@opengsd/gsd-core 1.3.1 → 1.4.0-rc.1

package/gsd-core/bin/lib/phase.cjs

@@ -550,7 +550,7 @@ function cmdPhaseAdd(cwd, description, raw, customId) {
         let _newPhaseId;
         let _dirName;
         if (customId || config.phase_naming === 'custom') {
-            _newPhaseId = customId || slug.toUpperCase().replace(/-/g, '-');
+            _newPhaseId = customId || slug.toUpperCase();
             if (!_newPhaseId)
                 error('--id required when phase_naming is "custom"');
             _dirName = `${prefix}${_newPhaseId}-${slug}`;
@@ -658,7 +658,7 @@ function cmdPhaseAddBatch(cwd, descriptions, raw) {
             let newPhaseId;
             let dirName;
             if (config.phase_naming === 'custom') {
-                newPhaseId = slug.toUpperCase().replace(/-/g, '-');
+                newPhaseId = slug.toUpperCase();
                 dirName = `${prefix}${newPhaseId}-${slug}`;
             }
             else {
@@ -913,7 +913,7 @@ function updateRoadmapAfterPhaseRemoval(roadmapPath, targetPhase, isDecimal, rem
             content = content.replace(/(#{2,4}\s*Phase\s+)(\d+(?:\.\d+)?)(\s*:)/gi, (_match, prefix, num, suffix) => `${prefix}${decrementRoadmapPhaseToken(num, removedInt)}${suffix}`);
             content = content.replace(/(-\s*\[[ x]\]\s*.*?Phase\s+)(\d+)(\s*:|\s+)/gi, (_match, prefix, num, suffix) => `${prefix}${decrementRoadmapPhaseNumber(num, removedInt)}${suffix}`);
             content = content.replace(/(\|\s*)(\d+)(\.\s)/g, (_match, prefix, num, suffix) => `${prefix}${decrementRoadmapPhaseNumber(num, removedInt)}${suffix}`);
-            content = content.replace(/(?<![0-9-])(\d{2})-(\d{2})(?=(?:(?:-[A-Za-z][A-Za-z0-9-]*)*-(?:PLAN|SUMMARY)\.md)|(?![0-9-]))/g, (_match, phaseNum, planNum) => `${decrementRoadmapPaddedPhaseNumber(phaseNum, removedInt)}-${planNum}`);
+            content = content.replace(/(?<![0-9-])(\d{2})-(\d{2})(?=(?:(?:-[A-Za-z][A-Za-z0-9-]*)?-(?:PLAN|SUMMARY)\.md)|(?![0-9-]))/g, (_match, phaseNum, planNum) => `${decrementRoadmapPaddedPhaseNumber(phaseNum, removedInt)}-${planNum}`);
             content = content.replace(/(\*\*Depends on\*\*\s*:\s*Phase\s+)(\d+(?:\.\d+)?)\b/gi, (_match, prefix, num) => `${prefix}${decrementRoadmapPhaseToken(num, removedInt)}`);
             content = content.replace(/(Depends on:\*\*\s*Phase\s+)(\d+(?:\.\d+)?)\b/gi, (_match, prefix, num) => `${prefix}${decrementRoadmapPhaseToken(num, removedInt)}`);
         }

