gsd-pi 2.63.0 → 2.64.0-dev.1a85e85

package/dist/resources/extensions/gsd/roadmap-slices.js

@@ -74,7 +74,7 @@ function parseTableSlices(section) {
         // Determine completion status from any cell containing [x], "Done", or "Complete"
         const fullRow = line.toLowerCase();
         const done = /\[x\]/i.test(line) ||
-            /[✅☑✓]/.test(line) ||
+            /[✅☑✓✔]/.test(line) ||
             /\bdone\b/.test(fullRow) ||
             /\bcomplete(?:d)?\b/.test(fullRow);
         // Extract risk from any cell containing risk keywords
@@ -214,10 +214,10 @@ function parseProseSliceHeaders(content) {
     // numeric prefixes (e.g., "1.", "(1)"), bracketed IDs (e.g., "[S01]"),
     // optional checkmark completion marker, and optional leading indentation.
     // Separator after the ID is flexible: colon, dash, em/en dash, dot, or just whitespace.
-    const headerPattern = /^\s*#{1,4}\s+\*{0,2}(?:\u2713\s+)?(?:\d+[.)]\s+)?(?:\(\d+\)\s+)?(?:Slice\s+)?\[?(S\d+)\]?\*{0,2}[:\s.\u2014\u2013-]*\s*(.+)/gm;
+    const headerPattern = /^\s*#{1,4}\s+\*{0,2}(?:[\u2713\u2705]\s+)?(?:\d+[.)]\s+)?(?:\(\d+\)\s+)?(?:Slice\s+)?\[?(S\d+)\]?\*{0,2}[:\s.\u2014\u2013-]*\s*(.+)/gm;
     let match;
     // Check for checkmark before the slice ID (e.g., "## checkmark S01: Title")
-    const prefixCheckPattern = /^\s*#{1,4}\s+\*{0,2}\u2713\s+/;
+    const prefixCheckPattern = /^\s*#{1,4}\s+\*{0,2}[\u2713\u2705]\s+/;
     while ((match = headerPattern.exec(content)) !== null) {
         const id = match[1];
         let title = match[2].trim().replace(/\*{1,2}$/g, "").trim(); // strip trailing bold markers
@@ -229,9 +229,13 @@ function parseProseSliceHeaders(content) {
         // 3. (Complete) suffix: "## S01: Title (Complete)"
         const line = match[0];
         let done = prefixCheckPattern.test(line);
-        if (!done && title.startsWith("\u2713")) {
+        if (!done && /^[\u2713\u2705]/.test(title)) {
             done = true;
-            title = title.replace(/^\u2713\s*/, "");
+            title = title.replace(/^[\u2713\u2705]\s*/, "");
+        }
+        if (!done && /[\u2705]\s*$/.test(title)) {
+            done = true;
+            title = title.replace(/\s*[\u2705]\s*$/, "");
         }
         if (!done && /\(Complete\)\s*$/i.test(title)) {
             done = true;

