@opengsd/gsd-pi 1.9.0 → 1.10.0-dev.a5e42e99

package/dist/resources/extensions/gsd/auto-runtime-state.js

@@ -1,6 +1,6 @@
 // GSD auto-mode runtime state
 import { AutoSession } from "./auto/session.js";
-import { isDeterministicPolicyError, isQueuedUserMessageSkip, isToolInvocationError, markToolEnd as markTrackedToolEnd, markToolStart as markTrackedToolStart, } from "./auto-tool-tracking.js";
+import { markToolEnd as markTrackedToolEnd, markToolStart as markTrackedToolStart, shouldClearToolInvocationErrorAfterSuccess, updateToolInvocationError, } from "./auto-tool-tracking.js";
 // Re-exported as a pure pass-through. Must stay UNGATED (no autoSession.active
 // argument, unlike markToolStart at the bottom of this file) so it is true in
 // foreground where the foreground approval-gate pause consults it.
@@ -61,13 +61,13 @@ export function markToolEnd(toolCallId) {
 export function recordToolInvocationError(toolName, errorMsg) {
     if (!autoSession.active)
         return;
-    if (isToolInvocationError(errorMsg) || isQueuedUserMessageSkip(errorMsg) || isDeterministicPolicyError(errorMsg)) {
-        autoSession.lastToolInvocationError = `${toolName}: ${errorMsg}`;
-    }
+    autoSession.lastToolInvocationError = updateToolInvocationError(autoSession.lastToolInvocationError, toolName, errorMsg);
 }
-export function clearToolInvocationError() {
+export function clearToolInvocationError(successfulToolName) {
     if (!autoSession.active)
         return;
+    if (!shouldClearToolInvocationErrorAfterSuccess(autoSession.lastToolInvocationError, successfulToolName))
+        return;
     autoSession.lastToolInvocationError = null;
 }
 export function getSourceObservationStore() {

package/dist/resources/extensions/gsd/auto-start.js

@@ -46,9 +46,10 @@ import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.
 import { extractVerdict } from "./verdict-parser.js";
 import { auditOrphanedPreflightStashes } from "./orphan-stash-audit.js";
 import { parseProject } from "./schemas/parsers.js";
+import { LAYOUT_SEGMENTS } from "./layout-policy.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { existsSync, mkdirSync, readFileSync, rmSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, } from "node:fs";
 import { join } from "node:path";
 import { validateDirectory } from "./validate-directory.js";
 import { isCustomProvider, resolveDefaultSessionModel, resolveDynamicRoutingConfig, } from "./preferences-models.js";
@@ -73,6 +74,30 @@ const MAX_CONSECUTIVE_COMPLETE_BOOTSTRAPS = 2;
 export function hasGitIndexLockForTest(basePath) {
     return existsSync(join(basePath, ".git", "index.lock"));
 }
+function isEmptyDirectory(dirPath) {
+    try {
+        return existsSync(dirPath) && readdirSync(dirPath).length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function reconcileFlatPhaseBootstrapLayout(basePath) {
+    const gsdDir = join(basePath, ".gsd");
+    const phasesPath = join(gsdDir, LAYOUT_SEGMENTS.level1);
+    const milestonesPath = join(gsdDir, "milestones");
+    if (isEmptyDirectory(milestonesPath)) {
+        if (!existsSync(phasesPath))
+            mkdirSync(phasesPath, { recursive: true });
+        rmSync(milestonesPath, { recursive: true, force: true });
+        return true;
+    }
+    if (!existsSync(phasesPath) && !existsSync(milestonesPath)) {
+        mkdirSync(phasesPath, { recursive: true });
+        return true;
+    }
+    return false;
+}
 export function _shouldAbortBootstrapForUnavailableDbForTest(gsdDbPath, dbAvailable, pathExists = existsSync) {
     return pathExists(gsdDbPath) && !dbAvailable;
 }
@@ -796,7 +821,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     // provider the user is not logged into and surface as "Not logged in · Please
     // run /login" before pausing and resetting to claude-code/claude-sonnet-4-6.
     const manualSessionOverride = getSessionModelOverride(ctx.sessionManager.getSessionId());
-    const sessionProviderIsCustom = isCustomProvider(ctx.model?.provider);
+    const sessionProviderIsCustom = isCustomProvider(ctx.model?.provider, ctx.modelRegistry);
     const profileModelIds = modelIdsForProfileResolution(ctx.modelRegistry, resolveProfileAnchorProvider(ctx.model?.provider), resolveDisabledModelProvidersFromPreferences());
     const preferredModel = sessionProviderIsCustom
         ? null
@@ -868,20 +893,15 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         ensureGitignore(base, { manageGitignore });
         if (manageGitignore !== false)
             untrackRuntimeFiles(base);
-        // Bootstrap milestones/ if it doesn't exist.
-        // Check milestones/ directly — ensureGsdSymlink above already created .gsd/,
-        // so checking .gsd/ existence would be dead code (#2942).
-        const gsdDir = join(base, ".gsd");
-        const milestonesPath = join(gsdDir, "milestones");
-        if (!existsSync(milestonesPath)) {
-            mkdirSync(milestonesPath, { recursive: true });
+        // Bootstrap the flat-phase projection root and clean empty legacy scaffolds.
+        if (reconcileFlatPhaseBootstrapLayout(base)) {
             try {
                 nativeAddAll(base);
                 nativeCommit(base, "chore: init gsd");
             }
             catch (err) {
                 /* nothing to commit */
-                logWarning("engine", `mkdir failed: ${err instanceof Error ? err.message : String(err)}`);
+                logWarning("engine", `layout bootstrap commit failed: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
         {

