39 Commits

Author	SHA1	Message	Date
Tom Boucher	aaf47c5fc2	fix(#3691): let every reviewer lane take a prompt cap, and make the documented global resolve (#3832) ... * test(#3691): failing-first coverage for the reviewer prompt budget No prompt cap can reach any CLI reviewer lane, by any configuration. Two independent defects compound: all nine `transport: spawn` lanes declare `promptBudgetKey: null`, so `budgetFor` returns on its first line; and the documented global `review.max_prompt_tokens` is advertised in the schema manifest but declared nowhere, so the resolver never materializes it and `budgetFor`'s fallback is dead code. Adds to tests/reviewer-config-federation.test.cjs, which already owns the per-reviewer budget config-set/config-get idiom: - a CLI lane inherits the global cap (RED: reports null) - an http lane with the -1 sentinel inherits the global cap (RED: reports null) - the resolved review surface carries max_prompt_tokens at all (RED: absent) - per-lane overrides the global on a CLI lane - the sentinel boundary: -1 inherits, 0 means do-not-trim and must NOT read as unset, 1 is the smallest real budget — the regression budgetFor's own comment warns about - anti-tightening pins that must stay green: an empty config leaves every lane null, the three existing budgeted lanes are unchanged, and config-set still rejects a per-reviewer key naming something that is not a declared lane - a fast-check property over the resolution contract itself, with -1, 0 and non-finite inputs generated explicitly rather than left to chance Every row was reproduced by hand against the real CLI before being written, so the RED/GREEN split is observed rather than predicted. Refs #3691 * fix(#3691): let every reviewer lane take a prompt cap, and make the global resolve No prompt cap could reach any CLI reviewer lane, by any configuration. Two independent defects compounded. The nine spawn-transport lanes — claude, coderabbit, antigravity, cursor, gemini, codex, kimi-code, opencode, qwen — declared `promptBudgetKey: null`, so `budgetFor` returned on its first line and `review-lane plan` reported `promptBudget: null` no matter what was configured. Each now declares `review.max_prompt_tokens_per_reviewer.<slug>` with the same `-1`-is-unset sentinel the three local-server lanes already use. Separately, the central `review.max_prompt_tokens` was listed in the schema manifest's validKeys and documented as a supported setting, but declared nowhere — the resolved surface is built from capability declarations plus the defaults manifest, and neither carried it. `configGet` returned undefined and `budgetFor`'s documented fallback was dead code. It is now declared with a `null` default, exactly as docs/CONFIGURATION.md already specified, so the default behavior is unchanged: nothing configured means nothing trims. Two things the diagnosis had not predicted, found and fixed while implementing: - `REVIEWER_LANES` in src/review-lane-descriptor.cts is a second, hardcoded registration site that `mergeReviewerLanes` prefers over the capability registry on a slug collision. Editing only the capability files left every CLI lane still null. Both sites now agree. - The generated `gsd-core/bin/lib/capability-registry.cjs` was stale and masked the capability edits; regenerated with `npm run gen:capability-registry` rather than hand-edited. docs/CONFIGURATION.md said "Only lanes that declare a budget key accept one — today ollama, lm_studio and llama_cpp". That is false as of this change and is corrected rather than left to rot. The trim-versus-refuse question the issue raises is deliberately not taken up here: the refusal path already exists for the case that matters — a reviewer whose minimum set exceeds its budget is skipped rather than sent a misleading prompt — and trimming above that floor is the documented, shipped design of the feature. Changing it would alter behavior for the three lanes that already work, which is not what the issue asks for. Fixes #3691 * fix(#3691): document the new global and narrow an invariant this change obsoleted The full suite surfaced two consequences of giving every CLI lane a budget key. `review.max_prompt_tokens` entered CONFIG_DEFAULTS without a matching entry in the planning-config reference, which config-field-docs guards. Documented, including the sentinel semantics a reader needs: a per-lane value overrides the global, `-1` means unset and inherits it, and `0` means "do not trim that lane" and is not unset. The #2797 federation guard asserted that "a lane with no model flag and no host owns no config keys". That held only because budget keys existed solely on the three local-server lanes, all of which have hosts. A lane can now legitimately own a config key for a third reason, so qwen tripped it. The assertion is narrowed rather than weakened: such a lane must still own no model key and no host key, and may own at most its own `review.max_prompt_tokens_per_reviewer.<slug>` — never another lane's. That is strictly more specific in the dimensions that still matter. Proven to still bite: hypothetically giving qwen a `review.models.qwen` key fails it with `model/host: review.models.qwen`. The name and comment cite #3691 for why the premise changed, so a reader sees a deliberate narrowing, not erosion. Checked the sibling assertions in that describe block; the other three do not rest on the obsolete premise and are untouched. Refs #3691 * fix(#3685): port the write-flag content-change contract to its three sibling sites #3685 fixed `phase complete`'s `roadmap_updated` / `state_updated`, which reported `fs.existsSync(path)` rather than whether the transaction wrote anything. Three sibling sites carried the identical defect and are ported here. - `cmdPhaseRemove` reported `roadmap_updated: true`, hardcoded. `updateRoadmapAfterPhaseRemoval` now returns whether the content changed and the flag reports it. #2640/#2974 already fixed `state_updated` at this same call site and left this one behind, so the correct shape was adjacent. - `cmdMilestoneComplete` reported `state_updated: fs.existsSync(statePath)` — byte-identical to #3685's bug in a different command. - `cmdMilestoneComplete` reported `milestones_updated: true`, hardcoded, never consulting the MILESTONES.md write. `gsd-core/workflows/remove-phase.md:100` extracts `roadmap_updated` for display and never branches on it, so the flip from always-true to content-based changes no workflow behavior. Verified by reading the step, not assumed. One trap found while implementing: the obvious in-memory `finalContent !== originalStateContent` comparison — copying `cmdPhaseComplete`'s shipped shape verbatim — gives a FALSE POSITIVE for milestone completion. `platformWriteSync` normalizes Markdown at write time, and the milestone-closure transform regenerates `## Current Position` fresh on every call, so its pre-normalize output always differs from the already-normalized file on disk even when the persisted bytes are identical. The comparison is therefore made against the post-write on-disk content. `cmdPhaseComplete`'s own comparisons are left untouched — their repeat-no-op tests pass, so they are not exposed to this artifact. `milestones_updated` has no reachable no-op: the MILESTONES.md write unconditionally appends an entry every call. Only the true direction is pinned, documented inline rather than faked with a passing test. Refs #3685 * fix(#3685): compare write-flag content through the writer's own normalizer An independent reviewer disproved a claim made while porting #3685's contract to its sibling sites: that `cmdPhaseComplete`'s comparisons were not exposed to the Markdown-normalization artifact already diagnosed in `cmdMilestoneComplete`. `platformWriteSync` normalizes on write — CRLF stripped, blank-line runs collapsed, a blank line inserted after a heading, a single trailing newline enforced. Every flag that compares the PRE-normalization in-memory string against the on-disk pre-image can therefore report a change when the persisted bytes are identical. `cmdMilestoneComplete` had been worked around by re-reading the file after the write; the other sites compared raw strings. All of them now go through one exported seam, `contentChangedAfterNormalize(filePath, before, after)`, which normalizes both sides exactly as the writer does. That removes the extra disk read the milestone workaround needed, and makes the sites agree by construction rather than by four independent implementations of one rule — the divergence the repo names as an anti-pattern. Reachability, stated precisely rather than uniformly: the seam is load-bearing at `cmdPhaseComplete`'s `roadmapUpdated`, `requirementsUpdated` and `stateUpdated`, where section-rewrite logic genuinely regenerates content into a different-but-normalization-equivalent shape. At `updateRoadmapAfterPhaseRemoval` it is defense-in-depth: the no-match branch never reassigns `content`, so the raw comparison was already correct there. The first analysis claimed the reverse; this is the corrected finding. Also fixes an unsound test premise the remote suite caught. The byte-identity precondition in `roadmap_updated is false when ROADMAP.md comes out byte-identical` asserted against a hand-authored, un-normalized fixture — so the very first write reformatted it and the file could not come back identical. The fixture is now written already-normalized, so the assertion compares a normalized pre-image against a normalized post-image and still fails if the flag regresses to a hardcoded `true`. Not platform-specific; it reproduces on macOS too, and the earlier local check simply never exercised it. The sibling true-direction and milestone tests were checked for the same premise and do not share it — they assert `notEqual`, or compare two post-write states produced through the same normalizing seam. Refs #3685 * chore(changeset): backfill PR number for #3691 fragment --------- Co-authored-by: sim <sim@local>	2026-08-24 19:39:51 -04:00
Tom Boucher	411196bc3a	refactor(#3471): one enforcement point for the empty case, and reports that match the disk (#3519) ... * refactor(#3471): one enforcement point for the empty case, and reports that match the disk Implements ADR-3408 section 8.5 and section 8.4's residue (folded in when Phase 3 closed as subsumed). Four items, and two findings the design did not predict. FINDING 1 — the guards could not simply be deleted, as the design instructed. state sync and REGENERATE_STATE never run applyStatePreservation at all, so those six conditions were their ONLY empty-field fallback. A baseline probe on the unedited tree confirmed unconditional deletion drops current_phase, current_phase_name, current_plan, stopped_at and paused_at from a blank-body STATE.md on state sync — breaking the byte-identical requirement section 8.3 grants those two sanctioned-permanent exceptions. They are now GATED, not deleted: on for the exceptions, off for the write seam, where an empty derived value finally reaches the executor unmolested. FINDING 2, the more serious one — there was a FOURTH encoding of this policy. The pre-existing #2202 unknown-key carry-forward loop independently restored the same six fields whenever derivedFm lacked the key, completely neutralizing the fix. It is named nowhere in the ADR, the design, or three prior phases. It was found only because a probe that should have passed did not: the first attempt reported divergedFields: [] and silently restored both fields, reproducing the exact bug this phase exists to close. That is worth stating plainly. This epic's thesis is 'policy declared in one table, enforcement hand-rolled per call site.' The final phase found one more call site than anyone had counted — which is the fourth consecutive time a copy count in this epic proved to be a lower bound. Also: divergedFields could only observe fields the executor actively RESTORED, by diffing postFm. A discard-to-empty is absent both before and after, so it was invisible. A second pass now reports it, which is what makes section 8.5's 'preservation is visible' true for the delete-the-body-line case rather than aspirational. cmdPhaseComplete now reports what it preserved — #3374 was filed against that command and its complaint was warnings: [], silence. cmdStateJson's private third copy of the guards is routed onto the executor's preserve-when-unchanged rule. A read is definitionally not a write, so the #1230 delta is 'unchanged' and curated wins over a stale annotation. shouldPreserveExistingProgress is a different rule and is untouched. Report reconciliation is ONE shared helper across seven commands, not five copies of fix(#3351)'s block. Five copies of a reconciliation is precisely the shape this epic removes, and introducing it in the final phase would have been a poor joke. Both untraced commands were traced rather than assumed: cmdStatePlannedPhase matched cmdStateBeginPhase exactly; cmdStateCompletePhase turned out to be a different legacy hand-rolled path reporting a mix of field names AND a section name, where the naive helper would have dropped 'Current Position' as a false negative every time. * test(#3471): characterization coverage for one enforcement point and reconciled reports Matrix sections A-E, asserted at the consumer's output per ADR-3180 Decision 4(b)/(c) — this phase owes Decision 5's outcome metric, the one the drift guard's zero may never be reported without. Three walls matter more than the new coverage: A2 is SIX separately named tests, one per gated guard, not one parameterised assertion over a list. A list is trivially shortened later; six named tests are not, and six guards is exactly where a field gets silently dropped. A6 pins what Phases 1-3 already fixed — non-empty stale body, delta unchanged, losing to fresher curated frontmatter, with the divergence reported. If A6 reddens, this phase broke the thing the epic was for. D1/D2 pin state sync byte-identical. The implementation had to GATE the six guards rather than delete them precisely because state sync has no executor, and a baseline probe showed unconditional deletion drops five fields. Nothing else in the suite would notice that regression. E6 covers #3345's direction — a field preservation restored that the intent never named IS reported. Nothing has ever tested that direction. Assertions were empirically verified against the compiled lib and the real CLI before being written, since the suite cannot be executed locally. That caught two type bugs in the draft: fm.current_phase after a quoted-YAML round-trip is the string '5', not the number 5. E5 is recorded as structurally unreachable rather than weakened or faked. Those