@opengsd/gsd-core 1.4.1 → 1.4.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gsd-core",
   "displayName": "GSD Core",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "author": {
     "name": "open-gsd",

package/bin/install.js

@@ -8496,6 +8496,52 @@ function uninstall(isGlobal, runtime = 'claude') {
     }
   }
 
+  // 4a. Remove scripts/changeset/ and scripts/lib/ (#935)
+  // GSD-managed files only: enumerate the exact set the installer writes.
+  // Any file NOT in this set is user-owned and must survive uninstall.
+  // After removing GSD files, attempt to rmdir — if the directory is still
+  // non-empty (user has custom helpers) it stays; otherwise it goes cleanly.
+  const GSD_CHANGESET_FILES = [
+    'cli.cjs', 'parse.cjs', 'render.cjs', 'serialize.cjs',
+    'github-release-notes.cjs', 'lint.cjs', 'new.cjs',
+    'README.md', // documentation only — not user-authored
+  ];
+  const GSD_SCRIPTS_LIB_FILES = ['cli-exit.cjs', 'allowlist-ratchet.cjs'];
+
+  const changesetUninstallDir = path.join(targetDir, 'scripts', 'changeset');
+  if (fs.existsSync(changesetUninstallDir)) {
+    let removedChangeset = 0;
+    for (const file of GSD_CHANGESET_FILES) {
+      const fp = path.join(changesetUninstallDir, file);
+      try { fs.unlinkSync(fp); removedChangeset++; } catch (_) { /* best-effort */ }
+    }
+    // Remove directory if empty after our cleanup
+    try { fs.rmdirSync(changesetUninstallDir); } catch (_) { /* Not empty — user content present */ }
+    if (removedChangeset > 0) {
+      removedCount++;
+      console.log(`  ${green}✓${reset} Removed scripts/changeset/ GSD files`);
+    }
+  }
+  const scriptsLibUninstallDir = path.join(targetDir, 'scripts', 'lib');
+  if (fs.existsSync(scriptsLibUninstallDir)) {
+    let removedScriptsLib = 0;
+    for (const file of GSD_SCRIPTS_LIB_FILES) {
+      const fp = path.join(scriptsLibUninstallDir, file);
+      try { fs.unlinkSync(fp); removedScriptsLib++; } catch (_) { /* best-effort */ }
+    }
+    // Remove directory if empty after our cleanup
+    try { fs.rmdirSync(scriptsLibUninstallDir); } catch (_) { /* Not empty — user content present */ }
+    if (removedScriptsLib > 0) {
+      removedCount++;
+      console.log(`  ${green}✓${reset} Removed scripts/lib/ GSD files`);
+    }
+  }
+  // If scripts/ dir is now empty, remove it too
+  const scriptsUninstallDir = path.join(targetDir, 'scripts');
+  if (fs.existsSync(scriptsUninstallDir)) {
+    try { fs.rmdirSync(scriptsUninstallDir); } catch (_) { /* Not empty — leave it */ }
+  }
+
   // 5. Remove GSD package.json (CommonJS mode marker)
   const pkgJsonPath = path.join(targetDir, 'package.json');
   if (fs.existsSync(pkgJsonPath)) {
@@ -9169,6 +9215,24 @@ function writeManifest(configDir, runtime = 'claude', options = {}) {
     }
   }
 
+  // Track scripts/changeset/ and scripts/lib/ so saveLocalPatches() can detect drift
+  const changesetInstallDir = path.join(configDir, 'scripts', 'changeset');
+  if (fs.existsSync(changesetInstallDir)) {
+    for (const file of fs.readdirSync(changesetInstallDir)) {
+      if (file.endsWith('.cjs')) {
+        manifest.files['scripts/changeset/' + file] = fileHash(path.join(changesetInstallDir, file));
+      }
+    }
+  }
+  const scriptsLibInstallDir = path.join(configDir, 'scripts', 'lib');
+  if (fs.existsSync(scriptsLibInstallDir)) {
+    for (const file of fs.readdirSync(scriptsLibInstallDir)) {
+      if (file.endsWith('.cjs')) {
+        manifest.files['scripts/lib/' + file] = fileHash(path.join(scriptsLibInstallDir, file));
+      }
+    }
+  }
+
   fs.writeFileSync(path.join(configDir, MANIFEST_NAME), JSON.stringify(manifest, null, 2));
   return manifest;
 }
@@ -10446,6 +10510,64 @@ function install(isGlobal, runtime = 'claude', options = {}) {
     console.log(`  ${green}✓${reset} Installed hooks/lib/ helpers (git-cmd, graphify-rebuild, ...)`);
   }
 
