Skip to content

chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.16.0 - #72

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/opengsd/gsd-core-1.16.0
Closed

chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.16.0#72
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/opengsd/gsd-core-1.16.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 8, 2026

Copy link
Copy Markdown
Contributor

Bumps @opengsd/gsd-core from 1.15.0 to 1.16.0.

Release notes

Sourced from @​opengsd/gsd-core's releases.

v1.16.0

Install

npm i @opengsd/gsd-core@1.16.0
# or
npm i @opengsd/gsd-core@latest

What's Changed

Enhancement

Fix

... (truncated)

Changelog

Sourced from @​opengsd/gsd-core's changelog.

[1.16.0] - 2026-10-05

Changed

  • Command arguments now arrive in a labeled <arguments> block — every argument-taking command and skill template opens with <arguments>$ARGUMENTS</arguments> (always present, empty when nothing was typed), so a flag such as /gsd-update --reapply can no longer be misread as template prose and silently run the default workflow. (#4780) (#5145)
  • /gsd-fast now appears in the generated CLAUDE.md entry-point list — listed ahead of /gsd-quick as the lightest entry point for a trivial, one-sentence task with no subagents and no PLAN.md. (#5110)
  • gsd-tools and the hooks that load gsd-core/bin/lib start faster — they turn on Node's compile cache, so later runs reuse compiled code for unchanged modules. Output is unchanged; the cache lives under the OS temp directory and NODE_DISABLE_COMPILE_CACHE (any value) turns it off. (#5183) (#5191)

