@opengsd/gsd-core 1.9.0 → 1.10.0

package/gsd-core/bin/lib/graphify.cjs

@@ -16,6 +16,15 @@ const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs")
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityStateMod = require("./capability-state.cjs");
 const { isCapabilityActive } = capabilityStateMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- io.cjs is an export= CommonJS module
+const ioMod = require("./io.cjs");
+const { serializeForOutput } = ioMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- prompt-budget.cjs is an export= CommonJS module
+const promptBudget = require("./prompt-budget.cjs");
+// The repo's single token scale (phase-estimation.cts documents the rule: a
+// ratio between two measurement methods measures the methods, not the miss).
+// This module previously carried a private copy of the same chars/4 formula.
+const { estimateTokens } = promptBudget;
 /**
  * Return the standard disabled response object.
  */
@@ -52,8 +61,12 @@ function execGraphify(cwd, args, options = {}) {
             reason: GRAPHIFY_REASON.ENOENT,
         };
     }
-    // Timeout — seam exposes signal; spawnSync sets SIGTERM when killed by timeout.
-    if (result.signal === 'SIGTERM') {
+    // Timeout — result.timedOut is derived by the shared isSpawnTimeout predicate
+    // (shell-command-projection.cts), keyed on error.code === 'ETIMEDOUT' rather
+    // than signal === 'SIGTERM': Windows does not reliably report SIGTERM on a
+    // timeout kill, and an externally-delivered SIGTERM (error is null) is not
+    // a timeout at all.
+    if (result.timedOut) {
         return {
             exitCode: 124,
             stdout: result.stdout,
@@ -104,15 +117,28 @@ function checkGraphifyVersion() {
         }
     }
     // Strategy 2: fall back to python3 importlib.metadata
+    let pyPackageConfirmed = false;
     if (!versionStr) {
         const pyResult = (0, shell_command_projection_cjs_1.execTool)('python3', [
             '-c',
             'from importlib.metadata import version; print(version("graphifyy"))',
         ], { timeout: 5000 });
         if (!pyResult.error && pyResult.exitCode === 0 && pyResult.stdout) {
-            versionStr = pyResult.stdout;
+            versionStr = pyResult.stdout.trim();
+            pyPackageConfirmed = true; // importlib.metadata confirmed the package
         }
     }
+    else {
+        // #3020: verify the `graphify` binary on PATH is actually the graphifyy
+        // package — a foreign binary that happens to print a version-like string
+        // must not silently report compatible. If importlib.metadata cannot confirm
+        // the package, emit an identity warning even if the version looks right.
+        const pyVerify = (0, shell_command_projection_cjs_1.execTool)('python3', [
+            '-c',
+            'from importlib.metadata import version; print(version("graphifyy"))',
+        ], { timeout: 5000 });
+        pyPackageConfirmed = !pyVerify.error && pyVerify.exitCode === 0 && !!pyVerify.stdout;
+    }
     if (!versionStr) {
         return { version: null, compatible: null, warning: 'Could not determine graphify version' };
     }
@@ -120,9 +146,19 @@ function checkGraphifyVersion() {
     if (parts.length < 2 || parts.some(isNaN)) {
         return { version: versionStr, compatible: null, warning: 'Could not parse version: ' + versionStr };
     }
-    const compatible = parts[0] === 0 && parts[1] >= 4;
-    const warning = compatible ? null : 'graphify version ' + versionStr + ' is outside tested range >=0.4.0,<1.0';
-    return { version: versionStr, compatible, warning };
+    const versionInRange = parts[0] === 0 && parts[1] >= 4;
+    // #3020: if the `graphify` binary answered --version but the Python package
+    // graphifyy could not be confirmed, the tool identity is unverified — emit
+    // a warning naming the mismatch regardless of version-range compatibility.
+    if (!pyPackageConfirmed) {
+        return {
+            version: versionStr,
+            compatible: false,
+            warning: 'graphify version ' + versionStr + ' detected but the graphifyy Python package could not be confirmed — the `graphify` binary on PATH may be a different tool. Verify with: pip show graphifyy',
+        };
+    }
+    const warning = versionInRange ? null : 'graphify version ' + versionStr + ' is outside tested range >=0.4.0,<1.0';
+    return { version: versionStr, compatible: versionInRange, warning };
 }
 /**
  * Safely read and parse a JSON file. Returns null on missing file or parse error.
