@opengsd/gsd-pi 1.8.1 → 1.9.0-dev.5c1a3ff2

package/src/resources/extensions/gsd/bootstrap/db-tools.ts

@@ -58,6 +58,7 @@ function registerAlias(pi: ExtensionAPI, toolDef: any, aliasName: string, canoni
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- toolDef shape matches ToolDefinition but varies by schema
 function registerWorkflowTool(pi: ExtensionAPI, toolDef: any): void {
   pi.registerTool(toolDef);
+  if (process.env.GSD_ADVERTISE_TOOL_ALIASES !== "1") return; // canonical-only model surface (see plan 035)
   for (const alias of aliasesForWorkflowTool(toolDef.name)) {
     registerAlias(pi, toolDef, alias, toolDef.name);
   }
@@ -771,12 +772,12 @@ export function registerDbTools(pi: ExtensionAPI): void {
     name: "gsd_plan_task",
     label: "Plan Task",
     description:
-      "Write task planning state to the GSD database, render tasks/T##-PLAN.md from DB, and clear caches after a successful render.",
-    promptSnippet: "Plan a task via DB write + task PLAN render + cache invalidation",
+      "Write task planning state to the GSD database, render the slice PLAN from DB, and clear caches after a successful render.",
+    promptSnippet: "Plan a task via DB write + slice PLAN render + cache invalidation",
     promptGuidelines: [
-      "Use gsd_plan_task for task planning instead of writing tasks/T##-PLAN.md directly.",
+      "Use gsd_plan_task for task planning instead of writing task PLAN files directly.",
       "Keep parameters flat and provide the full task planning payload.",
-      "The tool validates input, requires an existing parent slice, writes task planning data, renders the task PLAN file from DB, and clears both state and parse caches after success.",
+      "The tool validates input, requires an existing parent slice, writes task planning data, renders the slice PLAN file from DB, and clears both state and parse caches after success.",
       "Use the canonical name gsd_plan_task; gsd_task_plan is only an alias.",
     ],
     parameters: Type.Object({
@@ -860,6 +861,15 @@ export function registerDbTools(pi: ExtensionAPI): void {
         }),
         { description: "Array of verification evidence entries (structured objects only)" },
       )),
+      reworkResolution: Type.Optional(Type.Array(
+        Type.Object({
+          findingId: Type.String({ description: "Rework finding ID being resolved (e.g. F1)" }),
+          status: StringEnum(["resolved", "deferred-with-override"], { description: "Resolution status for this finding" }),
+          evidence: Type.String({ description: "Concrete evidence that the required fix was completed" }),
+          decisionRef: Type.Optional(Type.String({ description: "Decision reference required for deferred-with-override findings" })),
+        }),
+        { description: "Resolution evidence for structured rework findings linked to this task" },
+      )),
       // Single-writer v3 audit trail (Stream 2): caller-provided actor identity + causation.
       actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail (e.g. 'executor-01', 'gsd-orchestrator')" })),
       triggerReason: Type.Optional(Type.String({ description: "Caller-provided reason this action was triggered (e.g. 'task verified after retry')" })),
@@ -1180,6 +1190,84 @@ export function registerDbTools(pi: ExtensionAPI): void {
 
   registerWorkflowTool(pi, replanSliceTool);
 
