@opengsd/get-shit-done-redux 1.0.0

package/scripts/run-tests.cjs

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+// Cross-platform test runner — resolves test file globs via Node
+// instead of relying on shell expansion (which fails on Windows PowerShell/cmd).
+// Propagates NODE_V8_COVERAGE so c8 collects coverage from the child process.
+//
+// Suite filtering (issue #3597):
+//   node scripts/run-tests.cjs                 # default — runs ALL tests (backcompat)
+//   node scripts/run-tests.cjs --suite all     # explicit "everything"
+//   node scripts/run-tests.cjs --suite unit    # only files with no other suite marker
+//   node scripts/run-tests.cjs --suite security    # *.security.test.cjs
+//   node scripts/run-tests.cjs --suite integration # *.integration.test.cjs
+//   node scripts/run-tests.cjs --suite install     # *.install.test.cjs
+//   node scripts/run-tests.cjs --suite slow        # *.slow.test.cjs
+//
+// Suite grouping convention: filename suffix marker before `.test.cjs`.
+// A file named `foo.security.test.cjs` belongs to the `security` suite.
+// A file named `foo.test.cjs` (no marker) belongs to the `unit` suite.
+// See docs/TESTING-SUITES.md for full grouping policy.
+'use strict';
+
+const { readdirSync } = require('fs');
+const { join } = require('path');
+const { execFileSync } = require('child_process');
+
+const SUITES = ['all', 'unit', 'integration', 'install', 'security', 'slow'];
+const MARKED_SUITES = ['integration', 'install', 'security', 'slow'];
+
+function parseArgs(argv) {
+  let suite = null;
+  let seen = false;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--suite') {
+      if (seen) {
+        return { error: 'duplicate --suite flag' };
+      }
+      seen = true;
+      const v = argv[i + 1];
+      if (!v || v.startsWith('--')) {
+        return { error: '--suite requires a value' };
+      }
+      suite = v;
+      i++;
+    } else if (a.startsWith('--suite=')) {
+      if (seen) {
+        return { error: 'duplicate --suite flag' };
+      }
+      seen = true;
+      suite = a.slice('--suite='.length);
+      if (!suite) {
+        return { error: '--suite requires a value' };
+      }
+    } else {
+      return { error: `unknown argument: ${a}` };
+    }
+  }
+  return { suite };
+}
+
+// Return the marked suite name embedded in a filename, or null if it's unmarked.
+// foo.security.test.cjs -> "security"
+// foo.test.cjs          -> null (unit)
+function suiteOf(filename) {
+  if (!filename.endsWith('.test.cjs')) return null;
+  const base = filename.slice(0, -'.test.cjs'.length);
+  const lastDot = base.lastIndexOf('.');
+  if (lastDot === -1) return null;
+  const marker = base.slice(lastDot + 1);
+  return MARKED_SUITES.includes(marker) ? marker : null;
+}
+
+function selectFiles(allFiles, suite) {
+  if (suite === null || suite === 'all') {
+    return allFiles;
+  }
+  if (suite === 'unit') {
+    return allFiles.filter(f => suiteOf(f) === null);
+  }
+  return allFiles.filter(f => suiteOf(f) === suite);
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const parsed = parseArgs(args);
+  if (parsed.error) {
+    console.error(`run-tests: ${parsed.error}`);
+    console.error(`Valid suites: ${SUITES.join(', ')}`);
+    process.exit(2);
+  }
+  const suite = parsed.suite;
+  if (suite !== null && !SUITES.includes(suite)) {
+    console.error(`run-tests: unknown suite "${suite}"`);
+    console.error(`Valid suites: ${SUITES.join(', ')}`);
+    process.exit(2);
+  }
+
+  const testDir = process.env.GSD_TEST_DIR
+    ? process.env.GSD_TEST_DIR
+    : join(__dirname, '..', 'tests');
+
+  const allFiles = readdirSync(testDir)
+    .filter(f => f.endsWith('.test.cjs'))
+    .sort();
+
+  if (allFiles.length === 0) {
+    console.error(`No test files found in ${testDir}`);
+    process.exit(1);
+  }
+
+  const selected = selectFiles(allFiles, suite).map(f => join(testDir, f));
+
+  if (selected.length === 0) {
+    // Empty suite: report and exit 0 so empty lanes (e.g. `security` before
+    // adversarial tests land) don't gate CI. CI consumers wanting strictness
+    // can grep stderr for "no tests in suite".
