@opengsd/gsd-pi 1.1.1-dev.9bb7453 → 1.1.1-dev.9f86580

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -26,6 +26,7 @@ import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { runWorktreePostCreateHook } from "./worktree-post-create-hook.js";
 import { classifyProject } from "./detection.js";
 import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeConflictFiles, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeMergeAbort, nativeWorktreeList, nativeLsFiles, } from "./native-git-bridge.js";
+import { CLOSEOUT_CONSISTENCY_BLOCKED_REASON, checkCloseoutConsistencyGate, formatCloseoutConsistencyBlock, } from "./closeout-consistency-gate.js";
 import { gsdHome } from "./gsd-home.js";
 import { createWorkspace } from "./workspace.js";
 import { _finalizeProjectionForMergeImpl, _projectRootToWorktreeImpl, _projectWorktreeToRootImpl, } from "./worktree-state-projection.js";
@@ -1513,17 +1514,29 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     // symlink layout) — ATTACHing a WAL-mode file to itself corrupts the
     // database (#2823).
     if (isDbAvailable()) {
+        const contract = resolveGsdPathContract(worktreeCwd, originalBasePath_);
+        const worktreeDbPath = join(contract.worktreeGsd ?? join(worktreeCwd, ".gsd"), "gsd.db");
+        const mainDbPath = contract.projectDb;
         try {
-            const contract = resolveGsdPathContract(worktreeCwd, originalBasePath_);
-            const worktreeDbPath = join(contract.worktreeGsd ?? join(worktreeCwd, ".gsd"), "gsd.db");
-            const mainDbPath = contract.projectDb;
+            const activeDbPath = getDbPath();
+            if (activeDbPath && _shouldReconcileWorktreeDb(activeDbPath, mainDbPath)) {
+                closeDatabase();
+                if (!openDatabase(mainDbPath)) {
+                    throw new Error(`cannot open project DB at ${mainDbPath}`);
+                }
+            }
             if (_shouldReconcileWorktreeDb(worktreeDbPath, mainDbPath)) {
                 reconcileWorktreeDb(mainDbPath, worktreeDbPath);
             }
         }
         catch (err) {
-            /* non-fatal */
-            logError("worktree", `DB reconciliation failed: ${err instanceof Error ? err.message : String(err)}`);
+            const message = `DB reconciliation failed before milestone ${milestoneId} merge: ${err instanceof Error ? err.message : String(err)}`;
+            logError("worktree", message);
+            throw new GSDError(GSD_GIT_ERROR, `${message}. Recovery reason: ${CLOSEOUT_CONSISTENCY_BLOCKED_REASON}.`);
+        }
+        const closeoutGate = checkCloseoutConsistencyGate(milestoneId);
+        if (!closeoutGate.ok) {
+            throw new GSDError(GSD_GIT_ERROR, formatCloseoutConsistencyBlock(closeoutGate));
         }
     }
     // 2. Get completed slices for commit message

