@opengsd/gsd-core 1.20.0 → 1.21.0

package/hooks/dist/lib/isolation-sentinel.js

@@ -29,6 +29,12 @@
 // of the same repo are separate directories on disk, so each gets its own
 // sentinel with no cross-worktree collision, no lock file needed.
 //
+// #5682: the single slot above is last-writer-wins, so two orchestrators sharing one checkout
+// overwrote each other's decision and the guard discarded the foreign record. The writer now ALSO
+// records each plan-scoped decision at `<cwd>/.gsd/dispatch-isolation/<phase>--<plan>.json`
+// (same payload, same cwd-derived location and forgery posture), and `readSentinel` consults the
+// record keyed by the dispatch's own phase/plan first, falling back to the single slot.
+//
 // #3045 SECURITY F3 (LOW, accepted risk — documented, not redesigned for):
 // the sentinel lives at a fixed, predictable, gitignored path inside the
 // PRIMARY checkout. An agent already running inside a legitimately isolated
@@ -64,6 +70,35 @@ const VALID_ISOLATION = new Set(['harness-worktree', 'orchestrator-worktree', 'n
 
 const SENTINEL_RELATIVE_PATH = path.join('.gsd', 'dispatch-isolation-sentinel.json');
 
+// #5682: per-dispatch records, one file per `<phase>--<plan>` under this directory.
+const KEYED_SENTINEL_DIR = path.join('.gsd', 'dispatch-isolation');
+const SAFE_SENTINEL_KEY_RE = /^[A-Za-z0-9._-]{1,100}$/;
+
+// #5758: a real sentinel payload is under 300 bytes. Anything larger is not one, and the cap bounds
+// the read so a hostile or runaway record cannot be pulled into the hook.
+const SENTINEL_MAX_BYTES = 4096;
+
+/** #5682: strict allow-list for a phase/plan string that becomes a path segment. */
+function isSafeSentinelKey(s) {
+  return typeof s === 'string' && SAFE_SENTINEL_KEY_RE.test(s) && s !== '.' && s !== '..';
+}
+
+/** #5682: keyed record path for a dispatch, or null unless BOTH phase and plan are safe keys. */
+function keyedSentinelPath(root, phase, plan) {
+  if (!isSafeSentinelKey(phase) || !isSafeSentinelKey(plan)) return null;
+  return path.join(root, KEYED_SENTINEL_DIR, `${phase}--${plan}.json`);
+}
+
+/**
+ * #5682: phase-level keyed record path (`<phase>.json`, written when a decision carries no plan),
+ * or null unless the phase is a safe key. Two orchestrators recording plan-less decisions for
+ * different phases each keep their own file.
+ */
+function phaseSentinelPath(root, phase) {
+  if (!isSafeSentinelKey(phase)) return null;
+  return path.join(root, KEYED_SENTINEL_DIR, `${phase}.json`);
+}
+
 // #3045 SECURITY F2 fix: how long a written sentinel is trusted as "this
 // dispatch's decision" before a reader falls back to the conservative
 // registry+config check.
@@ -103,10 +138,10 @@ function sentinelPath(cwd) {
 /**
  * Resolve the project root a sentinel should be read from/written to, using
  * the SAME derivation gsd-tools.cjs's dispatcher applies to every `--cwd`
- * before invoking a route handler: `findProjectRoot(resolveMainWorktreeCwd(cwd))`
- * (gsd-core/bin/gsd-tools.cjs main(), :3506/:3603 — `record-dispatch-isolation`
- * and `dispatch-isolation` are not in SKIP_ROOT_RESOLUTION, so every write
- * goes through both steps).
+ * before invoking a route handler: `resolveProjectContext(cwd).projectRoot`
+ * (gsd-core/bin/gsd-tools.cjs main() — `record-dispatch-isolation` and
+ * `dispatch-isolation` are not in SKIP_ROOT_RESOLUTION, so every write goes
+ * through it).
  *
  * #3045 MINOR fix: the guard hooks previously read the sentinel from the raw
  * `data.cwd` / `workspace_roots[i]` the harness reports, with NO equivalent
@@ -119,7 +154,7 @@ function sentinelPath(cwd) {