+    console.error(`run-tests: no tests in suite "${suite || 'all'}"`);
+    process.exit(0);
+  }
+
+  // Log selected files to stderr for CI / harness-test visibility.
+  // node:test default reporter doesn't echo filenames, so this gives
+  // operators a single stable line they can grep.
+  console.error(
+    `run-tests: suite="${suite || 'all'}" files=${selected.length}: ${selected
+      .map(f => f.split(/[\\/]/).pop())
+      .join(' ')}`,
+  );
+
+  const concurrency = process.env.TEST_CONCURRENCY
+    ? `--test-concurrency=${process.env.TEST_CONCURRENCY}`
+    : '--test-concurrency=4';
+
+  // Windows `CreateProcess` caps the full command line at 32,767 chars
+  // (lpCommandLine). With 500+ test paths the spawn fails instantly with no
+  // test output. Linux/macOS allow ~2 MB (ARG_MAX) so unchunked spawns are
+  // fine there. Split into chunks sized for the tightest target so behavior
+  // is identical across platforms. (#3597)
+  // Operator override (also used by tests to force chunking with short paths).
+  const MAX_CMDLINE_CHARS = process.env.RUN_TESTS_MAX_CMDLINE_CHARS
+    ? Number(process.env.RUN_TESTS_MAX_CMDLINE_CHARS)
+    : 28000; // headroom below the 32,767 Windows ceiling
+  const FIXED_OVERHEAD = process.execPath.length + '--test'.length + concurrency.length + 8;
+  const chunks = [];
+  let current = [];
+  let currentLen = FIXED_OVERHEAD;
+  for (const file of selected) {
+    const add = file.length + 1; // +1 for the inter-arg separator
+    if (current.length > 0 && currentLen + add > MAX_CMDLINE_CHARS) {
+      chunks.push(current);
+      current = [];
+      currentLen = FIXED_OVERHEAD;
+    }
+    current.push(file);
+    currentLen += add;
+  }
+  if (current.length > 0) chunks.push(current);
+
+  let firstFailureExit = 0;
+  for (let i = 0; i < chunks.length; i++) {
+    if (chunks.length > 1) {
+      console.error(`run-tests: chunk ${i + 1}/${chunks.length} — ${chunks[i].length} files`);
+    }
+    try {
+      execFileSync(process.execPath, ['--test', concurrency, ...chunks[i]], {
+        stdio: 'inherit',
+        env: { ...process.env },
+      });
+    } catch (err) {
+      const code = err.status || 1;
+      // Run every chunk so the operator sees all failures in one pass; report
+      // the first non-zero exit at the end.
+      if (firstFailureExit === 0) firstFailureExit = code;
+    }
+  }
+  if (firstFailureExit !== 0) process.exit(firstFailureExit);
+}
+
+main();

package/scripts/secret-scan.sh

@@ -0,0 +1,229 @@
+#!/usr/bin/env bash
+# secret-scan.sh — Check files for accidentally committed secrets/credentials
+#
+# Usage:
+#   scripts/secret-scan.sh --diff origin/main   # CI mode: scan changed files
+#   scripts/secret-scan.sh --file path/to/file   # Scan a single file
+#   scripts/secret-scan.sh --dir agents/          # Scan all files in a directory
+#
+# Exit codes:
+#   0 = clean
+#   1 = findings detected
+#   2 = usage error
+set -euo pipefail
+
+# ─── Secret Patterns ─────────────────────────────────────────────────────────
+# Format: "LABEL:::REGEX"
+# Each entry is a human label paired with a POSIX extended regex.
