* fix(#663): resolve open CodeQL/Dependabot security alerts (ReDoS, prototype pollution, workflow perms, qs DoS) (#665) * fix(#663): resolve open CodeQL/Dependabot security alerts - ReDoS: collapse ambiguous nested quantifiers in phase-heading regexes (verify/validate/commands) and the plan-filename lookahead (phase) to provably-equivalent non-backtracking forms - prototype pollution: guard __proto__/constructor/prototype in setConfigValue - remove dead no-op .replace(/-/g,'-') in phase.cts - escape all regex metachars in bug-2839 test - add contents:read permissions to security-scan + install-smoke workflows - pin qs >= 6.15.2 via overrides (DoS GHSA) - broaden prompt-injection allowlist to translated security-model docs Closes #663 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#663): regression tests for prototype-pollution guard and roadmap-phase ReDoS Behavioral test that config-set rejects __proto__/constructor/prototype keys without polluting Object.prototype, plus a ReDoS guard (timing-bound) and behavior-preservation assertions for the collapsed phase-heading regexes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#663): make ReDoS regression assert structured result, not elapsed time Replace elapsed-time assertions (which tripped local/no-elapsed-assertion ESLint rule and were unsound for synchronous ReDoS) with structured-result assertions on adversarial inputs: assert that malformed phase headings/ unchecked-item lines without a terminating colon/space yield an empty Set, which is both the correct behavior and an exercise of the fixed linear regex on the catastrophic-backtracking input shape. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#663): add Security changeset fragment for #665 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#663): fold prototype-pollution regression into config.test.cjs The standalone bug-663-config-prototype-pollution.test.cjs was a 9th config-module test file, tripping lint-test-file-count (the allowlist is ratcheted and must not grow). Consolidated into config.test.cjs instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore(#660): bump next to 1.3.1-dev.0 (-dev stream per ADR 660) (#672) After the 1.3.0 release, next moves onto the -dev prerelease stream so the trunk self-identifies as unreleased (floor = next patch). First manual exercise of the ADR-660 release model. Refs #660 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * ci(#660): use scoped GSD_BOT_PR_TOKEN for backmerge & release merge-back PR creation (#673) The open-gsd org blocks the Actions GITHUB_TOKEN from creating PRs, so auto-backmerge and the release finalize merge-back PR steps can't open their PRs (must be done manually). Point those two steps at a scoped secret (pull-requests:write + contents:write), falling back to GITHUB_TOKEN so behavior is unchanged until the secret is added. Refs #660 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix: accept published installer migration checksums * fix(#670): self-healing recovery for installer-migration checksum drift (#675) Editing the body of an already-released installer migration drifts its computed checksum (it hashes plan.toString()). The integrity guard then hard-aborted every prior install on upgrade with "applied migration checksum changed" — a 100% reproducible blocker (v1.3.0, all platforms). Already-applied migrations are filtered out of `pending` and never re-run, so a drifted checksum is functionally inert. ADR-0008 anticipates checksum-mismatch state as something the install-state layer must handle gracefully (plan -> apply -> recover/report), not abort on. This supersedes the published-checksum allowlist merged in #674 (per-release maintenance debt — every historical checksum hand-pinned, still throws for any unregistered value) with a general, self-healing recovery: - Replace the throwing guard with non-fatal `collectAppliedChecksumDrift`, surfaced on `plan.checksumDrift`. - Reconcile drifted stored checksums durably on the next state write (`reconcileDriftedChecksums`), idempotently (no perpetual writes). - Relocate the "shipped migration bodies are immutable" rule to a CI baseline test that locks every shipped migration's checksum and fails on body drift — where #615 should have been caught, instead of blocking users. Removes #674's legacyChecksums field, per-migration checksum pins, published-checksums.json fixture, and compat test. Fixes #670 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#676): consolidate hotfix into release.yml (delete standalone hotfix workflow) (#678) * fix(#676): consolidate hotfix into release.yml; delete standalone hotfix workflow npm allows only one trusted publisher per package and it is release.yml, so the standalone hotfix.yml (token-auth) could never publish via OIDC (ENEEDAUTH on the v1.3.1 finalize). Fold the patch/hotfix path into release.yml — the sole OIDC trusted publisher — and delete hotfix.yml. - validate-version accepts X.Y.Z (Z>0) → hotfix/X.Y.Z + base_tag; rejects rc for hotfixes; X.Y.0 still → release/X.Y.0. - create branches hotfix/X.Y.Z from the base tag with optional auto-cherry-pick (default on) of fix:/chore: from next; release path unchanged. - finalize is branch-agnostic already and publishes @latest via the existing OIDC trusted publisher (no NODE_AUTH_TOKEN). - CONTRIBUTING branching table updated; hotfix.yml removed. Fixes #676 Supersedes #677. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#676): add hotfix/patch path to release.yml (OIDC trusted publisher) The companion to the hotfix.yml deletion: release.yml now handles patch versions (X.Y.Z) via hotfix/X.Y.Z branches and publishes @latest through the existing OIDC trusted publisher. CONTRIBUTING branching table updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#676): update tests/docs referencing deleted hotfix.yml (#680) hotfix.yml was deleted (folded into release.yml). Remove the now-broken release-coverage-scope and policy-release-no-npm-self-upgrade assertions that readFileSync'd hotfix.yml (release.yml equivalents retained), drop the dead install-smoke.yml path trigger, and update VERSIONING.md / docs/branching.md prose to describe hotfixes via the Release workflow with a patch version. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix: bump hono to 4.12.23 on next to clear moderate advisory Same moderate hono advisory (GHSA-3hrh-pfw6-9m5x et al.) that blocked the 1.3.1 hotfix is present on next (was 4.12.19); bump to keep the npm-audit gate green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#690): promote CHANGELOG 1.3.x + gate release-notes promotion (#694) * fix(#690): promote CHANGELOG 1.3.x + gate release-notes promotion /gsd:update showed an empty "What's New" preview after updating to 1.3.1 because CHANGELOG.md's 1.3.x content was never promoted out of [Unreleased] into dated sections, so `scripts/changeset/cli.cjs extract` returned exit 2 ("no releases in range"). - CHANGELOG.md: split [Unreleased] into dated [1.3.0] and [1.3.1] sections (1.3.1 = hono advisory bump + installer-migration checksum self-heal, #670; 1.3.0 = the feature release), restoring an empty [Unreleased]. - scripts/changeset/cli.cjs: new `verify` subcommand that exits non-zero when CHANGELOG has no dated `## [x.y.z]` heading for a version; hoist shared stripV/resolveChangelogPath helpers used by extract + verify. - .github/workflows/release.yml: gate the finalize job on `verify` (after the build, before tag/publish) so an unpromoted CHANGELOG can never ship again. - gsd-core/workflows/update.md: move `rm -f $CHANGELOG_TMP` after the human-readable extract re-run so the preview no longer degrades to "(changelog unavailable)". - tests: regression guard for the 1.3.x headings + extract range + verify command coverage (present/absent/undated/v-prefixed/--json/prerelease). Closes #690 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#690): add changeset fragment for #694 Fixed-type fragment for the user-facing /gsd:update preview fix and the release-notes promotion gate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#698): make auto-backmerge main→next actually land (admin-merge via PAT) (#699) The Auto Back-Merge workflow could open a back-merge PR but never landed it, and silently reported success on failure. Fixes: - Merge via admin bypass using GSD_BOT_PR_TOKEN (the PAT) instead of auto-merge, since back-merge PRs structurally can't satisfy next's required checks (Issue-link / PR-template / changeset-lint). - Stop swallowing create/merge failures with "|| echo ::warning" — real failures now fail the job. (That greenwashing hid the whole bug.) - Resolve the PR number with `--jq '.[0].number // empty'` (a no-match returns the string "null", not empty) and capture a freshly-created PR's number from the create URL to avoid GitHub API eventual-consistency races. - Merge the exact PR number (env-bound) rather than by branch name. - Force-push the disposable SHA-named bot branch, guarded by a chore/backmerge-main-to-next-* name check so a mislabeled PR can't redirect the force-push. - Apply labels non-fatally so a missing label can't abort PR creation. - On a genuine merge conflict, fail loudly (::error + exit 1) instead of pushing an empty branch and opening a PR with no diff. Closes #698 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#637): route 3 more workflows through gsd_run launcher (hardcoded $HOME sweep) (#642) * fix(#637): route 3 more workflows through gsd_run launcher (hardcoded $HOME sweep) The hardcoded `node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs"` invocation form fixed in plan-phase.md (#621) survived in three more workflows. Same bug class: on a global/shim-only install with no project-local runtime, the hardcoded path can miss a working install, so the step reports the tool "not found" instead of resolving it via the launcher. #3668 introduced gsd_run resolution; these sites were missed. - plan-review-convergence.md: convert the 3 hardcoded invocations (init, roadmap get-phase, state planned-phase) to gsd_run. File already carried the canonical preamble (first gsd_run is the earlier convergence-enabled check). - ingest-docs.md, spec-phase.md: convert their hardcoded invocations to gsd_run and inject the canonical launcher preamble via `node scripts/sync-runtime-launcher.cjs` (these files previously had no gsd_run and no preamble). The injected preamble is byte-equal to _runtime-launcher.snippet.sh and precedes the first gsd_run call, per runtime-launcher-parity invariant (B). - Add tests/bug-637-workflow-no-hardcoded-home-tool.test.cjs: repo-wide regression guard asserting NO workflow .md invokes gsd-tools via a hardcoded $HOME path. Generalizes the plan-phase-only guard from #621 — the parity test guards retired $GSD_SDK / bare /gsd-tools tokens but not this form, which is how it survived across four files. Fails on the pre-fix files, passes after. runtime-launcher-parity 7/7; full unit suite green (3477 pass / 0 fail). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(#637): add changeset fragment for PR #642 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(#637): update stale bug-2801 assertion to expect gsd_run bug-2801 pinned ingest-docs.md to the hardcoded node "$HOME/.../gsd-tools.cjs" init form, which #637 replaces with the gsd_run launcher. Flip the assertion to expect gsd_run init ingest-docs; the bare-gsd-tools rejection and CLI-handler tests are unchanged, and bug-637's repo-wide guard now owns the no-hardcoded-$HOME invariant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Tom Boucher <trekkie@nomorestars.com> * fix(#705): route hardcoded $HOME gsd-tools invocations in agents/commands through gsd_run (#707) * fix(#705): route hardcoded $HOME gsd-tools invocations in agents/commands through gsd_run The hardcoded `node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs" <cmd>` form (fixed for workflows in #621/#637) survived in agent/command surfaces and misresolves on global/shim-only installs. Route every agent-executed invocation through the resolved `gsd_run` launcher in gsd-phase-researcher, gsd-planner (load_graph_context extracted to a shared reference to stay under the planner size budget), import, and graphify. Add a regression guard over agents/ + commands/ + gsd-core/references/ bash blocks. User-facing display messages and docs are intentionally left untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#705): use repo changeset fragment format (type: Fixed, pr: 707) The hand-written fragment used the standard changesets package format (package: bump) which lacks the type:/pr: frontmatter the repo's docs-required lint consumes (fail_malformed_fragment / missing_type). Regenerated via scripts/changeset/new.cjs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#685): set windowsHide on all Windows child-process spawns (#688) * fix(#685): set windowsHide on all Windows child-process spawns A visible "gsd-core" console window flashed on Windows whenever a gsd-core child process spawned without `windowsHide: true`. The most visible offenders fire on every SessionStart / `/clear` (execNpm's `shell:true` npm view via the update-check worker) and on every Edit/Write/MultiEdit in a worktree (the worktree-path guard's git probe). Add `windowsHide: true` to every external-binary spawn in the runtime source: - hooks/gsd-context-monitor.js (record-session spawn) - hooks/gsd-worktree-path-guard.js (SPAWNOPT) - hooks/gsd-workflow-guard.js (git branch --show-current) - src/shell-command-projection.cts (execGit / execNpm / execTool) - src/check-command-router.cts (git log execFileSync) - src/roadmap-upgrade.cts (git status/rev-parse/reset/clean execSync) gsd-check-update.js already had it (the precedent). probeTty's tty call is POSIX-only and intentionally untouched. Adds a regression test that asserts each site plus a repo-wide completeness guard so a future external-binary spawn that omits windowsHide fails CI. No behavior change off-Windows. Closes #685 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#685): set changeset pr number to 688 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#687): bound agy print mode with its native --print-timeout (#689) `/gsd-review --agy` hung indefinitely on large prompts. agy's print mode runs the full tool-enabled agent, and on a big, file-path-rich prompt its agentic Cascade loops on the code_search/grep tool and never converges; the transcript fallback only runs after agy exits, so it can't recover a run that never exits. The agy CLI exposes no per-tool deny (that lives in the Antigravity SDK), but it does expose --print-timeout — agy's native print-mode cap. Pass it explicitly so a stalled run self-terminates through the tool's own mechanism; a non-zero exit discards any partial output so the existing transcript fallback / "review failed" stub take over. Adds a regression test. Closes #687 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#669): /gsd-review --cursor actually invokes cursor-agent (#686) * fix(#669): /gsd-review --cursor actually invokes cursor-agent The Cursor reviewer branch in review.md never ran the agent: - detection probed `cursor` (the IDE launcher) instead of the headless `cursor-agent` binary - the invocation used the two-token `cursor agent` (the IDE treats `agent` as a file-path argument, so the agent never starts) - the prompt was piped via stdin, but `cursor-agent -p` reads the prompt from a command-line argument, and `2>/dev/null` hid the empty result Probe `cursor-agent`; invoke `cursor-agent -p --mode ask --trust --output-format text` with the prompt passed as a file-path-reference argument (avoids the OS arg-length limit on large prompts); capture stderr so failures are diagnosable. Invert tests/cursor-reviewer.test.cjs to assert the corrected contract, with negative guards against the two-token form and the stdin pipe. The sibling `agy` reviewer already used the argument form. Closes #669 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#669): set changeset pr number to 686 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore: archive 463 shipped changeset fragments before wiring render (#714) CHANGELOG promotion was a manual operator step that was never run, so 463 fragments for work already shipped in <=1.3.1 accumulated in .changeset/. Their notes were already hand-curated into the dated [1.2.0]/[1.3.0]/[1.3.1] CHANGELOG sections (#690 backfill, PR #694). Rendering them now would duplicate and mis-attribute shipped work. Move them to .changeset/archived/ (read non-recursively by all changeset tooling, so never rendered), keeping only the 3 genuinely-unreleased fragments at the top level. Prep for wiring `render` into the release finalize job (#690 follow-up). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore(release): wire CHANGELOG render into release finalize job (#690 follow-up) (#715) * feat(#690): wire CHANGELOG render into release finalize job CHANGELOG promotion has always been a manual operator step, which is why 1.3.0/1.3.1 shipped unpromoted (#690). PR #694 added a `verify` latch that fails a release lacking a dated heading, but nothing performed the promotion. Wire `changeset render` into the finalize job, after build/test and before the verify gate, committing the promoted CHANGELOG so it ships with the release. Add a `--allow-empty` flag to cmdRender so a zero-fragment release still emits a dated heading (with a '_No notable changes._' placeholder) instead of writing nothing and tripping the verify gate. Note: requires the changeset-archive cleanup (separate PR) to land first, so the first render consumes only genuinely-unreleased fragments. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#713): set changeset pr number to 715 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * docs: document --only and --text flags for /gsd-autonomous (#695) (#716) Adds --only N and --text to the COMMANDS.md reference table and the run-phases-autonomously how-to guide, revised to fit the Diataxis framework (reference: factual/parallel rows; how-to: goal-framed sections). * feat(#656): Research module — content-addressed cache + provider seam + registry-API legitimacy (#664) * feat(#656): add Research Store module (content-addressed cache, TTL staleness) Content-addressed research cache behind a clock seam: researchKey (sha256, deterministic), putResearch/getResearch ({hit,stale}, never throws), ttlForSource (curated HIGH 30d / MED 7d / web LOW 1d), two-tier resolveStorePath (curated -> ~/.gsd/research-cache, web/synthesis -> project .planning/research/.cache). 28 behavioral + property tests; boundary coverage at ttl-1/ttl/ttl+1. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(#656): add Research Provider module (waterfall + confidence + plan) Single source of truth for the Balanced provider waterfall (docs Context7->Ref->Jina, web Exa+Tavily, fallback Perplexity/Brave, Firecrawl scrape-only). classifyConfidence stamps HIGH|MEDIUM|LOW by provider (never throws). providerAvailability maps config flags to usable providers. planResearch checks the Research Store (injected seam) and returns cache-hits + a per-question fetch plan, falling through the waterfall to the always-available websearch terminal. 22 behavioral + property tests. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(#656): add Package Legitimacy module (registry-API verdicts, slopcheck optional) Replaces the pip-install-or-degrade slopcheck prose gate with code: classifyPackage (pure, never throws) computes OK|SUS|SLOP from tunable thresholds (minAgeDays 30, minWeeklyDownloads 1000, requireRepo). checkPackages queries injectable npm/PyPI/crates registry adapters (real https with 5s timeout, degraded-not-thrown on failure); slopcheck is one optional adapter that can only escalate severity, never degrade to [ASSUMED]. 34 behavioral + property tests; boundary coverage on age and downloads (limit-1/limit/limit+1). Known follow-up: real npm adapter must add api.npmjs.org last-week downloads fetch (currently null -> unknown-downloads). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(#656): detect Tavily/Ref/Perplexity/Jina provider keys; complete npm downloads adapter config: add tavily_search/ref_search/perplexity/jina availability flags (env var or ~/.gsd/<x>_api_key), mirroring brave_search/exa_search/firecrawl, so the Research Provider waterfall can gate them. package-legitimacy: real npm adapter now fetches api.npmjs.org last-week downloads (bounded, degraded-not-thrown) so weeklyDownloads is populated. +12 config tests; 34 legitimacy tests unchanged. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(#656): expose Research seam via gsd-tools query (research-plan, research-store, package-legitimacy) Routes the L2-hybrid surface so agents reach it as CLI: 'query research-store get/put' (cache, HOME-sandboxable), 'query research-plan --input' (cache-hits + fetch plan from planResearch), 'query package-legitimacy check --ecosystem' (async registry verdicts). Commands skip .planning root resolution and appear in top-level usage. 5 behavioral runGsdTools tests; command-contract unchanged (335). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(#656): document Research module (CONTEXT predicates, ADR-0656, architecture, changeset) Adds GSD-RESEARCH.* + DEFECT.RESEARCH-PROVIDER-PROSE-DRIFT predicates to CONTEXT.md, ADR-0656 recording the L2-hybrid seam decision, a docs/ARCHITECTURE.md Research Module subsection, and an Added changeset fragment (pr:0, backfill on PR). Notes the #657 deferrals (agent collapse + install.js MCP mapping). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(#656): sync inventory for research modules Regenerate INVENTORY-MANIFEST.json and bump docs/INVENTORY.md CLI Modules count 82->85 with rows for research-store/research-provider/package-legitimacy (DEFECT.INVENTORY-DRIFT). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(#656): eslint-ignore generated research .cjs artifacts (ADR-457) research-store/research-provider/package-legitimacy .cjs are tsc-generated from src/*.cts, so they belong in the ESLint ignore block (lint the .cts source, not the emitted .cjs). Fixes tests/551-eslint-bin-lib-coverage. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(#656): backfill changeset pr number to #664 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(#656): satisfy eslint lint-tests gate Fix 20 eslint errors in the new research files: use helpers.cleanup() instead of raw fs.rmSync() in tests (local/no-raw-rmsync-in-tests, Windows-EBUSY retry budget); drop redundant '| string' union members and unnecessary type assertions; deterministic object normalization in researchKey (no-base-to-string). Logic unchanged; 6180 tests still green. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(#656): harden package legitimacy per review (W1/W2/I3/I4) W1: httpsGet now reads statusCode; npm/PyPI/crates map 404 -> exists:false -> SLOP (registry-existence is the #1 slopsquatting defense; previously only npm caught it). Transport made injectable (_setHttpGet) for hermetic 404 tests. W2: suspicious-postinstall is now terminal SLOP independent of the optional slopcheck adapter, and the regex drops the bare https?:// arm (over-fired on esbuild/sharp/node-gyp) for shell-exec/download-exec signatures only. I3: checkPackages now threads version to registry.lookup and adapters verify that specific version exists. I4: moreServerVerdict -> moreSevereVerdict. +11 regression tests (all RED-first); 45 total green. Addresses review by @davesienkowski on #664. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(#656): research-store tier coherence + freshness + version TTL (W4/I1/I2/I4) I1: tier now derives from source (curated -> user ~/.gsd, else -> project .planning), not kind, so put-tier and get-tier can't diverge; kind is a key component only. W4: getResearch searches both tiers and returns the freshest (non-stale preferred), never letting a stale curated entry shadow a fresh web one; blank version caps TTL at 1 day (no 30d on version-blind keys). I2: atomic platformWriteSync instead of raw fs.writeFileSync on the shared global path. I4: dropped the dead ttlForSource arm. CLI get now searches both tiers. +5 RED-first regression tests; 38 green. Addresses review by @davesienkowski on #664. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(#656): expose classifyConfidence as a CLI route, killing dead code (W3) Adds 'gsd-tools query classify-confidence --provider X [--verified]' so research agents get the confidence tier FROM CODE (provider waterfall + verification lever) instead of asserting it in prose. classifyConfidence previously had no runtime caller. HIGH means 'trusted provider'; --verified raises web results to MEDIUM (verification semantics documented in ADR-0656). +4 behavioral tests. Addresses review by @davesienkowski on #664 (W3). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(#656): close Codex adversarial-review findings (path-traversal, version-age, malformed-cache) HIGH: research key must be 64-hex sha256 (isValidResearchKey) + resolved-path containment check in put/get + CLI validation -> blocks '../../x' arbitrary-file-write. HIGH: package legitimacy now derives publishedAt from the REQUESTED version (npm time[version], PyPI releases[version] upload_time, crates versions[].created_at) so a new malicious version of an old package can't inherit old age and evade 'too-new'. MEDIUM: getResearch validates entry shape (finite fetched_at + positive ttl + required fields) -> malformed cache entry is a miss, not fresh-forever. +regression tests (RED-first); 111 green. Codex adversarial review (required pre-PR gate). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(#656): close code-review correctness findings (1) package-legitimacy CLI now rejects unknown --flags instead of silently consuming the following package as a flag value; only --ecosystem takes a value. (2) crates recent_downloads (90-day) normalized to a weekly figure before the minWeeklyDownloads threshold (was ~13x too lenient). (3) research-plan --input validates parsed JSON is an object with an Array questions before destructuring -> clean usage error instead of an uncaught TypeError on null/bad input. (4) research-store put rejects a flag value that is itself a --flag (no more storing '--source' as content). (5) planResearch skips questions whose text is not a non-empty string instead of emitting question:undefined. +13 RED-first regression tests; 143 green. Code-review gate. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(#657): extract researcher documentation_lookup to shared @-reference 6 researcher agents carried a near-duplicate <documentation_lookup> block; consolidate into gsd-core/references/research-documentation-lookup.md (@-included). Unifies the ctx7 CLI fallback to the safer 'command -v ctx7' guard (drops silent 'npx --yes ctx7@latest' execution in 5 agents). Behavior-preserving dedup; inventory 63->64 references. Phase A of the agent collapse. Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(#657): extract researcher philosophy + verification-protocol to shared @-references philosophy and the pitfalls+pre-submission-checklist common-core were near-duplicated in project/phase researchers; consolidate into gsd-core/references/research-{philosophy,verification-protocol}.md (@-included). phase-researcher keeps its 3 extra checklist items inline. Pre-submission domains checklist made agent-agnostic so project-researcher doesn't lose features/architecture coverage. Write-contract intentionally left inline (bug-214 tests assert it verbatim). Inventory 64->66 refs. Behavior-preserving. Phase A. Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(#657): wire gsd-phase-researcher to the Research seam (Phase B / S1) The phase researcher now CALLS the code seam instead of carrying inline mechanics: provider waterfall -> 'gsd-tools query research-plan' (+ research-store put to cache digests); confidence-tier prose -> 'gsd-tools query classify-confidence'; slopcheck pip-install protocol -> 'gsd-tools query package-legitimacy check'. This makes the Research module a real runtime consumer (validates the seam end-to-end, addresses reviewer S1) and removes the duplicated waterfall/confidence/slopcheck prose. RESEARCH.md output contract, commit step, structured returns, and Phase-A @-includes unchanged. package-legitimacy-gate.test.cjs rewritten prose-grep -> behavioral (asserts the seam invocation). Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(#657): wire gsd-project-researcher to the seam + add tavily/ref/jina MCP tools (Phase C.1) project-researcher now calls gsd-tools query research-plan / classify-confidence (+ research-store put) instead of the inline provider waterfall + confidence-tier prose (mirrors the phase-researcher rewire; no package-legitimacy — phase-only). Output contract (STACK/FEATURES/ARCHITECTURE/PITFALLS/SUMMARY.md + sections, no-commit, structured returns, Phase-A @-includes) unchanged. Adds mcp__tavily/ref/jina__* to the project/phase/ui researcher tools frontmatter (Balanced provider set) so install.js MCP mapping (C.2) has a consumer. Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(#657): cover tavily/ref/jina MCP install handling + frontmatter parity guard (Phase C.2) Investigation: exa/firecrawl have no explicit per-runtime tool-mapping — every mcp__<server>__* except context7 rides the generic passthrough (Copilot lowercases; OpenCode/Cursor/Windsurf/Augment keep as-is; Gemini auto-discovers). tavily/ref/jina are handled identically, no install path broken. Added 12 copilot-install passthrough tests + a mcp-tool-inheritance parity guard (tavily co-declared with exa, jina with firecrawl, ref present across the 3 web researchers) so the MCP set can't drift. No io.github registry ids invented (none sourceable in-repo); documented as a follow-up. 488 tests green. Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(#657): profiles as source of truth for researcher agents + drift-guard (Phase C.3) scripts/research-profiles.cjs declares each of the 7 researcher agents' identity + contract (name, description, color, tools, required @-includes, required gsd-tools seam calls, output-contract markers). scripts/gen-research-agents.cjs --check validates every committed agent against its profile; --write regenerates ONLY the frontmatter from profiles (body untouched) and is a verified no-op against the current agents (zero diff = fidelity). tests/research-agent-profiles.test.cjs is the DEFECT.GENERATIVE-FIX drift guard. Design note: profiles govern the generatable/contract surface rather than destructively regenerating the disparate operational prose bodies (those were deduped via @-includes in Phase A). scripts/ is not inventoried (no inventory change). Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(#657): complete agent provider-dispatch + parity guard; align legitimacy field; validate profiles Adversarial-review findings: (HIGH) the seam-wired agents' Step-C dispatch only mapped 6 providers, so a planResearch result of jina/ref/perplexity/brave (reachable via the waterfall fallbacks) had no handling -> agent stall; completed both agents' dispatch to all 9 PROVIDER_WATERFALL ids + a catch-all, and added a parity test asserting agent dispatch stays in sync with research-provider PROVIDER_WATERFALL (DEFECT.GENERATIVE-FIX). (MEDIUM) phase-researcher package-legitimacy JSON example used 'package' but the module returns 'name' -> aligned. (LOW) gen-research-agents checkAgent now returns a clear failure for a malformed profile instead of throwing. +parity/validation tests (RED-first). Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(#656): make classifyConfidence verification-evidence-driven (W3) Confidence conflated provider authority with claim verification — context7/ref stamped HIGH purely by provider identity, and the only verification lever was a self-set --verified flag. Split into two axes: provider authority (static) + verification evidence (code-computed). HIGH now requires ground-truth corroboration (legitimacyVerdict OK), independent of provider; authority alone caps at MEDIUM; SLOP caps at LOW; the self-reported --verified is demoted to a MEDIUM-only web lever. HIGH = corroborated-against-authoritative-source, not a correctness guarantee. Adds --legitimacy-verdict to the classify-confidence CLI; updates CONTEXT.md predicate + ADR-0656 (tier set unchanged, ADR-consistent). Addresses davesienkowski's W3 review on #664. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#656): bind classify-confidence verdict to code, closing CLI self-grading Adversarial review found the new --legitimacy-verdict flag was caller-supplied, so an agent could self-assert OK->HIGH without any real legitimacy check — reintroducing the exact self-grading hole W3 closes. Remove the free flag; the CLI now computes the verdict via checkPackages only when --package/--ecosystem is given (code-computed, not agent-asserted). Update the stale CLI test (context7 alone -> MEDIUM) and extend the property test to vary legitimacyVerdict. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(#717): re-base workflow size budget on bytes + document quality rationale (#719) * feat(#717): re-base workflow size budget on bytes + document quality rationale Re-base tests/workflow-size-budget.test.cjs from line counts to byte counts (matches Codex's 32,768-byte project_doc_max_bytes cap; deterministic, no tokenizer). Tier ceilings: XL=90000, LARGE=54000, DEFAULT=38000, GRACE=3000; discuss-phase target re-expressed as <30 KB. The #597 tighten-only ratchet and per-file budget semantics are preserved unchanged — only the unit swaps. byteCount() uses fs.statSync().size to match `wc -c` (includes trailing newline), deliberately not lineCount()'s newline-stripping. Document the context-rot / attention-budget QUALITY rationale (independent of prompt caching) in the test JSDoc and docs/ARCHITECTURE.md, plus the Goodhart caveat: the byte budget measures one file, so the real goal is bounded *loaded* context — eager @-imports game the proxy; legitimate extraction is lazy. Update CONTEXT.md RULESET.WORKFLOW_SIZE_BUDGET to bytes and remove a stale duplicate ruleset entry that still said "1800 lines". Defers the #3182 MVP-mode split (tracked separately): MVP is a cross-cutting concern woven through plan-phase/execute-phase, not a discrete extractable mode. Closes #717 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#717): add changeset fragment for byte-budget re-base Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#159): auto-use existing RESEARCH.md in /gsd:plan-phase --research-phase (#718) * feat(#159): auto-use existing RESEARCH.md in /gsd:plan-phase --research-phase When RESEARCH.md already exists in research-only mode and neither --research nor --view is passed, emit a one-line notice and exit cleanly instead of prompting update/view/skip. This matches the promptless auto-use of standard /gsd:plan-phase <N> (§5.1) and removes the §5.0/§5.1 inconsistency, making AI-agent and CLI invocations non-interactive in the common case. The two explicit-flag escape hatches (--research to refresh, --view to print) cover any deviation. Closes #159 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#159): point changeset fragment at PR #718 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#159): tighten research-phase reference register (Diataxis) Make the 'no modifier' research-phase entries descriptive rather than imperative and drop the trailing 'pass --research/--view' clauses, which duplicated the adjacent --research/--view documentation. Reference docs describe; the recovery flags are documented in their own entries. The emitted runtime notice in the workflow keeps naming the flags (in-band recovery), unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore: clean up clear-cut ESLint warnings (#732) (#734) Pay down pre-existing error→warn lint debt. Removes dead imports/vars, unused functions, redundant regex/string escapes, and stale eslint-disable directives; converts unused `catch (_e)` to optional catch binding (src/*.cts). No behavior change. Lint 345→125 warnings (0 errors); deferred categories (n/no-process-exit, test-sleeps, control-regex) tracked in #732 for follow-up. Full test suite green (0 failures); code-review verified all removals unused and all escape fixes semantics-preserving. Closes #732 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore(lint): justify intentional no-control-regex (ANSI strip) + ratchet to error (#737) The 5 no-control-regex warnings are all the same intentional ANSI-color-strip pattern /\x1b\[[0-9;]*m/g across 5 test files. The \x1b (ESC) control char is the required leading byte of an ANSI SGR sequence, so matching it is the whole point of stripping color codes from captured CLI/console output. Add an inline eslint-disable-next-line with justification at each site (not a refactor — the control char is essential, not accidental), then flip no-control-regex from warn to error so the debt can't regrow. Refs #736 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore(lint): refactor magic-sleep tests to async waits + ratchet rules to error (#735) Replace raw setTimeout/Atomics.wait synchronization sleeps in 4 test files with a shared async delay()/waitFor() poll-for-condition helper in tests/helpers.cjs, then flip local/no-magic-sleep-in-tests and no-restricted-syntax from warn to error so the debt can't regrow. - tests/helpers.cjs: add delay(ms) + waitFor(predicate, opts), exported - bug-1974: setTimeout backoff -> await delay() - config.test: drop Atomics.wait sleep(); async retry via await delay() - graphify: waitForBuildStatus/cleanupHookRepo async via await delay() - locking-bugs: 3 Atomics.wait poll loops -> await waitFor() - eslint.config.mjs: ratchet both rules warn -> error Refs #733 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#704): exclude } and ) from Codex path-rewrite lookbehind (no literal $gsd-core in installs) (#710) * fix(#704): exclude } and ) from Codex path-rewrite lookbehind Shell variable expressions like \${VAR}/gsd-core/ and command-substitution paths like \$(cmd)/gsd-local-patches were being rewritten to \$gsd-core and \$gsd-local-patches respectively because the negative lookbehind in convertSlashCommandsToCodexSkillMentions did not include } or ). Add both characters to the lookbehind set: (?<![a-zA-Z0-9./})]) Also adds regression test: tests/bug-704-codex-launcher-path-corruption.test.cjs Closes #704 * chore: add changeset for #704 * test: use RUNTIME_ROOT_PATH in assertion to eliminate dead-code lint warning Replace the partial hard-coded fragment '}/gsd-core/bin/' with the existing RUNTIME_ROOT_PATH const so the assertion both compiles clean (no unused variable) and self-documents which canonical launcher path must survive Codex conversion intact (#704). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: link changeset to PR #710 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(#706): skip rescue of already-committed SUMMARY to avoid worktree cleanup merge_failed (#709) * fix(#706): skip rescueSummaryArtifacts when SUMMARY is already committed rescueSummaryArtifacts now probes `git cat-file -e HEAD:<path>` before copying a SUMMARY.md into the main checkout. When the file is already committed on the worktree branch, copying it as an untracked file causes `git merge --no-ff` to abort with "untracked working tree files would be overwritten by merge" — a permanent merge_failed cleanup-wave failure. Fail-closed on timeout: if cat-file is unreliable we skip rescue (the merge will surface the collision as it did before, which is recoverable). Adds 4 new test cases in worktree-safety.test.cjs covering: - committed SUMMARY skipped, merge succeeds (#706 regression case) - committed SUMMARY skipped even when timeout (fail-closed) - uncommitted SUMMARY still rescued (existing contract preserved) - rescue failure on ENOSPC still propagates (unchanged) Closes #706 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: add changeset for #706 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(#706): treat cat-file exit 128 as uncertain — skip rescue (fail-closed) The previous guard skipped rescue only when `exitCode === 0` (committed) or `timedOut`. Any other non-zero exit, including `128` (fatal git error: corrupt object store, unborn HEAD, missing repo), fell through and PROCEEDED with rescue — potentially re-creating the #706 untracked-file merge collision. Fix: rescue ONLY when `exitCode === 1` (cat-file definitively reports the object absent). All other outcomes — 0 (committed), 128 (fatal), null/SIGTERM (timeout), or any other code — are treated as "uncertain → skip rescue". Also corrects the JSDoc bullet that still referenced `git ls-files --error-unmatch` (the old mechanism); updated to `git cat-file -e HEAD:<relPath>`. Regression test added: asserts rescue is SKIPPED when cat-file returns exit 128, leaving the merge to surface the issue safely rather than silently copying an already-committed file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: link changeset to PR #709 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor(scripts): replace process.exit() with ExitError + runMain handler (#739) (#740) Part 1 of 2 of the n/no-process-exit cleanup (umbrella #738): convert every process.exit() call in standalone scripts/** CLIs to the rule-compliant pattern. - New shared helper scripts/lib/cli-exit.cjs: ExitError(code,message) + runMain() which translates a thrown ExitError / returned number into process.exitCode (never process.exit()), flushing output and still firing process.on('exit'). - main()-based entrypoints: throw new ExitError(code) for errors, return <code> for verdicts; invoked via runMain(main). Child exit codes preserved via return. - top-level-only scripts: imperative body extracted into main() so mid-flow aborts (throw ExitError) actually halt; pure consts/helpers stay at module scope. - diff-touches-shipped-paths.cjs: stdin event handling restructured to an async read so the whole flow runs under runMain; uncaughtException/unhandledRejection nets replaced by an in-band catch that preserves EXIT_ERROR=2. Exit codes verified unchanged for every converted script (success/error/help and the 0/1/2 semantic codes in diff-touches). Rule stays warn here; flipped to error in part 2 (#738) once gsd-core/bin/** is also clean. Refs #739 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * refactor(bin): replace process.exit() in CLI entrypoints + ratchet rule to error (#738) (#741) Part 2 of 2 of the n/no-process-exit cleanup (completes umbrella #738; part 1 was #739/scripts). Converts the 20 flagged process.exit() calls in the three hand-written gsd-core/bin CLI entrypoints and flips n/no-process-exit to error. - New src/cli-exit.cts -> gsd-core/bin/lib/cli-exit.cjs (ExitError + runMain), the gsd-core-side equivalent of scripts/lib/cli-exit.cjs; registered in .gitignore, eslint ignores, and the inventory manifest like its siblings. - gsd-tools.cjs: 13 apply-prompt-budget exits -> throw ExitError; main()->runMain. - verify-reapply-patches.cjs: 6 exits -> throw ExitError / return verdict; runMain. - check-latest-version.cjs: 1 exit -> return verdict; runMain. - eslint.config.mjs: n/no-process-exit warn -> error. Scope note: the gsd-core/bin/lib/*.cjs modules (core, state, profile-pipeline, roadmap-command-router, adr-parser, ui-safety-gate) are tsc-generated and eslint-ignored (ADR-457), so their process.exit calls were never flagged and are intentionally left untouched. Only the linted hand-written entrypoints are in scope. Exit codes verified unchanged for all three entrypoints. Closes #738 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * refactor(#720): lazy-load MVP-only reference bodies on non-MVP runs (#746) * refactor(#720): lazy-load MVP-only reference bodies (eager @-import → gated Read) Convert eager @-imports of MVP-only reference bodies into lazy "Read" instructions gated on MVP_MODE / WALKING_SKELETON / MVP+TDD, so non-MVP planning/execution runs no longer pull MVP guidance into context. Covers both the workflow files and the planner/executor agent definitions (the dominant context-cost path): - workflows/plan-phase.md: planner-mvp-mode.md + skeleton-template.md (L146/936/937/941) - workflows/execute-phase.md: execute-mvp-tdd.md halt-report ref, now gated on gate-trip (L191) - agents/gsd-planner.md: planner-mvp-mode.md, user-story-template.md, skeleton-template.md - agents/gsd-executor.md: execute-mvp-tdd.md The dedicated always-MVP mvp-phase workflow keeps its eager imports (intentional). Behaviour is unchanged; non-MVP runs simply carry less loaded context. Adds a regression guard mirroring the discuss-phase lazy-load test, and documents the conformance in docs/ARCHITECTURE.md. Refs #720 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#720): add changeset fragment (pr #746) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * refactor(#712): replace Codex slash-command denylist lookbehind with positive-boundary match (#747) * refactor(#712): replace Codex slash-command denylist lookbehind with positive-boundary match The hyphen-style /gsd-<cmd> -> $gsd-<cmd> conversion in convertSlashCommandsToCodexSkillMentions used a negative-lookbehind DENYLIST enumerating characters that must NOT precede a real mention. #637 -> #704 showed this is an unbounded treadmill: each new unanticipated preceding char (/, ., word chars, then }, )) leaked the same path-corruption bug class, and a backtick-wrapped path (`/gsd-core/workflows/update.md`) still leaked through. Replace it with a POSITIVE two-boundary definition of a mention: 1. Left: opens at start-of-string, whitespace, or an inline-prose delimiter (backtick/quote/paren/bracket). 2. Right: the command token is not followed by a path separator `/` (a path continues, a command does not). The (?![a-z0-9/-]) lookahead also blocks regex backtracking to a shorter command. This closes the whole class by construction (no preceding-char denylist to maintain) and fixes the backtick-wrapped-path corruption the #704 test documented as a pre-existing gap, while preserving conversion of legitimate backtick-wrapped mentions (e.g. CONTEXT.md's `/gsd-execute-phase` lists). The colon-style /gsd: replace is intentionally left unguarded (it never appears as a filesystem path segment) and is annotated as such. Tests assert the regex directly (function now exported) across a convert/ don't-convert matrix plus one end-to-end pipeline assertion for the headline backtick-path case. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#712): add changeset fragment for PR #747 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#730): scope current-milestone Phase Details section in roadmap parser (#748) `extractCurrentMilestone()` scoped the current-milestone window to its `## Phases` checklist subsection and terminated at the milestone's own `## Milestone … (Phase Details)` heading, so the `### Phase N:` detail headers fell outside scope. Every parser-backed command — `init.phase-op` (and thus `/gsd:discuss-phase`, `/gsd:plan-phase`), `state`, `roadmap list`, and `validate health` (W006) — therefore could not resolve phases of any milestone after the first until a `.planning/phases/` directory already existed, blocking discuss/plan. The parser now additionally includes the current milestone's `(Phase Details)` section in scope, located via the already-computed version matches and anchored (boundary-aware) to the selected milestone's version token so sibling sub-milestones sharing a version prefix do not cross-pollinate. The existing heading selection and primary window are unchanged. Adds tests/bug-730-milestone-phase-details-scope.test.cjs covering the two-milestone reproduction, first-milestone non-regression, direct getRoadmapPhaseInternal resolution, validate-health W006 visibility, a three-milestone roadmap, and the closed-sibling sub-milestone case. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#683): auto-degrade phase execution to sequential on worktree base mismatch (#749) * fix(#683): auto-degrade phase execution to sequential on worktree base mismatch Claude Code forks worktree-isolated executors off the repository default branch (origin/HEAD), not the orchestrator's HEAD. Running /gsd-execute-phase on a branch diverged from the default (unmerged milestone/feature branch) left every executor without the phase's plan files and tripped the worktree-branch-check guard with `exit 42` — 100% reproducible, all OSes. - New module src/worktree-base-ref.cts: HEAD-vs-fork-base drift detection (origin/HEAD with symbolic-ref fallback) and no-clobber worktree.baseRef management, exposed as `worktree base-check` / `worktree set-baseref`. - execute-phase.md: pre-dispatch, for Claude Code with worktrees enabled, auto-degrades the run to sequential on the main tree when a base mismatch is detected, recommending worktree.baseRef:"head". The exit-42 guard stays as a backstop. - Installer: fresh local Claude installs set worktree.baseRef:"head" in .claude/settings.local.json (no-clobber, respecting an explicit shared settings.json value); upgrades print an opt-in notice pointing at `gsd-tools worktree set-baseref`. - Docs: how-to guide, CLI/config reference, planning-config cross-ref. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#683): auto-apply worktree.baseRef on upgrade; gate fresh+upgrade on use_worktrees Per maintainer direction: on a local Claude Code UPGRADE, set worktree.baseRef:"head" automatically (no opt-in notice) when the project's workflow.use_worktrees is enabled, instead of merely printing a remediation notice. For consistency the FRESH path is now gated the same way: both paths compute worktrees-enabled once (bounded walk-up read of .planning/config.json, default enabled unless workflow.use_worktrees === false) and apply the no-clobber baseRef only when enabled — never overwriting an explicit value in settings.local.json or a shared settings.json. gsd-tools worktree set-baseref remains for manual use. Docs + changeset updated; tests hardened (file-exists assertions, fresh+disabled case, upgrade idempotency). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#683): measure workflow byte-budget on LF, fixing Windows-only CI failure The workflow-size-budget test failed only on Windows: git checks out the .md files as CRLF (no eol=lf in .gitattributes) and byteCount used fs.statSync().size (raw on-disk bytes), counting an extra \r per line. That inflated execute-phase.md — the XL high-water-mark file pinned near its ceiling by the tighten-only ratchet — from 88492 LF bytes to ~90245 on Windows, over the 90000 XL ceiling, while passing on the LF-checkout Mac/Linux runners. The ceilings are explicitly "calibrated against raw `wc -c`" on an LF checkout, so the measurement should be LF-based on every platform. byteCount now reads the file and counts Buffer.byteLength after stripping CR, making the budget platform-independent (a no-op on LF checkouts; verified statSync === normalized for all 88 workflow files). No ceilings changed. Added a regression test asserting CRLF and LF content of the same file count identically. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#683): make worktree-base-ref test path mocks Windows-safe (path.join) tests/worktree-base-ref.test.cjs keyed its injected readFile/writeFile mocks (and a few expected `file` values) with forward-slash template literals like `${claudeDir}/settings.local.json`. The module composes those paths with path.join(), which emits backslashes on Windows, so the mock keys never matched the module's lookup → readFile returned null → resolveEffectiveBaseRef / cmdWorktreeBaseCheck / cmdWorktreeSetBaseRef (and the JSONC variants) failed on the Windows full-test runner only (they passed on Mac/Linux, and the install tests passed because they use the real filesystem). The module is correct; only the test fixtures hardcoded '/'. All mock keys and path assertions now use path.join(base, ...) mirroring the module, so they match on every platform (no-op on POSIX). 19 path references across 16 lines. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#703): add --granularity override flag to /gsd:plan-phase (#750) * feat(#703): add --granularity override flag to /gsd:plan-phase Add a `--granularity <coarse|standard|fine>` flag to /gsd:plan-phase that overrides the configured planning granularity for a single invocation. The override is a new highest-priority tier above the existing precedence chain (granularities[phaseType] -> granularity -> planning.granularity -> 'standard') in resolveGranularityInternal; when the flag is absent, resolution is byte-for-byte unchanged. cmdInitPlanPhase now resolves with phaseType 'planning' so granularities.planning participates, and emits the resolved value in the init JSON, which the plan-phase workflow forwards to the planner prompt. Invalid values are rejected at the CLI boundary via a shared assertValidGranularityOverride helper. Closes #703 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#703): set changeset pr to 750 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#751): recognise config-set prototype-pollution guard in CodeQL + test dynamic-key vectors (#752) CodeQL alert #26 (js/prototype-pollution-utility) kept firing on setConfigValue because its dataflow does not trace the #663 Set-based, pre-loop keys.some(...) forbidden-key check as a sanitising barrier on the write site. - src/config.cts: replace the Set + pre-loop check with inline literal comparisons (key === '__proto__' || 'prototype' || 'constructor') on the exact key used to index `current`, immediately before each write (intermediate keys in the descent loop, plus the final key). Same forbidden set, same error message and ERROR_REASON.CONFIG_PARSE_FAILED — behaviour unchanged from #663, but the barrier is now CodeQL-recognised. - tests/config.test.cjs: add regression tests for schema-valid dynamic-prefix keys (agent_skills.__proto__, agent_skills.constructor, agent_skills.prototype, features.__proto__, review.models.constructor) that pass the isValidConfigKey schema gate and reach the guard. Each asserts the guard's own message fires (not the schema gate's "Unknown config key") and Object.prototype is not polluted. The prior #663 tests never reached the guard — their keys are rejected by the schema gate first — so the guard's real attack surface was untested. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#25): scope gsd-verifier Step 7b to enumerate-or-single-test; forbid full-suite re-runs (#753) * feat(#25): scope gsd-verifier Step 7b to enumerate-or-single-test; forbid full-suite re-runs Step 7b's lone test example (`npm test -- --grep "$PHASE_TEST_PATTERN"`) is mocha/vitest/jest-specific, where `--grep` filters which tests *execute*. Models generalized it to `cargo test --workspace 2>&1 | grep X` (runs the whole suite, filters only *output*) and repeated it once per must-have, adding minutes per verification with no new evidence after the first run. Replace the example with language-agnostic guidance: prove a test EXISTS via enumeration (`cargo test -- --list` / `pytest --collect-only` / `npx vitest list` / `go test -list`), and prove it PASSES via a single named test (`cargo test <name> -- --exact` / `pytest -k` / `npx vitest run -t`). Add a Spot-check constraint forbidding more than one full-suite run per verification or piping a full run through grep per must-have, while still permitting one saved run + grep when a full run is genuinely required. docs/AGENTS.md gains a one-line Key-behaviors note, and a new test asserts the Step 7b content. Scoped per the maintainer decision on the issue: folded into Step 7b (no new top-level Step 7a) with no VERIFICATION.md label changes. Closes #25 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#25): add Changed changeset fragment for PR #753 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#52): add agent_skills_security.trusted_global_roots allowlist for global skills (#754) * feat(#52): add agent_skills_security.trusted_global_roots allowlist Opt-in allowlist so a global: agent skill whose SKILL.md realpath resolves outside the default global skills base (e.g. ~/.claude/skills) is accepted when its real target lies under a user-declared trusted root. Default [] is byte-identical to prior behavior; the symlink-escape guard is preserved and simply re-applied against each declared root. - src/security.cts: loadTrustedGlobalRoots — tilde-expand (~ and ~/), reject project-relative and dangerously broad roots (filesystem/UNC root, homedir), realpath-canonicalize each root every run and drop non-existent ones. - src/init.cts: on base-check failure the guard consults the trusted roots (hoisted out of the loop); emits a stderr NOTE when a skill is accepted via a trusted root so the widened boundary is visible. - src/core.cts: thread agent_skills_security through loadConfig. - config-schema.manifest.json: allow the new key path. - docs/CONFIGURATION.md: document the option and its security model. - tests/agent-skills.test.cjs: unit + end-to-end CLI coverage (regression, feature, negative, broad-root hardening, stderr NOTE). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#52): add changeset fragment for trusted_global_roots (#754) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * refactor(#651): consolidate verification-status routing into one queryable seam (#755) * refactor(#651): consolidate verification-status routing into one queryable seam The passed/gaps_found/human_needed verification status was re-encoded as bare strings across three prose surfaces (gsd-verifier emits, execute-phase routes, ship gates), each independently deciding the per-status next action with no parity coupling — the DEFECT.GENERATIVE-FIX class. Give the enum one home: src/verification.cts (-> bin/lib/verification.cjs) exposing `gsd_run query verification.status <phaseDir>` returning a typed {status, next_action, next_command}. ship.md and execute-phase.md now consume the query instead of re-deriving the routing in prose; gsd-verifier.md points at the shared vocabulary as the single emitter (values unchanged). Also fixes the latent broad-grep status misread (DEFECT.FRONTMATTER-SCALAR- BROAD-GREP): execute-phase.md read `grep "^status:"` over the whole report, so a body `status:` line could misroute a valid phase. Extraction is now frontmatter-scoped in one place. A parity test fails if a verifier status gains no route. Lands the two CONTEXT.md DEFECT entries captured on the issue. Closes #651 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#651): set changeset pr to 755 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#758): trigger draft-PR auto-close on pull_request_target (#760) Bare `pull_request` hands fork PRs a read-only GITHUB_TOKEN, so the close/comment API calls 403 and a first-time/external contributor's draft PR survives — bypassing the auto-close for exactly the population the job targets. Switch to `pull_request_target`, which runs in the base-repo context with a write-capable token even for fork PRs. Safe because the job never checks out or executes PR-supplied code; it only reads event metadata and calls the GitHub API. The minimal `permissions: pull-requests: write` block still constrains the token. Add a regression guard in tests/workflow-maintainer-skip.test.cjs asserting the workflow triggers on pull_request_target and not bare pull_request. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * docs(#58): add ADR for Runtime Install Policy Module boundary (#762) Record the Runtime Install Policy Module decision and ownership boundary: install policy projects a pure, typed install plan by composing artifact placements (ADR-3660) and command text (ADR-0009) plus per-runtime config intentions, with no filesystem IO; runtime adapters consume the plan and execute concrete file mutations and format-specific config rendering. Explicitly records what stays outside the policy module (TOML/JSON/Markdown serialization, merge semantics, filesystem effects). Adds the ADR index row in docs/adr/README.md and a glossary entry in CONTEXT.md. Leads the installer-refactor chain (#58 -> #60 -> #56). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#759): non-destructive CHANGELOG preview in the rc release job (#763) The rc action publishes a release candidate to @next for testing but never surfaces the curated CHANGELOG section for the version under test — render only runs destructively at finalize (#715), so there was no safe way to preview the upcoming notes during the RC window. Add a --preview mode to scripts/changeset/cli.cjs cmdRender: it renders the dated release section to stdout via the existing renderChangelog/ serializeChangelog path (with priorChangelog: null, so only the new section is emitted), reuses the shared injectEmptyPlaceholder helper for zero-fragment releases, and returns WITHOUT writing CHANGELOG.md or deleting any .changeset fragment. Wire a "Preview CHANGELOG" step into the rc job that renders to a file (standalone command, so a malformed fragment fails the step) and cats it to the job summary and log. Closes #759 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#761): add scheduled base-context sweep to close SHA-branch-evading draft PRs (#765) close-draft-prs.yml (on pull_request_target after #760) cannot close fork draft PRs whose head branch name looks like a Git SHA — GitHub never dispatches pull_request_target for such branches, and a pull_request run from a fork gets a read-only token. So a draft PR on a SHA-named fork branch evades the auto-close. Add close-draft-prs-sweep.yml: a schedule (every 6h) + workflow_dispatch sweep running in base-repo context with pull-requests: write that paginates open PRs, filters to non-OWNER/MEMBER/COLLABORATOR drafts, and closes + comments them with the identical policy/message as the event-driven workflow. Re-fetches each candidate before mutating (TOCTOU guard), closes before commenting so enforcement is never gated on the explanatory comment, and core.setFailed on partial failures. The per-PR workflow remains the fast path; this is the safety net for the documented residual bypass. Extends tests/workflow-maintainer-skip.test.cjs with structural guards locking the triggers, write permission, maintainer carve-out, pagination, and message. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix discord release changelog announcements * test(#339): regression guard for gsd-sdk refs in runtime surfaces (#691) * test(#339): add regression guard for gsd-sdk refs in runtime surfaces Lock in the already-clean runtime surface so a retired `gsd-sdk`/`GSD_SDK` reference cannot creep back into a shipped prompt or hook. Scans gsd-core/workflows, gsd-core/references, commands/gsd, agents, and hooks (excluding the gitignored dist/ build artifact). Complements gsd-tools-path-refs.test.cjs, which only catches the `gsd-sdk query` binary form; this catches any runtime reference. A second test guards against an empty sweep so a future dir rename can't silently turn the guard into a no-op. Intentionally does NOT touch bin/install.js (live stale-package-detection mechanics per #339 triage) or CI/lint scripts (legitimate stale detection). Refs #339 * test(#339): split file content on /\r?