@opengsd/gsd-core 1.16.0 → 1.18.0

package/commands/gsd/code-review.md

@@ -48,6 +48,14 @@ Optional flags parsed from the `<arguments>` block:
 - `--files=file1,file2,...` — Explicit file list override. Has highest precedence for file scoping per D-08. When provided, workflow skips SUMMARY.md extraction and git diff fallback entirely.
 
 Context files (CLAUDE.md, SUMMARY.md, phase state) are resolved inside the workflow via `gsd-tools query init.phase-op` and delegated to agent via `<required_reading>` blocks.
+
+## Outside a phase
+
+Reviewer lanes run without a phase (`gsd_run` is defined by the runtime-launcher preamble inside workflow fences; in a plain shell call `node <install>/gsd-core/bin/gsd-tools.cjs` instead): pipe canonical repo-relative file paths (one per line) to stdin of
+`gsd_run review-lane dispatch-step --repo-root <root> --depth <quick|standard|deep> --base-sha <sha> --run-dir "$(mktemp -d)" --cap-id code-review --point execute:post --explicit <slugs> --raw`.
+`review-lane` flags are space-separated (`--depth quick`), never `--flag=value`. `--explicit` (omitted, nothing dispatches yet the call exits ok), `--depth`, `--base-sha` (lane reviews changes relative to it; commit them first) and stdin paths are required; `--run-dir` should be a fresh temp dir (default `.` writes the prompt file into the current directory); read each lane's output path (`results[].reviewPath`) from the JSON before removing it. `--cap-id`/`--point` select the `code-review` capability, which must be enabled (`workflow.code_review`) and active at `--point` — `execute:post`, or `execute:wave:post` when `workflow.code_review_point` selects it; otherwise nothing dispatches.
+`--explicit` takes comma-separated canonical slugs, no spaces (`codex,antigravity`), not flag aliases (`antigravity`, not `agy`); slugs: first column of `gsd_run review-lane sections` (`review-lane flags` lists flags/aliases).
+Each lane declares its own model key, which is not always its slug (antigravity's is `review.models.agy`); see the `review.models.*` table in `docs/CONFIGURATION.md`. Unset = lane default model.
 </context>
 
 <process>

package/commands/gsd/pause-work.md

@@ -21,7 +21,7 @@ Routes to the pause-work workflow which handles:
 - Current phase detection from recent files
 - Complete state gathering (position, completed work, remaining work, decisions, blockers)
 - Handoff file creation with all context sections
-- Git commit as WIP
+- Git commit handoff
 - Resume instructions
 </objective>
 

package/gsd-core/bin/gsd-tools.cjs

@@ -312,6 +312,7 @@ try {
 } catch { /* advisory — never block */ }
 
 const { resolveActiveWorkstream, applyResolvedWorkstreamEnv, peekActiveWorkstream } = require('./lib/active-workstream-store.cjs');
+const { planningDir, planningRoot } = require('./lib/planning-workspace.cjs');
 const state = require('./lib/state.cjs');
 const phase = require('./lib/phase.cjs');
 const roadmap = require('./lib/roadmap.cjs');
@@ -1445,8 +1446,12 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
     // Silent no-op when the section is absent or the table is already canonical
     // — the quick/fast workflows call this before their first append, so the
     // migration runs exactly once, on the first quick run, unprompted otherwise.
-    const statePath = path.join(cwd, '.planning', 'STATE.md');
+    const planningPath = planningDir(cwd);
+    const statePath = path.join(planningPath, 'STATE.md');
     if (!fs.existsSync(statePath)) {
+      if (planningPath !== planningRoot(cwd)) {
+        throw new ExitError(1, `quick-tasks-migrate: STATE.md not found at ${statePath}`);
+      }
       output({ ok: true, migrated: false, reason: `STATE.md not found at ${statePath}` }, raw);
       return;
     }
@@ -1519,7 +1524,7 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
             || (qtaQuickId && qtaSlug ? `[${qtaQuickId}-${qtaSlug}](./quick/${qtaQuickId}-${qtaSlug}/)` : undefined);
           const qtaStatus = qtaParsed['status'] || undefined;
 
