gsd-lite 0.7.7 → 0.7.9

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "gsd",
       "source": "./",
       "description": "AI orchestration tool — GSD management shell + Superpowers quality core. 5 commands, 4 agents, 5 workflows, MCP server, context monitoring.",
-      "version": "0.7.7",
+      "version": "0.7.9",
       "keywords": [
         "orchestration",
         "mcp",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core",
   "author": {
     "name": "sdsrss",

package/install.js

@@ -210,7 +210,19 @@ export function main() {
 
   // 6. Stable runtime for MCP server
   copyDir(join(__dirname, 'src'), join(RUNTIME_DIR, 'src'), 'runtime/src → ~/.claude/gsd/src/');
-  copyFile(join(__dirname, 'package.json'), join(RUNTIME_DIR, 'package.json'), 'runtime/package.json → ~/.claude/gsd/package.json');
+  // Write a sanitized package.json: strip dev-only npm lifecycle scripts
+  // (prepare/prepublishOnly/version use POSIX shell + dev tooling absent from
+  // the runtime). Leaving them in means a later manual `npm install` in
+  // ~/.claude/gsd fails under cmd.exe on Windows (issue #2).
+  if (DRY_RUN) {
+    log('  [dry-run] Would write runtime/package.json (dev scripts stripped)');
+  } else {
+    const runtimePkg = JSON.parse(readFileSync(join(__dirname, 'package.json'), 'utf-8'));
+    delete runtimePkg.scripts;
+    mkdirSync(RUNTIME_DIR, { recursive: true });
+    writeFileSync(join(RUNTIME_DIR, 'package.json'), JSON.stringify(runtimePkg, null, 2) + '\n');
+    log('  ✓ runtime/package.json → ~/.claude/gsd/package.json (scripts stripped)');
+  }
   // Copy uninstall.js so the SessionStart hook's Phase 0 orphan-cleanup can
   // spawn it when /plugin uninstall has removed the plugin without running our
   // uninstaller. Without this, hooks/runtime/settings.json entries written by
@@ -230,7 +242,12 @@ export function main() {
     log('  ⧗ Installing runtime dependencies...');
     const lockFile = join(RUNTIME_DIR, 'package-lock.json');
     const hasLockFile = existsSync(lockFile);
-    const installCmd = hasLockFile ? 'npm ci --omit=dev' : 'npm install --omit=dev --no-fund --no-audit';
+    // --ignore-scripts: the runtime install only needs node_modules. Skipping
+    // lifecycle scripts avoids running the dev-only POSIX `prepare` git-hook
+    // setup, which fails under cmd.exe on Windows (issue #2).
+    const installCmd = hasLockFile
+      ? 'npm ci --omit=dev --ignore-scripts'
+      : 'npm install --omit=dev --no-fund --no-audit --ignore-scripts';
     try {
       execSync(installCmd, { cwd: RUNTIME_DIR, stdio: 'pipe' });
       log('  ✓ runtime dependencies installed');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-lite",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core",
   "type": "module",
   "bin": {

package/src/schema.js

@@ -761,16 +761,28 @@ export function createInitialState({ project, phases }) {
   // the public API guard is in init() which rejects phases.length === 0.
   // Validate task names and uniqueness before creating state
   const seenIds = new Set();
+  // Track task IDs per phase so task-kind dependencies can be checked against the
+  // same phase only — selectRunnableTask resolves task deps within phase.todo, so a
+  // cross-phase task dep silently deadlocks at runtime. patchPlan.add_dependency
+  // rejects the same thing; keep init consistent.
+  const phaseTaskIds = phases.map(() => new Set());
   for (const [pi, p] of phases.entries()) {
     for (const [ti, t] of (p.tasks || []).entries()) {
       if (!t.name || typeof t.name !== 'string') {
         return { error: true, message: `Phase ${pi + 1} task ${ti + 1}: name is required (got ${JSON.stringify(t.name)})` };
       }
+      // Guard explicit index: must be a positive integer or it yields malformed task IDs
+      // (e.g. "1.0", "1.1.5", "1.x") that break downstream id parsing.
+      if (t.index !== undefined && t.index !== null
+          && (!Number.isInteger(t.index) || t.index < 1)) {
+        return { error: true, message: `Phase ${pi + 1} task ${ti + 1}: index must be a positive integer (got ${JSON.stringify(t.index)})` };
+      }
       const id = `${pi + 1}.${t.index ?? (ti + 1)}`;
       if (seenIds.has(id)) {
         return { error: true, message: `Duplicate task ID: ${id} in phase ${pi + 1}` };
       }
       seenIds.add(id);
+      phaseTaskIds[pi].add(id);
     }
   }
 
