@opengsd/gsd-pi 1.3.0-dev.eed73bea → 1.4.0-dev.5fc22c6f

package/dist/resources/extensions/gsd/doctor-engine-checks.js

@@ -1,12 +1,130 @@
-import { existsSync, statSync } from "node:fs";
-import { isDbAvailable, _getAdapter } from "./gsd-db.js";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
+import { getAllMilestones, getMilestoneSlices, getSliceTasks, isDbAvailable, isMemoriesFtsAvailable, _getAdapter, } from "./gsd-db.js";
+import { MEMORIES_FTS_REBUILT_KEY } from "./db-memory-fts-schema.js";
 import { isAfter, latestExplicitReopenAt } from "./milestone-reopen-events.js";
-import { resolveGsdPathContract, resolveMilestoneFile } from "./paths.js";
+import { gsdProjectionRoot, gsdRoot, resolveGsdPathContract, resolveMilestoneFile, resolveSliceFile } from "./paths.js";
 import { deriveState } from "./state.js";
+import { isClosedStatus } from "./status-guards.js";
 import { workflowEventLogPath } from "./workflow-event-ledger.js";
 import { readEvents } from "./workflow-events.js";
 import { flushWorkflowProjections } from "./projection-flush.js";
-export async function checkEngineHealth(basePath, issues, fixesApplied) {
+import { parseRoadmapSlices } from "./roadmap-slices.js";
+import { parsePlan } from "./parsers-legacy.js";
+const USER_AUTHORED_ARTIFACT_TYPES = new Set(["CONTEXT", "RESEARCH"]);
+function relativeFile(basePath, filePath) {
+    return relative(basePath, filePath).split("\\").join("/");
+}
+function normalizedArtifactType(artifactType) {
+    return artifactType.trim().toUpperCase();
+}
+function isUserAuthoredArtifactType(artifactType) {
+    return USER_AUTHORED_ARTIFACT_TYPES.has(normalizedArtifactType(artifactType));
+}
+function userContentRecoveryCommand(artifactType) {
+    return normalizedArtifactType(artifactType) === "CONTEXT" ? "/gsd discuss" : "/gsd auto";
+}
+function userContentMissingMessage(path, artifactType) {
+    const type = normalizedArtifactType(artifactType) || "UNKNOWN";
+    return `Artifact \`${path}\` is a user-authored ${type} file recorded in the database but missing from disk. Re-run \`${userContentRecoveryCommand(type)}\` in this milestone to regenerate it.`;
+}
+function reportCheckboxDbStatusDivergence(issues, basePath, filePath, scope, unitId, status, checkboxDone) {
+    const dbDone = isClosedStatus(status);
+    if (checkboxDone === dbDone)
+        return;
+    issues.push({
+        severity: "error",
+        code: "checkbox_db_status_divergence",
+        scope,
+        unitId,
+        message: `${scope === "slice" ? "Slice" : "Task"} ${unitId} is ${dbDone ? "closed" : "open"} in the database (status: ${status}) but the markdown checkbox is ${checkboxDone ? "checked" : "unchecked"}.`,
+        file: relativeFile(basePath, filePath),
+        fixable: false,
+    });
+}
+function checkProjectionCheckboxDbStatus(basePath, milestoneIds, issues) {
+    for (const milestoneId of milestoneIds) {
+        const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
+        const slices = getMilestoneSlices(milestoneId);
+        if (roadmapPath && existsSync(roadmapPath)) {
+            try {
+                const roadmap = readFileSync(roadmapPath, "utf-8");
+                const sliceDoneById = new Map(parseRoadmapSlices(roadmap).map((entry) => [entry.id, entry.done]));
+                for (const slice of slices) {
+                    const checkboxDone = sliceDoneById.get(slice.id);
+                    if (checkboxDone === undefined)
+                        continue;
+                    reportCheckboxDbStatusDivergence(issues, basePath, roadmapPath, "slice", `${milestoneId}/${slice.id}`, slice.status, checkboxDone);
+                }
+            }
+            catch {
+                // Non-fatal — checkbox drift diagnostics must never block doctor.
