gsd-pi 2.77.0-dev.58d3d4d6c → 2.77.0-dev.cfd69e714

package/src/resources/extensions/gsd/auto-recovery.ts

@@ -17,6 +17,7 @@ import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updat
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
+import { readIntegrationBranch } from "./git-service.js";
 import { isClosedStatus } from "./status-guards.js";
 import {
   nativeConflictFiles,
@@ -24,6 +25,7 @@ import {
   nativeCheckoutTheirs,
   nativeAddPaths,
   nativeMergeAbort,
+  nativeRebaseAbort,
   nativeResetHard,
 } from "./native-git-bridge.js";
 import {
@@ -63,14 +65,16 @@ export {
 // ─── Artifact Resolution & Verification ───────────────────────────────────────
 
 /**
- * Check whether a milestone produced implementation artifacts (non-`.gsd/` files)
- * in the git history. Uses `git log --name-only` to inspect all commits on the
- * current branch that touch files outside `.gsd/`.
+ * Check whether a milestone produced implementation artifacts (non-`.gsd/`
+ * files) in git history. The primary signal is the branch diff against the
+ * integration branch. When a retry is already on the integration branch, that
+ * diff is a self-diff; if a milestone ID is available, fall back to recent
+ * GSD-tagged commits for that milestone.
  *
  * Returns "present" if implementation files found, "absent" if only .gsd/ files,
  * "unknown" if git is unavailable or check failed (callers decide how to handle).
  */
-export function hasImplementationArtifacts(basePath: string): "present" | "absent" | "unknown" {
+export function hasImplementationArtifacts(basePath: string, milestoneId?: string): "present" | "absent" | "unknown" {
   try {
     // Verify we're in a git repo
     try {
@@ -86,20 +90,29 @@ export function hasImplementationArtifacts(basePath: string): "present" | "absen
 
     // Strategy: check `git diff --name-only` against the merge-base with the
     // main branch. This captures ALL files changed during the milestone's
-    // lifetime. If no merge-base exists (e.g., single-branch workflow), fall
-    // back to checking the last N commits.
-    const mainBranch = detectMainBranch(basePath);
-    const changedFiles = getChangedFilesSinceBranch(basePath, mainBranch);
-
-    // No files changed at all — unknown (could be detached HEAD, single-
-    // commit repo, or other edge case where git diff returns nothing).
-    if (changedFiles.length === 0) return "unknown";
-
-    // Filter out .gsd/ files — only implementation files count.
-    // If every changed file is under .gsd/, the milestone produced no
-    // implementation code (#1703).
-    const implFiles = changedFiles.filter(f => !f.startsWith(".gsd/") && !f.startsWith(".gsd\\"));
-    return implFiles.length > 0 ? "present" : "absent";
+    // lifetime while running on a milestone branch.
+    const integrationBranch = milestoneId
+      ? readIntegrationBranch(basePath, milestoneId) ?? detectMainBranch(basePath)
+      : detectMainBranch(basePath);
+    const currentBranch = getCurrentBranch(basePath);
+    const branchDiff = getChangedFilesSinceBranch(basePath, integrationBranch);
+    if (!branchDiff.ok) return "unknown";
+    const changedFiles = branchDiff.files;
+
+    // No branch-diff files can mean the unit retried on main after milestone
+    // commits already landed there. In that topology, inspect GSD-tagged
+    // milestone commits instead of treating the self-diff as proof of no work.
+    if (changedFiles.length === 0) {
+      if (milestoneId && currentBranch === integrationBranch) {
+        const tagged = getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId);
+        if (!tagged.ok) return "unknown";
+        if (tagged.matched) return classifyImplementationFiles(tagged.files);
+      }
+      if (currentBranch && currentBranch !== "HEAD") return "absent";
+      return "unknown";
+    }
+
+    return classifyImplementationFiles(changedFiles);
   } catch (e) {
     // Non-fatal — if git operations fail, return unknown so callers can decide
     logWarning("recovery", `implementation artifact check failed: ${(e as Error).message}`);
@@ -107,6 +120,28 @@ export function hasImplementationArtifacts(basePath: string): "present" | "absen
   }
 }
 
