@opengsd/gsd-core 1.5.0 → 1.6.0-rc.2

package/scripts/lint-regression-test-names.allowlist.json

@@ -2,6 +2,7 @@
   "bug-10-semver-policy-consolidation.test.cjs",
   "bug-130-finishinstall-opencode-testmode.test.cjs",
   "bug-131-release-tarball-smoke-explicit-home.test.cjs",
+  "bug-1367-claude-local-flat-command-layout.test.cjs",
   "bug-14-progress-auto-flag-dropped.test.cjs",
   "bug-167-query-meta-command.test.cjs",
   "bug-17-askuserquestion-option-cap.test.cjs",

package/scripts/lint-resolution-provenance.allowlist.json

@@ -0,0 +1 @@
+[]

package/scripts/lint-resolution-provenance.cjs

@@ -0,0 +1,192 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * lint-resolution-provenance.cjs — CI guard for Resolution Provenance contracts.
+ *
+ * ## Purpose (ADR-1411 P4 / #1417)
+ *
+ * This is a REGRESSION-LOCK and REGISTRATION RATCHET, NOT a universal static
+ * detector (which is intractable given false positives from config-reading
+ * helpers that don't consume a `reason`).
+ *
+ * The guard maintains a REGISTRY of config-interpreting read verbs that MUST
+ * carry provenance — each entry names the verb, its source file, and its test
+ * file. For every registered verb, the guard asserts that its test file
+ * contains BOTH a `configured_empty` assertion AND a `not_configured`
+ * assertion, proving that the configured-empty-vs-not-configured contract is
+ * explicitly tested (not silently open-to-defaults).
+ *
+ * ## Registration protocol
+ *
+ * When adding a NEW config-interpreting read verb:
+ *   1. Add an entry to REGISTRY below: { verb, sourceFile, testFile }.
+ *   2. Add a `configured_empty` test and a `not_configured` test to testFile.
+ *   3. If the test coverage cannot land in the same PR, add the verb to
+ *      scripts/lint-resolution-provenance.allowlist.json to grandfather it —
+ *      but the allowlist MUST shrink over time (stale entries fail).
+ *
+ * See docs/adr/1411-resolution-provenance.md and #1417.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { assertWithinAllowlist } = require('./lib/allowlist-ratchet.cjs');
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const ROOT = path.join(__dirname, '..');
+const ALLOWLIST_PATH = path.join(__dirname, 'lint-resolution-provenance.allowlist.json');
+
+/**
+ * Registry of config-interpreting read verbs that must carry provenance.
+ * Each entry: { verb, sourceFile, testFile }
+ *
+ * - verb:       Short stable name for this verb (used in error messages and the
+ *               allowlist).
+ * - sourceFile: Path (relative to ROOT) to the source implementation.
+ * - testFile:   Path (relative to ROOT) to the test file that MUST contain
+ *               both a `configured_empty` assertion and a `not_configured`
+ *               assertion.
+ *
+ * Seed: agent-skills (P2/P3 fix, #1415/#1416) is the founding member.
+ */
+const REGISTRY = [
+  {
+    verb: 'agent-skills',
+    sourceFile: 'src/init.cts',
+    testFile: 'tests/agent-skills.test.cjs',
+  },
+];
+
+// Markers that MUST appear in every registered verb's test file.
+const MARKER_CONFIGURED_EMPTY = 'configured_empty';
+const MARKER_NOT_CONFIGURED = 'not_configured';
+
+/**
+ * Pure check logic — factored out for unit testing without I/O.
+ *
+ * @param {object} opts
+ * @param {Array<{verb: string, sourceFile: string, testFile: string}>} opts.registry
+ *   The REGISTRY to check (or an injected subset for tests).
+ * @param {string[]} opts.allowlist
+ *   Array of verb names to grandfather (stale entries fail).
+ * @param {function(string): string} opts.readFile
+ *   Reads a file path and returns its content.  Injected for testability;
+ *   callers pass `(p) => fs.readFileSync(p, 'utf8')`.
+ * @param {function(string): void} opts.fail
+ *   Callback invoked with a descriptive failure message.
+ * @returns {{ ok: boolean }}
+ */
+function checkRegistry({ registry, allowlist, readFile, fail }) {