four commands report body Title-Case labels, which cannot string-collide with a frontmatter snake_case key the way cmdStatePatch's arbitrary field names can — which is why fix(#3351) targeted only cmdStatePatch. Testing it directly would need reconcileReportedFields exported from private scope; the helper is exercised through E6 and all seven commands instead. * docs(#3471): amend ADR-3408 section 8.5 — a fourth enforcement point, and guards that could not be deleted Amendment 3. The contract held; two of section 8.5's own statements did not. It said the six empty-only guards are DELETED. They cannot be. writeStateMd is the sole path for both section 8.3 sanctioned-permanent exceptions and never runs applyStatePreservation, so those guards were their only empty-field fallback. A baseline probe on the unedited tree confirmed unconditional deletion drops five fields from a blank-body STATE.md on state sync, breaking the byte-identical guarantee section 8.3 grants it. They are gated instead. It also mis-located cmdStateJson's guards, describing them as living in syncStateFrontmatter. They were a separate private copy on the read path with no delta check at all, so a stale body annotation always beat fresher curated frontmatter in state.json — #3395's shape entirely outside the write seam. THE FINDING: a fourth enforcement point nobody had counted. The pre-existing #2202 unknown-key carry-forward loop independently restored the same six fields, silently neutralizing the fix. It is named nowhere in this ADR, in the phase design, or in three prior phases, and was found only because a probe that should have passed did not. Fourth consecutive time a copy count in this epic proved a lower bound: 2 write-seam bypasses became 4, three preservation encodings became four, and the estimate was wrong every time. ADR-3180's standing rule has earned itself in every phase — read the code, not the write-up. Records the Row 2 decision (a discard-to-empty wins per the delta rule and is reported, not silent — the sharpest Hyrum exposure in the epic), section 8.4's residue landing as ONE shared reconcileReportedFields across seven commands rather than five copies, and the parity assertion added because FRONTMATTER_KEY_TO_BODY_LABEL was itself a second table that failed silently — this epic's shape in miniature, in its final phase. * fix(#3471): repair four regressions the checkpoint caught Checkpoint returned 16 failures of 34389: six real regressions in pre-existing tests, plus seven of my own test bugs. My hypothesis was wrong and is recorded as such. I predicted the #2202 carry-forward skip was the cause, reasoning it had removed a load-bearing fallback the way the six guards nearly were. It was not implicated in any of the six. Three unrelated causes: #2111 — current_phase came back undefined from milestone complete, which is the epic's own defect class reintroduced by its final phase. Root cause is Row 2 working exactly as designed: milestoneCompleteCore rewrites the body Phase: line to a closure message, so current_phase's #1230 delta reads CHANGED and the new rule correctly discards the curated value. The transition never declared any intent to touch that field. Fixed by re-asserting current_phase and current_phase_name through authoritativeFm — the existing #2736 mechanism beginPhaseCore and completePhaseCore already use — rather than by weakening Row 2, which A5 pins. That interaction is worth naming: a rule that keys on 'did this write change the body source' will fire on a transition that moves the body line for an entirely unrelated reason. The design did not anticipate it. #1264 / #3242 / the state.patch progress report — reconcileReportedFields folded EVERY divergedFields entry into updated, including preserve-always progress restores no caller asked about. Now scoped to preserve-when-unchanged rows only. #1162 / case-insensitive table fields — valueOf checked frontmatter before body, so a lowercase table field name exact-matched the lowercase frontmatter key sync always derives, comparing stale pre-sync body text against a post-sync frontmatter enum. Flipped to body-first. That last one is the SAME lesson as Phase 2's patchCore, recurring in a different function two phases later: in this model the body is authoritative and frontmatter is the projection, so a name that could mean either resolves body-first. Twice now. Test bugs: a stray unused parameter shifted every argument at six call sites, so body arrived undefined; and A4 compared nested progress scalars against numbers when extractFrontmatter returns raw YAML strings. The string-vs-number YAML round-trip has now been caught three times in this phase alone. * test(#3471): one helper for the progress coercion that bit four times A2f failed on the string-vs-number YAML round-trip: extractFrontmatter returns nested progress scalars as raw YAML strings, so a comparison against numeric literals can never pass. This is the FOURTH time this exact class has been caught in this phase — twice during test authoring, once as A4 in the previous checkpoint, now as A2f. Patching it a fourth time by hand would guarantee a fifth. Added numericProgress() with a comment saying why it exists, and routed every progress-reading assertion in the #3471 block through it. Swept the block: C3 needed no change, because cmdStateJson's output already runs through normalizeProgressNumbers. Deliberately NOT shared with frontmatter.test.cjs's readPersistedProgress: that one is path-based and re-reads from disk, while these assert on an in-memory string that is never written. Sharing would have meant either a disk round-trip these tests do not do, or duplicating half the helper — so the coercion pattern is mirrored locally and the reason recorded, rather than manufacturing a dependency to satisfy the letter of consolidation. * chore(#3471): backfill pr number in changeset fragment --------- Co-authored-by: sim <sim@local>	2026-08-14 21:06:01 -04:00
Tom Boucher	e2f4c16d9e	refactor(#3469): one composition for the STATE.md write seam (#3501) ... * docs(#3469): amend ADR-3408 section 8.3 — the pipeline has sanctioned exceptions Section 8.3 read 'Every STATE.md write applies the pipeline.' That is false by design for two commands, and acting on it would have inverted a shipped feature. Preservation makes curated frontmatter win over a re-derived body value. state sync exists to do the opposite — #905's 'body annotation beats existing frontmatter when both are present'; it re-derives frontmatter FROM the body. REGENERATE_STATE is a factory reset that rebuilds STATE.md from scratch. Applying the pipeline to either would re-lock exactly what the command was invoked to replace. This issue's own scope line, inherited from the epic, said to route the direct writeStateMd callers through the pipeline. For cmdStateSync that would have shipped silently, with every gate green, because no test asserts that sync LETS the body win. Caught by reading the helper's docstring and then verifying the claim against the code — a stale comment had already misdirected this epic once. Both commands are now named in a closed exception list and are permanent ratchet entries. Consequence recorded rather than left to bite Phase 4: the 'drive the ratchet to 0 and delete the file' target in this ADR and in #3471 is wrong. Two entries are permanent, so the correct end state is 2, and the honest report is '0 removable bypasses, 2 sanctioned'. A guard reaching 0 here would only do so by having stopped looking at two real writers. * refactor(#3469): one composition for the write seam, not one per caller Implements ADR-3408 section 8.3 as amended. syncAndPreserveStateMd is now the single composition of syncStateFrontmatter and applyPostSyncPreservation. readModifyWriteStateMd and cmdPhaseComplete both CALL it instead of each assembling the two steps themselves. cmdPhaseComplete keeps its own writePlanningFileSet envelope — the composition returns content, it does not take over the write, so STATE.md still commits atomically with ROADMAP and REQUIREMENTS. Assembling the stages at a call site is a re-derivation even when every step calls an owner. Upstream's fix(#3374) routed cmdPhaseComplete through applyPostSyncPreservation but left it calling syncStateFrontmatter directly first, so the composition was duplicated and free to diverge with both guards green. That is ADR-3180 Amendment 2's finding repeating on the write side. cmdMilestoneComplete gains preservation. It wrote through writeStateMd, so it got sync and no preservation — the identical shape #3374 reported for phase.complete, and flagged upstream as a follow-up in the helper's own docstring. This is that follow-up. Divergence is now visible: preservation_warnings names each field restored over a disagreeing derived value. Deliberately NOT named warnings — cmdPhaseComplete already exposes warnings as a prose string array, and two sibling commands carrying that name with different element types is Generative Fix Divergence, the class this epic exists to remove. patchCore stops running stateReplaceField over the whole document. One observable consequence, intended per design row 9: a frontmatter-shaped patch key with no body counterpart now reports failed instead of silently succeeding, because the old whole-document match was literally hitting the YAML line case-insensitively. The guard closes Phase 1's DECLARED KNOWN GAP as promised rather than re-deferring it: section 8.3(b) detection is tractable now the composition exists. Scoped by two factors to avoid Phase 1's measured 29-to-1 false positive rate — a variable field-name argument AND a content argument whose nearest preceding assignment is not stripFrontmatter. Verified 0 findings and 0 false positives across all 33 call sites, plus 5 synthetic shapes. It also detects the re-assembly shape above. Ratchet: 4 entries to 2, both sanctioned-permanent. cmdStateSync's owner changes from #3471 to sanctioned-permanent per Amendment 2 — routing it through preservation would invert the #905 contract. Also fixed inline rather than deferred: cmdMilestoneComplete's STATE.md read now happens inside withStateLock. It previously read outside any lock before writeStateMd took its own, leaving a TOCTOU window under concurrent writers. * test(#3469): characterization coverage for the single write seam Matrix sections A-E. Criterion 6 was amended by maintainer decision — all five instances closed by point fixes while Phase 1 was in flight — so these are characterization tests at the consumer's output per ADR-3180 Decision 4(b)/(c), paired with the drift guard's count, never either alone. Section C is the one that earns its keep. cmdStateSync is a sanctioned permanent exception: state sync exists to re-derive frontmatter FROM the body, so preservation there re-locks exactly what the command was invoked to replace. C1 pins that the body wins; C4 pins that this phase left the command byte-identical. Nothing else in the suite would notice if a future change made sync start preserving, and the natural reading of 'one write seam' is to make precisely that change. Section E pins the guard's false-positive scoping. E4 (updateCore's strip-then-replace) and E5 (sectionBody-scoped calls) must NOT be reported — the naive detector measured 29 false positives to 1 true positive in Phase 1. E7 is the inverse: a sanctioned-permanent entry disappearing must FAIL, because a guard reaching zero here would only do so by having stopped looking at two real writers. Also corrects a stale test that asserted patchCore's old whole-document behavior, which this phase deliberately changes. One honest limitation, flagged rather than papered over: A1's 'byte-identical to pre-refactor' cannot be diffed against real pre-refactor bytes from inside the suite. It is implemented as the seeded fast-check property that cmdPhaseComplete's composed output equals readModifyWriteStateMd's for the same inputs — the strongest available proxy, not the literal claim. * docs(#3469): refresh the seam glossary entry and add the changeset Two spec-review gaps, both real. CONTEXT.md's STATE.md Transition Module entry named three direct writeStateMd callers including cmdMilestoneComplete. This phase routed that one through the composition, so the line was false the moment the refactor landed. Worth recording plainly: I wrote that sentence in Phase 0, correcting an older stale pointer in it, and my own Phase 2 change invalidated it again within the same epic. That is the exact drift this epic exists to remove, demonstrated on the epic's own documentation — and it is why the entry now ends by saying the whole-repo drift guard, not this line, is the authoritative count. The entry now records the composition (syncAndPreserveStateMd) and states that exactly two direct callers remain, both SANCTIONED PERMANENT rather than debt. Changeset: type Changed, because milestone complete's observable output moves. Tier-2 per ADR-3180 Decision 3 — a stale body line no longer wins over fresher frontmatter, and the command gains preservation_warnings. Docs requirement is met by the ADR amendment already in this diff. * test(#3469): register property-test temp-dir cleanup at creation time Standards review, minor but real: the new fast-check property cleaned up its temp dirs in a loop AFTER fc.assert returned. A genuine property failure throws, so that line never ran and every dir from the failing run — including all of fast-check's shrinking iterations — leaked. The failure path is exactly when a littered machine hurts most, and a failing property test is the case the test exists for. Cleanup is now registered with t.after() at dir-creation time, so teardown happens however the test exits. Not try/finally — CONTRIBUTING.md:356 bans it inside test bodies, which is why the after-the-assertion shape existed in the first place. Swept the rest of the branch's test diff for the same shape; phase.test.cjs already uses registered teardown and nothing else matched. * fix(#3469): patchCore routes frontmatter writes instead of dropping them Checkpoint returned 10 failures of 33880. One implementation defect, three test defects, one stale test — all fixed, and the implementation defect is the one that matters. patchCore stripped frontmatter and then reconstructed it VERBATIM, applying no patches to it. An arbitrary custom frontmatter key with no body counterpart and no FIELD_CLASSIFICATION row — risk_level in the upstream fix(#3351) test — therefore always reported failed and silently never wrote. It worked before, via the old whole-document match on the raw YAML line. That is a regression against this phase's own design