@tekyzinc/gsd-t 2.20.5 → 2.20.7

package/commands/Claude-md.md

@@ -1,3 +1,5 @@
+# Reload CLAUDE.md Directives
+
 Reload and apply CLAUDE.md directives for this session.
 
 1. Read `~/.claude/CLAUDE.md` (global directives). Note any changes from what you've been following.

package/commands/gsd-t-execute.md

@@ -44,8 +44,8 @@ For each task:
 8. **Run ALL tests** — unit, integration, and full Playwright suite. Fix any failures before proceeding (up to 2 attempts)
 9. Run the Pre-Commit Gate checklist from CLAUDE.md — update ALL affected docs BEFORE committing
 10. Commit with a descriptive message: `[{domain}] Task {N}: {description}`
-10. Update `.gsd-t/progress.md` — mark task complete
-11. If you've reached a CHECKPOINT in integration-points.md, pause and verify the contract before continuing
+11. Update `.gsd-t/progress.md` — mark task complete
+12. If you've reached a CHECKPOINT in integration-points.md, pause and verify the contract before continuing
 
 ### Team Mode (when agent teams are enabled)
 Spawn teammates for independent domains:
@@ -143,4 +143,17 @@ When all tasks in all domains are complete:
 
 **Level 1–2**: Report completion summary and recommend proceeding to integrate phase. Wait for confirmation.
 
+## Document Ripple
+
+Execute modifies source code, so the Pre-Commit Gate (referenced in Step 9) covers document updates. For clarity, the key documents affected by execution:
+
+### Always update:
+1. **`.gsd-t/progress.md`** — Mark tasks complete, update domain status, log execution summary
+
+### Check if affected (per task):
+2. **`.gsd-t/contracts/`** — Did a task change an API endpoint, schema, or component interface? Update the contract
+3. **`docs/requirements.md`** — Did a task implement or change a requirement? Mark it complete or revise
+4. **`docs/architecture.md`** — Did a task add/change a component or data flow? Update it
+5. **`.gsd-t/techdebt.md`** — Did a task resolve a debt item? Mark it done. Did it reveal new debt? Add it
+
 $ARGUMENTS

package/commands/gsd-t-scan.md

@@ -401,4 +401,20 @@ All detailed findings are in `.gsd-t/scan/` for review.
 
 Ask: "Want to promote any tech debt items to milestones? Or address the critical items first?"
 
+## Document Ripple
+
+Scan produces analysis files and updates living documents (Step 5 already covers most updates). Verify:
+
+### Always update:
+1. **`.gsd-t/progress.md`** — Log scan completion with summary stats in Decision Log
+2. **`docs/architecture.md`** — Merge scan findings (Step 5)
+3. **`docs/workflows.md`** — Merge business rules findings (Step 5)
+4. **`docs/infrastructure.md`** — Merge operational findings (Step 5)
+5. **`docs/requirements.md`** — Merge discovered requirements (Step 5)
+6. **`README.md`** — Update tech stack and setup if needed (Step 5)
+
+### Check if affected:
+7. **`.gsd-t/techdebt.md`** — Created/updated with all findings (Step 3)
+8. **`CLAUDE.md`** — If new conventions or patterns were discovered, suggest additions
+
 $ARGUMENTS

package/commands/gsd-t-test-sync.md

@@ -317,4 +317,15 @@ Generated 5 test tasks → added to current domain
 
 **Level 1–2**: Present the full report and wait for user input before proceeding.
 
+## Document Ripple
+
+### Always update:
+1. **`.gsd-t/progress.md`** — Log test sync results in Decision Log (standalone mode)
+2. **`.gsd-t/test-coverage.md`** — Created/updated with coverage report (Step 5)
+
+### Check if affected:
+3. **`docs/requirements.md`** — If test tasks map to requirements, update the Test Coverage table
+4. **`.gsd-t/domains/{current}/tasks.md`** — If test tasks were generated, append them (Step 6)
+5. **`.gsd-t/techdebt.md`** — If persistent test gaps were found, add as debt items
+
 $ARGUMENTS

package/commands/gsd-t-verify.md

@@ -157,4 +157,15 @@ Update `.gsd-t/progress.md`:
 - CONDITIONAL PASS → User decides if warnings are acceptable
 - FAIL → Return to execute phase for remediation tasks
 
