@opengsd/gsd-core 1.13.0 → 1.14.0

package/scripts/lint-workflow-shellcheck-baseline.json

@@ -274,6 +274,26 @@
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
   },
+  {
+    "file": "gsd-core/workflows/complete-milestone/detail/elaboration.md",
+    "code": "2001",
+    "message": "See if you can use ${variable//search/replace} instead."
+  },
+  {
+    "file": "gsd-core/workflows/complete-milestone/detail/elaboration.md",
+    "code": "2001",
+    "message": "See if you can use ${variable//search/replace} instead."
+  },
+  {
+    "file": "gsd-core/workflows/complete-milestone/detail/elaboration.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/complete-milestone/detail/elaboration.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
   {
     "file": "gsd-core/workflows/debug.md",
     "code": "2010",
@@ -369,6 +389,11 @@
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
   },
+  {
+    "file": "gsd-core/workflows/execute-phase/detail/elaboration.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
   {
     "file": "gsd-core/workflows/execute-phase/steps/executor-isolation-dispatch.md",
     "code": "2016",
@@ -469,6 +494,56 @@
     "code": "2012",
     "message": "Use find instead of ls to better handle non-alphanumeric filenames."
   },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
   {
     "file": "gsd-core/workflows/new-project.md",
     "code": "2012",
@@ -479,6 +554,16 @@
     "code": "2012",
     "message": "Use find instead of ls to better handle non-alphanumeric filenames."
   },
+  {
+    "file": "gsd-core/workflows/new-project/detail/elaboration.md",
+    "code": "2012",
+    "message": "Use find instead of ls to better handle non-alphanumeric filenames."
+  },
+  {
+    "file": "gsd-core/workflows/new-project/detail/elaboration.md",
+    "code": "2012",
+    "message": "Use find instead of ls to better handle non-alphanumeric filenames."
+  },
   {
     "file": "gsd-core/workflows/new-workspace.md",
     "code": "2164",

package/scripts/prompt-injection-scan.sh

@@ -179,6 +179,20 @@ ALLOWLIST=(
   # rendering, never a command. Same DEFECT.PROMPT-INJECTION-SCAN-COLLISION
   # class as the input-validator fixtures above.
   'tests/quick-batch.test.cjs'
+  # #4209 — the regression test pinning gsd-code-reviewer.md's untrusted-evidence
+  # contract discusses the injection attack it defends against (embedded
+  # redirection, "act as an instruction") without performing it. gsd-code-reviewer.md
+  # ITSELF is deliberately NOT allowlisted — R2 (#4209 review): a production prompt
+  # that ingests untrusted third-party output should stay in-scope for this scanner,
+  # not be exempted wholesale; its defense-contract wording was reworded instead to
+  # avoid literally spelling out the trigger phrase (see git blame on that section).
+  # Same DEFECT.PROMPT-INJECTION-SCAN-COLLISION class as the entries above.
+  'tests/code-review-pipeline-regression.test.cjs'
+  # #4209 agy-F1 regression test — a crafted-filename fixture containing the literal
+  # phrase "Ignore all prior instructions." to prove validatePaths rejects it before
+  # it ever reaches an external-reviewer prompt. Discusses/detects the attack pattern
+  # as test data, never performs it. Same class as the entries above.
+  'tests/reviewer-step-dispatch.test.cjs'
 )
 
 is_allowlisted() {

package/scripts/workflow-size.cjs

@@ -89,10 +89,149 @@ function measureWorkflows(dir = WORKFLOWS_DIR) {
   return measureMdFiles(dir);
 }
 
