@opengsd/gsd-core 1.14.0 → 1.16.0

package/hooks/dist/lib/git-probe.js

@@ -81,4 +81,20 @@ function reportIfUndetermined(hookName, probeLabel, result) {
   }
 }
 
-module.exports = { classifyGitProbe, reportIfUndetermined };
+// Per-probe budget for the git probes of BLOCKING guards. A probe that times
+// out fails OPEN (see reportIfUndetermined above), which is the same outcome
+// as the host killing the hook — so a budget sized to git's ~0.1s typical run
+// silently disables the gate on a starved host (a 2000ms budget was exceeded
+// on a loaded Windows runner, #5180). Worst case for a guard that runs up to
+// BLOCKING_GUARD_MAX_SEQUENTIAL_PROBES sequential probes:
+//   3 x 5000ms + ~500ms node start/kill/reap = ~15.5s,
+// inside the 120s host budget blocking guards are registered with (#3981).
+const BLOCKING_GUARD_PROBE_TIMEOUT_MS = 5000;
+const BLOCKING_GUARD_MAX_SEQUENTIAL_PROBES = 3;
+
+module.exports = {
+  classifyGitProbe,
+  reportIfUndetermined,
+  BLOCKING_GUARD_PROBE_TIMEOUT_MS,
+  BLOCKING_GUARD_MAX_SEQUENTIAL_PROBES,
+};

package/hooks/dist/lib/isolation-sentinel.js

@@ -23,8 +23,8 @@
 // explicit fallback for the per-plan submodule-degrade override and shares
 // the exact same atomic-write implementation.
 //
-// Sentinel path: `<cwd>/.gsd/dispatch-isolation-sentinel.json`. `.gsd` is
-// gitignored (root `.gitignore`'s bare `.gsd` entry matches at any depth),
+// Sentinel path: `<cwd>/.gsd/dispatch-isolation-sentinel.json`. The writer
+// seeds `.gsd/.gitignore` so this stays ignored in user projects too,
 // and lives inside the checkout that ran the workflow — concurrent worktrees
 // of the same repo are separate directories on disk, so each gets its own
 // sentinel with no cross-worktree collision, no lock file needed.

package/hooks/gsd-agent-isolation-guard.js

@@ -60,6 +60,14 @@
 
 'use strict';
 
+// #5183: Node's on-disk compile cache, so later runs reuse V8's compiled code
+// for unchanged modules. Only as the entry (a test require() is unaffected),
+// skipped under V8 coverage, optional (Bun stubs it), and never fatal.
+// NODE_DISABLE_COMPILE_CACHE (any value) turns it off.
+if (require.main === module && !process.env.NODE_V8_COVERAGE) {
+  try { require('node:module').enableCompileCache?.(); } catch { /* optimization only */ }
+}
+
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -337,6 +345,30 @@ function resolveRegistryIsolation(cwd, configPath) {
     if (!useWorktrees) isolation = 'none';
   }
 
+  // #4734: a harness worktree can never be created in a directory that is not
+  // a git repository (or a repository with no commits) — git's definitive
+  // exit-128 answer on `rev-parse HEAD`. Demanding the isolation flag there
+  // blocked every flag-less dispatch the moment the sentinel went stale, on a
+  // root where no worktree can exist. Degrade to 'none' exactly like the
+  // use_worktrees opt-out above; the classification is owned by
+  // `classifyGitHead` (worktree-base-ref.cjs) — the same single owner the
+  // base-check's degrade decision uses — and ambiguous or failed resolutions
+  // keep the conservative (enforce) default, matching that check's own
+  // fail-closed treatment of the same classes.
+  if (isolation === 'harness-worktree') {
+    try {
+      ensureRuntimeBuild();
+      const { classifyGitHead } = require('../gsd-core/bin/lib/worktree-base-ref.cjs');
+      if (classifyGitHead({ cwd }).status === 'definitive-absence') {
+        isolation = 'none';
+      }
+    } catch {
+      // Unbuilt or unreadable runtime library — keep the conservative
+      // (enforce) default rather than silently disabling the guard, same
+      // posture as the ladder fallback above.
+    }
+  }
+
   return { isolation, harnessFlag };
 }
 

package/hooks/gsd-check-update-worker.js

@@ -9,6 +9,14 @@
 
 'use strict';
 
