@opengsd/gsd-core 1.7.0-rc.5 → 1.7.0

package/gsd-core/bin/lib/runtime-name-policy.cjs

@@ -15,6 +15,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_LOCAL_CONFIG_DIR_SENTINEL = void 0;
 exports.canonicalizeRuntimeName = canonicalizeRuntimeName;
 exports.resolveRuntimeNameFromCandidates = resolveRuntimeNameFromCandidates;
 exports.getProjectInstructionFile = getProjectInstructionFile;
@@ -132,7 +133,15 @@ function resolveRuntimeNameFromCandidates(...candidates) {
  * Aliases are normalized via `canonicalizeRuntimeName` first, so inputs like
  * `codex-cli` resolve to `codex` → `AGENTS.md`. Replaces the prior codex-only
  * override in profile-output.cjs (#3163) which left AGENTS-native runtimes
- * (opencode/kilo/kimi) incorrectly emitting `.claude/CLAUDE.md`. Pure: no I/O.
+ * (opencode/kilo/kimi) incorrectly emitting `.claude/CLAUDE.md`. Pure: no I/O
+ * (the lazy `require` below reads a static generated module, not the disk).
+ *
+ * Descriptor-driven (ADR-1239 / #2096): antigravity's `GEMINI.md` is folded
+ * from a hardcoded `canonical === 'antigravity'` literal into a read of
+ * `runtime.hostBehaviors.projectInstructionFile`. claude/copilot stay
+ * hardcoded (out of scope here) mirroring `getDirName` below, which already
+ * lazy-`require`s `capability-registry.cjs` inside the function body to
+ * avoid a circular dependency at module load.
  */
 function getProjectInstructionFile(runtime) {
     const canonical = canonicalizeRuntimeName(runtime);
@@ -140,17 +149,46 @@ function getProjectInstructionFile(runtime) {
         return '.claude/CLAUDE.md';
     if (canonical === 'copilot')
         return '.github/copilot-instructions.md';
-    if (canonical === 'antigravity')
-        return 'GEMINI.md';
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { runtimes } = require('./capability-registry.cjs');
+    const declared = canonical ? runtimes[canonical]?.runtime?.hostBehaviors?.projectInstructionFile : undefined;
+    if (typeof declared === 'string' && declared.length > 0)
+        return declared;
     // codex, opencode, kilo, kimi, AND unknown/future runtimes all default to
     // root AGENTS.md (the safe cross-agent instruction file).
     return 'AGENTS.md';
 }
+/**
+ * Sentinel returned by {@link getDirName} for a runtime whose
+ * `runtime.configHome.kind === 'none'` (#2103 — a Marketplace/VSIX-distributed
+ * host with NO file-projected config directory at all, e.g. VS Code).
+ *
+ * A plain fallback to `.claude` would be actively wrong here — it would read
+ * as "this runtime installs into .claude", which is false. This sentinel is
+ * a string (not `null`) so `getDirName`'s return type and every existing
+ * template-literal call site (`` `${getDirName(runtime)}` `` in bin/install.js
+ * / runtime-artifact-conversion.cjs / install-engine.cjs) are unaffected —
+ * widening the return type to `string | null` would require auditing every
+ * call site for a null-check, which is out of scope for a runtime that is
+ * never actually dispatched through those installer paths (vscode has no
+ * install surface — see capabilities/vscode/capability.json). The value is
+ * deliberately NOT a plausible dot-dir name (parens are not valid in a
+ * directory-name token GSD would ever generate) so a future caller that
+ * mistakenly interpolates it into a path fails obviously rather than
+ * silently colliding with a real directory.
+ */
