@opengsd/gsd-core 1.20.1 → 1.21.0

package/gsd-core/bin/lib/gate-phase-context.cjs

@@ -31,7 +31,7 @@ const gate_verdict_cjs_1 = require("./gate-verdict.cjs");
 const gate_evidence_cjs_1 = require("./gate-evidence.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspaceMod = require("./planning-workspace.cjs");
-const { planningDir } = planningWorkspaceMod;
+const { planningDir, planningRoot } = planningWorkspaceMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseLocatorMod = require("./phase-locator.cjs");
 const { phaseDirectoryOptions, findPhaseInternal, resolvePhaseDirectoryLookup, matchPhaseDirsForLookup } = phaseLocatorMod;
@@ -40,12 +40,24 @@ const roadmapModule = require("./roadmap.cjs");
 const { getRoadmapPhaseWithFallback } = roadmapModule;
 /**
  * Resolve a caller-supplied path (absolute, or relative to `projectDir`) and require the result to
- * stay inside `projectDir` (realpath containment, ADR-4650). Returns the contained path the
- * predicate produced, or a `GateUsageFailure` (`usage`, `path escapes its allowed directory: <arg>`).
+ * stay inside `projectDir` or inside the realpath of the project's OWN `.planning` (#5474: it may be
+ * a symlink to an out-of-repo store, so its phases realpath outside `projectDir`; ADR-5057 "Two
+ * containment roots"). Both decisions go through `tryWithinRoot` (realpath containment, ADR-4650);
+ * a symlink inside the store that leaves it, `..` traversal and a name-prefix sibling of the store
+ * still fail both. Returns the contained path the predicate produced, or a `GateUsageFailure`
+ * (`usage`, `path escapes its allowed directory: <arg>`).
+ *
+ * Trust assumption: the `.planning` link is trusted like the rest of the project tree. Whatever it
+ * resolves to becomes a containment root, so a `.planning` linked to a broad directory (a home
+ * directory, `/etc`) makes every path under that directory contained. This is accepted by design
+ * (#5474 scope): the link is part of the checkout the user chose to run gates on, and the gates
+ * read paths, they do not grant access the user's own shell lacks. Only the project's own
+ * `.planning` is honoured; any other symlink target is still refused.
  */
 function resolveContainedPath(inputPath, projectDir) {
     const candidate = node_path_1.default.isAbsolute(inputPath) ? inputPath : node_path_1.default.join(projectDir, inputPath);
-    const contained = (0, security_cjs_1.tryWithinRoot)(candidate, projectDir, security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
+    const contained = (0, security_cjs_1.tryWithinRoot)(candidate, projectDir, security_cjs_1.PathAcceptance.AbsoluteInsideRoot) ??
+        (0, security_cjs_1.tryWithinRoot)(candidate, planningRoot(projectDir), security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
     if (contained === null) {
         return (0, gate_verdict_cjs_1.gateUsageFailure)(gate_verdict_cjs_1.GATE_FAILURE_CODE.USAGE, `path escapes its allowed directory: ${inputPath}`);
     }

package/gsd-core/bin/lib/graphify.cjs

@@ -14,6 +14,9 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- config-file-read.cjs is an export= CommonJS module
+const configFileReadMod = require("./config-file-read.cjs");
+const { readConfigFileBounded } = configFileReadMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityStateMod = require("./capability-state.cjs");
 const { isCapabilityActive } = capabilityStateMod;
@@ -175,6 +178,20 @@ function safeReadJson(filePath) {
         return null;
     }
 }
+/**
+ * Safely read and parse `<planningDir>/config.json` as a bounded regular file (#5759). Returns
+ * null on a missing, non-regular (FIFO/device), oversized, unreadable or malformed file — never
+ * blocks. Not `safeReadJson`: that reader is for graph artifacts and opens blocking.
+ */
+function safeReadConfigJson(planningDir) {
+    try {
+        const raw = readConfigFileBounded(node_path_1.default.join(planningDir, 'config.json'));
+        return raw === null ? null : JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Build a bidirectional adjacency map from graph nodes and edges.
  * Each node ID maps to an array of { target, edge } entries.
@@ -390,7 +407,7 @@ const SNAPSHOT_FILENAME = '.last-build-snapshot.json';
  * default `<planningDir>/graphs/graph.json` when unset/blank/non-string.
  */
 function resolveGraphLocation(cwd, planningDir) {
-    const config = safeReadJson(node_path_1.default.join(planningDir, 'config.json'));
+    const config = safeReadConfigJson(planningDir);
     const graphify = (config && config['graphify']);
     const configuredValue = graphify && graphify['graph_path'];
     if (typeof configuredValue === 'string' && configuredValue.trim().length > 0) {
@@ -564,7 +581,7 @@ function graphifyBuild(cwd) {
     const graphsDir = node_path_1.default.join(planningDir, 'graphs');
     node_fs_1.default.mkdirSync(graphsDir, { recursive: true });
     // Read build timeout from config -- default 300s per D-02
-    const config = safeReadJson(node_path_1.default.join(planningDir, 'config.json')) || {};
+    const config = safeReadConfigJson(planningDir) || {};
     const graphifyConfig = config.graphify;
     const timeoutSec = (graphifyConfig && graphifyConfig.build_timeout) || 300;
     return {

