@opengsd/gsd-pi 1.8.1-dev.897b3c90 → 1.9.0-dev.5c1a3ff2

package/README.md

@@ -28,14 +28,16 @@ See [CHANGELOG.md](./CHANGELOG.md) for release-by-release fixes and [Legacy Rele
 ## Latest Release Highlights
 
 <!-- release-highlights:start -->
-Latest release: **v1.8.1**
-
-- **doctor:** Extract state checks.
-- **doctor:** Extract history and workspace checks.
-- **issue:** Unregistered-milestone false positive: flat-phase ID extractor derives bare M### from descriptive slug, missing suffixed DB row (M###-abcdef) (#1282).
-- **issue:** [Bug] reconcile triggers mass re-projection of all historical PLAN.md files, resetting completed task checkboxes to unchecked (#1279).
-- **issue:** [Bug]: `migrateHierarchyToDb` imports a `[sketch]` slice's stub PLAN tasks as real DB rows, flipping planning→executing.
-- **issue:** [Bug]: `sketchFlagHandler` clears `is_sketch` on mere PLAN-file existence, including a stub or leftover PLAN.
+Latest release: **v1.9.0**
+
+- **gsd:** Add task rework briefs.
+- **web:** Delete unused chart.tsx and recharts.
+- **deps:** Move ajv to devDependencies.
+- **daemon:** Dedupe @anthropic-ai/sdk to ^0.91.1.
+- **deps:** Override hono to >=4.12.25.
+- **gsd:** Batch plan-v2 task queries and skip unchanged graph writes.
+- **gsd:** Open the worker DB once per parallel-monitor tick.
+- **gsd:** Batch parallel-eligibility task queries.
 
 <!-- release-highlights:end -->
 

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-4c3ea176cf8f5545
+1252616a01ee43bc

package/dist/resources/GSD-WORKFLOW.md

@@ -367,7 +367,7 @@ When verification finds gaps, include a **Gaps** section with what's missing, im
 ### Phase 6: Summarize
 
 **Purpose:** Record what happened for downstream tasks.
-**Produces:** `T##-SUMMARY.md`, and when slice completes, `S##-SUMMARY.md`.
+**Produces:** `S##-T##-SUMMARY.md` in flat-phase projects, and when slice completes, `S##-SUMMARY.md`. Legacy flat `T##-SUMMARY.md` task summaries are still readable.
 
 **Task summary format:**
 ```markdown
@@ -494,7 +494,7 @@ It is NOT the source of truth. It's a convenience dashboard.
 **Sources of truth:**
 - `ROADMAP.md` → which slices exist and which are done
 - `<NN>-<MM>-PLAN.md` → which tasks exist within a slice and what each task must do
-- `T##-SUMMARY.md` → what happened during a task
+- `S##-T##-SUMMARY.md` → what happened during a task in flat-phase projects (legacy `T##-SUMMARY.md` is still readable)
 - `S##-SUMMARY.md` and `M###-SUMMARY.md` → compressed slice and milestone outcomes
 
 **Update `STATE.md`** after every significant action:

package/dist/resources/extensions/gsd/artifact-verification.js

@@ -9,7 +9,7 @@ import { refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { resolveSlicePath, resolveSliceFile, resolveTasksDir, resolveTaskFiles, relSliceFile, resolveMilestoneFile, clearPathCache, resolveGsdRootFile, } from "./paths.js";
+import { resolveSlicePath, resolveSliceFile, resolveTasksDir, resolveTaskFiles, resolveTaskFile, relSliceFile, resolveMilestoneFile, clearPathCache, resolveGsdRootFile, } from "./paths.js";
 import { existsSync, readFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { LAYOUT_SEGMENTS } from "./layout-policy.js";
@@ -185,10 +185,9 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
         const batchIds = batchPart.slice(plusIdx + 1).split(",").filter(Boolean);
         if (batchIds.length === 0)
             return false;
-        const tDir = resolveTasksDir(base, mid, sid) ?? slicePath;
-        const existingSummaries = new Set(resolveTaskFiles(tDir, "SUMMARY").map((f) => f.replace(/-SUMMARY\.md$/i, "").toUpperCase()));
         for (const tid of batchIds) {
-            if (!existingSummaries.has(tid.toUpperCase()))
+            const summaryPath = resolveTaskFile(base, mid, sid, tid, "SUMMARY");
+            if (!summaryPath || !existsSync(summaryPath))
                 return false;
         }
         return true;

package/dist/resources/extensions/gsd/auto-artifact-paths.js

@@ -5,7 +5,7 @@
 // resolveExpectedArtifactPath and diagnoseExpectedArtifact moved here from
 // auto-recovery.ts (Phase 5 dead-code cleanup). The artifact verification
 // function was removed entirely — callers now query WorkflowEngine directly.
