golem15/msd-core
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
cc3ee301a7827a06bca912539594a3e88134fd7f
msd-core/tests/fixtures/install-tree/kilo.json
0xdhx cc3ee301a7 fix(#2544): stage the CommonJS marker in GSD-owned dirs, not the config root (#2593) 
* fix(#2544): stage the CommonJS marker in GSD-owned dirs, not the config root

installSharedHooksBundle wrote `{"type":"commonjs"}` over
<configRoot>/package.json unconditionally — no existence check, no merge,
no backup — on every install and every /gsd-update re-install. On the 11
affected runtimes that file is often user-owned; on OpenCode and Kilo it is
the documented place to declare local-plugin npm dependencies, so a user's
name/type/dependencies/scripts were destroyed on each run.

The uninstall path already read the file and unlinked it only on an exact
content match. That asymmetry was the defect: the discipline existed in the
codebase, it just was not applied on the write side.

Move the marker into the directories GSD creates and fills with its own .js
files — hooks/ (all shared-hooks runtimes, incl. Kimi's own root) and the
nativePlugin dir (plugins/ for OpenCode+Kilo, extensions/ for pi) — and stop
writing the config root entirely. New src/commonjs-marker.cts owns the marker
string plus one ownership predicate (absent / gsd-owned / foreign, fail-closed
on an unreadable file) shared by ensureCommonJsMarker and removeCommonJsMarker,
so install and uninstall cannot drift apart again.

Nothing else depended on the config-root marker: package identity is baked at
build time (#378/#498) and version resolution prefers gsd-core/VERSION and
already tolerates a missing root package.json (#1383) — Codex has installed
without one all along. A package.json in plugins/ or extensions/ is inert to
plugin discovery, which globs *.{ts,js} only (see installer-migration 006).

Uninstall retires the pre-fix config-root marker, so upgrading users are
cleaned up on removal, and still never touches a file it did not write.

* fix(#2544): point the changeset fragment at the filed PR

The fragment's `pr:` field is only knowable after `gh pr create` returns.

* fix(#2544): register commonjs-marker.cjs in the tsc-generated ESLint ignore set

bin/lib/commonjs-marker.cjs is tsc output (src/commonjs-marker.cts is the
linted source), so it belongs in the ADR-457 ignore list like its siblings.
Clears the lint-tests no-var failure and the repo-invariants
"linted xor ignored" migration-state test.

* fix(#2544): pin the kimi CommonJS marker to hooks/, not the ~/.kimi root

The UPGRADE 1 test still asserted the pre-#2544 marker location
(~/.kimi/package.json). The marker now lives inside ~/.kimi/hooks — the
directory GSD itself creates — matching the updated golden-install-parity
and install-tree fixtures. Also asserts the root marker is NOT written.

* fix(#2544): make the CommonJS marker write path non-fatal

Review round 2, Major 3 + Minor 1 + the stagedHooks nit.

ensureCommonJsMarker rethrew any non-EEXIST write error and neither call site
caught it, so EACCES on a read-only hooks/, EROFS, or ENOSPC aborted the whole
install with a raw stack trace. Every other marker interaction in the module is
best-effort — removeCommonJsMarker swallows unlink failures, classifyMarker
swallows read failures — and this was the write path, i.e. the one most likely
to fail on a locked-down config dir. It now returns a new 'failed' outcome and
both call sites warn and continue.

Sibling found while sweeping for the same defect class: fs.mkdirSync sat
OUTSIDE the try block, so an unwritable parent threw past the guard entirely.
Creating the directory is the same environmental hazard as writing into it, so
it moved inside.

Also in this file:

- The hooks marker is now gated on `stagedHooks && hooksOk`, not stagedHooks
  alone. stagedHooks is computed from the SOURCE listing before the copy loop,
  so it stays true when the copies land but verifyInstalled() then fails —
  marking a hooks/ GSD did not successfully populate claims an ownership the
  install did not earn.
- The uninstall rmdir of the native plugin dir is gated on GSD having actually
  removed something from it. Hoisting it out of the adapter-exists guard (so
  the marker-only case could prune) had silently widened it into deleting a
  user-created but empty plugins/ or extensions/ dir — the same "don't touch
  territory GSD didn't fill" principle this issue is about, inverted.
- Kimi's pre-#2544 marker at its native hook root (~/.kimi) is retired at the
  same call site that writes its replacement. That path is outside kimi's
  configDir, so installer-migration 007 structurally cannot reach it.

* fix(#2544): retire the stale config-root marker via installer-migration 007

Review round 2, Major 1 — the PR's headline claim was false for existing
installs. Upgraders kept BOTH markers: the new one under hooks/ and the stale
{"type":"commonjs"} at the config root, so their config root stayed pinned to
CommonJS and their dependency manifest stayed gone until they uninstalled.

The migration is unusual in one way, and it is the part worth reviewing: the
config-root marker was never recorded in gsd-file-manifest.json (writeManifest
records hooks/, agents/, commands/, scripts/ and the native plugin, never a root
package.json), so classifyArtifact answers 'unknown' for it and the planner's
own guard downgrades a remove-managed on an 'unknown' classification to
preserve-user. 007 therefore supplies the "purpose-built detector for an old
GSD-owned shape" that docs/installer-migrations.md#remove-managed sanctions —
exact content match, the same predicate removeCommonJsMarker has always used —
and declares the resulting classification on the action. A package.json with any
other content is left untouched, and there is deliberately no backup-and-remove
branch: a non-matching file here is not a patched GSD artifact, it is somebody
else's file.

