@opengsd/gsd-core 1.20.0 → 1.21.0

package/gsd-core/bin/lib/commands.cjs

@@ -14,6 +14,8 @@ const node_path_1 = __importDefault(require("node:path"));
 const text_lines_cjs_1 = require("./text-lines.cjs");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const pattern_cjs_1 = require("./pattern.cjs");
+const phase_entry_grammar_cjs_1 = require("./phase-entry-grammar.cjs");
+const install_manifest_record_cjs_1 = require("./install-manifest-record.cjs");
 const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 const security_cjs_1 = require("./security.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -835,6 +837,7 @@ function cmdEffortSync(cwd, raw, opts) {
     // cmdEffortSyncCodex and cmdEffortSyncOpencode, so a fault mid-write can
     // never leave an agent file truncated or empty.
     let fileFailureCount = 0;
+    const rewrittenFiles = [];
     for (const file of files) {
         const agentName = file.replace(/\.md$/, '');
         const filePath = node_path_1.default.join(agentsDir, file);
@@ -852,6 +855,8 @@ function cmdEffortSync(cwd, raw, opts) {
             fileFailureCount++;
             continue;
         }
+        // #5683: hash BEFORE any rewrite — only a GSD-owned file gets re-recorded.
+        const preHash = (0, install_manifest_record_cjs_1.tryFileHash)(filePath);
         // Resolve using install-time logic: home defaults merged with project config.
         const universalEffort = resolveInstallTimeEffort(effortCfg, agentName);
         // #3533 (10d): 'inherit' means the key must NOT exist. An absent key is
@@ -915,6 +920,7 @@ function cmdEffortSync(cwd, raw, opts) {
                     }
                     catch { /* non-fatal: proceed with default tmp-file mode */ }
                     (0, shell_command_projection_cjs_1.retryRenameSync)(tmpPathInherit, filePath);
+                    rewrittenFiles.push({ path: filePath, preHash });
                 }
                 catch {
                     try {
@@ -992,6 +998,7 @@ function cmdEffortSync(cwd, raw, opts) {
                 }
                 catch { /* non-fatal: proceed with default tmp-file mode */ }
                 (0, shell_command_projection_cjs_1.retryRenameSync)(tmpPathSet, filePath);
+                rewrittenFiles.push({ path: filePath, preHash });
             }
             catch {
                 try {
@@ -1006,6 +1013,9 @@ function cmdEffortSync(cwd, raw, opts) {
         changes.push({ agent: agentName, from: currentEffort, to: newEffortValue });
         synced++;
     }
+    // #5683: keep the install manifest in step with the agents just rewritten.
+    if (!dryRun)
+        (0, install_manifest_record_cjs_1.recordManifestFileHashes)(node_path_1.default.dirname(agentsDir), rewrittenFiles);
     output({ synced, skipped, changes, dry_run: dryRun, agents_dir: agentsDir }, raw, fileFailureCount > 0 ? 'failed' : synced > 0 ? 'changed' : 'ok');
 }
 /**
@@ -1048,6 +1058,7 @@ function cmdEffortSyncCodex(raw, dryRun, configDir) {
     const refused = [];
     const writeFailures = [];
     const readFailures = [];
+    const rewrittenFiles = [];
     let synced = 0;
     let skipped = 0;
     for (const file of files) {
@@ -1066,6 +1077,7 @@ function cmdEffortSyncCodex(raw, dryRun, configDir) {
             readFailures.push({ agent: agentName, file: filePath, error: err instanceof Error ? err.message : String(err) });
             continue;
         }
+        const preHash = (0, install_manifest_record_cjs_1.tryFileHash)(filePath); // #5683
         const parsed = (0, codex_agent_toml_cjs_1.parseCodexAgentToml)(content);
         if (!parsed.ok) {
             // Never partially rewritten (40-design.md, ADR-2313 reader/writer
@@ -1134,6 +1146,7 @@ function cmdEffortSyncCodex(raw, dryRun, configDir) {
                 }
                 catch { /* non-fatal: proceed with default tmp-file mode */ }
                 (0, shell_command_projection_cjs_1.retryRenameSync)(tmpPath, filePath);
+                rewrittenFiles.push({ path: filePath, preHash });
             }
             catch (err) {
                 // Reported, not thrown — the remaining agents still get processed.
