@opengsd/gsd-core 1.18.0 → 1.20.0

package/gsd-core/bin/lib/verification.cjs

@@ -47,6 +47,8 @@ const coreUtilsMod = require("./core-utils.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- planning-scope.cjs is an export= CommonJS module
 const planningScopeMod = require("./planning-scope.cjs");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+const text_lines_cjs_1 = require("./text-lines.cjs");
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 const security_cjs_1 = require("./security.cjs");
 const pattern_cjs_1 = require("./pattern.cjs");
@@ -607,17 +609,19 @@ function phaseArtifactPaths(phaseDir, projectRoot) {
  *                `.planning/<project>/workstreams/<ws>`), covering a
  *                per-project/per-workstream store symlink (amendment 1,
  *                revised R7).
+ *   v4 (#5351) — v3 with each CRLF byte pair hashed as LF. Every other
+ *                byte, including a lone CR and non-UTF-8 input, is preserved.
  *
  * A stored digest names its own version (`v<N>:sha256:…`), and
  * `readVerificationStatus` recomputes under the STORED version rather than
  * this constant — so bumping it does not flip every already-verified phase
- * to `stale` on upgrade. A legacy v1/v2 report keeps its own semantics
- * (shared documents included for v1; no report filter or artifact union for
- * either) until it is re-fingerprinted; only a version outside
+ * to `stale` on upgrade. A legacy v1/v2/v3 report keeps its own raw-byte
+ * semantics (shared documents included for v1; no report filter or artifact
+ * union for v1/v2) until it is re-fingerprinted; only a version outside
  * `KNOWN_FINGERPRINT_VERSIONS` is unrecomputable and fails closed.
  */
-const FINGERPRINT_VERSION = 3;
-const KNOWN_FINGERPRINT_VERSIONS = new Set([1, 2, 3]);
+const FINGERPRINT_VERSION = 4;
+const KNOWN_FINGERPRINT_VERSIONS = new Set([1, 2, 3, 4]);
 /**
  * #4623: the planning roots whose DIRECT children are repo-wide planning
  * documents, as project-root-relative posix paths. Always `.planning`; plus
@@ -815,7 +819,22 @@ function deriveCoveredDigest(projectRoot, coveredFiles, version = FINGERPRINT_VE
         catch {
             return { ok: true, digest: null, files: declared, mappedPhaseDir: artifactMappedPhaseDir };
         }
-        const fileHash = node_crypto_1.default.createHash('sha256').update(bytes).digest('hex');
+        const hash = node_crypto_1.default.createHash('sha256');
+        if (version >= 4) {
+            // #5351: drop only the CR in each CRLF pair without decoding the
+            // covered input — binary files and lone CR bytes keep their meaning.
+            // Hash Buffer slices directly, retaining the LF at each new start.
+            let start = 0;
+            for (let crlf = bytes.indexOf('\r\n'); crlf !== -1; crlf = bytes.indexOf('\r\n', start)) {
+                hash.update(bytes.subarray(start, crlf));
+                start = crlf + 1;
+            }
+            hash.update(bytes.subarray(start));
+        }
+        else {
+            hash.update(bytes);
+        }
+        const fileHash = hash.digest('hex');
         parts.push(`${rel}\n${fileHash}\n`);
         hashed++;
     }
@@ -1175,6 +1194,72 @@ function findVerificationStatusError(phaseDirs, deps = {}) {
     }
     return null;
 }
+/**
+ * #5291: legacy report statuses `validate health --repair` may rewrite, and the
+ * closed-set status each becomes. Deliberately minimal — only the value the
+ * maintainer ruled on (`pass_with_caveats` -> `passed`). Every other status
+ * outside the closed set (`pending`, `partial`, …) has NO mapping: it stays
+ * refused and its W030 stays advise-only (fail closed; only `passed` satisfies
+ * the gate). The original value is preserved in `legacy_status`.
+ */
+const LEGACY_STATUS_REPAIRS = Object.freeze({
+    pass_with_caveats: VERIFICATION_STATUS.PASSED,
+});
+/** The closed-set status a known legacy `raw` status repairs to, or `null` when it has no mapping. */
+function legacyStatusRepairTarget(raw) {
+    return typeof raw === 'string' && Object.prototype.hasOwnProperty.call(LEGACY_STATUS_REPAIRS, raw)
+        ? LEGACY_STATUS_REPAIRS[raw]
+        : null;
+}
+/**
+ * #5291: rewrite one report's frontmatter `status:` from a known legacy value
+ * to its closed-set equivalent and record the original as `legacy_status:`
