gsd-pi 2.81.0 → 2.82.0-dev.2841a1e44

package/src/resources/extensions/gsd/auto-recovery.ts

@@ -7,7 +7,6 @@
  * globals or AutoContext dependency.
  */
 
-import type { ExtensionContext } from "@gsd/pi-coding-agent";
 import { parseUnitId } from "./unit-id.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { appendEvent } from "./workflow-events.js";
@@ -20,15 +19,6 @@ import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { readIntegrationBranch } from "./git-service.js";
 import { isClosedStatus } from "./status-guards.js";
-import {
-  nativeConflictFiles,
-  nativeCommit,
-  nativeCheckoutTheirs,
-  nativeAddPaths,
-  nativeMergeAbort,
-  nativeRebaseAbort,
-  nativeResetHard,
-} from "./native-git-bridge.js";
 import {
   resolveSlicePath,
   resolveSliceFile,
@@ -46,7 +36,6 @@ import {
   mkdirSync,
   readFileSync,
   writeFileSync,
-  unlinkSync,
 } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { dirname, join } from "node:path";
@@ -1001,205 +990,14 @@ export function writeBlockerPlaceholder(
 }
 
 // ─── Merge State Reconciliation ───────────────────────────────────────────────
+// Body relocated to state-reconciliation/drift/merge-state.ts (ADR-017 #5701).
+// Re-exported here for backward compatibility with existing call sites:
+// auto.ts, auto/loop-deps.ts, tests/integration/auto-recovery.test.ts.
 
