@opengsd/gsd-core 1.11.0 → 1.12.0

package/gsd-core/bin/lib/verify.cjs

@@ -37,7 +37,7 @@ const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 const pattern_cjs_1 = require("./pattern.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- agent-install-check.cjs is an export= CommonJS module
 const agentInstallCheck = require("./agent-install-check.cjs");
-const { checkAgentsInstalled, checkCodexModelPosture } = agentInstallCheck;
+const { checkAgentsInstalled, checkCodexModelPosture, checkCodexSandboxPosture } = agentInstallCheck;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
 const { output, error } = ioMod;
@@ -56,7 +56,7 @@ const { SEVERITY: HEALTH_SEVERITY, REMEDY_ACTION, REMEDY_RISK, evaluateRules, ev
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- planning-snapshot.cjs is an export= CommonJS module
 const planningSnapshotMod = require("./planning-snapshot.cjs");
 const { buildPlanningSnapshot } = planningSnapshotMod;
-const { planningDir, planningRoot } = planningWorkspace;
+const { planningDir } = planningWorkspace;
 const { extractFrontmatter, parseMustHavesBlock } = frontmatterMod;
 const { readStateHeadFreshness } = stateMod;
 /**
@@ -262,15 +262,78 @@ function cmdVerifySummary(cwd, summaryPath, checkFileCount, raw) {
  * verify gate fails on the comment echo rather than a real regression. Conservative:
  * errors only on a confidently-extracted QUOTED literal; ambiguous (bareword) → warning.
  */
+/**
+ * Decode entity-escaped ampersands (& → &) — #3611. Planners emit
+ * <automated> bodies with `&amp;&amp;` as the chain operator (66 occurrences
+ * vs 0 literal in the reporting repo), and the executing agent reads the
+ * decoded (rendered) form. Every downstream scan — segment split,
+ * zero-comparison, literal harvest, echo matching — must operate on the same
+ * decoded text or a negative clause (`= 0`) poisons the literals of a
+ * POSITIVE clause (-ge 3) joined to it. Shared by both plan-discipline
+ * scanners so the two gates cannot drift apart again.
+ */
+function decodeEntityAmps(s) {
+    return s.replace(/&amp;/g, '&');
+}
+/**
+ * Split one shell line into &&/|| segments, QUOTE-AWARE (#3611 adversarial
+ * review): an operator inside a quoted literal (`grep -c 'a&&b'`) is part of
+ * the pattern, not a chain operator — a quote-blind split destroys the
+ * literal and silently disarms the gate for exactly the plans that spell
+ * patterns with ampersands. Backslash escapes count inside double quotes
+ * (POSIX single quotes have none, and over-staying a single-quoted span can
+ * only miss a split, never invent one).
+ */
+function splitShellSegments(line) {
+    const segments = [];
+    let current = '';
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (quote === "'") {
+            if (ch === "'")
+                quote = null;
+            current += ch;
+            continue;
+        }
+        if (quote === '"') {
+            if (ch === '\\') {
+                current += ch + (line[i + 1] ?? '');
+                i++;
+                continue;
+            }
+            if (ch === '"')
+                quote = null;
+            current += ch;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        if ((ch === '&' && line[i + 1] === '&') || (ch === '|' && line[i + 1] === '|')) {
+            segments.push(current.trim());
+            current = '';
+            i++;
+            continue;
+        }
+        current += ch;
+    }
+    segments.push(current.trim());
+    return segments.filter((s) => s !== '');
+}
 function scanNegativeGrepCommentEcho(content) {
     const errors = [];
     const warnings = [];
     // Normalize newlines; join backslash line-continuations so a verify command wrapped
     // across lines (grep ... \ <newline> == 0) is still seen as one segment.
-    const text = (content || '')
+    // #3611: decode entity-escaped ampersands (see decodeEntityAmps) so every
+    // downstream scan reads the same decoded text the executing agent reads.