+ * right after it. Touches only those lines — every other byte (body, other
+ * keys, line endings) is preserved — and never overwrites an existing
+ * `legacy_status`. Refuses (writes nothing) for a path that is not a report
+ * contained in its own phase directory, a report with no frontmatter `status`,
+ * and any status without a mapping.
+ */
+function repairLegacyVerificationStatus(filePath) {
+    if (!isReportContained(node_path_1.default.dirname(filePath), filePath)) {
+        return { ok: false, reason: 'the report is not contained in its phase directory' };
+    }
+    let content;
+    try {
+        content = node_fs_1.default.readFileSync(filePath, 'utf-8');
+    }
+    catch (err) {
+        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+    // The fence owner (`locateFrontmatterFence`) is the one place that knows where
+    // the frontmatter body starts and ends (BOM, CRLF, lenient closing fence).
+    const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(content);
+    if (!fence || !fence.closed)
+        return { ok: false, reason: 'the report has no closed frontmatter' };
+    const lines = (0, text_lines_cjs_1.splitLines)(content.slice(fence.openEnd, fence.bodyEnd));
+    // The YAML reader keeps the LAST of duplicate keys, so the line the repair
+    // edits is the last `status:` line — the very value the refusal named. A
+    // trailing comment (`status: pass_with_caveats # x`) is not part of the value.
+    let statusAt = -1;
+    lines.forEach((l, i) => { if (/^status:/.test(l))
+        statusAt = i; });
+    if (statusAt === -1)
+        return { ok: false, reason: 'the report frontmatter has no status' };
+    const raw = lines[statusAt]
+        .replace(/^status:\s*/, '')
+        .replace(/\s+#.*$/, '')
+        .replace(/\s+$/, '')
+        .replace(/^(["'])(.*)\1$/, '$2');
+    const to = legacyStatusRepairTarget(raw);
+    if (to === null)
+        return { ok: false, reason: `${describeRawStatus(raw)} has no known repair` };
+    const legacyStatusKept = lines.some((l) => /^legacy_status:/.test(l));
+    lines[statusAt] = `status: ${to}`;
+    if (!legacyStatusKept)
+        lines.splice(statusAt + 1, 0, `legacy_status: ${raw}`);
+    (0, shell_command_projection_cjs_1.platformWriteSync)(filePath, content.slice(0, fence.openEnd) + (0, text_lines_cjs_1.joinLines)(lines, fence.eol) + content.slice(fence.bodyEnd), { verbatim: true });
+    return { ok: true, from: raw, to, legacyStatusKept };
+}
 /**
  * #3518: the shared phase-pinned artifact-selection core BOTH single-pick
  * resolvers (`resolveVerificationFile` for `*-VERIFICATION.md`,
@@ -1499,11 +1584,11 @@ function readVerificationStatus(phaseDir, opts = {}) {
             isStale = true;
         }
         else if (storedVersion >= 3) {
-            // #5095 (R1): v3's digest is computed over the declared set UNIONED
+            // #5095 (R1): the v3+ digest is computed over the declared set UNIONED
             // with the phase's own live artifacts — a plan/summary added after
             // fingerprinting already moves the digest itself, so the separate
             // live-directory re-scan (`uncoveredCurrentArtifacts`) is redundant
-            // for v3 and is not run.
+            // for v3+ and is not run.
             isStale =
                 computeCoveredDigest(projectRoot, coveredFilesVal, storedVersion, { phaseDir }) !== coveredDigestVal;
             if (isStale) {
@@ -1784,7 +1869,7 @@ function parseFingerprintFileArgs(tokens) {
  *                       directly assignable. #5095 (ADR-5057 Phase 2): `raw`
  *                       returning only the digest is safe even though the
  *                       emitted `covered_files` is a SUPERSET of the caller's
- *                       declared list — the v3 digest is computed over
+ *                       declared list — the v3+ digest is computed over
  *                       `canonicalize(declared ∪ phaseArtifactPaths)` on BOTH
  *                       the emit side (here) and the check side
  *                       (`readVerificationStatus`), so a `--raw` caller that
@@ -2134,6 +2219,8 @@ const verificationModule = {
     isReportContained,
     routeResult,
     findVerificationStatusError,
+    legacyStatusRepairTarget,
+    repairLegacyVerificationStatus,
     defaultPhaseCleanCommitTimesMs,
     resolvePhaseArtifactFile,
     resolveVerificationFile,

