@opengsd/gsd-core 1.10.0 → 1.12.0

package/gsd-core/bin/lib/retired-artifact-cleanup.cjs

@@ -12,8 +12,13 @@
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+// #2874 (ADR-58 cleanup phase): pruneRetiredRuntimeArtifacts is the first
+// thing installRuntimeArtifacts calls, so its fs calls are routed through
+// the injectable seam too — see install-fs-adapter.cts's module doc.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const installFsAdapter = require("./install-fs-adapter.cjs");
+const { installFs } = installFsAdapter;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const installerMigrations = require("./installer-migrations.cjs");
 const external_descriptor_trust_cjs_1 = require("./external-descriptor-trust.cjs");
@@ -43,9 +48,9 @@ function pruneRetiredRuntimeArtifacts(runtime, configDir) {
         const destDir = node_path_1.default.resolve(configDir, destSubpath);
         let entries;
         try {
-            if (!node_fs_1.default.existsSync(destDir) || node_fs_1.default.lstatSync(destDir).isSymbolicLink())
+            if (!installFs().existsSync(destDir) || installFs().lstatSync(destDir).isSymbolicLink())
                 continue;
-            entries = node_fs_1.default.readdirSync(destDir, { withFileTypes: true });
+            entries = installFs().readdirSync(destDir, { withFileTypes: true });
         }
         catch {
             continue;
@@ -60,7 +65,7 @@ function pruneRetiredRuntimeArtifacts(runtime, configDir) {
                 continue;
             }
             try {
-                node_fs_1.default.unlinkSync(node_path_1.default.join(destDir, entry.name));
+                installFs().unlinkSync(node_path_1.default.join(destDir, entry.name));
                 result.removed.push(relPath);
             }
             catch {
@@ -68,8 +73,8 @@ function pruneRetiredRuntimeArtifacts(runtime, configDir) {
             }
         }
         try {
-            if (node_fs_1.default.readdirSync(destDir).length === 0)
-                node_fs_1.default.rmdirSync(destDir);
+            if (installFs().readdirSync(destDir).length === 0)
+                installFs().rmdirSync(destDir);
         }
         catch {
             // Non-empty, unreadable, or concurrently changed: preserve the directory.

package/gsd-core/bin/lib/review-lane-descriptor.cjs

@@ -111,7 +111,7 @@ exports.REVIEWER_LANES = Object.freeze([
         reviewsSection: 'Gemini',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.gemini',
         modelConfigKey: 'review.models.gemini',
         handler: null,
     },
@@ -128,13 +128,22 @@ exports.REVIEWER_LANES = Object.freeze([
             ...SPAWN_STDIN_STDOUT,
             modelArg: '--model',
             effortChannel: 'argv',
+            // #2483: without these the claude leg is the only reviewer that additionally inherits the
+            // invoking user's global CLAUDE.md, the project CLAUDE.md, and Claude Code auto-memory —
+            // a context asymmetry against the independent-review premise (gemini sees only the
+            // assembled prompt; codex runs --ephemeral). Both flags, not just the first: CLAUDE.md
+            // loading and auto-memory are independently-toggled mechanisms, and an environment
+            // exporting CLAUDE_CODE_DISABLE_AUTO_MEMORY=0 forces auto-memory back ON — the explicit
+            // pair is robust against that. Applies when /gsd:review runs from a non-Claude-Code host;
+            // inside Claude Code the claude lane self-skips for independence.
+            env: { CLAUDE_CODE_DISABLE_CLAUDE_MDS: '1', CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1' },
         },
         timeoutFloorMs: 1_200_000,
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'Claude',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.claude',
         modelConfigKey: 'review.models.claude',
         handler: null,
     },
@@ -162,7 +171,7 @@ exports.REVIEWER_LANES = Object.freeze([
         reviewsSection: 'Codex',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.codex',
         modelConfigKey: 'review.models.codex',
         handler: null,
     },
@@ -187,7 +196,7 @@ exports.REVIEWER_LANES = Object.freeze([
         reviewsSection: 'CodeRabbit',
         evidenceClass: 'diff-only',
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.coderabbit',
         // Accepts no model flag at all (review.md:367) — not merely "none configured".
         modelConfigKey: null,
         handler: null,
@@ -214,7 +223,7 @@ exports.REVIEWER_LANES = Object.freeze([
         // Phase 5b: the handler reconstructs from the JSON stream with JSON.parse, so `jq` — absent on
         // stock Windows/Git-Bash (#2589) — is no longer a prerequisite for this lane.
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.opencode',
         modelConfigKey: 'review.models.opencode',
         // Phase 5b (#2799): was `null`. The review is REBUILT from assistant `text` parts; a plain
         // stdout copy would write the raw JSON envelope as the review (#1936). See LaneHandler.
@@ -237,7 +246,7 @@ exports.REVIEWER_LANES = Object.freeze([
         reviewsSection: 'Qwen',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.qwen',
         modelConfigKey: null,
         handler: null,
     },
@@ -262,7 +271,7 @@ exports.REVIEWER_LANES = Object.freeze([
         reviewsSection: 'Cursor',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.cursor',
         modelConfigKey: null,
         handler: null,
     },
@@ -289,7 +298,7 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'source-grounded',
         // Phase 5b: the handler reads the transcript with JSON.parse per line, not `jq`.
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.antigravity',
         // NOT `review.models.antigravity` — the shipped key is `review.models.agy` (review.md:291) and
         // Phase 4 federated it under that name. This lane is why the key is declared, not derived.
         modelConfigKey: 'review.models.agy',
@@ -419,7 +428,7 @@ exports.REVIEWER_LANES = Object.freeze([
         reviewsSection: 'Kimi Code',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
-        promptBudgetKey: null,
+        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.kimi-code',
         modelConfigKey: 'review.models.kimi-code',
         handler: null,
     },
@@ -462,10 +471,10 @@ exports.REVIEWER_LANES = Object.freeze([
  *                   (`loadRegistry({ includeInstalled: true })`); only its
  *                   `capabilities` map is read. A cap contributes a lane iff it
  *                   carries an object `reviewer` body with a non-empty,
- *                   grammar-valid `slug`. The `role:"runtime"` legacy
- *                   `reviewerCli` alias contributes NO lane here — it has no lane
- *                   descriptor, and the selection roster (`deriveReviewerSlugs`)
- *                   is a separate surface.
+ *                   grammar-valid `slug`. The `role:"runtime"` `reviewerCli`
+ *                   alias never contributed a lane here, and as of #2801 it no
+ *                   longer contributes to the selection roster
+ *                   (`deriveReviewerSlugs`) either — the two surfaces now agree.
  * @returns A NEW array: first-party lanes (in order) followed by accepted overlay
  *          lanes (in registry iteration order). Callers must not mutate it.
  */