package/gsd-core/bin/lib/health-diagnostic.cjs

@@ -324,7 +324,11 @@ function runRepairAction(cwd, action, paths, args = {}) {
         case REMEDY_ACTION.ADD_NYQUIST_KEY:
         case REMEDY_ACTION.ADD_AI_INTEGRATION_PHASE_KEY: {
             const key = action === REMEDY_ACTION.ADD_NYQUIST_KEY ? 'nyquist_validation' : 'ai_integration_phase';
-            const configRaw = node_fs_1.default.readFileSync(configPath, 'utf-8');
+            // Bounded read (#5759): a FIFO/device/oversized config throws (the repair fails, never blocks).
+            const configRaw = configLoaderMod.readConfigFileBounded(configPath);
+            if (configRaw === null) {
+                throw Object.assign(new Error(`ENOENT: no such file or directory, open '${configPath}'`), { code: 'ENOENT' });
+            }
             const configParsed = JSON.parse(configRaw);
             if (!configParsed['workflow'])
                 configParsed['workflow'] = {};

package/gsd-core/bin/lib/init.cjs

@@ -48,7 +48,7 @@ const secrets_cjs_1 = require("./secrets.cjs");
 const scanPhasePlans = require("./plan-scan.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- plan-document.cjs is an export= CommonJS module
 const planDocument = require("./plan-document.cjs");
-const state_document_cjs_1 = require("./state-document.cjs");
+const state_transition_cjs_1 = require("./state-transition.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 const host_runtime_detection_cjs_1 = require("./host-runtime-detection.cjs");
 const security_cjs_1 = require("./security.cjs");
@@ -540,7 +540,10 @@ function detectHasPriorPhases(cwd, phaseInfo) {
  */
 function readConfigJsonBoolean(cwd, keyPath) {
     try {
-        const raw = node_fs_1.default.readFileSync(node_path_1.default.join(planningDir(cwd), 'config.json'), 'utf8');
+        // Bounded read (#5759): a FIFO/device/oversized config throws and degrades to false below.
+        const raw = configLoader.readConfigFileBounded(node_path_1.default.join(planningDir(cwd), 'config.json'));
+        if (raw === null)
+            return false;
         let cursor = JSON.parse(raw);
         for (const segment of keyPath) {
             if (cursor === null || typeof cursor !== 'object' || Array.isArray(cursor))
@@ -576,7 +579,10 @@ function readNonEmptyFileOrNull(filePath) {
  */
 function readConfigJsonValue(cwd, keyPath) {
     try {
-        const raw = node_fs_1.default.readFileSync(node_path_1.default.join(planningDir(cwd), 'config.json'), 'utf8');
+        // Bounded read (#5759): a FIFO/device/oversized config throws and degrades to undefined below.
+        const raw = configLoader.readConfigFileBounded(node_path_1.default.join(planningDir(cwd), 'config.json'));
+        if (raw === null)
+            return undefined;
         let cursor = JSON.parse(raw);
         for (const segment of keyPath) {
             if (cursor === null || typeof cursor !== 'object' || Array.isArray(cursor))
@@ -1058,8 +1064,7 @@ function cmdInitExecutePhase(cwd, phase, raw, options = {}) {
                 const stateWarnings = [];
                 if (phaseInfo?.['directory'] && node_fs_1.default.existsSync(node_path_1.default.join(cwd, phaseInfo['directory']))) {
                     const diskPlans = listPhasePlanFiles(node_path_1.default.join(cwd, phaseInfo['directory'])).length;
-                    const totalPlansRaw = (0, state_document_cjs_1.stateExtractField)(stateContent, 'Total Plans in Phase');
-                    const totalPlansInPhase = totalPlansRaw ? parseInt(totalPlansRaw, 10) : null;
+                    const totalPlansInPhase = (0, state_transition_cjs_1.readRecordedPlanTotal)(stateContent);
                     if (totalPlansInPhase !== null && diskPlans !== totalPlansInPhase) {
                         stateWarnings.push(`Plan count mismatch: STATE.md says ${totalPlansInPhase}, disk has ${diskPlans}`);
                     }
@@ -1286,8 +1291,7 @@ function cmdInitPlanPhase(cwd, phase, raw, options = {}) {
             if (stateContent !== null) {
                 const stateWarnings = [];
                 result['state_validation_ran'] = true;
-                const totalPlansRaw = (0, state_document_cjs_1.stateExtractField)(stateContent, 'Total Plans in Phase');
-                const totalPlansInPhase = totalPlansRaw ? parseInt(totalPlansRaw, 10) : null;
+                const totalPlansInPhase = (0, state_transition_cjs_1.readRecordedPlanTotal)(stateContent);
                 if (totalPlansInPhase !== null &&
                     phaseInfo &&
                     totalPlansInPhase !==
@@ -2635,9 +2639,7 @@ function cmdInitManager(cwd, raw) {
         const phaseNum = capturesBracketId ? match[2] : match[1];
         if (bracketId)
             bracketIdsByPhaseNumber.set(phaseNum, bracketId);
-        const phaseName = (capturesBracketId ? match[3] : match[2])
-            .replace(/\(INSERTED\)/i, '')
-            .trim();
+        const phaseName = (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(capturesBracketId ? match[3] : match[2]);
         let displayId;
         if (bracketId) {
             try {
@@ -3443,7 +3445,7 @@ function cmdInitProgress(cwd, raw, options = {}) {
         let hm;
         while ((hm = headingPattern.exec(roadmapContent)) !== null) {
             roadmapPhaseNums.add(hm[hNumGroup]);
-            roadmapPhaseNames.set(hm[hNumGroup], hm[hNameGroup].replace(/\(INSERTED\)/i, '').trim());
+            roadmapPhaseNames.set(hm[hNumGroup], (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(hm[hNameGroup]));
         }
         // #4906 Phase 5 (#4984): NOT migrated onto phaseHeadingPrefixSrcFor — same
         // out-of-scope reasoning as roadmapPhaseMatchesExactPrefix/detectPhaseMvpMode

