@opengsd/gsd-core 1.3.0 → 1.4.0-rc.1

package/gsd-core/bin/lib/core.cjs

@@ -506,6 +506,7 @@ function loadConfig(cwd, options = {}) {
             effort: (parsed['effort']) || null,
             fast_mode: (parsed['fast_mode']) || null,
             agent_skills: (parsed['agent_skills']) || {},
+            agent_skills_security: (parsed['agent_skills_security']) || null,
             manager: (parsed['manager']) || {},
             response_language: get('response_language') || null,
             claude_md_path: get('claude_md_path') || null,
@@ -994,35 +995,38 @@ function extractCurrentMilestone(content, cwd) {
     const firstMatch = allMatches[0];
     const selected = allMatches.find((m) => !isClosed(m[1])) || firstMatch;
     const sectionStart = selected.index;
-    const sectionMatch = selected;
-    const headingLevel = (sectionMatch[1].match(/^(#{1,3})\s/) ?? ['', '#'])[1].length;
-    const restContent = content.slice(sectionStart + sectionMatch[0].length);
-    const nextMilestonePattern = new RegExp(`^#{1,${headingLevel}}\\s+(?!Phase\\s+\\S)(?:.*v\\d+\\.\\d+|✅|📋|🚧)`, 'i');
-    let sectionEnd = content.length;
-    let fenceChar = null;
-    let fenceLen = 0;
-    let charOffset = 0;
-    for (const line of restContent.split('\n')) {
-        const fenceMatch = line.match(/^\s{0,3}((?:`{3,}|~{3,}))(.*)/);
-        if (fenceMatch) {
-            const char = fenceMatch[1][0];
-            const len = fenceMatch[1].length;
-            const trailing = fenceMatch[2] || '';
-            if (!fenceChar) {
-                fenceChar = char;
-                fenceLen = len;
+    const computeSectionEnd = (headingText, headingStart) => {
+        const level = (headingText.match(/^(#{1,3})\s/) ?? ['', '#'])[1].length;
+        const rest = content.slice(headingStart + headingText.length);
+        const stopPattern = new RegExp(`^#{1,${level}}\\s+(?!Phase\\s+\\S)(?:.*v\\d+\\.\\d+|✅|📋|🚧)`, 'i');
+        let end = content.length;
+        let fc = null;
+        let fl = 0;
+        let off = 0;
+        for (const line of rest.split('\n')) {
+            const fm = line.match(/^\s{0,3}((?:`{3,}|~{3,}))(.*)/);
+            if (fm) {
+                const ch = fm[1][0];
+                const ln = fm[1].length;
+                const trailing = fm[2] || '';
+                if (!fc) {
+                    fc = ch;
+                    fl = ln;
+                }
+                else if (ch === fc && ln >= fl && /^\s*$/.test(trailing)) {
+                    fc = null;
+                    fl = 0;
+                }
             }
-            else if (char === fenceChar && len >= fenceLen && /^\s*$/.test(trailing)) {
-                fenceChar = null;
-                fenceLen = 0;
+            else if (!fc && stopPattern.test(line)) {
+                end = headingStart + headingText.length + off;
+                break;
             }
+            off += line.length + 1;
         }
-        else if (!fenceChar && nextMilestonePattern.test(line)) {
-            sectionEnd = sectionStart + sectionMatch[0].length + charOffset;
-            break;
-        }
-        charOffset += line.length + 1;
-    }
+        return end;
+    };
+    const sectionEnd = computeSectionEnd(selected[0], sectionStart);
     const anyMilestonePattern = /^#{1,3}\s+(?!Phase\s+\S)(?:.*v\d+\.\d+|✅|📋|🚧)/im;
     const firstMilestoneMatch = content.match(anyMilestonePattern);
     const preambleCutoff = firstMilestoneMatch
@@ -1030,11 +1034,36 @@ function extractCurrentMilestone(content, cwd) {
         : firstMatch.index;
     const beforeMilestones = content.slice(0, preambleCutoff);