-import { gsdRoot, resolveDir, resolveFile, resolveMilestonePath, resolveMilestoneFile, resolveSliceFile, relMilestoneFile, relSliceFile, buildTaskFileName, resolveSlicePath, resolveTasksDir, dirIsMetaOnlyLegacyMilestone, normalizeRealPath, } from "./paths.js";
+import { gsdRoot, resolveDir, resolveFile, resolveMilestonePath, resolveMilestoneFile, resolveSliceFile, relMilestoneFile, relSliceFile, buildFlatTaskFileName, buildTaskFileName, resolveSlicePath, resolveTasksDir, dirIsMetaOnlyLegacyMilestone, normalizeRealPath, } from "./paths.js";
 import { milestoneIdToPhaseNum } from "./layout-policy.js";
 import { parseUnitId } from "./unit-id.js";
 import { basename, dirname, join, relative } from "node:path";
@@ -79,12 +79,15 @@ function resolveProjectMilestonePath(base, mid) {
     const dir = resolveDir(milestonesDir, mid);
     if (!dir)
         return null;
-    // git-service.ts creates milestones/<MID>/ for integration-branch metadata
-    // (<MID>-META.json) even in flat-phase projects. A dir that holds ONLY
-    // *-META.json files must not be treated as a real legacy milestone dir —
-    // otherwise this early-return resolves CONTEXT/ROADMAP/SUMMARY to the legacy
-    // path (milestones/<MID>/<MID>-<SUFFIX>.md) before the flat-phase fallback
-    // can run, trapping the unit in a finalize-retry loop (#852 follow-up).
+    // Historically git-service.ts wrote integration-branch metadata into
+    // milestones/<MID>/<MID>-META.json, which could create that dir in flat-phase
+    // projects and poison layout detection. As of ADR-045 that META lives flat at
+    // .gsd/<MID>-META.json and no longer poisons detection. A dir that holds ONLY
+    // *-META.json files (a pre-migration on-disk tree) must still not be treated
+    // as a real legacy milestone dir — otherwise this early-return resolves
+    // CONTEXT/ROADMAP/SUMMARY to the legacy path (milestones/<MID>/<MID>-<SUFFIX>.md)
+    // before the flat-phase fallback can run, trapping the unit in a
+    // finalize-retry loop (#852 follow-up).
     //
     // We use dirIsMetaOnlyLegacyMilestone rather than !dirIsContentBearingLegacyMilestone
     // so that an EMPTY dir (a new milestone before any content is written) is NOT
@@ -203,7 +206,10 @@ export function resolveExpectedArtifactPath(unitType, unitId, base) {
             const summaryDir = isLegacySlice
                 ? (resolveTasksDir(base, mid, sid) ?? slicePath)
                 : slicePath;
-            return join(summaryDir, buildTaskFileName(tid, "SUMMARY"));
+            const fileName = isLegacySlice
+                ? buildTaskFileName(tid, "SUMMARY")
+                : buildFlatTaskFileName(sid, tid, "SUMMARY");
+            return join(summaryDir, fileName);
         }
         case "complete-slice": {
             return resolveSliceArtifactPath(base, mid, sid, "SUMMARY");

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -10,12 +10,12 @@
 import { loadFile, parseContinue, parseSummary, loadActiveOverrides, formatOverridesSection } from "./files.js";
 import { extractVerdict } from "./verdict-parser.js";
 import { loadPrompt, inlineTemplate } from "./prompt-loader.js";
-import { resolveMilestoneFile, resolveSliceFile, resolveSlicePath, resolveTasksDir, resolveTaskFiles, resolveTaskFile, relMilestoneFile, relSliceFile, relSlicePath, relMilestonePath, relTaskFile, resolveGsdRootFile, relGsdRootFile, resolveRuntimeFile, } from "./paths.js";
+import { resolveMilestoneFile, resolveSliceFile, resolveSlicePath, resolveTasksDir, resolveTaskFiles, resolveTaskFile, taskIdFromTaskFileName, relMilestoneFile, relSliceFile, relSlicePath, relMilestonePath, relTaskFile, resolveGsdRootFile, relGsdRootFile, resolveRuntimeFile, } from "./paths.js";
 import { resolveInlineLevel, loadEffectiveGSDPreferences } from "./preferences.js";
 import { createRepositoryRegistryFromPreferences } from "./repository-registry.js";
 import { isContextModeEnabled } from "./preferences-types.js";
 import { parseRoadmap } from "./parsers-legacy.js";
-import { join, relative, sep } from "node:path";
+import { join, basename, relative, sep } from "node:path";
 import { existsSync } from "node:fs";
 import { computeBudgets, resolveExecutorContextWindow, truncateAtSectionBoundary } from "./context-budget.js";
 import { getBlockingReworkFindingsForTask, getGateResults, getPendingGatesForTurn } from "./gsd-db.js";
@@ -62,13 +62,29 @@ function resolvePromptBudgets() {
         const prefs = loadEffectiveGSDPreferences();
         const sessionWindow = prefs?.preferences.context_window_override;
         const windowTokens = resolveExecutorContextWindow(undefined, prefs?.preferences, sessionWindow);
-        return computeBudgets(windowTokens);
+        return computeBudgets(windowTokens, resolveExecutionProvider(prefs?.preferences));
     }
     catch (e) {
         logWarning("prompt", `resolvePromptBudgets failed: ${e.message}`);
         return computeBudgets(200_000);
     }
 }
+/**
+ * Best-effort provider for the chars/token ratio: the executor's configured
+ * model profile is the only provider source reachable here (the runtime
+ * `sessionProvider` that reaches `formatExecutorConstraints` isn't threaded to
+ * `capPreamble`/summary callers). Undefined when no explicit provider is set —
+ * `computeBudgets` then uses the 4.0 default, i.e. today's behavior.