\n/ for Windows CRLF parity The windows-test-parity-guard lint requires test files that readFileSync + split to use /\r?\n/, not '\n', so CRLF files don't leave a trailing \r. New test files are not in the PR #3649 allowlist. * test(#339): cover .sh/.json runtime files in workflows surface Address #691 review: the gsd-core/workflows surface scanned only .md, silently skipping two deployed runtime files — _runtime-launcher.snippet.sh (synced into every hook) and discuss-phase/templates/checkpoint.json. Add .sh/.json so the guard covers all 290 deployed runtime files (was 288/290), not just the .md subset. * test(#339): cover templates/contexts surfaces + per-ext empty-sweep guard Address PR #691 review (trek-e): - Add gsd-core/templates and gsd-core/contexts to RUNTIME_SURFACES — both are deep-copied by the installer and runtime-loaded via @~/.claude/gsd-core/templates/*.md anchors, so a reintroduced gsd-sdk ref there would have slipped past the guard. (major) - Reword the bin/install.js exclusion rationale: it has zero gsd-sdk refs today (subsystem removed in #515, shim retired in #522); the real reason it is excluded is that it is installer code, not a deployed prompt/hook surface. (minor) - Make the empty-sweep guard assert coverage per configured extension, not per surface — .md files alone kept gsd-core/workflows green even if .sh/.json were dropped, silently un-covering _runtime-launcher.snippet.sh and discuss-phase/templates/*.json. (low) --------- Co-authored-by: Tom Boucher <trekkie@nomorestars.com> * refactor(#60): make runtime config adapter registry explicit (#795) * refactor(#60): make runtime config adapter registry explicit Replace scattered inline `runtime === '...'` config-mutation branching in bin/install.js with an explicit, typed adapter registry. The new src/runtime-config-adapter-registry.cts maps each of the 15 supported runtimes to a config intent { installSurface, writesSharedSettings, finishPermissionWriter }; install()/finishInstall() dispatch by resolved intent instead of runtime-name checks (cursor/windsurf/trae collapse to one profile-marker-only branch). Behavior-preserving: the same config files are written for the same runtimes (opencode still writes both settings.json and its permissions; kilo writes only its permissions; codex minimal-mode and opencode GSD_TEST_MODE guards unchanged). Unknown runtimes fail loudly via TypeError, with an Object.hasOwn barrier so prototype-chain keys (__proto__/constructor) also throw rather than returning a bogus intent. Leads the installer-refactor chain (#58 -> #60 -> #56), building on ADR-58. Closes #60 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#60): add changeset for runtime config adapter registry Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#60): register Runtime Config Adapter Registry in CONTEXT.md glossary Per docs/contributor-standards.md, every new Module/seam must get a `### <Name>` entry under the domain glossary. Adds the entry for the runtime-config-adapter-registry seam introduced in this PR (interface, policy boundary, source file, ADR-58 / #60 cross-references). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#764): skip cross-platform test matrix for docs-only and inert-CI PRs (#798) test.yml had no paths filter and the ci-test-scope classifier treated docs/ and every .github/workflows/* as code_changed, so documentation edits and product-irrelevant automation tweaks still spun up the full Linux/Windows/macOS matrix. Narrow the heavy matrix to changes that can actually affect the product or the test pipeline. - ci-test-scope.cjs: drop docs/ from code_changed (docs-only -> full skip; the required-tests fan-in still reports green). Add src/ to code_changed (it was missing -> a source-only PR previously skipped all tests). Add INERT_WORKFLOWS allowlist + isInertCi() + an "inert CI" rule, and a product_changed output that gates the heavy test/coverage jobs. Fail-safe: any workflow not on the inert allowlist defaults to the full matrix. A module-load assertion throws if a PROTECTED_WORKFLOWS entry (test/install-smoke/mutation/security-scan/release) is ever added to the inert set, so a weakening edit fails CI loudly. - test.yml: keep the static 3-lane matrix (so the H1 shell-policy linter can still statically verify the Windows lane), gate test/coverage on product_changed, add a lightweight ubuntu-only test-inert job, and branch the required-tests fan-in on product_changed. - docs-required.yml: run docs-parity-live-registry (gated on docs/ changes) so pure-docs PRs still catch live-registry drift without the matrix. - tests: cover docs-only, inert-only, src/, pipeline, unknown-workflow fail-safe, mixed escalation, the code_changed=false -> no-lanes invariant, and protected- workflow tamper-evidence. Closes #764 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#766): distribute gsd-core as a native Claude Code plugin (#797) * feat(#766): distribute gsd-core as a native Claude Code plugin Add an additive .claude-plugin/plugin.json manifest plus hooks/hooks.json so gsd-core can be installed as a first-class Claude Code plugin (marketplace or zero-friction @skills-dir), with /gsd-core: namespaced commands and lifecycle management — alongside the unchanged npm/file-copy installer. - .claude-plugin/plugin.json: validated with 'claude plugin validate --strict' - hooks/hooks.json: mirrors the installer's always-on Claude hook wiring via ${CLAUDE_PLUGIN_ROOT} - package.json: ship .claude-plugin in the npm tarball - tests/issue-766-plugin-manifest.test.cjs: manifest + always-on-hook-contract drift guards - docs: install-on-your-runtime.md + FEATURES.md Closes #766 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#766): add ADR-766 + glossary entry for Claude Code Plugin Manifest Module Record the plugin manifest as the Seam projecting gsd-core's artifact surfaces onto the Claude Code plugin contract (sibling of the Runtime Artifact Layout Module, ADR-3660), with the defined kind->field mapping and the always-on hook projection rule. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * refactor(#56): retire legacy runtime directory helpers into runtime-homes projection (#802) * refactor(#56): retire legacy runtime directory helpers into runtime-homes projection Consolidate per-runtime global config-dir resolution onto the single canonical projection runtime-homes:getGlobalConfigDir. Extend it with the explicitDir override (CLI --config-dir) and the opencode/kilo OPENCODE_CONFIG/KILO_CONFIG file-path precedence the installer helpers had, making it byte-for-behavior equivalent to the old getGlobalDir across all 15 install runtimes. Delete bin/install.js's getGlobalDir/getOpencodeGlobalDir/getKiloGlobalDir (and the orphaned local expandTilde), repoint all 9 call-sites, and remove getGlobalDir from module.exports (net -242 lines in the installer). Migrate the 5 test importers to the canonical projection; harden default/XDG assertions against ambient *_CONFIG env vars. getAgentsDir now respects OPENCODE_CONFIG/KILO_CONFIG consistently with the installer (intentional convergence). Update CONTEXT.md Installer Module entry. Completes the installer-refactor chain #58 -> #60 -> #56. Closes #56 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#56): add changeset for runtime directory helper retirement Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#786): elevate GitHub Copilot installer — lifecycle hook + AGENTS.md (#804) * feat(#786): elevate Copilot installer with lifecycle hook + AGENTS.md Emit a self-contained sessionStart hook config (.github/hooks/gsd-session.json local, ~/.copilot/hooks/gsd-session.json global) and write AGENTS.md at the repo root (Copilot CLI reads it as primary instructions) alongside copilot-instructions.md. The hook is an inline `command` hook (no separate hook script), so it cannot dangle. Uninstall removes both and preserves user content. Verified against GitHub Copilot CLI primary docs: hooks-configuration (camelCase events, version+hooks shape, inline bash/powershell command hooks) and add-custom-instructions (AGENTS.md read at repo root as primary instructions). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#786): set changeset pr number to 804 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#783): resolve Kilo global skills base to ~/.kilo/skills (#806) * fix(#783): resolve Kilo global skills base to ~/.kilo/skills getGlobalSkillsBase('kilo') returned ~/.config/kilo/skills (the XDG config dir), but Kilo Code discovers global skills from ~/.kilo/skills/ (the .kilo dir in HOME), independent of the kilo.jsonc config dir. Add a HOME-relative special case so the resolver matches Kilo's actual discovery path. The config dir (~/.config/kilo) and the installer's command/ path are correct and unchanged. This corrects the path used by doctor/status and agent-skills-block resolution; the installer writes commands (not skills) for Kilo, so no files were being written to the wrong location. Closes #783 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#783): set changeset pr to 806 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#785): write .cursor/commands/ Cursor 1.6 slash-command surface (#805) * feat(#785): write .cursor/commands/ as Cursor 1.6 slash-command surface Cursor 1.6 (released 2025-09-12) introduced plain-markdown slash commands in `.cursor/commands/<name>.md` — no frontmatter, invocable via `/` in the Agent input. GSD previously emitted only `~/.cursor/skills/` for Cursor. This PR wires a second artifact kind for `cursor` in `runtime-artifact-layout.cts`: `convertedCommandsKind('commands', 'gsd-', 'convertClaudeCommandToCursorCommand', configDir)`. The new kind applies the same `convertClaudeToCursorMarkdown` transforms (tool renames, brand substitution, slash-command normalisation) and then strips YAML frontmatter so the output is plain prose. Skills output is unchanged. `stageCommandsForRuntimeFlat` in `install-profiles.cts` stages each source `.md` as a flat `<stem>.md` in a temp dir; the existing `_copyStaged` commands path then prefixes and copies to `<configDir>/commands/`. `.cursor/mcp.json` is explicitly OUT OF SCOPE: GSD ships no MCP server; the `mcpServers` schema cannot be usefully populated by the installer. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor(#785): address review nit --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(#787): elevate Cline — .clinerules/ dir form, PreToolUse hook, AGENTS.md (#803) * feat(#787): elevate Cline — .clinerules/ dir form, PreToolUse hook, AGENTS.md Migrate the installer's Cline output from a single-file .clinerules to the .clinerules/ directory form (.clinerules/gsd.md), which is the prerequisite for Cline's v3.36 hooks (a path cannot be both a file and a directory). Add a .clinerules/hooks/PreToolUse lifecycle hook implementing Cline's JSON stdin -> {cancel,errorMessage,contextModification} protocol; it guards .planning/ artifacts and fails open. On global installs, merge GSD instructions into the cross-tool ~/.agents/AGENTS.md target (marker-delimited, merge-safe). A legacy single-file .clinerules is migrated in place; --uninstall removes the new artifacts and strips the AGENTS.md GSD block. Also fixes the uninstall targetDir for Cline local installs (it pointed at ./.cline instead of the project root) and re-runs writeManifest after the Cline artifacts are written so they are hash-tracked. Self-contained: implemented independently of the #782 Cline skills work. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#787): address review findings - Scope PreToolUse hook path-walk to PATH_KEY fields only (eliminates false positive when doc body content mentions .planning/) - Use lstatSync + isSymbolicLink() for migration guard so GSD never writes through a user's symlinked .clinerules into an external directory - Add regression tests for both cases Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(#787): set changeset pr: 803 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#812): honor COPILOT_HOME in Copilot global config-dir resolution (#814) * fix(#812): honor COPILOT_HOME in Copilot global config-dir resolution getGlobalConfigDir('copilot') resolved the global config directory using only --config-dir > COPILOT_CONFIG_DIR > ~/.copilot, ignoring the COPILOT_HOME env var. Per GitHub's Copilot CLI docs, COPILOT_HOME overrides the default ~/.copilot location (and user-level hooks are read from $COPILOT_HOME/hooks/), so a global --copilot install wrote all artifacts (skills, agents, copilot-instructions.md, the gsd-session.json hook) to ~/.copilot even when the user relocated their Copilot home, making them undiscoverable by Copilot CLI. Mirror the codex/CODEX_HOME branch: precedence is now --config-dir > COPILOT_CONFIG_DIR > COPILOT_HOME > ~/.copilot. Uninstall uses the same resolver, so it stays symmetric. Also: document COPILOT_HOME in the installer --help notes, the USER-GUIDE env-var table, and the installer-migrations Copilot row; and clear COPILOT_HOME in the two default-path test suites so they stay hermetic now that the resolver honors it. Closes #812 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#812): add changeset for PR #814 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#788): expand Qwen Code hook-event coverage (#807) * feat(#788): expand Qwen Code hook-event coverage to 4 new events Register SubagentStop, Stop, PreCompact (gsd-context-monitor.js) and UserPromptSubmit (gsd-prompt-guard.js) in the Qwen Code installer. Guard is isQwen-only — Claude Code and all other runtimes are unchanged. Uninstall loop extended to include the 4 new event names. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(#788): reconcile to 3 Qwen-only events — defer UserPromptSubmit gsd-prompt-guard exits unless tool_name is Write|Edit (PreToolUse payload shape); UserPromptSubmit carries raw user-prompt text with no tool_name field, so wiring it would be a silent no-op. Deferred to a follow-on issue. Artifacts made consistent: - bin/install.js: drop UserPromptSubmit registration block; uninstall loop drops UPS from event list - .changeset/788-qwen-hook-events.md: corrected to 3 events + rationale - docs/how-to/install-on-your-runtime.md: remove UPS row from hook table - tests/enh-788-qwen-hook-events.test.cjs: assert UPS NOT registered; fix idempotency suite to persist settings between installs; drop UPS-specific assertions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(#788): update changeset PR number to #807 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(#788): prune stale install-bucket allowlist entry for enh-788 test --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * enhancement(#782): emit gsd skills to ~/.cline/skills for Cline >= v3.48 (#809) Cline added a global skills system (~/.cline/skills/<name>/SKILL.md) in v3.48.0, but gsd treated Cline as rules-only and emitted zero skills (getGlobalSkillsBase('cline')=null, empty artifact kinds). This makes gsd emit skills for Cline at global scope, alongside the existing .clinerules. - runtime-homes: getGlobalSkillsBase('cline') -> ~/.cline/skills (was null) - runtime-artifact-layout: cline emits a skills kind for GLOBAL scope only (local stays .clinerules-only), mirroring claude's scope dispatch - install.js: convertClaudeCommandToClineSkill emits name+description-only SKILL.md frontmatter (Cline/agentskills.io spec; no Claude-specific allowed-tools/argument-hint/agent), hyphen-normalized + .cline/-rewritten body; global cline routed through the skills path while .clinerules is still written; _applyRuntimeRewrites cline case handles custom CLINE_CONFIG_DIR; convertClaudeToCliineMarkdown also rewrites bare ~/.claude and CLAUDE_CONFIG_DIR - docs: install-on-your-runtime.md documents Cline global skills vs local rules - tests: converter (name+description-only), global emission, skills+.clinerules coexistence, scope-aware layout, custom-dir paths, idempotency Closes #782 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#790): emit Augment slash commands (~/.augment/commands/) (#808) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * enh(#784): emit native skills for OpenCode + Kilo runtimes (#810) * feat(#784): emit native skills for OpenCode + Kilo runtimes OpenCode and Kilo share a config schema and both discover on-demand skills from skills/<name>/SKILL.md. The installer previously emitted only flat commands (command/) and file-based agents (agents/) for these runtimes. Add a shared OpenCode-family skill writer that stages each GSD command as a spec-compliant SKILL.md (name matching the directory, description 1-1024 chars), wired through the runtime artifact layout so uninstall cleans skills/ automatically. Skills respect the active install profile. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#784): correct skill body paths + preserve user dev-preferences Address adversarial-review findings: - Add opencode/kilo cases to _applyRuntimeRewrites so staged SKILL.md bodies are re-pointed from the converter's hardcoded default config dir to the actual install target (fixes --local / --config-dir installs; commands/agents already did this by applying pathPrefix pre-conversion). - Preserve user-owned skills/gsd-dev-preferences across reinstall in installOpencodeFamilySkills (snapshot+restore around the gsd-* prune), matching installRuntimeArtifacts. - Export installOpencodeFamilySkills and add regression tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#784): guarantee command/skill body parity, fix kilo-alt double-rewrite Follow-up adversarial-review found the post-conversion path rewrite could double-rewrite custom Kilo dirs (kilo -> kilo-alt -> kilo-alt-alt) because the kilo pathPrefix is a $HOME (non-absolute) superset of the hardcoded default base. Restructure so OpenCode/Kilo skills mirror copyFlattenedCommands exactly: stage raw commands, apply pathPrefix BEFORE conversion via a new shared applyOpencodeFamilyPathPrefix() helper (now used by both the command and skill writers), then convert. This guarantees byte-for-byte command/ skill body parity for global, --local, and --config-dir installs and removes the prefix-overlap hazard. Drop the fragile _applyRuntimeRewrites opencode/ kilo case. Strengthen the path regression test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor(#784): derive opencode/kilo skills from the same staged command set Pass the installer's _stageSkills() output directly to installOpencodeFamilySkills instead of re-staging via the layout, so the command/ and skills/ surfaces always cover the identical profile-resolved set — including the --minimal/--core-only alias path, which stages differently from a plain --profile=core. Verified: minimal install now emits 8 commands and 8 skills. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#784): set changeset PR number to 810 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#784): fully escape backslashes in test helper (CodeQL js/incomplete-string-escaping) Replace the dot-only escape `replace(/[.]/g, '\\.')` with a complete regex-escape pattern `replace(/[\\.*+?^${}()|[\]]/g, '\\$&')` so all regex metacharacters (including backslash itself) in `defaultBase` are safely escaped before interpolation into `new RegExp(...)`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#813): apply per-runtime skill path rewrites in applySurface (#817) * fix(#813): apply per-runtime skill path rewrites in applySurface applySurface() re-staged skill artifacts but, unlike installRuntimeArtifacts(), never applied the per-runtime path rewrites. So /gsd:surface (profile/enable/disable/reset) overwrote installed SKILL.md bodies with the converter's default ~/.claude paths instead of the install target (pathPrefix), silently regressing skill path references for every skillsKind runtime until the next reinstall. applySurface now mirrors installRuntimeArtifacts: for kind.kind === 'skills' it derives pathPrefix the same way and applies applyRuntimeContentRewritesInPlace on the staged dir before syncing. - bin/install.js: export applyRuntimeContentRewritesInPlace - runtime-artifact-layout.cts: carry resolved scope on Layout; export getInstallExports; type computePathPrefix/applyRuntimeContentRewritesInPlace on InstallExports - surface.cts: lazily derive pathPrefix (only when a skills kind exists) and apply the rewrite via the shared getInstallExports accessor — single source of truth with install, only skills kinds rewritten (matches install) - tests: regression test parameterized over cursor + codex asserting post-applySurface bodies carry the install pathPrefix, not ~/.claude - CONTEXT.md: glossary updated for the applySurface rewrite parity + scope seam Closes #813 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#813): add changeset fragment for PR #817 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#813): normalize configDir prefix to forward slashes for Windows CI The #813 regression assertion compared skill bodies against a raw ${configDir}/ prefix, but production derives pathPrefix via path.resolve(configDir).replace(/\\/g, '/'). On Windows, mkdtempSync returns backslash paths while the rewritten body uses forward slashes, so the assertion would fail Windows-only (not covered by local gsd-test). Normalize the expected prefix the same way production does. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#816): mirror install command-prefix handling in _syncGsdDir (#822) * fix(#816): mirror install command-prefix handling in _syncGsdDir applySurface() via _syncGsdDir handled command artifacts differently from a fresh install. For flat command dirs (cursor/augment/opencode/kilo) install's _copyStaged adds kind.prefix (gsd-<stem>.md) and _removeGsdEntries prunes prefix-scoped, but _syncGsdDir copied staged files verbatim (unprefixed) and pruned by exact name. So every /gsd:surface toggle wrote wrong filenames, orphaned the installed gsd-*.md, and deleted user-authored command files. _syncGsdDir's commands/agents branch now mirrors install: - flat command dirs get the gsd- prefix on copy; namespaced dirs (commands/gsd) and agents keep staged names, using install's namespacedByDir rule - prune is prefix-scoped so user files in shared flat dirs are preserved; namespaced commands/gsd stays membership-pruned so superseded commands are still removed on profile shrink The naming rule is intentionally re-implemented (not via require('bin/install.js') to avoid its module-load banner side-effect); a strict parity test asserts applySurface and installRuntimeArtifacts produce identical command filenames for opencode/kilo/cursor/augment/gemini, guarding against drift. Closes #816 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#816): add changeset fragment for PR #822 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore(#771): convert agent color: hex/magenta values to documented named colors (#823) * chore(#771): convert agent color: hex/magenta values to documented named colors Claude Code's sub-agent `color:` field documents only 8 named colors (red, blue, green, yellow, purple, orange, pink, cyan). Twelve agent files used hex values and two used the undocumented `magenta`; convert each to the nearest documented named color so the intended per-agent TUI color differentiation is spec-compliant. - agents/*.md: 14 color values hex/magenta -> nearest named color - scripts/research-profiles.cjs: update the 3 generated research-agent profiles (source of truth) so gen-research-agents stays in sync - docs/AGENTS.md: update documented colors; add missing Color rows for gsd-nyquist-auditor, gsd-project-researcher, gsd-phase-researcher - tests/agent-frontmatter.test.cjs: add regression guard asserting every agent color: is in the documented named-color set Closes #771 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#771): add changeset Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#773): add --ephemeral and --dangerously-bypass-hook-trust to automated codex exec wrappers (#824) * feat(#773): add --ephemeral and --dangerously-bypass-hook-trust to automated codex exec invocations Automated codex exec calls in the review workflow now carry --ephemeral (no session-state accumulation across CI runs) and --dangerously-bypass-hook-trust (skip hook-trust prompts for hooks whose provenance gsd-core already controls). Both flags were verified present in the installed codex CLI (codex exec --help). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#773): correct changeset pr: reference to #824 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#775): ship a gemini-extension.json extension package (#818) Add a Gemini CLI extension package so users can install, update, and remove GSD through Gemini's own extension lifecycle and have it appear in `gemini extensions list`: gemini extensions install https://github.com/open-gsd/gsd-core gemini extensions update gsd-core gemini extensions uninstall gsd-core gemini extensions link /path/to/gsd-core # dev This mirrors the additive Claude Code plugin manifest (#766): a thin, version-stamped manifest enforced by an in-repo drift test. The extension ships the context-file payload (GEMINI.md), loaded into every Gemini session; slash-command/agent/hook TOML projection into the extension is a documented follow-up. The manual `npx gsd-core --gemini` installer (which provides the /gsd:* commands) is unchanged — purely additive, no breaking change. - gemini-extension.json: name=binName, version tracks package.json, description, contextFileName=GEMINI.md (minimal; no mcpServers — gsd ships no MCP server) - GEMINI.md: Gemini-session context payload - package.json: add both artifacts to files[] so they publish - CONTEXT.md: add "Gemini Extension Package" glossary entry - docs: USER-GUIDE + install-on-your-runtime how-to - tests/issue-775-gemini-extension.test.cjs: manifest validity, version parity with package.json, contextFileName existence, files[] publication Closes #775 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#768): pre-populate settings.json permissions.allow/deny for Claude Code (#819) * feat(#768): pre-populate settings.json permissions.allow/deny for Claude Code Adds mergeClaudePermissions() to bin/install.js which non-destructively appends GSD's known-safe tool-call patterns to permissions.allow and defense-in-depth credential-file patterns to permissions.deny during Claude Code installs. Merge is idempotent (no duplicates on reinstall) and additive (existing user entries preserved). Uninstall removes only the exact GSD-owned entries. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: update changeset pr number to 819 --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#774): emit service_tier/model_verbosity in Codex agent TOML + agents/openai.yaml skill chip (#828) * feat(#774): emit service_tier/model_verbosity in Codex agent TOML + agents/openai.yaml skill chip - Add service_tier = "flex" and model_verbosity = "low" to the Codex ConfigProfile TOML for light-tier agents (gsd-research-synthesizer, gsd-codebase-mapper, gsd-plan-checker, and 8 others identified via AGENT_DEFAULT_TIERS). Field names/values verified against Codex schema (profile_toml.rs / config_types.rs Verbosity enum). Non-light agents are unaffected. - Add generateCodexSkillMetadataYaml() and writeCodexSkillMetadataFiles(): after installRuntimeArtifacts, iterate every gsd-* skill directory, read the short-description already emitted in the SKILL.md frontmatter by convertClaudeCommandToCodexSkill, and write agents/openai.yaml with interface.display_name and interface.short_description for the Codex TUI skill picker chip. - yamlQuote (JSON.stringify) handles all YAML-unsafe chars. - User-owned gsd-dev-preferences dir is never overwritten. - Errors per-skill are swallowed so a bad SKILL.md can't abort install. - agents/openai.yaml is covered by the snapshot/rollback system and manifest hash (writeManifest hashes skill dirs recursively). - Uninstall symmetry: _removeGsdEntries removes whole gsd-* dirs. - 21 new tests in codex-config.test.cjs covering service_tier/verbosity TOML emission, YAML generation (round-trip via js-yaml), and writeCodexSkillMetadataFiles including an e2e integration test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#774): correct docs-lint coverage — proper changeset format + USER-GUIDE entry Rewrite the changeset fragment from old @opengsd/gsd-core:patch format to the required type:/pr: schema so the docs-lint parser can consume it. Add a new "Codex skill picker and agent scheduling (#774)" section to docs/USER-GUIDE.md describing the flex-tier scheduling and /skills TUI chip enrichments — both are user-visible and belong in docs rather than behind a docs-exempt marker. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#769): adopt context:fork + effort on heavy workflow skills (#820) * feat(#769): emit context:fork + effort: frontmatter on heavy workflow skills Add `context: fork` and `effort: xhigh` to the three heaviest workflow commands (plan-phase, execute-phase, autonomous) and `effort: low` to the two quick-status commands (progress, stats). On Claude Code, `context: fork` runs the skill in an isolated subagent context window so the main session's context budget is protected. `effort: xhigh` / `effort: low` signal the appropriate token-budget tier to the runtime. Both fields are silently ignored by runtimes that do not recognise them (Gemini, Codex, Cursor, etc.) — no behaviour change outside Claude Code. Update convertClaudeCommandToClaudeSkill in bin/install.js to preserve `context:` and `effort:` when rewriting source command files to SKILL.md for a Claude global install. Add install-suite tests to assert the fields are present in both source commands and the installed SKILL.md output. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#769): tighten regex assertions + add execute/plan-phase effort coverage Fix low-severity adversarial finding: tighten test regex patterns from `\s*` to `[ \t]*` so they cannot match across newlines (CRLF parity). Add missing effort: xhigh assertions for gsd-execute-phase and gsd-plan-phase SKILL.md install output to complete the black-box coverage gap. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#772): adopt stable Codex hook events + commandWindows for Windows parity (#827) * feat(#772): adopt stable Codex hook events + commandWindows for Windows parity Register three new stable Codex hook events (SubagentStart, Stop, PostToolUse) wired to gsd-context-monitor.js so Codex installs get the same context-headroom tracking at subagent and session boundaries that Claude/Qwen already have. Add commandWindows field to the SessionStart hook entry on Windows so Codex uses the .cmd shim directly (Git Bash/MSYS cannot POSIX-exec node.exe). commandWindows is only emitted on win32; POSIX is unchanged. Refactor reconcileCodexHooksJsonSessionStart into a generic reconcileCodexHooksJsonEvent so any event name can be reconciled with the same dedup/preserve-user-entries logic. Add gsd-context-monitor.js and .cmd to MANAGED_HOOK_COMMAND_BASENAMES _BY_SURFACE so idempotent re-runs de-duplicate entries correctly. 