@opengsd/gsd-pi 1.2.0-dev.955e4da0 → 1.2.0-dev.fb12b103

package/src/resources/extensions/gsd/tests/exec-graceful-kill.test.ts

@@ -0,0 +1,193 @@
+// Project/App: gsd-pi
+// File Purpose: Deterministic timing tests for the exec-sandbox graceful-kill
+// ladder + hard-deadline force-resolve (S04/T02).
+//
+// T01 extended runExecSandbox's timeout path to a graceful
+// SIGTERM -> grace -> SIGKILL ladder (via killProcessTree) plus a caller-side
+// force-resolve hard deadline so a non-closing ("D-state") child can never hang
+// the awaiting promise. A true D-state child is non-portable, so we simulate the
+// exact symptom deterministically:
+//   1. A SIGTERM-cooperative child (trap 'exit 0' TERM) closes promptly on the
+//      first SIGTERM — proving the ladder resolves via `close` well before the
+//      force-resolve deadline.
+//   2. A SIGTERM-ignoring (trap '' TERM) child combined with a LARGE
+//      kill_grace_ms (so SIGKILL never fires in-window) and a SHORT
+//      force_resolve_delay_ms — the only way the promise can settle is the
+//      hard deadline, proving the no-hang guarantee.
+//
+// Unlike the sync bash path (which throws on force-resolve), runExecSandbox
+// always RESOLVES; force-resolve calls finalize(null, "SIGKILL") and preserves
+// timed_out === true so the agent can still distinguish a graceful timeout exit
+// from a forced kill.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { EXEC_DEFAULTS, runExecSandbox, type ExecSandboxOptions } from '../exec-sandbox.ts';
+
+const isWin = process.platform === 'win32';
+
+function freshBase(): string {
+  return mkdtempSync(join(tmpdir(), 'gsd-exec-gracekill-'));
+}
+
+function cleanup(dir: string): void {
+  rmSync(dir, { recursive: true, force: true });
+}
+
+function baseOpts(base: string, overrides: Partial<ExecSandboxOptions> = {}): ExecSandboxOptions {
+  return {
+    baseDir: base,
+    clamp_timeout_ms: EXEC_DEFAULTS.clampTimeoutMs,
+    default_timeout_ms: 10_000,
+    stdout_cap_bytes: 1_024,
+    stderr_cap_bytes: 1_024,
+    digest_chars: 120,
+    env_allowlist: EXEC_DEFAULTS.envAllowlist,
+    ...overrides,
+  };
+}
+
+// Wall-clock guard: reject if the call has not settled by `ms`. Proves no-hang
+// independently of the assertions on timing/markers.
+function wallClockGuard<T>(promise: Promise<T>, ms: number): Promise<T> {
+  return Promise.race([
+    promise,
+    new Promise<never>((_, reject) => {
+      const t = setTimeout(() => reject(new Error(`Call did not settle within ${ms}ms (hang)`)), ms);
+      if (typeof t === 'object' && 'unref' in t) t.unref();
+    }),
+  ]);
+}
+
+// Clean up a detached child (and its process group) that a large kill_grace_ms
+// intentionally leaves alive past the force-resolve deadline.
+function cleanupByPidFile(pidFile: string): void {
+  if (!existsSync(pidFile)) return;
+  const pid = Number.parseInt(readFileSync(pidFile, 'utf-8').trim(), 10);
+  if (!Number.isFinite(pid) || pid <= 0) return;
+  if (isWin) return; // best-effort; test is skipped on win32
+  try {
+    process.kill(-pid, 'SIGKILL');
+  } catch {
+    try {
+      process.kill(pid, 'SIGKILL');
+    } catch {
+      // already gone
+    }
+  }
+}
+
+test(
+  'runExecSandbox: SIGTERM-cooperative child exits promptly within grace on timeout',
+  { skip: isWin ? 'Unix-primary graceful semantics' : false, timeout: 20_000 },
+  async (t) => {
+    const base = freshBase();
+    t.after(() => cleanup(base));
+
+    const KILL_GRACE_MS = 5_000;
+    const FORCE_RESOLVE_DELAY_MS = 8_000; // grace + hard-deadline; must NOT be reached
+    const TIMEOUT_MS = 300;
+
+    // Child traps SIGTERM and exits 0, then sleeps long. The first SIGTERM from
+    // the ladder ends it immediately -> `close` fires -> finalize via close,
+    // well before the force-resolve deadline.
+    const script = `trap 'exit 0' TERM; sleep 30`;
+
+    const result = await wallClockGuard(
+      runExecSandbox(
+        { runtime: 'bash', script, timeout_ms: TIMEOUT_MS },
+        baseOpts(base, {
+          kill_grace_ms: KILL_GRACE_MS,
+          force_resolve_delay_ms: FORCE_RESOLVE_DELAY_MS,
+        }),
