@opengsd/gsd-core 1.6.0-rc.1 → 1.6.0-rc.3

package/commands/gsd/capture.md

@@ -1,7 +1,7 @@
 ---
 name: gsd:capture
 description: Capture ideas, tasks, notes, and seeds to their destination
-argument-hint: "[--note | --backlog | --seed | --list] [text]"
+argument-hint: "[--note | --backlog | --seed | --list | --list-seeds] [text]"
 allowed-tools:
   - Read
   - Write
@@ -21,6 +21,7 @@ Mode routing:
 - **--backlog**: Add an idea to the backlog parking lot (999.x numbering) → add-backlog workflow
 - **--seed**: Capture a forward-looking idea with trigger conditions → plant-seed workflow
 - **--list**: List pending todos and select one to work on → check-todos workflow
+- **--list-seeds**: List/audit captured seeds (optional status filter) → list-seeds workflow
 </objective>
 
 <routing>
@@ -32,6 +33,7 @@ Mode routing:
 | --backlog | ROADMAP.md backlog section (999.x) | add-backlog |
 | --seed | .planning/seeds/SEED-NNN-slug.md | plant-seed |
 | --list | Interactive todo browser + action router | check-todos |
+| --list-seeds | Read-only seed list/audit (optional status filter) | list-seeds |
 
 </routing>
 
@@ -41,6 +43,7 @@ Mode routing:
 @~/.claude/gsd-core/workflows/add-backlog.md
 @~/.claude/gsd-core/workflows/plant-seed.md
 @~/.claude/gsd-core/workflows/check-todos.md
+@~/.claude/gsd-core/workflows/list-seeds.md
 @~/.claude/gsd-core/references/ui-brand.md
 </execution_context>
 
@@ -51,6 +54,7 @@ Parse the first token of $ARGUMENTS:
 - If it is `--note`: strip the flag, pass remainder to note workflow
 - If it is `--backlog`: strip the flag, pass remainder to add-backlog workflow
 - If it is `--seed`: strip the flag, pass remainder to plant-seed workflow
+- If it is `--list-seeds`: strip the flag, pass remainder (optional status filter) to list-seeds workflow
 - If it is `--list`: pass remainder (optional area filter) to check-todos workflow
 - Otherwise: pass all of $ARGUMENTS to add-todo workflow
 </context>

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-core",
-  "version": "1.6.0-rc.1",
+  "version": "1.6.0-rc.3",
   "description": "GSD Core — a meta-prompting, context engineering, and spec-driven development system for AI coding agents. Loads gsd's operating context into every Gemini CLI session.",
   "contextFileName": "GEMINI.md"
 }

