chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.18.0 by dependabot[bot] · Pull Request #78 · tchivs/gsd-omp

dependabot · 2026-10-22T10:14:01Z

Bumps @opengsd/gsd-core from 1.15.0 to 1.18.0.

Release notes

Sourced from @opengsd/gsd-core's releases.

v1.18.0

Install
npm i @opengsd/gsd-core@1.18.0
# or
npm i @opengsd/gsd-core@latest
What's Changed

Feature

feat(#5313): fail closed when artifact-frontmatter-equals matches more than one artifact by @davdittrich in open-gsd/gsd-core#5392

Fix

fix(#4901): phase complete never lowers the body Completed Phases counter by @trek-e in open-gsd/gsd-core#5425

fix(#4928): doc-writer handles targets with no runnable local entry point by @trek-e in open-gsd/gsd-core#5432

fix(#4915): execute-phase hands the regression file list and wave-failure tally across blocks by @trek-e in open-gsd/gsd-core#5428

fix(#4929): ui-researcher inventory gate cross-checks its first answer and falls back to the lockfile by @trek-e in open-gsd/gsd-core#5435

fix(#4927): plan-phase catches truncated plans, unverified gate baselines and the reversibility conflict by @trek-e in open-gsd/gsd-core#5436

fix(#4867): TDD review credits a RED-only probe plan with the GREEN of the plan that depends on it by @trek-e in open-gsd/gsd-core#5444

fix(#4799): a sequential executor in a linked phase worktree can commit on its phase branch by @trek-e in open-gsd/gsd-core#5445

fix(#4945): begin-phase replaces a wrapped Current focus whole and starts a gap-closure re-entry at the first plan to run by @trek-e in open-gsd/gsd-core#5446

fix(#4956): the shared-ID gate reads ready-ids as JSON, so it can mark requirements complete by @trek-e in open-gsd/gsd-core#5448

fix(#5449): the synthesizer returns SUMMARY.md inline when the runtime refuses to write it by @trek-e in open-gsd/gsd-core#5450

fix(#4947): update-plan-progress reconciles the pending-plan tail, replaces a bare TBD, and reports a skipped Progress row by @trek-e in open-gsd/gsd-core#5452

fix(#4972): phase complete names a verify:post audit that is missing or unresolved by @trek-e in open-gsd/gsd-core#5453

fix(#4993): ship-note CI recovery no longer waits on the review state by @trek-e in open-gsd/gsd-core#5459

fix(#5085): an isolated quick executor writes its SUMMARY at a worktree-relative path and stops on a guard denial by @trek-e in open-gsd/gsd-core#5462

fix(#5017): every reader and writer of the defaults store resolves its root like the loader by @trek-e in open-gsd/gsd-core#5463

fix(#5049): --prompt-file reaches review lanes that take the prompt path in argv by @trek-e in open-gsd/gsd-core#5468

fix(#5050): docs-update --verify-only asks nothing; verifier results stay under project_root and never collide by @trek-e in open-gsd/gsd-core#5472

fix(#5106): TDD gate accepts go test RED evidence, refuses build failures, and shares one test-file definition by @trek-e in open-gsd/gsd-core#5475

fix(#5113): phase add touches only its inserted block and depends on a phase that exists by @trek-e in open-gsd/gsd-core#5477

fix(#5045): scan command-valued git -c config for secret reads by @trek-e in open-gsd/gsd-core#5478

fix(#5122): agent_skills self-load names its own type, supplies its launcher, and skips the persona fallback by @trek-e in open-gsd/gsd-core#5481

fix(#5123): installed @ includes resolve for Kimi, and for Copilot and Antigravity with --config-dir by @trek-e in open-gsd/gsd-core#5484

fix(#5473): extract the commit subject byte-wise so a 112KB message is not slow in a UTF-8 locale by @trek-e in open-gsd/gsd-core#5485

fix(#5143): workflow shell fences capture the typed text once instead of splicing it by @trek-e in open-gsd/gsd-core#5493

fix(#5121): bound the SKILL.md read in skill discovery by @trek-e in open-gsd/gsd-core#5499

fix(#5287): the audit-milestone closure chain addresses the inserted phase, not the insert-after phase by @0xdhx in open-gsd/gsd-core#5440

fix(#5051): honor workstreams in quick task state updates by @agammann in open-gsd/gsd-core#5373

fix(#4890): separate global phase from roadmap counts by @agammann in open-gsd/gsd-core#5374

fix(#5327): probe capability-lock's own start-time on the first lock acquire, not at module load by @behruznassre in open-gsd/gsd-core#5434

