@opengsd/gsd-pi 1.4.0 → 1.5.0-dev.4fb2d460

package/src/resources/extensions/gsd/migrate-external.ts

@@ -9,7 +9,7 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSync, cpSync, rmSync, statSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
-import { externalGsdRoot, isInsideWorktree } from "./repo-identity.js";
+import { externalGsdRoot, externalStateAlreadyExistsForProject, isInsideWorktree } from "./repo-identity.js";
 import { getErrorMessage } from "./error-utils.js";
 import { hasGitTrackedGsdFiles } from "./gitignore.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
@@ -85,6 +85,16 @@ export function migrateToExternalState(basePath: string): MigrationResult {
     }
   }
 
+  // If external state already contains project data, this is not a legacy
+  // migration source. It is likely an already-migrated project whose symlink
+  // was replaced by a real directory, so copying would risk data loss.
+  if (externalStateAlreadyExistsForProject(basePath)) {
+    return {
+      migrated: false,
+      error: "External state already exists for this project; leaving local .gsd directory untouched to avoid overwriting authoritative state",
+    };
+  }
+
   const externalPath = externalGsdRoot(basePath);
   const migratingPath = join(basePath, ".gsd.migrating");
 
@@ -94,12 +104,12 @@ export function migrateToExternalState(basePath: string): MigrationResult {
 
     // Rename .gsd -> .gsd.migrating (atomic lock).
     // On Windows, NTFS may reject rename with EPERM if file descriptors are
-    // open (VS Code watchers, antivirus on-access scan). Fall back to
-    // copy+delete (#1292).
+    // open (VS Code watchers, antivirus on-access scan). WSL/DrvFs can report
+    // the same transient lock as EACCES. Fall back to copy+delete (#1292).
     try {
       renameSync(localGsd, migratingPath);
     } catch (renameErr: any) {
-      if (renameErr?.code === "EPERM" || renameErr?.code === "EBUSY") {
+      if (renameErr?.code === "EPERM" || renameErr?.code === "EBUSY" || renameErr?.code === "EACCES") {
         try {
           cpSync(localGsd, migratingPath, { recursive: true, force: true });
           rmSync(localGsd, { recursive: true, force: true });
@@ -237,7 +247,7 @@ function isLocalGsdExternalStateJunction(basePath: string, localGsd: string): bo
  * Recover from a failed migration (`.gsd.migrating` exists).
  * Moves `.gsd.migrating` back to `.gsd` if `.gsd` doesn't exist, or removes an
  * orphaned staging directory when `.gsd` is already a verified external state
- * junction with intact current state.
+ * junction, or an intact real directory, with intact current state.
  */
 export function recoverFailedMigration(basePath: string): boolean {
   const localGsd = join(basePath, ".gsd");
@@ -245,8 +255,15 @@ export function recoverFailedMigration(basePath: string): boolean {
 
   if (!existsSync(migratingPath)) return false;
   if (existsSync(localGsd)) {
-    if (!isLocalGsdExternalStateJunction(basePath, localGsd)) return false;
     if (!isCurrentGsdStateIntactForMigratingCleanup(basePath)) return false;
+    if (!isLocalGsdExternalStateJunction(basePath, localGsd)) {
+      try {
+        const stat = lstatSync(localGsd);
+        if (!stat.isDirectory()) return false;
+      } catch {
+        return false;
+      }
+    }
     try {
       rmSync(migratingPath, { recursive: true, force: true });
       return true;

package/src/resources/extensions/gsd/migration-auto-check.ts

@@ -102,13 +102,41 @@ function replaceSetPrefix(values: Set<string>, from: string, to: string): void {
   }
 }
 
