@opengsd/gsd-core 1.2.0 → 1.3.0

package/hooks/dist/gsd-check-update-worker.js

@@ -11,17 +11,29 @@
 
 const fs = require('fs');
 const path = require('path');
-const { isSemverNewer } = require('../get-shit-done/bin/lib/semver-compare.cjs');
+const { isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs');
 // Latest-version lookup is delegated to the single deterministic adapter
 // (#498). checkLatestVersion() owns the npm-view call, the timeout/semver
 // policy, and the package name — sourced from the baked Package Identity seam.
 // The previous `require('../package.json').name` (#378) resolved to undefined
 // in the installed tree (only a {"type":"commonjs"} marker ships), so the
 // background check never reported updates.
-const { checkLatestVersion } = require('../get-shit-done/bin/check-latest-version.cjs');
+const { checkLatestVersion } = require('../gsd-core/bin/check-latest-version.cjs');
+const { PACKAGE_NAME } = require('../gsd-core/bin/lib/package-identity.cjs');
 // Authoritative list of managed hooks — shared with tests to retire source-grep
 // assertions (pending-migration-to-typed-ir [#455]).
-const { MANAGED_HOOKS } = require('./managed-hooks-registry.cjs');
+// NOTE: managed-hooks-registry.cjs must be in HOOKS_TO_COPY (scripts/build-hooks.js)
+// so it is present in hooks/dist/ and ships to the installed runtime hooks/ dir.
+// If it is missing (e.g., installed from an older dist), catch and degrade gracefully
+// so the worker always proceeds to compute and write the result cache record.
+let MANAGED_HOOKS = [];
+try {
+  ({ MANAGED_HOOKS } = require('./managed-hooks-registry.cjs'));
+} catch (e) {
+  // Module not found in installed runtime — stale-hook detection degrades to
+  // no-op (empty list means no hooks are checked for staleness). The worker
+  // still runs and writes package_name / installed / latest / update_available.
+}
 
 const cacheFile = process.env.GSD_CACHE_FILE;
 const projectVersionFile = process.env.GSD_PROJECT_VERSION_FILE;
@@ -88,6 +100,7 @@ const result = {
   latest: latest || 'unknown',
   checked: Math.floor(Date.now() / 1000),
   stale_hooks: staleHooks.length > 0 ? staleHooks : undefined,
+  package_name: PACKAGE_NAME,
 };
 
 if (cacheFile) {

package/hooks/dist/gsd-check-update.js

@@ -8,6 +8,8 @@ const path = require('path');
 const os = require('os');
 const { spawn } = require('child_process');
 
+const { updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
+
 const homeDir = os.homedir();
 const cwd = process.cwd();
 
@@ -16,11 +18,11 @@ const cwd = process.cwd();
 function detectConfigDir(baseDir) {
   // Check env override first (supports multi-account setups)
   const envDir = process.env.CLAUDE_CONFIG_DIR;
-  if (envDir && fs.existsSync(path.join(envDir, 'get-shit-done', 'VERSION'))) {
+  if (envDir && fs.existsSync(path.join(envDir, 'gsd-core', 'VERSION'))) {
     return envDir;
   }
   for (const dir of ['.claude', '.gemini', '.config/kilo', '.kilo', '.config/opencode', '.opencode']) {
-    if (fs.existsSync(path.join(baseDir, dir, 'get-shit-done', 'VERSION'))) {
+    if (fs.existsSync(path.join(baseDir, dir, 'gsd-core', 'VERSION'))) {
       return path.join(baseDir, dir);
     }
   }
@@ -33,11 +35,11 @@ const projectConfigDir = detectConfigDir(cwd);
 // resolution mismatches where check-update writes to one runtime's cache
 // but statusline reads from another (#1421).
 const cacheDir = path.join(homeDir, '.cache', 'gsd');
-const cacheFile = path.join(cacheDir, 'gsd-update-check.json');
+const cacheFile = path.join(cacheDir, updateCacheFileName);
 
