@opengsd/gsd-pi 1.2.0-dev.4c756166 → 1.2.0-dev.822c9439

package/src/resources/extensions/gsd/state.ts

@@ -13,6 +13,11 @@ import type {
   MilestoneRegistryEntry,
 } from './types.js';
 
+// Pre-migration fallback ONLY (ADR-017): deriveState must work on projects
+// whose DB does not exist yet (before md-importer runs), so it parses markdown
+// projections when `isDbAvailable()` is false or the DB has no rows. Once the
+// DB is populated, decision reads go through gsd-db queries — these parsers
+// must never be consulted when DB data is present.
 import {
   parseRoadmap,
   parsePlan,
@@ -71,27 +76,10 @@ import {
   readinessNeedsDiscussion,
 } from './milestone-readiness.js';
 
-function formatNeedsAttentionBlocker(milestoneId: string): string {
-  return [
-    `Milestone ${milestoneId} is blocked because milestone validation returned needs-attention.`,
-    `Fix options:`,
-    `1. Review the validation details: \`/gsd status\``,
-    `2. If you fixed the missing evidence or issue, re-run milestone validation: \`/gsd validate-milestone\``,
-    `3. If the finding is acceptable, override it: \`/gsd verdict pass --rationale "why this is okay"\``,
-    `4. If this should wait, defer it explicitly: \`/gsd park ${milestoneId}\``,
-    `After validation or override passes, run \`/gsd auto\` to complete and merge the milestone.`,
-  ].join("\n");
-}
-
-function formatNeedsRemediationBlocker(milestoneId: string): string {
-  return [
-    `Milestone ${milestoneId} is blocked because milestone validation returned needs-remediation, but all slices are complete.`,
-    `Fix options:`,
-    `1. Run \`/gsd dispatch reassess\` to add remediation slices, then run \`/gsd auto\``,
-    `2. If the finding is acceptable, override it: \`/gsd verdict pass --rationale "why this is okay"\``,
-    `3. If this should wait, defer it explicitly: \`/gsd park ${milestoneId}\``,
-  ].join("\n");
-}
+import {
+  needsAttentionBlockerGuidance as formatNeedsAttentionBlocker,
+  needsRemediationBlockerGuidance as formatNeedsRemediationBlocker,
+} from './guidance.js';
 
 /**
  * A "ghost" milestone directory contains only META.json (and no substantive

