@opengsd/gsd-pi 1.8.1 → 1.9.0-dev.5c1a3ff2

package/src/resources/extensions/gsd/tests/auto-artifact-paths.test.ts

@@ -442,11 +442,11 @@ test("bare milestone id still falls back to a lone team-suffix projection (#1195
 // ── #1208: flat-phase execute-task summaries resolve at the phase root ────────
 //
 // In flat-phase layout task summaries are written beside the plan files
-// (phases/<phase>/T##-SUMMARY.md), NOT under a tasks/ subdir. A tasks/ dir may
-// still exist to hold auxiliary task-scoped gate artifacts (e.g. T01-VERIFY.json).
+// (phases/<phase>/S##-T##-SUMMARY.md), NOT under a tasks/ subdir. A tasks/ dir
+// may still exist to hold auxiliary task-scoped gate artifacts (e.g. T01-VERIFY.json).
 // Before the fix, the mere existence of that tasks/ dir redirected summary
-// verification into tasks/T##-SUMMARY.md — which never exists — trapping auto-mode
-// in a false verification retry that eventually paused after a successful task.
+// verification into tasks/S##-T##-SUMMARY.md — which never exists — trapping
+// auto-mode in a false verification retry after a successful task.
 
 test("flat-phase execute-task summary resolves at phase root when no tasks/ dir exists (#1208)", () => {
   const root = realpathSync(mkdtempSync(join(tmpdir(), "gsd-flat-task-summary-")));
@@ -461,7 +461,7 @@ test("flat-phase execute-task summary resolves at phase root when no tasks/ dir
 
     assert.equal(
       resolveExpectedArtifactPath("execute-task", "M049/S03/T02", root),
-      join(phaseDir, "T02-SUMMARY.md"),
+      join(phaseDir, "S03-T02-SUMMARY.md"),
     );
   } finally {
     _clearGsdRootCache();
@@ -489,12 +489,12 @@ test("flat-phase execute-task summary resolves at phase root even when tasks/ di
     const resolved = resolveExpectedArtifactPath("execute-task", "M049/S03/T02", root);
     assert.equal(
       resolved,
-      join(phaseDir, "T02-SUMMARY.md"),
+      join(phaseDir, "S03-T02-SUMMARY.md"),
       "flat-phase task summary must resolve at the phase root, not tasks/",
     );
     assert.notEqual(
       resolved,
-      join(tasksDir, "T02-SUMMARY.md"),
+      join(tasksDir, "S03-T02-SUMMARY.md"),
       "a tasks/ dir with gate artifacts must NOT redirect summary resolution into tasks/",
     );
   } finally {

package/src/resources/extensions/gsd/tests/auto-recovery.test.ts

@@ -1218,6 +1218,10 @@ test("hasImplementationArtifacts finds integration implementation-only commits w
 
     execFileSync("git", ["checkout", "-b", "milestone/M001"], { cwd: base, stdio: "ignore" });
     writeIntegrationBranch(base, "M001", "main");
+    // ADR-045: writeIntegrationBranch no longer creates milestones/<MID>/ as a
+    // side effect (META is now flat at .gsd/<MID>-META.json), so scaffold the
+    // legacy summary dir explicitly.
+    mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
     writeFileSync(join(base, ".gsd", "milestones", "M001", "M001-SUMMARY.md"), "# Milestone Summary\nDone.");
     execFileSync("git", ["add", "."], { cwd: base, stdio: "ignore" });
     execFileSync("git", ["commit", "-m", "chore: auto-commit after complete-milestone\n\nGSD-Unit: M001"], { cwd: base, stdio: "ignore" });
@@ -2063,6 +2067,41 @@ test("#1088: writeReactiveExecuteBlocker preserves deferred batch task statuses"
   }
 });
 
