@opengsd/gsd-core 1.5.0-rc.2 → 1.5.0-rc.4

package/gsd-core/bin/lib/config.cjs

@@ -206,7 +206,6 @@ function buildNewProjectConfig(userChoices) {
             ui_phase: true,
             ui_safety_gate: true,
             ai_integration_phase: true,
-            tdd_mode: false,
             human_verify_mode: 'end-of-phase',
             text_mode: false,
             research_before_questions: false,
@@ -234,7 +233,7 @@ function buildNewProjectConfig(userChoices) {
         project_code: null,
         phase_naming: 'sequential',
         agent_skills: {},
-        claude_md_path: './CLAUDE.md',
+        claude_md_path: './.claude/CLAUDE.md',
         plan_review: {
             source_grounding: true,
             source_grounding_authority: 'grep',
@@ -369,6 +368,42 @@ function cmdConfigEnsureSection(cwd, raw) {
         output(ensureConfigFileResult, raw, 'exists');
     }
 }
+/**
+ * Shared helper: write a single key-path into an in-memory config object.
+ *
+ * Prototype-pollution guard: reject dangerous segments via inline literal
+ * comparisons on the exact key used to index `current`, immediately before
+ * each write. The inline comparison is the barrier CodeQL's
+ * js/prototype-pollution-utility query recognises — the previous Set-based
+ * pre-loop check was functionally correct but not traced through, so
+ * code-scanning alert #26 kept firing. Behaviour is unchanged from #663.
+ *
+ * Returns the previous value at the leaf key (undefined if absent).
+ * Never writes to disk — callers handle persistence.
+ * Calls error() (process.exit(1)) on prototype-pollution attempts.
+ */
+function _setNestedValue(config, keyPath, parsedValue) {
+    const keys = keyPath.split('.');
+    let current = config;
+    for (let i = 0; i < keys.length - 1; i++) {
+        const key = keys[i];
+        if (key === '__proto__' || key === 'prototype' || key === 'constructor') {
+            error('Invalid config key (prototype pollution guard): ' + keyPath, ERROR_REASON.CONFIG_PARSE_FAILED);
+        }
+        const existingChild = current[key];
+        if (existingChild === undefined || existingChild === null || typeof existingChild !== 'object' || Array.isArray(existingChild)) {
+            current[key] = {};
+        }
+        current = current[key];
+    }
+    const lastKey = keys[keys.length - 1];
+    if (lastKey === '__proto__' || lastKey === 'prototype' || lastKey === 'constructor') {
+        error('Invalid config key (prototype pollution guard): ' + keyPath, ERROR_REASON.CONFIG_PARSE_FAILED);
+    }
+    const previousValue = current[lastKey];
+    current[lastKey] = parsedValue;
+    return previousValue;
+}
 /**
  * Sets a value in the config file, allowing nested values via dot notation (e.g.,
  * "workflow.research").
@@ -389,35 +424,52 @@ function setConfigValue(cwd, keyPath, parsedValue) {
         catch (err) {
             error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
         }
-        // Set nested value using dot notation (e.g., "workflow.research").
-        // Prototype-pollution guard: reject dangerous segments via inline literal
-        // comparisons on the exact key used to index `current`, immediately before
-        // each write. The inline comparison is the barrier CodeQL's
-        // js/prototype-pollution-utility query recognises — the previous Set-based
-        // pre-loop check was functionally correct but not traced through, so
-        // code-scanning alert #26 kept firing. Behaviour is unchanged from #663.
-        const keys = keyPath.split('.');
-        let current = config;
-        for (let i = 0; i < keys.length - 1; i++) {
-            const key = keys[i];
-            if (key === '__proto__' || key === 'prototype' || key === 'constructor') {
-                error('Invalid config key (prototype pollution guard): ' + keyPath, ERROR_REASON.CONFIG_PARSE_FAILED);
-            }
-            if (current[key] === undefined || typeof current[key] !== 'object') {
-                current[key] = {};
+        const previousValue = _setNestedValue(config, keyPath, parsedValue);
+        // Write back
+        try {
+            (0, shell_command_projection_cjs_1.platformWriteSync)(configPath, JSON.stringify(config, null, 2));
+            return { updated: true, key: keyPath, value: parsedValue, previousValue };
+        }
+        catch (err) {
+            error('Failed to write config.json: ' + err.message);
+        }
+    });
+}
+/**
+ * Batched sibling of setConfigValue: apply multiple key-path writes in a
+ * single load → set-all → write cycle inside ONE withPlanningLock call.
