gsd-pi 2.80.0-dev.c5f2443b3 → 2.80.0-dev.f55d16d13

package/src/resources/extensions/gsd/tests/fixtures/pr-body/swarm-lane-no-blockers.md

@@ -0,0 +1,55 @@
+## TL;DR
+
+**What:** Ship workflow lane/writer - lane/writer
+**Why:** Workflow work is complete and ready for review.
+**How:** Generated by GSD GitHub Sync swarm routines from lane evidence.
+
+## What
+
+### Swarm lane
+**Lane:** `lane/writer`
+**Branch:** `lane/single-writer`
+**Owner:** @owner
+**Latest commit:** `abc1234`
+
+### Impact area
+Single-writer UOK metadata.
+
+### Changed contracts
+- [ ] WriterToken
+
+### Transition risks
+- [ ] Writer token lifecycle regression
+
+## Why
+
+Workflow work is complete and ready for review.
+
+## How
+
+Generated by GSD GitHub Sync swarm routines from lane evidence.
+
+## Linked Issue
+
+Closes #123
+
+## Tests Run
+
+- npm run typecheck:extensions
+
+## Change Type
+
+- [ ] `feat` - New feature or capability
+- [ ] `fix` - Bug fix
+- [x] `refactor` - Code restructuring
+- [ ] `test` - Adding or updating tests
+- [ ] `docs` - Documentation only
+- [ ] `chore` - Build, CI, or tooling changes
+
+## Rollback And Compatibility
+
+- Disable writer sequence enrichment
+
+## AI Assistance Disclosure
+
+This PR was prepared with AI assistance.

package/src/resources/extensions/gsd/tests/fixtures/pr-body/swarm-lane-with-blockers.md

@@ -0,0 +1,60 @@
+## TL;DR
+
+**What:** Ship workflow lane/writer - lane/writer
+**Why:** Workflow work is complete and ready for review.
+**How:** Generated by GSD GitHub Sync swarm routines from lane evidence.
+
+## What
+
+### Swarm lane
+**Lane:** `lane/writer`
+**Branch:** `lane/single-writer`
+**Owner:** @owner
+**Latest commit:** `abc1234`
+
+### Impact area
+Single-writer UOK metadata.
+
+### Changed contracts
+- [ ] WriterToken
+
+### Transition risks
+- [ ] Writer token lifecycle regression
+
+## Blockers
+
+- Awaiting state-lane writer-sequence merge
+- Parity report incomplete
+
+## Why
+
+Workflow work is complete and ready for review.
+
+## How
+
+Generated by GSD GitHub Sync swarm routines from lane evidence.
+
+## Linked Issue
+
+Closes #123
+
+## Tests Run
+
+- npm run typecheck:extensions
+
+## Change Type
+
+- [ ] `feat` - New feature or capability
+- [ ] `fix` - Bug fix
+- [x] `refactor` - Code restructuring
+- [ ] `test` - Adding or updating tests
+- [ ] `docs` - Documentation only
+- [ ] `chore` - Build, CI, or tooling changes
+
+## Rollback And Compatibility
+
+- Disable writer sequence enrichment
+
+## AI Assistance Disclosure
+
+This PR was prepared with AI assistance.

package/src/resources/extensions/gsd/tests/graph-operations.test.ts

@@ -233,6 +233,16 @@ describe("getNextPendingStep", () => {
     const next = getNextPendingStep(graph);
     assert.equal(next?.id, "b");
   });
+
+  it("treats expanded dependencies as satisfied", (t) => {
+    const graph = makeGraph([
+      makeStep({ id: "iter", status: "expanded" }),
+      makeStep({ id: "after", dependsOn: ["iter"] }),
+    ]);
+
+    const next = getNextPendingStep(graph);
+    assert.equal(next?.id, "after");
+  });
 });
 
 // ─── markStepComplete ────────────────────────────────────────────────────

package/src/resources/extensions/gsd/tests/gsd-db.test.ts

@@ -30,6 +30,10 @@ import {
   insertTask,
   getTask,
   getSliceTasks,
+  deleteMilestone,
+  clearEngineHierarchy,
+  recordMilestoneCommitAttribution,
+  getMilestoneCommitAttributionShas,
   checkpointDatabase,
   refreshOpenDatabaseFromDisk,
   tryCreateMemoriesFts,
@@ -1047,6 +1051,46 @@ describe('gsd-db', () => {
     });
   });
 