 // VERSION file locations (check project first, then global)
-const projectVersionFile = path.join(projectConfigDir, 'get-shit-done', 'VERSION');
-const globalVersionFile = path.join(globalConfigDir, 'get-shit-done', 'VERSION');
+const projectVersionFile = path.join(projectConfigDir, 'gsd-core', 'VERSION');
+const globalVersionFile = path.join(globalConfigDir, 'gsd-core', 'VERSION');
 
 // Ensure cache directory exists
 if (!fs.existsSync(cacheDir)) {

package/hooks/dist/gsd-context-monitor.js

@@ -140,10 +140,10 @@ process.stdin.on('end', () => {
     if (isCritical && isGsdActive && !warnData.criticalRecorded) {
       try {
         // Runtime-agnostic path: this hook lives at <runtime-config>/hooks/
-        // and gsd-tools.cjs lives at <runtime-config>/get-shit-done/bin/.
+        // and gsd-tools.cjs lives at <runtime-config>/gsd-core/bin/.
         // Using __dirname makes this work on Claude Code, OpenCode, Gemini,
         // Kilo, etc. without hardcoding ~/.claude/.
-        const gsdTools = path.join(__dirname, '..', 'get-shit-done', 'bin', 'gsd-tools.cjs');
+        const gsdTools = path.join(__dirname, '..', 'gsd-core', 'bin', 'gsd-tools.cjs');
         // Coerce usedPct to a safe number in case bridge file is malformed
         const safeUsedPct = Number(usedPct) || 0;
         const stoppedAt = `context exhaustion at ${safeUsedPct}% (${new Date().toISOString().split('T')[0]})`;

package/hooks/dist/gsd-statusline.js

@@ -6,7 +6,8 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { isSemverNewer } = require('../get-shit-done/bin/lib/semver-compare.cjs');
+const { isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs');
+const { PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
 
 // --- Config + last-command readers ------------------------------------------
 
@@ -395,32 +396,22 @@ function runStatusline() {
     const gsdStateStr = task ? '' : formatGsdState(readGsdState(dir) || {});
 
     // GSD update available?
-    // Check shared cache first (#1421), fall back to runtime-specific cache for
-    // backward compatibility with older gsd-check-update.js versions.
+    // Read only the per-package shared cache file (#607). The legacy
+    // runtime-specific fallback has been removed — the per-package filename
+    // carries lineage and avoids multi-runtime resolution mismatches (#1421).
     let gsdUpdate = '';
-    const sharedCacheFile = path.join(homeDir, '.cache', 'gsd', 'gsd-update-check.json');
-    const legacyCacheFile = path.join(claudeDir, 'cache', 'gsd-update-check.json');
-    const cacheFile = fs.existsSync(sharedCacheFile) ? sharedCacheFile : legacyCacheFile;
+    const cacheFile = path.join(homeDir, '.cache', 'gsd', updateCacheFileName);
     if (fs.existsSync(cacheFile)) {
       try {
         const cache = JSON.parse(fs.readFileSync(cacheFile, 'utf8'));
-        if (cache.update_available) {
+        const { showUpdate, staleWarning } = evaluateUpdateCache(cache);
+        if (showUpdate) {
           gsdUpdate = '\x1b[33m⬆ /gsd:update\x1b[0m │ ';
         }
-        if (cache.stale_hooks && cache.stale_hooks.length > 0) {
-          // If installed version is ahead of npm latest, this is a dev install.
-          // Running /gsd:update would downgrade — show a contextual warning instead.
-          const isDevInstall = (
-            cache.installed &&
-            cache.latest &&
-            cache.latest !== 'unknown' &&
-            isInstalledAheadOfLatest(cache.installed, cache.latest)
-          );
-          if (isDevInstall) {
-            gsdUpdate += '\x1b[33m⚠ dev install — re-run installer to sync hooks\x1b[0m │ ';
-          } else {
-            gsdUpdate += '\x1b[31m⚠ stale hooks — run /gsd:update\x1b[0m │ ';
-          }
+        if (staleWarning === 'dev') {
+          gsdUpdate += '\x1b[33m⚠ dev install — re-run installer to sync hooks\x1b[0m │ ';
+        } else if (staleWarning === 'stale') {
+          gsdUpdate += '\x1b[31m⚠ stale hooks — run /gsd:update\x1b[0m │ ';
         }
       } catch (e) {}
     }
@@ -507,12 +498,39 @@ function isInstalledAheadOfLatest(installed, latest) {
   return isSemverNewer(installed, latest);
 }
 