+## Document Ripple
+
+### Always update:
+1. **`.gsd-t/progress.md`** — Set status to VERIFIED/VERIFY-FAILED, log verification summary
+2. **`.gsd-t/verify-report.md`** — Created with full verification results (Step 4)
+
+### Check if affected:
+3. **`.gsd-t/domains/{domain}/tasks.md`** — If remediation tasks were created (Step 5)
+4. **`.gsd-t/techdebt.md`** — If verification found new quality or security issues, add as debt
+5. **`docs/requirements.md`** — If verification revealed unmet requirements, update status
+
 $ARGUMENTS

package/package.json

@@ -1,35 +1,39 @@
-{
-  "name": "@tekyzinc/gsd-t",
-  "version": "2.20.5",
-  "description": "GSD-T: Contract-Driven Development for Claude Code — 41 slash commands with backlog management, impact analysis, test sync, and milestone archival",
-  "author": "Tekyz, Inc.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Tekyz-Inc/get-stuff-done-teams.git"
-  },
-  "homepage": "https://github.com/Tekyz-Inc/get-stuff-done-teams#readme",
-  "keywords": [
-    "claude-code",
-    "gsd",
-    "ai-development",
-    "agent-teams",
-    "contract-driven-development",
-    "slash-commands"
-  ],
-  "bin": {
-    "gsd-t": "bin/gsd-t.js"
-  },
-  "files": [
-    "bin/",
-    "commands/",
-    "scripts/",
-    "templates/",
-    "examples/",
-    "docs/",
-    "CHANGELOG.md"
-  ],
-  "engines": {
-    "node": ">=16.0.0"
-  }
-}
+{
+  "name": "@tekyzinc/gsd-t",
+  "version": "2.20.7",
+  "description": "GSD-T: Contract-Driven Development for Claude Code — 41 slash commands with backlog management, impact analysis, test sync, and milestone archival",
+  "author": "Tekyz, Inc.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Tekyz-Inc/get-stuff-done-teams.git"
+  },
+  "homepage": "https://github.com/Tekyz-Inc/get-stuff-done-teams#readme",
+  "keywords": [
+    "claude-code",
+    "gsd",
+    "ai-development",
+    "agent-teams",
+    "contract-driven-development",
+    "slash-commands"
+  ],
+  "main": "bin/gsd-t.js",
+  "bin": {
+    "gsd-t": "bin/gsd-t.js"
+  },
+  "scripts": {
+    "test": "node --test"
+  },
+  "files": [
+    "bin/",
+    "commands/",
+    "scripts/",
+    "templates/",
+    "examples/",
+    "docs/",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=16.0.0"
+  }
+}

