@opengsd/gsd-pi 1.1.1-dev.616a1a1 → 1.1.1-dev.75048e7

package/src/resources/extensions/gsd/docs/preferences-reference.md

@@ -305,10 +305,18 @@ This config sets a parent workspace with two child repositories. The implicit `p
   - `max_cycles`: number — max times this hook fires per trigger (default: 1, max: 10).
   - `model`: string — optional model override.
   - `artifact`: string — expected output file name (relative to task/slice dir). Hook is skipped if file already exists (idempotent).
+  - `criticality`: `"advisory"` or `"blocking"` — advisory preserves current best-effort behavior; blocking requires clean hook completion plus a valid outcome verdict before auto-mode advances. Default: `"advisory"`.
   - `retry_on`: string — if this file is produced instead of the artifact, re-run the trigger unit then re-run hooks.
+  - `on_block`: object — optional routing for blocking findings:
+    - `action`: `"retry-unit"`, `"retry-task"`, `"queue-task"`, `"queue-slice"`, or `"pause"`.
+    - `artifact`: string — optional compatibility artifact for retry routing.
   - `agent`: string — agent definition file to use for hook execution.
   - `enabled`: boolean — toggle without removing (default: `true`).
 
+  Blocking hook artifacts must begin with YAML frontmatter containing either `verdict` or `outcome.verdict`.
+  Supported verdicts are `pass`, `advisory`, `needs-rework`, `needs-remediation`, and `needs-attention`.
+  `pass` and `advisory` continue; `needs-rework` retries the trigger unit when routed with `retry-unit`/`retry-task`; `needs-remediation` and `needs-attention` pause with recovery guidance.
+
 - `pre_dispatch_hooks`: array — hooks that fire before a unit is dispatched. Each entry has:
   - `name`: string — unique hook identifier.
   - `before`: string[] — unit types to intercept.

package/src/resources/extensions/gsd/doctor-runtime-checks.ts

@@ -269,14 +269,14 @@ export async function checkRuntimeHealth(
         } catch {
           count = MAX_UAT_ATTEMPTS + 1;
         }
-        if (count <= MAX_UAT_ATTEMPTS) continue;
+        if (count < MAX_UAT_ATTEMPTS) continue;
 
         issues.push({
           severity: "warning",
           code: "uat_retry_exhausted",
           scope: "slice",
           unitId: `${mid}/${sid}`,
-          message: `run-uat for ${mid}/${sid} exhausted ${count - 1} retry attempt(s) without an ASSESSMENT verdict. Reset the retry counter after fixing the underlying UAT/tool issue, then rerun /gsd auto.`,
+          message: `run-uat for ${mid}/${sid} exhausted ${count} attempt(s) without an ASSESSMENT verdict. Reset the retry counter after fixing the underlying UAT/tool issue, then rerun /gsd auto.`,
           file: `.gsd/runtime/${fileName}`,
           fixable: true,
         });

package/src/resources/extensions/gsd/error-classifier.ts

@@ -47,9 +47,10 @@ export function resetRetryState(state: RetryState): void {
 const PERMANENT_RE = /auth|unauthorized|forbidden|invalid.*key|invalid.*api|billing|quota exceeded|account/i;
 // Include provider-specific quota-window phrasing like:
 // - "You've hit your limit"
+// - "You've reached your limit"
 // - "usage limit" / "quota reached"
 // - "out of extra usage"
-const RATE_LIMIT_RE = /rate.?limit|too many requests|429|hit your limit|usage limit|out of extra usage|quota (?:reached|hit)|limit.*resets?/i;
+const RATE_LIMIT_RE = /rate.?limit|too many requests|429|(?:hit|reached) your (?:\w+ )?limit|(?:usage|session|weekly|daily|monthly|quota) limit|out of extra usage|quota (?:reached|hit)|limit.*resets?/i;
 // OpenRouter affordability-style quota errors should be treated as transient
 // so core retry logic can lower maxTokens and continue in-session.
 const AFFORDABILITY_RE = /requires more credits|can only afford|insufficient credits|not enough credits|fewer max_tokens/i;

package/src/resources/extensions/gsd/escalation.ts

@@ -159,13 +159,13 @@ export function readEscalationArtifact(path: string): EscalationArtifact | null
 // ─── Detection ────────────────────────────────────────────────────────────
 