Scope is all runtimes. The `runtimes` field is OMITTED rather than `[]`:
validateStringArray requires the field to be non-empty WHEN PRESENT, while the
runtime filter treats an empty array as "all" — so `runtimes: []` throws at plan
time and the migration never runs. The metadata test pins this.

Kimi is a deliberate carve-out, named in the migration's own header: its marker
lived at ~/.kimi, outside kimi's configDir, and migration relPaths are
structurally confined to configDir. It is retired by the installer instead.

Registration: shipped-migrations table, .gitignore for the emitted .cjs, the
EXPECTED_CHECKSUMS baseline, and the ESLint ignore set. That last one is not
copied from migration 006 by rote — 006 needs no entry because it imports
nothing, while 007 imports node builtins, so tsc emits its __importDefault
helper and the `var` in it trips no-var. This is the same lint gate that made
round 1 red.

* test(#2544): fault-injection and multi-runtime marker coverage

Review round 2, Major 2 + Minors 4 and 5.

Major 2 — CONTRIBUTING.md:514-531 is mandatory for install/uninstall flows and
the suite had no fs monkeypatching at all. Every branch now covered is one whose
doc comment claims it as the module's safety posture:

- classifyMarker non-ENOENT lstat error -> 'foreign' (the fail-closed rule),
  with an ENOENT control alongside it so the test discriminates rather than
  just asserting one side
- classifyMarker readFileSync throw -> 'foreign' (present-but-unreadable never
  downgrades to the permissive answer) — the fixture's bytes are exactly GSD's
  marker, so the test fails if the code ever answers on content it could not read
- a DIRECTORY at the marker path (CONTRIBUTING:521; the symlink case was already
  covered with a real symlink, the directory case needs no injection at all)
- the ensureCommonJsMarker TOCTOU EEXIST branch — the entire reason for flag:'wx'
- the new 'failed' outcome, for both writeFileSync (EACCES/EROFS/ENOSPC) and the
  mkdirSync that used to sit outside the guard
- removeCommonJsMarker unlink throw -> false

These save and restore fs methods in `finally` rather than using chmod 0o000,
which does not fault under root and would pass vacuously in root Docker and CI.

Minor 4 — uninstall was driven for opencode only. pi's extensions/ and both
kimi locations now have behavioral coverage, install and uninstall, each paired
with a user-authored-file case proving GSD leaves it alone.

Minor 5 — the stagedHooks gate had no assertion behind its stated reason.
A pre-existing, GSD-untouched hooks/ directory is now driven through a runtime
that declares skipSharedHooksInstall and asserted to stay marker-free, with its
user content intact.

Also regression-tests the uninstall rmdir gate from the previous commit: an
empty plugin dir GSD removed nothing from must survive.

* docs(#2544): correct stale marker prose, register the module, document the trade-off

Review round 2, Minors 2, 3 and 6.

Minor 2 — six files asserted the installed ROOT ships the synthetic marker.
None was load-bearing (all three walk-up consumers are VERSION-first with
try/catch and the marker never carried a `version`), but ADR-457:52 is the
rationale for keeping a generated module, so a future reader would mis-derive
the constraint from it. Each site is corrected to what is now true: the
installed tree carries no package.json with a .name at all, because the only
ones GSD stages are {"type":"commonjs"} markers and they now live in GSD's own
directories.

Two of the six needed more than a location swap. hooks/gsd-check-update-worker.js
and the platform-gate test both described `require('../package.json').name`
resolving to undefined; post-#2544 that require does not resolve at all, so the
history is kept accurate and the present-tense claim corrected rather than just
moved. And src/runtime-artifact-conversion.cts described the no-root-package.json
case as Codex-only — it is now every runtime, which strengthens that comment's
own argument for lazy resolution. The generated .cjs sibling needs no edit: it
is gitignored build output, not a tracked file.

Minor 3 — src/commonjs-marker.cts had no CONTEXT.md entry, unlike every peer
module, and CONTEXT.md is the #2 co-change partner of bin/install.js. Added,
including the fail-closed posture and the never-throws contract.

Minor 6 — the plugins//extensions/ marker shadows the config root for all .js
siblings, so an OpenCode/Kilo user's ESM plugin/*.js stays broken. That is
exactly what #2544's Fix section prescribed and it is disclosed in the PR body,
but the PR body is not documentation. It now lives in the OpenCode section of
docs/how-to/install-on-your-runtime.md, stated as a real constraint rather than
a pure improvement, with the .ts mitigation and a fallback for ESM plugins.

* test(#2544): attribute the CommonJS marker in the emitted-provenance rules

The differential emitted-attribution gate (#2723, landed on `next` after this
branch was cut) went red on the macOS shards once this PR rebased onto it. Two
distinct causes, both real gaps rather than noise:

1. `plugins/package.json` and `extensions/package.json` matched NO rule — the
   `native-plugin` rule covers `*.{js,cjs,mjs}` only, so the marker read as an
   unattributed emitted family.
2. `hooks/package.json` fell through to `hooks-built`, which attributes an
   emitted `hooks/<X>` to a repo source `hooks/<X>`. There is no
   `hooks/package.json` in the repo, so it resolved to a nonexistent path.

