@opengsd/gsd-core 1.7.0-rc.1 → 1.7.0-rc.2

package/gsd-core/workflows/review.md

@@ -277,10 +277,15 @@ fi
 # $CODEX_BYPASS_FLAG is capability-gated above (#1115). Capture stderr to a .err
 # file (not /dev/null) so a non-zero exit — e.g. a flag the installed codex-cli
 # does not support — is diagnosable instead of a silent empty review.
+# Capture the review via codex's own `-o/--output-last-message <FILE>` (only the
+# final agent message) and discard stdout (#1698): on some platforms (Windows)
+# codex writes process-teardown output to stdout *after* the final message, and a
+# stdout redirect would append that noise to a non-empty file — slipping past the
+# `[ ! -s … ]` empty-output guard as a silently polluted review.
 if [ -n "$CODEX_MODEL" ] && [ "$CODEX_MODEL" != "null" ]; then
-  cat /tmp/gsd-review-prompt-{phase}.md | codex exec --ephemeral $CODEX_BYPASS_FLAG --model "$CODEX_MODEL" --skip-git-repo-check - 2>/tmp/gsd-review-codex-{phase}.err > /tmp/gsd-review-codex-{phase}.md
+  cat /tmp/gsd-review-prompt-{phase}.md | codex exec --ephemeral $CODEX_BYPASS_FLAG --model "$CODEX_MODEL" --skip-git-repo-check -o /tmp/gsd-review-codex-{phase}.md - 2>/tmp/gsd-review-codex-{phase}.err >/dev/null
 else
-  cat /tmp/gsd-review-prompt-{phase}.md | codex exec --ephemeral $CODEX_BYPASS_FLAG --skip-git-repo-check - 2>/tmp/gsd-review-codex-{phase}.err > /tmp/gsd-review-codex-{phase}.md
+  cat /tmp/gsd-review-prompt-{phase}.md | codex exec --ephemeral $CODEX_BYPASS_FLAG --skip-git-repo-check -o /tmp/gsd-review-codex-{phase}.md - 2>/tmp/gsd-review-codex-{phase}.err >/dev/null
 fi
 if [ ! -s /tmp/gsd-review-codex-{phase}.md ]; then
   echo "Codex review failed or returned empty output. stderr:" > /tmp/gsd-review-codex-{phase}.md

package/gsd-core/workflows/settings-advanced.md

@@ -353,13 +353,13 @@ Built-in tier defaults by runtime:
 
 | Runtime    | `opus`                        | `sonnet`                        | `haiku`                       |
 |------------|-------------------------------|---------------------------------|-------------------------------|
-| `claude`   | `claude-opus-4-8`             | `claude-sonnet-4-6`             | `claude-haiku-4-5`            |
+| `claude`   | `claude-opus-4-8`             | `claude-sonnet-5`             | `claude-haiku-4-5`            |
 | `codex`    | `gpt-5.5`                     | `gpt-5.4`                       | `gpt-5.4-mini`                |
 | `gemini`   | `gemini-3.1-pro-preview`      | `gemini-3-flash`                | `gemini-2.5-flash-lite`       |
 | `qwen`     | `qwen3-max-2026-01-23`        | `qwen3-coder-plus`              | `qwen3-coder-next`            |
-| `opencode` | `anthropic/claude-opus-4-8`   | `anthropic/claude-sonnet-4-6`   | `anthropic/claude-haiku-4-5`  |
-| `copilot`  | `claude-opus-4-8`             | `claude-sonnet-4-6`             | `claude-haiku-4-5`            |
-| `hermes`   | `anthropic/claude-opus-4-8`   | `anthropic/claude-sonnet-4-6`   | `anthropic/claude-haiku-4-5`  |
+| `opencode` | `anthropic/claude-opus-4-8`   | `anthropic/claude-sonnet-5`   | `anthropic/claude-haiku-4-5`  |
+| `copilot`  | `claude-opus-4-8`             | `claude-sonnet-5`             | `claude-haiku-4-5`            |
+| `hermes`   | `anthropic/claude-opus-4-8`   | `anthropic/claude-sonnet-5`   | `anthropic/claude-haiku-4-5`  |
 | Group B (`kilo`, `cline`, `cursor`, `windsurf`, `augment`, `trae`, `codebuddy`, `antigravity`) | (no built-in default — your runtime handles model selection) | | |
 
