@opengsd/gsd-core 1.10.0 → 1.11.0

package/hooks/gsd-agent-isolation-guard.js

@@ -43,8 +43,9 @@
 // authoritative — `none`/`orchestrator-worktree` ALLOW immediately
 // (sequential/orchestrator-managed dispatch is legitimate, not a bug); an
 // absent/stale sentinel falls back to a conservative registry+config check
-// (GSD_RUNTIME env > .planning/config.json `runtime` — no confident signal
-// degrades to inert rather than guessing 'claude', see resolveRegistryIsolation)
+// (GSD_RUNTIME env > .planning/config.json `runtime` > the per-install
+// `.gsd-runtime` marker, #3566 — no confident signal degrades to inert rather
+// than guessing 'claude', see resolveRegistryIsolation)
 // gated additionally by `workflow.use_worktrees` — read directly, in-process,
 // no subprocess spawn.
 //
@@ -63,6 +64,15 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { readSentinel, VALID_ISOLATION, extractDispatchIdentifiers, sentinelAppliesToDispatch } = require('./lib/isolation-sentinel.js');
+const { REASON_CODE } = require('./lib/isolation-deny-reason.js');
+// #3582: gsd-core/bin/lib/*.cjs (runtime-name-policy.cjs, capability-registry.cjs
+// below) are tsc build artifacts (ADR-457), gitignored and absent on a raw
+// plugin-marketplace / git-clone install that never ran `npm run build:lib`.
+// Self-heal before the first such require (resolveRegistryIsolation, below) —
+// see ensureRuntimeBuild's own header for the full rationale. This module
+// itself (gsd-core/bin/ensure-runtime-build.cjs) depends on nothing under
+// ./lib, so requiring it here is always safe.
+const { ensureRuntimeBuild, RuntimeBuildError } = require('../gsd-core/bin/ensure-runtime-build.cjs');
 
 // No other executor-shaped subagent_type exists in agents/ today
 // (verified: only agents/gsd-executor.md). A Set, not a bare string compare,
@@ -85,6 +95,42 @@ function parseHarnessFlag(flag) {
   return { param: m[1], value: m[2] };
 }
 
