* chore(contrib): add commit-msg hook, CODEOWNERS, team workflow docs
- Extend install-hooks.sh with commit-msg hook that enforces
Conventional Commits format on every commit
- Add .github/CODEOWNERS mapping packages, CI, scripts, and
security-sensitive files to @gsd-build/maintainers
- CONTRIBUTING.md: add Branching and commits section with naming
convention, commit format, and rebase guidance
- CONTRIBUTING.md: add Working with GSD section covering mode: team,
unique milestone IDs, and worktree isolation for multi-dev workflows
- CONTRIBUTING.md: surface npm run secret-scan:install-hook in Local
development with explanation of both hooks it installs
- CONTRIBUTING.md: align AI disclosure section — no AI tool authorship
in commits, Draft PR requirement for multi-phase agent work
* chore: remove install-hooks.sh — local git hook installation is too intrusive for a contributor PR
Node v24 unconditionally refuses .ts files under node_modules/ — even
with --experimental-transform-types. When GSD is installed globally via
npm, every web service subprocess that loads a .ts extension module
crashes with ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING.
Add resolveSubprocessModule() and buildSubprocessPrefixArgs() to
ts-subprocess-flags.ts. When packageRoot is under node_modules/ and the
compiled dist/*.js file exists, subprocess calls use the compiled JS
directly without TS flags or the resolve-ts.mjs loader.
Updated all 14 web service files: auto-dashboard, bridge, captures,
cleanup, doctor, export, forensics, history, hooks, recovery-diagnostics,
settings, skill-health, undo, and visualizer.
Fixes#2279
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The `deriveStateFromDb() <1ms` assertion failed at 1.050ms on GitHub
Actions runners under load. Increased threshold to 10ms — still catches
real regressions (10x) without flaking on CI jitter.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
gsd.db-shm, gsd.db-wal, journal/, and doctor-history.jsonl are always
created alongside gsd.db during normal operation but were missing from
both RUNTIME_EXCLUSION_PATHS (git-service.ts) and GSD_RUNTIME_PATTERNS
(gitignore.ts). This caused them to be staged by nativeAddAllWithExclusions,
left untracked by untrackRuntimeFiles, and omitted from .gitignore by
ensureGitignore — leading to squash merge failures when these files were
tracked and modified during milestone execution.
Closes#2296
The observability validator checked for markdown headings (## Observability / Diagnostics,
## Observability Impact) that the DB-backed renderer never produces, causing false-positive
warnings on every dispatch. Removed entirely — the DB schema enforces structure at write time.
The worktree health check blocked execution in directories without recognized project files
(package.json, Cargo.toml, etc.), preventing greenfield projects from scaffolding. Downgraded
to a warning — .git check remains as the hard gate.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(memory): fix memory and resource leaks across TUI, LSP, DB, and automation
Addresses all findings from a systematic memory leak audit across five
dimensions: event listeners, timers, file system handles, subscriptions/
closures, and GSD automation lifecycle.
Critical fixes:
rpc-client.ts: stderr .on("data") handler attached in start() was never
removed in stop(). Now stored as _stderrHandler and removed via
removeListener() on stop.
lsp/client.ts: Three process.on() handlers (beforeExit, SIGINT, SIGTERM)
registered at module load time with anonymous functions — impossible to
remove. Now stored as named references; new removeProcessHandlers() export
allows graceful teardown. stdout/stderr stream listeners in
startMessageReader/startStderrReader also stored per-client in
clientStreamHandlers map and removed in shutdownClient() and shutdownAll().
parallel-orchestrator.ts: spawnWorker() attached 5 listeners to child
process streams on every spawn with no removal on worker stop/respawn,
accumulating listeners indefinitely. Added cleanup() field to WorkerInfo;
called via removeAllListeners() on exit, graceful stop, stale detection,
and dead PID cleanup paths. Also: module-level state.workers Map was never
cleared between orchestration runs; startParallel() and resetOrchestrator()
now iterate and clean up all WorkerInfo entries before reassigning state.
scripts/watch-resources.js: fs.watch() return value was discarded (OS
watcher never closed) and the fallback setInterval handle was also
discarded (timer ran forever). Both now stored; process.on("exit") handler
closes/clears them.
gsd-db.ts: closeDatabase() did not checkpoint the WAL before closing —
.db-shm/.db-wal files accumulated on disk across crash-recovery cycles.
