@opengsd/gsd-pi 1.2.0-dev.844675c9 → 1.2.0-dev.8e6112e9

package/src/resources/extensions/gsd/worktree-reentry.ts

@@ -10,7 +10,7 @@ import { readdirSync } from "node:fs";
 
 import { enterAutoWorktree, getAutoWorktreePath } from "./auto-worktree.js";
 import { getIsolationMode } from "./preferences.js";
-import { worktreesDir } from "./worktree-manager.js";
+import { allWorktreesDirs } from "./worktree-manager.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "./worktree-root.js";
 
 interface LiveWorktree {
@@ -19,15 +19,18 @@ interface LiveWorktree {
 }
 
 /**
- * Enumerate the live (valid git) auto-worktrees under <projectRoot>/.gsd/worktrees/.
+ * Enumerate the live (valid git) auto-worktrees in the project's worktree
+ * containers (canonical .gsd-worktrees/ and legacy .gsd/worktrees/).
  * Reuses getAutoWorktreePath's validation so stray directories are ignored.
  */
 function liveMilestoneWorktrees(projectRoot: string): LiveWorktree[] {
-  let names: string[];
-  try {
-    names = readdirSync(worktreesDir(projectRoot));
-  } catch {
-    return [];
+  const names = new Set<string>();
+  for (const dir of allWorktreesDirs(projectRoot)) {
+    try {
+      for (const name of readdirSync(dir)) names.add(name);
+    } catch {
+      // container absent — skip
+    }
   }
   const live: LiveWorktree[] = [];
   for (const id of names) {

package/src/resources/extensions/gsd/worktree-root.ts

@@ -20,10 +20,17 @@ export function normalizeWorktreePathForCompare(path: string): string {
 }
 
 /**
- * Find the GSD worktree segment in both direct project layout and the
- * symlink-resolved external-state layout used by ~/.gsd/projects/<hash>.
+ * Find the GSD worktree segment in the canonical layout (.gsd-worktrees/),
+ * the legacy direct layout (.gsd/worktrees/), and the symlink-resolved
+ * external-state layout used by ~/.gsd/projects/<hash>.
  */
 export function findWorktreeSegment(normalizedPath: string): WorktreeSegment | null {
+  const canonicalMarker = "/.gsd-worktrees/";
+  const canonicalIdx = normalizedPath.indexOf(canonicalMarker);
+  if (canonicalIdx !== -1) {
+    return { gsdIdx: canonicalIdx, afterWorktrees: canonicalIdx + canonicalMarker.length };
+  }
+
   const directMarker = "/.gsd/worktrees/";
   const directIdx = normalizedPath.indexOf(directMarker);
   if (directIdx !== -1) {
@@ -62,6 +69,18 @@ export function isGsdWorktreePath(path: string): boolean {
   return findWorktreeSegment(path.replaceAll("\\", "/")) !== null;
 }
 
+/**
+ * Project-root prefix of a GSD worktree path, or null when the path is not
+ * inside a recognized worktree layout. Pure string split — no env handling,
+ * HOME guard, or filesystem fallbacks (resolveWorktreeProjectRoot adds
+ * those). Separator normalization is 1:1 on characters, so the prefix is
+ * sliced from the ORIGINAL string and keeps its separators.
+ */
+export function projectRootFromWorktreePath(path: string): string | null {
+  const segment = findWorktreeSegment(path.replaceAll("\\", "/"));
+  return segment ? path.slice(0, segment.gsdIdx) : null;
+}
+
 /**
  * When a milestone worktree lives under the external-state layout
  * (`<gsdHome>/projects/<hash>/worktrees/<MID>/`, or the `GSD_STATE_DIR`
@@ -72,7 +91,8 @@ export function isGsdWorktreePath(path: string): boolean {
 export function resolveExternalStateProjectGsdFromWorktreePath(projectPath: string): string | null {
   const normalized = resolve(projectPath).replaceAll("\\", "/");
 
