@opengsd/gsd-pi 1.8.1 → 1.9.0-dev.97ef11e3

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -118,6 +118,8 @@ export function clearInFlightTools() {
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Input validation error|Invalid arguments for tool|MCP error -32602|No such tool available|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON|does not provide an export named|Named export .* not found|Cannot find module|ERR_MODULE_NOT_FOUND|ERR_MODULE_NOT_EXPORTED|ERR_PACKAGE_PATH_NOT_EXPORTED/i;
 const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
+const SCHEDULE_WAKEUP_TOOL_NAME = "ScheduleWakeup";
+const SCHEDULE_WAKEUP_CONTINUATION_ERROR = "`prompt` is required when `stop` is not true";
 /**
  * Matches the runtime's "tool not registered" error. Unlike the deterministic
  * invocation failures above, this one is usually transient: the workflow MCP
@@ -135,6 +137,44 @@ export function isToolInvocationError(errorMsg) {
         return false;
     return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
+/**
+ * Claude Code validates its native ScheduleWakeup tool outside GSD's schema.
+ * Keep this exact and tool-scoped so similarly worded business validation from
+ * unrelated tools does not pause auto-mode.
+ */
+export function isScheduleWakeupContinuationError(toolName, errorMsg) {
+    return stripMcpToolPrefix(toolName) === SCHEDULE_WAKEUP_TOOL_NAME
+        && errorMsg.trim() === SCHEDULE_WAKEUP_CONTINUATION_ERROR;
+}
+function shouldRecordToolInvocationError(toolName, errorMsg) {
+    return isScheduleWakeupContinuationError(toolName, errorMsg)
+        || isToolInvocationError(errorMsg)
+        || isQueuedUserMessageSkip(errorMsg);
+}
+function isRecordedScheduleWakeupContinuationError(recordedError) {
+    if (!recordedError)
+        return false;
+    const separator = recordedError.indexOf(": ");
+    return separator >= 0 && isScheduleWakeupContinuationError(recordedError.slice(0, separator), recordedError.slice(separator + 2));
+}
+export function updateToolInvocationError(recordedError, toolName, errorMsg) {
+    if (!shouldRecordToolInvocationError(toolName, errorMsg))
+        return recordedError;
+    if (isRecordedScheduleWakeupContinuationError(recordedError)
+        && !isScheduleWakeupContinuationError(toolName, errorMsg))
+        return recordedError;
+    return `${toolName}: ${errorMsg}`;
+}
+/**
+ * A failed continuation must survive successful diagnostic/read calls in the
+ * same turn. Only a later successful ScheduleWakeup proves the continuation
+ * was armed; all other invocation errors retain their existing clear-on-success
+ * behavior.
+ */
+export function shouldClearToolInvocationErrorAfterSuccess(recordedError, successfulToolName) {
+    return !isRecordedScheduleWakeupContinuationError(recordedError)
+        || stripMcpToolPrefix(successfulToolName ?? "") === SCHEDULE_WAKEUP_TOOL_NAME;
+}
 /**
  * Returns true if the error message indicates the called tool was not on the
  * session's tool surface (MCP startup race — see TOOL_UNAVAILABLE_ERROR_RE).

package/dist/resources/extensions/gsd/auto-worktree-cleanup.js

@@ -8,6 +8,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, realpathSync, unlinkSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
 import { gsdRoot } from "./paths.js";
+import { milestoneMetaPath } from "./git-service.js";
 import { logWarning } from "./workflow-logger.js";
 function isSamePath(a, b) {
     try {
@@ -73,6 +74,9 @@ export function clearProjectRootStateFiles(basePath, milestoneId) {
     // worth removing on teardown.
     const transientFiles = [
         join(gsdDir, "STATE.md"),
+        // Integration-branch META now lives flat at .gsd/<MID>-META.json (ADR-045).
+        milestoneMetaPath(basePath, milestoneId),
+        // Legacy location — still cleaned for pre-migration trees.
         join(gsdDir, "milestones", milestoneId, `${milestoneId}-META.json`),
     ];
     for (const file of transientFiles) {