fix(#5316): dispatch ship:pre step hooks in ship preflight by @davdittrich in open-gsd/gsd-core#5391

fix(#5409): stop Brave fetch following redirects by @davdittrich in open-gsd/gsd-core#5443

fix(#4926): accept any readable text-file input and exit non-zero when it cannot be read by @Maestro157 in open-gsd/gsd-core#5314

fix(#4943): pause work conventional commit by @denniyahh in open-gsd/gsd-core#5150

fix(#5359): document reviewer-lane dispatch outside a phase and slug-vs-alias by @davdittrich in open-gsd/gsd-core#5417

fix(#4939): answer a caller error for a missing phase dir by @drakeo338 in open-gsd/gsd-core#5030

... (truncated)

Changelog

Sourced from @opengsd/gsd-core's changelog.

[1.18.0] - 2026-10-19

Added

The Community Capability Registry now lists Ponytail Everywhere — discover the independently maintained davdittrich/ponytail-everywhere capability, which adds advisory lazy-ladder discipline at plan:pre, execute:wave:pre and execute:wave:post plus a plan-review proportionality checker, with exact install and uninstall commands. (#5293) (#5380)

Changed

Gate artifact-frontmatter-equals blocks when more than one artifact matches (#5313) — a phase holding two files that match a gate's artifact (for example a stale BEADS.md plus NN-BEADS.md, or BEADS.md plus .planning/BEADS.md) now blocks naming every candidate, instead of reading whichever the OS listed first.

Two companion behaviors: a symlink to the same file counts as one artifact, not an ambiguity; and because the phase directory is now always listed to detect ambiguity, a directory that exists but cannot be listed fails with the usage error even when the artifact sits directly in it (previously a direct hit skipped the listing). (#5392)

Fixed

state begin-phase now replaces a wrapped Current focus value whole instead of leaving its second line behind, and a gap-closure re-entry starts Current Plan and Plan: N of M at the first plan that has no summary instead of resetting to plan 1 (#4945). (#5446)

The milestone audit's closure chain now targets the inserted phase — after /gsd:phase --insert <after-phase>, the printed /gsd:discuss-phase, /gsd:plan-phase and /gsd:execute-phase lines use <new-phase>, the number the insert prints, instead of reusing the insert's argument, which resolved cleanly to the existing phase and left the closure phase empty. (#5287) (#5440)

verify plan-structure now fails a truncated PLAN.md (leftover write sentinel, unclosed , or a file ending mid-tag); the planner and checker run count/match acceptance gates against the current tree and record a baseline; and the planner and its reversibility reference agree that an already-settled one-way decision gets no new checkpoint. (#5436)

/gsd-quick under worktree isolation now tells the executor to write its SUMMARY at a worktree-relative path instead of an absolute main-checkout path that gsd-worktree-path-guard blocks, and to stop and report a guard denial rather than copy around it (#5085) (#5462)

Brave web search no longer follows HTTP redirects, so the X-Subscription-Token header cannot be forwarded to another host; a redirect now reports an API error. (#5443)

Unpinned emitted-attribution checks prefer the upstream base — Fork clones now try upstream/next before origin/next, preserve pin and CI precedence, and report the resolved base with the GSD_EMITTED_BASE override before failures or skips (#5187). (#5508)

The shared-requirement-ID gate in execute-plan now reads requirements.ready-ids as JSON, so a finishing plan marks its ready requirement IDs complete instead of silently marking none (#4956). (#5448)

Smart entry avoids summaries such as "Phase 13 of 5" when a multi-milestone roadmap supplies the active milestone's progress. (#4890) (#5374)

phase complete now lists, in warnings[], an active verify:post audit (SECURITY.md, VALIDATION.md) that is missing, still draft, or has open threats, so a phase no longer closes silently with the audit unrun (#4972) (#5453)

gsd-tools no longer probes its own process start-time (a PowerShell launch on Windows, a ps on macOS) on every config read; capability-lock now probes on its first lock acquire and caches only a successful result, retrying once if that probe fails (#5327). (#5434)

/gsd-ship now dispatches ship:pre step hooks — the preflight capability arm consumed only kind == "gate" entries, so a capability step registered at ship:pre (for example one recording a ship-override audit) was resolved by render-hooks and never ran. Steps now dispatch per the generic loop-hook contract after the gate loop; they honor onError and never block ship on their own. Gate evaluation is unchanged. (#5391)

/gsd-docs-update --verify-only no longer asks questions it discards, the doc verifier's result files are written under the project root and named by the doc's full relative path (so two README.md files no longer overwrite each other, and a run in a git worktree no longer writes into the main checkout), and verifier spawns are batched under the host's dispatch capacity. (#5472)