-  // Direct layout — parent state is resolved via repoIdentity(git root).
+  // Canonical/direct layouts — parent state is resolved via repoIdentity(git root).
+  if (normalized.includes("/.gsd-worktrees/")) return null;
   if (normalized.includes("/.gsd/worktrees/") && !normalized.includes("/.gsd/projects/")) {
     return null;
   }
@@ -139,12 +159,15 @@ function resolveProjectRootFromPath(path: string): string {
     return resolveNearestBootstrappedGsdRoot(path) ?? resolveGitWorkingTreeRoot(path) ?? path;
   }
 
+  // Slice at the first `.gsd` boundary, but never past the worktree segment:
+  // in the canonical layout (`<root>/.gsd-worktrees/<MID>/.gsd/...`) the first
+  // `/.gsd/` occurrence is the worktree-local projection dir, not the project
+  // root's state dir.
   const sepChar = path.includes("\\") ? "\\" : "/";
   const gsdMarker = `${sepChar}.gsd${sepChar}`;
   const markerIdx = path.indexOf(gsdMarker);
-  const candidate = markerIdx !== -1
-    ? path.slice(0, markerIdx)
-    : path.slice(0, segment.gsdIdx);
+  const sliceIdx = markerIdx !== -1 ? Math.min(markerIdx, segment.gsdIdx) : segment.gsdIdx;
+  const candidate = path.slice(0, sliceIdx);
 
   const gsdHomeNorm = normalizeWorktreePathForCompare(gsdHome());
   const candidateGsdPath = normalizeWorktreePathForCompare(join(candidate, ".gsd"));

package/src/resources/extensions/gsd/worktree-safety.ts

@@ -6,6 +6,7 @@ import { execFileSync } from "node:child_process";
 import { join, resolve } from "node:path";
 
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
+import { worktreesDirs } from "./worktree-placement.js";
 import { listWorktrees } from "./worktree-manager.js";
 import { getCurrentBranch } from "./worktree.js";
 
@@ -158,10 +159,12 @@ export function createWorktreeSafetyModule(
       const projectRoot = resolve(input.projectRoot);
       const unitRoot = resolve(input.unitRoot);
       const isolationMode = input.isolationMode ?? "worktree";
-      const expectedRoot = isolationMode === "worktree"
-        ? join(projectRoot, ".gsd", "worktrees", milestoneId)
-        : projectRoot;
-      if (!samePath(unitRoot, expectedRoot)) {
+      // A milestone worktree may live in the canonical container or the
+      // legacy one (pre-placement-change worktrees keep their location).
+      const expectedRoots = isolationMode === "worktree"
+        ? worktreesDirs(projectRoot).map((dir) => join(dir, milestoneId))
+        : [projectRoot];
+      if (!expectedRoots.some((expectedRoot) => samePath(unitRoot, expectedRoot))) {
         return failure(
           "invalid-root",
           isolationMode === "worktree"
@@ -170,7 +173,7 @@ export function createWorktreeSafetyModule(
           isolationMode === "worktree"
             ? "Prepare the Unit in its canonical milestone worktree before allowing source writes."
             : "Run the Unit from the project root when worktree isolation is disabled.",
-          { expectedRoot, unitRoot },
+          { expectedRoot: expectedRoots[0], unitRoot },
         );
       }
 
@@ -215,52 +218,54 @@ export function createWorktreeSafetyModule(
       }
 
       let registered: readonly RegisteredWorktree[] | undefined;
-      try {
-        registered = deps.listRegisteredWorktrees?.(projectRoot);
-      } catch (error) {
-        return failure(
-          "worktree-git-probe-failed",
-          `Unable to list registered worktrees for project root ${projectRoot}.`,
-          "Recover or recreate the milestone worktree before dispatching the source-writing Unit.",
-          { projectRoot, error: errorMessage(error) },
-        );
-      }
-      if (registered && !registered.some((worktree) => samePath(worktree.path, unitRoot))) {
-        const wasPreviouslyTracked = unregisteredRecoveryFailed.has(unitRoot);
-        let attemptedPrune = false;
+      if (isolationMode === "worktree") {
+        try {
+          registered = deps.listRegisteredWorktrees?.(projectRoot);
+        } catch (error) {
+          return failure(
+            "worktree-git-probe-failed",
+            `Unable to list registered worktrees for project root ${projectRoot}.`,
+            "Recover or recreate the milestone worktree before dispatching the source-writing Unit.",
+            { projectRoot, error: errorMessage(error) },
+          );
+        }
+        if (registered && !registered.some((worktree) => samePath(worktree.path, unitRoot))) {
+          const wasPreviouslyTracked = unregisteredRecoveryFailed.has(unitRoot);
+          let attemptedPrune = false;
 
