gsd-lite 0.5.14 → 0.6.0

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "gsd",
       "source": "./",
       "description": "AI orchestration tool — GSD management shell + Superpowers quality core. 5 commands, 4 agents, 5 workflows, MCP server, context monitoring.",
-      "version": "0.5.14",
+      "version": "0.6.0",
       "keywords": [
         "orchestration",
         "mcp",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd",
-  "version": "0.5.14",
+  "version": "0.6.0",
   "description": "AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core",
   "author": {
     "name": "sdsrss",

package/agents/debugger.md

@@ -55,8 +55,11 @@ Phase 3 假设测试:
   3. 验证: 有效 → Phase 4 / 无效 → 新假设
 
 Phase 4 修复方向建议:
-  1. 提出修复方案 (针对根因，不是症状)
-  2. 建议失败测试用例 (供 executor 实现)
+  调试器不直接写代码 — 返回 fix_direction + 测试用例描述，由 executor 实施。
+  1. 提出修复方案 (针对根因，不是症状) → 写入 `fix_direction`
+  2. 描述回归测试用例 (测什么、预期 vs 实际) → 供 executor 实现
+     - 不要自己写测试代码，你没有 Write 工具
+     - 用自然语言描述: 输入、操作步骤、预期结果、实际错误行为
   3. 评估修复影响范围 (哪些下游可能受影响)
   → 3 次修复方向均被 executor 验证无效 → 停止。标记 architecture_concern: true。报告给编排器。
 </four_phases>
@@ -66,6 +69,10 @@ Phase 4 修复方向建议:
 {
   "task_id": "2.3",
   "outcome": "root_cause_found | fix_suggested | failed",
+  // outcome 判定:
+  //   root_cause_found — 根因已确认，有明确的修复方向
+  //   fix_suggested    — 部分理解，建议一个尝试方向 (根因尚未完全确认)
+  //   failed           — 穷尽假设仍无法定位根因，或 fix_attempts >= 3
   "root_cause": "Description of the identified root cause",
   "evidence": [
     { "id": "ev:repro:error-xyz", "scope": "task:2.3", "command": "npm test", "exit_code": 1, "stdout": "...", "stderr": "...", "timestamp": "ISO8601" }
@@ -73,8 +80,8 @@ Phase 4 修复方向建议:
   "hypothesis_tested": [
     { "hypothesis": "X causes Y", "result": "confirmed | rejected", "evidence": "non-empty string (required)" }
   ],
-  "fix_direction": "Suggested fix approach for executor",
-  "fix_attempts": 0,
+  "fix_direction": "Suggested fix approach for executor (include suggested test case description)",
+  "fix_attempts": 0, // 由编排器 dispatch context 中的 debug_context 传入，记录已尝试的修复方向次数
   "blockers": [],
   "architecture_concern": false
 }

package/agents/reviewer.md

@@ -51,6 +51,14 @@ L1 普通编码任务 → executor 自审 + 阶段结束时批量 review
 L2 关键任务 → 单任务独立 review
    (涉及认证/支付/数据安全/核心架构的任务)
 
+L3 最高风险任务 → 单任务独立 review + 人工确认
+   (auth/payment/security architecture 等最高风险任务)
+   - 与 L2 相同的双阶段审查流程，外加:
+   - 结果中必须包含 `requires_human_confirmation: true`
+   - review summary 必须明确列出安全影响 (security implications)
+   - 质量审查阶段必须检查 OWASP Top 10 相关问题
+   - 审查通过后 task 进入 `awaiting_user` 而非 `accepted`，需用户显式确认
+
 判定规则按影响面，不按关键词猜测:
   - 改 auth/payment/permission/public API/DB migration/core architecture → L2
   - 纯 docs/comment/style/config 且无运行时语义变化 → L0
@@ -107,7 +115,9 @@ Minor = 建议修复 (命名/风格)
 {
   "scope": "task | phase",
   "scope_id": "2.3 (task scope: string ID) | 2 (phase scope: number ID)",
-  "review_level": "L2 | L1-batch | L1",
+  "review_level": "L2 | L3 | L1-batch | L1",
+  "requires_human_confirmation": false, // L3 时必须为 true
+  "security_implications": [], // L3 时必须列出安全影响
   "spec_passed": true,
   "quality_passed": false,
   "critical_issues": [
@@ -141,4 +151,5 @@ checkpoint commit ≠ accepted
 L0: checkpoint commit = accepted
 L1: checkpoint commit → phase batch review 通过 → accepted
 L2: checkpoint commit → immediate independent review 通过 → accepted
+L3: checkpoint commit → immediate independent review 通过 → awaiting_user → 用户确认 → accepted
 </checkpoint_topology>