+exports.NO_LOCAL_CONFIG_DIR_SENTINEL = '(no-local-config-dir)';
 /**
  * Map a canonical runtime id to its on-disk local config directory name
  * (e.g. `cursor` -> `.cursor`, `windsurf` -> `.windsurf`). Unknown/empty inputs
  * fall back to `.claude`.
  *
+ * #2103: a runtime whose descriptor declares `configHome.kind === 'none'`
+ * (no file-projected config directory at all) returns
+ * {@link NO_LOCAL_CONFIG_DIR_SENTINEL} instead of falling through to
+ * `.claude` — it has no local config dir, and `.claude` would be a wrong
+ * answer, not just an imprecise one.
+ *
  * Pure runtime-identity projection. Relocated from `bin/install.js` per
  * ADR-1508 (epic #1507, #1510 Phase 1) so the Runtime Artifact Conversion
  * Module's rewrite engine can consume it without importing the installer.
@@ -161,9 +199,12 @@ function getDirName(runtime) {
         return '.claude';
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const { runtimes } = require('./capability-registry.cjs');
-    const dir = runtimes[runtime]?.runtime?.localConfigDir;
+    const entry = runtimes[runtime]?.runtime;
+    const dir = entry?.localConfigDir;
     if (typeof dir === 'string' && dir.length > 0)
         return dir;
+    if (entry?.configHome?.kind === 'none')
+        return exports.NO_LOCAL_CONFIG_DIR_SENTINEL;
     return '.claude';
 }
 /**
@@ -210,6 +251,12 @@ const RUNTIME_LABELS = {
     codebuddy: 'CodeBuddy',
     cline: 'Cline',
     zcode: 'ZCode',
+    pi: 'pi',
+    // #2103: vscode is a registered (role:runtime) capability for validator +
+    // host-integration coverage, even though it is never CLI-installed (no
+    // --vscode flag — see NON_INSTALLABLE_RUNTIMES in tests/runtime-flags.test.cjs).
+    // A distinct label is still required by the drift guard below.
+    vscode: 'VS Code',
 };
 /**
  * Map a canonical runtime id to its short display label for the
@@ -257,6 +304,12 @@ const GLOBAL_CONFIG_HOME_FRAGMENTS = {
     cline: "'.cline'",
     kimi: "'.config', 'agents'",
     zcode: "'.zcode'",
+    // pi's global config home is ~/.pi/agent (configHome: dot-home-nested,
+    // parent '.pi', name 'agent' — capabilities/pi/capability.json), matching
+    // resolveConfigHomeFromDescriptor's `path.join(home, parent, name)` for the
+    // no-probe dot-home-nested case (src/runtime-homes.cts). Two-segment
+    // path.join args, same shape as opencode/kilo/kimi above.
+    pi: "'.pi', 'agent'",
 };
 /**
  * Return the global config-home path-fragment source snippet for a runtime
@@ -277,9 +330,14 @@ function getGlobalConfigHomeFragment(runtime) {
  * function declaration block (the add-a-host tax ADR-1239 Phase B / #1679 AC2
  * removes).
  */
+// #2094: 'trae' stays here — bin/install.js's agents-converter dispatch
+// (convertClaudeAgentToTraeAgent selection) still reads isTrae directly.
+// Removing it is gated on migrating that runtime-keyed `else if` chain to a
+// cross-runtime agents-dispatch table (out of scope for #2094, which only
+// folds the shared-hooks-install skip).
 const RUNTIME_FLAG_IDS = Object.freeze([
     'opencode', 'kilo', 'codex', 'copilot', 'antigravity', 'cursor',
-    'windsurf', 'augment', 'trae', 'qwen', 'hermes', 'codebuddy', 'cline', 'kimi', 'zcode',
+    'windsurf', 'augment', 'trae', 'qwen', 'hermes', 'codebuddy', 'cline', 'kimi', 'zcode', 'pi',
 ]);
 /**
  * Return a frozen map of `is<Runtime>` boolean predicates for the given runtime

