@tekyzinc/gsd-t 3.13.12 → 3.13.13

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [3.13.13] - 2026-04-17
+
+### Fixed — Stray sweep now matches older-version installer artifacts
+
+v3.13.12 shipped the defensive require + DEPRECATED_BIN_STRAYS sweep, but the sweep's safety check was too narrow: it only deleted strays whose bytes matched the **current** source. Projects left behind with a v3.13.11 (or earlier) `bin/gsd-t.js` would not match the current source (different body), so the sweep refused to delete them and those projects stayed crashed.
+
+**Fix**: sweep now uses a **signature** check rather than a byte-identity check. A stray is deleted when it starts with `#!/usr/bin/env node` AND contains the verbatim JSDoc header `GSD-T CLI Installer` in the first 400 characters. That combination is unique enough to rule out user-owned files (a user's own script would not contain our header) while matching every historical version of this installer — so older-version artifacts are swept correctly.
+
+**Files**:
+- `bin/gsd-t.js` — sweep loop now uses signature match instead of byte-match.
+- `test/bin-gsd-t-resilience.test.js` — new test case covering older-version stray (shebang + header + different body) → must be deleted. Existing byte-match test kept. Existing user-owned test kept.
+
+**Tests**: 1239/1239 pass (+1 new assertion vs v3.13.12). E2E: N/A.
+
+**Impact**: bee-poc and any other project carrying a pre-v3.13.12 `bin/gsd-t.js` now self-heals on the next `gsd-t update-all` pass after installing v3.13.13.
+
 ## [3.13.12] - 2026-04-17
 
 ### Fixed — Project-local `bin/gsd-t.js` crash on missing `debug-ledger.js` + self-heal sweep

package/bin/gsd-t.js

@@ -2157,13 +2157,19 @@ function copyBinToolsToProject(projectDir, projectName) {
   let cleaned = 0;
   for (const stray of DEPRECATED_BIN_STRAYS) {
     const strayPath = path.join(projectBinDir, stray);
-    const srcPath = path.join(PKG_ROOT, "bin", stray);
     if (!fs.existsSync(strayPath)) continue;
-    if (!fs.existsSync(srcPath)) continue;
     try {
       const strayContent = fs.readFileSync(strayPath, "utf8");
-      const srcContent = fs.readFileSync(srcPath, "utf8");
-      if (strayContent === srcContent) {
+      const head = strayContent.slice(0, 400);
+      // Signature-match any version this installer ever shipped. The marker
+      // is unique enough to rule out user-owned files: node shebang + the
+      // verbatim JSDoc header "GSD-T CLI Installer". Matches every historical
+      // version of bin/gsd-t.js, not just the current one, so older strays
+      // (e.g. v3.13.11 left behind on v3.13.12+) are still swept.
+      const isOurs =
+        head.startsWith("#!/usr/bin/env node") &&
+        head.includes("GSD-T CLI Installer");
+      if (isOurs) {
         fs.unlinkSync(strayPath);
         cleaned++;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "3.13.12",
+  "version": "3.13.13",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",