@opengsd/gsd-pi 1.5.0-dev.4fb2d460 → 1.5.0-dev.c4c8885f

package/src/resources/extensions/gsd/uok/model-policy.ts

@@ -1,6 +1,7 @@
 import type { TaskMetadata } from "../complexity-classifier.js";
 import { computeTaskRequirements, filterToolsForProvider } from "../model-router.js";
 import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+import { isUnifiedAuditEnabled } from "./audit-toggle.js";
 
 export interface ModelCandidate {
   id: string;
@@ -83,23 +84,25 @@ export function applyModelPolicyFilter<T extends ModelCandidate>(
     };
     decisions.push(decision);
 
-    emitUokAuditEvent(
-      options.basePath,
-      buildAuditEnvelope({
-        traceId: options.traceId,
-        turnId: options.turnId,
-        category: "model-policy",
-        type: allowed ? "model-policy-allow" : "model-policy-deny",
-        payload: {
-          modelId: model.id,
-          provider: model.provider,
-          api: model.api,
-          reason,
-          unitType: options.unitType,
-          requirements,
-        },
-      }),
-    );
+    if (isUnifiedAuditEnabled(options.basePath)) {
+      emitUokAuditEvent(
+        options.basePath,
+        buildAuditEnvelope({
+          traceId: options.traceId,
+          turnId: options.turnId,
+          category: "model-policy",
+          type: allowed ? "model-policy-allow" : "model-policy-deny",
+          payload: {
+            modelId: model.id,
+            provider: model.provider,
+            api: model.api,
+            reason,
+            unitType: options.unitType,
+            requirements,
+          },
+        }),
+      );
+    }
 
     if (allowed) eligible.push(model);
   }

package/src/resources/extensions/gsd/workflow-event-ledger.ts

@@ -105,7 +105,7 @@ export function writeWorktreeEventLog(
 }
 
 function emitWorkflowEventAudit(basePath: string, event: WorkflowEvent): void {
-  if (!isUnifiedAuditEnabled()) return;
+  if (!isUnifiedAuditEnabled(basePath)) return;
   try {
     const normalized = normalizeWorkflowEventCommand(event.cmd) ?? "unknown";
     emitUokAuditEvent(

package/src/resources/extensions/gsd/workflow-logger.ts

@@ -302,7 +302,7 @@ function _push(
     _buffer.shift();
   }
 
-  if (_auditBasePath && isUnifiedAuditEnabled()) {
+  if (_auditBasePath && isUnifiedAuditEnabled(_auditBasePath)) {
     try {
       emitUokAuditEvent(
         _auditBasePath,

package/src/resources/extensions/gsd/workflow-projections.ts

@@ -17,7 +17,7 @@ import type { MilestoneRow } from "./db-milestone-artifact-rows.js";
 import type { SliceRow, TaskRow } from "./db-task-slice-rows.js";
 import type { VerificationEvidenceRow } from "./db-verification-evidence-rows.js";
 import { atomicWriteSync } from "./atomic-write.js";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { mkdirSync, existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { logWarning } from "./workflow-logger.js";
@@ -26,7 +26,7 @@ import { deriveState } from "./state.js";
 import type { GSDState } from "./types.js";
 import { renderPlanFromDb, renderRoadmapFromDb } from "./markdown-renderer.js";
 import { readManifest } from "./workflow-manifest.js";
-import { gsdRoot, resolveSliceFile, resolveMilestonePath, resolveSlicePath, gsdProjectionRoot } from "./paths.js";
+import { gsdRoot, resolveMilestoneFile, resolveSliceFile, resolveTaskFile, relTaskFile } from "./paths.js";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────
 
@@ -329,24 +329,10 @@ export function renderSummaryProjection(basePath: string, milestoneId: string, s
   const evidenceRows = getVerificationEvidence(milestoneId, sliceId, taskId);
   const content = renderSummaryContent(taskRow, sliceId, milestoneId, evidenceRows);
 
