@opengsd/gsd-pi 1.4.0 → 1.5.0

package/dist/resources/extensions/gsd/doctor-engine-checks.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { isAbsolute, join, relative } from "node:path";
-import { getAllMilestones, getMilestoneSlices, getSliceTasks, isDbAvailable, isMemoriesFtsAvailable, _getAdapter, } from "./gsd-db.js";
+import { isAbsolute, join, relative, sep } from "node:path";
+import { deleteArtifactByPath, getAllMilestones, getMilestoneSlices, getSliceTasks, isDbAvailable, isMemoriesFtsAvailable, repairTaskCompletionFromSummary, _getAdapter, } from "./gsd-db.js";
 import { MEMORIES_FTS_REBUILT_KEY } from "./db-memory-fts-schema.js";
 import { isAfter, latestExplicitReopenAt } from "./milestone-reopen-events.js";
 import { gsdProjectionRoot, gsdRoot, resolveGsdPathContract, resolveMilestoneFile, resolveSliceFile } from "./paths.js";
@@ -11,9 +11,38 @@ import { readEvents } from "./workflow-events.js";
 import { flushWorkflowProjections } from "./projection-flush.js";
 import { parseRoadmapSlices } from "./roadmap-slices.js";
 import { parsePlan } from "./parsers-legacy.js";
+import { parseSummary } from "./files.js";
+const USER_AUTHORED_ARTIFACT_TYPES = new Set(["CONTEXT", "RESEARCH"]);
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function relativeFile(basePath, filePath) {
     return relative(basePath, filePath).split("\\").join("/");
 }
+function normalizedArtifactType(artifactType) {
+    return artifactType.trim().toUpperCase();
+}
+function isUserAuthoredArtifactType(artifactType) {
+    return USER_AUTHORED_ARTIFACT_TYPES.has(normalizedArtifactType(artifactType));
+}
+function userContentRecoveryCommand(artifactType) {
+    return normalizedArtifactType(artifactType) === "CONTEXT" ? "/gsd discuss" : "/gsd auto";
+}
+function userContentMissingMessage(path, artifactType) {
+    const type = normalizedArtifactType(artifactType) || "UNKNOWN";
+    return `Artifact \`${path}\` is a user-authored ${type} file recorded in the database but missing from disk. Re-run \`${userContentRecoveryCommand(type)}\` in this milestone to regenerate it.`;
+}
+function artifactPathRelativeToGsd(artifactPath) {
+    const parts = artifactPath.split(/[\\/]+/);
+    const gsdIndex = parts.lastIndexOf(".gsd");
+    if (gsdIndex < 0 || gsdIndex === parts.length - 1)
+        return artifactPath;
+    return parts.slice(gsdIndex + 1).join("/");
+}
+function isPathInside(basePath, candidatePath) {
+    const rel = relative(basePath, candidatePath);
+    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
 function reportCheckboxDbStatusDivergence(issues, basePath, filePath, scope, unitId, status, checkboxDone) {
     const dbDone = isClosedStatus(status);
     if (checkboxDone === dbDone)
@@ -85,12 +114,97 @@ function isClearedByMilestoneShellProjectionFlush(basePath, issue, reRenderedMil
     return issue.file === relativeFile(basePath, roadmapPath);
 }
 function artifactExistsOnDisk(basePath, artifactPath) {
-    if (isAbsolute(artifactPath))
-        return existsSync(artifactPath);
-    return [
-        join(gsdProjectionRoot(basePath), artifactPath),
-        join(gsdRoot(basePath), artifactPath),
-    ].some((candidate) => existsSync(candidate));
+    return resolveArtifactDiskPath(basePath, artifactPath) !== null;
+}
+function resolveArtifactDiskPath(basePath, artifactPath) {
+    const relativeArtifactPath = artifactPathRelativeToGsd(artifactPath);
+    if (isAbsolute(relativeArtifactPath)) {
+        return existsSync(relativeArtifactPath) ? relativeArtifactPath : null;
+    }
+    for (const root of [gsdProjectionRoot(basePath), gsdRoot(basePath)]) {
+        const candidate = join(root, relativeArtifactPath);
+        if (isPathInside(root, candidate) && existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+function taskExistsInPlan(basePath, milestoneId, sliceId, taskId) {
+    const planPath = resolveSliceFile(basePath, milestoneId, sliceId, "PLAN");
+    if (!planPath || !existsSync(planPath))
+        return false;
+    try {
+        return parsePlan(readFileSync(planPath, "utf-8")).tasks.some((task) => task.id === taskId);
+    }
+    catch {
+        return false;
+    }
+}
+function isPassingVerificationResult(value) {
+    const normalized = value.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    if (/\b(fail(?:ed|ing)?|error|blocked|mixed|untested)\b/.test(normalized))
+        return false;
+    if (/\b(?:not|never|no|didn't|did\s+not|cannot|can't|won't|couldn't)\s+(?:\w+\s+){0,3}?(?:pass(?:ed|ing)?|success(?:ful)?|succeeded)\b/.test(normalized)) {
