gsd-pi 2.74.0 → 2.75.0-dev.fd2382b9f

package/src/resources/extensions/gsd/native-git-bridge.ts

@@ -6,7 +6,7 @@
 // execSync calls because git2 credential handling is too complex.
 
 import { execSync, execFileSync } from "node:child_process";
-import { existsSync, readFileSync, unlinkSync, rmSync } from "node:fs";
+import { existsSync, readFileSync, unlinkSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { GSDError, GSD_GIT_ERROR } from "./errors.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
@@ -323,7 +323,7 @@ export function nativeIsRepo(basePath: string): boolean {
     return native.gitIsRepo(basePath);
   }
   try {
-    execSync("git rev-parse --git-dir", { cwd: basePath, stdio: "pipe" });
+    execFileSync("git", ["rev-parse", "--git-dir"], { cwd: basePath, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -690,6 +690,134 @@ export function nativeAddTracked(basePath: string): void {
   gitFileExec(basePath, ["add", "-u"]);
 }
 
+function isDotGsdIgnored(basePath: string): boolean {
+  for (const path of [".gsd", ".gsd/"]) {
+    try {
+      execFileSync("git", ["check-ignore", "-q", path], {
+        cwd: basePath,
+        stdio: "pipe",
+        env: GIT_NO_PROMPT_ENV,
+      });
+      return true;
+    } catch {
+      // exit 1 means this form is not ignored; try the next variant
+    }
+  }
+  return false;
+}
+
+/**
+ * Determine whether the project opts out of GSD-managed `.gitignore` via
+ * `git.manage_gitignore: false` in `.gsd/PREFERENCES.md`. Uses a minimal
+ * inline parser to avoid importing the full preferences module (which would
+ * introduce a circular dependency back into this low-level bridge).
+ *
+ * Returns true when management is disabled. Any parse failure or missing
+ * file returns false (default: GSD may manage `.gitignore`).
+ */
+function isGitignoreManagementDisabled(basePath: string): boolean {
+  const prefsPath = join(basePath, ".gsd", "PREFERENCES.md");
+  if (!existsSync(prefsPath)) return false;
+  try {
+    const content = readFileSync(prefsPath, "utf-8");
+    // Look for `manage_gitignore: false` under a `git:` block. The preference
+    // is indented; a loose regex is sufficient since we only care about the
+    // explicit opt-out case.
+    return /^\s*manage_gitignore\s*:\s*false\s*$/m.test(content);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Self-heal path for the symlinked-`.gsd` staging failure: append `.gsd` to
+ * `.gitignore` so subsequent `git add -A` calls succeed without the symlink
+ * pathspec error. Honors the `git.manage_gitignore: false` opt-out.
+ *
+ * Returns true when `.gitignore` now contains an entry covering `.gsd`
+ * (either pre-existing or newly appended). Returns false when the opt-out
+ * is set or the write fails.
+ */
+function trySelfHealGsdGitignore(basePath: string): boolean {
+  if (isGitignoreManagementDisabled(basePath)) return false;
+
+  const gitignorePath = join(basePath, ".gitignore");
+  try {
+    const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "";
+    const lines = new Set(
+      existing.split("\n").map(l => l.trim()).filter(l => l && !l.startsWith("#")),
+    );
+    if (lines.has(".gsd") || lines.has(".gsd/")) return true;
+
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    const block = `${prefix}\n# ── GSD self-heal: .gsd is a symlink to external state ──\n.gsd\n`;
+    writeFileSync(gitignorePath, existing + block, "utf-8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Stage untracked files individually while skipping anything under `.gsd`.
+ * Used as a last-resort when `.gsd` is a symlink, not gitignored, and