+/**
+ * Pure function: evaluate an update-check cache object and return display flags.
+ * Applies lineage guard — if package_name is absent or foreign, treats cache as absent.
+ *
+ * @param {object|null} cache  Parsed cache object, or null.
+ * @returns {{ showUpdate: boolean, staleWarning: 'none'|'dev'|'stale' }}
+ */
+function evaluateUpdateCache(cache) {
+  const none = { showUpdate: false, staleWarning: 'none' };
+  if (!cache) return none;
+  // Lineage guard: package_name must be present and match this package.
+  if (!cache.package_name || cache.package_name !== PACKAGE_NAME) return none;
+  const showUpdate = Boolean(cache.update_available);
+  let staleWarning = 'none';
+  if (cache.stale_hooks && cache.stale_hooks.length > 0) {
+    const isDevInstall = (
+      cache.installed &&
+      cache.latest &&
+      cache.latest !== 'unknown' &&
+      isInstalledAheadOfLatest(cache.installed, cache.latest)
+    );
+    staleWarning = isDevInstall ? 'dev' : 'stale';
+  }
+  return { showUpdate, staleWarning };
+}
+
 // Export helpers for unit tests. Harmless when run as a script.
 module.exports = {
   readGsdState, parseStateMd, formatGsdState,
   readGsdConfig, getConfigValue, readLastSlashCommand,
   composeStatusline,
   isInstalledAheadOfLatest,
+  evaluateUpdateCache,
 };
 
 /**

package/hooks/dist/gsd-update-banner.js

@@ -2,7 +2,7 @@
 // gsd-hook-version: {{GSD_VERSION}}
 // SessionStart banner that surfaces GSD update availability when GSD's
 // statusline isn't installed. Reads the cache that
-// gsd-check-update-worker.js writes to ~/.cache/gsd/gsd-update-check.json.
+// gsd-check-update-worker.js writes to ~/.cache/gsd/<updateCacheFileName> (per-package).
 //
 // Opt-in by design: bin/install.js only registers this hook when the user
 // declines to install (or replace) the GSD statusline. The presence of the
@@ -15,6 +15,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
 
 // Suppress repeat parse-error banners for 24 hours so a genuinely broken
 // cache file doesn't nag the user every session.
@@ -37,6 +38,9 @@ function buildBannerOutput(state) {
     return { systemMessage: 'GSD update check failed.' };
   }
   if (!cache) return null;
+  // Lineage guard: package_name must be present and match this package.
+  // Absent package_name means the cache predates lineage tracking — treat as untrusted.
+  if (!cache.package_name || cache.package_name !== PACKAGE_NAME) return null;
   if (!cache.update_available) return null;
   const installed = cache.installed || 'unknown';
   const latest = cache.latest || 'unknown';
@@ -96,7 +100,7 @@ function recordFailureWarning(sentinelFile, nowSeconds) {
 
 function main() {
   const cacheDir = path.join(os.homedir(), '.cache', 'gsd');
-  const cacheFile = path.join(cacheDir, 'gsd-update-check.json');
+  const cacheFile = path.join(cacheDir, updateCacheFileName);
   const sentinelFile = path.join(cacheDir, 'banner-failure-warned-at');
   const now = Math.floor(Date.now() / 1000);
 

