@opengsd/gsd-pi 1.3.0-dev.eed73bea → 1.4.0

package/src/resources/extensions/gsd/safety/destructive-guard.ts

@@ -29,6 +29,13 @@ const DESTRUCTIVE_PATTERNS: readonly DestructivePattern[] = [
   { pattern: /\bkubectl\s+(delete|apply)\b/i, label: "kubectl mutation" },
 ];
 
+function stripQuotedAndComments(command: string): string {
+  return command
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''")
+    .replace(/(^|\s)#.*$/g, "$1");
+}
+
 // ─── Public API ─────────────────────────────────────────────────────────────
 
 export interface CommandClassification {
@@ -41,9 +48,10 @@ export interface CommandClassification {
  * Returns the list of matched destructive pattern labels.
  */
 export function classifyCommand(command: string): CommandClassification {
+  const commandToClassify = stripQuotedAndComments(command);
   const labels: string[] = [];
   for (const { pattern, label } of DESTRUCTIVE_PATTERNS) {
-    if (pattern.test(command)) {
+    if (pattern.test(commandToClassify)) {
       // Deduplicate labels (e.g., two force-push patterns)
       if (!labels.includes(label)) labels.push(label);
     }

package/src/resources/extensions/gsd/safety/evidence-collector.ts

@@ -65,12 +65,16 @@ const MCP_EXECUTION_TOOL_RE = /^mcp__.+__gsd_(?:uat_)?exec(?:_search)?$/;
 // ─── Module State ───────────────────────────────────────────────────────────
 
 let unitEvidence: EvidenceEntry[] = [];
+let lastWritePath: string | null = null;
+let lastWriteSig: string | null = null;
 
 // ─── Public API ─────────────────────────────────────────────────────────────
 
 /** Reset all evidence for a new unit. Call at unit start. */
 export function resetEvidence(): void {
   unitEvidence = [];
+  lastWritePath = null;
+  lastWriteSig = null;
 }
 
 /** Get a read-only view of all evidence collected for the current unit. */
@@ -145,10 +149,15 @@ export function saveEvidenceToDisk(
 ): void {
   try {
     const path = evidencePath(basePath, milestoneId, sliceId, taskId);
+    const body = JSON.stringify(unitEvidence, null, 2) + "\n";
+    if (path === lastWritePath && body === lastWriteSig) return;
+
     mkdirSync(dirname(path), { recursive: true });
     const tmp = `${path}.tmp.${randomBytes(4).toString("hex")}`;
-    writeFileSync(tmp, JSON.stringify(unitEvidence, null, 2) + "\n", "utf-8");
+    writeFileSync(tmp, body, "utf-8");
     renameSync(tmp, path);
+    lastWritePath = path;
+    lastWriteSig = body;
   } catch {
     // Non-fatal — don't let persistence failures break unit execution
   }
@@ -167,6 +176,8 @@ export function loadEvidenceFromDisk(
   taskId: string,
 ): void {
   try {
+    lastWritePath = null;
+    lastWriteSig = null;
     const path = evidencePath(basePath, milestoneId, sliceId, taskId);
     if (!existsSync(path)) return;
     const raw = readFileSync(path, "utf-8");
@@ -195,6 +206,10 @@ export function clearEvidenceFromDisk(
     if (existsSync(path)) {
       unlinkSync(path);
     }
+    if (path === lastWritePath) {
+      lastWritePath = null;
+      lastWriteSig = null;
+    }
   } catch {
     // Non-fatal
   }

package/src/resources/extensions/gsd/safety/file-change-validator.ts

@@ -76,8 +76,14 @@ export function validateFileChanges(
   const actualFiles = getChangedFilesFromLastCommit(basePath);
   if (!actualFiles) return null;
 
-  // Filter out .gsd/ internal files — only validate project source files
-  const projectFiles = actualFiles.filter(f => !f.startsWith(".gsd/") && !f.startsWith(".gsd\\"));
+  // Filter out GSD-internal paths — only validate project source files.
+  const projectFiles = actualFiles.filter(
+    (f) =>
+      !f.startsWith(".gsd/") &&
+      !f.startsWith(".gsd\\") &&
+      !f.startsWith(".gsd-backups/") &&
+      !f.startsWith(".gsd-backups\\"),
+  );
 
