gsd-pi 2.74.0 → 2.75.0-dev.2203010a0

package/src/resources/extensions/gsd/prompts/workflow-oneshot.md

@@ -0,0 +1,26 @@
+# Oneshot Workflow: {{displayName}}
+
+You are running a **oneshot** workflow called `{{name}}`. Oneshot workflows are
+prompt-only — there is no STATE.json, no phase tracking, no artifact directory,
+and no resume mechanism. Just execute the instructions below and return.
+
+## User Arguments
+
+`{{userArgs}}`
+
+(If empty, use sensible defaults from the workflow body.)
+
+## Workflow Instructions
+
+{{body}}
+
+## Execution Rules
+
+1. **No scaffolding.** Do not create `.gsd/workflows/` directories, STATE.json
+   files, or run directories unless the instructions explicitly tell you to
+   write a specific artifact.
+2. **No branch switching.** Work on the current branch.
+3. **Be concise.** Oneshot workflows produce a single focused output (a report,
+   a summary, a code change, a PR comment) — finish in this turn.
+4. **Ask only when blocked.** If the instructions need information you can't
+   discover, ask one clear question. Otherwise proceed.

package/src/resources/extensions/gsd/python-resolver.ts

@@ -0,0 +1,76 @@
+/**
+ * Cross-platform Python interpreter resolver.
+ *
+ * Provides utilities to detect the available Python interpreter on the current
+ * system and to normalize shell commands that reference `python`/`python3` so
+ * that they use whichever interpreter is actually installed.
+ *
+ * On Windows the canonical names differ (`py -3`, `python`, `python3`), so
+ * hard-coded `python3` invocations fail with exit 127. This module detects the
+ * working interpreter once (cached for the process lifetime) and rewrites
+ * commands accordingly.
+ *
+ * @module python-resolver
+ */
+
+import { spawnSync } from "node:child_process";
+
+/** Cached result of `detectPythonExecutable`. `undefined` means not yet probed. */
+let cached: string | null | undefined;
+
+/**
+ * Returns the first working Python invocation on this system, or `null` if no
+ * Python interpreter is found.
+ *
+ * Probe order:
+ * - Windows: `py -3` → `python` → `python3`
+ * - All other platforms: `python3` → `python`
+ *
+ * The result is cached for the lifetime of the process to avoid repeated
+ * `spawnSync` calls.
+ */
+export function detectPythonExecutable(): string | null {
+  if (cached !== undefined) return cached;
+  const candidates: string[] = process.platform === "win32"
+    ? ["py -3", "python", "python3"]
+    : ["python3", "python"];
+  for (const candidate of candidates) {
+    const [bin, ...args] = candidate.split(" ");
+    const r = spawnSync(bin, [...args, "--version"], { stdio: "ignore" });
+    if (!r.error && r.status === 0) {
+      cached = candidate;
+      return candidate;
+    }
+  }
+  cached = null;
+  return null;
+}
+
+/**
+ * Rewrites a shell command string so that leading `python`/`python3`/`py`
+ * tokens at command boundaries are replaced with the interpreter returned by
+ * `detectPythonExecutable`.
+ *
+ * Only tokens at command boundaries (start of string, or after `&&`, `||`,
+ * `;`) are rewritten — mid-string occurrences (e.g. file paths containing
+ * "python") are left intact.
+ *
+ * When no Python interpreter is detected, the command is returned unchanged so
+ * that the caller receives a meaningful "command not found" error rather than a
+ * silent no-op.
+ *
+ * @param command - The shell command string to normalize.
+ * @returns The command with Python interpreter tokens rewritten, or the
+ *   original command if no rewrite is needed.
+ */
+export function normalizePythonCommand(command: string): string {
+  const executable = detectPythonExecutable();
+  if (!executable) return command;
+
+  // Split on common shell separators to handle compound commands.
+  // We reconstruct the string preserving the original separators.
+  return command.replace(
+    /(^\s*|(?:&&|\|\||;)\s*)(?:python3?|py(?:\s+-\d+)?)(?=\s|$)/g,
+    (_match, pre: string) => `${pre}${executable}`,
+  );
+}

