@opengsd/gsd-pi 1.9.0 → 1.10.0-dev.a5e42e99

package/src/resources/extensions/gsd/preferences-models.ts

@@ -9,6 +9,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { getProviders } from "@gsd/pi-ai";
 import { gsdHome } from "./gsd-home.js";
 import type { DynamicRoutingConfig } from "./model-router.js";
 import { canonicalModelForTier, defaultRoutingConfig, resolveModelForTier } from "./model-router.js";
@@ -31,6 +32,33 @@ import { getUnitPhaseChain } from "./unit-registry.js";
 // Re-export types so existing consumers of ./preferences-models.js keep working
 export type { GSDPhaseModelConfig, GSDModelConfig, GSDModelConfigV2, ResolvedModelConfig } from "./preferences-types.js";
 
+type ProviderModelRegistry = {
+  getAll?: () => ReadonlyArray<{ provider: string }>;
+  getAvailable?: () => ReadonlyArray<{ provider: string }>;
+  getAllWithDiscovered?: () => ReadonlyArray<{ provider: string }>;
+};
+
+/**
+ * First-party providers shipped as bundled extensions that delegate to a
+ * vendor CLI (`authMode: "externalCli"`). They are registered into the live
+ * model registry at runtime, so they are absent from the generated `@gsd/pi-ai`
+ * catalog (`getProviders()`), but they are NOT custom: `PREFERENCES.md` can
+ * route to them, so they must defer to `PREFERENCES.md` like any other built-in
+ * provider. Without this exclusion the registry check below would classify the
+ * default `claude-code` provider (and the other CLI providers) as custom and
+ * silently skip `PREFERENCES.md` in auto-mode (#801, extends #4122).
+ *
+ * Kept in sync with the `registerProvider(...)` calls in the bundled CLI
+ * extensions (claude-code-cli, cursor-cli, google-cli). Names are lowercase for
+ * direct comparison against normalized provider ids.
+ */
+const BUILTIN_EXTENSION_PROVIDERS: ReadonlySet<string> = new Set([
+  "claude-code",
+  "cursor-agent",
+  "google-gemini-cli",
+  "google-antigravity",
+]);
+
 /**
  * Resolve which model ID to use for a given auto-mode unit type.
  * Returns undefined if no model preference is set for this unit type.
@@ -321,9 +349,8 @@ export function resolveDefaultSessionModel(
 }
 
 /**
- * Returns true if `provider` is defined as a custom provider in the user's
- * `~/.gsd/agent/models.json` (Ollama, vLLM, LM Studio, OpenAI-compatible
- * proxies, etc.).
+ * Returns true if `provider` is a custom provider. Custom providers may be
+ * declared in `models.json` or registered dynamically by a Pi extension.
  *
  * Used by auto-mode bootstrap to decide whether the session model
  * (set via `/gsd model`) should override `PREFERENCES.md`.  Custom providers
@@ -332,13 +359,16 @@ export function resolveDefaultSessionModel(
  * priority — otherwise auto-mode tries to start the built-in provider from
  * PREFERENCES.md and fails with "Not logged in · Please run /login" (#4122).
  *
- * Reads models.json directly with a lightweight JSON parse to avoid
- * pulling in the full model-registry at this call site.  Falls back to
- * `~/.pi/agent/models.json` for parity with `resolveModelsJsonPath()`.
- * Any read or parse error yields `false` (treat as not-custom) so a
- * malformed models.json never breaks the session bootstrap.
+ * Reads models.json directly with a lightweight JSON parse, then checks the
+ * live model registry for extension-registered providers that are not in the
+ * generated built-in provider catalog (`getProviders()`) and not one of the
+ * bundled external-CLI providers (`BUILTIN_EXTENSION_PROVIDERS`, e.g.
+ * `claude-code`), which register at runtime but are still built-in.  Falls back
+ * to `~/.pi/agent/models.json` for parity with `resolveModelsJsonPath()`. Any
+ * read, parse, or registry error yields `false` (treat as not-custom) so
+ * bootstrap stays non-fatal.
  */
-export function isCustomProvider(provider: string | undefined): boolean {
+export function isCustomProvider(provider: string | undefined, registry?: ProviderModelRegistry): boolean {
   if (!provider) return false;
   const candidates = [
     join(gsdHome(), "agent", "models.json"),
@@ -356,7 +386,21 @@ export function isCustomProvider(provider: string | undefined): boolean {
       // Ignore — malformed models.json must not break bootstrap.
     }
   }
-  return false;
+  try {
+    const normalizedProvider = provider.trim().toLowerCase();
+    if (!normalizedProvider) return false;
+    if (BUILTIN_EXTENSION_PROVIDERS.has(normalizedProvider)) return false;
+    const builtInProviders = new Set(getProviders().map((p) => p.toLowerCase()));
+    if (builtInProviders.has(normalizedProvider)) return false;
+    const registryModels =
+      registry?.getAllWithDiscovered?.()
+      ?? registry?.getAll?.()
+      ?? registry?.getAvailable?.()
+      ?? [];
+    return registryModels.some((m) => m.provider.toLowerCase() === normalizedProvider);
+  } catch {
+    return false;
+  }
 }
 