package/dist/resources/extensions/gsd/auto-worktree-sync.js

@@ -5,7 +5,7 @@
 import { cpSync, existsSync, lstatSync as lstatSyncFn, mkdirSync, readdirSync, } from "node:fs";
 import { join } from "node:path";
 import { _isSamePath as isSamePath, } from "./auto-worktree-cleanup.js";
-import { resolveGsdPathContract } from "./paths.js";
+import { dirIsContentBearingLegacyMilestone, resolveGsdPathContract } from "./paths.js";
 import { WorktreeStateProjection } from "./worktree-state-projection.js";
 import { logWarning } from "./workflow-logger.js";
 const PROJECT_PREFERENCES_FILE = "PREFERENCES.md";
@@ -143,10 +143,14 @@ function syncMilestoneLayout(mainGsd, wtGsd, layoutSegment, synced) {
     if (!existsSync(mainMilestonesDir))
         return;
     try {
-        mkdirSync(wtMilestonesDir, { recursive: true });
         const mainMilestones = readdirSync(mainMilestonesDir, { withFileTypes: true })
             .filter((entry) => entry.isDirectory())
-            .map((entry) => entry.name);
+            .map((entry) => entry.name)
+            .filter((name) => layoutSegment !== "milestones" ||
+            dirIsContentBearingLegacyMilestone(join(mainMilestonesDir, name)));
+        if (mainMilestones.length === 0)
+            return;
+        mkdirSync(wtMilestonesDir, { recursive: true });
         for (const milestoneId of mainMilestones) {
             syncMilestoneDirectory(mainMilestonesDir, wtMilestonesDir, milestoneId, synced);
         }

package/dist/resources/extensions/gsd/auto-worktree-teardown.js

@@ -45,7 +45,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
             throw new GSDError(GSD_IO_ERROR, `Failed to chdir back to ${originalBasePath} during teardown: ${err instanceof Error ? err.message : String(err)}`);
         }
         // Mirror cleanup steps from mergeMilestoneToMain abort path:
-        // 1. Remove transient state files (STATE.md, auto.lock, {MID}-META.json).
+        // 1. Remove transient state files (STATE.md, auto.lock, .gsd/{MID}-META.json).
         //    Non-fatal — must not block teardown.
         try {
             clearProjectRootStateFiles(originalBasePath, milestoneId);

