gsd-pi 2.78.1-dev.e9d88a536 → 2.78.1-dev.eccf86e27

package/src/resources/extensions/gsd/bootstrap/write-gate.ts

@@ -63,20 +63,42 @@ const QUEUE_SAFE_TOOLS = new Set([
  */
 const BASH_READ_ONLY_RE = /^\s*(cat|head|tail|less|more|wc|file|stat|du|df|which|type|echo|printf|ls|find|grep|rg|awk|sed\b(?!.*-i)|sort|uniq|diff|comm|tr|cut|tee\s+-a\s+\/dev\/null|git\s+(log|show|diff|status|branch|tag|remote|rev-parse|ls-files|blame|shortlog|describe|stash\s+list|config\s+--get|cat-file)|gh\s+(issue|pr|api|repo|release)\s+(view|list|diff|status|checks)|mkdir\s+-p\s+\.gsd|rtk\s|npm\s+run\s+(test|test:\w+|lint|lint:\w+|typecheck|type-check|type-check:\w+|check|verify|audit|outdated|format:check|ci|validate)\b|npm\s+(ls|list|info|view|show|outdated|audit|explain|doctor|ping|--version|-v)\b|npx\s|tsx\s|node\s+(--print|--version|-v\b)|python[23]?\s+(-c\s+'[^']*'|--version|-V\b|-m\s+(pip\s+show|pip\s+list|site))|pip[23]?\s+(show|list|freeze|check|index\s+versions)\b|jq\s|yq\s|curl\s+(-s\b|--silent\b)(?!\s+[^|>]*\s-[oO]\b)(?!\s+[^|>]*\s--output\b)[^|>]*$|openssl\s+(version|x509|s_client)|env\b|printenv\b|true\b|false\b)/;
 
-const verifiedDepthMilestones = new Set<string>();
-const verifiedApprovalGates = new Set<string>();
-let activeQueuePhase = false;
+interface InMemoryWriteGateState {
+  verifiedDepthMilestones: Set<string>;
+  verifiedApprovalGates: Set<string>;
+  activeQueuePhase: boolean;
+  pendingGateId: string | null;
+}
+
+function createEmptyWriteGateState(): InMemoryWriteGateState {
+  return {
+    verifiedDepthMilestones: new Set<string>(),
+    verifiedApprovalGates: new Set<string>(),
+    activeQueuePhase: false,
+    pendingGateId: null,
+  };
+}
+
+const writeGateStatesByBasePath = new Map<string, InMemoryWriteGateState>();
+
+function writeGateStateKey(basePath: string): string {
+  return resolve(basePath);
+}
+
+function getWriteGateState(basePath: string = process.cwd()): InMemoryWriteGateState {
+  const key = writeGateStateKey(basePath);
+  let state = writeGateStatesByBasePath.get(key);
+  if (!state) {
+    state = createEmptyWriteGateState();
+    writeGateStatesByBasePath.set(key, state);
+  }
+  return state;
+}
 
 /**
- * Discussion gate enforcement state.
- *
- * When ask_user_questions is called with a recognized gate question ID,
- * we track the pending gate. Until the gate is confirmed (user selects the
- * first/recommended option), all non-read-only tool calls are blocked.
- * This mechanically prevents the model from rationalizing past failed or
- * cancelled gate questions.
+ * Discussion gate enforcement state is scoped per basePath so multiple
+ * workspaces can coexist in the same process without sharing gate state.
  */
-let pendingGateId: string | null = null;
 
 /**
  * Recognized gate question ID patterns.
@@ -119,25 +141,26 @@ function shouldPersistWriteGateSnapshot(env: NodeJS.ProcessEnv = process.env): b
   return v !== "0" && v !== "false";
 }
 
-function writeGateSnapshotPath(basePath: string = process.cwd()): string {
+function writeGateSnapshotPath(basePath: string): string {
   return join(basePath, ".gsd", "runtime", "write-gate-state.json");
 }
 
