@opengsd/gsd-core 1.6.0 → 1.7.0-rc.1

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@opengsd/gsd-core",
-  "version": "1.6.0",
+  "version": "1.7.0-rc.1",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "bin": {
     "gsd-core": "bin/install.js",
     "gsd-tools": "gsd-core/bin/gsd-tools.cjs",
-    "gsd_run": "gsd-core/bin/gsd_run"
+    "gsd_run": "gsd-core/bin/gsd_run",
+    "gsd-mcp-server": "bin/gsd-mcp-server.js"
   },
   "files": [
     "bin",
@@ -94,9 +95,8 @@
     "pretest:coverage": "npm run build:lib && npm run lint:skill-deps",
     "lint": "eslint . --cache --cache-location node_modules/.cache/eslint/",
     "lint:fix": "eslint . --fix",
-    "lint:ci": "npm run lint && npm run lint:skill-deps && node scripts/lint-test-file-count.cjs && node scripts/lint-command-contract.cjs && node scripts/lint-pr-check-project-dir.cjs && npm run lint:legacy-name && node scripts/lint-regression-test-names.cjs && node scripts/lint-windows-test-portability.cjs && node scripts/lint-allow-test-rule-refs.cjs && node scripts/lint-resolution-provenance.cjs",
+    "lint:ci": "npm run lint && npm run lint:skill-deps && node scripts/lint-test-file-count.cjs && node scripts/lint-command-contract.cjs && node scripts/lint-pr-check-project-dir.cjs && npm run lint:legacy-name && node scripts/lint-regression-test-names.cjs && node scripts/lint-allow-test-rule-refs.cjs && node scripts/lint-resolution-provenance.cjs",
     "lint:allow-test-rule-refs": "node scripts/lint-allow-test-rule-refs.cjs",
-    "lint:windows-test-portability": "node scripts/lint-windows-test-portability.cjs",
     "lint:regression-names": "node scripts/lint-regression-test-names.cjs",
     "lint:descriptions": "node scripts/lint-descriptions.cjs",
     "lint:skill-deps": "node scripts/lint-skill-deps.cjs",

package/scripts/ci-test-scope.cjs

@@ -118,6 +118,7 @@ const RULES = [
     tests: [
       'tests/semver-compare.test.cjs',
       'tests/bug-10-semver-policy-consolidation.test.cjs',
+      'tests/golden-install-parity.test.cjs', // any src/installer change can alter emitted install artifacts → re-verify golden install parity (drift guard)
     ],
   },
   {
@@ -134,6 +135,7 @@ const RULES = [
       'tests/install-path-detection.test.cjs',
       'tests/release-tarball-smoke.install.test.cjs',
       'tests/runtime-artifact-layout.test.cjs',
+      'tests/golden-install-parity.test.cjs', // any src/installer change can alter emitted install artifacts → re-verify golden install parity (drift guard)
     ],
   },
   {
@@ -212,17 +214,44 @@ const RULES = [
     ],
   },
   {
-    name: 'configuration',
-    match: path => ['config', 'configuration', 'model-catalog', 'model-profile'].some(k => path.includes(k)),
+     name: 'configuration',
+     match: path => ['config', 'configuration', 'model-catalog', 'model-profile'].some(k => path.includes(k)),
+     tests: [
+       'tests/config.test.cjs',
+       'tests/config-get-default.test.cjs',
+       'tests/configuration-migrate-config.test.cjs',
+       'tests/model-catalog-runtime-defaults.test.cjs',
+       'tests/model-profiles.test.cjs',
+     ],
+   },
+  {
+    // ADR-1703 portability lint surface. Editing a rule, the shared vocab/guard
+    // helpers, or the eslint config that wires them must re-run the rule suites
+    // + the disable-ban. The disable-ban also scans bin/install.js and
+    // scripts/build-hooks.js (the Phase 6 glob-expansion surface), so changes
+    // to those files re-run it too.
+    name: 'portability lint rules (ADR-1703)',
+    match: path => path.startsWith('eslint-rules/') ||
+      path === 'eslint.config.mjs' ||
+      path === 'bin/install.js' ||
+      path === 'scripts/build-hooks.js',
     tests: [
-      'tests/config.test.cjs',
-      'tests/config-get-default.test.cjs',
-      'tests/configuration-migrate-config.test.cjs',
-      'tests/model-catalog-runtime-defaults.test.cjs',
-      'tests/model-profiles.test.cjs',
+      'tests/portability-rule-disable-ban.test.cjs',
+      'tests/portability-vocab-drift.test.cjs',
+      // All nine RuleTester suites (P1–P6) — editing any rule / the shared
+      // vocab+guard helpers / the eslint config re-runs the full rule family.
+      'tests/no-path-literal-in-assert.rule.test.cjs',
+      'tests/no-posix-mode-bit-assert.rule.test.cjs',
+      'tests/no-unguarded-nonportable-exec.rule.test.cjs',
+      'tests/no-crlf-fragile-split.rule.test.cjs',
+      'tests/no-hardcoded-tmp.rule.test.cjs',
+      'tests/no-bare-npm-exec.rule.test.cjs',
+      'tests/require-userprofile-with-home.rule.test.cjs',
+      'tests/normalize-path-in-content.rule.test.cjs',
+      'tests/require-fs-op-fallback.rule.test.cjs',
     ],
   },
-];
+ ];
 