Cause 2 is exactly the failure already documented three lines above it for
Copilot's `gsd-session.json` — "a code literal, not a built script" — so the fix
follows that precedent rather than inventing one: `package.json` is excluded
from `hooks-built` the same way, and a dedicated `commonjs-marker` rule
attributes the family across all four roots it can appear in (both hooks roots
plus `plugins`/`extensions`) to the sources that actually emit it.

Deliberately a RULE, not an entry in tests/emitted-drift-ack.json. An ack is for
a one-off ripple and goes stale by design — the gate fails a stale ack precisely
so it cannot pre-clear the next change on that path. These markers are a
permanent part of the emitted tree from #2544 onward, so they need standing
attribution.

Verified by reproducing the CI failure locally with GSD_EMITTED_BASE: 3
provenance errors + 12 unattributed paths before, 35/35 green after.

* fix(#2544): route the #2717 hooks-surface marker helpers through commonjs-marker

#2717 landed a second copy of ensureCommonJsMarker/removeCommonJsMarkerIfGsdOwned
in src/runtime-hooks-surface.cts for the runtimes that stage .js hooks via
dedicated paths (cursor/windsurf/codex). That copy had drifted from this PR's
module on the two properties that matter:

  - ownership probe: `fs.existsSync` FOLLOWS symlinks and reports false for a
    DANGLING one, so a dangling package.json symlink classified as absent and
    the write went straight through it. Demonstrated: against the pre-fix copy,
    ensureCommonJsMarker() on a hooks/ dir holding a dangling package.json
    symlink returns true and creates {"type":"commonjs"} OUTSIDE that directory.
  - create: a plain writeFileSync leaves the classify->write window open, where
    commonjs-marker creates with flag:'wx' (O_EXCL).

Both helpers now delegate to src/commonjs-marker.cts, which is what this PR's
own docstring already claimed was the single place these rules are enforced.
Exported signatures are unchanged (still boolean), so bin/install.js and the
#2717 tests are unaffected.

The new subtest is the only coverage that fails if the duplicate is ever
reintroduced — the two implementations agree on every non-adversarial input, so
the existing suites pass against both.

* test(#2544): pin the stagedHooks gate on zcode, not windsurf

The Minor-5 coverage picked windsurf because hostBehaviors.skipSharedHooksInstall
kept it out of the shared hooks bundle, so GSD staged nothing into hooks/ and the
marker was correctly absent.

#2717 changed that premise: cursor/windsurf/codex now stage their .js hooks via
dedicated paths and get the marker beside those scripts. Measured on this tree,
windsurf stages 2 .js hooks and receives a marker — so the assertion was pinning
behaviour that is now wrong, not the gate it was written for.

ZCode is the durable choice: per #1821 it has hooksSurface:'none' AND no plugin
surface to spawn hooks, so GSD stages no .js there by either route (measured: 0
staged, no marker). The property under test is unchanged — a user-created hooks/
directory GSD never fills stays marker-free.

* test(#2544): use the shared cleanup helper in the migration test

Addresses the review's Major 1. The suppression's stated reason — "no helpers
import available" — was not correct: tests/helpers.cjs exports cleanup, and the
other test file added in this same PR imports it (tests/commonjs-marker.test.cjs).

The local reimplementation dropped two protections that are live on this repo's
windows-latest lane: the CWD guard (Windows cannot remove a directory that is the
current working directory) and the 20 x 250ms retry budget that absorbs the
deferred-scan handle Windows Defender holds on newly-written files.

Local function and suppression both removed; local/no-raw-rmsync-in-tests now
passes without one.

* test(#2544): expect hooks/package.json for the #2717 runtimes

The fresh-install contract table predates #2717, which stages cursor/windsurf/
codex .js hooks via dedicated paths and writes the CommonJS marker beside them.
All three therefore now receive hooks/package.json legitimately.

Measured on this tree: codex stages 3 .js hooks, cursor 6, windsurf 2 — each with
the marker; cline/copilot/trae/zcode stage none and get none, so their contracts
are unchanged.

* fix(#2544): gate the #2717 marker writes on having staged something

The three dedicated marker writers #2717 added ran unconditionally. Each one
mkdirs hooks/ up front and stages its scripts conditionally on the source
existing, so with an absent or empty hook source they created a directory,
filled it with nothing, and marked it as GSD's anyway.

That is the same write-into-someone-else's-territory this issue is about, and
installSharedHooksBundle already guards the identical case with `stagedHooks`.
The dedicated paths now carry the matching gate:

  - cursor / windsurf: `installedScripts.size > 0`
  - codex: a new `codexStagedHooks` flag. The enclosing guard only proves that
    hooks/dist EXISTS; it says nothing about whether any CODEX_HOOKS_TO_COPY
    entry landed.

Covered for cursor and windsurf by driving each writer against a src tree whose
hooks/ dir is empty. The codex leg is defensive and deliberately uncovered: its
trigger state needs a package tree where hooks/dist exists but holds none of the
allowlist, which is not constructible from a real checkout.

* test(#2544): scope the commonjs-marker sources per root

The rule declared one flat source list for every marker root, so
`extensions/package.json` was attributed to runtime-hooks-surface.cts (which
never writes there) and `.kimi/hooks/package.json` to install-engine.cts.

That is not merely untidy. emitted-diff.cjs accepts the FIRST satisfied source,
so a flat list containing bin/install.js let any change anywhere in that
13k-line file authorise marker drift for every root — the blanket escape hatch
this file's own agents-verbatim comment refuses for exactly the same reason.

