@opengsd/gsd-core 1.17.0 → 1.19.0

package/gsd-core/bin/lib/read-only-git-env.cjs

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * read-only-git-env.cts — the single owner of the read-only git env block
+ * (#5048). CONTEXT.md / OS Shell Projection seam.
+ *
+ * By default `git status` refreshes the index and takes an *optional*
+ * `.git/index.lock` to write the refreshed copy back. That is a write the caller
+ * never asked for, and it turns a pure read into a contender for the lock a
+ * real `git add` / `git commit` needs — so a read-only statusline render can
+ * make a concurrent commit fail with
+ * `Unable to create '.git/index.lock': File exists`. `GIT_OPTIONAL_LOCKS=0`
+ * tells git to skip only those *optional* index operations. Nothing a read
+ * needs is lost: `git status` reads the index, it just doesn't need to rewrite
+ * it.
+ *
+ * ## Why this module exists
+ *
+ * The block used to be hand-written at every seam that spawns git for a read.
+ * Six copies of `{ ...process.env, GIT_OPTIONAL_LOCKS: '0' }` is six places to
+ * forget when a seam is added, and a probe that checks each seam for the literal
+ * value passes even when a seam stopped consulting the owner. One owner makes
+ * the drift structural instead: the parity test patches THIS function to a
+ * sentinel and asserts every seam's spawn carries the sentinel, so a seam that
+ * hand-writes the variable again fails red rather than passing quietly.
+ * (tests/git-optional-locks-parity.test.cjs, "#5048 every seam reads the shared
+ * owner".)
+ *
+ * ## Why the hook scripts require the built artifact
+ *
+ * `hooks/*.js` are staged as standalone files at install time, so they reach
+ * compiled `src/` modules through `../gsd-core/bin/lib/*.cjs` rather than a
+ * sibling hooks/-tree file — the same rule hooks/lib/git-cmd.js follows for
+ * token-scanner. They call `readOnlyGitEnv()` per spawn rather than snapshotting
+ * the result at module load, so a later `process.env` mutation is visible and the
+ * two behave identically.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOnlyGitEnv = readOnlyGitEnv;
+/**
+ * Build the env for a read-only git spawn.
+ *
+ * @param base Environment to spread, `process.env` by default. Callers that
+ *   layer extra git variables on top (GIT_TERMINAL_PROMPT, a caller's own
+ *   overrides) pass them in `base`; callers that must let a caller-supplied
+ *   override win spread the result and apply their own keys afterwards.
+ * @returns A fresh object each call — never the cached `process.env`.
+ */
+function readOnlyGitEnv(base = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(base)) {
+        // process.env carries undefined-valued keys on some platforms; spawn()
+        // rejects a non-string value rather than ignoring it.
+        if (value !== undefined)
+            env[key] = value;
+    }
+    env.GIT_OPTIONAL_LOCKS = '0';
+    return env;
+}