+ */
+function resolveExecutionProvider(prefs) {
+    const exec = prefs?.models?.execution;
+    if (exec && typeof exec === "object" && "provider" in exec) {
+        const provider = exec.provider;
+        if (typeof provider === "string" && provider)
+            return provider;
+    }
+    return undefined;
+}
 /**
  * Character budget for dependency/prior slice summaries injected into dispatch
  * prompts. Scales with the executor's configured context window (issue #4435).
@@ -200,7 +216,7 @@ function formatCloseoutReviewInstructions(validationContent, validationRel, curr
         `No passing validation artifact was found at \`${validationRel}\`. Use the full closeout review path before completion.`,
     ].join("\n");
 }
-function capPreamble(preamble) {
+export function capPreamble(preamble) {
     // Cap inlined context at min(static ceiling, scaled inline budget).
     // The ceiling bounds repeated auto prompt payloads; the scaled
     // budget tightens the cap for small-window users whose true safe limit is
@@ -210,6 +226,35 @@ function capPreamble(preamble) {
         return preamble;
     return truncateAtSectionBoundary(preamble, budget).content;
 }
+/**
+ * Cap the execute-task inline blocks against one shared budget in priority
+ * order. Unlike `capPreamble` (single concatenated preamble), execute-task
+ * feeds these blocks into separate, non-contiguous template placeholders, so
+ * they can't be joined and re-split — the budget is spent block-by-block.
+ *
+ * The task plan is the authoritative execution contract: it is never truncated
+ * here (it consumes budget first, whole). Remaining budget flows to the slice
+ * excerpt, then templates, each truncated at section boundaries so the lowest-
+ * priority context drops whole trailing sections first. When the task plan
+ * alone meets or exceeds the budget, the trailing blocks are dropped rather
+ * than the task plan being cut.
+ */
+function capExecuteTaskInlineBlocks(taskPlan, slicePlan, templates, budgetChars) {
+    let remaining = budgetChars - taskPlan.length;
+    if (remaining <= 0) {
+        return { taskPlan, slicePlan: "", templates: "" };
+    }
+    const cappedSlice = slicePlan.length <= remaining
+        ? slicePlan
+        : truncateAtSectionBoundary(slicePlan, remaining).content;
+    remaining -= cappedSlice.length;
+    const cappedTemplates = remaining <= 0
+        ? ""
+        : templates.length <= remaining
+            ? templates
+            : truncateAtSectionBoundary(templates, remaining).content;
+    return { taskPlan, slicePlan: cappedSlice, templates: cappedTemplates };
+}
 function trackPromptContext(entries, key, mode, body, reason) {
     entries.push({
         key,
@@ -253,7 +298,7 @@ function renderContextModeBlockForPrompt(unitType, base, renderMode = "standalon
     return `${contextMode}\n\n## Context Snapshot\nSource: \`.gsd/last-snapshot.md\`\n\n${snapshot.trimEnd()}`;
 }
 function prependContextModeToBlock(unitType, base, block, renderMode = "standalone") {
-    const toolSurface = composeToolSurfaceInstructions(unitType, { renderMode });
+    const toolSurface = composeToolSurfaceInstructions(unitType, { renderMode, basePath: base });
     const contextMode = renderContextModeBlockForPrompt(unitType, base, renderMode);
     const guidance = [toolSurface, contextMode].filter(Boolean).join("\n\n");
     if (!guidance)
@@ -310,7 +355,7 @@ function formatExecutorConstraints(sessionContextWindow, modelRegistry, sessionP
         // so DEFAULT_CONTEXT_WINDOW stays the single source of truth.
