@hegemonart/get-design-done 1.60.2 → 1.60.4

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Get Design Done — 5-stage agent-orchestrated design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 agents, 96 skills, 39 connection integrations, two MCP servers, opt-in SQLite state backbone, bidirectional Figma write-back, and a reflector-driven self-improvement loop. Cross-runtime install for Claude Code, Codex, Cursor, OpenCode, Gemini, and more.",
-    "version": "1.60.2"
+    "version": "1.60.4"
   },
   "plugins": [
     {
       "name": "get-design-done",
       "source": "./",
       "description": "Agent-orchestrated 5-stage design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 specialized agents, 96 skills, 39 connection integrations (Figma, Refero, Preview, Storybook, Chromatic, Graphify, Linear, Jira, Notion, …), bidirectional Figma write-back, queryable intel store, opt-in SQLite state backbone, and a reflector-driven self-improvement loop. Two MCP servers (gdd-state for typed STATE mutators, gdd-mcp for 13 read-only project-priming tools), tier-aware routing with cost telemetry, and defense-in-depth hooks (protected paths, MCP circuit breaker, injection scanner, budget enforcer). Cross-runtime install for Claude Code, Codex, Cursor, OpenCode, Gemini, Copilot, and more.",
-      "version": "1.60.2",
+      "version": "1.60.4",
       "author": {
         "name": "hegemonart"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "get-design-done",
   "short_name": "gdd",
-  "version": "1.60.2",
+  "version": "1.60.4",
   "description": "Agent-orchestrated 5-stage design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 specialized agents, 96 skills, 39 connection integrations (Figma, Refero, Preview, Storybook, Chromatic, Graphify, Linear, Jira, Notion, …), bidirectional Figma write-back, queryable intel store for O(1) design-surface lookups, opt-in SQLite state backbone, and a reflector-driven self-improvement loop. Two MCP servers (`gdd-state` for typed STATE mutators, `gdd-mcp` for 13 read-only project-priming tools), tier-aware agent routing with cost telemetry, defense-in-depth hooks (protected paths, MCP circuit breaker, injection scanner, budget enforcer), and a cross-runtime install layer for Claude Code, Codex, Cursor, OpenCode, Gemini, Copilot, and more.",
   "author": {
     "name": "hegemonart",

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to get-design-done are documented here. Versions follow [sem
 
 ---
 
+## [1.60.4] - 2026-07-06
+
+**Multi-runtime install fix (Tier-2 bundles)** - follow-up to 1.60.3. The same Claude-only `model:` frontmatter directive is now stripped from the Tier-2 marketplace distribution bundles, not just the Tier-1 file-drop command files.
+
+### Fixed
+
+- **`model:` frontmatter stripped from Tier-2 marketplace bundles** (`scripts/lib/install/converters/codex-plugin.cjs`, `scripts/lib/install/converters/cursor-marketplace.cjs`). These converters copied the `skills/` tree verbatim, so `model: inherit` still leaked into the Codex-plugin and Cursor-marketplace bundles and would crash non-Claude consumers exactly as the file-drop path did before 1.60.3 (`Model not found: inherit/.`). A new shared helper `stripModelFromFrontmatter` drops the `model:` line from each `SKILL.md` frontmatter during the copy; files that carry no `model:` line are still copied byte-for-byte, so the verbatim-copy guarantee holds for everything else. `buildFrontmatter` and the new helper share a single `MODEL_FIELD_RE` so the Tier-1 and Tier-2 paths strip identically. Regression coverage in `test/suite/converters/codex-plugin.test.cjs`, `test/suite/converters/cursor-marketplace.test.cjs`, and a `stripModelFromFrontmatter` unit in `test/suite/converters-wave4.test.cjs`.
+
+### Breaking changes
+
+None.
+
+5,148/5,148 tests pass.
+
+---
+
+## [1.60.3] - 2026-07-06
+
+**Multi-runtime install fix** - the Claude-only `model:` frontmatter directive no longer leaks into the command files generated for non-Claude runtimes. Running any `/gdd-*` command on Kilo Code (Qwen) crashed with `Model not found: inherit/.` because the installer round-tripped `model: inherit` verbatim into the command file and Kilo parsed the value as a literal model id.
+
+### Fixed
+
+- **`model:` frontmatter stripped from non-Claude command files** (`scripts/lib/install/converters/shared.cjs`). `buildFrontmatter` now drops the `model:` line when emitting artifacts for the 12 non-Claude command-format runtimes (Kilo, Qwen, OpenCode, Gemini, Cursor, Codex, Copilot, Antigravity, Augment, CodeBuddy, Windsurf, Trae). `model: inherit` is a Claude-Code directive meaning "defer to the session model"; it - and the Claude tier names `opus` / `sonnet` / `haiku` - are not valid model ids on any other runtime, so Kilo read `inherit` as `<provider>/<model>` (`inherit/`) and failed with `Model not found: inherit/.`. Cross-runtime model selection remains the job of `default-tier` / `reasoning-class` + `tier-resolver.cjs`, which round-trip untouched; sibling keys such as `default-tier:` and `model-notes:` are preserved. Agents are Claude-local-only, so no agent artifact was affected. Regression coverage added in `test/suite/converters-wave4.test.cjs` (Kilo / OpenCode / Gemini integration plus a direct `buildFrontmatter` unit).
+
+### Breaking changes
+
+None.
+
+5,145/5,145 tests pass.
+
+---
+
 ## [1.60.2] - 2026-06-13
 
