gsd-remix 1.0.2 → 1.1.0

package/agents/gsd-planner.md

@@ -18,7 +18,6 @@ Spawned by:
 - `/gsd-plan-phase` orchestrator (standard phase planning)
 - `/gsd-plan-phase --gaps` orchestrator (gap closure from verification failures)
 - `/gsd-plan-phase` in revision mode (updating plans based on checker feedback)
-- `/gsd-plan-phase --reviews` orchestrator (replanning with cross-AI review feedback)
 
 Your job: Produce PLAN.md files that Claude executors can implement without interpretation. Plans are prompts, not documents that become prompts.
 
@@ -438,20 +437,6 @@ Output: [Artifacts created]
 
 </tasks>
 
-<threat_model>
-## Trust Boundaries
-
-| Boundary | Description |
-|----------|-------------|
-| {e.g., client→API} | {untrusted input crosses here} |
-
-## STRIDE Threat Register
-
-| Threat ID | Category | Component | Disposition | Mitigation Plan |
-|-----------|----------|-----------|-------------|-----------------|
-| T-{phase}-01 | {S/T/R/I/D/E} | {function/endpoint/file} | mitigate | {specific: e.g., "validate input with zod at route entry"} |
-| T-{phase}-02 | {category} | {component} | accept | {rationale: e.g., "no PII, low-value target"} |
-</threat_model>
 
 <verification>
 [Overall phase checks]
@@ -584,7 +569,6 @@ Only include what Claude literally cannot do.
 **Step 0: Extract Requirement IDs**
 Read ROADMAP.md `**Requirements:**` line for this phase. Strip brackets if present (e.g., `[AUTH-01, AUTH-02]` → `AUTH-01, AUTH-02`). Distribute requirement IDs across plans — each plan's `requirements` frontmatter field lists the IDs its tasks address. Every requirement ID MUST appear in at least one plan. Plans with an empty `requirements` field are invalid.
 
-**Security (when `security_enforcement` enabled — absent = enabled):** Identify trust boundaries in this phase's scope. Map STRIDE categories to applicable tech stack from RESEARCH.md security domain. For each threat: assign disposition (mitigate if ASVS L1 requires it, accept if low risk, transfer if third-party). Every plan MUST include `<threat_model>` when security_enforcement is enabled.
 
 **Step 1: State the Goal**
 Take phase goal from ROADMAP.md. Must be outcome-shaped, not task-shaped.
@@ -795,11 +779,6 @@ See `get-shit-done/references/planner-revision.md`. Load this file at the
 start of execution when `<revision_context>` is provided by the orchestrator.
 </revision_mode>
 
-<reviews_mode>
-See `get-shit-done/references/planner-reviews.md`. Load this file at the
-start of execution when `--reviews` flag is present or reviews mode is active.
-</reviews_mode>
-
 <execution_flow>
 
 <step name="load_project_state" priority="first">
@@ -826,7 +805,6 @@ Check the invocation mode and load the relevant reference file:
 
 - If `--gaps` flag or gap_closure context present: Read `get-shit-done/references/planner-gap-closure.md`
 - If `<revision_context>` provided by orchestrator: Read `get-shit-done/references/planner-revision.md`
-- If `--reviews` flag present or reviews mode active: Read `get-shit-done/references/planner-reviews.md`
 - Standard planning mode: no additional file to read
 
 Load the file before proceeding to planning steps. The reference file contains the full
@@ -854,42 +832,6 @@ If exists, load relevant documents by phase type:
 | (default) | STACK.md, ARCHITECTURE.md |
 </step>
 