-/**
- * Best-effort abort of a pending merge/squash and hard-reset to HEAD.
- * Handles both real merges (MERGE_HEAD) and squash merges (SQUASH_MSG).
- */
-function abortAndResetMerge(
-  basePath: string,
-  hasMergeHead: boolean,
-  squashMsgPath: string,
-): void {
-  if (hasMergeHead) {
-    try {
-      nativeMergeAbort(basePath);
-    } catch (err) {
-      /* best-effort */
-      logWarning("recovery", `git merge-abort failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  } else if (squashMsgPath) {
-    try {
-      unlinkSync(squashMsgPath);
-    } catch (err) {
-      /* best-effort */
-      logWarning("recovery", `file unlink failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  try {
-    nativeResetHard(basePath);
-  } catch (err) {
-    /* best-effort */
-    logError("recovery", `git reset failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-}
-
-export type MergeReconcileResult = "clean" | "reconciled" | "blocked";
-
-/**
- * Detect and abort other in-progress git operations left behind by a SIGKILL'd
- * worker (rebase, cherry-pick, revert). Without this, a killed worker mid-rebase
- * leaves `.git/rebase-merge/` or `.git/CHERRY_PICK_HEAD` and the worktree is
- * wedged until the user manually runs the matching `--abort`.
- *
- * Called before merge-state reconciliation because these states block any
- * subsequent merge/commit operation. (Issue #4980 HIGH-7)
- */
-function reconcileOtherInProgressGitOps(
-  basePath: string,
-  ctx: ExtensionContext,
-): "clean" | "reconciled" | "blocked" {
-  const gitDir = join(basePath, ".git");
-  const states: Array<{
-    label: string;
-    indicators: string[];
-    abort: () => void;
-  }> = [
-    {
-      label: "rebase",
-      indicators: [join(gitDir, "rebase-merge"), join(gitDir, "rebase-apply")],
-      abort: () => nativeRebaseAbort(basePath),
-    },
-    {
-      label: "cherry-pick",
-      indicators: [join(gitDir, "CHERRY_PICK_HEAD")],
-      abort: () => {
-        // No native helper; fall back to git CLI.
-        try {
-          execFileSync("git", ["cherry-pick", "--abort"], {
-            cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
-          });
-        } catch (err) { logWarning("recovery", `cherry-pick --abort failed: ${getErrorMessage(err)}`); }
-      },
-    },
-    {
-      label: "revert",
-      indicators: [join(gitDir, "REVERT_HEAD")],
-      abort: () => {
-        try {
-          execFileSync("git", ["revert", "--abort"], {
-            cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
-          });
-        } catch (err) { logWarning("recovery", `revert --abort failed: ${getErrorMessage(err)}`); }
-      },
-    },
-  ];
-
-  let reconciled = false;
-  for (const s of states) {
-    const present = s.indicators.some((p) => existsSync(p));
-    if (!present) continue;
-    try {
-      s.abort();
-      ctx.ui.notify(
-        `Detected leftover ${s.label} state from prior session — aborted.`,
-        "warning",
-      );
-      reconciled = true;
-    } catch (err) {
-      logError("recovery", `${s.label} abort failed: ${getErrorMessage(err)}`);
-      ctx.ui.notify(
-        `Detected leftover ${s.label} state but auto-abort failed. ` +
-        `Run \`git ${s.label} --abort\` manually before retrying.`,
-        "error",
-      );
-      return "blocked";
-    }
-  }
-  return reconciled ? "reconciled" : "clean";
-}
-
-/**
- * Detect leftover merge state from a prior session and reconcile it.
- * If MERGE_HEAD or SQUASH_MSG exists, check whether conflicts are resolved.
- * If resolved: finalize the commit. If only .gsd conflicts remain: auto-resolve.
- * If code conflicts remain: fail safe without modifying the worktree.
- */
-export function reconcileMergeState(
-  basePath: string,
-  ctx: ExtensionContext,
-): MergeReconcileResult {
-  // First, abort any rebase/cherry-pick/revert left over from a SIGKILL'd
-  // worker. Doing this before the merge-state check unblocks any merge that
-  // would otherwise refuse with "you have unfinished operation". (HIGH-7)
-  const otherOpsResult = reconcileOtherInProgressGitOps(basePath, ctx);
-  if (otherOpsResult === "blocked") return "blocked";
-
-  const mergeHeadPath = join(basePath, ".git", "MERGE_HEAD");
-  const squashMsgPath = join(basePath, ".git", "SQUASH_MSG");
-  const hasMergeHead = existsSync(mergeHeadPath);
-  const hasSquashMsg = existsSync(squashMsgPath);
-  if (!hasMergeHead && !hasSquashMsg) {
-    // If we cleaned up another op type, return "reconciled" so the caller
-    // re-derives state from a known-good baseline.
-    return otherOpsResult === "reconciled" ? "reconciled" : "clean";
-  }
-
-  const conflictedFiles = nativeConflictFiles(basePath);
-  if (conflictedFiles.length === 0) {
-    // All conflicts resolved — finalize the merge/squash commit
-    try {
-      const commitSha = nativeCommit(basePath, "chore(gsd): reconcile merge state");
-      if (commitSha) {
-        const mode = hasMergeHead ? "merge" : "squash commit";
-        ctx.ui.notify(`Finalized leftover ${mode} from prior session.`, "info");
-      } else {
-        ctx.ui.notify("No new commit needed for leftover merge/squash state — already committed.", "info");
-      }
-    } catch (err) {
-      const errorMessage = getErrorMessage(err);
-      ctx.ui.notify(`Failed to finalize leftover merge/squash commit: ${errorMessage}`, "error");
-      return "blocked";
-    }
-  } else {
-    // Still conflicted — try auto-resolving .gsd/ state file conflicts (#530)
-    const gsdConflicts = conflictedFiles.filter((f) => f.startsWith(".gsd/"));
-    const codeConflicts = conflictedFiles.filter((f) => !f.startsWith(".gsd/"));
-
-    if (gsdConflicts.length > 0 && codeConflicts.length === 0) {
-      // All conflicts are in .gsd/ state files — auto-resolve by accepting theirs
-      let resolved = true;
-      try {
-        nativeCheckoutTheirs(basePath, gsdConflicts);
-        nativeAddPaths(basePath, gsdConflicts);
-      } catch (e) {
-        logError("recovery", `auto-resolve .gsd/ conflicts failed: ${(e as Error).message}`);
-        resolved = false;
-      }
-      if (resolved) {
-        try {
-          nativeCommit(
-            basePath,
-            "chore: auto-resolve .gsd/ state file conflicts",
-          );
-          ctx.ui.notify(
-            `Auto-resolved ${gsdConflicts.length} .gsd/ state file conflict(s) from prior merge.`,
-            "info",
-          );
-        } catch (e) {
-          logError("recovery", `auto-commit .gsd/ conflict resolution failed: ${(e as Error).message}`);
-          resolved = false;
-        }
-      }
-      if (!resolved) {
-        abortAndResetMerge(basePath, hasMergeHead, squashMsgPath);
-        ctx.ui.notify(
-          "Detected leftover merge state — auto-resolve failed, cleaned up. Re-deriving state.",
-          "warning",
-        );
-      }
-    } else {
-      // Code conflicts present — fail safe and preserve any manual resolution
-      // work instead of discarding it with merge --abort/reset --hard.
-      ctx.ui.notify(
-        "Detected leftover merge state with unresolved code conflicts. Auto-mode will pause without modifying the worktree so manual conflict resolution is preserved.",
-        "error",
-      );
-      return "blocked";
-    }
-  }
-  return "reconciled";
-}
+export {
+  reconcileMergeState,
+  type MergeReconcileResult,
+} from "./state-reconciliation/drift/merge-state.js";
 