-  // Layout-aware: avoid creating a milestones/ directory as a side effect for
-  // flat-phase projects. If milestonesDir() sees a freshly-created milestones/
-  // dir it treats the project as legacy, breaking all subsequent path resolution.
-  const slicePath = resolveSlicePath(basePath, milestoneId, sliceId);
-  const phaseDir = resolveMilestonePath(basePath, milestoneId);
-  let dir: string;
-  if (slicePath && phaseDir && slicePath !== phaseDir) {
-    // Legacy layout: slice has its own slices/SID/ subdir → tasks/ subdir
-    dir = join(slicePath, "tasks");
-  } else if (phaseDir) {
-    // Flat-phase: task summaries go in the phase dir (no tasks/ subdir needed)
-    dir = phaseDir;
-  } else {
-    // Fallback: legacy hardcoded path (milestone dir not on disk yet)
-    dir = join(gsdProjectionRoot(basePath), "milestones", milestoneId, "slices", sliceId, "tasks");
-  }
-  mkdirSync(dir, { recursive: true });
-  atomicWriteSync(join(dir, `${taskId}-SUMMARY.md`), content);
+  const summaryPath = resolveTaskFile(basePath, milestoneId, sliceId, taskId, "SUMMARY")
+    ?? join(basePath, relTaskFile(basePath, milestoneId, sliceId, taskId, "SUMMARY", getMilestone(milestoneId)?.title));
+  mkdirSync(dirname(summaryPath), { recursive: true });
+  atomicWriteSync(summaryPath, content);
 }
 
 // ─── STATE.md Projection ────────────────────────────────────────────────
@@ -536,7 +522,7 @@ export async function regenerateIfMissing(
       filePath = resolveSliceFile(basePath, milestoneId, sliceId, "PLAN") ?? "";
       break;
     case "ROADMAP":
-      filePath = join(basePath, ".gsd", "milestones", milestoneId, `${milestoneId}-ROADMAP.md`);
+      filePath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP") ?? "";
       break;
     case "SUMMARY":
       // For SUMMARY, we regenerate all task summaries in the slice
@@ -553,8 +539,7 @@ export async function regenerateIfMissing(
     const doneTasks = taskRows.filter(t => t.status === "done" || t.status === "complete");
     let regenerated = 0;
     for (const task of doneTasks) {
-      const summaryPath = join(basePath, ".gsd", "milestones", milestoneId, "slices", sliceId, "tasks", `${task.id}-SUMMARY.md`);
-      if (!existsSync(summaryPath)) {
+      if (!resolveTaskFile(basePath, milestoneId, sliceId, task.id, "SUMMARY")) {
         try {
           renderSummaryProjection(basePath, milestoneId, sliceId, task.id);
           regenerated++;
@@ -591,7 +576,7 @@ export async function regenerateIfMissing(
         return !!(resolveSliceFile(basePath, milestoneId, sliceId, "PLAN"));
       case "ROADMAP":
         await renderRoadmapFromDb(basePath, milestoneId);
-        return existsSync(filePath);
+        return !!resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
       case "STATE":
         await renderStateProjection(basePath);
         return existsSync(filePath);

package/src/resources/extensions/gsd/workspace.ts

@@ -2,14 +2,11 @@
 
 import { dirname, join, resolve } from "node:path";
 import {
-  buildMilestoneFileName,
-  canonicalPhaseDirName,
-  isLegacyMilestonesLayout,
-  milestonesDir,
   type GsdPathContract,
   resolveGsdPathContract,
   resolveMilestoneFile,
   resolveMilestonePath,
+  targetMilestoneFile,
   normalizeRealPath,
 } from "./paths.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "./worktree-root.js";
@@ -41,27 +38,14 @@ function tryRealpath(p: string): string {
   return normalizeRealPath(p);
 }
 