package/gsd-core/bin/gsd-tools.cjs

@@ -25,6 +25,7 @@
  *   generate-slug <text>               Convert text to URL-safe slug
  *   current-timestamp [format]         Get timestamp (full|date|filename)
  *   list-todos [area]                  Count and enumerate pending todos
+ *   list-seeds [status]                List captured seeds (optional status filter)
  *   verify-path-exists <path>          Check file/directory existence
  *   config-ensure-section              Initialize .planning/config.json
  *   history-digest                     Aggregate all SUMMARY.md data
@@ -84,6 +85,7 @@
  * UAT Audit:
  *   audit-uat                           Scan all phases for unresolved UAT/verification items
  *   uat render-checkpoint --file <path> Render the current UAT checkpoint block
+ *   uat classify-coverage --summary <path> Classify a SUMMARY coverage block into auto-passed vs human-UAT (#1602)
  *
  * Open Artifact Audit:
  *   audit-open [--json]                 Scan all .planning/ artifact types for unresolved items
@@ -631,13 +633,13 @@ async function main() {
   // discovery; previously it was a partial subset that didn't include
   // phase / roadmap / milestone / progress / etc.
   const TOP_LEVEL_USAGE = 'Usage: gsd-tools <command> [args] [--raw] [--pick <field>] [--cwd <path>] [--ws <name>] [--json-errors]\n' +
-    'Commands: agent, agent-skills, audit-open, audit-uat, check, check-commit, commit, commit-to-subrepo, ' +
+    'Commands: agent, agent-skills, audit-open, audit-uat, check, check-commit, commit, commit-to-subrepo, pr-subrepo, ' +
     'config-ensure-section, config-get, config-new-project, config-path, config-set, migrate-config, ' +
     'current-timestamp, detect-custom-files, docs-init, drift-guard, effort, extract-messages, find-phase, ' +
     'from-gsd2, frontmatter, gap-analysis, generate-claude-md, generate-claude-profile, ' +
     'generate-dev-preferences, generate-slug, graphify, history-digest, init, intel, ' +
-    'capability, classify-confidence, git, learnings, list-todos, loop, milestone, package-legitimacy, phase, phase-plan-index, phases, profile-questionnaire, ' +
-    'profile-sample, progress, prompt-budget, requirements, research-plan, research-store, resolve-granularity, resolve-model, roadmap, scaffold, state, ' +
+    'capability, classify-confidence, git, learnings, list-seeds, list-todos, loop, milestone, package-legitimacy, phase, phase-plan-index, phases, profile-questionnaire, ' +
+    'profile-sample, progress, project-instruction-file, prompt-budget, requirements, research-plan, research-store, resolve-granularity, resolve-model, roadmap, scaffold, state, ' +
     'task, template, user-story, validate, verify, verify-path-exists, verify-summary, workstream, worktree\n\n' +
     'Global flags:\n' +
     '  --raw              Emit raw output without post-processing\n' +
@@ -688,6 +690,10 @@ async function main() {
     'worktree', 'prompt-budget',
     'research-store', 'research-plan', 'package-legitimacy', 'classify-confidence',
     'user-story', // pure string validation — no .planning/ access needed
+    // #1529: pure runtime→filename projection via getProjectInstructionFile; no
+    // .planning/ access needed, and resolving project root would break workflow
+    // invocations that run before .planning/ exists (new-project Step 1).
+    'project-instruction-file',
   ]);
   if (!SKIP_ROOT_RESOLUTION.has(command)) {
     cwd = findProjectRoot(cwd);
@@ -959,6 +965,13 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       break;
     }
 
+    case 'pr-subrepo': {
+      const message = args[1];
+      const { repo, branch } = parseNamedArgs(args, ['repo', 'branch']);
+      commands.cmdPrSubrepo(cwd, repo, branch, message, raw);
+      break;
+    }
+
     case 'verify-summary': {
       const summaryPath = args[1];
       const countIndex = args.indexOf('--check-count');
@@ -1095,11 +1108,39 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       break;
     }
 
+    case 'project-instruction-file': {
+      // #1529: pure runtime→filename projection. Backs the
+      // `gsd_run query project-instruction-file --runtime <r>` call in
+      // new-project.md so the bash workflow and profile-output.cjs share one
+      // source of truth (getProjectInstructionFile in runtime-name-policy.cjs).
+      // No SDK bridge — pure local lookup, runs before .planning/ exists.
+      const { getProjectInstructionFile } = require('./lib/runtime-name-policy.cjs');
+      // Parse --runtime <value> (space or = form); default to empty so the
+      // safe AGENTS.md cross-agent default applies.
+      const pifArgs = args.slice(1);
+      let pifRuntime = '';
+      for (let i = 0; i < pifArgs.length; i++) {
+        const a = pifArgs[i];
+        if (a === '--runtime' && pifArgs[i + 1] !== undefined) { pifRuntime = pifArgs[++i]; continue; }
+        if (a.startsWith('--runtime=')) { pifRuntime = a.slice('--runtime='.length); continue; }
+        // First positional that isn't a flag also works (lenient); otherwise ignore unknown flags.
+        if (!a.startsWith('-') && !pifRuntime) { pifRuntime = a; }
+      }
+      const filename = getProjectInstructionFile(pifRuntime);
+      process.stdout.write(filename + '\n');
+      break;
+    }
+
     case 'list-todos': {
       commands.cmdListTodos(cwd, args[1], raw);
       break;
     }
 
