@opengsd/gsd-pi 1.2.0-dev.4813ead6 → 1.2.0-dev.5457a158

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -7,7 +7,7 @@ import { isToolCallEventType } from "@gsd/pi-coding-agent";
 import { ALWAYS_PRESERVED_SHIM_TOOL_NAMES } from "@gsd/pi-ai";
 import { updateSnapshot } from "../ecosystem/gsd-extension-api.js";
 import { buildMilestoneFileName, clearPathCache, milestonesDir, resolveMilestonePath, resolveSliceFile, resolveSlicePath } from "../paths.js";
-import { applyAskUserQuestionsGateResult, canonicalToolName, clearDiscussionFlowState, formatPendingAskUserQuestionsGateMessage, isMilestoneDepthVerified, isQueuePhaseActive, markApprovalGateVerified, markDepthVerified, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeWrite, isGateQuestionId, setPendingGate, clearPendingGate, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
+import { applyAskUserQuestionsGateResult, canonicalToolName, clearDiscussionFlowState, formatPendingAskUserQuestionsGateMessage, isApprovalGateVerifiedInSnapshot, isMilestoneDepthVerified, isMilestoneDepthVerifiedInSnapshot, isQueuePhaseActive, markApprovalGateVerified, markDepthVerified, refreshWriteGateStateFromDisk, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeWrite, isGateQuestionId, setPendingGate, clearPendingGate, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
 import { resolveManifest } from "../unit-context-manifest.js";
 import { isBlockedStateFile, isBashWriteToStateFile, BLOCKED_WRITE_ERROR } from "../write-intercept.js";
 import { loadFile, saveFile, formatContinue } from "../files.js";
@@ -20,6 +20,7 @@ import { recordToolCall as safetyRecordToolCall, recordToolResult as safetyRecor
 import { parseUnitId } from "../unit-id.js";
 import { classifyCommand } from "../safety/destructive-guard.js";
 import { logWarning as safetyLogWarning } from "../workflow-logger.js";
+import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
 import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
 import { initNotificationWidget } from "../notification-widget.js";
@@ -35,6 +36,8 @@ import { filterToolsForProvider } from "../model-router.js";
 import { mcpToolMatchesBaseName } from "../mcp-tool-name.js";
 import { RUN_UAT_READ_ONLY_TOOL_NAMES, RUN_UAT_WORKFLOW_TOOL_NAMES } from "../tool-presentation-plan.js";
 import { supportsSourceObservationsForUnit } from "../source-observations.js";
+import { clearPendingAutoStart } from "../pending-auto-start.js";
+import { resolveWorkflowToolBasePath } from "./dynamic-tools.js";
 let approvalQuestionAbortInFlight = false;
 async function loadWelcomeScreenModule() {
     const candidates = [];
@@ -444,8 +447,15 @@ function isShellExecutionTool(canonicalName) {
 function activateDeferredApprovalGate(basePath) {
     if (deferredApprovalGate?.basePath !== basePath)
         return;
-    setPendingGate(deferredApprovalGate.gateId, basePath);
+    const gateId = deferredApprovalGate.gateId;
     deferredApprovalGate = null;
+    const snapshot = refreshWriteGateStateFromDisk(basePath);
+    const milestoneId = extractDepthVerificationMilestoneId(gateId);
+    if (isApprovalGateVerifiedInSnapshot(snapshot, gateId))
+        return;
+    if (milestoneId && isMilestoneDepthVerifiedInSnapshot(snapshot, milestoneId))
+        return;
+    setPendingGate(gateId, basePath);
 }
 function extractGateQuestionId(input) {
     const questions = input?.questions ?? [];
@@ -463,6 +473,25 @@ function isContextDraftSummarySave(toolName, input) {
         return false;
     return input.artifact_type === "CONTEXT-DRAFT";
 }
+/**
+ * External engines (claude-code-cli) deliver ask_user_questions results as
+ * relayed MCP tool results: the structured round payload arrives in
+ * `result.structuredContent`, not in pi-native `event.details`. Without this
+ * fallback, applyAskUserQuestionsGateResult sees no response for an answered
+ * gate question and lands in the "waiting" branch — leaving a re-armed gate
+ * permanently pending and the discuss→auto handoff blocked.
+ */
+function resolveAskUserQuestionsGateDetails(event) {
+    const hasRoundShape = (value) => !!value && typeof value === "object" &&
+        (value.cancelled !== undefined || value.response !== undefined);
+    const details = event.details;
+    if (hasRoundShape(details))
+        return details;
+    const structured = event.result?.structuredContent;
+    if (hasRoundShape(structured))
+        return structured;
+    return details ?? {};
+}
 function selectedAnswerLabel(selected) {
     if (Array.isArray(selected))
         return selected.map(String).join(", ");
@@ -626,7 +655,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             catch { /* non-fatal */ }
         }
     });
-    pi.on("session_switch", async (_event, ctx) => {
+    pi.on("session_switch", async (event, ctx) => {
         const basePath = contextBasePath(ctx);
         const preserveCloseoutSurface = isAutoCompletionStopInProgress();