+  // Install scripts/changeset/ and scripts/lib/ into <configDir>/scripts/
+  // so that `node "$GSD_DIR/scripts/changeset/cli.cjs"` resolves at runtime.
+  //
+  // The changeset CLI (scripts/changeset/cli.cjs) is invoked by the update
+  // workflow (gsd-core/workflows/update.md) to extract changelog ranges for
+  // the /gsd-update preview step. It was previously only present in the npm
+  // tarball root but never copied to the runtime config dir, causing the
+  // preview to always silently fail (#935).
+  //
+  // cli.cjs requires:
+  //   - sibling files in scripts/changeset/ (parse/render/serialize/github-release-notes)
+  //   - ../lib/cli-exit.cjs  → scripts/lib/cli-exit.cjs
+  //   - ../../gsd-core/bin/lib/semver-compare.cjs  (already installed under gsd-core/)
+  //   - ../../gsd-core/bin/lib/package-identity.cjs (already installed under gsd-core/)
+  //
+  // All runtimes that use the update workflow need this, so we copy unconditionally
+  // (same scope as gsd-core/ itself — every runtime that installs workflows gets it).
+  const changesetSrc = path.join(src, 'scripts', 'changeset');
+  const scriptsLibSrc = path.join(src, 'scripts', 'lib');
+  if (!fs.existsSync(changesetSrc)) {
+    // The changeset CLI source is missing from the package — mark as a hard failure
+    // so the user knows the changelog preview will not work rather than silently degrading.
+    failures.push('scripts/changeset/ (source missing from package — reinstall from npm)');
+  } else {
+    const changesetDest = path.join(targetDir, 'scripts', 'changeset');
+    const scriptsLibDest = path.join(targetDir, 'scripts', 'lib');
+    fs.mkdirSync(changesetDest, { recursive: true });
+    fs.mkdirSync(scriptsLibDest, { recursive: true });
+    // Copy scripts/changeset/ — all .cjs and .md files
+    for (const entry of fs.readdirSync(changesetSrc)) {
+      const srcFile = path.join(changesetSrc, entry);
+      if (fs.statSync(srcFile).isFile()) {
+        fs.copyFileSync(srcFile, path.join(changesetDest, entry));
+      }
+    }
+    // Copy scripts/lib/ — cli-exit.cjs (required by cli.cjs) and any future lib helpers.
+    // Hard-fail if missing: without cli-exit.cjs the installed CLI throws MODULE_NOT_FOUND.
+    if (!fs.existsSync(scriptsLibSrc)) {
+      failures.push('scripts/lib/ (source missing from package — reinstall from npm)');
+    } else {
+      for (const entry of fs.readdirSync(scriptsLibSrc)) {
+        const srcFile = path.join(scriptsLibSrc, entry);
+        if (fs.statSync(srcFile).isFile()) {
+          fs.copyFileSync(srcFile, path.join(scriptsLibDest, entry));
+        }
+      }
+      // Verify the critical dep cli-exit.cjs landed
+      if (!verifyFileInstalled(path.join(scriptsLibDest, 'cli-exit.cjs'), 'scripts/lib/cli-exit.cjs')) {
+        failures.push('scripts/lib/cli-exit.cjs');
+      }
+    }
+    if (verifyFileInstalled(path.join(changesetDest, 'cli.cjs'), 'scripts/changeset/cli.cjs')) {
+      console.log(`  ${green}✓${reset} Installed scripts/changeset/ (changelog preview CLI)`);
+    } else {
+      failures.push('scripts/changeset/cli.cjs');
+    }
+  }
+
   // Remove legacy get-shit-done-cc artifacts and stale update caches (#607).
   // cleanupLegacyGsdCc handles both the legacy shared cache and the per-package
   // cache (formerly an inline unlinkSync here). A cleanup failure must never

package/commands/gsd/autonomous.md

@@ -2,7 +2,6 @@
 name: gsd:autonomous
 description: Run all remaining phases autonomously — discuss→plan→execute per phase
 argument-hint: "[--from N] [--to N] [--only N] [--interactive]"
-context: fork
 effort: xhigh
 allowed-tools:
   - Read

package/commands/gsd/execute-phase.md

@@ -2,7 +2,6 @@
 name: gsd:execute-phase
 description: Execute all plans in a phase with wave-based parallelization
 argument-hint: "<phase-number> [--wave N] [--gaps-only] [--interactive] [--tdd]"
-context: fork
 effort: xhigh
 allowed-tools:
   - Read

package/commands/gsd/plan-phase.md

@@ -2,7 +2,6 @@
 name: gsd:plan-phase
 description: Create detailed phase plan (PLAN.md) with verification loop
 argument-hint: "[phase] [--auto] [--research] [--skip-research] [--research-phase <N>] [--view] [--gaps] [--skip-verify] [--prd <file>] [--ingest <path-or-glob>] [--ingest-format <auto|nygard|madr|narrative>] [--reviews] [--text] [--tdd] [--mvp]"
-context: fork
 effort: xhigh
 allowed-tools:
   - Read

package/commands/gsd/plan-review-convergence.md

@@ -17,11 +17,11 @@ requires: [phase, review]
 Cross-AI plan convergence loop — an outer revision gate around gsd-review and gsd-planner.
 Repeatedly: review plans with external AI CLIs → if HIGH concerns found → replan with --reviews feedback → re-review. Stops when no HIGH concerns remain or max cycles reached.
 