package/hooks/dist/gsd-worktree-path-guard.js

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+// gsd-hook-version: {{GSD_VERSION}}
+// GSD Worktree Path Guard — PreToolUse hook
+// Blocks Edit/Write/MultiEdit tool calls that target absolute paths outside the worktree root.
+//
+// Problem: gsd-executor agents spawned with isolation="worktree" sometimes issue
+// Edit/Write calls with absolute paths rooted at the MAIN repository instead of
+// the worktree (issue #260). The prose guard in agents/gsd-executor.md step 0b
+// is never enforced because the model under load skips it.
+//
+// This hook enforces the constraint at the tooling layer, making it HARD-BLOCKING.
+//
+// Triggers on: Edit, Write, and MultiEdit tool calls
+// Action: BLOCK (exit 2) if file_path is absolute and outside the worktree root
+// No-op: relative paths, non-worktree CWDs, hook errors (silent fail)
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const SPAWNOPT = { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 2000 };
+
+function git(args, cwd) {
+  return spawnSync('git', args, { ...SPAWNOPT, cwd });
+}
+
+// Walk up from `start` to find the nearest existing directory.
+// Returns null if we reach the filesystem root without finding one.
+function nearestExistingDir(start) {
+  let dir = start;
+  let prev;
+  do {
+    prev = dir;
+    try { fs.accessSync(dir, fs.constants.F_OK); return dir; } catch { /* keep walking */ }
+    dir = path.dirname(dir);
+  } while (dir !== prev);
+  return null;
+}
+
+let input = '';
+const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => input += chunk);
+process.stdin.on('end', () => {
+  clearTimeout(stdinTimeout);
+  try {
+    const data = JSON.parse(input);
+    const toolName = data.tool_name;
+
+    // Only guard Edit, Write, and MultiEdit tool calls
+    if (toolName !== 'Edit' && toolName !== 'Write' && toolName !== 'MultiEdit') {
+      process.exit(0);
+    }
+
+    const cwd = data.cwd || process.cwd();
+
+    // Detect whether CWD is inside a linked git worktree by inspecting
+    // the git-dir path. In a linked worktree, git rev-parse --git-dir
+    // returns a path containing .git/worktrees/ as a component.
+    // In the main repo or a submodule it returns .git (or a path without /worktrees/).
+    // This approach works even when cwd is a subdirectory of the worktree.
+    const gitDirResult = git(['rev-parse', '--git-dir'], cwd);
+    if (gitDirResult.status !== 0 || !gitDirResult.stdout) {
+      process.exit(0); // not a git repo — pass through
+    }
+
+    const gitDir = gitDirResult.stdout.trim();
+    // A linked worktree's --git-dir contains .git/worktrees/ as a path component
+    const isLinkedWorktree = /[/\\]\.git[/\\]worktrees[/\\]/.test(gitDir);
+    if (!isLinkedWorktree) {
+      process.exit(0); // main repo, submodule, or separate-git-dir — no-op
+    }
+
+    // Get the raw --show-toplevel output for the worktree (cwd).
+    // We keep it raw (not path.resolve'd) to compare directly with the
+    // file's toplevel — same git binary, same format, no normalization needed.
+    const wtTopResult = git(['rev-parse', '--show-toplevel'], cwd);
+    if (wtTopResult.status !== 0 || !wtTopResult.stdout) {
+      process.exit(0); // can't determine root — fail open
+    }
+    const wtTopRaw = wtTopResult.stdout.trim();
+
+    const rawFilePath = data.tool_input?.file_path || '';
+    if (!rawFilePath) {
+      process.exit(0);
+    }
+
+    // Relative paths are always safe — they resolve relative to CWD inside the worktree
+    if (!path.isAbsolute(rawFilePath)) {
+      process.exit(0);
+    }
+
+    // Normalise .. traversal so /worktree/src/../../../main/file
+    // resolves to its true location before we check containment.
+    const filePath = path.resolve(rawFilePath);
+
+    // Find the nearest existing ancestor of filePath so we can ask git
+    // for its toplevel. The file itself may not exist yet (Write creates
+    // new files), but at least one ancestor directory must exist.
+    // We check the file itself first in case it already exists.
+    const checkDir = nearestExistingDir(
+      (() => {
+        try {
+          return fs.statSync(filePath).isDirectory() ? filePath : path.dirname(filePath);
+        } catch {
+          return path.dirname(filePath);
+        }
+      })()
+    );
+
+    if (!checkDir) {
+      // Walked to root without finding any directory — path is synthetic.
+      // Block conservatively.
+      const output = {
+        decision: 'block',
+        reason:
+          `Worktree path guard: '${filePath}' has no existing ancestor directory — ` +
+          `cannot verify it is inside the worktree '${wtTopRaw}'. Use a relative path instead.`,
+      };
+      process.stdout.write(JSON.stringify(output));
+      process.exit(2);
+    }
+
+    // Ask git for the toplevel of the file's location.
+    // Comparing two raw git --show-toplevel outputs avoids every
+    // platform-specific path normalisation pitfall (Windows 8.3 short names,
+    // case differences between realpathSync and path.resolve, forward- vs
+    // back-slash inconsistencies) — both values come from the same git binary
+    // in the same format by definition.
+    const fileTopResult = git(['rev-parse', '--show-toplevel'], checkDir);
+
+    if (fileTopResult.status !== 0 || !fileTopResult.stdout) {
+      // checkDir is not inside any git repo → cannot be inside the worktree.
+      const output = {
+        decision: 'block',
+        reason:
+          `Worktree path guard: '${filePath}' is not inside any git repository — ` +
+          `it cannot be inside the worktree at '${wtTopRaw}'. Use a relative path instead.`,
+      };
+      process.stdout.write(JSON.stringify(output));
+      process.exit(2);
+    }
+
+    const fileTopRaw = fileTopResult.stdout.trim();
+
+    // Same git toplevel → file is inside the worktree → allow
+    if (fileTopRaw === wtTopRaw) {
+      process.exit(0);
+    }
+
+    // BLOCK: file resolves to a different git root than the active worktree
+    const output = {
+      decision: 'block',
+      reason:
+        `Worktree path guard: '${filePath}' resolves to git root '${fileTopRaw}' which ` +
+        `differs from the active worktree root '${wtTopRaw}'. This likely means an ` +
+        `absolute path was derived from the orchestrator's main repository instead of ` +
+        `the active worktree. To fix: use a relative path, or re-derive the base ` +
+        `directory with \`git rev-parse --show-toplevel\` from within the worktree ` +
+        `(hook cwd: '${cwd}').`,
+    };
+
+    process.stdout.write(JSON.stringify(output));
+    process.exit(2);
+  } catch {
+    // Silent fail — never block valid tool calls due to hook errors
+    process.exit(0);
+  }
+});

