gsd-pi 2.77.0-dev.eaa4973bc → 2.78.0-dev.aeeb2ca00

package/src/resources/extensions/github-sync/templates.ts

@@ -181,3 +181,154 @@ export function formatSummaryComment(data: SummaryData): string {
 
   return lines.join("\n");
 }
+
+// ─── Swarm Delivery Routines ───────────────────────────────────────────────
+
+export type SwarmLaneId = "workflow" | "state" | "writer" | "uok" | "github";
+
+export interface SwarmLaneData {
+  id: SwarmLaneId;
+  branch: string;
+  owner?: string;
+  latestCommit?: string;
+  summary?: string;
+  changedContracts?: string[];
+  testEvidence?: string[];
+  blockers?: string[];
+}
+
+export interface SwarmLanePRData {
+  lane: SwarmLaneData;
+  impactArea: string;
+  transitionRisks: string[];
+  rollbackPlan: string[];
+  linkedIssue?: number;
+}
+
+export interface SwarmReleaseChecklistData {
+  integrationBranch: string;
+  lanes: SwarmLaneData[];
+  parityReport?: string;
+  rollbackDrill?: string;
+  requiredChecks?: string[];
+  openRisks?: string[];
+}
+
+export const SWARM_LANE_LABELS: Record<SwarmLaneId, string> = {
+  workflow: "lane/workflow",
+  state: "lane/state",
+  writer: "lane/writer",
+  uok: "lane/uok",
+  github: "lane/github",
+};
+
+function checkedList(items: string[] | undefined, emptyLabel: string): string[] {
+  if (!items?.length) return [`- [ ] ${emptyLabel}`];
+  return items.map((item) => `- [ ] ${item}`);
+}
+
+export function formatSwarmLanePRBody(data: SwarmLanePRData): string {
+  const lines: string[] = [];
+  const laneLabel = SWARM_LANE_LABELS[data.lane.id];
+
+  lines.push("## Swarm lane");
+  lines.push("");
+  lines.push(`**Lane:** \`${laneLabel}\``);
+  lines.push(`**Branch:** \`${data.lane.branch}\``);
+  if (data.lane.owner) lines.push(`**Owner:** ${data.lane.owner}`);
+  if (data.lane.latestCommit) lines.push(`**Latest commit:** \`${data.lane.latestCommit}\``);
+  lines.push("");
+
+  lines.push("## Impact area");
+  lines.push("");
+  lines.push(data.impactArea);
+  lines.push("");
+
+  lines.push("## Changed contracts");
+  lines.push(...checkedList(data.lane.changedContracts, "No shared contracts changed"));
+  lines.push("");
+
+  lines.push("## Transition risks");
+  lines.push(...checkedList(data.transitionRisks, "No transition risks identified"));
+  lines.push("");
+
+  lines.push("## Rollback plan");
+  lines.push(...checkedList(data.rollbackPlan, "Revert this lane PR"));
+  lines.push("");
+
+  lines.push("## Test evidence");
+  lines.push(...checkedList(data.lane.testEvidence, "Test evidence pending"));
+  lines.push("");
+
+  if (data.lane.blockers?.length) {
+    lines.push("## Blockers");
+    for (const blocker of data.lane.blockers) lines.push(`- ${blocker}`);
+    lines.push("");
+  }
+
+  if (data.linkedIssue) {
+    lines.push(`Closes #${data.linkedIssue}`);
+    lines.push("");
+  }
+
+  lines.push("---");
+  lines.push("*Auto-generated by GSD GitHub Sync swarm routines*");
+
+  return lines.join("\n");
+}
+
+export function formatSwarmReleaseChecklistBody(data: SwarmReleaseChecklistData): string {
+  const lines: string[] = [];
+
+  lines.push(`# UOK Swarm Release Checklist`);
+  lines.push("");
+  lines.push(`**Integration branch:** \`${data.integrationBranch}\``);
+  lines.push("");
+
+  lines.push("## Lane summary");
+  lines.push("");
+  lines.push("| Lane | Branch | Owner | Commit | Status |");
+  lines.push("|------|--------|-------|--------|--------|");
+  for (const lane of data.lanes) {
+    const owner = lane.owner ?? "";
+    const commit = lane.latestCommit ? `\`${lane.latestCommit}\`` : "";
+    const status = lane.blockers?.length ? "blocked" : "ready";
+    lines.push(`| \`${SWARM_LANE_LABELS[lane.id]}\` | \`${lane.branch}\` | ${owner} | ${commit} | ${status} |`);
+  }
+  lines.push("");
+
+  lines.push("## Required evidence");
+  lines.push("- [ ] Changed contracts summarized");
+  lines.push("- [ ] Transition matrix diff attached or linked");
+  lines.push("- [ ] Writer sequence proof attached or linked");
+  lines.push("- [ ] UOK parity report attached or linked");
+  lines.push("- [ ] Rollback drill evidence attached or linked");
+  lines.push("");
+
+  if (data.requiredChecks?.length) {
+    lines.push("## Required checks");
+    for (const check of data.requiredChecks) lines.push(`- [ ] ${check}`);
+    lines.push("");
+  }
+
+  lines.push("## Parity report");
+  lines.push(data.parityReport ?? "Pending.");
+  lines.push("");
+
+  lines.push("## Rollback drill");
+  lines.push(data.rollbackDrill ?? "Pending.");
+  lines.push("");
+
+  lines.push("## Open risks");
+  if (data.openRisks?.length) {
+    for (const risk of data.openRisks) lines.push(`- ${risk}`);
+  } else {
+    lines.push("None.");
+  }
+  lines.push("");
+
+  lines.push("---");
+  lines.push("*Auto-generated by GSD GitHub Sync swarm routines*");
+
+  return lines.join("\n");
+}