+ * `git.manage_gitignore: false` forbids the self-heal path. Protects user
+ * work by never silently dropping new real files.
+ */
+function stageUntrackedExcludingDotGsd(basePath: string): void {
+  // Stage tracked modifications first. `git add -u` never fails on pathspec
+  // issues because it doesn't walk untracked trees.
+  gitFileExec(basePath, ["add", "-u"]);
+
+  // Enumerate untracked paths via porcelain output. `?? ` prefix marks
+  // untracked files (status respects `.gitignore`).
+  const status = gitFileExec(basePath, ["status", "--porcelain=v1", "-z"], true);
+  if (!status) return;
+
+  const untracked: string[] = [];
+  for (const entry of status.split("\0")) {
+    if (!entry) continue;
+    // Porcelain format: "XY path" where XY is the 2-char status code.
+    if (entry.length < 4) continue;
+    const code = entry.slice(0, 2);
+    const path = entry.slice(3);
+    if (code !== "??") continue;
+    // Skip GSD runtime artifacts. Under `manage_gitignore: false` the user
+    // may not have these in `.gitignore`, so we filter explicitly to avoid
+    // committing transient state (.gsd external link, migration lock,
+    // background shell scratch dir).
+    if (path === ".gsd" || path.startsWith(".gsd/")) continue;
+    if (path === ".gsd-id" || path === ".gsd.migrating") continue;
+    if (path === ".bg-shell" || path.startsWith(".bg-shell/")) continue;
+    untracked.push(path);
+  }
+
+  if (untracked.length === 0) return;
+  // Stage in chunks to avoid exceeding ARG_MAX on large change sets.
+  const CHUNK = 200;
+  for (let i = 0; i < untracked.length; i += CHUNK) {
+    gitFileExec(basePath, ["add", "--", ...untracked.slice(i, i + CHUNK)]);
+  }
+}
+
+/**
+ * Handle `nativeAddAllWithExclusions` failing with "beyond a symbolic link"
+ * when `.gsd` is a symlink. Self-heals by adding `.gsd` to `.gitignore`, or
+ * falls back to explicit per-file staging so user work is never dropped.
+ */
+function fallbackStageWithSymlinkedDotGsd(basePath: string): void {
+  if (isDotGsdIgnored(basePath)) {
+    gitFileExec(basePath, ["add", "-A"]);
+    return;
+  }
+  if (trySelfHealGsdGitignore(basePath)) {
+    gitFileExec(basePath, ["add", "-A"]);
+    return;
+  }
+  // `manage_gitignore: false` — protect work by staging files explicitly.
+  stageUntrackedExcludingDotGsd(basePath);
+}
+
 /**
  * Stage all files with pathspec exclusions (git add -A -- ':!pattern' ...).
  * Excluded paths are never hashed by git, preventing hangs on large
@@ -724,12 +852,12 @@ export function nativeAddAllWithExclusions(basePath: string, exclusions: readonl
       return;
     }
     // When .gsd is a symlink, git rejects `:!.gsd/...` pathspecs with
-    // "beyond a symbolic link". Fall back to `git add -u` which only
-    // stages changes to already-tracked files — O(tracked) not O(filesystem).
-    // Using `git add -A` here would traverse the entire working tree,
-    // hanging indefinitely on repos with large untracked data dirs. (#1977)
+    // "beyond a symbolic link". Hand off to the self-heal fallback which
+    // either adds `.gsd` to `.gitignore` and retries `git add -A`, or stages
+    // real files explicitly when `git.manage_gitignore: false` forbids the
+    // self-heal path. Either way, user work is protected from silent drops.
     if (stderr.includes("beyond a symbolic link")) {
-      gitFileExec(basePath, ["add", "-u"]);
+      fallbackStageWithSymlinkedDotGsd(basePath);
       return;
     }
     throw new GSDError(GSD_GIT_ERROR, `git add -A with exclusions failed in ${basePath}: ${getErrorMessage(err)}`);
@@ -790,16 +918,15 @@ export function nativeCommit(
 