-function currentWriteGateSnapshot(): WriteGateSnapshot {
+function currentWriteGateSnapshot(basePath: string = process.cwd()): WriteGateSnapshot {
+  const state = getWriteGateState(basePath);
   return {
-    verifiedDepthMilestones: [...verifiedDepthMilestones].sort(),
-    verifiedApprovalGates: [...verifiedApprovalGates].sort(),
-    activeQueuePhase,
-    pendingGateId,
+    verifiedDepthMilestones: [...state.verifiedDepthMilestones].sort(),
+    verifiedApprovalGates: [...state.verifiedApprovalGates].sort(),
+    activeQueuePhase: state.activeQueuePhase,
+    pendingGateId: state.pendingGateId,
   };
 }
 
-function persistWriteGateSnapshot(basePath: string = process.cwd()): void {
+function persistWriteGateSnapshot(basePath: string): void {
   if (!shouldPersistWriteGateSnapshot()) return;
   const path = writeGateSnapshotPath(basePath);
   mkdirSync(join(basePath, ".gsd", "runtime"), { recursive: true });
   const tempPath = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  writeFileSync(tempPath, JSON.stringify(currentWriteGateSnapshot(), null, 2), "utf-8");
+  writeFileSync(tempPath, JSON.stringify(currentWriteGateSnapshot(basePath), null, 2), "utf-8");
   try {
     renameSync(tempPath, path);
   } catch (err: unknown) {
@@ -152,7 +175,7 @@ function persistWriteGateSnapshot(basePath: string = process.cwd()): void {
   }
 }
 
-function clearPersistedWriteGateSnapshot(basePath: string = process.cwd()): void {
+function clearPersistedWriteGateSnapshot(basePath: string): void {
   if (!shouldPersistWriteGateSnapshot()) return;
   const path = writeGateSnapshotPath(basePath);
   try {
@@ -185,32 +208,35 @@ const EMPTY_SNAPSHOT: WriteGateSnapshot = {
   pendingGateId: null,
 };
 
-export function loadWriteGateSnapshot(basePath: string = process.cwd()): WriteGateSnapshot {
+export function loadWriteGateSnapshot(basePath: string): WriteGateSnapshot {
   const path = writeGateSnapshotPath(basePath);
   if (!existsSync(path)) {
     // When persist mode is active and the file has been deleted, treat it as a
     // full state reset so deleting the file clears the HARD BLOCK gate.
     // In non-persist mode the file is never written, so fall back to in-memory.
     if (shouldPersistWriteGateSnapshot()) return EMPTY_SNAPSHOT;
-    return currentWriteGateSnapshot();
+    return currentWriteGateSnapshot(basePath);
   }
   try {
     return normalizeWriteGateSnapshot(JSON.parse(readFileSync(path, "utf-8")));
   } catch {
-    return currentWriteGateSnapshot();
+    return currentWriteGateSnapshot(basePath);
   }
 }
 
-export function isDepthVerified(): boolean {
-  return verifiedDepthMilestones.size > 0;
+export function isDepthVerified(basePath: string = process.cwd()): boolean {
+  return getWriteGateState(basePath).verifiedDepthMilestones.size > 0;
 }
 
 /**
  * Check whether a specific milestone has passed depth verification.
  */
-export function isMilestoneDepthVerified(milestoneId: string | null | undefined): boolean {
+export function isMilestoneDepthVerified(
+  milestoneId: string | null | undefined,
+  basePath: string = process.cwd(),
+): boolean {
   if (!milestoneId) return false;
-  return verifiedDepthMilestones.has(milestoneId);
+  return getWriteGateState(basePath).verifiedDepthMilestones.has(milestoneId);
 }
 
 export function isMilestoneDepthVerifiedInSnapshot(
@@ -221,39 +247,37 @@ export function isMilestoneDepthVerifiedInSnapshot(
   return snapshot.verifiedDepthMilestones.includes(milestoneId);
 }
 
-export function isQueuePhaseActive(): boolean {
-  return activeQueuePhase;
+export function isQueuePhaseActive(basePath: string = process.cwd()): boolean {
+  return getWriteGateState(basePath).activeQueuePhase;
 }
 
-export function setQueuePhaseActive(active: boolean): void {
-  activeQueuePhase = active;
-  persistWriteGateSnapshot();
+export function setQueuePhaseActive(active: boolean, basePath: string): void {
+  getWriteGateState(basePath).activeQueuePhase = active;
+  persistWriteGateSnapshot(basePath);
 }
 
