gsd-pi 2.77.0 → 2.78.0

package/src/resources/extensions/gsd/auto-post-unit.ts

@@ -65,14 +65,41 @@ import { resolveExpectedArtifactPath as resolveArtifactForContent } from "./auto
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { getSliceTasks } from "./gsd-db.js";
 import { runPreExecutionChecks, type PreExecutionResult } from "./pre-execution-checks.js";
-import { writePreExecutionEvidence } from "./verification-evidence.js";
+import { writePreExecutionEvidence, type PreExecutionCheckJSON } from "./verification-evidence.js";
 import { ensureCodebaseMapFresh } from "./codebase-generator.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { UokGateRunner } from "./uok/gate-runner.js";
 import { writeTurnGitTransaction } from "./uok/gitops.js";
+import { isClosedStatus } from "./status-guards.js";
+import { detectAbandonMilestone } from "./abandon-detect.js";
+import { isDeterministicPolicyError } from "./auto-tool-tracking.js";
 
 /** Maximum verification retry attempts before escalating to blocker placeholder (#2653). */
 const MAX_VERIFICATION_RETRIES = 3;
+/** Keep failure toasts short while still showing concrete examples. */
+const MAX_NOTIFICATION_DETAILS = 3;
+const NOTIFICATION_BULLET = "•";
+
+function formatPreExecutionCheckDetail(check: PreExecutionCheckJSON): string {
+  const category = check.category?.trim() || "unknown category";
+  const target = check.target?.trim() || "unknown target";
+  const message = check.message.split(/\r?\n/, 1)[0]?.trim() || "No details provided";
+  return `  ${NOTIFICATION_BULLET} [${category}] ${target}: ${message}`;
+}
+
+const COMPLETE_MILESTONE_DB_SETTLE_MS = 1500;
+const COMPLETE_MILESTONE_DB_SETTLE_POLL_MS = 100;
+
+async function waitForMilestoneDbClose(mid: string): Promise<boolean> {
+  const deadline = Date.now() + COMPLETE_MILESTONE_DB_SETTLE_MS;
+  while (Date.now() < deadline) {
+    if (!isDbAvailable()) return false;
+    const milestone = getMilestone(mid);
+    if (milestone && isClosedStatus(milestone.status)) return true;
+    await new Promise((resolve) => setTimeout(resolve, COMPLETE_MILESTONE_DB_SETTLE_POLL_MS));
+  }
+  return false;
+}
 
 
 /** Enqueue a sidecar item (hook, triage, or quick-task) for the main loop to
@@ -110,7 +137,7 @@ import {
   describeNextUnit,
 } from "./auto-dashboard.js";
 import { existsSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
+import { join, relative } from "node:path";
 import { _resetHasChangesCache } from "./native-git-bridge.js";
 import { autoCommitCurrentBranch } from "./worktree.js";
 
@@ -238,6 +265,14 @@ export function detectRogueFileWrites(
   return rogues;
 }
 
+/**
+ * Maximum number of times to retry a unit whose expected artifact is missing
+ * after execution. Matches the bounded pattern used by runPostUnitVerification
+ * in auto-verification.ts. Exceeding this limit pauses auto-mode instead of
+ * looping indefinitely (#2007).
+ */
+const MAX_ARTIFACT_VERIFICATION_RETRIES = 3;
+
 export const STEP_COMPLETE_FALLBACK_MESSAGE =
   "Step complete. Run /clear, then /gsd to continue (or /gsd auto to run continuously).";
 
