@opengsd/gsd-core 1.11.0 → 1.13.0

package/gsd-core/bin/lib/tdd-red-evidence.cjs

@@ -0,0 +1,133 @@
+"use strict";
+/**
+ * TDD RED-evidence classification (#3770).
+ *
+ * The `type: tdd` executor gate previously accepted ANY nonzero test command as
+ * RED: syntax errors, zero-test discovery, fixture crashes, parser errors, and
+ * unrelated assertions all authorized production edits (GREEN). This module
+ * defines the compact RED evidence the gate now requires — the TARGET test's
+ * identity plus a matching assertion failure — and classifies a persisted test
+ * run into exactly one verdict:
+ *
+ *   RED_EVIDENCE_OK  — nonzero exit AND the target test failed as a REAL test
+ *                      (distinctly named, TAP-reported failure). The ONLY
+ *                      verdict that may advance to GREEN.
+ *   INVALID_RED      — everything else, with a machine-readable reason:
+ *                      unexpected_green | zero_tests_discovered |
+ *                      nonzero_exit_without_test_failure |
+ *                      fixture_or_load_failure | no_target_test_failure |
+ *                      invalid_record | unreadable_record (router arm).
+ *
+ * Everything here is PURE — no fs, no spawn, no clock — so the executor can
+ * persist the record (command, exit code, failing test, expected, actual) and
+ * validate it via `gsd_run check tdd-red-evidence <record.json>`.
+ *
+ * TAP parsing reuses the proven primitives from prohibition-enforcement
+ * (`parseNodeTestSummary`, `tapFailedTestNames`) — the same contract the
+ * prohibition probe's fail-first prover already relies on (#1259).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyRedEvidence = classifyRedEvidence;
+exports.buildRedEvidenceRecord = buildRedEvidenceRecord;
+const prohibition_enforcement_cjs_1 = require("./prohibition-enforcement.cjs");
+/** Basename of a path-like string ('' for non-strings) — separators `/` and `\`. */
+function baseOf(p) {
+    return typeof p === 'string' ? (p.split(/[\\/]/).pop() ?? p) : '';
+}
+/** Coerce and validate the raw record's scalar fields. Returns null exit_code only when absent/non-numeric. */
+function readInput(input) {
+    const command = typeof input?.command === 'string' ? input.command : '';
+    const output = typeof input?.output === 'string' ? input.output : '';
+    const targetTest = typeof input?.targetTest === 'string' ? input.targetTest.trim() : '';
+    const exitCode = typeof input?.exitCode === 'number' && Number.isFinite(input.exitCode) ? input.exitCode : null;
+    if (!command || !targetTest || exitCode === null)
+        return null;
+    return { command, exitCode, output, targetTest };
+}
+/**
+ * Classify a persisted RED-phase test run. Fail-closed: malformed input, an
+ * unparseable/empty TAP summary, a file-named (load/crash) failure, or a
+ * failure that is not the target test's are all INVALID_RED — only a nonzero
+ * exit WITH the distinctly-named target test failing is RED_EVIDENCE_OK.
+ * Never throws.
+ */
+function classifyRedEvidence(input) {
+    const parsed = readInput(input);
+    if (!parsed) {
+        return {
+            verdict: 'INVALID_RED',
+            reason: 'invalid_record',
+            evidence: {
+                command: typeof input?.command === 'string' ? input.command : '',
+                exit_code: null,
+                target_test: '',
+                tests: 0,
+                pass: 0,
+                fail: 0,
+                failing_tests: [],
+            },
+        };
+    }
+    const { command, exitCode, output, targetTest } = parsed;
+    const summary = (0, prohibition_enforcement_cjs_1.parseNodeTestSummary)(output);
+    const failing = (0, prohibition_enforcement_cjs_1.tapFailedTestNames)(output);
+    const evidence = {
+        command,
+        exit_code: exitCode,
+        target_test: targetTest,
+        tests: summary.tests,
+        pass: summary.pass,
+        fail: summary.fail,
+        failing_tests: failing,
+    };
+    // Existing fail-fast rule, now machine-checked: exit 0 during RED is an
+    // unexpected GREEN — the feature may already exist or the test is wrong.
+    if (exitCode === 0) {
+        return { verdict: 'INVALID_RED', reason: 'unexpected_green', evidence };
+    }
+    // Zero-test discovery: the discovery pattern / fixture matched no tests.
+    // A run that executed nothing cannot prove anything about the behavior.
+    if (summary.tests === 0) {
+        return { verdict: 'INVALID_RED', reason: 'zero_tests_discovered', evidence };
+    }
+    // Nonzero exit but TAP reports no failing test: harness/setup/parser crash
+    // whose failure never reached a test assertion (or unparseable output).
+    if (summary.fail === 0 || failing.length === 0) {
+        return { verdict: 'INVALID_RED', reason: 'nonzero_exit_without_test_failure', evidence };
+    }
+    // Fixture/load failure: every failing entry is named like the target FILE —
+    // node reports a load-time crash (throw-on-require, syntax error, ENOENT
+    // fixture) as a file-named `not ok 1 - <file>`, never the target test.
+    const targetBase = baseOf(input?.targetFile ?? '');
+    const distinctlyNamed = failing.filter((n) => (targetBase ? baseOf(n) !== targetBase : true));
+    if (distinctlyNamed.length === 0) {
+        return { verdict: 'INVALID_RED', reason: 'fixture_or_load_failure', evidence };
+    }
+    // Unrelated failure: real tests ran and failed, but none is the target test
+    // the plan named — an unrelated assertion must not authorize GREEN.
+    if (!distinctlyNamed.includes(targetTest)) {
+        return { verdict: 'INVALID_RED', reason: 'no_target_test_failure', evidence };
+    }
+    return { verdict: 'RED_EVIDENCE_OK', reason: 'target_test_failed', evidence };
+}
+/**
+ * Project a classification into the persisted record shape — command, exit
+ * code, failing test, expected, actual, verdict, reason — so the evidence
+ * survives past the terminal and the gate can re-verify it deterministically.
+ * Pure: JSON-serializable, no timestamps (the record's mtime/commit carries time).
+ */
+function buildRedEvidenceRecord(input, result) {
+    const failingTest = result.evidence.failing_tests.find((n) => n === result.evidence.target_test) ??
+        result.evidence.failing_tests[0] ??
+        null;
+    return {
+        command: result.evidence.command,
+        exit_code: result.evidence.exit_code,
+        failing_test: failingTest,
+        target_test: result.evidence.target_test,
+        expected: typeof input?.expected === 'string' ? input.expected : null,
+        actual: typeof input?.actual === 'string' ? input.actual : null,
+        verdict: result.verdict,
+        reason: result.reason,
+    };
+}

