@opengsd/gsd-core 1.7.0-rc.4 → 1.7.0-rc.6

package/gsd-core/bin/lib/normalize-test-command.cjs

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * Test-command normalizer (#1857).
+ *
+ * A GSD verification gate resolves a project's test command and runs it. When
+ * that command is a watch/dev-mode runner (vitest defaults to WATCH in an
+ * interactive TTY — which is exactly a user running `gsd-execute-phase` in their
+ * terminal — and jest with `--watch`/`--watchAll`), the process never exits and
+ * the orchestrator waits forever.
+ *
+ * `normalizeTestCommand` rewrites a resolved command to a best-effort one-shot
+ * form so a gate cannot hang on watch mode. It is intentionally conservative:
+ *   - it NEVER double-adds flags (already-one-shot commands are returned verbatim),
+ *   - it only touches commands it positively recognises as a watch runner,
+ *   - anything it cannot classify is returned unchanged.
+ * The gate's wall-clock `timeout` is the ultimate guarantee for anything this
+ * best-effort pass cannot defeat (e.g. an explicit `--watch` baked into a
+ * project's `test` script, which even `CI=1` cannot override per vitest docs).
+ *
+ * Bounded by design (#1857 security review): the input is length-capped, all
+ * scanning is linear-time (no super-linear regex backtracking), and package.json
+ * is only read when it is a regular file — so normalization itself can never
+ * hang or take super-linear time on an adversarial `workflow.test_command`.
+ *
+ * Single source of truth: all four test-command gates (regression, post-merge,
+ * audit-fix, verify-phase) route their resolved command through this helper so
+ * the paths cannot drift.
+ *
+ * Leaf module — depends only on node:fs / node:path.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+// A resolved test command is never realistically this long; anything larger is
+// not a real runner invocation. We skip normalization above this bound (the
+// gate's own timeout still bounds the actual run) so no regex ever scans an
+// adversarial multi-KB string.
+const MAX_COMMAND_LENGTH = 4096;
+// Markers proving a command is already one-shot / non-watch. If any is present
+// we return the command unchanged so we never double-add flags or fight an
+// explicit user choice.
+const ONE_SHOT_MARKERS = [
+    /(?:^|\s)vitest\s+run\b/, // vitest run …
+    /(?:^|\s)--run\b/, // vitest --run
+    /(?:^|\s)--no-watch\b/, // vitest --no-watch
+    /(?:^|\s)--watchAll=false\b/, // jest --watchAll=false
+    /(?:^|\s)--watch=false\b/,
+    /(?:^|\s)--ci\b/, // jest --ci
+    /^\s*CI=/, // already forced into CI/run mode via env
+];
+/** True if the command already runs one-shot (so normalization is a no-op). */
+function isAlreadyOneShot(cmd) {
+    return ONE_SHOT_MARKERS.some((re) => re.test(cmd));
+}
+// Match a runner as a standalone command TOKEN (whitespace-delimited), NOT as a
+// substring — so "vitest.config.js" / "jest-environment" / "node vitest-x.js"
+// are not treated as the runner and are never mangled.
+const VITEST_TOKEN = /(?:^|\s)vitest(?=\s|$)/;
+const JEST_TOKEN = /(?:^|\s)jest(?=\s|$)/;
+/**
+ * Linear-time detection of a package-manager `test` script invocation
+ * (`npm test`, `pnpm run test`, `pnpm --dir app test`, `yarn test`, …). We split
+ * on shell separators FIRST (linear), then test each bounded segment with simple
+ * anchored regexes — no tempered-greedy scan, so no super-linear backtracking on
+ * adversarial input.
+ */
+function isScriptInvocation(cmd) {
+    return cmd.split(/&&|\|\||;/).some((seg) => {
+        const s = seg.trim();
+        return /^(?:npm|pnpm|yarn|bun)\b/.test(s) && /\btest\b/.test(s);
+    });
+}
+/**
+ * Resolve the package.json directory for a command that may target a different
+ * working dir via `--dir <p>` (pnpm), `-C <p>` (pnpm), or `--prefix <p>` (npm).
+ */
+function resolvePackageDir(cmd, cwd) {
+    const m = cmd.match(/(?:--dir|--prefix|-C)[=\s]+(\S+)/);
+    if (m && m[1]) {
+        const p = m[1].replace(/^['"]|['"]$/g, '');
+        return node_path_1.default.isAbsolute(p) ? p : node_path_1.default.join(cwd, p);
+    }
+    return cwd;
+}
+/**
+ * Inspect package.json `scripts.test` for the given command's target dir and
+ * report whether it resolves to a watch-by-default / explicitly-watching runner.
+ * Only ever reads `scripts.test` as a STRING for classification — it is never
+ * executed or spliced into the output.
+ */
+function scriptTestRunner(cmd, cwd) {
+    try {
+        const pkgPath = node_path_1.default.join(resolvePackageDir(cmd, cwd), 'package.json');
+        // Only read a REGULAR file — never block on a FIFO/socket/dir named
+        // "package.json" reachable via --dir (#1857 security review).
