Tom Boucher 3711a4f04f fix(3663): replace ../../.. fallback with descriptive error per CLAUDE.md ...

Both findInstallSourceRoot and findAgentsSourceRoot previously returned a
path.join(__dirname, '..', '..', '..', ...) fallback when the walk-up loop
found nothing. Replace with throw per CLAUDE.md "No Relative Path Traversal"
policy: ..  chains silently break on CWD changes; a throw with the failing
__dirname in the message is an unambiguous diagnostic.

The walk-up loop already uses path.dirname iteratively (no literal ..); only
the dead-end fallback used the banned pattern.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-17 01:12:00 -04:00

..

installer-migrations

feat(shell-projection): centralize managed hook command policy (#3450)

2026-05-12 20:15:43 -04:00

active-workstream-store.cjs

fix(workstream): normalize migration workstream names (#3269)

2026-05-09 00:15:04 -04:00

adr-parser.cjs

feat(plan-phase): add ADR ingest express path for approved enhancement #3209 (#3421)

2026-05-11 23:01:34 -04:00

artifacts.cjs

fix(artifacts): register RETROSPECTIVE.md as canonical planning artifact (#3200)

2026-05-06 21:51:29 -04:00

audit.cjs

refactor(shell-projection): migrate all fs call sites to platform* seam (Phase 3, #3467) (#3481)

2026-05-13 19:34:23 -04:00

cjs-command-router-adapter.cjs

Refactor SDK-first architecture seams (#3316)

2026-05-09 14:21:42 -04:00

cjs-sdk-bridge.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

clusters.cjs

feat(skill-surface): install-time profiles + runtime /gsd:surface (#3408) (#3456)

2026-05-13 12:45:16 -04:00

command-aliases.generated.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

commands.cjs

fix(3569): surface phase_status from init.plan-phase; gate /gsd:plan-phase on closed phases (re-submit of #3578) (#3581)

2026-05-16 13:14:21 -04:00

config-schema.cjs

feat(3536): Configuration Module via shared manifests + generator (Phase 2 of #3524)

2026-05-15 00:02:56 -04:00

config.cjs

test(3593): CLI negative-matrix harness + config family + universal sweep (#3627)

2026-05-15 23:57:38 -04:00

configuration.generated.cjs

fix(3571): load configuration manifests after install (#3572)

2026-05-15 22:03:03 -04:00

context-utilization.cjs

feat(#2792): namespace meta-skills + keyword-tag descriptions + context utilization guard (#2825)

2026-04-30 01:04:41 -04:00

core.cjs

Merge pull request #3607 from gsd-build/feat/3592-test-rewrite-text-existence-checks-into-

2026-05-15 23:11:34 -04:00

decisions.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

decisions.generated.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

docs.cjs

refactor(shell-projection): migrate all fs call sites to platform* seam (Phase 3, #3467) (#3481)

2026-05-13 19:34:23 -04:00

drift.cjs

fix(3584): address coderabbit findings on PR #3606

2026-05-15 19:52:17 -04:00

fallow-runner.cjs

feat(code-review): integrate fallow structural pre-pass for /gsd-code-review (#3424)

2026-05-13 21:19:47 -04:00

frontmatter.cjs

refactor(shell-projection): migrate all fs call sites to platform* seam (Phase 3, #3467) (#3481)

2026-05-13 19:34:23 -04:00

gap-checker.cjs

fix: gap-analysis parses mixed requirement prefixes and skips table headers (#2902)

2026-04-30 12:13:55 -04:00

graphify.cjs

fix(3347): surface auto-build state via graphifyStatus; trim planner edits to free size budget

2026-05-15 11:59:43 -04:00

gsd2-import.cjs

fix(3584): address coderabbit findings on PR #3606

2026-05-15 19:52:17 -04:00

init-command-router.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

init.cjs

fix(3569): surface phase_status from init.plan-phase; gate /gsd:plan-phase on closed phases (re-submit of #3578) (#3581)

2026-05-16 13:14:21 -04:00

install-profiles.cjs

feat(3663): implement stageSkillsForRuntimeAsSkills iteration+write loop

2026-05-17 01:12:00 -04:00

installer-migration-authoring.cjs

fix: tighten installer migration authoring guards

2026-05-11 14:36:14 -04:00

installer-migration-report.cjs

fix(3628)(security): whitelist bundled hook filenames in classifier (#3630)

2026-05-16 00:07:59 -04:00

installer-migrations.cjs

refactor(shell-projection): remove deprecated wrappers + finalize ADRs (Phase 4, #3468) (#3484)

2026-05-13 20:46:02 -04:00

intel.cjs

refactor(shell-projection): migrate all fs call sites to platform* seam (Phase 3, #3467) (#3481)