-        if (!wasPreviouslyTracked && deps.pruneRegisteredWorktrees) {
-          attemptedPrune = true;
-          try {
-            deps.pruneRegisteredWorktrees(projectRoot);
-            const rechecked = deps.listRegisteredWorktrees?.(projectRoot);
-            if (rechecked?.some((worktree) => samePath(worktree.path, unitRoot))) {
-              unregisteredRecoveryFailed.delete(unitRoot);
-              registered = rechecked;
-            } else {
+          if (!wasPreviouslyTracked && deps.pruneRegisteredWorktrees) {
+            attemptedPrune = true;
+            try {
+              deps.pruneRegisteredWorktrees(projectRoot);
+              const rechecked = deps.listRegisteredWorktrees?.(projectRoot);
+              if (rechecked?.some((worktree) => samePath(worktree.path, unitRoot))) {
+                unregisteredRecoveryFailed.delete(unitRoot);
+                registered = rechecked;
+              } else {
+                unregisteredRecoveryFailed.add(unitRoot);
+              }
+            } catch (error) {
               unregisteredRecoveryFailed.add(unitRoot);
+              return failure(
+                "worktree-git-probe-failed",
+                `Unable to recover unregistered worktree root ${unitRoot}.`,
+                "Run 'git worktree prune', then recreate or re-register the milestone worktree before dispatching the source-writing Unit.",
+                { projectRoot, unitRoot, error: errorMessage(error) },
+              );
             }
-          } catch (error) {
-            unregisteredRecoveryFailed.add(unitRoot);
+          }
+
+          if (!registered?.some((worktree) => samePath(worktree.path, unitRoot))) {
             return failure(
-              "worktree-git-probe-failed",
-              `Unable to recover unregistered worktree root ${unitRoot}.`,
-              "Run 'git worktree prune', then recreate the milestone worktree before dispatching the source-writing Unit.",
-              { projectRoot, unitRoot, error: errorMessage(error) },
+              "worktree-unregistered",
+              `Worktree root ${unitRoot} is not registered with git worktree list.`,
+              attemptedPrune || wasPreviouslyTracked
+                ? "Worktree recovery was attempted but the root is still unregistered. Recreate or re-register the milestone worktree before dispatching the source-writing Unit."
+                : "Run 'git worktree prune'. If still unregistered, recreate or re-register the milestone worktree before dispatching the source-writing Unit.",
+              { unitRoot, attemptedPrune, trackedAsFailed: unregisteredRecoveryFailed.has(unitRoot) },
             );
           }
         }
-
-        if (!registered?.some((worktree) => samePath(worktree.path, unitRoot))) {
-          return failure(
-            "worktree-unregistered",
-            `Worktree root ${unitRoot} is not registered with git worktree list.`,
-            attemptedPrune || wasPreviouslyTracked
-              ? "Worktree recovery was attempted but the root is still unregistered. Recreate or re-register the milestone worktree before dispatching the source-writing Unit."
-              : "Run 'git worktree prune'. If still unregistered, recreate or re-register the milestone worktree before dispatching the source-writing Unit.",
-            { unitRoot, attemptedPrune, trackedAsFailed: unregisteredRecoveryFailed.has(unitRoot) },
-          );
-        }
       }
 
       if (input.emptyWorktreeWithProjectContent) {

package/src/resources/extensions/gsd/worktree-session-state.ts

@@ -1,4 +1,6 @@
 // GSD worktree session state
+import { findWorktreeSegment, projectRootFromWorktreePath } from "./worktree-root.js";
+
 let originalCwd: string | null = null;
 
 export function getWorktreeOriginalCwd(): string | null {
@@ -15,21 +17,19 @@ export function clearWorktreeOriginalCwd(): void {
 
