@opengsd/gsd-core 1.4.4 → 1.5.0-rc.2

package/gsd-core/bin/lib/uat-predicate.cjs

@@ -0,0 +1,329 @@
+"use strict";
+/**
+ * UAT Predicate — Pure-computation UAT pass/fail evaluation
+ *
+ * Evaluates all *-UAT.md and *-VERIFICATION.md files in a phase directory and
+ * returns a typed report. Used by `phase uat-passed` to harden against the
+ * naive whole-file regex in cmdPhaseComplete which false-matches `result:` lines
+ * inside frontmatter, fenced code blocks, blockquotes, and HTML comments.
+ *
+ * Issue #247 — phase uat-passed predicate
+ *
+ * ADR-457 build-at-publish: compiled by tsc to gsd-core/bin/lib/uat-predicate.cjs.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const frontmatter = require("./frontmatter.cjs");
+const { extractFrontmatter } = frontmatter;
+// ─── Blocking state sets (documented for maintainability) ─────────────────────
+// UAT file frontmatter `status` values that indicate the file is not fully done
+const BLOCKING_UAT_FM_STATUSES = new Set([
+    'partial', 'diagnosed', 'pending', 'blocked', 'in_progress', 'failed',
+]);
+// UAT file frontmatter `result` values that indicate failure
+const BLOCKING_UAT_FM_RESULTS = new Set(['pending', 'blocked', 'failed']);
+// VERIFICATION file frontmatter `status` values that indicate passing
+const PASSING_VERIFICATION_STATUSES = new Set([
+    'complete', 'verified', 'passed', 'human_passed',
+]);
+// VERIFICATION file frontmatter `status` values that explicitly block
+const BLOCKING_VERIFICATION_FM_STATUSES = new Set([
+    'human_needed', 'gaps_found', 'pending', 'blocked', 'partial',
+    'failed', 'in_progress',
+]);
+// UAT test-item `result` values that count as passing
+const PASSING_RESULTS = new Set(['passed', 'pass']);
+// ─── stripFalsePositiveContexts ───────────────────────────────────────────────
+/**
+ * Remove contexts that can contain `result: ...` lines that are NOT real test results:
+ *   (a) leading frontmatter block at byte 0
+ *   (b) HTML comments (unterminated comments swallow to EOF — fail-closed)
+ *   (c) fenced code blocks (backtick and tilde, indented too) via CommonMark state machine
+ *   (d) blockquote lines
+ *
+ * Each step is a composable function (Kernighan's Law — independently testable).
+ * Returns surviving lines joined by '\n'. Robust to CRLF input.
+ */
+function stripFalsePositiveContexts(content) {
+    // Step (a): strip leading frontmatter block only at byte 0
+    let stripped = content.replace(/^---\r?\n[\s\S]*?\r?\n---[ \t]*(\r?\n|$)/, '');
+    // Step (b): remove HTML comments anywhere; unterminated comment swallows to EOF
+    stripped = stripped.replace(/<!--[\s\S]*?(?:-->|$)/g, '');
+    // Step (c): remove fenced code blocks via CommonMark-style state machine (handles CRLF + indented fences)
+    stripped = _stripFencedBlocks(stripped).text;
+    // Step (d): remove blockquote lines
+    stripped = stripped
+        .split('\n')
+        .filter(line => !/^\s*>/.test(line))
+        .join('\n');
+    return stripped;
+}
+/**
+ * CommonMark-style fenced-code-block stripper.
+ * Tracks the opening delimiter char and length so that a ~~~ line inside a
+ * ``` fence is correctly treated as fence content, not a closing delimiter.
+ *
+ * Opening rule: first delimiter line with char+len sets openFence.
+ * Closing rule: delimiter line with SAME char, run length >= openFence.len,
+ *   and NO trailing non-whitespace text closes the fence.
+ * All delimiter and content lines are dropped; non-fence lines are kept.
+ * Returns the kept text plus unterminatedFence:true if EOF inside a fence.
+ */
+function _stripFencedBlocks(content) {
+    const lines = content.split('\n');
+    const kept = [];
+    let openFence = null;
+    const delimRe = /^(\s*)(`{3,}|~{3,})(.*)$/;
+    for (const rawLine of lines) {
+        // Tolerate CRLF: strip trailing \r for matching, but we work on split-by-\n lines
+        // (the outer caller joined by \n already; we just handle a stray \r in the last char)
+        const line = rawLine.replace(/\r$/, '');
+        const m = delimRe.exec(line);
+        if (m) {
+            const char = m[2][0];
+            const len = m[2].length;
+            const trailing = m[3];
+            if (openFence === null) {
+                // Opening delimiter — drop this line and record the fence
+                openFence = { char, len };
+            }
+            else if (char === openFence.char && len >= openFence.len && /^\s*$/.test(trailing)) {
+                // Closing delimiter (same char, sufficient length, no trailing text) — drop and close
+                openFence = null;
+            }
+            // else: mismatched delimiter inside fence (e.g. ~~~ inside ```) — drop as content
+            continue; // delimiter lines are always dropped
+        }
+        if (openFence === null) {
+            kept.push(rawLine);
+        }
+        // Lines inside fence are dropped
+    }
