@opengsd/gsd-core 1.9.0 → 1.10.0

package/gsd-core/bin/lib/capability-validator.cjs

@@ -707,7 +707,6 @@ const VALID_CONVERTER_NAMES = new Set([
   'convertClaudeCommandToCodebuddySkill',
   'convertClaudeCommandToCodexSkill',
   'convertClaudeCommandToCopilotSkill',
-  'convertClaudeCommandToCursorCommand',
   'convertClaudeCommandToCursorSkill',
   'convertClaudeCommandToKiloSkill',
   'convertClaudeCommandToKimiSkill',
@@ -1075,7 +1074,18 @@ function validateArtifactLayout(capId, layout) {
       errors.push(ctx + '.' + scope + ' must be an array');
     } else {
       for (let i = 0; i < arr.length; i++) {
-        errors.push(...validateArtifactKindEntry(capId, arr[i], 'artifactLayout.' + scope + '[' + i + ']'));
+        const entry = arr[i];
+        errors.push(...validateArtifactKindEntry(capId, entry, 'artifactLayout.' + scope + '[' + i + ']'));
+        if (
+          scope === 'local' &&
+          typeof entry === 'object' && entry !== null && !Array.isArray(entry) &&
+          Object.prototype.hasOwnProperty.call(entry, 'home')
+        ) {
+          errors.push(
+            ctx + '.local[' + i + '].home is not allowed; ' +
+            'local artifact layout entries must remain project-scoped',
+          );
+        }
       }
     }
   }

package/gsd-core/bin/lib/check-command-router.cjs

@@ -22,7 +22,11 @@ const { planningDir } = planningWorkspaceMod;
 const phaseLocatorMod = require("./phase-locator.cjs");
 const { findPhaseInternal } = phaseLocatorMod;
 const decisions_cjs_1 = require("./decisions.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const frontmatterMod = require("./frontmatter.cjs");
+const { extractFrontmatter } = frontmatterMod;
 const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
+const security_cjs_1 = require("./security.cjs");
 const ui_safety_gate_cjs_1 = require("./ui-safety-gate.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const verifyModule = require("./verify.cjs");
@@ -849,9 +853,47 @@ function buildPredicateDeps() {
                 stdout: r.stdout,
                 stderr: r.stderr,
                 signal: r.signal,
-                timedOut: r.signal === 'SIGTERM',
+                timedOut: r.timedOut,
             };
         },
+        findPhaseArtifact(phaseDir, artifactSuffix) {
+            if (!node_fs_1.default.existsSync(phaseDir))
+                return null;
+            if (artifactSuffix === '.' ||
+                artifactSuffix === '..' ||
+                artifactSuffix.includes('\0') ||
+                node_path_1.default.basename(artifactSuffix) !== artifactSuffix ||
+                node_path_1.default.win32.basename(artifactSuffix) !== artifactSuffix) {
+                return null;
+            }
+            const directPath = (0, security_cjs_1.validatePath)(artifactSuffix, phaseDir);
+            if (directPath.safe && node_fs_1.default.existsSync(directPath.resolved) && node_fs_1.default.statSync(directPath.resolved).isFile()) {
+                return directPath.resolved;
+            }
+            const planningPath = (0, security_cjs_1.validatePath)(node_path_1.default.join('.planning', artifactSuffix), phaseDir);
+            if (planningPath.safe && node_fs_1.default.existsSync(planningPath.resolved) && node_fs_1.default.statSync(planningPath.resolved).isFile()) {
+                return planningPath.resolved;
+            }
+            try {
+                const files = node_fs_1.default.readdirSync(phaseDir);
+                for (const f of files) {
+                    if (f.endsWith('-' + artifactSuffix) || f === artifactSuffix) {
+                        const candidate = (0, security_cjs_1.validatePath)(f, phaseDir);
+                        if (candidate.safe && node_fs_1.default.statSync(candidate.resolved).isFile())
+                            return candidate.resolved;
+                    }
+                }
+            }
+            catch { /* ignore */ }
+            return null;
+        },
+        readFrontmatter(filePath) {
+            const content = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);
+            if (content === null)
+                throw new Error(`predicate artifact disappeared before it could be read: ${filePath}`);
+            const parsed = extractFrontmatter(content, filePath);
+            return parsed;
+        }
     };
 }
 /** Parse `--flag value` pairs from an args array into a map (last write wins). */

