@opengsd/gsd-pi 1.2.0-dev.0b870afa → 1.2.0-dev.23d85b63

package/src/resources/extensions/gsd/auto.ts

@@ -80,6 +80,8 @@ import type { SessionLockStatus } from "./session-lock.js";
 import {
   resolveAutoSupervisorConfig,
   loadEffectiveGSDPreferences,
+  loadEffectiveGSDPreferencesWithRegistry,
+  resolveProfileAnchorProvider,
   getIsolationMode,
   resolveEffectiveUnitIsolationMode,
 } from "./preferences.js";
@@ -851,7 +853,7 @@ export function _warnIfWorktreeMissingForTest(
   if (worktreePath && !existsSync(worktreePath)) {
     logWarning(
       "session",
-      `Worktree was expected at ${worktreePath} but is missing. Continuing in project-root mode. To restart with a fresh worktree, run /gsd-debug or recreate the milestone.`,
+      `Worktree was expected at ${worktreePath} but is missing. Resuming from project root; /gsd next will recreate the worktree when isolation is enabled.`,
       { file: "auto.ts", milestoneId },
     );
     return true;
@@ -859,6 +861,35 @@ export function _warnIfWorktreeMissingForTest(
   return false;
 }
 
+export function anchorProcessCwdForAutoResume(
+  basePath: string,
+  fallbackPaths: string[] = [],
+): boolean {
+  const candidates = [basePath, ...fallbackPaths].filter(
+    (candidate, index, all) =>
+      Boolean(candidate) && all.indexOf(candidate) === index,
+  );
+  for (const candidate of candidates) {
+    if (!existsSync(candidate)) continue;
+    try {
+      process.chdir(candidate);
+      return true;
+    } catch (err) {
+      logWarning(
+        "session",
+        `resume cwd anchor failed for ${candidate}: ${err instanceof Error ? err.message : String(err)}`,
+        { file: "auto.ts", basePath: candidate },
+      );
+    }
+  }
+  logWarning(
+    "session",
+    `resume cwd anchor failed: no usable directory among ${candidates.join(", ")}`,
+    { file: "auto.ts" },
+  );
+  return false;
+}
+
 export function isAutoPaused(): boolean {
   return s.paused;
 }
@@ -1160,6 +1191,56 @@ function pauseAutoUnitIdentityMatches(expected: PauseAutoUnitIdentity | null): b
     s.currentUnit.startedAt === expected.startedAt;
 }
 
+function shouldPreserveCoordinationForPause(errorContext?: ErrorContext): boolean {
+  return errorContext?.category === "provider" && errorContext.isTransient === true;
+}
+
+function resolvePauseLifecyclePresentation(errorContext?: ErrorContext): {
+  status: "paused" | "blocked";
+  title: string;
+  detail: string;
+  nextAction: string;
+  commands: string[];
+  notifyLevel: "info" | "warning";
+  notifyPrefix: string;
+} {
+  const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
+  const modeLabel = s.stepMode ? "Step" : "Auto";
+  const defaultPresentation = {
+    status: "paused" as const,
+    title: `${modeLabel}-mode paused`,
+    detail: errorContext?.message ?? "Paused by user request.",
+    nextAction: `Type to steer, or run ${resumeCmd} to resume.`,
+    commands: [resumeCmd, "/gsd status for overview", "/gsd notifications for history"],
+    notifyLevel: "info" as const,
+    notifyPrefix: `${modeLabel}-mode paused`,
+  };
+
+  const message = errorContext?.message ?? "";
+  if (
+    message.includes("completed closeout dispatch history") ||
+    message.includes("completed complete-milestone dispatch history")
+  ) {
+    const milestoneMatch = message.match(/Milestone (M\d+[A-Z0-9-]*)/);
+    const milestoneId = milestoneMatch?.[1] ?? "this milestone";
+    return {
+      status: "blocked",
+      title: `${modeLabel}-mode blocked`,
+      detail: message,
+      nextAction: `Run \`/gsd dispatch complete-milestone ${milestoneId}\` to finish closeout, then ${resumeCmd}.`,
+      commands: [
+        `/gsd dispatch complete-milestone ${milestoneId}`,
+        `/gsd status ${milestoneId}`,
+        resumeCmd,
+      ],
+      notifyLevel: "warning",
+      notifyPrefix: `${modeLabel}-mode blocked`,
+    };
+  }
+
+  return defaultPresentation;
+}
+
 function setLifecycleOutcome(
   ctx: ExtensionContext | undefined,
   input: {
@@ -1211,11 +1292,15 @@ function setTerminalCloseoutOutcome(
     invalidate(): void {},
   }));
   ctx.ui.setStatus?.("gsd-step", undefined);
+  ctx.ui?.setGsdProgress?.(undefined);
   ctx.ui.setWidget?.("gsd-progress", undefined);
+  const detail = input.allMilestonesComplete && input.milestoneTitle
+    ? `${input.milestoneTitle}. All milestones complete`
+    : `${titleLine}${input.reason ?? "Milestone closeout finished."}`;
   setLifecycleOutcome(ctx, {
     status: "complete",
     title,
-    detail: `${titleLine}${input.reason ?? "Milestone closeout finished."}`,
+    detail,
     nextAction,
     commands: TERMINAL_CLOSEOUT_COMMANDS,
     unitLabel: input.milestoneId ? `complete-milestone ${input.milestoneId}` : null,
@@ -2032,6 +2117,12 @@ export async function pauseAuto(
     });
     return;
   }
+
+  anchorProcessCwdForAutoResume(s.basePath || s.originalBasePath || "", [
+    s.originalBasePath,
+    lockBase(),
+  ].filter((path): path is string => Boolean(path)));
+
   s.active = false;
   s.paused = true;
   clearUnitTimeout();
@@ -2120,7 +2211,7 @@ export async function pauseAuto(
     clearLock(lockBase());
   }
 