+    return { text: kept.join('\n'), unterminatedFence: openFence !== null };
+}
+/**
+ * Analyse raw markdown for structural anomalies (unterminated fence / comment).
+ * Exported for unit-testability and used by evaluateUatPassed for per-file malformed detection.
+ *
+ * FIX C: properly balanced comments are stripped before checking for a dangling <!--,
+ * so an earlier closed comment does not mask a later unterminated one.
+ */
+function analyzeMarkdown(raw) {
+    // Detect an unterminated HTML comment via a paired scan: every `<!--` must
+    // have a following `-->`. Using indexOf (not a regex .replace of the comment
+    // token) avoids the js/incomplete-multi-character-sanitization pattern — and
+    // is exact: a closed earlier comment never masks a later unterminated one.
+    let unterminatedComment = false;
+    for (let i = 0;;) {
+        const open = raw.indexOf('<!--', i);
+        if (open === -1)
+            break;
+        const close = raw.indexOf('-->', open + 4);
+        if (close === -1) {
+            unterminatedComment = true;
+            break;
+        }
+        i = close + 3;
+    }
+    // Fence state machine gives the accurate unterminated-fence signal.
+    const { unterminatedFence } = _stripFencedBlocks(raw);
+    return { unterminatedFence, unterminatedComment };
+}
+// ─── parseUatResultItems ──────────────────────────────────────────────────────
+/**
+ * HEADING-BLOCK parser: scan the CLEANED body (after stripFalsePositiveContexts)
+ * for UAT test blocks.
+ *
+ * For each ### N. Name heading, the block spans until the next ### heading or EOF.
+ * Within each block, find a column-0 anchored result line (rejects indented YAML
+ * block-scalar bodies and inline/quoted fakes).
+ *
+ * - If a heading block has NO column-0 result line → emit result:'missing' (blocker).
+ * - Support bracketed [passed] and bare passed (#2273).
+ * - Returns ALL items (both passing and non-passing).
+ */
+function parseUatResultItems(cleanContent) {
+    const items = [];
+    // Find all ### N. Name headings (line-anchored)
+    const headingPattern = /^###\s*(\d+)\.\s*(.+)$/gm;
+    const headings = [];
+    let hMatch;
+    while ((hMatch = headingPattern.exec(cleanContent)) !== null) {
+        headings.push({
+            index: hMatch.index + hMatch[0].length,
+            test: parseInt(hMatch[1], 10),
+            name: hMatch[2].trim(),
+        });
+    }
+    for (let i = 0; i < headings.length; i++) {
+        const h = headings[i];
+        const blockStart = h.index;
+        // More precise: find next heading's position in the original string
+        // We'll slice from current heading end to the position just before next heading's "###"
+        const nextHeadingMatch = i + 1 < headings.length
+            ? cleanContent.lastIndexOf('\n###', headings[i + 1].index)
+            : -1;
+        const blockContent = nextHeadingMatch >= blockStart
+            ? cleanContent.slice(blockStart, nextHeadingMatch)
+            : cleanContent.slice(blockStart);
+        // Column-0 anchored result line: /^result:[ \t]*\[?([\w-]+)\]?/mi
+        // Uses [ \t]* (not \s*) so the captured value must sit on the SAME line as result:.
+        // A result: key with the value on a subsequent line yields no match → 'missing' (blocker).
+        const resultMatch = /^result:[ \t]*\[?([\w-]+)\]?/mi.exec(blockContent);
+        if (resultMatch) {
+            items.push({
+                test: h.test,
+                name: h.name,
+                result: resultMatch[1].toLowerCase(),
+            });
+        }
+        else {
+            // No column-0 result line → emit 'missing' (a non-passing state)
+            items.push({
+                test: h.test,
+                name: h.name,
+                result: 'missing',
+            });
+        }
+    }
+    return items;
+}
+// ─── evaluateUatPassed ────────────────────────────────────────────────────────
+/**
+ * Evaluate all UAT/VERIFICATION files in a phase directory.
+ * Returns a UatPassedReport with the locked, stable shape defined by the interface.
+ *
+ * FAIL-CLOSED: any absence/ambiguity/malformed input → NOT passed.
+ * Pass requires at least one real passing check AND no blockers.
+ */
+function evaluateUatPassed(phaseFullDir, opts) {
+    const requireVerification = opts?.policy?.requireVerification === true;
+    const blockers = [];
+    const checks = [];
+    const uatFiles = [];
+    const verificationFiles = [];
+    // Read the directory — if unreadable, treat as no files (fail-closed: no artifacts → not passed)
+    let dirEntries = [];
+    try {
+        dirEntries = node_fs_1.default.readdirSync(phaseFullDir);
+    }
+    catch {
+        // Unreadable dir — no_uat_artifacts:true, passed:false
+        const no_uat_artifacts = true;
+        if (requireVerification) {
+            blockers.push('policy: verification required but no passing *-VERIFICATION.md found');
