@opengsd/gsd-core 1.12.0 → 1.14.0

package/gsd-core/bin/lib/surface.cjs

@@ -165,7 +165,7 @@ function normalizeSkillManifest(runtimeConfigDir, manifest) {
  *   - registry is threaded into resolveProfile so capability skills
  *     participate in the base skill set and their requires: chains expand.
  */
-function resolveSurface(runtimeConfigDir, manifest, clusterMap, registry) {
+function resolveSurface(runtimeConfigDir, manifest, clusterMap, registry, surfaceOverride) {
     // Merge capability clusters into the cluster map when registry is provided.
     // The ADR-857 phase 4a HARD gate guarantees that when a capId matches a CLUSTERS
     // key, the values are EQUAL — so the spread is idempotent for matching names.
@@ -205,7 +205,7 @@ function resolveSurface(runtimeConfigDir, manifest, clusterMap, registry) {
         cm = merged;
     }
     const skillManifest = normalizeSkillManifest(runtimeConfigDir, manifest);
-    const surface = readSurface(runtimeConfigDir);
+    const surface = surfaceOverride === undefined ? readSurface(runtimeConfigDir) : surfaceOverride;
     // Determine base profile name: from surface state or from .gsd-profile marker
     const baseProfileName = (surface && surface.baseProfile)
         ? surface.baseProfile
@@ -316,10 +316,9 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
         os: deps.os, env: deps.env,
     });
     const skillManifest = normalizeSkillManifest(layout.configDir, manifest);
-    const resolved = resolveSurface(layout.configDir, skillManifest, clusterMap, registry);
-    // Profile toggles must converge retired surfaces too. Once a kind disappears
-    // from artifactLayout there is no normal sync pass left to prune it (#2644).
-    retiredArtifactCleanup.pruneRetiredRuntimeArtifacts(layout.runtime, layout.configDir);
+    const hasCandidateState = opts !== undefined && Object.prototype.hasOwnProperty.call(opts, 'surfaceState');
+    const candidateState = hasCandidateState ? (opts.surfaceState ?? null) : undefined;
+    const resolved = resolveSurface(layout.configDir, skillManifest, clusterMap, registry, candidateState);
     // #1575: agents kind now mirrors createRuntimeArtifactInstallPlan — build
     // agentCtx (pathPrefix + attribution) and pass it to kind.stage() so
     // stageAgentsForRuntimeWithConverter applies the full inline-loop pipeline
@@ -353,7 +352,7 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
     // not referenced by any skill's _calls_agents_ manifest entry would be silently
     // dropped from the surface path. For tiered profiles (core/standard) or when
     // surface mods exist, pass the resolved set so only the filtered subset stages.
-    const _surfaceState = readSurface(layout.configDir);
+    const _surfaceState = candidateState === undefined ? readSurface(layout.configDir) : candidateState;
     const _baseProfileName = (_surfaceState && _surfaceState.baseProfile)
         ? _surfaceState.baseProfile
         : (readActiveProfile(layout.configDir) || 'full');
@@ -361,17 +360,29 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
         _surfaceState.explicitAdds.length > 0 ||
         _surfaceState.explicitRemoves.length > 0);
     const _isUnmodifiedFull = _baseProfileName === 'full' && !_hasSurfaceMods;
+    const stagedKinds = [];
     try {
         for (const kind of layout.kinds) {
             let staged;
-            if (kind.kind === 'agents') {
+            // #4211: kimi-agents is an AGENT kind — kimiAgentsKind.stage() forwards
+            // agentCtx into stageAgentsForRuntimeWithConverter exactly as agentsKind
+            // does, and createRuntimeArtifactInstallPlan hands every kind the
+            // context. Staging it bare here dropped the path-prefix rewrites and the
+            // attribution trailer from Kimi's generated subagents, and (under an
+            // unmodified `full` profile) staged only the skill-referenced subset the
+            // install path stages with `skills: '*'`.
+            if (kind.kind === 'agents' || kind.kind === 'kimi-agents') {
                 const agentProfile = _isUnmodifiedFull ? { ...resolved, skills: '*' } : resolved;
                 staged = kind.stage(agentProfile, agentCtx);
             }
             else {
                 staged = kind.stage(resolved);
             }
-            if (kind.kind === 'skills') {
+            // #4211: kimi-agents takes the skill-body rewrite too —
+            // createRuntimeArtifactInstallPlan routes `skills` and `kimi-agents`
+            // through rewriteStagedSkillBodies together, so omitting it here left
+            // Kimi's surface-materialized prompts with unrewritten paths.