+        return false;
+    }
+    return /\b(pass(?:ed|ing)?|success(?:ful)?|succeeded)\b/.test(normalized) || normalized === "all-pass";
+}
+function readTaskCompletionEvidenceFromSummary(basePath, row) {
+    if (!row.slice_id || !row.task_id)
+        return null;
+    if (!row.task_status && Number(row.task_count) > 0 && !taskExistsInPlan(basePath, row.milestone_id, row.slice_id, row.task_id)) {
+        return null;
+    }
+    const diskPath = resolveArtifactDiskPath(basePath, row.path);
+    if (!diskPath)
+        return null;
+    try {
+        const fullSummaryMd = readFileSync(diskPath, "utf-8");
+        const summary = parseSummary(fullSummaryMd);
+        const fm = summary.frontmatter;
+        if (fm.id !== row.task_id || fm.parent !== row.slice_id || fm.milestone !== row.milestone_id)
+            return null;
+        if (fm.blocker_discovered)
+            return null;
+        if (!isPassingVerificationResult(fm.verification_result))
+            return null;
+        const completedAt = fm.completed_at.trim();
+        if (!completedAt || !Number.isFinite(Date.parse(completedAt)))
+            return null;
+        return {
+            completedAt,
+            verificationResult: fm.verification_result.trim(),
+            title: summary.title.replace(new RegExp(`^${escapeRegExp(row.task_id)}:\\s*`), "").trim(),
+            oneLiner: summary.oneLiner,
+            narrative: summary.whatHappened,
+            duration: fm.duration,
+            blockerDiscovered: fm.blocker_discovered,
+            deviations: summary.deviations,
+            knownIssues: summary.knownLimitations,
+            keyFiles: fm.key_files.filter((file) => file !== "(none)"),
+            keyDecisions: fm.key_decisions.filter((decision) => decision !== "(none)"),
+            fullSummaryMd,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function repairTaskArtifactDbStatusDivergence(basePath, row) {
+    const evidence = readTaskCompletionEvidenceFromSummary(basePath, row);
+    if (!evidence || !row.slice_id || !row.task_id)
+        return false;
+    repairTaskCompletionFromSummary({
+        milestoneId: row.milestone_id,
+        sliceId: row.slice_id,
+        taskId: row.task_id,
+        ...evidence,
+    });
+    return true;
+}
+function artifactDbStatusDivergenceFixable(basePath, row) {
+    return readTaskCompletionEvidenceFromSummary(basePath, row) !== null;
 }
 function artifactUnitId(row) {
     if (!row.milestone_id)
@@ -110,7 +224,39 @@ function artifactScope(row) {
         return "milestone";
     return "project";
 }
-export async function checkEngineHealth(basePath, issues, fixesApplied) {
+function sameArtifactIdentity(left, right) {
+    return left.artifact_type === right.artifact_type &&
+        left.milestone_id === right.milestone_id &&
+        left.slice_id === right.slice_id &&
+        left.task_id === right.task_id;
+}
+function isMilestonesArtifactPath(artifactPath) {
+    return artifactPathRelativeToGsd(artifactPath).startsWith("milestones/");
+}
+function expectedMilestonesArtifactPath(row) {
+    if (!row.milestone_id)
+        return null;
+    const artifactType = normalizedArtifactType(row.artifact_type);
+    if (!artifactType)
+        return null;
+    if (row.slice_id && row.task_id) {
+        return `milestones/${row.milestone_id}/slices/${row.slice_id}/tasks/${row.task_id}-${artifactType}.md`;
+    }
+    if (row.slice_id) {
+        return `milestones/${row.milestone_id}/slices/${row.slice_id}/${row.slice_id}-${artifactType}.md`;
+    }
+    return `milestones/${row.milestone_id}/${row.milestone_id}-${artifactType}.md`;
+}
+function hasPresentMilestonesReplacement(basePath, row, artifactRows) {
+    const expectedPath = expectedMilestonesArtifactPath(row);
+    if (expectedPath && artifactExistsOnDisk(basePath, expectedPath))
+        return true;
+    return artifactRows.some((other) => other.path !== row.path &&
+        isMilestonesArtifactPath(other.path) &&
+        sameArtifactIdentity(row, other) &&
+        artifactExistsOnDisk(basePath, other.path));
+}
+export async function checkEngineHealth(basePath, issues, fixesApplied, options) {
     const dbPath = resolveGsdPathContract(basePath).projectDb;
     if (!isDbAvailable() && existsSync(dbPath)) {
         issues.push({
@@ -301,6 +447,7 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
                 // Non-fatal — completed-milestone reopen check failed
             }
             // f. Artifact rows reference files that no longer exist on disk.