-function isLegacyMilestoneDirectory(dir: string): boolean {
-  const parent = dirname(dir);
-  return parent.endsWith("/milestones") || parent.endsWith("\\milestones");
-}
-
 function scopeMilestoneDir(basePath: string, milestoneId: string): string {
-  return resolveMilestonePath(basePath, milestoneId) ?? join(
-    milestonesDir(basePath),
-    isLegacyMilestonesLayout(basePath) ? milestoneId : canonicalPhaseDirName(milestoneId),
-  );
+  return resolveMilestonePath(basePath, milestoneId)
+    ?? dirname(targetMilestoneFile(basePath, milestoneId, "ROADMAP"));
 }
 
 function scopeMilestoneFile(basePath: string, milestoneId: string, suffix: string): string {
-  const existing = resolveMilestoneFile(basePath, milestoneId, suffix);
-  if (existing) return existing;
-
-  const dir = scopeMilestoneDir(basePath, milestoneId);
-  const filename = isLegacyMilestoneDirectory(dir)
-    ? `${milestoneId}-${suffix}.md`
-    : buildMilestoneFileName(milestoneId, suffix);
-  return join(dir, filename);
+  return resolveMilestoneFile(basePath, milestoneId, suffix)
+    ?? targetMilestoneFile(basePath, milestoneId, suffix);
 }
 
 /**

package/src/resources/extensions/shared/gsd-browser-cli.ts

@@ -66,6 +66,30 @@ function splitCommandLine(commandLine: string): string[] {
   });
 }
 
+/**
+ * Extra gsd-browser CLI flags to forward verbatim to the launched daemon, from
+ * GSD_BROWSER_MCP_EXTRA_ARGS. Unlike GSD_BROWSER_MCP_ARGS (a full args override),
+ * these are *appended* to the default `mcp`/`daemon start` invocation so callers
+ * keep the managed session/identity flags. Accepts a JSON array (e.g.
+ * `["--stealth"]`) or a plain, optionally-quoted command-line string
+ * (e.g. `--stealth --browser-path /usr/bin/chromium`). This is the config-level
+ * knob for environments where Chrome needs extra launch flags — e.g. containers
+ * without unprivileged user namespaces, where `--stealth` supplies Chrome's
+ * `--no-sandbox`.
+ */
+function resolveExtraGsdBrowserArgs(env: NodeJS.ProcessEnv): string[] {
+  const raw = env.GSD_BROWSER_MCP_EXTRA_ARGS?.trim();
+  if (!raw) return [];
+  if (raw.startsWith("[")) {
+    const parsed = parseJsonEnv<unknown>(env, "GSD_BROWSER_MCP_EXTRA_ARGS");
+    if (!Array.isArray(parsed)) {
+      throw new Error("GSD_BROWSER_MCP_EXTRA_ARGS JSON must be an array of strings");
+    }
+    return parsed.map(String);
+  }
+  return splitCommandLine(raw);
+}
+
 function buildPathGsdBrowserVersionInvocation(platform: NodeJS.Platform): { command: string; args: string[] } {
   if (platform === "win32") {
     return { command: "cmd", args: ["/d", "/s", "/c", "gsd-browser", "--version"] };
@@ -297,6 +321,10 @@ export function resolveGsdBrowserMcpLaunchConfig(
     || (preferPathCli ? "gsd-browser" : undefined)
     || (bundledCliPath ? process.execPath : undefined)
     || "gsd-browser";
+  // Appended after the managed session/identity flags so they survive the
+  // daemon-start transformation (which forwards everything after `mcp`), letting
+  // callers add extra Chrome/gsd-browser launch flags via one config knob.
+  const extraArgs = resolveExtraGsdBrowserArgs(env);
   const args = Array.isArray(explicitArgs) && explicitArgs.length > 0
     ? explicitArgs.map(String)
     : [
@@ -311,6 +339,7 @@ export function resolveGsdBrowserMcpLaunchConfig(
         identityKey,
         "--identity-project",
         identityProject,
+        ...extraArgs,
       ];
   const cwd = env.GSD_BROWSER_MCP_CWD?.trim() || resolvedProjectRoot;