@opengsd/gsd-path 1.3.1 → 1.5.0

package/scripts/state_checkpoint.py

@@ -17,12 +17,15 @@ from datetime import date
 from pathlib import Path, PurePosixPath
 from typing import Mapping, Optional, Sequence
 
-try:
-    from isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
-except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
-    if error.name != "isolation":
-        raise
-    from scripts.isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
+if __package__:
+    from .isolation import IsolationError, checkpoint as isolation_checkpoint, PROJECT_ENTRIES
+else:
+    try:
+        from isolation import IsolationError, checkpoint as isolation_checkpoint, PROJECT_ENTRIES
+    except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
+        if error.name != "isolation":
+            raise
+        from scripts.isolation import IsolationError, checkpoint as isolation_checkpoint, PROJECT_ENTRIES
 
 
 if __package__:
@@ -66,6 +69,11 @@ def _sha256(content: str) -> str:
     return hashlib.sha256(content.encode("utf-8")).hexdigest()
 
 
+def _is_junk_file(path: Path) -> bool:
+    # Drift digests skip OS junk by name: Finder rewrites it whatever its ignore status.
+    return path.name in pipeline_state._common.OS_JUNK_NAMES and path.is_file() and not path.is_symlink()
+
+
 def _tree_digest(path: Path, excluded: Sequence[str] = ()) -> str:
     if path.is_symlink() or not path.is_dir():
         raise PipelineStateError(f"promotion path must be a real directory: {path}")
@@ -74,7 +82,7 @@ def _tree_digest(path: Path, excluded: Sequence[str] = ()) -> str:
         if child.is_symlink():
             raise PipelineStateError(f"promotion path contains a symlink: {child}")
         relative = child.relative_to(path).as_posix()
-        if PurePosixPath(relative).parts[0] in excluded:
+        if PurePosixPath(relative).parts[0] in excluded or _is_junk_file(child):
             continue
         if child.is_dir():
             digest.update(f"d\0{relative}\0".encode())
@@ -87,15 +95,15 @@ def _tree_digest(path: Path, excluded: Sequence[str] = ()) -> str:
 
 
 def _checkpoint_artifact_digest(project: Path, mutable_paths: set[str]) -> str:
-    """Hash every approval artifact except the helper-owned metadata files."""
+    """Hash approval artifacts except helper-owned metadata and OS junk."""
     digest = hashlib.sha256()
     for child in sorted(project.rglob("*")):
         if child.is_symlink():
             raise PipelineStateError(f"checkpoint path contains a symlink: {child}")
         relative = child.relative_to(project).as_posix()
-        # Unsupported entries (OS junk) are refused by the checkpoint itself; leaving them
-        # out lets a refused approval resume after the owner removes them.
-        if relative in mutable_paths or relative.split("/", 1)[0] not in PROJECT_ENTRIES:
+        # Finder can rewrite OS junk during approval; it must not cause artifact drift.
+        if (relative in mutable_paths or relative.split("/", 1)[0] not in PROJECT_ENTRIES
+                or _is_junk_file(child)):
             continue
         if child.is_dir():
             digest.update(f"d\0{relative}\0".encode())
@@ -333,11 +341,7 @@ def _converge_checkpoint_file(path: Path, before: str, after: str, label: str) -
 
 def _unlink_checkpoint_journal(path: Path) -> None:
     path.unlink()
-    descriptor = os.open(path.parent, os.O_RDONLY)
-    try:
-        os.fsync(descriptor)
-    finally:
-        os.close(descriptor)
+    pipeline_state._common.fsync_directory(path.parent)
 
