gsd-lite 0.7.6 → 0.7.8

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "gsd",
       "source": "./",
       "description": "AI orchestration tool — GSD management shell + Superpowers quality core. 5 commands, 4 agents, 5 workflows, MCP server, context monitoring.",
-      "version": "0.7.6",
+      "version": "0.7.8",
       "keywords": [
         "orchestration",
         "mcp",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core",
   "author": {
     "name": "sdsrss",

package/hooks/gsd-auto-update.cjs

@@ -29,6 +29,35 @@ const LOCK_STALE_MS = 10_000;
 const LOCK_RETRY_MS = 50;
 const LOCK_MAX_RETRIES = 100;
 
+// ── Orphan Detection ───────────────────────────────────────
+// Mirrors gsd-session-init.cjs Phase 0. When the plugin was removed via
+// /plugin uninstall but install.js-written state (hook files, runtime dir,
+// settings.json) survives, getInstallMode() falls through to 'manual' and a
+// new GitHub release would re-trigger install.js — resurrecting the plugin.
+// Guard here so checkForUpdate is a no-op until the orphan is cleaned up
+// (session-init Phase 0 handles the cleanup itself).
+function isOrphan() {
+  const installModeMarker = path.join(claudeDir, 'gsd', '.install-mode');
+  let mode = null;
+  try { mode = fs.readFileSync(installModeMarker, 'utf8').trim(); } catch { /* missing → fall through */ }
+  if (mode === 'manual') return false;
+  if (mode === 'plugin') {
+    try {
+      const data = JSON.parse(fs.readFileSync(path.join(claudeDir, 'plugins', 'installed_plugins.json'), 'utf8'));
+      return !data.plugins?.['gsd@gsd'];
+    } catch { return false; }
+  }
+  // Pre-marker fallback: orphan iff every cached version has .orphaned_at.
+  const cacheBase = path.join(claudeDir, 'plugins', 'cache', 'gsd', 'gsd');
+  if (!fs.existsSync(cacheBase)) return false;
+  try {
+    const dirs = fs.readdirSync(cacheBase, { withFileTypes: true })
+      .filter(e => e.isDirectory() && /^\d+\.\d+\.\d+/.test(e.name));
+    if (dirs.length === 0) return false;
+    return dirs.every(d => fs.existsSync(path.join(cacheBase, d.name, '.orphaned_at')));
+  } catch { return false; }
+}
+
 // ── Main Entry ─────────────────────────────────────────────
 async function checkForUpdate(options = {}) {
   const {
@@ -43,6 +72,10 @@ async function checkForUpdate(options = {}) {
   const installMode = getInstallMode();
 
   try {
+    if (isOrphan()) {
+      if (verbose) console.log('Skipping update check (plugin uninstalled — orphan state)');
+      return null;
+    }
     if (!force && shouldSkipUpdateCheck()) {
       if (verbose) console.log('Skipping update check (dev mode or auto-update in progress)');
       return null;
@@ -643,6 +676,7 @@ module.exports = {
   compareVersions,
   getInstallMode,
   isDevMode,
+  isOrphan,
   shouldCheck,
   shouldSkipUpdateCheck,
   validateExtractedPackage,

package/hooks/gsd-session-init.cjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 // GSD-Lite SessionStart hook
+// 0. Orphan self-cleanup: if /plugin uninstall removed the plugin but left
+//    install.js-written state behind, run inline cleanup and exit.
 // 1. Cleans up stale temp files (throttled to once/day).
 // 2. Auto-registers statusLine in settings.json if not already configured.
 // 3. Self-heals .mcp.json if missing.
@@ -16,6 +18,143 @@ const os = require('node:os');
 const claudeDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
 const settingsPath = path.join(claudeDir, 'settings.json');
 