package/gsd-core/bin/lib/install-effort-resolver.cjs

@@ -36,9 +36,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- config-file-read.cjs is an export= CommonJS module
+const configFileReadMod = require("./config-file-read.cjs");
+const { unboundedConfigFileReason, printablePath, readConfigFileBounded } = configFileReadMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- install-fs-adapter.cjs is an export= CommonJS module
 const installFsAdapter = require("./install-fs-adapter.cjs");
-const { installFs } = installFsAdapter;
+const { installFs, isRealInstallFs } = installFsAdapter;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- model-resolver.cjs is an export= CommonJS module
 const modelResolver = require("./model-resolver.cjs");
 const { EFFORT_SET: GSD_EFFORT_SET } = modelResolver;
@@ -54,19 +57,36 @@ const { mergeEffortTierDefaults } = modelCatalog;
 function _readGsdConfigFile(absPath, label) {
     if (!installFs().existsSync(absPath))
         return null;
+    // #5759: refuse a FIFO/device/socket or an oversized file BEFORE the adapter's blocking read
+    // (shared guard; a path that is not on the real fs is left to the adapter).
     let raw;
     try {
-        raw = installFs().readFileSync(absPath, 'utf-8');
+        if (isRealInstallFs()) {
+            // The real fs: the descriptor-bound reader (non-blocking open, fstat, cap).
+            const text = readConfigFileBounded(absPath);
+            if (text === null)
+                return null;
+            raw = text;
+        }
+        else {
+            // An injected adapter cannot give a descriptor: stat the real path first (best effort).
+            const unbounded = unboundedConfigFileReason(absPath);
+            if (unbounded !== null) {
+                process.stderr.write(`gsd: warning — could not read ${label} (${printablePath(absPath)}): ${unbounded}\n`);
+                return null;
+            }
+            raw = installFs().readFileSync(absPath, 'utf-8');
+        }
     }
     catch (err) {
-        process.stderr.write(`gsd: warning — could not read ${label} (${absPath}): ${err.message}\n`);
+        process.stderr.write(`gsd: warning — could not read ${label} (${printablePath(absPath)}): ${printablePath(err.message)}\n`);
         return null;
     }
     try {
         return JSON.parse(raw);
     }
     catch (err) {
-        process.stderr.write(`gsd: warning — invalid JSON in ${label} (${absPath}): ${err.message}\n`);
+        process.stderr.write(`gsd: warning — invalid JSON in ${label} (${printablePath(absPath)}): ${printablePath(err.message)}\n`);
         return null;
     }
 }

