@opengsd/gsd-core 1.7.0 → 1.9.0

package/gsd-core/bin/lib/review-reviewer-selection.cjs

@@ -16,41 +16,108 @@
  * detected. The instance→cli mapping lives HERE (single source; see the parity
  * test in tests/review-reviewer-instances.test.cjs — DEFECT.GENERATIVE-FIX).
  *
- * KNOWN_REVIEWER_SLUGS (post-review #2092): registry-derived, not a flat
- * hand-maintained array. Each capability-runtime descriptor that is a valid
- * reviewer CLI declares `runtime.hostBehaviors.reviewerCli: true`
- * (capabilities/<id>/capability.json); this module reads that flag off the
- * generated capability-registry.cjs at require-time. A handful of reviewer
- * CLIs are NOT install-time runtimes at all (no capabilities/<id>/ descriptor
- * exists) — those stay a small hardcoded tail:
- *   - `gemini` — hook-event dialect name only (see runtime-hooks-surface.cts);
- *     the Gemini CLI reviewer is not an installable runtime (#1928 folded
- *     gemini into antigravity's descriptor).
- *   - `coderabbit` / `ollama` / `lm_studio` / `llama_cpp` — third-party
- *     review/model CLIs with no GSD install surface at all.
+ * KNOWN_REVIEWER_SLUGS (ADR-2782 D9, Phase 5a #2798): derived from declared
+ * `reviewer` bodies in the capability registry, not a hand-maintained tail.
+ * A capability of EITHER `role: "runtime"` (the six dual-purpose hosts —
+ * antigravity/claude/codex/cursor/opencode/qwen) or the lane-only
+ * `role: "reviewer"` (gemini/coderabbit/ollama/lm_studio/llama_cpp) may carry
+ * a `reviewer` body, and it is the body's `reviewer.slug` — NOT the capability
+ * id — that becomes the roster entry: the two differ for `lm-studio` (id) /
+ * `lm_studio` (slug) and `llama-cpp` (id) / `llama_cpp` (slug), ADR-2782's
+ * three-namespace trap (`id` must be kebab; `slug` keeps the shipped roster's
+ * snake form).
+ *
+ * `runtime.hostBehaviors.reviewerCli: true` survives as a DERIVED LEGACY ALIAS
+ * for one release (D9): a capability that only sets the flag (no `reviewer`
+ * body yet) still contributes its capability id as a slug, exactly as before
+ * this phase. Where a capability carries BOTH a declared body and the alias,
+ * the BODY WINS — that capability contributes only the body's slug, never
+ * both. Alias removal is a named later phase (#2801), not done here.
+ *
+ * Before this phase the five non-runtime reviewers (`gemini`, `coderabbit`,
+ * `ollama`, `lm_studio`, `llama_cpp`) had no `capabilities/<id>/` descriptor at
+ * all and were a hardcoded `NON_RUNTIME_REVIEWER_SLUGS` tail. Phase 5a gives
+ * each one a lane-only `role: "reviewer"` capability (ADR-2782 D3), so the
+ * tail is deleted outright. See
+ * `docs/adr/2782-reviewer-lane-capability-surface.md`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.INSTANCE_NAME_PATTERN = exports.KNOWN_REVIEWER_SLUGS = void 0;
+exports.deriveReviewerSlugs = deriveReviewerSlugs;
 exports.normalizeConfiguredDefaultReviewers = normalizeConfiguredDefaultReviewers;
 exports.normalizeReviewerInstances = normalizeReviewerInstances;
 exports.resolveReviewerSelection = resolveReviewerSelection;
-const NON_RUNTIME_REVIEWER_SLUGS = [
-    'gemini',
-    'coderabbit',
-    'ollama',
-    'lm_studio',
-    'llama_cpp',
-];
-function deriveRuntimeReviewerSlugs() {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const registry = require('./capability-registry.cjs');
-    const runtimes = registry.runtimes || {};
-    return Object.keys(runtimes).filter((id) => runtimes[id]?.runtime?.hostBehaviors?.reviewerCli === true);
+/**
+ * Derive the reviewer-slug roster from a capability registry.