row 9, which requires frontmatter changes to ROUTE THROUGH the seam — still work, policy-governed — not to stop working. Removing a capability is not routing it. An upstream test caught it, which is the argument for running the checkpoint before believing the refactor. patchCore now partitions by frontmatter shape, decided structurally from the parsed frontmatter's own keys rather than a naming heuristic: - classified keys still report failed — policy owns them and a raw patch may not bypass it; - unclassified keys apply to the frontmatter object and report updated — Phase 1's behavior-table row 19, a field with no row is not this contract's business; - body-shaped keys are unchanged. The property 'failure' was my own test breaking the repo's Clock Seams rule. The two paths agree byte-for-byte; the only difference was last_updated, stamped from the wall clock on two invocations milliseconds apart, so it could never pass. Time is now frozen with mock.timers across both — not by excluding last_updated from the comparison, which would have silently stopped comparing a field the composition writes. B4's fixture could not discriminate: normalizeStateStatus maps any text containing 'complete' to 'completed', and milestone complete's own new body value derives to exactly that — which was also the fixture's stale value. The stale value is now 'executing' so the assertion can tell 'body correctly won' from 'stale survived'. B5's fixture tripped a pre-existing unstarted-phase guard before reaching any write-seam code; it now has the matching phase directory. D9 asserted the old exempt set. readModifyWriteStateMd now calls one symbol rather than assembling two, so it needs no exemption; syncAndPreserveStateMd is the sole legitimate composition site. * fix(#3469): patchCore resolves body-first, so the body wins a name collision Re-verification returned 2 failures of 33880, both D4 — the hostile row for a key that exists as BOTH a frontmatter key and a body field. The partition checked frontmatter first, so 'status' — classified in FIELD_CLASSIFICATION and also present as a body 'Status:' line — routed to the frontmatter branch, was rejected as classified, and reported failed. Wrong order. Patching 'status' means the body field, and upstream fix(#3351) says so in its own comment: 'the legitimate working case for state.patch is display-cased BODY fields — Status, Current Plan, Phase.' The body is authoritative in this model; frontmatter is the projection. D4 asserted exactly that and was right. Resolution order is now body, then frontmatter: 1. resolves to a body field -> apply to body, updated 2. else an own key of the frontmatter: classified -> failed (policy owns it) unclassified -> apply to frontmatter, updated 3. else -> failed Verified by probe against the compiled lib for all four cases rather than asserted: risk_level (frontmatter-only, unclassified) still lands; current_phase still fails; display-cased Status unchanged; D4's lower-cased status now lands via the body with the frontmatter untouched. The current_phase case was the one that could have regressed silently, so its fixture was read rather than assumed — D1's body carries 'Phase: 3 (alpha)' and no 'Current Phase:' line, so body-first cannot reach it. * chore(#3469): backfill pr number in changeset fragment --------- Co-authored-by: sim <sim@local>	2026-08-14 16:04:09 -04:00
Tom Boucher	2283168612	fix(#3170): anchor milestone one-liner extraction to a summary-shaped heading (#3401) ... * test(#3170): extractOneLinerFromBody must anchor to a summary-shaped heading Regression for #3170: the function matched the first heading's first bold run, so an incidental first heading (rule list, deviation notes) contributed its bold text as the milestone accomplishment. Rows 1/2 fail RED on next; rows 3/4 guard Overview recognition and the #2660 Summary-heading form. * fix(#3170): anchor milestone one-liner extraction to a summary-shaped heading extractOneLinerFromBody matched the first heading's first bold run regardless of section, so an incidental first heading (rule list, deviation notes) contributed its bold text as the milestone accomplishment written into MILESTONES.md. Iterate headings and extract from the first Summary/Overview/ Accomplishments one with a bold run, falling back to null when none exists. The #2660 Summary-heading forms and the frontmatter one-liner precedence are preserved. * docs(#3170): add changeset * test(#3170): align extractOneLinerFromBody unit fixtures with summary-heading contract The core-utils unit fixtures used generic # Title headings encoding the old 'any first heading' contract; the #3170 fix anchors to a Summary/Overview/ Accomplishments heading (the function is summary-specific). Update the heading text to Summary-shaped; the extraction assertions (bold, frontmatter strip, colon-label, CRLF, unicode) are unchanged. * docs(#3170): backfill changeset PR number (3401) --------- Co-authored-by: sim <sim@local>	2026-08-12 22:21:53 -04:00
JusticeWay	77374cfc32	fix(#2528): resolve digit-leading phase directories by bare number (#2559) ... * fix(#2528): resolve digit-slug phase dirs by bare number — tokenizer rewind, shared bare-integer fallback, resolution-path parity gate extractPhaseToken welded 2-digit slug words onto the phase token (phase 10 named "24/7 Autonomy" -> dir 10-24-7 -> token 10-24), making digit-prefixed phase names unresolvable by bare number across every phase verb. - phase-id: continuation segments must be the PURE 2-digit zero-padded form the write side emits; a 1-digit terminator rewinds the absorbed run (10-24-7 -> 10) while >=2-digit terminators keep the locked #2232 round-trip (14-06-2026-photos -> 14-06). - phase-id: new matchPhaseDirs owner — primary exact-token match plus a bare-integer leading-digit-run fallback for shapes the tokenizer cannot rewind (05-80-20-cleanup); collisions stay #2237-loud. - locator/find-phase/phase-plan-index all delegate selection to the owner; plan-index gains the previously missing multi-match guard. - tests: #2528 unit + fast-check metamorphic blocks; new 9-scenario resolution-path parity gate across all three paths. Fixes #2528 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(#2528): add changeset for PR #2559 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#2528): align validation token grammar * fix: address phase token review * fix: restore phase grammar parity for numeric slugs * docs: document digit-leading phase resolution * docs: clarify ambiguous phase resolution behavior * docs: register canonical phase directory selectors * fix: align prefixed deep phase token parsing * fix(#2528): route the fourth resolution site through matchPhaseDirs Review BLOCKER. smart-entry.cts::detectVerifyFailed resolved the current phase's directory with its own `.find(phaseTokenMatches)` and never reached the shared selection, so the bare-integer-fallback family the issue names — `05-80-20-cleanup`, `30-12-factor-refactor` — resolved nowhere. The miss is silent by construction: an unresolved phase reports "not failed", which is byte-identical to a healthy one, so a failed verification simply never surfaced in /gsd or /gsd:progress. `entries` is already sorted and matchPhaseDirs filters without reordering, so matches[0] reproduces the previous selection exactly wherever the old code resolved at all. Wiring it into phase-resolution-parity.test.cjs as a fourth path then exposed a second, older defect in the same function: phaseTokenFromDirName shape-probed the UNSTRIPPED token, so a project-code-prefixed directory (`MEM-05-…`, tokenizing to `MEM-05-80-20`) failed the leading-digit test and was dropped before any resolution ran — every phase in a project-coded plan was invisible to this check. The probe now runs on the stripped token; the returned value is unchanged, so the comparePhaseNum sort is untouched. Path 4 has no JSON surface to compare, so the gate observes selection indirectly: plant the failing artifact in exactly one directory and a passing one everywhere else, then read the boolean. Reverting either fix turns 5 of the 10 corpus scenarios red. * refactor(#2528): collapse the duplicated extractCanonicalPlanId Review MAJOR. The function existed as two independent, byte-identical copies — src/core-utils.cts and src/phase.cts — and this PR had to patch BOTH with the same single-digit-slug rewind rule. That is the generative fix divergence CLAUDE.md names, and only the core-utils copy was under test, so a future one-sided patch would have silently split plan-id canonicalization between the plan listing and everything else. Removed rather than parity-tested: core-utils was already the leaf owner and already exported it, and phase.cts already imported that module, so there is no second surface left for a parity test to police. * test(#2528): pin matchPhaseDirs at the digit-width boundaries Review MAJOR. The bare-integer fallback's correctness rests entirely on capturing each directory's whole leading digit run before the zero-strip compare; a regex that stopped short would turn every query into a prefix match, and "1" would claim 10, 100, and 12 alike. The existing coverage was example-based and never touched that boundary. Adds the explicit 9/10 and 1/10/100 cases — including the forms where only the wider directories exist, so an exact-width neighbour cannot satisfy the assertion — plus a fast-check property over arbitrary distinct leading runs. The property is stated as an invariant on the result (every returned directory's leading run IS the query) rather than an expected list, so it covers primary and fallback matches alike and cannot be satisfied by reimplementing the selection in the test. Both fail when the fallback regex is degraded to a prefix match. * fix(#2528): route the remaining eight consumers through matchPhaseDirs phaseTokenMatches had eight consumers left that each rebuilt the directory selection around it by hand: phases-list, next-decimal, phase-remove, the W021 milestone-consistency check, schema-drift, the init-manager overview, milestone-complete's disk check, and roadmap analyze. Every one of them reproduced the reported symptom in full after the tokenizer was fixed. None of them derives a displayed phase number from the matched directory, so none needs phaseNumberForMatch; the change at each site is the selection and nothing else. matchPhaseDirs filters without reordering, so matches[0] reproduces the prior .find() choice wherever the old code resolved at all. phaseTokenMatches now has no call sites outside phase-id.cts. It stays exported as the primitive matchPhaseDirs is built from and as a pinned canonical surface, but no consumer reaches past the owner to it. * test(#2528): extend the parity gate to the migrated consumers Each of the eight is observed through the surface a user sees, not through the matcher, with a no-directory control so the assertions cannot be satisfied by a consumer that resolves unconditionally. init-manager and roadmap-analyze are additionally asserted to agree with each other. * refactor(#2528): own the case-flexible phase grammar and the leading-digit-run fragment validate.cts derived its case-flexible regex sources by running `replaceAll('A-Z', 'A-Za-z')` over two constants exported by phase-id.cts. That passes lint-phase-id-drift.cjs — there is no literal copy of the grammar — but it depends on the owner rendering that exact substring. The day phase-id.cts expresses the same class any other way the replaceAll silently no-ops and validate.cts narrows to uppercase-only. The failure mode is a NON-match, so nothing throws and no uppercase-only fixture notices. Both variants are now derived once, beside the sources they widen, and imported. Also names the leading digit run the bare-integer fallback selects on. It was spelled `/^(\d+)(?:-|$)/` where the fallback filters and `/^\d+/` where phaseNumberForMatch reads the number back off the winner; selecting on one run and displaying another would resolve a directory and then label it with a number that never matched it. * fix(#2528): refuse to remove a phase when two directories claim its number cmdPhaseRemove was the only migrated site taking matches[0] with no multi-match guard. Every sibling resolution path returns ambiguous_matches and refuses to choose; this one is the DESTRUCTIVE path, so choosing silently is strictly worse than anywhere else. With 05-80-20-a and 05-90-till-late on disk, `phase remove 5 --force` deleted one of them and renumbered every phase after it — where the base resolved nothing, deleted nothing, and the corpus in tests/phase-resolution-parity.test.cjs already declared that exact input ambiguous. The refusal is emitted before any file is touched and carries both candidates. CONSUMER_SCENARIOS could not express the case — every row is binary, resolving to one directory or to none — so the gate gains a dedicated ambiguous test. It asserts on the filesystem, not only on the reported directory_deleted: a null printed after an rmSync would satisfy every other check. * fix(#2528): pair digit-leading phase directories with their roadmap phase in validate health W006/W007 are the ninth site of this bug class and the one a `phaseTokenMatches` grep could never surface: they resolve roadmap↔disk by intersecting TOKEN SETS, which is a dir→token labelling rather than the query→dir selection matchPhaseDirs owns. On the canonical fixture the label is wrong in both directions at once, so `validate health` reported "Phase 5 in ROADMAP.md but no directory on disk" AND "Phase 05-80-20 exists on disk but not in ROADMAP.md" for the same directory. collectDiskPhases now keeps the directory names behind each token, so W006 can ask the canonical matcher whether a roadmap phase resolves to a real directory, and W007 — which iterates directories and therefore has no query to resolve — gets the inverse mapping it never had: a directory is claimed when some roadmap phase resolves to it. Both checks are additive: the token intersection still decides every shape it already decided, and the resolution can only REMOVE a warning. The regression test carries controls in the other direction — a roadmap phase with no directory must still raise W006, an unclaimed directory must still raise W007 — so it cannot be satisfied by a check that stopped reporting. * docs(#2528): state and pin the directory-side scope of the bare-integer fallback The matchPhaseDirs docblock claimed deep-decomposition lookups were untouched. That is true of the QUERY side only — no non-bare query enters the fallback — but the DIRECTORY side is what changed classification: a bare `5` now reaches a lone `05-01-auth` and