 // ─── Loop Remediation ─────────────────────────────────────────────────────────
 

package/src/resources/extensions/gsd/auto-runtime-state.ts

@@ -56,3 +56,8 @@ export function recordToolInvocationError(toolName: string, errorMsg: string): v
     autoSession.lastToolInvocationError = `${toolName}: ${errorMsg}`;
   }
 }
+
+export function clearToolInvocationError(): void {
+  if (!autoSession.active) return;
+  autoSession.lastToolInvocationError = null;
+}

package/src/resources/extensions/gsd/auto-start.ts

@@ -904,29 +904,24 @@ export async function bootstrapAutoSession(
     {
       const orphan = findUnmergedCompletedMilestone(base, getIsolationMode(base));
       if (orphan && orphan !== state.activeMilestone?.id) {
-        const priorBasePath = s.basePath;
-        const priorOriginalBasePath = s.originalBasePath;
-        s.originalBasePath = base;
-        s.basePath = getAutoWorktreePath(base, orphan) ?? base;
-        const result = _mergeOrphanCompletedMilestone(buildLifecycle(), orphan, ctx.ui);
+        // ADR-016 phase 2 / B4 (#5622): the swap-run-revert protocol for
+        // the orphan-merge dance is owned by `adoptOrphanWorktree`. The
+        // verb snapshots prior `s.basePath` / `s.originalBasePath`, swaps
+        // into the orphan worktree, runs the merge callback under the
+        // swap, and reverts (or holds the swap) based on the result.
+        // Callers can no longer forget the revert step on failure — the
+        // pattern that originally motivated this verb.
+        const lifecycle = buildLifecycle();
+        const result = lifecycle.adoptOrphanWorktree(orphan, base, () =>
+          _mergeOrphanCompletedMilestone(lifecycle, orphan, ctx.ui),
+        );
         if (!result.merged) {
-          s.basePath = base;
-          s.originalBasePath = base;
-          try {
-            process.chdir(base);
-          } catch (err) {
-            logWarning("bootstrap", `could not restore cwd after orphan merge failure: ${err instanceof Error ? err.message : String(err)}`);
-          }
+          // Verb already restored basePath/originalBasePath to `base` and
+          // chdir'd there. Return early.
           return releaseLockAndReturn();
         }
-        if (!s.active) {
-          s.basePath = priorBasePath || base;
-          s.originalBasePath = priorOriginalBasePath || base;
-        }
-        if (result.merged) {
-          invalidateAllCaches();
-          state = await deriveState(base);
-        }
+        invalidateAllCaches();
+        state = await deriveState(base);
       }
     }
 