+            if (kind.kind === 'skills' || kind.kind === 'kimi-agents') {
                 runtimeArtifactConversion.rewriteStagedSkillBodies(staged, {
                     runtime: layout.runtime,
                     configDir: layout.configDir,
@@ -396,7 +407,22 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
             // the parity test in tests/runtime-artifact-layout-surface.test.cjs
             // enforces that the two writers never diverge again.
             const dest = assertDestWithinConfigHome(kind.home ?? layout.configDir, kind.destSubpath);
-            _syncGsdDir(staged, dest, kind, skillManifest, layout.runtime);
+            stagedKinds.push({ kind, staged, dest });
+        }
+        // Do not mutate installed artifacts until every kind has staged
+        // successfully. A missing source provider therefore leaves both artifacts
+        // and the persisted surface state untouched.
+        retiredArtifactCleanup.pruneRetiredRuntimeArtifacts(layout.runtime, layout.configDir);
+        for (const item of stagedKinds) {
+            _syncGsdDir(item.staged, item.dest, item.kind, skillManifest, layout.runtime);
+        }
+        if (hasCandidateState) {
+            if (candidateState === null) {
+                node_fs_1.default.rmSync(node_path_1.default.join(runtimeConfigDir, SURFACE_FILE_NAME), { force: true });
+            }
+            else if (candidateState !== undefined) {
+                writeSurface(runtimeConfigDir, candidateState);
+            }
         }
     }
     finally {
@@ -557,6 +583,53 @@ function _syncGsdDir(stagedDir, destDir, kind, manifest, runtime) {
     // (no agentFileExtension declared) keep the staged filename verbatim.
     const _agentExt = runtime ? runtimeArtifactConversion.agentFileExtensionFor(runtime) : undefined;
     const isRenamedAgents = !!_agentExt && kindName === 'agents';
+    if (kindName === 'kimi-agents') {
+        // #4211: Kimi's managed tree is `gsd.yaml` + `gsd.md` + `subagents/gsd-*.{yaml,md}`
+        // (runtime-artifact-layout.cts kimiAgentsKind), and install copies it
+        // RECURSIVELY (_copyStaged in src/install-engine.cts). Surface apply fell
+        // through to the flat command/agent branch below, which reads only `*.md`
+        // at the top level: the YAML half and the whole subagents/ subtree were
+        // dropped, and `gsd.md` was written as `gsdgsd.md` (the flat branch
+        // re-applies kind.prefix to a name that already carries it). A surface
+        // change could therefore corrupt Kimi's installed artifacts while still
+        // reporting success.
+        node_fs_1.default.cpSync(stagedDir, destDir, { recursive: true });
+        // Prune GSD-owned files the new surface no longer stages, with exactly the
+        // ownership rule install's _removeGsdEntries applies to this kind: the two
+        // root files, and `gsd-`-prefixed .yaml/.md under subagents/. Everything
+        // else in the directory is user-owned and is preserved.
+        const _rootStaged = new Set(node_fs_1.default.readdirSync(stagedDir));
+        for (const fileName of ['gsd.yaml', 'gsd.md']) {
+            if (!_rootStaged.has(fileName)) {
+                try {
+                    node_fs_1.default.rmSync(node_path_1.default.join(destDir, fileName), { force: true });
+                }
+                catch { /* ignore */ }
+            }
+        }
+        const _stagedSubagentsDir = node_path_1.default.join(stagedDir, 'subagents');
+        const _destSubagentsDir = node_path_1.default.join(destDir, 'subagents');
+        const _stagedSubagents = node_fs_1.default.existsSync(_stagedSubagentsDir)
+            ? new Set(node_fs_1.default.readdirSync(_stagedSubagentsDir))
+            : new Set();
+        if (node_fs_1.default.existsSync(_destSubagentsDir)) {
+            for (const entry of node_fs_1.default.readdirSync(_destSubagentsDir, { withFileTypes: true })) {
+                if (!entry.isFile())
+                    continue;
+                if (!entry.name.startsWith('gsd-'))
+                    continue;
+                if (!entry.name.endsWith('.yaml') && !entry.name.endsWith('.md'))
+                    continue;
+                if (_stagedSubagents.has(entry.name))
+                    continue;
+                try {
+                    node_fs_1.default.rmSync(node_path_1.default.join(_destSubagentsDir, entry.name), { force: true });
+                }
+                catch { /* ignore */ }
+            }
+        }
+        return;
+    }
     if (kindName === 'skills') {
         // Skills kind: work with directories, not files.
         // Each staged entry is a directory named ${prefix}${stem}.