         windowTokens = resolveExecutorContextWindow(undefined, undefined, sessionContextWindow, sessionProvider);
     }
-    const budgets = computeBudgets(windowTokens);
+    const budgets = computeBudgets(windowTokens, sessionProvider);
     const { min, max } = budgets.taskCountRange;
     const execWindowK = Math.round(windowTokens / 1000);
     const perTaskBudgetK = Math.round(budgets.inlineContextBudgetChars / 1000);
@@ -1245,6 +1290,13 @@ function resolveTaskSummariesLocation(base, mid, sid) {
         return { dir: tDir, relPrefix: `${sRel}/tasks` };
     return { dir: slicePath, relPrefix: sRel };
 }
+function summaryFileBelongsToSlice(fileName, base, mid, sid) {
+    const tid = taskIdFromTaskFileName(fileName, "SUMMARY");
+    if (!tid)
+        return false;
+    const resolved = resolveTaskFile(base, mid, sid, tid, "SUMMARY");
+    return resolved !== null && basename(resolved) === fileName;
+}
 export async function getPriorTaskSummaryPaths(mid, sid, currentTid, base) {
     const loc = resolveTaskSummariesLocation(base, mid, sid);
     if (!loc)
@@ -1253,7 +1305,12 @@ export async function getPriorTaskSummaryPaths(mid, sid, currentTid, base) {
     const currentNum = parseInt(currentTid.replace(/^T/, ""), 10);
     return summaryFiles
         .filter(f => {
-        const num = parseInt(f.replace(/^T/, ""), 10);
+        if (!summaryFileBelongsToSlice(f, base, mid, sid))
+            return false;
+        const tid = taskIdFromTaskFileName(f, "SUMMARY");
+        if (!tid)
+            return false;
+        const num = parseInt(tid.replace(/^T/, ""), 10);
         return num < currentNum;
     })
         .map(f => `${loc.relPrefix}/${f}`);
@@ -1280,8 +1337,11 @@ export async function getDependencyTaskSummaryPaths(mid, sid, currentTid, depend
     const depSet = new Set(dependsOn.map((d) => d.toUpperCase()));
     return summaryFiles
         .filter((f) => {
-        // Extract task ID from filename: "T02-SUMMARY.md" → "T02"
-        const tid = f.replace(/-SUMMARY\.md$/i, "").toUpperCase();
+        if (!summaryFileBelongsToSlice(f, base, mid, sid))
+            return false;
+        const tid = taskIdFromTaskFileName(f, "SUMMARY");
+        if (!tid)
+            return false;
         return depSet.has(tid);
     })
         .map((f) => `${loc.relPrefix}/${f}`);
@@ -2307,7 +2367,7 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
     // Compute verification budget for the executor's context window (issue #707)
     const prefs = loadEffectiveGSDPreferences();
     const contextWindow = resolveExecutorContextWindow(opts.modelRegistry, prefs?.preferences, opts.sessionContextWindow, opts.sessionProvider);
-    const budgets = computeBudgets(contextWindow);
+    const budgets = computeBudgets(contextWindow, opts.sessionProvider);
     const verificationBudget = `~${Math.round(budgets.verificationBudgetChars / 1000)}K chars`;
     // Truncate carry-forward section when it exceeds 40% of inline context budget.
     const carryForwardBudget = Math.floor(budgets.inlineContextBudgetChars * 0.4);
@@ -2409,10 +2469,19 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
             }
         },
     });
-    const taskPlanInline = requireComposedArtifactBlock(contractedContext.blocks, "execute-task", "task-plan");
-    const slicePlanExcerpt = requireComposedArtifactBlock(contractedContext.blocks, "execute-task", "slice-plan");
+    const rawTaskPlanInline = requireComposedArtifactBlock(contractedContext.blocks, "execute-task", "task-plan");
+    const rawSlicePlanExcerpt = requireComposedArtifactBlock(contractedContext.blocks, "execute-task", "slice-plan");
     const contractedCarryForward = requireComposedArtifactBlock(contractedContext.blocks, "execute-task", "prior-task-summaries");
-    const contractedTemplates = requireComposedArtifactBlock(contractedContext.blocks, "execute-task", "templates");
+    const rawContractedTemplates = requireComposedArtifactBlock(contractedContext.blocks, "execute-task", "templates");
+    // Cap the static inline blocks against one shared budget so a small-window
+    // executor can't overflow (the sibling builders cap via `capPreamble`;
+    // execute-task's blocks feed separate template slots, so they share a budget
+    // block-by-block). Carry-forward already has its own truncation above.