-**Flow:** Agent→Skill("gsd-plan-phase") → Agent→Skill("gsd-review") → check HIGHs → Agent→Skill("gsd-plan-phase --reviews") → Agent→Skill("gsd-review") → ... → Converge or escalate
+**Flow:** Skill("gsd-plan-phase") → Agent→Skill("gsd-review") → check HIGHs → Skill("gsd-plan-phase --reviews") → Agent→Skill("gsd-review") → ... → Converge or escalate
 
-Replaces gsd-plan-phase's internal gsd-plan-checker with external AI reviewers (codex, gemini, etc.). Each step runs inside an isolated Agent that calls the corresponding existing Skill — orchestrator only does loop control.
+Replaces gsd-plan-phase's internal gsd-plan-checker with external AI reviewers (codex, gemini, etc.). Plan-phase runs **inline** (bare Skill at depth 0) so it can spawn gsd-planner/gsd-plan-checker at depth 1. Review runs inside an isolated Agent (gsd-review is a Bash leaf — no sub-agents needed). Orchestrator only does loop control.
 
-**Orchestrator role:** Parse arguments, validate phase, spawn Agents for existing Skills, check HIGHs, stall detection, escalation gate.
+**Orchestrator role:** Parse arguments, validate phase, run plan-phase inline (Skill at depth 0), spawn an Agent for gsd-review, check HIGHs, stall detection, escalation gate.
 </objective>
 
 <execution_context>

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-core",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "GSD Core — a meta-prompting, context engineering, and spec-driven development system for AI coding agents. Loads gsd's operating context into every Gemini CLI session.",
   "contextFileName": "GEMINI.md"
 }

package/gsd-core/bin/lib/installer-migrations/004-prune-stale-pristine-snapshots.cjs

