@opengsd/gsd-core 1.5.0-rc.3 → 1.5.0-rc.4

package/gsd-core/bin/gsd-tools.cjs

@@ -63,6 +63,13 @@
  *                                      Returns JSON { valid, errors[], slots: {role,capability,outcome} | null }
  *                                      --pick valid  Emit bare boolean (for workflow boolean checks)
  *
+ * Drift Guard (ADR-22):
+ *   drift-guard authority                Resolve effective source-grounding authority
+ *                                        (reads plan_review.source_grounding_authority + intel.enabled from config)
+ *   drift-guard severity --status <S>    Classify a symbol verdict into { severity, hardBlock }
+ *     [--authority <A>]                  Status: VERIFIED|MISSING|AMBIGUOUS|UNCHECKABLE
+ *                                        Authority: grep|intel|treesitter|lsp|scip (default: config-resolved)
+ *
  * Validation:
  *   validate consistency               Check phase numbering, disk/roadmap sync
  *   validate health [--repair]         Check .planning/ integrity, optionally repair
@@ -217,6 +224,7 @@ const verification = require('./lib/verification.cjs');
 const { routeInitCommand } = require('./lib/init-command-router.cjs');
 const loopResolver = require('./lib/loop-resolver.cjs');
 const capabilityState = require('./lib/capability-state.cjs');
+const capabilityWriter = require('./lib/capability-writer.cjs');
 const { routePhaseCommand } = require('./lib/phase-command-router.cjs');
 const { routePhasesCommand } = require('./lib/phases-command-router.cjs');
 const { routeValidateCommand } = require('./lib/validate-command-router.cjs');
@@ -225,6 +233,8 @@ const { routeAgentCommand } = require('./lib/agent-command-router.cjs');
 const { routeCheckCommand } = require('./lib/check-command-router.cjs');
 const { routeTaskCommand } = require('./lib/task-command-router.cjs');
 const { parseNamedArgs, parseMultiwordArg } = require('./lib/command-arg-projection.cjs');
+const { cmdGitBaseBranch } = require('./lib/git-base-branch.cjs');
+const { getEffectiveAuthority, classifyDriftSeverity } = require('./lib/plan-drift-guard.cjs');
 
 // ─── Bridge collapsed (Phase 4) ────────────────────────────────────────────────
 // Non-family commands now run through their CJS handlers directly. Keep the
@@ -508,10 +518,10 @@ async function main() {
   const TOP_LEVEL_USAGE = 'Usage: gsd-tools <command> [args] [--raw] [--pick <field>] [--cwd <path>] [--ws <name>] [--json-errors]\n' +
     'Commands: agent, agent-skills, audit-open, audit-uat, check, check-commit, commit, commit-to-subrepo, ' +
     'config-ensure-section, config-get, config-new-project, config-path, config-set, migrate-config, ' +
-    'current-timestamp, detect-custom-files, docs-init, effort, extract-messages, find-phase, ' +
+    'current-timestamp, detect-custom-files, docs-init, drift-guard, effort, extract-messages, find-phase, ' +
     'from-gsd2, frontmatter, gap-analysis, generate-claude-md, generate-claude-profile, ' +
     'generate-dev-preferences, generate-slug, graphify, history-digest, init, intel, ' +
-    'capability, classify-confidence, learnings, list-todos, loop, milestone, package-legitimacy, phase, phase-plan-index, phases, profile-questionnaire, ' +
+    'capability, classify-confidence, git, learnings, list-todos, loop, milestone, package-legitimacy, phase, phase-plan-index, phases, profile-questionnaire, ' +
     'profile-sample, progress, prompt-budget, requirements, research-plan, research-store, resolve-granularity, resolve-model, roadmap, scaffold, state, ' +
     'task, template, user-story, validate, verify, verify-path-exists, verify-summary, workstream, worktree\n\n' +
     'Global flags:\n' +
@@ -1303,9 +1313,85 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
         }
         const resolvedConfigDir = configDir ? path.resolve(configDir) : null;
         capabilityState.cmdCapabilityState(cwd, resolvedConfigDir, raw, {});
+      } else if (capSubcommand === 'set') {
+        // capability set <id> [--on|--off|--enable|--disable] [--gate <key>=<bool>]... [--config-dir <dir>] [--runtime <r>] [--scope <s>]