package/src/resources/extensions/gsd/status-guards.ts

@@ -1,17 +1,68 @@
 /**
- * Status predicates for GSD state-machine guards.
+ * Status predicates and the canonical status vocabulary for GSD state-machine
+ * guards (ADR-030).
  *
- * The DB stores status as free-form strings. Three values indicate
- * "closed": "complete" (canonical), "done" (legacy / alias),
- * "closed" (legacy/imported), and
- * "skipped" (user-directed skip via rethink or backtrack).
- * Every inline `status === "complete" || status === "done"` should
- * use isClosedStatus() instead.
+ * The DB column is free-form `string` so legacy/imported rows still load. Three
+ * raw values besides canonical "complete"/"skipped" indicate "closed": "done"
+ * (legacy alias), "closed" (legacy/imported), and "skipped" (user-directed skip
+ * via rethink or backtrack). `RAW_CLOSED_STATUSES` is the single source for both
+ * `isClosedStatus()` and the SQL terminal-status fragment
+ * (`db/sql-constants.ts` derives `TERMINAL_STATUS_SQL` from it), replacing the
+ * prior independent definitions.
+ *
+ * `toStatus()` is the single seam where a free-form string becomes the canonical
+ * `Status` vocabulary; the Status Transition Core writes canonical, so the store
+ * converges over time without a forced migration.
+ */
+
+/**
+ * Canonical, normalized entity-status vocabulary across milestones, slices, and
+ * tasks — the single source for both the `Status` type and the runtime
+ * membership set. The in-memory domain speaks `Status`; the DB column stays
+ * free-form.
+ */
+export const CANONICAL_STATUSES = [
+  "pending", "queued", "active", "parked", "in_progress", "blocked", "complete", "skipped", "deferred",
+] as const;
+export type Status = (typeof CANONICAL_STATUSES)[number];
+const CANONICAL_STATUS_SET: ReadonlySet<string> = new Set(CANONICAL_STATUSES);
+
+/**
+ * Raw status values that mean a unit is closed — the single source of truth.
+ * Includes legacy/imported aliases ("done", "closed") alongside canonical
+ * "complete"/"skipped" because the DB column is free-form and older rows /
+ * imports still carry them. Order matters: `TERMINAL_STATUS_SQL` is derived
+ * from this array verbatim.
+ */
+export const RAW_CLOSED_STATUSES = ["complete", "done", "skipped", "closed"] as const;
+const RAW_CLOSED_SET: ReadonlySet<string> = new Set(RAW_CLOSED_STATUSES);
+
+/** Free-form aliases mapped to their canonical Status on read. */
+const ALIAS_TO_CANONICAL: Readonly<Record<string, Status>> = {
+  done: "complete",
+  closed: "complete",
+  planned: "pending",
+  "in-progress": "in_progress",
+};
+
+/**
+ * Normalize a free-form DB status string into the canonical `Status`
+ * vocabulary. Maps known aliases (done/closed → complete, planned → pending,
+ * in-progress → in_progress). An unrecognized/legacy value is **quarantined** —
+ * preserved verbatim rather than silently remapped to a wrong canonical state —
+ * so reads never fail and reconciliation/telemetry can surface it.
  */
+export function toStatus(raw: string): Status {
+  const value = raw.trim();
+  if (CANONICAL_STATUS_SET.has(value)) return value as Status;
+  const alias = ALIAS_TO_CANONICAL[value];
+  if (alias) return alias;
+  return value as Status;
+}
 
 /** Returns true when a milestone, slice, or task status indicates closure. */
 export function isClosedStatus(status: string): boolean {