@@ -1040,7 +1035,10 @@ export async function bootstrapAutoSession(
     s.stepMode = requestedStepMode;
     s.verbose = verboseMode;
     s.cmdCtx = ctx;
-    s.basePath = base;
+    // ADR-016 phase 2 / B2 (#5620): single owner of bootstrap basePath
+    // mutation. Sets s.basePath = base and s.originalBasePath = base
+    // (originalBasePath is empty on a fresh bootstrap).
+    buildLifecycle().adoptSessionRoot(base);
     s.unitDispatchCount.clear();
     s.unitRecoveryCount.clear();
     s.lastBudgetAlertLevel = 0;
@@ -1098,7 +1096,9 @@ export async function bootstrapAutoSession(
     }
 
     // ── Auto-worktree setup ──
-    s.originalBasePath = base;
+    // s.originalBasePath was set to `base` by `adoptSessionRoot(base)` above
+    // (ADR-016 phase 2 / B2, #5620). The redundant assignment that used to
+    // live here is gone.
 
     const isUnderGsdWorktrees = (p: string): boolean => {
       // Direct layout: /.gsd/worktrees/

package/src/resources/extensions/gsd/auto-unit-closeout.ts

@@ -1,3 +1,6 @@
+// Project/App: GSD-2
+// File Purpose: Auto-mode unit closeout metrics, activity capture, and ghost-run detection.
+
 /**
  * Unit closeout helper — consolidates the repeated pattern of
  * snapshotting metrics + saving activity log + extracting memories
@@ -24,6 +27,54 @@ export interface CloseoutOptions {
   gitError?: string;
 }
 
+export interface UnitActivitySnapshot {
+  elapsedMs: number;
+  toolCalls: number;
+  assistantMessages: number;
+}
+
+export const GHOST_COMPLETION_MAX_ELAPSED_MS = 500;
+
+export function snapshotUnitActivity(
+  ctx: ExtensionContext,
+  startedAt: number,
+  now = Date.now(),
+): UnitActivitySnapshot {
+  let toolCalls = 0;
+  let assistantMessages = 0;
+  const entries = ctx.sessionManager.getEntries() ?? [];
+
+  for (const entry of entries) {
+    if (entry.type !== "message") continue;
+    const msg = (entry as any).message;
+    if (!msg || msg.role !== "assistant") continue;
+    assistantMessages++;
+    if (!Array.isArray(msg.content)) continue;
+    for (const block of msg.content) {
+      if (block?.type === "toolCall") toolCalls++;
+    }
+  }
+
+  return {
+    elapsedMs: Math.max(0, now - startedAt),
+    toolCalls,
+    assistantMessages,
+  };
+}
+
+export function isSuspiciousGhostCompletion(
+  ctx: ExtensionContext,
+  startedAt: number,
+  maxElapsedMs = GHOST_COMPLETION_MAX_ELAPSED_MS,
+): boolean {
+  const activity = snapshotUnitActivity(ctx, startedAt);
+  return (
+    activity.elapsedMs < maxElapsedMs &&
+    activity.toolCalls === 0 &&
+    activity.assistantMessages === 0
+  );
+}
+
 /**
  * Snapshot metrics, save activity log, and fire-and-forget memory extraction
  * for a completed unit. Returns the activity log file path (if any).

package/src/resources/extensions/gsd/auto-verification.ts

@@ -39,6 +39,8 @@ import type { VerificationResult as VerificationGateResult } from "./types.js";
 import { join } from "node:path";
 import { resolveUokFlags } from "./uok/flags.js";
 import { UokGateRunner } from "./uok/gate-runner.js";
+import { verificationRetryKey } from "./auto/verification-retry-policy.js";
+import { decideVerificationVerdict } from "./verification-verdict.js";
 
 export interface VerificationContext {
   s: AutoSession;
@@ -48,12 +50,6 @@ export interface VerificationContext {
 
 export type VerificationResult = "continue" | "retry" | "pause";
 
