@opengsd/gsd-core 1.7.0 → 1.9.0

package/gsd-core/bin/lib/capability-consent.cjs

@@ -399,6 +399,10 @@ function isValidConsentRecord(rec) {
         return false;
     if (typeof r['consentedAt'] !== 'string' || !r['consentedAt'])
         return false;
+    // Optional (see ConsentRecord.reviewerHost): absent is valid and is the common case. Present but
+    // non-string is a corrupt record — reject rather than silently comparing against a non-host.
+    if (r['reviewerHost'] !== undefined && typeof r['reviewerHost'] !== 'string')
+        return false;
     return true;
 }
 /**
@@ -645,7 +649,7 @@ function writeConsentStore(gsdHome, store) {
  * written. (The OLD code returned a null handle and proceeded unlocked — that is the bug.)
  */
 function recordProjectConsent(args) {
-    const { gsdHome, projectRoot, id, integrity, disclosureSignature, contentHash } = args;
+    const { gsdHome, projectRoot, id, integrity, disclosureSignature, contentHash, reviewerHost } = args;
     if (isUnsafeCapabilityId(id)) {
         throw new Error(`Invalid capability id "${String(id)}": must match /^[a-z][a-z0-9-]*$/ (kebab-case, lowercase). ` +
             `Unsafe or non-kebab ids are rejected to keep the consent store prototype-pollution-safe.`);
@@ -685,6 +689,9 @@ function recordProjectConsent(args) {
             disclosureSignature,
             contentHash,
             consentedAt: new Date().toISOString(),
+            // Written only when the capability actually declares an egress destination, so a spawn lane
+            // or a non-lane capability keeps a byte-identical record shape.
+            ...(typeof reviewerHost === 'string' && reviewerHost ? { reviewerHost } : {}),
         };
         writeConsentStore(gsdHome, store);
     }
@@ -730,6 +737,37 @@ function revokeProjectConsent(args) {
         releaseConsentLock(lock);
     }
 }
+/**
+ * The egress destination a capability's consent was granted against, or `undefined`.
+ *
+ * ADR-2782 D5 rule 4 (#2799) — read on the INVOCATION path, not only at install, because
+ * `hostConfigKey` names a key in `.planning/config.json`: the one consent-bound value that lives
+ * outside the SHA-pinned bundle and can be changed by an ordinary pull request with no re-install
+ * and no integrity check.
+ *
+ * `undefined` means "nothing to compare", and the caller MUST treat that as allow, not deny. Two
+ * legitimate ways to get it: the capability has no consent record at all (first-party lanes ship
+ * inside the SHA-pinned distribution and are never consent-gated), or the record predates this
+ * field. Denying on absence would break every existing local-model user on upgrade.
+ *
+ * Non-throwing: a missing, corrupt, or oversized store yields `undefined` like any other absence.
+ */
+function readConsentedReviewerHost(args) {
+    const { gsdHome, projectRoot, id } = args;
+    if (isUnsafeCapabilityId(id))
+        return undefined;
+    try {
+        const store = readConsentStore(gsdHome);
+        const key = consentKey(realpathProject(projectRoot), id);
+        if (!Object.prototype.hasOwnProperty.call(store.records, key))
+            return undefined;
+        const host = store.records[key].reviewerHost;
+        return typeof host === 'string' && host ? host : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * #1459 finding 2 (round 6): TEST-ONLY — override the cumulative bundle entry-count cap and return a
  * restore() that resets it to the production default. Lets a test prove the streaming walk fails closed
@@ -744,6 +782,7 @@ module.exports = {
     consentStorePath,
     bundleContentHash,
     readConsentStore,
+    readConsentedReviewerHost,
     hasProjectConsent,
     recordProjectConsent,
     revokeProjectConsent,