package/gsd-core/bin/lib/schema-detect.cjs

@@ -13,6 +13,7 @@ exports.ORM_INFO = exports.SCHEMA_PATTERNS = void 0;
 exports.detectSchemaFiles = detectSchemaFiles;
 exports.detectSchemaOrm = detectSchemaOrm;
 exports.checkSchemaDrift = checkSchemaDrift;
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 exports.SCHEMA_PATTERNS = [
     { pattern: /^src\/collections\/.*\.ts$/, orm: 'payload' },
     { pattern: /^src\/globals\/.*\.ts$/, orm: 'payload' },
@@ -61,7 +62,7 @@ function detectSchemaFiles(files) {
     const matches = [];
     const orms = new Set();
     for (const rawFile of files) {
-        const file = rawFile.replace(/\\/g, '/');
+        const file = (0, shell_command_projection_cjs_1.posixNormalize)(rawFile);
         for (const { pattern, orm } of exports.SCHEMA_PATTERNS) {
             if (pattern.test(file)) {
                 matches.push(rawFile);

package/gsd-core/bin/lib/security.cjs

@@ -34,7 +34,6 @@ exports.safeJsonParse = safeJsonParse;
 exports.validatePhaseNumber = validatePhaseNumber;
 exports.validateFieldName = validateFieldName;
 exports.validatePromptStructure = validatePromptStructure;
-exports.scanEntropyAnomalies = scanEntropyAnomalies;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -342,7 +341,7 @@ function sanitizeForDisplay(text) {
     let sanitized = sanitizeForPrompt(text);
     const protocolLeakPatterns = [
         /^\s*(?:assistant|user|system)\s+to=[^:\s]+:[^\n]+$/i,
-        /^\s*<\|(?:assistant|user|system)[^|]*\|>\s*$/i,
+        /^\s*<\|(?:assistant|user|system)[^|]*\|>\s*$/i, // allow-adhoc-markdown: not a GFM table-cell scan — matches `<|role|>` protocol-leak marker tokens (prompt-injection sanitization), a false-positive on the table-regex pipe+cell-class fingerprint
     ];
     sanitized = sanitized
         .split('\n')
@@ -443,38 +442,9 @@ function validatePromptStructure(text, fileType) {
     }
     return { valid: violations.length === 0, violations };
 }
-// ─── Layer 4: Paragraph-Level Entropy Anomaly Detection ─────────────────────────────────────────────────────────────────────
-function shannonEntropy(text) {
-    if (!text || text.length === 0)
-        return 0;
-    const freq = {};
-    for (const ch of text) {
-        freq[ch] = (freq[ch] || 0) + 1;
-    }
-    const len = text.length;
-    let entropy = 0;
-    for (const count of Object.values(freq)) {
-        const p = count / len;
-        entropy -= p * Math.log2(p);
-    }
-    return entropy;
-}
-/**
- * Scan text for paragraphs with anomalously high Shannon entropy.
- */
-function scanEntropyAnomalies(text) {
-    if (!text || typeof text !== 'string') {
-        return { clean: true, findings: [] };
-    }
-    const findings = [];
-    const paragraphs = text.split(/\n\n+/);
-    for (const para of paragraphs) {
-        if (para.length <= 50)
-            continue;
-        const entropy = shannonEntropy(para);
-        if (entropy > 5.5) {
-            findings.push(`High-entropy paragraph detected (${entropy.toFixed(2)} bits/char) — possible encoded payload`);
-        }
-    }
-    return { clean: findings.length === 0, findings };
-}
+// NOTE (#2198): scanEntropyAnomalies + shannonEntropy were removed as dead exports.
+// They had zero production callers — the live hooks (gsd-prompt-guard.js,
+// gsd-read-injection-scanner.js) inline their own pattern subsets for hook
+// independence and never called these functions. scanForInjection is retained
+// below: it serves as the CI codebase-scanner engine
+// (tests/prompt-injection-scan.security.test.cjs), not as a live hook.