resolves it (phase_number "05", phase_name "01-auth") where the base found nothing. The widening is irreducible from directory names alone. `05-01-auth` (sub-phase 5.1) and `30-12-factor-refactor` (phase 30 named "12-Factor Refactor") are the same `NN-NN-<slug>` shape, and the discriminator that would separate them — "is the second segment a valid decimal sub-phase" — accepts `5.1` and `30.12` equally. Any rule strong enough to exclude the first excludes the second, which is the defect #2528 exists to fix. So the tie is broken in favour of resolving, the docblock now says so, and the consequence is bounded where it matters: two such directories are two matches, and every caller (including phase remove) refuses to choose. Pins both directions, since nothing observed the directory side before. * fix(#2528): count surviving phases by identity in phase remove's STATE resync #2640 landed on `next` while this branch was open. Its STATE.md phase-count resync re-derives "which directory was removed" from the query with `phaseTokenMatches`, which is the tenth site of this issue's defect: the bare-integer fallback resolves `05-80-20-cleanup` for query `5`, but the token predicate does not, so the just-deleted directory is counted as still present and the written `Total Phases` is one too high. `targetDir` already IS the directory that was removed, and the block is gated on it being non-null, so identity answers the question exactly — which is also what the comment above the filter already claimed it did. This keeps `phaseTokenMatches` out of `phase.cts` rather than re-importing it to satisfy one call site: the module's public surface should not grow for a question that does not need re-derivation. Pinned in the parity gate with a control on a directory the tokenizer reads correctly, so the assertion is about the digit-leading shape and not about the counting rule changing for everything. * fix(#2528): let the resolution layer own the digit-leading slug family alone The tokenizer rewind this fix carried — pop the last absorbed continuation when the segment that stopped the scan is a bare single digit — reads "10-24-7-autonomy" (phase 10 named "24/7 Autonomy") correctly and silently re-reads "10-24-7-zip" (sub-phase 10.24 named "7-Zip Integration") from "10-24" to "10". The two names are string-identical in shape, so no local signal separates them; the rule traded the reported ambiguity for the symmetric one a level down, on a 15-caller chokepoint whose output also feeds query-less derivations (STATE.md phase counts, W007, the #2562 key surface). A well-formed sub-phase directory became unresolvable by its own id — the very symptom #2528 was filed about. It also bought nothing. The bare-integer fallback in matchPhaseDirs already resolves "10-24-7-autonomy" for query "10" whatever the token is: no primary match, bare query, leading digit run "10". The reported case was covered twice, by two rules, and the two disagreed about the case nobody reported. So the rewind is removed rather than narrowed, in the tokenizer and in the five surfaces kept in lockstep with it (BRACKET_PHASE_TOKEN_SOURCE, PHASE_TOKEN_FROM_DIR_RE, canonicalPlanStem's pair grammar and its collision branch, roadmap-parser's numericRe, extractCanonicalPlanId), together with the SINGLE_DIGIT_RUN_SEGMENT_SOURCE owner constant they shared. Disambiguation now lives only where a QUERY exists to disambiguate against, which is the same bounded mechanism the "05-80-20-cleanup" shape already used. Measured, not argued: over 29800 generated directory names, extractPhaseToken is byte-identical to `next` on every input except the lowercase-continuation class ("01-20a", "05-80-20-25abc") — a rule about the segment itself, not a guess about its neighbour. Both readings now stay reachable by their own ids: matchPhaseDirs(['10-24-7-autonomy'], '10') -> the dir (fallback) matchPhaseDirs(['10-24-7-zip'], '10') -> the dir (fallback) matchPhaseDirs(['10-24-7-zip'], '10-24') -> the dir (primary) * test(#2528): pin the one-continuation boundary the rewind had no coverage for The regressing shape was invisible to the suite by construction, not by luck: the deep-rewind property built its cases from `continuationArb` with `minLength: 2`, so it never exercised the single-continuation case — exactly one genuine sub-phase level before a digit-leading slug — and every hand-written fixture used the ambiguous shape only where "phase-plus-slug" was the intended reading. `continuationArb` is now `minLength: 1` and the property states the invariant instead of the old rule: for any prefix, phase, 1-5 continuations and any one-digit terminator, the token equals the FULL continuation run on both the imperative and the regex surface, and `matchPhaseDirs([dir], token)` returns that dir. That third assertion is the one that catches the class on its own — the old behaviour made a well-formed directory unresolvable by its own id, which is a property, not a fixture. Around it: "10-24-7-zip" and "10-24-3d-printer" now sit beside "10-24-7-autonomy" everywhere the family is pinned, so the two readings can never diverge again; the 24/7 metamorphic property asserts the RESOLUTION result rather than the token (the token is precisely the part no surface may decide); the end-to-end parity corpus gains "a sub-phase with a digit-leading slug resolves by its full id" across all four resolution paths; and the milestone-scoping residual is pinned in three directions rather than left to prose. Mutation: re-inserting the rewind and rebuilding turns 9 tests red, the `minLength: 1` property first, and nothing else. Build success checked separately (build:lib reports 0 `error TS`), so the mutation reached the artifact under test. * test(#2528): pin the #2946 guard against digit-leading phase directories The #2946 fix makes the milestone-complete unstarted-phase guard run unconditionally, so whether it fires now rides entirely on the directory-resolution owner this PR replaces. Two cases, both with STATE.md carrying no `milestone:` field so the #2946 path is the one exercised: - ROADMAP Phase 5, disk `05-80-20-cleanup` → guard must stay silent. RED on next (fail-closed: the guard blocks a legitimate one-way-door operation because phaseTokenMatches resolves neither 05 nor 80 for that directory). - ROADMAP Phase 80, same directory → guard must still fire. Green on both sides; it pins the fail-open direction against a future widening of the matcher. * fix(#3175): stop the injection scanner reading RegExp.exec as code execution The apostrophe fix in 27aa40f6 replaced ["\x27] with a real ["'] class. The old class never contained an apostrophe at all (POSIX bracket expressions do not honour backslash escapes, so it was the set ", \, x, 2, 7), so only exec(" matched. Single-quoted method calls now match for the first time, and RegExp.prototype.exec takes a subject string, not code: any PR touching a file that tests a regex goes red. On next, six files match the scanner's own pattern across 16 method calls. A plain [^[:alnum:]] boundary cannot separate the two forms because . is not alnum, so exec gets [^[:alnum:].] and the command-execution vector moves to a dedicated member-call pattern. Bare exec('rm -rf /'), cp.exec(...) and child_process.exec(...) all still fire. Mutation: reverting the boundary reds 1 test and only it; removing the member-call pattern reds the 2 non-weakening tests and only them. Co-Authored-By: Claude <noreply@anthropic.com> * fix(#2528): keep exec( detection receiver-blind, allowlist the two grammar suites The left boundary [^[:alnum:].] added in 58a7b560 excluded a preceding dot, which dropped every member-position .exec('…') from the scanner. The follow-up receiver pattern only restored three literal spellings (child_process, childProcess, cp), so require('child_process').exec('…') — the most common Node spelling of the vector this pattern exists to catch — became invisible, along with any opaque receiver (conn.exec, shelljs.exec). Revert the pattern to its receiver-blind form and handle the RegExp.prototype .exec false positive where the script already handles this class: per-file ALLOWLIST entries for the two phase-token grammar suites. Mutation-checked — removing the two entries reds exactly those two files and nothing else. The four assertions written around the old patterns are replaced by a table-driven set covering all six spellings, including the three the narrowed pattern silently lost. Co-Authored-By: Claude <noreply@anthropic.com> * docs(#2528): pin the three undeclared grammar edges, correct the ambiguity claim Review round 10 asked for declaration, not behavior change, on four items. All four have zero production consumers or preserve their caller's prior rule, so each is pinned as a test or corrected in prose rather than reverted. - BRACKET_PHASE_TOKEN_SOURCE: the (?=-|$) terminator is what keeps the bracket read path in step with the other surfaces, and it costs the display shapes (`05.03: Title`, `12A: X`, `05.03]` no longer tokenize). Pinned so widening the terminator class is a deliberate act rather than a lookahead deletion. - canonicalPlanStem: uppercase plan suffixes still strip, lowercase and dotted sub-plans now fall through. Dead export; pinned as a decision on record. - getMilestonePhaseFilter: `12A-01-foo` now yields `12A-01`, matching what `12-01-foo` has always yielded. The letter suffix was the only reason a sub-phase directory folded into its parent phase's milestone window; the two shapes now agree. Not named in the review — found auditing the same commit. - matchPhaseDirs docblock claimed every caller refuses on multi-match. Four do; five take matches[0]. Replaced the claim with the actual two-tier policy and the honest caveat that the bare fallback makes multi-match newly reachable for queries that previously found nothing. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Tom Boucher <trekkie@nomorestars.com>	2026-08-12 20:45:04 -04:00
Tom Boucher	481ac7c71b	fix(#2946): run milestone complete unstarted-phase guard independent of STATE (#3081) ... * test(#2946): milestone complete unstarted-phase guard fails open on STATE desync Row 1 of the test matrix: the regression test that fails first. Adds seven cases to tests/milestone.test.cjs covering the desync, absent, no-file, --force-override, mismatch-WARNING, fresh-project-noop, and sentinel-skip behaviors. RED on next: the guard's entire scan is nested inside `if (stateVersion && stateVersion === version)`, so any STATE.md milestone: value that does not exactly equal the version argument skips the scan with no warning — functionally an implicit --force on a one-way-door operation. * fix(#2946): run milestone complete unstarted-phase guard independent of STATE The entire ROADMAP phase-directory scan was nested inside `if (stateVersion && stateVersion === version)`, so any STATE.md milestone: value that did not exactly string-equal the version argument — a desynced value, or no milestone: field at all — skipped the scan with no warning, functionally an implicit --force. The operation the guard fronts is a one-way door: ROADMAP.md and REQUIREMENTS.md are archived and phase directories are MOVED into .planning/milestones/<version>-phases/. The scan was already driven by the version argument through getMilestonePhaseFilter / extractCurrentMilestone; the STATE match was a redundant second gate that shadowed and broke it. Decouple: the scan now runs whenever --force is absent, and a present-but-mismatched STATE milestone: field emits a WARNING naming both values so the suspicious condition is visible rather than silent. A fresh project with no Phase headings in the scoped slice still yields an empty scan (no false positives) — the intent the STATE-match short-circuit was reaching for, now achieved by the scan itself. * docs(#2946): document milestone complete --force, --dry-run, and the unstarted-phase guard The CLI-TOOLS reference signature omitted --force and --dry-run entirely, and neither the unstarted-phase guard nor its override was documented anywhere user-facing. Add a flags table and a factual guard description to the Reference page (CLI-TOOLS.md), and a practical guard note to the /gsd-complete-milestone How-to (COMMANDS.md) covering what to do when the guard fires and the new STATE-mismatch WARNING (#2946). American English per CONTRIBUTING.md language policy. * fix(#2946): emit STATE-mismatch WARNING as JSON in --json-errors mode Follow-up to the guard decoupling: a structured caller using --json-errors parses stderr line-by-line as JSON, so the plain-text WARNING would break such a parser. Honor getJsonErrorMode() and emit a structured JSON object ({ ok, level, message }) in that mode, plain text otherwise — mirroring io.cts error()'s JSON shape. Addresses the isolated-review observation (~45% but credible, since --json-errors is a documented CLI flag). * fix(#2946): address review — drop JSON-mode WARNING scope creep, tighten test assertions Standards + spec review findings (code-review two-axis + isolated adversarial): 1. The --json-errors JSON WARNING branch (commit dee719404) was scope creep the issue never asked for, AND emitted ok:true for a suspicious-condition warning (a category error — a stderr JSON parser keying on ok would treat the suspicious state as success), AND its comment falsely claimed to mirror io.cts error()'s {ok:false,reason,message} shape. Dropped: the WARNING is now plain-text stderr only, matching the existing [gsd-tools] WARNING convention (state.cts). The issue asked for 'at minimum warn', not a structured JSON surface. 2. The WARNING test asserted on /WARNING/ regex (raw-text matching on stderr prose). Tightened to assert on the stable operator-facing tokens — the WARNING: marker and both version literals the operator must see — not the surrounding formatter prose. Added a paired negative test confirming no WARNING is emitted for an absent milestone: field (a missing declaration is a normal fresh-project state, not suspicious drift). * fix(#2946): sanitize STATE milestone value before stderr WARNING interpolation Security review (minor): stateVersion is read from a user-controlled file (STATE.md) and is not validated like the CLI version arg. Sanitize before interpolating into the WARNING — strip ANSI/control chars (/[\x00-\x1f\x7f]/g -> '?') and truncate to 80 chars — so a corrupted or hostile STATE.md cannot echo terminal escapes or secret-looking strings verbatim into a CI log or terminal aggregator (CONTRIBUTING.md security: secret-looking values in stderr). version is already constrained to [A-Za-z0-9._-] by ARCHIVE_VERSION_LABEL_RE upstream, so it needs no sanitization. * test(#2946): correct stale fixtures that relied on the guard being silently disabled Four pre-existing tests broke under the #2946 fix because their fixtures only passed thanks to the bug — the unstarted-phase guard was skipping on STATE mismatch, so fixtures with missing or non-matching phase directories slipped through. The tests exercise version-forwarding / version-scoping, not the guard, so give them legitimate directories: - milestone.test.cjs #3043: dirs were '103.old'/'104.old'/'108.new' (dot), which phaseTokenMatches rejects — renamed to hyphen form. The v3.6 stats scoping still yields 1 phase (getMilestonePhaseFilter scopes correctly); the guard now sees all three phases as having directories. - milestone-archive.test.cjs 'returns version in response data': ROADMAP listed Phase 1 but no directory was created. Added 01-foundation so the scan is satisfied. Per CONTRIBUTING.md, test-fixture corrections land as their own test: commit, not bundled into fix: (release hotfix cherry-pick routes by prefix). * chore(#2946): backfill changeset PR number 3081 --------- Co-authored-by: sim <sim@local>	2026-08-05 10:42:42 -04:00