         initSessionNotifications(ctx);
@@ -635,6 +664,13 @@ export function registerHooks(pi, ecosystemHandlers) {
         clearDeferredApprovalGate();
         await resetAskUserQuestionsTurnCache();
         clearDiscussionFlowState(basePath);
+        // /clear or /new destroys the conversation holding a discuss interview, so
+        // its pending discuss→auto handoff can never be answered — clear it. Resume
+        // restores the interview transcript, so the entry survives. Auto-mode's own
+        // newSession() calls are safe: the handoff consumes the entry on agent_end.
+        if (event.reason === "new") {
+            clearPendingAutoStart(basePath);
+        }
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
         await applyCompactionThresholdOverride(ctx);
@@ -1105,12 +1141,27 @@ export function registerHooks(pi, ecosystemHandlers) {
         else if (isAutoActive()) {
             clearToolInvocationError();
         }
+        // Interactive Closeout adapter (ADR-032): auto-mode owns closeout for its
+        // own units; interactive completions get the durable git subset (commit +
+        // Closeout Git Verdict) instead of silently bypassing git.isolation.
+        if (!event.isError && !isAutoActive() && isUnitCloseoutTool(toolName)) {
+            try {
+                runInteractiveUnitCloseout({
+                    basePath: resolveWorkflowToolBasePath(ctx, event.input),
+                    canonicalToolName: toolName,
+                    input: event.input,
+                });
+            }
+            catch (err) {
+                safetyLogWarning("engine", `interactive unit closeout failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
         if (toolName !== "ask_user_questions")
             return;
         const basePath = contextBasePath(ctx);
         const milestoneId = await getDiscussionMilestoneIdFor(basePath);
-        const details = event.details;
-        const questions = event.input?.questions ?? [];
+        const details = resolveAskUserQuestionsGateDetails(event);
+        const questions = event.input?.questions ?? details?.questions ?? [];
         const gateResult = applyAskUserQuestionsGateResult({
             basePath,
             questions,
@@ -1146,10 +1197,39 @@ export function registerHooks(pi, ecosystemHandlers) {
         if (toolName === "ask_user_questions") {
             const questionId = extractGateQuestionId(event.args);
             if (typeof questionId === "string") {
-                setPendingGate(questionId, basePath);
+                // External engines (claude-code-cli) ingest the SDK turn's tool blocks
+                // post-hoc, so this event can fire AFTER the workflow MCP child already
+                // verified this gate and allowed the CONTEXT save. setPendingGate also
+                // revokes verifiedDepthMilestones/verifiedApprovalGates, so an
+                // unconditional re-arm here wipes the child's verification and leaves
+                // the discuss→auto handoff permanently blocked. Skip the re-arm when
+                // the snapshot already records this exact gate as verified — mirrors
+                // activateDeferredApprovalGate's guard. Stale verified state cannot
+                // leak into a later re-discussion: a successful handoff deletes the
+                // snapshot via clearDiscussionFlowState.
+                const snapshot = refreshWriteGateStateFromDisk(basePath);
+                const gateMilestoneId = extractDepthVerificationMilestoneId(questionId);
+                const alreadyVerified = isApprovalGateVerifiedInSnapshot(snapshot, questionId) ||
+                    isMilestoneDepthVerifiedInSnapshot(snapshot, gateMilestoneId);
+                if (!alreadyVerified) {
+                    setPendingGate(questionId, basePath);
+                }
                 clearDeferredApprovalGate(basePath);
             }
         }
+        // Safety harness: record evidence here, not only in tool_call. External
+        // engines (claude-code-cli) pre-execute tools, so the agent loop skips
+        // beforeToolCall/tool_call for them — tool_execution_start is the only
+        // event that fires for every tool call. recordToolCall dedupes by
+        // toolCallId, so native tools (which hit both events) record once.
+        safetyRecordToolCall(event.toolCallId, event.toolName, (event.args ?? {}));
+        const execDash = getAutoRuntimeSnapshot();
+        if (execDash.basePath && execDash.currentUnit?.type === "execute-task") {
+            const { milestone: xMid, slice: xSid, task: xTid } = parseUnitId(execDash.currentUnit.id);
+            if (xMid && xSid && xTid) {
+                saveEvidenceToDisk(execDash.basePath, xMid, xSid, xTid);
+            }
+        }
         if (!isAutoActive())
             return;
         markToolStart(event.toolCallId, event.toolName);