package/gsd-core/bin/lib/capability-lifecycle.cjs

@@ -672,6 +672,59 @@ function warnIfConsentSkipped(opts, id) {
  * Best-effort: a consent-store write failure must not turn a successful install/upgrade into a
  * failure (the bundle is already committed) — it is surfaced as a warning, not a throw.
  */
+/**
+ * Resolve an `openai-http` reviewer lane's declared `hostConfigKey` to the destination it currently
+ * names, or `undefined` when this capability is not such a lane.
+ *
+ * Falls back to the lane's declared `defaultHost` when the key is unset, because that is exactly
+ * what the invocation path will do — binding the config value while the runtime uses the default
+ * would guarantee a mismatch on the very first review.
+ *
+ * Non-throwing: consent binding is best-effort and must never turn a successful install into a
+ * failure. An unresolvable host simply records nothing, which reads as "not bound" and allows.
+ */
+function resolveReviewerEgressHost(opts, manifest) {
+    try {
+        const reviewer = manifest['reviewer'];
+        if (reviewer === null || typeof reviewer !== 'object' || Array.isArray(reviewer))
+            return undefined;
+        const r = reviewer;
+        if (r['transport'] !== 'openai-http')
+            return undefined;
+        const invoke = r['invoke'];
+        if (invoke === null || typeof invoke !== 'object')
+            return undefined;
+        const inv = invoke;
+        const key = typeof inv['hostConfigKey'] === 'string' ? inv['hostConfigKey'] : '';
+        const fallback = typeof inv['defaultHost'] === 'string' ? inv['defaultHost'] : '';
+        let configured = '';
+        if (key) {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const cfgLoader = require('./config-loader.cjs');
+            const root = projectRootMod.consentProjectRoot(opts.runtimeDir);
+            const cfg = cfgLoader.loadConfigResolved ? (cfgLoader.loadConfigResolved(root).config ?? {}) : {};
+            let cur = cfg;
+            for (const part of key.split('.')) {
+                if (cur === null || typeof cur !== 'object') {
+                    cur = undefined;
+                    break;
+                }
+                cur = Object.prototype.hasOwnProperty.call(cur, part)
+                    ? cur[part]
+                    : undefined;
+            }
+            if (typeof cur === 'string')
+                configured = cur.trim();
+        }
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { normalizeHost } = require('./review-lane-invocation.cjs');
+        const resolved = normalizeHost(configured || fallback);
+        return resolved || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function bindProjectConsent(opts, id, integrity, manifest) {
     // #1459 IC-07: a project-scope op WITHOUT a consent store cannot bind — warn (then nothing to do).
     if (!shouldBindConsent(opts)) {
@@ -689,6 +742,11 @@ function bindProjectConsent(opts, id, integrity, manifest) {
             integrity,
             disclosureSignature: trustMod.signatureForManifest(manifest),
             contentHash: consentMod.bundleContentHash(capDir(opts.runtimeDir, id)),
+            // ADR-2782 D5 rule 1 (#2799): bind the RESOLVED egress destination, not merely the config key
+            // that names it. The key lives in `.planning/config.json`, outside the SHA-pinned bundle, so
+            // without this the user consents to "wherever that key points" — a promise the bundle hash
+            // cannot keep. Phase 5b re-resolves and compares at invocation (rule 4).
+            reviewerHost: resolveReviewerEgressHost(opts, manifest),
         });
     }
     catch (err) {

package/gsd-core/bin/lib/capability-loader.cjs

@@ -426,6 +426,8 @@ function loadRegistry(options = {}) {
     // consent the CLI records is the consent the loader checks. The consent store NEVER lives in a repo.
     const gsdHome = options.gsdHome || process.env['GSD_HOME'] || os.homedir();
     const warnings = [];
+    // ADR-2782 D4.3 — non-fatal notices for capabilities that are ACCEPTED (see OverlayMeta).
+    const diagnostics = [];
     const incompatibleGateCapIds = [];
     const blockedGates = [];
     const commandRoots = {};
@@ -719,6 +721,26 @@ function loadRegistry(options = {}) {
                     }
                 }
                 // Accepted.
+                //
+                // ADR-2782 D4.3: an unknown field inside a `reviewer` body is IGNORED WITH A
+                // WARNING rather than failing validation, so a lane built for a newer GSD
+                // degrades to accepted-but-partially-understood instead of being rejected.
+                // That case validates cleanly, so without this call it would surface
+                // nowhere at runtime — the build-time generator only ever sees first-party
+                // in-repo manifests, never an installed third-party overlay. Guarded on
+                // presence so an older built validator without the function still loads,
+                // and wrapped because the never-crash contract (ADR-1244 D2) outranks a
+                // diagnostic: a throwing collector must not cost the user a working lane.
+                if (typeof validator.collectReviewerWarnings === 'function') {
+                    try {
+                        for (const w of validator.collectReviewerWarnings(cap) || []) {
+                            diagnostics.push(`${root.scope}:${id}: ${w}`);
+                        }
+                    }
+                    catch {
+                        // A diagnostic that cannot be produced is not worth failing an install over.
+                    }
+                }
                 overlayCaps.push(cap);
                 acceptedIds.add(id);
                 for (const s of skills)
@@ -752,7 +774,7 @@ function loadRegistry(options = {}) {
             }
         }
     }
-    const meta = { warnings, incompatibleGateCapIds, blockedGates, commandRoots };
+    const meta = { warnings, diagnostics, incompatibleGateCapIds, blockedGates, commandRoots };
     if (overlayCaps.length === 0) {
         // Nothing to compose. Return the frozen registry unchanged when there is
         // also nothing to report (identity-stable); otherwise attach diagnostics.