gsd-pi 2.63.0 → 2.64.0

package/src/resources/extensions/gsd/tests/complete-slice-string-coercion.test.ts

@@ -0,0 +1,211 @@
+// GSD Extension — String coercion regression tests for complete-slice/task tools
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import {
+  openDatabase,
+  closeDatabase,
+  insertMilestone,
+  insertSlice,
+  insertTask,
+} from "../gsd-db.ts";
+import { handleCompleteSlice } from "../tools/complete-slice.ts";
+import type { CompleteSliceParams } from "../types.ts";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────
+
+/**
+ * The splitPair coercion logic extracted from db-tools.ts sliceCompleteExecute.
+ * Duplicated here so we can unit-test it directly.
+ */
+function splitPair(s: string): [string, string] {
+  const m = s.match(/^(.+?)\s*(?:—|-)\s+(.+)$/);
+  return m ? [m[1].trim(), m[2].trim()] : [s.trim(), ""];
+}
+
+function makeValidSliceParams(): CompleteSliceParams {
+  return {
+    sliceId: "S01",
+    milestoneId: "M001",
+    sliceTitle: "Test Slice",
+    oneLiner: "Implemented test slice",
+    narrative: "Built and tested.",
+    verification: "All tests pass.",
+    deviations: "None.",
+    knownLimitations: "None.",
+    followUps: "None.",
+    keyFiles: ["src/foo.ts"],
+    keyDecisions: ["D001"],
+    patternsEstablished: [],
+    observabilitySurfaces: [],
+    provides: ["test handler"],
+    requirementsSurfaced: [],
+    drillDownPaths: [],
+    affects: [],
+    requirementsAdvanced: [{ id: "R001", how: "Handler validates" }],
+    requirementsValidated: [],
+    requirementsInvalidated: [],
+    filesModified: [{ path: "src/foo.ts", description: "Handler" }],
+    requires: [],
+    uatContent: "## Smoke Test\n\nVerify all assertions pass.",
+  };
+}
+
+// ─── splitPair unit tests ────────────────────────────────────────────────
+
+describe("splitPair coercion helper (#3565)", () => {
+  test("plain string without delimiter returns string + empty", () => {
+    const [a, b] = splitPair("src/foo.ts");
+    assert.equal(a, "src/foo.ts");
+    assert.equal(b, "");
+  });
+
+  test("em-dash delimiter parses both parts", () => {
+    const [id, how] = splitPair("R001 — Handler validates task completion");
+    assert.equal(id, "R001");
+    assert.equal(how, "Handler validates task completion");
+  });
+
+  test("hyphen delimiter parses both parts", () => {
+    const [id, proof] = splitPair("R002 - Tests pass");
+    assert.equal(id, "R002");
+    assert.equal(proof, "Tests pass");
+  });
+
+  test("string with no space around hyphen is treated as plain", () => {
+    // e.g. a file path like "src/foo-bar.ts" should not split
+    const [a, b] = splitPair("src/foo-bar.ts");
+    assert.equal(a, "src/foo-bar.ts");
+    assert.equal(b, "");
+  });
+
+  test("whitespace is trimmed from both parts", () => {
+    const [id, how] = splitPair("  R003  —  Trimmed value  ");
+    assert.equal(id, "R003");
+    assert.equal(how, "Trimmed value");
+  });
+});
+
+// ─── verificationEvidence sentinel tests ─────────────────────────────────
+
+describe("verificationEvidence sentinel coercion (#3565)", () => {
+  function coerceEvidence(v: any) {
+    return typeof v === "string"
+      ? { command: v, exitCode: -1, verdict: "unknown (coerced from string)", durationMs: 0 }
+      : v;
+  }
+
+  test("string input produces non-passing sentinel", () => {
+    const result = coerceEvidence("npm test");
+    assert.equal(result.command, "npm test");
+    assert.equal(result.exitCode, -1);
+    assert.equal(result.verdict, "unknown (coerced from string)");
+    assert.equal(result.durationMs, 0);
+  });
+
+  test("object input passes through unchanged", () => {
+    const obj = { command: "npm test", exitCode: 0, verdict: "pass", durationMs: 1234 };
+    const result = coerceEvidence(obj);
