@opengsd/gsd-core 1.4.2 → 1.5.0-rc.1

package/gsd-core/bin/lib/federated-config.cjs

@@ -0,0 +1,182 @@
+"use strict";
+/**
+ * Federated Config — Defensive merge of capability-declared config keys
+ *
+ * ADR-857 phase 3b: wires the Capability Registry's configSchema into
+ * loadConfig as a provably-empty no-op channel until capability keys are
+ * migrated out of the central config-schema.
+ *
+ * Exported function:
+ *   mergeFederatedConfig({ configSchema, isCentralKey, userConfig })
+ *     → { values, validKeys, warnings }
+ *
+ * Design:
+ *   - For each key in configSchema:
+ *       If isCentralKey(key) → SKIP; push a pending-migration warning.
+ *       Else if slice is malformed → SKIP; push a warning. Never throw.
+ *       Else (valid federated key absent from central):
+ *         resolvedValue = nested userConfig lookup if present & type-matches; else slice.default.
+ *         Add key→resolvedValue to values; add key to validKeys.
+ *   - Guard all object writes with inline literal __proto__/constructor/prototype checks.
+ *   - Zero external dependencies; no ajv; hand-rolled type checks only.
+ *
+ * ADR-857 no-op guarantee:
+ *   With the current registry, every UI key is still present in the central
+ *   config-schema, so isCentralKey() returns true for all of them and values
+ *   is always empty. The channel is live but carries no traffic until a key
+ *   is atomically removed from the central schema (the cutover step).
+ *
+ * Dependencies: none (zero-dep module).
+ */
+// ─── Allowed slice types (mirrors gen-capability-registry.cjs VALID_CONFIG_SLICE_TYPES) ──
+const VALID_SLICE_TYPES = new Set(['boolean', 'string', 'number', 'enum']);
+// ─── Internal helpers ──────────────────────────────────────────────────────────
+/**
+ * Returns true if `slice` has a non-empty type, a `default` property, and a
+ * non-empty string description. Does NOT throw.
+ */
+function _isWellFormedSlice(slice) {
+    if (typeof slice !== 'object' || slice === null || Array.isArray(slice))
+        return false;
+    const s = slice;
+    if (typeof s['type'] !== 'string' || s['type'].length === 0)
+        return false;
+    if (!VALID_SLICE_TYPES.has(s['type']))
+        return false;
+    if (!Object.prototype.hasOwnProperty.call(s, 'default'))
+        return false;
+    return true;
+}
+/**
+ * Returns true if `value` matches the declared type in the slice.
+ * For enum, also validates against slice.values if present.
+ */
+function _typeMatches(value, slice) {
+    switch (slice.type) {
+        case 'boolean': return typeof value === 'boolean';
+        case 'string': return typeof value === 'string';
+        case 'number': return typeof value === 'number';
+        case 'enum':
+            // Must be a string AND, if values list is present, must be in it
+            if (typeof value !== 'string')
+                return false;
+            if (Array.isArray(slice.values) && slice.values.length > 0) {
+                return slice.values.includes(value);
+            }
+            return true;
+        default: return false;
+    }
+}
+/**
+ * Traverse a dotted key path through a nested config object.
+ * E.g. key="workflow.ui_phase", obj={workflow:{ui_phase:false}} → {found:true, value:false}
+ * Returns {found:false} if any segment is missing or not an own property.
+ * Handles 1, 2, or N segments generically.
+ */
+function _getNestedValue(obj, key) {
+    const segments = key.split('.');
+    let current = obj;
+    for (let i = 0; i < segments.length; i++) {
+        const seg = segments[i];
+        // Inline literal prototype-pollution guard
+        if (seg === '__proto__' || seg === 'constructor' || seg === 'prototype') {
+            return { found: false, value: undefined };
+        }
+        if (typeof current !== 'object' || current === null) {
+            return { found: false, value: undefined };
+        }
+        const cur = current;
+        if (!Object.prototype.hasOwnProperty.call(cur, seg)) {
+            return { found: false, value: undefined };
+        }
+        current = cur[seg];
+    }
+    return { found: true, value: current };
+}
+// ─── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Defensive merge of capability-declared config slices into the loadConfig
+ * return value.
