@opengsd/gsd-core 1.2.0 → 1.3.0

package/hooks/gsd-worktree-path-guard.js

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+// gsd-hook-version: {{GSD_VERSION}}
+// GSD Worktree Path Guard — PreToolUse hook
+// Blocks Edit/Write/MultiEdit tool calls that target absolute paths outside the worktree root.
+//
+// Problem: gsd-executor agents spawned with isolation="worktree" sometimes issue
+// Edit/Write calls with absolute paths rooted at the MAIN repository instead of
+// the worktree (issue #260). The prose guard in agents/gsd-executor.md step 0b
+// is never enforced because the model under load skips it.
+//
+// This hook enforces the constraint at the tooling layer, making it HARD-BLOCKING.
+//
+// Triggers on: Edit, Write, and MultiEdit tool calls
+// Action: BLOCK (exit 2) if file_path is absolute and outside the worktree root
+// No-op: relative paths, non-worktree CWDs, hook errors (silent fail)
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const SPAWNOPT = { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 2000 };
+
+function git(args, cwd) {
+  return spawnSync('git', args, { ...SPAWNOPT, cwd });
+}
+
+// Walk up from `start` to find the nearest existing directory.
+// Returns null if we reach the filesystem root without finding one.
+function nearestExistingDir(start) {
+  let dir = start;
+  let prev;
+  do {
+    prev = dir;
+    try { fs.accessSync(dir, fs.constants.F_OK); return dir; } catch { /* keep walking */ }
+    dir = path.dirname(dir);
+  } while (dir !== prev);
+  return null;
+}
+
+let input = '';
+const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => input += chunk);
+process.stdin.on('end', () => {
+  clearTimeout(stdinTimeout);
+  try {
+    const data = JSON.parse(input);
+    const toolName = data.tool_name;
+
+    // Only guard Edit, Write, and MultiEdit tool calls
+    if (toolName !== 'Edit' && toolName !== 'Write' && toolName !== 'MultiEdit') {
+      process.exit(0);
+    }
+
+    const cwd = data.cwd || process.cwd();
+
+    // Detect whether CWD is inside a linked git worktree by inspecting
+    // the git-dir path. In a linked worktree, git rev-parse --git-dir
+    // returns a path containing .git/worktrees/ as a component.
+    // In the main repo or a submodule it returns .git (or a path without /worktrees/).
+    // This approach works even when cwd is a subdirectory of the worktree.
+    const gitDirResult = git(['rev-parse', '--git-dir'], cwd);
+    if (gitDirResult.status !== 0 || !gitDirResult.stdout) {
+      process.exit(0); // not a git repo — pass through
+    }
+
+    const gitDir = gitDirResult.stdout.trim();
+    // A linked worktree's --git-dir contains .git/worktrees/ as a path component
+    const isLinkedWorktree = /[/\\]\.git[/\\]worktrees[/\\]/.test(gitDir);
+    if (!isLinkedWorktree) {
+      process.exit(0); // main repo, submodule, or separate-git-dir — no-op
+    }
+
+    // Get the raw --show-toplevel output for the worktree (cwd).
+    // We keep it raw (not path.resolve'd) to compare directly with the
+    // file's toplevel — same git binary, same format, no normalization needed.
+    const wtTopResult = git(['rev-parse', '--show-toplevel'], cwd);
+    if (wtTopResult.status !== 0 || !wtTopResult.stdout) {
+      process.exit(0); // can't determine root — fail open
+    }
+    const wtTopRaw = wtTopResult.stdout.trim();
+
+    const rawFilePath = data.tool_input?.file_path || '';
