@opengsd/gsd-core 1.12.0 → 1.14.0

package/gsd-core/bin/lib/refactor-trigger-command-router.cjs

@@ -35,6 +35,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+const security_cjs_1 = require("./security.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -174,8 +175,11 @@ function resolvePhaseDirForArg(cwd, phaseArg) {
  */
 function resolveConfinedPath(cwd, relFile) {
     const root = node_path_1.default.resolve(cwd);
-    const resolved = node_path_1.default.resolve(root, relFile);
-    if (resolved !== root && !resolved.startsWith(root + node_path_1.default.sep))
+    // ADR-4650 decision 6: lexical family — resolving the symlink here would
+    // undo the refuse-don't-resolve posture documented above; `lstatSync` below
+    // is the gate that actually refuses a symlink.
+    const resolved = (0, security_cjs_1.tryWithinRootLexical)(relFile, root);
+    if (resolved === null)
         return null;
     try {
         if (!node_fs_1.default.lstatSync(resolved).isFile())
@@ -321,6 +325,32 @@ function loadWindowsOrDegrade(cwd, windowsOverride) {
     }
     return { ok: true, windows, ledger };
 }
+/**
+ * #3780: lazy (module-load cost, see file header) require of the ledger's
+ * serialization seam — the same `.planning/.WINDOWS.lock` the windows cmd*
+ * writers hold, so this router's own read-compute-write cycles on
+ * WINDOWS.md cannot lose updates against them. Required from the REAL
+ * compiled module, never through the injectable `windowsOverride` seam:
+ * the lock is infrastructure, not a parser stand-in.
+ */
+function withLedgerLock(cwd, fn) {
+    let lockMod;
+    try {
+        /* eslint-disable @typescript-eslint/no-require-imports */
+        lockMod = require('./broken-windows.cjs');
+        /* eslint-enable @typescript-eslint/no-require-imports */
+    }
+    catch {
+        // Ledger module unavailable (the #1953 degrade world — see the row-86
+        // notesLedgerUnavailableWithoutBrokenWindows contract): no lock-holding
+        // writer can exist either, because every WINDOWS.md writer requires this
+        // same module. Run the body unlocked and let loadWindowsOrDegrade
+        // produce the canonical degrade note — wrapping that world in lock
+        // ceremony would only rewrite the note the degrade contract pins.
+        return fn();
+    }
+    return lockMod.withLedgerLock(cwd, fn);
+}
 /**
  * Strict-mode window append (step 9 of `evaluate`). Degrades to
  * `{ recorded: false, note }` per `loadWindowsOrDegrade` — never an error,
@@ -329,6 +359,23 @@ function loadWindowsOrDegrade(cwd, windowsOverride) {
  * file/line) and does not append a second one.
  */
 function recordStrictWindow(cwd, padded, target, windowsOverride) {
+    // #3780: hold the same cross-process ledger lock the windows cmd* writers
+    // hold — this site's read-compute-write on WINDOWS.md is otherwise the
+    // same lost-update race: a concurrent `gsd_run windows append` (or another
+    // evaluator) could silently overwrite this entry, or be overwritten by
+    // it. The lock comes from the real ledger module, not the injectable
+    // `windowsOverride` seam — it is infrastructure, not a parser stand-in.
+    // The wrapper keeps the #1953-defect-2 degrade contract: the lock's typed
+    // refusal degrades to `{ recorded: false, note }` like every other
+    // failure, it never throws out of this function.
+    try {
+        return withLedgerLock(cwd, () => recordStrictWindowLocked(cwd, padded, target, windowsOverride));
+    }
+    catch (e) {
+        return { recorded: false, note: `failed to record broken-windows entry: ${e instanceof Error ? e.message : String(e)}` };
+    }
+}
+function recordStrictWindowLocked(cwd, padded, target, windowsOverride) {
     const loaded = loadWindowsOrDegrade(cwd, windowsOverride);
     if (!loaded.ok)
         return { recorded: false, note: loaded.note };
@@ -357,6 +404,18 @@ function recordStrictWindow(cwd, padded, target, windowsOverride) {
  * `accept`/`decline` never tell a user "it failed" without saying why.