package/gsd-core/bin/lib/verify.cjs

@@ -42,7 +42,7 @@ const ioMod = require("./io.cjs");
 const { output, error } = ioMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseLocatorMod = require("./phase-locator.cjs");
-const { findPhaseInternal } = phaseLocatorMod;
+const { phaseDirectoryOptions, findPhaseInternal } = phaseLocatorMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapParserMod = require("./roadmap-parser.cjs");
 const { stripShippedMilestones } = roadmapParserMod;
@@ -1282,7 +1282,7 @@ function cmdVerifyPhaseCompleteness(cwd, phase, raw) {
     if (!phase) {
         error('phase required');
     }
-    const phaseInfoRaw = findPhaseInternal(cwd, phase);
+    const phaseInfoRaw = findPhaseInternal(cwd, phase, undefined, phaseDirectoryOptions(cwd));
     if (!phaseInfoRaw || !phaseInfoRaw['found']) {
         // An unresolvable phase is "could not look" (#5170): there is no phase to evaluate.
         emitVerbVerdict((0, gate_verdict_cjs_1.gateUnreadable)(false, { error: 'Phase not found', phase }), 'status', raw);
@@ -1809,6 +1809,8 @@ function repairFixText(slash, action) {
             return `Run ${slash('health')} --repair to add key`;
         case REMEDY_ACTION.BACKFILL_MILESTONES:
             return `Run ${slash('health')} --backfill to synthesize missing entries from archive snapshots`;
+        case REMEDY_ACTION.REPAIR_VERIFICATION_STATUS:
+            return `Run ${slash('health')} --repair to rewrite the legacy status (original kept as legacy_status)`;
         default:
             return '';
     }

