gsd-pi 2.77.0 → 2.78.0-dev.aeeb2ca00

package/dist/resources/extensions/gsd/bootstrap/register-extension.js

@@ -12,6 +12,13 @@ import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
 import { writeCrashLog } from "./crash-log.js";
 import { logWarning } from "../workflow-logger.js";
+// Static import so cmux event listeners are registered synchronously during
+// extension bootstrap. Prior implementation used `void import().then()` which
+// queued listener registration as a microtask — any CMUX_CHANNELS emit fired
+// in the same event loop turn as registration (e.g. from a provider-error
+// session hook calling startAuto) would be silently dropped because Node's
+// EventEmitter does not buffer events for late subscribers.
+import { initCmuxEventListeners } from "../../cmux/index.js";
 export { writeCrashLog } from "./crash-log.js";
 export function handleRecoverableExtensionProcessError(err) {
     if (err.code === "EPIPE") {
@@ -89,6 +96,10 @@ export function registerGsdExtension(pi) {
         ["memory-tools", () => registerMemoryTools(pi)],
         ["exec-tools", () => registerExecTools(pi)],
         ["shortcuts", () => registerShortcuts(pi)],
+        // cmux is a library (no pi), so gsd sets up the event listeners on its
+        // behalf using the shared event channel contract. Registration is
+        // synchronous — see the import comment above for the rationale.
+        ["cmux-events", () => initCmuxEventListeners(pi.events)],
         ["hooks", () => registerHooks(pi, ecosystemHandlers)],
         ["ecosystem", () => {
                 void loadEcosystemExtensions(pi, ecosystemHandlers).catch((err) => {

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -353,7 +353,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         if (isAutoActive() && typeof event.toolCallId === "string") {
             markToolEnd(event.toolCallId);
         }
-        if (isAutoActive() && event.isError && event.toolName.startsWith("gsd_")) {
+        if (isAutoActive() && event.isError) {
             const resultPayload = ("result" in event ? event.result : undefined);
             const errorText = typeof resultPayload === "string"
                 ? resultPayload
@@ -362,6 +362,8 @@ export function registerHooks(pi, ecosystemHandlers) {
                     : (typeof event.content === "string"
                         ? event.content
                         : String(resultPayload ?? "")));
+            // Let recordToolInvocationError classify the failure so non-gsd_ harness
+            // errors and deterministic policy rejections are handled consistently.
             recordToolInvocationError(event.toolName, errorText);
         }
         if (event.toolName !== "ask_user_questions")
@@ -447,12 +449,14 @@ export function registerHooks(pi, ecosystemHandlers) {
     });
     pi.on("tool_execution_end", async (event) => {
         markToolEnd(event.toolCallId);
-        // #2883: Capture tool invocation errors (malformed/truncated JSON arguments)
+        // #2883/#4974: Capture deterministic invocation/policy errors
         // so postUnitPreVerification can break the retry loop instead of re-dispatching.
-        if (event.isError && event.toolName.startsWith("gsd_")) {
+        if (event.isError) {
             const errorText = typeof event.result === "string"
                 ? event.result
                 : (typeof event.result?.content?.[0]?.text === "string" ? event.result.content[0].text : String(event.result));
+            // Let recordToolInvocationError classify the failure so non-gsd_ harness
+            // errors and deterministic policy rejections are handled consistently.
             recordToolInvocationError(event.toolName, errorText);
         }
         // Safety harness: record tool execution results for evidence cross-referencing

package/dist/resources/extensions/gsd/bootstrap/system-context.js

@@ -16,7 +16,6 @@ import { getActiveWorktreeName, getWorktreeOriginalCwd } from "../worktree-comma
 import { deriveState } from "../state.js";
 import { formatOverridesSection, formatShortcut, loadActiveOverrides, loadFile, parseContinue, parseSummary } from "../files.js";
 import { toPosixPath } from "../../shared/mod.js";
-import { markCmuxPromptShown, shouldPromptToEnableCmux } from "../../cmux/index.js";
 import { autoEnableCmuxPreferences } from "../commands-cmux.js";
 const gsdHome = process.env.GSD_HOME || join(homedir(), ".gsd");
 /**
@@ -87,13 +86,19 @@ export async function buildBeforeAgentStartResult(event, ctx) {
         shortcutShell: formatShortcut("Ctrl+Alt+B"),
     });
     let loadedPreferences = loadEffectiveGSDPreferences();
-    if (shouldPromptToEnableCmux(loadedPreferences?.preferences)) {
-        markCmuxPromptShown();
-        if (autoEnableCmuxPreferences()) {
-            loadedPreferences = loadEffectiveGSDPreferences();
-            ctx.ui.notify("cmux detected — auto-enabled. Run /gsd cmux off to disable.", "info");
+    try {
+        const { markCmuxPromptShown, shouldPromptToEnableCmux } = await import("../../cmux/index.js");
+        if (shouldPromptToEnableCmux(loadedPreferences?.preferences)) {
+            markCmuxPromptShown();
+            if (autoEnableCmuxPreferences()) {
+                loadedPreferences = loadEffectiveGSDPreferences();
+                ctx.ui.notify("cmux detected — auto-enabled. Run /gsd cmux off to disable.", "info");
+            }
         }
     }
+    catch (e) {
+        logWarning("bootstrap", `cmux prompt setup skipped: ${e.message}`);
+    }
     let preferenceBlock = "";
     if (loadedPreferences) {
         const cwd = process.cwd();