@@ -1150,6 +1163,8 @@ function cmdEffortSyncCodex(raw, dryRun, configDir) {
         changes.push(...pendingChanges);
         synced++;
     }
+    if (!dryRun)
+        (0, install_manifest_record_cjs_1.recordManifestFileHashes)(node_path_1.default.dirname(agentsDir), rewrittenFiles);
     output({ synced, skipped, changes, dry_run: dryRun, agents_dir: agentsDir, refused, write_failures: writeFailures, read_failures: readFailures }, raw, writeFailures.length > 0 || readFailures.length > 0 ? 'failed' : synced > 0 ? 'changed' : 'ok');
 }
 /**
@@ -1198,6 +1213,7 @@ function cmdEffortSyncOpencode(cwd, raw, dryRun, configDir) {
     const changes = [];
     const writeFailures = [];
     const readFailures = [];
+    const rewrittenFiles = [];
     let synced = 0;
     let skipped = 0;
     for (const file of files) {
@@ -1216,6 +1232,7 @@ function cmdEffortSyncOpencode(cwd, raw, dryRun, configDir) {
             readFailures.push({ agent: agentName, file: filePath, error: err instanceof Error ? err.message : String(err) });
             continue;
         }
+        const preHash = (0, install_manifest_record_cjs_1.tryFileHash)(filePath); // #5683
         // `target === null` covers both "no effort configured" (inherit) and "a
         // level OpenCode does not accept" — both must produce NO `variant:` key,
         // exactly what install writes.
@@ -1312,6 +1329,7 @@ function cmdEffortSyncOpencode(cwd, raw, dryRun, configDir) {
                 }
                 catch { /* non-fatal: proceed with default tmp-file mode */ }
                 (0, shell_command_projection_cjs_1.retryRenameSync)(tmpPath, filePath);
+                rewrittenFiles.push({ path: filePath, preHash });
             }
             catch (err) {
                 try {
@@ -1340,6 +1358,8 @@ function cmdEffortSyncOpencode(cwd, raw, dryRun, configDir) {
     // Making the exit code reflect failure would be a CLI-contract change
     // affecting all three cmdEffortSync* branches (claude, codex, opencode) and
     // is out of scope for this fix.
+    if (!dryRun)
+        (0, install_manifest_record_cjs_1.recordManifestFileHashes)(node_path_1.default.dirname(agentsDir), rewrittenFiles);
     output({ synced, skipped, changes, dry_run: dryRun, agents_dir: agentsDir, write_failures: writeFailures, read_failures: readFailures }, raw, writeFailures.length > 0 || readFailures.length > 0 ? 'failed' : synced > 0 ? 'changed' : 'ok');
 }
 /**
@@ -1763,7 +1783,74 @@ function stageDeclaredRemovals(cwd, removedDeclared) {
     }
     return { removedEntries, removedPathspec, failures };
 }
-function cmdCommit(cwd, message, files, raw, amend, noVerify, filesRemoved) {
+/**
+ * #6043 (ADR-4908 §3): a committing verb commits in the checkout the process
+ * runs in. Returns the typed refusal when it cannot: not a git repository, or
+ * `cwd` / a path to commit resolves outside `ctx.worktreeRoot`.
+ * `cwd` and the worktree root are compared by realpath; a relative path is
+ * resolved lexically against the canonical `cwd`, so a `.planning` symlink
+ * inside the worktree stays inside; an absolute path is canonicalized through
+ * its nearest existing ancestor directory.
+ * A degraded context (git timed out or could not run) makes no claim about the
+ * worktree, so it never refuses.
+ */
+function commitRefusal(ctx, cwd, files, filesRemoved) {
+    if (ctx.provenance.reason === 'not_git_repo') {
+        return { reason: 'not_git_repo', message: `commit refused: ${cwd} is not inside a git repository` };
+    }
+    if (ctx.provenance.degraded)
+        return null;
+    const realOrSelf = (p) => {
+        try {
+            return node_fs_1.default.realpathSync.native(p);
+        }
+        catch {
+            return p;
+        }
+    };
+    // Nearest existing ancestor directory of an absolute path, realpath'd, with
+    // the not-yet-existing remainder re-appended (macOS /var <-> /private/var,
+    // Windows 8.3 short names like RUNNER~1).
