Resolves bd-ee1: Add security tests for WriteFile permissions in doctor command
Added comprehensive security tests for the FixGitignore function to verify:
- Files are created with 0600 permissions (secure, owner-only read/write)
- Existing files with insecure permissions are fixed
- Read-only files can be updated (permissions fixed first)
- File ownership is correct
- Permissions are enforced even on systems that respect umask
Also improved FixGitignore implementation to:
- Handle read-only files by fixing permissions before writing
- Explicitly set permissions after write to ensure 0600 regardless of umask
- Maintain secure permissions throughout the operation
Tests verify the gosec G306 security concern is properly addressed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
This implements the ability to separate bd-specific instructions from
project-specific instructions by generating a canonical BD_GUIDE.md file.
## Changes
1. Added `--output` flag to `bd onboard` command
- Generates version-stamped BD_GUIDE.md at specified path
- Includes both agentsContent and copilotInstructionsContent
- Auto-generated header warns against manual editing
2. Version tracking integration
- checkAndSuggestBDGuideUpdate() detects outdated BD_GUIDE.md
- Suggests regeneration when bd version changes
- Integrated with maybeShowUpgradeNotification()
3. Comprehensive test coverage
- Tests for BD_GUIDE.md generation
- Tests for version stamp validation
- Tests for content inclusion
4. Documentation updates
- Updated AGENTS.md with BD_GUIDE.md workflow
- Added regeneration instructions to upgrade workflow
## Benefits
- Clear separation of concerns (bd vs project instructions)
- Deterministic updates (no LLM involved)
- Git-trackable diffs show exactly what changed
- Progressive disclosure (agents read when needed)
## Usage
\`\`\`bash
# Generate BD_GUIDE.md
bd onboard --output .beads/BD_GUIDE.md
# After upgrading bd
bd onboard --output .beads/BD_GUIDE.md # Regenerate
\`\`\`
Closes bd-woro
Problem: Existing beads repositories initialized before commit a4c38d5 don't have sync.branch configured. This causes 'bd sync --status' to fail with a confusing error.
Solution: Added new check in 'bd doctor' that detects when sync.branch is not configured and provides automatic fix via 'bd doctor --fix'. The fix automatically sets sync.branch to the current branch using 'git symbolic-ref --short HEAD'.
Changes:
- Added checkSyncBranchConfig() function in doctor.go
- Created fix/sync_branch.go with SyncBranchConfig() fix handler
- Added comprehensive test coverage in doctor_test.go
- Integrated check into applyFixes() switch statement
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Re-check socket existence after lock check to avoid stale socket state
- If socket is initially missing but daemon lock is held, re-check socket to handle daemon startup race
- Add test TestTryConnectWithTimeout_SocketExistenceRecheck to verify fix
Fixes bd-4owj
Changes:
- CheckStaleness now returns errors for corrupted last_import_time metadata
instead of silently returning false (bd-o4qy)
- Added handling for empty string metadata (memory store behavior)
- Enhanced warning messages when staleness check fails to be more explicit
that operation continues with potentially stale data (bd-n4td)
- Added test coverage for corrupted metadata scenario
Closes bd-2q6d, bd-o4qy, bd-n4td
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Validate dependsOnID is non-empty before setting discoveredFromParentID
to prevent attempting to fetch an issue with empty ID.
Also added validation to ensure parent issue exists before generating
child IDs in direct mode.
Fixes: bd-ia8r
- Add isInRebase() to detect rebase state
- Add hasJSONLConflict() to check for JSONL-only conflicts
- Add runGitRebaseContinue() to continue rebase after resolution
- Auto-export from DB and resolve conflict when detected
- Add comprehensive tests for auto-resolution logic
Implements bd-cwmt
Implements flexible error handling for export operations with four policies:
- strict: Fail-fast on any error (default for user exports)
- best-effort: Skip errors with warnings (default for auto-exports)
- partial: Retry then skip with manifest tracking
- required-core: Fail on core data, skip enrichments
Key features:
- Per-project configuration via `bd config set export.error_policy`
- Separate policy for auto-exports: `auto_export.error_policy`
- Retry with exponential backoff (configurable attempts/delay)
- Optional export manifests documenting completeness
- Per-issue encoding error handling
This allows users to choose the right trade-off between data integrity
and system availability for their specific project needs.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