+
+SECRET_PATTERNS=(
+  # AWS
+  "AWS Access Key:::AKIA[0-9A-Z]{16}"
+  "AWS Secret Key:::aws_secret_access_key[[:space:]]*=[[:space:]]*[A-Za-z0-9/+=]{40}"
+
+  # OpenAI / Anthropic / AI providers
+  "OpenAI API Key:::sk-[A-Za-z0-9]{20,}"
+  "Anthropic API Key:::sk-ant-[A-Za-z0-9_-]{20,}"
+
+  # GitHub
+  "GitHub PAT:::ghp_[A-Za-z0-9]{36}"
+  "GitHub OAuth:::gho_[A-Za-z0-9]{36}"
+  "GitHub App Token:::ghs_[A-Za-z0-9]{36}"
+  "GitHub Fine-grained PAT:::github_pat_[A-Za-z0-9_]{20,}"
+
+  # Stripe
+  "Stripe Secret Key:::sk_live_[A-Za-z0-9]{24,}"
+  "Stripe Publishable Key:::pk_live_[A-Za-z0-9]{24,}"
+
+  # Generic patterns
+  "Private Key Header:::-----BEGIN[[:space:]]+(RSA|EC|DSA|OPENSSH)?[[:space:]]*PRIVATE[[:space:]]+KEY-----"
+  "Generic API Key Assignment:::api[_-]?key[[:space:]]*[:=][[:space:]]*['\"][A-Za-z0-9_-]{20,}['\"]"
+  "Generic Secret Assignment:::secret[[:space:]]*[:=][[:space:]]*['\"][A-Za-z0-9_-]{20,}['\"]"
+  "Generic Token Assignment:::token[[:space:]]*[:=][[:space:]]*['\"][A-Za-z0-9_-]{20,}['\"]"
+  "Generic Password Assignment:::password[[:space:]]*[:=][[:space:]]*['\"][^'\"]{8,}['\"]"
+
+  # Slack
+  "Slack Bot Token:::xoxb-[0-9]{10,}-[A-Za-z0-9]{20,}"
+  "Slack Webhook:::hooks\.slack\.com/services/T[A-Z0-9]{8,}/B[A-Z0-9]{8,}/[A-Za-z0-9]{24}"
+
+  # Google
+  "Google API Key:::AIza[A-Za-z0-9_-]{35}"
+
+  # NPM
+  "NPM Token:::npm_[A-Za-z0-9]{36}"
+
+  # .env file content (key=value with sensitive-looking keys)
+  "Env Variable Leak:::(DATABASE_URL|DB_PASSWORD|REDIS_URL|MONGO_URI|JWT_SECRET|SESSION_SECRET|ENCRYPTION_KEY)[[:space:]]*=[[:space:]]*[^[:space:]]{8,}"
+)
+
+# ─── Ignorelist ──────────────────────────────────────────────────────────────
+
+IGNOREFILE=".secretscanignore"
+IGNORED_FILES=()
+
+load_ignorelist() {
+  if [[ -f "$IGNOREFILE" ]]; then
+    while IFS= read -r line; do
+      [[ "$line" =~ ^[[:space:]]*# ]] && continue
+      [[ -z "${line// }" ]] && continue
+      IGNORED_FILES+=("$line")
+    done < "$IGNOREFILE"
+  fi
+}
+
+is_ignored() {
+  local file="$1"
+  if [[ ${#IGNORED_FILES[@]} -eq 0 ]]; then
+    return 1
+  fi
+  for pattern in "${IGNORED_FILES[@]}"; do
+    # Support glob-style matching
+    # shellcheck disable=SC2254
+    case "$file" in
+      $pattern) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# ─── Skip Rules ──────────────────────────────────────────────────────────────
+
+should_skip_file() {
+  local file="$1"
+  # Skip binary files
+  case "$file" in
+    *.png|*.jpg|*.jpeg|*.gif|*.ico|*.woff|*.woff2|*.ttf|*.eot|*.otf) return 0 ;;
+    *.zip|*.tar|*.gz|*.bz2|*.xz|*.7z) return 0 ;;
+    *.pdf|*.doc|*.docx|*.xls|*.xlsx) return 0 ;;
+  esac
+  # Skip lockfiles and node_modules
+  case "$file" in
+    */node_modules/*) return 0 ;;
+    */package-lock.json) return 0 ;;
+    */yarn.lock) return 0 ;;
+    */pnpm-lock.yaml) return 0 ;;
+  esac
+  # Skip the scan scripts themselves and test files
+  case "$file" in
+    */secret-scan.sh) return 0 ;;
+    */security-scan.test.cjs) return 0 ;;
+    */security-prompt-injection.test.cjs) return 0 ;;
+    tests/fixtures/adversarial/security/*|*/tests/fixtures/adversarial/security/*) return 0 ;;
+  esac
+  return 1
+}
+
+# ─── File Collection ─────────────────────────────────────────────────────────
+
+collect_files() {
+  local mode="$1"
+  shift
+
+  case "$mode" in
+    --diff)
+      local base="${1:-origin/main}"
+      git diff --name-only --diff-filter=ACMR "$base"...HEAD 2>/dev/null \
+        | grep -vE '\.(png|jpg|jpeg|gif|ico|woff|woff2|ttf|eot|otf|zip|tar|gz|pdf)$' || true
+      ;;
+    --file)
+      if [[ -f "$1" ]]; then
+        echo "$1"
+      else
+        echo "Error: file not found: $1" >&2
+        exit 2
+      fi
+      ;;
+    --dir)
+      local dir="$1"
+      if [[ ! -d "$dir" ]]; then
+        echo "Error: directory not found: $dir" >&2
+        exit 2
+      fi
+      find "$dir" -type f ! -path '*/node_modules/*' ! -path '*/.git/*' ! -path '*/dist/*' \
+        ! -name '*.png' ! -name '*.jpg' ! -name '*.gif' ! -name '*.woff*' 2>/dev/null || true
+      ;;
+    --stdin)
+      cat
+      ;;
+    *)
+      echo "Usage: $0 --diff [base] | --file <path> | --dir <path> | --stdin" >&2
+      exit 2
+      ;;