+// #5183: Node's on-disk compile cache, so later runs reuse V8's compiled code
+// for unchanged modules. Only as the entry (a test require() is unaffected),
+// skipped under V8 coverage, optional (Bun stubs it), and never fatal.
+// NODE_DISABLE_COMPILE_CACHE (any value) turns it off.
+if (require.main === module && !process.env.NODE_V8_COVERAGE) {
+  try { require('node:module').enableCompileCache?.(); } catch { /* optimization only */ }
+}
+
 const fs = require('fs');
 const path = require('path');
 

package/hooks/gsd-check-update.js

@@ -3,6 +3,14 @@
 // Check for GSD updates in background, write result to cache
 // Called by SessionStart hook - runs once per session
 
+// #5183: Node's on-disk compile cache, so later runs reuse V8's compiled code
+// for unchanged modules. Only as the entry (a test require() is unaffected),
+// skipped under V8 coverage, optional (Bun stubs it), and never fatal.
+// NODE_DISABLE_COMPILE_CACHE (any value) turns it off.
+if (require.main === module && !process.env.NODE_V8_COVERAGE) {
+  try { require('node:module').enableCompileCache?.(); } catch { /* optimization only */ }
+}
+
 const fs = require('fs');
 const path = require('path');
 const os = require('os');

package/hooks/gsd-context-monitor.js

@@ -201,6 +201,29 @@ function writeSentinel(target, payload) {
   } catch (e) { /* best effort — see above */ }
 }
 
+// The calendar day the CRITICAL auto-record writes into STATE.md (#4905): the
+// operator's LOCAL day through the clock seam, which honors GSD_NOW_MS under
+// GSD_TEST_MODE, like every other date GSD stamps into planning files. The
+// clock is compiled into gsd-core/bin/lib/, so it is reached through the
+// self-healing build seam (#3582). If the library is missing and cannot
+// self-build, the host's local day stands in — still never the UTC day.
+function localDayStamp() {
+  try {
+    const { ensureRuntimeBuild } = require('../gsd-core/bin/ensure-runtime-build.cjs');
+    ensureRuntimeBuild();
+    return require('../gsd-core/bin/lib/clock.cjs').realClock.localToday();
+  } catch {
+    const now = new Date();
+    return [now.getFullYear(), String(now.getMonth() + 1).padStart(2, '0'), String(now.getDate()).padStart(2, '0')].join('-');
+  }
+}
+
+// The Stopped At breadcrumb for /gsd:resume-work (#1974). usedPct is coerced to
+// a safe number in case the bridge file is malformed.
+function criticalStoppedAt(usedPct) {
+  return `context exhaustion at ${Number(usedPct) || 0}% (${localDayStamp()})`;
+}
+
 let input = '';
 // Assigned by main(); the handler below clears it. Declared out here rather
 // than inside main() because the handler closes over it.
@@ -464,9 +487,7 @@ const handleStdinEnd = () => {
         // Using __dirname makes this work on Claude Code, OpenCode, Gemini,
         // Kilo, etc. without hardcoding ~/.claude/.
         const gsdTools = path.join(__dirname, '..', 'gsd-core', 'bin', 'gsd-tools.cjs');
-        // Coerce usedPct to a safe number in case bridge file is malformed
-        const safeUsedPct = Number(usedPct) || 0;
-        const stoppedAt = `context exhaustion at ${safeUsedPct}% (${new Date().toISOString().split('T')[0]})`;
+        const stoppedAt = criticalStoppedAt(usedPct);
         spawn(
           process.execPath,
           [gsdTools, 'state', 'record-session', '--stopped-at', stoppedAt],
@@ -560,8 +581,10 @@ if (require.main === module) {
   main();
 }
 
