gsd-pi 2.77.0-dev.58d3d4d6c → 2.77.0-dev.cfd69e714

package/dist/resources/extensions/gsd/skill-manifest.js

@@ -0,0 +1,168 @@
+// GSD2 + skill-manifest — per-unit-type skill allowlist resolver (RFC #4779)
+//
+// Each auto-mode unit type can declare which skills are relevant to it. This
+// trims the set of skills considered for activation in the per-unit prompt,
+// reducing prompt token bloat and sharpening model focus.
+//
+// Contract:
+//   - Unknown unit types fall through to "all skills" (current behavior).
+//   - A manifest entry referencing a skill that is not installed is a silent
+//     no-op at filter time — the filter passes through installed skills only.
+//   - The allowlist is an inclusion list: only skills whose normalized name
+//     appears in the allowlist are retained. Order is not preserved.
+//
+// Phase 1 scope: seed manifests for a small number of unit types as proof.
+// Additional unit types can be added incrementally; each addition is a pure
+// data change with no wiring cost.
+import { logWarning } from "./workflow-logger.js";
+/** Normalize a skill reference the same way callers do (lowercase, trim). */
+function normalize(name) {
+    return name.trim().toLowerCase();
+}
+/**
+ * Allowlist per unit type. Keys match unit type identifiers used by auto-mode
+ * dispatch. Values are normalized skill names.
+ *
+ * Wildcard semantics: a unit type absent from this map resolves to `null`
+ * (wildcard) — meaning "all installed skills are eligible". Prefer absence
+ * over an exhaustive list when uncertain.
+ */
+const UNIT_TYPE_SKILL_MANIFEST = {
+    // Milestone-level planning / meta flows — predictable skill sets.
+    "research-milestone": [
+        "write-docs",
+        "write-milestone-brief",
+        "decompose-into-slices",
+        "grill-me",
+        "design-an-interface",
+        "api-design",
+        "observability",
+    ],
+    "plan-milestone": [
+        "write-milestone-brief",
+        "decompose-into-slices",
+        "design-an-interface",
+        "grill-me",
+        "write-docs",
+        "api-design",
+        "tdd",
+        "verify-before-complete",
+    ],
+    "complete-milestone": [
+        "verify-before-complete",
+        "write-docs",
+        "handoff",
+        "forensics",
+        "observability",
+        "security-review",
+    ],
+    "validate-milestone": [
+        "verify-before-complete",
+        "review",
+        "test",
+        "lint",
+        "security-review",
+        "accessibility",
+        "forensics",
+        "observability",
+    ],
+    "reassess-roadmap": [
+        "decompose-into-slices",
+        "grill-me",
+        "write-milestone-brief",
+        "write-docs",
+        "forensics",
+    ],
+    // Slice-level research / planning.
+    "research-slice": [
+        "write-docs",
+        "decompose-into-slices",
+        "design-an-interface",
+        "grill-me",
+        "api-design",
+        "observability",
+    ],
+    "plan-slice": [
+        "decompose-into-slices",
+        "design-an-interface",
+        "grill-me",
+        "write-docs",
+        "api-design",
+        "tdd",
+        "verify-before-complete",
+    ],
+    "refine-slice": [
+        "decompose-into-slices",
+        "design-an-interface",
+        "grill-me",
+        "write-docs",
+        "api-design",
+        "tdd",
+        "verify-before-complete",
+    ],
+    "replan-slice": [
+        "decompose-into-slices",
+        "grill-me",
+        "design-an-interface",
+        "write-docs",
+        "api-design",
+    ],
+    "run-uat": [
+        "verify-before-complete",
+        "test",
+        "review",
+        "accessibility",
+    ],
+    // `execute-task` intentionally omitted — implementation hot path covers a
+    // wide surface of technologies; wildcard fallback preserves today's
+    // behavior until per-task skill hints can be derived from task-plan
+    // frontmatter. See RFC #4779.