+    const canonicalAbsolute = (abs) => {
+        const rest = [node_path_1.default.basename(abs)];
+        let ancestor = node_path_1.default.dirname(abs);
+        for (;;) {
+            try {
+                return node_path_1.default.join(node_fs_1.default.realpathSync.native(ancestor), ...rest);
+            }
+            catch {
+                const parent = node_path_1.default.dirname(ancestor);
+                if (parent === ancestor)
+                    return abs;
+                rest.unshift(node_path_1.default.basename(ancestor));
+                ancestor = parent;
+            }
+        }
+    };
+    const norm = (p) => {
+        const slashed = p.replace(/\\/g, '/');
+        return process.platform === 'win32' ? slashed.toLowerCase() : slashed;
+    };
+    const inside = (target, root) => (0, security_cjs_1.isContainedIn)(norm(target), norm(root), { sep: '/' });
+    const worktreeRoot = realOrSelf(node_path_1.default.resolve(ctx.worktreeRoot));
+    const realCwd = realOrSelf(node_path_1.default.resolve(cwd));
+    const declared = [...(files ?? []), ...(filesRemoved ?? [])];
+    const targets = declared.length > 0 ? declared : ['.planning/'];
+    // Lexical against the canonical cwd: a `.planning` symlink component is not followed.
+    const resolveTarget = (t) => node_path_1.default.isAbsolute(t) ? canonicalAbsolute(node_path_1.default.resolve(t)) : node_path_1.default.resolve(realCwd, t);
+    const escaping = !inside(realCwd, worktreeRoot)
+        ? realCwd
+        : targets.map(resolveTarget).find((abs) => !inside(abs, worktreeRoot));
+    if (escaping === undefined)
+        return null;
+    return {
+        reason: 'outside_worktree',
+        skipped: false,
+        message: `commit refused: ${escaping} is outside the worktree ${worktreeRoot}; ` +
+            'pass the checkout that owns the path with --project-dir to commit there',
+    };
+}
+function cmdCommit(cwd, message, files, raw, amend, noVerify, filesRemoved, ctx) {
     if (!message && !amend) {
         error('commit message required');
     }
@@ -1793,6 +1880,16 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify, filesRemoved) {
         output(result, raw, 'skipped');
         return;
     }
+    // #6043: refuse before branching or staging, and only AFTER the commit_docs
+    // skip above, so a benign skip is never turned into an error.
+    const refusal = ctx ? commitRefusal(ctx, cwd, files, filesRemoved) : null;
+    if (refusal) {
+        error(refusal.message, refusal.reason === 'not_git_repo' ? ERROR_REASON.COMMIT_NOT_GIT_REPO : ERROR_REASON.COMMIT_OUTSIDE_WORKTREE, {
+            committed: false,
+            ...(refusal.skipped === false ? { skipped: false } : {}),
+            hash: null,
+        });
+    }
     // Ensure branching strategy branch exists before first commit (#1278).
     // Pre-execution workflows (discuss, plan, research) commit artifacts but the branch
     // was previously only created during execute-phase — too late.
@@ -3518,7 +3615,7 @@ function cmdStats(cwd, format, raw) {
             phasesByNumber.set(key, {
                 number: key,
                 ...(displayId ? { display_id: displayId } : {}),
-                name: phaseName.replace(/\(INSERTED\)/i, '').trim(),
+                name: (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(phaseName),
                 plans: 0,
                 summaries: 0,
                 phaseStatus: phase_status_cjs_1.PHASE_STATUS.NOT_STARTED,

package/gsd-core/bin/lib/config-file-read.cjs

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * Config File Read — the single bounded reader for a project or workstream config.json (#5759)
+ *
+ * A config.json can be planted as a FIFO or device: a plain readFileSync opens it
+ * blocking and waits forever for a writer. Every read of a config.json in src/ goes through
+ * `readConfigFileBounded`, so the loader, the resolve-model omit check, and the many
+ * direct "read one key" helpers cannot diverge on how a non-regular or oversized file is treated.
+ *
+ * Leaf module: it imports only node:fs and ./capability-ledger.cjs (itself a node-builtins-only leaf), so
+ * planning-workspace, config-loader and every other reader can import it without a require cycle.
+ *
+ * Dependencies (leaf modules only):
+ *   - ./capability-ledger.cjs (readSmallRegularFile — non-blocking open, fstat regular-file check, size cap)
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const capabilityLedgerMod = require("./capability-ledger.cjs");
+const { readSmallRegularFile } = capabilityLedgerMod;
+/**
+ * Largest config.json any reader will read (#5759). Real configs are a few KB; 1 MiB
+ * is generous enough that no legitimate config is refused. A larger file is reported
+ * unusable (EFBIG) rather than read whole.
