@opengsd/gsd-core 1.10.0 → 1.11.0

package/gsd-core/bin/lib/runtime-homes.cjs

@@ -34,7 +34,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LEGACY_NON_REGISTRY_RUNTIME_IDS = void 0;
+exports.GSD_LOCATION_ENV_KEYS = exports.NON_REGISTRY_CONFIG_HOME_DESCRIPTORS = exports.KIMI_CODE_HOOKS_TOML_DESCRIPTOR = exports.KIMI_HOOKS_TOML_DESCRIPTOR = exports.LEGACY_NON_REGISTRY_RUNTIME_IDS = void 0;
 exports.isRegisteredRuntimeId = isRegisteredRuntimeId;
 exports.resolveConfigHomeFromDescriptor = resolveConfigHomeFromDescriptor;
 exports.resolveAntigravityGlobalDir = resolveAntigravityGlobalDir;
@@ -338,6 +338,72 @@ function resolveKimiGlobalDir(opts = {}) {
         probeExists: 'skills',
     }, { env, home, existsSync: existsSyncFn });
 }
+/**
+ * Kimi CLI's own native config.toml home. Hoisted out of resolveKimiHooksTomlDir
+ * so it is ENUMERABLE, not merely resolvable.
+ *
+ * #2665 round 3: a config-location var that lives only inside a function body is
+ * invisible to every consumer that needs the SET rather than the path — the test
+ * scrub list and the hermeticity guard both derive from descriptors, and this one
+ * reached neither. `kimi` is the sharp case precisely because it owns TWO config
+ * homes: KIMI_CONFIG_DIR (registry-visible, already covered) and KIMI_SHARE_DIR
+ * (this one), so a derivation keyed only on the registry looks complete and is not.
+ */
+exports.KIMI_HOOKS_TOML_DESCRIPTOR = {
+    kind: 'dot-home',
+    name: '.kimi',
+    env: ['KIMI_SHARE_DIR'],
+};
+/**
+ * Kimi Code's native config.toml home — the `kimi-code` counterpart of the
+ * descriptor above, hoisted for exactly the same reason.
+ *
+ * #2755 landed kimi-code hooks support on `next` while this PR was open, and
+ * declared this descriptor as an inline object literal inside
+ * resolveKimiHooksTomlDir's body — the same resolvable-but-not-enumerable shape
+ * round 3 hoisted KIMI_SHARE_DIR out of. Hoisting it puts `KIMI_CODE_HOME` into
+ * the derived scrub set and the hermeticity guard's watch roots in the SAME
+ * commit, which is the property NON_REGISTRY_CONFIG_HOME_DESCRIPTORS exists to
+ * guarantee. Each product's env var stays scoped to that product (#2755).
+ */
+exports.KIMI_CODE_HOOKS_TOML_DESCRIPTOR = {
+    kind: 'dot-home',
+    name: '.kimi-code',
+    env: ['KIMI_CODE_HOME'],
+};
+/**
+ * Config-home descriptors resolved OUTSIDE the capability registry.
+ *
+ * Anything added here is picked up by every derived consumer in the same commit —
+ * which is the property that makes the derivation structurally incapable of being
+ * narrower than the surface it guards. Adding a hardcoded resolver WITHOUT adding
+ * its descriptor here is the defect this array exists to make hard.
+ */
+exports.NON_REGISTRY_CONFIG_HOME_DESCRIPTORS = [
+    exports.KIMI_HOOKS_TOML_DESCRIPTOR,
+    exports.KIMI_CODE_HOOKS_TOML_DESCRIPTOR,
+];
+/**
+ * GSD's OWN location vars — a second family, not runtime configHomes.