package/gsd-core/bin/lib/review-lane-invocation.cjs

@@ -24,6 +24,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LANE_UNAVAILABLE = void 0;
+exports.configString = configString;
 exports.normalizeHost = normalizeHost;
 exports.isEmptyReview = isEmptyReview;
 exports.fileRefPrompt = fileRefPrompt;
@@ -74,6 +75,9 @@ const KNOWN_HANDLERS = new Set(['antigravity', 'openai-compatible', 'opencode'])
  *
  * A non-string (number, bool, object, array) is NOT coerced. `String(0)` would put `"0"` into argv
  * as a model name; a wrong model silently reviewed is worse than no model override.
+ *
+ * Exported and shared with the runner's model-recovery arms (#2295) — "what counts as unset" has
+ * ONE source, so the plan resolver and the runner's recovered-model normalization cannot disagree.
  */
 function configString(raw) {
     if (typeof raw !== 'string')
@@ -212,6 +216,10 @@ function resolveLanePlan(input) {
         ? lane.timeoutFloorMs
         : 900_000;
     const emptyOutput = lane.emptyOutput === 'handler-owned' ? 'handler-owned' : 'stub-with-stderr';
+    // #3194: only an EXACT 'diff-only' declaration exempts a lane from evidence verification.
+    // Anything else — including a missing or garbage value on a third-party overlay body —
+    // resolves as 'source-grounded', so the runner verifies rather than trusts it.
+    const evidenceClass = lane.evidenceClass === 'diff-only' ? 'diff-only' : 'source-grounded';
     const requiresBinaries = Array.isArray(lane.requiresBinaries)
         ? lane.requiresBinaries.filter((b) => typeof b === 'string')
         : [];
@@ -255,6 +263,7 @@ function resolveLanePlan(input) {
                 errPath,
                 timeoutMs,
                 emptyOutput,
+                evidenceClass,
                 handler,
                 requiresBinaries,
                 probe: lane.probe,
@@ -325,6 +334,23 @@ function resolveLanePlan(input) {
             argv.push(token);
         }
     }
+    // Per-invocation env pairs (#2483). Own string-valued entries only — a non-string is dropped,
+    // never coerced, and prototype members never resolve (same lookup discipline as the argv
+    // expansions above). An empty or absent declaration resolves to `null`, so the runner has one
+    // shape to test.
+    let env = null;
+    const declaredEnv = inv.env;
+    if (declaredEnv !== null && typeof declaredEnv === 'object' && !Array.isArray(declaredEnv)) {
+        const source = declaredEnv;
+        const pairs = {};
+        for (const k of Object.keys(source)) {
+            const v = source[k];
+            if (typeof v === 'string')
+                pairs[k] = v;
+        }
+        if (Object.keys(pairs).length > 0)
+            env = pairs;
+    }
     return {
         ok: true,
         warnings,
@@ -333,6 +359,8 @@ function resolveLanePlan(input) {
             slug,
             binary,
             argv,
+            model: modelExpansion.length > 0 ? model : null,
+            effort: effortExpansion.length > 0 ? (configString(input.effortValue) ?? null) : null,
             stdin,
             promptPath,
             outputTarget,
@@ -340,9 +368,11 @@ function resolveLanePlan(input) {
             errPath,
             timeoutMs,
             emptyOutput,
+            evidenceClass,
             handler,
             requiresBinaries,
             probe: lane.probe,
+            env,
         },
     };
 }