gsd-pi 2.77.0-dev.58d3d4d6c → 2.77.0-dev.cfd69e714

package/dist/resources/extensions/gsd/component-types.js

@@ -0,0 +1,69 @@
+/**
+ * Unified Component Type Definitions
+ *
+ * Shared metadata for installable/discoverable skills and agents.
+ *
+ * Replaces the separate type systems in:
+ * - packages/pi-coding-agent/src/core/skills.ts (SkillFrontmatter, Skill)
+ * - src/resources/extensions/subagent/agents.ts (AgentConfig)
+ *
+ * Legacy skill and agent formats are supported via backward-compatible loading.
+ */
+// ============================================================================
+// Validation
+// ============================================================================
+/** Max name length per spec */
+export const MAX_NAME_LENGTH = 64;
+/** Max description length per spec */
+export const MAX_DESCRIPTION_LENGTH = 1024;
+/** Valid name pattern: lowercase a-z, 0-9, hyphens, no leading/trailing/consecutive hyphens */
+export const NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+/**
+ * Validate a component name.
+ * @returns Array of error messages (empty if valid).
+ */
+export function validateComponentName(name) {
+    const errors = [];
+    if (!name || name.trim() === '') {
+        errors.push('name is required');
+        return errors;
+    }
+    if (name.length > MAX_NAME_LENGTH) {
+        errors.push(`name exceeds ${MAX_NAME_LENGTH} characters (${name.length})`);
+    }
+    if (name.includes('--')) {
+        errors.push('name must not contain consecutive hyphens');
+    }
+    if (!NAME_PATTERN.test(name)) {
+        if (/[A-Z]/.test(name)) {
+            errors.push('name must be lowercase');
+        }
+        else if (name.startsWith('-') || name.endsWith('-')) {
+            errors.push('name must not start or end with a hyphen');
+        }
+        else if (!name.includes('--')) {
+            errors.push('name must contain only lowercase a-z, 0-9, and hyphens');
+        }
+    }
+    return errors;
+}
+/**
+ * Validate a component description.
+ * @returns Array of error messages (empty if valid).
+ */
+export function validateComponentDescription(description) {
+    const errors = [];
+    if (!description || description.trim() === '') {
+        errors.push('description is required');
+    }
+    else if (description.length > MAX_DESCRIPTION_LENGTH) {
+        errors.push(`description exceeds ${MAX_DESCRIPTION_LENGTH} characters (${description.length})`);
+    }
+    return errors;
+}
+/**
+ * Compute the canonical ID for a component.
+ */
+export function computeComponentId(name, namespace) {
+    return namespace ? `${namespace}:${name}` : name;
+}

package/dist/resources/extensions/gsd/detection.js

@@ -6,7 +6,7 @@
  * flow to show when entering a project directory.
  */
 import { existsSync, openSync, readSync, closeSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join, parse as parsePath } from "node:path";
 import { homedir } from "node:os";
 import { gsdRoot } from "./paths.js";
 const gsdHome = process.env.GSD_HOME || join(homedir(), ".gsd");
@@ -951,6 +951,54 @@ function resolveVersionCatalogAccessors(basePath, versionCatalogFiles, settingsF
     }
     return accessors;
 }
+/**
+ * Walk ancestor directories of `startDir` looking for any file in
+ * `PROJECT_FILES`. Stops at the filesystem root or at a `.git` boundary
+ * (so ancestors above a git repo root — e.g. `$HOME` or `/usr/local` —
+ * can't trigger false positives). Returns true if an ancestor contains
+ * one of the project markers.
+ *
+ * Used by the worktree health check (#2347) to avoid warning about
+ * monorepos where package.json / Cargo.toml / etc. live in a parent
+ * directory rather than in the worktree's own checkout.
+ *
+ * `existsFn` is injectable so this remains deterministically testable
+ * without touching the real filesystem; defaults to `fs.existsSync`.
+ */
+export function hasProjectFileInAncestor(startDir, existsFn = existsSync) {
+    let checkDir = dirname(startDir);
+    const { root } = parsePath(checkDir);
+    while (checkDir !== root) {
+        if (PROJECT_FILES.some((f) => existsFn(join(checkDir, f)))) {
+            return true;
+        }
+        // Stop at git repository boundary — ancestors above the repo root
+        // may contain unrelated project files. Check AFTER project-file scan
+        // so a repo root containing both .git and a marker is still recognized.
+        if (existsFn(join(checkDir, ".git")))
+            return false;
+        checkDir = dirname(checkDir);
+    }
+    return false;
+}
+/**
+ * Check whether a project's `.gsd/` directory contains the bootstrap artifacts
+ * (`PREFERENCES.md` or `milestones/`) that indicate a completed init run.
+ *
+ * A zombie `.gsd/` state — symlink exists but neither artifact is present —
+ * must be treated as "needs init wizard". The previous guard checked only
+ * `existsSync(gsdRoot(basePath))`, which accepted zombie states and skipped
+ * the wizard (#2942).
+ *
+ * `existsFn` is injectable so tests can run deterministically; defaults to
+ * `fs.existsSync`.
+ */
+export function hasGsdBootstrapArtifacts(gsdPath, existsFn = existsSync) {
+    return (existsFn(gsdPath) &&
+        (existsFn(join(gsdPath, "PREFERENCES.md")) ||
+            existsFn(join(gsdPath, "preferences.md")) ||
+            existsFn(join(gsdPath, "milestones"))));
+}
 export function scanProjectFiles(basePath) {
     const files = [];
     const queue = [{ path: basePath, depth: 0 }];