+ *
+ * #2665 round 3: the registry describes where each *third-party runtime* keeps its
+ * config. It says nothing about where GSD keeps its own user-owned state, and that
+ * is a separate env-first surface:
+ *
+ *   GSD_HOME       — `process.env['GSD_HOME'] || os.homedir()`, the root of
+ *                    `$GSD_HOME/.gsd/` (consent.json, defaults.json, capability
+ *                    overlays). Read env-first by capability-loader, capability-consent,
+ *                    capability-state, capability-writer, config-loader, install-profiles
+ *                    and bin/install.js. A WRITE surface.
+ *   GSD_AGENTS_DIR — `if (process.env['GSD_AGENTS_DIR']) return it`, priority 1 in
+ *                    getAgentsDir. Misdirects a READ rather than a write, hence lower
+ *                    severity — but it is env-first and unconditional, so it belongs
+ *                    to the same class.
+ *
+ * Deliberately NOT folded into the descriptor array above: these do not resolve
+ * through resolveConfigHomeFromDescriptor and have no `kind`/`name` shape.
+ */
+exports.GSD_LOCATION_ENV_KEYS = ['GSD_HOME', 'GSD_AGENTS_DIR'];
 /**
  * Resolve the directory holding the Kimi product's OWN native config.toml —
  * the file that product itself reads for providers/models/hooks/etc, and the
@@ -375,8 +441,8 @@ function resolveKimiHooksTomlDir(opts = {}) {
     // value originates from argv, and an index would resolve inherited keys
     // (`constructor`, `__proto__`) to something that is not a descriptor.
     const descriptor = opts.runtime === 'kimi-code'
-        ? { kind: 'dot-home', name: '.kimi-code', env: ['KIMI_CODE_HOME'] }
-        : { kind: 'dot-home', name: '.kimi', env: ['KIMI_SHARE_DIR'] };
+        ? exports.KIMI_CODE_HOOKS_TOML_DESCRIPTOR
+        : exports.KIMI_HOOKS_TOML_DESCRIPTOR;
     return resolveConfigHomeFromDescriptor(descriptor, { env, home });
 }
 /**

package/gsd-core/bin/lib/runtime-hooks-surface.cjs

@@ -21,9 +21,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  * BEHAVIOR-PRESERVING RELOCATION: all logic is copied verbatim from
  * bin/install.js. No behavior change, no descriptor reads, no new IO.
  *
- * bin/install.js re-exports every symbol from this module so existing
- * consumers that do require('../bin/install.js').writeCursorHooksJson
- * (etc.) continue to work unchanged.
+ * #2876 (epic #2866 Phase 7): bin/install.js previously re-exported every
+ * symbol from this module, but a repo-wide audit found zero production
+ * consumers of those re-exports — no `require('../bin/install.js').
+ * writeCursorHooksJson` (or any sibling) exists outside a doc comment
+ * anywhere in the tree. The re-exports were test-suite-only pass-throughs;
+ * tests now require this module directly instead.
  */
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -488,6 +491,98 @@ function rewriteLegacyManagedNodeHookCommands(settings, absoluteRunner, opts) {
     }
     return changed;
 }
+// ---------------------------------------------------------------------------
+// Shared: reconcileManagedShellHookCommands (#3329)
+// ---------------------------------------------------------------------------
+/**
+ * Rewrite already-registered managed `.sh` hook `command` strings to the shape
+ * the current installer would generate (#3329).
+ *
+ * applySettingsJsonHooks registers the four `.sh` managed hooks only-if-absent,
+ * so an entry registered by an older installer keeps its old command forever —
+ * `/gsd-update` (which re-invokes the installer) never re-derived it. On
+ * Claude/win32 that left the pre-#580/#3393 bash-runner-prefixed commands
+ * (`bash "<script>.sh"`, `"<git>/bash.exe" "<script>.sh"`) in place, spawning a
+ * nested bash on every hook fire. The #2979 rewriter above cannot help: it is
+ * Node-only by design (its basename gate contains only `.js` filenames).
+ *
+ * Scoping / safety:
+ * - Inert unless `shellHookOmitsBashRunner({ platform, runtime, isShellHook:
+ *   true })` — the exact combination whose correct command shape changed. Where
+ *   the bash runner is still correct (non-Windows, non-claude), nothing is
+ *   rewritten, so the reconcile cannot churn unrelated installs.