+  esac
+}
+
+# ─── Scanner ─────────────────────────────────────────────────────────────────
+
+scan_file() {
+  local file="$1"
+  local found=0
+
+  if is_ignored "$file"; then
+    return 0
+  fi
+
+  for entry in "${SECRET_PATTERNS[@]}"; do
+    local label="${entry%%:::*}"
+    local pattern="${entry#*:::}"
+
+    local matches
+    matches=$(grep -nE -e "$pattern" "$file" 2>/dev/null || true)
+    if [[ -n "$matches" ]]; then
+      if [[ $found -eq 0 ]]; then
+        echo "FAIL: $file"
+        found=1
+      fi
+      echo "$matches" | while IFS= read -r line; do
+        echo "  [$label] $line"
+      done
+    fi
+  done
+
+  return $found
+}
+
+# ─── Main ────────────────────────────────────────────────────────────────────
+
+main() {
+  if [[ $# -eq 0 ]]; then
+    echo "Usage: $0 --diff [base] | --file <path> | --dir <path>" >&2
+    exit 2
+  fi
+
+  load_ignorelist
+
+  local mode="$1"
+  shift
+
+  local files
+  files=$(collect_files "$mode" "$@")
+
+  if [[ -z "$files" ]]; then
+    echo "secret-scan: no files to scan"
+    exit 0
+  fi
+
+  local total=0
+  local failed=0
+
+  while IFS= read -r file; do
+    [[ -z "$file" ]] && continue
+    if should_skip_file "$file"; then
+      continue
+    fi
+    total=$((total + 1))
+    if ! scan_file "$file"; then
+      failed=$((failed + 1))
+    fi
+  done <<< "$files"
+
+  echo ""
+  echo "secret-scan: scanned $total files, $failed with findings"
+
+  if [[ $failed -gt 0 ]]; then
+    exit 1
+  fi
+  exit 0
+}
+
+main "$@"

package/scripts/shared-module-handsync-allowlist.json

@@ -0,0 +1,145 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "_comment": "Allowlist for scripts/lint-shared-module-handsync.cjs — Phase 6 of #3524 (#3575). Two categories: cooperatingSiblings (legitimate pairs, lint accepts silently) and migrateMeBacklog (known drift anti-patterns, lint warns but does not fail). All entries require cjs + ts path + classification + justification.",
+  "cooperatingSiblings": [
+    {
+      "cjs": "get-shit-done/bin/lib/active-workstream-store.cjs",
+      "ts": "sdk/src/query/active-workstream-store.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS manages filesystem-backed workstream store; SDK layer wraps via Adapter for query dispatch. Different responsibilities, not drift."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/config-schema.cjs",
+      "ts": "sdk/src/query/config-schema.ts",
+      "classification": "cooperating-sibling",
+      "justification": "SDK config-schema.ts is the generated source-of-truth derived from sdk/shared/config-schema.manifest.json (Phase 2/#3540). CJS config-schema.cjs is the Adapter that reads from that manifest. Not a hand-sync pair; freshness check enforces alignment."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/frontmatter.cjs",
+      "ts": "sdk/src/query/frontmatter.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS implements full frontmatter parsing/mutation; SDK frontmatter.ts is the native SDK query handler delegating to the CJS runtime via the seam bridge. Not duplicating logic."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/init.cjs",
+      "ts": "sdk/src/query/init.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS init.cjs is the authoritative initializer; SDK init.ts provides the native handler layer for the SDK query seam. Phase 5.2+ will migrate remaining subcommands, but current architecture is intentional."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/phase.cjs",
+      "ts": "sdk/src/query/phase.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS phase.cjs is the full phase lifecycle implementation; SDK phase.ts provides the native query handler. The SDK delegates to CJS for most subcommands. Phase 5.2+ candidate for further migration."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/profile-output.cjs",
+      "ts": "sdk/src/query/profile-output.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS profile-output.cjs handles profiling output rendering; SDK profile-output.ts is the corresponding SDK query handler. Separate responsibilities across the seam."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/roadmap.cjs",
