gsd-pi 2.78.1-dev.e9d88a536 → 2.78.1-dev.eccf86e27

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -55,19 +55,31 @@ const QUEUE_SAFE_TOOLS = new Set([
  *   true / false        — shell no-ops / test exit codes
  */
 const BASH_READ_ONLY_RE = /^\s*(cat|head|tail|less|more|wc|file|stat|du|df|which|type|echo|printf|ls|find|grep|rg|awk|sed\b(?!.*-i)|sort|uniq|diff|comm|tr|cut|tee\s+-a\s+\/dev\/null|git\s+(log|show|diff|status|branch|tag|remote|rev-parse|ls-files|blame|shortlog|describe|stash\s+list|config\s+--get|cat-file)|gh\s+(issue|pr|api|repo|release)\s+(view|list|diff|status|checks)|mkdir\s+-p\s+\.gsd|rtk\s|npm\s+run\s+(test|test:\w+|lint|lint:\w+|typecheck|type-check|type-check:\w+|check|verify|audit|outdated|format:check|ci|validate)\b|npm\s+(ls|list|info|view|show|outdated|audit|explain|doctor|ping|--version|-v)\b|npx\s|tsx\s|node\s+(--print|--version|-v\b)|python[23]?\s+(-c\s+'[^']*'|--version|-V\b|-m\s+(pip\s+show|pip\s+list|site))|pip[23]?\s+(show|list|freeze|check|index\s+versions)\b|jq\s|yq\s|curl\s+(-s\b|--silent\b)(?!\s+[^|>]*\s-[oO]\b)(?!\s+[^|>]*\s--output\b)[^|>]*$|openssl\s+(version|x509|s_client)|env\b|printenv\b|true\b|false\b)/;
-const verifiedDepthMilestones = new Set();
-const verifiedApprovalGates = new Set();
-let activeQueuePhase = false;
+function createEmptyWriteGateState() {
+    return {
+        verifiedDepthMilestones: new Set(),
+        verifiedApprovalGates: new Set(),
+        activeQueuePhase: false,
+        pendingGateId: null,
+    };
+}
+const writeGateStatesByBasePath = new Map();
+function writeGateStateKey(basePath) {
+    return resolve(basePath);
+}
+function getWriteGateState(basePath = process.cwd()) {
+    const key = writeGateStateKey(basePath);
+    let state = writeGateStatesByBasePath.get(key);
+    if (!state) {
+        state = createEmptyWriteGateState();
+        writeGateStatesByBasePath.set(key, state);
+    }
+    return state;
+}
 /**
- * Discussion gate enforcement state.
- *
- * When ask_user_questions is called with a recognized gate question ID,
- * we track the pending gate. Until the gate is confirmed (user selects the
- * first/recommended option), all non-read-only tool calls are blocked.
- * This mechanically prevents the model from rationalizing past failed or
- * cancelled gate questions.
+ * Discussion gate enforcement state is scoped per basePath so multiple
+ * workspaces can coexist in the same process without sharing gate state.
  */
-let pendingGateId = null;
 /**
  * Recognized gate question ID patterns.
  * These appear in discuss.md (depth/requirements/roadmap).
