@opengsd/gsd-core 1.9.1 → 1.11.0

package/gsd-core/bin/lib/retired-artifact-cleanup.cjs

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * Conservative cleanup for artifact surfaces retired by a runtime descriptor.
+ *
+ * A descriptor may stop materializing an artifact kind while old installs
+ * still contain files from that surface. Install and profile/surface apply
+ * both call this helper so either path converges an existing installation.
+ * Only files proven managed by the previous install manifest are removed;
+ * modified and unknown files are preserved for the journaled installer
+ * migration (or the user) to handle without data loss.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_path_1 = __importDefault(require("node:path"));
+// #2874 (ADR-58 cleanup phase): pruneRetiredRuntimeArtifacts is the first
+// thing installRuntimeArtifacts calls, so its fs calls are routed through
+// the injectable seam too — see install-fs-adapter.cts's module doc.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const installFsAdapter = require("./install-fs-adapter.cjs");
+const { installFs } = installFsAdapter;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const installerMigrations = require("./installer-migrations.cjs");
+const external_descriptor_trust_cjs_1 = require("./external-descriptor-trust.cjs");
+// Generated at build time, so no TypeScript source declaration exists.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const capabilityRegistry = require('./capability-registry.cjs');
+function retiredArtifactsFor(runtime) {
+    const configured = capabilityRegistry.runtimes?.[runtime]?.runtime?.hostBehaviors?.retiredArtifacts;
+    return Array.isArray(configured) ? configured : [];
+}
+function pruneRetiredRuntimeArtifacts(runtime, configDir) {
+    const result = { removed: [], preserved: [] };
+    const declarations = retiredArtifactsFor(runtime);
+    if (declarations.length === 0)
+        return result;
+    const manifest = installerMigrations.readInstallManifest(configDir);
+    for (const declaration of declarations) {
+        const destSubpath = declaration.destSubpath;
+        const prefix = declaration.prefix;
+        const suffix = declaration.suffix;
+        if (typeof destSubpath !== 'string' || destSubpath.length === 0 ||
+            typeof prefix !== 'string' || prefix.length === 0 ||
+            typeof suffix !== 'string' || suffix.length === 0 ||
+            !(0, external_descriptor_trust_cjs_1.isPathConfined)(destSubpath, configDir)) {
+            continue;
+        }
+        const destDir = node_path_1.default.resolve(configDir, destSubpath);
+        let entries;
+        try {
+            if (!installFs().existsSync(destDir) || installFs().lstatSync(destDir).isSymbolicLink())
+                continue;
+            entries = installFs().readdirSync(destDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.startsWith(prefix) || !entry.name.endsWith(suffix))
+                continue;
+            const relPath = node_path_1.default.posix.join(destSubpath.replace(/\\/g, '/'), entry.name);
+            const artifact = installerMigrations.classifyArtifact(configDir, relPath, manifest);
+            if (artifact.classification !== 'managed-pristine') {
+                result.preserved.push(relPath);
+                continue;
+            }
+            try {
+                installFs().unlinkSync(node_path_1.default.join(destDir, entry.name));
+                result.removed.push(relPath);
+            }
+            catch {
+                result.preserved.push(relPath);
+            }
+        }
+        try {
+            if (installFs().readdirSync(destDir).length === 0)
+                installFs().rmdirSync(destDir);
+        }
+        catch {
+            // Non-empty, unreadable, or concurrently changed: preserve the directory.
+        }
+    }
+    return result;
+}
+module.exports = { pruneRetiredRuntimeArtifacts, retiredArtifactsFor };