+  // ─── gsd_replan_task ───────────────────────────────────────────────────
+
+  const replanTaskExecute = async (_toolCallId: string, params: any, _signal: AbortSignal | undefined, _onUpdate: unknown, _ctx: unknown) => {
+    const { executeReplanTask } = await loadWorkflowExecutors();
+    return executeReplanTask(params, resolveWorkflowToolBasePath(_ctx, params));
+  };
+
+  const replanTaskTool = {
+    name: "gsd_replan_task",
+    label: "Replan Task",
+    description:
+      "Update one pending task's planning contract after rework without touching sibling tasks. " +
+      "Completed tasks are structurally protected. Re-renders the task/slice PLAN projection and records replan history.",
+    promptSnippet: "Replan one pending GSD task after rework",
+    promptGuidelines: [
+      "Use gsd_replan_task when a reopened pending task needs its title, description, files, verify, inputs, or expectedOutput updated for rework.",
+      "The task must already exist and be pending; completed tasks are rejected.",
+      "Set reworkBriefRef when a structured rework brief triggered the task replan.",
+    ],
+    parameters: Type.Object({
+      milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
+      sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
+      taskId: Type.String({ description: "Task ID (e.g. T01)" }),
+      title: Type.String({ description: "Updated task title" }),
+      description: Type.String({ description: "Updated task description incorporating rework scope" }),
+      estimate: Type.String({ description: "Updated task estimate string" }),
+      files: Type.Array(Type.String(), { description: "Updated files likely touched" }),
+      verify: Type.String({ description: "Updated verification command or block" }),
+      inputs: Type.Array(Type.String(), { description: "Updated input files or references" }),
+      expectedOutput: Type.Array(Type.String(), { description: "Updated files this task creates or overwrites" }),
+      reworkBriefRef: Type.Optional(Type.String({ description: "Rework brief ID/reference that triggered this task replan" })),
+      actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail" })),
+      triggerReason: Type.Optional(Type.String({ description: "Caller-provided reason this action was triggered" })),
+    }),
+    execute: replanTaskExecute,
+  };
+
+  registerWorkflowTool(pi, replanTaskTool);
+
+  // ─── gsd_rework_brief_save ─────────────────────────────────────────────
+
+  const reworkBriefSaveExecute = async (_toolCallId: string, params: any, _signal: AbortSignal | undefined, _onUpdate: unknown, _ctx: unknown) => {
+    const { executeReworkBriefSave } = await loadWorkflowExecutors();
+    return executeReworkBriefSave(params, resolveWorkflowToolBasePath(_ctx, params));
+  };
+
+  const reworkBriefSaveTool = {
+    name: "gsd_rework_brief_save",
+    label: "Save Rework Brief",
+    description:
+      "Persist a structured rework brief for a task. Blocking findings are enforced by gsd_task_complete until resolved with evidence.",
+    promptSnippet: "Persist structured task rework findings",
+    promptGuidelines: [
+      "Use gsd_rework_brief_save when post-unit checks produce task rework findings.",
+      "Use severity 'blocking' for findings that must be resolved before gsd_task_complete succeeds.",
+      "Each finding needs a stable findingId, requiredFix, and verificationCommands.",
+    ],
+    parameters: Type.Object({
+      briefId: Type.Optional(Type.String({ description: "Stable brief ID; omitted defaults to RB-<milestone>-<slice>-<task>" })),
+      milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
+      sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
+      taskId: Type.String({ description: "Task ID (e.g. T01)" }),
+      findings: Type.Array(Type.Object({
+        findingId: Type.String({ description: "Stable finding ID (e.g. F1)" }),
+        severity: StringEnum(["blocking", "advisory"], { description: "Whether this finding blocks task completion" }),
+        description: Type.String({ description: "What was found" }),
+        requiredFix: Type.String({ description: "What must change" }),
+        verificationCommands: Type.Array(Type.String(), { description: "Commands that must pass after the fix" }),
+        status: Type.Optional(StringEnum(["pending", "resolved", "deferred-with-override"], { description: "Finding status; defaults to pending" })),
+        evidence: Type.Optional(Type.String({ description: "Resolution evidence when already resolved" })),
+        decisionRef: Type.Optional(Type.String({ description: "Decision reference for deferred-with-override" })),
+      }), { description: "Structured rework findings for this task" }),
+    }),
+    execute: reworkBriefSaveExecute,
+  };
+
+  registerWorkflowTool(pi, reworkBriefSaveTool);
+
   // ─── gsd_reassess_roadmap (gsd_roadmap_reassess alias) ─────────────────
 
   const reassessRoadmapExecute = async (_toolCallId: string, params: any, _signal: AbortSignal | undefined, _onUpdate: unknown, _ctx: unknown) => {