-  if (s.workerId) {
+  if (s.workerId && !shouldPreserveCoordinationForPause(_errorContext)) {
     try {
       if (s.currentMilestoneId && s.milestoneLeaseToken) {
         releaseMilestoneLease(s.workerId, s.currentMilestoneId, s.milestoneLeaseToken);
@@ -2147,22 +2238,22 @@ export async function pauseAuto(
   s.pendingVerificationRetry = null;
   ctx?.ui.setStatus("gsd-auto", "paused");
   ctx?.ui.setWidget("gsd-progress", undefined);
-  const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
+  const lifecycle = resolvePauseLifecyclePresentation(_errorContext);
   setLifecycleOutcome(ctx, {
-    status: "paused",
-    title: `${s.stepMode ? "Step" : "Auto"}-mode paused`,
-    detail: _errorContext?.message ?? "Paused by user request.",
-    nextAction: `Type to steer, or run ${resumeCmd} to resume.`,
-    commands: [resumeCmd, "/gsd status for overview", "/gsd notifications for history"],
+    status: lifecycle.status,
+    title: lifecycle.title,
+    detail: lifecycle.detail,
+    nextAction: lifecycle.nextAction,
+    commands: lifecycle.commands,
     unitLabel: pausedUnitLabel,
   });
   if (ctx) initHealthWidget(ctx);
   const pauseMessage = _errorContext?.message
-    ? `${s.stepMode ? "Step" : "Auto"}-mode paused: ${_errorContext.message}`
-    : `${s.stepMode ? "Step" : "Auto"}-mode paused (Escape). Type to interact, or ${resumeCmd} to resume.`;
+    ? `${lifecycle.notifyPrefix}: ${_errorContext.message}`
+    : `${lifecycle.notifyPrefix} (Escape). Type to interact, or ${lifecycle.commands[0] ?? (s.stepMode ? "/gsd next" : "/gsd auto")} to resume.`;
   ctx?.ui.notify(
     pauseMessage,
-    "info",
+    lifecycle.notifyLevel,
   );
 }
 
@@ -2232,7 +2323,7 @@ function ensureOrchestrationModule(ctx: ExtensionContext, pi: ExtensionAPI, base
  * Build the LoopDeps object from auto.ts private scope.
  * This bundles all private functions that autoLoop needs without exporting them.
  */
-function buildLoopDeps(pi: ExtensionAPI): LoopDeps {
+function buildLoopDeps(pi: ExtensionAPI, ctx: ExtensionContext): LoopDeps {
   // Initialize the unified rule registry with converted dispatch rules.
   // Must happen before LoopDeps is assembled so facade functions
   // (resolveDispatch, runPreDispatchHooks, etc.) delegate to the registry.
@@ -2258,7 +2349,12 @@ function buildLoopDeps(pi: ExtensionAPI): LoopDeps {
     invalidateAllCaches,
     deriveState,
     rebuildState,
-    loadEffectiveGSDPreferences,
+    loadEffectiveGSDPreferences: () =>
+      loadEffectiveGSDPreferencesWithRegistry(
+        ctx.modelRegistry,
+        s.basePath || undefined,
+        resolveProfileAnchorProvider(ctx.model?.provider, s.autoModeStartModel?.provider),
+      ),
 
