gsd-code-first 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (238) hide show
  1. package/LICENSE +21 -0
  2. package/README.ja-JP.md +834 -0
  3. package/README.ko-KR.md +823 -0
  4. package/README.md +937 -0
  5. package/README.pt-BR.md +452 -0
  6. package/README.zh-CN.md +800 -0
  7. package/agents/gsd-advisor-researcher.md +104 -0
  8. package/agents/gsd-annotator.md +148 -0
  9. package/agents/gsd-arc-executor.md +537 -0
  10. package/agents/gsd-arc-planner.md +374 -0
  11. package/agents/gsd-assumptions-analyzer.md +105 -0
  12. package/agents/gsd-code-planner.md +155 -0
  13. package/agents/gsd-codebase-mapper.md +770 -0
  14. package/agents/gsd-debugger.md +1373 -0
  15. package/agents/gsd-executor.md +509 -0
  16. package/agents/gsd-integration-checker.md +443 -0
  17. package/agents/gsd-nyquist-auditor.md +176 -0
  18. package/agents/gsd-phase-researcher.md +698 -0
  19. package/agents/gsd-plan-checker.md +773 -0
  20. package/agents/gsd-planner.md +1354 -0
  21. package/agents/gsd-project-researcher.md +654 -0
  22. package/agents/gsd-prototyper.md +161 -0
  23. package/agents/gsd-research-synthesizer.md +247 -0
  24. package/agents/gsd-roadmapper.md +679 -0
  25. package/agents/gsd-ui-auditor.md +439 -0
  26. package/agents/gsd-ui-checker.md +300 -0
  27. package/agents/gsd-ui-researcher.md +357 -0
  28. package/agents/gsd-user-profiler.md +171 -0
  29. package/agents/gsd-verifier.md +700 -0
  30. package/bin/install.js +5009 -0
  31. package/commands/gsd/add-backlog.md +76 -0
  32. package/commands/gsd/add-phase.md +43 -0
  33. package/commands/gsd/add-tests.md +41 -0
  34. package/commands/gsd/add-todo.md +47 -0
  35. package/commands/gsd/annotate.md +54 -0
  36. package/commands/gsd/audit-milestone.md +36 -0
  37. package/commands/gsd/audit-uat.md +24 -0
  38. package/commands/gsd/autonomous.md +41 -0
  39. package/commands/gsd/check-todos.md +45 -0
  40. package/commands/gsd/cleanup.md +18 -0
  41. package/commands/gsd/complete-milestone.md +136 -0
  42. package/commands/gsd/debug.md +173 -0
  43. package/commands/gsd/deep-plan.md +52 -0
  44. package/commands/gsd/discuss-phase.md +64 -0
  45. package/commands/gsd/do.md +30 -0
  46. package/commands/gsd/execute-phase.md +59 -0
  47. package/commands/gsd/extract-plan.md +35 -0
  48. package/commands/gsd/fast.md +30 -0
  49. package/commands/gsd/forensics.md +56 -0
  50. package/commands/gsd/health.md +22 -0
  51. package/commands/gsd/help.md +22 -0
  52. package/commands/gsd/insert-phase.md +32 -0
  53. package/commands/gsd/iterate.md +124 -0
  54. package/commands/gsd/join-discord.md +18 -0
  55. package/commands/gsd/list-phase-assumptions.md +46 -0
  56. package/commands/gsd/list-workspaces.md +19 -0
  57. package/commands/gsd/manager.md +39 -0
  58. package/commands/gsd/map-codebase.md +71 -0
  59. package/commands/gsd/milestone-summary.md +51 -0
  60. package/commands/gsd/new-milestone.md +44 -0
  61. package/commands/gsd/new-project.md +42 -0
  62. package/commands/gsd/new-workspace.md +44 -0
  63. package/commands/gsd/next.md +24 -0
  64. package/commands/gsd/note.md +34 -0
  65. package/commands/gsd/pause-work.md +38 -0
  66. package/commands/gsd/plan-milestone-gaps.md +34 -0
  67. package/commands/gsd/plan-phase.md +47 -0
  68. package/commands/gsd/plant-seed.md +28 -0
  69. package/commands/gsd/pr-branch.md +25 -0
  70. package/commands/gsd/profile-user.md +46 -0
  71. package/commands/gsd/progress.md +24 -0
  72. package/commands/gsd/prototype.md +56 -0
