gsd-pi 2.65.0-dev.6cc5110 → 2.65.0-dev.d0517ff

package/src/resources/extensions/gsd/gsd-db.ts

@@ -451,6 +451,25 @@ function migrateSchema(db: DbAdapter): void {
   const currentVersion = row ? (row["v"] as number) : 0;
   if (currentVersion >= SCHEMA_VERSION) return;
 
+  // Backup database before migration so a mid-migration crash doesn't
+  // leave a partially-migrated DB with no recovery path.
+  // WAL-safe: checkpoint first to flush WAL into the main DB file, then copy.
+  if (currentPath && currentPath !== ":memory:" && existsSync(currentPath)) {
+    try {
+      const backupPath = `${currentPath}.backup-v${currentVersion}`;
+      if (!existsSync(backupPath)) {
+        // Flush WAL to main DB file before copying — without this, the backup
+        // may be missing committed data that only exists in the -wal file.
+        try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch { /* checkpoint is best-effort */ }
+        copyFileSync(currentPath, backupPath);
+      }
+    } catch (backupErr) {
+      // Log but proceed — blocking migration leaves the DB stuck at an old
+      // schema version permanently on read-only or full filesystems.
+      logWarning("db", `Pre-migration backup failed: ${backupErr instanceof Error ? backupErr.message : String(backupErr)}`);
+    }
+  }
+
   db.exec("BEGIN");
   try {
     if (currentVersion < 2) {
@@ -999,9 +1018,21 @@ export function _resetProvider(): void {
 
 export function upsertDecision(d: Omit<Decision, "seq">): void {
   if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+  // Use ON CONFLICT DO UPDATE instead of INSERT OR REPLACE to preserve the
+  // seq column. INSERT OR REPLACE deletes then reinserts, resetting seq and
+  // corrupting decision ordering in DECISIONS.md after reconcile replay.
   currentDb.prepare(
-    `INSERT OR REPLACE INTO decisions (id, when_context, scope, decision, choice, rationale, revisable, made_by, superseded_by)
-     VALUES (:id, :when_context, :scope, :decision, :choice, :rationale, :revisable, :made_by, :superseded_by)`,
+    `INSERT INTO decisions (id, when_context, scope, decision, choice, rationale, revisable, made_by, superseded_by)
+     VALUES (:id, :when_context, :scope, :decision, :choice, :rationale, :revisable, :made_by, :superseded_by)
+     ON CONFLICT(id) DO UPDATE SET
+       when_context = excluded.when_context,
+       scope = excluded.scope,
+       decision = excluded.decision,
+       choice = excluded.choice,
+       rationale = excluded.rationale,
+       revisable = excluded.revisable,
+       made_by = excluded.made_by,
+       superseded_by = excluded.superseded_by`,
   ).run({
     ":id": d.id,
     ":when_context": d.when_context,

package/src/resources/extensions/gsd/index.ts

@@ -1,6 +1,7 @@
 import type { ExtensionAPI } from "@gsd/pi-coding-agent";
 
 export {
+  isDepthConfirmationAnswer,
   isDepthVerified,
   isQueuePhaseActive,
   setQueuePhaseActive,

package/src/resources/extensions/gsd/prompts/discuss.md

@@ -114,6 +114,8 @@ If they clarify, absorb the correction and re-verify.
 
 The depth verification is the required write-gate. Do **not** add another meta "ready to proceed?" checkpoint immediately after it unless there is still material ambiguity.
 
+**CRITICAL — Non-bypassable gate:** The system mechanically blocks CONTEXT.md writes until the user selects the "(Recommended)" option. If the user declines, cancels, or the tool fails, you MUST re-ask — never rationalize past the block ("tool not responding, I'll proceed" is forbidden). The gate exists to protect the user's work; treat a block as an instruction, not an obstacle to work around.
+
 ## Wrap-up Gate
 
 Once the depth checklist is fully satisfied, move directly into requirements and roadmap preview. Do not insert a separate "are you ready to continue?" gate unless the user explicitly wants to keep brainstorming or you still see material ambiguity.

package/src/resources/extensions/gsd/prompts/guided-discuss-milestone.md

@@ -100,6 +100,8 @@ If they clarify, absorb the correction and re-verify.
 
 The depth verification is the only required confirmation gate. Do not add a second "ready to proceed?" gate after it.
 
+**CRITICAL — Non-bypassable gate:** The system mechanically blocks CONTEXT.md writes until the user selects the "(Recommended)" option. If the user declines, cancels, or the tool fails, you MUST re-ask — never rationalize past the block ("tool not responding, I'll proceed" is forbidden). The gate exists to protect the user's work; treat a block as an instruction, not an obstacle to work around.
+
 ---
 
 ## Output

package/src/resources/extensions/gsd/prompts/queue.md

@@ -103,6 +103,8 @@ The user confirms or corrects before you write. One depth verification per miles
 
 **If you skip this step, the system will block the CONTEXT.md write and return an error telling you to complete verification first.**
 
+**CRITICAL — Non-bypassable gate:** The system mechanically blocks CONTEXT.md writes until the user selects the "(Recommended)" option. If the user declines, cancels, or the tool fails, you MUST re-ask — never rationalize past the block ("tool not responding, I'll proceed" is forbidden). The gate exists to protect the user's work; treat a block as an instruction, not an obstacle to work around.
+
 ## Output Phase
 
 Once the user is satisfied, in a single pass for **each** new milestone:

package/src/resources/extensions/gsd/state.ts

@@ -304,12 +304,9 @@ function extractContextTitle(content: string | null, fallback: string): string {
 
 // ─── DB-backed State Derivation ────────────────────────────────────────────
 
-/**
- * Helper: check if a DB status counts as "done" (handles K002 ambiguity).
- */
-function isStatusDone(status: string): boolean {
-  return status === 'complete' || status === 'done' || status === 'skipped';
-}
+// isStatusDone replaced by isClosedStatus from status-guards.ts (single source of truth).
+// Alias kept for backward compatibility within this file.
+const isStatusDone = isClosedStatus;
 
 /**
  * Derive GSD state from the milestones/slices/tasks DB tables.

package/src/resources/extensions/gsd/tests/wave5-consistency-regressions.test.ts

@@ -0,0 +1,165 @@
+// GSD State Machine — Wave 5 Consistency Regression Tests
+// Validates isClosedStatus usage in projections, upsertDecision seq preservation,
+// event schema versioning, and replay round-trip with mixed cmd formats.
+
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { isClosedStatus } from "../status-guards.js";
+import { openDatabase, closeDatabase, upsertDecision, _getAdapter, insertMilestone, insertSlice, insertTask, getTask } from "../gsd-db.js";
+import { extractEntityKey } from "../workflow-reconcile.js";
+import type { WorkflowEvent } from "../workflow-events.js";
+
+// ── Fix 19: isClosedStatus covers all closed statuses ──
+
+describe("isClosedStatus used by projections", () => {
+  test("skipped is closed (projections now show checked)", () => {
+    assert.ok(isClosedStatus("skipped"));
+  });
+  test("complete is closed", () => {
+    assert.ok(isClosedStatus("complete"));
+  });
+  test("done is closed", () => {
+    assert.ok(isClosedStatus("done"));
+  });
+  test("in-progress is not closed", () => {
+    assert.ok(!isClosedStatus("in-progress"));
+  });
+});
+
+// ── Fix 20: upsertDecision preserves seq on update ──
+
+describe("upsertDecision preserves seq column", () => {
+  test("seq is preserved when decision is re-upserted", () => {
+    const tmp = mkdtempSync(join(tmpdir(), "gsd-upsert-test-"));
+    const dbPath = join(tmp, "gsd.db");
+    try {
+      openDatabase(dbPath);
+      const adapter = _getAdapter();
+      assert.ok(adapter, "adapter must be available");
+
+      // Insert two decisions
+      upsertDecision({
+        id: "D001", when_context: "ctx1", scope: "s1",
+        decision: "d1", choice: "c1", rationale: "r1",
+        revisable: "yes", made_by: "agent", superseded_by: null,
+      });
+      upsertDecision({
+        id: "D002", when_context: "ctx2", scope: "s2",
+        decision: "d2", choice: "c2", rationale: "r2",
+        revisable: "yes", made_by: "agent", superseded_by: null,
+      });
+
+      // Get original seq values
+      const rows1 = adapter.prepare("SELECT id, seq FROM decisions ORDER BY seq").all() as Array<{ id: string; seq: number }>;
+      assert.strictEqual(rows1[0].id, "D001");
+      assert.strictEqual(rows1[1].id, "D002");
+      const d001OriginalSeq = rows1[0].seq;
+
+      // Re-upsert D001 with updated content
+      upsertDecision({
+        id: "D001", when_context: "updated", scope: "s1",
+        decision: "d1-updated", choice: "c1", rationale: "r1",
+        revisable: "yes", made_by: "agent", superseded_by: null,
+      });
+
+      // Verify seq is preserved (not moved to end)
+      const rows2 = adapter.prepare("SELECT id, seq FROM decisions ORDER BY seq").all() as Array<{ id: string; seq: number }>;
+      assert.strictEqual(rows2[0].id, "D001", "D001 should still be first by seq");
+      assert.strictEqual(rows2[0].seq, d001OriginalSeq, "D001 seq should be preserved");
+      assert.strictEqual(rows2[1].id, "D002", "D002 should still be second");
+
+      // Verify content was updated
+      const updated = adapter.prepare("SELECT decision FROM decisions WHERE id = 'D001'").get() as { decision: string };
+      assert.strictEqual(updated.decision, "d1-updated");
+
+      closeDatabase();
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+});
+
+// ── Fix 23: Event schema versioning ──
+
+describe("WorkflowEvent v field", () => {
+  test("appendEvent includes v:2 in output", async () => {
+    const tmp = mkdtempSync(join(tmpdir(), "gsd-event-v-test-"));
+    try {
+      const { appendEvent } = await import("../workflow-events.js");
+      appendEvent(tmp, {
+        cmd: "test-event",
+        params: { foo: "bar" },
+        ts: new Date().toISOString(),
+        actor: "system",
+      });
+
+      const logPath = join(tmp, ".gsd", "event-log.jsonl");
+      const line = readFileSync(logPath, "utf-8").trim();
+      const event = JSON.parse(line);
+      assert.strictEqual(event.v, 2, "New events should have v:2");
+      assert.strictEqual(event.cmd, "test-event");
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+});
+
+// ── Fix 19 (behavior-level): Projection rendering with skipped tasks ──
+
+describe("isClosedStatus drives projection checkbox logic", () => {
+  test("skipped task produces checked checkbox via isClosedStatus", () => {
+    // This tests the behavior contract that projections rely on:
+    // workflow-projections.ts uses isClosedStatus() to determine checkbox state.
+    // "skipped" tasks must render as [x], not [ ].
+    const statuses = ["complete", "done", "skipped"];
+    for (const status of statuses) {
+      assert.ok(
+        isClosedStatus(status),
+        `status "${status}" must be closed so projections render [x]`,
+      );
+    }
+    // Non-closed statuses must render as [ ]
+    for (const status of ["pending", "in-progress", "blocked", "active"]) {
+      assert.ok(
+        !isClosedStatus(status),
+        `status "${status}" must NOT be closed so projections render [ ]`,
+      );
+    }
+  });
+});
+
+// ── extractEntityKey: underscored cmds are recognized (Wave 5 scope) ──
+// Note: hyphenated cmd normalization is in Wave 1. These tests validate
+// the underscored format that Wave 5's extractEntityKey handles directly.
+
+describe("extractEntityKey recognizes underscored cmds", () => {
+  const base: WorkflowEvent = { cmd: "", params: {}, ts: "", hash: "", actor: "agent", session_id: "" };
+
+  test("complete_task → task entity", () => {
+    const key = extractEntityKey({ ...base, cmd: "complete_task", params: { taskId: "T01" } });
+    assert.deepStrictEqual(key, { type: "task", id: "T01" });
+  });
+
+  test("complete_slice → slice entity", () => {
+    const key = extractEntityKey({ ...base, cmd: "complete_slice", params: { sliceId: "S01" } });
+    assert.deepStrictEqual(key, { type: "slice", id: "S01" });
+  });
+
+  test("plan_slice → slice_plan entity (distinct from complete)", () => {
+    const key = extractEntityKey({ ...base, cmd: "plan_slice", params: { sliceId: "S01" } });
+    assert.deepStrictEqual(key, { type: "slice_plan", id: "S01" });
+  });
+
+  test("save_decision → decision entity", () => {
+    const key = extractEntityKey({ ...base, cmd: "save_decision", params: { scope: "s", decision: "d" } });
+    assert.deepStrictEqual(key, { type: "decision", id: "s:d" });
+  });
+
+  test("unknown cmd returns null (not crash)", () => {
+    const key = extractEntityKey({ ...base, cmd: "future_unknown_cmd", params: {} });
+    assert.strictEqual(key, null);
+  });
+});

package/src/resources/extensions/gsd/tests/write-gate.test.ts

@@ -12,6 +12,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
+  isDepthConfirmationAnswer,
   shouldBlockContextWrite,
   isDepthVerified,
   isQueuePhaseActive,
@@ -117,9 +118,9 @@ test('write-gate: regex does not match slice context files (S01-CONTEXT.md)', ()
   assert.strictEqual(result.block, false, 'S01-CONTEXT.md should not be blocked');
 });
 