+        }
+        return {
+            passed: false,
+            uat_files: [],
+            verification_files: [],
+            checks: [],
+            blockers,
+            no_uat_artifacts,
+            policy: { require_verification: requireVerification },
+        };
+    }
+    // Filter UAT and VERIFICATION files using the same filter as cmdPhaseComplete
+    const uatFileNames = dirEntries.filter(f => f.includes('-UAT') && f.endsWith('.md'));
+    const verFileNames = dirEntries.filter(f => f.includes('-VERIFICATION') && f.endsWith('.md'));
+    // ── Process UAT files ──────────────────────────────────────────────────────
+    for (const file of uatFileNames) {
+        uatFiles.push(file);
+        let raw = '';
+        try {
+            raw = node_fs_1.default.readFileSync(node_path_1.default.join(phaseFullDir, file), 'utf-8');
+        }
+        catch {
+            blockers.push(`${file}: could not read file`);
+            continue;
+        }
+        // ── Per-file malformed markdown guard ──────────────────────────────────
+        // FIX D: use accurate signals from analyzeMarkdown instead of heuristics.
+        // unterminatedFence: CommonMark state machine detects a genuinely unclosed fence.
+        // unterminatedComment: strips balanced comments first, then checks for leftover <!--.
+        const { unterminatedFence, unterminatedComment } = analyzeMarkdown(raw);
+        if (unterminatedFence || unterminatedComment) {
+            blockers.push(`${file}: malformed markdown (unterminated fence or comment)`);
+        }
+        const fm = extractFrontmatter(raw);
+        // File-level frontmatter status check
+        if (fm['status'] && BLOCKING_UAT_FM_STATUSES.has(fm['status'])) {
+            blockers.push(`${file}: frontmatter status=${fm['status']}`);
+        }
+        // File-level frontmatter result check
+        if (fm['result'] && BLOCKING_UAT_FM_RESULTS.has(fm['result'])) {
+            blockers.push(`${file}: frontmatter result=${fm['result']}`);
+        }
+        // Parse test items from the cleaned body (hardened against false positives)
+        const cleanContent = stripFalsePositiveContexts(raw);
+        const items = parseUatResultItems(cleanContent);
+        for (const item of items) {
+            const passing = PASSING_RESULTS.has(item.result);
+            checks.push({
+                file,
+                test: item.test,
+                name: item.name,
+                result: item.result,
+                passing,
+            });
+            if (!passing) {
+                blockers.push(`${file}: test ${item.test} (${item.result})`);
+            }
+        }
+    }
+    // ── Process VERIFICATION files ─────────────────────────────────────────────
+    let hasPassingVerification = false;
+    for (const file of verFileNames) {
+        verificationFiles.push(file);
+        let raw = '';
+        try {
+            raw = node_fs_1.default.readFileSync(node_path_1.default.join(phaseFullDir, file), 'utf-8');
+        }
+        catch {
+            blockers.push(`${file}: could not read verification file`);
+            continue;
+        }
+        const vfm = extractFrontmatter(raw);
+        const vStatus = vfm['status'];
+        if (vStatus && BLOCKING_VERIFICATION_FM_STATUSES.has(vStatus)) {
+            blockers.push(`${file}: verification status=${vStatus}`);
+        }
+        else if (vStatus && PASSING_VERIFICATION_STATUSES.has(vStatus)) {
+            // Allowlist: only explicitly-passing statuses count
+            hasPassingVerification = true;
+        }
+        // Missing or unknown status: does NOT count as passing, does NOT push a blocker
+        // (handled by the requireVerification policy check below if needed)
+    }
+    // ── Policy: requireVerification ───────────────────────────────────────────
+    if (requireVerification && !hasPassingVerification) {
+        blockers.push('policy: verification required but no passing *-VERIFICATION.md found');
+    }
+    // ── Determine no_uat_artifacts and passed ─────────────────────────────────
+    // no_uat_artifacts: true when no real UAT test items were parsed from any file
+    const no_uat_artifacts = checks.length === 0;
+    // FIX 1: require positive passing evidence; no vacuous pass
+    // passed = no blockers AND at least one check AND all checks passing
+    const passed = blockers.length === 0 && checks.length > 0 && checks.every(c => c.passing);
+    return {
+        passed,
+        uat_files: uatFiles,
+        verification_files: verificationFiles,
+        checks,
+        blockers,
+        no_uat_artifacts,
+        policy: {
+            require_verification: requireVerification,
+        },
+    };
+}
+module.exports = {
+    stripFalsePositiveContexts,
+    parseUatResultItems,
+    analyzeMarkdown,
+    evaluateUatPassed,
+};

