gsd-pi 2.79.0-dev.ece5fd8ba → 2.80.0-dev.4ea7d80e7

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -1,7 +1,9 @@
-import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { minimatch } from "minimatch";
+import { getIsolationMode } from "../preferences.js";
 import { logWarning } from "../workflow-logger.js";
+import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
 /**
  * Regex matching milestone CONTEXT.md file names in both legacy M001
  * and unique M001-abc123 formats. Exported so regex-hardening tests
@@ -728,3 +730,129 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
     // avoids breaking gsd_* MCP tools or future safe additions.
     return { block: false };
 }
+// ─── Worktree isolation write gate (#5199) ────────────────────────────────
+//
+// When `git.isolation: worktree` is configured, the per-unit commit pipeline
+// only runs inside the auto-mode loop (`auto-post-unit.ts`). If the LLM
+// authors code at the project root before auto-mode is started, those writes
+// land in the working tree but never reach a commit — they're silently
+// orphaned outside git history. This guard blocks those writes at the
+// tool_call seam so the agent receives a clear error instead.
+const WORKTREE_GATE_BOOTSTRAP_UNITS = new Set([
+    "discuss-milestone",
+    "plan-milestone",
+    "init",
+]);
+function realpathOrResolve(p) {
+    const abs = resolve(p);
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        // Path doesn't exist (yet) — realpath the deepest existing ancestor so
+        // platforms where /tmp -> /private/tmp don't break containment checks.
+        let dir = abs;
+        const tail = [];
+        while (dir && dir !== resolve(dir, "..")) {
+            try {
+                const real = realpathSync(dir);
+                return tail.length ? join(real, ...tail.reverse()) : real;
+            }
+            catch {
+                const idx = dir.lastIndexOf(sep);
+                if (idx <= 0)
+                    break;
+                tail.push(dir.slice(idx + 1));
+                dir = dir.slice(0, idx) || sep;
+            }
+        }
+        return abs;
+    }
+}
+function isPathContained(target, container) {
+    if (target === container)
+        return true;
+    return target.startsWith(container.endsWith(sep) ? container : container + sep);
+}
+/**
+ * Block planning-write tool calls that would land code at the project root
+ * while `git.isolation: worktree` is in effect and auto-mode hasn't created
+ * (or flipped cwd into) the milestone worktree.
+ *
+ * Pure / unit-testable. Callers in `register-hooks.ts` supply the resolved
+ * project root and current auto liveness; this function does no I/O beyond
+ * realpath resolution.
+ *
+ * Allow rules (in order):
+ *   1. Tool isn't a planning-write (write/edit/multi_edit/notebook_edit).
+ *   2. `GSD_DISABLE_WORKTREE_WRITE_GUARD=1` self-hosting bypass.
+ *   3. Isolation mode is not "worktree".
+ *   4. Active unit is a bootstrap unit (discuss-milestone/plan-milestone/init).
+ *   5. Target is inside `<projectRoot>/.gsd/worktrees/` (a real worktree).
+ *   6. Target is inside `<projectRoot>/.gsd/` and isn't masquerading as a
+ *      worktrees sibling (rejects the `.gsd/worktrees-extra/…` prefix trick).
+ *   7. Auto is live AND `effectiveBasePath` is itself a `.gsd/worktrees/…` path.
+ *
+ * Otherwise: block with a message that points the agent at `/gsd` to start
+ * auto-mode.
+ */
+export function shouldBlockWorktreeWrite(toolName, targetPath, effectiveBasePath, isAutoLive, currentUnitType) {
+    const tool = canonicalToolName(toolName);
+    if (!PLANNING_WRITE_TOOLS.has(tool))
+        return { block: false };
+    if (process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD === "1")
+        return { block: false };
+    if (getIsolationMode(effectiveBasePath) !== "worktree")
+        return { block: false };
+    if (currentUnitType && WORKTREE_GATE_BOOTSTRAP_UNITS.has(currentUnitType))
+        return { block: false };
+    if (!targetPath) {
+        return {
+            block: true,
+            reason: [
+                `HARD BLOCK: ${tool} called with empty path while \`git.isolation: worktree\` is configured`,
+                `and auto-mode is not active. Refusing to allow writes that cannot be located.`,
+            ].join(" "),
+        };
+    }
+    // Resolve the target relative to the project root, then realpath to defeat
+    // symlink-based escapes and prefix tricks (e.g. .gsd/worktrees-extra/).
+    const projectRoot = resolveWorktreeProjectRoot(effectiveBasePath);
+    const absTarget = isAbsolute(targetPath) ? targetPath : resolve(projectRoot, targetPath);
+    const realTarget = realpathOrResolve(absTarget);
+    const realRoot = realpathOrResolve(projectRoot);
+    const realGsd = realpathOrResolve(join(projectRoot, ".gsd"));
+    const realWorktreesDir = realpathOrResolve(join(projectRoot, ".gsd", "worktrees"));
+    // Allow writes inside the legitimate worktrees subtree.
+    if (isPathContained(realTarget, realWorktreesDir))
+        return { block: false };
+    // Allow writes to .gsd/ planning artifacts, but reject siblings whose name
+    // starts with "worktrees" (the worktrees-extra prefix trick — case 4).
+    if (isPathContained(realTarget, realGsd)) {
+        const rel = relative(realGsd, realTarget);
+        const firstSeg = rel.split(/[\/\\]/)[0] ?? "";
+        if (!firstSeg.startsWith("worktrees"))
+            return { block: false };
+        // fall through: looks like worktrees<something> sibling — block
+    }
+    // Auto is live and the caller is operating inside a worktree path —
+    // host tool's write happens in worktree context; let it through.
+    if (isAutoLive && isGsdWorktreePath(effectiveBasePath))
+        return { block: false };
+    // Block. Provide enough context that the agent can self-correct.
+    const displayTarget = isPathContained(realTarget, realRoot)
+        ? relative(realRoot, realTarget) || "."
+        : realTarget;
+    return {
+        block: true,
+        reason: [
+            `HARD BLOCK: Worktree isolation is configured (\`git.isolation: worktree\`) but auto-mode is`,
+            `not running and the target "${displayTarget}" is not inside \`.gsd/worktrees/<MID>/\`.`,
+            `Code edits at the project root would be lost — only the auto-mode commit pipeline`,
+            `(auto-post-unit) commits work, and it never runs outside the loop.`,
+            `Required action: start auto-mode with \`/gsd\` so the milestone worktree is created,`,
+            `then write inside it. To disable this guard for self-hosting development, set`,
+            `GSD_DISABLE_WORKTREE_WRITE_GUARD=1.`,
+        ].join(" "),
+    };
+}