 function usage() {
   return [
@@ -329,7 +358,7 @@ function classify(files) {
     // Determine if this file is product/pipeline code.
     // docs/ and root-level .md files are intentionally excluded.
     if (
-      ['bin/', 'src/', 'gsd-core/', 'agents/', 'commands/', 'hooks/', 'tests/', 'scripts/'].some(p => file.startsWith(p)) ||
+      ['bin/', 'src/', 'gsd-core/', 'agents/', 'commands/', 'hooks/', 'tests/', 'scripts/', 'eslint-rules/'].some(p => file.startsWith(p)) ||
       file === 'package.json' || file === 'package-lock.json' ||
       (file.startsWith('tsconfig') && file.endsWith('.json')) ||
       file.startsWith('.github/rulesets/')

package/scripts/lint-allow-test-rule-refs.allowlist.json

@@ -313,7 +313,6 @@
   "tests/verify-test-quality.test.cjs :: source-text-is-the-product",
   "tests/verify-work-auto-transition.test.cjs :: source-text-is-the-product",
   "tests/windows-robustness.test.cjs :: source-text-is-the-product",
-  "tests/windows-test-parity-guard.test.cjs :: structural-regression-guard",
   "tests/workflow-compat.test.cjs :: source-text-is-the-product",
   "tests/workflow-guard-registration.test.cjs :: structural-regression-guard",
   "tests/workflow-maintainer-skip.test.cjs :: source-text-is-the-product",

package/scripts/lint-regression-test-names.allowlist.json

@@ -5,10 +5,13 @@
   "bug-1367-claude-local-flat-command-layout.test.cjs",
   "bug-14-progress-auto-flag-dropped.test.cjs",
   "bug-167-query-meta-command.test.cjs",
+  "bug-1695-state-patch-clobbers-phase-name.test.cjs",
   "bug-17-askuserquestion-option-cap.test.cjs",
   "bug-170-workflow-fallback-install-hint.test.cjs",
   "bug-1736-local-install-commands.test.cjs",
   "bug-1754-js-hook-guard.test.cjs",
+  "bug-1760-state-prune-noop-template-field.test.cjs",
+  "bug-1761-state-sync-wrong-progress.test.cjs",
   "bug-1817-sh-hook-guard.test.cjs",
   "bug-1818-unknown-flags.test.cjs",
   "bug-1826-phases-clear-confirm.test.cjs",