@@ -555,6 +590,35 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
     // Rewrite-docs completion
     if (s.currentUnit.type === "rewrite-docs") {
       await runSafely("postUnit", "rewrite-docs-resolve", async () => {
+        // Detect abandon/descope overrides BEFORE resolving them (#3490).
+        // If an override is about abandoning the milestone, park it so the
+        // state engine skips it. Without this, rewrite-docs only edits
+        // markdown but the DB still has the milestone as active.
+        try {
+          const { loadActiveOverrides } = await import("./files.js");
+          const overrides = await loadActiveOverrides(s.basePath);
+          const decision = detectAbandonMilestone(overrides, s.currentMilestoneId);
+          if (decision.shouldPark && s.currentMilestoneId) {
+            const { parkMilestone } = await import("./milestone-actions.js");
+            const parked = parkMilestone(s.basePath, s.currentMilestoneId, decision.reason);
+            if (parked) {
+              ctx.ui.notify(`Milestone ${s.currentMilestoneId} parked: "${decision.reason}"`, "info");
+            } else {
+              // Park refused: milestone directory missing, milestone already
+              // completed (SUMMARY present), or PARKED.md already exists.
+              // resolveAllOverrides below will still consume the override —
+              // surface this loudly so the user notices state drift rather
+              // than silently losing the abandon directive.
+              const msg = `Abandon detected for ${s.currentMilestoneId} but park refused (milestone is completed, already parked, or missing). Override will be resolved anyway — verify state is correct.`;
+              logError("engine", msg);
+              ctx.ui.notify(msg, "warning");
+            }
+          }
+        } catch (err) {
+          logError("engine", `abandon-detect failed: ${(err as Error).message}`);
+          ctx.ui.notify(`Abandon detection failed — check logs. Overrides will still be resolved.`, "warning");
+        }
+
         await resolveAllOverrides(s.basePath);
         // Reset both disk and in-memory counters. Disk counter is authoritative
         // (survives restarts); in-memory is kept in sync for the current session.
@@ -574,6 +638,87 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
           clearReactiveState(s.basePath, mid, sid);
         }
       });
+
+      // #4765 — slice-cadence collapse. When `git.collapse_cadence: "slice"`
+      // is set, squash-merge the slice's commits from the milestone branch
+      // onto main right here, so orphan risk shrinks from milestone-size to
+      // slice-size. Only runs in worktree isolation mode — the feature needs
+      // a milestone branch to squash from.
+      let sliceMergeStopped = false;
+      await runSafely("postUnit", "slice-cadence-merge", async () => {
+        const prefsResult = loadEffectiveGSDPreferences(s.basePath);
+        const prefs = prefsResult?.preferences;
+        const { getCollapseCadence, mergeSliceToMain } = await import("./slice-cadence.js");
+        if (getCollapseCadence(prefs) !== "slice") return;
+        if (prefs?.git?.isolation !== "worktree") return;
+        if (s.isolationDegraded) return;
+
+        const projectRoot = s.originalBasePath || s.basePath;
+        const { milestone: mid, slice: sid } = parseUnitId(unit.id);
+        if (!mid || !sid) return;
+
+        // Record the milestone start SHA before the first slice merge, so
+        // resquashMilestoneOnMain has a target at milestone completion.
+        // Resolve main branch dynamically — hard-coding "main" breaks repos
+        // that use "master" or a custom default branch.
+        if (!s.milestoneStartShas.has(mid)) {
+          try {
+            const { nativeDetectMainBranch } = await import("./native-git-bridge.js");
+            const mainBranch = nativeDetectMainBranch(projectRoot);
+            const { execFileSync } = await import("node:child_process");
+            const sha = execFileSync("git", ["rev-parse", mainBranch], {
+              cwd: projectRoot, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+            }).trim();
+            if (sha) s.milestoneStartShas.set(mid, sha);
+          } catch (err) {
+            logWarning("engine", `slice-cadence: failed to record milestone start SHA: ${err instanceof Error ? err.message : String(err)}`);
+          }
+        }
+
+        try {
+          const result = mergeSliceToMain(projectRoot, mid, sid);
+          if (result.skipped) {
+            logWarning("engine", `slice-cadence: merge skipped for ${sid} — ${result.skippedReason}`);
+            return;
+          }
+          ctx.ui.notify(
+            `slice-cadence: ${sid} merged to main (${result.durationMs}ms).`,
+            "info",
+          );
+        } catch (err) {
+          const { MergeConflictError } = await import("./git-service.js");
+          if (err instanceof MergeConflictError) {
+            ctx.ui.notify(
+              `slice-cadence merge conflict in ${sid}: ${err.conflictedFiles.join(", ")}. ` +
+              `Resolve manually on main and run \`/gsd auto\` to resume.`,
+              "error",
+            );
+            // Stop auto AND signal the outer postUnit flow to exit early.
+            // Without the flag, subsequent hooks (triage, rogue detection,
+            // DB writes) would keep running against a conflicted main
+            // checkout after the loop was already told to stop.
+            const { stopAuto } = await import("./auto.js");
+            await stopAuto(ctx, undefined, `slice-merge-conflict on ${sid}`);
+            sliceMergeStopped = true;
+            return;
+          }
+          logError("engine", `slice-cadence merge failed for ${sid}`, {
+            error: err instanceof Error ? err.message : String(err),
+          });
+          // Non-conflict failures (dirty main, rev-walk error, etc.) can
+          // leave the checkout in an unexpected state. Stop auto-mode so
+          // the next slice doesn't dispatch on top of it.
+          const { stopAuto } = await import("./auto.js");
+          await stopAuto(ctx, undefined, `slice-merge-error on ${sid}`);
+          sliceMergeStopped = true;
+        }
+      });
+      // Exit early after stopAuto so the rest of post-unit processing
+      // (triage, rogue detection, hook dispatch, DB writes) doesn't run
+      // against a conflicted main checkout. Return "dispatched" to match
+      // the convention used by other stop/pauseAuto paths in this function
+      // (see signal handling earlier: stop/pause also return "dispatched").
+      if (sliceMergeStopped) return "dispatched";
     }
 