package/src/resources/extensions/gsd/run-manager.ts

@@ -16,8 +16,9 @@
 import { mkdirSync, writeFileSync, existsSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { stringify } from "yaml";
-import { loadDefinition, substituteParams } from "./definition-loader.js";
+import { loadDefinition, loadDefinitionFromFile, substituteParams } from "./definition-loader.js";
 import { initializeGraph, writeGraph, readGraph } from "./graph.js";
+import { resolvePlugin } from "./workflow-plugins.js";
 import type { WorkflowDefinition } from "./definition-loader.js";
 import type { WorkflowGraph } from "./graph.js";
 
@@ -67,48 +68,81 @@ function deriveStatus(graph: WorkflowGraph): "pending" | "running" | "complete"
 
 // ─── Public API ──────────────────────────────────────────────────────────
 
+/**
+ * Create a run directory from an explicit definition file path.
+ * Preferred over `createRun` when the caller has already resolved the file
+ * (e.g. via the plugin resolver).
+ */
+export function createRunFromDefinition(
+  basePath: string,
+  defName: string,
+  definitionFile: string,
+  overrides?: Record<string, string>,
+): string {
+  const rawDef = loadDefinitionFromFile(definitionFile);
+  const def: WorkflowDefinition = overrides
+    ? substituteParams(rawDef, overrides)
+    : substituteParams(rawDef);
+
+  const timestamp = makeTimestamp();
+  const runDir = join(basePath, ".gsd", RUNS_DIR, defName, timestamp);
+  mkdirSync(runDir, { recursive: true });
+
+  writeFileSync(join(runDir, "DEFINITION.yaml"), stringify(def), "utf-8");
+
+  const graph = initializeGraph(def);
+  writeGraph(runDir, graph);
+
+  if (overrides && Object.keys(overrides).length > 0) {
+    writeFileSync(
+      join(runDir, "PARAMS.json"),
+      JSON.stringify(overrides, null, 2),
+      "utf-8",
+    );
+  }
+
+  return runDir;
+}
+
 /**
  * Create a new isolated run directory for a workflow definition.
  *
- * 1. Loads the definition from `<basePath>/.gsd/workflow-defs/<defName>.yaml`
- * 2. Applies parameter substitution if overrides are provided
- * 3. Creates `<basePath>/.gsd/workflow-runs/<defName>/<timestamp>/`
- * 4. Writes frozen DEFINITION.yaml, initialized GRAPH.yaml, and optional PARAMS.json
+ * Resolution order:
+ *   1. Plugin resolver (project → global → bundled), YAML format only.
+ *   2. Legacy `.gsd/workflow-defs/<defName>.yaml`.
  *
- * @param basePath — project root directory
- * @param defName — definition filename (without .yaml extension)
- * @param overrides — optional parameter overrides (merged with definition defaults)
- * @returns Full path to the created run directory
- * @throws Error if the definition file doesn't exist or is invalid
+ * Creates `<basePath>/.gsd/workflow-runs/<defName>/<timestamp>/` containing
+ * DEFINITION.yaml (frozen), GRAPH.yaml (initialized), and optional PARAMS.json.
+ *
+ * @throws Error if no matching definition is found anywhere.
  */
 export function createRun(
   basePath: string,
   defName: string,
   overrides?: Record<string, string>,
 ): string {
-  const defsDir = join(basePath, ".gsd", DEFS_DIR);
+  // Try the unified plugin resolver first — honors project/global overrides.
+  const plugin = resolvePlugin(basePath, defName);
+  if (plugin && plugin.format === "yaml") {
+    return createRunFromDefinition(basePath, defName, plugin.path, overrides);
+  }
 