  73. package/commands/gsd/quick.md +47 -0
  74. package/commands/gsd/reapply-patches.md +123 -0
  75. package/commands/gsd/remove-phase.md +31 -0
  76. package/commands/gsd/remove-workspace.md +26 -0
  77. package/commands/gsd/research-phase.md +195 -0
  78. package/commands/gsd/resume-work.md +40 -0
  79. package/commands/gsd/review-backlog.md +61 -0
  80. package/commands/gsd/review.md +37 -0
  81. package/commands/gsd/session-report.md +19 -0
  82. package/commands/gsd/set-mode.md +41 -0
  83. package/commands/gsd/set-profile.md +12 -0
  84. package/commands/gsd/settings.md +36 -0
  85. package/commands/gsd/ship.md +23 -0
  86. package/commands/gsd/stats.md +18 -0
  87. package/commands/gsd/thread.md +127 -0
  88. package/commands/gsd/ui-phase.md +34 -0
  89. package/commands/gsd/ui-review.md +32 -0
  90. package/commands/gsd/update.md +37 -0
  91. package/commands/gsd/validate-phase.md +35 -0
  92. package/commands/gsd/verify-work.md +38 -0
  93. package/commands/gsd/workstreams.md +63 -0
  94. package/get-shit-done/bin/gsd-tools.cjs +946 -0
  95. package/get-shit-done/bin/lib/arc-scanner.cjs +341 -0
  96. package/get-shit-done/bin/lib/commands.cjs +959 -0
  97. package/get-shit-done/bin/lib/config.cjs +466 -0
  98. package/get-shit-done/bin/lib/core.cjs +1230 -0
  99. package/get-shit-done/bin/lib/frontmatter.cjs +336 -0
  100. package/get-shit-done/bin/lib/init.cjs +1442 -0
  101. package/get-shit-done/bin/lib/milestone.cjs +252 -0
  102. package/get-shit-done/bin/lib/model-profiles.cjs +68 -0
  103. package/get-shit-done/bin/lib/phase.cjs +888 -0
  104. package/get-shit-done/bin/lib/profile-output.cjs +952 -0
  105. package/get-shit-done/bin/lib/profile-pipeline.cjs +539 -0
  106. package/get-shit-done/bin/lib/roadmap.cjs +329 -0
  107. package/get-shit-done/bin/lib/security.cjs +382 -0
  108. package/get-shit-done/bin/lib/state.cjs +1031 -0
  109. package/get-shit-done/bin/lib/template.cjs +222 -0
  110. package/get-shit-done/bin/lib/uat.cjs +282 -0
  111. package/get-shit-done/bin/lib/verify.cjs +888 -0
  112. package/get-shit-done/bin/lib/workstream.cjs +491 -0
  113. package/get-shit-done/commands/gsd/workstreams.md +63 -0
  114. package/get-shit-done/references/arc-standard.md +315 -0
  115. package/get-shit-done/references/checkpoints.md +778 -0
  116. package/get-shit-done/references/continuation-format.md +249 -0
  117. package/get-shit-done/references/decimal-phase-calculation.md +64 -0
  118. package/get-shit-done/references/git-integration.md +295 -0
  119. package/get-shit-done/references/git-planning-commit.md +38 -0
  120. package/get-shit-done/references/model-profile-resolution.md +36 -0
  121. package/get-shit-done/references/model-profiles.md +139 -0
  122. package/get-shit-done/references/phase-argument-parsing.md +61 -0
  123. package/get-shit-done/references/planning-config.md +202 -0
  124. package/get-shit-done/references/questioning.md +162 -0
  125. package/get-shit-done/references/tdd.md +263 -0
  126. package/get-shit-done/references/ui-brand.md +160 -0
  127. package/get-shit-done/references/user-profiling.md +681 -0
  128. package/get-shit-done/references/verification-patterns.md +612 -0
  129. package/get-shit-done/references/workstream-flag.md +58 -0
  130. package/get-shit-done/templates/DEBUG.md +164 -0
  131. package/get-shit-done/templates/UAT.md +265 -0
  132. package/get-shit-done/templates/UI-SPEC.md +100 -0
  133. package/get-shit-done/templates/VALIDATION.md +76 -0