+    case 'list-seeds': {
+      commands.cmdListSeeds(cwd, args[1], raw);
+      break;
+    }
+
     case 'verify-path-exists': {
       commands.cmdVerifyPathExists(cwd, args[1], raw);
       break;
@@ -1320,12 +1361,16 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
 
     case 'uat': {
       const subcommand = args[1];
-      const uat = require('./lib/uat.cjs');
       if (subcommand === 'render-checkpoint') {
+        const uat = require('./lib/uat.cjs');
         const options = parseNamedArgs(args, ['file']);
         uat.cmdRenderCheckpoint(cwd, options, raw);
+      } else if (subcommand === 'classify-coverage') {
+        const coverage = require('./lib/coverage.cjs');
+        const options = parseNamedArgs(args, ['summary', 'file']);
+        coverage.cmdClassify(cwd, options, raw);
       } else {
-        error('Unknown uat subcommand. Available: render-checkpoint', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        error('Unknown uat subcommand. Available: render-checkpoint, classify-coverage', ERROR_REASON.SDK_UNKNOWN_COMMAND);
       }
       break;
     }
@@ -2128,6 +2173,8 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       const worktreeSafety = require('./lib/worktree-safety.cjs');
       if (subcommand === 'cleanup-wave') {
         worktreeSafety.cmdWorktreeCleanupWave(cwd, args.slice(2));
+      } else if (subcommand === 'record-agent') {
+        worktreeSafety.cmdWorktreeRecordAgent(cwd, args.slice(2));
       } else if (subcommand === 'reap-orphans') {
         worktreeSafety.cmdWorktreeReapOrphans(cwd);
       } else if (subcommand === 'base-check') {
@@ -2135,7 +2182,7 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       } else if (subcommand === 'set-baseref') {
         require('./lib/worktree-base-ref.cjs').cmdWorktreeSetBaseRef(cwd, args.slice(2));
       } else {
-        error('Unknown worktree subcommand. Available: cleanup-wave, reap-orphans, base-check, set-baseref', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        error('Unknown worktree subcommand. Available: cleanup-wave, record-agent, reap-orphans, base-check, set-baseref', ERROR_REASON.SDK_UNKNOWN_COMMAND);
       }
       break;
     }

package/gsd-core/bin/lib/adr-parser.cjs

@@ -58,7 +58,6 @@ const CANONICAL_HEADERS = {
         'candidates',
         'approaches considered',
         'variants',
-        'trade-offs',
         'pros and cons of the options',
         'discussion',
     ],
@@ -190,15 +189,31 @@ function normalizeAdrHeader(raw) {
         .replace(/[^\w\s]/g, '')
         .trim();
 }
-function classifyHeader(normalizedHeader) {
+// Normalized synonym index (audit M7). classifyHeader receives an ALREADY-normalized
+// header (via normalizeAdrHeader), but historically compared it against the RAW synonym
+// strings. Because normalizeAdrHeader collapses [\s:._-]+ to a space and strips [^\w\s],
+// any synonym carrying a hyphen/apostrophe/etc. ('trade-offs', "won't do", 'post-grilling')
+// could never match a normalized header — it was silently dead, and its ADR section went
+// unmapped. Normalizing BOTH sides closes that abstraction asymmetry once, so every synonym
+// (current and future) is reachable regardless of punctuation. Precomputed at module load to
+// avoid re-normalizing the whole table per call; insertion order is preserved so first-match-
+// wins and the exact-then-prefix precedence stay identical to the prior raw-compare loop.
+const _NORMALIZED_SYNONYM_INDEX = (() => {
+    const index = [];
     for (const [canonical, synonyms] of Object.entries(CANONICAL_HEADERS)) {
         for (const synonym of synonyms) {
-            if (normalizedHeader === synonym)
-                return canonical;
-            if (normalizedHeader.startsWith(`${synonym} `))
-                return canonical;
+            index.push([normalizeAdrHeader(synonym), canonical]);
         }
     }
+    return index;
+})();
+function classifyHeader(normalizedHeader) {
+    for (const [synonym, canonical] of _NORMALIZED_SYNONYM_INDEX) {
+        if (normalizedHeader === synonym)
+            return canonical;
+        if (normalizedHeader.startsWith(`${synonym} `))
+            return canonical;
+    }
     return null;
 }
 function splitEntries(blockText) {

