@opengsd/gsd-core 1.10.0 → 1.11.0

package/hooks/dist/gsd-check-update.js

@@ -8,7 +8,25 @@ const path = require('path');
 const os = require('os');
 const { spawn } = require('child_process');
 
-const { updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
+// #3582: gsd-core/bin/lib/package-identity.cjs is a tsc build artifact
+// (ADR-457), gitignored and absent on a raw plugin-marketplace / git-clone
+// install that never ran `npm run build:lib`. This SessionStart hook must
+// DEGRADE (fall back to a generic cache filename) rather than crash session
+// start. gsd-check-update-worker.js — the process this hook spawns — degrades
+// identically and independently, so the shared fallback literal keeps the
+// cache path consistent between writer and reader even in the (rare)
+// doubly-degraded case. This try/require/ensureRuntimeBuild/require/catch
+// shape is deliberately duplicated (not extracted to hooks/lib/) — see
+// gsd-check-update-worker.js's identical #3582 comment for why.
+let updateCacheFileName = 'gsd-update-check.json';
+try {
+  const { ensureRuntimeBuild } = require('../gsd-core/bin/ensure-runtime-build.cjs');
+  ensureRuntimeBuild();
+  ({ updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs'));
+} catch (e) {
+  // Runtime library missing/broken and could not self-build — degrade to the
+  // fallback filename above rather than crash the SessionStart hook.
+}
 
 const homeDir = os.homedir();
 const cwd = process.cwd();

package/hooks/dist/gsd-cursor-pre-tool.js

@@ -22,9 +22,6 @@
 
 'use strict';
 
-const fs = require('fs');
-const path = require('path');
-
 const WRITE_TOOL_RE = /write|edit|replace|create|delete|remove|append|apply|patch|insert|mkdir/i;
 const PATH_KEY_RE = /^(path|file|file_?path|filepath|target_?path|target|dir|directory|uri|filename)$/i;
 const PLANNING_PATH_RE = /(^|[\\/])\.planning([\\/]|$)/;

package/hooks/dist/gsd-cursor-subagent-start.js

@@ -62,6 +62,15 @@ const os = require('os');
 // writeCursorHooksJson so the require always resolves post-install.
 const { resolveStatePath } = require('./lib/cursor-workspace.js');
 const { readSentinel, VALID_ISOLATION, extractDispatchIdentifiers, sentinelAppliesToDispatch } = require('./lib/isolation-sentinel.js');
+const { REASON_CODE } = require('./lib/isolation-deny-reason.js');
+// #3582: gsd-core/bin/lib/*.cjs (runtime-homes.cjs, worktree-safety.cjs,
+// runtime-name-policy.cjs, capability-registry.cjs — required below, inside
+// resolveIsolationEvidence and resolveFallbackIsolation) are tsc build
+// artifacts (ADR-457), gitignored and absent on a raw plugin-marketplace /
+// git-clone install that never ran `npm run build:lib`. Self-heal once, in
+// evaluateRootIsolation, before any of those four requires run — see the
+// call site below. This module itself depends on nothing under ./lib.
+const { ensureRuntimeBuild, RuntimeBuildError } = require('../gsd-core/bin/ensure-runtime-build.cjs');
 
 const MSG_PRESENT =
   'GSD: Subagent session started — review .planning/STATE.md for the current phase and any blockers before acting.';
@@ -333,6 +342,37 @@ function resolveIsolationDecision(data, { clock = Date, realpath = fs.realpathSy
   return { action: 'allow' };
 }
 