package/src/resources/extensions/gsd/bootstrap/register-hooks.ts

@@ -51,7 +51,9 @@ import {
   confirmDestructiveCommand,
   consumeDestructiveConfirmation,
   isDestructiveConfirmGateId,
+  peekPendingDestructiveCommand,
   requestDestructiveConfirmation,
+  resetDestructiveConfirmation,
 } from "../safety/destructive-confirmation.js";
 import { logWarning as safetyLogWarning, setStderrLoggingEnabled } from "../workflow-logger.js";
 import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
@@ -59,6 +61,7 @@ import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
 import { initNotificationWidget } from "../notification-widget.js";
 import { notifyPreferenceDiagnostics } from "../preferences-diagnostics.js";
+import { resolveEffectivePlanningToolsPolicy } from "../planning-subagent-policy.js";
 import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { extractSubagentAgentClasses } from "./subagent-input.js";
 import {
@@ -187,6 +190,7 @@ function suppressWelcomeHeader(ctx: ExtensionContext): void {
  * are bounded — cleared on activation, session boundaries, and verification.
  */
 const deferredApprovalGates = new Map<string, string>();
+const deferredDestructiveConfirmationPauses = new Set<string>();
 
 export const MINIMAL_GSD_TOOL_NAMES = [
   "gsd_exec",
@@ -618,6 +622,23 @@ function clearDeferredApprovalGate(basePath?: string): void {
   }
 }
 
+function deferDestructiveConfirmationPause(basePath: string): void {
+  deferredDestructiveConfirmationPauses.add(basePath);
+}
+
+function clearDeferredDestructiveConfirmationPause(basePath?: string): void {
+  if (!basePath) {
+    deferredDestructiveConfirmationPauses.clear();
+  } else {
+    deferredDestructiveConfirmationPauses.delete(basePath);
+  }
+}
+
+function isDestructiveConfirmationBlocking(basePath: string): boolean {
+  return deferredDestructiveConfirmationPauses.has(basePath)
+    && Boolean(peekPendingDestructiveCommand(basePath));
+}
+
 function deferApprovalGate(gateId: string, basePath: string): void {
   // Verified-on-disk wins (same adapter policy as activation/re-arm): if the
   // workflow MCP child already verified this gate, deferring would block
@@ -1015,6 +1036,7 @@ export function registerHooks(
     await applyToolCallLoopGuardConfig(basePath);
     approvalQuestionAbortInFlight = false;
     clearDeferredApprovalGate();
+    clearDeferredDestructiveConfirmationPause();
     await resetAskUserQuestionsTurnCache();
     await syncServiceTierStatus(ctx);
     await applyDisabledModelProviderPolicy(ctx);
@@ -1106,6 +1128,7 @@ export function registerHooks(
     resetToolCallLoopGuard();
     await applyToolCallLoopGuardConfig(basePath);
     clearDeferredApprovalGate();
+    clearDeferredDestructiveConfirmationPause();
     await resetAskUserQuestionsTurnCache();
     clearDiscussionFlowState(basePath);
     // /clear or /new destroys the conversation holding a discuss interview, so
@@ -1157,6 +1180,7 @@ export function registerHooks(
       }
     }
     clearDeferredApprovalGate(beforeAgentBasePath);
+    clearDeferredDestructiveConfirmationPause(beforeAgentBasePath);
 
     // session_start can fire before the active provider has settled. By
     // before_agent_start, Claude Code CLI sessions should get the same
@@ -1244,12 +1268,20 @@ export function registerHooks(
       await handleAgentEnd(pi, event, ctx);
     } finally {
       activateDeferredApprovalGate(agentEndBasePath);
+      const destructiveConfirmationBlocking = isDestructiveConfirmationBlocking(agentEndBasePath);
+      clearDeferredDestructiveConfirmationPause(agentEndBasePath);
       await maybePauseAutoForApprovalGate(
         ctx,
         pi,
         isApprovalGateBlocking(agentEndBasePath),
         "Depth confirmation is waiting for your answer — pausing auto-mode.",
       );
+      await maybePauseAutoForApprovalGate(
+        ctx,
+        pi,
+        destructiveConfirmationBlocking,
+        "Destructive-command confirmation is waiting for your answer — pausing auto-mode.",
+      );
     }
   });
 