@@ -99,24 +111,25 @@ function shouldPersistWriteGateSnapshot(env = process.env) {
     const v = env.GSD_PERSIST_WRITE_GATE_STATE;
     return v !== "0" && v !== "false";
 }
-function writeGateSnapshotPath(basePath = process.cwd()) {
+function writeGateSnapshotPath(basePath) {
     return join(basePath, ".gsd", "runtime", "write-gate-state.json");
 }
-function currentWriteGateSnapshot() {
+function currentWriteGateSnapshot(basePath = process.cwd()) {
+    const state = getWriteGateState(basePath);
     return {
-        verifiedDepthMilestones: [...verifiedDepthMilestones].sort(),
-        verifiedApprovalGates: [...verifiedApprovalGates].sort(),
-        activeQueuePhase,
-        pendingGateId,
+        verifiedDepthMilestones: [...state.verifiedDepthMilestones].sort(),
+        verifiedApprovalGates: [...state.verifiedApprovalGates].sort(),
+        activeQueuePhase: state.activeQueuePhase,
+        pendingGateId: state.pendingGateId,
     };
 }
-function persistWriteGateSnapshot(basePath = process.cwd()) {
+function persistWriteGateSnapshot(basePath) {
     if (!shouldPersistWriteGateSnapshot())
         return;
     const path = writeGateSnapshotPath(basePath);
     mkdirSync(join(basePath, ".gsd", "runtime"), { recursive: true });
     const tempPath = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-    writeFileSync(tempPath, JSON.stringify(currentWriteGateSnapshot(), null, 2), "utf-8");
+    writeFileSync(tempPath, JSON.stringify(currentWriteGateSnapshot(basePath), null, 2), "utf-8");
     try {
         renameSync(tempPath, path);
     }
@@ -132,7 +145,7 @@ function persistWriteGateSnapshot(basePath = process.cwd()) {
         }
     }
 }
-function clearPersistedWriteGateSnapshot(basePath = process.cwd()) {
+function clearPersistedWriteGateSnapshot(basePath) {
     if (!shouldPersistWriteGateSnapshot())
         return;
     const path = writeGateSnapshotPath(basePath);
@@ -164,7 +177,7 @@ const EMPTY_SNAPSHOT = {
     activeQueuePhase: false,
     pendingGateId: null,
 };
-export function loadWriteGateSnapshot(basePath = process.cwd()) {
+export function loadWriteGateSnapshot(basePath) {
     const path = writeGateSnapshotPath(basePath);
     if (!existsSync(path)) {
         // When persist mode is active and the file has been deleted, treat it as a
@@ -172,61 +185,59 @@ export function loadWriteGateSnapshot(basePath = process.cwd()) {
         // In non-persist mode the file is never written, so fall back to in-memory.
         if (shouldPersistWriteGateSnapshot())
             return EMPTY_SNAPSHOT;
-        return currentWriteGateSnapshot();
+        return currentWriteGateSnapshot(basePath);
     }
     try {
         return normalizeWriteGateSnapshot(JSON.parse(readFileSync(path, "utf-8")));
     }
     catch {
-        return currentWriteGateSnapshot();
+        return currentWriteGateSnapshot(basePath);
     }
 }
-export function isDepthVerified() {
-    return verifiedDepthMilestones.size > 0;
+export function isDepthVerified(basePath = process.cwd()) {
+    return getWriteGateState(basePath).verifiedDepthMilestones.size > 0;
 }
 /**
  * Check whether a specific milestone has passed depth verification.