+/**
+ * Rewrite one milestone identity across EVERY markdown identity set. The
+ * roadmapless subset is a view of `milestones`, so it must speak the same
+ * aligned vocabulary; otherwise the discussion-phase exclusion below keys off
+ * the stale bare id, fails its `dbScan.milestones.has(...)` membership check,
+ * and decrements the milestone count even though the aligned identity remains
+ * in the set, reporting false drift for a milestone that is actually in sync.
+ * Centralising the set list here keeps every alignment path from silently
+ * missing a set (the defect that regressed the suffixed roadmapless case).
+ */
+function realignMilestonePrefix(markdownScan: HierarchyScan, from: string, to: string): void {
+  replaceSetPrefix(markdownScan.milestones, from, to);
+  replaceSetPrefix(markdownScan.slices, from, to);
+  replaceSetPrefix(markdownScan.tasks, from, to);
+  replaceSetPrefix(markdownScan.milestonesWithoutRoadmap, from, to);
+}
+
 function alignNumericMarkdownIdsWithDb(markdownScan: HierarchyScan, dbScan: HierarchyScan): void {
   for (const dbId of dbScan.milestones) {
     const paddedId = paddedMilestoneId(dbId);
     if (!paddedId || dbScan.milestones.has(paddedId) || !markdownScan.milestones.has(paddedId)) continue;
-    replaceSetPrefix(markdownScan.milestones, paddedId, dbId);
-    replaceSetPrefix(markdownScan.slices, paddedId, dbId);
-    replaceSetPrefix(markdownScan.tasks, paddedId, dbId);
+    realignMilestonePrefix(markdownScan, paddedId, dbId);
+  }
+}
+
+function bareMilestoneId(id: string): string | null {
+  const match = id.match(/^(M\d{3})-[a-z0-9]{6}$/);
+  return match?.[1] ?? null;
+}
+
+function alignBareMarkdownIdsWithSuffixedDb(markdownScan: HierarchyScan, dbScan: HierarchyScan): void {
+  for (const dbId of dbScan.milestones) {
+    const bareId = bareMilestoneId(dbId);
+    if (!bareId || dbScan.milestones.has(bareId) || !markdownScan.milestones.has(bareId)) continue;
+    realignMilestonePrefix(markdownScan, bareId, dbId);
   }
 }
 
@@ -208,6 +236,7 @@ export async function checkMarkdownHierarchyAgainstDb(
   const dbScan = scanDbHierarchy();
   const beforeDb = dbScan.counts;
   alignNumericMarkdownIdsWithDb(markdownScan, dbScan);
+  alignBareMarkdownIdsWithSuffixedDb(markdownScan, dbScan);
 
   // Discussion-phase scratch: a milestone dir with no ROADMAP and no DB row is
   // a pre-registration discussion artifact (CONTEXT/CONTEXT-DRAFT only — the

package/src/resources/extensions/gsd/milestone-merge-transaction.ts

@@ -1,6 +1,8 @@
 // Project/App: gsd-pi
 // File Purpose: Process-level transaction wrapper for milestone merge closeout.
 
+import { mergeMilestoneToMain } from "./auto-worktree-merge.js";
+
 export interface MilestoneMergeTransactionResult {
   pushed: boolean;
   codeFilesChanged: boolean;
@@ -21,14 +23,14 @@ export type MilestoneMergeTransactionRunner = (
 ) => MilestoneMergeTransactionResult;
 
 export interface MilestoneMergeTransactionDeps {
-  mergeMilestoneToMain: MilestoneMergeTransactionRunner;
+  mergeMilestone: MilestoneMergeTransactionRunner;
 }
 
 export function runMilestoneMergeTransaction(
   deps: MilestoneMergeTransactionDeps,
   input: MilestoneMergeTransactionInput,
 ): MilestoneMergeTransactionResult {
-  return deps.mergeMilestoneToMain(
+  return deps.mergeMilestone(
     input.basePath,
     input.milestoneId,
     input.roadmapContent,
@@ -36,12 +38,25 @@ export function runMilestoneMergeTransaction(
 }
 