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -1,6 +1,13 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-const MILESTONE_CONTEXT_RE = /M\d+(?:-[a-z0-9]{6})?-CONTEXT\.md$/;
+import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { minimatch } from "minimatch";
+/**
+ * Regex matching milestone CONTEXT.md file names in both legacy M001
+ * and unique M001-abc123 formats. Exported so regex-hardening tests
+ * can exercise the real pattern rather than a drift-prone inline
+ * re-implementation (see #4835).
+ */
+export const MILESTONE_CONTEXT_RE = /M\d+(?:-[a-z0-9]{6})?-CONTEXT\.md$/;
 const CONTEXT_MILESTONE_RE = /(?:^|[/\\])(M\d+(?:-[a-z0-9]{6})?)-CONTEXT\.md$/i;
 const DEPTH_VERIFICATION_MILESTONE_RE = /depth_verification[_-](M\d+(?:-[a-z0-9]{6})?)/i;
 /**
@@ -76,8 +83,15 @@ const GATE_SAFE_TOOLS = new Set([
     "search-the-web", "resolve_library", "get_library_docs", "fetch_page",
     "search_and_read",
 ]);
+/**
+ * Persistence is ON by default (opt-out).
+ * Set GSD_PERSIST_WRITE_GATE_STATE="0" or GSD_PERSIST_WRITE_GATE_STATE="false"
+ * to disable. All other values — including unset — persist the snapshot.
+ * (Inverted from the original opt-in guard; see #4950.)
+ */
 function shouldPersistWriteGateSnapshot(env = process.env) {
-    return env.GSD_PERSIST_WRITE_GATE_STATE === "1";
+    const v = env.GSD_PERSIST_WRITE_GATE_STATE;
+    return v !== "0" && v !== "false";
 }
 function writeGateSnapshotPath(basePath = process.cwd()) {
     return join(basePath, ".gsd", "runtime", "write-gate-state.json");
@@ -94,9 +108,22 @@ function persistWriteGateSnapshot(basePath = process.cwd()) {
         return;
     const path = writeGateSnapshotPath(basePath);
     mkdirSync(join(basePath, ".gsd", "runtime"), { recursive: true });
-    const tempPath = `${path}.tmp`;
+    const tempPath = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
     writeFileSync(tempPath, JSON.stringify(currentWriteGateSnapshot(), null, 2), "utf-8");
-    renameSync(tempPath, path);
+    try {
+        renameSync(tempPath, path);
+    }
+    catch (err) {
+        // EXDEV: cross-device rename (temp and dest on different mounts). Fall back
+        // to copy-then-delete so the snapshot is still written atomically enough.
+        if (err instanceof Error && err.code === "EXDEV") {
+            copyFileSync(tempPath, path);
+            unlinkSync(tempPath);
+        }
+        else {
+            throw err;
+        }
+    }
 }
 function clearPersistedWriteGateSnapshot(basePath = process.cwd()) {
     if (!shouldPersistWriteGateSnapshot())
@@ -295,9 +322,9 @@ export function isDepthConfirmationAnswer(selected, options) {
         const confirmLabel = options[0]?.label;
         return typeof confirmLabel === "string" && value === confirmLabel;
     }
-    // Fallback when options aren't available (e.g., older call sites):
-    // accept only if it contains "(Recommended)" — the prompt convention suffix.
-    return value.includes("(Recommended)");
+    // Fail-closed: no options means we cannot structurally validate the answer.
+    // Returning false prevents any free-form string from unlocking the gate.
+    return false;
 }
 export function shouldBlockContextWrite(toolName, inputPath, milestoneId, _queuePhaseActive) {
     if (toolName !== "write")
@@ -413,3 +440,94 @@ export function shouldBlockQueueExecutionInSnapshot(snapshot, toolName, input, q
         reason: `Blocked: /gsd queue is a planning tool — it creates milestones, not executes work. Unknown tools are not permitted during queue mode.`,
     };
 }
+// ─── Planning-unit tools-policy enforcement (#4934) ───────────────────────
+const PLANNING_WRITE_TOOLS = new Set(["write", "edit", "multi_edit", "notebook_edit"]);
+const PLANNING_SUBAGENT_TOOLS = new Set(["subagent", "task"]);
+const PLANNING_SAFE_TOOLS = new Set([
+    "read", "grep", "find", "ls", "glob",
+    "ask_user_questions",
+    "search-the-web", "resolve_library", "get_library_docs", "fetch_page",