+ *
+ * Returns { updated: true, results: SetConfigValueResult[] } on success.
+ * An empty entries array is a no-op and returns { updated: false, results: [] }.
+ *
+ * Prototype-pollution guards are enforced per entry (identical inline-literal
+ * guards as setConfigValue — CodeQL barrier requirement).
+ */
+function setConfigValues(cwd, entries) {
+    if (entries.length === 0) {
+        return { updated: false, results: [] };
+    }
+    const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
+    return withPlanningLock(cwd, () => {
+        // Load existing config or start with empty object
+        let config = {};
+        try {
+            if (node_fs_1.default.existsSync(configPath)) {
+                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
             }
-            current = current[key];
         }
-        const lastKey = keys[keys.length - 1];
-        if (lastKey === '__proto__' || lastKey === 'prototype' || lastKey === 'constructor') {
-            error('Invalid config key (prototype pollution guard): ' + keyPath, ERROR_REASON.CONFIG_PARSE_FAILED);
+        catch (err) {
+            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
         }
-        const previousValue = current[lastKey]; // Capture previous value before overwriting
-        current[lastKey] = parsedValue;
-        // Write back
+        const results = [];
+        for (const entry of entries) {
+            const previousValue = _setNestedValue(config, entry.keyPath, entry.value);
+            results.push({ updated: true, key: entry.keyPath, value: entry.value, previousValue });
+        }
+        // Write back once for all entries
         try {
             (0, shell_command_projection_cjs_1.platformWriteSync)(configPath, JSON.stringify(config, null, 2));
-            return { updated: true, key: keyPath, value: parsedValue, previousValue };
+            return { updated: true, results };
         }
         catch (err) {
             error('Failed to write config.json: ' + err.message);
@@ -735,4 +787,7 @@ module.exports = {
     cmdConfigNewProject,
     cmdConfigPath,
     cmdMigrateConfig,
+    // Exported for programmatic use by capability-writer and tests
+    setConfigValue,
+    setConfigValues,
 };

package/gsd-core/bin/lib/core.cjs

@@ -47,7 +47,7 @@ const { loadConfig, isGitIgnored, CONFIG_DEFAULTS, _warnUnknownProfileOverrides,
 // ─── Model Resolver Module (extracted from core, ADR-857 phase 2f / #888) ────
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const modelResolverModule = require("./model-resolver.cjs");
-const { resolveTierEntry, resolveModelPolicy, resolveModelInternal, VALID_GRANULARITIES, resolveGranularityInternal, assertValidGranularityOverride, resolveModelForTier, VALID_EFFORTS, EFFORT_SET, nextEffort, resolveEffortInternal, resolveFastModeInternal, resolveEffortForTier, } = modelResolverModule;
+const { resolveTierEntry, resolveModelPolicy, resolveModelInternal, VALID_GRANULARITIES, resolveGranularityInternal, assertValidGranularityOverride, resolveModelForTier, VALID_EFFORTS, EFFORT_SET, nextEffort, resolveEffortInternal, resolveFastModeInternal, resolveEffortForTier, _resetModelPolicyWarningCacheForTests, } = modelResolverModule;
 // ─── Path helpers ────────────────────────────────────────────────────────────
 // toPosixPath and detectSubRepos moved to core-utils.cjs (ADR-857 phase 2c / #877).