     const currentSection = content.slice(sectionStart, sectionEnd);
+    // Multi-milestone roadmaps split each added milestone across two version-bearing
+    // headings: a `## Phases` checklist subsection (early) and a dedicated
+    // `## Milestone … (Phase Details)` section (late) holding the `### Phase N:`
+    // detail headers. The scope window above stops at the next version-bearing
+    // heading — the current milestone's OWN Phase Details heading — leaving those
+    // detail headers outside `currentSection`. Append that section so phase
+    // resolution and counting see the current milestone's phases. Anchor the lookup
+    // to the SELECTED heading's specific version token (boundary-aware, so a
+    // `v3.0` state does not match a `v3.0-A` sub-milestone) so sibling milestones
+    // that share a version prefix do not cross-pollinate. (#730)
+    const selectedVersionToken = selected[1].match(/v\d+(?:\.\d+)+(?:[-.][A-Za-z0-9]+)*/i)?.[0];
+    const detailsVersionBoundary = selectedVersionToken
+        ? new RegExp(`${escapeRegex(selectedVersionToken)}(?![\\w.-])`, 'i')
+        : null;
+    let detailsSection = '';
+    const detailsMatch = allMatches.find((m) => /\(Phase\s+Details\)/i.test(m[1]) &&
+        !isClosed(m[1]) &&
+        (!detailsVersionBoundary || detailsVersionBoundary.test(m[1])) &&
+        (m.index ?? 0) >= sectionEnd);
+    if (detailsMatch) {
+        const detailsStart = detailsMatch.index ?? 0;
+        detailsSection = content.slice(detailsStart, computeSectionEnd(detailsMatch[0], detailsStart));
+    }
     const preamble = beforeMilestones
         .replace(/<details>[\s\S]*?<\/details>/gi, '')
         .replace(/^#{2,4}\s*Phase\s+[\w][\w.-]*\s*:[^\n]*(?:\n(?!#{1,6}\s)[^\n]*)*\n?/gim, '')
         .replace(/^#{1,4}\s*Phase Details\b[^\n]*\n?/gim, '');
-    return preamble + currentSection;
+    return detailsSection
+        ? preamble + currentSection + '\n' + detailsSection
+        : preamble + currentSection;
 }
 /**
  * Replace a pattern only in the current milestone section of ROADMAP.md.
@@ -1399,7 +1428,12 @@ const VALID_GRANULARITIES = new Set(['coarse', 'standard', 'fine']);
 /**
  * Resolve the planning granularity for a phase type (#68).
  */
-function resolveGranularityInternal(cwd, phaseType) {
+function resolveGranularityInternal(cwd, phaseType, override) {
+    if (override !== undefined && override !== null && override !== '') {
+        if (VALID_GRANULARITIES.has(override)) {
+            return override;
+        }
+    }
     const config = loadConfig(cwd);
     const configGranularities = config['granularities'];
     const perPhase = (phaseType && configGranularities && typeof configGranularities === 'object')
@@ -1418,6 +1452,15 @@ function resolveGranularityInternal(cwd, phaseType) {
     }
     return 'standard';
 }
+/**
+ * Validate a CLI granularity override at the command boundary. Empty/null/undefined
+ * are treated as "no override" (no-op). An invalid non-empty value calls `fail`.
+ */
+function assertValidGranularityOverride(override, fail) {
+    if (override !== undefined && override !== null && override !== '' && !VALID_GRANULARITIES.has(override)) {
+        fail(`invalid granularity '${override}' (valid: ${[...VALID_GRANULARITIES].join(', ')})`);
+    }
+}
 /**
  * #3024 — Resolve a model for a specific dynamic-routing attempt.
  */
@@ -1956,6 +1999,7 @@ module.exports = {
     resolveModelForTier,
     resolveGranularityInternal,
     VALID_GRANULARITIES,
+    assertValidGranularityOverride,
     resolveEffortInternal,
     resolveFastModeInternal,
     resolveEffortForTier,