Sources are now derived per root from ctx.rel. Note the rule ctx is
`{ rel, runtime }` and carries no `root`, so keying on ctx.root would have sent
every path down one branch silently.

* test(#2544): state precisely what the zcode assertion pins

The comment claimed the test pinned installSharedHooksBundle's `stagedHooks`
gate. It does not, and neither did the windsurf version it replaced: zcode
declares skipSharedHooksInstall, so the outer guard skips that helper entirely
and the gate is never evaluated. The test passes on the runtime exclusion.

What it does pin — the outcome a pre-existing, GSD-untouched hooks/ stays
marker-free — is still worth having, and is what the review asked for. The two
`staging zero hook scripts` tests are the ones that pin a real staged-nothing
gate. Comment corrected rather than left implying coverage that is not there.

---------

Co-authored-by: Tom Boucher <trekkie@nomorestars.com>
2026-08-01 21:00:23 -04:00

518 lines
20 KiB
JSON
Raw Blame History

[
".gsd-profile",
".gsd/defaults.json",
"agents/gsd-advisor-researcher.md",
"agents/gsd-ai-researcher.md",
"agents/gsd-assumptions-analyzer.md",
"agents/gsd-code-fixer.md",
"agents/gsd-code-reviewer.md",
"agents/gsd-codebase-mapper.md",
"agents/gsd-debug-session-manager.md",
"agents/gsd-debugger.md",
"agents/gsd-doc-classifier.md",
"agents/gsd-doc-synthesizer.md",
"agents/gsd-doc-verifier.md",
"agents/gsd-doc-writer.md",
"agents/gsd-domain-researcher.md",
"agents/gsd-eval-auditor.md",
"agents/gsd-eval-planner.md",
"agents/gsd-executor.md",
"agents/gsd-framework-selector.md",
"agents/gsd-integration-checker.md",
"agents/gsd-intel-updater.md",
"agents/gsd-mempalace-curator.md",
"agents/gsd-nyquist-auditor.md",
"agents/gsd-pattern-mapper.md",
"agents/gsd-phase-researcher.md",
"agents/gsd-plan-checker.md",
"agents/gsd-planner.md",
"agents/gsd-project-researcher.md",
"agents/gsd-research-synthesizer.md",
"agents/gsd-roadmapper.md",
"agents/gsd-security-auditor.md",
"agents/gsd-ui-auditor.md",
"agents/gsd-ui-checker.md",
"agents/gsd-ui-researcher.md",
"agents/gsd-user-profiler.md",
"agents/gsd-verifier.md",
"command/gsd-add-tests.md",
"command/gsd-ai-integration-phase.md",
"command/gsd-audit-fix.md",
"command/gsd-audit-milestone.md",
"command/gsd-audit-uat.md",
"command/gsd-autonomous.md",
"command/gsd-capture.md",
"command/gsd-cleanup.md",
"command/gsd-code-review.md",
"command/gsd-complete-milestone.md",
"command/gsd-config.md",
"command/gsd-debug.md",
"command/gsd-discuss-phase.md",
"command/gsd-docs-update.md",
"command/gsd-eval-review.md",
"command/gsd-execute-phase.md",
"command/gsd-explore.md",
"command/gsd-extract-learnings.md",
"command/gsd-fast.md",
"command/gsd-forensics.md",
"command/gsd-graphify.md",
"command/gsd-health.md",
"command/gsd-help.md",
"command/gsd-import.md",
"command/gsd-inbox.md",
"command/gsd-ingest-docs.md",
"command/gsd-manager.md",
"command/gsd-map-codebase.md",
"command/gsd-mempalace-capture.md",
"command/gsd-mempalace-recall.md",
"command/gsd-milestone-summary.md",
"command/gsd-mvp-phase.md",
"command/gsd-new-milestone.md",
"command/gsd-new-project.md",
"command/gsd-next.md",
"command/gsd-ns-context.md",
"command/gsd-ns-ideate.md",
"command/gsd-ns-manage.md",
"command/gsd-ns-project.md",
"command/gsd-ns-review.md",
"command/gsd-ns-workflow.md",
"command/gsd-onboard.md",
"command/gsd-pause-work.md",
"command/gsd-phase.md",
"command/gsd-plan-phase.md",
"command/gsd-plan-review-convergence.md",
"command/gsd-pr-branch.md",
"command/gsd-profile-user.md",
"command/gsd-progress.md",
"command/gsd-quick.md",
"command/gsd-resume-work.md",
"command/gsd-review-backlog.md",
"command/gsd-review.md",
"command/gsd-secure-phase.md",
"command/gsd-settings.md",
"command/gsd-ship.md",
"command/gsd-sketch.md",
"command/gsd-spec-phase.md",
"command/gsd-spike.md",
"command/gsd-stats.md",
"command/gsd-surface.md",
"command/gsd-thread.md",
"command/gsd-ui-phase.md",
"command/gsd-ui-review.md",
"command/gsd-ultraplan-phase.md",
"command/gsd-undo.md",
"command/gsd-update.md",
"command/gsd-validate-phase.md",
"command/gsd-verify-work.md",
"command/gsd-workspace.md",
"command/gsd-workstreams.md",
"gsd-core/.gsd-runtime",
"gsd-core/VERSION",
