Tom Boucher faf329ecb9 fix(#260): enforce worktree absolute-path safety via PreToolUse hook ...

Closes #260

Moves the step-0b absolute-path guard from prose instructions to a harness-enforced PreToolUse hook (gsd-worktree-path-guard.js). Hard-blocks Edit/Write/MultiEdit calls whose absolute path resolves outside the active worktree root.

2026-06-01 10:56:06 -04:00

..

changeset

feat(#498): single Package Identity seam for /gsd:update + fix runtime undefined-name bug (#499)

2026-05-30 16:53:44 -04:00

affected-tests-lib.cjs

ci(#483): resolve transitive dependencies in affected-test selection + zero-dependent widen backstop (#485)

2026-05-29 17:12:58 -04:00

audit-workflow-script-paths.cjs

feat(#2995): post-install path audit for workflow-invoked scripts (#2996)

2026-05-01 21:13:45 -04:00

base64-scan.sh

fix(116): locale-safe base64-scan with portable timeout and partial-scan signaling (#132)

2026-05-23 10:14:48 -04:00

build-hooks.js

fix(#260): enforce worktree absolute-path safety via PreToolUse hook

2026-06-01 10:56:06 -04:00

check-alias-drift.cjs

fix(#303): deepen command routing seams and alias parity guard (#304)

2026-05-26 11:23:53 -04:00

check-env.cjs

fix(#437,#439,#440): restore defaults.run.shell + 'zsh {0}' format + Windows .cmd shell:true (PR #434 fallout) (#438)

2026-05-28 18:06:19 -04:00

check-npm-integrity.cjs

fix(#431): enforce H1 shell policy (linux=bash, macOS=zsh, windows=pwsh) across PR + release gates (#434)

2026-05-28 09:23:59 -04:00

ci-guard-runner.cjs

fix(#431): enforce H1 shell policy (linux=bash, macOS=zsh, windows=pwsh) across PR + release gates (#434)

2026-05-28 09:23:59 -04:00

ci-prepare-test-scope.cjs

fix(#431): enforce H1 shell policy (linux=bash, macOS=zsh, windows=pwsh) across PR + release gates (#434)

2026-05-28 09:23:59 -04:00

ci-rebase-check.cjs

fix(#431): enforce H1 shell policy (linux=bash, macOS=zsh, windows=pwsh) across PR + release gates (#434)

2026-05-28 09:23:59 -04:00

ci-test-scope.cjs

enhancement(#537): pilot TS build-at-publish for bin/lib (semver-compare) (#541)

2026-05-31 14:47:48 -04:00

command-contract-helpers.cjs

fix(3597): windows test parity batch — CRLF parsers, ESM file URLs, posix-tmp, bash-only skips, retry bump

2026-05-16 12:03:44 -04:00

diff-touches-shipped-paths.cjs

chore(#192): retire sdk release pipeline seam

2026-05-25 11:20:43 -04:00

fix-slash-commands.cjs

fix(3583): normalize retired colon-form commands in generated Claude/Qwen/Hermes SKILL.md bodies (#3629)

2026-05-16 13:09:58 -04:00

gen-inventory-manifest.cjs

docs: close doc drift vectors — bidirectional parity, manifest, schema-driven config (#2479)

2026-04-20 09:39:05 -04:00

generate-package-identity.cjs

feat(#498): single Package Identity seam for /gsd:update + fix runtime undefined-name bug (#499)

2026-05-30 16:53:44 -04:00

lint-command-contract.cjs

fix: apply CodeRabbit auto-fixes

2026-05-05 22:36:38 +00:00

lint-descriptions.cjs

feat(#2789): trim skill description anti-patterns; enforce 100-char budget (#2823)

2026-04-29 08:14:11 -04:00

lint-docs-required.cjs

Enforce documentation updates via lint:docs + PR templates (#3651)

2026-05-16 13:09:54 -04:00

lint-no-source-grep-extras.cjs

feat(#2982): extend no-source-grep lint to catch var-binding readFileSync.includes() (#2985)

2026-05-01 19:50:10 -04:00

lint-no-source-grep.cjs

feat(#2982): extend no-source-grep lint to catch var-binding readFileSync.includes() (#2985)

2026-05-01 19:50:10 -04:00

lint-package-identity-drift.cjs

feat(#498): single Package Identity seam for /gsd:update + fix runtime undefined-name bug (#499)

2026-05-30 16:53:44 -04:00

lint-pr-check-project-dir.cjs

test: forbid cwd in PR checkers

2026-05-15 20:00:29 -04:00

lint-shell-command-projection-drift.cjs

feat(shell-projection): add shim wrapper drift guard (#3448)

2026-05-12 20:49:43 -04:00

lint-skill-deps.cjs

feat(skill-surface): install-time profiles + runtime /gsd:surface (#3408) (#3456)

2026-05-13 12:45:16 -04:00

lint-test-file-count.allowlist.json

test(#192): ratchet audit prefix test-file-count allowlist

2026-05-25 11:30:47 -04:00

lint-test-file-count.cjs

chore(tests): lint rule — cap test files per production module at 2 (#3738)

2026-05-20 20:37:07 -04:00

pr-template-policy.cjs

fix(ci): replace minimatch with path.matchesGlob in pr-template-policy (#3701)

2026-05-18 12:41:01 -04:00

prompt-injection-scan.sh

test(3596): adversarial security/prompt-injection abuse suite (#3654)

2026-05-17 00:34:53 -04:00

release-tarball-smoke.cjs

chore(#518): rename npm package + bin to @opengsd/gsd-core (#519)

2026-05-30 17:25:02 -04:00

run-affected-tests.cjs

ci(#365): run affected tests for pull request CI lanes (#366)

2026-05-26 18:54:27 -04:00

run-cross-platform-tests.cjs

test: add cross-platform test run module (#335)

2026-05-26 11:23:23 -04:00

run-tests.cjs

enhancement(#537): pilot TS build-at-publish for bin/lib (semver-compare) (#541)

2026-05-31 14:47:48 -04:00

secret-scan-lint.sh

feat(115): secret-scan exclusion governance + --strict reduced-scan mode (#134)

2026-05-23 10:58:14 -04:00

secret-scan.sh

feat(115): secret-scan exclusion governance + --strict reduced-scan mode (#134)

2026-05-23 10:58:14 -04:00

setup-branch-protection.sh

chore(#518): rename npm package + bin to @opengsd/gsd-core (#519)

2026-05-30 17:25:02 -04:00

strip-prose-atrefs.cjs

fix(coderabbit): resolve all 12 findings on PR #3152

2026-05-05 16:06:29 -04:00

sync-rulesets.sh

chore(#518): rename npm package + bin to @opengsd/gsd-core (#519)

2026-05-30 17:25:02 -04:00

sync-runtime-launcher.cjs

fix(#373): replace unquoted $GSD_SDK with space-safe gsd_run launcher (#379)

2026-05-27 20:21:05 -04:00

test-failure-reasons.cjs

test: add typed failure classification module (#333)

2026-05-26 11:23:29 -04:00

workflow-policy.cjs

fix(#437,#439,#440): restore defaults.run.shell + 'zsh {0}' format + Windows .cmd shell:true (PR #434 fallout) (#438)

2026-05-28 18:06:19 -04:00