package/dist/resources/extensions/gsd/auto.js

@@ -30,7 +30,7 @@ import { playNotificationBell, sendDesktopNotification } from "./notifications.j
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, resolveCompactionThresholdPercent, shouldRerootStepSessionForContext, } from "./auto-budget.js";
 import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, isDeterministicPolicyError, } from "./auto-tool-tracking.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
-import { selectAndApplyModel, resolveModelId, clearToolBaseline } from "./auto-model-selection.js";
+import { selectAndApplyModel, resolveModelId, clearToolBaseline, getToolBaselineSnapshot } from "./auto-model-selection.js";
 import { resetRoutingHistory, recordOutcome } from "./routing-history.js";
 import { resetHookState, runPreDispatchHooks, restoreHookState, clearPersistedHookState, } from "./post-unit-hooks.js";
 import { runGSDDoctor, rebuildState } from "./doctor.js";
@@ -287,8 +287,24 @@ export function _synthesizePausedSessionRecoveryForTest(basePath, unitType, unit
 function handlePausedSessionResumeRecovery(basePath, state, notify) {
     if (!state.pausedSessionFile)
         return { skippedReplay: false };
-    const pausedRecoveryUnitType = state.currentUnit?.type ?? state.pausedUnitType ?? "unknown";
-    const pausedRecoveryUnitId = state.currentUnit?.id ?? state.pausedUnitId ?? "unknown";
+    const pausedRecoveryUnitType = state.currentUnit?.type ?? state.pausedUnitType ?? null;
+    const pausedRecoveryUnitId = state.currentUnit?.id ?? state.pausedUnitId ?? null;
+    // When the paused-session metadata never captured the unit identity (the
+    // pause happened between units, or the worker died before currentUnit was
+    // set), we have nothing to verify against and nothing correct to target. A
+    // replay synthesized with an "unknown" unit re-injects an unbounded,
+    // mis-identified tool-call blob into the fresh resume context — exactly the
+    // thrash that turns one stuck unit into several. Disk state has already been
+    // rebuilt (rebuildState + doctor) before this runs, so skip the replay and
+    // let the normal dispatcher recompute the next unit from disk.
+    if (!pausedRecoveryUnitType || !pausedRecoveryUnitId) {
+        state.pausedSessionFile = null;
+        state.pausedUnitType = null;
+        state.pausedUnitId = null;
+        state.pendingCrashRecovery = null;
+        notify("Paused session had no recorded unit identity. Skipping tool-call replay and resuming from disk state.");
+        return { skippedReplay: true };
+    }
     const completedPausedUnit = verifyExpectedArtifact(pausedRecoveryUnitType, pausedRecoveryUnitId, basePath);
     if (completedPausedUnit) {
         state.pausedSessionFile = null;
@@ -1637,7 +1653,10 @@ export function createWiredDispatchAdapter(ctx, pi, dispatchBasePath, session) {
             const authMode = sessionProvider && typeof ctx.modelRegistry?.getProviderAuthMode === "function"
                 ? ctx.modelRegistry.getProviderAuthMode(sessionProvider)
                 : undefined;
-            const activeTools = typeof pi.getActiveTools === "function" ? pi.getActiveTools() : [];
+            // Use baseline snapshot — same reason as phases.ts:runDispatch: the live
+            // active set may be narrowed by the prior unit before selectAndApplyModel
+            // restores it, causing false transport-preflight failures (#477 follow-up).
+            const activeTools = getToolBaselineSnapshot(pi);
             // Mirrors runDispatch: deep-planning keeps approval gates in plain chat
             // because structured questions can be cancelled outside the chat turn on
             // some transports.
@@ -1678,6 +1697,9 @@ export function createWiredDispatchAdapter(ctx, pi, dispatchBasePath, session) {
                 sessionContextWindow,
                 sessionProvider,
                 modelRegistry,
+                activeTools,
+                sessionAuthMode: authMode,
+                sessionBaseUrl: ctx.model?.baseUrl,
             });
             if (action.action === "stop") {
                 if (session)

