mirror of https://github.com/garrytan/gstack.git
3 Commits
| Author | SHA1 | Message | Date |
|---|---|---|---|
Garry Tan
|
94993f7401
|
v1.61.0.0 fix wave: guards failing open / silent failures (9 fixes, 4 community PRs absorbed) (#2472)
* fix(careful): warn on chained rm even when the last target is safe The safe-exception block whitelisted rm -rf of build artifacts by extracting targets with a single greedy match (.*rm ...), which only ever inspects the LAST rm in the command. A chain like 'rm -rf /; rm -rf node_modules' was therefore judged solely by its trailing safe target and allowed without warning, waving through the destructive 'rm -rf /'. Gate the shortcut to single rm invocations: when any shell separator (; | & newline, incl. JSON-escaped \n/\r from the grep extraction path) is present, fall through to the destructive-pattern check, which warns on any recursive rm. Single-command artifact cleanups still allow. Adds 3 regression tests covering semicolon and && chains in both orders. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * harden(careful): substitution separators + capital -R recursive flag (#2039) Two residual fail-opens in the same guard PR #2040 hardened, both verified by executing the script pre-fix: - rm -rf $(./wipe-all)/node_modules silently allowed: the substitution token ends in a whitelisted suffix and the safe-exception early exit skipped ALL downstream checks. $( and backtick now count as chain separators; plain $VAR expansion stays allowed. - rm -R / silently allowed: both greps required a lowercase r in the flag cluster; capital -R is the documented BSD/macOS recursive flag. Both greps now match -[a-zA-Z]*[rR]. Six new tests: substitution x2 -> ask, capital-R x2 -> ask, rm -Rf node_modules single-command -> still allowed, escaped-newline branch (existing code, previously untested), and a pinned deliberate FP (cd app && rm -rf node_modules -> ask) documenting the fail-closed direction on chains. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(context-restore): prefer the current branch's own checkpoint (#2052) All worktrees of a repo share one origin-derived slug, so they share one `~/.gstack/projects/<slug>/checkpoints/` dir. `/context-restore` loaded the newest checkpoint across the whole dir, so in one worktree it could silently restore a *sibling worktree's* newer checkpoint. Step 1 now orders candidates current-branch-first (read from each file's `branch:` frontmatter), keeping other branches as a fallback. A branch is checked out in at most one worktree, so this stops cross-worktree contamination while preserving Conductor cross-branch handoff: when the current branch has no checkpoint of its own, the full newest-first set is still used. - scan the 200 newest before partitioning so a current-branch checkpoint sitting below a burst of sibling saves is still found; output still capped at 20 - non-git / detached HEAD / branchless legacy saves fall back to the old newest-first behavior (back-compat) - +5 regression tests in context-save-hardening.test.ts (the #2052 bug case fails on the old pipeline); regenerated SKILL.md + proactive-suggestions.json Fixes #2052 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(gbrain): pass --confirm-destructive on drift re-register (#1985) ensureSourceRegistered() handles match-but-different-path by removing the old source then re-adding it at the new path. The remove was issued as `gbrain sources remove <id> --yes`, but gbrain >= 0.42 gates `sources remove` behind `--confirm-destructive` (`--yes` alone no longer suppresses the data-loss prompt). The remove therefore fails with "To proceed, pass --confirm-destructive", which ensureSourceRegistered surfaces as "source registration failed" — aborting the entire /sync-gbrain code stage for any already-registered source whose path has drifted. The memory and brain-sync stages still pass, so the code index silently stops refreshing. The orchestrator's own safeSourcesRemove() already passes --confirm-destructive; this brings the lib helper in line with that convention. Keeps --yes for older gbrain. Tests: extend the fake gbrain shim in gbrain-sources.test.ts to simulate the gbrain >= 0.42 guard (remove without --confirm-destructive exits 1), update the drift re-register assertion, and add a regression test that proves the drift path no longer throws. Both fail on main with the exact "To proceed, pass --confirm-destructive" error and pass with the fix. Fixes #1985 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * harden(gbrain-sources): route drift remove through #1734 guards + realpath drift check Absorbing #2031 un-blocked a destructive remove that bypassed the #1734 data-loss guards: ensureSourceRegistered's drift path issued `gbrain sources remove` directly, without the detectAutopilot + decideSourceRemove checks every other remove routes through via safeSourcesRemove. gbrain >= 0.42's own prompt was accidentally blocking that path; with --confirm-destructive passed it is live again. - Drift remove now refuses LOUDLY (throws, actionable message) while an autopilot is active or when decideSourceRemove disallows; a silent changed=false would hide the drifted registration. - decideSourceRemove's extraArgs (--keep-storage when supported) propagate to the remove call, matching safeSourcesRemove. - Drift is realpath-normalized before being declared: a symlink alias of the same directory (macOS /tmp -> /private/tmp) is a match, not drift — the probable cause of #1985's reporter hitting the remove on an unmoved repo. - Drift fires a loud stderr line (old -> new path); perpetual drift in logs is the trigger for promoting #1985's reindex-in-place design. Tests: autopilot-active refusal (no remove in call log), fail-closed refusal on unreadable sources list, --keep-storage propagation, symlink-alias no-drift; existing drift tests pin the guard probes so a live autopilot on the dev machine can't flip them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(developer-profile): exclude mode:resources rows from SESSION_COUNT, TIER, NUDGE_ELIGIBLE (#2067) Every /office-hours run appends a mode:"resources" bookkeeping row alongside the real session row, so --read double-counted sessions (~2x): tiers promoted early and the builder-to-founder nudge armed prematurely. The file already filtered resources rows for LAST_*/CROSS_PROJECT; the same realSessions filter now feeds SESSION_COUNT/TIER, and the nudge predicate is the faithful allowlist (mode === 'builder') so a future mode #4 fails closed instead of re-opening this bug. 8 regression tests: count vs resources noise, tier boundaries both sides, nudge false-with-noise / true-at-3-builders, cross-project trailing row. Absorbed from PR #1991 by @mvann (fix + tests commits; the PR's version-bump commit is superseded by this wave's consolidated release commit). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(hooks): passThrough() two-branch contract — never emit permissionDecision:'defer' (#2035, #2006) Every AskUserQuestion died with "Tool result missing due to internal error" on current Claude Code builds (Desktop 1.14271.0, CC 2.1.177). Root cause: the question-preference-hook emitted permissionDecision:'defer' on every pass-through path. 