package/gsd-core/bin/lib/research-provider.cjs

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Research Provider Module
+ *
+ * Encodes the Balanced-set provider decision: PROVIDER_WATERFALL constant,
+ * classifyConfidence, providerAvailability, and planResearch (with injectable
+ * store for testability).
+ *
+ * ADR-457 build-at-publish: authored as TypeScript .cts → emits .cjs via tsc.
+ */
+// ---------------------------------------------------------------------------
+// Cycle 1 / Cycle 6: PROVIDER_WATERFALL (Balanced-set decision)
+// firecrawl appears ONLY in scrape — demoted to known-URL scrape, NOT in docs/web
+// ---------------------------------------------------------------------------
+const PROVIDER_WATERFALL = {
+    docs: ['context7', 'ref', 'jina', 'websearch'],
+    web: ['exa', 'tavily', 'perplexity', 'brave', 'websearch'],
+    scrape: ['firecrawl', 'jina'],
+};
+function authorityOf(provider) {
+    switch (provider) {
+        case 'context7':
+        case 'ref':
+            return 'official';
+        case 'jina':
+        case 'firecrawl':
+            return 'scrape';
+        case 'exa':
+        case 'tavily':
+        case 'perplexity':
+        case 'brave':
+        case 'websearch':
+            return 'web';
+        default:
+            return 'none';
+    }
+}
+function normalizeLegitimacyVerdict(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const upper = raw.toUpperCase();
+    if (upper === 'OK' || upper === 'SUS' || upper === 'SLOP')
+        return upper;
+    return null;
+}
+function classifyConfidence(input) {
+    try {
+        const { provider, verifiedAgainstOfficial, legitimacyVerdict } = input;
+        const authority = authorityOf(provider);
+        const verdict = normalizeLegitimacyVerdict(legitimacyVerdict);
+        const groundTruth = verdict === 'OK';
+        // SLOP caps everything — checked first
+        if (verdict === 'SLOP')
+            return 'LOW';
+        // Ground-truth corroboration + known authority → HIGH
+        if (groundTruth && authority !== 'none')
+            return 'HIGH';
+        // Official or scrape provider (authority alone) → MEDIUM
+        if (authority === 'official' || authority === 'scrape')
+            return 'MEDIUM';
+        // Ground-truth but unknown provider → MEDIUM
+        if (groundTruth)
+            return 'MEDIUM';
+        // Web provider with self-reported verification → MEDIUM
+        if (authority === 'web' && verifiedAgainstOfficial === true)
+            return 'MEDIUM';
+        return 'LOW';
+    }
+    catch {
+        return 'LOW';
+    }
+}
+// ---------------------------------------------------------------------------
+// Cycle 5: providerAvailability
+// ---------------------------------------------------------------------------
+function providerAvailability(config) {
+    const cfg = config ?? {};
+    return {
+        context7: true,
+        jina: cfg.jina !== undefined ? Boolean(cfg.jina) : true,
+        websearch: true,
+        exa: Boolean(cfg.exa_search),
+        tavily: Boolean(cfg.tavily_search),
+        brave: Boolean(cfg.brave_search),
+        firecrawl: Boolean(cfg.firecrawl),
+        ref: Boolean(cfg.ref_search),
+        perplexity: Boolean(cfg.perplexity),
+    };
+}
+// ---------------------------------------------------------------------------
+// Lazy-load default store (avoids circular require at module eval time)
+// ---------------------------------------------------------------------------
+let _defaultStore;
+function getDefaultStore() {
+    if (!_defaultStore) {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports -- lazy default store; tests inject their own
+        _defaultStore = require('./research-store.cjs');
+    }
+    return _defaultStore;
+}
+// ---------------------------------------------------------------------------
+// Cycle 1–3, 5, 7: planResearch
+// ---------------------------------------------------------------------------
+function planResearch(options) {
+    const { questions, ecosystem = '', cwd, config, clock = Date, homeDir, store = getDefaultStore(), } = options;
+    const availability = providerAvailability(config);
+    const items = questions.flatMap((q) => {
+        const { text, kind, library, version } = q;
+        // Skip questions without a non-empty string text — emitting an item with
+        // question:undefined / fetch.query:undefined would produce corrupt output.
+        if (typeof text !== 'string' || text.length === 0) {
+            return [];
+        }
+        const key = store.researchKey({ ecosystem, library, version, query: text, kind });
+        const res = store.getResearch(cwd, key, { clock, homeDir, kind });
+        // Fresh cache hit — no fetch needed
+        if (res.hit && !res.stale) {
+            return { question: text, key, cache: { hit: true, stale: false } };
+        }
+        // Determine which waterfall to use
+        const waterfall = PROVIDER_WATERFALL[kind] ?? PROVIDER_WATERFALL.web;
+        // Pick first available provider
+        const provider = waterfall.find((p) => availability[p] === true) ?? 'websearch';
+        const item = {
+            question: text,
+            key,
+            fetch: { provider, query: text },
+        };
+        // Stale hit: include cache info
+        if (res.hit) {
+            item.cache = { hit: true, stale: true };
+        }
+        return item;
+    });
+    return { items };
+}
+module.exports = { PROVIDER_WATERFALL, classifyConfidence, providerAvailability, planResearch };