     // Post-triage: execute actionable resolutions
@@ -740,6 +885,25 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
 
       // If verification failed, attempt to regenerate missing projection files
       // from DB data before giving up (e.g. research-slice produces PLAN from engine).
+      if (!triggerArtifactVerified) {
+        if (s.currentUnit.type === "complete-milestone") {
+          try {
+            const { milestone: mid } = parseUnitId(s.currentUnit.id);
+            if (mid) {
+              const settled = await waitForMilestoneDbClose(mid);
+              if (settled) {
+                triggerArtifactVerified = verifyExpectedArtifact(s.currentUnit.type, s.currentUnit.id, s.basePath);
+                if (triggerArtifactVerified) {
+                  invalidateAllCaches();
+                }
+              }
+            }
+          } catch (e) {
+            debugLog("postUnit", { phase: "artifact-verify-settle-db", error: String(e) });
+          }
+        }
+      }
+
       if (!triggerArtifactVerified) {
         try {
           const { milestone: mid, slice: sid } = parseUnitId(s.currentUnit.id);
@@ -761,16 +925,35 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
       // When artifact verification fails for a unit type that has a known expected
       // artifact, return "retry" so the caller re-dispatches with failure context
       // instead of blindly re-dispatching the same unit (#1571).
-      // After MAX_VERIFICATION_RETRIES, escalate to writeBlockerPlaceholder so the
-      // pipeline can advance instead of looping forever (#2653).
+      // Retries are capped at MAX_ARTIFACT_VERIFICATION_RETRIES to prevent
+      // unbounded loops (#2007).
+      //
+      // Pre-checks short-circuit retry for known-unrecoverable failures:
+      // - Deterministic policy rejection (#4973): structural write-gate failure
+      //   that will recur on every retry, so write a blocker placeholder.
+      // - DB infra failure (#2517): completion tool returned db_unavailable, so
+      //   the artifact was never written. Retrying can never succeed.
+      // - Tool invocation error (#2883/#3595): malformed JSON args or queued
+      //   user message — retry will produce the same failure.
       //
-      // HOWEVER, if the DB is unavailable (db_unavailable), the artifact was never
-      // written because the completion tool failed at the infra level. Retrying
-      // can never succeed and produces a costly re-dispatch loop (#2517).
-      if (!triggerArtifactVerified && !isDbAvailable()) {
-        // DB infra failure — do NOT retry; the completion tool returned
-        // db_unavailable so the artifact was never written. Retrying would
-        // produce an infinite re-dispatch loop (#2517).
+      // #4973: Deterministic policy rejections (e.g. context_write_blocked from the
+      // write-gate) are checked FIRST — before the DB-availability check — because
+      // they are structural gates that will fire on every retry regardless of DB or
+      // model tier. Short-circuit immediately by writing a blocker placeholder.
+      if (!triggerArtifactVerified && s.lastToolInvocationError && isDeterministicPolicyError(s.lastToolInvocationError)) {
+        const retryKey = `${s.currentUnit.type}:${s.currentUnit.id}`;
+        debugLog("postUnit", { phase: "deterministic-policy-error-placeholder", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError });
+        const reason = `Deterministic policy rejection for ${s.currentUnit.type} "${s.currentUnit.id}": ${s.lastToolInvocationError}. Retrying cannot resolve this gate — writing blocker placeholder to advance pipeline.`;
+        s.lastToolInvocationError = null;
+        s.pendingVerificationRetry = null;
+        s.verificationRetryCount.delete(retryKey);
+        writeBlockerPlaceholder(s.currentUnit.type, s.currentUnit.id, s.basePath, reason);
+        ctx.ui.notify(
+          `${s.currentUnit.type} ${s.currentUnit.id} — deterministic policy rejection, wrote blocker placeholder (no retries) (#4973)`,
+          "warning",
+        );
+        // Fall through to "continue" — do NOT enter the retry or db-unavailable paths.
+      } else if (!triggerArtifactVerified && !isDbAvailable()) {
         debugLog("postUnit", { phase: "artifact-verify-skip-db-unavailable", unitType: s.currentUnit.type, unitId: s.currentUnit.id });
         const dbSkipDiag = diagnoseExpectedArtifact(s.currentUnit.type, s.currentUnit.id, s.basePath);
         ctx.ui.notify(
@@ -778,9 +961,6 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
           "error",
         );
       } else if (!triggerArtifactVerified) {
-        // #2883/#3595: If the artifact is missing because the tool invocation
-        // failed (malformed JSON) or was skipped (queued user message), retrying
-        // will produce the same failure. Pause auto-mode instead of looping.
         if (s.lastToolInvocationError) {
           const isUserSkip = /queued user message/i.test(s.lastToolInvocationError);
           const errMsg = isUserSkip
@@ -797,68 +977,36 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