package/dist/resources/extensions/gsd/safety/content-validator.js

@@ -0,0 +1,73 @@
+/**
+ * Lightweight content validator for auto-mode safety harness.
+ * Validates that high-value unit outputs contain minimum expected content.
+ *
+ * Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { logWarning } from "../workflow-logger.js";
+// ─── Public API ─────────────────────────────────────────────────────────────
+/**
+ * Validate content quality for a completed unit.
+ * Returns an array of violations. Empty array = content looks acceptable.
+ *
+ * @param unitType - The type of unit that completed (e.g. "plan-slice")
+ * @param artifactPath - Absolute path to the primary artifact file
+ */
+export function validateContent(unitType, artifactPath) {
+    if (!artifactPath || !existsSync(artifactPath))
+        return [];
+    const validator = VALIDATORS[unitType];
+    if (!validator)
+        return [];
+    try {
+        const content = readFileSync(artifactPath, "utf-8");
+        return validator(content);
+    }
+    catch (e) {
+        logWarning("safety", `content validation read failed: ${e.message}`);
+        return [];
+    }
+}
+const VALIDATORS = {
+    "plan-slice": validatePlanSlice,
+    "plan-milestone": validatePlanMilestone,
+};
+function validatePlanSlice(content) {
+    const violations = [];
+    // Must have at least 2 task entries (checkbox pattern)
+    const taskCount = (content.match(/- \[[ x]\] \*\*T\d+/g) || []).length;
+    if (taskCount < 2) {
+        violations.push({
+            severity: "warning",
+            reason: `Slice plan has only ${taskCount} task(s) — expected at least 2`,
+        });
+    }
+    // Should have a Files Likely Touched section
+    if (!content.includes("## Files Likely Touched") && !content.includes("## Files")) {
+        violations.push({
+            severity: "warning",
+            reason: "Slice plan missing 'Files Likely Touched' section",
+        });
+    }
+    // Should have a verification section
+    if (!content.includes("Verify") && !content.includes("verify")) {
+        violations.push({
+            severity: "warning",
+            reason: "Slice plan has no verification instructions",
+        });
+    }
+    return violations;
+}
+function validatePlanMilestone(content) {
+    const violations = [];
+    // Must have at least 1 slice entry
+    const sliceCount = (content.match(/##\s+S\d+/g) || []).length;
+    if (sliceCount < 1) {
+        violations.push({
+            severity: "warning",
+            reason: `Milestone roadmap has ${sliceCount} slice(s) — expected at least 1`,
+        });
+    }
+    return violations;
+}

package/dist/resources/extensions/gsd/safety/destructive-guard.js

@@ -0,0 +1,34 @@
+/**
+ * Destructive command classifier for auto-mode safety harness.
+ * Classifies bash commands and warns on potentially destructive operations.
+ * Does NOT block — only classifies for logging/notification.
+ *
+ * Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+ */
+const DESTRUCTIVE_PATTERNS = [
+    { pattern: /\brm\s+(-[^\s]*[rfRF][^\s]*\s+|.*\s+-[^\s]*[rfRF])/, label: "recursive delete" },
+    { pattern: /\bgit\s+push\s+.*--force/, label: "force push" },
+    { pattern: /\bgit\s+push\s+-f\b/, label: "force push" },
+    { pattern: /\bgit\s+reset\s+--hard/, label: "hard reset" },
+    { pattern: /\bgit\s+clean\s+-[^\s]*[fdxFDX]/, label: "git clean" },
+    { pattern: /\bgit\s+checkout\s+--\s+\./, label: "discard all changes" },
+    { pattern: /\bdrop\s+(database|table|index)\b/i, label: "SQL drop" },
+    { pattern: /\btruncate\s+table\b/i, label: "SQL truncate" },
+    { pattern: /\bchmod\s+777\b/, label: "world-writable permissions" },
+    { pattern: /\bcurl\s.*\|\s*(bash|sh|zsh)\b/, label: "pipe to shell" },
+];
+/**
+ * Classify a bash command for destructive operations.
+ * Returns the list of matched destructive pattern labels.
+ */
+export function classifyCommand(command) {
+    const labels = [];
+    for (const { pattern, label } of DESTRUCTIVE_PATTERNS) {
+        if (pattern.test(command)) {
+            // Deduplicate labels (e.g., two force-push patterns)
+            if (!labels.includes(label))
+                labels.push(label);
+        }
+    }
+    return { destructive: labels.length > 0, labels };
+}