@@ -1559,6 +1591,7 @@ export function registerHooks(
     const activeUnitType = dash.currentUnit?.type ?? guidedUnit?.unitType;
     if (activeUnitType) {
       const manifest = resolveManifest(activeUnitType);
+      const planningBasePath = dash.basePath || guidedUnit?.basePath || discussionBasePath;
       let planningInput = "";
       let agentClasses: string[] | undefined;
       if (isToolCallEventType("write", event)) {
@@ -1574,9 +1607,9 @@ export function registerHooks(
       const planningGuard = shouldBlockPlanningUnit(
         event.toolName,
         planningInput,
-        dash.basePath || guidedUnit?.basePath || discussionBasePath,
+        planningBasePath,
         activeUnitType,
-        manifest?.tools,
+        resolveEffectivePlanningToolsPolicy(activeUnitType, manifest?.tools, planningBasePath),
         agentClasses,
         (event as { input?: unknown }).input,
         dash.currentUnit?.id,
@@ -1685,6 +1718,7 @@ export function registerHooks(
         // Record the command as pending so an affirmative answer to a
         // destructive_confirm gate (handled in tool_result) can confirm it.
         requestDestructiveConfirmation(command, guardBasePath);
+        deferDestructiveConfirmationPause(guardBasePath);
         const reason = [
           "HARD BLOCK: destructive Bash command requires explicit human confirmation.",
           `Detected: ${classification.labels.join(", ")}`,
@@ -1695,14 +1729,6 @@ export function registerHooks(
         safetyLogWarning("safety", `destructive command: ${classification.labels.join(", ")}`, {
           command: String(command).slice(0, 200),
         });
-        if (ctx) {
-          await maybePauseAutoForApprovalGate(
-            ctx,
-            pi,
-            isAutoActive(),
-            "Destructive-command confirmation is waiting for your answer — pausing auto-mode.",
-          );
-        }
         return { block: true, reason };
       }
     }
@@ -1884,7 +1910,10 @@ export function registerHooks(
         const answer = details.response?.answers?.[question.id];
         if (isDepthConfirmationAnswer(answer?.selected, question.options)) {
           confirmDestructiveCommand(basePath);
+        } else {
+          resetDestructiveConfirmation(basePath);
         }
+        clearDeferredDestructiveConfirmationPause(basePath);
         break;
       }
     }

package/src/resources/extensions/gsd/bootstrap/system-context.ts

@@ -21,6 +21,14 @@ import { formatOverridesSection, formatShortcut, loadActiveOverrides, loadFile,
 import { toPosixPath } from "../../shared/mod.js";
 import { autoEnableCmuxPreferences } from "../commands-cmux.js";
 import { gsdHome } from "../gsd-home.js";
+import { GSD_CONTEXT_MESSAGE_SENTINEL } from "../constants.js";
+
+// Single source of truth lives in ../constants.js; re-exported here because
+// buildContextMessage() stamps this marker on every context injection and the
+// provider payload policy (filterSupersededContextInjections in
+// context-masker.ts) matches it to dedupe. Adding a new context customType?
+// Ensure buildContextMessage still prepends this sentinel.
+export { GSD_CONTEXT_MESSAGE_SENTINEL };
 
 const DEFAULT_CONTEXT_MESSAGE_MAX_CHARS = 4_000;
 const DEFAULT_KNOWLEDGE_MAX_CHARS = 12_000;
@@ -448,14 +456,14 @@ export function buildContextMessage(opts: {
   const memoryContent = markMemoryContextSupplied(opts.memoryBlock.trim());
   if (opts.injection) {
     const content = limitContextMessageContent(
-      memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection,
+      `${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection}`,
       contextCharLimit,
     );
     return { customType: "gsd-guided-context", content, display: false as const };
   }
   if (opts.forensicsInjection) {
     const content = limitContextMessageContent(
-      memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection,
+      `${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection}`,
       contextCharLimit,
     );
     return { customType: "gsd-forensics", content, display: false as const };
@@ -463,7 +471,7 @@ export function buildContextMessage(opts: {
   if (memoryContent) {
     return {
       customType: "gsd-memory",
-      content: limitContextMessageContent(memoryContent, contextCharLimit),
+      content: limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent}`, contextCharLimit),
       display: false as const,
     };
   }