-function isInfraVerificationFailure(stderr: string): boolean {
-  return /\b(ENOENT|ENOTFOUND|ETIMEDOUT|ECONNRESET|EAI_AGAIN|spawn\s+\S+\s+ENOENT|command not found)\b/i.test(
-    stderr,
-  );
-}
-
 /**
  * Post-unit guard for `validate-milestone` units (#4094).
  *
@@ -195,7 +191,7 @@ async function countIncompleteSlices(basePath: string, milestoneId: string): Pro
 /**
  * Run the verification gate for the current execute-task unit.
  * Returns:
- * - "continue" — gate passed (or no checks configured), proceed normally
+ * - "continue" — host-owned verification passed, proceed normally
  * - "retry" — gate failed with retries remaining, s.pendingVerificationRetry set for loop re-iteration
  * - "pause" — gate failed with retries exhausted, pauseAuto already called
  */
@@ -259,6 +255,11 @@ export async function runPostUnitVerification(
       }
     }
 
+    const verdict = decideVerificationVerdict(s.currentUnit.type, result);
+    if (!verdict.passed) {
+      result.passed = false;
+    }
+
     if (uokFlags.gates) {
       const gateRunner = new UokGateRunner();
       gateRunner.register({
@@ -271,10 +272,12 @@ export async function runPostUnitVerification(
             : "verification",
           rationale: result.passed
             ? "verification checks passed"
-            : "verification checks failed",
+            : verdict.reason === "no-host-checks"
+              ? "no runnable host-owned verification checks discovered"
+              : "verification checks failed",
           findings: result.passed
             ? ""
-            : formatFailureContext(result),
+            : verdict.failureContext || formatFailureContext(result),
         }),
       });
 
@@ -331,7 +334,8 @@ export async function runPostUnitVerification(
     }
 
     // Write verification evidence JSON
-    const attempt = s.verificationRetryCount.get(s.currentUnit.id) ?? 0;
+    const retryKey = verificationRetryKey(s.currentUnit.type, s.currentUnit.id);
+    const attempt = s.verificationRetryCount.get(retryKey) ?? 0;
     if (mid && sid && tid) {
       try {
         const sDir = resolveSlicePath(s.basePath, mid, sid);
@@ -341,13 +345,18 @@ export async function runPostUnitVerification(
             writeVerificationJSON(result, tasksDir, tid, s.currentUnit.id);
           } else {
             const nextAttempt = attempt + 1;
+            const includeRetryMetadata =
+              !result.passed &&
+              verdict.retryable &&
+              autoFixEnabled &&
+              nextAttempt <= maxRetries;
             writeVerificationJSON(
               result,
               tasksDir,
               tid,
               s.currentUnit.id,
-              nextAttempt,
-              maxRetries,
+              includeRetryMetadata ? nextAttempt : undefined,
+              includeRetryMetadata ? maxRetries : undefined,
             );
           }
         }
@@ -356,25 +365,6 @@ export async function runPostUnitVerification(
       }
     }
 
-    const advisoryFailure =
-      !result.passed &&
-      (result.discoverySource === "package-json" ||
-        result.checks.some((check) =>
-          isInfraVerificationFailure(check.stderr),
-        ));
-
-    if (advisoryFailure) {
-      s.verificationRetryCount.delete(s.currentUnit.id);
-      s.pendingVerificationRetry = null;
-      ctx.ui.notify(
-        result.discoverySource === "package-json"
-          ? "Verification failed in auto-discovered package.json checks — treating as advisory."
-          : "Verification failed due to infrastructure/runtime environment issues — treating as advisory.",
-        "warning",
-      );
-      return "continue";
-    }
-
     // ── Post-execution checks (run after main verification passes for execute-task units) ──
     let postExecChecks: PostExecutionCheckJSON[] | undefined;
     let postExecBlockingFailure = false;
@@ -565,13 +555,26 @@ export async function runPostUnitVerification(
 