  134. package/get-shit-done/templates/claude-md.md +122 -0
  135. package/get-shit-done/templates/codebase/architecture.md +255 -0
  136. package/get-shit-done/templates/codebase/concerns.md +310 -0
  137. package/get-shit-done/templates/codebase/conventions.md +307 -0
  138. package/get-shit-done/templates/codebase/integrations.md +280 -0
  139. package/get-shit-done/templates/codebase/stack.md +186 -0
  140. package/get-shit-done/templates/codebase/structure.md +285 -0
  141. package/get-shit-done/templates/codebase/testing.md +480 -0
  142. package/get-shit-done/templates/config.json +44 -0
  143. package/get-shit-done/templates/context.md +352 -0
  144. package/get-shit-done/templates/continue-here.md +78 -0
  145. package/get-shit-done/templates/copilot-instructions.md +7 -0
  146. package/get-shit-done/templates/debug-subagent-prompt.md +91 -0
  147. package/get-shit-done/templates/dev-preferences.md +21 -0
  148. package/get-shit-done/templates/discovery.md +146 -0
  149. package/get-shit-done/templates/discussion-log.md +63 -0
  150. package/get-shit-done/templates/milestone-archive.md +123 -0
  151. package/get-shit-done/templates/milestone.md +115 -0
  152. package/get-shit-done/templates/phase-prompt.md +610 -0
  153. package/get-shit-done/templates/planner-subagent-prompt.md +117 -0
  154. package/get-shit-done/templates/project.md +186 -0
  155. package/get-shit-done/templates/requirements.md +231 -0
  156. package/get-shit-done/templates/research-project/ARCHITECTURE.md +204 -0
  157. package/get-shit-done/templates/research-project/FEATURES.md +147 -0
  158. package/get-shit-done/templates/research-project/PITFALLS.md +200 -0
  159. package/get-shit-done/templates/research-project/STACK.md +120 -0
  160. package/get-shit-done/templates/research-project/SUMMARY.md +170 -0
  161. package/get-shit-done/templates/research.md +552 -0
  162. package/get-shit-done/templates/retrospective.md +54 -0
  163. package/get-shit-done/templates/roadmap.md +202 -0
  164. package/get-shit-done/templates/state.md +176 -0
  165. package/get-shit-done/templates/summary-complex.md +59 -0
  166. package/get-shit-done/templates/summary-minimal.md +41 -0
  167. package/get-shit-done/templates/summary-standard.md +48 -0
  168. package/get-shit-done/templates/summary.md +248 -0
  169. package/get-shit-done/templates/user-profile.md +146 -0
  170. package/get-shit-done/templates/user-setup.md +311 -0
  171. package/get-shit-done/templates/verification-report.md +322 -0
  172. package/get-shit-done/workflows/add-phase.md +112 -0
  173. package/get-shit-done/workflows/add-tests.md +351 -0
  174. package/get-shit-done/workflows/add-todo.md +158 -0
  175. package/get-shit-done/workflows/audit-milestone.md +340 -0
  176. package/get-shit-done/workflows/audit-uat.md +109 -0
  177. package/get-shit-done/workflows/autonomous.md +891 -0
  178. package/get-shit-done/workflows/check-todos.md +177 -0
  179. package/get-shit-done/workflows/cleanup.md +152 -0
  180. package/get-shit-done/workflows/complete-milestone.md +767 -0
  181. package/get-shit-done/workflows/diagnose-issues.md +231 -0
  182. package/get-shit-done/workflows/discovery-phase.md +289 -0
  183. package/get-shit-done/workflows/discuss-phase-assumptions.md +653 -0
  184. package/get-shit-done/workflows/discuss-phase.md +1049 -0
  185. package/get-shit-done/workflows/do.md +104 -0
  186. package/get-shit-done/workflows/execute-phase.md +846 -0
  187. package/get-shit-done/workflows/execute-plan.md +514 -0