 
 def _resume_checkpoint_locked(
@@ -439,41 +443,85 @@ def _validate_plan_briefs(repo: Path, kind: str, project_dir: str) -> None:
     if head.returncode != 0:
         # Pre-Git approval defers base-dependent checks to build.
         return
+    if __package__:
+        from .check_task_briefs import BriefError, _member_bases, plan_validation_bases, validate_task_briefs
+    else:
+        try:
+            from check_task_briefs import BriefError, _member_bases, plan_validation_bases, validate_task_briefs
+        except ModuleNotFoundError as error:  # pragma: no cover - package imports
+            if error.name != "check_task_briefs":
+                raise
+            from scripts.check_task_briefs import BriefError, _member_bases, plan_validation_bases, validate_task_briefs
+    if __package__:
+        from . import check_handoffs
+    else:
+        try:
+            import check_handoffs
+        except ModuleNotFoundError as error:
+            if error.name != "check_handoffs":
+                raise
+            from scripts import check_handoffs
     try:
-        from check_task_briefs import BriefError, validate_task_briefs
-    except ModuleNotFoundError as error:  # pragma: no cover - package imports
-        if error.name != "check_task_briefs":
-            raise
-        from scripts.check_task_briefs import BriefError, validate_task_briefs
-    try:
-        import check_handoffs
-    except ModuleNotFoundError as error:
-        if error.name != "check_handoffs":
-            raise
-        from scripts import check_handoffs
-    try:
-        tasks, dependency_files = check_handoffs.plan_brief_inputs(repo, project_dir)
-        landed_bases = {}
-        for task_id, text in tasks.items():
-            if check_handoffs._task_scalar(text, task_id, "status") != "done":
-                continue
-            agent = check_handoffs._task_scalar(text, task_id, "agent")
-            if agent in {"", "null"}:
-                raise BriefError(f"{task_id} landed task has no recorded agent")
-            recorded_base = check_handoffs._task_scalar(text, task_id, "base")
-            try:
-                landed_bases[task_id] = require_commit(repo, require_full_sha(recorded_base))
-            except IsolationError as error:
-                raise BriefError(f"{task_id} landed task has invalid historical base: {error}") from error
-            dependency_files[task_id] = set()
+        member_base = _member_bases(repo)
+        tasks, dependency_files, landed_bases = plan_validation_bases(
+            repo, project_dir, member_base, initial=True
+        )
         validate_task_briefs(
             repo, head.stdout.strip(), f"{project_dir}/tasks",
             dependency_files=dependency_files, landed_bases=landed_bases,
+            member_base=member_base,
         )
+        if project_dir == ".project/next":
+            # Promotion checks lookahead member tasks from the bases their briefs were checked at.
+            named = {
+                str(check_handoffs._strict_frontmatter(text, task_id).get("repo"))
+                for task_id, text in tasks.items()
+                if check_handoffs._strict_frontmatter(text, task_id).get("repo")
+                and check_handoffs._task_scalar(text, task_id, "status") != "done"
+            }
+            if named:
+                bases = {name: member_base(name)[1] for name in sorted(named)}
+                milestone = pipeline_state.load_state(repo, project_dir)[0].milestone
+                path = _lookahead_member_bases_path(repo, str(milestone))
+                path.parent.mkdir(parents=True, exist_ok=True)
+                pipeline_state._common.atomic_write(path, json.dumps(
+                    {"schema": LOOKAHEAD_MEMBER_BASES_SCHEMA, "milestone": milestone, "bases": bases},
+                    indent=2, sort_keys=True) + "\n")
     except (BriefError, check_handoffs.HandoffError) as error:
         raise PipelineStateError(f"task brief validation failed: {error}") from error
 
