@opengsd/gsd-core 1.3.1 → 1.4.0-rc.2

package/gsd-core/bin/lib/research-store.cjs

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * Research Store Module
+ *
+ * Provides deterministic cache key generation, TTL policy, path resolution,
+ * and JSON-backed put/get operations for research entries.
+ *
+ * ADR-457 build-at-publish: authored as TypeScript .cts → emits .cjs via tsc.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const DAY_MS = 86_400_000;
+// ---------------------------------------------------------------------------
+// researchKey
+// ---------------------------------------------------------------------------
+function normalize(x) {
+    if (x === null || x === undefined)
+        return '';
+    if (typeof x === 'object')
+        return JSON.stringify(x).trim().toLowerCase();
+    // After excluding null, undefined, and object, x can only be a primitive —
+    // cast through number | string | boolean to avoid no-base-to-string on unknown.
+    return `${x}`.trim().toLowerCase();
+}
+function researchKey(input) {
+    const parts = {
+        ecosystem: normalize(input.ecosystem),
+        library: normalize(input.library),
+        version: normalize(input.version),
+        query: normalize(input.query),
+        kind: normalize(input.kind),
+    };
+    const serialized = JSON.stringify(parts);
+    return node_crypto_1.default.createHash('sha256').update(serialized).digest('hex');
+}
+// ---------------------------------------------------------------------------
+// ttlForSource
+// ---------------------------------------------------------------------------
+function ttlForSource(source, confidence) {
+    if (source === 'curated' && confidence === 'HIGH')
+        return 30 * DAY_MS;
+    if (source === 'curated' && confidence === 'MEDIUM')
+        return 7 * DAY_MS;
+    return DAY_MS;
+}
+// ---------------------------------------------------------------------------
+// tierForSource / resolveStorePath
+// ---------------------------------------------------------------------------
+const CURATED_SOURCES = new Set(['curated']);
+function tierForSource(source) {
+    return CURATED_SOURCES.has(source) ? 'user' : 'project';
+}
+function resolveStorePath(cwd, source, { homeDir = node_os_1.default.homedir() } = {}) {
+    if (tierForSource(source) === 'user') {
+        return node_path_1.default.join(homeDir, '.gsd', 'research-cache');
+    }
+    return node_path_1.default.join(cwd, '.planning', 'research', '.cache');
+}
+// ---------------------------------------------------------------------------
+// isValidResearchKey
+// ---------------------------------------------------------------------------
+/**
+ * Returns true iff key is a valid 64-character lowercase hexadecimal SHA-256
+ * string (the exact shape produced by researchKey).  Any other shape —
+ * including path-traversal sequences — is rejected.
+ */
+function isValidResearchKey(key) {
+    return typeof key === 'string' && /^[0-9a-f]{64}$/.test(key);
+}
+// ---------------------------------------------------------------------------
+// putResearch
+// ---------------------------------------------------------------------------
+function putResearch(cwd, key, payload, { clock = Date, homeDir = node_os_1.default.homedir() } = {}) {
+    // Defense-in-depth: reject any key that is not a 64-char sha256 hex string.
+    if (!isValidResearchKey(key)) {
+        throw new Error('invalid research key');
+    }
+    const { content, source, provider, confidence, kind, version } = payload;
+    let ttl = ttlForSource(source, confidence);
+    // Cap TTL when version is blank/missing — a versionless curated entry must not
+    // get the long 30-day window since we can't know if it's still current.
+    if (!version) {
+        ttl = Math.min(ttl, DAY_MS);
+    }
+    const fetched_at = new Date(clock.now()).toISOString();
+    const entry = { content, source, provider, confidence, fetched_at, ttl, kind };
+    const dir = resolveStorePath(cwd, source, { homeDir });
+    // Belt-and-suspenders: ensure the resolved file path stays inside the store dir.