 **Security & CI hardening** - bring the SAST/dependency-audit gates the project lacked, and close the one untrusted-link gap in the injection scanner, *before* the detection engine lands its large new surface. Sourced from a reconciliation against the upstream framework's recent releases (`.planning/audits/UPSTREAM-GSD-CORE-DIFF-2026-06-13.md`).

package/hooks/context-exhaustion.ts

@@ -148,11 +148,16 @@ export function stateFileHasPausedBlock(): boolean {
 }
 
 function appendPausedBlock(block: string): void {
-  if (!existsSync(dirname(STATE_PATH))) {
-    mkdirSync(dirname(STATE_PATH), { recursive: true });
-  }
-  if (!existsSync(STATE_PATH)) {
-    writeFileSync(STATE_PATH, '# Design State\n\n', 'utf8');
+  // mkdir recursive is idempotent — no existsSync check needed.
+  mkdirSync(dirname(STATE_PATH), { recursive: true });
+  // Seed the header only when the file is new, atomically via the 'wx' flag:
+  // an EEXIST means STATE.md already exists, so we skip the header and append
+  // to it. This collapses the existsSync→writeFileSync/appendFileSync TOCTOU
+  // race that previously sat between the check and the writes.
+  try {
+    writeFileSync(STATE_PATH, '# Design State\n\n', { encoding: 'utf8', flag: 'wx' });
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code !== 'EEXIST') throw e;
   }
   appendFileSync(STATE_PATH, block, 'utf8');
 }

package/hooks/gdd-mcp-circuit-breaker.js

@@ -197,9 +197,24 @@ function appendJsonl(filePath, row) {
 
 function appendStateBlocker(cwd, message) {
   const statePath = path.join(cwd, '.design', 'STATE.md');
-  if (!fs.existsSync(statePath)) return; // silent if STATE missing
   const line = `\n<!-- mcp-circuit-breaker: ${new Date().toISOString()} --> 🛑 BLOCKER: ${message}\n`;
-  try { fs.appendFileSync(statePath, line, 'utf8'); } catch { /* best-effort */ }
+  // Open with 'r+' (no-create) so we append ONLY to an already-existing STATE
+  // and never create it — opening fails with ENOENT when STATE is missing,
+  // which we swallow as "silent if STATE missing". This collapses the old
+  // existsSync→appendFileSync TOCTOU race into a single atomic open.
+  let fd;
+  try {
+    fd = fs.openSync(statePath, 'r+');
+  } catch {
+    return; // STATE missing (ENOENT) or otherwise unopenable — best-effort, stay silent
+  }
+  try {
+    fs.writeSync(fd, line, fs.fstatSync(fd).size, 'utf8');
+  } catch {
+    /* best-effort */
+  } finally {
+    try { fs.closeSync(fd); } catch { /* best-effort */ }
+  }
 }
 
 async function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hegemonart/get-design-done",
-  "version": "1.60.2",
+  "version": "1.60.4",
   "description": "A design-quality pipeline for AI coding agents: brief, explore, plan, design, and verify UI work against your design system.",
   "author": "Hegemon",
   "homepage": "https://github.com/hegemonart/get-design-done",

package/scripts/cli/gdd-events.mjs

@@ -29,7 +29,7 @@
 //
 // Default --path is `.design/telemetry/events.jsonl` (relative to cwd).
 