+            }
+        }
+        for (const slice of slices) {
+            const planPath = resolveSliceFile(basePath, milestoneId, slice.id, "PLAN");
+            if (!planPath || !existsSync(planPath))
+                continue;
+            try {
+                const plan = readFileSync(planPath, "utf-8");
+                // parsePlan reads the authoritative task checkboxes (the flat-phase
+                // <tasks> block / ## Tasks section), so a stray task-style checkbox
+                // line elsewhere in PLAN.md (e.g. a Must-Haves or Verification bullet
+                // above <tasks>) can no longer hide real drift or fake a divergence.
+                const taskDoneById = new Map(parsePlan(plan).tasks.map((entry) => [entry.id, entry.done]));
+                for (const task of getSliceTasks(milestoneId, slice.id)) {
+                    const checkboxDone = taskDoneById.get(task.id);
+                    if (checkboxDone === undefined)
+                        continue;
+                    reportCheckboxDbStatusDivergence(issues, basePath, planPath, "task", `${milestoneId}/${slice.id}/${task.id}`, task.status, checkboxDone);
+                }
+            }
+            catch {
+                // Non-fatal — checkbox drift diagnostics must never block doctor.
+            }
+        }
+    }
+}
+function isClearedByMilestoneShellProjectionFlush(basePath, issue, reRenderedMilestoneIds) {
+    if (issue.code !== "checkbox_db_status_divergence")
+        return false;
+    if (issue.scope !== "slice")
+        return false;
+    const milestoneId = issue.unitId.split("/")[0] ?? "";
+    if (!reRenderedMilestoneIds.has(milestoneId))
+        return false;
+    const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
+    if (!roadmapPath || !issue.file)
+        return false;
+    return issue.file === relativeFile(basePath, roadmapPath);
+}
+function artifactExistsOnDisk(basePath, artifactPath) {
+    if (isAbsolute(artifactPath))
+        return existsSync(artifactPath);
+    return [
+        join(gsdProjectionRoot(basePath), artifactPath),
+        join(gsdRoot(basePath), artifactPath),
+    ].some((candidate) => existsSync(candidate));
+}
+function artifactUnitId(row) {
+    if (!row.milestone_id)
+        return "project";
+    if (row.slice_id && row.task_id)
+        return `${row.milestone_id}/${row.slice_id}/${row.task_id}`;
+    if (row.slice_id)
+        return `${row.milestone_id}/${row.slice_id}`;
+    return row.milestone_id;
+}
+function artifactScope(row) {
+    if (row.task_id)
+        return "task";
+    if (row.slice_id)
+        return "slice";
+    if (row.milestone_id)
+        return "milestone";
+    return "project";
+}
+export async function checkEngineHealth(basePath, issues, fixesApplied, options) {
     const dbPath = resolveGsdPathContract(basePath).projectDb;
     if (!isDbAvailable() && existsSync(dbPath)) {
         issues.push({
@@ -23,6 +141,30 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
     try {
         if (isDbAvailable()) {
             const adapter = _getAdapter();
+            try {
+                if (isMemoriesFtsAvailable(adapter)) {
+                    const runtimeKv = adapter
+                        .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='runtime_kv'")
+                        .get();
+                    const marker = runtimeKv
+                        ? adapter.prepare("SELECT 1 as present FROM runtime_kv WHERE scope = 'global' AND scope_id = '' AND key = :key").get({ ":key": MEMORIES_FTS_REBUILT_KEY })
+                        : undefined;
+                    if (!marker) {
+                        issues.push({
+                            severity: "warning",
+                            code: "memories_fts_rebuild_missing",
+                            scope: "project",
+                            unitId: "project",
+                            message: `Memory full-text index exists but runtime_kv has no ${MEMORIES_FTS_REBUILT_KEY} marker. The index may be stale or incomplete, so memory search can silently degrade to the LIKE fallback.`,
+                            file: ".gsd/gsd.db",
+                            fixable: false,
+                        });
+                    }
+                }
+            }
+            catch {
+                // Non-fatal — memory FTS health check failed
+            }
             // a. Orphaned tasks (task.slice_id points to non-existent slice)
             try {
                 const orphanedTasks = adapter
@@ -172,7 +314,53 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
             catch {
                 // Non-fatal — completed-milestone reopen check failed
             }
-            // f. Completion artifacts disagree with open DB hierarchy rows.