Fixed

  • roadmap analyze now reports phases whose ROADMAP checkbox disagrees with their disk status — a [x] backfilled phase (summary, no plans) or a fully summarized [x] phase without a passing VERIFICATION is still returned as next_phase/current_phase (selectors stay disk-authoritative per ADR-3180), and a new checkbox_conflict list names each such phase instead of handing back a completed phase with no signal. (#4757) (#5146)
  • Blocking PreToolUse guards no longer silently allow a denied edit on a slow host — plugin-registered and Kimi-registered guards use the 120 s host budget the installer already uses; the worktree-path, workflow and Windsurf pre-write guards give their git probes a 5 s budget instead of 2 s; and the OpenCode and Kilo plugins no longer kill the git-probing guards before their worst case finishes. A killed or timed-out guard counts as an allow, so on a starved host any of these could previously let through the edit it exists to deny (Windsurf documents no hook timeout, so its host budget stays unknown). (#5180) (#5185)
  • Roadmap analyze now reads each phase's own checkbox — a phase's completion status could be read from a different phase's checklist line when its description merely mentioned this phase's number. (#4965) (#5063)
  • The secret-read guard no longer blocks git check-ignore, git ls-files, git rm --cached or a template copy on a secret file — these name the file without printing it (git check-ignore -v .env, cp .env.example .env), yet the guard treated every operand of git, cp and mv as a read. Only those operand positions are now exempt; content-revealing forms (git show, git diff, git log -p, git blame, a secret cp/mv source) and any unlisted option stay blocked. (#5047)
  • The debugger's knowledge base is no longer treated as a debug session — gsd-debugger appends every resolved session to .planning/debug/knowledge-base.md, and every reader of the debug directory treated that file as a session: audit-open reported it as open on every run (so every milestone-close audit carried a permanent false positive), /gsd-debug list listed it, /gsd-debug's resume prompt offered it as a session to resume, /gsd-progress counted it as an active debug session, and the debugger's own active-session check listed it. All of them now skip it by name. The shell readers also no longer hide a real active session whose slug contains "resolved" (e.g. unresolved-promise-hang). (#4869, #5011) (#5041)
  • TDD RED-evidence gate now recognizes a genuine Python unittest failure — a real red from python -m unittest was misreported as zero tests discovered, permanently blocking GREEN. (#4970) (#5062)
  • /gsd-pause-work now detects the active phase — context detection globbed a literal PLAN.md, so phases whose plans use the canonical {phase}-{plan}-PLAN.md name were never found and the handoff silently landed in .planning/.continue-here.md instead of the phase directory that execute-phase reads for blocking anti-patterns. (#4966)
  • milestone: null in STATE.md no longer produces a false "asserted ... matches no ROADMAP heading" warning — YAML null (null, Null, NULL, ~, with an optional trailing comment) is now read as "no milestone asserted" by every milestone: reader through one shared normalizer, including state update-progress, which previously withheld its write on a flat ROADMAP. When the ROADMAP has real milestone sections, progress counters are withheld (left at their stored values) instead of being silently recomputed from a whole-document or on-disk scan that could conflate a foreign milestone's phases; a flat (unsectioned) ROADMAP keeps its whole-document count. (#5111)
  • gsd-verifier now resolves gsd-tools in re-verification mode — the gsd_run resolver was defined only in the initial-mode Step 1, so re-verification fell back to a disk-wide find / that stalled the verifier; it is now a mode-independent preamble that also forbids filesystem searches. (#5004) (#5142)
  • Installer no longer crashes on a malformed extended-hook entry in settings.json — a non-array value under SubagentStop, Stop, PreCompact, SubagentStart or FileChanged now repairs to an empty list like the other extended events do, because hook registration is now one table behind the settings-json adapter instead of per-hook branches. (#5207) (#5208)
  • A verification report with a status outside passed | gaps_found | human_needed is now a hard error, and a stale phase re-verifies instead of looping — status: verified (or Passed, stale, a number) used to route as unknown to /gsd-execute-phase; every command that reads the report now stops with verification_status_invalid naming the file, the value, the accepted values and the recovery (set the report's status: or delete the report and re-run verification), and /gsd-health reports it as W030. Case-folded and legacy statuses (Passed, pending, partial) that phase complete's warning pre-scan and audit-uat used to fold into a known status hard-error the same way. A stale report has one route: /gsd-verify-work now runs the same regeneration step as /gsd-execute-phase so the phase ends passed (a missing report on a phase that is not fully executed still blocks with /gsd-execute-phase instead), and a phase directory that does not exist reads phase_dir_not_found with no next command instead of sending you to re-execute it. verification status and planning inspect gain an additive route field (the bare command the status routes to) and init * gains verification_route; the unknown status no longer exists (#5118). (#5131)
  • summary-extract now fails loudly on malformed SUMMARY frontmatter — a SUMMARY.md with unparseable YAML frontmatter used to silently report empty fields (including requirements_completed) at exit 0; it now exits non-zero with a parse error naming the file, and an absolute target path resolves correctly instead of being mangled by the working directory (#5013). (#5070)
  • A gate verb that failed no longer exits 0, and a gate that could not read its evidence no longer passes — phase uat-passed, verify artifacts, verify plan-structure, verify phase-completeness, verify references, verify commits and verify key-links printed a failing verdict and exited 0, and gates that hit an unreadable plan, directory or COVERAGE.md treated it as empty and passed. Their exit status now follows the verdict: 0 pass, 1 negative verdict, 66 empty scope, 69 could not look (the JSON on stdout is unchanged; check verbs and the drift verbs stay payload mode, where a blocking verdict is still exit 0 and only 69 is non-zero). Also: verify schema-drift now sees a block-sequence files_modified, verify plan-structure flags a ! grep negative gate whose literal appears in the task action, verify commits outside a repository exits 69 instead of listing every hash invalid, and the test runner fails a chunk whose registered tests are not all reported, or whose accounting evidence cannot be read. (#5170) (#5171)
