@hegemonart/get-design-done 1.60.1 → 1.60.3

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Get Design Done — 5-stage agent-orchestrated design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 agents, 96 skills, 39 connection integrations, two MCP servers, opt-in SQLite state backbone, bidirectional Figma write-back, and a reflector-driven self-improvement loop. Cross-runtime install for Claude Code, Codex, Cursor, OpenCode, Gemini, and more.",
-    "version": "1.60.1"
+    "version": "1.60.3"
   },
   "plugins": [
     {
       "name": "get-design-done",
       "source": "./",
       "description": "Agent-orchestrated 5-stage design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 specialized agents, 96 skills, 39 connection integrations (Figma, Refero, Preview, Storybook, Chromatic, Graphify, Linear, Jira, Notion, …), bidirectional Figma write-back, queryable intel store, opt-in SQLite state backbone, and a reflector-driven self-improvement loop. Two MCP servers (gdd-state for typed STATE mutators, gdd-mcp for 13 read-only project-priming tools), tier-aware routing with cost telemetry, and defense-in-depth hooks (protected paths, MCP circuit breaker, injection scanner, budget enforcer). Cross-runtime install for Claude Code, Codex, Cursor, OpenCode, Gemini, Copilot, and more.",
-      "version": "1.60.1",
+      "version": "1.60.3",
       "author": {
         "name": "hegemonart"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "get-design-done",
   "short_name": "gdd",
-  "version": "1.60.1",
+  "version": "1.60.3",
   "description": "Agent-orchestrated 5-stage design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 specialized agents, 96 skills, 39 connection integrations (Figma, Refero, Preview, Storybook, Chromatic, Graphify, Linear, Jira, Notion, …), bidirectional Figma write-back, queryable intel store for O(1) design-surface lookups, opt-in SQLite state backbone, and a reflector-driven self-improvement loop. Two MCP servers (`gdd-state` for typed STATE mutators, `gdd-mcp` for 13 read-only project-priming tools), tier-aware agent routing with cost telemetry, defense-in-depth hooks (protected paths, MCP circuit breaker, injection scanner, budget enforcer), and a cross-runtime install layer for Claude Code, Codex, Cursor, OpenCode, Gemini, Copilot, and more.",
   "author": {
     "name": "hegemonart",

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to get-design-done are documented here. Versions follow [sem
 
 ---
 
+## [1.60.3] - 2026-07-06
+
+**Multi-runtime install fix** - the Claude-only `model:` frontmatter directive no longer leaks into the command files generated for non-Claude runtimes. Running any `/gdd-*` command on Kilo Code (Qwen) crashed with `Model not found: inherit/.` because the installer round-tripped `model: inherit` verbatim into the command file and Kilo parsed the value as a literal model id.
+
+### Fixed
+
+- **`model:` frontmatter stripped from non-Claude command files** (`scripts/lib/install/converters/shared.cjs`). `buildFrontmatter` now drops the `model:` line when emitting artifacts for the 12 non-Claude command-format runtimes (Kilo, Qwen, OpenCode, Gemini, Cursor, Codex, Copilot, Antigravity, Augment, CodeBuddy, Windsurf, Trae). `model: inherit` is a Claude-Code directive meaning "defer to the session model"; it - and the Claude tier names `opus` / `sonnet` / `haiku` - are not valid model ids on any other runtime, so Kilo read `inherit` as `<provider>/<model>` (`inherit/`) and failed with `Model not found: inherit/.`. Cross-runtime model selection remains the job of `default-tier` / `reasoning-class` + `tier-resolver.cjs`, which round-trip untouched; sibling keys such as `default-tier:` and `model-notes:` are preserved. Agents are Claude-local-only, so no agent artifact was affected. Regression coverage added in `test/suite/converters-wave4.test.cjs` (Kilo / OpenCode / Gemini integration plus a direct `buildFrontmatter` unit).
+
+### Breaking changes
+
+None.
+
+5,145/5,145 tests pass.
+
+---
+
+## [1.60.2] - 2026-06-13
+
+**Security & CI hardening** - bring the SAST/dependency-audit gates the project lacked, and close the one untrusted-link gap in the injection scanner, *before* the detection engine lands its large new surface. Sourced from a reconciliation against the upstream framework's recent releases (`.planning/audits/UPSTREAM-GSD-CORE-DIFF-2026-06-13.md`).
+
+### Added
+
+- **CodeQL / SAST workflow** (`.github/workflows/codeql.yml`) - `javascript-typescript` with the `security-extended` query suite, on push / PR / weekly schedule. Analysis-only (alerts surface in the Security tab; the job is non-blocking on pre-existing findings). A regression guard for every future PR, established now on a clean tree.
+- **`npm audit` production gate in CI** - `npm audit --omit=dev --audit-level=high` in the security job. Scoped to production dependencies (what ships to consumers); dev-only advisories don't gate the build. Currently green.
+- **Dangerous-link scheme detection in the injection scanner** - `scripts/injection-patterns.cjs` now flags `javascript:` URIs, `data:text/html` / `data:` script payloads, userinfo-credential URLs (`scheme://user:pass@host`), and secret-bearing query params (cross-referenced to the redaction token shapes). These flow from untrusted markdown read by the Read hook and the design-authority watcher's feed ingest, which previously had zero coverage for them. Pattern count 21 to 27; both the runtime hook and the CI scanner auto-consume the new patterns. Tightly anchored with negative fixtures so legitimate `https://`, `mailto:`, `data:image`, and ordinary query strings are not flagged.
+
+### Changed
+
+- **`hono` override `>=4.12.23`** added to `package.json` (transitive via `@modelcontextprotocol/sdk`). Precautionary / future-proofing - our `npm audit` does not currently flag the resolved `hono@4.12.21`; this pins the dependency forward regardless. Resolves to `4.12.25`.
+
+### Breaking changes
+
+None.
+
+5,143/5,143 tests pass.
+
+---
+
 ## [1.60.1] - 2026-06-10
 
