@opengsd/gsd-core 1.2.0-rc.1

package/get-shit-done/bin/lib/runtime-slash.cjs

@@ -0,0 +1,112 @@
+'use strict';
+
+const { canonicalizeRuntimeName, resolveRuntimeNameFromCandidates } = require('./runtime-name-policy.cjs');
+
+/**
+ * runtime-slash.cjs — single source of truth for emitting GSD slash-command
+ * references in user-facing runtime output (recommended-actions JSON, persisted
+ * ROADMAP.md entries, verify/validate fix hints, error messages, etc.).
+ *
+ * Background: #2808 unified all GSD skill installs to register under the hyphen
+ * form (`name: gsd-<cmd>`). The legacy colon form `/gsd:<cmd>` is no longer
+ * routable by Claude Code skill installs, but ~50 runtime emissions in
+ * bin/lib/*.cjs still hardcoded it (#3584). Codex installs need the shell-var
+ * `$gsd-<cmd>` form. This module is the only place the runtime should decide
+ * which shape to emit.
+ *
+ *   - codex:                                   $gsd-<cmd>   (shell-var syntax)
+ *   - claude, cursor, opencode, kilo, etc.:    /gsd-<cmd>
+ *
+ * The colon form is never emitted.
+ */
+
+function formatGsdSlash(commandName, runtime) {
+  if (typeof commandName !== 'string') return commandName;
+  if (commandName === '') return commandName;
+
+  // Strip any existing leading prefix so the helper is idempotent and accepts
+  // both legacy `/gsd:<name>` and canonical hyphen-form input (plus the bare
+  // `gsd:<name>` shorthand and codex `$gsd-<name>` shell-var input).
+  const stripped = commandName.replace(/^[/$]?gsd[-:]/i, '');
+  // If the regex matched nothing (no prefix), the input is already a bare name.
+  const bare = stripped === commandName ? commandName : stripped;
+  // Defensive: a degenerate input like `/gsd:`, `gsd-`, or whitespace-only
+  // normalizes to empty. Returning the original colon-form would re-emit the
+  // deprecated shape that this module exists to suppress (#3584). Return an
+  // empty string so callers see "no command" rather than the broken input.
+  if (bare === '' || bare.trim() === '') return '';
+
+  // Split on the first whitespace so only the command token is rewritten —
+  // anything after the first space is caller-supplied arguments (phase
+  // numbers, --flags, --paths C:\\Users\\Me, etc.) that must round-trip
+  // untouched. Codex lowercases only the command token; preserving the
+  // argument tail prevents path/flag corruption on case-sensitive systems.
+  const wsMatch = bare.match(/^(\S+)(\s[\s\S]*)?$/);
+  const token = wsMatch ? wsMatch[1] : bare;
+  const tail = wsMatch && wsMatch[2] ? wsMatch[2] : '';
+
+  const runtimeText = String(runtime || 'claude').toLowerCase();
+  const rt = canonicalizeRuntimeName(runtimeText) || runtimeText;
+  if (rt === 'codex') {
+    // Codex skills are invoked as $gsd-<cmd> (shell-var syntax). The command
+    // token is lowercased because shell-var identifiers are conventionally
+    // lowercase; matches the convertCodexSlash() projection in bin/install.js.
+    return `$gsd-${token.toLowerCase()}${tail}`;
+  }
+  return `/gsd-${token}${tail}`;
+}
+
+/**
+ * Resolve the effective runtime for a project directory.
+ *
+ *   process.env.GSD_RUNTIME  >  config.runtime  >  'claude'
+ *
+ * Mirrors the precedence already used by profile-output.cjs and the rest of
+ * the runtime resolution chain. Returns a lowercased string so downstream
+ * comparisons can be case-blind.
+ *
+ * @param {string|null|undefined} projectDir
+ * @returns {string}
+ */
+function resolveRuntime(projectDir) {
+  const envRuntime = resolveRuntimeNameFromCandidates(process.env.GSD_RUNTIME);
+  if (envRuntime) return envRuntime;
+  if (projectDir) {
+    try {
+      // Read config.json directly (not via loadConfig). loadConfig has a side
+      // effect of normalizing and re-writing legacy keys back to disk, which
+      // would mutate the project file just to read the runtime name. We only
+      // need the literal `runtime:` value, so a plain JSON read is sufficient
+      // and side-effect-free.
+      const fs = require('fs');
+      const path = require('path');
+      const configPath = path.join(projectDir, '.planning', 'config.json');
+      if (fs.existsSync(configPath)) {
+        const raw = fs.readFileSync(configPath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && parsed.runtime) {
+          const configRuntime = resolveRuntimeNameFromCandidates(parsed.runtime);
+          if (configRuntime) return configRuntime;
+        }
+      }
+    } catch {
+      // Fall through to default — a missing/broken config must not crash
+      // runtime output formatting.
+    }
+  }
+  return 'claude';
+}
+
+/**
+ * Convenience: format using the runtime resolved from a project directory.
+ * Equivalent to `formatGsdSlash(name, resolveRuntime(projectDir))`.
+ */
+function formatGsdSlashFor(projectDir, commandName) {
+  return formatGsdSlash(commandName, resolveRuntime(projectDir));
+}
+
+module.exports = {
+  formatGsdSlash,
+  resolveRuntime,
+  formatGsdSlashFor,
+};