+ *
+ * Exported (rather than a require()-time-only side effect) so tests can
+ * exercise the derivation directly against a synthetic registry — the real
+ * roster below is a single call against the generated
+ * `capability-registry.cjs`, and `tests/review-lane-descriptor.test.cjs`'s
+ * `checkReviewerLaneParity` separately guards that the real roster still
+ * agrees with `src/review-lane-descriptor.cts` and the workflow.
+ *
+ * Reads `registry.capabilities` — every declared capability regardless of
+ * role — because a `role: "reviewer"` lane-only capability is never stored in
+ * `registry.runtimes` (that map is role:"runtime" only). Per capability: a
+ * declared `reviewer.slug` wins outright (D9) and the capability contributes
+ * ONLY that slug; only when there is no body does the legacy
+ * `hostBehaviors.reviewerCli` alias contribute the capability id instead. The
+ * result is collected into a Set (so a slug can never appear twice, even if
+ * two distinct capabilities somehow named the same one) and returned as a
+ * SORTED array, so the roster's order never depends on `Object.entries()`
+ * iteration / registry build order.
+ */
+function deriveReviewerSlugs(registry) {
+    const capabilities = registry.capabilities || {};
+    const slugs = new Set();
+    for (const [capId, cap] of Object.entries(capabilities)) {
+        // Trim before the emptiness test: `length > 0` alone admits a whitespace-only
+        // slug ("   ") verbatim into the roster, where it can never match a real lane
+        // but still occupies a roster entry. Unreachable through the checked-in
+        // registry today, but this function is EXPORTED for reuse and carries no
+        // other validation, so it should not depend on its caller's hygiene.
+        const rawSlug = cap?.reviewer?.slug;
+        const declaredSlug = typeof rawSlug === 'string' ? rawSlug.trim() : '';
+        if (declaredSlug.length > 0) {
+            slugs.add(declaredSlug);
+            continue; // the body wins — never ALSO add this capability's alias below.
+        }
+        if (cap?.runtime?.hostBehaviors?.reviewerCli === true) {
+            slugs.add(capId);
+        }
+    }
+    return [...slugs].sort();
 }
-exports.KNOWN_REVIEWER_SLUGS = [
-    ...deriveRuntimeReviewerSlugs(),
-    ...NON_RUNTIME_REVIEWER_SLUGS,
-];
+/**
+ * The roster, derived once at module load.
+ *
+ * GUARDED, because this runs at `require()` time: an uncaught throw here does not
+ * degrade reviewer selection, it breaks `require()` of this module for EVERY
+ * consumer. The sibling `capability-trust.cjs` already holds this line — its
+ * `discloseExecutableSurfaces` is documented "TOTAL: never throws, for any
+ * manifest shape" and wrapped accordingly — and this module handles the same
+ * class of registry-derived input, so it should not be the asymmetric one.
+ *
+ * A malformed registry yields an EMPTY roster rather than a crash. That is a
+ * visible degradation, not a silent one: under ADR-2782 D4 an explicitly
+ * requested reviewer that is unavailable is an ERROR, so `/gsd:review --claude`
+ * against an empty roster fails loudly instead of quietly reviewing with nobody.
+ *
+ * Unreachable through the checked-in registry today (it is generated, JSON-sourced
+ * and code-reviewed, so it cannot carry a getter or a Proxy). Guarded anyway —
+ * reachability analysis is not a contract, and the next caller should not have to
+ * redo it.