 // The destructured bindings above (from coreUtilsModule) make them available to
@@ -305,7 +305,10 @@ module.exports = {
     resolveTierEntry,
     resolveModelPolicy,
     KNOWN_PROVIDERS: model_catalog_cjs_1.KNOWN_PROVIDERS,
-    _resetRuntimeWarningCacheForTests,
+    _resetRuntimeWarningCacheForTests: () => {
+        _resetRuntimeWarningCacheForTests();
+        _resetModelPolicyWarningCacheForTests();
+    },
     pathExistsInternal,
     gitWorktreeInfoInternal,
     generateSlugInternal,

package/gsd-core/bin/lib/edge-probe.cjs

@@ -19,7 +19,7 @@
  * edges, and (via probe-core) merges author resolutions into a coverage report.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EDGE_VALIDATORS = exports.TAXONOMY = exports.VALID_SHAPES = exports.SHAPE_CUES = void 0;
+exports.EDGE_VALIDATORS = exports.UNCLASSIFIED_CATEGORY = exports.TAXONOMY = exports.VALID_SHAPES = exports.SHAPE_CUES = void 0;
 exports.classifyShape = classifyShape;
 exports.applicableCategories = applicableCategories;
 exports.validateRequirement = validateRequirement;
@@ -74,8 +74,15 @@ function applicableCategories(shapes) {
  * taxonomy; both verification tiers require a non-empty `resolution` (an explicit AC's text
  * or a backstop note) so plan-phase has a criterion to lift.
  */
+/**
+ * Pseudo-category for a requirement whose prose matched NO shape cue (#1110). It is a soft
+ * "review manually" signal, NOT a 9th taxonomy category: it stays out of `TAXONOMY` (the closed
+ * eight) and only joins `EDGE_VALIDATORS.categories` so `analyzeCoverage` accepts the item.
+ */
+exports.UNCLASSIFIED_CATEGORY = 'unclassified';
+const UNCLASSIFIED_PROBE = 'unclassified — review manually';
 exports.EDGE_VALIDATORS = {
-    categories: exports.TAXONOMY.map((c) => c.id),
+    categories: [...exports.TAXONOMY.map((c) => c.id), exports.UNCLASSIFIED_CATEGORY],
     verification: ['explicit', 'backstop'],
     requiredFieldsByVerification: { explicit: ['resolution'], backstop: ['resolution'] },
 };
@@ -126,6 +133,22 @@ function proposeEdges(requirement) {
     }
     else {
         shapes = classifyShape(requirement.text);
+        if (shapes.length === 0) {
+            // Prose present but no shape cue matched. Do NOT silently drop it (#1110): an
+            // edge-relevant requirement whose phrasing missed every cue would otherwise vanish from
+            // coverage with no signal — the exact blind spot this probe exists to catch. Surface ONE
+            // soft, dismissible "unclassified — review manually" candidate. The explicit `shapes: []`
+            // opt-out (handled above) stays silent — that is the author's deliberate "no edge surface".
+            return [{
+                    requirement_id: requirement.id,
+                    category: exports.UNCLASSIFIED_CATEGORY,
+                    status: 'unresolved',
+                    verification: null,
+                    resolution: null,
+                    reason: null,
+                    probe: UNCLASSIFIED_PROBE,
+                }];
+        }
     }
     return applicableCategories(shapes).map((catId) => {
         const cat = exports.TAXONOMY.find((c) => c.id === catId);

package/gsd-core/bin/lib/frontmatter.cjs

@@ -202,13 +202,60 @@ function reconstructFrontmatter(obj) {
     return lines.join('\n');
 }
 function spliceFrontmatter(content, newObj) {
-    const yamlStr = reconstructFrontmatter(newObj);
     const match = content.match(/^---\r?\n[\s\S]+?\r?\n---/);
     if (match) {
+        // Identity-preservation (additive, lossless round-trip): `reconstructFrontmatter` is a
+        // deliberately lossy serializer — it cannot faithfully re-emit nested object-list items
+        // (e.g. must_haves.artifacts / must_haves.prohibitions, whose items are `{ path, provides }`
+        // / `{ statement, status, … }` maps). When the caller is writing back a value that is
+        // STRUCTURALLY UNCHANGED from the original parse (the canonical CRUD round-trip and the
+        // #644 prohibition schema round-trip both do this), regenerating from the lossy object would
+        // silently mangle those blocks. Detect that case by deep-equality against a re-parse of the
+        // original frontmatter and preserve the ORIGINAL raw text verbatim — a true no-op splice.