+      "ts": "sdk/src/query/roadmap.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS roadmap.cjs is the full roadmap implementation; SDK roadmap.ts provides the native handler for SDK query dispatch. Phase 5.2+ candidate."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/state.cjs",
+      "ts": "sdk/src/query/state.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS state.cjs is the full state implementation; SDK state.ts routes known subcommands via executeForCjs (Phase 5.0/#3558, Phase 5.1/#3574). Intentional seam delegation pattern."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/state-document.cjs",
+      "ts": "sdk/src/query/state-document.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS state-document.cjs is the generated Adapter reading from sdk/src/state-document/ Shared Module (Phase 1/#3531). SDK state-document.ts is the corresponding source-of-truth query handler. Freshness check enforces alignment."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/template.cjs",
+      "ts": "sdk/src/query/template.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS template.cjs handles template operations; SDK template.ts is the corresponding SDK native handler. Separate responsibilities across the seam."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/uat.cjs",
+      "ts": "sdk/src/query/uat.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS uat.cjs implements UAT workflows; SDK uat.ts provides the SDK query handler layer. Separate responsibilities."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/verify.cjs",
+      "ts": "sdk/src/query/verify.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS verify.cjs is the full verify implementation; SDK verify.ts provides the native handler. Phase 5.2+ candidate for further delegation."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/workstream.cjs",
+      "ts": "sdk/src/query/workstream.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS workstream.cjs handles workstream management; SDK workstream.ts provides the SDK query handler. Workstream support inside sync bridge is an open follow-up item."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/workstream-inventory.cjs",
+      "ts": "sdk/src/query/workstream-inventory.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS workstream-inventory.cjs is the generated Adapter for the workstream-inventory Shared Module (Phase 3/#3548). SDK workstream-inventory.ts is the source-of-truth query handler. Freshness check enforces alignment."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/config.cjs",
+      "ts": "sdk/src/config.ts",
+      "classification": "CJS-CLI-ONLY",
+      "justification": "Phase 2 (#3536) already migrated CONFIG_DEFAULTS and loadConfig/mergeDefaults to the Configuration Module and sdk/src/config.ts. What remains in config.cjs is exclusively CLI command handlers (cmdConfigGet, cmdConfigSet, cmdConfigNewProject, cmdConfigEnsureSection, cmdConfigSetModelProfile, cmdConfigPath, cmdMigrateConfig, buildNewProjectConfig, setConfigValue, ensureConfigFile) that depend on CJS-only APIs (withPlanningLock, platformWriteSync/ReadSync/EnsureDir, sync fs ops, process.exit). sdk/src/config.ts provides only the async loadConfig/mergeDefaults SDK layer. The two files serve disjoint surfaces with no logical overlap — not a hand-sync drift anti-pattern."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/intel.cjs",
+      "ts": "sdk/src/query/intel.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS intel.cjs is the synchronous runtime implementation used by gsd-tools.cjs; sdk/src/query/intel.ts is the async QueryHandler port for the SDK query seam (explicitly documented as a port in its file header). The two files intentionally diverge on INTEL_FILES naming (CJS: file-roles.json/api-map.json/dependency-graph.json/arch-decisions.json; SDK: files.json/apis.json/deps.json/arch.md) — existing CJS tests are locked to the old naming. Not a hand-sync drift pattern; separate runtime responsibilities across the seam."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/model-catalog.cjs",
+      "ts": "sdk/src/model-catalog.ts",
+      "classification": "ADAPTER-OVER-MODULE",