'defer' is a real PreToolUse value, but since CC v2.1.89 its semantics are "pause this tool call for external resumption" (headless resume) — never "abstain". Interactive sessions have nothing to resume the paused call, so the tool orphaned. Pre-2.1.89 builds ignored the unknown value, which is why the hook worked when it shipped and broke later. The fix is the two-branch pass-through contract: - no context -> exit 0 with EXACTLY empty stdout - memory nuggets present -> hookSpecificOutput with hookEventName + additionalContext ONLY (the documented shape; plan-tune Layer 8 memory injection ships through this branch and keeps working) defer() is renamed passThrough() so the function says what it does, and docs/spikes/claude-code-hook-mutation.md's protocol contract (cited by the hook header) is corrected in the same commit — it taught '"defer" — let permission flow continue' and was the reintroduction vector. Test contract rewritten in the same commit (13 assertions across 3 files, verified fail-first against the unfixed hook): pass-through paths assert exact-empty stdout (a garbage/partial write cannot slip past an optional-chained parse), the nugget path asserts permissionDecision is ABSENT while additionalContext survives, and a new tripwire asserts no non-deny path ever puts the string "permissionDecision" on stdout. The deny (auto-decide) and Conductor prose-redirect paths are unchanged. Deployment: no migration needed — settings.json points at the absolute bash shim which execs the .ts live; /gstack-upgrade delivers the fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(one-way-doors): unify credential noun net + wire it into the runtime (#2024) Library fix: revoke/reset/rotate now share ONE noun alternation (api key, token, secret, credential, access key, password) with optional plural s?. Pre-fix leaks: "reset my secret", "reset my access key", "revoke my secret" (mismatched per-verb lists) and every plural form ("rotate the credentials", "revoke all tokens" — \b(...)\b cannot match a trailing s). Runtime wiring — the regexes could never fire in production before: - gstack-question-preference --check gains --summary-stdin: the question text pipes via stdin (never argv — summaries carry quotes/newlines/shell metacharacters) and feeds isOneWayDoor alongside the id, so an ad-hoc destructive question with a stored never-ask preference now forces ASK_NORMALLY. Empty/absent stdin keeps exact id-only semantics. - question-preference-hook falls back to classifyQuestion(question text) when the registry lookup misses, so unregistered destructive questions pass through to a human instead of auto-deciding. - question-tuning resolver prose shows the piped form (SKILL.md regen lands in the wave's release commit). Tripwires (verified fail-first): full verbs x nouns x singular/plural matrix with the #2024 repro rows, benign-summary no-over-match rows, stdin transport survival (quotes/newlines), empty-stdin fail-safe, and hook fallback both directions (destructive -> pass-through, benign -> deny). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(design): loud integer-flag contract for --count/--retry/--timeout (#2032) design variants --count abc silently generated ZERO variants and exited 0: parseInt(NaN) flowed through Math.min into the generation loop bound. The same NaN class was live on the two sibling flags in the same file: --retry abc made generate() a silent no-op (attempt <= NaN never true, null output, exit 0) and --timeout abc killed the serve board ~immediately (setTimeout(NaN)). New design/src/flag-utils.ts: parseIntFlag (pure, unit-testable) + normalizeIntFlag (CLI wrapper). Contract matches the --viewports precedent (error loudly on nonsense — these commands spend real image-API money, a silent fixup hides typos from calling agents): undefined -> default; bare flag/empty/non-integer ("3.7" rejected, not truncated)/below-min -> exit 1 with usage hint; above-max -> clamp with stderr warning. --count normalizes at the variants() consumption site so programmatic callers are covered, with the ceiling derived from STYLE_VARIATIONS.length instead of a magic 7; the CLI passes the raw flag through (a pre-parseInt would truncate "3.7"). Tripwires live in test/design-flag-utils.test.ts — deliberately under test/, not design/test/, which is invisible to the bun test glob, TEST_ROOTS, and every workflow (wiring design/test/ into CI is a captured TODO). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(gbrain): thin-client state — remote-MCP brains no longer classify as broken-config (#2051) A thin client (remote-HTTP MCP brain, no local engine by design) probed `gbrain sources list`, which gbrain's dispatch guard REFUSES on thin clients (exit 1, no recognized error string), so the classifier fell to its defensive broken-config default and every suppression gate silently hid brain-aware blocks from exactly the users on a shared team brain. New 'thin-client' state, detected PRE-probe from gbrain's own remote_mcp config marker via the existing gbrainConfigPath() helper (mirrors gbrain's isThinClient(); honors GBRAIN_HOME; zero network, immune to error-string drift), with a /thin[- ]client/ stderr backstop in the probe catch. Remote reachability is deliberately NOT probed by the classifier — that is the #1964 pathology; gbrain calls degrade gracefully at use time, and the detect JSON says so honestly (gbrain_thin_client: {probed: false}). The state is admitted at every suppression gate — gstack-gbrain-detect --is-ok (drives setup + gbrain-refresh), gen-skill-docs' detection override, gstack-config gbrain-refresh — while the sync stages (code/memory/dream) SKIP with an accurate reason: code indexing runs on the brain server, memory syncs via the remote brain's artifacts pull. The two consumer classes need opposite answers, which is why this is a distinct state and not a skip-the-probe special case. sync-gbrain Step 1.5 and setup-gbrain prose route thin-client to proceed, never into broken-config remediation. detectMcpMode secondary generalization: url-match against the config's remote_mcp.mcp_url (deterministic — gbrain mounts at the generic /mcp path) -> name pattern gbrain[-_]* -> stdio command token; gbrain_mcp_mode stays a 3-value enum. Tripwires: end-to-end --is-ok exits 0 on a thin-client fixture AND still exits 1 on broken-config (the gate didn't widen); pre-probe + stderr-fallback classifier paths; 4 detectMcpMode identification cases incl. a non-matching url that must NOT false-positive. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * release: v1.60.0.0 — regen SKILL.md, VERSION, CHANGELOG, TODOS follow-ups - Regenerate all SKILL.md from templates (question-tuning --summary-stdin prose from #2024, context-restore branch preference from PR #2054, sync-gbrain/setup-gbrain thin-client prose from #2051) + llms.txt. - VERSION + package.json -> 1.60.0.0 (bin/gstack-next-version, queue-aware: #1815 claims 1.59.0.0, #2213 claims 1.59.1.0). - CHANGELOG release summary + itemized entry crediting @jbetala7 (x3) and @mvann. - TODOS.md: three eng-review follow-ups (design/test CI wiring + documented pre-existing retry-after flake, /context-save worktree identity, gbrain reindex-in-place conditional on the new drift log). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(resolvers): compress --summary-stdin preamble prose to fit parity budget; re-bless ship goldens The v1.57.7.0 parity suite caps investigate's generated size at 1.09x baseline; the #2024 question-tuning prose (duplicated into every tier->=2 skill) tipped it to 1.092. Compressed to a single inline command + short pointer (the full rationale lives in bin/gstack-question-preference's header and the one-way-doors module docs). Ship goldens re-blessed against the final resolver text (conscious template-change acknowledgment, per the golden-file regression contract). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(e2e): office-hours-spec-review turn budget fits the carved skill layout (#2473) The test failed deterministically with error_max_turns at 9 turns on main and this branch alike (CI attempt logs + local main repro). Root cause from the failing transcript: the Spec Review Loop content is carved out of office-hours/SKILL.md into office-hours/sections/, so the agent needs discovery hops (grep SKILL.md -> ls sections/ -> read the section) before it can write — 8 tool turns + the closing text turn = 9 > the 8-turn budget, which predates the carve. Observed failures wrote a CORRECT summary on tool turn 8 and died on the closing turn. maxTurns 8 -> 12. Verified: PASS locally post-fix (7 turns this run — the extra headroom absorbs discovery-path nondeterminism). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(e2e): review-dashboard-via session budget survives runner contention (#2473) The test failed on CI (and its baseline run) with the timeout signature: 0 turns, $0.00, exactly 183s, 3/3 attempts — the spawned claude -p session never emitted a single stream event before the 180s inner timeout. The file's tests run concurrently on one runner; session startup queues behind sibling sessions, and this test had the tightest budget in the file (the 240s-budget tests in the same job passed). A clean local run takes 270s wall for 4 turns, confirming 180s was too tight even without contention. Inner timeout 180s -> 300s; outer bun timeout 240s -> 360s to keep headroom over the inner budget. Verified: PASS locally post-fix (4 turns, 270s). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(e2e): retro-base-branch session budget survives runner contention (#2473) Same class as review-dashboard-via, one test over in the same file: /retro is a long multi-step flow whose clean pass measures 225-239s — a coin flip against the 240s inner budget. First CI run passed at 225s; the rerun timed out at the 240s line on all 3 attempts (exitReason "timeout"); the local verification run passed at 239s, ONE second under the old cap. Inner timeout 240s -> 360s; outer bun timeout 300s -> 480s for headroom. Verified: PASS locally post-fix (17 turns, 239s). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jayesh Betala <jayesh.betala7@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Michael Vann <9221873+mvann@users.noreply.github.com> |
|
|
Garry Tan
|
c7ae63201a
|
v1.58.1.0 feat: hermetic local E2E + Conductor prose AskUserQuestion (#2004)
* feat: add shared call-time isConductor() helper
Single source of truth for Conductor host detection in TS consumers
(CONDUCTOR_WORKSPACE_PATH / CONDUCTOR_PORT). Reads the passed env at
call time, not a module-load snapshot, so unit tests can pin the env
inline without Bun --preload (esm-hoist-breaks-env-pin-bootstrap).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: harden question-preference-hook harness against ambient Conductor env
runHook copied all of process.env into the hook subprocess, so running the
suite inside Conductor (CONDUCTOR_WORKSPACE_PATH/PORT set) would leak those
markers. Strip them so the existing cases deterministically characterize
NON-Conductor behavior before the Conductor branch lands. Baseline: 15 pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: PreToolUse hook denies AskUserQuestion in Conductor, redirects to prose
Conductor disables native AskUserQuestion and routes through a flaky MCP
variant that returns '[Tool result missing due to internal error]'. The
hook now denies any AUQ call in a Conductor session and instructs the model
to render a prose decision brief instead (transport avoidance, not preference
enforcement) — firing for one-way doors too, with a typed-confirmation
requirement for destructive paths.
Precedence: never-ask auto-decide still wins (user already settled those);
Conductor prose is the fallback for everything else; non-Conductor behavior
is byte-for-byte unchanged. Restructured the per-question loop to compute
eligibility without early-returning so the Conductor branch can run as the
fallback while preserving memoryContext on every exit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: Conductor renders AskUserQuestion decisions as prose by default
In Conductor, native AskUserQuestion is disabled and the MCP variant is
flaky, so skills now render every decision as a plain-text prose brief the
user answers by typing a letter — proactively, not as a failure reaction.
- Preamble emits CONDUCTOR_SESSION, gated on != headless so eval/CI inside
Conductor still BLOCKs instead of rendering prose to nobody.
- AskUserQuestion Format gains a Conductor-default-prose rule (auto-decide
preferences still apply first; prose decisions log via gstack-question-log
since PostToolUse never fires), a one-way/destructive typed-confirmation
rule, and a typed-reply continuation protocol for split chains.
- Regenerated all SKILL.md + ship golden fixtures; bumped affected carve
skeleton caps to absorb the always-loaded additions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: deploy the Conductor AskUserQuestion hook (setup + upgrade migration)
The PreToolUse hook only delivers its Conductor-prose guarantee if it's
installed, but setup skips hook registration in non-interactive (conductor/CI)
setups. Two fixes so layer 3 actually deploys:
- setup: treat a Conductor workspace as an implicit opt-in for the PreToolUse
hook on the silent fall-through (never overriding an explicit opt-out).
- migration v1.58.0.0: re-register the hook for existing Conductor installs on
/gstack-upgrade, idempotent and respecting plan_tune_hooks=no.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: E2E for Conductor prose + fix auto-decide-preserved GSTACK_HOME bug
- New skill-e2e-conductor-prose (periodic): Conductor env + plan-eng-review
surfaces a prose decision brief, not a silent skip. Header documents this is
end-to-end behavior coverage; the deterministic Conductor guard is the
question-preference-hook unit test (the PTY harness can't register the MCP
variant — Codex #10).
- Fix the pre-existing bug in auto-decide-preserved: it seeded the never-ask
preference under GSTACK_HOME=tmpHome but never passed GSTACK_HOME into the
PTY run, so the spawned claude read the real ~/.gstack and the preference
was inert (Codex #9). Now passes GSTACK_HOME + CONDUCTOR_WORKSPACE_PATH to
prove auto-decide still wins over the Conductor prose redirect.
- Register both in touchfiles (periodic tier).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* v1.58.0.0 feat: Conductor renders AskUserQuestion decisions as prose
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: strip ambient Conductor env in memory-cache-injection hook harness
Same dev-in-Conductor leak fixed for question-preference-hook: this suite's
runHook copies process.env, so running it inside Conductor flipped the
defer-path memoryContext assertions into the [conductor] prose deny. Strip
CONDUCTOR_* so the cases characterize non-Conductor behavior. (CI is headless,
so this only bit local Conductor runs.)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: gstack-detach — run agent eval/bench jobs in their own session
Long agent-run jobs (30-60 min evals, benchmarks) die when the harness sends
SIGTERM to a background task's process group on turn boundaries / monitor
stops / interruptions (observed: 'script test:gate terminated by signal
SIGTERM'). gstack-detach runs the command in a fresh session (python3
os.setsid, or setsid on Linux, nohup fallback) so a group SIGTERM can't reach
it, and wraps it in caffeinate -i on macOS so idle-sleep can't kill it either.
Returns immediately; caller polls the logfile. Secrets stay in env, never argv.