+        // This touches neither the parser (`extractFrontmatter`) nor `parseMustHavesBlock`; it only
+        // makes the existing splice faithful when nothing changed. A genuine mutation (different
+        // object) still flows through `reconstructFrontmatter` exactly as before.
+        try {
+            if (frontmatterDeepEqual(extractFrontmatter(content), newObj)) {
+                return content;
+            }
+        }
+        catch {
+            /* fall through to regeneration on any comparison hiccup */
+        }
+        const yamlStr = reconstructFrontmatter(newObj);
         return `---\n${yamlStr}\n---` + content.slice(match[0].length);
     }
+    const yamlStr = reconstructFrontmatter(newObj);
     return `---\n${yamlStr}\n---\n\n` + content;
 }
+/**
+ * Structural deep-equality for two parsed frontmatter objects. Order-sensitive for arrays
+ * (YAML lists are ordered), key-order-insensitive for objects. Used only by `spliceFrontmatter`
+ * to recognize a no-op write-back; intentionally narrow (handles the string / string[] /
+ * nested-object shapes `extractFrontmatter` produces).
+ */
+function frontmatterDeepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (a == null || b == null)
+        return a === b;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        return a.every((v, i) => frontmatterDeepEqual(v, b[i]));
+    }
+    if (typeof a === 'object' && typeof b === 'object') {
+        const ao = a;
+        const bo = b;
+        const ak = Object.keys(ao);
+        const bk = Object.keys(bo);
+        if (ak.length !== bk.length)
+            return false;
+        return ak.every((k) => Object.prototype.hasOwnProperty.call(bo, k) && frontmatterDeepEqual(ao[k], bo[k]));
+    }
+    return false;
+}
 function parseMustHavesBlock(content, blockName) {
     // Extract a specific block from must_haves in raw frontmatter YAML
     // Handles 3-level nesting: must_haves > artifacts/key_links > [{path, provides, ...}]
@@ -431,6 +478,11 @@ function cmdFrontmatterValidate(cwd, filePath, schemaName, raw) {
 }
 module.exports = {
     extractFrontmatter,
+    // Additive alias (#644 prohibition-probe schema contract): the probe round-trip seam reads a
+    // frontmatter object via `parseFrontmatter` (the name the contract test pins). It is the SAME
+    // function as `extractFrontmatter` — a bare-object parse with no behavior change — exposed under
+    // the alias so the prohibition schema round-trip and any future caller can use the canonical name.
+    parseFrontmatter: extractFrontmatter,
     reconstructFrontmatter,
     spliceFrontmatter,
     parseMustHavesBlock,

package/gsd-core/bin/lib/git-base-branch.cjs

@@ -0,0 +1,194 @@
+"use strict";
+/**
+ * Git Base-Branch Resolver — issue #1146.
+ *
+ * Single source of truth for detecting the repository's default branch.
+ * Replaces the duplicated per-workflow bash detection that only consulted
+ * `refs/remotes/origin/HEAD` then hardcoded `:-main`, which silently
+ * returned "main" for repos whose default branch is "master" whenever
+ * origin/HEAD was unset (git init + remote add / fetch without set-head /
+ * most CI checkouts / many worktrees).
+ *
+ * Precedence ladder (highest to lowest):
+ *   1. `git.base_branch` config override from .planning/config.json
+ *   2. `git symbolic-ref --short refs/remotes/origin/HEAD`  (fast, no network)
+ *   3. `git remote show origin` HEAD branch  ← AUTHORITATIVE; works when #2 unset
+ *   4. Local branch existence: "master" present + "main" absent → "master";
+ *      "main" present → "main"
+ *   5. "main"  (last-resort default)
+ *
+ * Every git subprocess is bounded with a timeout (≤ 30 s); on timeout/error
+ * the resolver degrades gracefully to the next tier — it never throws.
