@opengsd/gsd-core 1.14.0 → 1.16.0

package/gsd-core/bin/lib/cjs-command-router-adapter.cjs

@@ -21,9 +21,12 @@ const { createHub, ERROR_KINDS } = commandRoutingHub;
 // --json-errors). Enabling stderr-on-error unconditionally by default is a
 // separate, blast-radius-bearing change (it adds a second stderr line to the
 // --json-errors envelope) — deferred as its own follow-up.
+// #4975: #2620 wired only the env half — the gate was evaluated without the
+// project config. resolveDispatchLogger owns the whole opt-in decision
+// (GSD_AUDIT or `audit.enabled`) for every live seam.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const observabilityLogger = require("./observability/logger.cjs");
-const { createDefaultLogger, isAuditEnabled } = observabilityLogger;
+const { resolveDispatchLogger } = observabilityLogger;
 // Phase 2 (#1646): import ERROR_REASON so the UnknownCommand translation can
 // pass `sdk_unknown_command` as the second arg to error(), preserving the
 // JSON-error envelope contract that capability routers' tests assert on.
@@ -87,7 +90,8 @@ function routeHubCommandFamily({ family, args, subcommands, handlers, defaultSub
         // #2620: wire the reference logger onto the live dispatch path (ADR-0174 §6),
         // but only when observability is opt-in enabled — otherwise leave it unset
         // so the Hub falls back to the no-op logger and stays byte-for-byte silent.
-        logger: isAuditEnabled() ? createDefaultLogger({ cwd }) : undefined,
+        // #4975: the opt-in is GSD_AUDIT=1 or `audit.enabled` in this cwd's config.
+        logger: resolveDispatchLogger(cwd),
     });
     const result = hub.dispatch({
         family,
@@ -126,6 +130,13 @@ function routeHubCommandFamily({ family, args, subcommands, handlers, defaultSub
         error(result.reason);
         return;
     }
+    if (result.kind === ERROR_KINDS.VerificationStatusInvalid) {
+        // #5118: the Result carries the VerificationStatusError's own message and
+        // reason — the error owns its ERROR_REASON; nothing here restates it.
+        const invalid = result;
+        error(invalid.message, invalid.reason);
+        return;
+    }
     error(result.message);
 }
 module.exports = {

package/gsd-core/bin/lib/cli-exit.cjs

@@ -172,6 +172,17 @@ function setPendingOutcome(v) {
 function getPendingOutcome() {
     return globalThis[PENDING_OUTCOME_KEY];
 }
+/**
+ * Declare the outcome a void-returning `main()` ends with (#5170, ADR-5057 §4): writes the
+ * pending-outcome cell that `runMain` projects. Validates `name` is an outcome
+ * `projectOutcome` accepts (PASS, FAIL or a registered name) and THROWS otherwise, so a typo'd
+ * name fails at the declaration rather than at process exit. Call it AFTER `output()`, which
+ * rewrites the cell on every call. `output()` and this are the only writers of the cell.
+ */
+function declareOutcome(name) {
+    projectOutcome(name, 'v1');
+    setPendingOutcome(name);
+}
 const EXIT_CONTRACT_FLAG_PREFIX = '--exit-contract=';
 /** Scan argv for the FIRST `--exit-contract=<value>` token; undefined if absent. */
 function findExitContractFlag(argv) {
@@ -544,4 +555,5 @@ module.exports = {
     terminateNow,
     setPendingOutcome,
     getPendingOutcome,
+    declareOutcome,
 };

package/gsd-core/bin/lib/codex-agent-toml.cjs

@@ -2,7 +2,8 @@
 /**
  * Codex Agent TOML — typed IR for `~/.codex/agents/<agent>.toml` (#3243, ADR-2313).
  *
- * A genuine leaf: node builtins only. This is a **document model**, not a policy —
+ * A genuine leaf: node builtins, plus the zero-import `frontmatter-fence.cjs`. This is a
+ * **document model**, not a policy —
  * it knows how to parse/render/strip two known keys (`model`,
  * `model_reasoning_effort`) from a Codex agent `.toml`. It does NOT know which
  * `model` values are illegal for Codex (that predicate — Anthropic-flavored
@@ -23,7 +24,9 @@
  * stdout-JSON caller (`agent-install-check.cts`'s `checkCodexSandboxPosture`).
  * This module was already the single fs/path-free-parsing home both callers
  * shared; `fs`/`path` are imported below ONLY for `validateCodexSandboxHolds`'s
- * roster check — still node builtins only, no third-party or bin/lib dependency.
+ * roster check — still node builtins only, no third-party dependency, and no bin/lib
+ * dependency beyond the zero-import, side-effect-free `frontmatter-fence.cjs` (the one
+ * frontmatter fence owner, read by `extractToolsValue`).
  *
  * ── The reconciliation (40-design.md) ──────────────────────────────────────
  *
@@ -62,6 +65,7 @@ exports.deriveCodexSandboxMode = deriveCodexSandboxMode;
 exports.validateCodexSandboxHolds = validateCodexSandboxHolds;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 /** Frozen reason enum for a failed {@link parseCodexAgentToml}. */
 exports.PARSE_REASON = Object.freeze({
     UNTERMINATED_BLOCK: 'unterminated_block',
@@ -382,9 +386,9 @@ function stripReasoningEffort(doc) {
 /**
  * The 17 roles measured as widening under derivation (declare Write/Edit,
  * never in the pre-#3897 `CODEX_AGENT_SANDBOX` map, so the old
- * `|| 'read-only'` fallback silently under-granted them). Pinned to
- * `read-only` pending the open question of whether Codex enforces
- * `sandbox_mode` or treats it as advisory (HALT.md). This list is CLOSED and
+ * `|| 'read-only'` fallback silently under-granted them) — pinned to
+ * `read-only` from 2026-09-08 (HALT.md) until #4770 lifted the hold on
+ * 2026-09-21. This list is CLOSED and
  * SHRINK-ONLY: a new writing role never lands here (S6, T26); it is validated
  * against the live tool contract every time it is consulted
  * ({@link _deriveCodexSandboxModeFromTools}) and against the real
@@ -401,29 +405,25 @@ function stripReasoningEffort(doc) {
  * parses the list correctly, so this role genuinely derives
  * `workspace-write` from its tool contract — HALT.md's original 16-role
  * count measured against the pre-fix (single-line) readers and undercounted
- * this role. It is held here for the same reason as the other 16: pending
- * Codex's `sandbox_mode` enforcement decision, not because the derivation is
- * wrong.
+ * this role.
+ *
+ * **LIFTED 2026-09-21 (#4770, maintainer decision: documented enforcement
+ * suffices).** The map is empty: the rung-3 hold's recorded reopen condition
+ * — official OpenAI documentation establishing Codex `sandbox_mode` as an
+ * enforced technical boundary that custom subagent TOML files honor — is
+ * satisfied, so every role now derives `sandbox_mode` purely from its own
+ * `tools:` frontmatter (`workspace-write` iff Write/Edit is declared). The
+ * shrink-to-zero invariant (ADR-3473 §8.3) is satisfied by reaching zero;
+ * the map is kept as an empty frozen structure so a future re-hold has a
+ * shape to land in, and {@link validateCodexSandboxHolds} keeps failing if
+ * the list ever grows a role that no longer exists in `agents/`. The
+ * #3897 security-review F1/F3 fail-closed pins are unchanged and
+ * map-independent: `suspicious` identities (non-ASCII after
+ * normalization) still pin `read-only`, and post-lift the sandbox derives
+ * from an artifact's own CONTENT, so the F1 identity-confusion attack no
+ * longer has a hold to ride.
  */
-exports.CODEX_SANDBOX_HOLDS = Object.freeze({
-    'gsd-ai-researcher': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-code-fixer': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-code-reviewer': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-debug-session-manager': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-doc-classifier': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-doc-synthesizer': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-doc-verifier': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-doc-writer': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-dom-verifier': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-domain-researcher': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-eval-auditor': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-eval-planner': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-intel-updater': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-pattern-mapper': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-ui-auditor': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-ui-researcher': 'declares Write/Edit; pending Codex sandbox_mode enforcement decision',
-    'gsd-nyquist-auditor': 'declares Write/Edit (YAML list-form tools:, surfaced by the list-form parse fix); pending Codex sandbox_mode enforcement decision',
-});
+exports.CODEX_SANDBOX_HOLDS = Object.freeze({});
 // True iff a `tools:` frontmatter value declares Write or Edit as a whole
 // token (never a substring match, so a hypothetical "Edith"-named tool could
 // never collide). Single predicate owner for both the emitter
@@ -593,13 +593,12 @@ function isSandboxHeld(...candidates) {
 function extractToolsValue(agentContent) {
     if (typeof agentContent !== 'string')
         return undefined;
-    if (!agentContent.startsWith('---'))
-        return '';
-    const endIndex = agentContent.indexOf('---', 3);
-    if (endIndex === -1)
+    // The block is the one the one fence owner finds, so a `---` inside a value (a
+    // description mentioning `a---b`) cannot cut the tools list off.
+    const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(agentContent);
+    if (!fence?.closed)
         return '';
-    const frontmatter = agentContent.substring(3, endIndex);
-    const lines = frontmatter.split(/\r?\n/);
+    const lines = agentContent.slice(fence.openEnd, fence.bodyEnd).split(/\r?\n/);
     const toolsLineIndex = lines.findIndex((line) => /^tools:/.test(line));
     if (toolsLineIndex === -1)
         return '';

package/gsd-core/bin/lib/command-aliases.cjs

@@ -892,6 +892,13 @@ exports.NON_FAMILY_COMMAND_ALIASES = [
         ],
         "mutation": false
     },
+    {
+        "canonical": "uat.complete-session",
+        "aliases": [
+            "uat complete-session"
+        ],
+        "mutation": true
+    },
     {
         "canonical": "uat.render-checkpoint",
         "aliases": [

package/gsd-core/bin/lib/command-routing-hub.cjs

@@ -15,6 +15,7 @@
  *           | { ok: false, kind: 'InvalidArgs',     arg: string, reason: string }
  *           | { ok: false, kind: 'HandlerRefusal',  reason: string }
  *           | { ok: false, kind: 'HandlerFailure',  message: string, cause?: Error }
+ *           | { ok: false, kind: 'VerificationStatusInvalid', message: string, reason: string, file: string }
  *
  * Invariants:
  *   - Hub always routes through CJS handlers. There is no SDK path (#175).
@@ -44,6 +45,31 @@ const { createNoOpLogger } = observabilityLogger;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const cliExitModule = require("./cli-exit.cjs");
 const { ExitError } = cliExitModule;
+let _verification = null;
+/**
+ * #5118: the verification-status owner, required lazily (the hub is loaded by
+ * every command router; the owner's I/O graph is needed only when a handler
+ * actually throws). Its exported error code is the one matched below.
+ */
+function verificationOwner() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    if (!_verification)
+        _verification = require('./verification.cjs');
+    return _verification;
+}
+/**
+ * #5118: a handler that threw verification.cts's VerificationStatusError (a
+ * report `status` outside the closed enum). Matched by the owner's exported
+ * code constant, never a restated literal.
+ */
+function asVerificationStatusError(err) {
+    if (!(err instanceof Error))
+        return null;
+    const code = err.code;
+    if (typeof code !== 'string' || code !== verificationOwner().VERIFICATION_STATUS_ERROR_CODE)
+        return null;
+    return err;
+}
 // ─── Error kind constants ─────────────────────────────────────────────────────
 /**
  * Closed error-kind enum. Export as a frozen object so callers can switch on
@@ -63,6 +89,13 @@ const ERROR_KINDS = Object.freeze({
     HandlerRefusal: 'HandlerRefusal',
     /** A handler threw an unexpected exception. */
     HandlerFailure: 'HandlerFailure',
+    /**
+     * #5118: a handler read a verification report whose `status` is outside the
+     * closed enum. The kind is PascalCase like every other (key === value); the
+     * Result carries the error's own ERROR_REASON in `reason`, so the CLI adapter
+     * fails with `error(message, reason)` and restates nothing.
+     */
+    VerificationStatusInvalid: 'VerificationStatusInvalid',
 });
 // ─── Internal helpers ─────────────────────────────────────────────────────────
 /**
@@ -117,6 +150,9 @@ function makeHandlerFailure(message, cause) {
     }
     return Object.freeze(obj);
 }
+function makeVerificationStatusInvalid(message, reason, file) {
+    return Object.freeze({ ok: false, kind: ERROR_KINDS.VerificationStatusInvalid, message, reason, file });
+}
 // ─── Handler-return shape validator (Finding 1) ───────────────────────────────
 /**
  * Required payload fields per ok:false kind.
@@ -141,6 +177,10 @@ const _VARIANT_SCHEMA = {
         required: ['message'],
         allowed: new Set(['ok', 'kind', 'message', 'cause']),
     },
+    [ERROR_KINDS.VerificationStatusInvalid]: {
+        required: ['message', 'reason', 'file'],
+        allowed: new Set(['ok', 'kind', 'message', 'reason', 'file']),
+    },
 };
 /**
  * Validates a handler-returned { ok: false, ... } result against the typed schema.
@@ -262,7 +302,14 @@ function createHub({ cjsRegistry, manifest, logger } = {}) {
             if (err instanceof ExitError) {
                 throw err;
             }
-            if (err instanceof Error) {
+            // #5118: an out-of-set verification report status is a pure Result
+            // carrying the error's own reason — never a reason-less HandlerFailure,
+            // never a rethrow.
+            const statusError = asVerificationStatusError(err);
+            if (statusError) {
+                result = makeVerificationStatusInvalid(statusError.message, statusError.reason, statusError.file);
+            }
+            else if (err instanceof Error) {
                 result = makeHandlerFailure(err.message, err);
             }
             else {