Now runs PRAGMA wal_checkpoint(TRUNCATE) before close. Also added a
one-time process.on("exit") handler in openDatabase() so the handle is
always closed even on unclean exits.
Medium fixes:
bg-shell/overlay.ts: 1-second refresh setInterval only cleared in
keyboard exit handler; abnormal teardown leaked the timer. Added dispose()
method that unconditionally clears it.
file-watcher.ts: pending debounce Map was scoped inside startFileWatcher()
making it inaccessible to stopFileWatcher(). Moved to module scope;
stopFileWatcher() now clears all pending timers and empties the map before
closing the watcher.
auto-supervisor.ts: registerSigtermHandler() could accumulate multiple
SIGTERM handlers if called without passing back the previous reference.
Added module-level _currentSigtermHandler; old handler is always removed
before registering the new one regardless of whether caller passes it.
Low-severity fixes:
print-mode.ts: session.subscribe() return value was discarded. Now stored
and called in a finally block to guarantee cleanup on both normal
completion and errors.
rpc-mode.ts: same — subscribe() unsubscribe now called in the shutdown
path before process.exit().
theme.ts: onThemeChangeCallback singleton silently overwrote any previous
subscriber. Converted to Set<() => void>; onThemeChange() now returns a
cleanup function. All four internal call sites updated to forEach().
Backward-compatible — existing callers that discard the return are unaffected.
* fix: ensure unsubscribe is called on error/abort in print-mode
The PR #2314 added unsubscribe storage but still called process.exit(1)
directly, bypassing the unsubscribe. Wrapped in try/finally to guarantee
cleanup runs before exit.
`saveDecisionToDb` previously regenerated DECISIONS.md from DB state
unconditionally, which silently destroyed any freeform/prose content
since `parseDecisionsTable` only parses table rows.
Now detects whether the existing file is in canonical table format
(starts with "# Decisions Register" + has the standard table header).
When freeform content is detected, the original content is preserved
and a decisions table section is appended/updated at the end instead
of overwriting the entire file.
Fixes#2301
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The alibaba-coding-plan provider (8 models) was silently dropped when
models.generated.ts was regenerated from models.dev in PR #2118. This
provider uses a proprietary DashScope endpoint not tracked by models.dev,
so regeneration removes it every time.
Add models.custom.ts for manually-maintained providers that don't exist
in models.dev. The model registry (models.ts) now merges both generated
and custom models at startup. Custom entries are additive and never
overwrite generated ones.
Restores: qwen3.5-plus, qwen3-max-2026-01-23, qwen3-coder-next,
qwen3-coder-plus, MiniMax-M2.5, glm-5, glm-4.7, kimi-k2.5
Fixes#2339
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds opt-in per-prompt cost display to the interactive footer. Users
enable it by setting `show_token_cost: true` in their preferences.md.
Disabled by default — the footer behavior is unchanged unless opted in.
Fixes#1515
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds a visible control to change the devRoot directory from both the
project selection gate and the slide-out projects panel, so users no
longer need to hand-edit ~/.gsd/web-preferences.json.
- New /api/switch-root POST endpoint: validates path (exists, is dir),
persists to web-preferences.json (clearing lastActiveProject), and
returns discovered projects under the new root
- ProjectSelectionGate: shows current devRoot with "Change" link above
the project list; also shows "Change project root" link when no
projects are found under the current root
- ProjectsPanel: shows "Change" link next to the devRoot path in the
slide-out header
- Both views use the existing FolderPickerDialog for directory browsing
- 17 tests covering path validation, preference persistence, tilde
expansion, and end-to-end switch scenarios
Fixes#2264
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): increase perf assertion threshold to prevent CI flake
The `deriveStateFromDb() <1ms` assertion failed at 1.050ms on GitHub
Actions runners under load. Increased threshold to 10ms — still catches
real regressions (10x) without flaking on CI jitter.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(doctor): skip false env_dependencies error in auto-worktrees
Auto-worktrees don't have their own node_modules by design — they
symlink to the project root's copy. The doctor environment check
now resolves the project root (via .gsd/worktrees/ path segment or
GSD_WORKTREE env var) and checks its node_modules before reporting
an error.