  * written where it looked. Deriving both sides through this one function
  * closes that divergence.
  *
- * `findProjectRoot`/`resolveWorktreeRoot` are read from the sibling
+ * `resolveProjectContext` is read from the sibling
  * `gsd-core/bin/lib/*.cjs` modules staged alongside these hooks at install
  * time (same pattern the guard hooks already use for
  * capability-registry.cjs/runtime-name-policy.cjs) — two directories up from
@@ -145,10 +180,10 @@ function resolveSentinelRoot(cwd) {
     // cold-tree encounter.
     const { ensureRuntimeBuild } = require('../../gsd-core/bin/ensure-runtime-build.cjs');
     ensureRuntimeBuild();
-    const { resolveWorktreeRoot } = require('../../gsd-core/bin/lib/worktree-safety.cjs');
-    const { root } = resolveWorktreeRoot(cwd);
-    const { findProjectRoot } = require('../../gsd-core/bin/lib/project-root.cjs');
-    return findProjectRoot(root);
+    // #6043 (ADR-4908): the dispatcher resolves non-skip commands through the
+    // same seam, so the reader looks where the writer wrote.
+    const { resolveProjectContext } = require('../../gsd-core/bin/lib/project-context.cjs');
+    return resolveProjectContext(cwd).projectRoot;
   } catch {
     return cwd;
   }
@@ -174,14 +209,129 @@ function resolveSentinelRoot(cwd) {
  * per the repo's clock-seam convention, so staleness is testable without
  * asserting on wall-clock time.
  */
-function readSentinel(cwd, { clock = Date } = {}) {
+function readSentinel(cwd, { clock = Date, dispatchIds = null } = {}) {
   const root = resolveSentinelRoot(cwd);
-  let raw;
+
+  // #5682: candidates are the record keyed by this dispatch's own phase/plan, the phase-level
+  // record for its phase, and the single legacy slot. A keyed candidate counts only when it is
+  // well-formed and its contents agree with its own filename key; the legacy slot only when it
+  // applies to this dispatch. Among FRESH candidates the latest `writtenAt` wins, so a newer
+  // phase-level decision is not shadowed by an older plan-scoped one (and vice versa).
+  const gsdDir = path.join(root, '.gsd');
+  const keyedDirs = [gsdDir, path.join(root, KEYED_SENTINEL_DIR)];
+  const keyedCandidates = [];
+  if (dispatchIds) {
+    const planFile = keyedSentinelPath(root, dispatchIds.phase, dispatchIds.plan);
+    if (planFile) {
+      const c = parseSentinelFile(planFile, clock, keyedDirs);
+      if (c.present && !c.malformed && c.phase === dispatchIds.phase && c.plan === dispatchIds.plan) keyedCandidates.push(c);
+    }
+    const phaseFile = phaseSentinelPath(root, dispatchIds.phase);
+    if (phaseFile) {
+      const c = parseSentinelFile(phaseFile, clock, keyedDirs);
+      if (c.present && !c.malformed && c.phase === dispatchIds.phase && c.plan === null) keyedCandidates.push(c);
+    }
+  }
+
+  const legacy = parseSentinelFile(sentinelPath(root), clock, [gsdDir]);
+  const legacyApplies = legacy.present && !legacy.malformed && sentinelAppliesToDispatch(legacy, dispatchIds);
+
+  const fresh = keyedCandidates.filter((c) => !c.stale);
+  if (legacyApplies && !legacy.stale) fresh.push(legacy);
+  if (fresh.length > 0) return latestWritten(fresh);
+
+  // Nothing fresh: a stale keyed record still feeds the aged-none path; otherwise the legacy
+  // slot is returned exactly as before.
+  if (keyedCandidates.length > 0) return latestWritten(keyedCandidates);
+  return legacy;
+}
+
+/** The candidate with the greatest `writtenAt` (ties keep the earlier-listed, i.e. most specific). */
+function latestWritten(candidates) {
+  return candidates.reduce((best, c) => (c.writtenAt > best.writtenAt ? c : best));