+    const text = decodeEntityAmps((content || '')
         .replace(/\r\n/g, '\n')
         .replace(/\r/g, '\n')
-        .replace(/\\\n/g, ' ');
+        .replace(/\\\n/g, ' '));
     // 1. Allowlisted literals: <!-- planner-discipline-allow: LIT -->
     const allow = new Set();
     const allowRe = /<!--\s*planner-discipline-allow:\s*(.+?)\s*-->/g;
@@ -313,7 +376,7 @@ function scanNegativeGrepCommentEcho(content) {
     //    poisoning a negative gate (`== 0`) sharing the same physical line.
     const seenErr = new Set();
     const seenWarn = new Set();
-    const segments = text.split('\n').flatMap((line) => line.split(/\s*(?:&&|\|\|)\s*/));
+    const segments = text.split('\n').flatMap(splitShellSegments);
     for (const seg of segments) {
         if (!/grep(?:\s+-{1,2}[A-Za-z])/.test(seg) || !zeroCmp(seg))
             continue;
@@ -362,10 +425,13 @@ function scanNegativeGrepCommentEcho(content) {
 function scanFileWideNegativeGateConflict(content) {
     const warnings = [];
     // Normalize newlines; join backslash line-continuations (same as #429).
-    const text = (content || '')
+    // #3611: the SAME entity decode as the #429 scanner — the two gates share
+    // the caller and the input; a decode on one side only let an entity-escaped
+    // chain poison this detector's harvest exactly the same way.
+    const text = decodeEntityAmps((content || '')
         .replace(/\r\n/g, '\n')
         .replace(/\r/g, '\n')
-        .replace(/\\\n/g, ' ');
+        .replace(/\\\n/g, ' '));
     // Allowlisted patterns: <!-- planner-region-allow: PAT -->
     const allow = new Set();
     const allowRe = /<!--\s*planner-region-allow:\s*(.+?)\s*-->/g;
@@ -499,8 +565,8 @@ function scanFileWideNegativeGateConflict(content) {
     // For each task A, scan gate text for file-wide negative grep bans.
     for (let ai = 0; ai < tasks.length; ai++) {
         const taskA = tasks[ai];
-        // Split gate text into shell segments (split on && / || within lines).
-        const segments = taskA.gateText.split('\n').flatMap(line => line.split(/\s*(?:&&|\|\|)\s*/));
+        // Split gate text into shell segments (quote-aware, shared with #429 — #3611).
+        const segments = taskA.gateText.split('\n').flatMap(splitShellSegments);
         for (const seg of segments) {
             if (!/grep/.test(seg))
                 continue;
@@ -1242,30 +1308,6 @@ function cmdVerifyKeyLinks(cwd, planFilePath, raw) {
         links: results,
     }, raw, allVerified ? 'valid' : 'invalid');
 }
-function listMilestoneArchiveDirs(planBase) {
-    const milestonesDir = node_path_1.default.join(planBase, 'milestones');
-    try {
-        return node_fs_1.default
-            .readdirSync(milestonesDir, { withFileTypes: true })
-            .filter((e) => e.isDirectory() && validate_cjs_1.MILESTONE_ARCHIVE_DIR_RE.test(e.name))
-            .map((e) => node_path_1.default.join(milestonesDir, e.name))
-            .sort((a, b) => node_path_1.default.basename(a).localeCompare(node_path_1.default.basename(b), undefined, { numeric: true }));
-    }
-    catch (err) {
-        // #1883: distinguish genuine absence from a permission/I-O failure. ENOENT
-        // (no milestones/ dir yet) keeps the long-standing [] contract callers of
-        // this function depend on for "no archives"; every other error (EACCES,
-        // EIO, …) must propagate — otherwise an unreadable milestones/ dir is
-        // silently reported as "no archives" and archived-phase resolution
-        // misbehaves. As of Phase 12 (#3310), `cmdValidateConsistency`'s own
-        // caller of this function (`collectPhaseRoots` -> `getActiveMilestoneArchiveDir`)
-        // was migrated onto `buildPlanningSnapshot` and deleted; this function is
-        // retained solely for its `_listMilestoneArchiveDirs` test seam below.
