Files
msd-core/tests/drift-detection.test.cjs
Tom Boucher b10e56818b feat(#1169): complete ADR-857 phase 6 — migrate features to Capabilities, revive dead gates, harden conformance gate (#1183)
* test(#1168): make phase-6 gate un-gameable — reject empty stubs + require loop shrink

The migration assertion previously checked only role==feature, so a registration-only stub (empty hooks, logic left inline) would turn the gate green while phase 6 stayed incomplete — the exact false-completion pattern this gate exists to prevent. Strengthen it: each ADR-named feature must OWN its behavior (>=1 hook, or a command family); and plan-phase.md/execute-phase.md must shrink strictly below their frozen pre-phase-6 sizes (94519/93166 LF bytes), which also defeats double-run gaming (declare a hook but keep the inline block -> file does not shrink -> red).

Gate now 5 pass / 4 fail (orphaned execute:wave:post, empty/unregistered features, config-key leaks, no shrink). Green is now reachable only by REAL migration. Refs #1168, #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#1169): migrate gap-analysis to a Capability (plan:post gate)

First real ADR-857 phase-6 migration (pattern-defining tracer). gap-analysis moves from an inline post_planning_gaps branch in plan-phase.md to a real plan:post gate Capability:

- capabilities/gap-analysis/capability.json: role:feature, plan:post gate (when=workflow.post_planning_gaps, blocking:false advisory), OWNS workflow.post_planning_gaps (federated out of central schema). - plan-phase.md: inline config-get + gsd_run gap-analysis block replaced with a plan:post render-hooks call site dispatching the gate; file shrinks 94519->93279. - src/check-command-router.cts: cmdGapAnalysisPlanPost runs the real gap analysis via gap-checker. - post_planning_gaps removed from central manifest; resolves via federated config (default true preserved). - tests/post-planning-gaps-2493: re-pointed to assert capability ownership.

Verified: gate 5 pass / 4 fail (gap-analysis cleared from migration, plan:post-orphan, config-leak, and plan-phase shrink checks); loadConfig still returns post_planning_gaps=true; check command runs real analysis; 392/392 in the config/registry/federation/router net. Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#1169): migrate profile-pipeline to a command-family Capability

ADR-857 Decision 7: profile-pipeline becomes a command-family Capability (like audit/intel/graphify). capabilities/profile-pipeline/capability.json declares an 8-command family (scan-sessions, extract-messages, profile-sample, write-profile, profile-questionnaire, generate-dev-preferences, generate-claude-profile, generate-claude-md) backed by a new gsd-core/bin/lib/profile-pipeline-command-router.cjs; the inline case arms are removed from gsd-tools.cjs. Owns profile-pipeline.enabled (federated).

Verified: registry shows role:feature with commands.length=8; scan-sessions/profile-sample run live via the family; gate cleared profile-pipeline from the empty-stub failure (only tdd/schema-gate/drift remain); 296/296 registry+inventory+gsd-tools tests; lint 0 errors. Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1167): wire execute:wave:post + implement ui.safety-gate check

Revives the second dead gate from #1167: ui.gates@execute:wave:post was declared but never dispatched AND its check.query (ui.safety-gate) was unimplemented. Adds the per-wave execute:wave:post render-hooks call site in execute-phase.md (fires after each wave's merge/cleanup, before the next forks) and implements cmdUiSafetyGate (frontend + UI-SPEC aware, mirrors cmdUiPlanGate) in check-command-router. +17 regression tests.

Verified: phase-6 orphaned-points conformance test now PASSES (gate 6 pass / 3 fail); ui-safety-gate routable in dot+hyphen forms; check-ui-safety-gate 17/17, check-ui-plan-gate 18/18; lint 0 errors. Refs #1167, #1168.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#1169): migrate drift (schema + codebase) to execute:wave:post gates

Removes the inline schema_drift_gate + codebase_drift_gate steps (77 lines) from execute-phase.md; drift becomes a Capability with two execute:wave:post gates (verify.schema-drift blocking, verify.codebase-drift advisory) dispatched via the per-wave render-hooks call site. check-command-router routes verify.schema-drift / verify.codebase-drift to the real detectors. Federates workflow.drift_threshold / drift_action / schema_drift_gate out of central.

Also fixes the execute:wave:post dispatch prose to run NON-blocking (advisory) gates too — the prior version only ran blocking gates, which would have silently dropped the codebase-drift advisory after its inline step was removed. Behavior preserved.

Verified: gate 7 pass / 2 fail (drift cleared from stub + config-leak; execute-phase.md 92297 < 93166 frozen -> shrink passes); both drift checks run real detection; loadConfig defaults preserved (threshold=3, action=warn, gate=true); drift-detection 56/56 + schema-drift 34/34; lint 0 errors. Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#1169): migrate tdd to a Capability (plan:pre contribution + execute:post gate)

tdd becomes a real Capability: a plan:pre contribution injects the <tdd_mode_active> planner guidance (rendered from PLAN_PRE_HOOKS_JSON like security's contribution), and an execute:post gate (tdd.review-checkpoint, advisory) runs the real end-of-phase RED/GREEN review via a new check-command handler. Inline tdd_mode reads + the inline planner block + the tdd_review_checkpoint step are removed; workflow.tdd_mode is federated out of central. The MVP+TDD per-task RED-commit gate is preserved — TDD_MODE is now derived from the execute:post hooks (capId==tdd active), not an inline config-get.