"gsd-core/bin/check-latest-version.cjs",
"gsd-core/bin/ensure-runtime-build.cjs",
"gsd-core/bin/gsd-tools.cjs",
"gsd-core/bin/gsd_run",
"gsd-core/bin/shared/config-defaults.manifest.json",
"gsd-core/bin/shared/config-schema.manifest.json",
"gsd-core/bin/shared/model-catalog.json",
"gsd-core/bin/shared/runtime-aliases.manifest.json",
"gsd-core/bin/verify-reapply-patches.cjs",
"gsd-core/contexts/dev.md",
"gsd-core/contexts/research.md",
"gsd-core/contexts/review.md",
"gsd-core/references/agent-contracts.md",
"gsd-core/references/agent-skills-bootstrap.md",
"gsd-core/references/ai-evals.md",
"gsd-core/references/ai-frameworks.md",
"gsd-core/references/api-coverage.md",
"gsd-core/references/artifact-types.md",
"gsd-core/references/autonomous-smart-discuss.md",
"gsd-core/references/checkpoints.md",
"gsd-core/references/common-bug-patterns.md",
"gsd-core/references/context-budget.md",
"gsd-core/references/continuation-format.md",
"gsd-core/references/debugger-bug-taxonomy.md",
"gsd-core/references/debugger-fix-acceptance.md",
"gsd-core/references/debugger-philosophy.md",
"gsd-core/references/debugger-prevention.md",
"gsd-core/references/debugger-rca-branching.md",
"gsd-core/references/debugger-repro-hardening.md",
"gsd-core/references/debugger-sbfl.md",
"gsd-core/references/debugger-semantic-recall.md",
"gsd-core/references/decimal-phase-calculation.md",
"gsd-core/references/doc-conflict-engine.md",
"gsd-core/references/domain-probes.md",
"gsd-core/references/edge-probe-fixtures/01-round-half-even/expected-coverage.json",
"gsd-core/references/edge-probe-fixtures/01-round-half-even/requirements.json",
"gsd-core/references/edge-probe-fixtures/02-merge-intervals/expected-coverage.json",
"gsd-core/references/edge-probe-fixtures/02-merge-intervals/requirements.json",
"gsd-core/references/edge-probe-fixtures/03-truncate-graphemes/expected-coverage.json",
"gsd-core/references/edge-probe-fixtures/03-truncate-graphemes/requirements.json",
"gsd-core/references/edge-probe-fixtures/04-money-rounding/expected-coverage.json",
"gsd-core/references/edge-probe-fixtures/04-money-rounding/requirements.json",
"gsd-core/references/edge-probe-fixtures/05-list-dedupe/expected-coverage.json",
"gsd-core/references/edge-probe-fixtures/05-list-dedupe/requirements.json",
"gsd-core/references/edge-probe-fixtures/06-resolved-mixed/expected-coverage.json",
"gsd-core/references/edge-probe-fixtures/06-resolved-mixed/requirements.json",
"gsd-core/references/edge-probe-fixtures/06-resolved-mixed/resolutions.json",
"gsd-core/references/edge-probe.md",
"gsd-core/references/execute-mvp-tdd.md",
"gsd-core/references/execute-phase-between-wave-reset.md",
"gsd-core/references/execute-phase-context-guard.md",
"gsd-core/references/execute-phase-quota-recovery.md",
"gsd-core/references/execute-phase-requirement-revert.md",
"gsd-core/references/execute-phase-response-language.md",
"gsd-core/references/execute-phase-wave-guard.md",
"gsd-core/references/executor-examples.md",
"gsd-core/references/few-shot-examples/plan-checker.md",
"gsd-core/references/few-shot-examples/verifier.md",
"gsd-core/references/gate-prompts.md",
"gsd-core/references/gates.md",
"gsd-core/references/git-integration.md",
"gsd-core/references/git-planning-commit.md",
"gsd-core/references/gsd-run-resolver.md",
"gsd-core/references/honest-verifier.md",
"gsd-core/references/ios-scaffold.md",
"gsd-core/references/loop-hook-dispatch.md",
"gsd-core/references/mandatory-initial-read.md",
"gsd-core/references/model-profile-resolution.md",
"gsd-core/references/model-profiles.md",
"gsd-core/references/mvp-concepts.md",
"gsd-core/references/offer-next.md",
"gsd-core/references/phase-argument-parsing.md",
"gsd-core/references/planner-antipatterns.md",
"gsd-core/references/planner-chunked.md",
"gsd-core/references/planner-gap-closure.md",
"gsd-core/references/planner-graphify-auto-update.md",
"gsd-core/references/planner-guidance.md",
"gsd-core/references/planner-human-verify-mode.md",
"gsd-core/references/planner-interface-context.md",
"gsd-core/references/planner-load-graph-context.md",
"gsd-core/references/planner-mvp-mode.md",
"gsd-core/references/planner-preconditions.md",
"gsd-core/references/planner-reversibility.md",
