@opengsd/gsd-core 1.17.0 → 1.19.0

package/gsd-core/bin/lib/capability-source.cjs

@@ -32,6 +32,8 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_https_1 = __importDefault(require("node:https"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
+const { resolveGsdHome } = require('./runtime-homes.cjs');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
 const shellSeam = require('./shell-command-projection.cjs');
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capValidator = require('./capability-validator.cjs');
@@ -984,7 +986,7 @@ async function resolveTarball(parsed, opts, gsdHome, hostVersion) {
 async function resolveCapabilitySource(spec, opts = {}) {
     const parsed = parseSpec(spec);
     const hostVersion = opts.hostVersion ?? readHostVersion();
-    const gsdHome = opts.gsdHome ?? process.env['GSD_HOME'] ?? node_os_1.default.homedir();
+    const gsdHome = opts.gsdHome || resolveGsdHome();
     switch (parsed.kind) {
         case 'local':
             return resolveLocal(parsed, opts, gsdHome, hostVersion);

package/gsd-core/bin/lib/capability-state.cjs

@@ -47,6 +47,8 @@ const { loadConfig } = configLoaderMod;
 const installProfilesMod = require("./install-profiles.cjs");
 const { readActiveProfile, loadSkillsManifest, resolveProfile, parseRequires, parseCallsAgents, workflowAgentRefs } = installProfilesMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
+const ledgerMod = require("./capability-ledger.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
 const surfaceMod = require("./surface.cjs");
 const { resolveSurface } = surfaceMod;
 // ─── Prototype-pollution guard (inline literal, CodeQL barrier) ───────────────
@@ -231,14 +233,17 @@ function _resolveCommandsGsdDir() {
  * Only directories whose names start with gsd- are included so user-created
  * skills (without the gsd- prefix) are not accidentally pulled in.
  *
- * The requires: field is parsed via the shared parseRequires helper (the same
- * parser loadSkillsManifest uses), so the two paths cannot drift.
+ * Dependencies use the same parseRequires, parseCallsAgents, and
+ * workflowAgentRefs helpers as loadSkillsManifest. Workflow references resolve
+ * against this runtime's own gsd-core/workflows tree, including its fragments,
+ * so a custom config directory never borrows another installation's agents.
  *
  * Returns an empty Map when the skills dir does not exist.
  */
 function _loadInstalledSkillsManifest(configDir) {
     const manifest = new Map();
     const skillsDir = node_path_1.default.join(configDir, 'skills');
+    const workflowsDir = node_path_1.default.join(configDir, 'gsd-core', 'workflows');
     if (!node_fs_1.default.existsSync(skillsDir))
         return manifest;
     let entries;
@@ -265,26 +270,30 @@ function _loadInstalledSkillsManifest(configDir) {
         // SKILL.md must NOT register the stem — otherwise the capability would be
         // wrongly reported surfaced/enabled and a verify:post hook would render
         // for a skill that cannot run.
-        if (!node_fs_1.default.existsSync(skillMdPath))
-            continue;
+        // #5121: bounded read — a missing, non-regular (FIFO/device) or oversized SKILL.md registers no stem.
         let content = '';
         try {
-            content = node_fs_1.default.readFileSync(skillMdPath, 'utf8');
+            content = ledgerMod.readSkillFile(skillMdPath);
         }
         catch {
             // SKILL.md present but unreadable — register with no deps (parity with
             // loadSkillsManifest's readFileSync catch branch).
         }
+        if (content === null)
+            continue;
         // Parse requires: via the SAME shared parser loadSkillsManifest uses, so
         // installed-runtime dependency resolution can never silently diverge from
         // the source-tree path (single source of truth — no duplicated regex).
         manifest.set(stem, content ? parseRequires(content) : []);
-        // Mirror loadSkillsManifest's Map shape: it always sets a companion
-        // `_calls_agents_<stem>` key. Installed SKILL.md bodies carry no
-        // recoverable agent-call refs, so [] (the no-agents case) keeps the two
-        // manifest shapes identical and prevents undefined-vs-[] drift for any
-        // consumer that reads the agent-refs companion key.
-        manifest.set(`_calls_agents_${stem}`, []);
+        // Installed skills delegate to workflows just as source commands do.
+        // Preserve their agent closure so surface materialization only prunes
+        // agents no retained skill requires (#5356).
+        manifest.set(`_calls_agents_${stem}`, [
+            ...new Set([
+                ...parseCallsAgents(content),
+                ...workflowAgentRefs(content, workflowsDir),
+            ]),
+        ]);
     }
     return manifest;
 }