-// Exported for the #4285 property test only. The two constants ride along so a
-// test asserts the fallback pair against the SOURCE of truth rather than
-// re-hardcoding 35/25 — a test carrying its own copy of the defaults would stay
-// green if the constants were edited.
-module.exports = { resolveThresholds, WARNING_THRESHOLD, CRITICAL_THRESHOLD };
+// Exported for tests only. resolveThresholds and the two constants serve the
+// #4285 property test; the constants ride along so a test asserts the fallback
+// pair against the SOURCE of truth rather than re-hardcoding 35/25 — a test
+// carrying its own copy of the defaults would stay green if the constants were
+// edited. criticalStoppedAt lets the #4905 test pin the breadcrumb's day
+// without waiting on the detached record-session writer (#3726).
+module.exports = { resolveThresholds, WARNING_THRESHOLD, CRITICAL_THRESHOLD, criticalStoppedAt };

package/hooks/gsd-cursor-subagent-start.js

@@ -53,6 +53,14 @@
 
 'use strict';
 
+// #5183: Node's on-disk compile cache, so later runs reuse V8's compiled code
+// for unchanged modules. Only as the entry (a test require() is unaffected),
+// skipped under V8 coverage, optional (Bun stubs it), and never fatal.
+// NODE_DISABLE_COMPILE_CACHE (any value) turns it off.
+if (require.main === module && !process.env.NODE_V8_COVERAGE) {
+  try { require('node:module').enableCompileCache?.(); } catch { /* optimization only */ }
+}
+
 const fs = require('fs');
 const path = require('path');
 const os = require('os');

package/hooks/gsd-secret-read-guard.js

@@ -61,7 +61,13 @@
 //   segment's operands — `[ -f .env ]` and `ls .env*` are existence checks
 //   GSD's own agents run — while `cp`/`mv`/`ln`/`git` are deliberately NOT
 //   exempt (`cp .env x && cat x` launders the name; `git show HEAD:.env`
-//   reads). A shell interpreter (bash/sh/zsh/dash/ksh/su) has its script scanned
+//   reads). Narrower carve-outs exempt single operand POSITIONS that are
+//   names, never contents, and keep checking the rest of the segment: the
+//   `--env-file` value under a container runtime (#4639), the pathspecs of
+//   `git check-ignore` / `git ls-files` / `git rm --cached`, and the
+//   destination of a one-source `cp`/`mv` (#4856). The #4856 carve-outs
+//   fail closed: an option they do not list withdraws them from the segment.
+//   A shell interpreter (bash/sh/zsh/dash/ksh/su) has its script scanned
 //   whether it arrives via `-c '…'`, a `<( )` file operand, a heredoc /
 //   here-string, or a pipe from a knowable `echo`/`printf` source
 //   (`echo cat .env | bash`); `eval` scans its joined operands; `source`/`.`
@@ -86,7 +92,16 @@
 //   on plain commands, without arming the compound-`cd` prompt". Writes to
 //   secret files are out of scope (Write/Edit were never gated). Commands
 //   over 1 MiB are denied outright (`command-too-large`) rather than
-//   scanned partially or waved through.
+//   scanned partially or waved through. (#4639 adds one more, by design: the
+//   value of `--env-file` under a container runtime is exempt, so the
+//   container's own command can print the interpolated environment
+//   (`alpine printenv`, `docker compose config`) — the same exposure class
+//   as the pre-existing volume-mount gap (`-v .env:/s`); the flag's value
+//   itself is a name, never contents. #4856 adds another: the `cp`/`mv`
+//   destination exemption can move a link prepared under a non-secret name
+//   onto a secret name (`ln -s .env.example l && mv l .env`), so a later
+//   edit of `.env` lands in the link target — a write redirection, the
+//   out-of-scope write class, not a read.)
 //
 // Triggers on: Read, Grep, Bash tool calls (Kimi: ReadFile, Grep, Shell)
 // Action: BLOCK (decision: 'block', exit 2) — codes secret-read |
@@ -127,6 +142,66 @@ const NON_READING_COMMANDS = new Set([
   'basename', 'dirname', 'realpath', 'file', 'echo', 'printf',
 ]);
 
