@opengsd/gsd-core 1.12.0 → 1.14.0

package/gsd-core/bin/lib/capability-source.cjs

@@ -677,8 +677,25 @@ function stageValidated(opts) {
             throw new Error(`Hook fragment validation failed: ${fragErrs.join('; ')}`);
         }
         // Cross-capability validations (contract, consumes, cross-capability).
-        const capMap = new Map([[id, cap]]);
-        const centralKeys = new Set();
+        //
+        // #3929: seed the validation set the way the loader builds its accepted
+        // map — frozen first-party registry, then each committed overlay of the
+        // TARGET (global) install scope accepted incrementally (structural +
+        // engines + full-suite-clean), then the candidate LAST (mirroring
+        // `acceptedMap.set(id, cap)`). The singleton seed
+        // `new Map([[id, cap]])` this replaced made every non-empty `requires`
+        // unsatisfiable (membership is checked against the map) and left cycles,
+        // tier-monotone and central config-key exclusivity vacuous at install.
+        // The seed builder lives in capability-loader so the overlay semantics
+        // have one owner and are clean by construction — pre-existing junk in the
+        // install scope is skipped, never attributed to the candidate. No swallow:
+        // if the loader cannot build the seed the install fails loudly — silently
+        // degrading to the singleton map would re-hide #3929.
+        /* eslint-disable @typescript-eslint/no-require-imports */
+        const seedLoader = require('./capability-loader.cjs');
+        /* eslint-enable @typescript-eslint/no-require-imports */
+        const { capMap, centralKeys } = seedLoader.crossValidationSeed(process.cwd(), gsdHome, hostVersion, capValidator, semverMod);
+        capMap.set(id, cap);
         const crossErrs = [
             ...capValidator.validateAgainstContract(cap, id),
             ...capValidator.validateConsumesGlobal(capMap),

package/gsd-core/bin/lib/capability-state.cjs

@@ -39,7 +39,7 @@ const ioMod = require("./io.cjs");
 const { output: coreOutput, error: coreError } = ioMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const activationMod = require("./capability-activation.cjs");
-const { _resolveActivationValue } = activationMod;
+const { _resolveActivationValue, _resolvePointGate } = activationMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderMod = require("./config-loader.cjs");
 const { loadConfig } = configLoaderMod;
@@ -179,6 +179,12 @@ function resolveCapabilityState(input) {
                     // (mirrors loop-resolver.isActive: `typeof when !== 'string' || when.length === 0` → false)
                     configured = false;
                 }
+                // #3661: optional point-selection gate, ANDed in — mirrors loop-resolver.isActive
+                // EXACTLY (see capability-activation.cts's _resolvePointGate doc comment; this
+                // parity is load-bearing, see tests/capability-precedence-parity.test.cjs).
+                if (configured) {
+                    configured = _resolvePointGate(h['pointFrom'], point, config, cwd, registry);
+                }
                 // Hook active = capability-level active AND hook's own config gate.
                 // The capability's `active` constant (= enabled && configActivation) is
                 // used here so that a config-disabled capability (active=false) cannot

package/gsd-core/bin/lib/capability-validator.cjs

@@ -1643,6 +1643,28 @@ function validateRuntimeBody(cap) {
           ' (or "undocumented") (got: ' + JSON.stringify(d.isolation) + ')',
         );
       }
+
+      // maxConcurrency — ADR-1239 Phase 1 (#3673). A numeric dispatch
+      // sub-field (not a closed-vocabulary enum member — same numeric
+      // dispatch sub-field treatment as maxDepth above; unlike maxDepth,
+      // 0 and negative values are invalid — 1 is the fail-closed floor, not
+      // a legitimate "no concurrency" declaration).
+      // OPTIONAL, like isolation: added after existing descriptors, so an
+      // omitted maxConcurrency is legitimate — negotiateHostCapabilities
+      // degrades it to 1 (the safe floor) and warns, exactly as for any
+      // other undeclared dispatch sub-field. Only a PRESENT value is
+      // checked against the positive-safe-integer contract.
+      if (d.maxConcurrency === undefined) {
+        // absent — nothing to validate; negotiateHostCapabilities fails it closed.
+      } else if (
+        d.maxConcurrency !== 'undocumented' &&
+        (!Number.isSafeInteger(d.maxConcurrency) || d.maxConcurrency < 1)
+      ) {
+        errors.push(
+          'runtime.hostIntegration.dispatch.maxConcurrency must be a positive safe integer or "undocumented" ' +
+          '(got: ' + JSON.stringify(d.maxConcurrency) + ')',
+        );
+      }
     }
   }
 
