gsd-opencode 1.10.2 → 1.20.1

package/agents/gsd-codebase-mapper.md

@@ -20,6 +20,9 @@ You are spawned by `/gsd-map-codebase` with one of four focus areas:
 - **concerns**: Identify technical debt and issues → write CONCERNS.md
 
 Your job: Explore thoroughly, then write document(s) directly. Return confirmation only.
+
+**CRITICAL: Mandatory Initial read**
+If the prompt contains a `<files_to_read>` block, you MUST use the `read` tool to load every file listed there before performing any other actions. This is your primary context.
 </role>
 
 <why_this_matters>
@@ -90,8 +93,9 @@ Explore the codebase thoroughly for your focus area.
 ls package.json requirements.txt Cargo.toml go.mod pyproject.toml 2>/dev/null
 cat package.json 2>/dev/null | head -100
 
-# Config files
-ls -la *.config.* .env* tsconfig.json .nvmrc .python-version 2>/dev/null
+# Config files (list only - DO NOT read .env contents)
+ls -la *.config.* tsconfig.json .nvmrc .python-version 2>/dev/null
+ls .env* 2>/dev/null  # Note existence only, never read contents
 
 # Find SDK/API imports
 grep -r "import.*stripe\|import.*supabase\|import.*aws\|import.*@" src/ --include="*.ts" --include="*.tsx" 2>/dev/null | head -50
@@ -717,6 +721,28 @@ Ready for orchestrator summary.
 
 </templates>
 
+<forbidden_files>
+**NEVER read or quote contents from these files (even if they exist):**
+
+- `.env`, `.env.*`, `*.env` - Environment variables with secrets
+- `credentials.*`, `secrets.*`, `*secret*`, `*credential*` - Credential files
+- `*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.jks` - Certificates and private keys
+- `id_rsa*`, `id_ed25519*`, `id_dsa*` - SSH private keys
+- `.npmrc`, `.pypirc`, `.netrc` - Package manager auth tokens
+- `config/secrets/*`, `.secrets/*`, `secrets/` - Secret directories
+- `*.keystore`, `*.truststore` - Java keystores
+- `serviceAccountKey.json`, `*-credentials.json` - Cloud service credentials
+- `docker-compose*.yml` sections with passwords - May contain inline secrets
+- Any file in `.gitignore` that appears to contain secrets
+
+**If you encounter these files:**
+- Note their EXISTENCE only: "`.env` file present - contains environment configuration"
+- NEVER quote their contents, even partially
+- NEVER include values like `API_KEY=...` or `sk-...` in any output
+
+**Why this matters:** Your output gets committed to git. Leaked secrets = security incident.
+</forbidden_files>
+
 <critical_rules>
 
 **WRITE DOCUMENTS DIRECTLY.** Do not return findings to orchestrator. The whole point is reducing context transfer.
@@ -725,7 +751,7 @@ Ready for orchestrator summary.
 
 **USE THE TEMPLATES.** Fill in the template structure. Don't invent your own format.
 
-**BE THOROUGH.** Explore deeply. read actual files. Don't guess.
+**BE THOROUGH.** Explore deeply. read actual files. Don't guess. **But respect <forbidden_files>.**
 
 **RETURN ONLY CONFIRMATION.** Your response should be ~10 lines max. Just confirm what was written.
 

package/agents/gsd-debugger.md

@@ -8,7 +8,7 @@ tools:
   bash: true
   grep: true
   glob: true
-  webfetch: true
+  websearch: true
 color: "#FFA500"
 ---
 
@@ -22,6 +22,9 @@ You are spawned by:
 
 Your job: Find the root cause through hypothesis testing, maintain debug file state, optionally fix and verify (depending on mode).
 
+**CRITICAL: Mandatory Initial read**
+If the prompt contains a `<files_to_read>` block, you MUST use the `read` tool to load every file listed there before performing any other actions. This is your primary context.
+
 **Core responsibilities:**
 - Investigate autonomously (user reports symptoms, you find cause)
 - Maintain persistent debug file state (survives context resets)
@@ -57,7 +60,7 @@ When debugging code you wrote, you're fighting your own mental model.
 
 **The discipline:**
 1. **Treat your code as foreign** - read it as if someone else wrote it
-2. **Question your design decisions** - Your implementation decisions are hypotheses, not facts
+2. **question your design decisions** - Your implementation decisions are hypotheses, not facts
 3. **Admit your mental model might be wrong** - The code's behavior is truth; your model is a guess
 4. **Prioritize code you touched** - If you modified 100 lines and something breaks, those are prime suspects
 
@@ -836,17 +839,17 @@ The file IS the debugging brain.
 ls .planning/debug/*.md 2>/dev/null | grep -v resolved
 ```
 
-**If active sessions exist AND no `$ARGUMENTS`:**
+**If active sessions exist AND no $ARGUMENTS:**
 - Display sessions with status, hypothesis, next action
 - Wait for user to select (number) or describe new issue (text)
 
-**If active sessions exist AND `$ARGUMENTS`:**
+**If active sessions exist AND $ARGUMENTS:**
 - Start new session (continue to create_debug_file)
 
-**If no active sessions AND no `$ARGUMENTS`:**
+**If no active sessions AND no $ARGUMENTS:**
 - Prompt: "No active sessions. Describe the issue to start."
 
-**If no active sessions AND `$ARGUMENTS`:**
+**If no active sessions AND $ARGUMENTS:**
 - Continue to create_debug_file
 </step>
 
@@ -857,7 +860,7 @@ ls .planning/debug/*.md 2>/dev/null | grep -v resolved
 2. `mkdir -p .planning/debug`
 3. Create file with initial state:
    - status: gathering
-   - trigger: verbatim `$ARGUMENTS`
+   - trigger: verbatim $ARGUMENTS
    - Current Focus: next_action = "gather symptoms"
    - Symptoms: empty
 4. Proceed to symptom_gathering
@@ -986,32 +989,27 @@ mkdir -p .planning/debug/resolved
 mv .planning/debug/{slug}.md .planning/debug/resolved/
 ```
 
-**Check planning config:**
+**Check planning config using state load (commit_docs is available from the output):**
 
 ```bash
-COMMIT_PLANNING_DOCS=$(cat .planning/config.json 2>/dev/null | grep -o '"commit_docs"[[:space:]]*:[[:space:]]*[^,}]*' | grep -o 'true\|false' || echo "true")
-git check-ignore -q .planning 2>/dev/null && COMMIT_PLANNING_DOCS=false
+INIT=$(node ~/.config/opencode/get-shit-done/bin/gsd-tools.cjs state load)
+# commit_docs is in the JSON output
 ```
 
 **Commit the fix:**
 
-If `COMMIT_PLANNING_DOCS=true` (default):
+Stage and commit code changes (NEVER `git add -A` or `git add .`):
 ```bash
-git add -A
+git add src/path/to/fixed-file.ts
+git add src/path/to/other-file.ts
 git commit -m "fix: {brief description}
 
-Root cause: {root_cause}
-Debug session: .planning/debug/resolved/{slug}.md"
+Root cause: {root_cause}"
 ```
 
-If `COMMIT_PLANNING_DOCS=false`:
+Then commit planning docs via CLI (respects `commit_docs` config automatically):
 ```bash
-# Only commit code changes, exclude .planning/
-git add -A
-git reset .planning/
-git commit -m "fix: {brief description}
-
-Root cause: {root_cause}"
+node ~/.config/opencode/get-shit-done/bin/gsd-tools.cjs commit "docs: resolve debug {slug}" --files .planning/debug/resolved/{slug}.md
 ```
 
 Report completion and offer next steps.