@tekyzinc/gsd-t 5.16.11 → 5.17.10

package/CHANGELOG.md

@@ -2,6 +2,88 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.17.10] - 2026-09-01
+
+### Fixed — the code graph indexed one TypeScript project and called it the whole repo
+
+Found in a live TimeTracking session: 8 of 245 files indexed, 96 of 50,283 call
+edges resolved (0.2%, all same-file), and not one backend call among them. The
+root `tsconfig.json`'s `include` listed frontend paths only, so `server/src/`
+was never compiled and every backend `who-calls` returned empty.
+
+**Three defects, and fixing any one alone changes nothing.**
+
+1. **One indexer run at the repo root.** `--infer-tsconfig` does not cover this —
+   it finds *a* tsconfig when the root has none, but still emits one index from
+   one root. Now: one run per tsconfig project, merged.
+
+2. **Paths keyed to where the indexer ran.** Indexing `server/` emits
+   `src/index.ts` while the graph stores `server/src/index.ts`, so a second run
+   *without* re-prefixing resolves nothing while looking like a fix. The prefix
+   has to apply to the funcId values too (`relPath#name`), not just the map keys.
+
+3. **`who-calls` claimed `coverage.complete: true` while returning zero.**
+   Coverage counted parse failures only; a file that parsed but was never
+   compiler-resolved is equally invisible to a call query and never lands in
+   `skippedFiles`. "Nothing calls this" is what gets read right before a rename
+   or a delete — and it was firing on auth middleware.
+
+Why (3) hid so long: the per-file record handed to the query layer was
+`{file, entities, edges}` with no tier field, so the query layer structurally
+could not tell a resolved file from an unresolved one.
+
+Import queries deliberately still report complete at floor tier — import edges
+come from the parse, so `who-imports` and `blast-radius` are genuinely complete
+there, and flagging them would train you to ignore the field.
+
+Measured on TimeTracking: 8 → 40 indexed files, 0 → 173 resolved call edges into
+`server/`, 96 → 390 overall, `server/` 0 → 13 of 19 files compiler-accurate.
+Affects 13 registered projects with nested tsconfigs (binvoice 1→5 projects,
+newman 1→7, Tekyz-CRM 1→2).
+
+- `bin/gsd-t-graph-scip-upgrade.cjs`: `findTsProjectDirs()` + one indexer run per project
+- `bin/gsd-t-scip-reader.cjs`: `pathPrefix` re-roots fileRefs keys AND funcIds
+- `bin/gsd-t-graph-query-cli.cjs`: per-file tier carried onto records + tier-aware coverage
+- `test/m114-nested-tsconfig-graph.test.js`: 12 tests, each mutation-tested
+
+**Re-index to pick this up**: `gsd-t graph index` in any project with a nested
+tsconfig. A graph built before this version under-reports call edges.
+
+## [5.16.12] - 2026-08-29
+
+### Fixed — a retired hook fired on every tool call, on every machine, since M61
+
+An audit of installed hooks against what the installer registers found all 16
+expected hooks present and correct — plus one that should not have been there.
+
+M61 deleted `scripts/gsd-t-context-meter.js` (native `/context` replaced it) and
+unwired the subsystem from `init()` and `doctor()`. `install()` was missed, so it
+kept calling `configureContextMeterHooks()` and re-adding a `PostToolUse` hook
+matching `*` on every install and every update.
+
+**It never errored, which is why it survived eight months.** The command is
+guarded `[ -f … ] && node … || true`, so on every single tool call it spawned a
+bash + `npm root -g` subprocess, found nothing, and exited 0 silently — a real
+cost with no signal.
+
+The fix is two parts, because dropping the registration alone fixes nobody: a
+machine that installed the hook once keeps running it out of its own
+`settings.json`, and the installer is the only thing that reaches those machines.
+
+- `bin/gsd-t.js`: removed the `configureContextMeterHooks()` call from `install()`
+- `bin/gsd-t.js`: added the marker to `removeRetiredHooks()`, so existing machines
+  get it stripped on their next install — the same mechanism that retired the
+  M105 worktree guard
+- `bin/gsd-t.js`: exported `removeRetiredHooks` — it was not testable from
+  outside at all, which is part of why this went unnoticed
+- `test/m61-context-meter-hook-retired.test.js`: 6 regression tests, mutation-tested
+  by reverting each half of the fix
+- `.gsd-t/contracts/graph-metrics-contract.md`: stale line citation for `doMetrics`
+  (:5486 → :5488), shifted by the edit above and caught by the M99 contract-line test
+
+`configureContextMeterHooks` and `removeContextMeterHook` stay defined for the
+uninstall path. No migration needed — the next `gsd-t update` removes the hook.
+
 ## [5.16.11] - 2026-08-27
 