package/gsd-core/bin/lib/shell-command-projection.cjs

@@ -15,6 +15,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPosixPath = toPosixPath;
+exports.toNativePath = toNativePath;
+exports.posixNormalize = posixNormalize;
 exports.hookCommandNeedsPowerShellCallOperator = hookCommandNeedsPowerShellCallOperator;
 exports.formatHookCommandForRuntime = formatHookCommandForRuntime;
 exports.shellHookOmitsBashRunner = shellHookOmitsBashRunner;
@@ -38,6 +41,8 @@ exports.projectPersistentPathExportActions = projectPersistentPathExportActions;
 exports.execGit = execGit;
 exports.execNpm = execNpm;
 exports.execTool = execTool;
+exports.resolveGsdToolsPath = resolveGsdToolsPath;
+exports.dispatchGsdCommand = dispatchGsdCommand;
 exports.probeTty = probeTty;
 exports.normalizeContent = normalizeContent;
 exports.retryRenameSync = retryRenameSync;
@@ -50,26 +55,58 @@ const node_fs_1 = __importDefault(require("node:fs"));
 // can intercept calls from this seam — destructured imports capture references
 // at load time and become un-mockable.
 const node_child_process_1 = __importDefault(require("node:child_process"));
+/**
+ * Convert a filesystem path to POSIX form (forward slashes) by translating the
+ * platform-native separator. Single seam for native→POSIX conversion.
+ *
+ * Prefer this over `p.replace(/\\/g, '/')`: the regex form hardcodes both
+ * separators and corrupts POSIX paths containing a literal backslash (a legal
+ * filename character). Splitting on `path.sep` only ever touches real
+ * separators — a no-op on POSIX, `\`→`/` on Windows.
+ */
+function toPosixPath(p) {
+    return p.split(node_path_1.default.sep).join(node_path_1.default.posix.sep);
+}
+/**
+ * Convert a filesystem path to the platform-native separator form. No-op on
+ * POSIX; `/`→`\` on Windows. Prefer this over a
+ * `process.platform === 'win32' ? p.replace(/\//g, '\\') : p` ternary.
+ */
+function toNativePath(p) {
+    return p.split(node_path_1.default.posix.sep).join(node_path_1.default.sep);
+}
+/**
+ * Normalize ALL backslashes to forward slashes, unconditionally and independent
+ * of the running OS. Use this when emitting a path into a POSIX/bash target
+ * (which may differ from the running platform — e.g. generating a Windows config
+ * on a Linux runner) or when parsing input whose separators are unpredictable.
+ *
+ * Contrast `toPosixPath`, which is running-OS-relative (splits on `path.sep`) and
+ * is for *this machine's* filesystem paths. Do NOT use `toPosixPath` for
+ * target-platform projection — on a Linux runner it would not convert a
+ * Windows-target path's backslashes.
+ */
+function posixNormalize(p) {
+    return p.replace(/\\/g, '/');
+}
 /**
  * Return true when a managed hook command must be prefixed with PowerShell's
  * call operator so a quoted executable token is invokable by the target
  * runtime/shell combination.
  *
- * Current evidence-backed policy:
- * - Claude Code on Windows does NOT need it: its hook commands execute under
- *   bash/Git Bash and `& ` breaks there (#3413).
- * - #1928: Gemini CLI — the ONLY runtime with a verified need for the `& `
- *   prefix on Windows — was removed (Google sunset it 2026-06-18). No currently
- *   supported runtime has a verified need, so this seam is now inert. It is
- *   retained (not deleted) so a future runtime with a verified need is a
- *   one-line re-enable, per the conservative policy below. Note: Antigravity —
- *   the Gemini-backend successor — never matched the old `runtime === 'gemini'`
- *   check, so its behavior (no prefix) is unchanged.
+ * The `&`/no-`&` decision is keyed on the **effective hook-execution shell**
+ * (`opts.hookShell`), not on runtime alone — a single runtime (Claude Code)