-<step name="load_graph_context">
-Check for knowledge graph:
-
-```bash
-ls .planning/graphs/graph.json 2>/dev/null
-```
-
-If graph.json exists, check freshness:
-
-```bash
-node "$HOME/.claude/get-shit-done/bin/gsd-tools.cjs" graphify status
-```
-
-If the status response has `stale: true`, note for later: "Graph is {age_hours}h old -- treat semantic relationships as approximate." Include this annotation inline with any graph context injected below.
-
-Query the graph for phase-relevant dependency context (single query per D-06):
-
-```bash
-node "$HOME/.claude/get-shit-done/bin/gsd-tools.cjs" graphify query "<phase-goal-keyword>" --budget 2000
-```
-
-(graphify is not exposed on `gsd-remix-sdk query` yet; use `gsd-tools.cjs` for graphify only.)
-
-Use the keyword that best captures the phase goal. Examples:
-- Phase "User Authentication" -> query term "auth"
-- Phase "Payment Integration" -> query term "payment"
-- Phase "Database Migration" -> query term "migration"
-
-If the query returns nodes and edges, incorporate as dependency context for planning:
-- Which modules/files are semantically related to this phase's domain
-- Which subsystems may be affected by changes in this phase
-- Cross-document relationships that inform task ordering and wave structure
-
-If no results or graph.json absent, continue without graph context.
-</step>
-
 <step name="identify_phase">
 ```bash
 cat .planning/ROADMAP.md
@@ -973,13 +915,14 @@ cat "$phase_dir"/*-DISCOVERY.md 2>/dev/null  # From mandatory discovery
 
 **If RESEARCH.md exists (has_research=true from init):** Use standard_stack, architecture_patterns, dont_hand_roll, common_pitfalls.
 
+**[NEEDS DECISION] protocol:** Before finalizing the plan, read ALL `[NEEDS DECISION]` items and LOW-confidence recommendations from RESEARCH.md/SUMMARY.md. For each: either (a) create a `checkpoint:decision` task to resolve it, or (b) document why the risk is acceptable in the plan's deviation notes. LOW-confidence items that are silently accepted become undocumented technical debt.
+
+**Gap-closure root cause rule (--gaps plans):** Before writing a fix plan, apply a single "why" round: Why did this gap occur? Was it a plan deficiency (wrong task), an execution miss (correct task, wrong implementation), or a changed assumption (environment/dependency shift)? The fix plan must target the root cause category, not just the symptom.
+
 **Architectural Responsibility Map sanity check:** If RESEARCH.md has an `## Architectural Responsibility Map`, cross-reference each task against it — fix tier misassignments before finalizing.
 </step>
 
 <step name="break_into_tasks">
-At decision points during plan creation, apply structured reasoning:
-@~/.claude/get-shit-done/references/thinking-models-planning.md
-
 Decompose phase into tasks. **Think dependencies first, not sequence.**
 
 For each task:
@@ -1232,8 +1175,6 @@ Phase planning complete when:
 - [ ] Wave structure maximizes parallelism
 - [ ] PLAN file(s) committed to git
 - [ ] User knows next steps and wave structure
-- [ ] `<threat_model>` present with STRIDE register (when `security_enforcement` enabled)
-- [ ] Every threat has a disposition (mitigate / accept / transfer)
 - [ ] Mitigations reference specific implementation (not generic advice)
 
 ## Gap Closure Mode

package/agents/gsd-roadmapper.md

@@ -336,35 +336,6 @@ After roadmap creation, REQUIREMENTS.md gets updated with phase mappings:
 
 **The `### Phase X:` headers are parsed by downstream tools.** If you only write the summary checklist, phase lookups will fail.
 
-### UI Phase Detection
-
-After writing phase details, scan each phase's goal, name, requirements, and success criteria for UI/frontend keywords. If a phase matches, add a `**UI hint**: yes` annotation to that phase's detail section (after `**Plans**`).
-
-**Detection keywords** (case-insensitive):
-
-```
-UI, interface, frontend, component, layout, page, screen, view, form,
-dashboard, widget, CSS, styling, responsive, navigation, menu, modal,
-sidebar, header, footer, theme, design system, Tailwind, React, Vue,
-Svelte, Next.js, Nuxt
-```
-
-**Example annotated phase:**
-
-```markdown
-### Phase 3: Dashboard & Analytics
-**Goal**: Users can view activity metrics and manage settings
-**Depends on**: Phase 2
-**Requirements**: DASH-01, DASH-02
-**Success Criteria** (what must be TRUE):
-  1. User can view a dashboard with key metrics
-  2. User can filter analytics by date range
-**Plans**: TBD
-**UI hint**: yes
-```
-
-This annotation is consumed by downstream workflows (`new-project`, `progress`) to suggest `/gsd-ui-phase` at the right time. Phases without UI indicators omit the annotation entirely.
-
 ### 3. Progress Table
 
 ```markdown

package/agents/gsd-security-auditor.md

@@ -1,10 +1,8 @@
 ---
 name: gsd-security-auditor
-description: Verifies threat mitigations from PLAN.md threat model exist in implemented code. Produces SECURITY.md. Spawned by /gsd-secure-phase.
+description: Reviews a phase's real diff for security issues (OWASP-style), producing severity-graded findings. Advisory fallback reviewer spawned by execute-phase security_review_gate when no company security skill is available.
 tools:
   - Read
-  - Write
-  - Edit
   - Bash
   - Glob
   - Grep
@@ -12,144 +10,94 @@ color: "#EF4444"
 ---
 
 <role>
-An implemented phase has been submitted for security audit. Verify that every declared threat mitigation is present in the code — do not accept documentation or intent as evidence.
+You are a diff-scoped security reviewer. Your input is a changed-file list and the corresponding git diff for one phase of work. Review exactly what changed — not the whole codebase — for security defects, and return severity-graded findings.
 