package/gsd-core/bin/lib/update-context.cjs

@@ -29,7 +29,10 @@ exports.RUNTIME_DIRS = [
     ['antigravity', '.gemini/antigravity-ide'],
     ['antigravity', '.gemini/antigravity-cli'],
     ['antigravity', '.gemini/antigravity'],
-    ['antigravity', '.agent'], // local Antigravity install dir (#503; bin/install.js getDirName('antigravity'))
+    ['antigravity', '.agents'], // local Antigravity install dir canonical (#791; bin/install.js getDirName('antigravity'))
+    ['antigravity', '.agent'], // local Antigravity install dir legacy (#503; backward-compat with pre-#791 installs)
+    ['windsurf', '.devin'], // local Windsurf/Devin Desktop install dir canonical (#1085; bin/install.js getDirName('windsurf'))
+    ['windsurf', '.windsurf'], // local Windsurf install dir legacy (#1085; backward-compat with pre-#1085 installs)
     ['gemini', '.gemini'],
     ['kilo', '.config/kilo'],
     ['kilo', '.kilo'],

package/gsd-core/bin/lib/verify.cjs

@@ -121,6 +121,98 @@ function cmdVerifySummary(cwd, summaryPath, checkFileCount, raw) {
     const result = { passed, checks, errors };
     output(result, raw, passed ? 'passed' : 'failed');
 }
+/**
+ * Issue #429 — negative-grep comment-text echo gate.
+ * A literal that an acceptance criterion negative-greps for (grep -c 'LIT' file == 0)
+ * must not also appear verbatim inside an <action> body, or the executor's commit-time
+ * verify gate fails on the comment echo rather than a real regression. Conservative:
+ * errors only on a confidently-extracted QUOTED literal; ambiguous (bareword) → warning.
+ */
+function scanNegativeGrepCommentEcho(content) {
+    const errors = [];
+    const warnings = [];
+    // Normalize newlines; join backslash line-continuations so a verify command wrapped
+    // across lines (grep ... \ <newline> == 0) is still seen as one segment.
+    const text = (content || '')
+        .replace(/\r\n/g, '\n')
+        .replace(/\r/g, '\n')
+        .replace(/\\\n/g, ' ');
+    // 1. Allowlisted literals: <!-- planner-discipline-allow: LIT -->
+    const allow = new Set();
+    const allowRe = /<!--\s*planner-discipline-allow:\s*(.+?)\s*-->/g;
+    let am;
+    while ((am = allowRe.exec(text)) !== null)
+        allow.add(am[1]);
+    // Zero-equality comparison (the negative grep). The required leading whitespace
+    // before the operator distinguishes a shell comparison (`[ $c == 0 ]`, `... == 0`,
+    // always spaced) from an assignment (`VAR=0`, never spaced) and naturally excludes
+    // `>= 0`, `<= 0`, `!= 0`, `!== 0`, `=== 0`.
+    const zeroCmp = (s) => /\s==?\s*0\b/.test(s) || /-eq\s+0\b/.test(s) || /\bequals\s+0\b/.test(s);
+    // A grep invocation using a count flag (-c / -cF / -Fc / --count), capturing the
+    // search pattern (first quoted token, else first bareword) after a run of options.
+    // The options run lets `grep -c -F 'LIT'`, `grep -F -c 'LIT'`, `grep -c -e 'LIT'`
+    // and `grep --count 'LIT'` all resolve to the LIT pattern.
+    const countGrepRe = /grep((?:\s+-{1,2}[A-Za-z][A-Za-z-]*)+)\s+(?:'([^']*)'|"([^"]*)"|([^\s'"|>&;]+))/g;
+    const optsHaveCount = (opts) => /(?:^|\s)-[A-Za-z]*c[A-Za-z]*(?=\s|$)/.test(opts) || /--count\b/.test(opts);
+    // `grep -cv 'pat' == 0` counts NON-matching lines, so == 0 there asserts "all lines
+    // match" — a POSITIVE gate, not our negative gate. Skip inverted greps.
+    const optsHaveInvert = (opts) => /(?:^|\s)-[A-Za-z]*v[A-Za-z]*(?=\s|$)/.test(opts) || /--invert-match\b/.test(opts);
+    // Bareword sanity: a real grep target, not a stray operator/number/flag.
+    const plausibleBare = (s) => /[A-Za-z0-9_]/.test(s) && !/^[-=!<>0-9]+$/.test(s);
+    // 2. <action> text to scan, with negative-grep COMMAND SPANS removed (only the
+    //    command, not the whole line) so a pasted verify command does not self-flag
+    //    while a prose echo on the same line is still caught.
+    const cmdSpanRe = /grep(?:\s+-{1,2}[A-Za-z][A-Za-z-]*)+\s+(?:'[^']*'|"[^"]*"|[^\s'"|>&;]+)[^\n]*?(?:==|-eq|=)\s*0\b/g;
+    const actionZones = [];
+    const actionRe = /<action>([\s\S]*?)<\/action>/g;
+    let acm;
+    while ((acm = actionRe.exec(text)) !== null)
+        actionZones.push(acm[1]);
+    const scannableActionText = actionZones.map((zone) => zone.replace(cmdSpanRe, ' ')).join('\n');
+    // 3. Per shell SEGMENT (split lines on && / ||) extract count-grep literals and
+    //    check echoes. Per-segment splitting keeps a positive gate (`== 1`) from
+    //    poisoning a negative gate (`== 0`) sharing the same physical line.
+    const seenErr = new Set();
+    const seenWarn = new Set();
+    const segments = text.split('\n').flatMap((line) => line.split(/\s*(?:&&|\|\|)\s*/));
+    for (const seg of segments) {
+        if (!/grep(?:\s+-{1,2}[A-Za-z])/.test(seg) || !zeroCmp(seg))
+            continue;
+        countGrepRe.lastIndex = 0;
+        const quotedLits = [];
+        const bareLits = [];
