@tekyzinc/gsd-t 2.50.12 → 2.53.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (99) hide show
  1. package/CHANGELOG.md +24 -0
  2. package/README.md +379 -372
  3. package/bin/component-registry.js +250 -0
  4. package/bin/graph-cgc.js +510 -510
  5. package/bin/graph-indexer.js +147 -147
  6. package/bin/graph-overlay.js +195 -195
  7. package/bin/graph-parsers.js +327 -327
  8. package/bin/graph-query.js +453 -452
  9. package/bin/graph-store.js +154 -154
  10. package/bin/qa-calibrator.js +194 -0
  11. package/bin/scan-data-collector.js +153 -153
  12. package/bin/scan-diagrams-generators.js +187 -187
  13. package/bin/scan-diagrams.js +79 -79
  14. package/bin/scan-renderer.js +92 -92
  15. package/bin/scan-report-sections.js +121 -121
  16. package/bin/scan-report.js +184 -184
  17. package/bin/scan-schema-parsers.js +199 -199
  18. package/bin/scan-schema.js +103 -103
  19. package/bin/token-budget.js +246 -0
  20. package/commands/Claude-md.md +10 -10
  21. package/commands/branch.md +15 -15
  22. package/commands/checkin.md +45 -45
  23. package/commands/global-change.md +209 -209
  24. package/commands/gsd-t-audit.md +199 -0
  25. package/commands/gsd-t-backlog-add.md +94 -94
  26. package/commands/gsd-t-backlog-edit.md +111 -111
  27. package/commands/gsd-t-backlog-list.md +63 -63
  28. package/commands/gsd-t-backlog-move.md +94 -94
  29. package/commands/gsd-t-backlog-promote.md +123 -123
  30. package/commands/gsd-t-backlog-remove.md +86 -86
  31. package/commands/gsd-t-backlog-settings.md +158 -158
  32. package/commands/gsd-t-complete-milestone.md +528 -515
  33. package/commands/gsd-t-debug.md +506 -399
  34. package/commands/gsd-t-discuss.md +174 -174
  35. package/commands/gsd-t-execute.md +758 -634
  36. package/commands/gsd-t-feature.md +276 -276
  37. package/commands/gsd-t-health.md +142 -142
  38. package/commands/gsd-t-help.md +465 -457
  39. package/commands/gsd-t-impact.md +302 -302
  40. package/commands/gsd-t-init.md +320 -280
  41. package/commands/gsd-t-integrate.md +365 -249
  42. package/commands/gsd-t-milestone.md +87 -87
  43. package/commands/gsd-t-partition.md +442 -361
  44. package/commands/gsd-t-pause.md +82 -82
  45. package/commands/gsd-t-plan.md +345 -344
  46. package/commands/gsd-t-populate.md +111 -111
  47. package/commands/gsd-t-prd.md +326 -326
  48. package/commands/gsd-t-project.md +211 -211
  49. package/commands/gsd-t-promote-debt.md +123 -123
  50. package/commands/gsd-t-prompt.md +137 -137
  51. package/commands/gsd-t-qa.md +266 -266
  52. package/commands/gsd-t-quick.md +357 -234
  53. package/commands/gsd-t-reflect.md +134 -134
  54. package/commands/gsd-t-resume.md +72 -72
  55. package/commands/gsd-t-scan.md +615 -615
  56. package/commands/gsd-t-setup.md +76 -0
  57. package/commands/gsd-t-status.md +192 -166
  58. package/commands/gsd-t-test-sync.md +381 -381
  59. package/commands/gsd-t-triage-and-merge.md +171 -171
  60. package/commands/gsd-t-verify.md +382 -382
  61. package/commands/gsd-t-visualize.md +118 -118
  62. package/commands/gsd-t-wave.md +401 -378
  63. package/docs/GSD-T-README.md +425 -422
  64. package/docs/architecture.md +385 -369
  65. package/docs/harness-design-analysis.md +371 -0
  66. package/docs/infrastructure.md +205 -205
  67. package/docs/prd-graph-engine.md +398 -398
  68. package/docs/prd-gsd2-hybrid.md +559 -559
  69. package/docs/prd-harness-evolution.md +583 -0
