@opengsd/gsd-core 1.11.0 → 1.12.0

package/hooks/dist/lib/git-probe.js

@@ -0,0 +1,84 @@
+'use strict';
+// hooks/lib/git-probe.js — classify a bounded spawnSync(git, ...) result,
+// distinguishing a GENUINE negative answer (git ran and said "no") from
+// "could not determine" (timeout / spawn failure / signal kill) — #3911.
+//
+// Proven defect: hooks/gsd-worktree-path-guard.js, hooks/gsd-workflow-guard.js,
+// and hooks/gsd-windsurf-pre-write.js each treat spawnSync(git, ..., {timeout})
+// returning a non-zero/empty result as "not applicable" and allow silently.
+// A macOS CI run showed three deny cases land at 2084ms/2112ms/2177ms — just
+// past the 2000ms budget — each returning exit 0 with EMPTY stdout AND EMPTY
+// stderr: a timeout is INDISTINGUISHABLE, at the call site, from git cleanly
+// answering "not a repo" / "not this worktree" unless the spawnSync() result
+// itself is inspected for `error`/`signal`, not just `status`/`stdout`.
+//
+// This module does not change any hook's decision or exit code — it only
+// answers "was this probe's answer real?" so a caller can emit a diagnostic
+// on the undetermined branch while keeping the existing fail-open behavior.
+//
+// Classification mirrors tests/helpers/process-seam.cjs's OUTCOME vocabulary
+// (EXITED vs TIMED_OUT/SPAWN_FAILED/KILLED) — same evidence-over-classification
+// ordering (a populated `status` outranks an attached `error`, since Node can
+// report `error.code === 'ETIMEDOUT'` on a result that also carried a real
+// exit that beat the timer) — so a probe here and a subprocess outcome in the
+// test suite never disagree on the same raw spawnSync() shape.
+
+/**
+ * @param {{error?: (Error & {code?: string})|null, status: number|null, signal: string|null}} result
+ *   the raw return value of `spawnSync('git', ...)`.
+ * @returns {{determined: true} | {determined: false, reason: string}}
+ */
+function classifyGitProbe(result) {
+  const error = result && result.error;
+  const status = result ? result.status : null;
+  const signal = result ? result.signal : null;
+
+  if (!error && signal === null) {
+    // A real exit — status 0 or non-zero is a genuine, trustworthy answer.
+    return { determined: true };
+  }
+  if (status !== null) {
+    // `status` is only ever populated by a real exit; it outranks an attached
+    // `error` even at the exact timeout boundary (process-seam.cjs's own
+    // "evidence over classification" rule).
+    return { determined: true };
+  }
+
+  const code = error ? (error.code ?? null) : null;
+  let reason;
+  if (code === 'ETIMEDOUT' || signal !== null) {
+    reason = signal ? `timed out (signal ${signal})` : 'timed out';
+  } else if (code) {
+    reason = `spawn failed (${code})`;
+  } else {
+    reason = 'could not run (unknown reason)';
+  }
+  return { determined: false, reason };
+}
+
+/**
+ * If `result` could not be determined (timeout / spawn failure / signal
+ * kill), write a stderr diagnostic naming the probe and why — never changes
+ * any exit code, never throws. A no-op when the probe genuinely ran and
+ * answered (status 0 or non-zero with no error/signal).
+ *
+ * @param {string} hookName - e.g. 'gsd-worktree-path-guard'
+ * @param {string} probeLabel - e.g. "git rev-parse --show-toplevel"
+ * @param {*} result - the raw spawnSync() return value
+ */
+function reportIfUndetermined(hookName, probeLabel, result) {
+  const classification = classifyGitProbe(result);
+  if (classification.determined) return;
+  try {
+    process.stderr.write(
+      `${hookName}: git probe '${probeLabel}' ${classification.reason} — ` +
+      `allowing this call because the probe's answer is unknown, not because ` +
+      `git answered "no" (#3911).\n`
+    );
+  } catch {
+    // A stderr write failing (EPIPE, closed fd) must never itself change the
+    // hook's fail-open outcome.
+  }
+}
+
+module.exports = { classifyGitProbe, reportIfUndetermined };