BEHAVIOR CHANGE (documented, not silent): the --tdd CLI flag now persists workflow.tdd_mode=true via config-set instead of being per-invocation. Rationale: tdd is now a config-toggled Capability, and env vars do not persist across the workflow's separate bash blocks (config does), so an ephemeral override isn't cleanly achievable; --tdd therefore enables the tdd capability, consistent with how all capabilities are toggled.

Verified: gate 7 pass / 2 fail (tdd cleared from stub + config-leak; plan-phase + execute-phase both < frozen sizes); contribution injection + execute:post gate dispatch wired; MVP+TDD gate preserved; tdd.review-checkpoint runs real review; full unit suite 556/0; lint 0 errors. Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#1169): migrate schema-gate to a plan:pre contribution Capability

The plan-time schema-push detection (former plan-phase.md §5.7) becomes a schema-gate Capability: a plan:pre contribution (into:planner, when:workflow.schema_push_detection) whose fragment carries the full ORM-detection + [BLOCKING] schema-push-task injection logic, rendered into the planner via the existing plan:pre render-hooks dispatch. The inline §5.7 block is removed (plan-phase.md 94519->90445). workflow.schema_push_detection is a new capability-owned (federated) key, default true. (The execute-side schema-drift gate was migrated separately into the drift capability.)

Verified: registry inlines the fragment (len 2704) so it is actually delivered at plan:pre; gate 8 pass / 1 fail — all 5 ADR-named features now real Capabilities, only the config-leak test remains (intel/security, next unit). Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#1169): close the 3 capability config-key leaks — phase-6 gate now GREEN

Removes the last inline config-get reads of capability-owned keys from plan-phase.md. security_asvs_level/security_block_on now flow through the security plan:pre contribution via a new loop-resolver configValues mechanism (resolves declared config keys with the same 4-level precedence as activation and attaches them to the rendered hook); the §5.55 banner reads them from PLAN_PRE_HOOKS_JSON. intel.enabled becomes a real intel plan:pre step (ref.command: intel api-surface) dispatched via render-hooks; the inline intel branch is gone. gen-capability-registry now validates ref.command as a third dispatch shape.

Verified: phase-6 capstone conformance gate is FULLY GREEN (9/0); 3 leaks gone (grep=0); security configValues resolve to {2,medium}/default {1,high}; intel step present only when enabled; loop-render-hooks 62/0, capability-registry 287/0, capability-state/federated-config 113/0; lint 0 errors. Closes the migration half of #1169. Refs #1139, #1167, #1168.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1169): address adversarial review — restore schema-drift block, generic planner injection, uniform gate contract

Adversarial review caught 2 real regressions the green gate missed: (1) schema-drift no longer blocked — the execute:wave:post dispatch read GATE_RESULT.block but verify.schema-drift emitted drift_detected/blocking, and onError:skip wrongly bypassed positive blocks; (2) only tdd's plan:pre contribution was injected into the planner, dropping schema-gate's schema-push detection and security's threat-model guidance.

Fixes: (A) every gate check returns a uniform boolean 'block' under --raw (the dispatch form), with advisory gates (tdd/gap) carrying their report in 'message'; (B) gate-dispatch contract corrected at all sites — onError governs command errors only, a blocking gate's positive block always halts; (C) generic planner injection of all plan:pre contributions where into=='planner' (tdd + schema-gate + security incl configValues); (D) two new conformance assertions: planner contributions injected generically + every gate check.query returns boolean block under --raw.

Verified: gate 11/11; all 6 gate checks return boolean block under --raw; full suite 595/0; lint 0 errors. Refs #1167, #1168, #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1169): restore MVP+TDD end-of-phase blocking escalation (2nd adversarial pass)

The migrated tdd execute:post gate is statically blocking:false, but the contract (references/execute-mvp-tdd.md + CONTEXT.md) requires the end-of-phase TDD review to ESCALATE from advisory to blocking when MVP_MODE && TDD_MODE && a TDD plan misses a RED/GREEN commit. The migration prose had downgraded this to a 'strong advisory recommendation' — silent loss of the blocking escalation. Restore it: the tdd-gate dispatch now refuses to mark the phase complete (Phase blocked message) under MVP+TDD when GATE_RESULT.block is true; advisory otherwise.

Also strengthen tests/execute-mvp-tdd-gate.test.cjs: hasBlockingEscalation previously matched any line with 'blocking'+'mvp+tdd' (so 'advisory (blocking: false) ... under MVP+TDD' was a false green); now it requires the real refusal semantics ('refuse to mark the phase complete' / 'phase blocked'). Caught by 2nd adversarial review pass.

Verified: execute-phase.md 92702 < 93166 frozen; mvp-tdd-gate + phase-6 gate 19/0; full suite green; lint 0 errors. Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1169): restore MVP+TDD proceed-block, codebase auto-remap, schema skip-flag (3rd adversarial pass)

3rd adversarial pass found 4 more silent regressions: (1) the tdd MVP+TDD 'refuse to mark complete' was nullified by a downstream 'ALWAYS proceed regardless of gate results' line — proceed is now conditional (stops on an active MVP+TDD block); (2) the test now asserts the proceed is NOT an unconditional override; (3) codebase-drift auto-remap (spawn gsd-codebase-mapper when drift_action=auto-remap) was dropped — the execute:wave:post advisory dispatch now consumes spawn_mapper/directive; (4) GSD_SKIP_SCHEMA_CHECK bypass was lost from the gate path — cmdVerifySchemaDrift now honors the env var (block:false when set).