+ * can host either Git Bash or PowerShell on Windows, and no single static
+ * command string is valid in both (#2236):
+ * - Git Bash: `"node.exe" "hook.js"` works; `& "node.exe" …` → syntax error.
+ * - PowerShell: `& "node.exe" "hook.js"` works; bare `"node.exe" …` →
+ *   `Unexpected token`.
  *
- * Keep the policy conservative until another runtime has a verified need.
+ * Default is `false` (Git Bash form) for backward compatibility. Set
+ * `opts.hookShell = 'powershell'` to emit the PowerShell call-operator form.
  */
-function hookCommandNeedsPowerShellCallOperator(_opts = {}) {
-    return false;
+function hookCommandNeedsPowerShellCallOperator(opts = {}) {
+    return opts.hookShell === 'powershell';
 }
 /**
  * Project a fully-assembled hook command string for the target runtime.
@@ -120,39 +157,48 @@ function formatManagedHookScriptToken(scriptPath, opts = {}) {
     const platform = opts.platform || process.platform;
     if (platform !== 'win32')
         return null;
-    return JSON.stringify(scriptPath.replace(/\\/g, '/'));
+    return JSON.stringify(posixNormalize(scriptPath));
 }
-function projectLocalHookPrefix({ runtime = 'claude', dirName }) {
+function projectLocalHookPrefix({ runtime: _runtime = 'claude', dirName, hookPathStyle }) {
     if (!dirName)
         return dirName;
-    return (runtime === 'antigravity')
+    // Descriptor-driven (ADR-1239 / #2096): folded from a hardcoded
+    // `runtime === 'antigravity'` literal into the runtime's declared
+    // `hostBehaviors.hookPathStyle`. Runtimes that always run project hooks
+    // with the project dir as cwd (Antigravity today) declare 'raw' and get
+    // the bare dirName; every other runtime keeps the $CLAUDE_PROJECT_DIR-
+    // anchored prefix. `runtime` itself is now unused here but stays in the
+    // signature for call-site/back-compat parity (kept `_`-prefixed to
+    // satisfy no-unused-vars).
+    return (hookPathStyle === 'raw')
         ? dirName
         : `"$CLAUDE_PROJECT_DIR"/${dirName}`;
 }
 function projectPortableHookBaseDir({ configDir, homeDir }) {
-    const normalizedConfigDir = String(configDir || '').replace(/\\/g, '/');
-    const normalizedHome = String(homeDir || '').replace(/\\/g, '/');
+    const normalizedConfigDir = posixNormalize(String(configDir || ''));
+    const normalizedHome = posixNormalize(String(homeDir || ''));
     if (!normalizedConfigDir || !normalizedHome)
         return normalizedConfigDir;
     return normalizedConfigDir.startsWith(normalizedHome)
         ? '$HOME' + normalizedConfigDir.slice(normalizedHome.length)
         : normalizedConfigDir;
 }
-function projectShellCommandText({ runnerToken, argTokens = [], runtime = 'generic', platform = process.platform, }) {
+function projectShellCommandText({ runnerToken, argTokens = [], runtime = 'generic', platform = process.platform, hookShell, }) {
     if (!runnerToken)
         return null;
     const parts = [runnerToken, ...argTokens.filter(Boolean)];
-    return formatHookCommandForRuntime(parts.join(' '), { platform, runtime });
+    return formatHookCommandForRuntime(parts.join(' '), { platform, runtime, hookShell });
 }
-function projectManagedHookCommand({ absoluteRunner, scriptPath, runtime = 'generic', platform = process.platform }) {
+function projectManagedHookCommand({ absoluteRunner, scriptPath, runtime = 'generic', platform = process.platform, hookShell }) {
     if (!absoluteRunner || !scriptPath)
         return null;
-    const normalizedScriptPath = platform === 'win32' ? scriptPath.replace(/\\/g, '/') : scriptPath;
+    const normalizedScriptPath = platform === 'win32' ? posixNormalize(scriptPath) : scriptPath;