  */
-export function isMilestoneDepthVerified(milestoneId) {
+export function isMilestoneDepthVerified(milestoneId, basePath = process.cwd()) {
     if (!milestoneId)
         return false;
-    return verifiedDepthMilestones.has(milestoneId);
+    return getWriteGateState(basePath).verifiedDepthMilestones.has(milestoneId);
 }
 export function isMilestoneDepthVerifiedInSnapshot(snapshot, milestoneId) {
     if (!milestoneId)
         return false;
     return snapshot.verifiedDepthMilestones.includes(milestoneId);
 }
-export function isQueuePhaseActive() {
-    return activeQueuePhase;
+export function isQueuePhaseActive(basePath = process.cwd()) {
+    return getWriteGateState(basePath).activeQueuePhase;
 }
-export function setQueuePhaseActive(active) {
-    activeQueuePhase = active;
-    persistWriteGateSnapshot();
+export function setQueuePhaseActive(active, basePath) {
+    getWriteGateState(basePath).activeQueuePhase = active;
+    persistWriteGateSnapshot(basePath);
 }
-export function resetWriteGateState() {
-    verifiedDepthMilestones.clear();
-    verifiedApprovalGates.clear();
-    pendingGateId = null;
-    persistWriteGateSnapshot();
+export function resetWriteGateState(basePath) {
+    const state = getWriteGateState(basePath);
+    state.verifiedDepthMilestones.clear();
+    state.verifiedApprovalGates.clear();
+    state.pendingGateId = null;
+    persistWriteGateSnapshot(basePath);
 }
-export function clearDiscussionFlowState() {
-    verifiedDepthMilestones.clear();
-    verifiedApprovalGates.clear();
-    activeQueuePhase = false;
-    pendingGateId = null;
-    clearPersistedWriteGateSnapshot();
+export function clearDiscussionFlowState(basePath) {
+    writeGateStatesByBasePath.delete(writeGateStateKey(basePath));
+    clearPersistedWriteGateSnapshot(basePath);
 }
 export function markDepthVerified(milestoneId, basePath = process.cwd()) {
     if (!milestoneId)
         return;
-    verifiedDepthMilestones.add(milestoneId);
+    getWriteGateState(basePath).verifiedDepthMilestones.add(milestoneId);
     persistWriteGateSnapshot(basePath);
 }
 export function markApprovalGateVerified(gateId, basePath = process.cwd()) {
     if (!gateId)
         return;
-    verifiedApprovalGates.add(gateId);
+    getWriteGateState(basePath).verifiedApprovalGates.add(gateId);
     persistWriteGateSnapshot(basePath);
 }
 export function isApprovalGateVerifiedInSnapshot(snapshot, gateId) {
@@ -258,26 +269,27 @@ function extractContextMilestoneId(inputPath) {
 /**
  * Mark a gate as pending (called when ask_user_questions is invoked with a gate ID).
  */
-export function setPendingGate(gateId) {
-    pendingGateId = gateId;
-    verifiedApprovalGates.delete(gateId);
+export function setPendingGate(gateId, basePath) {
+    const state = getWriteGateState(basePath);
+    state.pendingGateId = gateId;
+    state.verifiedApprovalGates.delete(gateId);
     const milestoneId = extractDepthVerificationMilestoneId(gateId);
     if (milestoneId)
-        verifiedDepthMilestones.delete(milestoneId);
-    persistWriteGateSnapshot();
+        state.verifiedDepthMilestones.delete(milestoneId);
+    persistWriteGateSnapshot(basePath);
 }
 /**
  * Clear the pending gate (called when the user confirms).
  */
-export function clearPendingGate() {
-    pendingGateId = null;
-    persistWriteGateSnapshot();
+export function clearPendingGate(basePath) {
+    getWriteGateState(basePath).pendingGateId = null;
+    persistWriteGateSnapshot(basePath);
 }
 /**
  * Get the currently pending gate, if any.
  */
-export function getPendingGate() {
-    return pendingGateId;
+export function getPendingGate(basePath = process.cwd()) {
+    return getWriteGateState(basePath).pendingGateId;
 }
 /**
  * Check whether a tool call should be blocked because a discussion gate

package/dist/resources/extensions/gsd/crash-recovery.js

@@ -1,24 +1,106 @@
 /**
- * GSD Crash Recovery
+ * GSD Crash Recovery (Phase C pt 2 — DB-backed)
  *
- * Detects interrupted auto-mode sessions via a lock file.
- * Written on auto-start, updated on each unit dispatch, deleted on clean stop.
- * If the lock file exists on next startup, the previous session crashed.
+ * Detects interrupted auto-mode sessions via the DB-backed workers +
+ * unit_dispatches + runtime_kv tables. The auto.lock file is gone; the
+ * `LockData` shape is preserved for backward compatibility with callers
+ * (auto.ts, doctor checks, interrupted-session.ts), but the contents are
+ * now synthesized from:
  *
- * The lock records the pi session file path so crash recovery can read the
- * surviving JSONL (pi appends entries incrementally via appendFileSync,
- * so the file on disk reflects every tool call up to the crash point).