+        let stat;
+        try {
+            stat = node_fs_1.default.statSync(pkgPath);
+        }
+        catch {
+            return null;
+        }
+        if (!stat.isFile())
+            return null;
+        const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgPath, 'utf-8'));
+        const testScript = pkg.scripts?.test ?? '';
+        if (!testScript)
+            return null;
+        // vitest watches by default unless the script itself is already one-shot.
+        if (VITEST_TOKEN.test(testScript) && !isAlreadyOneShot(testScript))
+            return 'vitest';
+        // jest only watches when explicitly asked to.
+        if (JEST_TOKEN.test(testScript) &&
+            /(?:^|\s)--watch(?:All)?\b/.test(testScript) &&
+            !/--watch(?:All)?=false\b/.test(testScript)) {
+            return 'jest';
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Strip a bare/explicit-true `--watch` / `--watchAll` (never `=false`). */
+function stripWatchFlags(cmd) {
+    return cmd
+        .replace(/(?:^|\s)--watch(?:All)?(?:=true)?(?=\s|$)/g, ' ')
+        .replace(/\s{2,}/g, ' ')
+        .trim();
+}
+/**
+ * Normalize a resolved test command to a best-effort one-shot form.
+ *
+ * @param rawCmd The resolved test command (e.g. from `config-get
+ *   workflow.test_command` or the gate's runner sniff).
+ * @param cwd    Directory used to locate package.json for script invocations.
+ * @returns A one-shot command, or `rawCmd` unchanged when it is already
+ *   one-shot / not a recognised watch runner / too long to be a real runner.
+ */
+function normalizeTestCommand(rawCmd, cwd) {
+    const cmd = (rawCmd ?? '').trim();
+    if (!cmd || cmd === 'true')
+        return rawCmd;
+    if (cmd.length > MAX_COMMAND_LENGTH)
+        return rawCmd; // bound all downstream scanning
+    if (isAlreadyOneShot(cmd))
+        return rawCmd;
+    const isScript = isScriptInvocation(cmd);
+    // 1. Direct vitest invocation (`vitest`, `npx vitest`, `pnpm exec vitest`, …):
+    //    force the explicit one-shot `run` command and drop any bare --watch.
+    if (VITEST_TOKEN.test(cmd) && !isScript) {
+        return stripWatchFlags(cmd).replace(/(^|\s)vitest(?=\s|$)/, '$1vitest run');
+    }
+    // 2. Direct jest invocation with an explicit watch flag: make it one-shot.
+    if (JEST_TOKEN.test(cmd) && !isScript) {
+        if (/(?:^|\s)--watch(?:All)?\b/.test(cmd)) {
+            return `${stripWatchFlags(cmd)} --watchAll=false`;
+        }
+        return rawCmd; // jest without --watch already runs once
+    }
+    // 3. Package-manager `test` script invocation: the runner is inside
+    //    package.json. If it resolves to a watch runner, force CI/run mode via
+    //    the CI env — robust across --dir and pnpm/yarn `--` propagation quirks
+    //    (vitest & jest both switch to run/non-interactive mode when CI is set).
+    if (isScript) {
+        const runner = scriptTestRunner(cmd, cwd);
+        if (runner === 'vitest' || runner === 'jest') {
+            return `CI=true ${cmd}`;
+        }
+        return rawCmd;
+    }
+    return rawCmd;
+}
+/**
+ * CLI handler for `gsd-tools query normalize-test-command <raw-cmd>`: prints the
+ * normalized one-shot command to stdout (the gates capture it via `$(…)`).
+ */
+function cmdNormalizeTestCommand(cwd, rawCmd) {
+    process.stdout.write(normalizeTestCommand(rawCmd ?? '', cwd));
+}
+module.exports = {
+    normalizeTestCommand,
+    cmdNormalizeTestCommand,
+    isAlreadyOneShot,
+};

package/gsd-core/bin/lib/phase-id.cjs

@@ -34,9 +34,20 @@ const OPTIONAL_PROJECT_CODE_PREFIX_SOURCE = '(?:[A-Z][A-Z0-9_]*-)?';
 // Enumeration/parse call sites that read phase headers from a regex *literal*
 // (rather than a `new RegExp` built from an interpolated phase number) cannot
 // reference this constant; they inline its literal-regex mirror instead —
-// `(?:\s*\([^)\n]*\))?` — kept character-for-character equivalent to this
+// `(?:\s*\([^)\n]{0,200}\))?` — kept character-for-character equivalent to this
 // source. Both forms must change together; see the #1729 regression test.
-const OPTIONAL_PHASE_TAG_SOURCE = '(?:\\s*\\([^)\\n]*\\))?';
+const OPTIONAL_PHASE_TAG_SOURCE = '(?:\\s*\\([^)\\n]{0,200}\\))?';
+// #2128: the canonical phase-NUMBER-TOKEN grammar — a phase number with an
+// optional single-letter variant suffix and optional dotted sub-phases
+// (1, 01, 12A, 12.1, 3.2.1). This is the ENUMERATION/scan counterpart to
+// phaseMarkdownRegexSource: use phaseMarkdownRegexSource(n) to build a source
+// for ONE KNOWN number; reference this constant when a call site must match ANY
+// phase and capture its token. Enumeration/parse sites inline this into a
+// `new RegExp(...)` instead of re-deriving the grammar as a literal, so every
+// phase-token producer shares one owner. The anti-divergence guard
+// (scripts/lint-phase-id-drift.cjs) fails CI if a literal re-derivation is
+// introduced outside this module without a `// phase-id-owner:` justification.