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -8,6 +8,7 @@ import { getIsolationMode } from "../preferences.js";
 import { compileSubagentPermissionContract } from "../unit-context-manifest.js";
 import { logWarning } from "../workflow-logger.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
+import { worktreesDirs } from "../worktree-placement.js";
 /**
  * Regex matching milestone CONTEXT.md file names in both legacy M001
  * and unique M001-abc123 formats. Exported so regex-hardening tests
@@ -214,6 +215,27 @@ export function loadWriteGateSnapshot(basePath) {
         return currentWriteGateSnapshot(basePath);
     }
 }
+/**
+ * Merge the persisted write-gate snapshot into the in-process Map entry.
+ * The workflow MCP server runs in a child process and records depth
+ * verification there; without this refresh the extension host keeps stale
+ * pending-gate memory and `activateDeferredApprovalGate` can re-arm a gate
+ * that the subprocess already cleared on disk.
+ *
+ * Returns the snapshot used for the refresh so callers that need to inspect
+ * it (e.g. re-arm guards) avoid a second disk read.
+ */
+export function refreshWriteGateStateFromDisk(basePath) {
+    const snapshot = loadWriteGateSnapshot(basePath);
+    if (!shouldPersistWriteGateSnapshot())
+        return snapshot;
+    const state = getWriteGateState(basePath);
+    state.pendingGateId = snapshot.pendingGateId;
+    state.activeQueuePhase = snapshot.activeQueuePhase;
+    state.verifiedDepthMilestones = new Set(snapshot.verifiedDepthMilestones);
+    state.verifiedApprovalGates = new Set(snapshot.verifiedApprovalGates ?? []);
+    return snapshot;
+}
 export function isDepthVerified(basePath = process.cwd()) {
     return getWriteGateState(basePath).verifiedDepthMilestones.size > 0;
 }
@@ -223,6 +245,7 @@ export function isDepthVerified(basePath = process.cwd()) {
 export function isMilestoneDepthVerified(milestoneId, basePath = process.cwd()) {
     if (!milestoneId)
         return false;
+    refreshWriteGateStateFromDisk(basePath);
     return getWriteGateState(basePath).verifiedDepthMilestones.has(milestoneId);
 }
 export function isMilestoneDepthVerifiedInSnapshot(snapshot, milestoneId) {
@@ -309,6 +332,7 @@ export function clearPendingGate(basePath) {
  * Get the currently pending gate, if any.
  */
 export function getPendingGate(basePath = process.cwd()) {
+    refreshWriteGateStateFromDisk(basePath);
     return getWriteGateState(basePath).pendingGateId;
 }
 /**
@@ -919,10 +943,12 @@ export function shouldBlockWorktreeWrite(toolName, targetPath, effectiveBasePath
     const realTarget = realpathOrResolve(absTarget);
     const realRoot = realpathOrResolve(projectRoot);
     const realGsd = realpathOrResolve(join(projectRoot, ".gsd"));
-    const realWorktreesDir = realpathOrResolve(join(projectRoot, ".gsd", "worktrees"));
-    // Allow writes inside the legitimate worktrees subtree.
-    if (isPathContained(realTarget, realWorktreesDir))
-        return { block: false };
+    // Allow writes inside a legitimate worktrees subtree (canonical
+    // .gsd-worktrees/ or legacy .gsd/worktrees/).
+    for (const container of worktreesDirs(projectRoot)) {
+        if (isPathContained(realTarget, realpathOrResolve(container)))
+            return { block: false };
+    }
     // Allow writes to .gsd/ planning artifacts, but reject siblings whose name
     // starts with "worktrees" (the worktrees-extra prefix trick — case 4).
     if (isPathContained(realTarget, realGsd)) {

