gsd-pi 2.76.0-dev.82e249f7b → 2.76.0-dev.97f5583d9

package/dist/claude-cli-check.js

@@ -12,12 +12,41 @@ import { execFileSync } from 'node:child_process';
  * `src/resources/extensions/gsd/pre-execution-checks.ts`.
  */
 export const CLAUDE_COMMAND = process.platform === 'win32' ? 'claude.cmd' : 'claude';
+/**
+ * Ordered list of binary names to probe for the Claude Code CLI.
+ *
+ * Windows installs vary: npm-global installs produce a `claude.cmd` shim,
+ * direct binary installs produce `claude.exe`, and Git Bash wrappers may
+ * expose a bare `claude` shim. Try all three so no valid install is missed.
+ */
+const CLAUDE_COMMAND_CANDIDATES = process.platform === 'win32' ? [CLAUDE_COMMAND, 'claude.exe', 'claude'] : [CLAUDE_COMMAND];
+/**
+ * Try to run `args` against each candidate binary.
+ * Returns the output buffer on first success, throws the last error if all fail.
+ */
+function execClaudeCheck(args) {
+    let lastError;
+    for (const command of CLAUDE_COMMAND_CANDIDATES) {
+        try {
+            return execFileSync(command, args, { timeout: 5_000, stdio: 'pipe' });
+        }
+        catch (error) {
+            lastError = error;
+            const code = error?.code;
+            // EINVAL can surface on Windows Git Bash for .cmd spawn failures.
+            if (code === 'ENOENT' || code === 'EINVAL')
+                continue;
+            throw error;
+        }
+    }
+    throw lastError ?? new Error(`Claude CLI not found (tried: ${CLAUDE_COMMAND_CANDIDATES.join(', ')})`);
+}
 /**
  * Check if the `claude` binary is installed (regardless of auth state).
  */
 export function isClaudeBinaryInstalled() {
     try {
-        execFileSync(CLAUDE_COMMAND, ['--version'], { timeout: 5_000, stdio: 'pipe' });
+        execClaudeCheck(['--version']);
         return true;
     }
     catch {
@@ -29,13 +58,13 @@ export function isClaudeBinaryInstalled() {
  */
 export function isClaudeCliReady() {
     try {
-        execFileSync(CLAUDE_COMMAND, ['--version'], { timeout: 5_000, stdio: 'pipe' });
+        execClaudeCheck(['--version']);
     }
     catch {
         return false;
     }
     try {
-        const output = execFileSync(CLAUDE_COMMAND, ['auth', 'status'], { timeout: 5_000, stdio: 'pipe' })
+        const output = execClaudeCheck(['auth', 'status'])
             .toString()
             .toLowerCase();
         return !(/not logged in|no credentials|unauthenticated|not authenticated/i.test(output));

package/dist/mcp-server.d.ts

@@ -1,6 +1,11 @@
 /**
  * Minimal tool interface matching GSD's AgentTool shape.
  * Avoids a direct dependency on @gsd/pi-agent-core from this compiled module.
+ *
+ * `details` and `isError` are optional fields that runtime tool implementations
+ * may populate. The MCP transport drops non-standard fields, so the wrapper at
+ * the call site mirrors `details` into `structuredContent` and forwards
+ * `isError` directly. See #4472.
  */
 export interface McpToolDef {
     name: string;
@@ -13,6 +18,8 @@ export interface McpToolDef {
             data?: string;
             mimeType?: string;
         }>;
+        details?: Record<string, unknown>;
+        isError?: boolean;
     }>;
 }
 /**