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -118,6 +118,8 @@ export function clearInFlightTools() {
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Input validation error|Invalid arguments for tool|MCP error -32602|No such tool available|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON|does not provide an export named|Named export .* not found|Cannot find module|ERR_MODULE_NOT_FOUND|ERR_MODULE_NOT_EXPORTED|ERR_PACKAGE_PATH_NOT_EXPORTED/i;
 const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
+const SCHEDULE_WAKEUP_TOOL_NAME = "ScheduleWakeup";
+const SCHEDULE_WAKEUP_CONTINUATION_ERROR = "`prompt` is required when `stop` is not true";
 /**
  * Matches the runtime's "tool not registered" error. Unlike the deterministic
  * invocation failures above, this one is usually transient: the workflow MCP
@@ -135,6 +137,44 @@ export function isToolInvocationError(errorMsg) {
         return false;
     return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
+/**
+ * Claude Code validates its native ScheduleWakeup tool outside GSD's schema.
+ * Keep this exact and tool-scoped so similarly worded business validation from
+ * unrelated tools does not pause auto-mode.
+ */
+export function isScheduleWakeupContinuationError(toolName, errorMsg) {
+    return stripMcpToolPrefix(toolName) === SCHEDULE_WAKEUP_TOOL_NAME
+        && errorMsg.trim() === SCHEDULE_WAKEUP_CONTINUATION_ERROR;
+}
+function shouldRecordToolInvocationError(toolName, errorMsg) {
+    return isScheduleWakeupContinuationError(toolName, errorMsg)
+        || isToolInvocationError(errorMsg)
+        || isQueuedUserMessageSkip(errorMsg);
+}
+function isRecordedScheduleWakeupContinuationError(recordedError) {
+    if (!recordedError)
+        return false;
+    const separator = recordedError.indexOf(": ");
+    return separator >= 0 && isScheduleWakeupContinuationError(recordedError.slice(0, separator), recordedError.slice(separator + 2));
+}
+export function updateToolInvocationError(recordedError, toolName, errorMsg) {
+    if (!shouldRecordToolInvocationError(toolName, errorMsg))
+        return recordedError;
+    if (isRecordedScheduleWakeupContinuationError(recordedError)
+        && !isScheduleWakeupContinuationError(toolName, errorMsg))
+        return recordedError;
+    return `${toolName}: ${errorMsg}`;
+}
+/**
+ * A failed continuation must survive successful diagnostic/read calls in the
+ * same turn. Only a later successful ScheduleWakeup proves the continuation
+ * was armed; all other invocation errors retain their existing clear-on-success
+ * behavior.
+ */
+export function shouldClearToolInvocationErrorAfterSuccess(recordedError, successfulToolName) {
+    return !isRecordedScheduleWakeupContinuationError(recordedError)
+        || stripMcpToolPrefix(successfulToolName ?? "") === SCHEDULE_WAKEUP_TOOL_NAME;
+}
 /**
  * Returns true if the error message indicates the called tool was not on the
  * session's tool surface (MCP startup race — see TOOL_UNAVAILABLE_ERROR_RE).