 ### Fixed — the voice fix was the wrong fix, and the gate was measuring the wrong thing

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.16.11** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.17.10** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t-graph-query-cli.cjs

@@ -295,16 +295,51 @@ function loadSkippedFiles(storePath) {
  * @param {Set<string>} skippedFiles  — files that failed to parse (D3-T6)
  * @returns {{ complete: boolean, unparsedContributors?: number, note?: string }}
  */
-function computeCoverage(skippedFiles) {
-  if (!skippedFiles || skippedFiles.size === 0) {
-    return { complete: true };
+function computeCoverage(skippedFiles, opts = {}) {
+  const n = (skippedFiles && skippedFiles.size) || 0;
+
+  // M114 — an UNRESOLVED file is as invisible to who-calls as an unparsed one.
+  // Parsing a file yields its call SITES; only compiler-accurate resolution says
+  // WHICH function each site targets. A floor-tier file parses fine, contributes
+  // zero resolved call edges, and never lands in skippedFiles — so coverage used
+  // to report complete:true while who-calls returned empty for an entire backend.
+  // "Nothing calls this" is what gets read right before a rename or a delete, so
+  // a false all-clear here is worse than no answer.
+  // Applies to CALL-edge queries only: IMPORT edges come from the parse, so
+  // who-imports and blast-radius are genuinely complete at floor tier.
+  const unresolved = opts.callEdgesUnresolved ? (opts.unresolvedFiles || 0) : 0;
+
+  if (n === 0 && !unresolved) return { complete: true };
+
+  const notes = [];
+  if (n) notes.push(`${n} file(s) unparsed`);
+  if (unresolved) {
+    notes.push(`${unresolved} file(s) parsed but not compiler-resolved — ` +
+      `call edges there are unknown, not absent`);
   }
-  const n = skippedFiles.size;
-  return {
+  const coverage = {
     complete: false,
-    unparsedContributors: n,
-    note: `result may be incomplete — ${n} file(s) unparsed`,
+    note: `result may be incomplete — ${notes.join('; ')}`,
   };
+  if (n) coverage.unparsedContributors = n;
+  if (unresolved) coverage.unresolvedContributors = unresolved;
+  return coverage;
+}
+
+/**
+ * Count files whose tier is NOT compiler-accurate — i.e. files that parsed but
+ * whose call targets were never resolved. These are invisible to who-calls.
+ *
+ * @param {{fileTier?: Map<string,string>}} index
+ * @returns {number}
+ */
+function countUnresolvedFiles(index) {
+  if (!index || !index.fileTier) return 0;
+  let n = 0;
+  for (const tier of index.fileTier.values()) {
+    if (tier && tier !== 'compiler-accurate') n++;
+  }
+  return n;
 }
 
 /**
@@ -332,6 +367,9 @@ function buildIndex(records, skippedFiles) {
   const funcEntities = new Map();
   /** @type {Set<string>} */
   const allFiles = new Set();
+  /** @type {Map<string,string>} file → tier (M114: who-calls needs the TARGET
+   * file's tier, not just the repo-wide dominant one). */
+  const fileTier = new Map();
 
   let dominantTier = "compiler-accurate";
   let hasFloor = false;
@@ -339,6 +377,7 @@ function buildIndex(records, skippedFiles) {
 
   for (const rec of records) {
     allFiles.add(rec.file);
+    if (rec.tier) fileTier.set(rec.file, rec.tier);
 