+// #4639: container runtimes take `--env-file <file>` — the runtime opens the
+// file itself, interpolates it into the container environment, and returns
+// nothing to the agent, so the flag's VALUE is a name, never contents. The
+// same category NON_READING_COMMANDS encodes, expressed as a flag value. Only
+// the flag's value under these runtimes is exempt; every other operand in the
+// segment is still checked, so the carve-out cannot launder a read.
+const CONTAINER_RUNTIMES = new Set(['docker', 'docker-compose', 'podman', 'nerdctl']);
+const ENV_FILE_FLAG_RE = /^--env-file(=|$)/;
+
+// #4856: git subcommands that report or drop a path's ignore / tracking
+// status and never print the file, so their pathspec operands are names —
+// the category NON_READING_COMMANDS encodes. Each carries the closed set of
+// its NO-VALUE options (from `git <subcommand> -h`, git 2.49). Any other
+// option withdraws the exemption from the whole segment, so an option value
+// is never mistaken for a pathspec: `-X <file>` reads the file, and
+// `--pathspec-from-file=<file>` echoes its lines in the "did not match"
+// error. `requires` names the option without which the subcommand stays
+// checked (#4856 scopes `git rm` to `--cached`).
+const GIT_PATHSPEC_SUBCOMMANDS = new Map([
+  ['check-ignore', {
+    flags: new Set(['-q', '--quiet', '-v', '--verbose', '--stdin', '-z', '-n', '--non-matching', '--no-index', '--index']),
+  }],
+  ['ls-files', {
+    flags: new Set([
+      '-z', '-t', '-v', '-f', '-c', '--cached', '-d', '--deleted', '-m', '--modified', '-o', '--others',
+      '-i', '--ignored', '-s', '--stage', '-k', '--killed', '-u', '--unmerged', '--directory', '--eol',
+      '--no-empty-directory', '--resolve-undo', '--exclude-standard', '--full-name',
+      '--recurse-submodules', '--error-unmatch', '--abbrev', '--debug', '--deduplicate', '--sparse',
+    ]),
+  }],
+  ['rm', {
+    flags: new Set(['--cached', '-f', '--force', '-n', '--dry-run', '-q', '--quiet', '-r', '--ignore-unmatch', '--sparse']),
+    requires: '--cached',
+  }],
+]);
+
+// git's global options (its own usage line, git 2.49), needed to locate the
+// subcommand. A value option consumes the next word unless written
+// `--opt=value`; an option in neither set fails closed, so a value is never
+// read as the subcommand (`git -C ls-files show HEAD:.env` runs `show`).
+const GIT_GLOBAL_VALUE_OPTIONS = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--config-env']);
+const GIT_GLOBAL_FLAGS = new Set([
+  '-p', '--paginate', '-P', '--no-pager', '--no-replace-objects', '--no-lazy-fetch',
+  '--no-optional-locks', '--no-advice', '--bare',
+]);
+
+// #4856: `cp`/`mv` write their destination and never print it, so a secret
+// name that is ONLY the destination of a one-source copy or move is a name
+// (`cp .env.example .env`). The exemption holds for exactly two operands
+// behind options from this closed set; anything else keeps the whole segment
+// checked — `-t`/`--target-directory` (every operand becomes a source), a
+// backup (`-b`, `--backup`, `-S`: the old secret survives as `.env~`, a name
+// the predicate does not classify), a link (`-l`, `-s`) or `--exchange`
+// (the destination shares or swaps the secret). Options must precede the
+// operands: a trailing one is an option under GNU getopt's permutation but
+// an operand under POSIXLY_CORRECT (`cp a .env -f` then copies `.env` INTO
+// `-f/`), so which word is the destination would hang on an environment
+// the hook cannot see.
+const COPY_NAME_ONLY_FLAGS = new Set(['-f', '--force', '-i', '--interactive', '-n', '--no-clobber', '-v', '--verbose']);
+
 // Shell interpreters that run a script from `-c`, a file operand, or stdin
 // (heredoc / here-string / piped `echo`|`printf`). `su` is here for its `-c`
 // form (`su [user] -c 'cmd'`); a bare `su user` resolves to file mode, which
@@ -700,6 +775,86 @@ function resolveCommand(words) {
   return { base: lastSegment(words[idx].text).toLowerCase(), operands: words.slice(idx + 1) };
 }
 