package/gsd-core/bin/lib/capability-validator.cjs

@@ -856,6 +856,7 @@ const VALID_CONVERTER_NAMES = new Set([
   'convertClaudeCommandToKimiSkill',
   'convertClaudeCommandToKimiCodeSkill',
   'convertClaudeCommandToOpencodeSkill',
+  'convertClaudeCommandToPiSkill',
   'convertClaudeCommandToTraeSkill',
   'convertClaudeCommandToWindsurfSkill',
   'convertClaudeCommandToWindsurfWorkflow',
@@ -879,6 +880,8 @@ const VALID_CONVERTER_NAMES = new Set([
   // and the kilo/opencode agent converters (shared with those runtimes'
   // commands-kind entries, options-bag signature `(content, {isAgent, modelOverride})`).
   'convertClaudeAgentToHermesAgent',
+  // #5569 (ADR-5559 §3) — the role file Pi's gsd_dispatch loads.
+  'convertClaudeAgentToPiAgent',
   'convertClaudeToKiloFrontmatter',
   'convertClaudeToOpencodeFrontmatter',
 ]);
@@ -1236,6 +1239,20 @@ function validateArtifactKindEntry(capId, entry, prefix) {
     }
   }
 
+  // excludeSuffixes — optional; filename suffixes the agents staging skips (#5569: Pi omits .compact.md)
+  if (entry.excludeSuffixes !== undefined) {
+    if (!Array.isArray(entry.excludeSuffixes)) {
+      errors.push(ctx + '.excludeSuffixes must be an array of non-empty strings if present');
+    } else {
+      for (let i = 0; i < entry.excludeSuffixes.length; i++) {
+        const s = entry.excludeSuffixes[i];
+        if (typeof s !== 'string' || s.length === 0 || s.includes('/') || s.includes('\\')) {
+          errors.push(ctx + '.excludeSuffixes[' + i + '] must be a non-empty string without path separators');
+        }
+      }
+    }
+  }
+
   // converter — required; must be a string or null (closed ConverterName enum — now enforced in phase 5e)
   if (!Object.prototype.hasOwnProperty.call(entry, 'converter')) {
     errors.push(ctx + '.converter is required (must be a string or null)');
@@ -1899,6 +1916,10 @@ const REVIEWER_EFFORT_LEVELS = new Set(['minimal', 'low', 'medium', 'high', 'xhi
  * silently rot away from reality (DEFECT.GENERATIVE-FIX).
  */
 const KNOWN_HOST_BEHAVIORS = new Set([
+  // #2586: declares runtime-level feature axes GSD does not/cannot support on
+  // omitting the key on every other runtime carries no inverted meaning.
+  // this host (e.g. Codex's `["context-warnings","phase-lifecycle-display"]`)
+  // — present-and-populated / absent-is-unsupported-empty convention, so
   'agentFileExtension',
   'agentFrontmatterExtensions',
   'agentManifestStyle',
@@ -1916,6 +1937,7 @@ const KNOWN_HOST_BEHAVIORS = new Set([
   'combinedFamilyInstall',
   'commandBodyConverter',
   'contentRewriteProfile',
+  'defaultHomeIncludeRoot',
   'doneBannerStyle',
   'flatCommandDir',
   'frontmatterDialect',
@@ -1953,6 +1975,7 @@ const KNOWN_HOST_BEHAVIORS = new Set([
   'requiresSubagentPair',
   'restoreAtRefTildeInAgents',
   'restoreAtRefTildeInSpecTree',
+  'retargetsGsdCoreProsePath',
   'retiredArtifacts',
   'rewriteClaudeAtIncludes',
   'settingsFileByScope',
@@ -1972,10 +1995,6 @@ const KNOWN_HOST_BEHAVIORS = new Set([
   'specRootSkillPass',
   'tomlConfigInstall',
   'trackCategoryDescription',
-  // #2586: declares runtime-level feature axes GSD does not/cannot support on
-  // this host (e.g. Codex's `["context-warnings","phase-lifecycle-display"]`)
-  // — present-and-populated / absent-is-unsupported-empty convention, so
-  // omitting the key on every other runtime carries no inverted meaning.
   'unsupportedFeatures',
   'verificationStyle',
   'writeCategoryDescription',