  70. package/docs/requirements.md +14 -0
  71. package/docs/workflows.md +226 -226
  72. package/examples/.gsd-t/domains/example-domain/scope.md +13 -13
  73. package/package.json +40 -40
  74. package/scripts/gsd-t-auto-route.js +39 -39
  75. package/scripts/gsd-t-dashboard-mockup.html +1143 -1143
  76. package/scripts/gsd-t-dashboard-server.js +171 -171
  77. package/scripts/gsd-t-dashboard.html +262 -262
  78. package/scripts/gsd-t-event-writer.js +128 -128
  79. package/scripts/gsd-t-statusline.js +94 -94
  80. package/scripts/gsd-t-tools.js +175 -175
  81. package/templates/CLAUDE-global.md +639 -614
  82. package/templates/CLAUDE-project.md +24 -0
  83. package/templates/backlog-settings.md +18 -18
  84. package/templates/backlog.md +1 -1
  85. package/templates/progress.md +40 -40
  86. package/templates/shared-services-contract.md +60 -60
  87. package/templates/stacks/desktop.ini +2 -2
  88. package/bin/desktop.ini +0 -2
  89. package/commands/desktop.ini +0 -2
  90. package/docs/ci-examples/desktop.ini +0 -2
  91. package/docs/desktop.ini +0 -2
  92. package/examples/.gsd-t/contracts/desktop.ini +0 -2
  93. package/examples/.gsd-t/desktop.ini +0 -2
  94. package/examples/.gsd-t/domains/desktop.ini +0 -2
  95. package/examples/.gsd-t/domains/example-domain/desktop.ini +0 -2
  96. package/examples/desktop.ini +0 -2
  97. package/examples/rules/desktop.ini +0 -2
  98. package/scripts/desktop.ini +0 -2
  99. package/templates/desktop.ini +0 -2
@@ -1,205 +1,205 @@
1
- # Infrastructure — GSD-T Framework (@tekyzinc/gsd-t)
2
-
3
- ## Last Updated: 2026-03-22 (M23 — Headless Mode)
4
-
5
- ## Quick Reference
6
-
7
- | Task | Command |
8
- |------|---------|
9
- | Install GSD-T | `npx @tekyzinc/gsd-t install` |
10
- | Check status | `npx @tekyzinc/gsd-t status` |
11
- | Update GSD-T | `npx @tekyzinc/gsd-t update` |
12
- | Update all projects | `npx @tekyzinc/gsd-t update-all` |
13
- | Diagnose issues | `npx @tekyzinc/gsd-t doctor` |
14
- | View changelog | `npx @tekyzinc/gsd-t changelog` |
15
- | Register project | `npx @tekyzinc/gsd-t register` |
16
- | Publish to npm | `npm publish` (runs `npm test` automatically via prepublishOnly) |
17
- | Headless exec | `gsd-t headless <command> [--json] [--timeout=N] [--log]` |
18
- | Headless query | `gsd-t headless query <type>` (no LLM, <100ms) |
19
-
20
- ## Local Development
21
-
22
- ### Setup
23
- ```bash
24
- # Clone and install
25
- git clone https://github.com/Tekyz-Inc/get-stuff-done-teams.git
26
- cd get-stuff-done-teams
27
-
28
- # No npm install needed — zero dependencies
29
- # Test the CLI directly:
30
- node bin/gsd-t.js status
31
- ```
32
-
33
- ### Testing
34
- ```bash
35
- # Run automated test suite (205 tests, zero dependencies)
36
- npm test
37
-
38
- # Test CLI subcommands manually
39
- node bin/gsd-t.js install
40
- node bin/gsd-t.js status
41
- node bin/gsd-t.js doctor
42
- node bin/gsd-t.js init test-project
43
-
44
- # Validate command files exist
45
- ls commands/*.md | wc -l # Should be 48
46
- ls templates/*.md | wc -l # Should be 9
47
-
48
- # Test new utility scripts
49
- node scripts/gsd-t-tools.js validate
50
- node scripts/gsd-t-tools.js git pre-commit-check
51
-
52
- # Test scan visual output
53
- node bin/gsd-t.js scan --export html
54
- # Output: scan-report.html (self-contained, no external deps)
55
-
56
- # Test dashboard server
57