+const PHASE_NUMBER_TOKEN_SOURCE = '\\d+[A-Z]?(?:\\.\\d+)*';
 function stripProjectCodePrefix(value, caseInsensitive = true) {
     const input = String(value);
     const re = caseInsensitive ? PROJECT_CODE_PREFIX_STRIP_RE_I : PROJECT_CODE_PREFIX_STRIP_RE;
@@ -200,9 +211,32 @@ function extractPhaseToken(dirName) {
     }
     const segments = rest.split('-');
     const tokenSegments = [];
+    // #2043: distinguish a real (zero-padded, ≥2-digit) phase/sub-phase segment
+    // from a single-digit slug word. A pure-numeric leading segment ("46") only
+    // continues with ≥2-digit segments, so "46-6-rs-…" yields "46" (the "6" is the
+    // slug's first word), not "46-6". Milestone-prefixed ids like "M1-2" reach here
+    // with "M1-" already stripped as a project-code prefix (see
+    // PROJECT_CODE_PREFIX_CAPTURE_RE_I), so "2" is the leading segment and the same
+    // pure-numeric rule applies (M1-46-6-rs → "M1-46"). The firstLetterPrefixed
+    // carve-out covers letter+digit leading segments that survive prefix stripping
+    // because of punctuation (e.g. "P0.3-2"), whose single-digit continuation is
+    // intentionally preserved (unchanged from prior behaviour).
+    let firstLetterPrefixed = false;
     for (let i = 0; i < segments.length; i++) {
         const seg = segments[i];
-        if (/^\d/.test(seg) || (i === 0 && /^[A-Za-z]{1,3}\d/.test(seg))) {
+        if (i === 0) {
+            if (/^\d/.test(seg)) {
+                tokenSegments.push(seg);
+            }
+            else if (/^[A-Za-z]{1,3}\d/.test(seg)) {
+                tokenSegments.push(seg);
+                firstLetterPrefixed = true;
+            }
+            else {
+                break;
+            }
+        }
+        else if (/^\d{2,}/.test(seg) || (firstLetterPrefixed && /^\d/.test(seg))) {
             tokenSegments.push(seg);
         }
         else {
@@ -229,10 +263,101 @@ function phaseTokenMatches(dirName, normalized) {
     }
     return false;
 }
+// ─── #2121 canonical surface (ADR-2121) ──────────────────────────────────────
+/**
+ * Parse a phase identifier from a STATE.md `Phase:` prose field VALUE — the text
+ * after the `Phase:` label (e.g. `"3 of 4 (Delta)"`, `"3A — Delta (executing)"`,
+ * or `"Milestone v0.5 complete"`).
+ *
+ * The token is anchored to the START of the value (after an optional literal
+ * `Phase ` label and an optional project-code prefix) so a phase is only
+ * returned when the value actually begins with one. This is the #2111 fix: the
+ * prior unanchored `/\b(\d+[A-Z]?(?:\.\d+)*)\b/i` mined the first numeral
+ * anywhere, so `"Milestone v0.5 complete"` collapsed to `"5"` (the minor-version
+ * digit) and `"v1.0"` to `"0"` (a reserved sentinel). Here both yield
+ * `{ phase: null }` because they do not begin with a phase token. The name
+ * extraction (parenthetical or em-dash tail, minus status words) is unchanged.
+ */
+function parsePhaseFromProse(value) {
+    if (!value)
+        return { phase: null, name: null };
+    // Coerce defensively so a non-string caller cannot throw on this canonical
+    // surface (mirrors the sibling #2121 functions' String(...) handling).
+    const str = String(value);
+    const phaseMatch = str.match(/^\s*(?:Phase\s+)?(?:[A-Z][A-Z0-9_]*-)?(\d+[A-Z]?(?:\.\d+)*)\b/i);
+    // The name-extraction quantifiers are length-bounded so a crafted long
+    // unterminated run (many `(` or `—`) in an untrusted STATE.md field value
+    // cannot drive O(n^2) regex backtracking (CPU-exhaustion DoS). A real phase
+    // name is far shorter than the cap.
+    const parenName = str.match(/\(([^)]{1,200})\)/);
+    const dashName = str.match(/—\s*([^(\n]{1,200}?)(?:\s*\(|$)/);
+    const rawName = parenName?.[1] ?? dashName?.[1] ?? null;
+    const name = rawName && !/^(?:complete|executing|not started)$/i.test(rawName.trim())
+        ? rawName.trim()
+        : null;
+    return {
+        phase: phaseMatch ? phaseMatch[1] : null,
+        name,
+    };
+}
+/**
+ * Config-AWARE project-code prefix strip. Unlike the config-blind
+ * `stripProjectCodePrefix` (which strips ANY `<CODE>-` shape), this strips the
+ * leading `<CODE>-` ONLY when `<CODE>` case-insensitively equals the configured
+ * `projectCode`. A foreign prefix (`MEM-01` when the configured code is `LKML`)
+ * or an absent/empty `projectCode` is preserved verbatim — this is the #2104
+ * fix: a foreign-prefixed id must not collapse to a bare numeric phase and
+ * collide with a real one.
