@opengsd/gsd-core 1.12.0 → 1.14.0

package/gsd-core/bin/lib/workstream-inventory.cjs

@@ -63,7 +63,19 @@ function countRoadmapPhases(roadmapPath, fallbackCount, cwd, ws, versionOverride
             return fallbackCount;
         if (!cwd)
             return fallbackCount;
-        const filter = getMilestonePhaseFilter(cwd, versionOverride ?? null, null, ws ?? null);
+        // #2761 B1 (trek-e review): `undefined`, NOT `null`. The third argument
+        // discriminates "not resolved yet — resolve it from this workstream's
+        // config" (`undefined`) from "resolved, and it is not bracket" (`null`).
+        // This site meant the former and spelled the latter, so a workstream that
+        // opted into `phase_id_convention: "bracket"` had its ROADMAP scanned with
+        // the LEGACY grammar: the heading set came back empty, `phaseCount` was 0,
+        // and the count silently fell back to the on-disk directory count — the
+        // very degrade the #3185 rewrite of this function existed to remove.
+        // Measured on a bracket workstream whose milestone declares 3 phases:
+        // `null` -> 0 (fallback), `undefined` -> 3. A non-bracket workstream
+        // resolves to a value that compiles the same base grammar `null` did, so
+        // its count is unchanged (verified against a legacy control).
+        const filter = getMilestonePhaseFilter(cwd, versionOverride ?? null, undefined, ws ?? null);
         // A pass-all degrade (phaseCount 0) means the window declared no phases —
         // fall back rather than reporting a confident zero.
         return filter.phaseCount > 0 ? filter.phaseCount : fallbackCount;
@@ -437,7 +449,13 @@ function inspectWorkstream(cwd, name, options = {}) {
     // filtering. Consulted only when it is genuinely scoped to a single milestone
     // (`versionScoped`); the unversioned whole-roadmap shape spans the project's
     // lifetime and would re-admit prior-milestone phases — the very defect here.
-    const headingFilter = getMilestonePhaseFilter(cwd, currentVersion, null, name);
+    //
+    // #2761 B1 (trek-e review): `undefined`, not `null` — same discriminator fix
+    // as `countRoadmapPhases` above. This site iterates workstreams by NAME, so
+    // it is exactly the caller that cannot set `GSD_WORKSTREAM`; spelling `null`
+    // pinned every workstream to the legacy grammar and made `headingScoped`
+    // unreachable (`phaseCount > 0` never held) on a bracket workstream.
+    const headingFilter = getMilestonePhaseFilter(cwd, currentVersion, undefined, name);
     const headingScoped = headingFilter.versionScoped && headingFilter.phaseCount > 0;
     // Phase keys the ROADMAP attributes to some OTHER milestone. A row carrying an
     // explicit version that is not the current one is a positive claim by a prior
@@ -715,6 +733,7 @@ module.exports = {
     inspectWorkstream,
     isCompletedInventory: workstream_inventory_builder_cjs_1.isCompletedInventory,
     listWorkstreamInventories,
+    readCurrentMilestoneVersion,
     sortWorkstreamInventories,
     workstreamsRoot,
 };