  188. package/get-shit-done/workflows/fast.md +105 -0
  189. package/get-shit-done/workflows/forensics.md +265 -0
  190. package/get-shit-done/workflows/health.md +181 -0
  191. package/get-shit-done/workflows/help.md +634 -0
  192. package/get-shit-done/workflows/insert-phase.md +130 -0
  193. package/get-shit-done/workflows/list-phase-assumptions.md +178 -0
  194. package/get-shit-done/workflows/list-workspaces.md +56 -0
  195. package/get-shit-done/workflows/manager.md +362 -0
  196. package/get-shit-done/workflows/map-codebase.md +377 -0
  197. package/get-shit-done/workflows/milestone-summary.md +223 -0
  198. package/get-shit-done/workflows/new-milestone.md +486 -0
  199. package/get-shit-done/workflows/new-project.md +1250 -0
  200. package/get-shit-done/workflows/new-workspace.md +237 -0
  201. package/get-shit-done/workflows/next.md +97 -0
  202. package/get-shit-done/workflows/node-repair.md +92 -0
  203. package/get-shit-done/workflows/note.md +156 -0
  204. package/get-shit-done/workflows/pause-work.md +176 -0
  205. package/get-shit-done/workflows/plan-milestone-gaps.md +273 -0
  206. package/get-shit-done/workflows/plan-phase.md +859 -0
  207. package/get-shit-done/workflows/plant-seed.md +169 -0
  208. package/get-shit-done/workflows/pr-branch.md +129 -0
  209. package/get-shit-done/workflows/profile-user.md +450 -0
  210. package/get-shit-done/workflows/progress.md +507 -0
  211. package/get-shit-done/workflows/quick.md +757 -0
  212. package/get-shit-done/workflows/remove-phase.md +155 -0
  213. package/get-shit-done/workflows/remove-workspace.md +90 -0
  214. package/get-shit-done/workflows/research-phase.md +82 -0
  215. package/get-shit-done/workflows/resume-project.md +326 -0
  216. package/get-shit-done/workflows/review.md +228 -0
  217. package/get-shit-done/workflows/session-report.md +146 -0
  218. package/get-shit-done/workflows/settings.md +283 -0
  219. package/get-shit-done/workflows/ship.md +228 -0
  220. package/get-shit-done/workflows/stats.md +60 -0
  221. package/get-shit-done/workflows/transition.md +671 -0
  222. package/get-shit-done/workflows/ui-phase.md +302 -0
  223. package/get-shit-done/workflows/ui-review.md +165 -0
  224. package/get-shit-done/workflows/update.md +323 -0
  225. package/get-shit-done/workflows/validate-phase.md +174 -0
  226. package/get-shit-done/workflows/verify-phase.md +254 -0
  227. package/get-shit-done/workflows/verify-work.md +637 -0
  228. package/hooks/dist/gsd-check-update.js +114 -0
  229. package/hooks/dist/gsd-context-monitor.js +156 -0
  230. package/hooks/dist/gsd-prompt-guard.js +96 -0
  231. package/hooks/dist/gsd-statusline.js +119 -0
  232. package/hooks/dist/gsd-workflow-guard.js +94 -0
  233. package/package.json +52 -0
  234. package/scripts/base64-scan.sh +262 -0
  235. package/scripts/build-hooks.js +82 -0
  236. package/scripts/prompt-injection-scan.sh +198 -0
  237. package/scripts/run-tests.cjs +29 -0
  238. package/scripts/secret-scan.sh +227 -0
@@ -0,0 +1,336 @@
1
+ /**
2
+ * Frontmatter — YAML frontmatter parsing, serialization, and CRUD commands
3
+ */
4
+
5
+ const fs = require('fs');
6
+ const path = require('path');
7
+ const { safeReadFile, normalizeMd, output, error } = require('./core.cjs');
8
+
9
+ // ─── Parsing engine ───────────────────────────────────────────────────────────
10
+
11
+ function extractFrontmatter(content) {
12
+ const frontmatter = {};
13
+ // Find ALL frontmatter blocks at the start of the file.