Verified: no unconditional proceed; GSD_SKIP_SCHEMA_CHECK=true -> block:false; gate 11/11 + mvp-tdd 9/9; full suite 569/0; lint 0; execute-phase.md 93109 < 93166. Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1169): init.cts reads federated config keys from nested path (4th adversarial pass)

Config federation moved tdd_mode/research/nyquist_validation from flat config.<key> to nested config.workflow.<key>, but src/init.cts still read them flat — so init.plan-phase/init.execute-phase emitted tdd_mode:false / research_enabled:undefined / nyquist:undefined regardless of config (a public command-contract regression; the migrated loops use render-hooks so enforcement was unaffected). Read via config.workflow (type-safe Record cast). Now init reflects the same resolved values + federated defaults (research/nyquist default true) as the render-hooks path.

Verified: build clean; init.plan-phase emits tdd_mode:true/research:false/nyquist:false for set config, defaults true for empty; full suite 591/0; lint 0. Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#1169): add changeset for ADR-857 phase-6 completion (PR #1183)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1169): complete phase-6 migration fallout — restore TEXT_MODE, fix registry .claude leak, re-point stale workflow-contract tests

The capability migration left real regressions and stale consumer tests that
the per-module unit suite missed but the full cross-platform suite caught (27
failing tests):

Real source regressions (fixed):
- execute-phase.md lost its AskUserQuestion TEXT_MODE plain-text fallback when
  the inline schema_drift_gate step was removed — non-Claude runtimes would
  stall. Restored, and the execute:post gate-dispatch prose de-duplicated to
  cite the execute:wave:post contract (loop body shrinks below the frozen
  pre-phase-6 ceiling while keeping every onError/blocking nuance).
- capabilities/tdd inline fragment hardcoded `@~/.claude/gsd-core/references/tdd.md`,
  baked verbatim into the committed capability-registry.cjs and leaked the
  install path on 11 non-Claude runtimes (registry .cjs is copied, not
  path-converted). Made the fragment path-free; regenerated the registry. The
  phase-6 conformance gate now guards this (no ~/.claude install path in any
  capability source or the generated registry).
- plan-phase.md: removed a §5.7 stub re-added in error and routed Branch 2 to
  step 6 (schema-gate is a plan:pre capability, §5.7 is gone).

Stale workflow-contract tests re-pointed to the capability dispatch they now
must assert (behavior verified preserved in source first, assertions kept
equal-or-stronger): bug-621 + bug-2851 (gap-analysis via gsd_run render-hooks
plan:post + registry binding), feat-2527 (tdd_mode federated out of central),
phase6-planning + plan-phase-ui-redirect (§5.6 bounded by ## 6.),
plan-phase-drift-guard (intel when:intel.enabled skip branch).

profile-pipeline-command-router.cjs un-ignored from eslint (hand-written, no
TS source) + stale disable comments removed. Size baseline regenerated.

Verified: full suite 15140 tests / 0 fail; lint 0 errors; conformance gate green
legitimately. Refs #1139, #1167, #1168, #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#1169): add ADR-857 E2E content-test coverage for the 12 loop points + capability deliverables

Grounds the capability engine in behavioral E2E tests (drive the real
render-hooks/check CLI + the real registry, assert typed result content — no
source-grep), structured around what ADR-857 says to deliver. 207 tests; each
genuineness-checked (flip the expectation, confirm it fails).

Per-loop-point dispatch (7 files): empty-point negative-space across the 6
no-hook points; verify:post 3-step resolution+ordering+onError; plan:pre
contribution/configValues + ui.plan-gate + intel; plan:post gap-analysis;
execute:wave:post drift+ui gates via the check route (schema-drift block/skip,
codebase-drift threshold BVA, auto-remap); execute:post tdd.review-checkpoint
RED/GREEN; ship:pre security gate resolution + frontmatter-get predicate pieces.

ADR-deliverable coverage (4 files): predicate boundary held (edge/prohibition
probes stay core, not off-by-default Feature Capabilities — phase-6 exception);
core loop runs with zero capabilities (all 12 points empty, init bundles
resolve); contribution merge (multiple ordered <contribution from=> blocks);
federated-config key removal on uninstall.

federated-config allowlisted for its 3-file split (unit + integration +
lifecycle). Refs #1139, #1167, #1168, #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1169): remove dead drifted converter dups + address adversarial review

Lint cleanup (root-caused, not waved off): src/runtime-artifact-conversion.cts
carried 11 agent-converter functions (+5 orphaned consts/helpers) that were
never exported, never called, and had silently DRIFTED from the live
hand-authored copies in bin/install.js (one even referenced an undefined
`claudeToCopilotTools`). Deleted the dead duplicates; install.js's live copies
are untouched (it never imported these). Lint now 0 errors / 0 warnings.

Adversarial-review (Codex) findings fixed:
- HIGH: execute-phase.md TDD_MODE used `jq ... || echo false`, silently
  disabling the MVP+TDD blocking gate on jq-less runtimes. Reverted to the
  `node -e` form (node is guaranteed; matches the file's other node-e usages) so
  a missing optional tool can no longer fail-open a blocking safety path.
- MEDIUM: federated-config-key-removal orphan-key test was vacuous (it skipped
  the orphan assertion). Now asserts the removed capability's key is genuinely
  not surfaced/validated after uninstall.
- LOW: phase-6 conformance leak regex broadened to catch absolute-home and
  Windows-backslash `.claude/(gsd-core|commands|agents|hooks)` paths, not only
  `~`/`$HOME` forward-slash forms.
- LOW: bug-2851 plan:post dispatch assertion now requires `--raw` (matched its
  stated contract).
- nit: plan-pre intel-step test duplicate assertion replaced with a distinct
  structured-output check.