package/dist/resources/extensions/gsd/auto-verification.js

@@ -1,7 +1,7 @@
 // Project/App: gsd-pi
 // File Purpose: Post-unit verification gate for GSD auto-mode units.
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { relMilestoneFile, resolveSlicePath } from "./paths.js";
+import { legacyMilestonesDir, relMilestoneFile, resolveMilestonePath, resolveSlicePath } from "./paths.js";
 import { resolveMilestoneValidationVerdict } from "./milestone-validation-verdict.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
 import { parseUnitId } from "./unit-id.js";
@@ -24,6 +24,20 @@ import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { formatPostUnitStatusCard } from "./auto-status-message.js";
 import { detectWebApp } from "./web-app-uat.js";
+function resolveVerificationEvidenceLocation(basePath, milestoneId, sliceId) {
+    const mDir = resolveMilestonePath(basePath, milestoneId);
+    if (!mDir)
+        return null;
+    const legacyBase = legacyMilestonesDir(basePath);
+    const isLegacy = mDir.startsWith(legacyBase + "/") || mDir.startsWith(legacyBase + "\\");
+    if (!isLegacy) {
+        return { dir: mDir, fileSliceId: sliceId };
+    }
+    const sDir = resolveSlicePath(basePath, milestoneId, sliceId);
+    if (!sDir)
+        return null;
+    return { dir: join(sDir, "tasks") };
+}
 function getCurrentUnitCostStats(unitId) {
     const ledger = getLedger();
     if (!ledger || !Array.isArray(ledger.units) || ledger.units.length === 0) {
@@ -431,11 +445,10 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
         const taskAlreadyComplete = taskRow?.status === "complete" || taskRow?.status === "done";
         if (mid && sid && tid) {
             try {
-                const sDir = resolveSlicePath(s.basePath, mid, sid);
-                if (sDir) {
-                    const tasksDir = join(sDir, "tasks");
+                const evidenceLocation = resolveVerificationEvidenceLocation(s.basePath, mid, sid);
+                if (evidenceLocation) {
                     if (result.passed) {
-                        writeVerificationJSON(result, tasksDir, tid, s.currentUnit.id);
+                        writeVerificationJSON(result, evidenceLocation.dir, tid, s.currentUnit.id, undefined, undefined, evidenceLocation.fileSliceId);
                     }
                     else {
                         const nextAttempt = attempt + 1;
@@ -444,7 +457,7 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                             verdict.retryable &&
                             autoFixEnabled &&
                             nextAttempt <= maxRetries;
-                        writeVerificationJSON(result, tasksDir, tid, s.currentUnit.id, includeRetryMetadata ? nextAttempt : undefined, includeRetryMetadata ? maxRetries : undefined);
+                        writeVerificationJSON(result, evidenceLocation.dir, tid, s.currentUnit.id, includeRetryMetadata ? nextAttempt : undefined, includeRetryMetadata ? maxRetries : undefined, evidenceLocation.fileSliceId);
                     }
                 }
             }
@@ -560,9 +573,8 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
         // Re-write verification evidence JSON with post-execution checks
         if (postExecChecks && postExecChecks.length > 0 && mid && sid && tid) {
             try {
-                const sDir = resolveSlicePath(s.basePath, mid, sid);
-                if (sDir) {
-                    const tasksDir = join(sDir, "tasks");
+                const evidenceLocation = resolveVerificationEvidenceLocation(s.basePath, mid, sid);
+                if (evidenceLocation) {
                     // Add postExecutionChecks to the result for the JSON write
                     const resultWithPostExec = {
                         ...result,
@@ -570,7 +582,7 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                         passed: result.passed && !postExecBlockingFailure,
                     };
                     // Manually write with postExecutionChecks field
-                    writeVerificationJSONWithPostExec(resultWithPostExec, tasksDir, tid, s.currentUnit.id, postExecChecks, postExecBlockingFailure ? attempt + 1 : undefined, postExecBlockingFailure ? maxRetries : undefined);
+                    writeVerificationJSONWithPostExec(resultWithPostExec, evidenceLocation.dir, tid, s.currentUnit.id, postExecChecks, postExecBlockingFailure ? attempt + 1 : undefined, postExecBlockingFailure ? maxRetries : undefined, evidenceLocation.fileSliceId);
                 }
             }
             catch (evidenceErr) {
@@ -738,7 +750,7 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
  * Write verification evidence JSON with post-execution checks included.
  * This is a variant of writeVerificationJSON that adds the postExecutionChecks field.
  */
-function writeVerificationJSONWithPostExec(result, tasksDir, taskId, unitId, postExecutionChecks, retryAttempt, maxRetries) {
+function writeVerificationJSONWithPostExec(result, tasksDir, taskId, unitId, postExecutionChecks, retryAttempt, maxRetries, sliceId) {
     mkdirSync(tasksDir, { recursive: true });
     const evidence = {
         schemaVersion: 1,
@@ -774,6 +786,7 @@ function writeVerificationJSONWithPostExec(result, tasksDir, taskId, unitId, pos
             fixAvailable: w.fixAvailable,
         }));
     }
-    const filePath = join(tasksDir, `${taskId}-VERIFY.json`);
+    const fileName = sliceId ? `${sliceId}-${taskId}-VERIFY.json` : `${taskId}-VERIFY.json`;
+    const filePath = join(tasksDir, fileName);
     writeFileSync(filePath, JSON.stringify(evidence, null, 2) + "\n", "utf-8");
 }