/gsd-pause-work no longer produces a commit Conventional Commits hooks reject — Prescribed handoff commits now use the conventional docs(pause): type instead of wip:, preventing commit-msg hook rejections when pausing work (#4943). (#5150)

The agent_skills self-load no longer re-reads the agent's own persona or silently does nothing — agents now state their own type, the bootstrap supplies the launcher, and the self-load queries with --skills-only, so non-Claude runtimes get configured skills only. (#5481)

/gsd-ship now pushes the CI-recovery commit for a [ci skip] ship-note head with no checks even while the PR is awaiting review, so a repo that requires an approval plus status checks no longer wedges (#4993) (#5459)

With GSD_HOME set, the install-time model/tools/effort resolvers, the installer's non-Claude defaults write and revert, the isolation and Cursor hooks' runtime fallback, capability staging and the /gsd-settings and /gsd-new-project workflows now use $GSD_HOME/.gsd/defaults.json like the config loader, instead of ~/.gsd/defaults.json (#5017) (#5463)

gsd-tools skill-manifest no longer hangs or runs out of memory on a hostile SKILL.md — A SKILL.md that is a symlink to /dev/zero, a FIFO, or larger than 256 KiB is now skipped like a missing one in skill discovery (both layouts), the installed-runtime dependency manifest, and installed capability skills, instead of being read unbounded. (#5121) (#5499)

The UI-SPEC component inventory gate now always cross-checks the first enumeration command against a filesystem count, records a mismatch, and resolves the version from the lockfile when node_modules is absent, treating empty output, a non-zero exit or 'undefined' as a failed lookup. (#5435)

The end-of-phase TDD review now credits a RED-only probe plan with the GREEN commit of a plan that lists it in depends_on, so a gap closure split into a probe plan and a fix plan no longer blocks the phase permanently (#4867). (#5444)

When Claude Code refuses a subagent's Write of an exact name such as SUMMARY.md, the research synthesizer now returns the complete document inline instead of a blocked message, and new-project and new-milestone persist it through the existing self-heal; the orchestrators no longer treat that refusal as a fabricated one or generalise it to other agents (#5449). (#5450)

review-lane dispatch-step --explicit now names the canonical slug when given a flag alias, and the non-phase call is documented — --explicit agy used to read as a missing CLI; it now says to pass antigravity. /gsd-code-review docs cover calling the lane outside a phase. (#5417)

The commit-message validation hook no longer stalls on very large commit messages on macOS — under bash 3.2 in a UTF-8 locale, validating a ~112KB git commit -m message took several seconds and could time out the hook; the subject is now extracted byte-wise and it takes a fraction of a second (#5473). (#5485)

review-lane invoke --prompt-file now reaches the cursor, antigravity and kimi-code review lanes. Their prompt path is embedded in argv, so the budget-trimmed prompt was silently ignored and the lane read the full prompt; the per-reviewer prompt cap now takes effect for them. (#5468)

execute-phase now hands the regression gate's test-file list and the cumulative wave-failure count between steps through files instead of shell variables that did not survive across blocks, so the pytest regression gate runs only the collected prior-phase files and the Fix-now escalation can fire. (#5428)

A sequential executor running in a linked phase worktree can commit on its configured phase branch again, instead of being refused by the per-agent branch allow-list after finishing its work. The allow-list now applies unless the executor's own dispatch prompt carries a sequential_execution block; protected-branch and detached-HEAD refusals are unchanged (#4799). (#5445)

phase add and phase add-batch now change only the block they insert: an unrelated heading no longer gains a blank line and a CRLF roadmap stays CRLF. The new phase's Depends on: names the nearest lower phase the roadmap actually declares (or Nothing) instead of N-1, which could be a phase that exists only on another branch, as an orphan directory, or not at all. (#5477)

The TDD gate no longer blocks Go projects: go test output is accepted as RED evidence (a run whose package fails to compile is refused as build_failure), and a task whose files are only Go, Elixir, RSpec or pytest test files is no longer treated as behavior-adding. The behavior-adding check and the RED-commit pathspec now share one test-file list. (#5475)

Installed @ includes now resolve for Kimi, and for Copilot and Antigravity with --config-dir — Kimi's @GSD core/… and the default-home @~/.copilot/… and @~/.gemini/antigravity/… includes pointed at files that only exist under the real install root. (#5484)