package/commands/doctor.md

@@ -102,4 +102,3 @@ Suggested Actions:
 - If a check cannot be performed (e.g., tool unavailable), report INFO rather than FAIL
 - Always show all 5 checks in the summary, even if some are INFO/skipped
 </rules>
-</output>

package/commands/prd.md

@@ -17,13 +17,30 @@ argument-hint: File path to requirements doc, or inline description text
 
 <process>
 
+## STEP 0 — 已有项目检测
+
+调用 `health` 工具（MCP tool 名称: health）。如果返回 state_exists=true 且项目未完成/未失败:
+- 告知用户: "检测到进行中的 GSD 项目。"
+- 显示当前项目状态 (项目名、当前阶段、workflow_mode)
+- 提供选项:
+  - (a) 恢复现有项目 → 转到 `/gsd:resume`
+  - (b) 覆盖并重新开始 → 继续 STEP 1（现有 state.json 将被覆盖）
+  - (c) 取消
+- 等待用户选择后再继续
+
+如果无 state 或项目已完成/已失败 → 直接进入 STEP 1。
+
 ## STEP 1: 解析输入
 
 判断 `$ARGUMENTS` 的类型:
 
 **如果是文件路径** (包含 `/` 或 `.` 且文件存在):
 - 使用 Read 工具读取文件内容
-- 如果文件不存在 → 告知用户并停止
+- 如果文件不存在:
+  - 告知用户文件不存在
+  - 提示常见原因: 路径拼写错误、当前工作目录不正确
+  - 建议: "请确认文件路径，或使用绝对路径重试。需要我帮你查找文件吗？"
+  - 停止
 
 **如果是文本描述**:
 - 直接作为需求描述使用

package/commands/resume.md

@@ -9,19 +9,20 @@ description: Resume project execution from saved state with workspace validation
 
 <process>
 
-## STEP 1: 读取状态
+## STEP 1: 调用 orchestrator-resume 获取状态摘要
 
-读取 `.gsd/state.json`:
-- 如果文件不存在 → 告知用户 "未找到 GSD 项目状态，请先运行 /gsd:start 或 /gsd:prd"，停止
-- 如果文件损坏或解析失败 → 告知用户并停止
+调用 MCP tool `orchestrator-resume`，使用响应中的 `summary` 字段展示状态给用户:
+- 如果响应为 error 且 message 包含 "No .gsd directory" → 告知用户 "未找到 GSD 项目状态，请先运行 /gsd:start 或 /gsd:prd"，停止
+- 如果响应为 error → 告知用户错误信息并停止
 
-提取关键 canonical fields:
+`summary` 字段包含:
 - `workflow_mode` — 当前工作流状态
-- `current_phase` / `current_task` — 当前执行位置
-- `current_review` — 当前审查状态
-- `git_head` — 上次记录的 Git HEAD
-- `plan_version` — 计划版本号
-- `research.expires_at` — 研究过期时间
+- `current_phase` — 当前阶段 (格式: "N/M")
+- `current_task` — 当前任务 (id + name)
+- `phase_progress` — 阶段进度 (格式: "done/total")
+- `recent_decisions` — 最近 2-3 个决策 (如有)
+
+注意: 不需要单独读取 state.json，`orchestrator-resume` 的响应已包含所有需要展示的信息。
 
 ## STEP 2: 前置校验
 
@@ -55,10 +56,15 @@ description: Resume project execution from saved state with workspace validation
    - 或 research.decision_index 中有条目的 expires_at 已过期
    - → 覆写 `workflow_mode = research_refresh_needed`
 