package/gsd-core/bin/lib/review-lane-descriptor.cjs

@@ -52,6 +52,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DOCS_PARITY_VIOLATION = exports.LANE_SLUG_RE = exports.PARITY_VIOLATION = exports.REVIEWER_LANES = exports.ARGV_PLACEHOLDER = void 0;
+exports.mergeReviewerLanes = mergeReviewerLanes;
 exports.checkReviewerLaneParity = checkReviewerLaneParity;
 exports.checkReviewerDocsParity = checkReviewerDocsParity;
 /**
@@ -127,6 +128,15 @@ exports.REVIEWER_LANES = Object.freeze([
             ...SPAWN_STDIN_STDOUT,
             modelArg: '--model',
             effortChannel: 'argv',
+            // #2483: without these the claude leg is the only reviewer that additionally inherits the
+            // invoking user's global CLAUDE.md, the project CLAUDE.md, and Claude Code auto-memory —
+            // a context asymmetry against the independent-review premise (gemini sees only the
+            // assembled prompt; codex runs --ephemeral). Both flags, not just the first: CLAUDE.md
+            // loading and auto-memory are independently-toggled mechanisms, and an environment
+            // exporting CLAUDE_CODE_DISABLE_AUTO_MEMORY=0 forces auto-memory back ON — the explicit
+            // pair is robust against that. Applies when /gsd:review runs from a non-Claude-Code host;
+            // inside Claude Code the claude lane self-skips for independence.
+            env: { CLAUDE_CODE_DISABLE_CLAUDE_MDS: '1', CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1' },
         },
         timeoutFloorMs: 1_200_000,
         emptyOutput: 'stub-with-stderr',
@@ -423,6 +433,104 @@ exports.REVIEWER_LANES = Object.freeze([
         handler: null,
     },
 ].map((lane) => Object.freeze(lane)));
+/**
+ * Merge the first-party lane set with installed overlay `reviewer` bodies
+ * (ADR-2782 D8: first-party ∪ overlay, first-party wins on slug collision).
+ *
+ * `routeReviewLane` (gsd-core/bin/gsd-tools.cjs) consumes this to build the lane
+ * map its `sections`/`flags`/`plan`/`invoke` subcommands resolve against, so an
+ * installed, consented third-party reviewer capability (`role:"reviewer"` with a
+ * declared `reviewer` body) becomes selectable, plannable, and invocable through
+ * the same surface as a built-in lane — closing #2927, where the overlay was
+ * roster-visible (`deriveReviewerSlugs`) and disclosed at install
+ * (`collectReviewerLaneSurfaces`) but never reached the invocation path.
+ *
+ * ADR-2782 D1 deliberately made the manifest `reviewer` body field-identical to
+ * `ReviewerLaneCommon` so "Phase 2 harvests the shape into the capability manifest
+ * with no translation layer" (CONTEXT.md reviewer-lane-descriptor predicate). The
+ * overlay body IS already `ReviewerLane`-shaped; this function MERGES, it does not
+ * PROJECT — there is no field renaming, no vocabulary translation. That is the
+ * design decision the bug violated by simply never calling anything.
+ *
+ * Pure and TOTAL — never throws on any input, because third-party overlay
+ * manifests are untrusted data reaching this seam at load time. A cap whose
+ * `reviewer` body is absent, non-object, or carries an empty/grammar-invalid slug
+ * is SKIPPED (contributes no lane) rather than crashing, so one malformed overlay
+ * cannot take the whole `review-lane` surface (and every first-party lane with it)
+ * down. The slug grammar (`LANE_SLUG_RE`) is enforced HERE even though
+ * `resolveLanePlan`'s trust boundary re-checks it, because `sections`/`flags` read
+ * lane fields before reaching `resolveLanePlan` — defense in depth against the
+ * path-traversal class the invocation boundary exists for.
+ *
+ * First-party wins: an overlay declaring a slug that already names a first-party
+ * lane is silently superseded (the first-party entry is kept, identity-stable),
+ * never overwritten. The first-party object is returned by reference, not copied.
+ *
+ * @param firstParty The frozen first-party lane set (`REVIEWER_LANES`).
+ * @param registry   The merged capability registry
+ *                   (`loadRegistry({ includeInstalled: true })`); only its
+ *                   `capabilities` map is read. A cap contributes a lane iff it
+ *                   carries an object `reviewer` body with a non-empty,
+ *                   grammar-valid `slug`. The `role:"runtime"` `reviewerCli`
+ *                   alias never contributed a lane here, and as of #2801 it no
+ *                   longer contributes to the selection roster
+ *                   (`deriveReviewerSlugs`) either — the two surfaces now agree.
+ * @returns A NEW array: first-party lanes (in order) followed by accepted overlay
+ *          lanes (in registry iteration order). Callers must not mutate it.
+ */
+function mergeReviewerLanes(firstParty, registry) {
+    // First-party always wins and is returned by reference (identity-stable), so a
+    // collision cannot perturb the first-party entry a consumer already holds.
+    const bySlug = new Map();
+    const ordered = [];
+    for (const lane of firstParty) {
+        const slug = typeof lane.slug === 'string' ? lane.slug.trim() : '';
+        if (!slug)
+            continue; // unreachable for the shipped frozen set, but this is exported
+        if (!bySlug.has(slug)) {
+            bySlug.set(slug, lane);
+            ordered.push(lane);
+        }
+    }
+    const capabilities = (registry && registry.capabilities) || {};
+    for (const cap of Object.values(capabilities)) {
+        if (cap === null || typeof cap !== 'object' || Array.isArray(cap))
+            continue;
+        const body = cap.reviewer;
+        // C1/C2 (mirroring collectReviewerLaneSurfaces): a missing, null, or
+        // non-object reviewer body declares no lane — never an error at this layer.
+        if (body === null || typeof body !== 'object' || Array.isArray(body))
+            continue;
+        const rawSlug = body.slug;
+        const slug = typeof rawSlug === 'string' ? rawSlug.trim() : '';
+        // Empty/whitespace slug: nothing to key on. Grammar-invalid slug: the
+        // path-traversal class — skip rather than admit, even though resolveLanePlan
+        // would reject it downstream. Both are skips, not throws.
+        if (!slug || !exports.LANE_SLUG_RE.test(slug))
+            continue;
+        if (bySlug.has(slug))
+            continue; // D8: first-party (or an earlier overlay) wins
+        // The body is already ReviewerLane-shaped per ADR-2782 D1. We do NOT
+        // deep-validate every field here: the invocation trust boundary
+        // (resolveLanePlan) is the seam that re-validates a lane before it runs, and
+        // `sections`/`flags` are both tolerant of a partial body (flags filters by
+        // shape; sections reads slug/reviewsSection which a non-string cap simply
+        // renders as undefined). Admitting the body keeps the merge a pure merge.
+        //
+        // The slug is normalized to its trimmed value on the stored lane so the merge
+        // and the selection roster (`deriveReviewerSlugs`, which trims before adding)
+        // agree on the canonical key — otherwise a body declaring `slug: '  x  '`
+        // would key the map on `'x'` but emit the raw `'  x  '` in `sections` and fail
+        // to match a `--selected` value coming from the roster. (The capability
+        // validator's grammar check rejects surrounding whitespace before this is
+        // reachable through a real install, so this is belt-and-braces parity with the
+        // roster, not a live-input guard.)
+        const lane = { ...body, slug };
+        bySlug.set(slug, lane);
+        ordered.push(lane);
+    }
+    return ordered;
+}
 /* ------------------------------------------------------------------ *
  * DEFECT.GENERATIVE-FIX parity (CONTEXT.md:797)
  * ------------------------------------------------------------------ */