package/dist/resources/extensions/gsd/branch-patterns.js

@@ -11,3 +11,5 @@ export const SLICE_BRANCH_RE = /^gsd\/(?:([a-zA-Z0-9_-]+)\/)?(M\d+(?:-[a-z0-9]{6
 export const QUICK_BRANCH_RE = /^gsd\/quick\//;
 /** Matches GSD-generated workflow template branches, not arbitrary user gsd/* branches. */
 export const WORKFLOW_BRANCH_RE = /^gsd\/(?:hotfix|bugfix|small-feature|refactor|spike|security-audit|dep-upgrade|full-project)\//;
+/** Auto-mode milestone branch prefix: milestone/<MID>. */
+export const MILESTONE_BRANCH_PREFIX = "milestone/";

package/dist/resources/extensions/gsd/captures.js

@@ -8,9 +8,10 @@
  * `.gsd/CAPTURES.md`, not the worktree's local `.gsd/`.
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join, resolve, sep } from "node:path";
+import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { gsdRoot } from "./paths.js";
+import { projectRootFromWorktreePath } from "./worktree-root.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
 const CAPTURES_FILENAME = "CAPTURES.md";
 const VALID_CLASSIFICATIONS = [
@@ -29,20 +30,9 @@ const VALID_CLASSIFICATIONS = [
  * directory that contains `.gsd/worktrees/` — that's the project root.
  */
 export function resolveCapturesPath(basePath) {
-    const resolved = resolve(basePath);
-    // Direct layout: /.gsd/worktrees/
-    const worktreeMarker = `${sep}.gsd${sep}worktrees${sep}`;
-    let idx = resolved.indexOf(worktreeMarker);
-    if (idx === -1) {
-        // Symlink-resolved layout: /.gsd/projects/<hash>/worktrees/
-        const symlinkRe = new RegExp(`\\${sep}\\.gsd\\${sep}projects\\${sep}[a-f0-9]+\\${sep}worktrees\\${sep}`);
-        const match = resolved.match(symlinkRe);
-        if (match && match.index !== undefined)
-            idx = match.index;
-    }
-    if (idx !== -1) {
-        // basePath is inside a worktree — resolve to project root
-        const projectRoot = resolved.slice(0, idx);
+    // If basePath is inside a worktree, resolve to the project root.
+    const projectRoot = projectRootFromWorktreePath(resolve(basePath));
+    if (projectRoot) {
         return join(projectRoot, ".gsd", CAPTURES_FILENAME);
     }
     return join(gsdRoot(basePath), CAPTURES_FILENAME);

