@opengsd/gsd-core 1.7.0-rc.6 → 1.8.0

package/gsd-core/bin/lib/commands.cjs

@@ -33,7 +33,10 @@ const roadmapParserMod = require("./roadmap-parser.cjs");
 const { extractCurrentMilestone, stripShippedMilestones: _stripShippedMilestones, getMilestoneInfo, getMilestonePhaseFilter, getRoadmapPhaseInternal } = roadmapParserMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const modelResolverMod = require("./model-resolver.cjs");
-const { resolveModelInternal, resolveEffortInternal, resolveFastModeInternal, resolveEffortForTier, resolveGranularityInternal, assertValidGranularityOverride } = modelResolverMod;
+const { resolveModelInternal, resolveModelForTier, resolveProviderEscalation, resolveEffortInternal, resolveFastModeInternal, resolveEffortForTier, resolveGranularityInternal, assertValidGranularityOverride } = modelResolverMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const agentCommandRouterMod = require("./agent-command-router.cjs");
+const { AGENT_FAILURE_CLASSES } = agentCommandRouterMod;
 const model_catalog_cjs_1 = require("./model-catalog.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
@@ -45,7 +48,46 @@ const { extractFrontmatter } = frontmatter;
 const modelProfiles = require("./model-profiles.cjs");
 const { MODEL_PROFILES, VALID_PHASE_TYPES } = modelProfiles;
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
+const clock_cjs_1 = require("./clock.cjs");
 // ─── Phase Status ─────────────────────────────────────────────────────────────
+/**
+ * Phase-status precedence ladder — furthest-along wins (#2408).
+ *
+ * `cmdStats` builds `phasesByNumber` by scanning on-disk phase directories.
+ * When two directories normalize to the same phase key (e.g. `05-real/` and
+ * `05-real-stray/`), the status field must be folded by precedence rather
+ * than overwritten last-write-wins — otherwise `/gsd-stats` reports whatever
+ * directory `fs.readdirSync` happened to yield last, which is non-deterministic
+ * across platforms and can silently call a `Complete` phase `Not Started`.
+ */
+const PHASE_STATUS_PRECEDENCE = [
+    'Complete',
+    'Needs Review',
+    'Executed',
+    'In Progress',
+    'Planned',
+    'Not Started',
+    'Pending',
+];
+const PHASE_STATUS_RANK = new Map(PHASE_STATUS_PRECEDENCE.map((s, i) => [s, i]));
+/**
+ * Fold two phase statuses by precedence — returns whichever is further along
+ * the {@link PHASE_STATUS_PRECEDENCE} ladder. Unrecognized statuses fall behind
+ * every recognized one (so a recognized status always wins over an unknown one;
+ * two unrecognized statuses favor `a` for determinism).
+ */
+function foldPhaseStatus(a, b) {
+    const ra = PHASE_STATUS_RANK.get(a);
+    const rb = PHASE_STATUS_RANK.get(b);
+    if (ra === undefined && rb === undefined)
+        return a;
+    if (ra === undefined)
+        return b;
+    if (rb === undefined)
+        return a;
+    // Lower rank = higher precedence (Complete=0 wins over Not Started=5).
+    return ra <= rb ? a : b;
+}
 /**
  * Determine phase status by checking plan/summary counts AND verification state.
  * Introduces "Executed" for phases with all summaries but no passing verification.
@@ -127,6 +169,9 @@ function cmdListTodos(cwd, area, raw) {
             const createdMatch = content.match(/^created:\s*(.+)$/m);
             const titleMatch = content.match(/^title:\s*(.+)$/m);
             const areaMatch = content.match(/^area:\s*(.+)$/m);
+            // #2337: surface severity when present. Omit the key entirely for todos
+            // with no severity line so existing consumers of this JSON are unaffected.
+            const severityMatch = content.match(/^severity:\s*(.+)$/m);
             const todoArea = areaMatch ? areaMatch[1].trim() : 'general';
             // Apply area filter if specified
             if (area && todoArea !== area)
@@ -138,6 +183,7 @@ function cmdListTodos(cwd, area, raw) {
                 title: titleMatch ? titleMatch[1].trim() : 'Untitled',
                 area: todoArea,
                 path: toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(pendingDir, file))),
+                ...(severityMatch ? { severity: severityMatch[1].trim() } : {}),
             });
         }
     }
@@ -393,7 +439,8 @@ function cmdResolveGranularity(cwd, phaseType, raw, override) {
  *   { model, profile, effort, effort_rendered, effort_param, effort_propagation,
  *     fast_mode, fast_mode_supported, [unknown_agent] }
  *
- * Flags: --effort <level>, --fast-mode <true|false>, --attempt <n>
+ * Flags: --effort <level>, --fast-mode <true|false>, --attempt <n>,
+ *        --failure-class <class> (#2296)
  */
 function cmdResolveExecution(cwd, agentType, raw, opts) {
     if (!agentType) {
@@ -402,7 +449,29 @@ function cmdResolveExecution(cwd, agentType, raw, opts) {
     opts = opts || {};