+test("#1343: writeReactiveExecuteBlocker uses slice-qualified summaries in flat-phase (no cross-slice collision)", () => {
+  const base = join(tmpdir(), `gsd-test-${randomUUID()}`);
+  try {
+    // Flat-phase layout: slices S01 and S02 share the phase dir and reuse task
+    // id T03. Only the sibling slice S01 produced a summary.
+    const phaseDir = join(base, ".gsd", "phases", "01-test");
+    mkdirSync(phaseDir, { recursive: true });
+    writeFileSync(join(phaseDir, "01-01-PLAN.md"), "# S01: First\n", "utf-8");
+    writeFileSync(join(phaseDir, "01-02-PLAN.md"), "# S02: Second\n", "utf-8");
+    writeFileSync(join(phaseDir, "S01-T03-SUMMARY.md"), "# S01 T03 Summary\n", "utf-8");
+
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    insertMilestone({ id: "M001", title: "Milestone", status: "active" });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "First", status: "pending" });
+    insertSlice({ id: "S02", milestoneId: "M001", title: "Second", status: "pending" });
+    insertTask({ id: "T03", milestoneId: "M001", sliceId: "S02", title: "Shared id", status: "pending" });
+
+    const recovery = writeReactiveExecuteBlocker(
+      "M001/S02/reactive+T03",
+      base,
+      "verification retries exhausted",
+    );
+
+    assert.ok(recovery, "recovery should run with DB available");
+    // S02 never wrote S02-T03-SUMMARY.md; the sibling S01-T03-SUMMARY.md must
+    // NOT make S02/T03 look complete. It has to be skipped.
+    assert.deepEqual(recovery!.completedTaskIds, []);
+    assert.deepEqual(recovery!.skippedTaskIds, ["T03"]);
+    assert.equal(getTask("M001", "S02", "T03")?.status, "skipped");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
 test("#4414: verifyExpectedArtifact parallel-research succeeds when all research-ready slices have RESEARCH", () => {
   const base = makeTmpBase();
   try {

package/src/resources/extensions/gsd/tests/before-provider-context-management.test.ts

@@ -143,3 +143,58 @@ test("successful shell result clears source context before provider injection",
   assert.equal(payload.messages.length, 1);
   assert.doesNotMatch(payload.messages[0].content[0].text, /Source Context Block/);
 });
+
+test("before_provider_request keeps only the latest GSD context injection across a 5-turn session", async (t) => {
+  const dir = mkdtempSync(join(tmpdir(), "gsd-before-provider-injections-"));
+  const gsdHome = join(dir, "home");
+  const project = join(dir, "project");
+  const previousCwd = process.cwd();
+  const previousGsdHome = process.env.GSD_HOME;
+
+  mkdirSync(join(project, ".gsd"), { recursive: true });
+  mkdirSync(gsdHome, { recursive: true });
+  process.env.GSD_HOME = gsdHome;
+  process.chdir(project);
+  _setAutoActiveForTest(false);
+
+  t.after(() => {
+    _setAutoActiveForTest(false);
+    process.chdir(previousCwd);
+    if (previousGsdHome === undefined) delete process.env.GSD_HOME;
+    else process.env.GSD_HOME = previousGsdHome;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  const beforeProviderRequest = requireHook(createHookHandlers(), "before_provider_request");
+
+  const sentinel = "[GSD Context Injection]";
+  const contextInjection = (turn: number) => ({
+    role: "user",
+    content: [{ type: "text", text: `${sentinel}\n[MEMORY] turn=${turn}` }],
+  });
+
+  const payload = {
+    messages: [
+      { role: "user", content: [{ type: "text", text: "turn 1" }] },
+      contextInjection(1),
+      { role: "assistant", content: [{ type: "text", text: "r1" }] },
+      { role: "user", content: [{ type: "text", text: "turn 2" }] },
+      contextInjection(2),
+      { role: "assistant", content: [{ type: "text", text: "r2" }] },
+      { role: "user", content: [{ type: "text", text: "turn 3" }] },
+      contextInjection(3),
+      { role: "assistant", content: [{ type: "text", text: "r3" }] },
+      { role: "user", content: [{ type: "text", text: "turn 4" }] },
+      contextInjection(4),
+      { role: "assistant", content: [{ type: "text", text: "r4" }] },
+      { role: "user", content: [{ type: "text", text: "turn 5" }] },
+      contextInjection(5),
+    ],
+  };
+
+  await beforeProviderRequest({ payload });
+
+  const survivors = (payload.messages as any[]).filter((m) => (m.content?.[0]?.text ?? "").startsWith(sentinel));
+  assert.equal(survivors.length, 1);
+  assert.match(survivors[0].content[0].text, /turn=5/);
+});

