preferences.md was missing from both ROOT_STATE_FILES (used by
syncGsdStateToWorktree and syncWorktreeStateBack) and the
copyPlanningArtifacts file list (initial worktree seed). Because .gsd/
is gitignored, worktrees start with an empty .gsd/ directory — the
bootstrap is the only opportunity to carry config over.
Without preferences.md, post_unit_hooks, skill rules, custom
instructions, and all other preference-driven config silently stop
working once auto-mode enters a worktree.
Closes#2684
Runs commands in the user's login shell ($SHELL -l -c) so PATH additions
and env vars from shell profiles (.zprofile/.profile) are available.
Shell aliases are intentionally not loaded (requires -i which causes
startup noise and job control side effects).
Implementation spawns $SHELL directly via a loginShell flag threaded
through the bash executor — no double-shell wrapping.
- Registered as builtin slash command with autocomplete
- Reuses existing bash execution pipeline (streaming, session recording)
- Output included in LLM context for agent reference
- Added loginShell option to executeBash and handleBashCommand
- Browser mode rejects /terminal (terminal-only command)
- Updated web-command-parity-contract tests
AI-assisted: This change was authored with Claude (AI pair programming).
The completing-milestone dispatch gate checks structural prerequisites
(slice summaries exist, implementation artifacts present) but does not
check whether planned verification classes were addressed in validation.
Add a check: if verification_operational is non-empty and not "none",
verify the validation output documents operational compliance. If not
addressed, stop progression with a warning directing the user to re-run
validation with verification class awareness.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: TÂCHES <afromanguy@me.com>
Slice summaries capture Follow-ups and Known Limitations sections during
completion, but parseSummary() never extracts them. This makes the data
write-only — no downstream code can access it programmatically.
Add followUps and knownLimitations fields to the Summary interface,
extract them via extractSection() in parseSummary(), and aggregate
outstanding items from all slices into the validate-milestone prompt
context so the validator can assess unresolved work.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: integrate managed RTK across shell workflows
* fix(rtk): unify managed fallback and live savings wiring
* fix(rtk): improve TUI status visibility
* fix(tests): make portability tests independent of pi-coding-agent dist build
The CI portability test runs don't guarantee that
packages/pi-coding-agent has been compiled. Any test that
imported files pulling in @gsd/pi-coding-agent (resource-loader,
preferences-skills, async-bash-tool, etc.) crashed with
ERR_MODULE_NOT_FOUND pointing at dist/index.js.
Two changes to dist-redirect.mjs (the Node ESM loader hook used by
all unit tests):
- Redirect the bare @gsd/pi-coding-agent specifier to the workspace
source entrypoint (src/index.ts) so no dist/ artifact is needed.
- Extend the load() hook to transpile *.ts files under
packages/pi-coding-agent/src/ through TypeScript's transpileModule.
Node's --experimental-strip-types can't handle parameter properties
and similar syntax present in that package's source; full transpilation
avoids the ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX crash.
Also fix the dashboard.tsx responsive grid:
- xl:grid-cols-5 → xl:grid-cols-4 2xl:grid-cols-5
(5 metric cards no longer fit at xl without overflow; test contract
expected xl:grid-cols-4)
- Keep loading-skeletons.tsx in sync with the same breakpoints.
Add src/tests/resolve-ts-loader.test.ts to guard the loader behaviour:
- bare @gsd/pi-coding-agent redirect points to workspace source
- direct source-entry rewrite (.js → .ts)
- transpilation removes TS parameter property syntax that strip-only
mode cannot parse
* fix(tests): redirect all workspace package imports to source in portability tests
The previous fix only redirected @gsd/pi-coding-agent to its
source entrypoint. In CI, pi-coding-agent/src itself imports
@gsd/pi-ai (and other workspace packages) which were still pointing
at dist/. Since no workspace dist is built during the portability
test run, any transitive resolution hit the same ERR_MODULE_NOT_FOUND.
