@tekyzinc/gsd-t 5.17.10 → 5.17.12

package/CHANGELOG.md

@@ -2,6 +2,63 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.17.12] - 2026-09-02
+
+### Fixed — an import written `.js` never resolved to its `.ts` source, so `who-imports` answered "nothing imports this"
+
+`who-imports src/content/dom-observer.ts` in binvoice returned 0 importers with
+coverage "complete" while five real importers sat in the edges table. TypeScript
+ESM requires an import to be WRITTEN `./dom-observer.js` even though the file on
+disk is `dom-observer.ts`. The resolver only ever APPENDED extensions
+(`x.js`, `x.js.ts`, …) and never SWAPPED one, so the specifier could not reach
+its source. 817 of binvoice's 2,376 import edges (34%) were unresolvable this way,
+each reading as "safe to delete."
+
+- `bin/gsd-t-graph-query-cli.cjs`: after the append pass, try the swap
+  (`.js`→`.ts`/`.tsx`, `.mjs`→`.mts`, `.cjs`→`.cts`) on both the relative and
+  alias-expanded routes. A real `.js` on disk still wins; a package specifier
+  stays as written. `[RULE] query-resolves-js-specifier-to-ts-source`.
+- `test/m114-nested-tsconfig-graph.test.js`: three end-to-end tests that index a
+  tiny repo and query it through the real CLI — `.js`→`.ts` resolves, a real
+  `.js` beats the swap, an external package is not rewritten.
+
+Re-run `gsd-t graph index` is NOT required — resolution happens at query time.
+
+## [5.17.11] - 2026-09-01
+
+### Fixed — every arrow-function export was invisible to the code graph
+
+`who-calls logAudit` answered "no callers" for a function called throughout a
+server, while `verifyToken` — three lines away in the same directory — resolved
+fine. The difference was how they were declared:
+
+- `export function verifyToken()` → SCIP emits a METHOD descriptor, `verifyToken().`
+- `export const logAudit = async () => {}` → SCIP emits a TERM descriptor, `logAudit.`
+
+TypeScript treats an arrow function assigned to a const as a variable, so it gets
+a term. `funcNameFromSymbol` required the `().` shape and discarded everything
+else — on a real server that meant **3,584 term symbols dropped against 1,624
+kept**, more than twice as much data thrown away as used.
+
+The references were in the SCIP index the whole time; GSD-T was deleting them on
+read. This was diagnosed in the field as a "scip-typescript coverage limitation" —
+it was not, it was ours.
+
+Non-callable terms (`Array.`, imported types) are now admitted and cost nothing:
+a name only resolves when a call site is looking for that exact name, so a type
+reference never matches one. Parameters (`name().(p)`) stay excluded — they end
+in `)`, not `.`.
+
+Measured on the same repo, on top of 5.17.10: `server/src/index.ts` went from 30
+to **116** unique resolved symbols, compiler-accurate files 38 → **130**, call
+edges into `server/` 173 → **591**. `logAudit`, `withTransaction` and
+`getAuditContext` all return correct callers, verified against the source.
+
+- `bin/gsd-t-scip-reader.cjs`: accept term descriptors alongside method ones
+- `test/m114-nested-tsconfig-graph.test.js`: 4 more tests, mutation-tested
+
+**Re-index to pick this up**: `gsd-t graph index`.
+
 ## [5.17.10] - 2026-09-01
 
 ### Fixed — the code graph indexed one TypeScript project and called it the whole repo

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.17.10** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.17.12** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t-graph-query-cli.cjs

