@opengsd/gsd-pi 1.9.0 → 1.10.0

package/src/resources/extensions/gsd/bootstrap/register-hooks.ts

@@ -51,7 +51,9 @@ import {
   confirmDestructiveCommand,
   consumeDestructiveConfirmation,
   isDestructiveConfirmGateId,
+  peekPendingDestructiveCommand,
   requestDestructiveConfirmation,
+  resetDestructiveConfirmation,
 } from "../safety/destructive-confirmation.js";
 import { logWarning as safetyLogWarning, setStderrLoggingEnabled } from "../workflow-logger.js";
 import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
@@ -59,6 +61,7 @@ import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
 import { initNotificationWidget } from "../notification-widget.js";
 import { notifyPreferenceDiagnostics } from "../preferences-diagnostics.js";
+import { resolveEffectivePlanningToolsPolicy } from "../planning-subagent-policy.js";
 import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { extractSubagentAgentClasses } from "./subagent-input.js";
 import {
@@ -187,6 +190,7 @@ function suppressWelcomeHeader(ctx: ExtensionContext): void {
  * are bounded — cleared on activation, session boundaries, and verification.
  */
 const deferredApprovalGates = new Map<string, string>();
+const deferredDestructiveConfirmationPauses = new Set<string>();
 
 export const MINIMAL_GSD_TOOL_NAMES = [
   "gsd_exec",
@@ -618,6 +622,23 @@ function clearDeferredApprovalGate(basePath?: string): void {
   }
 }
 
+function deferDestructiveConfirmationPause(basePath: string): void {
+  deferredDestructiveConfirmationPauses.add(basePath);
+}
+
+function clearDeferredDestructiveConfirmationPause(basePath?: string): void {
+  if (!basePath) {
+    deferredDestructiveConfirmationPauses.clear();
+  } else {
+    deferredDestructiveConfirmationPauses.delete(basePath);
+  }
+}
+
+function isDestructiveConfirmationBlocking(basePath: string): boolean {
+  return deferredDestructiveConfirmationPauses.has(basePath)
+    && Boolean(peekPendingDestructiveCommand(basePath));
+}
+
 function deferApprovalGate(gateId: string, basePath: string): void {
   // Verified-on-disk wins (same adapter policy as activation/re-arm): if the
   // workflow MCP child already verified this gate, deferring would block
@@ -1015,6 +1036,7 @@ export function registerHooks(
     await applyToolCallLoopGuardConfig(basePath);
     approvalQuestionAbortInFlight = false;
     clearDeferredApprovalGate();
+    clearDeferredDestructiveConfirmationPause();
     await resetAskUserQuestionsTurnCache();
     await syncServiceTierStatus(ctx);
     await applyDisabledModelProviderPolicy(ctx);
@@ -1106,6 +1128,7 @@ export function registerHooks(
     resetToolCallLoopGuard();
     await applyToolCallLoopGuardConfig(basePath);
     clearDeferredApprovalGate();
+    clearDeferredDestructiveConfirmationPause();
     await resetAskUserQuestionsTurnCache();
     clearDiscussionFlowState(basePath);
     // /clear or /new destroys the conversation holding a discuss interview, so
@@ -1157,6 +1180,7 @@ export function registerHooks(
       }
     }
     clearDeferredApprovalGate(beforeAgentBasePath);
+    clearDeferredDestructiveConfirmationPause(beforeAgentBasePath);
 
     // session_start can fire before the active provider has settled. By
     // before_agent_start, Claude Code CLI sessions should get the same
@@ -1244,12 +1268,20 @@ export function registerHooks(
       await handleAgentEnd(pi, event, ctx);
     } finally {
       activateDeferredApprovalGate(agentEndBasePath);
+      const destructiveConfirmationBlocking = isDestructiveConfirmationBlocking(agentEndBasePath);
+      clearDeferredDestructiveConfirmationPause(agentEndBasePath);
       await maybePauseAutoForApprovalGate(
         ctx,
         pi,
         isApprovalGateBlocking(agentEndBasePath),
         "Depth confirmation is waiting for your answer — pausing auto-mode.",
       );
+      await maybePauseAutoForApprovalGate(
+        ctx,
+        pi,
+        destructiveConfirmationBlocking,
+        "Destructive-command confirmation is waiting for your answer — pausing auto-mode.",
+      );
     }
   });
 