+    if (!rawFilePath) {
+      process.exit(0);
+    }
+
+    // Relative paths are always safe — they resolve relative to CWD inside the worktree
+    if (!path.isAbsolute(rawFilePath)) {
+      process.exit(0);
+    }
+
+    // Normalise .. traversal so /worktree/src/../../../main/file
+    // resolves to its true location before we check containment.
+    const filePath = path.resolve(rawFilePath);
+
+    // Find the nearest existing ancestor of filePath so we can ask git
+    // for its toplevel. The file itself may not exist yet (Write creates
+    // new files), but at least one ancestor directory must exist.
+    // We check the file itself first in case it already exists.
+    const checkDir = nearestExistingDir(
+      (() => {
+        try {
+          return fs.statSync(filePath).isDirectory() ? filePath : path.dirname(filePath);
+        } catch {
+          return path.dirname(filePath);
+        }
+      })()
+    );
+
+    if (!checkDir) {
+      // Walked to root without finding any directory — path is synthetic.
+      // Block conservatively.
+      const output = {
+        decision: 'block',
+        reason:
+          `Worktree path guard: '${filePath}' has no existing ancestor directory — ` +
+          `cannot verify it is inside the worktree '${wtTopRaw}'. Use a relative path instead.`,
+      };
+      process.stdout.write(JSON.stringify(output));
+      process.exit(2);
+    }
+
+    // Ask git for the toplevel of the file's location.
+    // Comparing two raw git --show-toplevel outputs avoids every
+    // platform-specific path normalisation pitfall (Windows 8.3 short names,
+    // case differences between realpathSync and path.resolve, forward- vs
+    // back-slash inconsistencies) — both values come from the same git binary
+    // in the same format by definition.
+    const fileTopResult = git(['rev-parse', '--show-toplevel'], checkDir);
+
+    if (fileTopResult.status !== 0 || !fileTopResult.stdout) {
+      // checkDir is not inside any git repo → cannot be inside the worktree.
+      const output = {
+        decision: 'block',
+        reason:
+          `Worktree path guard: '${filePath}' is not inside any git repository — ` +
+          `it cannot be inside the worktree at '${wtTopRaw}'. Use a relative path instead.`,
+      };
+      process.stdout.write(JSON.stringify(output));
+      process.exit(2);
+    }
+
+    const fileTopRaw = fileTopResult.stdout.trim();
+
+    // Same git toplevel → file is inside the worktree → allow
+    if (fileTopRaw === wtTopRaw) {
+      process.exit(0);
+    }
+
+    // BLOCK: file resolves to a different git root than the active worktree
+    const output = {
+      decision: 'block',
+      reason:
+        `Worktree path guard: '${filePath}' resolves to git root '${fileTopRaw}' which ` +
+        `differs from the active worktree root '${wtTopRaw}'. This likely means an ` +
+        `absolute path was derived from the orchestrator's main repository instead of ` +
+        `the active worktree. To fix: use a relative path, or re-derive the base ` +
+        `directory with \`git rev-parse --show-toplevel\` from within the worktree ` +
+        `(hook cwd: '${cwd}').`,
+    };
+
+    process.stdout.write(JSON.stringify(output));
+    process.exit(2);
+  } catch {
+    // Silent fail — never block valid tool calls due to hook errors
+    process.exit(0);
+  }
+});