+    const inlineBudget = Math.min(MAX_PREAMBLE_CHARS, budgets.inlineContextBudgetChars);
+    const { taskPlan: taskPlanInline, slicePlan: slicePlanExcerpt, templates: contractedTemplates } = capExecuteTaskInlineBlocks(rawTaskPlanInline, rawSlicePlanExcerpt, rawContractedTemplates, inlineBudget);
+    const inlineDropped = (rawTaskPlanInline.length + rawSlicePlanExcerpt.length + rawContractedTemplates.length)
+        - (taskPlanInline.length + slicePlanExcerpt.length + contractedTemplates.length);
+    trackPromptContext(contextTelemetry, "inline-cap", inlineDropped > 0 ? "excerpt" : "skipped", null, inlineDropped > 0 ? `dropped ${inlineDropped} chars (budget ${inlineBudget})` : "within budget");
     const onDemandResult = renderExecuteTaskOnDemandContext(base, mid, sid, contractedContext.onDemand);
     const onDemandContext = onDemandResult.text;
     trackPromptContext(contextTelemetry, "slice-research", onDemandContext ? "on-demand" : "skipped", onDemandContext, onDemandContext ? undefined : onDemandResult.skipReason ?? undefined);
@@ -2497,12 +2566,14 @@ export async function buildCompleteSlicePrompt(mid, midTitle, sid, sTitle, base,
                     trackPromptContext(contextTelemetry, "prior-task-summaries", "skipped", null, "missing tasks dir");
                     return null;
                 }
-                const summaryFiles = resolveTaskFiles(loc.dir, "SUMMARY").sort();
+                const summaryFiles = resolveTaskFiles(loc.dir, "SUMMARY")
+                    .filter((file) => summaryFileBelongsToSlice(file, base, mid, sid))
+                    .sort();
                 const blocks = [];
                 for (const file of summaryFiles) {
                     const absPath = join(loc.dir, file);
                     const relPath = `${loc.relPrefix}/${file}`;
-                    const taskId = file.replace(/-SUMMARY\.md$/i, "");
+                    const taskId = taskIdFromTaskFileName(file, "SUMMARY") ?? file.replace(/-SUMMARY\.md$/i, "");
                     blocks.push(await buildTaskSummaryExcerpt(absPath, relPath, taskId));
                 }
                 const body = blocks.length > 0 ? blocks.join("\n\n---\n\n") : null;
@@ -3072,7 +3143,9 @@ export async function buildReplanSlicePrompt(mid, midTitle, sid, sTitle, base) {
     let blockerTaskId = "";
     const summaryLoc = resolveTaskSummariesLocation(base, mid, sid);
     if (summaryLoc) {
-        const summaryFiles = resolveTaskFiles(summaryLoc.dir, "SUMMARY").sort();
+        const summaryFiles = resolveTaskFiles(summaryLoc.dir, "SUMMARY")
+            .filter((file) => summaryFileBelongsToSlice(file, base, mid, sid))
+            .sort();
         for (const file of summaryFiles) {
             const absPath = join(summaryLoc.dir, file);
             const content = await loadFile(absPath);
@@ -3081,7 +3154,7 @@ export async function buildReplanSlicePrompt(mid, midTitle, sid, sTitle, base) {
             const summary = parseSummary(content);
             const relPath = `${summaryLoc.relPrefix}/${file}`;
             if (summary.frontmatter.blocker_discovered) {
-                blockerTaskId = summary.frontmatter.id || file.replace(/-SUMMARY\.md$/i, "");
+                blockerTaskId = summary.frontmatter.id || taskIdFromTaskFileName(file, "SUMMARY") || file.replace(/-SUMMARY\.md$/i, "");
                 inlined.push(await buildTaskSummaryExcerpt(absPath, relPath, blockerTaskId, { blocker: true }));
             }
         }

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -17,7 +17,7 @@ import { refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning } from "./workflow-logger.js";
 import { isClosedStatus, isInactiveStatus } from "./status-guards.js";
-import { resolveSlicePath, resolveTasksDir, resolveTaskFiles, relMilestoneFile, relSliceFile, clearPathCache, } from "./paths.js";
+import { resolveSlicePath, resolveTaskFile, relMilestoneFile, relSliceFile, clearPathCache, } from "./paths.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
 import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, } from "./auto-artifact-paths.js";
@@ -227,10 +227,15 @@ export function writeReactiveExecuteBlocker(unitId, base, reason) {
     const slicePath = resolveSlicePath(base, mid, sid);
     if (!slicePath)
         return null;
-    const tasksDir = resolveTasksDir(base, mid, sid) ?? slicePath;
-    const existingSummaries = new Set(resolveTaskFiles(tasksDir, "SUMMARY").map((f) => f.replace(/-SUMMARY\.md$/i, "").toUpperCase()));
-    const summaryPresent = batchIds.filter((tid) => existingSummaries.has(tid.toUpperCase()));
-    const summaryMissing = batchIds.filter((tid) => !existingSummaries.has(tid.toUpperCase()));
+    // Resolve each batch task's SUMMARY with slice-qualified paths so flat-phase
+    // slices that reuse a task id (e.g. two T03s in one phase) don't collide: a
+    // sibling slice's summary must never make this slice's task look complete.
+    const hasSummary = (tid) => {
+        const summaryPath = resolveTaskFile(base, mid, sid, tid, "SUMMARY");
+        return summaryPath !== null && existsSync(summaryPath);
+    };
+    const summaryPresent = batchIds.filter((tid) => hasSummary(tid));
+    const summaryMissing = batchIds.filter((tid) => !hasSummary(tid));
     const completedTaskIds = [];
     const skippedTaskIds = [];
     const unchangedTaskIds = [];

package/dist/resources/extensions/gsd/auto-worktree-cleanup.js

@@ -8,6 +8,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, realpathSync, unlinkSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
 import { gsdRoot } from "./paths.js";
+import { milestoneMetaPath } from "./git-service.js";
 import { logWarning } from "./workflow-logger.js";
 function isSamePath(a, b) {
     try {
@@ -73,6 +74,9 @@ export function clearProjectRootStateFiles(basePath, milestoneId) {
     // worth removing on teardown.
     const transientFiles = [
         join(gsdDir, "STATE.md"),
+        // Integration-branch META now lives flat at .gsd/<MID>-META.json (ADR-045).