@@ -1559,6 +1591,7 @@ export function registerHooks(
     const activeUnitType = dash.currentUnit?.type ?? guidedUnit?.unitType;
     if (activeUnitType) {
       const manifest = resolveManifest(activeUnitType);
+      const planningBasePath = dash.basePath || guidedUnit?.basePath || discussionBasePath;
       let planningInput = "";
       let agentClasses: string[] | undefined;
       if (isToolCallEventType("write", event)) {
@@ -1574,9 +1607,9 @@ export function registerHooks(
       const planningGuard = shouldBlockPlanningUnit(
         event.toolName,
         planningInput,
-        dash.basePath || guidedUnit?.basePath || discussionBasePath,
+        planningBasePath,
         activeUnitType,
-        manifest?.tools,
+        resolveEffectivePlanningToolsPolicy(activeUnitType, manifest?.tools, planningBasePath),
         agentClasses,
         (event as { input?: unknown }).input,
         dash.currentUnit?.id,
@@ -1685,6 +1718,7 @@ export function registerHooks(
         // Record the command as pending so an affirmative answer to a
         // destructive_confirm gate (handled in tool_result) can confirm it.
         requestDestructiveConfirmation(command, guardBasePath);
+        deferDestructiveConfirmationPause(guardBasePath);
         const reason = [
           "HARD BLOCK: destructive Bash command requires explicit human confirmation.",
           `Detected: ${classification.labels.join(", ")}`,
@@ -1695,14 +1729,6 @@ export function registerHooks(
         safetyLogWarning("safety", `destructive command: ${classification.labels.join(", ")}`, {
           command: String(command).slice(0, 200),
         });
-        if (ctx) {
-          await maybePauseAutoForApprovalGate(
-            ctx,
-            pi,
-            isAutoActive(),
-            "Destructive-command confirmation is waiting for your answer — pausing auto-mode.",
-          );
-        }
         return { block: true, reason };
       }
     }
@@ -1743,7 +1769,7 @@ export function registerHooks(
       recordToolInvocationError(event.toolName, errorText);
       recordRetryableHarnessToolError(toolName, resultPayload, errorText);
     } else if (isAutoActive()) {
-      clearToolInvocationError();
+      clearToolInvocationError(event.toolName);
     }
     // Interactive Closeout adapter (ADR-032): auto-mode owns closeout for its
     // own units; interactive completions get the durable git subset (commit +
@@ -1884,7 +1910,10 @@ export function registerHooks(
         const answer = details.response?.answers?.[question.id];
         if (isDepthConfirmationAnswer(answer?.selected, question.options)) {
           confirmDestructiveCommand(basePath);
+        } else {
+          resetDestructiveConfirmation(basePath);
         }
+        clearDeferredDestructiveConfirmationPause(basePath);
         break;
       }
     }
@@ -1951,7 +1980,7 @@ export function registerHooks(
       recordToolInvocationError(event.toolName, errorText);
       recordRetryableHarnessToolError(toolName, event.result, errorText);
     } else if (isAutoActive()) {
-      clearToolInvocationError();
+      clearToolInvocationError(event.toolName);
     }
     // Safety harness: record tool execution results for evidence cross-referencing
     if (isAutoActive()) {

package/src/resources/extensions/gsd/bootstrap/system-context.ts

@@ -21,6 +21,14 @@ import { formatOverridesSection, formatShortcut, loadActiveOverrides, loadFile,
 import { toPosixPath } from "../../shared/mod.js";
 import { autoEnableCmuxPreferences } from "../commands-cmux.js";
 import { gsdHome } from "../gsd-home.js";
+import { GSD_CONTEXT_MESSAGE_SENTINEL } from "../constants.js";
+
+// Single source of truth lives in ../constants.js; re-exported here because
+// buildContextMessage() stamps this marker on every context injection and the
+// provider payload policy (filterSupersededContextInjections in
+// context-masker.ts) matches it to dedupe. Adding a new context customType?
+// Ensure buildContextMessage still prepends this sentinel.
+export { GSD_CONTEXT_MESSAGE_SENTINEL };
 