+// Operand indices the segment's command consumes as a NAME, never as
+// CONTENTS (#4639, #4856). Only these positions skip the operand check;
+// every other operand is still checked, so a carve-out cannot launder a read
+// elsewhere in the segment.
+function nameOnlyOperandIndices(base, operands) {
+  if (CONTAINER_RUNTIMES.has(base)) return envFileValueIndices(operands);
+  if (base === 'git') return gitPathspecIndices(operands);
+  if (base === 'cp' || base === 'mv') return copyDestinationIndices(operands);
+  return new Set();
+}
+
+// #4639: the `--env-file` word, plus the next operand for the bare flag
+// (`--env-file=<value>` is a single word).
+function envFileValueIndices(operands) {
+  const exempt = new Set();
+  for (let k = 0; k < operands.length; k++) {
+    if (!ENV_FILE_FLAG_RE.test(operands[k].text)) continue;
+    exempt.add(k);
+    if (!operands[k].text.includes('=')) exempt.add(++k);
+  }
+  return exempt;
+}
+
+// True when `text` is a listed long option, or a short cluster (`-co`) whose
+// every letter is listed. `--opt=value`, an abbreviation, or a cluster
+// holding a value option (`-ciX`) is not.
+function isListedFlag(text, flags) {
+  if (text.startsWith('--')) return flags.has(text);
+  return /^-[A-Za-z]+$/.test(text) && [...text.slice(1)].every((ch) => flags.has(`-${ch}`));
+}
+
+// Index of git's subcommand past its global options, or -1 when an option
+// outside GIT_GLOBAL_VALUE_OPTIONS / GIT_GLOBAL_FLAGS precedes it.
+function gitSubcommandIndex(operands) {
+  for (let k = 0; k < operands.length; k++) {
+    const t = operands[k].text;
+    if (!t.startsWith('-')) return k;
+    if (GIT_GLOBAL_VALUE_OPTIONS.has(t)) { k++; continue; }
+    if (GIT_GLOBAL_FLAGS.has(t)) continue;
+    const eq = t.indexOf('=');
+    const isLongValueForm = t.startsWith('--') && eq !== -1 && GIT_GLOBAL_VALUE_OPTIONS.has(t.slice(0, eq));
+    if (!isLongValueForm) return -1;
+  }
+  return -1;
+}
+
+// #4856: the pathspec operands of a GIT_PATHSPEC_SUBCOMMANDS invocation. git
+// permutes options, so one may follow a pathspec; after `--` every word is a
+// pathspec. The subcommand is matched case-sensitively, as git looks it up.
+function gitPathspecIndices(operands) {
+  const sub = gitSubcommandIndex(operands);
+  const spec = sub === -1 ? undefined : GIT_PATHSPEC_SUBCOMMANDS.get(operands[sub].text);
+  if (!spec) return new Set();
+  const pathspecs = new Set();
+  let required = spec.requires === undefined;
+  let endOfOptions = false;
+  for (let k = sub + 1; k < operands.length; k++) {
+    const t = operands[k].text;
+    if (endOfOptions || !t.startsWith('-') || t === '-') pathspecs.add(k);
+    else if (t === '--') endOfOptions = true;
+    else if (!isListedFlag(t, spec.flags)) return new Set();
+    else if (t === spec.requires) required = true;
+  }
+  return required ? pathspecs : new Set();
+}
+
+// #4856: the destination of a one-source `cp`/`mv` (see COPY_NAME_ONLY_FLAGS).
+function copyDestinationIndices(operands) {
+  const positional = [];
+  let endOfOptions = false;
+  for (let k = 0; k < operands.length; k++) {
+    const t = operands[k].text;
+    if (endOfOptions || !t.startsWith('-') || t === '-') positional.push(k);
+    else if (positional.length) return new Set(); // an option or `--` after an operand
+    else if (t === '--') endOfOptions = true;
+    else if (!isListedFlag(t, COPY_NAME_ONLY_FLAGS)) return new Set();
+  }
+  return positional.length === 2 ? new Set([positional[1]]) : new Set();
+}
+
 // The statically-knowable stdin a segment writes: `echo`/`printf` operands
 // joined by a space (for `echo`, leading `-neE` flags dropped). Any other
 // source (`cat gen.sh | bash`, `curl … | sh`) is not knowable → null.
@@ -840,8 +995,10 @@ function findSecretRead(command, depth) {
 
     if (NON_READING_COMMANDS.has(base)) continue;
 
