@opengsd/gsd-core 1.3.1 → 1.4.0-rc.2

package/gsd-core/bin/lib/core.cjs

@@ -506,6 +506,7 @@ function loadConfig(cwd, options = {}) {
             effort: (parsed['effort']) || null,
             fast_mode: (parsed['fast_mode']) || null,
             agent_skills: (parsed['agent_skills']) || {},
+            agent_skills_security: (parsed['agent_skills_security']) || null,
             manager: (parsed['manager']) || {},
             response_language: get('response_language') || null,
             claude_md_path: get('claude_md_path') || null,
@@ -994,35 +995,38 @@ function extractCurrentMilestone(content, cwd) {
     const firstMatch = allMatches[0];
     const selected = allMatches.find((m) => !isClosed(m[1])) || firstMatch;
     const sectionStart = selected.index;
-    const sectionMatch = selected;
-    const headingLevel = (sectionMatch[1].match(/^(#{1,3})\s/) ?? ['', '#'])[1].length;
-    const restContent = content.slice(sectionStart + sectionMatch[0].length);
-    const nextMilestonePattern = new RegExp(`^#{1,${headingLevel}}\\s+(?!Phase\\s+\\S)(?:.*v\\d+\\.\\d+|✅|📋|🚧)`, 'i');
-    let sectionEnd = content.length;
-    let fenceChar = null;
-    let fenceLen = 0;
-    let charOffset = 0;
-    for (const line of restContent.split('\n')) {
-        const fenceMatch = line.match(/^\s{0,3}((?:`{3,}|~{3,}))(.*)/);
-        if (fenceMatch) {
-            const char = fenceMatch[1][0];
-            const len = fenceMatch[1].length;
-            const trailing = fenceMatch[2] || '';
-            if (!fenceChar) {
-                fenceChar = char;
-                fenceLen = len;
+    const computeSectionEnd = (headingText, headingStart) => {
+        const level = (headingText.match(/^(#{1,3})\s/) ?? ['', '#'])[1].length;
+        const rest = content.slice(headingStart + headingText.length);
+        const stopPattern = new RegExp(`^#{1,${level}}\\s+(?!Phase\\s+\\S)(?:.*v\\d+\\.\\d+|✅|📋|🚧)`, 'i');
+        let end = content.length;
+        let fc = null;
+        let fl = 0;
+        let off = 0;
+        for (const line of rest.split('\n')) {
+            const fm = line.match(/^\s{0,3}((?:`{3,}|~{3,}))(.*)/);
+            if (fm) {
+                const ch = fm[1][0];
+                const ln = fm[1].length;
+                const trailing = fm[2] || '';
+                if (!fc) {
+                    fc = ch;
+                    fl = ln;
+                }
+                else if (ch === fc && ln >= fl && /^\s*$/.test(trailing)) {
+                    fc = null;
+                    fl = 0;
+                }
             }
-            else if (char === fenceChar && len >= fenceLen && /^\s*$/.test(trailing)) {
-                fenceChar = null;
-                fenceLen = 0;
+            else if (!fc && stopPattern.test(line)) {
+                end = headingStart + headingText.length + off;
+                break;
             }
+            off += line.length + 1;
         }
-        else if (!fenceChar && nextMilestonePattern.test(line)) {
-            sectionEnd = sectionStart + sectionMatch[0].length + charOffset;
-            break;
-        }
-        charOffset += line.length + 1;
-    }
+        return end;
+    };
+    const sectionEnd = computeSectionEnd(selected[0], sectionStart);
     const anyMilestonePattern = /^#{1,3}\s+(?!Phase\s+\S)(?:.*v\d+\.\d+|✅|📋|🚧)/im;
     const firstMilestoneMatch = content.match(anyMilestonePattern);
     const preambleCutoff = firstMilestoneMatch
@@ -1030,11 +1034,36 @@ function extractCurrentMilestone(content, cwd) {
         : firstMatch.index;
     const beforeMilestones = content.slice(0, preambleCutoff);