package/dist/mcp-server.js

@@ -1,3 +1,21 @@
+/**
+ * Strict plain-object guard. True only for object literals and
+ * `Object.create(null)` — not for `Date`, `URL`, `Map`, `Set`, class instances,
+ * or arrays. Used to gate `structuredContent` forwarding so the MCP transport
+ * receives only true JSON objects (the protocol contract). See #4477 review.
+ *
+ * Mirrored in `packages/mcp-server/src/workflow-tools.ts` for the
+ * `adaptExecutorResult` adapter on the workflow path. Keep both copies in
+ * sync if the contract definition needs to evolve.
+ */
+function isPlainObject(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    if (Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === null || proto === Object.prototype;
+}
 // MCP SDK subpath imports use wildcard exports (./*) in @modelcontextprotocol/sdk's
 // package.json export map. The wildcard maps "./foo" → "./dist/cjs/foo" (no .js
 // suffix), so bare subpath specifiers like `${MCP_PKG}/server/stdio` resolve to
@@ -83,7 +101,23 @@ export async function startMcpServer(options) {
                 // by stringifying into a text block so clients see the payload.
                 return { type: 'text', text: JSON.stringify(block) };
             });
-            return { content };
+            // Forward a tool's runtime `details` field to MCP's `structuredContent`
+            // channel. The protocol drops non-standard fields on the wire, so tools
+            // that populate `details` for client-side renderers (e.g. save_gate_result)
+            // would otherwise arrive empty on the other side. See #4472.
+            //
+            // Use a strict plain-object guard (prototype-chain check) rather than just
+            // `typeof === 'object' && !Array.isArray()` — Date, URL, Map, Set, and
+            // class instances would otherwise pass through and end up as
+            // `structuredContent`, violating the protocol's JSON-object contract.
+            // The mirror discipline applies in `workflow-tools.ts adaptExecutorResult`.
+            const base = { content };
+            if (isPlainObject(result.details)) {
+                base.structuredContent = result.details;
+            }
+            if (result.isError === true)
+                base.isError = true;
+            return base;
         }
         catch (err) {
             // AbortError from a cancelled tool surfaces as a normal error — MCP

package/dist/resource-loader.d.ts

@@ -21,6 +21,6 @@ export declare function getNewerManagedResourceVersion(agentDir: string, current
  *
  * Inspectable: `ls ~/.gsd/agent/extensions/`
  */
-export declare function initResources(agentDir: string): void;
+export declare function initResources(agentDir: string, skillsDir?: string): void;
 export declare function hasStaleCompiledExtensionSiblings(extensionsDir: string, sourceDir?: string): boolean;
 export declare function buildResourceLoader(agentDir: string): DefaultResourceLoader;

package/dist/resource-loader.js

@@ -506,7 +506,7 @@ function pruneRemovedBundledExtensions(manifest, agentDir) {
  *
  * Inspectable: `ls ~/.gsd/agent/extensions/`
  */
-export function initResources(agentDir) {
+export function initResources(agentDir, skillsDir = join(homedir(), '.agents', 'skills')) {
     mkdirSync(agentDir, { recursive: true });
     const currentVersion = getBundledGsdVersion();
     const manifest = readManagedResourceManifest(agentDir);
@@ -538,13 +538,7 @@ export function initResources(agentDir) {
     // Sync bundled resources — overwrite so updates land on next launch.
     syncResourceDir(bundledExtensionsDir, join(agentDir, 'extensions'));
     syncResourceDir(join(resourcesDir, 'agents'), join(agentDir, 'agents'));
-    // Skills are no longer force-synced here. Users install skills via the
-    // skills.sh CLI (`npx skills add <repo>`) into ~/.agents/skills/ which
-    // is the industry-standard Agent Skills ecosystem directory.
-    //
-    // Migration from the legacy ~/.gsd/agent/skills/ directory is handled
-    // above the manifest check so it runs on every launch (including retries
-    // after partial copy failures).
+    syncResourceDir(join(resourcesDir, 'skills'), skillsDir);
     // Sync GSD-WORKFLOW.md to agentDir as a fallback for when GSD_WORKFLOW_PATH
     // env var is not set (e.g. fork/dev builds, alternative entry points).
     const workflowSrc = join(resourcesDir, 'GSD-WORKFLOW.md');