+            // f. Artifact rows reference files that no longer exist on disk.
+            const missingUserContentArtifacts = [];
+            try {
+                const artifactRows = adapter
+                    .prepare(`SELECT path, artifact_type, milestone_id, slice_id, task_id
+             FROM artifacts
+             WHERE path != ''
+             ORDER BY path`)
+                    .all();
+                for (const row of artifactRows) {
+                    if (artifactExistsOnDisk(basePath, row.path))
+                        continue;
+                    const unitId = artifactUnitId(row);
+                    if (isUserAuthoredArtifactType(row.artifact_type)) {
+                        const artifactType = normalizedArtifactType(row.artifact_type);
+                        missingUserContentArtifacts.push({ path: row.path, artifactType });
+                        issues.push({
+                            severity: "warning",
+                            code: "artifact_user_content_missing",
+                            scope: artifactScope(row),
+                            unitId,
+                            message: userContentMissingMessage(row.path, artifactType),
+                            file: row.path,
+                            fixable: false,
+                        });
+                        continue;
+                    }
+                    issues.push({
+                        severity: "error",
+                        code: "artifact_file_missing",
+                        scope: artifactScope(row),
+                        unitId,
+                        message: `Artifact ${row.path} is recorded in the database as ${row.artifact_type || "UNKNOWN"} but no matching file exists on disk`,
+                        file: row.path,
+                        fixable: false,
+                    });
+                }
+            }
+            catch {
+                // Non-fatal — artifact file existence check failed
+            }
+            if (options?.repair) {
+                for (const artifact of missingUserContentArtifacts) {
+                    fixesApplied.push(`skipped user-authored ${artifact.artifactType} artifact ${artifact.path} (content cannot be regenerated from the database)`);
+                }
+            }
+            // g. Completion artifacts disagree with open DB hierarchy rows.
             try {
                 const rows = adapter
                     .prepare(`SELECT a.path, a.artifact_type, a.milestone_id, a.slice_id, a.task_id, a.imported_at,
@@ -189,6 +377,8 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
                     .all();
                 const seen = new Set();
                 for (const row of rows) {
+                    if (!artifactExistsOnDisk(basePath, row.path))
+                        continue;
                     const reopenAt = latestExplicitReopenAt(basePath, row.milestone_id);
                     if (!isAfter(row.imported_at, reopenAt))
                         continue;
@@ -223,9 +413,24 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
     catch {
         // Non-fatal — DB constraint checks failed entirely
     }
+    // Checkbox-vs-DB divergence detection runs before projection drift auto-fix
+    // so stale re-renders cannot overwrite manually edited markdown first. Runs
+    // inside its own try/catch: getAllMilestones / getMilestoneSlices /
+    // getSliceTasks issue prepared queries that can throw on a corrupt or locked
+    // DB, and like every other DB-touching check here this diagnostic must never
+    // block doctor.
+    try {
+        if (isDbAvailable()) {
+            checkProjectionCheckboxDbStatus(basePath, getAllMilestones().map((milestone) => milestone.id), issues);
+        }
+    }
+    catch {
+        // Non-fatal: checkbox-vs-DB divergence check must never block doctor
+    }
     // ── Projection drift detection ──────────────────────────────────────────
     // If the DB is available, check whether markdown projections are stale
     // relative to the event log and re-render them.