+  // ─── milestone_commit_attributions teardown ───────────────────────────────
+
+  describe('milestone commit attribution teardown', () => {
+    test('deleteMilestone removes persisted milestone commit attributions', () => {
+      openDatabase(':memory:');
+      insertMilestone({ id: 'M001', title: 'Milestone', status: 'active' });
+      recordMilestoneCommitAttribution({
+        commitSha: '0123456789abcdef0123456789abcdef01234567',
+        milestoneId: 'M001',
+        source: 'backfill',
+        confidence: 0.8,
+        files: ['app.js'],
+        createdAt: '2026-05-05T00:00:00.000Z',
+      });
+
+      assert.deepEqual(getMilestoneCommitAttributionShas('M001'), ['0123456789abcdef0123456789abcdef01234567']);
+      deleteMilestone('M001');
+      assert.deepEqual(getMilestoneCommitAttributionShas('M001'), []);
+      closeDatabase();
+    });
+
+    test('clearEngineHierarchy removes persisted milestone commit attributions', () => {
+      openDatabase(':memory:');
+      insertMilestone({ id: 'M001', title: 'Milestone', status: 'active' });
+      recordMilestoneCommitAttribution({
+        commitSha: 'fedcba9876543210fedcba9876543210fedcba98',
+        milestoneId: 'M001',
+        source: 'backfill',
+        confidence: 0.8,
+        files: ['app.js'],
+        createdAt: '2026-05-05T00:00:00.000Z',
+      });
+
+      assert.deepEqual(getMilestoneCommitAttributionShas('M001'), ['fedcba9876543210fedcba9876543210fedcba98']);
+      clearEngineHierarchy();
+      assert.deepEqual(getMilestoneCommitAttributionShas('M001'), []);
+      closeDatabase();
+    });
+  });
+
   // ─── getDbStatus ───────────────────────────────────────────────────────────
 
   describe('getDbStatus', () => {

package/src/resources/extensions/gsd/tests/has-pending-deep-stage.test.ts

@@ -15,7 +15,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 
-import { hasPendingDeepStage } from "../auto-dispatch.ts";
+import { hasPendingDeepStage, shouldRunDeepProjectSetup } from "../auto-dispatch.ts";
 import type { GSDPreferences } from "../preferences.ts";
 import { loadEffectiveGSDPreferences } from "../preferences.ts";
 
@@ -57,6 +57,38 @@ test("hasPendingDeepStage: returns true in deep mode when nothing has been captu
   }
 });
 
+test("shouldRunDeepProjectSetup: complete state wins over pending deep setup", async () => {
+  const base = makeBase();
+  try {
+    assert.equal(hasPendingDeepStage(deepPrefs, base), true);
+    assert.equal(
+      shouldRunDeepProjectSetup({ phase: "complete" }, deepPrefs, base),
+      false,
+      "completed projects must not restart deep setup and loop through auto-mode",
+    );
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("shouldRunDeepProjectSetup: only setup phases can trigger pending deep setup", () => {
+  const base = makeBase();
+  try {
+    assert.equal(hasPendingDeepStage(deepPrefs, base), true);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "pre-planning" }, deepPrefs, base), true);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "needs-discussion" }, deepPrefs, base), true);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "planning" }, deepPrefs, base), true);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "executing" }, deepPrefs, base), false);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "blocked" }, deepPrefs, base), false);
+    assert.equal(
+      shouldRunDeepProjectSetup({ phase: "pre-planning" }, deepPrefs, base, { hasSurvivorBranch: true }),
+      false,
+    );
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
 test("hasPendingDeepStage: returns true in deep mode when only some gates pass", () => {
   // workflow-preferences captured but PROJECT.md still missing.
   const base = makeBase();

