gsd-pi 2.50.0 → 2.51.0-dev.7d435fe

package/dist/resources/extensions/gsd/skill-discovery.js

@@ -9,8 +9,9 @@
  */
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { getAgentDir } from "@gsd/pi-coding-agent";
-const SKILLS_DIR = join(getAgentDir(), "skills");
+import { homedir } from "node:os";
+/** Industry-standard skills.sh global skills directory */
+const SKILLS_DIR = join(homedir(), ".agents", "skills");
 /** Snapshot of skill names at auto-mode start */
 let baselineSkills = null;
 /**

package/dist/resources/extensions/gsd/skill-health.js

@@ -14,7 +14,7 @@
  */
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { getAgentDir } from "@gsd/pi-coding-agent";
+import { homedir } from "node:os";
 import { formatCost, formatTokenCount, loadLedgerFromDisk } from "./metrics.js";
 import { detectStaleSkills } from "./skill-telemetry.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
@@ -141,7 +141,7 @@ export function formatSkillDetail(basePath, skillName) {
         lines.push(`  ${date}  ${u.id.padEnd(20)}  ${formatTokenCount(u.tokens.total).padStart(8)} tokens  ${formatCost(u.cost)}`);
     }
     // Check for SKILL.md existence
-    const skillPath = join(getAgentDir(), "skills", skillName, "SKILL.md");
+    const skillPath = join(homedir(), ".agents", "skills", skillName, "SKILL.md");
     if (existsSync(skillPath)) {
         const stat = require("node:fs").statSync(skillPath);
         lines.push("");

package/dist/resources/extensions/gsd/skill-telemetry.js

@@ -12,7 +12,7 @@
  */
 import { existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
-import { getAgentDir } from "@gsd/pi-coding-agent";
+import { homedir } from "node:os";
 // ─── In-memory state ──────────────────────────────────────────────────────────
 /** Skills available in the system prompt for the current unit */
 let availableSkills = [];
@@ -24,8 +24,14 @@ const activelyLoadedSkills = new Set();
  * Called before each unit starts.
  */
 export function captureAvailableSkills() {
-    const skillsDir = join(getAgentDir(), "skills");
-    availableSkills = listSkillNames(skillsDir);
+    const skillsDir = join(homedir(), ".agents", "skills");
+    const legacyDir = join(homedir(), ".gsd", "agent", "skills");
+    const names = listSkillNames(skillsDir);
+    // Include skills still in the legacy directory only if migration hasn't completed
+    const legacyMigrated = existsSync(join(legacyDir, ".migrated-to-agents"));
+    const legacyNames = legacyMigrated ? [] : listSkillNames(legacyDir);
+    const all = new Set([...names, ...legacyNames]);
+    availableSkills = [...all];
     activelyLoadedSkills.clear();
 }
 /**
@@ -85,8 +91,12 @@ export function detectStaleSkills(units, thresholdDays) {
     const cutoff = Date.now() - (thresholdDays * 24 * 60 * 60 * 1000);
     const stale = [];
     // Check all installed skills, not just those with usage data
-    const skillsDir = join(getAgentDir(), "skills");
-    const installed = listSkillNames(skillsDir);
+    const skillsDir = join(homedir(), ".agents", "skills");
+    const legacyDir = join(homedir(), ".gsd", "agent", "skills");
+    const legacyMigrated = existsSync(join(legacyDir, ".migrated-to-agents"));
+    const legacyNames = legacyMigrated ? [] : listSkillNames(legacyDir);
+    const installedSet = new Set([...listSkillNames(skillsDir), ...legacyNames]);
+    const installed = [...installedSet];
     for (const skill of installed) {
         const lastTs = lastUsed.get(skill);
         if (lastTs === undefined || lastTs < cutoff) {

