gsd-pi 2.50.0-dev.d210a87 → 2.51.0-dev.7d435fe

package/dist/resources/extensions/gsd/milestone-actions.js

@@ -15,6 +15,7 @@ import { join } from "node:path";
 import { resolveMilestonePath, resolveMilestoneFile, buildMilestoneFileName, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
+import { isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
 // ─── Park ──────────────────────────────────────────────────────────────────
 /**
  * Park a milestone — creates a PARKED.md marker file with reason and timestamp.
@@ -44,6 +45,15 @@ export function parkMilestone(basePath, milestoneId, reason) {
         "",
     ].join("\n");
     writeFileSync(parkedPath, content, "utf-8");
+    // Sync DB status so deriveStateFromDb also skips this milestone (#2694)
+    if (isDbAvailable()) {
+        try {
+            updateMilestoneStatus(milestoneId, "parked");
+        }
+        catch (err) {
+            process.stderr.write(`gsd: parkMilestone DB sync failed for ${milestoneId}: ${err.message}\n`);
+        }
+    }
     invalidateAllCaches();
     return true;
 }
@@ -60,6 +70,15 @@ export function unparkMilestone(basePath, milestoneId) {
     if (!existsSync(parkedPath))
         return false; // not parked
     unlinkSync(parkedPath);
+    // Sync DB status so deriveStateFromDb picks up the unparked milestone (#2694)
+    if (isDbAvailable()) {
+        try {
+            updateMilestoneStatus(milestoneId, "active");
+        }
+        catch (err) {
+            process.stderr.write(`gsd: unparkMilestone DB sync failed for ${milestoneId}: ${err.message}\n`);
+        }
+    }
     invalidateAllCaches();
     return true;
 }

package/dist/resources/extensions/gsd/preferences-models.js

@@ -98,18 +98,6 @@ export function getNextFallbackModel(currentModelId, modelConfig) {
         return modelsToTry[0];
     }
 }
-/**
- * Detect whether an error message indicates a transient network error
- * (worth retrying the same model) vs a permanent provider error
- * (auth failure, quota exceeded, etc. -- should fall back immediately).
- */
-export function isTransientNetworkError(errorMsg) {
-    if (!errorMsg)
-        return false;
-    const hasNetworkSignal = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns/i.test(errorMsg);
-    const hasPermanentSignal = /auth|unauthorized|forbidden|invalid.*key|quota|billing/i.test(errorMsg);
-    return hasNetworkSignal && !hasPermanentSignal;
-}
 /**
  * Validate a model ID string.
  * Returns true if the ID looks like a valid model identifier.
@@ -273,7 +261,7 @@ export function resolveContextSelection() {
     return profile === "budget" ? "smart" : "full";
 }
 /**
- * Resolve the search provider preference from preferences.md.
+ * Resolve the search provider preference from PREFERENCES.md.
  * Returns undefined if not configured (caller falls back to existing behavior).
  */
 export function resolveSearchProviderFromPreferences() {