+ *
+ * Pure/testable: all I/O is injectable via the `deps` argument so unit
+ * tests can run without touching the real filesystem or spawning real git.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readConfigBaseBranch = readConfigBaseBranch;
+exports.trySymbolicRef = trySymbolicRef;
+exports.tryRemoteShow = tryRemoteShow;
+exports.tryLocalBranch = tryLocalBranch;
+exports.resolveBaseBranch = resolveBaseBranch;
+exports.cmdGitBaseBranch = cmdGitBaseBranch;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+/**
+ * Safely look up `git.base_branch` from the project's config.json.
+ * Returns the configured value (a non-empty, non-null string) or null.
+ */
+function readConfigBaseBranch(planningDir, deps) {
+    const readFile = deps?.readFile ??
+        ((p) => { try {
+            return node_fs_1.default.readFileSync(p, 'utf8');
+        }
+        catch {
+            return null;
+        } });
+    const configPath = node_path_1.default.join(planningDir, 'config.json');
+    const raw = readFile(configPath);
+    if (!raw)
+        return null;
+    let cfg;
+    try {
+        cfg = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg))
+        return null;
+    const top = cfg;
+    // Support both "git.base_branch" (nested) and "base_branch" (flat legacy)
+    const gitSection = top.git;
+    if (gitSection && typeof gitSection === 'object' && !Array.isArray(gitSection)) {
+        const nested = gitSection.base_branch;
+        if (typeof nested === 'string' && nested.trim())
+            return nested.trim();
+    }
+    const flat = top.base_branch;
+    if (typeof flat === 'string' && flat.trim())
+        return flat.trim();
+    return null;
+}
+/**
+ * Try `git symbolic-ref --short refs/remotes/origin/HEAD` (no network).
+ * Strips the `origin/` prefix to return just the branch name.
+ * Returns null if unset or on error/timeout.
+ */
+function trySymbolicRef(cwd, execGit) {
+    try {
+        const r = execGit(['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD'], { cwd, timeout: 5_000 });
+        if (r.exitCode !== 0 || !r.stdout)
+            return null;
+        // Output is e.g. "origin/main" — strip the prefix
+        const branch = r.stdout.trim().replace(/^origin\//, '');
+        return branch || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Try `git remote show origin` to read the HEAD branch.
+ * This is authoritative when origin/HEAD is unset locally.
+ * Requires network access but succeeds in the common CI case where
+ * origin/HEAD was never set after `git init && git remote add origin`.
+ *
+ * Parses the line:  `HEAD branch: <name>`
+ * Returns null on error, timeout, or if the output is malformed.
+ */
+function tryRemoteShow(cwd, execGit) {
+    try {
+        const r = execGit(['remote', 'show', 'origin'], { cwd, timeout: 15_000 });
+        if (r.exitCode !== 0 || !r.stdout)
+            return null;
+        // The line looks like: "  HEAD branch: master"
+        const m = r.stdout.match(/^\s*HEAD branch:\s*(\S+)\s*$/m);
+        if (!m)
+            return null;
+        const branch = m[1];
+        // git emits "(unknown)" when the remote is offline but the local cache
+        // resolved it; treat that as non-authoritative and fall through.
+        if (!branch || branch === '(unknown)')
+            return null;
+        return branch;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Detect local branch existence as a tie-breaker when no remote info is available.
+ *
+ * Rules:
+ *   - "master" present AND "main" absent → "master"
+ *   - "main" present → "main"
+ *   - Neither → null (fall through to default)
+ *
+ * Returns null on error/timeout.
+ */
+function tryLocalBranch(cwd, execGit) {
+    try {
+        const r = execGit(['branch', '--list', 'main', 'master'], { cwd, timeout: 5_000 });
+        if (r.exitCode !== 0 || !r.stdout)
+            return null;
+        // `git branch --list main master` outputs one line per matching branch
+        const lines = r.stdout.split('\n').map(l => l.trim().replace(/^\*\s*/, ''));
+        const hasMain = lines.includes('main');
+        const hasMaster = lines.includes('master');
+        if (hasMaster && !hasMain)
+            return 'master';
+        if (hasMain)
+            return 'main';
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the default/base branch for the repository at `cwd`.
+ *
+ * Consults the full precedence ladder and always returns a non-empty string.
