gsd-pi 2.78.1-dev.b0759e59b → 2.78.1-dev.d8826a445

package/src/resources/extensions/gsd/tests/gsd-root-home-guard.test.ts

@@ -1,10 +1,13 @@
 /**
- * GSD2 — regression test for #5187: gsdRoot() must refuse to use the global
- * GSD home (~/.gsd) as a project .gsd directory when basePath resolves to
- * $HOME. Paths under ~/.gsd/projects/<hash>/ remain valid.
+ * GSD2 — regression tests for #5187 and git-root anchor guard:
  *
- * Before the fix, gsdRoot(homedir()) returned ~/.gsd silently and downstream
- * writes polluted the user's global state directory. After the fix, it throws.
+ * #5187: gsdRoot() must refuse to use the global GSD home (~/.gsd) as a
+ * project .gsd directory when basePath resolves to $HOME. Paths under
+ * ~/.gsd/projects/<hash>/ remain valid.
+ *
+ * git-root anchor guard: when $HOME is itself a git repo and ~/.gsd exists,
+ * gsdRoot() must NOT return ~/.gsd for a subdir basePath like ~/projects/foo.
+ * It should fall through to step 4 (creation fallback) instead.
  */
 
 import { describe, test, beforeEach, afterEach } from 'node:test';
@@ -12,6 +15,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, realpathSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
 
 import { gsdRoot, _clearGsdRootCache } from '../paths.ts';
 
@@ -84,3 +88,62 @@ describe('gsdRoot() refuses ~/.gsd as project state when basePath is $HOME (#518
     }
   });
 });
+
+describe('git-root anchor guard: subdir basePath must not resolve to ~/.gsd', () => {
+  let fakeHome: string;
+  let subDir: string;
+  let savedHome: string | undefined;
+  let savedUserProfile: string | undefined;
+  let savedGsdHome: string | undefined;
+
+  beforeEach(() => {
+    // Create a tmpdir that will act as both $HOME and a git repo root.
+    fakeHome = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-anchor-guard-')));
+    // Init a bare-minimum git repo so git rev-parse --show-toplevel returns fakeHome.
+    spawnSync('git', ['init', fakeHome], { encoding: 'utf-8' });
+    // Create ~/.gsd (the global home that must NOT be used for project subdirs).
+    mkdirSync(join(fakeHome, '.gsd'), { recursive: true });
+    // Create a subdir inside the git repo — this is the project basePath.
+    subDir = join(fakeHome, 'projects', 'foo');
+    mkdirSync(subDir, { recursive: true });
+
+    savedHome = process.env.HOME;
+    savedUserProfile = process.env.USERPROFILE;
+    savedGsdHome = process.env.GSD_HOME;
+
+    process.env.HOME = fakeHome;
+    process.env.USERPROFILE = fakeHome;
+    delete process.env.GSD_HOME;
+
+    _clearGsdRootCache();
+  });
+
+  afterEach(() => {
+    if (savedHome === undefined) delete process.env.HOME;
+    else process.env.HOME = savedHome;
+    if (savedUserProfile === undefined) delete process.env.USERPROFILE;
+    else process.env.USERPROFILE = savedUserProfile;
+    if (savedGsdHome === undefined) delete process.env.GSD_HOME;
+    else process.env.GSD_HOME = savedGsdHome;
+
+    _clearGsdRootCache();
+    rmSync(fakeHome, { recursive: true, force: true });
+  });
+
+  test('does NOT return ~/.gsd when $HOME is a git repo and basePath is a subdir', () => {
+    // fakeHome IS the git root AND $HOME, so git rev-parse returns fakeHome,
+    // and ~/.gsd (fakeHome/.gsd) exists. The guard must skip that candidate
+    // and fall through to the creation fallback: subDir/.gsd.
+    const result = gsdRoot(subDir);
+    assert.notEqual(
+      result,
+      join(fakeHome, '.gsd'),
+      'gsdRoot must not return ~/.gsd for a subdir basePath',
+    );
+    assert.equal(
+      result,
+      join(subDir, '.gsd'),
+      'gsdRoot should fall through to the creation fallback for a subdir',
+    );
+  });
+});