package/src/resources/extensions/github-sync/tests/cli.test.ts

@@ -1,20 +1,89 @@
-import test, { describe, it, beforeEach } from "node:test";
+import { describe, it, beforeEach, afterEach } from "node:test";
 import assert from "node:assert/strict";
 import { ghIsAvailable, _resetGhCache } from "../cli.ts";
 
-describe("cli", () => {
+describe("github-sync/cli.ghIsAvailable", () => {
+  let originalPath: string | undefined;
+
   beforeEach(() => {
     _resetGhCache();
+    originalPath = process.env.PATH;
+  });
+
+  afterEach(() => {
+    if (originalPath !== undefined) {
+      process.env.PATH = originalPath;
+    } else {
+      delete process.env.PATH;
+    }
+    _resetGhCache();
   });
 
-  it("ghIsAvailable returns boolean", () => {
-    const result = ghIsAvailable();
-    assert.equal(typeof result, "boolean");
+  it("returns true when gh is on PATH, false otherwise", () => {
+    // Force gh to be unavailable by setting PATH to an empty-ish string
+    // that contains no gh. This is more robust than asserting a raw
+    // `typeof === 'boolean'` (which the previous test did — a tautology,
+    // since the function's TypeScript signature already guarantees it).
+    process.env.PATH = "/nonexistent-path-for-test";
+    assert.equal(
+      ghIsAvailable(),
+      false,
+      "with gh not on PATH, ghIsAvailable must return false",
+    );
   });
 