-    for (const w of operands) {
-      if (namesSecret(normalizeOperand(w.text))) return w.text;
+    const nameOnly = nameOnlyOperandIndices(base, operands);
+    for (let k = 0; k < operands.length; k++) {
+      if (nameOnly.has(k)) continue;
+      if (namesSecret(normalizeOperand(operands[k].text))) return operands[k].text;
     }
   }
   return null;

package/hooks/gsd-statusline.js

@@ -3,6 +3,14 @@
 // Claude Code Statusline - GSD Edition
 // Shows: model | current task (or GSD state) | directory | context usage
 
+// #5183: Node's on-disk compile cache, so later runs reuse V8's compiled code
+// for unchanged modules. Only as the entry (a test require() is unaffected),
+// skipped under V8 coverage, optional (Bun stubs it), and never fatal.
+// NODE_DISABLE_COMPILE_CACHE (any value) turns it off.
+if (require.main === module && !process.env.NODE_V8_COVERAGE) {
+  try { require('node:module').enableCompileCache?.(); } catch { /* optimization only */ }
+}
+
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -42,6 +50,11 @@ if (require.main === module) {
 const { isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs');
 const { PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
 const { normalizeStateStatus } = require('../gsd-core/bin/lib/state-document.cjs');
+const { locateFrontmatterFence } = require('../gsd-core/bin/lib/frontmatter-fence.cjs');
+const {
+  renderBracketPhaseDisplay,
+  renderBracketMilestoneDisplay,
+} = require('../gsd-core/bin/lib/phase-id-display.cjs');
 // #2850: reuse the existing workstream resolution seams rather than
 // re-implementing CLI>env>store precedence or path construction inline.
 // peekActiveWorkstream is the read-only sibling of the store-tier lookup
@@ -246,13 +259,12 @@ function readGsdState(dir, opts = {}) {
 function parseStateMd(content) {
   const state = {};
 
-  // YAML frontmatter between --- markers (anchored at file start).
-  // #2754: \r?\n (not literal \n) so a CRLF STATE.md (Windows-authored) parses
-  // identically to LF — pre-fix the literal-\n fence dropped the ENTIRE block.
-  // Mirrors the CRLF-safe extractFrontmatter in src/frontmatter.cts.
-  const fmMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (fmMatch) {
-    const fm = fmMatch[1];
+  // YAML frontmatter: the block the one fence owner finds (`locateFrontmatterFence`), so a
+  // CRLF STATE.md (#2754), a BOM, and a `---` inside a value read exactly as every other
+  // STATE.md reader reads them (found while implementing #5105).
+  const fence = locateFrontmatterFence(content);
+  if (fence && fence.closed) {
+    const fm = content.slice(fence.openEnd, fence.bodyEnd);
     // Top-level scalar key: value
     for (const line of fm.split(/\r?\n/)) {
       const m = line.match(/^(\w+):\s*(.+)/);
@@ -359,16 +371,26 @@ function renderProgressBar(percent) {
  * Progress bar is opt-in: appended to the milestone segment only when
  * progress.percent is present in frontmatter; absent → empty string.
  */
-function formatGsdState(s) {
+function formatGsdState(s, opts = {}) {
   // #2850: workstream mode with nothing resolvable — an observable signal,
   // never silent emptiness (distinguishes from "GSD isn't installed here").
   if (s.noActiveWorkstream) return NO_ACTIVE_WORKSTREAM_LABEL;
 
   const parts = [];
+  const bracket = opts.convention === 'bracket';
+  const bracketMilestone = bracket
+    ? renderBracketMilestoneDisplay(s.milestone, opts.projectCode)
+    : null;
+  const phaseLabel = (phase) => {
+    const display = bracket
+      ? renderBracketPhaseDisplay(s.milestone, phase, opts.projectCode)
+      : null;
+    return display ?? `Phase ${phase}`;
+  };
 