package/src/resources/extensions/gsd/tests/gsdroot-worktree-detection.test.ts

@@ -1,9 +1,10 @@
 /**
  * gsdroot-worktree-detection.test.ts — Regression test for #2594.
  *
- * gsdRoot() must return the worktree's own .gsd directory when the basePath
- * is inside a .gsd/worktrees/<name>/ structure, not walk up to the project
- * root's .gsd via the git-root probe.
+ * gsdRoot() must return the canonical project .gsd directory when basePath
+ * is inside a .gsd/worktrees/<name>/ structure. Worktree-local .gsd folders
+ * are legacy projection roots only; runtime state is DB-authoritative at the
+ * project .gsd.
  *
  * The bug: when a git worktree lives at /project/.gsd/worktrees/M008/,
  * probeGsdRoot() runs `git rev-parse --show-toplevel` which can return the
@@ -20,7 +21,7 @@ import { mkdtempSync, realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";
 
-import { gsdRoot, _clearGsdRootCache } from "../paths.ts";
+import { gsdRoot, resolveGsdPathContract, _clearGsdRootCache } from "../paths.ts";
 
 describe("gsdRoot() worktree detection (#2594)", () => {
   let projectRoot: string;
@@ -61,7 +62,7 @@ describe("gsdRoot() worktree detection (#2594)", () => {
     rmSync(projectRoot, { recursive: true, force: true });
   });
 
-  test("returns worktree .gsd when basePath is a worktree with its own .gsd (fast path)", () => {
+  test("returns project .gsd when basePath is a worktree with its own .gsd", () => {
     // Simulates a worktree that already had copyPlanningArtifacts() run,
     // so it has its own .gsd/ directory.
     const worktreeBase = join(projectGsd, "worktrees", "M008");
@@ -71,41 +72,26 @@ describe("gsdRoot() worktree detection (#2594)", () => {
     const result = gsdRoot(worktreeBase);
     assert.equal(
       result,
-      worktreeGsd,
-      `Expected worktree .gsd (${worktreeGsd}), got ${result}. ` +
-        "gsdRoot() should use the fast path for an existing worktree .gsd.",
+      projectGsd,
+      `Expected canonical project .gsd (${projectGsd}), got ${result}.`,
     );
+    assert.equal(resolveGsdPathContract(worktreeBase).worktreeGsd, worktreeGsd);
   });
 
-  test("returns worktree .gsd path (not project root .gsd) when worktree .gsd does not exist yet", () => {
-    // This is the core #2594 bug: the worktree directory exists but its .gsd
-    // subdirectory hasn't been created yet. Without the fix, probeGsdRoot()
-    // walks up from the worktree path, finds /project/.gsd, and returns it.
-    // With the fix, it detects the .gsd/worktrees/<name>/ pattern and returns
-    // the worktree-local .gsd path as the creation fallback.
+  test("returns project .gsd when worktree .gsd does not exist yet", () => {
     const worktreeBase = join(projectGsd, "worktrees", "M008");
     mkdirSync(worktreeBase, { recursive: true });
     // NOTE: no .gsd/ inside worktreeBase
 
     const result = gsdRoot(worktreeBase);
-    const expected = join(worktreeBase, ".gsd");
-
-    // Without the fix, this returns projectGsd (/project/.gsd) because the
-    // walk-up from worktreeBase finds it. With the fix, it returns the
-    // worktree-local path.
-    assert.notEqual(
-      result,
-      projectGsd,
-      "gsdRoot() must NOT return the project root .gsd when basePath is inside .gsd/worktrees/",
-    );
     assert.equal(
       result,
-      expected,
-      `Expected worktree-local .gsd (${expected}), got ${result}.`,
+      projectGsd,
+      `Expected canonical project .gsd (${projectGsd}), got ${result}.`,
     );
   });
 