package/hooks/dist/lib/hook-exit.js

@@ -0,0 +1,81 @@
+'use strict';
+// hooks/lib/hook-exit.js — hand-written, NOT generated. A tiny hook-facing
+// vocabulary layered over hooks/lib/cli-exit.js's terminateNow (ADR-3889 §3),
+// for the 19 enforcement hooks P7/#3911 is migrating off raw process.exit().
+//
+// WHY onCrash is a REQUIRED argument, with no default (this is the entire
+// point of this module): every hook audited for #3911 ended its outer
+// try/catch in ONE of two ways — some `process.exit(0)` (fail open: a hook
+// error must never block a legitimate tool call), others `process.exit(2)`
+// (fail closed: a hook whose whole job is a security/safety denial must not
+// let its own bug wave the denial through). Both are legitimate policies for
+// DIFFERENT hooks — but neither is the "obviously correct" one, and a shared
+// helper that silently defaulted to either would let a future hook inherit
+// the wrong policy by omission, which is exactly the "nothing fails with
+// success" defect ADR-3889 exists to close. Requiring the caller to name its
+// policy at every call site — not just once at module load — makes "I forgot
+// to decide" a load-time/call-time crash instead of a silent behavior. A
+// caller that truly wants "allow on crash" must still write ALLOW; there is
+// no path that reaches terminateNow without a declared choice.
+//
+// crash() itself is total: it does not throw on a bad `onCrash`, because
+// throwing would unwind into the CALLER's own outer catch — the exact
+// fail-open-by-accident hazard this module removes. Instead an unrecognized
+// policy terminates via terminateNow('INTERNAL', ...) with a diagnostic
+// payload naming the offending value, so a typo'd/misspelled policy is
+// debuggable on stderr rather than silently reinterpreted as ALLOW or DENY.
+const { terminateNow } = require('./cli-exit.js');
+
+/** Frozen enum of the two declarable crash policies. No third option. */
+const HOOK_ON_CRASH = Object.freeze({
+  ALLOW: 'allow',
+  DENY: 'deny',
+});
+
+/** Terminate with the hook-protocol PASS outcome (exit 0). */
+function allow(payload) {
+  terminateNow('PASS', payload);
+}
+
+/**
+ * Terminate with the hook-protocol deny outcome (exit 2, stdout+stderr).
+ *
+ * @param {*} payload - JSON-serializable value written to fd 1 (and, when
+ *   `stderrPayload` is omitted, fd 2 too).
+ * @param {*} [stderrPayload] - optional distinct value for fd 2, forwarded
+ *   verbatim to terminateNow's own `stderrPayload` param — a string is
+ *   written raw, anything else is JSON-stringified.
+ */
+function deny(payload, stderrPayload) {
+  terminateNow('HOOK_DENY', payload, stderrPayload);
+}
+
+/**
+ * Dispatch to allow()/deny() per a DECLARED crash policy. `onCrash` is
+ * required — see the module header for why there is no default.
+ *
+ * @param {'allow'|'deny'} onCrash - one of HOOK_ON_CRASH's two values.
+ * @param {*} payload - JSON-serializable value forwarded to terminateNow.
+ */
+function crash(onCrash, payload) {
+  if (onCrash === HOOK_ON_CRASH.ALLOW) {
+    allow(payload);
+    return;
+  }
+  if (onCrash === HOOK_ON_CRASH.DENY) {
+    deny(payload);
+    return;
+  }
+  // Never guess a policy and never throw (a throw would unwind into the
+  // caller's own outer catch — the fail-open-by-accident defect this module
+  // exists to remove). Terminate deterministically with INTERNAL, naming the
+  // offending value so a misspelled/omitted policy is diagnosable.
+  terminateNow('INTERNAL', {
+    error: 'hook-exit: crash() called with an unrecognized onCrash policy',
+    receivedOnCrash: onCrash,
+    expectedOneOf: [HOOK_ON_CRASH.ALLOW, HOOK_ON_CRASH.DENY],
+    originalPayload: payload,
+  });
+}
+
+module.exports = { HOOK_ON_CRASH, allow, deny, crash };