+ * - Only entries whose parsed script token's basename exactly equals one of the
+ *   expected managed `.sh` filenames are touched. A user hook would have to
+ *   live at a path ending in exactly `gsd-session-state.sh` etc. — i.e. the
+ *   GSD-installed file — to match. Extra-token commands (env prefixes, extra
+ *   args) and args-form launcher entries (#976) never match the strict
+ *   `[runner ]<script>` two-token shape and are left alone.
+ * - A null/empty expected command disables rewriting for that hook (a
+ *   bash-runner-unavailable install must not have its entry nulled).
+ *
+ * @param settings settings.json-shaped object; mutated in place
+ * @param expected map of managed `.sh` filename → the command this install
+ *   would register today (from buildHookCommand / buildLocalShellHookCommand)
+ * @param opts platform/runtime override (default: current process)
+ * @returns true when any command was rewritten
+ */
+function reconcileManagedShellHookCommands(settings, expected, opts) {
+    if (!settings || !settings.hooks || !expected)
+        return false;
+    if (!opts)
+        opts = {};
+    const platform = opts.platform || process.platform;
+    const runtime = opts.runtime || 'generic';
+    if (!shellHookOmitsBashRunner({ platform, runtime, isShellHook: true }))
+        return false;
+    const expectedByBasename = new Map();
+    for (const [hookFile, command] of Object.entries(expected)) {
+        if (typeof command === 'string' && command.length > 0) {
+            expectedByBasename.set(hookFile, command);
+        }
+    }
+    if (expectedByBasename.size === 0)
+        return false;
+    let changed = false;
+    for (const entries of Object.values(settings.hooks)) {
+        if (!Array.isArray(entries))
+            continue;
+        for (const entry of entries) {
+            if (!entry || !Array.isArray(entry.hooks))
+                continue;
+            for (const h of entry.hooks) {
+                if (!h || typeof h.command !== 'string')
+                    continue;
+                if (Array.isArray(h.args) && h.args.length > 0)
+                    continue;
+                let trimmed = h.command.trim();
+                const hadPowerShellCallOperator = platform === 'win32' && /^&\s+/.test(trimmed);
+                if (hadPowerShellCallOperator) {
+                    trimmed = trimmed.replace(/^&\s+/, '').trim();
+                }
+                // Strict `[runner ]<script>` shape: an optional single runner token
+                // (bare, 'single-quoted', or "double-quoted") followed by the script
+                // token. Anything else (env prefixes, extra flags, pipelines) does not
+                // match and is left untouched.
+                const m = trimmed.match(/^(?:(?:"([^"]+)"|'([^']+)'|(\S+))\s+)?(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/);
+                if (!m)
+                    continue;
+                const scriptToken = m[4] || m[5] || m[6] || '';
+                if (!scriptToken)
+                    continue;
+                const basename = shellCmdProjection.posixNormalize(scriptToken).split('/').pop() || '';
+                const expectedCommand = expectedByBasename.get(basename);
+                if (!expectedCommand)
+                    continue;
+                if (h.command === expectedCommand)
+                    continue;
+                h.command = expectedCommand;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
 function buildCodexHookBlock(targetDir, opts) {
     const absoluteRunner = opts && opts.absoluteRunner;
     if (!absoluteRunner)
@@ -1764,6 +1859,22 @@ function applySettingsJsonHooks(settings, opts) {
         else if (!hasPhaseBoundaryHook && !phaseBoundaryCommand) {
             console.warn(`  ${yellow}⚠${reset}  Skipped phase boundary hook — Bash executable path unavailable (#3393)`);
         }
+        // #3329: the four `.sh` sites above register only-if-absent, so an entry
+        // registered by an older installer keeps its old command forever —
+        // /gsd-update (which re-invokes the installer) never re-derived it. On
+        // Claude/win32 that left the pre-#580/#3393 bash-runner-prefixed commands
+        // in settings.json indefinitely. Reconcile existing managed `.sh` entries
+        // to the command this install would generate today. Inert wherever the
+        // bash runner is still the correct shape; scoped to exact managed
+        // basenames so user-authored hooks are never touched.
