@tekyzinc/gsd-t 3.26.10 → 3.27.10

package/bin/gsd-t-ci-parity.cjs

@@ -0,0 +1,500 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * GSD-T ci-parity (M57 D2)
+ *
+ * Reproduces a project's actual CI build locally instead of relying on
+ * potentially warm-cache local tsc/test parity.
+ *
+ * Auto-detects CI config via locked detection precedence (user decision — do
+ * NOT reorder): cloudbuild.yaml → .github/workflows/*.yml → Dockerfile RUN →
+ * package.json scripts (build, typecheck, test) → none.
+ *
+ * Clears build caches before running detected commands so stale incremental
+ * artifacts cannot mask regressions (the TimeTracking v1.10.12 SC2 failure
+ * class: ~8 noImplicitAny errors passed warm-cache local tsc, failed CI cold
+ * build).
+ *
+ * When a Dockerfile is present, runs a real `docker build` — presence is the
+ * sole trigger; no opt-in flag (locked user decision).
+ *
+ * Contract: .gsd-t/contracts/ci-parity-contract.md v1.0.0 STABLE
+ *
+ * Parse limits (no external YAML lib; minimal line/regex scanning):
+ *   - cloudbuild.yaml: only reads `args:` array elements under `steps:`.
+ *     Multi-line folded/block scalars are not supported. Only simple
+ *     `args: [...]` one-liner arrays or `- 'val'` list forms are handled.
+ *   - .github/workflows/*.yml: only reads `run:` lines from the FIRST job's
+ *     steps. Multi-line pipe/fold blocks (`run: |`) capture only the first
+ *     continuation line. `uses:` steps (no `run:`) are skipped.
+ *   - Dockerfile: reads `RUN` lines (single-line only; backslash-continuations
+ *     are joined into one command).
+ *   These limits are intentional trade-offs to keep the module at zero
+ *   external runtime deps.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const child_process = require('child_process');
+
+const DEFAULT_TIMEOUT_MS = 120_000;
+
+// ── Detection ─────────────────────────────────────────────────────────────────
+
+/** Parse cloudbuild.yaml steps[].args → array of command strings. */
+function detectCloudbuild(projectDir) {
+  const f = path.join(projectDir, 'cloudbuild.yaml');
+  if (!fs.existsSync(f)) return null;
+  const lines = fs.readFileSync(f, 'utf8').split('\n');
+  const cmds = [];
+  let inArgs = false;
+  let argParts = [];
+
+  for (const raw of lines) {
+    const line = raw.trimEnd();
+    // Inline array: `    args: ['node', '-e', '...']`
+    const inlineM = line.match(/^\s+args:\s*\[(.+)\]/);
+    if (inlineM) {
+      const cmd = inlineM[1]
+        .split(',')
+        .map((t) => t.trim().replace(/^['"]|['"]$/g, ''))
+        .filter(Boolean)
+        .join(' ');
+      if (cmd) cmds.push(cmd);
+      inArgs = false;
+      argParts = [];
+      continue;
+    }
+    // Start of args block: `    args:`
+    if (/^\s+args:\s*$/.test(line)) {
+      inArgs = true;
+      argParts = [];
+      continue;
+    }
+    if (inArgs) {
+      // List item under args
+      const itemM = line.match(/^\s+-\s+['"]?(.+?)['"]?\s*$/);
+      if (itemM) {
+        argParts.push(itemM[1]);
+        continue;
+      }
+      // Not a list item → end of args block
+      if (argParts.length) {
+        cmds.push(argParts.join(' '));
+        argParts = [];
+      }
+      inArgs = false;
+    }
+  }
+  if (inArgs && argParts.length) cmds.push(argParts.join(' '));
+  return cmds.length ? cmds : [];
+}
+
+/** Parse first job's steps[].run from .github/workflows/*.yml. */
+function detectWorkflows(projectDir) {
+  const wfDir = path.join(projectDir, '.github', 'workflows');
+  if (!fs.existsSync(wfDir)) return null;
+  const files = fs.readdirSync(wfDir).filter((f) => /\.ya?ml$/.test(f));
+  if (!files.length) return null;
+  const lines = fs.readFileSync(path.join(wfDir, files[0]), 'utf8').split('\n');
+  const cmds = [];
+  let inJobs = false;
+  let inSteps = false;
+  let firstJobDone = false;
+  let jobDepth = 0;
+  let pendingRun = null;
+
+  for (const raw of lines) {
+    const line = raw.trimEnd();
+    if (/^jobs:/.test(line)) { inJobs = true; continue; }
+    if (!inJobs) continue;
+    if (firstJobDone) continue;
+
+    // Detect first-job boundary (4-space indent key)
+    if (/^  \w[\w-]*:/.test(line)) { jobDepth++; if (jobDepth > 1) { firstJobDone = true; continue; } }
+    if (/^\s+steps:/.test(line)) { inSteps = true; continue; }
+    if (!inSteps) continue;
+
+    // Inline run: `      - run: cmd`
+    const inlineRunM = line.match(/^\s+-\s+run:\s+(.+)$/);
+    if (inlineRunM) { cmds.push(inlineRunM[1].trim()); pendingRun = null; continue; }