     const currentSection = content.slice(sectionStart, sectionEnd);
+    // Multi-milestone roadmaps split each added milestone across two version-bearing
+    // headings: a `## Phases` checklist subsection (early) and a dedicated
+    // `## Milestone … (Phase Details)` section (late) holding the `### Phase N:`
+    // detail headers. The scope window above stops at the next version-bearing
+    // heading — the current milestone's OWN Phase Details heading — leaving those
+    // detail headers outside `currentSection`. Append that section so phase
+    // resolution and counting see the current milestone's phases. Anchor the lookup
+    // to the SELECTED heading's specific version token (boundary-aware, so a
+    // `v3.0` state does not match a `v3.0-A` sub-milestone) so sibling milestones
+    // that share a version prefix do not cross-pollinate. (#730)
+    const selectedVersionToken = selected[1].match(/v\d+(?:\.\d+)+(?:[-.][A-Za-z0-9]+)*/i)?.[0];
+    const detailsVersionBoundary = selectedVersionToken
+        ? new RegExp(`${escapeRegex(selectedVersionToken)}(?![\\w.-])`, 'i')
+        : null;
+    let detailsSection = '';
+    const detailsMatch = allMatches.find((m) => /\(Phase\s+Details\)/i.test(m[1]) &&
+        !isClosed(m[1]) &&
+        (!detailsVersionBoundary || detailsVersionBoundary.test(m[1])) &&
+        (m.index ?? 0) >= sectionEnd);
+    if (detailsMatch) {
+        const detailsStart = detailsMatch.index ?? 0;
+        detailsSection = content.slice(detailsStart, computeSectionEnd(detailsMatch[0], detailsStart));
+    }
     const preamble = beforeMilestones
         .replace(/<details>[\s\S]*?<\/details>/gi, '')
         .replace(/^#{2,4}\s*Phase\s+[\w][\w.-]*\s*:[^\n]*(?:\n(?!#{1,6}\s)[^\n]*)*\n?/gim, '')
         .replace(/^#{1,4}\s*Phase Details\b[^\n]*\n?/gim, '');
-    return preamble + currentSection;
+    return detailsSection
+        ? preamble + currentSection + '\n' + detailsSection
+        : preamble + currentSection;
 }
 /**
  * Replace a pattern only in the current milestone section of ROADMAP.md.
@@ -1399,7 +1428,12 @@ const VALID_GRANULARITIES = new Set(['coarse', 'standard', 'fine']);
 /**
  * Resolve the planning granularity for a phase type (#68).
  */
-function resolveGranularityInternal(cwd, phaseType) {
+function resolveGranularityInternal(cwd, phaseType, override) {
+    if (override !== undefined && override !== null && override !== '') {
+        if (VALID_GRANULARITIES.has(override)) {
+            return override;
+        }
+    }
     const config = loadConfig(cwd);
     const configGranularities = config['granularities'];
     const perPhase = (phaseType && configGranularities && typeof configGranularities === 'object')
@@ -1418,6 +1452,15 @@ function resolveGranularityInternal(cwd, phaseType) {
     }
     return 'standard';
 }
+/**
+ * Validate a CLI granularity override at the command boundary. Empty/null/undefined
+ * are treated as "no override" (no-op). An invalid non-empty value calls `fail`.
+ */
+function assertValidGranularityOverride(override, fail) {
+    if (override !== undefined && override !== null && override !== '' && !VALID_GRANULARITIES.has(override)) {
+        fail(`invalid granularity '${override}' (valid: ${[...VALID_GRANULARITIES].join(', ')})`);
+    }
+}
 /**
  * #3024 — Resolve a model for a specific dynamic-routing attempt.
  */
@@ -1956,6 +1999,7 @@ module.exports = {
     resolveModelForTier,
     resolveGranularityInternal,
     VALID_GRANULARITIES,
+    assertValidGranularityOverride,
     resolveEffortInternal,
     resolveFastModeInternal,
     resolveEffortForTier,