         if (hasExpectedArtifact) {
           const retryKey = `${s.currentUnit.type}:${s.currentUnit.id}`;
           const attempt = (s.verificationRetryCount.get(retryKey) ?? 0) + 1;
-          s.verificationRetryCount.set(retryKey, attempt);
-
-          if (attempt > MAX_VERIFICATION_RETRIES) {
-            // #4175: For complete-milestone, a blocker placeholder is harmful —
-            // the stub SUMMARY has no recovery value (milestone is terminal),
-            // it does not update DB status (so deriveState never advances),
-            // and it fools stopAuto's presence check into merging a milestone
-            // that was never legitimately completed. Pause auto-mode with a
-            // clear single failure signal and preserve the worktree branch.
-            if (s.currentUnit.type === "complete-milestone") {
-              debugLog("postUnit", {
-                phase: "artifact-verify-pause-complete-milestone",
-                unitType: s.currentUnit.type,
-                unitId: s.currentUnit.id,
-                attempt,
-                maxRetries: MAX_VERIFICATION_RETRIES,
-              });
-              s.verificationRetryCount.delete(retryKey);
-              s.pendingVerificationRetry = null;
-              ctx.ui.notify(
-                `Milestone ${s.currentUnit.id} verification failed after ${MAX_VERIFICATION_RETRIES} retries — worktree branch preserved. Re-run /gsd auto once blockers are resolved.`,
-                "error",
-              );
-              await pauseAuto(ctx, pi);
-              return "dispatched";
-            }
-
-            // Retries exhausted — write a blocker placeholder so the pipeline
-            // can advance past this stuck unit (#2653).
-            debugLog("postUnit", {
-              phase: "artifact-verify-escalate",
-              unitType: s.currentUnit.type,
-              unitId: s.currentUnit.id,
-              attempt,
-              maxRetries: MAX_VERIFICATION_RETRIES,
-            });
-            const reason = `Artifact verification failed after ${MAX_VERIFICATION_RETRIES} retries for ${s.currentUnit.type} "${s.currentUnit.id}".`;
-            writeBlockerPlaceholder(s.currentUnit.type, s.currentUnit.id, s.basePath, reason);
-            ctx.ui.notify(
-              `${s.currentUnit.type} ${s.currentUnit.id} — verification retries exhausted (${MAX_VERIFICATION_RETRIES}), wrote blocker placeholder to advance pipeline`,
-              "warning",
-            );
-            // Reset retry count and fall through to "continue" so the loop
-            // re-derives state with the placeholder in place.
+          if (attempt > MAX_ARTIFACT_VERIFICATION_RETRIES) {
             s.verificationRetryCount.delete(retryKey);
-            s.pendingVerificationRetry = null;
-            // Do NOT return "retry" — fall through to "continue" below.
-          } else {
-            s.pendingVerificationRetry = {
-              unitId: s.currentUnit.id,
-              failureContext: `Artifact verification failed: expected artifact for ${s.currentUnit.type} "${s.currentUnit.id}" was not found on disk after unit execution (attempt ${attempt}).`,
-              attempt,
-            };
-            debugLog("postUnit", { phase: "artifact-verify-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
+            debugLog("postUnit", { phase: "artifact-verify-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
             ctx.ui.notify(
-              `Artifact missing for ${s.currentUnit.type} ${s.currentUnit.id} — retrying (attempt ${attempt})`,
-              "warning",
+              `Artifact still missing for ${s.currentUnit.type} ${s.currentUnit.id} after ${MAX_ARTIFACT_VERIFICATION_RETRIES} retries — pausing auto-mode`,
+              "error",
             );
-            return "retry";
+            await pauseAuto(ctx, pi);
+            return "dispatched";
           }
+          s.verificationRetryCount.set(retryKey, attempt);
+          s.pendingVerificationRetry = {
+            unitId: s.currentUnit.id,
+            failureContext: `Artifact verification failed: expected artifact for ${s.currentUnit.type} "${s.currentUnit.id}" was not found on disk after unit execution (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES}).`,
+            attempt,
+          };
+          debugLog("postUnit", { phase: "artifact-verify-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
+          ctx.ui.notify(
+            `Artifact missing for ${s.currentUnit.type} ${s.currentUnit.id} — retrying (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES})`,
+            "warning",
+          );
+          return "retry";
         }
       }
+
+      // Verification succeeded — clear the retry counter so a future failure
+      // of the same unit gets a full retry budget instead of the stale count.
+      if (triggerArtifactVerified) {
+        s.verificationRetryCount.delete(`${s.currentUnit.type}:${s.currentUnit.id}`);
+      }
     } else {
       // Hook unit completed — no additional processing needed
     }
@@ -1098,8 +1246,11 @@ export async function postUnitPostVerification(pctx: PostUnitContext): Promise<"
 