+    const resolvedDir = node_path_1.default.resolve(dir);
+    const filePath = node_path_1.default.join(dir, `${key}.json`);
+    const resolvedFile = node_path_1.default.resolve(filePath);
+    if (!resolvedFile.startsWith(resolvedDir + node_path_1.default.sep)) {
+        throw new Error('invalid research key');
+    }
+    node_fs_1.default.mkdirSync(dir, { recursive: true });
+    (0, shell_command_projection_cjs_1.platformWriteSync)(filePath, JSON.stringify(entry));
+    return entry;
+}
+// ---------------------------------------------------------------------------
+// getResearch
+// ---------------------------------------------------------------------------
+function getResearch(cwd, key, { clock = Date, homeDir = node_os_1.default.homedir() } = {}) {
+    // Defense-in-depth: reject any key that is not a 64-char sha256 hex string.
+    if (!isValidResearchKey(key)) {
+        return { hit: false, stale: false, entry: null };
+    }
+    try {
+        // Search both physical tiers: user (curated) and project (web/etc.)
+        const userDir = node_path_1.default.join(homeDir, '.gsd', 'research-cache');
+        const projectDir = node_path_1.default.join(cwd, '.planning', 'research', '.cache');
+        const tierDirs = [userDir, projectDir];
+        const candidates = [];
+        for (const dir of tierDirs) {
+            const resolvedDir = node_path_1.default.resolve(dir);
+            const filePath = node_path_1.default.join(dir, `${key}.json`);
+            // Belt-and-suspenders: ensure path stays inside tier dir
+            if (!node_path_1.default.resolve(filePath).startsWith(resolvedDir + node_path_1.default.sep))
+                continue;
+            if (!node_fs_1.default.existsSync(filePath))
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
+            }
+            catch {
+                // Corrupt file in this tier — skip it
+                continue;
+            }
+            // Finding 3: validate entry metadata shape before accepting as a candidate.
+            // An entry with missing/invalid fetched_at or ttl must be treated as a miss.
+            const parsedFetchedAt = Date.parse(entry.fetched_at);
+            if (!Number.isFinite(parsedFetchedAt))
+                continue;
+            if (typeof entry.ttl !== 'number' ||
+                !Number.isFinite(entry.ttl) ||
+                entry.ttl <= 0)
+                continue;
+            const age = clock.now() - parsedFetchedAt;
+            const stale = age > entry.ttl;
+            candidates.push({ entry, stale, age });
+        }
+        if (candidates.length === 0) {
+            return { hit: false, stale: false, entry: null };
+        }
+        // Prefer: non-stale over stale; among same-staleness, lowest age (most recent)
+        candidates.sort((a, b) => {
+            if (a.stale !== b.stale)
+                return a.stale ? 1 : -1; // non-stale first
+            return a.age - b.age; // lower age (more recent) first
+        });
+        const best = candidates[0];
+        return { hit: true, stale: best.stale, entry: best.entry };
+    }
+    catch {
+        return { hit: false, stale: false, entry: null };
+    }
+}
+module.exports = { isValidResearchKey, researchKey, ttlForSource, tierForSource, resolveStorePath, putResearch, getResearch };

package/gsd-core/bin/lib/roadmap-upgrade.cjs

@@ -25,8 +25,6 @@ const MIGRATED_PHASE_HEADING_RE = /^#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+\d+-\d{2}
 // Matches milestone section headings: ## v1.0, ## Roadmap v2.0, ## ✅ v1.0, ## [GSD] v1.0, etc.
 // The optional bracket-token prefix (e.g., [GSD]) must be tested before the emoji group.
 const MILESTONE_HEADING_RE = /^##\s+(?:\[[^\]]+\]\s+|Roadmap\s+|[✅🚧]\s*)?v(\d+)\.(\d+)(?:\s|:)/iu;
-// Matches checklist phase references: - [ ] **Phase N:** or - [x] **Phase N:**  (also decimal)
-const CHECKLIST_PHASE_RE = /^(\s*-\s*\[[ x]\]\s*\*{0,2})Phase\s+(\d+[A-Z]?(?:\.\d+)*)\s*:/gi;
 // ─── Pure computation helpers ─────────────────────────────────────────────────
 /**
  * Parse the ROADMAP.md content and build a list of phase entries with their
@@ -126,19 +124,6 @@ function buildNewDirName(oldDirName, newId, projectCode) {
     const newBase = slug ? `${paddedMilestone}-${subStr}-${slug}` : `${paddedMilestone}-${subStr}`;
     return projectCode ? `${projectCode}-${newBase}` : newBase;
 }
-/**
- * Read project_code from config.json if present.