2026-05-13 19:34:23 -04:00

learnings.cjs

refactor(shell-projection): remove deprecated wrappers + finalize ADRs (Phase 4, #3468) (#3484)

2026-05-13 20:46:02 -04:00

milestone.cjs

fix(3584): runtime-aware slash formatter for user-facing emissions

2026-05-15 19:32:02 -04:00

model-catalog.cjs

fix(install): copy sdk/shared/model-catalog.json + resolve chain in CJS (#3288) (#3293)

2026-05-09 07:40:17 -04:00

model-profiles.cjs

fix(#3229): shared model catalog source of truth for agent profiles + runtime tier defaults (#3230)

2026-05-08 21:25:37 -04:00

phase-command-router.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

phase.cjs

Merge pull request #3607 from gsd-build/feat/3592-test-rewrite-text-existence-checks-into-

2026-05-15 23:11:34 -04:00

phases-command-router.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

plan-scan.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

plan-scan.generated.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

planning-workspace.cjs

refactor(shell-projection): migrate all fs call sites to platform* seam (Phase 3, #3467) (#3481)

2026-05-13 19:34:23 -04:00

profile-output.cjs

fix(3584): address codex-review findings on PR #3606

2026-05-15 19:42:48 -04:00

profile-pipeline.cjs

refactor(shell-projection): remove deprecated wrappers + finalize ADRs (Phase 4, #3468) (#3484)

2026-05-13 20:46:02 -04:00

project-root.generated.cjs

feat(3553): Project-Root Resolution Module via generator (Phase 4 of #3524)

2026-05-15 10:07:10 -04:00

review-reviewer-selection.cjs

feat: add review.default_reviewers config for /gsd-review defaults (#3464)

2026-05-13 14:10:15 -04:00

roadmap-command-router.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

roadmap.cjs

fix(3599): treat prefixed phase headings as section boundaries

2026-05-15 22:40:18 -04:00

runtime-artifact-layout.cjs

fix(3663): replace ../../.. fallback with descriptive error per CLAUDE.md

2026-05-17 01:12:00 -04:00

runtime-homes.cjs

fix(3583): normalize retired colon-form commands in generated Claude/Qwen/Hermes SKILL.md bodies (#3629)

2026-05-16 13:09:58 -04:00

runtime-slash.cjs

fix(3584): address coderabbit findings on PR #3606

2026-05-15 19:52:17 -04:00

schema-detect.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

schema-detect.generated.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

secrets.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

secrets.generated.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

security.cjs

fix(security): neutralize spaced+closing injection markers; fix audit-uat resolved status (#2456)

2026-04-20 10:08:18 -04:00

shell-command-projection.cjs

refactor(shell-projection): migrate all subprocess call sites to exec*/probeTty seam (Phase 2, #3466) (#3476)

2026-05-13 18:33:32 -04:00

state-command-router.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

state-document.cjs

feat(3530): STATE.md Document Module via generator (Phase 1 of #3524) (#3531)

2026-05-14 22:17:20 -04:00

state-document.generated.cjs

feat(3530): STATE.md Document Module via generator (Phase 1 of #3524) (#3531)

2026-05-14 22:17:20 -04:00

state.cjs

fix(sdk): make state.complete-phase idempotent (#3489)

2026-05-14 07:47:18 -04:00

surface.cjs

fix(3663): preserve Hermes user-skill dirs under skills/gsd/ namespace

2026-05-17 01:12:00 -04:00

template.cjs

refactor(shell-projection): remove deprecated wrappers + finalize ADRs (Phase 4, #3468) (#3484)

2026-05-13 20:46:02 -04:00

uat.cjs

refactor: extract planning-workspace seam from core.cjs (#2901)

2026-04-30 11:38:13 -04:00

validate-command-router.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

verify-command-router.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

verify.cjs

fix(3584): address coderabbit findings on PR #3606

2026-05-15 19:52:17 -04:00

workstream-inventory-builder.generated.cjs

fix: align settings docs and inventory completion matching

2026-05-15 11:59:43 -04:00

workstream-inventory.cjs

feat(3544): Workstream Inventory Builder/Reader split (Phase 3 of #3524)

2026-05-15 09:35:02 -04:00

workstream-name-policy.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

workstream-name-policy.generated.cjs

feat(3575): Phase 6 — CJS↔SDK seam migration end-to-end complete (#3524) (#3577)

2026-05-16 13:14:24 -04:00

workstream.cjs

fix(3584): runtime-aware slash formatter for user-facing emissions

2026-05-15 19:32:02 -04:00

worktree-safety.cjs

refactor(shell-projection): migrate all subprocess call sites to exec*/probeTty seam (Phase 2, #3466) (#3476)

2026-05-13 18:33:32 -04:00