+};
+/**
+ * Resolve the skill allowlist for a unit type.
+ *
+ * @returns Array of normalized skill names when an entry exists, or `null`
+ *   when the unit type is unknown (wildcard — caller should not filter).
+ */
+export function resolveSkillManifest(unitType) {
+    if (!unitType)
+        return null;
+    const entry = UNIT_TYPE_SKILL_MANIFEST[unitType];
+    if (!entry)
+        return null;
+    return entry.map(normalize);
+}
+/**
+ * Filter a skill list by the manifest for `unitType`. Pass-through when the
+ * manifest is wildcard (unknown unit type) or `unitType` is undefined.
+ */
+export function filterSkillsByManifest(skills, unitType) {
+    const allowlist = resolveSkillManifest(unitType);
+    if (allowlist === null)
+        return skills;
+    const allowed = new Set(allowlist);
+    return skills.filter(skill => allowed.has(normalize(skill.name)));
+}
+/**
+ * Dev-mode guard: warn once per process if a manifest entry references a name
+ * that is not currently installed. Silent in production.
+ */
+const warnedMissing = new Set();
+export function warnIfManifestHasMissingSkills(unitType, installedNames) {
+    // Strict mode is intentionally opt-in via exactly "1"; values like "0" or
+    // "false" must preserve the normal silent manifest behavior.
+    if (process.env.GSD_SKILL_MANIFEST_STRICT !== "1")
+        return;
+    const allowlist = resolveSkillManifest(unitType);
+    if (!allowlist)
+        return;
+    for (const name of allowlist) {
+        const key = `${unitType}:${name}`;
+        if (warnedMissing.has(key))
+            continue;
+        if (!installedNames.has(name)) {
+            warnedMissing.add(key);
+            logWarning("prompt", `skill-manifest: references uninstalled skill '${name}' for unit '${unitType}'`);
+        }
+    }
+}

package/dist/resources/extensions/gsd/slice-parallel-orchestrator.js

@@ -12,8 +12,9 @@
  * - Lock env: GSD_SLICE_LOCK (in addition to GSD_MILESTONE_LOCK)
  * - Conflict check: file overlap between slice plans (slice-parallel-conflict.ts)
  */
-import { spawn } from "node:child_process";
-import { appendFileSync, existsSync, mkdirSync, } from "node:fs";
+import { execFileSync, spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { appendFileSync, existsSync, writeFileSync, readFileSync, mkdirSync, renameSync, unlinkSync, } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gsdRoot } from "./paths.js";
@@ -24,12 +25,243 @@ import { getErrorMessage } from "./error-utils.js";
 import { selectConflictFreeBatch } from "./uok/execution-graph.js";
 // ─── Module State ──────────────────────────────────────────────────────────
 let sliceState = null;
+// ─── Persisted State (crash recovery) ──────────────────────────────────────
+//
+// Mirrors parallel-orchestrator.ts. Without persistence, a coordinator crash
+// leaves orphaned worktrees on disk with no way to detect or clean them up
+// on next session start. (Issue #4980 HIGH-8)
+const SLICE_ORCHESTRATOR_STATE_FILE = "slice-orchestrator.json";
+const TMP_SUFFIX = ".tmp";
+function sliceStateFilePath(basePath) {
+    return join(gsdRoot(basePath), SLICE_ORCHESTRATOR_STATE_FILE);
+}
+function isPidAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "EPERM")
+            return true;
+        return false;
+    }
+}
+function readLinuxProcessStartFingerprint(pid) {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf-8");
+        const afterCommand = stat.slice(stat.lastIndexOf(")") + 2).trim();
+        const fields = afterCommand.split(/\s+/);
+        const startTimeTicks = fields[19];
+        return startTimeTicks ? `linux-stat:${startTimeTicks}` : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readPsProcessStartFingerprint(pid) {
+    try {
+        const raw = execFileSync("ps", ["-p", String(pid), "-o", "lstart="], {
+            stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf-8",
+        }).trim().replace(/\s+/g, " ");
+        return raw ? `ps-lstart:${raw}` : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readProcessStartFingerprint(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return null;
+    return readLinuxProcessStartFingerprint(pid) ?? readPsProcessStartFingerprint(pid);
+}
+function linuxProcessEnvContains(pid, key, value) {
+    if (process.platform !== "linux")
+        return null;
+    try {
+        const env = readFileSync(`/proc/${pid}/environ`, "utf-8");
+        return env.split("\0").includes(`${key}=${value}`);
+    }
+    catch {
+        return null;
+    }
+}
+function createWorkerToken(milestoneId, sliceId) {
+    return `slice:${milestoneId}:${sliceId}:${Date.now()}:${randomUUID()}`;
+}
+function isRecoveredSliceWorkerAlive(worker) {
+    if (!isPidAlive(worker.pid))
+        return false;
+    if (!worker.processStartFingerprint)
+        return false;
+    const currentFingerprint = readProcessStartFingerprint(worker.pid);
+    if (!currentFingerprint || currentFingerprint !== worker.processStartFingerprint) {
+        return false;
+    }
+    if (worker.workerToken) {
+        const envMatches = linuxProcessEnvContains(worker.pid, "GSD_SLICE_WORKER_TOKEN", worker.workerToken);
+        if (envMatches === false)
+            return false;
+    }
+    return true;
+}
+/**
+ * Persist current slice orchestrator state. Atomic write (tmp + rename) to
+ * prevent partial reads if the coordinator dies mid-write.
+ */
+function persistSliceState() {
+    if (!sliceState)
+        return;
+    try {
+        const dir = gsdRoot(sliceState.basePath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const persisted = {
+            active: sliceState.active,
+            workers: [...sliceState.workers.values()].map((w) => ({
+                milestoneId: w.milestoneId,
+                sliceId: w.sliceId,
+                pid: w.pid,
+                workerToken: w.workerToken,
+                processStartFingerprint: w.processStartFingerprint,
+                worktreePath: w.worktreePath,
+                startedAt: w.startedAt,
+                state: w.state,
+                completedUnits: w.completedUnits,
+                cost: w.cost,
+            })),
+            totalCost: sliceState.totalCost,
+            budgetCeiling: sliceState.budgetCeiling,
+            maxWorkers: sliceState.maxWorkers,
+            startedAt: sliceState.startedAt,
+            basePath: sliceState.basePath,
+        };
+        const dest = sliceStateFilePath(sliceState.basePath);
+        const tmp = dest + TMP_SUFFIX;
+        writeFileSync(tmp, JSON.stringify(persisted, null, 2), "utf-8");
+        renameSync(tmp, dest);
+        lastPersistTs = Date.now();
+    }
+    catch {
+        /* non-fatal: persistence is best-effort */
+    }
+}
+/**
+ * Throttled wrapper around `persistSliceState`. Skips if the last successful
+ * persist was less than `PERSIST_THROTTLE_MS` ago; otherwise persists
+ * immediately. Use this on hot paths (e.g. `message_end` events) where we
+ * receive many events per second per worker. Terminal events (worker exit,
+ * crash, stop) should call `persistSliceState()` directly to guarantee the
+ * final state hits disk regardless of timing.
+ */
+const PERSIST_THROTTLE_MS = 1000;
+let lastPersistTs = 0;
+function persistSliceStateThrottled() {
+    if (Date.now() - lastPersistTs < PERSIST_THROTTLE_MS)
+        return;
+    persistSliceState();
+}
+function removeSliceStateFile(basePath) {
+    try {
+        const p = sliceStateFilePath(basePath);
+        if (existsSync(p))
+            unlinkSync(p);
+    }
+    catch {
+        /* non-fatal */
+    }
+}
+/**
+ * Restore slice orchestrator state from disk. Filters dead-PID workers and
+ * removes their orphaned worktrees so a clean restart is possible.
+ *
+ * Returns null if no state file exists or no workers survive.
+ */
+export function restoreSliceState(basePath) {
+    try {
+        const p = sliceStateFilePath(basePath);
+        if (!existsSync(p))
+            return null;
+        const persisted = JSON.parse(readFileSync(p, "utf-8"));
+        const survivors = [];
+        const dead = [];
+        for (const w of persisted.workers) {
+            if (w.state === "running" && isRecoveredSliceWorkerAlive(w)) {
+                survivors.push(w);
+            }
+            else if (w.state === "running") {
+                dead.push(w);
+            }
+            else {
+                survivors.push(w);
+            }
+        }
+        // Best-effort cleanup of orphaned worktrees from dead workers.
+        for (const w of dead) {
+            const wtName = `${w.milestoneId}-${w.sliceId}`;
+            try {
+                removeWorktree(persisted.basePath, wtName, { deleteBranch: true, force: true });
+            }
+            catch {
+                /* worktree may already be gone */
+            }
+        }
+        persisted.workers = survivors;
+        if (survivors.length === 0) {
+            removeSliceStateFile(basePath);
+            return null;
+        }
+        return persisted;
+    }
+    catch {
+        return null;
+    }
+}
 // ─── Public API ────────────────────────────────────────────────────────────
 /**
  * Check whether slice-level parallel is currently active.
+ *
+ * If in-memory state is unset but a persisted state file exists with at
+ * least one live-PID worker, treat as active and rehydrate so a coordinator
+ * crash followed by a fresh process is detectable. (Issue #4980 HIGH-8)
  */
-export function isSliceParallelActive() {
-    return sliceState?.active === true;
+export function isSliceParallelActive(basePath) {
+    if (sliceState?.active === true)
+        return true;
+    if (!basePath)
+        return false;
+    const restored = restoreSliceState(basePath);
+    if (!restored || restored.workers.length === 0)
+        return false;
+    // Rehydrate in-memory state from disk; processes are detached so we have
+    // no ChildProcess handles, only PIDs.
+    sliceState = {
+        active: restored.active,
+        workers: new Map(),
+        totalCost: restored.totalCost,
+        budgetCeiling: restored.budgetCeiling,
+        maxWorkers: restored.maxWorkers,
+        startedAt: restored.startedAt,
+        basePath: restored.basePath,
+    };
+    for (const w of restored.workers) {
+        sliceState.workers.set(w.sliceId, {
+            milestoneId: w.milestoneId,
+            sliceId: w.sliceId,
+            pid: w.pid,
+            process: null,
+            worktreePath: w.worktreePath,
+            workerToken: w.workerToken ?? "",
+            processStartFingerprint: w.processStartFingerprint ?? null,
+            startedAt: w.startedAt,
+            state: w.state,
+            completedUnits: w.completedUnits,
+            cost: w.cost,
+        });
+    }
+    return true;
 }
 /**
  * Get current slice orchestrator state (read-only snapshot).
@@ -80,6 +312,8 @@ export async function startSliceParallel(basePath, milestoneId, eligibleSlices,
                 milestoneId,
                 sliceId: slice.id,
                 pid: 0,
+                workerToken: createWorkerToken(milestoneId, slice.id),
+                processStartFingerprint: null,
                 process: null,
                 worktreePath: wtPath,
                 startedAt: Date.now(),
@@ -95,13 +329,18 @@ export async function startSliceParallel(basePath, milestoneId, eligibleSlices,
             }
             else {
                 errors.push({ sid: slice.id, error: "Failed to spawn worker process" });
-                worker.state = "error";
+                sliceState.workers.delete(slice.id);
+                try {
+                    removeWorktree(basePath, wtName, { deleteBranch: true, force: true });
+                }
+                catch { /* ignore cleanup failures */ }
             }
         }
         catch (err) {
             errors.push({ sid: slice.id, error: getErrorMessage(err) });
             // Best-effort cleanup of partially created worktree
             const wtName = `${milestoneId}-${slice.id}`;
+            sliceState.workers.delete(slice.id);
             try {
                 removeWorktree(basePath, wtName, { deleteBranch: true, force: true });
             }
@@ -111,6 +350,11 @@ export async function startSliceParallel(basePath, milestoneId, eligibleSlices,
     // If nothing started, deactivate
     if (started.length === 0) {
         sliceState.active = false;
+        removeSliceStateFile(basePath);
+    }
+    else {
+        // Persist state for crash recovery (Issue #4980 HIGH-8).