     const config = loadConfig(cwd);
     const profile = config['model_profile'] || 'balanced';
-    const model = resolveModelInternal(cwd, agentType);
+    // #2068: resolve the model per-attempt so dynamic_routing escalates the MODEL
+    // (heavy tier) alongside effort. Gated on an explicit --attempt exactly like the
+    // effort resolution below, so the two fields stay symmetric: with no --attempt
+    // the model comes from the classic profile path (unchanged for everyone,
+    // including dynamic_routing-enabled users who don't pass --attempt), and only an
+    // explicit attempt routes through the tier ladder. resolveModelForTier itself
+    // still falls back to resolveModelInternal when dynamic_routing is off.
+    let model = (opts.attempt !== undefined && opts.attempt !== null)
+        ? resolveModelForTier(cwd, agentType, opts.attempt)
+        : resolveModelInternal(cwd, agentType);
+    // #2296: when the caller reports WHY the previous attempt failed, consult the
+    // provider-escalation ladder. Only a quota/rate-limit class warrants it — a
+    // heavier tier on the same throttled provider is still throttled, so this
+    // ladder swaps providers instead. Gated on an explicit --failure-class so the
+    // JSON contract is byte-identical for every existing caller.
+    let escalation;
+    if (opts.failureClass !== undefined) {
+        const applicable = opts.failureClass === AGENT_FAILURE_CLASSES.QUOTA_EXCEEDED;
+        const resolved = resolveProviderEscalation(cwd, agentType, opts.attempt, applicable);
+        if (resolved.escalated)
+            model = resolved.to;
+        escalation = { class: opts.failureClass, ...resolved };
+    }
     const effortOpts = {};
     if (typeof opts.effortOverride === 'string')
         effortOpts['override'] = opts.effortOverride;
@@ -429,6 +498,8 @@ function cmdResolveExecution(cwd, agentType, raw, opts) {
     };
     if (!agentModels)
         result['unknown_agent'] = true;
+    if (escalation)
+        result['escalation'] = escalation;
     output(result, raw, effort);
 }
 /**
@@ -592,6 +663,7 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify) {
     // Stage files
     const explicitFiles = files && files.length > 0;
     const filesToStage = explicitFiles ? files : ['.planning/'];
+    const stagedPaths = [];
     for (const file of filesToStage) {
         const fullPath = node_path_1.default.join(cwd, file);
         if (!node_fs_1.default.existsSync(fullPath)) {
@@ -607,12 +679,32 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify) {
         }
         else {
             (0, shell_command_projection_cjs_1.execGit)(['add', file], { cwd });
+            stagedPaths.push(file);
         }
     }
-    // Commit (--no-verify skips pre-commit hooks, used by parallel executor agents)
-    const commitArgs = amend ? ['commit', '--amend', '--no-edit'] : ['commit', '-m', sanitizedMessage];
+    // Commit — when the caller declared a scope (--files), append a pathspec so
+    // only the declared files land in the commit, not the entire index (#2112).
+    // The pathspec uses stagedPaths (not filesToStage) so skipped missing files
+    // are excluded — otherwise git would record them as deletions (#2014).
+    // During a merge, git refuses partial commits — fall back to a bare commit.
+    // --amend is left without a pathspec: amending with -- <paths> is a different
+    // operation that rewrites the tip with only those paths.
+    if (explicitFiles && stagedPaths.length === 0 && !amend) {
+        const result = { committed: false, hash: null, reason: 'nothing_to_commit' };
+        output(result, raw, 'nothing');
+        return;
+    }
+    const isMergeInProgress = (0, shell_command_projection_cjs_1.execGit)(['rev-parse', '-q', '--verify', 'MERGE_HEAD'], { cwd }).exitCode === 0;
+    const canScope = explicitFiles && stagedPaths.length > 0 && !amend
+        && !isMergeInProgress;
+    const commitArgs = amend
+        ? ['commit', '--amend', '--no-edit']
+        : ['commit', '-m', sanitizedMessage];
     if (noVerify)
         commitArgs.push('--no-verify');
+    if (canScope) {
+        commitArgs.push('--', ...stagedPaths);
+    }
     const commitResult = (0, shell_command_projection_cjs_1.execGit)(commitArgs, { cwd });
     if (commitResult.exitCode !== 0) {
         if (commitResult.stdout.includes('nothing to commit') || commitResult.stderr.includes('nothing to commit')) {
@@ -710,12 +802,21 @@ function cmdCommitToSubrepo(cwd, message, files, raw) {
     for (const [repo, repoFiles] of Object.entries(grouped)) {
         const repoCwd = node_path_1.default.join(cwd, repo);
         // Stage files (strip sub-repo prefix for paths relative to that repo)
+        const stagedRelPaths = [];
         for (const file of repoFiles) {