- */
-function readProjectCode(configPath) {
-    try {
-        const raw = node_fs_1.default.readFileSync(configPath, 'utf8');
-        const parsed = JSON.parse(raw);
-        return typeof parsed['project_code'] === 'string' ? parsed['project_code'] : null;
-    }
-    catch {
-        return null;
-    }
-}
 // ─── computeMigrationPlan ─────────────────────────────────────────────────────
 /**
  * Compute a migration plan without touching the filesystem.
@@ -390,7 +375,7 @@ function applyMigration(cwd, plan, options = {}) {
     // ── Real run: verify clean working tree ───────────────────────────────────
     let gitStatus;
     try {
-        gitStatus = (0, node_child_process_1.execSync)('git status --porcelain', { cwd, encoding: 'utf8' });
+        gitStatus = (0, node_child_process_1.execSync)('git status --porcelain', { cwd, encoding: 'utf8', windowsHide: true });
     }
     catch (err) {
         throw new Error(`git status failed: ${err.message}`);
@@ -401,7 +386,7 @@ function applyMigration(cwd, plan, options = {}) {
     // Capture HEAD sha for rollback
     let headSha;
     try {
-        headSha = (0, node_child_process_1.execSync)('git rev-parse HEAD', { cwd, encoding: 'utf8' }).trim();
+        headSha = (0, node_child_process_1.execSync)('git rev-parse HEAD', { cwd, encoding: 'utf8', windowsHide: true }).trim();
     }
     catch (err) {
         throw new Error(`git rev-parse HEAD failed: ${err.message}`);
@@ -475,8 +460,8 @@ function applyMigration(cwd, plan, options = {}) {
     catch (err) {
         // Rollback via git reset --hard + git clean
         try {
-            (0, node_child_process_1.execSync)(`git reset --hard ${headSha}`, { cwd, stdio: 'pipe' });
-            (0, node_child_process_1.execSync)('git clean -fd .planning/phases/', { cwd, stdio: 'pipe' });
+            (0, node_child_process_1.execSync)(`git reset --hard ${headSha}`, { cwd, stdio: 'pipe', windowsHide: true });
+            (0, node_child_process_1.execSync)('git clean -fd .planning/phases/', { cwd, stdio: 'pipe', windowsHide: true });
         }
         catch {
             // Swallow rollback errors — surface original error

package/gsd-core/bin/lib/runtime-artifact-layout.cjs

@@ -18,7 +18,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = __importDefault(require("node:fs"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const installProfiles = require("./install-profiles.cjs");
-const { stageSkillsForProfile, stageAgentsForProfile, stageSkillsForRuntimeAsSkills, } = installProfiles;
+const { stageSkillsForProfile, stageAgentsForProfile, stageSkillsForRuntimeAsSkills, stageCommandsForRuntimeFlat, } = installProfiles;
 // In .cts (CommonJS output) files, `require` is available as a global.
 const _require = require;
 /**
@@ -175,6 +175,34 @@ function skillsKind(destSubpath, prefix, converterName, runtime, configDir) {
         },
     };
 }
+/**
+ * Build a converted-commands kind descriptor for runtimes that use a flat
+ * commands directory with per-file conversion (e.g. Cursor 1.6 slash commands).
+ *
+ * Unlike `commandsKind` (which passes raw source files through), this kind
+ * applies `converterName` from bin/install.js exports to each file during
+ * staging, writing flat `${prefix}${stem}.md` files to the staged directory.
+ *
+ * The staged files are then written by `_copyStaged` (commands branch) which
+ * handles prefix logic via the existing layout machinery.