package/gsd-core/bin/lib/research-store.cjs

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * Research Store Module
+ *
+ * Provides deterministic cache key generation, TTL policy, path resolution,
+ * and JSON-backed put/get operations for research entries.
+ *
+ * ADR-457 build-at-publish: authored as TypeScript .cts → emits .cjs via tsc.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const DAY_MS = 86_400_000;
+// ---------------------------------------------------------------------------
+// researchKey
+// ---------------------------------------------------------------------------
+function normalize(x) {
+    if (x === null || x === undefined)
+        return '';
+    if (typeof x === 'object')
+        return JSON.stringify(x).trim().toLowerCase();
+    // After excluding null, undefined, and object, x can only be a primitive —
+    // cast through number | string | boolean to avoid no-base-to-string on unknown.
+    return `${x}`.trim().toLowerCase();
+}
+function researchKey(input) {
+    const parts = {
+        ecosystem: normalize(input.ecosystem),
+        library: normalize(input.library),
+        version: normalize(input.version),
+        query: normalize(input.query),
+        kind: normalize(input.kind),
+    };
+    const serialized = JSON.stringify(parts);
+    return node_crypto_1.default.createHash('sha256').update(serialized).digest('hex');
+}
+// ---------------------------------------------------------------------------
+// ttlForSource
+// ---------------------------------------------------------------------------
+function ttlForSource(source, confidence) {
+    if (source === 'curated' && confidence === 'HIGH')
+        return 30 * DAY_MS;
+    if (source === 'curated' && confidence === 'MEDIUM')
+        return 7 * DAY_MS;
+    return DAY_MS;
+}
+// ---------------------------------------------------------------------------
+// tierForSource / resolveStorePath
+// ---------------------------------------------------------------------------
+const CURATED_SOURCES = new Set(['curated']);
+function tierForSource(source) {
+    return CURATED_SOURCES.has(source) ? 'user' : 'project';
+}
+function resolveStorePath(cwd, source, { homeDir = node_os_1.default.homedir() } = {}) {
+    if (tierForSource(source) === 'user') {
+        return node_path_1.default.join(homeDir, '.gsd', 'research-cache');
+    }
+    return node_path_1.default.join(cwd, '.planning', 'research', '.cache');
+}
+// ---------------------------------------------------------------------------
+// isValidResearchKey
+// ---------------------------------------------------------------------------
+/**
+ * Returns true iff key is a valid 64-character lowercase hexadecimal SHA-256
+ * string (the exact shape produced by researchKey).  Any other shape —
+ * including path-traversal sequences — is rejected.
+ */
+function isValidResearchKey(key) {
+    return typeof key === 'string' && /^[0-9a-f]{64}$/.test(key);
+}
+// ---------------------------------------------------------------------------
+// putResearch
+// ---------------------------------------------------------------------------
+function putResearch(cwd, key, payload, { clock = Date, homeDir = node_os_1.default.homedir() } = {}) {
+    // Defense-in-depth: reject any key that is not a 64-char sha256 hex string.
+    if (!isValidResearchKey(key)) {
+        throw new Error('invalid research key');
+    }
+    const { content, source, provider, confidence, kind, version } = payload;
+    let ttl = ttlForSource(source, confidence);
+    // Cap TTL when version is blank/missing — a versionless curated entry must not
+    // get the long 30-day window since we can't know if it's still current.
+    if (!version) {
+        ttl = Math.min(ttl, DAY_MS);
+    }
+    const fetched_at = new Date(clock.now()).toISOString();
+    const entry = { content, source, provider, confidence, fetched_at, ttl, kind };
+    const dir = resolveStorePath(cwd, source, { homeDir });
+    // Belt-and-suspenders: ensure the resolved file path stays inside the store dir.
+    const resolvedDir = node_path_1.default.resolve(dir);
+    const filePath = node_path_1.default.join(dir, `${key}.json`);
+    const resolvedFile = node_path_1.default.resolve(filePath);
+    if (!resolvedFile.startsWith(resolvedDir + node_path_1.default.sep)) {
+        throw new Error('invalid research key');
+    }
+    node_fs_1.default.mkdirSync(dir, { recursive: true });
+    (0, shell_command_projection_cjs_1.platformWriteSync)(filePath, JSON.stringify(entry));
+    return entry;
+}
+// ---------------------------------------------------------------------------
+// getResearch
+// ---------------------------------------------------------------------------
+function getResearch(cwd, key, { clock = Date, homeDir = node_os_1.default.homedir() } = {}) {
+    // Defense-in-depth: reject any key that is not a 64-char sha256 hex string.
+    if (!isValidResearchKey(key)) {
+        return { hit: false, stale: false, entry: null };
+    }
+    try {
+        // Search both physical tiers: user (curated) and project (web/etc.)
+        const userDir = node_path_1.default.join(homeDir, '.gsd', 'research-cache');
+        const projectDir = node_path_1.default.join(cwd, '.planning', 'research', '.cache');
+        const tierDirs = [userDir, projectDir];
+        const candidates = [];
+        for (const dir of tierDirs) {
+            const resolvedDir = node_path_1.default.resolve(dir);
+            const filePath = node_path_1.default.join(dir, `${key}.json`);
+            // Belt-and-suspenders: ensure path stays inside tier dir
+            if (!node_path_1.default.resolve(filePath).startsWith(resolvedDir + node_path_1.default.sep))
+                continue;
+            if (!node_fs_1.default.existsSync(filePath))
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
+            }
+            catch {
+                // Corrupt file in this tier — skip it
+                continue;
+            }
+            // Finding 3: validate entry metadata shape before accepting as a candidate.
+            // An entry with missing/invalid fetched_at or ttl must be treated as a miss.
+            const parsedFetchedAt = Date.parse(entry.fetched_at);
+            if (!Number.isFinite(parsedFetchedAt))
+                continue;
+            if (typeof entry.ttl !== 'number' ||
+                !Number.isFinite(entry.ttl) ||
+                entry.ttl <= 0)
+                continue;
+            const age = clock.now() - parsedFetchedAt;
+            const stale = age > entry.ttl;
+            candidates.push({ entry, stale, age });
+        }
+        if (candidates.length === 0) {
+            return { hit: false, stale: false, entry: null };
+        }
+        // Prefer: non-stale over stale; among same-staleness, lowest age (most recent)
+        candidates.sort((a, b) => {
+            if (a.stale !== b.stale)
+                return a.stale ? 1 : -1; // non-stale first
+            return a.age - b.age; // lower age (more recent) first
+        });
+        const best = candidates[0];
+        return { hit: true, stale: best.stale, entry: best.entry };
+    }
+    catch {
+        return { hit: false, stale: false, entry: null };
+    }
+}
+module.exports = { isValidResearchKey, researchKey, ttlForSource, tierForSource, resolveStorePath, putResearch, getResearch };