+        const capId = args[2];
+        if (!capId || capId.startsWith('--')) {
+          error('Missing capability id for: capability set <id>', core.ERROR_REASON ? core.ERROR_REASON.USAGE : undefined);
+        }
+        // Parse --config-dir
+        const setConfigDirIdx = args.indexOf('--config-dir');
+        let setConfigDir = null;
+        if (setConfigDirIdx !== -1) {
+          const setConfigDirVal = args[setConfigDirIdx + 1];
+          if (!setConfigDirVal || setConfigDirVal.startsWith('--')) {
+            error('Missing value for --config-dir', core.ERROR_REASON ? core.ERROR_REASON.USAGE : undefined);
+          }
+          setConfigDir = setConfigDirVal;
+        }
+        const resolvedSetConfigDir = setConfigDir ? path.resolve(setConfigDir) : null;
+        // Parse --on/--enable and --off/--disable (mutually exclusive)
+        const hasOn = args.includes('--on') || args.includes('--enable');
+        const hasOff = args.includes('--off') || args.includes('--disable');
+        if (hasOn && hasOff) {
+          error('Conflicting flags: --on/--enable and --off/--disable cannot both be present', core.ERROR_REASON ? core.ERROR_REASON.USAGE : undefined);
+        }
+        let setEnabled;
+        if (hasOn) {
+          setEnabled = true;
+        } else if (hasOff) {
+          setEnabled = false;
+        }
+        // Parse --gate <key>=<bool> (repeatable)
+        const setGates = {};
+        for (let gi = 0; gi < args.length; gi++) {
+          if (args[gi] === '--gate') {
+            const gateVal = args[gi + 1];
+            if (!gateVal || gateVal.startsWith('--')) {
+              error('Missing value for --gate (expected <key>=<true|false>)', core.ERROR_REASON ? core.ERROR_REASON.USAGE : undefined);
+            }
+            const eqIdx = gateVal.indexOf('=');
+            if (eqIdx === -1) {
+              error(`Malformed --gate value "${gateVal}": expected <key>=<true|false>`, core.ERROR_REASON ? core.ERROR_REASON.USAGE : undefined);
+            }
+            const gateKey = gateVal.slice(0, eqIdx);
+            const gateBoolStr = gateVal.slice(eqIdx + 1);
+            if (gateBoolStr !== 'true' && gateBoolStr !== 'false') {
+              error(`Malformed --gate value "${gateVal}": bool must be true or false`, core.ERROR_REASON ? core.ERROR_REASON.USAGE : undefined);
+            }
+            setGates[gateKey] = gateBoolStr === 'true';
+            gi++; // skip consumed value
+          }
+        }
+        // Parse --runtime and --scope (validate that values are present and not flags)
+        const runtimeIdx = args.indexOf('--runtime');
+        let setRuntime;
+        if (runtimeIdx !== -1) {
+          const runtimeVal = args[runtimeIdx + 1];
+          if (!runtimeVal || runtimeVal.startsWith('--')) {
+            error('Missing value for --runtime', core.ERROR_REASON ? core.ERROR_REASON.USAGE : undefined);
+          }
+          setRuntime = runtimeVal;
+        }
+        const scopeIdx = args.indexOf('--scope');
+        let setScope;
+        if (scopeIdx !== -1) {
+          const scopeVal = args[scopeIdx + 1];
+          if (!scopeVal || scopeVal.startsWith('--')) {
+            error('Missing value for --scope', core.ERROR_REASON ? core.ERROR_REASON.USAGE : undefined);
+          }
+          setScope = scopeVal;
+        }
+        capabilityWriter.cmdCapabilitySet(
+          cwd,
+          resolvedSetConfigDir,
+          capId,
+          { enabled: setEnabled, gates: Object.keys(setGates).length > 0 ? setGates : undefined, runtime: setRuntime, scope: setScope },
+          raw,
+        );
       } else {
         error(
-          `Unknown capability subcommand: ${capSubcommand}. Available: state`,
+          `Unknown capability subcommand: ${capSubcommand}. Available: state, set`,
           core.ERROR_REASON ? core.ERROR_REASON.SDK_UNKNOWN_COMMAND : undefined,
         );
       }
@@ -1948,6 +2034,23 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
     //   Each slot must be non-empty and contain non-whitespace content.