package/gsd-core/bin/lib/graphify.cjs

@@ -35,7 +35,7 @@ function isGraphifyEnabled(planningDir) {
             return true;
         return false;
     }
-    catch (_e) {
+    catch {
         return false;
     }
 }
@@ -157,7 +157,7 @@ function safeReadJson(filePath) {
             return null;
         return JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }

package/gsd-core/bin/lib/init-command-router.cjs

@@ -34,8 +34,8 @@ function routeInitCommand({ init, args, cwd, raw, error }) {
                 init.cmdInitExecutePhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'] });
             },
             'plan-phase': () => {
-                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['validate', 'tdd']);
-                init.cmdInitPlanPhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'] });
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, ['granularity'], ['validate', 'tdd']);
+                init.cmdInitPlanPhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'], granularity: namedArgs['granularity'] });
             },
             'new-project': () => init.cmdInitNewProject(cwd, raw),
             'new-milestone': () => init.cmdInitNewMilestone(cwd, raw),

package/gsd-core/bin/lib/init.cjs

@@ -28,7 +28,7 @@ const security_cjs_1 = require("./security.cjs");
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- frontmatter.cjs is an export= CommonJS module
 const frontmatterMod = require("./frontmatter.cjs");
-const { loadConfig, resolveModelInternal, findPhaseInternal, getRoadmapPhaseInternal, pathExistsInternal, gitWorktreeInfoInternal, generateSlugInternal, getMilestoneInfo, getMilestonePhaseFilter, stripShippedMilestones, extractCurrentMilestone, normalizePhaseName, toPosixPath, output, error, checkAgentsInstalled, phaseTokenMatches, } = core;
+const { loadConfig, resolveModelInternal, resolveGranularityInternal, assertValidGranularityOverride, findPhaseInternal, getRoadmapPhaseInternal, pathExistsInternal, gitWorktreeInfoInternal, generateSlugInternal, getMilestoneInfo, getMilestonePhaseFilter, stripShippedMilestones, extractCurrentMilestone, normalizePhaseName, toPosixPath, output, error, checkAgentsInstalled, phaseTokenMatches, } = core;
 const { planningPaths, planningDir, planningRoot, findContextMdIn, } = planningWorkspace;
 const { determinePhaseStatus } = commandsMod;
 const { extractFrontmatter } = frontmatterMod;
@@ -297,11 +297,15 @@ function cmdInitPlanPhase(cwd, phase, raw, options = {}) {
             expectedPhaseDirPlan = toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(planningPaths(cwd).phases, dirName)));
         }
     }
+    const granularityOverride = options['granularity'];
+    assertValidGranularityOverride(granularityOverride, error);
+    const granularity = resolveGranularityInternal(cwd, 'planning', granularityOverride || undefined);
     const result = {
         researcher_model: resolveModelInternal(cwd, 'gsd-phase-researcher'),
         planner_model: resolveModelInternal(cwd, 'gsd-planner'),
         checker_model: resolveModelInternal(cwd, 'gsd-plan-checker'),
         tdd_mode: options['tdd'] || config.tdd_mode || false,
+        granularity,
         research_enabled: config.research,
         plan_checker_enabled: config.plan_checker,
         nyquist_validation_enabled: config.nyquist_validation,
@@ -1521,6 +1525,11 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
         skillPaths = [skillPaths];
     if (!Array.isArray(skillPaths) || skillPaths.length === 0)
         return '';
+    // Hoist trusted roots computation before the loop: loadTrustedGlobalRoots does
+    // realpathSync I/O and should run at most once per call, not once per failing skill.
+    // It returns [] cheaply when no roots are configured, so the realpath cost only
+    // occurs when the caller has actually set trusted_global_roots.
+    const trustedGlobalRoots = (0, security_cjs_1.loadTrustedGlobalRoots)(config);
     const validPaths = [];
     for (const skillPath of skillPaths) {
         if (typeof skillPath !== 'string')
@@ -1548,8 +1557,15 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
             }
             const pathCheck = (0, security_cjs_1.validatePath)(globalSkillMd, globalSkillsBase, { allowAbsolute: true });
             if (!pathCheck['safe']) {
-                process.stderr.write(`[agent-skills] WARNING: Global skill "${skillName}" failed path check (symlink escape?) — skipping\n`);
-                continue;
+                const acceptedViaTrustedRoot = trustedGlobalRoots.some((root) => {
+                    const rootCheck = (0, security_cjs_1.validatePath)(globalSkillMd, root, { allowAbsolute: true });
+                    return Boolean(rootCheck['safe']);
+                });
+                if (!acceptedViaTrustedRoot) {
+                    process.stderr.write(`[agent-skills] WARNING: Global skill "${skillName}" failed path check (symlink escape?) — skipping\n`);
+                    continue;
+                }
+                process.stderr.write(`[agent-skills] NOTE: Global skill "${skillName}" accepted via trusted_global_roots (resolves outside the default skills dir)\n`);
             }
             validPaths.push({ ref: `${globalSkillDir}/SKILL.md`, display: displayPath });
             continue;

