@opengsd/gsd-core 1.9.0 → 1.9.1

package/gsd-core/bin/lib/project-root.cjs

@@ -63,6 +63,33 @@ function findProjectRoot(startDir) {
         }
         return false;
     }
+    // #2843: nearest ancestor (including `from` itself) that contains a `.git`,
+    // bounded by `upTo` (exclusive). Returns the git-repo root, or null if none
+    // exists before `upTo` / the filesystem root. Used to detect a NESTED child
+    // repo whose root is strictly below a candidate ancestor `.planning/` — in
+    // that case the caller's repo boundary sits between start and the ancestor,
+    // so trusting the ancestor's `.planning/` would silently cross into a
+    // different project. (No `git` subprocess — fs walk only, matching
+    // isInsideGitRepo's deliberate no-spawn contract.)
+    function nearestGitRoot(from, upTo) {
+        let d = from;
+        while (d !== fsRoot) {
+            if (d === upTo)
+                break;
+            try {
+                if (node_fs_1.default.existsSync(d + node_path_1.default.sep + '.git'))
+                    return d;
+            }
+            catch {
+                // ignore
+            }
+            const next = node_path_1.default.dirname(d);
+            if (next === d)
+                break;
+            d = next;
+        }
+        return null;
+    }
     let dir = resolvedStart;
     let depth = 0;
     while (dir !== fsRoot && depth < FIND_PROJECT_ROOT_MAX_DEPTH) {
@@ -114,6 +141,18 @@ function findProjectRoot(startDir) {
             // claims our startDir — explicit sub_repos config takes precedence over the
             // implicit .git signal. (#1422)
             if (isInsideGitRepo(parent)) {
+                // #2843: do NOT cross a git-repo boundary. If the caller is inside its
+                // OWN nested repo whose root is strictly below `parent`, trusting
+                // `parent`'s .planning/ would silently resolve to a DIFFERENT project.
+                // isInsideGitRepo only proved SOME .git exists between start and parent;
+                // verify that .git is parent's own (or absent between), not a nested
+                // child repo. If nearestGitRoot finds a .git strictly below parent,
+                // the boundary is crossed — fall through (do not return parent).
+                if (nearestGitRoot(resolvedStart, parent) !== null) {
+                    dir = parent;
+                    depth += 1;
+                    continue;
+                }
                 // Lookahead: walk ancestors above `parent` to find a sub_repos claim.
                 let ancestor = node_path_1.default.dirname(parent);
                 let ancestorDepth = 0;
@@ -169,6 +208,15 @@ function findProjectRoot(startDir) {
         try {
             const candidatePlanning = parent2 + node_path_1.default.sep + '.planning';
             if (node_fs_1.default.existsSync(candidatePlanning) && node_fs_1.default.statSync(candidatePlanning).isDirectory()) {
+                // #2843: do not cross a git-repo boundary. If the caller is inside its
+                // own nested repo (a .git strictly below parent2), parent2's .planning/
+                // belongs to a DIFFERENT project — keep walking is wrong; stop and fall
+                // through to the startDir fallback instead of silently resolving to the
+                // ancestor project. (Reached only when no .git exists anywhere in the
+                // chain per the triage, but guard defensively.)
+                if (nearestGitRoot(resolvedStart, parent2) !== null) {
+                    break;
+                }
                 return parent2;
             }
         }

