@tekyzinc/gsd-t 4.10.10 → 4.10.12

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [4.10.12] - 2026-06-27
+
+### Fixed — freshness hash mismatch made every graph query re-index the whole repo
+
+`compute_touched_files` hashed files with md5 (full length) while the indexer stores sha256 sliced to 16 chars — a guaranteed permanent mismatch. So every file read as "edited" on every query and freshness re-indexed the entire repo (re-running SCIP), hanging `gsd-t graph status` for 30s+ (then reporting graph-unavailable) on large projects.
+
+- `bin/gsd-t-graph-freshness.cjs`: `hashFileContent` now `sha256().slice(0,16)` — matches the indexer's `contentHash` exactly. `EXCLUDE_DIRS` synced with the indexer's `SKIP_DIRS` (`.venv`/`site-packages`/etc.) so freshness doesn't see phantom ADDs from vendored dirs the indexer skipped.
+- 5 D4 freshness test fixtures seeded stores with md5 hashes — updated to sha256(16) to match the real store.
+
+Measured on Tekyz-CRM: `gsd-t graph status` 30s-timeout-unavailable → 0.38s ok; `compute_touched_files` 291ms / 11,821-files-stale → 12ms / 0-stale. This also makes graph queries cheap enough for ambient grep-interception (the next milestone). Suite: 2502/2502 pass.
+
+## [4.10.11] - 2026-06-27
+
+### Fixed — M96: the code graph now actually runs in projects (native-dep resolution)
+
+M94/M95 copied the graph runtime into every project's `bin/`, but it couldn't run: the native engines (better-sqlite3 store + tree-sitter floor parsers) were `devDependencies`, and a copied tool resolved them from the *project's* node_modules — which lacked them. The result was a SILENT empty graph (0 nodes/edges that read as a successful build). M96 makes the graph runnable everywhere.
+
+- `package.json`: moved `better-sqlite3` + `tree-sitter` + `tree-sitter-typescript` + `tree-sitter-python` from devDependencies to `dependencies` (they ship now).
+- `bin/gsd-t-require-store.cjs`: NEW `requireGraphDep()` — resolves a native dep from project node_modules → GSD-T global package node_modules → GSD-T dev tree; FAIL LOUD with a remediation message if all miss.
+- `bin/gsd-t-graph-edge-extract.cjs`: resolves tree-sitter via the resolver and THROWS (not silent-0) when the mandatory floor parser is absent.
+- `bin/gsd-t-graph-{index,freshness,query-cli}.cjs`: store engine via the resolver.
+- `bin/gsd-t.js`: propagate `gsd-t-require-store.cjs` to projects.
+- `test/m50-d2-viewer-specs-smoke.test.js`: zero-dep invariant updated to allow ONLY the graph native engines as runtime deps.
+
+Proven on binvoice (a real non-GSD-T project): graph builds 471 files / 43,309 edges; `blast-radius(src/build-config.ts)` returns its real dependents (the consumer reads the graph, not grep). Decision reaffirmed: zero-dependency is a guiding principle, not a hard rule — native deps are justified because the graph cannot function without them. Suite: 2502/2502 pass.
+
 ## [4.10.10] - 2026-06-26
 
 ### Added — M94 persistent code graph + M95 real SCIP call-graph resolution; graph runtime now propagates into projects

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v4.10.10** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v4.10.12** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t-graph-edge-extract.cjs

@@ -63,19 +63,29 @@ let pythonAvailable = false;
 function ensureParsers() {
   if (_parsersLoaded) return;
   _parsersLoaded = true;
+  // M96: resolve the tree-sitter native modules via the multi-location resolver so
+  // a COPIED extractor (in a project's bin/) finds them in the GSD-T global package,
+  // not the project's own (absent) node_modules. The TS grammar is the MANDATORY
+  // floor parser — if it cannot load, FAIL LOUD. A silent fall-through to
+  // tsAvailable=false produced an empty graph (0 nodes/edges) that looked like a
+  // successful build — the exact silent-degrade this milestone exists to kill.
+  const { requireGraphDep } = require('./gsd-t-require-store.cjs');
   try {
-    Parser = require('tree-sitter');
-    TSGrammars = require('tree-sitter-typescript');
+    Parser = requireGraphDep('tree-sitter');
+    TSGrammars = requireGraphDep('tree-sitter-typescript');
     TSX = TSGrammars.tsx;
     tsAvailable = true;
   } catch (e) {
-    warn(`tree-sitter-typescript not available: ${e.message}`);
+    throw new Error(
+      `code-graph floor parser unavailable: ${e.message} — the graph cannot be built ` +
+      `without tree-sitter. Reinstall GSD-T (npx @tekyzinc/gsd-t install).`
+    );
   }
   try {
-    Python = require('tree-sitter-python');
+    Python = requireGraphDep('tree-sitter-python');
     pythonAvailable = true;
   } catch {
-    /* Python optional */
+    /* Python optional — TS/JS still index */
   }
 }
 

package/bin/gsd-t-graph-freshness.cjs

@@ -48,22 +48,32 @@ function fail(msg) { return `${C.red}✘${C.reset} ${msg}`; }
 // ─── Source-file extensions the indexer tracks ────────────────────────────────
 const TRACKED_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.py']);
 
