3d6c2bea4b
* docs: clarify capture_thought is an optional convention (#1873) Issue #1873 merged /gsd:extract-learnings with an optional capture_thought hook, but the docs never explained what the tool is or where it comes from — readers couldn't tell whether it was a bundled GSD tool, a required dependency, or something they had to install. This surfaced in a user question on that issue's thread. Clarify in docs/FEATURES.md §112 and the workflow file that capture_thought is a convention — any MCP server exposing a tool with that name will be used; if none is present, LEARNINGS.md remains the primary output and the step is a silent no-op. No behavioral change. All 23 extract-learnings tests still pass. * fix(security): add human to detection message; test [/INST] closing form neutralization - Detection message now lists <human> alongside <system>/<assistant>/<user> - Sanitizer regex extended to cover [/INST] closing form (was only [INST]) - Detection pattern extended to cover [/INST] closing form - New sanitizeForPrompt test asserts [/INST] is neutralized Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(config): add workflow.security_* keys to VALID_CONFIG_KEYS Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: add language tag to fenced code block in FEATURES.md Fixes MD040 lint finding in PR #2379 — the capture_thought tool signature example was missing a javascript language identifier. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Tom Boucher <trekkie@nomorestars.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
30 KiB
30 KiB