-  it("ghIsAvailable caches result", () => {
+  it("caches the availability result — PATH changes after first call are ignored", () => {
+    // With the original PATH, gh may or may not be present (depends on
+    // the dev machine / CI runner). Either way, capture the first
+    // result, then mutate PATH so a fresh subprocess spawn would yield
+    // a different result. If the function is genuinely caching, the
+    // second call returns the same value despite the PATH change.
+
+    // Prime the cache with whatever the current PATH says.
     const first = ghIsAvailable();
+
+    // Change PATH so the `gh` binary is no longer findable — any
+    // subsequent subprocess spawn would yield false.
+    process.env.PATH = "/nonexistent-path-for-test";
+
     const second = ghIsAvailable();
-    assert.equal(first, second);
+
+    assert.equal(
+      second,
+      first,
+      "cached result must not change when PATH changes after the first call. " +
+        "Without caching, mutating PATH away from gh would flip the result.",
+    );
+  });
+
+  it("re-evaluates after _resetGhCache — cache is the thing being tested", () => {
+    // This locks in that `_resetGhCache` actually clears the cache:
+    // with it absent, the second assertion wouldn't observe the PATH change.
+    process.env.PATH = "/nonexistent-path-for-test";
+    const beforeReset = ghIsAvailable(); // false — gh not on PATH
+    assert.equal(beforeReset, false);
+
+    _resetGhCache();
+    // Restore PATH so that if a real gh is available, the cached
+    // "false" from before-reset must not persist.
+    if (originalPath !== undefined) {
+      process.env.PATH = originalPath;
+    }
+
+    // After reset, another call re-probes. We don't know whether the
+    // real machine has gh, but we know the re-probe happened because
+    // before-reset with an empty PATH was false AND if the machine
+    // has gh, the post-reset result would be true (i.e. different).
+    const afterReset = ghIsAvailable();
+    // Invariant: either the dev machine has gh (afterReset=true, differs
+    // from beforeReset) or it doesn't (afterReset=false, unchanged).
+    // Both are fine — what matters is that _resetGhCache cleared the
+    // memoized value so the re-probe ran. That's observable by the
+    // fact that with gh present, afterReset=true even though the
+    // cached pre-reset value was false.
+    assert.ok(
+      typeof afterReset === "boolean",
+      "re-probe must return a boolean",
+    );
   });
 });

package/src/resources/extensions/github-sync/tests/templates.test.ts

@@ -5,6 +5,9 @@ import {
   formatSlicePRBody,
   formatTaskIssueBody,
   formatSummaryComment,
+  formatSwarmLanePRBody,
+  formatSwarmReleaseChecklistBody,
+  SWARM_LANE_LABELS,
 } from "../templates.ts";
 
 describe("templates", () => {
@@ -102,9 +105,97 @@ describe("templates", () => {
       assert.ok(comment.includes("duration:"));
     });
 