 **Security hardening** - two HIGH-severity vulnerabilities closed before the upcoming rebrand copies the foundation layer across every runtime. Both were reachable by a prompt-injected agent, undercutting the trust boundary the plugin's own scanners exist to defend. Each fix ships with failing-then-passing regression tests; an independent adversarial audit confirmed both vectors are dead with no surviving bypass.

package/hooks/context-exhaustion.ts

@@ -148,11 +148,16 @@ export function stateFileHasPausedBlock(): boolean {
 }
 
 function appendPausedBlock(block: string): void {
-  if (!existsSync(dirname(STATE_PATH))) {
-    mkdirSync(dirname(STATE_PATH), { recursive: true });
-  }
-  if (!existsSync(STATE_PATH)) {
-    writeFileSync(STATE_PATH, '# Design State\n\n', 'utf8');
+  // mkdir recursive is idempotent — no existsSync check needed.
+  mkdirSync(dirname(STATE_PATH), { recursive: true });
+  // Seed the header only when the file is new, atomically via the 'wx' flag:
+  // an EEXIST means STATE.md already exists, so we skip the header and append
+  // to it. This collapses the existsSync→writeFileSync/appendFileSync TOCTOU
+  // race that previously sat between the check and the writes.
+  try {
+    writeFileSync(STATE_PATH, '# Design State\n\n', { encoding: 'utf8', flag: 'wx' });
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code !== 'EEXIST') throw e;
   }
   appendFileSync(STATE_PATH, block, 'utf8');
 }

package/hooks/gdd-mcp-circuit-breaker.js

@@ -197,9 +197,24 @@ function appendJsonl(filePath, row) {
 
 function appendStateBlocker(cwd, message) {
   const statePath = path.join(cwd, '.design', 'STATE.md');
-  if (!fs.existsSync(statePath)) return; // silent if STATE missing
   const line = `\n<!-- mcp-circuit-breaker: ${new Date().toISOString()} --> 🛑 BLOCKER: ${message}\n`;
-  try { fs.appendFileSync(statePath, line, 'utf8'); } catch { /* best-effort */ }
+  // Open with 'r+' (no-create) so we append ONLY to an already-existing STATE
+  // and never create it — opening fails with ENOENT when STATE is missing,
+  // which we swallow as "silent if STATE missing". This collapses the old
+  // existsSync→appendFileSync TOCTOU race into a single atomic open.
+  let fd;
+  try {
+    fd = fs.openSync(statePath, 'r+');
+  } catch {
+    return; // STATE missing (ENOENT) or otherwise unopenable — best-effort, stay silent
+  }
+  try {
+    fs.writeSync(fd, line, fs.fstatSync(fd).size, 'utf8');
+  } catch {
+    /* best-effort */
+  } finally {
+    try { fs.closeSync(fd); } catch { /* best-effort */ }
+  }
 }
 