package/src/resources/extensions/gsd/bootstrap/write-gate.ts

@@ -9,7 +9,12 @@ import { canonicalToolName } from "../engine-hook-contract.js";
 import { loadJsonFileOrNull } from "../json-persistence.js";
 import { getIsolationMode } from "../preferences.js";
 import { compileSubagentPermissionContract, type ToolsPolicy } from "../unit-context-manifest.js";
+import {
+  allowedPlanningDispatchAgentsList,
+  isReadOnlyPlanningDispatchAgent,
+} from "../planning-subagent-registry.js";
 import { logWarning } from "../workflow-logger.js";
+import { acquireSyncLock, releaseSyncLock } from "../sync-lock.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { worktreesDirs } from "../worktree-placement.js";
 import { bashReferencesProjectRootOutsideWorktree } from "../worktree-shell-guard.js";
@@ -364,12 +369,63 @@ export function refreshWriteGateStateFromDisk(basePath: string): WriteGateSnapsh
   return currentWriteGateSnapshot(basePath);
 }
 
+const WRITE_GATE_LOCK_NAME = "write-gate.lock";
+
+/**
+ * Test-only seam: fires once inside the held cross-process lock (after acquire,
+ * before the read-merge-write body) with the resolved lock root. Lets a
+ * regression test observe that a concurrent process is genuinely locked out of
+ * the critical section. Production leaves it null. Follows the repo's
+ * `_setGhAvailableForTest` naming convention.
+ */
+let interleaveHookForTest: ((lockRoot: string) => void) | null = null;
+export function _setWriteGateInterleaveHookForTest(fn: ((lockRoot: string) => void) | null): void {
+  interleaveHookForTest = fn;
+}
+
+/**
+ * Serialize the read-merge-write critical section across the two processes
+ * that share the snapshot file (extension host + workflow MCP child). Atomic
+ * rename prevents torn files but not lost updates: without this lock the host
+ * can read the snapshot, the child can arm a gate and persist, then the host's
+ * later persist overwrites `pendingGateId`/`activeQueuePhase` (last-writer-wins
+ * fields) and silently drops the armed HARD-BLOCK gate.
+ *
+ * Fail-OPEN by contract: if a live peer holds the lock we proceed WITHOUT it —
+ * exactly the racy-but-functional behavior that shipped before this lock — and
+ * log once. The lock shrinks the race window to ~zero; it must never block,
+ * throw, or refuse a gate mutation. The lock is skipped entirely when snapshot
+ * persistence is off (no disk file, no cross-process seam).
+ */
+function withWriteGateLock<T>(basePath: string, fn: () => T): T {
+  if (!shouldPersistWriteGateSnapshot()) return fn();
+  const lockRoot = resolveWriteGateSnapshotRoot(basePath);
+  // Materialize `.gsd/` (including a dangling external-state symlink target)
+  // before locking. acquireSyncLock's own mkdir does NOT follow a symlink to
+  // create its target, so without this the O_EXCL open lands on a missing
+  // parent and the lock silently fails open — leaving the seam unserialized
+  // for exactly the external-state projects that need it. This is the same
+  // directory the persist path ensures anyway.
+  try { ensureWriteGateSnapshotDirectory(basePath); } catch { /* best-effort; acquire fails-open below */ }
+  const { acquired } = acquireSyncLock(lockRoot, 0, WRITE_GATE_LOCK_NAME);
+  if (!acquired) {
+    logWarning("intercept", "write-gate: proceeding without cross-process lock (held by live peer)", { lockRoot });
+    return fn();
+  }
+  try {
+    interleaveHookForTest?.(lockRoot);
+    return fn();
+  } finally {
+    releaseSyncLock(lockRoot, WRITE_GATE_LOCK_NAME);
+  }
+}
+
 /**
  * Read-modify-write primitive for gate mutations. Reconciles the disk
  * snapshot into memory (union merge), applies the mutation on top, then
- * persists. The whole sequence is synchronous, so the reconcile read
- * doubles as the pre-persist merge of concurrent writes — there is no
- * version field; the read-merge-write is simply unconditional.
+ * persists — all under the cross-process lock (withWriteGateLock). The whole
+ * sequence is synchronous, so the reconcile read doubles as the pre-persist
+ * merge of concurrent writes; there is no version field.
  *
  * The mutate callback sees the already-reconciled state, so policy checks
  * (e.g. host setPending's verified-on-disk-wins guard) can live inside it
@@ -385,21 +441,23 @@ function mutateWriteGateState(
   opts?: { writer?: WriteGateWriter; reconcile?: boolean },
 ): boolean {
   const state = getWriteGateState(basePath);
-  if (shouldPersistWriteGateSnapshot() && (opts?.reconcile ?? true)) {
-    const disk = readDiskSnapshot(basePath);
-    if (disk) {
-      mergeSnapshotIntoState(state, disk);
-    } else {
-      // Missing OR unparseable on disk: treat as a full reset. Keeping
-      // stale in-memory state across a corrupt snapshot would persist it
-      // back on this very mutation and defeat the documented
-      // "delete the file to clear the HARD BLOCK gate" escape hatch.
-      replaceStateFromSnapshot(state, EMPTY_SNAPSHOT);
+  return withWriteGateLock(basePath, () => {
+    if (shouldPersistWriteGateSnapshot() && (opts?.reconcile ?? true)) {
+      const disk = readDiskSnapshot(basePath);
+      if (disk) {
+        mergeSnapshotIntoState(state, disk);
+      } else {
+        // Missing OR unparseable on disk: treat as a full reset. Keeping
+        // stale in-memory state across a corrupt snapshot would persist it
+        // back on this very mutation and defeat the documented
+        // "delete the file to clear the HARD BLOCK gate" escape hatch.
+        replaceStateFromSnapshot(state, EMPTY_SNAPSHOT);
+      }
     }
-  }
-  if (mutate(state) === false) return false;
-  persistWriteGateSnapshot(basePath, opts?.writer ?? defaultWriteGateWriter());
-  return true;
+    if (mutate(state) === false) return false;
+    persistWriteGateSnapshot(basePath, opts?.writer ?? defaultWriteGateWriter());
+    return true;
+  });
 }
 