package/gsd-core/bin/lib/workstream-inventory.cjs

@@ -30,7 +30,7 @@ const state_document_cjs_1 = require("./state-document.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- frontmatter.cjs is an export= CommonJS module
 const frontmatterMod = require("./frontmatter.cjs");
 const { extractFrontmatter, stripFrontmatter } = frontmatterMod;
-const markdown_table_cjs_1 = require("./markdown-table.cjs");
+const roadmap_progress_cjs_1 = require("./roadmap-progress.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- verification.cjs is an export= CommonJS module
 const verificationMod = require("./verification.cjs");
 const { isPhaseComplete, isVerificationStatus, VERIFICATION_STATUS } = verificationMod;
@@ -41,6 +41,9 @@ const { phaseKeyFromDir, phaseKeyFromProse, parentPhaseKey } = phaseIdMod;
 const roadmapParserMod = require("./roadmap-parser.cjs");
 const { getMilestonePhaseFilter, isMilestoneShippedInRoadmap } = roadmapParserMod;
 const workstream_inventory_builder_cjs_1 = require("./workstream-inventory-builder.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const phaseLocatorMod = require("./phase-locator.cjs");
+const { phaseDirectoryOptions } = phaseLocatorMod;
 // ─── Implementation ───────────────────────────────────────────────────────────
 function workstreamsRoot(cwd) {
     return node_path_1.default.join(planningRoot(cwd), 'workstreams');
@@ -75,7 +78,7 @@ function countRoadmapPhases(roadmapPath, fallbackCount, cwd, ws, versionOverride
         // `null` -> 0 (fallback), `undefined` -> 3. A non-bracket workstream
         // resolves to a value that compiles the same base grammar `null` did, so
         // its count is unchanged (verified against a legacy control).
-        const filter = getMilestonePhaseFilter(cwd, versionOverride ?? null, undefined, ws ?? null);
+        const filter = getMilestonePhaseFilter(cwd, versionOverride ?? null, undefined, ws ?? null, phaseDirectoryOptions(cwd, undefined, undefined, ws ?? null));
         // A pass-all degrade (phaseCount 0) means the window declared no phases —
         // fall back rather than reporting a confident zero.
         return filter.phaseCount > 0 ? filter.phaseCount : fallbackCount;
@@ -98,25 +101,22 @@ function countRoadmapPhases(roadmapPath, fallbackCount, cwd, ws, versionOverride
  * `phaseKeyFromDir` uses for directories, so a `| 01. … |` row and a `1-slug`
  * directory cannot land in different key spaces (the padding-asymmetry defect).
  */
-function parseRoadmapProgressRows(roadmapPath) {
-    let content;
-    try {
-        content = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
-    }
-    catch {
-        return []; /* no roadmap */
-    }
+function parseRoadmapProgressRows(content, directoryContext) {
     // Milestone-ATTRIBUTING shape first. Both shapes carry `Plans Complete`, so
     // probing that column first would pick a flat table appearing earlier in the
     // document over a milestone-grouped one later — every row would come back
     // unattributed and be treated as current-milestone, silently over-including.
-    const table = (0, markdown_table_cjs_1.findTableWithColumns)(content, ['Phase', 'Milestone'])
-        ?? (0, markdown_table_cjs_1.findTableWithColumns)(content, ['Phase', 'Plans Complete']);
-    if (!table)
-        return [];
+    // #5761: the roadmap-progress owner picks the table (heading-scoped, so a
+    // decoy table elsewhere cannot be mistaken for it); this reader only supplies
+    // the probe order. A table outside a table-less `## Progress` section has
+    // always been read here (#5692: no behavior change), hence `sectionMiss`.
+    const { rows: tableRows } = (0, roadmap_progress_cjs_1.locateRoadmapProgress)(content, {
+        columns: [['Phase', 'Milestone'], ['Phase', 'Plans Complete']],
+        sectionMiss: 'document',
+    });
     const rows = [];
-    for (const row of table.rows) {
-        const key = phaseKeyFromProse(row['Phase']);
+    for (const row of tableRows) {
+        const key = phaseKeyFromProse(row['Phase'], directoryContext);
         if (key === null)
             continue;
         const cell = (row['Milestone'] ?? '').trim();
@@ -428,12 +428,18 @@ function inspectWorkstream(cwd, name, options = {}) {
     const writeDiagnostic = options.writeDiagnostic ?? ((message) => process.stderr.write(message));
     const p = planningPaths(cwd, name);
     const phaseDirNames = readSubdirectories(p.phases);
+    let roadmap = '';
+    try {
+        roadmap = node_fs_1.default.readFileSync(p.roadmap, 'utf8');
+    }
+    catch { /* no roadmap */ }
+    const directoryContext = phaseDirectoryOptions(cwd, undefined, roadmap, name);
     // #2562: scope progress to the CURRENT milestone. Membership and the
     // denominator are derived in ONE key space (`phaseKeyFromDir` /
     // `phaseKeyFromProse`, both from the phase-id owner module) so the two sides
     // of the rollup cannot disagree.
     const currentVersion = readCurrentMilestoneVersion(p.state, p.roadmap);
-    const progressRows = parseRoadmapProgressRows(p.roadmap);
+    const progressRows = parseRoadmapProgressRows(roadmap, directoryContext);
     // Phase keys the ROADMAP attributes to the current milestone. A row whose
     // Milestone cell is blank or malformed is INCLUDED rather than dropped: a
     // phase we cannot attribute must still be visible to the rollup. Dropping it
@@ -458,7 +464,7 @@ function inspectWorkstream(cwd, name, options = {}) {
     // it is exactly the caller that cannot set `GSD_WORKSTREAM`; spelling `null`
     // pinned every workstream to the legacy grammar and made `headingScoped`
     // unreachable (`phaseCount > 0` never held) on a bracket workstream.
-    const headingFilter = getMilestonePhaseFilter(cwd, currentVersion, undefined, name);
+    const headingFilter = getMilestonePhaseFilter(cwd, currentVersion, undefined, name, directoryContext);
     const headingScoped = headingFilter.versionScoped && headingFilter.phaseCount > 0;
     // Phase keys the ROADMAP attributes to some OTHER milestone. A row carrying an
     // explicit version that is not the current one is a positive claim by a prior
@@ -507,7 +513,7 @@ function inspectWorkstream(cwd, name, options = {}) {
     const isDirInCurrentMilestone = (dir) => {
         if (!scoped)
             return true;
-        const key = phaseKeyFromDir(dir);
+        const key = phaseKeyFromDir(dir, undefined, directoryContext);
         if (currentMilestoneKeys.has(key))
             return true;
         const parent = parentPhaseKey(key);
@@ -563,7 +569,7 @@ function inspectWorkstream(cwd, name, options = {}) {
         }
         return {
             directory: dir,
-            phaseKey: phaseKeyFromDir(dir),
+            phaseKey: phaseKeyFromDir(dir, undefined, directoryContext),
             mtimeMs: phaseDirMtime(phaseDir),
             planCount: counts.planCount,
             summaryCount: counts.summaryCount,