     if (rec.tier === "tree-sitter-floor") hasFloor = true;
     if (rec.tier === "tree-sitter-floor-STALE-SCIP") hasStaleScip = true;
@@ -384,6 +423,7 @@ function buildIndex(records, skippedFiles) {
     forwardCallEdges,
     funcEntities,
     allFiles,
+    fileTier,
     tier: dominantTier,
     skippedFiles: skippedFiles instanceof Set ? skippedFiles : new Set(),
   };
@@ -516,6 +556,17 @@ function loadSqliteStore(dbPath) {
     for (const n of nodes) {
       if (n.func_id) rec(n.file).entities.push({ funcId: n.func_id, name: n.name, file: n.file, tier: n.tier, endLine: n.end_line });
     }
+    // M114 — carry each file's TIER onto its record. Without this the record is
+    // {file, entities, edges} with no tier, so the query layer cannot tell a
+    // compiler-resolved file from an unresolved one and coverage cannot report
+    // incompleteness. A file is only compiler-accurate if every entity is; a
+    // single floor entity means some call target in it is unknown.
+    for (const n of nodes) {
+      if (!n.file) continue;
+      const r = rec(n.file);
+      if (n.tier && n.tier !== 'compiler-accurate') r.tier = n.tier;
+      else if (!r.tier) r.tier = n.tier || 'compiler-accurate';
+    }
     for (const e of edges) {
       // src for an IMPORT edge is the source FILE; for a CALL edge it's a funcId
       // (file#fn@line). The owning file record is the src's file part.
@@ -676,7 +727,7 @@ function queryWhoImports(index, target) {
  */
 function queryWhoCalls(index, identity) {
   const isFuncId = identity.includes("#");
-  const coverage = computeCoverage(index.skippedFiles);
+  const coverage = computeCoverage(index.skippedFiles, { callEdgesUnresolved: true, unresolvedFiles: countUnresolvedFiles(index) });
 
   if (isFuncId) {
     // File-qualified identity — exact funcId lookup (tolerate @line suffix:
@@ -909,7 +960,7 @@ function queryBlastRadius(index, target) {
   }
 
   const results = Array.from(visited).sort();
-  const coverage = computeCoverage(index.skippedFiles);
+  const coverage = computeCoverage(index.skippedFiles, { callEdgesUnresolved: true, unresolvedFiles: countUnresolvedFiles(index) });
   return { results, tier: index.tier, coverage };
 }
 
@@ -1295,6 +1346,7 @@ module.exports = {
   queryDangling,
   queryTestImpl,
   computeCoverage,
+  countUnresolvedFiles,
   loadStore,
   runFreshnessCheck,
   resolveStorePath,

package/bin/gsd-t-graph-scip-upgrade.cjs

@@ -243,6 +243,59 @@ function isRustCrossCrateEdge(edge, relPath) {
   return false;
 }
 
+// ── TypeScript project discovery (M114) ──────────────────────────────────────
+
+/**
+ * Find every TypeScript project root in the repo — each directory holding a
+ * `tsconfig.json`.
+ *
+ * Why: scip-typescript indexes ONE tsconfig per run, and a tsconfig's `include`
+ * governs what it can see. A repo whose root tsconfig covers only the frontend
+ * indexes only the frontend; `server/src/` is never compiled, so not one backend
+ * call resolves and `who-calls` answers empty for the entire backend.
+ * `--infer-tsconfig` does NOT cover this — it finds *a* tsconfig when the root
+ * has none, but still produces a single index from a single root.
+ *
+ * Returns repo-relative dirs, root first (`''` for the repo root itself), so the
+ * root project's symbols win when two projects define the same name.
+ *
+ * A nested project inside another's `include` gets indexed twice; that is
+ * harmless — the second read overwrites identical keys with identical values.
+ *
+ * [RULE] scip-indexes-every-tsconfig-project
+ *
+ * @param {string} repoRoot
+ * @returns {string[]} repo-relative project dirs, e.g. ['', 'server']
+ */
+function findTsProjectDirs(repoRoot) {
+  const SKIP = new Set(['node_modules', '.git', 'dist', 'build', 'out', '.venv', 'venv',
+    'site-packages', '__pycache__', '.next', 'coverage', 'Pods', '.dart_tool', 'vendor']);
+  function isSkip(name) {
+    if (SKIP.has(name)) return true;
+    return ['dist', 'build', 'out'].some(p => name.length > p.length && name.startsWith(p) &&
+      (name[p.length] === '-' || name[p.length] === '.' || name[p.length] === '_'));
+  }
+  const found = [];
+  function walk(dir, depth) {
+    if (depth > 4) return;               // deep enough for monorepo packages/*/x
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (e.isFile() && e.name === 'tsconfig.json') {
+        const rel = path.relative(repoRoot, dir).split(path.sep).join('/');
+        found.push(rel);
+      }
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && !isSkip(e.name)) walk(path.join(dir, e.name), depth + 1);
+    }
+  }
+  walk(repoRoot, 0);
+  // Root ('') first so its symbols are read before nested ones.
+  found.sort((a, b) => (a === '' ? -1 : b === '' ? 1 : a.localeCompare(b)));
+  return found;
+}
+
 // ── Repo-level SCIP resolver (M95) ────────────────────────────────────────────
 
 /**
@@ -282,11 +335,32 @@ function buildScipResolver(repoRoot, opts = {}) {
     }
   }
 
