claude-autopm 3.25.4 → 3.25.5

package/.github/review-context.md

@@ -0,0 +1,11 @@
+# PROJECT_CONTEXT_BRIEF — ClaudeAutoPM
+
+## Stack
+- Node.js / JavaScript CLI tool (npm package: project-management automation). Shell scripts. Some Python + TypeScript.
+
+## OUT OF SCOPE (do not flag)
+- Style nits (linters/prettier enforce). Pre-existing tech debt outside the diff hunk. Doc/markdown wording.
+
+## Severity
+- HIGH: data loss, security (esp. arbitrary command exec in a CLI), broken contract, crash on happy path.
+- MEDIUM: edge-case bug, missing test for a new code path. LOW: maintainability nit.

package/.github/workflows/copilot-review-required.yml

@@ -0,0 +1,128 @@
+name: AI Review Gate (Sonnet via OpenRouter) — ClaudeAutoPM
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+
+concurrency:
+  group: ai-review-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ai-review:
+    name: ai-review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: >-
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute PR diff
+        id: diff
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          git diff "$BASE_SHA" "$HEAD_SHA" > "$RUNNER_TEMP/pr.diff" 2>/dev/null || true
+          echo "bytes=$(wc -c < "$RUNNER_TEMP/pr.diff" 2>/dev/null || echo 0)" >> "$GITHUB_OUTPUT"
+
+      - name: Single-call review via OpenRouter
+        uses: actions/github-script@v9
+        env:
+          PR_DIFF_PATH: ${{ runner.temp }}/pr.diff
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          REVIEW_MODEL: anthropic/claude-sonnet-4.6
+        with:
+          script: |
+            const fs = require('fs');
+            const sha = context.payload.pull_request.head.sha;
+            const CHECK = 'copilot-review';
+
+            const redactSecrets = (s) => String(s || '')
+              .replace(/("(?:access_token|id_token|refresh_token|api_key|apikey|secret|client_secret|private_key|aws_secret_access_key|OPENROUTER_API_KEY|OPENAI_API_KEY|account_id|password|passwd|token)"\s*:\s*")[^"]+/gi, '$1[REDACTED]')
+              .replace(/eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, '[REDACTED-JWT]')
+              .replace(/sk-or-[A-Za-z0-9_-]{20,}/g, 'sk-or-[REDACTED]')
+              .replace(/sk-ant-[A-Za-z0-9_-]{20,}/g, 'sk-ant-[REDACTED]')
+              .replace(/sk-[A-Za-z0-9_-]{20,}/g, 'sk-[REDACTED]')
+              .replace(/ghp_[A-Za-z0-9]{36}/g, 'ghp_[REDACTED]')
+              .replace(/github_pat_[A-Za-z0-9_]{50,}/g, 'github_pat_[REDACTED]');
+
+            let BRIEF = '';
+            try { BRIEF = fs.readFileSync('.github/review-context.md', 'utf8'); } catch (e) {}
+            let diff = '';
+            try { diff = fs.readFileSync(process.env.PR_DIFF_PATH, 'utf8'); } catch (e) {}
+            if (diff.length > 200000) diff = diff.slice(0, 200000) + '\n…[diff truncated]';
+
+            const prompt = [
+              BRIEF, '',
+              'You are a senior code reviewer. Review ONLY the diff below for HIGH/MEDIUM/LOW issues',
+              '(security, correctness, data-loss, broken contracts). Ignore style nits and pre-existing',
+              'tech debt outside the diff. If unsure, do not invent findings.', '',
+              'Respond with ONLY a JSON object, no prose:',
+              '{"verdict":"approve|request_changes","summary":"<=600 chars","findings":[{"severity":"HIGH|MEDIUM|LOW","file":"path","line":<int|null>,"message":"<=300 chars"}]}',
+              '', '--- DIFF ---', diff || '(empty diff)'
+            ].join('\n');
+
+            let raw = '';
+            try {
+              const resp = await fetch('https://openrouter.ai/api/v1/chat/completions', {
+                method: 'POST',
+                headers: { 'Authorization': `Bearer ${process.env.OPENROUTER_API_KEY}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                  model: process.env.REVIEW_MODEL,