Size baseline regenerated (execute-phase.md 93089 < 93166 frozen). Refs #1167, #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#1169): make runtime-homes-descriptor-drive titles environment-independent

The descriptor-equivalence test embedded the absolute golden config path
(`os.homedir()`-derived) directly in each `test(...)` title, so titles differed
between macOS (`/Users/x/.claude`) and Docker (`/home/gsdtest/.claude`). Every
test PASSES on both platforms (15885/0 leaf tests each), but gsd-test-summary
compares results by title and reported 29+29 false "only in Mac / only in
Docker" discrepancies for tests that actually pass everywhere.

Move the golden path out of the title and into the assertion message (still
shown on failure); titles are now byte-identical across platforms so the
cross-platform comparator matches them. No assertion logic or golden values
changed. Refs #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1169): derive TDD_MODE via gsd_run --active-cap, not node -e (fix prompt-injection CI gate)

The prior fix reverted execute-phase.md:181 from jq to `node -e` to close a
Codex HIGH (jq||echo-false silently disabling the MVP+TDD blocking gate on
jq-less runtimes) — but the CI prompt-injection scanner BLOCKS new `node -e` in
workflow markdown (inline code-exec = injection vector), turning the security
gate red. Both forms were wrong: node -e fails the scanner; jq fail-opens a
blocking safety gate; `config-get workflow.tdd_mode` is forbidden by the
conformance leak gate (tdd_mode is capability-owned).

Correct fix (what Codex recommended): a gsd_run-native boolean. Add an
`--active-cap <capId>` flag to `loop render-hooks <point>` that resolves hooks
the normal way and prints exactly `true`/`false` for whether a capId is active
— scanner-safe (canonical launcher, no inline code), node-reliable (no optional
jq to fail-open), and leak-free (render-hooks resolution, not config-get).
execute-phase.md:181 now `TDD_MODE=$(gsd_run loop render-hooks execute:post
--active-cap tdd)`. +5 behavioral tests for the flag.

Verified: prompt-injection-scan --diff origin/next → 0 findings; conformance
gate 13/13 (execute-phase.md 92934 < 93166); execute-mvp-tdd + tdd-mode +
loop-render-hooks 87/0; lint 0/0. Refs #1167, #1169.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 21:07:55 -04:00

