@opengsd/gsd-core 1.17.0 → 1.18.0

package/gsd-core/bin/lib/capability-state.cjs

@@ -47,6 +47,8 @@ const { loadConfig } = configLoaderMod;
 const installProfilesMod = require("./install-profiles.cjs");
 const { readActiveProfile, loadSkillsManifest, resolveProfile, parseRequires, parseCallsAgents, workflowAgentRefs } = installProfilesMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
+const ledgerMod = require("./capability-ledger.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
 const surfaceMod = require("./surface.cjs");
 const { resolveSurface } = surfaceMod;
 // ─── Prototype-pollution guard (inline literal, CodeQL barrier) ───────────────
@@ -265,16 +267,17 @@ function _loadInstalledSkillsManifest(configDir) {
         // SKILL.md must NOT register the stem — otherwise the capability would be
         // wrongly reported surfaced/enabled and a verify:post hook would render
         // for a skill that cannot run.
-        if (!node_fs_1.default.existsSync(skillMdPath))
-            continue;
+        // #5121: bounded read — a missing, non-regular (FIFO/device) or oversized SKILL.md registers no stem.
         let content = '';
         try {
-            content = node_fs_1.default.readFileSync(skillMdPath, 'utf8');
+            content = ledgerMod.readSkillFile(skillMdPath);
         }
         catch {
             // SKILL.md present but unreadable — register with no deps (parity with
             // loadSkillsManifest's readFileSync catch branch).
         }
+        if (content === null)
+            continue;
         // Parse requires: via the SAME shared parser loadSkillsManifest uses, so
         // installed-runtime dependency resolution can never silently diverge from
         // the source-tree path (single source of truth — no duplicated regex).

package/gsd-core/bin/lib/capability-validator.cjs

@@ -1899,6 +1899,10 @@ const REVIEWER_EFFORT_LEVELS = new Set(['minimal', 'low', 'medium', 'high', 'xhi
  * silently rot away from reality (DEFECT.GENERATIVE-FIX).
  */
 const KNOWN_HOST_BEHAVIORS = new Set([
+  // #2586: declares runtime-level feature axes GSD does not/cannot support on
+  // omitting the key on every other runtime carries no inverted meaning.
+  // this host (e.g. Codex's `["context-warnings","phase-lifecycle-display"]`)
+  // — present-and-populated / absent-is-unsupported-empty convention, so
   'agentFileExtension',
   'agentFrontmatterExtensions',
   'agentManifestStyle',
@@ -1916,6 +1920,7 @@ const KNOWN_HOST_BEHAVIORS = new Set([
   'combinedFamilyInstall',
   'commandBodyConverter',
   'contentRewriteProfile',
+  'defaultHomeIncludeRoot',
   'doneBannerStyle',
   'flatCommandDir',
   'frontmatterDialect',
@@ -1953,6 +1958,7 @@ const KNOWN_HOST_BEHAVIORS = new Set([
   'requiresSubagentPair',
   'restoreAtRefTildeInAgents',
   'restoreAtRefTildeInSpecTree',
+  'retargetsGsdCoreProsePath',
   'retiredArtifacts',
   'rewriteClaudeAtIncludes',
   'settingsFileByScope',
@@ -1972,10 +1978,6 @@ const KNOWN_HOST_BEHAVIORS = new Set([
   'specRootSkillPass',
   'tomlConfigInstall',
   'trackCategoryDescription',
-  // #2586: declares runtime-level feature axes GSD does not/cannot support on
-  // this host (e.g. Codex's `["context-warnings","phase-lifecycle-display"]`)
-  // — present-and-populated / absent-is-unsupported-empty convention, so
-  // omitting the key on every other runtime carries no inverted meaning.
   'unsupportedFeatures',
   'verificationStyle',
   'writeCategoryDescription',