package/dist/resources/extensions/gsd/preferences.js

@@ -24,27 +24,27 @@ export { validatePreferences } from "./preferences-validation.js";
 // ─── Re-exports: skills ─────────────────────────────────────────────────────
 export { resolveAllSkillReferences, resolveSkillDiscoveryMode, resolveSkillStalenessDays, } from "./preferences-skills.js";
 // ─── Re-exports: models ─────────────────────────────────────────────────────
-export { resolveModelForUnit, resolveModelWithFallbacksForUnit, getNextFallbackModel, isTransientNetworkError, validateModelId, updatePreferencesModels, resolveDynamicRoutingConfig, resolveAutoSupervisorConfig, resolveProfileDefaults, resolveEffectiveProfile, resolveInlineLevel, resolveContextSelection, resolveSearchProviderFromPreferences, } from "./preferences-models.js";
+export { resolveModelForUnit, resolveModelWithFallbacksForUnit, getNextFallbackModel, validateModelId, updatePreferencesModels, resolveDynamicRoutingConfig, resolveAutoSupervisorConfig, resolveProfileDefaults, resolveEffectiveProfile, resolveInlineLevel, resolveContextSelection, resolveSearchProviderFromPreferences, } from "./preferences-models.js";
 // ─── Path Constants & Getters ───────────────────────────────────────────────
 function gsdHome() {
     return process.env.GSD_HOME || join(homedir(), ".gsd");
 }
 function globalPreferencesPath() {
-    return join(gsdHome(), "preferences.md");
+    return join(gsdHome(), "PREFERENCES.md");
 }
 function legacyGlobalPreferencesPath() {
     return join(homedir(), ".pi", "agent", "gsd-preferences.md");
 }
 function projectPreferencesPath() {
-    return join(gsdRoot(process.cwd()), "preferences.md");
+    return join(gsdRoot(process.cwd()), "PREFERENCES.md");
 }
-// Bootstrap in gitignore.ts historically created PREFERENCES.md (uppercase) by mistake.
-// Check uppercase as a fallback so those files aren't silently ignored.
-function globalPreferencesPathUppercase() {
-    return join(gsdHome(), "PREFERENCES.md");
+// Legacy: older versions used lowercase preferences.md.
+// Check lowercase as a fallback so those files aren't silently ignored.
+function globalPreferencesPathLegacy() {
+    return join(gsdHome(), "preferences.md");
 }
-function projectPreferencesPathUppercase() {
-    return join(gsdRoot(process.cwd()), "PREFERENCES.md");
+function projectPreferencesPathLegacy() {
+    return join(gsdRoot(process.cwd()), "preferences.md");
 }
 export function getGlobalGSDPreferencesPath() {
     return globalPreferencesPath();
@@ -58,12 +58,12 @@ export function getProjectGSDPreferencesPath() {
 // ─── Loading ────────────────────────────────────────────────────────────────
 export function loadGlobalGSDPreferences() {
     return loadPreferencesFile(globalPreferencesPath(), "global")
-        ?? loadPreferencesFile(globalPreferencesPathUppercase(), "global")
+        ?? loadPreferencesFile(globalPreferencesPathLegacy(), "global")
         ?? loadPreferencesFile(legacyGlobalPreferencesPath(), "global");
 }
 export function loadProjectGSDPreferences() {
     return loadPreferencesFile(projectPreferencesPath(), "project")
-        ?? loadPreferencesFile(projectPreferencesPathUppercase(), "project");
+        ?? loadPreferencesFile(projectPreferencesPathLegacy(), "project");
 }
 export function loadEffectiveGSDPreferences() {
     const globalPreferences = loadGlobalGSDPreferences();
@@ -149,7 +149,7 @@ export function parsePreferencesMarkdown(content) {
     }
     if (!_warnedUnrecognizedFormat) {
         _warnedUnrecognizedFormat = true;
-        console.warn("[parsePreferencesMarkdown] preferences.md exists but uses an unrecognized format — skipping.");
+        console.warn("[parsePreferencesMarkdown] PREFERENCES.md exists but uses an unrecognized format — skipping.");
     }
     return null;
 }
@@ -398,7 +398,7 @@ export function resolvePreDispatchHooks() {
  * Resolve the effective git isolation mode from preferences.
  * Returns "none" (default), "worktree", or "branch".
  *
- * Default is "none" so GSD works out of the box without preferences.md.
+ * Default is "none" so GSD works out of the box without PREFERENCES.md.
  * Worktree isolation requires explicit opt-in because it depends on git
  * branch infrastructure that must be set up before use.
  */

package/dist/resources/extensions/gsd/prompts/system.md

@@ -92,7 +92,7 @@ Titles live inside file content (headings, frontmatter), not in file or director
 