 const DEFAULT_CONTEXT_MESSAGE_MAX_CHARS = 4_000;
 const DEFAULT_KNOWLEDGE_MAX_CHARS = 12_000;
@@ -448,14 +456,14 @@ export function buildContextMessage(opts: {
   const memoryContent = markMemoryContextSupplied(opts.memoryBlock.trim());
   if (opts.injection) {
     const content = limitContextMessageContent(
-      memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection,
+      `${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.injection}` : opts.injection}`,
       contextCharLimit,
     );
     return { customType: "gsd-guided-context", content, display: false as const };
   }
   if (opts.forensicsInjection) {
     const content = limitContextMessageContent(
-      memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection,
+      `${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent ? `${memoryContent}\n\n${opts.forensicsInjection}` : opts.forensicsInjection}`,
       contextCharLimit,
     );
     return { customType: "gsd-forensics", content, display: false as const };
@@ -463,7 +471,7 @@ export function buildContextMessage(opts: {
   if (memoryContent) {
     return {
       customType: "gsd-memory",
-      content: limitContextMessageContent(memoryContent, contextCharLimit),
+      content: limitContextMessageContent(`${GSD_CONTEXT_MESSAGE_SENTINEL}\n${memoryContent}`, contextCharLimit),
       display: false as const,
     };
   }

package/src/resources/extensions/gsd/bootstrap/write-gate.ts

@@ -9,6 +9,10 @@ import { canonicalToolName } from "../engine-hook-contract.js";
 import { loadJsonFileOrNull } from "../json-persistence.js";
 import { getIsolationMode } from "../preferences.js";
 import { compileSubagentPermissionContract, type ToolsPolicy } from "../unit-context-manifest.js";
+import {
+  allowedPlanningDispatchAgentsList,
+  isReadOnlyPlanningDispatchAgent,
+} from "../planning-subagent-registry.js";
 import { logWarning } from "../workflow-logger.js";
 import { acquireSyncLock, releaseSyncLock } from "../sync-lock.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
@@ -1191,36 +1195,10 @@ export function shouldBlockQueueExecutionInSnapshot(
 const PLANNING_WRITE_TOOLS = new Set(["write", "edit", "multi_edit", "notebook_edit"]);
 const PLANNING_SUBAGENT_TOOLS = new Set(["subagent", "task"]);
 
-/**
- * Canonical registry for agents that planning-dispatch may consider. Unit
- * manifests still declare per-unit subsets via ToolsPolicy.allowedSubagents.
- */
-const PLANNING_DISPATCH_AGENT_REGISTRY = {
-  mnemo: { readOnlySpecialist: true },
-  scout: { readOnlySpecialist: true },
-  planner: { readOnlySpecialist: true },
-  reviewer: { readOnlySpecialist: true },
-  security: { readOnlySpecialist: true },
-  tester: { readOnlySpecialist: true },
-} as const satisfies Record<string, { readonly readOnlySpecialist: boolean }>;
-
-export const ALLOWED_PLANNING_DISPATCH_AGENTS = new Set<string>(
-  Object.entries(PLANNING_DISPATCH_AGENT_REGISTRY)
-    .filter(([, metadata]) => metadata.readOnlySpecialist)
-    .map(([agentId]) => agentId),
-);
+export { ALLOWED_PLANNING_DISPATCH_AGENTS } from "../planning-subagent-registry.js";
 
 let warnedMissingControlledDispatchAgentClasses = false;
 
-function isReadOnlySpecialist(agentId: string): boolean {
-  const metadata = PLANNING_DISPATCH_AGENT_REGISTRY[agentId as keyof typeof PLANNING_DISPATCH_AGENT_REGISTRY];
-  return metadata?.readOnlySpecialist === true;
-}
-
-function allowedPlanningDispatchAgentsList(): string {
-  return [...ALLOWED_PLANNING_DISPATCH_AGENTS].join(", ");
-}
-
 function allowsControlledSubagentDispatch(
   policy: ToolsPolicy,
 ): policy is ToolsPolicy & { readonly allowedSubagents: readonly string[] } {
@@ -1393,7 +1371,7 @@ export function shouldBlockPlanningUnit(
       if (requested.length === 0) {
         return { block: false };
       }
-      const globallyDisallowed = requested.find(a => !isReadOnlySpecialist(a));
+      const globallyDisallowed = requested.find(a => !isReadOnlyPlanningDispatchAgent(a));
       if (globallyDisallowed) {
         return planningBlock(
           unitType,
@@ -1406,7 +1384,7 @@ export function shouldBlockPlanningUnit(
         return planningBlock(
           unitType,
           policy.mode,
-          `subagent dispatch of "${disallowedByPolicy}" not permitted by ToolsPolicy.allowedSubagents; permitted agents for this unit: ${allowedSubagents.join(", ")}`,
+          `subagent dispatch of "${disallowedByPolicy}" not permitted by unit allowlist (ToolsPolicy.allowedSubagents/planning_subagents); permitted agents for this unit: ${allowedSubagents.join(", ")}`,
         );
       }
       return { block: false };