   // Fallback: use git commit with stdin pipe for safe multi-line messages
   try {
-    const result = execSync(
-      `git commit --no-verify -F -${options?.allowEmpty ? " --allow-empty" : ""}`,
-      {
-        cwd: basePath,
-        stdio: ["pipe", "pipe", "pipe"],
-        encoding: "utf-8",
-        env: GIT_NO_PROMPT_ENV,
-        input: message,
-      },
-    ).trim();
+    const args = ["commit", "--no-verify", "-F", "-"];
+    if (options?.allowEmpty) args.push("--allow-empty");
+    const result = execFileSync("git", args, {
+      cwd: basePath,
+      stdio: ["pipe", "pipe", "pipe"],
+      encoding: "utf-8",
+      env: GIT_NO_PROMPT_ENV,
+      input: message,
+    }).trim();
     return result;
   } catch (err: unknown) {
     const errObj = err as { stdout?: string; stderr?: string; message?: string };
@@ -940,7 +1067,7 @@ export function nativeResetHard(basePath: string): void {
     native.gitResetHard(basePath);
     return;
   }
-  execSync("git reset --hard HEAD", { cwd: basePath, stdio: "pipe" });
+  execFileSync("git", ["reset", "--hard", "HEAD"], { cwd: basePath, stdio: "pipe" });
 }
 
 /**

package/src/resources/extensions/gsd/notification-widget.ts

@@ -1,60 +1,42 @@
-// GSD Extension — Notification Widget
-// Always-on ambient widget rendered belowEditor showing unread count and
-// the most recent notification message. Refreshes every 30 seconds.
-// Widget key: "gsd-notifications", placement: "belowEditor"
+// GSD Extension — Notification Status
+// Always-on ambient notification chip surfaced as an extension status on the
+// footer pwd row. Refreshes on store change + on a 30s timer. Hidden when
+// unread=0. Key sorts late so the chip renders to the right of other
+// extension statuses.
 
 import type { ExtensionContext } from "@gsd/pi-coding-agent";
 
 import { getUnreadCount, onNotificationStoreChange } from "./notification-store.js";
 import { formattedShortcutPair } from "./shortcut-defs.js";
 
-// ─── Pure rendering ──���────────────────────────���─────────────────────────
+// Key chosen to sort after alphabetic extension keys so the chip lands on the
+// far right of the extension-status block.
+const STATUS_KEY = "zz-notifications";
 
-export function buildNotificationWidgetLines(): string[] {
+export function buildNotificationChip(): string {
   const unread = getUnreadCount();
-  if (unread === 0) return [];
-
-  return [`  🔔 Notifications: ${unread} unread  (${formattedShortcutPair("notifications")})`];
+  if (unread === 0) return "";
+  return `🔔 ${unread} unread (${formattedShortcutPair("notifications")})`;
 }
 
-// ─── Widget init ────────────────────────────────────────────────────────
+// Retained for backwards compatibility with tests and the RPC fallback path
+// that still expected a line-array widget. Returns empty when no unread.
+export function buildNotificationWidgetLines(): string[] {
+  const chip = buildNotificationChip();
+  return chip ? [`  ${chip}`] : [];
+}
 
 const REFRESH_INTERVAL_MS = 30_000;
 
-/**
- * Initialize the always-on notification widget (belowEditor).
- * Call once from session_start after the notification store is initialized.
- */
 export function initNotificationWidget(ctx: ExtensionContext): void {
   if (!ctx.hasUI) return;
 
-  // String-array fallback for RPC mode
-  ctx.ui.setWidget("gsd-notifications", buildNotificationWidgetLines(), { placement: "belowEditor" });
-
-  // Factory-based widget for TUI mode
-  ctx.ui.setWidget("gsd-notifications", (_tui, _theme) => {
-    let cachedLines: string[] | undefined;
-
-    const refresh = () => {
-      cachedLines = undefined;
-      _tui.requestRender();
-    };
-
-    const unsubscribe = onNotificationStoreChange(refresh);
-    const refreshTimer = setInterval(refresh, REFRESH_INTERVAL_MS);
-
-    return {
-      render(_width: number): string[] {
-        if (!cachedLines) cachedLines = buildNotificationWidgetLines();
-        return cachedLines;
-      },
-      invalidate(): void {
-        cachedLines = undefined;
-      },
-      dispose(): void {
-        unsubscribe();
-        clearInterval(refreshTimer);
-      },
-    };
-  }, { placement: "belowEditor" });
+  const push = () => {
+    const chip = buildNotificationChip();
+    ctx.ui.setStatus(STATUS_KEY, chip.length > 0 ? chip : undefined);
+  };
+  push();
+
+  onNotificationStoreChange(push);
+  setInterval(push, REFRESH_INTERVAL_MS).unref?.();
 }