14
+ // If multiple blocks exist (corruption from CRLF mismatch), use the LAST one
15
+ // since it represents the most recent state sync.
16
+ const allBlocks = [...content.matchAll(/(?:^|\n)\s*---\r?\n([\s\S]+?)\r?\n---/g)];
17
+ const match = allBlocks.length > 0 ? allBlocks[allBlocks.length - 1] : null;
18
+ if (!match) return frontmatter;
19
+
20
+ const yaml = match[1];
21
+ const lines = yaml.split(/\r?\n/);
22
+
23
+ // Stack to track nested objects: [{obj, key, indent}]
24
+ // obj = object to write to, key = current key collecting array items, indent = indentation level
25
+ let stack = [{ obj: frontmatter, key: null, indent: -1 }];
26
+
27
+ for (const line of lines) {
28
+ // Skip empty lines
29
+ if (line.trim() === '') continue;
30
+
31
+ // Calculate indentation (number of leading spaces)
32
+ const indentMatch = line.match(/^(\s*)/);
33
+ const indent = indentMatch ? indentMatch[1].length : 0;
34
+
35
+ // Pop stack back to appropriate level
36
+ while (stack.length > 1 && indent <= stack[stack.length - 1].indent) {
37
+ stack.pop();
38
+ }
39
+
40
+ const current = stack[stack.length - 1];
41
+
42
+ // Check for key: value pattern
43
+ const keyMatch = line.match(/^(\s*)([a-zA-Z0-9_-]+):\s*(.*)/);
44
+ if (keyMatch) {
45
+ const key = keyMatch[2];
46
+ const value = keyMatch[3].trim();
47
+
48
+ if (value === '' || value === '[') {
49
+ // Key with no value or opening bracket — could be nested object or array
50
+ // We'll determine based on next lines, for now create placeholder
51
+ current.obj[key] = value === '[' ? [] : {};
52
+ current.key = null;
53
+ // Push new context for potential nested content
54
+ stack.push({ obj: current.obj[key], key: null, indent });
55
+ } else if (value.startsWith('[') && value.endsWith(']')) {
56
+ // Inline array: key: [a, b, c]
57
+ current.obj[key] = value.slice(1, -1).split(',').map(s => s.trim().replace(/^["']|["']$/g, '')).filter(Boolean);
58
+ current.key = null;
59
+ } else {
60
+ // Simple key: value
61
+ current.obj[key] = value.replace(/^["']|["']$/g, '');
62
+ current.key = null;
63
+ }
64
+ } else if (line.trim().startsWith('- ')) {
65
+ // Array item
66
+ const itemValue = line.trim().slice(2).replace(/^["']|["']$/g, '');
67
+
68
+ // If current context is an empty object, convert to array
69
+ if (typeof current.obj === 'object' && !Array.isArray(current.obj) && Object.keys(current.obj).length === 0) {
70
+ // Find the key in parent that points to this object and convert it
71
+ const parent = stack.length > 1 ? stack[stack.length - 2] : null;
72
+ if (parent) {
73
+ for (const k of Object.keys(parent.obj)) {
74
+ if (parent.obj[k] === current.obj) {
75
+ parent.obj[k] = [itemValue];
76
+ current.obj = parent.obj[k];
77
+ break;
78
+ }
79
+ }
80
+ }
81
+ } else if (Array.isArray(current.obj)) {
82
+ current.obj.push(itemValue);
83
+ }
84
+ }
85
+ }
86
+
87
+ return frontmatter;
88
+ }
89
+
90
+ function reconstructFrontmatter(obj) {
91
+ const lines = [];
92
+ for (const [key, value] of Object.entries(obj)) {
93
+ if (value === null || value === undefined) continue;
94
+ if (Array.isArray(value)) {
95
+ if (value.length === 0) {
96
+ lines.push(`${key}: []`);
97
+ } else if (value.every(v => typeof v === 'string') && value.length <= 3 && value.join(', ').length < 60) {
98
+ lines.push(`${key}: [${value.join(', ')}]`);
99
