@opengsd/gsd-core 1.18.0 → 1.20.0

package/gsd-core/bin/lib/surface.cjs

@@ -36,6 +36,7 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const runtime_name_policy_cjs_1 = require("./runtime-name-policy.cjs");
+const args_terminator_cjs_1 = require("./args-terminator.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const installProfiles = require("./install-profiles.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -322,6 +323,14 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
     if (node_path_1.default.resolve(runtimeConfigDir) !== node_path_1.default.resolve(layout.configDir)) {
         throw new TypeError('applySurface runtimeConfigDir must match layout.configDir');
     }
+    // #5637: re-staged commands and skills keep the typed-text terminator nonce the install wrote,
+    // when it wrote one; this process is not an installer, so nothing armed it.
+    // A directory with no nonce (an install from before this change) is re-staged canonical, and a
+    // nonce armed earlier in this process for another directory is not carried over.
+    if ((0, args_terminator_cjs_1.readInstalledNonce)(layout.configDir) !== null)
+        (0, args_terminator_cjs_1.armArgsNonce)(layout.configDir, true);
+    else
+        (0, args_terminator_cjs_1.disarmArgsNonce)();
     // #3712: the dest selection below prefers `kind.home` over layout.configDir and
     // then hands it to the destructive _syncGsdDir, so surface apply is a third
     // escape route into the developer's real home alongside install/uninstall.

package/gsd-core/bin/lib/task-command-router.cjs

@@ -20,10 +20,8 @@ const { output, error, ERROR_REASON } = ioMod;
 const planDocumentMod = require("./plan-document.cjs");
 const { parsePlanDocument } = planDocumentMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
-const capabilityLoaderMod = require("./capability-loader.cjs");
-// eslint-disable-next-line @typescript-eslint/no-require-imports
 const taskContentResolutionMod = require("./task-content-resolution.cjs");
-const { resolveTaskContent, ResolverAmbiguousError, ResolverFailedError, ResolverTimeoutError, ResolverMalformedOutputError, } = taskContentResolutionMod;
+const { resolveTaskContent, loadResolverCapabilities, isResolverFailure, } = taskContentResolutionMod;
 // ─── Implementation ───────────────────────────────────────────────────────────
 function isBehaviorAddingTaskContent(content) {
     const tddTrue = /\btdd\s*=\s*["']true["']/i.test(content);
@@ -60,19 +58,6 @@ function isBehaviorAddingTaskContent(content) {
         reason: isBehaviorAdding ? null : `Not behavior-adding: ${missing.join('; ')}`,
     };
 }
-/**
- * Default (production) capability loader for `resolve-content`: the merged
- * first-party + validated-installed-overlay registry (ADR-1244 D2), the
- * established runtime read path for "installed capabilities including
- * third-party" — as opposed to `capability-loader.cts`'s heavier build-time
- * validation entry points or the static `capability-registry.cjs` alone
- * (first-party only, would miss a third-party capability's
- * `taskContentResolver` declaration entirely).
- */
-function defaultLoadCapabilities(cwd) {
-    const registry = capabilityLoaderMod.loadRegistry({ includeInstalled: true, cwd });
-    return Object.values(registry.capabilities ?? {});
-}
 function parseResolveContentArgs(args) {
     let plan = null;
     let taskId = null;
@@ -93,12 +78,10 @@ function parseResolveContentArgs(args) {
  * (ADR-3646 Decision 2). Resolves one task's content from the external
  * tracker its `tracker-id` attribute names, via `task-content-resolution.cts`.
  *
- * HARD-HALT CONTRACT: a thrown `ResolverAmbiguousError` / `ResolverFailedError`
- * / `ResolverTimeoutError` / `ResolverMalformedOutputError` from
+ * HARD-HALT CONTRACT: a thrown resolver failure (`isResolverFailure`) from
  * `resolveTaskContent` is turned into this CLI's own non-zero exit via
  * `error()` — never swallowed into a `{resolved: false}` JSON answer. Any
- * other thrown error is not one of the four documented resolver-error
- * classes and is allowed to propagate uncaught.
+ * other thrown error is not a documented resolver-error class and is allowed to propagate uncaught.
  */
 function routeResolveContent({ args, cwd, raw }, deps = {}) {
     const usage = 'Usage: task resolve-content --plan <path> --task-id <tracker-id> --raw';
@@ -127,7 +110,7 @@ function routeResolveContent({ args, cwd, raw }, deps = {}) {
         error(`No task with tracker-id '${taskId}' found in plan: ${plan}`, ERROR_REASON.USAGE);
         return;
     }
-    const loadCapabilities = deps.loadCapabilities ?? defaultLoadCapabilities;
+    const loadCapabilities = deps.loadCapabilities ?? loadResolverCapabilities;
     const capabilities = loadCapabilities(projectRoot);
     const resolveFn = deps.resolveTaskContentFn ?? resolveTaskContent;
     let result;
@@ -135,10 +118,7 @@ function routeResolveContent({ args, cwd, raw }, deps = {}) {
         result = resolveFn({ trackerId: task.trackerId, capabilities });
     }
     catch (err) {
-        if (err instanceof ResolverAmbiguousError ||
-            err instanceof ResolverFailedError ||
-            err instanceof ResolverTimeoutError ||
-            err instanceof ResolverMalformedOutputError) {
+        if (isResolverFailure(err)) {
             error(err.message, ERROR_REASON.UNKNOWN);
             return;
         }