-  // Load and validate the definition
+  // Fall back to legacy `.gsd/workflow-defs/<defName>.yaml`.
+  const defsDir = join(basePath, ".gsd", DEFS_DIR);
   const rawDef = loadDefinition(defsDir, defName);
-
-  // Apply parameter substitution if overrides provided
   const def: WorkflowDefinition = overrides
     ? substituteParams(rawDef, overrides)
-    : substituteParams(rawDef); // still resolve default params if any
+    : substituteParams(rawDef);
 
-  // Create the run directory
   const timestamp = makeTimestamp();
   const runDir = join(basePath, ".gsd", RUNS_DIR, defName, timestamp);
   mkdirSync(runDir, { recursive: true });
 
-  // Freeze the definition as DEFINITION.yaml
   writeFileSync(join(runDir, "DEFINITION.yaml"), stringify(def), "utf-8");
 
-  // Initialize and write GRAPH.yaml
   const graph = initializeGraph(def);
   writeGraph(runDir, graph);
 
-  // Write PARAMS.json if overrides were provided
   if (overrides && Object.keys(overrides).length > 0) {
     writeFileSync(
       join(runDir, "PARAMS.json"),

package/src/resources/extensions/gsd/safety/evidence-collector.ts

@@ -68,11 +68,11 @@ export function getFilePaths(): string[] {
  * Record a tool call at dispatch time (before execution).
  * Exit codes and output are filled in by recordToolResult after execution.
  */
-export function recordToolCall(toolName: string, input: Record<string, unknown>): void {
+export function recordToolCall(toolCallId: string, toolName: string, input: Record<string, unknown>): void {
   if (toolName === "bash" || toolName === "Bash") {
     unitEvidence.push({
       kind: "bash",
-      toolCallId: "",
+      toolCallId,
       command: String(input.command ?? ""),
       exitCode: -1,
       outputSnippet: "",
@@ -81,14 +81,14 @@ export function recordToolCall(toolName: string, input: Record<string, unknown>)
   } else if (toolName === "write" || toolName === "Write") {
     unitEvidence.push({
       kind: "write",
-      toolCallId: "",
+      toolCallId,
       path: String(input.file_path ?? input.path ?? ""),
       timestamp: Date.now(),
     });
   } else if (toolName === "edit" || toolName === "Edit") {
     unitEvidence.push({
       kind: "edit",
-      toolCallId: "",
+      toolCallId,
       path: String(input.file_path ?? input.path ?? ""),
       timestamp: Date.now(),
     });
@@ -96,8 +96,9 @@ export function recordToolCall(toolName: string, input: Record<string, unknown>)
 }
 
 /**
- * Record a tool execution result. Matches the most recent unresolved entry
- * of the same kind and fills in the toolCallId, exit code, and output.
+ * Record a tool execution result. Matches the entry by toolCallId (assigned
+ * at dispatch time) and fills in exit code + output. Prior versions matched
+ * by `kind + empty-string` which corrupted parallel tool calls.
  */
 export function recordToolResult(
   toolCallId: string,
@@ -105,36 +106,19 @@ export function recordToolResult(
   result: unknown,
   isError: boolean,
 ): void {
-  const normalizedName = toolName.toLowerCase();
-
-  if (normalizedName === "bash") {
-    const entry = findLastUnresolved("bash") as BashEvidence | undefined;
-    if (entry) {
-      entry.toolCallId = toolCallId;
-      const text = extractResultText(result);
-      entry.outputSnippet = text.slice(0, 500);
-      const exitMatch = text.match(/Command exited with code (\d+)/);
-      entry.exitCode = exitMatch ? Number(exitMatch[1]) : (isError ? 1 : 0);
-    }
-  } else if (normalizedName === "write" || normalizedName === "edit") {
-    const entry = findLastUnresolved(normalizedName as "write" | "edit");
-    if (entry) {
-      entry.toolCallId = toolCallId;
-    }
+  const entry = unitEvidence.find(e => e.toolCallId === toolCallId);
+  if (!entry) return;
+
+  if (entry.kind === "bash") {
+    const text = extractResultText(result);
+    entry.outputSnippet = text.slice(0, 500);
+    const exitMatch = text.match(/Command exited with code (\d+)/);
+    entry.exitCode = exitMatch ? Number(exitMatch[1]) : (isError ? 1 : 0);
   }
 }
 