package/src/resources/extensions/gsd/tests/closeout-git-deferral.test.ts

@@ -3,8 +3,14 @@
 
 import test from "node:test";
 import assert from "node:assert/strict";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
 
-import { shouldDeferCloseoutGitAction } from "../auto-post-unit.ts";
+import { postUnitPreVerification, shouldDeferCloseoutGitAction, type PostUnitContext } from "../auto-post-unit.ts";
+import { AutoSession } from "../auto/session.ts";
+import { closeDatabase, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, openDatabase } from "../gsd-db.ts";
+import { recordToolCall, recordToolResult, resetEvidence } from "../safety/evidence-collector.ts";
+import { cleanup, git, makeTempRepo } from "./test-utils.ts";
 
 test("execute-task defers closeout git action until verification passes", () => {
   assert.equal(shouldDeferCloseoutGitAction("execute-task"), true);
@@ -14,3 +20,92 @@ test("non execute-task units keep pre-verification closeout git action", () => {
   assert.equal(shouldDeferCloseoutGitAction("plan-slice"), false);
   assert.equal(shouldDeferCloseoutGitAction("complete-slice"), false);
 });
+
+test("blocking evidence-xref commits deferred execute-task work before pausing", async () => {
+  const base = makeTempRepo("gsd-evidence-xref-commit-before-pause-");
+
+  try {
+    writeFileSync(join(base, ".gitignore"), ".gsd/\n");
+    git(base, "add", ".gitignore");
+    git(base, "commit", "-m", "chore: ignore gsd runtime");
+
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Milestone", status: "active" });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "Slice", status: "active" });
+    insertTask({
+      id: "T01",
+      sliceId: "S01",
+      milestoneId: "M001",
+      title: "Add app entrypoint",
+      status: "complete",
+      oneLiner: "Added app entrypoint",
+      keyFiles: ["app.js"],
+      planning: {
+        description: "Create app entrypoint",
+        estimate: "small",
+        files: ["app.js"],
+        verify: "npm test",
+        inputs: [],
+        expectedOutput: ["app.js"],
+        observabilityImpact: "none",
+      },
+    });
+    insertVerificationEvidence({
+      taskId: "T01",
+      sliceId: "S01",
+      milestoneId: "M001",
+      command: "npm test",
+      exitCode: 0,
+      verdict: "passed",
+      durationMs: 10,
+    });
+
+    writeFileSync(join(base, "app.js"), "console.log('ready');\n");
+    resetEvidence();
+    recordToolCall("call-1", "bash", { command: "npm test" });
+    recordToolResult("call-1", "bash", "Command exited with code 1\nfailed\n", true);
+
+    const s = new AutoSession();
+    s.active = true;
+    s.basePath = base;
+    s.currentUnit = { type: "execute-task", id: "M001/S01/T01", startedAt: Date.now() };
+
+    let pauseCalled = false;
+    const notifications: string[] = [];
+    const pctx: PostUnitContext = {
+      s,
+      ctx: {
+        ui: { notify: (message: string) => notifications.push(message) },
+      } as unknown as PostUnitContext["ctx"],
+      pi: {} as PostUnitContext["pi"],
+      buildSnapshotOpts: () => ({}),
+      lockBase: () => base,
+      stopAuto: async () => {},
+      pauseAuto: async () => {
+        pauseCalled = true;
+        assert.equal(git(base, "status", "--short"), "", "task work must be committed before pauseAuto runs");
+      },
+      updateProgressWidget: () => {},
+    };
+
+    const result = await postUnitPreVerification(pctx, {
+      skipSettleDelay: true,
+      skipWorktreeSync: true,
+    });
+
+    assert.equal(result, "dispatched");
+    assert.equal(pauseCalled, true);
+    assert.ok(
+      notifications.some((message) => message.includes("claimed passing verification")),
+      `expected evidence-xref notification, got: ${notifications.join("\n")}`,
+    );
+
+    const commitMessage = git(base, "log", "-1", "--pretty=%B");
+    assert.match(commitMessage, /^feat: Added app entrypoint/m);
+    assert.match(commitMessage, /GSD-Task: S01\/T01/);
+  } finally {
+    resetEvidence();
+    closeDatabase();
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/command-feedback.test.ts