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Installer migration 004: remove stale gsd-pristine/get-shit-done/ snapshot // gsd-allow-legacy-name
+ * files after the get-shit-done → gsd-core rename (#604, #934). // gsd-allow-legacy-name
+ *
+ * Background: migration 003 removed legacy runtime files from
+ * get-shit-done/ but did not touch gsd-pristine/get-shit-done/, the // gsd-allow-legacy-name
+ * parallel directory that holds pristine snapshots captured before the rename.
+ * These snapshot files are GSD-managed (written by the installer, never by the
+ * user) and reference stale get-shit-done/... key paths that no longer exist // gsd-allow-legacy-name
+ * in the active layout. When verify-reapply-patches.cjs looks up a backup entry
+ * keyed under gsd-core/... it finds no matching gsd-pristine/ snapshot, falls
+ * to over-broad mode, and reports false FAIL_INSTALLED_MISSING / // gsd-allow-legacy-name
+ * FAIL_USER_LINES_MISSING for every backed-up pre-rename file (#934).
+ *
+ * Fix: walk gsd-pristine/get-shit-done/ and emit remove-managed for each file. // gsd-allow-legacy-name
+ * These files are always GSD-written snapshots — users never place their own
+ * files inside gsd-pristine/ — so the classification override
+ * (managed-pristine) is safe: there is no user content to protect.
+ *
+ * Checksum safety: migration 003's body is left untouched.  Adding this
+ * separate migration avoids modifying 003's checksum, which would break
+ * upgrade state for any user who already applied 003 (root cause of #670).
+ *
+ * Per-file approach: the migration framework has no recursive directory-removal
+ * primitive — all actions operate on individual files. Empty directory shells
+ * left after removal can be cleaned up manually; this is the intentional ADR-0008
+ * limitation.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+function walkPristineFiles(root, relDir, baseResolved, results) {
+    const dir = node_path_1.default.join(root, relDir);
+    let entries;
+    try {
+        entries = node_fs_1.default.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return; // directory absent or unreadable — nothing to do
+    }
+    for (const entry of entries) {
+        // Do not follow symlinks — skip to avoid out-of-tree traversal.
+        if (entry.isSymbolicLink())
+            continue;
+        const relPath = node_path_1.default.posix.join(relDir, entry.name);
+        // Bounds check: ensure the resolved path stays under configDir.
+        const resolved = node_path_1.default.resolve(root, relPath);
+        if (resolved !== baseResolved && !resolved.startsWith(baseResolved + node_path_1.default.sep))
+            continue;
+        if (entry.isDirectory()) {
+            walkPristineFiles(root, relPath, baseResolved, results);
+        }
+        else if (entry.isFile()) {
+            results.push(relPath);
+        }
+    }
+}
+const REASON = 'stale pristine snapshot from legacy get-shit-done/ dir, orphaned by rename migration 003 (#604, #934)'; // gsd-allow-legacy-name
+const migration = {
+    id: '2026-06-09-prune-stale-pristine-get-shit-done', // gsd-allow-legacy-name
+    title: 'Remove stale gsd-pristine/get-shit-done/ snapshot files (#934)', // gsd-allow-legacy-name
+    description: 'Migration 003 removed runtime files from get-shit-done/ but left the matching pristine snapshot ' + // gsd-allow-legacy-name
+        'directory gsd-pristine/get-shit-done/ intact. Those snapshots reference stale key paths and cause ' + // gsd-allow-legacy-name
+        'verify-reapply-patches false positives (#934). Remove all files under gsd-pristine/get-shit-done/ ' + // gsd-allow-legacy-name
+        'as they are GSD-managed snapshots, never user content.',
+    introducedIn: '1.4.3',
+    scopes: ['global', 'local'],
+    destructive: true,
+    plan(ctx) {
+        const pristineGsdRoot = node_path_1.default.join(ctx.configDir, 'gsd-pristine', 'get-shit-done'); // gsd-allow-legacy-name
+        // Idempotency: if the stale pristine subdir doesn't exist, nothing to do.
+        if (!node_fs_1.default.existsSync(pristineGsdRoot))
+            return [];
+        // Safety: reject symlinks in ANY ancestor component of the path we will walk
+        // to prevent following a symlink out of configDir.  Check both gsd-pristine/
+        // and gsd-pristine/get-shit-done/ — either being a symlink could redirect // gsd-allow-legacy-name
+        // the walk to an out-of-tree location.
+        const pristineParent = node_path_1.default.join(ctx.configDir, 'gsd-pristine');
+        try {
+            if (node_fs_1.default.lstatSync(pristineParent).isSymbolicLink())
+                return [];
+        }
+        catch {
+            return [];
+        }
+        try {
+            if (node_fs_1.default.lstatSync(pristineGsdRoot).isSymbolicLink())
+                return []; // gsd-allow-legacy-name
+        }
+        catch {
+            return [];
+        }
+        const baseResolved = node_path_1.default.resolve(ctx.configDir);
+        const relPaths = [];
+        walkPristineFiles(ctx.configDir, node_path_1.default.posix.join('gsd-pristine', 'get-shit-done'), baseResolved, relPaths); // gsd-allow-legacy-name
+        const actions = [];
+        for (const relPath of relPaths) {
+            // Bounds-check each relPath before emitting any action.
+            const resolved = node_path_1.default.resolve(ctx.configDir, relPath);
+            if (resolved !== baseResolved && !resolved.startsWith(baseResolved + node_path_1.default.sep))
+                continue;
+            // These files are GSD-managed pristine snapshots — the installer writes
+            // them during install/upgrade; users never place personal files inside
+            // gsd-pristine/.  Pass classification: 'managed-pristine' explicitly so
+            // the framework does not downgrade remove-managed to preserve-user when
+            // the manifest has no entry (these paths were never in the manifest since
+            // they live under gsd-pristine/, not the tracked runtime dir).
+            actions.push({
+                type: 'remove-managed',
+                relPath,
+                reason: REASON,
+                ownershipEvidence: 'GSD-written pristine snapshot under gsd-pristine/get-shit-done/; ' + // gsd-allow-legacy-name
+                    'installer is the sole author of gsd-pristine/ contents; no user content lives here',
+                classification: 'managed-pristine',
+            });
+        }
+        return actions;
+    },
+};
+module.exports = migration;

package/gsd-core/bin/verify-reapply-patches.cjs

@@ -165,6 +165,19 @@ const REASON = Object.freeze({
   // resolve this file; the guard here ensures the gate does not report spurious
   // failures in the meantime.
   OK_PRISTINE_DRIFT_DETECTED: 'ok_pristine_drift_detected',
+  // Bug #934: backup-meta.json records a pristine_hash for this file but the
+  // gsd-pristine/ file is absent from disk.  This happens on post-#604-rename
+  // installs where saveLocalPatches discarded the only pristine candidate
+  // because its hash did not match the old-release hash (the file changed
+  // upstream between releases).  Without a baseline the verifier cannot
+  // distinguish user-added lines from upstream-changed lines, so falling to
+  // over-broad mode would produce FAIL_USER_LINES_MISSING false positives for
+  // every upstream-removed line.  The correct posture is advisory/non-blocking:
+  // report OK_NO_BASELINE so the caller can log a warning without halting the
+  // gate on a spurious failure.  This is a bounded "cannot reason → do not
+  // block" rather than "ignore everything" — it only applies when the hash was
+  // recorded (modern installer) but the file is absent (specific gap).
+  OK_NO_BASELINE: 'ok_no_baseline',
   FAIL_INSTALLED_MISSING: 'fail_installed_missing',
   FAIL_INSTALLED_NOT_REGULAR_FILE: 'fail_installed_not_regular_file',
   FAIL_READ_ERROR: 'fail_read_error',
@@ -208,11 +221,25 @@ function verifyFile({ relPath, patchesDir, configDir, pristineDir, pristineHashe
     return result;
   }
 