+ } else {
100
+ lines.push(`${key}:`);
101
+ for (const item of value) {
102
+ lines.push(` - ${typeof item === 'string' && (item.includes(':') || item.includes('#')) ? `"${item}"` : item}`);
103
+ }
104
+ }
105
+ } else if (typeof value === 'object') {
106
+ lines.push(`${key}:`);
107
+ for (const [subkey, subval] of Object.entries(value)) {
108
+ if (subval === null || subval === undefined) continue;
109
+ if (Array.isArray(subval)) {
110
+ if (subval.length === 0) {
111
+ lines.push(` ${subkey}: []`);
112
+ } else if (subval.every(v => typeof v === 'string') && subval.length <= 3 && subval.join(', ').length < 60) {
113
+ lines.push(` ${subkey}: [${subval.join(', ')}]`);
114
+ } else {
115
+ lines.push(` ${subkey}:`);
116
+ for (const item of subval) {
117
+ lines.push(` - ${typeof item === 'string' && (item.includes(':') || item.includes('#')) ? `"${item}"` : item}`);
118
+ }
119
+ }
120
+ } else if (typeof subval === 'object') {
121
+ lines.push(` ${subkey}:`);
122
+ for (const [subsubkey, subsubval] of Object.entries(subval)) {
123
+ if (subsubval === null || subsubval === undefined) continue;
124
+ if (Array.isArray(subsubval)) {
125
+ if (subsubval.length === 0) {
126
+ lines.push(` ${subsubkey}: []`);
127
+ } else {
128
+ lines.push(` ${subsubkey}:`);
129
+ for (const item of subsubval) {
130
+ lines.push(` - ${item}`);
131
+ }
132
+ }
133
+ } else {
134
+ lines.push(` ${subsubkey}: ${subsubval}`);
135
+ }
136
+ }
137
+ } else {
138
+ const sv = String(subval);
139
+ lines.push(` ${subkey}: ${sv.includes(':') || sv.includes('#') ? `"${sv}"` : sv}`);
140
+ }
141
+ }
142
+ } else {
143
+ const sv = String(value);
144
+ if (sv.includes(':') || sv.includes('#') || sv.startsWith('[') || sv.startsWith('{')) {
145
+ lines.push(`${key}: "${sv}"`);
146
+ } else {
147
+ lines.push(`${key}: ${sv}`);
148
+ }
149
+ }
150
+ }
151
+ return lines.join('\n');
152
+ }
153
+
154
+ function spliceFrontmatter(content, newObj) {
155
+ const yamlStr = reconstructFrontmatter(newObj);
156
+ const match = content.match(/^---\r?\n[\s\S]+?\r?\n---/);
157
+ if (match) {
158
+ return `---\n${yamlStr}\n---` + content.slice(match[0].length);
159
+ }
160
+ return `---\n${yamlStr}\n---\n\n` + content;
161
+ }
162
+
163
+ function parseMustHavesBlock(content, blockName) {
164
+ // Extract a specific block from must_haves in raw frontmatter YAML
165
+ // Handles 3-level nesting: must_haves > artifacts/key_links > [{path, provides, ...}]
166
+ const fmMatch = content.match(/^---\r?\n([\s\S]+?)\r?\n---/);
167
+ if (!fmMatch) return [];
168
+
169
+ const yaml = fmMatch[1];
170
+
171
+ // Find must_haves: first to detect its indentation level
172
+ const mustHavesMatch = yaml.match(/^(\s*)must_haves:\s*$/m);
173
+ if (!mustHavesMatch) return [];
174
+ const mustHavesIndent = mustHavesMatch[1].length;
175
+
176
+ // Find the block (e.g., "truths:", "artifacts:", "key_links:") under must_haves
177
+ // It must be indented more than must_haves but we detect the actual indent dynamically
178
+ const blockPattern = new RegExp(`^(\\s+)${blockName}:\\s*$`, 'm');
179
+ const blockMatch = yaml.match(blockPattern);
180
+ if (!blockMatch) return [];
181
+
182
+ const blockIndent = blockMatch[1].length;
183
+ // The block must be nested under must_haves (more indented)
184
+ if (blockIndent <= mustHavesIndent) return [];
185
+
186