     //
     // No .planning/ access needed — pure string validation.
+
+    // #1146: single base-branch resolver for all forking workflows.
+    // Workflows call `gsd_run query git.base-branch` (dotted form normalised to
+    // command='git', args=['git','base-branch']).
+    case 'git': {
+      const subcommand = args[1];
+      if (subcommand !== 'base-branch') {
+        error(
+          `Unknown git subcommand: ${subcommand || '(none)'}. Available: base-branch`,
+          ERROR_REASON.SDK_UNKNOWN_COMMAND,
+        );
+        break;
+      }
+      cmdGitBaseBranch(cwd, args.slice(2));
+      break;
+    }
+
     case 'user-story': {
       const subcommand = args[1];
       if (subcommand !== 'validate') {
@@ -2002,6 +2105,67 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       break;
     }
 
+    case 'drift-guard': {
+      // ADR-22: deterministic authority resolution + severity classification.
+      // Subcommands:
+      //   drift-guard authority                          → effective authority string
+      //   drift-guard severity --status <S> [--authority <A>]  → {severity, hardBlock}
+      const subcommand = args[1];
+
+      // Read config.json directly for both plan_review.source_grounding_authority
+      // and intel.enabled. Neither key is in the config-loader.cjs whitelist that
+      // core.loadConfig() returns; plan_review is only in config.cjs's private
+      // buildConfig(), and intel is a federated capability config key.
+      let configuredAuthority = 'grep';
+      let intelEnabled = false;
+      try {
+        const { planningDir } = require('./lib/planning-workspace.cjs');
+        const cfgPath = require('path').join(planningDir(cwd), 'config.json');
+        if (require('fs').existsSync(cfgPath)) {
+          const rawCfg = JSON.parse(require('fs').readFileSync(cfgPath, 'utf-8'));
+          if (rawCfg && rawCfg.plan_review && rawCfg.plan_review.source_grounding_authority) {
+            configuredAuthority = String(rawCfg.plan_review.source_grounding_authority);
+          }
+          if (rawCfg && rawCfg.intel && rawCfg.intel.enabled === true) {
+            intelEnabled = true;
+          }
+        }
+      } catch {
+        // not fatal — defaults apply
+      }
+
+      const effectiveAuthority = getEffectiveAuthority(configuredAuthority, intelEnabled);
+
+      if (subcommand === 'authority') {
+        // Pass rawValue as 3rd arg so --raw returns unquoted string (not JSON)
+        core.output(effectiveAuthority, raw, effectiveAuthority);
+        break;
+      }
+
+      if (subcommand === 'severity') {
+        const statusIdx = args.indexOf('--status');
+        const statusVal = statusIdx !== -1 ? args[statusIdx + 1] : undefined;
+        if (!statusVal || statusVal.startsWith('--')) {
+          error('drift-guard severity requires --status <VERIFIED|MISSING|AMBIGUOUS|UNCHECKABLE>', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+          break;
+        }
+        const authIdx = args.indexOf('--authority');
+        const authVal = authIdx !== -1 ? args[authIdx + 1] : undefined;
+        const authorityForClassify = (authVal && !authVal.startsWith('--'))
+          ? authVal
+          : effectiveAuthority;
+        const result = classifyDriftSeverity({ status: statusVal, authority: authorityForClassify });
+        core.output(result, raw);
+        break;
+      }
+
+      error(
+        `Unknown drift-guard subcommand: ${subcommand || '(none)'}. Available: authority, severity`,
+        ERROR_REASON.SDK_UNKNOWN_COMMAND,
+      );
+      break;
+    }
+
     default: {
       // ADR-959: try capability-registry dispatch before emitting the unknown-command error.