package/gsd-core/bin/lib/command-aliases.cjs

@@ -331,6 +331,30 @@ exports.INIT_COMMAND_ALIASES = [
         "subcommand": "phase-op",
         "mutation": false
     },
+    {
+        "canonical": "init.code-review",
+        "aliases": [
+            "init code-review"
+        ],
+        "subcommand": "code-review",
+        "mutation": false
+    },
+    {
+        "canonical": "init.review",
+        "aliases": [
+            "init review"
+        ],
+        "subcommand": "review",
+        "mutation": false
+    },
+    {
+        "canonical": "init.discuss-phase-assumptions",
+        "aliases": [
+            "init discuss-phase-assumptions"
+        ],
+        "subcommand": "discuss-phase-assumptions",
+        "mutation": false
+    },
     {
         "canonical": "init.todos",
         "aliases": [
@@ -371,6 +395,54 @@ exports.INIT_COMMAND_ALIASES = [
         "subcommand": "manager",
         "mutation": false
     },
+    {
+        "canonical": "init.complete-milestone",
+        "aliases": [
+            "init complete-milestone"
+        ],
+        "subcommand": "complete-milestone",
+        "mutation": false
+    },
+    {
+        "canonical": "init.autonomous",
+        "aliases": [
+            "init autonomous"
+        ],
+        "subcommand": "autonomous",
+        "mutation": false
+    },
+    {
+        "canonical": "init.docs-update",
+        "aliases": [
+            "init docs-update"
+        ],
+        "subcommand": "docs-update",
+        "mutation": false
+    },
+    {
+        "canonical": "init.update",
+        "aliases": [
+            "init update"
+        ],
+        "subcommand": "update",
+        "mutation": false
+    },
+    {
+        "canonical": "init.transition",
+        "aliases": [
+            "init transition"
+        ],
+        "subcommand": "transition",
+        "mutation": false
+    },
+    {
+        "canonical": "init.debug",
+        "aliases": [
+            "init debug"
+        ],
+        "subcommand": "debug",
+        "mutation": false
+    },
     {
         "canonical": "init.new-workspace",
         "aliases": [