+ *
+ * @param destSubpath   destination subpath within configDir (e.g. 'commands')
+ * @param prefix        filename prefix, e.g. 'gsd-'
+ * @param converterName name of converter function in bin/install.js exports
+ * @param configDir     runtime config dir (for .gsd-source marker resolution)
+ */
+function convertedCommandsKind(destSubpath, prefix, converterName, configDir) {
+    return {
+        kind: 'commands',
+        destSubpath,
+        prefix,
+        stage: (resolved) => {
+            const installExports = getInstallExports();
+            const converter = installExports[converterName];
+            return stageCommandsForRuntimeFlat(findInstallSourceRoot(configDir), resolved, converter, prefix);
+        },
+    };
+}
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -205,7 +233,14 @@ function resolveRuntimeArtifactLayout(runtime, configDir, scope = 'global') {
             }
             break;
         case 'cursor':
-            kinds = [skillsKind('skills', 'gsd-', 'convertClaudeCommandToCursorSkill', 'cursor', configDir)];
+            // Cursor 1.6+ supports two artifact surfaces:
+            //   1. skills/gsd-<name>/SKILL.md  — rich skills with frontmatter + adapter header
+            //   2. commands/gsd-<name>.md      — plain markdown slash commands (no frontmatter)
+            //      accessed via '/' in the Agent input (#785)
+            kinds = [
+                skillsKind('skills', 'gsd-', 'convertClaudeCommandToCursorSkill', 'cursor', configDir),
+                convertedCommandsKind('commands', 'gsd-', 'convertClaudeCommandToCursorCommand', configDir),
+            ];
             break;
         case 'gemini':
             kinds = [commandsKind('commands/gsd', 'gsd-', configDir)];
@@ -223,7 +258,10 @@ function resolveRuntimeArtifactLayout(runtime, configDir, scope = 'global') {
             kinds = [skillsKind('skills', 'gsd-', 'convertClaudeCommandToWindsurfSkill', 'windsurf', configDir)];
             break;
         case 'augment':
-            kinds = [skillsKind('skills', 'gsd-', 'convertClaudeCommandToAugmentSkill', 'augment', configDir)];
+            kinds = [
+                commandsKind('commands', 'gsd-', configDir),
+                skillsKind('skills', 'gsd-', 'convertClaudeCommandToAugmentSkill', 'augment', configDir),
+            ];
             break;
         case 'trae':
             kinds = [skillsKind('skills', 'gsd-', 'convertClaudeCommandToTraeSkill', 'trae', configDir)];
@@ -235,20 +273,40 @@ function resolveRuntimeArtifactLayout(runtime, configDir, scope = 'global') {
             kinds = [skillsKind('skills/gsd', '', 'convertClaudeCommandToClaudeSkill', 'hermes', configDir)];
             break;
         case 'codebuddy':
-            kinds = [skillsKind('skills', 'gsd-', 'convertClaudeCommandToCodebuddySkill', 'codebuddy', configDir)];
+            // CodeBuddy (Tencent) reads two user-level surfaces (codebuddy.ai/docs/cli):
+            //   1. commands/gsd-<name>.md      — slash commands shown in the '/' menu (#789)
+            //   2. skills/gsd-<name>/SKILL.md  — model-invocable skills, emitted with
+            //      user-invocable:false so they stay OUT of '/' (the commands surface is
+            //      the sole '/' entry point) — avoids a duplicated /gsd-* per workflow.
+            // Subagents (~/.codebuddy/agents/) are already emitted by the generic agents
+            // block in bin/install.js; MCP is excluded (gsd ships no MCP server).
+            kinds = [
+                convertedCommandsKind('commands', 'gsd-', 'convertClaudeCommandToCodebuddyCommand', configDir),
+                skillsKind('skills', 'gsd-', 'convertClaudeCommandToCodebuddySkill', 'codebuddy', configDir),
+            ];
             break;
         case 'cline':
-            kinds = [];
+            kinds = scope === 'global' ? [skillsKind('skills', 'gsd-', 'convertClaudeCommandToClineSkill', 'cline', configDir)] : [];
             break;
         case 'opencode':
-            kinds = [commandsKind('command', 'gsd-', configDir)];
+            // OpenCode reads flat slash commands from command/ and on-demand skills
+            // from skills/<name>/SKILL.md (https://opencode.ai/docs/skills). Emit both.