package/dist/resources/extensions/gsd/auto.js

@@ -11,7 +11,7 @@
  * next unit type, creates a fresh session, and injects a focused prompt
  * telling the LLM which files to read and what to do.
  */
-import { deriveState } from "./state.js";
+import { deriveState, invalidateStateCache } from "./state.js";
 import { buildRequirementsBacklogSummaryLines, countUnmappedActiveRequirements, getUnmappedActiveRequirements, } from "./requirements-backlog.js";
 import { parseUnitId } from "./unit-id.js";
 import { assessInterruptedSession, readPausedSessionMetadata, PAUSED_SESSION_KV_KEY, } from "./interrupted-session.js";
@@ -28,7 +28,7 @@ import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSes
 import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, loadEffectiveGSDPreferencesWithRegistry, resolveProfileAnchorProvider, getIsolationMode, resolveEffectiveUnitIsolationMode, } from "./preferences.js";
 import { playNotificationBell, sendDesktopNotification } from "./notifications.js";
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, HARD_CONTEXT_REROOT_THRESHOLD_PERCENT, resolveCompactionThresholdPercent, shouldRerootStepSessionForContext, shouldWarnStepSessionForContext, } from "./auto-budget.js";
-import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, isDeterministicPolicyError, } from "./auto-tool-tracking.js";
+import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, updateToolInvocationError, } from "./auto-tool-tracking.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
 import { selectAndApplyModel, resolveModelId, clearToolBaseline, isModelUnavailable, applyThinkingLevelForModel } from "./auto-model-selection.js";
 import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
@@ -214,6 +214,9 @@ function captureMilestoneLockEnv(milestoneId) {
     else {
         delete process.env.GSD_MILESTONE_LOCK;
     }
+    // The derive cache is keyed on basePath only; GSD_MILESTONE_LOCK changes
+    // what deriveState computes, so a lock flip must not serve a cached result.
+    invalidateStateCache();
 }
 function restoreMilestoneLockEnv() {
     if (!s.milestoneLockEnvCaptured)
@@ -227,6 +230,7 @@ function restoreMilestoneLockEnv() {
     s.previousMilestoneLockEnv = null;
     s.hadMilestoneLockEnv = false;
     s.milestoneLockEnvCaptured = false;
+    invalidateStateCache();
 }
 /**
  * Rebuild s.scope from the current s.basePath / s.originalBasePath / s.currentMilestoneId.
@@ -613,15 +617,14 @@ export function markToolEnd(toolCallId) {
  * Called from tool_execution_end when a GSD tool fails with isError.
  * Stores the error if it matches:
  *   - tool-invocation-error pattern (malformed/truncated JSON)
+ *   - failed ScheduleWakeup continuation validation (#1379)
  *   - queued-user-message skip pattern
  *   - deterministic policy rejection (#4973, e.g. context_write_blocked)
  */
 export function recordToolInvocationError(toolName, errorMsg) {
     if (!s.active)
         return;
-    if (isToolInvocationError(errorMsg) || isQueuedUserMessageSkip(errorMsg) || isDeterministicPolicyError(errorMsg)) {
-        s.lastToolInvocationError = `${toolName}: ${errorMsg}`;
-    }
+    s.lastToolInvocationError = updateToolInvocationError(s.lastToolInvocationError, toolName, errorMsg);
 }
 export function getOldestInFlightToolAgeMs() {
     return _getOldestInFlightToolAgeMs();
@@ -2437,7 +2440,18 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
         startedAt: hookStartedAt,
         workspaceRoot: s.basePath,
     });
-    const result = await s.cmdCtx.newSession({ workspaceRoot: s.basePath });
+    const cmdCtx = s.cmdCtx;
+    if (typeof cmdCtx?.newSession !== "function") {
+        const message = "Auto-mode has no command context for dispatch.";
+        ctx.ui.notify(message, "error");
+        const unitToCommit = previousCurrentUnit ?? s.currentUnit;
+        if (unitToCommit) {
+            await autoCommitUnit(s.basePath, unitToCommit.type, unitToCommit.id, ctx);
+        }
+        await stopAuto(ctx, pi, message, { preserveWorktree: true });
+        return false;
+    }
+    const result = await cmdCtx.newSession({ workspaceRoot: s.basePath });
     if (result.cancelled) {
         await stopAuto(ctx, pi);
         return false;

