gsd-pi 2.78.1-dev.82bcf6b71 → 2.78.1-dev.84c045fd2

package/src/resources/extensions/gsd/doctor-runtime-checks.ts

@@ -14,6 +14,18 @@ import { recoverFailedMigration } from "./migrate-external.js";
 import { splitCompletedKey } from "./forensics.js";
 import { findMilestoneIds } from "./milestone-ids.js";
 
+const MAX_UAT_ATTEMPTS = 3;
+
+function hasAssessmentVerdict(basePath: string, mid: string, sid: string): boolean {
+  const assessmentPath = join(gsdRoot(basePath), "milestones", mid, "slices", sid, `${sid}-ASSESSMENT.md`);
+  if (!existsSync(assessmentPath)) return false;
+  try {
+    return /^\s*verdict\s*:\s*(PASS|FAIL|PARTIAL)\b/im.test(readFileSync(assessmentPath, "utf-8"));
+  } catch {
+    return false;
+  }
+}
+
 export async function checkRuntimeHealth(
   basePath: string,
   issues: DoctorIssue[],
@@ -191,6 +203,47 @@ export async function checkRuntimeHealth(
     // Non-fatal — hook state check failed
   }
 
+  // ── Exhausted run-uat retry counters ──────────────────────────────────
+  try {
+    const runtimeDir = join(root, "runtime");
+    if (existsSync(runtimeDir)) {
+      const uatCounterPattern = /^uat-count-(M\d+)-(S\d+)\.json$/;
+      for (const fileName of readdirSync(runtimeDir)) {
+        const match = fileName.match(uatCounterPattern);
+        if (!match) continue;
+        const [, mid, sid] = match;
+        if (!mid || !sid || hasAssessmentVerdict(basePath, mid, sid)) continue;
+
+        const filePath = join(runtimeDir, fileName);
+        let count = 0;
+        try {
+          const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+          count = typeof parsed.count === "number" ? parsed.count : 0;
+        } catch {
+          count = MAX_UAT_ATTEMPTS + 1;
+        }
+        if (count <= MAX_UAT_ATTEMPTS) continue;
+
+        issues.push({
+          severity: "warning",
+          code: "uat_retry_exhausted",
+          scope: "slice",
+          unitId: `${mid}/${sid}`,
+          message: `run-uat for ${mid}/${sid} exhausted ${count - 1} retry attempt(s) without an ASSESSMENT verdict. Reset the retry counter after fixing the underlying UAT/tool issue, then rerun /gsd auto.`,
+          file: `.gsd/runtime/${fileName}`,
+          fixable: true,
+        });
+
+        if (shouldFix("uat_retry_exhausted")) {
+          rmSync(filePath, { force: true });
+          fixesApplied.push(`reset exhausted run-uat retry counter for ${mid}/${sid}`);
+        }
+      }
+    }
+  } catch {
+    // Non-fatal — UAT retry counter check failed
+  }
+
   // ── Activity log bloat ────────────────────────────────────────────────
   try {
     const activityDir = join(root, "activity");

package/src/resources/extensions/gsd/doctor-types.ts

@@ -19,6 +19,7 @@ export type DoctorIssueCode =
   | "stale_parallel_session"
   | "orphaned_completed_units"
   | "stale_hook_state"
+  | "uat_retry_exhausted"
   | "activity_log_bloat"
   | "state_file_stale"
   | "state_file_missing"

