@hegemonart/get-design-done 1.60.3 → 1.60.4

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Get Design Done — 5-stage agent-orchestrated design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 agents, 96 skills, 39 connection integrations, two MCP servers, opt-in SQLite state backbone, bidirectional Figma write-back, and a reflector-driven self-improvement loop. Cross-runtime install for Claude Code, Codex, Cursor, OpenCode, Gemini, and more.",
-    "version": "1.60.3"
+    "version": "1.60.4"
   },
   "plugins": [
     {
       "name": "get-design-done",
       "source": "./",
       "description": "Agent-orchestrated 5-stage design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 specialized agents, 96 skills, 39 connection integrations (Figma, Refero, Preview, Storybook, Chromatic, Graphify, Linear, Jira, Notion, …), bidirectional Figma write-back, queryable intel store, opt-in SQLite state backbone, and a reflector-driven self-improvement loop. Two MCP servers (gdd-state for typed STATE mutators, gdd-mcp for 13 read-only project-priming tools), tier-aware routing with cost telemetry, and defense-in-depth hooks (protected paths, MCP circuit breaker, injection scanner, budget enforcer). Cross-runtime install for Claude Code, Codex, Cursor, OpenCode, Gemini, Copilot, and more.",
-      "version": "1.60.3",
+      "version": "1.60.4",
       "author": {
         "name": "hegemonart"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "get-design-done",
   "short_name": "gdd",
-  "version": "1.60.3",
+  "version": "1.60.4",
   "description": "Agent-orchestrated 5-stage design pipeline (Brief → Explore → Plan → Design → Verify) for AI coding agents. 64 specialized agents, 96 skills, 39 connection integrations (Figma, Refero, Preview, Storybook, Chromatic, Graphify, Linear, Jira, Notion, …), bidirectional Figma write-back, queryable intel store for O(1) design-surface lookups, opt-in SQLite state backbone, and a reflector-driven self-improvement loop. Two MCP servers (`gdd-state` for typed STATE mutators, `gdd-mcp` for 13 read-only project-priming tools), tier-aware agent routing with cost telemetry, defense-in-depth hooks (protected paths, MCP circuit breaker, injection scanner, budget enforcer), and a cross-runtime install layer for Claude Code, Codex, Cursor, OpenCode, Gemini, Copilot, and more.",
   "author": {
     "name": "hegemonart",

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to get-design-done are documented here. Versions follow [sem
 
 ---
 
+## [1.60.4] - 2026-07-06
+
+**Multi-runtime install fix (Tier-2 bundles)** - follow-up to 1.60.3. The same Claude-only `model:` frontmatter directive is now stripped from the Tier-2 marketplace distribution bundles, not just the Tier-1 file-drop command files.
+
+### Fixed
+
+- **`model:` frontmatter stripped from Tier-2 marketplace bundles** (`scripts/lib/install/converters/codex-plugin.cjs`, `scripts/lib/install/converters/cursor-marketplace.cjs`). These converters copied the `skills/` tree verbatim, so `model: inherit` still leaked into the Codex-plugin and Cursor-marketplace bundles and would crash non-Claude consumers exactly as the file-drop path did before 1.60.3 (`Model not found: inherit/.`). A new shared helper `stripModelFromFrontmatter` drops the `model:` line from each `SKILL.md` frontmatter during the copy; files that carry no `model:` line are still copied byte-for-byte, so the verbatim-copy guarantee holds for everything else. `buildFrontmatter` and the new helper share a single `MODEL_FIELD_RE` so the Tier-1 and Tier-2 paths strip identically. Regression coverage in `test/suite/converters/codex-plugin.test.cjs`, `test/suite/converters/cursor-marketplace.test.cjs`, and a `stripModelFromFrontmatter` unit in `test/suite/converters-wave4.test.cjs`.
+
+### Breaking changes
+
+None.
+
+5,148/5,148 tests pass.
+
+---
+
 ## [1.60.3] - 2026-07-06
 
 **Multi-runtime install fix** - the Claude-only `model:` frontmatter directive no longer leaks into the command files generated for non-Claude runtimes. Running any `/gdd-*` command on Kilo Code (Qwen) crashed with `Model not found: inherit/.` because the installer round-tripped `model: inherit` verbatim into the command file and Kilo parsed the value as a literal model id.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hegemonart/get-design-done",
-  "version": "1.60.3",
+  "version": "1.60.4",
   "description": "A design-quality pipeline for AI coding agents: brief, explore, plan, design, and verify UI work against your design system.",
   "author": "Hegemon",
   "homepage": "https://github.com/hegemonart/get-design-done",

package/scripts/lib/install/converters/codex-plugin.cjs

@@ -44,6 +44,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const shared = require('./shared.cjs');
 