+ // Find where the block starts in the yaml string
187
+ const blockStart = yaml.indexOf(blockMatch[0]);
188
+ if (blockStart === -1) return [];
189
+
190
+ const afterBlock = yaml.slice(blockStart);
191
+ const blockLines = afterBlock.split(/\r?\n/).slice(1); // skip the header line
192
+
193
+ // List items are indented one level deeper than blockIndent
194
+ // Continuation KVs are indented one level deeper than list items
195
+ const items = [];
196
+ let current = null;
197
+ let listItemIndent = -1; // detected from first "- " line
198
+
199
+ for (const line of blockLines) {
200
+ // Skip empty lines
201
+ if (line.trim() === '') continue;
202
+ const indent = line.match(/^(\s*)/)[1].length;
203
+ // Stop at same or lower indent level than the block header
204
+ if (indent <= blockIndent && line.trim() !== '') break;
205
+
206
+ const trimmed = line.trim();
207
+
208
+ if (trimmed.startsWith('- ')) {
209
+ // Detect list item indent from the first occurrence
210
+ if (listItemIndent === -1) listItemIndent = indent;
211
+
212
+ // Only treat as a top-level list item if at the expected indent
213
+ if (indent === listItemIndent) {
214
+ if (current) items.push(current);
215
+ current = {};
216
+ const afterDash = trimmed.slice(2);
217
+ // Check if it's a simple string item (no colon means not a key-value)
218
+ if (!afterDash.includes(':')) {
219
+ current = afterDash.replace(/^["']|["']$/g, '');
220
+ } else {
221
+ // Key-value on same line as dash: "- path: value"
222
+ const kvMatch = afterDash.match(/^(\w+):\s*"?([^"]*)"?\s*$/);
223
+ if (kvMatch) {
224
+ current = {};
225
+ current[kvMatch[1]] = kvMatch[2];
226
+ }
227
+ }
228
+ continue;
229
+ }
230
+ }
231
+
232
+ if (current && typeof current === 'object' && indent > listItemIndent) {
233
+ // Continuation key-value or nested array item
234
+ if (trimmed.startsWith('- ')) {
235
+ // Array item under a key
236
+ const arrVal = trimmed.slice(2).replace(/^["']|["']$/g, '');
237
+ const keys = Object.keys(current);
238
+ const lastKey = keys[keys.length - 1];
239
+ if (lastKey && !Array.isArray(current[lastKey])) {
240
+ current[lastKey] = current[lastKey] ? [current[lastKey]] : [];
241
+ }
242
+ if (lastKey) current[lastKey].push(arrVal);
243
+ } else {
244
+ const kvMatch = trimmed.match(/^(\w+):\s*"?([^"]*)"?\s*$/);
245
+ if (kvMatch) {
246
+ const val = kvMatch[2];
247
+ // Try to parse as number
248
+ current[kvMatch[1]] = /^\d+$/.test(val) ? parseInt(val, 10) : val;
249
+ }
250
+ }
251
+ }
252
+ }
253
+ if (current) items.push(current);
254
+
255
+ return items;
256
+ }
257
+
258
+ // ─── Frontmatter CRUD commands ────────────────────────────────────────────────
259
+
260
+ const FRONTMATTER_SCHEMAS = {
261
+ plan: { required: ['phase', 'plan', 'type', 'wave', 'depends_on', 'files_modified', 'autonomous', 'must_haves'] },
262
+ summary: { required: ['phase', 'plan', 'subsystem', 'tags', 'duration', 'completed'] },
263
+ verification: { required: ['phase', 'verified', 'status', 'score'] },
264
+ };
265
+
266
+ function cmdFrontmatterGet(cwd, filePath, field, raw) {
267
+ if (!filePath) { error('file path required'); }
268
+ // Path traversal guard: reject null bytes
269
+ if (filePath.includes('\0')) { error('file path contains null bytes'); }
270
+ const fullPath = path.isAbsolute(filePath) ? filePath : path.join(cwd, filePath);
