@opengsd/gsd-pi 1.7.0 → 1.8.1-dev.897b3c90

package/src/resources/extensions/gsd/tests/command-feedback.test.ts

@@ -11,6 +11,7 @@ import {
   notifySmartEntryNeedsInteractiveMenu,
   requiresInteractiveMenu,
 } from "../command-feedback.js";
+import { isBlockedNoticeMessage, isInteractiveMenuUnavailableNotice } from "../stop-notice.js";
 import type { ExtensionCommandContext } from "@gsd/pi-coding-agent";
 
 function makeCtx(overrides: {
@@ -87,6 +88,17 @@ describe("notifyQueueHubNeedsInteractiveMenu", () => {
     assert.match(notes[0]!.message, /\/gsd queue/);
     assert.match(notes[0]!.message, /reorder/i);
   });
+
+  // /gsd queue continues headless with the add-work flow after this notice, so
+  // it must NOT be classified as a blocked dead-end (would exit 10 early). (#1294)
+  it("emits a notice the headless host does not treat as a dead-end", () => {
+    const ctx = makeCtx({ hasUI: false });
+    notifyQueueHubNeedsInteractiveMenu(ctx, "this session has no interactive menu");
+    const notes = (ctx as typeof ctx & { _notifications: Array<{ message: string }> })._notifications;
+    const message = notes[0]!.message.toLowerCase();
+    assert.equal(isInteractiveMenuUnavailableNotice(message), false);
+    assert.equal(isBlockedNoticeMessage(message), false);
+  });
 });
 
 describe("notifyInitNeedsInteractiveMenu", () => {

package/src/resources/extensions/gsd/tests/compat-marker.test.ts

@@ -16,6 +16,9 @@ import {
   EMPTY_MARKER,
   compatMarkerPath,
 } from "../compat/compat-marker.ts";
+import { externalMarkdownEditHandler } from "../state-reconciliation/drift/external-markdown-edit.ts";
+import type { DriftContext } from "../state-reconciliation/types.ts";
+import type { GSDState } from "../types.ts";
 
 const tmpDirs: string[] = [];
 