package/gsd-core/bin/lib/install-profiles.cjs

@@ -351,6 +351,63 @@ function stageSkillsForRuntimeAsSkills(srcCommandsDir, resolvedProfile, converte
     ensureExitCleanup();
     return stageDir;
 }
+/**
+ * Stage converted command files as flat `.md` files.
+ *
+ * Analogous to `stageSkillsForRuntimeAsSkills` but for runtimes that use a
+ * flat commands directory (e.g. Cursor's `.cursor/commands/<name>.md`).
+ * Each source `.md` is passed through `converter` and written as a single flat
+ * `${stem}.md` file in the staging directory (no subdirectory, no prefix).
+ *
+ * The `_copyStaged` commands branch in install.js will add the prefix when
+ * copying staged files to the destination directory, so staged files must be
+ * named with just the stem (e.g. `help.md` not `gsd-help.md`).
+ *
+ * The `converter` receives `(content, ${prefix}${stem})` so it can embed the
+ * full command name (e.g. 'gsd-help') into the document body if needed.
+ *
+ * Used by the `convertedCommandsKind` layout descriptor in
+ * runtime-artifact-layout.cts (#785 — Cursor 1.6 slash commands).
+ *
+ * @param srcCommandsDir  source commands directory (e.g. commands/gsd/)
+ * @param resolvedProfile profile filter — '*' for all, Set for subset
+ * @param converter       (content, commandName) → string  pure converter
+ * @param prefix          command name prefix (for converter arg), e.g. 'gsd-'
+ */
+function stageCommandsForRuntimeFlat(srcCommandsDir, resolvedProfile, converter, prefix) {
+    if (!node_fs_1.default.existsSync(srcCommandsDir))
+        return srcCommandsDir;
+    const stageDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'gsd-profile-runtime-commands-'));
+    try {
+        const entries = node_fs_1.default.readdirSync(srcCommandsDir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            if (!entry.name.endsWith('.md'))
+                continue;
+            const stem = entry.name.slice(0, -3);
+            if (resolvedProfile.skills !== '*' && !(resolvedProfile.skills).has(stem))
+                continue;
+            const content = node_fs_1.default.readFileSync(node_path_1.default.join(srcCommandsDir, entry.name), 'utf8');
+            // Pass the full command name (with prefix) to the converter so it can
+            // reference the installed command name in the body (e.g. for descriptions).
+            // The staged file itself is named without the prefix; _copyStaged adds it.
+            const commandName = `${prefix}${stem}`;
+            const converted = converter(content, commandName);
+            node_fs_1.default.writeFileSync(node_path_1.default.join(stageDir, `${stem}.md`), converted);
+        }
+    }
+    catch (err) {
+        try {
+            node_fs_1.default.rmSync(stageDir, { recursive: true, force: true });
+        }
+        catch { /* best-effort */ }
+        throw err;
+    }
+    STAGED_DIRS.add(stageDir);
+    ensureExitCleanup();
+    return stageDir;
+}
 // ---------------------------------------------------------------------------
 // Profile marker persistence
 // ---------------------------------------------------------------------------
@@ -513,6 +570,7 @@ module.exports = {
     stageSkillsForProfile,
     stageAgentsForProfile,
     stageSkillsForRuntimeAsSkills,
+    stageCommandsForRuntimeFlat,
     STAGED_DIRS,
     readActiveProfile,
     writeActiveProfile,

package/gsd-core/bin/lib/installer-migration-report.cjs

@@ -34,7 +34,10 @@ const VALID_CHOICES = ['keep', 'remove'];
 exports.BUNDLED_GSD_HOOK_FILES = Object.freeze(new Set([
     'hooks/gsd-check-update-worker.js',
     'hooks/gsd-check-update.js',
+    'hooks/gsd-config-reload.js',
     'hooks/gsd-context-monitor.js',
+    'hooks/gsd-cursor-post-tool.js',
+    'hooks/gsd-cursor-session-start.js',
     'hooks/gsd-graphify-update.sh',
     'hooks/gsd-phase-boundary.sh',
     'hooks/gsd-prompt-guard.js',

package/gsd-core/bin/lib/installer-migrations/000-first-time-baseline.cjs

@@ -24,7 +24,7 @@ const RUNTIME_SURFACES = {
     kilo: ['gsd-core', 'command', 'skills', 'agents'],
     copilot: ['gsd-core', 'skills', 'agents'],
     antigravity: ['gsd-core', 'skills', 'agents'],
-    cursor: ['gsd-core', 'skills', 'agents'],
+    cursor: ['gsd-core', 'skills', 'agents', 'hooks', 'hooks.json'],
     windsurf: ['gsd-core', 'skills', 'agents', 'rules'],
     augment: ['gsd-core', 'skills', 'agents'],
     trae: ['gsd-core', 'skills', 'agents', 'rules'],

package/gsd-core/bin/lib/intel.cjs

@@ -59,7 +59,7 @@ function isIntelEnabled(planningDir) {
             return true;
         return false;
     }
-    catch (_e) {
+    catch {
         return false;
     }
 }
@@ -86,7 +86,7 @@ function safeReadJson(filePath) {
             return null;
         return JSON.parse(raw);
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }
@@ -101,7 +101,7 @@ function hashFile(filePath) {
             return null;
         return node_crypto_1.default.createHash('sha256').update(content).digest('hex');
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }
@@ -147,23 +147,6 @@ function matchesInValue(value, lowerTerm) {
     }
     return false;
 }
-/**
- * Search for a term in arch.md text content.
- * Returns matching lines.
- */
-function searchArchMd(filePath, term) {
-    try {
-        const content = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);
-        if (content === null)
-            return [];
-        const lowerTerm = term.toLowerCase();
-        const lines = content.split(/\r?\n/);
-        return lines.filter(line => line.toLowerCase().includes(lowerTerm));
-    }
-    catch (_e) {
-        return [];
-    }
-}
 /**
  * Query intel files for a search term.
  * Searches across all JSON intel files (keys and values) and arch.md (text lines).