30 new tests covering: export surface, event registration for each of the three events, commandWindows parity (POSIX vs win32), idempotency, uninstall, and user-entry preservation. Closes #772 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#772): windows path normalization + docs-lint - Normalize scriptPath backslashes to forward slashes in ensureCodexHooksJsonEvent and ensureCodexHooksJsonSessionStart so that isManagedHookCommand can match stored commands against configDir on Windows CI runners. path.resolve returns backslash paths on Windows, but when platform is not 'win32' (e.g. platform:'linux' in tests), projectManagedHookCommand skips normalization — producing a mismatch that breaks idempotency deduplication (the same hook entry appended twice on re-register). Forward-slash paths are always valid in both Node.js and Codex, so the normalization is safe for all platforms. - Fix changeset pr: 0 → 827 to resolve fail_malformed_fragment. - Add Codex hook coverage table to docs/how-to/install-on-your-runtime.md documenting the SubagentStart/Stop/PostToolUse events + commandWindows Windows-parity field added by this enhancement. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#778): cross-runtime command enrichment (Gemini {{args}}/!{}, Qwen priority) (#825) * feat(#778): cross-runtime command enrichment (Gemini {{args}}/!{}, Qwen priority) Enrich the installer's per-runtime command/skill generators with native, verified, additive fields: - Gemini CLI: map Claude's $ARGUMENTS -> Gemini's {{args}} in generated TOML commands so typed arguments interpolate; inject live .planning/STATE.md into /gsd:progress via a fixed, injection-safe !{cat .planning/STATE.md 2>/dev/null} shell block (no interpolated input). - Qwen Code: emit the optional numeric `priority` field on main-loop skills so the most-used workflows sort first in the /skills list (higher = earlier per the Qwen skills spec; the issue's inverse numbering was corrected). OpenCode per-command model/agent/subtask/variant enrichment was evaluated and intentionally not implemented: `model` reintroduces the #1156 ProviderModelNotFoundError regression for non-Anthropic providers (the converter deliberately strips model:), `subtask`/`agent` change execution semantics for GSD's interactive commands, and `variant` is not in the OpenCode command schema. Schemas verified against primary docs (Gemini custom-commands, Qwen skills, OpenCode commands/skills). Adds tests/enh-778-* and how-to + USER-GUIDE docs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#778): set changeset PR number to 825 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#789): elevate CodeBuddy — slash commands (#830) * feat(#789): elevate CodeBuddy — emit slash commands (+ document subagent/MCP scope) Emit a CodeBuddy slash-command surface so GSD workflows appear in the '/' menu, reaching parity with other elevated runtimes. - Add convertClaudeCommandToCodebuddyCommand and register a commands/ artifact kind for the codebuddy runtime (commands/gsd-<name>.md), consistent with the Cursor (#785) and Augment (#790) commands surfaces. - Mark emitted skills user-invocable:false so the commands surface is the sole '/' entry point (no duplicate /gsd-* entries); skills stay model-invocable. CodeBuddy's SKILL.md supports this field. - Normalize $HOME/.codebuddy (bare + slash) path forms in runtime rewrites so --config-dir/local installs don't leak the default home. - Report installed commands/ count on install; uninstall prunes gsd-* commands while preserving user-owned commands. Scope: subagents (~/.codebuddy/agents/) are already emitted by the generic agents block (unchanged); no mcp.json is written (gsd ships no MCP server, and CodeBuddy's mcp.json registers only external servers). Closes #789 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#789): set changeset pr number to 830 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#776): Gemini hook events (BeforeAgent/AfterAgent/BeforeModel) + hooksConfig.enabled check (#829) * feat(#776): Gemini hook events (BeforeAgent/AfterAgent/BeforeModel) + hooksConfig.enabled check Register three new Gemini-CLI hook events on install: - BeforeAgent: fires before agent planning; wired to gsd-context-monitor - AfterAgent: fires after final response generation; wired to gsd-context-monitor - BeforeModel: fires before each LLM call (per-turn); wired to gsd-context-monitor All three reuse gsd-context-monitor.js (no new hook files). Uninstall cleanup loop extended to remove the new events. Non-array guard added for robustness against malformed settings. Also detect hooksConfig.enabled:false in Gemini settings and emit a clear warning — without this check, all registered hooks silently do nothing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: update changeset pr: 829 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#776): document Gemini hook events Add hook coverage table to the Gemini CLI section of install-on-your-runtime.md, covering the three new events (BeforeAgent/AfterAgent/BeforeModel wired to gsd-context-monitor) plus a callout for the hooksConfig.enabled:false silent failure mode detected by the installer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#777): register Cursor-native hooks (.cursor/hooks.json) for session-start/post-tool parity (#831) * feat(#777): register Cursor-native hooks (.cursor/hooks.json) for session-start/post-tool parity - Add gsd-cursor-session-start.js: injects STATE.md presence reminder (or new-project nudge) into Cursor sessions via the sessionStart hook event - Add gsd-cursor-post-tool.js: emits an additional_context nudge when write-class tool calls touch .planning/ files (postToolUse hook event) - Add 'cursor-hooks-json' installSurface to runtime-config-adapter-registry; writeCursorHooksJson/reconcileCursorHooksJson write the canonical { version: 1, hooks: { sessionStart, postToolUse } } JSON shape with idempotent reconciliation that preserves user-owned hook entries - Hook scripts are copied with /gsd:→gsd- rewrite so installed files contain no colon-form slash-command refs (bug-376 invariant) - 20 new tests in tests/cursor-hooks.test.cjs cover all reconciler paths, entry helpers, removal, runtime adapter surface, and hook script behavior - Update CONTEXT.md, ARCHITECTURE.md, installer-migrations.md, and 000-first-time-baseline.cts to include Cursor hooks.json surface Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#777): build hooks/dist on demand in bug-376 test for scoped/windows CI hooks/dist is gitignored and only produced by `npm run build:hooks`. The CI scoped (ubuntu-latest/node-22) and windows (windows-latest/node-24) test jobs do NOT run build:hooks before executing tests, so bug-376's prerequisite suite was failing with "hooks/dist not found" on both legs. Add ensureHooksDist() helper (mirrors bug-3357 pattern) that builds hooks/dist on demand in the before() hooks of prerequisite and Suite 3. Also add ensureHooksDist() call to Suite 3's before() so the snapshot step is also hermetic. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * docs(#832): add how-to guide for minimal install / skill profiles (#835) Add docs/how-to/install-minimal-and-add-skills.md covering the --minimal / --core-only / --profile=core install, the core/standard/full profiles, and growing the surface live via /gsd:surface or on reinstall. Register it in the docs/README.md How-to guides index. Closes #832 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#815): add /gsd-update --next to install the @next RC channel (#839) Adds an opt-in --next (alias --rc) flag to /gsd-update targeting the @next RC dist-tag (ADR #660), with a {latest,next} allowlist enforced at three layers, channel-aware version check + banner, and byte-for-byte unchanged default @latest behavior. Closes #815 * fix(#837): three-dot diff in ci-test-scope so docs-only PRs skip the heavy matrix (#841) CI test-scope detection diffed changed files with a two-dot `git diff --name-only base head`, where base is the moving tip of `next`. A PR branch cut from a slightly older `next` surfaced every product file `next` had gained since the merge-base, flipping product_changed/full_matrix and running the full Windows/macOS matrix + coverage on docs-only PRs. Switch to a three-dot `git diff --name-only base...head` (vs the merge-base), matching GitHub's PR "Files changed" semantics. Add a regression test that builds a stale-base topology, plus a guard test pinning `fetch-depth: 0` on the `changes` job (required for the merge-base to be locally available). Closes #837 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#836): no-LLM duplicate-issue detection + challenge + 1-day auto-close (#843) * feat(#836): no-LLM duplicate-issue detection + challenge + 1-day auto-close Adds a deterministic (no-LLM) duplicate-issue governance lifecycle: - scripts/issue-dedupe.cjs: pure, unit-tested module (tokenize, Sørensen–Dice title similarity, scoreCandidates, renderChallengeComment, shouldClose) with fail-safe destructive-action guards. - duplicate-check.yml (issues:opened): scores new-issue title against open issues, posts a challenge comment + applies the pending `possible-duplicate` label on a clear match. - duplicate-sweep.yml (daily cron): closes possible-duplicate issues whose challenge comment is >24h old with no human reply and no 👎 veto; honors exempt labels; re-checks the label immediately before close (TOCTOU guard); strips the label on close to avoid reopen loops. - remove-duplicate-label.yml (issue_comment:created): clears the label and applies needs-maintainer-review when any human responds. - bug_report.yml / docs_issue.yml: add the required "I searched existing issues" preflight checkbox so all five forms force a pre-search attestation. - docs/agents/triage-labels.md: document the label + lifecycle. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#836): add changeset fragment for duplicate-issue detection Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(#770): register Claude Code lifecycle hooks (SubagentStop/Stop/PreCompact/FileChanged) (#821) * feat(#770): register Claude Code lifecycle hooks (SubagentStop/Stop/PreCompact/FileChanged) Wire three new context-tracking events (SubagentStop, Stop, PreCompact) to gsd-context-monitor so context-headroom warnings surface at model-stop and subagent-finalisation moments — not just on PostToolUse. Add a new FileChanged hook (gsd-config-reload.js) that hot-reloads .planning/config.json context mid-session when the user edits it, injecting a config summary as hookSpecificOutput.additionalContext. Updates plugin manifest hooks.json, managed-hooks-registry, installer-migration-report allowlist, and shell-command-projection cleanup tables. Tests: 21 new assertions in enh-770-claude-hook-events.test.cjs; enh-788 and issue-766 test suites updated. Closes #770 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#770): document newly-registered Claude Code lifecycle hooks Add a Hook coverage table to the Claude Code npm installer section of docs/how-to/install-on-your-runtime.md describing SubagentStop, Stop, PreCompact, and the new FileChanged (gsd-config-reload.js) hook that hot-reloads .planning/config.json mid-session. Also fixes the changeset frontmatter (adds type: Added + pr: 821) so docs-lint can consume the fragment. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#770): add gsd-config-reload.js to INVENTORY.md and regenerate manifest The feat commit added hooks/gsd-config-reload.js but did not bump the Hooks count in docs/INVENTORY.md (14→15) or add the new row, and did not regenerate docs/INVENTORY-MANIFEST.json. Both inventory-counts and inventory-manifest-sync tests failed across the full CI matrix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#770): make lifecycle-hook tests deterministic on scoped runner Replace the shared hooks/dist/ ensemble setup (ensureHooksDist / teardownHooksDist) in the Claude hook tests with per-test isolation: pre-populate each test's own tmpDir/.claude/hooks/ with stub files and pass installerMigrations:[] to install() so the first-time-baseline migration does not remove the stubs before the copy step can run. Root cause: hooks/dist/ is gitignored and absent on a fresh npm ci. ensureHooksDist() created it and teardownHooksDist() deleted it, but with --test-concurrency=4 both test files ran concurrently as separate Node.js worker processes sharing the same filesystem. One file's afterEach teardown deleted hooks/dist/ while the other file's install() was copying from it, producing an ENOENT (reproduced 2/10 runs locally). The additional issue: even with pre-placed stubs surviving the copy race, the 000-first-time-baseline migration classified hooks/gsd-*.js as bundled-gsd-hook artifacts, auto-removed them, and the copy step never re-ran (hooks/dist/ absent) — leaving contextMonitorFile missing and all hook registrations silently skipped (the 'got: []' symptom). Fix: pre-populate targetDir/hooks/ per-test (isolated temp dir) AND pass installerMigrations:[] so the baseline scan is skipped. The Qwen suites already used this pattern correctly; the Claude suites are aligned to it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#770): ship gsd-config-reload.js by adding it to build-hooks HOOKS_TO_COPY The #770 feature added hooks/gsd-config-reload.js and registered it in MANAGED_HOOKS, the installer, INVENTORY, and the test EXPECTED_ALL_HOOKS list — but never added it to scripts/build-hooks.js HOOKS_TO_COPY. As a result the hook was never copied into hooks/dist/ during the build, so: - the hook would never ship to users (real production bug — the FileChanged config-reload feature was dead-on-arrival), and - install-minimal-hooks.test.cjs #1755 ("all expected hooks are copied from hooks/dist/ to target", ".js hooks are executable after copy", "manifest contains .js hook entries") failed on any environment with a clean checkout (no pre-existing hooks/dist/): coverage, full test macos-22/macos-24, test ubuntu-24. The failures were masked locally only by a stale hooks/dist/ left from a prior build (build-hooks copies into dist without clearing it). On CI's fresh `npm ci` there is no dist, so the omission surfaced. Fix: add 'gsd-config-reload.js' to HOOKS_TO_COPY so build-hooks stages it into hooks/dist/ alongside the other JS hooks. Verified by removing hooks/dist/ and rerunning the full suite green (0 fail). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#770): make config prototype-pollution beforeEach deterministic on scoped runner Root cause: the #663 and alert-#26 prototype-pollution describe blocks seeded .planning/config.json in beforeEach via a bare runGsdTools('config-ensure-section') whose result was discarded. That command runs in a spawned gsd-tools child; on the scoped CI lane (--test-concurrency=4, config.test.cjs scheduled alongside the heavy install/tarball suites that #770 pulled into the targeted set) the child can be transiently killed under resource pressure (non-zero exit, empty stderr — an OS-level kill, not an app error). The swallowed failure left config.json absent, so the first subtest's readConfig() threw ENOENT opening <tmp>/.planning/config.json. Only 1 of 4 subtests failed, confirming a per-invocation transient, not a deterministic miss; the full suite schedules files differently so config.test.cjs did not collide with those heavy neighbors → passed there. Fix: add ensureConfigReady(tmpDir) which retries config-ensure-section on ANY failure or missing file and throws a clear diagnostic if it still cannot create config.json, then use it in both prototype-pollution beforeEach blocks. Setup is now deterministic under load; the #663/alert-#26 security assertions are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(#844): sync runtime manifest versions on npm version bump (#845) * fix(#844): sync runtime manifest versions on npm version bump The release workflow bumps package.json via `npm version` but never stamped the runtime-integration manifests that must track it (.claude-plugin/plugin.json #766, gemini-extension.json #775), so the first RC/finalize whose version diverged from the -dev stream failed the test suite before tagging/publishing. Add scripts/sync-manifest-versions.cjs (single VERSIONED_MANIFESTS registry) wired to a `version` npm lifecycle hook that stamps + stages the manifests on every `npm version` — covering all four release bump sites and local bumps with no workflow edits. A regression guard test fails if any repo JSON whose version matches package.json is not registered, forcing future version-bearing manifests into the sync. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(#844): add changeset for manifest version sync fix Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * chore: bump to 1.4.0-rc.2 * chore: finalize v1.4.0 * chore: promote CHANGELOG for v1.4.0 --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Colin <colin@solvely.net> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Joe <44273333+jslitzkerttcu@users.noreply.github.com> Co-authored-by: Solvely-Colin <211764741+Solvely-Colin@users.noreply.github.com>
142 KiB
GSD Feature Reference
Feature index and reference for GSD Core. For architecture details, see Architecture. For command syntax, see Command Reference. Return to docs index.
Table of Contents
- Core Features
- Planning Features
- Quality Assurance Features
- Context Engineering Features
- Brownfield Features
- Utility Features
- Infrastructure Features
- v1.27 Features
- v1.28 Features
- v1.29 Features
- v1.31 Features
- v1.32 Features
- STATE.md Consistency Gates
- Autonomous
--to NFlag - Research Gate
- Verifier Milestone Scope Filtering
- Read-Before-Edit Guard Hook
- Context Reduction
- Discuss-Phase
--powerFlag - Debug
--diagnoseFlag - Phase Dependency Analysis
- Anti-Pattern Severity Levels
- Methodology Artifact Type
- Planner Reachability Check
- Playwright-MCP UI Verification
- Pause-Work Expansion
- Response Language Config
- Manual Update Procedure
- New Runtime Support (Trae, Cline, Augment Code)
- Autonomous
--interactiveFlag - Commit-Docs Guard Hook
- Community Hooks Opt-In
- v1.34.0 Features
- Global Learnings Store
- Queryable Codebase Intelligence
- Execution Context Profiles
- Gates Taxonomy
- Code Review Pipeline
- Socratic Exploration
- Safe Undo
- Plan Import
- Rapid Codebase Scan
- Autonomous Audit-to-Fix
- Improved Prompt Injection Scanner
- Stall Detection in Plan-Phase
- Hard Stop Safety Gates in /gsd-progress --next
- Adaptive Model Preset
- Post-Merge Hunk Verification
- v1.35.0 Features
- v1.36.0 Features
- v1.37.0 Features
- v1.40.0 Features
- v1.41.0 Features
- v1.42.1 Features
- Package Legitimacy Gate
- Skill Surface Budgeting
- Installer Migrations
- Custom Ship PR Body Sections
- Review Default Reviewers
- Fallow Structural Review Pre-Pass
- End-of-Phase Human Verification Mode
- Quota and Rate-Limit Failure Classification
- Statusline Context Position
- Milestone Tag Creation Toggle
- Structured JSON Error Mode
Core Features
1. Project Initialization
Command: /gsd-new-project [--auto @file.md]
Purpose: Transform a user's idea into a fully structured project with research, scoped requirements, and a phased roadmap.
Requirements:
- REQ-INIT-01: System MUST conduct adaptive questioning until project scope is fully understood
- REQ-INIT-02: System MUST spawn parallel research agents to investigate the domain ecosystem
- REQ-INIT-03: System MUST extract requirements into v1 (must-have), v2 (future), and out-of-scope categories
- REQ-INIT-04: System MUST generate a phased roadmap with requirement traceability
- REQ-INIT-05: System MUST require user approval of the roadmap before proceeding
- REQ-INIT-06: System MUST prevent re-initialization when
.planning/PROJECT.mdalready exists - REQ-INIT-07: System MUST support
--auto @file.mdflag to skip interactive questions and extract from a document
Produces:
| Artifact | Description |
|---|---|
PROJECT.md |
Project vision, constraints, technical decisions, evolution rules |
REQUIREMENTS.md |
Scoped requirements with unique IDs (REQ-XX) |
ROADMAP.md |
Phase breakdown with status tracking and requirement mapping |
STATE.md |
Initial project state with position, decisions, metrics |
config.json |
Workflow configuration |
research/SUMMARY.md |
Synthesized domain research |
research/STACK.md |
Technology stack investigation |
research/FEATURES.md |
Feature implementation patterns |
research/ARCHITECTURE.md |
Architecture patterns and trade-offs |
research/PITFALLS.md |
Common failure modes and mitigations |
Process:
- Questions — Adaptive questioning guided by the "dream extraction" philosophy (not requirements gathering)
- Research — 4 parallel researcher agents investigate stack, features, architecture, and pitfalls
- Synthesis — Research synthesizer combines findings into SUMMARY.md
- Requirements — Extracted from user responses + research, categorized by scope
- Roadmap — Phase breakdown mapped to requirements, with granularity setting controlling phase count
Functional Requirements:
- Questions adapt based on detected project type (web app, CLI, mobile, API, etc.)
- Research agents have web search capability for current ecosystem information
- Granularity setting controls phase count:
coarse(2-4),standard(4-6),fine(6-10) --automode extracts all information from the provided document without interactive questioning- Existing codebase context (from
/gsd-map-codebase) is loaded if present
2. Phase Discussion
Command: /gsd-discuss-phase [N] [--auto] [--batch]
Purpose: Capture user's implementation preferences and decisions before research and planning begin. Eliminates the gray areas that cause AI to guess.
Requirements:
- REQ-DISC-01: System MUST analyze the phase scope and identify decision areas (gray areas)
- REQ-DISC-02: System MUST categorize gray areas by type (visual, API, content, organization, etc.)
- REQ-DISC-03: System MUST ask only questions not already answered in prior CONTEXT.md files
- REQ-DISC-04: System MUST persist decisions in
{phase}-CONTEXT.mdwith canonical references - REQ-DISC-05: System MUST support
--autoflag to auto-select recommended defaults - REQ-DISC-06: System MUST support
--batchflag for grouped question intake - REQ-DISC-07: System MUST scout relevant source files before identifying gray areas (code-aware discussion)
- REQ-DISC-08: System MUST adapt gray area language to product-outcome terms when USER-PROFILE.md indicates a non-technical owner (learning_style: guided, jargon in frustration_triggers, or high-level explanation depth)
- REQ-DISC-09: When REQ-DISC-08 applies, advisor_research rationale paragraphs MUST be rewritten in plain language — same decisions, translated framing
Produces: {padded_phase}-CONTEXT.md — User preferences that feed into research and planning
Gray Area Categories:
| Category | Example Decisions |
|---|---|
| Visual features | Layout, density, interactions, empty states |
| APIs/CLIs | Response format, flags, error handling, verbosity |
| Content systems | Structure, tone, depth, flow |
| Organization | Grouping criteria, naming, duplicates, exceptions |
3. UI Design Contract
Command: /gsd-ui-phase [N]
Purpose: Lock design decisions before planning so that all components in a phase share consistent visual standards.
Requirements:
- REQ-UI-01: System MUST detect existing design system state (shadcn components.json, Tailwind config, tokens)
- REQ-UI-02: System MUST ask only unanswered design contract questions
- REQ-UI-03: System MUST validate against 6 dimensions (Copywriting, Visuals, Color, Typography, Spacing, Registry Safety)
- REQ-UI-04: System MUST enter revision loop if validation returns BLOCKED (max 2 iterations)
- REQ-UI-05: System MUST offer shadcn initialization for React/Next.js/Vite projects without
components.json - REQ-UI-06: System MUST enforce registry safety gate for third-party shadcn registries
Produces: {padded_phase}-UI-SPEC.md — Design contract consumed by executors
6 Validation Dimensions:
- Copywriting — CTA labels, empty states, error messages
- Visuals — Focal points, visual hierarchy, icon accessibility
- Color — Accent usage discipline, 60/30/10 compliance
- Typography — Font size/weight constraint adherence
- Spacing — Grid alignment, token consistency
- Registry Safety — Third-party component inspection requirements
shadcn Integration:
- Detects missing
components.jsonin React/Next.js/Vite projects - Guides user through
ui.shadcn.com/createpreset configuration - Preset string becomes a planning artifact reproducible across phases
- Safety gate requires
npx shadcn viewandnpx shadcn diffbefore third-party components
4. Phase Planning
Command: /gsd-plan-phase [N] [--auto] [--skip-research] [--skip-verify]
Purpose: Research the implementation domain and produce verified, atomic execution plans.
Requirements:
- REQ-PLAN-01: System MUST spawn a phase researcher to investigate implementation approaches
- REQ-PLAN-02: System MUST produce plans with 2-3 tasks each, sized for a single context window
- REQ-PLAN-03: System MUST structure plans as XML with
<task>elements containingname,files,action,verify, anddonefields - REQ-PLAN-04: System MUST include
read_firstandacceptance_criteriasections in every plan - REQ-PLAN-05: System MUST run plan checker verification loop (up to 3 iterations) unless
--skip-verifyis set - REQ-PLAN-06: System MUST support
--skip-researchflag to bypass research phase - REQ-PLAN-07: System MUST prompt user to run
/gsd-ui-phaseif frontend phase detected and no UI-SPEC.md exists (UI safety gate) - REQ-PLAN-08: System MUST include Nyquist validation mapping when
workflow.nyquist_validationis enabled - REQ-PLAN-09: System MUST verify all phase requirements are covered by at least one plan before planning completes (requirements coverage gate)
Produces:
| Artifact | Description |
|---|---|
{phase}-RESEARCH.md |
Ecosystem research findings |
{phase}-{N}-PLAN.md |
Atomic execution plans (2-3 tasks each) |
{phase}-VALIDATION.md |
Test coverage mapping (Nyquist layer) |
Plan Structure (XML):
<task type="auto">
<name>Create login endpoint</name>
<files>src/app/api/auth/login/route.ts</files>
<action>
Use jose for JWT. Validate credentials against users table.
Return httpOnly cookie on success.
</action>
<verify>curl -X POST localhost:3000/api/auth/login returns 200 + Set-Cookie</verify>
<done>Valid credentials return cookie, invalid return 401</done>
</task>
Plan Checker Verification (8 Dimensions):
- Requirement coverage — Plans address all phase requirements
- Task atomicity — Each task is independently committable
- Dependency ordering — Tasks sequence correctly
- File scope — No excessive file overlap between plans
- Verification commands — Each task has testable done criteria
- Context fit — Tasks fit within a single context window
- Gap detection — No missing implementation steps
- Nyquist compliance — Tasks have automated verify commands (when enabled)
5. Phase Execution
Command: /gsd-execute-phase <N>
Purpose: Execute all plans in a phase using wave-based parallelization with fresh context windows per executor.
Requirements:
- REQ-EXEC-01: System MUST analyze plan dependencies and group into execution waves
- REQ-EXEC-02: System MUST spawn independent plans in parallel within each wave
- REQ-EXEC-03: System MUST give each executor a fresh context window (200K tokens)
- REQ-EXEC-04: System MUST produce atomic git commits per task
- REQ-EXEC-05: System MUST produce a SUMMARY.md for each completed plan
- REQ-EXEC-06: System MUST run post-execution verifier to check phase goals were met
- REQ-EXEC-07: System MUST support git branching strategies (
none,phase,milestone) - REQ-EXEC-08: System MUST invoke node repair operator on task verification failure (when enabled)
- REQ-EXEC-09: System MUST run prior phases' test suites before verification to catch cross-phase regressions
Produces:
| Artifact | Description |
|---|---|
{phase}-{N}-SUMMARY.md |
Execution outcomes per plan |
{phase}-VERIFICATION.md |
Post-execution verification report |
| Git commits | Atomic commits per task |
Wave Execution:
- Plans with no dependencies → Wave 1 (parallel)
- Plans depending on Wave 1 → Wave 2 (parallel, waits for Wave 1)
- Continues until all plans complete
- File conflicts force sequential execution within same wave
Executor Capabilities:
- Reads PLAN.md with full task instructions
- Has access to PROJECT.md, STATE.md, CONTEXT.md, RESEARCH.md
- Commits each task atomically with structured commit messages
- Uses
--no-verifyon commits during parallel execution to avoid build lock contention - Handles checkpoint types:
auto,checkpoint:human-verify,checkpoint:decision,checkpoint:human-action - Reports deviations from plan in SUMMARY.md
Parallel Safety:
- Pre-commit hooks: Skipped by parallel agents (
--no-verify), run once by orchestrator after each wave - STATE.md locking: File-level lockfile prevents concurrent write corruption across agents
6. Work Verification
Command: /gsd-verify-work [N]
Purpose: User acceptance testing — walk the user through testing each deliverable and auto-diagnose failures.
Requirements:
- REQ-VERIFY-01: System MUST extract testable deliverables from the phase
- REQ-VERIFY-02: System MUST present deliverables one at a time for user confirmation
- REQ-VERIFY-03: System MUST spawn debug agents to diagnose failures automatically
- REQ-VERIFY-04: System MUST create fix plans for identified issues
- REQ-VERIFY-05: System MUST inject cold-start smoke test for phases modifying server/database/seed/startup files
- REQ-VERIFY-06: System MUST produce UAT.md with pass/fail results
Produces: {phase}-UAT.md — User acceptance test results, plus fix plans if issues found
6.5. Ship
Command: /gsd-ship [N] [--draft]
Purpose: Bridge local completion → merged PR. After verification passes, push branch, create PR with auto-generated body from planning artifacts, optionally trigger review, and track in STATE.md.
Requirements:
- REQ-SHIP-01: System MUST verify phase has passed verification before shipping
- REQ-SHIP-02: System MUST push branch and create PR via
ghCLI - REQ-SHIP-03: System MUST auto-generate PR body from SUMMARY.md, VERIFICATION.md, and REQUIREMENTS.md
- REQ-SHIP-04: System MUST update STATE.md with shipping status and PR number
- REQ-SHIP-05: System MUST support
--draftflag for draft PRs - REQ-SHIP-06: System MUST support append-only project PR body sections configured with
ship.pr_body_sections
Prerequisites: Phase verified, gh CLI installed and authenticated, work on feature branch
Produces: GitHub PR with rich body, optional configured PRD-style sections, STATE.md updated
User documentation: Custom PR Body Sections
7. UI Review
Command: /gsd-ui-review [N]
Purpose: Retroactive 6-pillar visual audit of implemented frontend code. Works standalone on any project.
Requirements:
- REQ-UIREVIEW-01: System MUST score each of the 6 pillars on a 1-4 scale
- REQ-UIREVIEW-02: System MUST capture screenshots via Playwright CLI to
.planning/ui-reviews/ - REQ-UIREVIEW-03: System MUST create
.gitignorefor screenshot directory - REQ-UIREVIEW-04: System MUST identify top 3 priority fixes
- REQ-UIREVIEW-05: System MUST work standalone (without UI-SPEC.md) using abstract quality standards
6 Audit Pillars (scored 1-4):
- Copywriting — CTA labels, empty states, error states
- Visuals — Focal points, visual hierarchy, icon accessibility
- Color — Accent usage discipline, 60/30/10 compliance
- Typography — Font size/weight constraint adherence
- Spacing — Grid alignment, token consistency
- Experience Design — Loading/error/empty state coverage
Produces: {padded_phase}-UI-REVIEW.md — Scores and prioritized fixes
8. Milestone Management
Commands: /gsd-audit-milestone, /gsd-complete-milestone, /gsd-new-milestone [name]
Purpose: Verify milestone completion, archive, tag release, and start the next development cycle.