package/src/resources/extensions/gsd/notifications.ts

@@ -5,6 +5,7 @@ import { execFileSync } from "node:child_process";
 import type { NotificationPreferences } from "./types.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { CmuxClient, emitOsc777Notification, resolveCmuxConfig } from "../cmux/index.js";
+import { sendRemoteNotification } from "../remote-questions/notify.js";
 
 export type NotifyLevel = "info" | "success" | "warning" | "error";
 export type NotificationKind = "complete" | "error" | "budget" | "milestone" | "attention";
@@ -31,6 +32,11 @@ export function sendDesktopNotification(
     title = formatNotificationTitle(projectName);
   }
   const loaded = loadEffectiveGSDPreferences()?.preferences;
+
+  // Remote notifications fire independently of desktop preferences.
+  // sendRemoteNotification handles "not configured" gracefully (early return).
+  void sendRemoteNotification(title, message).catch(() => {});
+
   if (!shouldSendDesktopNotification(kind, loaded?.notifications)) return;
 
   const cmux = resolveCmuxConfig(loaded);

package/src/resources/extensions/gsd/parallel-orchestrator.ts

@@ -42,6 +42,8 @@ import {
 } from "./parallel-eligibility.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning } from "./workflow-logger.js";
+import { resolveUokFlags } from "./uok/flags.js";
+import { selectConflictFreeBatch } from "./uok/execution-graph.js";
 
 // ─── Types ─────────────────────────────────────────────────────────────────
 
@@ -69,6 +71,10 @@ export interface OrchestratorState {
 
 let state: OrchestratorState | null = null;
 
+function overlapKey(a: string, b: string): string {
+  return a < b ? `${a}::${b}` : `${b}::${a}`;
+}
+
 // ─── Persistence ──────────────────────────────────────────────────────────
 
 const ORCHESTRATOR_STATE_FILE = "orchestrator.json";
@@ -365,6 +371,7 @@ export async function startParallel(
   }
 
   const config = resolveParallelConfig(prefs);
+  const uokFlags = resolveUokFlags(prefs);
 
   // Release any leftover state from a previous session before reassigning
   if (state) {
@@ -418,8 +425,40 @@ export async function startParallel(
   const started: string[] = [];
   const errors: Array<{ mid: string; error: string }> = [];
 
+  let filteredMilestoneIds = milestoneIds;
+  if (uokFlags.executionGraph && milestoneIds.length > 1) {
+    try {
+      const requestedIds = new Set(milestoneIds);
+      const candidates = await analyzeParallelEligibility(basePath);
+      const overlapPairs = new Set<string>();
+      for (const overlap of candidates.fileOverlaps) {
+        if (!requestedIds.has(overlap.mid1) || !requestedIds.has(overlap.mid2)) continue;
+        overlapPairs.add(overlapKey(overlap.mid1, overlap.mid2));
+      }
+      filteredMilestoneIds = selectConflictFreeBatch({
+        orderedIds: milestoneIds,
+        maxParallel: milestoneIds.length,
+        hasConflict: (candidate, existing) =>
+          overlapPairs.has(overlapKey(candidate, existing)),
+      });
+      if (filteredMilestoneIds.length < milestoneIds.length) {
+        const skipped = milestoneIds.filter((mid) => !filteredMilestoneIds.includes(mid));
+        logWarning(
+          "parallel",
+          `uok execution graph filtered ${skipped.length} conflicting milestone(s): ${skipped.join(", ")}`,
+        );
+      }
+    } catch (e) {
+      logWarning(
+        "parallel",
+        `uok execution graph overlap analysis failed; using legacy milestone selection: ${(e as Error).message}`,
+      );
+      filteredMilestoneIds = milestoneIds;
+    }
+  }
+
   // Cap to max_workers
-  const toStart = milestoneIds.slice(0, config.max_workers);
+  const toStart = filteredMilestoneIds.slice(0, config.max_workers);
 