package/gsd-core/bin/lib/report-parser.cjs

@@ -6,7 +6,7 @@ exports.parseTestReport = parseTestReport;
 const tap_parser_cjs_1 = require("./vendor/tap-parser.cjs");
 const saxes_cjs_1 = require("./vendor/saxes.cjs");
 exports.ReportFormat = {
-    Tap: 'tap', Junit: 'junit', SwiftTesting: 'swift-testing', Unittest: 'unittest', Unknown: 'unknown',
+    Tap: 'tap', Junit: 'junit', SwiftTesting: 'swift-testing', Unittest: 'unittest', GoTest: 'go-test', Unknown: 'unknown',
 };
 exports.TestStatus = { Passed: 'passed', Failed: 'failed', Skipped: 'skipped', Todo: 'todo' };
 function parseTap(output) {
@@ -247,7 +247,63 @@ function parseUnittest(output) {
     report.valid = report.issues.length === 0;
     return report;
 }
+/**
+ * `go test` text output (#5106). Plain console text, so the shape is matched by line:
+ *   --- FAIL: TestName (0.00s)          one per failed test (every test with -v; subtests indented)
+ *   FAIL\texample.com/pkg\t0.004s        one package summary per package, after that package's tests
+ *   FAIL\texample.com/pkg [build failed]   the package did not compile — nothing asserted anything
+ * A test's name carries no package, so each test is also known as `<package>.<name>`, attributed to
+ * the next package summary line. The same name failing in two packages is ambiguous until qualified.
+ * `go test -json` is not text and stays unsupported.
+ */
+const GO_TEST_RESULT = /^[ \t]*-{3} (PASS|FAIL|SKIP): (\S+) \(\d+(?:\.\d+)?s\)$/; // -{3}: not a literal fence, see frontmatter-fence-drift
+const GO_PACKAGE_LINE = /^(ok|FAIL|\?)[ \t]+(\S+)[ \t]+(?:\d+(?:\.\d+)?s\b|\(cached\)|\[([a-z ]+)\])/;
+function isGoTestOutput(output) {
+    if (/^TAP version \d+/.test(output.trimStart()))
+        return false;
+    return output.split(/\r?\n/).some((line) => GO_TEST_RESULT.test(line) || GO_PACKAGE_LINE.test(line));
+}
+function parseGoTest(output) {
+    const report = { format: exports.ReportFormat.GoTest, valid: true, tests: [], issues: [] };
+    let segment = [];
+    let packages = 0;
+    for (const line of output.split(/\r?\n/)) {
+        const result = GO_TEST_RESULT.exec(line);
+        if (result) {
+            const name = result[2];
+            const status = result[1] === 'FAIL' ? exports.TestStatus.Failed : result[1] === 'SKIP' ? exports.TestStatus.Skipped : exports.TestStatus.Passed;
+            if (!segment.some((test) => test.name === name && test.status === status)) {
+                segment.push({ name, identities: [name], group: null, groupIdentities: [], status });
+            }
+            continue;
+        }
+        const pkg = GO_PACKAGE_LINE.exec(line);
+        if (!pkg)
+            continue;
+        packages++;
+        const [, outcome, importPath, bracket] = pkg;
+        if (outcome === 'FAIL' && (bracket === 'build failed' || bracket === 'setup failed')) {
+            report.buildFailed = true;
+            report.issues.push(`go test package ${importPath} ${bracket}`);
+        }
+        else if (outcome === 'ok' && segment.some((test) => test.status === exports.TestStatus.Failed)) {
+            report.issues.push(`go test package ${importPath} is ok but its output reports a failed test`);
+        }
+        for (const test of segment)
+            test.identities.push(`${importPath}.${test.name}`);
+        report.tests.push(...segment);
+        segment = [];
+    }
+    if (packages === 0)
+        report.issues.push('Missing go test package summary');
+    if (segment.length > 0)
+        report.issues.push('go test results without a following package summary');
+    report.valid = report.issues.length === 0;
+    return report;
+}
 const adapters = [
+    // Before TAP: a run whose first package is fine begins `ok  <TAB>pkg`, which the TAP matcher reads as a point.
+    { matches: isGoTestOutput, parse: parseGoTest },
     { matches: (output) => /^(?:TAP version \d+|(?:not )?ok\b|1\.\.\d+|#)/.test(output.trimStart()), parse: parseTap },
     { matches: (output) => output.trimStart().startsWith('<'), parse: parseJunit },
     { matches: (output) => new RegExp(SWIFT_AGGREGATE.source, 'm').test(output), parse: parseSwiftTesting },