+// ─── #3566: per-install runtime marker ────────────────────────────────────────
+// bin/install.js writes `<install>/gsd-core/.gsd-runtime` for EVERY runtime
+// install (#2297), co-located with VERSION. Unlike `~/.gsd/defaults.json` —
+// which is host-wide and names whichever runtime's install ran LAST, the exact
+// leakage #2840's config.cjs change exists to prevent — the marker describes
+// THIS install, which is the property runtime identity needs on a machine
+// with 2+ runtimes. Mirrors readInstallRuntimeMarker in src/model-resolver.cts
+// (same cache + test-seam shape); this hook cannot import that module without
+// dragging the whole model-resolution stack into a PreToolUse hot path, so the
+// 5-line read lives here against the same sibling-layout assumption the hook's
+// own require('../gsd-core/bin/lib/…') already makes. Epic #3473 B3 owns
+// consolidating every marker reader into one shared seam.
+let _installMarkerCache; // undefined = unread; null = known absent; string = value
+
+function readInstallRuntimeMarker() {
+  if (_installMarkerCache !== undefined) return _installMarkerCache;
+  try {
+    const markerPath = path.join(__dirname, '..', 'gsd-core', '.gsd-runtime');
+    const raw = fs.readFileSync(markerPath, 'utf-8').trim();
+    _installMarkerCache = raw || null;
+  } catch {
+    // No marker: dev/source tree, or an install predating #2297 — "no signal
+    // from this rung", never a resolution failure. Falls through to the
+    // defaults rung below.
+    _installMarkerCache = null;
+  }
+  return _installMarkerCache;
+}
+
+// Test seam for the marker rung (the dev/source tree has no marker file, so
+// the read always bottoms out at null there — same seam contract as
+// model-resolver.cts's _setInstallRuntimeMarkerForTests, #2297).
+function _setInstallRuntimeMarkerForTests(value) {
+  _installMarkerCache = value;
+}
+
 /**
  * Resolve this project's declared `runtime` identity WITHOUT defaulting to
  * 'claude' when no explicit signal exists (#3045 MAJOR 2).
@@ -100,9 +146,10 @@ function parseHarnessFlag(flag) {
  *
  * Returns `{ runtimeId, confident }`. `confident` is true only when an
  * explicit signal exists (GSD_RUNTIME env override, a `runtime` key literally
- * present in config.json, or a `runtime` persisted to `~/.gsd/defaults.json`
- * by the installer — see below); false means "cannot determine" and callers
- * must NOT silently substitute 'claude' — see resolveRegistryIsolation.
+ * present in config.json, the per-install `.gsd-runtime` marker, or a
+ * `runtime` persisted to `~/.gsd/defaults.json` by the installer — see
+ * below); false means "cannot determine" and callers must NOT silently
+ * substitute 'claude' — see resolveRegistryIsolation.
  *
  * #3045 BLOCKER 2 fix: precedence is GSD_RUNTIME env > config.json `runtime`
  * key > `~/.gsd/defaults.json` `runtime`. The first two are unchanged; the
@@ -117,6 +164,17 @@ function parseHarnessFlag(flag) {
  * (`nativeModelAliases` short-circuits it) and therefore correctly still rely
  * on config.json/env. Reading the installer's own persisted signal makes
  * "confident" the common case instead.
+ *
+ * #3566: the per-install `.gsd-runtime` marker now sits BETWEEN config.json
+ * and defaults.json. defaults.json is host-wide and names whichever runtime
+ * installed LAST — on a 2-runtime machine that confidently resolves the WRONG
+ * runtime (a Codex install's `runtime:"codex"` leaking into Claude projects),
+ * and when the wrong runtime declares no harnessIsolationFlag the guard goes
+ * silently inert. The marker describes THIS install (written for every
+ * runtime since #2297), which is the source #2840's config.cjs change names
+ * as correct. defaults.json stays as the final rung so single-runtime default
+ * installs and pre-#2297 installs (no marker on disk) keep the #3045
+ * BLOCKER 2 behavior.
  */
 function resolveRuntimeIdentity(cwd, configPath, resolveRuntimeNameFromCandidates) {
   const envRuntime = resolveRuntimeNameFromCandidates(process.env.GSD_RUNTIME);
@@ -132,6 +190,13 @@ function resolveRuntimeIdentity(cwd, configPath, resolveRuntimeNameFromCandidate
     if (configRuntime) return { runtimeId: configRuntime, confident: true };
   }
 
+  // #3566: the per-install marker, above the host-wide defaults — see the
+  // block comment on readInstallRuntimeMarker. An empty/whitespace-only file
+  // or an unknown value degrades exactly like the other rungs (no signal /
+  // future-runtime tolerance via resolveRuntimeNameFromCandidates).
+  const markerRuntime = resolveRuntimeNameFromCandidates(readInstallRuntimeMarker());
+  if (markerRuntime) return { runtimeId: markerRuntime, confident: true };
+
   // #3045 BLOCKER 2: fall back to the installer-persisted default. Read
   // defensively — an absent/corrupt/non-object defaults.json is "no signal",
   // never a resolution failure (this function only ever throws for the
@@ -183,6 +248,15 @@ function resolveHarnessFlag(runtimeId, runtimes) {
  * run, e.g. a manual Agent() call before any sentinel has been written).
  */
 function resolveRegistryIsolation(cwd, configPath) {
+  // #3582: self-heal the compiled runtime library BEFORE either require
+  // below — this is the only reaching path to both (resolveRegistryIsolation
+  // is the sole caller of each), so one call here covers both. Throws
+  // RuntimeBuildError on an unbuildable tree; the caller (resolveIsolationState)
+  // already wraps this whole function in try/catch and folds any error into
+  // its fail-closed `error` result — evaluateDispatch below distinguishes a
+  // RuntimeBuildError there so it surfaces this seam's actionable message
+  // instead of being misreported as an unreadable config.json (#3050 lesson).
+  ensureRuntimeBuild();
   const { resolveRuntimeNameFromCandidates } = require('../gsd-core/bin/lib/runtime-name-policy.cjs');
   const { runtimes } = require('../gsd-core/bin/lib/capability-registry.cjs');
 