 ### Isolation Model
 
-Auto-mode supports three isolation modes (configured in `.gsd/preferences.md` under `taskIsolation.mode`):
+Auto-mode supports three isolation modes (configured in `.gsd/PREFERENCES.md` under `taskIsolation.mode`):
 
 - **worktree** (default): Work happens in `.gsd/worktrees/<MID>/`, a full git worktree on the `milestone/<MID>` branch. Each worktree has its own working copy and `.gsd/` directory. Squash-merged back to the integration branch on milestone completion.
 - **branch**: Work happens in the project root on a `milestone/<MID>` branch. No worktree directory — files are checked out in-place.

package/dist/resources/extensions/gsd/provider-error-pause.js

@@ -1,47 +1,3 @@
-/**
- * Classify a provider error as transient (auto-resume) or permanent (manual resume).
- *
- * Transient: rate limits, server errors (500/502/503), overloaded, internal errors.
- * These are expected to self-resolve and should auto-resume after a delay.
- *
- * Permanent: auth errors, invalid API key, billing issues.
- * These require user intervention and should pause indefinitely.
- */
-export function classifyProviderError(errorMsg) {
-    const isRateLimit = /rate.?limit|too many requests|429/i.test(errorMsg);
-    const isServerError = /internal server error|500|502|503|overloaded|server_error|api_error|service.?unavailable/i.test(errorMsg);
-    // Connection/process errors — transient, auto-resume after brief backoff (#2309).
-    // These indicate the process was killed, the connection was reset, or a network
-    // blip occurred. They are NOT permanent failures.
-    const isConnectionError = /terminated|connection.?reset|connection.?refused|other side closed|fetch failed|network.?(?:is\s+)?unavailable|ECONNREFUSED|ECONNRESET|EPIPE/i.test(errorMsg);
-    // Permanent errors — never auto-resume
-    const isPermanent = /auth|unauthorized|forbidden|invalid.*key|invalid.*api|billing|quota exceeded|account/i.test(errorMsg);
-    if (isPermanent && !isRateLimit) {
-        return { isTransient: false, isRateLimit: false, suggestedDelayMs: 0 };
-    }
-    if (isRateLimit) {
-        // Try to extract retry-after from the message
-        const resetMatch = errorMsg.match(/reset in (\d+)s/i);
-        const delayMs = resetMatch ? Number(resetMatch[1]) * 1000 : 60_000; // default 60s for rate limits
-        return { isTransient: true, isRateLimit: true, suggestedDelayMs: delayMs };
-    }
-    if (isServerError) {
-        return { isTransient: true, isRateLimit: false, suggestedDelayMs: 30_000 }; // 30s for server errors
-    }
-    if (isConnectionError) {
-        return { isTransient: true, isRateLimit: false, suggestedDelayMs: 15_000 }; // 15s for connection errors
-    }
-    // Stream-truncation JSON parse errors — transient (#2572).
-    // When the API stream is cut mid-chunk, pi tries to reassemble the partial
-    // tool-call JSON and gets a SyntaxError. This is the downstream symptom of
-    // a connection drop — same root cause as ECONNRESET, one layer up.
-    const isMalformedStream = /Unexpected end of JSON|Unexpected token.*JSON|Expected double-quoted property name|SyntaxError.*JSON/i.test(errorMsg);
-    if (isMalformedStream) {
-        return { isTransient: true, isRateLimit: false, suggestedDelayMs: 15_000 }; // 15s, same as connection errors
-    }
-    // Unknown error — treat as permanent (user reviews)
-    return { isTransient: false, isRateLimit: false, suggestedDelayMs: 0 };
-}
 /**
  * Pause auto-mode due to a provider error.
  *

package/dist/resources/extensions/gsd/rule-registry.js

@@ -426,7 +426,7 @@ export class RuleRegistry {
     formatHookStatus() {
         const entries = this.getHookStatus();
         if (entries.length === 0) {
-            return "No hooks configured. Add post_unit_hooks or pre_dispatch_hooks to .gsd/preferences.md";
+            return "No hooks configured. Add post_unit_hooks or pre_dispatch_hooks to .gsd/PREFERENCES.md";
         }
         const lines = ["Configured Hooks:", ""];
         const postHooks = entries.filter(e => e.type === "post");