package/scripts/lint-test-file-count.allowlist.json

@@ -99,6 +99,9 @@
     },
     "state": {
       "files": [
+        "bug-1695-state-patch-clobbers-phase-name.test.cjs",
+        "bug-1760-state-prune-noop-template-field.test.cjs",
+        "bug-1761-state-sync-wrong-progress.test.cjs",
         "bug-21-state-md-template-frontmatter.test.cjs",
         "bug-2630-state-frontmatter-milestone-switch.test.cjs",
         "bug-3127-state-begin-phase-idempotent.test.cjs",
@@ -107,10 +110,12 @@
         "bug-3454-state-dollar-backreference-growth.test.cjs",
         "bug-397-state-preserve-executor-authored.test.cjs",
         "bug-905-state-syncstatefrontmatter-preserve-scalars.test.cjs",
-        "bug-948-state-noop-write-guard.test.cjs",
-        "state-acquirestatelock-non-eexist.test.cjs",
-        "state-prune.test.cjs",
-        "state.test.cjs"
+    "bug-948-state-noop-write-guard.test.cjs",
+    "state-acquirestatelock-non-eexist.test.cjs",
+    "state-prune.test.cjs",
+    "state-rebuild-cli.test.cjs",
+    "state-rebuild.test.cjs",
+    "state.test.cjs"
       ],
       "issue": "180"
     },
@@ -142,9 +147,10 @@
         "install-regressions.test.cjs",
         "install-runtime-artifacts.test.cjs",
         "install-update-marker.test.cjs",
+        "install-write-confinement.test.cjs",
         "install.test.cjs"
       ],
-      "issue": "TBD"
+      "issue": "1679"
     },
     "validate": {
       "files": [
@@ -184,6 +190,14 @@
         "fix-1464-docs-manifest-validation.test.cjs"
       ],
       "issue": "1496"
+    },
+    "host-integration": {
+      "files": [
+        "host-integration.test.cjs",
+        "host-integration-validator-parity.test.cjs",
+        "host-integration-descriptors.test.cjs"
+      ],
+      "issue": "1684"
     }
   }
 }

package/scripts/mutation-matrix.cjs

@@ -30,10 +30,52 @@
  */
 
 const { execFileSync } = require('child_process');
-const { readFileSync } = require('fs');
+const fs = require('fs');
 
 const { ExitError, runMain } = require('./lib/cli-exit.cjs');
 
+// ── Resilient stdin reader ────────────────────────────────────────────────────
+// On macOS, libuv sets the stdin pipe fd to non-blocking mode.  A synchronous
+// readFileSync(process.stdin.fd) can therefore throw EAGAIN ("resource
+// temporarily unavailable") when the writer hasn't yet filled the pipe — this
+// is intermittent under heavy CI shard load and causes a spurious status 2
+// exit.  We work around it by calling fs.readSync in a loop and retrying on
+// EAGAIN with a 1 ms synchronous pause (Atomics.wait on a fresh SharedArrayBuffer
+// — no hot spin, no real-clock dependency, works under --experimental-vm-modules).
+/**
+ * Read all of stdin synchronously, retrying on EAGAIN.
+ *
+ * @returns {string} UTF-8 decoded full stdin content.
+ */
+function readStdinSync() {
+  const BUF_SIZE = 64 * 1024; // 64 KB chunks
+  const buf = Buffer.allocUnsafe(BUF_SIZE);
+  const chunks = [];
+
+  for (;;) {
+    let bytesRead;
+    try {
+      bytesRead = fs.readSync(process.stdin.fd, buf, 0, BUF_SIZE, null);
+    } catch (err) {
+      if (err.code === 'EAGAIN') {
+        // Non-blocking pipe not yet ready — yield for ~1 ms then retry.
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1);
+        continue;
+      }
+      if (err.code === 'EOF') {
+        break;
+      }
+      throw err;
+    }
+    if (bytesRead === 0) {
+      break; // Clean EOF
+    }
+    chunks.push(Buffer.from(buf.slice(0, bytesRead)));
+  }
+
+  return Buffer.concat(chunks).toString('utf8');
+}
+
 // ── Per-module mutation score ratchet ─────────────────────────────────────────
 // ADR-456 / issue #1187: every covered module declares a minScore floor.
 //
@@ -195,7 +237,7 @@ function resolveChangedFiles(args) {
   // When --base is absent AND stdin is not a TTY (isTTY is falsy / undefined),
   // read a newline-delimited file list from stdin.
   if (!args.base && process.stdin.isTTY !== true) {
-    const raw = readFileSync(process.stdin.fd, 'utf8');
+    const raw = readStdinSync();
     return raw.split('\n').map(l => l.trim()).filter(Boolean);
   }
 