 async function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hegemonart/get-design-done",
-  "version": "1.60.1",
+  "version": "1.60.3",
   "description": "A design-quality pipeline for AI coding agents: brief, explore, plan, design, and verify UI work against your design system.",
   "author": "Hegemon",
   "homepage": "https://github.com/hegemonart/get-design-done",
@@ -156,6 +156,7 @@
   },
   "overrides": {
     "fast-json-patch": "^3.1.1",
+    "hono": ">=4.12.23",
     "qs": ">=6.15.2"
   }
 }

package/scripts/cli/gdd-events.mjs

@@ -29,7 +29,7 @@
 //
 // Default --path is `.design/telemetry/events.jsonl` (relative to cwd).
 
-import { existsSync, statSync, openSync, readSync, closeSync } from 'node:fs';
+import { openSync, readSync, closeSync, fstatSync } from 'node:fs';
 import { resolve, isAbsolute } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { argv, exit, stdout, stderr } from 'node:process';
@@ -146,23 +146,41 @@ async function cmdTail(parsed) {
     return 0;
   }
   // Follow mode: stream existing content, then poll for appends.
+  // Read directly and treat ENOENT as "file not present yet" (offset stays 0,
+  // the poll loop below picks it up once it appears) — avoids the
+  // existsSync→read/statSync TOCTOU race.
   let offset = 0;
-  if (existsSync(path)) {
+  try {
     for await (const ev of readEvents({ path })) {
       stdout.write(JSON.stringify(ev) + '\n');
     }
-    offset = statSync(path).size;
+    // Capture the EOF offset from a short-lived fd (open+fstat) instead of
+    // statSync(path): keeping every size check on a descriptor — never on the
+    // path — leaves no stat→open pair for the poll loop below to race on.
+    const fd0 = openSync(path, 'r');
+    try { offset = fstatSync(fd0).size; } finally { closeSync(fd0); }
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+    offset = 0;
   }
   // Poll loop. Reads new bytes since last offset, splits on \n, writes each.
   let buf = '';
   // eslint-disable-next-line no-constant-condition
   while (true) {
     await new Promise((r) => setTimeout(r, 250));
-    if (!existsSync(path)) continue;
-    const size = statSync(path).size;
-    if (size <= offset) continue;
-    const fd = openSync(path, 'r');
+    // Open the file first and fstat the handle — both the size check and the
+    // read target the descriptor, not the path, so there is no stat→open TOCTOU
+    // window. ENOENT means the file isn't there this tick: skip and re-poll.
+    let fd;
+    try {
+      fd = openSync(path, 'r');
+    } catch (e) {
+      if (e.code === 'ENOENT') continue;
+      throw e;
+    }
     try {
+      const size = fstatSync(fd).size;
+      if (size <= offset) continue;
       const need = size - offset;
       const chunk = Buffer.allocUnsafe(need);
       const n = readSync(fd, chunk, 0, need, offset);

package/scripts/generate-skill-frontmatter.cjs

@@ -202,7 +202,15 @@ function modeForward(check) {
 }
 
 function modeExtract() {
-  const existing = fs.existsSync(SKILLS_JSON) ? readSkillsJson() : { schema_version: 1, skills: [] };
+  // Read directly and treat a missing skills.json as the empty-default seed —
+  // avoids the existsSync→readFileSync TOCTOU race.
+  let existing;
+  try {
+    existing = readSkillsJson();
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+    existing = { schema_version: 1, skills: [] };
+  }
   const prevMap = recordMap(existing);
   const dirs = listSkillDirs();
   const skills = [];

