Skip to content

chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.17.0 - #77

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/opengsd/gsd-core-1.17.0
Closed

chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.17.0#77
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/opengsd/gsd-core-1.17.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps @opengsd/gsd-core from 1.15.0 to 1.17.0.

Release notes

Sourced from @​opengsd/gsd-core's releases.

v1.17.0

Install

npm i @opengsd/gsd-core@1.17.0
# or
npm i @opengsd/gsd-core@latest

What's Changed

Feature

Fix

Full Changelog: open-gsd/gsd-core@v1.16.0...v1.17.0

v1.16.0

Install

npm i @opengsd/gsd-core@1.16.0
# or
npm i @opengsd/gsd-core@latest

... (truncated)

Changelog

Sourced from @​opengsd/gsd-core's changelog.

[1.17.0] - 2026-10-14

Added

  • OpenCode Phase 3 (epic #5331): the opt-in commit validation, phase boundary, session state and graphify hooks, and a footer statusline, now work on OpenCode; OpenCode 1.x is deprecated — every feature was verified on real OpenCode 2.0.27 and 1.18.29. On 2.x the terminal client shows the GSD statusline and update banner. OpenCode 1.x is bug-fix-only until 2026-12-31 and the installer says so; see "How to move GSD from OpenCode 1.x to OpenCode 2.x". (#5345)
  • OpenCode 2.x support in the GSD plugin (epic #5331, Phase 1) — the OpenCode plugin now loads on OpenCode 2.x as well as 1.x and runs the same guards on both (including the 2.x shell and patch tools), detects the installed OpenCode generation, and avoids the 1.x-only --dir and --variant flags on 2.x. Plugin hooks now start under Node instead of the OpenCode executable, which had left the guards silently inactive (#4849). (#5342)
  • OpenCode 2.x installer output and a complete OpenCode uninstall (epic #5331, Phase 2) — your annotated opencode.jsonc keeps its comments through install, update and uninstall; the GSD MCP companion no longer lists every GSD command a second time (existing installs are converged by a new migration); agents carry tool restrictions from their tools: allowlist; and --uninstall now removes everything GSD created on OpenCode 1.x and 2.x, including the hook helpers, install state, the GSD MCP entry and the machine-wide defaults it had set, while leaving your own files untouched. (#5343)

Changed

  • STATE.md writes gain an internal verifying executor (ADR-4629 section 8.2 and 8.3, epic #4629 child C2) — a declared StateWriteIntent is applied through the existing write seam and fails loud when a required assertion does not land or the write changes anything outside its declared scope. No user-facing behavior changes and no caller is migrated yet (that is Phase 3 and later). (#4935)
  • The Claude Code plugin now registers each workflow once, as its gsd-<name> skill, instead of twice (claude plugin details listed 144 skills). Plugin slash commands are now /gsd-core:gsd-<name> (were /gsd-core:<name>) (#4860) (#5362)