+            kinds = [
+                commandsKind('command', 'gsd-', configDir),
+                skillsKind('skills', 'gsd-', 'convertClaudeCommandToOpencodeSkill', 'opencode', configDir),
+            ];
             break;
         case 'kilo':
-            kinds = [commandsKind('command', 'gsd-', configDir)];
+            // Kilo derives from OpenCode and shares the skills/<name>/SKILL.md layout
+            // (https://kilo.ai/docs/customize/skills). Emit flat commands + skills.
+            kinds = [
+                commandsKind('command', 'gsd-', configDir),
+                skillsKind('skills', 'gsd-', 'convertClaudeCommandToKiloSkill', 'kilo', configDir),
+            ];
             break;
         default:
             throw new TypeError(`Unknown runtime: '${runtime}' — add to runtime-artifact-layout.cjs table`);
     }
-    return { runtime, configDir, kinds };
+    return { runtime, configDir, scope, kinds };
 }
-module.exports = { resolveRuntimeArtifactLayout, findInstallSourceRoot };
+module.exports = { resolveRuntimeArtifactLayout, findInstallSourceRoot, getInstallExports };

package/gsd-core/bin/lib/runtime-config-adapter-registry.cjs

@@ -0,0 +1,56 @@
+'use strict';
+// ---------------------------------------------------------------------------
+// Registry
+// ---------------------------------------------------------------------------
+const REGISTRY = Object.freeze({
+    claude: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: true, finishPermissionWriter: null }),
+    gemini: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: true, finishPermissionWriter: null }),
+    antigravity: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: true, finishPermissionWriter: null }),
+    augment: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: true, finishPermissionWriter: null }),
+    qwen: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: true, finishPermissionWriter: null }),
+    hermes: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: true, finishPermissionWriter: null }),
+    codebuddy: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: true, finishPermissionWriter: null }),
+    opencode: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: true, finishPermissionWriter: 'opencode' }),
+    kilo: Object.freeze({ installSurface: 'settings-json', writesSharedSettings: false, finishPermissionWriter: 'kilo' }),
+    codex: Object.freeze({ installSurface: 'codex-toml', writesSharedSettings: false, finishPermissionWriter: null }),
+    copilot: Object.freeze({ installSurface: 'copilot-instructions', writesSharedSettings: false, finishPermissionWriter: null }),
+    cline: Object.freeze({ installSurface: 'cline-rules', writesSharedSettings: false, finishPermissionWriter: null }),
+    cursor: Object.freeze({ installSurface: 'cursor-hooks-json', writesSharedSettings: false, finishPermissionWriter: null }),
+    windsurf: Object.freeze({ installSurface: 'profile-marker-only', writesSharedSettings: false, finishPermissionWriter: null }),
+    trae: Object.freeze({ installSurface: 'profile-marker-only', writesSharedSettings: false, finishPermissionWriter: null }),
+});
+// ---------------------------------------------------------------------------
+// Exports
+// ---------------------------------------------------------------------------
+/** The complete set of 15 supported runtimes for config-adapter dispatch. */
+const ALLOWED_CONFIG_RUNTIMES = new Set(Object.keys(REGISTRY));
+/** All valid installSurface values. */
+const INSTALL_SURFACES = Object.freeze([
+    'settings-json',
+    'codex-toml',
+    'copilot-instructions',
+    'cline-rules',
+    'cursor-hooks-json',
+    'profile-marker-only',
+]);
+/**
+ * Resolve the config adapter intent for a given runtime.
+ *
+ * Returns a fresh object each call so callers cannot poison the registry by
+ * mutating the returned value.
+ *
+ * @throws {TypeError} if runtime is not a known supported runtime.