The guard test pins the contract: the command runs in a different process
group than the caller and outlives the launching shell.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: eval:bg* scripts — detached eval runs for agents
Agent-facing convenience scripts that launch the eval suites through
gstack-detach so a harness SIGTERM can't kill a long run. eval:bg (diff-based),
eval:bg:all, eval:bg:gate, eval:bg:periodic — each returns immediately and
streams to /tmp/gstack-evals.log for polling. The plain test:evals / test:e2e
scripts stay foreground for humans.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: CLAUDE.md — agents must run long evals via gstack-detach
Codifies the detached-execution default: agent-launched eval/benchmark runs go
through bin/gstack-detach (or the eval:bg* scripts) so a harness SIGTERM or
macOS idle-sleep can't kill a 30-60 min run, then poll the log with a
death-aware watcher. Humans keep foreground scripts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: harden gstack-detach against all four eval-infra killers
The basic bash detach fixed SIGTERM but a real run on a shared dev box hit
three more killers: cross-worktree API saturation (15-way concurrency x a
sibling worktree mass-timed-out the suite), a silent hang (periodic bun died
with no exit marker), and shared-/tmp log contamination (a concurrent
worktree's agent output bled into the log). Rewrite as a portable python3 tool
that bakes in all four fixes:
- fork + setsid: SIGTERM-proof (own session, survives harness polite-quit)
- caffeinate -i on macOS: no idle-sleep death
- --lock NAME (fcntl, machine-wide): concurrent worktrees SERIALIZE instead of
saturating the shared model API
- run-scoped default log (~/.gstack-dev/eval-runs/<label>-<slug>-<branch>-<ts>-<pid>):
no cross-worktree collision/contamination
- --timeout watchdog + a guaranteed '### gstack-detach EXIT=<code> ###' sentinel
on every terminal path: no silent hang, finished-vs-died always detectable
Guard test pins all four: detached pgid differs + outlives launcher, run-scoped
log path, watchdog EXIT=timeout, and lock serialization (second run WAITS).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: eval:bg* use run-scoped logs + machine lock + watchdog
Drop the shared /tmp/gstack-evals.log path (the cross-worktree collision that
contaminated a live run) for gstack-detach's run-scoped default, and add the
machine-wide gstack-evals lock (concurrent worktrees serialize, no API
saturation) plus per-tier watchdog timeouts (60/90/120 min). Each eval:bg*
prints its run-scoped log path to poll.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: wire detached-eval guidance into /ship + correct CLAUDE.md flags
- /ship eval step (sections/tests.md): long eval suites launch via gstack-detach
(own session, machine lock, EXIT sentinel) so a turn boundary can't kill a
30+ min run mid-ship — the exact failure observed during this branch's ship.
- CLAUDE.md: correct the now-stale /tmp reference; document the --lock (serialize
worktrees, no API saturation), --timeout watchdog, run-scoped log, and the
guaranteed EXIT sentinel the poller breaks on.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor: extract pure promotedEnv() from conductor-env-shim
Single source of truth for GSTACK_* key promotion semantics. The ambient
promoteConductorEnv() becomes a wrapper; behavior-preserving. Needed by the
hermetic env builder which must not mutate process.env.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: hermetic child-env builder for E2E runners
Allowlist scrub (basics/network/named-auth kept; CONDUCTOR_*, CLAUDE_*,
GSTACK_*, MCP_*, GBRAIN_*, operator credentials dropped), per-runner
extraAllow, overrides merge last, EVALS_HERMETIC=0 byte-identical escape
hatch read at call time (ESM-hoist safe). Sync memoized singleton temp dirs
(<runRoot>/.claude keeps the extractPlanFilePath contract), seeded
.claude.json for non-interactive first run, pid-aware GC of crashed runs.
19 free unit tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: session-runner spawns hermetic children + isolation canaries
claude -p children now get the allowlist-scrubbed env and a gated
--strict-mcp-config (EVALS_HERMETIC=0 restores operator env AND args).
Two gate-tier canaries make the clean room falsifiable: hermetic-canary
asserts env redirect + scrub + zero MCP servers + nonzero API-key cost
from the Bash tool_result (never model prose); hermetic-sentinel plants a
poisoned operator config (user CLAUDE.md + MCP server) and proves the
child cannot see it. Empirically verified on claude 2.1.175: print mode
needs no seed config (the seed serves the PTY path); the child CLI sets
CLAUDECODE for its own tools, so that scrub is pinned in unit tests, not
E2E. hermetic-env.ts joins GLOBAL_TOUCHFILES.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: PTY runner spawns hermetic claude sessions
launchClaudePty children get the allowlist-scrubbed env, a gated
--strict-mcp-config, and the session exposes hermeticConfigDir for
forensics (hermetic plan files live under <dir>/plans/ and still match
extractPlanFilePath via the /.claude dir-name contract). Seeded trust
state covers repo-cwd sessions; the 15s trust-watcher stays as fallback.
Verified foreground via the plan-mode-no-op gate test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: codex/gemini runners spawn hermetic children
Same allowlist scrub as the claude runners, with each provider's auth
surface re-admitted via extraAllow (codex: OPENAI_API_KEY/CODEX_* plus
its tempHome .codex copy; gemini: GEMINI_*/GOOGLE_* with real HOME for
~/.gemini auth). The gemini spawn previously inherited the full operator
env with no env property at all.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: agent-sdk-runner spawns hermetic children via complete Options.env
The historical 'env: breaks SDK auth' failure was partial-env replacement:
Options.env replaces the child's entire environment, so objects lacking
ANTHROPIC_API_KEY killed auth. Passing the complete hermetic env (key +
PATH + redirected CLAUDE_CONFIG_DIR/GSTACK_HOME) works — validated live
via query() with a Bash tool call (success, real cost, Conductor vars
scrubbed). Per-test opts.env merges last; ambient key mutation still
works because the builder reads process.env at call time.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: static tripwire pins hermetic wiring in all five runners
Free-tier invariants: every runner builds child env via hermeticChildEnv,
no raw ...process.env spread at any spawn site, --strict-mcp-config gated
on isHermeticEnabled in both claude runners, and no test callsite passes
the operator env into a runner's override parameter (scoped to runner
calls — unit tests spawning gstack bin scripts directly are exempt).
Mirrors the terminal-agent-pid-identity / server-embedder-terminal-port
tripwire idiom.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: refresh codex/factory ship goldens with detached-eval block
|
|
|
Garry Tan
|
ce5fbfa99f
|
v1.52.0.0 feat(plan-tune): explicit consent + first-run setup wizard for contributors (#1741)
* feat(plan-tune): explicit-consent surface + setup gate for question_tuning
Step 0 grows two implicit gates that run before user-intent routing:
- Consent gate: question_tuning=false + no marker → offer opt-in (contributor-specific copy variant)
- Setup gate: question_tuning=true + declared empty + no marker → run 5-Q wizard
Markers (~/.gstack/.question-tuning-prompted, ~/.gstack/.declared-setup-prompted)
ensure each user is asked at most once. The Enable+setup section split into
"Consent + opt-in" (with contributor framing) and standalone "5-Q setup"
reachable from both the consent flow and the setup gate.
Also aligns the calibration gate across three docs (V0 said 90+ days, TODOS
said 2+ weeks, binary uses 7 days). The fix distinguishes:
- Display gate (sample_size>=20, skills>=3, question_ids>=8, days_span>=7):
for rendering inferred values in /plan-tune output
- Promotion gate (90+ days stable across 3+ skills): for shipping E1
behavior-adapting defaults
TODOS.md E1 card updated to reference 90+ days, plus Codex's substrate risk
note: generated skill prose is agent-compliance-based, so E1 ships as
advisory annotations on AskUserQuestion recommendations, not silent
AUTO_DECIDE. Tests can verify templates contain right reads but can't
prove agents obey them.