+ * Never throws.
+ */
+function resolveBaseBranch(cwd, deps) {
+    const execGit = deps?.execGit ?? shell_command_projection_cjs_1.execGit;
+    // Derive .planning dir relative to cwd (mirrors planningDir() in core.cjs)
+    const planningDir = node_path_1.default.join(cwd, '.planning');
+    // 1. Config override
+    const configured = readConfigBaseBranch(planningDir, deps);
+    if (configured)
+        return configured;
+    // 2. symbolic-ref (fast, no network)
+    const symref = trySymbolicRef(cwd, execGit);
+    if (symref)
+        return symref;
+    // 3. git remote show origin (authoritative when origin/HEAD unset)
+    const remoteShow = tryRemoteShow(cwd, execGit);
+    if (remoteShow)
+        return remoteShow;
+    // 4. Local branch existence
+    const local = tryLocalBranch(cwd, execGit);
+    if (local)
+        return local;
+    // 5. Last-resort default
+    return 'main';
+}
+// ─── CLI entry point ──────────────────────────────────────────────────────────
+/**
+ * CLI command: `gsd-tools git base-branch`
+ * Resolves the default branch and writes it to stdout (raw string, newline-terminated).
+ * Called by workflows via `gsd_run query git.base-branch`.
+ */
+function cmdGitBaseBranch(cwd, _args, deps) {
+    const branch = resolveBaseBranch(cwd, deps);
+    const write = deps?.write ?? ((s) => process.stdout.write(s));
+    write(branch + '\n');
+    return branch;
+}

package/gsd-core/bin/lib/init.cjs

@@ -182,10 +182,11 @@ function cmdInitExecutePhase(cwd, phase, raw, options = {}) {
         ? reqMatch[1].replace(/[\[\]]/g, '').split(',').map((s) => s.trim()).filter(Boolean).join(', ')
         : null;
     const phase_req_ids = reqExtracted && reqExtracted !== 'TBD' ? reqExtracted : null;
+    const wf = (config.workflow ?? {});
     const result = {
         executor_model: resolveModelInternal(cwd, 'gsd-executor'),
         verifier_model: resolveModelInternal(cwd, 'gsd-verifier'),
-        tdd_mode: options['tdd'] || config.tdd_mode || false,
+        tdd_mode: options['tdd'] || Boolean(wf['tdd_mode']) || false,
         commit_docs: config.commit_docs,
         sub_repos: config.sub_repos,
         parallelization: config.parallelization,
@@ -300,15 +301,16 @@ function cmdInitPlanPhase(cwd, phase, raw, options = {}) {
     const granularityOverride = options['granularity'];
     assertValidGranularityOverride(granularityOverride, error);
     const granularity = resolveGranularityInternal(cwd, 'planning', granularityOverride || undefined);
+    const wf = (config.workflow ?? {});
     const result = {
         researcher_model: resolveModelInternal(cwd, 'gsd-phase-researcher'),
         planner_model: resolveModelInternal(cwd, 'gsd-planner'),
         checker_model: resolveModelInternal(cwd, 'gsd-plan-checker'),
-        tdd_mode: options['tdd'] || config.tdd_mode || false,
+        tdd_mode: options['tdd'] || Boolean(wf['tdd_mode']) || false,
         granularity,
-        research_enabled: config.research,
+        research_enabled: wf['research'],
         plan_checker_enabled: config.plan_checker,
-        nyquist_validation_enabled: config.nyquist_validation,
+        nyquist_validation_enabled: wf['nyquist_validation'],
         commit_docs: config.commit_docs,
         text_mode: config.text_mode,
         auto_advance: !!(config.auto_advance),
@@ -507,12 +509,13 @@ function cmdInitNewMilestone(cwd, raw) {
     catch {
         /* intentionally empty */
     }
+    const wf = (config.workflow ?? {});
     const result = {
         researcher_model: resolveModelInternal(cwd, 'gsd-project-researcher'),
         synthesizer_model: resolveModelInternal(cwd, 'gsd-research-synthesizer'),
         roadmapper_model: resolveModelInternal(cwd, 'gsd-roadmapper'),
         commit_docs: config.commit_docs,
-        research_enabled: config.research,
+        research_enabled: wf['research'],
         current_milestone: milestone['version'],
         current_milestone_name: milestone['name'],
         latest_completed_milestone: latestCompleted?.version || null,
@@ -1530,7 +1533,9 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
     // It returns [] cheaply when no roots are configured, so the realpath cost only
     // occurs when the caller has actually set trusted_global_roots.
