@opengsd/gsd-pi 1.1.1-dev.9f86580 → 1.1.1-dev.b2556262

package/src/resources/extensions/gsd/commands-maintenance.ts

@@ -481,6 +481,8 @@ export async function handleCleanupProjects(args: string, ctx: ExtensionCommandC
   ctx.ui.notify(lines.join("\n"), "info");
 }
 
+type HierarchyCounts = { milestones: number; slices: number; tasks: number };
+
 function recoverConfirmed(args: string): boolean {
   return args
     .split(/\s+/)
@@ -488,27 +490,82 @@ function recoverConfirmed(args: string): boolean {
     .some((part) => part === "--confirm" || part === "--yes" || part === "confirm");
 }
 
-async function confirmRecover(ctx: ExtensionCommandContext, args: string): Promise<boolean> {
-  if (recoverConfirmed(args)) return true;
+function recoverAllowsDataLoss(args: string): boolean {
+  return args
+    .split(/\s+/)
+    .map((part) => part.trim().toLowerCase())
+    .some((part) => part === "--allow-data-loss" || part === "--force");
+}
 
+async function confirmRecover(
+  ctx: ExtensionCommandContext,
+  args: string,
+  markdown: HierarchyCounts,
+  beforeDb: HierarchyCounts,
+  dataLoss: boolean,
+): Promise<boolean> {
   const warning = [
     "gsd recover imports markdown into the database.",
     "It clears and reconstructs milestone, slice, and task hierarchy rows from rendered markdown.",
     "Use /gsd rebuild markdown for normal DB-to-markdown realignment.",
-  ].join("\n");
+    "",
+    `  Markdown on disk: ${markdown.milestones}M/${markdown.slices}S/${markdown.tasks}T`,
+    `  Current DB:       ${beforeDb.milestones}M/${beforeDb.slices}S/${beforeDb.tasks}T`,
+  ];
+  if (dataLoss) {
+    warning.push(
+      "",
+      "⚠ The DB holds rows the markdown lacks. Recover will permanently DELETE",
+      "  those rows. A snapshot is written to .gsd/backups/ first, but if the DB",
+      "  is the source of truth you almost certainly want /gsd rebuild markdown.",
+    );
+  }
+  const warningText = warning.join("\n");
+
+  if (recoverConfirmed(args)) {
+    // Non-interactive --confirm still refuses a data-loss recover unless the
+    // caller explicitly opts in with --allow-data-loss / --force.
+    if (dataLoss && !recoverAllowsDataLoss(args)) {
+      ctx.ui.notify(
+        `${warningText}\n\nRefusing: this would delete authoritative DB rows. Re-run with ` +
+          `/gsd recover --confirm --allow-data-loss to proceed, or use /gsd rebuild markdown ` +
+          `to re-project markdown from the DB instead.`,
+        "error",
+      );
+      return false;
+    }
+    return true;
+  }
 
   if (typeof ctx.ui.confirm === "function") {
     const confirmed = await ctx.ui.confirm(
       "Import markdown into the DB?",
-      `${warning}\n\nContinue only if the DB is lost or corrupt and markdown is the source you intend to import.`,
+      `${warningText}\n\nContinue only if the DB is lost or corrupt and markdown is the source you intend to import.`,
     );
-    if (confirmed) return true;
-    ctx.ui.notify("gsd recover cancelled. No database changes made.", "info");
-    return false;
+    if (!confirmed) {
+      ctx.ui.notify("gsd recover cancelled. No database changes made.", "info");
+      return false;
+    }
+    // Data loss requires a second, explicit acknowledgement — the interactive
+    // equivalent of the --allow-data-loss opt-in the non-interactive paths
+    // demand. A single generic "yes" must not silently delete DB rows.
+    if (dataLoss) {
+      const acknowledged = await ctx.ui.confirm(
+        "Permanently delete DB rows the markdown lacks?",
+        "This recover will DELETE authoritative DB rows the markdown does not contain. " +
+          "A snapshot is saved to .gsd/backups/ first, but /gsd rebuild markdown is usually " +
+          "what you want. Proceed with the deletion?",
+      );
+      if (!acknowledged) {
+        ctx.ui.notify("gsd recover cancelled. No database changes made.", "info");
+        return false;
+      }
+    }
+    return true;
   }
 