package/hooks/managed-hooks-registry.cjs

@@ -29,6 +29,7 @@ const MANAGED_HOOKS = [
   'gsd-update-banner.js',
   'gsd-validate-commit.sh',
   'gsd-workflow-guard.js',
+  'gsd-worktree-path-guard.js',
 ];
 
 module.exports = { MANAGED_HOOKS };

package/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@opengsd/gsd-core",
-  "version": "1.2.0",
-  "description": "A meta-prompting, context engineering and spec-driven development system for Claude Code, OpenCode, Gemini and Codex by TÂCHES.",
+  "version": "1.3.0",
+  "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "bin": {
     "gsd-core": "bin/install.js",
-    "gsd-tools": "get-shit-done/bin/gsd-tools.cjs"
+    "gsd-tools": "gsd-core/bin/gsd-tools.cjs"
   },
   "files": [
     "bin",
     "commands",
-    "get-shit-done",
+    "gsd-core",
+    "assets",
     "agents",
     "hooks",
     "scripts"
@@ -26,7 +27,7 @@
     "codex",
     "codex-cli"
   ],
-  "author": "TÂCHES",
+  "author": "OpenGSD",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -50,6 +51,7 @@
   "devDependencies": {
     "@eslint/js": "^9.39.4",
     "@stryker-mutator/core": "^9.6.1",
+    "@types/node": "^22.19.19",
     "c8": "^11.0.0",
     "eslint": "^9.39.4",
     "eslint-plugin-n": "^17.24.0",
@@ -69,12 +71,15 @@
     "check:alias-drift": "node scripts/check-alias-drift.cjs",
     "check:identity-drift": "node scripts/lint-package-identity-drift.cjs",
     "check:integrity": "node scripts/check-npm-integrity.cjs",
-    "build": "npm run generate:identity && npm run build:hooks",
+    "build": "npm run generate:identity && npm run build:lib && npm run build:hooks",
     "build:hooks": "node scripts/build-hooks.js",
+    "build:lib": "tsc -p tsconfig.build.json",
     "generate:identity": "node scripts/generate-package-identity.cjs",
-    "prepublishOnly": "npm run build:hooks",
-    "pretest": "npm run lint:skill-deps",
-    "pretest:coverage": "npm run lint:skill-deps",
+    "prepack": "npm run build:lib",
+    "prepare": "npm run build:lib",
+    "prepublishOnly": "npm run build:lib && npm run build:hooks",
+    "pretest": "npm run build:lib && npm run lint:skill-deps",
+    "pretest:coverage": "npm run build:lib && npm run lint:skill-deps",
     "lint": "eslint . --cache --cache-location node_modules/.cache/eslint/",
     "lint:fix": "eslint . --fix",
     "lint:descriptions": "node scripts/lint-descriptions.cjs",
@@ -83,6 +88,7 @@
     "lint:pr-checks": "node scripts/lint-pr-check-project-dir.cjs",
     "lint:changeset": "node scripts/changeset/lint.cjs",
     "lint:docs": "node scripts/lint-docs-required.cjs",
+    "lint:legacy-name": "node scripts/lint-legacy-dir-name.cjs",
     "ci:test-scope": "node scripts/ci-test-scope.cjs",
     "changeset": "node scripts/changeset/new.cjs",
     "changelog:render": "node scripts/changeset/cli.cjs render",
@@ -93,8 +99,8 @@
     "test:security": "node scripts/run-tests.cjs --suite security",
     "test:slow": "node scripts/run-tests.cjs --suite slow",
     "test:affected": "node scripts/run-affected-tests.cjs",
-    "test:coverage": "c8 --check-coverage --lines 70 --reporter text --include 'get-shit-done/bin/lib/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs",
-    "test:coverage:unit": "c8 --check-coverage --lines 70 --reporter text --include 'get-shit-done/bin/lib/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs --suite unit",
+    "test:coverage": "c8 --check-coverage --lines 70 --reporter text --include 'gsd-core/bin/lib/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs",
+    "test:coverage:unit": "c8 --check-coverage --lines 70 --reporter text --include 'gsd-core/bin/lib/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs --suite unit",
     "test:coverage:all": "npm run test:coverage",
     "test:mutation": "stryker run",
     "test:mutation:since": "stryker run --incremental --since origin/next"

package/scripts/affected-tests-lib.cjs

@@ -25,7 +25,7 @@ const PR_FULL_SUITES = ['unit', 'integration', 'security'];
 // Relative to repoRoot. We walk these to discover SUT-internal requires so that
 // a change to a deep helper propagates through re-export chains to tests.
 const SOURCE_TREES = [
-  'get-shit-done/bin/lib',
+  'gsd-core/bin/lib',
   'bin/lib',
   'bin',
   'scripts',

package/scripts/base64-scan.sh

@@ -217,6 +217,18 @@ extract_and_check_blobs() {
   local found=0
   local line_num=0
 