@@ -188,3 +191,104 @@ test("pruneOrphanedProjectionEntries returns 0 and writes nothing when marker is
   const files = readdirSync(join(base, ".gsd"));
   assert.ok(!files.includes(".compat.json"), "must not create a marker where none existed");
 });
+
+// --- Path-traversal containment (plan 029) ---------------------------------
+//
+// The marker is repo-controlled content whose projection-map keys are joined
+// with basePath and readFileSync'd by the drift detectors. A key that escapes
+// .gsd/ must invalidate the whole marker so readCompatMarker fails safe to the
+// empty marker (detectors see no entries → nothing outside the repo is read).
+
+for (const badKey of ["../outside.md", "/etc/hosts", "C:/x.md", "..\\x.md"]) {
+  test(`readCompatMarker rejects a projection key that escapes the root: ${JSON.stringify(badKey)}`, () => {
+    const base = makeTmpBase();
+    // Write the hostile marker directly (writeCompatMarker does not validate).
+    writeCompatMarker(base, {
+      schema: 2,
+      lastWriter: "gsd-pi",
+      lastProjectedAt: "2026-07-07T00:00:00.000Z",
+      projections: { [badKey]: { sha: "deadbeefdeadbeef", entities: ["m1"] } },
+      piVersion: "1.8.1",
+    });
+
+    const marker = readCompatMarker(base);
+    assert.equal(
+      Object.keys(marker.projections).length,
+      0,
+      "a marker with an escaping key must fall back to the empty marker",
+    );
+  });
+}
+
+test("readCompatMarker preserves legitimate nested projection keys", () => {
+  const base = makeTmpBase();
+  const roadmap = "milestones/M001/M001-ROADMAP.md";
+  const context = "phases/01-foo/01-CONTEXT.md";
+  writeCompatMarker(base, {
+    schema: 2,
+    lastWriter: "gsd-pi",
+    lastProjectedAt: "2026-07-07T00:00:00.000Z",
+    projections: {
+      [roadmap]: { sha: "aaaaaaaaaaaaaaaa", entities: ["M001"] },
+      [context]: { sha: "bbbbbbbbbbbbbbbb", entities: ["P01"] },
+    },
+    planning: { active: false, layout: null, projections: {}, passthrough: {} },
+    piVersion: "1.8.1",
+  });
+
+  const marker = readCompatMarker(base);
+  assert.ok(marker.projections[roadmap], "roadmap key must round-trip");
+  assert.ok(marker.projections[context], "nested phase key must round-trip");
+  assert.equal(Object.keys(marker.projections).length, 2);
+});
+
+test("an escaping key in planning.passthrough also invalidates the whole marker", () => {
+  const base = makeTmpBase();
+  writeCompatMarker(base, {
+    schema: 2,
+    lastWriter: "gsd-pi",
+    lastProjectedAt: "2026-07-07T00:00:00.000Z",
+    projections: {},
+    planning: {
+      active: true,
+      layout: "flat-phases",
+      projections: {},
+      passthrough: { "../../secret.md": { sha: "cccccccccccccccc", entities: [] } },
+    },
+    piVersion: "1.8.1",
+  });
+
+  const marker = readCompatMarker(base);
+  assert.equal(Object.keys(marker.projections).length, 0);
+  assert.equal(marker.planning!.active, false, "planning falls back to inactive default");
+});
+
+test("hostile marker makes the drift detector read nothing outside the project", async () => {
+  const base = makeTmpBase();
+  // Sentinel lives OUTSIDE the project dir; a `../` traversal from .gsd/ would
+  // reach it if the key were trusted.
+  const sentinelDir = mkdtempSync(join(tmpdir(), `gsd-sentinel-${randomUUID()}`));
+  tmpDirs.push(sentinelDir);
+  const sentinelName = "known_hosts";
+  writeFileSync(join(sentinelDir, sentinelName), "SECRET\n", "utf-8");
+  const escapeKey = `../../${sentinelName}`; // e.g. ../../known_hosts
+
+  writeCompatMarker(base, {
+    schema: 2,
+    lastWriter: "gsd-pi",
+    lastProjectedAt: "2026-07-07T00:00:00.000Z",
+    projections: { [escapeKey]: { sha: "0000000000000000", entities: ["m1"] } },
+    piVersion: "1.8.1",
+  });
+
+  const stubState = { phase: "idle" } as unknown as GSDState;
+  const ctx: DriftContext = { basePath: base, state: stubState };
+
+  // Must not throw and must not emit a record referencing the sentinel.
+  const drift = await externalMarkdownEditHandler.detect(stubState, ctx);
+  assert.equal(drift.length, 0, "no drift record from a rejected hostile marker");
+  assert.ok(
+    !drift.some((d) => d.projectionPath.includes(sentinelName)),
+    "detector must not reference the out-of-project sentinel",
+  );
+});

package/src/resources/extensions/gsd/tests/complete-task.test.ts

@@ -17,6 +17,7 @@ import {
   insertVerificationEvidence,
   insertGateRow,
   getGateResults,
+  saveReworkBrief,
   updateMilestoneStatus,
   updateSliceStatus,
   SCHEMA_VERSION,
@@ -507,6 +508,77 @@ console.log('\n=== complete-task: disabled hard-blocker escalation rolls back co
   cleanup(dbPath);
 }
 