+      "justification": "Both files read from sdk/shared/model-catalog.json (ADR-0003 precedent) as independent consumers of the shared manifest. CJS exposes VALID_AGENT_TIERS, MODEL_ALIAS_MAP, RUNTIME_PROFILE_MAP, KNOWN_RUNTIMES, RUNTIMES_WITH_REASONING_EFFORT, nextTier, formatAgentToModelMapAsTable for core.cjs and model-profiles.cjs consumers. SDK exposes resolveRuntimeTierDefault, runtimesWithReasoningEffort for session-runner.ts and query handlers. The shared JSON is the single source-of-truth; both adapters derive their exports from it without duplicating any logic between themselves."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/plan-scan.cjs",
+      "ts": "sdk/src/query/plan-scan.ts",
+      "classification": "ADAPTER-OVER-MODULE",
+      "justification": "CJS plan-scan.cjs is the generated Adapter reading from sdk/src/query/plan-scan.ts Shared Module (Phase 6/#3575). SDK plan-scan.ts is the source-of-truth. Freshness check (check-plan-scan-fresh.mjs) enforces alignment."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/secrets.cjs",
+      "ts": "sdk/src/query/secrets.ts",
+      "classification": "ADAPTER-OVER-MODULE",
+      "justification": "CJS secrets.cjs is the generated Adapter reading from sdk/src/query/secrets.ts Shared Module (Phase 6/#3575). SDK secrets.ts is the source-of-truth. Freshness check (check-secrets-fresh.mjs) enforces alignment."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/schema-detect.cjs",
+      "ts": "sdk/src/query/schema-detect.ts",
+      "classification": "ADAPTER-OVER-MODULE",
+      "justification": "CJS schema-detect.cjs is the generated Adapter reading from sdk/src/query/schema-detect.ts Shared Module (Phase 6/#3575). SDK schema-detect.ts is the source-of-truth. Generated CJS adds detectSchemaOrm compat export (not in SDK) and exports SCHEMA_PATTERNS/ORM_INFO for backward compatibility. Freshness check (check-schema-detect-fresh.mjs) enforces alignment."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/decisions.cjs",
+      "ts": "sdk/src/query/decisions.ts",
+      "classification": "ADAPTER-OVER-MODULE",
+      "justification": "Phase 6 (#3575): CJS decisions.cjs is the generated Adapter reading from sdk/src/query/decisions.ts Shared Module. SDK source-of-truth; regex aligned to accept alphanumeric IDs (D-INFRA-01). CJS callers (gap-checker.cjs) use {id, text} subset; extra fields {category, tags, trackable} are present but ignored. Freshness check (check-decisions-fresh.mjs) enforces alignment."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/workstream-name-policy.cjs",
+      "ts": "sdk/src/workstream-name-policy.ts",
+      "classification": "ADAPTER-OVER-MODULE",
+      "justification": "Phase 6 (#3575): CJS workstream-name-policy.cjs is the generated Adapter reading from sdk/src/workstream-name-policy.ts Shared Module. SDK source-of-truth now exports all three functions used by CJS callers (toWorkstreamSlug, hasInvalidPathSegment, isValidActiveWorkstreamName) plus validateWorkstreamName alias. Freshness check (check-workstream-name-policy-fresh.mjs) enforces alignment."
+    },
+    {
+      "cjs": "get-shit-done/bin/lib/prompt-budget.cjs",
+      "ts": "sdk/src/query/prompt-budget.ts",
+      "classification": "cooperating-sibling",
+      "justification": "CJS prompt-budget.cjs provides the applyBudget implementation used by gsd-tools.cjs case 'prompt-budget'. SDK prompt-budget.ts is the native QueryHandler port for gsd-sdk query dispatch (#3081). The SDK handler ports the pure budget logic and adds CLI arg parsing / file I/O directly, satisfying the registry-integration drift-guard without duplicating shared state."
+    }
+  ],
+  "migrateMeBacklog": []
+}

package/scripts/strip-prose-atrefs.cjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+/**
+ * strip-prose-atrefs.cjs
+ *
+ * Removes redundant @~/.claude/get-shit-done/ path tokens from prose lines
+ * in <process> and <context> blocks. The path is already declared in
+ * <execution_context> where it actually loads the file. Prose copies are
+ * inert and add ~900 tokens/invocation of dead weight.
+ *
+ * Transformation rules (applied per matching line):
+ *   - "Execute the X workflow from @PATH end-to-end." → "Execute end-to-end."
