STD Bridge

Bridge between GitHub Spec Kit and GSD Core — converts tasks.md → .planning/PLAN.md with embedded TDD structure and generates application-specific pentest files.

Install

npx std-bridge --init

Or install globally:

npm install -g std-bridge
std-bridge --init

Usage

# Basic (uses default paths)
npx std-bridge

# Custom project path
npx std-bridge ./my-project

# Custom base URL for generated tests
npx std-bridge --base-url https://api.example.com

# Init a new project
npx std-bridge --init
npx std-bridge --init ./my-project

Configuration

After running --init, a .std-bridge.json file is created in your project root:

{
  "baseUrl": "http://localhost:3000"
}

You can also override these paths in .std-bridge.json:

{
  "baseUrl": "https://api.example.com",
  "tasksPath": "docs/specs/tasks.md",
  "specPath": "docs/specs/spec.md",
  "planOut": ".planning/PLAN.md",
  "pentestDir": "tests/security"
}

CLI flags take precedence over the config file:

• --base-url overrides baseUrl in .std-bridge.json
• First positional arg sets the project directory

What it does

1. Reads docs/specs/tasks.md (from SpecKit)
2. Reads docs/specs/spec.md (from SpecKit)
3. Generates .planning/PLAN.md with TDD Red/Green/Refactor/Pentest per task
4. Generates tests/security/ with application-specific pentest files:
   • tests/security/api/*.spec.js — endpoint pentests (SQLi, IDOR, rate limit)
   • tests/security/auth/*.spec.js — auth pentests (JWT tampering, brute force)
   • tests/security/business-logic/*.spec.js — rule pentests (race, overflow)
   • tests/security/data/*.spec.js — data pentests (leakage, mass assignment)

Integration

Works as a hook between /speckit.tasks and /gsd-execute-phase:

/speckit.specify → /speckit.plan → /speckit.tasks
                                         ↓
                               npx std-bridge
                                         ↓
                              /gsd-execute-phase

Security

Each generated pentest targets specific endpoints, models, auth flows, and business rules from your spec — not generic tests.