 /**

package/src/resources/extensions/gsd/preferences-types.ts

@@ -141,6 +141,8 @@ export const KNOWN_PREFERENCE_KEYS = new Set<string>([
   "git",
   "post_unit_hooks",
   "pre_dispatch_hooks",
+  "planning_subagent_registry",
+  "planning_subagents",
   "dynamic_routing",
   "disabled_model_providers",
   "uok",
@@ -217,6 +219,26 @@ export const KNOWN_UNIT_LABELS = [
 ] as const;
 export type UnitLabel = (typeof KNOWN_UNIT_LABELS)[number];
 
+export const CONFIGURABLE_PLANNING_SUBAGENT_UNITS = [
+  "plan-milestone",
+  "plan-slice",
+] as const;
+export type ConfigurablePlanningSubagentUnit = (typeof CONFIGURABLE_PLANNING_SUBAGENT_UNITS)[number];
+
+export interface PlanningSubagentUnitConfig {
+  allowed?: string[];
+}
+
+export type PlanningSubagentsConfig = Partial<
+  Record<ConfigurablePlanningSubagentUnit, PlanningSubagentUnitConfig>
+>;
+
+export interface PlanningSubagentRegistryEntry {
+  read_only_specialist?: boolean;
+}
+
+export type PlanningSubagentRegistryConfig = Record<string, PlanningSubagentRegistryEntry>;
+
 
 export const SKILL_ACTIONS = new Set(["use", "prefer", "avoid"]);
 
@@ -230,10 +252,10 @@ export interface GSDSkillRule {
 /**
  * Reasoning effort levels. Mirrors `ThinkingLevel` in `@gsd/pi-agent-core`;
  * declared locally so preference parsing/validation does not import the agent
- * core package. `xhigh` is only honored by models whose `thinkingLevelMap`
+ * core package. `xhigh` and `max` are only honored by models whose `thinkingLevelMap`
  * advertises it — unsupported levels are clamped at dispatch (ADR-026).
  */
-export type GSDThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh";
+export type GSDThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
 
 /** The nine model-routing phase buckets. */
 export const GSD_MODEL_PHASE_KEYS = [
@@ -476,6 +498,8 @@ export interface GSDPreferences {
   git?: GitPreferences;
   post_unit_hooks?: PostUnitHookConfig[];
   pre_dispatch_hooks?: PreDispatchHookConfig[];
+  planning_subagent_registry?: PlanningSubagentRegistryConfig;
+  planning_subagents?: PlanningSubagentsConfig;
   dynamic_routing?: DynamicRoutingConfig;
   /** Provider IDs to exclude from /model and automatic model routing while leaving tool auth intact. */
   disabled_model_providers?: string[];

package/src/resources/extensions/gsd/preferences-validation.ts

@@ -17,6 +17,7 @@ import { getGateIdsForTurn } from "./gate-registry.js";
 import {
   KNOWN_PREFERENCE_KEYS,
   KNOWN_UNIT_LABELS,
+  CONFIGURABLE_PLANNING_SUBAGENT_UNITS,
   GSD_MODEL_PHASE_KEYS,
 