  • Quick-task rows, audit acknowledgements and the context-exhaustion breadcrumb are dated with your local day, and honor the test clock pin — quick-tasks-append (the Date column of STATE.md's Quick Tasks Completed table), audit-open acknowledge without --at, and the context monitor's CRITICAL auto-record (the day in STATE.md's Stopped At: context exhaustion at N% (<day>)) took the UTC calendar day of the real wall clock, so work done between local midnight and UTC midnight was stamped with the wrong day, and GSD_NOW_MS could not pin any of them. All three now use the local calendar day through the clock seam, like every other operator-facing date field; an explicit --at still wins. (#4905) (#5043)
  • Fixed the manager's ROADMAP checkbox projection mis-attributing phase checkboxes. An unanchored regex let a checklist line's checkbox bind to the wrong phase whenever its own prose mentioned a later phase number, and a global last-match-wins scan let a later checklist line silently overwrite an earlier phase's correct checkbox state — both could report the wrong phase as next/complete. (#4982) (#5064)
  • A green /gsd-verify-work run no longer leaves its own verification report stale — verify-work and autonomous stopped re-running the security, validation and UI-review steps after the fingerprint when their file already exists, a complete UAT is no longer rewritten and committed on resume, and a re-audit whose counts match the previous audit no longer appends a duplicate dated block. A genuinely changed audit still writes and still marks the report stale. (#5105) (#5114)
  • Gates and workflows evaluate a phase, plan or quick task through one scope resolver — code review, the UI safety and TDD checkpoint gates, decision-coverage verify, schema-drift, quick and the execute workflows no longer scope their work with HEAD~1..HEAD, base..HEAD ranges or any-branch commit lookups, so unrelated interleaved commits and commits that live only on another branch stop appearing in a phase's scope; a scope the resolver had to widen or could not read is reported by name instead of passing as empty. (#5164) (#5168)
  • A resolved UAT issue no longer blocks phase completion forever. A result: issue test whose ## Gaps entry was reconciled to status: resolved by an executed gap-closure plan kept blocking phase uat-passed and re-routing a resumed /gsd:verify-work session into diagnosis, because neither ever read the Gaps resolution state. (#4983) (#5066)
  • /gsd-progress, /gsd-stats, init plan-phase, roadmap analyze and state.json now agree on what state a phase is in — a phase whose verification report says passed but no longer matches the code showed Complete in progress and stats while /gsd-health said it was not; it now shows Executed everywhere. roadmap analyze reports executed (not partial) for a fully executed, unverified phase, as init manager already did, and gives table-declared phases a real status instead of ok. A ROADMAP Progress Status cell with notes after the word (Complete — shipped) is read by that word, a Planned cell reads as in_progress in state.json, and drift-guard phase-status can now compare both. The milestone's completed-phase count (init milestone-op) counts only verified phases, not any phase with a summary. (#5060) (#5077)
  • /gsd-quick now pre-commits the plan when workflow.use_worktrees is unset — with the key absent (documented default: true) the executor was dispatched in a worktree, but the section manifest read the unset key as false and skipped the pre-dispatch PLAN.md commit, so the isolated executor started without its plan committed at the worktree HEAD. An unset key now selects the same steps as an explicit true, and a root-level use_worktrees is inherited under GSD_WORKSTREAM exactly as config-get reports it; an explicit false still opts out. (#4977) (#5025)
  • A throw inside check prohibition-enforcement no longer crashes the gate — it returns a non-blocking unreadable verdict like every other gate, and the four drift and prohibition check verbs now live in gate modules that the positive-control ratchet covers; check verify-codebase-drift now treats a mapped-commit stamp that is not a 7–64 character hex id (a ref name such as HEAD, a 6-character abbreviation) as unresolvable instead of handing it to the version-control tool. (#5219) (#5220)
  • Fixed skills/*/SKILL.md still telling agents to run a bare gsd-tools command — on a shim-only install (no global gsd-tools on PATH), following gsd-workstreams, gsd-quick, gsd-review-backlog, or gsd-config's SKILL.md instructions verbatim failed with command not found; the generated skill now uses the same gsd_run resolver every other shipped skill/workflow already relies on. (#4995) (#5075)
  • A top-level context_coverage_gate: false no longer disables the blocking decision-coverage gate — a config holding only that key switched the gate off even though plan-phase and config-get treated it as enabled; gate config is now read from nested workflow.* keys exactly as config-get answers, and honors GSD_WORKSTREAM; a malformed config.json is read as an absent key without a stderr warning, verify context-drift / codebase-drift read their workflow.* keys through the same reader (context-drift and schema-drift now stay non-blocking on a config error such as an invalid GSD_WORKSTREAM), check tdd-red-evidence refuses a record path outside the project directory (a relative path resolves against the process working directory, so from elsewhere a project-relative path is refused too), and the tdd-review-checkpoint plan id reaches git log --grep as an escaped literal (#5139). (#5144)
  • frontmatter set and frontmatter merge no longer lose or corrupt frontmatter — a single line without a space after its colon made setting one key delete every other key. Comments and blank lines next to a changed key were dropped. Multi-line values could be left unreadable, and every markdown write reformatted the frontmatter block. Writes now keep every line they don't change, keep comments (inline and nested) or refuse, and refuse, leaving the file untouched, when the frontmatter cannot be parsed or would not read back as written. (#5105) (#5114)
  • gates.* confirmation toggles now actually take effect — the config schema previously rejected gates.execute_next_plan/gates.confirm_transition/gates.confirm_milestone_scope as unknown keys, and workflows only honored them under a nonexistent mode: "custom", so the toggle was a no-op regardless of value; config-set mode now also rejects anything other than interactive/yolo. (#4974) (#5076)