package/gsd-core/bin/lib/worktree-safety.cjs

@@ -14,6 +14,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+const security_cjs_1 = require("./security.cjs");
 // Default timeout for worktree-related git subprocess calls.
 // 10 s is generous enough for normal git operations on large repos while still
 // providing a deterministic failure path when git stalls (locked index, hung
@@ -509,6 +510,11 @@ const SUMMARY_ARTIFACT_SUFFIX = 'SUMMARY.md';
  * (a trailing lone backslash, or an octal escape with fewer than three
  * digits) never throws — it degrades to treating the character literally, so
  * a single bad path can never take down the whole cleanup wave.
+ *
+ * Exported (#4081) so the codebase-drift gate's `--name-status` parser can
+ * decode the identical C-quoted form before classifying paths — the gate's
+ * `execGit` call sets no `core.quotepath` config, so it receives the same
+ * quoting and must decode it with the same single owner of this seam.
  */
 function decodeGitQuotedPath(raw) {
     if (raw.length < 2 || !raw.startsWith('"') || !raw.endsWith('"'))
@@ -573,7 +579,7 @@ function normalizeScopePath(raw) {
  */
 function isSummaryArtifactRelPath(relPath) {
     const normalized = normalizeScopePath(relPath);
-    return normalized.startsWith(`${SUMMARY_ARTIFACT_DIR}/`)
+    return normalized.startsWith(`${SUMMARY_ARTIFACT_DIR}/`) // allow-handrolled-containment: artifact-type classification by a fixed known subdirectory name, not a filesystem root-confinement gate
         && normalized.endsWith(SUMMARY_ARTIFACT_SUFFIX);
 }
 /**
@@ -767,7 +773,8 @@ function planWaveScopeConformance(changedPaths, declaredFiles, branch) {
         seen.add(changed);
         if (isSummaryArtifactRelPath(changed))
             continue;
-        const covered = prefixes.some((prefix) => (prefix === null || changed === prefix || changed.startsWith(`${prefix}/`)));
+        const covered = prefixes.some((prefix) => (prefix === null || changed === prefix || changed.startsWith(`${prefix}/`) // allow-handrolled-containment: advisory scope-coverage match against a caller-declared prefix (documented above as deliberately distinct from a security gate) — not a filesystem root-confinement decision
+        ));
         if (covered)
             continue;
         warnings.push({ code: WAVE_CLEANUP_WARNING.SCOPE_OUT_OF_DECLARED, branch, path: changed });
@@ -1576,11 +1583,15 @@ function cmdWorktreeCreate(cwd, args = [], deps = {}) {
     {
         const absRoot = node_path_1.default.resolve(cwd, rootFlag);
         const absWorktree = node_path_1.default.resolve(cwd, plan.entry.worktree_path);
-        const rel = node_path_1.default.relative(absRoot, absWorktree);
-        // rel === ''           → the worktree IS the root (would clobber the checkout)
-        // rel === '..' / '../…' → escapes the root
-        // path.isAbsolute(rel) → a different Windows drive or UNC root
-        if (rel === '' || rel === '..' || rel.startsWith(`..${node_path_1.default.sep}`) || node_path_1.default.isAbsolute(rel)) {
+        // Lexical containment (ADR-4650): the worktree does not exist yet, so there is
+        // nothing to realpath. Both operands are already resolved above, so the shared
+        // `isContainedIn` comparison applies directly (mirrors the already-resolved-caller
+        // exception documented on `isContainedIn`) — a different Windows drive/UNC root
+        // fails the prefix comparison the same way an escaping relative path does.
+        // The canonical predicate treats target === root as CONTAINED; this call site
+        // explicitly REJECTS that case (absWorktree === absRoot below), because a worktree
+        // AT the root would clobber the checkout — the inversion this migration preserves.
+        if (absWorktree === absRoot || !(0, security_cjs_1.isContainedIn)(absWorktree, absRoot)) {
             const hint = `--path must resolve INSIDE --root (root="${absRoot}", path="${absWorktree}"). A worktree outside the declared root is unreachable by manifest-scoped cleanup and would let a spawned executor write outside the project.`;
             writeErr(`[gsd] worktree.create: path_outside_root — ${hint}\n`);
             write(`${JSON.stringify({ ok: false, reason: 'path_outside_root', hint }, null, 2)}\n`);
@@ -1986,6 +1997,9 @@ function pruneOrphanedWorktrees(repoRoot, deps = {}) {
     return [];
 }
 module.exports = {
+    // Re-exported for the codebase-drift gate's --name-status parser (#4081):
+    // single owner of git C-quoted-path decoding.
+    decodeGitQuotedPath,
     resolveWorktreeContext,
     resolveWorktreeLinkage,
     parseWorktreePorcelain,

package/gsd-core/bin/shared/config-defaults.manifest.json

@@ -38,6 +38,7 @@
     "ui_phase": true,
     "ui_safety_gate": true,
     "text_mode": false,
+    "compact_content": false,
     "research_before_questions": false,
     "discuss_mode": "discuss",
     "skip_discuss": false,

package/gsd-core/bin/shared/config-schema.manifest.json

@@ -22,6 +22,7 @@
     "workflow.smart_zone_tokens",
     "workflow.human_verify_mode",
     "workflow.text_mode",
+    "workflow.compact_content",
     "workflow.research_before_questions",
     "workflow.discuss_mode",
     "workflow.skip_discuss",
@@ -45,6 +46,7 @@
     "git.branching_strategy",
     "git.base_branch",
     "git.protected_branches",
+    "git.allow_default_branch_commits",
     "git.create_tag",
     "git.phase_branch_template",
     "git.milestone_branch_template",
@@ -53,6 +55,8 @@
     "planning.pr_strict",
     "planning.search_gitignored",
     "planning.sub_repos",
+    "planning.chunked_parallel",
+    "agent_tools",
     "review.default_reviewers",
     "review.max_prompt_tokens",
     "review.max_prompt_tokens_per_reviewer",
@@ -72,7 +76,11 @@
     "planner.stall_threshold_minutes",
     "workflow.inline_plan_threshold",
     "hooks.context_warnings",
+    "hooks.context_warning_threshold",
+    "hooks.context_critical_threshold",
     "hooks.workflow_guard",
+    "hooks.commit_types",
+    "hooks.community",
     "workflow.context_coverage_gate",
     "statusline.show_last_command",
     "statusline.context_position",
@@ -118,6 +126,11 @@
     "workflow._auto_chain_active"
   ],
   "dynamicKeyPatterns": [
+    {
+      "topLevel": "agent_tools",
+      "source": "^agent_tools\\.(\\*|[a-zA-Z0-9_-]+)$",
+      "description": "agent_tools.<selector>"
+    },
     {
       "topLevel": "agent_skills",
       "source": "^agent_skills\\.[a-zA-Z0-9_-]+$",