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -46,6 +46,8 @@ function registerAlias(pi, toolDef, aliasName, canonicalName) {
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- toolDef shape matches ToolDefinition but varies by schema
 function registerWorkflowTool(pi, toolDef) {
     pi.registerTool(toolDef);
+    if (process.env.GSD_ADVERTISE_TOOL_ALIASES !== "1")
+        return; // canonical-only model surface (see plan 035)
     for (const alias of aliasesForWorkflowTool(toolDef.name)) {
         registerAlias(pi, toolDef, alias, toolDef.name);
     }
@@ -731,12 +733,12 @@ export function registerDbTools(pi) {
     const planTaskTool = {
         name: "gsd_plan_task",
         label: "Plan Task",
-        description: "Write task planning state to the GSD database, render tasks/T##-PLAN.md from DB, and clear caches after a successful render.",
-        promptSnippet: "Plan a task via DB write + task PLAN render + cache invalidation",
+        description: "Write task planning state to the GSD database, render the slice PLAN from DB, and clear caches after a successful render.",
+        promptSnippet: "Plan a task via DB write + slice PLAN render + cache invalidation",
         promptGuidelines: [
-            "Use gsd_plan_task for task planning instead of writing tasks/T##-PLAN.md directly.",
+            "Use gsd_plan_task for task planning instead of writing task PLAN files directly.",
             "Keep parameters flat and provide the full task planning payload.",
-            "The tool validates input, requires an existing parent slice, writes task planning data, renders the task PLAN file from DB, and clears both state and parse caches after success.",
+            "The tool validates input, requires an existing parent slice, writes task planning data, renders the slice PLAN file from DB, and clears both state and parse caches after success.",
             "Use the canonical name gsd_plan_task; gsd_task_plan is only an alias.",
         ],
         parameters: Type.Object({
@@ -812,6 +814,12 @@ export function registerDbTools(pi) {
                 verdict: Type.String({ description: "Pass/fail verdict (e.g. '✅ pass', '❌ fail')" }),
                 durationMs: Type.Number({ description: "Duration of the command in milliseconds" }),
             }), { description: "Array of verification evidence entries (structured objects only)" })),
+            reworkResolution: Type.Optional(Type.Array(Type.Object({
+                findingId: Type.String({ description: "Rework finding ID being resolved (e.g. F1)" }),
+                status: StringEnum(["resolved", "deferred-with-override"], { description: "Resolution status for this finding" }),
+                evidence: Type.String({ description: "Concrete evidence that the required fix was completed" }),
+                decisionRef: Type.Optional(Type.String({ description: "Decision reference required for deferred-with-override findings" })),
+            }), { description: "Resolution evidence for structured rework findings linked to this task" })),
             // Single-writer v3 audit trail (Stream 2): caller-provided actor identity + causation.
             actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail (e.g. 'executor-01', 'gsd-orchestrator')" })),
             triggerReason: Type.Optional(Type.String({ description: "Caller-provided reason this action was triggered (e.g. 'task verified after retry')" })),
@@ -1084,6 +1092,74 @@ export function registerDbTools(pi) {
         execute: replanSliceExecute,
     };
     registerWorkflowTool(pi, replanSliceTool);
+    // ─── gsd_replan_task ───────────────────────────────────────────────────
+    const replanTaskExecute = async (_toolCallId, params, _signal, _onUpdate, _ctx) => {
+        const { executeReplanTask } = await loadWorkflowExecutors();
+        return executeReplanTask(params, resolveWorkflowToolBasePath(_ctx, params));
+    };
+    const replanTaskTool = {
+        name: "gsd_replan_task",
+        label: "Replan Task",
+        description: "Update one pending task's planning contract after rework without touching sibling tasks. " +
+            "Completed tasks are structurally protected. Re-renders the task/slice PLAN projection and records replan history.",
+        promptSnippet: "Replan one pending GSD task after rework",
+        promptGuidelines: [
+            "Use gsd_replan_task when a reopened pending task needs its title, description, files, verify, inputs, or expectedOutput updated for rework.",
+            "The task must already exist and be pending; completed tasks are rejected.",
+            "Set reworkBriefRef when a structured rework brief triggered the task replan.",
+        ],
+        parameters: Type.Object({
+            milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
+            sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
+            taskId: Type.String({ description: "Task ID (e.g. T01)" }),
+            title: Type.String({ description: "Updated task title" }),
+            description: Type.String({ description: "Updated task description incorporating rework scope" }),
+            estimate: Type.String({ description: "Updated task estimate string" }),
+            files: Type.Array(Type.String(), { description: "Updated files likely touched" }),
+            verify: Type.String({ description: "Updated verification command or block" }),
+            inputs: Type.Array(Type.String(), { description: "Updated input files or references" }),
+            expectedOutput: Type.Array(Type.String(), { description: "Updated files this task creates or overwrites" }),
+            reworkBriefRef: Type.Optional(Type.String({ description: "Rework brief ID/reference that triggered this task replan" })),
+            actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail" })),
+            triggerReason: Type.Optional(Type.String({ description: "Caller-provided reason this action was triggered" })),
+        }),
+        execute: replanTaskExecute,
+    };
+    registerWorkflowTool(pi, replanTaskTool);
+    // ─── gsd_rework_brief_save ─────────────────────────────────────────────
+    const reworkBriefSaveExecute = async (_toolCallId, params, _signal, _onUpdate, _ctx) => {
+        const { executeReworkBriefSave } = await loadWorkflowExecutors();
+        return executeReworkBriefSave(params, resolveWorkflowToolBasePath(_ctx, params));
+    };
+    const reworkBriefSaveTool = {
+        name: "gsd_rework_brief_save",
+        label: "Save Rework Brief",
+        description: "Persist a structured rework brief for a task. Blocking findings are enforced by gsd_task_complete until resolved with evidence.",
+        promptSnippet: "Persist structured task rework findings",
+        promptGuidelines: [
+            "Use gsd_rework_brief_save when post-unit checks produce task rework findings.",
+            "Use severity 'blocking' for findings that must be resolved before gsd_task_complete succeeds.",
+            "Each finding needs a stable findingId, requiredFix, and verificationCommands.",
+        ],
+        parameters: Type.Object({
+            briefId: Type.Optional(Type.String({ description: "Stable brief ID; omitted defaults to RB-<milestone>-<slice>-<task>" })),
+            milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
+            sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
+            taskId: Type.String({ description: "Task ID (e.g. T01)" }),
+            findings: Type.Array(Type.Object({
+                findingId: Type.String({ description: "Stable finding ID (e.g. F1)" }),
+                severity: StringEnum(["blocking", "advisory"], { description: "Whether this finding blocks task completion" }),
+                description: Type.String({ description: "What was found" }),
+                requiredFix: Type.String({ description: "What must change" }),
+                verificationCommands: Type.Array(Type.String(), { description: "Commands that must pass after the fix" }),
+                status: Type.Optional(StringEnum(["pending", "resolved", "deferred-with-override"], { description: "Finding status; defaults to pending" })),
+                evidence: Type.Optional(Type.String({ description: "Resolution evidence when already resolved" })),
+                decisionRef: Type.Optional(Type.String({ description: "Decision reference for deferred-with-override" })),
+            }), { description: "Structured rework findings for this task" }),
+        }),
+        execute: reworkBriefSaveExecute,
+    };
+    registerWorkflowTool(pi, reworkBriefSaveTool);
     // ─── gsd_reassess_roadmap (gsd_roadmap_reassess alias) ─────────────────
     const reassessRoadmapExecute = async (_toolCallId, params, _signal, _onUpdate, _ctx) => {
         const { executeReassessRoadmap } = await loadWorkflowExecutors();