+  # Skip binary-by-content files (e.g. adversarial parser fixtures with embedded
+  # non-UTF8 / NUL bytes). They cannot meaningfully carry base64-obfuscated *text*,
+  # and feeding NUL bytes through the per-line scanner spawns thousands of bogus
+  # `base64 -d` subprocesses (the "ignored null byte" warnings) — slow enough to
+  # blow the job timeout on a large diff. `grep -Iq .` treats a binary file as
+  # non-matching, so this skips it with a coverage notice (collect_files already
+  # filters binary *extensions*; this catches binary *content* in text extensions).
+  if ! LC_ALL=C grep -Iq . "$file" 2>/dev/null; then
+    echo "SKIP: $file (binary content — base64 text scan not applicable)" >&2
+    return 0
+  fi
+
   while IFS= read -r line; do
     line_num=$((line_num + 1))
 

package/scripts/build-hooks.js

@@ -26,6 +26,9 @@ const STAGE_DIR = path.join(HOOKS_DIR, `.dist-staging-${process.pid}`);
 const HOOKS_TO_COPY = [
   'gsd-check-update-worker.js',
   'gsd-check-update.js',
+  // Required by gsd-check-update-worker.js at runtime — must ship alongside it
+  // so require('./managed-hooks-registry.cjs') resolves in the installed hooks/ dir.
+  'managed-hooks-registry.cjs',
   'gsd-context-monitor.js',
   'gsd-prompt-guard.js',
   'gsd-read-guard.js',
@@ -33,6 +36,7 @@ const HOOKS_TO_COPY = [
   'gsd-statusline.js',
   'gsd-update-banner.js',
   'gsd-workflow-guard.js',
+  'gsd-worktree-path-guard.js',
   // Community hooks (bash, opt-in via .planning/config.json hooks.community)
   'gsd-session-state.sh',
   'gsd-validate-commit.sh',
@@ -233,4 +237,4 @@ if (require.main === module) {
   build();
 }
 
-module.exports = { HOOKS_TO_COPY };
+module.exports = { HOOKS_TO_COPY, HOOKS_SUBDIRS_TO_COPY };

package/scripts/changeset/cli.cjs

@@ -24,8 +24,8 @@ const { renderGithubReleaseNotes } = require('./github-release-notes.cjs');
 const {
   compareSemverCore,
   isStableTripletSemver,
-} = require('../../get-shit-done/bin/lib/semver-compare.cjs');
-const { packageName, repoSlug: defaultRepoSlug } = require('../../get-shit-done/bin/lib/package-identity.cjs');
+} = require('../../gsd-core/bin/lib/semver-compare.cjs');
+const { packageName, repoSlug: defaultRepoSlug } = require('../../gsd-core/bin/lib/package-identity.cjs');
 
 function parseArgs(argv) {
   const opts = {

package/scripts/changeset/github-release-notes.cjs

@@ -4,7 +4,7 @@ const cp = require('node:child_process');
 const path = require('node:path');
 
 const { parseFragment } = require('./parse.cjs');
-const { packageName, repoSlug: defaultRepoSlug } = require('../../get-shit-done/bin/lib/package-identity.cjs');
+const { packageName, repoSlug: defaultRepoSlug } = require('../../gsd-core/bin/lib/package-identity.cjs');
 
 const SECTION_ORDER = ['Fixed', 'Added', 'Changed', 'Deprecated', 'Removed', 'Security'];
 

package/scripts/changeset/lint.cjs

@@ -25,7 +25,7 @@ const OPT_OUT_LABEL = 'no-changelog';
 // fragment or an explicit opt-out label. Test/CI/docs/lock files do not.
 const USER_FACING_PREFIXES = [
   'bin/',
-  'get-shit-done/',
+  'gsd-core/',
   'agents/',
   'commands/',
   'hooks/',

package/scripts/check-alias-drift.cjs

@@ -4,7 +4,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 
 const ROOT = path.resolve(__dirname, '..');
-const aliasesPath = path.join(ROOT, 'get-shit-done', 'bin', 'lib', 'command-aliases.cjs');
+const aliasesPath = path.join(ROOT, 'gsd-core', 'bin', 'lib', 'command-aliases.cjs');
 