+ */
+exports.KNOWN_REVIEWER_SLUGS = (() => {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        return deriveReviewerSlugs(require('./capability-registry.cjs'));
+    }
+    catch {
+        return [];
+    }
+})();
 /** Instance names are lowercase slugs that must not shadow a built-in slug. */
 exports.INSTANCE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 function normalizeConfiguredDefaultReviewers(rawValue) {
@@ -164,12 +231,27 @@ function resolveReviewerSelection(input) {
     let selected = [];
     if (explicitFlags.size > 0) {
         source = 'explicit_flags';
+        // ADR-2782 D4: absent-safe governs DISCOVERY, never explicit selection.
+        // Not finding a lane nobody asked for is normal; failing to run a lane
+        // somebody asked for is an error. Every miss used to be an `info`, so a
+        // PARTIAL miss (`--gemini --qwen` with qwen absent) ran the review with a
+        // thinner reviewer set while present_results reported success — "a cross-AI
+        // review that silently drops a lane is blind in one eye" (review.md).
+        // A total miss already errored, but only as a side effect of the selected
+        // set being empty; the partial case had no signal at all.
+        const priorErrorCount = errors.length;
         selected = [...explicitFlags].filter((slug) => detected.has(slug));
-        const missing = [...explicitFlags].filter((slug) => !detected.has(slug));
-        if (missing.length > 0) {
-            infos.push(`explicit reviewers missing on host: ${missing.join(', ')}`);
+        // Sorted so the error order does not depend on flag order on the command line.
+        const missing = [...explicitFlags].filter((slug) => !detected.has(slug)).sort();
+        for (const slug of missing) {
+            errors.push(`explicit reviewer '${slug}' is not available on this host`);
         }
-        if (selected.length === 0 && errors.length === 0) {
+        // Guarded on the error count as it stood BEFORE this branch, so the
+        // aggregate message fires under exactly the conditions it did previously.
+        // Guarding on `errors.length` would let the per-slug errors just pushed
+        // suppress it, silently dropping a message this change did not intend to
+        // remove.
+        if (selected.length === 0 && priorErrorCount === 0) {
             errors.push('no selected reviewers are available for explicit flags');
         }
     }

package/gsd-core/bin/lib/roadmap-parser.cjs

@@ -31,6 +31,9 @@ roadmapPhaseLookupSources, } = phaseIdModule;
 const planningWorkspace = require("./planning-workspace.cjs");
 const { planningDir } = planningWorkspace;
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const unusableInputMod = require("./unusable-input.cjs");
+const { UNUSABLE_REASON, warnUnusableInput } = unusableInputMod;
 const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 // ─── Roadmap milestone scoping ───────────────────────────────────────────────
 /**
@@ -271,10 +274,18 @@ function getRoadmapPhaseInternal(cwd, phaseNum) {
     const normalizedPhase = stripProjectCodePrefix(phaseNum);
     if (/^999(?:\.|$)/.test(normalizedPhase))
         return null;
-    const roadmapPath = node_path_1.default.join(planningDir(cwd), 'ROADMAP.md');
-    if (!node_fs_1.default.existsSync(roadmapPath))
-        return null;
+    // Resolved INSIDE the try for the same reason as getMilestoneInfo below: planningDir
+    // throws a plain Error for an invalid GSD_WORKSTREAM/GSD_PROJECT segment, and resolving
+    // it outside let that escape uncaught, crashing every caller for a malformed workstream
+    // name. ADR-227 is explicit that throwing breaks pipeline continuity, and this read path
+    // has no reason to be the exception -- it already degrades to null for every other
+    // failure. Absence still returns null before any diagnostic, and when the path never
+    // resolved there is nothing to name.
+    let roadmapPath;
     try {
+        roadmapPath = node_path_1.default.join(planningDir(cwd), 'ROADMAP.md');
+        if (!node_fs_1.default.existsSync(roadmapPath))
+            return null;
         const roadmapRaw = (0, shell_command_projection_cjs_1.platformReadSync)(roadmapPath);
         if (roadmapRaw === null)
             throw new Error('missing');
@@ -301,10 +312,33 @@ function getRoadmapPhaseInternal(cwd, phaseNum) {
         }
         return null;
     }
-    catch {
+    catch (err) {
+        // Absence already returned above via existsSync; anything caught here is a read fault
+        // or the synthetic missing-marker. The null is preserved exactly either way.