package/gsd-core/bin/lib/audit-command-router.cjs

@@ -25,6 +25,10 @@
  */
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
+// Phase 2 (#1646): route through the Hub per ADR-959 §III(B) line 75.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const cjsCommandRouterAdapter = require("./cjs-command-router-adapter.cjs");
+const { routeHubCommandFamily } = cjsCommandRouterAdapter;
 // ─── routeAuditUat ────────────────────────────────────────────────────────────
 function routeAuditUat({ args, cwd, raw, error, _uat }) {
     // Suppress unused-variable warnings for args/error — this command has no
@@ -33,27 +37,61 @@ function routeAuditUat({ args, cwd, raw, error, _uat }) {
     void error;
     // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
     const u = _uat ?? require('./uat.cjs');
-    u.cmdAuditUat(cwd, raw);
+    // Phase 2 (#1646): routes through the Hub for uniform observability and
+    // HandlerFailure taxonomy. audit-uat has no subcommands — a synthetic 'run'
+    // defaultSubcommand gives the Hub a single-handler manifest. The dispatch is
+    // trivial but the observability seam (DispatchEvent, GSD_AUDIT=1 trace) is
+    // now consistent with graphify/intel/host routers.
+    routeHubCommandFamily({
+        family: 'audit-uat',
+        args,
+        subcommands: ['run'],
+        defaultSubcommand: 'run',
+        handlers: {
+            run: () => u.cmdAuditUat(cwd, raw),
+        },
+        unknownMessage: (subcommand) => `Unknown audit-uat subcommand: "${subcommand}". audit-uat takes no subcommands.`,
+        error,
+        cwd,
+        raw,
+    });
 }
 // ─── routeAuditOpen ──────────────────────────────────────────────────────────
 function routeAuditOpen({ args, cwd, raw, error, _audit, _core }) {
-    // Suppress unused-variable warning for error — audit-open has no subcommand
-    // dispatch that would call error(); only flag parsing occurs here.
-    void error;
     // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
     const a = _audit ?? require('./audit.cjs');
     const c = _core ?? io;
+    // Phase 2 (#1646): routes through the Hub for uniform observability.
+    // `--json` is a flag, not a subcommand — capture it in the closure and strip
+    // it from args before Hub dispatch so it isn't mistaken for a subcommand by
+    // the manifest check. The handler then branches on wantJson for the two
+    // output shapes (JSON object vs human-readable formatted report).
     const wantJson = args.includes('--json');
-    const result = a.auditOpenArtifacts(cwd);
-    if (wantJson) {
-        // io.output JSON-stringifies its first arg; pass the object directly.
-        c.output(result, raw);
-    }
-    else {
-        // Human-readable report must bypass JSON encoding — use the rawValue
-        // form (third arg) which io.output emits verbatim.
-        c.output(null, true, a.formatAuditReport(result));
-    }
+    const hubArgs = wantJson ? args.filter((arg) => arg !== '--json') : args;
+    routeHubCommandFamily({
+        family: 'audit-open',
+        args: hubArgs,
+        subcommands: ['run'],
+        defaultSubcommand: 'run',
+        handlers: {
+            run: () => {
+                const result = a.auditOpenArtifacts(cwd);
+                if (wantJson) {
+                    // io.output JSON-stringifies its first arg; pass the object directly.
+                    c.output(result, raw);
+                }
+                else {
+                    // Human-readable report must bypass JSON encoding — use the rawValue
+                    // form (third arg) which io.output emits verbatim.
+                    c.output(null, true, a.formatAuditReport(result));
+                }
+            },
+        },
+        unknownMessage: (subcommand) => `Unknown audit-open subcommand: "${subcommand}". audit-open takes no subcommands (use --json for JSON output).`,
+        error,
+        cwd,
+        raw,
+    });
 }
 module.exports = {
     routeAuditUat,

