@opengsd/gsd-pi 1.1.1-dev.3ea310e → 1.1.1-dev.595401e

package/src/resources/extensions/gsd/unit-context-manifest.ts

@@ -137,7 +137,9 @@ export type ContextModePolicy =
  *                    edits project markdown outside .gsd/.
  *   - "verification"
  *                  — Read tools + Bash for verification commands, writes
- *                    restricted to .gsd/**, no subagents.
+ *                    restricted to .gsd/**. Subagent dispatch is denied unless
+ *                    `allowedSubagents` opts a unit into controlled read-only
+ *                    specialist delegation.
  *
  * The allowlist for "docs" is declared per-manifest rather than hardcoded so
  * projects with non-standard doc layouts can extend it without forking the
@@ -150,7 +152,7 @@ export type ToolsPolicy =
   | { readonly mode: "planning" }
   | { readonly mode: "planning-dispatch"; readonly allowedSubagents: readonly string[] }
   | { readonly mode: "docs"; readonly allowedPathGlobs: readonly string[] }
-  | { readonly mode: "verification" };
+  | { readonly mode: "verification"; readonly allowedSubagents?: readonly string[] };
 
 // ─── Computed-artifact registry (#4924 v2 contract) ───────────────────────
 
@@ -305,6 +307,10 @@ const COMMON_BUDGET_SMALL = 250_000;    // ~65K tokens
 const TOOLS_ALL: ToolsPolicy = { mode: "all" };
 const TOOLS_PLANNING: ToolsPolicy = { mode: "planning" };
 const TOOLS_VERIFICATION: ToolsPolicy = { mode: "verification" };
+const TOOLS_VERIFICATION_DISPATCH_UAT: ToolsPolicy = {
+  mode: "verification",
+  allowedSubagents: ["mnemo", "scout", "reviewer", "tester"],
+};
 // Like TOOLS_PLANNING but permits dispatch to read-only recon/planning
 // specialists. Runtime-enforced by write-gate.ts before the subagent tool runs.
 const TOOLS_PLANNING_DISPATCH_RECON: ToolsPolicy = {
@@ -601,7 +607,7 @@ export const UNIT_MANIFESTS: Record<UnitType, UnitContextManifest> = {
     codebaseMap: false,
     preferences: "active-only",
     contextMode: "verification",
-    tools: TOOLS_VERIFICATION,
+    tools: TOOLS_VERIFICATION_DISPATCH_UAT,
     artifacts: {
       inline: ["slice-uat"],
       excerpt: ["slice-summary"],
@@ -792,9 +798,12 @@ export function compileSubagentPermissionContract(
   if (policy.mode === "all") {
     return { allowed: true, allowedSubagents: ["*"], toolsMode: policy.mode };
   }
-  if (policy.mode === "planning-dispatch") {
+  if (
+    (policy.mode === "planning-dispatch" || policy.mode === "verification") &&
+    Array.isArray(policy.allowedSubagents)
+  ) {
     return {
-      allowed: true,
+      allowed: policy.allowedSubagents.length > 0,
       allowedSubagents: [...policy.allowedSubagents],
       toolsMode: policy.mode,
     };

package/src/resources/extensions/gsd/validation-block-guard.ts

@@ -14,6 +14,8 @@ const VALIDATION_BLOCK_RE =
   /milestone validation returned needs-(?:attention|remediation)|validation verdict is needs-(?:attention|remediation)/i;
 
 const VALIDATION_SAFE_DISPATCH_COMMANDS = new Set([
+  "reassess",
+  "reassess-roadmap",
   "validate",
   "validate-milestone",
 ]);

package/src/resources/extensions/gsd/verdict-parser.ts

@@ -7,9 +7,60 @@
 
 import { extractUatType } from "./files.js";
 import type { UatType } from "./files.js";
+import { splitFrontmatter, parseFrontmatterMap } from "../shared/frontmatter.js";
+import { parse as parseYaml } from "yaml";
+
+function normalizeVerdict(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  let verdict = value.trim().toLowerCase();
+  if (!verdict) return undefined;
+  if (verdict === "passed") verdict = "pass";
+  return verdict;
+}
+
+function getCaseInsensitive(obj: Record<string, unknown>, key: string): unknown {
+  const lowerKey = key.toLowerCase();
+  for (const [candidate, value] of Object.entries(obj)) {
+    if (candidate.toLowerCase() === lowerKey) return value;
+  }
+  return undefined;
+}
 