+    // Block run marker: `        run: |` or `        run: >`
+    const blockRunM = line.match(/^\s+run:\s*[|>]?\s*$/);
+    if (blockRunM) { pendingRun = true; continue; }
+    // Inline run value: `        run: cmd`
+    const plainRunM = line.match(/^\s+run:\s+(.+)$/);
+    if (plainRunM && !blockRunM) { cmds.push(plainRunM[1].trim()); pendingRun = null; continue; }
+    // Continuation line for block run (indented more than run:)
+    if (pendingRun) {
+      const contM = line.match(/^\s{10,}(.+)$/);
+      if (contM) { cmds.push(contM[1].trim()); pendingRun = null; continue; }
+      if (line.trim() === '') continue;
+      pendingRun = null;
+    }
+  }
+  return cmds.length ? cmds : [];
+}
+
+/** Parse RUN lines from a Dockerfile (backslash-continuations joined). */
+function detectDockerfileRun(projectDir) {
+  const f = path.join(projectDir, 'Dockerfile');
+  if (!fs.existsSync(f)) return null;
+  const lines = fs.readFileSync(f, 'utf8').split('\n');
+  const cmds = [];
+  let buf = '';
+
+  for (const raw of lines) {
+    const line = raw.trimEnd();
+    if (/^RUN\s+/.test(line)) {
+      buf = line.replace(/^RUN\s+/, '').replace(/\\$/, '').trim();
+    } else if (buf && /^\s/.test(line)) {
+      buf += ' ' + line.replace(/\\$/, '').trim();
+    } else {
+      if (buf) { cmds.push(buf); buf = ''; }
+    }
+  }
+  if (buf) cmds.push(buf);
+  return cmds.length ? cmds : [];
+}
+
+/** Extract package.json scripts: build, typecheck, test (in that order). */
+function detectPackageScripts(projectDir) {
+  const f = path.join(projectDir, 'package.json');
+  if (!fs.existsSync(f)) return null;
+  let pkg;
+  try { pkg = JSON.parse(fs.readFileSync(f, 'utf8')); } catch { return null; }
+  const scripts = (pkg && pkg.scripts) || {};
+  const ORDER = ['build', 'typecheck', 'test'];
+  const found = ORDER.filter((k) => scripts[k]);
+  if (!found.length) return null;
+  return found.map((k) => `npm run ${k}`);
+}
+
+/**
+ * Detect CI source and return { source, commands }.
+ * Precedence: cloudbuild → workflows → dockerfile-run → package-scripts → none.
+ */
+function detectCi(projectDir) {
+  const cb = detectCloudbuild(projectDir);
+  if (cb !== null) return { source: 'cloudbuild', commands: cb };
+
+  const wf = detectWorkflows(projectDir);
+  if (wf !== null) return { source: 'workflows', commands: wf };
+
+  const df = detectDockerfileRun(projectDir);
+  if (df !== null) return { source: 'dockerfile-run', commands: df };
+
+  const ps = detectPackageScripts(projectDir);
+  if (ps !== null) return { source: 'package-scripts', commands: ps };
+
+  return { source: 'none', commands: [] };
+}
+
+// ── Cache clearing ─────────────────────────────────────────────────────────────
+
+function collectFiles(dir, pred, depth, out) {
+  if (depth <= 0) return;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (e.name === 'node_modules') continue;
+      collectFiles(full, pred, depth - 1, out);
+    } else if (pred(e.name)) {
+      out.push(full);
+    }
+  }
+}
+
+/** Parse tsBuildInfoFile and outDir from tsconfig*.json files. */
+function parseTsconfigArtifacts(projectDir) {
+  const paths = [];
+  let entries;
+  try { entries = fs.readdirSync(projectDir); } catch { return paths; }
+  for (const name of entries) {
+    if (!/^tsconfig.*\.json$/.test(name)) continue;
+    let cfg;
+    try { cfg = JSON.parse(fs.readFileSync(path.join(projectDir, name), 'utf8')); } catch { continue; }
+    const opts = (cfg && cfg.compilerOptions) || {};
+    if (opts.tsBuildInfoFile) {
+      paths.push(path.resolve(projectDir, opts.tsBuildInfoFile));
+    }
+    if (opts.outDir) {
+      paths.push(path.resolve(projectDir, opts.outDir));
+    }
+  }
+  return paths;
+}
+
+/**
+ * Containment predicate (Destructive Action Guard — LOCKED).
+ *
+ * A config-derived path may be deleted ONLY when its resolved absolute path
+ * is a STRICT DESCENDANT of projectRoot:
+ *
+ *   resolved.startsWith(projectRoot + path.sep) && resolved !== projectRoot
+ *
+ * Both halves are load-bearing:
+ *   - resolves OUTSIDE projectRoot (`../victim`, absolute) → REFUSE
+ *     (BUG-1: `tsconfig outDir:"../victim"` force-deleted a sibling).
+ *   - resolves EQUAL TO projectRoot (`.`, `./`, `src/..`, `./foo/../`)
+ *     → REFUSE (BUG-8: a regression that force-deleted the entire repo —
+ *     deleting the project root is never a cache-clear).
+ *   - the `+ path.sep` guards the prefix-collision edge: a sibling whose
+ *     name is `projectRoot + "-evil"` must NOT pass `startsWith(projectRoot)`.