package/dist/resources/extensions/gsd/commands-extract-learnings.js

@@ -114,14 +114,19 @@ Using the \`write\` tool, persist the full structured report to
 LEARNINGS.md is the full, cited audit trail. Write it first — subsequent steps
 feed from its content.
 
-### Step 3 — Optionally pre-query the memory store for semantic duplicates
+### Step 3 — Run one bounded duplicate check
 
-Before persisting any extracted item in Steps 4–6, you may call
-\`memory_query\` with 2–3 keywords from the item to check whether the
-memory store already holds a semantically equivalent entry at high
-confidence. Skip those items in their respective steps. The memory store
-is the single source of truth for cross-session durable knowledge — no
-other persistence call is part of this flow.
+Before persisting extracted items in Steps 4–6, do at most one duplicate-check
+pass for the durable Decisions, Lessons, and Patterns from this milestone. Use
+the already-written LEARNINGS.md content and call \`memory_query\` once with a
+compact keyword summary for the whole batch. If that result clearly shows a
+semantically equivalent high-confidence memory for an item, mark only that item
+as already captured and skip it in its respective persistence step.
+
+Do not re-read milestone artefacts or repeat memory queries category-by-category
+after this point. The memory store is the single source of truth for
+cross-session durable knowledge — no other persistence call is part of this
+flow.
 
 ### Step 4 — Persist Patterns via \`capture_thought\`
 
@@ -160,11 +165,11 @@ later projection back to a human-visible decisions register stays lossless
 
 ### Step 7 — Deduplication rule (applies to Steps 4, 5, 6)
 
-Before each \`capture_thought\` call, optionally call \`memory_query\` with 2–3
-keywords from the entry. If a semantically equivalent memory is returned at
-high confidence, skip the capture entirely. Prefer skipping a near-duplicate
-over creating a second slightly-different row — redundancy degrades the
-signal.
+Use only the duplicate-check result from Step 3. If that bounded check returned
+a semantically equivalent memory at high confidence for an extracted item, skip
+the capture entirely. Otherwise, persist the item once via \`capture_thought\`.
+Prefer skipping a near-duplicate over creating a second slightly-different row
+— redundancy degrades the signal.
 