+ */
+function resolveRuntimeConfigIntent(runtime) {
+    if (!Object.hasOwn(REGISTRY, runtime)) {
+        throw new TypeError(`Unknown runtime for config adapter: ${runtime}`);
+    }
+    const entry = REGISTRY[runtime];
+    return {
+        runtime,
+        installSurface: entry.installSurface,
+        writesSharedSettings: entry.writesSharedSettings,
+        finishPermissionWriter: entry.finishPermissionWriter,
+    };
+}
+module.exports = { resolveRuntimeConfigIntent, ALLOWED_CONFIG_RUNTIMES, INSTALL_SURFACES };

package/gsd-core/bin/lib/runtime-homes.cjs

@@ -12,9 +12,9 @@
  * Runtime-specific notes:
  *   hermes  — GSD skills nest under skills/gsd/<skillName>/ (not the flat
  *             skills/<skillName>/ layout used by all other runtimes).
- *   cline   — Rules-based; commands are embedded in .clinerules. Cline does
- *             not use a skills/ directory. getGlobalSkillDir() returns null
- *             for cline so the caller can emit an appropriate warning.
+ *   cline   — Skills-capable since v3.48.0 (#782). SKILL.md files live at
+ *             ~/.cline/skills/<skillName>/SKILL.md (same flat layout as cursor/codex).
+ *             .clinerules is also emitted (rules-based compatibility layer).
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -62,8 +62,15 @@ function resolveAntigravityGlobalDir(opts = {}) {
 /**
  * Return the global config base directory for the given runtime.
  * Respects the same env-var overrides as bin/install.js getGlobalDir().
+ *
+ * @param runtime   - The runtime identifier (e.g. 'claude', 'opencode').
+ * @param explicitDir - If provided and non-empty, returned immediately after
+ *   tilde-expansion, overriding all env-var and default logic. This matches
+ *   the behaviour of bin/install.js getGlobalDir(runtime, explicitDir).
  */
-function getGlobalConfigDir(runtime) {
+function getGlobalConfigDir(runtime, explicitDir) {
+    if (explicitDir)
+        return expandTilde(explicitDir);
     const home = node_os_1.default.homedir();
     const env = process.env;
     switch (runtime) {
@@ -84,7 +91,11 @@ function getGlobalConfigDir(runtime) {
             return env['GROK_AGENTS_HOME'] ? expandTilde(env['GROK_AGENTS_HOME']) : node_path_1.default.join(home, '.agents');
         // ── Copilot (VS Code) ────────────────────────────────────────────────────
         case 'copilot':
-            return env['COPILOT_CONFIG_DIR'] ? expandTilde(env['COPILOT_CONFIG_DIR']) : node_path_1.default.join(home, '.copilot');
+            if (env['COPILOT_CONFIG_DIR'])
+                return expandTilde(env['COPILOT_CONFIG_DIR']);
+            if (env['COPILOT_HOME'])
+                return expandTilde(env['COPILOT_HOME']);
+            return node_path_1.default.join(home, '.copilot');
         // ── Antigravity ──────────────────────────────────────────────────────────
         case 'antigravity':
             return resolveAntigravityGlobalDir({ env, home });
@@ -115,6 +126,8 @@ function getGlobalConfigDir(runtime) {
         case 'opencode': {
             if (env['OPENCODE_CONFIG_DIR'])
                 return expandTilde(env['OPENCODE_CONFIG_DIR']);
+            if (env['OPENCODE_CONFIG'])
+                return node_path_1.default.dirname(expandTilde(env['OPENCODE_CONFIG']));
             if (env['XDG_CONFIG_HOME'])
                 return node_path_1.default.join(expandTilde(env['XDG_CONFIG_HOME']), 'opencode');
             return node_path_1.default.join(home, '.config', 'opencode');
@@ -123,6 +136,8 @@ function getGlobalConfigDir(runtime) {
         case 'kilo': {
             if (env['KILO_CONFIG_DIR'])
                 return expandTilde(env['KILO_CONFIG_DIR']);
+            if (env['KILO_CONFIG'])
+                return node_path_1.default.dirname(expandTilde(env['KILO_CONFIG']));
             if (env['XDG_CONFIG_HOME'])
                 return node_path_1.default.join(expandTilde(env['XDG_CONFIG_HOME']), 'kilo');
             return node_path_1.default.join(home, '.config', 'kilo');
@@ -136,19 +151,25 @@ function getGlobalConfigDir(runtime) {
  * Return the global skills base directory for the given runtime.