@@ -360,13 +434,27 @@ function evaluateDispatch(data, { clock = Date } = {}) {
   if (!state.gsdProject) return { action: 'allow' };
 
   if (state.error) {
-    const reason =
-      `Agent isolation guard: could not read or resolve this project's dispatch-isolation ` +
-      `configuration ('.planning/config.json' under '${cwd}'). Refusing to dispatch ` +
-      `subagent_type="${subagentType}" without being able to verify whether isolation is ` +
-      `required — a guard that cannot verify must not answer "safe" (#3050). Retry once the ` +
-      `project configuration is readable.`;
-    return { action: 'block', reason };
+    // #3582: a missing/unbuildable compiled runtime library (RuntimeBuildError,
+    // thrown by ensureRuntimeBuild in resolveRegistryIsolation) is a DIFFERENT,
+    // actionable failure from an unreadable/unparsable config.json — surface
+    // its own message instead of misreporting it as the generic
+    // "could not read or resolve ... configuration" text (the exact #3050
+    // misreport this issue exists to fix). Both cases still fail closed
+    // (block); only the message differs.
+    const isBuildFailure = state.error instanceof RuntimeBuildError;
+    const reason = isBuildFailure
+      ? `Agent isolation guard: cannot resolve this project's dispatch-isolation ` +
+        `configuration because the GSD runtime library failed to self-build. ` +
+        `${state.error.message} Refusing to dispatch subagent_type="${subagentType}" until ` +
+        `the runtime library is built — a guard that cannot verify must not answer "safe" ` +
+        `(#3050).`
+      : `Agent isolation guard: could not read or resolve this project's dispatch-isolation ` +
+        `configuration ('.planning/config.json' under '${cwd}'). Refusing to dispatch ` +
+        `subagent_type="${subagentType}" without being able to verify whether isolation is ` +
+        `required — a guard that cannot verify must not answer "safe" (#3050). Retry once the ` +
+        `project configuration is readable.`;
+    const reasonCode = isBuildFailure ? REASON_CODE.RUNTIME_BUILD_FAILED : REASON_CODE.CONFIG_UNREADABLE;
+    return { action: 'block', reason, reasonCode };
   }
 
   if (state.isolation !== 'harness-worktree') return { action: 'allow' };
@@ -382,7 +470,7 @@ function evaluateDispatch(data, { clock = Date } = {}) {
     `${parsed.param}="${parsed.value}". Add ${parsed.param}="${parsed.value}" to the Agent() ` +
     `call so the executor runs in an isolated worktree instead of the primary checkout ` +
     `(gsd-core/workflows/execute-phase/steps/executor-isolation-dispatch.md).`;
-  return { action: 'block', reason };
+  return { action: 'block', reason, reasonCode: REASON_CODE.HARNESS_FLAG_MISSING };
 }
 
 /* istanbul ignore next -- stdin adapter, exercised via spawnSync in tests */
@@ -397,7 +485,7 @@ function main() {
       const data = JSON.parse(input);
       const decision = evaluateDispatch(data);
       if (decision.action === 'block') {
-        const out = { decision: 'block', reason: decision.reason };
+        const out = { decision: 'block', reason: decision.reason, reason_code: decision.reasonCode };
         process.stdout.write(JSON.stringify(out));
         // Kimi feeds stderr (not stdout) back to the model on exit 2.
         process.stderr.write(decision.reason);
@@ -425,4 +513,5 @@ module.exports = {
   resolveHarnessFlag,
   resolveRegistryIsolation,
   parseHarnessFlag,
+  _setInstallRuntimeMarkerForTests,
 };