package/gsd-core/bin/lib/review-lane-invocation.cjs

@@ -24,6 +24,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LANE_UNAVAILABLE = void 0;
+exports.configString = configString;
 exports.normalizeHost = normalizeHost;
 exports.isEmptyReview = isEmptyReview;
 exports.fileRefPrompt = fileRefPrompt;
@@ -74,6 +75,9 @@ const KNOWN_HANDLERS = new Set(['antigravity', 'openai-compatible', 'opencode'])
  *
  * A non-string (number, bool, object, array) is NOT coerced. `String(0)` would put `"0"` into argv
  * as a model name; a wrong model silently reviewed is worse than no model override.
+ *
+ * Exported and shared with the runner's model-recovery arms (#2295) — "what counts as unset" has
+ * ONE source, so the plan resolver and the runner's recovered-model normalization cannot disagree.
  */
 function configString(raw) {
     if (typeof raw !== 'string')
@@ -212,6 +216,10 @@ function resolveLanePlan(input) {
         ? lane.timeoutFloorMs
         : 900_000;
     const emptyOutput = lane.emptyOutput === 'handler-owned' ? 'handler-owned' : 'stub-with-stderr';
+    // #3194: only an EXACT 'diff-only' declaration exempts a lane from evidence verification.
+    // Anything else — including a missing or garbage value on a third-party overlay body —
+    // resolves as 'source-grounded', so the runner verifies rather than trusts it.
+    const evidenceClass = lane.evidenceClass === 'diff-only' ? 'diff-only' : 'source-grounded';
     const requiresBinaries = Array.isArray(lane.requiresBinaries)
         ? lane.requiresBinaries.filter((b) => typeof b === 'string')
         : [];
@@ -255,6 +263,7 @@ function resolveLanePlan(input) {
                 errPath,
                 timeoutMs,
                 emptyOutput,
+                evidenceClass,
                 handler,
                 requiresBinaries,
                 probe: lane.probe,
@@ -325,6 +334,23 @@ function resolveLanePlan(input) {
             argv.push(token);
         }
     }
+    // Per-invocation env pairs (#2483). Own string-valued entries only — a non-string is dropped,
+    // never coerced, and prototype members never resolve (same lookup discipline as the argv
+    // expansions above). An empty or absent declaration resolves to `null`, so the runner has one
+    // shape to test.
+    let env = null;
+    const declaredEnv = inv.env;
+    if (declaredEnv !== null && typeof declaredEnv === 'object' && !Array.isArray(declaredEnv)) {
+        const source = declaredEnv;
+        const pairs = {};
+        for (const k of Object.keys(source)) {
+            const v = source[k];
+            if (typeof v === 'string')
+                pairs[k] = v;
+        }
+        if (Object.keys(pairs).length > 0)
+            env = pairs;
+    }
     return {
         ok: true,
         warnings,
@@ -333,6 +359,8 @@ function resolveLanePlan(input) {
             slug,
             binary,
             argv,
+            model: modelExpansion.length > 0 ? model : null,
+            effort: effortExpansion.length > 0 ? (configString(input.effortValue) ?? null) : null,
             stdin,
             promptPath,
             outputTarget,
@@ -340,9 +368,11 @@ function resolveLanePlan(input) {
             errPath,
             timeoutMs,
             emptyOutput,
+            evidenceClass,
             handler,
             requiresBinaries,
             probe: lane.probe,
+            env,
         },
     };
 }