-5. **全部通过:**
+5. **Dirty-phase 回滚检测:**
+   - 检查已完成 phase 中是否有 `needs_revalidation` 状态的 task
+   - 如有 → 回滚 `current_phase` 到最早的 dirty phase
+   - → 覆写 `workflow_mode = executing_task`
+
+6. **全部通过:**
    - 保持原 `workflow_mode` 不变
 
-校验顺序: 1→2→3→4，首个命中的覆写生效 (不累积)
+校验顺序: 1→2→3→4→5，首个命中的覆写生效 (不累积)
 </HARD-GATE>
 
 ## STEP 3: 按 workflow_mode 恢复
@@ -106,8 +112,8 @@ description: Resume project execution from saved state with workspace validation
 ### `awaiting_clear` — 继续自动执行
 
 - 上下文已通过 /clear 清理
-- 直接继续自动执行主路径
-- 从 `current_phase` + `current_task` 恢复调度
+- 再次验证上下文健康度 ≥ 40%，不足则要求再次 /clear
+- 验证通过后从 `current_phase` + `current_task` 恢复调度
 
 ---
 
@@ -208,17 +214,17 @@ description: Resume project execution from saved state with workspace validation
 
 ## STEP 4: 显示当前进度 + 下一动作
 
-每次恢复后都展示简要进度面板:
+每次恢复后使用 `orchestrator-resume` 响应中的 `summary` 字段展示简要进度面板:
 
 ```
-项目: {project}
-模式: {workflow_mode}
-进度: Phase {current_phase}/{total_phases} | Task {done}/{tasks}
-当前: {current_task} — {task_name}
-下一步: {根据 workflow_mode 推导的下一动作}
+模式: {summary.workflow_mode}
+进度: Phase {summary.current_phase} | Task {summary.phase_progress}
+当前: {summary.current_task.id} — {summary.current_task.name}
+决策: {summary.recent_decisions (如有)}
+下一步: {根据 action 推导的下一动作}
 ```
 
-所有展示数据从 canonical fields 实时推导，不使用 derived fields。
+注意: 所有展示数据直接取自 `summary` 字段，不需要额外读取 state.json。
 
 ## STEP 5: 自动执行循环
 

package/commands/start.md

@@ -58,3 +58,11 @@ argument-hint: Optional feature or project description
 使用 Read 工具读取 `workflows/execution-flow.md`，严格按照其中 STEP 5-12 执行。
 
 </process>
+
+<EXTREMELY-IMPORTANT>
+## 编排器纪律
+- 只有编排器写 state.json，子代理不直接写
+- 所有摘要/提示在展示时从 canonical fields 推导，不持久化 derived fields
+- 子代理返回结构化 JSON，不解析自然语言
+- 上下文 < 35% → 保存状态 + workflow_mode = awaiting_clear + 停止执行
+</EXTREMELY-IMPORTANT>

package/hooks/gsd-auto-update.cjs

@@ -7,6 +7,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 const { execSync, spawnSync } = require('node:child_process');
+const { semverSortComparator } = require('./lib/semver-sort.cjs');
 
 // ── Configuration ──────────────────────────────────────────
 const GITHUB_REPO = 'sdsrss/gsd-lite';
@@ -195,12 +196,13 @@ async function withFileLock(fn) {
     }
   }
 
+  if (!acquired) {
+    return null;
+  }
   try {
     return await fn();
   } finally {
-    if (acquired) {
-      try { fs.rmSync(STATE_LOCK_FILE, { force: true }); } catch {}
-    }
+    try { fs.rmSync(STATE_LOCK_FILE, { force: true }); } catch {}
   }
 }
 
@@ -209,7 +211,7 @@ async function withFileLock(fn) {
 // 1. PLUGIN_AUTO_UPDATE env set → recursive guard (auto-update already in progress)
 // 2. Running from a git clone → dev mode (developer working on source)
 function shouldSkipUpdateCheck() {
-  if (process.env.PLUGIN_AUTO_UPDATE) return true;
+  if (process.env.PLUGIN_AUTO_UPDATE === '1') return true;
   return isDevMode();
 }
 