Requirements:
- REQ-MILE-01: Audit MUST verify all milestone requirements are met
- REQ-MILE-02: Audit MUST detect stubs, placeholder implementations, and untested code
- REQ-MILE-03: Audit MUST check Nyquist validation compliance across phases
- REQ-MILE-04: Complete MUST archive milestone data to MILESTONES.md
- REQ-MILE-05: Complete MUST offer git tag creation for the release
- REQ-MILE-06: Complete MUST offer squash merge or merge with history for branching strategies
- REQ-MILE-07: Complete MUST clean up UI review screenshots
- REQ-MILE-08: New milestone MUST follow same flow as new-project (questions → research → requirements → roadmap)
- REQ-MILE-09: New milestone MUST NOT reset existing workflow configuration
Planning Features
9. Phase Management
Commands: /gsd-phase, /gsd-phase --insert [N], /gsd-phase --remove [N]
Purpose: Dynamic roadmap modification during development.
Requirements:
- REQ-PHASE-01: Add MUST append a new phase to the end of the current roadmap
- REQ-PHASE-02: Insert MUST use decimal numbering (e.g., 3.1) between existing phases
- REQ-PHASE-03: Remove MUST renumber all subsequent phases
- REQ-PHASE-04: Remove MUST prevent removing phases that have been executed
- REQ-PHASE-05: All operations MUST update ROADMAP.md and create/remove phase directories
10. Quick Mode
Command: /gsd-quick [--full] [--discuss] [--research]
Purpose: Ad-hoc task execution with GSD guarantees but a faster path.
Requirements:
- REQ-QUICK-01: System MUST accept freeform task description
- REQ-QUICK-02: System MUST use same planner + executor agents as full workflow
- REQ-QUICK-03: System MUST skip research, plan checker, and verifier by default
- REQ-QUICK-04:
--fullflag MUST enable plan checking (max 2 iterations) and post-execution verification - REQ-QUICK-05:
--discussflag MUST run lightweight pre-planning discussion - REQ-QUICK-06:
--researchflag MUST spawn focused research agent before planning - REQ-QUICK-07: Flags MUST be composable (
--discuss --research --full) - REQ-QUICK-08: System MUST track quick tasks in
.planning/quick/YYMMDD-xxx-slug/ - REQ-QUICK-09: System MUST produce atomic commits for quick task execution
11. Autonomous Mode
Command: /gsd-autonomous [--from N]
Purpose: Run all remaining phases autonomously — discuss → plan → execute per phase.
Requirements:
- REQ-AUTO-01: System MUST iterate through all incomplete phases in roadmap order
- REQ-AUTO-02: System MUST run discuss → plan → execute for each phase
- REQ-AUTO-03: System MUST pause for explicit user decisions (gray area acceptance, blockers, validation)
- REQ-AUTO-04: System MUST re-read ROADMAP.md after each phase to catch dynamically inserted phases
- REQ-AUTO-05:
--from Nflag MUST start from a specific phase number
12. Freeform Routing
Command: /gsd-progress --do (see also /gsd-manager for interactive routing)
Purpose: Analyze freeform text and route to the appropriate GSD command.
Requirements:
- REQ-DO-01: System MUST parse user intent from natural language input
- REQ-DO-02: System MUST map intent to the best matching GSD command
- REQ-DO-03: System MUST confirm the routing with the user before executing
- REQ-DO-04: System MUST handle project-exists vs no-project contexts differently
13. Note Capture
Command: /gsd-capture
Purpose: Zero-friction idea capture without interrupting workflow. Append timestamped notes, list all notes, or promote notes to structured todos.
Requirements:
- REQ-NOTE-01: System MUST save timestamped note files with a single Write call
- REQ-NOTE-02: System MUST support
listsubcommand to show all notes from project and global scopes - REQ-NOTE-03: System MUST support
promote Nsubcommand to convert a note into a structured todo - REQ-NOTE-04: System MUST support
--globalflag for global scope operations - REQ-NOTE-05: System MUST NOT use Task, AskUserQuestion, or Bash — runs inline only
14. Auto-Advance (Next)
Command: /gsd-progress --next
Purpose: Automatically detect current project state and advance to the next logical workflow step, eliminating the need to remember which phase/step you're on.
Requirements:
- REQ-NEXT-01: System MUST read STATE.md, ROADMAP.md, and phase directories to determine current position
- REQ-NEXT-02: System MUST detect whether discuss, plan, execute, or verify is needed
- REQ-NEXT-03: System MUST invoke the correct command automatically
- REQ-NEXT-04: System MUST suggest
/gsd-new-projectif no project exists - REQ-NEXT-05: System MUST suggest
/gsd-complete-milestonewhen all phases are complete
State Detection Logic:
| State | Action |
|---|---|
No .planning/ directory |
Suggest /gsd-new-project |
| Phase has no CONTEXT.md | Run /gsd-discuss-phase |
| Phase has no PLAN.md files | Run /gsd-plan-phase |
| Phase has plans but no SUMMARY.md | Run /gsd-execute-phase |
| Phase executed but no VERIFICATION.md | Run /gsd-verify-work |
| All phases complete | Suggest /gsd-complete-milestone |
Quality Assurance Features
15. Nyquist Validation
Purpose: Map automated test coverage to phase requirements before any code is written. Named after the Nyquist sampling theorem — ensures a feedback signal exists for every requirement.
Requirements:
- REQ-NYQ-01: System MUST detect existing test infrastructure during plan-phase research
- REQ-NYQ-02: System MUST map each requirement to a specific test command
- REQ-NYQ-03: System MUST identify Wave 0 tasks (test scaffolding needed before implementation)
- REQ-NYQ-04: Plan checker MUST enforce Nyquist compliance as 8th verification dimension
- REQ-NYQ-05: System MUST support retroactive validation via
/gsd-validate-phase - REQ-NYQ-06: System MUST be disableable via
workflow.nyquist_validation: false
Produces: {phase}-VALIDATION.md — Test coverage contract
Retroactive Validation (/gsd-validate-phase [N]):
- Scans implementation and maps requirements to tests
- Identifies gaps where requirements lack automated verification
- Spawns auditor to generate tests (max 3 attempts)
- Never modifies implementation code — only test files and VALIDATION.md
- Flags implementation bugs as escalations for user to address
16. Plan Checking
Purpose: Goal-backward verification that plans will achieve phase objectives before execution.
Requirements:
- REQ-PLANCK-01: System MUST verify plans against 8 quality dimensions
- REQ-PLANCK-02: System MUST loop up to 3 iterations until plans pass
- REQ-PLANCK-03: System MUST produce specific, actionable feedback on failures
- REQ-PLANCK-04: System MUST be disableable via
workflow.plan_check: false
17. Post-Execution Verification
Purpose: Automated check that the codebase delivers what the phase promised.
Requirements:
- REQ-POSTVER-01: System MUST check against phase goals, not just task completion
- REQ-POSTVER-02: System MUST produce VERIFICATION.md with pass/fail analysis
- REQ-POSTVER-03: System MUST log issues for
/gsd-verify-workto address - REQ-POSTVER-04: System MUST be disableable via
workflow.verifier: false
18. Node Repair
Purpose: Autonomous recovery when task verification fails during execution.
Requirements:
- REQ-REPAIR-01: System MUST analyze failure and choose one strategy: RETRY, DECOMPOSE, or PRUNE
- REQ-REPAIR-02: RETRY MUST attempt with a concrete adjustment
- REQ-REPAIR-03: DECOMPOSE MUST break task into smaller verifiable sub-steps
- REQ-REPAIR-04: PRUNE MUST remove unachievable tasks and escalate to user
- REQ-REPAIR-05: System MUST respect repair budget (default: 2 attempts per task)
- REQ-REPAIR-06: System MUST be configurable via
workflow.node_repair_budgetandworkflow.node_repair
19. Health Validation
Command: /gsd-health [--repair]
Purpose: Validate .planning/ directory integrity and auto-repair issues.
Requirements:
- REQ-HEALTH-01: System MUST check for missing required files
- REQ-HEALTH-02: System MUST validate configuration consistency
- REQ-HEALTH-03: System MUST detect orphaned plans without summaries
- REQ-HEALTH-04: System MUST check phase numbering and roadmap sync
- REQ-HEALTH-05:
--repairflag MUST auto-fix recoverable issues
20. Cross-Phase Regression Gate
Purpose: Prevent regressions from compounding across phases by running prior phases' test suites after execution.
Requirements:
- REQ-REGR-01: System MUST run test suites from all completed prior phases after phase execution
- REQ-REGR-02: System MUST report any test failures as cross-phase regressions
- REQ-REGR-03: Regressions MUST be surfaced before post-execution verification
- REQ-REGR-04: System MUST identify which prior phase's tests were broken
When: Runs automatically during /gsd-execute-phase before the verifier step.
21. Requirements Coverage Gate
Purpose: Ensure all phase requirements are covered by at least one plan before planning completes.
Requirements:
- REQ-COVGATE-01: System MUST extract all requirement IDs assigned to the phase from ROADMAP.md
- REQ-COVGATE-02: System MUST verify each requirement appears in at least one PLAN.md
- REQ-COVGATE-03: Uncovered requirements MUST block planning completion
- REQ-COVGATE-04: System MUST report which specific requirements lack plan coverage
When: Runs automatically at the end of /gsd-plan-phase after the plan checker loop.
Context Engineering Features
22. Context Window Monitoring
Purpose: Prevent context rot by alerting both user and agent when context is running low.
Requirements:
- REQ-CTX-01: Statusline MUST display context usage percentage to user
- REQ-CTX-02: Context monitor MUST inject agent-facing warnings at ≤35% remaining (WARNING)
- REQ-CTX-03: Context monitor MUST inject agent-facing warnings at ≤25% remaining (CRITICAL)
- REQ-CTX-04: Warnings MUST debounce (5 tool uses between repeated warnings)
- REQ-CTX-05: Severity escalation (WARNING→CRITICAL) MUST bypass debounce
- REQ-CTX-06: Context monitor MUST differentiate GSD-active vs non-GSD-active projects
- REQ-CTX-07: Warnings MUST be advisory, never imperative commands that override user preferences
- REQ-CTX-08: All hooks MUST fail silently and never block tool execution
Architecture: Two-part bridge system:
- Statusline writes metrics to
/tmp/claude-ctx-{session}.json - Context monitor reads metrics and injects
additionalContextwarnings
23. Session Management
Commands: /gsd-pause-work, /gsd-resume-work, /gsd-progress
Purpose: Maintain project continuity across context resets and sessions.
Requirements:
- REQ-SESSION-01: Pause MUST save current position and next steps to
continue-here.mdand structuredHANDOFF.json - REQ-SESSION-02: Resume MUST restore full project context from HANDOFF.json (preferred) or state files (fallback)
- REQ-SESSION-03: Progress MUST show current position, next action, and overall completion
- REQ-SESSION-04: Progress MUST read all state files (STATE.md, ROADMAP.md, phase directories)
- REQ-SESSION-05: All session operations MUST work after
/clear(context reset) - REQ-SESSION-06: HANDOFF.json MUST include blockers, human actions pending, and in-progress task state
- REQ-SESSION-07: Resume MUST surface human actions and blockers immediately on session start
24. Session Reporting
Command: /gsd-pause-work --report
Purpose: Generate a structured post-session summary document capturing work performed, outcomes achieved, and estimated resource usage.
Requirements:
- REQ-REPORT-01: System MUST gather data from STATE.md, git log, and plan/summary files
- REQ-REPORT-02: System MUST include commits made, plans executed, and phases progressed
- REQ-REPORT-03: System MUST estimate token usage and cost based on session activity
- REQ-REPORT-04: System MUST include active blockers and decisions made
- REQ-REPORT-05: System MUST recommend next steps
Produces: .planning/reports/SESSION_REPORT.md
Report Sections:
- Session overview (duration, milestone, phase)
- Work performed (commits, plans, phases)
- Outcomes and deliverables
- Blockers and decisions
- Resource estimates (tokens, cost)
- Next steps recommendation
25. Multi-Agent Orchestration
Purpose: Coordinate specialized agents with fresh context windows for each task.
Requirements:
- REQ-ORCH-01: Each agent MUST receive a fresh context window
- REQ-ORCH-02: Orchestrators MUST be thin — spawn agents, collect results, route next
- REQ-ORCH-03: Context payload MUST include all relevant project artifacts
- REQ-ORCH-04: Parallel agents MUST be truly independent (no shared mutable state)
- REQ-ORCH-05: Agent results MUST be written to disk before orchestrator processes them
- REQ-ORCH-06: Failed agents MUST be detected (spot-check actual output vs reported failure)
26. Model Profiles
Command: /gsd-config --profile <quality|balanced|budget|adaptive|inherit>
Purpose: Control which AI model each agent uses, balancing quality vs cost.
Requirements:
- REQ-MODEL-01: System MUST support 4 profiles:
quality,balanced,budget,inherit - REQ-MODEL-02: Each profile MUST define model tier per agent (see profile table)
- REQ-MODEL-03: Per-agent overrides MUST take precedence over profile
- REQ-MODEL-04:
inheritprofile MUST defer to runtime's current model selection - REQ-MODEL-04a:
inheritprofile MUST be used when running non-Anthropic providers (OpenRouter, local models) to avoid unexpected API costs - REQ-MODEL-05: Profile switch MUST be programmatic (script, not LLM-driven)
- REQ-MODEL-06: Model resolution MUST happen once per orchestration, not per spawn
Profile Assignments:
| Agent | quality |
balanced |
budget |
inherit |
|---|---|---|---|---|
| gsd-planner | Opus | Opus | Sonnet | Inherit |
| gsd-roadmapper | Opus | Sonnet | Sonnet | Inherit |
| gsd-executor | Opus | Sonnet | Sonnet | Inherit |
| gsd-phase-researcher | Opus | Sonnet | Haiku | Inherit |
| gsd-project-researcher | Opus | Sonnet | Haiku | Inherit |
| gsd-research-synthesizer | Sonnet | Sonnet | Haiku | Inherit |
| gsd-debugger | Opus | Sonnet | Sonnet | Inherit |
| gsd-codebase-mapper | Sonnet | Haiku | Haiku | Inherit |
| gsd-verifier | Sonnet | Sonnet | Haiku | Inherit |
| gsd-plan-checker | Sonnet | Sonnet | Haiku | Inherit |
| gsd-integration-checker | Sonnet | Sonnet | Haiku | Inherit |
| gsd-nyquist-auditor | Sonnet | Sonnet | Haiku | Inherit |
Brownfield Features
27. Codebase Mapping
Command: /gsd-map-codebase [area]
Purpose: Analyze an existing codebase before starting a new project, so GSD understands what exists.
Requirements:
- REQ-MAP-01: System MUST spawn parallel mapper agents for each analysis area
- REQ-MAP-02: System MUST produce structured documents in
.planning/codebase/ - REQ-MAP-03: System MUST detect: tech stack, architecture patterns, coding conventions, concerns
- REQ-MAP-04: Subsequent
/gsd-new-projectMUST load codebase mapping and focus questions on what's being added - REQ-MAP-05: Optional
[area]argument MUST scope mapping to a specific area
Produces:
| Document | Content |
|---|---|
STACK.md |
Languages, frameworks, databases, infrastructure |
ARCHITECTURE.md |
Patterns, layers, data flow, boundaries |
CONVENTIONS.md |
Naming, file organization, code style, testing patterns |
CONCERNS.md |
Technical debt, security issues, performance bottlenecks |
STRUCTURE.md |
Directory layout and file organization |
TESTING.md |
Test infrastructure, coverage, patterns |
INTEGRATIONS.md |
External services, APIs, third-party dependencies |
Incremental remap — --paths (#2003): The mapper accepts an optional
--paths <p1,p2,...> scope hint. When provided, it restricts exploration
to the listed repo-relative prefixes instead of scanning the whole tree.
This is the pathway used by the post-execute codebase-drift gate to refresh
only the subtrees the phase actually changed. Each produced document carries
last_mapped_commit in its YAML frontmatter so drift can be measured
against the mapping point, not HEAD.
27a. Post-Execute Codebase Drift Detection
Introduced by: #2003
Trigger: Runs automatically at the end of every /gsd-execute-phase
Configuration:
workflow.drift_threshold(integer, default3) — minimum new structural elements before the gate acts.workflow.drift_action(warn|auto-remap, defaultwarn) — warn-only or spawngsd-codebase-mapperwith--pathsscoped to affected subtrees.
What counts as drift:
- New directory outside mapped paths
- New barrel export at
(packages|apps)/*/src/index.* - New migration file (supabase/prisma/drizzle/src/migrations/…)
- New route module under
routes/orapi/
Non-blocking guarantee: any internal failure (missing STRUCTURE.md, git errors, mapper spawn failure) logs a single line and the phase continues. Drift detection cannot fail verification.
Requirements:
- REQ-DRIFT-01: System MUST detect the four drift categories from
git diff --name-status last_mapped_commit..HEAD - REQ-DRIFT-02: Action fires only when element count ≥
workflow.drift_threshold - REQ-DRIFT-03:
warnaction MUST NOT spawn any agent - REQ-DRIFT-04:
auto-remapaction MUST pass sanitized--pathsto the mapper - REQ-DRIFT-05: Detection/remap failure MUST be non-blocking for
/gsd-execute-phase - REQ-DRIFT-06:
last_mapped_commitround-trip through YAML frontmatter on each.planning/codebase/*.mdfile
Utility Features
28. Debug System
Command: /gsd-debug [description]
Purpose: Systematic debugging with persistent state across context resets.
Requirements:
- REQ-DEBUG-01: System MUST create debug session file in
.planning/debug/ - REQ-DEBUG-02: System MUST track hypotheses, evidence, and eliminated theories
- REQ-DEBUG-03: System MUST persist state so debugging survives context resets
- REQ-DEBUG-04: System MUST require human verification before marking resolved
- REQ-DEBUG-05: Resolved sessions MUST append to
.planning/debug/knowledge-base.md - REQ-DEBUG-06: Knowledge base MUST be consulted on new debug sessions to prevent re-investigation
Debug Session States: gathering → investigating → fixing → verifying → awaiting_human_verify → resolved
29. Todo Management
Commands: /gsd-capture [desc], /gsd-capture --list
Purpose: Capture ideas and tasks during sessions for later work.
Requirements:
- REQ-TODO-01: System MUST capture todo from current conversation context
- REQ-TODO-02: Todos MUST be stored in
.planning/todos/pending/ - REQ-TODO-03: Completed todos MUST move to
.planning/todos/completed/ - REQ-TODO-04: Check-todos MUST list all pending items with selection to work on one
30. Statistics Dashboard
Command: /gsd-stats
Purpose: Display project metrics — phases, plans, requirements, git history, and timeline.
Requirements:
- REQ-STATS-01: System MUST show phase/plan completion counts
- REQ-STATS-02: System MUST show requirement coverage
- REQ-STATS-03: System MUST show git commit metrics
- REQ-STATS-04: System MUST support multiple output formats (json, table, bar)
31. Update System
Command: /gsd-update
Purpose: Update GSD to the latest version with changelog preview.
Requirements:
- REQ-UPDATE-01: System MUST check for new versions via npm
- REQ-UPDATE-02: System MUST display changelog for new version before updating
- REQ-UPDATE-03: System MUST be runtime-aware and target the correct directory
- REQ-UPDATE-04: System MUST back up locally modified files to
gsd-local-patches/ - REQ-UPDATE-05:
/gsd-update --reapplyMUST restore local modifications after update - REQ-UPDATE-06:
/gsd-update --next(alias--rc) MUST target the@nextRC dist-tag for version check and install; omitting the flag MUST keep@latestbehavior unchanged (ADR #660)
32. Settings Management
Command: /gsd-settings
Purpose: Interactive configuration of workflow toggles and model profile.
Requirements:
- REQ-SETTINGS-01: System MUST present current settings with toggle options
- REQ-SETTINGS-02: System MUST update
.planning/config.json - REQ-SETTINGS-03: System MUST support saving as global defaults (
~/.gsd/defaults.json)
Configurable Settings:
| Setting | Type | Default | Description |
|---|---|---|---|
mode |
enum | interactive |
interactive or yolo (auto-approve) |
granularity |
enum | standard |
coarse, standard, or fine |
model_profile |
enum | balanced |
quality, balanced, budget, or inherit |
models.<phase_type> |
enum | (none) | Per-phase-type tier override (planning, discuss, research, execution, verification, completion). Values: opus, sonnet, haiku, inherit. Coarse phase-level tuning that wins over model_profile but loses to per-agent model_overrides. See CONFIGURATION.md. Added in v1.40 |
granularities.<phase_type> |
enum | (none) | Per-phase-type granularity override (planning, discuss, research, execution, verification, completion). Values: coarse, standard, fine. Mirrors models.<phase_type> for granularity. See CONFIGURATION.md. Added in v1.43 (#68). /gsd:plan-phase --granularity <coarse|standard|fine> overrides all config-based granularity for a single invocation (takes precedence over granularities.planning, top-level granularity, and planning.granularity). (#703) |
dynamic_routing.enabled |
boolean | false |
Master switch for failure-tier escalation. When true, agents resolve to tier_models[default_tier] and escalate one tier on orchestrator-detected soft failure. Capped by max_escalations. See CONFIGURATION.md. Added in v1.40 |
workflow.research |
boolean | true |
Domain research before planning |
workflow.plan_check |
boolean | true |
Plan verification loop |
workflow.verifier |
boolean | true |
Post-execution verification |
workflow.auto_advance |
boolean | false |
Auto-chain discuss→plan→execute |
workflow.nyquist_validation |
boolean | true |
Nyquist test coverage mapping |
workflow.ui_phase |
boolean | true |
UI design contract generation |
workflow.ui_safety_gate |
boolean | true |
Prompt for ui-phase on frontend phases |
workflow.node_repair |
boolean | true |
Autonomous task repair |
workflow.node_repair_budget |
number | 2 |
Max repair attempts per task |
planning.commit_docs |
boolean | true |
Commit .planning/ files to git |
planning.search_gitignored |
boolean | false |
Include gitignored files in searches |
parallelization.enabled |
boolean | true |
Run independent plans simultaneously |
git.branching_strategy |
enum | none |
none, phase, or milestone |
33. Test Generation
Command: /gsd-add-tests [N]
Purpose: Generate tests for a completed phase based on UAT criteria and implementation.
Requirements:
- REQ-TEST-01: System MUST analyze completed phase implementation
- REQ-TEST-02: System MUST generate tests based on UAT criteria and acceptance criteria
- REQ-TEST-03: System MUST use existing test infrastructure patterns
Infrastructure Features
34. Git Integration
Purpose: Atomic commits, branching strategies, and clean history management.
Requirements:
- REQ-GIT-01: Each task MUST get its own atomic commit
- REQ-GIT-02: Commit messages MUST follow structured format:
type(scope): description - REQ-GIT-03: System MUST support 3 branching strategies:
none,phase,milestone - REQ-GIT-04: Phase strategy MUST create one branch per phase
- REQ-GIT-05: Milestone strategy MUST create one branch per milestone
- REQ-GIT-06: Complete-milestone MUST offer squash merge (recommended) or merge with history
- REQ-GIT-07: System MUST respect
commit_docssetting for.planning/files - REQ-GIT-08: System MUST auto-detect
.planning/in.gitignoreand skip commits
Commit Format:
type(phase-plan): description
# Examples:
docs(08-02): complete user registration plan
feat(08-02): add email confirmation flow
fix(03-01): correct auth token expiry
35. CLI Tools
Purpose: Programmatic utilities for workflows and agents, replacing repetitive inline bash patterns.
Requirements:
- REQ-CLI-01: System MUST provide atomic commands for state, config, phase, roadmap operations
- REQ-CLI-02: System MUST provide compound
initcommands that load all context for each workflow - REQ-CLI-03: System MUST support
--rawflag for machine-readable output - REQ-CLI-04: System MUST support
--cwdflag for sandboxed subagent operation - REQ-CLI-05: All operations MUST use forward-slash paths on Windows
Command Categories: State (11 subcommands), Phase (5), Roadmap (3), Verify (8), Template (2), Frontmatter (4), Scaffold (4), Init (12), Validate (2), Progress, Stats, Todo
36. Multi-Runtime Support
Purpose: Run GSD across multiple AI coding agent runtimes.
Requirements:
- REQ-RUNTIME-01: System MUST support Claude Code, OpenCode, Gemini CLI, Kilo, Codex, Copilot, Antigravity, Trae, Cline, Augment Code, CodeBuddy, Qwen Code
- REQ-RUNTIME-02: Installer MUST transform content per runtime (tool names, paths, frontmatter)
- REQ-RUNTIME-03: Installer MUST support interactive and non-interactive (
--claude --global) modes - REQ-RUNTIME-04: Installer MUST support both global and local installation
- REQ-RUNTIME-05: Uninstall MUST cleanly remove all GSD files without affecting other configurations
- REQ-RUNTIME-06: Installer MUST handle platform differences (Windows, macOS, Linux, WSL, Docker)
Runtime Transformations:
| Aspect | Claude Code | OpenCode | Gemini | Kilo | Codex | Copilot | Antigravity | Cursor | Trae | Cline | Augment | CodeBuddy | Qwen Code |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Commands | Slash commands | Slash commands | Slash commands | Slash commands | Skills (TOML) | Slash commands | Skills | Skills + Slash commands | Skills | Rules | Skills | Skills | Skills |
| Agent format | Claude native | mode: subagent |
Claude native | mode: subagent |
Skills | Tool mapping | Skills | Skills | Skills | Rules | Skills | Skills | Skills |
| Hook events | PostToolUse |
N/A | AfterTool |
N/A | N/A | N/A | N/A | N/A | N/A | N/A | N/A | N/A | N/A |
| Config | settings.json |
opencode.json(c) |
settings.json |
kilo.json(c) |
TOML | Instructions | Config | Config | Config | .clinerules |
Config | Config | Config |
Cursor artifact surfaces: gsd install --cursor writes two artifact kinds:
~/.cursor/skills/gsd-<name>/SKILL.md— rich skills with YAML frontmatter, Cursor tool-name mapping, and adapter context header (existing surface)~/.cursor/commands/gsd-<name>.md— plain markdown slash commands (no frontmatter) invocable via/in the Agent input (Cursor 1.6+, added in #785)
Claude Code native plugin distribution: GSD Core ships a .claude-plugin/plugin.json manifest, enabling installation and lifecycle management via claude plugin install|enable|disable|update gsd-core. Commands load under the /gsd-core: namespace (e.g. /gsd-core:plan-phase), avoiding slash-command collisions with the classic npm installer which uses /gsd:. Always-on guard and update hooks are wired automatically via hooks/hooks.json. The plugin path is additive — the npm installer (npx @opengsd/gsd-core) remains fully supported.
37. Hook System
Purpose: Runtime event hooks for context monitoring, status display, and update checking.
Requirements:
- REQ-HOOK-01: Statusline MUST display model, current task, directory, and context usage
- REQ-HOOK-02: Context monitor MUST inject agent-facing warnings at threshold levels
- REQ-HOOK-03: Update checker MUST run in background on session start
- REQ-HOOK-04: All hooks MUST respect
CLAUDE_CONFIG_DIRenv var - REQ-HOOK-05: All hooks MUST include 3-second stdin timeout guard
- REQ-HOOK-06: All hooks MUST fail silently on any error
- REQ-HOOK-07: Context usage MUST normalize for autocompact buffer (16.5% reserved)
- REQ-HOOK-08: Update banner MUST be opt-in and silent unless an update is available (PR #2795)
Statusline Display:
[⬆ /gsd-update │] model │ [current task │] directory [█████░░░░░ 50%]
Color coding: <50% green, <65% yellow, <80% orange, ≥80% red with skull emoji
Update Banner (opt-in, when GSD statusline isn't used):
When the user declines (or keeps a non-GSD) statusline, the installer offers a SessionStart banner that surfaces update availability without occupying statusline real estate. The banner reads ~/.cache/gsd/gsd-update-check.json (written by gsd-check-update-worker.js) and emits one line only when an update is available:
GSD update available: 1.39.0 → 1.40.0. Run /gsd-update.
The banner is silent when up-to-date and rate-limits "check failed" diagnostics to once per 24 hours. Removed cleanly by npx @opengsd/gsd-core --uninstall or by deleting the SessionStart entry that references gsd-update-banner.js.