+ *
+ * See memory: feedback_destructive_path_ops_containment.md.
+ */
+function _isSafeToDelete(targetPath, projectRoot) {
+  const resolved = path.resolve(targetPath);
+  const root = path.resolve(projectRoot);
+  return resolved !== root && resolved.startsWith(root + path.sep);
+}
+
+/**
+ * Delete a config-derived path, but ONLY if it passes the containment
+ * predicate. Refusals are recorded (never thrown, never deleted) so the
+ * caller can surface them in the envelope and still clear legitimate caches.
+ */
+function removePathContained(p, projectRoot, refused) {
+  if (!_isSafeToDelete(p, projectRoot)) {
+    refused.push(path.resolve(p));
+    return;
+  }
+  try {
+    const st = fs.statSync(p);
+    if (st.isDirectory()) fs.rmSync(p, { recursive: true, force: true });
+    else fs.unlinkSync(p);
+  } catch { /* best-effort: a missing path is fine */ }
+}
+
+/**
+ * Clear build caches before running detected commands (mandatory path —
+ * runCiParity calls this unconditionally before any detected command).
+ * Returns { refusedPaths } so a containment refusal is observable.
+ */
+function clearBuildCaches(projectDir) {
+  const root = path.resolve(projectDir);
+  const refused = [];
+
+  // 1. *.tsbuildinfo files (constructed under projectDir, but guarded too)
+  const tsBuildInfoFiles = [];
+  collectFiles(projectDir, (name) => name.endsWith('.tsbuildinfo'), 6, tsBuildInfoFiles);
+  for (const f of tsBuildInfoFiles) removePathContained(f, root, refused);
+
+  // 2. node_modules/.cache
+  removePathContained(path.join(projectDir, 'node_modules', '.cache'), root, refused);
+
+  // 3. tsconfig-referenced outDir / tsBuildInfoFile — the dangerous,
+  //    user-controlled paths. Each MUST pass _isSafeToDelete.
+  for (const p of parseTsconfigArtifacts(projectDir)) removePathContained(p, root, refused);
+
+  return { refusedPaths: refused };
+}
+
+// ── Command runner ─────────────────────────────────────────────────────────────
+
+/** Run a single shell command with bounded timeout. Returns {cmd, exitCode, ok, output}. */
+function runCommand(cmd, projectDir, timeoutMs) {
+  let result;
+  try {
+    result = child_process.spawnSync('sh', ['-c', cmd], {
+      cwd: projectDir,
+      timeout: timeoutMs,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } catch (err) {
+    return { cmd, exitCode: 1, ok: false, output: String(err) };
+  }
+  const exitCode = result.status != null ? result.status : 1;
+  return { cmd, exitCode, ok: exitCode === 0, output: (result.stdout || '') + (result.stderr || '') };
+}
+
+// ── Docker ─────────────────────────────────────────────────────────────────────
+
+/** Check whether the `docker` binary is available on PATH. */
+function dockerAvailable() {
+  try {
+    const r = child_process.spawnSync('docker', ['--version'], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 5000,
+    });
+    return r.status === 0;
+  } catch { return false; }
+}
+
+/**
+ * Run `docker build` in projectDir with a bounded timeout.
+ * Returns { ok, exitCode, output }.
+ */
+function runDockerBuild(projectDir, timeoutMs) {
+  const tag = `gsd-t-ci-parity-${Date.now()}`;
+  let result;
+  try {
+    result = child_process.spawnSync(
+      'docker', ['build', '--no-cache', '-t', tag, '.'],
+      {
+        cwd: projectDir,
+        timeout: timeoutMs,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }
+    );
+  } catch (err) {
+    return { ok: false, exitCode: 1, output: String(err) };
+  }
+  // Best-effort cleanup of created image
+  try {
+    child_process.spawnSync('docker', ['rmi', '-f', tag], {
+      stdio: 'ignore', timeout: 10000,
+    });
+  } catch { /* ignore */ }
+  const exitCode = result.status != null ? result.status : 1;
+  return { ok: exitCode === 0, exitCode, output: (result.stdout || '') + (result.stderr || '') };
+}
+
+// ── Public API ─────────────────────────────────────────────────────────────────
+
+/**
+ * Run CI parity check for a project.
+ *
+ * @param {object} opts
+ * @param {string} opts.projectDir
+ * @param {number} [opts.timeoutMs]
+ * @returns {{ ok: boolean, detectedSource: string, commands: Array, dockerBuilt: boolean, dockerSkippedReason?: string, note?: string }}
+ */
+function runCiParity(opts) {
+  const projectDir = (opts && opts.projectDir) || process.cwd();
+  const timeoutMs = (opts && opts.timeoutMs) || DEFAULT_TIMEOUT_MS;
+
+  const { source, commands } = detectCi(projectDir);
+
+  // Cache-clear is on the MANDATORY path — it runs before any command AND