   ctx.ui.notify(
-    `${warning}\n\nNo database changes made. Re-run /gsd recover --confirm to proceed.`,
+    `${warningText}\n\nNo database changes made. Re-run /gsd recover --confirm to proceed.`,
     "warning",
   );
   return false;
@@ -524,18 +581,31 @@ async function confirmRecover(ctx: ExtensionCommandContext, args: string): Promi
  * Prints counts of recovered items and the resulting project phase.
  */
 export async function handleRecover(ctx: ExtensionCommandContext, basePath: string, args = ""): Promise<void> {
-  const { isDbAvailable: dbAvailable, clearEngineHierarchy, transaction: dbTransaction } = await import("./gsd-db.js");
+  const { isDbAvailable: dbAvailable, clearEngineHierarchy, transaction: dbTransaction, backupDatabaseSnapshot } = await import("./gsd-db.js");
   const { migrateHierarchyToDb } = await import("./md-importer.js");
   const { invalidateStateCache } = await import("./state.js");
+  const { countDbHierarchy, countMarkdownHierarchy, recoverWouldDeleteDbRows } = await import("./migration-auto-check.js");
+  const { renderAllFromDb } = await import("./markdown-renderer.js");
 
   if (!dbAvailable()) {
     ctx.ui.notify("gsd recover: No database open. Run a GSD command first to initialize the DB.", "error");
     return;
   }
 
-  if (!(await confirmRecover(ctx, args))) return;
+  // Compare markdown-on-disk against the live DB so the confirmation prompt can
+  // surface exactly what recover will overwrite (and refuse silent data loss).
+  // The data-loss check is identity-based, not count-based: it flags any DB row
+  // markdown lacks, including equal-count divergence (DB S99 vs markdown S01).
+  const markdown = countMarkdownHierarchy(basePath);
+  const beforeDb = countDbHierarchy();
+  const dataLoss = recoverWouldDeleteDbRows(basePath);
+
+  if (!(await confirmRecover(ctx, args, markdown, beforeDb, dataLoss))) return;
 
   try {
+    // 0. Snapshot the DB before the destructive clear so recover is reversible.
+    const backupPath = backupDatabaseSnapshot("pre-recover");
+
     // 1. Delete + re-populate inside a single transaction for atomicity.
     //    clearEngineHierarchy() uses transaction() internally but transaction()
     //    is re-entrant, so wrapping in dbTransaction() keeps the whole
@@ -545,9 +615,16 @@ export async function handleRecover(ctx: ExtensionCommandContext, basePath: stri
       return migrateHierarchyToDb(basePath);
     });
 
-    // 3. Invalidate state cache so deriveState() picks up fresh DB data
+    // 2. Invalidate state cache so deriveState() picks up fresh DB data
     invalidateStateCache();
 
+    // 3. Re-project markdown from the freshly imported DB so disk and DB agree
+    //    immediately (otherwise the markdown still reflects the pre-import state
+    //    and the next startup check would flag fresh drift). renderAllFromDb
+    //    swallows per-artifact failures into its result, so inspect them — a
+    //    silent projection failure must not be reported as a clean success.
+    const renderResult = await renderAllFromDb(basePath);
+
     // 4. Derive state to verify sanity
     const state = await deriveState(basePath);
 
@@ -560,6 +637,23 @@ export async function handleRecover(ctx: ExtensionCommandContext, basePath: stri
       ``,
       `  Phase:      ${state.phase}`,
     ];
+    // Post-import verification: markdown that failed to parse imports as fewer
+    // rows than countMarkdownHierarchy saw on disk. Surface the shortfall.
+    if (
+      counts.milestones < markdown.milestones ||
+      counts.slices < markdown.slices ||
+      counts.tasks < markdown.tasks
+    ) {
+      lines.push(
+        ``,
+        `  ⚠ Imported fewer rows than markdown contained ` +
+          `(${markdown.milestones}M/${markdown.slices}S/${markdown.tasks}T on disk). ` +
+          `Some markdown may have failed to parse — review before continuing.`,
+      );
+    }
+    if (backupPath) {
+      lines.push(``, `  Backup:     ${backupPath}`);
+    }
     if (state.activeMilestone) {
       lines.push(`  Active:     ${state.activeMilestone.id}: ${state.activeMilestone.title}`);
     }
@@ -570,10 +664,27 @@ export async function handleRecover(ctx: ExtensionCommandContext, basePath: stri
       lines.push(`  Task:       ${state.activeTask.id}: ${state.activeTask.title}`);
     }
 