package/dist/resources/extensions/gsd/auto-worktree-cleanup.js

@@ -8,6 +8,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, realpathSync, unlinkSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
 import { gsdRoot } from "./paths.js";
+import { milestoneMetaPath } from "./git-service.js";
 import { logWarning } from "./workflow-logger.js";
 function isSamePath(a, b) {
     try {
@@ -73,6 +74,9 @@ export function clearProjectRootStateFiles(basePath, milestoneId) {
     // worth removing on teardown.
     const transientFiles = [
         join(gsdDir, "STATE.md"),
+        // Integration-branch META now lives flat at .gsd/<MID>-META.json (ADR-045).
+        milestoneMetaPath(basePath, milestoneId),
+        // Legacy location — still cleaned for pre-migration trees.
         join(gsdDir, "milestones", milestoneId, `${milestoneId}-META.json`),
     ];
     for (const file of transientFiles) {

package/dist/resources/extensions/gsd/auto-worktree-sync.js

@@ -5,7 +5,7 @@
 import { cpSync, existsSync, lstatSync as lstatSyncFn, mkdirSync, readdirSync, } from "node:fs";
 import { join } from "node:path";
 import { _isSamePath as isSamePath, } from "./auto-worktree-cleanup.js";
-import { resolveGsdPathContract } from "./paths.js";
+import { dirIsContentBearingLegacyMilestone, resolveGsdPathContract } from "./paths.js";
 import { WorktreeStateProjection } from "./worktree-state-projection.js";
 import { logWarning } from "./workflow-logger.js";
 const PROJECT_PREFERENCES_FILE = "PREFERENCES.md";
@@ -143,10 +143,14 @@ function syncMilestoneLayout(mainGsd, wtGsd, layoutSegment, synced) {
     if (!existsSync(mainMilestonesDir))
         return;
     try {
-        mkdirSync(wtMilestonesDir, { recursive: true });
         const mainMilestones = readdirSync(mainMilestonesDir, { withFileTypes: true })
             .filter((entry) => entry.isDirectory())
-            .map((entry) => entry.name);
+            .map((entry) => entry.name)
+            .filter((name) => layoutSegment !== "milestones" ||
+            dirIsContentBearingLegacyMilestone(join(mainMilestonesDir, name)));
+        if (mainMilestones.length === 0)
+            return;
+        mkdirSync(wtMilestonesDir, { recursive: true });
         for (const milestoneId of mainMilestones) {
             syncMilestoneDirectory(mainMilestonesDir, wtMilestonesDir, milestoneId, synced);
         }

package/dist/resources/extensions/gsd/auto-worktree-teardown.js

@@ -45,7 +45,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
             throw new GSDError(GSD_IO_ERROR, `Failed to chdir back to ${originalBasePath} during teardown: ${err instanceof Error ? err.message : String(err)}`);
         }
         // Mirror cleanup steps from mergeMilestoneToMain abort path:
-        // 1. Remove transient state files (STATE.md, auto.lock, {MID}-META.json).
+        // 1. Remove transient state files (STATE.md, auto.lock, .gsd/{MID}-META.json).
         //    Non-fatal — must not block teardown.
         try {
             clearProjectRootStateFiles(originalBasePath, milestoneId);