package/src/resources/extensions/gsd/commands-verdict.ts

@@ -11,6 +11,7 @@ import { executeValidateMilestone } from "./tools/workflow-tool-executors.js";
 import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
 import { getLatestAssessmentByScope } from "./gsd-db.js";
 import { checkpointWorkflowDatabase } from "./db-workspace.js";
+import { formatVerdictRecordedNotice, formatVerdictRejectedNotice } from "./stop-notice.js";
 import {
   VALIDATION_VERDICTS,
   extractVerdict,
@@ -165,17 +166,17 @@ export async function handleVerdict(
   basePath: string,
 ): Promise<void> {
   if (!rawArgs.trim()) {
-    ctx.ui.notify(USAGE, "warning");
+    ctx.ui.notify(formatVerdictRejectedNotice(USAGE), "warning");
     return;
   }
 
   const parsed = parseArgs(rawArgs);
   if ("error" in parsed) {
-    ctx.ui.notify(`${parsed.error}\n${USAGE}`, "warning");
+    ctx.ui.notify(formatVerdictRejectedNotice(`${parsed.error}\n${USAGE}`), "warning");
     return;
   }
   if (!parsed.verdict) {
-    ctx.ui.notify(USAGE, "warning");
+    ctx.ui.notify(formatVerdictRejectedNotice(USAGE), "warning");
     return;
   }
 
@@ -184,7 +185,7 @@ export async function handleVerdict(
     const state = await deriveState(basePath);
     if (!state.activeMilestone) {
       ctx.ui.notify(
-        "No active milestone — pass --milestone Mxxx to target a specific milestone.",
+        formatVerdictRejectedNotice("No active milestone — pass --milestone Mxxx to target a specific milestone."),
         "warning",
       );
       return;
@@ -195,7 +196,9 @@ export async function handleVerdict(
   const existingValidation = await loadExistingValidation(basePath, milestoneId);
   if (!existingValidation) {
     ctx.ui.notify(
-      `No milestone validation found for ${milestoneId}. Run /gsd auto to validate first, then retry /gsd verdict.`,
+      formatVerdictRejectedNotice(
+        `No milestone validation found for ${milestoneId}. Run /gsd auto to validate first, then retry /gsd verdict.`,
+      ),
       "warning",
     );
     return;
@@ -205,7 +208,7 @@ export async function handleVerdict(
 
   if (parsed.verdict !== "pass" && !parsed.rationale) {
     ctx.ui.notify(
-      `--rationale is required when overriding to ${parsed.verdict}.`,
+      formatVerdictRejectedNotice(`--rationale is required when overriding to ${parsed.verdict}.`),
       "warning",
     );
     return;
@@ -234,7 +237,7 @@ export async function handleVerdict(
   if (result.isError) {
     const msg =
       result.content[0]?.type === "text" ? result.content[0].text : "Unknown error";
-    ctx.ui.notify(msg, "error");
+    ctx.ui.notify(formatVerdictRejectedNotice(msg), "error");
     return;
   }
 
@@ -244,12 +247,16 @@ export async function handleVerdict(
   const effectiveVerdict = extractEffectiveVerdict(result.details, parsed.verdict);
   if (effectiveVerdict !== parsed.verdict) {
     ctx.ui.notify(
-      `Milestone ${milestoneId} verdict requested: ${parsed.verdict}, effective: ${effectiveVerdict} (${existingValidation.source})`,
+      formatVerdictRecordedNotice(
+        `Milestone ${milestoneId} verdict requested: ${parsed.verdict}, effective: ${effectiveVerdict} (${existingValidation.source})`,
+      ),
       "warning",
     );
   } else {
     ctx.ui.notify(
-      `Milestone ${milestoneId} verdict: ${prevVerdict} -> ${effectiveVerdict} (${existingValidation.source})`,
+      formatVerdictRecordedNotice(
+        `Milestone ${milestoneId} verdict: ${prevVerdict} -> ${effectiveVerdict} (${existingValidation.source})`,
+      ),
       "success",
     );
   }

package/src/resources/extensions/gsd/compat/compat-marker.ts

@@ -6,8 +6,8 @@
 // (drift to import). gsd-core is oblivious to this file and ignores it.
 