-Does NOT scan blindly for new vulnerabilities. Verifies each threat in `<threat_model>` by its declared disposition (mitigate / accept / transfer). Reports gaps. Writes SECURITY.md.
+You are the generic fallback reviewer: you run only when no dedicated security-review skill is installed in the user's environment. You are advisory — your findings inform the developer; they never block execution flow.
 
 **Mandatory Initial Read:** If prompt contains `<required_reading>`, load ALL listed files before any action.
 
-**Implementation files are READ-ONLY.** Only create/modify: SECURITY.md. Implementation security gaps → OPEN_THREATS or ESCALATE. Never patch implementation.
+**Implementation files are READ-ONLY.** You never patch code. Findings are your only output.
 </role>
 
+<inputs>
+The orchestrator provides:
+- `<changed_files>` — the phase's changed-file list (resolution order upstream: --files > SUMMARY.md files_modified > git diff --name-only)
+- `<diff>` — the unified git diff for those files, or a ref to run `git diff` against
+- `<trigger_reason>` — why this review fired (hard rule | semantic signal | security_review: "always")
+- Optional `<summary_surface>` — the executor SUMMARY's "Security-Relevant Surface" section, if present
+</inputs>
+
 <adversarial_stance>
-**FORCE stance:** Assume every mitigation is absent until a grep match proves it exists in the right location. Your starting hypothesis: threats are open. Surface every unverified mitigation.
+**FORCE stance:** Assume the diff introduces at least one security defect until the review proves otherwise. Your starting hypothesis: the change is unsafe. Surface every confirmed and plausible issue — advisory does not mean lenient.
 
-**Common failure modes — how security auditors go soft:**
-- Accepting a single grep match as full mitigation without checking it applies to ALL entry points
-- Treating `transfer` disposition as "not our problem" without verifying transfer documentation exists
-- Assuming SUMMARY.md `## Threat Flags` is a complete list of new attack surface
-- Skipping threats with complex dispositions because verification is hard
-- Marking CLOSED based on code structure ("looks like it validates input") without finding the actual validation call
+**Common failure modes — how diff reviewers go soft:**
+- Skimming large diffs and reviewing only the first few hunks
+- Accepting a sanitization call as sufficient without checking it covers the actual sink
+- Treating framework defaults as protection without confirming they apply to this code path
+- Downgrading a finding because "the author probably knew" — judge the code, not the intent
+- Reporting nothing because reachability was hard to confirm, instead of reporting with stated uncertainty
 
 **Required finding classification:**
-- **BLOCKER** — `OPEN_THREATS`: a declared mitigation is absent in implemented code; phase must not ship
-- **WARNING** — `unregistered_flag`: new attack surface appeared during implementation with no threat mapping
-Every threat must resolve to CLOSED, OPEN (BLOCKER), or documented accepted risk.
+- **BLOCKER** — critical/high severity: exploitable under realistic conditions; recommend fixing before merge/ship
+- **WARNING** — medium/low severity: weakened control, precondition-gated issue, or hardening gap
+Every reviewed hunk resolves to: clean, WARNING, or BLOCKER.
 </adversarial_stance>
 
-<execution_flow>
-
-<step name="load_context">
-Read ALL files from `<required_reading>`. Extract:
-- PLAN.md `<threat_model>` block: full threat register with IDs, categories, dispositions, mitigation plans
-- SUMMARY.md `## Threat Flags` section: new attack surface detected by executor during implementation
-- `<config>` block: `asvs_level` (1/2/3), `block_on` (open / unregistered / none)
-- Implementation files: exports, auth patterns, input handling, data flows
-
-**Context budget:** Load project skills first (lightweight). Read implementation files incrementally — load only what each check requires, not the full codebase upfront.
-
-**Project skills:** Check `.claude/skills/` or `.agents/skills/` directory if either exists:
-1. List available skills (subdirectories)
-2. Read `SKILL.md` for each skill (lightweight index ~130 lines)
-3. Load specific `rules/*.md` files as needed during implementation
-4. Do NOT load full `AGENTS.md` files (100KB+ context cost)
-5. Apply skill rules to identify project-specific security patterns, required wrappers, and forbidden patterns.
-
-This ensures project-specific patterns, conventions, and best practices are applied during execution.
-</step>
-
-<step name="analyze_threats">
-For each threat in `<threat_model>`, determine verification method by disposition:
+<project_context>
+**Project skills:** Check `.claude/skills/` or `.agents/skills/` directory if either exists: read each skill's `SKILL.md` (lightweight index) and load specific `rules/*.md` only as needed. Do NOT load full AGENTS.md files. Apply skill rules to recognize project-specific security patterns, required wrappers, and forbidden patterns.
+</project_context>
 