+        if (reconcileManagedShellHookCommands(settings, {
+            'gsd-validate-commit.sh': validateCommitCommand,
+            'gsd-graphify-update.sh': graphifyUpdateCommand,
+            'gsd-session-state.sh': sessionStateCommand,
+            'gsd-phase-boundary.sh': phaseBoundaryCommand,
+        }, { platform: hookOpts.platform, runtime })) {
+            console.log(`  ${green}✓${reset} Reconciled managed .sh hook commands to current format (#3329)`);
+        }
         // ── Extended hook events: SubagentStop / Stop / PreCompact / SubagentStart
         //    (#788 + #770 + #2092) ────────────────────────────────────────────────
         // Claude Code (since #770) and Qwen Code (since #788) both support the
@@ -2195,6 +2306,7 @@ module.exports = {
     applySettingsJsonHooks,
     referencesHook,
     rewriteLegacyManagedNodeHookCommands,
+    reconcileManagedShellHookCommands,
     normalizeNodePath,
     resolveNodeRunner,
     resolveBashRunner,

package/gsd-core/bin/lib/runtime-name-policy.cjs

@@ -193,7 +193,9 @@ exports.NO_LOCAL_CONFIG_DIR_SENTINEL = '(no-local-config-dir)';
  * Pure runtime-identity projection. Relocated from `bin/install.js` per
  * ADR-1508 (epic #1507, #1510 Phase 1) so the Runtime Artifact Conversion
  * Module's rewrite engine can consume it without importing the installer.
- * `bin/install.js` re-exports this same function for back-compat.
+ * Consumers import it from here. `bin/install.js` used to re-export it for
+ * back-compat; that re-export was retired in #2876, once an audit found the
+ * compatibility spine had no production consumer at all.
  */
 function getDirName(runtime) {
     if (!runtime)

package/gsd-core/bin/lib/runtime-slash.cjs

@@ -29,6 +29,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatGsdSlash = formatGsdSlash;
+exports.resolveExplicitRuntime = resolveExplicitRuntime;
 exports.resolveRuntime = resolveRuntime;
 exports.formatGsdSlashFor = formatGsdSlashFor;
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -75,19 +76,21 @@ function formatGsdSlash(commandName, runtime) {
     return `/gsd-${token}${tail}`;
 }
 /**
- * Resolve the effective runtime for a project directory.
+ * Resolve the explicit runtime for a project directory, from the two
+ * explicit sources only — no default is applied.
  *
- *   process.env.GSD_RUNTIME  >  config.runtime  >  'claude'
+ *   env.GSD_RUNTIME  >  config.runtime  >  null
  *
- * Mirrors the precedence already used by profile-output.cjs and the rest of
- * the runtime resolution chain. Returns a lowercased string so downstream
- * comparisons can be case-blind.
+ * Returns null when neither explicit source is set, so a caller can
+ * distinguish "config said claude" from "nothing was set" (needed by
+ * #3245's host-detection rung, which must only run when this returns null).
  *
  * @param projectDir - path to the project directory, or null/undefined
- * @returns the resolved runtime name
+ * @param env - environment variables to read GSD_RUNTIME from; defaults to process.env
+ * @returns the resolved runtime name, or null if neither source is set
  */
-function resolveRuntime(projectDir) {
-    const envRuntime = (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(process.env['GSD_RUNTIME']);
+function resolveExplicitRuntime(projectDir, env = process.env) {
+    const envRuntime = (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(env['GSD_RUNTIME']);
     if (envRuntime)
         return envRuntime;
     if (projectDir) {
@@ -113,7 +116,22 @@ function resolveRuntime(projectDir) {
             // runtime output formatting.