+}
+
+/**
+ * lstat of `dir` when it is a real directory, not a link (lstat does not follow); otherwise null.
+ * Never throws.
+ */
+function lstatRealDirectory(dir) {
   try {
-    raw = fs.readFileSync(sentinelPath(root), 'utf-8');
+    // bigint: an NTFS file id is 64 bits and a JS number keeps 53, so ids are compared exactly.
+    const st = fs.lstatSync(dir, { bigint: true });
+    return st.isDirectory() && !st.isSymbolicLink() ? st : null;
   } catch {
-    return { present: false };
+    return null;
+  }
+}
+
+/** Same filesystem object: equal dev and ino. A zero ino (some Windows volumes) cannot be compared. */
+function sameObject(a, b) {
+  return a.ino === 0n || b.ino === 0n || (a.dev === b.dev && a.ino === b.ino);
+}
+
+/**
+ * #5758: read one sentinel file as a bounded, non-blocking, link-refusing read of a regular file.
+ * Returns the text, or null for EVERY refusal (missing, link, FIFO, device, directory, oversized,
+ * short read, a hard link to another file, a parent directory that is a link), so a hostile record
+ * is exactly as absent as a missing one. `readFileSync` would block forever on a FIFO with no
+ * writer, follow a link to an endless device or to a file outside the project, and read without
+ * bound. The writers only ever produce a fresh temp file renamed into place (link count 1). A
+ * sentinel renamed over between the open and the fstat reads as nlink 0 and is refused for that one
+ * dispatch, which is the conservative no-sentinel decision.
+ *
+ * Parent directories are lstat-checked before the open and re-checked (same dev/ino, still a real
+ * directory) after it, and the opened file must be the object the pre-open lstat saw. Node has no
+ * openat, so this NARROWS the window for a parent swapped to a link between check and open; it does
+ * not close it.
+ */
+function readSentinelText(file, parentDirs) {
+  const parents = [];
+  for (const dir of parentDirs) {
+    const st = lstatRealDirectory(dir);
+    if (!st) return null;
+    parents.push({ dir, st });
   }
+  let fd;
+  try {
+    const before = fs.lstatSync(file, { bigint: true });
+    if (!before.isFile() || before.size > BigInt(SENTINEL_MAX_BYTES)) return null;
+    // O_NONBLOCK makes an open of a FIFO swapped in after the lstat return at once; O_NOFOLLOW
+    // refuses a link swapped in. Windows lacks both flags (`|| 0`); lstat/fstat still guard.
+    fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0));
+    const st = fs.fstatSync(fd, { bigint: true });
+    if (!st.isFile() || st.nlink !== 1n || st.size > BigInt(SENTINEL_MAX_BYTES)) return null;
+    if (!sameObject(before, st)) return null;
+    const size = Number(st.size);
+    for (const p of parents) {
+      const after = lstatRealDirectory(p.dir);
+      if (!after || !sameObject(p.st, after)) return null;
+    }
+    const buf = Buffer.alloc(size);
+    let offset = 0;
+    while (offset < size) {
+      const n = fs.readSync(fd, buf, offset, size - offset, offset);
+      if (n === 0) return null;
+      offset += n;
+    }
+    return buf.toString('utf-8');
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* nothing left to release */ }
+    }
+  }
+}
+
+/**
+ * Parse and validate one sentinel file. Never throws. Shape: see `readSentinel`.
+ * `parentDirs` are the directories between the project root and the file that must be real
+ * directories (not links); a refusal anywhere reads as `{ present: false }`.
+ */
+function parseSentinelFile(file, clock, parentDirs = []) {
+  const raw = readSentinelText(file, parentDirs);
+  if (raw === null) return { present: false };
 