+        milestoneMetaPath(basePath, milestoneId),
+        // Legacy location — still cleaned for pre-migration trees.
         join(gsdDir, "milestones", milestoneId, `${milestoneId}-META.json`),
     ];
     for (const file of transientFiles) {

package/dist/resources/extensions/gsd/auto-worktree-teardown.js

@@ -45,7 +45,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
             throw new GSDError(GSD_IO_ERROR, `Failed to chdir back to ${originalBasePath} during teardown: ${err instanceof Error ? err.message : String(err)}`);
         }
         // Mirror cleanup steps from mergeMilestoneToMain abort path:
-        // 1. Remove transient state files (STATE.md, auto.lock, {MID}-META.json).
+        // 1. Remove transient state files (STATE.md, auto.lock, .gsd/{MID}-META.json).
         //    Non-fatal — must not block teardown.
         try {
             clearProjectRootStateFiles(originalBasePath, milestoneId);

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -46,6 +46,8 @@ function registerAlias(pi, toolDef, aliasName, canonicalName) {
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- toolDef shape matches ToolDefinition but varies by schema
 function registerWorkflowTool(pi, toolDef) {
     pi.registerTool(toolDef);
+    if (process.env.GSD_ADVERTISE_TOOL_ALIASES !== "1")
+        return; // canonical-only model surface (see plan 035)
     for (const alias of aliasesForWorkflowTool(toolDef.name)) {
         registerAlias(pi, toolDef, alias, toolDef.name);
     }

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -22,13 +22,14 @@ import { saveActivityLog } from "../activity-log.js";
 import { recordToolCall as safetyRecordToolCall, recordToolResult as safetyRecordToolResult, saveEvidenceToDisk } from "../safety/evidence-collector.js";
 import { parseUnitId } from "../unit-id.js";
 import { classifyCommand } from "../safety/destructive-guard.js";
-import { confirmDestructiveCommand, consumeDestructiveConfirmation, isDestructiveConfirmGateId, requestDestructiveConfirmation, } from "../safety/destructive-confirmation.js";
+import { confirmDestructiveCommand, consumeDestructiveConfirmation, isDestructiveConfirmGateId, peekPendingDestructiveCommand, requestDestructiveConfirmation, resetDestructiveConfirmation, } from "../safety/destructive-confirmation.js";
 import { logWarning as safetyLogWarning, setStderrLoggingEnabled } from "../workflow-logger.js";
 import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
 import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
 import { initNotificationWidget } from "../notification-widget.js";
 import { notifyPreferenceDiagnostics } from "../preferences-diagnostics.js";
+import { resolveEffectivePlanningToolsPolicy } from "../planning-subagent-policy.js";
 import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { extractSubagentAgentClasses } from "./subagent-input.js";
 import { approvalGateIdForUnit, evaluateAskUserQuestionsRound, formatUnansweredConsentQuestionMessage, isExplicitApprovalResponse, messageHasPendingAskUserQuestionsTool, shouldPauseForQuestion, } from "../consent-question.js";
@@ -136,6 +137,7 @@ function suppressWelcomeHeader(ctx) {
  * are bounded — cleared on activation, session boundaries, and verification.
  */
 const deferredApprovalGates = new Map();
+const deferredDestructiveConfirmationPauses = new Set();
 export const MINIMAL_GSD_TOOL_NAMES = [
     "gsd_exec",
     "gsd_exec_search",
@@ -456,6 +458,21 @@ function clearDeferredApprovalGate(basePath) {
         deferredApprovalGates.delete(basePath);
     }
 }
+function deferDestructiveConfirmationPause(basePath) {
+    deferredDestructiveConfirmationPauses.add(basePath);
+}
+function clearDeferredDestructiveConfirmationPause(basePath) {
+    if (!basePath) {
+        deferredDestructiveConfirmationPauses.clear();
+    }
+    else {
+        deferredDestructiveConfirmationPauses.delete(basePath);
+    }
+}
+function isDestructiveConfirmationBlocking(basePath) {
+    return deferredDestructiveConfirmationPauses.has(basePath)
+        && Boolean(peekPendingDestructiveCommand(basePath));
+}
 function deferApprovalGate(gateId, basePath) {
     // Verified-on-disk wins (same adapter policy as activation/re-arm): if the
     // workflow MCP child already verified this gate, deferring would block
@@ -798,6 +815,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         await applyToolCallLoopGuardConfig(basePath);
         approvalQuestionAbortInFlight = false;
         clearDeferredApprovalGate();
+        clearDeferredDestructiveConfirmationPause();
         await resetAskUserQuestionsTurnCache();
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
@@ -883,6 +901,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         resetToolCallLoopGuard();
         await applyToolCallLoopGuardConfig(basePath);
         clearDeferredApprovalGate();
+        clearDeferredDestructiveConfirmationPause();
         await resetAskUserQuestionsTurnCache();
         clearDiscussionFlowState(basePath);
         // /clear or /new destroys the conversation holding a discuss interview, so
@@ -933,6 +952,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             }
         }
         clearDeferredApprovalGate(beforeAgentBasePath);
+        clearDeferredDestructiveConfirmationPause(beforeAgentBasePath);
         // session_start can fire before the active provider has settled. By
         // before_agent_start, Claude Code CLI sessions should get the same
         // project MCP config that /gsd mcp init would write.