@@ -11,6 +11,7 @@ import {
   notifySmartEntryNeedsInteractiveMenu,
   requiresInteractiveMenu,
 } from "../command-feedback.js";
+import { isBlockedNoticeMessage, isInteractiveMenuUnavailableNotice } from "../stop-notice.js";
 import type { ExtensionCommandContext } from "@gsd/pi-coding-agent";
 
 function makeCtx(overrides: {
@@ -87,6 +88,17 @@ describe("notifyQueueHubNeedsInteractiveMenu", () => {
     assert.match(notes[0]!.message, /\/gsd queue/);
     assert.match(notes[0]!.message, /reorder/i);
   });
+
+  // /gsd queue continues headless with the add-work flow after this notice, so
+  // it must NOT be classified as a blocked dead-end (would exit 10 early). (#1294)
+  it("emits a notice the headless host does not treat as a dead-end", () => {
+    const ctx = makeCtx({ hasUI: false });
+    notifyQueueHubNeedsInteractiveMenu(ctx, "this session has no interactive menu");
+    const notes = (ctx as typeof ctx & { _notifications: Array<{ message: string }> })._notifications;
+    const message = notes[0]!.message.toLowerCase();
+    assert.equal(isInteractiveMenuUnavailableNotice(message), false);
+    assert.equal(isBlockedNoticeMessage(message), false);
+  });
 });
 
 describe("notifyInitNeedsInteractiveMenu", () => {

package/src/resources/extensions/gsd/tests/compat-marker.test.ts

@@ -16,6 +16,9 @@ import {
   EMPTY_MARKER,
   compatMarkerPath,
 } from "../compat/compat-marker.ts";
+import { externalMarkdownEditHandler } from "../state-reconciliation/drift/external-markdown-edit.ts";
+import type { DriftContext } from "../state-reconciliation/types.ts";
+import type { GSDState } from "../types.ts";
 
 const tmpDirs: string[] = [];
 