@@ -297,15 +299,8 @@ async function fetchLatestRelease(token) {
 }
 
 // ── Version Comparison (semver) ────────────────────────────
-function compareVersions(a, b) {
-  const pa = a.split('.').map(Number);
-  const pb = b.split('.').map(Number);
-  for (let i = 0; i < 3; i++) {
-    if ((pa[i] || 0) > (pb[i] || 0)) return 1;
-    if ((pa[i] || 0) < (pb[i] || 0)) return -1;
-  }
-  return 0;
-}
+// Reuse shared comparator; callers only check sign (> 0, < 0, === 0)
+const compareVersions = semverSortComparator;
 
 function getCurrentVersion(mode = getInstallMode()) {
   const candidates = mode === 'manual'
@@ -337,7 +332,7 @@ function validateExtractedPackage(extractDir) {
 // ── Download & Install ─────────────────────────────────────
 async function downloadAndInstall(tarballUrl, verbose = false, token = null) {
   const tmpDir = path.join(os.tmpdir(), `gsd-update-${Date.now()}`);
-  const backupPath = path.join(pluginRoot, 'package.json.bak');
+  const backupPath = path.join(runtimeDir, 'package.json.bak');
   let backedUp = false;
   try {
     fs.mkdirSync(tmpDir, { recursive: true });
@@ -450,6 +445,42 @@ function writeNotification(notification) {
   }
 }
 
+// ── Cache Cleanup ─────────────────────────────────────────
+// Remove old plugin cache versions, keeping the N most recent.
+function pruneOldCacheVersions(cacheBase, keepCount = 3, verbose = false) {
+  try {
+    if (!fs.existsSync(cacheBase)) return;
+    const entries = fs.readdirSync(cacheBase, { withFileTypes: true })
+      .filter(e => e.isDirectory())
+      .map(e => e.name);
+    if (entries.length <= keepCount) return;
+
+    // Sort by semver using shared comparator
+    const sorted = entries.slice().sort(semverSortComparator);
+
+    // Detect versions with active processes to avoid disrupting running sessions
+    let activeVersions;
+    try {
+      const psOutput = spawnSync('ps', ['aux'], { stdio: 'pipe', timeout: 5000 });
+      const lines = (psOutput.stdout || '').toString();
+      activeVersions = new Set(
+        entries.filter(ver => lines.includes(`/cache/gsd/gsd/${ver}/`))
+      );
+    } catch { activeVersions = new Set(); }
+
+    const toRemove = sorted.slice(0, sorted.length - keepCount);
+    for (const ver of toRemove) {
+      if (activeVersions.has(ver)) {
+        if (verbose) console.log(`  Skipped ${ver} (active process detected)`);
+        continue;
+      }
+      const verPath = path.join(cacheBase, ver);
+      fs.rmSync(verPath, { recursive: true, force: true });
+      if (verbose) console.log(`  Pruned old cache: ${ver}`);
+    }
+  } catch { /* best effort */ }
+}
+
 // ── Plugin Cache Sync ─────────────────────────────────────
 // When installed as a plugin, the MCP server runs from plugins/cache/gsd/gsd/<version>/
 // The auto-update installs to ~/.claude/gsd/ (runtime dir) via install.js,
@@ -492,11 +523,17 @@ function syncPluginCache(extractedDir, verbose = false) {
 
     // Install dependencies in cache dir
     if (!fs.existsSync(path.join(newCachePath, 'node_modules', '@modelcontextprotocol'))) {
-      spawnSync('npm', ['install', '--omit=dev', '--ignore-scripts'], {
+      const npmResult = spawnSync('npm', ['install', '--omit=dev', '--ignore-scripts'], {
         cwd: newCachePath,
         stdio: 'pipe',
         timeout: 60000,
       });
+      if (npmResult.status !== 0) {
+        // npm install failed — don't update registry to point to broken cache
+        if (verbose) console.error('  npm install failed in cache dir, aborting cache sync');
+        fs.rmSync(newCachePath, { recursive: true, force: true });
+        return;
+      }
     }
 