package/dist/resources/extensions/gsd/service-tier.js

@@ -13,16 +13,27 @@ import { getGlobalGSDPreferencesPath, loadEffectiveGSDPreferences, loadGlobalGSD
 import { ensurePreferencesFile, serializePreferencesToFrontmatter } from "./commands-prefs-wizard.js";
 const SERVICE_TIER_SCOPE_NOTE = "Only affects gpt-5.4 models, regardless of provider.";
 // ─── Gating ──────────────────────────────────────────────────────────────────
+/**
+ * Model ID prefixes (bare, without provider) that support OpenAI service tiers.
+ *
+ * This list is the fallback for callers that only have a model ID string.
+ * The authoritative source of truth is `model.capabilities.supportsServiceTier`
+ * (set via CAPABILITY_PATCHES in packages/pi-ai/src/models.ts). When callers
+ * have access to the full Model object, prefer reading capabilities directly.
+ *
+ * See: https://github.com/gsd-build/gsd-2/issues/2546
+ */
+const SERVICE_TIER_MODEL_PREFIXES = ["gpt-5.4"];
 /**
  * Returns true when the given model ID supports OpenAI service tiers.
- * Currently only gpt-5.4 variants qualify.
+ * Reads from SERVICE_TIER_MODEL_PREFIXES — update that list, not this function.
  */
 export function supportsServiceTier(modelId) {
     if (!modelId)
         return false;
     // Strip provider prefix if present (e.g. "openai/gpt-5.4" → "gpt-5.4")
     const bare = modelId.includes("/") ? modelId.split("/").pop() : modelId;
-    return bare.startsWith("gpt-5.4");
+    return SERVICE_TIER_MODEL_PREFIXES.some((prefix) => bare.startsWith(prefix));
 }
 // ─── Status Formatting ───────────────────────────────────────────────────────
 /**

package/dist/resources/extensions/gsd/state.js

@@ -144,7 +144,23 @@ export async function deriveState(basePath) {
     let result;
     // Dual-path: try DB-backed derivation first when hierarchy tables are populated
     if (isDbAvailable()) {
-        const dbMilestones = getAllMilestones();
+        let dbMilestones = getAllMilestones();
+        // Disk→DB reconciliation (#2631): when the milestones table is empty
+        // (e.g. failed initial migration per #2529), the reconciliation code
+        // inside deriveStateFromDb is unreachable. Populate from disk here so
+        // the DB path activates correctly.
+        if (dbMilestones.length === 0) {
+            const diskIds = findMilestoneIds(basePath);
+            let synced = false;
+            for (const diskId of diskIds) {
+                if (!isGhostMilestone(basePath, diskId)) {
+                    insertMilestone({ id: diskId, status: 'active' });
+                    synced = true;
+                }
+            }
+            if (synced)
+                dbMilestones = getAllMilestones();
+        }
         if (dbMilestones.length > 0) {
             const stopDbTimer = debugTime("derive-state-db");
             result = await deriveStateFromDb(basePath);
@@ -465,7 +481,10 @@ export async function deriveStateFromDb(basePath) {
         };
     }
     // ── All slices done → validating/completing ─────────────────────────
-    const allSlicesDone = activeMilestoneSlices.every(s => isStatusDone(s.status));
+    // Guard: [].every() === true (vacuous truth). Without the length check,
+    // an empty slice array causes a premature phase transition to
+    // validating-milestone. See: https://github.com/gsd-build/gsd-2/issues/2667
+    const allSlicesDone = activeMilestoneSlices.length > 0 && activeMilestoneSlices.every(s => isStatusDone(s.status));
     if (allSlicesDone) {
         const validationFile = resolveMilestoneFile(basePath, activeMilestone.id, "VALIDATION");
         const validationContent = validationFile ? await loadFile(validationFile) : null;