package/dist/resources/extensions/claude-code-cli/readiness.js

@@ -18,10 +18,11 @@ import { execFileSync } from "node:child_process";
 const CLAUDE_COMMAND = process.platform === "win32" ? "claude.cmd" : "claude";
 /**
  * Windows installs vary: some environments expose `claude.cmd` (npm shim),
- * others expose a `claude` shim on PATH (for example Git Bash wrappers).
- * Try both to avoid false "not installed" results in readiness checks.
+ * `claude.exe` (direct binary install), or a bare `claude` shim on PATH
+ * (for example Git Bash wrappers). Try all three to avoid false "not
+ * installed" results in readiness checks.
  */
-const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude"] : [CLAUDE_COMMAND];
+const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude.exe", "claude"] : [CLAUDE_COMMAND];
 function execClaude(args) {
     let lastError;
     for (const command of CLAUDE_COMMAND_CANDIDATES) {

package/dist/resources/extensions/claude-code-cli/stream-adapter.js

@@ -484,25 +484,23 @@ export function makeAbortedMessage(model, lastTextContent) {
 /**
  * Resolve the Claude Code permission mode for the current run.
  *
- * GSD subagents run underneath a host Claude Code session the user has
- * already consented to, and their work (edits, shell inspection, MCP calls)
- * spans the full workflow toolset. Defaulting the inner SDK to
- * `bypassPermissions` avoids per-tool approval prompts that offer no
- * meaningful safety beyond what the host session and the subagent prompts
- * already enforce. `GSD_CLAUDE_CODE_PERMISSION_MODE` lets security-conscious
- * users opt into a stricter mode (`acceptEdits`, `default`, `plan`).
+ * Defaults to `acceptEdits`, which auto-approves file reads/edits but
+ * surfaces a permission dialog for dangerous operations (e.g. general Bash,
+ * Agent, WebFetch). This prevents tools outside the allowlist from being
+ * silently denied — the SDK emits an `extension_ui_request` event so the
+ * user sees a prompt instead of a silent refusal that Claude Code mistakes
+ * for user rejection (#4383).
  *
- * Tradeoff: bypass means a prompt-injection payload read from an untrusted
- * file could trigger tool calls without a second gate. Accepted for GSD
- * because the workflow is explicit user intent and the alternative
- * (#4099) is continuous approval fatigue that blocks real work.
+ * Set `GSD_CLAUDE_CODE_PERMISSION_MODE` to `bypassPermissions` to restore
+ * the old always-approve behaviour, or to `default` / `plan` for stricter
+ * modes.
  */
 export async function resolveClaudePermissionMode(env = process.env) {
     const override = env.GSD_CLAUDE_CODE_PERMISSION_MODE?.trim();
     if (override === "bypassPermissions" || override === "acceptEdits" || override === "default" || override === "plan") {
         return override;
     }
-    return "bypassPermissions";
+    return "acceptEdits";
 }
 // NOTE: These helpers intentionally mirror @gsd/pi-ai anthropic-shared
 // behavior so this extension remains typecheck-stable even when the published
@@ -554,7 +552,7 @@ function mapThinkingLevelToAnthropicEffort(level, modelId) {
 export function buildSdkOptions(modelId, prompt, overrides, extraOptions = {}) {
     const { reasoning, ...sdkExtraOptions } = extraOptions;
     const mcpServers = buildWorkflowMcpServers();
-    const permissionMode = overrides?.permissionMode ?? "bypassPermissions";
+    const permissionMode = overrides?.permissionMode ?? "acceptEdits";
     const disallowedTools = ["AskUserQuestion"];
     // Pre-authorize the safe built-ins and every registered workflow MCP
     // server's tools. `acceptEdits` mode (the interactive default) only
@@ -637,6 +635,68 @@ function normalizeToolResultContent(content) {
     }
     return blocks.length > 0 ? blocks : [{ type: "text", text: "" }];
 }
+/**
+ * Extract a `details` payload from an MCP tool-result block.
+ *
+ * MCP's `CallToolResult` carries structured data in `structuredContent` — the
+ * protocol's supported channel for non-text payloads. Claude Code's synthetic
+ * user message may surface that field in one of two shapes depending on SDK