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -22,13 +22,14 @@ import { saveActivityLog } from "../activity-log.js";
 import { recordToolCall as safetyRecordToolCall, recordToolResult as safetyRecordToolResult, saveEvidenceToDisk } from "../safety/evidence-collector.js";
 import { parseUnitId } from "../unit-id.js";
 import { classifyCommand } from "../safety/destructive-guard.js";
-import { confirmDestructiveCommand, consumeDestructiveConfirmation, isDestructiveConfirmGateId, requestDestructiveConfirmation, } from "../safety/destructive-confirmation.js";
+import { confirmDestructiveCommand, consumeDestructiveConfirmation, isDestructiveConfirmGateId, peekPendingDestructiveCommand, requestDestructiveConfirmation, resetDestructiveConfirmation, } from "../safety/destructive-confirmation.js";
 import { logWarning as safetyLogWarning, setStderrLoggingEnabled } from "../workflow-logger.js";
 import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
 import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
 import { initNotificationWidget } from "../notification-widget.js";
 import { notifyPreferenceDiagnostics } from "../preferences-diagnostics.js";
+import { resolveEffectivePlanningToolsPolicy } from "../planning-subagent-policy.js";
 import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { extractSubagentAgentClasses } from "./subagent-input.js";
 import { approvalGateIdForUnit, evaluateAskUserQuestionsRound, formatUnansweredConsentQuestionMessage, isExplicitApprovalResponse, messageHasPendingAskUserQuestionsTool, shouldPauseForQuestion, } from "../consent-question.js";
@@ -136,6 +137,7 @@ function suppressWelcomeHeader(ctx) {
  * are bounded — cleared on activation, session boundaries, and verification.
  */
 const deferredApprovalGates = new Map();
+const deferredDestructiveConfirmationPauses = new Set();
 export const MINIMAL_GSD_TOOL_NAMES = [
     "gsd_exec",
     "gsd_exec_search",
@@ -456,6 +458,21 @@ function clearDeferredApprovalGate(basePath) {
         deferredApprovalGates.delete(basePath);
     }
 }
+function deferDestructiveConfirmationPause(basePath) {
+    deferredDestructiveConfirmationPauses.add(basePath);
+}
+function clearDeferredDestructiveConfirmationPause(basePath) {
+    if (!basePath) {
+        deferredDestructiveConfirmationPauses.clear();
+    }
+    else {
+        deferredDestructiveConfirmationPauses.delete(basePath);
+    }
+}
+function isDestructiveConfirmationBlocking(basePath) {
+    return deferredDestructiveConfirmationPauses.has(basePath)
+        && Boolean(peekPendingDestructiveCommand(basePath));
+}
 function deferApprovalGate(gateId, basePath) {
     // Verified-on-disk wins (same adapter policy as activation/re-arm): if the
     // workflow MCP child already verified this gate, deferring would block
@@ -798,6 +815,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         await applyToolCallLoopGuardConfig(basePath);
         approvalQuestionAbortInFlight = false;
         clearDeferredApprovalGate();
+        clearDeferredDestructiveConfirmationPause();
         await resetAskUserQuestionsTurnCache();
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
@@ -883,6 +901,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         resetToolCallLoopGuard();
         await applyToolCallLoopGuardConfig(basePath);
         clearDeferredApprovalGate();
+        clearDeferredDestructiveConfirmationPause();
         await resetAskUserQuestionsTurnCache();
         clearDiscussionFlowState(basePath);
         // /clear or /new destroys the conversation holding a discuss interview, so
@@ -933,6 +952,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             }
         }
         clearDeferredApprovalGate(beforeAgentBasePath);
+        clearDeferredDestructiveConfirmationPause(beforeAgentBasePath);
         // session_start can fire before the active provider has settled. By
         // before_agent_start, Claude Code CLI sessions should get the same
         // project MCP config that /gsd mcp init would write.
@@ -1010,7 +1030,10 @@ export function registerHooks(pi, ecosystemHandlers) {
         }
         finally {
             activateDeferredApprovalGate(agentEndBasePath);
+            const destructiveConfirmationBlocking = isDestructiveConfirmationBlocking(agentEndBasePath);