 // Per research § Top-level fields: name, version, description are the only
 // strictly-required spec fields. All other manifest fields are optional.
@@ -112,6 +113,12 @@ function curateKeywords(arr) {
 /**
  * Copy a directory tree recursively. Vanilla fs only — no deps. Mirrors
  * the helper used by cursor-marketplace.cjs (Plan 28-8-B1).
+ *
+ * `SKILL.md` files are sanitized in transit: the Claude-only `model:`
+ * frontmatter directive is stripped so non-Claude marketplace consumers do
+ * not choke on `model: inherit` (Kilo: `Model not found: inherit/.`). Files
+ * that carry no `model:` line are copied byte-for-byte (copyFileSync), so the
+ * verbatim-copy guarantee still holds for everything else.
  */
 function copyDirRecursive(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
@@ -121,7 +128,17 @@ function copyDirRecursive(src, dest) {
     if (entry.isDirectory()) {
       copyDirRecursive(srcPath, destPath);
     } else if (entry.isFile()) {
-      fs.copyFileSync(srcPath, destPath);
+      if (entry.name === 'SKILL.md') {
+        const original = fs.readFileSync(srcPath, 'utf8');
+        const stripped = shared.stripModelFromFrontmatter(original);
+        if (stripped === original) {
+          fs.copyFileSync(srcPath, destPath); // byte-exact, no re-encode
+        } else {
+          fs.writeFileSync(destPath, stripped, 'utf8');
+        }
+      } else {
+        fs.copyFileSync(srcPath, destPath);
+      }
     }
     // symlinks + other: ignored (skills tree is regular files only).
   }

package/scripts/lib/install/converters/cursor-marketplace.cjs

@@ -34,6 +34,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const shared = require('./shared.cjs');
 
 // Curated keyword subset for Cursor's marketplace card display.
 // Per Wave A research § Schema Mapping `keywords` row: marketplace card
@@ -201,6 +202,12 @@ function buildManifest(sources, opts) {
 /**
  * Copy a directory tree recursively. Vanilla fs only — no deps.
  * Returns the list of relative paths written (relative to `dest`).
+ *
+ * `SKILL.md` files are sanitized in transit: the Claude-only `model:`
+ * frontmatter directive is stripped so non-Claude marketplace consumers do
+ * not choke on `model: inherit` (Kilo: `Model not found: inherit/.`). Files
+ * that carry no `model:` line are copied byte-for-byte (copyFileSync), so the
+ * verbatim-copy guarantee still holds for everything else.
  */
 function copyDirRecursive(src, dest, relPrefix) {
   const written = [];
@@ -208,16 +215,30 @@ function copyDirRecursive(src, dest, relPrefix) {
   while (stack.length > 0) {
     const { s, d, rel } = stack.pop();
     fs.mkdirSync(d, { recursive: true });
-    const entries = fs.readdirSync(s);
+    // Use withFileTypes so dir/file classification comes from the single
+    // readdir syscall (the dirent), not a follow-up statSync — this collapses
+    // the check-then-use file race (CodeQL js/file-system-race) between the
+    // stat and the readFileSync/copyFileSync. Mirrors codex-plugin.cjs.
+    const entries = fs.readdirSync(s, { withFileTypes: true });
     for (const entry of entries) {
-      const sp = path.join(s, entry);
-      const dp = path.join(d, entry);
-      const relPath = rel ? `${rel}/${entry}` : entry;
-      const stat = fs.statSync(sp);
-      if (stat.isDirectory()) {
+      const name = entry.name;
+      const sp = path.join(s, name);
+      const dp = path.join(d, name);
+      const relPath = rel ? `${rel}/${name}` : name;
+      if (entry.isDirectory()) {
         stack.push({ s: sp, d: dp, rel: relPath });
-      } else if (stat.isFile()) {
-        fs.copyFileSync(sp, dp);
+      } else if (entry.isFile()) {
+        if (name === 'SKILL.md') {
+          const original = fs.readFileSync(sp, 'utf8');
+          const stripped = shared.stripModelFromFrontmatter(original);
+          if (stripped === original) {
+            fs.copyFileSync(sp, dp); // byte-exact, no re-encode
+          } else {
+            fs.writeFileSync(dp, stripped, 'utf8');
+          }
+        } else {
+          fs.copyFileSync(sp, dp);
+        }
         written.push(relPath);
       }
       // symlinks + other: ignored (skills tree is regular files only)

package/scripts/lib/install/converters/shared.cjs

@@ -101,6 +101,21 @@ const CODEX_TOOL_MAP = Object.freeze({
   WebFetch: 'shell',
 });
 