+  const allowlistSet = new Set(allowlist);
+  const offenders = []; // verbs that ARE failing (for ratchet: stale check)
+  let anyFail = false;
+
+  for (const entry of registry) {
+    const { verb, testFile } = entry;
+    const resolvedTestFile = path.isAbsolute(testFile) ? testFile : path.join(ROOT, testFile);
+
+    // Grandfathered? Check markers anyway to detect when it's been fixed.
+    let content;
+    try {
+      content = readFile(resolvedTestFile);
+    } catch (err) {
+      fail(
+        `[resolution-provenance] Cannot read test file for verb "${verb}" (${testFile}): ${err.message}\n` +
+          `  Register the verb's test file correctly, or remove the registry entry.`
+      );
+      anyFail = true;
+      offenders.push(verb);
+      continue;
+    }
+
+    const hasConfiguredEmpty = content.includes(MARKER_CONFIGURED_EMPTY);
+    const hasNotConfigured = content.includes(MARKER_NOT_CONFIGURED);
+
+    if (!hasConfiguredEmpty || !hasNotConfigured) {
+      offenders.push(verb);
+
+      if (allowlistSet.has(verb)) {
+        // Grandfathered — tolerate but don't report.
+        continue;
+      }
+
+      const missing = [];
+      if (!hasConfiguredEmpty) missing.push(`\`configured_empty\``);
+      if (!hasNotConfigured) missing.push(`\`not_configured\``);
+
+      fail(
+        `[resolution-provenance] verb "${verb}" (${testFile}) is missing contract test marker(s):\n` +
+          `  Missing: ${missing.join(', ')}\n` +
+          `  Each registered config-interpreting read verb must have both a\n` +
+          `  \`configured_empty\` assertion and a \`not_configured\` assertion in its\n` +
+          `  test file to prove the configured-empty-vs-not-configured contract is\n` +
+          `  tested (ADR-1411 P4 / #1417).\n` +
+          `  Add the missing test(s) or grandfather the verb in\n` +
+          `  scripts/lint-resolution-provenance.allowlist.json.`
+      );
+      anyFail = true;
+    }
+  }
+
+  // Ratchet: stale allowlist entries (verb is compliant but still grandfathered)
+  // must be pruned so the allowlist only ever shrinks.
+  const offenderSet = new Set(offenders);
+  const staleEntries = [];
+  for (const v of allowlistSet) {
+    if (!offenderSet.has(v)) {
+      staleEntries.push(v);
+    }
+  }
+
+  // Also verify stale entries via assertWithinAllowlist for consistent messaging.
+  const ratchetFailures = [];
+  assertWithinAllowlist({
+    label: 'resolution-provenance',
+    current: offenders,
+    known: allowlist,
+    fail: (msg) => ratchetFailures.push(msg),
+    pruneHint: 'edit scripts/lint-resolution-provenance.allowlist.json',
+  });
+
+  // Only report stale entries from the ratchet (novel offenders are already
+  // reported above with more actionable messages).
+  if (staleEntries.length > 0) {
+    for (const msg of ratchetFailures) {
+      // Only surface the stale-entry message (it contains "stale" or "no longer").
+      if (msg.includes('stale') || msg.includes('no longer')) {
+        fail(msg);
+        anyFail = true;
+      }
+    }
+  }
+
+  return { ok: !anyFail };
+}
+
+function main() {
+  const allowlist = JSON.parse(fs.readFileSync(ALLOWLIST_PATH, 'utf8'));
+
+  const failures = [];
+  const { ok } = checkRegistry({
+    registry: REGISTRY,
+    allowlist,
+    readFile: (filePath) => fs.readFileSync(filePath, 'utf8'),
+    fail: (msg) => failures.push(msg),
+  });
+
+  if (!ok) {
+    for (const msg of failures) process.stderr.write(`${msg}\n`);
+    throw new ExitError(1);
+  }
+
+  console.log(
+    `ok lint-resolution-provenance: ${REGISTRY.length} registered verb(s), all carry configured_empty + not_configured contract tests`
+  );
+}
+
+module.exports = { checkRegistry, REGISTRY };
+
+// Only run the CLI check when executed directly, not when imported by tests
+// (keeps the unit tests hermetic — importing checkRegistry must not run main).
+if (require.main === module) runMain(main);

