feat(commands): add handoffs support for speckit compatibility #410
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Upgrade frontmatter parser to use js-yaml for complex YAML support - Add HandoffDefinition interface for speckit-style workflow transitions - Update CommandFrontmatter and CommandDefinition to include handoffs - Add comprehensive tests for backward compatibility and complex YAML - Fix type parameters in auto-slash-command and slashcommand tools Closes #407
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Greptile SummaryReplaces manual line-by-line frontmatter parser with Key Changes:
Critical Issue:
Confidence Score: 3/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant User
participant CommandLoader as Command Loader
participant Frontmatter as parseFrontmatter()
participant YAML as js-yaml
participant Command as CommandDefinition
User->>CommandLoader: Load command from .md file
CommandLoader->>Frontmatter: Parse file content
Frontmatter->>YAML: yaml.load(yamlContent)
YAML-->>Frontmatter: Parsed object with handoffs[]
Frontmatter-->>CommandLoader: {data: CommandFrontmatter, body}
CommandLoader->>CommandLoader: Extract handoffs from data
CommandLoader->>Command: Create CommandDefinition with handoffs
Command-->>User: Command ready with handoff workflows
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
src/shared/frontmatter.ts
Outdated
Comment on lines
22
to
26
| const parsed = yaml.load(yamlContent) | ||
| const data = (parsed ?? {}) as T | ||
| return { data, body } | ||
| } catch { | ||
| return { data: {} as T, body } |
There was a problem hiding this comment.
logic: yaml.load() can execute arbitrary JavaScript code when parsing YAML with !!js/function tags by default
add { schema: yaml.SAFE_SCHEMA } option to prevent code execution:
Suggested change
| const parsed = yaml.load(yamlContent) | |
| const data = (parsed ?? {}) as T | |
| return { data, body } | |
| } catch { | |
| return { data: {} as T, body } | |
| const parsed = yaml.load(yamlContent, { schema: yaml.SAFE_SCHEMA }) | |
| const data = (parsed ?? {}) as T | |
| return { data, body } | |
| } catch { | |
| return { data: {} as T, body } |
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/shared/frontmatter.ts
Line: 22:26
Comment:
**logic:** `yaml.load()` can execute arbitrary JavaScript code when parsing YAML with `!!js/function` tags by default
add `{ schema: yaml.SAFE_SCHEMA }` option to prevent code execution:
```suggestion
const parsed = yaml.load(yamlContent, { schema: yaml.SAFE_SCHEMA })
const data = (parsed ?? {}) as T
return { data, body }
} catch {
return { data: {} as T, body }
```
How can I resolve this? If you propose a fix, please make it concise.| content: string | ||
| ): FrontmatterResult<T> { | ||
| const frontmatterRegex = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/ | ||
| const frontmatterRegex = /^---\r?\n([\s\S]*?)\r?\n?---\r?\n([\s\S]*)$/ |
There was a problem hiding this comment.
style: regex now allows optional newline before closing ---, which relaxes the frontmatter format validation
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/shared/frontmatter.ts
Line: 11:11
Comment:
**style:** regex now allows optional newline before closing `---`, which relaxes the frontmatter format validation
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.
Owner
|
…olerance tests - Use JSON_SCHEMA in yaml.load() to prevent code execution via YAML tags - Add tests to verify extra fields in frontmatter don't cause failures - Address Greptile security review comment
Collaborator
Author
Review Feedback AddressedI've addressed the review feedback: 1. Security Fix (Greptile Review)
2. Extra Fields Tolerance (User Request)Yes, the current implementation correctly handles extra fields without failing. Added tests to confirm and document this behavior:
The implementation casts the parsed YAML to the generic type
Changes
All 430 tests pass. Build successful. |
sisyphus-dev-ai
removed
the
sisyphus: working
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
js-yamlfor complex YAML support (speckit compatibility)HandoffDefinitioninterface for speckit-style workflow transitionsCommandFrontmatterandCommandDefinitionto include handoffsChanges
Core Changes
src/shared/frontmatter.ts: Replace manual line-by-line parsing withjs-yamlfor full YAML spec supportsrc/features/claude-code-command-loader/types.ts: AddHandoffDefinitioninterface and update command typessrc/features/claude-code-command-loader/loader.ts: Pass handoffs through to command definitionsSupporting Changes
src/hooks/auto-slash-command/executor.ts: Add explicit type parameter for frontmatter parsingsrc/tools/slashcommand/tools.ts: Add explicit type parameter for frontmatter parsingsrc/features/opencode-skill-loader/loader.test.ts: Update test for new YAML parsing behaviorTests
src/shared/frontmatter.test.ts: New comprehensive test suite covering:Handoff Format (speckit)
Commands can now use complex handoffs in frontmatter:
Closes #407
Summary by cubic
Adds speckit-style handoffs to commands by switching frontmatter parsing to full YAML with js-yaml and extending command types. Enables complex workflow definitions in command frontmatter while preserving backward compatibility, and closes #407.
Written for commit fb7230f. Summary will update on new commits.