+    assert.equal(result.exitCode, 0);
+    assert.equal(result.verdict, "pass");
+    assert.equal(result.durationMs, 1234);
+  });
+
+  test("sentinel exitCode is not 0 (must not fabricate success)", () => {
+    const result = coerceEvidence("anything");
+    assert.notEqual(result.exitCode, 0, "exitCode must not be 0 for coerced strings");
+    assert.ok(
+      !result.verdict.includes("pass"),
+      "verdict must not contain 'pass' for coerced strings",
+    );
+  });
+});
+
+// ─── Handler integration with coerced params ─────────────────────────────
+
+describe("handleCompleteSlice with coerced string arrays (#3565)", () => {
+  let dbPath: string;
+  let basePath: string;
+
+  beforeEach(() => {
+    dbPath = path.join(
+      fs.mkdtempSync(path.join(os.tmpdir(), "gsd-coerce-")),
+      "test.db",
+    );
+    openDatabase(dbPath);
+
+    basePath = fs.mkdtempSync(path.join(os.tmpdir(), "gsd-coerce-handler-"));
+    const sliceDir = path.join(basePath, ".gsd", "milestones", "M001", "slices", "S01", "tasks");
+    fs.mkdirSync(sliceDir, { recursive: true });
+
+    const roadmapPath = path.join(basePath, ".gsd", "milestones", "M001", "M001-ROADMAP.md");
+    fs.writeFileSync(
+      roadmapPath,
+      [
+        "# M001: Test Milestone",
+        "",
+        "## Slices",
+        "",
+        '- [ ] **S01: Test Slice** `risk:medium` `depends:[]`',
+        "  - After this: basic functionality works",
+      ].join("\n"),
+    );
+
+    insertMilestone({ id: "M001" });
+    insertSlice({ id: "S01", milestoneId: "M001" });
+    insertTask({ id: "T01", sliceId: "S01", milestoneId: "M001", status: "complete", title: "Task 1" });
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    fs.rmSync(path.dirname(dbPath), { recursive: true, force: true });
+    fs.rmSync(basePath, { recursive: true, force: true });
+  });
+
+  test("handler succeeds with coerced filesModified and requirementsAdvanced", async () => {
+    const params = makeValidSliceParams();
+    // Simulate coercion from plain strings
+    params.filesModified = ["src/foo.ts", "src/bar.ts"].map((f) => {
+      const [p, d] = splitPair(f);
+      return { path: p, description: d };
+    });
+    params.requirementsAdvanced = ["R001 — Handler validates task completion"].map((r) => {
+      const [id, how] = splitPair(r);
+      return { id, how };
+    });
+
+    const result = await handleCompleteSlice(params, basePath);
+    assert.ok(!("error" in result), "handler should succeed");
+    if (!("error" in result)) {
+      const summary = fs.readFileSync(result.summaryPath, "utf-8");
+      assert.match(summary, /src\/foo\.ts/);
+      assert.match(summary, /R001/);
+      assert.match(summary, /Handler validates task completion/);
+    }
+  });
+
+  test("handler succeeds with coerced requires and requirementsValidated", async () => {
+    const params = makeValidSliceParams();
+    params.requires = ["S00 — Provided base infrastructure"].map((r) => {
+      const [slice, provides] = splitPair(r);
+      return { slice, provides };
+    });
+    params.requirementsValidated = ["R002 - Tests pass"].map((r) => {
+      const [id, proof] = splitPair(r);
+      return { id, proof };
+    });
+
+    const result = await handleCompleteSlice(params, basePath);
+    assert.ok(!("error" in result), "handler should succeed");
+    if (!("error" in result)) {
+      const summary = fs.readFileSync(result.summaryPath, "utf-8");
+      assert.match(summary, /S00/);
+      assert.match(summary, /Provided base infrastructure/);
+      assert.match(summary, /R002/);
+      assert.match(summary, /Tests pass/);
+    }
+  });
+});

package/src/resources/extensions/gsd/tests/complete-task.test.ts

@@ -449,6 +449,45 @@ console.log('\n=== complete-task: handler with missing plan file ===');
   cleanup(dbPath);
 }
 
