gsd-pi 2.33.0-dev.bafba33 → 2.33.1-dev.235d83a

package/dist/resources/extensions/gsd/unit-runtime.ts

@@ -1,192 +0,0 @@
-import { existsSync, readdirSync, readFileSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
-import {
-  gsdRoot,
-  relSliceFile,
-  relTaskFile,
-  resolveSliceFile,
-  resolveTaskFile,
-} from "./paths.js";
-import { loadFile, parseTaskPlanMustHaves, countMustHavesMentionedInSummary } from "./files.js";
-import { loadJsonFileOrNull, saveJsonFile } from "./json-persistence.js";
-import { parseUnitId } from "./unit-id.js";
-
-export type UnitRuntimePhase =
-  | "dispatched"
-  | "wrapup-warning-sent"
-  | "timeout"
-  | "recovered"
-  | "finalized"
-  | "paused"
-  | "skipped";
-
-export interface ExecuteTaskRecoveryStatus {
-  planPath: string;
-  summaryPath: string;
-  summaryExists: boolean;
-  taskChecked: boolean;
-  nextActionAdvanced: boolean;
-  mustHaveCount: number;
-  mustHavesMentionedInSummary: number;
-}
-
-export interface AutoUnitRuntimeRecord {
-  version: 1;
-  unitType: string;
-  unitId: string;
-  startedAt: number;
-  updatedAt: number;
-  phase: UnitRuntimePhase;
-  wrapupWarningSent: boolean;
-  continueHereFired: boolean;
-  timeoutAt: number | null;
-  lastProgressAt: number;
-  progressCount: number;
-  lastProgressKind: string;
-  recovery?: ExecuteTaskRecoveryStatus;
-  recoveryAttempts?: number;
-  lastRecoveryReason?: "idle" | "hard";
-}
-
-function isAutoUnitRuntimeRecord(data: unknown): data is AutoUnitRuntimeRecord {
-  return (
-    typeof data === "object" &&
-    data !== null &&
-    (data as AutoUnitRuntimeRecord).version === 1 &&
-    typeof (data as AutoUnitRuntimeRecord).unitType === "string" &&
-    typeof (data as AutoUnitRuntimeRecord).unitId === "string"
-  );
-}
-
-function runtimeDir(basePath: string): string {
-  return join(gsdRoot(basePath), "runtime", "units");
-}
-
-function runtimePath(basePath: string, unitType: string, unitId: string): string {
-  const sanitizedUnitType = unitType.replace(/[^a-zA-Z0-9._-]+/g, "-");
-  const sanitizedUnitId = unitId.replace(/[^a-zA-Z0-9._-]+/g, "-");
-  return join(runtimeDir(basePath), `${sanitizedUnitType}-${sanitizedUnitId}.json`);
-}
-
-export function writeUnitRuntimeRecord(
-  basePath: string,
-  unitType: string,
-  unitId: string,
-  startedAt: number,
-  updates: Partial<AutoUnitRuntimeRecord> = {},
-): AutoUnitRuntimeRecord {
-  const path = runtimePath(basePath, unitType, unitId);
-  const prev = readUnitRuntimeRecord(basePath, unitType, unitId);
-  const next: AutoUnitRuntimeRecord = {
-    version: 1,
-    unitType,
-    unitId,
-    startedAt,
-    updatedAt: Date.now(),
-    phase: updates.phase ?? prev?.phase ?? "dispatched",
-    wrapupWarningSent: updates.wrapupWarningSent ?? prev?.wrapupWarningSent ?? false,
-    continueHereFired: updates.continueHereFired ?? prev?.continueHereFired ?? false,
-    timeoutAt: updates.timeoutAt ?? prev?.timeoutAt ?? null,
-    lastProgressAt: updates.lastProgressAt ?? prev?.lastProgressAt ?? Date.now(),
-    progressCount: updates.progressCount ?? prev?.progressCount ?? 0,
-    lastProgressKind: updates.lastProgressKind ?? prev?.lastProgressKind ?? "dispatch",
-    recovery: updates.recovery ?? prev?.recovery,
-    recoveryAttempts: updates.recoveryAttempts ?? prev?.recoveryAttempts ?? 0,
-    lastRecoveryReason: updates.lastRecoveryReason ?? prev?.lastRecoveryReason,
-  };
-  saveJsonFile(path, next);
-  return next;
-}
-
-export function readUnitRuntimeRecord(basePath: string, unitType: string, unitId: string): AutoUnitRuntimeRecord | null {
-  return loadJsonFileOrNull(runtimePath(basePath, unitType, unitId), isAutoUnitRuntimeRecord);
-}
-
-export function clearUnitRuntimeRecord(basePath: string, unitType: string, unitId: string): void {
-  const path = runtimePath(basePath, unitType, unitId);
-  if (existsSync(path)) unlinkSync(path);
-}
-
-/**
- * Return all runtime records currently on disk for `basePath`.