-  test("returns worktree .gsd when basePath is a real git worktree inside .gsd/worktrees/", () => {
+  test("returns project .gsd when basePath is a real git worktree inside .gsd/worktrees/", () => {
     // Create a real git worktree at .gsd/worktrees/M010
     const worktreeName = "M010";
     const worktreeBase = join(projectGsd, "worktrees", worktreeName);
@@ -125,17 +111,10 @@ describe("gsdRoot() worktree detection (#2594)", () => {
 
     // The real git worktree exists at worktreeBase but has NO .gsd/ subdir yet
     const gsdResult = gsdRoot(worktreeBase);
-    const expected = join(worktreeBase, ".gsd");
-
-    assert.notEqual(
-      gsdResult,
-      projectGsd,
-      "gsdRoot() must NOT escape to project root .gsd from inside a git worktree",
-    );
     assert.equal(
       gsdResult,
-      expected,
-      `Expected worktree-local .gsd (${expected}), got ${gsdResult}`,
+      projectGsd,
+      `Expected canonical project .gsd (${projectGsd}), got ${gsdResult}`,
     );
 
     // Cleanup worktree

package/src/resources/extensions/gsd/tests/guided-flow-prompt-consolidation.test.ts

@@ -86,8 +86,8 @@ describe("guided-flow → auto-prompts consolidation (#5183)", () => {
     assert.ok(prompt.includes(TID), "must mention task id");
     assert.ok(prompt.includes(T_TITLE), "must mention task title");
     assert.ok(
-      prompt.includes("gsd_complete_task"),
-      "must instruct calling the canonical gsd_complete_task tool",
+      prompt.includes("gsd_task_complete"),
+      "must instruct calling the canonical gsd_task_complete tool",
     );
     assert.ok(
       prompt.includes(base),
@@ -110,8 +110,8 @@ describe("guided-flow → auto-prompts consolidation (#5183)", () => {
     assert.ok(prompt.includes(SID), "must mention slice id");
     assert.ok(prompt.includes(S_TITLE), "must mention slice title");
     assert.ok(
-      prompt.includes("gsd_complete_slice"),
-      "must instruct calling gsd_complete_slice (was in guided-complete-slice.md)",
+      prompt.includes("gsd_slice_complete"),
+      "must instruct calling gsd_slice_complete (was in guided-complete-slice.md)",
     );
     assert.ok(
       prompt.includes(base),

package/src/resources/extensions/gsd/tests/handler-worktree-write-isolation.test.ts

@@ -0,0 +1,57 @@
+/**
+ * Regression: when /gsd handlers run with cwd inside a worktree, writes must
+ * land in the worktree's .gsd/, not the parent project's .gsd/.
+ *
+ * The fix in 01464a97 replaced `process.cwd()` with `projectRoot()` to block
+ * $HOME pollution, but `projectRoot()` walks UP from a worktree path to the
+ * outer project root — breaking the worktree isolation invariant agents rely
+ * on. The corrected pattern: handlers use `currentDirectoryRoot()`, which
+ * preserves the active cwd (worktree or project) and still throws when cwd
+ * is $HOME.
+ */
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, realpathSync } from "node:fs";
+import { tmpdir, homedir } from "node:os";
+import { join } from "node:path";
+
+import { currentDirectoryRoot, projectRoot, withCommandCwd, GSDNoProjectError } from "../commands/context.ts";
+
+describe("handlers preserve worktree cwd via currentDirectoryRoot()", () => {
+  let project: string;
+  let worktree: string;
+
+  beforeEach(() => {
+    project = realpathSync(mkdtempSync(join(tmpdir(), "gsd-wt-iso-")));
+    mkdirSync(join(project, ".gsd"), { recursive: true });
+    mkdirSync(join(project, ".git"), { recursive: true });
+    worktree = join(project, ".gsd", "worktrees", "M001");
+    mkdirSync(join(worktree, ".gsd"), { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(project, { recursive: true, force: true });
+  });
+
+  test("currentDirectoryRoot() returns the worktree path when cwd is the worktree", async () => {
+    const resolved = await withCommandCwd(worktree, async () => currentDirectoryRoot());
+    assert.equal(resolved, worktree, "must keep worktree path so writes isolate");
+  });
+
+  test("projectRoot() walks UP from worktree to the project root (legacy semantics)", async () => {
+    const resolved = await withCommandCwd(worktree, async () => projectRoot());
+    assert.equal(resolved, project, "projectRoot intentionally returns project, not worktree");
+  });
+
+  test("currentDirectoryRoot() throws GSDNoProjectError when cwd is $HOME", async () => {
+    await assert.rejects(
+      withCommandCwd(homedir(), async () => currentDirectoryRoot()),
+      (err: unknown) => err instanceof GSDNoProjectError,
+    );
+  });
+
+  test("currentDirectoryRoot() returns project root when cwd is project root", async () => {
+    const resolved = await withCommandCwd(project, async () => currentDirectoryRoot());
+    assert.equal(resolved, project);
+  });
+});