package/gsd-core/bin/lib/task-command-router.cjs

@@ -11,6 +11,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const security_cjs_1 = require("./security.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
 const { output, error, ERROR_REASON } = ioMod;
@@ -108,12 +109,14 @@ function routeResolveContent({ args, cwd, raw }, deps = {}) {
         return;
     }
     const projectRoot = node_path_1.default.resolve(cwd || process.cwd());
-    const resolvedPlanPath = node_path_1.default.resolve(projectRoot, plan);
-    const rel = node_path_1.default.relative(projectRoot, resolvedPlanPath);
-    if (rel === '..' || rel.startsWith(`..${node_path_1.default.sep}`)) {
+    // Lexical containment (ADR-4650): this path is validated before existence is
+    // checked below, so realpath resolution is neither available nor required.
+    const contained = (0, security_cjs_1.tryWithinRootLexical)(plan, projectRoot);
+    if (contained === null) {
         error(`Plan file is outside project scope: ${plan}`, ERROR_REASON.USAGE);
         return;
     }
+    const resolvedPlanPath = contained;
     if (!node_fs_1.default.existsSync(resolvedPlanPath)) {
         error(`Plan file not found: ${plan}`, ERROR_REASON.USAGE);
         return;
@@ -173,11 +176,14 @@ function routeTaskCommand({ args, cwd, raw }) {
     else if (args[2]) {
         const projectRoot = node_path_1.default.resolve(cwd || process.cwd());
         const requestedPath = args[2];
-        const resolvedTaskPath = node_path_1.default.resolve(projectRoot, requestedPath);
-        const rel = node_path_1.default.relative(projectRoot, resolvedTaskPath);
-        if (rel === '..' || rel.startsWith(`..${node_path_1.default.sep}`)) {
+        // Lexical containment (ADR-4650): validated before existence is checked below.
+        // `error()` here does not return/throw (preserved from before this migration),
+        // so resolvedTaskPath must still be computed identically on the rejected path.
+        const contained = (0, security_cjs_1.tryWithinRootLexical)(requestedPath, projectRoot);
+        if (contained === null) {
             error(`Task file is outside project scope: ${requestedPath}`, ERROR_REASON.USAGE);
         }
+        const resolvedTaskPath = contained ?? node_path_1.default.resolve(projectRoot, requestedPath);
         if (!node_fs_1.default.existsSync(resolvedTaskPath)) {
             error(`Task file not found: ${requestedPath}`, ERROR_REASON.USAGE);
         }

package/gsd-core/bin/lib/tdd-red-evidence.cjs

@@ -0,0 +1,133 @@
+"use strict";
+/**
+ * TDD RED-evidence classification (#3770).
+ *
+ * The `type: tdd` executor gate previously accepted ANY nonzero test command as
+ * RED: syntax errors, zero-test discovery, fixture crashes, parser errors, and
+ * unrelated assertions all authorized production edits (GREEN). This module
+ * defines the compact RED evidence the gate now requires — the TARGET test's
+ * identity plus a matching assertion failure — and classifies a persisted test
+ * run into exactly one verdict:
+ *
+ *   RED_EVIDENCE_OK  — nonzero exit AND the target test failed as a REAL test
+ *                      (distinctly named, TAP-reported failure). The ONLY
+ *                      verdict that may advance to GREEN.
+ *   INVALID_RED      — everything else, with a machine-readable reason:
+ *                      unexpected_green | zero_tests_discovered |
+ *                      nonzero_exit_without_test_failure |
+ *                      fixture_or_load_failure | no_target_test_failure |
+ *                      invalid_record | unreadable_record (router arm).
+ *
+ * Everything here is PURE — no fs, no spawn, no clock — so the executor can
+ * persist the record (command, exit code, failing test, expected, actual) and
+ * validate it via `gsd_run check tdd-red-evidence <record.json>`.