   for (const mid of toStart) {
     // Check budget ceiling before each spawn

package/src/resources/extensions/gsd/post-execution-checks.ts

@@ -118,8 +118,12 @@ export function extractRelativeImports(
 
 /**
  * Check if a relative import resolves to an existing file.
- * Handles .ts, .tsx, .js, .jsx extensions and index files.
- * Also handles TypeScript ESM convention where imports use .js but resolve to .ts.
+ * Resolution order:
+ *   1. Imports carrying an explicit extension are checked as-is (handles assets
+ *      like .css/.scss/images/fonts and .json, not just code extensions).
+ *   2. TypeScript ESM convention where .js imports resolve to .ts files.
+ *   3. Extensionless imports resolved against .ts/.tsx/.js/.jsx/.mjs/.cjs.
+ *   4. Directory imports resolved against index.{ts,tsx,js,jsx,mjs,cjs}.
  */
 export function resolveImportPath(
   importPath: string,
@@ -129,6 +133,27 @@ export function resolveImportPath(
   const sourceDir = dirname(resolve(basePath, sourceFile));
   const extensions = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 
+  // If the import already has an explicit extension, check it as-is first.
+  // This correctly resolves asset imports like .css, .scss, images, fonts
+  // without requiring each extension to be enumerated (issue #4411). We only
+  // do this when the import carries an extension so that extensionless module
+  // imports still flow through the TS ESM convention and index-file resolvers.
+  const explicitExt = extname(importPath);
+  if (explicitExt !== "") {
+    const directPath = resolve(sourceDir, importPath);
+    if (existsSync(directPath)) {
+      return { exists: true, resolvedPath: directPath };
+    }
+    // Only .js/.jsx/.mjs/.cjs imports legitimately fall through for the TS
+    // ESM convention (.js → .ts). Any other explicit extension (.css, .json,
+    // .svg, images, fonts, .ts, .tsx, …) must stay unresolved when the direct
+    // path is missing — otherwise a stray `./missing.css.ts` could shadow a
+    // genuinely missing `./missing.css` import.
+    if (![".js", ".jsx", ".mjs", ".cjs"].includes(explicitExt)) {
+      return { exists: false, resolvedPath: null };
+    }
+  }
+
   // Handle TypeScript ESM convention: .js imports resolve to .ts files
   // e.g., import './types.js' -> ./types.ts
   let normalizedPath = importPath;
@@ -142,7 +167,7 @@ export function resolveImportPath(
     normalizedPath = importPath.slice(0, -4);
   }
 
-  // Try the normalized path with common extensions first
+  // Try the normalized path with common extensions
   for (const ext of extensions) {
     const fullPath = resolve(sourceDir, normalizedPath + ext);
     if (existsSync(fullPath)) {
@@ -158,17 +183,6 @@ export function resolveImportPath(
     }
   }
 
-  // Check if path already has extension (for .json, etc.)
-  const hasExt = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".json"].some(
-    (ext) => importPath.endsWith(ext)
-  );
-  if (hasExt) {
-    const fullPath = resolve(sourceDir, importPath);
-    if (existsSync(fullPath)) {
-      return { exists: true, resolvedPath: fullPath };
-    }
-  }
-
   return { exists: false, resolvedPath: null };
 }
 