  */
 function resolveLedgerWindow(cwd, padded, file, line, kind, reasonText, windowsOverride) {
+    // #3780: same serialization as recordStrictWindow — a concurrent ledger
+    // writer holding a stale snapshot would silently revert this resolve (or
+    // lose its own write to this one). Same degrade contract: the lock's
+    // typed refusal degrades, never throws.
+    try {
+        return withLedgerLock(cwd, () => resolveLedgerWindowLocked(cwd, padded, file, line, kind, reasonText, windowsOverride));
+    }
+    catch (e) {
+        return { resolved: false, note: `failed to resolve broken-windows entry: ${e instanceof Error ? e.message : String(e)}` };
+    }
+}
+function resolveLedgerWindowLocked(cwd, padded, file, line, kind, reasonText, windowsOverride) {
     const loaded = loadWindowsOrDegrade(cwd, windowsOverride);
     if (!loaded.ok)
         return { resolved: false, note: loaded.note };

package/gsd-core/bin/lib/research-store.cjs

@@ -15,6 +15,10 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// ADR-4650 decision 6: lexical family — the key is validated before
+// `fs.mkdirSync` creates the store dir, so the candidate legitimately does
+// not exist yet at check time.
+const security_cjs_1 = require("./security.cjs");
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -94,15 +98,12 @@ function putResearch(cwd, key, payload, { clock = Date, homeDir = node_os_1.defa
     const fetched_at = new Date(clock.now()).toISOString();
     const entry = { content, source, provider, confidence, fetched_at, ttl, kind };
     const dir = resolveStorePath(cwd, source, { homeDir });
-    // Belt-and-suspenders: ensure the resolved file path stays inside the store dir.
-    const resolvedDir = node_path_1.default.resolve(dir);
-    const filePath = node_path_1.default.join(dir, `${key}.json`);
-    const resolvedFile = node_path_1.default.resolve(filePath);
-    if (!resolvedFile.startsWith(resolvedDir + node_path_1.default.sep)) {
+    const containedFile = (0, security_cjs_1.tryWithinRootLexical)(`${key}.json`, dir);
+    if (containedFile === null || containedFile === node_path_1.default.resolve(dir)) {
         throw new Error('invalid research key');
     }
     node_fs_1.default.mkdirSync(dir, { recursive: true });
-    (0, shell_command_projection_cjs_1.platformWriteSync)(filePath, JSON.stringify(entry));
+    (0, shell_command_projection_cjs_1.platformWriteSync)(containedFile, JSON.stringify(entry));
     return entry;
 }
 // ---------------------------------------------------------------------------
@@ -120,16 +121,14 @@ function getResearch(cwd, key, { clock = Date, homeDir = node_os_1.default.homed
         const tierDirs = [userDir, projectDir];
         const candidates = [];
         for (const dir of tierDirs) {
-            const resolvedDir = node_path_1.default.resolve(dir);
-            const filePath = node_path_1.default.join(dir, `${key}.json`);
-            // Belt-and-suspenders: ensure path stays inside tier dir
-            if (!node_path_1.default.resolve(filePath).startsWith(resolvedDir + node_path_1.default.sep))
+            const containedFile = (0, security_cjs_1.tryWithinRootLexical)(`${key}.json`, dir);
+            if (containedFile === null || containedFile === node_path_1.default.resolve(dir))
                 continue;
-            if (!node_fs_1.default.existsSync(filePath))
+            if (!node_fs_1.default.existsSync(containedFile))
                 continue;
             let entry;
             try {
-                entry = JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
+                entry = JSON.parse(node_fs_1.default.readFileSync(containedFile, 'utf8'));
             }
             catch {
                 // Corrupt file in this tier — skip it

package/gsd-core/bin/lib/review-lane-descriptor.cjs

@@ -45,6 +45,9 @@
  *   4. `flags: string[]` — Antigravity is selected by BOTH `--antigravity` and
  *      `--agy`, which a single-valued field cannot express. This also flattens
  *      D8's uniqueness invariant across every lane's flags.