+        let m;
+        while ((m = countGrepRe.exec(seg)) !== null) {
+            if (!optsHaveCount(m[1]) || optsHaveInvert(m[1]))
+                continue; // need count, not invert (-cv is positive)
+            if (m[2] !== undefined)
+                quotedLits.push(m[2]);
+            else if (m[3] !== undefined)
+                quotedLits.push(m[3]);
+            else if (m[4] !== undefined && plausibleBare(m[4]))
+                bareLits.push(m[4]);
+        }
+        for (const quoted of quotedLits) {
+            if (!quoted || allow.has(quoted) || seenErr.has(quoted))
+                continue;
+            if (scannableActionText.includes(quoted)) {
+                seenErr.add(quoted);
+                errors.push(`Plan body contains forbidden literal "${quoted}" in an <action> block, but an acceptance criterion negative-greps for it (grep -c ... == 0). Rephrase the literal by concept, remove it from the plan body, or add <!-- planner-discipline-allow: ${quoted} --> if it must legitimately appear.`);
+            }
+        }
+        if (quotedLits.length === 0) {
+            for (const bare of bareLits) {
+                if (allow.has(bare) || seenWarn.has(bare))
+                    continue;
+                if (scannableActionText.includes(bare)) {
+                    seenWarn.add(bare);
+                    warnings.push(`Possible comment-text echo (#429): negative-grep target "${bare}" is unquoted so its literal could not be extracted unambiguously, but it appears in an <action> block. Quote the grep literal and add an allowlist marker if the echo is intended, or rephrase by concept.`);
+                }
+            }
+        }
+    }
+    return { errors, warnings };
+}
 function cmdVerifyPlanStructure(cwd, filePath, raw) {
     if (!filePath) {
         error('file path required');
@@ -175,6 +267,9 @@ function cmdVerifyPlanStructure(cwd, filePath, raw) {
     if (hasCheckpoints && fm['autonomous'] !== 'false' && String(fm['autonomous']) !== 'false') {
         errors.push('Has checkpoint tasks but autonomous is not false');
     }
+    const echoScan = scanNegativeGrepCommentEcho(content);
+    errors.push(...echoScan.errors);
+    warnings.push(...echoScan.warnings);
     output({
         valid: errors.length === 0,
         errors,
@@ -383,7 +478,7 @@ function cmdVerifyKeyLinks(cwd, planFilePath, raw) {
         };
         const sourceContent = (0, shell_command_projection_cjs_1.platformReadSync)(node_path_1.default.join(cwd, link['from'] || ''));
         if (!sourceContent) {
-            check['detail'] = 'Source file not found';
+            check['detail'] = 'Source file not found (from: must be a relative file path; describe components/endpoints in via:)';
         }
         else if (link['pattern']) {
             try {
@@ -826,6 +921,12 @@ function cmdValidateHealth(cwd, options, raw) {
             if ((agentStatus.installed_agents).length === 0) {
                 addIssue('warning', 'W010', `No GSD agents found in ${agentStatus.agents_dir} — Task(subagent_type="gsd-*") will fall back to general-purpose`, `Run the GSD installer: npx ${package_identity_cjs_1.PACKAGE_NAME}@latest`);
             }
+            else if ((agentStatus.incomplete_agents).length > 0 && (agentStatus.missing_agents).length === 0) {
+                addIssue('warning', 'W010', `Incomplete agent installs (missing generated file): ${(agentStatus.incomplete_agents).join(', ')} — affected workflows may fall back to general-purpose`, `Re-run the GSD installer to complete the install: npx ${package_identity_cjs_1.PACKAGE_NAME}@latest`);
+            }
+            else if ((agentStatus.incomplete_agents).length > 0) {
+                addIssue('warning', 'W010', `Missing ${(agentStatus.missing_agents).length} GSD agents: ${(agentStatus.missing_agents).join(', ')}; incomplete agent installs (missing generated file): ${(agentStatus.incomplete_agents).join(', ')} — affected workflows will fall back to general-purpose`, `Run the GSD installer: npx ${package_identity_cjs_1.PACKAGE_NAME}@latest`);
+            }
             else {
                 addIssue('warning', 'W010', `Missing ${(agentStatus.missing_agents).length} GSD agents: ${(agentStatus.missing_agents).join(', ')} — affected workflows will fall back to general-purpose`, `Run the GSD installer: npx ${package_identity_cjs_1.PACKAGE_NAME}@latest`);
             }
@@ -1239,6 +1340,7 @@ function cmdValidateAgents(cwd, raw) {
         agents_found: agentStatus.agents_installed,
         installed: agentStatus.installed_agents,
         missing: agentStatus.missing_agents,
+        incomplete: agentStatus.incomplete_agents,
         expected,
     }, raw);
 }
@@ -1423,6 +1525,7 @@ function cmdVerifyCodebaseDrift(cwd, raw) {
     }
 }
 module.exports = {
+    scanNegativeGrepCommentEcho,
     cmdVerifySummary,
     cmdVerifyPlanStructure,
     cmdVerifyPhaseCompleteness,