package/hooks/gsd-check-update-worker.js

@@ -11,18 +11,61 @@
 
 const fs = require('fs');
 const path = require('path');
-const { isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs');
-// Latest-version lookup is delegated to the single deterministic adapter
-// (#498). checkLatestVersion() owns the npm-view call, the timeout/semver
-// policy, and the package name — sourced from the baked Package Identity seam.
-// The previous `require('../package.json').name` (#378) never yielded a name in
-// the installed tree — at the time it resolved to the synthetic
-// {"type":"commonjs"} marker GSD wrote at the config root, which has no `.name`,
-// so the background check never reported updates. Since #2544 GSD writes no
-// marker there at all, so that require would now fail to resolve outright.
-// Either way the name must come from the baked seam, never a walk-up.
-const { checkLatestVersion } = require('../gsd-core/bin/check-latest-version.cjs');
-const { PACKAGE_NAME } = require('../gsd-core/bin/lib/package-identity.cjs');
+
+// #3582: gsd-core/bin/lib/semver-compare.cjs and package-identity.cjs (and,
+// transitively, check-latest-version.cjs's own gsd-core/bin/lib/cli-exit.cjs
+// + shell-command-projection.cjs) are tsc build artifacts (ADR-457),
+// gitignored and absent on a raw plugin-marketplace / git-clone install that
+// never ran `npm run build:lib`. This worker is a DETACHED SessionStart
+// background process (spawned with stdio: 'ignore') — a build failure here
+// must DEGRADE to the no-signal fallbacks below (mirroring the
+// managed-hooks-registry.cjs degrade just below) so the worker still runs to
+// completion and writes a result cache record, rather than dying silently
+// with no visible signal and no cache-file write at all.
+//
+// This try/require/ensureRuntimeBuild/require/catch shape repeats (with
+// different destructured names) in hooks/gsd-check-update.js and
+// hooks/gsd-update-banner.js. It is deliberately NOT extracted into a shared
+// hooks/lib/ helper: scripts/lint-hooks-runtime-build-seam.cjs enforces this
+// exact seam textually, PER FILE — it greps each hooks/ file for its OWN
+// literal `require('.../ensure-runtime-build.cjs')` + `ensureRuntimeBuild(`
+// call co-occurring with its OWN literal `require('.../gsd-core/bin/lib/*.cjs')`.
+// A generic helper taking the compiled module's path as a variable would move
+// the literal compiled-lib require OUT of this file and into the helper,
+// called with a non-literal argument — the scan's regex (see that script's
+// "Known limitations") cannot see a require() called with a variable, so this
+// file would then read as "requires nothing" and the lint would stop
+// protecting it. A ceremony-only helper (just the ensureRuntimeBuild call,
+// each caller keeping its own literal compiled-lib require) fails the SAME
+// way from the other side: it would remove this file's own literal
+// `require('.../ensure-runtime-build.cjs')` + `ensureRuntimeBuild(` call,
+// which the lint also requires to be textually present in THIS file. Either
+// shape needs the lint script itself widened to special-case the helper,
+// which is a bigger, riskier change than the ~6 duplicated lines it would
+// save; kept inline instead.
+let isSemverNewer = () => false;
+let checkLatestVersion = () => ({ ok: false });
+let PACKAGE_NAME = null;
+try {
+  const { ensureRuntimeBuild } = require('../gsd-core/bin/ensure-runtime-build.cjs');
+  ensureRuntimeBuild();
+  ({ isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs'));
+  // Latest-version lookup is delegated to the single deterministic adapter
+  // (#498). checkLatestVersion() owns the npm-view call, the timeout/semver
+  // policy, and the package name — sourced from the baked Package Identity seam.
+  // The previous `require('../package.json').name` (#378) never yielded a name in
+  // the installed tree — at the time it resolved to the synthetic
+  // {"type":"commonjs"} marker GSD wrote at the config root, which has no `.name`,
+  // so the background check never reported updates. Since #2544 GSD writes no
+  // marker there at all, so that require would now fail to resolve outright.
+  // Either way the name must come from the baked seam, never a walk-up.
+  ({ checkLatestVersion } = require('../gsd-core/bin/check-latest-version.cjs'));
+  ({ PACKAGE_NAME } = require('../gsd-core/bin/lib/package-identity.cjs'));
+} catch (e) {
+  // Runtime library missing/broken and could not self-build — degrade to the
+  // no-signal fallbacks declared above; the worker still writes a result
+  // cache record (package_name: null, update_available: false).
+}
 // Authoritative list of managed hooks — shared with tests to retire source-grep
 // assertions (pending-migration-to-typed-ir [#455]).
 // NOTE: managed-hooks-registry.cjs must be in HOOKS_TO_COPY (scripts/build-hooks.js)
@@ -63,7 +106,7 @@ try {
 // (e.g., gsd-intel-*.js) must be ignored to avoid permanent stale warnings (#1750)
 // MANAGED_HOOKS is imported from ./managed-hooks-registry.cjs above.
 