     return projectShellCommandText({
         runnerToken: absoluteRunner,
         argTokens: [JSON.stringify(normalizedScriptPath)],
         runtime,
         platform,
+        hookShell,
     });
 }
 const MANAGED_HOOK_BASENAMES_BY_SURFACE = {
@@ -245,14 +291,14 @@ function isManagedHookCommand(commandText, opts = {}) {
         for (const arg of opts.args) {
             if (typeof arg !== 'string')
                 continue;
-            const argBasename = arg.replace(/\\/g, '/').split('/').pop() || '';
+            const argBasename = posixNormalize(arg).split('/').pop() || '';
             if (isManagedHookBasename(argBasename, { surface }))
                 return true;
         }
     }
-    const normalizedCommand = commandText.replace(/\\/g, '/');
+    const normalizedCommand = posixNormalize(commandText);
     if (typeof opts.configDir === 'string' && opts.configDir.length > 0) {
-        const normalizedHooksDir = `${node_path_1.default.join(opts.configDir, 'hooks').replace(/\\/g, '/')}/`;
+        const normalizedHooksDir = `${posixNormalize(node_path_1.default.join(opts.configDir, 'hooks'))}/`;
         if (!normalizedCommand.includes(normalizedHooksDir))
             return false;
     }
@@ -282,7 +328,7 @@ const ANCHORED_HOOK_SCRIPT_TOKEN = /^"\$[A-Za-z_][A-Za-z0-9_]*"\//;
 function projectLegacySettingsHookCommand({ absoluteRunner, scriptPath, scriptToken, runtime = 'generic', platform = process.platform, }) {
     if (!absoluteRunner || !scriptPath)
         return null;
-    const normalizedScriptPath = platform === 'win32' ? scriptPath.replace(/\\/g, '/') : scriptPath;
+    const normalizedScriptPath = platform === 'win32' ? posixNormalize(scriptPath) : scriptPath;
     // #1693: a script path already carrying a `"$CLAUDE_PROJECT_DIR"`-anchored
     // quoted prefix (local installs) is already a valid shell token — only the
     // variable is quoted, the rest is bare. JSON.stringify-ing it on Windows
@@ -340,7 +386,7 @@ function projectPathActionProjection({ mode = 'repair', targetDir, platform = pr
     let shellActions;
     if (isWin32) {
         const psTargetDir = escapePowerShellSingleQuoted(targetDir);
-        const bashTargetDir = escapeSingleQuotedShellLiteral(String(targetDir).replace(/\\/g, '/'));
+        const bashTargetDir = escapeSingleQuotedShellLiteral(posixNormalize(String(targetDir)));
         shellActions = [
             {
                 label: 'PowerShell',
@@ -461,6 +507,109 @@ function execTool(program, args, opts = {}) {
     });
     return _spawnResult(result, program);
 }
+/**
+ * Resolve the absolute path to gsd-tools.cjs relative to THIS module.
+ *
+ * This file compiles to gsd-core/bin/lib/shell-command-projection.cjs — a
+ * sibling of gsd-core/bin/gsd-tools.cjs — so the relative walk-up is stable
+ * regardless of install location (global/local/dev-repo layouts all ship
+ * gsd-core/bin/ as a unit).
+ */
+function resolveGsdToolsPath() {
+    return node_path_1.default.resolve(__dirname, '..', 'gsd-tools.cjs');
+}
+/**
+ * Subprocess-shim dispatch to gsd-tools.cjs (ADR-1239 #2102 Stage 2).
+ *
+ * No fully-populated in-process command-routing hub exists anywhere in the
+ * tree — every `createHub()` caller (cjs-command-router-adapter.cts,
+ * phase-command-router.cts, command-routing-hub.cts's own tests) builds a
+ * single-family hub for its own narrow purpose. The ONLY dispatch path that
+ * covers the FULL family/subcommand surface is the gsd-tools.cjs CLI itself.
+ * This mirrors the SUBPROCESS-REUSE precedent already established for the
+ * OpenCode/Kilo hook bridge (see .opencode/plugins/gsd-core.js header:
+ * "Architecture: SUBPROCESS REUSE ... spawns existing hook scripts as child