+            clearDeferredDestructiveConfirmationPause(agentEndBasePath);
             await maybePauseAutoForApprovalGate(ctx, pi, isApprovalGateBlocking(agentEndBasePath), "Depth confirmation is waiting for your answer — pausing auto-mode.");
+            await maybePauseAutoForApprovalGate(ctx, pi, destructiveConfirmationBlocking, "Destructive-command confirmation is waiting for your answer — pausing auto-mode.");
         }
     });
     pi.on("message_end", async (event) => {
@@ -1276,6 +1299,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         const activeUnitType = dash.currentUnit?.type ?? guidedUnit?.unitType;
         if (activeUnitType) {
             const manifest = resolveManifest(activeUnitType);
+            const planningBasePath = dash.basePath || guidedUnit?.basePath || discussionBasePath;
             let planningInput = "";
             let agentClasses;
             if (isToolCallEventType("write", event)) {
@@ -1291,7 +1315,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                 // Subagent inputs use { agent }, { tasks: [{ agent }] }, or { chain: [{ agent }] }.
                 agentClasses = extractSubagentAgentClasses(event.input);
             }
-            const planningGuard = shouldBlockPlanningUnit(event.toolName, planningInput, dash.basePath || guidedUnit?.basePath || discussionBasePath, activeUnitType, manifest?.tools, agentClasses, event.input, dash.currentUnit?.id);
+            const planningGuard = shouldBlockPlanningUnit(event.toolName, planningInput, planningBasePath, activeUnitType, resolveEffectivePlanningToolsPolicy(activeUnitType, manifest?.tools, planningBasePath), agentClasses, event.input, dash.currentUnit?.id);
             if (planningGuard.block)
                 return planningGuard;
         }
@@ -1373,6 +1397,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                 // Record the command as pending so an affirmative answer to a
                 // destructive_confirm gate (handled in tool_result) can confirm it.
                 requestDestructiveConfirmation(command, guardBasePath);
+                deferDestructiveConfirmationPause(guardBasePath);
                 const reason = [
                     "HARD BLOCK: destructive Bash command requires explicit human confirmation.",
                     `Detected: ${classification.labels.join(", ")}`,
@@ -1383,9 +1408,6 @@ export function registerHooks(pi, ecosystemHandlers) {
                 safetyLogWarning("safety", `destructive command: ${classification.labels.join(", ")}`, {
                     command: String(command).slice(0, 200),
                 });
-                if (ctx) {
-                    await maybePauseAutoForApprovalGate(ctx, pi, isAutoActive(), "Destructive-command confirmation is waiting for your answer — pausing auto-mode.");
-                }
                 return { block: true, reason };
             }
         }
@@ -1426,7 +1448,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             recordRetryableHarnessToolError(toolName, resultPayload, errorText);
         }
         else if (isAutoActive()) {
-            clearToolInvocationError();
+            clearToolInvocationError(event.toolName);
         }
         // Interactive Closeout adapter (ADR-032): auto-mode owns closeout for its
         // own units; interactive completions get the durable git subset (commit +
@@ -1541,6 +1563,10 @@ export function registerHooks(pi, ecosystemHandlers) {
                 if (isDepthConfirmationAnswer(answer?.selected, question.options)) {
                     confirmDestructiveCommand(basePath);
                 }
+                else {
+                    resetDestructiveConfirmation(basePath);
+                }
+                clearDeferredDestructiveConfirmationPause(basePath);
                 break;
             }
         }
@@ -1605,7 +1631,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             recordRetryableHarnessToolError(toolName, event.result, errorText);
         }
         else if (isAutoActive()) {
-            clearToolInvocationError();
+            clearToolInvocationError(event.toolName);
         }
         // Safety harness: record tool execution results for evidence cross-referencing
         if (isAutoActive()) {