-  return status === "complete" || status === "done" || status === "skipped" || status === "closed";
+  return RAW_CLOSED_SET.has(status);
 }
 
 /** Returns true when a slice status indicates it was deferred by a decision. */

package/src/resources/extensions/gsd/stop-notice.ts

@@ -0,0 +1,75 @@
+// Project/App: gsd-pi
+// File Purpose: Stop Notice module — single owner of the auto/step-mode
+// stop/pause notice vocabulary. Both sides of the wire live here: the
+// formatters that produce the canonical prefixes (used by stopAuto/pauseAuto)
+// and the classifiers that recognize them (used by the headless host to pick
+// exit codes). Wording changes in this file keep emitter and detector in
+// lockstep; round-trip tests enforce it.
+
+export type StopNoticeKind = "stopped" | "blocked";
+
+/** A reason string of the form "Blocked: …" marks a blocked stop. */
+export function isBlockedStopReason(reason?: string | null): boolean {
+  return /^Blocked:\s*/i.test(reason ?? "");
+}
+
+/** Strip the "Blocked: " marker for display. */
+export function stopNoticeDisplayReason(reason?: string | null): string {
+  return (reason ?? "").replace(/^Blocked:\s*/i, "").trim();
+}
+
+export function stopNoticeKind(reason?: string | null): StopNoticeKind {
+  return isBlockedStopReason(reason) ? "blocked" : "stopped";
+}
+
+/** Canonical stop-notice prefix: "Auto-mode blocked — reason" / "Auto-mode stopped". */
+export function formatStopNoticePrefix(reason?: string | null): string {
+  const displayReason = stopNoticeDisplayReason(reason);
+  const prefix = stopNoticeKind(reason) === "blocked" ? "Auto-mode blocked" : "Auto-mode stopped";
+  return displayReason ? `${prefix} — ${displayReason}` : prefix;
+}
+
+// ─── Classification (headless host side) ────────────────────────────────
+// The canonical lowercase prefixes the headless event loop recognizes in
+// notify messages. Emitters above and ad-hoc emitters elsewhere must start
+// their terminal notices with one of these.
+
+export const PAUSED_NOTICE_PREFIXES = ["auto-mode paused", "step-mode paused"] as const;
+
+export const TERMINAL_NOTICE_PREFIXES = [
+  "auto-mode stopped",
+  "step-mode stopped",
+  "auto-mode complete",
+  "no active milestone",
+  "auto-mode idle",
+] as const;
+
+/** Manual-resolution notices emitted before auto-mode can formally pause/stop. */
+export function isManualResolutionNotice(message: string): boolean {
+  return (
+    message.includes("resolve manually and re-run /gsd auto") ||
+    message.includes("resolve conflicts manually and run /gsd auto to resume") ||
+    message.includes("resolve and run /gsd auto to resume")
+  );
+}
+
+export function isPauseNotice(message: string): boolean {
+  return PAUSED_NOTICE_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+
+export function isTerminalNotice(message: string): boolean {
+  return TERMINAL_NOTICE_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+
+/** Pauses that do not require operator intervention in headless mode. */
+export function isNonBlockingPauseNotice(message: string): boolean {
+  return message.includes("idempotent advance: unit already active");
+}
+
+export function isBlockedNoticeMessage(message: string): boolean {
+  return (
+    message.includes("blocked:") ||
+    (isPauseNotice(message) && !isNonBlockingPauseNotice(message)) ||
+    isManualResolutionNotice(message)
+  );
+}