Secret-read guard now blocks command-valued git -c config — git -c alias.x='!cat .env' x and git -c diff.external='cat .env' diff were allowed and printed the protected file. (#5478)

roadmap update-plan-progress now drops completed plans from a trailing pending (…) list on the Plans line, replaces a bare **Plans**: TBD with the count, and returns a warnings entry when a word-prefixed Phase N Progress row is not updated (#4947) (#5452)

Typed command arguments no longer run as shell inside workflow snippets — a quote, $(...), backtick or newline in an argument could end the quoting in about 58 workflows and execute; each snippet now reads the text from a quoted heredoc capture. (#5493)

check decision-coverage-plan no longer reports covered: 0 when the phase-dir argument is not a directory or holds no plans. Passing the phase number (e.g. 01) where the phase directory belongs loaded zero plans, and the gate then listed every decision as uncovered, which looked exactly like a real coverage gap. Both decision-coverage gates now answer reason: "phase directory not found" (or "phase path is not a directory" when the argument names a file) and name the argument: the plan gate still fails closed, with total/covered null instead of a measured-looking zero, and the verify gate returns a non-blocking warning with no decision reported not-honored. A phase dir that cannot be read (e.g. EACCES) answers reason: "phase directory unreadable" with the error code and exits UNAVAILABLE (69) rather than being reported as missing. A phase dir with no PLAN file (for verify, no PLAN or SUMMARY file) answers reason: "phase directory holds no plans" the same way. Calling the plan gate with no phase-dir argument behaves as before. (#4939) (#5030)

Quick task state updates honor the selected workstream — migration and append no longer target the root STATE.md when a workstream is active, and migration reports a missing scoped state file as an error. (#5051) (#5373)

phase complete no longer lowers the STATE.md body Completed Phases counter: it only ratchets up like the frontmatter counter, and it now counts the current milestone's Progress table instead of the first one in the file. (#5425)

state add-decision --summary-file / --rationale-file, add-blocker --text-file and add-roadmap-evolution --note-file now accept any readable regular file of up to 256 KiB, including a scratch file outside the project root. Every refusal from these three verbs now exits non-zero with the reason on stderr (reason: "usage" under --json-errors): a file that cannot be read, a FIFO, device or directory, a file over 256 KiB, a blank (empty or whitespace-only) required field given inline or as a file, or a missing STATE.md. A blank rationale, inline or file, is written as no rationale. Before, they printed { "added": false } or { "error": … } at exit 0. (#4926) (#5314)

gsd-doc-writer no longer invents a run step for projects that cannot be run locally: it falls back to the test command, then the build command, then states there is no standalone run mode, and it only cites a Makefile or package script as a quick start when the files that script needs exist. (#5432)

... (truncated)

Commits

35f5a45 chore: promote CHANGELOG for v1.18.0
62f51ab chore: bump version to 1.18.0 for release
8940d2a fix(#5187): prefer upstream/next for emitted attribution (#5508)
a59deb7 docs(#5293): list ponytail-everywhere in the Community Capability Registry (#...
88b4e8b fix(#5276): sandbox USERPROFILE in tdd_mode init tests (#5281)
9d1ca20 fix(#4939): answer a caller error for a phase dir with nothing to scan (#5030)
e2c8919 fix(#5359): document reviewer-lane dispatch outside a phase and slug-vs-alias...
b224cc9 feat(#5313): fail closed when artifact-frontmatter-equals matches more than o...
4d8c0ae fix(#4943): pause work conventional commit (#5150)
274f8ca fix(#4926): accept any readable text-file input and exit non-zero when it can...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@opengsd/gsd-core](https://github.com/open-gsd/gsd-core) from 1.15.0 to 1.18.0. - [Release notes](https://github.com/open-gsd/gsd-core/releases) - [Changelog](https://github.com/open-gsd/gsd-core/blob/next/CHANGELOG.md) - [Commits](open-gsd/gsd-core@v1.15.0...v1.18.0) --- updated-dependencies: - dependency-name: "@opengsd/gsd-core" dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-22T10:14:04Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot · 2026-10-30T10:14:20Z

Superseded by #79.

dependabot Bot mentioned this pull request Oct 22, 2026

chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.17.0 #77

Closed

dependabot Bot closed this Oct 30, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/opengsd/gsd-core-1.18.0 branch October 30, 2026 10:14

Navigation Menu

Repository navigation

chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.18.0 - #78

chore(deps): bump @opengsd/gsd-core from 1.15.0 to 1.18.0#78
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/opengsd/gsd-core-1.18.0

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026

v1.18.0

Install

What's Changed

Feature

Fix

[1.18.0] - 2026-10-19

Added

Changed

Fixed

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Labels

Uh oh!

dependabot Bot commented on behalf of github Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants