@opengsd/gsd-core 1.11.0 → 1.12.0

package/scripts/prompt-injection-scan.sh

@@ -6,12 +6,29 @@
 #   scripts/prompt-injection-scan.sh --file path/to/file   # Scan a single file
 #   scripts/prompt-injection-scan.sh --dir agents/          # Scan all files in a directory
 #
-# Exit codes:
-#   0 = clean
-#   1 = findings detected
-#   2 = usage error
+# Exit codes (ADR-3889, #3908 — registered in gsd-core/bin/shared/exit-codes.json):
+#   0                = clean
+#   1                = findings detected
+#   $EXIT_USAGE       (64) = usage error (bad argv, missing --file/--dir target)
+#   $EXIT_NO_INPUT    (66) = ran; scope established; zero files in scope (genuinely empty)
+#   $EXIT_UNAVAILABLE (69) = could not establish scope (bad ref, not a repo, unreadable dir)
 set -euo pipefail
 
+# ─── Exit-code registry (ADR-3889, #3908) ────────────────────────────────────
+# Resolved relative to THIS script's location, not the caller's cwd. Loud,
+# non-zero failure if the fragment is missing — never fall back to a guessed
+# literal integer, and never let a missing registry silently degrade to
+# exit 0.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXIT_CODES_SH="$SCRIPT_DIR/../gsd-core/bin/shared/exit-codes.sh"
+if [[ ! -f "$EXIT_CODES_SH" ]]; then
+  echo "prompt-injection-scan: FATAL: exit-code registry not found at $EXIT_CODES_SH" >&2
+  echo "  Regenerate with: node scripts/gen-exit-code-registry.cjs --write" >&2
+  exit 1
+fi
+# shellcheck disable=SC1090
+. "$EXIT_CODES_SH"
+
 # ─── Patterns ────────────────────────────────────────────────────────────────
 # Each pattern is a POSIX extended regex. Keep alphabetized by category.
 #
@@ -175,33 +192,73 @@ collect_files() {
   case "$mode" in
     --diff)
       local base="${1:-origin/main}"
-      # Get changed files in the diff, filter to scannable extensions
-      git diff --name-only --diff-filter=ACMR "$base"...HEAD 2>/dev/null \
-        | grep -E '\.(md|cjs|js|json|yml|yaml|sh)$' || true
+      # Run git separately from the filter pipe so its OWN exit status (not
+      # grep's) decides whether the diff could be established. stdout and
+      # stderr are captured SEPARATELY (never merged with `2>&1`) so that a
+      # warning git writes to stderr on an otherwise successful diff can
+      # never be mistaken for a filename in the file list. On failure the
+      # captured stderr is emitted as the diagnostic; on success it is
+      # forwarded as a warning, never folded into the file list.
+      # `|| true` on the filter below is CORRECT (not gratuitous): `grep -E`
+      # exits 1 when nothing matches the scannable extensions (e.g. a diff
+      # touching only non-scannable file types), which is a legitimate empty
+      # result, not a failure to run.
+      local raw status err_file
+      err_file=$(mktemp)
+      raw=$(git diff --name-only --diff-filter=ACMR "$base"...HEAD 2>"$err_file")
+      status=$?
+      if (( status != 0 )); then
+        cat "$err_file" >&2
+        rm -f "$err_file"
+        exit "$EXIT_UNAVAILABLE"
+      fi
+      if [[ -s "$err_file" ]]; then
+        echo "Warning: git diff emitted stderr output:" >&2
+        cat "$err_file" >&2
+      fi
+      rm -f "$err_file"
+      printf '%s\n' "$raw" | grep -E '\.(md|cjs|js|json|yml|yaml|sh)$' || true
       ;;
     --file)
       if [[ -f "$1" ]]; then
         echo "$1"
       else
         echo "Error: file not found: $1" >&2
-        exit 2
+        exit "$EXIT_USAGE"
       fi
       ;;
     --dir)
       local dir="$1"
       if [[ ! -d "$dir" ]]; then
         echo "Error: directory not found: $dir" >&2
-        exit 2
+        exit "$EXIT_USAGE"
+      fi
+      # Same treatment as --diff: a `find` that fails (e.g. permission
+      # denied) must not be reported as an empty directory, and stdout/stderr
+      # are captured separately so a stderr warning never enters the file list.
+      local raw status err_file
+      err_file=$(mktemp)
+      raw=$(find "$dir" -type f \( -name '*.md' -o -name '*.cjs' -o -name '*.js' -o -name '*.json' -o -name '*.yml' -o -name '*.yaml' -o -name '*.sh' \) \
+        ! -path '*/node_modules/*' ! -path '*/.git/*' ! -path '*/dist/*' 2>"$err_file")
+      status=$?
+      if (( status != 0 )); then
+        cat "$err_file" >&2
+        rm -f "$err_file"
+        exit "$EXIT_UNAVAILABLE"
+      fi
+      if [[ -s "$err_file" ]]; then
+        echo "Warning: find emitted stderr output:" >&2
+        cat "$err_file" >&2
       fi
-      find "$dir" -type f \( -name '*.md' -o -name '*.cjs' -o -name '*.js' -o -name '*.json' -o -name '*.yml' -o -name '*.yaml' -o -name '*.sh' \) \
-        ! -path '*/node_modules/*' ! -path '*/.git/*' ! -path '*/dist/*' 2>/dev/null || true
+      rm -f "$err_file"
+      printf '%s\n' "$raw"
       ;;
     --stdin)
       cat
       ;;
     *)
       echo "Usage: $0 --diff [base] | --file <path> | --dir <path> | --stdin" >&2
-      exit 2
+      exit "$EXIT_USAGE"
       ;;
   esac
 }
@@ -240,7 +297,7 @@ scan_file() {
 main() {
   if [[ $# -eq 0 ]]; then
     echo "Usage: $0 --diff [base] | --file <path> | --dir <path>" >&2
-    exit 2
+    exit "$EXIT_USAGE"
   fi
 
   local mode="$1"
@@ -250,8 +307,12 @@ main() {
   files=$(collect_files "$mode" "$@")
 
   if [[ -z "$files" ]]; then
+    # collect_files already exited (UNAVAILABLE/USAGE) for anything that
+    # could not establish scope. Reaching here with an empty result means
+    # scope WAS established and is genuinely empty — that is NO_INPUT, not a
+    # silent clean pass.
     echo "prompt-injection-scan: no files to scan"
-    exit 0
+    exit "$EXIT_NO_INPUT"
   fi
 
   local total=0

package/scripts/secret-scan.sh

@@ -17,10 +17,12 @@
 #              This flag does not change secret-detection logic — only which
 #              exclusions are applied.
 #
-# Exit codes:
-#   0 = clean
-#   1 = findings detected
-#   2 = usage error
+# Exit codes (ADR-3889, #3908 — registered in gsd-core/bin/shared/exit-codes.json):
+#   0                = clean
+#   1                = findings detected
+#   $EXIT_USAGE       (64) = usage error (bad argv, missing --file/--dir target)
+#   $EXIT_NO_INPUT    (66) = ran; scope established; zero files in scope (genuinely empty)
+#   $EXIT_UNAVAILABLE (69) = could not establish scope (bad ref, not a repo, unreadable dir)
 #
 # Annotation format for .secretscanignore (required for --strict compliance):
 #   # allow: <pattern>  reason="..."  owner="..."  expires="YYYY-MM-DD"  [rule-id="..."]
@@ -39,6 +41,21 @@
 #   cannot permanently hide secrets. See SECURITY.md for the audit runbook.
 set -euo pipefail
 
+# ─── Exit-code registry (ADR-3889, #3908) ────────────────────────────────────
+# Resolved relative to THIS script's location, not the caller's cwd, so this
+# works regardless of where the scanner is invoked from. Loud, non-zero
+# failure if the fragment is missing — never fall back to a guessed literal
+# integer, and never let a missing registry silently degrade to exit 0.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXIT_CODES_SH="$SCRIPT_DIR/../gsd-core/bin/shared/exit-codes.sh"
+if [[ ! -f "$EXIT_CODES_SH" ]]; then
+  echo "secret-scan: FATAL: exit-code registry not found at $EXIT_CODES_SH" >&2
+  echo "  Regenerate with: node scripts/gen-exit-code-registry.cjs --write" >&2
+  exit 1
+fi
+# shellcheck disable=SC1090
+. "$EXIT_CODES_SH"
+
 # ─── Global mode flag ─────────────────────────────────────────────────────────
 STRICT_MODE=false
 
@@ -235,7 +252,31 @@ collect_files() {
   case "$mode" in
     --diff)
       local base="${1:-origin/main}"
-      git diff --name-only --diff-filter=ACMR "$base"...HEAD 2>/dev/null \
+      # Run git separately from the filter pipe so its OWN exit status (not
+      # grep's) decides whether the diff could be established. stdout and
+      # stderr are captured SEPARATELY (never merged with `2>&1`) so that a
+      # warning git writes to stderr on an otherwise successful diff can
+      # never be mistaken for a filename in the file list. On failure the
+      # captured stderr is emitted as the diagnostic; on success it is
+      # forwarded as a warning, never folded into the file list.
+      # `|| true` on the filter below is CORRECT (not gratuitous): `grep -v`
+      # exits 1 when every line is filtered out (e.g. an all-images diff),
+      # which is a legitimate empty result, not a failure to run.
+      local raw status err_file
+      err_file=$(mktemp)
+      raw=$(git diff --name-only --diff-filter=ACMR "$base"...HEAD 2>"$err_file")
+      status=$?
+      if (( status != 0 )); then
+        cat "$err_file" >&2
+        rm -f "$err_file"
+        exit "$EXIT_UNAVAILABLE"
+      fi
+      if [[ -s "$err_file" ]]; then
+        echo "Warning: git diff emitted stderr output:" >&2
+        cat "$err_file" >&2
+      fi
+      rm -f "$err_file"
+      printf '%s\n' "$raw" \
         | grep -vE '\.(png|jpg|jpeg|gif|ico|woff|woff2|ttf|eot|otf|zip|tar|gz|pdf)$' || true
       ;;
     --file)
@@ -243,24 +284,41 @@ collect_files() {
         echo "$1"
       else
         echo "Error: file not found: $1" >&2
-        exit 2
+        exit "$EXIT_USAGE"
       fi
       ;;
     --dir)
       local dir="$1"
       if [[ ! -d "$dir" ]]; then
         echo "Error: directory not found: $dir" >&2
-        exit 2
+        exit "$EXIT_USAGE"
+      fi
+      # Same treatment as --diff: a `find` that fails (e.g. permission
+      # denied) must not be reported as an empty directory, and stdout/stderr
+      # are captured separately so a stderr warning never enters the file list.
+      local raw status err_file
+      err_file=$(mktemp)
+      raw=$(find "$dir" -type f ! -path '*/node_modules/*' ! -path '*/.git/*' ! -path '*/dist/*' \
+        ! -name '*.png' ! -name '*.jpg' ! -name '*.gif' ! -name '*.woff*' 2>"$err_file")
+      status=$?
+      if (( status != 0 )); then
+        cat "$err_file" >&2
+        rm -f "$err_file"
+        exit "$EXIT_UNAVAILABLE"
+      fi
+      if [[ -s "$err_file" ]]; then
+        echo "Warning: find emitted stderr output:" >&2
+        cat "$err_file" >&2
       fi
-      find "$dir" -type f ! -path '*/node_modules/*' ! -path '*/.git/*' ! -path '*/dist/*' \
-        ! -name '*.png' ! -name '*.jpg' ! -name '*.gif' ! -name '*.woff*' 2>/dev/null || true
+      rm -f "$err_file"
+      printf '%s\n' "$raw"
       ;;
     --stdin)
       cat
       ;;
     *)
       echo "Usage: $0 --diff [base] | --file <path> | --dir <path> | --stdin" >&2
-      exit 2
+      exit "$EXIT_USAGE"
       ;;
   esac
 }
@@ -300,7 +358,7 @@ scan_file() {
 main() {
   if [[ $# -eq 0 ]]; then
     echo "Usage: $0 --diff [base] | --file <path> | --dir <path> [--strict]" >&2
-    exit 2
+    exit "$EXIT_USAGE"
   fi
 
