@opengsd/gsd-core 1.6.0-rc.2 → 1.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (157) hide show
  1. package/.claude-plugin/plugin.json +2 -1
  2. package/agents/gsd-advisor-researcher.md +2 -0
  3. package/agents/gsd-ai-researcher.md +2 -0
  4. package/agents/gsd-assumptions-analyzer.md +2 -0
  5. package/agents/gsd-doc-classifier.md +2 -0
  6. package/agents/gsd-doc-synthesizer.md +2 -0
  7. package/agents/gsd-domain-researcher.md +2 -0
  8. package/agents/gsd-eval-auditor.md +6 -9
  9. package/agents/gsd-phase-researcher.md +2 -0
  10. package/agents/gsd-planner.md +8 -57
  11. package/agents/gsd-project-researcher.md +2 -0
  12. package/agents/gsd-research-synthesizer.md +2 -0
  13. package/agents/gsd-security-auditor.md +37 -18
  14. package/agents/gsd-ui-researcher.md +2 -0
  15. package/bin/install.js +370 -18
  16. package/gemini-extension.json +1 -1
  17. package/gsd-core/bin/gsd-tools.cjs +46 -4
  18. package/gsd-core/bin/lib/audit-command-router.cjs +52 -14
  19. package/gsd-core/bin/lib/capability-lifecycle.cjs +30 -7
  20. package/gsd-core/bin/lib/capability-registry.cjs +96 -83
  21. package/gsd-core/bin/lib/capability-validator.cjs +22 -0
  22. package/gsd-core/bin/lib/cjs-command-router-adapter.cjs +40 -2
  23. package/gsd-core/bin/lib/command-aliases.cjs +10 -1
  24. package/gsd-core/bin/lib/command-routing-hub.cjs +10 -3
  25. package/gsd-core/bin/lib/config-schema.cjs +1 -0
  26. package/gsd-core/bin/lib/config.cjs +67 -24
  27. package/gsd-core/bin/lib/coverage.cjs +464 -0
  28. package/gsd-core/bin/lib/decisions.cjs +27 -0
  29. package/gsd-core/bin/lib/eval-command-router.cjs +21 -0
  30. package/gsd-core/bin/lib/eval.cjs +60 -0
  31. package/gsd-core/bin/lib/frontmatter.cjs +132 -13
  32. package/gsd-core/bin/lib/graphify-command-router.cjs +53 -36
  33. package/gsd-core/bin/lib/init.cjs +139 -30
  34. package/gsd-core/bin/lib/install-profiles.cjs +6 -3
  35. package/gsd-core/bin/lib/intel-command-router.cjs +79 -60
  36. package/gsd-core/bin/lib/io.cjs +1 -0
  37. package/gsd-core/bin/lib/phase.cjs +16 -2
  38. package/gsd-core/bin/lib/plan-scan.cjs +2 -2
  39. package/gsd-core/bin/lib/planning-workspace.cjs +157 -13
  40. package/gsd-core/bin/lib/profile-output.cjs +18 -6
  41. package/gsd-core/bin/lib/runtime-artifact-conversion.cjs +53 -16
  42. package/gsd-core/bin/lib/runtime-artifact-layout.cjs +21 -3
  43. package/gsd-core/bin/lib/runtime-hooks-surface.cjs +15 -0
  44. package/gsd-core/bin/lib/runtime-name-policy.cjs +47 -2
  45. package/gsd-core/bin/lib/shell-command-projection.cjs +10 -0
  46. package/gsd-core/bin/lib/state.cjs +398 -60
  47. package/gsd-core/bin/lib/surface.cjs +42 -10
  48. package/gsd-core/bin/lib/uat-predicate.cjs +13 -6
  49. package/gsd-core/bin/lib/update-context.cjs +2 -2
  50. package/gsd-core/bin/lib/verification.cjs +67 -6
  51. package/gsd-core/bin/lib/verify.cjs +8 -1
  52. package/gsd-core/bin/shared/config-defaults.manifest.json +3 -0
  53. package/gsd-core/bin/shared/config-schema.manifest.json +2 -1
  54. package/gsd-core/references/planner-guidance.md +66 -0
  55. package/gsd-core/references/planning-config.md +2 -2
  56. package/gsd-core/references/security-asvs-levels.md +27 -0