+  // Normalize to forward slashes so the key lookup matches on Windows
+  // where path.join produces backslash-separated relPath values but
+  // backup-meta.json stores keys written with forward slashes.
+  const hashKey = relPath.replace(/\\/g, '/');
+  const recordedHash = pristineHashes && pristineHashes[hashKey];
+
   let pristineContent = null;
   if (pristineDir) {
     const pristinePath = path.join(pristineDir, relPath);
+    // Bug #934: track whether the pristine path EXISTS on disk (stat did not
+    // throw ENOENT).  A regular file that fails to read, or a non-file path
+    // (e.g. a directory accidentally placed at the pristine path), is treated
+    // as "present but unusable" — we fall to over-broad mode (safe side).
+    // OK_NO_BASELINE is reserved for the strictly absent case: stat throws,
+    // meaning the file was never written (the gap the bug describes).
+    let pristinePathExists = false;
     try {
       const stat = fs.statSync(pristinePath);
+      pristinePathExists = true; // path exists (any type)
       if (stat.isFile()) {
         const candidate = fs.readFileSync(pristinePath, 'utf8');
         // Bug #3657: if backup-meta.json recorded a pristine_hash for this
@@ -226,11 +253,6 @@ function verifyFile({ relPath, patchesDir, configDir, pristineDir, pristineHashe
         // Over-broad mode never false-fails for a different reason because all
         // backup lines that are genuinely user-added will still be present in a
         // correctly merged install.
-        // Normalize to forward slashes so the key lookup matches on Windows
-        // where path.join produces backslash-separated relPath values but
-        // backup-meta.json stores keys written with forward slashes.
-        const hashKey = relPath.replace(/\\/g, '/');
-        const recordedHash = pristineHashes && pristineHashes[hashKey];
         if (recordedHash) {
           if (sha256(candidate) === recordedHash) {
             // Hash matches: the on-disk pristine is the correct baseline.
@@ -251,8 +273,28 @@ function verifyFile({ relPath, patchesDir, configDir, pristineDir, pristineHashe
           pristineContent = candidate;
         }
       }
+      // Non-file at pristinePath (e.g. a directory): stat succeeded so
+      // pristinePathExists is true; we fall through to over-broad mode below,
+      // which is safe and conservative.
     } catch {
-      // Pristine missing or unreadable — fall through to over-broad mode.
+      // Pristine stat threw — path is absent (ENOENT) or inaccessible.
+      // pristinePathExists stays false.
+    }
+
+    // Bug #934: recordedHash is present (modern installer) but the pristine
+    // path does not exist on disk at all (stat threw above).  This means
+    // saveLocalPatches recorded a hash but could not write the corresponding
+    // gsd-pristine/ file (the only candidate was discarded because it was from
+    // a newer release).  Falling to over-broad mode here would treat every
+    // upstream-changed line as a "user-added line that must survive", producing
+    // false FAIL_USER_LINES_MISSING for each upstream removal.  Since we
+    // cannot reason correctly without a baseline, the safe answer is advisory/
+    // non-blocking: return OK_NO_BASELINE and let the caller decide.
+    // NOTE: this guard fires ONLY when stat threw (path absent), not when the
+    // path is present but non-file — in that case over-broad mode is safer.
+    if (!pristinePathExists && recordedHash) {
+      result.reason = REASON.OK_NO_BASELINE;
+      return result;
     }
   }
 
@@ -316,9 +358,17 @@ function main() {
   const drifted = driftedResults.length;
   const drifted_files = driftedResults.map((r) => r.file);
 
+  // Bug #934: aggregate no-baseline files into top-level report fields so the
+  // workflow can log a warning about files that could not be verified.  Like
+  // drift, this is NOT a failure (exit code stays 0) but gives the caller
+  // structured data to surface the advisory condition.
+  const noBaselineResults = results.filter((r) => r.reason === REASON.OK_NO_BASELINE);
+  const no_baseline = noBaselineResults.length;
+  const no_baseline_files = noBaselineResults.map((r) => r.file);
+
   if (opts.json) {
     process.stdout.write(
-      JSON.stringify({ checked: results.length, failures: failures.length, drifted, drifted_files, results }, null, 2) + '\n',
+      JSON.stringify({ checked: results.length, failures: failures.length, drifted, drifted_files, no_baseline, no_baseline_files, results }, null, 2) + '\n',
     );
   } else {
     process.stdout.write(`# Hunk Verification Gate (#2969)\n\n`);

package/gsd-core/workflows/plan-phase.md

@@ -39,10 +39,13 @@ discuss-phase early-exit path. It does NOT authorize inline role performance for
 plan-phase agents.
 