+    const reRenderedMilestoneIds = [];
     try {
         if (isDbAvailable()) {
             const eventLogPath = workflowEventLogPath(basePath);
@@ -241,6 +446,7 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
                         try {
                             await flushWorkflowProjections(basePath, { milestoneId: milestone.id });
                             fixesApplied.push(`re-rendered missing projections for ${milestone.id}`);
+                            reRenderedMilestoneIds.push(milestone.id);
                         }
                         catch {
                             // Non-fatal — projection re-render failed
@@ -252,6 +458,7 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
                         try {
                             await flushWorkflowProjections(basePath, { milestoneId: milestone.id });
                             fixesApplied.push(`re-rendered stale projections for ${milestone.id}`);
+                            reRenderedMilestoneIds.push(milestone.id);
                         }
                         catch {
                             // Non-fatal — projection re-render failed
@@ -264,4 +471,19 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
     catch {
         // Non-fatal — projection drift check must never block doctor
     }
+    if (reRenderedMilestoneIds.length > 0) {
+        const reRendered = new Set(reRenderedMilestoneIds);
+        for (let i = issues.length - 1; i >= 0; i--) {
+            const issue = issues[i];
+            // flushWorkflowProjections re-renders milestone shell projections (not
+            // slice PLAN.md files), so only clear stale ROADMAP checkbox diagnostics.
+            if (isClearedByMilestoneShellProjectionFlush(basePath, issue, reRendered)) {
+                issues.splice(i, 1);
+                continue;
+            }
+            if (issue.code === "artifact_file_missing" && issue.file && artifactExistsOnDisk(basePath, issue.file)) {
+                issues.splice(i, 1);
+            }
+        }
+    }
 }

package/dist/resources/extensions/gsd/doctor-providers.js

@@ -12,12 +12,13 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { access, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
 import { AuthStorage } from "@gsd/pi-coding-agent";
 import { getEnvApiKey } from "@gsd/pi-ai";
+import { isCursorAgentReadyUncached } from "../cursor-cli/readiness.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { getAuthPath, PROVIDER_REGISTRY, supportsBrowserOAuth } from "./key-manager.js";
-import { homedir } from "node:os";
 // ── Provider routing constants ────────────────────────────────────────────────
 /**
  * Providers that use external CLI authentication (not API keys).
@@ -27,6 +28,7 @@ const CLI_AUTH_PROVIDERS = new Set([
     "claude-code",
     "google-gemini-cli",
     "google-antigravity",
+    "cursor-agent",
 ]);
 /**
  * Providers that can serve models normally associated with another provider.
@@ -34,9 +36,9 @@ const CLI_AUTH_PROVIDERS = new Set([
  * e.g. GitHub Copilot subscriptions can access Claude and GPT models.
  */
 const PROVIDER_ROUTES = {
-    anthropic: ["github-copilot", "claude-code"],
-    openai: ["github-copilot", "openai-codex"],
-    google: ["google-antigravity", "google-gemini-cli"],
+    anthropic: ["github-copilot", "claude-code", "cursor-agent"],
+    openai: ["github-copilot", "openai-codex", "cursor-agent"],
+    google: ["google-antigravity", "google-gemini-cli", "cursor-agent"],
 };
 // ── Model → Provider ID mapping ───────────────────────────────────────────────
 /**
@@ -61,6 +63,7 @@ function modelToProviderId(model) {
             anthropic: "anthropic",
             openai: "openai",
             "github-copilot": "github-copilot",
+            "cursor-agent": "cursor-agent",
         };
         if (prefixMap[prefix])
             return prefixMap[prefix];
@@ -73,6 +76,8 @@ function modelToProviderId(model) {
         return "openai";
     if (lower.startsWith("gemini"))
         return "google";
+    if (lower.startsWith("composer"))
+        return "cursor-agent";