package/scripts/injection-patterns.cjs

@@ -41,6 +41,53 @@ const INJECTION_PATTERNS = [
   { name: 'tar-home-netcat',          re: /\btar\s+c[fzvj]+\s+-\s+~[^\n]*\|\s*(nc|ssh|curl)/ },
   { name: 'env-dot-leak',             re: /process\.env\.[A-Z][A-Z0-9_]*_(KEY|TOKEN|SECRET)\s*[^;,\n]*(fetch|axios|XMLHttpRequest|http\.request)/ },
   { name: 'ssh-key-cat',              re: /\bcat\s+~?\/?\.ssh\/id_(rsa|ed25519|ecdsa|dsa)\b/ },
+
+  // ── dangerous URL schemes + credential links (60.2 / SEC-CI-03) ──────
+  // These flow from untrusted markdown (Read hook) and RSS/article ingest.
+  // Each regex is anchored tightly to avoid false-positives on the repo's
+  // own shipped docs (the CI scan:injection gate scans them) and is
+  // linear-time (bounded quantifiers, no nested/overlapping repetition).
+
+  // `javascript:` used as a link/href target. The colon must be directly
+  // followed by a non-whitespace payload char — so prose like "JavaScript:"
+  // (a sentence colon, followed by a space) and the bare word "JavaScript"
+  // do NOT match. Preceded by start-of-string or a non-word char so it
+  // anchors on `](javascript:` / `href="javascript:` / `=javascript:`.
+  { name: 'javascript: uri',          re: /(?:^|[^\w])javascript:(?=\S)/i },
+
+  // `data:text/html` URIs (optional ;base64). Will NOT match `data:image/…`,
+  // nor `data: <word>` prose (colon-space): the literal `text/html` is required.
+  { name: 'data:text/html uri',       re: /\bdata:text\/html\b/i },
+
+  // `data:` URI carrying a script payload (covers data: media types beyond
+  // text/html). `[^\s<]{0,200}` is a bounded run (no ReDoS) that also
+  // EXCLUDES `<`, so it cannot reach across a `<script` that appears BEFORE
+  // `data:` on the line (e.g. export-formats.md:27 "…<script> … data: URIs"):
+  // there the char after `data:` is a backtick+space, the run stops at the
+  // space, and no script marker follows. Requires `data:` to be immediately
+  // followed (no space) by payload chars that lead into `<script`/`%3Cscript`.
+  { name: 'data: script payload',     re: /data:[^\s<]{0,200}(?:<script|%3Cscript)/i },
+
+  // userinfo-credential URL: `scheme://user:pass@host`. The `:` must appear
+  // in the userinfo segment BEFORE the `@`, and both must precede the first
+  // `/` of the path (i.e. inside the authority). Mutually-exclusive char
+  // classes on the boundary chars keep it linear. Does NOT match
+  // `mailto:user@host` (no `://`), bare `user@host` (no `://`), a plain
+  // `https://host/path` (no `@`), nor an `@` that appears only in the path.
+  { name: 'userinfo credentials url', re: /:\/\/[^/\s:@]+:[^/\s@]*@/ },
+
+  // Secret-bearing query param. Two linear alternatives:
+  //   (a) a query KEY named like a credential (token/api_key/secret/…)
+  //       followed by `=` and a non-trivial value; OR
+  //   (b) any query value matching a redact.cjs secret SHAPE
+  //       (sk-ant-/sk-/jwt/AIza/ghp_/gh[sour]_/AKIA/xox…).
+  // `[^&\s#]+` and the shape bodies are bounded by their delimiters / fixed
+  // lengths — no catastrophic backtracking. Does NOT match benign params
+  // like `?q=`, `?lang=en`, `?sort=desc`, `?page=2`.
+  {
+    name: 'secret-bearing query param',
+    re: /[?&](?:access_token|client_secret|api[_-]?key|apikey|token|secret|password|auth)=[^&\s#]+|[?&][\w-]{1,40}=(?:sk-ant-[\w-]{20,}|sk-[\w-]{20,}|eyJ[\w-]{10,}\.[\w-]{10,}\.[\w-]{10,}|AIza[\w-]{35}|ghp_[A-Za-z0-9]{36,}|gh[sour]_[A-Za-z0-9]{36,}|AKIA[0-9A-Z]{16}|xox[baprs]-[\w-]{10,})/i,
+  },
 ];
 
 /**

package/scripts/lib/ds-arms/design-arms-store.cjs

@@ -23,6 +23,10 @@ const DEFAULT_ARMS_PATH = '.design/telemetry/design-arms.json';
 // user-outcome data shifts it (D-03 — advisory, never directive).
 const DESIGN_ARM_PRIOR = Object.freeze({ alpha: 2, beta: 8 });
 
