gsd-pi 2.59.0-dev.d77b3dd → 2.60.0-dev.2580e65

package/src/resources/extensions/gsd/tools/reopen-task.ts

@@ -22,6 +22,7 @@ import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
+import { logWarning } from "../workflow-logger.js";
 
 export interface ReopenTaskParams {
   milestoneId: string;
@@ -117,9 +118,7 @@ export async function handleReopenTask(
       trigger_reason: params.triggerReason,
     });
   } catch (hookErr) {
-    process.stderr.write(
-      `gsd: reopen-task post-mutation hook warning: ${(hookErr as Error).message}\n`,
-    );
+    logWarning("tool", `reopen-task post-mutation hook warning: ${(hookErr as Error).message}`);
   }
 
   return {

package/src/resources/extensions/gsd/tools/replan-slice.ts

@@ -16,6 +16,7 @@ import { renderPlanFromDb, renderReplanFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
+import { logWarning } from "../workflow-logger.js";
 
 export interface ReplanSliceTaskInput {
   taskId: string;
@@ -226,9 +227,7 @@ export async function handleReplanSlice(
         trigger_reason: params.triggerReason,
       });
     } catch (hookErr) {
-      process.stderr.write(
-        `gsd: replan-slice post-mutation hook warning: ${(hookErr as Error).message}\n`,
-      );
+      logWarning("tool", `replan-slice post-mutation hook warning: ${(hookErr as Error).message}`);
     }
 
     return {

package/src/resources/extensions/gsd/tools/validate-milestone.ts

@@ -22,6 +22,7 @@ import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
 import { VALIDATION_VERDICTS, isValidMilestoneVerdict } from "../verdict-parser.js";
 import { insertMilestoneValidationGates } from "../milestone-validation-gates.js";
+import { logWarning } from "../workflow-logger.js";
 
 export interface ValidateMilestoneParams {
   milestoneId: string;
@@ -137,9 +138,7 @@ export async function handleValidateMilestone(
   try {
     await saveFile(validationPath, validationMd);
   } catch (renderErr) {
-    process.stderr.write(
-      `gsd-db: validate_milestone — disk render failed, rolling back DB row: ${(renderErr as Error).message}\n`,
-    );
+    logWarning("tool", `validate_milestone — disk render failed, rolling back DB row: ${(renderErr as Error).message}`);
     deleteAssessmentByScope(params.milestoneId, 'milestone-validation');
     return { error: `disk render failed: ${(renderErr as Error).message}` };
   }

package/src/resources/extensions/gsd/triage-resolution.ts

@@ -148,10 +148,17 @@ export function executeBacktrack(
   capture: CaptureEntry,
 ): string | null {
   try {
-    // Extract target milestone from capture text or resolution
-    const targetMatch = (capture.resolution ?? capture.text)
-      .match(/\b(M\d{3}(?:-[a-z0-9]{6})?)\b/);
-    const targetMilestoneId = targetMatch?.[1] ?? null;
+    // Extract target milestone from capture text or resolution.
+    // Filter out the current milestone ID to avoid picking it as the backtrack target
+    // when the text mentions both current and target milestones (e.g. "backtrack from M004 to M003").
+    const sourceText = capture.resolution ?? capture.text;
+    const allMatches = [...sourceText.matchAll(/\b(M\d{3}(?:-[a-z0-9]{6})?)\b/g)]
+      .map(m => m[1])
+      .filter(id => id !== currentMilestoneId);
+    // Reject ambiguous multi-target strings — if more than one distinct target remains,
+    // don't guess; let the user clarify.
+    const uniqueTargets = [...new Set(allMatches)];
+    const targetMilestoneId = uniqueTargets.length === 1 ? uniqueTargets[0] : null;
 
     const ts = new Date().toISOString();
     const triggerPath = join(gsdRoot(basePath), "BACKTRACK-TRIGGER.md");

package/src/resources/extensions/gsd/types.ts

@@ -316,6 +316,7 @@ export interface ClassificationResult {
   tier: ComplexityTier;
   reason: string;
   downgraded: boolean;
+  taskMetadata?: TaskMetadata;
 }
 
 export interface TaskMetadata {

package/src/resources/extensions/gsd/workflow-events.ts

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { appendFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { atomicWriteSync } from "./atomic-write.js";
+import { logWarning } from "./workflow-logger.js";
 