       // An unmigrated command still hits its hardcoded `case` above — untouched.

package/gsd-core/bin/lib/active-workstream-store.cjs

@@ -47,6 +47,11 @@ function sanitizeWorkstreamSessionToken(value) {
     const token = raw.trim().replace(/[^a-zA-Z0-9._-]+/g, '_').replace(/^_+|_+$/g, '');
     return token ? token.slice(0, 160) : null;
 }
+/** Test-only seam: clear the memoized controlling-TTY probe cache (#1191). */
+function _resetControllingTtyCacheForTests() {
+    cachedControllingTtyToken = null;
+    didProbeControllingTtyToken = false;
+}
 function probeControllingTtyToken() {
     if (didProbeControllingTtyToken)
         return cachedControllingTtyToken;
@@ -288,4 +293,5 @@ module.exports = {
     parseCliWorkstream,
     resolveActiveWorkstream,
     applyResolvedWorkstreamEnv,
+    _resetControllingTtyCacheForTests,
 };

package/gsd-core/bin/lib/capability-state.cjs

@@ -32,6 +32,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = __importDefault(require("node:fs"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const core = require("./core.cjs");
 const { output: coreOutput, error: coreError } = core;
@@ -43,7 +44,7 @@ const configLoaderMod = require("./config-loader.cjs");
 const { loadConfig } = configLoaderMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const installProfilesMod = require("./install-profiles.cjs");
-const { readActiveProfile, loadSkillsManifest, resolveProfile } = installProfilesMod;
+const { readActiveProfile, loadSkillsManifest, resolveProfile, parseRequires } = installProfilesMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const surfaceMod = require("./surface.cjs");
 const { resolveSurface } = surfaceMod;
@@ -193,6 +194,93 @@ function _resolveCommandsGsdDir() {
     const repoRoot = node_path_1.default.resolve(__dirname, '..', '..', '..');
     return node_path_1.default.join(repoRoot, 'commands', 'gsd');
 }
+/**
+ * Build a skill dependency manifest from an INSTALLED runtime's skills directory.
+ *
+ * In an installed runtime (e.g. Codex at ~/.codex), gsd skills live as
+ * configDir/skills/gsd-STEM/SKILL.md. There is no commands/gsd source tree.
+ * This function scans that installed layout and builds the same
+ * Map shape that loadSkillsManifest produces from sources.
+ *
+ * Stem extraction: a directory named gsd-secure-phase maps to stem secure-phase.
+ * Only directories whose names start with gsd- are included so user-created
+ * skills (without the gsd- prefix) are not accidentally pulled in.
+ *
+ * The requires: field is parsed via the shared parseRequires helper (the same
+ * parser loadSkillsManifest uses), so the two paths cannot drift.
+ *
+ * Returns an empty Map when the skills dir does not exist.
+ */
+function _loadInstalledSkillsManifest(configDir) {
+    const manifest = new Map();
+    const skillsDir = node_path_1.default.join(configDir, 'skills');
+    if (!node_fs_1.default.existsSync(skillsDir))
+        return manifest;
+    let entries;
+    try {
+        entries = node_fs_1.default.readdirSync(skillsDir, { withFileTypes: true });
+    }
+    catch {
+        return manifest;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        if (!entry.name.startsWith('gsd-'))
+            continue;
+        // Strip the 'gsd-' prefix to get the skill stem
+        const stem = entry.name.slice(4); // 'gsd-'.length === 4
+        if (!stem)
+            continue;
+        const skillMdPath = node_path_1.default.join(skillsDir, entry.name, 'SKILL.md');
+        // Parity with loadSkillsManifest: a stem exists only when its artifact
+        // file is present. loadSkillsManifest registers a stem per .md FILE (and
+        // tolerates an unreadable file as []), but never invents a stem for which
+        // no file exists. Mirror that here: a stale gsd-<stem>/ directory with no
+        // SKILL.md must NOT register the stem — otherwise the capability would be
+        // wrongly reported surfaced/enabled and a verify:post hook would render
+        // for a skill that cannot run.