   SKILL_ACTIONS,
@@ -26,6 +27,10 @@ import {
   type GSDSkillRule,
   type GSDThinkingLevel,
 } from "./preferences-types.js";
+import {
+  allowedPlanningDispatchAgentsList,
+  isReadOnlyPlanningDispatchAgent,
+} from "./planning-subagent-registry.js";
 
 const VALID_TOKEN_PROFILES = new Set<TokenProfile>(["budget", "balanced", "quality", "burn-max"]);
 const VALID_THINKING_LEVELS = new Set<GSDThinkingLevel>([
@@ -35,6 +40,7 @@ const VALID_THINKING_LEVELS = new Set<GSDThinkingLevel>([
   "medium",
   "high",
   "xhigh",
+  "max",
 ]);
 const KNOWN_MODEL_PHASE_KEYS = new Set<string>(GSD_MODEL_PHASE_KEYS);
 const VALID_UOK_TURN_ACTIONS = new Set<"commit" | "snapshot" | "status-only">([
@@ -88,7 +94,7 @@ function sanitizeModelField(
       } else {
         warnings?.push(
           `${label} thinking "${String(obj.thinking)}" is not a valid thinking level ` +
-          `(off, minimal, low, medium, high, xhigh) — ignored`,
+          `(off, minimal, low, medium, high, xhigh, max) — ignored`,
         );
       }
     }
@@ -481,7 +487,7 @@ export function validatePreferences(preferences: GSDPreferences): {
           if (level !== undefined && !VALID_THINKING_LEVELS.has(level as GSDThinkingLevel)) {
             warnings.push(
               `models.${phase}.thinking "${String(level)}" is not a valid thinking level ` +
-              `(off, minimal, low, medium, high, xhigh) — ignored`,
+              `(off, minimal, low, medium, high, xhigh, max) — ignored`,
             );
             const { thinking: _ignored, ...rest } = entry as Record<string, unknown>;
             // If stripping the bad thinking leaves no usable model, drop the
@@ -516,7 +522,7 @@ export function validatePreferences(preferences: GSDPreferences): {
         if (!VALID_THINKING_LEVELS.has(level as GSDThinkingLevel)) {
           warnings.push(
             `thinking.${phase} "${String(level)}" is not a valid thinking level ` +
-            `(off, minimal, low, medium, high, xhigh) — ignored`,
+            `(off, minimal, low, medium, high, xhigh, max) — ignored`,
           );
           continue;
         }
@@ -747,6 +753,105 @@ export function validatePreferences(preferences: GSDPreferences): {
     }
   }
 