package/hooks/dist/managed-hooks-registry.cjs

@@ -29,6 +29,9 @@ const MANAGED_HOOKS = [
   'gsd-cursor-subagent-stop.js',
   'gsd-ensure-canonical-path.js',
   'gsd-graphify-update.sh',
+  // #3662: portable node resolver (helper staged in hooks/; managed JS hook
+  // commands route through it under --portable-hooks).
+  'gsd-node-runner.sh',
   'gsd-phase-boundary.sh',
   'gsd-prompt-guard.js',
   'gsd-read-guard.js',

package/hooks/gsd-agent-isolation-guard.js

@@ -65,6 +65,23 @@ const path = require('path');
 const os = require('os');
 const { readSentinel, VALID_ISOLATION, extractDispatchIdentifiers, sentinelAppliesToDispatch } = require('./lib/isolation-sentinel.js');
 const { REASON_CODE } = require('./lib/isolation-deny-reason.js');
+const { HOOK_ON_CRASH, allow, deny, crash } = require('./lib/hook-exit.js');
+
+// Required at module top, alongside the other ./lib requires — NOT behind
+// ensureRuntimeBuild() below. Terminating on a parse/timeout failure must
+// never depend on the gitignored build artifacts this hook self-heals for
+// its own registry lookups (#3911).
+//
+// This guard's outer catch (main(), below) has always exited 0 (fail open):
+// that outer catch only covers payload PARSING failing before applicability
+// could even be determined (malformed stdin JSON, etc.) — the guard's real
+// fail-closed logic (a GSD project whose dispatch-isolation configuration
+// cannot be verified) is handled separately, inside evaluateDispatch/
+// resolveIsolationState, and already returns a 'block' decision through the
+// normal exit-2 path rather than through this catch. So an unparseable
+// payload has nothing to enforce; allowing it preserves today's behavior
+// exactly.
+const ON_CRASH = HOOK_ON_CRASH.ALLOW;
 // #3582: gsd-core/bin/lib/*.cjs (runtime-name-policy.cjs, capability-registry.cjs
 // below) are tsc build artifacts (ADR-457), gitignored and absent on a raw
 // plugin-marketplace / git-clone install that never ran `npm run build:lib`.
@@ -95,40 +112,40 @@ function parseHarnessFlag(flag) {
   return { param: m[1], value: m[2] };
 }
 
-// ─── #3566: per-install runtime marker ────────────────────────────────────────
+// ─── #3897 rung 2: per-install runtime marker, single canonical owner ────────
 // bin/install.js writes `<install>/gsd-core/.gsd-runtime` for EVERY runtime
 // install (#2297), co-located with VERSION. Unlike `~/.gsd/defaults.json` —
 // which is host-wide and names whichever runtime's install ran LAST, the exact
 // leakage #2840's config.cjs change exists to prevent — the marker describes
 // THIS install, which is the property runtime identity needs on a machine
-// with 2+ runtimes. Mirrors readInstallRuntimeMarker in src/model-resolver.cts
-// (same cache + test-seam shape); this hook cannot import that module without
-// dragging the whole model-resolution stack into a PreToolUse hot path, so the
-// 5-line read lives here against the same sibling-layout assumption the hook's
-// own require('../gsd-core/bin/lib/…') already makes. Epic #3473 B3 owns
-// consolidating every marker reader into one shared seam.
-let _installMarkerCache; // undefined = unread; null = known absent; string = value
-
+// with 2+ runtimes. Previously this hook held its own private reader/cache
+// (one of four #3897 found); it now delegates to the single canonical owner,
+// `src/runtime-slash.cts` (compiled to gsd-core/bin/lib/runtime-slash.cjs),
+// reached through `ensureRuntimeBuild()` like every other compiled-lib require
+// in this file (`scripts/lint-hooks-runtime-build-seam.cjs`).
 function readInstallRuntimeMarker() {
-  if (_installMarkerCache !== undefined) return _installMarkerCache;
   try {
-    const markerPath = path.join(__dirname, '..', 'gsd-core', '.gsd-runtime');
-    const raw = fs.readFileSync(markerPath, 'utf-8').trim();
-    _installMarkerCache = raw || null;
+    ensureRuntimeBuild();
+    const runtimeSlash = require('../gsd-core/bin/lib/runtime-slash.cjs');
+    return runtimeSlash.readInstallRuntimeMarker();
   } catch {
-    // No marker: dev/source tree, or an install predating #2297 — "no signal
-    // from this rung", never a resolution failure. Falls through to the
-    // defaults rung below.
-    _installMarkerCache = null;
+    // Unbuilt runtime library, or any other failure reaching the canonical
+    // owner — "no signal from this rung" (N4), never a resolution failure.
+    return null;
   }
-  return _installMarkerCache;
 }
 