package/gsd-core/bin/lib/install-engine.cjs

@@ -122,7 +122,7 @@ function pruneEmptyCorpusParents(start, stop) {
 }
 function syncRuntimeSurfaceCorpus(source, destination, configDir, manifestPrefix) {
     if (hasExistingSymlinkBetween(node_path_1.default.resolve(configDir), destination, { allowOptInFollow: isSymlinkedDestOptIn() })) {
-        throw new Error(`syncRuntimeSurfaceCorpus: destination "${destination}" contains a symlink the install root "${configDir}" does not trust — refusing to write.`);
+        throw new Error(runtimeArtifactInstallPlan.syncRuntimeSurfaceCorpusSymlinkRefusalMessage(destination, configDir));
     }
     assertCorpusTreeHasNoSymlinks(destination);
     // Remove only paths the previous manifest proves GSD owned and which the
@@ -160,15 +160,7 @@ function syncRuntimeSurfaceCorpus(source, destination, configDir, manifestPrefix
  * The compatibility marker does not replace that installed-corpus authority.
  */
 function provisionRuntimeSurfaceCorpus(layout, configDir, scope) {
-    const required = new Set();
-    if ((0, install_scope_cjs_1.isGlobalScope)(scope)) {
-        for (const kind of layout.kinds) {
-            if (kind.kind === 'commands' || kind.kind === 'skills')
-                required.add('commands');
-            if (kind.kind === 'agents' || kind.kind === 'kimi-agents')
-                required.add('agents');
-        }
-    }
+    const required = runtimeArtifactInstallPlan.requiredRuntimeSurfaceSources(layout, scope);
     if (required.size === 0)
         return;
     const corpusRoot = node_path_1.default.join(configDir, 'gsd-core');
@@ -557,7 +549,7 @@ function _resolveDevPreferencesSkillTarget(targetDir, runtime, scope = 'global')
         // legacy dev-preferences migration lands in the SAME tree the installer
         // and surface-apply use. Runtimes with no `home` override are unaffected.
         hasHomeOverride = skillsKindEntry.home != null;
-        installRoot = skillsKindEntry.home ?? targetDir;
+        installRoot = runtimeArtifactInstallPlan.resolveRuntimeArtifactInstallRoot(targetDir, skillsKindEntry);
         skillDir = node_path_1.default.join(runtimeArtifactInstallPlan.assertDestWithinConfigHome(installRoot, skillsKindEntry.destSubpath), stemName);
     }
     else {
@@ -666,7 +658,7 @@ function _copyStaged(stagedDir, destDir, kind, configDir, runtime) {
     // that case this defense-in-depth check must confine against the resolved
     // alternate root instead, matching the upstream gate's own root selection in
     // createRuntimeArtifactInstallPlan.
-    const installRoot = (kind && typeof kind.home === 'string' && kind.home !== '') ? kind.home : configDir;
+    const installRoot = runtimeArtifactInstallPlan.resolveRuntimeArtifactInstallRoot(configDir, kind);
     // Strict-subpath + NUL containment via the canonical gate (shared with the
     // layout-driven install plan); throws if destDir escapes the install root.
     // destDir here is an absolute path; path.resolve(installRoot, absoluteDest) returns it unchanged, so the gate's strict-subpath check still correctly confines it to installRoot.
@@ -1300,7 +1292,7 @@ function installRuntimeArtifacts(runtime, configDir, scope, resolvedProfile, res
         // previously lived inline in bin/install.js.
         const behaviors = hostBehaviorsFor(runtime);
         const projectDir = scope === 'global' ? process.cwd() : configDir;
-        if (behaviors.combinedFamilyInstall) {
+        if (runtimeArtifactInstallPlan.shouldInstallCombinedFamily(behaviors)) {
             // #2329: combined-family runtimes (OpenCode/Kilo) bypass
             // _runLegacyInstallMigrations below entirely (early return), so their
             // legacy-directory cleanup needs its own pre-materialization hook here.
@@ -1378,12 +1370,12 @@ function installRuntimeArtifacts(runtime, configDir, scope, resolvedProfile, res
                 // A fake adapter can change what those probes observe for paths that
                 // were never real to begin with; it cannot make this `if` pass for a
                 // path the real filesystem would refuse.
-                const installRoot = (kind && typeof kind.home === 'string' && kind.home !== '') ? kind.home : configDir;
+                const installRoot = runtimeArtifactInstallPlan.resolveRuntimeArtifactInstallRoot(configDir, kind);
                 // #2393: honor GSD_ALLOW_SYMLINKED_DEST for intentional user-owned symlink layouts.
                 // Threat model from #1704 / ADR-1239 Phase B preserved: path-traversal and