 // ── Verdict extraction ──────────────────────────────────────────────────
 
+/**
+ * Extract and normalize the frontmatter `verdict` value.
+ *
+ * Supports both top-level `verdict` and the hook outcome shape
+ * `outcome.verdict`. Returns `undefined` when frontmatter is absent or has no
+ * verdict field.
+ */
+export function extractFrontmatterVerdict(content: string): string | undefined {
+  const [frontmatterLines] = splitFrontmatter(content);
+  if (!frontmatterLines) return undefined;
+
+  try {
+    const parsed = parseYaml(frontmatterLines.join("\n")) as unknown;
+    if (parsed && typeof parsed === "object") {
+      const root = parsed as Record<string, unknown>;
+      const topLevel = normalizeVerdict(getCaseInsensitive(root, "verdict"));
+      if (topLevel) return topLevel;
+      const outcome = getCaseInsensitive(root, "outcome");
+      if (outcome && typeof outcome === "object") {
+        const nested = normalizeVerdict(getCaseInsensitive(outcome as Record<string, unknown>, "verdict"));
+        if (nested) return nested;
+      }
+    }
+  } catch {
+    // Fall through to the permissive parser used by legacy frontmatter paths.
+  }
+
+  const frontmatter = parseFrontmatterMap(frontmatterLines);
+  const topLevel = normalizeVerdict(getCaseInsensitive(frontmatter, "verdict"));
+  if (topLevel) return topLevel;
+  return undefined;
+}
+
 /**
  * Extract and normalize the `verdict` value from YAML frontmatter.
  *
@@ -21,24 +72,14 @@ import type { UatType } from "./files.js";
  */
 export function extractVerdict(content: string): string | undefined {
   // Primary: YAML frontmatter verdict (canonical format)
-  const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
-  if (fmMatch) {
-    const verdictMatch = fmMatch[1].match(/verdict:\s*([\w-]+)/i);
-    if (verdictMatch) {
-      let v = verdictMatch[1].toLowerCase();
-      if (v === "passed") v = "pass";
-      return v;
-    }
-    return undefined;
-  }
+  const [frontmatterLines] = splitFrontmatter(content);
+  if (frontmatterLines) return extractFrontmatterVerdict(content);
 
   // Fallback: detect verdict in markdown body (LLM manual writes, #2960).
   // Matches patterns like: **Verdict:** PASS, **Verdict:** ✅ PASS, **Verdict** needs-remediation
   const bodyMatch = content.match(/\*\*Verdict:?\*\*\s*(?:✅\s*)?(\w[\w-]*)/i);
   if (bodyMatch) {
-    let v = bodyMatch[1].toLowerCase();
-    if (v === "passed") v = "pass";
-    return v;
+    return normalizeVerdict(bodyMatch[1]);
   }
 
   return undefined;

package/src/resources/extensions/gsd/verification-gate.ts

@@ -295,6 +295,90 @@ function hasUnsafeShellSyntax(cmd: string): boolean {
   return false;
 }
 