+ * version: as a sibling on the `mcp_tool_result` block itself, or as a
+ * dedicated content sub-block with `type: "structuredContent"`. Snake-case
+ * (`structured_content`) is accepted defensively in case a transport hop
+ * rewrites casing. All other shapes fall back to an empty object so callers
+ * can rely on `details` being present.
+ */
+function extractStructuredDetailsFromBlock(block) {
+    const sibling = block.structuredContent ?? block.structured_content;
+    if (sibling && typeof sibling === "object" && !Array.isArray(sibling)) {
+        return sibling;
+    }
+    if (Array.isArray(block.content)) {
+        for (const item of block.content) {
+            if (!item || typeof item !== "object")
+                continue;
+            const sub = item;
+            if (sub.type !== "structuredContent" && sub.type !== "structured_content")
+                continue;
+            const payload = sub.structuredContent ?? sub.structured_content ?? sub.data ?? sub.value;
+            if (payload && typeof payload === "object" && !Array.isArray(payload)) {
+                return payload;
+            }
+        }
+    }
+    // Return undefined (not {}) when no structured payload is present, matching
+    // the pre-#4477 contract where `details` was nullable. An empty-object
+    // sentinel is truthy and breaks downstream consumers that gate on
+    // `if (details)`. `undefined` matches the type of the field these results
+    // flow into (`Record<string, unknown> | undefined`).
+    return undefined;
+}
+/**
+ * True for items that are MCP `structuredContent` pseudo-blocks living inside
+ * a tool-result `content[]` array. These blocks carry the structured payload
+ * (extracted separately by `extractStructuredDetailsFromBlock`) and must NOT
+ * leak into the visible content rendered to the user — otherwise the renderer
+ * stringifies the JSON pseudo-block and shows it next to the actual tool
+ * output. See PR #4477 review (CodeRabbit, post-fix-round).
+ */
+function isStructuredContentPseudoBlock(item) {
+    if (!item || typeof item !== "object")
+        return false;
+    const type = item.type;
+    return type === "structuredContent" || type === "structured_content";
+}
+/**
+ * Strip `structuredContent` pseudo-blocks from a tool-result content array
+ * before normalization. The structured payload is extracted via the sibling
+ * `structuredContent` field (or a dedicated extractor pass on the raw block);
+ * the visible content path must not include the pseudo-block itself.
+ */
+function stripStructuredContentPseudoBlocks(content) {
+    if (!Array.isArray(content))
+        return content;
+    return content.filter((item) => !isStructuredContentPseudoBlock(item));
+}
 /** Extract tool result payloads from an SDK synthetic user message, keyed by tool-use ID. */
 export function extractToolResultsFromSdkUserMessage(message) {
     const extracted = [];
@@ -657,8 +717,8 @@ export function extractToolResultsFromSdkUserMessage(message) {
         extracted.push({
             toolUseId,
             result: {
-                content: normalizeToolResultContent(block.content),
-                details: {},
+                content: normalizeToolResultContent(stripStructuredContentPseudoBlocks(block.content)),
+                details: extractStructuredDetailsFromBlock(block),
                 isError: block.is_error === true,
             },
         });
@@ -672,8 +732,8 @@ export function extractToolResultsFromSdkUserMessage(message) {
                 extracted.push({
                     toolUseId,
                     result: {
-                        content: normalizeToolResultContent(toolResult.content),
-                        details: {},
+                        content: normalizeToolResultContent(stripStructuredContentPseudoBlocks(toolResult.content)),
+                        details: extractStructuredDetailsFromBlock(toolResult),
                         isError: toolResult.is_error === true,
                     },
                 });