+// ─── #3566: per-install runtime marker ────────────────────────────────────────
+// Same contract as hooks/gsd-agent-isolation-guard.js's readInstallRuntimeMarker
+// (mirroring src/model-resolver.cts #2297): bin/install.js writes
+// `<install>/gsd-core/.gsd-runtime` beside VERSION for every runtime install;
+// this hook ships at `<install>/hooks/`, so the marker is the `gsd-core` sibling
+// of this file's own directory — the same sibling-layout assumption the
+// require('../gsd-core/bin/lib/…') calls below already make. Epic #3473 B3 owns
+// consolidating every marker reader into one shared seam.
+let _installMarkerCache; // undefined = unread; null = known absent; string = value
+
+function readInstallRuntimeMarker() {
+  if (_installMarkerCache !== undefined) return _installMarkerCache;
+  try {
+    const markerPath = path.join(__dirname, '..', 'gsd-core', '.gsd-runtime');
+    const raw = fs.readFileSync(markerPath, 'utf-8').trim();
+    _installMarkerCache = raw || null;
+  } catch {
+    // No marker: dev/source tree, or an install predating #2297 — "no signal
+    // from this rung", never a resolution failure.
+    _installMarkerCache = null;
+  }
+  return _installMarkerCache;
+}
+
+// Test seam — same contract as model-resolver.cts's #2297 seam; the dev/source
+// tree has no marker file, so spawned-hook tests (fresh process, no marker)
+// are unaffected.
+function _setInstallRuntimeMarkerForTests(value) {
+  _installMarkerCache = value;
+}
+
 /**
  * Conservative fallback resolution used when the #3045 sentinel is absent or
  * stale for `root`: re-derive isolation from the registry CAPABILITY, gated
@@ -355,7 +395,8 @@ function resolveIsolationDecision(data, { clock = Date, realpath = fs.realpathSy
  * otherwise legitimate dispatches, unlike `hooks/gsd-agent-isolation-guard.js`,
  * which degrades an undeterminable runtime to inert (#3045 MAJOR 2). Aligned
  * here: an explicit signal is now required — `GSD_RUNTIME` > config.json
- * `runtime` key > `~/.gsd/defaults.json` `runtime` (mirrors the Claude hook's
+ * `runtime` key > the per-install `.gsd-runtime` marker (#3566) >
+ * `~/.gsd/defaults.json` `runtime` (mirrors the Claude hook's
  * `resolveRuntimeIdentity`; `bin/install.js`'s `writeNonClaudeDefaults`
  * persists the installed runtime there for every non-Claude install,
  * including Cursor, so a REAL Cursor+GSD install still resolves confidently
@@ -372,6 +413,13 @@ function resolveFallbackIsolation(root, configPath) {
   if (!runtimeId && parsedConfig && typeof parsedConfig === 'object' && 'runtime' in parsedConfig) {
     runtimeId = resolveRuntimeNameFromCandidates(parsedConfig.runtime) || null;
   }
+  if (!runtimeId) {
+    // #3566: the per-install marker, above the host-wide defaults — same fix as
+    // hooks/gsd-agent-isolation-guard.js's resolveRuntimeIdentity. defaults.json
+    // is host-wide and names whichever runtime installed LAST (#2840's poison);
+    // the marker describes THIS install (written for every runtime since #2297).
+    runtimeId = resolveRuntimeNameFromCandidates(readInstallRuntimeMarker()) || null;
+  }
   if (!runtimeId) {
     try {
       const defaultsPath = path.join(os.homedir(), '.gsd', 'defaults.json');
@@ -419,6 +467,28 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
   }
   if (!isGsdProject) return { action: 'allow' };
 
+  // #3582: self-heal the compiled runtime library BEFORE any of its four
+  // downstream requires (resolveFallbackIsolation's two, resolveIsolationEvidence's
+  // two — reached only below this point). Checked separately from the
+  // sentinel/fallback try block below so a build failure surfaces its own
+  // actionable RuntimeBuildError message rather than being folded into the
+  // generic "could not read or resolve ... configuration" deny reason (the
+  // #3050 misreport this issue exists to fix). Still fails closed either way.
+  try {
+    ensureRuntimeBuild();
+  } catch (err) {
+    return {
+      action: 'deny',
+      reason:
+        `GSD subagent isolation guard: cannot resolve this project's dispatch-isolation ` +
+        `configuration because the GSD runtime library failed to self-build. ` +
+        `${err instanceof RuntimeBuildError ? err.message : String(err && err.message || err)} ` +
+        `Refusing to allow this subagent to spawn until the runtime library is built — a guard ` +
+        `that cannot verify must not answer "safe" (#3050).`,
+      reasonCode: REASON_CODE.RUNTIME_BUILD_FAILED,
+    };
+  }
+
   let declaredIsolation;
   try {
     // #3045 BLOCKER fix: a fresh sentinel is authoritative for THIS
@@ -439,6 +509,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `Refusing to allow this subagent to spawn without being able to verify whether ` +
         `isolation is required — a guard that cannot verify must not answer "safe" (#3050). ` +
         `Retry once the project configuration is readable.`,
+      reasonCode: REASON_CODE.CONFIG_UNREADABLE,
     };
   }
 