Per /plan-eng-review + Codex outside-voice 2026-05-26.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore: bump version and changelog (v1.49.0.0)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(bins): honor GSTACK_STATE_ROOT override for test isolation
Plan-tune cathedral T1 (per D16 / Codex outside voice). The 3 bins that back
/plan-tune (question-log, question-preference, developer-profile) previously
ignored GSTACK_STATE_ROOT, so tests that tried to point state at a tempdir
via that env var silently wrote to the real ~/.gstack. Make STATE_ROOT take
precedence over GSTACK_HOME so the cathedral's E2E + unit tests can isolate
cleanly without sledgehammering HOME.
Order of precedence:
GSTACK_STATE_ROOT > GSTACK_HOME > $HOME/.gstack
Matches the existing gstack-paths emission order.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(plan-tune): regression coverage for v1.49 consent + setup gates
Plan-tune cathedral T2 + part of T1 follow-up (Codex IRON RULE — regressions
get tests). v1.49 shipped two prose-driven implicit gates inside plan-tune
Step 0 (consent, setup) with zero test coverage. The cathedral refactors that
template heavily; without tests, silent breakage is possible.
Three regression families plus a static template assertion:
1. Consent gate fires under qt=false + no marker; goes silent on marker write
or qt=true flip.
2. Setup gate fires under qt=true + empty declared + no marker; goes silent
when declared populates, marker is written, or qt is still false.
3. Marker idempotency: gates stay silent across 5 re-invocations after a
single decline/bail. Markers honored independently.
4. Static template assertion: gate language can't be silently deleted
without breaking a test.
Also extends gstack-config to honor GSTACK_STATE_ROOT (it was the last bin
still ignoring it — caught while writing the tests; without this, tests
would silently mutate the user's real config.yaml).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(spikes): Claude hook mutation + Codex session format
Plan-tune cathedral T4 (per D5/D10). Two Phase 1 design spikes that
downstream tasks (T3, T5, T6, T8, T9) depend on.
claude-code-hook-mutation.md
- Confirms PreToolUse allow + updatedInput is supported and is the right
mechanism for substituting an auto-decided answer.
- Pins stdin/stdout JSON schemas with field-by-field reference.
- Documents matcher regex syntax for "(AskUserQuestion|mcp__.*__AskUserQuestion)"
so Conductor's MCP-routed AUQ is covered.
- Captures parallel-hook merge order caveat and our settings.json snippet.
codex-session-format.md
- Maps the on-disk ~/.codex/sessions/<date>/rollout-*.jsonl schema by
event type (response_item 76%, event_msg 19%, turn_context, session_meta).
- Critical finding: Codex has NO AskUserQuestion tool. Gstack AUQ-shaped
Decision Briefs surface as agent_message text; answer is the next
user_message. Two-tier recovery: marker-first (D18), then pattern
fallback for hash-only logging.
- Confirms logs_2.sqlite is internal telemetry, not session content.
- Lists open questions to answer during T9 implementation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(settings-hook): schema-aware PreToolUse/PostToolUse registration
Plan-tune cathedral T3 (per D4 + Codex correction). The previous bin only
knew SessionStart and dedup'd on the hardcoded `gstack-session-update`
substring. The cathedral needs PreToolUse + PostToolUse hooks registered
side-by-side with the user's own hooks, with explicit consent UX, backups,
and rollback.
New subcommands:
- add-event --event <SessionStart|PreToolUse|PostToolUse|...> --command <cmd>
--source <tag> [--matcher <re>] [--timeout <s>]
- remove-source --source <tag> # removes all entries tagged by source
- diff-event ... # preview without mutating
- rollback # restore latest backup
- list-sources # audit gstack-tagged hooks
Multi-source dedup via a new `_gstack_source` field on each hook entry
(Claude Code preserves unknown fields). Source tag lets plan-tune-cathedral
register PreToolUse + PostToolUse without colliding with the existing
SessionStart wiring, and lets remove-source clean up cleanly during
gstack-uninstall.
Backups written automatically to settings.json.bak.<ts> before any
mutation, with a .bak-latest pointer the rollback subcommand reads.
Existing legacy `add <cmd>` / `remove <cmd>` shape preserved verbatim so
setup --team and gstack-uninstall keep working unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(hooks): PostToolUse capture hook for AskUserQuestion
Plan-tune cathedral T5. Closes the substrate hole that motivated this
entire branch: agent-compliance-only logging produced zero events in weeks
of dogfood. PostToolUse hook captures every AUQ fire deterministically.
What ships:
- hosts/claude/hooks/question-log-hook.ts — TS hook that reads Claude
Code's hook stdin, walks tool_input.questions[*], extracts user choice
+ recommended option from tool_response, spawns gstack-question-log per
question.
- hosts/claude/hooks/question-log-hook — bash shim Claude Code's hook
runner invokes; execs bun against the .ts file.
- Marker-first question_id extraction (D18 progressive markers):
<gstack-qid:foo-bar> stripped from question text, used as the id.
Hash fallback hook-<sha1[:10]> for unmarked questions (observed-only,
never used as preference key — D18 hash drift mitigation).
- (recommended) label parsing for the user_choice/recommended fields,
with refuse-on-ambiguous when two labels are present (D2 safety).
- Free-text capture: source=auq-other + free_text field when user picks
Other and types (Layer 8 dream cycle input).
- Matcher covers both native AskUserQuestion and mcp__*__AskUserQuestion
(Codex/Conductor catch from outside voice review).
- Crash safety: always exits 0; errors land in ~/.gstack/hook-errors.log
so the user's session is never blocked by a hook failure.
gstack-question-log extended to:
- Accept `source` field (default 'agent', new values: hook, auq-other,
auto-decided, codex-import-marker, codex-import-pattern).
- Accept `tool_use_id` (<=128 chars) for dedup.
- Composite dedup on (source, tool_use_id) across the last 100 lines —
protects against hook + preamble both firing on the same tool call
(D3 belt+suspenders).
- Async fire `gstack-developer-profile --derive` after each successful
write so inferred.sample_size actually grows (D17 — without this, the
cathedral's "before 0, after >0" metric never moves).
- GSTACK_QUESTION_LOG_NO_DERIVE=1 escape hatch for tests.
9 new unit tests covering capture, marker extraction, MCP variant,
free-text, dedup, ambiguous-recommended safety, crash paths. All pass
plus the existing 88 tests across related files.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(hooks): PreToolUse enforcement hook for AskUserQuestion preferences
Plan-tune cathedral T6 — the keystone that makes never-ask actually bind.
Today preferences are agent-convention (silently ignored). This hook
enforces them via Claude Code's hook protocol: when a never-ask preference
matches an AUQ that is two-way + has a marker + has a clear recommendation,
the hook returns permissionDecision: "deny" with permissionDecisionReason
naming the auto-decided option. The agent obeys the rejection feedback and
proceeds with the recommended option without re-firing AUQ.
Decision tree (per question):
- marker absent → defer (D18: hash IDs are observed-only)
- one-way door → defer (safety override — never auto-decide one-way)
- always-ask preference → defer
- no preference set → defer
- ambiguous recommendation (two (recommended) labels OR no parseable rec)
→ defer (D2 refuse-on-ambiguous)
- never-ask / ask-only-for-one-way + two-way + clean rec → deny+reason
Preference precedence per D8: project-local
(~/.gstack/projects/<slug>/question-preferences.json) wins, global
(~/.gstack/global-question-preferences.json) is fallback.