package/gsd-core/bin/lib/commands.cjs

@@ -762,21 +762,28 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify) {
         if (branchName) {
             const currentBranch = (0, shell_command_projection_cjs_1.execGit)(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd });
             if (currentBranch.exitCode === 0 && currentBranch.stdout.trim() !== branchName) {
-                // #2539: the #1278 intent is to CREATE the phase/milestone branch
+                // #2539/#3079: the #1278 intent is to CREATE the phase/milestone branch
                 // before the FIRST commit on it — not to force-switch an already-
                 // checked-out working branch onto a DIFFERENT existing branch. The
-                // prior fallback to a bare `git checkout <branch>` silently switched
-                // the whole working tree onto an existing unrelated branch in the same
-                // call that then committed (the only trace was a reflog entry). So:
-                // create-if-absent only. If the resolved branch already exists and the
-                // tree is on some other branch, do NOT switch — but never silently: log
-                // the resolution so the operator sees that the phase branch was
-                // resolved and deliberately not switched to (#2539 AC2: an auto-
-                // checkout mid-commit must never happen silently).
-                const create = (0, shell_command_projection_cjs_1.execGit)(['checkout', '-b', branchName], { cwd });
-                if (create.exitCode !== 0) {
-                    // `git checkout -b` fails (non-zero) when the branch already exists.
-                    // The operator is on the branch they intend to be on; commit there.
+                // prior `git checkout -b` both created AND switched (silently moving
+                // HEAD), which resurrected merged-and-deleted phase branches (#3079).
+                // Now: create-if-absent WITHOUT switching, using `git branch` instead
+                // of `git checkout -b`. The commit always lands on the current branch.
+                // If the resolved branch already exists, log the resolution so the
+                // operator sees that the phase branch was resolved and deliberately
+                // not switched to (#2539 AC2: an auto-checkout mid-commit must never
+                // happen silently).
+                const verify = (0, shell_command_projection_cjs_1.execGit)(['rev-parse', '--verify', `refs/heads/${branchName}`], { cwd });
+                if (verify.exitCode !== 0) {
+                    // Branch does not exist — create it WITHOUT switching.
+                    const create = (0, shell_command_projection_cjs_1.execGit)(['branch', branchName], { cwd });
+                    if (create.exitCode !== 0) {
+                        process.stderr.write(`Warning: could not create ${branchingStrategy} branch "${branchName}" ` +
+                            `(${create.stderr.trim()}); committing on the current branch "${currentBranch.stdout.trim()}".\n`);
+                    }
+                }
+                else {
+                    // Branch already exists — do NOT switch, commit on current branch.
                     process.stderr.write(`Warning: resolved ${branchingStrategy} branch "${branchName}" already exists; ` +
                         `committing on the current branch "${currentBranch.stdout.trim()}" instead of switching.\n`);
                 }
@@ -817,11 +824,10 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify) {
             // exit is a real I/O failure, not a missing file.
             const rmResult = (0, shell_command_projection_cjs_1.execGit)(['rm', '--cached', '--ignore-unmatch', file], { cwd });
             if (rmResult.exitCode !== 0) {
-                const rmErr = rmResult.error;
                 stagingFailures.push({
                     file,
                     error: rmResult.stderr || rmResult.stdout,
-                    timed_out: rmResult.signal === 'SIGTERM' && rmErr?.code === 'ETIMEDOUT',
+                    timed_out: (0, shell_command_projection_cjs_1.isSpawnTimeout)(rmResult),
                 });
             }
         }
@@ -834,17 +840,13 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify) {
                 stagedPaths.push(file);
             }
             else {
-                // `SpawnResultOutput.error` is typed `Error | null`; widen to the errno
-                // shape by ANNOTATION rather than assertion — `Error` is assignable to
-                // `NodeJS.ErrnoException` (its extra fields are optional), so an `as`
-                // cast here trips no-unnecessary-type-assertion.
-                const addErr = addResult.error;
                 stagingFailures.push({
                     file,
                     error: addResult.stderr || addResult.stdout,
-                    // The projection exposes a timeout distinctly (#2608 AC5); this is the
-                    // same SIGTERM+ETIMEDOUT idiom worktree-safety.cts uses.
-                    timed_out: addResult.signal === 'SIGTERM' && addErr?.code === 'ETIMEDOUT',
+                    // The projection exposes a timeout distinctly (#2608 AC5); this uses
+                    // the shared isSpawnTimeout predicate (shell-command-projection.cts)
+                    // also used by worktree-safety.cts and worktree-base-ref.cts (#3050).
+                    timed_out: (0, shell_command_projection_cjs_1.isSpawnTimeout)(addResult),
                 });
             }
         }
@@ -1015,11 +1017,10 @@ function cmdCommitToSubrepo(cwd, message, files, raw) {
                 stagedRelPaths.push(relativePath);
             }
             else {
-                const addErr = addResult.error;
                 subStagingFailures.push({
                     file,
                     error: addResult.stderr || addResult.stdout,
-                    timed_out: addResult.signal === 'SIGTERM' && addErr?.code === 'ETIMEDOUT',
+                    timed_out: (0, shell_command_projection_cjs_1.isSpawnTimeout)(addResult),
                 });
             }
         }