+        if (roadmapPath !== undefined)
+            reportUnreadableRoadmap(err, roadmapPath);
         return null;
     }
 }
+/**
+ * Report a ROADMAP.md that exists but could not be read (#1881, ADR-1411).
+ *
+ * The discriminator is the errno, and it matters in the SILENT direction.
+ * platformReadSync returns null for ENOENT and both callers convert that null into a
+ * synthetic Error carrying no code, which lands in the same catch as a real EACCES.
+ * Reporting unconditionally here would flag every project that has no ROADMAP.md yet --
+ * every brand-new project -- as corrupt. A genuine read fault always carries an errno;
+ * absence never does.
+ *
+ * The parse itself is regex over text and cannot throw, so anything reaching a catch is
+ * either a read fault or that synthetic absence marker. Nothing else gets here.
+ */
+function reportUnreadableRoadmap(err, roadmapPath) {
+    const code = err?.code;
+    if (typeof code !== 'string')
+        return;
+    warnUnusableInput({ reason: UNUSABLE_REASON.ROADMAP_UNREADABLE, source: roadmapPath });
+}
 /**
  * Strip a leading delimiter run (whitespace, em/en-dash, colon, hyphen) from a
  * milestone-name capture. Markdown headings commonly take the shape
@@ -318,8 +352,16 @@ function stripLeadingDelimiter(s) {
     return s.replace(/^[\s—–:-]+/, '').trim();
 }
 function getMilestoneInfo(cwd) {
+    // Declared here but RESOLVED INSIDE the try, so the catch can name the file without
+    // moving planningDir() out of the protected region. planningDir throws a plain Error
+    // for an invalid GSD_WORKSTREAM/GSD_PROJECT segment, and hoisting the call let that
+    // escape uncaught — breaking the invariant #2245 relies on, that this function never
+    // throws. When the path never resolved there is nothing to name, so the diagnostic is
+    // skipped and the default is returned exactly as before.
+    let roadmapPath;
     try {
-        const roadmap = (0, shell_command_projection_cjs_1.platformReadSync)(node_path_1.default.join(planningDir(cwd), 'ROADMAP.md'));
+        roadmapPath = node_path_1.default.join(planningDir(cwd), 'ROADMAP.md');
+        const roadmap = (0, shell_command_projection_cjs_1.platformReadSync)(roadmapPath);
         if (roadmap === null)
             throw new Error('missing');
         let stateVersion = null;
@@ -388,7 +430,13 @@ function getMilestoneInfo(cwd) {
             name: 'milestone',
         };
     }
-    catch {
+    catch (err) {
+        // This function has no existsSync guard, so an absent ROADMAP arrives here too, as a
+        // synthetic Error with no errno. Only a real read fault is reported; the populated
+        // default is returned unchanged either way, and a plausible-looking default needs the
+        // diagnostic more than an empty sentinel does, not less (ADR-1411).
+        if (roadmapPath !== undefined)
+            reportUnreadableRoadmap(err, roadmapPath);
         return { version: 'v1.0', name: 'milestone' };
     }
 }
@@ -511,12 +559,15 @@ function getMilestonePhaseFilter(cwd, versionOverride, phaseIdConvention) {
         return id.split('-').map(seg => seg.replace(/^0+(?=\d)/, '') || '0').join('-');
     }
     const roadmapUsesHyphenedIds = [...normalized].some(n => n.includes('-'));
-    // #2043: milestone-prefixed sub-phase components must be zero-padded (≥2 digits)
-    // — "-\d{2,}" instead of "-0*\d+" — so a single-digit slug word after the phase
+    // #2043: milestone-prefixed sub-phase components must be zero-padded — so a
+    // single-digit slug word after the phase
     // number (e.g. dir "46-6-rs-…") captures "46" and is not silently excluded from
-    // the milestone as a bogus "46-6" id.