package/dist/resources/extensions/gsd/state.js

@@ -4,7 +4,8 @@
 import { parseRoadmap, parsePlan, } from './parsers-legacy.js';
 import { parseSummary, loadFile, parseRequirementCounts, parseContextDependsOn, } from './files.js';
 import { resolveMilestoneFile, resolveSlicePath, resolveSliceFile, resolveTaskFile, resolveTasksDir, resolveGsdRootFile, gsdRoot, } from './paths.js';
-import { milestoneIdSort, findMilestoneIds } from './milestone-ids.js';
+import { findMilestoneIds } from './milestone-ids.js';
+import { loadQueueOrder, sortByQueueOrder } from './queue-order.js';
 import { nativeBatchParseGsdFiles } from './native-parser-bridge.js';
 import { join, resolve } from 'path';
 import { existsSync, readdirSync } from 'node:fs';
@@ -84,8 +85,14 @@ export async function getActiveMilestoneId(basePath) {
     if (isDbAvailable()) {
         const allMilestones = getAllMilestones();
         if (allMilestones.length > 0) {
-            const sorted = [...allMilestones].sort((a, b) => a.id.localeCompare(b.id));
-            for (const m of sorted) {
+            // Respect queue-order.json so /gsd queue reordering is honored (#2556).
+            // Without this, the DB path uses lexicographic sort while the dispatch
+            // guard uses queue order — causing a deadlock.
+            const customOrder = loadQueueOrder(basePath);
+            const sortedIds = sortByQueueOrder(allMilestones.map(m => m.id), customOrder);
+            const byId = new Map(allMilestones.map(m => [m.id, m]));
+            for (const id of sortedIds) {
+                const m = byId.get(id);
                 if (m.status === "complete" || m.status === "done" || m.status === "parked")
                     continue;
                 return m.id;
@@ -137,7 +144,23 @@ export async function deriveState(basePath) {
     let result;
     // Dual-path: try DB-backed derivation first when hierarchy tables are populated
     if (isDbAvailable()) {
-        const dbMilestones = getAllMilestones();
+        let dbMilestones = getAllMilestones();
+        // Disk→DB reconciliation (#2631): when the milestones table is empty
+        // (e.g. failed initial migration per #2529), the reconciliation code
+        // inside deriveStateFromDb is unreachable. Populate from disk here so
+        // the DB path activates correctly.
+        if (dbMilestones.length === 0) {
+            const diskIds = findMilestoneIds(basePath);
+            let synced = false;
+            for (const diskId of diskIds) {
+                if (!isGhostMilestone(basePath, diskId)) {
+                    insertMilestone({ id: diskId, status: 'active' });
+                    synced = true;
+                }
+            }
+            if (synced)
+                dbMilestones = getAllMilestones();
+        }
         if (dbMilestones.length > 0) {
             const stopDbTimer = debugTime("derive-state-db");
             result = await deriveStateFromDb(basePath);
@@ -233,8 +256,13 @@ export async function deriveStateFromDb(basePath) {
             });
         }
     }
-    // Re-sort so milestones are in canonical order after injection
-    allMilestones.sort((a, b) => milestoneIdSort(a.id, b.id));
+    // Re-sort so milestones follow queue order (same as dispatch guard) (#2556)
+    const customOrder = loadQueueOrder(basePath);
+    const sortedIds = sortByQueueOrder(allMilestones.map(m => m.id), customOrder);
+    const byId = new Map(allMilestones.map(m => [m.id, m]));
+    allMilestones.length = 0;
+    for (const id of sortedIds)
+        allMilestones.push(byId.get(id));
     // Parallel worker isolation: when locked, filter to just the locked milestone
     const milestoneLock = process.env.GSD_MILESTONE_LOCK;
     const milestones = milestoneLock
@@ -453,7 +481,10 @@ export async function deriveStateFromDb(basePath) {
         };
     }
     // ── All slices done → validating/completing ─────────────────────────
-    const allSlicesDone = activeMilestoneSlices.every(s => isStatusDone(s.status));
+    // Guard: [].every() === true (vacuous truth). Without the length check,
+    // an empty slice array causes a premature phase transition to
+    // validating-milestone. See: https://github.com/gsd-build/gsd-2/issues/2667
+    const allSlicesDone = activeMilestoneSlices.length > 0 && activeMilestoneSlices.every(s => isStatusDone(s.status));
     if (allSlicesDone) {
         const validationFile = resolveMilestoneFile(basePath, activeMilestone.id, "VALIDATION");
         const validationContent = validationFile ? await loadFile(validationFile) : null;

package/dist/resources/extensions/gsd/templates/{preferences.md → PREFERENCES.md}