package/src/resources/extensions/gsd/tests/integration/parallel-merge.test.ts

@@ -473,26 +473,26 @@ test("mergeAllCompleted — by-completion order respects startedAt", async () =>
 });
 
 // ═══════════════════════════════════════════════════════════════════════════════
-// Bug #2812 — determineMergeOrder should use worktree DB as source of truth
+// Bug #2812 — determineMergeOrder should use DB state as source of truth
 // ═══════════════════════════════════════════════════════════════════════════════
 
-/** Set up a worktree DB with a milestone marked complete */
-function setupWorktreeDb(basePath: string, mid: string): void {
-  const wtGsdDir = join(basePath, ".gsd", "worktrees", mid, ".gsd");
-  mkdirSync(wtGsdDir, { recursive: true });
-  const dbPath = join(wtGsdDir, "gsd.db");
+/** Set up canonical DB with a milestone marked complete and a worktree marker dir */
+function setupCanonicalDbWithWorktree(basePath: string, mid: string): void {
+  mkdirSync(join(basePath, ".gsd", "worktrees", mid), { recursive: true });
+  mkdirSync(join(basePath, ".gsd"), { recursive: true });
+  const dbPath = join(basePath, ".gsd", "gsd.db");
   openDatabase(dbPath);
   insertMilestone({ id: mid, title: `Milestone ${mid}`, status: "complete" });
   updateMilestoneStatus(mid, "complete", new Date().toISOString());
   closeDatabase();
 }
 
-test("determineMergeOrder — finds milestones completed in worktree DB even when worker state is 'error' (#2812)", () => {
+test("determineMergeOrder — finds milestones completed in canonical DB even when worker state is 'error' (#2812)", () => {
   const base = realpathSync(mkdtempSync(join(tmpdir(), "merge-db-bug-")));
   try {
     // Simulate the bug scenario: orchestrator has stale "error" state
-    // but the worktree DB shows milestone is actually complete.
-    setupWorktreeDb(base, "M011");
+    // but the canonical DB shows milestone is actually complete.
+    setupCanonicalDbWithWorktree(base, "M011");
 
     const workers = [
       makeWorker({ milestoneId: "M010", state: "error" }),
@@ -502,12 +502,12 @@ test("determineMergeOrder — finds milestones completed in worktree DB even whe
 
     const order = determineMergeOrder(workers, "sequential", base);
 
-    // M011 should be included because its worktree DB says status='complete'
+    // M011 should be included because the canonical DB says status='complete'
     assert.ok(
       order.includes("M011"),
-      `Expected M011 in merge order (worktree DB says complete), got: [${order}]`,
+      `Expected M011 in merge order (canonical DB says complete), got: [${order}]`,
     );
-    // M010 and M012 should NOT be included (no worktree DB with complete status)
+    // M010 and M012 should NOT be included (no canonical complete status)
     assert.ok(!order.includes("M010"), "M010 should not be in merge order (error, no DB)");
     assert.ok(!order.includes("M012"), "M012 should not be in merge order (running, no DB)");
   } finally {
@@ -529,7 +529,7 @@ test("determineMergeOrder — combines stopped workers and DB-complete milestone
   const base = realpathSync(mkdtempSync(join(tmpdir(), "merge-dedup-")));
   try {
     // M001 is stopped in orchestrator AND complete in worktree DB
-    setupWorktreeDb(base, "M001");
+    setupCanonicalDbWithWorktree(base, "M001");
 