-import { existsSync, statSync, openSync, readSync, closeSync } from 'node:fs';
+import { openSync, readSync, closeSync, fstatSync } from 'node:fs';
 import { resolve, isAbsolute } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { argv, exit, stdout, stderr } from 'node:process';
@@ -146,23 +146,41 @@ async function cmdTail(parsed) {
     return 0;
   }
   // Follow mode: stream existing content, then poll for appends.
+  // Read directly and treat ENOENT as "file not present yet" (offset stays 0,
+  // the poll loop below picks it up once it appears) — avoids the
+  // existsSync→read/statSync TOCTOU race.
   let offset = 0;
-  if (existsSync(path)) {
+  try {
     for await (const ev of readEvents({ path })) {
       stdout.write(JSON.stringify(ev) + '\n');
     }
-    offset = statSync(path).size;
+    // Capture the EOF offset from a short-lived fd (open+fstat) instead of
+    // statSync(path): keeping every size check on a descriptor — never on the
+    // path — leaves no stat→open pair for the poll loop below to race on.
+    const fd0 = openSync(path, 'r');
+    try { offset = fstatSync(fd0).size; } finally { closeSync(fd0); }
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+    offset = 0;
   }
   // Poll loop. Reads new bytes since last offset, splits on \n, writes each.
   let buf = '';
   // eslint-disable-next-line no-constant-condition
   while (true) {
     await new Promise((r) => setTimeout(r, 250));
-    if (!existsSync(path)) continue;
-    const size = statSync(path).size;
-    if (size <= offset) continue;
-    const fd = openSync(path, 'r');
+    // Open the file first and fstat the handle — both the size check and the
+    // read target the descriptor, not the path, so there is no stat→open TOCTOU
+    // window. ENOENT means the file isn't there this tick: skip and re-poll.
+    let fd;
+    try {
+      fd = openSync(path, 'r');
+    } catch (e) {
+      if (e.code === 'ENOENT') continue;
+      throw e;
+    }
     try {
+      const size = fstatSync(fd).size;
+      if (size <= offset) continue;
       const need = size - offset;
       const chunk = Buffer.allocUnsafe(need);
       const n = readSync(fd, chunk, 0, need, offset);

package/scripts/generate-skill-frontmatter.cjs

@@ -202,7 +202,15 @@ function modeForward(check) {
 }
 
 function modeExtract() {
-  const existing = fs.existsSync(SKILLS_JSON) ? readSkillsJson() : { schema_version: 1, skills: [] };
+  // Read directly and treat a missing skills.json as the empty-default seed —
+  // avoids the existsSync→readFileSync TOCTOU race.
+  let existing;
+  try {
+    existing = readSkillsJson();
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+    existing = { schema_version: 1, skills: [] };
+  }
   const prevMap = recordMap(existing);
   const dirs = listSkillDirs();
   const skills = [];

package/scripts/lib/ds-arms/design-arms-store.cjs

@@ -23,6 +23,10 @@ const DEFAULT_ARMS_PATH = '.design/telemetry/design-arms.json';
 // user-outcome data shifts it (D-03 — advisory, never directive).
 const DESIGN_ARM_PRIOR = Object.freeze({ alpha: 2, beta: 8 });
 
+// Monotonic per-process counter so two saves within the same millisecond still get
+// distinct tmp names (no `crypto` — this module is "no crypto, no egress").
+let _tmpSeq = 0;
+
 /** Inline FNV-1a (32-bit) hash → 8-char hex. Deterministic, dependency-free. */
 function fnv1a(str) {
   let h = 0x811c9dc5;
@@ -62,7 +66,10 @@ function save(store, opts = {}) {
   fs.mkdirSync(path.dirname(p), { recursive: true });
   store.schema_version = SCHEMA_VERSION;
   store.generated_at = new Date().toISOString();
-  const tmp = p + '.tmp';
+  // Unique per-writer tmp name: prevents symlink/race attacks on a static `.tmp`
+  // path AND stops concurrent writers from clobbering each other's tmp file before
+  // the atomic rename. pid + time + counter — no crypto (see module header).
+  const tmp = `${p}.${process.pid}.${Date.now()}.${_tmpSeq++}.tmp`;
   fs.writeFileSync(tmp, JSON.stringify(store, null, 2));
   fs.renameSync(tmp, p);
 }

package/scripts/lib/install/converters/codex-plugin.cjs

@@ -44,6 +44,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const shared = require('./shared.cjs');
 