package/gsd-core/bin/lib/commands.cjs

@@ -2986,6 +2986,8 @@ async function cmdWebsearch(query, options, raw) {
                         'Accept': 'application/json',
                         'X-Subscription-Token': apiKey
                     },
+                    // never follow redirects: X-Subscription-Token must not leave api.search.brave.com (#5409)
+                    redirect: 'manual',
                     signal: ac.signal
                 });
             }
@@ -3011,7 +3013,9 @@ async function cmdWebsearch(query, options, raw) {
             const status = response.status;
             const isRetryable = status === 429 || status >= 500;
             if (!isRetryable) {
-                // Non-retryable 4xx — fail immediately, no attempts field
+                // Non-retryable 4xx and every 3xx (redirect: 'manual' hands them back as-is, #5409) —
+                // fail immediately, no attempts field. Keep 3xx out of isRetryable.
+                response.body?.cancel().catch(() => { });
                 output({ available: false, error: `API error: ${status}` }, raw, '');
                 return;
             }

package/gsd-core/bin/lib/config-loader.cjs

@@ -25,11 +25,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 const node_fs_1 = __importDefault(require("node:fs"));
-const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // #4717: runtime-identity fill — env rung + per-install marker rung.
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
+const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 const runtime_name_policy_cjs_1 = require("./runtime-name-policy.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
@@ -156,6 +156,15 @@ const CONFIG_DEFAULTS = {
     planner_stall_detection_enabled: _getNestedConfigDefault('planner', 'stall_detection_enabled'),
     max_prompt_tokens: _getNestedConfigDefault('review', 'max_prompt_tokens'),
 };
+/**
+ * Resolve `git.repo_tagging` (#5706) from hand-edited configuration. Only the
+ * two documented enum members are honored; any other stored value (a number,
+ * null, an unknown string, a wrong-case spelling) reads as the default `single`
+ * and never throws, so a bad hand edit cannot enable per-repository tagging.
+ */
+function resolveRepoTagging(value) {
+    return value === 'per_repo' ? 'per_repo' : 'single';
+}
 /**
  * Resolve the planner watchdog policy from hand-edited configuration.
  * Only a real JSON boolean may override the default; strings/numbers/null
@@ -849,6 +858,7 @@ function loadConfigResolvedInternal(cwd, options = {}) {
             base_branch: get('base_branch', { section: 'git', field: 'base_branch' }),
             protected_branches: getNested('git', 'protected_branches'),
             allow_default_branch_commits: getNested('git', 'allow_default_branch_commits'),
+            repo_tagging: resolveRepoTagging(getNested('git', 'repo_tagging')),
             phase_branch_template: get('phase_branch_template', { section: 'git', field: 'phase_branch_template' }) ?? defaults.phase_branch_template,
             milestone_branch_template: get('milestone_branch_template', { section: 'git', field: 'milestone_branch_template' }) ?? defaults.milestone_branch_template,
             quick_branch_template: get('quick_branch_template', { section: 'git', field: 'quick_branch_template' }) ?? defaults.quick_branch_template,
@@ -935,7 +945,7 @@ function loadConfigResolvedInternal(cwd, options = {}) {
         // untouched. Faults in the global file stay silent in this branch (the
         // project config governs; the nearer file is the actionable one).
         try {
-            const shadowHome = process.env['GSD_HOME'] || node_os_1.default.homedir();
+            const shadowHome = (0, runtime_homes_cjs_1.resolveGsdHome)();
             const shadowPath = node_path_1.default.join(shadowHome, '.gsd', 'defaults.json');
             const shadowRead = _readConfigFile(shadowPath);
             if (shadowRead.kind === 'ok') {
@@ -997,7 +1007,7 @@ function loadConfigResolvedInternal(cwd, options = {}) {
         }
         // Branch D or E: no .planning/
         try {
-            const home = process.env['GSD_HOME'] || node_os_1.default.homedir();
+            const home = (0, runtime_homes_cjs_1.resolveGsdHome)();
             const globalDefaultsPath = node_path_1.default.join(home, '.gsd', 'defaults.json');
             const globalRead = _readConfigFile(globalDefaultsPath);
             if (globalRead.kind === 'fault') {