+ *   - workers.pid / .started_at / .last_heartbeat_at  → liveness + age
+ *   - unit_dispatches.unit_type / .unit_id / .started_at  → what was running
+ *   - runtime_kv("worker", workerId, "session_file")  → pi session JSONL path
+ *
+ * "Crashed" is detected via workers.status='active' + heartbeat past TTL,
+ * cross-checked with the OS PID via isLockProcessAlive(). When the DB is
+ * unavailable (fresh project before init), all readers return null and
+ * writers no-op — preserving the historical "no lock means no prior
+ * crash" semantics.
+ *
+ * The journal-based emitCrashRecoveredUnitEnd is unchanged from the file
+ * era — it queries the journal independently of the lock mechanism.
  */
+import { emitJournalEvent, queryJournal, } from "./journal.js";
 import { readFileSync, unlinkSync, existsSync } from "node:fs";
 import { join } from "node:path";
-import { gsdRoot } from "./paths.js";
+import { findStaleWorkerForProject, getAllAutoWorkers, } from "./db/auto-workers.js";
+import { getRuntimeKv, setRuntimeKv, deleteRuntimeKv } from "./db/runtime-kv.js";
+import { _getAdapter, isDbAvailable } from "./gsd-db.js";
+import { gsdRoot, normalizeRealPath } from "./paths.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { effectiveLockFile } from "./session-lock.js";
-import { emitJournalEvent, queryJournal } from "./journal.js";
+const SESSION_FILE_KV_KEY = "session_file";
 function lockPath(basePath) {
     return join(gsdRoot(basePath), effectiveLockFile());
 }
-/** Write or update the lock file with current auto-mode state. */
+function readLegacyLock(basePath) {
+    try {
+        const p = lockPath(basePath);
+        if (!existsSync(p))
+            return null;
+        return JSON.parse(readFileSync(p, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function findActiveWorkerForCurrentProcess(projectRootRealpath) {
+    if (!isDbAvailable())
+        return null;
+    const workers = getAllAutoWorkers();
+    for (const worker of workers) {
+        if (worker.pid === process.pid
+            && worker.project_root_realpath === projectRootRealpath) {
+            return worker;
+        }
+    }
+    return null;
+}
+/**
+ * Look up the most recent dispatch row for a worker, regardless of status.
+ * Returns null if the worker has no dispatch history yet (e.g. crashed
+ * during bootstrap before claiming the first unit).
+ */
+function getLatestDispatchForWorker(workerId) {
+    if (!isDbAvailable())
+        return null;
+    const db = _getAdapter();
+    const row = db.prepare(`SELECT unit_type, unit_id, started_at, status
+     FROM unit_dispatches
+     WHERE worker_id = :worker_id
+     ORDER BY id DESC
+     LIMIT 1`).get({ ":worker_id": workerId });
+    return row ?? null;
+}
+function workerToLockData(worker) {
+    const dispatch = getLatestDispatchForWorker(worker.worker_id);
+    const sessionFile = getRuntimeKv("worker", worker.worker_id, SESSION_FILE_KV_KEY) ?? undefined;
+    return {
+        pid: worker.pid,
+        startedAt: worker.started_at,
+        // Pre-Phase-C-pt-2 default: when no dispatch row exists yet (bootstrap
+        // crash), report unitType="starting", unitId="bootstrap" — same shape
+        // the file-based writer used to produce.
+        unitType: dispatch?.unit_type ?? "starting",
+        unitId: dispatch?.unit_id ?? "bootstrap",
+        unitStartedAt: dispatch?.started_at ?? worker.started_at,
+        sessionFile,
+    };
+}
+/**
+ * Write or update the lock state for the current auto-mode session.