 export function ensureWorktreeOriginalCwdFromPath(cwd: string = process.cwd()): string | null {
   if (originalCwd) return originalCwd;
-  const marker = `${/\\/.test(cwd) ? "\\" : "/"}.gsd${/\\/.test(cwd) ? "\\" : "/"}worktrees${/\\/.test(cwd) ? "\\" : "/"}`;
-  const markerIdx = cwd.indexOf(marker);
-  if (markerIdx !== -1) {
-    originalCwd = cwd.slice(0, markerIdx);
-  }
+  const root = projectRootFromWorktreePath(cwd);
+  if (root) originalCwd = root;
   return originalCwd;
 }
 
 export function getActiveWorktreeName(): string | null {
   if (!originalCwd) return null;
-  const cwd = process.cwd();
-  const wtDir = `${originalCwd.replace(/[\\/]+$/, "")}/.gsd/worktrees`.replaceAll("\\", "/");
-  const normalizedCwd = cwd.replaceAll("\\", "/");
-  if (!normalizedCwd.startsWith(`${wtDir}/`)) return null;
-  const rel = normalizedCwd.slice(wtDir.length + 1);
-  const name = rel.split("/")[0];
+  const normalizedCwd = process.cwd().replaceAll("\\", "/");
+  const normalizedOriginal = originalCwd.replace(/[\\/]+$/, "").replaceAll("\\", "/");
+  const segment = findWorktreeSegment(normalizedCwd);
+  if (!segment) return null;
+  // Only treat the cwd as an active worktree of OUR project root.
+  if (normalizedCwd.slice(0, segment.gsdIdx) !== normalizedOriginal) return null;
+  const name = normalizedCwd.slice(segment.afterWorktrees).split("/")[0];
   return name || null;
 }

package/src/resources/extensions/gsd/worktree-state-projection.ts

@@ -74,6 +74,30 @@ const VERDICT_RE = /verdict:\s*[\w-]+/i;
  * Only overwrites when the source has a verdict — never clobbers a
  * worktree ASSESSMENT with a verdictless project-root copy.
  */
+function forceOverwriteValidationWithVerdict(
+  srcMilestoneDir: string,
+  dstMilestoneDir: string,
+  milestoneId: string,
+): void {
+  if (!existsSync(srcMilestoneDir) || !milestoneId) return;
+
+  const srcFile = join(srcMilestoneDir, `${milestoneId}-VALIDATION.md`);
+  if (!existsSync(srcFile)) return;
+
+  try {
+    const srcContent = readFileSync(srcFile, "utf-8");
+    if (!VERDICT_RE.test(srcContent)) return;
+
+    mkdirSync(dstMilestoneDir, { recursive: true });
+    safeCopy(srcFile, join(dstMilestoneDir, `${milestoneId}-VALIDATION.md`), { force: true });
+  } catch (err) {
+    logWarning(
+      "worktree",
+      `validation force-copy failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}
+
 function forceOverwriteAssessmentsWithVerdict(
   srcMilestoneDir: string,
   dstMilestoneDir: string,
@@ -260,10 +284,10 @@ export function _projectRootToWorktreeImpl(
   // session resume the DB is rebuilt from disk, and if the stale ASSESSMENT
   // persists, checkNeedsRunUat finds no passing verdict → re-dispatches
   // run-uat indefinitely (stuck-loop ×9).
-  forceOverwriteAssessmentsWithVerdict(
-    join(prGsd, "milestones", milestoneId),
-    join(wtGsd, "milestones", milestoneId),
-  );
+  const prMilestoneDir = join(prGsd, "milestones", milestoneId);
+  const wtMilestoneDir = join(wtGsd, "milestones", milestoneId);
+  forceOverwriteValidationWithVerdict(prMilestoneDir, wtMilestoneDir, milestoneId);
+  forceOverwriteAssessmentsWithVerdict(prMilestoneDir, wtMilestoneDir);
 
   // Forward-sync completed-units.json from project root to worktree.
   // Project root is authoritative for completion state after crash recovery;
@@ -442,25 +466,41 @@ export class WorktreeStateProjection {
    * any Unit dispatches.
    */
   projectRootToWorktree(scope: MilestoneScope): void {
-    _projectRootToWorktreeImpl(
+    this.projectRootToWorktreePaths(
       scope.workspace.projectRoot,
       scope.workspace.worktreeRoot ?? scope.workspace.projectRoot,
       scope.milestoneId,
     );
   }
 