+function getCurrentBranch(basePath: string): string | null {
+  try {
+    const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+      cwd: basePath,
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf-8",
+    }).trim();
+    return branch || null;
+  } catch {
+    return null;
+  }
+}
+
+function classifyImplementationFiles(files: readonly string[]): "present" | "absent" {
+  const implFiles = files.filter(isImplementationPath);
+  return implFiles.length > 0 ? "present" : "absent";
+}
+
+function isImplementationPath(file: string): boolean {
+  return !file.startsWith(".gsd/") && !file.startsWith(".gsd\\");
+}
+
 /**
  * Detect the main/master branch name.
  */
@@ -142,7 +177,7 @@ function detectMainBranch(basePath: string): string {
  * Get files changed since the branch diverged from the target branch.
  * Falls back to checking HEAD~20 if merge-base detection fails.
  */
-function getChangedFilesSinceBranch(basePath: string, targetBranch: string): string[] {
+function getChangedFilesSinceBranch(basePath: string, targetBranch: string): { ok: boolean; files: string[] } {
   try {
     // Try merge-base approach first
     const mergeBase = execFileSync(
@@ -155,7 +190,7 @@ function getChangedFilesSinceBranch(basePath: string, targetBranch: string): str
         "git", ["diff", "--name-only", mergeBase, "HEAD"],
         { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
       ).trim();
-      return result ? result.split("\n").filter(Boolean) : [];
+      return { ok: true, files: result ? result.split("\n").filter(Boolean) : [] };
     }
   } catch (err) {
     // merge-base failed — fall back
@@ -168,11 +203,94 @@ function getChangedFilesSinceBranch(basePath: string, targetBranch: string): str
       "git", ["log", "--name-only", "--pretty=format:", "-20", "HEAD"],
       { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
     ).trim();
-    return result ? [...new Set(result.split("\n").filter(Boolean))] : [];
+    return { ok: true, files: result ? [...new Set(result.split("\n").filter(Boolean))] : [] };
   } catch (e) {
     logWarning("recovery", `git log fallback failed: ${(e as Error).message}`);
-    return [];
+    return { ok: false, files: [] };
+  }
+}
+
+function getChangedFilesFromMilestoneTaggedCommits(
+  basePath: string,
+  milestoneId: string,
+): { ok: boolean; matched: boolean; files: string[] } {
+  try {
+    const logOutput = execFileSync(
+      "git",
+      ["log", "--format=%H%x1f%B%x1e", "HEAD", "--", `.gsd/milestones/${milestoneId}`],
+      { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
+    );
+    const records = logOutput
+      .split("\x1e")
+      .map((record) => record.trim())
+      .filter(Boolean)
+      .flatMap((record) => {
+        const sep = record.indexOf("\x1f");
+        if (sep === -1) return [];
+        const hash = record.slice(0, sep).trim();
+        const message = record.slice(sep + 1);
+        return [{ hash, message }];
+      });
+
+    const files = new Set<string>();
+    let matched = false;
+    for (const { hash, message } of records) {
+      if (!commitMessageHasGsdTrailer(message)) continue;
+
+      const commitFiles = getChangedFilesForCommit(basePath, hash);
+      if (!commitMatchesMilestone(message, milestoneId, commitFiles)) continue;
+
+      matched = true;
+      for (const file of commitFiles) {
+        files.add(file);
+      }
+    }
+
+    return { ok: true, matched, files: [...files] };
+  } catch (e) {
+    logWarning("recovery", `milestone-tagged commit scan failed: ${(e as Error).message}`);
+    return { ok: false, matched: false, files: [] };
+  }
+}
+
+function getChangedFilesForCommit(basePath: string, hash: string): string[] {
+  const fileOutput = execFileSync(
+    "git",
+    ["diff-tree", "--root", "--no-commit-id", "-r", "--name-only", hash],
+    { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
+  ).trim();
+  return fileOutput.split("\n").map((f) => f.trim()).filter(Boolean);
+}
+
+function commitMessageHasGsdTrailer(message: string): boolean {
+  return /^GSD-(?:Task|Unit):\s*\S+/m.test(message);
+}
+
+function commitMatchesMilestone(message: string, milestoneId: string, files: readonly string[]): boolean {
+  if (commitTrailerStartsWithMilestone(message, milestoneId)) return true;
+
+  // Meaningful execute-task commits currently store task scope as Sxx/Tyy
+  // rather than Mxx/Sxx/Tyy. Bind those commits back to the milestone only
+  // when the commit also touched this milestone's artifacts.
+  if (/^GSD-Task:\s*S[^/\s]+\/T\S+/m.test(message)) {
+    return files.some((file) => isMilestoneArtifactPath(file, milestoneId));
   }
+
+  return false;
+}
+
+function commitTrailerStartsWithMilestone(message: string, milestoneId: string): boolean {
+  const escapedMilestone = milestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const trailerPattern = new RegExp(
+    `^GSD-(?:Task|Unit):\\s*${escapedMilestone}(?:$|[\\s/])`,
+    "m",
+  );
+  return trailerPattern.test(message);
+}
+
+function isMilestoneArtifactPath(file: string, milestoneId: string): boolean {
+  return file.startsWith(`.gsd/milestones/${milestoneId}/`)
+    || file.startsWith(`.gsd\\milestones\\${milestoneId}\\`);
 }
 