@@ -318,6 +360,6 @@ function resolveMutationBreak(raw) {
 
 // Export internals for programmatic use (tests/mutation-matrix-ratchet.test.cjs).
 // The require.main guard prevents main() from running when this file is require()d.
-module.exports = { COVERED, TARGET_MUTATION_SCORE, resolveMutationBreak };
+module.exports = { COVERED, TARGET_MUTATION_SCORE, resolveMutationBreak, readStdinSync };
 
 if (require.main === module) runMain(main);

package/scripts/prompt-injection-scan.sh

@@ -94,6 +94,14 @@ ALLOWLIST=(
   # real injection payloads to prove the validator rejects them. See
   # DEFECT.PROMPT-INJECTION-SCAN-COLLISION in CONTEXT.md.
   'tests/windsurf-conversion.test.cjs'
+  # RuleTester fixtures for the local/no-unguarded-nonportable-exec ESLint rule
+  # contain shell-exec command strings (exec("sh -c …"), execFileSync('bash',['-c',…]))
+  # as test DATA the rule must lint — not attack vectors. ADR-1703 Phase 3 (#1720).
+  'tests/no-unguarded-nonportable-exec.rule.test.cjs'
+  # RuleTester fixtures for the local/no-bare-npm-exec ESLint rule contain npm
+  # exec command strings (execFileSync('npm', ['install'])) as test DATA the rule
+  # must lint — not attack vectors. ADR-1703 Phase 4 (#1726).
+  'tests/no-bare-npm-exec.rule.test.cjs'
 )
 