+// ═══════════════════════════════════════════════════════════════════════════
+// complete-task: minimal params — no optional fields (#2771 regression)
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('\n=== complete-task: minimal params (no keyFiles, keyDecisions, verificationEvidence, blockerDiscovered) ===');
+{
+  const dbPath = tempDbPath();
+  openDatabase(dbPath);
+
+  const { basePath, planPath } = createTempProject();
+
+  insertMilestone({ id: 'M001', title: 'Test Milestone' });
+  insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Test Slice' });
+
+  // Minimal params — only required fields, all optional enrichment fields omitted
+  const minimalParams = {
+    taskId: 'T01',
+    sliceId: 'S01',
+    milestoneId: 'M001',
+    oneLiner: 'Basic task',
+    narrative: 'Did the work.',
+    verification: 'Looks good.',
+    // keyFiles, keyDecisions, verificationEvidence, blockerDiscovered intentionally omitted
+  };
+
+  const result = await handleCompleteTask(minimalParams as any, basePath);
+
+  assertTrue(!('error' in result), 'handler should not crash with minimal params (no optional fields)');
+  if (!('error' in result)) {
+    assertTrue(fs.existsSync(result.summaryPath), 'summary file should be written with minimal params');
+    const summaryContent = fs.readFileSync(result.summaryPath, 'utf-8');
+    assertMatch(summaryContent, /blocker_discovered:\s*false/, 'blocker_discovered should default to false');
+    assertMatch(summaryContent, /\(none\)/, 'key_files/key_decisions should show (none) placeholder');
+  }
+
+  cleanupDir(basePath);
+  cleanup(dbPath);
+}
+
 // ═══════════════════════════════════════════════════════════════════════════
 
 report();

package/src/resources/extensions/gsd/tests/dashboard-model-label-ordering.test.ts

@@ -0,0 +1,107 @@
+/**
+ * dashboard-model-label-ordering.test.ts — Regression test for #2899.
+ *
+ * The dashboard model label was showing the previous unit's model because
+ * updateProgressWidget was called before selectAndApplyModel in phases.ts.
+ * This test verifies:
+ *   1. updateProgressWidget is called AFTER selectAndApplyModel in phases.ts
+ *   2. session.ts has a currentDispatchedModelId field
+ *   3. auto.ts exposes getCurrentDispatchedModelId in widgetStateAccessors
+ *   4. auto-dashboard.ts reads from a dispatched model accessor, not cmdCtx?.model
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { createTestContext } from "./test-helpers.ts";
+
+const { assertTrue, assertMatch, report } = createTestContext();
+
+const phasesPath = join(import.meta.dirname, "..", "auto", "phases.ts");
+const sessionPath = join(import.meta.dirname, "..", "auto", "session.ts");
+const autoPath = join(import.meta.dirname, "..", "auto.ts");
+const dashboardPath = join(import.meta.dirname, "..", "auto-dashboard.ts");
+
+const phasesSrc = readFileSync(phasesPath, "utf-8");
+const sessionSrc = readFileSync(sessionPath, "utf-8");
+const autoSrc = readFileSync(autoPath, "utf-8");
+const dashboardSrc = readFileSync(dashboardPath, "utf-8");
+
+console.log("\n=== #2899: Dashboard model label shows correct (dispatched) model ===");
+
+// ── Test 1: updateProgressWidget is called AFTER selectAndApplyModel ──────
+
+// Find the positions of the calls in the dispatch function body.
+// selectAndApplyModel must appear BEFORE updateProgressWidget.
+const selectModelPos = phasesSrc.indexOf("deps.selectAndApplyModel(");
+const updateWidgetPos = phasesSrc.indexOf("deps.updateProgressWidget(");
+
+assertTrue(
+  selectModelPos > 0,
+  "phases.ts contains deps.selectAndApplyModel call",
+);
+
+assertTrue(
+  updateWidgetPos > 0,
+  "phases.ts contains deps.updateProgressWidget call",
+);
+
+assertTrue(
+  selectModelPos < updateWidgetPos,
+  `selectAndApplyModel (pos ${selectModelPos}) must be called BEFORE updateProgressWidget (pos ${updateWidgetPos}) — widget needs fresh model`,
+);
+
+// ── Test 2: session.ts declares currentDispatchedModelId ──────────────────
+
+assertTrue(
+  sessionSrc.includes("currentDispatchedModelId"),
+  "session.ts has currentDispatchedModelId field",
+);
+
+// ── Test 3: auto.ts exposes getCurrentDispatchedModelId in widgetStateAccessors ──
+
+assertTrue(
+  autoSrc.includes("getCurrentDispatchedModelId"),
+  "auto.ts exposes getCurrentDispatchedModelId accessor",
+);
+
+// Verify it's in the widgetStateAccessors object
+const accessorsBlock = autoSrc.slice(
+  autoSrc.indexOf("const widgetStateAccessors"),
+  autoSrc.indexOf("};", autoSrc.indexOf("const widgetStateAccessors")) + 2,
+);
+
+assertTrue(
+  accessorsBlock.includes("getCurrentDispatchedModelId"),
+  "getCurrentDispatchedModelId is in the widgetStateAccessors object",
+);
+
+// ── Test 4: WidgetStateAccessors interface has getCurrentDispatchedModelId ──
+
+assertTrue(
+  dashboardSrc.includes("getCurrentDispatchedModelId"),
+  "auto-dashboard.ts references getCurrentDispatchedModelId",
+);
+
+// The dashboard render closure should NOT read model from cmdCtx?.model for display.
+// It should use the accessor for the dispatched model ID.
+// Check that the "Model display" section uses the accessor, not cmdCtx?.model directly.
+const modelDisplaySection = dashboardSrc.slice(
+  dashboardSrc.indexOf("// Model display"),
+  dashboardSrc.indexOf("// Model display") + 500,
+);
+
+assertTrue(
+  modelDisplaySection.includes("getCurrentDispatchedModelId") ||
+  modelDisplaySection.includes("getDispatchedModelId"),
+  "Model display section reads from dispatched model accessor, not cmdCtx?.model alone",
+);
+
+// ── Test 5: currentDispatchedModelId is set after selectAndApplyModel in phases.ts ──
+
+// After selectAndApplyModel returns, phases.ts should store the dispatched model ID
+assertTrue(
+  phasesSrc.includes("currentDispatchedModelId"),
+  "phases.ts stores currentDispatchedModelId after model selection",
+);
+
+report();