package/dist/resources/extensions/gsd/safety/evidence-collector.js

@@ -0,0 +1,109 @@
+/**
+ * Real-time tool call evidence collector for auto-mode safety harness.
+ * Tracks every bash command, file write, and file edit during a unit execution.
+ * Evidence is compared against LLM completion claims in evidence-cross-ref.ts.
+ *
+ * Follows the same module-level Map pattern as auto-tool-tracking.ts.
+ * Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+ */
+// ─── Module State ───────────────────────────────────────────────────────────
+let unitEvidence = [];
+// ─── Public API ─────────────────────────────────────────────────────────────
+/** Reset all evidence for a new unit. Call at unit start. */
+export function resetEvidence() {
+    unitEvidence = [];
+}
+/** Get a read-only view of all evidence collected for the current unit. */
+export function getEvidence() {
+    return unitEvidence;
+}
+/** Get only bash evidence entries. */
+export function getBashEvidence() {
+    return unitEvidence.filter((e) => e.kind === "bash");
+}
+/** Get all file paths touched (write + edit). */
+export function getFilePaths() {
+    return unitEvidence
+        .filter((e) => e.kind === "write" || e.kind === "edit")
+        .map(e => e.path);
+}
+// ─── Recording (called from register-hooks.ts) ─────────────────────────────
+/**
+ * Record a tool call at dispatch time (before execution).
+ * Exit codes and output are filled in by recordToolResult after execution.
+ */
+export function recordToolCall(toolName, input) {
+    if (toolName === "bash" || toolName === "Bash") {
+        unitEvidence.push({
+            kind: "bash",
+            toolCallId: "",
+            command: String(input.command ?? ""),
+            exitCode: -1,
+            outputSnippet: "",
+            timestamp: Date.now(),
+        });
+    }
+    else if (toolName === "write" || toolName === "Write") {
+        unitEvidence.push({
+            kind: "write",
+            toolCallId: "",
+            path: String(input.file_path ?? input.path ?? ""),
+            timestamp: Date.now(),
+        });
+    }
+    else if (toolName === "edit" || toolName === "Edit") {
+        unitEvidence.push({
+            kind: "edit",
+            toolCallId: "",
+            path: String(input.file_path ?? input.path ?? ""),
+            timestamp: Date.now(),
+        });
+    }
+}
+/**
+ * Record a tool execution result. Matches the most recent unresolved entry
+ * of the same kind and fills in the toolCallId, exit code, and output.
+ */
+export function recordToolResult(toolCallId, toolName, result, isError) {
+    const normalizedName = toolName.toLowerCase();
+    if (normalizedName === "bash") {
+        const entry = findLastUnresolved("bash");
+        if (entry) {
+            entry.toolCallId = toolCallId;
+            const text = extractResultText(result);
+            entry.outputSnippet = text.slice(0, 500);
+            const exitMatch = text.match(/Command exited with code (\d+)/);
+            entry.exitCode = exitMatch ? Number(exitMatch[1]) : (isError ? 1 : 0);
+        }
+    }
+    else if (normalizedName === "write" || normalizedName === "edit") {
+        const entry = findLastUnresolved(normalizedName);
+        if (entry) {
+            entry.toolCallId = toolCallId;
+        }
+    }
+}
+// ─── Internals ──────────────────────────────────────────────────────────────
+function findLastUnresolved(kind) {
+    for (let i = unitEvidence.length - 1; i >= 0; i--) {
+        if (unitEvidence[i].kind === kind && unitEvidence[i].toolCallId === "") {
+            return unitEvidence[i];
+        }
+    }
+    return undefined;
+}
+function extractResultText(result) {
+    if (typeof result === "string")
+        return result;
+    if (result && typeof result === "object") {
+        const r = result;
+        if (Array.isArray(r.content)) {
+            const textBlock = r.content.find((c) => typeof c === "object" && c !== null && c.type === "text");
+            if (textBlock && typeof textBlock.text === "string")
+                return textBlock.text;
+        }
+        if (typeof r.text === "string")
+            return r.text;
+    }
+    return String(result ?? "");
+}