 
+LOOKAHEAD_MEMBER_BASES_SCHEMA = "gsd-path/lookahead-member-bases/v1"
+
+
+def _lookahead_member_bases_path(repo: Path, milestone: str) -> Path:
+    common = pipeline_state._run_git(repo, "rev-parse", "--path-format=absolute", "--git-common-dir").stdout.strip()
+    return Path(common) / "gsd-path" / "lookahead-member-bases" / f"{milestone}.json"
+
+
+def _lookahead_member_bases(repo: Path, milestone: str) -> Optional[dict]:
+    path = _lookahead_member_bases_path(repo, milestone)
+    if not path.is_file():
+        return None
+    value = json.loads(path.read_text(encoding="utf-8"))
+    if value.get("schema") != LOOKAHEAD_MEMBER_BASES_SCHEMA or value.get("milestone") != milestone:
+        return None
+    return value.get("bases")
+
+
+def _shipped_member_merges(repo: Path, landing: str) -> dict:
+    """Member merges named by the ship commit the integration landing merged."""
+    if __package__:
+        from .pipeline_git import ship_member_rows
+    else:
+        from pipeline_git import ship_member_rows
+    ship = pipeline_state._run_git(repo, "rev-parse", "--verify", "--quiet", f"{landing}^2", check=False)
+    if ship.returncode != 0:
+        return {}
+    message = pipeline_state._run_git(repo, "show", "-s", "--format=%B", ship.stdout.strip()).stdout
+    return {row["name"]: row["merge"] for row in ship_member_rows(message)}
+
+
 def checkpoint_approval(
     repo: Path,
     kind: str,
@@ -1027,6 +1075,46 @@ def _classify_plan_drift(
         }
     approved = _approved_task_contracts(repo, checkpoint)
     current = _task_contracts_at(repo, revision)
+    if __package__:
+        from . import check_handoffs
+    else:
+        import check_handoffs
+    # Member task paths live in member repos: compare each member from the base its brief
+    # was checked at to the member merge the shipped milestone made (both fixed commits).
+    task_repos = {
+        task_id: str(check_handoffs._strict_frontmatter(contract.text, contract.path).get("repo") or "")
+        for task_id, contract in approved.items()
+    }
+    active_member_tasks = {
+        task_id for task_id, name in task_repos.items()
+        if name and check_handoffs._task_scalar(approved[task_id].text, task_id, "status") != "done"
+    }
+    active_members = {task_repos[task_id] for task_id in active_member_tasks}
+    member_changes: dict[str, list] = {}
+    if active_members:
+        bases = _lookahead_member_bases(repo, str(state.milestone)) or {}
+        if any(name not in bases for name in active_members):
+            return {
+                "class": "unverifiable",
+                "checkpoint": checkpoint,
+                "task_ids": [],
+                "changed_paths": [],
+                "contract_paths": [],
+                "member_tasks": True,
+                "reason": "member bases were not recorded at plan approval",
+            }
+        if __package__:
+            from . import members
+        else:
+            import members
+        checkouts = {item["name"]: Path(item["checkout"]) for item in members.read_members(repo)}
+        merges = _shipped_member_merges(repo, landing or revision)
+        for name in active_members:
+            member_changes[name] = [
+                item for item in pipeline_state._run_git(
+                    checkouts[name], "diff", "--no-renames", "--name-only", "-z", bases[name], merges[name]
+                ).stdout.split("\0") if item
+            ] if name in merges else []
 
     contract_paths: set[str] = set()
     flagged_ids: set[str] = set()
@@ -1050,9 +1138,12 @@ def _classify_plan_drift(
 
     product_paths: set[str] = set()
     for task_id, contract in approved.items():
+        member = task_repos.get(task_id)
+        if member and task_id not in active_member_tasks:
+            continue
         matches = sorted(
-            changed_path
-            for changed_path in changed
+            (f"{member}:{changed_path}" if member else changed_path)
+            for changed_path in (member_changes[member] if member else changed)
             if any(
                 changed_path == path
                 or changed_path.startswith(f"{path.rstrip('/')}/")

package/scripts/state_promote.py

@@ -82,6 +82,8 @@ def _promotion_event(
         if isinstance(task_ids, list) and task_ids:
             return f"{prefix}; plan drift flagged tasks {', '.join(task_ids)}"
         return f"{prefix}; plan contract changed after approval"
+    if drift_class == "unverifiable" and drift.get("member_tasks"):
+        return f"{prefix}; plan drift unverifiable because member bases were not recorded at plan approval"
     if drift_class == "unverifiable":
         return f"{prefix}; plan drift unverifiable because approval checkpoint is missing"
     return prefix