package/gsd-core/bin/lib/roadmap-upgrade.cjs

@@ -25,8 +25,6 @@ const MIGRATED_PHASE_HEADING_RE = /^#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+\d+-\d{2}
 // Matches milestone section headings: ## v1.0, ## Roadmap v2.0, ## ✅ v1.0, ## [GSD] v1.0, etc.
 // The optional bracket-token prefix (e.g., [GSD]) must be tested before the emoji group.
 const MILESTONE_HEADING_RE = /^##\s+(?:\[[^\]]+\]\s+|Roadmap\s+|[✅🚧]\s*)?v(\d+)\.(\d+)(?:\s|:)/iu;
-// Matches checklist phase references: - [ ] **Phase N:** or - [x] **Phase N:**  (also decimal)
-const CHECKLIST_PHASE_RE = /^(\s*-\s*\[[ x]\]\s*\*{0,2})Phase\s+(\d+[A-Z]?(?:\.\d+)*)\s*:/gi;
 // ─── Pure computation helpers ─────────────────────────────────────────────────
 /**
  * Parse the ROADMAP.md content and build a list of phase entries with their
@@ -126,19 +124,6 @@ function buildNewDirName(oldDirName, newId, projectCode) {
     const newBase = slug ? `${paddedMilestone}-${subStr}-${slug}` : `${paddedMilestone}-${subStr}`;
     return projectCode ? `${projectCode}-${newBase}` : newBase;
 }
-/**
- * Read project_code from config.json if present.
- */
-function readProjectCode(configPath) {
-    try {
-        const raw = node_fs_1.default.readFileSync(configPath, 'utf8');
-        const parsed = JSON.parse(raw);
-        return typeof parsed['project_code'] === 'string' ? parsed['project_code'] : null;
-    }
-    catch {
-        return null;
-    }
-}
 // ─── computeMigrationPlan ─────────────────────────────────────────────────────
 /**
  * Compute a migration plan without touching the filesystem.
@@ -390,7 +375,7 @@ function applyMigration(cwd, plan, options = {}) {
     // ── Real run: verify clean working tree ───────────────────────────────────
     let gitStatus;
     try {
-        gitStatus = (0, node_child_process_1.execSync)('git status --porcelain', { cwd, encoding: 'utf8' });
+        gitStatus = (0, node_child_process_1.execSync)('git status --porcelain', { cwd, encoding: 'utf8', windowsHide: true });
     }
     catch (err) {
         throw new Error(`git status failed: ${err.message}`);
@@ -401,7 +386,7 @@ function applyMigration(cwd, plan, options = {}) {
     // Capture HEAD sha for rollback
     let headSha;
     try {
-        headSha = (0, node_child_process_1.execSync)('git rev-parse HEAD', { cwd, encoding: 'utf8' }).trim();
+        headSha = (0, node_child_process_1.execSync)('git rev-parse HEAD', { cwd, encoding: 'utf8', windowsHide: true }).trim();
     }
     catch (err) {
         throw new Error(`git rev-parse HEAD failed: ${err.message}`);
@@ -475,8 +460,8 @@ function applyMigration(cwd, plan, options = {}) {
     catch (err) {
         // Rollback via git reset --hard + git clean
         try {
-            (0, node_child_process_1.execSync)(`git reset --hard ${headSha}`, { cwd, stdio: 'pipe' });
-            (0, node_child_process_1.execSync)('git clean -fd .planning/phases/', { cwd, stdio: 'pipe' });
+            (0, node_child_process_1.execSync)(`git reset --hard ${headSha}`, { cwd, stdio: 'pipe', windowsHide: true });
+            (0, node_child_process_1.execSync)('git clean -fd .planning/phases/', { cwd, stdio: 'pipe', windowsHide: true });
         }
         catch {
             // Swallow rollback errors — surface original error