+ */
+function stripConfiguredProjectCodePrefix(value, projectCode) {
+    const input = String(value);
+    const configured = typeof projectCode === 'string' ? projectCode.trim() : '';
+    if (!configured)
+        return input;
+    const m = input.match(PROJECT_CODE_PREFIX_CAPTURE_RE_I);
+    if (!m)
+        return input;
+    if (m[1].toUpperCase() !== configured.toUpperCase())
+        return input;
+    return m[2];
+}
+/**
+ * True when `phase` carries a project-code prefix that is NOT the configured
+ * `projectCode` (or when no `projectCode` is configured). The canonical
+ * predicate the init-command foreign-prefix guard (#2056 / PR #2105) delegates
+ * to, so every call site shares one foreign-prefix rule.
+ */
+function isForeignPrefixedPhaseQuery(phase, projectCode) {
+    const m = String(phase).match(PROJECT_CODE_PREFIX_CAPTURE_RE_I);
+    if (!m)
+        return false;
+    const configured = typeof projectCode === 'string' ? projectCode.trim() : '';
+    return !configured || m[1].toUpperCase() !== configured.toUpperCase();
+}
+/**
+ * Canonical ROADMAP heading lookup-source list (moved here from
+ * roadmap-parser.cts so phase-id.cts is the single owner of the ordering).
+ * Sources are tried in a fixed, deduplicated order: exact (only when the query
+ * itself is project-code-prefixed) → bare numeric / padding-tolerant →
+ * prefix-tolerant fallback. The bare numeric source precedes the prefix-tolerant
+ * form so a canonical heading (`### Phase 117:`) is preferred over a drifted
+ * prefixed one (`### Phase MANIFOLD-117:`) when both exist in one ROADMAP.
+ */
+function roadmapPhaseLookupSources(phaseNum) {
+    const sources = [];
+    const exactSource = phaseMarkdownRegexSourceExact(phaseNum);
+    if (exactSource)
+        sources.push(exactSource);
+    const numericSource = phaseMarkdownRegexSource(phaseNum);
+    sources.push(numericSource);
+    sources.push(`${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}${numericSource}`);
+    return [...new Set(sources)];
+}
 module.exports = {
     escapeRegex,
     OPTIONAL_PROJECT_CODE_PREFIX_SOURCE,
     OPTIONAL_PHASE_TAG_SOURCE,
+    PHASE_NUMBER_TOKEN_SOURCE,
     stripProjectCodePrefix,
     normalizePhaseName,
     getMilestoneFromPhaseId,
@@ -242,4 +367,8 @@ module.exports = {
     comparePhaseNum,
     extractPhaseToken,
     phaseTokenMatches,
+    parsePhaseFromProse,
+    stripConfiguredProjectCodePrefix,
+    isForeignPrefixedPhaseQuery,
+    roadmapPhaseLookupSources,
 };

package/gsd-core/bin/lib/phase.cjs

@@ -32,7 +32,7 @@ const coreUtilsMod = require("./core-utils.cjs");
 const { toPosixPath, generateSlugInternal, readSubdirectories } = coreUtilsMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-id.cjs is an export= CommonJS module
 const phaseIdMod = require("./phase-id.cjs");
-const { escapeRegex, normalizePhaseName, phaseMarkdownRegexSource, comparePhaseNum, phaseTokenMatches, OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, OPTIONAL_PHASE_TAG_SOURCE, } = phaseIdMod;
+const { escapeRegex, normalizePhaseName, phaseMarkdownRegexSource, comparePhaseNum, phaseTokenMatches, OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, OPTIONAL_PHASE_TAG_SOURCE, PHASE_NUMBER_TOKEN_SOURCE, } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-locator.cjs is an export= CommonJS module
 const phaseLocatorMod = require("./phase-locator.cjs");
 const { findPhaseInternal, getArchivedPhaseDirs } = phaseLocatorMod;
@@ -55,7 +55,7 @@ const { evaluateUatPassed } = uatPredicate;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- verification.cjs is an export= CommonJS module
 const verificationMod = require("./verification.cjs");
 const { readVerificationStatus } = verificationMod;
-const { planningDir, withPlanningLock } = planningWorkspace;
+const { planningDir, withPlanningLock, listAvailableWorkstreams, getActiveWorkstream } = planningWorkspace;
 const { extractFrontmatter } = frontmatterMod;
 const { readModifyWriteStateMd, stateExtractField, stateReplaceField, syncStateFrontmatter, withStateLock, updatePerformanceMetricsSection, } = stateMod;
 // #2893 — strict canonical filter: `{padded_phase}-{NN}-PLAN.md` or `PLAN.md`.
@@ -84,7 +84,10 @@ function extractCanonicalPlanId(filename) {
         .replace(/-SUMMARY\.md$/i, '')
         .replace(/\.md$/i, '');
     const parts = base.split('-').filter(Boolean);
-    const tokenRe = /^\d+[A-Z]?(?:\.\d+)*$/i;
+    // #2043: a phase/plan token component is either a zero-padded number (≥2 digits)
+    // or a single-digit-plus-letter id ("3A"); a *bare* single digit is a slug word,
+    // so "46-6-rs-…" is not paired into a "46-6" id while "3A-01" stays intact.