 // ─── Internals ──────────────────────────────────────────────────────────────
 
-function findLastUnresolved(kind: string): EvidenceEntry | undefined {
-  for (let i = unitEvidence.length - 1; i >= 0; i--) {
-    if (unitEvidence[i].kind === kind && unitEvidence[i].toolCallId === "") {
-      return unitEvidence[i];
-    }
-  }
-  return undefined;
-}
-
 function extractResultText(result: unknown): string {
   if (typeof result === "string") return result;
   if (result && typeof result === "object") {

package/src/resources/extensions/gsd/session-lock.ts

@@ -52,6 +52,18 @@ export interface SessionLockStatus {
   recovered?: boolean;
 }
 
+interface ProperLockfileApi {
+  lockSync(
+    path: string,
+    options?: {
+      realpath?: boolean;
+      stale?: number;
+      update?: number;
+      onCompromised?: () => void;
+    },
+  ): () => void;
+}
+
 // ─── Module State ───────────────────────────────────────────────────────────
 
 /** Release function from proper-lockfile — calling it releases the OS lock. */
@@ -277,9 +289,9 @@ export function acquireSessionLock(basePath: string): SessionLockResult {
     unitStartedAt: new Date().toISOString(),
   };
 
-  let lockfile: typeof import("proper-lockfile");
+  let lockfile: ProperLockfileApi;
   try {
-    lockfile = _require("proper-lockfile") as typeof import("proper-lockfile");
+    lockfile = _require("proper-lockfile") as ProperLockfileApi;
   } catch {
     // proper-lockfile not available — fall back to PID-based check
     return acquireFallbackLock(basePath, lp, lockData);