+ *
+ * DEFENSIVE contract (never throws, even on bad capability data):
+ *   - Null/undefined/non-object input → returns empty result.
+ *   - Null/undefined/non-object userConfig → treated as {} (no overrides).
+ *   - Central keys are skipped with a pending-migration warning.
+ *   - Malformed slices are skipped with a warning.
+ *   - User-supplied values with wrong types (or out-of-enum values) fall back
+ *     to the slice default (a type-mismatch warning is pushed but the key is
+ *     still federated with its default; this is best-effort degraded operation).
+ */
+function mergeFederatedConfig(input) {
+    // FIX 4: Guard null/undefined/non-object input
+    if (input === null || input === undefined || typeof input !== 'object') {
+        return { values: Object.create(null), validKeys: [], warnings: [] };
+    }
+    const { configSchema, isCentralKey } = input;
+    // FIX 4: Guard null/undefined/non-object userConfig — treat as {}
+    const userConfig = (input.userConfig !== null && input.userConfig !== undefined && typeof input.userConfig === 'object' && !Array.isArray(input.userConfig))
+        ? input.userConfig
+        : {};
+    // FIX 6b: Use null-prototype object for all return paths
+    const values = Object.create(null);
+    const validKeys = [];
+    const warnings = [];
+    if (typeof configSchema !== 'object' || configSchema === null) {
+        return { values: Object.create(null), validKeys: [], warnings: [] };
+    }
+    for (const key of Object.keys(configSchema)) {
+        // S2: inline literal prototype-pollution guard (CodeQL barrier)
+        // Guard both the full key AND all dotted-path segments
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
+        const _keySegments = key.split('.');
+        if (_keySegments.some((s) => s === '__proto__' || s === 'constructor' || s === 'prototype'))
+            continue;
+        const slice = configSchema[key];
+        // If this key is still in the central schema → pending migration, skip
+        try {
+            if (isCentralKey(key)) {
+                warnings.push('federated-config: key "' + key + '" is still in the central config-schema (pending-migration); ' +
+                    'skipping federated resolution until the central schema entry is removed');
+                continue;
+            }
+        }
+        catch {
+            // isCentralKey threw — treat as unknown, skip defensively
+            warnings.push('federated-config: isCentralKey("' + key + '") threw; skipping key');
+            continue;
+        }
+        // Validate slice shape — skip malformed entries
+        if (!_isWellFormedSlice(slice)) {
+            warnings.push('federated-config: config slice for key "' + key + '" is malformed (missing or invalid type/default); skipping');
+            continue;
+        }
+        const sliceEntry = slice;
+        // FIX 1: Resolve value using NESTED dotted-path lookup through userConfig
+        let resolvedValue = sliceEntry.default;
+        const { found: userHasKey, value: userValue } = _getNestedValue(userConfig, key);
+        if (userHasKey && userValue !== undefined) {
+            // FIX 5b: For enum, validate against slice.values if present; otherwise check type
+            if (_typeMatches(userValue, sliceEntry)) {
+                resolvedValue = userValue;
+            }
+            else {
+                const typeDesc = sliceEntry.type === 'enum' && Array.isArray(sliceEntry.values)
+                    ? 'enum(' + sliceEntry.values.join('|') + ')'
+                    : sliceEntry.type;
+                warnings.push('federated-config: user-supplied value for "' + key + '" has wrong type or invalid enum value ' +
+                    '(expected ' + typeDesc + ', got ' + typeof userValue +
+                    (typeof userValue === 'string' ? ' "' + String(userValue) + '"' : '') +
+                    '); falling back to slice default');
+                // resolvedValue stays as slice default
+            }
+        }
+        // S2: inline literal guard before writing to values
+        if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
+            values[key] = resolvedValue;
+            validKeys.push(key);
+        }
+    }
+    return { values, validKeys, warnings };
+}
+module.exports = { mergeFederatedConfig };

package/gsd-core/bin/lib/graphify-command-router.cjs

@@ -0,0 +1,74 @@
+'use strict';
+/**
+ * Graphify command router — CLI subcommand dispatcher for `gsd-tools graphify`.