package/dist/resources/extensions/gsd/closeout-recovery.js

@@ -2,12 +2,13 @@
 // File Purpose: Closeout git failure discovery, retry, and manual resolution helpers.
 import { execFileSync } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
-import { isAbsolute, join, resolve } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
 import { runTurnGitAction } from "./git-service.js";
 import { _getAdapter, upsertTurnGitTransaction } from "./gsd-db.js";
 import { probeGitConflictState } from "./git-conflict-state.js";
 import { parseUnitId } from "./unit-id.js";
+import { worktreePathFor } from "./worktree-placement.js";
 function parseMetadata(value) {
     if (typeof value !== "string" || !value.trim())
         return {};
@@ -121,7 +122,7 @@ export function resolveCloseoutRecoveryBasePath(projectRoot, record) {
     const parsed = parseUnitId(record.unitId);
     const milestoneId = parsed.milestone ?? (/^M\d+(?:-[a-z0-9]{6})?/.exec(record.unitId)?.[0] ?? "");
     if (milestoneId) {
-        const worktreePath = existingRealPath(join(projectRoot, ".gsd", "worktrees", milestoneId));
+        const worktreePath = existingRealPath(worktreePathFor(projectRoot, milestoneId));
         if (worktreePath)
             return worktreePath;
     }

package/dist/resources/extensions/gsd/commands/catalog.js

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
 import { loadRegistry } from "../workflow-templates.js";
 import { gsdHome } from "../gsd-home.js";
+import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { VISUAL_BRIEF_MODES } from "../../visual-brief/prompts.js";
 export const GSD_COMMAND_DESCRIPTION = "GSD — Git Ship Done: /gsd help|start|templates|next|auto|stop|pause|status|widget|visualize|brief|report|queue|quick|discuss|capture|triage|dispatch|verdict|history|undo|undo-task|reset-slice|rate|skip|export|cleanup|closeout|rebuild|model|mode|prefs|config|keys|hooks|run-hook|skill-health|doctor|debug|logs|forensics|changelog|migrate|remote|steer|knowledge|memory|new-milestone|new-project|parallel|cmux|park|unpark|init|setup|onboarding|inspect|extensions|update|upgrade|fast|mcp|rethink|workflow|codebase|notifications|ship|do|usage|context|session-report|backlog|pr-branch|add-tests|scan|language|worktree|eval-review";
 export const TOP_LEVEL_SUBCOMMANDS = [
@@ -380,70 +381,13 @@ function getExtensionCompletions(prefix, action) {
         return [];
     }
 }
-function normalizePathForCompare(path) {
-    return path.replaceAll("\\", "/").replace(/\/+$/, "");
-}
-function findWorktreeSegment(normalizedPath) {
-    const directMarker = "/.gsd/worktrees/";
-    const directIdx = normalizedPath.indexOf(directMarker);
-    if (directIdx !== -1) {
-        return { gsdIdx: directIdx, afterWorktrees: directIdx + directMarker.length };
-    }
-    const symlinkMatch = normalizedPath.match(/\/\.gsd\/projects\/[a-f0-9]+\/worktrees\//);
-    if (symlinkMatch?.index !== undefined) {
-        return { gsdIdx: symlinkMatch.index, afterWorktrees: symlinkMatch.index + symlinkMatch[0].length };
-    }
-    return null;
-}
-function resolveProjectRootFromGitFile(worktreePath) {
-    try {
-        let dir = worktreePath;
-        for (let i = 0; i < 30; i++) {
-            const gitPath = join(dir, ".git");
-            if (existsSync(gitPath)) {
-                const content = readFileSync(gitPath, "utf8").trim();
-                if (content.startsWith("gitdir: ")) {
-                    const gitDir = resolve(dir, content.slice(8));
-                    const dotGitDir = resolve(gitDir, "..", "..");
-                    if (dotGitDir.endsWith(".git") || dotGitDir.endsWith(".git/") || dotGitDir.endsWith(".git\\")) {
-                        return resolve(dotGitDir, "..");
-                    }
-                    const commonDirPath = join(gitDir, "commondir");
-                    if (existsSync(commonDirPath)) {
-                        const commonDir = readFileSync(commonDirPath, "utf8").trim();
-                        return resolve(resolve(gitDir, commonDir), "..");
-                    }
-                }
-                break;
-            }
-            const parent = resolve(dir, "..");
-            if (parent === dir)
-                break;
-            dir = parent;
-        }
-    }
-    catch {
-        // Completion must stay best-effort.
-    }
-    return null;
-}
 function resolveProjectRootForCompletion(basePath) {
+    // Completion honors GSD_PROJECT_ROOT unconditionally (worker processes may
+    // complete from any cwd); resolveWorktreeProjectRoot only honors it for
+    // worktree paths.
     if (process.env.GSD_PROJECT_ROOT)
         return process.env.GSD_PROJECT_ROOT;
-    const normalizedPath = normalizePathForCompare(basePath);
-    const segment = findWorktreeSegment(normalizedPath);
-    if (!segment)
-        return basePath;
-    const separator = basePath.includes("\\") ? "\\" : "/";
-    const gsdMarker = `${separator}.gsd${separator}`;
-    const gsdIdx = basePath.indexOf(gsdMarker);
-    const candidate = gsdIdx !== -1 ? basePath.slice(0, gsdIdx) : basePath.slice(0, segment.gsdIdx);
-    const normalizedGsdHome = normalizePathForCompare(gsdHome());
-    const candidateGsdPath = normalizePathForCompare(join(candidate, ".gsd"));
-    if (candidateGsdPath === normalizedGsdHome || candidateGsdPath.startsWith(`${normalizedGsdHome}/`)) {
-        return resolveProjectRootFromGitFile(basePath) ?? basePath;
-    }
-    return candidate;
+    return resolveWorktreeProjectRoot(basePath);
 }
 export function getGsdArgumentCompletions(prefix) {
     const hasTrailingSpace = prefix.endsWith(" ");