+  // before the no-CI/docker-only path, so a Dockerfile-only project still
+  // gets a clean cache (closes BUG-2: the prior early-return skipped it).
+  const { refusedPaths } = clearBuildCaches(projectDir);
+
+  // No CI config found — not a failure
+  if (source === 'none') {
+    const hasDockerfile = fs.existsSync(path.join(projectDir, 'Dockerfile'));
+    const dockerResult = hasDockerfile
+      ? runDockerStep(projectDir, timeoutMs)
+      : { dockerBuilt: false, dockerSkippedReason: 'no-dockerfile' };
+    const env = {
+      ok: !dockerResult.dockerFailed,
+      detectedSource: 'none',
+      commands: [],
+      cacheCleared: true,
+      ...dockerResult,
+      note: 'No CI config detected (no cloudbuild.yaml, .github/workflows, Dockerfile RUN lines, or package.json scripts)',
+    };
+    if (refusedPaths.length) env.refusedPaths = refusedPaths;
+    return env;
+  }
+
+  // Run all detected commands
+  const commandResults = [];
+  let allOk = true;
+  for (const cmd of commands) {
+    const r = runCommand(cmd, projectDir, timeoutMs);
+    commandResults.push({ cmd: r.cmd, exitCode: r.exitCode, ok: r.ok });
+    if (!r.ok) allOk = false;
+  }
+
+  // Docker step (presence-triggered, not a failure if docker unavailable)
+  const hasDockerfile = fs.existsSync(path.join(projectDir, 'Dockerfile'));
+  const dockerResult = hasDockerfile
+    ? runDockerStep(projectDir, timeoutMs)
+    : { dockerBuilt: false, dockerSkippedReason: 'no-dockerfile' };
+
+  if (dockerResult.dockerFailed) allOk = false;
+
+  const envelope = {
+    ok: allOk,
+    detectedSource: source,
+    commands: commandResults,
+    cacheCleared: true,
+    dockerBuilt: dockerResult.dockerBuilt,
+  };
+  if (refusedPaths.length) envelope.refusedPaths = refusedPaths;
+  if (dockerResult.dockerSkippedReason) envelope.dockerSkippedReason = dockerResult.dockerSkippedReason;
+  if (!allOk && commands.length === 0) envelope.note = 'No commands detected';
+  return envelope;
+}
+
+/**
+ * Run docker build step (T3 logic).
+ * Returns { dockerBuilt, dockerFailed?, dockerSkippedReason? }
+ */
+function runDockerStep(projectDir, timeoutMs) {
+  if (!dockerAvailable()) {
+    return { dockerBuilt: false, dockerSkippedReason: 'docker-unavailable', dockerFailed: false };
+  }
+  const r = runDockerBuild(projectDir, timeoutMs);
+  return {
+    dockerBuilt: r.ok,
+    dockerFailed: !r.ok,
+  };
+}
+
+module.exports = { runCiParity, detectCi, clearBuildCaches, _isSafeToDelete };
+
+// ── CLI entry ──────────────────────────────────────────────────────────────────
+
+if (require.main === module) {
+  const argv = process.argv.slice(2);
+  let jsonMode = false;
+  let projectDir = process.cwd();
+  let timeoutMs = DEFAULT_TIMEOUT_MS;
+
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--json') { jsonMode = true; continue; }
+    if (a === '--project-dir' && argv[i + 1]) { projectDir = argv[++i]; continue; }
+    if (a === '--timeout-ms' && argv[i + 1]) { timeoutMs = Number(argv[++i]); continue; }
+    if (a === '--help' || a === '-h') {
+      process.stdout.write(
+        'Usage: gsd-t ci-parity [--project-dir <dir>] [--timeout-ms <ms>] [--json]\n' +
+        'Exit 0 = all CI commands + docker build passed\n' +
+        'Exit 4 = failure\n' +
+        'Exit 2 = usage error\n'
+      );
+      process.exit(0);
+    }
+  }
+
+  let result;
+  try {
+    result = runCiParity({ projectDir, timeoutMs });
+  } catch (err) {
+    if (jsonMode) {
+      process.stdout.write(JSON.stringify({ ok: false, error: String(err) }) + '\n');
+    } else {
+      process.stderr.write('ci-parity error: ' + String(err) + '\n');
+    }
+    process.exit(4);
+  }
+
+  if (jsonMode) {
+    process.stdout.write(JSON.stringify(result) + '\n');
+  } else {
+    const status = result.ok ? 'PASS' : 'FAIL';
+    process.stdout.write(`[ci-parity] ${status} detectedSource=${result.detectedSource}\n`);
+    for (const c of result.commands) {
+      process.stdout.write(`  [${c.ok ? 'ok' : 'FAIL'}] ${c.cmd} (exit ${c.exitCode})\n`);
+    }
+    if (result.dockerBuilt) {
+      process.stdout.write('  [ok] docker build\n');
+    } else if (result.dockerSkippedReason) {
+      process.stdout.write(`  [skip] docker build: ${result.dockerSkippedReason}\n`);
+    } else if (!result.dockerBuilt) {
+      process.stdout.write('  [FAIL] docker build\n');
+    }
+    if (result.note) process.stdout.write(`  note: ${result.note}\n`);
+  }
+
+  process.exit(result.ok ? 0 : 4);
+}