-          const statePath = path.join(cwd, '.planning', 'STATE.md');
+          const statePath = path.join(planningDir(cwd), 'STATE.md');
           if (!fs.existsSync(statePath)) {
             error(`quick-tasks-append: STATE.md not found at ${statePath}`, ERROR_REASON.USAGE);
           }
@@ -1593,7 +1598,16 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
     const fsx = require('node:fs');
     const os = require('node:os');
     const { REVIEWER_LANES, mergeReviewerLanes } = require('./lib/review-lane-descriptor.cjs');
-    const { resolveLanePlan, resolveLaneEffort, resolveLaneBudget } = require('./lib/review-lane-invocation.cjs');
+    const { resolveLanePlan: resolveLanePlanBase, resolveLaneEffort, resolveLaneBudget, applyPromptOverride } = require('./lib/review-lane-invocation.cjs');
+    // OpenCode 2.x argv differs from 1.x (no --variant; effort rides on the model as `#variant`;
+    // ADR-5331 D5/D8). The generation is probed lazily, only when the opencode lane is resolved.
+    const resolveLanePlan = (laneInput) => {
+      if (!laneInput || !laneInput.lane || laneInput.lane.slug !== 'opencode') return resolveLanePlanBase(laneInput);
+      const ocv = require('./lib/opencode-version.cjs');
+      const adapted = ocv.adaptLaneInputForGeneration(laneInput, ocv.detectOpencodeGeneration().generation);
+      for (const w of adapted.warnings) process.stderr.write('gsd: ' + w + '\n');
+      return ocv.adaptLanePlanForGeneration(resolveLanePlanBase(adapted.input), ocv.detectOpencodeGeneration().generation);
+    };
     const modelCatalog = require('./lib/model-catalog.cjs');
     const runner = require('./lib/review-lane-runner.cjs');
     const cfgLoader = require('./lib/config-loader.cjs');
@@ -1936,7 +1950,7 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
       const dispatchResult = await dispatchReviewerLanes(
         {
           trait,
-          selection: { explicitFlags, detected: rosterSlugs },
+          selection: { explicitFlags, detected: rosterSlugs, lanes: mergedLanes },
           repoRoot,
           paths,
           depth,
@@ -2088,14 +2102,11 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
     }
 
     // `--prompt-file` lets the caller substitute a budget-trimmed prompt. Applied to whichever
-    // channel this lane actually reads from, so one flag serves both transports.
+    // channel this lane actually reads from (stdin, argv, an argv-embedded file reference, or the
+    // http promptPath), so one flag serves every lane (#5049).
     const promptOverride = flag('--prompt-file');
     if (promptOverride) {
-      if (entry.plan.transport === 'spawn') {
-        if (entry.plan.stdin) entry.plan.stdin = promptOverride;
-      } else {
-        entry.plan.promptPath = promptOverride;
-      }
+      entry.plan = applyPromptOverride(entry.plan, promptOverride, repoRoot);
     }
 
     // ADR-2782 D5 rule 4: re-resolve the consented destination at INVOCATION. `undefined` (no
@@ -2675,8 +2686,14 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
               'gsd-executor', readGsdEffectiveModelOverrides(cwd), null);
             model = resolveDispatchModelPin('gsd-executor', pinned);
           }
+          let orchestratorExec = runtimeEntry?.runtime?.orchestratorExec;
+          if (orchestratorExec && orchestratorExec.cwdFlag === '--dir' && runtimeId === 'opencode') {
+            // OpenCode 2.x `run` has no --dir: bind the worktree through the process cwd (ADR-5331 D5).
+            const ocv = require('./lib/opencode-version.cjs');
+            orchestratorExec = ocv.adaptOrchestratorExecForGeneration(orchestratorExec, ocv.detectOpencodeGeneration().generation);
+          }
           const resolution = hostIntegration.resolveOrchestratorExec(
-            runtimeEntry?.runtime?.orchestratorExec,
+            orchestratorExec,
             cwdTarget,
             promptArg,
             model,
@@ -3007,7 +3024,12 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
           const jsonIdx = args.indexOf('--json');
           const agentSkillsJsonMode = jsonIdx !== -1;
           if (agentSkillsJsonMode) args.splice(jsonIdx, 1);
-          init.cmdAgentSkills(cwd, args[1], raw, agentSkillsJsonMode);
+          // #5122: the agent's own self-load asks for configured skills only,
+          // never the persona fallback served to orchestrator-side injection.
+          const skillsOnlyIdx = args.indexOf('--skills-only');
+          const agentSkillsOnly = skillsOnlyIdx !== -1;
+          if (agentSkillsOnly) args.splice(skillsOnlyIdx, 1);
+          init.cmdAgentSkills(cwd, args[1], raw, agentSkillsJsonMode, agentSkillsOnly);
   }
 