 **Other runtimes:**
-If the Agent tool is genuinely absent (e.g. a backgrounded Claude Code agent per
-#853, or a non-Claude runtime that does not expose Agent/agent), log the gap and
-stop — do NOT perform researcher/planner/checker roles inline. Independent agent
-contexts are required for the plan-checker gate to be meaningful.
+Do not pre-judge Agent availability by introspection. Always attempt the actual
+Agent() call for gsd-phase-researcher, gsd-planner, and gsd-plan-checker. Only
+a real tool-unavailable error returned by Agent() is a reliable absence signal —
+never stop based on a self-assessed "I think Agent is unavailable." If the call
+fails with a tool-unavailable error, log the gap and stop — do NOT collapse
+researcher/planner/checker roles inline. Independent agent contexts are required
+for the plan-checker gate to be meaningful.
 </runtime_compatibility>
 
 <process>

package/gsd-core/workflows/plan-review-convergence.md

@@ -1,7 +1,8 @@
 <purpose>
 Cross-AI plan convergence loop — automates the manual chain:
 gsd-plan-phase N → gsd-review N --codex → gsd-plan-phase N --reviews → gsd-review N --codex → ...
-Each step runs inside an isolated Agent that calls the corresponding Skill.
+Plan-phase runs inline (bare Skill at depth 0) so it can spawn gsd-planner/gsd-plan-checker at depth 1.
+Review runs inside an isolated Agent (leaf skill — Bash only, no sub-agents needed).
 Orchestrator only does: init, loop control, parse CYCLE_SUMMARY for HIGH count, stall detection, escalation.
 </purpose>
 
@@ -98,21 +99,15 @@ Display startup banner:
 
 **If `has_plans` is false:**
 
-Display: `◆ No plans found — spawning initial planning agent... (runs in a subagent — no output until it returns, ~1–5 min; expected, not a freeze)`
+Display: `◆ No plans found — running initial planning inline... (plan-phase runs here in the orchestrator — no output until planning is complete, ~1–5 min; expected, not a freeze)`
 
 ```text
-Agent(
-  description="Initial planning Phase {PHASE}",
-  prompt="Run /gsd:plan-phase for Phase {PHASE}.
-
-Execute: Skill(skill='gsd-plan-phase', args='{PHASE} {GSD_WS}')
-
-Complete the full planning workflow. Do NOT return until planning is complete and PLAN.md files are committed.",
-  mode="auto"
-)
+Skill(skill="gsd-plan-phase", args="{PHASE} {GSD_WS}")
 ```
 
-After agent returns, verify plans were created:
+Run plan-phase **inline** (do NOT wrap it in Agent()). The convergence orchestrator runs at depth 0 with Agent available, so inline plan-phase can spawn gsd-planner and gsd-plan-checker at depth 1 — the one level of nesting that works on Claude Code. Wrapping plan-phase in Agent() would push it to depth 1 where the Agent tool is absent, preventing it from spawning any sub-agents. Wait until plan-phase completes and PLAN.md files are committed before continuing.
+
+After plan-phase completes, verify plans were created:
 ```bash
 PLAN_COUNT=$(ls ${phase_dir}/${padded_phase}-*-PLAN.md 2>/dev/null | wc -l)
 ```
@@ -302,44 +297,35 @@ To restart loop:     /gsd:plan-review-convergence {PHASE} {REVIEWER_FLAGS}
 ```
 Exit workflow.
 
-### 5d. Replan (Spawn Agent)
+### 5d. Replan (Inline)
 
 **If under max cycles:**
 
 Update `prev_high_count = HIGH_COUNT`.
 
-Display: `◆ Spawning replan agent with review feedback... (runs in a subagent — no output until it returns, ~1–5 min; expected, not a freeze)`
+Display: `◆ Replanning inline with review feedback... (plan-phase runs here in the orchestrator — no output until replanning is complete, ~1–5 min; expected, not a freeze)`
 