package/dist/resources/extensions/gsd/safety/evidence-cross-ref.js

@@ -0,0 +1,83 @@
+/**
+ * Evidence cross-reference for auto-mode safety harness.
+ * Compares the LLM's claimed verification evidence (command + exitCode)
+ * against actual bash tool calls recorded by the evidence collector.
+ *
+ * Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+ */
+// ─── Public API ─────────────────────────────────────────────────────────────
+/**
+ * Cross-reference claimed verification evidence against actual bash tool calls.
+ *
+ * Returns an array of mismatches. Empty array = all claims verified.
+ * Skips entries that were coerced from strings (already flagged by db-tools.ts).
+ */
+export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
+    const bashCalls = actualEvidence.filter((e) => e.kind === "bash");
+    const mismatches = [];
+    for (const claimed of claimedEvidence) {
+        // Skip coerced entries — they're already flagged with exitCode: -1
+        // and verdict: "unknown (coerced from string)" by db-tools.ts
+        if (claimed.verdict?.includes("coerced from string"))
+            continue;
+        if (claimed.exitCode === -1)
+            continue;
+        // Skip entries with empty or generic commands
+        if (!claimed.command || claimed.command.length < 3)
+            continue;
+        // Find matching bash call by command substring match
+        const match = findBestMatch(claimed.command, bashCalls);
+        if (!match) {
+            mismatches.push({
+                severity: "warning",
+                claimed,
+                actual: null,
+                reason: `No bash tool call found matching "${claimed.command.slice(0, 80)}"`,
+            });
+            continue;
+        }
+        // Exit code mismatch: LLM claims success but actual command failed
+        if (claimed.exitCode === 0 && match.exitCode !== 0) {
+            mismatches.push({
+                severity: "error",
+                claimed,
+                actual: match,
+                reason: `Claimed exitCode=0 but actual exitCode=${match.exitCode}`,
+            });
+        }
+    }
+    return mismatches;
+}
+// ─── Internals ──────────────────────────────────────────────────────────────
+/**
+ * Find the best matching bash evidence entry for a claimed command.
+ * Uses substring matching — the claimed command may be a shortened version
+ * of the actual command, or vice versa.
+ */
+function findBestMatch(claimedCommand, bashCalls) {
+    const normalized = claimedCommand.trim();
+    // Exact match first
+    const exact = bashCalls.find(b => b.command.trim() === normalized);
+    if (exact)
+        return exact;
+    // Substring match: claimed is contained in actual or actual in claimed
+    const substring = bashCalls.find(b => b.command.includes(normalized) || normalized.includes(b.command));
+    if (substring)
+        return substring;
+    // Token match: split on whitespace and check significant overlap
+    const claimedTokens = normalized.split(/\s+/).filter(t => t.length > 2);
+    if (claimedTokens.length === 0)
+        return null;
+    let bestMatch = null;
+    let bestScore = 0;
+    for (const call of bashCalls) {
+        const callTokens = new Set(call.command.split(/\s+/));
+        const matchCount = claimedTokens.filter(t => callTokens.has(t)).length;
+        const score = matchCount / claimedTokens.length;
+        if (score > bestScore && score >= 0.5) {
+            bestScore = score;
+            bestMatch = call;
+        }
+    }
+    return bestMatch;
+}