+  // ─── Planning Subagent Registry ──────────────────────────────────────────
+  if (preferences.planning_subagent_registry !== undefined) {
+    if (
+      !preferences.planning_subagent_registry ||
+      typeof preferences.planning_subagent_registry !== "object" ||
+      Array.isArray(preferences.planning_subagent_registry)
+    ) {
+      errors.push("planning_subagent_registry must be an object keyed by agent id");
+    } else {
+      const validRegistry: NonNullable<GSDPreferences["planning_subagent_registry"]> = {};
+
+      for (const [rawAgentId, rawConfig] of Object.entries(preferences.planning_subagent_registry as Record<string, unknown>)) {
+        const agentId = rawAgentId.trim();
+        if (!agentId) {
+          errors.push("planning_subagent_registry includes an empty agent id");
+          continue;
+        }
+        if (!rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) {
+          errors.push(`planning_subagent_registry.${agentId} must be an object with read_only_specialist: true`);
+          continue;
+        }
+
+        const readOnlySpecialist = (rawConfig as Record<string, unknown>).read_only_specialist;
+        if (readOnlySpecialist !== true) {
+          errors.push(
+            `planning_subagent_registry.${agentId}.read_only_specialist must be true to classify ` +
+            `"${agentId}" as a read-only planning specialist`,
+          );
+          continue;
+        }
+
+        validRegistry[agentId] = { read_only_specialist: true };
+      }
+
+      if (Object.keys(validRegistry).length > 0) {
+        validated.planning_subagent_registry = validRegistry;
+      }
+    }
+  }
+
+  // ─── Planning Subagents ─────────────────────────────────────────────────
+  if (preferences.planning_subagents !== undefined) {
+    if (
+      !preferences.planning_subagents ||
+      typeof preferences.planning_subagents !== "object" ||
+      Array.isArray(preferences.planning_subagents)
+    ) {
+      errors.push("planning_subagents must be an object keyed by planning unit type");
+    } else {
+      const validUnits = new Set<string>(CONFIGURABLE_PLANNING_SUBAGENT_UNITS);
+      const validPlanningSubagents: NonNullable<GSDPreferences["planning_subagents"]> = {};
+
+      for (const [unitType, rawConfig] of Object.entries(preferences.planning_subagents as Record<string, unknown>)) {
+        if (!validUnits.has(unitType)) {
+          errors.push(
+            `planning_subagents unknown or unsupported unit "${unitType}" — supported units: ` +
+            `${CONFIGURABLE_PLANNING_SUBAGENT_UNITS.join(", ")}`,
+          );
+          continue;
+        }
+        if (!rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) {
+          errors.push(`planning_subagents.${unitType} must be an object with an allowed array`);
+          continue;
+        }
+
+        const allowed = normalizeStringArray((rawConfig as Record<string, unknown>).allowed);
+        if (allowed.length === 0) {
+          errors.push(`planning_subagents.${unitType}.allowed must include at least one read-only planning specialist`);
+          continue;
+        }
+
+        const sanitizedAllowed: string[] = [];
+        for (const agentId of allowed) {
+          if (!isReadOnlyPlanningDispatchAgent(agentId, validated.planning_subagent_registry)) {
+            errors.push(
+              `planning_subagents.${unitType}.allowed includes "${agentId}", which is not classified as a ` +
+              `read-only planning specialist. Allowed agents: ` +
+              `${allowedPlanningDispatchAgentsList(validated.planning_subagent_registry)}. ` +
+              `For custom planning agents, add planning_subagent_registry.${agentId}.read_only_specialist: true`,
+            );
+            continue;
+          }
+          sanitizedAllowed.push(agentId);
+        }
+
+        const dedupedAllowed = Array.from(new Set(sanitizedAllowed));
+        if (dedupedAllowed.length > 0) {
+          validPlanningSubagents[unitType as keyof NonNullable<GSDPreferences["planning_subagents"]>] = {
+            allowed: dedupedAllowed,
+          };
+        }
+      }
+
+      if (Object.keys(validPlanningSubagents).length > 0) {
+        validated.planning_subagents = validPlanningSubagents;
+      }
+    }
+  }
+
   // ─── Dynamic Routing ─────────────────────────────────────────────────
   if (preferences.dynamic_routing !== undefined) {
     if (typeof preferences.dynamic_routing === "object" && preferences.dynamic_routing !== null) {