package/dist/resources/extensions/gsd/auto/phases.js

@@ -30,7 +30,8 @@ import { isDbAvailable, getMilestoneSlices } from "../gsd-db.js";
 import { ensurePlanV2Graph } from "../uok/plan-v2.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { UokGateRunner } from "../uok/gate-runner.js";
-import { resetEvidence } from "../safety/evidence-collector.js";
+import { resetEvidence, loadEvidenceFromDisk } from "../safety/evidence-collector.js";
+import { parseUnitId } from "../unit-id.js";
 import { createCheckpoint, cleanupCheckpoint, rollbackToCheckpoint } from "../safety/git-checkpoint.js";
 import { resolveSafetyHarnessConfig } from "../safety/safety-harness.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, supportsStructuredQuestions, } from "../workflow-mcp.js";
@@ -389,6 +390,8 @@ export async function runPreDispatch(ic, loopState) {
         loopState.recentUnits.length = 0;
         loopState.stuckRecoveryAttempts = 0;
         // Worktree lifecycle on milestone transition — merge current, enter next
+        // #2909: preflight — warn + stash dirty working tree before merge
+        const preflightTransition = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
         try {
             deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
         }
@@ -405,6 +408,10 @@ export async function runPreDispatch(ic, loopState) {
             await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
             return { action: "break", reason: "merge-failed" };
         }
+        // #2909: postflight — restore stashed changes after successful merge
+        if (preflightTransition.stashPushed) {
+            deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+        }
         // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         deps.invalidateAllCaches();
         state = await deps.deriveState(s.basePath);
@@ -459,6 +466,8 @@ export async function runPreDispatch(ic, loopState) {
         if (incomplete.length === 0 && state.registry.length > 0) {
             // All milestones complete — merge milestone branch before stopping
             if (s.currentMilestoneId) {
+                // #2909: preflight — warn + stash dirty working tree before merge
+                const preflightAllComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
                 try {
                     deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
                     // Prevent stopAuto from attempting the same merge (#2645)
@@ -475,6 +484,10 @@ export async function runPreDispatch(ic, loopState) {
                     await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
                     return { action: "break", reason: "merge-failed" };
                 }
+                // #2909: postflight — restore stashed changes after successful merge
+                if (preflightAllComplete.stashPushed) {
+                    deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+                }
                 // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
             }
             deps.sendDesktopNotification("GSD", "All milestones complete!", "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -539,6 +552,8 @@ export async function runPreDispatch(ic, loopState) {
     if (state.phase === "complete") {
         // Milestone merge on complete (before closeout so branch state is clean)
         if (s.currentMilestoneId) {
+            // #2909: preflight — warn + stash dirty working tree before merge
+            const preflightComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
             try {
                 deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
                 // Prevent stopAuto from attempting the same merge (#2645)
@@ -555,6 +570,10 @@ export async function runPreDispatch(ic, loopState) {
                 await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
                 return { action: "break", reason: "merge-failed" };
             }
+            // #2909: postflight — restore stashed changes after successful merge
+            if (preflightComplete.stashPushed) {
+                deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+            }
             // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         }
         deps.sendDesktopNotification("GSD", `Milestone ${mid} complete!`, "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -1028,6 +1047,14 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
     const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
     if (safetyConfig.enabled && safetyConfig.evidence_collection) {
         resetEvidence();
+        // Restore persisted evidence so session-restart resumes don't produce
+        // false-positive "no bash calls" warnings (Bug #4385).
+        if (s.basePath && unitType === "execute-task") {
+            const { milestone: eMid, slice: eSid, task: eTid } = parseUnitId(unitId);
+            if (eMid && eSid && eTid) {
+                loadEvidenceFromDisk(s.basePath, eMid, eSid, eTid);
+            }
+        }
     }
     // Only checkpoint code-executing units (not lifecycle/planning units)
     if (safetyConfig.enabled && safetyConfig.checkpoints && unitType === "execute-task") {
@@ -1430,6 +1457,20 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         }
         else {
             // s.pendingVerificationRetry was set by postUnitPreVerification.
+            // Emit a dedicated journal event so forensics can distinguish bounded
+            // verification retries from genuine stuck-loop dispatch repetitions (#4540).
+            const retryInfo = s.pendingVerificationRetry;
+            deps.emitJournalEvent({
+                ts: new Date().toISOString(),
+                flowId: ic.flowId,
+                seq: ic.nextSeq(),
+                eventType: "artifact-verification-retry",
+                data: {
+                    unitType: preUnitSnapshot?.type,
+                    unitId: retryInfo?.unitId,
+                    attempt: retryInfo?.attempt,
+                },
+            });
             // Continue the loop — next iteration will inject the retry context into the prompt.
             debugLog("autoLoop", { phase: "artifact-verification-retry", iteration: ic.iteration });
             return { action: "continue" };