+                  messages: [{ role: 'user', content: prompt }],
+                  temperature: 0.1,
+                  max_tokens: 1500
+                })
+              });
+              const data = await resp.json();
+              raw = data?.choices?.[0]?.message?.content || '';
+            } catch (e) { raw = ''; }
+
+            let obj = null;
+            try { obj = JSON.parse(raw); } catch (e) {
+              const i = raw.indexOf('{');
+              if (i >= 0) { let d=0; for (let j=i;j<raw.length;j++){ const c=raw[j]; if(c==='{')d++; else if(c==='}'){d--; if(d===0){ try{obj=JSON.parse(raw.slice(i,j+1));}catch(_){} break; }}}}
+            }
+
+            let conclusion, title, body;
+            if (!obj || !obj.verdict) {
+              conclusion = 'neutral';
+              title = 'AI review — call failed / malformed (human review required)';
+              body = `<!-- gemini-ai-review:${sha} -->\n<!-- gemini-verdict:malformed -->\n\n🤖 **${process.env.REVIEW_MODEL}** automated review via OpenRouter:\n\n**Verdict:** (unparseable — neutral, not blocking)`;
+            } else {
+              const approve = obj.verdict === 'approve';
+              conclusion = approve ? 'success' : 'failure';
+              const findings = Array.isArray(obj.findings) ? obj.findings : [];
+              const fblock = findings.length
+                ? '\n\n### Findings\n\n' + findings.map(f => `- **[${redactSecrets(f.severity)}]** \`${redactSecrets(f.file)}${f.line?':'+f.line:''}\` — ${redactSecrets(f.message)}`).join('\n')
+                : '';
+              title = `AI review: ${approve ? 'APPROVE' : 'REQUEST_CHANGES'}`;
+              body = [
+                `<!-- gemini-ai-review:${sha} -->`,
+                `<!-- gemini-verdict:${approve ? 'approve' : 'reject'} -->`, '',
+                `🤖 **${process.env.REVIEW_MODEL}** automated review via OpenRouter:`, '',
+                `**Verdict:** ${approve ? 'APPROVE' : 'REQUEST_CHANGES'}`, '',
+                `**Summary:** ${redactSecrets(obj.summary || '')}`, fblock
+              ].join('\n');
+            }
+
+            await github.rest.checks.create({
+              owner: context.repo.owner, repo: context.repo.repo,
+              name: CHECK, head_sha: sha, status: 'completed', conclusion,
+              output: { title, summary: redactSecrets((body||'').slice(0, 60000)) }
+            });
+            await github.rest.pulls.createReview({
+              owner: context.repo.owner, repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+              event: 'COMMENT', body
+            });

package/.github/workflows/deploy-docs.yml

@@ -46,7 +46,7 @@ jobs:
         working-directory: docs-site
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: docs-site/docs/.vitepress/dist
 

package/.github/workflows/enforce-main-source.yml

@@ -0,0 +1,24 @@
+name: Enforce main source
+# Fires on ALL PRs so the required-status-check `Verify PR source is develop`
+# reports a result on every PR (including PRs into `develop`). The enforcement
+# itself only runs when the base is `main` — promotion-only into main, free
+# branch names everywhere else.
+on:
+  pull_request:
+jobs:
+  verify:
+    name: Verify PR source is develop
+    runs-on: ubuntu-latest
+    steps:
+      - name: Skip when not targeting main
+        if: github.base_ref != 'main'
+        run: |
+          echo "Base is '${{ github.base_ref }}', not 'main' — promotion gate not applicable."
+      - name: Check head is develop
+        if: github.base_ref == 'main'
+        run: |
+          if [ "${{ github.head_ref }}" != "develop" ]; then
+            echo "::error::PRs into main must come from develop (head: ${{ github.head_ref }}). Promotion-only."
+            exit 1
+          fi
+          echo "OK — promotion from develop."