+    // Surface markdown projection failures: renderAllFromDb resolves even when
+    // individual artifacts fail to render, so a clean exit here would otherwise
+    // hide a stale/partial projection.
+    const renderFailed = renderResult.errors.length > 0;
+    if (renderFailed) {
+      lines.push(
+        ``,
+        `  ⚠ ${renderResult.errors.length} markdown projection(s) failed to render — ` +
+          `markdown may be stale. Re-run /gsd rebuild markdown.`,
+      );
+      for (const e of renderResult.errors.slice(0, 5)) lines.push(`    - ${e}`);
+      if (renderResult.errors.length > 5) {
+        lines.push(`    …and ${renderResult.errors.length - 5} more`);
+      }
+    }
+
     process.stderr.write(
-      `gsd-recover: recovered ${counts.milestones}M/${counts.slices}S/${counts.tasks}T hierarchy\n`,
+      `gsd-recover: recovered ${counts.milestones}M/${counts.slices}S/${counts.tasks}T hierarchy` +
+        `${renderFailed ? ` (${renderResult.errors.length} projection errors)` : ""}\n`,
     );
-    ctx.ui.notify(lines.join("\n"), "success");
+    ctx.ui.notify(lines.join("\n"), renderFailed ? "warning" : "success");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     logWarning("command", `recover failed: ${msg}`);

package/src/resources/extensions/gsd/commands-prefs-wizard.ts

@@ -1285,7 +1285,7 @@ async function configureHooks(ctx: ExtensionCommandContext, prefs: Record<string
   if (geEnabled !== undefined) ge.enabled = geEnabled;
   const currentSliceGates = Array.isArray(ge.slice_gates) ? ge.slice_gates as string[] : [];
   const sgInput = await ctx.ui.input(
-    `Slice gates to evaluate (comma-separated, blank keeps)${currentSliceGates.length ? ` (current: ${currentSliceGates.join(", ")})` : " (default: Q3,Q4)"}:`,
+    `Gate-evaluate slice gates (Q3,Q4; comma-separated, blank keeps)${currentSliceGates.length ? ` (current: ${currentSliceGates.join(", ")})` : " (default: Q3,Q4)"}:`,
     currentSliceGates.join(", "),
   );
   if (sgInput !== null && sgInput !== undefined) {
@@ -1751,7 +1751,7 @@ export function serializePreferencesToFrontmatter(prefs: Record<string, unknown>
   // Ordered keys for consistent output
   const orderedKeys = [
     "version", "mode", "always_use_skills", "prefer_skills", "avoid_skills",
-    "skill_rules", "custom_instructions", "models", "skill_discovery",
+    "skill_rules", "custom_instructions", "models", "thinking", "skill_discovery",
     "skill_staleness_days", "auto_supervisor", "uat_dispatch", "unique_milestone_ids",
     "budget_ceiling", "budget_enforcement", "context_pause_threshold",
     "notifications", "cmux", "remote_questions", "git",

package/src/resources/extensions/gsd/db-writer.ts

@@ -452,6 +452,44 @@ export function _resetDecisionSaveLock(): void {
   _decisionSaveLock = Promise.resolve();
 }
 
+/**
+ * Re-project root DECISIONS.md from the authoritative decision records, with no
+ * new decision being added. Mirrors the projection saveDecisionToDb performs
+ * after a save, but over the full set — so a DB → markdown re-projection
+ * (recover, rebuild, reconcile) re-derives DECISIONS.md and never leaves it
+ * showing a stale subset (e.g. after a worktree merge that accepted one
+ * branch's DECISIONS.md while the DB holds the union of both branches'
+ * decisions). DB stays the single source of truth; this only writes markdown.
+ */
+export async function regenerateDecisionsMarkdown(basePath: string): Promise<void> {
+  const { getAllDecisionsFromMemories } = await import('./context-store.js');
+  const allDecisions: Decision[] = getAllDecisionsFromMemories();
+
+  const filePath = resolveGsdRootFile(basePath, 'DECISIONS');
+  let existingContent: string | null = null;
+  if (existsSync(filePath)) {
+    existingContent = readFileSync(filePath, 'utf-8');
+  }
+
+  // Nothing to project: no decisions in the DB and no file to normalize.
+  if (allDecisions.length === 0 && existingContent === null) return;
+
+  let md: string;
+  if (existingContent && !isDecisionsTableFormat(existingContent)) {
+    // Preserve freeform content; refresh only the appended decisions table.
+    const marker = '---\n\n## Decisions Table';
+    const markerIdx = existingContent.indexOf(marker);
+    const freeformPart = markerIdx >= 0
+      ? existingContent.substring(0, markerIdx).trimEnd()
+      : existingContent.trimEnd();
+    md = freeformPart + '\n' + generateDecisionsAppendBlock(allDecisions);
+  } else {
+    md = generateDecisionsMd(allDecisions);
+  }
+
+  await saveFile(filePath, md);
+}
+
 // ─── Save Decision to DB + Regenerate Markdown ────────────────────────────
 
 export interface SaveDecisionFields {

package/src/resources/extensions/gsd/docs/preferences-reference.md

@@ -104,14 +104,22 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
 
 - `language`: preferred response language for all GSD interactions. Accepts any language name or code — `"Chinese"`, `"zh"`, `"German"`, `"de"`, `"日本語"`, etc. When set, GSD injects "Always respond in \<language\>" into every agent's system prompt, including after `/clear`. Quickest way to set it: `/gsd language <name>`. To clear: `/gsd language off`.
 