-// Test seam for the marker rung (the dev/source tree has no marker file, so
-// the read always bottoms out at null there — same seam contract as
-// model-resolver.cts's _setInstallRuntimeMarkerForTests, #2297).
+// Test seam for the marker rung — forwards to the canonical owner's seam so
+// this hook and runtime-slash.cjs always share one cache (#3897 rung 2).
 function _setInstallRuntimeMarkerForTests(value) {
-  _installMarkerCache = value;
+  try {
+    ensureRuntimeBuild();
+    const runtimeSlash = require('../gsd-core/bin/lib/runtime-slash.cjs');
+    runtimeSlash._setInstallRuntimeMarkerForTests(value);
+  } catch {
+    // Test-only seam; an unbuilt library here means the test itself will fail
+    // downstream, which is a louder and more actionable signal than throwing here.
+  }
 }
 
 /**
@@ -282,18 +299,40 @@ function resolveRegistryIsolation(cwd, configPath) {
 
   if (isolation === 'harness-worktree') {
     let useWorktrees = true;
+    // #3972: the opt-out read shares the ONE owner every other
+    // isolation-deciding surface uses — planning-workspace's
+    // worktreesOptedOut ladder (scoped own-key wins; root inherited under
+    // the GSD_WORKSTREAM gate; strict === false). A flat single-file read
+    // here made a workstream-LOCAL opt-out invisible, so the sentinel-absent
+    // fallback denied a sequential dispatch the config explicitly allowed.
+    // Reached through ensureRuntimeBuild() like every other compiled-lib
+    // require in this file (scripts/lint-hooks-runtime-build-seam.cjs); if
+    // the library is unreachable the flat-root read below remains as the
+    // degraded fallback — today's behavior, never worse.
+    let ladderAnswered = false;
     try {
-      const raw = fs.readFileSync(configPath, 'utf-8');
-      const parsedCfg = JSON.parse(raw);
-      if (parsedCfg && typeof parsedCfg === 'object' && parsedCfg.workflow &&
-          typeof parsedCfg.workflow === 'object' && parsedCfg.workflow.use_worktrees === false) {
-        useWorktrees = false;
-      }
+      ensureRuntimeBuild();
+      const { worktreesOptedOut } = require('../gsd-core/bin/lib/planning-workspace.cjs');
+      useWorktrees = !worktreesOptedOut(cwd);
+      ladderAnswered = true;
     } catch {
-      // Unreadable config already propagated to the outer caller's catch
-      // before this point in practice (resolveRuntimeIdentity reads it
-      // first); tolerate defensively and keep the conservative (enforce)
-      // default rather than silently disabling the guard.
+      // Unbuilt runtime library or a ladder failure — fall through to the
+      // legacy flat-root read (conservative: keep enforcing).
+    }
+    if (!ladderAnswered) {
+      try {
+        const raw = fs.readFileSync(configPath, 'utf-8');
+        const parsedCfg = JSON.parse(raw);
+        if (parsedCfg && typeof parsedCfg === 'object' && parsedCfg.workflow &&
+            typeof parsedCfg.workflow === 'object' && parsedCfg.workflow.use_worktrees === false) {
+          useWorktrees = false;
+        }
+      } catch {
+        // Unreadable config already propagated to the outer caller's catch
+        // before this point in practice (resolveRuntimeIdentity reads it
+        // first); tolerate defensively and keep the conservative (enforce)
+        // default rather than silently disabling the guard.
+      }
     }
     if (!useWorktrees) isolation = 'none';
   }
@@ -476,7 +515,7 @@ function evaluateDispatch(data, { clock = Date } = {}) {
 /* istanbul ignore next -- stdin adapter, exercised via spawnSync in tests */
 function main() {
   let input = '';
-  const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+  const stdinTimeout = setTimeout(() => allow(undefined), 3000);
   process.stdin.setEncoding('utf8');
   process.stdin.on('data', (chunk) => { input += chunk; });
   process.stdin.on('end', () => {
@@ -486,18 +525,18 @@ function main() {
       const decision = evaluateDispatch(data);
       if (decision.action === 'block') {
         const out = { decision: 'block', reason: decision.reason, reason_code: decision.reasonCode };
-        process.stdout.write(JSON.stringify(out));
         // Kimi feeds stderr (not stdout) back to the model on exit 2.
-        process.stderr.write(decision.reason);
-        process.exit(2);
+        deny(out, decision.reason);
       }
-      process.exit(0);
+      allow(undefined);
     } catch {
       // Silent fail — never block valid tool calls due to hook errors
       // (malformed payload, etc.). This is distinct from resolveIsolationState's
       // internal error handling, which DOES deny — this outer catch only
       // covers payload parsing before applicability could even be determined.
-      process.exit(0);
+      // ON_CRASH is declared ALLOW at module top: this preserves today's
+      // exit(0) fail-open behavior exactly (#3911).
+      crash(ON_CRASH, undefined);
     }
   });
 }