package/gsd-core/bin/lib/graphify.cjs

@@ -35,7 +35,7 @@ function isGraphifyEnabled(planningDir) {
             return true;
         return false;
     }
-    catch (_e) {
+    catch {
         return false;
     }
 }
@@ -157,7 +157,7 @@ function safeReadJson(filePath) {
             return null;
         return JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }

package/gsd-core/bin/lib/init-command-router.cjs

@@ -34,8 +34,8 @@ function routeInitCommand({ init, args, cwd, raw, error }) {
                 init.cmdInitExecutePhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'] });
             },
             'plan-phase': () => {
-                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['validate', 'tdd']);
-                init.cmdInitPlanPhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'] });
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, ['granularity'], ['validate', 'tdd']);
+                init.cmdInitPlanPhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'], granularity: namedArgs['granularity'] });
             },
             'new-project': () => init.cmdInitNewProject(cwd, raw),
             'new-milestone': () => init.cmdInitNewMilestone(cwd, raw),

package/gsd-core/bin/lib/init.cjs

@@ -28,7 +28,7 @@ const security_cjs_1 = require("./security.cjs");
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- frontmatter.cjs is an export= CommonJS module
 const frontmatterMod = require("./frontmatter.cjs");
-const { loadConfig, resolveModelInternal, findPhaseInternal, getRoadmapPhaseInternal, pathExistsInternal, gitWorktreeInfoInternal, generateSlugInternal, getMilestoneInfo, getMilestonePhaseFilter, stripShippedMilestones, extractCurrentMilestone, normalizePhaseName, toPosixPath, output, error, checkAgentsInstalled, phaseTokenMatches, } = core;
+const { loadConfig, resolveModelInternal, resolveGranularityInternal, assertValidGranularityOverride, findPhaseInternal, getRoadmapPhaseInternal, pathExistsInternal, gitWorktreeInfoInternal, generateSlugInternal, getMilestoneInfo, getMilestonePhaseFilter, stripShippedMilestones, extractCurrentMilestone, normalizePhaseName, toPosixPath, output, error, checkAgentsInstalled, phaseTokenMatches, } = core;
 const { planningPaths, planningDir, planningRoot, findContextMdIn, } = planningWorkspace;
 const { determinePhaseStatus } = commandsMod;
 const { extractFrontmatter } = frontmatterMod;
@@ -297,11 +297,15 @@ function cmdInitPlanPhase(cwd, phase, raw, options = {}) {
             expectedPhaseDirPlan = toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(planningPaths(cwd).phases, dirName)));
         }
     }
+    const granularityOverride = options['granularity'];
+    assertValidGranularityOverride(granularityOverride, error);
+    const granularity = resolveGranularityInternal(cwd, 'planning', granularityOverride || undefined);
     const result = {
         researcher_model: resolveModelInternal(cwd, 'gsd-phase-researcher'),
         planner_model: resolveModelInternal(cwd, 'gsd-planner'),
         checker_model: resolveModelInternal(cwd, 'gsd-plan-checker'),
         tdd_mode: options['tdd'] || config.tdd_mode || false,
+        granularity,
         research_enabled: config.research,
         plan_checker_enabled: config.plan_checker,
         nyquist_validation_enabled: config.nyquist_validation,
@@ -1521,6 +1525,11 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
         skillPaths = [skillPaths];
     if (!Array.isArray(skillPaths) || skillPaths.length === 0)
         return '';
+    // Hoist trusted roots computation before the loop: loadTrustedGlobalRoots does
+    // realpathSync I/O and should run at most once per call, not once per failing skill.
+    // It returns [] cheaply when no roots are configured, so the realpath cost only
+    // occurs when the caller has actually set trusted_global_roots.
+    const trustedGlobalRoots = (0, security_cjs_1.loadTrustedGlobalRoots)(config);
     const validPaths = [];
     for (const skillPath of skillPaths) {
         if (typeof skillPath !== 'string')
@@ -1548,8 +1557,15 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
             }
             const pathCheck = (0, security_cjs_1.validatePath)(globalSkillMd, globalSkillsBase, { allowAbsolute: true });
             if (!pathCheck['safe']) {
-                process.stderr.write(`[agent-skills] WARNING: Global skill "${skillName}" failed path check (symlink escape?) — skipping\n`);
-                continue;
+                const acceptedViaTrustedRoot = trustedGlobalRoots.some((root) => {
+                    const rootCheck = (0, security_cjs_1.validatePath)(globalSkillMd, root, { allowAbsolute: true });
+                    return Boolean(rootCheck['safe']);
+                });
+                if (!acceptedViaTrustedRoot) {
+                    process.stderr.write(`[agent-skills] WARNING: Global skill "${skillName}" failed path check (symlink escape?) — skipping\n`);
+                    continue;
+                }
+                process.stderr.write(`[agent-skills] NOTE: Global skill "${skillName}" accepted via trusted_global_roots (resolves outside the default skills dir)\n`);
             }
             validPaths.push({ ref: `${globalSkillDir}/SKILL.md`, display: displayPath });
             continue;

