$ show gsd-build/get-shit-done
GSD (Get Shit Done) is a mature, actively maintained meta-prompting and context-engineering system that orchestrates AI coding agents (Claude Code, OpenCode, Gemini, Codex, Copilot, Cursor, and 9+ other runtimes) through a structured milestone → phase → plan → execute → verify workflow. The system solves context decay in long AI-assisted coding sessions by maintaining a `.planning/` artifact tree (ROADMAP.md, STATE.md, PLAN.md, SUMMARY.md, VERIFICATION.md) and dispatching focused subagents with fresh 200K-token contexts for each discrete task. The codebase is a dual-package npm monorepo: a legacy CJS CLI (`get-shit-done-cc`) and a modern TypeScript SDK (`@gsd-build/sdk`) with a query-registry architecture, runtime-bridge sync primitive, and generated CJS mirrors that keep both surfaces in parity. The architecture is built around a 'thin orchestrator' pattern where slash-command entry points delegate to workflow markdown files that spawn specialized subagents (planner, executor, verifier, researcher, debugger, code-reviewer) via a registry-backed `gsd-sdk query` dispatch layer. The SDK exposes a `GSD` class that composes plan parsing, config loading, prompt building, and session running into `executePlan()` and `runPhase()` calls, with event-stream telemetry and CLI/WS transports. A `synckit`-based synchronous bridge (`executeForCjs`) lets CJS callers invoke async SDK handlers without subprocess overhead. The query registry resolves commands through a multi-strategy topology (exact, alias, dotted, spaced) with native handlers and transparent CJS fallback. What distinguishes this codebase is the obsessive engineering around installer migrations (transactional, with rollback and user-prompt resolution), cross-runtime path projection (PowerShell/cmd/Git-Bash/POSIX), adversarial parser testing (hostile frontmatter/roadmap fixtures), atomic state writes with file locking, prompt-injection scanning hooks, and a changeset-fragment workflow that eliminates CHANGELOG merge conflicts. The test suite is exceptionally thorough — 400+ test files covering mutation-resistant config validation, golden parity between CJS and SDK, security prompt injection, worktree safety, and regression coverage for 3800+ tracked issues. The system supports 15 AI runtimes with runtime-aware artifact layout, model-profile resolution, and per-agent model overrides.
The LLM identified 8 files worth highlighting for reuse:
Single source of truth for finding the `.planning/` root across monorepo/sub-repo layouts. Implements a four-heuristic resolution chain (own `.planning/` guard, parent `sub_repos` match, legacy `multiRepo: true`, `.git` ancestor fallback) bounded by `FIND_PROJECT_ROOT_MAX_DEPTH = 10`. Generated into a CJS mirror via build scripts, ensuring byte-identical behavior across SDK and CLI. Extractable as a standalone utility for any tool that needs to locate a workspace root from a subdirectory.
Provides `executeForCjs()` — a synchronous primitive that lets CJS callers invoke async SDK query handlers in-process using `Atomics.wait` + `SharedArrayBuffer` in a pooled worker thread. First-call ~80ms, steady-state ~0.1ms. Returns a typed discriminated union (`{ ok: true, data } | { ok: false, errorKind, exitCode }`) aligned with the ADR-0001 dispatch error taxonomy. The pattern is reusable for any project that needs to bridge async TypeScript into synchronous CJS without subprocess overhead.
Unified config loading with a three-pipeline design: parse JSON → normalize legacy keys (branching_strategy, sub_repos, multiRepo, depth) → deep-merge defaults from a manifest. The `migrateOnDisk()` function performs explicit, opt-in canonicalization of legacy config shapes. Schema data (valid keys, runtime state keys, dynamic patterns) derives from `sdk/shared/config-schema.manifest.json` — a single source of truth shared between CJS and SDK. The deep-merge preserves explicit `null` (meaning 'unset') and boolean `false` — not overridden by truthy defaults. Extractable for any project needing backward-compatible config evolution.
Demonstrates a registry pattern for query command routing with a static catalog of `[command, handler]` tuples supporting dotted (`state.json`), spaced (`stats table`), and kebab (`list-todos`) forms. Separates domain-specific handlers (progress, workstream, skills, audit) into focused modules. The pattern is reusable for any CLI tool that needs multi-form command resolution with a single source of truth for the command surface.
A reusable corpus of hostile-but-realistic inputs for YAML frontmatter parsers: duplicate keys, CRLF endings, unclosed blocks, Unicode keys/values, null bytes, and deliberately large bounded payloads. Each fixture encodes the invariant the parser must satisfy (deterministic result, no crash, no silent data loss). The pattern — pure data fixtures consumed by behavioral tests — is extractable for any project that needs to harden parsers against adversarial input.
Hostile ROADMAP.md inputs for phase parsers: headings inside fenced code blocks, nested fences, Unicode phase titles, repeated phase IDs, decimal-phase prefix collisions (2.1 vs 2.10 vs 21), and HTML-commented headings. Pins parser behavior so regressions become test failures. The fixture-as-contract pattern is reusable for any markdown-based planning tool.
Reusable hostile payloads for prompt-injection scanners: fake instruction overrides, invisible zero-width characters, fake system tags, heredoc breakout attempts, malicious markdown links with javascript:/data: URIs, and fake frontmatter fields. Pure data (no real secrets) consumed by behavioral tests. Extractable for any project that needs to test read-time injection defenses.
A focused secrets module that masks API keys and credentials in config output. Uses a `SECRET_CONFIG_KEYS` set for O(1) lookup, `maskSecret()` to redact values (showing only last 4 chars), and `maskIfSecret()` for conditional application. Generated into a CJS mirror via build scripts. The pattern — a small, pure, generated module with a manifest-driven allowlist — is reusable for any tool that surfaces config values and must avoid leaking secrets.