package/src/resources/extensions/gsd/setup-catalog.ts

@@ -0,0 +1,105 @@
+// GSD — Setup catalog (single source of truth for onboarding steps + provider sub-views)
+//
+// Re-exports filtered views over PROVIDER_REGISTRY (key-manager.ts) and owns the
+// canonical ONBOARDING_STEPS list. Consumers (CLI wizard, /gsd setup hub,
+// onboarding handler, web alignment) all read from here so adding a step or
+// provider lands in one place. Keep this module thin: no behavior beyond
+// filters + lookup helpers, so it stays cycle-safe even though it depends on
+// key-manager for the provider catalog.
+
+import { PROVIDER_REGISTRY, type ProviderInfo } from "./key-manager.js"
+
+export type OnboardingStepId =
+  | "llm"
+  | "model"
+  | "search"
+  | "remote"
+  | "tool-keys"
+  | "prefs"
+  | "skills"
+  | "doctor"
+  | "project"
+
+export interface OnboardingStepDef {
+  id: OnboardingStepId
+  label: string
+  /** Required steps gate the "complete" flag. Skipped required steps mark the wizard incomplete. */
+  required: boolean
+  /** Short description shown in /gsd setup status hub. */
+  hint: string
+}
+
+/**
+ * Canonical ordered list of onboarding steps.
+ *
+ * To add a new step:
+ *   1. Append here (or insert at the right position).
+ *   2. Bump FLOW_VERSION in onboarding-state.ts so existing users get re-prompted.
+ *   3. Wire its CLI runner in src/onboarding.ts (and handlers/onboarding.ts for --step).
+ */
+export const ONBOARDING_STEPS: readonly OnboardingStepDef[] = [
+  { id: "llm",       label: "LLM provider & auth",      required: true,  hint: "Sign in or paste an API key" },
+  { id: "model",     label: "Default model",            required: false, hint: "Pick a default model for the chosen provider" },
+  { id: "search",    label: "Web search provider",      required: false, hint: "Brave, Tavily, or Anthropic built-in" },
+  { id: "remote",    label: "Remote questions",         required: false, hint: "Discord / Slack / Telegram notifications" },
+  { id: "tool-keys", label: "Tool API keys",            required: false, hint: "Context7, Jina, Groq voice, etc." },
+  { id: "prefs",     label: "Global preferences",       required: false, hint: "Mode, profile, notifications" },
+  { id: "skills",    label: "Skills install",           required: false, hint: "Browse and install skill plugins" },
+  { id: "doctor",    label: "Validate setup",           required: false, hint: "Run provider doctor checks" },
+  { id: "project",   label: "Project init",             required: false, hint: "Bootstrap .gsd/ in this repo" },
+]
+
+const STEP_INDEX = new Map(ONBOARDING_STEPS.map((s, i) => [s.id, i]))
+
+export function getStep(id: string): OnboardingStepDef | undefined {
+  const idx = STEP_INDEX.get(id as OnboardingStepId)
+  return idx === undefined ? undefined : ONBOARDING_STEPS[idx]
+}
+
+export function isValidStepId(id: string): id is OnboardingStepId {
+  return STEP_INDEX.has(id as OnboardingStepId)
+}
+
+/**
+ * Given a possibly-stale resume point, return the nearest next step that is
+ * still defined in the catalog. Falls back to the first step.
+ */
+export function nearestResumeStep(lastResumePoint: string | null, completedSteps: string[]): OnboardingStepId {
+  const completed = new Set(completedSteps)
+  // First incomplete step at or after the lastResumePoint
+  let startIdx = 0
+  if (lastResumePoint && STEP_INDEX.has(lastResumePoint as OnboardingStepId)) {
+    startIdx = STEP_INDEX.get(lastResumePoint as OnboardingStepId) ?? 0
+  }
+  for (let i = startIdx; i < ONBOARDING_STEPS.length; i++) {
+    if (!completed.has(ONBOARDING_STEPS[i].id)) return ONBOARDING_STEPS[i].id
+  }
+  // Everything from the resume point is complete — try from the start
+  for (const step of ONBOARDING_STEPS) {
+    if (!completed.has(step.id)) return step.id
+  }
+  return ONBOARDING_STEPS[0].id
+}
+
+// ─── Provider catalog views ───────────────────────────────────────────────────
+
+export function getLlmProviders(): ProviderInfo[] {
+  return PROVIDER_REGISTRY.filter(p => p.category === "llm")
+}
+
+export function getToolProviders(): ProviderInfo[] {
+  return PROVIDER_REGISTRY.filter(p => p.category === "tool")
+}
+
+export function getSearchProviders(): ProviderInfo[] {
+  return PROVIDER_REGISTRY.filter(p => p.category === "search")
+}
+
+export function getRemoteProviders(): ProviderInfo[] {
+  return PROVIDER_REGISTRY.filter(p => p.category === "remote")
+}
+
+/** Provider IDs that count as "the user has an LLM configured" for shouldRunOnboarding. */
+export function getLlmProviderIds(): string[] {
+  return Array.from(new Set([...getLlmProviders().map(p => p.id), "claude-code"]))
+}

package/src/resources/extensions/gsd/slice-parallel-orchestrator.ts

@@ -32,6 +32,7 @@ import {
 } from "./session-status-io.js";
 import { hasFileConflict } from "./slice-parallel-conflict.js";
 import { getErrorMessage } from "./error-utils.js";
+import { selectConflictFreeBatch } from "./uok/execution-graph.js";
 
 // ─── Types ─────────────────────────────────────────────────────────────────
 
@@ -61,6 +62,7 @@ export interface SliceOrchestratorState {
 export interface StartSliceParallelOpts {
   maxWorkers?: number;
   budgetCeiling?: number;
+  useExecutionGraph?: boolean;
 }
 