@@ -188,3 +191,104 @@ test("pruneOrphanedProjectionEntries returns 0 and writes nothing when marker is
   const files = readdirSync(join(base, ".gsd"));
   assert.ok(!files.includes(".compat.json"), "must not create a marker where none existed");
 });
+
+// --- Path-traversal containment (plan 029) ---------------------------------
+//
+// The marker is repo-controlled content whose projection-map keys are joined
+// with basePath and readFileSync'd by the drift detectors. A key that escapes
+// .gsd/ must invalidate the whole marker so readCompatMarker fails safe to the
+// empty marker (detectors see no entries → nothing outside the repo is read).
+
+for (const badKey of ["../outside.md", "/etc/hosts", "C:/x.md", "..\\x.md"]) {
+  test(`readCompatMarker rejects a projection key that escapes the root: ${JSON.stringify(badKey)}`, () => {
+    const base = makeTmpBase();
+    // Write the hostile marker directly (writeCompatMarker does not validate).
+    writeCompatMarker(base, {
+      schema: 2,
+      lastWriter: "gsd-pi",
+      lastProjectedAt: "2026-07-07T00:00:00.000Z",
+      projections: { [badKey]: { sha: "deadbeefdeadbeef", entities: ["m1"] } },
+      piVersion: "1.8.1",
+    });
+
+    const marker = readCompatMarker(base);
+    assert.equal(
+      Object.keys(marker.projections).length,
+      0,
+      "a marker with an escaping key must fall back to the empty marker",
+    );
+  });
+}
+
+test("readCompatMarker preserves legitimate nested projection keys", () => {
+  const base = makeTmpBase();
+  const roadmap = "milestones/M001/M001-ROADMAP.md";
+  const context = "phases/01-foo/01-CONTEXT.md";
+  writeCompatMarker(base, {
+    schema: 2,
+    lastWriter: "gsd-pi",
+    lastProjectedAt: "2026-07-07T00:00:00.000Z",
+    projections: {
+      [roadmap]: { sha: "aaaaaaaaaaaaaaaa", entities: ["M001"] },
+      [context]: { sha: "bbbbbbbbbbbbbbbb", entities: ["P01"] },
+    },
+    planning: { active: false, layout: null, projections: {}, passthrough: {} },
+    piVersion: "1.8.1",
+  });
+
+  const marker = readCompatMarker(base);
+  assert.ok(marker.projections[roadmap], "roadmap key must round-trip");
+  assert.ok(marker.projections[context], "nested phase key must round-trip");
+  assert.equal(Object.keys(marker.projections).length, 2);
+});
+
+test("an escaping key in planning.passthrough also invalidates the whole marker", () => {
+  const base = makeTmpBase();
+  writeCompatMarker(base, {
+    schema: 2,
+    lastWriter: "gsd-pi",
+    lastProjectedAt: "2026-07-07T00:00:00.000Z",
+    projections: {},
+    planning: {
+      active: true,
+      layout: "flat-phases",
+      projections: {},
+      passthrough: { "../../secret.md": { sha: "cccccccccccccccc", entities: [] } },
+    },
+    piVersion: "1.8.1",
+  });
+
+  const marker = readCompatMarker(base);
+  assert.equal(Object.keys(marker.projections).length, 0);
+  assert.equal(marker.planning!.active, false, "planning falls back to inactive default");
+});
+
+test("hostile marker makes the drift detector read nothing outside the project", async () => {
+  const base = makeTmpBase();
+  // Sentinel lives OUTSIDE the project dir; a `../` traversal from .gsd/ would
+  // reach it if the key were trusted.
+  const sentinelDir = mkdtempSync(join(tmpdir(), `gsd-sentinel-${randomUUID()}`));
+  tmpDirs.push(sentinelDir);
+  const sentinelName = "known_hosts";
+  writeFileSync(join(sentinelDir, sentinelName), "SECRET\n", "utf-8");
+  const escapeKey = `../../${sentinelName}`; // e.g. ../../known_hosts
+
+  writeCompatMarker(base, {
+    schema: 2,
+    lastWriter: "gsd-pi",
+    lastProjectedAt: "2026-07-07T00:00:00.000Z",
+    projections: { [escapeKey]: { sha: "0000000000000000", entities: ["m1"] } },
+    piVersion: "1.8.1",
+  });
+
+  const stubState = { phase: "idle" } as unknown as GSDState;
+  const ctx: DriftContext = { basePath: base, state: stubState };
+
+  // Must not throw and must not emit a record referencing the sentinel.
+  const drift = await externalMarkdownEditHandler.detect(stubState, ctx);
+  assert.equal(drift.length, 0, "no drift record from a rejected hostile marker");
+  assert.ok(
+    !drift.some((d) => d.projectionPath.includes(sentinelName)),
+    "detector must not reference the out-of-project sentinel",
+  );
+});