 ### Step 8 — Surprises stay only in LEARNINGS.md
 

package/dist/resources/extensions/gsd/commands-ship.js

@@ -1,9 +1,5 @@
-/**
- * GSD Command — /gsd ship
- *
- * Creates a PR from milestone artifacts: generates title + body from
- * roadmap, slice summaries, and metrics, then opens via `gh pr create`.
- */
+// Project/App: GSD-2
+// File Purpose: Ship command for creating pull requests from GSD milestone evidence.
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { readFile } from "node:fs/promises";
@@ -14,6 +10,7 @@ import { nativeGetCurrentBranch, nativeDetectMainBranch } from "./native-git-bri
 import { formatDuration } from "../shared/format-utils.js";
 import { parseEvalReviewFrontmatter } from "./eval-review-schema.js";
 import { currentDirectoryRoot } from "./commands/context.js";
+import { buildPrEvidence } from "./pr-evidence.js";
 function git(basePath, args) {
     return execFileSync("git", args, { cwd: basePath, encoding: "utf-8" }).trim();
 }
@@ -114,66 +111,46 @@ export async function checkSliceEvalReview(basePath, milestoneId, sliceId) {
     };
 }
 function generatePRContent(basePath, milestoneId, milestoneTitle) {
-    const title = `feat: ${milestoneTitle || milestoneId}`;
-    const sections = [];
-    // TL;DR
-    sections.push("## TL;DR\n");
-    sections.push(`**What:** Ship milestone ${milestoneId} — ${milestoneTitle || "(untitled)"}`);
-    sections.push(`**Why:** Milestone work complete, ready for review.`);
-    sections.push(`**How:** See slice summaries below.\n`);
-    // What — slice summaries
     const summaries = collectSliceSummaries(basePath, milestoneId);
-    if (summaries.length > 0) {
-        sections.push("## What\n");
-        sections.push(summaries.join("\n\n"));
-        sections.push("");
-    }
-    // Roadmap status
+    const roadmapItems = [];
     const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
     if (roadmapPath && existsSync(roadmapPath)) {
         try {
             const roadmap = readFileSync(roadmapPath, "utf-8");
             const checkboxLines = roadmap.split("\n").filter((l) => /^\s*-\s*\[[ x]\]/.test(l));
-            if (checkboxLines.length > 0) {
-                sections.push("## Roadmap\n");
-                sections.push(checkboxLines.join("\n"));
-                sections.push("");
-            }
+            roadmapItems.push(...checkboxLines);
         }
         catch {
             // non-fatal
         }
     }
-    // Metrics
+    const metrics = [];
     const ledger = getLedger();
     const units = ledger?.units ?? loadLedgerFromDisk(basePath)?.units ?? [];
     if (units.length > 0) {
         const totals = getProjectTotals(units);
         const byModel = aggregateByModel(units);
-        sections.push("## Metrics\n");
-        sections.push(`- **Units executed:** ${units.length}`);
-        sections.push(`- **Total cost:** ${formatCost(totals.cost)}`);
-        sections.push(`- **Tokens:** ${formatTokenCount(totals.tokens.input)} input / ${formatTokenCount(totals.tokens.output)} output`);
+        metrics.push(`**Units executed:** ${units.length}`);
+        metrics.push(`**Total cost:** ${formatCost(totals.cost)}`);
+        metrics.push(`**Tokens:** ${formatTokenCount(totals.tokens.input)} input / ${formatTokenCount(totals.tokens.output)} output`);
         if (totals.duration > 0) {
-            sections.push(`- **Duration:** ${formatDuration(totals.duration)}`);
+            metrics.push(`**Duration:** ${formatDuration(totals.duration)}`);
         }
         if (byModel.length > 0) {
-            sections.push(`- **Models:** ${byModel.map((m) => `${m.model} (${m.units} units)`).join(", ")}`);
+            metrics.push(`**Models:** ${byModel.map((m) => `${m.model} (${m.units} units)`).join(", ")}`);
         }
-        sections.push("");
-    }
-    // Change type checklist
-    sections.push("## Change type\n");
-    sections.push("- [x] `feat` — New feature or capability");
-    sections.push("- [ ] `fix` — Bug fix");
-    sections.push("- [ ] `refactor` — Code restructuring");
-    sections.push("- [ ] `test` — Adding or updating tests");
-    sections.push("- [ ] `docs` — Documentation only");
-    sections.push("- [ ] `chore` — Build, CI, or tooling changes\n");
-    // AI disclosure
-    sections.push("---\n");
-    sections.push("*This PR was prepared with AI assistance (GSD auto-mode).*");
-    return { title, body: sections.join("\n") };
+    }
+    return buildPrEvidence({
+        milestoneId,
+        milestoneTitle,
+        changeType: "feat",
+        summaries,
+        roadmapItems,
+        metrics,
+        testsRun: ["Run `npm run verify:pr` before marking this PR ready."],
+        rollbackNotes: ["Revert the merge commit or close the PR before merge if review finds a regression."],
+        how: "Generated from GSD milestone slice summaries, roadmap status, and local metrics.",
+    });
 }
 export async function handleShip(args, ctx, _pi) {
     const basePath = currentDirectoryRoot();