  * Most runtimes: <configDir>/skills
  * Hermes: <configDir>/skills/gsd  (nested category layout — #2841)
- * Cline:  null (rules-based, no skills directory)
+ * Cline ≥ v3.48.0: <configDir>/skills  (SKILL.md-based global skills — #782)
  */
 function getGlobalSkillsBase(runtime) {
-    if (runtime === 'cline')
-        return null;
-    const configDir = getGlobalConfigDir(runtime);
-    if (runtime === 'hermes')
+    if (runtime === 'hermes') {
+        const configDir = getGlobalConfigDir(runtime);
         return node_path_1.default.join(configDir, 'skills', 'gsd');
+    }
+    // Kilo Code discovers global skills from ~/.kilo/skills/ (HOME-relative),
+    // independent of the XDG-based config dir (~/.config/kilo) used for commands.
+    // See: https://kilo.ai/docs/customize/skills
+    // "Global skills are located in the `.kilo` directory within your Home
+    //  directory: ~/.kilo/skills/"
+    if (runtime === 'kilo')
+        return node_path_1.default.join(node_os_1.default.homedir(), '.kilo', 'skills');
+    const configDir = getGlobalConfigDir(runtime);
     return node_path_1.default.join(configDir, 'skills');
 }
 /**
  * Return the full path to a specific skill's directory for the given runtime.
- * Returns null for runtimes that don't use a skills directory (cline).
  */
 function getGlobalSkillDir(runtime, skillName) {
     const base = getGlobalSkillsBase(runtime);

package/gsd-core/bin/lib/security.cjs

@@ -24,6 +24,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MARKDOWN_LINK_PATTERNS = exports.INJECTION_PATTERNS = void 0;
 exports.validatePath = validatePath;
+exports.loadTrustedGlobalRoots = loadTrustedGlobalRoots;
 exports.requireSafePath = requireSafePath;
 exports.scanForInjection = scanForInjection;
 exports.sanitizeForPrompt = sanitizeForPrompt;
@@ -35,6 +36,7 @@ exports.validateFieldName = validateFieldName;
 exports.validatePromptStructure = validatePromptStructure;
 exports.scanEntropyAnomalies = scanEntropyAnomalies;
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 // ─── Path Traversal Prevention ──────────────────────────────────────────────
 /**
@@ -92,6 +94,77 @@ function validatePath(filePath, baseDir, opts = {}) {
     }
     return { safe: true, resolved: resolvedPath };
 }
+/**
+ * Load the opt-in trusted global roots allowlist from config.
+ *
+ * Reads `config.agent_skills_security.trusted_global_roots` (an array of
+ * path strings). Each entry is canonicalized via realpathSync: non-strings
+ * are dropped, leading `~/` is expanded to `os.homedir()`, entries that are
+ * not absolute after expansion are dropped (project-relative paths are
+ * rejected as a security boundary), and entries that do not exist on disk are
+ * dropped (a non-existent root is not trustworthy). The canonical realpath is
+ * used for all subsequent checks and as the stored value — this closes the
+ * case-insensitive bypass on macOS APFS (`/users/alice` vs `/Users/alice`)
+ * and ensures trust doesn't drift across re-invocations if a root is
+ * re-created at a different target. Results are de-duplicated by canonical path.
+ */
+function loadTrustedGlobalRoots(config) {
+    const roots = config?.['agent_skills_security'];
+    const raw = roots?.['trusted_global_roots'];
+    if (!Array.isArray(raw))
+        return [];
+    // Compute canonical homedir once for case-insensitive-safe comparison.