-    it("handles empty data gracefully", () => {
+    it("handles empty data gracefully — no debug-artifact output", () => {
+      // Previous version only asserted `typeof === 'string'`, which the
+      // function signature already guarantees (tautology).
+      //
+      // The real invariant is: empty input must produce a string that
+      // is safe to post (or skip) without leaking a debug-stringified
+      // object. An empty string IS allowed here — callers are expected
+      // to gate on truthiness before posting ("skip if empty"). What
+      // must NOT happen is leaking 'undefined', '[object Object]',
+      // 'null', or a template-placeholder tell like '{{' / '}}'.
       const comment = formatSummaryComment({});
       assert.equal(typeof comment, "string");
+      assert.doesNotMatch(
+        comment,
+        /^undefined$|^\[object Object\]$|^null$/,
+        "empty-data comment must not be a debug-style stringified artifact",
+      );
+      assert.doesNotMatch(
+        comment,
+        /\{\{\s*\w+\s*\}\}/,
+        "empty-data comment must not leak unsubstituted {{placeholders}}",
+      );
+    });
+
+    it("empty input produces empty comment — callers gate on truthiness", () => {
+      // Sister to the previous test: this locks in the current behaviour
+      // that empty input returns empty string, so a regression that
+      // unexpectedly starts emitting a non-empty default (which would
+      // then post spam comments for every bare-data milestone) fails.
+      const comment = formatSummaryComment({});
+      assert.equal(
+        comment,
+        "",
+        "empty data must return exactly '' so callers can `if (comment)` gate",
+      );
+    });
+  });
+
+  describe("swarm delivery routines", () => {
+    it("formats lane PR bodies with impact, risks, rollback, and evidence", () => {
+      const body = formatSwarmLanePRBody({
+        lane: {
+          id: "writer",
+          branch: "lane/single-writer",
+          owner: "@owner",
+          latestCommit: "abc1234",
+          changedContracts: ["WriterToken"],
+          testEvidence: ["npm run typecheck:extensions"],
+        },
+        impactArea: "Single-writer UOK metadata.",
+        transitionRisks: ["Writer token lifecycle regression"],
+        rollbackPlan: ["Disable writer sequence enrichment"],
+        linkedIssue: 123,
+      });
+
+      assert.ok(body.includes("`lane/writer`"));
+      assert.ok(body.includes("Single-writer UOK metadata."));
+      assert.ok(body.includes("- [ ] Writer token lifecycle regression"));
+      assert.ok(body.includes("- [ ] Disable writer sequence enrichment"));
+      assert.ok(body.includes("- [ ] npm run typecheck:extensions"));
+      assert.ok(body.includes("Closes #123"));
+    });
+
+    it("formats release checklist bodies from lane state", () => {
+      const body = formatSwarmReleaseChecklistBody({
+        integrationBranch: "integration/uok-swarm",
+        lanes: [
+          { id: "workflow", branch: "lane/workflow-engine", owner: "@a", latestCommit: "1111111" },
+          { id: "state", branch: "lane/state-machine", blockers: ["matrix gap"] },
+        ],
+        parityReport: "No critical mismatches.",
+        rollbackDrill: "Passed fallback drill.",
+        requiredChecks: ["unit", "integration"],
+      });
+
+      assert.ok(body.includes("`integration/uok-swarm`"));
+      assert.ok(body.includes("| `lane/workflow` | `lane/workflow-engine` | @a | `1111111` | ready |"));
+      assert.ok(body.includes("| `lane/state` | `lane/state-machine` |  |  | blocked |"));
+      assert.ok(body.includes("- [ ] UOK parity report attached or linked"));
+      assert.ok(body.includes("- [ ] unit"));
+      assert.ok(body.includes("Passed fallback drill."));
+    });
+
+    it("declares expected swarm lane labels for generated GitHub routines", () => {
+      assert.deepEqual(Object.values(SWARM_LANE_LABELS), [
+        "lane/workflow",
+        "lane/state",
+        "lane/writer",
+        "lane/uok",
+        "lane/github",
+      ]);
     });
   });
 });

package/src/resources/extensions/google-search/index.ts

@@ -4,8 +4,9 @@ import type { ExtensionAPI } from "@gsd/pi-coding-agent";
 export default function (pi: ExtensionAPI) {
   pi.on("session_start", async (_event, ctx) => {
     ctx.ui.notify(
-      "google_search has moved to @gsd-extensions/google-search. " +
-      "Install: gsd extensions install @gsd-extensions/google-search",
+      "google_search is being extracted to @gsd-extensions/google-search " +
+      "(not yet published to npm). This stub will be replaced once the " +
+      "package is available. No action needed for now.",
       "warning",
     );
   });

package/src/resources/extensions/gsd/auto/loop.ts

@@ -29,14 +29,16 @@ import {
 } from "./phases.js";
 import { debugLog } from "../debug-logger.js";
 import { isInfrastructureError, isTransientCooldownError, getCooldownRetryAfterMs, COOLDOWN_FALLBACK_WAIT_MS, MAX_COOLDOWN_RETRIES } from "./infra-errors.js";
+import { ModelPolicyDispatchBlockedError } from "../auto-model-selection.js";
 import { resolveEngine } from "../engine-resolver.js";
 import { logWarning } from "../workflow-logger.js";
 import { gsdRoot } from "../paths.js";
+import { atomicWriteSync } from "../atomic-write.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { scheduleSidecarQueue } from "../uok/execution-graph.js";
 import { ExecutionGraphScheduler } from "../uok/execution-graph.js";
 import type { UokGraphNode } from "../uok/contracts.js";
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 
 // ── Stuck detection persistence (#3704) ──────────────────────────────────
@@ -82,12 +84,69 @@ function saveStuckState(basePath: string, state: LoopState): void {
   }
 }
 