package/autopm/.claude/commands/pm:epic-sync-original.md

@@ -75,7 +75,7 @@ fi
 Strip frontmatter and prepare GitHub issue body:
 ```bash
 # Extract content without frontmatter
-sed '1,/^---$/d; 1,/^---$/d' .claude/epics/$ARGUMENTS/epic.md > /tmp/epic-body-raw.md
+awk 'BEGIN{p=0; done=0} /^---$/ && !done {p++; if(p==2) done=1; next} p>=2{print}' ".claude/epics/$ARGUMENTS/epic.md" > /tmp/epic-body-raw.md
 
 # Remove "## Tasks Created" section and replace with Stats
 awk '
@@ -162,7 +162,7 @@ if [ "$task_count" -lt 5 ]; then
     task_name=$(grep '^name:' "$task_file" | sed 's/^name: *//')
 
     # Strip frontmatter from task content
-    sed '1,/^---$/d; 1,/^---$/d' "$task_file" > /tmp/task-body.md
+    awk 'BEGIN{p=0; done=0} /^---$/ && !done {p++; if(p==2) done=1; next} p>=2{print}' "$task_file" > /tmp/task-body.md
 
     # Create sub-issue with labels
     if [ "$use_subissues" = true ]; then
@@ -222,7 +222,7 @@ Task:
 
     For each task file:
     1. Extract task name from frontmatter
-    2. Strip frontmatter using: sed '1,/^---$/d; 1,/^---$/d'
+    2. Strip frontmatter using: awk 'BEGIN{p=0; done=0} /^---$/ && !done {p++; if(p==2) done=1; next} p>=2{print}'
     3. Create sub-issue using:
        - If gh-sub-issue available:
          gh sub-issue create --parent $epic_number --title "$task_name" \

package/autopm/.claude/commands/pm:issue-start.md

@@ -4,30 +4,77 @@ allowed-tools: Bash, Read, Write, LS, Task
 
 # Issue Start
 
-Begin work on a GitHub issue with parallel agents based on work stream analysis.
+Begin work on an issue. Auto-detects local (Lite) or GitHub mode from git remote.
 
 ## Usage
-` ``
-/pm:issue-start <issue_number>
-` ``
+```
+/pm:issue-start <issue_id> [--analyze]
+```
 
-## Quick Check
+`issue_id` can be a local file ID (`demo-001`, `001`) or a GitHub issue number.
+
+## Step 0 — Detect provider
+
+```bash
+ISSUE_ID=$(echo "$ARGUMENTS" | awk '{print $1}')
+HAS_ANALYZE=$(echo "$ARGUMENTS" | grep -q '\-\-analyze' && echo "true" || echo "false")
+
+PROVIDER="local"
+if git remote get-url origin 2>/dev/null | grep -q "github.com"; then
+  PROVIDER="github"
+elif [ -n "$AZURE_DEVOPS_ORG" ] || [ -f ".azure" ]; then
+  PROVIDER="azure"
+fi
+echo "Provider: $PROVIDER"
+```
+
+**PROVIDER=`local`** → LOCAL FLOW · **PROVIDER=`github`** → GITHUB FLOW
+
+---
+
+## LOCAL FLOW (Lite — no GitHub remote)
+
+```bash
+ISSUE_FILE=$(find .claude/issues -name "${ISSUE_ID}.md" 2>/dev/null | head -1)
+[ -z "$ISSUE_FILE" ] && echo "❌ Not found: .claude/issues/${ISSUE_ID}.md — ls .claude/issues/" && exit 1
+```
+
+1. Update `status: open` → `status: in-progress` in frontmatter
+2. Update `updated:` with `date -u +"%Y-%m-%dT%H:%M:%SZ"`
+3. Add entry to `.claude/active-work.json`
+4. Show issue content and begin working on it
+5. Output: `🚀 Local issue $ISSUE_ID started — close with: /pm:issue-close $ISSUE_ID`
+
+---
+
+## GITHUB FLOW
+
+### Quick Check
 
 1. **Get issue details:**
-   ` ``bash
-   gh issue view $ARGUMENTS --json state,title,labels,body
-   ` ``
-   If it fails: "❌ Cannot access issue #$ARGUMENTS. Check number or run: gh auth login"
+   ```bash
+   ISSUE_NUMBER=$ISSUE_ID
+   gh issue view $ISSUE_NUMBER --json state,title,labels,body
+   ```
+   If it fails: "❌ Cannot access issue #$ISSUE_NUMBER. Check number or run: gh auth login"
 
 2. **Find local task file:**
-   - First check if `.claude/epics/*/$ARGUMENTS.md` exists (new naming)
-   - If not found, search for file containing `github:.*issues/$ARGUMENTS` in frontmatter (old naming)
-   - If not found: "❌ No local task for issue #$ARGUMENTS. This issue may have been created outside the PM system."