-let staleHooks = [];
+const staleHooks = [];
 if (configDir) {
   // #3023: the bundle's directory name is runtime-descriptor-driven (pi stages
   // it as `gsd-hooks/`), so deriving it as `<configDir>/hooks` silently scanned

package/hooks/gsd-check-update.js

@@ -8,7 +8,25 @@ const path = require('path');
 const os = require('os');
 const { spawn } = require('child_process');
 
-const { updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
+// #3582: gsd-core/bin/lib/package-identity.cjs is a tsc build artifact
+// (ADR-457), gitignored and absent on a raw plugin-marketplace / git-clone
+// install that never ran `npm run build:lib`. This SessionStart hook must
+// DEGRADE (fall back to a generic cache filename) rather than crash session
+// start. gsd-check-update-worker.js — the process this hook spawns — degrades
+// identically and independently, so the shared fallback literal keeps the
+// cache path consistent between writer and reader even in the (rare)
+// doubly-degraded case. This try/require/ensureRuntimeBuild/require/catch
+// shape is deliberately duplicated (not extracted to hooks/lib/) — see
+// gsd-check-update-worker.js's identical #3582 comment for why.
+let updateCacheFileName = 'gsd-update-check.json';
+try {
+  const { ensureRuntimeBuild } = require('../gsd-core/bin/ensure-runtime-build.cjs');
+  ensureRuntimeBuild();
+  ({ updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs'));
+} catch (e) {
+  // Runtime library missing/broken and could not self-build — degrade to the
+  // fallback filename above rather than crash the SessionStart hook.
+}
 
 const homeDir = os.homedir();
 const cwd = process.cwd();

package/hooks/gsd-cursor-pre-tool.js

@@ -22,9 +22,6 @@
 
 'use strict';
 
-const fs = require('fs');
-const path = require('path');
-
 const WRITE_TOOL_RE = /write|edit|replace|create|delete|remove|append|apply|patch|insert|mkdir/i;
 const PATH_KEY_RE = /^(path|file|file_?path|filepath|target_?path|target|dir|directory|uri|filename)$/i;
 const PLANNING_PATH_RE = /(^|[\\/])\.planning([\\/]|$)/;