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -159,7 +159,7 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
 
 - `phases`: fine-grained control over which phases run. Usually set by `token_profile`, but can be overridden. Keys:
   - `skip_research`: boolean — skip milestone-level research. Default: `false`.
-  - `reassess_after_slice`: boolean — run roadmap reassessment after each completed slice. Default: `true`.
+  - `reassess_after_slice`: boolean — run a dedicated roadmap-reassessment unit after each completed slice. Default: `false` (per ADR-003 §4). The plan-slice agent for the next slice performs JIT reassessment via a prompt preamble at zero additional token cost; a dedicated reassess session is opt-in. Set to `true` (e.g. via the `burn-max` profile) if you want the explicit session.
   - `skip_reassess`: boolean — force-disable roadmap reassessment even if `reassess_after_slice` is enabled. Default: `false`.
   - `skip_slice_research`: boolean — skip per-slice research. Default: `false`.
 

package/dist/resources/extensions/gsd/gate-registry.js

@@ -37,9 +37,9 @@ export const GATE_REGISTRY = {
         id: "Q4",
         scope: "slice",
         ownerTurn: "gate-evaluate",
-        question: "What existing promises does this break?",
+        question: "Which existing requirements (R-IDs) does this slice touch, and which must be re-tested?",
         guidance: [
-            "List which existing requirements (R001, R003, etc.) are touched by this slice.",
+            "List the R-IDs (e.g. R001, R003) touched by this slice; see the milestone requirements artifact at .gsd/milestones/<id>/REQUIREMENTS.md.",
             "Identify what must be re-tested after shipping.",
             "Flag decisions that should be revisited given the new scope.",
             "If no existing requirements are affected, return verdict 'omitted'.",

package/dist/resources/extensions/gsd/git-constants.js

@@ -1,9 +1,36 @@
 /**
  * Shared git constants used across git-service and native-git-bridge.
  */
+/**
+ * Parent process env vars that, if leaked into a git child process, can
+ * silently redirect every operation to a different repo or index.
+ *
+ * Stripped from GIT_NO_PROMPT_ENV so a GSD invoked from inside a git hook,
+ * a different worktree's terminal, or any context that pre-set these vars
+ * cannot redirect GSD's git operations to the wrong target.
+ * (Issue #4980 NEW-1)
+ */
+const LEAKING_GIT_ENV_VARS = [
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_COMMON_DIR",
+    "GIT_NAMESPACE",
+];
+function buildSafeParentEnv() {
+    const safe = {};
+    for (const [k, v] of Object.entries(process.env)) {
+        if (!LEAKING_GIT_ENV_VARS.includes(k)) {
+            safe[k] = v;
+        }
+    }
+    return safe;
+}
 /** Env overlay that suppresses interactive git credential prompts and git-svn noise. */
 export const GIT_NO_PROMPT_ENV = {
-    ...process.env,
+    ...buildSafeParentEnv(),
     GIT_TERMINAL_PROMPT: "0",
     GIT_ASKPASS: "",
     GIT_SVN_ID: "",