+ *   - "Execute @PATH end-to-end."                    → "Execute end-to-end."
+ *   - "Read and execute the X workflow from @PATH end-to-end." → "Execute end-to-end."
+ *   - "Follow the X workflow at @PATH."              → "Execute end-to-end."
+ *   - "Output the X reference from @PATH."           → "Execute end-to-end."
+ *   - "**Follow the X** from `@PATH`."               → "**Follow the X.**"
+ *   - "- If it is '...': ... from @PATH end-to-end." → strip path token only
+ *   - "- Otherwise: ... from @PATH end-to-end."      → strip path token only
+ *   - "- @PATH (label)"                              → "- (label)"
+ *
+ * Run with --dry-run to preview without writing.
+ */
+
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+const DRY_RUN      = process.argv.includes('--dry-run');
+const ROOT         = path.join(__dirname, '..');
+const COMMANDS_DIR = path.join(ROOT, 'commands', 'gsd');
+
+const AT_PATH_PATTERN = /@(?:~|\$HOME)\/.+?get-shit-done\/[^\s`\)]+/;
+const mkAtRe = () => new RegExp(AT_PATH_PATTERN.source, 'g');
+
+function transformLine(line) {
+  if (!AT_PATH_PATTERN.test(line)) return line;
+
+  const trimmed = line.trim();
+
+  // "- @PATH (label)"  →  "- (label)"
+  if (/^- @(?:~|\$HOME)\//.test(trimmed)) {
+    return line.replace(/^(\s*- )@(?:~|\$HOME)\/[^\s(]+\s*/, '$1');
+  }
+
+  // "**Follow the X workflow** from `@PATH`."  →  "**Follow the X workflow.**"
+  // "**Follow the X workflow** from `@PATH`"   →  "**Follow the X workflow.**"
+  if (/\*\*Follow the .+ workflow\*\* from `@/.test(trimmed)) {
+    return line.replace(/\s+from `@(?:~|\$HOME)\/[^`]+`\.?/, '.');
+  }
+
+  // Routing bullet: keep everything except "from @PATH" or bare "@PATH"
+  // "- If …: … from @PATH end-to-end." → strip path, keep bullet
+  // "- Otherwise: … from @PATH end-to-end." → strip path, keep bullet
+  if (/^- (?:If |Otherwise:|pass all)/.test(trimmed)) {
+    return line
+      .replace(/\s+from\s+@(?:~|\$HOME)\/\S+/g, '')
+      .replace(/@(?:~|\$HOME)\/\S+/g, '');
+  }
+
+  // "Execute [the X workflow] [from] @PATH [end-to-end]."
+  // "Read and execute …"  /  "Follow …"  /  "Output …"
+  // → collapse to leading indent + "Execute end-to-end."
+  const indent = line.match(/^(\s*)/)[1];
+  return `${indent}Execute end-to-end.`;
+}
+
+function processFile(filePath) {
+  const original = fs.readFileSync(filePath, 'utf-8');
+  const lines    = original.split('\n');
+  const out      = [];
+  let inProse    = false; // true when inside <process> or <context> (not execution_context)
+
+  for (const line of lines) {
+    const t = line.trim();
+    if (/<(process|context)>/.test(t) && !t.includes('execution_context')) inProse = true;
+    if (/<\/(process|context)>/.test(t) && !t.includes('execution_context')) inProse = false;
+
+    if (inProse && AT_PATH_PATTERN.test(line)) {
+      const re = mkAtRe();
+      re.lastIndex = 0;
+      out.push(transformLine(line));
+    } else {
+      out.push(line);
+    }
+  }
+
+  const result = out.join('\n');
+  if (result === original) return false; // no change
+
+  if (!DRY_RUN) fs.writeFileSync(filePath, result, 'utf-8');
+  return true;
+}
+
+const files = fs.readdirSync(COMMANDS_DIR)
+  .filter(f => f.endsWith('.md'))
+  .map(f => path.join(COMMANDS_DIR, f));
+
+let changed = 0;
+for (const f of files) {
+  if (processFile(f)) {
+    console.log(`${DRY_RUN ? '[dry]' : 'fixed'}: ${path.basename(f)}`);
+    changed++;
+  }
+}
+console.log(`\n${changed} file(s) ${DRY_RUN ? 'would be' : 'were'} modified.`);