package/gsd-core/bin/lib/teams-status.cjs

@@ -31,6 +31,9 @@ exports.cmdTeamsStatus = cmdTeamsStatus;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
 const { output: coreOutput } = ioMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const cliExitModule = require("./cli-exit.cjs");
+const { ExitError } = cliExitModule;
 // ─── Pure core ────────────────────────────────────────────────────────────────
 /**
  * Resolve the agent-teams status from injected runtime and env.
@@ -67,7 +70,7 @@ function cmdTeamsStatus(cwd, opts) {
     const status = resolveTeamsStatus({ runtime, env: process.env });
     if (opts.active) {
         // --active mode: no output, exit code encodes the boolean
-        process.exit(status.active ? 0 : 1);
+        throw new ExitError(status.active ? 0 : 1);
     }
     // Default: emit JSON to stdout via io.output, exit 0
     coreOutput(status, false);

package/gsd-core/bin/lib/uat-predicate.cjs

@@ -28,6 +28,9 @@ const { readVerificationStatus } = verification;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
 const { scopeToPhase } = phaseIdMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const coreUtils = require("./core-utils.cjs");
+const { normalizeLineEndings } = coreUtils;
 // ─── Blocking state sets (documented for maintainability) ─────────────────────
 // UAT file frontmatter `status` values that indicate the file is not fully done
 const BLOCKING_UAT_FM_STATUSES = new Set([
@@ -112,32 +115,62 @@ function analyzeMarkdown(raw) {
  */
 function parseUatResultItems(cleanContent) {
     const items = [];
-    // Find all ### N. Name headings (line-anchored)
-    const headingPattern = /^###\s*(\d+)\.\s*(.+)$/gm;
+    // Find all ### N. Name headings.
+    // #3078-CR MEDIUM (security review follow-up): STRUCTURE and ATTRIBUTION
+    // need different split frames. This is a STRUCTURE scan — finding where a
+    // heading block begins — and there is no attribution distinction to
+    // preserve, so split on any of `\n`, U+2028, U+2029: a heading delimited by
+    // an exotic line separator (origin/next's `/m`-anchored scan found these;
+    // a naive `split('\n')`-only port silently stopped finding them, making the
+    // gate MORE permissive than origin/next) is found exactly like a
+    // `\n`-delimited one. Contrast the `result:` scan below, which is an
+    // ATTRIBUTION scan and must NOT do this.
+    const HEADING_LINE_RE = /^###\s*(\d+)\.\s*(.+)$/;
     const headings = [];
-    let hMatch;
-    while ((hMatch = headingPattern.exec(cleanContent)) !== null) {
-        headings.push({
-            index: hMatch.index + hMatch[0].length,
-            test: parseInt(hMatch[1], 10),
-            name: hMatch[2].trim(),
-        });
+    {
+        // All three separators are exactly one UTF-16 code unit, so the
+        // `line.length + 1` offset arithmetic below stays valid regardless of
+        // which separator terminated a given line.
+        const lines = cleanContent.split(/[\n\u2028\u2029]/);
+        let offset = 0;
+        for (const line of lines) {
+            const hMatch = line.match(HEADING_LINE_RE);
+            if (hMatch) {
+                headings.push({
+                    index: offset + hMatch[0].length,
+                    lineStart: offset,
+                    test: parseInt(hMatch[1], 10),
+                    name: hMatch[2].trim(),
+                });
+            }
+            offset += line.length + 1; // +1 for the separator consumed by split
+        }
     }
     for (let i = 0; i < headings.length; i++) {