 export function createMilestoneMergeTransaction(
-  mergeMilestoneToMain: MilestoneMergeTransactionRunner,
+  mergeMilestone: MilestoneMergeTransactionRunner,
 ): MilestoneMergeTransactionRunner {
   return function mergeMilestoneTransaction(basePath, milestoneId, roadmapContent) {
     return runMilestoneMergeTransaction(
-      { mergeMilestoneToMain },
+      { mergeMilestone },
       { basePath, milestoneId, roadmapContent },
     );
   };
 }
+
+/**
+ * Production merge transaction adapter.
+ *
+ * This is the only production construction point that knows the legacy
+ * `auto-worktree.ts` merge primitive. Lifecycle callers depend on the
+ * transaction runner interface, not the legacy implementation module.
+ */
+export function createDefaultMilestoneMergeTransaction(
+  mergeMilestone: MilestoneMergeTransactionRunner = mergeMilestoneToMain,
+): MilestoneMergeTransactionRunner {
+  return createMilestoneMergeTransaction(mergeMilestone);
+}

package/src/resources/extensions/gsd/milestone-settlement.ts

@@ -1,7 +1,7 @@
 // Project/App: gsd-pi
 // File Purpose: Milestone closeout settlement state across DB proof, artifacts, merge, and cleanup.
 
-import { isInAutoWorktree } from "./auto-worktree.js";
+import { isInAutoWorktree } from "./auto-worktree-entry.js";
 import {
   formatCloseoutProofBlock,
   proveMilestoneCloseout,

package/src/resources/extensions/gsd/model-router.ts

@@ -24,11 +24,10 @@ export interface DynamicRoutingConfig {
   cross_provider?: boolean;        // default: true
   hooks?: boolean;                 // default: true
   /**
-   * Opt into dynamic routing for flat-rate providers (e.g. claude-code,
-   * GitHub Copilot). Default false preserves the #3453 bypass that skips
-   * routing when the subscription makes per-request cost identical.
-   * Enable only when you want per-task model selection across a flat-rate
-   * subscription (e.g. haiku for research, opus for architecture). (#4386)
+   * Override dynamic routing for flat-rate providers (e.g. claude-code,
+   * GitHub Copilot). Omit or set true to honor `dynamic_routing.enabled`;
+   * set false to preserve one-model dispatch when the subscription makes
+   * per-request cost identical.
    */
   allow_flat_rate_providers?: boolean;
 }

package/src/resources/extensions/gsd/parallel-merge.ts

@@ -10,7 +10,7 @@ import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { resolveGsdPathContract } from "./paths.js";
 import { worktreePathFor, worktreesDirs } from "./worktree-placement.js";
-import { getAutoWorktreePath } from "./auto-worktree.js";
+import { getAutoWorktreePath } from "./auto-worktree-path-resolution.js";
 import { buildWorktreeLifecycleDeps } from "./auto.js";
 import {
   mergeMilestoneStandalone,

package/src/resources/extensions/gsd/parallel-orchestrator.ts

@@ -21,7 +21,9 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gsdRoot } from "./paths.js";
 import { createWorktree, worktreePath } from "./worktree-manager.js";
-import { autoWorktreeBranch, fastForwardReusedMilestoneBranchIfSafe, runWorktreePostCreateHook, syncGsdStateToWorktreeByScope } from "./auto-worktree.js";
+import { autoWorktreeBranch, fastForwardReusedMilestoneBranchIfSafe } from "./auto-worktree-branch-lifecycle.js";
+import { syncGsdStateToWorktreeByScope } from "./auto-worktree-sync.js";
+import { runWorktreePostCreateHook } from "./worktree-post-create-hook.js";
 import { nativeBranchExists } from "./native-git-bridge.js";
 import { readIntegrationBranch } from "./git-service.js";
 import { createWorkspace, scopeMilestone } from "./workspace.js";

package/src/resources/extensions/gsd/paths.ts

@@ -696,7 +696,16 @@ function pickPreferredPhaseDir(phasesDir: string, matches: string[]): string {
   return best;
 }
 