+    const tokenRe = /^(?:\d{2,}[A-Z]?|\d[A-Z])(?:\.\d+)*$/i;
     const phaseIdx = parts.findIndex((p) => tokenRe.test(p));
     if (phaseIdx >= 0 && phaseIdx + 1 < parts.length && tokenRe.test(parts[phaseIdx + 1])) {
         return `${parts[phaseIdx]}-${parts[phaseIdx + 1]}`;
@@ -313,8 +316,7 @@ function cmdFindPhase(cwd, phase, raw) {
             const match = dirs.find((d) => phaseTokenMatches(d, normalized));
             if (!match)
                 continue;
-            const dirMatch = match.match(new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}(\\d+[A-Z]?(?:\\.\\d+)*)-?(.*)`, 'i')) ||
-                match.match(/^(\d+[A-Z]?(?:\.\d+)*)-?(.*)/i);
+            const dirMatch = match.match(new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}(${PHASE_NUMBER_TOKEN_SOURCE})-?(.*)`, 'i')) || match.match(new RegExp(`^(${PHASE_NUMBER_TOKEN_SOURCE})-?(.*)`, 'i'));
             const phaseNumber = dirMatch ? dirMatch[1] : normalized;
             const phaseName = dirMatch && dirMatch[2] ? dirMatch[2] : null;
             const phaseDir = node_path_1.default.join(searchDir, match);
@@ -578,13 +580,13 @@ function cmdPhaseAdd(cwd, description, raw, customId) {
             // Three sources are scanned so that a phase in ANY representation
             // (section header, roadmap bullet, or on-disk directory) is counted:
             // 1) Section headers: ### Phase N: / ## Phase N: / #### Phase N:
-            // #1729: `(?:\s*\([^)\n]*\))?` tolerates a pre-colon ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE).
-            const headerPattern = /#{2,4}\s*Phase\s+(\d+)[A-Z]?(?:\.\d+)*(?:\s*\([^)\n]*\))?:/gi;
+            // #1729: `(?:\s*\([^)\n]{0,200}\))?` tolerates a pre-colon ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE).
+            const headerPattern = /#{2,4}\s*Phase\s+(\d+)[A-Z]?(?:\.\d+)*(?:\s*\([^)\n]{0,200}\))?:/gi;
             // 2) Roadmap bullet entries: - [ ] **Phase N: ...** (all checkbox variants)
             // The lookahead accepts colon, decimal-dot, whitespace, bold-close asterisk,
             // or end-of-line so titleless forms ("- [ ] **Phase 11**", "- [ ] Phase 11")
             // are counted and cannot collide with a freshly-added phase. (#1229)
-            const bulletPattern = /^[ \t]*-[ \t]*\[[^\]]*\][ \t]*\*{0,2}Phase[ \t]+(\d+)(?=[:.\s*]|$)/gim;
+            const bulletPattern = /^[ \t]*-[ \t]*\[[^\]]{0,200}\][ \t]*\*{0,2}Phase[ \t]+(\d+)(?=[:.\s*]|$)/gim;
             const usedPhaseNums = new Set();
             let m;
             while ((m = headerPattern.exec(content)) !== null) {
@@ -663,8 +665,8 @@ function cmdPhaseAddBatch(cwd, descriptions, raw) {
         const content = extractCurrentMilestone(rawContent, cwd);
         let maxPhase = 0;
         if (config.phase_naming !== 'custom') {
-            // #1729: `(?:\s*\([^)\n]*\))?` tolerates a pre-colon ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE).
-            const phasePattern = /#{2,4}\s*Phase\s+(\d+)[A-Z]?(?:\.\d+)*(?:\s*\([^)\n]*\))?:/gi;
+            // #1729: `(?:\s*\([^)\n]{0,200}\))?` tolerates a pre-colon ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE).
+            const phasePattern = /#{2,4}\s*Phase\s+(\d+)[A-Z]?(?:\.\d+)*(?:\s*\([^)\n]{0,200}\))?:/gi;
             let m;
             while ((m = phasePattern.exec(content)) !== null) {
                 const num = parseInt(m[1], 10);
@@ -948,7 +950,7 @@ function updateRoadmapAfterPhaseRemoval(roadmapPath, targetPhase, isDecimal, rem
         if (!isDecimal) {
             // #1729: fold an optional pre-colon ( ) tag into the suffix capture so it
             // is re-emitted verbatim — a tagged later phase still gets renumbered.