package/hooks/gsd-cursor-subagent-start.js

@@ -62,6 +62,15 @@ const os = require('os');
 // writeCursorHooksJson so the require always resolves post-install.
 const { resolveStatePath } = require('./lib/cursor-workspace.js');
 const { readSentinel, VALID_ISOLATION, extractDispatchIdentifiers, sentinelAppliesToDispatch } = require('./lib/isolation-sentinel.js');
+const { REASON_CODE } = require('./lib/isolation-deny-reason.js');
+// #3582: gsd-core/bin/lib/*.cjs (runtime-homes.cjs, worktree-safety.cjs,
+// runtime-name-policy.cjs, capability-registry.cjs — required below, inside
+// resolveIsolationEvidence and resolveFallbackIsolation) are tsc build
+// artifacts (ADR-457), gitignored and absent on a raw plugin-marketplace /
+// git-clone install that never ran `npm run build:lib`. Self-heal once, in
+// evaluateRootIsolation, before any of those four requires run — see the
+// call site below. This module itself depends on nothing under ./lib.
+const { ensureRuntimeBuild, RuntimeBuildError } = require('../gsd-core/bin/ensure-runtime-build.cjs');
 
 const MSG_PRESENT =
   'GSD: Subagent session started — review .planning/STATE.md for the current phase and any blockers before acting.';
@@ -333,6 +342,37 @@ function resolveIsolationDecision(data, { clock = Date, realpath = fs.realpathSy
   return { action: 'allow' };
 }
 
+// ─── #3566: per-install runtime marker ────────────────────────────────────────
+// Same contract as hooks/gsd-agent-isolation-guard.js's readInstallRuntimeMarker
+// (mirroring src/model-resolver.cts #2297): bin/install.js writes
+// `<install>/gsd-core/.gsd-runtime` beside VERSION for every runtime install;
+// this hook ships at `<install>/hooks/`, so the marker is the `gsd-core` sibling
+// of this file's own directory — the same sibling-layout assumption the
+// require('../gsd-core/bin/lib/…') calls below already make. Epic #3473 B3 owns
+// consolidating every marker reader into one shared seam.
+let _installMarkerCache; // undefined = unread; null = known absent; string = value
+
+function readInstallRuntimeMarker() {
+  if (_installMarkerCache !== undefined) return _installMarkerCache;
+  try {
+    const markerPath = path.join(__dirname, '..', 'gsd-core', '.gsd-runtime');
+    const raw = fs.readFileSync(markerPath, 'utf-8').trim();
+    _installMarkerCache = raw || null;
+  } catch {
+    // No marker: dev/source tree, or an install predating #2297 — "no signal
+    // from this rung", never a resolution failure.
+    _installMarkerCache = null;
+  }
+  return _installMarkerCache;
+}
+
+// Test seam — same contract as model-resolver.cts's #2297 seam; the dev/source
+// tree has no marker file, so spawned-hook tests (fresh process, no marker)
+// are unaffected.
+function _setInstallRuntimeMarkerForTests(value) {
+  _installMarkerCache = value;
+}
+
 /**
  * Conservative fallback resolution used when the #3045 sentinel is absent or
  * stale for `root`: re-derive isolation from the registry CAPABILITY, gated
@@ -355,7 +395,8 @@ function resolveIsolationDecision(data, { clock = Date, realpath = fs.realpathSy
  * otherwise legitimate dispatches, unlike `hooks/gsd-agent-isolation-guard.js`,
  * which degrades an undeterminable runtime to inert (#3045 MAJOR 2). Aligned
  * here: an explicit signal is now required — `GSD_RUNTIME` > config.json
- * `runtime` key > `~/.gsd/defaults.json` `runtime` (mirrors the Claude hook's
+ * `runtime` key > the per-install `.gsd-runtime` marker (#3566) >
+ * `~/.gsd/defaults.json` `runtime` (mirrors the Claude hook's
  * `resolveRuntimeIdentity`; `bin/install.js`'s `writeNonClaudeDefaults`
  * persists the installed runtime there for every non-Claude install,
  * including Cursor, so a REAL Cursor+GSD install still resolves confidently
@@ -372,6 +413,13 @@ function resolveFallbackIsolation(root, configPath) {
   if (!runtimeId && parsedConfig && typeof parsedConfig === 'object' && 'runtime' in parsedConfig) {
     runtimeId = resolveRuntimeNameFromCandidates(parsedConfig.runtime) || null;
   }
+  if (!runtimeId) {
+    // #3566: the per-install marker, above the host-wide defaults — same fix as
+    // hooks/gsd-agent-isolation-guard.js's resolveRuntimeIdentity. defaults.json
+    // is host-wide and names whichever runtime installed LAST (#2840's poison);
+    // the marker describes THIS install (written for every runtime since #2297).
+    runtimeId = resolveRuntimeNameFromCandidates(readInstallRuntimeMarker()) || null;
+  }
   if (!runtimeId) {
     try {
       const defaultsPath = path.join(os.homedir(), '.gsd', 'defaults.json');
@@ -419,6 +467,28 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
   }
   if (!isGsdProject) return { action: 'allow' };
 