+ *   5. `NATIVE_TIMEOUT` — a lane whose CLI takes its own native inner timeout flag (today only
+ *      antigravity's `--print-timeout`) declares where the resolved value goes; `resolveLanePlan`
+ *      computes what it is from the same resolved outer `timeoutMs` (#3274).
  *
  * Phase 2 (#2795) implements the manifest validator against the amended
  * vocabulary, which is the point of amending rather than leaving it to be
@@ -69,7 +72,7 @@ exports.checkReviewerDocsParity = checkReviewerDocsParity;
  * and vanishes when it has nothing to contribute (no model configured, no effort channel, prompt on
  * stdin), which is what lets one template serve the configured and unconfigured cases.
  *
- * This is a closed four-member vocabulary with no expressions, no nesting and no conditionals — a
+ * This is a closed five-member vocabulary with no expressions, no nesting and no conditionals — a
  * placeholder set, deliberately not a template language. The moment it needs a conditional, the
  * lane wants a `handler` instead (D6).
  */
@@ -82,6 +85,9 @@ exports.ARGV_PLACEHOLDER = Object.freeze({
     OUTPUT: '{{output}}',
     /** The argv-borne prompt, or nothing unless `promptChannel` is `argv`/`argv-file-ref`. */
     PROMPT: '{{prompt}}',
+    /** A lane's own CLI-native inner timeout duration, derived from the resolved outer `timeoutMs`
+     * (never independently configured) — see `resolveLanePlan`'s expansion of this token. */
+    NATIVE_TIMEOUT: '{{nativeTimeout}}',
 });
 const SPAWN_STDIN_STDOUT = {
     promptChannel: 'stdin',
@@ -107,12 +113,15 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'none',
         },
         timeoutFloorMs: 900_000,
+        timeoutConfigKey: 'review.timeouts.gemini',
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'Gemini',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.gemini',
         modelConfigKey: 'review.models.gemini',
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: null,
     },
     {
@@ -139,12 +148,15 @@ exports.REVIEWER_LANES = Object.freeze([
             env: { CLAUDE_CODE_DISABLE_CLAUDE_MDS: '1', CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1' },
         },
         timeoutFloorMs: 1_200_000,
+        timeoutConfigKey: 'review.timeouts.claude',
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'Claude',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.claude',
         modelConfigKey: 'review.models.claude',
+        effortConfigKey: 'review.effort.claude',
+        defaultEffort: 'high',
         handler: null,
     },
     {
@@ -167,12 +179,15 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'argv',
         },
         timeoutFloorMs: 1_200_000,
+        timeoutConfigKey: 'review.timeouts.codex',
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'Codex',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.codex',
         modelConfigKey: 'review.models.codex',
+        effortConfigKey: 'review.effort.codex',
+        defaultEffort: 'high',
         handler: null,
     },
     {
@@ -192,6 +207,7 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'none',
         },
         timeoutFloorMs: 360_000,
+        timeoutConfigKey: null,
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'CodeRabbit',
         evidenceClass: 'diff-only',
@@ -199,6 +215,8 @@ exports.REVIEWER_LANES = Object.freeze([
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.coderabbit',
         // Accepts no model flag at all (review.md:367) — not merely "none configured".
         modelConfigKey: null,
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: null,
     },
     {
@@ -217,6 +235,7 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'argv',
         },
         timeoutFloorMs: 660_000,
+        timeoutConfigKey: 'review.timeouts.opencode',
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'OpenCode',
         evidenceClass: 'source-grounded',
@@ -225,6 +244,8 @@ exports.REVIEWER_LANES = Object.freeze([
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.opencode',
         modelConfigKey: 'review.models.opencode',
+        effortConfigKey: 'review.effort.opencode',
+        defaultEffort: 'high',
         // Phase 5b (#2799): was `null`. The review is REBUILT from assistant `text` parts; a plain
         // stdout copy would write the raw JSON envelope as the review (#1936). See LaneHandler.