-            content = content.replace(/(#{2,4}\s*Phase\s+)(\d+(?:\.\d+)?)((?:\s*\([^)\n]*\))?\s*:)/gi, (_match, prefix, num, suffix) => `${prefix}${decrementRoadmapPhaseToken(num, removedInt)}${suffix}`);
+            content = content.replace(/(#{2,4}\s*Phase\s+)(\d+(?:\.\d+)?)((?:\s*\([^)\n]{0,200}\))?\s*:)/gi, (_match, prefix, num, suffix) => `${prefix}${decrementRoadmapPhaseToken(num, removedInt)}${suffix}`);
             content = content.replace(/(-\s*\[[ x]\]\s*.*?Phase\s+)(\d+)(\s*:|\s+)/gi, (_match, prefix, num, suffix) => `${prefix}${decrementRoadmapPhaseNumber(num, removedInt)}${suffix}`);
             content = content.replace(/(\|\s*)(\d+)(\.\s)/g, (_match, prefix, num, suffix) => `${prefix}${decrementRoadmapPhaseNumber(num, removedInt)}${suffix}`);
             content = content.replace(/(?<![0-9-])(\d{2})-(\d{2})(?=(?:(?:-[A-Za-z][A-Za-z0-9-]*)?-(?:PLAN|SUMMARY)\.md)|(?![0-9-]))/g, (_match, phaseNum, planNum) => `${decrementRoadmapPaddedPhaseNumber(phaseNum, removedInt)}-${planNum}`);
@@ -1067,6 +1069,19 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
     if (!phaseNum) {
         error('phase number required for phase complete');
     }
+    // #2028: fail safe in workstream mode with no active workstream. With no active
+    // workstream and no --ws, planningDir(cwd) resolves to root .planning, so
+    // phase.complete would write STATE.md/ROADMAP.md (and mislabel milestone status)
+    // into the shared root that other workstreams read. Mirror the #1912 guard that
+    // init.progress got (resolution: GSD_WORKSTREAM env > stored active pointer; an
+    // explicit --ws sets GSD_WORKSTREAM upstream and satisfies the check).
+    const availableWorkstreams = listAvailableWorkstreams(cwd);
+    const resolvedWorkstream = process.env['GSD_WORKSTREAM'] || getActiveWorkstream(cwd);
+    if (availableWorkstreams.length > 0 && !resolvedWorkstream) {
+        error(`phase.complete requires a workstream in workstream mode — no active workstream is set, so root STATE.md/ROADMAP.md (likely stale) would be written. ` +
+            `Pass --ws <name> or run ${(0, runtime_slash_cjs_1.formatGsdSlash)('workstream set', (0, runtime_slash_cjs_1.resolveRuntime)(cwd))} first. ` +
+            `Available workstreams: ${availableWorkstreams.join(', ')}`);
+    }
     const roadmapPath = node_path_1.default.join(planningDir(cwd), 'ROADMAP.md');
     const statePath = node_path_1.default.join(planningDir(cwd), 'STATE.md');
     const phasesDir = node_path_1.default.join(planningDir(cwd), 'phases');
@@ -1132,7 +1147,13 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                 const originalRoadmapContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
                 roadmapContent = originalRoadmapContent;
                 const phaseEscaped = phaseMarkdownRegexSource(phaseNum);
-                const checkboxPattern = new RegExp(`(-\\s*\\[)[ ](\\]\\s*.*Phase\\s+${phaseEscaped}${OPTIONAL_PHASE_TAG_SOURCE}[:\\s][^\\n]*)`, 'i');
+                // #2067: the gap between `]` and `Phase N` must allow only whitespace /
+                // markdown bold emphasis — NOT greedy `.*`. A greedy gap matched a later
+                // phase whose description merely mentioned the completed phase number,
+                // so completing an already-checked phase (idempotent re-run) checked the
+                // wrong phase's box. Mirrors the tight pattern used by phase-insert
+                // (`]\\s*(?:\\*\\*)?Phase`).
+                const checkboxPattern = new RegExp(`(-\\s*\\[)[ ](\\]\\s*(?:\\*\\*)?\\s*Phase\\s+${phaseEscaped}${OPTIONAL_PHASE_TAG_SOURCE}[:\\s][^\\n]*)`, 'i');
                 roadmapContent = roadmapContent.replace(checkboxPattern, `$1x$2 (completed ${today})`);
                 const tableRowPattern = new RegExp(`^(\\|\\s*${phaseEscaped}\\.?\\s[^|]*(?:\\|[^\\n]*))$`, 'im');
                 // Scope the Progress-row search to the ## Progress section so the regex
@@ -1166,7 +1187,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                 else {
                     roadmapContent = roadmapContent.replace(tableRowPattern, updateProgressRow);
                 }
-                const planCountPattern = new RegExp(`(#{2,4}\\s*Phase\\s+${phaseEscaped}[\\s\\S]*?\\*\\*Plans:\\*\\*\\s*)[^\\n]+`, 'i');
+                const planCountPattern = new RegExp(`(#{2,4}\\s*Phase\\s+${phaseEscaped}(?:(?!\\n#{1,4}\\s)[\\s\\S])*?\\*\\*Plans:\\*\\*\\s*)[^\\n]+`, 'i');
                 roadmapContent = roadmapContent.replace(planCountPattern, `$1${summaryCount}/${planCount} plans complete`);
                 const phaseInfoSummaries = phaseInfo['summaries'];
                 for (const summaryFile of phaseInfoSummaries) {
@@ -1284,7 +1305,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     .filter(isDirInMilestone)
                     .sort((a, b) => comparePhaseNum(a, b));
                 for (const dir of dirs) {
-                    const dm = dir.match(/^(\d+[A-Z]?(?:\.\d+)*)-?(.*)/i);
+                    const dm = dir.match(new RegExp(`^(${PHASE_NUMBER_TOKEN_SOURCE})-?(.*)`, 'i'));
                     if (dm) {
                         if (/^999(?:\.|$)/.test(dm[1]))
                             continue;
@@ -1315,10 +1336,10 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // phase. Allow optional `**`/`__` emphasis after the marker and stop
                     // the name capture at emphasis so bold names slug cleanly; the number
                     // capture is unchanged.