+            const missingUserContentArtifacts = [];
             try {
                 const artifactRows = adapter
                     .prepare(`SELECT path, artifact_type, milestone_id, slice_id, task_id
@@ -312,20 +459,48 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
                     if (artifactExistsOnDisk(basePath, row.path))
                         continue;
                     const unitId = artifactUnitId(row);
+                    const issuePath = artifactPathRelativeToGsd(row.path);
+                    if (options?.repair && issuePath.startsWith("phases/") && hasPresentMilestonesReplacement(basePath, row, artifactRows)) {
+                        // Route the write through the Single Writer owner (gsd-db.ts) instead
+                        // of issuing raw DELETE SQL here — doctor is a read-only consumer and
+                        // the single-writer invariant forbids write SQL outside the allowlist.
+                        deleteArtifactByPath(row.path);
+                        fixesApplied.push(`pruned stale flat-phase artifact row ${row.path}`);
+                        continue;
+                    }
+                    if (isUserAuthoredArtifactType(row.artifact_type)) {
+                        const artifactType = normalizedArtifactType(row.artifact_type);
+                        missingUserContentArtifacts.push({ path: issuePath, artifactType });
+                        issues.push({
+                            severity: "warning",
+                            code: "artifact_user_content_missing",
+                            scope: artifactScope(row),
+                            unitId,
+                            message: userContentMissingMessage(issuePath, artifactType),
+                            file: issuePath,
+                            fixable: false,
+                        });
+                        continue;
+                    }
                     issues.push({
                         severity: "error",
                         code: "artifact_file_missing",
                         scope: artifactScope(row),
                         unitId,
-                        message: `Artifact ${row.path} is recorded in the database as ${row.artifact_type || "UNKNOWN"} but no matching file exists on disk`,
-                        file: row.path,
-                        fixable: false,
+                        message: `Artifact ${issuePath} is recorded in the database as ${row.artifact_type || "UNKNOWN"} but no matching file exists on disk`,
+                        file: issuePath,
+                        fixable: issuePath.startsWith("phases/") && hasPresentMilestonesReplacement(basePath, row, artifactRows),
                     });
                 }
             }
             catch {
                 // Non-fatal — artifact file existence check failed
             }
+            if (options?.repair) {
+                for (const artifact of missingUserContentArtifacts) {
+                    fixesApplied.push(`skipped user-authored ${artifact.artifactType} artifact ${artifact.path} (content cannot be regenerated from the database)`);
+                }
+            }
             // g. Completion artifacts disagree with open DB hierarchy rows.
             try {
                 const rows = adapter
@@ -361,13 +536,30 @@ export async function checkEngineHealth(basePath, issues, fixesApplied) {
                     if (seen.has(unitId))
                         continue;
                     seen.add(unitId);
+                    const fixable = artifactDbStatusDivergenceFixable(basePath, row);
+                    let repairFailed = false;
+                    if (options?.repair && fixable) {
+                        try {
+                            if (repairTaskArtifactDbStatusDivergence(basePath, row)) {
+                                fixesApplied.push(`repaired task completion from SUMMARY artifact for ${unitId}`);
+                                continue;
+                            }
+                        }
+                        catch {
+                            repairFailed = true;
+                        }
+                    }
                     issues.push({
                         severity: "error",
                         code: "artifact_db_status_divergence",
                         scope: row.task_id ? "task" : row.slice_id ? "slice" : "milestone",
                         unitId,
-                        message: `Completion artifact ${row.path} exists while DB state for ${unitId} is still open or missing. Runtime will not import it silently; run explicit recovery/repair after review.`,
-                        fixable: false,
+                        message: repairFailed
+                            ? `Completion artifact ${row.path} exists while DB state for ${unitId} is still open or missing. Doctor found valid SUMMARY completion evidence but could not repair the database state.`
+                            : fixable
+                                ? `Completion artifact ${row.path} exists while DB state for ${unitId} is still open or missing. Doctor can repair this from the SUMMARY completion evidence.`
+                                : `Completion artifact ${row.path} exists while DB state for ${unitId} is still open or missing. Runtime will not import it silently; run explicit recovery/repair after review.`,
+                        fixable,
                     });
                 }
             }

package/dist/resources/extensions/gsd/doctor-providers.js

@@ -12,12 +12,13 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { access, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
 import { AuthStorage } from "@gsd/pi-coding-agent";
 import { getEnvApiKey } from "@gsd/pi-ai";
+import { isCursorAgentReadyUncached } from "../cursor-cli/readiness.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { getAuthPath, PROVIDER_REGISTRY, supportsBrowserOAuth } from "./key-manager.js";
-import { homedir } from "node:os";
 // ── Provider routing constants ────────────────────────────────────────────────
 /**
  * Providers that use external CLI authentication (not API keys).