 /**
- * Returns the task id of the first task with an un-resolved pause-escalation
- * (escalation_pending=1, not yet respondedAt). awaiting_review slices are NOT
- * returned — they don't pause the loop.
+ * Returns the task id of the first task with an unresolved escalation.
+ * `continueWithDefault=true` artifacts keep the awaiting_review flag for
+ * compatibility, but still pause dispatch until the user explicitly responds.
  */
 export function detectPendingEscalation(tasks: TaskRow[], basePath: string): string | null {
   for (const t of tasks) {
-    if (t.escalation_pending !== 1) continue;
+    if (t.escalation_pending !== 1 && t.escalation_awaiting_review !== 1) continue;
     if (!t.escalation_artifact_path) continue;
     const art = readEscalationArtifact(t.escalation_artifact_path);
     if (art && !art.respondedAt) return t.id;

package/src/resources/extensions/gsd/exec-sandbox.ts

@@ -20,6 +20,8 @@ export interface ExecSandboxRequest {
   script: string;
   /** Optional purpose/label recorded in meta.json. */
   purpose?: string;
+  /** Optional structured metadata recorded in meta.json. */
+  metadata?: Record<string, unknown>;
   /** Per-invocation timeout in ms. Clamped to `clamp_timeout_ms`. */
   timeout_ms?: number;
 }
@@ -315,6 +317,7 @@ function writeMeta(
     id: result.id,
     runtime: result.runtime,
     purpose: request.purpose ?? null,
+    ...(request.metadata ? { metadata: request.metadata } : {}),
     script_chars: request.script.length,
     started_at: now.toISOString(),
     finished_at: new Date(now.getTime() + result.duration_ms).toISOString(),
@@ -328,6 +331,7 @@ function writeMeta(
     stderr_truncated: result.stderr_truncated,
     stdout_path: result.stdout_path,
     stderr_path: result.stderr_path,
+    ...(request.metadata ? { metadata: request.metadata } : {}),
   };
   writeFileSync(path, `${JSON.stringify(meta, null, 2)}\n`);
 }

package/src/resources/extensions/gsd/forensics.ts

@@ -123,6 +123,91 @@ interface ForensicReport {
   worktreeTelemetry: WorktreeTelemetrySummary | null;
 }
 
+// ─── Filing Tool Scope ───────────────────────────────────────────────────────
+
+const FORENSICS_FILING_TOOLS = ["bash", "write"] as const;
+
+type ForensicsFilingTool = typeof FORENSICS_FILING_TOOLS[number];
+
+export interface ForensicsToolScope {
+  savedTools: string[];
+  activeToolsForTurn: string[];
+  availableFilingTools: ForensicsFilingTool[];
+  missingFilingTools: ForensicsFilingTool[];
+  toolsChanged: boolean;
+}
+
+function uniqueAppend(base: readonly string[], additions: readonly string[]): string[] {
+  const seen = new Set(base);
+  const next = [...base];
+  for (const name of additions) {
+    if (seen.has(name)) continue;
+    seen.add(name);
+    next.push(name);
+  }
+  return next;
+}
+
+function sameOrderedTools(a: readonly string[], b: readonly string[]): boolean {
+  return a.length === b.length && a.every((name, index) => name === b[index]);
+}
+
+function getRegisteredToolNames(
+  pi: Pick<ExtensionAPI, "getActiveTools"> & Partial<Pick<ExtensionAPI, "getAllTools">>,
+  fallback: readonly string[],
+): string[] {
+  if (typeof pi.getAllTools === "function") {
+    return pi.getAllTools().map((tool) => tool.name);
+  }
+  return [...fallback];
+}
+
+export function createForensicsToolScope(
+  pi: Pick<ExtensionAPI, "getActiveTools"> & Partial<Pick<ExtensionAPI, "getAllTools">>,
+): ForensicsToolScope {
+  const savedTools = [...pi.getActiveTools()];
+  const registeredTools = new Set([...getRegisteredToolNames(pi, savedTools), ...savedTools]);
+  const availableFilingTools = FORENSICS_FILING_TOOLS.filter((name) => registeredTools.has(name));
+  const missingFilingTools = FORENSICS_FILING_TOOLS.filter((name) => !registeredTools.has(name));
+  const activeToolsForTurn = uniqueAppend(savedTools, availableFilingTools);
+
+  return {
+    savedTools,
+    activeToolsForTurn,
+    availableFilingTools,
+    missingFilingTools,
+    toolsChanged: !sameOrderedTools(savedTools, activeToolsForTurn),
+  };
+}
+
+export function applyForensicsToolScope(pi: Pick<ExtensionAPI, "setActiveTools">, scope: ForensicsToolScope): void {
+  if (scope.toolsChanged) pi.setActiveTools(scope.activeToolsForTurn);
+}
+
+export function restoreForensicsToolScope(pi: Pick<ExtensionAPI, "setActiveTools">, scope: ForensicsToolScope): void {
+  if (scope.toolsChanged) pi.setActiveTools(scope.savedTools);
+}
+
+export function buildForensicsToolingSection(scope: ForensicsToolScope): string {
+  const available = new Set(scope.availableFilingTools);
+  const requested = scope.availableFilingTools.length
+    ? scope.availableFilingTools.map((name) => `\`${name}\``).join(", ")
+    : "none";
+  const statusFor = (name: ForensicsFilingTool) => available.has(name)
+    ? `- \`${name}\`: available for this queued forensics turn`
+    : `- \`${name}\`: unavailable in this host session`;
+
+  return `
+## Filing Tool Availability
+
+For this queued forensic turn, the extension requested the registered filing tools: ${requested}.
+
+${FORENSICS_FILING_TOOLS.map(statusFor).join("\n")}
+
+If \`bash\` is available, use the GitHub duplicate-check and issue-creation protocols below. If \`bash\` is unavailable, do not attempt duplicate-check or issue-creation tool calls with another tool; provide the paste-once shell script fallback instead.
+`;
+}
+
 // ─── Duplicate Detection ──────────────────────────────────────────────────────
 