 Display a table to the user showing the effective configuration:
@@ -623,8 +623,8 @@ AskUserQuestion([
     header: "Provider",
     multiSelect: false,
     options: [
-      { label: "anthropic", description: "claude-opus-4-8 / claude-sonnet-4-6 / claude-haiku-4-5 (Anthropic / Claude)" },
-      { label: "anthropic-fable", description: "claude-fable-5 / claude-sonnet-4-6 / claude-haiku-4-5 (Anthropic / Claude Fable opt-in)" },
+      { label: "anthropic", description: "claude-opus-4-8 / claude-sonnet-5 / claude-haiku-4-5 (Anthropic / Claude)" },
+      { label: "anthropic-fable", description: "claude-fable-5 / claude-sonnet-5 / claude-haiku-4-5 (Anthropic / Claude Fable opt-in)" },
       { label: "openai", description: "gpt-5.5 / gpt-5.4 / gpt-5.4-mini (OpenAI / Codex)" },
       { label: "Other known provider", description: "Type google or qwen; both still use the canonical tier mapping." }
     ]
@@ -654,11 +654,11 @@ Canonical tier mappings by provider and budget:
 
 | Provider  | Budget | high                       | medium                     | low                        |
 |-----------|--------|----------------------------|----------------------------|----------------------------|
-| anthropic | high   | claude-opus-4-8            | claude-opus-4-8            | claude-sonnet-4-6          |
-| anthropic | medium | claude-opus-4-8            | claude-sonnet-4-6          | claude-haiku-4-5           |
+| anthropic | high   | claude-opus-4-8            | claude-opus-4-8            | claude-sonnet-5          |
+| anthropic | medium | claude-opus-4-8            | claude-sonnet-5          | claude-haiku-4-5           |
 | anthropic | low    | claude-haiku-4-5           | claude-haiku-4-5           | claude-haiku-4-5           |
-| anthropic-fable | high   | claude-fable-5             | claude-fable-5             | claude-sonnet-4-6          |
-| anthropic-fable | medium | claude-opus-4-8            | claude-sonnet-4-6          | claude-haiku-4-5           |
+| anthropic-fable | high   | claude-fable-5             | claude-fable-5             | claude-sonnet-5          |
+| anthropic-fable | medium | claude-opus-4-8            | claude-sonnet-5          | claude-haiku-4-5           |
 | anthropic-fable | low    | claude-haiku-4-5           | claude-haiku-4-5           | claude-haiku-4-5           |
 | openai    | high   | gpt-5.5                    | gpt-5.5                    | gpt-5.5                    |
 | openai    | medium | gpt-5.5                    | gpt-5.4                    | gpt-5.4-mini               |

package/gsd-core/workflows/verify-work.md

@@ -417,6 +417,7 @@ If no more tests → Go to `complete_session`
 Read the full UAT file.
 
 Find first test with `result: [pending]`.
+If no `[pending]` test found → go to `complete_session`.
 
 Announce:
 ```
@@ -514,8 +515,6 @@ Resolve the security review failure before advancing to the next phase.
 All tests passed, but phase advancement is blocked until security review produces SECURITY.md.
 
 - `/gsd:secure-phase {phase}` — security review (required before advancing)
-- `/gsd:plan-phase {next}` — Plan next phase
-- `/gsd:execute-phase {next}` — Execute next phase
 - `/gsd:ui-review {phase}` — visual quality audit (if frontend files were modified)
 ```
 

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@opengsd/gsd-core",
-  "version": "1.7.0-rc.1",
+  "version": "1.7.0-rc.2",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
+  "main": ".opencode/plugins/gsd-core.js",
   "bin": {
     "gsd-core": "bin/install.js",
     "gsd-tools": "gsd-core/bin/gsd-tools.cjs",
@@ -16,6 +17,7 @@
     "assets",
     "agents",
     ".claude-plugin",
+    ".opencode",
     "gemini-extension.json",
     "GEMINI.md",
     "hooks",