     // Update installed_plugins.json to point to new cache path
@@ -507,6 +544,26 @@ function syncPluginCache(extractedDir, verbose = false) {
     fs.writeFileSync(tmpPlugins, JSON.stringify(plugins, null, 2) + '\n');
     fs.renameSync(tmpPlugins, pluginsFile);
 
+    // Update settings.json statusLine if it points to the old cache path
+    try {
+      const settingsPath = path.join(claudeDir, 'settings.json');
+      const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+      if (settings.statusLine?.command?.includes('/plugins/cache/gsd/gsd/')) {
+        const oldCmd = settings.statusLine.command;
+        const updated = oldCmd.replace(/\/plugins\/cache\/gsd\/gsd\/[^/]+\//g, `/plugins/cache/gsd/gsd/${newVersion}/`);
+        if (updated !== oldCmd) {
+          settings.statusLine.command = updated;
+          const tmpSettings = settingsPath + `.${process.pid}.tmp`;
+          fs.writeFileSync(tmpSettings, JSON.stringify(settings, null, 2) + '\n');
+          fs.renameSync(tmpSettings, settingsPath);
+          if (verbose) console.log('  StatusLine path updated to new version');
+        }
+      }
+    } catch {}
+
+    // Prune old cache versions — keep only the 3 most recent
+    pruneOldCacheVersions(cacheBase, 3, verbose);
+
     if (verbose) console.log(`  Plugin cache synced to v${newVersion}`);
   } catch (err) {
     // Best effort — don't fail the update if cache sync fails

package/hooks/lib/gsd-finder.cjs

@@ -9,26 +9,42 @@
 const fs = require('node:fs');
 const path = require('node:path');
 
+const _findCache = new Map();
+
 /**
  * Walk from startDir up to filesystem root looking for a .gsd directory
  * that contains state.json. Returns the absolute path to .gsd or null.
+ * Results are cached per startDir (positive hits only — null is not cached
+ * so that a later-created .gsd directory can be discovered).
  */
 function findGsdDir(startDir) {
+  if (_findCache.has(startDir)) return _findCache.get(startDir);
+
   let dir = startDir;
   while (true) {
     const candidate = path.join(dir, '.gsd');
     try {
       if (fs.statSync(candidate).isDirectory()) {
         // Only return if state.json exists (not just an empty .gsd dir)
-        if (fs.existsSync(path.join(candidate, 'state.json'))) return candidate;
+        if (fs.existsSync(path.join(candidate, 'state.json'))) {
+          _findCache.set(startDir, candidate);
+          return candidate;
+        }
       }
     } catch { /* skip */ }
     const parent = path.dirname(dir);
-    if (parent === dir) return null;
+    if (parent === dir) return null; // Don't cache negative results
     dir = parent;
   }
 }
 
+/**
+ * Clear the findGsdDir result cache. Useful for testing.
+ */
+function clearFindGsdDirCache() {
+  _findCache.clear();
+}
+
 /**
  * Read and parse .gsd/state.json. Returns parsed object or null on any failure.
  */
@@ -81,4 +97,4 @@ function getProgress(state) {
   };
 }
 
-module.exports = { findGsdDir, readState, getProgress };
+module.exports = { findGsdDir, clearFindGsdDirCache, readState, getProgress };

package/hooks/lib/semver-sort.cjs

@@ -0,0 +1,20 @@
+// Shared semver sort comparator for use by install.js and gsd-auto-update.cjs
+'use strict';
+
+/**
+ * Compare two semver version strings (e.g. "1.2.3") for sorting.
+ * Returns negative if a < b, positive if a > b, 0 if equal.
+ * @param {string} a
+ * @param {string} b
+ * @returns {number}
+ */
+function semverSortComparator(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) - (pb[i] || 0);
+  }
+  return 0;
+}
+
+module.exports = { semverSortComparator };

package/install.js

@@ -1,24 +1,28 @@
 #!/usr/bin/env node
 // Plugin installer for GSD-Lite
 
-import { existsSync, mkdirSync, cpSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, cpSync, readFileSync, writeFileSync, renameSync, rmSync, readdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { execSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
+const _require = createRequire(import.meta.url);
+const { semverSortComparator } = _require('./hooks/lib/semver-sort.cjs');
 const CLAUDE_DIR = process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude');
 const RUNTIME_DIR = join(CLAUDE_DIR, 'gsd');
 const DRY_RUN = process.argv.includes('--dry-run');
 