+ * processes") — the same pattern, applied to command dispatch instead of
+ * hook dispatch.
+ *
+ * Output-flag choice (verified by direct invocation — see #2102 dispatch
+ * notes for the sample invocations): always pass `--raw` (undecorated,
+ * programmatically-consumable stdout on success) and `--json-errors` (a
+ * structured `{ok:false,reason,message}` JSON object on stderr, with a
+ * non-zero exit, instead of a free-text "Error: ..." line). Both are global
+ * flags accepted by every gsd-tools.cjs family/subcommand, so passing them
+ * unconditionally is safe for the full command surface.
+ *
+ * `family` maps 1:1 onto gsd-tools.cjs's first positional argv token;
+ * `subcommand` (when present) onto the second — e.g.
+ * `{family:'phase', subcommand:'add'}` → `gsd-tools.cjs phase add`. An empty
+ * `subcommand` is omitted entirely (some families, e.g. `config-path`, take
+ * no subcommand).
+ *
+ * NEVER throws. Degrades to `{ ok:false, ... }` on:
+ *   - a missing/invalid "family" (validated locally, no subprocess spawned)
+ *   - ENOENT / a missing gsd-tools.cjs (via the injectable `gsdToolsPath`)
+ *   - a wall-clock timeout (`timedOut:true`, mirroring the
+ *     `signal === 'SIGTERM' && error.code === 'ETIMEDOUT'` idiom already used
+ *     by worktree-safety.cts)
+ *   - any other unanticipated throw from the underlying spawn (defensive
+ *     try/catch — execTool itself is spawnSync-based and does not throw).
+ */
+function dispatchGsdCommand({ family, subcommand, args = [], cwd, timeout = 30_000, gsdToolsPath, } = {}) {
+    if (typeof family !== 'string' || family.length === 0) {
+        return {
+            ok: false,
+            stdout: '',
+            stderr: 'dispatchGsdCommand requires a non-empty string "family".',
+            code: null,
+            timedOut: false,
+        };
+    }
+    const resolvedCwd = cwd || process.cwd();
+    const toolsPath = gsdToolsPath || resolveGsdToolsPath();
+    const argv = [
+        toolsPath,
+        family,
+        ...(subcommand ? [subcommand] : []),
+        ...(Array.isArray(args) ? args : []),
+        '--cwd', resolvedCwd,
+        '--raw',
+        '--json-errors',
+    ];
+    let result;
+    try {
+        result = execTool(process.execPath, argv, { cwd: resolvedCwd, timeout });
+    }
+    catch (e) {
+        // Defensive belt-and-suspenders: execTool is spawnSync-based and does not
+        // throw today, but a degraded result here keeps this seam's no-throw
+        // contract true even under an unanticipated future failure mode.
+        return {
+            ok: false,
+            stdout: '',
+            stderr: e instanceof Error ? e.message : String(e),
+            code: null,
+            timedOut: false,
+        };
+    }
+    // Mirrors the established `result.error && (result.error as
+    // NodeJS.ErrnoException).code === ...` idiom (graphify.cts, worktree-safety.cts):
+    // narrow away null via `!== null` FIRST, then cast — asserting `Error | null`
+    // to `NodeJS.ErrnoException | null` directly (paired with optional chaining)
+    // trips a typescript-eslint no-unnecessary-type-assertion false positive for
+    // this exact narrowing shape (all of ErrnoException's extra fields over Error
+    // are optional).
+    const timedOut = result.signal === 'SIGTERM'
+        && result.error !== null
+        && result.error.code === 'ETIMEDOUT';
+    return {
+        ok: result.exitCode === 0 && !timedOut,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        code: result.exitCode,
+        timedOut,
+    };
+}
 function probeTty(opts = {}) {
     const platform = opts.platform ?? process.platform;
     if (platform === 'win32')