Why deny+reason instead of allow+updatedInput:
AskUserQuestion's updatedInput shape for "pre-resolve this question" isn't
structurally pinned in Claude Code docs (T4 spike open question). deny with
a reason that names the auto-decided option is the conservative + reliable
v1 — the model receives the rejection, reads the recommended option from
the reason, proceeds without re-prompting. Swap to allow+updatedInput once
the AUQ input shape is verified against real Claude Code.
Since deny prevents PostToolUse from firing, this hook logs the auto-decided
event itself via gstack-question-log (source=auto-decided) so /plan-tune's
Recent auto-decisions surface picks it up. Also writes a session marker
~/.gstack/sessions/<id>/.auto-decided-<tool_use_id> for coordination when
the AUQ-shape switch lands.
Multi-question AUQ: enforcement is all-or-nothing per call. If any question
in the batch isn't eligible (no marker, no preference, ambiguous rec, etc.),
the whole call defers so the user still gets to answer the rest normally.
Registry lookup: cheap regex extraction from scripts/question-registry.ts
(reading + bun-importing the TS file from a hook is too slow). Door type
defaults to two-way for unregistered.
Matcher covers both native AskUserQuestion and mcp__*__AskUserQuestion
(Conductor disables native — Codex outside-voice catch).
15 unit tests cover defer paths, enforcement, one-way safety override,
ambiguous-rec refuse, precedence (project wins, global fallback,
project-overrides-global), MCP matcher, auto-decided event logging,
session marker writing, crash safety.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(scripts): declared-annotation helper + autonomy signal_key wiring
Plan-tune cathedral T7. Adds the helper that lets skills inject one-line
plain-English annotations on AUQ recommendations based on the user's
declared profile — read-only, advisory-only, per TODOS.md E1 substrate-risk
guidance (no AUTO_DECIDE off inferred).
scripts/declared-annotation.ts
- getDeclaredAnnotation(signal_key) → annotation | null
- primaryDimensionFor(signal_key) → Dimension | null
- Signature uses kebab signal_key per D2/Codex correction (registry uses
hyphens; profile dimensions use underscores; helper maps internally).
- Bands: >= 0.7 high, <= 0.3 low, else null. Middle band stays silent.
- Per-dimension plain-English phrasing: 5 dimensions × 2 bands = 10 phrases.
- Reads ~/.gstack/developer-profile.json (honors GSTACK_STATE_ROOT).
scripts/psychographic-signals.ts
- New signal_key 'decision-autonomy' that maps user_choice → autonomy
dimension nudges. This was the missing signal for the 'autonomy'
dimension — without it, the cathedral could annotate four of five
declared dimensions but autonomy stayed silent.
scripts/question-registry.ts
- Add signal_key: 'decision-autonomy' to land-and-deploy-merge-confirm
and land-and-deploy-rollback. These are the highest-leverage autonomy
questions in the surface — "let me decide" vs "go ahead" is exactly
what the dimension captures.
13 unit tests cover the helper's full contract (unknown keys, missing
profile, middle-band null, both band thresholds, all five dimensions
rendering distinct phrases). Existing 47 plan-tune.test.ts tests still
pass after the registry + signal-map enrichment.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(setup): install plan-tune cathedral hooks with explicit consent UX
Plan-tune cathedral T8. Wires the new PostToolUse capture hook and
PreToolUse enforcement hook into ~/.claude/settings.json via the
schema-aware gstack-settings-hook (T3) — respecting D4's "never mutate
settings.json silently" boundary and the Codex outside-voice warning.
Behavior at setup time:
- Idempotency: if list-sources already shows 'plan-tune-cathedral', no-op
with a one-line note.
- Marker present (previously declined): no-op, no re-prompt.
- Interactive terminal: print rationale + diff preview from settings-hook,
rollback command, and prompt y/N. On accept, register both hooks
(PostToolUse and PreToolUse) with --source plan-tune-cathedral. On
decline, touch ~/.gstack/.plan-tune-hooks-prompted so we don't re-ask.
- Non-interactive (CI / scripted): no prompt; print the two exact commands
the user would need to install manually.
- --no-team teardown also removes the plan-tune hooks via remove-source.
gstack-uninstall extended to clean up plan-tune-cathedral hooks alongside
the existing SessionStart cleanup. Listed as a separate "plan-tune
cathedral hooks" line in the REMOVED summary when it fires.
No new test file — coverage from T3's gstack-settings-hook-schema-aware
tests proves the underlying bin behavior; setup-level integration is
verified manually (re-running ./setup is cheap and the prompt makes it
obvious whether install happened).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bin): gstack-codex-session-import — structured Codex transcript parser
Plan-tune cathedral T9. Backfills question-log.jsonl from Codex sessions
since Codex has no AskUserQuestion tool (per docs/spikes/codex-session-format.md)
and gstack AUQ-shaped Decision Briefs show up as agent_message prose.
Walks ~/.codex/sessions/<date>/rollout-*.jsonl, matches each agent_message
that contains either a <gstack-qid:foo-bar> marker or a D-numbered Decision
Brief header, then pairs it with the next user_message for the answer.
Two-tier recovery per D5:
- marker present → source=codex-import-marker, stable question_id
- no marker but D-shape detected → source=codex-import-pattern with
hash-only question_id (never used as preference key per D18)
Subcommands:
gstack-codex-session-import # latest session
gstack-codex-session-import <file> # explicit path
gstack-codex-session-import --since <iso> # all sessions newer than
User-choice extraction handles A/B/C letter responses and prose responses
that start with the option label. Recommended option parsed via the
"(recommended)" label suffix (same convention as Layer 2).
Each extracted event written via gstack-question-log, so source tagging,
dedup, and async derive all apply uniformly. spawnSync uses the cwd from
session_meta so gstack-slug buckets events into the project the user was
actually working in, not the importer's cwd.
7 unit tests cover marker path, pattern fallback, multiple briefs in
sequence, missing user_message, numeric/letter user response forms,
empty-sessions-dir handling.
Smoke-tested against a real ~/.codex/sessions/ file from earlier today —
returns IMPORTED: 0 because that session was autonomous (no AUQ-shaped
prose), proving the bin doesn't false-positive on unrelated agent_message
events.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bin): gstack-distill-free-text — Layer 8 dream cycle distiller
Plan-tune cathedral T10. Reads auq-other free-text events from this
project's question-log.jsonl, calls Claude via the Anthropic SDK to extract
structured proposals (preference candidates, declared-profile nudges, memory
nuggets), writes them to distillation-proposals.json for the user to review
via /plan-tune (never autonomous — every apply requires explicit Y).
Subcommands:
gstack-distill-free-text # sync distill
gstack-distill-free-text --background # detach + return PID
gstack-distill-free-text --dry-run # emit prompt + events, no API call
gstack-distill-free-text --status # run history + cost-to-date
D7 rate cap: 3 distills per slug per day. Reads ~/.gstack/distill-cost.jsonl
for the count, exits with RATE_CAPPED when limit hit. Cost log lines tagged
by slug so sibling projects don't share the cap. Yesterday runs don't count.