package/gsd-core/bin/lib/commands.cjs

@@ -2986,6 +2986,8 @@ async function cmdWebsearch(query, options, raw) {
                         'Accept': 'application/json',
                         'X-Subscription-Token': apiKey
                     },
+                    // never follow redirects: X-Subscription-Token must not leave api.search.brave.com (#5409)
+                    redirect: 'manual',
                     signal: ac.signal
                 });
             }
@@ -3011,7 +3013,9 @@ async function cmdWebsearch(query, options, raw) {
             const status = response.status;
             const isRetryable = status === 429 || status >= 500;
             if (!isRetryable) {
-                // Non-retryable 4xx — fail immediately, no attempts field
+                // Non-retryable 4xx and every 3xx (redirect: 'manual' hands them back as-is, #5409) —
+                // fail immediately, no attempts field. Keep 3xx out of isRetryable.
+                response.body?.cancel().catch(() => { });
                 output({ available: false, error: `API error: ${status}` }, raw, '');
                 return;
             }

package/gsd-core/bin/lib/config-loader.cjs

@@ -25,11 +25,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 const node_fs_1 = __importDefault(require("node:fs"));
-const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // #4717: runtime-identity fill — env rung + per-install marker rung.
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
+const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 const runtime_name_policy_cjs_1 = require("./runtime-name-policy.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
@@ -935,7 +935,7 @@ function loadConfigResolvedInternal(cwd, options = {}) {
         // untouched. Faults in the global file stay silent in this branch (the
         // project config governs; the nearer file is the actionable one).
         try {
-            const shadowHome = process.env['GSD_HOME'] || node_os_1.default.homedir();
+            const shadowHome = (0, runtime_homes_cjs_1.resolveGsdHome)();
             const shadowPath = node_path_1.default.join(shadowHome, '.gsd', 'defaults.json');
             const shadowRead = _readConfigFile(shadowPath);
             if (shadowRead.kind === 'ok') {
@@ -997,7 +997,7 @@ function loadConfigResolvedInternal(cwd, options = {}) {
         }
         // Branch D or E: no .planning/
         try {
-            const home = process.env['GSD_HOME'] || node_os_1.default.homedir();
+            const home = (0, runtime_homes_cjs_1.resolveGsdHome)();
             const globalDefaultsPath = node_path_1.default.join(home, '.gsd', 'defaults.json');
             const globalRead = _readConfigFile(globalDefaultsPath);
             if (globalRead.kind === 'fault') {

package/gsd-core/bin/lib/decision-coverage-support.cjs

@@ -21,6 +21,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decisionMentioned = decisionMentioned;
+exports.phaseDirProblem = phaseDirProblem;
 exports.loadPlanContents = loadPlanContents;
 exports.loadSummaryContents = loadSummaryContents;
 exports.loadDecisionExtraction = loadDecisionExtraction;
@@ -70,6 +71,24 @@ function decisionMentioned(haystack, decision) {
     return phrase ? normalizePhrase(haystack).includes(phrase) : false;
 }
 // ─── File reading ─────────────────────────────────────────────────────────────
+// #4939: loadPlanContents answers no files for a path that is not there, and that reads
+// as "no plan cites anything" — so a phase-dir argument that names no directory
+// (the phase NUMBER in the phase-dir slot) must be told apart BEFORE the scan.
+// Answers null for a directory, else what is wrong with the path and what to do
+// about it. Like the plan gate's contextKind (#4794), the message names the real
+// stat outcome: a permission or I/O failure (EACCES, ELOOP, EIO) is reported as
+// unreadable, not as a missing directory. Only ENOENT/ENOTDIR mean the path is not there.
+function phaseDirProblem(dirPath) {
+    const passDirectory = 'Pass the phase DIRECTORY (e.g. .planning/phases/01-slug), not the phase number.';
+    const st = (0, gate_evidence_cjs_1.statEvidence)(dirPath);
+    if (st.kind === 'none')
+        return { reason: 'phase directory not found', what: 'does not exist', hint: passDirectory, unreadable: false };
+    if (st.kind === 'unreadable')
+        return { reason: 'phase directory unreadable', what: `could not be read (${st.reason})`, hint: 'Check that the directory is readable.', unreadable: true };
+    if (st.value.isDirectory())
+        return null;
+    return { reason: 'phase path is not a directory', what: st.value.isFile() ? 'is a file, not a directory' : 'is not a directory', hint: passDirectory, unreadable: false };
+}
 /**
  * The contents of the phase files `pick` selects (#5170, ADR-5057 §4). An ABSENT phase directory
  * is "no files" (`found []`); a directory or file that exists but cannot be read is `unreadable` —