package/scripts/lint-test-file-count.allowlist.json

@@ -60,6 +60,7 @@
     },
     "phase": {
       "files": [
+        "fix-1437-phase-list-plans.test.cjs",
         "bug-214-phase-researcher-write-truncation-contract.test.cjs",
         "phase-dependency-levels.test.cjs",
         "phase.test.cjs"
@@ -174,6 +175,14 @@
         "external-job-waiting.test.cjs"
       ],
       "issue": "#1165"
+    },
+    "docs": {
+      "files": [
+        "docs-parity-live-registry.test.cjs",
+        "docs-update.test.cjs",
+        "fix-1464-docs-manifest-validation.test.cjs"
+      ],
+      "issue": "1496"
     }
   }
 }

package/scripts/prompt-injection-scan.sh

@@ -78,6 +78,7 @@ ALLOWLIST=(
   'hooks/gsd-read-injection-scanner.js'
   'tests/read-injection-scanner.security.test.cjs'
   'tests/security-prompt-injection.security.test.cjs'
+  'tests/list-seeds.test.cjs'
   'tests/fixtures/adversarial/security/'
   'SECURITY.md'
   # These files contain intentional injection examples / security-model prose

package/scripts/run-tests.cjs

@@ -462,6 +462,20 @@ function main() {
   delete process.env.GSD_PROJECT;
   delete process.env.GSD_WORKSTREAM;
   delete process.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+  // Sandbox the overlay home so the loader's global scan ($GSD_HOME/.gsd/capabilities)
+  // cannot read a developer's real installed capabilities during tests (ADR-1244 D2).
+  // IDEMPOTENT: a nested run-tests spawn (e.g. tests/run-tests-harness.test.cjs)
+  // inherits this sandbox via env — it must REUSE it, never mkdtemp a fresh dir per
+  // invocation (that churned ~20+ temp dirs per harness run and amplified Docker load).
+  {
+    const { mkdtempSync } = require('fs');
+    const { join: _join, basename: _basename } = require('path');
+    const { tmpdir } = require('os');
+    const _gh = process.env.GSD_HOME;
+    if (!_gh || !_basename(_gh).startsWith('gsd-test-home-')) {
+      process.env.GSD_HOME = mkdtempSync(_join(tmpdir(), 'gsd-test-home-'));
+    }
+  }
 
   // Log selected files to stderr for CI / harness-test visibility.
   // node:test default reporter doesn't echo filenames, so this gives