package/scripts/status_runtime.py

@@ -6,6 +6,7 @@ import hashlib
 import errno
 import json
 import os
+import stat
 import subprocess
 import sys
 import time
@@ -29,7 +30,7 @@ def process_identity(pid: int):
     else:
         command = ["ps", "-o", "lstart=", "-p", str(pid)]
     try:
-        result = subprocess.run(command, capture_output=True, text=True, check=False)
+        result = subprocess.run(command, capture_output=True, encoding="utf-8", errors="replace", check=False)
     except OSError:
         return None
     value = result.stdout.strip()
@@ -45,11 +46,39 @@ def runtime_identity(runtime: Path):
 
 
 def process_alive(pid: int) -> bool:
+    """Whether pid names a running process, without signalling it.
+
+    Windows os.kill(pid, 0) sends CTRL_C_EVENT, so Windows asks the kernel.
+    status_runtime and install carry verbatim copies (they cannot import this
+    module); tests/test_common_platform.py keeps them identical.
+    """
+    if pid <= 0:
+        return False
+    if os.name != "nt":
+        try:
+            os.kill(pid, 0)
+        except OSError as error:
+            return error.errno == errno.EPERM
+        return True
+    import ctypes
+    from ctypes import wintypes
+
+    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+    kernel32.OpenProcess.restype = wintypes.HANDLE
+    kernel32.OpenProcess.argtypes = (wintypes.DWORD, wintypes.BOOL, wintypes.DWORD)
+    kernel32.GetExitCodeProcess.argtypes = (wintypes.HANDLE, ctypes.POINTER(wintypes.DWORD))
+    kernel32.CloseHandle.argtypes = (wintypes.HANDLE,)
+    handle = kernel32.OpenProcess(0x1000, False, pid)  # PROCESS_QUERY_LIMITED_INFORMATION
+    if not handle:
+        # ERROR_ACCESS_DENIED: a protected process exists but refuses the query.
+        return ctypes.get_last_error() == 5
     try:
-        os.kill(pid, 0)
-    except OSError as error:
-        return error.errno == errno.EPERM
-    return True
+        code = wintypes.DWORD()
+        if not kernel32.GetExitCodeProcess(handle, ctypes.byref(code)):
+            return True
+        return code.value == 259  # STILL_ACTIVE
+    finally:
+        kernel32.CloseHandle(handle)
 
 
 def install_lock_active(lock: Path) -> bool:
@@ -123,7 +152,17 @@ def validate_runtime(data: dict) -> Path:
             path = root / name
             if path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest() != expected:
                 raise ValueError(f"runtime file changed: {name}")
-        if set(p.name for p in root.iterdir()) != set(files) | {"manifest.json"}:
+        runtime_entries = set()
+        for path in root.iterdir():
+            if path.name == "__pycache__":
+                if not stat.S_ISDIR(path.lstat().st_mode):
+                    raise ValueError("unexpected runtime files")
+                for cached in path.iterdir():
+                    if cached.suffix != ".pyc" or not stat.S_ISREG(cached.lstat().st_mode):
+                        raise ValueError("unexpected runtime files")
+                continue
+            runtime_entries.add(path.name)
+        if runtime_entries != set(files) | {"manifest.json"}:
             raise ValueError("unexpected runtime files")
     except (OSError, ValueError, TypeError) as error:
         raise ValueError(hint + f" ({error})") from error
@@ -139,8 +178,13 @@ def run_guard(repo: Path, name: str) -> None:
     root = resolve_runtime(repo)
     sys.dont_write_bytecode = True
     sys.path.insert(0, str(root))
-    code = compile((root / name).read_bytes(), str(root / name), "exec")
-    exec(code, {"__name__": "__main__", "__file__": str(repo / ".gsd-path" / name)})
+    previous_pycache_prefix = sys.pycache_prefix
+    sys.pycache_prefix = str(root / "manifest.json")
+    try:
+        code = compile((root / name).read_bytes(), str(root / name), "exec")
+        exec(code, {"__name__": "__main__", "__file__": str(repo / ".gsd-path" / name)})
+    finally:
+        sys.pycache_prefix = previous_pycache_prefix
 