Changes to dist-redirect.mjs:
- Redirect @gsd/pi-ai, @gsd/pi-ai/oauth, @gsd/pi-agent-core, and
@gsd/pi-tui bare imports to their workspace src/ entrypoints.
- Broaden the load() transpilation condition from
'/packages/pi-coding-agent/src/' to '/packages/*/src/' so that
all workspace source files are run through TypeScript's
transpileModule, handling parameter properties and other syntax
that Node's strip-only mode rejects.
Verified by hiding all four workspace dist/ directories locally and
running the failing test set — 96/96 pass.
* fix(tests): redirect @gsd/native sub-paths; fix Windows .cmd spawnSync
Two more portability failures after the previous fix:
1. @gsd/native sub-path imports (@gsd/native/fd, @gsd/native/text, etc.)
were not redirected — the loader only handled the bare specifier.
Added a prefix-match redirect for @gsd/native/* → packages/native/src/<sub>/index.ts.
2. Windows RTK tests failed because createFakeRtk produces a .cmd wrapper
on Windows, and spawnSync(binaryPath, [...]) without shell:true silently
returns non-zero when the binary is a .cmd file.
Added shell: /\.(cmd|bat)$/i.test(binaryPath) to the spawnSync calls in:
- src/resources/extensions/shared/rtk.ts (rewriteCommandWithRtk)
- src/resources/extensions/shared/rtk-session-stats.ts (readCurrentRtkGainSummary)
- packages/pi-coding-agent/src/utils/rtk.ts (rewriteCommandForGsd)
Production use of rtk.exe is unaffected; the shell flag is only true for
.cmd/.bat paths.
Verified: all 93 portability tests pass with all workspace dist/ directories
removed (simulating CI portability environment).
* fix(tests): Windows portability fixes — HOME env, managed RTK path, perf threshold
Four Windows-specific failures fixed:
1. app-smoke.test.ts: process.env.HOME is undefined on Windows (uses
USERPROFILE instead). Changed to homedir() from node:os which works
cross-platform.
2. Managed RTK path tests on Windows: tests placed a fake RTK as rtk.exe
(by copying a .cmd script into a .exe filename), which Windows cannot
execute. Two-part fix:
- resolveRtkBinaryPath() in both rtk.ts files now falls back to rtk.cmd
in the managed dir on Windows when rtk.exe is absent.
- withManagedFakeRtk and equivalent patterns in rtk.test.ts,
rtk-session-stats.test.ts, rtk-execution-seams.test.ts changed to
place the fake at rtk.cmd instead of rtk.exe on Windows.
3. bg_shell RTK test on Windows: requires bash (for shell sessions), which
is not available on the blacksmith-4vcpu-windows-2025 runner without
Git Bash installed. Test now skips on win32.
4. derive-state-db perf assertion: 10ms threshold was too tight for Windows
CI runners (measured 12ms under load). Raised to 25ms — still catches
real regressions (baseline is 3ms locally and ~12ms on stressed runners).
* fix(tests): fix managed RTK path fallback on Windows in src/rtk.ts + fix copyable fake
Two remaining Windows failures:
1. src/rtk.ts was never patched with the rtk.cmd managed-dir fallback
(only the shared/rtk.ts and pi-coding-agent/src/utils/rtk.ts were updated).
Added the same rtk.cmd fallback and shell:.cmd detection to src/rtk.ts,
which is what rtk.test.ts imports from.
2. createFakeRtk on Windows wrote '%~dp0\fake-rtk.js' in the .cmd content —
this resolves relative to the .cmd file's own directory. When the test
copies rtk.cmd to a different managed dir, %~dp0 resolves to the copy
destination where fake-rtk.js does not exist. Fixed by embedding the
absolute path to fake-rtk.js directly in the .cmd content so the fake
works correctly regardless of where the .cmd is copied.