723 lines
25 KiB
JavaScript

// allow-test-rule: source-text-is-the-product
// Reads .md/.json/.yml product files whose deployed text IS what the
// runtime loads — testing text content tests the deployed contract.
/**
* GSD Tools Tests — Codebase Drift Detection (#2003)
*
* Unit tests for bin/lib/drift.cjs plus CLI surface via verify codebase-drift.
* Exercises the four drift categories (new dir, barrel, migration, route),
* threshold gating, warn vs. auto-remap, last_mapped_commit round-trip,
* config validation, mapper --paths passthrough, and graceful failure paths.
*/
'use strict';
const { test, describe, beforeEach, afterEach } = require('node:test');
const assert = require('node:assert/strict');
const fs = require('node:fs');
const path = require('node:path');
const { execFileSync } = require('node:child_process');
const {
createTempProject,
createTempGitProject,
cleanup,
runGsdTools,
} = require('./helpers.cjs');
const DRIFT_PATH = path.join(
__dirname,
'..',
'gsd-core',
'bin',
'lib',
'drift.cjs',
);
const CONFIG_SCHEMA_PATH = path.join(
__dirname,
'..',
'gsd-core',
'bin',
'lib',
'config-schema.cjs',
);
const {
detectDrift,
classifyFile,
readMappedCommit,
writeMappedCommit,
chooseAffectedPaths,
sanitizePaths,
DRIFT_CATEGORIES,
} = require(DRIFT_PATH);
// Small wrapper around execFileSync so tests don't sprinkle shell=true calls.
function git(cwd, ...args) {
return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
}
// ─── Unit: classifyFile ──────────────────────────────────────────────────────
describe('classifyFile', () => {
test('classifies packages barrel export', () => {
assert.strictEqual(classifyFile('packages/foo/src/index.ts'), 'barrel');
});
test('classifies apps barrel export', () => {
assert.strictEqual(classifyFile('apps/web/src/index.tsx'), 'barrel');
});
test('classifies supabase migration', () => {
assert.strictEqual(
classifyFile('supabase/migrations/20240101_init.sql'),
'migration',
);
});
test('classifies prisma migration folder', () => {
assert.strictEqual(
classifyFile('prisma/migrations/20240101_init/migration.sql'),
'migration',
);
});
test('classifies drizzle meta migration', () => {
assert.strictEqual(classifyFile('drizzle/meta/_journal.json'), 'migration');
});
test('classifies route module', () => {
assert.strictEqual(
classifyFile('apps/web/src/routes/journal.ts'),
'route',
);
assert.strictEqual(
classifyFile('src/api/users.ts'),
'route',
);
});
test('returns null for ordinary source file', () => {
assert.strictEqual(classifyFile('src/lib/util.ts'), null);
});
});
// ─── Unit: detectDrift categories ────────────────────────────────────────────
describe('detectDrift — categories', () => {
const baseStructure = [
'# Codebase Structure',
'',
'- `src/lib/` — helpers',
'- `bin/` — CLIs',
'',
].join('\n');
test('identifies new directory outside mapped paths', () => {
const result = detectDrift({
addedFiles: ['newpkg/src/thing.ts'],
modifiedFiles: [],
deletedFiles: [],
structureMd: baseStructure,
});
const newDirs = result.elements.filter((e) => e.category === 'new_dir');
assert.ok(newDirs.length >= 1, 'should find at least one new directory');
assert.ok(
newDirs.some((e) => e.path.startsWith('newpkg')),
'should flag newpkg as new',
);
});
test('does not flag files in already-mapped paths', () => {
const result = detectDrift({
addedFiles: ['src/lib/newhelper.ts'],
modifiedFiles: [],
deletedFiles: [],
structureMd: baseStructure,
});
const newDirs = result.elements.filter((e) => e.category === 'new_dir');
assert.strictEqual(
newDirs.length,
0,
'src/lib is mapped — no new_dir drift',
);
});
test('identifies new barrel export', () => {
const result = detectDrift({
addedFiles: ['packages/widgets/src/index.ts'],
modifiedFiles: [],
deletedFiles: [],
structureMd: baseStructure,
});
assert.ok(result.elements.some((e) => e.category === 'barrel'));
});
test('identifies new migration', () => {
const result = detectDrift({
addedFiles: ['supabase/migrations/20240501_add_accounts.sql'],
modifiedFiles: [],
deletedFiles: [],
structureMd: baseStructure,
});
assert.ok(result.elements.some((e) => e.category === 'migration'));
});
test('identifies new route module', () => {
const result = detectDrift({
addedFiles: ['apps/accounting/src/routes/journal.ts'],
modifiedFiles: [],
deletedFiles: [],
structureMd: baseStructure,
});
assert.ok(result.elements.some((e) => e.category === 'route'));
});
test('prioritizes higher-specificity category per file', () => {
const result = detectDrift({
addedFiles: ['supabase/migrations/20240101_init.sql'],
modifiedFiles: [],
deletedFiles: [],
structureMd: baseStructure,
});
const perFile = result.elements.filter(
(e) => e.path === 'supabase/migrations/20240101_init.sql',
);
assert.strictEqual(perFile.length, 1, 'file counted once');
assert.strictEqual(perFile[0].category, 'migration');
});
});
// ─── Unit: threshold gating ──────────────────────────────────────────────────
describe('detectDrift — threshold gating', () => {
test('2 elements under default threshold → no action', () => {
const result = detectDrift({
addedFiles: [
'packages/a/src/index.ts',
'packages/b/src/index.ts',
],
modifiedFiles: [],
deletedFiles: [],
structureMd: '# only src/ mapped',
threshold: 3,
});
assert.strictEqual(result.elements.length >= 2, true);
assert.strictEqual(result.actionRequired, false);
});
test('3 elements at threshold → action required', () => {
const result = detectDrift({
addedFiles: [
'packages/a/src/index.ts',
'packages/b/src/index.ts',
'packages/c/src/index.ts',
],
modifiedFiles: [],
deletedFiles: [],