+// Monotonic per-process counter so two saves within the same millisecond still get
+// distinct tmp names (no `crypto` — this module is "no crypto, no egress").
+let _tmpSeq = 0;
+
 /** Inline FNV-1a (32-bit) hash → 8-char hex. Deterministic, dependency-free. */
 function fnv1a(str) {
   let h = 0x811c9dc5;
@@ -62,7 +66,10 @@ function save(store, opts = {}) {
   fs.mkdirSync(path.dirname(p), { recursive: true });
   store.schema_version = SCHEMA_VERSION;
   store.generated_at = new Date().toISOString();
-  const tmp = p + '.tmp';
+  // Unique per-writer tmp name: prevents symlink/race attacks on a static `.tmp`
+  // path AND stops concurrent writers from clobbering each other's tmp file before
+  // the atomic rename. pid + time + counter — no crypto (see module header).
+  const tmp = `${p}.${process.pid}.${Date.now()}.${_tmpSeq++}.tmp`;
   fs.writeFileSync(tmp, JSON.stringify(store, null, 2));
   fs.renameSync(tmp, p);
 }

package/scripts/lib/install/converters/shared.cjs

@@ -316,6 +316,10 @@ function ensureAdapterHeader(body, runtimeDisplay) {
  *     `gsd-` prefix on the existing name to avoid `gdd-gdd-`-style
  *     duplication). All other fields round-trip verbatim — we do NOT
  *     parse YAML; we operate on the raw text with a line-by-line scan.
+ *   - EXCEPTION: the Claude-Code-only `model:` line is dropped. Its
+ *     values (`inherit` / a Claude tier name) are invalid model ids on
+ *     non-Claude runtimes and crash their command loaders (Kilo:
+ *     `Model not found: inherit/.`). See the inline note below.
  *   - If the original has no `name:` field, prepend one.
  *
  * Returns a complete frontmatter string with leading/trailing `---`
@@ -339,8 +343,24 @@ function buildFrontmatter(originalFrontmatter, skillName, runtimePrefix) {
   }
 
   // Line-by-line rewrite of the `name:` field. We never touch description,
-  // tools, or any other field — they round-trip verbatim.
-  const lines = originalFrontmatter.split(/\r?\n/);
+  // tools, or any other field — they round-trip verbatim, with ONE
+  // exception: the Claude-Code-only `model:` directive is dropped.
+  //
+  // `model:` is a Claude harness directive ("defer to the session model" for
+  // `inherit`, or pin a Claude tier for `opus`/`sonnet`/`haiku`). None of
+  // those values are valid model ids on the non-Claude runtimes this
+  // converter targets. Kilo (and other command-runners) read the `model:`
+  // frontmatter and parse the value as a literal `<provider>/<model>` — so
+  // `model: inherit` becomes `inherit/` (empty model) and the command dies
+  // with `Model not found: inherit/.`. Cross-runtime model selection is the
+  // job of `default-tier`/`reasoning-class` + tier-resolver.cjs, NOT this
+  // per-command harness directive, so we strip the whole line here.
+  //
+  // The `^\s*model\s*:` anchor matches only the exact `model` key — sibling
+  // keys like `model-notes:` or `default-tier:` are preserved.
+  const lines = originalFrontmatter
+    .split(/\r?\n/)
+    .filter((line) => !/^\s*model\s*:/.test(line));
   let nameSeen = false;
   for (let i = 0; i < lines.length; i++) {
     const m = lines[i].match(/^(\s*name\s*:\s*)(.*)$/);

package/scripts/lib/manifest/loader.cjs

@@ -31,20 +31,29 @@ function load(name, opts) {
   const fallback = Object.prototype.hasOwnProperty.call(o, 'fallback') ? o.fallback : {};
   const abs = path.join(dir, `${name}.json`);
 
-  let stat;
-  try { stat = fs.statSync(abs); } catch {
+  // Open once and operate on the file descriptor (fstat for the mtime-cache key,
+  // then read from the same fd). A single handle resolves the path exactly once,
+  // at open, so there is no statSync→readFileSync TOCTOU window.
+  let fd;
+  try { fd = fs.openSync(abs, 'r'); } catch {
     if (!o.quiet) process.stderr.write(`manifest: ${name}.json not found — using empty fallback (a consumer phase may not have shipped its data yet)\n`);
     return fallback;
   }
-  const cached = _cache.get(abs);
-  if (cached && cached.mtimeMs === stat.mtimeMs) return cached.data;
   try {
-    const data = JSON.parse(fs.readFileSync(abs, 'utf8'));
-    _cache.set(abs, { mtimeMs: stat.mtimeMs, data });
-    return data;
-  } catch (e) {
-    if (!o.quiet) process.stderr.write(`manifest: ${name}.json parse error (${e.message}) — using empty fallback\n`);
-    return fallback;
+    const stat = fs.fstatSync(fd);
+    const cached = _cache.get(abs);
+    if (cached && cached.mtimeMs === stat.mtimeMs) return cached.data;
+    const raw = fs.readFileSync(fd, 'utf8');
+    try {
+      const data = JSON.parse(raw);
+      _cache.set(abs, { mtimeMs: stat.mtimeMs, data });
+      return data;
+    } catch (e) {
+      if (!o.quiet) process.stderr.write(`manifest: ${name}.json parse error (${e.message}) — using empty fallback\n`);
+      return fallback;
+    }
+  } finally {
+    fs.closeSync(fd);
   }
 }
 