 function fail(message) {
   process.stderr.write(`${message}\n`);
@@ -37,37 +37,37 @@ const families = [
   {
     commandAliases: 'STATE_COMMAND_ALIASES',
     subcommands: 'STATE_SUBCOMMANDS',
-    routerPath: path.join(ROOT, 'get-shit-done', 'bin', 'lib', 'state-command-router.cjs'),
+    routerPath: path.join(ROOT, 'gsd-core', 'bin', 'lib', 'state-command-router.cjs'),
   },
   {
     commandAliases: 'VERIFY_COMMAND_ALIASES',
     subcommands: 'VERIFY_SUBCOMMANDS',
-    routerPath: path.join(ROOT, 'get-shit-done', 'bin', 'lib', 'verify-command-router.cjs'),
+    routerPath: path.join(ROOT, 'gsd-core', 'bin', 'lib', 'verify-command-router.cjs'),
   },
   {
     commandAliases: 'INIT_COMMAND_ALIASES',
     subcommands: 'INIT_SUBCOMMANDS',
-    routerPath: path.join(ROOT, 'get-shit-done', 'bin', 'lib', 'init-command-router.cjs'),
+    routerPath: path.join(ROOT, 'gsd-core', 'bin', 'lib', 'init-command-router.cjs'),
   },
   {
     commandAliases: 'PHASE_COMMAND_ALIASES',
     subcommands: 'PHASE_SUBCOMMANDS',
-    routerPath: path.join(ROOT, 'get-shit-done', 'bin', 'lib', 'phase-command-router.cjs'),
+    routerPath: path.join(ROOT, 'gsd-core', 'bin', 'lib', 'phase-command-router.cjs'),
   },
   {
     commandAliases: 'PHASES_COMMAND_ALIASES',
     subcommands: 'PHASES_SUBCOMMANDS',
-    routerPath: path.join(ROOT, 'get-shit-done', 'bin', 'lib', 'phases-command-router.cjs'),
+    routerPath: path.join(ROOT, 'gsd-core', 'bin', 'lib', 'phases-command-router.cjs'),
   },
   {
     commandAliases: 'VALIDATE_COMMAND_ALIASES',
     subcommands: 'VALIDATE_SUBCOMMANDS',
-    routerPath: path.join(ROOT, 'get-shit-done', 'bin', 'lib', 'validate-command-router.cjs'),
+    routerPath: path.join(ROOT, 'gsd-core', 'bin', 'lib', 'validate-command-router.cjs'),
   },
   {
     commandAliases: 'ROADMAP_COMMAND_ALIASES',
     subcommands: 'ROADMAP_SUBCOMMANDS',
-    routerPath: path.join(ROOT, 'get-shit-done', 'bin', 'lib', 'roadmap-command-router.cjs'),
+    routerPath: path.join(ROOT, 'gsd-core', 'bin', 'lib', 'roadmap-command-router.cjs'),
   },
 ];
 

package/scripts/check-env.cjs

@@ -212,7 +212,11 @@ if (fs.existsSync(LOCKFILE)) {
 // ---------------------------------------------------------------------------
 if (fs.existsSync(LOCKFILE)) {
   try {
-    const res = spawnSync(npmCmd, ['ci', '--dry-run'], {
+    // --ignore-scripts: this is a lockfile-vs-package.json sync check, not a
+    // build. Without it, npm would run the `prepare` lifecycle (build:lib via
+    // tsc) — which fails when check:env runs before deps are installed (tsc
+    // absent), misreporting an out-of-sync lockfile. ADR-457 build-at-publish.
+    const res = spawnSync(npmCmd, ['ci', '--dry-run', '--ignore-scripts'], {
       cwd: PROJECT_ROOT,
       encoding: 'utf8',
       shell: process.platform === 'win32',