-export function resetWriteGateState(): void {
-  verifiedDepthMilestones.clear();
-  verifiedApprovalGates.clear();
-  pendingGateId = null;
-  persistWriteGateSnapshot();
+export function resetWriteGateState(basePath: string): void {
+  const state = getWriteGateState(basePath);
+  state.verifiedDepthMilestones.clear();
+  state.verifiedApprovalGates.clear();
+  state.pendingGateId = null;
+  persistWriteGateSnapshot(basePath);
 }
 
-export function clearDiscussionFlowState(): void {
-  verifiedDepthMilestones.clear();
-  verifiedApprovalGates.clear();
-  activeQueuePhase = false;
-  pendingGateId = null;
-  clearPersistedWriteGateSnapshot();
+export function clearDiscussionFlowState(basePath: string): void {
+  writeGateStatesByBasePath.delete(writeGateStateKey(basePath));
+  clearPersistedWriteGateSnapshot(basePath);
 }
 
 export function markDepthVerified(milestoneId?: string | null, basePath: string = process.cwd()): void {
   if (!milestoneId) return;
-  verifiedDepthMilestones.add(milestoneId);
+  getWriteGateState(basePath).verifiedDepthMilestones.add(milestoneId);
   persistWriteGateSnapshot(basePath);
 }
 
 export function markApprovalGateVerified(gateId?: string | null, basePath: string = process.cwd()): void {
   if (!gateId) return;
-  verifiedApprovalGates.add(gateId);
+  getWriteGateState(basePath).verifiedApprovalGates.add(gateId);
   persistWriteGateSnapshot(basePath);
 }
 
@@ -292,27 +316,28 @@ function extractContextMilestoneId(inputPath: string): string | null {
 /**
  * Mark a gate as pending (called when ask_user_questions is invoked with a gate ID).
  */
-export function setPendingGate(gateId: string): void {
-  pendingGateId = gateId;
-  verifiedApprovalGates.delete(gateId);
+export function setPendingGate(gateId: string, basePath: string): void {
+  const state = getWriteGateState(basePath);
+  state.pendingGateId = gateId;
+  state.verifiedApprovalGates.delete(gateId);
   const milestoneId = extractDepthVerificationMilestoneId(gateId);
-  if (milestoneId) verifiedDepthMilestones.delete(milestoneId);
-  persistWriteGateSnapshot();
+  if (milestoneId) state.verifiedDepthMilestones.delete(milestoneId);
+  persistWriteGateSnapshot(basePath);
 }
 
 /**
  * Clear the pending gate (called when the user confirms).
  */
-export function clearPendingGate(): void {
-  pendingGateId = null;
-  persistWriteGateSnapshot();
+export function clearPendingGate(basePath: string): void {
+  getWriteGateState(basePath).pendingGateId = null;
+  persistWriteGateSnapshot(basePath);
 }
 
 /**
  * Get the currently pending gate, if any.
  */
-export function getPendingGate(): string | null {
-  return pendingGateId;
+export function getPendingGate(basePath: string = process.cwd()): string | null {
+  return getWriteGateState(basePath).pendingGateId;
 }
 
 /**

package/src/resources/extensions/gsd/crash-recovery.ts

@@ -1,21 +1,43 @@
 /**
- * GSD Crash Recovery
+ * GSD Crash Recovery (Phase C pt 2 — DB-backed)
  *
- * Detects interrupted auto-mode sessions via a lock file.
- * Written on auto-start, updated on each unit dispatch, deleted on clean stop.
- * If the lock file exists on next startup, the previous session crashed.
+ * Detects interrupted auto-mode sessions via the DB-backed workers +
+ * unit_dispatches + runtime_kv tables. The auto.lock file is gone; the
+ * `LockData` shape is preserved for backward compatibility with callers
+ * (auto.ts, doctor checks, interrupted-session.ts), but the contents are
+ * now synthesized from:
  *
- * The lock records the pi session file path so crash recovery can read the
- * surviving JSONL (pi appends entries incrementally via appendFileSync,
- * so the file on disk reflects every tool call up to the crash point).
+ *   - workers.pid / .started_at / .last_heartbeat_at  → liveness + age
+ *   - unit_dispatches.unit_type / .unit_id / .started_at  → what was running
+ *   - runtime_kv("worker", workerId, "session_file")  → pi session JSONL path
+ *
+ * "Crashed" is detected via workers.status='active' + heartbeat past TTL,
+ * cross-checked with the OS PID via isLockProcessAlive(). When the DB is
+ * unavailable (fresh project before init), all readers return null and
+ * writers no-op — preserving the historical "no lock means no prior
+ * crash" semantics.
+ *
+ * The journal-based emitCrashRecoveredUnitEnd is unchanged from the file
+ * era — it queries the journal independently of the lock mechanism.
  */
 