     const trustedGlobalRoots = (0, security_cjs_1.loadTrustedGlobalRoots)(config);
-    const validPaths = [];
+    // Each entry is either a filesystem include ({ kind: 'include', ref, display }) or a
+    // Skill-tool directive ({ kind: 'directive', name }) for plugin-provided namespaced skills.
+    const validEntries = [];
     for (const skillPath of skillPaths) {
         if (typeof skillPath !== 'string')
             continue;
@@ -1540,10 +1545,25 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
                 process.stderr.write(`[agent-skills] WARNING: "global:" prefix with empty skill name — skipping\n`);
                 continue;
             }
-            if (!/^[a-zA-Z0-9_-]+$/.test(skillName)) {
+            // Accept: one or more [A-Za-z0-9_-]+ segments joined by single colons.
+            // Rejects: empty segments (::), leading/trailing colon, dots, slashes, backslashes.
+            if (!/^[A-Za-z0-9_-]+(:[A-Za-z0-9_-]+)*$/.test(skillName)) {
                 process.stderr.write(`[agent-skills] WARNING: Invalid global skill name "${skillName}" — skipping\n`);
                 continue;
             }
+            const isNamespaced = skillName.includes(':');
+            if (isNamespaced) {
+                // Plugin-provided namespaced skill: no filesystem path exists locally.
+                if (runtime === 'claude') {
+                    // Emit a natural-language Skill-tool directive (not a @-include).
+                    validEntries.push({ kind: 'directive', name: skillName });
+                }
+                else {
+                    process.stderr.write(`[agent-skills] WARNING: Plugin-namespaced skill "global:${skillName}" requires a Skill-tool-capable runtime (claude) — skipping on runtime "${runtime}"\n`);
+                }
+                continue;
+            }
+            // Non-namespaced bare name: attempt filesystem resolution as before.
             if (globalSkillsBase === null) {
                 process.stderr.write(`[agent-skills] WARNING: Runtime "${runtime}" does not use a skills directory — "global:${skillName}" is not supported on this runtime\n`);
                 continue;
@@ -1567,7 +1587,7 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
                 }
                 process.stderr.write(`[agent-skills] NOTE: Global skill "${skillName}" accepted via trusted_global_roots (resolves outside the default skills dir)\n`);
             }
-            validPaths.push({ ref: `${globalSkillDir}/SKILL.md`, display: displayPath });
+            validEntries.push({ kind: 'include', ref: `${globalSkillDir}/SKILL.md`, display: displayPath });
             continue;
         }
         const pathCheck = (0, security_cjs_1.validatePath)(skillPath, projectRoot);
@@ -1580,11 +1600,16 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
             process.stderr.write(`[agent-skills] WARNING: Skill not found at "${skillPath}/SKILL.md" — skipping\n`);
             continue;
         }
-        validPaths.push({ ref: `${skillPath}/SKILL.md`, display: skillPath });
+        validEntries.push({ kind: 'include', ref: `${skillPath}/SKILL.md`, display: skillPath });
     }
-    if (validPaths.length === 0)
+    if (validEntries.length === 0)
         return '';
-    const lines = validPaths.map((p) => `- @${p.ref}`).join('\n');
+    const lines = validEntries.map((entry) => {
+        if (entry.kind === 'directive') {
+            return `- Load the \`${entry.name}\` skill via the Skill tool before proceeding (plugin-provided).`;
+        }
+        return `- @${entry.ref}`;
+    }).join('\n');
     return `<agent_skills>\nRead these user-configured skills:\n${lines}\n</agent_skills>`;
 }
 function cmdAgentSkills(cwd, agentType, raw, jsonMode) {