+// ── Phase 0: Orphan self-cleanup ──
+// /plugin uninstall only touches installed_plugins.json + enabledPlugins; it
+// leaves hook scripts, settings.json registrations, the runtime dir, and the
+// composite statusline registry in place — so hooks keep firing and Phases
+// 2/5 below will self-heal the stale state on every session. Detect that case
+// here and remove our footprint before any other phase runs.
+function isOrphan() {
+  // .install-mode marker (written by install.js ≥ 0.7.7) is authoritative.
+  const installModeMarker = path.join(claudeDir, 'gsd', '.install-mode');
+  let mode = null;
+  try { mode = fs.readFileSync(installModeMarker, 'utf8').trim(); } catch { /* missing → fall through */ }
+  if (mode === 'manual') return false; // npx install never enters /plugin uninstall path
+  if (mode === 'plugin') {
+    try {
+      const data = JSON.parse(fs.readFileSync(path.join(claudeDir, 'plugins', 'installed_plugins.json'), 'utf8'));
+      return !data.plugins?.['gsd@gsd'];
+    } catch { return false; } // registry unreadable → don't assume orphan
+  }
+  // Pre-marker installs: fallback heuristic. Claude Code stamps
+  // .orphaned_at inside cache version dirs when the entry is removed from
+  // installed_plugins.json. Orphan iff every cached version has the marker.
+  const cacheBase = path.join(claudeDir, 'plugins', 'cache', 'gsd', 'gsd');
+  if (!fs.existsSync(cacheBase)) return false;
+  try {
+    const dirs = fs.readdirSync(cacheBase, { withFileTypes: true })
+      .filter(e => e.isDirectory() && /^\d+\.\d+\.\d+/.test(e.name));
+    if (dirs.length === 0) return false;
+    return dirs.every(d => fs.existsSync(path.join(cacheBase, d.name, '.orphaned_at')));
+  } catch { return false; }
+}
+
+function atomicWriteJson(filePath, value) {
+  const tmp = filePath + `.gsd-orphan-${process.pid}-${Date.now()}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n');
+  fs.renameSync(tmp, filePath);
+}
+
+function cleanupOrphan() {
+  // 1. Composite statusLine registry — call removeProvider BEFORE deleting
+  //    the lib file it lives in.
+  try {
+    const compositeLib = path.join(claudeDir, 'hooks', 'lib', 'statusline-composite.cjs');
+    if (fs.existsSync(compositeLib)) {
+      const { removeProvider } = require(compositeLib);
+      removeProvider();
+    }
+  } catch { /* best effort */ }
+
+  // 2. settings.json — mirror uninstall.js logic.
+  try {
+    const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+    let changed = false;
+    for (const name of ['gsd', 'gsd-lite']) {
+      if (settings.mcpServers?.[name]) { delete settings.mcpServers[name]; changed = true; }
+      const pluginKey = `${name}@${name}`;
+      if (settings.enabledPlugins?.[pluginKey]) { delete settings.enabledPlugins[pluginKey]; changed = true; }
+      if (settings.extraKnownMarketplaces?.[name]) { delete settings.extraKnownMarketplaces[name]; changed = true; }
+    }
+    if (settings.extraKnownMarketplaces && Object.keys(settings.extraKnownMarketplaces).length === 0) {
+      delete settings.extraKnownMarketplaces;
+    }
+    if (settings.statusLine?.command?.includes('gsd-statusline')
+        || settings.statusLine?.command?.includes('context-monitor.js')) {
+      delete settings.statusLine;
+      changed = true;
+    }
+    if (settings.hooks) {