+ *
+ * ADR-959 (phase 4d-impl-2) pilot: first real capability command cutover.
+ * Extracted from the hardcoded `case 'graphify':` arm in gsd-tools.cjs.
+ * Behaviour is preserved byte-for-behaviour from the prior inline case;
+ * the dispatch path now flows: default → dispatchCapabilityCommand →
+ * require(graphify-command-router.cjs) → routeGraphifyCommand.
+ *
+ * Router signature: { args, cwd, raw, error } — identical to the 12 existing
+ * host routers. No new handler/arg convention; the capability registry
+ * discovers this router by name.
+ *
+ * Arg indexing (preserved exactly from the original case):
+ *   args[0] = 'graphify'  (family — matched by dispatchCapabilityCommand)
+ *   args[1] = subcommand  (query | status | diff | build)
+ *   args[2] = term (query) | 'snapshot' (build snapshot)
+ *   args.indexOf('--budget') + 1 = budget value
+ *
+ * Test seam: pass `_graphify` in the options object to inject a recording mock
+ * instead of the real graphify module. The `_`-prefix follows the repo's
+ * established seam convention (see other routers). Production callers omit it.
+ */
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const graphify = require("./graphify.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const core = require("./core.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const io = require("./io.cjs");
+const { ERROR_REASON } = io;
+// ─── Implementation ───────────────────────────────────────────────────────────
+function routeGraphifyCommand({ args, cwd, raw, error, _graphify }) {
+    const subcommand = args[1];
+    const g = _graphify ?? graphify;
+    if (subcommand === 'query') {
+        const term = args[2];
+        if (!term) {
+            error('Usage: gsd-tools graphify query <term>', ERROR_REASON.USAGE);
+            return;
+        }
+        const budgetIdx = args.indexOf('--budget');
+        let budget = null;
+        if (budgetIdx !== -1) {
+            const rawBudget = args[budgetIdx + 1];
+            if (rawBudget === undefined || Number.isNaN(parseInt(rawBudget, 10))) {
+                error('Usage: gsd-tools graphify query <term> [--budget <N>]', ERROR_REASON.USAGE);
+                return;
+            }
+            budget = parseInt(rawBudget, 10);
+        }
+        core.output(g.graphifyQuery(cwd, term, { budget }), raw);
+    }
+    else if (subcommand === 'status') {
+        core.output(g.graphifyStatus(cwd), raw);
+    }
+    else if (subcommand === 'diff') {
+        core.output(g.graphifyDiff(cwd), raw);
+    }
+    else if (subcommand === 'build') {
+        if (args[2] === 'snapshot') {
+            core.output(g.writeSnapshot(cwd), raw);
+        }
+        else {
+            core.output(g.graphifyBuild(cwd), raw);
+        }
+    }
+    else {
+        error('Unknown graphify subcommand. Available: build, query, status, diff', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    }
+}
+module.exports = {
+    routeGraphifyCommand,
+};

package/gsd-core/bin/lib/init.cjs

@@ -1718,16 +1718,22 @@ function buildSkillManifest(cwd, skillsDir = null) {
             roots.push(rootSummary);
             continue;
         }
-        let skillCount = 0;
-        for (const entry of entries) {
-            if (!entry.isDirectory())
-                continue;
-            const skillMdPath = node_path_1.default.join(rootPath, entry.name, 'SKILL.md');
-            const content = (0, shell_command_projection_cjs_1.platformReadSync)(skillMdPath);
-            if (content === null)
-                continue;
+        // Track skill names seen within this root to deduplicate dual-routed concretes
+        // (e.g. spec-phase nested under both gsd-ns-workflow and gsd-ns-manage).
