chore: merge release v1.17.0 to main

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "gsd-core",
       "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
-      "version": "1.16.0",
+      "version": "1.17.0",
       "source": "./",
       "author": {
         "name": "open-gsd",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gsd-core",
   "displayName": "GSD Core",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "author": {
     "name": "open-gsd",
@@ -18,6 +18,5 @@
     "claude-code",
     "gsd"
   ],
-  "commands": "./commands/gsd/",
   "skills": "./skills/"
 }

.github/workflows/release.yml

@@ -415,6 +415,12 @@ jobs:
       - name: Run unit tests (shard ${{ matrix.shard }}, raw coverage only)
         env:
           NODE_OPTIONS: --max-old-space-size=6144
+          # Pin the #3588/#4196 npm-audit gate's baseline to the commit this
+          # run was dispatched from. Unset, resolveBaselineRef() falls back to
+          # the LIVE origin/next tip, which can move mid-run (run 38549271057:
+          # an advisory fixed on next after the run began was reported as
+          # "newly introduced" by this branch). Same pinning test.yml does.
+          AUDIT_BASELINE_REF: ${{ github.sha }}
         run: |
           npm ci
           node scripts/check-npm-integrity.cjs
@@ -694,6 +700,12 @@ jobs:
       - name: Run unit tests (shard ${{ matrix.shard }}, raw coverage only)
         env:
           NODE_OPTIONS: --max-old-space-size=6144
+          # Pin the #3588/#4196 npm-audit gate's baseline to the commit this
+          # run was dispatched from. Unset, resolveBaselineRef() falls back to
+          # the LIVE origin/next tip, which can move mid-run (run 38549271057:
+          # an advisory fixed on next after the run began was reported as
+          # "newly introduced" by this branch). Same pinning test.yml does.
+          AUDIT_BASELINE_REF: ${{ github.sha }}
         run: |
           npm ci
           node scripts/check-npm-integrity.cjs

.gitignore

@@ -151,6 +151,8 @@ build/
 /gsd-core/bin/lib/review-reviewer-selection.cjs
 /gsd-core/bin/lib/review-lane-descriptor.cjs
 /gsd-core/bin/lib/review-lane-invocation.cjs
+/gsd-core/bin/lib/opencode-version.cjs
+/gsd-core/bin/lib/jsonc-edit.cjs
 /gsd-core/bin/lib/review-lane-runner.cjs
 /gsd-core/bin/lib/reviewer-step-dispatch.cjs
 /gsd-core/bin/lib/clusters.cjs
@@ -199,6 +201,8 @@ build/
 /gsd-core/bin/lib/installer-migrations/007-retire-config-root-commonjs-marker.cjs
 /gsd-core/bin/lib/installer-migrations/009-pi-retire-reserved-hooks-dir.cjs
 /gsd-core/bin/lib/installer-migrations/010-antigravity-retire-confighome-artifacts.cjs
+/gsd-core/bin/lib/installer-migrations/011-opencode-mcp-no-prompts.cjs
+/gsd-core/bin/lib/opencode-mcp-entry.cjs
 /gsd-core/bin/lib/observability/logger.cjs
 /gsd-core/bin/lib/active-workstream-store.cjs
 /gsd-core/bin/lib/adr-parser.cjs

.kilo/plugins/gsd-core.js

@@ -239,6 +239,18 @@ function gitProbingGuardTimeoutMs() {
   return GIT_PROBING_GUARD_FALLBACK_TIMEOUT_MS;
 }
 
+// Hooks are Node scripts. `process.execPath` is only a JS runtime when the host is Node or Bun
+// itself; inside OpenCode's single-file binary (1.x and 2.x) spawning it with a .js path boots
+// OpenCode instead and exits 0, silently disabling every guard (#4849). So: an explicit
+// GSD_HOOK_RUNTIME wins, then a Node/Bun host's own executable, else `node` from PATH.
+let warnedMissingRuntime = false;
+function hookRuntime() {
+  const fromEnv = process.env.GSD_HOOK_RUNTIME;
+  if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv;
+  const base = path.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
+  return base === "node" || base === "bun" ? process.execPath : "node";
+}
+
 function runHook(hookFile, payload, opts = {}) {
   const hookPath = path.join(HOOKS_DIR, hookFile);
   if (!fs.existsSync(hookPath)) {
@@ -261,7 +273,7 @@ function runHook(hookFile, payload, opts = {}) {
     (GIT_PROBING_GUARDS.has(hookFile) ? gitProbingGuardTimeoutMs() : 8000);
   let result;
   try {
-    result = spawnSync(process.execPath, [hookPath], {
+    result = spawnSync(hookRuntime(), [hookPath], {
       input: JSON.stringify(payload),
       encoding: "utf8",
       timeout,
@@ -273,6 +285,15 @@ function runHook(hookFile, payload, opts = {}) {
     return { stdout: "", exitCode: 0, timedOut: false };
   }
 
+  if (result.error && !warnedMissingRuntime) {
+    // The runtime could not be started: the guard did not run. Fail open (adapter contract) but
+    // never silently (#4849).
+    warnedMissingRuntime = true;
+    console.error(
+      `[gsd-core] cannot start hook runtime '${hookRuntime()}' (${result.error.code || result.error.message}) — ` +
+        "GSD hooks are NOT enforced. Install Node.js or set GSD_HOOK_RUNTIME to a node/bun executable.",
+    );
+  }
   const stdout = (result.stdout || "").trim();
   const exitCode = result.status == null ? 0 : result.status;
   return { stdout, exitCode, timedOut: result.signal === "SIGTERM" };