package/src/resources/extensions/gsd/eval-review-schema.ts

@@ -0,0 +1,243 @@
+/**
+ * EVAL-REVIEW frontmatter schema and parser.
+ *
+ * The auditor agent for `/gsd eval-review` writes a markdown file whose
+ * machine-readable contract lives entirely in YAML frontmatter. The body
+ * after the closing `---` is human-only prose and is never parsed by any
+ * consumer (the design response to a prior parser that used regex over LLM-generated
+ * prose and produced silent failures).
+ *
+ * This module owns:
+ *   - The TypeBox schema for the frontmatter (single source of truth).
+ *   - A small frontmatter extractor (locates the YAML block).
+ *   - The validated parser (`parseEvalReviewFrontmatter`).
+ *   - Pure helpers for derived fields the handler must recompute server-side
+ *     (overall score, severity counts) — we never trust LLM arithmetic.
+ *
+ * Consumers: `commands-eval-review.ts` (writer), `commands-ship.ts` (reader
+ * for the soft pre-ship warning), and a future `commands-eval-fix.ts`.
+ */
+
+import { Type, type Static, type TSchema } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { parse as parseYaml } from "yaml";
+
+// ─── Constants ────────────────────────────────────────────────────────────────
+
+/** Schema version literal embedded in every EVAL-REVIEW.md frontmatter. */
+export const EVAL_REVIEW_SCHEMA_VERSION = "eval-review/v1" as const;
+
+/** Verdict values, ordered from worst to best for UI display purposes. */
+export const VERDICT_VALUES = [
+  "NOT_IMPLEMENTED",
+  "SIGNIFICANT_GAPS",
+  "NEEDS_WORK",
+  "PRODUCTION_READY",
+] as const;
+
+/** Severity classifications used in `gaps[*].severity`. */
+export const SEVERITY_VALUES = ["blocker", "major", "minor"] as const;
+
+/** Eval dimensions an auditor scores. `other` is the catch-all. */
+export const DIMENSION_VALUES = [
+  "observability",
+  "guardrails",
+  "tests",
+  "metrics",
+  "datasets",
+  "other",
+] as const;
+
+/** Lower bound for any score in the schema. */
+export const MIN_SCORE = 0;
+/** Upper bound for any score in the schema. */
+export const MAX_SCORE = 100;
+/** Coverage's contribution to overall_score. See `docs/user-docs/eval-review.md` for rationale. */
+export const COVERAGE_WEIGHT = 0.6;
+/** Infrastructure's contribution to overall_score. See `docs/user-docs/eval-review.md` for rationale. */
+export const INFRASTRUCTURE_WEIGHT = 0.4;
+
+// ─── Schema ───────────────────────────────────────────────────────────────────
+
+const verdictSchema = Type.Union(VERDICT_VALUES.map((v) => Type.Literal(v)));
+const severitySchema = Type.Union(SEVERITY_VALUES.map((v) => Type.Literal(v)));
+const dimensionSchema = Type.Union(DIMENSION_VALUES.map((v) => Type.Literal(v)));
+
+/**
+ * One gap finding inside `gaps[]`. Every field is required — the prompt
+ * cannot emit a partial gap. `evidence` is mandatory; the anti-Goodhart
+ * guard depends on it.
+ */
+export const EvalReviewGap = Type.Object({
+  id: Type.String({ pattern: "^G\\d+$" }),
+  dimension: dimensionSchema,
+  severity: severitySchema,
+  description: Type.String({ minLength: 1 }),
+  evidence: Type.String({ minLength: 1 }),
+  suggested_fix: Type.String({ minLength: 1 }),
+});
+
+/** Severity histogram. The handler recomputes this from `gaps[]`. */
+export const EvalReviewCounts = Type.Object({
+  blocker: Type.Integer({ minimum: 0 }),
+  major: Type.Integer({ minimum: 0 }),
+  minor: Type.Integer({ minimum: 0 }),
+});
+
+/**
+ * The full frontmatter schema. Field order in the schema definition mirrors
+ * the order that the auditor prompt asks the LLM to emit, so a literal-eyeball
+ * comparison between this file and `prompts/eval-review.md` stays meaningful.
+ */
+export const EvalReviewFrontmatter = Type.Object({
+  schema: Type.Literal(EVAL_REVIEW_SCHEMA_VERSION),
+  verdict: verdictSchema,
+  coverage_score: Type.Integer({ minimum: MIN_SCORE, maximum: MAX_SCORE }),
+  infrastructure_score: Type.Integer({ minimum: MIN_SCORE, maximum: MAX_SCORE }),
+  overall_score: Type.Integer({ minimum: MIN_SCORE, maximum: MAX_SCORE }),
+  generated: Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?Z$" }),
+  slice: Type.String({ pattern: "^S\\d+$" }),
+  milestone: Type.String({ minLength: 1 }),
+  gaps: Type.Array(EvalReviewGap),
+  counts: EvalReviewCounts,
+});
+
+/** Inferred TypeScript type for a validated frontmatter object. */
+export type EvalReviewFrontmatterT = Static<typeof EvalReviewFrontmatter>;
+/** Inferred TypeScript type for a single gap finding. */
+export type EvalReviewGapT = Static<typeof EvalReviewGap>;
+/** Inferred TypeScript type for the counts histogram. */
+export type EvalReviewCountsT = Static<typeof EvalReviewCounts>;
+/** One of the four allowed verdict literals. */
+export type Verdict = (typeof VERDICT_VALUES)[number];
+
+// ─── Frontmatter extraction ───────────────────────────────────────────────────
+