- * Returns an empty array if the runtime directory does not exist.
- */
-export function listUnitRuntimeRecords(basePath: string): AutoUnitRuntimeRecord[] {
-  const dir = runtimeDir(basePath);
-  if (!existsSync(dir)) return [];
-  const results: AutoUnitRuntimeRecord[] = [];
-  for (const file of readdirSync(dir)) {
-    if (!file.endsWith(".json")) continue;
-    try {
-      const raw = readFileSync(join(dir, file), "utf-8");
-      const record = JSON.parse(raw) as AutoUnitRuntimeRecord;
-      results.push(record);
-    } catch {
-      // Skip malformed files
-    }
-  }
-  return results;
-}
-
-export async function inspectExecuteTaskDurability(
-  basePath: string,
-  unitId: string,
-): Promise<ExecuteTaskRecoveryStatus | null> {
-  const { milestone: mid, slice: sid, task: tid } = parseUnitId(unitId);
-  if (!mid || !sid || !tid) return null;
-
-  const planAbs = resolveSliceFile(basePath, mid, sid, "PLAN");
-  const summaryAbs = resolveTaskFile(basePath, mid, sid, tid, "SUMMARY");
-  const stateAbs = join(gsdRoot(basePath), "STATE.md");
-
-  const planPath = relSliceFile(basePath, mid, sid, "PLAN");
-  const summaryPath = relTaskFile(basePath, mid, sid, tid, "SUMMARY");
-
-  const planContent = planAbs ? await loadFile(planAbs) : null;
-  const stateContent = existsSync(stateAbs) ? readFileSync(stateAbs, "utf-8") : "";
-  const summaryExists = !!(summaryAbs && existsSync(summaryAbs));
-
-  const escapedTid = tid.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const taskChecked = !!planContent && new RegExp(`^- \\[[xX]\\] \\*\\*${escapedTid}:`, "m").test(planContent);
-  const nextActionAdvanced = !new RegExp(`Execute ${tid}\\b`).test(stateContent);
-
-  // Must-have coverage: load task plan and count mentions in summary
-  let mustHaveCount = 0;
-  let mustHavesMentionedInSummary = 0;
-
-  const taskPlanAbs = resolveTaskFile(basePath, mid, sid, tid, "PLAN");
-  if (taskPlanAbs) {
-    const taskPlanContent = await loadFile(taskPlanAbs);
-    if (taskPlanContent) {
-      const mustHaves = parseTaskPlanMustHaves(taskPlanContent);
-      mustHaveCount = mustHaves.length;
-      if (mustHaveCount > 0 && summaryExists && summaryAbs) {
-        const summaryContent = await loadFile(summaryAbs);
-        if (summaryContent) {
-          mustHavesMentionedInSummary = countMustHavesMentionedInSummary(mustHaves, summaryContent);
-        }
-      }
-    }
-  }
-
-  return {
-    planPath,
-    summaryPath,
-    summaryExists,
-    taskChecked,
-    nextActionAdvanced,
-    mustHaveCount,
-    mustHavesMentionedInSummary,
-  };
-}
-
-export function formatExecuteTaskRecoveryStatus(status: ExecuteTaskRecoveryStatus): string {
-  const missing = [] as string[];
-  if (!status.summaryExists) missing.push(`summary missing (${status.summaryPath})`);
-  if (!status.taskChecked) missing.push(`task checkbox unchecked in ${status.planPath}`);
-  if (!status.nextActionAdvanced) missing.push("state next action still points at the timed-out task");
-  if (status.mustHaveCount > 0 && status.mustHavesMentionedInSummary < status.mustHaveCount) {
-    missing.push(`must-have gap: ${status.mustHavesMentionedInSummary} of ${status.mustHaveCount} must-haves addressed in summary`);
-  }
-  return missing.length > 0 ? missing.join("; ") : "all durable task artifacts present";
-}

package/dist/resources/extensions/gsd/validate-directory.ts

@@ -1,164 +0,0 @@
-/**
- * GSD Directory Validation — Safeguards against running in dangerous directories.