+      if (typeof settings.hooks.StatusLine === 'string'
+          && (settings.hooks.StatusLine.includes('gsd-statusline')
+              || settings.hooks.StatusLine.includes('context-monitor.js'))) {
+        delete settings.hooks.StatusLine;
+        changed = true;
+      }
+      for (const [hookType, identifier] of [
+        ['PostToolUse', 'gsd-context-monitor'],
+        ['PostToolUse', 'context-monitor.js'],
+        ['SessionStart', 'gsd-session-init'],
+        ['Stop', 'gsd-session-stop'],
+      ]) {
+        if (Array.isArray(settings.hooks[hookType])) {
+          const before = settings.hooks[hookType].length;
+          settings.hooks[hookType] = settings.hooks[hookType].filter(e =>
+            !e.hooks?.some(h => h.command?.includes(identifier)));
+          if (settings.hooks[hookType].length < before) changed = true;
+          if (settings.hooks[hookType].length === 0) delete settings.hooks[hookType];
+        } else if (typeof settings.hooks[hookType] === 'string'
+            && settings.hooks[hookType].includes(identifier)) {
+          delete settings.hooks[hookType];
+          changed = true;
+        }
+      }
+    }
+    if (changed) atomicWriteJson(settingsPath, settings);
+  } catch { /* best effort */ }
+
+  // 3. plugins/known_marketplaces.json
+  try {
+    const known = path.join(claudeDir, 'plugins', 'known_marketplaces.json');
+    const data = JSON.parse(fs.readFileSync(known, 'utf8'));
+    let dirty = false;
+    for (const n of ['gsd', 'gsd-lite']) {
+      if (n in data) { delete data[n]; dirty = true; }
+    }
+    if (dirty) atomicWriteJson(known, data);
+  } catch { /* best effort */ }
+
+  // 4. Hook script files
+  for (const name of ['context-monitor.js', 'gsd-statusline.cjs', 'gsd-context-monitor.cjs', 'gsd-auto-update.cjs', 'gsd-session-stop.cjs']) {
+    try { fs.rmSync(path.join(claudeDir, 'hooks', name), { force: true }); } catch { /* best effort */ }
+  }
+  // 5. Hook lib files (GSD-owned only — don't touch other plugins' libs)
+  for (const lib of ['gsd-finder.cjs', 'statusline-composite.cjs', 'semver-sort.cjs']) {
+    try { fs.rmSync(path.join(claudeDir, 'hooks', 'lib', lib), { force: true }); } catch { /* best effort */ }
+  }
+  // 6. Runtime dir + plugin marketplace + cache dirs (current + legacy names)
+  for (const dir of [
+    path.join(claudeDir, 'gsd'),
+    path.join(claudeDir, 'gsd-lite'),
+    path.join(claudeDir, 'plugins', 'marketplaces', 'gsd'),
+    path.join(claudeDir, 'plugins', 'marketplaces', 'gsd-lite'),
+    path.join(claudeDir, 'plugins', 'cache', 'gsd'),
+    path.join(claudeDir, 'plugins', 'cache', 'gsd-lite'),
+  ]) {
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+  // 7. Self-removal — delete this script last. The running process keeps the
+  //    file handle until exit (POSIX); on Windows this may fail silently and
+  //    Phase 0's next-session check will retry.
+  try { fs.rmSync(path.join(claudeDir, 'hooks', 'gsd-session-init.cjs'), { force: true }); } catch { /* best effort */ }
+}
+
+if (isOrphan()) {
+  console.log('⚠ GSD-Lite plugin uninstalled — cleaning up orphaned hooks and runtime.');
+  try { cleanupOrphan(); } catch { /* best effort — never block session start */ }
+  process.exit(0);
+}
+
 // Safety: exit after 4s regardless (hook timeout is 5s)
 setTimeout(() => process.exit(0), 4000).unref();
 