+ *
+ * Phase C pt 2: the only persistent state this function adds beyond what
+ * the workers + unit_dispatches tables already track is the pi session
+ * JSONL path, which lands in runtime_kv (worker scope, key
+ * "session_file"). The pid/startedAt/unitType/unitId/unitStartedAt are
+ * recorded by registerAutoWorker / heartbeatAutoWorker / recordDispatchClaim
+ * already.
+ *
+ * basePath is unused by the new implementation (kept as a parameter for
+ * back-compat with the 15+ call sites) — the worker is identified by
+ * pid + project_root_realpath in the workers table.
+ */
 export function writeLock(basePath, unitType, unitId, sessionFile) {
     try {
         const data = {
@@ -29,51 +111,86 @@ export function writeLock(basePath, unitType, unitId, sessionFile) {
             unitStartedAt: new Date().toISOString(),
             sessionFile,
         };
-        const lp = lockPath(basePath);
-        atomicWriteSync(lp, JSON.stringify(data, null, 2));
+        atomicWriteSync(lockPath(basePath), JSON.stringify(data, null, 2));
+    }
+    catch {
+        // Best-effort — never throw from the lock writer.
+    }
+    if (!isDbAvailable() || !sessionFile)
+        return;
+    try {
+        const projectRoot = normalizeRealPath(basePath);
+        const worker = findActiveWorkerForCurrentProcess(projectRoot);
+        if (!worker)
+            return;
+        setRuntimeKv("worker", worker.worker_id, SESSION_FILE_KV_KEY, sessionFile);
     }
-    catch (e) { /* non-fatal: lock write failure */
-        void e;
+    catch {
+        // Best-effort — never throw from the lock writer.
     }
 }
-/** Remove the lock file on clean stop. */
+/**
+ * Phase C pt 2: clearLock no longer deletes a file. The cleanup path
+ * (markWorkerStopping in stopAuto) flips the workers row to 'stopping'.
+ * This function additionally drops the session_file runtime_kv row for
+ * the current worker so a follow-up crash detection doesn't pick up a
+ * stale session-file pointer.
+ */
 export function clearLock(basePath) {
     try {
         const p = lockPath(basePath);
         if (existsSync(p))
             unlinkSync(p);
     }
-    catch (e) { /* non-fatal: lock clear failure */
-        void e;
+    catch {
+        // Best-effort.
     }
-}
-/** Check if a crash lock exists and return its data. */
-export function readCrashLock(basePath) {
+    if (!isDbAvailable())
+        return;
     try {
-        const p = lockPath(basePath);
-        if (!existsSync(p))
-            return null;
-        const raw = readFileSync(p, "utf-8");
-        return JSON.parse(raw);
+        const projectRoot = normalizeRealPath(basePath);
+        const worker = findActiveWorkerForCurrentProcess(projectRoot);
+        if (!worker)
+            return;
+        deleteRuntimeKv("worker", worker.worker_id, SESSION_FILE_KV_KEY);
     }
-    catch (e) {
-        /* non-fatal: corrupt or unreadable lock file */ void e;
-        return null;
+    catch {
+        // Best-effort.
+    }
+}
+/**
+ * Detect a previous crashed auto-mode session.
+ *
+ * Phase C pt 2: synthesized from workers (status='active' + lapsed
+ * heartbeat) + unit_dispatches (most recent for that worker) +
+ * runtime_kv (session_file). Returns null when no stale worker exists
+ * or the DB is unavailable.
+ */
+export function readCrashLock(basePath) {
+    if (isDbAvailable()) {
+        try {
+            const projectRoot = normalizeRealPath(basePath);
+            const stale = findStaleWorkerForProject(projectRoot);
+            if (stale)
+                return workerToLockData(stale);
+        }
+        catch {
+            // Fall through to the legacy lock-file compatibility path.
+        }
     }
+    return readLegacyLock(basePath);
 }
 /**
  * Check whether the process that wrote the lock is still running.
