@tekyzinc/gsd-t 4.13.10 → 4.13.12

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [4.13.12] - 2026-06-30
+
+### Fixed — scan graph probe silently fell back to grep-mode despite a LIVE graph
+
+A `/gsd-t-scan` on NiceNote announced `GRAPH-FALLBACK — graph index not available` and ran in grep-mode, even though the dependency graph was live (156 files, compiler-accurate, all verbs + freshness verified working). Root cause, proven by reproducing the probe through a real haiku agent: the scan's `runCli` told a **haiku** agent to "return ONLY the raw JSON line" and then `JSON.parse`'d the free-text reply — haiku wrapped the JSON in a ```` ```json ```` fence, `JSON.parse` threw, the catch returned `graph-unavailable`, and the scan demoted to grep-mode. The graph, CLI, cwd, and bin-presence were all fine. This is the deterministic-orchestration anti-pattern (a reliability-critical gate routed through an LLM's free text).
+
+- `templates/workflows/gsd-t-scan.workflow.js`: `runCli` now passes a `schema` (StructuredOutput) so the probe returns structured JSON via the tool layer, never fence-vulnerable prose; resolves project-local bin → global `gsd-t graph` fallback; drops `2>/dev/null` and surfaces `reason`/`via` in the fallback log (parse-fail vs cli-not-found vs cli-error). Mirrors the proven `gsd-t-verify.workflow.js` runCli.
+- `test/m94-d6-scan-consumer.test.js`: source-structural regression test — scan `runCli` MUST use `schema:`, MUST NOT `JSON.parse(result…)`, MUST have a global-bin fallback. (The prior test only simulated recorded envelopes; it never exercised the parsing layer where the bug lived.)
+
+The probe stays `model: "haiku"` (a mechanical CLI call) — the schema, not the model tier, is the fix. Suite: 2542/2546 pass; M71 sandbox + M85 tier lints green.
+
+## [4.13.11] - 2026-06-29
+
+### Fixed — `gsd-t graph body` reachable from the front door (M98 follow-up)
+
+M98 shipped the `body` slice logic in the query CLI and wired the Read-intercept hook, but the top-level `gsd-t graph` router in `bin/gsd-t.js` had no `case "body"` — so `gsd-t graph body <fn>` fell through to "Unknown graph subcommand". The headline M98 feature worked via the internal CLI and the hook, but was unreachable from the user-facing `gsd-t graph` command (the M98 test exercised the CLI directly, never the front door).
+
+- **`bin/gsd-t.js`** — added `case "body"` to the graph subcommand router (delegates to the D5 query CLI, mirrors `who-calls`/`blast-radius`); added `body` to the usage string.
+- **`test/m94-d5-graph-dispatch.test.js`** — new front-door regression test: `gsd-t graph body` must route to the CLI and emit a `{ ok, verb:"body" }` envelope, never "Unknown graph subcommand".
+
+Verified on real binvoice: `gsd-t graph body selectCommentId` now returns the live 43-line slice (compiler-accurate, imports + callers) through the front door. Suite: 2541/2545 pass.
+
 ## [4.13.10] - 2026-06-29
 
 ### Added — The graph serves code (function-level slices) + Read-intercept (M98)

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v4.13.10** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v4.13.12** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t.js

@@ -3880,10 +3880,11 @@ function doGraph(args) {
     case "who-imports":   { const e = _graphQueryCli(["who-imports", args[1] || ""]); log(JSON.stringify(e, null, 2)); break; }
     case "who-calls":     { const e = _graphQueryCli(["who-calls",   args[1] || ""]); log(JSON.stringify(e, null, 2)); break; }
     case "blast-radius":  { const e = _graphQueryCli(["blast-radius", args[1] || ""]); log(JSON.stringify(e, null, 2)); break; }
+    case "body":          { const e = _graphQueryCli(["body",         args[1] || ""]); log(JSON.stringify(e, null, 2)); break; }
     case "tasks":         doGraphTaskOutput(args[1] || "table"); break;
     default:
       error(`Unknown graph subcommand: ${sub}`);
-      info("Usage: gsd-t graph [index|status|query|who-imports|who-calls|blast-radius|tasks]");
+      info("Usage: gsd-t graph [index|status|query|who-imports|who-calls|blast-radius|body|tasks]");
       info("       gsd-t graph --output json|table   (task DAG)");
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "4.13.10",
+  "version": "4.13.12",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",

package/templates/workflows/gsd-t-scan.workflow.js

@@ -238,29 +238,53 @@ const GRAPH_SLICE_SCHEMA = {
 let structuralSlice = null;   // { deadCode, dangling, clusters, coverage, tier } | null
 let graphWiringMode = "pending"; // "wired" | "fallback-announced" | "disabled"
 