+      ),
+      15_000,
+    );
+
+    // timed_out is preserved even though the child exited cooperatively.
+    assert.equal(result.timed_out, true, 'timeout fired so timed_out must be true');
+    // Proves SIGTERM (close) resolved it, NOT the force-resolve deadline:
+    // a force-resolve would land at ~TIMEOUT_MS + FORCE_RESOLVE_DELAY_MS (~8.3s).
+    assert.ok(
+      result.duration_ms < KILL_GRACE_MS,
+      `expected prompt close well under grace (${KILL_GRACE_MS}ms), got ${result.duration_ms}ms`,
+    );
+    // A clean SIGTERM-trapped exit resolves via `close` with an exit code,
+    // not the force-resolve sentinel (exit_code null / signal SIGKILL).
+    assert.notEqual(
+      result.signal,
+      'SIGKILL',
+      'cooperative child must not be force-resolved as SIGKILL',
+    );
+    assert.equal(result.force_resolved, false, 'a cooperative close must not be flagged as force-resolved');
+  },
+);
+
+test(
+  'runExecSandbox: SIGTERM-ignoring (non-closing) child force-resolves via hard deadline without hanging',
+  { skip: isWin ? 'Unix-primary graceful semantics; force-resolve covered on POSIX' : false, timeout: 20_000 },
+  async (t) => {
+    const base = freshBase();
+    const pidFile = join(base, 'child.pid');
+    t.after(() => {
+      cleanupByPidFile(pidFile);
+      cleanup(base);
+    });
+
+    // Timing seams: SIGKILL never fires in-window (grace huge), so the only way
+    // the promise can settle is the hard deadline -> proves the caller-side
+    // force-resolve.
+    const KILL_GRACE_MS = 30_000;
+    const FORCE_RESOLVE_DELAY_MS = 800;
+    // Generous timeout so the SIGTERM trap is reliably installed before the kill
+    // fires, even under heavy parallel test load. A too-tight timeout can race
+    // the shell's startup: the kill lands before `trap '' TERM` runs, SIGTERM
+    // takes its default action, the child closes on SIGTERM, and the
+    // force-resolve path never runs (flaky 'SIGTERM' instead of 'SIGKILL').
+    const TIMEOUT_MS = 1_500;
+
+    // Install the SIGTERM trap FIRST (before any other command) so the shell is
+    // already immune by the time the kill fires; then record the detached
+    // shell's PID (process-group leader) for cleanup. The shell loops forever
+    // holding its stdout pipe open -> `close` never fires in-window -> the
+    // caller's hard deadline must force-resolve.
+    const script = `trap '' TERM; echo $$ > '${pidFile}'; while true; do sleep 1; done`;
+
+    const start = Date.now();
+    const result = await wallClockGuard(
+      runExecSandbox(
+        { runtime: 'bash', script, timeout_ms: TIMEOUT_MS },
+        baseOpts(base, {
+          kill_grace_ms: KILL_GRACE_MS,
+          force_resolve_delay_ms: FORCE_RESOLVE_DELAY_MS,
+        }),
+      ),
+      8_000,
+    );
+    const elapsed = Date.now() - start;
+
+    // (a) Did not hang and settled well before the SIGKILL grace would fire.
+    assert.ok(
+      elapsed < KILL_GRACE_MS,
+      `expected force-resolve before SIGKILL grace (${KILL_GRACE_MS}ms), took ${elapsed}ms`,
+    );
+    // (b) Settled in the force-resolve band: >= timeout (kill initiated) and
+    //     roughly timeout + force_resolve_delay (generous CI slack, but kept below
+    //     the 8000ms wallClockGuard so the upper bound is actually reachable).
+    assert.ok(
+      elapsed >= TIMEOUT_MS && elapsed <= TIMEOUT_MS + FORCE_RESOLVE_DELAY_MS + 4_000,
+      `expected settle near ${TIMEOUT_MS + FORCE_RESOLVE_DELAY_MS}ms, took ${elapsed}ms`,
+    );
+    // (c) Force-resolve preserves timed_out and surfaces the SIGKILL sentinel
+    //     (exit_code null) plus the explicit force_resolved flag, so the agent can
+    //     tell a forced kill (D-state hard deadline) from a clean SIGKILL exit.
+    assert.equal(result.timed_out, true, 'force-resolve must preserve timed_out');
+    assert.equal(result.exit_code, null, 'force-resolve exit_code must be null');
+    assert.equal(result.signal, 'SIGKILL', 'force-resolve must mark signal SIGKILL');
+    assert.equal(result.force_resolved, true, 'force-resolve must set force_resolved=true');
+  },
+);