package/scripts/gsd-t-heartbeat.js

@@ -1,156 +1,198 @@
-#!/usr/bin/env node
-
-/**
- * GSD-T Heartbeat — Claude Code Hook Event Writer
- *
- * Writes structured events to .gsd-t/heartbeat-{session_id}.jsonl
- * Installed as an async hook for multiple Claude Code events.
- *
- * Events captured:
- *   SessionStart, PostToolUse, SubagentStart, SubagentStop,
- *   TaskCompleted, TeammateIdle, Notification, Stop, SessionEnd
- */
-
-const fs = require("fs");
-const path = require("path");
-
-let input = "";
-process.stdin.setEncoding("utf8");
-process.stdin.on("data", (d) => (input += d));
-process.stdin.on("end", () => {
-  try {
-    const hook = JSON.parse(input);
-    const dir = hook.cwd || process.cwd();
-    const gsdtDir = path.join(dir, ".gsd-t");
-
-    if (!fs.existsSync(gsdtDir)) return;
-
-    const sid = hook.session_id || "unknown";
-    const file = path.join(gsdtDir, `heartbeat-${sid}.jsonl`);
-
-    const event = buildEvent(hook);
-    if (event) {
-      fs.appendFileSync(file, JSON.stringify(event) + "\n");
-    }
-  } catch (e) {
-    // Silent failure — never interfere with Claude Code
-  }
-});
-
-function buildEvent(hook) {
-  const base = {
-    ts: new Date().toISOString(),
-    sid: hook.session_id,
-  };
-
-  switch (hook.hook_event_name) {
-    case "SessionStart":
-      return {
-        ...base,
-        evt: "session_start",
-        data: { source: hook.source, model: hook.model },
-      };
-
-    case "PostToolUse":
-      return {
-        ...base,
-        evt: "tool",
-        tool: hook.tool_name,
-        data: summarize(hook.tool_name, hook.tool_input),
-      };
-
-    case "SubagentStart":
-      return {
-        ...base,
-        evt: "agent_spawn",
-        data: { agent_id: hook.agent_id, agent_type: hook.agent_type },
-      };
-
-    case "SubagentStop":
-      return {
-        ...base,
-        evt: "agent_stop",
-        data: { agent_id: hook.agent_id, agent_type: hook.agent_type },
-      };
-
-    case "TaskCompleted":
-      return {
-        ...base,
-        evt: "task_done",
-        data: { task: hook.task_subject, agent: hook.teammate_name },
-      };
-
-    case "TeammateIdle":
-      return {
-        ...base,
-        evt: "agent_idle",
-        data: { agent: hook.teammate_name, team: hook.team_name },
-      };
-
-    case "Notification":
-      return {
-        ...base,
-        evt: "notification",
-        data: { message: hook.message, title: hook.title },
-      };
-
-    case "Stop":
-      return { ...base, evt: "session_stop" };
-
-    case "SessionEnd":
-      return {
-        ...base,
-        evt: "session_end",
-        data: { reason: hook.reason },
-      };
-
-    default:
-      return null;
-  }
-}
-
-function summarize(tool, input) {
-  if (!tool || !input) return {};
-  switch (tool) {
-    case "Read":
-      return { file: shortPath(input.file_path) };
-    case "Edit":
-      return { file: shortPath(input.file_path) };
-    case "Write":
-      return { file: shortPath(input.file_path) };
-    case "Bash":
-      return {
-        cmd: (input.command || "").slice(0, 150),
-        desc: input.description,
-      };
-    case "Grep":
-      return { pattern: input.pattern, path: shortPath(input.path) };
-    case "Glob":
-      return { pattern: input.pattern };
-    case "Task":
-      return { desc: input.description, type: input.subagent_type };
-    case "WebSearch":
-      return { query: input.query };
-    case "WebFetch":
-      return { url: input.url };
-    case "NotebookEdit":
-      return { file: shortPath(input.notebook_path) };
-    default:
-      return {};
-  }
-}
-
-function shortPath(p) {
-  if (!p) return null;
-  // Convert absolute paths to relative for readability
-  const cwd = process.cwd();
-  if (p.startsWith(cwd)) {
-    return p.slice(cwd.length + 1).replace(/\\/g, "/");
-  }
-  // For home-dir paths, abbreviate
-  const home = require("os").homedir();
-  if (p.startsWith(home)) {
-    return "~" + p.slice(home.length).replace(/\\/g, "/");
-  }
-  return p.replace(/\\/g, "/");
-}
+#!/usr/bin/env node
+
+/**
+ * GSD-T Heartbeat — Claude Code Hook Event Writer
+ *
+ * Writes structured events to .gsd-t/heartbeat-{session_id}.jsonl
+ * Installed as an async hook for multiple Claude Code events.
+ *
+ * Events captured:
+ *   SessionStart, PostToolUse, SubagentStart, SubagentStop,
+ *   TaskCompleted, TeammateIdle, Notification, Stop, SessionEnd
+ */
+
+const fs = require("fs");
+const path = require("path");
+
+const MAX_STDIN = 1024 * 1024; // 1MB — prevent OOM from unbounded input
+const SAFE_SID = /^[a-zA-Z0-9_-]+$/; // Allowlist for session_id — blocks path traversal
+const MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days — auto-cleanup threshold
