Tom Boucher fb5f89db10 feat(#1704): destSubpath write-confinement (ADR-1239 Phase B) (#1706) ...

* feat(#1679): confine install writes within configHome

ADR-1239 Phase B write-confinement: a pure assertDestWithinConfigHome(configDir, destSubpath) rejects a destSubpath that escapes configHome (path traversal / NUL byte) at plan-build time on BOTH the install and uninstall plan paths; surface.applySurface and installOpencodeFamilySkills route through it, and _copyStaged carries a defense-in-depth containment check. Security-load-bearing for the Phase C third-party-descriptor loader.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#1704): add changeset for destSubpath write-confinement

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#1704): fix windows path-portability in confinement test

The N1 'accepts a true child subpath' assertion compared against path.join (no drive resolution) while the helper uses path.resolve — on Windows that mismatches the C: drive prefix. Compute the expected via path.resolve to mirror the helper. Windows-CI-only failure (local gsd-test is Mac+Linux).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-25 13:20:25 -04:00

..

installer-migrations

fix(#934): reapply verifier handles missing pristine baseline post-rename (#937)

2026-06-09 12:51:15 -04:00

observability

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

active-workstream-store.cts

refactor(#1191): inject clock/reset testability seams + handle valid-null settings (#1233)

2026-06-14 20:52:56 -04:00

adr-parser.cts

fix(#1535): make punctuated adr-parser header synonyms reachable (#1536)

2026-06-21 22:55:22 -04:00

agent-command-router.cts

refactor(#1281): T2 — migrate 12 single-leaf callers off the core spine (batch 1) (#1282)

2026-06-15 16:18:54 -04:00

agent-install-check.cts

refactor(#1294): T-final — delete the core.cjs re-export spine (epic #1267 complete) (#1295)

2026-06-15 18:50:46 -04:00

artifacts.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

audit-command-router.cts

refactor(#1646): route capability routers through Command Routing Hub per ADR-959 (#1647)

2026-06-23 23:21:06 -04:00

audit.cts

ci(#1401): add no-adhoc-markdown-parsing rule (fence-strip + section-collect) + grandfather burn-down (#1402)

2026-06-17 20:14:12 -04:00

capability-activation.cts

refactor(#1308): consolidate config-key precedence engine into single owner (#1322)

2026-06-16 02:38:47 -04:00

capability-consent.cts

fix(#1459): user-owned consent store gates third-party capability activation; env/cwd in disclosure; loader validator parity (#1473)

2026-06-20 01:59:03 -04:00

capability-ledger.cts

fix(#1459): user-owned consent store gates third-party capability activation; env/cwd in disclosure; loader validator parity (#1473)

2026-06-20 01:59:03 -04:00

capability-lifecycle.cts

fix(#1634): honor capability hook matcher and node-prefix command (#1638)

2026-06-23 21:49:43 -04:00

capability-loader.cts

fix(#1461): loader never crashes on a malformed overlay (skip-with-warning); bound the source fetch

2026-06-20 03:24:47 -04:00

capability-lock.cts

fix(#1459): user-owned consent store gates third-party capability activation; env/cwd in disclosure; loader validator parity (#1473)

2026-06-20 01:59:03 -04:00

capability-source.cts

feat(#1463): add capability outdated (per-source update check); drop phantom slash-command docs

2026-06-20 10:50:12 -04:00

capability-state.cts

fix(#1459): user-owned consent store gates third-party capability activation; env/cwd in disclosure; loader validator parity (#1473)

2026-06-20 01:59:03 -04:00

capability-trust.cts

fix(#1459): user-owned consent store gates third-party capability activation; env/cwd in disclosure; loader validator parity (#1473)

2026-06-20 01:59:03 -04:00

capability-writer.cts

feat(#1451): wire gsd capability install/update/remove/list/disable/enable management CLI (#1457)

2026-06-19 12:02:36 -04:00

check-command-router.cts

refactor(#1390): migrate check-command-router + gap-checker onto markdown-sectionizer seam (epic #1372 T3) (#1392)

2026-06-17 14:32:43 -04:00

cjs-command-router-adapter.cts

refactor(#1646): route capability routers through Command Routing Hub per ADR-959 (#1647)

2026-06-23 23:21:06 -04:00

cli-exit.cts

fix(#965): emit structured json error for unexpected handler throws under --json-errors (#987)

2026-06-10 10:40:12 -04:00

clock.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

clusters.cts

feat(#956): add MemPalace memory capability (ADR-857 feature plug-in) (#1201)