package/dist/resources/extensions/gsd/auto.js

@@ -28,7 +28,7 @@ import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSes
 import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, loadEffectiveGSDPreferencesWithRegistry, resolveProfileAnchorProvider, getIsolationMode, resolveEffectiveUnitIsolationMode, } from "./preferences.js";
 import { playNotificationBell, sendDesktopNotification } from "./notifications.js";
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, HARD_CONTEXT_REROOT_THRESHOLD_PERCENT, resolveCompactionThresholdPercent, shouldRerootStepSessionForContext, shouldWarnStepSessionForContext, } from "./auto-budget.js";
-import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, isDeterministicPolicyError, } from "./auto-tool-tracking.js";
+import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, updateToolInvocationError, } from "./auto-tool-tracking.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
 import { selectAndApplyModel, resolveModelId, clearToolBaseline, isModelUnavailable, applyThinkingLevelForModel } from "./auto-model-selection.js";
 import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
@@ -617,15 +617,14 @@ export function markToolEnd(toolCallId) {
  * Called from tool_execution_end when a GSD tool fails with isError.
  * Stores the error if it matches:
  *   - tool-invocation-error pattern (malformed/truncated JSON)
+ *   - failed ScheduleWakeup continuation validation (#1379)
  *   - queued-user-message skip pattern
  *   - deterministic policy rejection (#4973, e.g. context_write_blocked)
  */
 export function recordToolInvocationError(toolName, errorMsg) {
     if (!s.active)
         return;
-    if (isToolInvocationError(errorMsg) || isQueuedUserMessageSkip(errorMsg) || isDeterministicPolicyError(errorMsg)) {
-        s.lastToolInvocationError = `${toolName}: ${errorMsg}`;
-    }
+    s.lastToolInvocationError = updateToolInvocationError(s.lastToolInvocationError, toolName, errorMsg);
 }
 export function getOldestInFlightToolAgeMs() {
     return _getOldestInFlightToolAgeMs();
@@ -2441,7 +2440,18 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
         startedAt: hookStartedAt,
         workspaceRoot: s.basePath,
     });
-    const result = await s.cmdCtx.newSession({ workspaceRoot: s.basePath });
+    const cmdCtx = s.cmdCtx;
+    if (typeof cmdCtx?.newSession !== "function") {
+        const message = "Auto-mode has no command context for dispatch.";
+        ctx.ui.notify(message, "error");
+        const unitToCommit = previousCurrentUnit ?? s.currentUnit;
+        if (unitToCommit) {
+            await autoCommitUnit(s.basePath, unitToCommit.type, unitToCommit.id, ctx);
+        }
+        await stopAuto(ctx, pi, message, { preserveWorktree: true });
+        return false;
+    }
+    const result = await cmdCtx.newSession({ workspaceRoot: s.basePath });
     if (result.cancelled) {
         await stopAuto(ctx, pi);
         return false;

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -46,6 +46,8 @@ function registerAlias(pi, toolDef, aliasName, canonicalName) {
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- toolDef shape matches ToolDefinition but varies by schema
 function registerWorkflowTool(pi, toolDef) {
     pi.registerTool(toolDef);
+    if (process.env.GSD_ADVERTISE_TOOL_ALIASES !== "1")
+        return; // canonical-only model surface (see plan 035)
     for (const alias of aliasesForWorkflowTool(toolDef.name)) {
         registerAlias(pi, toolDef, alias, toolDef.name);
     }