+/**
+ * Locate the YAML block between two `---` lines and return its raw text.
+ *
+ * Tolerant to CRLF line endings. Does not interpret the YAML — that's the
+ * caller's job. The extractor only enforces the markdown frontmatter shape.
+ *
+ * @param raw - Full contents of an EVAL-REVIEW.md file.
+ * @returns `{ yaml }` with the inner YAML text on success, or `{ error }`
+ *   describing why the frontmatter could not be located.
+ */
+export function extractFrontmatterRaw(
+  raw: string,
+): { yaml: string } | { error: string } {
+  const lines = raw.split(/\r?\n/);
+  if (lines[0] !== "---") {
+    return { error: "Missing opening `---` frontmatter delimiter on line 1" };
+  }
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i] === "---") {
+      return { yaml: lines.slice(1, i).join("\n") };
+    }
+  }
+  return { error: "Missing closing `---` frontmatter delimiter" };
+}
+
+// ─── Parser ───────────────────────────────────────────────────────────────────
+
+/** Discriminated result type returned by the parser. */
+export type ParseResult =
+  | { ok: true; data: EvalReviewFrontmatterT }
+  | { ok: false; error: string; pointer: string };
+
+/**
+ * Parse and validate the frontmatter of an EVAL-REVIEW.md file.
+ *
+ * Failure cases are exhaustive and deterministic:
+ *   - missing/unclosed frontmatter → `pointer: "/"`, message names the cause
+ *   - YAML syntax error → `pointer: "/"`, message contains "YAML"
+ *   - schema violation → `pointer` is the JSON-Pointer path of the bad field
+ *
+ * Body content after the closing `---` is never inspected. This is an
+ * response to a prior parser that used regex over the body and silently
+ * failed on prose / tables / numbered lists.
+ *
+ * @param raw - Full contents of an EVAL-REVIEW.md file.
+ * @returns A discriminated `ParseResult`.
+ */
+export function parseEvalReviewFrontmatter(raw: string): ParseResult {
+  const fm = extractFrontmatterRaw(raw);
+  if ("error" in fm) {
+    return { ok: false, error: fm.error, pointer: "/" };
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = parseYaml(fm.yaml, { schema: "core" });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, error: `YAML parse error: ${msg}`, pointer: "/" };
+  }
+
+  const schema: TSchema = EvalReviewFrontmatter;
+  if (!Value.Check(schema, parsed)) {
+    const errs = [...Value.Errors(schema, parsed)];
+    const first = errs[0];
+    return {
+      ok: false,
+      error: `Schema validation failed: ${first?.message ?? "unknown error"}`,
+      pointer: first?.path ?? "/",
+    };
+  }
+
+  return { ok: true, data: parsed as EvalReviewFrontmatterT };
+}
+
+// ─── Derived fields ───────────────────────────────────────────────────────────
+
+/**
+ * Compute `overall_score` from the two component scores using the rubric
+ * weights documented in `docs/user-docs/eval-review.md`.
+ *
+ * The handler always recomputes this value rather than trusting whatever the
+ * LLM emitted in `overall_score`. If the LLM-emitted value disagrees with the
+ * recomputed one, the disagreement is logged and the recomputed value wins.
+ *
+ * Clamps the result into `[MIN_SCORE, MAX_SCORE]` defensively. Schema-validated
+ * inputs are already in range, but the helper is exported and may be called
+ * from a code path that bypasses the schema (tests, future tools); the clamp
+ * keeps the contract honest in those cases.
+ *
+ * @param coverage - integer 0..100 from the auditor's coverage assessment.
+ * @param infrastructure - integer 0..100 from the auditor's infra assessment.
+ * @returns rounded integer 0..100.
+ */
+export function computeOverallScore(coverage: number, infrastructure: number): number {
+  const raw = Math.round(coverage * COVERAGE_WEIGHT + infrastructure * INFRASTRUCTURE_WEIGHT);
+  return Math.max(MIN_SCORE, Math.min(MAX_SCORE, raw));
+}
+
+/**
+ * Build the severity histogram for a list of gaps.
+ *
+ * Used by the handler to overwrite whatever the LLM put in `counts` —
+ * we recompute server-side rather than trust LLM arithmetic.
+ *
+ * @param gaps - validated gap list.
+ * @returns counts keyed by severity literal.
+ */
+export function deriveCounts(gaps: readonly EvalReviewGapT[]): EvalReviewCountsT {
+  const counts: EvalReviewCountsT = { blocker: 0, major: 0, minor: 0 };
+  for (const g of gaps) counts[g.severity]++;
+  return counts;
+}
+
+/**
+ * Map a numeric overall_score to its verdict literal using the bands from
+ * Bands per `docs/user-docs/eval-review.md`: ≥80 PRODUCTION_READY, 60..79 NEEDS_WORK, 40..59 SIGNIFICANT_GAPS,
+ * <40 NOT_IMPLEMENTED.
+ *
+ * @param overall - integer 0..100.
+ * @returns a verdict literal.
+ */
+export function verdictForScore(overall: number): Verdict {
+  if (overall >= 80) return "PRODUCTION_READY";
+  if (overall >= 60) return "NEEDS_WORK";
+  if (overall >= 40) return "SIGNIFICANT_GAPS";
+  return "NOT_IMPLEMENTED";
+}