 /**
@@ -491,7 +609,7 @@ export function verifyExpectedArtifact(
       if (!dbMilestone) return false;
       if (!isClosedStatus(dbMilestone.status) && summaryOutcome !== "success") return false;
     }
-    if (hasImplementationArtifacts(base) === "absent") return false;
+    if (hasImplementationArtifacts(base, mid) === "absent") return false;
   }
 
   return true;
@@ -612,6 +730,79 @@ function abortAndResetMerge(
 
 export type MergeReconcileResult = "clean" | "reconciled" | "blocked";
 
+/**
+ * Detect and abort other in-progress git operations left behind by a SIGKILL'd
+ * worker (rebase, cherry-pick, revert). Without this, a killed worker mid-rebase
+ * leaves `.git/rebase-merge/` or `.git/CHERRY_PICK_HEAD` and the worktree is
+ * wedged until the user manually runs the matching `--abort`.
+ *
+ * Called before merge-state reconciliation because these states block any
+ * subsequent merge/commit operation. (Issue #4980 HIGH-7)
+ */
+function reconcileOtherInProgressGitOps(
+  basePath: string,
+  ctx: ExtensionContext,
+): "clean" | "reconciled" | "blocked" {
+  const gitDir = join(basePath, ".git");
+  const states: Array<{
+    label: string;
+    indicators: string[];
+    abort: () => void;
+  }> = [
+    {
+      label: "rebase",
+      indicators: [join(gitDir, "rebase-merge"), join(gitDir, "rebase-apply")],
+      abort: () => nativeRebaseAbort(basePath),
+    },
+    {
+      label: "cherry-pick",
+      indicators: [join(gitDir, "CHERRY_PICK_HEAD")],
+      abort: () => {
+        // No native helper; fall back to git CLI.
+        try {
+          execFileSync("git", ["cherry-pick", "--abort"], {
+            cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+          });
+        } catch (err) { logWarning("recovery", `cherry-pick --abort failed: ${getErrorMessage(err)}`); }
+      },
+    },
+    {
+      label: "revert",
+      indicators: [join(gitDir, "REVERT_HEAD")],
+      abort: () => {
+        try {
+          execFileSync("git", ["revert", "--abort"], {
+            cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+          });
+        } catch (err) { logWarning("recovery", `revert --abort failed: ${getErrorMessage(err)}`); }
+      },
+    },
+  ];
+
+  let reconciled = false;
+  for (const s of states) {
+    const present = s.indicators.some((p) => existsSync(p));
+    if (!present) continue;
+    try {
+      s.abort();
+      ctx.ui.notify(
+        `Detected leftover ${s.label} state from prior session — aborted.`,
+        "warning",
+      );
+      reconciled = true;
+    } catch (err) {
+      logError("recovery", `${s.label} abort failed: ${getErrorMessage(err)}`);
+      ctx.ui.notify(
+        `Detected leftover ${s.label} state but auto-abort failed. ` +
+        `Run \`git ${s.label} --abort\` manually before retrying.`,
+        "error",
+      );
+      return "blocked";
+    }
+  }
+  return reconciled ? "reconciled" : "clean";
+}
+
 /**
  * Detect leftover merge state from a prior session and reconcile it.
  * If MERGE_HEAD or SQUASH_MSG exists, check whether conflicts are resolved.
@@ -622,11 +813,21 @@ export function reconcileMergeState(
   basePath: string,
   ctx: ExtensionContext,
 ): MergeReconcileResult {
+  // First, abort any rebase/cherry-pick/revert left over from a SIGKILL'd
+  // worker. Doing this before the merge-state check unblocks any merge that
+  // would otherwise refuse with "you have unfinished operation". (HIGH-7)
+  const otherOpsResult = reconcileOtherInProgressGitOps(basePath, ctx);
+  if (otherOpsResult === "blocked") return "blocked";
+
   const mergeHeadPath = join(basePath, ".git", "MERGE_HEAD");
   const squashMsgPath = join(basePath, ".git", "SQUASH_MSG");
   const hasMergeHead = existsSync(mergeHeadPath);
   const hasSquashMsg = existsSync(squashMsgPath);
-  if (!hasMergeHead && !hasSquashMsg) return "clean";
+  if (!hasMergeHead && !hasSquashMsg) {
+    // If we cleaned up another op type, return "reconciled" so the caller
+    // re-derives state from a known-good baseline.
+    return otherOpsResult === "reconciled" ? "reconciled" : "clean";
+  }
 