+  projectRootToWorktreePaths(
+    projectRoot: string,
+    worktreePath: string,
+    milestoneId: string | null,
+  ): void {
+    _projectRootToWorktreeImpl(projectRoot, worktreePath, milestoneId);
+  }
+
   /**
    * Project state from the auto-worktree back onto the project root for `scope`.
    * Called by the post-unit pipeline between Units.
    */
   projectWorktreeToRoot(scope: MilestoneScope): void {
-    _projectWorktreeToRootImpl(
+    this.projectWorktreeToRootPaths(
       scope.workspace.worktreeRoot ?? scope.workspace.projectRoot,
       scope.workspace.projectRoot,
       scope.milestoneId,
     );
   }
 
+  projectWorktreeToRootPaths(
+    worktreePath: string,
+    projectRoot: string,
+    milestoneId: string | null,
+  ): void {
+    _projectWorktreeToRootImpl(worktreePath, projectRoot, milestoneId);
+  }
+
   /**
    * Final projection from the auto-worktree to the project root before
    * teardown. Called by Lifecycle's exit path after a successful merge,
@@ -471,10 +511,18 @@ export class WorktreeStateProjection {
    * telemetry on what crossed the boundary.
    */
   finalizeProjectionForMerge(scope: MilestoneScope): { synced: string[] } {
-    return _finalizeProjectionForMergeImpl(
+    return this.finalizeProjectionForMergePaths(
       scope.workspace.projectRoot,
       scope.workspace.worktreeRoot ?? scope.workspace.projectRoot,
       scope.milestoneId,
     );
   }
+
+  finalizeProjectionForMergePaths(
+    projectRoot: string,
+    worktreePath: string,
+    milestoneId: string,
+  ): { synced: string[] } {
+    return _finalizeProjectionForMergeImpl(projectRoot, worktreePath, milestoneId);
+  }
 }

package/src/resources/extensions/gsd/worktree-telemetry.ts

@@ -22,6 +22,7 @@
 import { randomUUID } from "node:crypto";
 import { emitJournalEvent, queryJournal } from "./journal.js";
 import type { JournalEntry } from "./journal.js";
+import type { AutoTerminalOutcome } from "./auto/contracts.js";
 
 function now(): string {
   return new Date().toISOString();
@@ -91,6 +92,21 @@ export function normalizeAutoExitReason(rawReason?: string): AutoExitReason {
                             : "other";
 }
 
+export function autoExitReasonForTerminalOutcome(
+  outcome: AutoTerminalOutcome | undefined,
+): AutoExitReason | null {
+  switch (outcome?.code) {
+    case "all-complete":
+      return "all-complete";
+    case "settlement-blocked":
+      return "blocked";
+    case "no-remaining-units":
+      return "stop";
+    default:
+      return null;
+  }
+}
+
 // ─── Emitters ────────────────────────────────────────────────────────────
 
 export function emitWorktreeCreated(

package/src/resources/extensions/gsd/worktree.ts

@@ -224,7 +224,13 @@ export function resolveGitHeadPath(dir: string): string | null {
  */
 export function nudgeGitBranchCache(previousCwd: string): void {
   const now = new Date();
-  for (const dir of [previousCwd, process.cwd()]) {
+  let currentCwd: string | null = null;
+  try {
+    currentCwd = process.cwd();
+  } catch {
+    currentCwd = null;
+  }
+  for (const dir of [previousCwd, currentCwd].filter((dir): dir is string => Boolean(dir))) {
     try {
       const headPath = resolveGitHeadPath(dir);
       if (headPath) utimesSync(headPath, now, now);

package/src/resources/extensions/mcp-client/manager.ts

@@ -105,6 +105,9 @@ const CHILD_ENV_ALLOWLIST = new Set([
 
 const MCP_STDERR_MAX_BYTES = 4096;
 
+/** Short-lived stdio probes must not register/kill production MCP PIDs (see probe-mode.ts). */
+export const GSD_MCP_PROBE_ENV = "GSD_MCP_PROBE";
+
 let cachedStatus: ManagedMcpStatus | null = null;
 let cachedStatusKey = "";
 
