@opengsd/gsd-core 1.15.0 → 1.17.0

package/gsd-core/bin/lib/mcp-server.cjs

@@ -234,7 +234,7 @@ function handleMessage(request, ctx = {}) {
                 // subscribe/listChanged — nothing ever sends those notifications
                 // (design row 2 / Hyrum's Law: advertising an unimplemented
                 // notification is a lie a host would act on).
-                capabilities: { tools: {}, resources: {}, prompts: {} },
+                capabilities: ctx.prompts === false ? { tools: {}, resources: {} } : { tools: {}, resources: {}, prompts: {} },
                 serverInfo: { name: exports.SERVER_NAME, version: resolveServerVersion() },
             };
             break;
@@ -276,6 +276,8 @@ function handleMessage(request, ctx = {}) {
             break;
         }
         case 'prompts/list':
+            if (ctx.prompts === false)
+                return isNotification ? null : errorResponse(id, METHOD_NOT_FOUND, 'Method not found: prompts/list.');
             result = {
                 prompts: [...getCatalog().prompts.values()]
                     .map(wirePrompt)
@@ -283,6 +285,8 @@ function handleMessage(request, ctx = {}) {
             };
             break;
         case 'prompts/get': {
+            if (ctx.prompts === false)
+                return isNotification ? null : errorResponse(id, METHOD_NOT_FOUND, 'Method not found: prompts/get.');
             const params = (request.params && typeof request.params === 'object' ? request.params : {});
             const name = asString(params.name);
             if (!name)

package/gsd-core/bin/lib/milestone.cjs

@@ -63,7 +63,7 @@ const { extractFrontmatter } = frontmatterMod;
 // divergence signal). Routed through the single write-seam composition
 // (`syncAndPreserveStateMd`) instead, under `withStateLock` — see
 // `cmdMilestoneComplete`'s own STATE.md-update block for the full rationale.
-const { syncAndPreserveStateMd, withStateLock, readModifyWriteStateMd } = stateMod;
+const { syncAndPreserveStateMd, withStateLock, readModifyWriteStateMd, assertVerificationReportsReadable } = stateMod;
 // #2288 security: a milestone version label becomes a filesystem directory
 // component (`milestones/<label>-phases/`) into which phase directories are
 // MOVED. Any label used as a path segment must be a safe version token —
@@ -869,6 +869,15 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
         output(dryRunResult, raw);
         return;
     }
+    // #5118 (no write before the error): the STATE.md update further down
+    // rebuilds the frontmatter from every phase's report and throws on a
+    // `status` outside the closed set — AFTER the archive directory, the
+    // archived ROADMAP/REQUIREMENTS copies, MILESTONES.md and the moved audit
+    // and quick-task files. Validate first, so the refusal leaves the tree
+    // untouched.
+    if (node_fs_1.default.existsSync(statePath)) {
+        assertVerificationReportsReadable((0, shell_command_projection_cjs_1.platformReadSync)(statePath) || '', cwd);
+    }
     // Ensure archive directory exists. Deliberately placed AFTER the dry-run
     // early return and every refusal/guard above (missingExplicitVersion, the
     // scope refusal, the unstarted-phase guard) — #3184 review finding: this
@@ -1702,6 +1711,15 @@ function cmdQuickArchive(cwd, version, options, raw) {
         }, raw);
         return;
     }
+    // #5118 (no write before the error): the STATE.md reset below goes through
+    // `readModifyWriteStateMd`, whose frontmatter rebuild reads every phase's
+    // report and throws on a `status` outside the closed set — AFTER the quick
+    // task directories have been MOVED. Validate first, so the refusal leaves the
+    // tree untouched. Gated on there being anything to archive: a run that would
+    // move nothing never reaches that rebuild.
+    if (node_fs_1.default.existsSync(statePath) && listQuickTaskDirsForArchive(cwd).length > 0) {
+        assertVerificationReportsReadable(node_fs_1.default.readFileSync(statePath, 'utf-8'), cwd);
+    }
     const quickArchiveResult = archiveQuickTaskDirectories(cwd, version);
     const warnings = [];
     let stateUpdated = false;