+  // TypeScript: one indexer run PER tsconfig project, each re-prefixed back to
+  // repo-root-relative paths before merging. A single root run misses every
+  // nested project (see findTsProjectDirs), and a second run without the prefix
+  // resolves nothing — both halves are required for either to work.
+  const tsProjects = [];
   if (avail.typescript && langs.typescript) {
-    try {
-      const run = runScipTypescript(repoRoot, resolveScipPath('index.scip', repoRoot));
-      if (run && run.ok) { mergeRead(readScipIndex(run.scipPath)); ranIndexers.push('typescript'); }
-    } catch { /* degrade to floor for TS */ }
+    const dirs = findTsProjectDirs(repoRoot);
+    // No tsconfig anywhere → one root run with --infer-tsconfig (prior behavior).
+    const targets = dirs.length ? dirs : [''];
+    for (const rel of targets) {
+      const absRoot = rel ? path.join(repoRoot, rel) : repoRoot;
+      // One .scip per project — a shared filename would have each run clobber
+      // the last, leaving only the final project's symbols.
+      const outName = rel ? `index-ts-${rel.replace(/[^A-Za-z0-9_-]/g, '-')}.scip` : 'index.scip';
+      try {
+        const run = runScipTypescript(absRoot, resolveScipPath(outName, repoRoot));
+        if (run && run.ok) {
+          const read = readScipIndex(run.scipPath, rel);
+          if (read && read.ok) {
+            mergeRead(read);
+            tsProjects.push({ dir: rel || '.', files: read.fileRefs.size });
+          }
+        }
+      } catch { /* this project degrades to floor; others still contribute */ }
+    }
+    if (tsProjects.length) ranIndexers.push('typescript');
   }
   if (avail.python && langs.python) {
     try {
@@ -335,7 +409,17 @@ function buildScipResolver(repoRoot, opts = {}) {
     return { edges: out, resolved };
   }
 
-  return { ok: true, indexers: ranIndexers, scipPath: resolveScipPath('index.scip', repoRoot), resolveFileEdges };
+  // tsProjects reports which tsconfig projects actually contributed refs. A
+  // project that ran but yielded 0 files is the signature of this bug class —
+  // surfaced rather than swallowed, so a re-index can be inspected.
+  return {
+    ok: true,
+    indexers: ranIndexers,
+    tsProjects,
+    indexedFiles: fileRefs.size,
+    scipPath: resolveScipPath('index.scip', repoRoot),
+    resolveFileEdges,
+  };
 }
 
 /** No-op resolver used when SCIP is unavailable (floor mode). */
@@ -495,6 +579,7 @@ if (require.main === module) {
 module.exports = {
   tryScipUpgrade,
   buildScipResolver,
+  findTsProjectDirs,
   detectScip,
   _resetScipCache,
   isRustCrossCrateEdge,

package/bin/gsd-t-scip-reader.cjs

@@ -118,12 +118,29 @@ function isBuildOutputPath(relPath) {
 /**
  * Decode a `.scip` file and build resolution maps.
  *
+ * `pathPrefix` re-roots every path in the index to be repo-root-relative.
+ * An indexer reports paths relative to WHERE IT RAN: indexing `server/` emits
+ * `src/index.ts`, while the graph stores `server/src/index.ts`. Without the
+ * prefix, a nested project's refs key on paths the graph has never heard of and
+ * resolve nothing — a second indexer run would LOOK like a fix and change
+ * nothing. [RULE] scip-paths-reprefixed-to-repo-root
+ *
+ * The prefix must apply to BOTH the fileRefs keys AND the funcId values, since
+ * a funcId is `relPath#name` — prefixing only the keys leaves every funcId
+ * pointing at a path the graph does not have.
+ *
  * @param {string} scipPath  absolute path to an index.scip
+ * @param {string} [pathPrefix]  repo-relative dir the index was produced from
+ *                               (e.g. "server"); "" or "." for the repo root
  * @returns {{ ok: true, symbolToDef: Map<string,string>,
  *             fileRefs: Map<string, Array<{symbol:string, funcId:string, line:number}>> }
  *         | { ok: false, reason: string }}
  */
-function readScipIndex(scipPath) {
+function readScipIndex(scipPath, pathPrefix) {
+  // Normalize: "", ".", "./", "server/" and "server" all mean the same thing.
+  const rawPrefix = (pathPrefix || '').replace(/^\.\/+/, '').replace(/\/+$/, '');
+  const prefix = (rawPrefix === '' || rawPrefix === '.') ? '' : rawPrefix + '/';
+  const reroot = prefix ? (p) => prefix + p : (p) => p;
   const proto = loadScipProto();
   if (!proto) {
     return { ok: false, reason: 'scip-decoder-unavailable' };
@@ -147,22 +164,24 @@ function readScipIndex(scipPath) {
 