package/gsd-core/bin/lib/review-lane-descriptor.cjs

@@ -58,6 +58,7 @@ exports.DOCS_PARITY_VIOLATION = exports.LANE_SLUG_RE = exports.PARITY_VIOLATION
 exports.mergeReviewerLanes = mergeReviewerLanes;
 exports.checkReviewerLaneParity = checkReviewerLaneParity;
 exports.checkReviewerDocsParity = checkReviewerDocsParity;
+const text_lines_cjs_1 = require("./text-lines.cjs");
 /**
  * Argv placeholders (Phase 5b, #2799).
  *
@@ -576,6 +577,7 @@ exports.PARITY_VIOLATION = Object.freeze({
     REGISTRY_LANE_UNDECLARED: 'registry_lane_undeclared',
     DESCRIPTOR_LANE_NOT_IN_REGISTRY: 'descriptor_lane_not_in_registry',
     BESPOKE_LEG_PRESENT: 'bespoke_leg_present',
+    AVAILABILITY_FALLBACK_MISMATCH: 'availability_fallback_mismatch',
     DUPLICATE_SLUG: 'duplicate_slug',
     DUPLICATE_FLAG: 'duplicate_flag',
     DUPLICATE_SECTION: 'duplicate_section',
@@ -607,6 +609,10 @@ const LEG_MARKER_RE = /<!--\s*reviewer-lane:\s*([a-z0-9_-]+)\s*-->/g;
  * design principle of this module.
  */
 exports.LANE_SLUG_RE = /^[a-z0-9][a-z0-9_-]*$/;
+/** The workflow's availability call: `gsd_run review-lane availability ...` at command position. */
+const AVAILABILITY_CALL_RE = /^\s*gsd_run review-lane availability(?:\s|$)/;
+/** One `<slug>:missing` row in the printf fallback; slug is LANE_SLUG_RE's grammar capped at 32 chars. */
+const AVAILABILITY_FALLBACK_ROW_RE = /(?:'|\\n)([a-z0-9][a-z0-9_-]{0,31}):missing/g;
 /** Bounds of the step a bespoke leg marker could appear inside. */
 const INVOKE_STEP_RE = /<step name="invoke_reviewers">([\s\S]*?)<\/step>/;
 function sliceStep(workflowText, re) {
@@ -627,8 +633,10 @@ function countOccurrences(haystack, re) {
 }
 /**
  * Bidirectional parity across three surfaces: the descriptor, the roster
- * (`KNOWN_REVIEWER_SLUGS`), and the generated capability **registry** — plus one anti-parity
- * assertion against the workflow.
+ * (`KNOWN_REVIEWER_SLUGS`), and the generated capability **registry** — plus two assertions
+ * against the workflow: the anti-parity check, and the availability-fallback check (the workflow
+ * makes the availability call, has a fallback row per lane, and the fallback slug set equals the
+ * openai-http lanes).
  *
  * **Re-pointed by Phase 5b (#2799).** Through Phase 5a this function also required a literal
  * `<!-- reviewer-lane: <slug> -->` per lane inside `invoke_reviewers` and a literal
@@ -671,6 +679,7 @@ function checkReviewerLaneParity(input) {
     const seenSlug = new Set();
     const seenFlag = new Set();
     const seenSection = new Set();
+    const httpSlugs = new Set();
     // The declared parameter type says `ReviewerLane[]`, but this function is a
     // trust boundary — narrow from `unknown` rather than believing the annotation.
     const rawLanes = Array.isArray(descriptor) ? descriptor : [];
@@ -689,6 +698,8 @@ function checkReviewerLaneParity(input) {
         if (seenSlug.has(slug))
             add(exports.PARITY_VIOLATION.DUPLICATE_SLUG, slug);
         seenSlug.add(slug);
+        if (lane.transport === 'openai-http')
+            httpSlugs.add(slug);
         const flags = Array.isArray(lane.flags) ? lane.flags : [];
         for (const flag of flags) {
             if (typeof flag !== 'string')
@@ -740,6 +751,28 @@ function checkReviewerLaneParity(input) {
     for (const slug of markerSlugs.keys()) {
         add(exports.PARITY_VIOLATION.BESPOKE_LEG_PRESENT, slug);
     }
+    // --- the availability call's `||` fallback must name exactly the openai-http lanes ---
+    //
+    // review.md prints these rows only when an older gsd-tools lacks `review-lane availability`, so
+    // they are a second hand-kept copy of the roster. Checked only when the call is present.
+    // Anchored to the command position so a comment or prose mention cannot shadow the real call;
+    // a missing call is itself a violation (otherwise deleting it would silently skip this check).
+    const availabilityLine = (0, text_lines_cjs_1.splitLines)(workflowText).find((line) => AVAILABILITY_CALL_RE.test(line));
+    if (availabilityLine === undefined) {
+        add(exports.PARITY_VIOLATION.AVAILABILITY_FALLBACK_MISMATCH, 'no-call');
+    }
+    else {
+        if (!availabilityLine.includes('review-lane availability ||')) {
+            add(exports.PARITY_VIOLATION.AVAILABILITY_FALLBACK_MISMATCH, 'no-fallback');
+        }
+        const fallback = new Set(Array.from(availabilityLine.matchAll(AVAILABILITY_FALLBACK_ROW_RE), (m) => m[1]));
+        for (const slug of fallback)
+            if (!httpSlugs.has(slug))
+                add(exports.PARITY_VIOLATION.AVAILABILITY_FALLBACK_MISMATCH, slug);
+        for (const slug of httpSlugs)
+            if (!fallback.has(slug))
+                add(exports.PARITY_VIOLATION.AVAILABILITY_FALLBACK_MISMATCH, slug);
+    }
     return { ok: violations.length === 0, violations };
 }
 /* ------------------------------------------------------------------ *