package/gsd-core/bin/lib/installer-migrations.cjs

@@ -175,16 +175,46 @@ function migrationChecksum(migration) {
     };
     return `sha256:${sha256Text(JSON.stringify(serializable))}`;
 }
-function assertAppliedMigrationChecksums(applied, migrations) {
+// Rewrite the stored checksum of any already-applied entry whose id drifted, so the
+// drift is reconciled durably and not re-detected on every subsequent run (issue #670).
+// Returns the number of entries actually changed (so callers know whether a write is needed).
+function reconcileDriftedChecksums(appliedEntries, checksumDrift) {
+    if (!Array.isArray(checksumDrift) || checksumDrift.length === 0)
+        return 0;
+    const reconcile = new Map(checksumDrift.map((d) => [d.id, d.currentChecksum]));
+    let changed = 0;
+    for (let i = 0; i < appliedEntries.length; i++) {
+        const existing = appliedEntries[i];
+        if (existing && typeof existing.id === 'string' && reconcile.has(existing.id)) {
+            const next = reconcile.get(existing.id);
+            if (existing.checksum !== next) {
+                appliedEntries[i] = { ...existing, checksum: next };
+                changed += 1;
+            }
+        }
+    }
+    return changed;
+}
+function collectAppliedChecksumDrift(applied, migrations) {
+    const drift = [];
     for (const migration of migrations) {
         const entry = applied.get(migration.id);
         if (!entry || !entry.checksum)
             continue;
-        const checksum = migrationChecksum(migration);
-        if (entry.checksum !== checksum) {
-            throw new Error(`applied migration checksum changed for ${migration.id}; create a new fix-forward migration id`);
+        const currentChecksum = migrationChecksum(migration);
+        if (entry.checksum !== currentChecksum) {
+            // An already-applied migration is never re-run (it is filtered out of `pending`),
+            // so a checksum drift here is functionally inert. A prior release may have edited a
+            // shipped migration body (see issue #670). Surface it for reconciliation instead of
+            // hard-aborting the user's upgrade.
+            drift.push({
+                id: migration.id,
+                storedChecksum: entry.checksum,
+                currentChecksum,
+            });
         }
     }
+    return drift;
 }
 function migrationMatchesContext(migration, { runtime, scope }) {
     if (Array.isArray(migration.runtimes) && migration.runtimes.length > 0) {
@@ -387,7 +417,7 @@ function planInstallerMigrations({ configDir, runtime = null, scope = null, migr
     const validatedMigrations = migrations.map((migration) => (0, installer_migration_authoring_cjs_1.validateInstallerMigrationRecord)(migration));
     const scopedMigrations = validatedMigrations.filter((migration) => migrationMatchesContext(migration, { runtime, scope }));
     const applied = appliedMigrationEntries(state);
-    assertAppliedMigrationChecksums(applied, scopedMigrations);
+    const checksumDrift = collectAppliedChecksumDrift(applied, scopedMigrations);
     const pending = scopedMigrations.filter((migration) => !applied.has(migration.id));
     const actions = [];
     const blocked = [];
@@ -474,6 +504,7 @@ function planInstallerMigrations({ configDir, runtime = null, scope = null, migr
         pendingMigrations: pending,
         actions,
         blocked,
+        checksumDrift,
     };
 }
 function uniqueActionMigrationIds(actions) {
@@ -630,6 +661,7 @@ function applyInstallerMigrationPlan({ configDir, plan, now = () => new Date().t
         const state = readInstallState(configDir);
         const applied = appliedMigrationIds(state);
         const nextApplied = [...state.appliedMigrations];
+        reconcileDriftedChecksums(nextApplied, plan.checksumDrift);
         const actionsByMigrationId = new Map();
         for (const action of plan.actions) {