   # Parse --strict flag first (may appear anywhere in argv)
@@ -316,7 +374,7 @@ main() {
 
   if [[ $# -eq 0 ]]; then
     echo "Usage: $0 --diff [base] | --file <path> | --dir <path> [--strict]" >&2
-    exit 2
+    exit "$EXIT_USAGE"
   fi
 
   load_ignorelist
@@ -328,8 +386,12 @@ main() {
   files=$(collect_files "$mode" "$@")
 
   if [[ -z "$files" ]]; then
+    # collect_files already exited (UNAVAILABLE/USAGE) for anything that
+    # could not establish scope. Reaching here with an empty result means
+    # scope WAS established and is genuinely empty (e.g. an all-images
+    # diff) — that is NO_INPUT, not a silent clean pass.
     echo "secret-scan: no files to scan"
-    exit 0
+    exit "$EXIT_NO_INPUT"
   fi
 
   local total=0

package/scripts/select-docs-guards.cjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * select-docs-guards.cjs — pure selector mapping a PR's changed docs/ paths
+ * to the subset of scripts/docs-guard-registry.cjs's DOCS_GUARD_TESTS that
+ * actually reads any of them (#3753 follow-up).
+ *
+ * Deliberately dependency-free: no fs, no git, no process. Callers (the
+ * docs-required.yml workflow, tests) are responsible for producing the
+ * changed-paths list and reading the registry; this module only implements
+ * the matching semantics so they are independently unit-testable.
+ *
+ * Pattern semantics (mirrors scripts/docs-guard-registry.cjs's header doc):
+ *   - a plain path matches an exact changed path;
+ *   - a trailing-slash path is a DIRECTORY PREFIX match — 'docs/adr/'
+ *     matches 'docs/adr/README.md' but must NOT match 'docs/adrenaline.md'
+ *     (a naive `startsWith('docs/adr')` without the trailing slash would
+ *     wrongly match the latter; matching against the full prefix INCLUDING
+ *     the trailing slash is what keeps this boundary correct);
+ *   - the sentinel '*' matches any non-empty changedDocsPaths.
+ */
+
+/**
+ * @param {string} changedPath - a single changed docs/ path (e.g. 'docs/AGENTS.md').
+ * @param {string} pattern - one entry from a registry value array.
+ * @returns {boolean}
+ */
+function patternMatches(changedPath, pattern) {
+  if (pattern === '*') return true;
+  if (pattern.endsWith('/')) return changedPath.startsWith(pattern);
+  return changedPath === pattern;
+}
+
+/**
+ * @param {string[]} changedDocsPaths - repo-relative paths under docs/ that
+ *   changed in this PR. An empty array always yields an empty selection.
+ * @param {Record<string, string[]>} registry - DOCS_GUARD_TESTS shape: test
+ *   file -> array of patterns it reads.
+ * @returns {string[]} sorted, deduped list of selected test file paths.
+ */
+function selectDocsGuards(changedDocsPaths, registry) {
+  if (!Array.isArray(changedDocsPaths) || changedDocsPaths.length === 0) return [];
+
+  const selected = new Set();
+  for (const [testFile, patterns] of Object.entries(registry)) {
+    const hit = patterns.some((pattern) =>
+      changedDocsPaths.some((changedPath) => patternMatches(changedPath, pattern)),
+    );
+    if (hit) selected.add(testFile);
+  }
+
+  return [...selected].sort();
+}
+
+module.exports = { selectDocsGuards, patternMatches };

package/scripts/sync-runtime-launcher.cjs

@@ -330,6 +330,16 @@ function transformFile(content, preamble) {
   let changed = false;
   let firstGsdRunBlockIdx = -1; // index into shellBlockRanges of the first gsd_run block (after strip)
 
+  // A file may place the preamble in a bootstrap-only block that defines
+  // gsd_run without calling it (gsd-core/workflows/explore.md Step 1, which
+  // documents exactly why). Stripping empties that block of gsd_run calls, so
+  // a pure "first block that CALLS gsd_run" target silently relocates the
+  // preamble forward and breaks define-before-use. Honour where it already is.
+  const existingPreambleBlockIdx = shellBlockRanges.findIndex((range) =>
+    allLines
+      .slice(range.contentStart, range.contentEnd)
+      .some((l) => /^\s*_GSD_SHIM_NAME=/.test(l)));
+
   // First: strip + replace in all blocks, find first gsd_run block
   const strippedBlocks = shellBlockRanges.map((range) => {
     const blockLines = outputLines.slice(range.contentStart, range.contentEnd);
@@ -345,12 +355,17 @@ function transformFile(content, preamble) {
     }
   }
 