             const relativePath = file.slice(repo.length + 1);
-            (0, shell_command_projection_cjs_1.execGit)(['add', relativePath], { cwd: repoCwd });
+            const addResult = (0, shell_command_projection_cjs_1.execGit)(['add', relativePath], { cwd: repoCwd });
+            if (addResult.exitCode === 0) {
+                stagedRelPaths.push(relativePath);
+            }
         }
-        // Commit
-        const commitResult = (0, shell_command_projection_cjs_1.execGit)(['commit', '-m', message], { cwd: repoCwd });
+        // Commit — pathspec limits the commit to the staged files only (#2112)
+        const isMergeInProgressSub = (0, shell_command_projection_cjs_1.execGit)(['rev-parse', '-q', '--verify', 'MERGE_HEAD'], { cwd: repoCwd }).exitCode === 0;
+        const canScopeSub = stagedRelPaths.length > 0 && !isMergeInProgressSub;
+        const commitArgs = canScopeSub
+            ? ['commit', '-m', message, '--', ...stagedRelPaths]
+            : ['commit', '-m', message];
+        const commitResult = (0, shell_command_projection_cjs_1.execGit)(commitArgs, { cwd: repoCwd });
         if (commitResult.exitCode !== 0) {
             if (commitResult.stdout.includes('nothing to commit') || commitResult.stderr.includes('nothing to commit')) {
                 repos[repo] = { committed: false, hash: null, files: repoFiles, reason: 'nothing_to_commit' };
@@ -837,8 +938,16 @@ function cmdPrSubrepo(cwd, repo, branch, commitMessage, raw) {
             error(`Failed to stage ${file} in ${repo}: ${addResult.stderr}`);
         }
     }
-    // 5. Commit
-    const commitResult = (0, shell_command_projection_cjs_1.execGit)(['commit', '-m', commitMessage], { cwd: repoCwd });
+    // 5. Commit — pathspec limits the commit to the staged files only (#2112).
+    // changedFiles includes both old and new paths for renames so the full
+    // rename is captured atomically (pathspec on newPath alone would leave the
+    // deletion of oldPath stranded in the index).
+    const isMergeInProgressPr = (0, shell_command_projection_cjs_1.execGit)(['rev-parse', '-q', '--verify', 'MERGE_HEAD'], { cwd: repoCwd }).exitCode === 0;
+    const canScopePr = changedFiles.length > 0 && !isMergeInProgressPr;
+    const commitArgs = canScopePr
+        ? ['commit', '-m', commitMessage, '--', ...changedFiles]
+        : ['commit', '-m', commitMessage];
+    const commitResult = (0, shell_command_projection_cjs_1.execGit)(commitArgs, { cwd: repoCwd });
     if (commitResult.exitCode !== 0) {
         rollback();
         error(`Failed to commit in ${repo}: ${commitResult.stderr}`);
@@ -1223,7 +1332,7 @@ function cmdTodoComplete(cwd, filename, raw) {
     (0, shell_command_projection_cjs_1.platformEnsureDir)(completedDir);
     // Read, add completion timestamp, move
     let content = node_fs_1.default.readFileSync(sourcePath, 'utf-8');
-    const today = new Date().toISOString().split('T')[0];
+    const today = clock_cjs_1.realClock.localToday();
     content = `completed: ${today}\n` + content;
     (0, shell_command_projection_cjs_1.platformWriteSync)(node_path_1.default.join(completedDir, filename), content);
     node_fs_1.default.unlinkSync(sourcePath);
@@ -1232,7 +1341,7 @@ function cmdTodoComplete(cwd, filename, raw) {
 function cmdScaffold(cwd, type, options, raw) {
     const { phase, name } = options;
     const padded = phase ? normalizePhaseName(phase) : '00';
-    const today = new Date().toISOString().split('T')[0];
+    const today = clock_cjs_1.realClock.localToday();
     // Find phase directory
     const phaseInfo = phase ? findPhaseInternal(cwd, phase) : null;
     const phaseDir = phaseInfo ? node_path_1.default.join(cwd, phaseInfo['directory']) : null;
@@ -1346,7 +1455,12 @@ function cmdStats(cwd, format, raw) {
                 name: existing?.name || phaseName,
                 plans: (existing?.plans || 0) + plans,
                 summaries: (existing?.summaries || 0) + summaries,
-                status,
+                // #2408: fold colliding statuses by precedence rather than overwriting
+                // last-write-wins. fs.readdirSync order is non-deterministic across
+                // platforms, so a naive overwrite can report a Complete phase as Not
+                // Started (or vice versa) depending on read order. The fold picks the
+                // furthest-along status, matching what an operator expects.
+                status: existing ? foldPhaseStatus(existing.status, status) : status,
             });
         }
     }
@@ -1468,6 +1582,8 @@ function cmdCheckCommit(cwd, raw) {
 module.exports = {
     groupFilesBySubrepo,
     determinePhaseStatus,
+    foldPhaseStatus,
+    PHASE_STATUS_PRECEDENCE,
     cmdGenerateSlug,
     cmdCurrentTimestamp,
     cmdListTodos,