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname, join, isAbsolute, normalize } from "node:path";
+import { existsSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname, join, isAbsolute, normalize, relative, resolve } from "node:path";
 
 /** Current marker schema version. Bump on breaking format changes + migrate. */
 export const COMPAT_MARKER_SCHEMA = 2;
@@ -54,6 +54,13 @@ export interface CompatMarker {
   piVersion: string;
 }
 
+export interface ReadCompatMarkerOptions {
+  /** Rewrite invalid-but-derivable marker keys back to safe root-relative keys. */
+  healInvalidKeys?: boolean;
+  /** Quarantine malformed/unsafe markers. Disable only for read-only previews. */
+  quarantineInvalid?: boolean;
+}
+
 /** Marker returned when no marker exists yet (fresh project, first gsd-pi run). */
 export const EMPTY_MARKER: CompatMarker = {
   schema: COMPAT_MARKER_SCHEMA,
@@ -81,6 +88,37 @@ export function computeProjectionSha(content: string): string {
   return createHash("sha256").update(normalizeForHash(content)).digest("hex").slice(0, 16);
 }
 
+function normalizeRealPath(p: string): string {
+  try {
+    return realpathSync.native(p);
+  } catch {
+    return resolve(p);
+  }
+}
+
+function rootRelativeKey(rootPath: string, absPath: string): string | null {
+  const root = normalizeRealPath(rootPath);
+  const abs = normalizeRealPath(absPath);
+  const rel = relative(root, abs);
+  if (!rel || rel === ".." || rel.startsWith(`..${sepForRelative(rel)}`) || isAbsolute(rel)) {
+    return null;
+  }
+  return rel.replace(/\\/g, "/");
+}
+
+function sepForRelative(rel: string): string {
+  return rel.includes("\\") ? "\\" : "/";
+}
+
+export function deriveCompatProjectionKey(absPath: string, roots: readonly string[]): string {
+  for (const root of roots) {
+    const key = rootRelativeKey(root, absPath);
+    if (key) return key;
+  }
+  const fallbackRoot = roots[roots.length - 1] ?? dirname(absPath);
+  return relative(fallbackRoot, absPath).replace(/\\/g, "/");
+}
+
 /**
  * Read & validate the marker. A missing marker → EMPTY_MARKER (treat every
  * projection as external on next reconcile). A malformed marker is quarantined
@@ -88,7 +126,12 @@ export function computeProjectionSha(content: string): string {
  * EMPTY_MARKER. A schema-mismatch returns EMPTY_MARKER (forward-compat: refuse
  * to act on a future format we don't understand).
  */
-export function readCompatMarker(basePath: string): CompatMarker {
+export function readCompatMarker(
+  basePath: string,
+  options: ReadCompatMarkerOptions = {},
+): CompatMarker {
+  const healInvalidKeys = options.healInvalidKeys ?? true;
+  const quarantineInvalid = options.quarantineInvalid ?? true;
   const path = compatMarkerPath(basePath);
   if (!existsSync(path)) return emptyMarker();
 
@@ -103,12 +146,16 @@ export function readCompatMarker(basePath: string): CompatMarker {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    quarantine(basePath, raw);
+    if (quarantineInvalid) quarantine(basePath, raw);
     return emptyMarker();
   }
 
+  if (healInvalidKeys && healMarkerProjectionKeys(basePath, parsed) && isValidMarker(parsed)) {
+    writeCompatMarker(basePath, parsed);
+  }
+
   if (!isValidMarker(parsed)) {
-    quarantine(basePath, raw);
+    if (quarantineInvalid) quarantine(basePath, raw);
     return emptyMarker();
   }
   // Promote older markers by defaulting absent fields. Schema 1 → 2 only adds
@@ -245,6 +292,53 @@ function isValidProjectionMap(x: unknown): boolean {
   return true;
 }
 