         handler: 'opencode',
@@ -242,12 +263,15 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'none',
         },
         timeoutFloorMs: 900_000,
+        timeoutConfigKey: null,
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'Qwen',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.qwen',
         modelConfigKey: null,
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: null,
     },
     {
@@ -260,19 +284,23 @@ exports.REVIEWER_LANES = Object.freeze([
         probe: { kind: 'command-exists', binary: 'cursor-agent' },
         invoke: {
             binary: 'cursor-agent',
-            args: ['-p', '--mode', 'ask', '--trust', '--output-format', 'text', '{{prompt}}'],
+            args: ['-p', '{{model}}', '--mode', 'ask', '--trust', '--output-format', 'text', '{{prompt}}'],
             promptChannel: 'argv-file-ref',
             outputChannel: 'stdout',
-            modelArg: null,
+            modelArg: '--model',
             effortChannel: 'none',
         },
         timeoutFloorMs: 900_000,
+        timeoutConfigKey: null,
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'Cursor',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.cursor',
-        modelConfigKey: null,
+        // #3653: cursor-agent exposes --model (204 selectable models); wired the same as codex.
+        modelConfigKey: 'review.models.cursor',
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: null,
     },
     {
@@ -286,13 +314,19 @@ exports.REVIEWER_LANES = Object.freeze([
         probe: { kind: 'command-exists', binary: 'agy' },
         invoke: {
             binary: 'agy',
-            args: ['--print-timeout', '540s', '{{model}}', '-p', '{{prompt}}'],
+            // `{{nativeTimeout}}` is the fifth ARGV_PLACEHOLDER member (#3274) — `resolveLanePlan`
+            // (review-lane-invocation.cts) expands it to a value DERIVED from this same lane's resolved
+            // outer `timeoutMs`, so the native `--print-timeout` and the outer wall-clock cap can never
+            // drift apart. No other shipped lane's `args` template contains this token, so the expansion
+            // is inert everywhere else.
+            args: ['--print-timeout', '{{nativeTimeout}}', '{{model}}', '-p', '{{prompt}}'],
             promptChannel: 'argv-file-ref',
             outputChannel: 'stdout',
             modelArg: '--model',
             effortChannel: 'none',
         },
         timeoutFloorMs: 600_000,
+        timeoutConfigKey: 'review.timeouts.antigravity',
         emptyOutput: 'handler-owned',
         reviewsSection: 'Antigravity',
         evidenceClass: 'source-grounded',
@@ -302,6 +336,8 @@ exports.REVIEWER_LANES = Object.freeze([
         // NOT `review.models.antigravity` — the shipped key is `review.models.agy` (review.md:291) and
         // Phase 4 federated it under that name. This lane is why the key is declared, not derived.
         modelConfigKey: 'review.models.agy',
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: 'antigravity',
     },
     {
@@ -323,6 +359,7 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'none',
         },
         timeoutFloorMs: 120_000,
+        timeoutConfigKey: 'review.timeouts.ollama',
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'Ollama',
         evidenceClass: 'source-grounded',
@@ -331,6 +368,8 @@ exports.REVIEWER_LANES = Object.freeze([
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.ollama',
         modelConfigKey: 'review.models.ollama',
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: 'openai-compatible',
     },
     {
@@ -352,12 +391,15 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'none',
         },
         timeoutFloorMs: 120_000,
+        timeoutConfigKey: 'review.timeouts.lm_studio',
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'LM Studio',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.lm_studio',
         modelConfigKey: 'review.models.lm_studio',
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: 'openai-compatible',
     },
     {
@@ -379,12 +421,15 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'none',
         },
         timeoutFloorMs: 120_000,
+        timeoutConfigKey: 'review.timeouts.llama_cpp',
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'llama.cpp',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.llama_cpp',
         modelConfigKey: 'review.models.llama_cpp',
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: 'openai-compatible',
     },
     {
@@ -424,12 +469,15 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'none',
         },
         timeoutFloorMs: 900_000,