package/gsd-core/bin/lib/config-loader.cjs

@@ -18,7 +18,7 @@
  *   - ./planning-workspace.cjs (planningDir, planningRoot)
  *   - ./shell-command-projection.cjs (execGit, platformWriteSync, platformReadSync)
  *   - ./core-utils.cjs       (detectSubRepos)
- *   - ./model-catalog.cjs    (KNOWN_RUNTIMES, KNOWN_PROVIDERS)
+ *   - ./model-catalog.cjs    (KNOWN_RUNTIMES, KNOWN_PROVIDERS, ADAPTIVE_TIER_VALUES)
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -158,17 +158,25 @@ const _warnedUnknownConfigKeys = new Set();
 // ─── Git utilities ────────────────────────────────────────────────────────────
 const _gitIgnoredCache = new Map();
 function isGitIgnored(cwd, targetPath) {
-    const key = cwd + '::' + targetPath;
+    // #2206: strip trailing slashes — `git check-ignore` has a quirk where a
+    // CRLF .gitignore with blank lines falsely reports a trailing-slash path
+    // (e.g. `.planning/`) as ignored. Normalizing here protects every call site.
+    const normalized = targetPath.replace(/\/+$/, '');
+    const key = cwd + '::' + normalized;
     if (_gitIgnoredCache.has(key))
         return _gitIgnoredCache.get(key);
     // --no-index checks .gitignore rules regardless of whether the file is tracked.
-    const result = (0, shell_command_projection_cjs_1.execGit)(['check-ignore', '-q', '--no-index', '--', targetPath], { cwd });
+    const result = (0, shell_command_projection_cjs_1.execGit)(['check-ignore', '-q', '--no-index', '--', normalized], { cwd });
     const ignored = result.exitCode === 0;
     _gitIgnoredCache.set(key, ignored);
     return ignored;
 }
 // ─── Model alias resolution ───────────────────────────────────────────────────
-const RUNTIME_OVERRIDE_TIERS = new Set(['opus', 'sonnet', 'haiku']);
+// Catalog-derived (model-catalog.cts) so this vocabulary can never drift from
+// VALID_TIERS in verify.cts — see #2070 "Generative Fix Divergence". Excludes
+// 'inherit' (unlike VALID_TIERS): runtime overrides always resolve to a
+// concrete tier, never the adaptive sentinel.
+const RUNTIME_OVERRIDE_TIERS = model_catalog_cjs_1.ADAPTIVE_TIER_VALUES;
 const _warnedConfigKeys = new Set();
 function _warnUnknownProfileOverrides(parsed, configLabel) {
     if (!parsed || typeof parsed !== 'object')
@@ -683,6 +691,14 @@ function loadConfigResolved(cwd, options = {}) {
                 fast_mode: (globalDefaults['fast_mode']) || null,
                 agent_skills: (globalDefaults['agent_skills']) || {},
                 response_language: (globalDefaults['response_language']) || null,
+                // #2069: forward model_policy / model_profile_overrides / runtime so the global-defaults
+                // path is at parity with the project-config path (which forwards these three from
+                // parsed['…'] at the top of this function). Without these entries, ~/.gsd/defaults.json
+                // silently drops them — model_policy/provider/budget etc. are honored when set in a
+                // project but ignored when set globally.
+                runtime: (globalDefaults['runtime']) || null,
+                model_profile_overrides: (globalDefaults['model_profile_overrides']) || null,
+                model_policy: (globalDefaults['model_policy']) || null,
             };
             // Branch D: global-defaults
             try {