+// ═══════════════════════════════════════════════════════════════════════════
+// complete-task: rollback reverts applied rework resolutions
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('\n=== complete-task: rollback reverts applied rework resolutions ===');
+{
+  const dbPath = tempDbPath();
+  openDatabase(dbPath);
+
+  const { basePath } = createTempProject();
+  writeProjectPreferences(basePath, 'phases:\n  mid_execution_escalation: false\n');
+
+  insertMilestone({ id: 'M001', title: 'Test Milestone' });
+  insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Test Slice' });
+  insertTask({ id: 'T01', sliceId: 'S01', milestoneId: 'M001', title: 'Test task', status: 'pending' });
+  saveReworkBrief({
+    briefId: 'RB-001',
+    milestoneId: 'M001',
+    sliceId: 'S01',
+    taskId: 'T01',
+    findings: [{
+      findingId: 'F1',
+      severity: 'blocking',
+      description: 'Compile regression',
+      requiredFix: 'Fix compile error',
+      verificationCommands: ['pnpm run typecheck:extensions'],
+    }],
+  });
+
+  // Completion resolves the blocking finding but then rolls back because the
+  // hard-blocker escalation is disabled. The rollback must also revert the
+  // finding. Otherwise a retry would see no unresolved blocking findings and
+  // silently skip the blocking gate.
+  const result = await withWorkingDirectory(basePath, () => handleCompleteTask({
+    ...makeValidParams(),
+    blockerDiscovered: true,
+    reworkResolution: [{
+      findingId: 'F1',
+      status: 'resolved',
+      evidence: 'Fixed compile error and reran pnpm run typecheck:extensions.',
+    }],
+    escalation: {
+      question: 'Should execution pause for the hard blocker?',
+      options: makeEscalationOptions(),
+      recommendation: 'pause',
+      recommendationRationale: 'The blocker should not be silently advanced.',
+      continueWithDefault: false,
+    },
+  }, basePath));
+
+  assertTrue('error' in result, 'completion should roll back when hard-blocker escalation is disabled');
+  assertEq(getTask('M001', 'S01', 'T01')?.status, 'pending', 'task status should roll back to pending');
+
+  const finding = _getAdapter()!.prepare(
+    "SELECT status, evidence, decision_ref FROM rework_brief_findings WHERE brief_id = 'RB-001' AND finding_id = 'F1'"
+  ).get() as { status: string; evidence: string; decision_ref: string };
+  assertEq(finding.status, 'pending', 'rework finding should revert to pending after rollback');
+  assertEq(finding.evidence, '', 'rework finding evidence should be cleared after rollback');
+
+  // Retry-safety invariant: the blocking gate must fire again because the
+  // finding is unresolved once more.
+  const retry = await withWorkingDirectory(basePath, () => handleCompleteTask(makeValidParams(), basePath));
+  assertTrue('error' in retry, 'retry without reworkResolution should be blocked again');
+  if ('error' in retry) {
+    assertMatch(retry.error, /unresolved blocking rework finding/i, 'retry should re-trigger the blocking gate');
+  }
+
+  cleanupDir(basePath);
+  cleanup(dbPath);
+}
+
 // ═══════════════════════════════════════════════════════════════════════════
 // complete-task: soft escalation with mid-execution escalation disabled
 // ═══════════════════════════════════════════════════════════════════════════
@@ -838,6 +910,220 @@ console.log('\n=== complete-task: closes Q5/Q6/Q7 gates (pass vs omitted) ===');
   cleanup(dbPath);
 }
 