+ */
+const CONFIG_MAX_BYTES = 1024 * 1024;
+/**
+ * Read a config.json as a bounded regular file (#5759). Opens non-blocking and fstats the
+ * fd, so a FIFO or device with no writer is refused instead of blocking open(2) forever.
+ * Returns the UTF-8 text, or null when the file is absent (ENOENT); throws a LedgerIOError
+ * carrying `.code` (ENXIO FIFO/device, EISDIR directory, EFBIG over CONFIG_MAX_BYTES, or the
+ * errno) for every other condition.
+ */
+function readConfigFileBounded(filePath) {
+    return readSmallRegularFile(filePath, CONFIG_MAX_BYTES);
+}
+/**
+ * Why `absPath` — looked up on the REAL file system — must not be read blindly: it exists but is
+ * not a regular file (FIFO, device, socket, directory) or is larger than CONFIG_MAX_BYTES.
+ * Returns null when it is a regular file within the cap, and also when it cannot be stat'ed
+ * (absent, or not on the real file system at all, as with an installer fake-fs adapter), so the
+ * caller's own read decides. stat(2) follows links and never opens, so it cannot block. This is
+ * the guard for readers that must go through an injected fs seam and so cannot use
+ * `readConfigFileBounded`; it is a check-then-read, not the descriptor-bound read. Residual
+ * race: the install-fs adapter exposes `openSync`/`readSync` with string flags (no O_NONBLOCK)
+ * and no `fstatSync`, so the check cannot be bound to the descriptor that is read; a path
+ * swapped for a FIFO between this stat and the adapter's read can still block. Closing that
+ * needs `fstatSync` and numeric open flags on the adapter.
+ */
+function unboundedConfigFileReason(absPath) {
+    try {
+        const st = node_fs_1.default.statSync(absPath);
+        if (!st.isFile())
+            return 'not a regular file';
+        if (st.size > CONFIG_MAX_BYTES)
+            return `larger than ${CONFIG_MAX_BYTES} bytes`;
+    }
+    catch { /* absent or not on the real fs — the caller's read decides */ }
+    return null;
+}
+/**
+ * A path as printed to a terminal: C0 controls, DEL and C1 controls (general category Cc) become
+ * `\xNN`; every other format (Cf), line/paragraph separator (Zl, Zp) and lone-surrogate (Cs)
+ * character — zero-width and bidirectional controls, soft hyphen, tag characters — becomes
+ * `\uNNNN` (`\u{N...}` above the BMP). A directory
+ * name can carry ESC (or a C1 CSI), and a path written to stderr verbatim is a terminal-escape
+ * injection through that name.
+ */
+function printablePath(p) {
+    return p.replace(new RegExp('[\\p{Cc}\\p{Cf}\\p{Zl}\\p{Zp}\\p{Cs}]', 'gu'), (c) => {
+        const code = c.codePointAt(0);
+        const hex = code.toString(16).padStart(4, '0');
+        if (/\p{Cc}/u.test(c))
+            return `\\x${hex.slice(-2)}`; // C0, DEL, C1 (all <= 0xff)
+        return code > 0xffff ? `\\u{${hex}}` : `\\u${hex}`; // format, separator, lone surrogate
+    });
+}
+module.exports = {
+    CONFIG_MAX_BYTES,
+    readConfigFileBounded,
+    unboundedConfigFileReason,
+    printablePath,
+};

package/gsd-core/bin/lib/config-loader.cjs

@@ -17,7 +17,8 @@
  *   - ./unusable-input.cjs   (warnUnusableInput, UNUSABLE_REASON — #3760)
  *   - ./config-schema.cjs    (VALID_CONFIG_KEYS, DYNAMIC_KEY_PATTERNS)
  *   - ./planning-workspace.cjs (planningDir, planningRoot)
- *   - ./shell-command-projection.cjs (execGit, platformWriteSync, platformReadSync)
+ *   - ./shell-command-projection.cjs (execGit, platformWriteSync)
+ *   - ./config-file-read.cjs (CONFIG_MAX_BYTES, readConfigFileBounded — bounded regular-file read, #5759)
  *   - ./core-utils.cjs       (detectSubRepos)
  *   - ./model-catalog.cjs    (KNOWN_RUNTIMES, KNOWN_PROVIDERS, ADAPTIVE_TIER_VALUES)
  */
@@ -27,6 +28,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const configFileReadMod = require("./config-file-read.cjs");
+const { CONFIG_MAX_BYTES, readConfigFileBounded, printablePath } = configFileReadMod;
 // #4717: runtime-identity fill — env rung + per-install marker rung.