   let parsed;
   try {
@@ -348,7 +498,12 @@ function buildSentinelDiscard(sentinel, dispatchIds) {
 module.exports = {
   VALID_ISOLATION,
   SENTINEL_RELATIVE_PATH,
+  KEYED_SENTINEL_DIR,
+  isSafeSentinelKey,
+  keyedSentinelPath,
+  phaseSentinelPath,
   SENTINEL_STALE_MS,
+  SENTINEL_MAX_BYTES,
   AGED_NONE_MAX_MS,
   sentinelPath,
   resolveSentinelRoot,

package/hooks/dist/lib/secret-read-exemptions.js

@@ -0,0 +1,161 @@
+// gsd-hook-version: {{GSD_VERSION}}
+// Project exemptions for the secret-read guard (#4432).
+//
+// A project lists repo-relative files under `hooks.secret_read_exempt` in the
+// ROOT `.planning/config.json`. A listed file stays readable only when it is
+// BOTH a regular file in the working tree (lstat, so a symlink never counts)
+// AND a regular blob (100644/100755) in the commit HEAD names. Config alone is
+// not the key: an agent that can write the config must not be able to unlock a
+// real secret that was never committed.
+//
+// The committed-file check reads `.git` directly (./git-head-tree.js): no
+// subprocess and no timer, so the verdict depends only on the repository's
+// bytes. Every failure means "not exempt"; nothing in this module throws.
+//
+// Standalone on purpose: hooks are installed as loose files and cannot require
+// `src/`. The entry rules are duplicated in `src/config.cts`
+// (`normalizeSecretReadExemptEntry`, used by config-set); tests/
+// secret-read-exemptions.test.cjs drives one corpus through both so they
+// cannot diverge.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { headTreeEntry } = require('./git-head-tree.js');
+
+const REGULAR_BLOB_MODES = new Set(['100644', '100755']);
+
+/**
+ * Normalize one config entry to a POSIX repo-relative file path, or null.
+ * `\` becomes `/` unconditionally; nothing is trimmed (whitespace is part of a
+ * name). Rejected: non-strings, absolute and UNC paths, drive prefixes, NUL, any
+ * `..` segment, a directory (trailing `/`), and `.`.
+ * @param {unknown} entry
+ * @returns {string | null}
+ */
+function normalizeExemptEntry(entry) {
+  if (typeof entry !== 'string') return null;
+  let s = entry.replace(/\\/g, '/');
+  while (s.startsWith('./')) s = s.slice(2);
+  if (s === '' || s === '.') return null;
+  if (s.startsWith('/') || s.endsWith('/')) return null;
+  if (/^[A-Za-z]:/.test(s)) return null;
+  if (s.includes('\0')) return null;
+  if (s.split('/').includes('..')) return null;
+  return s;
+}
+
+/**
+ * The normalized, de-duplicated `hooks.secret_read_exempt` entries of
+ * `<root>/.planning/config.json`. Anything unreadable or malformed yields [].
+ * @param {string} root
+ * @param {{ readFile?: (file: string, encoding: string) => string }} [deps]
+ * @returns {string[]}
+ */
+function readExemptEntries(root, { readFile = fs.readFileSync } = {}) {
+  let config;
+  try {
+    config = JSON.parse(readFile(path.join(root, '.planning', 'config.json'), 'utf8'));
+  } catch {
+    return [];
+  }
+  if (config === null || typeof config !== 'object' || Array.isArray(config)) return [];
+  const hooks = config.hooks;
+  if (hooks === null || typeof hooks !== 'object' || Array.isArray(hooks)) return [];
+  const list = hooks.secret_read_exempt;
+  if (!Array.isArray(list)) return [];