 ```text
-Agent(
-  description="Replan Phase {PHASE} with review feedback cycle {cycle}",
-  prompt="Run /gsd:plan-phase with --reviews for Phase {PHASE}.
-
-Execute: Skill(skill='gsd-plan-phase', args='{PHASE} --reviews --skip-research {GSD_WS}')
-
-This will replan incorporating cross-AI review feedback from REVIEWS.md.
-Do NOT return until replanning is complete and updated PLAN.md files are committed.
-
-IMPORTANT: When gsd-plan-phase outputs '## PLANNING COMPLETE', that means replanning is done. Return at that point.",
-  mode="auto"
-)
+Skill(skill="gsd-plan-phase", args="{PHASE} --reviews --skip-research {GSD_WS}")
 ```
 
-After agent returns → go back to **step 5a** (review again).
+Run plan-phase **inline** (do NOT wrap it in Agent()). Same rationale as step 4: the convergence orchestrator runs at depth 0 with Agent available, so inline plan-phase can spawn gsd-planner and gsd-plan-checker at depth 1. Wrapping in Agent() pushes plan-phase to depth 1 where the Agent tool is absent — the replan loop can never produce a revised plan when HIGHs are found. This is the root cause of bug #936. Wait until plan-phase completes (outputs '## PLANNING COMPLETE') and updated PLAN.md files are committed before continuing.
+
+After plan-phase completes → go back to **step 5a** (review again).
 
 </process>
 
 <success_criteria>
 - [ ] Config gate checked before running — exits with enable instructions if workflow.plan_review_convergence is false
-- [ ] Initial planning via Agent → Skill("gsd-plan-phase") if no plans exist
-- [ ] Review via Agent → Skill("gsd-review") — isolated, not inline; {GSD_WS} forwarded
-- [ ] Replan via Agent → Skill("gsd-plan-phase --reviews") — isolated, not inline
+- [ ] Initial planning via inline Skill("gsd-plan-phase") if no plans exist — NOT wrapped in Agent() (bug #936: depth-1 Agent has no Agent tool)
+- [ ] Review via Agent → Skill("gsd-review") — isolated Agent is correct; gsd-review is a Bash leaf with no sub-agent spawns; {GSD_WS} forwarded
+- [ ] Replan via inline Skill("gsd-plan-phase --reviews") — NOT wrapped in Agent(); inline lets plan-phase spawn gsd-planner/gsd-plan-checker at depth 1
 - [ ] Orchestrator only does: init, config gate, loop control, parse CYCLE_SUMMARY for HIGH count, stall detection, escalation
 - [ ] HIGH count extracted from review agent's CYCLE_SUMMARY return message (not by grepping REVIEWS.md)
 - [ ] Review agent prompt defines CYCLE_SUMMARY: current_high=<N> contract with PARTIALLY/FULLY RESOLVED definitions
 - [ ] Abort with clear error if CYCLE_SUMMARY is absent; distinguish malformed from absent
 - [ ] Warn if HIGH_COUNT > 0 but ## Current HIGH Concerns section is absent from return message
-- [ ] Each Agent fully completes its Skill before returning
+- [ ] The review Agent fully completes gsd-review before returning (plan-phase runs inline — no Agent wrap)
 - [ ] Loop exits on: no HIGH concerns (converged) OR max cycles (escalation)
 - [ ] Stall detection reported when HIGH count not decreasing
 - [ ] STATE.md updated on convergence completion

package/gsd-core/workflows/reapply-patches.md

@@ -299,11 +299,28 @@ VERIFY_OUTPUT="$(node "${GSD_HOME}/gsd-core/bin/verify-reapply-patches.cjs" "${V
 VERIFY_STATUS=$?
 ```
 
-**Step 5a: drift check** — even when `VERIFY_STATUS` is 0, the report may signal that one or more files were skipped due to pristine-snapshot drift (Bug #3657). Parse the JSON and check:
+**Step 5a: drift check** — even when `VERIFY_STATUS` is 0, the report may signal that one or more files were skipped due to pristine-snapshot drift (Bug #3657) or a missing baseline (Bug #934). Parse the JSON and check:
 
 ```bash
 DRIFTED_COUNT="$(echo "$VERIFY_OUTPUT" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));process.stdout.write(String(d.drifted||0))")"
 DRIFTED_FILES="$(echo "$VERIFY_OUTPUT"  | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));(d.drifted_files||[]).forEach(f=>process.stdout.write(f+'\n'))")"
+NO_BASELINE_COUNT="$(echo "$VERIFY_OUTPUT" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));process.stdout.write(String(d.no_baseline||0))")"
+NO_BASELINE_FILES="$(echo "$VERIFY_OUTPUT"  | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));(d.no_baseline_files||[]).forEach(f=>process.stdout.write(f+'\n'))")"
+```
+
+**If `NO_BASELINE_COUNT` is greater than 0**, emit an advisory warning (non-blocking — the gate still exits 0 for these files). Do NOT halt:
+
+```text
+ADVISORY: {NO_BASELINE_COUNT} file(s) could not be diff-verified because no pristine
+baseline exists on disk despite a hash being recorded in backup-meta.json (Bug #934:
+the installer discarded the only pristine candidate because it was from a newer release).
+These files were skipped rather than false-failed; their user customisations may or
+may not have survived the merge.
+
+Unverified files:
+  {each path in NO_BASELINE_FILES, one per line, indented two spaces}
+
+Recommended: manually inspect each file above and confirm your customisations survived.
 ```
 
