From 13a96ee994fa4289bd3f50d65a4a02fcbae5b26c Mon Sep 17 00:00:00 2001 From: Jeremy McSpadden Date: Sat, 18 Apr 2026 08:42:36 -0500 Subject: [PATCH] fix(build): include gsd-read-injection-scanner in hooks/dist (#2406) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scanner was added in #2201 but never added to the HOOKS_TO_COPY allowlist in scripts/build-hooks.js, so it never landed in hooks/dist/. install.js reads from hooks/dist/, so every install on 1.37.0/1.37.1 emitted "Skipped read injection scanner hook — not found at target" and the read-time prompt-injection scanner was silently disabled. - Add gsd-read-injection-scanner.js to HOOKS_TO_COPY - Add it to EXPECTED_ALL_HOOKS regression test in install-hooks-copy Fixes #2406 Co-Authored-By: Claude Opus 4.7 (1M context) --- CHANGELOG.md | 1 + scripts/build-hooks.js | 1 + tests/install-hooks-copy.test.cjs | 1 + 3 files changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a6d634ff..5190a543 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). - **`/gsd-ingest-docs` command** — Scan a repo containing mixed ADRs, PRDs, SPECs, and DOCs and bootstrap or merge the full `.planning/` setup from them in a single pass. Parallel classification (`gsd-doc-classifier`), synthesis with precedence rules and cycle detection (`gsd-doc-synthesizer`), three-bucket conflicts report (`INGEST-CONFLICTS.md`: auto-resolved, competing-variants, unresolved-blockers), and hard-block on LOCKED-vs-LOCKED ADR contradictions in both new and merge modes. Supports directory-convention discovery and `--manifest ` YAML override with per-doc precedence. v1 caps at 50 docs per invocation; `--resolve interactive` is reserved. Extracts shared conflict-detection contract into `references/doc-conflict-engine.md` which `/gsd-import` now also consumes (#2387) ### Fixed +- **`gsd-read-injection-scanner` hook now ships to users** — the scanner was added in 1.37.0 (#2201) but was never added to `scripts/build-hooks.js`' `HOOKS_TO_COPY` allowlist, so it never landed in `hooks/dist/` and `install.js` skipped it with "Skipped read injection scanner hook — gsd-read-injection-scanner.js not found at target". Effectively disabled the read-time prompt-injection scanner for every user on 1.37.0/1.37.1. Added to the build allowlist and regression test (#2406) - **Installer now installs `@gsd-build/sdk` automatically** so `gsd-sdk` lands on PATH. Resolves `command not found: gsd-sdk` errors that affected every `/gsd-*` command after a fresh install or `/gsd-update` to 1.36+. Adds `--no-sdk` to opt out and `--sdk` to force reinstall. Implements the `--sdk` flag that was previously documented in README but never wired up (#2385) ## [1.37.1] - 2026-04-17 diff --git a/scripts/build-hooks.js b/scripts/build-hooks.js index a2f136d4..f4e2f3ec 100644 --- a/scripts/build-hooks.js +++ b/scripts/build-hooks.js @@ -20,6 +20,7 @@ const HOOKS_TO_COPY = [ 'gsd-context-monitor.js', 'gsd-prompt-guard.js', 'gsd-read-guard.js', + 'gsd-read-injection-scanner.js', 'gsd-statusline.js', 'gsd-workflow-guard.js', // Community hooks (bash, opt-in via .planning/config.json hooks.community) diff --git a/tests/install-hooks-copy.test.cjs b/tests/install-hooks-copy.test.cjs index 422a2ff2..2eb821a9 100644 --- a/tests/install-hooks-copy.test.cjs +++ b/tests/install-hooks-copy.test.cjs @@ -35,6 +35,7 @@ const EXPECTED_ALL_HOOKS = [ 'gsd-context-monitor.js', 'gsd-prompt-guard.js', 'gsd-read-guard.js', + 'gsd-read-injection-scanner.js', 'gsd-statusline.js', 'gsd-workflow-guard.js', ...EXPECTED_SH_HOOKS,