   const conflictedFiles = nativeConflictFiles(basePath);
   if (conflictedFiles.length === 0) {

package/src/resources/extensions/gsd/auto-start.ts

@@ -146,6 +146,35 @@ export async function openProjectDbIfPresent(basePath: string): Promise<void> {
  *
  * Returns a summary of actions taken for the caller to surface via notify.
  */
+/**
+ * Decide which survivor-branch recovery action bootstrapAutoSession must
+ * run for the current (hasSurvivorBranch, phase) combination. Extracted
+ * from the inline chain at `bootstrapAutoSession` (around line 604) so
+ * the decision table is testable without constructing a full session.
+ *
+ * - `none`     — no survivor, or phase doesn't call for recovery. Fall
+ *                through to normal bootstrap flow.
+ * - `discuss`  — survivor + phase=needs-discussion (#1726). Route to
+ *                showSmartEntry.
+ * - `finalize` — survivor + phase=complete (#2358). Run mergeAndExit to
+ *                merge the milestone branch and clear the worktree.
+ *
+ * Any other phase with a survivor (pre-planning, planning, executing…)
+ * returns `none` — the caller continues its normal flow and the
+ * survivor branch participates in whatever auto-mode happens next.
+ */
+export type SurvivorAction = "none" | "discuss" | "finalize";
+
+export function decideSurvivorAction(
+  hasSurvivorBranch: boolean,
+  phase: string | null | undefined,
+): SurvivorAction {
+  if (!hasSurvivorBranch) return "none";
+  if (phase === "needs-discussion") return "discuss";
+  if (phase === "complete") return "finalize";
+  return "none";
+}
+
 export function auditOrphanedMilestoneBranches(
   basePath: string,
   isolationMode: "worktree" | "branch" | "none",
@@ -575,7 +604,7 @@ export async function bootstrapAutoSession(
     // The worktree/branch was created but the milestone only has CONTEXT-DRAFT.md.
     // Route to the interactive discussion handler instead of falling through to
     // auto-mode, which would immediately stop with "needs discussion".
-    if (hasSurvivorBranch && state.phase === "needs-discussion") {
+    if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "discuss") {
       const { showSmartEntry } = await import("./guided-flow.js");
       await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
 
@@ -601,7 +630,9 @@ export async function bootstrapAutoSession(
     // The milestone artifacts were written but finalization (merge, worktree
     // cleanup) never ran. Run mergeAndExit to finalize, then re-derive state
     // so the normal "all milestones complete" or "next milestone" path runs.
-    if (hasSurvivorBranch && state.phase === "complete") {
+    // Re-evaluate via the helper — the discuss branch above may have cleared
+    // hasSurvivorBranch after a successful promotion.
+    if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
       const mid = state.activeMilestone!.id;
       ctx.ui.notify(
         `Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`,
@@ -971,17 +1002,34 @@ export async function bootstrapAutoSession(
       );
     }
 