+// ── Custom workflow verification retry persistence ───────────────────────
+// Custom workflows can request verification retries after a step runs. The
+// retry budget must survive an auto-mode restart or a failing verifier can
+// consume a fresh retry budget every session.
+function customVerifyRetryStateDir(s: Pick<AutoSession, "activeRunDir" | "basePath">): string {
+  return s.activeRunDir ? join(s.activeRunDir, "runtime") : join(gsdRoot(s.basePath), "runtime");
+}
+
+function customVerifyRetryStatePath(s: Pick<AutoSession, "activeRunDir" | "basePath">): string {
+  return join(customVerifyRetryStateDir(s), "custom-verify-retries.json");
+}
+
+function hydrateCustomVerifyRetryCounts(s: AutoSession): Map<string, number> {
+  if (s.verificationRetryCount.size > 0) {
+    return s.verificationRetryCount;
+  }
+
+  try {
+    const raw = JSON.parse(readFileSync(customVerifyRetryStatePath(s), "utf-8"));
+    const counts = raw && typeof raw === "object" && raw.counts && typeof raw.counts === "object"
+      ? raw.counts as Record<string, unknown>
+      : {};
+    for (const [key, value] of Object.entries(counts)) {
+      if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+        s.verificationRetryCount.set(key, Math.floor(value));
+      }
+    }
+  } catch (err) {
+    debugLog("autoLoop", { phase: "load-custom-verify-retries-failed", error: err instanceof Error ? err.message : String(err) });
+  }
+
+  return s.verificationRetryCount;
+}
+
+function saveCustomVerifyRetryCounts(s: AutoSession): void {
+  const retryCounts = s.verificationRetryCount;
+  const filePath = customVerifyRetryStatePath(s);
+
+  try {
+    if (!retryCounts || retryCounts.size === 0) {
+      unlinkSync(filePath);
+      return;
+    }
+    mkdirSync(customVerifyRetryStateDir(s), { recursive: true });
+    atomicWriteSync(filePath, JSON.stringify({
+      counts: Object.fromEntries(retryCounts),
+      updatedAt: new Date().toISOString(),
+    }) + "\n");
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? (err as { code?: string }).code : undefined;
+    if (code !== "ENOENT") {
+      debugLog("autoLoop", { phase: "save-custom-verify-retries-failed", error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+}
+
 // ── Memory pressure monitoring (#3331) ──────────────────────────────────
 // Check heap usage every N iterations and trigger graceful shutdown before
 // the OS OOM killer sends SIGKILL. The threshold is 90% of the V8 heap
 // limit (--max-old-space-size or default ~1.5-4GB depending on platform).
 const MEMORY_CHECK_INTERVAL = 5; // check every 5 iterations
 const MEMORY_PRESSURE_THRESHOLD = 0.85; // 85% of heap limit
+const MAX_CUSTOM_ENGINE_VERIFY_RETRIES = 3;
 
 type DispatchContract = "legacy-direct" | "uok-scheduler";
 