package/src/resources/extensions/gsd/tests/auto-loop.test.ts

@@ -5517,6 +5517,129 @@ test("dispatch Worktree Safety wins before stuck detection for execute-task with
   );
 });
 
+test("dispatch Worktree Safety honors degraded branch fallback instead of demanding the canonical worktree root", async (t) => {
+  _resetPendingResolve();
+
+  const ctx = makeMockCtx();
+  const pi = makeMockPi();
+  const notifications: string[] = [];
+  ctx.ui.notify = (msg: string) => { notifications.push(msg); };
+
+  // Worktree creation failed and the lifecycle fell back to the milestone
+  // branch in the project root. The safety gate must validate against that
+  // effective branch mode, not the configured worktree mode.
+  const projectRoot = mkdtempSync(join(tmpdir(), "gsd-wt-safety-degraded-"));
+  t.after(() => rmSync(projectRoot, { recursive: true, force: true }));
+
+  const s = makeLoopSession({
+    basePath: projectRoot,
+    originalBasePath: projectRoot,
+    canonicalProjectRoot: projectRoot,
+    isolationDegraded: true,
+  });
+  const deps = makeMockDeps({
+    getIsolationMode: () => "worktree",
+  });
+  const result = await runDispatch(
+    {
+      ctx,
+      pi,
+      s,
+      deps,
+      prefs: undefined,
+      iteration: 1,
+      flowId: "test-flow",
+      nextSeq: () => 1,
+    },
+    {
+      state: {
+        phase: "executing",
+        activeMilestone: { id: "M001", title: "Test", status: "active" },
+        activeSlice: { id: "S01", title: "Slice 1" },
+        activeTask: { id: "T01" },
+        registry: [{ id: "M001", status: "active" }],
+        blockers: [],
+      } as any,
+      mid: "M001",
+      midTitle: "Test",
+    },
+    {
+      recentUnits: [],
+      stuckRecoveryAttempts: 0,
+      consecutiveFinalizeTimeouts: 0,
+    },
+  );
+
+  assert.equal(result.action, "next", "dispatch must proceed under degraded branch isolation");
+  assert.ok(
+    !notifications.some((n) => n.includes("Worktree Safety failed")),
+    "degraded branch fallback must not trip a false invalid-root",
+  );
+  assert.ok(!deps.callLog.includes("stopAuto"), "auto-mode must not stop on the degraded fallback");
+});
+
+test("dispatch Worktree Safety honors stranded branch recovery instead of demanding the canonical worktree root", async (t) => {
+  _resetPendingResolve();
+
+  const ctx = makeMockCtx();
+  const pi = makeMockPi();
+  const notifications: string[] = [];
+  ctx.ui.notify = (msg: string) => { notifications.push(msg); };
+
+  // Bootstrap adopted stranded work by checking out the milestone branch in
+  // the project root (strandedRecoveryIsolationMode = "branch"). Isolation is
+  // NOT degraded — the adoption is intentional. The safety gate must validate
+  // against the effective branch mode, not the configured worktree mode.
+  const projectRoot = mkdtempSync(join(tmpdir(), "gsd-wt-safety-stranded-"));
+  t.after(() => rmSync(projectRoot, { recursive: true, force: true }));
+
+  const s = makeLoopSession({
+    basePath: projectRoot,
+    originalBasePath: projectRoot,
+    canonicalProjectRoot: projectRoot,
+    strandedRecoveryIsolationMode: "branch",
+  });
+  const deps = makeMockDeps({
+    getIsolationMode: () => "worktree",
+  });
+  const result = await runDispatch(
+    {
+      ctx,
+      pi,
+      s,
+      deps,
+      prefs: undefined,
+      iteration: 1,
+      flowId: "test-flow",
+      nextSeq: () => 1,
+    },
+    {
+      state: {
+        phase: "executing",
+        activeMilestone: { id: "M001", title: "Test", status: "active" },
+        activeSlice: { id: "S01", title: "Slice 1" },
+        activeTask: { id: "T01" },
+        registry: [{ id: "M001", status: "active" }],
+        blockers: [],
+      } as any,
+      mid: "M001",
+      midTitle: "Test",
+    },
+    {
+      recentUnits: [],
+      stuckRecoveryAttempts: 0,
+      consecutiveFinalizeTimeouts: 0,
+    },
+  );
+
+  assert.equal(result.action, "next", "dispatch must proceed under stranded branch recovery");
+  assert.ok(
+    !notifications.some((n) => n.includes("Worktree Safety failed")),
+    "stranded branch recovery must not trip a false invalid-root",
+  );
+  assert.ok(!deps.callLog.includes("stopAuto"), "auto-mode must not stop on stranded branch recovery");
+});
+
 test("runDispatch runs stuck detection while artifact verification retry is pending (#5719)", async (t) => {
   _resetPendingResolve();
 

