@opengsd/gsd-core 1.13.0 → 1.15.0

package/gsd-core/bin/lib/project-root.cjs

@@ -17,12 +17,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.setExplicitProjectRoot = setExplicitProjectRoot;
+exports.resolveProjectRoot = resolveProjectRoot;
 exports.findProjectRoot = findProjectRoot;
 exports.consentProjectRoot = consentProjectRoot;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
 const FIND_PROJECT_ROOT_MAX_DEPTH = 10;
+// #4894: an operator-supplied `--project-dir` IS the project root — the
+// dispatcher validates it and skips the ancestor walk-up for `cwd`, but code
+// that derives a root from a PHASE DIRECTORY (verification) never sees `cwd`.
+// The dispatcher records the validated root here, once per process, and those
+// callers resolve through `resolveProjectRoot`. `null` (the default, and what
+// the dispatcher sets when the flag is absent) leaves `findProjectRoot`'s
+// walk-up as the only source of truth, so no-flag behavior is unchanged.
+let explicitProjectRoot = null;
+function setExplicitProjectRoot(root) {
+    explicitProjectRoot = root;
+}
+function resolveProjectRoot(startDir) {
+    return explicitProjectRoot ?? findProjectRoot(startDir);
+}
 function findProjectRoot(startDir) {
     let resolvedStart;
     try {
@@ -43,12 +59,35 @@ function findProjectRoot(startDir) {
     catch {
         // fall through
     }
+    // A `.planning` that is itself a symlink is a deliberate hop into a separate
+    // tree (the documented "keep planning content out of the tracked repo"
+    // convention: `.planning -> ~/.gsd-external-planning/<project>/`, its own git
+    // repo). `fs.existsSync(d + '/.git')` DEREFERENCES `d`, so at `d ===
+    // <the .planning symlink path>` it finds the EXTERNAL store's `.git`, and
+    // both isInsideGitRepo/nearestGitRoot misread it as a crossed nested-child-
+    // repo boundary (#2843's guard). `fs.lstatSync` does not dereference its
+    // final path component, so it answers "is `d` ITSELF a symlink" (#4815).
+    //
+    // Deliberately scoped to a symlink named `.planning`, NOT any symlinked
+    // directory: a nested child repo reached through some other symlinked
+    // ancestor is still a real repo boundary, and skipping it would reopen
+    // #2843 through a different trigger.
+    function isSymlinkedPlanningDir(d) {
+        if (node_path_1.default.basename(d) !== '.planning')
+            return false;
+        try {
+            return node_fs_1.default.lstatSync(d).isSymbolicLink();
+        }
+        catch {
+            return false;
+        }
+    }
     // Walk upward, mirroring isInsideGitRepo from the CJS reference.
     function isInsideGitRepo(candidateParent) {
         let d = resolvedStart;
         while (d !== fsRoot) {
             try {
-                if (node_fs_1.default.existsSync(d + node_path_1.default.sep + '.git'))
+                if (!isSymlinkedPlanningDir(d) && node_fs_1.default.existsSync(d + node_path_1.default.sep + '.git'))
                     return true;
             }
             catch {
@@ -77,7 +116,7 @@ function findProjectRoot(startDir) {
             if (d === upTo)
                 break;
             try {
-                if (node_fs_1.default.existsSync(d + node_path_1.default.sep + '.git'))
+                if (!isSymlinkedPlanningDir(d) && node_fs_1.default.existsSync(d + node_path_1.default.sep + '.git'))
                     return d;
             }
             catch {

package/gsd-core/bin/lib/quick-batch.cjs

@@ -210,7 +210,7 @@ function parseTaskListFromFile(cwd, filePath) {
     const root = planningRoot(cwd);
     let safePath;
     try {
-        safePath = (0, security_cjs_1.requireSafePath)(filePath, root, 'quick-batch --file', { allowAbsolute: true });
+        safePath = (0, security_cjs_1.requireSafePath)(filePath, root, 'quick-batch --file', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
     }
     catch (err) {
         return { ok: false, reason: err instanceof Error ? err.message : String(err) };