package/gsd-core/bin/lib/gate-decision-coverage-plan.cjs

@@ -145,9 +145,24 @@ function evaluateDecisionCoveragePlan(input) {
     if (decisions.length === 0) {
         return (0, gate_verdict_cjs_1.gateVerdict)('skip', false, { passed: true, skipped: true, reason: 'no trackable decisions', total: 0, covered: 0, uncovered: [], message: 'No trackable decisions in CONTEXT.md.' });
     }
+    // #4939: a phase-dir argument that was GIVEN but is not a directory is a caller
+    // error like #2770's empty context argument and #4794's non-file context path:
+    // no plan was scanned, so nothing was measured. Fail closed with total/covered
+    // null and `uncovered` omitted. An OMITTED phase dir is left to the scan below —
+    // the #4130 `--context <path>` alone tests pin that as a coverage gap.
+    const phaseDirIssue = phaseDir ? (0, decision_coverage_support_cjs_1.phaseDirProblem)(phaseDir) : null;
+    if (phaseDirIssue) {
+        const phaseDirResult = { passed: false, skipped: false, reason: phaseDirIssue.reason, total: null, covered: null, message: `Decision coverage gate: the phase directory "${positionals[0]}" ${phaseDirIssue.what}, so no plans were scanned. ${phaseDirIssue.hint}` };
+        return phaseDirIssue.unreadable ? (0, gate_verdict_cjs_1.gateUnreadable)(true, phaseDirResult) : (0, gate_verdict_cjs_1.gateVerdict)('block', true, phaseDirResult);
+    }
     const planContents = (0, decision_coverage_support_cjs_1.loadPlanContents)(phaseDir);
     if (planContents.kind === 'unreadable')
         return unreadableDecisionGate(`${planContents.span ?? phaseDir}: ${planContents.reason}`);
+    // #4939: a phase directory that holds no PLAN file is the same caller error: zero plans
+    // loaded is not zero coverage.
+    if (phaseDir && planContents.value.length === 0) {
+        return (0, gate_verdict_cjs_1.gateVerdict)('block', true, { passed: false, skipped: false, reason: 'phase directory holds no plans', total: null, covered: null, message: `Decision coverage gate: the phase directory "${positionals[0]}" holds no PLAN files, so no plans were scanned. Pass the phase DIRECTORY that holds the plans (e.g. .planning/phases/01-slug), not the phase number.` });
+    }
     const sections = planContents.value.map(decision_coverage_support_cjs_1.extractPlanDesignatedSections);
     const uncovered = [];
     let covered = 0;

package/gsd-core/bin/lib/gate-decision-coverage-verify.cjs

@@ -90,6 +90,14 @@ function evaluateDecisionCoverageVerify(input) {
     if (decisions.length === 0) {
         return (0, gate_verdict_cjs_1.gateVerdict)('skip', false, { skipped: true, blocking: false, reason: 'no trackable decisions', total: 0, honored: 0, not_honored: [], message: 'No trackable decisions in CONTEXT.md.' });
     }
+    // #4939: mirror the plan gate. A phase-dir argument that names no directory
+    // means no plan or summary was scanned, so no decision can be reported
+    // not-honored. Warn (verify stays non-blocking) rather than list every decision.
+    const phaseDirIssue = phaseDir ? (0, decision_coverage_support_cjs_1.phaseDirProblem)(phaseDir) : null;
+    if (phaseDirIssue) {
+        const phaseDirResult = { skipped: false, blocking: false, reason: phaseDirIssue.reason, total: null, honored: null, not_honored: [], message: `Decision coverage verify (warning): the phase directory "${args[0]}" ${phaseDirIssue.what}, so no plans or summaries were scanned. ${phaseDirIssue.hint}` };
+        return phaseDirIssue.unreadable ? (0, gate_verdict_cjs_1.gateUnreadable)(false, phaseDirResult) : (0, gate_verdict_cjs_1.gateVerdict)('advisory', false, phaseDirResult);
+    }
     // Every file the haystack is built from is typed evidence (#5170): one that exists but cannot be
     // read is `unreadable`, never an empty slice of the haystack that makes a decision look unhonored.
     const planContents = (0, decision_coverage_support_cjs_1.loadPlanContents)(phaseDir);
@@ -98,6 +106,11 @@ function evaluateDecisionCoverageVerify(input) {
     const summaryParts = (0, decision_coverage_support_cjs_1.loadSummaryContents)(phaseDir);
     if (summaryParts.kind === 'unreadable')
         return unreadableVerify(`${summaryParts.span ?? phaseDir}: ${summaryParts.reason}`);
+    // #4939: mirror the plan gate. A phase directory with no PLAN and no SUMMARY file gave the
+    // verifier nothing to read, which is a caller error, not a phase whose decisions were all missed.
+    if (phaseDir && planContents.value.length === 0 && summaryParts.value.length === 0) {
+        return (0, gate_verdict_cjs_1.gateVerdict)('advisory', false, { skipped: false, blocking: false, reason: 'phase directory holds no plans', total: null, honored: null, not_honored: [], message: `Decision coverage verify (warning): the phase directory "${args[0]}" holds no PLAN or SUMMARY files, so nothing was scanned. Pass the phase DIRECTORY that holds the plans (e.g. .planning/phases/01-slug), not the phase number.` });
+    }
     const modifiedFiles = (0, decision_coverage_support_cjs_1.readModifiedFilesContent)(projectDir, summaryParts.value);
     if (modifiedFiles.kind === 'unreadable')
         return unreadableVerify(`${modifiedFiles.span ?? 'files_modified'}: ${modifiedFiles.reason}`);