-                    // #1729: `(?:\s*\([^)\n]*\))?` after the number tolerates a pre-colon
+                    // #1729: `(?:\s*\([^)\n]{0,200}\))?` after the number tolerates a pre-colon
                     // ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE) so
                     // `### Phase N (Cluster B): X` resolves. Captures are unchanged.
-                    const phasePattern = /(?:#{2,4}|-\s*\[[ xX]\])\s*(?:\*\*|__)?\s*Phase\s+(\d+[A-Z]?(?:\.\d+)*)(?:\s*\([^)\n]*\))?\s*:\s*([^\n*]+)/gi;
+                    const phasePattern = new RegExp(`(?:#{2,4}|-\\s*\\[[ xX]\\])\\s*(?:\\*\\*|__)?\\s*Phase\\s+(${PHASE_NUMBER_TOKEN_SOURCE})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*:\\s*([^\\n*]+)`, 'gi');
                     let pm;
                     while ((pm = phasePattern.exec(roadmapForPhases)) !== null) {
                         if (comparePhaseNum(pm[1], phaseNum) > 0) {
@@ -1337,6 +1358,47 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     /* intentionally empty */
                 }
             }
+            // #2028: don't stamp "Milestone complete" when a LOWER-numbered phase is
+            // still outstanding. The two blocks above only clear isLastPhase when a
+            // HIGHER-numbered phase exists, so completing the numerically-highest phase
+            // out of order (e.g. Phase 10 before Phase 9) wrongly read as milestone-end.
+            // A phase is complete iff its roadmap checkbox is `[x]` (phase.complete sets
+            // this on completion — including the one just marked above); any earlier
+            // phase in this milestone whose checkbox is still `[ ]` means the milestone
+            // is not done, and the LOWEST such phase is the real next actionable item —
+            // point next_phase at it so STATE.md advances to the gap rather than parking
+            // on the just-completed phase. Roadmaps without phase checkboxes (heading-
+            // only) retain the prior behavior — there is nothing to scan. The checkbox
+            // pattern mirrors the sibling phasePattern's anchoring (only whitespace/bold
+            // between the box and "Phase", a required `:`) so unrelated checklist lines
+            // that merely mention "Phase N" don't match.
+            if (isLastPhase && roadmapContent !== null) {
+                try {
+                    const milestoneScope = extractCurrentMilestone(roadmapContent, cwd);
+                    const cbPattern = new RegExp(`-\\s*\\[(x| )\\]\\s*(?:\\*\\*|__)?\\s*Phase\\s+(${PHASE_NUMBER_TOKEN_SOURCE})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*:\\s*([^\\n*]+)`, 'gi');
+                    let cbm;
+                    let lowestOutstanding = null;
+                    while ((cbm = cbPattern.exec(milestoneScope)) !== null) {
+                        const isChecked = cbm[1].toLowerCase() === 'x';
+                        if (!isChecked && comparePhaseNum(cbm[2], phaseNum) < 0) {
+                            if (lowestOutstanding === null || comparePhaseNum(cbm[2], lowestOutstanding.num) < 0) {
+                                lowestOutstanding = {
+                                    num: cbm[2],
+                                    name: cbm[3].replace(/\(INSERTED\)/i, '').trim().toLowerCase().replace(/\s+/g, '-'),
+                                };
+                            }
+                        }
+                    }
+                    if (lowestOutstanding !== null) {
+                        isLastPhase = false;
+                        nextPhaseNum = lowestOutstanding.num;
+                        nextPhaseName = lowestOutstanding.name;
+                    }
+                }
+                catch {
+                    /* intentionally empty */
+                }
+            }
             if (node_fs_1.default.existsSync(statePath)) {
                 const originalStateContent = (0, shell_command_projection_cjs_1.platformReadSync)(statePath) || '';
                 let stateContent = originalStateContent;

package/gsd-core/bin/lib/planning-workspace.cjs

@@ -120,6 +120,22 @@ function planningDir(cwd, ws, project) {
 function planningRoot(cwd) {
     return node_path_1.default.join(cwd, '.planning');
 }
+// Sorted list of workstream directory names under `<root>/.planning/workstreams`,
+// or `[]` when the project is flat (no workstreams dir). Single source of truth
+// for the "workstream mode" detection shared by the #1912/#2028 fail-safe guards
+// (init.progress, phase.complete) so the two paths cannot drift.
+function listAvailableWorkstreams(cwd) {
+    try {
+        return node_fs_1.default
+            .readdirSync(node_path_1.default.join(planningRoot(cwd), 'workstreams'), { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
 function planningPaths(cwd, ws) {
     const base = planningDir(cwd, ws);
     return {
@@ -364,6 +380,7 @@ module.exports = {
     createMemoryPointerAdapter,
     planningDir,
     planningRoot,
+    listAvailableWorkstreams,
     planningPaths,
     withPlanningLock,
     getActiveWorkstream,

package/gsd-core/bin/lib/review-reviewer-selection.cjs

@@ -15,25 +15,42 @@
  * per-instance CLI flags). An instance is available iff its base `cli` is
  * detected. The instance→cli mapping lives HERE (single source; see the parity
  * test in tests/review-reviewer-instances.test.cjs — DEFECT.GENERATIVE-FIX).