                 // resolved-target-equals-root still refuse regardless of opt-in.
                 if (hasExistingSymlinkBetween(node_path_1.default.resolve(installRoot), dest, { allowOptInFollow: isSymlinkedDestOptIn() })) {
-                    throw new Error(`installRuntimeArtifacts: destDir "${dest}" contains a symlink the install root "${installRoot}" does not trust — refusing to create. If this is an intentional user-owned symlink layout (e.g. externalized skills/hooks dir, multi-account configHome, or a dotfiles-managed configHome), re-run with GSD_ALLOW_SYMLINKED_DEST=1.`);
+                    throw new Error(runtimeArtifactInstallPlan.installRuntimeArtifactsSymlinkRefusalMessage(dest, installRoot));
                 }
                 // #2875 defect fix (--minimal regression closed): a restricted profile
                 // (e.g. --minimal) can legitimately stage ZERO agents — no skill in
@@ -1577,6 +1569,7 @@ function installOpencodeFamilySkills(runtime, targetDir, rawCommandsDir, pathPre
     const skillsKindEntry = layout.kinds.find((k) => k.kind === 'skills');
     if (!skillsKindEntry)
         return 0;
+    const installRoot = runtimeArtifactInstallPlan.resolveRuntimeArtifactInstallRoot(targetDir, skillsKindEntry);
     // #3712: combined-family runtimes take installRuntimeArtifacts' early return
     // BEFORE its guard runs, and this writer honors `skillsKindEntry.home` below and
     // then prunes that destination. opencode/kilo declare no `home` today, so there
@@ -1603,13 +1596,12 @@ function installOpencodeFamilySkills(runtime, targetDir, rawCommandsDir, pathPre
     // OpenCode/Kilo writer lands in the SAME tree the installer and surface-apply use.
     // Runtimes with no `home` override (opencode, kilo today) are unaffected. Must stay
     // in lockstep with the sibling writers — the destination-parity test enforces it.
-    const installRoot = skillsKindEntry.home ?? targetDir;
     const dest = runtimeArtifactInstallPlan.assertDestWithinConfigHome(installRoot, skillsKindEntry.destSubpath);
     // Symlink-escape guard: reject if any path component between installRoot and
     // dest is a symlink that would redirect writes outside the install root.
     // #2393: honor GSD_ALLOW_SYMLINKED_DEST for intentional user-owned symlink layouts.
     if (hasExistingSymlinkBetween(node_path_1.default.resolve(installRoot), dest, { allowOptInFollow: isSymlinkedDestOptIn() })) {
-        throw new Error(`installOpencodeFamilySkills: destDir "${dest}" contains a symlink the install root "${installRoot}" does not trust — refusing to write. If this is an intentional user-owned symlink layout, re-run with GSD_ALLOW_SYMLINKED_DEST=1.`);
+        throw new Error(runtimeArtifactInstallPlan.installOpencodeFamilySkillsSymlinkRefusalMessage(dest, installRoot));
     }
     installFs().mkdirSync(dest, { recursive: true });
     // Preserve user-owned GSD-prefixed skill dirs across the gsd-* prune.
@@ -1798,14 +1790,14 @@ function installAgentsKindStandalone(runtime, targetDir, scope, resolvedProfile,
     const stagedAgentFiles = installFs().existsSync(stagedDir)
         ? installFs().readdirSync(stagedDir).filter((f) => f.endsWith('.md'))
         : [];
-    const installRoot = (typeof agentsKindEntry.home === 'string' && agentsKindEntry.home !== '') ? agentsKindEntry.home : targetDir;
+    const installRoot = runtimeArtifactInstallPlan.resolveRuntimeArtifactInstallRoot(targetDir, agentsKindEntry);
     const dest = runtimeArtifactInstallPlan.assertDestWithinConfigHome(installRoot, agentsKindEntry.destSubpath);
     // Symlink-escape guard — same gate _copyStaged/installOpencodeFamilySkills apply
     // to their own writes (#2393 GSD_ALLOW_SYMLINKED_DEST opt-in preserved). Runs
     // even when nothing will be written this call — the stale-agent prune below
     // (`_removeGsdEntries`) still touches `dest` whenever it already exists.
     if (hasExistingSymlinkBetween(node_path_1.default.resolve(installRoot), dest, { allowOptInFollow: isSymlinkedDestOptIn() })) {
-        throw new Error(`installAgentsKindStandalone: destDir "${dest}" contains a symlink the install root "${installRoot}" does not trust — refusing to write. If this is an intentional user-owned symlink layout, re-run with GSD_ALLOW_SYMLINKED_DEST=1.`);
+        throw new Error(runtimeArtifactInstallPlan.installAgentsKindStandaloneSymlinkRefusalMessage(dest, installRoot));
     }
     // #2875 defect fix, corrected: the ORIGINAL fix returned `null` (no-op)
     // whenever a restricted profile (e.g. --minimal) staged ZERO agents,