package/hooks/dist/managed-hooks-registry.cjs

@@ -0,0 +1,35 @@
+'use strict';
+
+/**
+ * Authoritative list of GSD-managed hook files.
+ *
+ * Extracted from the worker script into a shared CJS module so that:
+ *  1. gsd-check-update-worker.js can require() it directly (no source-level
+ *     duplication).
+ *  2. Tests can assert against the exported array instead of regex-parsing
+ *     the worker source (retiring the pending-migration-to-typed-ir token
+ *     on managed-hooks.test.cjs and orphaned-hooks.test.cjs, per #455).
+ *
+ * These are the files GSD ships into ~/.claude/hooks/ (or equivalent) and
+ * checks for staleness after an update. Orphaned files from removed features
+ * (e.g., gsd-intel-*.js) must NOT be listed here — that would cause permanent
+ * stale warnings for users who haven't cleaned up manually (#1750).
+ */
+const MANAGED_HOOKS = [
+  'gsd-check-update-worker.js',
+  'gsd-check-update.js',
+  'gsd-context-monitor.js',
+  'gsd-graphify-update.sh',
+  'gsd-phase-boundary.sh',
+  'gsd-prompt-guard.js',
+  'gsd-read-guard.js',
+  'gsd-read-injection-scanner.js',
+  'gsd-session-state.sh',
+  'gsd-statusline.js',
+  'gsd-update-banner.js',
+  'gsd-validate-commit.sh',
+  'gsd-workflow-guard.js',
+  'gsd-worktree-path-guard.js',
+];
+
+module.exports = { MANAGED_HOOKS };