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -92,6 +92,33 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     catch (e) {
         logWarning("engine", "Failed to chdir to basePath before dispatch", { basePath: s.basePath, error: String(e) });
     }
+    // ── Provider request-readiness pre-check (#4555) ──
+    // Verify the provider can accept requests before dispatching. If the token
+    // has expired since bootstrap, return cancelled immediately so the unit is
+    // not wasted on a guaranteed 401.
+    {
+        const provider = s.currentUnitModel?.provider ?? ctx.model?.provider;
+        const registry = ctx.modelRegistry;
+        if (provider && registry != null && typeof registry.isProviderRequestReady === "function") {
+            let ready = false;
+            try {
+                ready = registry.isProviderRequestReady(provider);
+            }
+            catch {
+                ready = false;
+            }
+            if (!ready) {
+                return {
+                    status: "cancelled",
+                    errorContext: {
+                        message: `Provider ${provider} is not request-ready (login/token expired)`,
+                        category: "provider",
+                        isTransient: false,
+                    },
+                };
+            }
+        }
+    }
     // ── Send the prompt ──
     debugLog("runUnit", { phase: "send-message", unitType, unitId });
     pi.sendMessage({ customType: "gsd-auto", content: prompt, display: s.verbose }, { triggerTurn: true });

package/dist/resources/extensions/gsd/auto/session.js

@@ -79,6 +79,17 @@ export class AutoSession {
     lastStateRebuildAt = 0;
     // ── Sidecar queue ─────────────────────────────────────────────────────
     sidecarQueue = [];
+    // ── Pre-exec gate failure context (#4551) ───────────────────────────
+    /**
+     * Persisted when a pre-execution gate fails on a plan-slice or refine-slice
+     * unit. The planning → plan-slice dispatch rule reads this field and injects
+     * the failure details into the next re-dispatch prompt so the LLM can fix the
+     * specific issues instead of producing an identical plan.
+     *
+     * Cleared after it has been consumed (injected into the prompt) to avoid
+     * stale context bleeding into unrelated slices.
+     */
+    lastPreExecFailure = null;
     // ── Tool invocation errors (#2883) ──────────────────────────────────
     /** Set when a GSD tool execution ends with isError due to malformed/truncated
      *  JSON arguments. Checked by postUnitPreVerification to break retry loops. */
@@ -199,6 +210,7 @@ export class AutoSession {
         this.sidecarQueue = [];
         this.rewriteAttemptCount = 0;
         this.consecutiveCompleteBootstraps = 0;
+        this.lastPreExecFailure = null;
         this.lastToolInvocationError = null;
         this.lastGitActionFailure = null;
         this.lastGitActionStatus = null;

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -451,18 +451,31 @@ export const DISPATCH_RULES = [
     },
     {
         name: "planning → plan-slice",
-        match: async ({ state, mid, midTitle, basePath, sessionContextWindow, modelRegistry }) => {
+        match: async ({ state, mid, midTitle, basePath, sessionContextWindow, modelRegistry, session }) => {
             if (state.phase !== "planning")
                 return null;
             if (!state.activeSlice)
                 return missingSliceStop(mid, state.phase);
             const sid = state.activeSlice.id;
             const sTitle = state.activeSlice.title;
+            // #4551: Consume any persisted pre-exec failure for this slice so the
+            // re-dispatched prompt includes the exact blocked references. Clear the
+            // field immediately after reading to prevent stale context leaking into
+            // a later, unrelated plan-slice run.
+            const unitId = `${mid}/${sid}`;
+            let priorPreExecFailure;
+            if (session?.lastPreExecFailure?.unitId === unitId) {
+                priorPreExecFailure = {
+                    blockingFindings: session.lastPreExecFailure.blockingFindings,
+                    verdictExcerpt: session.lastPreExecFailure.verdictExcerpt,
+                };
+                session.lastPreExecFailure = null;
+            }
             return {
                 action: "dispatch",
                 unitType: "plan-slice",
-                unitId: `${mid}/${sid}`,
-                prompt: await buildPlanSlicePrompt(mid, midTitle, sid, sTitle, basePath, undefined, { sessionContextWindow, modelRegistry }),
+                unitId,
+                prompt: await buildPlanSlicePrompt(mid, midTitle, sid, sTitle, basePath, undefined, { sessionContextWindow, modelRegistry, priorPreExecFailure }),
             };
         },
     },