+        const seenNamesInRoot = new Set();
+        function pushSkillEntry(
+        // relPath must use forward slashes on all platforms (manifest paths are
+        // posix-style for cross-platform stability; flat entries use template
+        // literals that always produce '/'; nested entries are joined below
+        // with explicit '/' separators rather than path.join).
+        relPath, content) {
             const frontmatter = extractFrontmatter(content);
-            const name = frontmatter['name'] || entry.name;
+            const dirPart = relPath.replace(/\/SKILL\.md$/, '');
+            const stem = dirPart.includes('/') ? dirPart.split('/').pop() : dirPart;
+            const name = frontmatter['name'] || stem;
+            if (seenNamesInRoot.has(name))
+                return false; // dedupe dual-routed concretes
+            seenNamesInRoot.add(name);
             const description = frontmatter['description'] || '';
             const triggers = [];
             const bodyMatch = content.match(/^---[\s\S]*?---\s*\n([\s\S]*)$/);
@@ -1746,14 +1752,54 @@ function buildSkillManifest(cwd, skillsDir = null) {
                 name,
                 description,
                 triggers,
-                path: entry.name,
-                file_path: `${entry.name}/SKILL.md`,
+                path: dirPart,
+                file_path: relPath,
                 root: rootInfo.root,
                 scope: rootInfo.scope,
                 installed: rootInfo.scope !== 'import-only',
                 deprecated: !!rootInfo.deprecated,
             });
-            skillCount++;
+            return true;
+        }
+        let skillCount = 0;
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const skillMdPath = node_path_1.default.join(rootPath, entry.name, 'SKILL.md');
+            const content = (0, shell_command_projection_cjs_1.platformReadSync)(skillMdPath);
+            if (content !== null) {
+                if (pushSkillEntry(`${entry.name}/SKILL.md`, content))
+                    skillCount++;
+            }
+            // Nested layout: <entry>/skills/<stem>/SKILL.md
+            // Used by cline, qwen, hermes, augment, trae, antigravity (#69 nested=true).
+            // Descend exactly one level into <entry>/skills/ — no deeper recursion.
+            // Scope to gsd-ns-* routers only: never vacuum up an unrelated user skill
+            // that happens to have its own `skills/` subdirectory.
+            if (!entry.name.startsWith('gsd-ns-'))
+                continue;
+            const nestedSkillsDir = node_path_1.default.join(rootPath, entry.name, 'skills');
+            let nestedEntries = [];
+            try {
+                nestedEntries = node_fs_1.default.readdirSync(nestedSkillsDir, { withFileTypes: true });
+            }
+            catch {
+                // No skills/ subdir — flat layout or unreadable; nothing to do.
+                nestedEntries = [];
+            }
+            for (const nested of nestedEntries) {
+                if (!nested.isDirectory())
+                    continue;
+                const nestedSkillMd = node_path_1.default.join(nestedSkillsDir, nested.name, 'SKILL.md');
+                const nestedContent = (0, shell_command_projection_cjs_1.platformReadSync)(nestedSkillMd);
+                if (nestedContent === null)
+                    continue;
+                // Use forward-slash separator explicitly so manifest paths are posix-style
+                // on all platforms, matching the flat-layout behaviour above.
+                const relPath = `${entry.name}/skills/${nested.name}/SKILL.md`;
+                if (pushSkillEntry(relPath, nestedContent))
+                    skillCount++;
+            }
         }
         rootSummary.skill_count = skillCount;
         roots.push(rootSummary);

package/gsd-core/bin/lib/install-profiles.cjs

@@ -157,10 +157,44 @@ function computeClosure(base, manifest) {
     }
     return closed;
 }
+/**
+ * Compute the capability skills to add for a given profile mode from the registry.
+ * Returns an array of skill stems contributed by capabilities whose profileMembership
+ * includes the given mode.  Guards against prototype pollution and malformed registry.