@@ -792,8 +804,12 @@ export function createInitialState({ project, phases }) {
         if (dep.gate && !validGates.includes(dep.gate)) {
           return { error: true, message: `Task ${taskId}: requires entry gate must be one of ${validGates.join(', ')} (got "${dep.gate}")` };
         }
-        if (dep.kind === 'task' && !seenIds.has(String(dep.id))) {
-          return { error: true, message: `Task ${taskId}: requires references non-existent task "${dep.id}" (valid IDs: ${[...seenIds].join(', ')})` };
+        if (dep.kind === 'task' && !phaseTaskIds[pi].has(String(dep.id))) {
+          if (seenIds.has(String(dep.id))) {
+            const targetPhase = String(dep.id).split('.')[0];
+            return { error: true, message: `Task ${taskId}: requires references task "${dep.id}" in a different phase (cross-phase task dependencies are not supported — use a phase dependency {kind: "phase", id: ${targetPhase}} for cross-phase ordering)` };
+          }
+          return { error: true, message: `Task ${taskId}: requires references non-existent task "${dep.id}" (same-phase IDs: ${[...phaseTaskIds[pi]].join(', ') || 'none'})` };
         }
         if (dep.kind === 'phase') {
           const phaseId = Number(dep.id);

package/src/server.js

@@ -259,6 +259,10 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
 }));
 
 async function dispatchToolCall(name, args) {
+  // Normalize missing args (MCP clients may omit `arguments`, sending null/undefined)
+  // so every tool receives an object and returns a clean validation error rather than
+  // leaking a raw destructuring TypeError.
+  args = args || {};
   let result;
   switch (name) {
     case 'health': {

package/src/tools/orchestrator/resume.js

@@ -220,7 +220,11 @@ async function resumeExecutingTask(state, basePath) {
   const reviewPassed = phase.phase_review?.status === 'accepted'
     || phase.phase_handoff?.required_reviews_passed === true
     || allAccepted;
-  if (allAccepted && reviewPassed) {
+  // Zero-task phase (empty milestone) is complete-able once its vacuous review passed —
+  // otherwise it can never satisfy the all-tasks-accepted condition and stalls.
+  const emptyPhaseDone = phase.todo.length === 0
+    && (phase.phase_review?.status === 'accepted' || phase.phase_handoff?.required_reviews_passed === true);
+  if ((allAccepted && reviewPassed) || emptyPhaseDone) {
     // Auto-advance phase lifecycle to 'reviewing' if currently 'active'
     // (mirrors trigger_review path at line 480-482)
     if (phase.lifecycle === 'active') {

package/src/tools/state/crud.js

@@ -60,7 +60,7 @@ export async function computePlanHashes(basePath) {
 /**
  * Initialize a new GSD project: creates .gsd/, state.json, plan.md, phases/
  */
-export async function init({ project, phases, research, force = false, basePath = process.cwd() }) {
+export async function init({ project, phases, research, force = false, basePath = process.cwd() } = {}) {
   if (!project || typeof project !== 'string') {
     return { error: true, code: ERROR_CODES.INVALID_INPUT, message: 'project must be a non-empty string' };
   }
@@ -808,6 +808,12 @@ function _applyPatchOp(state, op) {
       const { phase_id, task } = op;
       if (typeof phase_id !== 'number') return { error: true, message: 'phase_id must be a number' };
       if (!task || typeof task.name !== 'string' || task.name.length === 0) return { error: true, message: 'task.name must be a non-empty string' };
+      // Guard task.index: a non-positive-integer index produces malformed IDs like
+      // "1.0"/"1.1.5"/"1.x"; "1.x" then poisons Math.max() and cascades to "1.NaN".
+      if (task.index !== undefined && task.index !== null
+          && (!Number.isInteger(task.index) || task.index < 1)) {
+        return { error: true, message: `task.index must be a positive integer (got ${JSON.stringify(task.index)})` };
+      }
 
       const phase = state.phases.find(p => p.id === phase_id);
       if (!phase) return { error: true, message: `Phase ${phase_id} not found` };
@@ -903,6 +909,11 @@ function _applyPatchOp(state, op) {
       const existing = new Set(taskMap.keys());
       const ordered = new Set(order);
 
+      // Reject duplicate IDs explicitly — otherwise a set-size match can slip a
+      // duplicate into todo and surface later as a misleading "circular dependency" error.
+      if (ordered.size !== order.length) {
+        return { error: true, message: `order contains duplicate task IDs for phase ${phase_id}` };
+      }
       // Must contain exactly the same task IDs
       if (ordered.size !== existing.size || ![...ordered].every(id => existing.has(id))) {
         return { error: true, message: `order must contain exactly the same task IDs as phase ${phase_id}` };

package/src/tools/state/logic.js

@@ -36,9 +36,14 @@ export function selectRunnableTask(phase, state, { maxRetry = DEFAULT_MAX_RETRY
   if (!phase || !Array.isArray(phase.todo)) {
     return { error: true, message: 'Phase todo must be an array' };
   }
-  // D-4: Zero-task phase — immediately trigger review so phase can advance
+  // D-4: Zero-task phase — trigger review once so the phase can advance, but only
+  // until that (vacuous) review passes. Returning trigger_review unconditionally
+  // makes the resume loop oscillate forever (review accepts → resume → review again)
+  // because an empty phase never reaches the normal all-accepted completion path.
   if (phase.todo.length === 0) {
-    return { mode: 'trigger_review' };
+    const reviewPassed = phase.phase_review?.status === 'accepted'
+      || phase.phase_handoff?.required_reviews_passed === true;
+    return reviewPassed ? { task: undefined, diagnostics: [] } : { mode: 'trigger_review' };
   }
 
   const runnableTasks = [];