@@ -1824,9 +1846,29 @@ const KNOWN_REVIEWER_FIELDS = new Set([
   // missed a configured model and silently disabled the pinned-model escape hatch
   // #2073 added. A convention one shipped lane already violates is not a contract.
   'modelConfigKey',
+  // `timeoutConfigKey` added by #3274, same optional/backward-compatible shape as
+  // `modelConfigKey` above: a manifest authored before this field existed must keep validating.
+  'timeoutConfigKey',
+  // `effortConfigKey` / `defaultEffort` added by #4255, same optional/backward-compatible shape
+  // as the two above. Lane effort used to be resolved by querying the `gsd-plan-checker` AGENT
+  // through a hardcoded id, so every prompt-fed lane ran at that verifier's frontmatter effort;
+  // it is a property of the review, so the lane declares it. A manifest authored before these
+  // fields existed must keep validating — absent is read as "this lane declares no review
+  // effort", which emits no effort argument at all.
+  'effortConfigKey',
+  'defaultEffort',
   'handler',
 ]);
 
+/**
+ * The effort levels a lane may declare as its review default (#4255, #3533 vocabulary).
+ *
+ * `inherit` is deliberately NOT a member. It is a legitimate CONFIGURED value — it selects "emit
+ * no argument, the CLI's own configuration decides" — but as a DECLARED default it would be a
+ * second spelling of `null` and split one behaviour across two shapes.
+ */
+const REVIEWER_EFFORT_LEVELS = new Set(['minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
+
 /**
  * The closed `runtime.hostBehaviors` vocabulary (ADR-1016, closed via #2801).
  *
@@ -1914,6 +1956,11 @@ const KNOWN_HOST_BEHAVIORS = new Set([
   'sourceMarkerFile',
   'tomlConfigInstall',
   'trackCategoryDescription',
+  // #2586: declares runtime-level feature axes GSD does not/cannot support on
+  // this host (e.g. Codex's `["context-warnings","phase-lifecycle-display"]`)
+  // — present-and-populated / absent-is-unsupported-empty convention, so
+  // omitting the key on every other runtime carries no inverted meaning.
+  'unsupportedFeatures',
   'verificationStyle',
   'writeCategoryDescription',
 ]);
@@ -2371,6 +2418,50 @@ function validateReviewerBodyFields(cap) {
     );
   }
 