package/bin/gsd-t-economics.cjs

@@ -18,13 +18,40 @@ const path = require("node:path");
 
 // ─── Constants ────────────────────────────────────────────────────────────
 
+const { SAFE_DEFAULT_WINDOW } = require("./model-windows.cjs");
+
+/**
+ * Effective CW ceiling in tokens. This IS the model context window, used for
+ * `tokens / ceiling` percentages and parallel-mode gate decisions. Resolved
+ * model-aware (see resolveCwCeiling) — the old hardcoded 200K was correct only
+ * for pre-4 models and overstated every CW% 5× on Opus/Sonnet (1M window),
+ * skewing parallel-mode gates. Kept as the safe fallback when no meter state.
+ *   - bin/token-budget.cjs            (FALLBACK_WINDOW = model-windows safe)
+ *   - bin/context-meter-config.cjs    (modelWindowSize default 200000, now a fallback)
+ *   - bin/runway-estimator.cjs        (DEFAULT_MODEL_CONTEXT_CAP = model-windows safe)
+ */
+const CW_CEILING_TOKENS = SAFE_DEFAULT_WINDOW;
+const METER_STATE_REL = ".gsd-t/.context-meter-state.json";
+const METER_STATE_STALE_MS = 5 * 60 * 1000;
+
 /**
- * Effective CW ceiling in tokens. Matches:
- *   - bin/token-budget.cjs (200000)
- *   - bin/context-meter-config.cjs (modelWindowSize: 200000)
- *   - bin/runway-estimator.cjs (DEFAULT_MODEL_CONTEXT_CAP = 200000)
+ * Resolve the effective CW ceiling for a project. Prefers a fresh Context
+ * Meter reading (model-aware modelWindowSize, written by the meter hook from
+ * the running model), else the safe large default.
  */
-const CW_CEILING_TOKENS = 200000;
+function resolveCwCeiling(projectDir) {
+  try {
+    const fp = path.join(projectDir || ".", METER_STATE_REL);
+    const s = JSON.parse(fs.readFileSync(fp, "utf8"));
+    if (s && typeof s.modelWindowSize === "number" && s.modelWindowSize > 0 && s.timestamp) {
+      const age = Date.now() - Date.parse(s.timestamp);
+      if (!isNaN(age) && age >= 0 && age <= METER_STATE_STALE_MS) {
+        return s.modelWindowSize;
+      }
+    }
+  } catch (_) { /* fall through */ }
+  return CW_CEILING_TOKENS;
+}
 