 // Per research § Top-level fields: name, version, description are the only
 // strictly-required spec fields. All other manifest fields are optional.
@@ -112,6 +113,12 @@ function curateKeywords(arr) {
 /**
  * Copy a directory tree recursively. Vanilla fs only — no deps. Mirrors
  * the helper used by cursor-marketplace.cjs (Plan 28-8-B1).
+ *
+ * `SKILL.md` files are sanitized in transit: the Claude-only `model:`
+ * frontmatter directive is stripped so non-Claude marketplace consumers do
+ * not choke on `model: inherit` (Kilo: `Model not found: inherit/.`). Files
+ * that carry no `model:` line are copied byte-for-byte (copyFileSync), so the
+ * verbatim-copy guarantee still holds for everything else.
  */
 function copyDirRecursive(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
@@ -121,7 +128,17 @@ function copyDirRecursive(src, dest) {
     if (entry.isDirectory()) {
       copyDirRecursive(srcPath, destPath);
     } else if (entry.isFile()) {
-      fs.copyFileSync(srcPath, destPath);
+      if (entry.name === 'SKILL.md') {
+        const original = fs.readFileSync(srcPath, 'utf8');
+        const stripped = shared.stripModelFromFrontmatter(original);
+        if (stripped === original) {
+          fs.copyFileSync(srcPath, destPath); // byte-exact, no re-encode
+        } else {
+          fs.writeFileSync(destPath, stripped, 'utf8');
+        }
+      } else {
+        fs.copyFileSync(srcPath, destPath);
+      }
     }
     // symlinks + other: ignored (skills tree is regular files only).
   }

package/scripts/lib/install/converters/cursor-marketplace.cjs

@@ -34,6 +34,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const shared = require('./shared.cjs');
 
 // Curated keyword subset for Cursor's marketplace card display.
 // Per Wave A research § Schema Mapping `keywords` row: marketplace card
@@ -201,6 +202,12 @@ function buildManifest(sources, opts) {
 /**
  * Copy a directory tree recursively. Vanilla fs only — no deps.
  * Returns the list of relative paths written (relative to `dest`).
+ *
+ * `SKILL.md` files are sanitized in transit: the Claude-only `model:`
+ * frontmatter directive is stripped so non-Claude marketplace consumers do
+ * not choke on `model: inherit` (Kilo: `Model not found: inherit/.`). Files
+ * that carry no `model:` line are copied byte-for-byte (copyFileSync), so the
+ * verbatim-copy guarantee still holds for everything else.
  */
 function copyDirRecursive(src, dest, relPrefix) {
   const written = [];
@@ -208,16 +215,30 @@ function copyDirRecursive(src, dest, relPrefix) {
   while (stack.length > 0) {
     const { s, d, rel } = stack.pop();
     fs.mkdirSync(d, { recursive: true });
-    const entries = fs.readdirSync(s);
+    // Use withFileTypes so dir/file classification comes from the single
+    // readdir syscall (the dirent), not a follow-up statSync — this collapses
+    // the check-then-use file race (CodeQL js/file-system-race) between the
+    // stat and the readFileSync/copyFileSync. Mirrors codex-plugin.cjs.
+    const entries = fs.readdirSync(s, { withFileTypes: true });
     for (const entry of entries) {
-      const sp = path.join(s, entry);
-      const dp = path.join(d, entry);
-      const relPath = rel ? `${rel}/${entry}` : entry;
-      const stat = fs.statSync(sp);
-      if (stat.isDirectory()) {
+      const name = entry.name;
+      const sp = path.join(s, name);
+      const dp = path.join(d, name);
+      const relPath = rel ? `${rel}/${name}` : name;
+      if (entry.isDirectory()) {
         stack.push({ s: sp, d: dp, rel: relPath });
-      } else if (stat.isFile()) {
-        fs.copyFileSync(sp, dp);
+      } else if (entry.isFile()) {
+        if (name === 'SKILL.md') {
+          const original = fs.readFileSync(sp, 'utf8');
+          const stripped = shared.stripModelFromFrontmatter(original);
+          if (stripped === original) {
+            fs.copyFileSync(sp, dp); // byte-exact, no re-encode
+          } else {
+            fs.writeFileSync(dp, stripped, 'utf8');
+          }
+        } else {
+          fs.copyFileSync(sp, dp);
+        }
         written.push(relPath);
       }
       // symlinks + other: ignored (skills tree is regular files only)

