@opengsd/gsd-core 1.12.0 → 1.13.0

package/gsd-core/bin/lib/surface.cjs

@@ -165,7 +165,7 @@ function normalizeSkillManifest(runtimeConfigDir, manifest) {
  *   - registry is threaded into resolveProfile so capability skills
  *     participate in the base skill set and their requires: chains expand.
  */
-function resolveSurface(runtimeConfigDir, manifest, clusterMap, registry) {
+function resolveSurface(runtimeConfigDir, manifest, clusterMap, registry, surfaceOverride) {
     // Merge capability clusters into the cluster map when registry is provided.
     // The ADR-857 phase 4a HARD gate guarantees that when a capId matches a CLUSTERS
     // key, the values are EQUAL — so the spread is idempotent for matching names.
@@ -205,7 +205,7 @@ function resolveSurface(runtimeConfigDir, manifest, clusterMap, registry) {
         cm = merged;
     }
     const skillManifest = normalizeSkillManifest(runtimeConfigDir, manifest);
-    const surface = readSurface(runtimeConfigDir);
+    const surface = surfaceOverride === undefined ? readSurface(runtimeConfigDir) : surfaceOverride;
     // Determine base profile name: from surface state or from .gsd-profile marker
     const baseProfileName = (surface && surface.baseProfile)
         ? surface.baseProfile
@@ -316,10 +316,9 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
         os: deps.os, env: deps.env,
     });
     const skillManifest = normalizeSkillManifest(layout.configDir, manifest);
-    const resolved = resolveSurface(layout.configDir, skillManifest, clusterMap, registry);
-    // Profile toggles must converge retired surfaces too. Once a kind disappears
-    // from artifactLayout there is no normal sync pass left to prune it (#2644).
-    retiredArtifactCleanup.pruneRetiredRuntimeArtifacts(layout.runtime, layout.configDir);
+    const hasCandidateState = opts !== undefined && Object.prototype.hasOwnProperty.call(opts, 'surfaceState');
+    const candidateState = hasCandidateState ? (opts.surfaceState ?? null) : undefined;
+    const resolved = resolveSurface(layout.configDir, skillManifest, clusterMap, registry, candidateState);
     // #1575: agents kind now mirrors createRuntimeArtifactInstallPlan — build
     // agentCtx (pathPrefix + attribution) and pass it to kind.stage() so
     // stageAgentsForRuntimeWithConverter applies the full inline-loop pipeline
@@ -353,7 +352,7 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
     // not referenced by any skill's _calls_agents_ manifest entry would be silently
     // dropped from the surface path. For tiered profiles (core/standard) or when
     // surface mods exist, pass the resolved set so only the filtered subset stages.
-    const _surfaceState = readSurface(layout.configDir);
+    const _surfaceState = candidateState === undefined ? readSurface(layout.configDir) : candidateState;
     const _baseProfileName = (_surfaceState && _surfaceState.baseProfile)
         ? _surfaceState.baseProfile
         : (readActiveProfile(layout.configDir) || 'full');
@@ -361,6 +360,7 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
         _surfaceState.explicitAdds.length > 0 ||
         _surfaceState.explicitRemoves.length > 0);
     const _isUnmodifiedFull = _baseProfileName === 'full' && !_hasSurfaceMods;
+    const stagedKinds = [];
     try {
         for (const kind of layout.kinds) {
             let staged;
@@ -396,7 +396,22 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
             // the parity test in tests/runtime-artifact-layout-surface.test.cjs
             // enforces that the two writers never diverge again.
             const dest = assertDestWithinConfigHome(kind.home ?? layout.configDir, kind.destSubpath);
-            _syncGsdDir(staged, dest, kind, skillManifest, layout.runtime);
+            stagedKinds.push({ kind, staged, dest });
+        }
+        // Do not mutate installed artifacts until every kind has staged
+        // successfully. A missing source provider therefore leaves both artifacts
+        // and the persisted surface state untouched.
+        retiredArtifactCleanup.pruneRetiredRuntimeArtifacts(layout.runtime, layout.configDir);
+        for (const item of stagedKinds) {
+            _syncGsdDir(item.staged, item.dest, item.kind, skillManifest, layout.runtime);
+        }
+        if (hasCandidateState) {
+            if (candidateState === null) {
+                node_fs_1.default.rmSync(node_path_1.default.join(runtimeConfigDir, SURFACE_FILE_NAME), { force: true });
+            }
+            else if (candidateState !== undefined) {
+                writeSurface(runtimeConfigDir, candidateState);
+            }
         }
     }
     finally {