     if (lower.startsWith("llama") || lower.startsWith("mixtral"))
         return "groq";
     if (lower.startsWith("grok"))
@@ -129,10 +134,12 @@ const CLI_BINARY_MAP = {
     "claude-code": ["claude", "claude-code"],
     "google-gemini-cli": ["gemini"],
     "google-antigravity": ["agy"],
+    "cursor-agent": ["cursor-agent"],
 };
 const CLI_AUTH_PATH_CHECK_PROVIDERS = new Set([
     "google-gemini-cli",
     "google-antigravity",
+    "cursor-agent",
 ]);
 let asyncCliBinaryPathCache = null;
 function cliExecutableNames(providerId) {
@@ -173,6 +180,17 @@ function isCliBinaryInPath(providerId) {
     const pathDirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
     return pathDirs.some(dir => executableNames.some(name => existsSync(join(dir, name))));
 }
+function isExternalCliProviderReady(providerId) {
+    if (providerId === "cursor-agent")
+        return isCursorAgentReadyUncached();
+    return isCliBinaryInPath(providerId);
+}
+function cursorAgentFailureDetail() {
+    if (!isCliBinaryInPath("cursor-agent")) {
+        return "Install Cursor Agent and ensure `cursor-agent` is on PATH";
+    }
+    return "Run `cursor-agent login` or set CURSOR_API_KEY";
+}
 async function isCliBinaryInPathAsync(providerId) {
     const executableNames = cliExecutableNames(providerId);
     if (executableNames.length === 0)
@@ -293,6 +311,11 @@ function resolveKeyFromAuthOrEnv(providerId) {
     return null;
 }
 function resolveKey(providerId) {
+    if (providerId === "cursor-agent") {
+        return isExternalCliProviderReady(providerId)
+            ? { found: true, source: "env", backedOff: false }
+            : { found: false, source: "none", backedOff: false };
+    }
     const direct = resolveKeyFromAuthOrEnv(providerId);
     if (direct)
         return direct;
@@ -301,7 +324,7 @@ function resolveKey(providerId) {
     }
     // Cross-provider routes can use a local CLI when it is installed. Explicit
     // external CLI provider selections are handled in checkLlmProviders() below.
-    if (CLI_AUTH_PROVIDERS.has(providerId) && isCliBinaryInPath(providerId)) {
+    if (CLI_AUTH_PROVIDERS.has(providerId) && isExternalCliProviderReady(providerId)) {
         return { found: true, source: "env", backedOff: false };
     }
     return { found: false, source: "none", backedOff: false };
@@ -316,17 +339,22 @@ function checkLlmProviders() {
         if (CLI_AUTH_PROVIDERS.has(providerId)) {
             const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
             const label = info?.label ?? providerId;
-            if (CLI_AUTH_PATH_CHECK_PROVIDERS.has(providerId) && !isCliBinaryInPath(providerId)) {
+            if (CLI_AUTH_PATH_CHECK_PROVIDERS.has(providerId) && !isExternalCliProviderReady(providerId)) {
                 const binaries = CLI_BINARY_MAP[providerId]?.map(binary => `\`${binary}\``).join(" or ");
+                const detail = providerId === "cursor-agent"
+                    ? cursorAgentFailureDetail()
+                    : binaries
+                        ? `Install ${label} and ensure ${binaries} is on PATH`
+                        : `Install ${label} and ensure its CLI is on PATH`;
                 results.push({
                     name: providerId,
                     label,
                     category: "llm",
                     status: "error",
-                    message: `${label} — CLI not found`,
-                    detail: binaries
-                        ? `Install ${label} and ensure ${binaries} is on PATH`
-                        : `Install ${label} and ensure its CLI is on PATH`,
+                    message: providerId === "cursor-agent" && isCliBinaryInPath(providerId)
+                        ? `${label} — CLI not authenticated`
+                        : `${label} — CLI not found`,
+                    detail,
                     required: true,
                 });
                 continue;

package/dist/resources/extensions/gsd/doctor-runtime-checks.js

@@ -387,6 +387,9 @@ export async function checkRuntimeHealth(basePath, issues, fixesApplied, shouldF
             if (!existingLines.has(".gsd-worktrees/") && !existingLines.has(".gsd-worktrees")) {