package/gsd-core/bin/lib/security.cjs

@@ -24,6 +24,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MARKDOWN_LINK_PATTERNS = exports.INJECTION_PATTERNS = void 0;
 exports.validatePath = validatePath;
+exports.loadTrustedGlobalRoots = loadTrustedGlobalRoots;
 exports.requireSafePath = requireSafePath;
 exports.scanForInjection = scanForInjection;
 exports.sanitizeForPrompt = sanitizeForPrompt;
@@ -35,6 +36,7 @@ exports.validateFieldName = validateFieldName;
 exports.validatePromptStructure = validatePromptStructure;
 exports.scanEntropyAnomalies = scanEntropyAnomalies;
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 // ─── Path Traversal Prevention ──────────────────────────────────────────────
 /**
@@ -92,6 +94,77 @@ function validatePath(filePath, baseDir, opts = {}) {
     }
     return { safe: true, resolved: resolvedPath };
 }
+/**
+ * Load the opt-in trusted global roots allowlist from config.
+ *
+ * Reads `config.agent_skills_security.trusted_global_roots` (an array of
+ * path strings). Each entry is canonicalized via realpathSync: non-strings
+ * are dropped, leading `~/` is expanded to `os.homedir()`, entries that are
+ * not absolute after expansion are dropped (project-relative paths are
+ * rejected as a security boundary), and entries that do not exist on disk are
+ * dropped (a non-existent root is not trustworthy). The canonical realpath is
+ * used for all subsequent checks and as the stored value — this closes the
+ * case-insensitive bypass on macOS APFS (`/users/alice` vs `/Users/alice`)
+ * and ensures trust doesn't drift across re-invocations if a root is
+ * re-created at a different target. Results are de-duplicated by canonical path.
+ */
+function loadTrustedGlobalRoots(config) {
+    const roots = config?.['agent_skills_security'];
+    const raw = roots?.['trusted_global_roots'];
+    if (!Array.isArray(raw))
+        return [];
+    // Compute canonical homedir once for case-insensitive-safe comparison.
+    let realHome;
+    try {
+        realHome = node_fs_1.default.realpathSync(node_os_1.default.homedir());
+    }
+    catch {
+        realHome = node_os_1.default.homedir();
+    }
+    const seen = new Set();
+    const result = [];
+    for (const entry of raw) {
+        if (typeof entry !== 'string')
+            continue;
+        let expanded;
+        if (entry === '~') {
+            expanded = node_os_1.default.homedir();
+        }
+        else if (entry.startsWith('~/')) {
+            expanded = node_path_1.default.join(node_os_1.default.homedir(), entry.slice(2));
+        }
+        else {
+            expanded = entry;
+        }
+        if (!node_path_1.default.isAbsolute(expanded))
+            continue; // reject project-relative
+        // Canonicalize: resolve symlinks and normalise case. If the path doesn't
+        // exist or can't be read, skip it — a non-existent root is not trustworthy.
+        let real;
+        try {
+            real = node_fs_1.default.realpathSync(expanded);
+        }
+        catch {
+            continue; // non-existent or unreadable — skip
+        }
+        // Reject dangerously broad roots: filesystem root (e.g. '/' or 'C:\' or UNC '\\server\share').
+        // Normalize both sides by stripping trailing path separators before comparing so that
+        // Windows UNC shares (where path.parse().root includes a trailing separator) are caught.
+        const stripTrailingSep = (p) => p.replace(/[\\/]+$/, '');
+        if (stripTrailingSep(node_path_1.default.parse(real).root) === stripTrailingSep(real))
+            continue;
+        // Reject homedir itself (canonical compare closes case-insensitive bypass).
+        // Apply stripTrailingSep for robustness on platforms where realpathSync may
+        // or may not include a trailing separator on the homedir path.
+        if (stripTrailingSep(real) === stripTrailingSep(realHome))
+            continue;
+        if (seen.has(real))
+            continue;
+        seen.add(real);
+        result.push(real);
+    }
+    return result;
+}
 /**
  * Validate a file path and throw on traversal attempt.
  * Convenience wrapper around validatePath for use in CLI commands.