package/gsd-core/bin/lib/tdd-red-evidence.cjs

@@ -0,0 +1,133 @@
+"use strict";
+/**
+ * TDD RED-evidence classification (#3770).
+ *
+ * The `type: tdd` executor gate previously accepted ANY nonzero test command as
+ * RED: syntax errors, zero-test discovery, fixture crashes, parser errors, and
+ * unrelated assertions all authorized production edits (GREEN). This module
+ * defines the compact RED evidence the gate now requires — the TARGET test's
+ * identity plus a matching assertion failure — and classifies a persisted test
+ * run into exactly one verdict:
+ *
+ *   RED_EVIDENCE_OK  — nonzero exit AND the target test failed as a REAL test
+ *                      (distinctly named, TAP-reported failure). The ONLY
+ *                      verdict that may advance to GREEN.
+ *   INVALID_RED      — everything else, with a machine-readable reason:
+ *                      unexpected_green | zero_tests_discovered |
+ *                      nonzero_exit_without_test_failure |
+ *                      fixture_or_load_failure | no_target_test_failure |
+ *                      invalid_record | unreadable_record (router arm).
+ *
+ * Everything here is PURE — no fs, no spawn, no clock — so the executor can
+ * persist the record (command, exit code, failing test, expected, actual) and
+ * validate it via `gsd_run check tdd-red-evidence <record.json>`.
+ *
+ * TAP parsing reuses the proven primitives from prohibition-enforcement
+ * (`parseNodeTestSummary`, `tapFailedTestNames`) — the same contract the
+ * prohibition probe's fail-first prover already relies on (#1259).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyRedEvidence = classifyRedEvidence;
+exports.buildRedEvidenceRecord = buildRedEvidenceRecord;
+const prohibition_enforcement_cjs_1 = require("./prohibition-enforcement.cjs");
+/** Basename of a path-like string ('' for non-strings) — separators `/` and `\`. */
+function baseOf(p) {
+    return typeof p === 'string' ? (p.split(/[\\/]/).pop() ?? p) : '';
+}
+/** Coerce and validate the raw record's scalar fields. Returns null exit_code only when absent/non-numeric. */
+function readInput(input) {
+    const command = typeof input?.command === 'string' ? input.command : '';
+    const output = typeof input?.output === 'string' ? input.output : '';
+    const targetTest = typeof input?.targetTest === 'string' ? input.targetTest.trim() : '';
+    const exitCode = typeof input?.exitCode === 'number' && Number.isFinite(input.exitCode) ? input.exitCode : null;
+    if (!command || !targetTest || exitCode === null)
+        return null;
+    return { command, exitCode, output, targetTest };
+}
+/**
+ * Classify a persisted RED-phase test run. Fail-closed: malformed input, an
+ * unparseable/empty TAP summary, a file-named (load/crash) failure, or a
+ * failure that is not the target test's are all INVALID_RED — only a nonzero
+ * exit WITH the distinctly-named target test failing is RED_EVIDENCE_OK.
+ * Never throws.
+ */
+function classifyRedEvidence(input) {
+    const parsed = readInput(input);
+    if (!parsed) {
+        return {
+            verdict: 'INVALID_RED',
+            reason: 'invalid_record',
+            evidence: {
+                command: typeof input?.command === 'string' ? input.command : '',
+                exit_code: null,
+                target_test: '',
+                tests: 0,
+                pass: 0,
+                fail: 0,
+                failing_tests: [],
+            },
+        };
+    }
+    const { command, exitCode, output, targetTest } = parsed;
+    const summary = (0, prohibition_enforcement_cjs_1.parseNodeTestSummary)(output);
+    const failing = (0, prohibition_enforcement_cjs_1.tapFailedTestNames)(output);
+    const evidence = {
+        command,
+        exit_code: exitCode,
+        target_test: targetTest,
+        tests: summary.tests,
+        pass: summary.pass,
+        fail: summary.fail,
+        failing_tests: failing,
+    };
+    // Existing fail-fast rule, now machine-checked: exit 0 during RED is an
+    // unexpected GREEN — the feature may already exist or the test is wrong.
+    if (exitCode === 0) {
+        return { verdict: 'INVALID_RED', reason: 'unexpected_green', evidence };
+    }
+    // Zero-test discovery: the discovery pattern / fixture matched no tests.
+    // A run that executed nothing cannot prove anything about the behavior.
+    if (summary.tests === 0) {
+        return { verdict: 'INVALID_RED', reason: 'zero_tests_discovered', evidence };
+    }
+    // Nonzero exit but TAP reports no failing test: harness/setup/parser crash
+    // whose failure never reached a test assertion (or unparseable output).
+    if (summary.fail === 0 || failing.length === 0) {
+        return { verdict: 'INVALID_RED', reason: 'nonzero_exit_without_test_failure', evidence };
+    }
+    // Fixture/load failure: every failing entry is named like the target FILE —
+    // node reports a load-time crash (throw-on-require, syntax error, ENOENT
+    // fixture) as a file-named `not ok 1 - <file>`, never the target test.
+    const targetBase = baseOf(input?.targetFile ?? '');
+    const distinctlyNamed = failing.filter((n) => (targetBase ? baseOf(n) !== targetBase : true));
+    if (distinctlyNamed.length === 0) {
+        return { verdict: 'INVALID_RED', reason: 'fixture_or_load_failure', evidence };
+    }
+    // Unrelated failure: real tests ran and failed, but none is the target test
+    // the plan named — an unrelated assertion must not authorize GREEN.
+    if (!distinctlyNamed.includes(targetTest)) {
+        return { verdict: 'INVALID_RED', reason: 'no_target_test_failure', evidence };
+    }
+    return { verdict: 'RED_EVIDENCE_OK', reason: 'target_test_failed', evidence };
+}
+/**
+ * Project a classification into the persisted record shape — command, exit
+ * code, failing test, expected, actual, verdict, reason — so the evidence
+ * survives past the terminal and the gate can re-verify it deterministically.
+ * Pure: JSON-serializable, no timestamps (the record's mtime/commit carries time).
+ */
+function buildRedEvidenceRecord(input, result) {
+    const failingTest = result.evidence.failing_tests.find((n) => n === result.evidence.target_test) ??
+        result.evidence.failing_tests[0] ??
+        null;
+    return {
+        command: result.evidence.command,
+        exit_code: result.evidence.exit_code,
+        failing_test: failingTest,
+        target_test: result.evidence.target_test,
+        expected: typeof input?.expected === 'string' ? input.expected : null,
+        actual: typeof input?.actual === 'string' ? input.actual : null,
+        verdict: result.verdict,
+        reason: result.reason,
+    };
+}