package/dist/resources/extensions/gsd/git-self-heal.js

@@ -9,12 +9,25 @@
  * what actions were taken. `formatGitError` maps raw git errors to
  * user-friendly messages suggesting `/gsd doctor`.
  */
+import { execFileSync } from "node:child_process";
 import { existsSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { MergeConflictError } from "./git-service.js";
 import { nativeMergeAbort, nativeRebaseAbort, nativeResetHard } from "./native-git-bridge.js";
 // Re-export for consumers
 export { MergeConflictError };
+function hasWorkingTreeChanges(cwd) {
+    try {
+        return execFileSync("git", ["status", "--porcelain"], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        }).trim().length > 0;
+    }
+    catch {
+        return true;
+    }
+}
 /**
  * Detect and clean up leftover merge/rebase state, then hard-reset.
  *
@@ -60,6 +73,20 @@ export function abortAndReset(cwd) {
             cleaned.push("rebase abort attempted (may have failed)");
         }
     }
+    // Preserve any staged or untracked user work before the hard reset.
+    // Reset --hard discards staged changes (reflog only covers committed
+    // state), so a labeled stash gives the user a recovery handle if their
+    // in-flight inspection work would otherwise be silently lost.
+    // (Issue #4980 HIGH-5)
+    if (hasWorkingTreeChanges(cwd)) {
+        try {
+            execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd: pre-self-heal-reset ${new Date().toISOString()}`], { cwd, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
+            cleaned.push("stashed working tree before reset");
+        }
+        catch {
+            /* nothing to stash, or stash refused (e.g. unresolved conflicts) — proceed */
+        }
+    }
     // Always hard-reset to HEAD
     try {
         nativeResetHard(cwd);

package/dist/resources/extensions/gsd/git-service.js

@@ -7,7 +7,7 @@
  * This module centralizes the GitPreferences interface, runtime exclusion
  * paths, commit type inference, and the runGit shell helper.
  */
-import { execFileSync, execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { gsdRoot } from "./paths.js";
@@ -243,6 +243,107 @@ export function resolveMilestoneIntegrationBranch(basePath, milestoneId, prefs =
         reason: `Recorded integration branch "${recordedBranch}" for milestone ${milestoneId} no longer exists, and no safe fallback branch could be determined.`,
     };
 }
+// ─── Pre-Merge Command Tokenizer ──────────────────────────────────────────
+/**
+ * Tokenize a user-supplied pre-merge command string into argv form, with
+ * minimal support for double- and single-quoted strings. Designed to be
+ * sufficient for typical commands ("npm test", `npm run lint:ci`,
+ * `pnpm run tsc --noEmit`) without spawning a shell.
+ *
+ * Returns [] when the input is empty or whitespace-only.
+ * Throws when quoting is malformed.
+ *
+ * Used by GitServiceImpl.runPreMergeCheck to eliminate the shell-injection
+ * surface that running an arbitrary user string through a shell would create.
+ * (Issue #4980 HIGH-2)
+ */
+export function tokenizePreMergeCommand(input) {
+    const tokens = [];
+    let current = "";
+    let i = 0;
+    let quote = "";
+    let hasContent = false;
+    while (i < input.length) {
+        const ch = input[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = "";
+            }
+            else if (ch === "\\" && quote === '"' && i + 1 < input.length) {
+                current += input[i + 1];
+                i += 2;
+                continue;
+            }
+            else {
+                current += ch;
+            }
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            hasContent = true;
+            i++;
+            continue;
+        }
+        if (ch === " " || ch === "\t") {
+            if (hasContent) {
+                tokens.push(current);
+                current = "";
+                hasContent = false;
+            }
+            i++;
+            continue;
+        }
+        if (ch === "\\" && i + 1 < input.length) {
+            current += input[i + 1];
+            i += 2;
+            hasContent = true;
+            continue;
+        }
+        current += ch;
+        hasContent = true;
+        i++;
+    }
+    if (quote) {
+        throw new Error(`Unterminated ${quote === '"' ? "double" : "single"} quote in pre-merge command`);
+    }
+    if (hasContent)
+        tokens.push(current);
+    return tokens;
+}
+function containsUnquotedShellControl(input) {
+    let i = 0;
+    let quote = "";
+    while (i < input.length) {
+        const ch = input[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = "";
+            }
+            else if (ch === "\\" && quote === '"' && i + 1 < input.length) {
+                i += 2;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            i++;
+            continue;
+        }
+        if (ch === "\\" && i + 1 < input.length) {
+            i += 2;
+            continue;
+        }
+        if (ch === ";" || ch === "&" || ch === "|" || ch === "`" || ch === "$" || ch === "<" || ch === ">") {
+            return true;
+        }
+        i++;
+    }
+    return false;
+}
 // ─── Git Helper ────────────────────────────────────────────────────────────
 /**
  * Strip git-svn noise from error messages.
@@ -601,8 +702,31 @@ export class GitServiceImpl {
                 return { passed: true, skipped: true };
             }
         }
+        // Tokenize and run via execFileSync (no shell). Shell metacharacters in
+        // user-supplied prefs.pre_merge_check would otherwise be interpreted as
+        // chaining/redirection (e.g. `;`, `&&`, `|`, backticks) — a privesc
+        // surface in repos with a checked-in `.gsd/PREFERENCES.md`.
+        // (Issue #4980 HIGH-2)
+        if (containsUnquotedShellControl(command)) {
+            return {
+                passed: false,
+                skipped: false,
+                command,
+                error: "pre_merge_check contains shell metacharacters (;, &&, |, $, backticks, redirects). " +
+                    "Put complex commands in a script file (e.g. './scripts/pre-merge.sh') and reference the script path instead.",
+            };
+        }
+        const tokens = tokenizePreMergeCommand(command);
+        if (tokens.length === 0) {
+            return { passed: true, skipped: true };
+        }
         try {
-            execSync(command, { cwd: this.basePath, stdio: "pipe", encoding: "utf-8" });
+            execFileSync(tokens[0], tokens.slice(1), {
+                cwd: this.basePath,
+                stdio: "pipe",
+                encoding: "utf-8",
+                env: GIT_NO_PROMPT_ENV,
+            });
             return { passed: true, skipped: false, command };
         }
         catch (err) {