- node scripts/gsd-t-dashboard-server.js --port 7433 --detach
58
- # Browser: http://localhost:7433
59
- node scripts/gsd-t-dashboard-server.js --stop
60
- ```
61
-
62
- ### Scripts
63
- | Script | Purpose |
64
- |--------|---------|
65
- | `scripts/gsd-t-heartbeat.js` | Claude Code hook event logger (JSONL output, secret scrubbing) |
66
- | `scripts/npm-update-check.js` | Background npm registry version checker (path-validated) |
67
- | `scripts/gsd-t-fetch-version.js` | Synchronous npm registry fetch (5s timeout, 1MB limit) |
68
- | `scripts/gsd-t-tools.js` | State utility CLI — state get/set, validate, list, git check, template read (M13) |
69
- | `scripts/gsd-t-statusline.js` | Context usage bar + project state for Claude Code statusLine setting (M13) |
70
- | `scripts/gsd-t-event-writer.js` | Structured JSONL event appender CLI — writes to .gsd-t/events/ (M14) |
71
- | `scripts/gsd-t-dashboard-server.js` | Zero-dep SSE server for real-time dashboard — port 7433 (M15) |
72
- | `scripts/gsd-t-auto-route.js` | UserPromptSubmit hook — auto-routes plain text via /gsd in GSD-T projects (M16) |
73
- | `scripts/gsd-t-update-check.js` | SessionStart hook — fetches latest npm version, auto-updates GSD-T (M16) |
74
- | `bin/scan-schema.js` | ORM/DB schema detector + extractor — 7 ORM types (M17) |
75
- | `bin/scan-diagrams.js` | Diagram orchestrator — 6 diagram types, renders to SVG or placeholder (M17) |
76
- | `bin/scan-report.js` | Self-contained HTML scan report generator (M17) |
77
- | `bin/scan-export.js` | Export subcommand — DOCX (pandoc) + PDF (md-to-pdf) stubs (M17) |
78
-
79
- ## Distribution
80
-
81
- ### npm Package
82
- - **Registry**: https://www.npmjs.com/package/@tekyzinc/gsd-t
83
- - **Publish**: `npm publish` (requires npm login with Tekyz account)
84
- - **Version**: Managed in `package.json`, synced to `.gsd-t/progress.md`
85
- - **Files shipped**: `bin/`, `commands/`, `scripts/`, `templates/`, `examples/`, `docs/`, `CHANGELOG.md`
86
-
87
- ### Installed Locations
88
- | What | Where |
89
- |------|-------|
90
- | Slash commands (48 files) | `~/.claude/commands/` |
91
- | Global config | `~/.claude/CLAUDE.md` |
92
- | Heartbeat script | `~/.claude/scripts/gsd-t-heartbeat.js` |
93
- | State utility CLI | `~/.claude/scripts/gsd-t-tools.js` |
94
- | Statusline script | `~/.claude/scripts/gsd-t-statusline.js` |
95
- | Hook configuration | `~/.claude/settings.json` (hooks section) |
96
- | Version file | `~/.claude/.gsd-t-version` |
97
- | Update cache | `~/.claude/.gsd-t-update-check` |
98
- | Project registry | `~/.claude/.gsd-t-projects` |
99
-
100
- ## Repository Structure
101
-
102
- ```
103
- get-stuff-done-teams/
104
- ├── bin/gsd-t.js — CLI installer (~1,438 lines, zero dependencies)
105
- ├── commands/ — 45 slash command files (41 GSD-T + 4 utility)
106
- ├── scripts/ — 5 hook/utility scripts (added gsd-t-tools.js, gsd-t-statusline.js in M13)
107
- ├── templates/ — 9 document templates
108
- ├── examples/ — Reference project structure
109
- ├── docs/ — Methodology + living docs
110
- ├── .gsd-t/ — GSD-T state (self-managed)
111
- └── package.json — npm package config
112
- ```
113
-
114
- ## Headless Mode (M23)
115
-
116
- Headless mode enables non-interactive GSD-T execution for CI/CD pipelines and overnight builds.
117
-
118
- ### headless exec
119
-
120
- Wraps `claude -p "/user:gsd-t-{command} {args}"` for unattended execution.