-- `models`: per-stage model selection (applies to both auto-mode and guided-flow dispatches). Keys: `research`, `planning`, `discuss`, `execution`, `execution_simple`, `completion`, `validation`, `subagent`. Values can be:
+- `models`: per-stage model selection (applies to both auto-mode and guided-flow dispatches). Keys: `research`, `planning`, `discuss`, `execution`, `execution_simple`, `completion`, `validation`, `subagent`, `uat`. Values can be:
   - Simple string: `"claude-sonnet-4-6"` — single model, no fallbacks
   - Provider-qualified string: `"bedrock/claude-sonnet-4-6"` — targets a specific provider when the same model ID exists across multiple providers
   - Object with fallbacks: `{ model: "claude-opus-4-6", fallbacks: ["glm-5", "minimax-m2.5"] }` — tries fallbacks in order if primary fails
   - Object with provider: `{ model: "claude-opus-4-6", provider: "bedrock" }` — explicit provider targeting in object format
+  - Object with thinking: `{ model: "claude-opus-4-6", thinking: "xhigh" }` — pins the reasoning effort for that phase (see `thinking` below)
   - Omit a key to use whatever model is currently active (except `discuss` and `validation` which fall back to `planning` when unset). Fallbacks are tried when model switching fails (provider unavailable, rate limited, etc.).
   - `discuss` — used for milestone/slice discussion (interactive context gathering). Falls back to `planning` if unset.
   - `validation` — used for gate evaluation, roadmap reassessment, milestone validation, and doc rewrites. Falls back to `planning` if unset.
+  - `uat` — used for UAT runs. Falls back to `completion` if unset.
+
+- `thinking`: per-phase reasoning effort (ADR-026), separate from `models`. Same phase keys as `models`. Values: `off`, `minimal`, `low`, `medium`, `high`, `xhigh`. Thinking travels with the model — model choice and reasoning effort are independent controls, so you can run one model across phases at different reasoning levels.
+  - Two equivalent ways to set it: inline as `models.<phase>.thinking`, or as a separate `thinking:` block keyed by phase. For the same phase, the inline value wins over the block; project preferences win over global; a phase that's unset inherits via the same sibling chain as `models` (e.g. `discuss → planning`).
+  - If no thinking is configured for a phase, the session level (set via `/model`) is used, exactly as before — this is fully backward-compatible.
+  - `execute-task` (code-writing) has a measured reasoning floor of `medium`: at lower levels models stop planning edits and thrash on file re-reads. The floor applies to the session/default path. An **explicit** `execution` thinking level bypasses the floor and is honored verbatim (with a one-time advisory) — set `execution: low` deliberately if you want it.
+  - Levels a model can't support are clamped to the nearest supported level at dispatch and never sent to the provider, so a model/level mismatch never fails a unit mid-run. `xhigh` is only honored by select model families.
 
 - `skill_staleness_days`: number — skills unused for this many days get deprioritized during discovery. Set to `0` to disable staleness tracking. Default: `60`.
 
@@ -448,6 +456,47 @@ models:
 ---
 ```
 
+## Per-Phase Thinking Level Example
+
+Model choice and reasoning effort are independent controls (ADR-026). You can use one model across phases at different reasoning levels, or mix per-phase models with per-phase thinking.
+
+Inline form — thinking pinned alongside the model:
+
+```yaml
+---
+version: 1
+models:
+  planning:
+    model: openai-codex/gpt-5.4
+    thinking: xhigh
+  execution:
+    model: openai-codex/gpt-5.4
+    thinking: low      # explicit → bypasses the execute-task medium floor
+  validation:
+    model: openai-codex/gpt-5.4
+    thinking: high
+---
+```
+
+Separate-block form — set thinking without pinning a model (the session model is used):
+
+```yaml
+---
+version: 1
+thinking:
+  research: medium
+  planning: xhigh
+  discuss: high
+  execution: low
+  execution_simple: low
+  completion: medium
+  validation: high
+  uat: medium
+---
+```
+
+For a single phase, an inline `models.<phase>.thinking` value wins over the same phase in the `thinking:` block; project preferences win over global. Unsupported levels are clamped to the nearest level the resolved model supports.
+
 When a model fails to switch (provider unavailable, rate limited, credits exhausted), GSD automatically tries the next model in the `fallbacks` list. This ensures auto-mode continues even when your preferred provider hits limits.
 
 ## Provider Targeting