  * Uses `process.kill(pid, 0)` which sends no signal but checks liveness.
  * Returns true if the PID matches our own — we are the lock holder (#2470).
+ *
+ * Unchanged from the file-based era — pure stateless OS check.
  */
 export function isLockProcessAlive(lock) {
     const pid = lock.pid;
     if (!Number.isInteger(pid) || pid <= 0)
         return false;
-    // Our own PID means WE hold this lock — we are alive. (#2470)
-    // Callers that need to distinguish "our lock" from "someone else's lock"
-    // (e.g. startAuto checking for a prior crashed session with a recycled PID)
-    // already guard with `crashLock.pid !== process.pid` before calling us.
     if (pid === process.pid)
         return true;
     try {
@@ -81,8 +198,6 @@ export function isLockProcessAlive(lock) {
         return true;
     }
     catch (err) {
-        // EPERM means the process exists but we lack permission — treat as alive.
-        // ESRCH means the process does not exist — treat as dead (stale lock).
         if (err.code === "EPERM")
             return true;
         return false;
@@ -96,7 +211,6 @@ export function formatCrashInfo(lock) {
         `  Started at: ${lock.unitStartedAt}`,
         `  PID: ${lock.pid}`,
     ];
-    // Add recovery guidance based on what was happening when it crashed
     if (lock.unitType === "starting" && lock.unitId === "bootstrap") {
         lines.push(`No work was lost. Run /gsd auto to restart.`);
     }
@@ -113,33 +227,23 @@ export function formatCrashInfo(lock) {
 }
 /**
  * Emit a synthetic unit-end event for a unit that crashed without emitting its own.
- *
- * Queries the journal to find the most recent unit-start for the crashed unit.
- * If a matching unit-end already exists (e.g. the hard timeout fired), this is a
- * no-op. Called during crash recovery, before clearing the stale lock.
- *
- * Addresses the gap reported in #3348 where `unit-start` was emitted but no
- * `unit-end` followed — side effects landed but the worker died before closeout.
+ * Unchanged from the file era — operates on the journal, not the lock.
  */
 export function emitCrashRecoveredUnitEnd(basePath, lock) {
-    // Skip bootstrap / starting pseudo-units — they have no meaningful unit-start event.
     if (!lock.unitType || !lock.unitId || lock.unitType === "starting")
         return;
     try {
         const all = queryJournal(basePath);
-        // Find the most recent unit-start for this unitId
         const starts = all.filter((e) => e.eventType === "unit-start" && e.data?.unitId === lock.unitId);
         if (starts.length === 0)
             return;
         const lastStart = starts[starts.length - 1];
-        // Check if a unit-end was already emitted (e.g. hard timeout fired after the crash)
         const alreadyClosed = all.some((e) => e.eventType === "unit-end" &&
             e.data?.unitId === lock.unitId &&
             e.causedBy?.flowId === lastStart.flowId &&
             e.causedBy?.seq === lastStart.seq);
         if (alreadyClosed)
             return;
-        // Find the highest seq in this flow for monotonic ordering
         const maxSeq = all
             .filter((e) => e.flowId === lastStart.flowId)
             .reduce((max, e) => Math.max(max, e.seq), lastStart.seq);
@@ -158,6 +262,15 @@ export function emitCrashRecoveredUnitEnd(basePath, lock) {
         });
     }
     catch {
-        // Never throw from crash recovery path — journal failure must not block recovery
+        // Never throw from crash recovery path.
     }
 }
+/**
+ * Used by the doctor checks (doctor-runtime-checks.ts, doctor-proactive.ts)
+ * to enumerate stale workers across all projects this DB knows about.
+ * Phase C pt 2 export — surface for the same diagnostics that previously
+ * iterated `auto.lock` files.
+ */
+export function findStaleAutoWorker(basePath) {
+    return readCrashLock(basePath);
+}