   function routeSkillManifest({ args, cwd, raw, error }) {

package/gsd-core/bin/lib/adr-parser.cjs

@@ -221,13 +221,45 @@ function classifyHeader(normalizedHeader) {
     }
     return null;
 }
+// A list item starts with a bullet (-, *, +) or an ordered marker (1. or 1)).
+const LIST_MARKER = /^([-*+]|\d+[.)])\s+/;
+/**
+ * Split a section body into one entry per top-level list item (#5227).
+ *
+ * A line that opens a list item starts a new entry with its marker stripped. Any
+ * other non-blank line, and any marker line indented deeper than the first item
+ * (a nested sub-bullet), joins the current entry with a single space, so a
+ * hard-wrapped item stays one entry. Text before the first marker is its own
+ * entry. A block with no list marker at all keeps one entry per line, so a plain
+ * `## Status` body still yields its first line.
+ */
 function splitEntries(blockText) {
-    return (typeof blockText === 'string' ? blockText : '')
+    const lines = (typeof blockText === 'string' ? blockText : '')
         .split(/\r?\n/)
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .map((line) => line.replace(/^[-*+]\s+/, '').trim())
-        .filter(Boolean);
+        .filter((line) => line.trim() !== '');
+    if (!lines.some((line) => LIST_MARKER.test(line.trim())))
+        return lines.map((line) => line.trim());
+    const entries = [];
+    let topIndent = -1;
+    let open = false;
+    for (const raw of lines) {
+        const text = raw.trim();
+        const indent = raw.length - raw.trimStart().length;
+        const isMarker = LIST_MARKER.test(text);
+        if (isMarker && (topIndent < 0 || indent <= topIndent)) {
+            if (topIndent < 0)
+                topIndent = indent;
+            entries.push(text.replace(LIST_MARKER, '').trim());
+            open = true;
+        }
+        else if (open) {
+            entries[entries.length - 1] = `${entries[entries.length - 1]} ${text}`;
+        }
+        else {
+            entries.push(text);
+        }
+    }
+    return entries.filter(Boolean);
 }
 /**
  * Thin adapter: wraps the seam's `collectSections` to produce the same

package/gsd-core/bin/lib/capability-ledger.cjs

@@ -807,6 +807,28 @@ function reconcile(runtimeDir) {
     }
     return result;
 }
+/**
+ * #5121: the one bounded read for a SKILL.md found by walking a skill root. A skill file is untrusted
+ * repository (or installed-runtime) content: a symlink to /dev/zero exhausts memory and a FIFO blocks
+ * the process, because a bare readFileSync does neither a type nor a size check. Reuses the fd protocol
+ * of readSmallRegularFile and maps its fail-closed "unreadable" conditions (not a regular file after
+ * following symlinks, over the cap) to null, so a caller treats the file as it treats a missing one.
+ * Any other IO error still throws, as the unbounded read did.
+ *
+ * 256 KiB: the largest shipped SKILL.md is ~21 KB, so the cap is >10x headroom while still bounding the
+ * allocation a hostile repository can force.
+ */
+const SKILL_FILE_MAX_BYTES = 256 * 1024;
+function readSkillFile(filePath) {
+    try {
+        return readSmallRegularFile(filePath, SKILL_FILE_MAX_BYTES);
+    }
+    catch (err) {
+        if (err instanceof LedgerIOError && (err.code === 'ENXIO' || err.code === 'EISDIR' || err.code === 'EFBIG'))
+            return null;
+        throw err;
+    }
+}
 module.exports = {
     readLedger,
     readLedgerStrict,
@@ -822,6 +844,9 @@ module.exports = {
     // #1459 finding 1 (HIGH): the RAW-BYTES variant — the SOLE correct reader for the byte-exact,
     // injective consent content-hash binding (a utf8 decode is lossy and could collide binary artifacts).
     readSmallRegularFileBuffer,
+    // #5121: bounded SKILL.md read shared by skill discovery, the installed-runtime manifest and capability skills.
+    readSkillFile,
+    SKILL_FILE_MAX_BYTES,
     // Exported for testing / introspection
     LEDGER_FILE_NAME,
     CorruptLedgerError,