+  const out = [];
+  for (const raw of list) {
+    const entry = normalizeExemptEntry(raw);
+    if (entry !== null && !out.includes(entry)) out.push(entry);
+  }
+  return out;
+}
+
+/**
+ * True when HEAD holds `entry` (relative to `root`) as a regular blob.
+ * @param {string} root
+ * @param {string} entry
+ * @returns {boolean}
+ */
+function isCommittedBlob(root, entry) {
+  const found = headTreeEntry(root, entry);
+  return found !== null && REGULAR_BLOB_MODES.has(found.mode);
+}
+
+/**
+ * True when `abs` is a regular file (lstat: a symlink is not). When `root` and
+ * `entry` are given, the real path of `abs` must also equal the real root joined
+ * with `entry`, so a symlinked PARENT directory (which lstat of the leaf does
+ * not see) is never exempt. A realpath failure means "not a match".
+ * @param {string} abs
+ * @param {string} [root]
+ * @param {string} [entry]
+ * @returns {boolean}
+ */
+function isRegularFile(abs, root, entry) {
+  try {
+    if (!fs.lstatSync(abs).isFile()) return false;
+    if (typeof root !== 'string' || typeof entry !== 'string') return true;
+    const fold = process.platform === 'win32' ? (s) => s.toLowerCase() : (s) => s;
+    // .native: canonical long form on Windows (see sameRealPath in git-head-tree.js).
+    return fold(fs.realpathSync.native(abs)) === fold(path.join(fs.realpathSync.native(root), entry));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Build the per-invocation checker. Pure apart from the two injected probes,
+ * which are memoized per entry. A probe that throws means "not exempt".
+ * @returns {(token: unknown) => boolean}
+ */
+function createExemptionChecker({
+  root,
+  entries,
+  allowRelative = false,
+  platform = process.platform,
+  isCommittedBlob: committed = isCommittedBlob,
+  isRegularFile: regular = isRegularFile,
+}) {
+  const fold = platform === 'win32' ? (s) => s.toLowerCase() : (s) => s;
+  const targets = [];
+  for (const entry of Array.isArray(entries) ? entries : []) {
+    if (typeof entry === 'string' && entry !== '') targets.push({ entry, target: fold(path.resolve(root, entry)) });
+  }
+  const verdicts = new Map();
+
+  function verdictFor(entry) {
+    if (verdicts.has(entry)) return verdicts.get(entry);
+    let ok = false;
+    try {
+      ok = regular(path.resolve(root, entry), root, entry) === true && committed(root, entry) === true;
+    } catch {
+      ok = false;
+    }
+    verdicts.set(entry, ok);
+    return ok;
+  }
+
+  return function isExempt(token) {
+    if (typeof token !== 'string' || token === '' || targets.length === 0) return false;
+    if (!allowRelative && !path.isAbsolute(token)) return false;
+    // path.resolve would collapse `<symlinkdir>/../x` lexically while the OS
+    // reads through the link, so a `..` segment is refused before resolving.
+    if (token.split(/[\\/]/).includes('..')) return false;
+    const resolved = fold(path.resolve(root, token));
+    for (const { entry, target } of targets) {
+      if (resolved === target) return verdictFor(entry);
+    }
+    return false;
+  };
+}
+
+module.exports = {
+  normalizeExemptEntry,
+  readExemptEntries,
+  createExemptionChecker,
+  isCommittedBlob,
+  isRegularFile,
+};

package/hooks/gsd-agent-isolation-guard.js

@@ -74,6 +74,7 @@ const os = require('os');
 const { readSentinel, VALID_ISOLATION, extractDispatchIdentifiers, sentinelAppliesToDispatch, agedNoneGovernsDispatch, buildSentinelDiscard } = require('./lib/isolation-sentinel.js');
 const { REASON_CODE, describeSentinelDiscard } = require('./lib/isolation-deny-reason.js');
 const { HOOK_ON_CRASH, allow, deny, crash } = require('./lib/hook-exit.js');
+const { readConfigFileBounded } = require('./lib/config-read.js');
 
 // Required at module top, alongside the other ./lib requires — NOT behind
 // ensureRuntimeBuild() below. Terminating on a parse/timeout failure must
@@ -208,7 +209,7 @@ function resolveRuntimeIdentity(cwd, configPath, resolveRuntimeNameFromCandidate
   // A throw here (corrupt JSON, EISDIR, permission error) propagates to the
   // caller's catch as a resolution failure — this function only decides
   // "confident vs not", never resolution failure.
-  const raw = fs.readFileSync(configPath, 'utf-8');
+  const raw = readConfigFileBounded(configPath, { required: true });
   const parsed = JSON.parse(raw);
   if (parsed && typeof parsed === 'object' && 'runtime' in parsed) {
     const configRuntime = resolveRuntimeNameFromCandidates(parsed.runtime);
@@ -331,7 +332,7 @@ function resolveRegistryIsolation(cwd, configPath) {
     }
     if (!ladderAnswered) {
       try {
-        const raw = fs.readFileSync(configPath, 'utf-8');
+        const raw = readConfigFileBounded(configPath, { required: true });
         const parsedCfg = JSON.parse(raw);
         if (parsedCfg && typeof parsedCfg === 'object' && parsedCfg.workflow &&
             typeof parsedCfg.workflow === 'object' && parsedCfg.workflow.use_worktrees === false) {
@@ -422,7 +423,7 @@ function resolveIsolationState(cwd, { clock = Date, dispatchIds = null } = {}) {
     return { gsdProject: false, isolation: null, harnessFlag: null, error: null, sentinelDiscarded: null };
   }
 
-  const sentinel = readSentinel(cwd, { clock });
+  const sentinel = readSentinel(cwd, { clock, dispatchIds });
   // Hoisted so the "sentinel was present/fresh but did not apply" case below
   // (#4594 row 15 — Postel's-Law finding) can distinguish itself from
   // "absent"/"stale" without re-deriving applicability.

package/hooks/gsd-config-reload.js

@@ -18,9 +18,9 @@
 // Enabled for all Claude Code installs. This hook is always-on — it is a
 // no-op when .planning/config.json is absent (ENOENT → exit 0).
 
-const fs = require('fs');
 const path = require('path');
 const { HOOK_ON_CRASH, allow, crash } = require('./lib/hook-exit.js');
+const { readConfigFileBounded } = require('./lib/config-read.js');
 
 // This hook only injects an advisory config-reload summary; a crash mid-parse
 // must not block the session or the FileChanged event that triggered it — the
@@ -70,7 +70,7 @@ process.stdin.on('end', () => {
     // Read the updated config file
     let config;
     try {
-      const raw = fs.readFileSync(filePath, 'utf8');
+      const raw = readConfigFileBounded(filePath, { required: true });
       config = JSON.parse(raw);
     } catch (e) {
       if (e && e.code === 'ENOENT') allow(undefined);

package/hooks/gsd-context-monitor.js

@@ -28,6 +28,7 @@ const os = require('os');
 const path = require('path');
 const { spawn } = require('child_process');
 const { HOOK_ON_CRASH, allow, crash } = require('./lib/hook-exit.js');
+const { readConfigFileBounded } = require('./lib/config-read.js');
 
 // This hook only injects an advisory context-usage warning; it never blocks
 // the tool call it rides in on. A crash here (e.g. a malformed bridge file)
@@ -334,7 +335,7 @@ const handleStdinEnd = () => {
     let thresholds = { warning: WARNING_THRESHOLD, critical: CRITICAL_THRESHOLD };
     try {
       const configPath = path.join(cwd, '.planning', 'config.json');
-      const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      const config = JSON.parse(readConfigFileBounded(configPath, { required: true }));
       if (config.hooks?.context_warnings === false) {
         allow(undefined);
       }

package/hooks/gsd-cursor-subagent-start.js

@@ -65,6 +65,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { allow } = require('./lib/hook-exit.js');
+const { readConfigFileBounded } = require('./lib/config-read.js');
 