@@ -195,41 +231,118 @@ function seedAndExpand(graph, term, maxHops = 2) {
     const resultNodes = [...visitedNodes].map(id => nodeMap[id]).filter((n) => Boolean(n));
     return { nodes: resultNodes, edges: collectedEdges, seeds: new Set(seeds.map(n => n.id)) };
 }
+/**
+ * The single definition of `graphifyQuery`'s wire shape.
+ *
+ * Both the emitter (`graphifyQuery`'s return) and the budget estimator go
+ * through here, so `budget_estimate` measures the object the caller actually
+ * receives rather than a private approximation of it (#2738).
+ */
+function buildQueryResponse(term, core) {
+    return {
+        term,
+        nodes: core.nodes,
+        edges: core.edges,
+        total_nodes: core.nodes.length,
+        total_edges: core.edges.length,
+        trimmed: core.trimmed,
+        // Budget outcome (#2738) — only present when a budget was requested
+        ...(core.budget ? { budget_met: core.budget.met, budget_estimate: core.budget.estimate } : {}),
+    };
+}
 /**
  * Apply token budget by dropping edges by confidence tier (D-04, D-05, D-06).
- * Token estimation: Math.ceil(JSON.stringify(obj).length / 4).
  * Drop order: AMBIGUOUS -> INFERRED -> EXTRACTED.
+ *
+ * The estimate measures the response **as emitted** — `serializeForOutput()`
+ * over the same object `graphifyQuery` returns, pretty-printed and including
+ * the wrapper keys. Measuring a compact `{nodes, edges}` instead understates
+ * the payload the caller receives, which makes `budget_met` a confident claim
+ * about a payload nobody is handed (#2738).
+ *
+ * `term` participates in the emitted bytes, so it is threaded through; the
+ * default keeps direct unit calls on the same wire shape, minus those bytes.
  */
-function applyBudget(result, budgetTokens) {
-    if (!budgetTokens)
+function applyBudget(result, budgetTokens, term = '') {
+    // == null (not truthiness): --budget 0 is a valid parsed budget the router
+    // forwards, and treating it as "no budget" silently returns the unbounded
+    // result — the same silent-non-application defect class as #974/#2738.
+    //
+    // Number.isFinite additionally keeps NaN out of the comparisons below, where
+    // every `estimate <= NaN` is false: the loop would strip all three tiers and
+    // return a seeds-only payload indistinguishable from a legitimate aggressive
+    // trim. The CLI cannot reach that state — graphify-command-router rejects a
+    // non-numeric --budget before this is called — but graphifyQuery and
+    // applyBudget are module-level entry points a future caller could reach
+    // without that validation. Infinity routes here too, and deliberately: an
+    // unbounded budget is not a budget.
+    if (budgetTokens == null || !Number.isFinite(budgetTokens))
         return result;
     const CONFIDENCE_ORDER = ['AMBIGUOUS', 'INFERRED', 'EXTRACTED'];
     let edges = [...result.edges];
     let omitted = 0;
-    const estimateTokens = (obj) => Math.ceil(JSON.stringify(obj).length / 4);
+    // Nodes that survive a given edge set: edge-reachable, plus seeds (always kept)
+    const survivingNodes = (edgeSet) => {
+        const reachableNodes = new Set();
+        for (const edge of edgeSet) {
+            reachableNodes.add(edge.source);
+            reachableNodes.add(edge.target);
+        }
+        return result.nodes.filter(n => reachableNodes.has(n.id) || (result.seeds && result.seeds.has(n.id)));
+    };
+    const trimmedLabel = (dropped, unreachable) => dropped > 0 ? `[${dropped} edges omitted, ${unreachable} nodes unreachable]` : null;
+    /**
+     * Tokens of the response as `output()` will emit it.
+     *
+     * Self-referential by construction: `budget_estimate` is itself one of the
+     * emitted fields, so its own digit width counts toward the total. Resolved by
+     * iterating to a fixed point — the sequence is non-decreasing (a wider number,
+     * and `false` over `true`, can only add characters), so it settles in a couple
+     * of passes. The cap is a guard rather than an expectation, and it exits on the
+     * larger value: over-reporting is the safe direction for a budget signal;
+     * under-reporting is the defect this fixes.
+     */
+    const wireEstimate = (candidateNodes, candidateEdges, trimmed) => {
+        let est = 0;
+        for (let i = 0; i < 8; i++) {
+            const next = estimateTokens(serializeForOutput(buildQueryResponse(term, {
+                nodes: candidateNodes,
+                edges: candidateEdges,
+                trimmed,
+                budget: { met: est <= budgetTokens, estimate: est },
+            })));
+            if (next === est)
+                break;
+            est = next;
+        }
+        return est;
+    };
+    // Estimate against the post-pruning node set after each tier removal, so a
+    // removal that already fits (once orphaned nodes are excluded) stops the loop
+    // instead of dropping the next, higher-confidence tier too (#2738).