Tom Boucher	9f567a1627	fix(#2788): recover Gaps Found rows; mark-complete no longer false-succeeds on a rejected row (#2902) ... * fix(#2788): recover Gaps Found rows; mark-complete no longer false-succeeds on a rejected row Two coupled defects in the requirement traceability state machine: Defect 1 (terminal state): requirements revert-phase (the gaps_found response) left a row at 'Gaps Found' with no inverse — neither mark-complete's /^pending$/i guard nor the phase-complete reconcile's /^(?:pending|in progress)$/i accepted it, so a single failed verification stranded every requirement permanently and blocked the milestone. Widen both guards to accept 'gaps found' so a genuinely-satisfied stranded row reaches Complete again. Defect 2 (false success): mark-complete ORed checkboxHit || tableHit for 'updated', so on a Gaps Found row it flipped the checkbox but could not move the row, yet reported updated:true. When a traceability table has a row for an ID, gate 'updated' on the row moving (tableHit) — a checkbox-only flip on a table-bearing file no longer lies. The #2140 table_unmatched path (no row for the ID) is preserved. * chore(#2788): backfill changeset PR 2902 --------- Co-authored-by: Test <test@example.com>	2026-07-31 00:04:04 -04:00
Tom Boucher	8d2f8bcb23	fix(#2388): gate shared requirement completion on sibling plans, revert on gaps (#2424) ... * fix(#2388): gate shared-ID requirement marking and revert on gaps_found Adds requirements.ready-ids (execute-plan.md's update_requirements step) so a requirement ID declared by multiple plans in a phase only marks Complete once every declaring plan has produced a SUMMARY.md, and requirements.revert-phase (execute-phase.md's gaps_found branch) so a gaps_found verdict reverts the phase's own prematurely-Complete IDs before the gap report renders. Single-plan IDs still mark immediately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#2388): regenerate fixtures + lint gate-prep * fix(#2388): repair failing tests after gate verification * chore(#2388): add changeset (#2424) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-19 07:52:17 -04:00
Tom Boucher	c1885df9e5	chore(#2143): prohibition-with-teeth + migrate remaining ad-hoc table sites — Phase 4 (final) (#2253) ... * chore(#2143): prohibition-with-teeth + migrate remaining table sites — Phase 4 Phase 4 of epic #2143 (ADR-2143 §7). Completes the markdown table/mutation consolidation by (a) giving the ad-hoc-parsing prohibition teeth and (b) migrating the last ad-hoc table sites onto the shared seam. - src/markdown-table.cts: new formatting-preserving `updateTableCell` primitive (self-contained, ragged-row-tolerant header/delimiter/cell-range scan; splices only the target cell's raw span, preserving all other bytes incl. padding/CRLF; no-op-preserves-padding when a transformer returns the current value). Exports splitTableRow/isDelimiterRow/findTableStartOffset for tolerant reuse. - eslint-rules/no-adhoc-markdown-parsing.cjs: TABLE-REGEX detector extended to `new RegExp(<literal|static-template>)`; new `.replace()`-mutation detector for roadmap/state/content receivers with a table/section-shaped pattern. - scripts/lint-table-schema-drift.cjs (wired into lint:ci): fails if a TABLE_SCHEMA header drifts from its authored table; tests import its logic (single source). - Migrated onto the seam (behaviour-preserving vs pre-Phase-4 HEAD, verified byte-diff old-vs-new): roadmap.cts cmdRoadmapUpdatePlanProgress, phase.cts cmdPhaseComplete + traceability, milestone.cts cmdRequirementsMarkComplete, uat.cts read path, state.cts metrics/decisions/By-Phase. - Incidental correctness gains from the migration: a decoy table can no longer swallow a phase-progress update (## Progress scoping); a ragged neighbouring row no longer silently aborts an edit; completing integer phase N no longer touches a decimal sub-phase N.x row; record-metric no longer drops trailing section content or duplicates the ## Performance Metrics section. - Kept justified allow-adhoc-markdown markers only where genuinely not a table (security.cts <|role|> token) or a loose non-GFM section (uat human-verify). Two orthogonal isolated reviews (correctness/adversarial + security) passed; correctness found 4 behaviour regressions in the first migration pass, all fixed and re-verified byte-identical-or-better vs OLD. Surfaced for maintainer (pre-existing, ambiguous domain logic, NOT changed here): templates/state.md places a By-Phase table under ## Performance Metrics while cmdStateRecordMetric assumes a Plan|Duration|Tasks|Files table. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): match traceability row by first-cell value, not Requirement header Phase 4's migration matched the REQUIREMENTS.md traceability row by a column literally named `Requirement` (`row['Requirement']`), but real tables head that column `REQ-ID`. The by-name lookup found nothing, so `phase complete` and `requirements mark-complete` left the Status cell `Pending` (regressed #2769 / #2203, caught by gsd-test — 8 failures, both node 22/24). - src/phase.cts, src/milestone.cts: match the row by its FIRST cell's value (the requirement-ID column) regardless of that column's HEADER name, via `Object.values(row)[0]` (updateTableCell builds the record in header order). This mirrors OLD's first-cell `\|\s*<id>\s*\|` anchor, restoring header-name independence while keeping the seam. - src/milestone.cts hasTable: broadened from `Requirement`-only to also recognize `Requirement ID` / `REQ-ID` / `REQ ID` headers, kept in sync with the now-positional rowMatch/hasRow so a REQ-ID-headed table participates in the ADR-2143 §6 write-set and the #2140 table_unmatched drift check (it was silently omitted before — a checkbox-only partial reconcile against a REQ-ID table could report as fully reconciled). The `Requirement`-headed path is byte-identical to OLD. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#2143): replace stale structural milestone guards with behavioural suite The `milestone.cjs regex global state fix` block was a source-structure guard (allow-test-rule: structural-regression-guard) — it readFileSync'd the compiled milestone.cjs and asserted removed regex idioms (`tablePattern.test`, `afterTable !== reqContent`, `doneTable = new RegExp(...)`). Phase 4's migration deleted those regexes (table update is now updateTableCell), making the assertions obsolete. Per the Test Cleanup rule, replace them in-PR with a behavioural suite driving the compiled CLI: - multi-ID mark-complete flips all IDs (guards the lastIndex/global-state class), - Pending->Complete flip under both `REQ-ID` and `Requirement` headers (#2769), - idempotent already_complete detection with no corruption, - REQ-ID-headed table participates in write_set (traceability entry, applied), - REQ-ID-headed table trips #2140 table_unmatched drift on a missing row. Pruned the now-nonexistent structural-regression-guard entry from the lint-allow-test-rule-refs allowlist (the source-text-is-the-product entry for the same file remains valid). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(changeset): backfill PR number 2253 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): record-metric targets its own metrics table, not By-Phase velocity `state record-metric` appended its per-plan row (`| Phase 1 P1 | 5min | 3 tasks | 4 files |`) into the FIRST table under `## Performance Metrics` — which on a real template-derived STATE.md is the By-Phase velocity table `| Phase | Plans | Total | Avg/Plan |`, polluting it on EVERY plan completion (execute-plan.md:414 is a per-plan call). The command's own metrics table is `| Plan | Duration | Tasks | Files |`, which the template does not ship, so the row never reached it; the scaffold branch also emitted a wrong `| Phase | Plan | Duration | Notes |` header matching neither the row nor the canonical table. Pre-existing (predates Phase 4); surfaced while migrating this site and fixed here per no-defer, on the user's explicit go-ahead. - src/state.cts cmdStateRecordMetric: locate the metrics table by its own header shape (`Plan|Duration|Tasks|Files`, via splitTableRow/isDelimiterRow) rather than "first table in the section". When the section exists but has no metrics table (only the By-Phase table), self-heal by appending a fresh **Per-Plan Metrics:** table to the END of the section body — By-Phase table, Recent Trend and footer preserved verbatim, no duplicate `## Performance Metrics` heading, created stays false. Absent-section scaffold header corrected to the canonical `| Plan | Duration | Tasks | Files |`. Ragged-tolerance + None-yet preserved. - Not touching templates/state.md (golden-install-parity hashed) — record-metric self-creates the table on first use instead. Failing-first regression test (tests/state.test.cjs) demonstrates the By-Phase pollution on the pre-fix build, then green after. Verified: no pollution, self- heal idempotency, both-tables isolation, content/heading preservation, flags, None-yet, corrected scaffold header (23-check adversarial harness + all existing record-metric scenarios). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(#2143): deleteSection seam primitive (level-bounded whole-section removal) ADR-2143 §4 shipped withSection/collectSection (replace a section BODY) but no way to DELETE a section (heading + body). Phase 4 suppressed the phase-remove section delete instead of building it. deleteSection(content, predicate, opts) locates the section via the collectSection machinery and splices out from the heading's start offset to the next same-or-higher-level heading — so a level-3 `### Phase N` delete stops at a following level-2 `## Progress`, never past it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): phase remove no longer deletes ## Progress on last-phase removal updateRoadmapAfterPhaseRemoval deleted a `### Phase N` detail section with a greedy raw regex whose lazy scan, on the LAST phase, ran to EOF and destroyed the following `## Progress` heading and its entire tracking table — silent data loss, uncovered by tests (removal tests only exercised a middle phase). Migrated onto the new deleteSection seam (level-bounded, stops at `## Progress`); dropped the allow-adhoc-markdown SECTION-DELETION suppression. Failing-first regression (tests/phase.test.cjs) removes the LAST phase and asserts the ## Progress heading + table survive; middle-phase removal is byte-identical. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(#2143): deleteTableRow seam primitive (row removal, ragged-tolerant) Sibling of updateTableCell: locates the first GFM table, matches a DATA row by predicate (ragged-tolerant record build, header order), and splices out that row's whole line preserving every other byte. Returns {ok:false,reason} on no table / no match. Enables migrating the phase-remove Progress-table row delete off its ad-hoc regex (ADR-2143 §7 — the "future row-delete seam" Phase 4 punted). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): phase remove deletes the Progress row via deleteTableRow The Progress-table row delete used a whole-document regex with two defects: (a) `\.?\s` required whitespace after the phase number, so a COMPACT row `|2|Beta|` was never deleted (stale row left behind); (b) unscoped — it could strike a row in a different table (e.g. an earlier `| Phase | Requirements |` table). Migrated onto deleteTableRow, scoped to the `## Progress` section (mirrors deriveProgressFromRoadmap), matching the row by first-cell phase number (integer zero-pad-insensitive; decimal exact; removing `2` never touches `2.5`). Both allow-adhoc-markdown suppressions removed. New behavioural tests: compact unpadded row deleted; padded byte-parity on the surviving rows (their ordinal correctly renumbers via the pre-existing renumber block). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): deleteTableRow leaves no dangling newline on last EOL-less row Deleting the final row of a table with no trailing EOL sliced from the row's start to end-of-string, stranding the newline that terminated the previous line. Back rowStart over the preceding \r?\n in that branch so the table ends cleanly. (Caught by the primitive's own unit test on gsd-test; local scenario checks missed the no-trailing-EOL edge.