package/src/resources/extensions/gsd/preferences.ts

@@ -817,6 +817,11 @@ function mergePreferences(base: GSDPreferences, override: GSDPreferences): GSDPr
       : undefined,
     post_unit_hooks: mergePostUnitHooks(base.post_unit_hooks, override.post_unit_hooks),
     pre_dispatch_hooks: mergePreDispatchHooks(base.pre_dispatch_hooks, override.pre_dispatch_hooks),
+    planning_subagent_registry: mergePlanningSubagentRegistry(
+      base.planning_subagent_registry,
+      override.planning_subagent_registry,
+    ),
+    planning_subagents: mergePlanningSubagents(base.planning_subagents, override.planning_subagents),
     dynamic_routing: (base.dynamic_routing || override.dynamic_routing)
       ? { ...(base.dynamic_routing ?? {}), ...(override.dynamic_routing ?? {}) } as DynamicRoutingConfig
       : undefined,
@@ -943,6 +948,39 @@ function mergePreDispatchHooks(
   return merged.length > 0 ? merged : undefined;
 }
 
+function mergePlanningSubagents(
+  base?: GSDPreferences["planning_subagents"],
+  override?: GSDPreferences["planning_subagents"],
+): GSDPreferences["planning_subagents"] | undefined {
+  if (!base && !override) return undefined;
+  const merged: NonNullable<GSDPreferences["planning_subagents"]> = {};
+  const unitTypes = new Set([
+    ...Object.keys(base ?? {}),
+    ...Object.keys(override ?? {}),
+  ]);
+
+  for (const unitType of unitTypes) {
+    const allowed = mergeStringLists(
+      base?.[unitType as keyof NonNullable<GSDPreferences["planning_subagents"]>]?.allowed,
+      override?.[unitType as keyof NonNullable<GSDPreferences["planning_subagents"]>]?.allowed,
+    );
+    if (allowed?.length) {
+      merged[unitType as keyof NonNullable<GSDPreferences["planning_subagents"]>] = { allowed };
+    }
+  }
+
+  return Object.keys(merged).length > 0 ? merged : undefined;
+}
+
+function mergePlanningSubagentRegistry(
+  base?: GSDPreferences["planning_subagent_registry"],
+  override?: GSDPreferences["planning_subagent_registry"],
+): GSDPreferences["planning_subagent_registry"] | undefined {
+  if (!base && !override) return undefined;
+  const merged = { ...(base ?? {}), ...(override ?? {}) };
+  return Object.keys(merged).length > 0 ? merged : undefined;
+}
+
 // ─── System Prompt Rendering ──────────────────────────────────────────────────
 
 export function renderPreferencesForSystemPrompt(

package/src/resources/extensions/gsd/prompts/validate-milestone.md

@@ -24,18 +24,18 @@ Roadmap, slice summaries, assessments, requirements, decisions, and project cont
 
 ### Step 1 - Dispatch Parallel Reviewers
 
-The Inlined Context above already preloads the evidence reviewers need — the roadmap, per-slice SUMMARY/ASSESSMENT excerpts, requirements, and verification classes. **Embed the relevant preloaded evidence directly into each reviewer's task prompt** so reviewers work from it instead of re-reading the same artifacts from disk. Each reviewer should read a full file only when its excerpt is missing, truncated, or internally inconsistent — never as a routine first step. This avoids three reviewers independently re-surveying artifacts the orchestrator already holds.
+The Inlined Context above already preloads the evidence reviewers need — the roadmap, per-slice SUMMARY/ASSESSMENT excerpts, requirements, and verification classes. **Embed the relevant preloaded evidence directly into each reviewer's task prompt** so reviewers work from it instead of re-reading the same artifacts from disk. Each reviewer should read a full file only when its excerpt is missing, truncated, or internally inconsistent — never as a routine first step. When a reviewer needs a full artifact, use only explicit file paths from the On-demand Validation Artifacts / On-demand Milestone Context blocks or discover files with `find .gsd -type f`; never pass a phase, slice, `tasks/`, or `slices/` directory to `read` or `readFileSync`. This avoids three reviewers independently re-surveying artifacts the orchestrator already holds.
 