package/hooks/gsd-config-reload.js

@@ -20,11 +20,17 @@
 
 const fs = require('fs');
 const path = require('path');
+const { HOOK_ON_CRASH, allow, crash } = require('./lib/hook-exit.js');
+
+// This hook only injects an advisory config-reload summary; a crash mid-parse
+// must not block the session or the FileChanged event that triggered it — the
+// agent simply keeps using the config context it already had (#3911).
+const ON_CRASH = HOOK_ON_CRASH.ALLOW;
 
 let input = '';
 // Timeout guard: if stdin does not close within 8s exit silently rather than
 // hanging until Claude Code kills the process and reports "hook error".
-const stdinTimeout = setTimeout(() => process.exit(0), 8000);
+const stdinTimeout = setTimeout(() => allow(undefined), 8000);
 process.stdin.setEncoding('utf8');
 process.stdin.on('data', chunk => (input += chunk));
 process.stdin.on('end', () => {
@@ -42,24 +48,23 @@ process.stdin.on('end', () => {
     // inject spurious additionalContext.
     const basename = path.basename(filePath);
     if (basename !== 'config.json') {
-      process.exit(0);
+      allow(undefined);
     }
     const expectedPath = path.resolve(cwd, '.planning', 'config.json');
     if (path.resolve(filePath) !== expectedPath) {
-      process.exit(0);
+      allow(undefined);
     }
 
     // On unlink (deletion) emit a brief notice and exit
     if (event === 'unlink') {
-      process.stdout.write(JSON.stringify({
+      allow({
         hookSpecificOutput: {
           hookEventName: 'FileChanged',
           additionalContext:
             'GSD config (.planning/config.json) was deleted. ' +
             'Falling back to built-in defaults for this session.',
         },
-      }));
-      process.exit(0);
+      });
     }
 