  • With GSD_HOME set, /gsd-new-project now seeds the project config from the same defaults.json the config loader reads — config-new-project (and every other command that creates .planning/config.json, such as config-ensure-section) read defaults.json and the per-provider *_api_key files from the home directory, while the config loader and its shadowed-global-defaults warning (#3532) read $GSD_HOME/.gsd/. One /gsd-new-project run therefore seeded the project from a different file than the one the loader had just resolved, detected search providers from the wrong key files, wrote the depth → granularity migration into the wrong defaults.json, and the warning named a file that never seeded the project. config-new-project and init new-project now resolve the store as GSD_HOME, falling back to the home directory, exactly like the loader. Nothing changes when GSD_HOME is unset. (#4976) (#5015)
  • A passed verification no longer goes permanently stale on its own report or on plans the verifier forgot to list — verification fingerprint now leaves the *-VERIFICATION.md report out of its own digest, always includes the phase's own plans and summaries (so --raw callers get a digest that verifies too), and accepts phase files that live in a planning store symlinked outside the repository. Fingerprints are now v3:; existing v1/v2 reports keep verifying as before, and a report that listed itself needs one re-fingerprint, after which it stays fresh. (#5095) (#5103)
  • Every remaining hand-rolled phase-heading regex, and every bold-label markdown field mutation that bypassed the PlanningDoc seam, now routes through one owner instead of a duplicated copy — /gsd-phase's add/insert/renumber/complete paths, /gsd-roadmap's milestone-parsing paths, and the "Depends on" and STATE.md field writers no longer carry their own independently-typed #{2,4}\s*Phase\s+ literal or ad-hoc .replace() mutation of a bold-label field. A new lint (local/no-adhoc-markdown-parsing's field-shaped detector) and a new positive-control check for the PlanningDoc seam's grammars now fail CI on the next such copy, closing the epic (#4906) this phase completes. No user-facing command, flag, or output format changed. (#5007) (#5022)
  • Mempalace gates on default-true keys now say what they mean — the recall command's knowledge-graph step and the curator agent's diary and KG-mirror steps read "unless <key> !== false", which literally licenses the step only when the key is false. They now read "when <key> !== false"; behavior is unchanged (an absent key still means enabled, only an explicit false disables). (#5173) (#5184)
  • phase.plan-index and the other readers of a *-PLAN.md file's frontmatter (wave, depends_on, autonomous, agent_hint, files_modified, files_deleted, type, objective) now read through the same PlanningDoc seam every other planning-document field goes through, instead of a separate call path — closing a naming-collision risk between src/plan-document.cts and the seam that the epic behind #4906 flagged but never resolved. No user-facing command, flag, or output changed; every value returned is byte-identical to before. (#5026) (#5028)
  • Keep dispatch isolation sentinels out of Git status — projects without an existing .gsd ignore rule no longer show the tool-owned sentinel as untracked, while existing local ignore rules remain intact. (#5086) (#5154)
  • effort sync and resolve-execution use a project-local Claude install's agents — they no longer read the global agents directory when running from a local install, and an empty selected directory explains why nothing was synced. (#4988) (#5160)
  • Shipped instructions now point at live phase and backlog commands — references to the absorbed /gsd-add-phase, /gsd-insert-phase and /gsd-add-backlog commands now use /gsd:phase "<description>", /gsd:phase --insert <after-phase> "<description>" and /gsd:capture --backlog. A guard walks every shipped prose directory and rejects the colon, hyphen and space spellings of all three removed commands. MVP instructions also use /gsd:<cmd> for live commands, replacing the unregistered /gsd <cmd> spelling; a second guard covers every live command. (#5002) (#5044)
  • gsd-tools check tdd-red-evidence now recognizes a genuine swift-testing failure — a real red from swift test was silently misreported as zero tests discovered, permanently blocking the TDD gate's RED-to-GREEN transition. (#4957) (#5055)
  • roadmap update-plan-progress no longer wipes the Progress-table Status cell — it rewrites only the leading status token and keeps any prose after it, no longer clears a - Completed placeholder, and no longer leaves the row as In Progress| |. (#4925) (#4931)
  • /gsd-debug no longer re-asks symptoms already given. When a symptom value (expected behavior, actual behavior, error messages, timeline, reproduction) is already supplied in $ARGUMENTS, Step 2 now shows it back for confirmation instead of asking the open question from scratch, and asks only for whatever is still missing (#5012). (#5087)
  • TDD mode accepts a genuine Vitest RED instead of rejecting it as zero_tests_discovered — check tdd-red-evidence now reads each report format through an adapter: TAP for Node and Vitest (tap/tap-flat), JUnit XML for Maven Surefire/Failsafe, swift-testing console output (including swift-testing 6.1 and tests without a display name), and Python unittest text. All four feed the same target-failure gate. The gate is stricter than before: a TAP report needs its plan, an XML report must be one complete document with no console text around it, the record's exit code must be a non-negative integer, and incomplete reports, bailouts, unittest load failures, skipped/TODO targets and ambiguous names block GREEN. The parsers ship with installed runtimes, which need no node_modules. (#4701)
  • An unknown runtime id is refused instead of installing into Claude Code's directory, and the shell launcher no longer probes the retired Gemini home — getGlobalConfigDir('gemini-typo') and the other runtime accessors used to answer with ~/.claude and the Claude label for any id they did not know, and the gsd_run launcher kept probing GEMINI_CONFIG_DIR while omitting zcode, pi and kimi; every path and label accessor now throws UnknownRuntimeError, and the launcher's home list is generated from the same runtime descriptors the JS resolver reads. The stale-bake warning now resolves the active runtime the way every other consumer does (GSD_RUNTIME, then config.runtime, then the install marker), so it also fires for an install that names its runtime only through the marker. The graphify, import and discuss-phase commands now carry the same launcher: a bare gsd-tools on PATH is used only after its identity is proven, a warning prints when it cannot be, and the command exits 1 when no install is found. (#5169) (#5206)
  • phase-plan-index now reports each plan's gap_closure value, so /gsd-execute-phase N --gaps-only runs the gap-closure plans instead of selecting none and exiting with a success message; the --gaps-only rule now stops with an error, rather than reporting an empty selection, when the index carries no gap_closure key. (#4924) (#4934)
  • Open debug sessions stay visible under an active workstream — audit-open reports sessions from the shared .planning/debug directory, and init.debug points the session manager there. (#5042) (#5155)