 // ─── Session ID ───────────────────────────────────────────────────────────
 
@@ -74,7 +75,7 @@ export function readEvents(logPath: string): WorkflowEvent[] {
     try {
       events.push(JSON.parse(line) as WorkflowEvent);
     } catch {
-      process.stderr.write(`workflow-events: skipping corrupted event line: ${line.slice(0, 80)}\n`);
+      logWarning("event-log", `skipping corrupted event line (${line.length} bytes)`);
     }
   }
 

package/src/resources/extensions/gsd/workflow-logger.ts

@@ -2,7 +2,9 @@
 // Centralized warning/error accumulator for the workflow engine pipeline.
 // Captures structured entries that the auto-loop can drain after each unit
 // to surface root causes for stuck loops, silent degradation, and blocked writes.
-// All entries are also persisted to .gsd/audit-log.jsonl for post-mortem analysis.
+// Error-severity entries are persisted to .gsd/audit-log.jsonl (sanitized) for
+// post-mortem analysis. Warnings are ephemeral (stderr + buffer only) to avoid
+// log amplification from expected-control-flow catch paths.
 //
 // Stderr policy: every logWarning/logError call writes immediately to stderr
 // for terminal visibility. This is intentional — unlike debug-logger (which is
@@ -33,7 +35,20 @@ export type LogComponent =
   | "compaction"    // Event compaction
   | "reconcile"     // Worktree reconciliation
   | "db"            // Database operations (gsd-db)
-  | "dispatch";     // Auto-dispatch rule evaluation
+  | "dispatch"      // Auto-dispatch rule evaluation
+  | "recovery"      // Auto-recovery and timeout recovery
+  | "session"       // Session lock and session state I/O
+  | "prompt"        // Prompt construction and context injection
+  | "dashboard"     // Auto-dashboard rendering
+  | "timer"         // Auto-timers (idle watchdog, hard timeout)
+  | "worktree"      // Worktree lifecycle (create, sync, merge)
+  | "command"       // Slash command execution and maintenance
+  | "parallel"      // Parallel orchestrator and merge
+  | "fs"            // Safe filesystem operations
+  | "bootstrap"     // Extension bootstrap (system-context, agent-end)
+  | "guided"        // Guided flow (discuss, plan wizards)
+  | "registry"      // Rule registry hook state
+  | "renderer";     // Markdown renderer and projections
 
 export interface LogEntry {
   ts: string;
@@ -230,15 +245,47 @@ function _push(
     _buffer.shift();
   }
 
-  // Persist to .gsd/audit-log.jsonl so entries survive context resets
-  if (_auditBasePath) {
+  // Persist errors to .gsd/audit-log.jsonl so they survive context resets.
+  // Only error-severity entries are persisted — warnings are ephemeral (stderr + buffer)
+  // to avoid log amplification from expected-control-flow catch paths.
+  if (_auditBasePath && severity === "error") {
     try {
       const auditDir = join(_auditBasePath, ".gsd");
       mkdirSync(auditDir, { recursive: true });
-      appendFileSync(join(auditDir, "audit-log.jsonl"), JSON.stringify(entry) + "\n", "utf-8");
+      const sanitized = _sanitizeForAudit(entry);
+      appendFileSync(join(auditDir, "audit-log.jsonl"), JSON.stringify(sanitized) + "\n", "utf-8");
     } catch (auditErr) {
       // Best-effort — never let audit write failures bubble up
       process.stderr.write(`[gsd:audit] failed to persist log entry: ${(auditErr as Error).message}\n`);
     }
   }
 }
+
+/**
+ * Sanitize a log entry before persisting to the audit JSONL file.
+ * Strips potentially sensitive context (raw paths, cwd, full error text)
+ * to avoid leaking local environment details into durable telemetry.
+ */
+function _sanitizeForAudit(entry: LogEntry): LogEntry {
+  const sanitized: LogEntry = {
+    ts: entry.ts,
+    severity: entry.severity,
+    component: entry.component,
+    // Truncate message to avoid persisting oversized raw error dumps
+    message: entry.message.length > 200 ? entry.message.slice(0, 200) + "…[truncated]" : entry.message,
+  };
+  if (entry.context) {
+    // Allowlist: only persist known-safe structured keys
+    const SAFE_KEYS = new Set(["fn", "tool", "mid", "sid", "tid", "worktree"]);
+    const filtered: Record<string, string> = {};
+    for (const [k, v] of Object.entries(entry.context)) {
+      if (SAFE_KEYS.has(k)) {
+        filtered[k] = v;
+      }
+    }
+    if (Object.keys(filtered).length > 0) {
+      sanitized.context = filtered;
+    }
+  }
+  return sanitized;
+}