package/gsd-core/bin/lib/gate-predicate-evaluator.cjs

@@ -26,6 +26,10 @@
  * This is a leaf pure module: no fs, no child_process, no config — the subprocess
  * seam is injected so the evaluator is trivially testable without spawning.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_path_1 = __importDefault(require("node:path"));
 // ─── Public constants ─────────────────────────────────────────────────────────
 /** Default command timeout for `command-exit-zero` (30s). Matches execTool default. */
 const COMMAND_EXIT_ZERO_DEFAULT_TIMEOUT_MS = 30_000;
@@ -116,15 +120,31 @@ function evaluateArtifactFrontmatterEquals(predicate, ctx, deps) {
         throw new Error('artifact-frontmatter-equals predicate requires an "equals" key');
     }
     const targetDir = isNonEmptyString(ctx.phaseDir) ? ctx.phaseDir : ctx.cwd;
-    const filePath = deps.findPhaseArtifact(targetDir, artifactSuffix);
-    if (!filePath) {
+    // Plain `.sort()` (no locale) so the outcome never depends on directory listing order (#5313).
+    // Set: finders return realpaths, so a symlink to the same file is one artifact, not two.
+    const found = deps.findPhaseArtifact(targetDir, artifactSuffix);
+    // A pre-#5313 dep returned `string | null`; a silent null -> "not found" block or per-character spread would mislead.
+    if (!Array.isArray(found)) {
+        throw new Error('predicate deps "findPhaseArtifact" must return an array of paths');
+    }
+    const candidates = [...new Set(found)].sort();
+    if (candidates.length === 0) {
         return {
             block: true,
             message: `Artifact matching ${artifactSuffix} not found in ${targetDir}`,
             details: { kind: 'artifact-frontmatter-equals', artifactNotFound: true },
         };
     }
-    const fm = deps.readFrontmatter(filePath);
+    // #5313: never pick one of several matches (listing order is OS-dependent); a throw would fail open via onError.
+    if (candidates.length > 1) {
+        const names = candidates.map((c) => node_path_1.default.relative(targetDir, c).split(node_path_1.default.sep).join('/')).join(', ');
+        return {
+            block: true,
+            message: `Multiple artifacts match ${artifactSuffix} in ${targetDir}: ${names}; remove or rename all but one`,
+            details: { kind: 'artifact-frontmatter-equals', ambiguous: true, candidates },
+        };
+    }
+    const fm = deps.readFrontmatter(candidates[0]);
     const actualValue = fm[field];
     // eslint-disable-next-line @typescript-eslint/no-base-to-string
     const expectedStr = typeof expectedValue === 'object' ? JSON.stringify(expectedValue) : String(expectedValue);