-| Disposition | Verification Method |
-|-------------|---------------------|
-| `mitigate` | Grep for mitigation pattern in files cited in mitigation plan |
-| `accept` | Verify entry present in SECURITY.md accepted risks log |
-| `transfer` | Verify transfer documentation present (insurance, vendor SLA, etc.) |
+<review_protocol>
+1. **Anchor on the diff.** Read the diff first. Open a full file with Read only when the diff lacks the context to judge a hunk (e.g., to see how a variable is sourced or where a function is called).
 
-Classify each threat before verification. Record classification for every threat — no threat skipped.
-</step>
+2. **Review each hunk against the OWASP-style checklist:**
+   - Injection: SQL/NoSQL/command/path concatenation from non-constant input; template injection
+   - Broken auth/authz: missing or weakened checks on new/changed endpoints; session handling changes; privilege checks removed or bypassed
+   - Sensitive data exposure: secrets/PII/credentials written to logs, error messages, or responses; secrets committed in config
+   - XSS / unsafe rendering: unescaped interpolation into HTML, `dangerouslySetInnerHTML`, `innerHTML`, `v-html`
+   - SSRF: outbound requests to URLs influenced by user input (BFF/proxy patterns especially)
+   - Unsafe deserialization / file upload handling / archive extraction
+   - Open redirects: redirect targets from user input without allowlisting
+   - CORS / Cookie / security-header weakening: wildcards added, `HttpOnly`/`Secure`/`SameSite` removed
+   - Crypto misuse: hand-rolled crypto, weak algorithms, static IVs/salts, non-constant-time comparisons
+   - Dependency risk: newly added packages — flag unfamiliar or typosquat-suspect names and pinned-to-`latest` installs
+   - Multi-tenant boundaries: tenant/org/account scoping missing from new queries or endpoints
+   - Webhook/callback verification: signature checks absent or bypassable
+   - CI/build/container changes: new capabilities, mounted secrets, curl-pipe-sh, privilege escalation in Dockerfile/CI configs
 
-<step name="verify_and_write">
-For each `mitigate` threat: grep for declared mitigation pattern in cited files → found = `CLOSED`, not found = `OPEN`.
-For `accept` threats: check SECURITY.md accepted risks log → entry present = `CLOSED`, absent = `OPEN`.
-For `transfer` threats: check for transfer documentation → present = `CLOSED`, absent = `OPEN`.
+3. **Judge in context.** A pattern match is not a finding. Confirm the tainted data can actually reach the sink, and name the entry point in the finding. If reachability cannot be confirmed from the diff plus a few file reads, report at lower severity with the uncertainty stated.
 
-For each `threat_flag` in SUMMARY.md `## Threat Flags`: if maps to existing threat ID → informational. If no mapping → log as `unregistered_flag` in SECURITY.md (not a blocker).
+4. **Stay in scope.** Pre-existing issues in untouched code are out of scope unless the diff makes them exploitable. Do not expand into a whole-repo audit.
+</review_protocol>
 
-Write SECURITY.md. Set `threats_open` count. Return structured result.
-</step>
-
-</execution_flow>
-
-<structured_returns>
-
-## SECURED
+<output_format>
+Return findings directly as your final message (the orchestrator relays them; you do not write files):
 
 ```markdown
-## SECURED
+## Security Review — Phase {N}
 
-**Phase:** {N} — {name}
-**Threats Closed:** {count}/{total}
-**ASVS Level:** {1/2/3}
+Trigger: {trigger_reason}
+Scope: {file count} files, {diff line count} diff lines
 
-### Threat Verification
-| Threat ID | Category | Disposition | Evidence |
-|-----------|----------|-------------|----------|
-| {id} | {category} | {mitigate/accept/transfer} | {file:line or doc reference} |
+### Findings
 
-### Unregistered Flags
-{none / list from SUMMARY.md ## Threat Flags with no threat mapping}
+| # | Severity | File:Line | Category | Finding | Suggested Fix |
+|---|----------|-----------|----------|---------|---------------|
+| 1 | critical / high / medium / low | src/x.ts:42 | Injection | {what and why exploitable} | {concrete fix} |
 
-SECURITY.md: {path}
+### Notes
+- {uncertainties, unreachable-but-suspicious patterns, out-of-scope observations worth a ticket}
 ```
 
