89886d90b4
* test(114): add failing regression tests for npm dependency integrity gate
Adds tests/npm-integrity-gate.test.cjs and four fixture directories under
tests/fixtures/npm-integrity/ covering:
- clean: matching lockfile and node_modules (expects exit 0)
- drift: declared vs installed version mismatch (expects exit 1)
Reproduces the ws 8.20.1 declared / 8.20.0 installed incident shape
using stable-dep@8.20.1 (package.json) vs stable-dep@8.20.0 (node_modules).
- extraneous: unlisted package in node_modules (exits 1; exits 0 with --ignore-extraneous)
- missing: declared package absent from node_modules (exits 1 regardless of flags)
Each test spawns scripts/check-npm-integrity.sh as a subprocess and asserts
on exit code first, then stderr content. Tests are RED at this commit because
the script does not yet exist.
Sources:
npm ls docs: https://docs.npmjs.com/cli/v10/commands/npm-ls
NIST SSDF PW.4.1: https://csrc.nist.gov/publications/detail/sp/800-218/final
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(114): add check-npm-integrity.sh + workspace-aware drift detection
Adds scripts/check-npm-integrity.sh, a Bash script that:
1. Runs `npm ls --all --json` at the invocation directory
2. Parses JSON output for invalid, missing, and extraneous package flags
3. Exits 1 on any finding; emits a structured report to stderr listing offenders
with both declared and installed versions for invalid packages
4. Exits 2 on tool error (npm/node not found, JSON parse failure)
5. Accepts --ignore-extraneous to suppress extraneous-only failures
6. Documents behaviour in --help output including remediation path
Workspace behaviour: the root package.json in this repo has no "workspaces"
field. npm ls runs at the invocation root and covers that tree only. The sdk/
sub-package is a separate, non-workspace package and is out of scope for a
single invocation. If workspaces are added in future, npm ls will traverse
them automatically (npm >=7).
The drift scenario (ws 8.20.1 declared vs 8.20.0 installed) is reproduced by
using an exact version pin in package.json combined with a mismatched
node_modules/package.json -- npm ls marks this as "invalid" and exits 1.
npm exits 0 for extraneous packages even though they appear in the JSON
"problems" array; this script detects them via JSON parsing regardless of
the npm exit code.
Sources:
npm ls docs: https://docs.npmjs.com/cli/v10/commands/npm-ls
NIST SSDF PW.4.1: https://csrc.nist.gov/publications/detail/sp/800-218/final
OpenSSF Scorecard Pinned-Dependencies:
https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* ci(114): wire dependency integrity gate into CI/release/security workflows
Adds a "Dependency integrity gate" step invoking
scripts/check-npm-integrity.sh to three workflows, always after `npm ci`
and before any test or build step:
.github/workflows/test.yml
- matrix job: after "Install dependencies" / before "Build SDK dist"
- coverage job: after "Install dependencies" / before "Build SDK dist"
.github/workflows/release.yml
- rc job "Install and test": after npm ci, before npm run test:coverage
- finalize job "Install and test": after npm ci, before npm run test:coverage
.github/workflows/security-scan.yml
- Added setup-node + npm ci + gate before existing source-scan steps
- Bumped timeout-minutes from 5 to 10 to accommodate the install step
Also adds "check:integrity": "./scripts/check-npm-integrity.sh" to root
package.json scripts for local contributor invocation.
No new workflow files created. All edits extend existing workflows.
Sources:
npm ls docs: https://docs.npmjs.com/cli/v10/commands/npm-ls
NIST SSDF PW.4.1: https://csrc.nist.gov/publications/detail/sp/800-218/final
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs(114): document dependency integrity gate in audit runbook
Appends a "Dependency Integrity Verification" section to SECURITY.md
(no docs/runbooks/ directory exists in this repo). Covers:
- The three detection classes: invalid, missing, extraneous
- Local invocation: ./scripts/check-npm-integrity.sh + npm run check:integrity
- Remediation: rm -rf node_modules && npm ci
- Bypass policy: no flag; commit-message documentation required if skipped
- Scope: root package only (sdk/ is a non-workspace package, out of scope)
- CI coverage listing
Sources cited:
NIST SSDF PW.4.1: https://csrc.nist.gov/publications/detail/sp/800-218/final
OpenSSF Scorecard Pinned-Dependencies:
https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(#114): npm integrity gate satisfies its own clean/drift/extraneous fixtures
Replace npm-ls-based analysis with pure package-lock.json parsing so the
script runs correctly in CI and test environments where node_modules is not
installed. Key changes:
- Rewrite check-npm-integrity.sh parser to read package-lock.json directly
instead of spawning `npm ls --all --json`, which required node_modules on
disk and incorrectly flagged clean/drift fixtures as MISSING.
- Implement a self-contained semver satisfies() covering exact, caret, tilde,
comparison-operator, and compound ranges — no external semver package needed.
- Update extraneous fixture package-lock.json to include ghost-pkg with
"extraneous: true" so the lockfile-based detector can identify it.
- Update missing fixture package-lock.json to omit the node_modules/absent-dep
entry, making the absent-dep MISSING condition derivable from lockfile alone.
All 13 tests (clean ×2, drift ×3, extraneous ×3, missing ×3, help ×2) pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(#114): treat transitive deps as non-extraneous in integrity gate
The extraneous check was comparing all lockfile packages against root
package.json declarations only. This caused every transitive dependency
(e.g. hono, ajv, @anthropic-ai/claude-agent-sdk-darwin-arm64) to be
flagged as EXTRANEOUS, producing false-positive failures in CI.
Only packages that npm itself marks with "extraneous: true" in the
lockfile represent genuinely unwanted packages. Transitive dependencies
installed by parent packages are valid and should be skipped.