package/gsd-core/bin/lib/model-resolver.cjs

@@ -55,24 +55,24 @@ const { planningDir } = planningWorkspaceMod;
 // <install>/gsd-core/bin/lib). Precedence for the gate: project config.runtime →
 // GSD_RUNTIME env (manual/CI override + test seam) → install marker → 'claude'.
 //
-// `claude` is currently the ONLY runtime with nativeModelAliases:true; a
-// registry-parity test guards this set so a future alias-capable runtime fails
-// loudly here instead of silently omitting.
-const RUNTIMES_WITH_NATIVE_ALIASES = new Set(['claude']);
+// Whether a runtime resolves tier aliases natively is a runtime-descriptor fact
+// (`hostBehaviors.nativeModelAliases`, #5169) — `claude` is currently the ONLY
+// runtime that declares it — not a hand-kept set in this module. A label that is
+// not a registered runtime (a future runtime named by env/config) has none.
+function hasNativeModelAliases(runtime) {
+    return (0, runtime_name_policy_cjs_1.hostBehaviorsFor)(runtime).nativeModelAliases === true;
+}
 // #3897 rung 2: the marker reader + its cache and test seams were promoted to
 // the canonical owner, `runtime-slash.cts` (imported above) — this module now
 // consumes that single implementation instead of holding its own copy. N5:
 // behaviour and the seam contract are unchanged by the move; the re-exports
 // below (`export =` at the bottom of this file) preserve every existing
 // caller's `require('./model-resolver.cjs')` surface byte-for-behaviour.
-// The runtime whose install is actually resolving, canonicalized so an alias or
-// case variant (e.g. "claude-code"/"Claude") cannot defeat the native-alias
-// check below (#2297 review). Precedence mirrors resolveRuntime()
-// (runtime-slash.cts): GSD_RUNTIME env → project config.runtime → per-install
-// .gsd-runtime marker → 'claude'.
-function resolveActiveRuntime(config) {
-    return (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(process.env['GSD_RUNTIME'], config['runtime'], (0, runtime_slash_cjs_1.readInstallRuntimeMarker)()) || 'claude';
-}
+// The runtime whose install is actually resolving — one chain, owned by
+// runtime-slash.cts's `resolveActiveRuntime` (#5169): GSD_RUNTIME env → project
+// config.runtime → per-install .gsd-runtime marker → 'claude', canonicalized so
+// an alias or case variant (e.g. "claude-code"/"Claude") cannot defeat the
+// native-alias check below (#2297 review).
 // Did the PROJECT's own config (root `.planning/config.json` or the active
 // workstream/project override) explicitly set resolve_model_ids to "omit"?
 // Project config takes precedence over the shared ~/.gsd/defaults.json (#2297
@@ -129,7 +129,7 @@ function _resolveRuntimeTier(config, tier) {
         // the per-install marker), and reading it raw made
         // `model_profile_overrides.<runtime>.<tier>` silently inert for every
         // install that did not also write the key by hand.
-        runtime: resolveActiveRuntime(config),
+        runtime: (0, runtime_slash_cjs_1.resolveActiveRuntime)(config),
         tier,
         overrides: config['model_profile_overrides'],
     });
@@ -502,7 +502,7 @@ function resolveModelInternal(cwd, agentType) {
         ? modelOverrides[agentType]
         : undefined;
     if (override) {
-        const mapped = mapClaudeOverrideForRuntime(override, resolveActiveRuntime(config), agentType);
+        const mapped = mapClaudeOverrideForRuntime(override, (0, runtime_slash_cjs_1.resolveActiveRuntime)(config), agentType);
         if (mapped !== null)
             return mapped;
         // Unmappable Claude ID — fall through to tier resolution (matches model_policy).
@@ -528,7 +528,7 @@ function resolveModelInternal(cwd, agentType) {
     // Never undefined, so the "no runtime declared anywhere" case still resolves
     // 'claude' and step 3's deliberate claude skip (#1156/#2297/#4192) is
     // unchanged for every existing install.
-    const activeRuntime = resolveActiveRuntime(config);
+    const activeRuntime = (0, runtime_slash_cjs_1.resolveActiveRuntime)(config);
     if (tier && tier !== 'inherit') {
         const onClaude = activeRuntime === 'claude';
         const effectiveRuntime = activeRuntime;
@@ -582,7 +582,7 @@ function resolveModelInternal(cwd, agentType) {
     // map, but only outranks the omit gate when that key canonicalizes to a
     // recognised non-Claude runtime.
     const omitApplies = config['resolve_model_ids'] === 'omit'
-        && (projectExplicitlySetsOmit(cwd) || !RUNTIMES_WITH_NATIVE_ALIASES.has(activeRuntime));
+        && (projectExplicitlySetsOmit(cwd) || !hasNativeModelAliases(activeRuntime));
     // CANONICALIZED, not the raw field. Comparing the raw value against the literal
     // 'claude' made every spelling that is not exactly that string count as a
     // non-Claude opt-in and outrank the omit gate: `runtime:"Claude"`,
@@ -764,13 +764,13 @@ function resolveModelForTier(cwd, agentType, attempt) {
         ? modelOverrides[agentType]
         : undefined;
     if (override) {
-        const mapped = mapClaudeOverrideForRuntime(override, resolveActiveRuntime(config), agentType);
+        const mapped = mapClaudeOverrideForRuntime(override, (0, runtime_slash_cjs_1.resolveActiveRuntime)(config), agentType);
         if (mapped !== null)
             return mapped;
         // Unmappable Claude ID — fall through to dynamic_routing / model_policy resolution.
     }
     // #4505: same active-runtime rule as resolveModelInternal step 3.
-    if (config['model_policy'] && resolveActiveRuntime(config) !== 'claude') {
+    if (config['model_policy'] && (0, runtime_slash_cjs_1.resolveActiveRuntime)(config) !== 'claude') {
         return resolveModelInternal(cwd, agentType);
     }
     const alias = dynamicRoutingModel(config, agentType, attemptN);