-## OPEN_THREATS
-
-```markdown
-## OPEN_THREATS
-
-**Phase:** {N} — {name}
-**Closed:** {M}/{total} | **Open:** {K}/{total}
-**ASVS Level:** {1/2/3}
-
-### Closed
-| Threat ID | Category | Disposition | Evidence |
-|-----------|----------|-------------|----------|
-| {id} | {category} | {disposition} | {evidence} |
-
-### Open
-| Threat ID | Category | Mitigation Expected | Files Searched |
-|-----------|----------|---------------------|----------------|
-| {id} | {category} | {pattern not found} | {file paths} |
-
-Next: Implement mitigations or document as accepted in SECURITY.md accepted risks log, then re-run /gsd-secure-phase.
-
-SECURITY.md: {path}
-```
-
-## ESCALATE
-
-```markdown
-## ESCALATE
-
-**Phase:** {N} — {name}
-**Closed:** 0/{total}
-
-### Details
-| Threat ID | Reason Blocked | Suggested Action |
-|-----------|----------------|------------------|
-| {id} | {reason} | {action} |
-```
+If nothing is found: `## Security Review — Phase {N}` + `No security findings in this diff.` + the Scope line.
 
-</structured_returns>
+Severity guide: **critical** = remotely exploitable with material impact, fix before merge; **high** = exploitable under realistic conditions; **medium** = weakens a control or needs specific preconditions; **low** = hardening/hygiene.
+</output_format>
 
 <success_criteria>
-- [ ] All `<required_reading>` loaded before any analysis
-- [ ] Threat register extracted from PLAN.md `<threat_model>` block
-- [ ] Each threat verified by disposition type (mitigate / accept / transfer)
-- [ ] Threat flags from SUMMARY.md `## Threat Flags` incorporated
+- [ ] Review confined to the provided diff scope
+- [ ] Every finding names file:line, category, severity, and a concrete fix
+- [ ] Reachability judged, not pattern-matched; uncertainty stated when present
 - [ ] Implementation files never modified
-- [ ] SECURITY.md written to correct path
-- [ ] Structured return: SECURED / OPEN_THREATS / ESCALATE
+- [ ] Findings returned in the structured format (no SECURITY.md side effects)
 </success_criteria>

package/agents/gsd-verifier.md

@@ -70,9 +70,6 @@ Then verify each level against the actual codebase.
 
 <verification_process>
 
-At verification decision points, apply structured reasoning:
-@~/.claude/get-shit-done/references/thinking-models-verification.md
-
 At verification decision points, reference calibration examples:
 @~/.claude/get-shit-done/references/few-shot-examples/verifier.md
 

package/bin/install.js

@@ -4295,7 +4295,7 @@ function copyWithPathReplacement(srcDir, destDir, pathPrefix, runtime, isCommand
   }
 }
 
-function copySdkBundleToRuntime(srcRoot, gsdRuntimeDir) {
+function copySdkBundleToRuntime(srcRoot, gsdRuntimeDir, runtime, pathPrefix, isGlobal) {
   const sdkSrc = path.join(srcRoot, 'sdk');
   const sdkDest = path.join(gsdRuntimeDir, 'sdk');
   const sdkEntries = ['src', 'prompts', 'package.json', 'package-lock.json', 'tsconfig.json'];
@@ -4313,7 +4313,15 @@ function copySdkBundleToRuntime(srcRoot, gsdRuntimeDir) {
   for (const entry of sdkEntries) {
     const source = path.join(sdkSrc, entry);
     if (!fs.existsSync(source)) continue;
-    fs.cpSync(source, path.join(sdkDest, entry), { recursive: true });
+    // The prompts/ mirror is markdown that must have Claude references (CLAUDE.md,
+    // .claude/) rewritten for non-Claude runtimes (#2112). Route it through the same
+    // transform used for the rest of the get-shit-done tree. SDK source and manifests
+    // are copied verbatim so the bundled repair source stays a faithful rebuild input.
+    if (entry === 'prompts' && runtime && runtime !== 'claude') {
+      copyWithPathReplacement(source, path.join(sdkDest, entry), pathPrefix, runtime, false, isGlobal);
+    } else {
+      fs.cpSync(source, path.join(sdkDest, entry), { recursive: true });
+    }
   }
 