@@ -71,6 +71,8 @@ remote_questions:
 uat_dispatch:
 post_unit_hooks: []
 pre_dispatch_hooks: []
+# experimental:
+#   rtk: false
 ---
 
 # GSD Skill Preferences

package/dist/resources/extensions/gsd/templates/milestone-validation.md

@@ -35,6 +35,18 @@ validated_at: {{date}}
 
 - **{{requirementId}}**: {{status}} — {{disposition: covered by remediation slice / acceptable gap / needs attention}}
 
+## Verification Class Compliance
+
+<!-- If verification classes were defined during planning, document whether each
+     was addressed. Use N/A for classes that were empty or "none" in planning. -->
+
+| Class | Planned | Evidence | Status |
+|-------|---------|----------|--------|
+| Contract | {{planned_or_none}} | {{evidence_or_none}} | {{MET / NOT MET / N/A}} |
+| Integration | {{planned_or_none}} | {{evidence_or_none}} | {{MET / NOT MET / N/A}} |
+| Operational | {{planned_or_none}} | {{evidence_or_none}} | {{MET / NOT MET / N/A}} |
+| UAT | {{planned_or_none}} | {{evidence_or_none}} | {{MET / NOT MET / N/A}} |
+
 ## Remediation Slices
 
 <!-- New slices appended to the roadmap to address auto-remediable gaps.

package/dist/resources/extensions/gsd/tests/dist-redirect.mjs

@@ -7,17 +7,28 @@ const require = createRequire(import.meta.url);
 const ROOT = new URL("../../../../../", import.meta.url);
 
 export function resolve(specifier, context, nextResolve) {
-  // 1. Direct redirects to dist/ for specific packages
+  // 1. Redirect all workspace package bare imports to source.
+  //    CI portability runs don't build any packages/ dist artifacts, so every
+  //    @gsd/* specifier (including transitive ones pulled in by pi-coding-agent
+  //    source itself) must resolve to the TypeScript source entrypoint.
   if (specifier === "../../packages/pi-coding-agent/src/index.js") {
-    specifier = new URL("packages/pi-coding-agent/dist/index.js", ROOT).href;
+    specifier = new URL("packages/pi-coding-agent/src/index.ts", ROOT).href;
+  } else if (specifier === "@gsd/pi-coding-agent") {
+    specifier = new URL("packages/pi-coding-agent/src/index.ts", ROOT).href;
   } else if (specifier === "@gsd/pi-ai/oauth") {
-    specifier = new URL("packages/pi-ai/dist/utils/oauth/index.js", ROOT).href;
+    specifier = new URL("packages/pi-ai/src/utils/oauth/index.ts", ROOT).href;
   } else if (specifier === "@gsd/pi-ai") {
-    specifier = new URL("packages/pi-ai/dist/index.js", ROOT).href;
+    specifier = new URL("packages/pi-ai/src/index.ts", ROOT).href;
   } else if (specifier === "@gsd/pi-agent-core") {
-    specifier = new URL("packages/pi-agent-core/dist/index.js", ROOT).href;
+    specifier = new URL("packages/pi-agent-core/src/index.ts", ROOT).href;
   } else if (specifier === "@gsd/pi-tui") {
-    specifier = new URL("packages/pi-tui/dist/index.js", ROOT).href;
+    specifier = new URL("packages/pi-tui/src/index.ts", ROOT).href;
+  } else if (specifier === "@gsd/native") {
+    specifier = new URL("packages/native/src/index.ts", ROOT).href;
+  } else if (specifier.startsWith("@gsd/native/")) {
+    // Sub-path imports like @gsd/native/fd, @gsd/native/text, etc.
+    const subpath = specifier.slice("@gsd/native/".length);
+    specifier = new URL(`packages/native/src/${subpath}/index.ts`, ROOT).href;
   }
   // 2. Redirect packages/*/dist/ → packages/*/src/ with .js→.ts for strip-types
   //    Also handles local imports — skip rewrite for dist/ paths that are real compiled artifacts.
@@ -54,9 +65,15 @@ export function resolve(specifier, context, nextResolve) {
 }
 