@@ -227,11 +241,20 @@ export function checkImportResolution(
 
 // ─── Cross-Task Signature Check ──────────────────────────────────────────────
 
+/**
+ * Normalized function signature extracted from a source file.
+ * Used to compare definitions across tasks and detect signature drift.
+ */
 interface FunctionSignature {
+  /** Function or exported const name. */
   name: string;
+  /** Parameter list with defaults and comments stripped. */
   params: string;
+  /** Declared return type, or "void" when none is annotated. */
   returnType: string;
+  /** Source file the signature was extracted from. */
   file: string;
+  /** 1-based line number of the declaration. */
   lineNum: number;
 }
 

package/src/resources/extensions/gsd/pre-execution-checks.ts

@@ -16,6 +16,7 @@
 
 import { existsSync } from "node:fs";
 import { spawn } from "node:child_process";
+import { homedir } from "node:os";
 import { resolve } from "node:path";
 import type { TaskRow } from "./gsd-db.ts";
 import type { PreExecutionCheckJSON } from "./verification-evidence.ts";
@@ -245,23 +246,74 @@ export function normalizeFilePath(filePath: string): string {
 
   // Normalize path separators to forward slashes
   normalized = normalized.replace(/\\/g, "/");
-  
+
+  // Expand a leading ~ or ~/ so downstream resolve()/set lookups hit the real
+  // home directory instead of treating the tilde as a literal path segment.
+  if (normalized === "~") {
+    normalized = homedir();
+  } else if (normalized.startsWith("~/")) {
+    normalized = resolve(homedir(), normalized.slice(2));
+  }
+  // homedir()/resolve() can emit platform separators (e.g. "\" on Windows).
+  normalized = normalized.replace(/\\/g, "/");
+
   // Remove leading ./
   while (normalized.startsWith("./")) {
     normalized = normalized.slice(2);
   }
-  
+
   // Remove duplicate slashes
   normalized = normalized.replace(/\/+/g, "/");
-  
+
   // Remove trailing slash unless it's the root
   if (normalized.length > 1 && normalized.endsWith("/")) {
     normalized = normalized.slice(0, -1);
   }
-  
+
   return normalized;
 }
 
+/**
+ * Planning units sometimes pass a directory reference as task.inputs
+ * (e.g. `artifacts/M009-S03/`). The trailing slash is meaningful — the task
+ * reads whatever lands inside — but normalizeFilePath strips it, so call this
+ * helper against the raw input before normalization.
+ */
+function isDirectoryReference(raw: string): boolean {
+  const candidate = extractPathFromAnnotation(raw.trim());
+  if (!candidate) return false;
+  if (containsGlobPattern(candidate)) return false;
+  return candidate.endsWith("/");
+}
+
+/**
+ * True when any of `knownOutputs` lives under `normalizedDir` (i.e. the task
+ * directory input is the parent of something a prior/same task produces).
+ */
+function anyOutputUnderDirectory(
+  normalizedDir: string,
+  knownOutputs: Iterable<string>,
+): boolean {
+  const prefix = normalizedDir + "/";
+  for (const output of knownOutputs) {
+    if (output === normalizedDir) return true;
+    if (output.startsWith(prefix)) return true;
+  }
+  return false;
+}
+
+const URL_SCHEME_PATTERN = /^(https?|ftp|file|ssh|git):\/\//i;
+const SCP_PATTERN = /^[\w.-]+@[\w.-]+:[^/]/;
+
+function looksLikePathOrUrl(token: string): boolean {
+  if (URL_SCHEME_PATTERN.test(token)) return true;
+  if (SCP_PATTERN.test(token)) return true;
+  if (/^[./~]/.test(token)) return true;
+  if (/[\\/]/.test(token)) return true;
+  if (/\.[A-Za-z0-9]{1,8}$/.test(token)) return true;
+  return false;
+}
+
 function extractPathFromAnnotation(raw: string): string {
   const trimmed = raw.trim();
   if (!trimmed) return trimmed;
@@ -276,6 +328,20 @@ function extractPathFromAnnotation(raw: string): string {
     return annotatedMatch[1].trim();
   }
 