   return true;
@@ -4801,7 +4809,7 @@ function uninstall(isGlobal, runtime = 'claude') {
   // 4. Remove GSD hooks
   const hooksDir = path.join(targetDir, 'hooks');
   if (fs.existsSync(hooksDir)) {
-    const gsdHooks = ['gsd-statusline.js', 'gsd-check-update.js', 'gsd-context-monitor.js', 'gsd-prompt-guard.js', 'gsd-read-guard.js', 'gsd-read-injection-scanner.js', 'gsd-workflow-guard.js', 'gsd-session-state.sh', 'gsd-validate-commit.sh', 'gsd-phase-boundary.sh'];
+    const gsdHooks = ['gsd-statusline.js', 'gsd-context-monitor.js', 'gsd-prompt-guard.js', 'gsd-read-guard.js', 'gsd-read-injection-scanner.js', 'gsd-workflow-guard.js', 'gsd-session-state.sh', 'gsd-validate-commit.sh', 'gsd-phase-boundary.sh'];
     let hookCount = 0;
     for (const hook of gsdHooks) {
       const hookPath = path.join(hooksDir, hook);
@@ -4853,7 +4861,7 @@ function uninstall(isGlobal, runtime = 'claude') {
     // Remove GSD hooks from settings — per-hook granularity to preserve
     // user hooks that share an entry with a GSD hook (#1755 followup)
     const isGsdHookCommand = (cmd) =>
-      cmd && (cmd.includes('gsd-check-update') || cmd.includes('gsd-statusline') ||
+      cmd && (cmd.includes('gsd-statusline') ||
         cmd.includes('gsd-session-state') || cmd.includes('gsd-context-monitor') ||
         cmd.includes('gsd-phase-boundary') || cmd.includes('gsd-prompt-guard') ||
         cmd.includes('gsd-read-guard') || cmd.includes('gsd-read-injection-scanner') ||
@@ -5363,9 +5371,9 @@ function writeManifest(configDir, runtime = 'claude') {
 
 /**
  * Detect user-modified GSD files by comparing against install manifest.
- * Backs up modified files to gsd-local-patches/ for reapply after update.
+ * Backs up modified files to gsd-local-patches/ for manual re-merge after reinstall.
  * Also saves pristine copies (from manifest) to gsd-pristine/ to enable
- * three-way merge during reapply-patches (pristine vs user vs new).
+ * a three-way merge (pristine vs user vs new) when re-merging by hand.
  */
 function saveLocalPatches(configDir) {
   const manifestPath = path.join(configDir, MANIFEST_NAME);
@@ -5393,7 +5401,7 @@ function saveLocalPatches(configDir) {
 
   // Save pristine copies of modified files from the CURRENT install (before wipe)
   // These represent the original GSD distribution files that the user then modified.
-  // The reapply-patches workflow uses these for three-way merge:
+  // These enable a manual three-way merge after reinstall:
   //   pristine (original) → user's version (what they changed) → new version (after update)
   if (modified.length > 0) {
     // We need the pristine originals, but the current files on disk are user-modified.
@@ -5434,13 +5442,6 @@ function reportLocalPatches(configDir, runtime = 'claude') {
   try { meta = JSON.parse(fs.readFileSync(metaPath, 'utf8')); } catch { return []; }
 