+    let realHome;
+    try {
+        realHome = node_fs_1.default.realpathSync(node_os_1.default.homedir());
+    }
+    catch {
+        realHome = node_os_1.default.homedir();
+    }
+    const seen = new Set();
+    const result = [];
+    for (const entry of raw) {
+        if (typeof entry !== 'string')
+            continue;
+        let expanded;
+        if (entry === '~') {
+            expanded = node_os_1.default.homedir();
+        }
+        else if (entry.startsWith('~/')) {
+            expanded = node_path_1.default.join(node_os_1.default.homedir(), entry.slice(2));
+        }
+        else {
+            expanded = entry;
+        }
+        if (!node_path_1.default.isAbsolute(expanded))
+            continue; // reject project-relative
+        // Canonicalize: resolve symlinks and normalise case. If the path doesn't
+        // exist or can't be read, skip it — a non-existent root is not trustworthy.
+        let real;
+        try {
+            real = node_fs_1.default.realpathSync(expanded);
+        }
+        catch {
+            continue; // non-existent or unreadable — skip
+        }
+        // Reject dangerously broad roots: filesystem root (e.g. '/' or 'C:\' or UNC '\\server\share').
+        // Normalize both sides by stripping trailing path separators before comparing so that
+        // Windows UNC shares (where path.parse().root includes a trailing separator) are caught.
+        const stripTrailingSep = (p) => p.replace(/[\\/]+$/, '');
+        if (stripTrailingSep(node_path_1.default.parse(real).root) === stripTrailingSep(real))
+            continue;
+        // Reject homedir itself (canonical compare closes case-insensitive bypass).
+        // Apply stripTrailingSep for robustness on platforms where realpathSync may
+        // or may not include a trailing separator on the homedir path.
+        if (stripTrailingSep(real) === stripTrailingSep(realHome))
+            continue;
+        if (seen.has(real))
+            continue;
+        seen.add(real);
+        result.push(real);
+    }
+    return result;
+}
 /**
  * Validate a file path and throw on traversal attempt.
  * Convenience wrapper around validatePath for use in CLI commands.

package/gsd-core/bin/lib/shell-command-projection.cjs

@@ -153,6 +153,7 @@ function projectManagedHookCommand({ absoluteRunner, scriptPath, runtime = 'gene
 const MANAGED_HOOK_BASENAMES_BY_SURFACE = {
     'settings-json': new Set([
         'gsd-check-update.js',
+        'gsd-config-reload.js',
         'gsd-statusline.js',
         'gsd-context-monitor.js',
         'gsd-prompt-guard.js',
@@ -168,6 +169,7 @@ const MANAGED_HOOK_BASENAMES_BY_SURFACE = {
 const MANAGED_HOOK_COMMAND_BASENAMES_BY_SURFACE = {
     'settings-json': new Set([
         'gsd-check-update.js',
+        'gsd-config-reload.js',
         'gsd-statusline.js',
         'gsd-context-monitor.js',
         'gsd-prompt-guard.js',
@@ -188,6 +190,10 @@ const MANAGED_HOOK_COMMAND_BASENAMES_BY_SURFACE = {
         // reconcileCodexHooksJsonSessionStart can replace stale node-runner commands
         // with the .cmd shim on reinstall (and vice-versa on cross-platform moves).
         'gsd-check-update.cmd',
+        // #772: context-monitor is now registered for Codex SubagentStart/Stop/PostToolUse.
+        'gsd-context-monitor.js',
+        // #772: Windows .cmd shim for gsd-context-monitor — same #3426 pattern.
+        'gsd-context-monitor.cmd',
     ]),
 };
 const LEGACY_MANAGED_HOOK_ALIASES_BY_SURFACE = {
@@ -381,6 +387,7 @@ function execGit(args, opts = {}) {
         encoding: 'utf-8',
         stdio: 'pipe',
         timeout: opts.timeout ?? 10_000,
+        windowsHide: true,
     });
     return _spawnResult(result, 'git');
 }
@@ -391,6 +398,7 @@ function execNpm(args, opts = {}) {
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'pipe'],
         timeout: opts.timeout ?? 15_000,
+        windowsHide: true,
     });
     return _spawnResult(result, 'npm');
 }
@@ -401,6 +409,7 @@ function execTool(program, args, opts = {}) {
         encoding: 'utf-8',
         stdio: 'pipe',
         timeout: opts.timeout ?? 30_000,
+        windowsHide: true,
     });
     return _spawnResult(result, program);
 }