         }
     }
-    return 'claude';
+    return null;
+}
+/**
+ * Resolve the effective runtime for a project directory.
+ *
+ *   process.env.GSD_RUNTIME  >  config.runtime  >  'claude'
+ *
+ * Mirrors the precedence already used by profile-output.cjs and the rest of
+ * the runtime resolution chain. Returns a lowercased string so downstream
+ * comparisons can be case-blind.
+ *
+ * @param projectDir - path to the project directory, or null/undefined
+ * @returns the resolved runtime name
+ */
+function resolveRuntime(projectDir) {
+    return resolveExplicitRuntime(projectDir) ?? 'claude';
 }
 /**
  * Convenience: format using the runtime resolved from a project directory.

package/gsd-core/bin/lib/security.cjs

@@ -29,6 +29,7 @@ exports.requireSafePath = requireSafePath;
 exports.scanForInjection = scanForInjection;
 exports.sanitizeForPrompt = sanitizeForPrompt;
 exports.sanitizeForDisplay = sanitizeForDisplay;
+exports.sanitizeLabel = sanitizeLabel;
 exports.validateShellArg = validateShellArg;
 exports.safeJsonParse = safeJsonParse;
 exports.validatePhaseNumber = validatePhaseNumber;
@@ -73,13 +74,52 @@ function validatePath(filePath, baseDir, opts = {}) {
         resolvedPath = node_fs_1.default.realpathSync(resolvedPath);
     }
     catch {
-        const parentDir = node_path_1.default.dirname(resolvedPath);
+        // realpathSync failed — either resolvedPath doesn't exist at all, or it's
+        // a dangling symlink (the link itself exists but its target doesn't).
+        // lstat (unlike stat/realpath) stats the link itself and does NOT follow
+        // it, so it succeeds for a dangling symlink and throws ENOENT for a
+        // genuinely absent path. That's the discriminator: without it, a dangling
+        // symlink to a non-existent OUTSIDE path would fall through to the
+        // parent-resolution fallback below and be re-accepted as an in-project
+        // path, while a symlink to an EXISTING outside path is correctly
+        // rejected via the realpathSync success branch above — a state
+        // difference an attacker can use as an existence oracle for arbitrary
+        // absolute paths.
         try {
-            const realParent = node_fs_1.default.realpathSync(parentDir);
-            resolvedPath = node_path_1.default.join(realParent, node_path_1.default.basename(resolvedPath));
+            if (node_fs_1.default.lstatSync(resolvedPath).isSymbolicLink()) {
+                return { safe: false, resolved: '', error: 'Path is an unresolvable symbolic link' };
+            }
         }
         catch {
-            // Parent doesn't exist either — keep the resolved path as-is
+            // lstat also threw — resolvedPath (and its would-be link) genuinely
+            // doesn't exist. Fall through to ancestor resolution below.
+        }
+        // Walk up to the nearest ancestor that exists and realpath THAT, then
+        // re-append the remaining (not-yet-created) segments. This canonicalizes
+        // resolvedPath the same way resolvedBase was canonicalized above,
+        // regardless of how many leading directories are missing — a single
+        // parent-only check would leave resolvedPath un-canonicalized whenever
+        // the parent is also missing, which breaks the startsWith comparison
+        // below on any non-canonical cwd (e.g. macOS /var/... vs
+        // /private/var/...).
+        let ancestor = node_path_1.default.dirname(resolvedPath);
+        const remainder = [node_path_1.default.basename(resolvedPath)];
+        for (;;) {
+            try {
+                const realAncestor = node_fs_1.default.realpathSync(ancestor);
+                resolvedPath = node_path_1.default.join(realAncestor, ...remainder);
+                break;
+            }
+            catch {
+                const parent = node_path_1.default.dirname(ancestor);
+                if (parent === ancestor) {
+                    // Reached filesystem root without finding an existing ancestor —
+                    // keep resolvedPath as-is.