* feat(experimental): add RTK opt-in preference with web UI toggle
- Add `experimental` category to GSDPreferences with `rtk: boolean` (default: false)
- RTK is now opt-in: disabled by default for all projects unless explicitly enabled
- Validate experimental.* keys; unknown experimental keys produce warnings
Web UI:
- Add ExperimentalPanel component with animated toggle switch per flag
- Add /api/experimental route (GET/PATCH) to read/write flags in preferences.md
- Add 'Experimental' tab to settings dialog sidebar nav (FlaskConical icon)
- Include ExperimentalPanel at bottom of gsd-prefs mega-scroll
- Fix toggle disabled state: trigger loadSettingsData for 'experimental' section
and self-fetch on mount when data is absent
Dashboard:
- Gate RTK Saved metric card on rtkEnabled from live auto state (web)
- Gate TUI dashboard RTK savings row on rtkEnabled
- Gate TUI footer RTK status updates on experimental.rtk preference
- Propagate rtkEnabled through AutoDashboardData → bridge-service → store
Build:
- Add scripts/build-if-stale.cjs: incremental build driver that skips each
step (packages, root tsc, copy-resources, web) when output is newer than
source; replaces full rebuild chain in gsd:web
- Add scripts/web-stop.cjs: robust stop with registry + legacy PID + orphan
sweep via pgrep; handles crash/restart orphaned next-server processes
- gsd:web now uses build-if-stale.cjs (fast cold starts, instant when unchanged)
- gsd:web:stop / gsd:web:stop:all use web-stop.cjs directly
Fix: correct import path in rtk-status.ts (./preferences.js not ../preferences.js)
* fix: restore em-dash encoding in package.json to match upstream
* refactor(rtk): move command rewrite out of pi-coding-agent into GSD extension
Per review feedback from igouss: pi-coding-agent should not be modified to add
GSD-specific logic. Instead, add a proper extension point and wire RTK through it.
Changes to packages/pi-coding-agent (extension API only — no RTK logic):
- Add BashTransformEvent + BashTransformEventResult types to extension API
- Add on('bash_transform') overload to ExtensionAPI interface
- Add emitBashTransform() to ExtensionRunner (chains all handlers in order)
- Call emitBashTransform() in wrapToolWithExtensions before bash tool execution
- Export new types from extensions/index.ts and package index.ts
- Revert all RTK-specific changes from bash-executor.ts, tools/bash.ts
- Remove packages/pi-coding-agent/src/utils/rtk.ts entirely
Changes to GSD extension:
- Register bash_transform handler in register-hooks.ts that calls
rewriteCommandWithRtk() from the existing shared/rtk.ts module
- Handler is a no-op when RTK is disabled or not installed
* fix: correct import path for shared/rtk.js in register-hooks
* fix(tests): remove deleted pi-coding-agent/utils/rtk imports from execution seams test
The RTK rewrite logic was moved out of pi-coding-agent into the GSD
extension (bash_transform hook). Tests that directly imported the
deleted utils/rtk.ts are removed; remaining tests verify the shared
RTK module and GSD-layer surfaces that still call rewriteCommandWithRtk.
Verification class fields (contract, integration, operational, UAT) are
captured during milestone planning and stored in the DB, but the
validate-milestone prompt never reads them back. This means milestones
can pass validation even when planned operational verification items
(migrations, deployments, runtime checks) were never addressed.
This change:
- Queries getMilestone() in buildValidateMilestonePrompt() to retrieve
verification_* fields and injects them as structured context
- Adds a verification class compliance step to validate-milestone.md
that requires the validator to check evidence for each non-empty class
- Adds a Verification Class Compliance table to the validation template
Backwards compatible: empty verification_* fields (existing milestones)
produce no additional prompt content.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When a user configures a phase-specific model that is not in
MODEL_CAPABILITY_TIER (e.g. gpt-5.4, custom-provider/my-model),
getModelTier() defaults to "heavy". This causes resolveModelForComplexity
to downgrade every standard/light unit to tier_models, silently ignoring
the user's explicit configuration.
Add an isKnownModel() check before the downgrade logic. If the configured
primary model is not in the known tier map, skip downgrading entirely and
honor the user's choice. Known models continue to be routed normally.