structureMd: '# only src/ mapped',
threshold: 3,
});
assert.strictEqual(result.actionRequired, true);
});
test('4 elements exceeds threshold → action required', () => {
const result = detectDrift({
addedFiles: [
'packages/a/src/index.ts',
'packages/b/src/index.ts',
'packages/c/src/index.ts',
'supabase/migrations/1.sql',
],
modifiedFiles: [],
deletedFiles: [],
structureMd: '# only src/ mapped',
threshold: 3,
});
assert.strictEqual(result.actionRequired, true);
});
test('respects custom threshold value', () => {
const result = detectDrift({
addedFiles: ['packages/a/src/index.ts', 'packages/b/src/index.ts'],
modifiedFiles: [],
deletedFiles: [],
structureMd: '# only src/ mapped',
threshold: 2,
});
assert.strictEqual(result.actionRequired, true);
});
});
// ─── Unit: action routing ────────────────────────────────────────────────────
describe('detectDrift — action routing', () => {
const over = {
addedFiles: [
'packages/a/src/index.ts',
'packages/b/src/index.ts',
'packages/c/src/index.ts',
],
modifiedFiles: [],
deletedFiles: [],
structureMd: '# only src/ mapped',
threshold: 3,
};
test('warn action yields warn directive and no mapper spawn request', () => {
const result = detectDrift({ ...over, action: 'warn' });
assert.strictEqual(result.directive, 'warn');
assert.strictEqual(result.spawnMapper, false);
assert.ok(result.message.includes('drift'), 'message mentions drift');
});
test('auto-remap action yields spawn directive with affected paths', () => {
const result = detectDrift({ ...over, action: 'auto-remap' });
assert.strictEqual(result.directive, 'auto-remap');
assert.strictEqual(result.spawnMapper, true);
assert.ok(Array.isArray(result.affectedPaths));
assert.ok(result.affectedPaths.length > 0);
for (const p of result.affectedPaths) {
assert.ok(!p.startsWith('/'), 'no absolute paths');
assert.ok(!p.includes('..'), 'no traversal');
}
});
test('below-threshold inputs produce no directive', () => {
const result = detectDrift({
addedFiles: ['packages/a/src/index.ts'],
modifiedFiles: [],
deletedFiles: [],
structureMd: '# only src/ mapped',
threshold: 3,
action: 'auto-remap',
});
assert.strictEqual(result.actionRequired, false);
assert.strictEqual(result.spawnMapper, false);
assert.strictEqual(result.directive, 'none');
});
});
// ─── Unit: affected-paths scoping ────────────────────────────────────────────
describe('chooseAffectedPaths', () => {
test('collapses files into top-level prefixes', () => {
const paths = chooseAffectedPaths([
'apps/accounting/src/routes/a.ts',
'apps/accounting/src/routes/b.ts',
'packages/ui/src/index.ts',
]);
assert.ok(paths.includes('apps/accounting'));
assert.ok(paths.includes('packages/ui'));
});
test('deduplicates and sorts', () => {
const paths = chooseAffectedPaths([
'zzz/a.ts',
'aaa/b.ts',
'zzz/c.ts',
]);
assert.deepStrictEqual(paths, ['aaa', 'zzz']);
});
test('returns [] for empty input', () => {
assert.deepStrictEqual(chooseAffectedPaths([]), []);
});
});
// ─── Unit: sanitizePaths ─────────────────────────────────────────────────────
describe('sanitizePaths', () => {
test('rejects traversal', () => {
assert.deepStrictEqual(sanitizePaths(['../evil']), []);
assert.deepStrictEqual(sanitizePaths(['foo/../evil']), []);
});
test('rejects absolute paths', () => {
assert.deepStrictEqual(sanitizePaths(['/etc/passwd']), []);
});
test('rejects shell metacharacters', () => {
assert.deepStrictEqual(sanitizePaths(['foo;rm -rf /']), []);
assert.deepStrictEqual(sanitizePaths(['foo`id`']), []);
assert.deepStrictEqual(sanitizePaths(['foo$(id)']), []);
});
test('accepts normal repo-relative paths', () => {
assert.deepStrictEqual(
sanitizePaths(['apps/web', 'packages/ui']),
['apps/web', 'packages/ui'],
);
});
});
// ─── Unit: last_mapped_commit frontmatter round-trip ─────────────────────────
describe('last_mapped_commit frontmatter', () => {
let tmp;
beforeEach(() => {
tmp = createTempProject('gsd-drift-');
fs.mkdirSync(path.join(tmp, '.planning', 'codebase'), { recursive: true });
});
afterEach(() => cleanup(tmp));
test('writeMappedCommit creates frontmatter on fresh file', () => {
const file = path.join(tmp, '.planning', 'codebase', 'STRUCTURE.md');
fs.writeFileSync(file, '# Codebase Structure\n\nBody\n');
writeMappedCommit(file, 'deadbeef00000000000000000000000000000000', '2026-04-22');
const content = fs.readFileSync(file, 'utf8');
assert.ok(content.startsWith('---\n'));
assert.ok(content.includes('last_mapped_commit: deadbeef00000000000000000000000000000000'));
assert.ok(content.includes('# Codebase Structure'));
});
test('writeMappedCommit updates existing frontmatter', () => {
const file = path.join(tmp, '.planning', 'codebase', 'STRUCTURE.md');
fs.writeFileSync(
file,
'---\nlast_mapped_commit: aaaa\nother: keep-me\n---\n# body\n',
);
writeMappedCommit(file, 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb', '2026-04-22');
const content = fs.readFileSync(file, 'utf8');
assert.ok(content.includes('last_mapped_commit: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'));
assert.ok(content.includes('other: keep-me'), 'preserves other keys');
assert.ok(content.includes('# body'));
});
test('readMappedCommit round-trips via write', () => {
const file = path.join(tmp, '.planning', 'codebase', 'STRUCTURE.md');
fs.writeFileSync(file, '# body\n');
writeMappedCommit(file, 'cafebabe00000000000000000000000000000000', '2026-04-22');
assert.strictEqual(
readMappedCommit(file),
'cafebabe00000000000000000000000000000000',
);
});
test('readMappedCommit returns null when file missing', () => {