package/scripts/run-tests.cjs

@@ -119,6 +119,51 @@ function ensureBuiltArtifacts(overrides = {}) {
     }
   }
 }
+
+// hooks/dist/ is gitignored (.gitignore) and NOT built by `prepare`
+// (npm run build:lib only) — only the full `build`/`prepublishOnly` scripts run
+// build:hooks. So on a clean checkout + `npm ci` (fresh CI, incl. the scoped
+// test lane) hooks/dist starts absent. Install tests (e.g.
+// bug-3683-workflow-colon-namespace-leak) spawn `install.js --<runtime> --local`
+// which copies hooks from hooks/dist/ and then verifyInstalled() hard-fails if
+// the target hooks dir is empty. build-hooks.js `build()` creates DIST_DIR
+// empty and fills it file-by-file, so the FIRST on-demand build (triggered by
+// whichever concurrent install test's before() hook runs first) exposes a
+// window where hooks/dist exists but is empty/partial. A concurrently-spawned
+// install reader observes zero hooks -> "Failed to install hooks: directory is
+// empty" -> intermittent scoped-lane failure (full lanes dodge it only by luck
+// of a hooks-builder finishing early). Building hooks/dist ONCE here — the same
+// upfront chokepoint as ensureBuiltArtifacts, single-process with no concurrent
+// readers — fully populates dist before any test runs, closing the first-build
+// empty window everywhere (CI scoped/unit shards + local). Subsequent on-demand
+// rebuilds only atomically replace individual files (per-file rename in
+// build-hooks.js) and never re-empty the dir, so they stay safe.
+function ensureBuiltHooks(overrides = {}) {
+  const { existsSync, statSync } = require('fs');
+  const root = overrides.root || join(__dirname, '..');
+  const distDir = overrides.distDir || join(root, 'hooks', 'dist');
+  const hookNames = overrides.hookNames || require('./build-hooks.js').HOOKS_TO_COPY;
+  const runBuild = overrides.runBuild || (() => {
+    execFileSync(process.execPath, [join(root, 'scripts', 'build-hooks.js')], {
+      cwd: root,
+      stdio: 'inherit',
+    });
+  });
+
+  // dist is "complete" only if every expected hook exists as a non-empty file.
+  // Absent dir, empty dir, or a missing/zero-byte hook all trigger a rebuild.
+  const complete = existsSync(distDir) && hookNames.every((hook) => {
+    const p = join(distDir, hook);
+    try {
+      return existsSync(p) && statSync(p).size > 0;
+    } catch {
+      return false;
+    }
+  });
+  if (!complete) {
+    runBuild();
+  }
+}
 const MARKED_SUITES = ['integration', 'install', 'security', 'slow'];
 
 // Recursively collect *.test.cjs files under dir, returning paths relative to dir.
@@ -454,6 +499,11 @@ function main() {
   // Build the gitignored bin/lib artifact if absent, before any test requires it.
   ensureBuiltArtifacts();
 
+  // Build the gitignored hooks/dist artifact once, before any concurrent install
+  // test spawns install.js and reads it — closes the first-build empty-dir race
+  // that intermittently failed the scoped CI lane (see ensureBuiltHooks above).
+  ensureBuiltHooks();
+
   // Hermeticity: in-process tests resolve `.planning` via planningDir(cwd), which
   // honours GSD_PROJECT/GSD_WORKSTREAM. A developer shell inside a GSD workstream
   // exports GSD_WORKSTREAM, which would redirect fixture STATE.md reads away from
@@ -600,4 +650,4 @@ if (require.main === module) {
   runMain(main);
 }
 
-module.exports = { suiteOf, ensureBuiltArtifacts, parseShardArg, selectShard };
+module.exports = { suiteOf, ensureBuiltArtifacts, ensureBuiltHooks, parseShardArg, selectShard };

package/scripts/sync-manifest-versions.cjs

@@ -21,18 +21,66 @@ const { execFileSync } = require('child_process');
 
 const ROOT = path.resolve(__dirname, '..');
 
-// Single source of truth: runtime-integration manifests whose top-level `version`
-// MUST track package.json. Add a new manifest here so `npm version` keeps it in
-// sync — the regression guard test (issue 844) fails if you forget.
+// Single source of truth: runtime-integration manifests whose `version` field
+// MUST track package.json. Each entry names the manifest path plus the dotted
+// path to the version field inside that JSON document. Top-level `version` is
+// the default (plugin.json, gemini-extension.json); the Claude plugin
+// marketplace manifest carries its canonical version at plugins[0].version
+// (the schema-canonical location runtimes read — issue #1855).
+//
+// Add a new manifest here so `npm version` keeps it in sync — the regression
+// guard test (issue 844) fails if you forget.
 const VERSIONED_MANIFESTS = [
-  '.claude-plugin/plugin.json',
-  'gemini-extension.json',
+  { path: '.claude-plugin/plugin.json', versionKey: 'version' },
+  { path: 'gemini-extension.json', versionKey: 'version' },
+  { path: '.claude-plugin/marketplace.json', versionKey: 'plugins.0.version' },
+  { path: 'vscode/package.json', versionKey: 'version' },
 ];
 
+// Convenience: just the registered paths, for consumers that only need to
+// iterate files (e.g. the issue-844 regression-guard ALLOWED set).
+const VERSIONED_MANIFEST_PATHS = VERSIONED_MANIFESTS.map((e) => e.path);
+
 function readJson(p) {
   return JSON.parse(fs.readFileSync(p, 'utf8'));
 }
 