@@ -1010,7 +1030,10 @@ export function registerHooks(pi, ecosystemHandlers) {
         }
         finally {
             activateDeferredApprovalGate(agentEndBasePath);
+            const destructiveConfirmationBlocking = isDestructiveConfirmationBlocking(agentEndBasePath);
+            clearDeferredDestructiveConfirmationPause(agentEndBasePath);
             await maybePauseAutoForApprovalGate(ctx, pi, isApprovalGateBlocking(agentEndBasePath), "Depth confirmation is waiting for your answer — pausing auto-mode.");
+            await maybePauseAutoForApprovalGate(ctx, pi, destructiveConfirmationBlocking, "Destructive-command confirmation is waiting for your answer — pausing auto-mode.");
         }
     });
     pi.on("message_end", async (event) => {
@@ -1276,6 +1299,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         const activeUnitType = dash.currentUnit?.type ?? guidedUnit?.unitType;
         if (activeUnitType) {
             const manifest = resolveManifest(activeUnitType);
+            const planningBasePath = dash.basePath || guidedUnit?.basePath || discussionBasePath;
             let planningInput = "";
             let agentClasses;
             if (isToolCallEventType("write", event)) {
@@ -1291,7 +1315,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                 // Subagent inputs use { agent }, { tasks: [{ agent }] }, or { chain: [{ agent }] }.
                 agentClasses = extractSubagentAgentClasses(event.input);
             }
-            const planningGuard = shouldBlockPlanningUnit(event.toolName, planningInput, dash.basePath || guidedUnit?.basePath || discussionBasePath, activeUnitType, manifest?.tools, agentClasses, event.input, dash.currentUnit?.id);
+            const planningGuard = shouldBlockPlanningUnit(event.toolName, planningInput, planningBasePath, activeUnitType, resolveEffectivePlanningToolsPolicy(activeUnitType, manifest?.tools, planningBasePath), agentClasses, event.input, dash.currentUnit?.id);
             if (planningGuard.block)
                 return planningGuard;
         }
@@ -1373,6 +1397,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                 // Record the command as pending so an affirmative answer to a
                 // destructive_confirm gate (handled in tool_result) can confirm it.
                 requestDestructiveConfirmation(command, guardBasePath);
+                deferDestructiveConfirmationPause(guardBasePath);
                 const reason = [
                     "HARD BLOCK: destructive Bash command requires explicit human confirmation.",
                     `Detected: ${classification.labels.join(", ")}`,
@@ -1383,9 +1408,6 @@ export function registerHooks(pi, ecosystemHandlers) {
                 safetyLogWarning("safety", `destructive command: ${classification.labels.join(", ")}`, {
                     command: String(command).slice(0, 200),
                 });
-                if (ctx) {
-                    await maybePauseAutoForApprovalGate(ctx, pi, isAutoActive(), "Destructive-command confirmation is waiting for your answer — pausing auto-mode.");
-                }
                 return { block: true, reason };
             }
         }
@@ -1541,6 +1563,10 @@ export function registerHooks(pi, ecosystemHandlers) {
                 if (isDepthConfirmationAnswer(answer?.selected, question.options)) {
                     confirmDestructiveCommand(basePath);
                 }
+                else {
+                    resetDestructiveConfirmation(basePath);
+                }
+                clearDeferredDestructiveConfirmationPause(basePath);
                 break;
             }
         }

package/dist/resources/extensions/gsd/bootstrap/system-context.js

@@ -18,6 +18,13 @@ import { formatOverridesSection, formatShortcut, loadActiveOverrides, loadFile,
 import { toPosixPath } from "../../shared/mod.js";
 import { autoEnableCmuxPreferences } from "../commands-cmux.js";
 import { gsdHome } from "../gsd-home.js";
+import { GSD_CONTEXT_MESSAGE_SENTINEL } from "../constants.js";
+// Single source of truth lives in ../constants.js; re-exported here because
+// buildContextMessage() stamps this marker on every context injection and the
+// provider payload policy (filterSupersededContextInjections in
+// context-masker.ts) matches it to dedupe. Adding a new context customType?
+// Ensure buildContextMessage still prepends this sentinel.