     // ── Auto-fix retry logic ──
     if (result.passed) {
-      s.verificationRetryCount.delete(s.currentUnit.id);
+      s.verificationRetryCount.delete(retryKey);
+      s.verificationRetryFailureHashes.delete(retryKey);
       s.pendingVerificationRetry = null;
       return "continue";
+    } else if (verdict.reason === "no-host-checks") {
+      s.verificationRetryCount.delete(retryKey);
+      s.verificationRetryFailureHashes.delete(retryKey);
+      s.pendingVerificationRetry = null;
+      ctx.ui.notify(
+        "Verification gate FAILED — no runnable host-owned verification checks were discovered. Pausing for human review.",
+        "error",
+      );
+      process.stderr.write(`verification-gate: ${verdict.failureContext}\n`);
+      await pauseAuto(ctx, pi);
+      return "pause";
     } else if (postExecBlockingFailure) {
       // Post-execution failures are cross-task consistency issues — retrying the same task won't fix them.
       // Skip retry and pause immediately for human review.
-      s.verificationRetryCount.delete(s.currentUnit.id);
+      s.verificationRetryCount.delete(retryKey);
+      s.verificationRetryFailureHashes.delete(retryKey);
       s.pendingVerificationRetry = null;
       ctx.ui.notify(
         `Post-execution checks failed — cross-task consistency issue detected, pausing for human review`,
@@ -581,10 +584,10 @@ export async function runPostUnitVerification(
       return "pause";
     } else if (autoFixEnabled && attempt + 1 <= maxRetries) {
       const nextAttempt = attempt + 1;
-      s.verificationRetryCount.set(s.currentUnit.id, nextAttempt);
+      s.verificationRetryCount.set(retryKey, nextAttempt);
       s.pendingVerificationRetry = {
         unitId: s.currentUnit.id,
-        failureContext: formatFailureContext(result),
+        failureContext: verdict.failureContext || formatFailureContext(result),
         attempt: nextAttempt,
       };
       const failedCmds = result.checks
@@ -601,7 +604,8 @@ export async function runPostUnitVerification(
       return "retry";
     } else {
       // Gate failed, retries exhausted
-      s.verificationRetryCount.delete(s.currentUnit.id);
+      s.verificationRetryCount.delete(retryKey);
+      s.verificationRetryFailureHashes.delete(retryKey);
       s.pendingVerificationRetry = null;
       const exhaustedFails = result.checks
         .filter((c) => c.exitCode !== 0)
@@ -617,9 +621,13 @@ export async function runPostUnitVerification(
       return "pause";
     }
   } catch (err) {
-    // Gate errors are non-fatal
     logWarning("engine", `verification-gate error: ${(err as Error).message}`);
-    return "continue";
+    ctx.ui.notify(
+      `Verification gate errored before producing an authoritative verdict: ${(err as Error).message}`,
+      "error",
+    );
+    await pauseAuto(ctx, pi);
+    return "pause";
   }
 }
 

package/src/resources/extensions/gsd/auto-worktree.ts

@@ -1502,6 +1502,14 @@ function autoCommitDirtyState(cwd: string): boolean {
  * On merge conflict: throws MergeConflictError.
  * On "nothing to commit" after squash: safe only if milestone work is already
  * on the integration branch.  Throws if unanchored code changes would be lost.
+ *
+ * @internal **Do not call directly.** This is the inner squash-merge primitive
+ * for the Worktree Lifecycle Module (ADR-016 phase 2 / A3, issue #5619).
+ * Production callers must go through `WorktreeLifecycle.mergeMilestoneStandalone`
+ * or `WorktreeLifecycle.exitMilestone({ merge: true })`. The export keyword
+ * is preserved only so `auto.ts:buildWorktreeLifecycleDeps()` can wire this
+ * function through the Module's deps seam — that is the construction of the
+ * seam, not a bypass.
  */
 export function mergeMilestoneToMain(
   originalBasePath_: string,