@pareto4/pp-core 1.5.0

package/pp-core/bin/lib/research-store.cjs

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * Research Store Module
+ *
+ * Provides deterministic cache key generation, TTL policy, path resolution,
+ * and JSON-backed put/get operations for research entries.
+ *
+ * ADR-457 build-at-publish: authored as TypeScript .cts → emits .cjs via tsc.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const DAY_MS = 86_400_000;
+// ---------------------------------------------------------------------------
+// researchKey
+// ---------------------------------------------------------------------------
+function normalize(x) {
+    if (x === null || x === undefined)
+        return '';
+    if (typeof x === 'object')
+        return JSON.stringify(x).trim().toLowerCase();
+    // After excluding null, undefined, and object, x can only be a primitive —
+    // cast through number | string | boolean to avoid no-base-to-string on unknown.
+    return `${x}`.trim().toLowerCase();
+}
+function researchKey(input) {
+    const parts = {
+        ecosystem: normalize(input.ecosystem),
+        library: normalize(input.library),
+        version: normalize(input.version),
+        query: normalize(input.query),
+        kind: normalize(input.kind),
+    };
+    const serialized = JSON.stringify(parts);
+    return node_crypto_1.default.createHash('sha256').update(serialized).digest('hex');
+}
+// ---------------------------------------------------------------------------
+// ttlForSource
+// ---------------------------------------------------------------------------
+function ttlForSource(source, confidence) {
+    if (source === 'curated' && confidence === 'HIGH')
+        return 30 * DAY_MS;
+    if (source === 'curated' && confidence === 'MEDIUM')
+        return 7 * DAY_MS;
+    return DAY_MS;
+}
+// ---------------------------------------------------------------------------
+// tierForSource / resolveStorePath
+// ---------------------------------------------------------------------------
+const CURATED_SOURCES = new Set(['curated']);
+function tierForSource(source) {
+    return CURATED_SOURCES.has(source) ? 'user' : 'project';
+}
+function resolveStorePath(cwd, source, { homeDir = node_os_1.default.homedir() } = {}) {
+    if (tierForSource(source) === 'user') {
+        return node_path_1.default.join(homeDir, '.gsd', 'research-cache');
+    }
+    return node_path_1.default.join(cwd, '.planning', 'research', '.cache');
+}
+// ---------------------------------------------------------------------------
+// isValidResearchKey
+// ---------------------------------------------------------------------------
+/**
+ * Returns true iff key is a valid 64-character lowercase hexadecimal SHA-256
+ * string (the exact shape produced by researchKey).  Any other shape —
+ * including path-traversal sequences — is rejected.
+ */
+function isValidResearchKey(key) {
+    return typeof key === 'string' && /^[0-9a-f]{64}$/.test(key);
+}
+// ---------------------------------------------------------------------------
+// putResearch
+// ---------------------------------------------------------------------------
+function putResearch(cwd, key, payload, { clock = Date, homeDir = node_os_1.default.homedir() } = {}) {
+    // Defense-in-depth: reject any key that is not a 64-char sha256 hex string.
+    if (!isValidResearchKey(key)) {
+        throw new Error('invalid research key');
+    }
+    const { content, source, provider, confidence, kind, version } = payload;
+    let ttl = ttlForSource(source, confidence);
+    // Cap TTL when version is blank/missing — a versionless curated entry must not
+    // get the long 30-day window since we can't know if it's still current.
+    if (!version) {
+        ttl = Math.min(ttl, DAY_MS);
+    }
+    const fetched_at = new Date(clock.now()).toISOString();
+    const entry = { content, source, provider, confidence, fetched_at, ttl, kind };
+    const dir = resolveStorePath(cwd, source, { homeDir });
+    // Belt-and-suspenders: ensure the resolved file path stays inside the store dir.