                 missing.push(".gsd-worktrees/");
             }
+            if (!existingLines.has(".gsd-backups/") && !existingLines.has(".gsd-backups")) {
+                missing.push(".gsd-backups/");
+            }
             if (!hasBlanketIgnore) {
                 missing.push(...criticalPatterns.filter(p => !existingLines.has(p)));
             }

package/dist/resources/extensions/gsd/doctor.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, lstatSync, readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
 import { loadFile, parseSummary, saveFile, parseTaskPlanMustHaves, countMustHavesMentionedInSummary } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
 import { isDbAvailable, getMilestoneSlices, getSliceTasks } from "./gsd-db.js";
@@ -12,6 +13,8 @@ import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { collectPreferenceDiagnostics, formatPreferenceDiagnosticDetail } from "./preferences-diagnostics.js";
 import { isClosedStatus } from "./status-guards.js";
 import { GLOBAL_STATE_CODES } from "./doctor-types.js";
+import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
+import { createRepositoryRegistryFromPreferences } from "./repository-registry.js";
 import { checkGitHealth, checkRuntimeHealth, checkGlobalHealth, checkEngineHealth } from "./doctor-checks.js";
 import { checkEnvironmentHealth } from "./doctor-environment.js";
 import { runProviderChecks } from "./doctor-providers.js";
@@ -281,6 +284,92 @@ export async function readDoctorHistory(basePath, lastN = 50) {
         return [];
     }
 }
+/**
+ * Resolve the git working-tree root for a path, or null if it is not a repo.
+ * Used by the workspace-repository probe to check that a declared child path is
+ * itself a git repository (not merely nested inside the parent's repo).
+ */
+function resolveGitToplevel(cwd) {
+    try {
+        const out = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+            env: GIT_NO_PROMPT_ENV,
+        }).trim();
+        return out ? resolve(out) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** realpath that falls back to the resolved path if the link cannot be read. */
+function realpathSafe(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/**
+ * Parent-workspace probe (#818): validate that every declared child repository
+ * exists on disk and is a git repository at its own root. The registry only
+ * checks paths stay inside the project root; it never checks existence or
+ * git-ness, so a typo'd path (e.g. `frontned`) would otherwise build cleanly
+ * and silently produce "no problems found." No-op for single-repo projects.
+ */
+function checkWorkspaceRepositoryHealth(basePath, prefs, issues) {
+    if (prefs?.workspace?.mode !== "parent")
+        return;
+    let registry;
+    try {
+        registry = createRepositoryRegistryFromPreferences(basePath, prefs);
+    }
+    catch (err) {
+        issues.push({
+            severity: "error",
+            code: "invalid_preferences",
+            scope: "project",
+            unitId: "workspace",
+            message: `workspace registry failed to build: ${err instanceof Error ? err.message : String(err)}`,
+            fixable: false,
+        });
+        return;
+    }
+    for (const repo of registry.repositories) {
+        if (repo.id === "project")
+            continue;
+        if (!existsSync(repo.root)) {
+            issues.push({
+                severity: "error",
+                code: "workspace_repo_path_missing",
+                scope: "project",
+                unitId: `workspace.repositories.${repo.id}`,
+                message: `declared repository "${repo.id}" path does not exist on disk: ${repo.root}`,
+                fixable: false,
+            });
+            continue;
+        }
+        // Must be a repo at its OWN root — a plain dir nested in the parent repo
+        // would otherwise pass a bare `nativeIsRepo` check via the enclosing
+        // parent's .git. Compare on realpath so symlinked temp roots (macOS
+        // /var vs /private/var) don't cause a false mismatch.