+    let nodes = survivingNodes(edges);
+    let estimate = wireEstimate(nodes, edges, trimmedLabel(omitted, result.nodes.length - nodes.length));
     for (const tier of CONFIDENCE_ORDER) {
-        if (estimateTokens({ nodes: result.nodes, edges }) <= budgetTokens)
+        if (estimate <= budgetTokens)
             break;
         const before = edges.length;
         // Check both confidence and confidence_score field names (Open Question 1)
         edges = edges.filter(e => (e.confidence || e.confidence_score) !== tier);
         omitted += before - edges.length;
+        nodes = survivingNodes(edges);
+        estimate = wireEstimate(nodes, edges, trimmedLabel(omitted, result.nodes.length - nodes.length));
     }
-    // Find unreachable nodes after edge removal
-    const reachableNodes = new Set();
-    for (const edge of edges) {
-        reachableNodes.add(edge.source);
-        reachableNodes.add(edge.target);
-    }
-    // Always keep seed nodes
-    const nodes = result.nodes.filter(n => reachableNodes.has(n.id) || (result.seeds && result.seeds.has(n.id)));
     const unreachable = result.nodes.length - nodes.length;
     return {
         nodes,
         edges,
-        trimmed: omitted > 0 ? `[${omitted} edges omitted, ${unreachable} nodes unreachable]` : null,
+        trimmed: trimmedLabel(omitted, unreachable),
         total_nodes: nodes.length,
         total_edges: edges.length,
+        // Seeds are retained unconditionally, so the seed set is a floor the
+        // reduction cannot go below — report the outcome instead of hiding a miss (#2738)
+        budget_met: estimate <= budgetTokens,
+        budget_estimate: estimate,
     };
 }
 // ─── Public API ──────────────────────────────────────────────────────────────
@@ -303,17 +416,19 @@ function graphifyQuery(cwd, term, options = {}) {
         return { error: 'Failed to parse graph.json' };
     }
     let result = seedAndExpand(graph, term);
-    if (options.budget) {
-        result = applyBudget(result, options.budget);
+    if (options.budget != null) {
+        result = applyBudget(result, options.budget, term);
     }
-    return {
-        term,
+    // Same builder the estimator measured, so budget_estimate describes exactly
+    // these bytes (#2738).
+    return buildQueryResponse(term, {
         nodes: result.nodes,
         edges: result.edges,
-        total_nodes: result.nodes.length,
-        total_edges: result.edges.length,
         trimmed: 'trimmed' in result ? (result.trimmed || null) : null,
-    };
+        budget: 'budget_met' in result
+            ? { met: result.budget_met, estimate: result.budget_estimate }
+            : undefined,
+    });
 }
 /**
  * Return status information about the knowledge graph (STAT-01, STAT-02).

package/gsd-core/bin/lib/gsd2-import.cjs

@@ -27,9 +27,15 @@ const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 const clock_cjs_1 = require("./clock.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- core-utils.cjs is an export= CommonJS module
+const coreUtilsMod = require("./core-utils.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- frontmatter.cjs is an export= CommonJS module
+const frontmatterMod = require("./frontmatter.cjs");
 const { output } = ioMod;
+const { transliterateForSlug } = coreUtilsMod;
+const { stripFrontmatter } = frontmatterMod;
 // ─── Utilities ──────────────────────────────────────────────────────────────
 function readOptional(filePath) {
     try {
@@ -43,7 +49,11 @@ function zeroPad(n, width = 2) {
     return String(n).padStart(width, '0');
 }
 function slugify(title) {
-    return title.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+    // #2848: transliterate Cyrillic to ASCII before the filter so a non-Latin
+    // title does not collapse to an empty slug. The shared primitive keeps this
+    // in sync with generateSlugInternal. slugify's DISTINCT contract is preserved:
+    // single leading/trailing hyphen strip (/^-|-$/), and NO 60-char truncation.