+// ---------------------------------------------------------------------------
+// MODEL_FIELD_RE — the Claude-only `model:` frontmatter key
+// ---------------------------------------------------------------------------
+
+/**
+ * Matches a `model:` frontmatter line (optional leading whitespace, exact key).
+ * The `model:` directive is Claude-Code-only: its values (`inherit`, or a
+ * Claude tier name `opus`/`sonnet`/`haiku`) are not valid model ids on any
+ * non-Claude runtime, whose command loaders parse the value as a literal
+ * `<provider>/<model>` and fail (Kilo: `Model not found: inherit/.`). Every
+ * converter that emits artifacts for a non-Claude consumer strips this line.
+ * Anchored to the exact key so `default-tier:` / `model-notes:` never match.
+ */
+const MODEL_FIELD_RE = /^\s*model\s*:/;
+
 // ---------------------------------------------------------------------------
 // extractFrontmatterAndBody — YAML frontmatter parser
 // ---------------------------------------------------------------------------
@@ -356,11 +371,11 @@ function buildFrontmatter(originalFrontmatter, skillName, runtimePrefix) {
   // job of `default-tier`/`reasoning-class` + tier-resolver.cjs, NOT this
   // per-command harness directive, so we strip the whole line here.
   //
-  // The `^\s*model\s*:` anchor matches only the exact `model` key — sibling
-  // keys like `model-notes:` or `default-tier:` are preserved.
+  // `MODEL_FIELD_RE` matches only the exact `model` key — sibling keys like
+  // `model-notes:` or `default-tier:` are preserved.
   const lines = originalFrontmatter
     .split(/\r?\n/)
-    .filter((line) => !/^\s*model\s*:/.test(line));
+    .filter((line) => !MODEL_FIELD_RE.test(line));
   let nameSeen = false;
   for (let i = 0; i < lines.length; i++) {
     const m = lines[i].match(/^(\s*name\s*:\s*)(.*)$/);
@@ -383,6 +398,41 @@ function buildFrontmatter(originalFrontmatter, skillName, runtimePrefix) {
   return '---\n' + lines.join('\n') + '\n---\n';
 }
 
+// ---------------------------------------------------------------------------
+// stripModelFromFrontmatter — drop the Claude-only `model:` line, keep body
+// ---------------------------------------------------------------------------
+
+/**
+ * Strip the Claude-only `model:` directive from a full SKILL.md string's
+ * frontmatter, leaving the body untouched.
+ *
+ * Used by the Tier-2 marketplace bundle emitters (codex-plugin.cjs,
+ * cursor-marketplace.cjs), which copy the `skills/` tree for non-Claude
+ * consumers. A verbatim copy would ship `model: inherit` and crash those
+ * consumers exactly as the Tier-1 file-drop path did before `buildFrontmatter`
+ * learned to drop it (Kilo: `Model not found: inherit/.`).
+ *
+ * Byte-preserving when there is nothing to strip: if `content` has no
+ * frontmatter, or the frontmatter carries no `model:` line, the ORIGINAL
+ * string is returned unchanged. Callers can therefore compare `stripped ===
+ * original` and fall back to a byte-exact `copyFileSync` for untouched files.
+ *
+ * The `model:` field is always a single-line scalar (`model: inherit`) in the
+ * GDD source set, so a line filter is sufficient — no block-scalar handling.
+ *
+ * @param {string} content  Full SKILL.md content (frontmatter + body).
+ * @returns {string}
+ */
+function stripModelFromFrontmatter(content) {
+  if (typeof content !== 'string' || content === '') return content;
+  const { frontmatter, body } = extractFrontmatterAndBody(content);
+  if (frontmatter == null) return content; // no frontmatter → nothing to strip
+  const lines = frontmatter.split(/\r?\n/);
+  const kept = lines.filter((line) => !MODEL_FIELD_RE.test(line));
+  if (kept.length === lines.length) return content; // no model line → unchanged
+  return '---\n' + kept.join('\n') + '\n---\n' + body;
+}
+
 // ---------------------------------------------------------------------------
 // Exports
 // ---------------------------------------------------------------------------
@@ -393,5 +443,7 @@ module.exports = {
   rewriteCodeFenceTools,
   ensureAdapterHeader,
   buildFrontmatter,
+  stripModelFromFrontmatter,
+  MODEL_FIELD_RE,
   CODEX_TOOL_MAP,
 };