 export function load(url, context, nextLoad) {
-  // Node's --experimental-strip-types handles .ts but not .tsx (which may contain JSX).
-  // Use TypeScript to transpile .tsx → JS with react-jsx transform, then serve as module.
-  if (url.endsWith('.tsx')) {
+  // Node's --experimental-strip-types handles plain .ts but not .tsx and not
+  // all TypeScript syntax used by workspace packages (parameter properties,
+  // decorators, etc.). Transpile all workspace package source files and .tsx
+  // files through TypeScript's transpileModule to avoid those crashes.
+  const shouldTranspileWithTypeScript =
+    url.endsWith('.tsx') ||
+    (url.endsWith('.ts') && url.includes('/packages/') && url.includes('/src/'));
+
+  if (shouldTranspileWithTypeScript) {
     const ts = require('typescript');
     const source = readFileSync(fileURLToPath(url), 'utf-8');
     const { outputText } = ts.transpileModule(source, {
@@ -66,6 +83,8 @@ export function load(url, context, nextLoad) {
         module: ts.ModuleKind.ESNext,
         target: ts.ScriptTarget.ESNext,
         esModuleInterop: true,
+        experimentalDecorators: true,
+        emitDecoratorMetadata: true,
       },
     });
     return { format: 'module', source: outputText, shortCircuit: true };

package/dist/resources/extensions/gsd/tools/complete-milestone.js

@@ -7,7 +7,7 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, _getAdapter, } from "../gsd-db.js";
+import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, updateMilestoneStatus, } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
@@ -116,11 +116,7 @@ export async function handleCompleteMilestone(params, basePath) {
             }
         }
         // All guards passed — perform write
-        const adapter = _getAdapter();
-        adapter.prepare(`UPDATE milestones SET status = 'complete', completed_at = :completed_at WHERE id = :mid`).run({
-            ":completed_at": completedAt,
-            ":mid": params.milestoneId,
-        });
+        updateMilestoneStatus(params.milestoneId, 'complete', completedAt);
     });
     if (guardError) {
         return { error: guardError };
@@ -144,10 +140,7 @@ export async function handleCompleteMilestone(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_milestone — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE milestones SET status = 'active', completed_at = NULL WHERE id = :mid`).run({ ":mid": params.milestoneId });
-        }
+        updateMilestoneStatus(params.milestoneId, 'active', null);
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -8,7 +8,7 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, _getAdapter, } from "../gsd-db.js";
+import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, setSliceSummaryMd, } from "../gsd-db.js";
 import { resolveSlicePath, clearPathCache } from "../paths.js";
 import { checkOwnership, sliceUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -240,26 +240,12 @@ export async function handleCompleteSlice(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_slice — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE slices SET status = 'pending' WHERE milestone_id = :mid AND id = :sid`).run({
-                ":mid": params.milestoneId,
-                ":sid": params.sliceId,
-            });
-        }
+        updateSliceStatus(params.milestoneId, params.sliceId, 'pending');
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }
     // Store rendered markdown in DB for D004 recovery
-    const adapter = _getAdapter();
-    if (adapter) {
-        adapter.prepare(`UPDATE slices SET full_summary_md = :summary_md, full_uat_md = :uat_md WHERE milestone_id = :mid AND id = :sid`).run({
-            ":summary_md": summaryMd,
-            ":uat_md": uatMd,
-            ":mid": params.milestoneId,
-            ":sid": params.sliceId,
-        });
-    }
+    setSliceSummaryMd(params.milestoneId, params.sliceId, summaryMd, uatMd);
     // Invalidate all caches
     invalidateStateCache();
     clearPathCache();