package/gsd-core/bin/lib/verify.cjs

@@ -161,6 +161,15 @@ function verifySummaryCore(cwd, summaryPath, checkFileCount, opts) {
     // is still not read. Recovering it needs a real frontmatter parse, which is
     // deliberately left as a follow-up rather than smuggled in here.
     const mentionedFiles = new Set();
+    // #2844: Pattern 1 matches any backticked path-like token. A SUMMARY body is
+    // predominantly about what the phase DID, so a backticked path in prose ("Built
+    // `src/kept.ts`", a `- \`src/x.ts\`` list item) is a legitimate claim (#2685
+    // pins this). The false-positive class #2844 fixes is a path mentioned as a
+    // FUTURE/CONDITIONAL deliverable — "next phase will add `shared/types.ts`",
+    // "planned", "would", "to be created" — which is NOT a claim about this phase.
+    // Exclude those lines rather than requiring an explicit claim verb (which would
+    // drop the legitimate "Built …" / list-item forms #2685 protects).
+    const isFutureMention = (line) => /\b(?:will(?:\s+(?:add|create|build|land))?(?:[^.])?|(?:next|later|future)\s+phase|planned?|would\s+(?:be|add|create|build)|to\s+be\s+(?:added|created|built)|eventually|not\s+yet)\b/i.test(line);
     const patterns = [
         /`([^`]+\.[a-zA-Z]+)`/g,
         /(?:Created|Modified|Added|Updated|Edited):\s*`?([^\s`[\]]+\.[a-zA-Z]+)`?/gi,
@@ -169,9 +178,16 @@ function verifySummaryCore(cwd, summaryPath, checkFileCount, opts) {
         let m;
         while ((m = pattern.exec(content)) !== null) {
             const filePath = m[1];
-            if (filePath && isProbableProjectFile(filePath)) {
-                mentionedFiles.add(filePath);
-            }
+            if (!filePath || !isProbableProjectFile(filePath))
+                continue;
+            // #2844: skip a backticked path on a future/conditional line — it names a
+            // deliverable this phase did NOT produce, so probing it is a false positive.
+            const lineStart = content.lastIndexOf('\n', m.index) + 1;
+            const lineEnd = content.indexOf('\n', m.index);
+            const line = content.slice(lineStart, lineEnd === -1 ? undefined : lineEnd);
+            if (isFutureMention(line))
+                continue;
+            mentionedFiles.add(filePath);
         }
     }
     const filesToCheck = Array.from(mentionedFiles).slice(0, checkCount);