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -65,6 +65,9 @@ function readDetails(result) {
 }
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- result shape varies by tool
 function formatToolErrorText(result, details) {
+    if (typeof details?.displayReason === "string" && details.displayReason) {
+        return details.displayReason;
+    }
     const message = details?.error
         ?? result?.content?.find((entry) => entry.type === "text")?.text
         ?? "unknown";
@@ -405,6 +408,9 @@ export function registerDbTools(pi) {
         kind: StringEnum(["gsd_uat_exec", "gsd_exec", "screenshot", "log", "url", "browser"], { description: "Evidence kind" }),
         ref: Type.String({ description: "Evidence ID, approved .gsd path, or URL" }),
         note: Type.Optional(Type.String({ description: "Short evidence note" })),
+        unitType: Type.Optional(Type.String({ description: "Unit that produced the evidence" })),
+        tool: Type.Optional(Type.String({ description: "Tool that produced the evidence" })),
+        executionId: Type.Optional(Type.String({ description: "Stable execution or artifact id" })),
     });
     const uatCheck = Type.Object({
         id: Type.String({ description: "Stable check ID from the UAT spec" }),
@@ -416,17 +422,17 @@ export function registerDbTools(pi) {
         nonAutomatable: Type.Optional(Type.Boolean({ description: "True when the check is explicitly non-automatable" })),
     });
     const toolPresentationBlock = Type.Object({
-        surface: StringEnum(["provider-tools", "claude-code-sdk", "mcp", "hybrid"], { description: "Tool presentation surface" }),
+        surface: Type.Optional(StringEnum(["provider-tools", "claude-code-sdk", "mcp", "hybrid"], { description: "Tool presentation surface" })),
         model: Type.Optional(Type.Object({
             provider: Type.Optional(Type.String()),
             api: Type.Optional(Type.String()),
             id: Type.Optional(Type.String()),
         })),
-        presentedTools: Type.Array(Type.String(), { description: "Tool names actually presented to the model" }),
-        blockedTools: Type.Array(Type.Object({
+        presentedTools: Type.Optional(Type.Array(Type.String(), { description: "Tool names actually presented to the model" })),
+        blockedTools: Type.Optional(Type.Array(Type.Object({
             name: Type.String(),
             reason: Type.String(),
-        }), { description: "Tool names blocked from the model with reasons" }),
+        }), { description: "Tool names blocked from the model with reasons" })),
         aliases: Type.Optional(Type.Array(Type.Object({
             requested: Type.String(),
             canonical: Type.String(),
@@ -448,12 +454,12 @@ export function registerDbTools(pi) {
             "Do not use raw gsd_summary_save as a substitute for UAT results.",
         ],
         parameters: Type.Object({
-            milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
-            sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
-            uatType: StringEnum(["artifact-driven", "browser-executable", "runtime-executable", "live-runtime", "mixed", "human-experience"], { description: "Declared UAT mode" }),
-            verdict: StringEnum(["PASS", "FAIL", "PARTIAL"], { description: "Overall UAT verdict" }),
-            checks: Type.Array(uatCheck, { description: "Structured check results" }),
-            presentation: toolPresentationBlock,
+            milestoneId: Type.Optional(Type.String({ description: "Milestone ID (e.g. M001)" })),
+            sliceId: Type.Optional(Type.String({ description: "Slice ID (e.g. S01)" })),
+            uatType: Type.Optional(Type.String({ description: "Declared UAT mode" })),
+            verdict: Type.Optional(Type.String({ description: "Overall UAT verdict: PASS, FAIL, or PARTIAL" })),
+            checks: Type.Optional(Type.Array(uatCheck, { description: "Structured check results" })),
+            presentation: Type.Optional(toolPresentationBlock),
             notes: Type.Optional(Type.String({ description: "Overall verdict rationale" })),
             attempt: Type.Optional(Type.String({ description: "Attempt number or auto" })),
             previousAttemptId: Type.Optional(Type.String({ description: "Prior attempt ID, when retrying" })),