package/gsd-core/bin/lib/worktree-base-ref.cjs

@@ -24,6 +24,7 @@ exports.evaluateWorktreeBaseDegrade = evaluateWorktreeBaseDegrade;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // ─── Internal helpers ─────────────────────────────────────────────────────────
 /**
  * Strip JSONC comments (line and block forms) from a string to produce valid JSON.
@@ -153,12 +154,18 @@ function applyWorktreeBaseRef(settings) {
     return { changed: true, settings, skipped: null, previous: null };
 }
 /**
- * Reads settings.local.json then settings.json under claudeDir, extracts
- * worktree.baseRef from the first file that provides a non-null string value.
+ * Reads settings files in a 3-layer cascade and extracts worktree.baseRef from
+ * the first layer that provides a non-null string value. Layers (highest to lowest
+ * precedence):
+ *   1. project local  — <claudeDir>/settings.local.json
+ *   2. project shared — <claudeDir>/settings.json
+ *   3. user/global    — <userClaudeDir>/settings.json  (only when userClaudeDir is
+ *                       provided AND resolves to a different path than claudeDir)
  *
  * deps.readFile(path) must return the file contents or null on any error.
+ * userClaudeDir is optional; when absent/null the user/global layer is skipped.
  */
-function resolveEffectiveBaseRef(claudeDir, deps) {
+function resolveEffectiveBaseRef(claudeDir, deps, userClaudeDir) {
     const readFile = deps?.readFile ?? ((p) => {
         try {
             return node_fs_1.default.readFileSync(p, 'utf8');
@@ -181,21 +188,39 @@ function resolveEffectiveBaseRef(claudeDir, deps) {
             return null;
         }
     }
+    // Layer 1: project local
     const localRef = parseBaseRef(localPath);
     if (localRef !== null)
         return localRef;
-    return parseBaseRef(sharedPath);
+    // Layer 2: project shared
+    const sharedRef = parseBaseRef(sharedPath);
+    if (sharedRef !== null)
+        return sharedRef;
+    // Layer 3: user/global (only when provided and not the same directory as claudeDir)
+    if (userClaudeDir && node_path_1.default.resolve(userClaudeDir) !== node_path_1.default.resolve(claudeDir)) {
+        const userSharedPath = node_path_1.default.join(userClaudeDir, 'settings.json');
+        const userRef = parseBaseRef(userSharedPath);
+        if (userRef !== null)
+            return userRef;
+    }
+    return null;
 }
 /**
  * CLI command: check current worktree base-ref degradation status.
  *
- * Reads effective baseRef from <cwd>/.claude settings, runs degradation
- * evaluation, writes JSON result to stdout (or injected write), and returns
- * the result object.
+ * Reads effective baseRef from <cwd>/.claude settings (3-layer cascade:
+ * project local → project shared → user/global), runs degradation evaluation,
+ * writes JSON result to stdout (or injected write), and returns the result object.
+ *
+ * deps.userClaudeDir overrides the user/global config directory resolution
+ * (default: getGlobalConfigDir('claude'), which honours CLAUDE_CONFIG_DIR).
  */
 function cmdWorktreeBaseCheck(cwd, _args, deps) {
     const claudeDir = node_path_1.default.join(cwd, '.claude');
-    const effectiveBaseRef = resolveEffectiveBaseRef(claudeDir, deps?.readFile ? { readFile: deps.readFile } : undefined);