@@ -385,7 +388,10 @@ export async function testMcpServerConnection(
 			transport = new StdioClientTransport({
 				command: config.command ?? "",
 				args: config.args,
-				env: buildMcpChildEnv(config.env),
+				env: {
+					...buildMcpChildEnv(config.env),
+					[GSD_MCP_PROBE_ENV]: "1",
+				},
 				cwd: config.cwd,
 				stderr: "pipe",
 			});

package/src/resources/extensions/search-the-web/native-search.ts

@@ -243,9 +243,11 @@ export function registerNativeSearchHooks(pi: NativeSearchPI): { getIsAnthropic:
       // Anthropic-only tool never leaks into OpenAI Responses requests.
       isAnthropic = isAnthropicProvider && payloadLooksAnthropic !== false;
     } else {
-      // Last resort: session-restore paths where the SDK doesn't pass model.
-      // The model-name prefix is best-effort and assumes direct Anthropic.
-      isAnthropic = payloadLooksAnthropic === true;
+      // No authoritative provider info available (no event.model, no model_select).
+      // Do NOT inject native web_search — guessing on model name alone causes 400
+      // "unsupported_value" errors when the actual provider (copilot, openrouter,
+      // proxy, etc.) doesn't expose the server-side search tool (#648).
+      isAnthropic = false;
     }
     if (!isAnthropic) return;
 

package/src/resources/extensions/shared/browser-contract.ts

@@ -0,0 +1,66 @@
+// Project/App: gsd-pi
+// File Purpose: Browser Automation Contract — the single source for the canonical
+// Pi-facing browser tool vocabulary. Engine adapters (legacy Playwright, managed
+// gsd-browser), UAT policy, dispatch preflight, and evidence detection all derive
+// their browser tool knowledge from this module instead of re-listing names.
+
+/**
+ * Canonical `browser_*` tool names of the Browser Automation Contract.
+ *
+ * These are the product-level names Units see regardless of which Browser
+ * Automation Engine serves them (ADR-024). Adding a capability here is the
+ * one-line vocabulary change; the engine adapters and presentation surfaces
+ * are typed against this list, so missing coverage fails typecheck.
+ */
+export const BROWSER_CONTRACT_TOOL_NAMES = [
+  "browser_navigate",
+  "browser_click",
+  "browser_type",
+  "browser_fill_form",
+  "browser_click_ref",
+  "browser_fill_ref",
+  "browser_wait_for",
+  "browser_assert",
+  "browser_verify",
+  "browser_screenshot",
+  "browser_snapshot_refs",
+  "browser_find",
+  "browser_get_console_logs",
+  "browser_get_network_logs",
+  "browser_evaluate",
+  "browser_reload",
+  "browser_batch",
+  "browser_act",
+] as const;
+
+export type BrowserContractToolName = (typeof BROWSER_CONTRACT_TOOL_NAMES)[number];
+
+const BROWSER_CONTRACT_TOOL_NAME_SET: ReadonlySet<string> = new Set(BROWSER_CONTRACT_TOOL_NAMES);
+
+export function isBrowserContractToolName(name: string): name is BrowserContractToolName {
+  return BROWSER_CONTRACT_TOOL_NAME_SET.has(name);
+}
+
+/**
+ * Whether a canonical (non-MCP-prefixed) tool name belongs to the browser tool
+ * family. Broader than the contract list on purpose: an External MCP Client or
+ * host integration may supply additional `browser_*` tools that still satisfy
+ * browser-backed UAT.
+ */
+export function hasBrowserContractPrefix(canonicalToolName: string): boolean {
+  return canonicalToolName.startsWith("browser_");
+}
+
+/**
+ * Contract tool names whose appearance in prose marks browser-backed UAT
+ * activity (requirement or evidence language). Consumed by the
+ * browser-evidence regexes so textual detection stays derived from the
+ * contract vocabulary.
+ */
+export const BROWSER_EVIDENCE_SIGNAL_TOOL_NAMES = [
+  "browser_assert",
+  "browser_batch",
+  "browser_find",
+  "browser_verify",
+  "browser_snapshot_refs",
+] as const satisfies readonly BrowserContractToolName[];