package/gsd-core/workflows/code-review.md

@@ -464,7 +464,22 @@ FALLOW_OK=$(FALLOW_TMP=\"${FALLOW_JSON_PATH}.tmp\" node -e \"
 if [ \"$FALLOW_OK\" != \"1\" ]; then
   FALLOW_STDERR_SUMMARY=$(head -5 \"$FALLOW_STDERR_TMP\")
   rm -f \"${FALLOW_JSON_PATH}.tmp\" \"$FALLOW_STDERR_TMP\"
-  echo \"WARNING: fallow structural pre-pass failed (exit ${FALLOW_EXIT}): ${FALLOW_STDERR_SUMMARY}\"
+  # #2667: distinguish a hard EXECUTION failure (the binary was found at step 1
+  # but would not run) from the binary-missing path (step 2). Exit 124 = timeout,
+  # 2 = usage error, 125 = spawn failure (e.g. Windows EINVAL on a .cmd shim —
+  # CVE-2024-27980, now mediated by run-with-timeout), 126/127 = not executable /
+  # not found. A non-zero exit here with a resolved binary means fallow is
+  # installed but did not produce a report — surface that loudly so a Windows
+  # user does not mistake it for "fallow absent".
+  case \"$FALLOW_EXIT\" in
+    124) FALLOW_FAIL_KIND=\"timed out\" ;;
+    2)   FALLOW_FAIL_KIND=\"usage error\" ;;
+    125) FALLOW_FAIL_KIND=\"spawn failure (the binary was found but did not start — e.g. a Windows .cmd shim; run-with-timeout mediates this)\" ;;
+    126) FALLOW_FAIL_KIND=\"not executable\" ;;
+    127) FALLOW_FAIL_KIND=\"not found\" ;;
+    *)   FALLOW_FAIL_KIND=\"crashed\" ;;
+  esac
+  echo \"WARNING: fallow structural pre-pass failed (${FALLOW_FAIL_KIND}, exit ${FALLOW_EXIT}): ${FALLOW_STDERR_SUMMARY}\"
   FALLOW_JSON_PATH=\"\"
 else
   mv \"${FALLOW_JSON_PATH}.tmp\" \"$FALLOW_JSON_PATH\"
@@ -472,7 +487,7 @@ else
 fi
 ```
 
-On any failure of the structural pre-pass (binary missing, timeout, empty output, or unparseable JSON), the workflow continues with no `<structural_findings>` injection; the reviewer agent receives a normal review request.
+On any failure of the structural pre-pass (binary missing at step 2, or an execution failure here — timeout, spawn failure, crash, empty output, or unparseable JSON), the workflow continues with no `<structural_findings>` injection; the reviewer agent receives a normal review request. The WARNING above names the failure KIND so a hard execution failure (e.g. a Windows `.cmd` spawn failure) is not mistaken for an absent optional dependency.
 
 4) Optional MCP bridge path (runtime-dependent):
 - If `FALLOW_MCP=true`, set reviewer input mode to MCP-backed structural findings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-core",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "main": ".opencode/plugins/gsd-core.js",
   "bin": {

package/scripts/gen-registry.cjs

@@ -2,10 +2,14 @@
 'use strict';
 
 /**
- * scripts/gen-registry.cjs — generates docs/registries/capability-registry.md
- * (and, once PR2 ships docs/registries/eos.json, docs/registries/eos-registry.md)
- * from the corresponding source JSON, via registry-schema.cjs#renderMarkdown.
- * Issue #2182.
+ * scripts/gen-registry.cjs — generates docs/registries/capability-registry.md,
+ * docs/registries/eos-registry.md, and docs/registries/reviewer-registry.md
+ * from their corresponding source JSON, via registry-schema.cjs#renderMarkdown.
+ * Issue #2182 (capability/eos); issue #2904 (reviewer).
+ *
+ * eos.json and reviewers.json are both OPTIONAL sources (`SOURCES[].optional`)
+ * — an absent one is skipped silently. capabilities.json is the primary
+ * source and is never optional.
  *
  * NOT to be confused with `scripts/gen-capability-registry.cjs`: that script
  * generates the RUNTIME capability manifest consumed by the host at runtime
@@ -34,7 +38,8 @@ const { renderMarkdown } = require('./registry-schema.cjs');
 
 const SOURCES = [
   { type: 'capability', jsonFile: 'capabilities.json', mdFile: 'capability-registry.md' },
-  { type: 'eos', jsonFile: 'eos.json', mdFile: 'eos-registry.md' },
+  { type: 'eos', jsonFile: 'eos.json', mdFile: 'eos-registry.md', optional: true },
+  { type: 'reviewer', jsonFile: 'reviewers.json', mdFile: 'reviewer-registry.md', optional: true },
 ];
 
 /**
@@ -57,14 +62,16 @@ function getRegistriesDir() {
  * Render the markdown for a single registry type from its committed source
  * JSON.
  *
- * Only `eos.json` is optional (pre-PR2, before that source JSON ships) —
- * an absent `eos.json` returns null and callers treat that as "nothing to
- * do". `capabilities.json` is the primary registry source: a missing
- * `capabilities.json` is ALWAYS an error (never a silent "up to date"
- * pass), mirroring the type distinction in `scripts/validate-registry.cjs`
- * (`type === 'eos' && !exists → continue`).
+ * Optionality is a per-source data flag (`SOURCES[].optional`), not a
+ * hardcoded type literal: `eos.json` (pre-PR2) and `reviewers.json` (issue
+ * #2904) are both optional — an absent source JSON returns null and callers
+ * treat that as "nothing to do". `capabilities.json` is still the primary
+ * registry source and is never optional: a missing `capabilities.json` is
+ * ALWAYS an error (never a silent "up to date" pass), mirroring the same
+ * `optional` flag in `scripts/validate-registry.cjs`
+ * (`optional && !exists → continue`).
  *
- * @param {'capability'|'eos'} type
+ * @param {'capability'|'eos'|'reviewer'} type
  * @returns {string|null}
  */
 function renderFor(type) {
@@ -73,14 +80,31 @@ function renderFor(type) {
 
   const jsonPath = path.join(getRegistriesDir(), source.jsonFile);
   if (!fs.existsSync(jsonPath)) {
-    if (type === 'eos') return null;
+    if (source.optional) return null;
     throw new ExitError(
       1,
       `${source.jsonFile} does not exist at ${jsonPath}. Run:\n  node scripts/gen-registry.cjs --write\n(after adding docs/registries/${source.jsonFile})`,
     );
   }
 
-  const entries = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
+  // A malformed source JSON must surface as an actionable CLI error, not an
+  // unhandled SyntaxError with a raw Node stack trace — mirrors
+  // scripts/validate-registry.cjs#validateFile's try/catch around JSON.parse.
+  let entries;
+  try {
+    entries = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
+  } catch (err) {
+    throw new ExitError(1, `${source.jsonFile} is not valid JSON at ${jsonPath}: ${err.message}`);
+  }
+
+  // Mirrors validate-registry.cjs's explicit non-array rejection: a source
+  // JSON that parses to a non-array (object, string, etc.) would otherwise
+  // throw an opaque TypeError from `[...entries].sort()` in renderMarkdown,
+  // or silently mis-render for an iterable-but-wrong-shape value like a string.
+  if (!Array.isArray(entries)) {
+    throw new ExitError(1, `${source.jsonFile} must be a JSON array of entries`);
+  }
+
   return renderMarkdown(entries, { type, sourceFile: source.jsonFile });
 }
 
@@ -91,7 +115,7 @@ function main() {
 
   for (const { type, mdFile } of SOURCES) {
     const rendered = renderFor(type);
-    if (rendered === null) continue; // source JSON absent (eos.json before PR2)
+    if (rendered === null) continue; // source JSON absent and optional (eos.json before PR2 / reviewers.json)
 
     const mdPath = path.join(registriesDir, mdFile);