  57. package/gsd-core/references/untrusted-input-boundary.md +13 -0
  58. package/gsd-core/templates/SECURITY.md +6 -4
  59. package/gsd-core/templates/summary-complex.md +4 -0
  60. package/gsd-core/templates/summary-minimal.md +3 -0
  61. package/gsd-core/templates/summary-standard.md +4 -0
  62. package/gsd-core/templates/summary.md +41 -0
  63. package/gsd-core/workflows/autonomous.md +53 -46
  64. package/gsd-core/workflows/complete-milestone.md +27 -8
  65. package/gsd-core/workflows/execute-phase.md +1 -1
  66. package/gsd-core/workflows/execute-plan.md +5 -0
  67. package/gsd-core/workflows/manager.md +17 -7
  68. package/gsd-core/workflows/new-project.md +82 -16
  69. package/gsd-core/workflows/plan-phase.md +15 -0
  70. package/gsd-core/workflows/profile-user.md +6 -2
  71. package/gsd-core/workflows/progress.md +37 -4
  72. package/gsd-core/workflows/quick.md +3 -1
  73. package/gsd-core/workflows/secure-phase.md +13 -7
  74. package/gsd-core/workflows/ship.md +3 -1
  75. package/gsd-core/workflows/spec-phase.md +3 -1
  76. package/gsd-core/workflows/transition.md +14 -12
  77. package/gsd-core/workflows/ui-review.md +2 -6
  78. package/gsd-core/workflows/verify-work.md +74 -1
  79. package/hooks/dist/gsd-read-injection-scanner.js +49 -25
  80. package/hooks/gsd-read-injection-scanner.js +49 -25
  81. package/hooks/hooks.json +1 -1
  82. package/package.json +4 -2
  83. package/scripts/check-alias-drift.cjs +5 -0
  84. package/scripts/gen-plugin-skills.cjs +117 -0
  85. package/scripts/lint-test-file-count.allowlist.json +2 -1
  86. package/scripts/prompt-injection-scan.sh +9 -0
  87. package/scripts/release-notes/conventional-title.cjs +88 -0
  88. package/scripts/release-notes/format-github-release-notes.cjs +4 -3
  89. package/skills/gsd-add-tests/SKILL.md +38 -0
  90. package/skills/gsd-ai-integration-phase/SKILL.md +37 -0
  91. package/skills/gsd-audit-fix/SKILL.md +33 -0
  92. package/skills/gsd-audit-milestone/SKILL.md +37 -0
  93. package/skills/gsd-audit-uat/SKILL.md +25 -0
  94. package/skills/gsd-autonomous/SKILL.md +51 -0
  95. package/skills/gsd-capture/SKILL.md +67 -0
  96. package/skills/gsd-cleanup/SKILL.md +24 -0
  97. package/skills/gsd-code-review/SKILL.md +59 -0
  98. package/skills/gsd-complete-milestone/SKILL.md +142 -0
  99. package/skills/gsd-config/SKILL.md +56 -0
  100. package/skills/gsd-debug/SKILL.md +53 -0
  101. package/skills/gsd-discuss-phase/SKILL.md +77 -0
  102. package/skills/gsd-docs-update/SKILL.md +49 -0
  103. package/skills/gsd-eval-review/SKILL.md +33 -0
  104. package/skills/gsd-execute-phase/SKILL.md +65 -0
  105. package/skills/gsd-explore/SKILL.md +28 -0
  106. package/skills/gsd-extract-learnings/SKILL.md +22 -0
  107. package/skills/gsd-fast/SKILL.md +31 -0
  108. package/skills/gsd-forensics/SKILL.md +56 -0
  109. package/skills/gsd-graphify/SKILL.md +204 -0
  110. package/skills/gsd-health/SKILL.md +31 -0
  111. package/skills/gsd-help/SKILL.md +29 -0
  112. package/skills/gsd-import/SKILL.md +46 -0
  113. package/skills/gsd-inbox/SKILL.md +39 -0
  114. package/skills/gsd-ingest-docs/SKILL.md +43 -0
  115. package/skills/gsd-manager/SKILL.md +45 -0