         const h = headings[i];
         const blockStart = h.index;
-        // More precise: find next heading's position in the original string
-        // We'll slice from current heading end to the position just before next heading's "###"
-        const nextHeadingMatch = i + 1 < headings.length
-            ? cleanContent.lastIndexOf('\n###', headings[i + 1].index)
-            : -1;
-        const blockContent = nextHeadingMatch >= blockStart
-            ? cleanContent.slice(blockStart, nextHeadingMatch)
+        // A block spans until the START of the next heading's line (tracked
+        // directly from the same split-frame scan above), not a re-search for a
+        // literal '\n###' over unsplit text -- the latter would silently miss a
+        // next heading delimited by U+2028/U+2029 instead of '\n' and swallow
+        // every subsequent block into this one.
+        const blockContent = i + 1 < headings.length
+            ? cleanContent.slice(blockStart, headings[i + 1].lineStart)
             : cleanContent.slice(blockStart);
-        // Column-0 anchored result line: /^result:[ \t]*\[?([\w-]+)\]?/mi
+        // Column-0 result line, split-then-match (#3078-CR MEDIUM — same fix as
+        // the heading scan above): test each already-split line individually
+        // against a single-line (no `/m` anchor) pattern instead of anchoring
+        // over unsplit `blockContent`, so a `result:`-shaped line reachable only
+        // via a U+2028/U+2029 separator inside an `expected: |` scalar body can
+        // never register as a fake column-0 match. FIRST MATCH WINS — no
+        // ambiguity counting, matching src/uat.cts's contract.
         // Uses [ \t]* (not \s*) so the captured value must sit on the SAME line as result:.
         // A result: key with the value on a subsequent line yields no match → 'missing' (blocker).
-        const resultMatch = /^result:[ \t]*\[?([\w-]+)\]?/mi.exec(blockContent);
+        const RESULT_LINE_RE = /^result:[ \t]*\[?([\w-]+)\]?/i;
+        const resultMatch = blockContent
+            .split('\n')
+            .map((line) => line.match(RESULT_LINE_RE))
+            .find((m) => m !== null) ?? null;
         if (resultMatch) {
             items.push({
                 test: h.test,
@@ -205,7 +238,11 @@ function evaluateUatPassed(phaseFullDir, opts) {
         const uatFilePath = node_path_1.default.join(phaseFullDir, file);
         let raw = '';
         try {
-            raw = node_fs_1.default.readFileSync(uatFilePath, 'utf-8');
+            // #3078-CR MEDIUM: normalize line endings at the read boundary — the
+            // same seam src/uat.cts and src/verification.cts route through — so a
+            // lone-CR *-UAT.md is not read as one unbroken line by the column-0
+            // scans below.
+            raw = normalizeLineEndings(node_fs_1.default.readFileSync(uatFilePath, 'utf-8'));
         }
         catch {
             blockers.push(`${file}: could not read file`);
@@ -252,7 +289,8 @@ function evaluateUatPassed(phaseFullDir, opts) {
         const verificationFilePath = node_path_1.default.join(phaseFullDir, file);
         let raw = '';
         try {
-            raw = node_fs_1.default.readFileSync(verificationFilePath, 'utf-8');
+            // #3078-CR MEDIUM: same read-boundary normalization as the UAT loop above.
+            raw = normalizeLineEndings(node_fs_1.default.readFileSync(verificationFilePath, 'utf-8'));
         }
         catch {
             blockers.push(`${file}: could not read verification file`);