package/src/resources/extensions/gsd/tests/auto-model-selection.test.ts

@@ -8,6 +8,7 @@ import { fileURLToPath } from "node:url";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
 import { ModelPolicyDispatchBlockedError, resolvePreferredModelConfig, resolveModelId, selectAndApplyModel, floorThinkingLevelForUnit } from "../auto-model-selection.js";
+import { blockModelUntil, clearTemporaryModelBlocksForTest } from "../blocked-models.ts";
 
 function makeTempDir(prefix: string): string {
   return mkdtempSync(join(tmpdir(), prefix));
@@ -223,6 +224,74 @@ test("selectAndApplyModel honors explicit phase models without downgrading (#361
   }
 });
 
+test("selectAndApplyModel skips a rate-limited primary until its reset time", async () => {
+  const originalCwd = process.cwd();
+  const originalGsdHome = process.env.GSD_HOME;
+  const tempProject = makeTempDir("gsd-rate-limit-fallback-project-");
+  const tempGsdHome = makeTempDir("gsd-rate-limit-fallback-home-");
+  const setModelCalls: string[] = [];
+
+  try {
+    clearTemporaryModelBlocksForTest();
+    mkdirSync(join(tempProject, ".gsd"), { recursive: true });
+    writeFileSync(
+      join(tempProject, ".gsd", "PREFERENCES.md"),
+      [
+        "---",
+        "models:",
+        "  execution:",
+        "    model: gpt-5.5",
+        "    provider: openai-codex",
+        "    fallbacks:",
+        "      - anthropic/claude-sonnet-4-6",
+        "---",
+      ].join("\n"),
+      "utf-8",
+    );
+    process.env.GSD_HOME = tempGsdHome;
+    process.chdir(tempProject);
+
+    const availableModels = [
+      { id: "gpt-5.5", provider: "openai-codex", api: "responses" },
+      { id: "claude-sonnet-4-6", provider: "anthropic", api: "anthropic-messages" },
+    ];
+    const ctx = {
+      modelRegistry: { getAvailable: () => availableModels },
+      sessionManager: { getSessionId: () => "test-session" },
+      ui: { notify: () => {} },
+      model: { provider: "openai-codex", id: "gpt-5.5", api: "responses" },
+    } as any;
+    const pi = {
+      setModel: async (model: { provider: string; id: string }) => {
+        setModelCalls.push(`${model.provider}/${model.id}`);
+        return true;
+      },
+      emitBeforeModelSelect: async () => undefined,
+      getActiveTools: () => [],
+      emitAdjustToolSet: async () => undefined,
+      setActiveTools: () => {},
+    } as any;
+
+    blockModelUntil(tempProject, "openai-codex", "gpt-5.5", Date.now() + 60_000, "session limit");
+    await selectAndApplyModel(ctx, pi, "execute-task", "M001/S01/T01", tempProject, undefined, false, { provider: "openai-codex", id: "gpt-5.5" }, undefined, true);
+
+    blockModelUntil(tempProject, "openai-codex", "gpt-5.5", Date.now() - 1, "expired");
+    await selectAndApplyModel(ctx, pi, "execute-task", "M001/S01/T02", tempProject, undefined, false, { provider: "openai-codex", id: "gpt-5.5" }, undefined, true);
+
+    assert.deepEqual(setModelCalls, [
+      "anthropic/claude-sonnet-4-6",
+      "openai-codex/gpt-5.5",
+    ]);
+  } finally {
+    clearTemporaryModelBlocksForTest();
+    process.chdir(originalCwd);
+    if (originalGsdHome === undefined) delete process.env.GSD_HOME;
+    else process.env.GSD_HOME = originalGsdHome;
+    rmSync(tempProject, { recursive: true, force: true });
+    rmSync(tempGsdHome, { recursive: true, force: true });
+  }
+});
+
 test("selectAndApplyModel lets explicit unit models bypass stale cross-provider lock (#116)", async () => {
   const originalCwd = process.cwd();
   const originalGsdHome = process.env.GSD_HOME;
@@ -803,7 +872,12 @@ test("selectAndApplyModel clamps explicit no-model thinking via ctx.model when r
 
   await selectAndApplyModel(
     {
-      modelRegistry: { getAvailable: () => [] },   // registry lookup fails
+      // Empty registry results force the clamp source to fall back to ctx.model.
+      modelRegistry: {
+        getAvailable: () => [],
+        getAll: () => [],
+        isProviderRequestReady: () => true,
+      },
       sessionManager: { getSessionId: () => "test-session" },
       ui: { notify: () => {} },
       model: ctxModel,
@@ -857,3 +931,25 @@ test("resolveModelId: claude-code wins when session is claude-code regardless of
   assert.ok(result, "should resolve a model");
   assert.equal(result.provider, "claude-code", "claude-code must win when it is the session provider");
 });
+
+test("resolveModelId: openai-codex wins over openai for bare GPT IDs when both are available", () => {
+  const availableModels = [
+    { id: "gpt-5.5", provider: "openai" },
+    { id: "gpt-5.5", provider: "openai-codex" },
+  ];
+
+  const result = resolveModelId("gpt-5.5", availableModels, undefined);
+  assert.ok(result, "should resolve a model");
+  assert.equal(result.provider, "openai-codex", "ChatGPT OAuth must win over platform API for bare IDs");
+});
+
+test("resolveModelId: github-copilot wins over openai when both offer the same GPT model", () => {
+  const availableModels = [
+    { id: "gpt-5.5", provider: "openai" },
+    { id: "gpt-5.5", provider: "github-copilot" },
+  ];
+
+  const result = resolveModelId("gpt-5.5", availableModels, undefined);
+  assert.ok(result);
+  assert.equal(result.provider, "github-copilot");
+});