-    // Self-heal: remove stale .git/index.lock
+    // Self-heal: remove stale .git/index.lock.
+    //
+    // Threshold raised from 60s → 5min because a 60s-old lock is not
+    // definitively stale: `git gc --auto` triggered by a heavy commit, NFS
+    // delays, or concurrent worktree writes can hold .git/index.lock for
+    // minutes on large repos. Force-removing a live lock causes the holder
+    // to encounter `fatal: Unable to create '.git/index.lock'` on its next
+    // write, or worse, operate on a partially-written index → corruption
+    // requiring `git fsck`/`git reset` to recover.
+    // (Issue #4980 CRIT-3)
     try {
       const gitLockFile = join(base, ".git", "index.lock");
       if (existsSync(gitLockFile)) {
         const lockAge = Date.now() - statSync(gitLockFile).mtimeMs;
-        if (lockAge > 60_000) {
+        const STALE_GIT_LOCK_THRESHOLD_MS = 5 * 60_000;
+        if (lockAge > STALE_GIT_LOCK_THRESHOLD_MS) {
           unlinkSync(gitLockFile);
           ctx.ui.notify(
-            "Removed stale .git/index.lock from prior crash.",
-            "info",
+            `Removed stale .git/index.lock (age ${Math.round(lockAge / 1000)}s, > 5min threshold).`,
+            "warning",
           );
+        } else {
+          // Lock present but not yet stale — surface so the user knows why
+          // git ops may be queueing instead of silently waiting.
+          debugLog("git-lock-present-not-stale", {
+            ageMs: lockAge,
+            thresholdMs: STALE_GIT_LOCK_THRESHOLD_MS,
+          });
         }
       }
     } catch (e) {

package/src/resources/extensions/gsd/auto-tool-tracking.ts

@@ -87,20 +87,21 @@ export function clearInFlightTools(): void {
 // ─── Tool invocation error classification (#2883) ────────────────────────
 
 /**
- * Patterns that indicate a tool invocation failed due to malformed or truncated
- * JSON arguments — as opposed to a normal business-logic error from the tool
- * handler. When these errors occur, retrying the same unit will produce the same
- * failure, so the retry loop must be broken.
+ * Patterns that indicate a tool invocation failed deterministically before
+ * useful work could be completed — as opposed to a normal business-logic error
+ * from the tool handler. When these errors occur, retrying the same unit will
+ * produce the same failure, so the retry loop must be broken.
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON/i;
+const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
 
 /**
- * Returns true if the error message indicates a tool invocation failure due to
- * malformed/truncated arguments (as opposed to a normal tool execution error).
+ * Returns true if the error message indicates a deterministic invocation or
+ * policy failure (as opposed to a normal tool execution error).
  */
 export function isToolInvocationError(errorMsg: string): boolean {
   if (!errorMsg) return false;
-  return TOOL_INVOCATION_ERROR_RE.test(errorMsg);
+  return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
 
 /**
@@ -112,3 +113,46 @@ export function isQueuedUserMessageSkip(errorMsg: string): boolean {
   if (!errorMsg) return false;
   return /^Skipped due to queued user message\.?$/i.test(errorMsg.trim());
 }
+
+// ─── Deterministic policy error classification (#4973, #4974) ──────────────
+
+/**
+ * Known deterministic policy error substrings. Each entry is a stable string
+ * that will appear in the tool error text content when the corresponding
+ * policy gate fires. Retrying these errors will always produce the same outcome.
+ *
+ * Add new entries here as new deterministic gates are introduced. Do NOT use
+ * regex — explicit substrings keep the list auditable.
+ */
+export const DETERMINISTIC_POLICY_ERROR_STRINGS = [
+  // gsd_summary_save write-gate: CONTEXT artifact blocked pending depth verification (#4973).
+  // Matches the fallback text in workflow-tool-executors.ts and the verbose reason
+  // from shouldBlockContextArtifactSaveInSnapshot at write-gate.ts:432-442.
+  "context write blocked",
+  "CONTEXT without depth verification",
+  // Raw write tool gate (#4973): shouldBlockContextWrite at write-gate.ts:390-399 emits
+  // "Cannot write to milestone CONTEXT.md without depth verification." for direct
+  // write tool calls to *-CONTEXT.md paths (different code path than gsd_summary_save).
+  "CONTEXT.md without depth verification",
+] as const;
+
+/**
+ * Returns true if the error message indicates a deterministic policy gate
+ * blocked the tool call before execution. Retrying the same unit without
+ * changing behavior will hit the same gate, so auto-mode should pause instead
+ * of re-dispatching.
+ *
+ * Combines the regex-based gate set from #4974 (HARD BLOCK / queue planning /
+ * STATE.md / mechanical gate) and the substring-based set from #4973 (context
+ * write block / CONTEXT depth verification). Both branches landed on main
+ * independently and their parallel `isDeterministicPolicyError` declarations
+ * were not deduplicated at merge — this consolidated form preserves both
+ * matchers under a single export.
+ */
+export function isDeterministicPolicyError(errorMsg: string): boolean {
+  if (!errorMsg) return false;
+  return (
+    DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg) ||
+    DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s))
+  );
+}