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -30,7 +30,7 @@ import { getGuidedUnitContext } from "../guided-unit-context.js";
 import { registerPlanMilestoneSchemaRecovery } from "./plan-milestone-schema-recovery.js";
 import { AUTO_UNIT_SCOPED_TOOLS, RUN_UAT_BROWSER_TOOL_NAMES, isWorkflowAliasTool } from "../auto-unit-tool-scope.js";
 import { filterToolsForProvider } from "../model-router.js";
-import { RUN_UAT_WORKFLOW_TOOL_NAMES } from "../tool-presentation-plan.js";
+import { RUN_UAT_READ_ONLY_TOOL_NAMES, RUN_UAT_WORKFLOW_TOOL_NAMES } from "../tool-presentation-plan.js";
 let approvalQuestionAbortInFlight = false;
 async function loadWelcomeScreenModule() {
     const candidates = [];
@@ -204,8 +204,18 @@ export function buildMinimalAutoGsdToolSet(activeToolNames, unitType, registered
     return withPreservedShimTools([...new Set([...preserved, ...scoped])]);
 }
 export function buildRunUatGsdToolSet(activeToolNames, registeredToolNames = activeToolNames) {
-    const scoped = resolveScopedToolNames([...activeToolNames, ...registeredToolNames], [...RUN_UAT_WORKFLOW_TOOL_NAMES, "subagent", ...RUN_UAT_BROWSER_TOOL_NAMES]);
-    return [...new Set(scoped)];
+    const scoped = resolveScopedToolNames([...activeToolNames, ...registeredToolNames], [
+        ...RUN_UAT_WORKFLOW_TOOL_NAMES,
+        ...RUN_UAT_READ_ONLY_TOOL_NAMES,
+        "subagent",
+        ...RUN_UAT_BROWSER_TOOL_NAMES,
+    ]);
+    const resolved = [...new Set(scoped)];
+    const unresolved = RUN_UAT_WORKFLOW_TOOL_NAMES.filter((tool) => !resolved.some((name) => name === tool || (name.startsWith("mcp__") && name.endsWith(`__${tool}`))));
+    if (unresolved.length > 0) {
+        safetyLogWarning("bootstrap", `buildRunUatGsdToolSet: required run-uat workflow tool(s) not found in active/registered surface: ${unresolved.join(", ")}. Session may lack gsd-workflow MCP connection.`);
+    }
+    return resolved;
 }
 export function buildMinimalGsdWorkflowToolSet(activeToolNames, registeredToolNames = activeToolNames) {
     const autoBaseTools = new Set(MINIMAL_AUTO_BASE_TOOL_NAMES);
@@ -382,6 +392,11 @@ function isContextDraftSummarySave(toolName, input) {
         return false;
     return input.artifact_type === "CONTEXT-DRAFT";
 }
+function withDepthGateDisplayReason(result, displayReason = "Depth confirmation is waiting for your answer.") {
+    if (!result.block)
+        return result;
+    return { ...result, displayReason };
+}
 function shouldBlockDeferredApprovalTool(toolName, input, basePath) {
     if (deferredApprovalGate?.basePath !== basePath)
         return { block: false };
@@ -389,14 +404,14 @@ function shouldBlockDeferredApprovalTool(toolName, input, basePath) {
         return { block: false };
     if (isContextDraftSummarySave(toolName, input))
         return { block: false };
-    return {
+    return withDepthGateDisplayReason({
         block: true,
         reason: [
             `HARD BLOCK: Approval question "${deferredApprovalGate.gateId}" has been shown to the user.`,
             `Only CONTEXT-DRAFT persistence may finish in this same assistant turn.`,
             `Wait for the user's answer before calling additional tools.`,
         ].join(" "),
-    };
+    });
 }
 export function resolveNotificationStoreBasePath(basePath) {
     return resolveWorktreeProjectRoot(basePath);
@@ -453,6 +468,18 @@ export function registerHooks(pi, ecosystemHandlers) {
         if (isAutoActive() || preserveCloseoutSurface) {
             ctx.ui.setWidget("gsd-health", undefined);
         }
+        // Cold start after /quit relaunches with cwd at the project root. When
+        // auto-mode is neither active nor paused (its own resume path re-enters the
+        // worktree with a lease check — auto.ts:3032), proactively chdir back into
+        // the active milestone's worktree so subsequent work isn't stranded at the
+        // root. Best-effort and a no-op when already inside a worktree.
+        if (!isAutoActive() && !isAutoPaused() && !preserveCloseoutSurface) {
+            try {
+                const { reenterActiveWorktreeIfNeeded } = await import("../worktree-reentry.js");
+                await reenterActiveWorktreeIfNeeded(basePath);
+            }
+            catch { /* non-fatal */ }
+        }
     });
     pi.on("session_switch", async (_event, ctx) => {
         const basePath = contextBasePath(ctx);
@@ -754,7 +781,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                     if (ctx) {
                         await maybePauseAutoForApprovalGate(ctx, pi, true, "Depth confirmation is waiting for your answer — pausing auto-mode.");