package/gsd-core/bin/lib/config.cjs

@@ -67,6 +67,45 @@ const SCHEMA_DEFAULTS = {
     'executor.stall_threshold_minutes': 10,
     'git.create_tag': true,
 };
+/**
+ * Resolve a schema-level default for an absent key (#2256). Checks the legacy
+ * hardcoded SCHEMA_DEFAULTS first, then the capability-registry configSchema
+ * default — the same registry default the runtime's capability-activation
+ * resolver (resolveConfigKey Level 4, capability-activation.cts) already honors,
+ * so `query config-get` can no longer disagree with the runtime about an absent
+ * key's effective value.
+ */
+function resolveSchemaDefault(cwd, kp) {
+    if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
+        return { found: true, value: SCHEMA_DEFAULTS[kp] };
+    }
+    const capSchema = getCapabilityConfigSchema(cwd);
+    if (capSchema && typeof capSchema === 'object'
+        && Object.prototype.hasOwnProperty.call(capSchema, kp)) {
+        const entry = capSchema[kp];
+        if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+            const def = entry['default'];
+            if (def !== undefined)
+                return { found: true, value: def };
+        }
+    }
+    return { found: false, value: undefined };
+}
+/**
+ * Emit a schema-resolved default (#2256), applying the same secret-masking
+ * invariant the found-key path applies. getCapabilityConfigSchema is a
+ * federated, third-party-extensible surface (ADR-1244) — a future key-name
+ * collision with a secret key must not leak a declared default in plaintext.
+ * Centralizing emission here means masking can't be missed at a call site.
+ */
+function emitResolvedDefault(kp, value, raw) {
+    if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+        const masked = (0, secrets_cjs_1.maskSecret)(value);
+        output(masked, raw, masked);
+        return;
+    }
+    output(value, raw, String(value));
+}
 // ─── Validation helpers ───────────────────────────────────────────────────────
 function validateKnownConfigKeyPath(keyPath) {
     const suggested = CONFIG_KEY_SUGGESTIONS[keyPath];
@@ -692,6 +731,22 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     const VALID_CONTEXT_POSITIONS = ['front', 'end'];
     if (kp === 'statusline.context_position')
         assertEnumValue(parsedValue, val, VALID_CONTEXT_POSITIONS, 'statusline.context_position');
+    // statusline.show_context_tokens — boolean only
+    if (kp === 'statusline.show_context_tokens') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid statusline.show_context_tokens '${val}'. Must be a boolean (true or false).`);
+        }
+    }
+    // Statusline GSD-state format enum validation
+    const VALID_STATE_FORMATS = ['full', 'compact'];
+    if (kp === 'statusline.state_format')
+        assertEnumValue(parsedValue, val, VALID_STATE_FORMATS, 'statusline.state_format');
+    // statusline.show_git — boolean only
+    if (kp === 'statusline.show_git') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid statusline.show_git '${val}'. Must be a boolean (true or false).`);
+        }
+    }
     // Fallow scope + profile enum validation (#3424)
     const VALID_FALLOW_SCOPES = ['phase', 'repo'];
     if (kp === 'code_quality.fallow.scope')
@@ -813,16 +868,15 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
             config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
         }
         else if (hasDefault) {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
-            output(defaultValue, raw, String(defaultValue));
-            return;
-        }
-        else if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-            const def = SCHEMA_DEFAULTS[kp];
-            output(def, raw, String(def));
+            emitResolvedDefault(kp, defaultValue, raw);
             return;
         }
         else {
+            const sd = resolveSchemaDefault(cwd, kp);
+            if (sd.found) {
+                emitResolvedDefault(kp, sd.value, raw);
+                return;
+            }
             error('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
         }
     }
@@ -836,29 +890,38 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     let current = config;
     for (const key of keys) {
         if (current === undefined || current === null || typeof current !== 'object') {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
             if (hasDefault) {
-                output(defaultValue, raw, String(defaultValue));
+                emitResolvedDefault(kp, defaultValue, raw);
                 return;
             }
-            if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-                const def = SCHEMA_DEFAULTS[kp];
-                output(def, raw, String(def));
+            const sd = resolveSchemaDefault(cwd, kp);
+            if (sd.found) {
+                emitResolvedDefault(kp, sd.value, raw);
                 return;
             }
             error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
         }
-        current = current[key];
+        // Own-property gate: bracket access on a plain object walks the
+        // prototype chain, so an unqualified `current[key]` would resolve
+        // '__proto__' / 'constructor' / 'hasOwnProperty' (and other
+        // Object.prototype members) to their inherited values instead of
+        // correctly reporting them as absent. hasOwnProperty.call only
+        // returns true for a key JSON.parse actually assigned as data on
+        // this object (including a literal "__proto__" JSON key, which
+        // JSON.parse defines as an own data property, not the accessor) —
+        // never for something inherited from the prototype chain.
+        current = Object.prototype.hasOwnProperty.call(current, key)
+            ? current[key]
+            : undefined;
     }
     if (current === undefined) {
-        // eslint-disable-next-line @typescript-eslint/no-base-to-string
         if (hasDefault) {
-            output(defaultValue, raw, String(defaultValue));
+            emitResolvedDefault(kp, defaultValue, raw);
             return;
         }
-        if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-            const def = SCHEMA_DEFAULTS[kp];
-            output(def, raw, String(def));
+        const sd = resolveSchemaDefault(cwd, kp);
+        if (sd.found) {
+            emitResolvedDefault(kp, sd.value, raw);
             return;
         }
         error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);