         // Write evidence JSON to slice artifacts directory
         const slicePath = resolveSlicePath(s.basePath, mid, sid);
+        const evidenceFileName = `${sid}-PRE-EXEC-VERIFY.json`;
+        let evidencePath = join(".gsd", "milestones", mid, "slices", sid, evidenceFileName);
         if (slicePath) {
           writePreExecutionEvidence(result, slicePath, mid, sid);
+          evidencePath = relative(s.basePath, join(slicePath, evidenceFileName)) || evidenceFileName;
         }
 
         if (uokFlags.gates) {
@@ -1136,9 +1287,11 @@ export async function postUnitPostVerification(pctx: PostUnitContext): Promise<"
         if (result.status === "fail") {
           const blockingChecks = result.checks.filter(c => !c.passed && c.blocking);
           const blockingCount = blockingChecks.length;
-          const details = blockingChecks.slice(0, 3).map(c => `  \u2022 ${c.message}`).join("\n");
-          const suffix = blockingChecks.length > 3 ? `\n  \u2022 ...and ${blockingChecks.length - 3} more` : "";
-          const evidenceNote = `\nSee ${sid}-PRE-EXEC-VERIFY.json for full details.`;
+          const details = blockingChecks.slice(0, MAX_NOTIFICATION_DETAILS).map(formatPreExecutionCheckDetail).join("\n");
+          const suffix = blockingChecks.length > MAX_NOTIFICATION_DETAILS
+            ? `\n  ${NOTIFICATION_BULLET} ...and ${blockingChecks.length - MAX_NOTIFICATION_DETAILS} more`
+            : "";
+          const evidenceNote = `\nSee ${evidencePath} for full details.`;
           ctx.ui.notify(
             `Pre-execution checks failed: ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} found\n${details}${suffix}${evidenceNote}`,
             "error",