+    // the milestone as a bogus "46-6" id. #2232: the continuation width is exactly 2
+    // (PHASE_CONTINUATION_SEGMENT_SOURCE), so a year-leading slug word (dir
+    // "14-2026-photos-…") captures "14" and is not excluded as a bogus "14-2026" id.
+    // Built via new RegExp (no /i — the [A-Za-z] letter class does real case handling).
     const numericRe = roadmapUsesHyphenedIds
-        ? /^0*(\d+(?:-\d{2,})*[A-Za-z]?(?:\.\d+)*)/
+        ? new RegExp(`^0*(\\d+(?:-${phaseIdModule.PHASE_CONTINUATION_SEGMENT_SOURCE})*[A-Za-z]?(?:\\.\\d+)*)`)
         // phase-id-owner: the [A-Za-z] letter class does real case handling here — this regex carries NO /i flag; kept literal, not source-byte-equal to the canonical PHASE_NUMBER_TOKEN_SOURCE.
         : /^0*(\d+[A-Za-z]?(?:\.\d+)*)/;
     function isDirInMilestone(dirName) {

package/gsd-core/bin/lib/roadmap.cjs

@@ -137,10 +137,16 @@ function searchPhaseInContent(content, escapedPhase, phaseNum) {
     // comparison; unrecognized values are preserved verbatim for forward-compat.
     const modeMatch = section.match(/\*\*Mode(?::\*\*|\*\*:)\s*([^\n]+)/i);
     const mode = modeMatch ? modeMatch[1].trim().toLowerCase() : null;
-    // Extract success criteria as structured array
-    const criteriaMatch = section.match(/\*\*Success Criteria\*\*[^\n]*:\s*\n((?:\s*\d+\.\s*[^\n]+\n?)+)/i);
+    // Extract success criteria as structured array. A criterion may wrap onto extra
+    // indented lines (no `N.` prefix); those continuations must fold INTO their
+    // criterion, not end the run (#2522 — the old `(?:\s*\d+\.\s*[^\n]+)+` broke on a
+    // wrapped line, truncating it and silently dropping every criterion below it).
+    // `\n*` before each numbered line keeps blank-line-separated criteria working.
+    const criteriaMatch = section.match(/\*\*Success Criteria\*\*[^\n]*:\s*\n((?:\n*[ \t]*\d+\.[^\n]*\n?(?:[ \t]+(?!\d+\.)[^\n]*\n?)*)+)/i);
     const success_criteria = criteriaMatch
-        ? criteriaMatch[1].trim().split('\n').map(line => line.replace(/^\s*\d+\.\s*/, '').trim()).filter(Boolean)
+        ? criteriaMatch[1].trim().split(/\n+(?=[ \t]*\d+\.)/)
+            .map(entry => entry.replace(/^\s*\d+\.\s*/, '').replace(/\s*\n\s*/g, ' ').trim())
+            .filter(Boolean)
         : [];
     return {
         found: true,
@@ -170,9 +176,19 @@ function getRoadmapPhaseWithFallback(cwd, phaseNum) {
     if (/^999(?:\.|$)/.test(stripProjectCodePrefix(phaseNum)))
         return null;
     const roadmapPath = planningPaths(cwd).roadmap;
-    if (!node_fs_1.default.existsSync(roadmapPath))
-        return null;
-    const rawContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
+    // Read directly rather than gating on fs.existsSync: existsSync returns false
+    // on EACCES/EIO too, which would mask an UNREADABLE roadmap as "missing" and
+    // let a blocking gate certify empty scope (#2365 review). Honor the documented
+    // contract — null only when genuinely absent (ENOENT), otherwise throw.