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -22,13 +22,14 @@ import { saveActivityLog } from "../activity-log.js";
 import { recordToolCall as safetyRecordToolCall, recordToolResult as safetyRecordToolResult, saveEvidenceToDisk } from "../safety/evidence-collector.js";
 import { parseUnitId } from "../unit-id.js";
 import { classifyCommand } from "../safety/destructive-guard.js";
-import { confirmDestructiveCommand, consumeDestructiveConfirmation, isDestructiveConfirmGateId, requestDestructiveConfirmation, } from "../safety/destructive-confirmation.js";
+import { confirmDestructiveCommand, consumeDestructiveConfirmation, isDestructiveConfirmGateId, peekPendingDestructiveCommand, requestDestructiveConfirmation, resetDestructiveConfirmation, } from "../safety/destructive-confirmation.js";
 import { logWarning as safetyLogWarning, setStderrLoggingEnabled } from "../workflow-logger.js";
 import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
 import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
 import { initNotificationWidget } from "../notification-widget.js";
 import { notifyPreferenceDiagnostics } from "../preferences-diagnostics.js";
+import { resolveEffectivePlanningToolsPolicy } from "../planning-subagent-policy.js";
 import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { extractSubagentAgentClasses } from "./subagent-input.js";
 import { approvalGateIdForUnit, evaluateAskUserQuestionsRound, formatUnansweredConsentQuestionMessage, isExplicitApprovalResponse, messageHasPendingAskUserQuestionsTool, shouldPauseForQuestion, } from "../consent-question.js";
@@ -136,6 +137,7 @@ function suppressWelcomeHeader(ctx) {
  * are bounded — cleared on activation, session boundaries, and verification.
  */
 const deferredApprovalGates = new Map();
+const deferredDestructiveConfirmationPauses = new Set();
 export const MINIMAL_GSD_TOOL_NAMES = [
     "gsd_exec",
     "gsd_exec_search",
@@ -456,6 +458,21 @@ function clearDeferredApprovalGate(basePath) {
         deferredApprovalGates.delete(basePath);
     }
 }
+function deferDestructiveConfirmationPause(basePath) {
+    deferredDestructiveConfirmationPauses.add(basePath);
+}
+function clearDeferredDestructiveConfirmationPause(basePath) {
+    if (!basePath) {
+        deferredDestructiveConfirmationPauses.clear();
+    }
+    else {
+        deferredDestructiveConfirmationPauses.delete(basePath);
+    }
+}
+function isDestructiveConfirmationBlocking(basePath) {
+    return deferredDestructiveConfirmationPauses.has(basePath)
+        && Boolean(peekPendingDestructiveCommand(basePath));
+}
 function deferApprovalGate(gateId, basePath) {
     // Verified-on-disk wins (same adapter policy as activation/re-arm): if the
     // workflow MCP child already verified this gate, deferring would block
@@ -798,6 +815,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         await applyToolCallLoopGuardConfig(basePath);
         approvalQuestionAbortInFlight = false;
         clearDeferredApprovalGate();
+        clearDeferredDestructiveConfirmationPause();
         await resetAskUserQuestionsTurnCache();
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
@@ -883,6 +901,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         resetToolCallLoopGuard();
         await applyToolCallLoopGuardConfig(basePath);
         clearDeferredApprovalGate();
+        clearDeferredDestructiveConfirmationPause();
         await resetAskUserQuestionsTurnCache();
         clearDiscussionFlowState(basePath);
         // /clear or /new destroys the conversation holding a discuss interview, so
@@ -933,6 +952,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             }
         }
         clearDeferredApprovalGate(beforeAgentBasePath);
+        clearDeferredDestructiveConfirmationPause(beforeAgentBasePath);
         // session_start can fire before the active provider has settled. By
         // before_agent_start, Claude Code CLI sessions should get the same
         // project MCP config that /gsd mcp init would write.
@@ -1010,7 +1030,10 @@ export function registerHooks(pi, ecosystemHandlers) {
         }
         finally {
             activateDeferredApprovalGate(agentEndBasePath);
+            const destructiveConfirmationBlocking = isDestructiveConfirmationBlocking(agentEndBasePath);
+            clearDeferredDestructiveConfirmationPause(agentEndBasePath);
             await maybePauseAutoForApprovalGate(ctx, pi, isApprovalGateBlocking(agentEndBasePath), "Depth confirmation is waiting for your answer — pausing auto-mode.");
+            await maybePauseAutoForApprovalGate(ctx, pi, destructiveConfirmationBlocking, "Destructive-command confirmation is waiting for your answer — pausing auto-mode.");
         }
     });
     pi.on("message_end", async (event) => {
@@ -1276,6 +1299,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         const activeUnitType = dash.currentUnit?.type ?? guidedUnit?.unitType;
         if (activeUnitType) {
             const manifest = resolveManifest(activeUnitType);
+            const planningBasePath = dash.basePath || guidedUnit?.basePath || discussionBasePath;
             let planningInput = "";
             let agentClasses;
             if (isToolCallEventType("write", event)) {
@@ -1291,7 +1315,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                 // Subagent inputs use { agent }, { tasks: [{ agent }] }, or { chain: [{ agent }] }.
                 agentClasses = extractSubagentAgentClasses(event.input);
             }
-            const planningGuard = shouldBlockPlanningUnit(event.toolName, planningInput, dash.basePath || guidedUnit?.basePath || discussionBasePath, activeUnitType, manifest?.tools, agentClasses, event.input, dash.currentUnit?.id);
+            const planningGuard = shouldBlockPlanningUnit(event.toolName, planningInput, planningBasePath, activeUnitType, resolveEffectivePlanningToolsPolicy(activeUnitType, manifest?.tools, planningBasePath), agentClasses, event.input, dash.currentUnit?.id);
             if (planningGuard.block)
                 return planningGuard;
         }
@@ -1373,6 +1397,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                 // Record the command as pending so an affirmative answer to a
                 // destructive_confirm gate (handled in tool_result) can confirm it.
                 requestDestructiveConfirmation(command, guardBasePath);
+                deferDestructiveConfirmationPause(guardBasePath);
                 const reason = [
                     "HARD BLOCK: destructive Bash command requires explicit human confirmation.",
                     `Detected: ${classification.labels.join(", ")}`,
@@ -1383,9 +1408,6 @@ export function registerHooks(pi, ecosystemHandlers) {
                 safetyLogWarning("safety", `destructive command: ${classification.labels.join(", ")}`, {
                     command: String(command).slice(0, 200),
                 });
-                if (ctx) {
-                    await maybePauseAutoForApprovalGate(ctx, pi, isAutoActive(), "Destructive-command confirmation is waiting for your answer — pausing auto-mode.");
-                }
                 return { block: true, reason };
             }
         }
@@ -1426,7 +1448,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             recordRetryableHarnessToolError(toolName, resultPayload, errorText);
         }
         else if (isAutoActive()) {
-            clearToolInvocationError();
+            clearToolInvocationError(event.toolName);
         }
         // Interactive Closeout adapter (ADR-032): auto-mode owns closeout for its
         // own units; interactive completions get the durable git subset (commit +
@@ -1541,6 +1563,10 @@ export function registerHooks(pi, ecosystemHandlers) {
                 if (isDepthConfirmationAnswer(answer?.selected, question.options)) {
                     confirmDestructiveCommand(basePath);
                 }
+                else {
+                    resetDestructiveConfirmation(basePath);
+                }
+                clearDeferredDestructiveConfirmationPause(basePath);
                 break;
             }
         }
@@ -1605,7 +1631,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             recordRetryableHarnessToolError(toolName, event.result, errorText);
         }
         else if (isAutoActive()) {
-            clearToolInvocationError();
+            clearToolInvocationError(event.toolName);
         }
         // Safety harness: record tool execution results for evidence cross-referencing
         if (isAutoActive()) {