+        if (!node_fs_1.default.existsSync(skillMdPath))
+            continue;
+        let content = '';
+        try {
+            content = node_fs_1.default.readFileSync(skillMdPath, 'utf8');
+        }
+        catch {
+            // SKILL.md present but unreadable — register with no deps (parity with
+            // loadSkillsManifest's readFileSync catch branch).
+        }
+        // Parse requires: via the SAME shared parser loadSkillsManifest uses, so
+        // installed-runtime dependency resolution can never silently diverge from
+        // the source-tree path (single source of truth — no duplicated regex).
+        manifest.set(stem, content ? parseRequires(content) : []);
+        // Mirror loadSkillsManifest's Map shape: it always sets a companion
+        // `_calls_agents_<stem>` key. Installed SKILL.md bodies carry no
+        // recoverable agent-call refs, so [] (the no-agents case) keeps the two
+        // manifest shapes identical and prevents undefined-vs-[] drift for any
+        // consumer that reads the agent-refs companion key.
+        manifest.set(`_calls_agents_${stem}`, []);
+    }
+    return manifest;
+}
+/**
+ * Resolve the skill dependency manifest for capability-state resolution.
+ *
+ * Resolution order (fixes #1160 — installed-runtime capability surface):
+ *   1. If commandsGsdDir exists, load from source (repo-checkout behavior).
+ *   2. Otherwise, fall back to installed skills at configDir/skills/gsd-[stem]/SKILL.md.
+ *
+ * In an installed runtime the commands/gsd source tree is absent; only the
+ * skills/ layout exists. Returning an empty manifest caused resolveSurface to
+ * materialise the full-sentinel to an empty Set, making every capability appear
+ * unsurfaced even when the skill was physically installed.
+ */
+function _resolveManifest(commandsGsdDir, configDir) {
+    if (node_fs_1.default.existsSync(commandsGsdDir)) {
+        return loadSkillsManifest(commandsGsdDir);
+    }
+    return _loadInstalledSkillsManifest(configDir);
+}
 /**
  * Command entry point: resolve install profile, surface, and config; compute
  * capability state; emit the envelope via core.output.
@@ -265,7 +353,9 @@ function resolveCapabilityRuntimeState(cwd, runtimeConfigDir) {
     let installedSkills;
     try {
         const commandsGsdDir = _resolveCommandsGsdDir();
-        const manifest = loadSkillsManifest(commandsGsdDir);
+        // Fix #1160: use _resolveManifest so installed-runtime layouts (where
+        // commands/gsd is absent) fall back to <configDir>/skills/gsd-*/SKILL.md.
+        const manifest = _resolveManifest(commandsGsdDir, resolvedConfigDir);
         const profileName = readActiveProfile(resolvedConfigDir) ?? 'full';
         const resolvedInstall = resolveProfile({
             modes: profileName.split(',').map((s) => s.trim()),
@@ -285,7 +375,9 @@ function resolveCapabilityRuntimeState(cwd, runtimeConfigDir) {
     let surfacedSkills;
     try {
         const commandsGsdDir = _resolveCommandsGsdDir();
-        const manifest = loadSkillsManifest(commandsGsdDir);
+        // Fix #1160: use _resolveManifest so installed-runtime layouts (where
+        // commands/gsd is absent) fall back to <configDir>/skills/gsd-*/SKILL.md.
+        const manifest = _resolveManifest(commandsGsdDir, resolvedConfigDir);
         const surfaceResult = resolveSurface(resolvedConfigDir, manifest, undefined, registry);
         // resolveSurface returns { name, skills: Set<string>, agents: Set<string> }
         // (always a concrete Set — full profile is materialized)
@@ -345,5 +437,7 @@ module.exports = {
     cmdCapabilityState,
     // Exported for tests
     _resolveCommandsGsdDir,
+    _loadInstalledSkillsManifest,
+    _resolveManifest,
     _isSafePropKey,
 };