+    const resolvedDir = node_path_1.default.resolve(dir);
+    const filePath = node_path_1.default.join(dir, `${key}.json`);
+    const resolvedFile = node_path_1.default.resolve(filePath);
+    if (!resolvedFile.startsWith(resolvedDir + node_path_1.default.sep)) {
+        throw new Error('invalid research key');
+    }
+    node_fs_1.default.mkdirSync(dir, { recursive: true });
+    (0, shell_command_projection_cjs_1.platformWriteSync)(filePath, JSON.stringify(entry));
+    return entry;
+}
+// ---------------------------------------------------------------------------
+// getResearch
+// ---------------------------------------------------------------------------
+function getResearch(cwd, key, { clock = Date, homeDir = node_os_1.default.homedir() } = {}) {
+    // Defense-in-depth: reject any key that is not a 64-char sha256 hex string.
+    if (!isValidResearchKey(key)) {
+        return { hit: false, stale: false, entry: null };
+    }
+    try {
+        // Search both physical tiers: user (curated) and project (web/etc.)
+        const userDir = node_path_1.default.join(homeDir, '.gsd', 'research-cache');
+        const projectDir = node_path_1.default.join(cwd, '.planning', 'research', '.cache');
+        const tierDirs = [userDir, projectDir];
+        const candidates = [];
+        for (const dir of tierDirs) {
+            const resolvedDir = node_path_1.default.resolve(dir);
+            const filePath = node_path_1.default.join(dir, `${key}.json`);
+            // Belt-and-suspenders: ensure path stays inside tier dir
+            if (!node_path_1.default.resolve(filePath).startsWith(resolvedDir + node_path_1.default.sep))
+                continue;
+            if (!node_fs_1.default.existsSync(filePath))
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
+            }
+            catch {
+                // Corrupt file in this tier — skip it
+                continue;
+            }
+            // Finding 3: validate entry metadata shape before accepting as a candidate.
+            // An entry with missing/invalid fetched_at or ttl must be treated as a miss.
+            const parsedFetchedAt = Date.parse(entry.fetched_at);
+            if (!Number.isFinite(parsedFetchedAt))
+                continue;
+            if (typeof entry.ttl !== 'number' ||
+                !Number.isFinite(entry.ttl) ||
+                entry.ttl <= 0)
+                continue;
+            const age = clock.now() - parsedFetchedAt;
+            const stale = age > entry.ttl;
+            candidates.push({ entry, stale, age });
+        }
+        if (candidates.length === 0) {
+            return { hit: false, stale: false, entry: null };
+        }
+        // Prefer: non-stale over stale; among same-staleness, lowest age (most recent)
+        candidates.sort((a, b) => {
+            if (a.stale !== b.stale)
+                return a.stale ? 1 : -1; // non-stale first
+            return a.age - b.age; // lower age (more recent) first
+        });
+        const best = candidates[0];
+        return { hit: true, stale: best.stale, entry: best.entry };
+    }
+    catch {
+        return { hit: false, stale: false, entry: null };
+    }
+}
+module.exports = { isValidResearchKey, researchKey, ttlForSource, tierForSource, resolveStorePath, putResearch, getResearch };

package/pp-core/bin/lib/review-reviewer-selection.cjs

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Review Reviewer Selection Module (ADR-457 build-at-publish: the hand-written
+ * bin/lib/review-reviewer-selection.cjs collapsed to a TypeScript source of
+ * truth). Behaviour is preserved byte-for-behaviour from the prior hand-written
+ * .cjs; only types are added.
