@tekyzinc/gsd-t 3.13.14 → 3.13.15

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [3.13.15] - 2026-04-17
+
+### Fixed — Self-protection guard now uses package-name identity + narrow `bin/*.cjs` gitignore rule
+
+Two bugs in v3.13.14 surfaced when `gsd-t update-all` ran against GSD-T's own source repo from the globally-installed CLI:
+
+**Bug 1 — Self-protection guard bypassed**: The v3.13.14 guard compared `realpathSync(projectBinDir)` against `realpathSync(PKG_ROOT/bin)`. When `update-all` runs from the globally-installed CLI (`/usr/local/lib/node_modules/@tekyzinc/gsd-t`), `PKG_ROOT` points there — NOT to the local GSD-T source at `/Users/…/projects/GSD-T`. The paths never match in the typical dogfood setup, so the guard returned `false` and the sweep ate the source `bin/gsd-t.js`.
+
+**Fix**: identity is now by `package.json` name. The sweep reads `projectDir/package.json` and skips if `name === "@tekyzinc/gsd-t"`. Works regardless of whether `update-all` runs from the local source tree or the global install.
+
+**Bug 2 — Gitignore rule overly broad**: `UNATTENDED_GITIGNORE_ENTRIES` included `bin/*.cjs`, which ignored every `.cjs` under `bin/` — contradicting the adjacent comment ("legitimate `.cjs` source files under `bin/` ARE tracked"). With the broad rule active, new source `.cjs` files (e.g., `bin/headless-exit-codes.cjs`) couldn't be committed without `--force`.
+
+**Fix**: the gitignore entry narrows to exactly `bin/context-meter-state.cjs` — the single session-state artifact that was the original intent.
+
+**Files**:
+- `bin/gsd-t.js` — `isSourcePackage` now reads `package.json.name`; `UNATTENDED_GITIGNORE_ENTRIES` narrowed.
+- `test/bin-gsd-t-resilience.test.js` — self-protection test reshaped: seeds a tmp `package.json` with `name: "@tekyzinc/gsd-t"` + a signature-matching stray, asserts the stray survives the sweep.
+- `.gitignore` — deduped and restored to the narrow form.
+
+**Tests**: 1240/1240 pass (unchanged count; existing self-protection test reshaped). E2E: N/A.
+
+**Impact**: `gsd-t update-all` is now safe to run with GSD-T itself registered as a project, regardless of where the CLI is installed from. Legitimate `.cjs` source files in `bin/` are no longer blanket-ignored in downstream projects' `.gitignore`. bee-poc's supervisor, which started loading cleanly on v3.13.14, continues to load on v3.13.15 (this release is purely dogfood-protection + gitignore repair; no supervisor-behavior change).
+
 ## [3.13.14] - 2026-04-17
 
 ### Fixed — Supervisor no longer requires project-local `bin/gsd-t.js` + sweep self-protection

package/bin/gsd-t.js

@@ -2161,18 +2161,23 @@ function copyBinToolsToProject(projectDir, projectName) {
       }
     }
   }
-  // Self-protection: NEVER sweep the package's own bin/. Without this guard,
+  // Self-protection: NEVER sweep GSD-T's own source repo. Without this guard,
   // running `gsd-t update-all` with the GSD-T source repo itself registered
   // as a project (legitimate during development) would signature-match
   // bin/gsd-t.js — which IS the installer — and delete the source file.
-  // Resolve both paths to handle symlinks / relative path quirks.
-  const resolvedProjectBin = fs.realpathSync.native
-    ? (() => { try { return fs.realpathSync(projectBinDir); } catch { return projectBinDir; } })()
-    : projectBinDir;
-  const resolvedPkgBin = (() => {
-    try { return fs.realpathSync(path.join(PKG_ROOT, "bin")); } catch { return path.join(PKG_ROOT, "bin"); }
+  // Identity is by package.json name, NOT by path — when update-all runs from
+  // the globally-installed package, PKG_ROOT points to the global install and
+  // realpath comparison against the local source always fails.
+  const isSourcePackage = (() => {
+    try {
+      const pkgPath = path.join(projectDir, "package.json");
+      if (!fs.existsSync(pkgPath)) return false;
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+      return pkg && pkg.name === "@tekyzinc/gsd-t";
+    } catch {
+      return false;
+    }
   })();
-  const isSourcePackage = resolvedProjectBin === resolvedPkgBin;
   let cleaned = 0;
   if (!isSourcePackage) {
     for (const stray of DEPRECATED_BIN_STRAYS) {
@@ -2324,7 +2329,7 @@ function ensureUnattendedConfig(projectDir, projectName) {
 }
 
 const UNATTENDED_GITIGNORE_ENTRIES = [
-  "bin/*.cjs",
+  "bin/context-meter-state.cjs",
   ".gsd-t/.archive-migration-v1",
   ".gsd-t/.task-counter-retired-v1",
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "3.13.14",
+  "version": "3.13.15",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",