package/install.js

@@ -210,7 +210,24 @@ export function main() {
 
   // 6. Stable runtime for MCP server
   copyDir(join(__dirname, 'src'), join(RUNTIME_DIR, 'src'), 'runtime/src → ~/.claude/gsd/src/');
-  copyFile(join(__dirname, 'package.json'), join(RUNTIME_DIR, 'package.json'), 'runtime/package.json → ~/.claude/gsd/package.json');
+  // Write a sanitized package.json: strip dev-only npm lifecycle scripts
+  // (prepare/prepublishOnly/version use POSIX shell + dev tooling absent from
+  // the runtime). Leaving them in means a later manual `npm install` in
+  // ~/.claude/gsd fails under cmd.exe on Windows (issue #2).
+  if (DRY_RUN) {
+    log('  [dry-run] Would write runtime/package.json (dev scripts stripped)');
+  } else {
+    const runtimePkg = JSON.parse(readFileSync(join(__dirname, 'package.json'), 'utf-8'));
+    delete runtimePkg.scripts;
+    mkdirSync(RUNTIME_DIR, { recursive: true });
+    writeFileSync(join(RUNTIME_DIR, 'package.json'), JSON.stringify(runtimePkg, null, 2) + '\n');
+    log('  ✓ runtime/package.json → ~/.claude/gsd/package.json (scripts stripped)');
+  }
+  // Copy uninstall.js so the SessionStart hook's Phase 0 orphan-cleanup can
+  // spawn it when /plugin uninstall has removed the plugin without running our
+  // uninstaller. Without this, hooks/runtime/settings.json entries written by
+  // install.js outlive the plugin and keep firing.
+  copyFile(join(__dirname, 'uninstall.js'), join(RUNTIME_DIR, 'uninstall.js'), 'runtime/uninstall.js → ~/.claude/gsd/uninstall.js');
   // Copy lock file so `npm ci` works when node_modules are not present (npx scenario)
   const lockFile = join(__dirname, 'package-lock.json');
   if (existsSync(lockFile)) {
@@ -225,7 +242,12 @@ export function main() {
     log('  ⧗ Installing runtime dependencies...');
     const lockFile = join(RUNTIME_DIR, 'package-lock.json');
     const hasLockFile = existsSync(lockFile);
-    const installCmd = hasLockFile ? 'npm ci --omit=dev' : 'npm install --omit=dev --no-fund --no-audit';
+    // --ignore-scripts: the runtime install only needs node_modules. Skipping
+    // lifecycle scripts avoids running the dev-only POSIX `prepare` git-hook
+    // setup, which fails under cmd.exe on Windows (issue #2).
+    const installCmd = hasLockFile
+      ? 'npm ci --omit=dev --ignore-scripts'
+      : 'npm install --omit=dev --no-fund --no-audit --ignore-scripts';
     try {
       execSync(installCmd, { cwd: RUNTIME_DIR, stdio: 'pipe' });
       log('  ✓ runtime dependencies installed');
@@ -289,6 +311,27 @@ export function main() {
     if (statusLineRegistered || hooksRegistered) {
       log('  ✓ GSD-Lite hooks registered in settings.json');
     }
+
+    // Record install mode so SessionStart's Phase 0 orphan-cleanup can
+    // distinguish "plugin uninstalled" from "npx install". Without this marker
+    // the hook falls back to the .orphaned_at cache heuristic, which is fine
+    // for pre-marker users but more guess-y.
+    try {
+      const installModeMarker = join(RUNTIME_DIR, '.install-mode');
+      writeFileSync(installModeMarker, (isPluginInstall ? 'plugin' : 'manual') + '\n');
+    } catch { /* best effort — marker missing falls back to heuristic */ }
+
+    // Clear stale .orphaned_at from the current plugin cache version, in case
+    // the user previously uninstalled (Claude Code stamps it) and is now
+    // reinstalling via /plugin. Leaving it would make orphan-cleanup mis-fire
+    // on the next session.
+    if (isPluginInstall) {
+      try {
+        const currentVersion = JSON.parse(readFileSync(join(__dirname, 'package.json'), 'utf-8')).version;
+        const orphanMarker = join(CLAUDE_DIR, 'plugins', 'cache', 'gsd', 'gsd', currentVersion, '.orphaned_at');
+        if (existsSync(orphanMarker)) rmSync(orphanMarker, { force: true });
+      } catch { /* best effort */ }
+    }
   } else {
     log('  [dry-run] Would register MCP server in settings.json');
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-lite",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core",
   "type": "module",
   "bin": {