package/gsd-core/bin/lib/review-lane-invocation.cjs

@@ -31,6 +31,7 @@ exports.resolveTimeoutMs = resolveTimeoutMs;
 exports.nativeTimeoutToken = nativeTimeoutToken;
 exports.isEmptyReview = isEmptyReview;
 exports.fileRefPrompt = fileRefPrompt;
+exports.applyPromptOverride = applyPromptOverride;
 exports.artifactPaths = artifactPaths;
 exports.resolveLaneBudget = resolveLaneBudget;
 exports.resolveLanePlan = resolveLanePlan;
@@ -229,6 +230,45 @@ function fileRefPrompt(promptPath, repoRoot) {
         `review request against that absolute root. Output only the resulting markdown review. ` +
         `Do not edit any files.`);
 }
+/**
+ * Re-point a resolved plan at a different prompt file (`review-lane invoke --prompt-file`, #5049).
+ *
+ * The override carries a budget-trimmed prompt, so it has to land wherever THIS lane actually
+ * reads its prompt, and that differs by channel:
+ *   - `stdin`: the runner streams the file `plan.stdin` names.
+ *   - `argv-file-ref`: the prompt PATH is embedded in a sentence in argv (`fileRefPrompt`), already
+ *     expanded by the time an override can run. Swapping `plan.promptPath` alone changes nothing
+ *     the CLI reads, which is how the override was dropped silently for cursor, antigravity and
+ *     kimi-code.
+ *   - `argv`: the bare path is an argv element.
+ *   - `openai-http`: the runner reads `plan.promptPath`.
+ * Argv elements are matched whole (the file-ref sentence, or the bare path), never by substring,
+ * so an unrelated argument that merely contains the path is left alone. `promptPath` moves with
+ * argv: the antigravity handler re-derives the sentence it swaps from `plan.promptPath` and would
+ * otherwise stop recognising it. A plan that takes no prompt (`none`) is returned unchanged.
+ * Pure: returns a new plan and never mutates the one it is given.
+ */
+function applyPromptOverride(plan, promptPath, repoRoot) {
+    if (plan.transport !== 'spawn')
+        return { ...plan, promptPath };
+    if (plan.stdin)
+        return { ...plan, stdin: promptPath, promptPath };
+    const oldRef = fileRefPrompt(plan.promptPath, repoRoot);
+    const newRef = fileRefPrompt(promptPath, repoRoot);
+    let replaced = false;
+    const argv = plan.argv.map((a) => {
+        if (a === oldRef) {
+            replaced = true;
+            return newRef;
+        }
+        if (a === plan.promptPath) {
+            replaced = true;
+            return promptPath;
+        }
+        return a;
+    });
+    return replaced ? { ...plan, argv, promptPath } : plan;
+}
 /** Run-dir artifact paths. POSIX-joined: these are workflow-visible strings, not OS paths. */
 function artifactPaths(runDir, slug) {
     const base = String(runDir ?? '').replace(/\/+$/, '');