package/src/resources/extensions/gsd/workflow-migration.ts

@@ -7,6 +7,7 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { _getAdapter, transaction } from "./gsd-db.js";
 import { parseRoadmap, parsePlan } from "./parsers-legacy.js";
+import { logWarning } from "./workflow-logger.js";
 
 // ─── needsAutoMigration ───────────────────────────────────────────────────
 
@@ -23,8 +24,8 @@ export function needsAutoMigration(basePath: string): boolean {
   try {
     const row = db.prepare("SELECT COUNT(*) as cnt FROM milestones").get();
     if (row && (row["cnt"] as number) > 0) return false;
-  } catch {
-    // Table might not exist yet — that's fine, we can still migrate
+  } catch (e) {
+    logWarning("migration", `DB probe failed: ${(e as Error).message}`);
     return false;
   }
 
@@ -71,7 +72,7 @@ export function migrateFromMarkdown(basePath: string): void {
       .filter(e => e.isDirectory())
       .map(e => e.name);
   } catch {
-    process.stderr.write("workflow-migration: failed to read milestones directory\n");
+    logWarning("migration", "failed to read milestones directory");
     return;
   }
 
@@ -141,7 +142,7 @@ export function migrateFromMarkdown(basePath: string): void {
           risk: s.risk || "low",
         }));
       } catch (err) {
-        process.stderr.write(`workflow-migration: failed to parse ROADMAP.md for ${mId}: ${(err as Error).message}\n`);
+        logWarning("migration", `failed to parse ROADMAP.md for ${mId}: ${(err as Error).message}`);
         // Still add milestone with ID as title
         milestoneInserts.push({ id: mId, title: mId, status: milestoneStatus });
       }
@@ -191,7 +192,7 @@ export function migrateFromMarkdown(basePath: string): void {
             });
           }
         } catch (err) {
-          process.stderr.write(`workflow-migration: failed to parse ${slice.id}-PLAN.md for ${mId}: ${(err as Error).message}\n`);
+          logWarning("migration", `failed to parse ${slice.id}-PLAN.md for ${mId}: ${(err as Error).message}`);
         }
       }
     }
@@ -206,8 +207,8 @@ export function migrateFromMarkdown(basePath: string): void {
           process.stderr.write(`workflow-migration: orphaned summary file ${summaryFile} in ${mId} (slice not found in ROADMAP.md), skipping\n`);
         }
       }
-    } catch {
-      // Non-fatal
+    } catch (e) {
+      logWarning("migration", `Orphaned summary check failed for ${mId}: ${(e as Error).message}`);
     }
   }
 