 // ─── Module State ──────────────────────────────────────────────────────────
@@ -118,7 +120,12 @@ export async function startSliceParallel(
   const errors: Array<{ sid: string; error: string }> = [];
 
   // Filter out conflicting slices (conservative: check all pairs)
-  const safeSlices = filterConflictingSlices(basePath, milestoneId, eligibleSlices);
+  const safeSlices = filterConflictingSlices(
+    basePath,
+    milestoneId,
+    eligibleSlices,
+    opts.useExecutionGraph === true,
+  );
 
   // Limit to maxWorkers
   const toSpawn = safeSlices.slice(0, maxWorkers);
@@ -245,7 +252,19 @@ function filterConflictingSlices(
   basePath: string,
   milestoneId: string,
   slices: Array<{ id: string }>,
+  useExecutionGraph: boolean,
 ): Array<{ id: string }> {
+  if (useExecutionGraph) {
+    const selectedIds = selectConflictFreeBatch({
+      orderedIds: slices.map((slice) => slice.id),
+      maxParallel: slices.length,
+      hasConflict: (candidate, existing) =>
+        hasFileConflict(basePath, milestoneId, candidate, existing),
+    });
+    const selected = new Set(selectedIds);
+    return slices.filter((slice) => selected.has(slice.id));
+  }
+
   const safe: Array<{ id: string }> = [];
 
   for (const candidate of slices) {

package/src/resources/extensions/gsd/state.ts

@@ -44,6 +44,8 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { debugCount, debugTime } from './debug-logger.js';
 import { logWarning, logError } from './workflow-logger.js';
 import { extractVerdict } from './verdict-parser.js';
+import { loadEffectiveGSDPreferences } from './preferences.js';
+import { detectPendingEscalation } from './escalation.js';
 
 import {
   isDbAvailable,
@@ -60,6 +62,7 @@ import {
   updateSliceStatus,
   updateTaskStatus,
   getPendingGateCountForTurn,
+  autoHealSketchFlags,
   type MilestoneRow,
   type SliceRow,
   type TaskRow,
@@ -345,8 +348,15 @@ function reconcileDiskToDb(basePath: string): MilestoneRow[] {
     const dbSliceIds = new Set(dbSlices.map(s => s.id));
 
     let roadmapContent: string;
-    try { roadmapContent = readFileSync(roadmapPath, "utf-8"); }
-    catch { continue; }
+    try {
+      roadmapContent = readFileSync(roadmapPath, "utf-8");
+    } catch (err) {
+      logWarning("state", "reconcileDiskToDb: roadmap read failed, skipping milestone", {
+        mid,
+        error: (err as Error).message,
+      });
+      continue;
+    }
 
     const parsed = parseRoadmap(roadmapContent);
     for (const s of parsed.slices) {
@@ -842,7 +852,15 @@ export async function deriveStateFromDb(basePath: string): Promise<GSDState> {
     return handleAllSlicesDone(basePath, activeMilestone, registry, requirements, milestoneProgress, sliceProgress);
   }
 
-  const activeSliceContext = resolveSliceDependencies(activeMilestoneSlices);
+  // ADR-011 auto-heal: if a slice has a PLAN on disk but is still flagged is_sketch=1
+  // (e.g. a crash between plan-slice write and the sketch flip), reconcile before
+  // running phase derivation so the flag doesn't misroute state.
+  autoHealSketchFlags(activeMilestone.id, (sid) =>
+    !!resolveSliceFile(basePath, activeMilestone.id, sid, "PLAN"),
+  );
+  // Re-read slices after auto-heal so downstream reads see fresh is_sketch values.
+  const healedSlices = getMilestoneSlices(activeMilestone.id);
+  const activeSliceContext = resolveSliceDependencies(healedSlices);
   if (!activeSliceContext.activeSlice) {
     // If locked slice wasn't found, it returns null but logs warning, we need to return 'blocked'
     if (process.env.GSD_SLICE_LOCK) {
@@ -862,10 +880,24 @@ export async function deriveStateFromDb(basePath: string): Promise<GSDState> {
       progress: { milestones: milestoneProgress, slices: sliceProgress },
     };
   }
-  const { activeSlice } = activeSliceContext;
+  const { activeSlice, activeSliceRow } = activeSliceContext;
 