 
 def launch(repo: Path) -> int:
@@ -151,7 +195,9 @@ def launch(repo: Path) -> int:
         except (OSError, ValueError) as error:
             print(str(error), file=sys.stderr)
             return 2
-        return subprocess.call([sys.executable, "-B", str(runtime), "status", "--repo", str(repo)],
+        return subprocess.call([sys.executable, "-B", "-X",
+                                f"pycache_prefix={runtime.parent / 'manifest.json'}",
+                                str(runtime), "status", "--repo", str(repo)],
                                env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"})
     runtime = parent / "runtime" / "pipeline_state.py"
     lock = repo / ".gsd-path-install-lock"
@@ -196,7 +242,9 @@ def main(argv: Sequence[str] = sys.argv[1:]) -> int:
         return 2
     if args.runtime_path:
         try:
-            print(resolve_runtime(args.repo.resolve()))
+            # Forward slashes: agents paste this into Git Bash on Windows, where
+            # unquoted backslashes are escapes.
+            print(resolve_runtime(args.repo.resolve()).as_posix())
             return 0
         except (OSError, ValueError) as error:
             print(str(error), file=sys.stderr)

package/scripts/sync_skill_resources.py

@@ -129,8 +129,8 @@ def divergence_warning(source: Path, destination: Path, root: Path) -> Optional[
     if destination.stat().st_mtime > source.stat().st_mtime:
         return (
             f"generated resource diverges from canonical and is newer "
-            f"(possible wrong-direction edit; edit {source.relative_to(root)} "
-            f"instead): {destination.relative_to(root)}"
+            f"(possible wrong-direction edit; edit {source.relative_to(root).as_posix()} "
+            f"instead): {destination.relative_to(root).as_posix()}"
         )
     return None
 
@@ -166,9 +166,9 @@ def mismatches(root: Path) -> Sequence[str]:
         problems.append("package.json files do not match manifest package_files")
     for source, destination in resource_pairs(root):
         if not source.is_file():
-            problems.append(f"missing canonical resource: {source.relative_to(root)}")
+            problems.append(f"missing canonical resource: {source.relative_to(root).as_posix()}")
         elif not destination.is_file():
-            problems.append(f"missing generated resource: {destination.relative_to(root)}")
+            problems.append(f"missing generated resource: {destination.relative_to(root).as_posix()}")
         else:
             try:
                 expected = materialized_resource_bytes(source, destination)
@@ -181,10 +181,10 @@ def mismatches(root: Path) -> Sequence[str]:
                     problems.append(warning)
                 else:
                     problems.append(
-                        f"stale generated resource: {destination.relative_to(root)}"
+                        f"stale generated resource: {destination.relative_to(root).as_posix()}"
                     )
     for path in package_metadata(root):
-        problems.append(f"unexpected package metadata: {path.relative_to(root)}")
+        problems.append(f"unexpected package metadata: {path.relative_to(root).as_posix()}")
     return problems
 