@@ -308,17 +309,18 @@ export function validateMigration(basePath: string): { discrepancies: string[] }
                 const planContent = readFileSync(planPath, "utf-8");
                 const plan = parsePlan(planContent);
                 mdTaskCount += plan.tasks.length;
-              } catch {
-                // Skip unreadable plan
+              } catch (e) {
+                logWarning("migration", `Failed to read plan ${slice.id}-PLAN.md: ${(e as Error).message}`);
               }
             }
           }
-        } catch {
-          // Skip unreadable roadmap
+        } catch (e) {
+          logWarning("migration", `Failed to read roadmap for ${mId}: ${(e as Error).message}`);
         }
       }
     }
-  } catch {
+  } catch (e) {
+    logWarning("migration", `Validation failed to read markdown: ${(e as Error).message}`);
     return { discrepancies: ["Failed to read markdown for validation"] };
   }
 

package/src/resources/extensions/gsd/workflow-projections.ts

@@ -423,7 +423,7 @@ export function regenerateIfMissing(
           renderSummaryProjection(basePath, milestoneId, sliceId, task.id);
           regenerated++;
         } catch (err) {
-          console.error(`[projections] regenerateIfMissing SUMMARY failed for ${task.id}:`, err);
+          logWarning("projection", `regenerateIfMissing SUMMARY failed for ${task.id}: ${(err as Error).message}`);
         }
       }
     }
@@ -452,7 +452,7 @@ export function regenerateIfMissing(
     }
     return true;
   } catch (err) {
-    console.error(`[projections] regenerateIfMissing ${fileType} failed:`, err);
+    logWarning("projection", `regenerateIfMissing ${fileType} failed: ${(err as Error).message}`);
     return false;
   }
 }

package/src/resources/extensions/gsd/workflow-reconcile.ts

@@ -455,8 +455,8 @@ function parseEventBlock(block: string): WorkflowEvent[] {
           if (paramsMatch) {
             try {
               params = JSON.parse(paramsMatch[1]!) as Record<string, unknown>;
-            } catch {
-              // Keep empty params on parse error
+            } catch (e) {
+              logWarning("reconcile", `tool call params parse failed: ${(e as Error).message}`);
             }
             i++; // consume params line
           }

package/src/resources/extensions/gsd/worktree-manager.ts

@@ -95,8 +95,8 @@ export function resolveGitDir(basePath: string): string {
     if (content.startsWith("gitdir: ")) {
       return resolve(basePath, content.slice(8));
     }
-  } catch {
-    // Not a file or unreadable — fall through to default
+  } catch (e) {
+    logWarning("worktree", `.git file read failed: ${(e as Error).message}`);
   }
   return join(basePath, ".git");
 }
@@ -308,8 +308,9 @@ export function findNestedGitDirs(rootPath: string): string[] {
     let entries: string[];
     try {
       entries = readdirSync(dir);
-    } catch {
-      return; // Permission denied, broken symlink, etc.
+    } catch (e) {
+      logWarning("worktree", `readdirSync failed: ${(e as Error).message}`);
+      return;
     }
 
     for (const entry of entries) {
@@ -321,7 +322,8 @@ export function findNestedGitDirs(rootPath: string): string[] {
       let stat;
       try {
         stat = lstatSync(fullPath);
-      } catch {
+      } catch (e) {
+        logWarning("worktree", `lstatSync failed for ${fullPath}: ${(e as Error).message}`);
         continue;
       }
       if (!stat.isDirectory()) continue;
@@ -337,8 +339,8 @@ export function findNestedGitDirs(rootPath: string): string[] {
           // Don't recurse into the nested repo — we found what we need
           continue;
         }
-      } catch {
-        // No .git here — continue scanning
+      } catch (e) {
+        logWarning("worktree", `existsSync/.git check failed for ${fullPath}: ${(e as Error).message}`);
       }
 
       walk(fullPath, depth + 1);
@@ -374,7 +376,7 @@ export function removeWorktree(
     if (entry?.path) {
       wtPath = entry.path;
     }
-  } catch { /* fall back to computed path */ }
+  } catch (e) { logWarning("worktree", `nativeWorktreeList parse failed: ${(e as Error).message}`); }
 
   const resolvedWtPath = existsSync(wtPath) ? realpathSync(wtPath) : wtPath;
 