package/dist/resources/extensions/gsd/commands-workflow-templates.js

@@ -1,12 +1,8 @@
-/**
- * GSD Workflow Template Commands — /gsd start, /gsd templates
- *
- * Handles the `/gsd start [template] [description]` and `/gsd templates` commands.
- * Resolves templates by name or auto-detection, then dispatches the workflow prompt.
- */
+// Project/App: GSD-2
+// File Purpose: Workflow template commands for starting, listing, and dispatching workflows.
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { resolveByName, autoDetect, listTemplates, getTemplateInfo, loadWorkflowTemplate, loadRegistry, } from "./workflow-templates.js";
+import { resolveByName, autoDetect, listTemplates, getTemplateInfo, loadWorkflowTemplate, loadRegistry, isLegacyWorkflowMode, } from "./workflow-templates.js";
 import { loadPrompt } from "./prompt-loader.js";
 import { gsdRoot } from "./paths.js";
 import { createGitService, runGit } from "./git-service.js";
@@ -14,6 +10,8 @@ import { isAutoActive, isAutoPaused } from "./auto.js";
 import { getErrorMessage } from "./error-utils.js";
 import { resolvePlugin } from "./workflow-plugins.js";
 import { currentDirectoryRoot } from "./commands/context.js";
+import { formatRecommendedProcessPaths } from "./process-task-path.js";
+import { incrementLegacyTelemetry } from "./legacy-telemetry.js";
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 /**
  * Generate a URL-friendly slug from text.
@@ -244,6 +242,9 @@ export async function handleStart(args, ctx, pi) {
                 "  /gsd start bugfix fix login button not responding\n" +
                 "  /gsd start spike evaluate auth libraries\n" +
                 "  /gsd start hotfix critical: API returns 500\n\n" +
+                "Recommended task paths:\n" +
+                formatRecommendedProcessPaths() +
+                "\n\n" +
                 "Flags:\n" +
                 "  --dry-run       Preview what would happen without executing\n" +
                 "  --issue <ref>   Link to a GitHub issue\n\n" +
@@ -364,6 +365,9 @@ export async function handleStart(args, ctx, pi) {
         infoLines.push(`Artifacts: ${artifactDir}`);
     infoLines.push(`Branch: ${actualBranch}`);
     ctx.ui.notify(infoLines.join("\n"), "info");
+    if (isLegacyWorkflowMode(template.mode)) {
+        incrementLegacyTelemetry("legacy.workflowEngineUsed");
+    }
     const prompt = loadPrompt("workflow-start", {
         templateId,
         templateName: template.name,
@@ -491,6 +495,7 @@ export function dispatchMarkdownPhasePlugin(plugin, description, ctx, pi) {
         infoLines.push(`Artifacts: ${artifactDir}`);
     infoLines.push(`Branch: ${actualBranch}`);
     ctx.ui.notify(infoLines.join("\n"), "info");
+    incrementLegacyTelemetry("legacy.workflowEngineUsed");
     const prompt = loadPrompt("workflow-start", {
         templateId,
         templateName: plugin.meta.displayName,