package/dist/resources/extensions/gsd/gsd-db.js

@@ -135,7 +135,7 @@ function openRawDb(path) {
     const Database = providerModule;
     return new Database(path);
 }
-const SCHEMA_VERSION = 22;
+export const SCHEMA_VERSION = 22;
 function indexExists(db, name) {
     return !!db.prepare("SELECT 1 as present FROM sqlite_master WHERE type = 'index' AND name = ?").get(name);
 }
@@ -2556,6 +2556,9 @@ export function insertReplanHistory(entry) {
 export function insertAssessment(entry) {
     if (!currentDb)
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+    // Idempotent: PRIMARY KEY is `path`, which is deterministic given (milestone_id, scope) per
+    // the artifact-path resolver. Retrying the same reassess-roadmap silently overwrites the row
+    // instead of accumulating duplicates.
     currentDb.prepare(`INSERT OR REPLACE INTO assessments (path, milestone_id, slice_id, task_id, status, scope, full_content, created_at)
      VALUES (:path, :milestone_id, :slice_id, :task_id, :status, :scope, :full_content, :created_at)`).run({
         ":path": entry.path,
@@ -2655,7 +2658,7 @@ function rowToGate(row) {
         scope: row["scope"],
         task_id: row["task_id"] ?? "",
         status: row["status"],
-        verdict: row["verdict"] || "",
+        verdict: row["status"] === "pending" ? null : row["verdict"],
         rationale: row["rationale"] || "",
         findings: row["findings"] || "",
         evaluated_at: row["evaluated_at"] ?? null,
@@ -2739,7 +2742,7 @@ export function getGateResults(milestoneId, sliceId, scope) {
 export function markAllGatesOmitted(milestoneId, sliceId) {
     if (!currentDb)
         return;
-    currentDb.prepare(`UPDATE quality_gates SET status = 'omitted', verdict = 'omitted', evaluated_at = :now
+    currentDb.prepare(`UPDATE quality_gates SET status = 'complete', verdict = 'omitted', evaluated_at = :now
      WHERE milestone_id = :mid AND slice_id = :sid AND status = 'pending'`).run({
         ":mid": milestoneId,
         ":sid": sliceId,