-// ─── Content-hash (SHA-256 hex, first 16 bytes → 32 hex chars) ───────────────
-// Using MD5 for speed (same family as graph-store.js) — collision-resistance
-// is not required here; we only need change-detection fidelity.
+// ─── Content-hash — MUST match the indexer's contentHash EXACTLY ─────────────
+// The indexer (gsd-t-graph-index.cjs::contentHash) stores sha256(content) sliced
+// to the first 16 hex chars. Freshness MUST compute the identical value, or EVERY
+// file reads as "edited" on every query (the hash never matches) and freshness
+// re-indexes the whole repo — the hang. (Was md5/full-length: a guaranteed
+// permanent mismatch.) [RULE] freshness-hash-matches-indexer-hash
 function hashFileContent(filePath) {
   try {
     const content = fs.readFileSync(filePath);
-    return crypto.createHash('md5').update(content).digest('hex');
+    return crypto.createHash('sha256').update(content).digest('hex').slice(0, 16);
   } catch {
     return null;
   }
 }
 
 // ─── Walk the working tree for source files ───────────────────────────────────
+// MUST stay in sync with the indexer's SKIP_DIRS (gsd-t-graph-index.cjs). If
+// freshness walks a dir the indexer skipped, every file in it reads as a phantom
+// ADD on every query → re-index storm (bee-poc/Tekyz-CRM: 9,008 phantom adds from
+// .venv + build bundles). [RULE] freshness-excludes-match-indexer-skipdirs
 const EXCLUDE_DIRS = new Set([
   'node_modules', '.git', 'dist', 'build', 'coverage',
   '.gsd-t', '.claude', '__pycache__', '.next', 'out',
+  '.cache', '.nyc_output', '.turbo',
+  '.venv', 'venv', 'env', '.dart_tool', 'Pods', 'vendor', '.gradle',
+  '.idea', '.vscode', 'tmp', '.tmp', 'site-packages',
 ]);
 
 function walkTree(dir, results = []) {
@@ -99,7 +109,7 @@ function walkTree(dir, results = []) {
 // a single open connection. If no db is passed, we open one from projectRoot.
 
 function openDb(projectRoot, explicitDbPath) {
-  const Database = require('better-sqlite3');
+  const Database = require('./gsd-t-require-store.cjs').requireBetterSqlite();
   // Canonical store path is `.gsd-t/graph.db` (matches build_index's default,
   // the query CLI, and .gitignore). Accept an explicit path when the caller
   // already knows it (runFreshnessCheck passes the exact storePath).

package/bin/gsd-t-graph-index.cjs

@@ -70,6 +70,11 @@ const SKIP_DIRS = new Set([
   'node_modules', '.next', 'dist', 'build', '.git',
   '.cache', '__pycache__', 'coverage', '.nyc_output',
   'out', '.turbo',
+  // M96 follow-up: vendored / generated trees that aren't project source and
+  // explode the file count (bee-poc had 18K files from .venv + iOS build assets,
+  // hanging scip-typescript at 8.5GB). Exclude language vendor/build dirs.
+  '.venv', 'venv', 'env', '.dart_tool', 'Pods', 'vendor', '.gradle',
+  '.idea', '.vscode', 'tmp', '.tmp', 'site-packages',
 ]);
 
 // ── Content hash ──────────────────────────────────────────────────────────────
@@ -114,7 +119,7 @@ function enumerateFiles(root) {
  * Returns a better-sqlite3 Database instance.
  */
 function openStore(dbPath) {
-  const Database = require('better-sqlite3');
+  const Database = require('./gsd-t-require-store.cjs').requireBetterSqlite();
   const db = new Database(dbPath);
   db.pragma('journal_mode = WAL');
   db.pragma('synchronous = NORMAL');

package/bin/gsd-t-graph-query-cli.cjs

@@ -232,10 +232,10 @@ function loadSkippedFiles(storePath) {
     }
     if (!dbPath) return new Set();
 
-    // Try to load better-sqlite3 — it is a devDependency, may be absent
+    // Load the graph store engine via the M96 multi-location resolver.
     let Database;
     try {
-      Database = require("better-sqlite3");
+      Database = require("./gsd-t-require-store.cjs").requireBetterSqlite();
     } catch (_e) {
       return new Set();
     }
@@ -394,7 +394,7 @@ function buildIndex(records, skippedFiles) {
  */
 function loadSqliteStore(dbPath) {
   let Database;
-  try { Database = require("better-sqlite3"); }
+  try { Database = require("./gsd-t-require-store.cjs").requireBetterSqlite(); }
   catch (_e) { return null; }
   let db;
   try {