@@ -27,6 +28,7 @@ const CLI_AUTH_PROVIDERS = new Set([
     "claude-code",
     "google-gemini-cli",
     "google-antigravity",
+    "cursor-agent",
 ]);
 /**
  * Providers that can serve models normally associated with another provider.
@@ -34,9 +36,9 @@ const CLI_AUTH_PROVIDERS = new Set([
  * e.g. GitHub Copilot subscriptions can access Claude and GPT models.
  */
 const PROVIDER_ROUTES = {
-    anthropic: ["github-copilot", "claude-code"],
-    openai: ["github-copilot", "openai-codex"],
-    google: ["google-antigravity", "google-gemini-cli"],
+    anthropic: ["github-copilot", "claude-code", "cursor-agent"],
+    openai: ["github-copilot", "openai-codex", "cursor-agent"],
+    google: ["google-antigravity", "google-gemini-cli", "cursor-agent"],
 };
 // ── Model → Provider ID mapping ───────────────────────────────────────────────
 /**
@@ -61,6 +63,7 @@ function modelToProviderId(model) {
             anthropic: "anthropic",
             openai: "openai",
             "github-copilot": "github-copilot",
+            "cursor-agent": "cursor-agent",
         };
         if (prefixMap[prefix])
             return prefixMap[prefix];
@@ -73,6 +76,8 @@ function modelToProviderId(model) {
         return "openai";
     if (lower.startsWith("gemini"))
         return "google";
+    if (lower.startsWith("composer"))
+        return "cursor-agent";
     if (lower.startsWith("llama") || lower.startsWith("mixtral"))
         return "groq";
     if (lower.startsWith("grok"))
@@ -129,10 +134,12 @@ const CLI_BINARY_MAP = {
     "claude-code": ["claude", "claude-code"],
     "google-gemini-cli": ["gemini"],
     "google-antigravity": ["agy"],
+    "cursor-agent": ["cursor-agent"],
 };
 const CLI_AUTH_PATH_CHECK_PROVIDERS = new Set([
     "google-gemini-cli",
     "google-antigravity",
+    "cursor-agent",
 ]);
 let asyncCliBinaryPathCache = null;
 function cliExecutableNames(providerId) {
@@ -173,6 +180,17 @@ function isCliBinaryInPath(providerId) {
     const pathDirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
     return pathDirs.some(dir => executableNames.some(name => existsSync(join(dir, name))));
 }
+function isExternalCliProviderReady(providerId) {
+    if (providerId === "cursor-agent")
+        return isCursorAgentReadyUncached();
+    return isCliBinaryInPath(providerId);
+}
+function cursorAgentFailureDetail() {
+    if (!isCliBinaryInPath("cursor-agent")) {
+        return "Install Cursor Agent and ensure `cursor-agent` is on PATH";
+    }
+    return "Run `cursor-agent login` or set CURSOR_API_KEY";
+}
 async function isCliBinaryInPathAsync(providerId) {
     const executableNames = cliExecutableNames(providerId);
     if (executableNames.length === 0)
@@ -293,6 +311,11 @@ function resolveKeyFromAuthOrEnv(providerId) {
     return null;
 }
 function resolveKey(providerId) {
+    if (providerId === "cursor-agent") {
+        return isExternalCliProviderReady(providerId)
+            ? { found: true, source: "env", backedOff: false }
+            : { found: false, source: "none", backedOff: false };
+    }
     const direct = resolveKeyFromAuthOrEnv(providerId);
     if (direct)
         return direct;
@@ -301,7 +324,7 @@ function resolveKey(providerId) {
     }
     // Cross-provider routes can use a local CLI when it is installed. Explicit
     // external CLI provider selections are handled in checkLlmProviders() below.