package/dist/resources/extensions/gsd/safety/file-change-validator.js

@@ -0,0 +1,71 @@
+/**
+ * Post-unit file change validator for auto-mode safety harness.
+ * Compares actual git diff against the task plan's expected output files.
+ *
+ * Uses tasks.expected_output (DB column, populated from per-task ## Expected Output)
+ * and tasks.files (from slice PLAN.md - Files: subline) as the expected set.
+ * Compares against git diff HEAD~1 --name-only after auto-commit.
+ *
+ * Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+ */
+import { execFileSync } from "node:child_process";
+import { logWarning } from "../workflow-logger.js";
+// ─── Public API ─────────────────────────────────────────────────────────────
+/**
+ * Validate file changes after auto-commit for an execute-task unit.
+ * Returns null if task data is unavailable or DB is not loaded.
+ *
+ * @param basePath - Working directory (worktree or project root)
+ * @param expectedOutput - JSON array from tasks.expected_output DB column
+ * @param plannedFiles - JSON array from tasks.files DB column
+ */
+export function validateFileChanges(basePath, expectedOutput, plannedFiles) {
+    const allExpected = new Set([...expectedOutput, ...plannedFiles]);
+    // If no expected files were planned, skip validation
+    if (allExpected.size === 0)
+        return null;
+    // Get actual changed files from last commit
+    const actualFiles = getChangedFilesFromLastCommit(basePath);
+    if (!actualFiles)
+        return null;
+    // Filter out .gsd/ internal files — only validate project source files
+    const projectFiles = actualFiles.filter(f => !f.startsWith(".gsd/") && !f.startsWith(".gsd\\"));
+    // Normalize expected paths (strip leading ./ or /)
+    const normalizedExpected = new Set([...allExpected].map(f => f.replace(/^\.\//, "").replace(/^\//, "")));
+    // Compute symmetric difference
+    const unexpectedFiles = projectFiles.filter(f => !normalizedExpected.has(f));
+    const missingFiles = [...normalizedExpected].filter(f => !projectFiles.includes(f));
+    const violations = [];
+    for (const f of unexpectedFiles) {
+        violations.push({
+            severity: "warning",
+            file: f,
+            reason: "Modified but not in task plan's expected output",
+        });
+    }
+    for (const f of missingFiles) {
+        violations.push({
+            severity: "info",
+            file: f,
+            reason: "Listed in task plan but not modified",
+        });
+    }
+    return {
+        expectedFiles: [...normalizedExpected],
+        actualFiles: projectFiles,
+        unexpectedFiles,
+        missingFiles,
+        violations,
+    };
+}
+// ─── Internals ──────────────────────────────────────────────────────────────
+function getChangedFilesFromLastCommit(basePath) {
+    try {
+        const result = execFileSync("git", ["diff", "--name-only", "HEAD~1", "HEAD"], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
+        return result ? result.split("\n").filter(Boolean) : [];
+    }
+    catch (e) {
+        logWarning("safety", `git diff failed in file-change-validator: ${e.message}`);
+        return null;
+    }
+}

package/dist/resources/extensions/gsd/safety/git-checkpoint.js

@@ -0,0 +1,91 @@
+/**
+ * Pre-unit git checkpoint and rollback for auto-mode safety harness.
+ * Uses the existing refs/gsd/ namespace (already pruned by doctor).
+ *
+ * Creates a lightweight ref at HEAD before unit execution. On failure,
+ * the ref can be used to rollback the branch to the pre-unit state.
+ *
+ * Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+ */
+import { execFileSync } from "node:child_process";
+import { logWarning } from "../workflow-logger.js";
+// ─── Constants ──────────────────────────────────────────────────────────────
+const CHECKPOINT_PREFIX = "refs/gsd/checkpoints/";
+// ─── Public API ─────────────────────────────────────────────────────────────
+/**
+ * Create a checkpoint ref at the current HEAD for the given unit.
+ * Returns the SHA of HEAD, or null if the operation fails.
+ */
+export function createCheckpoint(basePath, unitId) {
+    try {
+        const sha = execFileSync("git", ["rev-parse", "HEAD"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        }).trim();
+        if (!sha || sha.length < 7)
+            return null;
+        // Sanitize unitId for use in ref path (replace / with -)
+        const safeUnitId = unitId.replace(/\//g, "-");
+        execFileSync("git", ["update-ref", `${CHECKPOINT_PREFIX}${safeUnitId}`, sha], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return sha;
+    }
+    catch (e) {
+        logWarning("safety", `checkpoint creation failed: ${e.message}`);
+        return null;
+    }
+}
+/**
+ * Rollback the current branch to a checkpoint SHA.
+ * Returns true on success, false on failure.
+ *
+ * WARNING: This is a destructive operation — it discards all changes
+ * since the checkpoint. Only call when the user has opted in via
+ * safety_harness.auto_rollback or an explicit manual trigger.
+ */
+export function rollbackToCheckpoint(basePath, unitId, sha) {
+    try {
+        // Get current branch name
+        const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        }).trim();
+        if (!branch || branch === "HEAD") {
+            logWarning("safety", "rollback: detached HEAD state, cannot rollback");
+            return false;
+        }
+        // Reset branch pointer and working tree to checkpoint SHA in one step.
+        // Using `git reset --hard <sha>` works on the currently checked-out branch
+        // (unlike `git branch -f` which is rejected for checked-out branches).
+        execFileSync("git", ["reset", "--hard", sha], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        // Cleanup checkpoint ref
+        cleanupCheckpoint(basePath, unitId);
+        return true;
+    }
+    catch (e) {
+        logWarning("safety", `rollback failed: ${e.message}`);
+        return false;
+    }
+}
+/**
+ * Remove a checkpoint ref after successful unit completion.
+ */
+export function cleanupCheckpoint(basePath, unitId) {
+    try {
+        const safeUnitId = unitId.replace(/\//g, "-");
+        execFileSync("git", ["update-ref", "-d", `${CHECKPOINT_PREFIX}${safeUnitId}`], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+    }
+    catch {
+        // Non-fatal — ref may already have been cleaned up
+    }
+}

package/dist/resources/extensions/gsd/safety/safety-harness.js

@@ -0,0 +1,64 @@
+/**
+ * Safety Harness — central module for LLM damage control during auto-mode.
+ * Provides types, preference resolution, and orchestration for all safety components.
+ *
+ * Components:
+ * - evidence-collector.ts: Real-time tool call tracking
+ * - destructive-guard.ts: Bash command classification
+ * - file-change-validator.ts: Post-unit git diff vs plan
+ * - evidence-cross-ref.ts: Claimed vs actual verification evidence
+ * - git-checkpoint.ts: Pre-unit checkpoints + rollback
+ * - content-validator.ts: Output quality validation
+ *
+ * Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+ */
+// ─── Defaults ───────────────────────────────────────────────────────────────
+const DEFAULTS = {
+    enabled: true,
+    evidence_collection: true,
+    file_change_validation: true,
+    evidence_cross_reference: true,
+    destructive_command_warnings: true,
+    content_validation: true,
+    checkpoints: true,
+    auto_rollback: false,
+    timeout_scale_cap: 6,
+};
+// ─── Public API ─────────────────────────────────────────────────────────────
+/**
+ * Resolve safety harness configuration from raw preferences.
+ * Missing fields fall back to defaults.
+ */
+export function resolveSafetyHarnessConfig(raw) {
+    if (!raw)
+        return { ...DEFAULTS };
+    return {
+        enabled: typeof raw.enabled === "boolean" ? raw.enabled : DEFAULTS.enabled,
+        evidence_collection: typeof raw.evidence_collection === "boolean" ? raw.evidence_collection : DEFAULTS.evidence_collection,
+        file_change_validation: typeof raw.file_change_validation === "boolean" ? raw.file_change_validation : DEFAULTS.file_change_validation,
+        evidence_cross_reference: typeof raw.evidence_cross_reference === "boolean" ? raw.evidence_cross_reference : DEFAULTS.evidence_cross_reference,
+        destructive_command_warnings: typeof raw.destructive_command_warnings === "boolean" ? raw.destructive_command_warnings : DEFAULTS.destructive_command_warnings,
+        content_validation: typeof raw.content_validation === "boolean" ? raw.content_validation : DEFAULTS.content_validation,
+        checkpoints: typeof raw.checkpoints === "boolean" ? raw.checkpoints : DEFAULTS.checkpoints,
+        auto_rollback: typeof raw.auto_rollback === "boolean" ? raw.auto_rollback : DEFAULTS.auto_rollback,
+        timeout_scale_cap: typeof raw.timeout_scale_cap === "number" ? raw.timeout_scale_cap : DEFAULTS.timeout_scale_cap,
+    };
+}
+/**
+ * Check if the safety harness is enabled.
+ * Used as a fast gate at hook registration and phase integration points.
+ */
+export function isHarnessEnabled(raw) {
+    if (!raw)
+        return DEFAULTS.enabled;
+    if (typeof raw.enabled === "boolean")
+        return raw.enabled;
+    return DEFAULTS.enabled;
+}
+// ─── Re-exports ─────────────────────────────────────────────────────────────
+export { resetEvidence, getEvidence, getBashEvidence, getFilePaths, recordToolCall, recordToolResult, } from "./evidence-collector.js";
+export { classifyCommand } from "./destructive-guard.js";
+export { validateFileChanges } from "./file-change-validator.js";
+export { crossReferenceEvidence } from "./evidence-cross-ref.js";
+export { createCheckpoint, rollbackToCheckpoint, cleanupCheckpoint } from "./git-checkpoint.js";
+export { validateContent } from "./content-validator.js";