package/dist/resources/extensions/gsd/tools/complete-task.js

@@ -8,7 +8,7 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, getMilestone, getSlice, getTask, _getAdapter, } from "../gsd-db.js";
+import { transaction, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, getMilestone, getSlice, getTask, updateTaskStatus, setTaskSummaryMd, deleteVerificationEvidence, } from "../gsd-db.js";
 import { resolveSliceFile, resolveTasksDir, clearPathCache } from "../paths.js";
 import { checkOwnership, taskUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -202,27 +202,16 @@ export async function handleCompleteTask(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_task — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE tasks SET status = 'pending' WHERE milestone_id = :mid AND slice_id = :sid AND id = :tid`).run({
-                ":mid": params.milestoneId,
-                ":sid": params.sliceId,
-                ":tid": params.taskId,
-            });
-        }
+        // Delete orphaned verification_evidence rows first (FK constraint
+        // references tasks, so evidence must go before status change).
+        // Without this, retries accumulate duplicate evidence rows (#2724).
+        deleteVerificationEvidence(params.milestoneId, params.sliceId, params.taskId);
+        updateTaskStatus(params.milestoneId, params.sliceId, params.taskId, 'pending');
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }
     // Store rendered markdown in DB for D004 recovery
-    const adapter = _getAdapter();
-    if (adapter) {
-        adapter.prepare(`UPDATE tasks SET full_summary_md = :md WHERE milestone_id = :mid AND slice_id = :sid AND id = :tid`).run({
-            ":md": summaryMd,
-            ":mid": params.milestoneId,
-            ":sid": params.sliceId,
-            ":tid": params.taskId,
-        });
-    }
+    setTaskSummaryMd(params.milestoneId, params.sliceId, params.taskId, summaryMd);
     // Invalidate all caches
     invalidateStateCache();
     clearPathCache();

package/dist/resources/extensions/gsd/tools/plan-milestone.js

@@ -145,25 +145,31 @@ export async function handlePlanMilestone(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    // ── State machine preconditions ─────────────────────────────────────────
-    const existingMilestone = getMilestone(params.milestoneId);
-    if (existingMilestone && (existingMilestone.status === "complete" || existingMilestone.status === "done")) {
-        return { error: `cannot re-plan milestone ${params.milestoneId}: it is already complete` };
-    }
-    // Validate depends_on: all dependencies must exist and be complete
-    if (params.dependsOn && params.dependsOn.length > 0) {
-        for (const depId of params.dependsOn) {
-            const dep = getMilestone(depId);
-            if (!dep) {
-                return { error: `depends_on references unknown milestone: ${depId}` };
-            }
-            if (dep.status !== "complete" && dep.status !== "done") {
-                return { error: `depends_on milestone ${depId} is not yet complete (status: ${dep.status})` };
-            }
-        }
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const existingMilestone = getMilestone(params.milestoneId);
+            if (existingMilestone && (existingMilestone.status === "complete" || existingMilestone.status === "done")) {
+                guardError = `cannot re-plan milestone ${params.milestoneId}: it is already complete`;
+                return;
+            }
+            // Validate depends_on: all dependencies must exist and be complete
+            if (params.dependsOn && params.dependsOn.length > 0) {
+                for (const depId of params.dependsOn) {
+                    const dep = getMilestone(depId);
+                    if (!dep) {
+                        guardError = `depends_on references unknown milestone: ${depId}`;
+                        return;
+                    }
+                    if (dep.status !== "complete" && dep.status !== "done") {
+                        guardError = `depends_on milestone ${depId} is not yet complete (status: ${dep.status})`;
+                        return;
+                    }
+                }
+            }
             insertMilestone({
                 id: params.milestoneId,
                 title: params.title,
@@ -206,6 +212,9 @@ export async function handlePlanMilestone(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     let roadmapPath;
     try {
         const renderResult = await renderRoadmapFromDb(basePath, params.milestoneId);

package/dist/resources/extensions/gsd/tools/plan-slice.js

@@ -102,22 +102,30 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    const parentMilestone = getMilestone(params.milestoneId);
-    if (!parentMilestone) {
-        return { error: `milestone not found: ${params.milestoneId}` };
-    }
-    if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
-        return { error: `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})` };
-    }
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first` };
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const parentMilestone = getMilestone(params.milestoneId);
+            if (!parentMilestone) {
+                guardError = `milestone not found: ${params.milestoneId}`;
+                return;
+            }
+            if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
+                guardError = `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})`;
+                return;
+            }
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (parentSlice.status === "complete" || parentSlice.status === "done") {
+                guardError = `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first`;
+                return;
+            }
             upsertSlicePlanning(params.milestoneId, params.sliceId, {
                 goal: params.goal,
                 successCriteria: params.successCriteria,
@@ -163,6 +171,9 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     try {
         const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
         invalidateStateCache();