package/scripts/lib/reflector-kfm-proposer.cjs

@@ -425,11 +425,16 @@ function applyReject(draftPath, _options) {
  */
 function applyDefer(draftPath, options) {
   const opts = options || {};
-  if (!fs.existsSync(draftPath)) {
-    throw new Error(`KFM draft not found: ${draftPath}`);
-  }
   const deferredUntil = opts.deferredUntil || new Date(Date.now() + 30 * 86_400_000).toISOString().slice(0, 10);
-  const orig = fs.readFileSync(draftPath, 'utf8');
+  // Read directly and treat ENOENT as "draft not found" — avoids the
+  // existsSync→readFileSync TOCTOU race.
+  let orig;
+  try {
+    orig = fs.readFileSync(draftPath, 'utf8');
+  } catch (e) {
+    if (e.code === 'ENOENT') throw new Error(`KFM draft not found: ${draftPath}`);
+    throw e;
+  }
   let updated;
   if (/^deferred_until:/m.test(orig)) {
     updated = orig.replace(/^deferred_until:.*$/m, `deferred_until: ${deferredUntil}`);

package/scripts/lib/risk/tables.cjs

@@ -73,7 +73,7 @@ const FILE_SENSITIVITY = Object.freeze([
   // De-risking: tests + fixtures are low-stakes.
   { test: /(^|\/)(tests?|fixtures?|__tests__|__fixtures__)\//i, mult: 0.6, add: 0, label: 'test-or-fixture' },
   // De-risking: docs / markdown.
-  { test: /(^|\/)docs?\/|\.mdx?$/i, mult: 0.5, add: 0, label: 'docs' },
+  { test: /(?:(?:^|\/)docs?\/)|(?:\.mdx?$)/i, mult: 0.5, add: 0, label: 'docs' },
 ]);
 
 // ── Severity -> addend for destructive bash (via dangerous-patterns.cjs) ────

package/sdk/cli/index.js

@@ -5,11 +5,20 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)

package/sdk/mcp/gdd-mcp/server.js

@@ -7,7 +7,11 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name14 in all)
@@ -428,24 +432,30 @@ var require_loader = __commonJS({
       const dir = o.dir || MANIFEST_DIR;
       const fallback = Object.prototype.hasOwnProperty.call(o, "fallback") ? o.fallback : {};
       const abs = path.join(dir, `${name14}.json`);
-      let stat;
+      let fd;
       try {
-        stat = fs.statSync(abs);
+        fd = fs.openSync(abs, "r");
       } catch {
         if (!o.quiet) process.stderr.write(`manifest: ${name14}.json not found \u2014 using empty fallback (a consumer phase may not have shipped its data yet)
 `);
         return fallback;
       }
-      const cached = _cache.get(abs);
-      if (cached && cached.mtimeMs === stat.mtimeMs) return cached.data;
       try {
-        const data = JSON.parse(fs.readFileSync(abs, "utf8"));
-        _cache.set(abs, { mtimeMs: stat.mtimeMs, data });
-        return data;
-      } catch (e) {
-        if (!o.quiet) process.stderr.write(`manifest: ${name14}.json parse error (${e.message}) \u2014 using empty fallback
+        const stat = fs.fstatSync(fd);
+        const cached = _cache.get(abs);
+        if (cached && cached.mtimeMs === stat.mtimeMs) return cached.data;
+        const raw = fs.readFileSync(fd, "utf8");
+        try {
+          const data = JSON.parse(raw);
+          _cache.set(abs, { mtimeMs: stat.mtimeMs, data });
+          return data;
+        } catch (e) {
+          if (!o.quiet) process.stderr.write(`manifest: ${name14}.json parse error (${e.message}) \u2014 using empty fallback
 `);
-        return fallback;
+          return fallback;
+        }
+      } finally {
+        fs.closeSync(fd);
       }
     }
     module2.exports = { load: load2, reset, MANIFEST_DIR };