Closes#2192
formatTraceSummary() is used by getDeepDiagnostic() which feeds into retry
prompts in phases.ts. Including the prior assistant's free-text reasoning
caused hallucination loops when the previous turn was truncated or malformed
— the model would recycle its own interrupted reasoning as if it were
diagnostic truth.
The fix removes the lastReasoning field from formatTraceSummary() output.
The crash recovery path (formatCrashRecoveryBriefing) has its own safe
handling of lastReasoning with explicit framing and is not affected.
Closes#2195
The rewrite-docs circuit breaker counter (MAX_REWRITE_ATTEMPTS=3) was
stored on the in-memory session object, resetting to 0 on every session
restart (crash recovery, pause/resume, step-mode). This allowed the
rewrite-docs dispatch rule to fire indefinitely without ever tripping
the circuit breaker.
The fix persists the counter to .gsd/runtime/rewrite-count.json using
the established runtime directory pattern. The dispatch rule reads from
disk instead of the session object, and the post-unit completion handler
resets both disk and in-memory counters.
Closes#2203
parseUnitId returns { milestone, slice?, task? } where slice and task are
optional. Test code that knows these fields are present needs ! assertions
to satisfy strict TypeScript checking.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The static analysis tests check source code for `return "continue"` patterns.
After extracting enqueueSidecar(), the return is now via the helper call.
Accept both patterns in the assertion.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Deduplicate the missing-slice-summary validation logic used by both
the validating-milestone and completing-milestone dispatch rules into
a single findMissingSummaries() helper function.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add cross-platform filesystem safety static analysis guard
Scan all production .ts files for patterns that break on Windows,
Linux, or macOS:
1. Hardcoded /tmp paths (FAIL) — use os.tmpdir()
2. String concatenation path separators (WARN) — use path.join()
3. rmSync without force: true (FAIL) — Windows read-only files
4. Shell command path interpolation (FAIL) — injection/spaces risk
5. existsSync + delete TOCTOU races (WARN) — informational
6. Recursive rmSync without containment check (WARN) — safety audit
Includes allowlists for known-safe patterns (e.g. cmux Unix socket,
npm package name constants). Reports violations with file path and
line number context.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: normalize path separators in allowlist matching for Windows CI
The isAllowlisted function compared relative paths using forward slashes,
but path.relative() produces backslashes on Windows, causing allowlist
entries to never match on the Windows CI runner.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
osascript display notification is silently swallowed by macOS when the
calling terminal app (Ghostty, iTerm2, etc.) lacks notification
permissions in System Settings. The command exits 0 with no error,
making the failure invisible.
terminal-notifier registers as its own Notification Center app, so
macOS prompts the user for permission on first use — the expected UX.
Changes:
- Add findExecutable() helper to locate terminal-notifier on PATH
- buildDesktopNotificationCommand() prefers terminal-notifier when
available, falls back to osascript (preserving existing behavior)
- Update tests to handle both terminal-notifier and osascript paths
- Add macOS delivery note to docs/configuration.md notifications section
- Add troubleshooting entry for notifications not appearing on macOS
Fixes#2632
Co-authored-by: Yang Yang(NYC) <Yang.Yang2@bcg.com>
When the API stream is truncated mid-chunk, pi reassembles the partial
tool-call JSON and gets a SyntaxError (e.g. "Expected double-quoted
property name", "Unexpected end of JSON input"). classifyProviderError()
did not match these patterns and fell through to the "unknown = permanent"
default, pausing auto-mode indefinitely instead of retrying.
These JSON parse errors are the downstream symptom of a connection drop —
same root cause as ECONNRESET, one layer up. Add an isMalformedStream
guard that matches common JSON SyntaxError patterns and classifies them
as transient with the same 15s backoff as connection errors.