 // Workspace resolution is shared across the Cursor hooks (#2587) — see
 // hooks/lib/cursor-workspace.js. Staged next to these scripts by
@@ -133,12 +134,12 @@ function realpathOrNull(p, realpathFn) {
  * i.e. `~/.cursor/worktrees` by default — `getGlobalConfigDir('cursor')`
  * honors the `CURSOR_CONFIG_DIR` env override and `~` expansion for free).
  * That is made NECESSARY AND SUFFICIENT below. Do NOT reinstate
- * `resolveWorktreeLinkage`'s `linked_worktree_root` mode as an alternative
+ * a linked-worktree result of `resolveProjectContext` as an alternative
  * OR'd proof of isolation — that is precisely the bypass finding 3 closed;
  * a future "simplification" that merges it back in re-opens unconsented
  * writes to the human's active checkout.
  *
- * `resolveWorktreeLinkage` is still called, but ONLY as a diagnostic: it
+ * `resolveProjectContext` is still called, but ONLY as a diagnostic: its provenance
  * distinguishes "confidently not isolated" from "git could not answer
  * (timeout) — cannot determine" so the eventual deny reason stays
  * actionable. Its result never flips `isolated`.
@@ -195,8 +196,10 @@ function resolveIsolationEvidence(root, { realpath = fs.realpathSync } = {}) {
   let linkageReason = null;
   try {
     // Sibling data/policy module, staged alongside this hook at install time.
-    const { resolveWorktreeLinkage } = require('../gsd-core/bin/lib/worktree-safety.cjs');
-    linkageReason = resolveWorktreeLinkage(root).reason;
+    const { resolveProjectContext } = require('../gsd-core/bin/lib/project-context.cjs');
+    const gitProvenance = resolveProjectContext(root).provenance;
+    // A degraded context (git timed out or could not run) is "cannot determine".
+    linkageReason = gitProvenance.degraded ? 'git_timed_out' : gitProvenance.reason;
   } catch {
     linkageReason = null;
   }
@@ -421,7 +424,7 @@ function resolveFallbackIsolation(root, configPath) {
   const { runtimes } = require('../gsd-core/bin/lib/capability-registry.cjs');
 
   let runtimeId = resolveRuntimeNameFromCandidates(process.env.GSD_RUNTIME);
-  const rawConfig = fs.readFileSync(configPath, 'utf-8');
+  const rawConfig = readConfigFileBounded(configPath, { required: true });
   const parsedConfig = JSON.parse(rawConfig);
   if (!runtimeId && parsedConfig && typeof parsedConfig === 'object' && 'runtime' in parsedConfig) {
     runtimeId = resolveRuntimeNameFromCandidates(parsedConfig.runtime) || null;
@@ -512,7 +515,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
   // Hoisted (readSentinel never throws) so the "present, fresh, but did not
   // apply" case (#4594 row 15) can be reported on every deny path below
   // instead of silently discarded.
-  const sentinel = readSentinel(root, { clock });
+  const sentinel = readSentinel(root, { clock, dispatchIds });
   const applies = sentinelAppliesToDispatch(sentinel, dispatchIds);
   const sentinelDiscarded = buildSentinelDiscard(sentinel, dispatchIds);
 

package/hooks/gsd-read-injection-scanner.js

@@ -22,8 +22,8 @@
 // hook source files — these legitimately contain injection-like strings.
 
 const path = require('path');
-const fs = require('fs');
 const { HOOK_ON_CRASH, allow, crash } = require('./lib/hook-exit.js');
+const { readConfigFileBounded } = require('./lib/config-read.js');
 
 // This is a PostToolUse advisory scanner over content the tool call already
 // returned; a crash while scanning must not retroactively block that Read/
@@ -343,7 +343,7 @@ process.stdin.on('end', () => {
       try {
         const cfgBase = data.cwd || process.cwd();
         const cfgPath = path.join(cfgBase, '.planning', 'config.json');
-        const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+        const cfg = JSON.parse(readConfigFileBounded(cfgPath, { required: true }));
         blocking = cfg.security?.injection_blocking === true;
       } catch { /* no config ⇒ advisory */ }
     }