     // Pre-dispatch health gate
     preDispatchHealthGate,
@@ -2537,7 +2633,7 @@ export async function startAuto(
               if (persistedWorktreePath && !existsSync(persistedWorktreePath)) {
                 logWarning(
                   "session",
-                  `Worktree was expected at ${persistedWorktreePath} but is missing. Continuing in project-root mode. To restart with a fresh worktree, run /gsd-debug or recreate the milestone.`,
+                  `Worktree was expected at ${persistedWorktreePath} but is missing. Resuming from project root; /gsd next will recreate the worktree when isolation is enabled.`,
                   { file: "auto.ts", milestoneId: meta.milestoneId ?? "" },
                 );
               }
@@ -2632,12 +2728,16 @@ export async function startAuto(
     if (resumeWorktreePath && !existsSync(resumeWorktreePath)) {
       logWarning(
         "session",
-        `Worktree was expected at ${resumeWorktreePath} but is missing. Continuing in project-root mode. To restart with a fresh worktree, run /gsd-debug or recreate the milestone.`,
+        `Worktree was expected at ${resumeWorktreePath} but is missing. Resuming from project root; /gsd next will recreate the worktree when isolation is enabled.`,
         { file: "auto.ts", milestoneId: s.currentMilestoneId ?? "" },
       );
     }
     // ADR-016 phase 2 / B3 (#5621): paused-resume worktree-path adoption.
     buildLifecycle().resumeFromPausedSession(base, resumeWorktreePath);
+    anchorProcessCwdForAutoResume(s.basePath || base, [
+      base,
+      s.originalBasePath || base,
+    ]);
     // Rebuild scope now that s.basePath reflects the actual worktree (or project root).
     rebuildScope(s.basePath, s.currentMilestoneId);
     // Ensure the workflow-logger audit log is pinned to the project root
@@ -2683,7 +2783,7 @@ export async function startAuto(
       rebuildScope(s.basePath, s.currentMilestoneId);
     }
 
-    const loopDeps = buildLoopDeps(pi);
+    const loopDeps = buildLoopDeps(pi, ctx);
     ensureOrchestrationModule(ctx, pi, s.basePath || base);
     registerSigtermHandler(lockBase());
 
@@ -2803,7 +2903,7 @@ export async function startAuto(
   // Build scope after bootstrap has populated s.basePath / s.originalBasePath /
   // s.currentMilestoneId (including worktree setup inside bootstrapAutoSession).
   rebuildScope(s.basePath, s.currentMilestoneId);
-  const loopDeps = buildLoopDeps(pi);
+  const loopDeps = buildLoopDeps(pi, ctx);
   ensureOrchestrationModule(ctx, pi, s.basePath || base);
   captureProjectRootEnv(s.originalBasePath || s.basePath);
   registerAutoWorkerForSession(s);

package/src/resources/extensions/gsd/bootstrap/agent-end-recovery.ts

@@ -677,11 +677,15 @@ export async function handleAgentEnd(
       return;
     }
 
-    // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli)
+    // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli, google-antigravity)
     // which use per-user quotas with shorter windows (#2922).
     if (cls.kind === "rate-limit") {
       const currentProvider = ctx.model?.provider;
-      if (currentProvider === "openai-codex" || currentProvider === "google-gemini-cli") {
+      if (
+        currentProvider === "openai-codex"
+        || currentProvider === "google-gemini-cli"
+        || currentProvider === "google-antigravity"
+      ) {
         cls.retryAfterMs = Math.min(cls.retryAfterMs, 30_000);
       }
       const dash = getAutoDashboardData();

package/src/resources/extensions/gsd/bootstrap/dynamic-tools.ts

@@ -8,7 +8,12 @@ import type { ExtensionAPI } from "@gsd/pi-coding-agent";
 import { createBashTool, createEditTool, createReadTool, createWriteTool } from "@gsd/pi-coding-agent";
 
 import { logWarning } from "../workflow-logger.js";
-import { openWorkflowDatabase } from "../db-workspace.js";
+import {
+  getWorkflowDatabaseStatus,
+  openWorkflowDatabase,
+  type WorkflowDatabaseOpenResult,
+  type WorkflowDatabaseStatus,
+} from "../db-workspace.js";
 import { getAutoWorktreePath } from "../auto-worktree.js";
 import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { worktreesDirs } from "../worktree-placement.js";
@@ -69,15 +74,60 @@ export function resolveWorkflowToolBasePath(
 
 export { resolveProjectRootDbPath } from "../db-workspace.js";
 