                     }
-                    return bashGuard;
+                    return withDepthGateDisplayReason(bashGuard);
                 }
             }
             else {
@@ -763,7 +790,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                     if (ctx) {
                         await maybePauseAutoForApprovalGate(ctx, pi, true, "Depth confirmation is waiting for your answer — pausing auto-mode.");
                     }
-                    return gateGuard;
+                    return withDepthGateDisplayReason(gateGuard);
                 }
             }
         }
@@ -847,8 +874,9 @@ export function registerHooks(pi, ecosystemHandlers) {
         if (!isToolCallEventType("write", event))
             return;
         const result = shouldBlockContextWrite(event.toolName, event.input.path, await getDiscussionMilestoneIdFor(discussionBasePath), isQueuePhaseActive(discussionBasePath), discussionBasePath);
-        if (result.block)
-            return result;
+        if (result.block) {
+            return withDepthGateDisplayReason(result, "Depth check required before writing milestone context.");
+        }
     });
     // ── Safety harness: evidence collection + destructive command blocking ──
     pi.on("tool_call", async (event, ctx) => {
@@ -1073,16 +1101,19 @@ export function registerHooks(pi, ecosystemHandlers) {
         if (isAutoActive()) {
             try {
                 const { loadEffectiveGSDPreferences } = await import("../preferences.js");
+                const { createObservationMask, createResponsesInputObservationMask, truncateContextResultMessages, truncateResponsesInputResultItems, } = await import("../context-masker.js");
                 const prefs = loadEffectiveGSDPreferences();
                 const cmConfig = prefs?.preferences.context_management;
                 // Observation masking: replace old tool results with placeholders
                 if (cmConfig?.observation_masking !== false) {
                     const keepTurns = cmConfig?.observation_mask_turns ?? 8;
-                    const { createObservationMask } = await import("../context-masker.js");
-                    const mask = createObservationMask(keepTurns);
                     const messages = payload.messages;
                     if (Array.isArray(messages)) {
-                        payload.messages = mask(messages);
+                        payload.messages = createObservationMask(keepTurns)(messages);
+                    }
+                    const input = payload.input;
+                    if (Array.isArray(input)) {
+                        payload.input = createResponsesInputObservationMask(keepTurns)(input);
                     }
                 }
                 // Tool result truncation: cap individual tool result content length.
@@ -1091,23 +1122,11 @@ export function registerHooks(pi, ecosystemHandlers) {
                 const maxChars = cmConfig?.tool_result_max_chars ?? 800;
                 const msgs = payload.messages;
                 if (Array.isArray(msgs)) {
-                    payload.messages = msgs.map((msg) => {
-                        // Match toolResult messages (role: "toolResult", content is array of content blocks)
-                        if (msg?.role === "toolResult" && Array.isArray(msg.content)) {
-                            const blocks = msg.content;
-                            const totalLen = blocks.reduce((sum, b) => sum + (typeof b.text === "string" ? b.text.length : 0), 0);
-                            if (totalLen > maxChars) {
-                                const truncated = blocks.map(b => {
-                                    if (typeof b.text === "string" && b.text.length > maxChars) {
-                                        return { ...b, text: b.text.slice(0, maxChars) + "\n…[truncated]" };
-                                    }
-                                    return b;
-                                });
-                                return { ...msg, content: truncated };
-                            }
-                        }
-                        return msg;
-                    });
+                    payload.messages = truncateContextResultMessages(msgs, maxChars);
+                }
+                const input = payload.input;
+                if (Array.isArray(input)) {
+                    payload.input = truncateResponsesInputResultItems(input, maxChars);
                 }
             }
             catch { /* non-fatal */ }