package/scripts/ci-test-scope.cjs

@@ -42,10 +42,20 @@ const RULES = [
       'tests/bug-3588-npm-audit-clean.test.cjs',
     ],
   },
+  {
+    name: 'TS runtime sources (ADR-457 build-at-publish)',
+    // src/*.cts compiles into gsd-core/bin/lib/*.cjs; a source-only edit must
+    // still trigger the migrated module's tests (otherwise CI silently skips them).
+    match: path => path.startsWith('src/') || path === 'tsconfig.build.json',
+    tests: [
+      'tests/semver-compare.test.cjs',
+      'tests/bug-10-semver-policy-consolidation.test.cjs',
+    ],
+  },
   {
     name: 'installer and package layout',
     match: path => path.startsWith('bin/') ||
-      path.startsWith('get-shit-done/bin/') ||
+      path.startsWith('gsd-core/bin/') ||
       path.includes('install') ||
       path.includes('release-tarball-smoke'),
     fullMatrix: true,
@@ -112,7 +122,7 @@ const RULES = [
   },
   {
     name: 'workflow prompts',
-    match: path => path.startsWith('get-shit-done/workflows/'),
+    match: path => path.startsWith('gsd-core/workflows/'),
     tests: [
       'tests/workflow-compat.test.cjs',
       'tests/workflow-size-budget.test.cjs',
@@ -143,7 +153,7 @@ const RULES = [
   },
   {
     name: 'configuration',
-    match: path => /config|configuration|model-catalog|model-profile/.test(path),
+    match: path => ['config', 'configuration', 'model-catalog', 'model-profile'].some(k => path.includes(k)),
     tests: [
       'tests/config.test.cjs',
       'tests/config-get-default.test.cjs',
@@ -198,7 +208,19 @@ function parseArgs(argv) {
 
 function splitFiles(value) {
   if (!value) return [];
-  return value.split(/[,\s]+/).map(v => v.trim()).filter(Boolean);
+  const SEPARATORS = new Set([',', ' ', '\t', '\n', '\r', '\f', '\v']);
+  const tokens = [];
+  let current = '';
+  for (const ch of value) {
+    if (SEPARATORS.has(ch)) {
+      if (current) tokens.push(current);
+      current = '';
+    } else {
+      current += ch;
+    }
+  }
+  if (current) tokens.push(current);
+  return tokens.map(v => v.trim()).filter(Boolean);
 }
 
 function changedFiles(args) {
@@ -221,6 +243,9 @@ function addAll(set, values) {
   for (const value of values) set.add(value);
 }
 
+const WINDOWS_HINTS = ['windows', 'path', 'shell', 'workflow', 'install', 'hook'];
+const isWindowsHint = s => WINDOWS_HINTS.some(k => s.toLowerCase().includes(k));
+
 function classify(files) {
   const targeted = new Set();
   const windows = new Set();
@@ -229,9 +254,9 @@ function classify(files) {
   let fullMatrix = false;
 
   for (const file of files) {
-    if (/^(bin|get-shit-done|agents|commands|docs|hooks|tests|scripts)\//.test(file) ||
-      /^package(-lock)?\.json$/.test(file) ||
-      /^tsconfig.*\.json$/.test(file) ||
+    if (['bin/', 'gsd-core/', 'agents/', 'commands/', 'docs/', 'hooks/', 'tests/', 'scripts/'].some(p => file.startsWith(p)) ||
+      file === 'package.json' || file === 'package-lock.json' ||
+      (file.startsWith('tsconfig') && file.endsWith('.json')) ||
       file.startsWith('.github/workflows/') ||
       file.startsWith('.github/rulesets/')) {
       codeChanged = true;
@@ -240,7 +265,7 @@ function classify(files) {
     if (file.startsWith('tests/') && file.endsWith('.test.cjs')) {
       targeted.add(file);
       fullMatrix = true;
-      if (/windows|path|shell|workflow|install|hook/i.test(file)) {
+      if (isWindowsHint(file)) {
         windows.add(file);
       }
     }
@@ -262,7 +287,7 @@ function classify(files) {
     targetedTests.push('unit');
   }
 