Fixed

  • Statusline context meter reads 100% where Claude Code auto-compacts, and the context monitor warns before it — the meter now resolves the auto-compact window the way Claude Code does (CLAUDE_CODE_AUTO_COMPACT_WINDOW, then the autoCompactWindow setting /autocompact saves, per model or top-level, then the model window), subtracts the 33k auto-compact buffer /context shows (lowered further by CLAUDE_AUTOCOMPACT_PCT_OVERRIDE), and measures the used tokens against that threshold. With /autocompact 650k on a 1M model it read 74% at the moment of compaction and the monitor stayed silent; it now reads 100% and the monitor has already gone CRITICAL. The statusline bridge's remaining_percentage / used_pct count down to the same threshold, and the bridge gains used_tokens / threshold_tokens, which the monitor's message quotes so it still matches /context. (#5252)
  • Hosts without a context metrics writer (Antigravity, Augment, CodeBuddy, Hermes, Qwen, Kimi, Kimi Code) no longer register the context monitor on tool events; they declare context-warnings unsupported, and a reinstall removes a stale registration while keeping user hooks. (#5389)
  • A capability can now deliver review rules to the built-in code reviewer (#4790) — a contribution with into: "code-reviewer" was rejected at install because the execute host published only executor and verifier, and the reviewer prompt had nowhere to receive one anyway. code-reviewer is now an execution-family role, and code-review.md adds the active reviewer contributions for its loop point to the reviewer prompt once, beside the project's agent_skills guidance. (#5353)
  • The install-time "N triggers shadowed" warning no longer appears on OpenCode, Kilo, Augment, CodeBuddy and ZCode installs (#5344) — those runtimes install commands and skills side by side at one scope on purpose, and the report counted that pair as a shadow ("72 triggers shadowed … skills wins instead"). It now reports only a shadow between two different scopes, as documented. (#5348)
  • verification status now lists the covered files that changed after the report (moved_files) on a stale result, so an edited covered file reads differently from a missing artifact (#4857) (#5361)
  • Runtime-generated guidance (the smart-entry action menu, the context-drift and ui-phase gate messages, graphify, capability and quick-batch errors, and capability descriptions) now names the command form the install registers, /gsd-<name> ($gsd-<name> on Codex), instead of the unregistered /gsd:<name> (#4859) (#5372)
  • opencode.jsonc comments and trailing commas survive install and uninstall, and OpenCode uninstall is complete (#5333, #5334, #5335) — uninstall used to leave 8 hook helpers, the install state and journal, an empty settings.json, the mcp.gsd entry and the ~/.gsd/defaults.json it had written; the config rewrite used to drop every comment. (#5343)
  • The stale-verification message now names a phase plan or summary the report never covered (#4817) — an older (v1/v2) verification report that never declared one of the phase's own plans or summaries read stale with "covered source files changed", which was false for that cause and named nothing. verification status now returns uncovered_artifacts and next_action names them and says whether a covered file also changed. The route is unchanged: re-run execute-phase. (#5357)
  • init plan-phase, verify-work, code-review, discuss-phase-assumptions and phase-op now emit the ROADMAP display name as phase_name instead of the directory slug, so a replan no longer rewrites STATE.md's current_phase_name to a slug (#4854) (#5363)
  • Statusline context meter no longer subtracts the auto-compact buffer when autoCompactEnabled is false — with auto-compact disabled (settings autoCompactEnabled: false, DISABLE_AUTO_COMPACT or DISABLE_COMPACT) the bar shows the used share of the whole model window, matching Claude Code's own /context, instead of reading ~8 points high and pinning at 100% from raw 83.5% onward. Contributed by @​tanji-dg (#4959, carried here). (#5252)
  • OpenCode: hook advisories now reach the model, and the session-start scripts run on 2.x — read-before-write, injection findings and phase-boundary reminders were logged where no model reads them, on both OpenCode generations; they are now appended to the tool result, so OpenCode 1.x users start seeing advisories that were always meant to be shown. A 2.x run emits no session-created event, so the canonical-path and update-check scripts never ran there; they do now. (#5345)
  • The managed debug loop can no longer detach its debugger through a shell spawn (#5214) — on a captured run the debug session manager skipped its Agent(run_in_background=false) call and ran claude --agent gsd-debugger through Bash in the background, so no result came back and the checkpoint never advanced. The Bash guard hook now denies that command and tells the model to use the Agent tool, and both manager prompts state the rule. (#5352)
  • The Codex Windows hook shim no longer depends on the install-time node.exe path alone: it uses GSD_NODE_PATH, then that path while it exists, then node.exe on PATH, so a WinGet Node upgrade no longer silently disables the hook until the installer is re-run. (#5405)
  • ADR parsing no longer splits a hard-wrapped list item into several entries or keeps ordered-list numbers (#5227) — a bullet wrapped over two lines used to become two sentence-fragment decisions, and 1. / 1) markers were kept as text. The parser now yields one entry per top-level list item, joins wrapped and nested lines onto it, and strips bullet and ordered markers; a block with no markers still gives one entry per line. (#5349)
  • SessionStart no longer fails when the background update check cannot start — cache-directory or worker-launch failures leave the session running without an update hint. (#4839) (#5159)
  • Smart-entry no longer prints a phase's number as its position when a milestone continues earlier numbering (#5228) — a milestone with phases 9-17 read "Phase 9 of 9 — needs a plan" instead of "Phase 1 of 9", and without a ROADMAP Progress table it was classified complete as soon as the phase number reached the phase count. The ordinal now comes from the phase's position in the milestone's phase list, and the legacy completion check compares against the milestone's last phase. (#5350)
  • phase complete no longer writes Ready to plan / Current Plan: Not started for a next phase that is already planned or executed; Status, Current Plan and Stopped at now route to execution or verification from the phase's disk state (#4824) (#5358)
  • Claude Code installs no longer pre-authorize npx gsd-core — the installer wrote a Bash(npx gsd-core *) allow rule, but GSD ships as @opengsd/gsd-core and the unscoped npm name belongs to a different owner, so Claude Code would run whatever was published under it without asking. Fresh installs no longer write the rule, the next install or upgrade removes it from an existing settings file (exact match only), and GEMINI.md now gives the scoped install command. (#5054) (#5269)
  • /gsd-resume-work no longer depends on the external find binary to discover checkpoints (#4805) — agent shells that allowlist commands (an fd-only policy, for one) refused the three bare find calls, and their 2>/dev/null hid the refusal, so a .continue-here checkpoint on disk could look absent. The step now lists checkpoints and async-job manifests with guarded shell glob loops, which need no external command and stay safe under zsh's NOMATCH. (#5355)

