@jwilger/pi-development-system 0.71.0 → 0.73.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilger/pi-development-system",
-  "version": "0.71.0",
+  "version": "0.73.0",
   "description": "A pi extension package representing a seasoned approach to software development using a full AI SDLC.",
   "keywords": [
     "pi-package"

package/prompts/devsys-start.md

@@ -6,6 +6,6 @@ Start new work with the work-intake-and-slicing skill.
 
 1. Call `devsys_intake` with `request` set to: $ARGUMENTS (if empty, ask the user what they want done first).
 2. Show the user the proposed size and artifacts. The tool asks them to confirm or change the size.
-3. Produce the planning artifacts first (brief, journeys, event model, architecture, lens review, in that order, whichever are recommended), then the task record. `review` and `adr-if-needed` are not written up front: review happens on the finished slice, and an ADR when a decision needs one. To skip one, call `devsys_record_departure` with gate `artifact.skipped:<artifact>` and the reason; do not skip silently. The event model and architecture are recommendations, never gates.
+3. Produce the planning artifacts first (brief, decision register, journeys, event model, architecture, lens review, in that order, whichever are recommended), then the task record. `review` and `adr-if-needed` are not written up front: review happens on the finished slice, and an ADR when a decision needs one. To skip one, call `devsys_record_departure` with gate `artifact.skipped:<artifact>` and the reason; do not skip silently. The event model and architecture are recommendations, never gates.
 4. For `capability` and `product` the phase stays `planning` while you produce the artifacts and the plan. The single point where it changes is the user approving the whole plan: then call `devsys_begin_work` so the review and red-first gates switch on (it does nothing if already implementing).
 5. For a confirmed `fix` the user is also asked whether to skip fresh-context review (it is logged if they say yes; if no, the slice needs its review rounds). For `fix` and `change` the phase is already `implementing`: write the task record, then work it test-first.

package/src/tracker/repo-files.ts

@@ -1,5 +1,5 @@
-import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { lstat, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
 import { ok } from "../core/result.ts";
 import { parseItem, renderBacklog, renderItem, unwritable } from "./item-format.ts";
 import {
@@ -15,8 +15,11 @@ import {
 const ID = /^[a-z0-9][a-z0-9-]*$/;
 const ID_MAX = 60;
 
+/** ASCII id from a title: accents are folded (Résumé → resume); a title with no ASCII letters or digits becomes `item`. */
 const slugOf = (title: string): string =>
   title
+    .normalize("NFD")
+    .replace(/\p{M}+/gu, "")
     .toLowerCase()
     .replace(/[^a-z0-9]+/g, "-")
     .replace(/^-+/, "")
@@ -33,8 +36,35 @@ const byCodeUnit = (a: string, b: string): number => Number(a > b) - Number(a <
 const describe = (cause: unknown): string =>
   cause instanceof Error ? cause.message : String(cause);
 
+/**
+ * The first symlink on the way from the repo root to `target`, if any. A committed symlink
+ * under `work/` could otherwise make a tracker write land outside the repository.
+ */
+const symlinkOnPath = async (root: string, target: string): Promise<string | undefined> => {
+  let current = root;
+  for (const part of relative(root, target).split(sep)) {
+    current = join(current, part);
+    try {
+      if ((await lstat(current)).isSymbolicLink()) return current;
+    } catch (cause) {
+      if (isMissing(cause)) return undefined;
+      throw cause;
+    }
+  }
+  return undefined;
+};
+
+const refuseSymlink = async (root: string, target: string): Promise<string | undefined> => {
+  const link = await symlinkOnPath(root, target);
+  return link === undefined
+    ? undefined
+    : `${relative(root, link)} is a symbolic link; the repo-files tracker will not follow it`;
+};
+
 const readItem = async (root: string, id: string): Promise<TrackerResult<WorkItem>> => {
   if (!ID.test(id)) return trackerError(`work item "${id}": not a valid id`);
+  const link = await refuseSymlink(root, fileOf(root, id));
+  if (link !== undefined) return trackerError(link);
   try {
     return parseItem(id, await readFile(fileOf(root, id), "utf8"));
   } catch (cause) {
@@ -44,6 +74,7 @@ const readItem = async (root: string, id: string): Promise<TrackerResult<WorkIte
 };
 
 const itemIds = async (root: string): Promise<string[]> => {
+  if ((await refuseSymlink(root, itemsDir(root))) !== undefined) return [];
   try {
     const files = await readdir(itemsDir(root));
     return files.flatMap((f) =>
@@ -68,6 +99,11 @@ const readAll = async (root: string): Promise<TrackerResult<WorkItem[]>> => {
 const save = async (root: string, item: WorkItem): Promise<TrackerResult<WorkItem>> => {
   const problem = unwritable(item);
   if (problem !== undefined) return trackerError(problem);
+  const backlog = join(root, "work", "backlog.md");
+  for (const target of [itemsDir(root), fileOf(root, item.id), backlog]) {
+    const link = await refuseSymlink(root, target);
+    if (link !== undefined) return trackerError(link);
+  }
   const others = await readAll(root);
   if (!others.ok) return others;
   await mkdir(itemsDir(root), { recursive: true });
@@ -75,13 +111,12 @@ const save = async (root: string, item: WorkItem): Promise<TrackerResult<WorkIte
   const items = [...others.value.filter((i) => i.id !== item.id), item].toSorted((a, b) =>
     byCodeUnit(a.id, b.id),
   );
-  await writeFile(join(root, "work", "backlog.md"), renderBacklog(items));
+  await writeFile(backlog, renderBacklog(items));
   return ok(item);
 };
 
-const freshId = async (root: string, title: string): Promise<string | undefined> => {
-  const base = slugOf(title);
-  if (base === "") return undefined;
+const freshId = async (root: string, title: string): Promise<string> => {
+  const base = slugOf(title) || "item";
   const taken = new Set(await itemIds(root));
   let id = base;
   for (let n = 2; taken.has(id); n++) id = `${base}-${n}`;
@@ -97,10 +132,8 @@ const listItems = async (root: string, filter: ItemFilter): Promise<TrackerResul
 const createItem = async (root: string, input: NewWorkItem): Promise<TrackerResult<WorkItem>> => {
   const problem = unwritable({ title: input.title, labels: input.labels ?? [] });
   if (problem !== undefined) return trackerError(problem);
-  const id = await freshId(root, input.title);
-  if (id === undefined) return trackerError("a work item title needs letters or digits");
   return save(root, {
-    id,
+    id: await freshId(root, input.title),
     title: input.title,
     body: input.body ?? "",
     status: "open",