+    return transliterateForSlug(title).replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
 }
 // ─── GSD-2 Parser ───────────────────────────────────────────────────────────
 /**
@@ -218,9 +228,22 @@ function buildPlanMd(task, phasePrefix, planPrefix, phaseSlug, milestoneTitle) {
  */
 function buildSummaryMd(task, phasePrefix, planPrefix) {
     const raw = task.summary || '';
-    // Strip GSD-2 frontmatter block (--- ... ---) if present
-    const bodyMatch = raw.match(/^---[\s\S]*?---\n+([\s\S]*)$/);
-    const body = bodyMatch ? bodyMatch[1].trim() : raw.trim();
+    // Strip the GSD-2 frontmatter block via the canonical primitive (#2703). The
+    // previous local regex required a bare `\n` after the closing `---`, so a
+    // CRLF-authored summary never matched, fell through to the untouched-raw
+    // branch, and had its frontmatter emitted a second time inside the body of
+    // the document this function then wrapped in a fresh v1 block.
+    //
+    // `extractFrontmatter` — which the issue names — returns only the parsed
+    // object and never the body, so it cannot serve this call site;
+    // `stripFrontmatter` is the same module's canonical body primitive.
+    //
+    // `once` is load-bearing. A GSD-2 summary is an arbitrary user-authored
+    // document, not a GSD artefact with a known frontmatter-doubling failure
+    // mode, so a body opening with a thematic-break-delimited section
+    // (`---` / heading / `---`) is far likelier than a corrupt second header —
+    // and the default greedy loop would delete it without a trace.
+    const body = stripFrontmatter(raw, { once: true }).trim();
     return [
         '---',
         `phase: "${phasePrefix}"`,

package/gsd-core/bin/lib/host-integration.cjs

@@ -464,8 +464,20 @@ function negotiateHostCapabilities(host, engine = DEFAULT_ENGINE) {
 function shouldFlattenDispatch(dispatch) {
     if (!dispatch || typeof dispatch !== 'object')
         return true;
+    // Can background at all: both background flags must be explicitly true.
     const canBackground = dispatch.background === true && dispatch.backgroundDispatch === true;
-    return !canBackground;
+    if (!canBackground)
+        return true;
+    // #2939: can background a NESTING orchestrator with room to delegate. A depth budget of 1
+    // is consumed by the backgrounded orchestrator itself; it needs > 1 (or unbounded, maxDepth < 0)
+    // to host a delegated leaf at depth 2. Non-finite/missing maxDepth fails closed (no budget →
+    // flatten), mirroring degradationFor's treatment of non-finite depth as 0.
+    const canNest = dispatch.nested === true && dispatch.subagentToolkit === 'full';
+    if (!canNest)
+        return true;
+    const depth = typeof dispatch.maxDepth === 'number' && Number.isFinite(dispatch.maxDepth) ? dispatch.maxDepth : 0;
+    const depthSufficient = depth < 0 || depth > 1;
+    return !depthSufficient;
 }
 // ---------------------------------------------------------------------------
 // resolveDispatchType — ADR-1239 / epic #2505 Phase 4 (Option A)

package/gsd-core/bin/lib/init-command-router.cjs

@@ -29,32 +29,107 @@ function routeInitCommand({ init, args, cwd, raw, error }) {
         error,
         unknownMessage: (_subcommand, available) => `Unknown init workflow: ${_subcommand}\nAvailable: ${available.join(', ')}`,
         handlers: {
+            // #2932/#2992: `parseNamedArgs` never yields `undefined` for an absent
+            // flag (value-flags default to `null`, booleanFlags default to `false`);
+            // `buildSectionManifestField`'s flags-Set builder (src/init.cts) is the
+            // single source of truth for flag ABSENCE and gates on value truthiness,
+            // so `namedArgs` is passed through here uncoerced.
