feat(gsd2): add GSD 2 agent adapter and TypeScript extension

[hashedone]

Summary

Builds on top of #95 (AgentAdapter abstraction). Adds first-class GSD 2 (pi/GSD-2) support.

Closes #148 (partial — covers GSD2; Codex already covered by #95)

What's included

Rust adapter (tracevault-core)

• Gsd2Adapter registered under gsd2 and gsd-2 in AgentAdapterRegistry
• File changes extracted from tool_execution_end transcript chunks (write → SHA256 + diff, edit → old/new diff, errors skipped)
• Token usage from agent_end chunks using GSD2's { input, output, cacheRead, cacheWrite } shape
• Model from agent_end and session_start chunks
• install_hooks() is a no-op — GSD2 is in-process, no shell hooks needed
• 16 new adapter tests

TypeScript extension (integrations/gsd2-extension/)

• In-process extension (not a shell hook process)
• Hooks: session_start, tool_execution_end, agent_end, stop
• POSTs directly to TraceVault HTTP API via fetch
• Config from .tracevault/config.toml (project) or ~/.config/tracevault/config.toml (user-wide)
• Silent no-op if config absent — won't interfere with normal GSD usage

Key difference from CC and Codex

GSD 2 is an in-process TypeScript extension, not a shell hook. This means:

• No transcript file to parse — events arrive via the GSD extension event system
• is_error is a first-class bool on every tool_execution_end event, so must_succeed policies (from feat(policies): add must_succeed flag to tool call policies #147) work correctly without any transcript scanning
• Token usage comes from AssistantMessage.usage in agent_end, not transcript JSONL chunks

Notes

• This PR should be merged after feat: add AgentAdapter abstraction with Codex CLI support #95
• After feat: add AgentAdapter abstraction with Codex CLI support #95 merges and rebases onto main, this branch needs a rebase too (same tool_is_error / tool_use_id fields to add to StreamEventRequest)

[aikido-pr-checks]

Fallback session_id is inconsistent: session_start uses crypto.randomUUID() but other handlers use "unknown", causing the same run’s events to be attributed to different sessions.

Suggested change

	const state = getState(ctx.sessionManager.sessionId ?? crypto.randomUUID());
	const state = getState(ctx.sessionManager.sessionId ?? "unknown");

Details

✨ AI Reasoning
​The code is trying to keep all events in a single per-session stream. However, when the runtime session identifier is absent, the first handler creates state with a random ID, but subsequent handlers use a different fallback string. Those branches cannot refer to the same session state in that scenario, so events are split across different IDs and cleanup targets the wrong map key.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

Potential file inclusion attack via reading file - high severity
If an attacker can control the input leading into the ReadFile function, they might be able to read sensitive files and launch further attacks with that information.

Show fix

Suggested change

	join(projectRoot, ".tracevault", "config.toml"),
	join(homedir(), ".config", "tracevault", "config.toml"),
	];
	for (const path of candidates) {
	if (!existsSync(path)) continue;
	try {
	const raw = readFileSync(path, "utf8");
	join(resolve(projectRoot), ".tracevault", "config.toml"),
	join(homedir(), ".config", "tracevault", "config.toml"),
	];
	for (const candidatePath of candidates) {
	const resolvedBase = resolve(projectRoot);
	const resolvedTarget = resolve(candidatePath);
	const rel = relative(resolvedBase, resolvedTarget);
	if (rel.startsWith('..') || isAbsolute(rel)) {
	continue;
	}
	if (!existsSync(resolvedTarget)) continue;
	try {
	const raw = readFileSync(resolvedTarget, "utf8");

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

Catch block silently ignores malformed config in loadConfig; log or record the parse error (e.g., console.debug or console.error) so malformed config isn't silently swallowed.

Show fix

Suggested change

	} catch {
	// ignore malformed config
	} catch (err) {
	// ignore malformed config and continue searching
	console.error(`[tracevault] Failed to parse config at ${path}:`, err);

Details

✨ AI Reasoning
​A try/catch was added around config parsing. The catch is a bare catch (no exception variable or type) and its body contains only a comment that says the error is ignored. This swallows parse errors silently. Silent catches on I/O or parsing operations make debugging harder and can hide configuration issues. The try block reads and parses files (state-changing I/O), so failing to report parse errors reduces observability. Adding minimal error handling (logging or structured handling) would preserve the intended silent-no-op behavior while leaving an audit trail.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

Module-level 'sessions' Map stores per-session state and can persist across requests, risking cross-session data leakage. Consider making session state request-scoped or using an explicit, documented shared cache abstraction.

Show fix

Suggested change

	const sessions = new Map<string, SessionState>();
	function getState(gsdSessionId: string): SessionState {
	let s = sessions.get(gsdSessionId);
	if (!s) {
	const sessions = new Map<string, SessionState>();
	const MAX_CACHE_SIZE = 128;
	function getState(gsdSessionId: string): SessionState {
	let s = sessions.get(gsdSessionId);
	if (!s) {
	if (sessions.size >= MAX_CACHE_SIZE) {
	sessions.delete(sessions.keys().next().value);
	}

Details

✨ AI Reasoning
​The extension now defines a module-level 'sessions' Map that holds SessionState objects keyed by GSD session IDs. This Map is mutated by getState and used across event handlers, making per-session data live in module/global scope. In long-running Node.js processes, module-level mutable state persists across requests and can unintentionally leak or mix data between different sessions or users. The pattern here stores request/session-specific information in a shared global that was introduced by this change, which meets the criteria for unintended global caching and therefore is worth flagging.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}