+type WorkflowDatabaseOpenFailure = Extract<WorkflowDatabaseOpenResult, { ok: false }>;
+
+function sqliteProviderHint(status: WorkflowDatabaseStatus, nodeVersion: string): string {
+  if (status.provider) return `Provider: ${status.provider}.`;
+
+  const major = Number.parseInt(nodeVersion.split(".")[0] ?? "", 10);
+  if (Number.isFinite(major) && major < 22) {
+    return (
+      `No SQLite provider available. Upgrade Node to >= 22.0.0 (current: v${nodeVersion}), ` +
+      "use the packaged GSD runtime, or install/restore better-sqlite3 in this runtime."
+    );
+  }
+
+  return (
+    "No SQLite provider available. Use a Node build with node:sqlite enabled, " +
+    "run the packaged GSD runtime, or install/restore better-sqlite3 in this runtime."
+  );
+}
+
+function dbOpenPhaseHint(status: WorkflowDatabaseStatus): string {
+  if (status.lastPhase === "open") return "The database file could not be opened";
+  if (status.lastPhase === "initSchema") return "The database schema could not be initialized";
+  if (status.lastPhase === "vacuum-recovery") return "Corruption recovery (VACUUM) failed";
+  if (status.attempted) return "The database could not be opened";
+  return "The database provider could not be loaded";
+}
+
+export function formatWorkflowDatabaseOpenFailure(
+  result: WorkflowDatabaseOpenFailure,
+  status?: WorkflowDatabaseStatus,
+  nodeVersion: string = process.versions.node,
+): string {
+  if (result.reason === "missing-gsd-dir") {
+    return `ensureDbOpen failed — no .gsd directory found at ${result.location.projectGsd}`;
+  }
+
+  if (result.reason === "missing-database") {
+    return `ensureDbOpen failed — no GSD database found at ${result.location.projectDb}`;
+  }
+
+  const resolvedStatus = status ?? getWorkflowDatabaseStatus();
+  const detail = result.error?.message ?? resolvedStatus.lastError?.message ?? "";
+  const detailSuffix = detail ? ` (${detail})` : "";
+  return (
+    `ensureDbOpen failed for ${result.location.projectDb}: ` +
+    `${dbOpenPhaseHint(resolvedStatus)}${detailSuffix}. ${sqliteProviderHint(resolvedStatus, nodeVersion)}`
+  );
+}
+
 export async function ensureDbOpen(basePath: string = safeWorkspaceCwd()): Promise<boolean> {
   const result = openWorkflowDatabase(basePath);
   if (result.ok) return true;
 
-  if (result.reason === "missing-gsd-dir") {
-    logWarning("bootstrap", "ensureDbOpen failed — no .gsd directory found");
-  } else {
-    logWarning("bootstrap", `ensureDbOpen failed: ${result.error?.message ?? "open failed"}`);
-  }
+  logWarning("bootstrap", formatWorkflowDatabaseOpenFailure(result));
   return false;
 }
 

package/src/resources/extensions/gsd/bootstrap/register-extension.ts

@@ -16,7 +16,7 @@ import { registerScheduleWakeupTool } from "./schedule-wakeup-tool.js";
 import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
 import { writeCrashLog } from "./crash-log.js";
-import { logWarning } from "../workflow-logger.js";
+import { logWarning, isGsdExtensionStderrEnabled } from "../workflow-logger.js";
 import { UNIT_TOOL_CONTRACTS } from "../unit-tool-contracts.js";
 // Static import so cmux event listeners are registered synchronously during
 // extension bootstrap. Prior implementation used `void import().then()` which
@@ -47,6 +47,7 @@ export const CRITICAL_GSD_WORKFLOW_TOOL_NAMES = [...new Set(
 /** Write to stderr without ever re-throwing — stderr can EPIPE too, which would
  *  re-enter this handler and re-loop. */
 function safeStderr(msg: string): void {
+  if (!isGsdExtensionStderrEnabled()) return;
   try {
     process.stderr.write(msg);
   } catch { /* stderr is also broken; nothing we can do */ }