package/src/resources/extensions/gsd/tests/exec-tool.test.ts

@@ -2,7 +2,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 
 import { registerExecTools } from "../bootstrap/exec-tools.ts";
-import { executeUatExec } from "../tools/exec-tool.ts";
+import { executeGsdExec, executeUatExec } from "../tools/exec-tool.ts";
 import type { ExecSandboxRequest, ExecSandboxResult } from "../exec-sandbox.ts";
 
 function makeExecResult(request: ExecSandboxRequest): ExecSandboxResult {
@@ -12,6 +12,7 @@ function makeExecResult(request: ExecSandboxRequest): ExecSandboxResult {
     exit_code: 0,
     signal: null,
     timed_out: false,
+    force_resolved: false,
     duration_ms: 1,
     stdout_bytes: 12,
     stderr_bytes: 0,
@@ -51,6 +52,33 @@ test("executeUatExec accepts evidence-mode aliases for intent", async () => {
   assert.equal(requests[0]?.metadata?.intent, "uat-artifact-check");
 });
 
+test("gsd_exec surfaces a force-resolved (D-state) kill distinctly from a clean exit", async () => {
+  // A hard-deadline force-resolve sets force_resolved=true with a synthetic SIGKILL
+  // signal and null exit code. The tool result must carry that flag in details and
+  // render it as exit=timeout(force-killed) so the agent can tell it apart from a
+  // normally-exited or cleanly-timed-out command.
+  const result = await executeGsdExec(
+    { runtime: "bash", script: "sleep 60" },
+    {
+      baseDir: "/tmp/gsd-exec-force-resolved-test",
+      preferences: null,
+      run: async (request) => ({
+        ...makeExecResult(request),
+        exit_code: null,
+        signal: "SIGKILL",
+        timed_out: true,
+        force_resolved: true,
+        digest: "[no stdout \u2014 timed out]",
+      }),
+    },
+  );
+
+  assert.equal(result.isError, true, "a force-resolved kill is an error result");
+  assert.equal(result.details?.force_resolved, true, "details must expose force_resolved");
+  const text = result.content.map((c) => c.text ?? "").join("\n");
+  assert.match(text, /exit=timeout\(force-killed\)/, "summary must distinguish a force-killed result");
+});
+
 test("registerExecTools exposes gsd_uat_exec intent as recoverable string schema", () => {
   const tools: Array<{ name: string; parameters: any }> = [];
   registerExecTools({

package/src/resources/extensions/gsd/tests/extension-bootstrap-isolation.test.ts

@@ -117,7 +117,8 @@ describe("extension bootstrap isolation (#4168, #4172)", () => {
 // registration is wrapped in its own try/catch so one failure does not
 // prevent siblings from loading.
 