-        if (err.code === 'ENOENT')
-            return [];
-        throw err;
-    }
-}
 /**
  * Wrapper-level fix-text table for `cmdValidateHealth`'s migrated
  * `HealthDiagnostic` -> `IssueEntry` mapping (Phase 11, #3309). Rules cannot
@@ -1397,8 +1439,10 @@ function cmdValidateHealth(cwd, options, raw) {
         }, raw);
         return;
     }
-    // rootBase always resolves to .planning/ (shared root — PROJECT.md, config.json live here)
-    const rootBase = planningRoot(cwd);
+    // rootBase resolves to the PROJECT-scoped planning root (`.planning[/<project>]`
+    // — PROJECT.md, config.json live here; #3749). Workstream-free by construction:
+    // planningDir(cwd, null) honors GSD_PROJECT and suppresses GSD_WORKSTREAM.
+    const rootBase = planningDir(cwd, null);
     const _slashRuntime = (0, runtime_slash_cjs_1.resolveRuntime)(cwd);
     const slash = (name) => (0, runtime_slash_cjs_1.formatGsdSlash)(name, _slashRuntime);
     // Second (and last) pre-check that stays OUTSIDE the rule table entirely
@@ -1523,6 +1567,21 @@ function cmdValidateAgents(cwd, raw) {
     // model or an orphaned reasoning-effort pin in a Codex agent .toml), not just
     // presence. checkAgentsInstalled above is untouched.
     const codexPosture = checkCodexModelPosture(runtime, cwd);
+    // #3897 rung 3 (ADR-3473 §8.3 criterion 3) — sibling posture check, additive
+    // alongside codex_posture (never nested inside it, never replacing it): a
+    // TOML's `sandbox_mode` disagreeing with its role's derived expectation is a
+    // different defect class than an Anthropic-flavored model. Same short-circuits,
+    // same read-only posture as checkCodexModelPosture above; checkAgentsInstalled
+    // and codex_posture are both left untouched.
+    //
+    // Failure semantics: matches the checkCodexModelPosture precedent exactly.
+    // Neither posture check makes `validate agents` exit non-zero on its own —
+    // both are report-only fields inspected by the caller (or a human) via the
+    // JSON payload. A `validate` verb whose two posture checks disagreed on
+    // fatality would be its own defect (#3897 dispatch note); this keeps them
+    // consistent rather than inventing new exit-code behavior for only one of
+    // the two siblings.
+    const sandboxPosture = checkCodexSandboxPosture(runtime, cwd);
     output({
         agents_dir: agentStatus.agents_dir,
         agents_found: agentStatus.agents_installed,
@@ -1531,6 +1590,7 @@ function cmdValidateAgents(cwd, raw) {
         incomplete: agentStatus.incomplete_agents,
         expected,
         codex_posture: codexPosture,
+        sandbox_posture: sandboxPosture,
     }, raw);
 }
 function cmdVerifySchemaDrift(cwd, phaseArg, skipFlag, raw) {
@@ -1765,9 +1825,4 @@ module.exports = {
     cmdVerifySchemaDrift,
     cmdVerifyCodebaseDrift,
     STATE_HEAD_ADVISORY_COMMITS,
-    // Test seam (#1883): listMilestoneArchiveDirs is private and exercised through
-    // the validate command, which runs in a subprocess — an fs monkeypatch in the
-    // test process cannot reach it. Exposed under a leading underscore so the
-    // permission-error path can be unit-tested directly (no chmod 0o000).
-    _listMilestoneArchiveDirs: listMilestoneArchiveDirs,
 };

package/gsd-core/bin/lib/workstream-name-policy.cjs

@@ -6,6 +6,24 @@
  * byte-for-behaviour from the prior hand-written .cjs; only types are added.
  *
  * Used by active-workstream-store.cjs, planning-workspace.cjs, workstream.cjs.