package/gsd-core/bin/lib/refactor-trigger-command-router.cjs

@@ -35,6 +35,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+const security_cjs_1 = require("./security.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -174,8 +175,11 @@ function resolvePhaseDirForArg(cwd, phaseArg) {
  */
 function resolveConfinedPath(cwd, relFile) {
     const root = node_path_1.default.resolve(cwd);
-    const resolved = node_path_1.default.resolve(root, relFile);
-    if (resolved !== root && !resolved.startsWith(root + node_path_1.default.sep))
+    // ADR-4650 decision 6: lexical family — resolving the symlink here would
+    // undo the refuse-don't-resolve posture documented above; `lstatSync` below
+    // is the gate that actually refuses a symlink.
+    const resolved = (0, security_cjs_1.tryWithinRootLexical)(relFile, root);
+    if (resolved === null)
         return null;
     try {
         if (!node_fs_1.default.lstatSync(resolved).isFile())
@@ -321,6 +325,32 @@ function loadWindowsOrDegrade(cwd, windowsOverride) {
     }
     return { ok: true, windows, ledger };
 }
+/**
+ * #3780: lazy (module-load cost, see file header) require of the ledger's
+ * serialization seam — the same `.planning/.WINDOWS.lock` the windows cmd*
+ * writers hold, so this router's own read-compute-write cycles on
+ * WINDOWS.md cannot lose updates against them. Required from the REAL
+ * compiled module, never through the injectable `windowsOverride` seam:
+ * the lock is infrastructure, not a parser stand-in.
+ */
+function withLedgerLock(cwd, fn) {
+    let lockMod;
+    try {
+        /* eslint-disable @typescript-eslint/no-require-imports */
+        lockMod = require('./broken-windows.cjs');
+        /* eslint-enable @typescript-eslint/no-require-imports */
+    }
+    catch {
+        // Ledger module unavailable (the #1953 degrade world — see the row-86
+        // notesLedgerUnavailableWithoutBrokenWindows contract): no lock-holding
+        // writer can exist either, because every WINDOWS.md writer requires this
+        // same module. Run the body unlocked and let loadWindowsOrDegrade
+        // produce the canonical degrade note — wrapping that world in lock
+        // ceremony would only rewrite the note the degrade contract pins.
+        return fn();
+    }
+    return lockMod.withLedgerLock(cwd, fn);
+}
 /**
  * Strict-mode window append (step 9 of `evaluate`). Degrades to
  * `{ recorded: false, note }` per `loadWindowsOrDegrade` — never an error,
@@ -329,6 +359,23 @@ function loadWindowsOrDegrade(cwd, windowsOverride) {
  * file/line) and does not append a second one.
  */
 function recordStrictWindow(cwd, padded, target, windowsOverride) {
+    // #3780: hold the same cross-process ledger lock the windows cmd* writers
+    // hold — this site's read-compute-write on WINDOWS.md is otherwise the
+    // same lost-update race: a concurrent `gsd_run windows append` (or another
+    // evaluator) could silently overwrite this entry, or be overwritten by
+    // it. The lock comes from the real ledger module, not the injectable
+    // `windowsOverride` seam — it is infrastructure, not a parser stand-in.
+    // The wrapper keeps the #1953-defect-2 degrade contract: the lock's typed
+    // refusal degrades to `{ recorded: false, note }` like every other
+    // failure, it never throws out of this function.
+    try {
+        return withLedgerLock(cwd, () => recordStrictWindowLocked(cwd, padded, target, windowsOverride));
+    }
+    catch (e) {
+        return { recorded: false, note: `failed to record broken-windows entry: ${e instanceof Error ? e.message : String(e)}` };
+    }
+}
+function recordStrictWindowLocked(cwd, padded, target, windowsOverride) {
     const loaded = loadWindowsOrDegrade(cwd, windowsOverride);
     if (!loaded.ok)
         return { recorded: false, note: loaded.note };
@@ -357,6 +404,18 @@ function recordStrictWindow(cwd, padded, target, windowsOverride) {
  * `accept`/`decline` never tell a user "it failed" without saying why.
  */
 function resolveLedgerWindow(cwd, padded, file, line, kind, reasonText, windowsOverride) {
+    // #3780: same serialization as recordStrictWindow — a concurrent ledger
+    // writer holding a stale snapshot would silently revert this resolve (or
+    // lose its own write to this one). Same degrade contract: the lock's
+    // typed refusal degrades, never throws.
+    try {
+        return withLedgerLock(cwd, () => resolveLedgerWindowLocked(cwd, padded, file, line, kind, reasonText, windowsOverride));
+    }
+    catch (e) {
+        return { resolved: false, note: `failed to resolve broken-windows entry: ${e instanceof Error ? e.message : String(e)}` };
+    }
+}
+function resolveLedgerWindowLocked(cwd, padded, file, line, kind, reasonText, windowsOverride) {
     const loaded = loadWindowsOrDegrade(cwd, windowsOverride);
     if (!loaded.ok)
         return { resolved: false, note: loaded.note };