@@ -455,6 +526,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `"harness-worktree", but the subagentStart payload for this dispatch carries no usable ` +
         `subagent_type. Refusing to allow it to spawn without being able to confirm whether it ` +
         `is a GSD executor — a guard that cannot verify must not answer "safe" (#3050).`,
+      reasonCode: REASON_CODE.NO_SUBAGENT_TYPE,
     };
   }
 
@@ -471,6 +543,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `could not be determined (git did not respond). Refusing to allow subagent_type=` +
         `"${subagentType}" to spawn without being able to verify isolation — a guard that ` +
         `cannot verify must not answer "safe" (#3050). Retry once git is responsive.`,
+      reasonCode: REASON_CODE.CANNOT_DETERMINE_ISOLATION,
     };
   }
 
@@ -483,6 +556,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
       `directly, with no consent and no warning. Start an isolated session first (the ` +
       `"--worktree" CLI flag or the "/worktree" chat command; Cursor manages these worktrees ` +
       `under "~/.cursor/worktrees/") and retry.`,
+    reasonCode: REASON_CODE.NOT_ISOLATED_WORKTREE,
   };
 }
 
@@ -532,7 +606,7 @@ function main() {
         decision = { action: 'allow' };
       }
       if (decision.action === 'deny') {
-        const out = { permission: 'deny', user_message: decision.reason };
+        const out = { permission: 'deny', user_message: decision.reason, reason_code: decision.reasonCode };
         if (additionalContext !== null) out.additional_context = additionalContext;
         process.stdout.write(JSON.stringify(out));
         return;
@@ -557,4 +631,5 @@ module.exports = {
   resolveFallbackIsolation,
   resolveIsolationEvidence,
   getWorkspaceRoots,
+  _setInstallRuntimeMarkerForTests,
 };

package/hooks/dist/gsd-cursor-subagent-stop.js

@@ -20,13 +20,14 @@
 
 'use strict';
 
-let raw = '';
 const stdinTimeout = setTimeout(() => {
   process.exit(0);
 }, 10000);
 
 process.stdin.setEncoding('utf8');
-process.stdin.on('data', (chunk) => { raw += chunk; });
+// Drain stdin (puts the stream into flowing mode so 'end' fires); the
+// payload itself is unused — this hook responds unconditionally.
+process.stdin.on('data', () => {});
 process.stdin.on('end', () => {
   clearTimeout(stdinTimeout);
   try {

package/hooks/dist/gsd-prompt-guard.js

@@ -11,26 +11,14 @@
 // The goal is to surface suspicious content so the orchestrator can inspect it,
 // not to create false-positive deadlocks.
 
-const fs = require('fs');
 const path = require('path');
 