package/gsd-core/bin/lib/smart-entry.cjs

@@ -42,6 +42,7 @@ exports.runSmartEntry = runSmartEntry;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
+const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
 const { output } = ioMod;
@@ -274,9 +275,9 @@ function detectSignals(cwd, now = Date.now) {
         fmScalar(fm, body, 'progress', 'Progress');
     // Blockers list: `- <text>` items under a `## Blockers` heading.
     const blockers = [];
-    const blockersMatch = body.match(/##\s*Blockers\s*\n([\s\S]*?)(?=\n##|$)/i); // allow-adhoc-markdown: read-only blockers section-collect in smart-entry.cts; mirrors state.cts (#1372), pending collectSection migration
-    if (blockersMatch) {
-        const items = blockersMatch[1].match(/^-\s+(.+)$/gm) || [];
+    const blockersSection = (0, markdown_sectionizer_cjs_1.collectSection)(body, (h) => h.level === 2 && h.text.trim().toLowerCase() === 'blockers', { levelBounded: true });
+    if (blockersSection) {
+        const items = blockersSection.body.match(/^-\s+(.+)$/gm) || [];
         for (const item of items)
             blockers.push(item.replace(/^-\s+/, '').trim());
     }

package/gsd-core/bin/lib/stale-bake-guard.cjs

@@ -3,9 +3,10 @@
 /**
  * Stale-bake guard for static-frontmatter runtimes (#1688, follow-up to #1650).
  *
- * Runtimes `codex` and `opencode` bake the resolved model ID into each agent's
- * static config at install time (bin/install.js ~5667-5767 for codex,
- * ~10008-10026 for opencode). Their task/spawn_agent interfaces do not accept
+ * Runtimes `codex`, `opencode`, and (since #2093) `kilo` bake the resolved
+ * model ID into each agent's static config at install time (bin/install.js
+ * ~5667-5767 for codex, ~10008-10026 for opencode, and the adjacent kilo
+ * branch added by #2093). Their task/spawn_agent interfaces do not accept
  * an inline `model` parameter, so editing `model_overrides` in
  * `.planning/config.json` or `~/.gsd/defaults.json` has NO effect until the
  * user re-runs `gsd install <runtime>` (or `gsd update`). The failure is
@@ -25,9 +26,17 @@ const os = require('os');
  * Runtimes whose agent config is static frontmatter/TOML baked at install time.
  * MUST stay in sync with the bake paths in bin/install.js. The parity test in
  * tests/stale-bake-guard.test.cjs asserts this matches the runtimes that
- * actually emit a baked model: line id #2256 (opencode) and #49/#2256 (codex).
+ * actually emit a baked model: line id #2256 (opencode), #49/#2256 (codex),
+ * and #2093 (kilo).
  */
-const STATIC_FRONTMATTER_RUNTIMES = Object.freeze(['codex', 'opencode']);
+const STATIC_FRONTMATTER_RUNTIMES = Object.freeze(['codex', 'kilo', 'opencode']);
+
+/** Per-runtime `gsd install` flag, for the remediation hint in the warning. */
+const INSTALL_FLAG_BY_RUNTIME = Object.freeze({
+  codex: '--codex',
+  opencode: '--opencode',
+  kilo: '--kilo',
+});
 
 const _warnedKeys = new Set();
 
@@ -55,7 +64,7 @@ function formatStaleBakeWarning({ runtime, configPath, configMtimeMs, agentMtime
   const signal = detectStaleBake({ runtime, configMtimeMs, agentMtimeMs });
   if (!signal) return '';
   const configDate = new Date(configMtimeMs).toISOString();
-  const installFlag = runtime === 'opencode' ? '--opencode' : '--codex';
+  const installFlag = INSTALL_FLAG_BY_RUNTIME[runtime] || `--${runtime}`;
   return [
     `gsd: model config in ${configPath} changed since agents were last baked (${configDate}).`,
     `     Static-frontmatter runtime '${runtime}' ignores the new model_overrides`,
@@ -79,13 +88,24 @@ function resolveRuntimeFromConfig(config) {
 
 /**
  * Resolve the install root for a runtime's agent files, honoring the same env
- * vars the installer does (CODEX_HOME, OPENCODE_CONFIG_DIR). Returns the
- * absolute directory or `null` for unsupported runtimes.
+ * vars the installer does (CODEX_HOME, OPENCODE_CONFIG_DIR, KILO_CONFIG_DIR).
+ * Returns the absolute directory or `null` for unsupported runtimes.
  */
 function resolveAgentDir(runtime, { env = process.env, homedir = os.homedir } = {}) {
   if (runtime === 'opencode') {
     const base = (env.OPENCODE_CONFIG_DIR && String(env.OPENCODE_CONFIG_DIR).trim()) || path.join(homedir(), '.config', 'opencode');
-    return path.join(base, 'agent');
+    // #2093 fix: the installer writes agents to `<base>/agents` (plural — see
+    // bin/install.js's universal `agentsDest = path.join(targetDir, 'agents')`,
+    // verified against a live `--opencode --global` install). The prior
+    // singular `agent` never matched the real install output, so this guard's
+    // `findOldestAgentMtime` always hit ENOENT and warnIfStaleBake was a
+    // silent no-op for opencode in production — discovered while wiring the
+    // parallel kilo entry below (same bake mechanism, #2093).
+    return path.join(base, 'agents');
+  }
+  if (runtime === 'kilo') {
+    const base = (env.KILO_CONFIG_DIR && String(env.KILO_CONFIG_DIR).trim()) || path.join(homedir(), '.config', 'kilo');
+    return path.join(base, 'agents');
   }
   if (runtime === 'codex') {
     const base = (env.CODEX_HOME && String(env.CODEX_HOME).trim()) || path.join(homedir(), '.codex');
@@ -148,7 +168,7 @@ function findOldestAgentMtime(runtime, { env = process.env, homedir = os.homedir
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     if (!entry.name.startsWith('gsd-')) continue;
-    const isAgentFile = (runtime === 'opencode' && entry.name.endsWith('.md'))
+    const isAgentFile = ((runtime === 'opencode' || runtime === 'kilo') && entry.name.endsWith('.md'))
       || (runtime === 'codex' && (entry.name.endsWith('.toml') || entry.name.endsWith('.md')));
     if (!isAgentFile) continue;
     try {