package/scripts/lib/install/converters/shared.cjs

@@ -101,6 +101,21 @@ const CODEX_TOOL_MAP = Object.freeze({
   WebFetch: 'shell',
 });
 
+// ---------------------------------------------------------------------------
+// MODEL_FIELD_RE — the Claude-only `model:` frontmatter key
+// ---------------------------------------------------------------------------
+
+/**
+ * Matches a `model:` frontmatter line (optional leading whitespace, exact key).
+ * The `model:` directive is Claude-Code-only: its values (`inherit`, or a
+ * Claude tier name `opus`/`sonnet`/`haiku`) are not valid model ids on any
+ * non-Claude runtime, whose command loaders parse the value as a literal
+ * `<provider>/<model>` and fail (Kilo: `Model not found: inherit/.`). Every
+ * converter that emits artifacts for a non-Claude consumer strips this line.
+ * Anchored to the exact key so `default-tier:` / `model-notes:` never match.
+ */
+const MODEL_FIELD_RE = /^\s*model\s*:/;
+
 // ---------------------------------------------------------------------------
 // extractFrontmatterAndBody — YAML frontmatter parser
 // ---------------------------------------------------------------------------
@@ -316,6 +331,10 @@ function ensureAdapterHeader(body, runtimeDisplay) {
  *     `gsd-` prefix on the existing name to avoid `gdd-gdd-`-style
  *     duplication). All other fields round-trip verbatim — we do NOT
  *     parse YAML; we operate on the raw text with a line-by-line scan.
+ *   - EXCEPTION: the Claude-Code-only `model:` line is dropped. Its
+ *     values (`inherit` / a Claude tier name) are invalid model ids on
+ *     non-Claude runtimes and crash their command loaders (Kilo:
+ *     `Model not found: inherit/.`). See the inline note below.
  *   - If the original has no `name:` field, prepend one.
  *
  * Returns a complete frontmatter string with leading/trailing `---`
@@ -339,8 +358,24 @@ function buildFrontmatter(originalFrontmatter, skillName, runtimePrefix) {
   }
 
   // Line-by-line rewrite of the `name:` field. We never touch description,
-  // tools, or any other field — they round-trip verbatim.
-  const lines = originalFrontmatter.split(/\r?\n/);
+  // tools, or any other field — they round-trip verbatim, with ONE
+  // exception: the Claude-Code-only `model:` directive is dropped.
+  //
+  // `model:` is a Claude harness directive ("defer to the session model" for
+  // `inherit`, or pin a Claude tier for `opus`/`sonnet`/`haiku`). None of
+  // those values are valid model ids on the non-Claude runtimes this
+  // converter targets. Kilo (and other command-runners) read the `model:`
+  // frontmatter and parse the value as a literal `<provider>/<model>` — so
+  // `model: inherit` becomes `inherit/` (empty model) and the command dies
+  // with `Model not found: inherit/.`. Cross-runtime model selection is the
+  // job of `default-tier`/`reasoning-class` + tier-resolver.cjs, NOT this
+  // per-command harness directive, so we strip the whole line here.
+  //
+  // `MODEL_FIELD_RE` matches only the exact `model` key — sibling keys like
+  // `model-notes:` or `default-tier:` are preserved.
+  const lines = originalFrontmatter
+    .split(/\r?\n/)
+    .filter((line) => !MODEL_FIELD_RE.test(line));
   let nameSeen = false;
   for (let i = 0; i < lines.length; i++) {
     const m = lines[i].match(/^(\s*name\s*:\s*)(.*)$/);
@@ -363,6 +398,41 @@ function buildFrontmatter(originalFrontmatter, skillName, runtimePrefix) {
   return '---\n' + lines.join('\n') + '\n---\n';
 }
 