+   ```bash
+   # Primary: search frontmatter for github issue URL (works with any filename)
+   task_file=$(grep -rl "github:.*issues/$ISSUE_NUMBER" .claude/epics/ 2>/dev/null | head -1)
+   if [ -z "$task_file" ]; then
+     # Fallback: check for issue-number filename
+     task_file=$(find .claude/epics -name "$ISSUE_NUMBER.md" 2>/dev/null | head -1)
+   fi
+   ```
+   - If not found: "❌ No local task for issue #$ISSUE_NUMBER. This issue may have been created outside the PM system."
+   - Use `$task_file` as the canonical path for ALL subsequent steps
 
 3. **Check for analysis (when NOT using --analyze flag):**
-   - If user didn't use `--analyze` flag, check if analysis file exists
-   - Analysis file location: `.claude/epics/{epic_name}/$ARGUMENTS-analysis.md`
-   - If no analysis AND no `--analyze` flag: Stop and suggest using `--analyze` flag
+   - Extract epic name from `$task_file` path: `epic_name=$(echo "$task_file" | sed 's|.claude/epics/||' | cut -d/ -f1)`
+   - If `$HAS_ANALYZE` is "false", check if analysis file exists
+   - Analysis file location: `.claude/epics/$epic_name/$ISSUE_NUMBER-analysis.md`
+   - If no analysis AND `$HAS_ANALYZE` is "false": Stop and suggest using `--analyze` flag
 
 ## Required Documentation Access
 
@@ -45,7 +92,7 @@ Begin work on a GitHub issue with parallel agents based on work stream analysis.
 - Validates task coordination strategies
 - Prevents common pitfalls in distributed work
 
-## ⚠️ TDD REMINDER - READ THIS FIRST
+## TDD REMINDER - READ THIS FIRST
 
 **CRITICAL: This project follows Test-Driven Development (TDD).**
 
@@ -69,10 +116,10 @@ See `.claude/rules/tdd.enforcement.md` for complete TDD requirements.
 
 ### 0. Handle --analyze Flag (if provided)
 
-If user provided `--analyze` flag, delegate to the Node.js script:
-` ``bash
-node .claude/scripts/pm/issue-start.cjs $ARGUMENTS --analyze
-` ``
+If `$HAS_ANALYZE` is "true", delegate to the Node.js script:
+```bash
+node .claude/scripts/pm/issue-start.cjs $ISSUE_NUMBER --analyze
+```
 
 This script will:
 1. Find the task file for the issue
@@ -88,7 +135,7 @@ This script will:
 ### 1. Ensure Branch Exists (Non-analyze workflow)
 
 Check if epic branch exists:
-` ``bash
+```bash
 # Find epic name from task file
 epic_name={extracted_from_path}
 
@@ -101,11 +148,11 @@ fi
 # Check out the branch
 git checkout epic/$epic_name
 git pull origin epic/$epic_name
-` ``
+```
 
 ### 2. Read Analysis
 
-Read `.claude/epics/{epic_name}/$ARGUMENTS-analysis.md`:
+Read `.claude/epics/{epic_name}/$ISSUE_NUMBER-analysis.md`:
 - Parse parallel streams
 - Identify which can start immediately
 - Note dependencies between streams
@@ -115,9 +162,9 @@ Read `.claude/epics/{epic_name}/$ARGUMENTS-analysis.md`:
 Get current datetime: `date -u +"%Y-%m-%dT%H:%M:%SZ"`
 
 Create workspace structure:
-` ``bash
-mkdir -p .claude/epics/{epic_name}/updates/$ARGUMENTS
-` ``
+```bash
+mkdir -p .claude/epics/{epic_name}/updates/$ISSUE_NUMBER
+```
 
 Update task file frontmatter `updated` field with current datetime.