package/hooks/gsd-check-update-worker.js

@@ -11,17 +11,29 @@
 
 const fs = require('fs');
 const path = require('path');
-const { isSemverNewer } = require('../get-shit-done/bin/lib/semver-compare.cjs');
+const { isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs');
 // Latest-version lookup is delegated to the single deterministic adapter
 // (#498). checkLatestVersion() owns the npm-view call, the timeout/semver
 // policy, and the package name — sourced from the baked Package Identity seam.
 // The previous `require('../package.json').name` (#378) resolved to undefined
 // in the installed tree (only a {"type":"commonjs"} marker ships), so the
 // background check never reported updates.
-const { checkLatestVersion } = require('../get-shit-done/bin/check-latest-version.cjs');
+const { checkLatestVersion } = require('../gsd-core/bin/check-latest-version.cjs');
+const { PACKAGE_NAME } = require('../gsd-core/bin/lib/package-identity.cjs');
 // Authoritative list of managed hooks — shared with tests to retire source-grep
 // assertions (pending-migration-to-typed-ir [#455]).
-const { MANAGED_HOOKS } = require('./managed-hooks-registry.cjs');
+// NOTE: managed-hooks-registry.cjs must be in HOOKS_TO_COPY (scripts/build-hooks.js)
+// so it is present in hooks/dist/ and ships to the installed runtime hooks/ dir.
+// If it is missing (e.g., installed from an older dist), catch and degrade gracefully
+// so the worker always proceeds to compute and write the result cache record.
+let MANAGED_HOOKS = [];
+try {
+  ({ MANAGED_HOOKS } = require('./managed-hooks-registry.cjs'));
+} catch (e) {
+  // Module not found in installed runtime — stale-hook detection degrades to
+  // no-op (empty list means no hooks are checked for staleness). The worker
+  // still runs and writes package_name / installed / latest / update_available.
+}
 
 const cacheFile = process.env.GSD_CACHE_FILE;
 const projectVersionFile = process.env.GSD_PROJECT_VERSION_FILE;
@@ -88,6 +100,7 @@ const result = {
   latest: latest || 'unknown',
   checked: Math.floor(Date.now() / 1000),
   stale_hooks: staleHooks.length > 0 ? staleHooks : undefined,
+  package_name: PACKAGE_NAME,
 };
 
 if (cacheFile) {

package/hooks/gsd-check-update.js

@@ -8,6 +8,8 @@ const path = require('path');
 const os = require('os');
 const { spawn } = require('child_process');
 
+const { updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
+
 const homeDir = os.homedir();
 const cwd = process.cwd();
 
@@ -16,11 +18,11 @@ const cwd = process.cwd();
 function detectConfigDir(baseDir) {
   // Check env override first (supports multi-account setups)
   const envDir = process.env.CLAUDE_CONFIG_DIR;
-  if (envDir && fs.existsSync(path.join(envDir, 'get-shit-done', 'VERSION'))) {
+  if (envDir && fs.existsSync(path.join(envDir, 'gsd-core', 'VERSION'))) {
     return envDir;
   }
   for (const dir of ['.claude', '.gemini', '.config/kilo', '.kilo', '.config/opencode', '.opencode']) {
-    if (fs.existsSync(path.join(baseDir, dir, 'get-shit-done', 'VERSION'))) {
+    if (fs.existsSync(path.join(baseDir, dir, 'gsd-core', 'VERSION'))) {
       return path.join(baseDir, dir);
     }
   }
@@ -33,11 +35,11 @@ const projectConfigDir = detectConfigDir(cwd);
 // resolution mismatches where check-update writes to one runtime's cache
 // but statusline reads from another (#1421).
 const cacheDir = path.join(homeDir, '.cache', 'gsd');
-const cacheFile = path.join(cacheDir, 'gsd-update-check.json');
+const cacheFile = path.join(cacheDir, updateCacheFileName);
 