package/scripts/sync-manifest-versions.cjs

@@ -68,6 +68,66 @@ function findDrift(opts) {
   return drift;
 }
 
+// ─── ADR-1244 D6: native capability manifests ────────────────────────────────
+//
+// Native capabilities (capabilities/<id>/capability.json) carry a `version`
+// stamped in lockstep with the package version at release. Unlike
+// VERSIONED_MANIFESTS (fixed paths), capabilities are discovered by glob so a
+// new capability is auto-covered without editing this file. The version-sync
+// regression guard (issue #844) treats every swept capability manifest as
+// registered.
+
+// Discover capabilities/<id>/capability.json under `root`, sorted for stable
+// staging order. Returns [] when there is no capabilities/ directory.
+function listCapabilityManifests(opts) {
+  const root = (opts && opts.root) || ROOT;
+  const dir = path.join(root, 'capabilities');
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((e) => e.isDirectory())
+    // Forward-slash rel paths (NOT path.join) so they match `git ls-files`
+    // output, git pathspecs, and the forward-slash VERSIONED_MANIFESTS on every
+    // platform — path.join would emit backslashes on Windows and break the
+    // issue-844 regression guard's ALLOWED-set comparison.
+    .map((e) => 'capabilities/' + e.name + '/capability.json')
+    .filter((rel) => fs.existsSync(path.join(root, rel)))
+    .sort();
+}
+
+// Stamp `version` into each native capability manifest. Returns changed rel paths.
+function syncCapabilityVersions(opts) {
+  const root = (opts && opts.root) || ROOT;
+  const v = (opts && opts.version) != null ? opts.version : getPackageVersion(root);
+  const changed = [];
+  for (const rel of listCapabilityManifests({ root })) {
+    const abs = path.join(root, rel);
+    const manifest = readJson(abs);
+    if (manifest.version !== v) {
+      manifest.version = v;
+      fs.writeFileSync(abs, JSON.stringify(manifest, null, 2) + '\n');
+      changed.push(rel);
+    }
+  }
+  return changed;
+}
+
+// Native capability manifests whose version != package version.
+function findCapabilityDrift(opts) {
+  const root = (opts && opts.root) || ROOT;
+  const v = (opts && opts.version) != null ? opts.version : getPackageVersion(root);
+  const drift = [];
+  for (const rel of listCapabilityManifests({ root })) {
+    const found = readJson(path.join(root, rel)).version;
+    if (found !== v) drift.push({ manifest: rel, found, expected: v });
+  }
+  return drift;
+}
+
 // Best-effort outside git; fail-closed inside a work tree so a release never
 // ships a stale manifest that the working-tree test already accepted.
 function stageManifests(opts) {
@@ -83,21 +143,32 @@ function stageManifests(opts) {
     console.warn('sync-manifest-versions: not a git work tree; skipping staging.');
     return;
   }
+  const toStage = [...VERSIONED_MANIFESTS, ...listCapabilityManifests({ root })];
   try {
-    execFileSync('git', ['add', '--', ...VERSIONED_MANIFESTS], { cwd: root, stdio: ['ignore', 'ignore', 'pipe'] });
+    execFileSync('git', ['add', '--', ...toStage], { cwd: root, stdio: ['ignore', 'ignore', 'pipe'] });
   } catch (err) {
     const detail = err && err.stderr ? err.stderr.toString().trim() : (err && err.message) || 'unknown error';
     throw new Error(`sync-manifest-versions: failed to git-add manifests inside a work tree: ${detail}`);
   }
 }
 
-module.exports = { VERSIONED_MANIFESTS, syncManifestVersions, findDrift, getPackageVersion, stageManifests };
+module.exports = {
+  VERSIONED_MANIFESTS,
+  syncManifestVersions,
+  findDrift,
+  getPackageVersion,
+  stageManifests,
+  // ADR-1244 D6: native capability version sweep
+  listCapabilityManifests,
+  syncCapabilityVersions,
+  findCapabilityDrift,
+};
 
 if (require.main === module) {
   const args = process.argv.slice(2);
   const version = getPackageVersion();
   if (args.includes('--check')) {
-    const drift = findDrift({ version });
+    const drift = [...findDrift({ version }), ...findCapabilityDrift({ version })];
     if (drift.length) {
       for (const d of drift) {
         console.error('Manifest ' + d.manifest + ' version ' + d.found + ' != package.json ' + d.expected);
@@ -105,10 +176,11 @@ if (require.main === module) {
       console.error('Run `node scripts/sync-manifest-versions.cjs` to fix.');
       process.exitCode = 1;
     } else {
-      console.log('All ' + VERSIONED_MANIFESTS.length + ' versioned manifests in sync at ' + version + '.');
+      const total = VERSIONED_MANIFESTS.length + listCapabilityManifests().length;
+      console.log('All ' + total + ' versioned manifests in sync at ' + version + '.');
     }
   } else {
-    const changed = syncManifestVersions({ version });
+    const changed = [...syncManifestVersions({ version }), ...syncCapabilityVersions({ version })];
     if (changed.length) {
       console.log('Stamped ' + version + ' into: ' + changed.join(', '));
     } else {