package/dist/resources/extensions/gsd/bootstrap/system-context.js

@@ -18,6 +18,13 @@ import { formatOverridesSection, formatShortcut, loadActiveOverrides, loadFile,
 import { toPosixPath } from "../../shared/mod.js";
 import { autoEnableCmuxPreferences } from "../commands-cmux.js";
 import { gsdHome } from "../gsd-home.js";
+import { GSD_CONTEXT_MESSAGE_SENTINEL } from "../constants.js";
+// Single source of truth lives in ../constants.js; re-exported here because
+// buildContextMessage() stamps this marker on every context injection and the
+// provider payload policy (filterSupersededContextInjections in
+// context-masker.ts) matches it to dedupe. Adding a new context customType?
+// Ensure buildContextMessage still prepends this sentinel.
+export { GSD_CONTEXT_MESSAGE_SENTINEL };
 const DEFAULT_CONTEXT_MESSAGE_MAX_CHARS = 4_000;
 const DEFAULT_KNOWLEDGE_MAX_CHARS = 12_000;
 const DEFAULT_CODEBASE_MAX_CHARS = 8_000;
@@ -385,17 +392,17 @@ export function buildContextMessage(opts) {
     const contextCharLimit = getContextMessageCharLimit();
     const memoryContent = markMemoryContextSupplied(opts.memoryBlock.trim());
     if (opts.injection) {
-        const content = limitContextMessageContent(memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection, contextCharLimit);
+        const content = limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection}`, contextCharLimit);
         return { customType: "gsd-guided-context", content, display: false };
     }
     if (opts.forensicsInjection) {
-        const content = limitContextMessageContent(memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection, contextCharLimit);
+        const content = limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection}`, contextCharLimit);
         return { customType: "gsd-forensics", content, display: false };
     }
     if (memoryContent) {
         return {
             customType: "gsd-memory",
-            content: limitContextMessageContent(memoryContent, contextCharLimit),
+            content: limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent}`, contextCharLimit),
             display: false,
         };
     }