All 13 existing tests continue to pass; the extraneous fixture still
works because it uses "extraneous: true" explicitly (npm's own marker).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* ci: retrigger checks after transient git-auth runner failure
The original run for this PR had a single CI job fail with:
"fatal: could not read Username for 'https://github.com': terminal prompts disabled"
That is a hosted-runner infrastructure flake — no code defect. The run
cannot be retried via gh CLI (too old). This empty commit kicks a fresh
full CI cycle.
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
100 lines
3.8 KiB
JSON
100 lines
3.8 KiB
JSON
{
|
|
"name": "@opengsd/get-shit-done-redux",
|
|
"version": "1.0.0",
|
|
"description": "A meta-prompting, context engineering and spec-driven development system for Claude Code, OpenCode, Gemini and Codex by TÂCHES.",
|
|
"bin": {
|
|
"get-shit-done-redux": "bin/install.js",
|
|
"gsd-sdk": "bin/gsd-sdk.js",
|
|
"gsd-tools": "bin/gsd-sdk.js"
|
|
},
|
|
"files": [
|
|
"bin",
|
|
"commands",
|
|
"get-shit-done",
|
|
"agents",
|
|
"hooks",
|
|
"scripts",
|
|
"sdk/src",
|
|
"sdk/shared",
|
|
"sdk/prompts",
|
|
"sdk/dist",
|
|
"sdk/package.json",
|
|
"sdk/package-lock.json",
|
|
"sdk/tsconfig.json"
|
|
],
|
|
"keywords": [
|
|
"claude",
|
|
"claude-code",
|
|
"ai",
|
|
"meta-prompting",
|
|
"context-engineering",
|
|
"spec-driven-development",
|
|
"gemini",
|
|
"gemini-cli",
|
|
"codex",
|
|
"codex-cli"
|
|
],
|
|
"author": "TÂCHES",
|
|
"license": "MIT",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/open-gsd/get-shit-done-redux.git"
|
|
},
|
|
"homepage": "https://github.com/open-gsd/get-shit-done-redux",
|
|
"bugs": {
|
|
"url": "https://github.com/open-gsd/get-shit-done-redux/issues"
|
|
},
|
|
"publishConfig": {
|
|
"access": "public"
|
|
},
|
|
"engines": {
|
|
"node": ">=22.0.0"
|
|
},
|
|
"dependencies": {
|
|
"@anthropic-ai/claude-agent-sdk": "^0.2.84",
|
|
"ws": "8.20.1"
|
|
},
|
|
"devDependencies": {
|
|
"c8": "^11.0.0"
|
|
},
|
|
"optionalDependencies": {
|
|
"fallow": "^2.70.0"
|
|
},
|
|
"scripts": {
|
|
"check:integrity": "./scripts/check-npm-integrity.sh",
|
|
"build:hooks": "node scripts/build-hooks.js",
|
|
"build:sdk": "cd sdk && npm ci && npm run build",
|
|
"check:alias-drift": "cd sdk && npm run check:alias-drift",
|
|
"check:state-document-fresh": "cd sdk && npm run check:state-document-fresh",
|
|
"check:configuration-fresh": "cd sdk && npm run check:configuration-fresh",
|
|
"check:workstream-inventory-builder-fresh": "cd sdk && npm run check:workstream-inventory-builder-fresh",
|
|
"check:project-root-fresh": "cd sdk && npm run check:project-root-fresh",
|
|
"check:plan-scan-fresh": "cd sdk && npm run check:plan-scan-fresh",
|
|
"check:secrets-fresh": "cd sdk && npm run check:secrets-fresh",
|
|
"check:schema-detect-fresh": "cd sdk && npm run check:schema-detect-fresh",
|
|
"check:decisions-fresh": "cd sdk && npm run check:decisions-fresh",
|
|
"check:workstream-name-policy-fresh": "cd sdk && npm run check:workstream-name-policy-fresh",
|
|
"prepublishOnly": "npm run build:hooks && npm run build:sdk",
|
|
"pretest": "npm run build:sdk && npm run lint:skill-deps",
|
|
"pretest:coverage": "npm run build:sdk",
|
|
"lint:descriptions": "node scripts/lint-descriptions.cjs",
|
|
"lint:skill-deps": "node scripts/lint-skill-deps.cjs",
|
|
"lint:tests": "node scripts/lint-no-source-grep.cjs",
|
|
"lint:test-file-count": "node scripts/lint-test-file-count.cjs",
|
|
"lint:pr-checks": "node scripts/lint-pr-check-project-dir.cjs",
|
|
"lint:changeset": "node scripts/changeset/lint.cjs",
|
|
"lint:docs": "node scripts/lint-docs-required.cjs",
|
|
"changeset": "node scripts/changeset/new.cjs",
|
|
"changelog:render": "node scripts/changeset/cli.cjs render",
|
|
"test": "node scripts/run-tests.cjs",
|
|
"test:unit": "node scripts/run-tests.cjs --suite unit",
|
|
"test:integration": "node scripts/run-tests.cjs --suite integration",
|
|
"test:install": "node scripts/run-tests.cjs --suite install",
|
|
"test:security": "node scripts/run-tests.cjs --suite security",
|
|
"test:slow": "node scripts/run-tests.cjs --suite slow",
|
|
"test:coverage": "c8 --check-coverage --lines 70 --reporter text --include 'get-shit-done/bin/lib/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs",
|
|
"test:coverage:unit": "c8 --check-coverage --lines 70 --reporter text --include 'get-shit-done/bin/lib/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs --suite unit",
|
|
"test:coverage:all": "npm run test:coverage"
|
|
}
|
|
}
|