   // Milestone segment: version + name + (opt-in) progress bar
   if (s.milestone || s.milestoneName) {
-    const ver = s.milestone || '';
+    const ver = bracketMilestone ?? s.milestone ?? '';
     const name = (s.milestoneName && s.milestoneName !== 'milestone') ? s.milestoneName : '';
     const bar = renderProgressBar(s.percent);
     const pieces = [ver, name, bar].filter(Boolean);
@@ -384,7 +406,8 @@ function formatGsdState(s) {
     // stage = whichever lifecycle status was written by the orchestrator
     //   (discussing / planning / executing / verifying)
     const stage = s.status || '';
-    parts.push(stage ? `Phase ${s.activePhase} ${stage}` : `Phase ${s.activePhase}`);
+    const phase = phaseLabel(s.activePhase);
+    parts.push(stage ? `${phase} ${stage}` : phase);
   } else if (s.nextAction && phasesStr) {
     // Scene 2: idle + a recommended next command is visible to the user.
     // Surfaces "what to run next" without the user opening STATE.md.
@@ -402,9 +425,16 @@ function formatGsdState(s) {
     // earlier so no existing project's status-line changes shape.
     if (s.status) parts.push(s.status);
     if (s.phaseNum && s.phaseTotal) {
+      const bracketPhase = bracket
+        ? renderBracketPhaseDisplay(s.milestone, s.phaseNum, opts.projectCode)
+        : null;
       const phase = s.phaseName
-        ? `${s.phaseName} (${s.phaseNum}/${s.phaseTotal})`
-        : `ph ${s.phaseNum}/${s.phaseTotal}`;
+        ? bracketPhase
+          ? `${bracketPhase} ${s.phaseName} (${s.phaseNum}/${s.phaseTotal})`
+          : `${s.phaseName} (${s.phaseNum}/${s.phaseTotal})`
+        : bracketPhase
+          ? `${bracketPhase} (${s.phaseNum}/${s.phaseTotal})`
+          : `ph ${s.phaseNum}/${s.phaseTotal}`;
       parts.push(phase);
     }
   }
@@ -490,17 +520,24 @@ function shortGsdStatus(status) {
  * default format — and collapses narrative statuses via shortGsdStatus().
  * The default "full" format is untouched.
  */
-function formatGsdStateCompact(s) {
+function formatGsdStateCompact(s, opts = {}) {
   // #2850: mirrors formatGsdState's observable "nothing resolvable" signal.
   if (s.noActiveWorkstream) return NO_ACTIVE_WORKSTREAM_LABEL;
 
   const parts = [];
+  const bracket = opts.convention === 'bracket';
+  const bracketMilestone = bracket
+    ? renderBracketMilestoneDisplay(s.milestone, opts.projectCode)
+    : null;
 
-  if (s.milestone) parts.push(s.milestone);
+  if (s.milestone) parts.push(bracketMilestone ?? s.milestone);
 
   const phaseId = s.activePhase || s.phaseNum;
   if (phaseId) {
-    parts.push(s.phaseTotal ? `P${phaseId}/${s.phaseTotal}` : `P${phaseId}`);
+    const bracketPhase = bracket
+      ? renderBracketPhaseDisplay(s.milestone, phaseId, opts.projectCode)
+      : null;
+    parts.push(bracketPhase ?? (s.phaseTotal ? `P${phaseId}/${s.phaseTotal}` : `P${phaseId}`));
   }
 