38. Developer Profiling
Command: /gsd-profile-user [--questionnaire] [--refresh]
Purpose: Analyze Claude Code session history to build behavioral profiles across 8 dimensions, generating artifacts that personalize Claude's responses to the developer's style.
Dimensions:
- Communication style (terse vs verbose, formal vs casual)
- Decision patterns (rapid vs deliberate, risk tolerance)
- Debugging approach (systematic vs intuitive, log preference)
- UX preferences (design sensibility, accessibility awareness)
- Vendor/technology choices (framework preferences, ecosystem familiarity)
- Frustration triggers (what causes friction in workflows)
- Learning style (documentation vs examples, depth preference)
- Explanation depth (high-level vs implementation detail)
Generated Artifacts:
USER-PROFILE.md— Full behavioral profile with evidence citationsCLAUDE.mdprofile section — Auto-discovered by Claude Code
Flags:
--questionnaire— Interactive questionnaire fallback when session history is unavailable--refresh— Re-analyze sessions and regenerate profile
Pipeline Modules:
profile-pipeline.cjs— Session scanning, message extraction, samplingprofile-output.cjs— Profile rendering, questionnaire, artifact generationgsd-user-profileragent — Behavioral analysis from session data
Requirements:
- REQ-PROF-01: Session analysis MUST cover at least 8 behavioral dimensions
- REQ-PROF-02: Profile MUST cite evidence from actual session messages
- REQ-PROF-03: Questionnaire MUST be available as fallback when no session history exists
- REQ-PROF-04: Generated artifacts MUST be discoverable by Claude Code (CLAUDE.md integration)
39. Execution Hardening
Purpose: Three additive quality improvements to the execution pipeline that catch cross-plan failures before they cascade.
Components:
1. Pre-Wave Dependency Check (execute-phase) Before spawning wave N+1, verify key-links from prior wave artifacts exist and are wired correctly. Catches cross-plan dependency gaps before they cascade into downstream failures.
2. Cross-Plan Data Contracts — Dimension 9 (plan-checker) New analysis dimension that checks plans sharing data pipelines have compatible transformations. Flags when one plan strips data that another plan needs in its original form.
3. Export-Level Spot Check (verify-phase) After Level 3 wiring verification passes, spot-check individual exports for actual usage. Catches dead stores that exist in wired files but are never called.
Requirements:
- REQ-HARD-01: Pre-wave check MUST verify key-links from all prior wave artifacts before spawning next wave
- REQ-HARD-02: Cross-plan contract check MUST detect incompatible data transformations between plans
- REQ-HARD-03: Export spot-check MUST identify dead stores in wired files
40. Verification Debt Tracking
Command: /gsd-audit-uat
Purpose: Prevent silent loss of UAT/verification items when projects advance past phases with outstanding tests. Surfaces verification debt across all prior phases so items are never forgotten.
Components:
1. Cross-Phase Health Check (progress.md Step 1.6)
Every /gsd-progress call scans ALL phases in the current milestone for outstanding items (pending, skipped, blocked, human_needed). Displays a non-blocking warning section with actionable links.
2. status: partial (verify-work.md, UAT.md)
New UAT status that distinguishes between "session ended" and "all tests resolved". Prevents status: complete when tests are still pending, blocked, or skipped without reason.
3. result: blocked with blocked_by tag (verify-work.md, UAT.md)
New test result type for tests blocked by external dependencies (server, physical device, release build, third-party services). Categorized separately from skipped tests.
4. HUMAN-UAT.md Persistence (execute-phase.md)
When verification returns human_needed, items are persisted as a trackable HUMAN-UAT.md file with status: partial. Feeds into the cross-phase health check and audit systems.
5. Phase Completion Warnings (phase.cjs, transition.md)
phase complete CLI returns verification debt warnings in its JSON output. Transition workflow surfaces outstanding items before confirmation.
Requirements:
- REQ-DEBT-01: System MUST surface outstanding UAT/verification items from ALL prior phases in
/gsd-progress - REQ-DEBT-02: System MUST distinguish incomplete testing (partial) from completed testing (complete)
- REQ-DEBT-03: System MUST categorize blocked tests with
blocked_bytags - REQ-DEBT-04: System MUST persist human_needed verification items as trackable UAT files
- REQ-DEBT-05: System MUST warn (non-blocking) during phase completion and transition when verification debt exists
- REQ-DEBT-06:
/gsd-audit-uatMUST scan all phases, categorize items by testability, and produce a human test plan
v1.27 Features
41. Fast Mode
Command: /gsd-fast [task description]
Purpose: Execute trivial tasks inline without spawning subagents or generating PLAN.md files. For tasks too small to justify planning overhead: typo fixes, config changes, small refactors, forgotten commits, simple additions.
Requirements:
- REQ-FAST-01: System MUST execute the task directly in the current context without subagents
- REQ-FAST-02: System MUST produce an atomic git commit for the change
- REQ-FAST-03: System MUST track the task in
.planning/quick/for state consistency - REQ-FAST-04: System MUST NOT be used for tasks requiring research, multi-step planning, or verification
When to use vs /gsd-quick:
/gsd-fast— One-sentence tasks executable in under 2 minutes (typo, config change, small addition)/gsd-quick— Anything needing research, multi-step planning, or verification
42. Cross-AI Peer Review
Command: /gsd-review --phase N [--gemini] [--claude] [--codex] [--coderabbit] [--opencode] [--qwen] [--cursor] [--agy] [--ollama] [--lm-studio] [--llama-cpp] [--all]
Purpose: Invoke external AI CLIs (Gemini, Claude, Codex, CodeRabbit, OpenCode, Qwen Code, Cursor, Antigravity) to independently review phase plans. Produces structured REVIEWS.md with per-reviewer feedback.
Requirements:
- REQ-REVIEW-01: System MUST detect available AI CLIs on the system
- REQ-REVIEW-02: System MUST build a structured review prompt from phase plans
- REQ-REVIEW-03: System MUST invoke each selected CLI independently
- REQ-REVIEW-04: System MUST collect responses and produce
REVIEWS.md - REQ-REVIEW-05: Reviews MUST be consumable by
/gsd-plan-phase --reviews - REQ-REVIEW-06: System MUST support project-level no-flag defaults via
review.default_reviewers - REQ-REVIEW-07: Reviewer precedence MUST be explicit flags >
--all>review.default_reviewers> all detected reviewers
Produces: {phase}-REVIEWS.md — Per-reviewer structured feedback
User configuration note:
- Set
review.default_reviewersin.planning/config.json(or viagsd config-set) to control no-flag/gsd-reviewfan-out. - Use
--allfor a full pre-merge sweep without changing project defaults. - For local model servers with small context windows, set
review.max_prompt_tokens_per_reviewerto auto-trim prompts per reviewer — see Prompt budgets for small-context reviewers in CONFIGURATION.md.
43. Backlog Parking Lot
Commands: /gsd-capture --backlog <description>, /gsd-review-backlog, /gsd-capture --seed <idea>
Purpose: Capture ideas that aren't ready for active planning. Backlog items use 999.x numbering to stay outside the active phase sequence. Seeds are forward-looking ideas with trigger conditions that surface automatically at the right milestone.
Requirements:
- REQ-BACKLOG-01: Backlog items MUST use 999.x numbering to stay outside active phase sequence
- REQ-BACKLOG-02: Phase directories MUST be created immediately so
/gsd-discuss-phaseand/gsd-plan-phasework on them - REQ-BACKLOG-03:
/gsd-review-backlogMUST support promote, keep, and remove actions per item - REQ-BACKLOG-04: Promoted items MUST be renumbered into the active milestone sequence
- REQ-SEED-01: Seeds MUST capture the full WHY and WHEN to surface conditions
- REQ-SEED-02:
/gsd-new-milestoneMUST scan seeds and present matches
Produces:
| Artifact | Description |
|---|---|
.planning/phases/999.x-slug/ |
Backlog item directory |
.planning/seeds/SEED-NNN-slug.md |
Seed with trigger conditions |
44. Persistent Context Threads
Command: /gsd-thread [name | description]
Purpose: Lightweight cross-session knowledge stores for work that spans multiple sessions but doesn't belong to any specific phase. Lighter weight than /gsd-pause-work — no phase state, no plan context.
Requirements:
- REQ-THREAD-01: System MUST support create, list, and resume modes
- REQ-THREAD-02: Threads MUST be stored in
.planning/threads/as markdown files - REQ-THREAD-03: Thread files MUST include Goal, Context, References, and Next Steps sections
- REQ-THREAD-04: Resuming a thread MUST load its full context into the current session
- REQ-THREAD-05: Threads MUST be promotable to phases or backlog items
Produces: .planning/threads/{slug}.md — Persistent context thread
45. PR Branch Filtering
Command: /gsd-pr-branch [target branch]
Purpose: Create a clean branch suitable for pull requests by filtering out .planning/ commits. Reviewers see only code changes, not GSD planning artifacts.
Requirements:
- REQ-PRBRANCH-01: System MUST identify commits that only modify
.planning/files - REQ-PRBRANCH-02: System MUST create a new branch with planning commits filtered out
- REQ-PRBRANCH-03: Code changes MUST be preserved exactly as committed
46. Security Hardening
Purpose: Defense-in-depth security for GSD's planning artifacts. Because GSD generates markdown files that become LLM system prompts, user-controlled text flowing into these files is a potential indirect prompt injection vector.
Components:
1. Centralized Security Module (security.cjs)
- Path traversal prevention — validates file paths resolve within the project directory
- Prompt injection detection — scans for known injection patterns in user-supplied text
- Safe JSON parsing — catches malformed input before state corruption
- Field name validation — prevents injection through config field names
- Shell argument validation — sanitizes user text before shell interpolation
2. Prompt Injection Guard Hook (gsd-prompt-guard.js)
PreToolUse hook that scans Write/Edit calls targeting .planning/ for injection patterns. Advisory-only — logs detection for awareness without blocking legitimate operations.
3. Workflow Guard Hook (gsd-workflow-guard.js)
PreToolUse hook that detects when Claude attempts file edits outside a GSD workflow context. Advises using /gsd-quick or /gsd-fast instead of direct edits. Configurable via hooks.workflow_guard (default: false).
4. CI-Ready Injection Scanner (prompt-injection-scan.test.cjs)
Test suite that scans all agent, workflow, and command files for embedded injection vectors.
Requirements:
- REQ-SEC-01: All user-supplied file paths MUST be validated against the project directory
- REQ-SEC-02: Prompt injection patterns MUST be detected before text enters planning artifacts
- REQ-SEC-03: Security hooks MUST be advisory-only (never block legitimate operations)
- REQ-SEC-04: JSON parsing of user input MUST catch malformed data gracefully
- REQ-SEC-05: macOS
/var→/private/varsymlink resolution MUST be handled in path validation
47. Multi-Repo Workspace Support
Purpose: Auto-detection and project root resolution for monorepos and multi-repo setups. Supports workspaces where .planning/ may need to resolve across repository boundaries.
Requirements:
- REQ-MULTIREPO-01: System MUST auto-detect multi-repo workspace configuration
- REQ-MULTIREPO-02: System MUST resolve project root across repository boundaries
- REQ-MULTIREPO-03: Executor MUST record per-repo commit hashes in multi-repo mode
48. Discussion Audit Trail
Purpose: Auto-generate DISCUSSION-LOG.md during /gsd-discuss-phase for full audit trail of decisions made during discussion.
Requirements:
- REQ-DISCLOG-01: System MUST auto-generate DISCUSSION-LOG.md during discuss-phase
- REQ-DISCLOG-02: Log MUST capture questions asked, options presented, and decisions made
- REQ-DISCLOG-03: Decision IDs MUST enable traceability from discuss-phase to plan-phase
v1.28 Features
49. Forensics
Command: /gsd-forensics [description]
Purpose: Post-mortem investigation of failed or stuck GSD workflows.
Requirements:
- REQ-FORENSICS-01: System MUST analyze git history for anomalies (stuck loops, long gaps, repeated commits)
- REQ-FORENSICS-02: System MUST check artifact integrity (completed phases have expected files)
- REQ-FORENSICS-03: System MUST generate a markdown report saved to
.planning/forensics/ - REQ-FORENSICS-04: System MUST offer to create a GitHub issue with findings
- REQ-FORENSICS-05: System MUST NOT modify project files (read-only investigation)
Produces:
| Artifact | Description |
|---|---|
.planning/forensics/report-{timestamp}.md |
Post-mortem investigation report |
Process:
- Scan — Analyze git history for anomalies: stuck loops, long gaps between commits, repeated identical commits
- Integrity Check — Verify completed phases have expected artifact files
- Report — Generate markdown report with findings, saved to
.planning/forensics/ - Issue — Offer to create a GitHub issue with findings for team visibility
50. Milestone Summary
Command: /gsd-milestone-summary [version]
Purpose: Generate comprehensive project summary from milestone artifacts for team onboarding.
Requirements:
- REQ-SUMMARY-01: System MUST aggregate phase plans, summaries, and verification results
- REQ-SUMMARY-02: System MUST work for both current and archived milestones
- REQ-SUMMARY-03: System MUST produce a single navigable document
Produces:
| Artifact | Description |
|---|---|
MILESTONE-SUMMARY.md |
Comprehensive navigable summary of milestone artifacts |
Process:
- Collect — Aggregate phase plans, summaries, and verification results from the target milestone
- Synthesize — Combine artifacts into a single navigable document with cross-references
- Output — Write
MILESTONE-SUMMARY.mdsuitable for team onboarding and stakeholder review
51. Workstream Namespacing
Command: /gsd-workstreams
Purpose: Parallel workstreams for concurrent work on different milestone areas.
Requirements:
- REQ-WS-01: System MUST isolate workstream state in separate
.planning/workstreams/{name}/directories - REQ-WS-02: System MUST validate workstream names (alphanumeric + hyphens only, no path traversal)
- REQ-WS-03: System MUST support list, create, switch, status, progress, complete, resume subcommands
Produces:
| Artifact | Description |
|---|---|
.planning/workstreams/{name}/ |
Isolated workstream directory structure |
Process:
- Create — Initialize a named workstream with isolated
.planning/workstreams/{name}/directory - Switch — Change active workstream context for subsequent GSD commands
- Manage — List, check status, track progress, complete, or resume workstreams
52. Manager Dashboard
Command: /gsd-manager
Purpose: Interactive command center for managing multiple phases from one terminal.
Requirements:
- REQ-MGR-01: System MUST show overview of all phases with status
- REQ-MGR-02: System MUST filter to current milestone scope
- REQ-MGR-03: System MUST show phase dependencies and conflicts
Produces: Interactive terminal output
Process:
- Scan — Load all phases in the current milestone with their statuses
- Display — Render overview showing phase dependencies, conflicts, and progress
- Interact — Accept commands to navigate, inspect, or act on individual phases
53. Assumptions Discussion Mode
Command: /gsd-discuss-phase with workflow.discuss_mode: 'assumptions'
Purpose: Replace interview-style questioning with codebase-first assumption analysis.
Requirements:
- REQ-ASSUME-01: System MUST analyze codebase to generate structured assumptions before asking questions
- REQ-ASSUME-02: System MUST classify assumptions by confidence level (Confident/Likely/Unclear)
- REQ-ASSUME-03: System MUST produce identical CONTEXT.md format as default discuss mode
- REQ-ASSUME-04: System MUST support confidence-based skip gate (all HIGH = no questions)
Produces:
| Artifact | Description |
|---|---|
{phase}-CONTEXT.md |
Same format as default discuss mode |
Process:
- Analyze — Scan codebase to generate structured assumptions about implementation approach
- Classify — Categorize assumptions by confidence level: Confident, Likely, Unclear
- Gate — If all assumptions are HIGH confidence, skip questioning entirely
- Confirm — Present unclear assumptions as targeted questions to the user
- Output — Produce
{phase}-CONTEXT.mdin identical format to default discuss mode
54. UI Phase Auto-Detection
Part of: /gsd-new-project and /gsd-progress
Purpose: Automatically detect UI-heavy projects and surface /gsd-ui-phase recommendation.
Requirements:
- REQ-UI-DETECT-01: System MUST detect UI signals in project description (keywords, framework references)
- REQ-UI-DETECT-02: System MUST annotate ROADMAP.md phases with
ui_hintwhen applicable - REQ-UI-DETECT-03: System MUST suggest
/gsd-ui-phasein next steps for UI-heavy phases - REQ-UI-DETECT-04: System MUST NOT make
/gsd-ui-phasemandatory
Process:
- Detect — Scan project description and tech stack for UI signals (keywords, framework references)
- Annotate — Add
ui_hintmarkers to applicable phases in ROADMAP.md - Surface — Include
/gsd-ui-phaserecommendation in next steps for UI-heavy phases
55. Multi-Runtime Installer Selection
Part of: npx @opengsd/gsd-core
Purpose: Select multiple runtimes in a single interactive install session.
Requirements:
- REQ-MULTI-RT-01: Interactive prompt MUST support multi-select (e.g., Claude Code + Gemini)
- REQ-MULTI-RT-02: CLI flags MUST continue to work for non-interactive installs
Process:
- Detect — Identify available AI CLI runtimes on the system
- Prompt — Present multi-select interface for runtime selection
- Install — Configure GSD for all selected runtimes in a single session
v1.29 Features
56. Windsurf Runtime Support
Part of: npx @opengsd/gsd-core
Purpose: Add Windsurf as a supported AI CLI runtime for GSD installation and execution.
Requirements:
- REQ-WINDSURF-01: Installer MUST detect Windsurf runtime and offer it as a target
- REQ-WINDSURF-02: GSD commands MUST function correctly within Windsurf sessions
Process:
- Detect — Identify Windsurf runtime availability on the system
- Install — Configure GSD skills and hooks for the Windsurf environment
57. Internationalized Documentation
Part of: docs/
Purpose: Provide GSD documentation in Portuguese, Korean, and Japanese.
Requirements:
- REQ-I18N-01: Documentation MUST be available in Portuguese (pt), Korean (ko), and Japanese (ja)
- REQ-I18N-02: Translations MUST stay synchronized with English source documents
Process:
- Translate — Convert core documentation into target languages
- Publish — Make translated documentation accessible alongside English originals
v1.31 Features
59. Schema Drift Detection
Command: Automatic during /gsd-execute-phase
Purpose: Detect when ORM schema files are modified without corresponding migration or push commands, preventing false-positive verification.
Requirements:
- REQ-SCHEMA-01: System MUST detect modifications to ORM schema files (Prisma, Drizzle, Payload, Sanity, Mongoose)
- REQ-SCHEMA-02: System MUST verify corresponding migration/push commands exist when schema changes are detected
- REQ-SCHEMA-03: System MUST implement two-layer defense: plan-time injection and execute-time gate
- REQ-SCHEMA-04: System MUST support
GSD_SKIP_SCHEMA_CHECKenv var to override detection - REQ-SCHEMA-05: System MUST prevent false-positive verification when schema is modified without migration
Process:
- Detect — Monitor ORM schema file modifications during plan execution
- Verify — Check that corresponding migration/push commands are present in the plan
- Gate — Block execution if schema drift is detected without migration (execute-time gate)
- Inject — Add migration reminders during plan generation (plan-time injection)
Config: GSD_SKIP_SCHEMA_CHECK environment variable to bypass detection.
60. Security Enforcement
Command: /gsd-secure-phase <N>
Purpose: Threat-model-anchored security verification for phase implementations.
Requirements:
- REQ-SEC-01: System MUST perform threat-model-anchored verification (not blind scanning)
- REQ-SEC-02: System MUST support configurable OWASP ASVS verification levels (1-3)
- REQ-SEC-03: System MUST block phase advancement based on configurable severity threshold
- REQ-SEC-04: System MUST spawn
gsd-security-auditoragent for analysis
Produces:
| Artifact | Description |
|---|---|
| Security audit report | Threat-model-anchored findings with severity classification |
Process:
- Model — Build threat model from phase implementation context
- Audit — Spawn
gsd-security-auditorto verify against threat model - Gate — Block phase advancement if findings meet or exceed
security_block_onseverity
Config:
| Setting | Type | Default | Description |
|---|---|---|---|
security_enforcement |
boolean | true |
Enable threat-model security verification |
security_asvs_level |
number (1-3) | 1 |
OWASP ASVS verification level |
security_block_on |
string | "high" |
Minimum severity to block phase advancement |
61. Documentation Generation
Command: /gsd-docs-update
Purpose: Generate and verify project documentation with accuracy checks.
Requirements:
- REQ-DOCS-01: System MUST spawn
gsd-doc-writeragent to generate documentation - REQ-DOCS-02: System MUST spawn
gsd-doc-verifieragent to check accuracy - REQ-DOCS-03: System MUST verify generated documentation against actual implementation
Produces:
| Artifact | Description |
|---|---|
| Updated project documentation | Generated and verified documentation files |
Process:
- Generate — Spawn
gsd-doc-writerto create or update documentation from implementation - Verify — Spawn
gsd-doc-verifierto check documentation accuracy against codebase - Output — Produce verified documentation with accuracy annotations
62. Discuss Chain Mode
Flag: /gsd-discuss-phase <N> --chain
Purpose: Auto-chain discuss, plan, and execute phases in one flow to reduce manual command sequencing.
Requirements:
- REQ-CHAIN-01: System MUST auto-chain discuss → plan → execute when
--chainflag is provided - REQ-CHAIN-02: System MUST respect all gate settings between chained phases
- REQ-CHAIN-03: System MUST halt the chain if any phase fails
Process:
- Discuss — Run discuss-phase to gather context
- Plan — Automatically invoke plan-phase with gathered context
- Execute — Automatically invoke execute-phase with generated plan
63. Single-Phase Autonomous
Flag: /gsd-autonomous --only N
Purpose: Execute just one phase autonomously instead of all remaining phases.
Requirements:
- REQ-ONLY-01: System MUST execute only the specified phase number when
--only Nis provided - REQ-ONLY-02: System MUST follow the same discuss → plan → execute flow as full autonomous mode
- REQ-ONLY-03: System MUST stop after the specified phase completes
Process:
- Select — Identify the target phase from
--only Nargument - Execute — Run full autonomous flow (discuss → plan → execute) for that single phase
- Stop — Halt after the phase completes instead of advancing to the next
64. Scope Reduction Detection
Part of: /gsd-plan-phase
Purpose: Prevent silent requirement dropping during plan generation with three-layer defense.
Requirements:
- REQ-SCOPE-01: System MUST prohibit planners from reducing scope without explicit justification
- REQ-SCOPE-02: System MUST have plan-checker verify requirement dimension coverage
- REQ-SCOPE-03: System MUST have orchestrator recover dropped requirements and re-inject them
- REQ-SCOPE-04: System MUST implement three-layer defense: planner prohibition, checker dimension, orchestrator recovery
Process:
- Prohibit — Planner instructions explicitly forbid scope reduction
- Check — Plan-checker verifies all phase requirements are covered in the plan
- Recover — Orchestrator detects dropped requirements and re-injects them into the planning loop
65. Claim Provenance Tagging
Part of: /gsd-plan-phase --research-phase <N>
Purpose: Ensure research claims are tagged with source evidence and assumptions are logged separately.
Requirements:
- REQ-PROVENANCE-01: Researcher MUST mark claims with source evidence references
- REQ-PROVENANCE-02: Assumptions MUST be logged separately from sourced claims
- REQ-PROVENANCE-03: System MUST distinguish between evidenced facts and inferred assumptions
Process:
- Research — Researcher gathers information from codebase and domain sources
- Tag — Each claim is annotated with its source (file path, documentation, API response)
- Separate — Assumptions without direct evidence are logged in a distinct section
66. Worktree Toggle
Config: workflow.use_worktrees: false
Purpose: Disable git worktree isolation for users who prefer sequential execution.
Requirements:
- REQ-WORKTREE-01: System MUST respect
workflow.use_worktreessetting when deciding isolation strategy - REQ-WORKTREE-02: System MUST default to
true(worktrees enabled) for backward compatibility - REQ-WORKTREE-03: System MUST fall back to sequential execution when worktrees are disabled
Config:
| Setting | Type | Default | Description |
|---|---|---|---|
workflow.use_worktrees |
boolean | true |
When false, disables git worktree isolation |
67. Project Code Prefixing
Config: project_code: "ABC"
Purpose: Prefix phase directory names with a project code for multi-project disambiguation.
Requirements:
- REQ-PREFIX-01: System MUST prefix phase directories with project code when configured (e.g.,
ABC-01-setup/) - REQ-PREFIX-02: System MUST use standard naming when
project_codeis not set - REQ-PREFIX-03: System MUST apply prefix consistently across all phase operations
Config:
| Setting | Type | Default | Description |
|---|---|---|---|
project_code |
string | (none) | Prefix for phase directory names |
68. Claude Code Skills Migration
Part of: npx @opengsd/gsd-core
Purpose: Migrate GSD commands to Claude Code 2.1.88+ skills format with backward compatibility.
Requirements:
- REQ-SKILLS-01: Installer MUST write
skills/gsd-*/SKILL.mdfor Claude Code 2.1.88+ - REQ-SKILLS-02: Installer MUST auto-clean legacy
commands/gsd/directory - REQ-SKILLS-03: Installer MUST maintain backward compatibility with older Claude Code versions via Gemini path
Process:
- Detect — Check Claude Code version to determine skills support
- Migrate — Write
skills/gsd-*/SKILL.mdfiles for each GSD command - Clean — Remove legacy
commands/gsd/directory if skills are installed - Fallback — Maintain Gemini path compatibility for older Claude Code versions
v1.32 Features
69. STATE.md Consistency Gates
Commands: state validate, state sync [--verify], state planned-phase --phase N --plans N
Purpose: Detect and repair drift between STATE.md and the actual filesystem, preventing cascading errors from stale state.
Requirements:
- REQ-STATE-01:
state validateMUST detect drift between STATE.md fields and filesystem reality - REQ-STATE-02:
state syncMUST reconstruct STATE.md from actual project state on disk - REQ-STATE-03:
state sync --verifyMUST perform a dry-run showing proposed changes without writing - REQ-STATE-04:
state planned-phaseMUST record the state transition after plan-phase completes (Planned/Ready to execute)
Produces:
| Artifact | Description |
|---|---|
Updated STATE.md |
Corrected state reflecting filesystem reality |
Process:
- Validate — Compare STATE.md fields against filesystem (phase directories, plan files, summaries)
- Sync — Reconstruct STATE.md from disk when drift is detected
- Transition — Record post-planning state with plan count for execute-phase readiness
70. Autonomous --to N Flag
Flag: /gsd-autonomous --to N
Purpose: Stop autonomous execution after completing a specific phase, allowing partial autonomous runs.
Requirements:
- REQ-TO-01: System MUST stop execution after the specified phase number completes
- REQ-TO-02: System MUST follow the same discuss -> plan -> execute flow for each phase up to N
- REQ-TO-03:
--to NMUST be combinable with--from Nfor bounded autonomous ranges
Process:
- Bound — Set the upper phase limit from
--to Nargument - Execute — Run autonomous flow for each phase up to and including phase N
- Stop — Halt after phase N completes
71. Research Gate
Part of: /gsd-plan-phase
Purpose: Block planning when RESEARCH.md has unresolved open questions, preventing plans built on incomplete information.
Requirements:
- REQ-RESGATE-01: System MUST scan RESEARCH.md for unresolved open questions before planning begins
- REQ-RESGATE-02: System MUST block plan-phase entry when open questions exist
- REQ-RESGATE-03: System MUST surface the specific unresolved questions to the user
Process:
- Scan — Check RESEARCH.md for open questions section with unresolved items
- Gate — Block planning if unresolved questions are found
- Surface — Display the specific open questions requiring resolution
72. Verifier Milestone Scope Filtering
Part of: /gsd-execute-phase (verifier step)
Purpose: Distinguish between genuine gaps and items deferred to later phases, reducing false negatives in verification.