package/gsd-core/bin/lib/install-fs-adapter.cjs

@@ -259,4 +259,8 @@ function mkInstallTempDir(prefix) {
     installFs().mkdirSync(dir, { recursive: true });
     return dir;
 }
-module.exports = { installFs, withInstallFs, mkInstallTempDir };
+/** True when no fake adapter is active, i.e. installFs() is the real `node:fs` (#5759). */
+function isRealInstallFs() {
+    return current === REAL_ADAPTER;
+}
+module.exports = { installFs, withInstallFs, mkInstallTempDir, isRealInstallFs };

package/gsd-core/bin/lib/install-model-override-resolver.cjs

@@ -35,9 +35,33 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- config-file-read.cjs is an export= CommonJS module
+const configFileReadMod = require("./config-file-read.cjs");
+const { unboundedConfigFileReason, printablePath, readConfigFileBounded } = configFileReadMod;
+/**
+ * Text of an install-time config file, or null (with a printable-path warning) when it is not a
+ * regular file within the cap or cannot be read. The real fs uses the descriptor-bound reader;
+ * an injected adapter gets the stat guard before its own read (#5759).
+ */
+function readInstallConfigText(absPath, label) {
+    try {
+        if (isRealInstallFs())
+            return readConfigFileBounded(absPath);
+        const unbounded = unboundedConfigFileReason(absPath);
+        if (unbounded !== null) {
+            process.stderr.write(`gsd: warning — could not read ${label} (${printablePath(absPath)}): ${unbounded}\n`);
+            return null;
+        }
+        return installFs().readFileSync(absPath, 'utf-8');
+    }
+    catch (err) {
+        process.stderr.write(`gsd: warning — could not read ${label} (${printablePath(absPath)}): ${printablePath(err.message)}\n`);
+        return null;
+    }
+}
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- install-fs-adapter.cjs is an export= CommonJS module
 const installFsAdapter = require("./install-fs-adapter.cjs");
-const { installFs } = installFsAdapter;
+const { installFs, isRealInstallFs } = installFsAdapter;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- install-effort-resolver.cjs is an export= CommonJS module
 const installEffortResolver = require("./install-effort-resolver.cjs");
 const { _readGsdConfigFile, _findAncestorGsdConfigPath } = installEffortResolver;
@@ -62,7 +86,9 @@ function readGsdGlobalModelOverrides(options = {}) {
         const defaultsPath = node_path_1.default.join(home, '.gsd', 'defaults.json');
         if (!installFs().existsSync(defaultsPath))
             return null;
-        const raw = installFs().readFileSync(defaultsPath, 'utf-8');
+        const raw = readInstallConfigText(defaultsPath, 'global defaults'); // #5759: never block on a planted FIFO
+        if (raw === null)
+            return null;
         const parsed = JSON.parse(raw);
         const overrides = parsed.model_overrides;
         if (!overrides || typeof overrides !== 'object')
@@ -99,7 +125,11 @@ function readGsdEffectiveModelOverrides(targetDir = null, options = {}) {
         const candidate = _findAncestorGsdConfigPath(targetDir);
         if (candidate) {
             try {
-                const parsed = JSON.parse(installFs().readFileSync(candidate, 'utf-8'));
+                // #5759: refuse a FIFO/device/oversized project config before the adapter's blocking read.
+                const text = readInstallConfigText(candidate, 'project config');
+                if (text === null)
+                    throw new Error('unusable project config');
+                const parsed = JSON.parse(text);
                 if (parsed && typeof parsed === 'object' && parsed.model_overrides && typeof parsed.model_overrides === 'object') {
                     projectOverrides = parsed.model_overrides;
                 }

package/gsd-core/bin/lib/io.cjs

@@ -364,6 +364,10 @@ const ERROR_REASON = Object.freeze({
     COMMIT_DOCS_GUARD_NOT_A_REPO: 'commit_docs_guard_not_a_repo',
     COMMIT_DOCS_GUARD_FOREIGN_HOOK: 'commit_docs_guard_foreign_hook',
     COMMIT_DOCS_GUARD_HOOKS_PATH_SET: 'commit_docs_guard_hooks_path_set',
+    // commit verb (#6043, ADR-4908 §3): it commits in the worktree the process
+    // runs in, or refuses with one of these. Wire values are the typed `reason`.
+    COMMIT_NOT_GIT_REPO: 'not_git_repo',
+    COMMIT_OUTSIDE_WORKTREE: 'outside_worktree',
     // security-scan
     SECURITY_SCAN_FAILED: 'security_scan_failed',
     // --pick (#3365 / #3358, ADR-3473 §8.4): an absent field or non-JSON
@@ -499,6 +503,8 @@ const REASON_TO_OUTCOME = Object.freeze({
     [ERROR_REASON.COMMIT_DOCS_GUARD_NOT_A_REPO]: 'UNAVAILABLE',
     [ERROR_REASON.COMMIT_DOCS_GUARD_FOREIGN_HOOK]: 'UNAVAILABLE',
     [ERROR_REASON.COMMIT_DOCS_GUARD_HOOKS_PATH_SET]: 'UNAVAILABLE',
+    [ERROR_REASON.COMMIT_NOT_GIT_REPO]: 'UNAVAILABLE',
+    [ERROR_REASON.COMMIT_OUTSIDE_WORKTREE]: 'FAIL',
     // Its own docstring: "an absent field or non-JSON command output is a
     // failure, never a demotion to an empty answer" — the field/output was
     // supposed to be there and was not; a prerequisite of the query failed.