package/gsd-core/bin/lib/commonjs-marker.cjs

@@ -0,0 +1,136 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMMONJS_MARKER_CONTENT = exports.COMMONJS_MARKER = void 0;
+exports.markerPathFor = markerPathFor;
+exports.classifyMarker = classifyMarker;
+exports.ensureCommonJsMarker = ensureCommonJsMarker;
+exports.removeCommonJsMarker = removeCommonJsMarker;
+/**
+ * CommonJS module-type marker — single source of truth (#2544).
+ *
+ * GSD stages its own hook scripts and native plugin adapters as `.js` files.
+ * Node resolves a `.js` file's module type by walking up for the nearest
+ * `package.json`, so an ambient `"type": "module"` above the install location
+ * makes every one of those scripts fail with `require is not defined`. GSD
+ * pins them to CommonJS by writing a minimal `{"type":"commonjs"}` marker.
+ *
+ * Two rules govern that marker, and this module exists so both are enforced in
+ * exactly one place:
+ *
+ * 1. **Write only where GSD owns the contents.** The marker belongs in the
+ *    directories GSD fills with its own `.js` files (`hooks/`, and the
+ *    `nativePlugin.dir` for the runtimes that declare one) — never at the
+ *    runtime's shared config root, which on OpenCode and Kilo is documented,
+ *    user-writable territory for declaring local-plugin npm dependencies.
+ *
+ * 2. **Never overwrite a file GSD did not write.** Before #2544 the install
+ *    path wrote the marker unconditionally while the uninstall path already
+ *    compared content before unlinking. That asymmetry is the defect: the
+ *    discipline existed in the codebase, it was simply not applied on the
+ *    write side. `classifyMarker` is now the shared predicate behind both
+ *    `ensureCommonJsMarker` and `removeCommonJsMarker`, so install and
+ *    uninstall cannot drift apart again.
+ *
+ * Ownership is decided by exact content match against the marker GSD itself
+ * writes — the same test the uninstall path has always used.
+ */
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/** The exact marker content GSD writes (and the only content it will remove). */
+exports.COMMONJS_MARKER = '{"type":"commonjs"}';
+/** File bytes written to disk — the marker plus a trailing newline. */
+exports.COMMONJS_MARKER_CONTENT = `${exports.COMMONJS_MARKER}\n`;
+/** The marker path for a directory. */
+function markerPathFor(dir) {
+    return node_path_1.default.join(dir, 'package.json');
+}
+/**
+ * Classify the package.json in `dir` by ownership.
+ *
+ * Fails CLOSED: a file that exists but cannot be read is reported `foreign`,
+ * never `absent`. Reporting it absent would license the overwrite this module
+ * exists to prevent. (Same posture as the unreadable-config branch in
+ * capability-command-router.cjs: present-but-unreadable never downgrades to
+ * the permissive answer.)
+ */
+function classifyMarker(dir) {
+    const markerPath = markerPathFor(dir);
+    let stat;
+    try {
+        // lstat, not existsSync: existsSync follows symlinks and reports `false`
+        // for a DANGLING one, which would classify the path `absent` and let the
+        // write below follow the link and land outside the directory GSD owns.
+        stat = node_fs_1.default.lstatSync(markerPath);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return 'absent';
+        return 'foreign';
+    }
+    // Anything that is not a regular file (symlink, directory, socket) is not
+    // something GSD wrote, so it is never ours to overwrite or remove.
+    if (!stat.isFile())
+        return 'foreign';
+    try {
+        const content = node_fs_1.default.readFileSync(markerPath, 'utf8');
+        return content.trim() === exports.COMMONJS_MARKER ? 'gsd-owned' : 'foreign';
+    }
+    catch {
+        return 'foreign';
+    }
+}
+/**
+ * Write the CommonJS marker into `dir`, unless a file GSD does not own is
+ * already there.
+ *
+ * Creates `dir` when needed. Returns what happened so the caller can report
+ * it; a `preserved-foreign` result is not an error — it is the guard working.
+ *
+ * NEVER THROWS. Every other marker interaction in this module is best-effort —
+ * `removeCommonJsMarker` swallows unlink failures, `classifyMarker` swallows
+ * read failures — and the write path is the one most likely to fail on a
+ * locked-down config dir (`EACCES` on a read-only `hooks/`, `EROFS`, `ENOSPC`).
+ * Letting it throw made an unwritable marker abort the entire install with a
+ * raw stack trace, which is a strictly worse outcome than hooks that resolve as
+ * ESM: the caller can warn and continue, and does. Both the `mkdir` and the
+ * write are inside the guard — creating the directory is the same environmental
+ * hazard as writing into it.
+ */
+function ensureCommonJsMarker(dir) {
+    const ownership = classifyMarker(dir);
+    if (ownership === 'foreign')
+        return 'preserved-foreign';
+    if (ownership === 'gsd-owned')
+        return 'unchanged';
+    try {
+        node_fs_1.default.mkdirSync(dir, { recursive: true });
+        // Exclusive create closes the gap between classifying and writing: if
+        // anything at all appeared at the path in between — including a symlink —
+        // this fails with EEXIST instead of following or overwriting it.
+        node_fs_1.default.writeFileSync(markerPathFor(dir), exports.COMMONJS_MARKER_CONTENT, { flag: 'wx' });
+        return 'written';
+    }
+    catch (err) {
+        if (err.code === 'EEXIST')
+            return 'preserved-foreign';
+        return 'failed';
+    }
+}
+/**
+ * Remove the CommonJS marker from `dir` — only when the content is exactly
+ * the marker GSD writes. Returns true when a file was removed.
+ */
+function removeCommonJsMarker(dir) {
+    if (classifyMarker(dir) !== 'gsd-owned')
+        return false;
+    try {
+        node_fs_1.default.unlinkSync(markerPathFor(dir));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/gsd-core/bin/lib/config-loader.cjs