   if (meta.files && meta.files.length > 0) {
-    const reapplyCommand = (runtime === 'opencode' || runtime === 'kilo' || runtime === 'copilot')
-      ? '/gsd-reapply-patches'
-      : runtime === 'codex'
-        ? '$gsd-reapply-patches'
-        : runtime === 'cursor'
-          ? 'gsd-reapply-patches (mention the skill name)'
-          : '/gsd-reapply-patches';
     console.log('');
     console.log('  ' + yellow + 'Local patches detected' + reset + ' (from v' + meta.from_version + '):');
     for (const f of meta.files) {
@@ -5448,8 +5449,7 @@ function reportLocalPatches(configDir, runtime = 'claude') {
     }
     console.log('');
     console.log('  Your modifications are saved in ' + cyan + PATCHES_DIR_NAME + '/' + reset);
-    console.log('  Run ' + cyan + reapplyCommand + reset + ' to merge them into the new version.');
-    console.log('  Or manually compare and merge the files.');
+    console.log('  Manually compare and merge the files into the new version.');
     console.log('');
   }
   return meta.files || [];
@@ -5729,7 +5729,7 @@ function install(isGlobal, runtime = 'claude') {
   const skillDest = path.join(targetDir, 'get-shit-done');
   const savedGsdArtifacts = preserveUserArtifacts(skillDest, ['USER-PROFILE.md']);
   copyWithPathReplacement(skillSrc, skillDest, pathPrefix, runtime, false, isGlobal);
-  const copiedSdkBundle = copySdkBundleToRuntime(src, skillDest);
+  const copiedSdkBundle = copySdkBundleToRuntime(src, skillDest, runtime, pathPrefix, isGlobal);
   restoreUserArtifacts(skillDest, savedGsdArtifacts);
   if (verifyInstalled(skillDest, 'get-shit-done')) {
     console.log(`  ${green}✓${reset} Installed get-shit-done`);
@@ -5896,8 +5896,8 @@ function install(isGlobal, runtime = 'claude') {
             // Ensure hook files are executable (fixes #1162 — missing +x permission)
             try { fs.chmodSync(destFile, 0o755); } catch (e) { /* Windows doesn't support chmod */ }
           } else {
-            // .sh hooks carry a gsd-hook-version header so gsd-check-update.js can
-            // detect staleness after updates — stamp the version just like .js hooks.
+            // .sh hooks carry a gsd-hook-version header stamped with the install
+            // version — stamp the version just like .js hooks.
             if (entry.endsWith('.sh')) {
               let content = fs.readFileSync(srcFile, 'utf8');
               content = content.replace(/\{\{GSD_VERSION\}\}/g, pkg.version);
@@ -5924,11 +5924,6 @@ function install(isGlobal, runtime = 'claude') {
     }
   }
 
-  // Clear stale update cache so next session re-evaluates hook versions
-  // Cache lives at ~/.cache/gsd/ (see hooks/gsd-check-update.js line 35-36)
-  const updateCacheFile = path.join(os.homedir(), '.cache', 'gsd', 'gsd-update-check.json');
-  try { fs.unlinkSync(updateCacheFile); } catch (e) { /* cache may not exist yet */ }
-
   if (failures.length > 0) {
     console.error(`\n  ${yellow}Installation incomplete!${reset} Failed: ${failures.join(', ')}`);
     process.exit(1);
@@ -5996,73 +5991,6 @@ function install(isGlobal, runtime = 'claude') {
     console.log(`  ${green}✓${reset} Generated config.toml with ${agentCount} agent roles`);
     console.log(`  ${green}✓${reset} Generated ${agentCount} agent .toml config files`);
 
-    // Copy hook files that are referenced in config.toml (#2153)
-    // The main hook-copy block is gated to non-Codex runtimes, but Codex registers
-    // gsd-check-update.js in config.toml — the file must physically exist.
-    const codexHooksSrc = path.join(src, 'hooks', 'dist');
-    if (fs.existsSync(codexHooksSrc)) {
-      const codexHooksDest = path.join(targetDir, 'hooks');
-      fs.mkdirSync(codexHooksDest, { recursive: true });
-      const configDirReplacement = getConfigDirFromHome(runtime, isGlobal);
-      for (const entry of fs.readdirSync(codexHooksSrc)) {
-        const srcFile = path.join(codexHooksSrc, entry);
-        if (!fs.statSync(srcFile).isFile()) continue;
-        const destFile = path.join(codexHooksDest, entry);
-        if (entry.endsWith('.js')) {
-          let content = fs.readFileSync(srcFile, 'utf8');
-          content = content.replace(/'\.claude'/g, configDirReplacement);
-          content = content.replace(/\/\.claude\//g, `/${getDirName(runtime)}/`);
-          content = content.replace(/\.claude\//g, `${getDirName(runtime)}/`);
-          content = content.replace(/\{\{GSD_VERSION\}\}/g, pkg.version);
-          fs.writeFileSync(destFile, content);
-          try { fs.chmodSync(destFile, 0o755); } catch (e) { /* Windows */ }
-        } else {
-          if (entry.endsWith('.sh')) {
-            let content = fs.readFileSync(srcFile, 'utf8');
-            content = content.replace(/\{\{GSD_VERSION\}\}/g, pkg.version);
-            fs.writeFileSync(destFile, content);
-            try { fs.chmodSync(destFile, 0o755); } catch (e) { /* Windows */ }
-          } else {
-            fs.copyFileSync(srcFile, destFile);
-          }
-        }
-      }
-      console.log(`  ${green}✓${reset} Installed hooks`);
-    }
-
-    // Add Codex hooks (SessionStart for update checking) — requires codex_hooks feature flag
-    const configPath = path.join(targetDir, 'config.toml');
-    try {
-      let configContent = fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf-8') : '';
-      const eol = detectLineEnding(configContent);
-      const codexHooksFeature = ensureCodexHooksFeature(configContent);
-      configContent = setManagedCodexHooksOwnership(codexHooksFeature.content, codexHooksFeature.ownership);
-
-      // Add SessionStart hook for update checking
-      const updateCheckScript = path.resolve(targetDir, 'hooks', 'gsd-check-update.js').replace(/\\/g, '/');
-      const hookBlock =
-        `${eol}# GSD Hooks${eol}` +
-        `[[hooks]]${eol}` +
-        `event = "SessionStart"${eol}` +
-        `command = "node ${updateCheckScript}"${eol}`;
-
-      // Migrate legacy gsd-update-check entries from prior installs (#1755 followup)
-      // Remove stale hook blocks that used the inverted filename or wrong path
-      if (configContent.includes('gsd-update-check')) {
-        configContent = configContent.replace(/\n# GSD Hooks\n\[\[hooks\]\]\nevent = "SessionStart"\ncommand = "node [^\n]*gsd-update-check\.js"\n/g, '\n');
-        configContent = configContent.replace(/\r\n# GSD Hooks\r\n\[\[hooks\]\]\r\nevent = "SessionStart"\r\ncommand = "node [^\r\n]*gsd-update-check\.js"\r\n/g, '\r\n');
-      }
-
-      if (hasEnabledCodexHooksFeature(configContent) && !configContent.includes('gsd-check-update')) {
-        configContent += hookBlock;
-      }
-
-      fs.writeFileSync(configPath, configContent, 'utf-8');
-      console.log(`  ${green}✓${reset} Configured Codex hooks (SessionStart)`);
-    } catch (e) {
-      console.warn(`  ${yellow}⚠${reset}  Could not configure Codex hooks: ${e.message}`);
-    }
-
     return { settingsPath: null, settings: null, statuslineCommand: null, runtime, configDir: targetDir };
   }
 