+    let rawContent;
+    try {
+        rawContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
+    }
+    catch (err) {
+        if (err?.code === 'ENOENT')
+            return null;
+        throw err;
+    }
     const milestoneContent = extractCurrentMilestone(rawContent, cwd);
     const fullContent = stripShippedMilestones(rawContent);
     // #2121/#2114: iterate the shared lookup-source list (exact → numeric →
@@ -648,7 +664,7 @@ function cmdRoadmapAnnotateDependencies(cwd, phaseNum, raw) {
         const planPath = node_path_1.default.join(node_path_1.default.resolve(cwd, phaseInfo.directory), planFile);
         try {
             const content = node_fs_1.default.readFileSync(planPath, 'utf-8');
-            const fm = extractFrontmatter(content);
+            const fm = extractFrontmatter(content, planPath);
             const wave = parseInt(fm.wave, 10) || 1;
             const planId = planFile.replace(/-PLAN\.md$/i, '').replace(/PLAN\.md$/i, '');
             const truths = parseMustHavesBlock(content, 'truths') || [];

package/gsd-core/bin/lib/runtime-artifact-conversion.cjs

@@ -518,6 +518,28 @@ function convertClaudeCommandToKimiSkill(content, skillName, _runtime = null, cm
     const normalizedBody = convertGsdCommandReferencesToKimiSkillInvocations(frontmatter ? body : content, names);
     return `---\nname: ${kimiSkillName}\ndescription: ${yamlQuote(toSingleLine(description))}\n---\nInvoke this Kimi skill with \`/skill:${kimiSkillName}\`.\n\n${normalizedBody}`;
 }
+/**
+ * Convert a Claude command-markdown source into a Kimi Code Agent Skill.
+ *
+ * Kimi Code (Moonshot's Node CLI) uses the standard Agent Skills format —
+ * a directory containing SKILL.md with frontmatter (name/description) and
+ * body — auto-discovered from `~/.kimi-code/skills/` (per Kimi Code docs:
+ * "Agent Skills is an open format for adding specialized knowledge and
+ * workflows to AI agents"). The invocation prefix is `/skill:<name>`,
+ * identical to Python kimi-cli.
+ *
+ * Today the output is byte-identical to `convertClaudeCommandToKimiSkill`
+ * (the Python kimi-cli converter) because both products consume the same
+ * Agent Skills format + `/skill:` invocation. The distinct function name
+ * lets a future divergence land cleanly if Kimi Code's skill format evolves
+ * independently of Python kimi-cli.
+ *
+ * Registered as `convertClaudeCommandToKimiCodeSkill` in the capabilities/
+ * kimi-code/capability.json `artifactLayout` `converter` field (#2454 PR 2).
+ */
+function convertClaudeCommandToKimiCodeSkill(content, skillName, _runtime = null, cmdNames = null) {
+    return convertClaudeCommandToKimiSkill(content, skillName, _runtime, cmdNames);
+}
 const KIMI_CANONICAL_GSD_AGENT_RE = /^gsd-[a-z0-9-]+$/;
 function parseKimiAgentSource(source) {
     if (typeof source === 'string') {
@@ -868,7 +890,13 @@ function convertClaudeCommandToCursorSkill(content, skillName) {
     description = toSingleLine(description);
     const shortDescription = description.length > 180 ? `${description.slice(0, 177)}...` : description;
     const adapter = getCursorSkillAdapterHeader(skillName);
-    return `---\nname: ${yamlIdentifier(skillName)}\ndescription: ${yamlQuote(shortDescription)}\n---\n\n${adapter}\n\n${body.trimStart()}`;
+    // #2341: mark user-invocable:false so the skill is NOT shown in Cursor's '/'
+    // menu (it defaults to true). Cursor also writes a commands/ surface (#785),
+    // and surfacing both duplicated every /gsd-* entry. This mirrors the #789
+    // CodeBuddy de-dup: the commands/ surface is the sole '/' entry point; skills
+    // stay model-invocable background knowledge. (user-invocable:false hides from
+    // '/' while keeping model invocation — distinct from disable-model-invocation.)