271
+ const content = safeReadFile(fullPath);
272
+ if (!content) { output({ error: 'File not found', path: filePath }, raw); return; }
273
+ const fm = extractFrontmatter(content);
274
+ if (field) {
275
+ const value = fm[field];
276
+ if (value === undefined) { output({ error: 'Field not found', field }, raw); return; }
277
+ output({ [field]: value }, raw, JSON.stringify(value));
278
+ } else {
279
+ output(fm, raw);
280
+ }
281
+ }
282
+
283
+ function cmdFrontmatterSet(cwd, filePath, field, value, raw) {
284
+ if (!filePath || !field || value === undefined) { error('file, field, and value required'); }
285
+ // Path traversal guard: reject null bytes
286
+ if (filePath.includes('\0')) { error('file path contains null bytes'); }
287
+ const fullPath = path.isAbsolute(filePath) ? filePath : path.join(cwd, filePath);
288
+ if (!fs.existsSync(fullPath)) { output({ error: 'File not found', path: filePath }, raw); return; }
289
+ const content = fs.readFileSync(fullPath, 'utf-8');
290
+ const fm = extractFrontmatter(content);
291
+ let parsedValue;
292
+ try { parsedValue = JSON.parse(value); } catch { parsedValue = value; }
293
+ fm[field] = parsedValue;
294
+ const newContent = spliceFrontmatter(content, fm);
295
+ fs.writeFileSync(fullPath, normalizeMd(newContent), 'utf-8');
296
+ output({ updated: true, field, value: parsedValue }, raw, 'true');
297
+ }
298
+
299
+ function cmdFrontmatterMerge(cwd, filePath, data, raw) {
300
+ if (!filePath || !data) { error('file and data required'); }
301
+ const fullPath = path.isAbsolute(filePath) ? filePath : path.join(cwd, filePath);
302
+ if (!fs.existsSync(fullPath)) { output({ error: 'File not found', path: filePath }, raw); return; }
303
+ const content = fs.readFileSync(fullPath, 'utf-8');
304
+ const fm = extractFrontmatter(content);
305
+ let mergeData;
306
+ try { mergeData = JSON.parse(data); } catch { error('Invalid JSON for --data'); return; }
307
+ Object.assign(fm, mergeData);
308
+ const newContent = spliceFrontmatter(content, fm);
309
+ fs.writeFileSync(fullPath, normalizeMd(newContent), 'utf-8');
310
+ output({ merged: true, fields: Object.keys(mergeData) }, raw, 'true');
311
+ }
312
+
313
+ function cmdFrontmatterValidate(cwd, filePath, schemaName, raw) {
314
+ if (!filePath || !schemaName) { error('file and schema required'); }
315
+ const schema = FRONTMATTER_SCHEMAS[schemaName];
316
+ if (!schema) { error(`Unknown schema: ${schemaName}. Available: ${Object.keys(FRONTMATTER_SCHEMAS).join(', ')}`); }
317
+ const fullPath = path.isAbsolute(filePath) ? filePath : path.join(cwd, filePath);
318
+ const content = safeReadFile(fullPath);
319
+ if (!content) { output({ error: 'File not found', path: filePath }, raw); return; }
320
+ const fm = extractFrontmatter(content);
321
+ const missing = schema.required.filter(f => fm[f] === undefined);
322
+ const present = schema.required.filter(f => fm[f] !== undefined);
323
+ output({ valid: missing.length === 0, missing, present, schema: schemaName }, raw, missing.length === 0 ? 'valid' : 'invalid');
324
+ }
325
+
326
+ module.exports = {
327
+ extractFrontmatter,
328
+ reconstructFrontmatter,
329
+ spliceFrontmatter,
330
+ parseMustHavesBlock,
331
+ FRONTMATTER_SCHEMAS,
332
+ cmdFrontmatterGet,
333
+ cmdFrontmatterSet,
334
+ cmdFrontmatterMerge,
335
+ cmdFrontmatterValidate,
336
+ };