+ */
+function _capabilitySkillsForMode(mode, registry) {
+    const BANNED = ['__proto__', 'constructor', 'prototype'];
+    const clusters = registry.capabilityClusters;
+    const membership = registry.profileMembership;
+    if (!clusters || typeof clusters !== 'object' || !membership || typeof membership !== 'object') {
+        return [];
+    }
+    const result = [];
+    for (const capId of Object.keys(clusters)) {
+        if (BANNED.includes(capId))
+            continue;
+        const mem = membership[capId];
+        if (!mem || typeof mem !== 'object')
+            continue;
+        const profiles = mem.profiles;
+        if (!Array.isArray(profiles))
+            continue;
+        if (!profiles.includes(mode))
+            continue;
+        const skills = clusters[capId];
+        if (!Array.isArray(skills))
+            continue;
+        for (const s of skills) {
+            if (typeof s === 'string' && s.length > 0)
+                result.push(s);
+        }
+    }
+    return result;
+}
 /**
  * Resolve a profile (or composed profiles) to a typed result object.
  */
-function resolveProfile({ modes, manifest, _profilesOverride } = {}) {
+function resolveProfile({ modes, manifest, _profilesOverride, registry } = {}) {
     const profiles = _profilesOverride || PROFILES;
     const activeModes = (modes && modes.length > 0) ? modes : ['full'];
     const normalizedModes = activeModes
@@ -185,7 +219,11 @@ function resolveProfile({ modes, manifest, _profilesOverride } = {}) {
             // This profile is full — sentinel short-circuit
             return { name: 'full', skills: '*', agents: new Set() };
         }
-        const closure = computeClosure(base, man);
+        // ADR-857 phase 4c: union capability skills for this mode BEFORE closure so
+        // their requires: chains expand too.
+        const capSkills = registry ? _capabilitySkillsForMode(mode, registry) : [];
+        const baseWithCap = [...base, ...capSkills];
+        const closure = computeClosure(baseWithCap, man);
         for (const s of closure)
             unionSkills.add(s);
     }
@@ -318,9 +356,103 @@ function stageAgentsForProfile(srcAgentsDir, resolvedProfile) {
     ensureExitCleanup();
     return stageDir;
 }
-function stageSkillsForRuntimeAsSkills(srcCommandsDir, resolvedProfile, converter, prefix) {
+/**
+ * Build the namespace router → concrete sub-skill mapping (#69). The
+ * authoritative source is each `ns-*.md` router file's `requires:` frontmatter
+ * list. A concrete skill may be routed by more than one router (e.g. spec-phase
+ * is shared by ns-workflow and ns-ideate); it is nested — and physically
+ * duplicated — under every owning router.
+ */
+function buildNamespaceBundleMap(srcCommandsDir) {
+    const routerStems = new Set();
+    const routerChildren = new Map();
+    const childToRouters = new Map();
+    if (!node_fs_1.default.existsSync(srcCommandsDir)) {
+        return { routerStems, routerChildren, childToRouters };
+    }
+    for (const entry of node_fs_1.default.readdirSync(srcCommandsDir, { withFileTypes: true })) {
+        if (!entry.isFile() || !entry.name.endsWith('.md'))
+            continue;
+        if (!entry.name.startsWith('ns-'))
+            continue;
+        const stem = entry.name.slice(0, -3);
+        let children = [];
+        try {
+            children = parseRequires(node_fs_1.default.readFileSync(node_path_1.default.join(srcCommandsDir, entry.name), 'utf8'));
+        }
+        catch {
+            children = [];
+        }
+        routerStems.add(stem);
+        routerChildren.set(stem, children);
+        for (const child of children) {
+            const owners = childToRouters.get(child) || [];
+            owners.push(stem);
+            childToRouters.set(child, owners);
+        }
+    }
+    return { routerStems, routerChildren, childToRouters };
+}
+/**
+ * Rewrite a converted namespace-router SKILL.md so its routing table points at
+ * nested sub-skill files instead of bare Skill-tool names (#69). Each table row
+ * whose final cell carries a `gsd-<stem>` token (optionally with `--flag`
+ * suffixes) is rewritten to `Read \`skills/<stem>/SKILL.md\`` (flags preserved
+ * as a note), the `Invoke` column header becomes `Read`, and the
+ * "Invoke … using the Skill tool" trailer becomes a file-read instruction.