2026-06-14 02:09:10 -04:00

code-review-flags.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

command-aliases.cts

enhance(#1579): deterministic gsd-tools query eval.score verb (#1583)

2026-06-24 17:16:13 -04:00

command-arg-projection.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

command-roster.cts

refactor(#1099): extract runtime artifact conversion module (#1100)

2026-06-13 10:27:12 -04:00

command-routing-hub.cts

refactor(#1644): Hub extension — exitReason? field on InvalidArgs + adapter honestification (#1645)

2026-06-23 22:47:57 -04:00

commands.cts

feat(#441): add /gsd-capture --list-seeds for seed listing and audit (#722)

2026-06-22 00:59:41 -04:00

config-loader.cts

fix(#1533): prototype-pollution guard in _deepMergeConfig (#1534)

2026-06-21 22:46:34 -04:00

config-schema.cts

fix(#1628): type-safe config-set validation — close JSON-coercion enum bypass + enforce capability schema

2026-06-23 16:10:34 -04:00

config-types.cts

refactor(#1294): T-final — delete the core.cjs re-export spine (epic #1267 complete) (#1295)

2026-06-15 18:50:46 -04:00

config.cts

fix(#1628): type-safe config-set validation — close JSON-coercion enum bypass + enforce capability schema

2026-06-23 16:10:34 -04:00

configuration.cts

chore(#893): remove dead loadConfig from configuration.cts (#912)

2026-06-08 22:51:43 -04:00

context-utilization.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

core-utils.cts

refactor(#877): extract shared low-level utilities into core-utils.cts (#878)

2026-06-08 13:29:13 -04:00

coverage.cts

feat(#1602): deterministic coverage-metadata UAT routing for verify-work

2026-06-22 23:43:22 -04:00

decisions.cts

fix(#1639): parseDecisions handles the titled-colon bullet form (#1665)

2026-06-24 13:26:25 -04:00

docs.cts

refactor(#1283): T3 — migrate 9 multi-leaf callers off the core spine (batch 2) (#1285)

2026-06-15 16:40:48 -04:00

drift.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

edge-probe.cts

feat(spec-phase): surface zero-classification edge-probe requirements as unclassified candidates (#1110) (#1117)

2026-06-14 21:44:21 -04:00

eval-command-router.cts

enhance(#1579): deterministic gsd-tools query eval.score verb (#1583)

2026-06-24 17:16:13 -04:00

eval.cts

enhance(#1579): deterministic gsd-tools query eval.score verb (#1583)

2026-06-24 17:16:13 -04:00

fallow-runner.cts

fix(#1012): invoke fallow with its real CLI and wire the report normalizer (#1044)

2026-06-11 11:36:50 -04:00

federated-config.cts

feat(#910): federated config merge in config-loader (ADR-857 phase 3b) (#914)

2026-06-08 23:37:41 -04:00

frontmatter.cts

fix(#1660): fail-closed frontmatter set of object-list fields instead of silent no-op (#1664)

2026-06-24 13:39:17 -04:00

gap-checker.cts

feat(#1269): expand same-prefix numeric ID ranges in --phase-req-ids (#1419)

2026-06-18 21:59:10 -04:00

git-base-branch.cts

refactor(#1294): T-final — delete the core.cjs re-export spine (epic #1267 complete) (#1295)

2026-06-15 18:50:46 -04:00

graphify-command-router.cts

refactor(#1646): route capability routers through Command Routing Hub per ADR-959 (#1647)

2026-06-23 23:21:06 -04:00

graphify.cts

refactor(#1306): gate graphify on isCapabilityActive (tri-state, runtime-aware) (#1313)

2026-06-15 23:19:21 -04:00

gsd2-import.cts

refactor(#1281): T2 — migrate 12 single-leaf callers off the core spine (batch 1) (#1282)

2026-06-15 16:18:54 -04:00

host-integration.cts

feat(#1684): negotiated host-integration interface (ADR-1239 Phase A) (#1690)

2026-06-25 11:33:06 -04:00

init-command-router.cts

feat(#703): add --granularity override flag to /gsd:plan-phase (#750)

2026-06-06 23:56:53 -04:00

init.cts

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

install-profiles.cts

feat(#1173): wire the 8 agent converters into the descriptor-driven install path

2026-06-21 11:21:52 -07:00

installer-migration-authoring.cts

fix(#670): self-healing recovery for installer-migration checksum drift (#675)

2026-06-04 13:44:05 -04:00

installer-migration-report.cts

fix(#997): ensure canonical ~/.claude/gsd-core path for plugin installs (#1207)