+ *
+ * Owns reviewer-selection policy projection for /gsd:review:
+ * explicit flags > --all > review.default_reviewers > all detected.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNOWN_REVIEWER_SLUGS = void 0;
+exports.normalizeConfiguredDefaultReviewers = normalizeConfiguredDefaultReviewers;
+exports.resolveReviewerSelection = resolveReviewerSelection;
+exports.KNOWN_REVIEWER_SLUGS = [
+    'gemini',
+    'claude',
+    'codex',
+    'coderabbit',
+    'opencode',
+    'qwen',
+    'cursor',
+    'antigravity',
+    'ollama',
+    'lm_studio',
+    'llama_cpp',
+];
+function normalizeConfiguredDefaultReviewers(rawValue) {
+    if (rawValue === undefined || rawValue === null) {
+        return { absent: true, values: [], errors: [] };
+    }
+    if (!Array.isArray(rawValue)) {
+        return {
+            absent: false,
+            values: [],
+            errors: ['review.default_reviewers must be a JSON array of reviewer slugs'],
+        };
+    }
+    if (rawValue.length === 0) {
+        return {
+            absent: false,
+            values: [],
+            errors: ['review.default_reviewers cannot be empty'],
+        };
+    }
+    const seen = new Set();
+    const normalized = [];
+    const errors = [];
+    for (const item of rawValue) {
+        if (typeof item !== 'string') {
+            errors.push('review.default_reviewers must contain only string slugs');
+            continue;
+        }
+        if (!/^[a-zA-Z0-9_-]+$/.test(item)) {
+            errors.push(`invalid reviewer slug in review.default_reviewers: ${item}`);
+            continue;
+        }
+        const slug = item.toLowerCase();
+        if (!seen.has(slug)) {
+            seen.add(slug);
+            normalized.push(slug);
+        }
+    }
+    return { absent: false, values: normalized, errors };
+}
+function resolveReviewerSelection(input) {
+    const detected = new Set((input.detected ?? []).map((v) => String(v).toLowerCase()));
+    const explicitFlags = new Set((input.explicitFlags ?? []).map((v) => String(v).toLowerCase()));
+    const allFlag = !!input.allFlag;
+    const normalizedDefaults = normalizeConfiguredDefaultReviewers(input.configuredDefaultReviewers);
+    const warnings = [];
+    const infos = [];
+    const errors = [...normalizedDefaults.errors];
+    let source = 'no_config_all_detected';
+    let selected = [];
+    if (explicitFlags.size > 0) {
+        source = 'explicit_flags';
+        selected = [...explicitFlags].filter((slug) => detected.has(slug));
+        const missing = [...explicitFlags].filter((slug) => !detected.has(slug));
+        if (missing.length > 0) {
+            infos.push(`explicit reviewers missing on host: ${missing.join(', ')}`);
+        }
+        if (selected.length === 0 && errors.length === 0) {
+            errors.push('no selected reviewers are available for explicit flags');
+        }
+    }
+    else if (allFlag) {
+        source = 'all_flag';
+        selected = [...detected];
+    }
+    else if (!normalizedDefaults.absent) {
+        source = 'config_default';
+        const knownDefaults = [];
+        for (const slug of normalizedDefaults.values) {
+            if (!exports.KNOWN_REVIEWER_SLUGS.includes(slug)) {
+                warnings.push(`unknown reviewer slug in review.default_reviewers: ${slug}`);
+            }
+            else {
+                knownDefaults.push(slug);
+            }
+        }
+        const undetected = knownDefaults.filter((slug) => !detected.has(slug));
+        if (undetected.length > 0) {
+            infos.push(`configured reviewers not detected on this host: ${undetected.join(', ')}`);
+        }
+        selected = knownDefaults.filter((slug) => detected.has(slug));
+        if (selected.length === 0 && errors.length === 0) {
+            errors.push('all configured default reviewers are unavailable on this host');
+        }
+    }
+    else {
+        selected = [...detected];
+    }
+    return {
+        source,
+        selected: selected.sort(),
+        warnings,
+        infos,
+        errors,
+    };
+}

package/pp-core/bin/lib/roadmap-command-router.cjs

@@ -0,0 +1,166 @@
+"use strict";
+/**
+ * Manifest-backed roadmap subcommand router.
+ * Keeps gsd-tools.cjs thin while preserving existing command semantics.