+ * Only lines beginning with a table pipe are touched, so the `|` inside the
+ * `description:` frontmatter field is never matched.
+ */
+function transformRouterBodyToNested(converted) {
+    const lines = converted.split('\n');
+    const out = lines.map((line) => {
+        if (/Invoke the matched skill directly using the Skill tool\./.test(line)) {
+            return line.replace(/Invoke the matched skill directly using the Skill tool\./, "Read the matched sub-skill's SKILL.md and follow its instructions. The `skills/<name>/SKILL.md` paths in the right column are relative to this skill's own directory.");
+        }
+        if (!/^\s*\|/.test(line))
+            return line;
+        if (/^\s*\|[\s:|-]+\|\s*$/.test(line))
+            return line;
+        if (/\|\s*Invoke\s*\|/.test(line)) {
+            return line.replace(/\|\s*Invoke\s*\|/, '| Read |');
+        }
+        const cells = line.split('|');
+        const lastIdx = cells.length - 2;
+        if (lastIdx < 1)
+            return line;
+        const cell = cells[lastIdx];
+        const m = cell.match(/gsd-([a-z0-9-]+)((?:\s+--[a-z0-9-]+)*)/i);
+        if (!m)
+            return line;
+        const stem = m[1];
+        const flags = m[2].trim();
+        cells[lastIdx] = flags
+            ? ` Read \`skills/${stem}/SKILL.md\` (${flags}) `
+            : ` Read \`skills/${stem}/SKILL.md\` `;
+        return cells.join('|');
+    });
+    return out.join('\n');
+}
+function stageSkillsForRuntimeAsSkills(srcCommandsDir, resolvedProfile, converter, prefix, nested = false) {
     if (!node_fs_1.default.existsSync(srcCommandsDir))
         return srcCommandsDir;
+    // Nesting applies to the `full` install AND to any surface whose skill set
+    // still contains every namespace router (a full/reset surface). It must NOT
+    // depend on the `'*'` sentinel alone: applySurface() materializes `full` into
+    // a concrete Set, so a sentinel-only gate would re-flatten the layout on every
+    // surface apply/reset (#69 adversarial-review finding). A partial surface that
+    // drops a whole router cluster falls back to flat automatically.
+    const bundles = nested ? buildNamespaceBundleMap(srcCommandsDir) : null;
+    let doNest = false;
+    if (nested && bundles && bundles.routerStems.size > 0) {
+        if (resolvedProfile.skills === '*') {
+            doNest = true;
+        }
+        else {
+            const present = resolvedProfile.skills;
+            doNest = [...bundles.routerStems].every((r) => present.has(r));
+        }
+    }
     const stageDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'gsd-profile-runtime-skills-'));
     try {
         const entries = node_fs_1.default.readdirSync(srcCommandsDir, { withFileTypes: true });
@@ -335,6 +467,27 @@ function stageSkillsForRuntimeAsSkills(srcCommandsDir, resolvedProfile, converte
             const content = node_fs_1.default.readFileSync(node_path_1.default.join(srcCommandsDir, entry.name), 'utf8');
             const skillName = `${prefix}${stem}`;
             const converted = converter(content, skillName);
+            if (doNest && bundles.routerStems.has(stem)) {
+                // Router skill: rewrite its routing table to the nested Read pattern and
+                // emit it as the single top-level bundle entry.