2026-06-14 09:37:41 -04:00

installer-migrations.cts

fix(#670): self-healing recovery for installer-migration checksum drift (#675)

2026-06-04 13:44:05 -04:00

intel-command-router.cts

refactor(#1646): route capability routers through Command Routing Hub per ADR-959 (#1647)

2026-06-23 23:21:06 -04:00

intel.cts

refactor(#1307): gate intel on isCapabilityActive + loop-resolver honors capability active (#1315)

2026-06-16 00:12:54 -04:00

io.cts

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

learnings.cts

refactor(#1281): T2 — migrate 12 single-leaf callers off the core spine (batch 1) (#1282)

2026-06-15 16:18:54 -04:00

loop-resolver.cts

fix(#1459): user-owned consent store gates third-party capability activation; env/cwd in disclosure; loader validator parity (#1473)

2026-06-20 01:59:03 -04:00

markdown-sectionizer.cts

refactor(#1373): add canonical markdown-sectionizer seam (epic #1372 T0) (#1381)

2026-06-17 11:14:17 -04:00

milestone.cts

fix(#1422,#1447): fix sub_repos/.git precedence; guard uncommitted data in new-milestone (#1484)

2026-06-20 13:37:16 -04:00

model-catalog.cts

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

model-profiles.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

model-resolver.cts

refactor(#1294): T-final — delete the core.cjs re-export spine (epic #1267 complete) (#1295)

2026-06-15 18:50:46 -04:00

package-identity.d.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

package-legitimacy.cts

feat(#656): Research module — content-addressed cache + provider seam + registry-API legitimacy (#664)

2026-06-05 17:58:48 -04:00

phase-command-router.cts

fix(#1437): add phase.list-plans to gsd-tools (#1485)

2026-06-20 13:37:22 -04:00

phase-id.cts

fix(#1455): resolve project-code-prefixed roadmap headings

2026-06-20 18:45:41 -04:00

phase-lifecycle.cts

fix(#1445,#1446): exclude 999.x backlog from milestone totals; allow total_phases downward correction (#1490)

2026-06-20 13:37:32 -04:00

phase-locator.cts

refactor(#1294): T-final — delete the core.cjs re-export spine (epic #1267 complete) (#1295)

2026-06-15 18:50:46 -04:00

phase.cts

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

phases-command-router.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

plan-drift-guard.cts

refactor(#1190): extract ADR-22 drift-guard decision logic into a testable seam (#1242)

2026-06-14 20:52:36 -04:00

plan-scan.cts

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

planning-workspace.cts

fix(#1531): race-safe steal for the two core-path locks (PR #1532 review)

2026-06-21 23:22:17 -04:00

probe-core.cts

enhance(verify-phase): node-test causation control — prove the RED is content-caused (#1346)

2026-06-21 10:44:48 -04:00

profile-output.cts

fix(#1574): resolve review — copilot instruction file is .github/copilot-instructions.md

2026-06-22 09:56:15 -04:00

profile-pipeline.cts

fix(#866): route profile-pipeline temp output under reaped root + fixture teardown (#879)

2026-06-08 14:04:26 -04:00

prohibition-enforcement.cts

enhance(verify-phase): node-test causation control — prove the RED is content-caused (#1346)

2026-06-21 10:44:48 -04:00

project-root.cts

fix(#1422,#1447): fix sub_repos/.git precedence; guard uncommitted data in new-milestone (#1484)

2026-06-20 13:37:16 -04:00

prompt-budget.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

research-provider.cts

chore: clean up clear-cut ESLint warnings (#732) (#734)

2026-06-06 11:24:48 -04:00

research-store.cts

feat(#656): Research module — content-addressed cache + provider seam + registry-API legitimacy (#664)

2026-06-05 17:58:48 -04:00

resolution.cts

feat(#1416): formalize Resolution convention + agent-skills value envelope (Resolution Provenance P3) (#1425)

2026-06-18 07:44:52 -04:00

review-reviewer-selection.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

roadmap-command-router.cts

fix(#1538): roadmap upgrade must not process.exit inside the no-throw hub (#1539)

2026-06-21 23:04:34 -04:00

roadmap-parser.cts

fix(#1455): resolve project-code-prefixed roadmap headings

2026-06-20 18:45:41 -04:00

roadmap-upgrade.cts

fix(#1542): roadmap upgrade rollback restores .planning regardless of git tracking (#1543)

2026-06-21 23:21:39 -04:00

roadmap.cts

fix(#1551): match dash-separated milestone phase IDs in roadmap analyze checklist scan (#1552)