+        const toplevel = resolveGitToplevel(repo.root);
+        const declaredReal = realpathSafe(repo.root);
+        const toplevelReal = toplevel ? realpathSafe(toplevel) : null;
+        if (toplevelReal !== declaredReal) {
+            issues.push({
+                severity: "warning",
+                code: "workspace_repo_not_a_repo",
+                scope: "project",
+                unitId: `workspace.repositories.${repo.id}`,
+                message: `declared repository "${repo.id}" path is not a git repository at its own root: ${repo.root}`,
+                fixable: false,
+            });
+        }
+    }
+}
 export async function runGSDDoctor(basePath, options) {
     const issues = [];
     const fixesApplied = [];
@@ -336,6 +425,7 @@ export async function runGSDDoctor(basePath, options) {
         (prefs?.preferences?.git?.isolation === "worktree" ? "worktree" :
             prefs?.preferences?.git?.isolation === "branch" ? "branch" : "none");
     await checkGitHealth(basePath, issues, fixesApplied, shouldFix, isolationMode, dryRun);
+    checkWorkspaceRepositoryHealth(basePath, prefs?.preferences, issues);
     const gitMs = Date.now() - t0git;
     // Runtime health checks — timed
     const t0runtime = Date.now();
@@ -352,7 +442,7 @@ export async function runGSDDoctor(basePath, options) {
     });
     const envMs = Date.now() - t0env;
     // Engine health checks — DB constraints and projection drift
-    await checkEngineHealth(basePath, issues, fixesApplied);
+    await checkEngineHealth(basePath, issues, fixesApplied, { repair: fix && !dryRun });
     const milestonesPath = milestonesDir(basePath);
     const legacyMilestonesPath2 = legacyMilestonesDir(basePath);
     if (!existsSync(milestonesPath) && !existsSync(legacyMilestonesPath2)) {

package/dist/resources/extensions/gsd/exec-sandbox.js

@@ -11,7 +11,8 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { resolve } from "node:path";
-import { killProcessTree, SIGKILL_GRACE_MS, HARD_DEADLINE_MS } from "@gsd/pi-coding-agent";
+import { getShellConfig, killProcessTree, SIGKILL_GRACE_MS, HARD_DEADLINE_MS } from "@gsd/pi-coding-agent";
+import { redactSecrets } from "./redact-secrets.js";
 const ALWAYS_FORWARD_ENV = ["PATH", "HOME"];
 // SIGKILL_GRACE_MS / HARD_DEADLINE_MS are imported from @gsd/pi-coding-agent
 // (shell.ts) — the single source of truth for the graceful-kill timing ladder —
@@ -60,7 +61,13 @@ function clampTimeout(request, opts) {
 function resolveCommand(runtime) {
     switch (runtime) {
         case "bash":
-            return { cmd: "bash", args: ["-c"] };
+            try {
+                const { shell, args } = getShellConfig();
+                return { cmd: shell, args };
+            }
+            catch {
+                return { cmd: "bash", args: ["-c"] };
+            }
         case "node":
             return { cmd: process.execPath, args: ["-e"] };
         case "python":
@@ -226,8 +233,11 @@ export function runExecSandbox(request, opts) {
             const stderrBuf = Buffer.concat(stderrChunks);
             const stdoutSuffix = stdoutTruncated ? "\n[truncated: stdout cap reached]\n" : "";
             const stderrSuffix = stderrTruncated ? "\n[truncated: stderr cap reached]\n" : "";
-            writeFileSync(stdoutPath, Buffer.concat([stdoutBuf, Buffer.from(stdoutSuffix, "utf-8")]));
-            writeFileSync(stderrPath, Buffer.concat([stderrBuf, Buffer.from(stderrSuffix, "utf-8")]));
+            // Redact secret-shaped substrings before persisting to .gsd/exec/ (skipped by
+            // the secret scanner). The returned digest is derived from the raw buffer
+            // below and is redacted downstream when the session is written to activity/.
+            writeFileSync(stdoutPath, redactSecrets(Buffer.concat([stdoutBuf, Buffer.from(stdoutSuffix, "utf-8")]).toString("utf-8")));
+            writeFileSync(stderrPath, redactSecrets(Buffer.concat([stderrBuf, Buffer.from(stderrSuffix, "utf-8")]).toString("utf-8")));
             const digestBody = tail(stdoutBuf, opts.digest_chars);
             const digest = digestBody.length > 0
                 ? digestBody