-import { registerGsdExtension } from "../bootstrap/register-extension.ts";
+import { CRITICAL_GSD_WORKFLOW_TOOL_NAMES, registerGsdExtension } from "../bootstrap/register-extension.ts";
+import { drainLogs } from "../workflow-logger.ts";
 
 describe("registerGsdExtension defensive registration", () => {
   test("a failing shortcut registration does not prevent kill command registration", async () => {
@@ -161,4 +162,37 @@ describe("registerGsdExtension defensive registration", () => {
       `registerGsdExtension must NOT register 'gsd' (it is registered separately by index.ts), got ${JSON.stringify(registered)}`,
     );
   });
+
+  test("critical workflow tool list includes lifecycle planning and completion tools", () => {
+    assert.ok(CRITICAL_GSD_WORKFLOW_TOOL_NAMES.includes("gsd_plan_slice"));
+    assert.ok(CRITICAL_GSD_WORKFLOW_TOOL_NAMES.includes("gsd_slice_complete"));
+    assert.ok(CRITICAL_GSD_WORKFLOW_TOOL_NAMES.includes("gsd_validate_milestone"));
+    assert.ok(CRITICAL_GSD_WORKFLOW_TOOL_NAMES.includes("gsd_complete_milestone"));
+  });
+
+  test("partial db-tools registration fails visibly when critical tools are missing", () => {
+    drainLogs();
+    const registeredTools: string[] = [];
+    const pi = {
+      registerCommand: () => {},
+      registerTool: (tool: { name: string }) => {
+        if (tool.name === "gsd_plan_slice") {
+          throw new Error("simulated db-tools partial registration failure");
+        }
+        registeredTools.push(tool.name);
+      },
+      registerHook: () => {},
+      registerShortcut: () => {},
+      events: { on: () => {}, off: () => {}, emit: () => {} },
+      getAllTools: () => registeredTools.map((name) => ({ name })),
+    };
+
+    assert.throws(
+      () => registerGsdExtension(pi as any),
+      /Critical GSD workflow tool registration failed; missing required tool\(s\): .*gsd_plan_slice/,
+    );
+    assert.ok(registeredTools.includes("gsd_plan_milestone"));
+    assert.ok(!registeredTools.includes("gsd_plan_slice"));
+    drainLogs();
+  });
 });