package/dist/resources/extensions/gsd/component-loader.js

@@ -1,18 +1,10 @@
-/**
- * Component Loader
- *
- * Multi-format loader that handles:
- * 1. New format: component.yaml + SKILL.md/AGENT.md
- * 2. Legacy skill format: SKILL.md with YAML frontmatter
- * 3. Legacy agent format: .md with YAML frontmatter (name, description, tools, model)
- *
- * Auto-detects format by checking for component.yaml first, then falling back
- * to legacy formats based on file naming conventions.
- */
+// Project/App: GSD-2
+// File Purpose: Loads modern component.yaml definitions and legacy skill/agent formats.
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 import { parseFrontmatter } from '@gsd/pi-coding-agent';
+import { incrementLegacyTelemetry } from './legacy-telemetry.js';
 import { validateComponentName, validateComponentDescription, computeComponentId, } from './component-types.js';
 const SUPPORTED_COMPONENT_KINDS = ['skill', 'agent'];
 const SUPPORTED_API_VERSIONS = ['gsd/v1'];
@@ -183,6 +175,7 @@ function loadFromLegacySkill(filePath, dir, source) {
         format: 'skill-md',
         enabled: true,
     };
+    incrementLegacyTelemetry('legacy.componentFormatUsed');
     return { component, diagnostics };
 }
 function loadFromLegacyAgent(filePath, source) {
@@ -235,6 +228,7 @@ function loadFromLegacyAgent(filePath, source) {
         format: 'agent-md',
         enabled: true,
     };
+    incrementLegacyTelemetry('legacy.componentFormatUsed');
     return { component, diagnostics };
 }
 // ============================================================================

package/dist/resources/extensions/gsd/custom-workflow-engine.js

@@ -13,13 +13,29 @@
  */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { readGraph, writeGraph, getNextPendingStep, markStepActive, markStepComplete, expandIteration, } from "./graph.js";
+import { readGraph, writeGraph, getNextPendingStep, markStepActive, markStepComplete, expandIteration, isTerminalStepStatus, } from "./graph.js";
 import { injectContext } from "./context-injector.js";
 import { readFrozenDefinition } from "./definition-io.js";
 import { parseUnitId } from "./unit-id.js";
 import { withFileLock } from "./file-lock.js";
 // Re-export for downstream consumers
 export { readFrozenDefinition } from "./definition-io.js";
+function formatBlockedWorkflowReason(graph) {
+    const statusById = new Map(graph.steps.map((step) => [step.id, step.status]));
+    const blockedSteps = graph.steps
+        .filter((step) => step.status === "pending")
+        .map((step) => {
+        const blockers = step.dependsOn
+            .filter((depId) => !isTerminalStepStatus(statusById.get(depId)))
+            .map((depId) => `${depId} (${statusById.get(depId) ?? "missing"})`);
+        return blockers.length > 0
+            ? `${step.id} waiting on ${blockers.join(", ")}`
+            : `${step.id} has no runnable dependency path`;
+    });
+    return blockedSteps.length > 0
+        ? `Workflow blocked: no pending steps are ready. Blocked steps: ${blockedSteps.join("; ")}`
+        : "Workflow blocked: no pending steps are ready.";
+}
 export class CustomWorkflowEngine {
     engineId = "custom";
     runDir;
@@ -78,6 +94,14 @@ export class CustomWorkflowEngine {
             }
             let next = getNextPendingStep(graph);
             if (!next) {
+                const allDone = graph.steps.every((step) => step.status === "complete" || step.status === "expanded");
+                if (!allDone) {
+                    return {
+                        action: "stop",
+                        reason: formatBlockedWorkflowReason(graph),
+                        level: "error",
+                    };
+                }
                 return {
                     action: "stop",
                     reason: "All steps complete",

package/dist/resources/extensions/gsd/db-adapter.js

@@ -0,0 +1,47 @@
+// Project/App: GSD-2
+// File Purpose: Normalized SQLite adapter wrapper used by the GSD database facade.
+export function normalizeDbRow(row) {
+    if (row == null)
+        return undefined;
+    if (Object.getPrototypeOf(row) === null) {
+        return { ...row };
+    }
+    return row;
+}
+export function normalizeDbRows(rows) {
+    return rows.map((row) => normalizeDbRow(row));
+}
+export function createDbAdapter(rawDb) {
+    const db = rawDb;
+    const stmtCache = new Map();
+    function wrapStmt(raw) {
+        return {
+            run(...params) {
+                return raw.run(...params);
+            },
+            get(...params) {
+                return normalizeDbRow(raw.get(...params));
+            },
+            all(...params) {
+                return normalizeDbRows(raw.all(...params));
+            },
+        };
+    }
+    return {
+        exec(sql) {
+            db.exec(sql);
+        },
+        prepare(sql) {
+            let cached = stmtCache.get(sql);
+            if (cached)
+                return cached;
+            cached = wrapStmt(db.prepare(sql));
+            stmtCache.set(sql, cached);
+            return cached;
+        },
+        close() {
+            stmtCache.clear();
+            db.close();
+        },
+    };
+}