@@ -755,6 +755,7 @@ function loadConfigResolved(cwd, options = {}) {
             response_language: get('response_language') || null,
             claude_md_path: get('claude_md_path') || null,
             claude_md_assembly: (parsed['claude_md_assembly']) || null,
+            phase_id_convention: get('phase_id_convention') ?? null,
         };
         // ADR-857 phase 3b: federated config overlay
         try {

package/gsd-core/bin/lib/config.cjs

@@ -65,6 +65,8 @@ const SCHEMA_DEFAULTS = {
     'context_window': 200000,
     'executor.stall_detect_interval_minutes': 5,
     'executor.stall_threshold_minutes': 10,
+    'planner.stall_detect_interval_minutes': 5,
+    'planner.stall_threshold_minutes': 10,
     'git.create_tag': true,
     // Derived from the defaults manifest rather than restated, so the manifest
     // stays the single source of truth for the smart-zone budget (#2630).
@@ -289,10 +291,19 @@ function buildNewProjectConfig(userChoices) {
     const ud = userDefaults;
     const ch = choices;
     const hd = hardcoded;
+    // #2840: `runtime` is host-specific (written by the installer for whichever
+    // runtime's install ran last). On a machine with 2+ runtimes, it poisons every
+    // new project config — e.g. a Codex install's `runtime:"codex"` leaks into
+    // Claude Code projects, resolving agents to wrong model IDs. `resolve_model_ids`
+    // already has a per-install guard (#2297); `runtime` gets the same treatment
+    // by excluding it from the defaults spread. Projects detect the runtime from
+    // the install path / .gsd-runtime marker, not from a copied config key.
+    const safeDefaults = { ...userDefaults };
+    delete safeDefaults['runtime'];
     // Three-level deep merge: hardcoded <- userDefaults <- choices
     const config = {
         ...hardcoded,
-        ...userDefaults,
+        ...safeDefaults,
         ...choices,
         git: {
             ...hd['git'],