package/get-shit-done/bin/lib/schema-detect.cjs

@@ -0,0 +1,165 @@
+'use strict';
+
+/**
+ * Schema Drift Detection — detects schema-relevant file changes and verifies
+ * that the appropriate database push command was executed during a phase.
+ * This module does not read the filesystem directly.
+ */
+
+// ─── ORM Patterns ───────────────────────────────────────────────────────────
+const SCHEMA_PATTERNS = [
+    { pattern: /^src\/collections\/.*\.ts$/, orm: 'payload' },
+    { pattern: /^src\/globals\/.*\.ts$/, orm: 'payload' },
+    { pattern: /^prisma\/schema\.prisma$/, orm: 'prisma' },
+    { pattern: /^prisma\/schema\/.*\.prisma$/, orm: 'prisma' },
+    { pattern: /^drizzle\/schema\.ts$/, orm: 'drizzle' },
+    { pattern: /^src\/db\/schema\.ts$/, orm: 'drizzle' },
+    { pattern: /^drizzle\/.*\.ts$/, orm: 'drizzle' },
+    { pattern: /^supabase\/migrations\/.*\.sql$/, orm: 'supabase' },
+    { pattern: /^src\/entities\/.*\.ts$/, orm: 'typeorm' },
+    { pattern: /^src\/migrations\/.*\.ts$/, orm: 'typeorm' },
+];
+
+// ─── Push Commands & Evidence Patterns ──────────────────────────────────────
+const ORM_INFO = {
+    payload: {
+        pushCommand: 'npx payload migrate',
+        envHint: 'CI=true PAYLOAD_MIGRATING=true npx payload migrate',
+        interactiveWarning: 'Payload migrate may require interactive prompts — use CI=true PAYLOAD_MIGRATING=true to suppress',
+        evidencePatterns: [/payload\s+migrate/i, /PAYLOAD_MIGRATING/],
+    },
+    prisma: {
+        pushCommand: 'npx prisma db push',
+        envHint: 'npx prisma db push --accept-data-loss (if destructive changes are intended)',
+        interactiveWarning: 'Prisma db push may prompt for confirmation on destructive changes — use --accept-data-loss to bypass',
+        evidencePatterns: [/prisma\s+db\s+push/i, /prisma\s+migrate\s+deploy/i, /prisma\s+migrate\s+dev/i],
+    },
+    drizzle: {
+        pushCommand: 'npx drizzle-kit push',
+        envHint: 'npx drizzle-kit push',
+        interactiveWarning: null,
+        evidencePatterns: [/drizzle-kit\s+push/i, /drizzle-kit\s+migrate/i],
+    },
+    supabase: {
+        pushCommand: 'supabase db push',
+        envHint: 'supabase db push',
+        interactiveWarning: 'Supabase db push may require authentication — ensure SUPABASE_ACCESS_TOKEN is set',
+        evidencePatterns: [/supabase\s+db\s+push/i, /supabase\s+migration\s+up/i],
+    },
+    typeorm: {
+        pushCommand: 'npx typeorm migration:run',
+        envHint: 'npx typeorm migration:run -d src/data-source.ts',
+        interactiveWarning: null,
+        evidencePatterns: [/typeorm\s+migration:run/i, /typeorm\s+schema:sync/i],
+    },
+};
+
+// ─── Public API ──────────────────────────────────────────────────────────────
+function detectSchemaFiles(files) {
+    const matches = [];
+    const orms = new Set();
+    for (const rawFile of files) {
+        const file = rawFile.replace(/\\/g, '/');
+        for (const { pattern, orm } of SCHEMA_PATTERNS) {
+            if (pattern.test(file)) {
+                matches.push(rawFile);
+                orms.add(orm);
+                break;
+            }
+        }
+    }
+    return {
+        detected: matches.length > 0,
+        matches,
+        orms: [...orms],
+    };
+}
+
+function detectSchemaOrm(ormName) {
+  return ORM_INFO[ormName] || null;
+}
+