     // Read the updated config file
@@ -68,17 +73,16 @@ process.stdin.on('end', () => {
       const raw = fs.readFileSync(filePath, 'utf8');
       config = JSON.parse(raw);
     } catch (e) {
-      if (e && e.code === 'ENOENT') process.exit(0);
+      if (e && e.code === 'ENOENT') allow(undefined);
       // Malformed JSON — inform the agent without crashing
-      process.stdout.write(JSON.stringify({
+      allow({
         hookSpecificOutput: {
           hookEventName: 'FileChanged',
           additionalContext:
             'GSD config (.planning/config.json) was modified but could not be parsed. ' +
             'Check the file for JSON syntax errors.',
         },
-      }));
-      process.exit(0);
+      });
     }
 
     // Build a concise summary of key config fields the agent cares about
@@ -127,7 +131,9 @@ process.stdin.on('end', () => {
       },
     }));
   } catch (e) {
-    // Silent fail — never block the session on a config reload error
-    process.exit(0);
+    // Silent fail — never block the session on a config reload error.
+    // ON_CRASH is declared ALLOW at module top: this preserves today's
+    // exit(0) fail-open behavior exactly (#3911).
+    crash(ON_CRASH, undefined);
   }
 });

package/hooks/gsd-context-monitor.js

@@ -22,6 +22,13 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawn } = require('child_process');
+const { HOOK_ON_CRASH, allow, crash } = require('./lib/hook-exit.js');
+
+// This hook only injects an advisory context-usage warning; it never blocks
+// the tool call it rides in on. A crash here (e.g. a malformed bridge file)
+// must not turn a PostToolUse advisory into a blocked tool call — losing a
+// context warning is far cheaper than stalling the agent's work (#3911).
+const ON_CRASH = HOOK_ON_CRASH.ALLOW;
 
 const WARNING_THRESHOLD = 35;  // remaining_percentage <= 35%
 const CRITICAL_THRESHOLD = 25; // remaining_percentage <= 25%
@@ -33,7 +40,7 @@ let input = '';
 // Windows/Git Bash, or slow Claude Code piping during large outputs),
 // exit silently instead of hanging until Claude Code kills the process
 // and reports "hook error". See #775, #1162.
-const stdinTimeout = setTimeout(() => process.exit(0), 10000);
+const stdinTimeout = setTimeout(() => allow(undefined), 10000);
 process.stdin.setEncoding('utf8');
 process.stdin.on('data', chunk => input += chunk);
 process.stdin.on('end', () => {
@@ -43,14 +50,14 @@ process.stdin.on('end', () => {
     const sessionId = data.session_id;
 
     if (!sessionId) {
-      process.exit(0);
+      allow(undefined);
     }
 
     // Reject session IDs that contain path traversal sequences or path separators.
     // session_id is used to construct file paths in /tmp — an unsanitized value
     // could escape the temp directory and read or write arbitrary files.
     if (/[/\\]|\.\./.test(sessionId)) {
-      process.exit(0);
+      allow(undefined);
     }
 
     // Check if context warnings are disabled via config.
@@ -61,7 +68,7 @@ process.stdin.on('end', () => {
       const configPath = path.join(cwd, '.planning', 'config.json');
       const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
       if (config.hooks?.context_warnings === false) {
-        process.exit(0);
+        allow(undefined);
       }
     } catch (e) {
       // Missing or unparseable config → proceed with defaults (context warnings enabled)
@@ -77,7 +84,7 @@ process.stdin.on('end', () => {
     try {
       metricsRaw = fs.readFileSync(metricsPath, 'utf8');
     } catch (e) {
-      if (e && e.code === 'ENOENT') process.exit(0);
+      if (e && e.code === 'ENOENT') allow(undefined);
       throw e;
     }
     const metrics = JSON.parse(metricsRaw);
@@ -85,7 +92,7 @@ process.stdin.on('end', () => {
 
     // Ignore stale metrics
     if (metrics.timestamp && (now - metrics.timestamp) > STALE_SECONDS) {
-      process.exit(0);
+      allow(undefined);
     }
 
     const remaining = metrics.remaining_percentage;
@@ -93,7 +100,7 @@ process.stdin.on('end', () => {
 