- *
- * Prevents GSD from creating .gsd/ structures in system paths, home directories,
- * or other locations where writing project scaffolding would be harmful.
- */
-
-import { realpathSync, readdirSync } from "node:fs";
-import { homedir, platform, tmpdir } from "node:os";
-import { resolve } from "node:path";
-
-// ─── Types ──────────────────────────────────────────────────────────────────────
-
-export interface DirectoryValidationResult {
-  /** Whether the directory is safe for GSD operations */
-  safe: boolean;
-  /** Severity: "blocked" = hard stop, "warning" = user can override */
-  severity: "ok" | "blocked" | "warning";
-  /** Human-readable reason if not safe */
-  reason?: string;
-}
-
-// ─── Blocked Paths ──────────────────────────────────────────────────────────────
-
-/** Paths where GSD must never create .gsd/ — no override possible. */
-const UNIX_BLOCKED_PATHS = new Set([
-  "/",
-  "/bin",
-  "/sbin",
-  "/usr",
-  "/usr/bin",
-  "/usr/sbin",
-  "/usr/lib",
-  "/usr/local",
-  "/usr/local/bin",
-  "/etc",
-  "/var",
-  "/var/tmp",
-  "/dev",
-  "/proc",
-  "/sys",
-  "/boot",
-  "/lib",
-  "/lib64",
-  // macOS-specific
-  "/System",
-  "/Library",
-  "/Applications",
-  "/Volumes",
-  "/private",
-  "/private/var",
-  "/private/etc",
-  "/private/tmp",
-]);
-
-const WINDOWS_BLOCKED_PATHS = new Set([
-  "C:\\",
-  "C:\\Windows",
-  "C:\\Windows\\System32",
-  "C:\\Program Files",
-  "C:\\Program Files (x86)",
-]);
-
-// ─── Core Validation ────────────────────────────────────────────────────────────
-
-/**
- * Validate whether a directory is safe for GSD to operate in.
- *
- * Checks in order:
- * 1. Blocked system paths (hard stop)
- * 2. Home directory itself (hard stop)
- * 3. Temp directory root (hard stop)
- * 4. High entry count heuristic (warning)
- */
-export function validateDirectory(dirPath: string): DirectoryValidationResult {
-  // Resolve to absolute + follow symlinks so aliases can't bypass checks
-  let resolved: string;
-  try {
-    resolved = realpathSync(resolve(dirPath));
-  } catch {
-    // If we can't resolve, use the raw resolved path
-    resolved = resolve(dirPath);
-  }
-
-  // Normalize trailing slashes for consistent comparison.