... (truncated)

Commits
  • 87e87d3 chore: promote CHANGELOG for v1.16.0
  • 936e287 chore: bump version to 1.16.0 for release
  • 6bc785c Merge pull request #5220 from open-gsd/chore/5219-ratify-adr-5057-and-close-a...
  • e717246 chore(#5219): backfill the changeset PR number
  • 2260703 fix(#5219): validate the drift mapped-commit stamp, own the phase-directory r...
  • d14de39 fix(#5219): the router imports verbs only from gate modules, and the ADR clai...
  • 1637e5b docs(#5219): index ADR-5057 under Active decisions and correct the router lin...
  • 3ed6770 docs(#5219): ratify ADR-5057 with a per-arm Ratification section and a changeset
  • 843d5b5 refactor(#5219): the four check verbs outside a gate module become gate modul...
  • 8bbdded Merge pull request #5218 from open-gsd/chore/5217-chore-5056-planning-writes-...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.16.0
f98487d 
Bumps [@opengsd/gsd-core](https://github.com/open-gsd/gsd-core) from 1.15.0 to 1.16.0.
- [Release notes](https://github.com/open-gsd/gsd-core/releases)
- [Changelog](https://github.com/open-gsd/gsd-core/blob/next/CHANGELOG.md)
- [Commits](open-gsd/gsd-core@v1.15.0...v1.16.0)

---
updated-dependencies:
- dependency-name: "@opengsd/gsd-core"
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 8, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #77.

@dependabot dependabot Bot closed this Oct 19, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/opengsd/gsd-core-1.16.0 branch October 19, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants