gsd-pi 2.77.0-dev.58d3d4d6c → 2.77.0-dev.cfd69e714

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -15,8 +15,9 @@ import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updat
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
+import { readIntegrationBranch } from "./git-service.js";
 import { isClosedStatus } from "./status-guards.js";
-import { nativeConflictFiles, nativeCommit, nativeCheckoutTheirs, nativeAddPaths, nativeMergeAbort, nativeResetHard, } from "./native-git-bridge.js";
+import { nativeConflictFiles, nativeCommit, nativeCheckoutTheirs, nativeAddPaths, nativeMergeAbort, nativeRebaseAbort, nativeResetHard, } from "./native-git-bridge.js";
 import { resolveSlicePath, resolveSliceFile, resolveTasksDir, resolveTaskFiles, relMilestoneFile, relSliceFile, buildSliceFileName, resolveMilestoneFile, clearPathCache, resolveGsdRootFile, } from "./paths.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, } from "node:fs";
 import { execFileSync } from "node:child_process";
@@ -28,14 +29,16 @@ export { resolveExpectedArtifactPath, diagnoseExpectedArtifact };
 export { classifyMilestoneSummaryContent, } from "./milestone-summary-classifier.js";
 // ─── Artifact Resolution & Verification ───────────────────────────────────────
 /**
- * Check whether a milestone produced implementation artifacts (non-`.gsd/` files)
- * in the git history. Uses `git log --name-only` to inspect all commits on the
- * current branch that touch files outside `.gsd/`.
+ * Check whether a milestone produced implementation artifacts (non-`.gsd/`
+ * files) in git history. The primary signal is the branch diff against the
+ * integration branch. When a retry is already on the integration branch, that
+ * diff is a self-diff; if a milestone ID is available, fall back to recent
+ * GSD-tagged commits for that milestone.
  *
  * Returns "present" if implementation files found, "absent" if only .gsd/ files,
  * "unknown" if git is unavailable or check failed (callers decide how to handle).
  */
-export function hasImplementationArtifacts(basePath) {
+export function hasImplementationArtifacts(basePath, milestoneId) {
     try {
         // Verify we're in a git repo
         try {
@@ -51,19 +54,31 @@ export function hasImplementationArtifacts(basePath) {
         }
         // Strategy: check `git diff --name-only` against the merge-base with the
         // main branch. This captures ALL files changed during the milestone's
-        // lifetime. If no merge-base exists (e.g., single-branch workflow), fall
-        // back to checking the last N commits.
-        const mainBranch = detectMainBranch(basePath);
-        const changedFiles = getChangedFilesSinceBranch(basePath, mainBranch);
-        // No files changed at all — unknown (could be detached HEAD, single-
-        // commit repo, or other edge case where git diff returns nothing).
-        if (changedFiles.length === 0)
+        // lifetime while running on a milestone branch.
+        const integrationBranch = milestoneId
+            ? readIntegrationBranch(basePath, milestoneId) ?? detectMainBranch(basePath)
+            : detectMainBranch(basePath);
+        const currentBranch = getCurrentBranch(basePath);
+        const branchDiff = getChangedFilesSinceBranch(basePath, integrationBranch);
+        if (!branchDiff.ok)
             return "unknown";
-        // Filter out .gsd/ files — only implementation files count.
-        // If every changed file is under .gsd/, the milestone produced no
-        // implementation code (#1703).
-        const implFiles = changedFiles.filter(f => !f.startsWith(".gsd/") && !f.startsWith(".gsd\\"));
-        return implFiles.length > 0 ? "present" : "absent";
+        const changedFiles = branchDiff.files;
+        // No branch-diff files can mean the unit retried on main after milestone
+        // commits already landed there. In that topology, inspect GSD-tagged
+        // milestone commits instead of treating the self-diff as proof of no work.
+        if (changedFiles.length === 0) {
+            if (milestoneId && currentBranch === integrationBranch) {
+                const tagged = getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId);
+                if (!tagged.ok)
+                    return "unknown";
+                if (tagged.matched)
+                    return classifyImplementationFiles(tagged.files);
+            }
+            if (currentBranch && currentBranch !== "HEAD")
+                return "absent";
+            return "unknown";
+        }
+        return classifyImplementationFiles(changedFiles);
     }
     catch (e) {
         // Non-fatal — if git operations fail, return unknown so callers can decide
@@ -71,6 +86,26 @@ export function hasImplementationArtifacts(basePath) {
         return "unknown";
     }
 }
+function getCurrentBranch(basePath) {
+    try {
+        const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        }).trim();
+        return branch || null;
+    }
+    catch {
+        return null;
+    }
+}
+function classifyImplementationFiles(files) {
+    const implFiles = files.filter(isImplementationPath);
+    return implFiles.length > 0 ? "present" : "absent";
+}
+function isImplementationPath(file) {
+    return !file.startsWith(".gsd/") && !file.startsWith(".gsd\\");
+}
 /**
  * Detect the main/master branch name.
  */
@@ -115,7 +150,7 @@ function getChangedFilesSinceBranch(basePath, targetBranch) {
         const mergeBase = execFileSync("git", ["merge-base", targetBranch, "HEAD"], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
         if (mergeBase) {
             const result = execFileSync("git", ["diff", "--name-only", mergeBase, "HEAD"], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
-            return result ? result.split("\n").filter(Boolean) : [];
+            return { ok: true, files: result ? result.split("\n").filter(Boolean) : [] };
         }
     }
     catch (err) {
@@ -125,13 +160,75 @@ function getChangedFilesSinceBranch(basePath, targetBranch) {
     // Fallback: check last 20 commits
     try {
         const result = execFileSync("git", ["log", "--name-only", "--pretty=format:", "-20", "HEAD"], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
-        return result ? [...new Set(result.split("\n").filter(Boolean))] : [];
+        return { ok: true, files: result ? [...new Set(result.split("\n").filter(Boolean))] : [] };
     }
     catch (e) {
         logWarning("recovery", `git log fallback failed: ${e.message}`);
-        return [];
+        return { ok: false, files: [] };
     }
 }
+function getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId) {
+    try {
+        const logOutput = execFileSync("git", ["log", "--format=%H%x1f%B%x1e", "HEAD", "--", `.gsd/milestones/${milestoneId}`], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
+        const records = logOutput
+            .split("\x1e")
+            .map((record) => record.trim())
+            .filter(Boolean)
+            .flatMap((record) => {
+            const sep = record.indexOf("\x1f");
+            if (sep === -1)
+                return [];
+            const hash = record.slice(0, sep).trim();
+            const message = record.slice(sep + 1);
+            return [{ hash, message }];
+        });
+        const files = new Set();
+        let matched = false;
+        for (const { hash, message } of records) {
+            if (!commitMessageHasGsdTrailer(message))
+                continue;
+            const commitFiles = getChangedFilesForCommit(basePath, hash);
+            if (!commitMatchesMilestone(message, milestoneId, commitFiles))
+                continue;
+            matched = true;
+            for (const file of commitFiles) {
+                files.add(file);
+            }
+        }
+        return { ok: true, matched, files: [...files] };
+    }
+    catch (e) {
+        logWarning("recovery", `milestone-tagged commit scan failed: ${e.message}`);
+        return { ok: false, matched: false, files: [] };
+    }
+}
+function getChangedFilesForCommit(basePath, hash) {
+    const fileOutput = execFileSync("git", ["diff-tree", "--root", "--no-commit-id", "-r", "--name-only", hash], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
+    return fileOutput.split("\n").map((f) => f.trim()).filter(Boolean);
+}
+function commitMessageHasGsdTrailer(message) {
+    return /^GSD-(?:Task|Unit):\s*\S+/m.test(message);
+}
+function commitMatchesMilestone(message, milestoneId, files) {
+    if (commitTrailerStartsWithMilestone(message, milestoneId))
+        return true;
+    // Meaningful execute-task commits currently store task scope as Sxx/Tyy
+    // rather than Mxx/Sxx/Tyy. Bind those commits back to the milestone only
+    // when the commit also touched this milestone's artifacts.
+    if (/^GSD-Task:\s*S[^/\s]+\/T\S+/m.test(message)) {
+        return files.some((file) => isMilestoneArtifactPath(file, milestoneId));
+    }
+    return false;
+}
+function commitTrailerStartsWithMilestone(message, milestoneId) {
+    const escapedMilestone = milestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const trailerPattern = new RegExp(`^GSD-(?:Task|Unit):\\s*${escapedMilestone}(?:$|[\\s/])`, "m");
+    return trailerPattern.test(message);
+}
+function isMilestoneArtifactPath(file, milestoneId) {
+    return file.startsWith(`.gsd/milestones/${milestoneId}/`)
+        || file.startsWith(`.gsd\\milestones\\${milestoneId}\\`);
+}
 /**
  * Check whether the expected artifact(s) for a unit exist on disk.
  * Returns true if all required artifacts exist, or if the unit type has no
@@ -447,7 +544,7 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
             if (!isClosedStatus(dbMilestone.status) && summaryOutcome !== "success")
                 return false;
         }
-        if (hasImplementationArtifacts(base) === "absent")
+        if (hasImplementationArtifacts(base, mid) === "absent")
             return false;
     }
     return true;
@@ -577,6 +674,72 @@ function abortAndResetMerge(basePath, hasMergeHead, squashMsgPath) {
         logError("recovery", `git reset failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/**
+ * Detect and abort other in-progress git operations left behind by a SIGKILL'd
+ * worker (rebase, cherry-pick, revert). Without this, a killed worker mid-rebase
+ * leaves `.git/rebase-merge/` or `.git/CHERRY_PICK_HEAD` and the worktree is
+ * wedged until the user manually runs the matching `--abort`.
+ *
+ * Called before merge-state reconciliation because these states block any
+ * subsequent merge/commit operation. (Issue #4980 HIGH-7)
+ */
+function reconcileOtherInProgressGitOps(basePath, ctx) {
+    const gitDir = join(basePath, ".git");
+    const states = [
+        {
+            label: "rebase",
+            indicators: [join(gitDir, "rebase-merge"), join(gitDir, "rebase-apply")],
+            abort: () => nativeRebaseAbort(basePath),
+        },
+        {
+            label: "cherry-pick",
+            indicators: [join(gitDir, "CHERRY_PICK_HEAD")],
+            abort: () => {
+                // No native helper; fall back to git CLI.
+                try {
+                    execFileSync("git", ["cherry-pick", "--abort"], {
+                        cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+                    });
+                }
+                catch (err) {
+                    logWarning("recovery", `cherry-pick --abort failed: ${getErrorMessage(err)}`);
+                }
+            },
+        },
+        {
+            label: "revert",
+            indicators: [join(gitDir, "REVERT_HEAD")],
+            abort: () => {
+                try {
+                    execFileSync("git", ["revert", "--abort"], {
+                        cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+                    });
+                }
+                catch (err) {
+                    logWarning("recovery", `revert --abort failed: ${getErrorMessage(err)}`);
+                }
+            },
+        },
+    ];
+    let reconciled = false;
+    for (const s of states) {
+        const present = s.indicators.some((p) => existsSync(p));
+        if (!present)
+            continue;
+        try {
+            s.abort();
+            ctx.ui.notify(`Detected leftover ${s.label} state from prior session — aborted.`, "warning");
+            reconciled = true;
+        }
+        catch (err) {
+            logError("recovery", `${s.label} abort failed: ${getErrorMessage(err)}`);
+            ctx.ui.notify(`Detected leftover ${s.label} state but auto-abort failed. ` +
+                `Run \`git ${s.label} --abort\` manually before retrying.`, "error");
+            return "blocked";
+        }
+    }
+    return reconciled ? "reconciled" : "clean";
+}
 /**
  * Detect leftover merge state from a prior session and reconcile it.
  * If MERGE_HEAD or SQUASH_MSG exists, check whether conflicts are resolved.
@@ -584,12 +747,21 @@ function abortAndResetMerge(basePath, hasMergeHead, squashMsgPath) {
  * If code conflicts remain: fail safe without modifying the worktree.