package/dist/resources/extensions/gsd/slice-parallel-conflict.js

@@ -0,0 +1,67 @@
+/**
+ * GSD Slice Parallel Conflict Detection — File overlap analysis between slices.
+ *
+ * Reads PLAN.md for each slice and extracts file paths mentioned in task
+ * descriptions. If two slices share more than 5 file paths, they are considered
+ * conflicting and should not run in parallel.
+ *
+ * Conservative by default: missing PLAN = block parallel execution.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+// ─── File Path Extraction ─────────────────────────────────────────────────────
+/**
+ * Extract file paths from a PLAN.md content string.
+ * Matches common patterns like `src/...`, `lib/...`, paths with extensions.
+ */
+function extractFilePaths(content) {
+    const paths = new Set();
+    // Match file-like patterns: word/word paths with extensions, or src/lib/etc prefixed paths
+    const patterns = [
+        // Paths like src/foo/bar.ts, lib/utils.js, etc.
+        /(?:src|lib|test|tests|app|pkg|cmd|internal|components|pages|api|utils|config|scripts|dist|build)\/[\w./-]+\.\w+/g,
+        // Generic path with at least one slash and extension
+        /(?<!\w)[\w-]+\/[\w./-]+\.\w{1,5}(?!\w)/g,
+    ];
+    for (const pattern of patterns) {
+        const matches = content.matchAll(pattern);
+        for (const match of matches) {
+            paths.add(match[0]);
+        }
+    }
+    return paths;
+}
+// ─── Conflict Detection ──────────────────────────────────────────────────────
+/**
+ * Check if two slices have file conflicts that would block parallel execution.
+ *
+ * @param basePath  Project root path.
+ * @param mid       Milestone ID.
+ * @param sliceA    First slice ID.
+ * @param sliceB    Second slice ID.
+ * @returns         true if parallel is unsafe (>5 shared files or missing plan).
+ */
+export function hasFileConflict(basePath, mid, sliceA, sliceB) {
+    const planPathA = join(basePath, ".gsd", "milestones", mid, sliceA, "PLAN.md");
+    const planPathB = join(basePath, ".gsd", "milestones", mid, sliceB, "PLAN.md");
+    // Conservative: missing PLAN = block
+    if (!existsSync(planPathA) || !existsSync(planPathB)) {
+        return true;
+    }
+    const contentA = readFileSync(planPathA, "utf-8");
+    const contentB = readFileSync(planPathB, "utf-8");
+    const filesA = extractFilePaths(contentA);
+    const filesB = extractFilePaths(contentB);
+    // If either has no files extracted, no conflict detectable → allow
+    if (filesA.size === 0 || filesB.size === 0) {
+        return false;
+    }
+    // Count shared files
+    let sharedCount = 0;
+    for (const file of filesA) {
+        if (filesB.has(file)) {
+            sharedCount++;
+        }
+    }
+    return sharedCount > 5;
+}