  116. package/skills/gsd-map-codebase/SKILL.md +83 -0
  117. package/skills/gsd-mempalace-capture/SKILL.md +71 -0
  118. package/skills/gsd-mempalace-recall/SKILL.md +102 -0
  119. package/skills/gsd-milestone-summary/SKILL.md +51 -0
  120. package/skills/gsd-mvp-phase/SKILL.md +45 -0
  121. package/skills/gsd-new-milestone/SKILL.md +45 -0
  122. package/skills/gsd-new-project/SKILL.md +47 -0
  123. package/skills/gsd-ns-context/SKILL.md +24 -0
  124. package/skills/gsd-ns-ideate/SKILL.md +23 -0
  125. package/skills/gsd-ns-manage/SKILL.md +35 -0
  126. package/skills/gsd-ns-project/SKILL.md +26 -0
  127. package/skills/gsd-ns-review/SKILL.md +28 -0
  128. package/skills/gsd-ns-workflow/SKILL.md +33 -0
  129. package/skills/gsd-pause-work/SKILL.md +43 -0
  130. package/skills/gsd-phase/SKILL.md +57 -0
  131. package/skills/gsd-plan-phase/SKILL.md +63 -0
  132. package/skills/gsd-plan-review-convergence/SKILL.md +60 -0
  133. package/skills/gsd-pr-branch/SKILL.md +26 -0
  134. package/skills/gsd-profile-user/SKILL.md +47 -0
  135. package/skills/gsd-progress/SKILL.md +49 -0
  136. package/skills/gsd-quick/SKILL.md +174 -0
  137. package/skills/gsd-resume-work/SKILL.md +31 -0
  138. package/skills/gsd-review/SKILL.md +42 -0
  139. package/skills/gsd-review-backlog/SKILL.md +63 -0
  140. package/skills/gsd-secure-phase/SKILL.md +36 -0
  141. package/skills/gsd-settings/SKILL.md +29 -0
  142. package/skills/gsd-ship/SKILL.md +24 -0
  143. package/skills/gsd-sketch/SKILL.md +60 -0
  144. package/skills/gsd-spec-phase/SKILL.md +63 -0
  145. package/skills/gsd-spike/SKILL.md +57 -0
  146. package/skills/gsd-stats/SKILL.md +20 -0
  147. package/skills/gsd-surface/SKILL.md +162 -0
  148. package/skills/gsd-thread/SKILL.md +24 -0
  149. package/skills/gsd-ui-phase/SKILL.md +35 -0
  150. package/skills/gsd-ui-review/SKILL.md +33 -0
  151. package/skills/gsd-ultraplan-phase/SKILL.md +34 -0
  152. package/skills/gsd-undo/SKILL.md +35 -0
  153. package/skills/gsd-update/SKILL.md +50 -0
  154. package/skills/gsd-validate-phase/SKILL.md +36 -0
  155. package/skills/gsd-verify-work/SKILL.md +39 -0
  156. package/skills/gsd-workspace/SKILL.md +53 -0
  157. package/skills/gsd-workstreams/SKILL.md +70 -0
@@ -238,6 +238,21 @@ function normalizeNodePath(execPath, opts) {
238
238
  if (/^\/opt\/homebrew\/Cellar\/node(@\d+)?\/[^/]+\/bin\/node(\.exe)?$/.test(execPath)) {
239
239
  return '/opt/homebrew/bin/node';
240
240
  }
241
+ // mise pins a concrete node version at <data>/installs/node/<ver>/bin/node
242
+ // (Windows: <data>/installs/node/<ver>/node.exe). Node realpaths
243
+ // process.execPath to that versioned path, and `mise up` prunes old versions,
244
+ // so a baked hook command 404s after any node bump — the same ephemeral-path
245
+ // failure #977 fixed for fnm. The stable alias is the sibling shim
246
+ // (<data>/shims/node), which always resolves to the active version, like the
247
+ // Homebrew symlink survives `brew upgrade node`. Derive <data> from execPath
248
+ // so a custom MISE_DATA_DIR layout still works, and only rewrite when the shim
249
+ // exists — otherwise fall back to the raw execPath unchanged.
