fix(#725): route Codex gsd-tools calls through shim (#731)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

tests/bug-3582-codex-skills-materialized.test.cjs

@@ -57,6 +57,22 @@ function stripAnsi(s) {
   return s.replace(/\x1b\[[0-9;]*m/g, '');
 }
 
+function assertNoBareGsdToolsInvocation(content, label) {
+  const patterns = [
+    /(^|\n)[ \t]*gsd-tools\s/,
+    /\$\(\s*gsd-tools\s/,
+    /`\s*gsd-tools\s/,
+    /(?:&&|\|\||[;|])\s*gsd-tools\s/,
+  ];
+  for (const pattern of patterns) {
+    assert.doesNotMatch(
+      content,
+      pattern,
+      `${label} must not contain a command-position bare gsd-tools invocation`,
+    );
+  }
+}
+
 /**
  * Walk commands/gsd/**\/*.md and return the set of skill names the installer
  * is contractually obligated to produce. Naming rule mirrors
@@ -253,6 +269,21 @@ describe('bug-3582: Codex global install materializes the skill surface', { conc
     }
   });
 
+  test('installed Codex skills do not ask agents to run bare gsd-tools commands', () => {
+    const skillsDir = path.join(installRun.codexHome, 'skills');
+    const skillDirs = fs.readdirSync(skillsDir, { withFileTypes: true })
+      .filter(e => e.isDirectory() && e.name.startsWith('gsd-'))
+      .map(e => e.name);
+
+    for (const name of skillDirs) {
+      const content = fs.readFileSync(
+        path.join(skillsDir, name, 'SKILL.md'),
+        'utf-8',
+      );
+      assertNoBareGsdToolsInvocation(content, `${name}/SKILL.md`);
+    }
+  });
+
   test('installer success log mentions skills/ — never claims success while skipping', () => {
     // The 1.42.2 user-visible failure mode was a successful install that
     // printed "Skipped Codex skill-copy generation (Codex discovers