+ *
+ * KNOWN_REVIEWER_SLUGS (post-review #2092): registry-derived, not a flat
+ * hand-maintained array. Each capability-runtime descriptor that is a valid
+ * reviewer CLI declares `runtime.hostBehaviors.reviewerCli: true`
+ * (capabilities/<id>/capability.json); this module reads that flag off the
+ * generated capability-registry.cjs at require-time. A handful of reviewer
+ * CLIs are NOT install-time runtimes at all (no capabilities/<id>/ descriptor
+ * exists) — those stay a small hardcoded tail:
+ *   - `gemini` — hook-event dialect name only (see runtime-hooks-surface.cts);
+ *     the Gemini CLI reviewer is not an installable runtime (#1928 folded
+ *     gemini into antigravity's descriptor).
+ *   - `coderabbit` / `ollama` / `lm_studio` / `llama_cpp` — third-party
+ *     review/model CLIs with no GSD install surface at all.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.INSTANCE_NAME_PATTERN = exports.KNOWN_REVIEWER_SLUGS = void 0;
 exports.normalizeConfiguredDefaultReviewers = normalizeConfiguredDefaultReviewers;
 exports.normalizeReviewerInstances = normalizeReviewerInstances;
 exports.resolveReviewerSelection = resolveReviewerSelection;
-exports.KNOWN_REVIEWER_SLUGS = [
+const NON_RUNTIME_REVIEWER_SLUGS = [
     'gemini',
-    'claude',
-    'codex',
     'coderabbit',
-    'opencode',
-    'qwen',
-    'cursor',
-    'antigravity',
     'ollama',
     'lm_studio',
     'llama_cpp',
 ];
+function deriveRuntimeReviewerSlugs() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const registry = require('./capability-registry.cjs');
+    const runtimes = registry.runtimes || {};
+    return Object.keys(runtimes).filter((id) => runtimes[id]?.runtime?.hostBehaviors?.reviewerCli === true);
+}
+exports.KNOWN_REVIEWER_SLUGS = [
+    ...deriveRuntimeReviewerSlugs(),
+    ...NON_RUNTIME_REVIEWER_SLUGS,
+];
 /** Instance names are lowercase slugs that must not shadow a built-in slug. */
 exports.INSTANCE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 function normalizeConfiguredDefaultReviewers(rawValue) {

package/gsd-core/bin/lib/roadmap-command-router.cjs

@@ -44,12 +44,13 @@ function checkW021(content) {
     // Milestone section heading: ## [GSD] v2.0 — Label  OR  ## v2.0: Label  OR  ## Roadmap v2.0
     //   OR  ## ✅ v2.0  OR  ## 🚧 v2.0  (emoji-prefixed variants used by roadmap templates)
     // Capture the major integer.
-    const MILESTONE_RE = /^#{1,3}\s+(?:\[[^\]]+\]\s+|Roadmap\s+|[✅🚧]\s*)?v(\d+)\.\d+(?:\s|:|\s*—)/iu;
+    const MILESTONE_RE = /^#{1,3}\s+(?:\[[^\]]{1,200}\]\s+|Roadmap\s+|[✅🚧]\s*)?v(\d+)\.\d+(?:\s|:|\s*—)/iu;
     // Migrated phase heading: ### Phase M-NN: Name  (M-NN or unpadded M-N form)
-    // #1729: `(?:\s*\([^)\n]*\))?` tolerates a pre-colon ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE).
-    const PHASE_RE = /^#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+(\d+)-(\d+)(?:-\d+)*(?:\s*\([^)\n]*\))?\s*:/i;
+    // #1729: `(?:\s*\([^)\n]{0,200}\))?` tolerates a pre-colon ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE).
+    const PHASE_RE = /^#{2,4}\s*(?:\[[^\]]{1,200}\]\s*)?Phase\s+(\d+)-(\d+)(?:-\d+)*(?:\s*\([^)\n]{0,200}\))?\s*:/i;
     // Unprefixed legacy phase heading: ### Phase N: Name  (no hyphen sub-index)
-    const UNPREFIXED_PHASE_RE = /^#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+(\d+[A-Za-z]?(?:\.\d+)*)(?:\s*\([^)\n]*\))?\s*:/i;
+    // phase-id-owner: UNPREFIXED_PHASE_RE token uses the [A-Za-z] case-variant (identical to the canonical [A-Z] token under /i); kept literal, not source-byte-equal to PHASE_NUMBER_TOKEN_SOURCE.
+    const UNPREFIXED_PHASE_RE = /^#{2,4}\s*(?:\[[^\]]{1,200}\]\s*)?Phase\s+(\d+[A-Za-z]?(?:\.\d+)*)(?:\s*\([^)\n]{0,200}\))?\s*:/i;
     let currentMilestoneMajor = null;
     const lines = content.split('\n');
     for (const line of lines) {