+/**
+ * #4261: the reserved margin, as a fraction of a tier's hard cap.
+ *
+ * The hard caps are red lines and stay exactly where they are. This is the
+ * second, softer level the caps never had: `execute-phase.md` already carries
+ * a hand-rolled version of this shape (a hard `< 93600` plus a `<= 93400`
+ * margin whose own message says it exists "so minor future edits don't
+ * re-trip the gate"), and it is the only capped file that does. Everywhere
+ * else a file is either fine or already over, with nothing in between — so
+ * the first signal a contributor gets is a failure, and by then the cheap
+ * moment to extract has passed.
+ *
+ * 95% is deliberately not derived from anything. It is the round number the
+ * issue proposed, and the census below is what makes it reviewable: if it
+ * turns out to name too many or too few files, that is visible in one table
+ * rather than argued from first principles.
+ */
+const MARGIN_RATIO = 0.95;
+
+/**
+ * The reserved-margin threshold for a hard cap, in bytes.
+ *
+ * Floor, not round: the margin must never land ON or above the cap it is
+ * meant to sit under, however small the cap.
+ *
+ * @param {number} cap - Tier hard cap in bytes.
+ * @returns {number} Margin threshold in bytes.
+ */
+function marginFor(cap) {
+  return Math.floor(cap * MARGIN_RATIO);
+}
+
+/**
+ * Build the headroom census for a set of measured files.
+ *
+ * Sorted by pressure (least headroom first) because that is the reading
+ * order that matters: the top row is the file that will break next.
+ *
+ * @param {Object<string, number>} sizes - Map of filename -> LF byte size.
+ * @param {function(string): {tier: string, cap: number}} capFor - Tier lookup, keyed by stem.
+ * @returns {Array<{name: string, tier: string, bytes: number, cap: number, margin: number, headroom: number, usedPct: number, overMargin: boolean}>}
+ */
+function buildHeadroomRows(sizes, capFor) {
+  return Object.entries(sizes)
+    .map(([file, bytes]) => {
+      const name = file.replace(/\.md$/, '');
+      const { tier, cap } = capFor(name);
+      const margin = marginFor(cap);
+      return {
+        name,
+        tier,
+        bytes,
+        cap,
+        margin,
+        headroom: cap - bytes,
+        usedPct: (bytes / cap) * 100,
+        overMargin: bytes > margin,
+      };
+    })
+    .sort((a, b) => a.headroom - b.headroom || a.name.localeCompare(b.name));
+}
+
+/**
+ * Render the census as a fixed-width text table for the test diagnostics.
+ *
+ * @param {ReturnType<typeof buildHeadroomRows>} rows
+ * @param {{limit?: number}} [opts] - How many rows to render (default: all).
+ * @returns {string[]} Lines, ready to hand to `t.diagnostic` one at a time.
+ */
+function formatHeadroomTable(rows, { limit = Infinity } = {}) {
+  const shown = rows.slice(0, limit);
+  const width = Math.max(4, ...shown.map((r) => r.name.length));
+  const head = `${'file'.padEnd(width)}  ${'tier'.padEnd(7)}  ${'bytes'.padStart(7)}  ${'cap'.padStart(7)}  ${'margin'.padStart(7)}  ${'headroom'.padStart(8)}  ${'used'.padStart(6)}`;
+  const body = shown.map(
+    (r) =>
+      `${r.name.padEnd(width)}  ${r.tier.padEnd(7)}  ${String(r.bytes).padStart(7)}  ${String(r.cap).padStart(7)}  ${String(r.margin).padStart(7)}  ${String(r.headroom).padStart(8)}  ${r.usedPct.toFixed(1).padStart(5)}%`,
+  );
+  return [head, ...body];
+}
+
+/**
+ * Render the census as a GitHub job-summary markdown table.
+ *
+ * Only the rows over the reserved margin: a job summary that lists all 124
+ * capped files is a log dump nobody reads, and every row below the margin is
+ * by definition not the problem. The count of the rest is still reported so
+ * an empty table cannot be mistaken for an unmeasured one.
+ *
+ * @param {string} title - Section heading (e.g. `'Agent size headroom'`).
+ * @param {ReturnType<typeof buildHeadroomRows>} rows
+ * @returns {string} Markdown block.
+ */
+function buildHeadroomSummaryMarkdown(title, rows) {
+  const pressured = rows.filter((r) => r.overMargin);
+  const lines = [`### ${title}`, ''];
+  if (pressured.length === 0) {
+    lines.push(`All ${rows.length} files are under the ${Math.round(MARGIN_RATIO * 100)}% reserved margin.`);
+    return `${lines.join('\n')}\n`;
+  }
+  lines.push(
+    `**${pressured.length} of ${rows.length}** files are over the ${Math.round(MARGIN_RATIO * 100)}% reserved margin.`,
+    '',
+    '| file | tier | bytes | cap | headroom | used |',
+    '| --- | --- | ---: | ---: | ---: | ---: |',
+  );
+  for (const r of pressured) {
+    lines.push(`| \`${r.name}\` | ${r.tier} | ${r.bytes} | ${r.cap} | ${r.headroom} | ${r.usedPct.toFixed(1)}% |`);
+  }
+  return `${lines.join('\n')}\n`;
+}
+
+/**
+ * Append a census block to `$GITHUB_STEP_SUMMARY` when running in CI.
+ *
+ * No-op off CI, and never throws: this is reporting, and a test suite must
+ * not go red because a summary file was not writable.
+ *
+ * @param {string} title - Section heading.
+ * @param {ReturnType<typeof buildHeadroomRows>} rows
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {boolean} Whether anything was written.
+ */
+function appendHeadroomStepSummary(title, rows, env = process.env) {
+  if (!env.GITHUB_STEP_SUMMARY) return false;
+  try {
+    fs.appendFileSync(env.GITHUB_STEP_SUMMARY, `${buildHeadroomSummaryMarkdown(title, rows)}\n`);
+    return true;
+  } catch (err) {
+    process.stderr.write(`workflow-size: could not write GITHUB_STEP_SUMMARY: ${err.message}\n`);
+    return false;
+  }
+}
+
 module.exports = {
   WORKFLOWS_DIR,
+  MARGIN_RATIO,
   lfByteCount,
   listWorkflowStems,
   measureMdFiles,
   measureWorkflows,
+  marginFor,
+  buildHeadroomRows,
+  formatHeadroomTable,
+  buildHeadroomSummaryMarkdown,
+  appendHeadroomStepSummary,
 };