"gsd-core/references/planner-reviews.md",
"gsd-core/references/planner-revision.md",
"gsd-core/references/planner-source-audit.md",
"gsd-core/references/planning-config.md",
"gsd-core/references/prohibition-probe-fixtures/01-streak-reminder/expected.json",
"gsd-core/references/prohibition-probe-fixtures/02-clean-utility/expected.json",
"gsd-core/references/prohibition-probe-fixtures/03-multi-prohibition/expected.json",
"gsd-core/references/prohibition-probe.md",
"gsd-core/references/project-skills-discovery.md",
"gsd-core/references/questioning.md",
"gsd-core/references/research-documentation-lookup.md",
"gsd-core/references/research-philosophy.md",
"gsd-core/references/research-verification-protocol.md",
"gsd-core/references/reviewer-instances.md",
"gsd-core/references/revision-loop.md",
"gsd-core/references/runtime-aware-dispatch.md",
"gsd-core/references/scout-codebase.md",
"gsd-core/references/security-asvs-levels.md",
"gsd-core/references/skeleton-template.md",
"gsd-core/references/sketch-interactivity.md",
"gsd-core/references/sketch-theme-system.md",
"gsd-core/references/sketch-tooling.md",
"gsd-core/references/sketch-variant-patterns.md",
"gsd-core/references/specless-probe-fallback.md",
"gsd-core/references/spidr-splitting.md",
"gsd-core/references/tdd.md",
"gsd-core/references/thinking-models-debug.md",
"gsd-core/references/thinking-models-execution.md",
"gsd-core/references/thinking-models-planning.md",
"gsd-core/references/thinking-models-research.md",
"gsd-core/references/thinking-models-verification.md",
"gsd-core/references/thinking-partner.md",
"gsd-core/references/ui-brand.md",
"gsd-core/references/ui-consideration-probe.md",
"gsd-core/references/universal-anti-patterns.md",
"gsd-core/references/untrusted-input-boundary.md",
"gsd-core/references/user-profiling.md",
"gsd-core/references/user-story-template.md",
"gsd-core/references/verification-overrides.md",
"gsd-core/references/verification-patterns.md",
"gsd-core/references/verify-mvp-mode.md",
"gsd-core/references/workstream-flag.md",
"gsd-core/references/worktree-branch-check.md",
"gsd-core/references/worktree-path-safety.md",
"gsd-core/templates/AI-SPEC.md",
"gsd-core/templates/DEBUG.md",
"gsd-core/templates/README.md",
"gsd-core/templates/SECURITY.md",
"gsd-core/templates/UAT.md",
"gsd-core/templates/UI-SPEC.md",
"gsd-core/templates/VALIDATION.md",
"gsd-core/templates/claude-md.md",
"gsd-core/templates/codebase/architecture.md",
"gsd-core/templates/codebase/concerns.md",
"gsd-core/templates/codebase/conventions.md",
"gsd-core/templates/codebase/integrations.md",
"gsd-core/templates/codebase/stack.md",
"gsd-core/templates/codebase/structure.md",
"gsd-core/templates/codebase/testing.md",
"gsd-core/templates/config.json",
"gsd-core/templates/context.md",
"gsd-core/templates/continue-here.md",
"gsd-core/templates/copilot-instructions.md",
"gsd-core/templates/debug-subagent-prompt.md",
"gsd-core/templates/dev-preferences.md",
"gsd-core/templates/discovery.md",
"gsd-core/templates/discussion-log.md",
"gsd-core/templates/milestone-archive.md",
"gsd-core/templates/milestone.md",
"gsd-core/templates/phase-prompt.md",
"gsd-core/templates/planner-subagent-prompt.md",
"gsd-core/templates/project.md",
"gsd-core/templates/requirements.md",
"gsd-core/templates/research-project/ARCHITECTURE.md",
"gsd-core/templates/research-project/FEATURES.md",
"gsd-core/templates/research-project/PITFALLS.md",
"gsd-core/templates/research-project/STACK.md",
"gsd-core/templates/research-project/SUMMARY.md",
"gsd-core/templates/research.md",
"gsd-core/templates/retrospective.md",
"gsd-core/templates/roadmap.md",
"gsd-core/templates/spec.md",
"gsd-core/templates/state.md",
"gsd-core/templates/summary-complex.md",
"gsd-core/templates/summary-minimal.md",
"gsd-core/templates/summary-standard.md",
"gsd-core/templates/summary.md",
"gsd-core/templates/user-profile.md",
"gsd-core/templates/user-setup.md",
"gsd-core/templates/verification-report.md",
"gsd-core/workflows/_runtime-launcher.snippet.sh",
"gsd-core/workflows/add-backlog.md",
"gsd-core/workflows/add-phase.md",
"gsd-core/workflows/add-tests.md",
"gsd-core/workflows/add-todo.md",
"gsd-core/workflows/ai-integration-phase.md",
"gsd-core/workflows/analyze-dependencies.md",