+        timeoutConfigKey: 'review.timeouts.kimi-code',
         emptyOutput: 'stub-with-stderr',
         reviewsSection: 'Kimi Code',
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.kimi-code',
         modelConfigKey: 'review.models.kimi-code',
+        effortConfigKey: null,
+        defaultEffort: null,
         handler: null,
     },
 ].map((lane) => Object.freeze(lane)));

package/gsd-core/bin/lib/review-lane-invocation.cjs

@@ -26,8 +26,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LANE_UNAVAILABLE = void 0;
 exports.configString = configString;
 exports.normalizeHost = normalizeHost;
+exports.resolveLaneEffort = resolveLaneEffort;
+exports.resolveTimeoutMs = resolveTimeoutMs;
+exports.nativeTimeoutToken = nativeTimeoutToken;
 exports.isEmptyReview = isEmptyReview;
 exports.fileRefPrompt = fileRefPrompt;
+exports.artifactPaths = artifactPaths;
+exports.resolveLaneBudget = resolveLaneBudget;
 exports.resolveLanePlan = resolveLanePlan;
 const review_lane_descriptor_cjs_1 = require("./review-lane-descriptor.cjs");
 /* ------------------------------------------------------------------ *
@@ -122,6 +127,73 @@ function normalizeHost(raw) {
     const pathPart = u.pathname.replace(/\/+$/, '');
     return `${scheme}//${host}${port ? `:${port}` : ''}${pathPart}`;
 }
+/** Levels GSD's effort axis accepts (#3533). `inherit` selects the no-argument path. */
+const EFFORT_LEVELS = new Set([
+    'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'inherit',
+]);
+/**
+ * Resolve one lane's reasoning effort from REVIEW configuration (#4255).
+ *
+ * Resolution order, highest first:
+ *   1. `lane.effortConfigKey` — the per-lane review effort the operator set
+ *   2. `lane.defaultEffort` — the lane's declared review default (`high` for prompt-fed,
+ *      source-grounded lanes)
+ *   3. nothing — no effort argument is emitted and the reviewer CLI's own configuration decides
+ *
+ * A configured `'inherit'` selects (3) explicitly. An unrecognized level is REFUSED rather than
+ * passed to the host: it falls back to the lane default, because forwarding a typo would render an
+ * argument the CLI rejects and kill the lane outright.
+ *
+ * What this function deliberately does NOT do is consult any agent's execution settings. Before
+ * #4255 the level came from `gsd-plan-checker`'s installed frontmatter through a hardcoded agent
+ * id, so every lane ran at a fast structural verifier's `low` — and, because the rendered argument
+ * is a CLI config override, it silently beat the effort the operator had configured for that CLI
+ * itself. A value inherited from an unrelated agent is worse than no value at all, which is why
+ * (3) emits nothing rather than falling back to some other agent's number.
+ *
+ * `renderArgv` is injected (the host table and the ADR-2481 surface negotiation live in
+ * `model-catalog` / `commands`, above this module's layer) so this stays a pure function of its
+ * inputs and the golden lane table can assert it without a spawn.
+ */
+function resolveLaneEffort(lane, configGet, renderArgv) {
+    const none = { argv: [], value: null, source: 'none' };
+    if (!lane || typeof lane !== 'object')
+        return none;
+    const configured = lane.effortConfigKey ? configString(configGet(lane.effortConfigKey)) : null;
+    const valid = configured !== null && EFFORT_LEVELS.has(configured) ? configured : null;
+    const level = valid ?? configString(lane.defaultEffort);
+    if (level === null || level === 'inherit')
+        return none;
+    const rendered = renderArgv(lane.slug, level);
+    const argv = (rendered.argv ?? []).filter((a) => typeof a === 'string' && a !== '');
+    if (argv.length === 0)
+        return none;
+    return {
+        argv,
+        value: configString(rendered.value) ?? level,
+        source: valid !== null ? 'config' : 'lane-default',
+    };
+}
+function resolveTimeoutMs(timeoutConfigKey, floorMs, configGet) {
+    const configuredSeconds = typeof timeoutConfigKey === 'string' ? configGet(timeoutConfigKey) : undefined;
+    return typeof configuredSeconds === 'number' && Number.isFinite(configuredSeconds) && configuredSeconds > 0
+        ? configuredSeconds * 1000
+        : floorMs;
+}
+/** Buffer (seconds) a lane's native inner timeout sits under its resolved outer wall-clock cap
+ * (#3274). Matches the shipped 600s outer / 540s native relationship exactly when unconfigured:
+ * floor(600000/1000) - 60 = 540. */
+const NATIVE_TIMEOUT_BUFFER_SECONDS = 60;
+/**
+ * Render the `{{nativeTimeout}}` argv placeholder from a lane's resolved outer timeout (#3274).