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -291,7 +291,7 @@ autoModeStartThinkingLevel) {
                 // ADR-005: Adjust active tool set for the selected model's provider capabilities.
                 // Hard-filter incompatible tools, then let extensions override via adjust_tool_set hook.
                 const activeToolNames = pi.getActiveTools();
-                const { toolNames: compatibleTools, removedTools } = adjustToolSet(activeToolNames, model.api);
+                const { toolNames: compatibleTools, removedTools } = adjustToolSet(activeToolNames, model.api, model.provider);
                 let finalToolNames = compatibleTools;
                 // Fire adjust_tool_set hook — extensions can override the filtered tool set
                 if (routingConfig.hooks !== false) {

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -30,7 +30,7 @@ import { checkPostUnitHooks, isRetryPending, consumeRetryTrigger, persistHookSta
 import { hasPendingCaptures, loadPendingCaptures, revertExecutorResolvedCaptures } from "./captures.js";
 import { debugLog } from "./debug-logger.js";
 import { runSafely } from "./auto-utils.js";
-import { getEvidence } from "./safety/evidence-collector.js";
+import { getEvidence, clearEvidenceFromDisk } from "./safety/evidence-collector.js";
 import { validateFileChanges } from "./safety/file-change-validator.js";
 // crossReferenceEvidence available for future use when verification_evidence is stored in DB
 // import { crossReferenceEvidence, type ClaimedEvidence } from "./safety/evidence-cross-ref.js";
@@ -535,7 +535,7 @@ export async function postUnitPreVerification(pctx, opts) {
                         if (taskRow) {
                             const expectedOutput = taskRow.expected_output ?? [];
                             const plannedFiles = taskRow.files ?? [];
-                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles);
+                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
                             if (audit && audit.violations.length > 0) {
                                 const warnings = audit.violations.filter(v => v.severity === "warning");
                                 for (const v of warnings) {
@@ -588,6 +588,16 @@ export async function postUnitPreVerification(pctx, opts) {
                         debugLog("postUnit", { phase: "safety-content-validation", error: String(e) });
                     }
                 }
+                // Clear persisted evidence file now that post-unit processing is complete
+                // (Bug #4385 — prevents stale evidence from affecting retries of same unit ID).
+                if (safetyConfig.evidence_collection && s.currentUnit.type === "execute-task" && sMid && sSid && sTid) {
+                    try {
+                        clearEvidenceFromDisk(s.basePath, sMid, sSid, sTid);
+                    }
+                    catch (e) {
+                        debugLog("postUnit", { phase: "safety-evidence-clear", error: String(e) });
+                    }
+                }
             }
         }
         catch (e) {
@@ -950,12 +960,25 @@ export async function postUnitPostVerification(pctx) {
                     const suffix = blockingChecks.length > 3 ? `\n  \u2022 ...and ${blockingChecks.length - 3} more` : "";
                     const evidenceNote = `\nSee ${sid}-PRE-EXEC-VERIFY.json for full details.`;
                     ctx.ui.notify(`Pre-execution checks failed: ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} found\n${details}${suffix}${evidenceNote}`, "error");
+                    // Persist failure context so the next plan-slice re-dispatch can inject
+                    // it into the prompt and break the infinite loop (#4551).
+                    s.lastPreExecFailure = {
+                        unitId: currentUnit.id,
+                        blockingFindings: blockingChecks.map(c => `[${c.category}] ${c.target}: ${c.message}`),
+                        verdictExcerpt: `status=${result.status}; ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} detected`,
+                    };
                     preExecPauseNeeded = true;
                 }
                 else if (result.status === "warn") {
                     ctx.ui.notify(`Pre-execution checks passed with warnings`, "warning");
                     // Strict mode: treat warnings as blocking
                     if (prefs?.enhanced_verification_strict === true) {
+                        const warnChecks = result.checks.filter(c => !c.passed);
+                        s.lastPreExecFailure = {
+                            unitId: currentUnit.id,
+                            blockingFindings: warnChecks.map(c => `[${c.category}] ${c.target}: ${c.message}`),
+                            verdictExcerpt: `status=${result.status} (strict mode); ${warnChecks.length} warning${warnChecks.length === 1 ? "" : "s"} treated as blocking`,
+                        };
                         preExecPauseNeeded = true;
                     }
                 }