+
+// ═══════════════════════════════════════════════════════════════════════════
+// complete-task: unresolved blocking rework findings reject completion
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('\n=== complete-task: rejects unresolved blocking rework findings ===');
+{
+  const dbPath = tempDbPath();
+  openDatabase(dbPath);
+  const { basePath } = createTempProject();
+
+  insertMilestone({ id: 'M001', title: 'Test Milestone' });
+  insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Test Slice' });
+  insertTask({ id: 'T01', sliceId: 'S01', milestoneId: 'M001', title: 'Test task', status: 'pending' });
+
+  saveReworkBrief({
+    briefId: 'RB-001',
+    milestoneId: 'M001',
+    sliceId: 'S01',
+    taskId: 'T01',
+    findings: [{
+      findingId: 'F1',
+      severity: 'blocking',
+      description: 'Compile regression',
+      requiredFix: 'Fix compile error',
+      verificationCommands: ['pnpm run typecheck:extensions'],
+    }],
+  });
+
+  const result = await handleCompleteTask(makeValidParams(), basePath);
+  assertTrue('error' in result, 'completion should reject unresolved blocking rework findings');
+  if ('error' in result) {
+    assertMatch(result.error, /unresolved blocking rework finding/i, 'error should explain unresolved rework');
+    assertMatch(result.error, /F1/, 'error should name the unresolved finding id');
+  }
+
+  cleanupDir(basePath);
+  cleanup(dbPath);
+}
+
+
+console.log('\n=== complete-task: accepts resolved blocking rework evidence ===');
+{
+  const dbPath = tempDbPath();
+  openDatabase(dbPath);
+  const { basePath } = createTempProject();
+
+  insertMilestone({ id: 'M001', title: 'Test Milestone' });
+  insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Test Slice' });
+  insertTask({ id: 'T01', sliceId: 'S01', milestoneId: 'M001', title: 'Test task', status: 'pending' });
+  saveReworkBrief({
+    briefId: 'RB-001',
+    milestoneId: 'M001',
+    sliceId: 'S01',
+    taskId: 'T01',
+    findings: [{
+      findingId: 'F1',
+      severity: 'blocking',
+      description: 'Compile regression',
+      requiredFix: 'Fix compile error',
+      verificationCommands: ['pnpm run typecheck:extensions'],
+    }],
+  });
+
+  const result = await handleCompleteTask({
+    ...makeValidParams(),
+    reworkResolution: [{
+      findingId: 'F1',
+      status: 'resolved',
+      evidence: 'Fixed compile error and reran pnpm run typecheck:extensions.',
+    }],
+  }, basePath);
+
+  assertTrue(!('error' in result), 'completion should accept resolved blocking rework evidence');
+  assertEq(getTask('M001', 'S01', 'T01')?.status, 'complete', 'task should complete after resolving rework');
+  const finding = _getAdapter()!.prepare("SELECT status, evidence FROM rework_brief_findings WHERE brief_id = 'RB-001' AND finding_id = 'F1'").get() as { status: string; evidence: string };
+  assertEq(finding.status, 'resolved', 'finding status should be updated');
+  assertMatch(finding.evidence, /Fixed compile error/, 'resolution evidence should be persisted');
+
+  cleanupDir(basePath);
+  cleanup(dbPath);
+}
+
+console.log('\n=== complete-task: accepts deferred blocking rework with decision reference ===');
+{
+  const dbPath = tempDbPath();
+  openDatabase(dbPath);
+  const { basePath } = createTempProject();
+
+  insertMilestone({ id: 'M001', title: 'Test Milestone' });
+  insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Test Slice' });
+  insertTask({ id: 'T01', sliceId: 'S01', milestoneId: 'M001', title: 'Test task', status: 'pending' });
+  saveReworkBrief({
+    briefId: 'RB-001',
+    milestoneId: 'M001',
+    sliceId: 'S01',
+    taskId: 'T01',
+    findings: [{
+      findingId: 'F1',
+      severity: 'blocking',
+      description: 'Compile regression',
+      requiredFix: 'Fix compile error',
+      verificationCommands: ['pnpm run typecheck:extensions'],
+    }],
+  });
+
+  const result = await handleCompleteTask({
+    ...makeValidParams(),
+    reworkResolution: [{
+      findingId: 'F1',
+      status: 'deferred-with-override',
+      evidence: 'Maintainer accepted temporary deferral.',
+      decisionRef: 'DEC-2026-07-07-rework-deferral',
+    }],
+  }, basePath);
+
+  assertTrue(!('error' in result), 'completion should accept deferred blocking rework with decision reference');