+// ---------------------------------------------------------------------------
+// stripModelFromFrontmatter — drop the Claude-only `model:` line, keep body
+// ---------------------------------------------------------------------------
+
+/**
+ * Strip the Claude-only `model:` directive from a full SKILL.md string's
+ * frontmatter, leaving the body untouched.
+ *
+ * Used by the Tier-2 marketplace bundle emitters (codex-plugin.cjs,
+ * cursor-marketplace.cjs), which copy the `skills/` tree for non-Claude
+ * consumers. A verbatim copy would ship `model: inherit` and crash those
+ * consumers exactly as the Tier-1 file-drop path did before `buildFrontmatter`
+ * learned to drop it (Kilo: `Model not found: inherit/.`).
+ *
+ * Byte-preserving when there is nothing to strip: if `content` has no
+ * frontmatter, or the frontmatter carries no `model:` line, the ORIGINAL
+ * string is returned unchanged. Callers can therefore compare `stripped ===
+ * original` and fall back to a byte-exact `copyFileSync` for untouched files.
+ *
+ * The `model:` field is always a single-line scalar (`model: inherit`) in the
+ * GDD source set, so a line filter is sufficient — no block-scalar handling.
+ *
+ * @param {string} content  Full SKILL.md content (frontmatter + body).
+ * @returns {string}
+ */
+function stripModelFromFrontmatter(content) {
+  if (typeof content !== 'string' || content === '') return content;
+  const { frontmatter, body } = extractFrontmatterAndBody(content);
+  if (frontmatter == null) return content; // no frontmatter → nothing to strip
+  const lines = frontmatter.split(/\r?\n/);
+  const kept = lines.filter((line) => !MODEL_FIELD_RE.test(line));
+  if (kept.length === lines.length) return content; // no model line → unchanged
+  return '---\n' + kept.join('\n') + '\n---\n' + body;
+}
+
 // ---------------------------------------------------------------------------
 // Exports
 // ---------------------------------------------------------------------------
@@ -373,5 +443,7 @@ module.exports = {
   rewriteCodeFenceTools,
   ensureAdapterHeader,
   buildFrontmatter,
+  stripModelFromFrontmatter,
+  MODEL_FIELD_RE,
   CODEX_TOOL_MAP,
 };

package/scripts/lib/manifest/loader.cjs

@@ -31,20 +31,29 @@ function load(name, opts) {
   const fallback = Object.prototype.hasOwnProperty.call(o, 'fallback') ? o.fallback : {};
   const abs = path.join(dir, `${name}.json`);
 
-  let stat;
-  try { stat = fs.statSync(abs); } catch {
+  // Open once and operate on the file descriptor (fstat for the mtime-cache key,
+  // then read from the same fd). A single handle resolves the path exactly once,
+  // at open, so there is no statSync→readFileSync TOCTOU window.
+  let fd;
+  try { fd = fs.openSync(abs, 'r'); } catch {
     if (!o.quiet) process.stderr.write(`manifest: ${name}.json not found — using empty fallback (a consumer phase may not have shipped its data yet)\n`);
     return fallback;
   }
-  const cached = _cache.get(abs);
-  if (cached && cached.mtimeMs === stat.mtimeMs) return cached.data;
   try {
-    const data = JSON.parse(fs.readFileSync(abs, 'utf8'));
-    _cache.set(abs, { mtimeMs: stat.mtimeMs, data });
-    return data;
-  } catch (e) {
-    if (!o.quiet) process.stderr.write(`manifest: ${name}.json parse error (${e.message}) — using empty fallback\n`);
-    return fallback;
+    const stat = fs.fstatSync(fd);
+    const cached = _cache.get(abs);
+    if (cached && cached.mtimeMs === stat.mtimeMs) return cached.data;
+    const raw = fs.readFileSync(fd, 'utf8');
+    try {
+      const data = JSON.parse(raw);
+      _cache.set(abs, { mtimeMs: stat.mtimeMs, data });
+      return data;
+    } catch (e) {
+      if (!o.quiet) process.stderr.write(`manifest: ${name}.json parse error (${e.message}) — using empty fallback\n`);
+      return fallback;
+    }
+  } finally {
+    fs.closeSync(fd);
   }
 }
 