package/src/resources/extensions/gsd/bootstrap/register-hooks.ts

@@ -13,7 +13,7 @@ import type { GSDEcosystemBeforeAgentStartHandler } from "../ecosystem/gsd-exten
 import { updateSnapshot } from "../ecosystem/gsd-extension-api.js";
 
 import { buildMilestoneFileName, clearPathCache, milestonesDir, resolveMilestonePath, resolveSliceFile, resolveSlicePath } from "../paths.js";
-import { applyAskUserQuestionsGateResult, clearDiscussionFlowState, formatPendingAskUserQuestionsGateMessage, hostWriteGateAdapter, isApprovalGateVerifiedInSnapshot, isDepthConfirmationAnswer, isMilestoneDepthVerified, isMilestoneDepthVerifiedInSnapshot, isQueuePhaseActive, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeWrite, isGateQuestionId, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
+import { applyAskUserQuestionsGateResult, clearDiscussionFlowState, formatPendingAskUserQuestionsGateMessage, hostWriteGateAdapter, isApprovalGateVerifiedInSnapshot, isDepthConfirmationAnswer, isMilestoneDepthVerified, isMilestoneDepthVerifiedInSnapshot, isQueuePhaseActive, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeBash, shouldBlockWorktreeWrite, isGateQuestionId, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
 import { canonicalToolName } from "../engine-hook-contract.js";
 import { resolveManifest } from "../unit-context-manifest.js";
 import { isBlockedStateFile, isBashWriteToStateFile, BLOCKED_WRITE_ERROR } from "../write-intercept.js";
@@ -46,7 +46,7 @@ import {
   isDestructiveConfirmGateId,
   requestDestructiveConfirmation,
 } from "../safety/destructive-confirmation.js";
-import { logWarning as safetyLogWarning } from "../workflow-logger.js";
+import { logWarning as safetyLogWarning, setStderrLoggingEnabled } from "../workflow-logger.js";
 import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
 import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
@@ -148,6 +148,15 @@ async function installWelcomeHeader(ctx: ExtensionContext): Promise<void> {
   }
 }
 
+/** Suppress the startup welcome banner without restoring the built-in pi header. */
+function suppressWelcomeHeader(ctx: ExtensionContext): void {
+  if (!ctx.hasUI || typeof ctx.ui?.setHeader !== "function") return;
+  ctx.ui.setHeader(() => ({
+    render(): string[] { return []; },
+    invalidate(): void {},
+  }));
+}
+
 /**
  * Approval gates whose durable arming is deferred until tool execution /
  * agent end, keyed by basePath. A Map (not a single slot) so concurrent
@@ -819,6 +828,9 @@ function initSessionNotifications(ctx: ExtensionContext): void {
   installNotifyInterceptor(ctx);
   initNotificationWidget(ctx);
   notifyPreferenceDiagnostics(ctx, contextBasePath(ctx), { surface: "session-start" });
+  if (ctx.hasUI) {
+    setStderrLoggingEnabled(false);
+  }
 }
 
 async function prepareWorkflowMcpForHookContext(
@@ -871,7 +883,14 @@ export function registerHooks(
       process.env.GSD_SHOW_TOKEN_COST = prefs?.preferences.show_token_cost ? "1" : "";
     } catch { /* non-fatal */ }
     if (!preserveCloseoutSurface) {
-      await installWelcomeHeader(ctx);
+      // Per-unit newSession() during auto/step runs fires session_start again.
+      // Keep the welcome banner startup-only — do not overwrite the empty header
+      // that updateProgressWidget installs once work begins.
+      if (isAutoActive() || isAutoPaused()) {
+        suppressWelcomeHeader(ctx);
+      } else {
+        await installWelcomeHeader(ctx);
+      }
     }
     await loadToolApiKeysForSession();
     if (isAutoActive() || preserveCloseoutSurface) {
@@ -1033,6 +1052,10 @@ export function registerHooks(
   pi.on("message_end", async (event) => {
     const { suppressTerminalDeletedWorktreeMessageEnd } = await import("./agent-end-recovery.js");
     suppressTerminalDeletedWorktreeMessageEnd(event);
+    if (isAutoActive()) {
+      const { sanitizePrematureCloseoutMessageEnd } = await import("../auto-closeout-messaging.js");
+      sanitizePrematureCloseoutMessageEnd(event);
+    }
   });
 