Closes#2572
Consolidate 21 manual unitId.split("/") calls to use the typed
parseUnitId() function from unit-id.ts, gaining ParsedUnitId type
safety and consistent milestone/slice/task naming.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
showDiscuss() is a command handler, not a tool handler, so it lacks the
automatic ensureDbOpen() call that tool handlers get. On cold-start
sessions where no GSD tool has been called yet, isDbAvailable() returns
false, normSlices falls to [], and the function exits with a misleading
"All slices are complete — nothing to discuss." notification.
Add ensureDbOpen() before both isDbAvailable() call sites in
guided-flow.ts:
1. showDiscuss() — the primary bug (false "all complete" exit)
2. buildDiscussSlicePrompt() — secondary (incomplete context when
inlining completed-slice summaries)
Closes#2560
The forensics prompt instructed the agent to create GitHub issues using
an inline heredoc with --body "$(cat <<'EOF' ... EOF)". This caused
two bugs:
1. Escaping: backticks and double-quotes in the body were passed with
leading backslashes, breaking fenced code blocks and inline code in
the rendered issue.
2. Truncation: the heredoc delimiter EOF could match a bare "EOF" line
in the body content, silently dropping everything after it.
Switch to writing the body to a temp file and passing it via --body-file,
which bypasses shell quoting entirely. Also change the heredoc delimiter
from EOF to GSD_ISSUE_BODY to avoid accidental termination.
Closes#2465
The self-PID guard in isLockProcessAlive returned false for
process.pid, treating the current process as dead. This caused the
doctor to delete auto.lock and .gsd.lock/ during live auto-mode
sessions (via postUnitPreVerification), breaking the session lock
and silently stopping auto-mode.
The guard was originally added for startAuto() where a matching PID
could mean a recycled PID from a prior crash. But startAuto already
has its own `crashLock.pid !== process.pid` check before calling
isLockProcessAlive, so the function-level guard was redundant there
and harmful everywhere else.
Change `pid === process.pid` to return true (alive) instead of false.
Closes#2470
The run-uat prompt instructs the agent to write the UAT verdict to the
ASSESSMENT file (via gsd_summary_save artifact_type:"ASSESSMENT"), but
checkNeedsRunUat only checked the UAT spec file for a verdict. Since the
spec file never receives a verdict, hasVerdict() always returned false and
the run-uat unit was re-dispatched indefinitely — triggering the stuck-loop
detector after 3 identical dispatches.
Add ASSESSMENT file checks on both the DB-primary and file-based fallback
paths in checkNeedsRunUat. If either the UAT spec or the ASSESSMENT file
contains a verdict, UAT has been run and dispatch is skipped.
Closes#2644
When the uat-verdict-gate returns a non-PASS verdict, it returns
action: "stop" with level: "warning". This was routed to
closeoutAndStop() → stopAuto(), which destroys the session — the user
must cold-restart `/gsd auto` from scratch.
A non-PASS UAT verdict is a recoverable human checkpoint, not an
infrastructure failure. The fix routes warning-level stops to
pauseAuto() instead, making the session resumable with `/gsd auto`.
Error and info-level stops continue to use closeoutAndStop() for
infrastructure failures and terminal conditions respectively.
Closes#2474
Consolidate three near-identical sidecar enqueue blocks (hook, triage,
quick-task) into a shared enqueueSidecar() helper that handles the
push + debugLog + optional UI notification + return "continue" pattern.
Update static-analysis tests to accept the helper call pattern.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When the API stream is truncated mid-tool-call, PartialMessageBuilder
emits a toolcall_end event with { _raw: "<broken json>" } in the
arguments — but the event looks identical to a healthy tool completion.
Downstream consumers (error classifiers, tool handlers, activity log)
have no way to distinguish a truncated call from a completed one.
Add a malformedArguments: boolean flag to the toolcall_end event variant
in AssistantMessageEvent. The flag is set to true only in the JSON parse
catch path, so existing consumers (which do not check for it) are
unaffected. New consumers like classifyProviderError can use it to
handle truncated tool calls appropriately.