 
@@ -216,7 +216,8 @@ def synchronize(root: Path) -> int:
     package_path = root / "package.json"
     package = json.loads(package_path.read_text(encoding="utf-8"))
     package["files"] = list(PACKAGE_FILES)
-    package_path.write_text(json.dumps(package, indent=2) + "\n", encoding="utf-8")
+    # Bytes, so Windows text mode never writes CRLF.
+    package_path.write_bytes((json.dumps(package, indent=2) + "\n").encode("utf-8"))
     print(
         json.dumps(
             {

package/scripts/task_context.py

@@ -9,15 +9,17 @@ from pathlib import Path
 
 try:
     from scripts import check_handoffs as contracts
+    from scripts import _common
 except ImportError:
     import check_handoffs as contracts
+    import _common
 
 
 def render(repo: Path, task: Path) -> str:
     intent_path = repo.resolve() / '.project/intent/INTENT.md'
     task = task.resolve()
-    intent = intent_path.read_bytes().decode('utf-8')
-    task_text = task.read_bytes().decode('utf-8')
+    intent = _common.read_user_text(intent_path)
+    task_text = _common.read_user_text(task)
     owned = contracts._owned_criteria(task_text, task.stem)
     criteria = contracts._success_criteria(intent)
     unknown = set(owned) - set(criteria)
@@ -40,7 +42,14 @@ def render(repo: Path, task: Path) -> str:
         if simple:
             before, after = intent[:section.start('body')], intent[section.end('body'):]
             # Corrections and task interfaces can explicitly refer to another SC.
-            required = set(owned) | set(re.findall(r'\bSC\d+\b', before + after + task_text))
+            # The spec-probe tables name every SC by design, so they select nothing.
+            scanned = re.sub(r'(?ms)^## (?:Edge coverage|Prohibitions)[ \t]*\n.*?(?=^## |\Z)', '',
+                             before + after)
+            required = set(owned) | set(re.findall(r'\bSC\d+\b', scanned + task_text))
+            # An owned criterion's edge or prohibition ruled into another SC needs that SC's text.
+            for rows in (contracts.edge_coverage(intent, criteria), contracts.prohibitions(intent, criteria)):
+                required |= {row['target'] for row in (rows or {}).values()
+                             if row['target'] and row['criterion'] in owned}
             selected = ''.join(chunk for item, chunk in zip(items, chunks) if f'SC{item[1]}' in required)
             projected = before + '\n' + (selected or '- No criteria assigned.\n\n') + after
             mode = 'owned-criteria'

package/scripts/token_budget.py

@@ -10,12 +10,16 @@ import json
 import sys
 from pathlib import Path
 
-try:
-    from _common import atomic_write
-    from loop_run import log_lock
-except ModuleNotFoundError:  # pragma: no cover - package imports
-    from scripts._common import atomic_write
-    from scripts.loop_run import log_lock
+if __package__:
+    from ._common import atomic_write
+    from .loop_run import log_lock
+else:
+    try:
+        from _common import atomic_write
+        from loop_run import log_lock
+    except ModuleNotFoundError:  # pragma: no cover - package imports
+        from scripts._common import atomic_write
+        from scripts.loop_run import log_lock
 
 
 SCHEMA = "gsd-path/token-budget/v1"
@@ -97,14 +101,14 @@ def operate(args):
                       "task_limit": args.task_limit, "session_limit": args.session_limit,
                       "authority": args.authority}
             if ledger.exists():
-                data = json.loads(ledger.read_text())
+                data = json.loads(ledger.read_text(encoding="utf-8"))
                 if any(data.get(key) != value for key, value in policy.items()):
                     raise ValueError("existing session policy differs; configuration cannot reset usage")
             else:
                 data = {**policy, "observations": {}}
                 atomic_write(ledger, json.dumps(data, indent=2) + "\n")
             return {"status": "configured", "hard_cap_supported": False}
-        data = json.loads(ledger.read_text())
+        data = json.loads(ledger.read_text(encoding="utf-8"))
         if data.get("schema") != SCHEMA or data.get("host") != "codex-cli":
             raise ValueError("unsupported budget ledger")
         if args.action == "record":

package/scripts/wizard.mjs

@@ -15,6 +15,7 @@ export const HOST_LABELS = {
   zed: "Zed",
   kiro: "Kiro",
   kimi: "Kimi Code",
+  muse: "Muse Code",
 };
 
 // ponytail: hand-drawn block letters; no figlet dependency.