   // Squash-merge quick-task branch back to the original branch after the
@@ -1364,6 +1387,16 @@ export function registerHooks(
       if (wtGuard.block) return wtGuard;
     }
 
+    if (isToolCallEventType("bash", event)) {
+      const wtBashGuard = shouldBlockWorktreeBash(
+        event.input.command,
+        dash.basePath ?? discussionBasePath,
+        isAutoActive(),
+        dash.currentUnit?.type,
+      );
+      if (wtBashGuard.block) return wtBashGuard;
+    }
+
     // ── Single-writer engine: block direct writes to STATE.md ──────────
     // Covers write, edit, and bash tools to prevent bypass vectors.
     if (isToolCallEventType("write", event)) {

package/src/resources/extensions/gsd/bootstrap/write-gate.ts

@@ -12,6 +12,7 @@ import { compileSubagentPermissionContract, type ToolsPolicy } from "../unit-con
 import { logWarning } from "../workflow-logger.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { worktreesDirs } from "../worktree-placement.js";
+import { bashReferencesProjectRootOutsideWorktree } from "../worktree-shell-guard.js";
 import { evaluateGateAnswer } from "../consent-verdict.js";
 
 /**
@@ -1373,6 +1374,37 @@ function isPathContained(target: string, container: string): boolean {
   return target.startsWith(container.endsWith(sep) ? container : container + sep);
 }
 
+function formatWorktreeIsolationBlockReason(
+  tool: string,
+  displayTarget: string,
+  isAutoLive: boolean,
+  effectiveBasePath: string,
+): string {
+  if (isGsdWorktreePath(effectiveBasePath)) {
+    return [
+      `HARD BLOCK: ${tool} target "${displayTarget}" is outside the active milestone worktree`,
+      `while \`git.isolation: worktree\` is configured. Source edits must stay inside`,
+      `\`.gsd-worktrees/<MID>/\` (or \`.gsd/\` planning artifacts) so the auto-mode commit`,
+      `pipeline captures them. Writing to the project root leaks changes that block milestone merge.`,
+      `Use a relative path under the worktree cwd or an absolute path inside the worktree directory.`,
+      ...(isAutoLive ? [] : [
+        "This guard also applies to subagent children spawned from the worktree — do not",
+        "`cd` to the project root or reference its paths in shell commands.",
+      ]),
+    ].join(" ");
+  }
+
+  return [
+    `HARD BLOCK: Worktree isolation is configured (\`git.isolation: worktree\`) but auto-mode is`,
+    `not running and the target "${displayTarget}" is not inside \`.gsd/worktrees/<MID>/\`.`,
+    `Code edits at the project root would be lost — only the auto-mode commit pipeline`,
+    `(auto-post-unit) commits work, and it never runs outside the loop.`,
+    `Required action: start auto-mode with \`/gsd\` so the milestone worktree is created,`,
+    `then write inside it. To disable this guard for self-hosting development, set`,
+    `GSD_DISABLE_WORKTREE_WRITE_GUARD=1.`,
+  ].join(" ");
+}
+
 /**
  * Block planning-write tool calls that would land code at the project root
  * while `git.isolation: worktree` is in effect and auto-mode hasn't created
@@ -1390,10 +1422,9 @@ function isPathContained(target: string, container: string): boolean {
  *   5. Target is inside `<projectRoot>/.gsd/worktrees/` (a real worktree).
  *   6. Target is inside `<projectRoot>/.gsd/` and isn't masquerading as a
  *      worktrees sibling (rejects the `.gsd/worktrees-extra/…` prefix trick).
- *   7. Auto is live AND `effectiveBasePath` is itself a `.gsd/worktrees/…` path.
  *
- * Otherwise: block with a message that points the agent at `/gsd` to start
- * auto-mode.
+ * Otherwise: block with a message that points the agent at the active worktree
+ * or `/gsd` to start auto-mode.
  */
 export function shouldBlockWorktreeWrite(
   toolName: string,
@@ -1442,24 +1473,46 @@ export function shouldBlockWorktreeWrite(
     // fall through: looks like worktrees<something> sibling — block
   }
 