@@ -388,7 +390,7 @@ export function removeWorktree(
   if (!existsSync(wtPath)) {
     nativeWorktreePrune(basePath);
     if (deleteBranch) {
-      try { nativeBranchDelete(basePath, branch, true); } catch { /* branch may not exist */ }
+      try { nativeBranchDelete(basePath, branch, true); } catch (e) { logWarning("worktree", `nativeBranchDelete failed: ${(e as Error).message}`); }
     }
     return;
   }
@@ -422,8 +424,8 @@ export function removeWorktree(
           logWarning("reconcile", `Submodule changes detected — stash failed, changes may be lost during force removal`, { worktree: name, path: resolvedWtPath });
         }
       }
-    } catch {
-      // submodule status failed — proceed with normal removal
+    } catch (e) {
+      logWarning("worktree", `submodule status check failed: ${(e as Error).message}`);
     }
   }
 
@@ -454,11 +456,11 @@ export function removeWorktree(
   // Remove worktree: try non-force first when submodules have changes,
   // falling back to force only after submodule state has been preserved.
   const useForce = hasSubmoduleChanges ? false : force;
-  try { nativeWorktreeRemove(basePath, resolvedWtPath, useForce); } catch { /* may fail */ }
+  try { nativeWorktreeRemove(basePath, resolvedWtPath, useForce); } catch (e) { logWarning("worktree", `nativeWorktreeRemove failed: ${(e as Error).message}`); }
 
   // If the directory is still there (e.g. locked), try harder with force
   if (existsSync(resolvedWtPath)) {
-    try { nativeWorktreeRemove(basePath, resolvedWtPath, true); } catch { /* may fail */ }
+    try { nativeWorktreeRemove(basePath, resolvedWtPath, true); } catch (e) { logWarning("worktree", `nativeWorktreeRemove (force) failed: ${(e as Error).message}`); }
   }
 
   // (#2821) If the worktree directory STILL exists after both native removal
@@ -488,7 +490,7 @@ export function removeWorktree(
   nativeWorktreePrune(basePath);
 
   if (deleteBranch) {
-    try { nativeBranchDelete(basePath, branch, true); } catch { /* branch may not exist */ }
+    try { nativeBranchDelete(basePath, branch, true); } catch (e) { logWarning("worktree", `final branch delete failed: ${(e as Error).message}`); }
   }
 }
 

package/src/resources/extensions/shared/interview-ui.ts

@@ -298,7 +298,9 @@ export async function showInterviewRound(
 			// Auto-open the notes field when "None of the above" is selected
 			// so the user can immediately provide a free-text explanation
 			// instead of being trapped in a re-asking loop (bug #2715).
-			if (!isMultiSelect(currentIdx) && states[currentIdx].cursorIndex === noneOrDoneIdx(currentIdx)) {
+			// Only auto-open if the user hasn't already provided notes —
+			// otherwise Enter from notes mode loops back here endlessly.
+			if (!isMultiSelect(currentIdx) && states[currentIdx].cursorIndex === noneOrDoneIdx(currentIdx) && !states[currentIdx].notes) {
 				states[currentIdx].notesVisible = true;
 				focusNotes = true;
 				loadStateToEditor();