-  // Insert preamble into the first gsd_run block only — UNLESS this file
+  // If the preamble already existed in a specific block before stripping,
+  // keep it there (even if that block no longer calls gsd_run after
+  // stripping). Otherwise fall back to the first gsd_run-calling block.
+  const preambleTargetIdx = existingPreambleBlockIdx >= 0 ? existingPreambleBlockIdx : firstGsdRunBlockIdx;
+
+  // Insert preamble into the target block only — UNLESS this file
   // delegates to the shared resolver reference (@-include). Delegating files keep
   // the stripped blocks (any inline preamble removed) but never get one inserted.
   const delegates = delegatesToResolverReference(content);
   const finalBlocks = strippedBlocks.map((stripped, bi) => {
-    if (!delegates && bi === firstGsdRunBlockIdx) {
+    if (!delegates && bi === preambleTargetIdx) {
       return insertPreamble(stripped, preamble);
     }
     return stripped;
@@ -428,4 +443,8 @@ function main() {
   console.log(`\nDone. ${transformedCount} files transformed, ${unchangedCount} unchanged.`);
 }
 
-main();
+if (require.main === module) {
+  main();
+}
+
+module.exports = { transformFile };

package/skills/gsd-discuss-phase/SKILL.md

@@ -48,7 +48,7 @@ Context files are resolved in-workflow using `init phase-op` and roadmap/state t
 **Mode routing:**
 ```bash
 _GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
-DISCUSS_MODE=$(gsd_run query config-get workflow.discuss_mode 2>/dev/null || echo "discuss")
+DISCUSS_MODE=$(gsd_run query config-get workflow.discuss_mode --raw 2>/dev/null || echo "discuss")
 ```
 
 If `--assumptions` is in $ARGUMENTS:

package/skills/gsd-import/SKILL.md

@@ -18,7 +18,7 @@ allowed-tools:
 Import external plan files into the GSD planning system with conflict detection against PROJECT.md decisions.
 
 - **--from**: Import an external plan file, detect conflicts, write as GSD PLAN.md, validate via gsd-plan-checker.
-- **--from-gsd2**: Reverse-migrate a GSD-2 project (`.gsd/` directory) back to GSD v1 (`.planning/`) format. Runs `gsd-tools.cjs from-gsd2`. Pass `--path <dir>` to migrate a project at a different path.
+- **--from-gsd2**: Reverse-migrate a GSD-2 project (`.gsd/` directory) back to GSD v1 (`.planning/`) format. Runs `gsd_run from-gsd2`. Pass `--path <dir>` to migrate a project at a different path.
 </objective>
 
 <execution_context>

package/skills/gsd-quick/SKILL.md

@@ -86,12 +86,14 @@ For each directory found:
 Display format:
 ```
 Quick Tasks
-────────────────────────────────────────────────────────────
+
+---
 slug                           date        status
 backup-s3-policy               2026-04-10  in-progress
 auth-token-refresh-fix         2026-04-09  complete ✓
 update-node-deps               2026-04-08  abandoned? (>7 days, no summary)
-────────────────────────────────────────────────────────────
+
+---
 3 tasks (1 complete, 2 incomplete/in-progress)
 ```
 
@@ -113,12 +115,14 @@ If no directory found, print `No quick task found with slug: {SLUG}` and stop.
 Read PLAN.md and SUMMARY.md (if exists) for the given slug. Display:
 ```
 Quick Task: {slug}
-─────────────────────────────────────
+
+---
 Plan file: .planning/quick/{dir}/PLAN.md
 Status: {status from SUMMARY.md frontmatter, or "no summary yet"}
 Description: {first non-empty line from PLAN.md after frontmatter}
 Last action: {last meaningful line of SUMMARY.md, or "none"}
-─────────────────────────────────────
+
+---
 Resume with: /gsd-quick resume {slug}
 ```
 

package/vscode/package.json

@@ -2,7 +2,7 @@
   "name": "gsd-core-vscode",
   "displayName": "GSD Core",
   "description": "GSD orchestration engine embedded in VS Code (ADR-1239 IDE profile).",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "publisher": "opengsd",
   "engines": {
     "vscode": "^1.105.0"