"gsd-core/workflows/audit-fix.md",
"gsd-core/workflows/audit-milestone.md",
"gsd-core/workflows/audit-uat.md",
"gsd-core/workflows/autonomous.md",
"gsd-core/workflows/check-todos.md",
"gsd-core/workflows/cleanup.md",
"gsd-core/workflows/code-review-fix.md",
"gsd-core/workflows/code-review.md",
"gsd-core/workflows/complete-milestone.md",
"gsd-core/workflows/debug.md",
"gsd-core/workflows/diagnose-issues.md",
"gsd-core/workflows/discovery-phase.md",
"gsd-core/workflows/discuss-phase-assumptions.md",
"gsd-core/workflows/discuss-phase-power.md",
"gsd-core/workflows/discuss-phase.md",
"gsd-core/workflows/discuss-phase/modes/advisor.md",
"gsd-core/workflows/discuss-phase/modes/all.md",
"gsd-core/workflows/discuss-phase/modes/analyze.md",
"gsd-core/workflows/discuss-phase/modes/auto.md",
"gsd-core/workflows/discuss-phase/modes/batch.md",
"gsd-core/workflows/discuss-phase/modes/chain.md",
"gsd-core/workflows/discuss-phase/modes/default.md",
"gsd-core/workflows/discuss-phase/modes/power.md",
"gsd-core/workflows/discuss-phase/modes/text.md",
"gsd-core/workflows/discuss-phase/templates/checkpoint.json",
"gsd-core/workflows/discuss-phase/templates/context.md",
"gsd-core/workflows/discuss-phase/templates/discussion-log.md",
"gsd-core/workflows/do.md",
"gsd-core/workflows/docs-update.md",
"gsd-core/workflows/edit-phase.md",
"gsd-core/workflows/eval-review.md",
"gsd-core/workflows/execute-phase.md",
"gsd-core/workflows/execute-phase/steps/codebase-drift-gate.md",
"gsd-core/workflows/execute-phase/steps/executor-isolation-dispatch.md",
"gsd-core/workflows/execute-phase/steps/per-plan-worktree-gate.md",
"gsd-core/workflows/execute-phase/steps/post-merge-gate.md",
"gsd-core/workflows/execute-phase/steps/regression-gate.md",
"gsd-core/workflows/execute-phase/steps/worktree-recovery-policy.md",
"gsd-core/workflows/execute-plan.md",
"gsd-core/workflows/explore.md",
"gsd-core/workflows/extract-learnings.md",
"gsd-core/workflows/fast.md",
"gsd-core/workflows/forensics.md",
"gsd-core/workflows/graduation.md",
"gsd-core/workflows/health.md",
"gsd-core/workflows/help.md",
"gsd-core/workflows/help/modes/brief.md",
"gsd-core/workflows/help/modes/default.md",
"gsd-core/workflows/help/modes/full.md",
"gsd-core/workflows/help/modes/topic.md",
"gsd-core/workflows/import.md",
"gsd-core/workflows/inbox.md",
"gsd-core/workflows/ingest-docs.md",
"gsd-core/workflows/insert-phase.md",
"gsd-core/workflows/list-phase-assumptions.md",
"gsd-core/workflows/list-seeds.md",
"gsd-core/workflows/list-workspaces.md",
"gsd-core/workflows/manager.md",
"gsd-core/workflows/map-codebase.md",
"gsd-core/workflows/milestone-summary.md",
"gsd-core/workflows/mvp-phase.md",
"gsd-core/workflows/new-milestone.md",
"gsd-core/workflows/new-project.md",
"gsd-core/workflows/new-workspace.md",
"gsd-core/workflows/next.md",
"gsd-core/workflows/node-repair.md",
"gsd-core/workflows/note.md",
"gsd-core/workflows/onboard.md",
"gsd-core/workflows/pause-work.md",
"gsd-core/workflows/plan-milestone-gaps.md",
"gsd-core/workflows/plan-phase.md",
"gsd-core/workflows/plan-phase/steps/closed-phase-gate.md",
"gsd-core/workflows/plan-phase/steps/prd-express-path.md",
"gsd-core/workflows/plan-phase/steps/windows-troubleshooting.md",
"gsd-core/workflows/plan-review-convergence.md",
"gsd-core/workflows/plant-seed.md",
"gsd-core/workflows/pr-branch.md",
"gsd-core/workflows/profile-user.md",
"gsd-core/workflows/progress.md",
"gsd-core/workflows/quick.md",
"gsd-core/workflows/reapply-patches.md",
"gsd-core/workflows/remove-phase.md",
"gsd-core/workflows/remove-workspace.md",
"gsd-core/workflows/resume-project.md",
"gsd-core/workflows/review.md",
"gsd-core/workflows/scan.md",
"gsd-core/workflows/secure-phase.md",
"gsd-core/workflows/session-report.md",
"gsd-core/workflows/settings-advanced.md",
"gsd-core/workflows/settings-integrations.md",
"gsd-core/workflows/settings.md",
"gsd-core/workflows/ship.md",
"gsd-core/workflows/sketch-wrap-up.md",
"gsd-core/workflows/sketch.md",
"gsd-core/workflows/smart-entry.md",
"gsd-core/workflows/spec-phase.md",
"gsd-core/workflows/spike-wrap-up.md",
"gsd-core/workflows/spike.md",
"gsd-core/workflows/stats.md",
"gsd-core/workflows/sync-skills.md",
"gsd-core/workflows/thread.md",