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -5,8 +5,9 @@ import { minimatch } from "minimatch";
 import { GSD_PHASE_SCOPE_DISPLAY_REASON, shouldBlockAutoUnitToolCall } from "../auto-unit-tool-scope.js";
 import { canonicalToolName } from "../engine-hook-contract.js";
 import { loadJsonFileOrNull } from "../json-persistence.js";
-import { getIsolationMode } from "../preferences.js";
+import { getIsolationMode, loadEffectiveGSDPreferences } from "../preferences.js";
 import { compileSubagentPermissionContract } from "../unit-context-manifest.js";
+import { allowedPlanningDispatchAgentsList, isReadOnlyPlanningDispatchAgent, } from "../planning-subagent-registry.js";
 import { logWarning } from "../workflow-logger.js";
 import { acquireSyncLock, releaseSyncLock } from "../sync-lock.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
@@ -981,29 +982,8 @@ export function shouldBlockQueueExecutionInSnapshot(snapshot, toolName, input, q
 // guards.
 const PLANNING_WRITE_TOOLS = new Set(["write", "edit", "multi_edit", "notebook_edit"]);
 const PLANNING_SUBAGENT_TOOLS = new Set(["subagent", "task"]);
-/**
- * Canonical registry for agents that planning-dispatch may consider. Unit
- * manifests still declare per-unit subsets via ToolsPolicy.allowedSubagents.
- */
-const PLANNING_DISPATCH_AGENT_REGISTRY = {
-    mnemo: { readOnlySpecialist: true },
-    scout: { readOnlySpecialist: true },
-    planner: { readOnlySpecialist: true },
-    reviewer: { readOnlySpecialist: true },
-    security: { readOnlySpecialist: true },
-    tester: { readOnlySpecialist: true },
-};
-export const ALLOWED_PLANNING_DISPATCH_AGENTS = new Set(Object.entries(PLANNING_DISPATCH_AGENT_REGISTRY)
-    .filter(([, metadata]) => metadata.readOnlySpecialist)
-    .map(([agentId]) => agentId));
+export { ALLOWED_PLANNING_DISPATCH_AGENTS } from "../planning-subagent-registry.js";
 let warnedMissingControlledDispatchAgentClasses = false;
-function isReadOnlySpecialist(agentId) {
-    const metadata = PLANNING_DISPATCH_AGENT_REGISTRY[agentId];
-    return metadata?.readOnlySpecialist === true;
-}
-function allowedPlanningDispatchAgentsList() {
-    return [...ALLOWED_PLANNING_DISPATCH_AGENTS].join(", ");
-}
 function allowsControlledSubagentDispatch(policy) {
     return ((policy.mode === "planning-dispatch" || policy.mode === "verification" || policy.mode === "workflow-only") &&
         Array.isArray(policy.allowedSubagents));
@@ -1138,6 +1118,7 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
             const dispatchContract = compileSubagentPermissionContract(policy);
             const allowedSubagents = dispatchContract.allowedSubagents;
             const allowed = new Set(allowedSubagents);
+            const planningSubagentRegistry = loadEffectiveGSDPreferences(basePath)?.preferences.planning_subagent_registry;
             // When agentClasses is undefined, the caller has not been updated to extract
             // agent identities yet. Block and warn so stale callers surface in telemetry
             // instead of silently bypassing the gate.
@@ -1151,13 +1132,13 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
             if (requested.length === 0) {
                 return { block: false };
             }
-            const globallyDisallowed = requested.find(a => !isReadOnlySpecialist(a));
+            const globallyDisallowed = requested.find(a => !isReadOnlyPlanningDispatchAgent(a, planningSubagentRegistry));
             if (globallyDisallowed) {
-                return planningBlock(unitType, policy.mode, `subagent dispatch of "${globallyDisallowed}" not permitted; only read-only specialists (${allowedPlanningDispatchAgentsList()}) may be dispatched from ${policy.mode} units`);
+                return planningBlock(unitType, policy.mode, `subagent dispatch of "${globallyDisallowed}" not permitted; only read-only specialists (${allowedPlanningDispatchAgentsList(planningSubagentRegistry)}) may be dispatched from ${policy.mode} units`);
             }
             const disallowedByPolicy = requested.find(a => !allowed.has(a));
             if (disallowedByPolicy) {
-                return planningBlock(unitType, policy.mode, `subagent dispatch of "${disallowedByPolicy}" not permitted by ToolsPolicy.allowedSubagents; permitted agents for this unit: ${allowedSubagents.join(", ")}`);
+                return planningBlock(unitType, policy.mode, `subagent dispatch of "${disallowedByPolicy}" not permitted by unit allowlist (ToolsPolicy.allowedSubagents/planning_subagents); permitted agents for this unit: ${allowedSubagents.join(", ")}`);
             }
             return { block: false };
         }