assert.strictEqual(readMappedCommit('/nonexistent/path.md'), null);
});
test('readMappedCommit returns null when frontmatter absent', () => {
const file = path.join(tmp, '.planning', 'codebase', 'STRUCTURE.md');
fs.writeFileSync(file, '# No frontmatter\n');
assert.strictEqual(readMappedCommit(file), null);
});
test('writeMappedCommit creates the file when it does not exist (symmetry with readMappedCommit)', () => {
const file = path.join(tmp, '.planning', 'codebase', 'NEW-DOC.md');
assert.strictEqual(fs.existsSync(file), false, 'precondition: file absent');
// Must not throw — readMappedCommit returns null for missing files,
// writeMappedCommit must defensively create them.
writeMappedCommit(file, 'feedface00000000000000000000000000000000', '2026-04-22');
assert.strictEqual(fs.existsSync(file), true, 'file created');
assert.strictEqual(
readMappedCommit(file),
'feedface00000000000000000000000000000000',
);
});
});
// ─── Unit: negative / defensive ──────────────────────────────────────────────
describe('detectDrift — defensive paths', () => {
test('missing structureMd → skipped result, no throw', () => {
const result = detectDrift({
addedFiles: ['foo/bar.ts'],
modifiedFiles: [],
deletedFiles: [],
structureMd: null,
});
assert.strictEqual(result.skipped, true);
assert.strictEqual(result.actionRequired, false);
assert.ok(result.reason);
});
test('empty inputs → no drift', () => {
const result = detectDrift({
addedFiles: [],
modifiedFiles: [],
deletedFiles: [],
structureMd: '# structure',
});
assert.strictEqual(result.elements.length, 0);
assert.strictEqual(result.actionRequired, false);
});
test('categories constant is exposed and stable', () => {
assert.ok(Array.isArray(DRIFT_CATEGORIES));
assert.deepStrictEqual(
[...DRIFT_CATEGORIES].sort(),
['barrel', 'migration', 'new_dir', 'route'],
);
});
});
// ─── Unit: non-blocking guarantee ────────────────────────────────────────────
describe('detectDrift — non-blocking guarantee', () => {
test('never throws on malformed input', () => {
assert.doesNotThrow(() => detectDrift({}));
assert.doesNotThrow(() => detectDrift({ addedFiles: null }));
assert.doesNotThrow(() => detectDrift({ addedFiles: ['x'], structureMd: undefined }));
});
test('malformed input returns a skipped result (never crashes the phase)', () => {
const r = detectDrift({});
assert.strictEqual(r.skipped, true);
assert.strictEqual(r.actionRequired, false);
});
});
// ─── Config validation: drift keys owned by the drift capability ──────────────
//
// After ADR-857 phase-6 migration, workflow.drift_threshold and workflow.drift_action
// are no longer in the central config schema manifest (VALID_CONFIG_KEYS). They are
// federated config keys owned exclusively by the `drift` capability in the registry.
// VALID_CONFIG_KEYS covers central-only keys; capability-owned keys resolve through
// the federated config overlay (loadConfig still returns them at their defaults).
const CAPABILITY_REGISTRY_PATH = path.join(
__dirname,
'..',
'gsd-core',
'bin',
'lib',
'capability-registry.cjs',
);
describe('config-schema — drift keys', () => {
test('workflow.drift_threshold owned by drift capability (not central)', () => {
const { isCentralConfigKey } = require(CONFIG_SCHEMA_PATH);
const registry = require(CAPABILITY_REGISTRY_PATH);
// Must be owned by the drift capability
assert.strictEqual(registry.configKeys['workflow.drift_threshold'], 'drift',
'workflow.drift_threshold must be owned by the drift capability');
// Must NOT be in central schema (migration complete)
assert.strictEqual(isCentralConfigKey('workflow.drift_threshold'), false,
'workflow.drift_threshold must not be a central config key after capability migration');
});
test('workflow.drift_action owned by drift capability (not central)', () => {
const { isCentralConfigKey } = require(CONFIG_SCHEMA_PATH);
const registry = require(CAPABILITY_REGISTRY_PATH);
// Must be owned by the drift capability
assert.strictEqual(registry.configKeys['workflow.drift_action'], 'drift',
'workflow.drift_action must be owned by the drift capability');
// Must NOT be in central schema (migration complete)
assert.strictEqual(isCentralConfigKey('workflow.drift_action'), false,
'workflow.drift_action must not be a central config key after capability migration');
});
});
describe('config-set drift validation via CLI', () => {
let tmp;
beforeEach(() => {
tmp = createTempGitProject('gsd-drift-cfg-');
});
afterEach(() => cleanup(tmp));
test('accepts warn', () => {
const r = runGsdTools(['config-set', 'workflow.drift_action', 'warn'], tmp);
assert.strictEqual(r.success, true, r.error);
});
test('accepts auto-remap', () => {
const r = runGsdTools(['config-set', 'workflow.drift_action', 'auto-remap'], tmp);
assert.strictEqual(r.success, true, r.error);
});
test('rejects bogus drift_action value', () => {
const r = runGsdTools(['config-set', 'workflow.drift_action', 'sometimes'], tmp);
assert.strictEqual(r.success, false);
});
test('drift_threshold accepts integer', () => {
const r = runGsdTools(['config-set', 'workflow.drift_threshold', '5'], tmp);
assert.strictEqual(r.success, true, r.error);
});
test('drift_threshold rejects non-numeric', () => {
const r = runGsdTools(['config-set', 'workflow.drift_threshold', 'many'], tmp);
assert.strictEqual(r.success, false);
});
});
// ─── Docs parity for CONFIGURATION.md ────────────────────────────────────────
describe('docs parity', () => {
test('workflow.drift_threshold mentioned in docs/CONFIGURATION.md', () => {
const md = fs.readFileSync(
path.join(__dirname, '..', 'docs', 'CONFIGURATION.md'),
'utf8',