"gsd-core/workflows/transition.md",
"gsd-core/workflows/ui-phase.md",
"gsd-core/workflows/ui-review.md",
"gsd-core/workflows/ultraplan-phase.md",
"gsd-core/workflows/undo.md",
"gsd-core/workflows/update.md",
"gsd-core/workflows/validate-phase.md",
"gsd-core/workflows/verify-phase.md",
"gsd-core/workflows/verify-work.md",
"hooks/gsd-check-update-worker.js",
"hooks/gsd-check-update.js",
"hooks/gsd-config-reload.js",
"hooks/gsd-context-monitor.js",
"hooks/gsd-cursor-post-tool.js",
"hooks/gsd-cursor-pre-tool.js",
"hooks/gsd-cursor-session-start.js",
"hooks/gsd-cursor-stop.js",
"hooks/gsd-cursor-subagent-start.js",
"hooks/gsd-cursor-subagent-stop.js",
"hooks/gsd-ensure-canonical-path.js",
"hooks/gsd-graphify-update.sh",
"hooks/gsd-phase-boundary.sh",
"hooks/gsd-prompt-guard.js",
"hooks/gsd-read-guard.js",
"hooks/gsd-read-injection-scanner.js",
"hooks/gsd-session-state.sh",
"hooks/gsd-statusline.js",
"hooks/gsd-update-banner.js",
"hooks/gsd-validate-commit.sh",
"hooks/gsd-windsurf-pre-command.js",
"hooks/gsd-windsurf-pre-write.js",
"hooks/gsd-workflow-guard.js",
"hooks/gsd-worktree-path-guard.js",
"hooks/lib/cursor-workspace.js",
"hooks/lib/git-cmd.js",
"hooks/lib/gsd-graphify-rebuild.sh",
"hooks/managed-hooks-registry.cjs",
"hooks/package.json",
"kilo.json",
"plugins/gsd-core.js",
"plugins/package.json",
"scripts/changeset/README.md",
"scripts/changeset/cli.cjs",
"scripts/changeset/github-release-notes.cjs",
"scripts/changeset/lint.cjs",
"scripts/changeset/new.cjs",
"scripts/changeset/parse.cjs",
"scripts/changeset/render.cjs",
"scripts/changeset/serialize.cjs",
"scripts/fix-slash-commands.cjs",
"scripts/gen-capability-registry.cjs",
"scripts/gen-loop-host-contract.cjs",
"scripts/lib/allowlist-ratchet.cjs",
"scripts/lib/cli-exit.cjs",
"skills/gsd-add-tests/SKILL.md",
"skills/gsd-ai-integration-phase/SKILL.md",
"skills/gsd-audit-fix/SKILL.md",
"skills/gsd-audit-milestone/SKILL.md",
"skills/gsd-audit-uat/SKILL.md",
"skills/gsd-autonomous/SKILL.md",
"skills/gsd-capture/SKILL.md",
"skills/gsd-cleanup/SKILL.md",
"skills/gsd-code-review/SKILL.md",
"skills/gsd-complete-milestone/SKILL.md",
"skills/gsd-config/SKILL.md",
"skills/gsd-debug/SKILL.md",
"skills/gsd-discuss-phase/SKILL.md",
"skills/gsd-docs-update/SKILL.md",
"skills/gsd-eval-review/SKILL.md",
"skills/gsd-execute-phase/SKILL.md",
"skills/gsd-explore/SKILL.md",
"skills/gsd-extract-learnings/SKILL.md",
"skills/gsd-fast/SKILL.md",
"skills/gsd-forensics/SKILL.md",
"skills/gsd-graphify/SKILL.md",
"skills/gsd-health/SKILL.md",
"skills/gsd-help/SKILL.md",
"skills/gsd-import/SKILL.md",
"skills/gsd-inbox/SKILL.md",
"skills/gsd-ingest-docs/SKILL.md",
"skills/gsd-manager/SKILL.md",
"skills/gsd-map-codebase/SKILL.md",
"skills/gsd-mempalace-capture/SKILL.md",
"skills/gsd-mempalace-recall/SKILL.md",
"skills/gsd-milestone-summary/SKILL.md",
"skills/gsd-mvp-phase/SKILL.md",
"skills/gsd-new-milestone/SKILL.md",
"skills/gsd-new-project/SKILL.md",
"skills/gsd-next/SKILL.md",
"skills/gsd-ns-context/SKILL.md",
"skills/gsd-ns-ideate/SKILL.md",
"skills/gsd-ns-manage/SKILL.md",
"skills/gsd-ns-project/SKILL.md",
"skills/gsd-ns-review/SKILL.md",
"skills/gsd-ns-workflow/SKILL.md",
"skills/gsd-onboard/SKILL.md",
"skills/gsd-pause-work/SKILL.md",
"skills/gsd-phase/SKILL.md",
"skills/gsd-plan-phase/SKILL.md",
"skills/gsd-plan-review-convergence/SKILL.md",
"skills/gsd-pr-branch/SKILL.md",
"skills/gsd-profile-user/SKILL.md",
"skills/gsd-progress/SKILL.md",
"skills/gsd-quick/SKILL.md",
"skills/gsd-resume-work/SKILL.md",
"skills/gsd-review-backlog/SKILL.md",
"skills/gsd-review/SKILL.md",
"skills/gsd-secure-phase/SKILL.md",
"skills/gsd-settings/SKILL.md",
"skills/gsd-ship/SKILL.md",
"skills/gsd-sketch/SKILL.md",
"skills/gsd-spec-phase/SKILL.md",
"skills/gsd-spike/SKILL.md",
"skills/gsd-stats/SKILL.md",
"skills/gsd-surface/SKILL.md",
"skills/gsd-thread/SKILL.md",
"skills/gsd-ui-phase/SKILL.md",
"skills/gsd-ui-review/SKILL.md",
"skills/gsd-ultraplan-phase/SKILL.md",
"skills/gsd-undo/SKILL.md",
"skills/gsd-update/SKILL.md",
"skills/gsd-validate-phase/SKILL.md",
"skills/gsd-verify-work/SKILL.md",
"skills/gsd-workspace/SKILL.md",
"skills/gsd-workstreams/SKILL.md"
]
Reference in New Issue View Git Blame Copy Permalink