package/gsd-core/bin/lib/worktree-safety.cjs

@@ -176,7 +176,28 @@ function resolveWorktreeContext(cwd, deps = {}) {
             reason: 'has_local_planning',
         };
     }
-    return resolveWorktreeLinkage(cwd, deps);
+    const linkage = resolveWorktreeLinkage(cwd, deps);
+    if (linkage.reason !== 'linked_worktree')
+        return linkage;
+    // #4885: from a SUBDIRECTORY of a LINKED worktree the cwd has no .planning of its own, but the
+    // worktree's own top-level may. That checkout is the project the caller means; remapping to the
+    // main checkout would make `commit` and every planning write land in the wrong repository. A linked
+    // worktree with no .planning anywhere still remaps to the main checkout, and the main checkout's own
+    // subdirectories are untouched.
+    const execGit = deps.execGit || execGitDefault;
+    const top = execGit(['rev-parse', '--show-toplevel'], { cwd });
+    const topText = String(top.stdout || '').trim();
+    if (!top.timedOut && top.exitCode === 0 && topText !== '') {
+        const topLevel = node_path_1.default.resolve(cwd, topText);
+        if (existsSync(node_path_1.default.join(topLevel, '.planning'))) {
+            return {
+                effectiveRoot: topLevel,
+                mode: 'current_directory',
+                reason: 'has_local_planning',
+            };
+        }
+    }
+    return linkage;
 }
 function planWorktreePrune(repoRoot, options = {}, deps = {}) {
     const parsePorcelain = deps.parseWorktreePorcelain || parseWorktreePorcelain;

package/gsd-core/bin/shared/config-defaults.manifest.json

@@ -22,6 +22,7 @@
   "git": {
     "branching_strategy": "none",
     "create_tag": true,
+    "repo_tagging": "single",
     "base_branch": null,
     "phase_branch_template": "gsd/phase-{phase}-{slug}",
     "milestone_branch_template": "gsd/{milestone}-{slug}",

package/gsd-core/bin/shared/config-schema.manifest.json

@@ -51,6 +51,7 @@
     "git.protected_branches",
     "git.allow_default_branch_commits",
     "git.create_tag",
+    "git.repo_tagging",
     "git.phase_branch_template",
     "git.milestone_branch_template",
     "git.quick_branch_template",