package/gsd-core/bin/lib/task-content-resolution.cjs

@@ -43,6 +43,8 @@ const node_child_process_1 = __importDefault(require("node:child_process"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
 const { formatDiagnosticToken } = ioMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const capabilityLoaderMod = require("./capability-loader.cjs");
 // ─── Result taxonomy ──────────────────────────────────────────────────────────
 /**
  * The four non-throwing outcomes of `resolveTaskContent`. Frozen because the
@@ -102,6 +104,17 @@ class ResolverFailedError extends Error {
         this.stderrTail = stderrTail;
     }
 }
+/**
+ * The tracker-id's id segment cannot safely be one argv element: a leading `-`
+ * reads as an option to the resolver binary, and control characters are never
+ * legitimate. Thrown before any spawn.
+ */
+class ResolverUnsafeIdError extends Error {
+    constructor() {
+        super('tracker-id rejected: id must not start with "-" or contain control characters');
+        this.name = 'ResolverUnsafeIdError';
+    }
+}
 /** The resolver subprocess exceeded its declared `invoke.timeoutMs` bound. */
 class ResolverTimeoutError extends Error {
     timeoutMs;
@@ -312,6 +325,9 @@ function resolveTaskContent(input) {
     const split = splitTrackerId(input.trackerId);
     if (split === null)
         return { kind: TASK_CONTENT_RESULT.NOT_APPLICABLE };
+    if (split.id.trimStart().startsWith('-') || /[\u0000-\u001f\u007f]/.test(input.trackerId ?? '')) {
+        throw new ResolverUnsafeIdError();
+    }
     const resolver = findResolver(split.prefix, input.capabilities ?? []);
     if (resolver === null)
         return { kind: TASK_CONTENT_RESULT.NO_RESOLVER };
@@ -327,7 +343,7 @@ function resolveTaskContent(input) {
         throw new ResolverAmbiguousError(split.prefix, ids);
     }
     const invocation = buildInvocation(resolver, split.id);
-    const timeoutMs = input.timeoutOverrideMs ?? invocation.timeoutMs;
+    const timeoutMs = Math.floor(Math.min(input.timeoutOverrideMs ?? invocation.timeoutMs, invocation.timeoutMs));
     const execFn = input.execFn ?? realExec;
     const result = execFn(invocation.binary, invocation.args, { timeout: timeoutMs });
     if (isExecTimeout(result)) {
@@ -354,12 +370,41 @@ function resolveTaskContent(input) {
     }
     return { kind: TASK_CONTENT_RESULT.RESOLVED, content };
 }
+/**
+ * Production capability loader for tracker-id resolution: the merged
+ * first-party + validated-installed-overlay registry (ADR-1244 D2), the
+ * established runtime read path for "installed capabilities including
+ * third-party" — as opposed to `capability-loader.cts`'s heavier build-time
+ * validation entry points or the static `capability-registry.cjs` alone
+ * (first-party only, would miss a third-party capability's
+ * `taskContentResolver` declaration entirely).
+ */
+function loadResolverCapabilities(cwd) {
+    const registry = capabilityLoaderMod.loadRegistry({ includeInstalled: true, cwd });
+    return Object.values(registry.capabilities ?? {});
+}
+/** True for every error `resolveTaskContent` throws as a hard halt (the one classifier all consumers share). */
+function isResolverFailure(err) {
+    return (err instanceof ResolverAmbiguousError ||
+        err instanceof ResolverFailedError ||
+        err instanceof ResolverTimeoutError ||
+        err instanceof ResolverMalformedOutputError ||
+        err instanceof ResolverUnsafeIdError);
+}
+/** Every text field of resolved content, so a consumer scanning for text cannot miss one when the shape grows. */
+function contentTexts(c) {
+    return [c.action, c.verify, ...c.acceptanceCriteria, ...c.readFirst, c.done].filter((v) => v !== null);
+}
 const taskContentResolution = {
     TASK_CONTENT_RESULT,
     splitTrackerId,
     findResolver,
     buildInvocation,
     resolveTaskContent,
+    loadResolverCapabilities,
+    isResolverFailure,
+    contentTexts,
+    ResolverUnsafeIdError,
     ResolverAmbiguousError,
     ResolverFailedError,
     ResolverTimeoutError,