@@ -6131,9 +6059,6 @@ function install(isGlobal, runtime = 'claude') {
   const statuslineCommand = isGlobal
     ? buildHookCommand(targetDir, 'gsd-statusline.js', hookOpts)
     : 'node ' + localPrefix + '/hooks/gsd-statusline.js';
-  const updateCheckCommand = isGlobal
-    ? buildHookCommand(targetDir, 'gsd-check-update.js', hookOpts)
-    : 'node ' + localPrefix + '/hooks/gsd-check-update.js';
   const contextMonitorCommand = isGlobal
     ? buildHookCommand(targetDir, 'gsd-context-monitor.js', hookOpts)
     : 'node ' + localPrefix + '/hooks/gsd-context-monitor.js';
@@ -6158,7 +6083,7 @@ function install(isGlobal, runtime = 'claude') {
     }
   }
 
-  // Configure SessionStart hook for update checking (skip for opencode)
+  // Configure GSD hooks (skip for opencode)
   if (!isOpencode && !isKilo) {
     if (!settings.hooks) {
       settings.hooks = {};
@@ -6167,29 +6092,6 @@ function install(isGlobal, runtime = 'claude') {
       settings.hooks.SessionStart = [];
     }
 
-    const hasGsdUpdateHook = settings.hooks.SessionStart.some(entry =>
-      entry.hooks && entry.hooks.some(h => h.command && h.command.includes('gsd-check-update'))
-    );
-
-    // Guard: only register if the hook file was actually installed (#1754).
-    // When hooks/dist/ is missing from the npm package (as in v1.32.0), the
-    // copy step produces no files but the registration step ran unconditionally,
-    // causing "hook error" on every tool invocation.
-    const checkUpdateFile = path.join(targetDir, 'hooks', 'gsd-check-update.js');
-    if (!hasGsdUpdateHook && fs.existsSync(checkUpdateFile)) {
-      settings.hooks.SessionStart.push({
-        hooks: [
-          {
-            type: 'command',
-            command: updateCheckCommand
-          }
-        ]
-      });
-      console.log(`  ${green}✓${reset} Configured update check hook`);
-    } else if (!hasGsdUpdateHook && !fs.existsSync(checkUpdateFile)) {
-      console.warn(`  ${yellow}⚠${reset}  Skipped update check hook — gsd-check-update.js not found at target`);
-    }
-
     // Configure post-tool hook for context window monitoring
     if (!settings.hooks[postToolEvent]) {
       settings.hooks[postToolEvent] = [];