+ *
+ * #3883 (ADR-3473 §8.3): toWorkstreamSlug delegates to core-utils.cjs's
+ * generateSlugInternal (the canonical slug formula), passing `maxLen: null`
+ * to preserve this site's pre-migration untruncated contract — the 60-char
+ * default collided distinct >60-char workstream names onto the same slug
+ * (verified: `"a".repeat(60)+"alpha"` and `"a".repeat(60)+"beta"` truncated
+ * identically). core-utils.cjs already
+ * requires (transitively, at module-init time) THIS module:
+ * core-utils.cjs -> planning-workspace.cjs -> active-workstream-store.cjs ->
+ * workstream-name-policy.cjs. A top-level require of core-utils.cjs here
+ * would therefore close that cycle and — per this codebase's compiled-.cjs
+ * convention of a single `module.exports = {...}` reassignment at the bottom
+ * of core-utils.cjs — capture a stale, still-empty exports object forever
+ * (verified live: "generateSlugInternal is not a function" whichever module
+ * loads first). The require is deferred (lazy, inside toWorkstreamSlug's
+ * body) instead, mirroring the same cycle-break already used by
+ * core-utils.cts's own getPhaseFileStats/plan-scan.cjs seam and by
+ * phase-id.cts's toDir/getPhaseDirFromPhaseId.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.INVALID_ACTIVE_WORKSTREAM_NAME_MESSAGE = void 0;
@@ -68,10 +86,13 @@ function validateWorkstreamName(name) {
  * Lowercases, collapses non-alphanumeric runs to hyphens, strips leading/trailing hyphens.
  */
 function toWorkstreamSlug(name) {
-    return String(name ?? '')
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '');
+    // #3883 (ADR-3473 §8.3): delegate to the canonical slug formula
+    // (generateSlugInternal, core-utils.cts) rather than re-implementing it —
+    // this call site previously diverged from it (no transliteration, no
+    // 60-char truncation). Lazy require to break the core-utils.cjs cycle
+    // (see the module dependency doc comment above).
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
+    return require('./core-utils.cjs').generateSlugInternal(String(name ?? ''), null) ?? '';
 }
 /**
  * Returns true when `name` is a valid active workstream name:

package/gsd-core/bin/lib/worktree-base-ref.cjs

@@ -94,10 +94,13 @@ function parseJsonc(text) {
 }
 // ─── Message constants (verbatim — downstream docs/tests depend on these) ─────
 function buildMsgDiverged(headSha, forkRef, forkSha) {
-    return `⚠ Worktree base mismatch: HEAD (${shortSha(headSha)}) differs from ${forkRef} (${shortSha(forkSha)}). Running this phase sequentially on the main working tree. To keep parallel worktrees, set worktree.baseRef:"head" in .claude/settings.local.json (or run: gsd-tools worktree set-baseref). See #683.`;
+    return `⚠ Worktree base mismatch: HEAD (${shortSha(headSha)}) differs from ${forkRef} (${shortSha(forkSha)}). Running this phase sequentially on the main working tree. Parallel worktrees return once HEAD is merged/pushed so ${forkRef} matches it. (worktree.baseRef:"head" applies only where GSD itself creates the worktree — the runtime harness does not read it; #48, #3659.)`;
 }
-const MSG_UNKNOWN = `⚠ Cannot determine the worktree fork base (origin/HEAD unresolved). Running this phase sequentially on the main working tree to avoid a base mismatch. To keep parallel worktrees, set worktree.baseRef:"head" in .claude/settings.local.json (or run: gsd-tools worktree set-baseref). See #683.`;