package/src/resources/extensions/shared/tests/interview-notes-loop.test.ts

@@ -0,0 +1,144 @@
+// GSD2 — Regression test for interview-ui "None of the above" notes loop
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+
+/**
+ * Regression test for bug #3502:
+ *
+ * Selecting "None of the above" opens the notes field, but pressing Enter
+ * after typing a note called goNextOrSubmit() which saw the cursor still
+ * on the "None of the above" slot and re-opened notes — trapping the user
+ * in an infinite loop.
+ *
+ * The fix adds a `!states[currentIdx].notes` guard so auto-open only fires
+ * when notes are still empty.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { showInterviewRound, type Question, type RoundResult } from "../interview-ui.js";
+
+// Raw terminal sequences that matchesKey() recognises
+const ENTER = "\r";
+const DOWN = "\x1b[B";
+const TAB = "\t";
+
+/**
+ * Drive showInterviewRound with a scripted sequence of key inputs.
+ * We mock ctx.ui.custom() to capture the widget, feed it inputs, and
+ * resolve when done() is called.
+ */
+function runWithInputs(
+	questions: Question[],
+	inputs: string[],
+): Promise<RoundResult> {
+	return new Promise((resolve, reject) => {
+		const timeout = setTimeout(() => reject(new Error("Timed out — likely stuck in infinite loop")), 3000);
+
+		const mockCtx = {
+			ui: {
+				custom: (factory: any) => {
+					const mockTui = {
+						requestRender: () => {},
+					};
+					const mockTheme = {
+						// Minimal theme stubs — render output is not asserted
+						fg: (_c: string, t: string) => t,
+						bold: (t: string) => t,
+						dim: (t: string) => t,
+						italic: (t: string) => t,
+						strikethrough: (t: string) => t,
+						accent: (t: string) => t,
+						success: (t: string) => t,
+						warning: (t: string) => t,
+						error: (t: string) => t,
+						info: (t: string) => t,
+						muted: (t: string) => t,
+						dimmed: (t: string) => t,
+					};
+					const mockKb = {};
+
+					const widget = factory(mockTui, mockTheme, mockKb, (result: RoundResult) => {
+						clearTimeout(timeout);
+						resolve(result);
+					});
+
+					// Feed each input sequentially
+					for (const input of inputs) {
+						widget.handleInput(input);
+					}
+				},
+			},
+		};
+
+		showInterviewRound(questions, {}, mockCtx as any).catch(reject);
+	});
+}
+
+describe("interview-ui notes loop regression (#3502)", () => {
+	const questions: Question[] = [
+		{
+			id: "q1",
+			header: "Project Type",
+			question: "What type of project?",
+			options: [
+				{ label: "Web App", description: "Frontend or full-stack" },
+				{ label: "CLI Tool", description: "Command-line utility" },
+			],
+		},
+	];
+
+	it("does not loop when Enter is pressed after typing a note on 'None of the above'", async () => {
+		// With 2 options, "None of the above" is index 2 (0-based)
+		// Cursor starts at 0, so press Down twice to reach it
+		const result = await runWithInputs(questions, [
+			DOWN,        // cursor → index 1 (CLI Tool)
+			DOWN,        // cursor → index 2 (None of the above)
+			ENTER,       // commit → auto-opens notes field
+			"u", "n", "s", "u", "r", "e",  // type "unsure"
+			ENTER,       // should advance to review, NOT reopen notes
+			ENTER,       // submit from review screen
+		]);
+
+		// If we get here, the loop did not occur (timeout would have fired)
+		assert.ok(result, "should return a result");
+		assert.equal(result.endInterview, false);
+
+		const answer = result.answers.q1;
+		assert.ok(answer, "answer for q1 should exist");
+		assert.equal(answer.notes, "unsure", "notes should contain typed text");
+		assert.equal(answer.selected, "None of the above");
+	});
+
+	it("still auto-opens notes when selecting 'None of the above' with no prior notes", async () => {
+		// Press Down twice to "None of the above", Enter to select
+		// Then immediately Enter again (empty notes) — this should re-open notes
+		// because the guard only skips when notes are non-empty.
+		// Type something on second open, then Enter to proceed.
+		const result = await runWithInputs(questions, [
+			DOWN,        // cursor → 1
+			DOWN,        // cursor → 2 (None of the above)
+			ENTER,       // commit → auto-opens notes
+			ENTER,       // empty notes → goNextOrSubmit → should re-open notes (empty guard)
+			"o", "k",    // type "ok"
+			ENTER,       // now notes = "ok" → should advance to review
+			ENTER,       // submit
+		]);
+
+		assert.ok(result, "should return a result");
+		const answer = result.answers.q1;
+		assert.ok(answer, "answer for q1 should exist");
+		assert.equal(answer.notes, "ok");
+	});
+
+	it("normal option selection is unaffected", async () => {
+		const result = await runWithInputs(questions, [
+			ENTER,       // select first option (Web App) and advance to review
+			ENTER,       // submit from review screen
+		]);
+
+		assert.ok(result, "should return a result");
+		const answer = result.answers.q1;
+		assert.ok(answer, "answer for q1 should exist");
+		assert.equal(answer.selected, "Web App");
+	});
+});