Fixes#2303
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: auto-stash dirty files before squash merge and surface dirty filenames in error
Two bugs in mergeMilestoneToMain caused milestone completion to fail when
the project root had pre-existing dirty tracked files:
Bug 1 — No auto-stash: clearProjectRootStateFiles only removes untracked
.gsd/ files. Any tracked dirty file elsewhere (e.g. .planning/work-state.json
with stash conflict markers) caused `git merge --squash` to reject with
"local changes would be overwritten". Fixed by adding a stash/pop wrapper
around the squash merge — dirty files are stashed before merge and restored
after commit. Stash is also popped on all error paths so local work is never
lost.
Bug 2 — Misleading error message: nativeMergeSquash discarded the filenames
from git stderr and the caller hardcoded blame on .gsd/ regardless of which
files were actually dirty. Fixed by parsing tab-indented filenames from git
stderr into a new `dirtyFiles` field on GitMergeResult, and surfacing them
in the error message.
Closes#2151
* ci: re-trigger CI (derive-state-db perf assertion is nondeterministic on slow runners)
* review: move #2151 tests to node:test format in separate file
Per review feedback, moved Tests 20 and 21 from the script-style
auto-worktree-milestone-merge.test.ts into a new auto-stash-merge.test.ts
using node:test's test() function and assert module.
Local tsconfig excludes src/resources/ but CI compiles everything.
Record<string, unknown> for params broke handler calls since handlers
expect typed params (validated at runtime). Keep params: any with
eslint-disable annotation, type all other executor params properly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Tool executor lambdas now use proper types (string, Record<string, unknown>,
AbortSignal | undefined) instead of any for all parameters.
registerAlias toolDef param also properly typed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- github-sync/sync.ts: import parseRoadmap/parsePlan from parsers-legacy
- auto-worktree.ts: replace dangling roadmap.title with getMilestone() DB query
- markdown-renderer.ts: add explicit type annotations on lazy-loaded parser callbacks
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
plan-task.ts was the only planning tool handler not wrapping its
insertTask/upsertTaskPlanning calls in a transaction(), risking partial
DB state if the upsert failed after insert. Matches the pattern used by
plan-slice, replan-slice, reassess-roadmap, and plan-milestone.
Also removes 80 .gsd/ working artifacts that were force-added despite
being in .gitignore.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a session-scoped contextual tips system that shows non-intrusive
hints when user behavior suggests they'd benefit from knowing a feature.
Tips:
- Shell command prefix: nudge when bare ls/git/npm typed without !
- Large paste: warn when >2000 char input sent to agent
- Thinking level: hint when short question with high/xhigh thinking
- Double-bang reminder: after 3+ single-! commands, suggest !!
- Compaction nudge: when context >= 70% full
Each tip fires at most N times per session, resets on /new.
Wired into both TUI (dim inline text) and web terminal (system line).
31 unit tests covering all tips, suppression, reset, and priority.
On first launch (before ~/.gsd/ exists), loader.ts prints a branded
ASCII logo and welcome message. Later, cli.ts unconditionally calls
printWelcomeScreen(), resulting in a duplicate banner.
Set GSD_FIRST_RUN_BANNER env flag in loader.ts after printing the
first-run banner. cli.ts now checks for this flag and skips the
welcome screen when it is already set.
The session-restart banner in register-hooks.ts is unaffected because
it only fires on non-first sessions (isFirstSession guard).
Closes#2245
The symlink test used single quotes in a commit message
(`-m 'add gitignore'`) inside a `&&`-chained shell command. On Windows,
`cmd.exe` doesn't treat single quotes as string delimiters, so git
received a mangled pathspec `gitignore'`. Split into two separate `run()`
calls with double-quoted commit message, matching every other test in
the file.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When await_job consumed async job results, onJobComplete still fired
follow-up messages for each job. Each follow-up triggered a wasteful
LLM turn where the agent could only say "Already captured...".
Add an `awaited` flag to Job. await_job sets it on all watched jobs
before waiting (avoiding a race with the promise .then() callback).
onJobComplete skips follow-up delivery for awaited jobs. Fire-and-forget
jobs still get follow-up messages as before.
Closes#2248
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
smartStage() was using git hash-object + update-index to bypass .gitignore
and force-stage .gsd/milestones/ files when .gsd is a symlink. This
contradicts the external state design (symlink = state lives outside repo)
and the documented deprecation of commit_docs.
Remove the force-add block, finish the commit_docs deprecation in
auto-prompts (always emit "do not commit"), and clean up the commitDocs
parameter from all call sites. The deprecation warning in
preferences-validation remains so users are told to remove the setting.
Closes#2247
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