             if (action.migrationId && !actionsByMigrationId.has(action.migrationId)) {
@@ -684,30 +716,36 @@ function applyInstallerMigrationPlan({ configDir, plan, now = () => new Date().t
     }
 }
 function markPendingMigrationsApplied({ configDir, plan, now = () => new Date().toISOString(), }) {
-    if (!plan || !Array.isArray(plan.pendingMigrationIds) || plan.pendingMigrationIds.length === 0) {
+    if (!plan)
+        return [];
+    const hasPending = Array.isArray(plan.pendingMigrationIds) && plan.pendingMigrationIds.length > 0;
+    const hasDrift = Array.isArray(plan.checksumDrift) && plan.checksumDrift.length > 0;
+    if (!hasPending && !hasDrift)
         return [];
-    }
     const appliedAt = now();
     const state = readInstallState(configDir);
     const applied = appliedMigrationIds(state);
-    const checksumsByMigrationId = new Map();
-    for (const migration of plan.pendingMigrations || []) {
-        checksumsByMigrationId.set(migration.id, migrationChecksum(migration));
-    }
     const nextApplied = [...state.appliedMigrations];
+    const reconciledCount = reconcileDriftedChecksums(nextApplied, plan.checksumDrift);
     const newlyApplied = [];
-    for (const id of plan.pendingMigrationIds) {
-        if (applied.has(id))
-            continue;
-        nextApplied.push({
-            id,
-            appliedAt,
-            journal: null,
-            checksum: checksumsByMigrationId.get(id) || null,
-        });
-        newlyApplied.push(id);
+    if (hasPending) {
+        const checksumsByMigrationId = new Map();
+        for (const migration of plan.pendingMigrations || []) {
+            checksumsByMigrationId.set(migration.id, migrationChecksum(migration));
+        }
+        for (const id of plan.pendingMigrationIds) {
+            if (applied.has(id))
+                continue;
+            nextApplied.push({
+                id,
+                appliedAt,
+                journal: null,
+                checksum: checksumsByMigrationId.get(id) || null,
+            });
+            newlyApplied.push(id);
+        }
     }
-    if (newlyApplied.length > 0) {
+    if (newlyApplied.length > 0 || reconciledCount > 0) {
         writeInstallState(configDir, {
             schemaVersion: 1,
             appliedMigrations: nextApplied,
@@ -776,6 +814,7 @@ module.exports = {
     applyInstallerMigrationPlan,
     classifyArtifact,
     discoverInstallerMigrations,
+    migrationChecksum,
     planInstallerMigrations,
     readInstallManifest,
     readInstallState,

package/gsd-core/bin/lib/intel.cjs

@@ -59,7 +59,7 @@ function isIntelEnabled(planningDir) {
             return true;
         return false;
     }
-    catch (_e) {
+    catch {
         return false;
     }
 }
@@ -86,7 +86,7 @@ function safeReadJson(filePath) {
             return null;
         return JSON.parse(raw);
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }
@@ -101,7 +101,7 @@ function hashFile(filePath) {
             return null;
         return node_crypto_1.default.createHash('sha256').update(content).digest('hex');
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }
@@ -147,23 +147,6 @@ function matchesInValue(value, lowerTerm) {
     }
     return false;
 }
-/**
- * Search for a term in arch.md text content.
- * Returns matching lines.
- */
-function searchArchMd(filePath, term) {
-    try {
-        const content = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);
-        if (content === null)
-            return [];
-        const lowerTerm = term.toLowerCase();
-        const lines = content.split(/\r?\n/);
-        return lines.filter(line => line.toLowerCase().includes(lowerTerm));
-    }
-    catch (_e) {
-        return [];
-    }
-}
 /**
  * Query intel files for a search term.
  * Searches across all JSON intel files (keys and values) and arch.md (text lines).