package/dist/resources/extensions/gsd/bootstrap/system-context.js

@@ -56,7 +56,7 @@ export const BUNDLED_SKILL_TRIGGERS = [
     { trigger: "Core Web Vitals — fix LCP, CLS, INP; layout shifts; page experience optimization", skill: "core-web-vitals" },
     { trigger: "GitHub Actions CI/CD — write, run, and debug workflow files; live syntax and run monitoring", skill: "github-workflows" },
     { trigger: "Comprehensive web quality audit — performance, accessibility, SEO, and best-practices (Lighthouse-style)", skill: "web-quality-audit" },
-    { trigger: "gsd-browser UAT — default browser MCP/CLI for real UI verification, screenshots, assertions, console/network diagnostics", skill: "gsd-browser" },
+    { trigger: "gsd-browser opt-in and External MCP UAT — screenshots, assertions, console/network diagnostics", skill: "gsd-browser" },
     { trigger: "Browser automation — open sites, fill forms, click, screenshot, scrape, or test web apps programmatically", skill: "agent-browser" },
     { trigger: "Review UI code for Web Interface Guidelines compliance — UX, design, and accessibility patterns", skill: "web-design-guidelines" },
     { trigger: "UI/UX patterns reference — animations, CSS, typography, prefetching, icons (file:line findings)", skill: "userinterface-wiki" },