package/src/resources/extensions/gsd/tests/guidance.test.ts

@@ -0,0 +1,125 @@
+// GSD Extension — Guidance module tests
+// The catalog is the test surface: every typed finding must resolve to
+// non-empty remediation, and load-bearing phrases must survive edits.
+
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  formatGuidance,
+  recoveryRemediation,
+  needsAttentionBlockerGuidance,
+  needsRemediationBlockerGuidance,
+  crashResumeHint,
+  doctorFixHint,
+  type RecoveryGuidanceKey,
+} from "../guidance.js";
+import { classifyFailure, type RecoveryFailureKind } from "../recovery-classification.js";
+import { isValidationBlockedState } from "../validation-block-guard.js";
+import type { GSDState } from "../types.js";
+
+const RECOVERY_KEYS: RecoveryGuidanceKey[] = [
+  "tool-schema",
+  "tool-contract",
+  "tool-unavailable",
+  "deterministic-policy",
+  "lifecycle-progression",
+  "stale-worker",
+  "worktree-invalid",
+  "verification-drift",
+  "reconciliation-drift",
+  "illegal-transition",
+  "runtime-unknown",
+  "provider-transient",
+  "provider-permanent",
+];
+
+describe("guidance catalog", () => {
+  test("every recovery guidance key resolves to non-empty remediation", () => {
+    for (const key of RECOVERY_KEYS) {
+      const remediation = recoveryRemediation(key);
+      assert.ok(remediation.length > 0, `empty remediation for ${key}`);
+    }
+  });
+
+  test("classifyFailure carries catalog remediation for every failure kind", () => {
+    const kinds: RecoveryFailureKind[] = [
+      "tool-schema",
+      "tool-contract",
+      "deterministic-policy",
+      "lifecycle-progression",
+      "stale-worker",
+      "worktree-invalid",
+      "verification-drift",
+      "reconciliation-drift",
+      "runtime-unknown",
+    ];
+    for (const kind of kinds) {
+      const result = classifyFailure({ error: new Error("boom"), failureKind: kind });
+      assert.equal(result.failureKind, kind);
+      assert.equal(result.exitReason, kind);
+      assert.ok(result.remediation.length > 0, `empty remediation for ${kind}`);
+    }
+  });
+
+  test("escalation kinds with weak guidance now name a concrete command", () => {
+    for (const key of ["stale-worker", "worktree-invalid", "verification-drift", "reconciliation-drift"] as const) {
+      assert.match(recoveryRemediation(key), /\/gsd /, `no command in remediation for ${key}`);
+    }
+  });
+
+  test("formatGuidance numbers steps under the summary", () => {
+    const text = formatGuidance({ summary: "It broke.", steps: ["Fix it.", "Retry."] });
+    assert.equal(text, "It broke.\n\n1. Fix it.\n2. Retry.");
+  });
+
+  test("formatGuidance with no steps is just the summary", () => {
+    assert.equal(formatGuidance({ summary: "All good.", steps: [] }), "All good.");
+  });
+});
+
+describe("milestone blocker guidance", () => {
+  test("needs-attention blocker keeps the phrase the validation-block guard matches", () => {
+    const state = { phase: "blocked", blockers: [needsAttentionBlockerGuidance("M005")] } as unknown as GSDState;
+    assert.ok(isValidationBlockedState(state));
+  });
+
+  test("needs-remediation blocker keeps the phrase the validation-block guard matches", () => {
+    const state = { phase: "blocked", blockers: [needsRemediationBlockerGuidance("M005")] } as unknown as GSDState;
+    assert.ok(isValidationBlockedState(state));
+  });
+
+  test("blockers carry the milestone id and concrete fix commands", () => {
+    const text = needsAttentionBlockerGuidance("M007");
+    assert.match(text, /M007/);
+    assert.match(text, /\/gsd status/);
+    assert.match(text, /\/gsd validate-milestone/);
+  });
+});
+
+describe("crash resume hints", () => {
+  test("bootstrap crash reports no work lost", () => {
+    assert.match(crashResumeHint("starting", "bootstrap") ?? "", /No work was lost/);
+  });
+
+  test("unit classes map to their resume hints", () => {
+    assert.match(crashResumeHint("research-milestone", "M001") ?? "", /may be incomplete/);
+    assert.match(crashResumeHint("execute-task", "T001") ?? "", /completed work is preserved/);
+    assert.match(crashResumeHint("complete-slice", "S001") ?? "", /interrupted/);
+  });
+
+  test("unknown unit types yield no hint", () => {
+    assert.equal(crashResumeHint("triage-captures", "X"), undefined);
+  });
+});
+
+describe("doctor fix hints", () => {
+  test("known codes resolve to a hint", () => {
+    assert.ok(doctorFixHint("stale_crash_lock"));
+    assert.ok(doctorFixHint("db_unavailable"));
+  });
+
+  test("codes without authored guidance resolve to undefined", () => {
+    assert.equal(doctorFixHint("delimiter_in_title"), undefined);
+  });
+});

package/src/resources/extensions/gsd/tests/integration/auto-worktree-milestone-merge.test.ts