package/gsd-core/bin/lib/observability/event.cjs

@@ -16,7 +16,7 @@
  *                                     (RFC 4122); invalid values are silently coerced to undefined.
  *   command:       string  — the dispatched verb
  *   args?:         unknown — only present when includeArgs === true
- *   result:        { kind: 'ok' | 'UnknownCommand' | 'InvalidArgs' | 'HandlerRefusal' | 'HandlerFailure', ...payload }
+ *   result:        { kind: 'ok' | 'UnknownCommand' | 'InvalidArgs' | 'HandlerRefusal' | 'HandlerFailure' | 'VerificationStatusInvalid', ...payload }
  *   timestamp:     string  — ISO 8601
  */
 Object.defineProperty(exports, "__esModule", { value: true });

package/gsd-core/bin/lib/observability/logger.cjs

@@ -16,6 +16,11 @@
  * No-op logger (createNoOpLogger):
  *   Silent on all events. Used as the Hub default when no logger is injected.
  *
+ * Live-seam gate (resolveDispatchLogger, #4975):
+ *   The one opt-in decision both live createHub() seams share. Resolves
+ *   `audit.enabled` for the seam's cwd and returns the default logger, or
+ *   undefined (inject nothing) when observability is off.
+ *
  * ADR-457 build-at-publish: the hand-written bin/lib/observability/logger.cjs
  * collapsed to a TypeScript source of truth. Behaviour is preserved
  * byte-for-behaviour from the prior hand-written .cjs; only types are added.
@@ -26,6 +31,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const redaction_cjs_1 = require("./redaction.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const planningWorkspace = require("../planning-workspace.cjs");
+const { readScopedConfigValue } = planningWorkspace;
 const AUDIT_FILE_NAME = '.gsd-trace.jsonl';
 const PLANNING_DIR = '.planning';
 // ─── helpers ─────────────────────────────────────────────────────────────────
@@ -47,6 +55,8 @@ function _safeStringify(value) {
  * inject nothing (the Hub stays byte-for-byte silent, preserving the default
  * dispatch output contract, incl. --json-errors); when on, the caller injects
  * createDefaultLogger and gets the stderr-on-error line + opt-in file audit.
+ * The live seams reach it through resolveDispatchLogger, which supplies the
+ * project config — called bare, only the env var is seen (#4975).
  */
 function _isAuditEnabled(config) {
     if (process.env['GSD_AUDIT'] === '1')
@@ -148,4 +158,39 @@ function createDefaultLogger({ cwd = process.cwd(), config } = {}) {
         },
     };
 }
-module.exports = { createDefaultLogger, createNoOpLogger, isAuditEnabled: _isAuditEnabled };
+/**
+ * Resolve `audit.enabled` for `cwd` as the value `config-get audit.enabled`
+ * reports, through planning-workspace's readScopedConfigValue — the one
+ * scope-aware ladder worktreesOptedOut (#3972) reads too, so the two gates
+ * can never resolve the same config differently. Strict `=== true`, never
+ * coerced.
+ *
+ * Direct file reads, deliberately NOT loadConfig: this runs on every live
+ * dispatch, and loadConfig can rewrite config.json, spawn git, scan the
+ * capability registry, and print warnings — none of which a dispatch that
+ * never opted in may do (the default dispatch output is a stable contract,
+ * ADR-2619). Never throws. An unreadable or unparseable config file sets
+ * nothing, so the ladder moves on: under GSD_WORKSTREAM a broken workstream