-function phaseDirMatchesMilestoneId(dirName: string, milestoneId: string, phaseNum: number): boolean {
+function slugLooksLikeTeamSuffixProjection(slugPart: string): boolean {
+  return /^[a-z0-9]{6}(-|$)/.test(slugPart);
+}
+
+function phaseDirMatchesMilestoneId(
+  dirName: string,
+  milestoneId: string,
+  phaseNum: number,
+  allowTeamSuffixSlugs = false,
+): boolean {
   const numMatch = dirName.match(/^(\d+)-(.*)$/);
   if (!numMatch || parseInt(numMatch[1]!, 10) !== phaseNum) return false;
   const slugPart = numMatch[2]!;
@@ -704,8 +713,8 @@ function phaseDirMatchesMilestoneId(dirName: string, milestoneId: string, phaseN
   if (suffix) {
     return slugPart === suffix || slugPart.startsWith(`${suffix}-`);
   }
-  // Plain sequential IDs must not resolve to unique-suffix phase dirs.
-  return !/^[a-z0-9]{6}(-|$)/.test(slugPart);
+  if (slugLooksLikeTeamSuffixProjection(slugPart) && !allowTeamSuffixSlugs) return false;
+  return true;
 }
 
 function resolvePhaseDir(basePath: string, milestoneId: string): string | null {
@@ -726,6 +735,15 @@ function resolvePhaseDir(basePath: string, milestoneId: string): string | null {
           matches.push(entry.name);
         }
       }
+      // Bare milestone ids may only have a suffixed team-mode projection on disk.
+      if (matches.length === 0 && !milestoneIdUniqueSuffix(milestoneId)) {
+        for (const entry of readdirSync(phasesDir, { withFileTypes: true })) {
+          if (!entry.isDirectory()) continue;
+          if (phaseDirMatchesMilestoneId(entry.name, milestoneId, phaseNum, true)) {
+            matches.push(entry.name);
+          }
+        }
+      }
     } catch {
       // unreadable — fall through
     }

package/src/resources/extensions/gsd/preferences-diagnostics.ts

@@ -1,8 +1,10 @@
 import type { PreferenceDiagnostic } from "./preferences-types.js";
 import {
+  loadEffectiveGSDPreferences,
   loadGlobalGSDPreferences,
   loadProjectGSDPreferences,
 } from "./preferences.js";
+import { crossAxisPreferenceWarnings } from "./preferences-validation.js";
 
 interface PreferenceNotificationContext {
   ui: {
@@ -30,6 +32,28 @@ export function collectPreferenceDiagnostics(basePath?: string): PreferenceDiagn
     seen.add(signature);
     unique.push(diagnostic);
   }
+
+  const effective = loadEffectiveGSDPreferences(basePath);
+  if (effective) {
+    const existingMessages = new Set(unique.map((diagnostic) => diagnostic.message));
+    for (const message of crossAxisPreferenceWarnings(effective.preferences)) {
+      if (existingMessages.has(message)) continue;
+      const diagnostic: PreferenceDiagnostic = {
+        path: effective.path,
+        scope: effective.scope,
+        severity: "warning",
+        kind: "validation",
+        message,
+        sanitized: true,
+      };
+      const signature = preferenceDiagnosticSignature(diagnostic);
+      if (seen.has(signature)) continue;
+      seen.add(signature);
+      existingMessages.add(message);
+      unique.push(diagnostic);
+    }
+  }
+
   return unique;
 }
 

package/src/resources/extensions/gsd/preferences-models.ts

@@ -99,10 +99,13 @@ export function resolveModelWithFallbacksForUnit(
   basePath?: string,
   availableModelIds?: string[],
   preferredModelId?: string,
+  skipProfileDefaults = false,
 ): ResolvedModelConfig | undefined {
-  const loadOpts = availableModelIds !== undefined || preferredModelId !== undefined
-    ? { availableModelIds, preferredModelId }
-    : undefined;
+  const loadOpts = {
+    ...(availableModelIds !== undefined ? { availableModelIds } : {}),
+    ...(preferredModelId !== undefined ? { preferredModelId } : {}),
+    ...(skipProfileDefaults ? { skipProfileDefaults: true } : {}),
+  };
   const prefs = loadEffectiveGSDPreferences(basePath, loadOpts);
   const chain = phaseChainForUnit(unitType);
   if (!chain) return undefined;