-// ─── Scenario 7: Error message contains actionable instruction ──
+// ─── Scenario 7: Error message contains actionable instruction and anti-bypass language ──
 
-test('write-gate: blocked reason contains depth_verification keyword', () => {
+test('write-gate: blocked reason contains depth_verification keyword and anti-bypass language', () => {
   const result = shouldBlockContextWrite(
     'write',
     '.gsd/milestones/M999/M999-CONTEXT.md',
@@ -129,6 +130,8 @@ test('write-gate: blocked reason contains depth_verification keyword', () => {
   assert.strictEqual(result.block, true);
   assert.ok(result.reason!.includes('depth_verification'), 'reason should mention depth_verification question id');
   assert.ok(result.reason!.includes('ask_user_questions'), 'reason should mention ask_user_questions tool');
+  assert.ok(result.reason!.includes('MUST NOT'), 'reason should include anti-bypass language');
+  assert.ok(result.reason!.includes('(Recommended)'), 'reason should specify the required confirmation option');
 });
 
 // ─── Scenario 8: Queue mode blocks CONTEXT.md write without depth verification ──
@@ -191,3 +194,125 @@ test('write-gate: markDepthVerified unblocks queue-mode writes when milestoneId
 
   clearDiscussionFlowState();
 });
+
+// ─── Standard options fixture used across depth confirmation tests ──
+
+const STANDARD_OPTIONS = [
+  { label: 'Yes, you got it (Recommended)' },
+  { label: 'Not quite — let me clarify' },
+];
+
+// ─── Scenario 11: accepts first option (confirmation) with structural validation ──
+
+test('write-gate: isDepthConfirmationAnswer accepts first option with options present', () => {
+  assert.strictEqual(
+    isDepthConfirmationAnswer('Yes, you got it (Recommended)', STANDARD_OPTIONS),
+    true,
+    'should accept exact match of first option label',
+  );
+});
+
+// ─── Scenario 12: rejects second option (decline) ──
+
+test('write-gate: isDepthConfirmationAnswer rejects decline option', () => {
+  assert.strictEqual(
+    isDepthConfirmationAnswer('Not quite — let me clarify', STANDARD_OPTIONS),
+    false,
+    'should reject the clarification option',
+  );
+});
+
+// ─── Scenario 13: rejects "None of the above" ──
+
+test('write-gate: isDepthConfirmationAnswer rejects None of the above', () => {
+  assert.strictEqual(
+    isDepthConfirmationAnswer('None of the above', STANDARD_OPTIONS),
+    false,
+    'should reject None of the above',
+  );
+});
+
+// ─── Scenario 14: rejects garbage/empty input ──
+
+test('write-gate: isDepthConfirmationAnswer rejects garbage and edge cases', () => {
+  assert.strictEqual(isDepthConfirmationAnswer('discord', STANDARD_OPTIONS), false, 'garbage string');
+  assert.strictEqual(isDepthConfirmationAnswer('', STANDARD_OPTIONS), false, 'empty string');
+  assert.strictEqual(isDepthConfirmationAnswer(undefined, STANDARD_OPTIONS), false, 'undefined');
+  assert.strictEqual(isDepthConfirmationAnswer(null, STANDARD_OPTIONS), false, 'null');
+  assert.strictEqual(isDepthConfirmationAnswer(42, STANDARD_OPTIONS), false, 'number');
+});
+
+// ─── Scenario 15: handles array-wrapped selection ──
+
+test('write-gate: isDepthConfirmationAnswer handles array-wrapped selected value', () => {
+  assert.strictEqual(
+    isDepthConfirmationAnswer(['Yes, you got it (Recommended)'], STANDARD_OPTIONS),
+    true,
+    'should accept array-wrapped confirmation',
+  );
+  assert.strictEqual(
+    isDepthConfirmationAnswer(['Not quite — let me clarify'], STANDARD_OPTIONS),
+    false,
+    'should reject array-wrapped decline',
+  );
+  assert.strictEqual(
+    isDepthConfirmationAnswer([], STANDARD_OPTIONS),
+    false,
+    'should reject empty array',
+  );
+});
+
+// ─── Scenario 16: rejects free-form "Other" text that contains "(Recommended)" ──
+
+test('write-gate: isDepthConfirmationAnswer rejects free-form text containing Recommended', () => {
+  assert.strictEqual(
+    isDepthConfirmationAnswer('I think this is fine (Recommended)', STANDARD_OPTIONS),
+    false,
+    'free-form text with (Recommended) substring must not unlock gate',
+  );
+  assert.strictEqual(
+    isDepthConfirmationAnswer('(Recommended)', STANDARD_OPTIONS),
+    false,
+    'bare (Recommended) string must not unlock gate',
+  );
+});
+
+// ─── Scenario 17: works with changed label text (decoupled from specific copy) ──
+
+test('write-gate: isDepthConfirmationAnswer works with different label text', () => {
+  const customOptions = [
+    { label: 'Looks good, proceed' },
+    { label: 'Needs more discussion' },
+  ];
+  assert.strictEqual(
+    isDepthConfirmationAnswer('Looks good, proceed', customOptions),
+    true,
+    'should accept first option regardless of label text',
+  );
+  assert.strictEqual(
+    isDepthConfirmationAnswer('Needs more discussion', customOptions),
+    false,
+    'should reject second option',
+  );
+  // Old label should NOT work with new options
+  assert.strictEqual(
+    isDepthConfirmationAnswer('Yes, you got it (Recommended)', customOptions),
+    false,
+    'old label text should not match new options',
+  );
+});
+
+// ─── Scenario 18: fallback when options not available ──
+
+test('write-gate: isDepthConfirmationAnswer falls back to (Recommended) match without options', () => {
+  assert.strictEqual(
+    isDepthConfirmationAnswer('Yes, you got it (Recommended)'),
+    true,
+    'should accept via fallback when no options provided',
+  );
+  assert.strictEqual(
+    isDepthConfirmationAnswer('Not quite — let me clarify'),
+    false,
+    'should reject non-Recommended via fallback',
+  );
+});

package/src/resources/extensions/gsd/workflow-events.ts

@@ -19,10 +19,11 @@ export function getSessionId(): string {
 // ─── Event Types ─────────────────────────────────────────────────────────
 
 export interface WorkflowEvent {
-  cmd: string;           // e.g. "complete-task" (canonical: hyphens; legacy: underscores — both accepted by replay)
+  v?: number;              // schema version — omitted in v1 (legacy), 2 for current format
+  cmd: string;             // e.g. "complete-task" (canonical: hyphens; legacy: underscores — both accepted by replay)
   params: Record<string, unknown>;
-  ts: string;            // ISO 8601
-  hash: string;          // content hash (hex, 16 chars)
+  ts: string;              // ISO 8601
+  hash: string;            // content hash (hex, 16 chars)
   actor: "agent" | "system";
   actor_name?: string;      // e.g. "executor-agent-01" — caller-provided identity
   trigger_reason?: string;  // e.g. "plan-phase complete" — caller-provided causation
@@ -46,6 +47,7 @@ export function appendEvent(
     .slice(0, 16);
 
   const fullEvent: WorkflowEvent = {
+    v: 2,
     ...event,
     hash,
     session_id: ENGINE_SESSION_ID,

package/src/resources/extensions/gsd/workflow-projections.ts

@@ -16,6 +16,7 @@ import { atomicWriteSync } from "./atomic-write.js";
 import { join } from "node:path";
 import { mkdirSync, existsSync } from "node:fs";
 import { logWarning } from "./workflow-logger.js";
+import { isClosedStatus } from "./status-guards.js";
 import { deriveState } from "./state.js";
 import type { GSDState } from "./types.js";
 
@@ -55,7 +56,7 @@ export function renderPlanContent(sliceRow: SliceRow, taskRows: TaskRow[]): stri
   lines.push("## Tasks");
 
   for (const task of taskRows) {
-    const checkbox = task.status === "done" || task.status === "complete" ? "[x]" : "[ ]";
+    const checkbox = isClosedStatus(task.status) ? "[x]" : "[ ]";
     lines.push(`- ${checkbox} **${task.id}: ${task.title}** \u2014 ${task.description}`);
 
     // Estimate subline (always present if non-empty)
@@ -125,7 +126,7 @@ export function renderRoadmapContent(milestoneRow: MilestoneRow, sliceRows: Slic
   lines.push("|----|-------|------|---------|------|------------|");
 
   for (const slice of sliceRows) {
-    const done = slice.status === "done" || slice.status === "complete" ? "\u2705" : "\u2B1C";
+    const done = isClosedStatus(slice.status) ? "\u2705" : "\u2B1C";
 
     // depends is already parsed to string[] by rowToSlice
     let depends = "\u2014";