package/gsd-core/bin/lib/gate-predicate.cjs

@@ -80,31 +80,27 @@ function buildPredicateDeps() {
             if (phaseDirStat.kind === 'unreadable')
                 return unreadable(phaseDir, phaseDirStat.reason);
             if (phaseDirStat.kind === 'none')
-                return null;
+                return [];
             if (artifactSuffix === '.' ||
                 artifactSuffix === '..' ||
                 artifactSuffix.includes('\0') ||
                 node_path_1.default.basename(artifactSuffix) !== artifactSuffix ||
                 node_path_1.default.win32.basename(artifactSuffix) !== artifactSuffix) {
-                return null;
-            }
-            const directContained = (0, security_cjs_1.tryWithinRoot)(artifactSuffix, phaseDir);
-            if (directContained !== null) {
-                const direct = regularFileOrNull(directContained);
-                if (direct !== null)
-                    return direct;
+                return [];
             }
+            // #5313: collect EVERY distinct match; the evaluator fails closed on >1 instead of trusting listing order.
+            const found = [];
             const planningContained = (0, security_cjs_1.tryWithinRoot)(node_path_1.default.join('.planning', artifactSuffix), phaseDir);
             if (planningContained !== null) {
                 const planning = regularFileOrNull(planningContained);
                 if (planning !== null)
-                    return planning;
+                    found.push(planning);
             }
             const listing = (0, gate_evidence_cjs_1.readDirEvidence)(phaseDir);
             if (listing.kind === 'unreadable')
                 return unreadable(phaseDir, listing.reason);
             if (listing.kind === 'none')
-                return null;
+                return [];
             for (const f of listing.value) {
                 if (f.endsWith('-' + artifactSuffix) || f === artifactSuffix) {
                     const candidateContained = (0, security_cjs_1.tryWithinRoot)(f, phaseDir);
@@ -112,10 +108,10 @@ function buildPredicateDeps() {
                         continue;
                     const candidate = regularFileOrNull(candidateContained);
                     if (candidate !== null)
-                        return candidate;
+                        found.push(candidate);
                 }
             }
-            return null;
+            return found;
         },
         readFrontmatter(filePath) {
             const content = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);