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
@@ -533,15 +537,19 @@ const CONFIG_REASON = Object.freeze({
     /** The file exists but could not be read (EACCES/EIO/…) — NOT applied. */
     CONFIG_UNREADABLE: 'config_unreadable',
 });
+// CONFIG_MAX_BYTES and readConfigFileBounded live in ./config-file-read.cjs (#5759), the leaf
+// every config.json reader shares; they are re-exported below for existing importers.
 /**
  * Read + JSON-parse a config file, keeping *absent* distinguishable from
- * *unusable*. `platformReadSync` returns null on ENOENT and re-throws every
- * other errno, which is the seam that makes this separable at all.
+ * *unusable*. `readConfigFileBounded` returns null on ENOENT and throws an error
+ * carrying `.code` for every other condition — a FIFO/device (ENXIO), a directory
+ * (EISDIR), an oversized file (EFBIG) or an errno — which is the seam that makes
+ * this separable at all.
  */
 function _readConfigFile(filePath) {
     let raw;
     try {
-        raw = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);
+        raw = readConfigFileBounded(filePath);
     }
     catch (err) {
         const code = err.code ?? 'EUNKNOWN';
@@ -573,14 +581,7 @@ function _readConfigFile(filePath) {
  * genuine second failure in a different file.
  */
 const _warnedUnusableConfig = new Set();
-/**
- * The wiring clause (ADR-1411 amendment). `reason` lives on `ConfigResolution`,
- * but `loadConfig` — the wrapper roughly fifty call sites use — returns
- * `.config` alone and would never surface it. Without this diagnostic the field
- * is unreachable to almost every consumer, and the user whose config was
- * silently discarded still gets no signal. That was the whole defect in #1880.
- */
-function _warnUnusableConfig(fault) {
+function _warnUnusableConfig(fault, fallback = 'defaults') {
     // The NUL separators are load-bearing: without them `path`+`reason`+`code` is bare
     // concatenation and two distinct faults can key alike. They are written as escapes rather
     // than literal 0x00 bytes because a literal NUL makes the whole file binary to file(1) and
@@ -594,7 +595,10 @@ function _warnUnusableConfig(fault) {
     const what = fault.reason === CONFIG_REASON.CONFIG_UNPARSEABLE
         ? 'is not valid JSON'
         : `could not be read (${fault.code})`;
-    process.stderr.write(`gsd-tools: warning: ${fault.path} ${what} — its settings were NOT applied; using defaults instead\n`);
+    const instead = fallback === 'root' ? '; using the root config instead'
+        : fallback === 'defaults' ? '; using defaults instead'
+            : '';
+    process.stderr.write(`gsd-tools: warning: ${printablePath(fault.path)} ${what} — its settings were NOT applied${instead}\n`);
 }
 /**
  * loadConfigResolved — provenance-aware config loading (#1415, ADR-1411 P2).
@@ -677,7 +681,8 @@ function loadConfigResolvedInternal(cwd, options = {}) {
             const rootRead = _readConfigFile(rootConfigPath);
             if (rootRead.kind === 'fault') {
                 configFault = rootRead.fault;
-                _warnUnusableConfig(rootRead.fault);
+                // The workstream config below may still apply, so no replacement is claimed.
+                _warnUnusableConfig(rootRead.fault, null);
             }
             if (rootRead.kind !== 'ok')
                 throw new Error('root config absent or unusable');
@@ -730,7 +735,8 @@ function loadConfigResolvedInternal(cwd, options = {}) {
             // The workstream/root config that ACTUALLY governs this resolution is
             // unusable. This outranks any earlier root-config fault for reporting.
             configFault = read.fault;
-            _warnUnusableConfig(read.fault);
+            // With a workstream active and a usable root config, the root config is what applies.
+            _warnUnusableConfig(read.fault, ws && rootParsed ? 'root' : 'defaults');
         }
         if (read.kind !== 'ok')
             throw new Error('config absent or unusable');
@@ -1135,6 +1141,8 @@ module.exports = {
     loadConfig,
     loadConfigResolved,
     CONFIG_REASON,
+    CONFIG_MAX_BYTES,
+    readConfigFileBounded,
     _warnedUnusableConfig,
     isGitIgnored,
     CONFIG_DEFAULTS,