+  // OPTIONAL, mirroring modelConfigKey's D4 forward/backward-compat treatment (#3274): a manifest
+  // authored before this field existed must keep validating. Absent/null means "no override for
+  // this lane, use timeoutFloorMs". An empty string is neither absent nor a key, and is rejected.
+  if (r.timeoutConfigKey !== undefined && r.timeoutConfigKey !== null &&
+      (typeof r.timeoutConfigKey !== 'string' || r.timeoutConfigKey.length === 0)) {
+    errors.push(
+      ctx + ' reviewer.timeoutConfigKey must be a dotted config key or null ' +
+      '(got: ' + describeValue(r.timeoutConfigKey) + ')',
+    );
+  }
+
+  // OPTIONAL, mirroring the two keys above (#4255). Absent/null means "this lane declares no
+  // review effort", which is the shape that emits no effort argument at all — the correct state
+  // for the nine lanes with no effort channel to feed. An empty string is neither.
+  if (r.effortConfigKey !== undefined && r.effortConfigKey !== null &&
+      (typeof r.effortConfigKey !== 'string' || r.effortConfigKey.length === 0)) {
+    errors.push(
+      ctx + ' reviewer.effortConfigKey must be a dotted config key or null ' +
+      '(got: ' + describeValue(r.effortConfigKey) + ')',
+    );
+  }
+
+  // A declared default must be a level the effort axis knows, or the lane would render an
+  // argument the reviewer CLI rejects and kill itself on every run. Closed vocabulary, checked
+  // here rather than at resolution time so a malformed manifest fails at the trust boundary.
+  if (r.defaultEffort !== undefined && r.defaultEffort !== null
+      && !(typeof r.defaultEffort === 'string' && REVIEWER_EFFORT_LEVELS.has(r.defaultEffort))) {
+    errors.push(
+      ctx + ' reviewer.defaultEffort must be one of ' +
+      Array.from(REVIEWER_EFFORT_LEVELS).join('/') + ' or null ' +
+      '(got: ' + describeValue(r.defaultEffort) + ')',
+    );
+  }
+
+  // A default with nothing to configure it through is a value the operator cannot change — the
+  // shape #4255 exists to end. Declared together or not at all.
+  if ((r.defaultEffort !== undefined && r.defaultEffort !== null)
+      && (r.effortConfigKey === undefined || r.effortConfigKey === null)) {
+    errors.push(
+      ctx + ' reviewer.defaultEffort is declared without an effortConfigKey, so the level ' +
+      'could never be overridden',
+    );
+  }
+
   // `null` is the declared "no per-lane budget"; an empty string is not.
   if (r.promptBudgetKey !== null && (typeof r.promptBudgetKey !== 'string' || r.promptBudgetKey.length === 0)) {
     errors.push(
@@ -2710,7 +2801,7 @@ function materializeHookFragments(cap, capDir) {
 
       const abs = path.resolve(capDir, fragment.path);
       const capRoot = path.resolve(capDir);
-      if (abs !== capRoot && !abs.startsWith(capRoot + path.sep)) {
+      if (abs !== capRoot && !abs.startsWith(capRoot + path.sep)) { // allow-handrolled-containment: committed pre-build .cjs; compiled security.cjs is untracked build output
         errors.push(
           cap.id + '/' + groupName + '[' + i + '].fragment.path escapes capability directory: ' +
           fragment.path,
@@ -2858,6 +2949,18 @@ function validateStep(step, prefix, declaredSkills, declaredAgents) {
     errors.push(prefix + '.when must be a string if present');
   }
 
+  if (step.pointFrom !== undefined && typeof step.pointFrom !== 'string') {
+    errors.push(prefix + '.pointFrom must be a string if present');
+  }
+
+  // #4209 DISP-02: strict optional boolean opt-in trait. Absent or false is
+  // inert; only a literal `true` reaches the projected active hook. Reject
+  // every other type (including truthy non-boolean values) so a typo can
+  // never silently opt a step into reviewer-lane dispatch.
+  if (step.supportsReviewerLanes !== undefined && typeof step.supportsReviewerLanes !== 'boolean') {
+    errors.push(prefix + '.supportsReviewerLanes must be a boolean if present');
+  }
+
   if (step.fragment !== undefined) {
     errors.push(...validateFragment(step.fragment, prefix + '.fragment'));
   }
@@ -2997,6 +3100,31 @@ function validateAgainstContract(cap, capId) {
     }
   }
 