+                    break;
+                }
+                remainder.unshift(node_path_1.default.basename(ancestor));
+                ancestor = parent;
+            }
         }
     }
     const normalizedBase = resolvedBase + node_path_1.default.sep;
@@ -193,7 +233,7 @@ exports.INJECTION_PATTERNS = [
     /override\s+(system|previous)\s+(prompt|instructions)/i,
     // Role/identity manipulation
     /you\s+are\s+now\s+(?:a|an|the)\s+/i,
-    /act\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
+    /\bact\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
     /pretend\s+(?:you(?:'re| are)\s+|to\s+be\s+)/i,
     /from\s+now\s+on,?\s+you\s+(?:are|will|should|must)/i,
     // System prompt extraction
@@ -349,6 +389,65 @@ function sanitizeForDisplay(text) {
         .join('\n');
     return sanitized;
 }
+/**
+ * Sanitize a value that must render as a SINGLE LINE and is derived from a
+ * filesystem name (a phase directory's number/name token, an archived
+ * milestone label, a bare filename) — not from file/frontmatter CONTENT.
+ *
+ * Why this is NOT `sanitizeForDisplay`: that helper's job is multi-line
+ * prose — it strips whole protocol-leak LINES while deliberately preserving
+ * `\n` between legitimate ones (see its docstring and
+ * `tests/security.test.cjs`'s neighbouring describe). A filesystem name is
+ * the opposite shape: it is supposed to be one line, so a `\n`/`\r` inside
+ * one is never legitimate content to preserve — it is an attacker (or a
+ * doctored checkout) using the directory NAME itself as the injection
+ * vector. #3458's reproduction: a phase directory literally named
+ *   `zz\n0 open items require decisions.\n\x1b[2K\x1b[1G FORGED`
+ * flows verbatim into `audit-open`'s human report (the phase-number
+ * fallback taken when the name doesn't match `PHASE_NUMBER_TOKEN_SOURCE`).
+ * `sanitizeForDisplay` would pass every one of those bytes straight through
+ * — by design, since it never touches control characters — so the embedded
+ * `\n` becomes a real newline in the report, printing a forged
+ * "0 open items require decisions." as its own line, and the raw ESC bytes
+ * reach the terminal.
+ *
+ * This helper closes that hole by ESCAPING (never silently stripping) the
+ * C0 control range (0x00–0x1F, including ESC 0x1B, CR, LF), DEL (0x7F), and
+ * the C1 range (0x80–0x9F) into a visible representation (`\n`, `\x1b`,
+ * ...). Escaping rather than stripping is deliberate: a reviewer reading the
+ * report should be able to SEE that a name was doctored, not have it quietly
+ * normalized away as if nothing happened. Every other character — including
+ * all ordinary printable and non-ASCII text — passes through byte-identical.
+ */
+function sanitizeLabel(text) {
+    if (!text || typeof text !== 'string')
+        return text;
+    const NAMED_ESCAPES = {
+        0x00: '\\0',
+        0x07: '\\a',
+        0x08: '\\b',
+        0x09: '\\t',
+        0x0a: '\\n',
+        0x0b: '\\v',
+        0x0c: '\\f',
+        0x0d: '\\r',
+        0x1b: '\\x1b',
+    };
+    let out = '';
+    for (const ch of text) {
+        const code = ch.codePointAt(0);
+        const isC0 = code <= 0x1f;
+        const isDel = code === 0x7f;
+        const isC1 = code >= 0x80 && code <= 0x9f;
+        if (isC0 || isDel || isC1) {
+            out += NAMED_ESCAPES[code] ?? `\\x${code.toString(16).padStart(2, '0')}`;
+        }
+        else {
+            out += ch;
+        }
+    }
+    return out;
+}
 // ─── Shell Safety ───────────────────────────────────────────────────────────────────────
 /**
  * Validate that a string is safe to use as a shell argument when quoted.