package/scripts/lib/reflector-kfm-proposer.cjs

@@ -425,11 +425,16 @@ function applyReject(draftPath, _options) {
  */
 function applyDefer(draftPath, options) {
   const opts = options || {};
-  if (!fs.existsSync(draftPath)) {
-    throw new Error(`KFM draft not found: ${draftPath}`);
-  }
   const deferredUntil = opts.deferredUntil || new Date(Date.now() + 30 * 86_400_000).toISOString().slice(0, 10);
-  const orig = fs.readFileSync(draftPath, 'utf8');
+  // Read directly and treat ENOENT as "draft not found" — avoids the
+  // existsSync→readFileSync TOCTOU race.
+  let orig;
+  try {
+    orig = fs.readFileSync(draftPath, 'utf8');
+  } catch (e) {
+    if (e.code === 'ENOENT') throw new Error(`KFM draft not found: ${draftPath}`);
+    throw e;
+  }
   let updated;
   if (/^deferred_until:/m.test(orig)) {
     updated = orig.replace(/^deferred_until:.*$/m, `deferred_until: ${deferredUntil}`);

package/scripts/lib/risk/tables.cjs

@@ -73,7 +73,7 @@ const FILE_SENSITIVITY = Object.freeze([
   // De-risking: tests + fixtures are low-stakes.
   { test: /(^|\/)(tests?|fixtures?|__tests__|__fixtures__)\//i, mult: 0.6, add: 0, label: 'test-or-fixture' },
   // De-risking: docs / markdown.
-  { test: /(^|\/)docs?\/|\.mdx?$/i, mult: 0.5, add: 0, label: 'docs' },
+  { test: /(?:(?:^|\/)docs?\/)|(?:\.mdx?$)/i, mult: 0.5, add: 0, label: 'docs' },
 ]);
 
 // ── Severity -> addend for destructive bash (via dangerous-patterns.cjs) ────

package/sdk/cli/index.js

@@ -5,11 +5,20 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)

package/sdk/mcp/gdd-mcp/server.js

@@ -7,7 +7,11 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name14 in all)
@@ -428,24 +432,30 @@ var require_loader = __commonJS({
       const dir = o.dir || MANIFEST_DIR;
       const fallback = Object.prototype.hasOwnProperty.call(o, "fallback") ? o.fallback : {};
       const abs = path.join(dir, `${name14}.json`);
-      let stat;
+      let fd;
       try {
-        stat = fs.statSync(abs);
+        fd = fs.openSync(abs, "r");
       } catch {
         if (!o.quiet) process.stderr.write(`manifest: ${name14}.json not found \u2014 using empty fallback (a consumer phase may not have shipped its data yet)
 `);
         return fallback;
       }
-      const cached = _cache.get(abs);
-      if (cached && cached.mtimeMs === stat.mtimeMs) return cached.data;
       try {
-        const data = JSON.parse(fs.readFileSync(abs, "utf8"));
-        _cache.set(abs, { mtimeMs: stat.mtimeMs, data });
-        return data;
-      } catch (e) {
-        if (!o.quiet) process.stderr.write(`manifest: ${name14}.json parse error (${e.message}) \u2014 using empty fallback
+        const stat = fs.fstatSync(fd);
+        const cached = _cache.get(abs);
+        if (cached && cached.mtimeMs === stat.mtimeMs) return cached.data;
+        const raw = fs.readFileSync(fd, "utf8");
+        try {
+          const data = JSON.parse(raw);
+          _cache.set(abs, { mtimeMs: stat.mtimeMs, data });
+          return data;
+        } catch (e) {
+          if (!o.quiet) process.stderr.write(`manifest: ${name14}.json parse error (${e.message}) \u2014 using empty fallback
 `);
-        return fallback;
+          return fallback;
+        }
+      } finally {
+        fs.closeSync(fd);
       }
     }
     module2.exports = { load: load2, reset, MANIFEST_DIR };