-const MSG_HEAD_UNRESOLVABLE = `⚠ Cannot determine the worktree base (git rev-parse HEAD did not return a definitive answer). Running this phase sequentially on the main working tree to avoid an unverified base mismatch. Note: worktree.baseRef:"head" would silence this check without verifying the base — it skips the comparison rather than resolving it. Retry; if it persists, check for a stalled filesystem mount or a stale git index lock (.git/index.lock). See #683, #3050.`;
+const MSG_UNKNOWN = `⚠ Cannot determine the worktree fork base (origin/HEAD unresolved). Running this phase sequentially on the main working tree to avoid a base mismatch. Parallel worktrees return once origin/HEAD resolves and matches HEAD. See #683, #3659.`;
+function buildMsgBaserefHeadIgnored(headSha, forkRef, forkSha) {
+    return `⚠ Worktree base mismatch: worktree.baseRef:"head" is set, but the runtime harness does not honor it for isolated dispatch — the fork base stays ${forkRef} (${shortSha(forkSha)}) while HEAD is ${shortSha(headSha)} (#48; upstream claude-code#44965). Running this phase sequentially on the main working tree. Parallel worktrees return once HEAD is merged/pushed so ${forkRef} matches it, or on runtimes where GSD itself manages worktree creation. See #3659.`;
+}
+const MSG_HEAD_UNRESOLVABLE = `⚠ Cannot determine the worktree base (git rev-parse HEAD did not return a definitive answer). Running this phase sequentially on the main working tree to avoid an unverified base mismatch. Note: worktree.baseRef:"head" silences this check only where GSD itself creates the worktree (orchestrator-managed runtimes) — in harness mode it never applied (#48, #3659). Retry; if it persists, check for a stalled filesystem mount or a stale git index lock (.git/index.lock). See #683, #3050.`;
 /**
  * Returns true when an execGit result indicates the subprocess was killed by
  * a timeout. A timeout means the command genuinely could not complete — it
@@ -228,7 +231,20 @@ function resolveEffectiveBaseRef(claudeDir, deps, userClaudeDir) {
  * deps.userClaudeDir overrides the user/global config directory resolution
  * (default: getGlobalConfigDir('claude'), which honours CLAUDE_CONFIG_DIR).
  */
-function cmdWorktreeBaseCheck(cwd, _args, deps) {
+function cmdWorktreeBaseCheck(cwd, args, deps) {
+    // --mode threads the dispatch isolation mode through to the evaluation
+    // (#3659): 'harness-worktree' (default) or 'orchestrator-worktree'. Invalid
+    // or missing values after --mode fail closed — a silently defaulted typo
+    // would re-open the hole the flag exists to close.
+    let isolationMode = 'harness-worktree';
+    const modeIdx = args.indexOf('--mode');
+    if (modeIdx !== -1) {
+        const value = args[modeIdx + 1];
+        if (value !== 'harness-worktree' && value !== 'orchestrator-worktree') {
+            throw new Error(`worktree base-check: --mode must be harness-worktree or orchestrator-worktree, got ${JSON.stringify(value ?? null)}`);
+        }
+        isolationMode = value;
+    }
     const claudeDir = node_path_1.default.join(cwd, '.claude');
     const userClaudeDir = Object.prototype.hasOwnProperty.call(deps ?? {}, 'userClaudeDir')
         ? deps.userClaudeDir
@@ -238,8 +254,22 @@ function cmdWorktreeBaseCheck(cwd, _args, deps) {
         cwd,
         effectiveBaseRef,
         execGit: deps?.execGit,
+        isolationMode,
+    });
+    // Default emit goes through fs.writeSync(1, …), NOT process.stdout.write:
+    // the CLI's --pick capture intercepts writeSync, and command substitution
+    // is a pipe — via process.stdout.write a `$(gsd-tools … --pick x)` capture
+    // received the full JSON instead of the picked field, so the workflow
+    // auto-degrade guards never matched (#3659 review). Short-count loop per
+    // io.cjs writeAllSync's rationale (a non-blocking pipe can accept partial
+    // writes).