 Call `subagent` with `tasks: [...]` containing ALL THREE reviewers simultaneously:
 
 **Reviewer A - Requirements Coverage**
-Prompt: "Review milestone {{milestoneId}} requirements coverage. Working directory: {{workingDirectory}}. Use the preloaded requirements and slice SUMMARY evidence embedded in this task — do not re-read them from disk. For each requirement, mark COVERED, PARTIAL, or MISSING against that evidence. Read a full SUMMARY under `.gsd/milestones/{{milestoneId}}/slices/` only if its preloaded excerpt is missing, truncated, or inconsistent. Output table: Requirement | Status | Evidence. End with one-line verdict: PASS if all covered, NEEDS-ATTENTION if partials exist, FAIL if any missing."
+Prompt: "Review milestone {{milestoneId}} requirements coverage. Working directory: {{workingDirectory}}. Use the preloaded requirements and slice SUMMARY evidence embedded in this task — do not re-read them from disk. For each requirement, mark COVERED, PARTIAL, or MISSING against that evidence. Read a full SUMMARY only from an explicit file path in the On-demand Validation Artifacts list, or discover candidates with `find .gsd -type f -name '*-SUMMARY.md'`; never read a directory path. Output table: Requirement | Status | Evidence. End with one-line verdict: PASS if all covered, NEEDS-ATTENTION if partials exist, FAIL if any missing."
 
 **Reviewer B - Cross-Slice Integration**
-Prompt: "Review milestone {{milestoneId}} cross-slice integration. Working directory: {{workingDirectory}}. Use the preloaded roadmap and slice SUMMARY evidence embedded in this task — do not re-read them from disk. Find the boundary map (produces/consumes contracts) in the roadmap. For each boundary, confirm producer SUMMARY produced the artifact and consumer SUMMARY consumed it. Read `{{roadmapPath}}` or a full SUMMARY only if the preloaded evidence is missing, truncated, or inconsistent. Output table: Boundary | Producer Summary | Consumer Summary | Status. End with one-line verdict: PASS if all boundaries honored, NEEDS-ATTENTION if any gaps."
+Prompt: "Review milestone {{milestoneId}} cross-slice integration. Working directory: {{workingDirectory}}. Use the preloaded roadmap and slice SUMMARY evidence embedded in this task — do not re-read them from disk. Find the boundary map (produces/consumes contracts) in the roadmap. For each boundary, confirm producer SUMMARY produced the artifact and consumer SUMMARY consumed it. Read `{{roadmapPath}}` or a full SUMMARY from the On-demand Validation Artifacts list only if the preloaded evidence is missing, truncated, or inconsistent; never read a directory path. Output table: Boundary | Producer Summary | Consumer Summary | Status. End with one-line verdict: PASS if all boundaries honored, NEEDS-ATTENTION if any gaps."
 