+import {
+  emitJournalEvent,
+  queryJournal,
+} from "./journal.js";
 import { readFileSync, unlinkSync, existsSync } from "node:fs";
 import { join } from "node:path";
-import { gsdRoot } from "./paths.js";
+import {
+  findStaleWorkerForProject,
+  getAllAutoWorkers,
+  type AutoWorkerRow,
+} from "./db/auto-workers.js";
+import { getLatestForUnit, type DispatchStatus } from "./db/unit-dispatches.js";
+import { getRuntimeKv, setRuntimeKv, deleteRuntimeKv } from "./db/runtime-kv.js";
+import { _getAdapter, isDbAvailable } from "./gsd-db.js";
+import { gsdRoot, normalizeRealPath } from "./paths.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { effectiveLockFile } from "./session-lock.js";
-import { emitJournalEvent, queryJournal } from "./journal.js";
 
 export interface LockData {
   pid: number;
@@ -27,11 +49,91 @@ export interface LockData {
   sessionFile?: string;
 }
 
+const SESSION_FILE_KV_KEY = "session_file";
+
 function lockPath(basePath: string): string {
   return join(gsdRoot(basePath), effectiveLockFile());
 }
 
-/** Write or update the lock file with current auto-mode state. */
+function readLegacyLock(basePath: string): LockData | null {
+  try {
+    const p = lockPath(basePath);
+    if (!existsSync(p)) return null;
+    return JSON.parse(readFileSync(p, "utf-8")) as LockData;
+  } catch {
+    return null;
+  }
+}
+
+function findActiveWorkerForCurrentProcess(
+  projectRootRealpath: string,
+): AutoWorkerRow | null {
+  if (!isDbAvailable()) return null;
+  const workers = getAllAutoWorkers();
+  for (const worker of workers) {
+    if (
+      worker.pid === process.pid
+      && worker.project_root_realpath === projectRootRealpath
+    ) {
+      return worker;
+    }
+  }
+  return null;
+}
+
+/**
+ * Look up the most recent dispatch row for a worker, regardless of status.
+ * Returns null if the worker has no dispatch history yet (e.g. crashed
+ * during bootstrap before claiming the first unit).
+ */
+function getLatestDispatchForWorker(workerId: string):
+  | { unit_type: string; unit_id: string; started_at: string; status: DispatchStatus }
+  | null {
+  if (!isDbAvailable()) return null;
+  const db = _getAdapter()!;
+  const row = db.prepare(
+    `SELECT unit_type, unit_id, started_at, status
+     FROM unit_dispatches
+     WHERE worker_id = :worker_id
+     ORDER BY id DESC
+     LIMIT 1`,
+  ).get({ ":worker_id": workerId }) as
+    | { unit_type: string; unit_id: string; started_at: string; status: DispatchStatus }
+    | undefined;
+  return row ?? null;
+}
+
+function workerToLockData(worker: AutoWorkerRow): LockData {
+  const dispatch = getLatestDispatchForWorker(worker.worker_id);
+  const sessionFile =
+    getRuntimeKv<string>("worker", worker.worker_id, SESSION_FILE_KV_KEY) ?? undefined;
+  return {
+    pid: worker.pid,
+    startedAt: worker.started_at,
+    // Pre-Phase-C-pt-2 default: when no dispatch row exists yet (bootstrap
+    // crash), report unitType="starting", unitId="bootstrap" — same shape
+    // the file-based writer used to produce.
+    unitType: dispatch?.unit_type ?? "starting",
+    unitId: dispatch?.unit_id ?? "bootstrap",
+    unitStartedAt: dispatch?.started_at ?? worker.started_at,
+    sessionFile,
+  };
+}
+
+/**
+ * Write or update the lock state for the current auto-mode session.
+ *
+ * Phase C pt 2: the only persistent state this function adds beyond what
+ * the workers + unit_dispatches tables already track is the pi session
+ * JSONL path, which lands in runtime_kv (worker scope, key
+ * "session_file"). The pid/startedAt/unitType/unitId/unitStartedAt are
+ * recorded by registerAutoWorker / heartbeatAutoWorker / recordDispatchClaim
+ * already.
+ *
+ * basePath is unused by the new implementation (kept as a parameter for
+ * back-compat with the 15+ call sites) — the worker is identified by
+ * pid + project_root_realpath in the workers table.
+ */
 export function writeLock(
   basePath: string,
   unitType: string,
@@ -47,51 +149,84 @@ export function writeLock(
       unitStartedAt: new Date().toISOString(),
       sessionFile,
     };
-    const lp = lockPath(basePath);
-    atomicWriteSync(lp, JSON.stringify(data, null, 2));
-  } catch (e) { /* non-fatal: lock write failure */ void e; }
+    atomicWriteSync(lockPath(basePath), JSON.stringify(data, null, 2));
+  } catch {
+    // Best-effort — never throw from the lock writer.
+  }
+
+  if (!isDbAvailable() || !sessionFile) return;
+  try {
+    const projectRoot = normalizeRealPath(basePath);
+    const worker = findActiveWorkerForCurrentProcess(projectRoot);
+    if (!worker) return;
+    setRuntimeKv("worker", worker.worker_id, SESSION_FILE_KV_KEY, sessionFile);
+  } catch {
+    // Best-effort — never throw from the lock writer.
+  }
 }
 