 is_allowlisted() {

package/scripts/lint-windows-test-portability.cjs

@@ -1,178 +0,0 @@
-'use strict';
-
-/**
- * lint-windows-test-portability.cjs — flag tests that combine chmod exec-bit
- * with bare sh/bash -c without a platform guard.
- *
- * ## Why
- *
- * Windows Git Bash (msys2) does not honour Node's chmod exec bit for
- * PATH-executing extension-less scripts. A test that (a) makes a fixture
- * executable via chmodSync and (b) runs it with `sh -c`/`bash -c` will pass
- * on Mac/Linux but fail only in the CI `test (windows-latest, *)` /
- * `full test (windows-latest, *)` lanes, producing a hard-to-diagnose
- * false-negative gate. See CONTEXT.md → DEFECT.WINDOWS-TEST-PORTABILITY.
- *
- * ## What this enforces
- *
- * For every file in tests/**\/*.test.cjs (recursive, excluding node_modules):
- *   - makesExecutable: contains chmodSync?( with an exec-bit octal literal
- *   - shellDashC: contains a sh/bash -c invocation (array form or string literal)
- *   - guarded: contains a process.platform / os.platform() / win32 / isWindows guard
- *   - optOut: contains the literal `windows-portability-ok`
- *   VIOLATION = makesExecutable && shellDashC && !guarded && !optOut
- *
- * ## Remediation
- *
- * Gate the bare-command execution with `if (process.platform !== 'win32')`,
- * or invoke via an explicit interpreter (`sh <path>`), or annotate
- * `// windows-portability-ok: <reason>`.
- *
- * ## Export contract (for unit tests)
- *
- * When required as a module (`require.main !== module`) this file exports
- * `scanContent(source)` → { makesExecutable, shellDashC, guarded, optOut, violation }.
- */
-
-const fs = require('fs');
-const path = require('path');
-
-// ─── Detection regexes ──────────────────────────────────────────────────────
-
-/**
- * Match chmod/chmodSync( calls with an octal mode literal whose exec bits are
- * set, e.g. `fs.chmodSync(p, 0o755)` or `chmod(file, 0o111)`.
- */
-const CHMOD_RE = /chmod(?:Sync)?\s*\([^,;]+,\s*0o([0-7]{3})\b/g;
-
-/**
- * Array form: execFileSync/spawnSync/exec* with 'sh' or 'bash' (optionally
- * prefixed) as the first arg and '-c' as an element of the args array.
- * e.g. execFileSync('bash', ['-c', ...]) or spawnSync('/bin/sh', ['-c', ...])
- */
-const SHELL_ARRAY_RE =
-  /(?:execFile(?:Sync)?|spawnSync|spawn|exec)\s*\(\s*['"`](?:\/(?:usr\/)?bin\/)?(?:bash|sh)['"`]\s*,\s*\[[^\]]*['"]-c['"]/;
-
-/**
- * String-literal form: any string containing `bash -c` or `sh -c`.
- */
-const SHELL_STRING_RE = /['"`][^'"`\n]*(?:bash|sh)\s+-c[^'"`\n]*['"`]/;
-
-/** Platform guard presence. */
-const GUARD_RE = /process\.platform|os\.platform\s*\(|\bwin32\b|\bisWindows\b/;
-
-/** Opt-out annotation. */
-const OPT_OUT_RE = /windows-portability-ok/;
-
-// ─── Pure scanning function (exported for unit tests) ────────────────────────
-
-/**
- * Scan a single file's source text and return detection flags.
- *
- * @param {string} source - The file contents as a string.
- * @returns {{ makesExecutable: boolean, shellDashC: boolean, guarded: boolean, optOut: boolean, violation: boolean }}
- */
-function scanContent(source) {
-  // Reset stateful regex before use.
-  CHMOD_RE.lastIndex = 0;
-
-  let makesExecutable = false;
-  let match;
-  while ((match = CHMOD_RE.exec(source)) !== null) {
-    const oct = match[1];
-    if ((parseInt(oct, 8) & 0o111) !== 0) {
-      makesExecutable = true;
-      break;
-    }
-  }
-
-  const shellDashC = SHELL_ARRAY_RE.test(source) || SHELL_STRING_RE.test(source);
-  const guarded = GUARD_RE.test(source);
-  const optOut = OPT_OUT_RE.test(source);
-  const violation = makesExecutable && shellDashC && !guarded && !optOut;
-
-  return { makesExecutable, shellDashC, guarded, optOut, violation };
-}
-
-// ─── Filesystem walker ───────────────────────────────────────────────────────
-
-/**
- * Recursively collect all *.test.cjs files under `dir`, excluding node_modules.
- *
- * @param {string} dir
- * @param {string[]} [acc]
- * @returns {string[]}
- */
-function collectTestFiles(dir, acc) {
-  acc = acc || [];
-  let entries;
-  try {
-    entries = fs.readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return acc;
-  }
-  for (const entry of entries) {
-    if (entry.name === 'node_modules') continue;
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      collectTestFiles(full, acc);
-    } else if (entry.isFile() && entry.name.endsWith('.test.cjs')) {
-      acc.push(full);
-    }
-  }
-  return acc;
-}
-
-// ─── Main ────────────────────────────────────────────────────────────────────
-
-function main() {
-  const ROOT = path.join(__dirname, '..');
-  const TESTS_DIR = path.join(ROOT, 'tests');
-
-  const files = collectTestFiles(TESTS_DIR);
-  const violations = [];
-
-  for (const file of files) {
-    let source;
-    try {
-      source = fs.readFileSync(file, 'utf8');
-    } catch {
-      continue;
-    }
-    const { violation } = scanContent(source);
-    if (violation) {
-      const rel = path.relative(ROOT, file).replace(/\\/g, '/');
-      violations.push(rel);
-    }
-  }
-
-  if (violations.length > 0) {
-    for (const rel of violations) {
-      process.stderr.write(
-        `${rel}: chmod-executable + sh/bash -c with no platform guard\n`,
-      );
-    }
-    process.stderr.write(
-      '\nWindows Git Bash does not honor Node\'s chmod exec bit for ' +
-        'PATH-executing extension-less scripts ' +
-        '(CONTEXT.md → DEFECT.WINDOWS-TEST-PORTABILITY). ' +
-        'Gate the bare-command execution with ' +
-        '`if (process.platform !== \'win32\')`, or invoke via an explicit ' +
-        'interpreter (`sh <path>`), or annotate ' +
-        '`// windows-portability-ok: <reason>`.\n',
-    );
-    process.exitCode = 1;
-  } else {
-    console.log(
-      `ok lint-windows-test-portability: ${files.length} file(s) scanned, no violations`,
-    );
-  }
-}
-
-// ─── Module boundary ─────────────────────────────────────────────────────────
-
-if (require.main === module) {
-  main();
-} else {
-  module.exports = { scanContent };
-}