package/src/resources/extensions/gsd/forensics.ts

@@ -12,7 +12,7 @@ import type { ExtensionAPI, ExtensionCommandContext } from "@gsd/pi-coding-agent
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { join, dirname, relative } from "node:path";
 import { fileURLToPath } from "node:url";
-import { getHomeDir } from "./home-dir.js";
+import { gsdHome } from "./gsd-home.js";
 
 import { extractTrace, type ExecutionTrace } from "./session-forensics.js";
 import { nativeParseJsonlTail } from "./native-parser-bridge.js";
@@ -36,6 +36,7 @@ import { loadEffectiveGSDPreferences, loadGlobalGSDPreferences, getGlobalGSDPref
 import { showNextAction } from "../shared/tui.js";
 import { ensurePreferencesFile, serializePreferencesToFrontmatter } from "./commands-prefs-wizard.js";
 import { summarizeWorktreeTelemetry, percentile, type WorktreeTelemetrySummary } from "./worktree-telemetry.js";
+import { homedir } from "node:os";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -244,8 +245,7 @@ export async function handleForensics(
   // when import.meta.url resolves to the npm-global install path (Windows).
   let gsdSourceDir = dirname(fileURLToPath(import.meta.url));
   if (!existsSync(join(gsdSourceDir, "prompts"))) {
-    const gsdHome = process.env.GSD_HOME || join(getHomeDir(), ".gsd");
-    const fallback = join(gsdHome, "agent", "extensions", "gsd");
+    const fallback = join(gsdHome(), "agent", "extensions", "gsd");
     if (existsSync(join(fallback, "prompts"))) gsdSourceDir = fallback;
   }
 
@@ -1307,7 +1307,13 @@ function redactForGitHub(text: string, basePath: string): string {
 
   // Replace absolute paths
   result = result.replace(pathRe(basePath), ".");
-  result = result.replace(pathRe(getHomeDir()), "~");
+  // Redact GSD_HOME first (when it's outside ~), then OS home.
+  // Order matters: longer path must be replaced before the shorter prefix.
+  const gsdHomePath = gsdHome();
+  if (!gsdHomePath.startsWith(homedir())) {
+    result = result.replace(pathRe(gsdHomePath), "~/.gsd");
+  }
+  result = result.replace(pathRe(homedir()), "~");
 
   // Strip API key patterns
   result = result.replace(/sk-[a-zA-Z0-9]{20,}/g, "sk-***");

package/src/resources/extensions/gsd/git-service.ts

@@ -10,7 +10,7 @@
 
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
@@ -147,7 +147,7 @@ export interface TaskCommitContext {
  * what was actually built), falling back to the task title (what was planned).
  */
 export function buildTaskCommitMessage(ctx: TaskCommitContext): string {
-  const description = ctx.oneLiner || ctx.taskTitle;
+  const description = sanitizeCommitSubjectDescription(ctx.oneLiner || ctx.taskTitle);
   const type = inferCommitType(ctx.taskTitle, ctx.oneLiner);
 