 export function isDepthVerified(basePath: string = process.cwd()): boolean {
@@ -643,13 +701,15 @@ export const childWriteGateAdapter: WriteGateStateAdapter = {
 
 function childMutate(basePath: string, mutate: (state: InMemoryWriteGateState) => void): void {
   const state = getWriteGateState(basePath);
-  if (shouldPersistWriteGateSnapshot()) {
-    // Always-fresh: disk is the only truth for the child; discard any
-    // cross-turn in-memory residue before mutating.
-    replaceStateFromSnapshot(state, readDiskSnapshot(basePath) ?? EMPTY_SNAPSHOT);
-  }
-  mutate(state);
-  persistWriteGateSnapshot(basePath, "child");
+  withWriteGateLock(basePath, () => {
+    if (shouldPersistWriteGateSnapshot()) {
+      // Always-fresh: disk is the only truth for the child; discard any
+      // cross-turn in-memory residue before mutating.
+      replaceStateFromSnapshot(state, readDiskSnapshot(basePath) ?? EMPTY_SNAPSHOT);
+    }
+    mutate(state);
+    persistWriteGateSnapshot(basePath, "child");
+  });
 }
 
 /**
@@ -1135,36 +1195,10 @@ export function shouldBlockQueueExecutionInSnapshot(
 const PLANNING_WRITE_TOOLS = new Set(["write", "edit", "multi_edit", "notebook_edit"]);
 const PLANNING_SUBAGENT_TOOLS = new Set(["subagent", "task"]);
 
-/**
- * Canonical registry for agents that planning-dispatch may consider. Unit
- * manifests still declare per-unit subsets via ToolsPolicy.allowedSubagents.
- */
-const PLANNING_DISPATCH_AGENT_REGISTRY = {
-  mnemo: { readOnlySpecialist: true },
-  scout: { readOnlySpecialist: true },
-  planner: { readOnlySpecialist: true },
-  reviewer: { readOnlySpecialist: true },
-  security: { readOnlySpecialist: true },
-  tester: { readOnlySpecialist: true },
-} as const satisfies Record<string, { readonly readOnlySpecialist: boolean }>;
-
-export const ALLOWED_PLANNING_DISPATCH_AGENTS = new Set<string>(
-  Object.entries(PLANNING_DISPATCH_AGENT_REGISTRY)
-    .filter(([, metadata]) => metadata.readOnlySpecialist)
-    .map(([agentId]) => agentId),
-);
+export { ALLOWED_PLANNING_DISPATCH_AGENTS } from "../planning-subagent-registry.js";
 
 let warnedMissingControlledDispatchAgentClasses = false;
 