D6 API auth: Anthropic SDK direct, fail-loud on missing ANTHROPIC_API_KEY
with explicit message that distill is a separate billing surface from the
interactive Claude Code session. Uses claude-haiku-4-5 for cost (~$0.001/
1k input, $0.005/1k output) — sufficient for structured extraction.
D14 execution context: --background spawns detached (nohup) so auto-trigger
during /ship doesn't add 30s of pause; results surface on next /plan-tune.
Source events get distilled_at:<ts> stamped on them after the run so they
don't re-propose on the next distill. Match by ts + question_id.
Cost-log line per run includes: slug, proposals_count, rejected_low_confidence,
input_tokens, output_tokens, cost_usd_est. /plan-tune stats reads this to
show "$X estimated, N runs this month" per Layer 4 surface.
10 unit tests cover --status, rate cap (3/day, yesterday-not-counted,
other-slug-not-counted), no-log/no-free-text paths, --dry-run, missing
API key, --background spawn. The actual SDK call is exercised by the T16
E2E test (uses real key, ~$0.001 per run).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bin): gstack-distill-apply — apply distillation proposals with gbrain tag
Plan-tune cathedral T11. Bin that applies a single user-approved proposal
from distillation-proposals.json to the right surface:
- memory-nugget → appended to ~/.gstack/free-text-memory.json (durable
local source-of-truth; gbrain is mirror when configured).
- preference → routed through gstack-question-preference --write
with source=plan-tune (clears the user-origin gate).
- declared-nudge → atomic update to developer-profile.json declared dim,
small=0.05, medium=0.10, large=0.15, clamped to [0, 1].
Why a separate bin (not inline in the skill template): /plan-tune's apply
step needs to be invokable from any host (Claude, Codex, etc) and must
write to multiple state files atomically. A bin centralizes the schema
+ clamp logic; the skill template just calls it after user Y.
gbrain coordination: --gbrain-published true marks the nugget so /plan-tune
stats can show "12 nuggets, 8 mirrored to gbrain". The skill template
invokes mcp__gbrain__put_page / extract_facts / add_tag in the same turn
(those are MCP tools, not CLI-callable) before calling this bin. Local file
remains canonical so the PreToolUse hook injection path (T12) doesn't
depend on gbrain availability.
Subcommands:
gstack-distill-apply --list # show pending proposals
gstack-distill-apply --proposal <N> # apply, file fallback
gstack-distill-apply --proposal <N> --gbrain-published true
Applied proposals get applied_at + gbrain_published stamped on them so
re-running --list shows only unconsumed ones.
11 unit tests cover --list (all three kinds + quotes), memory-nugget
append + non-clobber, preference routing through the gate-respecting bin,
declared-nudge math (medium=0.10, small=0.05, large=0.15, clamp at [0,1]),
proposal mark-applied with gbrain flag, and error paths (bad index, missing
--proposal).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(hooks): Layer 8 memory injection via per-session cache
Plan-tune cathedral T12. Extends the PreToolUse hook to inject matching
free-text-memory.json nuggets into AskUserQuestion responses, giving the
agent + user the distilled context from past 'Other' answers right when
the related question fires.
Per-session cache (D13 perf): first read of free-text-memory.json writes
~/.gstack/sessions/<id>/memory-cache.json. Subsequent hooks on the same
session take the cached path. Invalidation is by file-missing: when the
canonical file changes (via gstack-distill-apply), the per-session cache
either reflects the staler view for the rest of the session or the
session restarts and the cache rebuilds. Cheap, correct enough for v1.
Matching logic:
- Walk this AUQ batch's questions, extract marker question_ids.
- Look up signal_key in scripts/question-registry.ts.
- Collect nuggets whose applies_to_signal_keys include any of the
matched signal_keys.
- Cap to 3 most-recent (by applied_at) so the additionalContext stays
short.
- Surface as additionalContext on the hookSpecificOutput response.
Memory + enforcement interact cleanly: the same hook can both surface
nuggets AND deny the tool when a never-ask preference matches. Memory
context isn't doubled in the deny reason — the auto-decided option name
in the deny path is sufficient signal.
6 new tests cover injection on defer, no-match silence, 3-most-recent cap,
memory-alongside-deny enforcement, cache file write-through, empty-canonical
graceful degradation. Existing 15 preference-hook tests still green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(plan-tune): SKILL.md surfaces for cathedral T13
Plan-tune cathedral T13. Rewires plan-tune/SKILL.md.tmpl to expose the
new cathedral surfaces:
Step 0 routing:
- Implicit gate #3 (dream-cycle): fires when distillation-proposals.json
has unapplied proposals. Marker is per-proposal applied_at so re-firing
naturally skips already-handled items.
- Added user-intent route for "dream cycle" / "distill" / "what have I
been free-texting".
- Power-user shortcuts: distill, dream, audit.
Stats:
- Host-aware source breakdown (SOURCE_HOOK, SOURCE_AGENT, SOURCE_AUTO_DECIDED,
SOURCE_CODEX_IMPORT_*, SOURCE_AUQ_OTHER).
- MARKED percentage so D18 progressive-markers progress is visible.
- Distill cost-to-date via gstack-distill-free-text --status.
Recent auto-decisions:
- Last 10 source=auto-decided events with question_id + user_choice.
Lets the user spot-check enforcement and flip via always-ask.
Audit unmarked questions:
- Top N hash-only ids by frequency. Surfaces next candidates for the
D18 marker retrofit.
Dream cycle review + manual distill:
- Walks unapplied proposals via AskUserQuestion (one per call), routes
accepts through gstack-distill-apply with --gbrain-published flag.
Skill template invokes mcp__gbrain__put_page when MCP is available;
local file remains source-of-truth.
Regenerated SKILL.md via `bun run gen:skill-docs`. All 60 plan-tune
tests still green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(preamble): inject <gstack-qid:...> marker convention into question-tuning resolver
Plan-tune cathedral T14. Per D18 progressive markers, the PreToolUse
enforcement hook only fires when the AUQ question text contains a
<gstack-qid:foo-bar> marker the hook can extract. Without a marker, the
hook logs the fire as observed-only and skips enforcement (hash IDs drift
with prose so they're never used as preference keys).
The high-leverage retrofit point is the preamble's Question Tuning section,
not 10 individual skill templates. Updating scripts/resolvers/question-tuning.ts
adds the marker convention to every tier-≥2 skill in one change — agents
running ANY of the 30+ tier-≥2 skills now embed the marker by default when
the question matches a registered question_id.
Two convention additions in the preamble:
1. "Embed the question_id as a marker (<gstack-qid:{id}>) somewhere in the
rendered question." With explanation that the marker is the only path
for the PreToolUse hook to enforce preferences.
2. "Embed the option recommendation via the (recommended) label suffix on
exactly one option per AUQ." Documents the D2 parser contract: label
first, prose fallback, refuse-on-ambiguous.
Net cost: ~700 bytes added to the preamble per generated skill. Plan-review
preamble budget ratcheted from 39000 → 40000 (test/gen-skill-docs.test.ts)
with a comment explaining the cathedral T14 expansion is load-bearing.