package/dist/resources/extensions/gsd/tools/complete-milestone.js

@@ -7,7 +7,7 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, _getAdapter, } from "../gsd-db.js";
+import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, updateMilestoneStatus, } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
@@ -116,11 +116,7 @@ export async function handleCompleteMilestone(params, basePath) {
             }
         }
         // All guards passed — perform write
-        const adapter = _getAdapter();
-        adapter.prepare(`UPDATE milestones SET status = 'complete', completed_at = :completed_at WHERE id = :mid`).run({
-            ":completed_at": completedAt,
-            ":mid": params.milestoneId,
-        });
+        updateMilestoneStatus(params.milestoneId, 'complete', completedAt);
     });
     if (guardError) {
         return { error: guardError };
@@ -144,10 +140,7 @@ export async function handleCompleteMilestone(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_milestone — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE milestones SET status = 'active', completed_at = NULL WHERE id = :mid`).run({ ":mid": params.milestoneId });
-        }
+        updateMilestoneStatus(params.milestoneId, 'active', null);
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -8,7 +8,7 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, _getAdapter, } from "../gsd-db.js";
+import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, setSliceSummaryMd, } from "../gsd-db.js";
 import { resolveSlicePath, clearPathCache } from "../paths.js";
 import { checkOwnership, sliceUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -240,26 +240,12 @@ export async function handleCompleteSlice(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_slice — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE slices SET status = 'pending' WHERE milestone_id = :mid AND id = :sid`).run({
-                ":mid": params.milestoneId,
-                ":sid": params.sliceId,
-            });
-        }
+        updateSliceStatus(params.milestoneId, params.sliceId, 'pending');
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }
     // Store rendered markdown in DB for D004 recovery
-    const adapter = _getAdapter();
-    if (adapter) {
-        adapter.prepare(`UPDATE slices SET full_summary_md = :summary_md, full_uat_md = :uat_md WHERE milestone_id = :mid AND id = :sid`).run({
-            ":summary_md": summaryMd,
-            ":uat_md": uatMd,
-            ":mid": params.milestoneId,
-            ":sid": params.sliceId,
-        });
-    }
+    setSliceSummaryMd(params.milestoneId, params.sliceId, summaryMd, uatMd);
     // Invalidate all caches
     invalidateStateCache();
     clearPathCache();

package/dist/resources/extensions/gsd/tools/complete-task.js

@@ -8,7 +8,7 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, getMilestone, getSlice, getTask, _getAdapter, } from "../gsd-db.js";
+import { transaction, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, getMilestone, getSlice, getTask, updateTaskStatus, setTaskSummaryMd, deleteVerificationEvidence, } from "../gsd-db.js";
 import { resolveSliceFile, resolveTasksDir, clearPathCache } from "../paths.js";
 import { checkOwnership, taskUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -202,27 +202,16 @@ export async function handleCompleteTask(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_task — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE tasks SET status = 'pending' WHERE milestone_id = :mid AND slice_id = :sid AND id = :tid`).run({
-                ":mid": params.milestoneId,
-                ":sid": params.sliceId,
-                ":tid": params.taskId,
-            });
-        }
+        // Delete orphaned verification_evidence rows first (FK constraint
+        // references tasks, so evidence must go before status change).
+        // Without this, retries accumulate duplicate evidence rows (#2724).
+        deleteVerificationEvidence(params.milestoneId, params.sliceId, params.taskId);
+        updateTaskStatus(params.milestoneId, params.sliceId, params.taskId, 'pending');
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }
     // Store rendered markdown in DB for D004 recovery
-    const adapter = _getAdapter();
-    if (adapter) {
-        adapter.prepare(`UPDATE tasks SET full_summary_md = :md WHERE milestone_id = :mid AND slice_id = :sid AND id = :tid`).run({
-            ":md": summaryMd,
-            ":mid": params.milestoneId,
-            ":sid": params.sliceId,
-            ":tid": params.taskId,
-        });
-    }
+    setTaskSummaryMd(params.milestoneId, params.sliceId, params.taskId, summaryMd);
     // Invalidate all caches
     invalidateStateCache();
     clearPathCache();