Requirements:
- REQ-VSCOPE-01: Verifier MUST check whether a gap is addressed in a later milestone phase
- REQ-VSCOPE-02: Gaps addressed in later phases MUST be marked as "deferred", not "gap"
- REQ-VSCOPE-03: Only genuine gaps (not covered by any future phase) MUST be reported as failures
Process:
- Verify — Run standard goal-backward verification
- Filter — Cross-reference detected gaps against later milestone phases
- Classify — Mark deferred items separately from genuine gaps
73. Read-Before-Edit Guard Hook
Part of: Hooks (PreToolUse)
Purpose: Prevent infinite retry loops in non-Claude runtimes by ensuring files are read before editing.
Requirements:
- REQ-RBE-01: Hook MUST detect Edit/Write tool calls that target files not previously read in the session
- REQ-RBE-02: Hook MUST advise reading the file first (advisory, non-blocking)
- REQ-RBE-03: Hook MUST prevent infinite retry loops common in runtimes without built-in read-before-edit enforcement
74. Context Reduction
Part of: prompt assembly pipeline
Purpose: Reduce context prompt sizes through markdown truncation and cache-friendly prompt ordering.
Requirements:
- REQ-CTXRED-01: System MUST truncate oversized markdown artifacts to fit within context budgets
- REQ-CTXRED-02: System MUST order prompts for cache-friendly assembly (stable prefixes first)
- REQ-CTXRED-03: Reduction MUST preserve essential information (headings, requirements, task structure)
- REQ-CTXRED-04: Skill
description:fields MUST be ≤ 100 chars; enforced bynpm run lint:descriptions(seescripts/lint-descriptions.cjsandtests/enh-2789-description-budget.test.cjs)
Process:
- Measure — Calculate total prompt size for the workflow
- Truncate — Apply markdown-aware truncation to oversized artifacts
- Order — Arrange prompt sections for optimal KV-cache reuse
75. Discuss-Phase --power Flag
Flag: /gsd-discuss-phase --power
Purpose: File-based bulk question answering for discuss-phase, enabling batch input from a prepared answers file.
Requirements:
- REQ-POWER-01: System MUST accept a file containing pre-written answers to discussion questions
- REQ-POWER-02: System MUST map answers to the corresponding gray area questions
- REQ-POWER-03: System MUST produce CONTEXT.md identical to interactive discuss-phase
76. Debug --diagnose Flag
Flag: /gsd-debug --diagnose
Purpose: Diagnosis-only mode that investigates without attempting fixes.
Requirements:
- REQ-DIAG-01: System MUST perform full debug investigation (hypotheses, evidence, root cause)
- REQ-DIAG-02: System MUST NOT attempt any code modifications
- REQ-DIAG-03: System MUST produce a diagnostic report with findings and recommended fixes
77. Phase Dependency Analysis
Command: /gsd-manager --analyze-deps
Purpose: Detect phase dependencies and suggest Depends on entries for ROADMAP.md before running /gsd-manager.
Requirements:
- REQ-DEP-01: System MUST detect file overlap between phases
- REQ-DEP-02: System MUST detect semantic dependencies (API/schema producers and consumers)
- REQ-DEP-03: System MUST detect data flow dependencies (output producers and readers)
- REQ-DEP-04: System MUST suggest dependency entries with user confirmation before writing
Produces: Dependency suggestion table; optionally updates ROADMAP.md Depends on fields
78. Anti-Pattern Severity Levels
Part of: /gsd-resume-work
Purpose: Mandatory understanding checks at resume with severity-based anti-pattern enforcement.
Requirements:
- REQ-ANTI-01: System MUST classify anti-patterns by severity level
- REQ-ANTI-02: System MUST enforce mandatory understanding checks at session resume
- REQ-ANTI-03: Higher severity anti-patterns MUST block workflow progression until acknowledged
79. Methodology Artifact Type
Part of: Planning artifacts
Purpose: Define consumption mechanisms for methodology documents, ensuring they are consumed correctly by agents.
Requirements:
- REQ-METHOD-01: System MUST support methodology as a distinct artifact type
- REQ-METHOD-02: Methodology artifacts MUST have defined consumption mechanisms for agents
80. Planner Reachability Check
Part of: /gsd-plan-phase
Purpose: Validate that plan steps are achievable before committing to execution.
Requirements:
- REQ-REACH-01: Planner MUST validate that each plan step references reachable files and APIs
- REQ-REACH-02: Unreachable steps MUST be flagged during planning, not discovered during execution
81. Playwright-MCP UI Verification
Part of: /gsd-verify-work (optional)
Purpose: Automated visual verification using Playwright-MCP during verify-phase.
Requirements:
- REQ-PLAY-01: System MUST support optional Playwright-MCP visual verification during verify-phase
- REQ-PLAY-02: Visual verification MUST be opt-in, not mandatory
- REQ-PLAY-03: System MUST capture and compare visual state against UI-SPEC.md expectations
82. Pause-Work Expansion
Part of: /gsd-pause-work
Purpose: Support non-phase contexts with richer handoff data for broader pause-work applicability.
Requirements:
- REQ-PAUSE-01: System MUST support pausing in non-phase contexts (quick tasks, debug sessions, threads)
- REQ-PAUSE-02: Handoff data MUST include richer context appropriate to the current work type
83. Response Language Config
Config: response_language
Purpose: Cross-phase language consistency for non-English users.
Requirements:
- REQ-LANG-01: System MUST respect
response_languagesetting across all phases and agents - REQ-LANG-02: Setting MUST propagate to all spawned agents for consistent language output
Config:
| Setting | Type | Default | Description |
|---|---|---|---|
response_language |
string | (none) | Language code for agent responses (e.g., "pt", "ko", "ja") |
84. Manual Update Procedure
Part of: docs/manual-update.md
Purpose: Document a manual update path for environments where npx is unavailable or npm publish is experiencing outages.
Requirements:
- REQ-MANUAL-01: Documentation MUST describe step-by-step manual update procedure
- REQ-MANUAL-02: Procedure MUST work without npm access
85. New Runtime Support (Trae, Cline, Augment Code)
Part of: npx @opengsd/gsd-core
Purpose: Extend GSD installation to Trae IDE, Cline, and Augment Code runtimes.
Requirements:
- REQ-TRAE-01: Installer MUST support
--traeflag for Trae IDE installation - REQ-CLINE-01: Installer MUST support Cline via
.clinerulesconfiguration - REQ-AUGMENT-01: Installer MUST support Augment Code with skill conversion and config management
86. Autonomous --interactive Flag
Flag: /gsd-autonomous --interactive
Purpose: Lean-context autonomous mode that keeps discuss-phase interactive (user answers questions) while dispatching plan and execute as background agents.
Requirements:
- REQ-INTERACT-01:
--interactiveMUST run discuss-phase inline with interactive questions (not auto-answered) - REQ-INTERACT-02:
--interactiveMUST dispatch plan-phase and execute-phase as background agents for context isolation - REQ-INTERACT-03:
--interactiveMUST enable pipeline parallelism — discuss Phase N+1 while Phase N builds - REQ-INTERACT-04: Main context MUST only accumulate discuss conversations (lean context)
Process:
- Discuss inline — Run discuss-phase in the main context with user interaction
- Dispatch — Send plan and execute to background agents with fresh context windows
- Pipeline — While background agents build Phase N, begin discussing Phase N+1
87. Commit-Docs Guard Hook
Hook: gsd-commit-docs.js
Purpose: PreToolUse hook that enforces the commit_docs configuration, preventing .planning/ files from being committed when planning.commit_docs is false.
Requirements:
- REQ-COMMITDOCS-01: Hook MUST intercept git commit commands that stage
.planning/files - REQ-COMMITDOCS-02: Hook MUST block commits containing
.planning/files whencommit_docsisfalse - REQ-COMMITDOCS-03: Hook MUST be advisory — does not block when
commit_docsistrueor absent
88. Community Hooks Opt-In
Hooks: gsd-validate-commit.sh, gsd-session-state.sh, gsd-phase-boundary.sh
Purpose: Optional git and session hooks for GSD projects, gated behind hooks.community: true in config.
Requirements:
- REQ-COMMUNITY-01: All community hooks MUST be no-ops unless
hooks.communityistruein.planning/config.json - REQ-COMMUNITY-02:
gsd-validate-commit.shMUST enforce Conventional Commits format on git commit messages - REQ-COMMUNITY-03:
gsd-session-state.shMUST track session state transitions - REQ-COMMUNITY-04:
gsd-phase-boundary.shMUST enforce phase boundary checks
Config:
| Setting | Type | Default | Description |
|---|---|---|---|
hooks.community |
boolean | false |
Enable optional community hooks for commit validation, session state, and phase boundaries |
v1.34.0 Features
- Global Learnings Store
- Queryable Codebase Intelligence
- Execution Context Profiles
- Gates Taxonomy
- Code Review Pipeline
- Socratic Exploration
- Safe Undo
- Plan Import
- Rapid Codebase Scan
- Autonomous Audit-to-Fix
- Improved Prompt Injection Scanner
- Stall Detection in Plan-Phase
- Hard Stop Safety Gates in /gsd-progress --next
- Adaptive Model Preset
- Post-Merge Hunk Verification
89. Global Learnings Store
Commands: Auto-triggered at phase completion; consumed by planner
Config: features.global_learnings
Purpose: Persist cross-session, cross-project learnings in a global store so the planner agent can learn from patterns across the entire project history — not just the current session.
Requirements:
- REQ-LEARN-01: Learnings MUST be auto-copied from
.planning/to the global store at phase completion - REQ-LEARN-02: The planner agent MUST receive relevant learnings at spawn time via injection
- REQ-LEARN-03: Injection MUST be capped by
learnings.max_injectto avoid context bloat - REQ-LEARN-04: Feature MUST be opt-in via
features.global_learnings: true
Config:
| Setting | Type | Default | Description |
|---|---|---|---|
features.global_learnings |
boolean | false |
Enable cross-project learnings pipeline |
learnings.max_inject |
number | (system default) | Maximum learnings entries injected into planner |
90. Queryable Codebase Intelligence
Command: /gsd-map-codebase --query [<term>|status|diff|refresh]
Config: intel.enabled
Purpose: Maintain a queryable JSON index of codebase structure, API surface, dependency graph, file roles, and architecture decisions in .planning/intel/. Enables targeted lookups without reading the entire codebase.
Requirements:
- REQ-INTEL-01: Intel files MUST be stored as JSON in
.planning/intel/ - REQ-INTEL-02:
querymode MUST search across all intel files for a term and group results by file - REQ-INTEL-03:
statusmode MUST report freshness (FRESH/STALE, stale threshold: 24 hours) - REQ-INTEL-04:
diffmode MUST compare current intel state to the last snapshot - REQ-INTEL-05:
refreshmode MUST spawn the intel-updater agent to rebuild all files - REQ-INTEL-06: Feature MUST be opt-in via
intel.enabled: true
Intel files produced:
| File | Contents |
|---|---|
stack.json |
Technology stack and dependencies |
api-map.json |
Exported functions and API surface |
dependency-graph.json |
Inter-module dependency relationships |
file-roles.json |
Role classification for each source file |
arch-decisions.json |
Detected architecture decisions |
91. Execution Context Profiles
Config: context_profile
Purpose: Select a pre-configured execution context (mode, model, workflow settings) tuned for a specific type of work without manually adjusting individual settings.
Requirements:
- REQ-CTX-01:
devprofile MUST optimize for iterative development (balanced model, plan_check enabled) - REQ-CTX-02:
researchprofile MUST optimize for research-heavy work (higher model tier, research enabled) - REQ-CTX-03:
reviewprofile MUST optimize for code review work (verifier and code_review enabled)
Available profiles: dev, research, review
Config:
| Setting | Type | Default | Description |
|---|---|---|---|
context_profile |
string | (none) | Execution context preset: dev, research, or review |
92. Gates Taxonomy
References: gsd-core/references/gates.md
Agents: plan-checker, verifier
Purpose: Define 4 canonical gate types that structure all workflow decision points, enabling plan-checker and verifier agents to apply consistent gate logic.
Gate types:
| Type | Description |
|---|---|
| Confirm | User approves before proceeding (e.g., roadmap review) |
| Quality | Automated quality check must pass (e.g., plan verification loop) |
| Safety | Hard stop on detected risk or policy violation |
| Transition | Phase or milestone boundary acknowledgment |
Requirements:
- REQ-GATES-01: plan-checker MUST classify each checkpoint as one of the 4 gate types
- REQ-GATES-02: verifier MUST apply gate logic appropriate to the gate type
- REQ-GATES-03: Hard stop safety gates MUST never be bypassed by
--autoflags
93. Code Review Pipeline
Commands: /gsd-code-review, /gsd-code-review --fix
Purpose: Structured review of source files changed during a phase, with a separate auto-fix pass that commits each fix atomically.
Requirements:
- REQ-REVIEW-01:
gsd-code-reviewMUST scope files to the phase using SUMMARY.md and git diff fallback - REQ-REVIEW-02: Review MUST support three depth levels:
quick,standard,deep - REQ-REVIEW-03: Findings MUST be severity-classified: Critical, Warning, Info
- REQ-REVIEW-04:
gsd-code-review --fixMUST read REVIEW.md and fix Critical + Warning findings by default - REQ-REVIEW-05: Each fix MUST be committed atomically with a descriptive message
- REQ-REVIEW-06:
--autoflag MUST enable fix + re-review iteration loop, capped at 3 iterations - REQ-REVIEW-07: Feature MUST be gated by
workflow.code_reviewconfig flag
Config:
| Setting | Type | Default | Description |
|---|---|---|---|
workflow.code_review |
boolean | true |
Enable code review commands |
workflow.code_review_depth |
string | standard |
Default review depth: quick, standard, or deep |
94. Socratic Exploration
Command: /gsd-explore [topic]
Purpose: Guide a developer through exploring an idea via Socratic probing questions before committing to a plan. Routes outputs to the appropriate GSD artifact: notes, todos, seeds, research questions, requirements updates, or a new phase.
Requirements:
- REQ-EXPLORE-01: Exploration MUST use Socratic probing — ask questions before proposing solutions
- REQ-EXPLORE-02: Session MUST offer to route outputs to the appropriate GSD artifact
- REQ-EXPLORE-03: An optional topic argument MUST prime the first question
- REQ-EXPLORE-04: Exploration MUST optionally spawn a research agent for technical feasibility
95. Safe Undo
Command: /gsd-undo --last N | --phase NN | --plan NN-MM
Purpose: Roll back GSD phase or plan commits safely using the phase manifest and git log, with dependency checks and a hard confirmation gate before any revert is applied.
Requirements:
- REQ-UNDO-01:
--phasemode MUST identify all commits for the phase via manifest and git log fallback - REQ-UNDO-02:
--planmode MUST identify all commits for a specific plan - REQ-UNDO-03:
--last Nmode MUST display recent GSD commits for interactive selection - REQ-UNDO-04: System MUST check for dependent phases/plans before reverting
- REQ-UNDO-05: A confirmation gate MUST be shown before any git revert is executed
96. Plan Import
Command: /gsd-import --from <filepath>
Purpose: Ingest an external plan file into the GSD planning system with conflict detection against PROJECT.md decisions, converting it to a valid GSD PLAN.md and validating it through the plan-checker.
Requirements:
- REQ-IMPORT-01: Importer MUST detect conflicts between the external plan and existing PROJECT.md decisions
- REQ-IMPORT-02: All detected conflicts MUST be presented to the user for resolution before writing
- REQ-IMPORT-03: Imported plan MUST be written as a valid GSD PLAN.md format
- REQ-IMPORT-04: Written plan MUST pass
gsd-plan-checkervalidation
97. Rapid Codebase Scan
Command: /gsd-map-codebase --fast [--focus tech|arch|quality|concerns]
Purpose: Lightweight alternative to /gsd-map-codebase that spawns a single mapper agent for one or two combined focus areas, producing targeted output in .planning/codebase/ without the overhead of 4 parallel agents.
Requirements:
- REQ-SCAN-01: Scan MUST spawn exactly one mapper agent (not four parallel agents)
- REQ-SCAN-02: Focus area MUST be one of:
tech,arch,quality,concerns, or the combinedtech+archshorthand (default:tech+arch); combined focus runs as a single agent covering both areas in one pass - REQ-SCAN-03: Output MUST be written to
.planning/codebase/in the same format as/gsd-map-codebase
98. Autonomous Audit-to-Fix
Command: /gsd-audit-fix [--source <audit>] [--severity high|medium|all] [--max N] [--dry-run]
Purpose: End-to-end pipeline that runs an audit, classifies findings as auto-fixable vs. manual-only, then autonomously fixes auto-fixable issues with test verification and atomic commits.
Requirements:
- REQ-AUDITFIX-01: Findings MUST be classified as auto-fixable or manual-only before any changes
- REQ-AUDITFIX-02: Each fix MUST be verified with tests before committing
- REQ-AUDITFIX-03: Each fix MUST be committed atomically
- REQ-AUDITFIX-04:
--dry-runMUST show classification table without applying any fixes - REQ-AUDITFIX-05:
--max NMUST limit the number of fixes applied in one run (default: 5)
99. Improved Prompt Injection Scanner
Hook: gsd-prompt-guard.js
Script: scripts/prompt-injection-scan.sh
Purpose: Enhanced detection of prompt injection attempts in planning artifacts, adding invisible Unicode character detection, encoding obfuscation patterns, and entropy-based analysis.
Requirements:
- REQ-SCAN-INJ-01: Scanner MUST detect invisible Unicode characters (zero-width spaces, soft hyphens, etc.)
- REQ-SCAN-INJ-02: Scanner MUST detect encoding obfuscation patterns (base64-encoded instructions, homoglyphs)
- REQ-SCAN-INJ-03: Scanner MUST apply entropy analysis to flag high-entropy strings in unexpected positions
- REQ-SCAN-INJ-04: Scanner MUST remain advisory-only — detection is logged, not blocking
100. Stall Detection in Plan-Phase
Command: /gsd-plan-phase
Purpose: Detect when the planner revision loop has stalled — producing the same output across multiple iterations — and break the cycle by escalating to a different strategy or exiting with a clear diagnostic.
Requirements:
- REQ-STALL-01: Revision loop MUST detect identical plan output across consecutive iterations
- REQ-STALL-02: On stall detection, system MUST escalate strategy before retrying
- REQ-STALL-03: Maximum stall retries MUST be bounded (capped at the existing max 3 iterations)
101. Hard Stop Safety Gates in /gsd-progress --next
Command: /gsd-progress --next
Purpose: Prevent /gsd-progress --next from entering runaway loops by adding hard stop safety gates and a consecutive-call guard that interrupts autonomous chaining when repeated identical steps are detected.
Requirements:
- REQ-NEXT-GATE-01:
/gsd-progress --nextMUST track consecutive same-step calls - REQ-NEXT-GATE-02: On repeated same-step, system MUST present a hard stop gate to the user
- REQ-NEXT-GATE-03: User MUST explicitly confirm to continue past a hard stop gate
102. Adaptive Model Preset
Config: model_profile: "adaptive"
Purpose: Role-based model assignment that automatically selects the appropriate model tier based on the current agent's role, rather than applying a single tier to all agents.
Requirements:
- REQ-ADAPTIVE-01:
adaptivepreset MUST assign model tiers based on agent role (planner → quality tier, executor → balanced tier, etc.) - REQ-ADAPTIVE-02:
adaptiveMUST be selectable via/gsd-config --profile adaptive
103. Post-Merge Hunk Verification
Command: /gsd-update --reapply
Purpose: After applying local patches post-update, verify that all hunks were actually applied by comparing the expected patch content against the live filesystem. Surface any dropped or partial hunks immediately rather than silently accepting incomplete merges.
Requirements:
- REQ-PATCH-VERIFY-01: Reapply-patches MUST verify each hunk was applied after the merge
- REQ-PATCH-VERIFY-02: Dropped or partial hunks MUST be reported to the user with file and line context
- REQ-PATCH-VERIFY-03: Verification MUST run after all patches are applied, not per-patch
v1.35.0 Features
- New Runtime Support (Cline, CodeBuddy, Qwen Code)
- GSD-2 Reverse Migration
- AI Integration Phase Wizard
- AI Eval Review
104. New Runtime Support (Cline, CodeBuddy, Qwen Code)
Part of: npx @opengsd/gsd-core
Purpose: Extend GSD installation to Cline, CodeBuddy, and Qwen Code runtimes.
Requirements:
- REQ-CLINE-02: Cline install MUST write
.clinerulesto~/.cline/(global) or./.cline/(local). No custom slash commands — rules-based integration only. Flag:--cline. - REQ-CODEBUDDY-01: CodeBuddy install MUST deploy skills to
~/.codebuddy/skills/gsd-*/SKILL.md(emitteduser-invocable: false),/gsd-*slash commands to~/.codebuddy/commands/gsd-*.md, and subagents to~/.codebuddy/agents/gsd-*.md. The commands surface is the sole/menu entry point. Nomcp.jsonis written (gsd ships no MCP server). Flag:--codebuddy. - REQ-QWEN-01: Qwen Code install MUST deploy skills to
~/.qwen/skills/gsd-*/SKILL.md, following the open standard used by Claude Code 2.1.88+.QWEN_CONFIG_DIRenv var overrides the default path. Flag:--qwen.
Runtime summary:
| Runtime | Install Format | Config Path | Flag |
|---|---|---|---|
| Cline | .clinerules |
~/.cline/ or ./.cline/ |
--cline |
| CodeBuddy | Skills (SKILL.md) |
~/.codebuddy/skills/ |
--codebuddy |
| Qwen Code | Skills (SKILL.md) |
~/.qwen/skills/ |
--qwen |
105. GSD-2 Reverse Migration
Command: /gsd-import --from-gsd2 [--dry-run] [--force] [--path <dir>]
Purpose: Migrate a project from GSD-2 format (.gsd/ directory with Milestone→Slice→Task hierarchy) back to the v1 .planning/ format, restoring full compatibility with all GSD v1 commands.
Requirements:
- REQ-FROM-GSD2-01: Importer MUST read
.gsd/from the specified or current directory - REQ-FROM-GSD2-02: Milestone→Slice hierarchy MUST be flattened to sequential phase numbers (M001/S01→phase 01, M001/S02→phase 02, M002/S01→phase 03, etc.)
- REQ-FROM-GSD2-03: System MUST guard against overwriting an existing
.planning/directory without--force - REQ-FROM-GSD2-04:
--dry-runMUST preview all changes without writing any files - REQ-FROM-GSD2-05: Migration MUST produce
PROJECT.md,REQUIREMENTS.md,ROADMAP.md,STATE.md, and sequential phase directories
Flags:
| Flag | Description |
|---|---|
--dry-run |
Preview migration output without writing files |
--force |
Overwrite an existing .planning/ directory |
--path <dir> |
Specify the GSD-2 root directory |
106. AI Integration Phase Wizard
Command: /gsd-ai-integration-phase [N]
Purpose: Guide developers through selecting, integrating, and planning evaluation for AI/LLM capabilities in a project phase. Produces a structured AI-SPEC.md that feeds into planning and verification.
Requirements:
- REQ-AISPEC-01: Wizard MUST present an interactive decision matrix covering framework selection, model choice, and integration approach
- REQ-AISPEC-02: System MUST surface domain-specific failure modes and eval criteria relevant to the project type
- REQ-AISPEC-03: System MUST spawn 3 parallel specialist agents: domain-researcher, framework-selector, and eval-planner
- REQ-AISPEC-04: Output MUST produce
{phase}-AI-SPEC.mdwith framework recommendation, implementation guidance, and evaluation strategy
Produces: {phase}-AI-SPEC.md in the phase directory
107. AI Eval Review
Command: /gsd-eval-review [N]
Purpose: Retroactively audit an executed AI phase's evaluation coverage against the AI-SPEC.md plan. Identifies gaps between planned and implemented evaluation before the phase is closed.
Requirements:
- REQ-EVALREVIEW-01: Review MUST read
AI-SPEC.mdfrom the specified phase - REQ-EVALREVIEW-02: Each eval dimension MUST be scored as COVERED, PARTIAL, or MISSING
- REQ-EVALREVIEW-03: Output MUST include findings, gap descriptions, and remediation guidance
- REQ-EVALREVIEW-04:
EVAL-REVIEW.mdMUST be written to the phase directory
Produces: {phase}-EVAL-REVIEW.md with scored eval dimensions, gap analysis, and remediation steps
v1.36.0 Features
108. Plan Bounce
Command: /gsd-plan-phase N --bounce
Purpose: After plans pass the checker, optionally refine them through an external script (a second AI, a linter, a custom validator). The bounce step backs up each plan, runs the script, validates YAML frontmatter integrity on the result, re-runs the plan checker, and restores the original if anything fails.
Requirements:
- REQ-BOUNCE-01:
--bounceflag orworkflow.plan_bounce: trueactivates the step;--skip-bouncealways disables it - REQ-BOUNCE-02:
workflow.plan_bounce_scriptmust point to a valid executable; missing script produces a warning and skips - REQ-BOUNCE-03: Each plan is backed up to
*-PLAN.pre-bounce.mdbefore the script runs - REQ-BOUNCE-04: Bounced plans with broken YAML frontmatter or that fail the plan checker are restored from backup
- REQ-BOUNCE-05:
workflow.plan_bounce_passes(default: 2) controls how many refinement passes the script receives
Configuration: workflow.plan_bounce, workflow.plan_bounce_script, workflow.plan_bounce_passes
109. External Code Review Command
Command: /gsd-ship (enhanced)
Purpose: Before the manual review step in /gsd-ship, automatically run an external code review command if configured. The command receives the diff and phase context via stdin and returns a JSON verdict (APPROVED or REVISE). Falls through to the existing manual review flow regardless of outcome.
Requirements:
- REQ-EXTREVIEW-01:
workflow.code_review_commandmust be set to a command string; null means skip - REQ-EXTREVIEW-02: Diff is generated against
BASE_BRANCHwith--statsummary included - REQ-EXTREVIEW-03: Review prompt is piped via stdin (never shell-interpolated)
- REQ-EXTREVIEW-04: 120-second timeout; stderr captured on failure
- REQ-EXTREVIEW-05: JSON output parsed for
verdict,confidence,summary,issuesfields
Configuration: workflow.code_review_command
110. Cross-AI Execution Delegation
Command: /gsd-execute-phase N --cross-ai
Purpose: Delegate individual plans to an external AI runtime for execution. Plans with cross_ai: true in their frontmatter (or all plans when --cross-ai is used) are sent to the configured command via stdin. Successfully handled plans are removed from the normal executor queue.
Requirements:
- REQ-CROSSAI-01:
--cross-aiforces all plans through cross-AI;--no-cross-aidisables it - REQ-CROSSAI-02:
workflow.cross_ai_execution: trueand plan frontmattercross_ai: truerequired for per-plan activation - REQ-CROSSAI-03: Task prompt is piped via stdin to prevent injection
- REQ-CROSSAI-04: Dirty working tree produces a warning before execution
- REQ-CROSSAI-05: On failure, user chooses: retry, skip (fall back to normal executor), or abort
Configuration: workflow.cross_ai_execution, workflow.cross_ai_command, workflow.cross_ai_timeout
111. Architectural Responsibility Mapping
Command: /gsd-plan-phase (enhanced research step)
Purpose: During phase research, the phase-researcher now maps each capability to its architectural tier owner (browser, frontend server, API, CDN/static, database). The planner cross-references tasks against this map, and the plan-checker enforces tier compliance as Dimension 7c.
Requirements:
- REQ-ARM-01: Phase researcher produces an Architectural Responsibility Map table in RESEARCH.md (Step 1.5)
- REQ-ARM-02: Planner sanity-checks task-to-tier assignments against the map
- REQ-ARM-03: Plan checker validates tier compliance as Dimension 7c (WARNING for general mismatches, BLOCKER for security-sensitive ones)
Produces: ## Architectural Responsibility Map section in {phase}-RESEARCH.md
112. Extract Learnings
Command: /gsd-extract-learnings N
Purpose: Extract structured knowledge from completed phase artifacts. Reads PLAN.md and SUMMARY.md (required) plus VERIFICATION.md, UAT.md, and STATE.md (optional) to produce four categories of learnings: decisions, lessons, patterns, and surprises. Optionally captures each item to an external knowledge base via capture_thought tool.