  */
 export function reconcileMergeState(basePath, ctx) {
+    // First, abort any rebase/cherry-pick/revert left over from a SIGKILL'd
+    // worker. Doing this before the merge-state check unblocks any merge that
+    // would otherwise refuse with "you have unfinished operation". (HIGH-7)
+    const otherOpsResult = reconcileOtherInProgressGitOps(basePath, ctx);
+    if (otherOpsResult === "blocked")
+        return "blocked";
     const mergeHeadPath = join(basePath, ".git", "MERGE_HEAD");
     const squashMsgPath = join(basePath, ".git", "SQUASH_MSG");
     const hasMergeHead = existsSync(mergeHeadPath);
     const hasSquashMsg = existsSync(squashMsgPath);
-    if (!hasMergeHead && !hasSquashMsg)
-        return "clean";
+    if (!hasMergeHead && !hasSquashMsg) {
+        // If we cleaned up another op type, return "reconciled" so the caller
+        // re-derives state from a known-good baseline.
+        return otherOpsResult === "reconciled" ? "reconciled" : "clean";
+    }
     const conflictedFiles = nativeConflictFiles(basePath);
     if (conflictedFiles.length === 0) {
         // All conflicts resolved — finalize the merge/squash commit

package/dist/resources/extensions/gsd/auto-start.js

@@ -64,25 +64,15 @@ export async function openProjectDbIfPresent(basePath) {
         logWarning("engine", `gsd-db: failed to open existing database: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/**
- * Audit for orphaned milestone branches at bootstrap.
- *
- * After a milestone completes, the teardown step (merge branch → main,
- * delete branch, remove worktree) runs as a post-completion engine step.
- * If the session ends between completion and teardown, the branch and
- * worktree are orphaned — the DB says "complete" so auto-mode won't
- * re-enter the milestone, and the teardown is never retried.
- *
- * This audit runs on every fresh bootstrap to catch that gap:
- * 1. Lists all local `milestone/*` branches.
- * 2. For each, checks if the milestone's DB status is "complete".
- * 3. If the branch is already merged into main → deletes the branch
- *    and cleans up any orphaned worktree directory (safe, no data loss).
- * 4. If the branch is NOT merged → preserves it and warns the user
- *    so they can merge manually (data safety first).
- *
- * Returns a summary of actions taken for the caller to surface via notify.
- */
+export function decideSurvivorAction(hasSurvivorBranch, phase) {
+    if (!hasSurvivorBranch)
+        return "none";
+    if (phase === "needs-discussion")
+        return "discuss";
+    if (phase === "complete")
+        return "finalize";
+    return "none";
+}
 export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     const recovered = [];
     const warnings = [];
@@ -450,7 +440,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // The worktree/branch was created but the milestone only has CONTEXT-DRAFT.md.
         // Route to the interactive discussion handler instead of falling through to
         // auto-mode, which would immediately stop with "needs discussion".
-        if (hasSurvivorBranch && state.phase === "needs-discussion") {
+        if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "discuss") {
             const { showSmartEntry } = await import("./guided-flow.js");
             await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
             invalidateAllCaches();
@@ -470,7 +460,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // The milestone artifacts were written but finalization (merge, worktree
         // cleanup) never ran. Run mergeAndExit to finalize, then re-derive state
         // so the normal "all milestones complete" or "next milestone" path runs.
-        if (hasSurvivorBranch && state.phase === "complete") {
+        // Re-evaluate via the helper — the discuss branch above may have cleared
+        // hasSurvivorBranch after a successful promotion.
+        if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
             const mid = state.activeMilestone.id;
             ctx.ui.notify(`Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`, "info");
             const resolver = buildResolver();
@@ -776,14 +768,32 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         catch (err) {
             ctx.ui.notify(`Secrets collection error: ${err instanceof Error ? err.message : String(err)}. Continuing with next task.`, "warning");
         }
-        // Self-heal: remove stale .git/index.lock
+        // Self-heal: remove stale .git/index.lock.
+        //
+        // Threshold raised from 60s → 5min because a 60s-old lock is not
+        // definitively stale: `git gc --auto` triggered by a heavy commit, NFS
+        // delays, or concurrent worktree writes can hold .git/index.lock for
+        // minutes on large repos. Force-removing a live lock causes the holder
+        // to encounter `fatal: Unable to create '.git/index.lock'` on its next
+        // write, or worse, operate on a partially-written index → corruption
+        // requiring `git fsck`/`git reset` to recover.
+        // (Issue #4980 CRIT-3)
         try {
             const gitLockFile = join(base, ".git", "index.lock");
             if (existsSync(gitLockFile)) {
                 const lockAge = Date.now() - statSync(gitLockFile).mtimeMs;
-                if (lockAge > 60_000) {
+                const STALE_GIT_LOCK_THRESHOLD_MS = 5 * 60_000;
+                if (lockAge > STALE_GIT_LOCK_THRESHOLD_MS) {
                     unlinkSync(gitLockFile);
-                    ctx.ui.notify("Removed stale .git/index.lock from prior crash.", "info");
+                    ctx.ui.notify(`Removed stale .git/index.lock (age ${Math.round(lockAge / 1000)}s, > 5min threshold).`, "warning");
+                }
+                else {
+                    // Lock present but not yet stale — surface so the user knows why
+                    // git ops may be queueing instead of silently waiting.
+                    debugLog("git-lock-present-not-stale", {
+                        ageMs: lockAge,
+                        thresholdMs: STALE_GIT_LOCK_THRESHOLD_MS,
+                    });
                 }
             }
         }

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -77,20 +77,21 @@ export function clearInFlightTools() {
 }
 // ─── Tool invocation error classification (#2883) ────────────────────────
 /**
- * Patterns that indicate a tool invocation failed due to malformed or truncated
- * JSON arguments — as opposed to a normal business-logic error from the tool
- * handler. When these errors occur, retrying the same unit will produce the same
- * failure, so the retry loop must be broken.
+ * Patterns that indicate a tool invocation failed deterministically before
+ * useful work could be completed — as opposed to a normal business-logic error
+ * from the tool handler. When these errors occur, retrying the same unit will
+ * produce the same failure, so the retry loop must be broken.
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON/i;
+const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
 /**
- * Returns true if the error message indicates a tool invocation failure due to
- * malformed/truncated arguments (as opposed to a normal tool execution error).
+ * Returns true if the error message indicates a deterministic invocation or
+ * policy failure (as opposed to a normal tool execution error).
  */
 export function isToolInvocationError(errorMsg) {
     if (!errorMsg)
         return false;
-    return TOOL_INVOCATION_ERROR_RE.test(errorMsg);
+    return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
 /**
  * Returns true if the error message indicates the tool was skipped because
@@ -102,3 +103,42 @@ export function isQueuedUserMessageSkip(errorMsg) {
         return false;
     return /^Skipped due to queued user message\.?$/i.test(errorMsg.trim());
 }
+// ─── Deterministic policy error classification (#4973, #4974) ──────────────
+/**
+ * Known deterministic policy error substrings. Each entry is a stable string
+ * that will appear in the tool error text content when the corresponding
+ * policy gate fires. Retrying these errors will always produce the same outcome.
+ *
+ * Add new entries here as new deterministic gates are introduced. Do NOT use
+ * regex — explicit substrings keep the list auditable.
+ */
+export const DETERMINISTIC_POLICY_ERROR_STRINGS = [
+    // gsd_summary_save write-gate: CONTEXT artifact blocked pending depth verification (#4973).
+    // Matches the fallback text in workflow-tool-executors.ts and the verbose reason
+    // from shouldBlockContextArtifactSaveInSnapshot at write-gate.ts:432-442.
+    "context write blocked",
+    "CONTEXT without depth verification",
+    // Raw write tool gate (#4973): shouldBlockContextWrite at write-gate.ts:390-399 emits
+    // "Cannot write to milestone CONTEXT.md without depth verification." for direct
+    // write tool calls to *-CONTEXT.md paths (different code path than gsd_summary_save).
+    "CONTEXT.md without depth verification",
+];
+/**
+ * Returns true if the error message indicates a deterministic policy gate
+ * blocked the tool call before execution. Retrying the same unit without
+ * changing behavior will hit the same gate, so auto-mode should pause instead
+ * of re-dispatching.
+ *
+ * Combines the regex-based gate set from #4974 (HARD BLOCK / queue planning /
+ * STATE.md / mechanical gate) and the substring-based set from #4973 (context
+ * write block / CONTEXT depth verification). Both branches landed on main
+ * independently and their parallel `isDeterministicPolicyError` declarations
+ * were not deduplicated at merge — this consolidated form preserves both
+ * matchers under a single export.
+ */
+export function isDeterministicPolicyError(errorMsg) {
+    if (!errorMsg)
+        return false;
+    return (DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg) ||
+        DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s)));
+}