package/dist/resources/extensions/gsd/tools/plan-milestone.js

@@ -145,25 +145,31 @@ export async function handlePlanMilestone(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    // ── State machine preconditions ─────────────────────────────────────────
-    const existingMilestone = getMilestone(params.milestoneId);
-    if (existingMilestone && (existingMilestone.status === "complete" || existingMilestone.status === "done")) {
-        return { error: `cannot re-plan milestone ${params.milestoneId}: it is already complete` };
-    }
-    // Validate depends_on: all dependencies must exist and be complete
-    if (params.dependsOn && params.dependsOn.length > 0) {
-        for (const depId of params.dependsOn) {
-            const dep = getMilestone(depId);
-            if (!dep) {
-                return { error: `depends_on references unknown milestone: ${depId}` };
-            }
-            if (dep.status !== "complete" && dep.status !== "done") {
-                return { error: `depends_on milestone ${depId} is not yet complete (status: ${dep.status})` };
-            }
-        }
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const existingMilestone = getMilestone(params.milestoneId);
+            if (existingMilestone && (existingMilestone.status === "complete" || existingMilestone.status === "done")) {
+                guardError = `cannot re-plan milestone ${params.milestoneId}: it is already complete`;
+                return;
+            }
+            // Validate depends_on: all dependencies must exist and be complete
+            if (params.dependsOn && params.dependsOn.length > 0) {
+                for (const depId of params.dependsOn) {
+                    const dep = getMilestone(depId);
+                    if (!dep) {
+                        guardError = `depends_on references unknown milestone: ${depId}`;
+                        return;
+                    }
+                    if (dep.status !== "complete" && dep.status !== "done") {
+                        guardError = `depends_on milestone ${depId} is not yet complete (status: ${dep.status})`;
+                        return;
+                    }
+                }
+            }
             insertMilestone({
                 id: params.milestoneId,
                 title: params.title,
@@ -206,6 +212,9 @@ export async function handlePlanMilestone(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     let roadmapPath;
     try {
         const renderResult = await renderRoadmapFromDb(basePath, params.milestoneId);

package/dist/resources/extensions/gsd/tools/plan-slice.js

@@ -102,22 +102,30 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    const parentMilestone = getMilestone(params.milestoneId);
-    if (!parentMilestone) {
-        return { error: `milestone not found: ${params.milestoneId}` };
-    }
-    if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
-        return { error: `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})` };
-    }
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first` };
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const parentMilestone = getMilestone(params.milestoneId);
+            if (!parentMilestone) {
+                guardError = `milestone not found: ${params.milestoneId}`;
+                return;
+            }
+            if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
+                guardError = `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})`;
+                return;
+            }
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (parentSlice.status === "complete" || parentSlice.status === "done") {
+                guardError = `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first`;
+                return;
+            }
             upsertSlicePlanning(params.milestoneId, params.sliceId, {
                 goal: params.goal,
                 successCriteria: params.successCriteria,
@@ -163,6 +171,9 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     try {
         const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
         invalidateStateCache();

package/dist/resources/extensions/gsd/tools/plan-task.js

@@ -50,19 +50,26 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-    }
-    const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
-    if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
-        return { error: `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first` };
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (parentSlice.status === "complete" || parentSlice.status === "done") {
+                guardError = `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+                return;
+            }
+            const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
+            if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
+                guardError = `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first`;
+                return;
+            }
             if (!existingTask) {
                 insertTask({
                     id: params.taskId,
@@ -88,6 +95,9 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     try {
         const renderResult = await renderTaskPlanFromDb(basePath, params.milestoneId, params.sliceId, params.taskId);
         invalidateStateCache();