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -2,7 +2,7 @@
 import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { minimatch } from "minimatch";
-import { shouldBlockAutoUnitToolCall } from "../auto-unit-tool-scope.js";
+import { GSD_PHASE_SCOPE_DISPLAY_REASON, shouldBlockAutoUnitToolCall } from "../auto-unit-tool-scope.js";
 import { getIsolationMode } from "../preferences.js";
 import { compileSubagentPermissionContract } from "../unit-context-manifest.js";
 import { logWarning } from "../workflow-logger.js";
@@ -643,6 +643,13 @@ function blockReason(unitType, mode, what) {
         `the work belongs in execute-task, not in a planning unit.`,
     ].join(" ");
 }
+function planningBlock(unitType, mode, what) {
+    return {
+        block: true,
+        reason: blockReason(unitType, mode, what),
+        displayReason: GSD_PHASE_SCOPE_DISPLAY_REASON,
+    };
+}
 /**
  * Planning-unit tool-policy enforcement. Returns { block } per the policy
  * resolved from the active unit's manifest:
@@ -690,10 +697,10 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
         if (tool.startsWith("gsd_"))
             return { block: false };
         if (PLANNING_WRITE_TOOLS.has(tool) || tool === "bash" || PLANNING_SUBAGENT_TOOLS.has(tool)) {
-            return { block: true, reason: blockReason(unitType, policy.mode, `${tool} is not permitted (read-only)`) };
+            return planningBlock(unitType, policy.mode, `${tool} is not permitted (read-only)`);
         }
         // Unknown tool in read-only mode — block by default.
-        return { block: true, reason: blockReason(unitType, policy.mode, `tool "${tool}" is not on the read-only allowlist`) };
+        return planningBlock(unitType, policy.mode, `tool "${tool}" is not on the read-only allowlist`);
     }
     // planning / planning-dispatch / docs / verification modes share the same surface for safe tools, bash, and subagent.
     if (PLANNING_SAFE_TOOLS.has(tool))
@@ -711,10 +718,7 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
             // instead of silently bypassing the gate.
             if (agentClasses === undefined) {
                 warnMissingControlledDispatchAgentClasses(unitType, policy.mode, tool);
-                return {
-                    block: true,
-                    reason: blockReason(unitType, policy.mode, `subagent dispatch blocked: stale caller did not supply agent identities for "${tool}"; update extractSubagentAgentClasses to handle this input shape`),
-                };
+                return planningBlock(unitType, policy.mode, `subagent dispatch blocked: stale caller did not supply agent identities for "${tool}"; update extractSubagentAgentClasses to handle this input shape`);
             }
             // agentClasses was explicitly provided but resolved to an empty list (for
             // example, a bare tool call with no agent field). Pass through; no agents
@@ -724,41 +728,29 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
             }
             const globallyDisallowed = requested.find(a => !isReadOnlySpecialist(a));
             if (globallyDisallowed) {
-                return {
-                    block: true,
-                    reason: blockReason(unitType, policy.mode, `subagent dispatch of "${globallyDisallowed}" not permitted; only read-only specialists (${allowedPlanningDispatchAgentsList()}) may be dispatched from ${policy.mode} units`),
-                };
+                return planningBlock(unitType, policy.mode, `subagent dispatch of "${globallyDisallowed}" not permitted; only read-only specialists (${allowedPlanningDispatchAgentsList()}) may be dispatched from ${policy.mode} units`);
             }
             const disallowedByPolicy = requested.find(a => !allowed.has(a));
             if (disallowedByPolicy) {
-                return {
-                    block: true,
-                    reason: blockReason(unitType, policy.mode, `subagent dispatch of "${disallowedByPolicy}" not permitted by ToolsPolicy.allowedSubagents; permitted agents for this unit: ${allowedSubagents.join(", ")}`),
-                };
+                return planningBlock(unitType, policy.mode, `subagent dispatch of "${disallowedByPolicy}" not permitted by ToolsPolicy.allowedSubagents; permitted agents for this unit: ${allowedSubagents.join(", ")}`);
             }
             return { block: false };
         }
-        return { block: true, reason: blockReason(unitType, policy.mode, `subagent dispatch is not permitted in planning units`) };
+        return planningBlock(unitType, policy.mode, "subagent dispatch is not permitted in planning units");
     }
     if (tool === "bash") {
         if (policy.mode === "verification") {
             if (BASH_VERIFICATION_RE.test(pathOrCommand) || BASH_READ_ONLY_RE.test(pathOrCommand))
                 return { block: false };
-            return {
-                block: true,
-                reason: blockReason(unitType, policy.mode, `bash is restricted to build/test verification commands (npm run build, npm test, etc.); cannot run "${pathOrCommand.slice(0, 80)}${pathOrCommand.length > 80 ? "…" : ""}"`),
-            };
+            return planningBlock(unitType, policy.mode, `bash is restricted to build/test verification commands (npm run build, npm test, etc.); cannot run "${pathOrCommand.slice(0, 80)}${pathOrCommand.length > 80 ? "…" : ""}"`);
         }
         if (BASH_READ_ONLY_RE.test(pathOrCommand))
             return { block: false };
-        return {
-            block: true,
-            reason: blockReason(unitType, policy.mode, `bash is restricted to read-only commands (cat/grep/git log/etc); cannot run "${pathOrCommand.slice(0, 80)}${pathOrCommand.length > 80 ? "…" : ""}"`),
-        };
+        return planningBlock(unitType, policy.mode, `bash is restricted to read-only commands (cat/grep/git log/etc); cannot run "${pathOrCommand.slice(0, 80)}${pathOrCommand.length > 80 ? "…" : ""}"`);
     }
     if (PLANNING_WRITE_TOOLS.has(tool)) {
         if (!pathOrCommand) {
-            return { block: true, reason: blockReason(unitType, policy.mode, `${tool} called with empty path`) };
+            return planningBlock(unitType, policy.mode, `${tool} called with empty path`);
         }
         const absPath = isAbsolute(pathOrCommand) ? pathOrCommand : resolve(basePath, pathOrCommand);
         // Always allow .gsd/ writes — that's where planning artifacts live.
@@ -768,10 +760,7 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
         if (policy.mode === "docs" && matchesAllowedGlob(absPath, basePath, policy.allowedPathGlobs)) {
             return { block: false };
         }
-        return {
-            block: true,
-            reason: blockReason(unitType, policy.mode, `cannot ${tool} "${pathOrCommand}" — writes are restricted to .gsd/${policy.mode === "docs" ? " and " + policy.allowedPathGlobs.join(", ") : ""}`),
-        };
+        return planningBlock(unitType, policy.mode, `cannot ${tool} "${pathOrCommand}" — writes are restricted to .gsd/${policy.mode === "docs" ? " and " + policy.allowedPathGlobs.join(", ") : ""}`);
     }
     // Unknown tool name — pass through. Other layers (queue, pending-gate,
     // CONTEXT.md write) catch known mutating shapes; defaulting to allow here