@@ -35,6 +35,7 @@ import {
   insertTask,
   openDatabase,
 } from "../../gsd-db.ts";
+import { createGsdIntegrationProject } from "./gsd-integration-fixture.ts";
 
 function run(cmd: string, cwd: string): string {
   // Safe: all inputs are hardcoded test strings, not user input
@@ -42,17 +43,12 @@ function run(cmd: string, cwd: string): string {
 }
 
 function createTempRepo(): string {
-  const dir = realpathSync(mkdtempSync(join(tmpdir(), "wt-ms-merge-test-")));
-  run("git init", dir);
-  run("git config user.email test@test.com", dir);
-  run("git config user.name Test", dir);
-  writeFileSync(join(dir, "README.md"), "# test\n");
-  mkdirSync(join(dir, ".gsd"), { recursive: true });
-  writeFileSync(join(dir, ".gsd", "STATE.md"), "# State\n");
-  run("git add .", dir);
-  run("git commit -m init", dir);
-  run("git branch -M main", dir);
-  return dir;
+  return createGsdIntegrationProject({
+    prefix: "wt-ms-merge-test-",
+    initialFiles: {
+      ".gsd/STATE.md": "# State\n",
+    },
+  }).root;
 }
 
 function createTempRepoWithExternalGsd(): { repo: string; externalState: string } {
@@ -784,6 +780,52 @@ describe("auto-worktree-milestone-merge", { timeout: 300_000 }, () => {
     );
   });
 
+  test("#2156 (legacy): mergeMilestoneToMain removes external-state worktrees created under .gsd/worktrees/", () => {
+    const { repo, externalState } = freshRepoWithExternalGsd();
+    // Worktrees created by older versions live at .gsd/worktrees/<MID>; git
+    // resolves the symlink and registers them under external state. Canonical
+    // .gsd-worktrees/ creation never crosses the symlink, so this coverage
+    // creates the legacy worktree explicitly. createAutoWorktree chdirs into
+    // the new worktree and mergeMilestoneToMain reads process.cwd() as the
+    // worktree cwd, so mirror that here.
+    const wtPath = join(repo, ".gsd", "worktrees", "M216");
+    run(`git worktree add -b milestone/M216 "${wtPath}"`, repo);
+    process.chdir(wtPath);
+
+    addSliceToMilestone(repo, wtPath, "M216", "S01", "Legacy external cleanup", [
+      { file: "legacy-external-cleanup.ts", content: "export const legacyExternalCleanup = true;\n", message: "add legacy external cleanup" },
+    ]);
+
+    const realWtPath = realpathSync(wtPath);
+    assert.ok(
+      realWtPath.startsWith(externalState),
+      `legacy worktree should be registered under external .gsd state, got ${realWtPath}`,
+    );
+
+    // Recreate the exact divergence from #1852: local .gsd/ is replaced with a
+    // stale real directory, so the computed path no longer matches git's record.
+    unlinkSync(join(repo, ".gsd"));
+    mkdirSync(join(repo, ".gsd", "worktrees", "M216"), { recursive: true });
+    writeFileSync(join(repo, ".gsd", "STATE.md"), "# Local stale state\n");
+    writeFileSync(join(repo, ".gsd", "worktrees", "M216", "stale.txt"), "stale local artifact\n");
+
+    const roadmap = makeRoadmap("M216", "Legacy external cleanup", [
+      { id: "S01", title: "Legacy external cleanup" },
+    ]);
+
+    mergeMilestoneToMain(repo, "M216", roadmap);
+
+    assert.ok(
+      !run("git worktree list", repo).includes("M216"),
+      "merged legacy milestone worktree should be removed from git worktree list",
+    );
+    assert.ok(!existsSync(realWtPath), "real external worktree directory should be removed");
+    assert.ok(
+      !run("git branch", repo).includes("milestone/M216"),
+      "milestone branch should be deleted after merge cleanup",
+    );
+  });
+
   test("#2912: MERGE_HEAD cleaned up after squash-merge conflict", () => {
     const repo = freshRepo();
     const wtPath = createAutoWorktree(repo, "M291");