package/src/resources/extensions/gsd/preferences-skills.ts

@@ -5,11 +5,11 @@
  * to absolute filesystem paths, plus skill discovery and staleness config.
  */
 
-import { existsSync, readdirSync } from "node:fs";
+import { existsSync, readdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, join } from "node:path";
+import { getSkillDirectories } from "@gsd/pi-coding-agent";
 import { gsdHome } from "./gsd-home.js";
-import { statSync } from "node:fs";
 
 import type {
   GSDPreferences,
@@ -25,26 +25,20 @@ export type { GSDSkillRule, SkillDiscoveryMode, SkillResolution, SkillResolution
 /**
  * Known skill directories for **preference reference resolution** (bare skill names).
  *
- * Search order (first match wins):
- * 1. ~/.gsd/agent/skills/ (GSD bundled)
- * 2. ~/.agents/skills/ (ecosystem global)
- * 3. .agents/skills/ (project ecosystem)
- * 4. ~/.claude/skills/ and .claude/skills/ (Claude Code compatibility)
+ * Sourced from the shared taxonomy (`@gsd/pi-coding-agent` `getSkillDirectories`)
+ * so preference resolution, mid-session discovery, and the PackageManager
+ * catalog all agree on which directories exist. The `method` is derived from
+ * each entry's scope.
  *
  * Note: the ResourceLoader catalog uses PackageManager precedence instead —
  * project `.gsd/skills` and `.agents/skills` can override bundled GSD skills
  * on name collision. See docs/dev/what-is-pi/09-the-customization-stack.md.
  */
 export function getSkillSearchDirs(cwd: string): Array<{ dir: string; method: SkillResolution["method"] }> {
-  const dirs: Array<{ dir: string; method: SkillResolution["method"] }> = [
-    { dir: join(gsdHome(), "agent", "skills"), method: "user-skill" },
-    { dir: join(homedir(), ".agents", "skills"), method: "user-skill" },
-    { dir: join(cwd, ".agents", "skills"), method: "project-skill" },
-    // Claude Code official skill directories
-    { dir: join(homedir(), ".claude", "skills"), method: "user-skill" },
-    { dir: join(cwd, ".claude", "skills"), method: "project-skill" },
-  ];
-  return dirs;
+  return getSkillDirectories({ cwd, gsdHome: gsdHome() }).map((entry) => ({
+    dir: entry.path,
+    method: entry.scope === "project" ? "project-skill" : "user-skill",
+  }));
 }
 
 /**

package/src/resources/extensions/gsd/preferences-types.ts

@@ -29,6 +29,33 @@ export interface ContextManagementConfig {
   tool_result_max_chars?: number;         // default: 800, range: 200-10000
 }
 