+  // Fallback: scan all backticked tokens and return the first one that looks
+  // like a path or URL. Handles prose-annotated bullets such as:
+  //   `path/` directory listing (...)
+  //   Prefix prose `https://...` suffix prose
+  //   Citing `.gsd/REQUIREMENTS.md` mid-sentence
+  // Skips non-path backticked tokens like `note` or `npm test`.
+  const backtickTokens = trimmed.matchAll(/`([^`]+)`/g);
+  for (const match of backtickTokens) {
+    const token = match[1].trim();
+    if (looksLikePathOrUrl(token)) {
+      return token;
+    }
+  }
+
   // Fall back to the original behavior for already-plain paths.
   return trimmed.replace(/`/g, "");
 }
@@ -291,13 +357,17 @@ function shouldValidateInputAsPath(raw: string): boolean {
   const trimmed = raw.trim();
   if (!trimmed) return false;
 
+  const candidate = extractPathFromAnnotation(trimmed);
+  if (!candidate) return false;
+
+  // URLs and remote repo refs are not filesystem paths.
+  if (URL_SCHEME_PATTERN.test(candidate)) return false;
+  if (SCP_PATTERN.test(candidate)) return false;
+
   if (/^`+[^`]+`+/.test(trimmed)) {
     return true;
   }
 
-  const candidate = extractPathFromAnnotation(trimmed);
-  if (!candidate) return false;
-
   if (!/\s/.test(candidate)) {
     return true;
   }
@@ -312,6 +382,10 @@ function shouldValidateInputAsPath(raw: string): boolean {
   );
 }
 
+function containsGlobPattern(candidate: string): boolean {
+  return ["*", "?", "[", "]", "{", "}"].some((char) => candidate.includes(char));
+}
+
 /**
  * Build a set of files that will be created by tasks up to (but not including) taskIndex.
  * All paths are normalized for consistent comparison.
@@ -354,6 +428,7 @@ export function checkFilePathConsistency(
 
       // Normalize path for consistent comparison
       const normalizedFile = normalizeFilePath(file);
+      if (containsGlobPattern(normalizedFile)) continue;
 
       // Check if file exists on disk
       const absolutePath = resolve(basePath, normalizedFile);
@@ -362,7 +437,17 @@ export function checkFilePathConsistency(
       // Check if file is in prior expected outputs (priorOutputs already normalized)
       const inPriorOutputs = priorOutputs.has(normalizedFile);
 
-      if (!existsOnDisk && !inPriorOutputs) {
+      // Directory inputs are satisfied when something produces a file beneath
+      // them — either a prior task or the current task itself.
+      let directorySatisfied = false;
+      if (!existsOnDisk && !inPriorOutputs && isDirectoryReference(file)) {
+        const sameTaskOutputs = task.expected_output.map(normalizeFilePath);
+        directorySatisfied =
+          anyOutputUnderDirectory(normalizedFile, priorOutputs) ||
+          anyOutputUnderDirectory(normalizedFile, sameTaskOutputs);
+      }
+
+      if (!existsOnDisk && !inPriorOutputs && !directorySatisfied) {
         results.push({
           category: "file",
           target: file,
@@ -414,6 +499,11 @@ export function checkTaskOrdering(
       if (!shouldValidateInputAsPath(file)) continue;
 
       const normalizedFile = normalizeFilePath(file);
+      if (containsGlobPattern(normalizedFile)) continue;
+      // A directory reference like `artifacts/M009-S03/` is never a concrete
+      // read-before-create dependency: the fileCreators map is keyed by leaf
+      // files, and a same-task output under the directory satisfies it.
+      if (isDirectoryReference(file)) continue;
       const creator = fileCreators.get(normalizedFile);
       const absolutePath = resolve(basePath, normalizedFile);
       const existsOnDisk = existsSync(absolutePath);