+
+let input = "";
+let aborted = false;
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (d) => {
+  input += d;
+  if (input.length > MAX_STDIN) {
+    aborted = true;
+    process.stdin.destroy();
+  }
+});
+process.stdin.on("end", () => {
+  if (aborted) return; // Silently discard oversized input
+  try {
+    const hook = JSON.parse(input);
+    const dir = hook.cwd || process.cwd();
+
+    // Validate cwd is absolute path
+    if (!path.isAbsolute(dir)) return;
+
+    const gsdtDir = path.join(dir, ".gsd-t");
+    if (!fs.existsSync(gsdtDir)) return;
+
+    const sid = hook.session_id || "unknown";
+
+    // Validate session_id — block path traversal (e.g., "../../etc/evil")
+    if (!SAFE_SID.test(sid)) return;
+
+    const file = path.join(gsdtDir, `heartbeat-${sid}.jsonl`);
+
+    // Verify resolved path is still within .gsd-t/ directory
+    const resolvedFile = path.resolve(file);
+    const resolvedDir = path.resolve(gsdtDir);
+    if (!resolvedFile.startsWith(resolvedDir + path.sep)) return;
+
+    const event = buildEvent(hook);
+    if (event) {
+      cleanupOldHeartbeats(gsdtDir);
+      fs.appendFileSync(file, JSON.stringify(event) + "\n");
+    }
+  } catch (e) {
+    // Silent failure — never interfere with Claude Code
+  }
+});
+
+function cleanupOldHeartbeats(gsdtDir) {
+  try {
+    const files = fs.readdirSync(gsdtDir);
+    const now = Date.now();
+    for (const f of files) {
+      if (!f.startsWith("heartbeat-") || !f.endsWith(".jsonl")) continue;
+      const fp = path.join(gsdtDir, f);
+      const stat = fs.statSync(fp);
+      if (now - stat.mtimeMs > MAX_AGE_MS) {
+        fs.unlinkSync(fp);
+      }
+    }
+  } catch {
+    // Silent failure — never interfere with Claude Code
+  }
+}
+
+function buildEvent(hook) {
+  const base = {
+    ts: new Date().toISOString(),
+    sid: hook.session_id,
+  };
+
+  switch (hook.hook_event_name) {
+    case "SessionStart":
+      return {
+        ...base,
+        evt: "session_start",
+        data: { source: hook.source, model: hook.model },
+      };
+
+    case "PostToolUse":
+      return {
+        ...base,
+        evt: "tool",
+        tool: hook.tool_name,
+        data: summarize(hook.tool_name, hook.tool_input),
+      };
+
+    case "SubagentStart":
+      return {
+        ...base,
+        evt: "agent_spawn",
+        data: { agent_id: hook.agent_id, agent_type: hook.agent_type },
+      };
+
+    case "SubagentStop":
+      return {
+        ...base,
+        evt: "agent_stop",
+        data: { agent_id: hook.agent_id, agent_type: hook.agent_type },
+      };
+
+    case "TaskCompleted":
+      return {
+        ...base,
+        evt: "task_done",
+        data: { task: hook.task_subject, agent: hook.teammate_name },
+      };
+
+    case "TeammateIdle":
+      return {
+        ...base,
+        evt: "agent_idle",
+        data: { agent: hook.teammate_name, team: hook.team_name },
+      };
+
+    case "Notification":
+      return {
+        ...base,
+        evt: "notification",
+        data: { message: hook.message, title: hook.title },
+      };
+
+    case "Stop":
+      return { ...base, evt: "session_stop" };
+
+    case "SessionEnd":
+      return {
+        ...base,
+        evt: "session_end",
+        data: { reason: hook.reason },
+      };
+
+    default:
+      return null;
+  }
+}
+
+function summarize(tool, input) {
+  if (!tool || !input) return {};
+  switch (tool) {
+    case "Read":
+      return { file: shortPath(input.file_path) };
+    case "Edit":
+      return { file: shortPath(input.file_path) };
+    case "Write":
+      return { file: shortPath(input.file_path) };
+    case "Bash":
+      return {
+        cmd: (input.command || "").slice(0, 150),
+        desc: input.description,
+      };
+    case "Grep":
+      return { pattern: input.pattern, path: shortPath(input.path) };
+    case "Glob":
+      return { pattern: input.pattern };
+    case "Task":
+      return { desc: input.description, type: input.subagent_type };
+    case "WebSearch":
+      return { query: input.query };
+    case "WebFetch":
+      return { url: input.url };
+    case "NotebookEdit":
+      return { file: shortPath(input.notebook_path) };
+    default:
+      return {};
+  }
+}
+
+function shortPath(p) {
+  if (!p) return null;
+  // Convert absolute paths to relative for readability
+  const cwd = process.cwd();
+  if (p.startsWith(cwd)) {
+    return p.slice(cwd.length + 1).replace(/\\/g, "/");
+  }
+  // For home-dir paths, abbreviate
+  const home = require("os").homedir();
+  if (p.startsWith(home)) {
+    return "~" + p.slice(home.length).replace(/\\/g, "/");
+  }
+  return p.replace(/\\/g, "/");
+}