   // Normalize expected paths (strip leading ./ or /)
   const normalizedExpected = new Set(

package/src/resources/extensions/gsd/skills/gsd-headless/references/commands.md

@@ -66,7 +66,7 @@ These commands dispatch native GSD prompts adapted to the milestone, slice, and
 | `progress` | Summarize recent work; can route `--next` or `--do "..."` |
 | `health` | Check `.gsd/` integrity (`--repair`, `--context`) |
 | `surface` | Manage surfaced skills and extensions |
-| `code-review` | Review changed source for bugs, security, and quality |
+| `code-review` | Review changed source diff-first for bugs, security, and quality |
 | `review` | Peer-review recent work across reviewer perspectives |
 | `audit-milestone` | Verify a milestone met its definition of done |
 | `audit-uat` | Audit outstanding UAT/verification items |

package/src/resources/extensions/gsd/state/derive/cache.ts

@@ -0,0 +1,46 @@
+// Project/App: gsd-pi
+// File Purpose: deriveState memoization cache and telemetry.
+
+import type { GSDState } from '../../types.js';
+
+interface StateCache {
+  basePath: string;
+  result: GSDState;
+  timestamp: number;
+}
+
+const CACHE_TTL_MS = 100;
+let _stateCache: StateCache | null = null;
+
+let _telemetry = { dbDeriveCount: 0 };
+
+export function getDeriveTelemetry() {
+  return { ..._telemetry };
+}
+
+export function resetDeriveTelemetry() {
+  _telemetry = { dbDeriveCount: 0 };
+}
+
+export function incrementDbDeriveCount(): void {
+  _telemetry.dbDeriveCount++;
+}
+
+export function invalidateStateCache(): void {
+  _stateCache = null;
+}
+
+export function readCachedDeriveState(cacheKey: string): GSDState | null {
+  if (
+    _stateCache &&
+    _stateCache.basePath === cacheKey &&
+    Date.now() - _stateCache.timestamp < CACHE_TTL_MS
+  ) {
+    return _stateCache.result;
+  }
+  return null;
+}
+
+export function writeCachedDeriveState(cacheKey: string, result: GSDState): void {
+  _stateCache = { basePath: cacheKey, result, timestamp: Date.now() };
+}

package/src/resources/extensions/gsd/state/derive/db-open.ts

@@ -0,0 +1,45 @@
+// Project/App: gsd-pi
+// File Purpose: Workflow DB open helpers for state derivation.
+
+import type { GSDState } from '../../types.js';
+import { getAllMilestones, isDbAvailable, setMilestoneQueueOrder } from '../../gsd-db.js';
+import { openExistingWorkflowDatabase } from '../../db-workspace.js';
+import { loadQueueOrder, sortByQueueOrder } from '../../queue-order.js';
+
+export function syncQueueOrderProjectionToDb(basePath: string): void {
+  const queueOrder = loadQueueOrder(basePath);
+  if (!queueOrder) return;
+
+  const currentIds = getAllMilestones().map((m) => m.id);
+  const desiredIds = sortByQueueOrder(currentIds, queueOrder);
+  if (currentIds.length === desiredIds.length && currentIds.every((id, i) => id === desiredIds[i])) return;
+
+  setMilestoneQueueOrder(desiredIds);
+}
+
+export function ensureExistingWorkflowDbOpen(basePath: string): boolean {
+  const opened = isDbAvailable() || openExistingWorkflowDatabase(basePath).ok;
+  if (opened) syncQueueOrderProjectionToDb(basePath);
+  return opened;
+}
+
+export function buildDbUnavailableState(): GSDState {
+  return {
+    activeMilestone: null,
+    activeSlice: null,
+    activeTask: null,
+    phase: "pre-planning",
+    recentDecisions: [],
+    blockers: ["DB unavailable — runtime markdown state derivation is disabled"],
+    nextAction:
+      "Open or create the canonical GSD database before deriving workflow state. If this project only has markdown state, run /gsd migrate explicitly.",
+    registry: [],
+    requirements: { active: 0, validated: 0, deferred: 0, outOfScope: 0, blocked: 0, total: 0 },
+    progress: { milestones: { done: 0, total: 0 } },
+  };
+}
+
+export function getRequestedMilestoneLock(): string | undefined {
+  const lock = process.env.GSD_MILESTONE_LOCK?.trim();
+  return lock || undefined;
+}