package/gsd-core/bin/lib/review-lane-runner.cjs

@@ -32,6 +32,7 @@ exports.parseModelBanner = parseModelBanner;
 exports.parseTranscriptModel = parseTranscriptModel;
 exports.checkEgressHost = checkEgressHost;
 exports.probeLane = probeLane;
+exports.probeHttpLanes = probeHttpLanes;
 exports.writeReviewOrStub = writeReviewOrStub;
 exports.emptyOutputDiagnosis = emptyOutputDiagnosis;
 exports.handleOpencodeOutput = handleOpencodeOutput;
@@ -318,14 +319,18 @@ async function probeLane(plan, deps) {
             // Only a STRING config value names a host. `String(unknown)` would turn an object into the
             // literal '[object Object]' and probe that as a URL — a nonsense destination reported as
             // "unreachable" rather than as the misconfiguration it is.
+            // For openai-http, `plan.host` is already resolved by `resolveLanePlan` (config → default,
+            // unset sentinels like "null" handled) — probe the destination the run would use.
             const configured = deps.configGet(probe.hostConfigKey);
-            const base = (0, review_lane_invocation_cjs_1.normalizeHost)((typeof configured === 'string' ? configured : '') ||
-                (plan.transport === 'openai-http' ? plan.host : ''));
+            const base = (0, review_lane_invocation_cjs_1.normalizeHost)((plan.transport === 'openai-http' ? plan.host : '') || (typeof configured === 'string' ? configured : ''));
             if (!base) {
                 return { available: false, reason: review_lane_invocation_cjs_1.LANE_UNAVAILABLE.HOST_UNREACHABLE, detail: 'no host resolved' };
             }
-            const r = await deps.httpJson(`${base}${probe.path}`, { method: 'GET', timeoutMs: probe.timeoutMs });
-            return r.ok
+            // D7: reachable ⇒ available. Any HTTP answer (401 behind an auth proxy, 404, 3xx) proves a
+            // server is there; only a transport failure (status 0) does not. Redirects are not followed:
+            // a probe must not issue a request to a host the descriptor never named.
+            const r = await deps.httpJson(`${base}${probe.path}`, { method: 'GET', timeoutMs: probe.timeoutMs, probe: true });
+            return r.status > 0
                 ? { available: true }
                 : {
                     available: false,
@@ -341,6 +346,25 @@ async function probeLane(plan, deps) {
             };
     }
 }
+/**
+ * `<slug>:available|missing` rows for the openai-http lanes in `lanes` (all, or those in `selected`).
+ * Prerequisite binaries are not folded in: the caller reports `jq` separately. An unresolvable lane
+ * reads `missing` and its reason is returned in `warnings` rather than swallowed.
+ */
+async function probeHttpLanes(lanes, selected, resolve, deps) {
+    // Probes run concurrently (each has its own timeout); Promise.all keeps descriptor order, and
+    // warnings are collected from the results afterwards so their order never depends on resolve timing.
+    const results = await Promise.all(lanes
+        .filter((l) => l.transport === 'openai-http' && (selected.length === 0 || selected.includes(l.slug)))
+        .map(async (lane) => {
+        const r = resolve(lane);
+        const up = r.ok && (await probeLane({ ...r.plan, requiresBinaries: [] }, deps)).available;
+        return { row: `${lane.slug}:${up ? 'available' : 'missing'}`, warning: r.ok ? null : `${lane.slug}: ${r.detail}` };
+    }));
+    const rows = results.map((x) => x.row);
+    const warnings = results.flatMap((x) => (x.warning === null ? [] : [x.warning]));
+    return { rows, warnings };
+}
 /* ------------------------------------------------------------------ *
  * Empty-output policy (#2494 / #2605 / #2794)
  * ------------------------------------------------------------------ */
@@ -940,6 +964,11 @@ async function runOpenAiCompatible(plan, promptText, deps) {
     let model = plan.model;
     if (!model && plan.modelsUrl) {
         const listed = await deps.httpJson(plan.modelsUrl, { method: 'GET', timeoutMs: 2_000 });
+        // A redirect is a lane failure, not "discovery found nothing" (#5433): the host answered with
+        // somewhere else to go, so the configured URL is wrong and the completions request would be too.
+        if (listed.status >= 300 && listed.status < 400 && listed.error) {
+            return { review: '', rawBody: listed.error, model: recordedModel(plan.fallbackModel, exports.MODEL_SOURCE.REQUESTED) };
+        }
         if (listed.ok) {
             try {
                 const parsed = JSON.parse(listed.body);

package/gsd-core/bin/lib/review-reviewer-selection.cjs

@@ -113,6 +113,22 @@ exports.KNOWN_REVIEWER_SLUGS = (() => {
         return [];
     }
 })();
+/**
+ * #5359: map a lane flag alias (`agy` for `--agy`) to its canonical slug via the
+ * descriptor roster's declared `flags` (same source as `review-lane explicit-from-argv`).
+ * Guarded like KNOWN_REVIEWER_SLUGS: a load failure degrades to the plain error.
+ */
+function laneSlugForAlias(name, lanes) {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const roster = lanes ?? require('./review-lane-descriptor.cjs').REVIEWER_LANES;
+        // `l.slug !== name`: an undetected canonical slug (`--codex` flag) is not an alias.
+        return roster.find((l) => l.slug !== name && l.flags.includes(`--${name}`))?.slug;
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Instance names are lowercase slugs that must not shadow a built-in slug. */
 exports.INSTANCE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 function normalizeConfiguredDefaultReviewers(rawValue) {
@@ -239,7 +255,10 @@ function resolveReviewerSelection(input) {
         // Sorted so the error order does not depend on flag order on the command line.
         const missing = [...explicitFlags].filter((slug) => !detected.has(slug)).sort();
         for (const slug of missing) {
-            errors.push(`explicit reviewer '${slug}' is not available on this host`);
+            const canonical = laneSlugForAlias(slug, input.lanes);
+            errors.push(canonical
+                ? `explicit reviewer '${slug}' is a flag alias; pass its canonical slug '${canonical}'`
+                : `explicit reviewer '${slug}' is not available on this host`);
         }
         // Guarded on the error count as it stood BEFORE this branch, so the
         // aggregate message fires under exactly the conditions it did previously.