package/dist/resources/extensions/gsd/crash-recovery.js

@@ -29,6 +29,7 @@ import { markLatestActiveForWorkerCanceled } from "./db/unit-dispatches.js";
 import { getRuntimeKv, setRuntimeKv, deleteRuntimeKv } from "./db/runtime-kv.js";
 import { _getAdapter, isDbAvailable } from "./gsd-db.js";
 import { gsdRoot, normalizeRealPath } from "./paths.js";
+import { crashResumeHint } from "./guidance.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { effectiveLockFile } from "./session-lock.js";
 import { isInFlightRuntimePhase, listUnitRuntimeRecords } from "./unit-runtime.js";
@@ -289,18 +290,9 @@ export function formatCrashInfo(lock) {
         `  Started at: ${lock.unitStartedAt}`,
         `  PID: ${lock.pid}`,
     ];
-    if (lock.unitType === "starting" && lock.unitId === "bootstrap") {
-        lines.push(`No work was lost. Run /gsd auto to restart.`);
-    }
-    else if (lock.unitType.includes("research") || lock.unitType.includes("plan")) {
-        lines.push(`The ${lock.unitType} unit may be incomplete. Run /gsd auto to re-run it.`);
-    }
-    else if (lock.unitType.includes("execute")) {
-        lines.push(`Task execution was interrupted. Run /gsd auto to resume — completed work is preserved.`);
-    }
-    else if (lock.unitType.includes("complete")) {
-        lines.push(`Slice/milestone completion was interrupted. Run /gsd auto to finish.`);
-    }
+    const hint = crashResumeHint(lock.unitType, lock.unitId);
+    if (hint)
+        lines.push(hint);
     return lines.join("\n");
 }
 /**