[1.16.0] - 2026-10-05

Changed

  • Command arguments now arrive in a labeled <arguments> block — every argument-taking command and skill template opens with <arguments>$ARGUMENTS</arguments> (always present, empty when nothing was typed), so a flag such as /gsd-update --reapply can no longer be misread as template prose and silently run the default workflow. (#4780) (#5145)
  • /gsd-fast now appears in the generated CLAUDE.md entry-point list — listed ahead of /gsd-quick as the lightest entry point for a trivial, one-sentence task with no subagents and no PLAN.md. (#5110)
  • gsd-tools and the hooks that load gsd-core/bin/lib start faster — they turn on Node's compile cache, so later runs reuse compiled code for unchanged modules. Output is unchanged; the cache lives under the OS temp directory and NODE_DISABLE_COMPILE_CACHE (any value) turns it off. (#5183) (#5191)

Fixed

  • roadmap analyze now reports phases whose ROADMAP checkbox disagrees with their disk status — a [x] backfilled phase (summary, no plans) or a fully summarized [x] phase without a passing VERIFICATION is still returned as next_phase/current_phase (selectors stay disk-authoritative per ADR-3180), and a new checkbox_conflict list names each such phase instead of handing back a completed phase with no signal. (#4757) (#5146)
  • Blocking PreToolUse guards no longer silently allow a denied edit on a slow host — plugin-registered and Kimi-registered guards use the 120 s host budget the installer already uses; the worktree-path, workflow and Windsurf pre-write guards give their git probes a 5 s budget instead of 2 s; and the OpenCode and Kilo plugins no longer kill the git-probing guards before their worst case finishes. A killed or timed-out guard counts as an allow, so on a starved host any of these could previously let through the edit it exists to deny (Windsurf documents no hook timeout, so its host budget stays unknown). (#5180) (#5185)
  • Roadmap analyze now reads each phase's own checkbox — a phase's completion status could be read from a different phase's checklist line when its description merely mentioned this phase's number. (#4965) (#5063)
  • The secret-read guard no longer blocks git check-ignore, git ls-files, git rm --cached or a template copy on a secret file — these name the file without printing it (git check-ignore -v .env, cp .env.example .env), yet the guard treated every operand of git, cp and mv as a read. Only those operand positions are now exempt; content-revealing forms (git show, git diff, git log -p, git blame, a secret cp/mv source) and any unlisted option stay blocked. (#5047)
  • The debugger's knowledge base is no longer treated as a debug session — gsd-debugger appends every resolved session to .planning/debug/knowledge-base.md, and every reader of the debug directory treated that file as a session: audit-open reported it as open on every run (so every milestone-close audit carried a permanent false positive), /gsd-debug list listed it, /gsd-debug's resume prompt offered it as a session to resume, /gsd-progress counted it as an active debug session, and the debugger's own active-session check listed it. All of them now skip it by name. The shell readers also no longer hide a real active session whose slug contains "resolved" (e.g. unresolved-promise-hang). (#4869, #5011) (#5041)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.17.0
2b4bb8b 
Bumps [@opengsd/gsd-core](https://github.com/open-gsd/gsd-core) from 1.15.0 to 1.17.0.
- [Release notes](https://github.com/open-gsd/gsd-core/releases)
- [Changelog](https://github.com/open-gsd/gsd-core/blob/next/CHANGELOG.md)
- [Commits](open-gsd/gsd-core@v1.15.0...v1.17.0)

---
updated-dependencies:
- dependency-name: "@opengsd/gsd-core"
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot mentioned this pull request Oct 19, 2026
Closed
@dependabot @github

dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #78.

@dependabot dependabot Bot closed this Oct 22, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/opengsd/gsd-core-1.17.0 branch October 22, 2026 10:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants