@opengsd/gsd-core 1.14.0 → 1.16.0

package/gsd-core/bin/lib/complexity-trigger.cjs

@@ -3,7 +3,9 @@
  * Complexity-triggered refactor extension point — analyzer, evaluator, and
  * baseline persistence (issue #1953).
  *
- * LEAF MODULE — imports ONLY: node:fs, node:path. No other src/ imports.
+ * LEAF MODULE — imports ONLY: node:fs, node:path, and the zero-import leaf
+ * frontmatter-fence.cjs (the one frontmatter fence owner, read by parseProposal). No other
+ * src/ imports.
  *
  * Pipeline: analyzeSource (decision-point complexity per function, via
  * stripLiterals to blank comments/string/regex content while preserving
@@ -49,6 +51,7 @@ exports.readBaseline = readBaseline;
 exports.writeBaseline = writeBaseline;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 // ─── Constants ─────────────────────────────────────────────────────────────
 exports.BASELINE_FILE_NAME = 'complexity-baseline.json'; // under .planning/
 exports.PROPOSAL_SUFFIX = '-REFACTOR.md'; // ${PHASE_DIR}/${PADDED}-REFACTOR.md
@@ -1018,13 +1021,11 @@ function renderProposal(p) {
  */
 function parseProposal(text) {
     try {
-        if (!text.startsWith('---\n') && !text.startsWith('---\r\n'))
+        // The block is the one the one fence owner finds (`locateFrontmatterFence`).
+        const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(text);
+        if (!fence?.closed)
             return null;
-        const headerEnd = text.startsWith('---\r\n') ? 5 : 4;
-        const closeIdx = text.indexOf('\n---', headerEnd);
-        if (closeIdx === -1)
-            return null;
-        const yamlBody = text.slice(headerEnd, closeIdx);
+        const yamlBody = text.slice(fence.openEnd, fence.bodyEnd);
         const fm = {};
         for (const rawLine of yamlBody.split(/\r?\n/)) {
             const line = rawLine.replace(/\r$/, '');

package/gsd-core/bin/lib/config-loader.cjs

@@ -28,6 +28,9 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// #4717: runtime-identity fill — env rung + per-install marker rung.
+const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
+const runtime_name_policy_cjs_1 = require("./runtime-name-policy.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
 const { planningDir, planningRoot } = planningWorkspace;
@@ -150,8 +153,21 @@ const CONFIG_DEFAULTS = {
     research_before_questions: _getNestedConfigDefault('workflow', 'research_before_questions'), // #3894
     smart_zone_tokens: _getNestedConfigDefault('workflow', 'smart_zone_tokens'),
     inline_plan_threshold: _getNestedConfigDefault('workflow', 'inline_plan_threshold'), // #3801
+    planner_stall_detection_enabled: _getNestedConfigDefault('planner', 'stall_detection_enabled'),
     max_prompt_tokens: _getNestedConfigDefault('review', 'max_prompt_tokens'),
 };
+/**
+ * Resolve the planner watchdog policy from hand-edited configuration.
+ * Only a real JSON boolean may override the default; strings/numbers/null
+ * fail safe to the manifest-owned default-on behavior (#4570).
+ */
+function resolvePlannerStallDetectionEnabled(value) {
+    if (typeof value === 'boolean')
+        return value;
+    // A missing or skewed manifest must never convert an absent override into
+    // permission to disable the watchdog. The documented contract is default-on.
+    return true;
+}
 /**
  * Deep-merge two plain config objects. `overlay` wins on key conflict.
  * Explicit `null` in overlay overrides base (null means "unset this key").
@@ -601,7 +617,7 @@ function _warnUnusableConfig(fault) {
  * cannot dirty the working tree; the ~30 callers that omit it keep persisting, so
  * a legacy config is still migrated exactly once by ordinary use.
  */
-function loadConfigResolved(cwd, options = {}) {
+function loadConfigResolvedInternal(cwd, options = {}) {
     // Opt-OUT, not opt-in: omitting the option must preserve the historical
     // write-back for every existing caller.
     const persist = options['persist'] !== false;
@@ -614,7 +630,7 @@ function loadConfigResolved(cwd, options = {}) {
         : (options['workstreamContext'] && Object.prototype.hasOwnProperty.call(options['workstreamContext'], 'ws'))
             ? options['workstreamContext']['ws']
             : (process.env['GSD_WORKSTREAM'] || null);
-    const ws = typeof activeWorkstream === 'string' ? activeWorkstream : (activeWorkstream === null ? null : null);
+    const ws = typeof activeWorkstream === 'string' ? activeWorkstream.trim() || null : null;
     // wsRequested: true when caller explicitly requested a non-empty workstream.
     // Used for source labeling (Fix 4) and early absent-dir intercept (Fix 2).
     const wsRequested = ws != null && ws !== '';
@@ -858,6 +874,7 @@ function loadConfigResolved(cwd, options = {}) {
             phase_naming: get('phase_naming') ?? defaults.phase_naming,
             project_code: get('project_code') ?? defaults.project_code,
             subagent_timeout: get('subagent_timeout', { section: 'workflow', field: 'subagent_timeout' }) ?? defaults.subagent_timeout,
+            planner_stall_detection_enabled: resolvePlannerStallDetectionEnabled(getNested('planner', 'stall_detection_enabled')),
             model_overrides: (parsed['model_overrides']) || null,
             agent_tools: (parsed['agent_tools']) || null,
             models: (parsed['models']) || null,
@@ -959,7 +976,7 @@ function loadConfigResolved(cwd, options = {}) {
         // `workstream: null` still wins the `hasOwnProperty` check at the top of this
         // function, so spreading cannot let `workstreamContext` reintroduce a workstream.
         if (wsRequested && rootParsed) {
-            const fb = loadConfigResolved(cwd, { ...options, workstream: null });
+            const fb = loadConfigResolvedInternal(cwd, { ...options, workstream: null });
             return fallback({ config: fb.config, source: 'root', degraded: true });
         }
         // Branch B, C, D, E
@@ -967,7 +984,7 @@ function loadConfigResolved(cwd, options = {}) {
             if (rootParsed) {
                 // Branch B: workstream requested but ws config.json absent; root config present.
                 // (Only reached when wsRequested is false — e.g. ws='' with .planning/workstreams//config.json)
-                const fb = loadConfigResolved(cwd, { ...options, workstream: null });
+                const fb = loadConfigResolvedInternal(cwd, { ...options, workstream: null });
                 return fallback({ config: fb.config, source: 'root', degraded: true });
             }
             // Branch C: .planning/ exists but no config.json and no root config — federated/builtin defaults
@@ -1016,6 +1033,7 @@ function loadConfigResolved(cwd, options = {}) {
                 resolve_model_ids: (globalDefaults['resolve_model_ids']) ?? defaults.resolve_model_ids,
                 context_window: (globalDefaults['context_window']) ?? defaults.context_window,
                 subagent_timeout: (globalDefaults['subagent_timeout']) ?? defaults.subagent_timeout,
+                planner_stall_detection_enabled: resolvePlannerStallDetectionEnabled(globalDefaults['planner']?.['stall_detection_enabled']),
                 model_overrides: (globalDefaults['model_overrides']) || null,
                 models: (globalDefaults['models']) || null,
                 granularity: (globalDefaults['granularity']) !== undefined ? globalDefaults['granularity'] : null,
@@ -1054,6 +1072,48 @@ function loadConfigResolved(cwd, options = {}) {
         }
     }
 }
+/**
+ * #4717 — fill an empty `runtime` from the environment, then the per-install
+ * marker. writeNonClaudeDefaults stamps `runtime` into the SHARED
+ * ~/.gsd/defaults.json with whichever non-Claude runtime installed first, so
+ * direct readers of config.runtime saw another runtime's identity (or
+ * nothing) on a multi-runtime machine. Copy-on-write: the builtin-defaults
+ * branch returns a shared object, so never assign into it. An explicit
+ * config.runtime is never overridden.
+ */
+function fillRuntimeIdentity(resolved) {
+    const cfg = resolved?.config;
+    if (!cfg)
+        return resolved;
+    const runtime = (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(process.env['GSD_RUNTIME'], (0, runtime_slash_cjs_1.readInstallRuntimeMarker)());
+    // Only a runtime the name policy can canonicalize is an identity. Unknown
+    // tokens pass THROUGH resolveRuntimeNameFromCandidates (future-runtime
+    // tolerance) and must not be materialized into config.runtime, where ~30
+    // consumers would read them — fail safe to no identity (#4717 review).
+    const canonicalRuntime = runtime ? (0, runtime_name_policy_cjs_1.canonicalizeRuntimeName)(runtime) : null;
+    if (!canonicalRuntime)
+        return resolved;
+    // Rung 1 — empty runtime: materialize THIS install's identity (env, then
+    // the per-install marker). An explicit runtime is never overridden.
+    if (!cfg['runtime']) {
+        return { ...resolved, config: { ...cfg, runtime: canonicalRuntime } };
+    }
+    // Rung 2 (#4717 stamped-defaults leg): the global-defaults branch forwards
+    // the SHARED ~/.gsd/defaults.json's runtime verbatim — whichever non-Claude
+    // runtime installed FIRST stamped that machine-wide file, and every other
+    // runtime's resolution inherited its identity (the issue's second failure
+    // shape). When THIS install carries its own identity (GSD_RUNTIME or the
+    // marker), the stamp — not the operator — is speaking: correct it. Project
+    // and workstream configs are explicit operator intent and are never touched;
+    // with no install identity of its own the stamped value stays (status quo).
+    if (resolved.source === 'global-defaults') {
+        return { ...resolved, config: { ...cfg, runtime: canonicalRuntime } };
+    }
+    return resolved;
+}
+function loadConfigResolved(cwd, options = {}) {
+    return fillRuntimeIdentity(loadConfigResolvedInternal(cwd, options));
+}
 /**
  * loadConfig — backwards-compatible config loading, now a thin wrapper over loadConfigResolved.
  * Returns the config object only; for provenance metadata use loadConfigResolved.
@@ -1072,6 +1132,7 @@ module.exports = {
     _getNestedConfigDefault,
     _getConfigValue,
     _getConfigNested,
+    resolvePlannerStallDetectionEnabled,
     _deepMergeConfig,
     _warnedUnknownConfigKeys,
     _warnedShadowedGlobalKeys,

package/gsd-core/bin/lib/config.cjs

@@ -20,11 +20,11 @@ const cliExitMod = require("./cli-exit.cjs");
 const { ExitError } = cliExitMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoader = require("./config-loader.cjs");
-const { CONFIG_DEFAULTS } = configLoader;
+const { CONFIG_DEFAULTS, resolvePlannerStallDetectionEnabled } = configLoader;
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
-const { planningDir, planningRoot, withPlanningLock } = planningWorkspace;
+const { planningDir, planningRoot, resolveEnvWorkstream, withPlanningLock } = planningWorkspace;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const modelProfiles = require("./model-profiles.cjs");
 const { VALID_PROFILES, getAgentToModelMapForProfile, formatAgentToModelMapAsTable } = modelProfiles;
@@ -66,6 +66,14 @@ const SHIP_PR_BODY_TEMPLATE_TOKENS = new Set([
     'padded_phase',
 ]);
 const SHIP_PR_BODY_SOURCE_RE = /^(ROADMAP|PLAN|SUMMARY|VERIFICATION|STATE|REQUIREMENTS|CONTEXT)\.md\s+##\s+[^\r\n#][^\r\n]*$/;
+// ADR-612 PR-5: configuration accepts every convention the runtime can read.
+// Keep this distinct from roadmap-upgrade's supported target set: sequential
+// is valid project configuration but is not a migration destination.
+const VALID_PHASE_ID_CONVENTIONS = Object.freeze([
+    'sequential',
+    'milestone-prefixed',
+    'bracket',
+]);
 /**
  * Schema-level defaults for well-known config keys.
  * When a key is absent from config.json and no --default flag was supplied,
@@ -75,6 +83,7 @@ const SCHEMA_DEFAULTS = {
     'context_window': 200000,
     'executor.stall_detect_interval_minutes': 5,
     'executor.stall_threshold_minutes': 10,
+    'planner.stall_detection_enabled': CONFIG_DEFAULTS.planner_stall_detection_enabled,
     'planner.stall_detect_interval_minutes': 5,
     'planner.stall_threshold_minutes': 10,
     'git.create_tag': true,
@@ -119,6 +128,19 @@ const SCHEMA_DEFAULTS = {
     // WARNING_THRESHOLD/CRITICAL_THRESHOLD so the copies cannot drift.
     'hooks.context_warning_threshold': 35,
     'hooks.context_critical_threshold': 25,
+    // #4974: gates.* confirmation toggles — an absent key must resolve to the
+    // documented default (true) rather than "Key not found", matching
+    // config-defaults.manifest.json's `gates` block. Literal here (like
+    // git.create_tag above) rather than derived from config-loader.cjs's flat
+    // CONFIG_DEFAULTS: that flat projection is enumerated 1:1 against
+    // gsd-core/references/planning-config.md by
+    // tests/config-field-docs.test.cjs, and these 3 keys are internal workflow
+    // wiring, not part of that public flat-key surface. Only the 3 keys
+    // actually read by workflow conditions are registered — see
+    // gsd-core/bin/shared/config-schema.manifest.json.
+    'gates.execute_next_plan': true,
+    'gates.confirm_transition': true,
+    'gates.confirm_milestone_scope': true,
 };
 /**
  * Resolve a schema-level default for an absent key (#2256). Checks the legacy
@@ -152,12 +174,15 @@ function resolveSchemaDefault(cwd, kp) {
  * Centralizing emission here means masking can't be missed at a call site.
  */
 function emitResolvedDefault(kp, value, raw) {
+    const resolvedValue = kp === 'planner.stall_detection_enabled'
+        ? resolvePlannerStallDetectionEnabled(value)
+        : value;
     if ((0, secrets_cjs_1.isSecretKey)(kp)) {
-        const masked = (0, secrets_cjs_1.maskSecret)(value);
+        const masked = (0, secrets_cjs_1.maskSecret)(resolvedValue);
         output(masked, raw, masked);
         return;
     }
-    output(value, raw, String(value));
+    output(resolvedValue, raw, String(resolvedValue));
 }
 // ─── Validation helpers ───────────────────────────────────────────────────────
 function validateKnownConfigKeyPath(keyPath) {
@@ -252,7 +277,8 @@ function validateShipPrBodySections(value) {
  *
  * Merges (increasing priority):
  *   1. Hardcoded defaults — every key that loadConfig() resolves, plus mode/granularity
- *   2. User-level defaults from ~/.gsd/defaults.json (if present)
+ *   2. User-level defaults from $GSD_HOME/.gsd/defaults.json (if present;
+ *      GSD_HOME defaults to the home directory, as in the config loader)
  *   3. userChoices — the settings the user explicitly selected during /gsd:new-project
  *
  * Uses the canonical `git` namespace for branching keys (consistent with VALID_CONFIG_KEYS
@@ -263,24 +289,27 @@ function validateShipPrBodySections(value) {
  */
 function buildNewProjectConfig(userChoices) {
     const choices = userChoices || {};
-    const homedir = node_os_1.default.homedir();
+    // #4976: the GSD-owned store resolves exactly as the config loader resolves
+    // it (`GSD_HOME || homedir()`), so the defaults.json seeding this project is
+    // the one the loader and its #3532 shadow warning read in the same run.
+    const gsdHome = process.env['GSD_HOME'] || node_os_1.default.homedir();
     // Detect API key availability
-    const braveKeyFile = node_path_1.default.join(homedir, '.gsd', 'brave_api_key');
+    const braveKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'brave_api_key');
     const hasBraveSearch = !!(process.env['BRAVE_API_KEY'] || node_fs_1.default.existsSync(braveKeyFile));
-    const firecrawlKeyFile = node_path_1.default.join(homedir, '.gsd', 'firecrawl_api_key');
+    const firecrawlKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'firecrawl_api_key');
     const hasFirecrawl = !!(process.env['FIRECRAWL_API_KEY'] || node_fs_1.default.existsSync(firecrawlKeyFile));
-    const exaKeyFile = node_path_1.default.join(homedir, '.gsd', 'exa_api_key');
+    const exaKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'exa_api_key');
     const hasExaSearch = !!(process.env['EXA_API_KEY'] || node_fs_1.default.existsSync(exaKeyFile));
-    const tavilyKeyFile = node_path_1.default.join(homedir, '.gsd', 'tavily_api_key');
+    const tavilyKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'tavily_api_key');
     const hasTavilySearch = !!(process.env['TAVILY_API_KEY'] || node_fs_1.default.existsSync(tavilyKeyFile));
-    const refKeyFile = node_path_1.default.join(homedir, '.gsd', 'ref_api_key');
+    const refKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'ref_api_key');
     const hasRefSearch = !!(process.env['REF_API_KEY'] || node_fs_1.default.existsSync(refKeyFile));
-    const perplexityKeyFile = node_path_1.default.join(homedir, '.gsd', 'perplexity_api_key');
+    const perplexityKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'perplexity_api_key');
     const hasPerplexity = !!(process.env['PERPLEXITY_API_KEY'] || node_fs_1.default.existsSync(perplexityKeyFile));
-    const jinaKeyFile = node_path_1.default.join(homedir, '.gsd', 'jina_api_key');
+    const jinaKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'jina_api_key');
     const hasJina = !!(process.env['JINA_API_KEY'] || node_fs_1.default.existsSync(jinaKeyFile));
-    // Load user-level defaults from ~/.gsd/defaults.json if available
-    const globalDefaultsPath = node_path_1.default.join(homedir, '.gsd', 'defaults.json');
+    // Load user-level defaults from $GSD_HOME/.gsd/defaults.json if available
+    const globalDefaultsPath = node_path_1.default.join(gsdHome, '.gsd', 'defaults.json');
     let userDefaults = {};
     try {
         if (node_fs_1.default.existsSync(globalDefaultsPath)) {
@@ -422,7 +451,7 @@ function buildNewProjectConfig(userChoices) {
  *
  * Accepts user-chosen settings as a JSON string (the keys the user explicitly
  * configured during /gsd:new-project). All remaining keys are filled from
- * hardcoded defaults and optional ~/.gsd/defaults.json.
+ * hardcoded defaults and optional $GSD_HOME/.gsd/defaults.json.
  *
  * Idempotent: if config.json already exists, returns { created: false }.
  */
@@ -542,7 +571,7 @@ function _setNestedValue(config, keyPath, parsedValue) {
 }
 /**
  * Deletes a value from the config object, allowing nested values via dot
- * notation (e.g., "review.models.gemini"). Mirrors `_setNestedValue`'s
+ * notation (e.g., "review.models.codex"). Mirrors `_setNestedValue`'s
  * prototype-pollution guard on every path segment (including intermediates).
  *
  * Unlike `_setNestedValue`, this NEVER creates missing intermediate objects —
@@ -806,6 +835,16 @@ function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
     const VALID_CONTEXT_VALUES = ['dev', 'research', 'review'];
     if (kp === 'context')
         assertEnumValue(parsedValue, val, VALID_CONTEXT_VALUES, 'context value');
+    // #4974: `mode` was never enum-validated — `config-set mode custom` (or any
+    // other string) silently succeeded, even though only "interactive" and
+    // "yolo" are documented/read values (gsd-core/references/planning-config.md,
+    // docs/CONFIGURATION.md, pinned by tests/config-field-docs.test.cjs).
+    const VALID_MODE_VALUES = ['interactive', 'yolo'];
+    if (kp === 'mode')
+        assertEnumValue(parsedValue, val, VALID_MODE_VALUES, 'mode');
+    if (kp === 'phase_id_convention') {
+        assertEnumValue(parsedValue, val, VALID_PHASE_ID_CONVENTIONS, 'phase_id_convention');
+    }
     // Codebase drift detector (#2003)
     const VALID_DRIFT_ACTIONS = ['warn', 'auto-remap'];
     if (kp === 'workflow.drift_action')
@@ -853,6 +892,20 @@ function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
             error(`Invalid workflow.agent_hint_routing '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Planner watchdog opt-out (#4570) — only a real boolean may change the
+    // default-on policy. In particular, string "false" must not disable it.
+    if (kp === 'planner.stall_detection_enabled') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid planner.stall_detection_enabled '${val}'. Must be a boolean (true or false).`);
+        }
+    }
+    // Dispatch audit-trail opt-in (#4975) — boolean only. The live seams honour
+    // only a real `true`, so any other stored value would be silently ignored.
+    if (kp === 'audit.enabled') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid audit.enabled '${val}'. Must be a boolean (true or false).`);
+        }
+    }
     // #3086 — git.create_tag: boolean only
     if (kp === 'git.create_tag') {
         if (typeof parsedValue !== 'boolean') {
@@ -1161,6 +1214,9 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
         }
         error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
     }
+    if (kp === 'planner.stall_detection_enabled') {
+        current = resolvePlannerStallDetectionEnabled(current);
+    }
     // Never echo plaintext for sensitive keys via config-get. Plaintext lives
     // in config.json on disk; the CLI surface always shows the masked form.
     if ((0, secrets_cjs_1.isSecretKey)(kp)) {
@@ -1190,7 +1246,7 @@ function resolveFromRootConfig(cwd, kp) {
     // diverges from planningRoot without a workstream and loadConfigResolved does NOT
     // inherit root — matching the runtime's own `if (ws)` gate keeps the two surfaces
     // from diverging on the project-scoped (non-workstream) case.
-    if (!process.env['GSD_WORKSTREAM'])
+    if (!resolveEnvWorkstream())
         return { found: false, value: undefined };
     const root = planningRoot(cwd);
     const rootConfigPath = node_path_1.default.join(root, 'config.json');
@@ -1297,7 +1353,7 @@ function cmdConfigPath(cwd, _raw, workstreamContext = null) {
  * (caller uses `await` which is safe on a sync return value).
  */
 function cmdMigrateConfig(cwd, raw) {
-    const ws = process.env['GSD_WORKSTREAM'] || null;
+    const ws = resolveEnvWorkstream();
     // #3749: resolve the migration target through the project-aware resolver so
     // GSD_PROJECT scopes the write; migrateOnDisk itself cannot (see its
     // configPathOverride note).
@@ -1345,6 +1401,7 @@ function cmdMigrateConfig(cwd, raw) {
 }
 module.exports = {
     VALID_CONFIG_KEYS,
+    VALID_PHASE_ID_CONVENTIONS,
     cmdConfigEnsureSection,
     cmdConfigSet,
     cmdConfigGet,

package/gsd-core/bin/lib/core-utils.cjs

@@ -15,6 +15,7 @@
  *   - node:fs / node:path (stdlib)
  *   - ./phase-id.cjs       (comparePhaseNum, used by readSubdirectories)
  *   - ./planning-workspace.cjs (findContextMdIn, used by getPhaseFileStats)
+ *   - ./frontmatter-fence.cjs (locateFrontmatterFence, used by extractOneLinerFromBody)
  *
  * #3883 (ADR-3473 §8.3): two of this module's cyclic partners require
  * generateSlugInternal, the canonical slug formula:
@@ -37,6 +38,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+// frontmatter-fence.cjs is a leaf module (no imports), so this adds no cycle.
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdModule = require("./phase-id.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -139,7 +142,9 @@ function extractOneLinerFromBody(content) {
     if (!content)
         return null;
     const normalized = content.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
-    const body = normalized.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n*/, '');
+    // The body starts after the block the one fence owner finds, and the blank lines after it.
+    const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(normalized);
+    const body = fence?.closed ? normalized.slice(fence.closingFenceEnd).replace(/^\n+/, '') : normalized;
     // #3170: anchor to a summary-shaped heading (Summary / Overview /
     // Accomplishments) so an incidental first heading (a rule list, task
     // breakdown, deviation note) does not contribute its first bold run as the

package/gsd-core/bin/lib/coverage.cjs

@@ -34,6 +34,7 @@ const { output, error } = io;
 const coreUtils = require("./core-utils.cjs");
 const { toPosixPath } = coreUtils;
 const security_cjs_1 = require("./security.cjs");
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 // ─── Frozen typed-IR surface ────────────────────────────────────────────────
 const MODE = Object.freeze({
     COVERAGE: 'coverage',
@@ -186,15 +187,10 @@ function setKey(obj, key, value) {
     obj[key] = value;
 }
 // ─── Frontmatter region helpers ──────────────────────────────────────────────
+/** The closed frontmatter block's YAML text, as the one fence owner finds it, or null. */
 function getFrontmatterYaml(content) {
-    const headerEnd = content.startsWith('---\r\n') ? 5 : content.startsWith('---\n') ? 4 : -1;
-    if (headerEnd === -1)
-        return null;
-    const closingLineStart = content.indexOf('\n---', headerEnd);
-    if (closingLineStart === -1)
-        return null;
-    const yamlEnd = content[closingLineStart - 1] === '\r' ? closingLineStart - 1 : closingLineStart;
-    return content.slice(headerEnd, yamlEnd);
+    const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(content);
+    return fence?.closed ? content.slice(fence.openEnd, fence.bodyEnd) : null;
 }
 /**
  * Locate and parse the top-level `coverage:` block from a SUMMARY document.