+    const write = deps?.write ?? ((s) => {
+        const buf = Buffer.from(s, 'utf8');
+        let offset = 0;
+        while (offset < buf.length) {
+            offset += node_fs_1.default.writeSync(1, buf, offset, buf.length - offset);
+        }
     });
-    const write = deps?.write ?? ((s) => process.stdout.write(s));
     write(JSON.stringify(result, null, 2) + '\n');
     return result;
 }
@@ -295,7 +325,20 @@ function cmdWorktreeSetBaseRef(cwd, _args, deps) {
         baseRef: 'head',
         file,
     };
-    const write = deps?.write ?? ((s) => process.stdout.write(s));
+    // Default emit goes through fs.writeSync(1, …), NOT process.stdout.write:
+    // the CLI's --pick capture intercepts writeSync, and command substitution
+    // is a pipe — via process.stdout.write a `$(gsd-tools … --pick x)` capture
+    // received the full JSON instead of the picked field, so the workflow
+    // auto-degrade guards never matched (#3659 review). Short-count loop per
+    // io.cjs writeAllSync's rationale (a non-blocking pipe can accept partial
+    // writes).
+    const write = deps?.write ?? ((s) => {
+        const buf = Buffer.from(s, 'utf8');
+        let offset = 0;
+        while (offset < buf.length) {
+            offset += node_fs_1.default.writeSync(1, buf, offset, buf.length - offset);
+        }
+    });
     write(JSON.stringify(output, null, 2) + '\n');
     return output;
 }
@@ -311,12 +354,19 @@ function evaluateWorktreeBaseDegrade(deps) {
     const execGit = deps?.execGit ?? shell_command_projection_cjs_1.execGit;
     const cwd = deps?.cwd;
     const cwdOpts = cwd ? { cwd } : {};
-    // a. If baseRef is explicitly 'head' the harness forks from HEAD — no mismatch possible.
-    // Claude Code's worktree.baseRef accepts only "fresh" (= origin/HEAD, the default) or "head".
-    // Therefore special-casing "head" here and otherwise comparing HEAD against origin/HEAD is
-    // complete: any non-"head" value (including "fresh" and absent/null) has fresh/origin-HEAD
-    // semantics and must be evaluated against origin/HEAD. (Reference: Claude Code worktrees docs, #683.)
-    if (deps?.effectiveBaseRef === 'head') {
+    // a. baseRef 'head' suppresses ONLY where GSD controls the fork start-point
+    // (#3659). The former unconditional suppress trusted the harness to honor the
+    // setting; #48 verified 5/5 that the Agent-isolation dispatch path never
+    // routes through project settings (upstream claude-code#44965), so in
+    // harness mode the fork base is always origin/HEAD and 'head' must fall
+    // through to the same comparison the fresh path runs. In
+    // orchestrator-worktree mode GSD itself runs `git worktree add <path>
+    // <start-point>` with the orchestrator HEAD — 'head' is honored by
+    // construction there and the suppress is correct. Any non-"head" value
+    // (including "fresh" and absent/null) has fresh/origin-HEAD semantics and is
+    // evaluated against origin/HEAD as before. (Reference: #683, #48, #3659.)
+    const headIgnoredByHarness = deps?.effectiveBaseRef === 'head';
+    if (headIgnoredByHarness && (deps?.isolationMode ?? 'harness-worktree') === 'orchestrator-worktree') {
         return { shouldDegrade: false, reason: 'baseref-head', message: null, headSha: null, forkRef: null, forkSha: null, headAbsenceVerified: null };
     }
     // b. Resolve HEAD sha.
@@ -389,6 +439,10 @@ function evaluateWorktreeBaseDegrade(deps) {
     if (forkSha === headSha) {
         return { shouldDegrade: false, reason: 'head-matches-fork', message: null, headSha, forkRef, forkSha, headAbsenceVerified: null };
     }
+    if (headIgnoredByHarness) {
+        const message = buildMsgBaserefHeadIgnored(headSha, forkRef, forkSha);
+        return { shouldDegrade: true, reason: 'baseref-head-ignored-by-harness', message, headSha, forkRef, forkSha, headAbsenceVerified: null };
+    }
     const message = buildMsgDiverged(headSha, forkRef, forkSha);
     return { shouldDegrade: true, reason: 'head-diverged-from-fork', message, headSha, forkRef, forkSha, headAbsenceVerified: null };
 }