   const planFile = resolveSliceFile(basePath, activeMilestone.id, activeSlice.id, "PLAN");
   if (!planFile) {
+    // ADR-011: sketch slices with progressive_planning enabled enter the
+    // `refining` phase — a refine-slice unit expands the sketch into a full plan
+    // before execution. When the flag is off, sketches are indistinguishable
+    // from a missing plan and fall through to the normal `planning` phase.
+    const progressive = loadEffectiveGSDPreferences()?.preferences?.phases?.progressive_planning === true;
+    if (progressive && activeSliceRow?.is_sketch === 1) {
+      return {
+        activeMilestone, activeSlice, activeTask: null,
+        phase: 'refining', recentDecisions: [], blockers: [],
+        nextAction: `Refine sketch slice ${activeSlice.id} (${activeSlice.title}) using prior slice context.`,
+        registry, requirements,
+        progress: { milestones: milestoneProgress, slices: sliceProgress },
+      };
+    }
     return {
       activeMilestone, activeSlice, activeTask: null,
       phase: 'planning', recentDecisions: [], blockers: [],
@@ -958,6 +990,29 @@ export async function deriveStateFromDb(basePath: string): Promise<GSDState> {
     }
   }
 
+  // ADR-011 Phase 2: pause-on-escalation takes precedence over dispatching the
+  // next task. `awaiting_review` tasks (continueWithDefault=true) are NOT
+  // surfaced here — they let the loop continue.
+  //
+  // We do NOT gate this on `phases.mid_execution_escalation` — creation of
+  // new escalations is gated at the write site (tools/complete-task.ts:315),
+  // but any escalation_pending row already persisted in the DB must be
+  // honored even if the user later toggles the flag off. Otherwise those
+  // rows would silently orphan, the loop would advance past the paused task,
+  // and the user's prior resolution never lands.
+  const escalatingTaskId = detectPendingEscalation(tasks, basePath);
+  if (escalatingTaskId) {
+    return {
+      activeMilestone, activeSlice, activeTask,
+      phase: 'escalating-task', recentDecisions: [],
+      blockers: [`Task ${escalatingTaskId} requires a user decision before the loop can proceed`],
+      nextAction: `Run /gsd escalate show ${escalatingTaskId} to review, then /gsd escalate resolve ${escalatingTaskId} <choice> to proceed.`,
+      activeWorkspace: undefined,
+      registry, requirements,
+      progress: { milestones: milestoneProgress, slices: sliceProgress, tasks: taskProgress },
+    };
+  }
+
   if (!blockerTaskId) {
     const isTriggered = checkReplanTrigger(basePath, activeMilestone.id, activeSlice.id);
     if (isTriggered) {

package/src/resources/extensions/gsd/templates/PREFERENCES.md

@@ -39,6 +39,24 @@ dynamic_routing:
   budget_pressure:
   cross_provider:
   hooks:
+uok:
+  enabled: true
+  legacy_fallback:
+    enabled: false
+  gates:
+    enabled: true
+  model_policy:
+    enabled: true
+  execution_graph:
+    enabled: true
+  gitops:
+    enabled: true
+    turn_action: commit
+    turn_push: false
+  audit_unified:
+    enabled: true
+  plan_v2:
+    enabled: true
 auto_visualize:
 auto_report:
 parallel:
@@ -71,6 +89,7 @@ remote_questions:
 uat_dispatch:
 post_unit_hooks: []
 pre_dispatch_hooks: []
+# language:
 # experimental:
 #   rtk: false
 ---