-    if (CLI_AUTH_PROVIDERS.has(providerId) && isCliBinaryInPath(providerId)) {
+    if (CLI_AUTH_PROVIDERS.has(providerId) && isExternalCliProviderReady(providerId)) {
         return { found: true, source: "env", backedOff: false };
     }
     return { found: false, source: "none", backedOff: false };
@@ -316,17 +339,22 @@ function checkLlmProviders() {
         if (CLI_AUTH_PROVIDERS.has(providerId)) {
             const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
             const label = info?.label ?? providerId;
-            if (CLI_AUTH_PATH_CHECK_PROVIDERS.has(providerId) && !isCliBinaryInPath(providerId)) {
+            if (CLI_AUTH_PATH_CHECK_PROVIDERS.has(providerId) && !isExternalCliProviderReady(providerId)) {
                 const binaries = CLI_BINARY_MAP[providerId]?.map(binary => `\`${binary}\``).join(" or ");
+                const detail = providerId === "cursor-agent"
+                    ? cursorAgentFailureDetail()
+                    : binaries
+                        ? `Install ${label} and ensure ${binaries} is on PATH`
+                        : `Install ${label} and ensure its CLI is on PATH`;
                 results.push({
                     name: providerId,
                     label,
                     category: "llm",
                     status: "error",
-                    message: `${label} — CLI not found`,
-                    detail: binaries
-                        ? `Install ${label} and ensure ${binaries} is on PATH`
-                        : `Install ${label} and ensure its CLI is on PATH`,
+                    message: providerId === "cursor-agent" && isCliBinaryInPath(providerId)
+                        ? `${label} — CLI not authenticated`
+                        : `${label} — CLI not found`,
+                    detail,
                     required: true,
                 });
                 continue;

package/dist/resources/extensions/gsd/doctor.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, lstatSync, readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
 import { loadFile, parseSummary, saveFile, parseTaskPlanMustHaves, countMustHavesMentionedInSummary } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
 import { isDbAvailable, getMilestoneSlices, getSliceTasks } from "./gsd-db.js";
@@ -12,6 +13,8 @@ import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { collectPreferenceDiagnostics, formatPreferenceDiagnosticDetail } from "./preferences-diagnostics.js";
 import { isClosedStatus } from "./status-guards.js";
 import { GLOBAL_STATE_CODES } from "./doctor-types.js";
+import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
+import { createRepositoryRegistryFromPreferences } from "./repository-registry.js";
 import { checkGitHealth, checkRuntimeHealth, checkGlobalHealth, checkEngineHealth } from "./doctor-checks.js";
 import { checkEnvironmentHealth } from "./doctor-environment.js";
 import { runProviderChecks } from "./doctor-providers.js";
@@ -281,6 +284,92 @@ export async function readDoctorHistory(basePath, lastN = 50) {
         return [];
     }
 }
+/**
+ * Resolve the git working-tree root for a path, or null if it is not a repo.
+ * Used by the workspace-repository probe to check that a declared child path is
+ * itself a git repository (not merely nested inside the parent's repo).
+ */
+function resolveGitToplevel(cwd) {
+    try {
+        const out = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+            env: GIT_NO_PROMPT_ENV,
+        }).trim();
+        return out ? resolve(out) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** realpath that falls back to the resolved path if the link cannot be read. */
+function realpathSafe(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/**
+ * Parent-workspace probe (#818): validate that every declared child repository
+ * exists on disk and is a git repository at its own root. The registry only
+ * checks paths stay inside the project root; it never checks existence or
+ * git-ness, so a typo'd path (e.g. `frontned`) would otherwise build cleanly
+ * and silently produce "no problems found." No-op for single-repo projects.