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): migrate read-only section-collects onto collectSection Six hand-rolled `## Section` read-extract regexes replaced by the collectSection seam (behaviour-preserving; extracted bodies feed the same downstream parsers): state.cts matchSessionSection (## Session / ## Session Continuity) + ## Blockers, smart-entry.cts ## Blockers, audit.cts ## Current Focus + ## Open Questions. Removes 6 allow-adhoc-markdown "pending #1372" suppressions. Incidental fix: the old Session regex `## Session[ \t]*\n` silently failed on a CRLF `## Session\r\n` heading (Windows STATE.md), nulling all session fields; collectSection is CRLF-safe, so session state now resolves on Windows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): fence-safe state-transition section writes + dedup stripFrontmatter - milestoneCompleteCore's `## Current Position` and `## Operator Next Steps` section resets used fence-blind raw regexes that a fenced `##` inside the body could truncate/mis-target (#2130/#2067/#2080 class). Migrated onto a fence-aware tokenizeHeadings-based helper (resetSectionVerbatim) that is byte-identical to the old output on the canonical path (9/9 fixtures) and correctly ignores a fenced fake heading (proven robustness gain). - mutateCurrentPositionFirstTime: hand-rolled locate+splice → collectSection + replaceSection (byte-parity). - stripFrontmatter was inlined byte-identically in state.cts AND state-transition.cts; hoisted the single canonical copy into frontmatter.cts (both call sites now import it) + unit tests — eliminates the divergence risk per CLAUDE.md "Generative Fix Divergence". Removes 3 allow-adhoc-markdown / #1372 markers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): name-address By-Phase sum + uat parse, eslint recall hole, catches - state.cts By-Phase "Total plans completed" sum: positional 2nd-cell regex → name-addressed splitTableRow read (correct on a reordered header, where the old code silently summed the wrong column). Marker removed. - uat.cts parseVerificationItems: loose pipe regex → splitTableRow within the existing table/numbered/bullet union scan (item list byte-identical; does NOT reintroduce the reverted strict-parseMarkdownTable item-drop). Marker removed. - eslint no-adhoc-markdown-parsing: close the `new RegExp(identifier)` recall hole — resolve a const-declared table-shaped regex identifier (mirrors the .replace() detector) + RuleTester cases; param/call args stay out (boundary). - commands.cts: delete a lying comment that claimed the scaffold date "stays on raw UTC / deferred" — #2136 already moved it to realClock.localToday(). - Empty catches (classified, not blind-swept): removed 4 dead try/catch; fixed 3 error-hiding (phase-insert decimal-dir I/O collision now fails loud; phase-remove rename partial-failure surfaced; milestone-archive true count via finally); left best-effort swallows with justification comments. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): extractFencedBlock seam + migrate api-coverage named fence parseCoverageMatrix extracted its ```coverage fenced block with an ad-hoc regex (the last real allow-adhoc-markdown suppression). Added extractFencedBlock to the markdown-sectionizer seam (reuses stripFencedCode's CommonMark fence engine — info-string match, ~~~/backtick, nesting, indent) and migrated onto it; byte- parity on the parsed CoverageMatrix across 8 fixtures. Only security.cts:367 (a genuine `<|role|>` protocol-token false-positive, not a GFM table) remains marked in src/ — the "prohibition with teeth" goal (nothing grandfathered but a true FP) is met. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): By-Phase row insert is name-addressed (insertTableRow seam) updatePerformanceMetricsSection's INSERT-new-row branch located the By-Phase table with a canonical-column-order-only regex + a hardcoded positional row literal, so on a reordered header it silently inserted nothing — inconsistent with the now name-addressed UPDATE and SUM halves of the same function. Added insertTableRow (markdown-table seam sibling of updateTableCell/deleteTableRow: name-addressed, header-order-agnostic, EOL-preserving) and migrated the branch onto it, mapping By-Phase values by column NAME. Canonical-order output is byte-identical; a reordered header now inserts a correctly-mapped row; a pre-existing CRLF mixed-EOL splice glitch is incidentally fixed. Retired the now-dead byPhaseTablePattern const. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): phase-list checkbox flip via updateBullet seam Added updateBullet (markdown-sectionizer): a fence-aware, offset-tracked single-bullet write primitive (GFM 1–4-space marker tolerance) — the write counterpart to read-only iterateBullets. Migrated mutateMilestonePhase's phase-list checkbox flip (`- [ ] Phase N …` → `- [x] … (completed <date>)`) off its whole-slice regex onto it, same milestone-slice scope + clock seam. Byte-identical across simple / idempotent / metachar-title / double-space / CRLF scenarios. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): scope the Progress-ordinal renumber to ## Progress via seam phase remove's integer-renumber decremented Progress-table phase ordinals with a whole-document `content.replace(/(\|\s*)(\d+)(\.\s)/g, …)` — unscoped, so it also rewrote any `| N. …` cell in an unrelated/decoy table (same class as the batch-2 row-delete scoping bug). Migrated onto updateTableCell, scoped to the ## Progress section, decrementing each affected row's leading phase ordinal by column name. Byte-identical on canonical Progress tables + multi-row + decimal-sibling cases; a decoy `| 3. … |` row before ## Progress is now correctly left untouched. The sibling heading / checkbox-bullet / PLAN.md-filename / Depends-on-prose renumbers are not GFM-table mutations (outside ADR-2143's table/section mandate) — left as-is. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#2143): review fixes — scope traceability write, restore Current Position H3-stop Adversarial review of the remediation (BLOCK verdict) — all 9 findings fixed: - F1 (BLOCKER): requirements mark-complete / phase complete flipped the checkbox but NOT the traceability row on the shipped template, because updateTableCell bound to the FIRST table (## Out of Scope, no Status column) instead of the ## Traceability table — the #2140 silent-divergence class, re-introduced by the seam migration and missed by tests (fixtures had Traceability first). Scoped the write + hasRow probe to the ## Traceability section slice (updateTraceability Cell helper) in milestone.cts + phase.cts. Failing-first tests on the Out-of-Scope-before-Traceability layout; the #2769 first-cell match preserved. - F2 (MAJOR): mutateCurrentPositionFirstTime restored to locateCurrentPosition (STOP_H2_PLUS) — collectSection's default H2-stop swallowed a level-3 subsection and the field regexes clobbered it (#2130 class). - F3/F8: Progress-ordinal renumber re-escapes via escapeCell + keys padding recovery by row index (was de-escaping `\|` and losing padding on dup values). - F4: insertTableRow escapes cell values internally. - F5: updateBullet accepts a tab after the marker (`[ \t]{1,4}`). - F7: resetSectionVerbatim consumes CRLF blank lines (byte-parity on CRLF). - F6/F9: corrected two misleading comments. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(changeset): data-loss + CRLF-session user-facing fixes (#2253) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#2143): de-flake the G10 windsurf ReDoS-guard wall-clock assertion The G10 test asserted `elapsedMs < 1000` for a 200k-char payload — a wall-clock assertion (CLAUDE.md: never assert on wall-clock time) that flaked on a loaded node24 bench at ~1.1s. It was redundant: runHook's spawnSync `timeout: 10000` already SIGKILLs a catastrophic-backtracking hook, so the exit-0 assertion is the real ReDoS guard. Removed the timing assertion; kept exit-0 + documented the subprocess-timeout mechanism. Surfaced (not caused) by this branch's gsd-test runs loading the bench; unrelated to the markdown-parsing changes but fixed in place per the no-flaky-tests rule. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-14 14:25:44 -04:00
Tom Boucher	2cbf186420	chore(#2143): fail-loud Result + per-surface write-set contract — Phase 3 (#2251) ... * chore(#2143): fail-loud Result + per-surface write-set contract — Phase 3 Phase 3 of epic #2143 (ADR-2143 §5/§6). The three target bugs (#2140, #2112, #2118) were already fixed tactically on next; this introduces the reusable structural contracts and rewires the primary #2140 site onto them. - src/write-set.cts (new): the parse `Result<T> = {ok,value|reason}` (§5) and the per-surface write-set (`WriteOutcome {surface, applied, requirement?}`, `WriteSet`, `writeSetComplete`) (§6). markdown-table.cts now imports + re-exports `Result` from here (single source; distinct from command-routing-hub's Result). - requirements mark-complete (src/milestone.cts): returns a PER-REQUIREMENT, per-surface write-set; `write_set_complete` is true only if every surface of every requirement applied — structurally forbidding the #2140 OR-into-one-flag masking, including across a multi-ID batch (adversarial-review regression). Pre-existing output fields unchanged (behaviour-preserving; #2140 already fixed). - deriveProgressFromRoadmap (src/phase-lifecycle.cts): removed the vestigial null-swallowing try/catch (findTableWithColumns never throws) — ADR §5 no-swallow; RoadmapProgress return contract unchanged. - commit --files (#2112) and milestone complete --dry-run (#2118) left as-is (single-surface commit / pre-mutation preview — not genuine multi-surface writes). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#2244): backfill changeset PR number (#2251) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 20:39:58 -04:00
Tom Boucher	481f00e38a	fix(#2118): honor --dry-run in milestone complete with zero-mutation preview (#2155) ... * fix(2118): honor --dry-run in milestone complete with zero-mutation preview milestone complete treated --dry-run as a no-op: the flag was neither parsed nor rejected, so a caller who expected a preview instead triggered the full destructive mutation (archive phases → move audit artifacts → rewrite STATE.md) with no way to back out. Fix (option 2 from the issue): add dryRun to MilestoneCompleteOptions, parse --dry-run in the dispatcher, and return a JSON preview plan (would_archive, would_update) after the read-only stats gathering but before any mutations. Also gated platformEnsureDir on !dryRun so the archive directory is not created during preview. 3 regression tests: no-mutation happy path, --no-archive-phases combo, and --force bypass combo. * docs(changeset): backfill PR number (#2155) * chore(#2118): regenerate pi/qwen golden fixtures after next merge The milestone --dry-run fix changes gsd-core/bin/gsd-tools.cjs; qwen.json (missed at authoring) and pi.json (added on next, never carried the fix) were the only two runtime fixtures still holding the pre-fix hash. All other runtimes already reflect the change. Regenerated via the sanctioned gen-golden-install-parity script. * fix(#2118): surface accomplishments in dry-run preview; fix --dry-run --raw Orthogonal review findings on the --dry-run preview: - The preview omitted the already-computed accomplishments (the primary MILESTONES.md content a real run writes); surface it as a top-level field, mirroring the real-run result. - `--dry-run --raw` discarded the structured payload and printed the literal string "dry-run"; drop the raw-value arg so --raw emits the full preview JSON, matching the real-run output() call. Adds tests: --dry-run --raw is parseable JSON, preview includes accomplishments, and --dry-run --force is proven zero-mutation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 00:02:52 -04:00
Tom Boucher	cee8d7d723	test(#2140): cover checkbox/table divergence in requirements mark-complete ... Adds the fixture the green suite lacked: an ID with a checkbox and a traceability table that does NOT mention it. Asserts (1) a checkbox-only reconcile surfaces table_unmatched instead of a silent full-success payload, (2) re-run on the half-written file does NOT mask the drift as already_complete, and (3) a REQUIREMENTS.md with no traceability table stays a clean success.	2026-07-12 16:06:29 -04:00
Tom Boucher	e7ff7be1a4	fix(#2125): migrate state.cts prose parsing to canonical parser (drives #2111) ... Phase 2 of epic #2121. state.cts:parseProsePhaseField now delegates to the anchored phase-id.cts:parsePhaseFromProse (built in Phase 1), removing this module's independent prose phase-id regex. Drives #2111: `milestone complete vX.Y` no longer corrupts current_phase. The body line "Phase: Milestone v0.5 complete" previously had "5" mined from it by the unanchored regex; the anchored parser returns { phase: null }, so syncStateFrontmatter's #905 guard preserves the real current_phase. This also fixes the broader family the review surfaced — every milestone completion (e.g. v1.0 -> "0") was silently corrupting current_phase, not just .5-versions. Regression (tests/milestone.test.cjs, in the milestone-complete suite, #2111): `milestone complete v0.5` on a project with current_phase: "19" now preserves "19". Demonstrated fail-first end-to-end: reverting the migration reproduces current_phase = "5". Closes #2125 Refs #2121 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-09 17:57:47 -04:00
Tom Boucher	e2bfe4dc67	fix(#1993): milestone --ws requirements archive header points at workstream path (#2015) ... * fix(#1993): milestone --ws requirements archive header points at workstream path The requirements archive header hardcoded the root .planning/REQUIREMENTS.md path, so a workstream (--ws) archive pointed readers at the wrong file even though #1917 fixed the archive LOCATIONS to land inside the workstream. Derive the display path from the same workstream-aware reqPath the writer already uses (path.relative(cwd, reqPath)). Root behavior is byte-identical ('.planning/REQUIREMENTS.md'); the --ws case now correctly reads '.planning/workstreams/<ws>/REQUIREMENTS.md'. - src/milestone.cts: reqDisplay interpolation in the archive header. - tests/milestone.test.cjs: #1993 regression in the #1911 --ws block — header references the workstream path, not the root literal. Closes #1993 * docs(#1993): backfill changeset pr 2015 * fix(#1993): use posix separators in archive header (Windows CI) + CRLF-safe test split - src/milestone.cts: normalize path.relative output to POSIX separators so the workstream archive header renders forward slashes on Windows too (path.relative yields backslashes there; the original literal was posix). - tests/milestone.test.cjs: .split(/\r?\n/) for the CRLF-fragile lint rule.	2026-07-05 14:03:43 -04:00
Tom Boucher	697cbb1f05	test(#1977): consolidate 22 misc + repo-invariant regression tests ... Final epic-#1969 batch. Fold 22 issue-named files: the 4 genuine repo-wide invariant scans (551-eslint-bin-lib-coverage, bug-3054 stale /gsd-next, bug-3810 no-gsd-sdk-runtime-refs, feat-3593 cli-negative-universal) into a NEW shared repo-invariants.test.cjs; the other 18 as singletons into their nearest module suite (model-resolver, codex-config, runtime-converters, security, state-transition, worktree-safety, roadmap-parser, etc.). Verbatim block-scoped describe wrappers; 334 subtests conserved 1:1. Host-env pre-check (B2+B6): the 6 CLI folds into GSD_TEST_MODE-setting hosts (model-resolver/ codex-config/runtime-converters) are benign — each origin independently sets GSD_TEST_MODE=1 itself (idempotent), unlike the B6 real-install case. Regenerates regression-name allowlist (222->213), ratchets file-count allowlist (state 17->16), makes 7 relocated allow-test-rule exemptions issue-ref-compliant (ADR-456; prunes stale ids). Repoints 2 tests/ refs in docs/TESTING-SUITES.md. lint:ci green. Part of epic #1969. Closes #1977. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-03 10:06:11 -04:00