-/** Remove the lock file on clean stop. */
+/**
+ * Phase C pt 2: clearLock no longer deletes a file. The cleanup path
+ * (markWorkerStopping in stopAuto) flips the workers row to 'stopping'.
+ * This function additionally drops the session_file runtime_kv row for
+ * the current worker so a follow-up crash detection doesn't pick up a
+ * stale session-file pointer.
+ */
 export function clearLock(basePath: string): void {
   try {
     const p = lockPath(basePath);
     if (existsSync(p)) unlinkSync(p);
-  } catch (e) { /* non-fatal: lock clear failure */ void e; }
+  } catch {
+    // Best-effort.
+  }
+
+  if (!isDbAvailable()) return;
+  try {
+    const projectRoot = normalizeRealPath(basePath);
+    const worker = findActiveWorkerForCurrentProcess(projectRoot);
+    if (!worker) return;
+    deleteRuntimeKv("worker", worker.worker_id, SESSION_FILE_KV_KEY);
+  } catch {
+    // Best-effort.
+  }
 }
 
-/** Check if a crash lock exists and return its data. */
+/**
+ * Detect a previous crashed auto-mode session.
+ *
+ * Phase C pt 2: synthesized from workers (status='active' + lapsed
+ * heartbeat) + unit_dispatches (most recent for that worker) +
+ * runtime_kv (session_file). Returns null when no stale worker exists
+ * or the DB is unavailable.
+ */
 export function readCrashLock(basePath: string): LockData | null {
-  try {
-    const p = lockPath(basePath);
-    if (!existsSync(p)) return null;
-    const raw = readFileSync(p, "utf-8");
-    return JSON.parse(raw) as LockData;
-  } catch (e) {
-    /* non-fatal: corrupt or unreadable lock file */ void e;
-    return null;
+  if (isDbAvailable()) {
+    try {
+      const projectRoot = normalizeRealPath(basePath);
+      const stale = findStaleWorkerForProject(projectRoot);
+      if (stale) return workerToLockData(stale);
+    } catch {
+      // Fall through to the legacy lock-file compatibility path.
+    }
   }
+  return readLegacyLock(basePath);
 }
 