-function isReadOnlySpecialist(agentId: string): boolean {
-  const metadata = PLANNING_DISPATCH_AGENT_REGISTRY[agentId as keyof typeof PLANNING_DISPATCH_AGENT_REGISTRY];
-  return metadata?.readOnlySpecialist === true;
-}
-
-function allowedPlanningDispatchAgentsList(): string {
-  return [...ALLOWED_PLANNING_DISPATCH_AGENTS].join(", ");
-}
-
 function allowsControlledSubagentDispatch(
   policy: ToolsPolicy,
 ): policy is ToolsPolicy & { readonly allowedSubagents: readonly string[] } {
@@ -1337,7 +1371,7 @@ export function shouldBlockPlanningUnit(
       if (requested.length === 0) {
         return { block: false };
       }
-      const globallyDisallowed = requested.find(a => !isReadOnlySpecialist(a));
+      const globallyDisallowed = requested.find(a => !isReadOnlyPlanningDispatchAgent(a));
       if (globallyDisallowed) {
         return planningBlock(
           unitType,
@@ -1350,7 +1384,7 @@ export function shouldBlockPlanningUnit(
         return planningBlock(
           unitType,
           policy.mode,
-          `subagent dispatch of "${disallowedByPolicy}" not permitted by ToolsPolicy.allowedSubagents; permitted agents for this unit: ${allowedSubagents.join(", ")}`,
+          `subagent dispatch of "${disallowedByPolicy}" not permitted by unit allowlist (ToolsPolicy.allowedSubagents/planning_subagents); permitted agents for this unit: ${allowedSubagents.join(", ")}`,
         );
       }
       return { block: false };

package/src/resources/extensions/gsd/command-feedback.ts

@@ -96,22 +96,29 @@ export function notifyDiscussNeedsInteractiveMenu(
   });
 }
 
-/** Hub picker for /gsd queue (reorder vs add) is unavailable. */
+/**
+ * Hub picker for /gsd queue (reorder vs add) is unavailable.
+ *
+ * Unlike the other picker-guidance notices, /gsd queue does NOT dead-end here:
+ * the caller falls through to the add-work flow, which runs headlessly. So this
+ * notice must avoid the "did not start:" picker-failure phrasing — the headless
+ * host classifies that as a blocked dead-end (see stop-notice.ts / #1294) and
+ * would exit 10 before the add-work run starts.
+ */
 export function notifyQueueHubNeedsInteractiveMenu(
   ctx: ExtensionCommandContext,
   reason: string,
 ): void {
-  notifyPickerCommandNeedsInteractiveMenu(ctx, {
-    command: "/gsd queue",
-    reason,
-    alternatives: [
-      "Add-work flow can run headless — continuing with queue discussion.",
-    ],
-    hints: [
-      "/gsd queue — run from the GSD TUI to reorder pending milestones",
-      "/gsd status — see milestone order and phase",
-    ],
-  });
+  ctx.ui.notify(
+    [
+      `/gsd queue reorder menu needs an interactive session (${reason}).`,
+      "Continuing headless with the add-work flow.",
+      "",
+      "  • /gsd queue — run from the GSD TUI to reorder pending milestones",
+      "  • /gsd status — see milestone order and phase",
+    ].join("\n"),
+    "warning",
+  );
 }
 
 /** /gsd, /gsd new-milestone, /gsd new-project wizard menus. */

package/src/resources/extensions/gsd/compat/compat-marker.ts

@@ -7,7 +7,7 @@
 
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, isAbsolute, normalize } from "node:path";
 
 /** Current marker schema version. Bump on breaking format changes + migrate. */
 export const COMPAT_MARKER_SCHEMA = 2;
@@ -34,8 +34,10 @@ export interface PlanningMarker {
 