+    const userClaudeDir = Object.prototype.hasOwnProperty.call(deps ?? {}, 'userClaudeDir')
+        ? deps.userClaudeDir
+        : (0, runtime_homes_cjs_1.getGlobalConfigDir)('claude');
+    const effectiveBaseRef = resolveEffectiveBaseRef(claudeDir, deps?.readFile ? { readFile: deps.readFile } : undefined, userClaudeDir);
     const result = evaluateWorktreeBaseDegrade({
         cwd,
         effectiveBaseRef,

package/gsd-core/bin/shared/model-catalog.json

@@ -14,11 +14,11 @@
     },
     "codex": {
       "opus": { "model": "gpt-5.5", "reasoning_effort": "xhigh" },
-      "sonnet": { "model": "gpt-5.3-codex", "reasoning_effort": "medium" },
+      "sonnet": { "model": "gpt-5.4", "reasoning_effort": "medium" },
       "haiku": { "model": "gpt-5.4-mini", "reasoning_effort": "medium" }
     },
     "gemini": {
-      "opus": { "model": "gemini-3-pro" },
+      "opus": { "model": "gemini-3.1-pro-preview" },
       "sonnet": { "model": "gemini-3-flash" },
       "haiku": { "model": "gemini-2.5-flash-lite" }
     },
@@ -52,6 +52,11 @@
       "sonnet": null,
       "haiku": null
     },
+    "kimi": {
+      "opus": null,
+      "sonnet": null,
+      "haiku": null
+    },
     "cursor": {
       "opus": null,
       "sonnet": null,
@@ -95,12 +100,12 @@
       "haiku":  { "low": { "model": "claude-haiku-4-5" }, "medium": { "model": "claude-haiku-4-5" }, "high": { "model": "claude-sonnet-4-6" } }
     },
     "openai": {
-      "opus":   { "low": { "model": "gpt-5.3-codex", "reasoning_effort": "medium" }, "medium": { "model": "gpt-5.5", "reasoning_effort": "high" }, "high": { "model": "gpt-5.5", "reasoning_effort": "xhigh" } },
-      "sonnet": { "low": { "model": "gpt-5.4-mini", "reasoning_effort": "low" }, "medium": { "model": "gpt-5.3-codex", "reasoning_effort": "medium" }, "high": { "model": "gpt-5.5", "reasoning_effort": "medium" } },
-      "haiku":  { "low": { "model": "gpt-5.4-mini", "reasoning_effort": "minimal" }, "medium": { "model": "gpt-5.4-mini", "reasoning_effort": "medium" }, "high": { "model": "gpt-5.3-codex", "reasoning_effort": "medium" } }
+      "opus":   { "low": { "model": "gpt-5.4", "reasoning_effort": "medium" }, "medium": { "model": "gpt-5.5", "reasoning_effort": "high" }, "high": { "model": "gpt-5.5", "reasoning_effort": "xhigh" } },
+      "sonnet": { "low": { "model": "gpt-5.4-mini", "reasoning_effort": "low" }, "medium": { "model": "gpt-5.4", "reasoning_effort": "medium" }, "high": { "model": "gpt-5.5", "reasoning_effort": "medium" } },
+      "haiku":  { "low": { "model": "gpt-5.4-mini", "reasoning_effort": "minimal" }, "medium": { "model": "gpt-5.4-mini", "reasoning_effort": "medium" }, "high": { "model": "gpt-5.4", "reasoning_effort": "medium" } }
     },
     "google": {
-      "opus":   { "low": { "model": "gemini-2.5-flash-lite" }, "medium": { "model": "gemini-3-flash" }, "high": { "model": "gemini-3-pro" } },
+      "opus":   { "low": { "model": "gemini-2.5-flash-lite" }, "medium": { "model": "gemini-3-flash" }, "high": { "model": "gemini-3.1-pro-preview" } },
       "sonnet": { "low": { "model": "gemini-2.5-flash-lite" }, "medium": { "model": "gemini-3-flash" }, "high": { "model": "gemini-3-flash" } },
       "haiku":  { "low": { "model": "gemini-2.5-flash-lite" }, "medium": { "model": "gemini-2.5-flash-lite" }, "high": { "model": "gemini-3-flash" } }
     },