 const DEDUP_PROMPT_SECTION = `
@@ -134,6 +219,8 @@ Before reading GSD source code or performing deep analysis, you MUST search for
 
 Use keywords from the user's problem description and the anomaly summaries in the forensic report above.
 
+If \`bash\` is unavailable in the Filing Tool Availability section, do not attempt live duplicate-search tool calls. Say the live duplicate search must be run by the user, continue the source investigation, and include the duplicate-search commands in the paste-once fallback when issue filing is accepted.
+
 1. **Search closed issues** for similar keywords:
    \`\`\`
    gh issue list --repo open-gsd/gsd-pi --state closed --search "<keywords from root cause>" --limit 20
@@ -265,21 +352,28 @@ export async function handleForensics(
   }
 
   const forensicData = formatReportForPrompt(report);
+  const toolScope = createForensicsToolScope(pi);
   const content = loadPrompt("forensics", {
     problemDescription,
     forensicData,
     gsdSourceDir,
     dedupSection,
+    toolingSection: buildForensicsToolingSection(toolScope),
   });
 
   ctx.ui.notify(`Forensic report saved: ${relative(basePath, savedPath)}`, "info");
   ctx.ui.setStatus("gsd-forensics", "running");
 
-  pi.sendMessage(
-    { customType: "gsd-forensics", content, display: false },
-    { triggerTurn: true },
-  );
-  ctx.ui.setStatus("gsd-forensics", undefined);
+  try {
+    applyForensicsToolScope(pi, toolScope);
+    await pi.sendMessage(
+      { customType: "gsd-forensics", content, display: false },
+      { triggerTurn: true },
+    );
+  } finally {
+    restoreForensicsToolScope(pi, toolScope);
+    ctx.ui.setStatus("gsd-forensics", undefined);
+  }
 
   // Persist forensics context so follow-up turns can re-inject it (#2941)
   writeForensicsMarker(basePath, savedPath, content);

package/src/resources/extensions/gsd/gsd-db.ts

@@ -55,6 +55,7 @@ import {
 import { rowToGate } from "./db-gate-rows.js";
 import { rowToArtifact, rowToMilestone, type ArtifactRow, type MilestoneRow } from "./db-milestone-artifact-rows.js";
 import { backupDatabaseBeforeMigration } from "./db-migration-backup.js";
+import { isClosedStatus } from "./status-guards.js";
 import {
   applyMigrationV2Artifacts,
   applyMigrationV3Memories,
@@ -1487,7 +1488,7 @@ export function setTaskEscalationPending(
   ).run({ ":path": artifactPath, ":mid": milestoneId, ":sid": sliceId, ":tid": taskId });
 }
 