+function healMarkerProjectionKeys(basePath: string, marker: unknown): marker is CompatMarker {
+  if (typeof marker !== "object" || marker === null) return false;
+  const m = marker as Record<string, unknown>;
+  let changed = false;
+
+  if (typeof m.projections === "object" && m.projections !== null) {
+    changed = healProjectionMapKeys(basePath, ".gsd", m.projections as Record<string, ProjectionEntry>) || changed;
+  }
+
+  const planning = m.planning;
+  if (typeof planning === "object" && planning !== null) {
+    const p = planning as Record<string, unknown>;
+    if (typeof p.projections === "object" && p.projections !== null) {
+      changed = healProjectionMapKeys(basePath, ".planning", p.projections as Record<string, ProjectionEntry>) || changed;
+    }
+    if (typeof p.passthrough === "object" && p.passthrough !== null) {
+      changed = healProjectionMapKeys(basePath, ".planning", p.passthrough as Record<string, ProjectionEntry>) || changed;
+    }
+  }
+
+  return changed;
+}
+
+function healProjectionMapKeys(
+  basePath: string,
+  rootName: ".gsd" | ".planning",
+  map: Record<string, ProjectionEntry>,
+): boolean {
+  let changed = false;
+  const root = join(basePath, rootName);
+
+  for (const key of Object.keys(map)) {
+    if (isSafeProjectionKey(key)) continue;
+    if (key.includes("\0") || isAbsolute(key) || /^[A-Za-z]:/.test(key)) continue;
+    const healedKey = rootRelativeKey(root, resolve(root, key));
+    if (!healedKey || !isSafeProjectionKey(healedKey)) continue;
+
+    if (!map[healedKey]) {
+      map[healedKey] = map[key]!;
+    }
+    delete map[key];
+    changed = true;
+  }
+
+  return changed;
+}
+
 function isValidPlanningMarker(x: unknown): x is PlanningMarker {
   if (typeof x !== "object" || x === null) return false;
   const p = x as Record<string, unknown>;

package/src/resources/extensions/gsd/constants.ts

@@ -31,36 +31,37 @@ export const CACHE_MAX = 50;
  * By scoping tools to this allowlist during discuss dispatches, the grammar
  * sent to the provider stays well under provider limits.
  *
- * Included tools and why:
+ * Included tools and why (canonical names only — aliases are no longer
+ * advertised to models by default, see plan 035):
  *   - gsd_summary_save: writes CONTEXT.md artifacts (all discuss prompts)
- *   - gsd_save_summary: alias for above
  *   - gsd_decision_save: records decisions (discuss.md output phase)
- *   - gsd_save_decision: alias for above
  *   - gsd_plan_milestone: writes roadmap (discuss.md single/multi milestone)
- *   - gsd_milestone_plan: alias for above
  *   - gsd_milestone_generate_id: generates milestone IDs (discuss.md multi-milestone)
- *   - gsd_generate_milestone_id: alias for above
  *   - gsd_requirement_save: creates requirements during discuss
- *   - gsd_save_requirement: alias for above
  *   - gsd_requirement_update: updates requirements during discuss
- *   - gsd_update_requirement: alias for above
  */
 export const DISCUSS_TOOLS_ALLOWLIST: readonly string[] = [
   // Context / summary writing
   "gsd_summary_save",
-  "gsd_save_summary",
   // Decision recording
   "gsd_decision_save",
-  "gsd_save_decision",
   // Milestone planning (needed for discuss.md output phase)
   "gsd_plan_milestone",
-  "gsd_milestone_plan",
   // Milestone ID generation (multi-milestone flow)
   "gsd_milestone_generate_id",
-  "gsd_generate_milestone_id",
   // Requirement updates
   "gsd_requirement_save",
-  "gsd_save_requirement",
   "gsd_requirement_update",
-  "gsd_update_requirement",
 ];
+
+// ─── Context Injection ────────────────────────────────────────────────────────
+
+/**
+ * Leading marker stamped on every buildContextMessage() output
+ * (bootstrap/system-context.ts). Single source of truth for the producer and
+ * the consumer: the provider payload policy (filterSupersededContextInjections
+ * in context-masker.ts) matches this prefix to find and dedupe injected
+ * memory/guided/forensics messages after convertToLlm strips their customType.
+ * Both sides import it from here — do not inline the literal in either module.
+ */
+export const GSD_CONTEXT_MESSAGE_SENTINEL = "[GSD Context Injection]";