Closes#2574
When a milestone completes, phases.ts calls mergeAndExit to merge the
worktree branch back to main. It then calls closeoutAndStop → stopAuto,
which unconditionally calls mergeAndExit again. The second call fails
because the branch was already deleted by the first merge, producing a
misleading 'not something we can merge' warning even though the merge
succeeded.
Add a milestoneMergedInPhases session flag that phases.ts sets after a
successful merge. stopAuto checks this flag and skips its own merge
when it is already set. The flag is cleared in AutoSession.reset() so
it does not leak across sessions.
Closes#2645
getActiveMilestoneId and deriveStateFromDb sorted milestones by ID
(localeCompare / milestoneIdSort) while the dispatch guard in
dispatch-guard.ts sorted by queue-order.json via findMilestoneIds.
When a user reordered milestones via /gsd queue to prioritize a
later-numbered milestone, the state machine ignored the reordering
and dispatched to the earlier-numbered one. The dispatch guard then
blocked completion because the queue-ordered-first milestone was
incomplete — producing a deadlock.
Replace the lexicographic sort with sortByQueueOrder(loadQueueOrder())
in both the getActiveMilestoneId DB path and the deriveStateFromDb
milestone sort. This aligns all three subsystems (state derivation,
dispatch, and dispatch guard) on the same ordering.
Closes#2556
writeBlockerPlaceholder writes a placeholder SUMMARY file when idle
recovery exhausts all retries, but never updated the DB task status.
verifyExpectedArtifact checks the DB as the authoritative source for
execute-task units — with status still "pending", verification failed,
deriveState re-derived the same task, and the dispatch loop repeated
indefinitely (observed as 8-9 "Advancing pipeline" messages).
After writing the file, call updateTaskStatus to mark the task as
"complete" in the DB. This lets verifyExpectedArtifact pass and
breaks the infinite re-dispatch loop.
Closes#2531
On Windows, scanProjectFiles returns backslash paths (e.g.
"apps\mobile\app\build.gradle") but PROJECT_FILES markers use forward
slashes ("app/build.gradle"). Normalize scanned paths to forward
slashes before matching.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The doctor-task-done-missing-summary-slice-loop test was written for
the old filesystem-based task_done_missing_summary check, which was
refactored to db_done_task_no_summary (SQLite-based). The test creates
filesystem structures but the current check queries the database,
making it fundamentally incompatible.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
`_deriveStateImpl` (used when no gsd.db exists) lacked the SUMMARY-based
reconciliation added to `deriveStateFromDb` in 0e7a01f4. Heading-style
tasks (`### T01:`) are always parsed as `done=false` by `parsePlan`
because the heading syntax has no checkbox. When the agent writes a
SUMMARY file but the plan heading has no checkbox, the task appears
incomplete forever, causing infinite re-dispatch.
Now checks each non-done task for a SUMMARY file on disk after
`parsePlan()`, mirroring the DB reconciliation logic.
Root cause: `parsePlan()` recognizes two task formats:
1. `- [x] **T01: Title**` → done from checkbox state
2. `### T01: Title` → always done=false (no checkbox to read)
The DB path (deriveStateFromDb) was already fixed in 0e7a01f4 to
reconcile via SUMMARY files. This commit applies the same fix to
the filesystem path used by projects without gsd.db.
Consolidate two separate imports from files.js into one to resolve
TS2300 duplicate identifier error.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MilestoneRow and SliceRow interfaces don't have index signatures,
so they can't be assigned to Record<string, unknown>. Using
Record<string, any> allows the helper to accept any typed row object.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Extract syncDirFiles() helper to eliminate duplicated iterate/filter/copy/catch
logic across three directory levels (milestone root, slices, tasks). Reduces
maximum nesting depth from 4 to 2.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add ErrorContext interface to UnitResult so error information (provider
errors, timeouts, idle watchdog kills) is no longer discarded at the
resolve boundary. The four call sites that previously threw away context
now attach typed error metadata with category, message, and transience.
Downstream consumers (stuck detection in phases.ts, journal unit-end
events) use the structured errorContext field directly instead of
fragile regex heuristics on message content.