+    "search_and_read",
+]);
+function isPathUnderGsd(absPath, basePath) {
+    const gsdRoot = resolve(basePath, ".gsd");
+    const rel = relative(gsdRoot, absPath);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+function matchesAllowedGlob(absPath, basePath, globs) {
+    const rel = relative(basePath, absPath);
+    if (rel.startsWith("..") || isAbsolute(rel))
+        return false;
+    const posix = rel.split(sep).join("/");
+    return globs.some(g => minimatch(posix, g, { dot: false, nocase: false }));
+}
+function blockReason(unitType, mode, what) {
+    return [
+        `HARD BLOCK: unit "${unitType}" runs under tools-policy "${mode}" — ${what}.`,
+        `This is a mechanical gate enforced by manifest.tools (#4934). You MUST NOT proceed,`,
+        `retry the same call, or rationalize past this block. If you need to write user source,`,
+        `the work belongs in execute-task, not in a planning unit.`,
+    ].join(" ");
+}
+/**
+ * Planning-unit tool-policy enforcement. Returns { block } per the policy
+ * resolved from the active unit's manifest:
+ *
+ *   - "all"        → never blocks.
+ *   - "read-only"  → blocks all writes, bash, and subagent dispatch.
+ *   - "planning"   → blocks writes to paths outside <basePath>/.gsd/,
+ *                    bash that isn't read-only, and subagent dispatch.
+ *   - "docs"       → like "planning" but also allows writes to paths
+ *                    matching `allowedPathGlobs` relative to basePath.
+ *
+ * `policy` of null means "no manifest resolved" — pass-through.
+ */
+export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitType, policy) {
+    if (!policy)
+        return { block: false };
+    if (policy.mode === "all")
+        return { block: false };
+    const tool = toolName;
+    if (policy.mode === "read-only") {
+        if (PLANNING_SAFE_TOOLS.has(tool))
+            return { block: false };
+        if (tool.startsWith("gsd_"))
+            return { block: false };
+        if (PLANNING_WRITE_TOOLS.has(tool) || tool === "bash" || PLANNING_SUBAGENT_TOOLS.has(tool)) {
+            return { block: true, reason: blockReason(unitType, policy.mode, `${tool} is not permitted (read-only)`) };
+        }
+        return { block: true, reason: blockReason(unitType, policy.mode, `tool "${tool}" is not on the read-only allowlist`) };
+    }
+    // planning / docs modes
+    if (PLANNING_SAFE_TOOLS.has(tool))
+        return { block: false };
+    if (tool.startsWith("gsd_"))
+        return { block: false };
+    if (PLANNING_SUBAGENT_TOOLS.has(tool)) {
+        return { block: true, reason: blockReason(unitType, policy.mode, `subagent dispatch is not permitted in planning units`) };
+    }
+    if (tool === "bash") {
+        if (BASH_READ_ONLY_RE.test(pathOrCommand))
+            return { block: false };
+        return {
+            block: true,
+            reason: blockReason(unitType, policy.mode, `bash is restricted to read-only commands (cat/grep/git log/etc); cannot run "${pathOrCommand.slice(0, 80)}${pathOrCommand.length > 80 ? "…" : ""}"`),
+        };
+    }
+    if (PLANNING_WRITE_TOOLS.has(tool)) {
+        if (!pathOrCommand) {
+            return { block: true, reason: blockReason(unitType, policy.mode, `${tool} called with empty path`) };
+        }
+        const absPath = isAbsolute(pathOrCommand) ? pathOrCommand : resolve(basePath, pathOrCommand);
+        if (isPathUnderGsd(absPath, basePath))
+            return { block: false };
+        if (policy.mode === "docs" && matchesAllowedGlob(absPath, basePath, policy.allowedPathGlobs)) {
+            return { block: false };
+        }
+        return {
+            block: true,
+            reason: blockReason(unitType, policy.mode, `cannot ${tool} "${pathOrCommand}" — writes are restricted to .gsd/${policy.mode === "docs" ? " and " + policy.allowedPathGlobs.join(", ") : ""}`),
+        };
+    }
+    return { block: false };
+}