package/bin/lib/ui-safety-gate.cjs

@@ -1,109 +0,0 @@
-'use strict';
-
-/**
- * UI Safety Gate — shell-free implementation (#3706, #3718)
- *
- * Replaces the bash shell-based one-liner that silently degraded on Windows
- * PowerShell / cmd.exe because the locale env-var prefix was not recognised.
- * This module runs inside Node.js — no shell dependency, works identically
- * on bash, Git-Bash, PowerShell, and cmd.exe.
- *
- * Word-boundary anchoring:
- *   (^|[^a-zA-Z0-9])(TOKEN)([^a-zA-Z0-9]|$)
- * Equivalent to POSIX ERE [^[:alnum:]] — matches tokens only when they are not
- * interior substrings of alphanumeric compound words (e.g. "microfrontend" is NOT
- * matched; "micro-frontend" and "micro frontend" ARE matched).
- *
- * Public API:
- *   checkUiPresence(text: string): { hasUI: boolean, tokens: string[] }
- *
- * CLI usage — reads phase-section text from STDIN to avoid ARG_MAX limits:
- *   echo "$PHASE_SECTION" | node bin/lib/ui-safety-gate.cjs
- *   echo $?   → 0 if UI tokens found, 1 if not, 2 on usage error
- *
- * Exit codes mirror grep: 0 = match found, 1 = no match, 2 = usage error.
- */
-
-const UI_TOKENS = [
-  'UI',
-  'interface',
-  'frontend',
-  'component',
-  'layout',
-  'page',
-  'screen',
-  'view',
-  'form',
-  'dashboard',
-  'widget',
-];
-
-/**
- * Built once at module load — no per-call compilation overhead.
- * ASCII word boundaries — matches the original ASCII-grep intent of #3706.
- * Note: JS [a-zA-Z0-9] is ASCII-only and NOT equivalent to POSIX [[:alnum:]],
- * which is locale-sensitive and includes accented characters.
- */
-const UI_GATE_PATTERN = new RegExp(
-  '(^|[^a-zA-Z0-9])(' + UI_TOKENS.join('|') + ')([^a-zA-Z0-9]|$)',
-  'i'
-);
-
-// Global-flagged variant for extracting ALL matches per line (matchAll).
-const UI_GATE_PATTERN_GLOBAL = new RegExp(UI_GATE_PATTERN.source, 'gi');
-
-/**
- * Check a roadmap phase section string for frontend UI indicators.
- *
- * @param {string} text - The roadmap phase section content (may be multi-line, CRLF or LF).
- * @returns {{ hasUI: boolean, tokens: string[] }}
- *   hasUI — true if any UI token was matched as a standalone word.
- *   tokens — matched token strings (lowercased), deduplicated.
- */
-function checkUiPresence(text) {
-  if (typeof text !== 'string') {
-    return { hasUI: false, tokens: [] };
-  }
-
-  // Normalise CRLF so the pattern sees consistent line boundaries.
-  const normalised = text.replace(/\r\n/g, '\n');
-
-  const found = new Set();
-  for (const line of normalised.split('\n')) {
-    // Reset lastIndex before each line so the global pattern restarts from 0.
-    UI_GATE_PATTERN_GLOBAL.lastIndex = 0;
-    for (const m of line.matchAll(UI_GATE_PATTERN_GLOBAL)) {
-      found.add(m[2].toLowerCase());
-    }
-  }
-
-  return { hasUI: found.size > 0, tokens: [...found] };
-}
-
-module.exports = { checkUiPresence, UI_TOKENS };
-
-// ── CLI entry point ─────────────────────────────────────────────────────────
-// Reads phase-section text from STDIN (not argv) to avoid OS ARG_MAX limits.
-// Invoked by workflow .md bash blocks as: echo "$PHASE_SECTION" | node bin/lib/ui-safety-gate.cjs
-// Exit 0 = UI found, 1 = no UI, 2 = startup error.
-
-if (require.main === module) {
-  // Collect stdin chunks asynchronously.
-  const chunks = [];
-  process.stdin.setEncoding('utf-8');
-
-  process.stdin.on('data', (chunk) => chunks.push(chunk));
-
-  process.stdin.on('end', () => {
-    const input = chunks.join('');
-    const result = checkUiPresence(input);
-    // eslint-disable-next-line n/no-process-exit -- CLI entry point (require.main===module): async stdin handler, nothing else terminates the process (#3059)
-    process.exit(result.hasUI ? 0 : 1);
-  });
-
-  process.stdin.on('error', (err) => {
-    process.stderr.write(`ERROR: ui-safety-gate.cjs stdin read failed: ${err.message}\n`);
-    // eslint-disable-next-line n/no-process-exit -- CLI entry point (require.main===module): async stdin handler, nothing else terminates the process (#3059)
-    process.exit(2);
-  });
-}