package/skills/gsd-cleanup/SKILL.md

@@ -5,6 +5,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
   - AskUserQuestion
 ---
 

package/skills/gsd-code-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gsd-code-review
 description: "Review source files changed during a phase for bugs, security issues, and code quality problems"
-argument-hint: "<phase-number> [--depth=quick|standard|deep] [--files file1,file2,...] [--fix [--all] [--auto]]"
+argument-hint: "<phase-number> [--depth=quick|standard|deep] [--files file1,file2,...] [--fix [--all] [--auto]] [reviewer-lane flags]"
 allowed-tools:
   - Read
   - Bash
@@ -26,6 +26,7 @@ Arguments:
 - `--fix` (optional) — after review completes (or if REVIEW.md already exists), auto-apply fixes found. Spawns gsd-code-fixer agent. Accepts sub-flags:
   - `--all` — include Info findings in fix scope (default: Critical + Warning only)
   - `--auto` — enable fix + re-review iteration loop, capped at 3 iterations
+- Optional reviewer-lane flags (#4209) — any flag returned by `gsd_run review-lane flags` (the canonical reviewer-lane roster; e.g. `--codex`, `--agy`) requests that lane independently review the same already-resolved scope alongside the internal `gsd-code-reviewer` agent. Its findings are corroborating evidence only — `gsd-code-reviewer` alone verifies each claim against the actual source and writes REVIEW.md; there is exactly one REVIEW.md schema. No reviewer-lane flag (the default) reviews with only the internal agent, byte-for-byte unchanged from before #4209.
 
 Output: {padded_phase}-REVIEW.md in phase directory + inline summary of findings
 </objective>

package/skills/gsd-complete-milestone/SKILL.md

@@ -6,6 +6,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
 ---
 
 

package/skills/gsd-config/SKILL.md

@@ -6,6 +6,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
   - AskUserQuestion
 ---
 

package/skills/gsd-debug/SKILL.md

@@ -6,6 +6,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
   - Agent
   - AskUserQuestion
 ---

package/skills/gsd-graphify/SKILL.md

@@ -5,6 +5,7 @@ argument-hint: "[build|query <term>|status|diff]"
 allowed-tools:
   - Read
   - Bash
+  - Grep
 ---
 
 

package/skills/gsd-health/SKILL.md

@@ -5,6 +5,7 @@ argument-hint: "[--repair] [--context]"
 allowed-tools:
   - Read
   - Bash
+  - Grep
   - Write
   - AskUserQuestion
 ---

package/skills/gsd-mempalace-capture/SKILL.md

@@ -5,6 +5,7 @@ argument-hint: "[CONTEXT.md|PLAN.md|SUMMARY.md]"
 allowed-tools:
   - Read
   - Bash
+  - Grep
 ---
 
