The check-todos command lists all pending todos with area filtering, allows interactive selection, loads full context for the selected todo, and routes to appropriate action.
Pending Todos (6 total)API (2):1. Add rate limiting to endpoints Priority: high Files: src/api/middleware.ts2. Implement response caching Priority: medium Files: src/api/handlers.tsAuth (2):3. Add refresh token rotation Priority: high Files: src/auth/tokens.ts4. Fix session timeout config Priority: medium Files: src/auth/session.tsDatabase (1):5. Add indexes to user_events Priority: high Files: src/db/schema.tsGeneral (1):6. Improve error messages Priority: low Files: src/utils/errors.tsSelect a number to see details, or type 'cancel':
Auth Todos (2):1. Add refresh token rotation Priority: high Added: 2026-03-04 Files: src/auth/tokens.ts Context: Current implementation uses long-lived refresh tokens. Security best practice is rotation.2. Fix session timeout config Priority: medium Added: 2026-03-05 Files: src/auth/session.ts Context: From debug session - intermittent logouts caused by misconfigured timeout.Select a number, or type 'cancel':
Todo: Add rate limiting to API endpointsArea: apiPriority: highAdded: 2026-03-04## ContextCurrently no rate limiting on public endpoints.Vulnerable to abuse and DDoS.## Proposed Action- Add express-rate-limit middleware- Configure per-endpoint limits- Add Redis for distributed rate limiting- Return 429 with Retry-After header## Related Files- src/api/middleware.ts- src/api/app.ts- src/config/rate-limits.ts## Roadmap CheckNot found in existing phase plans.How would you like to proceed?1. Quick fix (/gsd:quick) - Fast implementation for straightforward todos2. Add to existing phase - Phase 4: API improvements (in progress)3. Plan new phase - Create dedicated phase for this work4. Brainstorm first (/gsd:discuss) - Explore approach before committing5. Mark as planned - You'll handle this manually6. Back to list
You: 3 # Plan new phaseGSD: Creating phase from todo...Phase 7: API rate limiting and protectionGoals:- Prevent API abuse- Implement distributed rate limiting- Add proper 429 responsesContext from todo loaded into phase PLAN.md.Use /gsd:execute 7 when ready.
You: 4 # BrainstormGSD: Let's explore rate limiting approaches...Questions:1. Which endpoints need limiting? - All public endpoints? - Just high-cost operations?2. Rate limit strategy? - Per IP? - Per user? - Per API key?3. Storage backend? - Redis for distributed? - In-memory for single instance?[Discussion continues...][Decisions captured in CONTEXT.md]Ready to proceed? - Quick fix with decisions- Plan phase with full context
## Roadmap Check✓ Related to Phase 4: API improvements - Task 3 mentions rate limiting - 60% completeThis todo might overlap with planned work.Review Phase 4 plan before creating duplicate phase.