+export { GSD_CONTEXT_MESSAGE_SENTINEL };
 const DEFAULT_CONTEXT_MESSAGE_MAX_CHARS = 4_000;
 const DEFAULT_KNOWLEDGE_MAX_CHARS = 12_000;
 const DEFAULT_CODEBASE_MAX_CHARS = 8_000;
@@ -385,17 +392,17 @@ export function buildContextMessage(opts) {
     const contextCharLimit = getContextMessageCharLimit();
     const memoryContent = markMemoryContextSupplied(opts.memoryBlock.trim());
     if (opts.injection) {
-        const content = limitContextMessageContent(memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection, contextCharLimit);
+        const content = limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection}`, contextCharLimit);
         return { customType: "gsd-guided-context", content, display: false };
     }
     if (opts.forensicsInjection) {
-        const content = limitContextMessageContent(memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection, contextCharLimit);
+        const content = limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection}`, contextCharLimit);
         return { customType: "gsd-forensics", content, display: false };
     }
     if (memoryContent) {
         return {
             customType: "gsd-memory",
-            content: limitContextMessageContent(memoryContent, contextCharLimit),
+            content: limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent}`, contextCharLimit),
             display: false,
         };
     }

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -7,6 +7,7 @@ import { canonicalToolName } from "../engine-hook-contract.js";
 import { loadJsonFileOrNull } from "../json-persistence.js";
 import { getIsolationMode } from "../preferences.js";
 import { compileSubagentPermissionContract } from "../unit-context-manifest.js";
+import { allowedPlanningDispatchAgentsList, isReadOnlyPlanningDispatchAgent, } from "../planning-subagent-registry.js";
 import { logWarning } from "../workflow-logger.js";
 import { acquireSyncLock, releaseSyncLock } from "../sync-lock.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
@@ -981,29 +982,8 @@ export function shouldBlockQueueExecutionInSnapshot(snapshot, toolName, input, q
 // guards.
 const PLANNING_WRITE_TOOLS = new Set(["write", "edit", "multi_edit", "notebook_edit"]);
 const PLANNING_SUBAGENT_TOOLS = new Set(["subagent", "task"]);
-/**
- * Canonical registry for agents that planning-dispatch may consider. Unit
- * manifests still declare per-unit subsets via ToolsPolicy.allowedSubagents.
- */
-const PLANNING_DISPATCH_AGENT_REGISTRY = {
-    mnemo: { readOnlySpecialist: true },
-    scout: { readOnlySpecialist: true },
-    planner: { readOnlySpecialist: true },
-    reviewer: { readOnlySpecialist: true },
-    security: { readOnlySpecialist: true },
-    tester: { readOnlySpecialist: true },
-};
-export const ALLOWED_PLANNING_DISPATCH_AGENTS = new Set(Object.entries(PLANNING_DISPATCH_AGENT_REGISTRY)
-    .filter(([, metadata]) => metadata.readOnlySpecialist)
-    .map(([agentId]) => agentId));
+export { ALLOWED_PLANNING_DISPATCH_AGENTS } from "../planning-subagent-registry.js";
 let warnedMissingControlledDispatchAgentClasses = false;
-function isReadOnlySpecialist(agentId) {
-    const metadata = PLANNING_DISPATCH_AGENT_REGISTRY[agentId];
-    return metadata?.readOnlySpecialist === true;
-}
-function allowedPlanningDispatchAgentsList() {
-    return [...ALLOWED_PLANNING_DISPATCH_AGENTS].join(", ");
-}
 function allowsControlledSubagentDispatch(policy) {
     return ((policy.mode === "planning-dispatch" || policy.mode === "verification" || policy.mode === "workflow-only") &&
         Array.isArray(policy.allowedSubagents));
@@ -1151,13 +1131,13 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
             if (requested.length === 0) {
                 return { block: false };
             }
-            const globallyDisallowed = requested.find(a => !isReadOnlySpecialist(a));
+            const globallyDisallowed = requested.find(a => !isReadOnlyPlanningDispatchAgent(a));
             if (globallyDisallowed) {
                 return planningBlock(unitType, policy.mode, `subagent dispatch of "${globallyDisallowed}" not permitted; only read-only specialists (${allowedPlanningDispatchAgentsList()}) may be dispatched from ${policy.mode} units`);
             }
             const disallowedByPolicy = requested.find(a => !allowed.has(a));
             if (disallowedByPolicy) {
-                return planningBlock(unitType, policy.mode, `subagent dispatch of "${disallowedByPolicy}" not permitted by ToolsPolicy.allowedSubagents; permitted agents for this unit: ${allowedSubagents.join(", ")}`);
+                return planningBlock(unitType, policy.mode, `subagent dispatch of "${disallowedByPolicy}" not permitted by unit allowlist (ToolsPolicy.allowedSubagents/planning_subagents); permitted agents for this unit: ${allowedSubagents.join(", ")}`);
             }
             return { block: false };
         }