+ * config inherits the root's `audit.enabled` (where config-get fails with
+ * CONFIG_PARSE_FAILED); otherwise the GSD_AUDIT env var alone decides.
+ */
+function _readAuditConfig(cwd) {
+    const { present, value } = readScopedConfigValue(cwd, ['audit', 'enabled']);
+    return { audit: { enabled: present && value === true } };
+}
+/**
+ * The DispatchLogger a live createHub() seam injects (#4975). Either
+ * GSD_AUDIT=1 or `audit.enabled: true` in the project config turns the opt-in
+ * audit trail (and the structured stderr line on error) on; neither turns the
+ * other off. When observability is off this returns undefined so the Hub keeps
+ * its no-op fallback and the default dispatch output — including the
+ * --json-errors envelope — stays byte-for-byte unchanged (#2620).
+ *
+ * `cwd` defaults exactly as createDefaultLogger's does, so the config that
+ * decides and the directory that receives the trail are always the same.
+ */
+function resolveDispatchLogger(cwd = process.cwd()) {
+    const config = _readAuditConfig(cwd);
+    return _isAuditEnabled(config) ? createDefaultLogger({ cwd, config }) : undefined;
+}
+module.exports = { createDefaultLogger, createNoOpLogger, isAuditEnabled: _isAuditEnabled, resolveDispatchLogger };

package/gsd-core/bin/lib/opencode-mcp-entry.cjs

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * The OpenCode MCP entry GSD's installer writes (`mcp.gsd`, or the 2.x native `mcp.servers.gsd`).
+ * One owner for "is this entry ours" so install, uninstall and migration 011 cannot drift apart
+ * (#5333, #5338; epic #5331).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GSD_MCP_NO_PROMPTS_FLAG = void 0;
+exports.isGsdMcpEntry = isGsdMcpEntry;
+exports.hasNoPromptsFlag = hasNoPromptsFlag;
+exports.withNoPromptsFlag = withNoPromptsFlag;
+const package_identity_cjs_1 = require("./package-identity.cjs");
+/** Withholds the MCP prompt catalog: OpenCode turns MCP prompts into `<server>:<prompt>` slash commands. */
+exports.GSD_MCP_NO_PROMPTS_FLAG = '--no-prompts';
+/**
+ * True when `entry` is the MCP server entry the installer writes: a local `npx … gsd-mcp-server`
+ * command for this package, pinned or not. A user-edited or user-defined `gsd` entry does not match.
+ * Recognizes both generations' shapes (`enabled` on 1.x, `disabled` on 2.x) because it keys only on
+ * `type` and `command`.
+ */
+function isGsdMcpEntry(entry) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+        return false;
+    const e = entry;
+    if (e.type !== 'local' || !Array.isArray(e.command))
+        return false;
+    const [bin, ...rest] = e.command;
+    if (bin !== 'npx' || !rest.includes('gsd-mcp-server'))
+        return false;
+    return rest.some((a) => typeof a === 'string' && (a === package_identity_cjs_1.PACKAGE_NAME || a.startsWith(`${package_identity_cjs_1.PACKAGE_NAME}@`)));
+}
+/** True when the entry already carries the no-prompts flag. */
+function hasNoPromptsFlag(entry) {
+    return entry.command.includes(exports.GSD_MCP_NO_PROMPTS_FLAG);
+}
+/** The entry with `--no-prompts` appended to its command (other fields untouched). */
+function withNoPromptsFlag(entry) {
+    return hasNoPromptsFlag(entry) ? entry : { ...entry, command: [...entry.command, exports.GSD_MCP_NO_PROMPTS_FLAG] };
+}