package/gsd-core/bin/lib/core-utils.cjs

@@ -27,10 +27,16 @@ const { comparePhaseNum } = phaseIdModule;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
 const { findContextMdIn } = planningWorkspace;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const shellCommandProjection = require("./shell-command-projection.cjs");
 // ─── Path helpers ────────────────────────────────────────────────────────────
-/** Normalize a relative path to always use forward slashes (cross-platform). */
+/**
+ * Normalize a relative path to always use forward slashes (cross-platform).
+ * Delegates to the single separator seam in shell-command-projection so there is
+ * exactly one implementation of native→POSIX conversion across the codebase.
+ */
 function toPosixPath(p) {
-    return p.split(node_path_1.default.sep).join('/');
+    return shellCommandProjection.toPosixPath(p);
 }
 /**
  * Scan immediate child directories for separate git repos.
@@ -180,8 +186,13 @@ function extractCanonicalPlanId(filename) {
     // or a single-digit-plus-letter id ("3A"); a *bare* single digit is a slug word,
     // so "46-6-rs-…" is not paired into a "46-6" id while "3A-01" stays intact.
     const tokenRe = /^(?:\d{2,}[A-Z]?|\d[A-Z])(?:\.\d+)*$/i;
+    // #2232: the PAIRED plan component is a zero-padded continuation segment
+    // (exactly 2 digits), so a ≥3-digit slug word (a year) is not paired into a
+    // bogus "14-2026" id. The leading phase component keeps tokenRe's unbounded
+    // \d{2,} — phase numbers ≥100 are legitimate; only continuations are capped.
+    const planTokenRe = new RegExp(`^(?:${phaseIdModule.PHASE_CONTINUATION_SEGMENT_SOURCE}[A-Z]?|\\d[A-Z])(?:\\.\\d+)*$`, 'i');
     const phaseIdx = parts.findIndex(p => tokenRe.test(p));
-    if (phaseIdx >= 0 && phaseIdx + 1 < parts.length && tokenRe.test(parts[phaseIdx + 1])) {
+    if (phaseIdx >= 0 && phaseIdx + 1 < parts.length && planTokenRe.test(parts[phaseIdx + 1])) {
         return `${parts[phaseIdx]}-${parts[phaseIdx + 1]}`;
     }
     return base;