     const workers = [
       makeWorker({ milestoneId: "M001", state: "stopped" }),
@@ -555,8 +555,8 @@ test("mergeAllCompleted — discovers DB-complete milestones when workers show e
     ]);
     setupRoadmap(repo, "M011", "Feature System", ["S01: Feature module"]);
 
-    // Set up worktree DB showing M011 is complete
-    setupWorktreeDb(repo, "M011");
+    // Set up canonical DB showing M011 is complete
+    setupCanonicalDbWithWorktree(repo, "M011");
 
     // Orchestrator thinks M011 is in error (stale state)
     const workers = [

package/src/resources/extensions/gsd/tests/integration/state-machine-edge-cases.test.ts

@@ -46,6 +46,7 @@ import {
   updateTaskStatus,
   updateSliceStatus,
   updateMilestoneStatus,
+  insertAssessment,
   insertReplanHistory,
   getReplanHistory,
   insertGateRow,
@@ -363,13 +364,13 @@ describe("state derivation failures", () => {
     const state2 = await deriveState(base);
     assert.equal(state2.phase, "executing", "cached result should still show executing");
 
-    // After explicit invalidation, should reflect the DB mutation and reconcile
-    // missing plan tasks instead of prematurely summarizing a partial DB row set.
+    // After explicit invalidation, DB rows remain authoritative; PLAN.md is a
+    // projection and must not import missing task rows.
     invalidateStateCache();
     const state3 = await deriveState(base);
-    assert.equal(state3.phase, "executing", "after cache invalidation should continue with the missing plan task");
-    assert.equal(state3.activeTask?.id, "T02", "missing plan task T02 should be imported and selected");
-    assert.deepEqual(state3.progress?.tasks, { done: 1, total: 2 });
+    assert.equal(state3.phase, "summarizing", "after cache invalidation should follow DB tasks only");
+    assert.equal(state3.activeTask, null, "disk-only plan task T02 should not be imported");
+    assert.deepEqual(state3.progress?.tasks, { done: 1, total: 1 });
   });
 
   test("corrupt ROADMAP: binary content does not crash deriveState", async () => {
@@ -486,12 +487,14 @@ describe("transition boundary failures", () => {
     writeFileSync(join(mDir, "M001-CONTEXT-DRAFT.md"), "# Draft\nSome draft.\n");
 
     openDatabase(join(base, ".gsd", "gsd.db"));
+    insertMilestone({ id: "M001", title: "Draft", status: "needs-discussion" });
     invalidateAllCaches();
     const state1 = await deriveState(base);
     assert.equal(state1.phase, "needs-discussion");
 
     // Now write the full CONTEXT (simulates discussion completion)
     writeFileSync(join(mDir, "M001-CONTEXT.md"), "# M001: Resolved\n\n## Purpose\nDone.\n");
+    updateMilestoneStatus("M001", "active");
 
     invalidateAllCaches();
     const state2 = await deriveState(base);
@@ -1148,6 +1151,13 @@ describe("completion and verification failures", () => {
     insertTask({ id: "T01", sliceId: "S01", milestoneId: "M001", status: "complete" });
     insertTask({ id: "T02", sliceId: "S01", milestoneId: "M001", status: "complete" });
     insertTask({ id: "T01", sliceId: "S02", milestoneId: "M001", status: "complete" });
+    insertAssessment({
+      path: "milestones/M001/M001-VALIDATION.md",
+      milestoneId: "M001",
+      status: "pass",
+      scope: "milestone-validation",
+      fullContent: "verdict: pass",
+    });
 
     invalidateAllCaches();
     const state = await deriveStateFromDb(base);