package/src/resources/extensions/gsd/tests/pr-evidence-equivalence.test.ts

@@ -0,0 +1,102 @@
+// Project/App: GSD-2
+// File Purpose: Golden-fixture equivalence tests pinning PR-body output for buildPrEvidence and formatSwarmLanePRBody.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+import { buildPrEvidence, type PrEvidenceInput } from "../pr-evidence.ts";
+import {
+  formatSwarmLanePRBody,
+  type SwarmLanePRData,
+} from "../../github-sync/templates.ts";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const FIXTURES_DIR = join(__dirname, "fixtures", "pr-body");
+
+const UPDATE = process.env.UPDATE_GOLDENS === "1";
+
+function compareGolden(name: string, actual: string): void {
+  const path = join(FIXTURES_DIR, name);
+  if (UPDATE) {
+    writeFileSync(path, actual, "utf8");
+    return;
+  }
+  const expected = readFileSync(path, "utf8");
+  assert.equal(actual, expected, `golden mismatch for ${name}`);
+}
+
+const SHIP_BASIC: PrEvidenceInput = {
+  milestoneId: "M001",
+  milestoneTitle: "Authentication",
+  changeType: "feat",
+  linkedIssue: "Closes #123",
+  summaries: ["### S01\nImplemented login flow."],
+  roadmapItems: ["- [x] **S01: Login**"],
+  metrics: ["**Units executed:** 3"],
+  testsRun: ["npm test", "npm run typecheck:extensions"],
+  why: "Users need to authenticate before accessing protected resources.",
+  how: "Added password hash check and session token issuance.",
+  rollbackNotes: ["Revert the merge commit."],
+};
+
+const SHIP_EMPTY_OPTIONALS: PrEvidenceInput = {
+  milestoneId: "M001",
+  milestoneTitle: "Authentication",
+  changeType: "feat",
+};
+
+const SWARM_WITH_BLOCKERS: SwarmLanePRData = {
+  lane: {
+    id: "writer",
+    branch: "lane/single-writer",
+    owner: "@owner",
+    latestCommit: "abc1234",
+    changedContracts: ["WriterToken"],
+    testEvidence: ["npm run typecheck:extensions"],
+    blockers: ["Awaiting state-lane writer-sequence merge", "Parity report incomplete"],
+  },
+  impactArea: "Single-writer UOK metadata.",
+  transitionRisks: ["Writer token lifecycle regression"],
+  rollbackPlan: ["Disable writer sequence enrichment"],
+  linkedIssue: 123,
+};
+
+const SWARM_NO_BLOCKERS: SwarmLanePRData = {
+  lane: {
+    id: "writer",
+    branch: "lane/single-writer",
+    owner: "@owner",
+    latestCommit: "abc1234",
+    changedContracts: ["WriterToken"],
+    testEvidence: ["npm run typecheck:extensions"],
+  },
+  impactArea: "Single-writer UOK metadata.",
+  transitionRisks: ["Writer token lifecycle regression"],
+  rollbackPlan: ["Disable writer sequence enrichment"],
+  linkedIssue: 123,
+};
+
+test("pr-evidence golden: commands-ship basic", () => {
+  compareGolden("commands-ship-basic.md", buildPrEvidence(SHIP_BASIC).body);
+});
+
+test("pr-evidence golden: commands-ship empty optionals", () => {
+  compareGolden("commands-ship-empty-optionals.md", buildPrEvidence(SHIP_EMPTY_OPTIONALS).body);
+});
+
+test("pr-evidence golden: swarm-lane with blockers", () => {
+  const body = formatSwarmLanePRBody(SWARM_WITH_BLOCKERS);
+  compareGolden("swarm-lane-with-blockers.md", body);
+  // Cross-check: top-level ## Blockers heading must appear (regression guard
+  // for the silent-drop fixed in this PR).
+  assert.ok(body.includes("\n## Blockers\n"), "swarm-lane body must emit a top-level ## Blockers heading");
+});
+
+test("pr-evidence golden: swarm-lane no blockers (no Blockers heading)", () => {
+  const body = formatSwarmLanePRBody(SWARM_NO_BLOCKERS);
+  compareGolden("swarm-lane-no-blockers.md", body);
+  assert.ok(!body.includes("## Blockers"), "swarm-lane body without blockers must not emit ## Blockers heading");
+});