+// Property names that must never be traversed/assigned through a dotted path —
+// the prototype-pollution triple. Mirrors the _isSafePropKey CodeQL barrier used
+// elsewhere in the repo. Versions are hand-authored descriptors, but the helpers
+// are exported, so guard them before reuse across a trust boundary.
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function assertSafePath(dotPath) {
+  for (const seg of String(dotPath).split('.')) {
+    if (UNSAFE_KEYS.has(seg)) {
+      throw new Error(`refusing to traverse reserved property "${seg}" in version path "${dotPath}"`);
+    }
+  }
+}
+
+// Read a dotted path ('plugins.0.version') from a parsed JSON document.
+// Returns undefined if any intermediate is missing. Array indices are plain
+// numeric keys, so 'plugins.0.version' resolves obj.plugins[0].version.
+// Reserved properties (__proto__/constructor/prototype) are rejected.
+function getByPath(obj, dotPath) {
+  assertSafePath(dotPath);
+  return String(dotPath).split('.').reduce((cur, key) => (cur == null ? cur : cur[key]), obj);
+}
+
+// Write a value at a dotted path. Intermediate nodes must already exist (every
+// registered manifest is hand-authored with its version slot present, so this
+// never needs to materialize a path). Reserved properties are rejected. Kept
+// trivial — no eval, no creation.
+function setByPath(obj, dotPath, value) {
+  assertSafePath(dotPath);
+  const parts = String(dotPath).split('.');
+  let cur = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    cur = cur[parts[i]];
+  }
+  cur[parts[parts.length - 1]] = value;
+}
+
 function getPackageVersion(root) {
   const r = root || ROOT;
   return readJson(path.join(r, 'package.json')).version;
@@ -44,13 +92,13 @@ function syncManifestVersions(opts) {
   const root = (opts && opts.root) || ROOT;
   const v = (opts && opts.version) != null ? opts.version : getPackageVersion(root);
   const changed = [];
-  for (const rel of VERSIONED_MANIFESTS) {
-    const abs = path.join(root, rel);
+  for (const entry of VERSIONED_MANIFESTS) {
+    const abs = path.join(root, entry.path);
     const manifest = readJson(abs);
-    if (manifest.version !== v) {
-      manifest.version = v;
+    if (getByPath(manifest, entry.versionKey) !== v) {
+      setByPath(manifest, entry.versionKey, v);
       fs.writeFileSync(abs, JSON.stringify(manifest, null, 2) + '\n');
-      changed.push(rel);
+      changed.push(entry.path);
     }
   }
   return changed;
@@ -61,9 +109,10 @@ function findDrift(opts) {
   const root = (opts && opts.root) || ROOT;
   const v = (opts && opts.version) != null ? opts.version : getPackageVersion(root);
   const drift = [];
-  for (const rel of VERSIONED_MANIFESTS) {
-    const found = readJson(path.join(root, rel)).version;
-    if (found !== v) drift.push({ manifest: rel, found, expected: v });
+  for (const entry of VERSIONED_MANIFESTS) {
+    const manifest = readJson(path.join(root, entry.path));
+    const found = getByPath(manifest, entry.versionKey);
+    if (found !== v) drift.push({ manifest: entry.path, found, expected: v });
   }
   return drift;
 }
@@ -143,7 +192,7 @@ function stageManifests(opts) {
     console.warn('sync-manifest-versions: not a git work tree; skipping staging.');
     return;
   }
-  const toStage = [...VERSIONED_MANIFESTS, ...listCapabilityManifests({ root })];
+  const toStage = [...VERSIONED_MANIFEST_PATHS, ...listCapabilityManifests({ root })];
   try {
     execFileSync('git', ['add', '--', ...toStage], { cwd: root, stdio: ['ignore', 'ignore', 'pipe'] });
   } catch (err) {
@@ -154,6 +203,9 @@ function stageManifests(opts) {
 
 module.exports = {
   VERSIONED_MANIFESTS,
+  VERSIONED_MANIFEST_PATHS,
+  getByPath,
+  setByPath,
   syncManifestVersions,
   findDrift,
   getPackageVersion,

package/skills/gsd-review/SKILL.md

@@ -35,6 +35,12 @@ Phase number: extracted from $ARGUMENTS (required)
 - `--cursor` — Include Cursor agent review
 - `--agy` / `--antigravity` — Include Antigravity CLI review
 - `--all` — Include all available CLIs
+
+**No flags** — if `review.default_reviewers` is set, review with only those configured
+reviewers that are detected; otherwise review with all available CLIs. Configured
+`review.reviewer_instances` names may appear in `review.default_reviewers`; each runs as an
+independent reviewer identity backed by its configured adapter+model (see
+`docs/CONFIGURATION.md`). Instance names are not valid as flags.
 </context>
 
 <process>