-// M94-D6: runCli — inline async helper that delegates CLI calls to an agent() Bash.
-// M81 invariant: NO require/fs/child_process in the orchestrator body.
-// This is the ONLY way to invoke the D5 query CLI from the sandbox.
-// [RULE] no-graph-baseline-proven-graph-free — this helper is called ONLY when graphMode==="wired".
+// M94-D6: runCli — inline async helper that delegates the D5 graph-query CLI to an
+// agent() Bash. M81 invariant: NO require/fs/child_process in the orchestrator body —
+// the agent runs the command; we read back a SCHEMA-VALIDATED envelope.
+//
+// v4.13.12 HARDENING (root cause of the NiceNote 2026-06-29 silent grep-fallback):
+// the old version told a HAIKU agent to "return ONLY the raw JSON line" and then
+// JSON.parse()'d its free-text reply. Haiku wrapped the JSON in a ```json fence →
+// JSON.parse threw → caught → graph-unavailable → grep-mode, even though the graph
+// was live (status returned ok, 156 files, compiler-accurate). Three fixes, mirroring
+// the proven gsd-t-verify.workflow.js runCli:
+//   1. SCHEMA-validated agent output (StructuredOutput) — the model returns structured
+//      JSON via the tool layer, never fenced text; no brittle JSON.parse of prose.
+//   2. project-local bin → GLOBAL `gsd-t` fallback (a project without a local bin copy
+//      no longer fails the probe — it was hardcoded to `node bin/...cjs`).
+//   3. stderr captured (dropped `2>/dev/null`) and surfaced in `reason` so the fallback
+//      log can say WHY (parse-fail vs not-found vs CLI-error), never a bare "unavailable".
+// [RULE] no-graph-baseline-proven-graph-free — called ONLY when graphMode==="wired".
+// [RULE] graph-probe-schema-validated-never-fence-parsed
+const _GRAPH_CLI_ENVELOPE_SCHEMA = {
+  type: "object",
+  required: ["ok"],
+  additionalProperties: true,
+  properties: {
+    ok:       { type: "boolean", description: "true iff the CLI printed a JSON envelope with ok:true" },
+    reason:   { type: "string",  description: "on failure: graph-unavailable / cli-not-found / cli-error / non-json-output, plus any stderr" },
+    via:      { type: "string",  description: "local | global | error" },
+    results:  { type: "array", items: {}, description: "the verb's results array (dead-code/dangling/cluster/etc.), [] if none" },
+    tier:     { type: "string",  description: "compiler-accurate | tree-sitter-floor | ... when present" },
+    coverage: {                   description: "coverage envelope when the verb returns one" },
+  },
+};
 async function runCli(verb, target, label) {
-  const targetArg = target ? ` ${JSON.stringify(target)}` : "";
-  const cmd = `node bin/gsd-t-graph-query-cli.cjs ${verb}${targetArg} 2>/dev/null || echo '{"ok":false,"reason":"graph-unavailable"}'`;
-  const result = await agent(
-    [
-      `Run the following command in \`${projectDir}\` via Bash and return ONLY the raw JSON line it prints (no commentary):`,
-      `\`\`\`bash`,
-      `cd ${JSON.stringify(projectDir)} && ${cmd}`,
-      `\`\`\``,
-      `If the command fails or prints no JSON, return: {"ok":false,"reason":"graph-unavailable"}`,
-      `Return ONLY the JSON, nothing else.`,
-    ].join("\n"),
-    { label: `graph:${label || verb}`, phase: "Graph-Wiring", model: "haiku" }
-  ).catch(() => null);
-  try {
-    return (typeof result === "string") ? JSON.parse(result.trim()) : (result || { ok: false, reason: "graph-unavailable" });
-  } catch (_) {
-    return { ok: false, reason: "graph-unavailable" };
-  }
+  const targetArg = target ? ` '${String(target).replace(/'/g, "'\\''")}'` : "";
+  const prompt = [
+    `Run the GSD-T graph-query CLI for the project at \`${projectDir}\` and report its result. Steps:`,
+    `1. If \`${projectDir}/bin/gsd-t-graph-query-cli.cjs\` exists, run: \`node ${projectDir}/bin/gsd-t-graph-query-cli.cjs ${verb}${targetArg}\` (set via="local"). Otherwise run: \`gsd-t graph ${verb}${targetArg}\` (set via="global"). Use cwd \`${projectDir}\`. Do NOT redirect stderr — capture it.`,
+    `2. The command prints ONE JSON envelope to stdout. Parse it. Set ok = (the parsed envelope's "ok" field === true). Copy its "results", "tier", and "coverage" fields through if present.`,
+    `3. If the command exits non-zero, prints no JSON, or stdout is not valid JSON: set ok=false and put a short reason in "reason" — "cli-not-found" if the file/binary was missing, else "cli-error", else "non-json-output" — and append the first ~200 chars of stderr.`,
+    `Do NOT do any other work. ONLY run this one command and report the structured result.`,
+  ].join("\n");
+  const r = await agent(prompt, {
+    label: `graph:${label || verb}`,
+    phase: "Graph-Wiring",
+    model: "haiku",
+    schema: _GRAPH_CLI_ENVELOPE_SCHEMA,
+  }).catch((e) => ({ ok: false, reason: `agent-error: ${e && e.message}`, via: "error" }));
+  return r || { ok: false, reason: "graph-unavailable", via: "error" };
 }
 
 // Preflight: an agent checks branch + whether a prior register exists, via Bash.
@@ -339,7 +363,7 @@ if (graphMode === "disabled") {
     // Graph unavailable — announce fallback, continue with intact grep-mode scan.
     // [RULE] parser-fail-disables-loud-never-silent (from graph-query-cli-contract)
     graphWiringMode = "fallback-announced";
-    log(`⚠ GRAPH-FALLBACK (ANNOUNCED): graph index not available (${(statusResult && statusResult.reason) || "graph-unavailable"}) — scan continues in full grep-mode (today's architecture, intact). Structural findings from LLM reconstruction only. Build the index (gsd-t graph build) to enable graph-wired accuracy.`);
+    log(`⚠ GRAPH-FALLBACK (ANNOUNCED): graph status probe returned not-ok [reason=${(statusResult && statusResult.reason) || "graph-unavailable"}, via=${(statusResult && statusResult.via) || "?"}] — scan continues in full grep-mode (today's architecture, intact). Structural findings from LLM reconstruction only. Build the index (gsd-t graph build) to enable graph-wired accuracy.`);
   } else {
     // Step 2: query the structural slice (dead-code + dangling + clusters).
     // These are the findings the deep-finders currently reconstruct by reading files (error-prone);