-  // Auto is live and the caller is operating inside a worktree path —
-  // host tool's write happens in worktree context; let it through.
-  if (isAutoLive && isGsdWorktreePath(effectiveBasePath)) return { block: false };
-
   // Block. Provide enough context that the agent can self-correct.
   const displayTarget = isPathContained(realTarget, realRoot)
     ? relative(realRoot, realTarget) || "."
     : realTarget;
   return {
     block: true,
-    reason: [
-      `HARD BLOCK: Worktree isolation is configured (\`git.isolation: worktree\`) but auto-mode is`,
-      `not running and the target "${displayTarget}" is not inside \`.gsd/worktrees/<MID>/\`.`,
-      `Code edits at the project root would be lost — only the auto-mode commit pipeline`,
-      `(auto-post-unit) commits work, and it never runs outside the loop.`,
-      `Required action: start auto-mode with \`/gsd\` so the milestone worktree is created,`,
-      `then write inside it. To disable this guard for self-hosting development, set`,
-      `GSD_DISABLE_WORKTREE_WRITE_GUARD=1.`,
-    ].join(" "),
+    reason: formatWorktreeIsolationBlockReason(tool, displayTarget, isAutoLive, effectiveBasePath),
+  };
+}
+
+/**
+ * Block bash commands that reference the project root while executing inside an
+ * active milestone worktree under `git.isolation: worktree`.
+ *
+ * Mirrors the gsd_exec sandbox rule so native bash cannot bypass write/edit gates.
+ */
+export function shouldBlockWorktreeBash(
+  command: string,
+  effectiveBasePath: string,
+  isAutoLive: boolean,
+  currentUnitType?: string | null,
+): { block: boolean; reason?: string } {
+  if (process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD === "1") return { block: false };
+  if (getIsolationMode(effectiveBasePath) !== "worktree") return { block: false };
+  if (currentUnitType && WORKTREE_GATE_BOOTSTRAP_UNITS.has(currentUnitType)) return { block: false };
+  // Block whenever the effective cwd is inside a milestone worktree — not only
+  // during live auto-mode. Reactive-execute subagents run as fresh pi children
+  // without an auto session, but still inherit the worktree cwd and must not
+  // shell out to the project root (the native bash bypass that caused root-write leaks).
+  if (!isGsdWorktreePath(effectiveBasePath)) return { block: false };
+  if (!command.trim()) return { block: false };
+  if (!bashReferencesProjectRootOutsideWorktree(command, effectiveBasePath)) return { block: false };
+
+  return {
+    block: true,
+    reason: formatWorktreeIsolationBlockReason(
+      "bash",
+      "project root path reference in shell command",
+      isAutoLive,
+      effectiveBasePath,
+    ),
   };
 }

package/src/resources/extensions/gsd/closeout-wizard.ts

@@ -22,7 +22,11 @@ import {
 } from "./unmerged-milestone-guard.js";
 import { appendRequirementsBacklogToSummary } from "./requirements-backlog.js";
 import { nativeBranchList, nativeIsRepo } from "./native-git-bridge.js";
-import { allWorktreesDirs } from "./worktree-manager.js";
+import {
+  allWorktreesDirs,
+  isMilestoneWorktreeResidueCandidate,
+  pruneEphemeralGhostWorktreeDirectories,
+} from "./worktree-manager.js";
 
 export type CloseoutActionId = "finish_quick" | "finish_milestone";
 
@@ -50,8 +54,11 @@ function listMilestoneWorktreeIds(basePath: string): string[] {
     if (!existsSync(wtDir)) continue;
     for (const entry of readdirSync(wtDir)) {
       if (!MILESTONE_ID_RE.test(entry)) continue;
+      const fullPath = join(wtDir, entry);
       try {
-        if (statSync(join(wtDir, entry)).isDirectory()) ids.add(entry);
+        if (!statSync(fullPath).isDirectory()) continue;
+        if (!isMilestoneWorktreeResidueCandidate(basePath, fullPath)) continue;
+        ids.add(entry);
       } catch {
         // skip unreadable entries
       }
@@ -90,6 +97,8 @@ function isStrandedMilestoneId(milestoneId: string): boolean {
 export function detectIdleMilestoneResidueHint(basePath: string): IdleMilestoneResidueHint | null {
   if (!nativeIsRepo(basePath)) return null;
 
+  pruneEphemeralGhostWorktreeDirectories(basePath);
+
   const gsdDir = join(basePath, ".gsd");
   const dbPath = join(gsdDir, "gsd.db");
   if (!existsSync(gsdDir) || !existsSync(dbPath)) {