Requirements:
- REQ-LEARN-01: Requires PLAN.md and SUMMARY.md; exits with clear error if missing
- REQ-LEARN-02: Each extracted item includes source attribution (artifact and section)
- REQ-LEARN-03: If
capture_thoughttool is available, captures items withsource,project, andphasemetadata - REQ-LEARN-04: If
capture_thoughtis unavailable, completes successfully and logs that external capture was skipped - REQ-LEARN-05: Running twice overwrites the previous
LEARNINGS.md
Produces: {phase}-LEARNINGS.md with YAML frontmatter (phase, project, counts per category, missing_artifacts)
Optional integration — capture_thought: capture_thought is a convention, not a bundled tool. GSD does not ship one and does not require one. The workflow checks whether any MCP server in the current session exposes a tool named capture_thought and, if so, calls it once per extracted learning with the signature below. If no such tool is present, the step is skipped silently and LEARNINGS.md remains the primary output.
Expected tool signature:
capture_thought({
category: "decision" | "lesson" | "pattern" | "surprise",
phase: <phase_number>,
content: <learning_text>,
source: <artifact_name>
})
Users who run a memory / knowledge-base MCP server (for example, ExoCortex-style servers, claude-mem, or mem0-style servers) can implement this tool name to have learnings routed into their knowledge base automatically with project, phase, and source metadata. Everyone else can use /gsd-extract-learnings without any extra setup — the LEARNINGS.md artifact is the feature.
114. Context-Window-Aware Prompt Thinning
Purpose: Reduce static prompt overhead by ~40% for models with context windows under 200K tokens. Extended examples and anti-pattern lists are extracted from agent definitions into reference files loaded on demand via @ required_reading.
Requirements:
- REQ-THIN-01: When
CONTEXT_WINDOW < 200000, executor and planner agent prompts omit inline examples - REQ-THIN-02: Extracted content lives in
references/executor-examples.mdandreferences/planner-antipatterns.md - REQ-THIN-03: Standard (200K-500K) and enriched (500K+) tiers are unaffected
- REQ-THIN-04: Core rules and decision logic remain inline; only verbose examples are extracted
Reference files: executor-examples.md, planner-antipatterns.md
115. Configurable CLAUDE.md Path
Purpose: Allow projects to store their CLAUDE.md in a non-root location. The claude_md_path config key controls where /gsd-profile-user and related commands write the generated CLAUDE.md file.
Requirements:
- REQ-CMDPATH-01:
claude_md_pathdefaults to./CLAUDE.md - REQ-CMDPATH-02: Profile generation commands read the path from config and write to the specified location
- REQ-CMDPATH-03: Relative paths are resolved from the project root
Configuration: claude_md_path
116. TDD Pipeline Mode
Purpose: Opt-in TDD (red-green-refactor) as a first-class phase execution mode. When enabled, the planner aggressively selects type: tdd for eligible tasks and the executor enforces RED/GREEN/REFACTOR gate sequence with fail-fast on unexpected GREEN before RED.
Requirements:
- REQ-TDD-01:
workflow.tdd_modeconfig key (boolean, defaultfalse) - REQ-TDD-02: When enabled, planner applies TDD heuristics from
references/tdd.mdto all eligible tasks (business logic, APIs, validations, algorithms, state machines) - REQ-TDD-03: Executor enforces gate sequence for
type: tddplans — RED commit (test(...)) must precede GREEN commit (feat(...)) - REQ-TDD-04: Executor fails fast if tests pass unexpectedly during RED phase (feature already exists or test is wrong)
- REQ-TDD-05: End-of-phase collaborative review checkpoint verifies gate compliance across all TDD plans (advisory, non-blocking)
- REQ-TDD-06: Gate violations surfaced in SUMMARY.md under
## TDD Gate Compliancesection
Configuration: workflow.tdd_mode
Reference files: tdd.md, checkpoints.md
v1.37.0 Features
117. Spike Command
Command: /gsd-spike [idea] [--quick]
Purpose: Run 2–5 focused feasibility experiments before committing to an implementation approach. Each experiment uses Given/When/Then framing, produces executable code, and returns a VALIDATED / INVALIDATED / PARTIAL verdict. Companion /gsd-spike --wrap-up packages findings into a project-local skill.
Requirements:
- REQ-SPIKE-01: Each experiment MUST produce a Given/When/Then hypothesis before any code is written
- REQ-SPIKE-02: Each experiment MUST include working code or a minimal reproduction
- REQ-SPIKE-03: Each experiment MUST return one of: VALIDATED, INVALIDATED, or PARTIAL verdict with evidence
- REQ-SPIKE-04: Results MUST be stored in
.planning/spikes/NNN-experiment-name/with a README and MANIFEST.md - REQ-SPIKE-05:
--quickflag skips intake conversation and uses the argument text as the experiment direction - REQ-SPIKE-06:
/gsd-spike --wrap-upMUST package findings into.claude/skills/spike-findings-[project]/
Produces:
| Artifact | Description |
|---|---|
.planning/spikes/NNN-name/README.md |
Hypothesis, experiment code, verdict, and evidence |
.planning/spikes/MANIFEST.md |
Index of all spikes with verdicts |
.claude/skills/spike-findings-[project]/ |
Packaged findings (via /gsd-spike --wrap-up) |
118. Sketch Command
Command: /gsd-sketch [idea] [--quick] [--text]
Purpose: Explore design directions through throwaway HTML mockups before committing to implementation. Produces 2–3 interactive variants per design question, all viewable directly in a browser with no build step. Companion /gsd-sketch --wrap-up packages winning decisions into a project-local skill.
Requirements:
- REQ-SKETCH-01: Each sketch MUST answer one specific visual design question
- REQ-SKETCH-02: Each sketch MUST include 2–3 meaningfully different variants in a single
index.htmlwith tab navigation - REQ-SKETCH-03: All interactive elements (hover, click, transitions) MUST be functional
- REQ-SKETCH-04: Sketches MUST use real-ish content, not lorem ipsum
- REQ-SKETCH-05: A shared
themes/default.cssMUST provide CSS variables adapted to the agreed aesthetic - REQ-SKETCH-06:
--quickflag skips mood intake;--textflag replacesAskUserQuestionwith numbered lists for non-Claude runtimes - REQ-SKETCH-07: The winning variant MUST be marked in the README frontmatter and with a ★ in the HTML tab
- REQ-SKETCH-08:
/gsd-sketch --wrap-upMUST package winning decisions into.claude/skills/sketch-findings-[project]/
Produces:
| Artifact | Description |
|---|---|
.planning/sketches/NNN-name/index.html |
2–3 interactive HTML variants |
.planning/sketches/NNN-name/README.md |
Design question, variants, winner, what to look for |
.planning/sketches/themes/default.css |
Shared CSS theme variables |
.planning/sketches/MANIFEST.md |
Index of all sketches with winners |
.claude/skills/sketch-findings-[project]/ |
Packaged decisions (via /gsd-sketch --wrap-up) |
119. Agent Size-Budget Enforcement
Purpose: Keep agent prompt files lean with tiered line-count limits enforced in CI. Oversized agents are caught before they bloat context windows in production.
Requirements:
- REQ-BUDGET-01:
agents/gsd-*.mdfiles are classified into three tiers: XL (≤ 1 600 lines), Large (≤ 1 000 lines), Default (≤ 500 lines) - REQ-BUDGET-02: Tier assignment is declared in the file's YAML frontmatter (
size: xl | large | default) - REQ-BUDGET-03:
tests/agent-size-budget.test.cjsenforces limits and fails CI on violation - REQ-BUDGET-04: Files without a
sizefrontmatter key default to the Default (500-line) limit
Test file: tests/agent-size-budget.test.cjs
120. Shared Boilerplate Extraction
Purpose: Reduce duplication across agents by extracting two common boilerplate blocks into shared reference files loaded on demand. Keeps agent files within size budget and makes boilerplate updates a single-file change.
Requirements:
- REQ-BOILER-01: Mandatory-initial-read instructions extracted to
references/mandatory-initial-read.md - REQ-BOILER-02: Project-skills-discovery instructions extracted to
references/project-skills-discovery.md - REQ-BOILER-03: Agents that previously inlined these blocks MUST now reference them via
@required_reading
Reference files: references/mandatory-initial-read.md, references/project-skills-discovery.md
121. Knowledge Graph Integration
Purpose: Build, query, and inspect a lightweight knowledge graph of the project in .planning/graphs/. Opt-in per project. Exposed as the /gsd-graphify user-facing command and the gsd-tools.cjs graphify … programmatic verb family. Complements /gsd-map-codebase --query (snapshot-oriented) with a graph-oriented view of nodes and edges across commands, agents, workflows, and phases.
Requirements:
- REQ-GRAPH-01: Opt-in via
graphify.enabled: truein.planning/config.json. When disabled,/gsd-graphifyprints an activation hint and stops without writing. - REQ-GRAPH-02: Slash-command
/gsd-graphifyexposes subcommandsbuild,query <term>,status,diff. The programmatic CLInode gsd-tools.cjs graphify …additionally exposessnapshot, which is also invoked automatically as the final step ofgraphify build. - REQ-GRAPH-03: Build runs within the configurable
graphify.build_timeout(seconds); exceeding the timeout aborts cleanly without leaving a partial graph. - REQ-GRAPH-04:
graphify.cjsfalls back tograph.linkswhengraph.edgesis absent so older graph artifacts keep rendering. - REQ-GRAPH-05: Graphify is invoked through
gsd-tools.cjs graphify ...command handlers.
Configuration: graphify.enabled, graphify.build_timeout
Reference files: commands/gsd/graphify.md, bin/lib/graphify.cjs
v1.40.0 Features
122. Skill Surface Consolidation
Purpose: Cut the eager skill-listing overhead by folding 31 micro-skills into 4 new grouped parents and 6 existing parents that absorb sub-operations as flags. Zero functional loss — every removed micro-skill's behavior survives via a flag on a consolidated parent. After consolidation, commands/gsd/*.md ships 59 sub-skills (plus 6 namespace meta-skills, see #123).
Requirements:
- REQ-CONSOLIDATE-01: Four new grouped skills replace clusters of micro-skills:
/gsd-capture— folds add-todo (default), note (--note), add-backlog (--backlog), plant-seed (--seed), check-todos (--list)/gsd-phase— folds add-phase (default), insert-phase (--insert), remove-phase (--remove), edit-phase (--edit)/gsd-config— folds settings-advanced (--advanced), settings-integrations (--integrations), set-profile (--profile)/gsd-workspace— folds new-workspace (--new), list-workspaces (--list), remove-workspace (--remove)
- REQ-CONSOLIDATE-02: Six existing parents absorb wrap-up / sub-operations as flags:
/gsd-update --sync,/gsd-update --reapply,/gsd-sketch --wrap-up,/gsd-spike --wrap-up,/gsd-map-codebase --fast,/gsd-map-codebase --query,/gsd-code-review --fix,/gsd-progress --do,/gsd-progress --next. - REQ-CONSOLIDATE-03: Deleted micro-skill slash forms (the bare
gsd-add-todo,gsd-add-backlog,gsd-plant-seed,gsd-check-todos,gsd-add-phase,gsd-insert-phase,gsd-remove-phase,gsd-edit-phase,gsd-new-workspace,gsd-list-workspaces,gsd-remove-workspace,gsd-settings-advanced,gsd-settings-integrations,gsd-set-profile,gsd-sketch-wrap-up,gsd-spike-wrap-up,gsd-reapply-patches,gsd-code-review-fix, …) MUST resolve to "Unknown command" — no shadow stubs. - REQ-CONSOLIDATE-04:
autonomous.mdinvokes/gsd-code-review --fix(was previously calling the deletedgsd-code-review-fix).
Reference issue: #2790
123. Namespace Meta-Skills (Two-Stage Routing)
Purpose: Replace the flat eager skill listing with a two-stage hierarchical routing layer. The model sees 6 namespace routers instead of 86 entries, selects a namespace, then routes to the sub-skill. Descriptions use pipe-separated keyword tags (≤ 60 chars) for routing density.
Commands:
/gsd-workflow— phase pipeline router (discuss / plan / execute / verify / phase / progress)/gsd-project— project lifecycle (milestones, audits, summary)/gsd-quality— quality gates (code review, debug, audit, security, eval, ui)/gsd-context— codebase intelligence (map, graphify, docs, learnings)/gsd-manage— config / workspace / workstreams / thread / update / ship / inbox/gsd-ideate— exploration & capture (explore, sketch, spike, spec, capture)
Token cost:
| Entries | Approx tokens | |
|---|---|---|
| Pre-1.40 full install | 86 | ~2,150 |
| Namespace meta-skills | 6 | ~120 |
Requirements:
- REQ-NS-01: Six
commands/gsd/ns-*.mdnamespace routers ship with pipe-separated keyword-tag descriptions (≤ 60 chars). - REQ-NS-02: Existing sub-skills are unchanged and still invocable directly — namespace skills are additive, not a replacement for direct slash forms.
- REQ-NS-03: The body of each namespace router contains a routing table that maps user intent to the correct concrete sub-skill on the post-#2790 consolidated surface.
Reference issue: #2792
124. Context-Window Utilization Guard
Command: /gsd-health --context
Purpose: Quality guard against context-window saturation. Two thresholds: 60 % utilization warns ("consider /gsd-thread"), 70 % is critical ("reasoning quality may degrade"; matches the fracture-point per recent context-attention research).
Requirements:
- REQ-CTX-GUARD-01:
/gsd-health --contextprints a structured status line with current utilization, threshold tier (ok/warn/critical), and a remediation suggestion. - REQ-CTX-GUARD-02: The same triage is exposed as
gsd-tools.cjs validate context --tokens-used <int> --context-window <int>— a structured envelope for status-line and hook callers (#125). Both flags are required; the handler returns the same{ percent, state }envelope as the pure classifier in REQ-CTX-GUARD-03. - REQ-CTX-GUARD-03: The classifier (
bin/lib/context-utilization.cjs) is pure: input(tokensUsed, contextWindow), output{ percent, state }. Easy to unit-test, easy to reuse from any caller.
Reference issue: #2792
125. Phase-Lifecycle Status-Line Read-Side
Purpose: Surface phase orchestration state on the status-line. parseStateMd() reads four new STATE.md frontmatter fields and formatGsdState() renders in-flight, idle, and progress scenes. Write-side wiring follows in a later RC.
Requirements:
- REQ-LIFECYCLE-01:
parseStateMd()reads four optional fields:active_phase— phase number when an orchestrator is in flightnext_action— recommended next command when idlenext_phases— YAML flow array of next phase numbersprogress— nestedtotal_phases/completed_phases/percentblock
- REQ-LIFECYCLE-02:
formatGsdState()checks the lifecycle fields in priority order and emits the first matching scene (Phase active → Idle next-recommended → Milestone complete → Default fallback). - REQ-LIFECYCLE-03: All four fields default to undefined; existing STATE.md files render byte-for-byte identically.
Reference issue: #2833 — see docs/STATE-MD-LIFECYCLE.md for the full field reference and rendering rules.
v1.41.0 Features
126. Per-Phase-Type Model Selection
Purpose: Express model tuning at the phase level (planning, research, execution, verification) without learning the full agent taxonomy. Sits between per-agent model_overrides (precise, verbose) and the global model_profile tier (coarse, uniform).
Config key: models in .planning/config.json
Phase-type slots:
| Slot | Agents assigned |
|---|---|
planning |
gsd-planner, gsd-roadmapper, gsd-pattern-mapper |
discuss |
(reserved for future subagent) |
research |
gsd-phase-researcher, gsd-project-researcher, gsd-research-synthesizer, gsd-codebase-mapper, gsd-ui-researcher |
execution |
gsd-executor, gsd-debugger, gsd-doc-writer |
verification |
gsd-verifier, gsd-plan-checker, gsd-integration-checker, gsd-nyquist-auditor, gsd-ui-checker, gsd-ui-auditor, gsd-doc-verifier |
completion |
(reserved for future subagent) |
Accepted values: "opus" / "sonnet" / "haiku" / "inherit"
Resolution precedence (highest → lowest):
1. model_overrides[<agent>]
2. dynamic_routing.tier_models[<tier>] (when enabled)
3. models[<phase_type>] (this feature)
4. model_profile
5. Runtime default
Requirements:
- REQ-PHASE-MODELS-01: Six named
models.*slots accepted byconfig-schema.cjsandconfig-schema.ts;config-setrejects unknown phase-types. - REQ-PHASE-MODELS-02: Configs without a
modelsblock behave byte-for-byte identically to pre-v1.41 behavior. - REQ-PHASE-MODELS-03:
discussandcompletionare accepted by the schema for forward compatibility; setting them today is a no-op until a subagent maps to each.
Reference issue: #3023
127. Dynamic Routing with Failure-Tier Escalation
Purpose: Pay for the cheap tier by default; escalate to a more capable model automatically when the orchestrator detects a soft failure (verification inconclusive, plan-check FLAG, etc.).
Config key: dynamic_routing in .planning/config.json
Behavior:
enabled: false(default) — feature is off; all agents use the precedence chain unchanged.enabled: true— the resolver pickstier_models[default_tier]for the first spawn and escalates one tier up on orchestrator-detected soft failure, capped bymax_escalations.
Composition: model_overrides always wins; dynamic_routing.tier_models[<tier>] resolves above models.<phase_type> and model_profile.
Requirements:
- REQ-DYNROUTE-01:
dynamic_routing.enabledacts as a master switch; whenfalseor block is absent, zero behavior change. - REQ-DYNROUTE-02: New resolver
resolveModelForTier(cwd, agent, attempt)incore.cjsis the single call-site for orchestrator integration. - REQ-DYNROUTE-03:
max_escalationscaps the escalation chain to prevent runaway cost.
Reference issue: #3024
128. Update Banner Opt-In
Purpose: Surface update availability to users who have declined or bypassed the GSD statusline, without requiring the statusline.
Behavior:
- At install time, if the installer detects no GSD statusline, it offers an opt-in
SessionStarthook. - The hook reads the existing
~/.cache/gsd/gsd-update-check.jsoncache — the same cache used by the statusline — and prints a banner only when an update is available. - Silent when up-to-date.
- Failure diagnostics rate-limited to once per 24 h.
- Cleanly removed by
npx @opengsd/gsd-core --uninstall.
Requirements:
- REQ-BANNER-01: Banner does not install without explicit opt-in.
- REQ-BANNER-02: No additional network requests — reuses the existing background update-check cache.
- REQ-BANNER-03: Uninstall path removes the banner hook.
Reference issue: #2795
129. Issue-Driven Orchestration Guide
Purpose: Document a recipe for driving the full GSD workflow from a GitHub / Linear / Jira issue, mapping tracker-centric concepts onto existing GSD primitives.
Document: docs/issue-driven-orchestration.md
Covered workflow:
- Create an isolated workspace per issue (
/gsd-workspace --new) - Run the manager dashboard to get oriented (
/gsd-manager) - Execute autonomously (
/gsd-autonomous) - Verify and review (
/gsd-verify-work,/gsd-review) - Ship and close the issue (
/gsd-ship)
No new commands or daemon process — purely a documentation artifact that maps existing primitives onto a tracker-driven workflow.
Reference issue: #2840
130. Graphify Commit-Based Staleness
Purpose: Surface whether the architecture graph was built from the current commit or an older one, complementing the existing mtime-based stale signal.
Command: /gsd-graphify status
New fields returned (graphify v0.7+ graphs):
| Field | Type | Description |
|---|---|---|
built_at_commit |
string | Commit SHA the graph was built from |
current_commit |
string | Current git HEAD |
commits_behind |
number | How many commits behind HEAD the graph is |
commit_stale |
boolean | null | true=stale, false=current, null=unavailable (pre-v0.7, non-git) |
Rendered output (when signal is available):
Source commit: abc1234 (3 commits behind HEAD)
Security: built_at_commit validated as 4–40 hex chars before reaching git — a hostile graph.json cannot inject dashed options into argv.
Fallback: pre-v0.7 graphs and non-git checkouts return commit_stale: null; callers fall back to the existing mtime-based stale flag. No behavior change for existing users.
Reference issue: #3170
v1.42.1 Features
132. Package Legitimacy Gate
Purpose: Stop hallucinated, suspicious, or slopsquatting package names before they reach a shell install command.
Behavior:
- Phase research writes a
## Package Legitimacy Audittable for recommended packages. - Packages verified only through search are treated as
[ASSUMED], not trusted. [SLOP]packages are removed from recommendations.- Plans that need
[ASSUMED]or suspicious packages add a human verification checkpoint. - Executor install failures stop for human verification instead of auto-trying similarly named packages.
Requirements:
- REQ-PKG-GATE-01: Research MUST record package registry, age, download/source signals, slopcheck verdict, and disposition.
- REQ-PKG-GATE-02: Planner MUST gate unverified or suspicious package installs before execution.
- REQ-PKG-GATE-03: Executor MUST NOT auto-substitute package names after failed package-manager installs.
Reference: v1.42.1 Release Notes
133. Skill Surface Budgeting
Purpose: Let users reduce installed skill and agent surface area when context budget matters.
Install profiles:
| Profile | Purpose |
|---|---|
core |
Minimal main-loop surface |
standard |
Core plus common phase-management commands |
full |
Complete surface; default |
Runtime control: /gsd:surface lists profile state and enables, disables, or resets skill clusters without reinstalling.
Requirements:
- REQ-SURFACE-01: Installer MUST resolve
--profile=<name>and persist the active profile in.gsd-profile. - REQ-SURFACE-02:
--minimaland--core-onlyMUST remain aliases for--profile=core. - REQ-SURFACE-03: Runtime surface state MUST persist outside the install profile marker.
Reference: ADR-0011
134. Installer Migrations
Purpose: Make runtime config cleanup explicit, auditable, and rollback-aware during installs and updates.
Capabilities:
- First-time baseline migration records managed files.
- Legacy stale-file cleanup uses ownership evidence before deleting or rewriting.
- User-owned artifacts are preserved.
- Ambiguous GSD-looking files block with a clear report instead of being silently overwritten.
- Migration plans support dry-run reporting and rollback protection.
Requirements:
- REQ-INSTALL-MIGRATION-01: Migration records MUST include metadata, install scope, and ownership evidence.
- REQ-INSTALL-MIGRATION-02: Destructive actions MUST fail closed when ownership is ambiguous.
- REQ-INSTALL-MIGRATION-03: Install failures MUST restore the pre-install state when rollback data exists.
Reference: Installer Migrations
135. Custom Ship PR Body Sections
Command: /gsd-ship
Config key: ship.pr_body_sections
Purpose: Add project-specific PRD-style sections to generated PR bodies without editing GSD workflow files.
Behavior: Configured sections append after the required Summary, Changes, Requirements Addressed, Verification, and Key Decisions sections. They can copy from artifact headings, render templates, or fall back to static text.
Requirements:
- REQ-SHIP-SECTIONS-01: Custom sections MUST NOT replace, remove, or reorder required PR sections.
- REQ-SHIP-SECTIONS-02: Unknown template tokens MUST be rejected by config validation.
- REQ-SHIP-SECTIONS-03: Disabled sections MUST stay in config without appearing in PR output.
Reference: Custom PR Body Sections
136. Review Default Reviewers
Command: /gsd-review
Config key: review.default_reviewers
Purpose: Let teams choose the default reviewer subset for no-flag /gsd-review runs.
Precedence:
explicit reviewer flags -> --all -> review.default_reviewers -> all detected reviewers
Requirements:
- REQ-REVIEW-DEFAULTS-01: Missing
review.default_reviewersMUST preserve the previous all-detected behavior. - REQ-REVIEW-DEFAULTS-02: Empty arrays MUST be rejected; remove the key to restore all-detected behavior.
- REQ-REVIEW-DEFAULTS-03: Known but unavailable reviewers MUST be skipped with diagnostics rather than hard-failing the run.
Reference: Configuration Reference
137. Fallow Structural Review Pre-Pass
Command: /gsd-code-review
Config keys: code_quality.fallow.*
Purpose: Add an optional structural analysis pass before the agent review.
Behavior: When enabled, GSD resolves a fallow binary, runs a bounded audit, writes FALLOW.json, and embeds structural findings in REVIEW.md.
Requirements:
- REQ-FALLOW-01: Fallow MUST be opt-in and disabled by default.
- REQ-FALLOW-02: Missing or failing fallow runs MUST produce clear diagnostics.
- REQ-FALLOW-03: Findings larger than the embed budget MUST be skipped with a warning, preserving the raw JSON artifact.
Reference: Configuration Reference
138. End-of-Phase Human Verification Mode
Config key: workflow.human_verify_mode
Purpose: Reduce mid-flight human checkpoint interruptions while preserving human verification requirements.
Behavior: The default "end-of-phase" mode embeds human checks into <verify><human-check> blocks for phase review. "mid-flight" restores blocking checkpoint:human-verify tasks.
Requirements:
- REQ-HUMAN-VERIFY-01:
checkpoint:decisionandcheckpoint:human-actionMUST remain blocking regardless of mode. - REQ-HUMAN-VERIFY-02: Human-needed verification MUST remain pending until the end-of-phase review resolves it.
- REQ-HUMAN-VERIFY-03: Configs without the key MUST use
"end-of-phase".
Reference: Checkpoints Reference
139. Quota and Rate-Limit Failure Classification
Command: /gsd-execute-phase
Purpose: Treat provider quota and rate-limit failures as wait-and-resume conditions, not normal executor failures.
Behavior: Agent output is classified for signals such as 429, rate limit, usage limit, RESOURCE_EXHAUSTED, and usage_limit_reached. Matching failures present a wait-for-reset recovery path.
Requirements:
- REQ-QUOTA-01: Quota failures MUST NOT offer immediate retry as the primary recovery.
- REQ-QUOTA-02: Classification MUST cover Claude, Copilot, Codex, Gemini, and generic provider sentinels.
- REQ-QUOTA-03: Non-quota failures MUST continue through the normal execution failure path.
Reference: Provider Rate Limit Signals
140. Statusline Context Position
Config key: statusline.context_position
Purpose: Keep the context meter visible in narrow terminals.
Options:
| Value | Behavior |
|---|---|
"end" |
Default; render context meter near the line tail |
"front" |
Render context meter immediately after the model name |
Requirements:
- REQ-STATUSLINE-POS-01: Invalid values MUST be rejected by config validation.
- REQ-STATUSLINE-POS-02: Missing config MUST preserve existing end-position rendering.
Reference: Configuration Reference
141. Milestone Tag Creation Toggle
Command: /gsd-complete-milestone
Config key: git.create_tag
Purpose: Let projects with external release automation complete milestones without creating local git tags.
Behavior: git.create_tag: false skips milestone tag creation. The workflow still updates milestone artifacts and state.
Requirements:
- REQ-MILESTONE-TAG-01: Missing config MUST preserve automatic tag creation.
- REQ-MILESTONE-TAG-02: Existing tag collisions MUST fail clearly instead of overwriting tags.
- REQ-MILESTONE-TAG-03: Disabling tag creation MUST NOT skip milestone archival.
Reference: Configuration Reference
142. Structured JSON Error Mode
CLI: gsd-tools --json-errors
Purpose: Give automation callers stable machine-readable error envelopes.
Behavior: Commands that fail under --json-errors return structured ok: false payloads with error kind, message, command context, and exit mapping instead of prose-only stderr.
Requirements:
- REQ-JSON-ERRORS-01: Unknown commands, validation errors, timeouts, native failures, fallback failures, and internal errors MUST map to canonical error kinds.
- REQ-JSON-ERRORS-02: CLI exit code mapping MUST remain stable for automation callers.
- REQ-JSON-ERRORS-03: Human-readable output MUST remain the default when
--json-errorsis absent.
Related
Reference: JSON Error Mode