package/dist/resources/extensions/gsd/tools/plan-task.js

@@ -50,19 +50,26 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-    }
-    const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
-    if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
-        return { error: `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first` };
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (parentSlice.status === "complete" || parentSlice.status === "done") {
+                guardError = `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+                return;
+            }
+            const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
+            if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
+                guardError = `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first`;
+                return;
+            }
             if (!existingTask) {
                 insertTask({
                     id: params.taskId,
@@ -88,6 +95,9 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     try {
         const renderResult = await renderTaskPlanFromDb(basePath, params.milestoneId, params.sliceId, params.taskId);
         invalidateStateCache();

package/dist/resources/extensions/gsd/tools/reassess-roadmap.js

@@ -61,48 +61,55 @@ export async function handleReassessRoadmap(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    // ── Verify milestone exists and is active ────────────────────────
-    const milestone = getMilestone(params.milestoneId);
-    if (!milestone) {
-        return { error: `milestone not found: ${params.milestoneId}` };
-    }
-    if (milestone.status === "complete" || milestone.status === "done") {
-        return { error: `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})` };
-    }
-    // ── Verify completedSliceId is actually complete ──────────────────
-    const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
-    if (!completedSlice) {
-        return { error: `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}` };
-    }
-    if (completedSlice.status !== "complete" && completedSlice.status !== "done") {
-        return { error: `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes` };
-    }
-    // ── Structural enforcement ────────────────────────────────────────
-    const existingSlices = getMilestoneSlices(params.milestoneId);
-    const completedSliceIds = new Set();
-    for (const slice of existingSlices) {
-        if (slice.status === "complete" || slice.status === "done") {
-            completedSliceIds.add(slice.id);
-        }
-    }
-    // Reject modifications to completed slices
-    for (const modifiedSlice of params.sliceChanges.modified) {
-        if (completedSliceIds.has(modifiedSlice.sliceId)) {
-            return { error: `cannot modify completed slice ${modifiedSlice.sliceId}` };
-        }
-    }
-    // Reject removal of completed slices
-    for (const removedId of params.sliceChanges.removed) {
-        if (completedSliceIds.has(removedId)) {
-            return { error: `cannot remove completed slice ${removedId}` };
-        }
-    }
     // ── Compute assessment artifact path ──────────────────────────────
     // Assessment lives in the completed slice's directory
     const assessmentRelPath = join(".gsd", "milestones", params.milestoneId, "slices", params.completedSliceId, `${params.completedSliceId}-ASSESSMENT.md`);
-    // ── Transaction: DB mutations ─────────────────────────────────────
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            // Verify milestone exists and is active
+            const milestone = getMilestone(params.milestoneId);
+            if (!milestone) {
+                guardError = `milestone not found: ${params.milestoneId}`;
+                return;
+            }
+            if (milestone.status === "complete" || milestone.status === "done") {
+                guardError = `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+                return;
+            }
+            // Verify completedSliceId is actually complete
+            const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
+            if (!completedSlice) {
+                guardError = `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}`;
+                return;
+            }
+            if (completedSlice.status !== "complete" && completedSlice.status !== "done") {
+                guardError = `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes`;
+                return;
+            }
+            // Structural enforcement — reject modifications/removal of completed slices
+            const existingSlices = getMilestoneSlices(params.milestoneId);
+            const completedSliceIds = new Set();
+            for (const slice of existingSlices) {
+                if (slice.status === "complete" || slice.status === "done") {
+                    completedSliceIds.add(slice.id);
+                }
+            }
+            for (const modifiedSlice of params.sliceChanges.modified) {
+                if (completedSliceIds.has(modifiedSlice.sliceId)) {
+                    guardError = `cannot modify completed slice ${modifiedSlice.sliceId}`;
+                    return;
+                }
+            }
+            for (const removedId of params.sliceChanges.removed) {
+                if (completedSliceIds.has(removedId)) {
+                    guardError = `cannot remove completed slice ${removedId}`;
+                    return;
+                }
+            }
             // Record assessment
             insertAssessment({
                 path: assessmentRelPath,
@@ -142,6 +149,9 @@ export async function handleReassessRoadmap(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     // ── Render artifacts ──────────────────────────────────────────────
     try {
         const roadmapResult = await renderRoadmapFromDb(basePath, params.milestoneId);