121
-
122
- ```bash
123
- gsd-t headless verify --json --timeout=1200 --log
124
- gsd-t headless execute --timeout=3600
125
- gsd-t headless wave --json
126
- ```
127
-
128
- **Flags:**
129
- | Flag | Default | Description |
130
- |------|---------|-------------|
131
- | `--json` | off | Output structured JSON envelope |
132
- | `--timeout=N` | 300s | Kill process after N seconds |
133
- | `--log` | off | Write output to `.gsd-t/headless-{timestamp}.log` |
134
-
135
- **Exit codes:**
136
- | Code | Meaning |
137
- |------|---------|
138
- | 0 | success |
139
- | 1 | verify-fail (tests or quality gates failed) |
140
- | 2 | context-budget-exceeded (split the milestone) |
141
- | 3 | error (claude CLI error or process failure) |
142
- | 4 | blocked-needs-human (requires manual intervention) |
143
-
144
- **JSON envelope shape (--json flag):**
145
- ```json
146
- {
147
- "success": true,
148
- "exitCode": 0,
149
- "gsdtExitCode": 0,
150
- "command": "verify",
151
- "args": [],
152
- "output": "...",
153
- "timestamp": "2026-03-22T10:00:00.000Z",
154
- "duration": 42150,
155
- "logFile": ".gsd-t/headless-1742641200000.log"
156
- }
157
- ```
158
-
159
- ### headless query
160
-
161
- Pure Node.js file parsing — no LLM calls, <100ms response.
162
-
163
- ```bash
164
- gsd-t headless query status # Version, milestone, phase
165
- gsd-t headless query domains # Domain list with flags
166
- gsd-t headless query contracts # Contract file list
167
- gsd-t headless query debt # Tech debt items
168
- gsd-t headless query context # Token log summary
169
- gsd-t headless query backlog # Backlog items
170
- gsd-t headless query graph # Graph index metadata
171
- ```
172
-
173
- All queries return JSON to stdout.
174
-
175
- ### CI/CD Integration
176
-
177
- Example workflow files are in `docs/ci-examples/`:
178
- - `github-actions.yml` — GitHub Actions workflow with verify + status gate jobs
179
- - `gitlab-ci.yml` — GitLab CI pipeline with status/verify/report stages
180
-
181
- **Quick setup for GitHub Actions:**
182
- ```yaml
183
- - name: GSD-T Verify
184
- env:
185
- ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
186
- run: gsd-t headless verify --json --timeout=1200
187
- ```
188
-
189
- **Quick setup for GitLab CI:**
190
- ```yaml
191
- gsd-t-verify:
192
- script:
193
- - gsd-t headless verify --json --timeout=1200
194
- variables:
195
- ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
196
- ```
197
-
198
- ## Security Notes
199
-
200
- - Zero npm dependencies — no supply chain risk
201
- - All file writes check for symlinks first
202
- - Input validation on project names, versions, session IDs, paths
203
- - Heartbeat stdin capped at 1MB
204
- - HTTP requests use HTTPS with timeouts
205
- - Init operations use exclusive file creation (`{ flag: "wx" }`)
1
+ # Infrastructure — GSD-T Framework (@tekyzinc/gsd-t)
2
+
3
+ ## Last Updated: 2026-03-22 (M23 — Headless Mode)
4
+
5
+ ## Quick Reference
6
+
7
+ | Task | Command |
8
+ |------|---------|
9
+ | Install GSD-T | `npx @tekyzinc/gsd-t install` |
10
+ | Check status | `npx @tekyzinc/gsd-t status` |
11
+ | Update GSD-T | `npx @tekyzinc/gsd-t update` |
12
+ | Update all projects | `npx @tekyzinc/gsd-t update-all` |
13
+ | Diagnose issues | `npx @tekyzinc/gsd-t doctor` |
14
+ | View changelog | `npx @tekyzinc/gsd-t changelog` |
15
+ | Register project | `npx @tekyzinc/gsd-t register` |
16
+ | Publish to npm | `npm publish` (runs `npm test` automatically via prepublishOnly) |
17
+ | Headless exec | `gsd-t headless <command> [--json] [--timeout=N] [--log]` |
18
+ | Headless query | `gsd-t headless query <type>` (no LLM, <100ms) |
19
+
20
+ ## Local Development
21
+
22
+ ### Setup
23
+ ```bash
24
+ # Clone and install
25
+ git clone https://github.com/Tekyz-Inc/get-stuff-done-teams.git
26
+ cd get-stuff-done-teams
27
+
28
+ # No npm install needed — zero dependencies
29
+ # Test the CLI directly:
30
+ node bin/gsd-t.js status
31
+ ```
32
+
33
+ ### Testing
34
+ ```bash
35