+  // pointFrom (#3661): selects which of possibly several same-capability steps is
+  // active for its own `point`, based on an enum config key. Require it references
+  // an enum key in cap.config whose values include THIS step's own point — otherwise
+  // the step could never activate (a silently-dead step).
+  for (const step of cap.steps) {
+    if (step.pointFrom !== undefined) {
+      if (typeof step.pointFrom !== 'string') continue; // already reported above
+      const slice = typeof cap.config === 'object' && cap.config !== null ? cap.config[step.pointFrom] : undefined;
+      if (!slice || typeof slice !== 'object') {
+        errors.push(
+          prefix + ' step.pointFrom "' + step.pointFrom + '" is not defined in capability config keys',
+        );
+      } else if (slice.type !== 'enum') {
+        errors.push(
+          prefix + ' step.pointFrom "' + step.pointFrom + '" must reference an enum config key (got type: ' + slice.type + ')',
+        );
+      } else if (!Array.isArray(slice.values) || !slice.values.includes(step.point)) {
+        errors.push(
+          prefix + ' step.pointFrom "' + step.pointFrom + '" enum values do not include this step\'s own point "' +
+          step.point + '" — the step could never activate',
+        );
+      }
+    }
+  }
+
   for (const contrib of cap.contributions) {
     if (contrib.when !== undefined) {
       if (typeof contrib.when !== 'string') continue;
@@ -3605,11 +3733,12 @@ const HOOK_GROUP_KINDS = Object.freeze({
  * double-report.
  *
  * KNOWN LIMITATION (#3606): coverage is the UNION across all call sites for a
- * point in the five STEP_WORKFLOWS host files. Consumers outside that universe
- * (quick.md, autonomous.md, code-review*.md, audit-milestone.md,
+ * point in HOST_LOOP_FILES. Quick's plan:pre planner contribution seam has an
+ * additional generator-owned per-file check. Other consumers outside that
+ * universe (autonomous.md, code-review*.md, audit-milestone.md,
  * secure-phase.md, validate-phase.md) are not per-file checked — a narrowed
- * consumer there passes as long as one host file covers the point. Per-file
- * coverage maps are the tightening path.
+ * consumer there passes as long as one host file covers the point. More
+ * per-file coverage maps are the tightening path.
  *
  * @param {object}   cap       Validated capability object.
  * @param {Map<string, Set<string>>} wiredKinds  Per point, the hook kinds the

package/gsd-core/bin/lib/capability-writer.cjs

@@ -184,6 +184,7 @@ function setCapabilityState(cwd, runtimeConfigDir, desired, opts) {
         };
     }
     // ── Step 4: APPLY PASS ────────────────────────────────────────────────────
+    let pendingSurfaceForCommit;
     // ── Surface writes ────────────────────────────────────────────────────────
     if (needsSurface && (idsToDisable.length > 0 || idsToEnable.length > 0)) {
         const existing = readSurface(resolvedConfigDir);
@@ -242,13 +243,19 @@ function setCapabilityState(cwd, runtimeConfigDir, desired, opts) {
             }
         }
         if (surfaceChanged) {
-            writeSurface(resolvedConfigDir, pendingSurface);
+            pendingSurfaceForCommit = pendingSurface;
         }
     }
     // ── Config writes (once, batched) ─────────────────────────────────────────
     if (pendingGateWrites.length > 0) {
         setConfigValues(cwd, pendingGateWrites);
     }
+    // State-only callers preserve the existing direct-write behavior. A caller
+    // that requests materialization lets applySurface publish the candidate only
+    // after every artifact kind has staged and synchronized successfully.
+    if (pendingSurfaceForCommit && !opts?.materialize) {
+        writeSurface(resolvedConfigDir, pendingSurfaceForCommit);
+    }
     // ── Materialize (optional) ────────────────────────────────────────────────
     if (opts?.materialize) {
         const { runtime, scope } = opts.materialize;
@@ -274,9 +281,12 @@ function setCapabilityState(cwd, runtimeConfigDir, desired, opts) {
             // folded:issue-1575-agent-descriptor-parity describe block in
             // tests/golden-parity-single-source.test.cjs).
             // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-            applySurface(resolvedConfigDir, layout, manifest, undefined, registry, opts?.materialize?.resolveAttribution
-                ? { resolveAttribution: opts.materialize.resolveAttribution }
-                : undefined);
+            applySurface(resolvedConfigDir, layout, manifest, undefined, registry, {
+                ...(pendingSurfaceForCommit ? { surfaceState: pendingSurfaceForCommit } : {}),
+                ...(opts.materialize.resolveAttribution
+                    ? { resolveAttribution: opts.materialize.resolveAttribution }
+                    : {}),
+            });
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);