+/**
+ * User-tunable thresholds for the tool-call loop guard (#1198). Keeps the two
+ * guards separately configurable: the identical-args guard (catches real
+ * infinite loops) and the repeated-tool-name cap (catches improvisation loops,
+ * more likely to false-positive on legitimate automation). All fields are
+ * optional; omitted fields fall back to the built-in defaults so existing
+ * installs keep their current behavior. Also overridable via GSD_TOOL_LOOP_*
+ * environment variables.
+ */
+export interface ToolCallLoopGuardConfig {
+  /** Master switch for both guards. Default: true. */
+  enabled?: boolean;
+  /** Identical-args sliding-window guard. */
+  identical_args?: {
+    enabled?: boolean;                    // default: true
+    max_consecutive_calls?: number;       // default: 4, min: 1
+  };
+  /** Per-tool-name cap, independent of args. */
+  repeated_tool?: {
+    enabled?: boolean;                    // default: true
+    default_cap?: number;                 // default: 6, min: 1
+    repeatable_cap?: number;              // default: 15, min: 1
+    /** Additional tool names exempt from the per-tool cap (merged with built-in defaults). */
+    exempt_tools?: string[];
+  };
+}
+
 /**
  * Opt-in tool-output sandboxing for sub-sessions. When enabled, the gsd_exec
  * MCP tool runs scripts in an isolated subprocess and returns only a short
@@ -139,6 +166,7 @@ export const KNOWN_PREFERENCE_KEYS = new Set<string>([
   "min_request_interval_ms",
   "stale_commit_threshold_minutes",
   "context_management",
+  "tool_call_loop_guard",
   "experimental",
   "codebase",
   "slice_parallel",
@@ -440,6 +468,8 @@ export interface GSDPreferences {
    */
   context_window_override?: number;
   context_management?: ContextManagementConfig;
+  /** User-tunable tool-call loop guard thresholds (#1198). */
+  tool_call_loop_guard?: ToolCallLoopGuardConfig;
   /**
    * Tool-output sandboxing via gsd_exec. Keeps sub-session context windows
    * clean by running scripts in a subprocess and only surfacing a short

package/src/resources/extensions/gsd/preferences-validation.ts

@@ -51,6 +51,16 @@ const VALID_POST_UNIT_HOOK_ON_BLOCK_ACTIONS = new Set([
 ]);
 const VALID_GATE_EVALUATE_SLICE_GATES = new Set<string>(getGateIdsForTurn("gate-evaluate"));
 
+/** Cross-axis warnings that only apply to the effective (merged) preference shape. */
+export function crossAxisPreferenceWarnings(preferences: GSDPreferences): string[] {
+  if (preferences.mode === "team" && preferences.workspace?.mode === "parent") {
+    return [
+      "mode:team + workspace.mode:parent: team branch-push/PR resolves at the project root and will not push child repositories — see docs/dev/ADR-044",
+    ];
+  }
+  return [];
+}
+
 export function validatePreferences(preferences: GSDPreferences): {
   preferences: GSDPreferences;
   errors: string[];
@@ -509,8 +519,11 @@ export function validatePreferences(preferences: GSDPreferences): {
 
   // ─── Remote Questions ───────────────────────────────────────────────
   if (preferences.remote_questions !== undefined) {
-    if (preferences.remote_questions && typeof preferences.remote_questions === "object") {
-      validated.remote_questions = preferences.remote_questions;
+    const remoteQuestions = preferences.remote_questions as unknown;
+    if (typeof remoteQuestions === "object" && remoteQuestions !== null) {
+      validated.remote_questions = remoteQuestions as GSDPreferences["remote_questions"];
+    } else if (remoteQuestions === false) {
+      // Explicit disable for a globally-configured remote questions channel.
     } else {
       errors.push("remote_questions must be an object");
     }
@@ -781,6 +794,75 @@ export function validatePreferences(preferences: GSDPreferences): {
     }
   }
 