package/gsd-core/bin/lib/gate-tdd-review-checkpoint.cjs

@@ -17,6 +17,12 @@
  * tolerant. A plan id that is not `<phase>-<plan>` (a plan named `.*-PLAN.md`) matches nothing,
  * and a git failure is "no commits" exactly as before.
  *
+ * Cross-plan GREEN (#4867): a gap closure is planned as a RED-only probe plan plus the plan that
+ * `depends_on` it and carries the fix. A `type: tdd` plan with its own RED but no GREEN is credited
+ * with a `feat(...)` commit under any plan that lists it in `depends_on`, directly or through a
+ * chain; the row carries `greenFrom` and the report names the supplier. Its own RED is still
+ * required, and a plan nothing depends on is scored on its own commits alone.
+ *
  * Argv after the verb: `<phase>` (a number; an unresolvable phase reports zero plans).
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
@@ -31,7 +37,7 @@ const gate_evidence_cjs_1 = require("./gate-evidence.cjs");
 const gate_evaluation_scope_cjs_1 = require("./gate-evaluation-scope.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const frontmatterMod = require("./frontmatter.cjs");
-const { frontmatterKeyHasValue } = frontmatterMod;
+const { frontmatterKeyHasValue, extractFrontmatter } = frontmatterMod;
 /**
  * True when the plan's frontmatter declares `type: tdd` (CRLF included, #2449). The block is the
  * one fence owner's, read as RAW text — not through the YAML parser — so a block the parser refuses
@@ -42,6 +48,35 @@ const { frontmatterKeyHasValue } = frontmatterMod;
 function isTddPlan(content) {
     return frontmatterKeyHasValue(content, 'type', 'tdd');
 }
+/** A `depends_on` token as a plan id: `01.1-20`, `01.1-20-PLAN` and `01.1-20-PLAN.md` all name plan `01.1-20`. */
+function toPlanId(token) {
+    return token.trim().replace(/-PLAN(?:\.md)?$/i, '');
+}
+/**
+ * The plan ids a plan lists in `depends_on` (#4867). A plan whose frontmatter does not parse, or has
+ * no `depends_on`, depends on nothing: the pairing below only ever ADDS credit, so an unreadable
+ * link can never turn a failing plan into a passing one.
+ */
+function dependsOnOf(content) {
+    // `extractFrontmatter` does not throw: an unparseable block is an empty result, so `depends_on` is absent.
+    const value = extractFrontmatter(content)['depends_on'];
+    const tokens = Array.isArray(value) ? value.map(String) : typeof value === 'string' ? value.split(',') : [];
+    return tokens.map(toPlanId).filter((id) => id !== '');
+}
+/** Every plan that depends on `planId`, directly or through a chain (#4867); a cycle is walked once. */
+function transitiveDependents(planId, dependents) {
+    const seen = new Set();
+    const queue = [planId];
+    while (queue.length > 0) {
+        for (const next of dependents.get(queue.shift()) ?? []) {
+            if (next !== planId && !seen.has(next)) {
+                seen.add(next);
+                queue.push(next);
+            }
+        }
+    }
+    return [...seen].sort();
+}
 /**
  * The commit types (`test`, `feat`, `refactor`, …) among the plan's own commits — those that
  * touched at least one path (`pathspecs: ['.']`, as the old `git log -- .` lookup did). An
@@ -91,6 +126,9 @@ function evaluateTddReviewCheckpoint(input) {
     const phaseDir = located.kind === 'found' ? located.value : '';
     // Find all PLAN.md files with type: tdd in frontmatter
     const tddPlanFiles = [];
+    // #4867: plan id -> the plans that list it in `depends_on`, over EVERY plan of the phase (a
+    // dependent GREEN plan is usually `type: execute`, not `tdd`).
+    const dependents = new Map();
     const unreadable = [];
     if (phaseDir) {
         const entries = (0, gate_evidence_cjs_1.readDirEvidence)(phaseDir);
@@ -110,8 +148,13 @@ function evaluateTddReviewCheckpoint(input) {
                     const plan = (0, gate_evidence_cjs_1.readTextEvidence)(planPath);
                     if (plan.kind === 'unreadable')
                         unreadable.push({ source: planPath, reason: plan.reason });
-                    else if (plan.kind === 'found' && isTddPlan(plan.value))
-                        tddPlanFiles.push(planPath);
+                    else if (plan.kind === 'found') {
+                        if (isTddPlan(plan.value))
+                            tddPlanFiles.push(planPath);
+                        const planId = node_path_1.default.basename(planPath, '-PLAN.md');
+                        for (const dep of dependsOnOf(plan.value))
+                            dependents.set(dep, [...(dependents.get(dep) ?? []), planId]);
+                    }
                 }
             }
         }
@@ -136,15 +179,24 @@ function evaluateTddReviewCheckpoint(input) {
         const planId = node_path_1.default.basename(planPath, '-PLAN.md');
         const kinds = planCommitKinds(projectDir, planId);
         const red = kinds.has('test');
-        const green = kinds.has('feat');
         const refactor = kinds.has('refactor');
+        // #4867: a RED-only probe plan is satisfied by the GREEN of a plan that (transitively) declares
+        // `depends_on` it. Only a real `feat(...)` commit under such a plan counts; the plan's own RED is
+        // still required, and a plan nothing depends on is scored on its own commits alone.
+        const ownGreen = kinds.has('feat');
+        const greenFrom = ownGreen
+            ? []
+            : transitiveDependents(planId, dependents).filter((dependentId) => planCommitKinds(projectDir, dependentId).has('feat'));
+        const green = ownGreen || greenFrom.length > 0;
         const missing = [];
         if (!red)
             missing.push('RED');
         if (!green)
             missing.push('GREEN');
         const status = missing.length === 0 ? 'Pass' : 'FAIL';
-        rows.push({ planId, red, green, refactor, status, missing });
+        rows.push(greenFrom.length > 0
+            ? { planId, red, green, refactor, status, missing, greenFrom }
+            : { planId, red, green, refactor, status, missing });
     }
     const violations = rows.filter(r => r.status === 'FAIL').length;
     // Build review table
@@ -160,6 +212,9 @@ function evaluateTddReviewCheckpoint(input) {
         tableDivider,
         ...tableRows,
     ].join('\n');
+    for (const r of rows.filter(row => row.greenFrom)) {
+        table += `\n\nPlan ${r.planId} GREEN is supplied by dependent plan ${(r.greenFrom ?? []).join(', ')}.`;
+    }
     if (violations > 0) {
         table += '\n\n⚠ Gate violations are advisory — review before advancing.';
         for (const r of rows.filter(row => row.status === 'FAIL')) {