package/gsd-core/bin/lib/capability-lock.cjs

@@ -176,7 +176,8 @@ function isSameHost(parsed) {
  * equality comparison (never parsed as a date). The pair (pid, startTime) uniquely identifies a
  * process instance: even if a crashed holder's pid is REUSED, the new process's start-time differs.
  * Returns null on ANY error / unobtainable value (liveness cannot be VERIFIED → steal-eligible past
- * the deadman). The shell-outs only run on the rare STEAL-decision path, never the happy path.
+ * the deadman). Probing ANOTHER pid only happens on the rare STEAL-decision path; this process's own
+ * start-time is probed on its first lock acquire (see selfStartTime) — never at module load (#5327).
  */
 function getProcessStartTime(pid) {
     if (!Number.isInteger(pid) || pid <= 0)
@@ -208,11 +209,29 @@ function getProcessStartTime(pid) {
         return null;
     }
 }
-/** THIS process's start-time, captured ONCE at module load so we never re-shell on every lock write. */
-const _selfStartTime = getProcessStartTime(process.pid);
-/** Serialize the lockfile body: JSON carrying the owner token, pid, hostname, cached start-time, ts. */
-function lockFileBody(token) {
-    return JSON.stringify({ token, pid: process.pid, hostname: node_os_1.default.hostname(), startTime: _selfStartTime, ts: Date.now() });
+/**
+ * THIS process's start-time, probed on the first lock acquire and cached so later acquires never re-shell.
+ * Not probed at module load: every config read loads this module, and most never take a lock (#5327).
+ * Only a successful probe is cached. A failed one (a PowerShell launch past its 5 s timeout on a loaded
+ * Windows host) is retried on the next acquire, up to SELF_PROBE_ATTEMPTS probes in all, so a host whose
+ * probe never succeeds pays a bounded cost instead of one launch per acquire.
+ * Probed per acquire ATTEMPT, before the O_EXCL create, so a process whose first acquire meets a live
+ * holder still pays it: probing after a successful create instead would widen the empty-body window
+ * that the steal path's `LOCK_STALE_MS` floor relies on.
+ */
+const SELF_PROBE_ATTEMPTS = 2;
+let _selfStartTime = null;
+let _selfProbeAttempts = 0;
+function selfStartTime() {
+    if (_selfStartTime === null && _selfProbeAttempts < SELF_PROBE_ATTEMPTS) {
+        _selfProbeAttempts++;
+        _selfStartTime = getProcessStartTime(process.pid);
+    }
+    return _selfStartTime;
+}
+/** Serialize the lockfile body: JSON carrying the owner token, pid, hostname, start-time, ts. */
+function lockFileBody(token, startTime) {
+    return JSON.stringify({ token, pid: process.pid, hostname: node_os_1.default.hostname(), startTime, ts: Date.now() });
 }
 // ---------------------------------------------------------------------------
 // Liveness probes (test seam)
@@ -364,6 +383,9 @@ function acquireLock(lockPath, opts) {
         ? opts.maxAttempts
         : LOCK_MAX_ATTEMPTS;
     const waitForFresh = !!(opts && opts.waitForFresh);
+    // Probe BEFORE the O_EXCL create: the first probe can be a PowerShell launch, and between the create
+    // and the body write a racing acquirer sees an empty lockfile. That window must stay sub-ms (#5327).
+    const startTime = selfStartTime();
     // A held lock that is NOT steal-eligible: fail-fast (return null) by default, or BACK OFF + RETRY
     // (continue) when waitForFresh and a retry budget remains — so a contended consent writer serializes.
     const blocked = (attempt) => {
@@ -382,7 +404,7 @@ function acquireLock(lockPath, opts) {
             // write/close error, best-effort unlink the file we just created and bail. fs.writeFileSync(fd, …)
             // flushes the WHOLE buffer (no short-write) unlike a bare fs.writeSync.
             try {
-                node_fs_1.default.writeFileSync(fd, lockFileBody(token));
+                node_fs_1.default.writeFileSync(fd, lockFileBody(token, startTime));
             }
             catch (writeErr) {
                 try {