package/gsd-core/bin/lib/capability-lifecycle.cjs

@@ -280,6 +280,20 @@ function isSafeHookScriptPath(script) {
 function shellSingleQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
+/**
+ * #1634: build the emitted hook `command` for an ABSOLUTE confined script path. For `.js`-family
+ * hooks (`.js`/`.cjs`/`.mjs`) prefix with `node` so the hook runs regardless of the source's
+ * executable bit — a `git`/tarball source that lost `+x` would otherwise yield
+ * `/bin/sh: Permission denied` on every matching call (defect #2). This mirrors first-party hooks
+ * (`node "${CLAUDE_PLUGIN_ROOT}/hooks/x.js"`). The path stays POSIX single-quoted (#1460 (R) HIGH)
+ * so a space-containing install prefix cannot word-split or inject. Non-JS scripts (e.g. `.sh`)
+ * keep the bare single-quoted absolute path (unchanged) — they remain responsible for their own
+ * executability, exactly as before; per-runtime command projection is a separate concern (ADR-857 D8).
+ */
+const JS_HOOK_EXT_RE = /\.(?:js|cjs|mjs)$/;
+function runnableHookCommand(absScript) {
+    return JS_HOOK_EXT_RE.test(absScript) ? 'node ' + shellSingleQuote(absScript) : shellSingleQuote(absScript);
+}
 /**
  * #1460 CONF-1: resolve a hook `script` (declared RELATIVE to the bundle) against the capability's
  * own install dir and CONFINE it via realpath, returning the ABSOLUTE confined path or null when it
@@ -459,6 +473,11 @@ function applyCapabilitySharedEdits(args) {
                 const script = typeof rec['script'] === 'string' ? rec['script'] : '';
                 if (!event || !script || isUnsafeKey(event))
                     continue;
+                // #1634: optional tool-scoping `matcher` (a settings.json concept — entry-level sibling of
+                // `hooks`). Absent => match-all (field OMITTED so the existing shipped capabilities' wiring
+                // is byte-for-byte unchanged, Hyrum's Law). The validator gates this to a non-empty string.
+                const matcherRaw = rec['matcher'];
+                const matcher = typeof matcherRaw === 'string' && matcherRaw.length > 0 ? matcherRaw : null;
                 // #1460 CONF-1: resolve the declared (relative) script against the capability's OWN install
                 // dir and CONFINE via realpath, then write the ABSOLUTE confined path as the hook command —
                 // never the raw relative path (which would resolve against the CWD at hook-exec time and could
@@ -467,14 +486,18 @@ function applyCapabilitySharedEdits(args) {
                 const absScript = confinedBundleScript(capDir(runtimeDir, capId), script);
                 if (absScript === null)
                     continue;
-                // #1460 (R) HIGH: the hook `command` is consumed by a shell (first-party hooks emit
-                // `node "${CLAUDE_PLUGIN_ROOT}/hooks/x.js"`). The absolute path begins with the
-                // (non-manifest) install-prefix, which commonly contains spaces — emit it POSIX
-                // single-quoted so the prefix cannot word-split or inject. The script BASENAME is
-                // already restricted to a shell-safe allowlist by isSafeHookScriptPath above.
-                const command = shellSingleQuote(absScript);
+                // #1460 (R) HIGH + #1634: the hook `command` is consumed by a shell. `runnableHookCommand`
+                // emits a `node`-prefixed POSIX-single-quoted absolute path for `.js`-family hooks (runs
+                // without `+x`; mirrors first-party) and a bare single-quoted path otherwise. Single-quoting
+                // keeps a space-containing install prefix as one shell token (cannot word-split or inject).
+                const command = runnableHookCommand(absScript);
                 const arr = Array.isArray(hooksObj[event]) ? hooksObj[event] : [];
-                arr.push({ [CAP_MARKER]: capId, hooks: [{ type: 'command', command }] });
+                // #1634: stamp the marker so the entry is surgically strippable, and carry the declared
+                // `matcher` (entry-level sibling of `hooks`) only when the author declared one.
+                const entry = { [CAP_MARKER]: capId, hooks: [{ type: 'command', command }] };
+                if (matcher !== null)
+                    entry['matcher'] = matcher;
+                arr.push(entry);
                 hooksObj[event] = arr;
                 touched = true;
             }