   // First pass: collect every DEFINITION occurrence → symbol → funcId.
   for (const doc of docs) {
-    const relPath = doc.relative_path;
-    if (!relPath || isBuildOutputPath(relPath)) continue;
+    const rawPath = doc.relative_path;
+    if (!rawPath || isBuildOutputPath(rawPath)) continue;
+    const relPath = reroot(rawPath);
     for (const occ of doc.occurrences || []) {
       const isDef = (occ.symbol_roles & SYMBOL_ROLE_DEFINITION) !== 0;
       if (!isDef) continue;
       const name = funcNameFromSymbol(occ.symbol);
       if (!name) continue;
-      // funcId = the graph's file#name key
+      // funcId = the graph's file#name key (repo-root-relative)
       symbolToDef.set(occ.symbol, `${relPath}#${name}`);
     }
   }
 
   // Second pass: collect every REFERENCE occurrence per file, resolved to the def.
   for (const doc of docs) {
-    const relPath = doc.relative_path;
-    if (!relPath || isBuildOutputPath(relPath)) continue;
+    const rawPath = doc.relative_path;
+    if (!rawPath || isBuildOutputPath(rawPath)) continue;
+    const relPath = reroot(rawPath);
     const refs = [];
     for (const occ of doc.occurrences || []) {
       const isDef = (occ.symbol_roles & SYMBOL_ROLE_DEFINITION) !== 0;

package/bin/gsd-t.js

@@ -1205,11 +1205,16 @@ function removeInterceptHooks(settingsPath) {
 //   session signal, but subagents write those too, so one session with agents
 //   looked like several colliding sessions and the guard blocked its own user.
 //
+//   gsd-t-context-meter — M61, script deleted; native /context replaced it.
+//   init() stopped provisioning it then, but install() kept re-registering it,
+//   so every machine still runs it on EVERY tool call: a bash + `npm root -g`
+//   subprocess spawned to look for a file that no longer ships.
+//
 // Throws on any failure. A retired hook that silently survives keeps blocking
 // edits forever, so "could not remove it" must stop the install loudly rather
 // than report success.
 function removeRetiredHooks(settingsPath) {
-  const RETIRED_HOOK_MARKERS = ["gsd-t-worktree-guard"];
+  const RETIRED_HOOK_MARKERS = ["gsd-t-worktree-guard", CONTEXT_METER_HOOK_MARKER];
   const targetPath = settingsPath || SETTINGS_JSON;
   if (!fs.existsSync(targetPath)) return { removed: 0 };
 
@@ -2285,13 +2290,10 @@ async function doInstall(opts = {}) {
   heading("Global Bin Tools (~/.claude/bin/)");
   installGlobalBinTools();
 
-  heading("Context Meter (PostToolUse)");
-  const cmHook = configureContextMeterHooks(SETTINGS_JSON);
-  if (cmHook.installed) {
-    if (cmHook.action === "added") success("Context meter PostToolUse hook added");
-    else if (cmHook.action === "updated") success("Context meter hook command refreshed");
-    else info("Context meter hook already configured");
-  }
+  // M61: Context Meter retired (scripts/gsd-t-context-meter.js deleted; native
+  // /context replaces it). The configureContextMeterHooks() call that stood here
+  // re-registered a PostToolUse hook pointing at that deleted script on every
+  // install. removeRetiredHooks() below now strips it instead.
 
   heading("Graph-Intercept (PostToolUse on Grep — M97)");
   const giHook = configureGraphInterceptHook(SETTINGS_JSON);
@@ -2318,7 +2320,7 @@ async function doInstall(opts = {}) {
 
   const retired = removeRetiredHooks(SETTINGS_JSON);
   if (retired.removed > 0) {
-    success(`Removed ${retired.removed} retired hook(s) from settings.json (worktree-collision guard — M105)`);
+    success(`Removed ${retired.removed} retired hook(s) from settings.json (worktree-collision guard — M105; context meter — M61)`);
   }
 
   // M105 worktree-collision guard RETIRED (2026-08-08). It detected sessions from
@@ -5610,6 +5612,7 @@ module.exports = {
   installContextMeter,
   configureContextMeterHooks,
   removeContextMeterHook,
+  removeRetiredHooks,
   // M97/M98: intercept hook installers
   configureGraphInterceptHook,
   configureReadInterceptHook,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.16.11",
+  "version": "5.17.10",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",