+  const finding = _getAdapter()!.prepare("SELECT status, decision_ref FROM rework_brief_findings WHERE brief_id = 'RB-001' AND finding_id = 'F1'").get() as { status: string; decision_ref: string };
+  assertEq(finding.status, 'deferred-with-override', 'finding status should record the override');
+  assertEq(finding.decision_ref, 'DEC-2026-07-07-rework-deferral', 'decision reference should be persisted');
+
+  cleanupDir(basePath);
+  cleanup(dbPath);
+}
+
+console.log('\n=== complete-task: invalid duplicate rework resolution cannot overwrite a valid one ===');
+{
+  const dbPath = tempDbPath();
+  openDatabase(dbPath);
+  const { basePath } = createTempProject();
+
+  insertMilestone({ id: 'M001', title: 'Test Milestone' });
+  insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Test Slice' });
+  insertTask({ id: 'T01', sliceId: 'S01', milestoneId: 'M001', title: 'Test task', status: 'pending' });
+  saveReworkBrief({
+    briefId: 'RB-001',
+    milestoneId: 'M001',
+    sliceId: 'S01',
+    taskId: 'T01',
+    findings: [{
+      findingId: 'F1',
+      severity: 'blocking',
+      description: 'Compile regression',
+      requiredFix: 'Fix compile error',
+      verificationCommands: ['pnpm run typecheck:extensions'],
+    }],
+  });
+
+  // The guard admits F1 because a satisfying entry exists, but a later
+  // non-satisfying duplicate for the same finding must NOT overwrite the valid
+  // resolution and leave F1 resolved with no evidence.
+  const result = await handleCompleteTask({
+    ...makeValidParams(),
+    reworkResolution: [
+      { findingId: 'F1', status: 'resolved', evidence: 'Fixed compile error and reran pnpm run typecheck:extensions.' },
+      { findingId: 'F1', status: 'resolved', evidence: '' },
+    ],
+  }, basePath);
+
+  assertTrue(!('error' in result), 'completion should succeed on the valid resolution');
+  const finding = _getAdapter()!.prepare(
+    "SELECT status, evidence FROM rework_brief_findings WHERE brief_id = 'RB-001' AND finding_id = 'F1'"
+  ).get() as { status: string; evidence: string };
+  assertEq(finding.status, 'resolved', 'finding should remain resolved');
+  assertMatch(finding.evidence, /Fixed compile error/, 'valid evidence must survive the invalid duplicate');
+
+  cleanupDir(basePath);
+  cleanup(dbPath);
+}
+
+console.log('\n=== complete-task: invalid deferred duplicate cannot strip decisionRef ===');
+{
+  const dbPath = tempDbPath();
+  openDatabase(dbPath);
+  const { basePath } = createTempProject();
+
+  insertMilestone({ id: 'M001', title: 'Test Milestone' });
+  insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Test Slice' });
+  insertTask({ id: 'T01', sliceId: 'S01', milestoneId: 'M001', title: 'Test task', status: 'pending' });
+  saveReworkBrief({
+    briefId: 'RB-001',
+    milestoneId: 'M001',
+    sliceId: 'S01',
+    taskId: 'T01',
+    findings: [{
+      findingId: 'F1',
+      severity: 'blocking',
+      description: 'Compile regression',
+      requiredFix: 'Fix compile error',
+      verificationCommands: ['pnpm run typecheck:extensions'],
+    }],
+  });
+
+  // A deferred-with-override duplicate that omits decisionRef is non-satisfying
+  // and must not overwrite the valid deferral.
+  const result = await handleCompleteTask({
+    ...makeValidParams(),
+    reworkResolution: [
+      { findingId: 'F1', status: 'deferred-with-override', evidence: 'Maintainer accepted temporary deferral.', decisionRef: 'DEC-2026-07-07-rework-deferral' },
+      { findingId: 'F1', status: 'deferred-with-override', evidence: 'Maintainer accepted temporary deferral.' },
+    ],
+  }, basePath);
+
+  assertTrue(!('error' in result), 'completion should succeed on the valid deferral');
+  const finding = _getAdapter()!.prepare(
+    "SELECT status, decision_ref FROM rework_brief_findings WHERE brief_id = 'RB-001' AND finding_id = 'F1'"
+  ).get() as { status: string; decision_ref: string };
+  assertEq(finding.status, 'deferred-with-override', 'finding should remain deferred-with-override');
+  assertEq(finding.decision_ref, 'DEC-2026-07-07-rework-deferral', 'valid decisionRef must survive the invalid duplicate');
+
+  cleanupDir(basePath);
+  cleanup(dbPath);
+}
+
 // ═══════════════════════════════════════════════════════════════════════════
 