package/gsd-core/bin/lib/research-store.cjs

@@ -15,6 +15,10 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// ADR-4650 decision 6: lexical family — the key is validated before
+// `fs.mkdirSync` creates the store dir, so the candidate legitimately does
+// not exist yet at check time.
+const security_cjs_1 = require("./security.cjs");
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -94,15 +98,12 @@ function putResearch(cwd, key, payload, { clock = Date, homeDir = node_os_1.defa
     const fetched_at = new Date(clock.now()).toISOString();
     const entry = { content, source, provider, confidence, fetched_at, ttl, kind };
     const dir = resolveStorePath(cwd, source, { homeDir });
-    // Belt-and-suspenders: ensure the resolved file path stays inside the store dir.
-    const resolvedDir = node_path_1.default.resolve(dir);
-    const filePath = node_path_1.default.join(dir, `${key}.json`);
-    const resolvedFile = node_path_1.default.resolve(filePath);
-    if (!resolvedFile.startsWith(resolvedDir + node_path_1.default.sep)) {
+    const containedFile = (0, security_cjs_1.tryWithinRootLexical)(`${key}.json`, dir);
+    if (containedFile === null || containedFile === node_path_1.default.resolve(dir)) {
         throw new Error('invalid research key');
     }
     node_fs_1.default.mkdirSync(dir, { recursive: true });
-    (0, shell_command_projection_cjs_1.platformWriteSync)(filePath, JSON.stringify(entry));
+    (0, shell_command_projection_cjs_1.platformWriteSync)(containedFile, JSON.stringify(entry));
     return entry;
 }
 // ---------------------------------------------------------------------------
@@ -120,16 +121,14 @@ function getResearch(cwd, key, { clock = Date, homeDir = node_os_1.default.homed
         const tierDirs = [userDir, projectDir];
         const candidates = [];
         for (const dir of tierDirs) {
-            const resolvedDir = node_path_1.default.resolve(dir);
-            const filePath = node_path_1.default.join(dir, `${key}.json`);
-            // Belt-and-suspenders: ensure path stays inside tier dir
-            if (!node_path_1.default.resolve(filePath).startsWith(resolvedDir + node_path_1.default.sep))
+            const containedFile = (0, security_cjs_1.tryWithinRootLexical)(`${key}.json`, dir);
+            if (containedFile === null || containedFile === node_path_1.default.resolve(dir))
                 continue;
-            if (!node_fs_1.default.existsSync(filePath))
+            if (!node_fs_1.default.existsSync(containedFile))
                 continue;
             let entry;
             try {
-                entry = JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
+                entry = JSON.parse(node_fs_1.default.readFileSync(containedFile, 'utf8'));
             }
             catch {
                 // Corrupt file in this tier — skip it

package/gsd-core/bin/lib/review-lane-descriptor.cjs

@@ -64,7 +64,7 @@ exports.checkReviewerDocsParity = checkReviewerDocsParity;
  * `args` is an argv TEMPLATE, not a prefix. The injected pieces — model, effort, output file,
  * argv-borne prompt — do not all go in the same place, and no positional rule expresses that:
  * `codex` injects the model in the MIDDLE (after the `exec --ephemeral` subcommand) and the output
- * file later still, while `gemini` injects the model first and five lanes end with a bare `-` that
+ * file later still, while `kimi-code` injects the model first and five lanes end with a bare `-` that
  * must stay last. Splicing by position silently produced
  * `codex --model M -o F exec --ephemeral …`, which is not a valid codex invocation.
  *
@@ -94,36 +94,16 @@ const SPAWN_STDIN_STDOUT = {
     outputChannel: 'stdout',
 };
 /**
- * The twelve declared lanes, in `write_reviews` order.
+ * The eleven declared lanes, in `write_reviews` order.
+ *
+ * The `gemini` lane was retired by #4709: Google sunset Gemini CLI on 2026-06-18 (the same
+ * sunset that removed the gemini RUNTIME in #1928/1.8.0), so the lane spawned a binary that no
+ * longer serves the free/Pro/Ultra tiers that are GSD's audience.
  *
  * `kimi-code` joined in Phase 5b (#2799, closes #2718) — ADR-2782's phase table lands it here
  * rather than in 5a precisely so it arrives together with the iteration that can invoke it.
  */
 exports.REVIEWER_LANES = Object.freeze([
-    {
-        slug: 'gemini',
-        flags: ['--gemini'],
-        transport: 'spawn',
-        probe: { kind: 'command-exists', binary: 'gemini' },
-        invoke: {
-            binary: 'gemini',
-            args: ['{{model}}', '-p', '-'],
-            ...SPAWN_STDIN_STDOUT,
-            modelArg: '-m',
-            effortChannel: 'none',
-        },
-        timeoutFloorMs: 900_000,
-        timeoutConfigKey: 'review.timeouts.gemini',
-        emptyOutput: 'stub-with-stderr',
-        reviewsSection: 'Gemini',
-        evidenceClass: 'source-grounded',
-        requiresBinaries: [],
-        promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.gemini',
-        modelConfigKey: 'review.models.gemini',
-        effortConfigKey: null,
-        defaultEffort: null,
-        handler: null,
-    },
     {
         // 1_200_000 rather than the 900_000 floor: headless Claude measured ~525 s
         // on a large plan set (review.md:304).
@@ -139,8 +119,8 @@ exports.REVIEWER_LANES = Object.freeze([
             effortChannel: 'argv',
             // #2483: without these the claude leg is the only reviewer that additionally inherits the
             // invoking user's global CLAUDE.md, the project CLAUDE.md, and Claude Code auto-memory —
-            // a context asymmetry against the independent-review premise (gemini sees only the
-            // assembled prompt; codex runs --ephemeral). Both flags, not just the first: CLAUDE.md
+            // a context asymmetry against the independent-review premise (codex sees only the
+            // assembled prompt and runs --ephemeral). Both flags, not just the first: CLAUDE.md
             // loading and auto-memory are independently-toggled mechanisms, and an environment
             // exporting CLAUDE_CODE_DISABLE_AUTO_MEMORY=0 forces auto-memory back ON — the explicit
             // pair is robust against that. Applies when /gsd:review runs from a non-Claude-Code host;
@@ -796,7 +776,7 @@ const NON_LANE_SIGNATURE_FLAGS = new Set(['--all']);
 /**
  * Is `flag` documented in `text` under one of the two structural shapes docs actually use?
  *
- * Backticked is the `COMMANDS.md` table-cell shape; bracketed (`[--gemini]`) is the
+ * Backticked is the `COMMANDS.md` table-cell shape; bracketed (`[--codex]`) is the
  * `FEATURES.md` signature shape. Requiring one of those two delimiters — rather than a bare
  * substring — is what keeps prose and fenced examples from satisfying the gate, and it bounds the
  * token for free: a backticked `--claude` demands its closing backtick, so a backticked
@@ -889,7 +869,7 @@ const BRACKETED_FLAG_RE = /\[(--[a-z0-9][a-z0-9-]*)\]/g;
  * cell 3. A file-scoped check is therefore satisfied by the forwarding row alone, so deleting a
  * lane's actual table row — the exact #2781 regression — passes. Keying on cell 1 separates the
  * two: `| `--agy` / `--antigravity` | … |` is one lane row declaring two flags, while
- * `| Reviewer flags | No | … `--gemini`, `--claude` … |` is not a lane row at all.
+ * `| Reviewer flags | No | … `--codex`, `--claude` … |` is not a lane row at all.
  */
 function flagsInFirstTableCell(lines, declared) {
     const found = new Set();

package/gsd-core/bin/lib/review-lane-invocation.cjs

@@ -31,6 +31,8 @@ exports.resolveTimeoutMs = resolveTimeoutMs;
 exports.nativeTimeoutToken = nativeTimeoutToken;
 exports.isEmptyReview = isEmptyReview;
 exports.fileRefPrompt = fileRefPrompt;
+exports.artifactPaths = artifactPaths;
+exports.resolveLaneBudget = resolveLaneBudget;
 exports.resolveLanePlan = resolveLanePlan;
 const review_lane_descriptor_cjs_1 = require("./review-lane-descriptor.cjs");
 /* ------------------------------------------------------------------ *
@@ -236,6 +238,27 @@ function artifactPaths(runDir, slug) {
         errPath: `${base}/gsd-review-${slug}.err`,
     };
 }
+/**
+ * Per-lane prompt budget (#2797 semantics, preserved exactly).
+ *
+ * `-1` is the UNSET sentinel and falls back to the central `review.max_prompt_tokens`, because
+ * `0` is a legitimate value meaning "do not trim this lane". Treating 0 as unset would silently
+ * switch a user who deliberately disabled trimming onto the global budget.
+ *
+ * Single source of truth: `gsd-core/bin/gsd-tools.cjs`'s `review-lane plan`/`invoke` and
+ * `src/reviewer-step-dispatch.cts`'s `dispatchReviewerLanes` both resolve a lane's budget through
+ * this function rather than each carrying their own copy (#4209 R3 — two verbatim copies drift).
+ */
+function resolveLaneBudget(lane, configGet) {
+    if (!lane.promptBudgetKey)
+        return null;
+    const per = configGet(lane.promptBudgetKey);
+    const isNum = (v) => typeof v === 'number' && Number.isFinite(v);
+    if (isNum(per) && per !== -1)
+        return per;
+    const global = configGet('review.max_prompt_tokens');
+    return isNum(global) ? global : null;
+}
 /* ------------------------------------------------------------------ *
  * Resolution
  * ------------------------------------------------------------------ */

package/gsd-core/bin/lib/review-reviewer-selection.cjs

@@ -20,7 +20,7 @@
  * `reviewer` bodies in the capability registry, not a hand-maintained tail.
  * A capability of EITHER `role: "runtime"` (the six dual-purpose hosts —
  * antigravity/claude/codex/cursor/opencode/qwen) or the lane-only
- * `role: "reviewer"` (gemini/coderabbit/ollama/lm_studio/llama_cpp) may carry
+ * `role: "reviewer"` (coderabbit/ollama/lm_studio/llama_cpp) may carry
  * a `reviewer` body, and it is the body's `reviewer.slug` — NOT the capability
  * id — that becomes the roster entry: the two differ for `lm-studio` (id) /
  * `lm_studio` (slug) and `llama-cpp` (id) / `llama_cpp` (slug), ADR-2782's
@@ -229,7 +229,7 @@ function resolveReviewerSelection(input) {
         // ADR-2782 D4: absent-safe governs DISCOVERY, never explicit selection.
         // Not finding a lane nobody asked for is normal; failing to run a lane
         // somebody asked for is an error. Every miss used to be an `info`, so a
-        // PARTIAL miss (`--gemini --qwen` with qwen absent) ran the review with a
+        // PARTIAL miss (`--codex --qwen` with qwen absent) ran the review with a
         // thinner reviewer set while present_results reported success — "a cross-AI
         // review that silently drops a lane is blind in one eye" (review.md).
         // A total miss already errored, but only as a side effect of the selected