 // Single source of truth for hook files (used by copy loop and registration)
-const HOOK_FILES = ['gsd-session-init.cjs', 'gsd-auto-update.cjs', 'gsd-context-monitor.cjs', 'gsd-statusline.cjs'];
+const HOOK_FILES = ['gsd-session-init.cjs', 'gsd-auto-update.cjs', 'gsd-context-monitor.cjs', 'gsd-statusline.cjs', 'gsd-session-stop.cjs'];
 
 // Hook registration config: hookType → { file identifier, matcher, timeout? }
 const HOOK_REGISTRY = [
   { hookType: 'SessionStart', identifier: 'gsd-session-init', matcher: 'startup', timeout: 5 },
   { hookType: 'PostToolUse', identifier: 'gsd-context-monitor', matcher: '*' },
+  { hookType: 'Stop', identifier: 'gsd-session-stop', matcher: '*', timeout: 3 },
 ];
 
 function log(msg) { console.log(msg); }
@@ -115,8 +119,23 @@ export function main() {
   }
 
   // Reset managed runtime directory to avoid stale files on reinstall
+  // Preserve runtime/ subdirectory (update-state.json, update-notification.json)
   if (!DRY_RUN && existsSync(RUNTIME_DIR)) {
+    const runtimeSubdir = join(RUNTIME_DIR, 'runtime');
+    const preserveRuntime = existsSync(runtimeSubdir);
+    let runtimeBackup;
+    if (preserveRuntime) {
+      runtimeBackup = join(RUNTIME_DIR, '..', '.gsd-runtime-backup');
+      try { cpSync(runtimeSubdir, runtimeBackup, { recursive: true }); } catch { runtimeBackup = null; }
+    }
     rmSync(RUNTIME_DIR, { recursive: true, force: true });
+    if (runtimeBackup) {
+      try {
+        mkdirSync(join(RUNTIME_DIR, 'runtime'), { recursive: true });
+        cpSync(runtimeBackup, join(RUNTIME_DIR, 'runtime'), { recursive: true });
+        rmSync(runtimeBackup, { recursive: true, force: true });
+      } catch { /* best effort */ }
+    }
   }
 
   // 1. Commands
@@ -135,6 +154,11 @@ export function main() {
   for (const hookFile of HOOK_FILES) {
     copyFile(join(__dirname, 'hooks', hookFile), join(CLAUDE_DIR, 'hooks', hookFile), `hooks/${hookFile}`);
   }
+  // 5b. Hook library dependencies (e.g. gsd-finder.cjs used by statusline + session-init)
+  const hookLibDir = join(__dirname, 'hooks', 'lib');
+  if (existsSync(hookLibDir)) {
+    copyDir(hookLibDir, join(CLAUDE_DIR, 'hooks', 'lib'), 'hooks/lib → ~/.claude/hooks/lib/');
+  }
 
   // 6. Stable runtime for MCP server
   copyDir(join(__dirname, 'src'), join(RUNTIME_DIR, 'src'), 'runtime/src → ~/.claude/gsd/src/');
@@ -186,12 +210,36 @@ export function main() {
     }
 