-  // Special cases: "/" → "/" (not ""), "C:\" → "C:\" (not "C:")
-  let normalized = resolved.replace(/[/\\]+$/, "");
-  if (normalized === "") {
-    normalized = "/";
-  } else if (/^[A-Za-z]:$/.test(normalized)) {
-    normalized = normalized + "\\";
-  }
-
-  // ── Check 1: Blocked system paths ──────────────────────────────────────
-  const blockedPaths = platform() === "win32" ? WINDOWS_BLOCKED_PATHS : UNIX_BLOCKED_PATHS;
-  if (blockedPaths.has(normalized)) {
-    return {
-      safe: false,
-      severity: "blocked",
-      reason: `Refusing to run in system directory: ${normalized}. GSD must be run inside a project directory.`,
-    };
-  }
-
-  // ── Check 2: Home directory itself (not subdirs) ───────────────────────
-  let resolvedHome: string;
-  try {
-    resolvedHome = realpathSync(resolve(homedir())).replace(/[/\\]+$/, "");
-  } catch {
-    resolvedHome = resolve(homedir()).replace(/[/\\]+$/, "");
-  }
-
-  if (normalized === resolvedHome) {
-    return {
-      safe: false,
-      severity: "blocked",
-      reason: `Refusing to run in your home directory (${normalized}). GSD must be run inside a project directory, not $HOME.`,
-    };
-  }
-
-  // ── Check 3: Temp directory root ───────────────────────────────────────
-  let resolvedTmp: string;
-  try {
-    resolvedTmp = realpathSync(resolve(tmpdir())).replace(/[/\\]+$/, "");
-  } catch {
-    resolvedTmp = resolve(tmpdir()).replace(/[/\\]+$/, "");
-  }
-
-  if (normalized === resolvedTmp) {
-    return {
-      safe: false,
-      severity: "blocked",
-      reason: `Refusing to run in the system temp directory (${normalized}). Use a project subdirectory instead.`,
-    };
-  }
-
-  // ── Check 4: Suspiciously large directory (heuristic warning) ──────────
-  try {
-    const entries = readdirSync(normalized);
-    if (entries.length > 200) {
-      return {
-        safe: false,
-        severity: "warning",
-        reason: `This directory has ${entries.length} entries, which suggests it may not be a project directory. Are you sure you want to initialize GSD here?`,
-      };
-    }
-  } catch {
-    // Can't read directory — let downstream handle the error
-  }
-
-  return { safe: true, severity: "ok" };
-}
-
-/**
- * Assert that a directory is safe for GSD operations.
- * Throws with a descriptive message if the directory is blocked.
- * Returns the validation result for warnings (caller decides how to handle).
- */
-export function assertSafeDirectory(dirPath: string): DirectoryValidationResult {
-  const result = validateDirectory(dirPath);
-  if (result.severity === "blocked") {
-    throw new Error(result.reason);
-  }
-  return result;
-}

package/dist/resources/extensions/gsd/verification-evidence.ts

@@ -1,188 +0,0 @@
-/**
- * Verification Evidence — JSON persistence and markdown table formatting.
- *
- * Two pure-ish functions:
- *   - writeVerificationJSON: persists a machine-readable T##-VERIFY.json artifact
- *   - formatEvidenceTable:   returns a markdown evidence table string
- *
- * JSON schema uses schemaVersion: 1 for forward-compatibility.
- * stdout/stderr are intentionally excluded from the JSON to avoid unbounded file sizes.
- */
-
-import { mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import type { VerificationResult } from "./types.ts";
-
-// ─── JSON Evidence Artifact ──────────────────────────────────────────────────
-
-export interface EvidenceCheckJSON {
-  command: string;
-  exitCode: number;
-  durationMs: number;
-  verdict: "pass" | "fail";
-  blocking: boolean;
-}
-
-export interface RuntimeErrorJSON {
-  source: "bg-shell" | "browser";
-  severity: "crash" | "error" | "warning";
-  message: string;
-  blocking: boolean;
-}
-
-export interface AuditWarningJSON {
-  name: string;
-  severity: string;
-  title: string;
-  url: string;
-  fixAvailable: boolean;
-}
-
-export interface EvidenceJSON {
-  schemaVersion: 1;
-  taskId: string;
-  unitId: string;
-  timestamp: number;
-  passed: boolean;
-  discoverySource: string;
-  checks: EvidenceCheckJSON[];
-  retryAttempt?: number;
-  maxRetries?: number;
-  runtimeErrors?: RuntimeErrorJSON[];
-  auditWarnings?: AuditWarningJSON[];
-}
-
-/**
- * Write a T##-VERIFY.json artifact to the tasks directory.
- * Creates the directory with mkdirSync({ recursive: true }) if it doesn't exist.
- *
- * stdout/stderr are excluded from the JSON — the full output lives in VerificationResult
- * in memory and is logged to stderr during the gate run.