 
@@ -125,10 +172,10 @@ Update task file frontmatter `updated` field with current datetime.
 
 For each stream that can start immediately:
 
-Create `.claude/epics/{epic_name}/updates/$ARGUMENTS/stream-{X}.md`:
-` ``markdown
+Create `.claude/epics/{epic_name}/updates/$ISSUE_NUMBER/stream-{X}.md`:
+```markdown
 ---
-issue: $ARGUMENTS
+issue: $ISSUE_NUMBER
 stream: {stream_name}
 agent: {agent_type}
 started: {current_datetime}
@@ -145,15 +192,15 @@ status: in_progress
 
 ## Progress
 - Starting implementation
-` ``
+```
 
 Launch agent using Task tool:
-` ``yaml
+```yaml
 Task:
-  description: "Issue #$ARGUMENTS Stream {X}"
+  description: "Issue #$ISSUE_NUMBER Stream {X}"
   subagent_type: "{agent_type}"
   prompt: |
-    **🚨 CRITICAL RULE #1: Test-Driven Development (TDD) is MANDATORY**
+    **CRITICAL RULE #1: Test-Driven Development (TDD) is MANDATORY**
 
     You MUST follow the RED-GREEN-REFACTOR cycle:
     1. **RED**: Write a FAILING test first that describes the desired behavior
@@ -177,63 +224,63 @@ Task:
 
     ---
 
-    You are working on Issue #$ARGUMENTS in the epic branch.
+    You are working on Issue #$ISSUE_NUMBER in the epic branch.
 
     Branch: epic/{epic_name}
     Your stream: {stream_name}
-    
+
     Your scope:
     - Files to modify: {file_patterns}
     - Work to complete: {stream_description}
-    
+
     Requirements:
     1. Read full task from: .claude/epics/{epic_name}/{task_file}
     2. **START WITH TESTS**: Write failing tests BEFORE any implementation
     3. Work ONLY in your assigned files
     4. Follow TDD cycle: RED (test fails) → GREEN (minimal code) → REFACTOR (cleanup)
-    5. Commit frequently with format: "Issue #$ARGUMENTS: {specific change}"
-    6. Update progress in: .claude/epics/{epic_name}/updates/$ARGUMENTS/stream-{X}.md
+    5. Commit frequently with format: "Issue #$ISSUE_NUMBER: {specific change}"
+    6. Update progress in: .claude/epics/{epic_name}/updates/$ISSUE_NUMBER/stream-{X}.md
     7. Follow coordination rules in /rules/agent-coordination.md
-    
+
     If you need to modify files outside your scope:
     - Check if another stream owns them
     - Wait if necessary
     - Update your progress file with coordination notes
-    
+
     Complete your stream's work and mark as completed when done.
-` ``
+```
 
 ### 5. GitHub Assignment
 
-` ``bash
+```bash
 # Assign to self and mark in-progress
-gh issue edit $ARGUMENTS --add-assignee @me --add-label "in-progress"
-` ``
+gh issue edit $ISSUE_NUMBER --add-assignee @me --add-label "in-progress"
+```
 
 ### 6. Output
 
-` ``
-✅ Started parallel work on issue #$ARGUMENTS
+```
+Started parallel work on issue #$ISSUE_NUMBER
 
 Epic: {epic_name}
-Worktree: ../epic-{epic_name}/
+Branch: epic/{epic_name}
 
 Launching {count} parallel agents:
-  Stream A: {name} (Agent-1) ✓ Started
-  Stream B: {name} (Agent-2) ✓ Started
+  Stream A: {name} (Agent-1) - Started
+  Stream B: {name} (Agent-2) - Started
   Stream C: {name} - Waiting (depends on A)
 
 Progress tracking:
-  .claude/epics/{epic_name}/updates/$ARGUMENTS/
+  .claude/epics/{epic_name}/updates/$ISSUE_NUMBER/
 
-⚠️  TDD CHECKLIST - All agents MUST follow:
-  1. ❌ RED: Write failing test
-  2. ❌ GREEN: Make test pass (minimal code)
-  3. ❌ REFACTOR: Clean up code
+TDD CHECKLIST - All agents MUST follow:
+  1. RED: Write failing test
+  2. GREEN: Make test pass (minimal code)
+  3. REFACTOR: Clean up code
 
 Monitor with: /pm:epic-status {epic_name}
-Sync updates: /pm:issue-sync $ARGUMENTS
-` ``
+Sync updates: /pm:issue-sync $ISSUE_NUMBER
+```
 
 ## Error Handling
 
@@ -245,4 +292,4 @@ If any step fails, report clearly:
 ## Important Notes
 
 Follow `/rules/datetime.md` for timestamps.