package/gsd-core/bin/lib/template.cjs

@@ -23,7 +23,7 @@ const phaseIdMod = require("./phase-id.cjs");
 const { normalizePhaseName } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseLocatorMod = require("./phase-locator.cjs");
-const { findPhaseInternal } = phaseLocatorMod;
+const { phaseDirectoryOptions, findPhaseInternal } = phaseLocatorMod;
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
@@ -80,7 +80,7 @@ function cmdTemplateFill(cwd, templateType, options, raw) {
     if (!options.phase) {
         error('--phase required');
     }
-    const phaseInfo = findPhaseInternal(cwd, options.phase);
+    const phaseInfo = findPhaseInternal(cwd, options.phase, undefined, phaseDirectoryOptions(cwd));
     if (!phaseInfo || !phaseInfo.found) {
         output({ error: 'Phase not found', phase: options.phase }, raw, undefined);
         return;

package/gsd-core/bin/lib/validate.cjs

@@ -43,6 +43,7 @@ exports.checkBracketCoherence = checkBracketCoherence;
 exports.textEncodingError = textEncodingError;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
+const phase_entry_grammar_cjs_1 = require("./phase-entry-grammar.cjs");
 const { OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, 
 // #2528 review: taken from the owner rather than derived here by
 // `replaceAll('A-Z', 'A-Za-z')` — that derivation silently no-ops (and narrows
@@ -228,7 +229,7 @@ function buildRoadmapPhaseVariants(roadmapContent, convention) {
     // shape (bold bullet index + detail headings) where the icebox appears as both.
     // `validate health` stayed silent on the same repo, so the two verbs disagreed
     // — the disagreement `sentinelPhases` exists to close.
-    const checklistPattern = new RegExp(`-\\s*\\[[ xX]\\]\\s*\\*{0,2}${phaseHeadingPrefixSrcFor(PHASE_HEADING_BASELINE.LABEL_ONLY, convention, capturing)}([\\w][\\w.-]*)\\s*:`, 'gi');
+    const checklistPattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`${phaseHeadingPrefixSrcFor(PHASE_HEADING_BASELINE.LABEL_ONLY, convention, capturing)}([\\w][\\w.-]*)\\s*:`, 'gi');
     let cm;
     while ((cm = checklistPattern.exec(roadmapContent)) !== null) {
         const cBracketId = g ? cm[1] : undefined;
@@ -252,7 +253,7 @@ function buildNotStartedPhaseVariants(roadmapContent, convention) {
     // Trailing class is `[:\s*]` — a SPACE terminates the token here, not only a
     // colon — so this site is the loosest of the three and the one where a
     // retro-granted bracket tolerance would suppress a live W006.
-    const uncheckedPattern = new RegExp(`-\\s*\\[\\s\\]\\s*\\*{0,2}${phaseHeadingPrefixSrcFor(PHASE_HEADING_BASELINE.LABEL_ONLY, convention)}([\\w][\\w.-]*)[:\\s*]`, 'gi');
+    const uncheckedPattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`${phaseHeadingPrefixSrcFor(PHASE_HEADING_BASELINE.LABEL_ONLY, convention)}([\\w][\\w.-]*)[:\\s*]`, 'gi', { state: 'unchecked' });
     let um;
     while ((um = uncheckedPattern.exec(roadmapContent)) !== null) {
         for (const variant of phaseVariants(um[1]))