   // Truncate description to ~72 chars for subject line (full budget without scope)
@@ -179,6 +179,61 @@ export function buildTaskCommitMessage(ctx: TaskCommitContext): string {
   return `${subject}\n\n${bodyParts.join("\n\n")}`;
 }
 
+function sanitizeCommitSubjectDescription(value: string): string {
+  const cleaned = value
+    .replace(/[\x00-\x1F\x7F]+/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+  return cleaned || "update task";
+}
+
+function normalizeRepoRelativePath(basePath: string, filePath: string): string | null {
+  const trimmed = filePath.trim();
+  if (!trimmed || trimmed.includes("\0")) return null;
+
+  const relPath = isAbsolute(trimmed)
+    ? relative(basePath, trimmed)
+    : normalize(trimmed);
+  if (!relPath || relPath === "." || isAbsolute(relPath) || relPath.startsWith(`..${sep}`) || relPath === "..") {
+    return null;
+  }
+
+  const resolved = resolve(basePath, relPath);
+  const relFromBase = relative(basePath, resolved);
+  if (!relFromBase || relFromBase === "." || relFromBase.startsWith("..") || isAbsolute(relFromBase)) {
+    return null;
+  }
+
+  return relFromBase;
+}
+
+function pathspecToRegex(pattern: string): RegExp {
+  const escaped = pattern
+    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+    .replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+
+function isExcludedScopedPath(path: string, exclusions: readonly string[]): boolean {
+  const normalizedPath = path.replace(/\\/g, "/");
+  for (const exclusion of exclusions) {
+    const normalizedExclusion = exclusion.replace(/^:!/, "").replace(/\\/g, "/");
+    if (!normalizedExclusion) continue;
+    if (normalizedExclusion.endsWith("/")) {
+      if (normalizedPath === normalizedExclusion.slice(0, -1) || normalizedPath.startsWith(normalizedExclusion)) {
+        return true;
+      }
+      continue;
+    }
+    if (normalizedExclusion.includes("*")) {
+      if (pathspecToRegex(normalizedExclusion).test(normalizedPath)) return true;
+      continue;
+    }
+    if (normalizedPath === normalizedExclusion) return true;
+  }
+  return false;
+}
+
 /**
  * Thrown when a slice merge hits code conflicts in non-.gsd files.
  * The working tree is left in a conflicted state (no reset) so the
@@ -659,6 +714,26 @@ export class GitServiceImpl {
     nativeAddAllWithExclusions(this.basePath, allExclusions);
   }
 
+  private scopedStageTaskFiles(
+    taskContext: TaskCommitContext,
+    extraExclusions: readonly string[] = [],
+  ): boolean {
+    const keyFiles = taskContext.keyFiles ?? [];
+    if (keyFiles.length === 0) return false;
+
+    const allExclusions = [...RUNTIME_EXCLUSION_PATHS, ...extraExclusions];
+    const paths = Array.from(new Set(
+      keyFiles
+        .map(file => normalizeRepoRelativePath(this.basePath, file))
+        .filter((file): file is string => file !== null)
+        .filter(file => !isExcludedScopedPath(file, allExclusions)),
+    ));
+    if (paths.length === 0) return false;
+
+    nativeAddPaths(this.basePath, paths);
+    return true;
+  }
+
   /** Tracks whether runtime file cleanup has run this session. */
   private _runtimeFilesCleanedUp = false;
 
@@ -698,7 +773,10 @@ export class GitServiceImpl {
     // Native path uses libgit2 (single syscall), fallback spawns git.
     if (!nativeHasChanges(this.basePath)) return null;
 
-    this.smartStage(extraExclusions);
+    const scoped = taskContext
+      ? this.scopedStageTaskFiles(taskContext, extraExclusions)
+      : false;
+    if (!scoped) this.smartStage(extraExclusions);
 
     // After smart staging, check if anything was actually staged
     // (all changes might have been runtime files that got excluded)