package/gsd-core/bin/lib/markdown-sectionizer.cjs

@@ -12,6 +12,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.XML_DECISION_TAG_NAMES = void 0;
+exports.matchFenceDelimiter = matchFenceDelimiter;
 exports.stripFencedCode = stripFencedCode;
 exports.stripInlineCode = stripInlineCode;
 exports.scanInlineCodeSpans = scanInlineCodeSpans;
@@ -24,6 +25,7 @@ exports.iterateBullets = iterateBullets;
 exports.updateBullet = updateBullet;
 exports.updateHeading = updateHeading;
 exports.extractTaggedBlocks = extractTaggedBlocks;
+exports.extractTaggedBlockSpans = extractTaggedBlockSpans;
 exports.stripTaggedBlocks = stripTaggedBlocks;
 exports.editOutsideTaggedBlocks = editOutsideTaggedBlocks;
 exports.maskFences = maskFences;
@@ -35,6 +37,30 @@ exports.editHeadingSlice = editHeadingSlice;
 exports.deleteSection = deleteSection;
 exports.extractXmlTagBodies = extractXmlTagBodies;
 const pattern_cjs_1 = require("./pattern.cjs");
+const FENCE_DELIMITER_RE = /^( {0,3})(`{3,}|~{3,})(.*)$/;
+/**
+ * The single CommonMark fence-delimiter grammar: ≤3 spaces of indent, a run of
+ * ≥3 backticks or tildes, then trailing text. A trailing `\r` is stripped first
+ * (CRLF safety). Returns `null` when the line is not a delimiter line at all.
+ * `stripFencedCode`, `scanFencedBlocks`, `tokenizeHeadings` and the roadmap
+ * parser's comment/fence blanking all classify delimiter lines through this one
+ * matcher.
+ */
+function matchFenceDelimiter(line) {
+    const m = FENCE_DELIMITER_RE.exec(line.replace(/\r$/, ''));
+    if (m === null)
+        return null;
+    const char = m[2][0];
+    const len = m[2].length;
+    const trailing = m[3];
+    return {
+        char,
+        len,
+        trailing,
+        canOpen: !(char === '`' && trailing.includes('`')),
+        closes: (opener) => char === opener.char && len >= opener.len && /^\s*$/.test(trailing),
+    };
+}
 // ─── stripFencedCode ──────────────────────────────────────────────────────────
 /**
  * CommonMark-correct fenced-code-block stripper.
@@ -62,27 +88,20 @@ function stripFencedCode(content) {
     const lines = content.split('\n');
     const kept = [];
     let openFence = null;
-    // Matches: optional indent (≤3 spaces per CommonMark), fence run, optional info string
-    const delimRe = /^( {0,3})(`{3,}|~{3,})(.*)$/;
     for (const rawLine of lines) {
-        // Strip trailing \r for delimiter matching (CRLF safety)
-        const line = rawLine.replace(/\r$/, '');
-        const m = delimRe.exec(line);
+        const m = matchFenceDelimiter(rawLine);
         if (m) {
-            const char = m[2][0];
-            const len = m[2].length;
-            const trailing = m[3];
             if (openFence === null) {
                 // CommonMark §4.5: backtick fence info string must not contain a backtick.
                 // If it does, this line is NOT a valid fence opener (treat as ordinary content).
-                if (char === '`' && trailing.includes('`')) {
+                if (!m.canOpen) {
                     kept.push(rawLine);
                     continue;
                 }
                 // Opening delimiter — record fence state, drop this line
-                openFence = { char, len };
+                openFence = { char: m.char, len: m.len };
             }
-            else if (char === openFence.char && len >= openFence.len && /^\s*$/.test(trailing)) {
+            else if (m.closes(openFence)) {
                 // Closing delimiter (same char, sufficient length, no trailing content) — close and drop
                 openFence = null;
             }
@@ -213,9 +232,8 @@ function stripInlineCodeLine(line) {
  * different-info-string fence, a fence nested/indented inside another fence,
  * and a `~~~` fence are all classified exactly as `stripFencedCode` would.
  *
- * Tracked duplication (same status as `tokenizeHeadings`'s copy, see its
- * comment above): this is a second independent copy of the fence state
- * machine, pending a T-tier consolidation.
+ * Delimiter classification goes through `matchFenceDelimiter`, the one shared
+ * grammar (also used by `stripFencedCode` and `tokenizeHeadings`).
  *
  * Exported so `context-predicates.cts` can consume this seam directly for its