 /** Confidence tier cutoffs (exact-match row counts). */
 const HIGH_CONFIDENCE_MIN = 5; // ≥5 exact matches
@@ -95,7 +122,7 @@ function loadCorpus(projectDir) {
   }
 
   const globalMedian = median(allTotals);
-  const globalPct = tokensToCwPct(globalMedian);
+  const globalPct = tokensToCwPct(globalMedian, resolveCwCeiling(projectDir));
 
   const idx = { rows, exact, byDomain, byCommand, globalMedian, globalPct };
   _corpusCache.set(projectDir, idx);
@@ -122,9 +149,10 @@ function median(arr) {
   return a.length % 2 === 1 ? a[mid] : (a[mid - 1] + a[mid]) / 2;
 }
 
-function tokensToCwPct(tokens) {
+function tokensToCwPct(tokens, ceiling) {
   if (!Number.isFinite(tokens) || tokens <= 0) return 0;
-  return (tokens / CW_CEILING_TOKENS) * 100;
+  const c = Number.isFinite(ceiling) && ceiling > 0 ? ceiling : CW_CEILING_TOKENS;
+  return (tokens / c) * 100;
 }
 
 // ─── Event emission (best-effort) ─────────────────────────────────────────
@@ -247,7 +275,7 @@ function estimateTaskFootprint(opts) {
   const corpus = loadCorpus(projectDir);
 
   const { estimatedTokens, matchedRows, confidence } = lookupInCorpus(taskNode, corpus);
-  const estimatedCwPct = tokensToCwPct(estimatedTokens);
+  const estimatedCwPct = tokensToCwPct(estimatedTokens, resolveCwCeiling(projectDir));
 
   const { parallelOk, split, workerCount } = decideGates(mode, estimatedCwPct, confidence);
 

package/bin/gsd-t.js

@@ -1185,6 +1185,9 @@ const GLOBAL_BIN_TOOLS = [
   "gsd-t-verify-gate-judge.cjs",
   // M55 D2 substrate — parallel-cli engine (added v3.25.11 patch — missed in initial M55 D5 wire-in).
   "parallel-cli.cjs",
+  // M57 — CI-parity verify-gate checks (structural build-coverage + containment-safe ci-parity).
+  "gsd-t-build-coverage.cjs",
+  "gsd-t-ci-parity.cjs",
 ];
 
 function installGlobalBinTools() {
@@ -4559,6 +4562,24 @@ if (require.main === module) {
       });
       process.exit(res.status == null ? 1 : res.status);
     }
+    case "build-coverage": {
+      // M57 D1 — `gsd-t build-coverage` thin dispatcher to bin/gsd-t-build-coverage.cjs.
+      const { spawnSync } = require("child_process");
+      const js = path.join(__dirname, "gsd-t-build-coverage.cjs");
+      const res = spawnSync(process.execPath, [js, ...args.slice(1)], {
+        stdio: "inherit",
+      });
+      process.exit(res.status == null ? 1 : res.status);
+    }
+    case "ci-parity": {
+      // M57 D2 — `gsd-t ci-parity` thin dispatcher to bin/gsd-t-ci-parity.cjs.
+      const { spawnSync } = require("child_process");
+      const js = path.join(__dirname, "gsd-t-ci-parity.cjs");
+      const res = spawnSync(process.execPath, [js, ...args.slice(1)], {
+        stdio: "inherit",
+      });
+      process.exit(res.status == null ? 1 : res.status);
+    }
     case "stream-feed": {
       doStreamFeed(args.slice(1));
       break;