@@ -525,6 +525,25 @@ function loadSqliteStore(dbPath) {
     // expanded alias is ALREADY project-relative and must not be — joining it to
     // the importer's directory would produce `src/app/src/lib/db`. So the two
     // take different routes to the same place: add the extension either way.
+    // [RULE] query-resolves-js-specifier-to-ts-source
+    //
+    // binvoice, 2026-09-02: `who-imports src/content/dom-observer.ts` returned 0
+    // importers with coverage "complete" while five real importers sat in the
+    // edges table. TypeScript ESM requires an import to be WRITTEN `.js` even
+    // though the file on disk is `.ts` — so the edge says `./dom-observer.js`
+    // and no amount of appending extensions reaches `dom-observer.ts`. It has to
+    // SWAP the extension, not append to it. 817 of binvoice's 2,376 import edges
+    // (34%) were unresolvable this way, each answering "nothing imports this" —
+    // which reads as safe to delete.
+    const jsToTsCandidates = (p) => {
+      const m = /\.(js|jsx|mjs|cjs)$/.exec(p);
+      if (!m) return [];
+      const stem = p.slice(0, -m[0].length);
+      // .js->.ts/.tsx, .jsx->.tsx, .mjs->.mts, .cjs->.cts — the source files a
+      // bundler would have compiled INTO the specifier that was written.
+      return [stem + ".ts", stem + ".tsx", stem + ".mts", stem + ".cts"];
+    };
+
     const resolveDst = (srcFile, dst) => {
       if (typeof dst !== "string" || !dst) return dst;
 
@@ -536,6 +555,10 @@ function loadSqliteStore(dbPath) {
         for (const ext of EXTS) {
           if (fileIds.has(base + ext)) return base + ext;
         }
+        // An alias-expanded path can carry the same written-.js convention.
+        for (const cand of jsToTsCandidates(base)) {
+          if (fileIds.has(cand)) return cand;
+        }
         return dst; // genuinely external — keep it exactly as written
       }
 
@@ -544,6 +567,11 @@ function loadSqliteStore(dbPath) {
       for (const ext of EXTS) {
         if (fileIds.has(base + ext)) return base + ext;
       }
+      // TypeScript ESM: the import is written `.js`, the source is `.ts`. Swap,
+      // don't append. [RULE] query-resolves-js-specifier-to-ts-source
+      for (const cand of jsToTsCandidates(base)) {
+        if (fileIds.has(cand)) return cand;
+      }
       return base; // no indexed match (external/missing) — keep the resolved path
     };
 

package/bin/gsd-t-scip-reader.cjs

@@ -81,15 +81,33 @@ function loadScipProto() {
  */
 function funcNameFromSymbol(symbol) {
   if (!symbol || typeof symbol !== 'string') return null;
-  // Only function/method occurrences (end with "()."). Parameters are "name().(p)"
-  // — they don't end with "()." so they're excluded.
-  if (!/\(\)\.$/.test(symbol)) return null;
-  // The callable name is the last descriptor segment. Top-level functions are
+
+  // The name is the last descriptor segment. Top-level functions are
   // ".../`file.ts`/name()."; methods are ".../`file.ts`/Class#method()." — so the
   // name follows the LAST '/' OR '#', whichever is later (methods key on '#').
   const cut = Math.max(symbol.lastIndexOf('/'), symbol.lastIndexOf('#'));
   const descriptor = cut === -1 ? symbol : symbol.slice(cut + 1);
-  const m = descriptor.match(/^([A-Za-z_$][\w$]*)\(\)\.$/);
+
+  // TWO callable descriptor shapes, and missing the second one silently halved
+  // the graph. [RULE] scip-accepts-term-and-method-descriptors
+  //
+  //   `name().`  — a METHOD descriptor: `export function name() {}`
+  //   `name.`    — a TERM descriptor:   `export const name = async () => {}`
+  //
+  // TypeScript treats an arrow function assigned to a const as a VARIABLE, so
+  // SCIP emits a term. Requiring "()." therefore discarded every arrow-function
+  // export: on a real server that was 3,584 term symbols dropped against 1,624
+  // kept, so `who-calls logAudit` answered "no callers" for a function called
+  // throughout the codebase — while `verifyToken`, three lines away but written
+  // as `export function`, resolved fine.
+  //
+  // Non-callable terms (`Array.`, an imported type) are admitted here and cost
+  // nothing: a name only resolves when a CALL SITE is looking for that exact
+  // name, so a type reference never matches one.
+  //
+  // Parameters (`name().(p)`) stay excluded — they end in `)`, not `.`.
+  let m = descriptor.match(/^([A-Za-z_$][\w$]*)\(\)\.$/);   // function / method
+  if (!m) m = descriptor.match(/^([A-Za-z_$][\w$]*)\.$/);   // term (const arrow fn)
   return m ? m[1] : null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.17.10",
+  "version": "5.17.12",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",