+ *
+ * ADR-457 build-at-publish: the hand-written bin/lib/roadmap-command-router.cjs
+ * collapsed to a TypeScript source of truth. Behaviour is preserved byte-for-behaviour
+ * from the prior hand-written .cjs; only types are added.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const command_aliases_cjs_1 = require("./command-aliases.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const cjsCommandRouterAdapter = require("./cjs-command-router-adapter.cjs");
+const { routeCjsCommandFamily } = cjsCommandRouterAdapter;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const roadmapUpgrade = require("./roadmap-upgrade.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const planningWorkspace = require("./planning-workspace.cjs");
+const { planningDir } = planningWorkspace;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const configLoaderMod = require("./config-loader.cjs");
+const { loadConfig } = configLoaderMod;
+// ─── W021 Implementation ──────────────────────────────────────────────────────
+/**
+ * Check each phase entry in a milestone-prefixed ROADMAP.md for W021 violations.
+ *
+ * W021: a phase whose ID integer prefix does not match its enclosing milestone's
+ * major version number.
+ *
+ * Sentinel milestones (0 = pre-milestone, 999 = backlog) are exempt.
+ *
+ * @param content - ROADMAP.md content
+ * @returns Array of W021 warnings
+ */
+function checkW021(content) {
+    const warnings = [];
+    // Sentinel milestone integers exempt from W021
+    const SENTINELS = new Set([0, 999]);
+    const MIGRATION_CMD = 'gsd-tools roadmap upgrade --convention milestone-prefixed';
+    // Milestone section heading: ## [GSD] v2.0 — Label  OR  ## v2.0: Label  OR  ## Roadmap v2.0
+    //   OR  ## ✅ v2.0  OR  ## 🚧 v2.0  (emoji-prefixed variants used by roadmap templates)
+    // Capture the major integer.
+    const MILESTONE_RE = /^#{1,3}\s+(?:\[[^\]]+\]\s+|Roadmap\s+|[✅🚧]\s*)?v(\d+)\.\d+(?:\s|:|\s*—)/iu;
+    // Migrated phase heading: ### Phase M-NN: Name  (M-NN or unpadded M-N form)
+    const PHASE_RE = /^#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+(\d+)-(\d+)(?:-\d+)*\s*:/i;
+    // Unprefixed legacy phase heading: ### Phase N: Name  (no hyphen sub-index)
+    const UNPREFIXED_PHASE_RE = /^#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+(\d+[A-Za-z]?(?:\.\d+)*)\s*:/i;
+    let currentMilestoneMajor = null;
+    const lines = content.split('\n');
+    for (const line of lines) {
+        const milestoneMatch = line.match(MILESTONE_RE);
+        if (milestoneMatch) {
+            currentMilestoneMajor = parseInt(milestoneMatch[1], 10);
+            continue;
+        }
+        const phaseMatch = line.match(PHASE_RE);
+        if (phaseMatch) {
+            const phaseMajor = parseInt(phaseMatch[1], 10);
+            if (SENTINELS.has(phaseMajor))
+                continue; // exempt
+            if (currentMilestoneMajor !== null && phaseMajor !== currentMilestoneMajor) {
+                const phaseId = `${phaseMatch[1]}-${phaseMatch[2]}`;
+                warnings.push({
+                    code: 'W021',
+                    message: `Phase ID prefix mismatch: phase "${phaseId}" is listed under v${currentMilestoneMajor}.x ` +
+                        `but its prefix (${phaseMajor}) does not match. ` +
+                        `Run \`${MIGRATION_CMD}\` to fix.`,
+                });
+            }
+            continue;
+        }
+        // When the convention is active, an unprefixed heading (### Phase 1:) is itself a W021
+        // violation — it is missing the required M-NN prefix entirely.