+  // #3582: self-heal the compiled runtime library BEFORE any of its four
+  // downstream requires (resolveFallbackIsolation's two, resolveIsolationEvidence's
+  // two — reached only below this point). Checked separately from the
+  // sentinel/fallback try block below so a build failure surfaces its own
+  // actionable RuntimeBuildError message rather than being folded into the
+  // generic "could not read or resolve ... configuration" deny reason (the
+  // #3050 misreport this issue exists to fix). Still fails closed either way.
+  try {
+    ensureRuntimeBuild();
+  } catch (err) {
+    return {
+      action: 'deny',
+      reason:
+        `GSD subagent isolation guard: cannot resolve this project's dispatch-isolation ` +
+        `configuration because the GSD runtime library failed to self-build. ` +
+        `${err instanceof RuntimeBuildError ? err.message : String(err && err.message || err)} ` +
+        `Refusing to allow this subagent to spawn until the runtime library is built — a guard ` +
+        `that cannot verify must not answer "safe" (#3050).`,
+      reasonCode: REASON_CODE.RUNTIME_BUILD_FAILED,
+    };
+  }
+
   let declaredIsolation;
   try {
     // #3045 BLOCKER fix: a fresh sentinel is authoritative for THIS
@@ -439,6 +509,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `Refusing to allow this subagent to spawn without being able to verify whether ` +
         `isolation is required — a guard that cannot verify must not answer "safe" (#3050). ` +
         `Retry once the project configuration is readable.`,
+      reasonCode: REASON_CODE.CONFIG_UNREADABLE,
     };
   }
 
@@ -455,6 +526,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `"harness-worktree", but the subagentStart payload for this dispatch carries no usable ` +
         `subagent_type. Refusing to allow it to spawn without being able to confirm whether it ` +
         `is a GSD executor — a guard that cannot verify must not answer "safe" (#3050).`,
+      reasonCode: REASON_CODE.NO_SUBAGENT_TYPE,
     };
   }
 
@@ -471,6 +543,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `could not be determined (git did not respond). Refusing to allow subagent_type=` +
         `"${subagentType}" to spawn without being able to verify isolation — a guard that ` +
         `cannot verify must not answer "safe" (#3050). Retry once git is responsive.`,
+      reasonCode: REASON_CODE.CANNOT_DETERMINE_ISOLATION,
     };
   }
 
@@ -483,6 +556,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
       `directly, with no consent and no warning. Start an isolated session first (the ` +
       `"--worktree" CLI flag or the "/worktree" chat command; Cursor manages these worktrees ` +
       `under "~/.cursor/worktrees/") and retry.`,
+    reasonCode: REASON_CODE.NOT_ISOLATED_WORKTREE,
   };
 }
 
@@ -532,7 +606,7 @@ function main() {
         decision = { action: 'allow' };
       }
       if (decision.action === 'deny') {
-        const out = { permission: 'deny', user_message: decision.reason };
+        const out = { permission: 'deny', user_message: decision.reason, reason_code: decision.reasonCode };
         if (additionalContext !== null) out.additional_context = additionalContext;
         process.stdout.write(JSON.stringify(out));
         return;
@@ -557,4 +631,5 @@ module.exports = {
   resolveFallbackIsolation,
   resolveIsolationEvidence,
   getWorkspaceRoots,
+  _setInstallRuntimeMarkerForTests,
 };

package/hooks/gsd-cursor-subagent-stop.js

@@ -20,13 +20,14 @@
 
 'use strict';
 