+ */
+function checkWorkspaceRepositoryHealth(basePath, prefs, issues) {
+    if (prefs?.workspace?.mode !== "parent")
+        return;
+    let registry;
+    try {
+        registry = createRepositoryRegistryFromPreferences(basePath, prefs);
+    }
+    catch (err) {
+        issues.push({
+            severity: "error",
+            code: "invalid_preferences",
+            scope: "project",
+            unitId: "workspace",
+            message: `workspace registry failed to build: ${err instanceof Error ? err.message : String(err)}`,
+            fixable: false,
+        });
+        return;
+    }
+    for (const repo of registry.repositories) {
+        if (repo.id === "project")
+            continue;
+        if (!existsSync(repo.root)) {
+            issues.push({
+                severity: "error",
+                code: "workspace_repo_path_missing",
+                scope: "project",
+                unitId: `workspace.repositories.${repo.id}`,
+                message: `declared repository "${repo.id}" path does not exist on disk: ${repo.root}`,
+                fixable: false,
+            });
+            continue;
+        }
+        // Must be a repo at its OWN root — a plain dir nested in the parent repo
+        // would otherwise pass a bare `nativeIsRepo` check via the enclosing
+        // parent's .git. Compare on realpath so symlinked temp roots (macOS
+        // /var vs /private/var) don't cause a false mismatch.
+        const toplevel = resolveGitToplevel(repo.root);
+        const declaredReal = realpathSafe(repo.root);
+        const toplevelReal = toplevel ? realpathSafe(toplevel) : null;
+        if (toplevelReal !== declaredReal) {
+            issues.push({
+                severity: "warning",
+                code: "workspace_repo_not_a_repo",
+                scope: "project",
+                unitId: `workspace.repositories.${repo.id}`,
+                message: `declared repository "${repo.id}" path is not a git repository at its own root: ${repo.root}`,
+                fixable: false,
+            });
+        }
+    }
+}
 export async function runGSDDoctor(basePath, options) {
     const issues = [];
     const fixesApplied = [];
@@ -336,6 +425,7 @@ export async function runGSDDoctor(basePath, options) {
         (prefs?.preferences?.git?.isolation === "worktree" ? "worktree" :
             prefs?.preferences?.git?.isolation === "branch" ? "branch" : "none");
     await checkGitHealth(basePath, issues, fixesApplied, shouldFix, isolationMode, dryRun);
+    checkWorkspaceRepositoryHealth(basePath, prefs?.preferences, issues);
     const gitMs = Date.now() - t0git;
     // Runtime health checks — timed
     const t0runtime = Date.now();
@@ -352,7 +442,7 @@ export async function runGSDDoctor(basePath, options) {
     });
     const envMs = Date.now() - t0env;
     // Engine health checks — DB constraints and projection drift
-    await checkEngineHealth(basePath, issues, fixesApplied);
+    await checkEngineHealth(basePath, issues, fixesApplied, { repair: fix && !dryRun });
     const milestonesPath = milestonesDir(basePath);
     const legacyMilestonesPath2 = legacyMilestonesDir(basePath);
     if (!existsSync(milestonesPath) && !existsSync(legacyMilestonesPath2)) {

package/dist/resources/extensions/gsd/exec-sandbox.js

@@ -12,6 +12,7 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { resolve } from "node:path";
 import { getShellConfig, killProcessTree, SIGKILL_GRACE_MS, HARD_DEADLINE_MS } from "@gsd/pi-coding-agent";
+import { redactSecrets } from "./redact-secrets.js";
 const ALWAYS_FORWARD_ENV = ["PATH", "HOME"];
 // SIGKILL_GRACE_MS / HARD_DEADLINE_MS are imported from @gsd/pi-coding-agent
 // (shell.ts) — the single source of truth for the graceful-kill timing ladder —
@@ -232,8 +233,11 @@ export function runExecSandbox(request, opts) {
             const stderrBuf = Buffer.concat(stderrChunks);
             const stdoutSuffix = stdoutTruncated ? "\n[truncated: stdout cap reached]\n" : "";
             const stderrSuffix = stderrTruncated ? "\n[truncated: stderr cap reached]\n" : "";
-            writeFileSync(stdoutPath, Buffer.concat([stdoutBuf, Buffer.from(stdoutSuffix, "utf-8")]));
-            writeFileSync(stderrPath, Buffer.concat([stderrBuf, Buffer.from(stderrSuffix, "utf-8")]));
+            // Redact secret-shaped substrings before persisting to .gsd/exec/ (skipped by
+            // the secret scanner). The returned digest is derived from the raw buffer
+            // below and is redacted downstream when the session is written to activity/.
+            writeFileSync(stdoutPath, redactSecrets(Buffer.concat([stdoutBuf, Buffer.from(stdoutSuffix, "utf-8")]).toString("utf-8")));
+            writeFileSync(stderrPath, redactSecrets(Buffer.concat([stderrBuf, Buffer.from(stderrSuffix, "utf-8")]).toString("utf-8")));
             const digestBody = tail(stdoutBuf, opts.digest_chars);
             const digest = digestBody.length > 0
                 ? digestBody