+    return `---\nname: ${yamlIdentifier(skillName)}\ndescription: ${yamlQuote(shortDescription)}\nuser-invocable: false\n---\n\n${adapter}\n\n${body.trimStart()}`;
 }
 /**
  * Convert a Claude Code command to a Cursor 1.6 slash command (#785).
@@ -1385,10 +1413,14 @@ Typed mapping (agent_type-capable schema only):
   inherited, or unsupported values; do not invent one-off effort literals in
   workflow prose.
 - \`fork_context: false\` by default — GSD agents load their own context via \`<files_to_read>\` blocks
-- \`Task(isolation="worktree")\` / \`Agent(isolation="worktree")\` → no direct Codex mapping.
-  Codex \`spawn_agent\` does not create or bind a git worktree automatically.
-  Workflows that require this isolation must fail closed or use an explicit
-  manual worktree protocol before spawning (#3360).
+- \`Task(isolation="worktree")\` / \`Agent(isolation="worktree")\` → no direct \`spawn_agent\` mapping,
+  but Codex declares \`dispatch.isolation: orchestrator-worktree\` (#2584). Codex
+  \`spawn_agent\` still does not create or bind a git worktree; instead GSD itself
+  creates the worktree and process-spawns the executor into it with
+  \`codex exec --cd <dir>\`, performing every git operation on the executor's behalf
+  (its \`workspace-write\` sandbox makes \`.git\` read-only). Workflows must therefore
+  never fabricate a manual worktree protocol — route through the negotiated
+  isolation adapter, which still fails closed for hosts declaring \`none\` (#3360).
 
 Generic-agent workaround (multi_agent_v1 schema — NO agent_type field):
 When only the generic \`multi_agent_v1\` schema is available, typed GSD agent dispatch
@@ -2597,6 +2629,7 @@ module.exports = {
     convertClaudeCommandToAntigravitySkill,
     convertClaudeCommandToClaudeSkill,
     convertClaudeCommandToKimiSkill,
+    convertClaudeCommandToKimiCodeSkill,
     buildKimiAgentArtifacts,
     convertClaudeToCursorMarkdown,
     convertClaudeCommandToCursorSkill,

package/gsd-core/bin/lib/runtime-artifact-layout.cjs

@@ -227,8 +227,12 @@ function kimiAgentsKind(destSubpath, prefix, configDir) {
  *                       arg so scope-aware converters (antigravity, copilot) can choose
  *                       between global home paths and workspace-relative paths without
  *                       colliding with the `runtime` string at position 3.
+ * @param capabilityRegistry #2322: optional capability registry — captured in the
+ *                       stage() closure so third-party capability skills are bound to
+ *                       their declaring capId at staging time. Absent -> stage() stages
+ *                       nothing third-party (fail closed).
  */
-function skillsKind(destSubpath, prefix, converterName, runtime, configDir, nested = false, scope = 'global') {
+function skillsKind(destSubpath, prefix, converterName, runtime, configDir, nested = false, scope = 'global', capabilityRegistry) {
     return {
         kind: 'skills',
         destSubpath,
@@ -247,7 +251,7 @@ function skillsKind(destSubpath, prefix, converterName, runtime, configDir, nest
                 : [];
             const isGlobal = scope === 'global';
             const wrappedConverter = (content, skillName) => realConverter(content, skillName, runtime, cmdNames, isGlobal);
-            return stageSkillsForRuntimeAsSkills(findInstallSourceRoot(configDir), resolved, wrappedConverter, prefix, nested);
+            return stageSkillsForRuntimeAsSkills(findInstallSourceRoot(configDir), resolved, wrappedConverter, prefix, nested, capabilityRegistry);
         },
     };
 }
@@ -285,7 +289,7 @@ function getRegistry() {
  * Map a single ArtifactKindDescriptor entry to an ArtifactKind using the
  * matching builder function. Mirrors the hand-built calls in the old switch.