-Keep it simple - trust that GitHub and file system work.
+Keep it simple - trust that GitHub and file system work.

package/autopm/.claude/rules/frontmatter-operations.md

@@ -61,10 +61,17 @@ updated: {current_datetime}
 YAML frontmatter MUST be removed before sending content to GitHub (issues, comments, external systems):
 
 ```bash
-# Strip frontmatter (everything between first two --- lines)
-sed '1,/^---$/d; 1,/^---$/d' input.md > output.md
+# Strip frontmatter, keep full body (including any body '---' horizontal rules).
+# ⚠️ Produces EMPTY output when the input has no leading '---'. If the input
+#    may be a plain markdown file, use the `strip_frontmatter` helper in
+#    `frontmatter-utils.sh` instead — it passes such files through unchanged.
+awk 'BEGIN{p=0; done=0} /^---$/ && !done {p++; if(p==2) done=1; next} p>=2{print}' input.md > output.md
 ```
 
+Do NOT use the naive `sed '1,/^---$/d; 1,/^---$/d'` idiom — it counts every
+`---` line, so it destroys the body when there is no body or when the body
+contains a horizontal rule (see issue #599 and `strip-frontmatter.md`).
+
 Always strip when:
 - Creating GitHub issues from markdown files (`gh issue create --body-file`)
 - Posting file content as comments
@@ -72,7 +79,7 @@ Always strip when:
 
 ```bash
 # Example: create issue from file
-sed '1,/^---$/d; 1,/^---$/d' task.md > /tmp/clean.md
+awk 'BEGIN{p=0; done=0} /^---$/ && !done {p++; if(p==2) done=1; next} p>=2{print}' task.md > /tmp/clean.md
 gh issue create --body-file /tmp/clean.md
 ```
 

package/autopm/.claude/scripts/lib/frontmatter-utils.sh

@@ -117,8 +117,23 @@ strip_frontmatter() {
         return 1
     fi
 
-    # Remove frontmatter (everything between first two --- lines)
-    sed '1,/^---$/d; 1,/^---$/d' "$input_file" > "$output_file"
+    # Passthrough when there is no frontmatter at all. Without this guard, the
+    # awk below (which prints only after seeing two `---` delimiters) produces
+    # empty output for files with no leading `---`, which would silently
+    # produce empty GitHub issue bodies. Flagged in the PR review for #599.
+    if [[ "$(head -n 1 "$input_file")" != "---" ]]; then
+        cp "$input_file" "$output_file"
+        log_debug "No leading frontmatter in $input_file; passthrough to $output_file"
+        log_function_exit "strip_frontmatter"
+        return 0
+    fi
+
+    # Remove frontmatter (everything between first two --- lines).
+    # Naive `sed '1,/^---$/d; 1,/^---$/d'` is BROKEN: it counts every '---' line,
+    # so it destroys the body when there is no body or when the body contains a
+    # horizontal rule. The `done` flag below freezes the counter after the
+    # second delimiter is consumed. See issue #599.