-  const windowsTests = existingTests([...new Set([...windows, ...targetedTests.filter(t => /windows|path|shell|workflow|install|hook/i.test(t))])].sort());
+  const windowsTests = existingTests([...new Set([...windows, ...targetedTests.filter(isWindowsHint)])].sort());
 
   return {
     code_changed: codeChanged,

package/scripts/command-contract-helpers.cjs

@@ -54,7 +54,7 @@ function executionContextRefs(content) {
       const trailingProse = line.length > token.length;
       const normalized = token
         .replace(/^@(?:~|\$HOME)\//, '')
-        .replace(/^(?:\.claude\/)?(?:get-shit-done\/)?/, '');
+        .replace(/^(?:\.claude\/)?(?:gsd-core\/)?/, '');
       refs.push({ token, normalized, trailingProse });
     }
   }

package/scripts/fix-slash-commands.cjs

@@ -20,11 +20,11 @@ const path = require('node:path');
 
 const COMMANDS_DIR = path.join(__dirname, '..', 'commands', 'gsd');
 const SEARCH_DIRS = [
-  path.join(__dirname, '..', 'get-shit-done', 'bin', 'lib'),
-  path.join(__dirname, '..', 'get-shit-done', 'workflows'),
-  path.join(__dirname, '..', 'get-shit-done', 'references'),
-  path.join(__dirname, '..', 'get-shit-done', 'templates'),
-  path.join(__dirname, '..', 'get-shit-done', 'contexts'),
+  path.join(__dirname, '..', 'gsd-core', 'bin', 'lib'),
+  path.join(__dirname, '..', 'gsd-core', 'workflows'),
+  path.join(__dirname, '..', 'gsd-core', 'references'),
+  path.join(__dirname, '..', 'gsd-core', 'templates'),
+  path.join(__dirname, '..', 'gsd-core', 'contexts'),
   path.join(__dirname, '..', 'commands', 'gsd'),
   path.join(__dirname, '..', 'agents'),
   path.join(__dirname, '..', 'hooks'),

package/scripts/gen-inventory-manifest.cjs

@@ -34,19 +34,19 @@ const FAMILIES = [
   },
   {
     name: 'workflows',
-    dir: path.join(ROOT, 'get-shit-done', 'workflows'),
+    dir: path.join(ROOT, 'gsd-core', 'workflows'),
     filter: (f) => f.endsWith('.md'),
     toName: (f) => f,
   },
   {
     name: 'references',
-    dir: path.join(ROOT, 'get-shit-done', 'references'),
+    dir: path.join(ROOT, 'gsd-core', 'references'),
     filter: (f) => f.endsWith('.md'),
     toName: (f) => f,
   },
   {
     name: 'cli_modules',
-    dir: path.join(ROOT, 'get-shit-done', 'bin', 'lib'),
+    dir: path.join(ROOT, 'gsd-core', 'bin', 'lib'),
     filter: (f) => f.endsWith('.cjs'),
     toName: (f) => f,
   },

package/scripts/generate-package-identity.cjs

@@ -6,7 +6,7 @@
  *
  * `deriveIdentity(pkg)` is the pure core: it turns a parsed package.json into
  * the coordinate record every consumer needs. The generated runtime module
- * `get-shit-done/bin/lib/package-identity.cjs` bakes those values at build
+ * `gsd-core/bin/lib/package-identity.cjs` bakes those values at build
  * time, because the installed tree carries only a synthetic
  * `{"type":"commonjs"}` package.json (no `.name`) — so a runtime
  * `require('package.json').name` resolves to `undefined` (the #378 bug this
@@ -24,6 +24,21 @@ function parseRepoSlug(repository) {
   return m ? m[1] : '';
 }
 