package/gsd-core/bin/shared/runtime-aliases.manifest.json

@@ -43,7 +43,8 @@
   "windsurf": [
     "windsurf",
     "windsurf-cli",
-    "windsurf-next"
+    "windsurf-next",
+    "devin-desktop"
   ],
   "augment": [
     "augment",
@@ -64,6 +65,9 @@
     "hermes-agent",
     "hermes-cli"
   ],
+  "kimi": [
+    "kimi"
+  ],
   "codebuddy": [
     "codebuddy",
     "codebuddy-cli"

package/gsd-core/references/edge-probe-fixtures/01-round-half-even/expected-coverage.json

@@ -0,0 +1,7 @@
+{
+  "items": [
+    { "requirement_id": "R1", "category": "boundary", "status": "unresolved", "verification": null, "resolution": null, "reason": null, "probe": "What happens exactly at each min/max/threshold — and one step either side?" },
+    { "requirement_id": "R1", "category": "precision", "status": "unresolved", "verification": null, "resolution": null, "reason": null, "probe": "Where can precision loss, overflow, or rounding/tie-breaking occur — and what is the exact contract (e.g. half-up vs half-to-even, ceil/floor/truncate)?" }
+  ],
+  "coverage": { "applicable": 2, "resolved": 0, "unresolved": 2, "byVerification": { "explicit": 0, "backstop": 0 } }
+}

package/gsd-core/references/edge-probe-fixtures/01-round-half-even/requirements.json

@@ -0,0 +1 @@
+[{ "id": "R1", "text": "Round a number to N decimal places, rounding half to nearest" }]

package/gsd-core/references/edge-probe-fixtures/02-merge-intervals/expected-coverage.json

@@ -0,0 +1,8 @@
+{
+  "items": [
+    { "requirement_id": "R1", "category": "adjacency", "status": "unresolved", "verification": null, "resolution": null, "reason": null, "probe": "When two things are exactly equal or just touch, do they merge, collide, or separate?" },
+    { "requirement_id": "R1", "category": "empty", "status": "unresolved", "verification": null, "resolution": null, "reason": null, "probe": "What is the result for empty, single-element, or null input?" },
+    { "requirement_id": "R1", "category": "ordering", "status": "unresolved", "verification": null, "resolution": null, "reason": null, "probe": "When elements compare equal, is output order specified and stable?" }
+  ],
+  "coverage": { "applicable": 3, "resolved": 0, "unresolved": 3, "byVerification": { "explicit": 0, "backstop": 0 } }
+}

package/gsd-core/references/edge-probe-fixtures/02-merge-intervals/requirements.json

@@ -0,0 +1 @@
+[{ "id": "R1", "text": "Merge a list of overlapping intervals into the minimal set" }]