     // No warning needed
     if (remaining > WARNING_THRESHOLD) {
-      process.exit(0);
+      allow(undefined);
     }
 
     // Debounce: check if we warned recently
@@ -121,7 +128,7 @@ process.stdin.on('end', () => {
     if (!firstWarn && warnData.callsSinceWarn < DEBOUNCE_CALLS && !severityEscalated) {
       // Update counter and exit without warning
       fs.writeFileSync(warnPath, JSON.stringify(warnData));
-      process.exit(0);
+      allow(undefined);
     }
 
     // Reset debounce counter
@@ -208,7 +215,9 @@ process.stdin.on('end', () => {
       process.stdout.write(JSON.stringify(output));
     }
   } catch (e) {
-    // Silent fail -- never block tool execution
-    process.exit(0);
+    // Silent fail -- never block tool execution.
+    // ON_CRASH is declared ALLOW at module top: this preserves today's
+    // exit(0) fail-open behavior exactly (#3911).
+    crash(ON_CRASH, undefined);
   }
 });

package/hooks/gsd-cursor-post-tool.js

@@ -22,6 +22,8 @@
 
 'use strict';
 
+const { allow } = require('./lib/hook-exit.js');
+
 const WRITE_TOOL_RE = /write|edit|replace|create|delete|remove|append|apply|patch|insert|mkdir/i;
 const PATH_KEY_RE = /^(path|file|file_?path|filepath|target_?path|target|dir|directory|uri|filename)$/i;
 const PLANNING_PATH_RE = /(^|[\\/])\.planning([\\/]|$)/;
@@ -29,7 +31,7 @@ const PLANNING_PATH_RE = /(^|[\\/])\.planning([\\/]|$)/;
 let raw = '';
 const stdinTimeout = setTimeout(() => {
   // Timeout guard: exit silently rather than hanging.
-  process.exit(0);
+  allow(undefined);
 }, 10000);
 
 process.stdin.setEncoding('utf8');

package/hooks/gsd-cursor-pre-tool.js

@@ -22,13 +22,15 @@
 
 'use strict';
 
+const { allow } = require('./lib/hook-exit.js');
+
 const WRITE_TOOL_RE = /write|edit|replace|create|delete|remove|append|apply|patch|insert|mkdir/i;
 const PATH_KEY_RE = /^(path|file|file_?path|filepath|target_?path|target|dir|directory|uri|filename)$/i;
 const PLANNING_PATH_RE = /(^|[\\/])\.planning([\\/]|$)/;
 
 let raw = '';
 const stdinTimeout = setTimeout(() => {
-  process.exit(0);
+  allow(undefined);
 }, 10000);
 
 process.stdin.setEncoding('utf8');

package/hooks/gsd-cursor-session-start.js

@@ -23,6 +23,7 @@
 'use strict';
 
 const fs = require('fs');
+const { allow } = require('./lib/hook-exit.js');
 
 const MSG_PRESENT =
   'GSD: .planning/STATE.md is present — review the current phase and any blockers before acting.';
@@ -37,7 +38,7 @@ const { resolveStatePath } = require('./lib/cursor-workspace.js');
 let raw = '';
 const stdinTimeout = setTimeout(() => {
   // Timeout guard: exit silently rather than hanging.
-  process.exit(0);
+  allow(undefined);
 }, 10000);
 
 process.stdin.setEncoding('utf8');

package/hooks/gsd-cursor-stop.js

@@ -21,6 +21,7 @@
 'use strict';
 
 const fs = require('fs');
+const { allow } = require('./lib/hook-exit.js');
 
 // Workspace resolution is shared across the Cursor hooks (#2587) — see
 // hooks/lib/cursor-workspace.js. Staged next to these scripts by
@@ -29,7 +30,7 @@ const { resolveStatePath } = require('./lib/cursor-workspace.js');
 
 let raw = '';
 const stdinTimeout = setTimeout(() => {
-  process.exit(0);
+  allow(undefined);
 }, 10000);
 
 process.stdin.setEncoding('utf8');