package/gsd-core/bin/lib/init.cjs

@@ -20,6 +20,8 @@ const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 const io = require("./io.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- config-loader.cjs is an export= CommonJS module
 const configLoader = require("./config-loader.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- capability-ledger.cjs is an export= CommonJS module
+const capabilityLedger = require("./capability-ledger.cjs");
 const project_root_cjs_1 = require("./project-root.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- model-resolver.cjs is an export= CommonJS module
 const modelResolver = require("./model-resolver.cjs");
@@ -3773,7 +3775,7 @@ function buildAgentSkillsBlock(config, agentType, projectRoot, diagnostics) {
     }).join('\n');
     return `<agent_skills>\nRead these user-configured skills:\n${lines}\n</agent_skills>`;
 }
-function cmdAgentSkills(cwd, agentType, raw, jsonMode) {
+function cmdAgentSkills(cwd, agentType, raw, jsonMode, skillsOnly = false) {
     if (!agentType) {
         output('', raw, '');
         return;
@@ -3804,8 +3806,13 @@ function cmdAgentSkills(cwd, agentType, raw, jsonMode) {
     // (a real exit code) instead of a prose config-get gate. Compact is tried
     // first when requested; a missing compact sibling falls back to canonical
     // with the fallback disclosed in the payload itself, never a silent switch.
+    //
+    // #5122: `skillsOnly` (the CLI's `--skills-only`) is the agent's own
+    // self-load. It wants configured skills and nothing else, so it skips the
+    // fallback on every runtime — otherwise a non-Claude agent reads its own
+    // persona back into itself as if it were a skills block.
     let agentPayloadVariant = null;
-    if (!block) {
+    if (!block && !skillsOnly) {
         const runtime = (config && config['runtime']) || process.env['GSD_RUNTIME'] || 'claude';
         if (runtime !== 'claude') {
             const agentCheck = checkAgentsInstalled(runtime, projectRoot);
@@ -4071,7 +4078,7 @@ function buildSkillManifest(cwd, skillsDir = null) {
             if (!entry.isDirectory())
                 continue;
             const skillMdPath = node_path_1.default.join(rootPath, entry.name, 'SKILL.md');
-            const content = (0, shell_command_projection_cjs_1.platformReadSync)(skillMdPath);
+            const content = capabilityLedger.readSkillFile(skillMdPath);
             if (content !== null) {
                 if (pushSkillEntry(`${entry.name}/SKILL.md`, content, skillMdPath))
                     skillCount++;
@@ -4096,7 +4103,7 @@ function buildSkillManifest(cwd, skillsDir = null) {
                 if (!nested.isDirectory())
                     continue;
                 const nestedSkillMd = node_path_1.default.join(nestedSkillsDir, nested.name, 'SKILL.md');
-                const nestedContent = (0, shell_command_projection_cjs_1.platformReadSync)(nestedSkillMd);
+                const nestedContent = capabilityLedger.readSkillFile(nestedSkillMd);
                 if (nestedContent === null)
                     continue;
                 // Use forward-slash separator explicitly so manifest paths are posix-style

package/gsd-core/bin/lib/install-effort-resolver.cjs

@@ -35,7 +35,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  */
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const node_os_1 = __importDefault(require("node:os"));
+const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- install-fs-adapter.cjs is an export= CommonJS module
 const installFsAdapter = require("./install-fs-adapter.cjs");
 const { installFs } = installFsAdapter;
@@ -154,7 +154,7 @@ function _findAncestorGsdConfigPath(targetDir) {
  * @param targetDir  Runtime install root (walks up to find .planning/).
  */
 function readGsdEffectiveEffortConfig(targetDir = null) {
-    const homeDefaults = _readGsdConfigFile(node_path_1.default.join(node_os_1.default.homedir(), '.gsd', 'defaults.json'), '~/.gsd/defaults.json');
+    const homeDefaults = _readGsdConfigFile(node_path_1.default.join((0, runtime_homes_cjs_1.resolveGsdHome)(), '.gsd', 'defaults.json'), '~/.gsd/defaults.json');
     let projectConfig = null;
     if (targetDir) {
         const candidate = _findAncestorGsdConfigPath(targetDir);