+ *
+ * TAP parsing reuses the proven primitives from prohibition-enforcement
+ * (`parseNodeTestSummary`, `tapFailedTestNames`) — the same contract the
+ * prohibition probe's fail-first prover already relies on (#1259).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyRedEvidence = classifyRedEvidence;
+exports.buildRedEvidenceRecord = buildRedEvidenceRecord;
+const prohibition_enforcement_cjs_1 = require("./prohibition-enforcement.cjs");
+/** Basename of a path-like string ('' for non-strings) — separators `/` and `\`. */
+function baseOf(p) {
+    return typeof p === 'string' ? (p.split(/[\\/]/).pop() ?? p) : '';
+}
+/** Coerce and validate the raw record's scalar fields. Returns null exit_code only when absent/non-numeric. */
+function readInput(input) {
+    const command = typeof input?.command === 'string' ? input.command : '';
+    const output = typeof input?.output === 'string' ? input.output : '';
+    const targetTest = typeof input?.targetTest === 'string' ? input.targetTest.trim() : '';
+    const exitCode = typeof input?.exitCode === 'number' && Number.isFinite(input.exitCode) ? input.exitCode : null;
+    if (!command || !targetTest || exitCode === null)
+        return null;
+    return { command, exitCode, output, targetTest };
+}
+/**
+ * Classify a persisted RED-phase test run. Fail-closed: malformed input, an
+ * unparseable/empty TAP summary, a file-named (load/crash) failure, or a
+ * failure that is not the target test's are all INVALID_RED — only a nonzero
+ * exit WITH the distinctly-named target test failing is RED_EVIDENCE_OK.
+ * Never throws.
+ */
+function classifyRedEvidence(input) {
+    const parsed = readInput(input);
+    if (!parsed) {
+        return {
+            verdict: 'INVALID_RED',
+            reason: 'invalid_record',
+            evidence: {
+                command: typeof input?.command === 'string' ? input.command : '',
+                exit_code: null,
+                target_test: '',
+                tests: 0,
+                pass: 0,
+                fail: 0,
+                failing_tests: [],
+            },
+        };
+    }
+    const { command, exitCode, output, targetTest } = parsed;
+    const summary = (0, prohibition_enforcement_cjs_1.parseNodeTestSummary)(output);
+    const failing = (0, prohibition_enforcement_cjs_1.tapFailedTestNames)(output);
+    const evidence = {
+        command,
+        exit_code: exitCode,
+        target_test: targetTest,
+        tests: summary.tests,
+        pass: summary.pass,
+        fail: summary.fail,
+        failing_tests: failing,
+    };
+    // Existing fail-fast rule, now machine-checked: exit 0 during RED is an
+    // unexpected GREEN — the feature may already exist or the test is wrong.
+    if (exitCode === 0) {
+        return { verdict: 'INVALID_RED', reason: 'unexpected_green', evidence };
+    }
+    // Zero-test discovery: the discovery pattern / fixture matched no tests.
+    // A run that executed nothing cannot prove anything about the behavior.
+    if (summary.tests === 0) {
+        return { verdict: 'INVALID_RED', reason: 'zero_tests_discovered', evidence };
+    }
+    // Nonzero exit but TAP reports no failing test: harness/setup/parser crash
+    // whose failure never reached a test assertion (or unparseable output).
+    if (summary.fail === 0 || failing.length === 0) {
+        return { verdict: 'INVALID_RED', reason: 'nonzero_exit_without_test_failure', evidence };
+    }
+    // Fixture/load failure: every failing entry is named like the target FILE —
+    // node reports a load-time crash (throw-on-require, syntax error, ENOENT
+    // fixture) as a file-named `not ok 1 - <file>`, never the target test.
+    const targetBase = baseOf(input?.targetFile ?? '');
+    const distinctlyNamed = failing.filter((n) => (targetBase ? baseOf(n) !== targetBase : true));
+    if (distinctlyNamed.length === 0) {
+        return { verdict: 'INVALID_RED', reason: 'fixture_or_load_failure', evidence };
+    }
+    // Unrelated failure: real tests ran and failed, but none is the target test
+    // the plan named — an unrelated assertion must not authorize GREEN.
+    if (!distinctlyNamed.includes(targetTest)) {
+        return { verdict: 'INVALID_RED', reason: 'no_target_test_failure', evidence };
+    }
+    return { verdict: 'RED_EVIDENCE_OK', reason: 'target_test_failed', evidence };
+}
+/**
+ * Project a classification into the persisted record shape — command, exit
+ * code, failing test, expected, actual, verdict, reason — so the evidence
+ * survives past the terminal and the gate can re-verify it deterministically.
+ * Pure: JSON-serializable, no timestamps (the record's mtime/commit carries time).
+ */
+function buildRedEvidenceRecord(input, result) {
+    const failingTest = result.evidence.failing_tests.find((n) => n === result.evidence.target_test) ??
+        result.evidence.failing_tests[0] ??
+        null;
+    return {
+        command: result.evidence.command,
+        exit_code: result.evidence.exit_code,
+        failing_test: failingTest,
+        target_test: result.evidence.target_test,
+        expected: typeof input?.expected === 'string' ? input.expected : null,
+        actual: typeof input?.actual === 'string' ? input.actual : null,
+        verdict: result.verdict,
+        reason: result.reason,
+    };
+}