+ # Run automated test suite (205 tests, zero dependencies)
36
+ npm test
37
+
38
+ # Test CLI subcommands manually
39
+ node bin/gsd-t.js install
40
+ node bin/gsd-t.js status
41
+ node bin/gsd-t.js doctor
42
+ node bin/gsd-t.js init test-project
43
+
44
+ # Validate command files exist
45
+ ls commands/*.md | wc -l # Should be 48
46
+ ls templates/*.md | wc -l # Should be 9
47
+
48
+ # Test new utility scripts
49
+ node scripts/gsd-t-tools.js validate
50
+ node scripts/gsd-t-tools.js git pre-commit-check
51
+
52
+ # Test scan visual output
53
+ node bin/gsd-t.js scan --export html
54
+ # Output: scan-report.html (self-contained, no external deps)
55
+
56
+ # Test dashboard server
57
+ node scripts/gsd-t-dashboard-server.js --port 7433 --detach
58
+ # Browser: http://localhost:7433
59
+ node scripts/gsd-t-dashboard-server.js --stop
60
+ ```
61
+
62
+ ### Scripts
63
+ | Script | Purpose |
64
+ |--------|---------|
65
+ | `scripts/gsd-t-heartbeat.js` | Claude Code hook event logger (JSONL output, secret scrubbing) |
66
+ | `scripts/npm-update-check.js` | Background npm registry version checker (path-validated) |
67
+ | `scripts/gsd-t-fetch-version.js` | Synchronous npm registry fetch (5s timeout, 1MB limit) |
68
+ | `scripts/gsd-t-tools.js` | State utility CLI — state get/set, validate, list, git check, template read (M13) |
69
+ | `scripts/gsd-t-statusline.js` | Context usage bar + project state for Claude Code statusLine setting (M13) |
70
+ | `scripts/gsd-t-event-writer.js` | Structured JSONL event appender CLI — writes to .gsd-t/events/ (M14) |
71
+ | `scripts/gsd-t-dashboard-server.js` | Zero-dep SSE server for real-time dashboard — port 7433 (M15) |
72
+ | `scripts/gsd-t-auto-route.js` | UserPromptSubmit hook — auto-routes plain text via /gsd in GSD-T projects (M16) |
73
+ | `scripts/gsd-t-update-check.js` | SessionStart hook — fetches latest npm version, auto-updates GSD-T (M16) |
74
+ | `bin/scan-schema.js` | ORM/DB schema detector + extractor — 7 ORM types (M17) |
75
+ | `bin/scan-diagrams.js` | Diagram orchestrator — 6 diagram types, renders to SVG or placeholder (M17) |
76
+ | `bin/scan-report.js` | Self-contained HTML scan report generator (M17) |
77
+ | `bin/scan-export.js` | Export subcommand — DOCX (pandoc) + PDF (md-to-pdf) stubs (M17) |
78
+
79
+ ## Distribution
80
+
81
+ ### npm Package
82
+ - **Registry**: https://www.npmjs.com/package/@tekyzinc/gsd-t
83
+ - **Publish**: `npm publish` (requires npm login with Tekyz account)
84
+ - **Version**: Managed in `package.json`, synced to `.gsd-t/progress.md`
85
+ - **Files shipped**: `bin/`, `commands/`, `scripts/`, `templates/`, `examples/`, `docs/`, `CHANGELOG.md`
86
+
87
+ ### Installed Locations
88
+ | What | Where |
89
+ |------|-------|
90
+ | Slash commands (48 files) | `~/.claude/commands/` |
91
+ | Global config | `~/.claude/CLAUDE.md` |
92
+ | Heartbeat script | `~/.claude/scripts/gsd-t-heartbeat.js` |
93
+ | State utility CLI | `~/.claude/scripts/gsd-t-tools.js` |
94
+ | Statusline script | `~/.claude/scripts/gsd-t-statusline.js` |
95
+ | Hook configuration | `~/.claude/settings.json` (hooks section) |
96
+ | Version file | `~/.claude/.gsd-t-version` |
97
+ | Update cache | `~/.claude/.gsd-t-update-check` |
98
+ | Project registry | `~/.claude/.gsd-t-projects` |
99
+
100
+ ## Repository Structure
101
+
102
+ ```
103
+ get-stuff-done-teams/
104
+ ├── bin/gsd-t.js — CLI installer (~1,438 lines, zero dependencies)
105
+ ├── commands/ — 45 slash command files (41 GSD-T + 4 utility)
106
+ ├── scripts/ — 5 hook/utility scripts (added gsd-t-tools.js, gsd-t-statusline.js in M13)
107
+ ├── templates/ — 9 document templates
108
+ ├── examples/ — Reference project structure
109
+ ├── docs/ — Methodology + living docs
110
+ ├── .gsd-t/ — GSD-T state (self-managed)
111
+ └── package.json — npm package config
112
+ ```
113
+
114
+ ## Headless Mode (M23)
115
+
116
+ Headless mode enables non-interactive GSD-T execution for CI/CD pipelines and overnight builds.