 **If `DRIFTED_COUNT` is greater than 0**, STOP and report to the user, then set `DRIFT_DETECTED=true` and halt — do not proceed to 5b or cleanup:

package/gsd-core/workflows/update.md

@@ -195,24 +195,29 @@ CHANGELOG_TMP="/tmp/gsd-changelog-$$.md"
 curl -fsSL "https://raw.githubusercontent.com/open-gsd/gsd-core/main/CHANGELOG.md" -o "$CHANGELOG_TMP" 2>/dev/null \
   || wget -qO "$CHANGELOG_TMP" "https://raw.githubusercontent.com/open-gsd/gsd-core/main/CHANGELOG.md" 2>/dev/null
 
-EXTRACT_JSON=$(node "$GSD_DIR/gsd-core/scripts/changeset/cli.cjs" extract \
-  --from "$INSTALLED_VERSION" \
-  --to "$LATEST_VERSION" \
-  --changelog "$CHANGELOG_TMP" \
-  --json 2>/dev/null)
-EXTRACT_EXIT=$?
-
-if [ "$EXTRACT_EXIT" -eq 2 ]; then
-  # Exit 2 = no releases in range (e.g. versions are equal or changelog is sparse)
-  CHANGELOG_PREVIEW="No changelog updates between v${INSTALLED_VERSION} and v${LATEST_VERSION}."
-elif [ "$EXTRACT_EXIT" -ne 0 ] || [ -z "$EXTRACT_JSON" ]; then
-  CHANGELOG_PREVIEW="(Could not extract changelog — update will still proceed)"
+GSD_CHANGESET_CLI="$GSD_DIR/scripts/changeset/cli.cjs"
+if [ ! -f "$GSD_CHANGESET_CLI" ]; then
+  CHANGELOG_PREVIEW="(Changelog CLI not found at $GSD_CHANGESET_CLI — reinstall GSD to restore preview. Update will still proceed.)"
 else
-  # Re-run without --json to get the human-readable markdown for display
-  CHANGELOG_PREVIEW=$(node "$GSD_DIR/gsd-core/scripts/changeset/cli.cjs" extract \
+  EXTRACT_JSON=$(node "$GSD_CHANGESET_CLI" extract \
     --from "$INSTALLED_VERSION" \
     --to "$LATEST_VERSION" \
-    --changelog "$CHANGELOG_TMP" 2>/dev/null || echo "(changelog unavailable)")
+    --changelog "$CHANGELOG_TMP" \
+    --json 2>&1)
+  EXTRACT_EXIT=$?
+
+  if [ "$EXTRACT_EXIT" -eq 2 ]; then
+    # Exit 2 = no releases in range (e.g. versions are equal or changelog is sparse)
+    CHANGELOG_PREVIEW="No changelog updates between v${INSTALLED_VERSION} and v${LATEST_VERSION}."
+  elif [ "$EXTRACT_EXIT" -ne 0 ] || [ -z "$EXTRACT_JSON" ]; then
+    CHANGELOG_PREVIEW="(Could not extract changelog — update will still proceed)"
+  else
+    # Re-run without --json to get the human-readable markdown for display
+    CHANGELOG_PREVIEW=$(node "$GSD_CHANGESET_CLI" extract \
+      --from "$INSTALLED_VERSION" \
+      --to "$LATEST_VERSION" \
+      --changelog "$CHANGELOG_TMP" 2>/dev/null || echo "(changelog unavailable)")
+  fi
 fi
 # Clean up temp changelog now that both extract runs are done
 rm -f "$CHANGELOG_TMP"

package/hooks/dist/gsd-context-monitor.js

@@ -182,7 +182,8 @@ process.stdin.on('end', () => {
 
     const output = {
       hookSpecificOutput: {
-        hookEventName: process.env.GEMINI_API_KEY ? "AfterTool" : "PostToolUse",
+        hookEventName: (data.hook_event_name && data.hook_event_name.trim())
+          || (process.env.GEMINI_API_KEY ? "AfterTool" : "PostToolUse"),
         additionalContext: message
       }
     };

package/hooks/gsd-context-monitor.js

@@ -182,7 +182,8 @@ process.stdin.on('end', () => {
 
     const output = {
       hookSpecificOutput: {
-        hookEventName: process.env.GEMINI_API_KEY ? "AfterTool" : "PostToolUse",
+        hookEventName: (data.hook_event_name && data.hook_event_name.trim())
+          || (process.env.GEMINI_API_KEY ? "AfterTool" : "PostToolUse"),
         additionalContext: message
       }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-core",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "bin": {
     "gsd-core": "bin/install.js",

package/scripts/changeset/cli.cjs

@@ -324,7 +324,7 @@ function resolveChangelogPath(opts) {
  *   1  — I/O error or missing required flags.
  *
  * Fix for #3496: provides a deterministic range-aware helper so the
- * `/gsd:update` show_changes_and_confirm step no longer relies on
+ * `/gsd-update` show_changes_and_confirm step no longer relies on
  * vague/manual extraction that can silently skip intermediate versions.
  */
 function cmdExtract(opts) {