+  // ─── Tool-call loop guard (#1198) ────────────────────────────────────────
+  if (preferences.tool_call_loop_guard !== undefined) {
+    if (typeof preferences.tool_call_loop_guard === "object" && preferences.tool_call_loop_guard !== null) {
+      const g = preferences.tool_call_loop_guard as unknown as Record<string, unknown>;
+      const validGuard: Record<string, unknown> = {};
+
+      if (g.enabled !== undefined) {
+        if (typeof g.enabled === "boolean") validGuard.enabled = g.enabled;
+        else errors.push("tool_call_loop_guard.enabled must be a boolean");
+      }
+
+      if (g.identical_args !== undefined) {
+        if (typeof g.identical_args === "object" && g.identical_args !== null) {
+          const ia = g.identical_args as Record<string, unknown>;
+          const validIa: Record<string, unknown> = {};
+          if (ia.enabled !== undefined) {
+            if (typeof ia.enabled === "boolean") validIa.enabled = ia.enabled;
+            else errors.push("tool_call_loop_guard.identical_args.enabled must be a boolean");
+          }
+          if (ia.max_consecutive_calls !== undefined) {
+            const n = ia.max_consecutive_calls;
+            if (typeof n === "number" && Number.isInteger(n) && n >= 1) validIa.max_consecutive_calls = n;
+            else errors.push("tool_call_loop_guard.identical_args.max_consecutive_calls must be an integer >= 1");
+          }
+          if (Object.keys(validIa).length > 0) validGuard.identical_args = validIa;
+        } else {
+          errors.push("tool_call_loop_guard.identical_args must be an object");
+        }
+      }
+
+      if (g.repeated_tool !== undefined) {
+        if (typeof g.repeated_tool === "object" && g.repeated_tool !== null) {
+          const rt = g.repeated_tool as Record<string, unknown>;
+          const validRt: Record<string, unknown> = {};
+          if (rt.enabled !== undefined) {
+            if (typeof rt.enabled === "boolean") validRt.enabled = rt.enabled;
+            else errors.push("tool_call_loop_guard.repeated_tool.enabled must be a boolean");
+          }
+          if (rt.default_cap !== undefined) {
+            const n = rt.default_cap;
+            if (typeof n === "number" && Number.isInteger(n) && n >= 1) validRt.default_cap = n;
+            else errors.push("tool_call_loop_guard.repeated_tool.default_cap must be an integer >= 1");
+          }
+          if (rt.repeatable_cap !== undefined) {
+            const n = rt.repeatable_cap;
+            if (typeof n === "number" && Number.isInteger(n) && n >= 1) validRt.repeatable_cap = n;
+            else errors.push("tool_call_loop_guard.repeated_tool.repeatable_cap must be an integer >= 1");
+          }
+          if (rt.exempt_tools !== undefined) {
+            if (Array.isArray(rt.exempt_tools) && rt.exempt_tools.every((t) => typeof t === "string")) {
+              validRt.exempt_tools = rt.exempt_tools;
+            } else {
+              errors.push("tool_call_loop_guard.repeated_tool.exempt_tools must be an array of strings");
+            }
+          }
+          if (Object.keys(validRt).length > 0) validGuard.repeated_tool = validRt;
+        } else {
+          errors.push("tool_call_loop_guard.repeated_tool must be an object");
+        }
+      }
+
+      if (Object.keys(validGuard).length > 0) {
+        validated.tool_call_loop_guard = validGuard as any;
+      }
+    } else {
+      errors.push("tool_call_loop_guard must be an object");
+    }
+  }
+
   // ─── Context Mode (gsd_exec sandbox) ────────────────────────────────────
   if (preferences.context_mode !== undefined) {
     if (typeof preferences.context_mode === "object" && preferences.context_mode !== null) {
@@ -1495,6 +1577,17 @@ export function validatePreferences(preferences: GSDPreferences): {
     } else {
       errors.push("workspace must be an object");
     }
+
+    // parent mode is behavioral: it must coordinate at least one declared
+    // child repository. Without one it is indistinguishable from project
+    // mode, so reject it explicitly rather than silently degrading.
+    if (validated.workspace?.mode === "parent") {
+      const childRepoCount = validated.workspace.repositories ? Object.keys(validated.workspace.repositories).length : 0;
+      if (childRepoCount === 0) {
+        errors.push('workspace.mode "parent" requires at least one repository under workspace.repositories');
+      }
+    }
+
   }
 
   // ─── Enhanced Verification ──────────────────────────────────────────────────
@@ -1568,5 +1661,7 @@ export function validatePreferences(preferences: GSDPreferences): {
     }
   }
 
+  warnings.push(...crossAxisPreferenceWarnings(validated));
+
   return { preferences: validated, errors, warnings };
 }