2026-06-21 23:30:27 -04:00

runtime-artifact-conversion.cts

fix(#1615): validate commandName to prevent workflow prompt injection

2026-06-23 14:38:38 -04:00

runtime-artifact-install-plan.cts

feat(#1704): destSubpath write-confinement (ADR-1239 Phase B) (#1706)

2026-06-25 13:20:25 -04:00

runtime-artifact-layout.cts

fix(#1614): install Antigravity skills flat

2026-06-23 10:21:06 -04:00

runtime-config-adapter-registry.cts

feat(#1138): make runtime descriptors authoritative (#1157)

2026-06-13 01:49:25 -04:00

runtime-homes.cts

fix(#1441): antigravity resolver prefers GSD-owned dir over first-existing (#1442)

2026-06-18 21:47:18 -04:00

runtime-hooks-surface.cts

fix(#1619): normalize pruned mise node execPath to the stable shim in normalizeNodePath (#1621)

2026-06-23 19:17:03 -04:00

runtime-name-policy.cts

fix(#1615): install Windsurf slash workflows

2026-06-23 12:10:21 -04:00

runtime-slash.cts

feat(#1046): phase 5c — drive commandStyle from the runtime descriptor (runtime-slash codex-check → lookup) (#1048)

2026-06-11 12:37:25 -04:00

schema-detect.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

secrets.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

security.cts

feat(#52): add agent_skills_security.trusted_global_roots allowlist for global skills (#754)

2026-06-07 01:06:41 -04:00

semver-compare.cts

feat(#1431): runtime capability registry overlay (ADR-1244 Phase 2) (#1440)

2026-06-18 14:41:20 -04:00

shell-command-projection.cts

feat(#323): fish-shell support in post-install PATH suggestion (#727)

2026-06-24 17:20:52 -04:00

state-command-router.cts

fix(#1140): implement state add-roadmap-evolution CJS handler (#1148)

2026-06-12 22:27:02 -04:00

state-document.cts

fix(#1445,#1446): exclude 999.x backlog from milestone totals; allow total_phases downward correction (#1490)

2026-06-20 13:37:32 -04:00

state.cts

fix(#1659): dedup By-Phase rows across padded/unpadded phase numbers (#1663)

2026-06-24 14:41:45 -04:00

surface.cts

feat(#1704): destSubpath write-confinement (ADR-1239 Phase B) (#1706)

2026-06-25 13:20:25 -04:00

task-command-router.cts

refactor(#1281): T2 — migrate 12 single-leaf callers off the core spine (batch 1) (#1282)

2026-06-15 16:18:54 -04:00

teams-status.cts

feat(#1355): detect-and-warn guard for claude-code agent-teams (#1371)

2026-06-17 08:52:23 -04:00

template.cts

refactor(#1286): T4 — migrate 5 large destructure callers off the core spine (batch 3) (#1287)

2026-06-15 17:03:22 -04:00

uat-predicate.cts

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

uat.cts

refactor(#1396): T5 — migrate uat-predicate + uat onto markdown-sectionizer seam (#1397)

2026-06-17 15:44:11 -04:00

ui-safety-gate.cts

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

update-context.cts

fix(#1615): install Windsurf slash workflows

2026-06-23 12:10:21 -04:00

validate-command-router.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

validate.cts

fix(#1455): resolve project-code-prefixed roadmap headings

2026-06-20 18:45:41 -04:00

verification-command-router.cts

refactor(#651): consolidate verification-status routing into one queryable seam (#755)

2026-06-07 01:26:56 -04:00

verification.cts

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

verify-command-router.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

verify.cts

fix(#1571): resolve schema-drift phase by token, not substring (#1640)

2026-06-24 17:03:01 -04:00

workstream-inventory-builder.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

workstream-inventory.cts

refactor(#1281): T2 — migrate 12 single-leaf callers off the core spine (batch 1) (#1282)

2026-06-15 16:18:54 -04:00

workstream-name-policy.cts

enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)

2026-06-02 11:45:01 -04:00

workstream.cts

refactor(#1283): T3 — migrate 9 multi-leaf callers off the core spine (batch 2) (#1285)

2026-06-15 16:40:48 -04:00

worktree-base-ref.cts

fix(#1013): resolve worktree.baseRef from user/global settings cascade (#1038)

2026-06-11 11:36:30 -04:00

worktree-safety.cts

feat(#1298): add validated worktree record-agent writer verb for wave manifests (#1448)

2026-06-21 15:38:44 -04:00