+function checkSchemaDrift(changedFiles, executionLog, options = {}) {
+    const { skipCheck = false } = options;
+    const detection = detectSchemaFiles(changedFiles);
+    if (!detection.detected) {
+        return {
+            driftDetected: false,
+            blocking: false,
+            schemaFiles: [],
+            orms: [],
+            unpushedOrms: [],
+            message: '',
+        };
+    }
+    const pushedOrms = new Set();
+    const unpushedOrms = [];
+    for (const orm of detection.orms) {
+        const info = ORM_INFO[orm];
+        if (!info)
+            continue;
+        const hasPushEvidence = info.evidencePatterns.some(p => p.test(executionLog));
+        if (hasPushEvidence) {
+            pushedOrms.add(orm);
+        }
+        else {
+            unpushedOrms.push(orm);
+        }
+    }
+    const driftDetected = unpushedOrms.length > 0;
+    if (!driftDetected) {
+        return {
+            driftDetected: false,
+            blocking: false,
+            schemaFiles: detection.matches,
+            orms: detection.orms,
+            unpushedOrms: [],
+            message: '',
+        };
+    }
+    const pushCommands = unpushedOrms
+        .map(orm => {
+        const info = ORM_INFO[orm];
+        return info ? `  ${orm}: ${info.envHint || info.pushCommand}` : null;
+    })
+        .filter(Boolean)
+        .join('\n');
+    const message = [
+        'Schema drift detected: schema-relevant files changed but no database push was executed.',
+        '',
+        `Schema files changed: ${detection.matches.join(', ')}`,
+        `ORMs requiring push: ${unpushedOrms.join(', ')}`,
+        '',
+        'Required push commands:',
+        pushCommands,
+        '',
+        'Run the appropriate push command, or set GSD_SKIP_SCHEMA_CHECK=true to bypass this gate.',
+    ].join('\n');
+    if (skipCheck) {
+        return {
+            driftDetected: true,
+            blocking: false,
+            skipped: true,
+            schemaFiles: detection.matches,
+            orms: detection.orms,
+            unpushedOrms,
+            message: 'Schema drift detected but check was skipped (GSD_SKIP_SCHEMA_CHECK=true).',
+        };
+    }
+    return {
+        driftDetected: true,
+        blocking: true,
+        schemaFiles: detection.matches,
+        orms: detection.orms,
+        unpushedOrms,
+        message,
+    };
+}
+
+module.exports = {
+  SCHEMA_PATTERNS,
+  ORM_INFO,
+  detectSchemaFiles,
+  detectSchemaOrm,
+  checkSchemaDrift,
+};

package/get-shit-done/bin/lib/secrets.cjs

@@ -0,0 +1,32 @@
+'use strict';
+
+/**
+ * Secrets handling — masking convention for API keys and other
+ * credentials managed via /gsd-settings-integrations.
+ * This module does not read the filesystem.
+ */
+
+const SECRET_CONFIG_KEYS = new Set([
+  'brave_search',
+  'firecrawl',
+  'exa_search',
+]);
+
+function isSecretKey(keyPath) {
+    return SECRET_CONFIG_KEYS.has(keyPath);
+}
+
+function maskSecret(value) {
+    if (value === null || value === undefined || value === '')
+        return '(unset)';
+    const s = String(value);
+    if (s.length < 8)
+        return '****';
+    return '****' + s.slice(-4);
+}
+
+function maskIfSecret(keyPath, value) {
+    return isSecretKey(keyPath) ? maskSecret(value) : value;
+}
+
+module.exports = { SECRET_CONFIG_KEYS, isSecretKey, maskSecret, maskIfSecret };