+    awk 'BEGIN{p=0; done=0} /^---$/ && !done {p++; if(p==2) done=1; next} p>=2{print}' "$input_file" > "$output_file"
 
     log_debug "Stripped frontmatter from $input_file to $output_file"
     log_function_exit "strip_frontmatter"

package/autopm/.claude/scripts/lib/github-utils.sh

@@ -60,6 +60,16 @@ check_repo_protection() {
     return 0
 }
 
+# Build separate --label flags from a comma-separated label string
+build_label_flags() {
+    local labels="$1"
+    local IFS=','
+    for label in $labels; do
+        echo "--label"
+        echo "$label"
+    done
+}
+
 # Create GitHub issue with proper error handling
 create_github_issue() {
     local title="$1"
@@ -82,12 +92,14 @@ create_github_issue() {
     # Check authentication
     check_gh_auth
 
-    # Create issue
+    # Create issue with split label flags
+    local -a label_flags
+    mapfile -t label_flags < <(build_label_flags "$labels")
     local issue_number
     if ! issue_output=$(gh issue create \
         --title "$title" \
         --body-file "$body_file" \
-        --label "$labels" \
+        "${label_flags[@]}" \
         --json number 2>/dev/null); then
         log_error "Failed to create GitHub issue"
         return 1
@@ -110,6 +122,10 @@ create_github_subissue() {
 
     log_info "Creating GitHub sub-issue under #$parent_issue: $title"
 
+    # Build split label flags
+    local -a label_flags
+    mapfile -t label_flags < <(build_label_flags "$labels")
+
     # Check if gh-sub-issue extension is available
     if gh extension list | grep -q "yahsan2/gh-sub-issue"; then
         local issue_number
@@ -117,7 +133,7 @@ create_github_subissue() {
             --parent "$parent_issue" \
             --title "$title" \
             --body-file "$body_file" \
-            --label "$labels" \
+            "${label_flags[@]}" \
             --json number -q .number 2>/dev/null); then
             log_error "Failed to create GitHub sub-issue"
             return 1

package/lib/cli/commands/obsidian.js

@@ -113,6 +113,35 @@ async function obsidianSync(argv) {
   child.on('close', (code) => process.exit(code || 0));
 }
 
+/**
+ * autopm obsidian link
+ */
+async function obsidianLink(argv) {
+  const root = findProjectRoot();
+  checkPlugin(root);
+
+  // Check multiple locations for link-vault.js
+  const candidates = [
+    path.join(root, '.claude', 'scripts', 'obsidian', 'link-vault.js'),
+    path.join(root, 'packages', 'plugin-obsidian', 'scripts', 'obsidian', 'link-vault.js'),
+  ];
+  const scriptPath = candidates.find(p => fs.existsSync(p));
+  if (!scriptPath) {
+    console.error('❌ Link script not found. Reinstall plugin-obsidian.');
+    process.exit(1);
+  }
+
+  const args = ['--project-root', root];
+  if (argv.dryRun) args.push('--dry-run');
+
+  const child = spawn('node', [scriptPath, ...args], {
+    stdio: 'inherit',
+    cwd: root
+  });
+
+  child.on('close', (code) => process.exit(code || 0));
+}
+
 /**
  * autopm obsidian doctor
  */
@@ -191,6 +220,21 @@ function builder(yargs) {
       },
       obsidianSync
     )
+    .command(
+      'link',
+      'Inject [[wikilinks]] into project files for Obsidian Graph View',
+      (yargs) => {
+        return yargs
+          .option('dry-run', {
+            describe: 'Show what would be linked without modifying files',
+            type: 'boolean',
+            default: false
+          })
+          .example('autopm obsidian link', 'Link all project files')
+          .example('autopm obsidian link --dry-run', 'Preview changes');
+      },
+      obsidianLink
+    )
     .command(
       'doctor',
       'Diagnose common Obsidian integration issues',
@@ -214,6 +258,7 @@ module.exports = {
     console.log('Commands:');
     console.log('  setup    Configure Obsidian vault integration');
     console.log('  sync     Sync project files to Obsidian vault');
+    console.log('  link     Inject [[wikilinks]] for Graph View');
     console.log('  doctor   Diagnose common integration issues');
     console.log('\nRun autopm obsidian <command> --help for details\n');
   }