 /**
  * Check whether the process that wrote the lock is still running.
  * Uses `process.kill(pid, 0)` which sends no signal but checks liveness.
  * Returns true if the PID matches our own — we are the lock holder (#2470).
+ *
+ * Unchanged from the file-based era — pure stateless OS check.
  */
 export function isLockProcessAlive(lock: LockData): boolean {
   const pid = lock.pid;
   if (!Number.isInteger(pid) || pid <= 0) return false;
-  // Our own PID means WE hold this lock — we are alive. (#2470)
-  // Callers that need to distinguish "our lock" from "someone else's lock"
-  // (e.g. startAuto checking for a prior crashed session with a recycled PID)
-  // already guard with `crashLock.pid !== process.pid` before calling us.
   if (pid === process.pid) return true;
   try {
     process.kill(pid, 0);
     return true;
   } catch (err) {
-    // EPERM means the process exists but we lack permission — treat as alive.
-    // ESRCH means the process does not exist — treat as dead (stale lock).
     if ((err as NodeJS.ErrnoException).code === "EPERM") return true;
     return false;
   }
@@ -106,7 +241,6 @@ export function formatCrashInfo(lock: LockData): string {
     `  PID: ${lock.pid}`,
   ];
 
-  // Add recovery guidance based on what was happening when it crashed
   if (lock.unitType === "starting" && lock.unitId === "bootstrap") {
     lines.push(`No work was lost. Run /gsd auto to restart.`);
   } else if (lock.unitType.includes("research") || lock.unitType.includes("plan")) {
@@ -122,22 +256,14 @@ export function formatCrashInfo(lock: LockData): string {
 
 /**
  * Emit a synthetic unit-end event for a unit that crashed without emitting its own.
- *
- * Queries the journal to find the most recent unit-start for the crashed unit.
- * If a matching unit-end already exists (e.g. the hard timeout fired), this is a
- * no-op. Called during crash recovery, before clearing the stale lock.
- *
- * Addresses the gap reported in #3348 where `unit-start` was emitted but no
- * `unit-end` followed — side effects landed but the worker died before closeout.
+ * Unchanged from the file era — operates on the journal, not the lock.
  */
 export function emitCrashRecoveredUnitEnd(basePath: string, lock: LockData): void {
-  // Skip bootstrap / starting pseudo-units — they have no meaningful unit-start event.
   if (!lock.unitType || !lock.unitId || lock.unitType === "starting") return;
 
   try {
     const all = queryJournal(basePath);
 
-    // Find the most recent unit-start for this unitId
     const starts = all.filter(
       (e) => e.eventType === "unit-start" && e.data?.unitId === lock.unitId,
     );
@@ -145,7 +271,6 @@ export function emitCrashRecoveredUnitEnd(basePath: string, lock: LockData): voi
 
     const lastStart = starts[starts.length - 1];
 
-    // Check if a unit-end was already emitted (e.g. hard timeout fired after the crash)
     const alreadyClosed = all.some(
       (e) =>
         e.eventType === "unit-end" &&
@@ -155,7 +280,6 @@ export function emitCrashRecoveredUnitEnd(basePath: string, lock: LockData): voi
     );
     if (alreadyClosed) return;
 
-    // Find the highest seq in this flow for monotonic ordering
     const maxSeq = all
       .filter((e) => e.flowId === lastStart.flowId)
       .reduce((max, e) => Math.max(max, e.seq), lastStart.seq);
@@ -174,6 +298,16 @@ export function emitCrashRecoveredUnitEnd(basePath: string, lock: LockData): voi
       causedBy: { flowId: lastStart.flowId, seq: lastStart.seq },
     });
   } catch {
-    // Never throw from crash recovery path — journal failure must not block recovery
+    // Never throw from crash recovery path.
   }
 }
+
+/**
+ * Used by the doctor checks (doctor-runtime-checks.ts, doctor-proactive.ts)
+ * to enumerate stale workers across all projects this DB knows about.
+ * Phase C pt 2 export — surface for the same diagnostics that previously
+ * iterated `auto.lock` files.
+ */
+export function findStaleAutoWorker(basePath: string): LockData | null {
+  return readCrashLock(basePath);
+}