Tom Boucher	85ed50cc4f	test(#1972): consolidate 94 command/module regression tests into subject suites ... Fold 94 issue-named command/module regression files into the canonical test file that owns each subject-under-test, across 52 existing suites (state, config, frontmatter, roadmap-parser, capability-registry, shell-command-projection-dispatch, plan-phase-drift-guard, health-validation, runtime-converters, commands, etc.). Verbatim block-scoped describe wrappers; 881 subtests conserved 1:1. No new test files. Host-env pre-check (per B2): the only GSD_WORKSTREAM/GSD_PROJECT-touching destinations (intel, planning-workspace) clear those vars hermetically, so folded CLI tests are safe. Regenerates regression-name allowlist (222->162), ratchets file-count allowlist across 8 buckets (validate entry removed after dropping <=2), makes 34 relocated allow-test-rule exemptions issue-ref-compliant (ADR-456; prunes 34 stale ids). Repoints CONTEXT.md + ADR-0002/443/1235/3524 test-file references. lint:ci green. Part of epic #1969. Closes #1972. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-03 08:59:23 -04:00
Tom Boucher	de3ba45d00	test(#1971): consolidate 48 gsd-tools CLI regression tests into subcommand suites ... Fold 48 issue-named gsd-tools CLI regression files into the canonical test file that owns each subcommand subject (state, roadmap, phase, milestone, audit, config, router/dispatch, stats, verify, health, etc.), preserving every assertion and its origin issue number as provenance (block-scoped describe wrappers, 299 subtests conserved 1:1). No monolithic gsd-tools.test.cjs created — routes into 18 existing per-subject suites. Removes 48 tests/ files. Regenerates regression-name allowlist (271->231), ratchets the file-count allowlist across 6 buckets (audit/milestone/phase/roadmap/state/verify), and makes 10 relocated allow-test-rule exemptions issue-ref-compliant (ADR-456; prunes 10 stale ids). Repoints one CONTEXT.md symptom ref and ADR-3524's parity-test ref. lint:ci green. Part of epic #1969. Closes #1971. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-03 01:55:48 -04:00
Tom Boucher	92091d71f2	fix(#1871): wire phase archival end-to-end (phases archive cmd + default + atomic) (#1924) ... Follow-up to #1919 (archive-then-remove core). Closes the remaining #1871 acceptance criteria so phase history is preserved across the full milestone lifecycle, not just at phases.clear: - #2 src/milestone.cts + src/phases-command-router.cts: extract shared archivePhaseDirectories() helper; add cmdPhasesArchive (the previously half-wired phases.archive alias now routes instead of erroring Unknown). - #4 gsd-tools.cjs + src/milestone.cts: milestone complete archives phase dirs by default (--no-archive-phases opts out; --archive-phases is now a harmless no-op). complete-milestone.md updated to drop the redundant manual Yes/Skip archive prompt. - #3 gsd-core/workflows/new-milestone.md: §6 stages the archive move + source removal (git add .planning/milestones/ .planning/phases/) in the same commit as the milestone start, so the archive lands atomically — no orphaned uncommitted deletions, no un-archived dirs inherited. - docs/CLI-TOOLS.md (+ ja/zh/ko/pt) + help/modes/full.md: flag accuracy. - tests: phases archive command (#2) + milestone complete default archive / --no-archive-phases opt-out (#4). Goldens + workflow size baseline refreshed. Closes #1871	2026-07-02 11:14:01 -04:00
Tom Boucher	88da609b3e	fix(#1911): milestone complete --ws archives to the workstream (#1917) ... cmdMilestoneComplete hardcoded three archive paths to root .planning/ while its siblings (roadmap/requirements/state/phases) used workstream-aware planningPaths. So `milestone complete <v> --ws <name>` scattered its archive into root and never created workstream-local milestones/. Derive the archive base from the workstream-aware planning root: - milestonesPath / archiveDir / auditFile now use planningPaths(cwd).planning - flat mode (no --ws) is a no-op (planningPaths(cwd).planning == root .planning) Regression in tests/milestone.test.cjs: --ws archives into the workstream milestones dir, not root. Closes #1911	2026-07-02 10:25:11 -04:00
Tom Boucher	463cffd894	chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615) ... * chore(#604): rename get-shit-done/ runtime directory to gsd-core/ Renames the installed runtime directory `get-shit-done/` to `gsd-core/` so the on-disk name matches the package (`@opengsd/gsd-core`), repo, and binary (`gsd-tools`). The npm package name and binary are unchanged; npx/npm consumers are unaffected. Mechanical (bulk, ~90% of the diff): - `git mv get-shit-done gsd-core` - Swept path/identifier references across the repo via `perl -pe 's/get-shit-done(?!-\w)/gsd-core/g'`. The negative lookahead preserves the five legitimate slug variants that are NOT the directory: get-shit-done-{OLD,cc,classic,cli,redux} (old package/repo names). - Build/manifest wiring: package.json (bin, files, coverage globs), tsconfig.build.json (outDir), ~86 .gitignore build-output entries, stryker.config.mjs, scan-ignore files, install.js path strings. - Frozen (not rewritten): CHANGELOG.md history; translated docs (README.<locale>.md and docs/{ja-JP,ko-KR,pt-BR,zh-CN}/). New logic (review here): - src/installer-migrations/003-rename-get-shit-done-to-gsd-core.cts: a proper ADR-0008 installer migration. On upgrade it walks the legacy `~/.claude/get-shit-done/` tree, classifies each file via the prior install manifest, and emits remove-managed / backup-and-remove for managed files while PRESERVING unknown user-added files. Symlink-safe (skips a symlinked root and symlinked entries; bounds-checks every path under configDir). The framework rolls back on install failure. Emptied dirs may remain (framework has no recursive dir-removal primitive) — documented. - scripts/lint-legacy-dir-name.cjs: CI regression guard forbidding the bare `get-shit-done` directory token (split token to avoid self-match; case- insensitive; `(?!-\w)` lookahead allows the slug variants; allowlists CHANGELOG, translated docs, and `gsd-allow-legacy-name` marker lines). Wired into the lint-tests CI job. - Restored scripts/lint-package-identity-drift.cjs detection regexes (the mechanical sweep had wrongly rewritten the old-name patterns it exists to detect) and marked them as intentional legacy references. - TDD tests for the migration and the guard; do.md slash-command guard regex tightened so a `/gsd-core/bin` path segment is not mistaken for a command; changeset + docs/installer-migrations.md row added. Breaking: the installed runtime path moves `~/.claude/get-shit-done/` -> `~/.claude/gsd-core/`. Migration 003 removes the stale legacy dir's managed files (preserving user files) on upgrade. Users with custom hooks/configs hardcoding the old path must update them. Closes #604 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): unsweep pending changesets + allowlist injection-example docs CI fixes for the rename PR: - Do not sweep pending .changeset/*.md (ephemeral release-note fragments, like CHANGELOG); reverted those body edits so 5 pre-existing malformed fragments (missing type/pr) no longer enter the PR diff and trip docs-lint. Allowlisted .changeset/ in the legacy-name guard accordingly. - Allowlisted TEST-EXAMPLES.md and docs/explanation/security-model.md in prompt-injection-scan.sh: they contain intentional injection examples / security-model prose; the path-reference rewrites are kept. CodeQL alerts on this PR are pre-existing (alert lines unchanged by this PR; none in the new migration/guard) and are out of scope for the rename. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): resolve CodeQL alerts surfaced on this PR The rename diff touched files carrying pre-existing CodeQL findings; per the no-pre-existing-dismissal rule, fixing every surfaced alert rather than waving them off. All behavior-preserving: - scripts/ci-test-scope.cjs: build the config-path match from string .includes() instead of a RegExp over an arg-derived value (js/regex-injection). - src/profile-output.cts: escape backslashes before pipe-escaping desc/safeName so the table-cell escape is complete (js/incomplete-sanitization). - tests/{bug-2643,bug-2808,docs-parity-live-registry}: two-pass HTML-comment strip so a bare/unclosed `<!--` cannot survive (js/incomplete-multi-character-sanitization). - tests/inline-plan-threshold: drop the no-op `\s`->`\s` identity replace, keep the meaningful POSIX-class conversion (js/identity-replacement). Verified: build:lib green; the touched test files + ci-test-scope + profile-output suites pass; lint:legacy-name clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): correctly resolve remaining CodeQL alerts (regex-injection + sanitization) The prior commit's fixes for two alerts were ineffective: - ci-test-scope.cjs js/regex-injection: the alert is the CLI-arg-derived `file` reaching static regex `.test(file)` calls (not the config rule). Removed ALL regex over file/t — startsWith/includes/=== string checks + an isWindowsHint helper — so there is no regex sink for the tainted value. - js/incomplete-multi-character-sanitization (3 test files): a single `.replace(/<!--...-->/g,'')` can let `<!--` re-form. Replaced with a fixpoint loop (replace until stable) plus a final bare-opener strip. Verified: no regex over file/t remains; ci-test-scope + the 3 test suites pass; lint:legacy-name clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): make ci-test-scope + comment-strippers regex-free to clear CodeQL CodeQL flags the regex PATTERNS syntactically (regex-injection on the --files arg split; incomplete-multi-character-sanitization on the <!--...--> replace), so loop fixes do not satisfy it. Made these paths regex-free: - ci-test-scope.cjs splitFiles: char-by-char separator tokenizer (no /[,\\s]+/). - 3 test files: indexOf/slice HTML-comment stripper (no .replace(/<!--/)). Behavior preserved; ci-test-scope + the 3 suites pass; guard clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): unblock security base64 scan on the large rename diff The security job hit its 10m timeout: base64-scan.sh choked on the binary test fixture tests/feat-3594-parser-property-style.test.cjs (embedded NUL/ non-UTF8 bytes -> thousands of bogus blobs + "ignored null byte" warnings), and the ~800-file rename diff is slow to scan regardless. - scripts/base64-scan.sh: skip binary-by-content files (grep -Iq .) — they can't carry base64-obfuscated *text* and feeding NUL bytes through the per-line scanner is pathologically slow. collect_files already filtered binary *extensions*; this catches binary *content* in text extensions. - .github/workflows/security-scan.yml: raise the security job timeout 10m->30m to accommodate very large diffs (the scan itself is unchanged). Verified locally: scan skips the fixture, 0 "ignored null byte" warnings, 0 findings, exit 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): sweep get-shit-done refs introduced by merging next The branch was updated with next (#614/#384/#618 etc.), which reference the get-shit-done/ dir (still named that on next). Swept the stale references in the merged files to gsd-core so the rename stays consistent and lint:legacy-name passes: - commands/gsd/discuss-phase.md (runtime-launcher shim paths) - src/core.cts (getAgentsDir layout comments) - tests/bug-384-agents-runtime-aware.test.cjs (require path to runtime lib) Verified: guard 0 violations; build green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): exclude gsd-core/ path segments from bug-3683 command cross-ref invariant The #614 runtime-launcher shim added to discuss-phase.md references `${_GSD_RUNTIME_ROOT}/gsd-core/bin/...`. bug-3683's REF_PATTERN excluded path-y refs only via lookbehind, but `}` precedes `/gsd-core/` in the shim, so it mis-read the directory path as a dangling `/gsd-core` command ref (same class as the #604 bug-2954 fix). Added a trailing `(?![\w-]*\/)` so `/gsd-<x>/...` path segments are not treated as slash-command references. Verified locally on BOTH platforms before pushing: - mac (node 26) full suite: 0 failures - gsd-test-runner (linux, node22 image) full suite: 0 failures - bug-3683 + bug-2954 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): lazily resolve findProjectRoot in gsd-tools (harden flaky CI) CI intermittently failed state.test's gsd-tools subprocess with "findProjectRoot is not a function" (flip-flopping across legs; not reproducible on mac full suite, gsd-test linux full suite, test:unit, or state.test x8). findProjectRoot is a re-export from core.cjs (sourced from project-root.cjs); binding it via destructure at module-load can be undefined under a load-ordering edge. Resolve it lazily at call time via a small wrapper so the lookup happens after core.cjs is fully initialized. Verified green on BOTH platforms before pushing: - mac (node 26) full suite: 0 failures - gsd-test-runner (linux, node22) full suite: 0 failures - state.test.cjs: 106/106; gsd-tools loads cleanly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#604): allowlist verification-patterns.md placeholder examples in secret scan The rename git-mv'd references/verification-patterns.md into gsd-core/, pulling it into the secret-scan diff. It documents stub/placeholder RED-FLAG env-var examples (illustrative Stripe test-key / database-URL / API-key placeholders) — not real credentials. Added it to .secretscanignore with the strict annotation, mirroring the existing gsd-core/workflows/plan-phase.md exception. Verified locally: secret-scan-lint --strict OK; secret-scan --diff origin/next exits 0 with 0 findings. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-02 18:35:29 -04:00
Tom Boucher	9f57f7488e	refactor(tests): consolidate Milestone Module — 10 files → 4 (#3754) ... * refactor(tests): consolidate Milestone Module — 10 files → 4 Closes #3753 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(changeset): correct fragment format for 3753-consolidate-milestone-tests Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(changeset): add required frontmatter to 3753 changeset fragment Adds `type: Fixed` and `pr: 3753` frontmatter so docs-lint passes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(tests): bug-2943 execFileSync timeout 5s→15s for Windows starvation PR #3754's milestone consolidation reshuffles run-tests.cjs chunk composition. On Windows/Node 22 under --test-concurrency=4, bug-2943 subprocesses now share concurrency slots with bug-2760-codex-install subtests (8–15s each), starving past the 5000ms timeout. 15s covers the observed 13.5s worst case with headroom. Refs #3753 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-20 20:38:53 -04:00