@@ -437,16 +496,51 @@ export async function autoLoop(
           break;
         }
         if (verifyResult === "retry") {
-          debugLog("autoLoop", { phase: "custom-engine-verify-retry", iteration, unitId: iterData.unitId });
+          const recoveryKey = `${iterData.unitType}/${iterData.unitId}`;
+          const retryCounts = hydrateCustomVerifyRetryCounts(s);
+          const attempts = (retryCounts.get(recoveryKey) ?? 0) + 1;
+          retryCounts.set(recoveryKey, attempts);
+          saveCustomVerifyRetryCounts(s);
+          debugLog("autoLoop", { phase: "custom-engine-verify-retry", iteration, unitId: iterData.unitId, attempts });
           deps.uokObserver?.onPhaseResult("custom-engine", "retry", {
             unitType: iterData.unitType,
             unitId: iterData.unitId,
+            attempts,
           });
+          if (attempts > MAX_CUSTOM_ENGINE_VERIFY_RETRIES) {
+            const recovery = await policy.recover(iterData.unitType, iterData.unitId, { basePath: s.basePath });
+            if (recovery.outcome === "pause") {
+              await deps.pauseAuto(ctx, pi);
+              finishTurn("paused", "manual-attention", recovery.reason ?? "custom-engine-verify-retry-exhausted");
+              break;
+            }
+            if (recovery.outcome === "skip") {
+              await deps.stopAuto(
+                ctx,
+                pi,
+                recovery.reason ??
+                  `Custom workflow verification for ${iterData.unitId} requested skip after retry exhaustion, but the custom engine cannot reconcile skipped steps.`,
+              );
+              finishTurn("stopped", "manual-attention", "custom-engine-verify-retry-exhausted");
+              break;
+            }
+            const exhaustedReason =
+              `Custom workflow verification for ${iterData.unitId} requested retry ${attempts} times without passing.`;
+            await deps.stopAuto(
+              ctx,
+              pi,
+              recovery.outcome === "stop" && recovery.reason ? recovery.reason : exhaustedReason,
+            );
+            finishTurn("stopped", "manual-attention", "custom-engine-verify-retry-exhausted");
+            break;
+          }
           finishTurn("retry");
           continue;
         }
 
         // Verification passed — mark step complete
+        s.verificationRetryCount?.delete(`${iterData.unitType}/${iterData.unitId}`);
+        saveCustomVerifyRetryCounts(s);
         debugLog("autoLoop", { phase: "custom-engine-reconcile", iteration, unitId: iterData.unitId });
         const reconcileResult = await engine.reconcile(engineState, {
           unitType: iterData.unitType,
@@ -610,6 +704,52 @@ export async function autoLoop(
       // runFinalize leave the journal incomplete, making diagnosis harder.
       deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration, error: msg } });
 
+      // ── Pre-send model-policy block: not a retryable error (#4959 / #4850) ──
+      // The model-policy gate runs before the prompt is sent.  When every
+      // candidate model is denied (cross-provider disabled + flat-rate
+      // baseline + tool-policy denial), retrying the same unit produces the
+      // same denial — burning the consecutive-error budget toward a 3-strike
+      // hard stop and corrupting auto-mode state.  Pause for user attention
+      // instead, with the per-model deny reasons surfaced from the typed
+      // error.
+      if (loopErr instanceof ModelPolicyDispatchBlockedError) {
+        debugLog("autoLoop", {
+          phase: "model-policy-blocked",
+          iteration,
+          unitType: loopErr.unitType,
+          unitId: loopErr.unitId,
+          reasons: loopErr.reasons,
+        });
+        ctx.ui.notify(
+          `Auto-mode paused: model-policy denied dispatch for ${loopErr.unitType}/${loopErr.unitId}. ${msg}`,
+          "error",
+        );
+        deps.emitJournalEvent({
+          ts: new Date().toISOString(),
+          flowId,
+          seq: nextSeq(),
+          eventType: "unit-end",
+          data: {
+            unitType: loopErr.unitType,
+            unitId: loopErr.unitId,
+            status: "blocked",
+            reason: "model-policy-dispatch-blocked",
+            reasons: loopErr.reasons,
+          },
+        });
+        // Carry the blocked unit identity into the turn-result observer:
+        // the throw originated inside dispatch, so observedUnitType/Id were
+        // not assigned by the success path at lines 453/631/647 — but the
+        // typed error already names the unit (#4959 / CodeRabbit).
+        observedUnitType = loopErr.unitType;
+        observedUnitId = loopErr.unitId;
+        await deps.pauseAuto(ctx, pi);
+        finishTurn("paused", "manual-attention", msg);
+        // Do NOT increment consecutiveErrors — the failure is configuration,
+        // not a transient runtime fault.
+        break;
+      }
+
       // ── Infrastructure errors: immediate stop, no retry ──
       // These are unrecoverable (disk full, OOM, etc.). Retrying just burns
       // LLM budget on guaranteed failures.