package/gsd-core/bin/lib/decisions.cjs

@@ -54,6 +54,26 @@ const bulletEmDashRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+
  * only colon permitted before `**`. (#1639)
  */
 const bulletTitledColonRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+)\])?[^:*]*:[^:*]*\*\*\s*(.*)$/;
+/**
+ * #2347: format-agnostic evidence that a block/section holds real decision
+ * ENTRIES the parser could not read — a bullet whose bold lead-in is an
+ * ID-SHAPED token (uppercase prefix, optional digits, hyphen, alnum), whatever
+ * the exact ID grammar. The three parser grammars above all require a `D-`
+ * prefix; #1365's fail-loud guard reused that same `\bD-` test as its "is this
+ * decision-shaped?" evidence, so any other prefix (e.g. `D5-01`) was invisible
+ * to BOTH parser and guard, collapsing `could-not-parse` into a clean
+ * `none-present` pass.
+ *
+ * The ID-shape requirement (not "any bold bullet") is deliberate: a decisions
+ * block or `### Claude's Discretion` sub-section legitimately contains prose
+ * bullets with bold labels (`- **Scope:** …`, `- **Why:** …`, `- **Note:** …`).
+ * Those are NOT decision entries and must stay `none-present` — a false
+ * `could-not-parse` hard-blocks the plan gate. `[A-Z]+[0-9]*-[A-Za-z0-9]` matches
+ * `D-01` / `D5-01` / `DEC-01` but not `Scope:` / `Why:` / `Follow-up:` (mixed
+ * case) / `TODO:` (no `-<alnum>` id) — mirroring the parser's own `D-<alnum>`
+ * shape without hardcoding the `D`.
+ */
+const boldLeadInBulletRe = /^\s*-\s+\*\*[A-Z]+[0-9]*-[A-Za-z0-9]/m;
 /**
  * Parse decision lines from a block of text (the inner text of a <decisions>
  * or markdown-header section body). Returns the extracted decisions and a count
@@ -193,11 +213,13 @@ function extractDecisions(content) {
         }
         // FIX A: Block present but 0 extracted and no parse-misses.
         // Only report could-not-parse when there is genuine evidence of real decisions
-        // that failed to parse: a \bD- token in the block text, or an unterminated fence.
-        // An empty scaffold (<decisions></decisions>) or an all-prose block has no such
-        // evidence — treat as none-present so the gate passes cleanly.
+        // that failed to parse: a bold-lead-in bullet (`- **…**`, any ID grammar — #2347),
+        // a \bD- token in the block text, or an unterminated fence. An empty scaffold
+        // (<decisions></decisions>) or an all-prose block has no such evidence — treat
+        // as none-present so the gate passes cleanly.
         const hasDecisionTokenInBlock = /\bD-[A-Za-z0-9]/m.test(combined);
-        if (hasDecisionTokenInBlock || unterminatedFence) {
+        const hasBoldLeadInBullet = boldLeadInBulletRe.test(combined);
+        if (hasDecisionTokenInBlock || hasBoldLeadInBullet || unterminatedFence) {
             return { decisions: [], outcome: 'could-not-parse' };
         }
         return { decisions: [], outcome: 'none-present' };
@@ -217,11 +239,13 @@ function extractDecisions(content) {
             return { decisions, outcome: 'could-not-parse' };
         }
         // FIX A: Heading found but 0 extracted and no parse-misses.
-        // Only report could-not-parse when the section body contains a D- token.
-        // A heading with only prose, sub-headings, or all-discretion content
-        // (no trackable D- tokens) is a legitimate empty/discretion section → none-present.
+        // Report could-not-parse when the section body holds a decision-entry-shaped
+        // bold-lead-in bullet (`- **…**`, any ID grammar — #2347) or a D- token. A
+        // heading with only prose, sub-headings, or all-discretion content (no such
+        // evidence) is a legitimate empty/discretion section → none-present.
         const hasDecisionTokenInSection = /\bD-[A-Za-z0-9]/m.test(section.body);
-        if (hasDecisionTokenInSection) {
+        const hasBoldLeadInBulletInSection = boldLeadInBulletRe.test(section.body);
+        if (hasDecisionTokenInSection || hasBoldLeadInBulletInSection) {
             return { decisions: [], outcome: 'could-not-parse' };
         }
         return { decisions: [], outcome: 'none-present' };