package/src/resources/extensions/gsd/tests/pr-evidence-hardening.test.ts

@@ -0,0 +1,165 @@
+// Project/App: GSD-2
+// File Purpose: Hardening tests for buildPrEvidence — HTML-comment stripping, fake commit-trailer removal, and per-item length capping.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildPrEvidence, type PrEvidenceInput } from "../pr-evidence.ts";
+
+test("pr-evidence hardening: strips HTML comments from summaries", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    summaries: ["visible<!-- hidden secret -->tail"],
+  });
+  assert.ok(!evidence.body.includes("<!--"), "raw <!-- must not appear");
+  assert.ok(!evidence.body.includes("hidden secret"), "comment contents must be stripped");
+  assert.ok(evidence.body.includes("visibletail"), "non-comment text must remain");
+});
+
+test("pr-evidence hardening: removes Co-Authored-By trailer from why", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    why: "Real reason here.\nCo-Authored-By: Evil <e@evil.com>\nMore reason.",
+  });
+  assert.ok(!evidence.body.includes("Evil <e@evil.com>"));
+  assert.ok(!/Co-Authored-By:/i.test(evidence.body));
+  assert.ok(evidence.body.includes("Real reason here."));
+  assert.ok(evidence.body.includes("More reason."));
+});
+
+test("pr-evidence hardening: removes Signed-off-by trailer from how", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    how: "Step one.\nSigned-off-by: Forged <f@x.com>\nStep two.",
+  });
+  assert.ok(!evidence.body.includes("Forged <f@x.com>"));
+  assert.ok(!/Signed-off-by:/i.test(evidence.body));
+  assert.ok(evidence.body.includes("Step one."));
+  assert.ok(evidence.body.includes("Step two."));
+});
+
+test("pr-evidence hardening: trailer-name match is case-insensitive", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    why: "ok\nco-authored-by: lower <l@l.com>\nSIGNED-OFF-BY: upper <u@u.com>\nend",
+  });
+  assert.ok(!evidence.body.includes("lower <l@l.com>"));
+  assert.ok(!evidence.body.includes("upper <u@u.com>"));
+  assert.ok(evidence.body.includes("ok"));
+  assert.ok(evidence.body.includes("end"));
+});
+
+test("pr-evidence hardening: caps oversize summaries item with truncation suffix", () => {
+  const big = "A".repeat(5 * 1024); // 5 KB
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    summaries: [big],
+  });
+  // Find the truncated A-block in the body and assert it is bounded.
+  const lines = evidence.body.split("\n");
+  const longLine = lines.find((l) => l.startsWith("AAAA"));
+  assert.ok(longLine, "expected truncated A-line in body");
+  assert.ok(longLine!.endsWith(" … [truncated]"), "must end with truncation suffix");
+  assert.ok(
+    Buffer.byteLength(longLine!, "utf8") <= 2048,
+    `truncated item must be within 2 KB cap, got ${Buffer.byteLength(longLine!, "utf8")}`,
+  );
+});
+
+test("pr-evidence hardening: HTML comment split across summary items is preserved literally", () => {
+  // Documented behavior: each item is sanitized independently. A comment
+  // that begins in one item and closes in the next is NOT joined, so the
+  // open/close markers remain as literal text. This is intentional — joining
+  // items before sanitizing would let an attacker straddle items to inject
+  // an aligned comment that hides the second item from rendered view.
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    summaries: ["first item ends <!--", "--> second item begins"],
+  });
+  // The literal markers survive because each item was sanitized alone.
+  assert.ok(evidence.body.includes("<!--"), "open marker preserved as literal");
+  assert.ok(evidence.body.includes("-->"), "close marker preserved as literal");
+  assert.ok(evidence.body.includes("first item ends"));
+  assert.ok(evidence.body.includes("second item begins"));
+});
+
+test("pr-evidence hardening: clean input is byte-identical to pre-hardening output", () => {
+  // This test is the contract that protects the golden fixtures: the
+  // sanitizer must be a true no-op for well-formed input. If this fails,
+  // there is a bug in the sanitizer (not in the goldens).
+  const cleanInput: PrEvidenceInput = {
+    milestoneId: "M001",
+    milestoneTitle: "Authentication",
+    changeType: "feat",
+    linkedIssue: "Closes #123",
+    summaries: ["### S01\nImplemented login flow."],
+    blockers: ["Awaiting design review"],
+    roadmapItems: ["- [x] **S01: Login**"],
+    metrics: ["**Units executed:** 3"],
+    testsRun: ["npm test", "npm run typecheck:extensions"],
+    why: "Users need to authenticate before accessing protected resources.",
+    how: "Added password hash check and session token issuance.",
+    rollbackNotes: ["Revert the merge commit."],
+  };
+
+  const expected = [
+    "## TL;DR",
+    "",
+    "**What:** Ship milestone M001 - Authentication",
+    "**Why:** Users need to authenticate before accessing protected resources.",
+    "**How:** Added password hash check and session token issuance.",
+    "",
+    "## What",
+    "",
+    "### S01\nImplemented login flow.",
+    "",
+    "## Blockers",
+    "",
+    "- Awaiting design review",
+    "",
+    "## Why",
+    "",
+    "Users need to authenticate before accessing protected resources.",
+    "",
+    "## How",
+    "",
+    "Added password hash check and session token issuance.",
+    "",
+    "## Linked Issue",
+    "",
+    "Closes #123",
+    "",
+    "## Roadmap",
+    "",
+    "- [x] **S01: Login**",
+    "",
+    "## Metrics",
+    "",
+    "- **Units executed:** 3",
+    "",
+    "## Tests Run",
+    "",
+    "- npm test",
+    "- npm run typecheck:extensions",
+    "",
+    "## Change Type",
+    "",
+    "- [x] `feat` - New feature or capability",
+    "- [ ] `fix` - Bug fix",
+    "- [ ] `refactor` - Code restructuring",
+    "- [ ] `test` - Adding or updating tests",
+    "- [ ] `docs` - Documentation only",
+    "- [ ] `chore` - Build, CI, or tooling changes",
+    "",
+    "## Rollback And Compatibility",
+    "",
+    "- Revert the merge commit.",
+    "",
+    "## AI Assistance Disclosure",
+    "",
+    "This PR was prepared with AI assistance.",
+  ].join("\n");
+
+  const actual = buildPrEvidence(cleanInput).body;
+  assert.equal(actual, expected, "clean input must produce byte-identical output (sanitizer is no-op)");
+});