     // Register statusLine (top-level setting) and hooks
-    if (!settings.hooks) settings.hooks = {};
-    const statuslinePath = join(CLAUDE_DIR, 'hooks', 'gsd-statusline.cjs');
-    const statusLineRegistered = registerStatusLine(settings, statuslinePath);
+    // When installed as a plugin, hooks are managed by hooks.json via the plugin system.
+    // Only register in settings.json for manual installs to avoid double execution.
+    let statusLineRegistered = false;
     let hooksRegistered = false;
-    for (const config of HOOK_REGISTRY) {
-      if (registerHookEntry(settings.hooks, config)) hooksRegistered = true;
+    if (!isPluginInstall) {
+      if (!settings.hooks) settings.hooks = {};
+      const statuslinePath = join(CLAUDE_DIR, 'hooks', 'gsd-statusline.cjs');
+      statusLineRegistered = registerStatusLine(settings, statuslinePath);
+      for (const config of HOOK_REGISTRY) {
+        if (registerHookEntry(settings.hooks, config)) hooksRegistered = true;
+      }
+    } else {
+      // Clean up stale manual hook entries left from previous install.js runs
+      if (settings.hooks) {
+        let cleaned = false;
+        for (const [hookType, identifier] of [
+          ['PostToolUse', 'gsd-context-monitor'],
+          ['SessionStart', 'gsd-session-init'],
+          ['Stop', 'gsd-session-stop'],
+        ]) {
+          if (Array.isArray(settings.hooks[hookType])) {
+            const before = settings.hooks[hookType].length;
+            settings.hooks[hookType] = settings.hooks[hookType].filter(e =>
+              !e.hooks?.some(h => h.command?.includes(identifier)));
+            if (settings.hooks[hookType].length < before) cleaned = true;
+            if (settings.hooks[hookType].length === 0) delete settings.hooks[hookType];
+          }
+        }
+        if (cleaned) log('  ✓ Removed stale manual hook entries (plugin hooks.json handles registration)');
+      }
     }
 
     const tmpSettings = settingsPath + `.${process.pid}-${Date.now()}.tmp`;
@@ -204,6 +252,35 @@ export function main() {
     log('  [dry-run] Would register MCP server in settings.json');
   }
 
+  // 9. Prune old plugin cache versions (keep latest 3)
+  if (!DRY_RUN && isPluginInstall) {
+    const cacheBase = join(CLAUDE_DIR, 'plugins', 'cache', 'gsd', 'gsd');
+    if (existsSync(cacheBase)) {
+      try {
+        const entries = readdirSync(cacheBase, { withFileTypes: true })
+          .filter(e => e.isDirectory()).map(e => e.name);
+        if (entries.length > 3) {
+          const sorted = entries.slice().sort(semverSortComparator);
+          // Detect versions with active processes to avoid disrupting running sessions
+          let activeVersions;
+          try {
+            const psOut = execSync('ps aux', { stdio: 'pipe', timeout: 5000 }).toString();
+            activeVersions = new Set(entries.filter(v => psOut.includes(`/cache/gsd/gsd/${v}/`)));
+          } catch { activeVersions = new Set(); }
+
+          const toRemove = sorted.slice(0, sorted.length - 3);
+          let pruned = 0;
+          for (const ver of toRemove) {
+            if (activeVersions.has(ver)) continue; // skip versions with running processes
+            rmSync(join(cacheBase, ver), { recursive: true, force: true });
+            pruned++;
+          }
+          if (pruned > 0) log(`  ✓ Pruned ${pruned} old cache version(s), kept latest 3`);
+        }
+      } catch { /* best effort */ }
+    }
+  }
+
   log('\n✓ GSD-Lite installed successfully!');
   log('  Use /gsd:start to begin a new project');
   log('  Use /gsd:resume to continue an existing project');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-lite",
-  "version": "0.5.14",
+  "version": "0.6.0",
   "description": "AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core",
   "type": "module",
   "bin": {

package/references/execution-loop.md

@@ -81,7 +81,7 @@ executor 上下文传递协议 (orchestrator → executor):
 **审查级别运行时重分类:**
 - executor 报告 `contract_changed: true` + 涉及 auth/payment/public API → 自动升级为 L2
 - executor 标注 `[LEVEL-UP]` → 编排器采纳
-- 不主动降级 (安全优先)
+- 不主动降级 (安全优先)，L1 + high confidence + 有 evidence 且无测试失败 → L0 例外
 
 ### 11.6 — 处理 reviewer 结果