+                const destDir = node_path_1.default.join(stageDir, skillName);
+                node_fs_1.default.mkdirSync(destDir, { recursive: true });
+                node_fs_1.default.writeFileSync(node_path_1.default.join(destDir, 'SKILL.md'), transformRouterBodyToNested(converted));
+                continue;
+            }
+            if (doNest && bundles.childToRouters.has(stem)) {
+                // Concrete skill routed by one or more namespace routers: nest a copy
+                // under each owning router's skills/ subdir so it drops out of the
+                // top-level eager listing while staying readable by file path (#69).
+                for (const routerStem of bundles.childToRouters.get(stem)) {
+                    const destDir = node_path_1.default.join(stageDir, `${prefix}${routerStem}`, 'skills', stem);
+                    node_fs_1.default.mkdirSync(destDir, { recursive: true });
+                    node_fs_1.default.writeFileSync(node_path_1.default.join(destDir, 'SKILL.md'), converted);
+                }
+                continue;
+            }
+            // Flat top-level skill (default behaviour; also the unrouted fallback when
+            // nesting is active).
             const destDir = node_path_1.default.join(stageDir, skillName);
             node_fs_1.default.mkdirSync(destDir, { recursive: true });
             node_fs_1.default.writeFileSync(node_path_1.default.join(destDir, 'SKILL.md'), converted);
@@ -575,6 +728,7 @@ module.exports = {
     readActiveProfile,
     writeActiveProfile,
     // Shared internals
+    parseRequires,
     cleanupStagedSkills,
     // Back-compat / deprecated
     MINIMAL_SKILL_ALLOWLIST,

package/gsd-core/bin/lib/installer-migrations/004-prune-stale-pristine-snapshots.cjs

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Installer migration 004: remove stale gsd-pristine/get-shit-done/ snapshot // gsd-allow-legacy-name
+ * files after the get-shit-done → gsd-core rename (#604, #934). // gsd-allow-legacy-name
+ *
+ * Background: migration 003 removed legacy runtime files from
+ * get-shit-done/ but did not touch gsd-pristine/get-shit-done/, the // gsd-allow-legacy-name
+ * parallel directory that holds pristine snapshots captured before the rename.
+ * These snapshot files are GSD-managed (written by the installer, never by the
+ * user) and reference stale get-shit-done/... key paths that no longer exist // gsd-allow-legacy-name
+ * in the active layout. When verify-reapply-patches.cjs looks up a backup entry
+ * keyed under gsd-core/... it finds no matching gsd-pristine/ snapshot, falls
+ * to over-broad mode, and reports false FAIL_INSTALLED_MISSING / // gsd-allow-legacy-name
+ * FAIL_USER_LINES_MISSING for every backed-up pre-rename file (#934).
+ *
+ * Fix: walk gsd-pristine/get-shit-done/ and emit remove-managed for each file. // gsd-allow-legacy-name
+ * These files are always GSD-written snapshots — users never place their own
+ * files inside gsd-pristine/ — so the classification override
+ * (managed-pristine) is safe: there is no user content to protect.
+ *
+ * Checksum safety: migration 003's body is left untouched.  Adding this
+ * separate migration avoids modifying 003's checksum, which would break
+ * upgrade state for any user who already applied 003 (root cause of #670).
+ *
+ * Per-file approach: the migration framework has no recursive directory-removal
+ * primitive — all actions operate on individual files. Empty directory shells
+ * left after removal can be cleaned up manually; this is the intentional ADR-0008
+ * limitation.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+function walkPristineFiles(root, relDir, baseResolved, results) {
+    const dir = node_path_1.default.join(root, relDir);
+    let entries;
+    try {
+        entries = node_fs_1.default.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return; // directory absent or unreadable — nothing to do
+    }
+    for (const entry of entries) {
+        // Do not follow symlinks — skip to avoid out-of-tree traversal.
+        if (entry.isSymbolicLink())
+            continue;
+        const relPath = node_path_1.default.posix.join(relDir, entry.name);
+        // Bounds check: ensure the resolved path stays under configDir.