  * line-preserving fenced-line skip detection, instead of carrying a third
@@ -223,24 +241,19 @@ function stripInlineCodeLine(line) {
  * comment).
  */
 function scanFencedBlocks(lines) {
-    const delimRe = /^( {0,3})(`{3,}|~{3,})(.*)$/;
     const blocks = [];
     let open = null;
     for (let i = 0; i < lines.length; i++) {
-        const line = lines[i].replace(/\r$/, '');
-        const m = delimRe.exec(line);
+        const m = matchFenceDelimiter(lines[i]);
         if (!m)
             continue;
-        const char = m[2][0];
-        const len = m[2].length;
-        const trailing = m[3];
         if (open === null) {
             // CommonMark §4.5: backtick fence info string must not contain a backtick.
-            if (char === '`' && trailing.includes('`'))
+            if (!m.canOpen)
                 continue; // not a valid opener — ordinary content
-            open = { char, len, infoString: trailing.trim(), openLineIdx: i };
+            open = { char: m.char, len: m.len, infoString: m.trailing.trim(), openLineIdx: i };
         }
-        else if (char === open.char && len >= open.len && /^\s*$/.test(trailing)) {
+        else if (m.closes(open)) {
             blocks.push({
                 char: open.char,
                 len: open.len,
@@ -319,30 +332,26 @@ function tokenizeHeadings(content) {
     const tokens = [];
     // We re-run the fence state machine to know which lines are "kept", so we
     // can map line index in original to whether it survived.
-    const delimRe = /^( {0,3})(`{3,}|~{3,})(.*)$/;
     let openFence = null;
     // Accumulate character offset as we iterate lines
     let charOffset = 0;
     for (let i = 0; i < originalLines.length; i++) {
         const rawLine = originalLines[i];
         const line = rawLine.replace(/\r$/, '');
-        const dm = delimRe.exec(line);
+        const dm = matchFenceDelimiter(rawLine);
         if (dm) {
-            const char = dm[2][0];
-            const len = dm[2].length;
-            const trailing = dm[3];
             if (openFence === null) {
                 // CommonMark §4.5: backtick fence info string must not contain a backtick.
-                if (char === '`' && trailing.includes('`')) {
+                if (!dm.canOpen) {
                     // Not a valid fence opener — check for heading on this line (will fall through)
                 }
                 else {
-                    openFence = { char, len };
+                    openFence = { char: dm.char, len: dm.len };
                     charOffset += rawLine.length + 1;
                     continue;
                 }
             }
-            else if (char === openFence.char && len >= openFence.len && /^\s*$/.test(trailing)) {
+            else if (dm.closes(openFence)) {
                 openFence = null;
                 charOffset += rawLine.length + 1;
                 continue;
@@ -818,6 +827,28 @@ function extractTaggedBlocks(content, tagName, allowAttributes = false) {
     }
     return results;
 }
+/**
+ * Offset spans of the bodies `extractTaggedBlocks` returns (#4309): same
+ * pattern, same blocks, but each body is reported as `{ start, end }` into
+ * `content` so a caller can test whether an arbitrary offset lies inside a
+ * block (and dedupe nested blocks) without re-harvesting the text.
+ * `content.slice(span.start, span.end)` equals the matching extracted body.
+ */
+function extractTaggedBlockSpans(content, tagName, allowAttributes = false) {
+    if (typeof content !== 'string' || content.length === 0)
+        return [];
+    if (typeof tagName !== 'string' || tagName.length === 0)
+        return [];
+    const closeLength = `</${tagName}>`.length;
+    const pattern = taggedBlockPattern(tagName, 'g', allowAttributes);
+    const spans = [];
+    let match;
+    while ((match = pattern.exec(content)) !== null) {
+        const end = match.index + match[0].length - closeLength;
+        spans.push({ start: end - match[1].length, end });
+    }
+    return spans;
+}
 /**
  * Build the single, ReDoS-safe `<tag>…</tag>` block regex shared by
  * `extractTaggedBlocks` (extract bodies) and `stripTaggedBlocks` (remove blocks).