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -1223,6 +1223,20 @@ export async function buildPlanSlicePrompt(mid, _midTitle, sid, sTitle, base, le
         prependBlocks.push(`## Prior Sketch Scope (soft hint — non-binding)\n\n${options.softScopeHint.trim()}\n\n` +
             `This scope was captured during an earlier progressive-planning pass that was later disabled. Treat it as context only — you may plan beyond it if the work genuinely requires more scope. Do NOT treat this as a hard boundary.`);
     }
+    // #4551: inject pre-exec failure context so the re-dispatched plan-slice
+    // addresses the exact blocked references rather than reproducing the same plan.
+    if (options?.priorPreExecFailure) {
+        const { blockingFindings, verdictExcerpt } = options.priorPreExecFailure;
+        const findingsList = blockingFindings.length > 0
+            ? blockingFindings.map(f => `- ${f}`).join("\n")
+            : "- (no specific findings recorded)";
+        prependBlocks.push(`## Fix these specific issues from the prior pre-exec check\n\n` +
+            `The previous plan-slice attempt was blocked by pre-execution validation.\n` +
+            `Gate verdict: ${verdictExcerpt}\n\n` +
+            `Blocked references that must be resolved in this plan:\n${findingsList}\n\n` +
+            `Revise the plan so that every reference listed above is satisfied before execution begins. ` +
+            `Do not reproduce the same file paths, package names, or task ordering that caused these failures.`);
+    }
     return renderSlicePrompt({
         mid, sid, sTitle, base,
         level: level ?? resolveInlineLevel(),

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -220,12 +220,25 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
     // RESEARCH file. Without this, resolveExpectedArtifactPath returns null and
     // the retry/escalation machinery silently re-dispatches forever.
     //
+    // #4068: Also treat a PARALLEL-BLOCKER placeholder as a terminal completion
+    // so that timeout-recovery can write the blocker, have verifyExpectedArtifact
+    // return true, and let the dispatch loop advance past this unit.  Without
+    // this, the blocker is written but verification still returns false, the unit
+    // is never cleared from unitDispatchCount, and on the next iteration the
+    // dispatch rule (which correctly skips parallel-research when PARALLEL-BLOCKER
+    // exists) returns null — leaving the loop stuck re-deriving indefinitely.
+    //
     // NOTE: this predicate mirrors the dispatch rule at
     // auto-dispatch.ts parallel-research-slices — keep the two in sync.
     if (unitType === "research-slice" && unitId.endsWith("/parallel-research")) {
         const { milestone: mid } = parseUnitId(unitId);
         if (!mid)
             return false;
+        // #4068: PARALLEL-BLOCKER written by timeout-recovery is a terminal state.
+        const blockerPath = resolveExpectedArtifactPath(unitType, unitId, base);
+        if (blockerPath && existsSync(blockerPath)) {
+            return true;
+        }
         const roadmapFile = resolveMilestoneFile(base, mid, "ROADMAP");
         if (!roadmapFile || !existsSync(roadmapFile)) {
             logWarning("recovery", `verify-fail ${unitType} ${unitId}: roadmap missing`);