             'execute-phase': () => {
-                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['validate', 'tdd']);
-                init.cmdInitExecutePhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'] });
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['validate', 'tdd', 'wave']);
+                init.cmdInitExecutePhase(cwd, args[2], raw, {
+                    validate: namedArgs['validate'],
+                    tdd: namedArgs['tdd'],
+                    wave: namedArgs['wave'],
+                });
             },
             'plan-phase': () => {
-                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, ['granularity'], ['validate', 'tdd']);
-                init.cmdInitPlanPhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'], granularity: namedArgs['granularity'] });
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, ['granularity', 'prd', 'ingest', 'research-phase'], ['validate', 'tdd', 'reviews', 'chunked']);
+                init.cmdInitPlanPhase(cwd, args[2], raw, {
+                    validate: namedArgs['validate'],
+                    tdd: namedArgs['tdd'],
+                    granularity: namedArgs['granularity'],
+                    prd: namedArgs['prd'],
+                    ingest: namedArgs['ingest'],
+                    'research-phase': namedArgs['research-phase'],
+                    reviews: namedArgs['reviews'],
+                    chunked: namedArgs['chunked'],
+                });
+            },
+            'new-project': () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['auto']);
+                init.cmdInitNewProject(cwd, raw, { auto: namedArgs['auto'] });
+            },
+            'new-milestone': () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['reset-phase-numbers']);
+                init.cmdInitNewMilestone(cwd, raw, {
+                    'reset-phase-numbers': namedArgs['reset-phase-numbers'],
+                });
             },
-            'new-project': () => init.cmdInitNewProject(cwd, raw),
-            'new-milestone': () => init.cmdInitNewMilestone(cwd, raw),
             onboard: () => {
                 const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['fast', 'text']);
                 init.cmdInitOnboard(cwd, raw, { fast: namedArgs['fast'], text: namedArgs['text'] });
             },
-            quick: () => init.cmdInitQuick(cwd, args.slice(2).join(' '), raw),
+            quick: () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['discuss', 'research', 'validate', 'full']);
+                // #2994: `args.slice(2)` is the free-text description, but section-manifest
+                // gating (buildSectionManifestField, src/init.cts) now requires forwarding
+                // --discuss/--research/--validate/--full alongside it — a plain `.join(' ')`
+                // would otherwise fold those recognized flag tokens straight into the
+                // description text. Strip them before joining so the description stays
+                // exactly what it was before this workflow started forwarding flags.
+                const quickFlagTokens = new Set(['--discuss', '--research', '--validate', '--full']);
+                const description = args
+                    .slice(2)
+                    .filter((token) => !quickFlagTokens.has(token))
+                    .join(' ');
+                init.cmdInitQuick(cwd, description, raw, {
+                    discuss: namedArgs['discuss'],
+                    research: namedArgs['research'],
+                    validate: namedArgs['validate'],
+                    full: namedArgs['full'],
+                });
+            },
             'ingest-docs': () => init.cmdInitIngestDocs(cwd, raw),
             resume: () => init.cmdInitResume(cwd, raw),
             'verify-work': () => init.cmdInitVerifyWork(cwd, args[2], raw),
             'phase-op': () => init.cmdInitPhaseOp(cwd, args[2], raw),
+            'code-review': () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['fix']);
+                init.cmdInitCodeReview(cwd, args[2], raw, { fix: namedArgs['fix'] });
+            },
+            review: () => init.cmdInitReview(cwd, args[2], raw, {}),
+            'discuss-phase-assumptions': () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['auto']);
+                init.cmdInitDiscussPhaseAssumptions(cwd, args[2], raw, { auto: namedArgs['auto'] });
+            },
             todos: () => init.cmdInitTodos(cwd, args[2], raw),
             'milestone-op': () => init.cmdInitMilestoneOp(cwd, raw),
             'map-codebase': () => init.cmdInitMapCodebase(cwd, raw),
-            progress: () => init.cmdInitProgress(cwd, raw),
+            progress: () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['forensic']);
+                init.cmdInitProgress(cwd, raw, { forensic: namedArgs['forensic'] });
+            },
             // Keep manager on CJS for now so runtime-specific command rendering
             // (e.g. $gsd-* for codex) stays consistent with runtime-slash helpers.
             manager: () => init.cmdInitManager(cwd, raw),
+            'complete-milestone': () => init.cmdInitCompleteMilestone(cwd, raw),
+            autonomous: () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['converge', 'cross-ai']);
+                init.cmdInitAutonomous(cwd, raw, {
+                    converge: namedArgs['converge'],
+                    'cross-ai': namedArgs['cross-ai'],
+                });
+            },
+            'docs-update': () => init.cmdInitDocsUpdate(cwd, raw, {}),
+            update: () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['next', 'rc']);
+                init.cmdInitUpdate(cwd, raw, { next: namedArgs['next'], rc: namedArgs['rc'] });
+            },
+            transition: () => init.cmdInitTransition(cwd, raw, {}),
+            debug: () => {
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['diagnose']);
+                init.cmdInitDebug(cwd, raw, { diagnose: namedArgs['diagnose'] });
+            },
             'new-workspace': () => init.cmdInitNewWorkspace(cwd, raw),
             'list-workspaces': () => init.cmdInitListWorkspaces(cwd, raw),
             'remove-workspace': () => init.cmdInitRemoveWorkspace(cwd, args[2], raw),