package/gsd-core/bin/lib/docs.cjs

@@ -259,6 +259,12 @@ function cmdDocsInit(cwd, raw) {
     const agentStatus = checkAgentsInstalled();
     result['agents_installed'] = agentStatus.agents_installed;
     result['missing_agents'] = agentStatus.missing_agents;
+    // #2402: withProjectRoot injects response_language when set; cmdDocsInit predates
+    // that helper and never picked it up, so docs-update's orchestrator-owned prompts
+    // silently stayed English even with response_language configured.
+    if (config.response_language) {
+        result['response_language'] = config.response_language;
+    }
     output(result, raw, undefined);
 }
 module.exports = { cmdDocsInit };

package/gsd-core/bin/lib/drift.cjs

@@ -69,7 +69,7 @@ const SAFE_PATH_RE = /^(?!.*\.\.)(?:[A-Za-z0-9_.][A-Za-z0-9_.\-]*)(?:\/[A-Za-z0-
 function classifyFile(file) {
     if (typeof file !== 'string' || !file)
         return null;
-    const norm = file.replace(/\\/g, '/');
+    const norm = (0, shell_command_projection_cjs_1.posixNormalize)(file);
     if (MIGRATION_RES.some((r) => r.test(norm)))
         return 'migration';
     if (ROUTE_RES.some((r) => r.test(norm)))
@@ -87,7 +87,7 @@ function classifyFile(file) {
  * check `structureMd.includes('src/lib')` holds.
  */
 function isPathMapped(file, structureMd) {
-    const norm = file.replace(/\\/g, '/');
+    const norm = (0, shell_command_projection_cjs_1.posixNormalize)(file);
     const parts = norm.split('/');
     // Check prefixes from longest to shortest; any hit means "mapped".
     for (let i = parts.length - 1; i >= 1; i--) {
@@ -130,7 +130,7 @@ function detectDrift(input) {
         const elements = [];
         const seen = new Map();
         for (const rawFile of added) {
-            const file = rawFile.replace(/\\/g, '/');
+            const file = (0, shell_command_projection_cjs_1.posixNormalize)(rawFile);
             const specific = classifyFile(file);
             let category = specific;
             if (!category) {
@@ -251,7 +251,7 @@ function chooseAffectedPaths(paths) {
     for (const raw of paths || []) {
         if (typeof raw !== 'string' || !raw)
             continue;
-        const file = raw.replace(/\\/g, '/');
+        const file = (0, shell_command_projection_cjs_1.posixNormalize)(raw);
         const parts = file.split('/');
         if (parts.length === 0)
             continue;

package/gsd-core/bin/lib/external-descriptor-trust.cjs

@@ -26,9 +26,21 @@ exports.isPathConfined = isPathConfined;
 exports.assertDescriptorConfined = assertDescriptorConfined;
 const node_path_1 = __importDefault(require("node:path"));
 /**
- * Pure path-containment check (cross-platform). `target` is confined to `root`
- * iff resolving it relative to `root` yields a path equal to or under `root`.
+ * Pure LEXICAL path-containment check (cross-platform). `target` is confined
+ * to `root` iff resolving it relative to `root` (via `path.resolve` — string
+ * manipulation, no filesystem access) yields a path equal to or under `root`.
  * Absolute paths outside `root` and `..`-escapes return false.
+ *
+ * NOT a realpath check: this function never calls `fs.realpathSync` and does
+ * not detect a symlink along `target` (or an existing path component of
+ * `root`) that would redirect the LEXICALLY-confined path to a physically
+ * different, unconfined location on disk. A caller relying on this for a
+ * write-confinement guarantee against a symlink-planting attacker must pair
+ * it with a symlink check (or refuse to follow symlinks at write time) — see
+ * capability-source.cts's install adapters (:491,577,675), which is what
+ * currently keeps every caller of this function's callers symlink-safe: they
+ * reject symlinks upstream, before a target ever reaches a lexical-only check
+ * like this one.
  */
 function isPathConfined(target, root) {
     if (typeof target !== 'string' || typeof root !== 'string' || target.length === 0 || root.length === 0) {