+ *
+ * Clamped to a 1-second floor so a very small configured (or, today, only-ever-default) outer
+ * timeout never produces a zero or negative duration string a CLI would reject or misinterpret.
+ */
+function nativeTimeoutToken(timeoutMs) {
+    const seconds = Math.max(1, Math.floor(timeoutMs / 1000) - NATIVE_TIMEOUT_BUFFER_SECONDS);
+    return `${seconds}s`;
+}
 /**
  * Classify a lane's output as a review or as empty.
  *
@@ -166,6 +238,27 @@ function artifactPaths(runDir, slug) {
         errPath: `${base}/gsd-review-${slug}.err`,
     };
 }
+/**
+ * Per-lane prompt budget (#2797 semantics, preserved exactly).
+ *
+ * `-1` is the UNSET sentinel and falls back to the central `review.max_prompt_tokens`, because
+ * `0` is a legitimate value meaning "do not trim this lane". Treating 0 as unset would silently
+ * switch a user who deliberately disabled trimming onto the global budget.
+ *
+ * Single source of truth: `gsd-core/bin/gsd-tools.cjs`'s `review-lane plan`/`invoke` and
+ * `src/reviewer-step-dispatch.cts`'s `dispatchReviewerLanes` both resolve a lane's budget through
+ * this function rather than each carrying their own copy (#4209 R3 — two verbatim copies drift).
+ */
+function resolveLaneBudget(lane, configGet) {
+    if (!lane.promptBudgetKey)
+        return null;
+    const per = configGet(lane.promptBudgetKey);
+    const isNum = (v) => typeof v === 'number' && Number.isFinite(v);
+    if (isNum(per) && per !== -1)
+        return per;
+    const global = configGet('review.max_prompt_tokens');
+    return isNum(global) ? global : null;
+}
 /* ------------------------------------------------------------------ *
  * Resolution
  * ------------------------------------------------------------------ */
@@ -212,9 +305,10 @@ function resolveLanePlan(input) {
         return fail(exports.LANE_UNAVAILABLE.UNKNOWN_HANDLER, `lane '${slug}' names handler '${String(handler)}', which this GSD version does not provide`);
     }
     const { promptPath, reviewPath, errPath } = artifactPaths(input.runDir, slug);
-    const timeoutMs = typeof lane.timeoutFloorMs === 'number' && Number.isFinite(lane.timeoutFloorMs) && lane.timeoutFloorMs > 0
+    const floorMs = typeof lane.timeoutFloorMs === 'number' && Number.isFinite(lane.timeoutFloorMs) && lane.timeoutFloorMs > 0
         ? lane.timeoutFloorMs
         : 900_000;
+    const timeoutMs = resolveTimeoutMs(lane.timeoutConfigKey, floorMs, input.configGet);
     const emptyOutput = lane.emptyOutput === 'handler-owned' ? 'handler-owned' : 'stub-with-stderr';
     // #3194: only an EXACT 'diff-only' declaration exempts a lane from evidence verification.
     // Anything else — including a missing or garbage value on a third-party overlay body —
@@ -319,6 +413,7 @@ function resolveLanePlan(input) {
         '{{effort}}': effortExpansion,
         '{{output}}': outputExpansion,
         '{{prompt}}': promptExpansion,
+        '{{nativeTimeout}}': [nativeTimeoutToken(timeoutMs)],
     };
     const template = Array.isArray(inv.args)
         ? inv.args.filter((a) => typeof a === 'string')