 

package/skills/gsd-mempalace-recall/SKILL.md

@@ -6,6 +6,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
 ---
 
 

package/skills/gsd-new-milestone/SKILL.md

@@ -6,6 +6,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
   - Agent
   - AskUserQuestion
 ---

package/skills/gsd-new-project/SKILL.md

@@ -5,6 +5,7 @@ argument-hint: "[--auto]"
 allowed-tools:
   - Read
   - Bash
+  - Grep
   - Write
   - Agent
   - AskUserQuestion

package/skills/gsd-next/SKILL.md

@@ -5,6 +5,7 @@ allowed-tools:
   - Read
   - Bash
   - Glob
+  - Grep
   - SlashCommand
   - AskUserQuestion
 ---

package/skills/gsd-pause-work/SKILL.md

@@ -6,6 +6,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
 ---
 
 

package/skills/gsd-phase/SKILL.md

@@ -7,6 +7,7 @@ allowed-tools:
   - Write
   - Bash
   - Glob
+  - Grep
 ---
 
 

package/skills/gsd-pr-branch/SKILL.md

@@ -4,6 +4,7 @@ description: "Create a clean PR branch by filtering out .planning/ commits — r
 argument-hint: "[target branch, default: main]"
 allowed-tools:
   - Bash
+  - Grep
   - Read
   - AskUserQuestion
 ---

package/skills/gsd-resume-work/SKILL.md

@@ -4,6 +4,7 @@ description: "Resume work from previous session with full context restoration"
 allowed-tools:
   - Read
   - Bash
+  - Grep
   - Write
   - AskUserQuestion
   - SlashCommand

package/skills/gsd-review-backlog/SKILL.md

@@ -5,6 +5,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
   - AskUserQuestion
 ---
 

package/skills/gsd-settings/SKILL.md

@@ -5,6 +5,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
   - AskUserQuestion
 ---
 
@@ -15,7 +16,7 @@ Interactive configuration of GSD workflow agents and model profile via multi-que
 Routes to the settings workflow which handles:
 - Config existence ensuring
 - Current settings reading and parsing
-- Interactive 5-question prompt (model, research, plan_check, verifier, branching)
+- Interactive multi-question prompt covering model profile and workflow toggles (research, plan_check, verifier, drift guard, TDD, code review, worktrees, compact content, and more — see `gsd-core/workflows/settings.md` for the current set)
 - Config merging and writing
 - Confirmation display with quick command references
 </objective>

package/skills/gsd-stats/SKILL.md

@@ -4,6 +4,7 @@ description: "Display project statistics — phases, plans, requirements, git me
 allowed-tools:
   - Read
   - Bash
+  - Grep
 ---
 
 <objective>

package/skills/gsd-thread/SKILL.md

@@ -6,6 +6,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
 ---
 
 

package/skills/gsd-workspace/SKILL.md

@@ -6,6 +6,7 @@ allowed-tools:
   - Read
   - Write
   - Bash
+  - Grep
   - AskUserQuestion
 ---
 

package/skills/gsd-workstreams/SKILL.md

@@ -4,6 +4,7 @@ description: "Manage parallel workstreams — list, create, switch, status, prog
 allowed-tools:
   - Read
   - Bash
+  - Grep
 ---
 
 

package/vscode/package.json

@@ -2,7 +2,7 @@
   "name": "gsd-core-vscode",
   "displayName": "GSD Core",
   "description": "GSD orchestration engine embedded in VS Code (ADR-1239 IDE profile).",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "publisher": "opengsd",
   "engines": {
     "vscode": "^1.105.0"