package/gsd-core/bin/lib/shell-command-projection.cjs

@@ -381,6 +381,7 @@ function execGit(args, opts = {}) {
         encoding: 'utf-8',
         stdio: 'pipe',
         timeout: opts.timeout ?? 10_000,
+        windowsHide: true,
     });
     return _spawnResult(result, 'git');
 }
@@ -391,6 +392,7 @@ function execNpm(args, opts = {}) {
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'pipe'],
         timeout: opts.timeout ?? 15_000,
+        windowsHide: true,
     });
     return _spawnResult(result, 'npm');
 }
@@ -401,6 +403,7 @@ function execTool(program, args, opts = {}) {
         encoding: 'utf-8',
         stdio: 'pipe',
         timeout: opts.timeout ?? 30_000,
+        windowsHide: true,
     });
     return _spawnResult(result, program);
 }

package/gsd-core/bin/lib/validate.cjs

@@ -90,7 +90,7 @@ function buildRoadmapPhaseVariants(roadmapContent) {
     const roadmapPhaseVariants = new Set();
     // Matches both legacy numeric (Phase 1:), decimal (Phase 2.1:), milestone-prefixed (Phase 2-01:),
     // and bracket-prefixed (### [GSD] Phase 2-01:) headings.
-    const phasePattern = /#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+([\w][\w.-]*(?:-[\w.-]+)*)\s*:/gi;
+    const phasePattern = /#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+([\w][\w.-]*)\s*:/gi;
     let m;
     while ((m = phasePattern.exec(roadmapContent)) !== null) {
         roadmapPhases.add(m[1]);
@@ -102,7 +102,7 @@ function buildRoadmapPhaseVariants(roadmapContent) {
 function buildNotStartedPhaseVariants(roadmapContent) {
     const notStartedPhases = new Set();
     // Also matches milestone-prefixed and bracket-prefixed checklist items.
-    const uncheckedPattern = /-\s*\[\s\]\s*\*{0,2}Phase\s+([\w][\w.-]*(?:-[\w.-]+)*)[:\s*]/gi;
+    const uncheckedPattern = /-\s*\[\s\]\s*\*{0,2}Phase\s+([\w][\w.-]*)[:\s*]/gi;
     let um;
     while ((um = uncheckedPattern.exec(roadmapContent)) !== null) {
         for (const variant of phaseVariants(um[1]))

package/gsd-core/bin/lib/verification-command-router.cjs

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * Verification-status subcommand router.
+ * Routes `verification.status <phaseDir>` to verification.cmdVerificationStatus.
+ *
+ * Note: `verification` (reads verifier-emitted status) is distinct from `verify`
+ * (runs verification checks like plan-structure/artifacts). Keep them separate.
+ *
+ * ADR-457 build-at-publish: source in src/verification-command-router.cts,
+ * compiled to gsd-core/bin/lib/verification-command-router.cjs (gitignored).
+ */
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const cjsCommandRouterAdapter = require("./cjs-command-router-adapter.cjs");
+const { routeCjsCommandFamily } = cjsCommandRouterAdapter;
+// ─── Implementation ───────────────────────────────────────────────────────────
+const VERIFICATION_SUBCOMMANDS = ['status'];
+function routeVerificationCommand({ verification, args, cwd, raw, error, }) {
+    routeCjsCommandFamily({
+        args,
+        subcommands: VERIFICATION_SUBCOMMANDS,
+        unsupported: {},
+        error,
+        unknownMessage: (_subcommand, available) => `Unknown verification subcommand. Available: ${available.join(', ')}`,
+        handlers: {
+            status: () => verification.cmdVerificationStatus(cwd, args[2], raw),
+        },
+    });
+}
+module.exports = {
+    routeVerificationCommand,
+};