package/gsd-core/bin/lib/install-model-override-resolver.cjs

@@ -34,6 +34,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  */
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
+const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- install-fs-adapter.cjs is an export= CommonJS module
 const installFsAdapter = require("./install-fs-adapter.cjs");
 const { installFs } = installFsAdapter;
@@ -57,7 +58,7 @@ const { resolveTierEntry: gsdResolveTierEntry, resolveModelPolicy: gsdResolveMod
  */
 function readGsdGlobalModelOverrides(options = {}) {
     try {
-        const home = options.homedir ? options.homedir() : node_os_1.default.homedir();
+        const home = (0, runtime_homes_cjs_1.resolveGsdHome)(options.homedir ? options.homedir() : node_os_1.default.homedir());
         const defaultsPath = node_path_1.default.join(home, '.gsd', 'defaults.json');
         if (!installFs().existsSync(defaultsPath))
             return null;
@@ -139,7 +140,7 @@ function readGsdAgentTools(config) {
  * model override resolver.
  */
 function readGsdEffectiveAgentTools(targetDir = null, options = {}) {
-    const home = options.homedir ? options.homedir() : node_os_1.default.homedir();
+    const home = (0, runtime_homes_cjs_1.resolveGsdHome)(options.homedir ? options.homedir() : node_os_1.default.homedir());
     const globalConfig = _readGsdConfigFile(node_path_1.default.join(home, '.gsd', 'defaults.json'), 'global defaults');
     let projectConfig = null;
     if (targetDir) {
@@ -170,7 +171,7 @@ function readGsdEffectiveAgentTools(targetDir = null, options = {}) {
  * baked, letting the runtime's own default/session model govern).
  */
 function readGsdRuntimeProfileResolver(targetDir = null) {
-    const homeDefaults = _readGsdConfigFile(node_path_1.default.join(node_os_1.default.homedir(), '.gsd', 'defaults.json'), '~/.gsd/defaults.json');
+    const homeDefaults = _readGsdConfigFile(node_path_1.default.join((0, runtime_homes_cjs_1.resolveGsdHome)(), '.gsd', 'defaults.json'), '~/.gsd/defaults.json');
     // #2875 defect fix (Generative Fix Divergence): same shared walk as
     // readGsdEffectiveModelOverrides above — see that call site's comment.
     let projectConfig = null;

package/gsd-core/bin/lib/install-profiles.cjs

@@ -31,6 +31,8 @@ const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 // #2322: reuse the existing pure path-containment seam (ADR-1239 Phase C-2)
 // instead of hand-rolling a new traversal check for capability skill stems.
 const external_descriptor_trust_cjs_1 = require("./external-descriptor-trust.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- capability-ledger.cjs is an export= CommonJS module
+const capabilityLedger = require("./capability-ledger.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const conversionModule = require("./runtime-artifact-conversion.cjs");
 const { applyAgentPathRewrites: _applyAgentPathRewrites, processAttribution: _processAttribution, normalizeAgentBodyForRuntime: _normalizeAgentBodyForRuntime, readGsdCommandNames: _readGsdCommandNames, deriveAgentName: _deriveAgentName, applyAgentFrontmatterExtensions: _applyAgentFrontmatterExtensions, appendAgentTools: _appendAgentTools, } = conversionModule;
@@ -748,9 +750,9 @@ function readInstalledCapabilitySkill(stem, registry) {
         // installed as a capability skill (epic #4636).
         if (node_fs_1.default.lstatSync(skillPath).isSymbolicLink())
             return null;
-        if (!node_fs_1.default.statSync(skillPath).isFile())
-            return null;
-        return { capId, content: node_fs_1.default.readFileSync(skillPath, 'utf8') };
+        // #5121: the bounded regular-file read — a FIFO/device/oversized SKILL.md is skipped like a missing one.
+        const content = capabilityLedger.readSkillFile(skillPath);
+        return content === null ? null : { capId, content };
     }
     catch {
         return null; // missing / unreadable / corrupt entry -> skip