+        const unprefixedMatch = line.match(UNPREFIXED_PHASE_RE);
+        if (unprefixedMatch && currentMilestoneMajor !== null) {
+            const rawId = unprefixedMatch[1];
+            // Skip if it matched PHASE_RE already (it didn't reach here in that case)
+            // Also skip if it looks like a bare integer whose prefix matches the section
+            // — those pass; only non-matching or non-prefixed forms fire W021.
+            const numericMajor = parseInt(rawId, 10);
+            if (!SENTINELS.has(numericMajor)) {
+                warnings.push({
+                    code: 'W021',
+                    message: `Phase ID "${rawId}" is not in M-NN form (milestone-prefixed convention is active). ` +
+                        `Run \`${MIGRATION_CMD}\` to migrate.`,
+                });
+            }
+        }
+    }
+    return warnings;
+}
+// ─── Router ───────────────────────────────────────────────────────────────────
+function routeRoadmapCommand({ roadmap, args, cwd, raw, error }) {
+    routeCjsCommandFamily({
+        args,
+        subcommands: command_aliases_cjs_1.ROADMAP_SUBCOMMANDS,
+        unsupported: {},
+        error,
+        unknownMessage: (_subcommand, available) => `Unknown roadmap subcommand. Available: ${available.join(', ')}`,
+        handlers: {
+            'get-phase': () => roadmap.cmdRoadmapGetPhase(cwd, args[2], raw),
+            analyze: () => roadmap.cmdRoadmapAnalyze(cwd, raw),
+            'update-plan-progress': () => roadmap.cmdRoadmapUpdatePlanProgress(cwd, args[2], raw),
+            'annotate-dependencies': () => roadmap.cmdRoadmapAnnotateDependencies(cwd, args[2], raw),
+            'validate': () => {
+                const roadmapPath = node_path_1.default.join(planningDir(cwd), 'ROADMAP.md');
+                let roadmapContent = '';
+                try {
+                    roadmapContent = node_fs_1.default.readFileSync(roadmapPath, 'utf8');
+                }
+                catch {
+                    // ROADMAP.md missing — return empty warnings
+                }
+                // W021 only fires when phase_id_convention is explicitly 'milestone-prefixed'.
+                // Authoritative source: .planning/config.json (set by the upgrade command).
+                // Fallback: ROADMAP.md frontmatter (for projects that set the field there directly).
+                let convention;
+                try {
+                    const cfg = loadConfig(cwd);
+                    convention = cfg['phase_id_convention'];
+                }
+                catch {
+                    convention = undefined;
+                }
+                if (convention === undefined || convention === null) {
+                    // Fallback: read from ROADMAP.md frontmatter
+                    const fmMatch = roadmapContent.match(/^---\r?\n([\s\S]+?)\r?\n---/);
+                    if (fmMatch) {
+                        const kvMatch = fmMatch[1].match(/^phase_id_convention:\s*(.*)$/m);
+                        if (kvMatch) {
+                            const val = kvMatch[1].trim();
+                            if (val !== 'null' && val !== '') {
+                                convention = val.replace(/^["']|["']$/g, '');
+                            }
+                        }
+                    }
+                }
+                const warnings = (convention === 'milestone-prefixed')
+                    ? checkW021(roadmapContent)
+                    : [];
+                const result = { warnings };
+                if (raw)
+                    process.stdout.write(JSON.stringify(result));
+                else
+                    process.stdout.write(JSON.stringify(result, null, 2));
+            },
+            'upgrade': () => {
+                const dryRun = !args.includes('--apply');
+                const convention = args.find((_a, i) => args[i - 1] === '--convention') || 'milestone-prefixed';
+                if (convention !== 'milestone-prefixed') {
+                    process.stderr.write('Only --convention milestone-prefixed is supported\n');
+                    process.exit(1);
+                }
+                const plan = roadmapUpgrade.computeMigrationPlan(cwd);
+                roadmapUpgrade.applyMigration(cwd, plan, { dryRun });
+            },
+        },
+    });
+}
+module.exports = {
+    routeRoadmapCommand,
+};