 // VERSION file locations (check project first, then global)
-const projectVersionFile = path.join(projectConfigDir, 'get-shit-done', 'VERSION');
-const globalVersionFile = path.join(globalConfigDir, 'get-shit-done', 'VERSION');
+const projectVersionFile = path.join(projectConfigDir, 'gsd-core', 'VERSION');
+const globalVersionFile = path.join(globalConfigDir, 'gsd-core', 'VERSION');
 
 // Ensure cache directory exists
 if (!fs.existsSync(cacheDir)) {

package/hooks/gsd-context-monitor.js

@@ -140,10 +140,10 @@ process.stdin.on('end', () => {
     if (isCritical && isGsdActive && !warnData.criticalRecorded) {
       try {
         // Runtime-agnostic path: this hook lives at <runtime-config>/hooks/
-        // and gsd-tools.cjs lives at <runtime-config>/get-shit-done/bin/.
+        // and gsd-tools.cjs lives at <runtime-config>/gsd-core/bin/.
         // Using __dirname makes this work on Claude Code, OpenCode, Gemini,
         // Kilo, etc. without hardcoding ~/.claude/.
-        const gsdTools = path.join(__dirname, '..', 'get-shit-done', 'bin', 'gsd-tools.cjs');
+        const gsdTools = path.join(__dirname, '..', 'gsd-core', 'bin', 'gsd-tools.cjs');
         // Coerce usedPct to a safe number in case bridge file is malformed
         const safeUsedPct = Number(usedPct) || 0;
         const stoppedAt = `context exhaustion at ${safeUsedPct}% (${new Date().toISOString().split('T')[0]})`;

package/hooks/gsd-statusline.js

@@ -6,7 +6,8 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { isSemverNewer } = require('../get-shit-done/bin/lib/semver-compare.cjs');
+const { isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs');
+const { PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
 
 // --- Config + last-command readers ------------------------------------------
 
@@ -395,32 +396,22 @@ function runStatusline() {
     const gsdStateStr = task ? '' : formatGsdState(readGsdState(dir) || {});
 
     // GSD update available?
-    // Check shared cache first (#1421), fall back to runtime-specific cache for
-    // backward compatibility with older gsd-check-update.js versions.
+    // Read only the per-package shared cache file (#607). The legacy
+    // runtime-specific fallback has been removed — the per-package filename
+    // carries lineage and avoids multi-runtime resolution mismatches (#1421).
     let gsdUpdate = '';
-    const sharedCacheFile = path.join(homeDir, '.cache', 'gsd', 'gsd-update-check.json');
-    const legacyCacheFile = path.join(claudeDir, 'cache', 'gsd-update-check.json');
-    const cacheFile = fs.existsSync(sharedCacheFile) ? sharedCacheFile : legacyCacheFile;
+    const cacheFile = path.join(homeDir, '.cache', 'gsd', updateCacheFileName);
     if (fs.existsSync(cacheFile)) {
       try {
         const cache = JSON.parse(fs.readFileSync(cacheFile, 'utf8'));
-        if (cache.update_available) {
+        const { showUpdate, staleWarning } = evaluateUpdateCache(cache);
+        if (showUpdate) {
           gsdUpdate = '\x1b[33m⬆ /gsd:update\x1b[0m │ ';
         }
-        if (cache.stale_hooks && cache.stale_hooks.length > 0) {
-          // If installed version is ahead of npm latest, this is a dev install.
-          // Running /gsd:update would downgrade — show a contextual warning instead.
-          const isDevInstall = (
-            cache.installed &&
-            cache.latest &&
-            cache.latest !== 'unknown' &&
-            isInstalledAheadOfLatest(cache.installed, cache.latest)
-          );
-          if (isDevInstall) {
-            gsdUpdate += '\x1b[33m⚠ dev install — re-run installer to sync hooks\x1b[0m │ ';
-          } else {
-            gsdUpdate += '\x1b[31m⚠ stale hooks — run /gsd:update\x1b[0m │ ';
-          }
+        if (staleWarning === 'dev') {
+          gsdUpdate += '\x1b[33m⚠ dev install — re-run installer to sync hooks\x1b[0m │ ';
+        } else if (staleWarning === 'stale') {
+          gsdUpdate += '\x1b[31m⚠ stale hooks — run /gsd:update\x1b[0m │ ';
         }
       } catch (e) {}
     }
@@ -507,12 +498,39 @@ function isInstalledAheadOfLatest(installed, latest) {
   return isSemverNewer(installed, latest);
 }
 