package/gsd-core/templates/claude-md.md

@@ -1,145 +0,0 @@
-# CLAUDE.md Template
-
-Template for project-root `CLAUDE.md` — auto-generated by `gsd-tools generate-claude-md`.
-
-Contains 7 marker-bounded sections. Each section is independently updatable.
-The `generate-claude-md` subcommand manages 6 sections (project, stack, conventions, architecture, skills, workflow enforcement).
-The profile section is managed exclusively by `generate-claude-profile`.
-
----
-
-## Section Templates
-
-### Project Section
-```
-<!-- GSD:project-start source:PROJECT.md -->
-## Project
-
-{{project_content}}
-<!-- GSD:project-end -->
-```
-
-**Fallback text:**
-```
-Project not yet initialized. Run /gsd:new-project to set up.
-```
-
-### Stack Section
-```
-<!-- GSD:stack-start source:STACK.md -->
-## Technology Stack
-
-{{stack_content}}
-<!-- GSD:stack-end -->
-```
-
-**Fallback text:**
-```
-Technology stack not yet documented. Will populate after codebase mapping or first phase.
-```
-
-### Conventions Section
-```
-<!-- GSD:conventions-start source:CONVENTIONS.md -->
-## Conventions
-
-{{conventions_content}}
-<!-- GSD:conventions-end -->
-```
-
-**Fallback text:**
-```
-Conventions not yet established. Will populate as patterns emerge during development.
-```
-
-### Architecture Section
-```
-<!-- GSD:architecture-start source:ARCHITECTURE.md -->
-## Architecture
-
-{{architecture_content}}
-<!-- GSD:architecture-end -->
-```
-
-**Fallback text:**
-```
-Architecture not yet mapped. Follow existing patterns found in the codebase.
-```
-
-### Skills Section
-```
-<!-- GSD:skills-start source:skills/ -->
-## Project Skills
-
-| Skill          | Description           | Path                      |
-| -------------- | --------------------- | ------------------------- |
-| {{skill_name}} | {{skill_description}} | `{{skill_path}}/SKILL.md` |
-<!-- GSD:skills-end -->
-```
-
-**Fallback text:**
-```
-No project skills found. Add skills to any of: `.claude/skills/`, `.agents/skills/`, `.cursor/skills/`, or `.github/skills/` with a `SKILL.md` index file.
-```
-
-**Discovery behavior:**
-- Scans `.claude/skills/`, `.agents/skills/`, `.cursor/skills/`, `.github/skills/` for subdirectories containing `SKILL.md`
-- Extracts `name` and `description` from YAML frontmatter (supports multi-line descriptions)
-- Skips GSD's own installed skills (directories starting with `gsd-`)
-- Deduplicates by skill name across directories
-
-### Workflow Enforcement Section
-```
-<!-- GSD:workflow-start source:GSD defaults -->
-## GSD Workflow Enforcement
-
-Before using Edit, Write, or other file-changing tools, start work through a GSD command so planning artifacts and execution context stay in sync.
-
-Use these entry points:
-- `/gsd:quick` for small fixes, doc updates, and ad-hoc tasks
-- `/gsd:debug` for investigation and bug fixing
-- `/gsd:execute-phase` for planned phase work
-
-Do not make direct repo edits outside a GSD workflow unless the user explicitly asks to bypass it.
-<!-- GSD:workflow-end -->
-```
-
-### Profile Section (Placeholder Only)
-```
-<!-- GSD:profile-start -->
-## Developer Profile
-
-> Profile not yet configured. Run `/gsd:profile-user` to generate your developer profile.
-> This section is managed by `generate-claude-profile` — do not edit manually.
-<!-- GSD:profile-end -->
-```
-
-**Note:** This section is NOT managed by `generate-claude-md`. It is managed exclusively
-by `generate-claude-profile`. The placeholder above is only used when creating a new
-CLAUDE.md file and no profile section exists yet.
-
----
-
-## Section Ordering
-
-1. **Project** — Identity and purpose (what this project is)
-2. **Stack** — Technology choices (what tools are used)
-3. **Conventions** — Code patterns and rules (how code is written)
-4. **Architecture** — System structure (how components fit together)
-5. **Skills** — Discovered project skills with name and description (what domain knowledge is available)
-6. **Workflow Enforcement** — Default GSD entry points for file-changing work
-7. **Profile** — Developer behavioral preferences (how to interact)
-
-## Marker Format
-
-- Start: `<!-- GSD:{name}-start source:{file} -->`
-- End: `<!-- GSD:{name}-end -->`
-- Source attribute enables targeted updates when source files change
-- Partial match on start marker (without closing `-->`) for detection
-
-## Fallback Behavior
-
-When a source file is missing, fallback text provides Claude-actionable guidance:
-- Guides Claude's behavior in the absence of data
-- Not placeholder ads or "missing" notices
-- Each fallback tells Claude what to do, not just what's absent