 report();

package/src/resources/extensions/gsd/tests/db-authority-regression.test.ts

@@ -17,7 +17,7 @@ import {
   openDatabase,
 } from "../gsd-db.ts";
 import { migrateHierarchyToDb } from "../md-importer.ts";
-import { checkMarkdownHierarchyAgainstDb } from "../migration-auto-check.ts";
+import { checkMarkdownHierarchyAgainstDb, countMarkdownHierarchy } from "../migration-auto-check.ts";
 import { queryDecisions } from "../context-store.ts";
 import { deriveStateFromDb, invalidateStateCache } from "../state.ts";
 import type { Requirement } from "../types.ts";
@@ -206,3 +206,78 @@ test("explicit markdown import remains opt-in and is not run by startup mismatch
   assert.equal(getAllMilestones().length, 1);
   assert.equal(getSliceTasks("M001", "S01").length, 1);
 });
+
+// #1286: migrateHierarchyToDb skips a `[sketch]` slice's stub PLAN tasks, so
+// scanMarkdownHierarchy must skip counting them too. Otherwise the markdown
+// scan claims task rows the DB authoritatively omits, and the startup drift
+// check perpetually reports recovery-required / recommends
+// `/gsd recover --confirm` — which re-skips the stub tasks and never converges.
+test("sketch slice stub tasks are not treated as markdown/DB drift", async (t) => {
+  const base = makeBase();
+  t.after(() => cleanup(base));
+
+  const milestoneDir = join(base, ".gsd", "milestones", "M001");
+  const sketchSliceDir = join(milestoneDir, "slices", "S01");
+  const realSliceDir = join(milestoneDir, "slices", "S02");
+  mkdirSync(sketchSliceDir, { recursive: true });
+  mkdirSync(realSliceDir, { recursive: true });
+
+  // S01 is a sketch (badge before risk, per ADR-011 render); S02 is refined.
+  writeFileSync(
+    join(milestoneDir, "M001-ROADMAP.md"),
+    [
+      "# M001: Sketch Drift",
+      "",
+      "**Vision:** Sketch stub tasks must not count as drift",
+      "",
+      "## Slices",
+      "- [ ] **S01: Sketch Slice** `[sketch]` `risk:low` `depends:[]`",
+      "  > After this: Sketch decomposed.",
+      "",
+      "- [ ] **S02: Real Slice** `risk:low` `depends:[]`",
+      "  > After this: Real work done.",
+      "",
+    ].join("\n"),
+  );
+  // The sketch slice still carries a stub PLAN with a placeholder <tasks> block.
+  writeFileSync(
+    join(sketchSliceDir, "S01-PLAN.md"),
+    [
+      "# S01: Sketch Slice",
+      "",
+      "**Goal:** Placeholder.",
+      "",
+      "## Tasks",
+      "- [ ] **T01: Plan 01**",
+      "  Stub placeholder task.",
+      "",
+    ].join("\n"),
+  );
+  writeFileSync(
+    join(realSliceDir, "S02-PLAN.md"),
+    [
+      "# S02: Real Slice",
+      "",
+      "**Goal:** Real work.",
+      "",
+      "## Tasks",
+      "- [ ] **T01: Task** `est:5m`",
+      "",
+    ].join("\n"),
+  );
+
+  openProjectDb(base);
+  // The importer seeds S02's task but skips S01's stub (1 task total).
+  const imported = migrateHierarchyToDb(base);
+  assert.deepEqual(imported, { milestones: 1, slices: 2, tasks: 1 });
+  assert.equal(getSliceTasks("M001", "S01").length, 0, "sketch slice seeds no tasks");
+  assert.equal(getSliceTasks("M001", "S02").length, 1, "real slice seeds its task");
+
+  // The markdown scan must mirror the importer: the sketch stub task is not
+  // counted, so markdown (1 task) matches the DB (1 task) and the check is
+  // in-sync rather than recommending a recover that would never converge.
+  assert.deepEqual(countMarkdownHierarchy(base), { milestones: 1, slices: 2, tasks: 1 });
+  const check = await checkMarkdownHierarchyAgainstDb(base);
+  assert.equal(check.action, "none", "sketch stub tasks must not be flagged as drift");
+  assert.equal(check.reason, "in-sync");
+});