+/**
+ * Pure: turn an npm package name into a filesystem-safe slug for cache filenames.
+ * Strips a leading `@`, replaces `/` with `-`, then collapses any run of
+ * characters that are NOT `[a-z0-9]` to a single `-`, and trims leading/trailing `-`.
+ */
+function slugifyPackageName(name) {
+  if (!name) return '';
+  return name
+    .replace(/^@/, '')
+    .replace(/\//g, '-')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
 /**
  * Pure: package.json object -> the package identity coordinates.
  */
@@ -35,7 +50,9 @@ function deriveIdentity(pkg = {}) {
   const changelogRawUrl = repoSlug
     ? `https://raw.githubusercontent.com/${repoSlug}/main/CHANGELOG.md`
     : '';
-  return { packageName, binName, repoSlug, repoUrl, changelogRawUrl };
+  const cacheSlug = slugifyPackageName(packageName);
+  const updateCacheFileName = cacheSlug ? `gsd-update-check-${cacheSlug}.json` : 'gsd-update-check.json';
+  return { packageName, binName, repoSlug, repoUrl, changelogRawUrl, cacheSlug, updateCacheFileName };
 }
 
 /**
@@ -62,7 +79,7 @@ const GENERATED_HEADER =
  * runtime command builder is byte-identical to the tested source above.
  */
 function render(identity) {
-  const { packageName, binName, repoSlug, repoUrl, changelogRawUrl } = identity;
+  const { packageName, binName, repoSlug, repoUrl, changelogRawUrl, cacheSlug, updateCacheFileName } = identity;
   const j = (v) => JSON.stringify(v);
   return (
     GENERATED_HEADER +
@@ -71,7 +88,9 @@ function render(identity) {
     `const binName = ${j(binName)};\n` +
     `const repoSlug = ${j(repoSlug)};\n` +
     `const repoUrl = ${j(repoUrl)};\n` +
-    `const changelogRawUrl = ${j(changelogRawUrl)};\n\n` +
+    `const changelogRawUrl = ${j(changelogRawUrl)};\n` +
+    `const cacheSlug = ${j(cacheSlug)};\n` +
+    `const updateCacheFileName = ${j(updateCacheFileName)};\n\n` +
     `${formatManualInstall.toString()}\n\n` +
     'function manualInstallCommand(opts = {}) {\n' +
     '  return formatManualInstall({ packageName, binName, scope: opts.scope, runtime: opts.runtime });\n' +
@@ -79,12 +98,14 @@ function render(identity) {
     'module.exports = Object.freeze({\n' +
     '  packageName,\n' +
     '  // PACKAGE_NAME: back-compat alias for #516-era consumers. Baked here, so it\n' +
-    '  // survives the installed tree’s synthetic package.json (fixes the #378 undefined).\n' +
+    "  // survives the installed tree's synthetic package.json (fixes the #378 undefined).\n" +
     '  PACKAGE_NAME: packageName,\n' +
     '  binName,\n' +
     '  repoSlug,\n' +
     '  repoUrl,\n' +
     '  changelogRawUrl,\n' +
+    '  cacheSlug,\n' +
+    '  updateCacheFileName,\n' +
     '  manualInstallCommand,\n' +
     '});\n'
   );
@@ -94,11 +115,11 @@ function main() {
   const fs = require('node:fs');
   const path = require('node:path');
   const pkg = require(path.join(__dirname, '..', 'package.json'));
-  const out = path.join(__dirname, '..', 'get-shit-done', 'bin', 'lib', 'package-identity.cjs');
+  const out = path.join(__dirname, '..', 'gsd-core', 'bin', 'lib', 'package-identity.cjs');
   fs.writeFileSync(out, render(deriveIdentity(pkg)));
   process.stdout.write(`wrote ${path.relative(path.join(__dirname, '..'), out)}\n`);
 }
 
 if (require.main === module) main();
 
-module.exports = { deriveIdentity, parseRepoSlug, formatManualInstall, render, main };
+module.exports = { deriveIdentity, parseRepoSlug, slugifyPackageName, formatManualInstall, render, main };