+        persistSliceState();
     }
     return { started, errors };
 }
@@ -120,13 +364,17 @@ export async function startSliceParallel(basePath, milestoneId, eligibleSlices,
 export function stopSliceParallel() {
     if (!sliceState)
         return;
+    const basePath = sliceState.basePath;
     for (const worker of sliceState.workers.values()) {
-        if (worker.process) {
-            try {
+        try {
+            if (worker.process) {
                 worker.process.kill("SIGTERM");
             }
-            catch { /* already dead */ }
+            else if (worker.state === "running" && isRecoveredSliceWorkerAlive(worker)) {
+                process.kill(worker.pid, "SIGTERM");
+            }
         }
+        catch { /* already dead */ }
         worker.cleanup?.();
         worker.cleanup = undefined;
         worker.process = null;
@@ -139,6 +387,9 @@ export function stopSliceParallel() {
         catch { /* best-effort cleanup */ }
     }
     sliceState.active = false;
+    // Clear persisted state — clean shutdown means no recovery on next start.
+    // (Issue #4980 HIGH-8)
+    removeSliceStateFile(basePath);
 }
 /**
  * Get aggregate cost across all slice workers.
@@ -170,6 +421,7 @@ export function resetSliceOrchestrator() {
         }
     }
     sliceState = null;
+    lastPersistTs = 0;
 }
 // ─── Internal: Conflict Filtering ──────────────────────────────────────────
 /**
@@ -254,6 +506,7 @@ function spawnSliceWorker(basePath, milestoneId, sliceId) {
                 GSD_MILESTONE_LOCK: milestoneId,
                 GSD_PROJECT_ROOT: basePath,
                 GSD_PARALLEL_WORKER: "1",
+                GSD_SLICE_WORKER_TOKEN: worker.workerToken,
             },
             stdio: ["ignore", "pipe", "pipe"],
             detached: false,
@@ -272,8 +525,17 @@ function spawnSliceWorker(basePath, milestoneId, sliceId) {
     });
     worker.process = child;
     worker.pid = child.pid ?? 0;
+    worker.processStartFingerprint = worker.pid > 0
+        ? readProcessStartFingerprint(worker.pid)
+        : null;
     if (!child.pid) {
         worker.process = null;
+        worker.pid = 0;
+        worker.processStartFingerprint = null;
+        try {
+            child.kill("SIGTERM");
+        }
+        catch { /* best-effort */ }
         return false;
     }
     // ── NDJSON stdout monitoring ────────────────────────────────────────
@@ -346,6 +608,9 @@ function spawnSliceWorker(basePath, milestoneId, sliceId) {
             startedAt: w.startedAt,
             worktreePath: w.worktreePath,
         });
+        // Persist worker terminal state for crash recovery.
+        // (Issue #4980 HIGH-8)
+        persistSliceState();
     });
     return true;
 }
@@ -374,6 +639,11 @@ function processSliceWorkerLine(_basePath, _milestoneId, sliceId, line) {
                 sliceState.totalCost += usage.cost;
             }
             worker.completedUnits++;
+            // Persist cost / progress updates so a crash mid-run preserves them.
+            // Throttled (~1/s per process) so high-frequency message_end traffic
+            // does not saturate disk I/O. Worker exit / start / stop paths persist
+            // unthrottled to guarantee the terminal state lands. (Issue #4980 HIGH-8)
+            persistSliceStateThrottled();
         }
     }
 }