-// Prompt injection patterns (subset of security.cjs patterns, inlined for hook independence)
-const INJECTION_PATTERNS = [
-  /ignore\s+(all\s+)?previous\s+instructions/i,
-  /ignore\s+(all\s+)?above\s+instructions/i,
-  /disregard\s+(all\s+)?previous/i,
-  /forget\s+(all\s+)?(your\s+)?instructions/i,
-  /override\s+(system|previous)\s+(prompt|instructions)/i,
-  /you\s+are\s+now\s+(?:a|an|the)\s+/i,
-  /act\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
-  /pretend\s+(?:you(?:'re| are)\s+|to\s+be\s+)/i,
-  /from\s+now\s+on,?\s+you\s+(?:are|will|should|must)/i,
-  /(?:print|output|reveal|show|display|repeat)\s+(?:your\s+)?(?:system\s+)?(?:prompt|instructions)/i,
-  /<\/?(?:system|assistant|human)>/i,
-  /\[SYSTEM\]/i,
-  /\[INST\]/i,
-  /<<\s*SYS\s*>>/i,
-];
+// Prompt injection patterns — shared with gsd-read-injection-scanner.js via
+// hooks/lib/injection-patterns.js so the two surfaces cannot drift (#3504).
+// Deliberately a subset of security.cjs's set: hooks stay loadable without the
+// compiled lib tree. Staging of the lib helper is allowlisted in
+// GSD_HOOK_LIB_FILES (bin/install.js).
+const { INJECTION_PATTERNS } = require('./lib/injection-patterns.js');
 
 // #2304: Kimi's native hook bus delivers Kimi's tool vocabulary in the payload
 // (Write → WriteFile, Edit/MultiEdit → StrReplaceFile) while the [[hooks]]
@@ -153,8 +141,21 @@ process.stdin.on('end', () => {
       process.exit(0);
     }
 
-    // Get the content being written
-    const content = data.tool_input?.content || data.tool_input?.new_string || '';
+    // Get the content being written. #3504 (isolated review finding 3): the
+    // bare `||` chain handed a NON-STRING truthy `content` straight to
+    // pattern.test(), where ToString can throw ("Cannot convert object to a
+    // primitive value" for `{"toString": null}`) into the outer catch — the
+    // exact crash-to-allow class #2547/#2595 hardened inside
+    // normalizeKimiPayload, unreached on this read. Guarded selection: take
+    // the first field that is a string, or String-coerces without throwing,
+    // so a poisoned `content` no longer shadows a real `new_string`.
+    let content = '';
+    for (const candidate of [data.tool_input?.content, data.tool_input?.new_string]) {
+      if (typeof candidate === 'string' && candidate) { content = candidate; break; }
+      if (candidate && typeof candidate !== 'string') {
+        try { const s = String(candidate); if (s) { content = s; break; } } catch { /* keep looking */ }
+      }
+    }
     if (!content) {
       process.exit(0);
     }

package/hooks/dist/gsd-read-injection-scanner.js

@@ -72,23 +72,10 @@ const MARKDOWN_LINK_PATTERNS = [
   },
 ];
 
-// Standard injection patterns — mirrors gsd-prompt-guard.js, inlined for hook independence.
-const INJECTION_PATTERNS = [
-  /ignore\s+(all\s+)?previous\s+instructions/i,
-  /ignore\s+(all\s+)?above\s+instructions/i,
-  /disregard\s+(all\s+)?previous/i,
-  /forget\s+(all\s+)?(your\s+)?instructions/i,
-  /override\s+(system|previous)\s+(prompt|instructions)/i,
-  /you\s+are\s+now\s+(?:a|an|the)\s+/i,
-  /act\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
-  /pretend\s+(?:you(?:'re| are)\s+|to\s+be\s+)/i,
-  /from\s+now\s+on,?\s+you\s+(?:are|will|should|must)/i,
-  /(?:print|output|reveal|show|display|repeat)\s+(?:your\s+)?(?:system\s+)?(?:prompt|instructions)/i,
-  /<\/?(?:system|assistant|human)>/i,
-  /\[SYSTEM\]/i,
-  /\[INST\]/i,
-  /<<\s*SYS\s*>>/i,
-];
+// Standard injection patterns — shared with gsd-prompt-guard.js via
+// hooks/lib/injection-patterns.js so the two surfaces cannot drift (#3504).
+// Staging of the lib helper is allowlisted in GSD_HOOK_LIB_FILES (bin/install.js).
+const { INJECTION_PATTERNS } = require('./lib/injection-patterns.js');
 
 const ALL_PATTERNS = [...INJECTION_PATTERNS, ...SUMMARISATION_PATTERNS];
 