package/src/resources/extensions/gsd/tests/db-access-guardrails.test.ts

@@ -0,0 +1,109 @@
+// GSD2 — Regression tests: DB anti-pattern guardrails in prompt templates
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+
+const promptsDir = join(process.cwd(), "src/resources/extensions/gsd/prompts");
+
+function readPrompt(name: string): string {
+  return readFileSync(join(promptsDir, `${name}.md`), "utf-8");
+}
+
+// ─── Layer 1: system.md global guardrail ──────────────────────────────────────
+
+test("system.md anti-patterns section prohibits direct .gsd/gsd.db access", () => {
+  const prompt = readPrompt("system");
+  assert.match(
+    prompt,
+    /Never query.*\.gsd\/gsd\.db.*directly/i,
+    "system.md must prohibit direct .gsd/gsd.db access in the anti-patterns section",
+  );
+  assert.match(prompt, /sqlite3/, "system.md DB guardrail must name the sqlite3 CLI");
+  assert.match(prompt, /better-sqlite3/, "system.md DB guardrail must name better-sqlite3");
+  assert.match(prompt, /gsd_\*/, "system.md DB guardrail must redirect to gsd_* tools");
+});
+
+test("system.md DB guardrail explains single-writer WAL risk", () => {
+  const prompt = readPrompt("system");
+  assert.match(prompt, /single-writer WAL/i, "system.md must explain the WAL architecture risk");
+});
+
+// ─── Layer 2: high-risk prompt guardrails ─────────────────────────────────────
+
+test("validate-milestone.md contains DB access safety guardrail with tool redirect", () => {
+  const prompt = readPrompt("validate-milestone");
+  assert.match(prompt, /DB access safety/i, "validate-milestone.md must have DB access safety section");
+  assert.match(prompt, /gsd_milestone_status/, "validate-milestone.md must name gsd_milestone_status as alternative");
+  assert.match(prompt, /Do NOT query.*\.gsd\/gsd\.db/i, "validate-milestone.md must prohibit direct DB queries");
+});
+
+test("complete-milestone.md contains DB access safety guardrail with tool redirect", () => {
+  const prompt = readPrompt("complete-milestone");
+  assert.match(prompt, /DB access safety/i, "complete-milestone.md must have DB access safety section");
+  assert.match(prompt, /gsd_milestone_status/, "complete-milestone.md must name gsd_milestone_status as alternative");
+  assert.match(prompt, /Do NOT query.*\.gsd\/gsd\.db/i, "complete-milestone.md must prohibit direct DB queries");
+});
+
+test("doctor-heal.md contains DB access guardrail naming gsd_milestone_status", () => {
+  const prompt = readPrompt("doctor-heal");
+  assert.match(prompt, /gsd_milestone_status/, "doctor-heal.md must name gsd_milestone_status as the DB inspection tool");
+  assert.match(prompt, /Do NOT query.*\.gsd\/gsd\.db/i, "doctor-heal.md must prohibit direct DB queries");
+});
+
+test("forensics.md contains DB inspection guardrail", () => {
+  const prompt = readPrompt("forensics");
+  assert.match(prompt, /gsd_milestone_status/, "forensics.md must name gsd_milestone_status as the DB inspection tool");
+  assert.match(prompt, /sqlite3.*\.gsd\/gsd\.db/i, "forensics.md must prohibit sqlite3 against .gsd/gsd.db");
+});
+
+test("reassess-roadmap.md contains DB access safety guardrail", () => {
+  const prompt = readPrompt("reassess-roadmap");
+  assert.match(prompt, /DB access safety/i, "reassess-roadmap.md must have DB access safety section");
+  assert.match(prompt, /gsd_milestone_status/, "reassess-roadmap.md must name gsd_milestone_status as alternative");
+});
+
+// ─── Negative assertion: no prompt instructs running sqlite3 as a command ─────
+
+test("no prompt file contains an unguarded sqlite3 command invocation", () => {
+  const files = readdirSync(promptsDir).filter((f) => f.endsWith(".md"));
+  assert.ok(files.length >= 35, `Expected at least 35 prompt files, found ${files.length}`);
+
+  const violations: string[] = [];
+
+  for (const file of files) {
+    const content = readFileSync(join(promptsDir, file), "utf-8");
+    const lines = content.split("\n");
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const trimmed = line.trim();
+
+      // Match lines containing sqlite3 targeting gsd.db in any common form:
+      //   sqlite3 .gsd/gsd.db, sqlite3 ./.gsd/gsd.db, sqlite3 "/path/.gsd/gsd.db",
+      //   sqlite3 -header .gsd/gsd.db, etc.
+      // Guardrail text that says "Never run" or "Do NOT query" is fine — only flag
+      // lines where these appear without a surrounding prohibition keyword.
+      if (/sqlite3\b.*gsd\.db/.test(trimmed)) {
+        const context = lines.slice(Math.max(0, i - 3), i + 1).join(" ");
+        if (!/Never|Do NOT|do not|don't|prohibited|forbidden|never run/i.test(context)) {
+          violations.push(`${file}:${i + 1} — unguarded sqlite3 command: ${trimmed}`);
+        }
+      }
+      // Match node -e with better-sqlite3 require in any quoting style
+      if (/node\s+-e\s+.*(?:require|import).*better-sqlite3/.test(trimmed)) {
+        const context = lines.slice(Math.max(0, i - 3), i + 1).join(" ");
+        if (!/Never|Do NOT|do not|don't|prohibited|forbidden|never run/i.test(context)) {
+          violations.push(`${file}:${i + 1} — unguarded node -e require command: ${trimmed}`);
+        }
+      }
+    }
+  }
+
+  assert.deepEqual(
+    violations,
+    [],
+    `Found prompts with unguarded sqlite3/better-sqlite3 invocations:\n${violations.join("\n")}`,
+  );
+});

package/src/resources/extensions/gsd/tests/db-path-worktree-symlink.test.ts

@@ -38,13 +38,17 @@ assertEq(
   "Standard worktree layout resolves to project root DB path",
 );
 
-// Symlink-resolved layout (the regression — /.gsd/projects/<hash>/worktrees/...)
+// Symlink-resolved layout: /.gsd/projects/<hash>/worktrees/...
+// After PR #2952, these paths resolve to the hash-level DB (same as external-state),
+// because on POSIX getcwd() returns the canonical (symlink-resolved) path anyway, so
+// a path like <proj>/.gsd/projects/<hash>/worktrees/ in practice is always
+// ~/.gsd/projects/<hash>/worktrees/ after the OS resolves the .gsd symlink.
 const symlinkPath = `/home/user/myproject/.gsd/projects/abc123def/worktrees/M001/work`;
 const symlinkResult = resolveProjectRootDbPath(symlinkPath);
 assertEq(
   symlinkResult,
-  join("/home/user/myproject", ".gsd", "gsd.db"),
-  "Symlink-resolved layout (/.gsd/projects/<hash>/worktrees/) resolves to project root DB path (#2517)",
+  join("/home/user/myproject/.gsd/projects/abc123def", "gsd.db"),
+  "/.gsd/projects/<hash>/worktrees/ resolves to hash-level DB (#2517, updated for #2952)",
 );
 
 // Windows-style separators for symlink layout
@@ -53,8 +57,8 @@ if (sep === "\\") {
   const winResult = resolveProjectRootDbPath(winSymlinkPath);
   assertEq(
     winResult,
-    join("C:\\Users\\dev\\project", ".gsd", "gsd.db"),
-    "Windows symlink layout resolves correctly",
+    join("C:\\Users\\dev\\project\\.gsd\\projects\\abc123def", "gsd.db"),
+    "Windows /.gsd/projects/<hash>/worktrees/ resolves to hash-level DB",
   );
 } else {
   // On non-Windows, test forward-slash variant explicitly
@@ -62,8 +66,8 @@ if (sep === "\\") {
   const fwdResult = resolveProjectRootDbPath(fwdSymlinkPath);
   assertEq(
     fwdResult,
-    join("/home/user/myproject", ".gsd", "gsd.db"),
-    "Forward-slash symlink layout resolves correctly on POSIX",
+    join("/home/user/myproject/.gsd/projects/abc123def", "gsd.db"),
+    "Forward-slash /.gsd/projects/<hash>/worktrees/ resolves to hash-level DB on POSIX",
   );
 }
 
@@ -72,8 +76,8 @@ const deepSymlinkPath = `/home/user/myproject/.gsd/projects/deadbeef42/worktrees
 const deepResult = resolveProjectRootDbPath(deepSymlinkPath);
 assertEq(
   deepResult,
-  join("/home/user/myproject", ".gsd", "gsd.db"),
-  "Deep symlink worktree path still resolves to project root DB",
+  join("/home/user/myproject/.gsd/projects/deadbeef42", "gsd.db"),
+  "Deep /.gsd/projects/<hash>/worktrees/ path resolves to hash-level DB (#2952)",
 );
 
 // Non-worktree path should be unchanged