  */
-function dispatchKindEntry(entry, runtime, configDir, scope) {
+function dispatchKindEntry(entry, runtime, configDir, scope, capabilityRegistry) {
     const { kind, destSubpath, prefix, nesting, converter } = entry;
     const nested = nesting === 'nested';
     let result;
@@ -304,7 +308,7 @@ function dispatchKindEntry(entry, runtime, configDir, scope) {
             if (converter == null) {
                 throw new TypeError(`resolveRuntimeArtifactLayout: skills entry for '${runtime}' has converter=null (converter is required for skills)`);
             }
-            result = skillsKind(destSubpath, prefix, converter, runtime, configDir, nested, scope);
+            result = skillsKind(destSubpath, prefix, converter, runtime, configDir, nested, scope, capabilityRegistry);
             break;
         case 'kimi-agents':
             result = kimiAgentsKind(destSubpath, prefix, configDir);
@@ -312,7 +316,7 @@ function dispatchKindEntry(entry, runtime, configDir, scope) {
         default:
             throw new TypeError(`resolveRuntimeArtifactLayout: unknown kind '${kind}' in descriptor for runtime '${runtime}'`);
     }
-    if (typeof entry.home === 'string' && entry.home !== '') {
+    if (scope === 'global' && typeof entry.home === 'string' && entry.home !== '') {
         result.home = node_path_1.default.join(node_os_1.default.homedir(), entry.home);
     }
     return result;
@@ -322,11 +326,21 @@ function dispatchKindEntry(entry, runtime, configDir, scope) {
  *
  * ADR-857 phase 5d: driven by the capability-registry artifactLayout descriptor
  * instead of a hardcoded switch statement.
+ *
+ * @param capabilityRegistry #2322: optional — when the caller has a composed
+ *   capability registry in scope (e.g. capability-writer.cts's `capability set`
+ *   path, or a fresh install's registry-aware profile resolution), pass it here
+ *   so the skills kind's stage() closure can materialize installed third-party
+ *   capability skills bound to their declaring capId. Both call paths (surface
+ *   apply AND the installer) must pass their registry here — resolveProfile's
+ *   own `'*'` (full profile) short-circuit never carries a registry, so if it
+ *   is not threaded in at layout-build time a `full`-profile install stages no
+ *   third-party capability skills regardless of registration (#2322 blocker 2).
  */
-function resolveRuntimeArtifactLayout(runtime, configDir, scope = 'global') {
-    return resolveRuntimeArtifactLayoutFromRegistry(getRegistry(), runtime, configDir, scope);
+function resolveRuntimeArtifactLayout(runtime, configDir, scope = 'global', capabilityRegistry) {
+    return resolveRuntimeArtifactLayoutFromRegistry(getRegistry(), runtime, configDir, scope, capabilityRegistry);
 }
-function resolveRuntimeArtifactLayoutFromRegistry(registry, runtime, configDir, scope = 'global') {
+function resolveRuntimeArtifactLayoutFromRegistry(registry, runtime, configDir, scope = 'global', capabilityRegistry) {
     if (typeof configDir !== 'string' || configDir === '') {
         throw new TypeError('configDir must be a non-empty string');
     }
@@ -338,7 +352,7 @@ function resolveRuntimeArtifactLayoutFromRegistry(registry, runtime, configDir,
         throw new TypeError(`Unknown runtime: '${runtime}' — add to runtime-artifact-layout.cjs table`);
     }
     const entries = desc[scope] ?? [];
-    const kinds = entries.map((entry) => dispatchKindEntry(entry, runtime, configDir, scope));
+    const kinds = entries.map((entry) => dispatchKindEntry(entry, runtime, configDir, scope, capabilityRegistry));
     return { runtime, configDir, scope, kinds };
 }
 module.exports = { resolveRuntimeArtifactLayout, resolveRuntimeArtifactLayoutFromRegistry, findInstallSourceRoot };