+/**
+ * Pure function: evaluate an update-check cache object and return display flags.
+ * Applies lineage guard — if package_name is absent or foreign, treats cache as absent.
+ *
+ * @param {object|null} cache  Parsed cache object, or null.
+ * @returns {{ showUpdate: boolean, staleWarning: 'none'|'dev'|'stale' }}
+ */
+function evaluateUpdateCache(cache) {
+  const none = { showUpdate: false, staleWarning: 'none' };
+  if (!cache) return none;
+  // Lineage guard: package_name must be present and match this package.
+  if (!cache.package_name || cache.package_name !== PACKAGE_NAME) return none;
+  const showUpdate = Boolean(cache.update_available);
+  let staleWarning = 'none';
+  if (cache.stale_hooks && cache.stale_hooks.length > 0) {
+    const isDevInstall = (
+      cache.installed &&
+      cache.latest &&
+      cache.latest !== 'unknown' &&
+      isInstalledAheadOfLatest(cache.installed, cache.latest)
+    );
+    staleWarning = isDevInstall ? 'dev' : 'stale';
+  }
+  return { showUpdate, staleWarning };
+}
+
 // Export helpers for unit tests. Harmless when run as a script.
 module.exports = {
   readGsdState, parseStateMd, formatGsdState,
   readGsdConfig, getConfigValue, readLastSlashCommand,
   composeStatusline,
   isInstalledAheadOfLatest,
+  evaluateUpdateCache,
 };
 
 /**

package/hooks/gsd-update-banner.js

@@ -2,7 +2,7 @@
 // gsd-hook-version: {{GSD_VERSION}}
 // SessionStart banner that surfaces GSD update availability when GSD's
 // statusline isn't installed. Reads the cache that
-// gsd-check-update-worker.js writes to ~/.cache/gsd/gsd-update-check.json.
+// gsd-check-update-worker.js writes to ~/.cache/gsd/<updateCacheFileName> (per-package).
 //
 // Opt-in by design: bin/install.js only registers this hook when the user
 // declines to install (or replace) the GSD statusline. The presence of the
@@ -15,6 +15,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
 
 // Suppress repeat parse-error banners for 24 hours so a genuinely broken
 // cache file doesn't nag the user every session.
@@ -37,6 +38,9 @@ function buildBannerOutput(state) {
     return { systemMessage: 'GSD update check failed.' };
   }
   if (!cache) return null;
+  // Lineage guard: package_name must be present and match this package.
+  // Absent package_name means the cache predates lineage tracking — treat as untrusted.
+  if (!cache.package_name || cache.package_name !== PACKAGE_NAME) return null;
   if (!cache.update_available) return null;
   const installed = cache.installed || 'unknown';
   const latest = cache.latest || 'unknown';
@@ -96,7 +100,7 @@ function recordFailureWarning(sentinelFile, nowSeconds) {
 
 function main() {
   const cacheDir = path.join(os.homedir(), '.cache', 'gsd');
-  const cacheFile = path.join(cacheDir, 'gsd-update-check.json');
+  const cacheFile = path.join(cacheDir, updateCacheFileName);
   const sentinelFile = path.join(cacheDir, 'banner-failure-warned-at');
   const now = Math.floor(Date.now() / 1000);