117
+
118
+ ### headless exec
119
+
120
+ Wraps `claude -p "/user:gsd-t-{command} {args}"` for unattended execution.
121
+
122
+ ```bash
123
+ gsd-t headless verify --json --timeout=1200 --log
124
+ gsd-t headless execute --timeout=3600
125
+ gsd-t headless wave --json
126
+ ```
127
+
128
+ **Flags:**
129
+ | Flag | Default | Description |
130
+ |------|---------|-------------|
131
+ | `--json` | off | Output structured JSON envelope |
132
+ | `--timeout=N` | 300s | Kill process after N seconds |
133
+ | `--log` | off | Write output to `.gsd-t/headless-{timestamp}.log` |
134
+
135
+ **Exit codes:**
136
+ | Code | Meaning |
137
+ |------|---------|
138
+ | 0 | success |
139
+ | 1 | verify-fail (tests or quality gates failed) |
140
+ | 2 | context-budget-exceeded (split the milestone) |
141
+ | 3 | error (claude CLI error or process failure) |
142
+ | 4 | blocked-needs-human (requires manual intervention) |
143
+
144
+ **JSON envelope shape (--json flag):**
145
+ ```json
146
+ {
147
+ "success": true,
148
+ "exitCode": 0,
149
+ "gsdtExitCode": 0,
150
+ "command": "verify",
151
+ "args": [],
152
+ "output": "...",
153
+ "timestamp": "2026-03-22T10:00:00.000Z",
154
+ "duration": 42150,
155
+ "logFile": ".gsd-t/headless-1742641200000.log"
156
+ }
157
+ ```
158
+
159
+ ### headless query
160
+
161
+ Pure Node.js file parsing — no LLM calls, <100ms response.
162
+
163
+ ```bash
164
+ gsd-t headless query status # Version, milestone, phase
165
+ gsd-t headless query domains # Domain list with flags
166
+ gsd-t headless query contracts # Contract file list
167
+ gsd-t headless query debt # Tech debt items
168
+ gsd-t headless query context # Token log summary
169
+ gsd-t headless query backlog # Backlog items
170
+ gsd-t headless query graph # Graph index metadata
171
+ ```
172
+
173
+ All queries return JSON to stdout.
174
+
175
+ ### CI/CD Integration
176
+
177
+ Example workflow files are in `docs/ci-examples/`:
178
+ - `github-actions.yml` — GitHub Actions workflow with verify + status gate jobs
179
+ - `gitlab-ci.yml` — GitLab CI pipeline with status/verify/report stages
180
+
181
+ **Quick setup for GitHub Actions:**
182
+ ```yaml
183
+ - name: GSD-T Verify
184
+ env:
185
+ ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
186
+ run: gsd-t headless verify --json --timeout=1200
187
+ ```
188
+
189
+ **Quick setup for GitLab CI:**
190
+ ```yaml
191
+ gsd-t-verify:
192
+ script:
193
+ - gsd-t headless verify --json --timeout=1200
194
+ variables:
195
+ ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
196
+ ```
197
+
198
+ ## Security Notes
199
+
200
+ - Zero npm dependencies — no supply chain risk
201
+ - All file writes check for symlinks first
202
+ - Input validation on project names, versions, session IDs, paths
203
+ - Heartbeat stdin capped at 1MB
204
+ - HTTP requests use HTTPS with timeouts
205
+ - Init operations use exclusive file creation (`{ flag: "wx" }`)