Regenerated 42 SKILL.md files via `bun run gen:skill-docs`. The token
ceiling warning on ship/SKILL.md (~41K tokens) is pre-existing; this PR
doesn't change ship's preamble materially.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(ship): plan-tune discoverability nudge after first successful ship
Plan-tune cathedral T15 (the ship-side surface; the setup-side surface
shipped in T8 with explicit hook-install consent UX). Adds Step 21 to
ship/SKILL.md.tmpl: after Step 20 (persist metrics) succeeds, surface
/plan-tune once per machine via a marker-gated single-line nudge.
Behavior:
- If ~/.gstack/.plan-tune-nudge-shown exists → no-op.
- If question_tuning is already true → no-op (user already on board).
- Otherwise: print one nudge line, touch marker.
The nudge mentions both the observational substrate AND the hook-installed
auto-decide enforcement so users know what they get when they opt in.
Non-blocking — never asks a question, doesn't gate ship completion.
To re-show: rm ~/.gstack/.plan-tune-nudge-shown before next ship.
Setup-side discoverability shipped in T8 via the hook install prompt
(explicit consent + diff preview + backup). Together these two surfaces
cover first-install AND first-ship moments — the user discovers plan-tune
organically rather than needing to know /plan-tune exists.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(plan-tune): 5 cathedral E2E scenarios + touchfile registration
Plan-tune cathedral T16 (per D12 — all 5 in gate tier). One consolidated
file with five describeIfSelected scenarios, each selectable by its own
touchfile entry so they only run when the relevant code changes (or
EVALS_ALL=1 forces all):
plan-tune-hook-capture — PostToolUse hook fires → question-log fills
plan-tune-enforcement — never-ask + marker + 2-way → deny+reason
+ auto-decided event logged
plan-tune-annotation — declared profile + memory nugget
→ additionalContext surfaced on defer
plan-tune-codex-import — synthetic JSONL → import bin → log with
source=codex-import-marker
plan-tune-dream-cycle — apply proposal → re-fire question
→ memory injected via additionalContext
Each scenario fixtures an isolated git repo + bins + scripts + hooks
under tmp, then exercises the cathedral chain end-to-end against real
on-disk binaries (no mocks at the bin layer). GSTACK_STATE_ROOT keeps
the user's real ~/.gstack untouched.
These five complement the existing unit tests by proving the full
sub-process chain works (not just individual functions in isolation).
They DON'T spawn claude -p because the cathedral's substrate behavior is
deterministic — agent compliance is no longer the variable. The existing
test/skill-e2e-plan-tune.test.ts (plan-tune-inspect) still covers the
LLM-driven intent-routing behavior.
Cost: each scenario runs in ~1s with $0 because no claude -p invocations.
Touchfile-gated, so they only run on PRs that touch cathedral code.
Also fixes a bug found by the E2E: question-log-hook didn't pass the
incoming tool call's cwd to spawnSync when invoking gstack-question-log,
so the bin used the hook process's cwd (the repo root) instead of the
session's cwd. Result: log writes landed in the wrong project bucket.
Fix mirrors the same cwd-passing pattern from question-preference-hook.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: bump VERSION to 1.50.0.0 + plan-tune cathedral CHANGELOG
Plan-tune cathedral T17. Bumps VERSION 1.49.0.0 → 1.50.0.0 (MINOR per
CLAUDE.md scale-aware rule: this is substantial new capability — 8 layers,
~3000 LOC, 96 new tests, deterministic substrate + dream-cycle distillation).
CHANGELOG entry follows the release-summary format from CLAUDE.md:
- Two-line bold headline naming what changed for users (deterministic
capture, binding preferences, free-text memory loop)
- Lead paragraph: before/after framed concretely (zero events captured →
every fire, agent-honored → hook-enforced, declared profile → injected
context, regex backfill → structured JSONL parser)
- Two tables: metric deltas + layer/where-it-lives. Real numbers
(96 tests, ~$0.01 per distill, 3/day cap), no AI vocabulary, no em
dashes.
- "What this means for solo builders" close: ties dream cycle to the
compounding loop and points to ./setup as the on-ramp.
- Itemized Added/Changed/For contributors sections list every layer's
surfaces with file paths.
Also:
- Refreshed test/fixtures/golden/{claude,codex,factory}-ship-SKILL.md
to match the regenerated ship templates (Step 21 nudge added).
- Rebased plan-tune entry in parity-baseline-v1.47.0.0.json from
51717 → 64017 bytes with a baseline_note explaining the cathedral T13
expansion. Documents that the new Dream cycle, Recent auto-decisions,
Audit unmarked, Dream cycle review/distill sections are load-bearing,
not bloat. Without the rebase, the size-budget gate fails — and the
cathedral's whole point is making /plan-tune do more, not less.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: bump VERSION 1.50.0.0 → 1.52.0.0 (queue collision with #1742)
CI version gate caught: PR #1742 (garrytan/upgrade-gstack-gbrain-v1)
already claims v1.50.0.0 and #1751 (garrytan/browser-memory-leak) claims
v1.51.0.0. gstack-next-version util recommends v1.52.0.0 as the next free
slot.
Updates:
- VERSION 1.50.0.0 → 1.52.0.0
- package.json version sync
- CHANGELOG.md header + metric table label
- parity-baseline-v1.47.0.0.json baseline_note reference
No content changes; pure slot rebase per the queue. The cathedral scope
(8 layers, 96 tests) and CHANGELOG narrative stay identical — same ship,
different release number.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: cap audit — remove distill rate cap, loosen size/budget gates
Plan-tune cathedral follow-up. The 3/day distill cap was theatrical: at
~$0.01 per Haiku call, even a runaway loop firing every minute would cost
~$14/day, and free-text events are rare enough that the natural input
rate self-limits to 1-2 fires/day. Count caps don't protect against
runaway bugs (which fire 1000x/second, not 4 times/day) but DO punish
heavy users who'd legitimately distill multiple times during a busy week.
Removed: 3/day rate cap on bin/gstack-distill-free-text. --status output
swapped from "TODAY: N / 3" to "TODAY: N run(s), $X" so users see what
they're spending instead of how close they are to a meaningless count.
Loosened (caps that exist for real-runaway protection, not normal scope):
- EVALS_BUDGET_HARD_CAP_GATE $25 → $200/run
- EVALS_BUDGET_HARD_CAP_PERIODIC $70 → $500/run
- EVALS_BUDGET_HARD_CAP $30 → $300/run (umbrella fallback)
- GSTACK_SIZE_BUDGET_RATIO 1.05 → 1.50 per-skill ratio
- plan-review preamble byte budget 40K → 60K
Principle: caps exist to catch obvious bugs (infinite retry, model price
change, prompt blowup), not to gate legitimate scope growth. Set high
enough that real growth never trips them, only bug territory does.
Adjusted defaults are 4-8× historical worst case, leaving ample headroom
for the next 12 months of legitimate expansion.
Tests updated: distill-free-text removes the 3-test rate-cap describe
block in favor of "no rate cap" assertion that 10 runs/day pass. Other
budget tests still pass because they were never near the old ceilings.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
|