package/dist/resources/extensions/gsd/bootstrap/system-context.js

@@ -18,6 +18,13 @@ import { formatOverridesSection, formatShortcut, loadActiveOverrides, loadFile,
 import { toPosixPath } from "../../shared/mod.js";
 import { autoEnableCmuxPreferences } from "../commands-cmux.js";
 import { gsdHome } from "../gsd-home.js";
+import { GSD_CONTEXT_MESSAGE_SENTINEL } from "../constants.js";
+// Single source of truth lives in ../constants.js; re-exported here because
+// buildContextMessage() stamps this marker on every context injection and the
+// provider payload policy (filterSupersededContextInjections in
+// context-masker.ts) matches it to dedupe. Adding a new context customType?
+// Ensure buildContextMessage still prepends this sentinel.
+export { GSD_CONTEXT_MESSAGE_SENTINEL };
 const DEFAULT_CONTEXT_MESSAGE_MAX_CHARS = 4_000;
 const DEFAULT_KNOWLEDGE_MAX_CHARS = 12_000;
 const DEFAULT_CODEBASE_MAX_CHARS = 8_000;
@@ -385,17 +392,17 @@ export function buildContextMessage(opts) {
     const contextCharLimit = getContextMessageCharLimit();
     const memoryContent = markMemoryContextSupplied(opts.memoryBlock.trim());
     if (opts.injection) {
-        const content = limitContextMessageContent(memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection, contextCharLimit);
+        const content = limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection}`, contextCharLimit);
         return { customType: "gsd-guided-context", content, display: false };
     }
     if (opts.forensicsInjection) {
-        const content = limitContextMessageContent(memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection, contextCharLimit);
+        const content = limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection}`, contextCharLimit);
         return { customType: "gsd-forensics", content, display: false };
     }
     if (memoryContent) {
         return {
             customType: "gsd-memory",
-            content: limitContextMessageContent(memoryContent, contextCharLimit),
+            content: limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent}`, contextCharLimit),
             display: false,
         };
     }