 **Reviewer C - Assessment & Acceptance Criteria**
-Prompt: "Review milestone {{milestoneId}} assessment evidence and acceptance criteria. Working directory: {{workingDirectory}}. Use the preloaded milestone context, slice SUMMARY, and ASSESSMENT evidence embedded in this task — do not re-read them from disk. Read `.gsd/milestones/{{milestoneId}}/{{milestoneId}}-CONTEXT.md`, a full SUMMARY, or a full ASSESSMENT only if the preloaded excerpt is missing, truncated, or inconsistent. UAT files are specs, not evidence. Verify each criterion maps to passing evidence. Then review the inlined `Verification Classes (from planning)` table. For every planned row in that table, output a `Verification Classes` table with columns `Class | Planned Check | Evidence | Verdict`. Preserve every planned non-empty class row; do not summarize, rename, combine, or omit planned classes. The first cell of each row must be exactly `Contract`, `Integration`, `Operational`, or `UAT` when that class is present in planning. If a planned class lacks evidence, still include its canonical row and mark the verdict NEEDS-ATTENTION or FAIL. If a planned browser/UAT class has no ASSESSMENT with browser/runtime actions and assertions, return NEEDS-ATTENTION. If no verification classes were planned, say that explicitly. Output sections `Acceptance Criteria` with checklist `[ ] Criterion | Evidence`, and `Verification Classes` with the table. End with one-line verdict: PASS if all criteria and classes are covered by evidence, NEEDS-ATTENTION if gaps exist."
+Prompt: "Review milestone {{milestoneId}} assessment evidence and acceptance criteria. Working directory: {{workingDirectory}}. Use the preloaded milestone context, slice SUMMARY, and ASSESSMENT evidence embedded in this task — do not re-read them from disk. Read the milestone context from the On-demand Milestone Context file path, and read full SUMMARY or ASSESSMENT files only from explicit paths in the On-demand Validation Artifacts list, if the preloaded excerpt is missing, truncated, or inconsistent. UAT files are specs, not evidence. Verify each criterion maps to passing evidence. Then review the inlined `Verification Classes (from planning)` table. For every planned row in that table, output a `Verification Classes` table with columns `Class | Planned Check | Evidence | Verdict`. Preserve every planned non-empty class row; do not summarize, rename, combine, or omit planned classes. The first cell of each row must be exactly `Contract`, `Integration`, `Operational`, or `UAT` when that class is present in planning. If a planned class lacks evidence, still include its canonical row and mark the verdict NEEDS-ATTENTION or FAIL. If a planned browser/UAT class has no ASSESSMENT with browser/runtime actions and assertions, return NEEDS-ATTENTION. If no verification classes were planned, say that explicitly. Output sections `Acceptance Criteria` with checklist `[ ] Criterion | Evidence`, and `Verification Classes` with the table. End with one-line verdict: PASS if all criteria and classes are covered by evidence, NEEDS-ATTENTION if gaps exist."
 
 ### Step 2 - Synthesize Findings
 
@@ -85,6 +85,6 @@ If verdict is `needs-remediation`:
 
 **You MUST call `gsd_validate_milestone` before finishing. Do not manually write `{{validationPath}}`.**
 
-**File system safety:** When scanning milestone directories, use `ls` or `find` first. Never pass a directory path such as `tasks/` or `slices/` directly to `read`; it only accepts files.
+**File system safety:** When scanning milestone directories, use `find .gsd -type f` first and read only files. In flat-phase projects, `.gsd/phases/<NN>-<slug>/` is a directory, not an artifact. Never pass a directory path such as a phase directory, `tasks/`, or `slices/` directly to `read`, `readFile`, or `readFileSync`.
 
 When done, say: "Milestone {{milestoneId}} validation complete — verdict: <verdict>." Say this exactly once — if you already said it in a prior message, do not repeat it.

package/src/resources/extensions/gsd/provider-payload-policy.ts

@@ -2,10 +2,12 @@
  * Provider Payload Policy - ordered shaping of provider request payloads.
  *
  * The order is intentional:
- * 1. observation budgeting masks old tool results in auto-mode,
- * 2. display truncation caps tool-result text for every mode,
- * 3. the protected Source Context Block is appended after truncation,
- * 4. supported models receive the configured service tier.
+ * 1. superseded GSD context injections (memory/guided/forensics) are removed,
+ *    keeping only the latest, for every mode,
+ * 2. observation budgeting masks old tool results in auto-mode,
+ * 3. display truncation caps tool-result text for every mode,
+ * 4. the protected Source Context Block is appended after truncation,
+ * 5. supported models receive the configured service tier.
  */
 
 import type { ContextManagementConfig } from "./preferences-types.js";
@@ -14,6 +16,8 @@ import type { ServiceTierSetting } from "./service-tier.js";
 import {
   createObservationMask,
   createResponsesInputObservationMask,
+  filterSupersededContextInjections,
+  filterSupersededResponsesContextInjections,
   truncateContextResultMessages,
   truncateResponsesInputResultItems,
 } from "./context-masker.js";
@@ -80,10 +84,20 @@ function applyContextManagement(
   deps: ProviderPayloadPolicyDeps,
 ): void {
   const config = deps.loadContextManagementConfig();
+  applyContextInjectionFilter(payload);
   applyObservationBudget(payload, config, deps.isAutoActive());
   applyDisplayTruncation(payload, config);
 }
 