package/dist/resources/extensions/gsd/guided-flow.js

@@ -28,7 +28,7 @@ import { ensureGitignore, ensurePreferences, untrackRuntimeFiles } from "./gitig
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { ensurePlanV2Graph, isMissingFinalizedContextResult } from "./uok/plan-v2.js";
-import { detectProjectState } from "./detection.js";
+import { detectProjectState, hasGsdBootstrapArtifacts } from "./detection.js";
 import { showProjectInit, offerMigration } from "./init-wizard.js";
 import { validateDirectory } from "./validate-directory.js";
 import { showConfirm } from "../shared/tui.js";
@@ -258,6 +258,18 @@ function extractAssistantText(msg) {
 }
 /**
  * Return true if the assistant message contains any tool-use block.
+ *
+ * The canonical pi-ai `AssistantMessage.content` (see packages/pi-ai/src/types.ts)
+ * uses `type: "toolCall"` and `type: "serverToolUse"` for tool invocations —
+ * every provider (anthropic-direct, claude-code-cli, openai, etc.) normalizes
+ * incoming tool blocks into these two shapes before they reach guided-flow.
+ *
+ * The Anthropic API wire shape `"tool_use"` / `"server_tool_use"` does NOT appear
+ * in the internal AssistantMessage — those literals are only used when sending
+ * messages back out to the Anthropic API. Matching them here was a latent bug:
+ * `hasToolUse` returned `false` for every real tool call, which let the
+ * empty-turn nudge fire and pre-empt MCP tools that block on the user
+ * (e.g. `ask_user_questions`). See investigation in PR for #4658.
  */
 function hasToolUse(msg) {
     if (!msg)
@@ -265,7 +277,9 @@ function hasToolUse(msg) {
     const content = msg.content;
     if (!Array.isArray(content))
         return false;
-    return content.some((b) => b && typeof b === "object" && (b.type === "tool_use" || b.type === "tool-use"));
+    return content.some((b) => b &&
+        typeof b === "object" &&
+        (b.type === "toolCall" || b.type === "serverToolUse"));
 }
 /**
  * #4573 — Detect and recover from the "ready phrase without files" failure mode.
@@ -1244,9 +1258,7 @@ export async function showSmartEntry(ctx, pi, basePath, options) {
     // A zombie .gsd/ state (symlink exists but missing PREFERENCES.md and
     // milestones/) must trigger the init wizard, not skip it (#2942).
     const gsdPath = gsdRoot(basePath);
-    const hasBootstrapArtifacts = existsSync(gsdPath)
-        && (existsSync(join(gsdPath, "PREFERENCES.md"))
-            || existsSync(join(gsdPath, "milestones")));
+    const hasBootstrapArtifacts = hasGsdBootstrapArtifacts(gsdPath);
     if (!hasBootstrapArtifacts) {
         const detection = detectProjectState(basePath);
         // v1 .planning/ detected — offer migration before anything else

package/dist/resources/extensions/gsd/memory-extractor.js

@@ -62,7 +62,9 @@ export function buildMemoryLLMCall(ctx) {
         // which returns undefined for OAuth users (Claude Max / Claude Pro).
         // See: https://github.com/gsd-build/gsd-2/issues/2959
         const resolvedKeyPromise = ctx.modelRegistry.getApiKey(selectedModel).catch(() => undefined);
-        return async (system, user) => {
+        // Expose on the returned fn so tests can await resolution deterministically
+        // (avoids arbitrary setTimeout polling for an internal microtask).
+        const llmCall = async (system, user) => {
             const { completeSimple } = await import('@gsd/pi-ai');
             const resolvedApiKey = await resolvedKeyPromise;
             const result = await completeSimple(selectedModel, {
@@ -79,6 +81,10 @@ export function buildMemoryLLMCall(ctx) {
                 .map(c => c.text);
             return textParts.join('');
         };
+        // Attach the in-flight API-key resolution so tests (and callers) can
+        // `await llmCall.apiKeyReady` rather than relying on setTimeout polling.
+        llmCall.apiKeyReady = resolvedKeyPromise;
+        return llmCall;
     }
     catch {
         return null;