   // Scene exclusivity mirrors formatGsdState's if/else chain: an in-flight
@@ -747,7 +784,7 @@ function formatStateFreshness(fresh) {
  * entry points — this collapses both onto one resolver.
  *
  * @param {object} cfg — parsed .planning/config.json (readGsdConfig())
- * @returns {{ showLastCommand: boolean, position: 'end'|'front', stateFormat: 'full'|'compact', showGit: boolean, showStateFreshness: boolean }}
+ * @returns {{ showLastCommand: boolean, position: 'end'|'front', stateFormat: 'full'|'compact', showGit: boolean, showStateFreshness: boolean, convention: string|null, projectCode: string|null }}
  */
 function resolveStatuslineOptions(cfg) {
   const showLastCommand = getConfigValue(cfg, 'statusline.show_last_command') === true;
@@ -759,7 +796,22 @@ function resolveStatuslineOptions(cfg) {
   const stateFormat = getConfigValue(cfg, 'statusline.state_format') === 'compact' ? 'compact' : 'full';
   const showGit = getConfigValue(cfg, 'statusline.show_git') === true;
   const showStateFreshness = getConfigValue(cfg, 'statusline.show_state_freshness') === true;
-  return { showLastCommand, position, stateFormat, showGit, showStateFreshness };
+  const convention = getConfigValue(cfg, 'phase_id_convention') === 'bracket'
+    ? 'bracket'
+    : null;
+  const projectCodeValue = getConfigValue(cfg, 'project_code');
+  const projectCode = typeof projectCodeValue === 'string' && projectCodeValue !== ''
+    ? projectCodeValue
+    : null;
+  return {
+    showLastCommand,
+    position,
+    stateFormat,
+    showGit,
+    showStateFreshness,
+    convention,
+    projectCode,
+  };
 }
 
 // --- stdin ------------------------------------------------------------------
@@ -934,7 +986,9 @@ function runStatusline() {
     // freshness git spawn here would spend a subprocess on discarded output.
     if (!task) {
       const state = readGsdState(dir, { stateFreshness: options.showStateFreshness }) || {};
-      gsdStateStr = options.stateFormat === 'compact' ? formatGsdStateCompact(state) : formatGsdState(state);
+      gsdStateStr = options.stateFormat === 'compact'
+        ? formatGsdStateCompact(state, options)
+        : formatGsdState(state, options);
     }
 
     // Output
@@ -1042,6 +1096,7 @@ module.exports = {
   STATE_HEAD_ADVISORY_COMMITS, isValidStateHeadStamp,
   readStateHeadCommits, parseRevListCounts, deriveStateFreshness,
   formatStateFreshness, resolveStatuslineOptions,
+  renderBracketPhaseDisplay, renderBracketMilestoneDisplay,
 };
 
 /**
@@ -1059,7 +1114,15 @@ function renderStatusline(data) {
   // key from reaching only one of them.
   let lastCmdSuffix = '';
   let gitSuffix = '';
-  let options = { showLastCommand: false, position: 'end', stateFormat: 'full', showGit: false, showStateFreshness: false };
+  let options = {
+    showLastCommand: false,
+    position: 'end',
+    stateFormat: 'full',
+    showGit: false,
+    showStateFreshness: false,
+    convention: null,
+    projectCode: null,
+  };
   try {
     const cfg = readGsdConfig(dir);
     options = resolveStatuslineOptions(cfg);
@@ -1075,7 +1138,9 @@ function renderStatusline(data) {
   } catch (e) { /* swallow */ }
 
   const state = readGsdState(dir, { stateFreshness: options.showStateFreshness }) || {};
-  const gsdStateStr = options.stateFormat === 'compact' ? formatGsdStateCompact(state) : formatGsdState(state);
+  const gsdStateStr = options.stateFormat === 'compact'
+    ? formatGsdStateCompact(state, options)
+    : formatGsdState(state, options);
   const middle = gsdStateStr ? `\x1b[2m${gsdStateStr}\x1b[0m` : null;
   return composeStatusline({ model, ctx: '', middle, dirname, lastCmdSuffix, gitSuffix, position: options.position });
 }

package/hooks/gsd-update-banner.js

@@ -12,6 +12,14 @@
 
 'use strict';
 
+// #5183: Node's on-disk compile cache, so later runs reuse V8's compiled code
+// for unchanged modules. Only as the entry (a test require() is unaffected),
+// skipped under V8 coverage, optional (Bun stubs it), and never fatal.
+// NODE_DISABLE_COMPILE_CACHE (any value) turns it off.
+if (require.main === module && !process.env.NODE_V8_COVERAGE) {
+  try { require('node:module').enableCompileCache?.(); } catch { /* optimization only */ }
+}
+
 const fs = require('fs');
 const path = require('path');
 const os = require('os');