-/** Set awaiting-review state (artifact exists but continueWithDefault=true, no pause). Mutually exclusive with pending. */
+/** Set awaiting-review state (artifact exists and requires explicit user review). Mutually exclusive with pending. */
 export function setTaskEscalationAwaitingReview(
   milestoneId: string, sliceId: string, taskId: string,
   artifactPath: string,
@@ -1665,16 +1666,50 @@ export function setMilestoneQueueOrder(order: string[]): void {
   }
 }
 
+function getMilestoneStatusForUpdate(milestoneId: string): string | null {
+  if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+  const row = currentDb.prepare("SELECT status FROM milestones WHERE id = :id").get({ ":id": milestoneId });
+  return typeof row?.["status"] === "string" ? row["status"] : null;
+}
+
+function writeMilestoneStatus(milestoneId: string, status: string, completedAt?: string | null): void {
+  if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+  currentDb.prepare(
+    `UPDATE milestones SET status = :status, completed_at = :completed_at WHERE id = :id`,
+  ).run({ ":status": status, ":completed_at": completedAt ?? null, ":id": milestoneId });
+}
+
 /**
  * Update a milestone's status in the database.
- * Used by park/unpark to keep the DB in sync with the filesystem marker.
- * See: https://github.com/open-gsd/gsd-pi/issues/2694
+ *
+ * Generic status updates may close milestones, park/unpark open milestones, or
+ * advance planned milestones. They may not reopen a closed milestone; callers
+ * must use reopenMilestoneStatus(), which is reserved for gsd_milestone_reopen.
  */
 export function updateMilestoneStatus(milestoneId: string, status: string, completedAt?: string | null): void {
   if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
-  currentDb.prepare(
-    `UPDATE milestones SET status = :status, completed_at = :completed_at WHERE id = :id`,
-  ).run({ ":status": status, ":completed_at": completedAt ?? null, ":id": milestoneId });
+  const currentStatus = getMilestoneStatusForUpdate(milestoneId);
+  if (currentStatus && isClosedStatus(currentStatus) && !isClosedStatus(status)) {
+    throw new Error(
+      `Cannot update closed milestone ${milestoneId} from ${currentStatus} to ${status}; use gsd_milestone_reopen for an explicit reopen.`,
+    );
+  }
+  writeMilestoneStatus(milestoneId, status, completedAt);
+}
+
+/**
+ * Explicit closed -> active transition for gsd_milestone_reopen only.
+ */
+export function reopenMilestoneStatus(milestoneId: string): void {
+  if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+  const currentStatus = getMilestoneStatusForUpdate(milestoneId);
+  if (!currentStatus) {
+    throw new Error(`Cannot reopen missing milestone ${milestoneId}`);
+  }
+  if (!isClosedStatus(currentStatus)) {
+    throw new Error(`Cannot reopen milestone ${milestoneId} from status ${currentStatus}; milestone is not closed.`);
+  }
+  writeMilestoneStatus(milestoneId, "active", null);
 }
 
 export function getActiveMilestoneFromDb(): MilestoneRow | null {
@@ -2708,7 +2743,7 @@ export function deleteArtifactByPath(path: string): void {
 
 /**
  * Drop hierarchy rows in dependency order inside a transaction. Used by
- * `gsd recover` to rebuild engine state from markdown.
+ * `gsd recover --confirm` to rebuild engine state from markdown.
  */
 export function clearEngineHierarchy(): void {
   if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
@@ -3198,7 +3233,10 @@ export function decayMemoriesBefore(cutoffTs: string, now: string): void {
   currentDb.prepare(
     `UPDATE memories
      SET confidence = MAX(0.1, confidence - 0.1), updated_at = :now
-     WHERE superseded_by IS NULL AND updated_at < :cutoff AND confidence > 0.1`,
+     WHERE superseded_by IS NULL
+       AND updated_at < :cutoff
+       AND confidence > 0.1
+       AND (structured_fields IS NULL OR structured_fields NOT LIKE '%"sourceDecisionId"%')`,
   ).run({ ":now": now, ":cutoff": cutoffTs });
 }