 /**
  * Per-file projection entry. `sha` is a normalized-content SHA-256; `entities`
- * is the list of DB entity ids (milestone/slice/task) that the file projects,
- * so repair can scope re-import rather than re-importing the whole tree.
+ * is the list of DB entity ids (milestone/slice/task) that the file projects.
+ * External-edit repair derives milestone ids from this list so markdown status
+ * authority is limited to the drifted projection's milestone scope while the
+ * importer still walks the whole tree.
  */
 export interface ProjectionEntry {
   sha: string;
@@ -220,9 +222,24 @@ function isValidProjectionEntry(x: unknown): x is ProjectionEntry {
   return true;
 }
 
+/**
+ * Projection-map keys are repo-relative paths under .gsd/ or .planning/.
+ * The marker is repo-controlled content, so a key must never escape its
+ * root: reject absolute paths, drive letters, backslashes, and any
+ * normalized form that starts with "..". Mirrors the write-side guard in
+ * db-writer.ts.
+ */
+function isSafeProjectionKey(key: string): boolean {
+  if (key.length === 0 || key.includes("\\") || key.includes("\0")) return false;
+  if (isAbsolute(key) || /^[A-Za-z]:/.test(key)) return false;
+  const norm = normalize(key);
+  return norm !== ".." && !norm.startsWith("../") && !isAbsolute(norm);
+}
+
 function isValidProjectionMap(x: unknown): boolean {
   if (typeof x !== "object" || x === null) return false;
-  for (const v of Object.values(x as Record<string, unknown>)) {
+  for (const [k, v] of Object.entries(x as Record<string, unknown>)) {
+    if (!isSafeProjectionKey(k)) return false;
     if (!isValidProjectionEntry(v)) return false;
   }
   return true;

package/src/resources/extensions/gsd/constants.ts

@@ -31,36 +31,37 @@ export const CACHE_MAX = 50;
  * By scoping tools to this allowlist during discuss dispatches, the grammar
  * sent to the provider stays well under provider limits.
  *
- * Included tools and why:
+ * Included tools and why (canonical names only — aliases are no longer
+ * advertised to models by default, see plan 035):
  *   - gsd_summary_save: writes CONTEXT.md artifacts (all discuss prompts)
- *   - gsd_save_summary: alias for above
  *   - gsd_decision_save: records decisions (discuss.md output phase)
- *   - gsd_save_decision: alias for above
  *   - gsd_plan_milestone: writes roadmap (discuss.md single/multi milestone)
- *   - gsd_milestone_plan: alias for above
  *   - gsd_milestone_generate_id: generates milestone IDs (discuss.md multi-milestone)
- *   - gsd_generate_milestone_id: alias for above
  *   - gsd_requirement_save: creates requirements during discuss
- *   - gsd_save_requirement: alias for above
  *   - gsd_requirement_update: updates requirements during discuss
- *   - gsd_update_requirement: alias for above
  */
 export const DISCUSS_TOOLS_ALLOWLIST: readonly string[] = [
   // Context / summary writing
   "gsd_summary_save",
-  "gsd_save_summary",
   // Decision recording
   "gsd_decision_save",
-  "gsd_save_decision",
   // Milestone planning (needed for discuss.md output phase)
   "gsd_plan_milestone",
-  "gsd_milestone_plan",
   // Milestone ID generation (multi-milestone flow)
   "gsd_milestone_generate_id",
-  "gsd_generate_milestone_id",
   // Requirement updates
   "gsd_requirement_save",
-  "gsd_save_requirement",
   "gsd_requirement_update",
-  "gsd_update_requirement",
 ];
+
+// ─── Context Injection ────────────────────────────────────────────────────────
+
+/**
+ * Leading marker stamped on every buildContextMessage() output
+ * (bootstrap/system-context.ts). Single source of truth for the producer and
+ * the consumer: the provider payload policy (filterSupersededContextInjections
+ * in context-masker.ts) matches this prefix to find and dedupe injected
+ * memory/guided/forensics messages after convertToLlm strips their customType.
+ * Both sides import it from here — do not inline the literal in either module.
+ */
+export const GSD_CONTEXT_MESSAGE_SENTINEL = "[GSD Context Injection]";