Tom Boucher	034b47c8d0	fix(3584): runtime-aware slash formatter for user-facing emissions ... Introduce `runtime-slash.cjs` as the single source of truth for emitting GSD slash-command references in user-facing runtime output and persisted artifacts. `formatGsdSlash(commandName, runtime)` produces `/gsd-<cmd>` for skills-based runtimes (Claude/Cursor/OpenCode/Kilo/etc.) and `$gsd-<cmd>` for Codex. The deprecated `/gsd:<cmd>` colon form is never emitted — pasting a recommended-action command into Claude Code now routes correctly instead of failing with `Unknown command`. Wired into the high-impact emitters identified in #3584: - `init.cjs` `cmdInitManager` recommended_actions[].command (the original failure path in the bug report) plus the no-ROADMAP / no-STATE error hints. - `phase.cjs` `cmdPhaseAdd`, `cmdPhaseAddBatch`, `cmdPhaseInsert` — ROADMAP.md `Plans:` references now persist the routable form instead of the legacy colon form. - `verify.cjs` `cmdValidateHealth` — every fix-hint addIssue() call (E001/E002/E003/E004/E005, W002/W003/W008/W009/W011/W016/W018) and the persisted STATE.md regenerate / MILESTONES.md backfill notes. - `milestone.cjs` `cmdMilestoneComplete` — Operator Next Steps tail rewrite. - `validate-command-router.cjs` — `validate context` recommendation strings for WARNING/CRITICAL utilization bands. - `workstream.cjs` — missing .planning hint. - `profile-output.cjs` — `generate-claude-md` workflow enforcement block, project/skills fallbacks, profile placeholder, and the dev-preferences refresh hints. - `drift.cjs`, `gsd2-import.cjs`, `commands.cjs scaffold context` — remaining one-off persisted references. Runtime detection: `resolveRuntime(projectDir)` reads `process.env.GSD_RUNTIME` first, then a side-effect-free direct read of `.planning/config.json` (NOT `loadConfig`, which would normalize legacy keys and re-write the file just to read the runtime name). Tests: - `tests/bug-3584-runtime-slash-formatter.test.cjs` — 22 unit tests covering the pure formatter and resolver (hyphen vs codex, prefix normalization, defensive returns, env/config/default chain). - `tests/bug-3584-runtime-slash-emitters.test.cjs` — 6 integration tests exercising `init manager`, `phase add` (via the structured `roadmap get-phase` payload to avoid raw-text matching on the on-disk artifact), `validate health`, `validate context`, and the codex variant. - Existing tests updated to assert the new contract: validate-context recommendations, claude-md workflow block, milestone complete Operator Next Steps. Copilot-install engine-conversion test now asserts against a synthetic input since bin/lib/*.cjs no longer contains literal `/gsd:` references for the install-time converter to rewrite. INVENTORY.md and INVENTORY-MANIFEST.json updated for the new module (64 CLI modules shipped, +1). Fixes #3584 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-15 19:32:02 -04:00
Tom Boucher	a60e05c714	fix(claude): restore namespaced /gsd:<command> references (#3452) ... * fix(claude): restore namespaced /gsd:<command> references * test(claude): align slash-command expectations to /gsd: form * test(claude): align generated command references to /gsd: * test(claude): finish /gsd: namespace expectation updates	2026-05-12 21:53:24 -04:00
Tom Boucher	67684626d8	fix(3088): append missing STATE narrative sections on milestone close	2026-05-04 23:29:45 -04:00
Tom Boucher	2dcf374da0	fix(milestone): normalize STATE narrative after milestone completion	2026-05-04 23:17:00 -04:00
Tom Boucher	918f987a19	feat(#2982): extend no-source-grep lint to catch var-binding readFileSync.includes() (#2985) ... * feat(#2982): extend no-source-grep lint to catch var-binding readFileSync.includes() The base lint (scripts/lint-no-source-grep.cjs) only catches readFileSync(...).<text-method>() chained directly. The much more common var-binding form escapes it: const src = fs.readFileSync(p, 'utf8'); // 50 lines later if (src.includes('foo')) {} // ← still grep, lint missed it Scan of the test suite found ~141 files using this pattern. Implementation built TDD per #2982 with structured-IR assertions: scripts/lint-no-source-grep-extras.cjs - detectVarBindingViolations(src) — pure detector, two passes: pass 1 collects vars bound from readFileSync, pass 2 finds any <var>.<includes|startsWith|endsWith|match|search>( on those vars. - detectWrappedAssertOkMatch(src) — flags assert.ok(<expr>.match(...)) which escapes the assert.match rule. - VIOLATION enum exposes stable codes for tests to assert on. scripts/lint-no-source-grep.cjs - Wires the new detectors into the existing per-file check; one additional violation row per file with the first 3 sample tokens. tests/bug-2982-lint-var-binding.test.cjs - 13 tests, all assertions on typed VIOLATION enum / structured records. Covers all 5 text-match methods, multi-var, no-bind, string literal (must NOT trigger), wrapped assert.ok(.match), and assert.match (must NOT double-flag). Migration backlog (#2974 expanded scope): - 42 files annotated `// allow-test-rule: source-text-is-the-product` (legitimate — they read .md/.json/.yml files whose deployed text IS the product) - 3 files annotated `// allow-test-rule: pending-migration-to-typed-ir [#2974]` (read .cjs/.js source — clear migration debt) - 95 files annotated `pending-migration-to-typed-ir [#2974]` with `Per-file review may reclassify as source-text-is-the-product during migration` (mixed — manual review under #2974) After this lands the lint reports 0 violations on main; new violations in PRs surface immediately. Closes #2982 Refs #2974 * test(#2982): fix truncated test name per CR The label ended with a bare '(' from a copy-paste mishap. Now reads 'does NOT flag .matchAll(...) — matchAll is not match, so assert.ok(.matchAll(...)) is not flagged'. * chore(#2982): add changeset fragment for PR #2985 * chore(#2982): add changeset fragment for PR #2985	2026-05-01 19:50:10 -04:00
Tom Boucher	09e56893c8	fix(milestone): preserve 999.x backlog phases during phases clear (#1858) ... * fix(milestone): preserve 999.x backlog phases during phases clear Fixes #1853 * fix: remove accidentally bundled plan-stall-detection test Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-06 08:54:18 -04:00
Tom Boucher	2703422be8	refactor(tests): standardize to node:assert/strict and t.after() per CONTRIBUTING.md (#1675) ... * refactor(tests): standardize to node:assert/strict and t.after() per CONTRIBUTING.md - Replace require('node:assert') with require('node:assert/strict') across all 73 test files to enforce strict equality (no type coercion) - Replace try/finally cleanup blocks with t.after() hooks in core.test.cjs and hooks-opt-in.test.cjs per the test lifecycle standards - Utility functions in codex-config and security-scan retain try/finally as that is appropriate for per-function resource guards, not lifecycle hooks Closes #1674 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * perf(tests): add --test-concurrency=4 to test runner for parallel file execution Node.js --test-concurrency controls how many test files run as parallel child processes. Set to 4 by default, configurable via TEST_CONCURRENCY env var. Fixes tests at a known level rather than inheriting os.availableParallelism() which varies across CI environments. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): allowlist verify.test.cjs in prompt-injection scanner tests/verify.test.cjs uses <human>...</human> as GSD phase task-type XML (meaning "a human should verify this step"), which matches the scanner's fake-message-boundary pattern for LLM APIs. This is a false positive — add it to the allowlist alongside the other test files that legitimately contain injection-adjacent patterns. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-04 14:29:03 -04:00
Tom Boucher	802092d8ff	fix: add verification gate before writing PROJECT.md in new-milestone ... After gathering milestone goals and determining version, the workflow now presents a summary and asks for confirmation before writing any files. Users can adjust until satisfied, preventing the previous behavior where GSD would immediately write PROJECT.md without verifying its understanding of the milestone scope. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-20 22:07:57 -04:00
Tom Boucher	3e2c85e6fd	refactor: consolidate STATE.md field helpers, fix command injection in isGitIgnored ... Refactoring: - Extract stateReplaceFieldWithFallback() to state.cjs as single source of truth for the try-primary-then-fallback pattern that was duplicated inline across phase.cjs, milestone.cjs, and state.cjs - Replace all inline bold-only regex patterns in cmdPhaseComplete with shared stateReplaceField/stateExtractField helpers — now supports both **Bold:** and plain Field: STATE.md formats (fixes the same bug as #924) - Replace inline bold-only regex patterns in cmdMilestoneComplete with shared helpers - Replace inline bold-only regex for Completed Phases/Total Phases/Progress counters in cmdPhaseComplete with stateExtractField/stateReplaceField - Replace inline bold-only Total Phases regex in cmdPhaseRemove with shared helpers Security: - Fix command injection surface in isGitIgnored (core.cjs): replace execSync with string concatenation with execFileSync using array arguments — prevents shell interpretation of special characters in file paths Tests (7 new): - 5 tests for stateReplaceFieldWithFallback: primary field, fallback, neither, preference, and plain format - 1 regression test: phase complete with plain-format STATE.md fields - 1 regression test: milestone complete with plain-format STATE.md fields 854 tests pass (was 847). No behavioral regressions.	2026-03-19 15:05:20 -04:00
j2h4u	104a39e573	fix(lifecycle): extract one-liner from summary body when not in frontmatter ... The summary template puts the one-liner as a `**bold**` line after the `# Phase N` heading, but `cmdSummaryExtract` and `cmdMilestoneComplete` only checked frontmatter `one-liner` field — which is often empty. Adds `extractOneLinerFromBody()` to core.cjs as a fallback that parses the first `**...**` line after the heading. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-19 21:29:25 +05:00
j2h4u	b34bf532ef	fix(milestone): read task count from **Tasks:** field in summary body ... The summary template writes task count as `**Tasks:** N` in the Performance section, but `cmdMilestoneComplete` only counted `## Task N` markdown headers — which don't exist in that format. Now checks three patterns in order: `**Tasks:** N` field (primary), `<task` XML tags, then `## Task N` headers (legacy fallback). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-19 14:37:21 +05:00
Maxim Brashenko	f2adc0cec4	fix(milestone): make requirements mark-complete idempotent (#948) ... Previously, calling `mark-complete` on already-completed requirements reported them as `not_found`, since the regex only matched unchecked `[ ]` checkboxes and `Pending` table cells. Now detects `[x]` checkboxes and `Complete` table cells and returns them in a new `already_complete` array instead of `not_found`. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 11:39:54 -06:00
TÂCHES	10576a58da	Merge pull request #785 from Tibsfox/fix/milestones-reverse-chronological ... fix(milestone): insert MILESTONES.md entries in reverse chronological order	2026-02-27 09:23:14 -06:00
Tibsfox	732ea09f81	fix(milestone): insert MILESTONES.md entries in reverse chronological order ... cmdMilestoneComplete previously appended new milestone entries at the end of MILESTONES.md. Over successive milestones this produced chronological order (oldest first), which is counterintuitive — users expect the most recent milestone at the top. This fix detects the file header (h1-h3) and inserts the new entry immediately after it, pushing older entries down. Files without a recognizable header get the entry prepended. New files still get a default '# Milestones' header. Adds 2 tests: single insertion ordering assertion and three-sequential- completions verification (v1.2 < v1.1 < v1.0 in file order). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-27 03:46:37 -08:00
Tibsfox	367149d0b2	fix(milestone): scope stats, accomplishments, and archive to current milestone phases ... cmdMilestoneComplete previously iterated ALL phase directories in .planning/phases/, including phases from prior milestones that remain on disk. This produced inflated stats, stale accomplishments from old summaries, and --archive-phases moving directories that belong to earlier milestones. This fix parses ROADMAP.md to extract phase numbers for the current milestone, builds a normalized Set for O(1) lookup, and filters all phase directory operations through an isDirInMilestone() helper. The helper handles edge cases: leading zeros (01 -> 1), letter suffixes (3A), decimal phases (3.1), large numbers (456), and excludes non-numeric directories (notes/, misc/). Adds 5 tests covering scoped stats, scoped archive, prefix collision guard, non-numeric directory exclusion, and large phase numbers. Complements upstream PRs #756 and #783 which fix getMilestoneInfo() milestone detection — this fix addresses milestone completion scoping. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-27 03:45:42 -08:00
Ethan Hurst	e0e7929449	test(05-02): add 7 requirements mark-complete ID format and edge case tests ... - single requirement checkbox + traceability table update - mixed prefixes (TEST-XX, REG-XX, INFRA-XX) in single call - space-separated ID input format - bracket-wrapped [REQ-01, REQ-02] input format - mixed valid/invalid IDs: valid updated, invalid in not_found - idempotent: re-marking already-complete does not corrupt - missing REQUIREMENTS.md returns {updated: false, reason: 'not found'}	2026-02-26 05:47:19 +10:00
Ethan Hurst	5778ff3e59	test(05-01): add 5 milestone complete archiving and defensive tests ... - --archive-phases flag moves phase dirs to milestones/vX.Y-phases/ - archived REQUIREMENTS.md contains header with version, SHIPPED, date - STATE.md status/activity/description updated during milestone complete - missing ROADMAP.md handled gracefully without crash - empty phases directory handled with zero counts	2026-02-26 05:47:19 +10:00
Tyler Satre	fa2e156887	refactor: split gsd-tools.test.cjs into domain test files ... Move 81 tests (18 describe blocks) from single monolithic test file into 7 domain-specific test files under tests/ with shared helpers. Test parity verified: 81/81 pass before and after split. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-20 10:30:54 -05:00