-let raw = '';
 const stdinTimeout = setTimeout(() => {
   process.exit(0);
 }, 10000);
 
 process.stdin.setEncoding('utf8');
-process.stdin.on('data', (chunk) => { raw += chunk; });
+// Drain stdin (puts the stream into flowing mode so 'end' fires); the
+// payload itself is unused — this hook responds unconditionally.
+process.stdin.on('data', () => {});
 process.stdin.on('end', () => {
   clearTimeout(stdinTimeout);
   try {

package/hooks/gsd-prompt-guard.js

@@ -11,26 +11,14 @@
 // The goal is to surface suspicious content so the orchestrator can inspect it,
 // not to create false-positive deadlocks.
 
-const fs = require('fs');
 const path = require('path');
 
-// Prompt injection patterns (subset of security.cjs patterns, inlined for hook independence)
-const INJECTION_PATTERNS = [
-  /ignore\s+(all\s+)?previous\s+instructions/i,
-  /ignore\s+(all\s+)?above\s+instructions/i,
-  /disregard\s+(all\s+)?previous/i,
-  /forget\s+(all\s+)?(your\s+)?instructions/i,
-  /override\s+(system|previous)\s+(prompt|instructions)/i,
-  /you\s+are\s+now\s+(?:a|an|the)\s+/i,
-  /act\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
-  /pretend\s+(?:you(?:'re| are)\s+|to\s+be\s+)/i,
-  /from\s+now\s+on,?\s+you\s+(?:are|will|should|must)/i,
-  /(?:print|output|reveal|show|display|repeat)\s+(?:your\s+)?(?:system\s+)?(?:prompt|instructions)/i,
-  /<\/?(?:system|assistant|human)>/i,
-  /\[SYSTEM\]/i,
-  /\[INST\]/i,
-  /<<\s*SYS\s*>>/i,
-];
+// Prompt injection patterns — shared with gsd-read-injection-scanner.js via
+// hooks/lib/injection-patterns.js so the two surfaces cannot drift (#3504).
+// Deliberately a subset of security.cjs's set: hooks stay loadable without the
+// compiled lib tree. Staging of the lib helper is allowlisted in
+// GSD_HOOK_LIB_FILES (bin/install.js).
+const { INJECTION_PATTERNS } = require('./lib/injection-patterns.js');
 
 // #2304: Kimi's native hook bus delivers Kimi's tool vocabulary in the payload
 // (Write → WriteFile, Edit/MultiEdit → StrReplaceFile) while the [[hooks]]
@@ -153,8 +141,21 @@ process.stdin.on('end', () => {
       process.exit(0);
     }
 
-    // Get the content being written
-    const content = data.tool_input?.content || data.tool_input?.new_string || '';
+    // Get the content being written. #3504 (isolated review finding 3): the
+    // bare `||` chain handed a NON-STRING truthy `content` straight to
+    // pattern.test(), where ToString can throw ("Cannot convert object to a
+    // primitive value" for `{"toString": null}`) into the outer catch — the
+    // exact crash-to-allow class #2547/#2595 hardened inside
+    // normalizeKimiPayload, unreached on this read. Guarded selection: take
+    // the first field that is a string, or String-coerces without throwing,
+    // so a poisoned `content` no longer shadows a real `new_string`.
+    let content = '';
+    for (const candidate of [data.tool_input?.content, data.tool_input?.new_string]) {
+      if (typeof candidate === 'string' && candidate) { content = candidate; break; }
+      if (candidate && typeof candidate !== 'string') {
+        try { const s = String(candidate); if (s) { content = s; break; } } catch { /* keep looking */ }
+      }
+    }
     if (!content) {
       process.exit(0);
     }