package/bin/gsd-t-require-store.cjs

@@ -0,0 +1,89 @@
+/**
+ * gsd-t-require-store.cjs
+ *
+ * M96 — Robust resolver for the graph runtime's NATIVE dependencies
+ * (better-sqlite3, tree-sitter, tree-sitter-typescript, tree-sitter-python).
+ *
+ * The graph runtime tools (gsd-t-graph-index / -freshness / -query-cli /
+ * -edge-extract) are COPIED into each project's `bin/` by update-all. A copied
+ * tool's bare `require('better-sqlite3')` / `require('tree-sitter')` resolves
+ * from the PROJECT's node_modules — which usually lacks these native modules.
+ * This helper resolves a module from, in order:
+ *   1. the normal resolution from this file's location
+ *   2. the project's own node_modules (cwd-based)
+ *   3. the GSD-T global package's node_modules (where `dependencies` install)
+ *   4. the GSD-T dev tree (this repo), a last-resort dev fallback
+ *
+ * All four are GSD-T `dependencies` (M96), so candidate 3 is the normal hit for a
+ * propagated copy. FAIL LOUD with a remediation message if all miss — never a
+ * cryptic MODULE_NOT_FOUND, and never a SILENT degrade to an empty graph.
+ *
+ * [RULE] graph-native-dep-resolved-or-fail-loud
+ */
+
+'use strict';
+
+const path = require('node:path');
+const { execSync } = require('node:child_process');
+
+const _cache = new Map();
+let _gsdtGlobalRoot; // memoized `npm root -g`/@tekyzinc/gsd-t
+
+function gsdtGlobalNodeModules() {
+  if (_gsdtGlobalRoot !== undefined) return _gsdtGlobalRoot;
+  try {
+    const groot = execSync('npm root -g', { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+    _gsdtGlobalRoot = path.join(groot, '@tekyzinc', 'gsd-t', 'node_modules');
+  } catch {
+    _gsdtGlobalRoot = null;
+  }
+  return _gsdtGlobalRoot;
+}
+
+/**
+ * Resolve and require a native graph dependency from any known location.
+ * @param {string} moduleName  e.g. 'better-sqlite3', 'tree-sitter'
+ * @returns {*} the required module
+ * @throws {Error} a clear, actionable error if it cannot be found anywhere
+ */
+function requireGraphDep(moduleName) {
+  if (_cache.has(moduleName)) return _cache.get(moduleName);
+
+  const tried = [];
+
+  // 1. Normal resolution (this file's own module graph).
+  try {
+    const m = require(moduleName);
+    _cache.set(moduleName, m);
+    return m;
+  } catch { tried.push('local module graph'); }
+
+  // 2–4. Explicit candidate directories.
+  const candidates = [
+    path.join(process.cwd(), 'node_modules', moduleName),                 // 2. project
+    gsdtGlobalNodeModules() ? path.join(gsdtGlobalNodeModules(), moduleName) : null, // 3. global pkg
+    path.join(__dirname, '..', 'node_modules', moduleName),               // 4. GSD-T dev tree
+  ].filter(Boolean);
+
+  for (const c of candidates) {
+    tried.push(c);
+    try {
+      const m = require(c);
+      _cache.set(moduleName, m);
+      return m;
+    } catch { /* try next */ }
+  }
+
+  throw new Error(
+    `graph dependency '${moduleName}' unavailable — the code graph cannot run. ` +
+    'Reinstall GSD-T (npx @tekyzinc/gsd-t install) so the native graph deps are present. ' +
+    `Searched: ${tried.join(' | ')}`
+  );
+}
+
+/** Back-compat convenience for the store engine. */
+function requireBetterSqlite() {
+  return requireGraphDep('better-sqlite3');
+}
+
+module.exports = { requireGraphDep, requireBetterSqlite };

package/bin/gsd-t.js

@@ -2682,6 +2682,10 @@ const PROJECT_BIN_TOOLS = [
   // [[project_code_graph_universal_consumer]] [[feedback_graph_is_architectural_anchor]]
   "gsd-t-graph-query-cli.cjs", "gsd-t-graph-index.cjs", "gsd-t-graph-freshness.cjs",
   "gsd-t-graph-edge-extract.cjs", "gsd-t-graph-scip-upgrade.cjs", "gsd-t-scip-reader.cjs",
+  // M96 — multi-location resolver for the store engine (better-sqlite3), so a
+  // copied tool finds the engine from the GSD-T global package, not the project's
+  // own (usually absent) node_modules. Fail-loud with remediation if all miss.
+  "gsd-t-require-store.cjs",
 ];
 
 // Files that older versions of this installer copied into project bin/ but

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",
@@ -31,12 +31,8 @@
   },
   "devDependencies": {
     "@playwright/test": "^1.55.0",
-    "better-sqlite3": "^12.11.1",
     "graphology": "^0.26.0",
-    "kuzu": "^0.11.3",
-    "tree-sitter": "^0.21.1",
-    "tree-sitter-python": "^0.21.0",
-    "tree-sitter-typescript": "^0.23.2"
+    "kuzu": "^0.11.3"
   },
   "files": [
     "bin/",
@@ -49,5 +45,11 @@
   ],
   "engines": {
     "node": ">=16.0.0"
+  },
+  "dependencies": {
+    "better-sqlite3": "^12.11.1",
+    "tree-sitter": "^0.21.1",
+    "tree-sitter-typescript": "^0.23.2",
+    "tree-sitter-python": "^0.21.0"
   }
 }