package/gsd-core/bin/lib/roadmap-parser.cjs

@@ -78,6 +78,17 @@ function isClosedMilestoneHeading(headingText) {
 function stripShippedMilestones(content) {
     return (0, markdown_sectionizer_cjs_1.stripTaggedBlocks)(content, 'details');
 }
+/**
+ * #5543: run `edit` over the ROADMAP with every shipped `<details>` block hidden
+ * and restored byte-for-byte afterwards. For writers whose active milestone
+ * could not be resolved: the first `### Phase N:` in document order must never
+ * be the one inside a shipped block. Layout-independent (the active phase may
+ * sit before or after a shipped block) and, unlike a "region after the last
+ * `</details>`" cut, not fooled by a `</details>` in a fence or inline code.
+ */
+function editOutsideShippedBlocks(content, edit) {
+    return (0, markdown_sectionizer_cjs_1.editOutsideTaggedBlocks)(content, 'details', edit);
+}
 /**
  * #3982: strip only <details> blocks whose <summary> marks a CLOSED milestone
  * (ARCHIVED/SHIPPED/✅/… without an active marker) — the narrow form of
@@ -2287,6 +2298,7 @@ module.exports = {
     getMilestonePhaseFilter,
     currentMilestoneRawRanges,
     withPhaseSection,
+    editOutsideShippedBlocks,
     computeMilestoneSectionEnd,
     locateMilestoneHeadings,
     listMilestoneHeadings,

package/gsd-core/bin/lib/roadmap-upgrade.cjs

@@ -12,7 +12,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const node_child_process_1 = require("node:child_process");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
@@ -1923,7 +1922,45 @@ function applyMigration(cwd, plan, options = {}) {
     // ── Real run: verify clean working tree ───────────────────────────────────
     let gitStatus;
     try {
-        gitStatus = (0, node_child_process_1.execSync)('git status --porcelain', { cwd, encoding: 'utf8', windowsHide: true, timeout: 10_000 });
+        // #5048: this is a read-only spawn, but git still refreshes the index under
+        // it and takes the optional `.git/index.lock` to write the refreshed copy
+        // back — which can lose a race against a real `git add` / `git commit` in
+        // the same repo. Routing through the shared execGit seam (CONTEXT.md, OS
+        // Shell Projection) is what gets GIT_OPTIONAL_LOCKS=0 here; a bare execSync
+        // bypassed the seam and therefore the opt-out, so this call site was the one
+        // read-only `git status` the seam change did not reach. shell-free, so no
+        // argv quoting or PATH-resolution policy is introduced.
+        const statusTimeoutMs = 10_000;
+        const result = (0, shell_command_projection_cjs_1.execGit)(['status', '--porcelain'], { cwd, timeout: statusTimeoutMs });
+        // #5048: execSync carried the cause on the thrown error. execGit reports a
+        // timeout, a spawn/buffer failure or a signal through `timedOut`/`error`/
+        // `signal` with an exit code of `status ?? 1` and often an empty stderr.
+        // Order matters: a maxBuffer overflow returns signal SIGTERM *and*
+        // error.code ENOBUFS — check `error` before `signal` so the real cause is
+        // not reported as "killed by SIGTERM". Only a genuine non-zero exit falls
+        // through. (ENOENT is rewritten by `_spawnResult` to exit 127 + stderr.)
+        if (result.timedOut) {
+            throw new Error(`git status timed out after ${statusTimeoutMs} ms`);
+        }
+        if (result.error) {
+            // The cause is not always a failed spawn: ENOBUFS and EPERM reach this
+            // branch with the process already started (a maxBuffer overflow returns
+            // signal SIGTERM *and* error.code ENOBUFS). So the message stays neutral
+            // about starting and names the code instead of inferring a cause from it.
+            const code = result.error.code;
+            const why = code === 'ENOBUFS' ? 'output exceeded the buffer' : code;
+            const detail = why && !result.error.message.includes(why)
+                ? `${result.error.message} (${why})`
+                : result.error.message;
+            throw new Error(detail);
+        }
+        if (result.signal) {
+            throw new Error(`git status was killed by ${result.signal}`);
+        }
+        if (result.exitCode !== 0) {
+            throw new Error(result.stderr || `git exited ${result.exitCode}`);
+        }
+        gitStatus = result.stdout;
     }
     catch (err) {
         throw new Error(`git status failed: ${err.message}`);