@@ -98,6 +85,16 @@ const ALL_PATTERNS = [...INJECTION_PATTERNS, ...SUMMARISATION_PATTERNS];
 // construction. Normalized to forward slashes to match `p` below.
 const OWN_BUNDLE_PREFIX = __dirname.replace(/\\/g, '/').replace(/\/+$/, '') + '/';
 
+// Synthetic rule ids for the finding classes that have no entry in
+// MARKDOWN_LINK_PATTERNS. Frozen and referenced from BOTH the push sites and
+// renderFinding so the two can never drift — a bare literal repeated at each
+// site is how a rename silently falls through to the generic render branch.
+const RULE_IDS = Object.freeze({
+  INJECTION_PATTERN: 'INJECTION-PATTERN',
+  INVISIBLE_UNICODE: 'INVISIBLE-UNICODE',
+  UNICODE_TAG_BLOCK: 'UNICODE-TAG-BLOCK',
+});
+
 function isExcludedPath(filePath) {
   const p = filePath.replace(/\\/g, '/');
   return (
@@ -267,12 +264,19 @@ process.stdin.on('end', () => {
       process.exit(0);
     }
 
+    // Typed findings IR — single source of truth for both the machine-readable
+    // `findings` array and the rendered advisory prose. Never build these as two
+    // parallel arrays: that invites the generative-fix-divergence defect class
+    // where the rendered text and the structured data silently drift apart.
     const findings = [];
 
     for (const pattern of ALL_PATTERNS) {
       if (pattern.test(content)) {
         // Trim pattern source for readable output
-        findings.push(pattern.source.replace(/\\s\+/g, '-').replace(/[()\\]/g, '').substring(0, 50));
+        findings.push({
+          ruleId: RULE_IDS.INJECTION_PATTERN,
+          match: pattern.source.replace(/\\s\+/g, '-').replace(/[()\\]/g, '').substring(0, 50),
+        });
       }
     }
 
@@ -284,19 +288,19 @@ process.stdin.on('end', () => {
         const m = line.match(entry.pattern);
         if (!m) continue;
         if (entry.safePredicate && entry.safePredicate(line)) continue;
-        findings.push(`${entry.ruleId}:${m[0].substring(0, 40)}`);
+        findings.push({ ruleId: entry.ruleId, match: m[0].substring(0, 40) });
       }
     }
 
     // Invisible Unicode (zero-width, RTL override, soft hyphen, BOM)
     if (/[\u200B-\u200F\u2028-\u202F\uFEFF\u00AD\u2060-\u2069]/.test(content)) {
-      findings.push('invisible-unicode');
+      findings.push({ ruleId: RULE_IDS.INVISIBLE_UNICODE, match: null });
     }
 
     // Unicode tag block U+E0000–E007F (invisible instruction injection vector)
     try {
       if (/[\u{E0000}-\u{E007F}]/u.test(content)) {
-        findings.push('unicode-tag-block');
+        findings.push({ ruleId: RULE_IDS.UNICODE_TAG_BLOCK, match: null });
       }
     } catch {
       // Engine does not support Unicode property escapes — skip this check
@@ -306,6 +310,16 @@ process.stdin.on('end', () => {
       process.exit(0);
     }
 