+function applyContextInjectionFilter(payload: Record<string, unknown>): void {
+  if (Array.isArray(payload.messages)) {
+    payload.messages = filterSupersededContextInjections(payload.messages as MessagePayload);
+  }
+  if (Array.isArray(payload.input)) {
+    payload.input = filterSupersededResponsesContextInjections(payload.input as ResponsesInputPayload);
+  }
+}
+
 function applyObservationBudget(
   payload: Record<string, unknown>,
   config: ContextManagementConfig | undefined,

package/src/resources/extensions/gsd/safety/destructive-guard.ts

@@ -14,7 +14,7 @@ interface DestructivePattern {
 }
 
 const DESTRUCTIVE_PATTERNS: readonly DestructivePattern[] = [
-  { pattern: /\brm\s+(-[^\s]*[rfRF][^\s]*\s+|.*\s+-[^\s]*[rfRF])/, label: "recursive delete" },
+  { pattern: /\brm\s+((?:-(?!-)[^\s]*[rR][^\s]*|--recursive)\s+|.*\s+(?:-(?!-)[^\s]*[rR][^\s]*|--recursive)(?:\s|$))/, label: "recursive delete" },
   { pattern: /\bgit\s+push\s+.*--force/, label: "force push" },
   { pattern: /\bgit\s+push\s+-f\b/, label: "force push" },
   { pattern: /\bgit\s+reset\s+--hard/, label: "hard reset" },

package/src/resources/extensions/gsd/skill-activation.ts

@@ -131,10 +131,23 @@ function resolvePreferredSkillNames(
  *  to prevent prompt injection via crafted directory names. */
 const SAFE_SKILL_NAME = /^[a-z0-9][a-z0-9-]*$/;
 
-function formatSkillActivationBlock(skillNames: string[]): string {
+function escapeXml(str: string): string {
+  return str
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+function formatSkillActivationBlock(skillNames: string[], skillPaths: Map<string, string>): string {
   const safe = skillNames.filter(name => SAFE_SKILL_NAME.test(name));
   if (safe.length === 0) return "";
-  const reads = safe.map(name => `Read the installed '${name}' skill file from <available_skills>`).join(". ");
+  const reads = safe.map(name => {
+    const path = skillPaths.get(name);
+    if (path) return `Read the skill file at \`${escapeXml(path)}\``;
+    return `Find '${name}' in <available_skills>, copy its <location> value, and pass that exact path to read`;
+  }).join(". ");
   return `<skill_activation>${reads}.</skill_activation>`;
 }
 
@@ -203,6 +216,7 @@ export function buildSkillActivationBlock(params: {
   const visibleSkills = loaded;
   const manifestScopedSkills = filterSkillsByManifest(visibleSkills, params.unitType);
   const installedNames = new Set(visibleSkills.map(skill => normalizeSkillReference(skill.name)));
+  const installedSkillPaths = new Map(visibleSkills.map(skill => [normalizeSkillReference(skill.name), skill.filePath]));
   warnIfManifestHasMissingSkills(params.unitType, installedNames);
   const avoided = new Set(resolvePreferenceSkillNames(prefs?.avoid_skills ?? [], params.base));
   const matched = new Set<string>();
@@ -252,7 +266,7 @@ export function buildSkillActivationBlock(params: {
   const ordered = [...matched]
     .filter(name => installedNames.has(name) && !avoided.has(name))
     .sort();
-  const activationBlock = formatSkillActivationBlock(ordered);
+  const activationBlock = formatSkillActivationBlock(ordered, installedSkillPaths);
 
   // Omit recommendations when the system catalog is manifest-scoped for this
   // unit — skill names are already listed in <available_skills>.