+function splitLeadingShellWords(cmd: string): string[] {
+  const words: string[] = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  let escaped = false;
+
+  for (let i = 0; i < cmd.length; i += 1) {
+    const ch = cmd[i];
+
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+
+    if (ch === "\\" && !inSingle) {
+      escaped = true;
+      continue;
+    }
+
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+
+    if (ch === "\"" && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+
+    if (!inSingle && !inDouble) {
+      if (/\s/.test(ch)) {
+        if (current) {
+          words.push(current);
+          current = "";
+        }
+        continue;
+      }
+
+      if ([";", "|", "&", "<", ">"].includes(ch)) {
+        break;
+      }
+    }
+
+    current += ch;
+  }
+
+  if (current) {
+    words.push(current);
+  }
+
+  return words;
+}
+
+function isCountFlag(token: string): boolean {
+  return (
+    token === "--count" ||
+    token.startsWith("--count=") ||
+    token === "--count-matches" ||
+    token.startsWith("--count-matches=") ||
+    /^-[A-Za-z]*c[A-Za-z]*$/.test(token)
+  );
+}
+
+function countSearchWarning(command: string, exitCode: number): string | null {
+  if (exitCode !== 1) return null;
+
+  const trimmed = command.trim();
+  if (trimmed.startsWith("!")) return null;
+
+  const [tool, ...args] = splitLeadingShellWords(trimmed);
+  if (tool !== "grep" && tool !== "rg") return null;
+  if (!args.some(isCountFlag)) return null;
+
+  return `verification-gate: warning: '${tool} -c' returns exit 1 when count=0; for absence checks use '! ${tool} -q ...' instead.`;
+}
+
+function appendStderrWarning(stderr: string, warning: string | null): string {
+  if (!warning) return stderr;
+  const trimmed = stderr.trimEnd();
+  return trimmed ? `${trimmed}\n${warning}` : warning;
+}
+
 /**
  * Known executable first-tokens that are safe to run.
  * Lowercase commands, common build/test tools, and npm/yarn/pnpm invocations.
@@ -486,11 +570,13 @@ export function runVerificationGate(options: RunVerificationGateOptions): Verifi
       stderr = truncate(result.stderr, MAX_OUTPUT_BYTES);
     }
 
+    const warning = countSearchWarning(command, exitCode);
+
     checks.push({
       command,
       exitCode,
       stdout: truncate(result.stdout, MAX_OUTPUT_BYTES),
-      stderr,
+      stderr: truncate(appendStderrWarning(stderr, warning), MAX_OUTPUT_BYTES),
       durationMs,
     });
   }

package/src/resources/extensions/gsd/workflow-mcp-auto-prep.ts

@@ -73,7 +73,7 @@ export function prepareWorkflowMcpForProject(
   try {
     const result = ensureProjectWorkflowMcpConfig(projectRoot);
     if (result.status !== "unchanged") {
-      prepCtx.ui?.notify?.(`Claude Code MCP prepared at ${result.configPath}`, "info");
+      prepCtx.ui?.notify?.(`GSD MCP Server Prepared at ${result.configPath}`, "info");
     }
     return result;
   } catch (err) {

package/src/resources/extensions/gsd/workflow-mcp.ts

@@ -2,6 +2,7 @@ import { execSync } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
 import { dirname, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { RUN_UAT_WORKFLOW_TOOL_NAMES } from "./tool-presentation-plan.js";
 
 type WorkflowExecutorsModule = typeof import("./tools/workflow-tool-executors.js");
 
@@ -100,6 +101,8 @@ const MCP_WORKFLOW_TOOL_SURFACE = new Set([
   "gsd_task_complete",
   "gsd_task_reopen",
   "gsd_update_requirement",
+  "gsd_uat_exec",
+  "gsd_uat_result_save",
   "gsd_validate_milestone",
 ]);
 
@@ -462,8 +465,9 @@ export function getRequiredWorkflowToolsForAutoUnit(unitType: string): string[]
       ];
     case "research-milestone":
     case "research-slice":
-    case "run-uat":
       return ["gsd_summary_save"];
+    case "run-uat":
+      return [...RUN_UAT_WORKFLOW_TOOL_NAMES];
     case "plan-milestone":
       return ["gsd_plan_milestone"];
     case "plan-slice":