- */
-export function writeVerificationJSON(
-  result: VerificationResult,
-  tasksDir: string,
-  taskId: string,
-  unitId?: string,
-  retryAttempt?: number,
-  maxRetries?: number,
-): void {
-  mkdirSync(tasksDir, { recursive: true });
-
-  const evidence: EvidenceJSON = {
-    schemaVersion: 1,
-    taskId,
-    unitId: unitId ?? taskId,
-    timestamp: result.timestamp,
-    passed: result.passed,
-    discoverySource: result.discoverySource,
-    checks: result.checks.map((check) => ({
-      command: check.command,
-      exitCode: check.exitCode,
-      durationMs: check.durationMs,
-      verdict: check.exitCode === 0 ? "pass" : "fail",
-      blocking: check.blocking,
-    })),
-    ...(retryAttempt !== undefined ? { retryAttempt } : {}),
-    ...(maxRetries !== undefined ? { maxRetries } : {}),
-  };
-
-  if (result.runtimeErrors && result.runtimeErrors.length > 0) {
-    evidence.runtimeErrors = result.runtimeErrors.map(e => ({
-      source: e.source,
-      severity: e.severity,
-      message: e.message,
-      blocking: e.blocking,
-    }));
-  }
-
-  if (result.auditWarnings && result.auditWarnings.length > 0) {
-    evidence.auditWarnings = result.auditWarnings.map(w => ({
-      name: w.name,
-      severity: w.severity,
-      title: w.title,
-      url: w.url,
-      fixAvailable: w.fixAvailable,
-    }));
-  }
-
-  const filePath = join(tasksDir, `${taskId}-VERIFY.json`);
-  writeFileSync(filePath, JSON.stringify(evidence, null, 2) + "\n", "utf-8");
-}
-
-// ─── Markdown Evidence Table ─────────────────────────────────────────────────
-
-/**
- * Format duration in milliseconds as seconds with 1 decimal place.
- * e.g. 2340 → "2.3s", 150 → "0.2s", 0 → "0.0s"
- *
- * Distinct from the shared formatDuration (which uses adaptive ms/s/m/h units);
- * evidence tables always display seconds for consistent column alignment.
- */
-function formatDurationSecs(ms: number): string {
-  return `${(ms / 1000).toFixed(1)}s`;
-}
-
-/**
- * Generate a markdown evidence table from a VerificationResult.
- *
- * Returns a "no checks" note if result.checks is empty.
- * Otherwise returns a 5-column markdown table: #, Command, Exit Code, Verdict, Duration.
- */
-export function formatEvidenceTable(result: VerificationResult): string {
-  if (result.checks.length === 0) {
-    return "_No verification checks discovered._";
-  }
-
-  const lines: string[] = [
-    "| # | Command | Exit Code | Verdict | Duration |",
-    "|---|---------|-----------|---------|----------|",
-  ];
-
-  for (let i = 0; i < result.checks.length; i++) {
-    const check = result.checks[i];
-    const num = i + 1;
-    const verdict =
-      check.exitCode === 0 ? "✅ pass" : "❌ fail";
-    const duration = formatDurationSecs(check.durationMs);
-
-    lines.push(
-      `| ${num} | ${check.command} | ${check.exitCode} | ${verdict} | ${duration} |`,
-    );
-  }
-
-  if (result.runtimeErrors && result.runtimeErrors.length > 0) {
-    lines.push("");
-    lines.push("**Runtime Errors**");
-    lines.push("");
-    lines.push("| # | Source | Severity | Blocking | Message |");
-    lines.push("|---|--------|----------|----------|---------|");
-    for (let i = 0; i < result.runtimeErrors.length; i++) {
-      const err = result.runtimeErrors[i];
-      const blockIcon = err.blocking ? "🚫 yes" : "ℹ️ no";
-      lines.push(`| ${i + 1} | ${err.source} | ${err.severity} | ${blockIcon} | ${err.message.slice(0, 100)} |`);
-    }
-  }
-
-  if (result.auditWarnings && result.auditWarnings.length > 0) {
-    const severityEmoji: Record<string, string> = {
-      critical: "🔴",
-      high: "🟠",
-      moderate: "🟡",
-      low: "⚪",
-    };
-    lines.push("");
-    lines.push("**Audit Warnings**");
-    lines.push("");
-    lines.push("| # | Package | Severity | Title | Fix Available |");
-    lines.push("|---|---------|----------|-------|---------------|");
-    for (let i = 0; i < result.auditWarnings.length; i++) {
-      const w = result.auditWarnings[i];
-      const emoji = severityEmoji[w.severity] ?? "⚪";
-      const fix = w.fixAvailable ? "✅ yes" : "❌ no";
-      lines.push(`| ${i + 1} | ${w.name} | ${emoji} ${w.severity} | ${w.title} | ${fix} |`);
-    }
-  }
-
-  return lines.join("\n");
-}