package/dist/resources/extensions/gsd/closeout-consistency-gate.js

@@ -0,0 +1,61 @@
+// Project/App: gsd-pi
+// File Purpose: Shared DB-backed guard for milestone closeout finalization.
+import { getDbPath, getLatestAssessmentByScope, getMilestone, getMilestoneSlices, getPendingGates, getSliceTasks, isDbAvailable, refreshOpenDatabaseFromDisk, } from "./gsd-db.js";
+import { isClosedStatus } from "./status-guards.js";
+export const CLOSEOUT_CONSISTENCY_BLOCKED_REASON = "closeout-consistency-blocked";
+function blocked(reason, message) {
+    return {
+        ok: false,
+        reason,
+        recoveryReason: CLOSEOUT_CONSISTENCY_BLOCKED_REASON,
+        message,
+    };
+}
+function isFileBackedDbPath(path) {
+    return Boolean(path && path !== ":memory:");
+}
+export function checkCloseoutConsistencyGate(milestoneId, options = {}) {
+    if (!isDbAvailable()) {
+        return blocked("db-unavailable", `Closeout consistency blocked for ${milestoneId}: canonical DB is unavailable.`);
+    }
+    if (options.refreshFromDisk && isFileBackedDbPath(getDbPath()) && !refreshOpenDatabaseFromDisk()) {
+        return blocked("db-refresh-failed", `Closeout consistency blocked for ${milestoneId}: canonical DB refresh failed.`);
+    }
+    const milestone = getMilestone(milestoneId);
+    if (!milestone) {
+        return blocked("milestone-missing", `Closeout consistency blocked for ${milestoneId}: milestone is missing from canonical DB.`);
+    }
+    if (!isClosedStatus(milestone.status)) {
+        return blocked("milestone-open", `Closeout consistency blocked for ${milestoneId}: canonical DB milestone status is "${milestone.status}".`);
+    }
+    if (milestone.status !== "skipped") {
+        const validation = getLatestAssessmentByScope(milestoneId, "milestone-validation");
+        if (validation?.status !== "pass") {
+            return blocked("validation-not-pass", `Closeout consistency blocked for ${milestoneId}: latest milestone validation is "${validation?.status ?? "absent"}".`);
+        }
+    }
+    const slices = getMilestoneSlices(milestoneId);
+    if (slices.length === 0 && milestone.status !== "skipped") {
+        return blocked("slice-missing", `Closeout consistency blocked for ${milestoneId}: no slices exist in canonical DB.`);
+    }
+    for (const slice of slices) {
+        if (!isClosedStatus(slice.status)) {
+            return blocked("slice-open", `Closeout consistency blocked for ${milestoneId}: slice ${slice.id} status is "${slice.status}".`);
+        }
+        for (const task of getSliceTasks(milestoneId, slice.id)) {
+            if (!isClosedStatus(task.status)) {
+                return blocked("task-open", `Closeout consistency blocked for ${milestoneId}: task ${slice.id}/${task.id} status is "${task.status}".`);
+            }
+        }
+        const pendingGate = getPendingGates(milestoneId, slice.id)[0];
+        if (pendingGate) {
+            return blocked("quality-gate-pending", `Closeout consistency blocked for ${milestoneId}: quality gate ${pendingGate.gate_id} is still pending for ${slice.id}.`);
+        }
+    }
+    return { ok: true };
+}
+export function formatCloseoutConsistencyBlock(result) {
+    if (result.ok)
+        return "";
+    return `${result.message} Recovery reason: ${result.recoveryReason}. Resolve the canonical DB state and run /gsd auto to retry.`;
+}

package/dist/resources/extensions/gsd/commands/handlers/auto.js

@@ -198,6 +198,16 @@ export async function handleAutoCommand(trimmed, ctx, pi) {
         if (!(await guardRemoteSession(ctx, pi)))
             return true;
         const basePath = projectRoot();
+        // Cold start after /quit lands at the project root, not the worktree. If the
+        // active milestone has a live worktree, chdir back into it now so the agent
+        // doesn't have to search for it. Best-effort; resolves to a no-op otherwise.
+        try {
+            const { reenterActiveWorktreeIfNeeded } = await import("../../worktree-reentry.js");
+            await reenterActiveWorktreeIfNeeded(basePath, {
+                notify: (message) => ctx.ui.notify(message, "info"),
+            });
+        }
+        catch { /* non-fatal */ }
         const { hasGsdBootstrapArtifacts } = await import("../../detection.js");
         const { gsdRoot } = await import("../../paths.js");
         if (!hasGsdBootstrapArtifacts(gsdRoot(basePath))) {

package/dist/resources/extensions/gsd/commands-mcp-status.js

@@ -34,7 +34,7 @@ export function formatMcpInitResult(status, configPath, targetPath) {
         `Config:   ${configPath}`,
         "",
         "MCP-capable clients can now load the GSD workflow and gsd-browser MCP servers from this folder.",
-        "Pi Providers use the managed gsd-browser engine directly; this project config is for External MCP Clients.",
+        "Pi Providers use built-in browser tools directly; this project config is for External MCP Clients.",
         "Restart or reconnect any client that already has this project open.",
     ].join("\n");
 }

package/dist/resources/extensions/gsd/config-overlay.js

@@ -122,6 +122,7 @@ function collectConfigSections() {
             supRows.push({ label: "Model", value: sup.model });
         supRows.push({ label: "Soft timeout", value: `${sup.soft_timeout_minutes}m` });
         supRows.push({ label: "Idle timeout", value: `${sup.idle_timeout_minutes}m` });
+        supRows.push({ label: "Stalled tool timeout", value: `${sup.stalled_tool_timeout_minutes}m` });
         supRows.push({ label: "Hard timeout", value: `${sup.hard_timeout_minutes}m` });
         sections.push({ title: "Auto Supervisor", rows: supRows });
     }