+    // Renders one finding back into the exact prose fragment the advisory has
+    // always embedded. Kept as the ONLY place that maps IR -> text, so the
+    // `additionalContext` string and the `findings` array can never diverge.
+    function renderFinding(f) {
+      if (f.ruleId === RULE_IDS.INVISIBLE_UNICODE) return 'invisible-unicode';
+      if (f.ruleId === RULE_IDS.UNICODE_TAG_BLOCK) return 'unicode-tag-block';
+      if (f.ruleId === RULE_IDS.INJECTION_PATTERN) return f.match;
+      return `${f.ruleId}:${f.match}`;
+    }
+
     const severity = findings.length >= 3 ? 'HIGH' : 'LOW';
     const label = toolName === 'Read' ? path.basename(source) : source;
     const detail = severity === 'HIGH'
@@ -313,7 +327,7 @@ process.stdin.on('end', () => {
       : 'Single pattern match may be a false positive (e.g., documentation). Proceed with awareness.';
     const advisory =
       `\u26a0\ufe0f INJECTION SCAN [${severity}] (${toolName}): "${label}" triggered ` +
-      `${findings.length} pattern(s): ${findings.join(', ')}. ` +
+      `${findings.length} pattern(s): ${findings.map(renderFinding).join(', ')}. ` +
       `This content is now in your conversation context. ${detail} Source: ${source}`;
 
     // Opt-in blocking: only when configured AND high-confidence
@@ -330,8 +344,8 @@ process.stdin.on('end', () => {
     const output = blocking
       ? { decision: 'block',
           reason: `Prompt-injection blocked (${toolName}). ${advisory}`,
-          hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: advisory } }
-      : { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: advisory } };
+          hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: advisory, findings } }
+      : { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: advisory, findings } };
 
     process.stdout.write(JSON.stringify(output));
   } catch {

package/hooks/dist/gsd-statusline.js

@@ -9,6 +9,24 @@ const os = require('os');
 // Namespace (not destructured) so tests can inject spawn failures by
 // monkeypatching childProcess.execFileSync.
 const childProcess = require('child_process');
+// #3582: gsd-core/bin/lib/*.cjs (semver-compare.cjs, state-document.cjs,
+// active-workstream-store.cjs, planning-workspace.cjs — required below) and
+// package-identity.cjs are tsc build artifacts (ADR-457), gitignored and
+// absent on a raw plugin-marketplace / git-clone install that never ran
+// `npm run build:lib`. The statusline renders on EVERY prompt, so a build
+// failure here must DEGRADE (print nothing, exit 0) rather than crash
+// Claude Code's per-render statusline hook. Scoped to the spawned-as-a-script
+// path (`require.main === module`) — a test `require()` of this module for
+// its pure helpers assumes a built tree, same as every other hook test.
+if (require.main === module) {
+  try {
+    const { ensureRuntimeBuild } = require('../gsd-core/bin/ensure-runtime-build.cjs');
+    ensureRuntimeBuild();
+  } catch (e) {
+    process.stdout.write('');
+    process.exit(0);
+  }
+}
 const { isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs');
 const { PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
 const { normalizeStateStatus } = require('../gsd-core/bin/lib/state-document.cjs');

package/hooks/dist/gsd-update-banner.js

@@ -15,7 +15,28 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
+
+// #3582: gsd-core/bin/lib/package-identity.cjs is a tsc build artifact
+// (ADR-457), gitignored and absent on a raw plugin-marketplace / git-clone
+// install that never ran `npm run build:lib`. This is an opt-in SessionStart
+// hook — a build failure here must DEGRADE, not crash session start. With
+// PACKAGE_NAME left null, buildBannerOutput's own lineage guard
+// (`!cache.package_name || cache.package_name !== PACKAGE_NAME`) always
+// treats the cache as untrusted, so main() falls through to its existing
+// silent "print nothing" path below — no separate degrade branch needed.
+// This try/require/ensureRuntimeBuild/require/catch shape is deliberately
+// duplicated (not extracted to hooks/lib/) — see
+// gsd-check-update-worker.js's identical #3582 comment for why.
+let PACKAGE_NAME = null;
+let updateCacheFileName = 'gsd-update-check.json';
+try {
+  const { ensureRuntimeBuild } = require('../gsd-core/bin/ensure-runtime-build.cjs');
+  ensureRuntimeBuild();
+  ({ PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs'));
+} catch (e) {
+  // Runtime library missing/broken and could not self-build — degrade to the
+  // fallbacks above rather than crash the SessionStart hook.
+}
 
 // Suppress repeat parse-error banners for 24 hours so a genuinely broken
 // cache file doesn't nag the user every session.