+        const resolved = node_path_1.default.resolve(root, relPath);
+        if (resolved !== baseResolved && !resolved.startsWith(baseResolved + node_path_1.default.sep))
+            continue;
+        if (entry.isDirectory()) {
+            walkPristineFiles(root, relPath, baseResolved, results);
+        }
+        else if (entry.isFile()) {
+            results.push(relPath);
+        }
+    }
+}
+const REASON = 'stale pristine snapshot from legacy get-shit-done/ dir, orphaned by rename migration 003 (#604, #934)'; // gsd-allow-legacy-name
+const migration = {
+    id: '2026-06-09-prune-stale-pristine-get-shit-done', // gsd-allow-legacy-name
+    title: 'Remove stale gsd-pristine/get-shit-done/ snapshot files (#934)', // gsd-allow-legacy-name
+    description: 'Migration 003 removed runtime files from get-shit-done/ but left the matching pristine snapshot ' + // gsd-allow-legacy-name
+        'directory gsd-pristine/get-shit-done/ intact. Those snapshots reference stale key paths and cause ' + // gsd-allow-legacy-name
+        'verify-reapply-patches false positives (#934). Remove all files under gsd-pristine/get-shit-done/ ' + // gsd-allow-legacy-name
+        'as they are GSD-managed snapshots, never user content.',
+    introducedIn: '1.4.3',
+    scopes: ['global', 'local'],
+    destructive: true,
+    plan(ctx) {
+        const pristineGsdRoot = node_path_1.default.join(ctx.configDir, 'gsd-pristine', 'get-shit-done'); // gsd-allow-legacy-name
+        // Idempotency: if the stale pristine subdir doesn't exist, nothing to do.
+        if (!node_fs_1.default.existsSync(pristineGsdRoot))
+            return [];
+        // Safety: reject symlinks in ANY ancestor component of the path we will walk
+        // to prevent following a symlink out of configDir.  Check both gsd-pristine/
+        // and gsd-pristine/get-shit-done/ — either being a symlink could redirect // gsd-allow-legacy-name
+        // the walk to an out-of-tree location.
+        const pristineParent = node_path_1.default.join(ctx.configDir, 'gsd-pristine');
+        try {
+            if (node_fs_1.default.lstatSync(pristineParent).isSymbolicLink())
+                return [];
+        }
+        catch {
+            return [];
+        }
+        try {
+            if (node_fs_1.default.lstatSync(pristineGsdRoot).isSymbolicLink())
+                return []; // gsd-allow-legacy-name
+        }
+        catch {
+            return [];
+        }
+        const baseResolved = node_path_1.default.resolve(ctx.configDir);
+        const relPaths = [];
+        walkPristineFiles(ctx.configDir, node_path_1.default.posix.join('gsd-pristine', 'get-shit-done'), baseResolved, relPaths); // gsd-allow-legacy-name
+        const actions = [];
+        for (const relPath of relPaths) {
+            // Bounds-check each relPath before emitting any action.
+            const resolved = node_path_1.default.resolve(ctx.configDir, relPath);
+            if (resolved !== baseResolved && !resolved.startsWith(baseResolved + node_path_1.default.sep))
+                continue;
+            // These files are GSD-managed pristine snapshots — the installer writes
+            // them during install/upgrade; users never place personal files inside
+            // gsd-pristine/.  Pass classification: 'managed-pristine' explicitly so
+            // the framework does not downgrade remove-managed to preserve-user when
+            // the manifest has no entry (these paths were never in the manifest since
+            // they live under gsd-pristine/, not the tracked runtime dir).
+            actions.push({
+                type: 'remove-managed',
+                relPath,
+                reason: REASON,
+                ownershipEvidence: 'GSD-written pristine snapshot under gsd-pristine/get-shit-done/; ' + // gsd-allow-legacy-name
+                    'installer is the sole author of gsd-pristine/ contents; no user content lives here',
+                classification: 'managed-pristine',
+            });
+        }
+        return actions;
+    },
+};
+module.exports = migration;