runs the regex over each file's full content (not line by
|
|
* line) so wrapped commands still match, then resolves the 1-based line number
|
|
* from the match index.
|
|
*/
|
|
function collectQueryUsages(files: readonly string[]): QueryUsage[] {
|
|
const usages: QueryUsage[] = [];
|
|
for (const file of files) {
|
|
const content = readFileSync(file, 'utf8');
|
|
for (const match of content.matchAll(QUERY_KEY_PATTERN)) {
|
|
const index = match.index ?? 0;
|
|
const line = content.slice(0, index).split('\n').length;
|
|
usages.push({ file, line, slug: match[1]! });
|
|
}
|
|
}
|
|
return usages;
|
|
}
|
|
|
|
describe('workflow agent-skills query consistency', () => {
|
|
it('every `agent-skills <slug>` query refers to an existing `agents/<slug>.md`', () => {
|
|
const validSlugs = collectAgentSlugs(agentsDir);
|
|
const workflowFiles = walkMarkdown(workflowsDir);
|
|
const usages = collectQueryUsages(workflowFiles);
|
|
const invalid = usages.filter((u) => !validSlugs.has(u.slug));
|
|
|
|
const report = invalid
|
|
.map((u) => ` ${relative(repoRoot, u.file)}:${u.line} — unknown slug '${u.slug}'`)
|
|
.join('\n');
|
|
|
|
expect(
|
|
invalid,
|
|
invalid.length
|
|
? `Found ${invalid.length} agent-skills query keys with no matching agents/<slug>.md:\n${report}`
|
|
: '',
|
|
).toHaveLength(0);
|
|
});
|
|
});
|