);
assert.ok(md.includes('`workflow.drift_threshold`'));
});
test('workflow.drift_action mentioned in docs/CONFIGURATION.md', () => {
const md = fs.readFileSync(
path.join(__dirname, '..', 'docs', 'CONFIGURATION.md'),
'utf8',
);
assert.ok(md.includes('`workflow.drift_action`'));
});
});
// ─── Mapper --paths flag documented ──────────────────────────────────────────
describe('gsd-codebase-mapper --paths flag', () => {
test('agent doc mentions --paths', () => {
const doc = fs.readFileSync(
path.join(__dirname, '..', 'agents', 'gsd-codebase-mapper.md'),
'utf8',
);
assert.ok(/--paths/.test(doc));
});
test('AGENTS.md mentions --paths for mapper', () => {
const doc = fs.readFileSync(
path.join(__dirname, '..', 'docs', 'AGENTS.md'),
'utf8',
);
assert.ok(/--paths/.test(doc));
});
test('map-codebase workflow documents --paths passthrough', () => {
const doc = fs.readFileSync(
path.join(
__dirname,
'..',
'gsd-core',
'workflows',
'map-codebase.md',
),
'utf8',
);
assert.ok(/--paths/.test(doc));
});
});
// ─── Execute-phase workflow integration ──────────────────────────────────────
//
// After ADR-857 phase-6 migration, codebase_drift_gate is no longer an inline
// step in execute-phase.md. Instead, it is declared as a gate in the `drift`
// capability at the `execute:wave:post` hook point. The execute-phase.md
// dispatches capability gates via `gsd_run loop render-hooks execute:wave:post`,
// which fires the drift gates automatically.
describe('execute-phase integrates codebase_drift_gate', () => {
test('workflow references a codebase drift step', () => {
// After capability migration: the drift gate fires via execute:wave:post
// render-hooks dispatch. Verify two things:
// 1. execute-phase.md has the execute:wave:post render-hooks call site.
// 2. The drift capability declares a codebase-drift gate at execute:wave:post.
const doc = fs.readFileSync(
path.join(
__dirname,
'..',
'gsd-core',
'workflows',
'execute-phase.md',
),
'utf8',
);
// execute-phase.md must dispatch execute:wave:post hooks (the call site that fires drift gates)
assert.ok(
/loop render-hooks execute:wave:post/.test(doc),
'execute-phase.md must dispatch execute:wave:post hooks (drift capability gate call site)',
);
// The drift capability must declare a codebase-drift gate at execute:wave:post
const registry = require(CAPABILITY_REGISTRY_PATH);
const driftCap = registry.capabilities['drift'];
assert.ok(driftCap, 'drift capability must be registered');
const codebaseDriftGate = (driftCap.gates || []).find(
(g) => g.check && /codebase.drift/i.test(g.check.query),
);
assert.ok(
codebaseDriftGate,
'drift capability must declare a codebase-drift gate at execute:wave:post',
);
assert.strictEqual(codebaseDriftGate.point, 'execute:wave:post');
assert.strictEqual(codebaseDriftGate.blocking, false,
'codebase-drift gate must be non-blocking by contract');
});
test('workflow documents non-blocking guarantee for drift', () => {
const doc = fs.readFileSync(
path.join(
__dirname,
'..',
'gsd-core',
'workflows',
'execute-phase.md',
),
'utf8',
);
assert.ok(/non[- ]blocking/i.test(doc) || /continue on (error|failure)/i.test(doc));
});
});
// ─── CLI: verify codebase-drift subcommand ───────────────────────────────────
describe('verify codebase-drift CLI', () => {
let tmp;
beforeEach(() => {
tmp = createTempGitProject('gsd-drift-cli-');
fs.mkdirSync(path.join(tmp, '.planning', 'codebase'), { recursive: true });
});
afterEach(() => cleanup(tmp));
test('returns skipped JSON when STRUCTURE.md missing', () => {
const r = runGsdTools(['verify', 'codebase-drift'], tmp);
assert.strictEqual(r.success, true, r.error);
const data = JSON.parse(r.output);
assert.strictEqual(data.skipped, true);
assert.strictEqual(data.action_required, false);
});
test('returns no-drift result when STRUCTURE.md is fresh', () => {
const structure = path.join(tmp, '.planning', 'codebase', 'STRUCTURE.md');
fs.writeFileSync(structure, '# Codebase Structure\n\n- `src/`\n');
const head = git(tmp, 'rev-parse', 'HEAD');
writeMappedCommit(structure, head, '2026-04-22');
const r = runGsdTools(['verify', 'codebase-drift'], tmp);
assert.strictEqual(r.success, true, r.error);
const data = JSON.parse(r.output);
assert.strictEqual(data.action_required, false);
});
test('detects drift when new files added after last_mapped_commit', () => {
const structure = path.join(tmp, '.planning', 'codebase', 'STRUCTURE.md');
fs.writeFileSync(structure, '# Codebase Structure\n\n- `src/`\n');
const head = git(tmp, 'rev-parse', 'HEAD');
writeMappedCommit(structure, head, '2026-04-22');
git(tmp, 'add', '-A');
git(tmp, 'commit', '-m', 'map codebase');
for (const pkg of ['alpha', 'beta', 'gamma']) {
const dir = path.join(tmp, 'packages', pkg, 'src');
fs.mkdirSync(dir, { recursive: true });
fs.writeFileSync(path.join(dir, 'index.ts'), 'export {};\n');
}
git(tmp, 'add', '-A');
git(tmp, 'commit', '-m', 'add packages');
const r = runGsdTools(['verify', 'codebase-drift'], tmp);
assert.strictEqual(r.success, true, r.error);
const data = JSON.parse(r.output);
assert.strictEqual(data.action_required, true);
assert.strictEqual(data.directive, 'warn');
assert.ok(data.elements.length >= 3);
});
test('never exits non-zero when git repo is missing (non-blocking)', () => {
const nonGit = createTempProject('gsd-drift-nongit-');
try {
const r = runGsdTools(['verify', 'codebase-drift'], nonGit);
assert.strictEqual(r.success, true, 'must exit 0 even without git');
const data = JSON.parse(r.output);
assert.strictEqual(data.skipped, true);
} finally {
cleanup(nonGit);
}
});
});