250
+ const miseMatch = normalizedForMatch.match(/^(.*)\/installs\/node\/[^/]+\/(?:bin\/)?node(\.exe)?$/);
251
+ if (miseMatch) {
252
+ const shim = `${miseMatch[1]}/shims/node${miseMatch[2] || ''}`;
253
+ if (existsSync(shim))
254
+ return shim;
255
+ }
241
256
  return execPath;
242
257
  }
243
258
  function resolveNodeRunner(opts) {
@@ -17,6 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
17
17
  Object.defineProperty(exports, "__esModule", { value: true });
18
18
  exports.canonicalizeRuntimeName = canonicalizeRuntimeName;
19
19
  exports.resolveRuntimeNameFromCandidates = resolveRuntimeNameFromCandidates;
20
+ exports.getProjectInstructionFile = getProjectInstructionFile;
20
21
  exports.getDirName = getDirName;
21
22
  const node_fs_1 = __importDefault(require("node:fs"));
22
23
  const node_path_1 = __importDefault(require("node:path"));
@@ -96,9 +97,53 @@ function resolveRuntimeNameFromCandidates(...candidates) {
96
97
  }
97
98
  return null;
98
99
  }
100
+ /**
101
+ * Map a runtime id to its project instruction file path (relative to project
102
+ * root). Bug #1529: this is the SINGLE source of truth shared by both
103
+ * consumption surfaces —
104
+ * (A) the Node surface: profile-output.cjs (generate-claude-md handler)
105
+ * (B) the bash surface: `gsd-tools query project-instruction-file --runtime <r>`,
106
+ * consumed by gsd-core/workflows/new-project.md to set $INSTRUCTION_FILE
107
+ *
108
+ * Mapping table (per the #1529 issue contract):
109
+ *
110
+ * claude → .claude/CLAUDE.md
111
+ * codex, opencode, kilo, kimi → AGENTS.md
112
+ * copilot → .github/copilot-instructions.md
113
+ * antigravity, gemini → GEMINI.md
114
+ * unknown / future runtimes → AGENTS.md (safe cross-agent default)
115
+ *
116
+ * Source-of-truth references for each runtime's read path:
117
+ * - copilot: GitHub Docs — repository-wide custom instructions are read ONLY
118
+ * from `.github/copilot-instructions.md`; a root `copilot-instructions.md`
119
+ * is not a read path. `AGENTS.md` is also read (agent instructions).
120
+ * https://docs.github.com/en/copilot/how-tos/configure-custom-instructions/add-repository-instructions
121
+ * (Installer parity: runtime-config-adapter-registry.cts installSurface
122
+ * 'copilot-instructions' writes the same `.github/copilot-instructions.md`.)
123
+ * - codex/opencode/kilo/kimi: AGENTS.md is the documented cross-agent
124
+ * instruction file (agentsmd/agents.md convention).
125
+ * - antigravity/gemini: GEMINI.md is Gemini CLI's contextFileName.
126
+ *
127
+ * Aliases are normalized via `canonicalizeRuntimeName` first, so inputs like
128
+ * `codex-cli` resolve to `codex` → `AGENTS.md`. Replaces the prior codex-only
129
+ * override in profile-output.cjs (#3163) which left AGENTS-native runtimes
130
+ * (opencode/kilo/kimi) incorrectly emitting `.claude/CLAUDE.md`. Pure: no I/O.
131
+ */
132
+ function getProjectInstructionFile(runtime) {
133
+ const canonical = canonicalizeRuntimeName(runtime);
134
+ if (canonical === 'claude')
135
+ return '.claude/CLAUDE.md';
136
+ if (canonical === 'copilot')
137
+ return '.github/copilot-instructions.md';
138
+ if (canonical === 'antigravity' || canonical === 'gemini')
139
+ return 'GEMINI.md';
140
+ // codex, opencode, kilo, kimi, AND unknown/future runtimes all default to
141
+ // root AGENTS.md (the safe cross-agent instruction file).
142
+ return 'AGENTS.md';
143
+ }
99
144
  /**
100
145
  * Map a canonical runtime id to its on-disk local config directory name
101
- * (e.g. `cursor` -> `.cursor`, `windsurf` -> `.devin`). Unknown/empty inputs
146
+ * (e.g. `cursor` -> `.cursor`, `windsurf` -> `.windsurf`). Unknown/empty inputs
102
147
  * fall back to `.claude`.
103
148
  *
104
149
  * Pure runtime-identity projection. Relocated from `bin/install.js` per
@@ -122,7 +167,7 @@ function getDirName(runtime) {
122
167
  if (runtime === 'cursor')
123
168
  return '.cursor';
124
169
  if (runtime === 'windsurf')
125
- return '.devin';
170
+ return '.windsurf';
126
171
  if (runtime === 'augment')
127
172
  return '.augment';
128
173
  if (runtime === 'trae')
@@ -347,6 +347,16 @@ function projectPathActionProjection({ mode = 'repair', targetDir, platform = pr
347
347
  shell: 'bash',
348
348
  command: `echo 'export PATH="${bashTargetDir}:$PATH"' >> ~/.bashrc`,
349
349
  },
350
+ // #323: fish has no `export`/`$PATH`-list syntax. `fish_add_path` is the
351
+ // fish-native API (>= fish 3.2, 2021) that persists to the universal
352
+ // variable store and de-duplicates. The directory is single-quoted with
353
+ // the same POSIX literal escaping as the zsh/bash siblings — `'\''` is
354
+ // also a valid escaped single quote in fish between quote spans.
355
+ {
356
+ label: 'fish',
357
+ shell: 'fish',
358
+ command: `fish_add_path '${bashTargetDir}'`,
359
+ },
350
360
  ];
351
361
  }
352
362
  else {