package/dist/resources/extensions/gsd/commands/handlers/workflow.js

@@ -17,6 +17,22 @@ import { validateDefinition } from "../../definition-loader.js";
 import { formatPluginInfo, listPluginsFormatted, resolvePlugin, } from "../../workflow-plugins.js";
 import { dispatchOneshot } from "../../workflow-dispatch.js";
 import { fetchWorkflowSource, globalInstallDir, inferPluginName, installPlugin, previewContent, projectInstallDir, resolveSourceUrl, uninstallPlugin, validateFetchedContent, } from "../../workflow-install.js";
+/**
+ * Refuses interactive commands that mutate durable .gsd/ planning state while
+ * auto-mode holds the worktree. Returns true if the command was blocked and
+ * the caller should return immediately; false if it is safe to proceed.
+ *
+ * Auto-mode's squash merge performs a pre-merge dirty-tree check; concurrent
+ * writes by interactive commands between that check and the merge itself
+ * cause __dirty_working_tree__ failures (#4704).
+ */
+function requireNotAutoActive(commandName, ctx) {
+    if (!isAutoActive())
+        return false;
+    ctx.ui.notify(`${commandName} cannot run while auto-mode is active.\n` +
+        `Stop auto-mode first with /gsd stop, then run ${commandName}.`, "error");
+    return true;
+}
 // ─── Custom Workflow Subcommands ─────────────────────────────────────────
 const RESERVED_SUBCOMMANDS = new Set([
     "new", "run", "list", "validate", "pause", "resume",
@@ -394,12 +410,16 @@ async function handleCustomWorkflow(sub, ctx, pi) {
 export async function handleWorkflowCommand(trimmed, ctx, pi) {
     // ── /gsd do — natural language routing (must be early to route to other commands) ──
     if (trimmed === "do" || trimmed.startsWith("do ")) {
+        if (requireNotAutoActive("/gsd do", ctx))
+            return true;
         const { handleDo } = await import("../../commands-do.js");
         await handleDo(trimmed.replace(/^do\s*/, "").trim(), ctx, pi);
         return true;
     }
     // ── Backlog management ──
     if (trimmed === "backlog" || trimmed.startsWith("backlog ")) {
+        if (requireNotAutoActive("/gsd backlog", ctx))
+            return true;
         const { handleBacklog } = await import("../../commands-backlog.js");
         await handleBacklog(trimmed.replace(/^backlog\s*/, "").trim(), ctx, pi);
         return true;
@@ -410,23 +430,26 @@ export async function handleWorkflowCommand(trimmed, ctx, pi) {
         return handleCustomWorkflow(sub, ctx, pi);
     }
     if (trimmed === "queue") {
+        if (requireNotAutoActive("/gsd queue", ctx))
+            return true;
         await showQueue(ctx, pi, projectRoot());
         return true;
     }
     if (trimmed === "discuss") {
+        if (requireNotAutoActive("/gsd discuss", ctx))
+            return true;
         await showDiscuss(ctx, pi, projectRoot());
         return true;
     }
     if (trimmed === "quick" || trimmed.startsWith("quick ")) {
-        if (isAutoActive()) {
-            ctx.ui.notify("/gsd quick cannot run while auto-mode is active.\n" +
-                "Stop auto-mode first with /gsd stop, then run /gsd quick.", "error");
+        if (requireNotAutoActive("/gsd quick", ctx))
             return true;
-        }
         await handleQuick(trimmed.replace(/^quick\s*/, "").trim(), ctx, pi);
         return true;
     }
     if (trimmed === "new-milestone") {
+        if (requireNotAutoActive("/gsd new-milestone", ctx))
+            return true;
         const basePath = projectRoot();
         const headlessContextPath = join(gsdRoot(basePath), "runtime", "headless-context.md");
         if (existsSync(headlessContextPath)) {
@@ -452,6 +475,8 @@ export async function handleWorkflowCommand(trimmed, ctx, pi) {
         return true;
     }
     if (trimmed === "park" || trimmed.startsWith("park ")) {
+        if (requireNotAutoActive("/gsd park", ctx))
+            return true;
         const basePath = projectRoot();
         const arg = trimmed.replace(/^park\s*/, "").trim();
         let targetId = arg;
@@ -474,6 +499,8 @@ export async function handleWorkflowCommand(trimmed, ctx, pi) {
         return true;
     }
     if (trimmed === "unpark" || trimmed.startsWith("unpark ")) {
+        if (requireNotAutoActive("/gsd unpark", ctx))
+            return true;
         const basePath = projectRoot();
         const arg = trimmed.replace(/^unpark\s*/, "").trim();
         let targetId = arg;

package/dist/resources/extensions/gsd/commands-cmux.js

@@ -1,5 +1,4 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { clearCmuxSidebar, CmuxClient, detectCmuxEnvironment, resolveCmuxConfig } from "../cmux/index.js";
 import { saveFile } from "./files.js";
 import { getProjectGSDPreferencesPath, loadEffectiveGSDPreferences, loadProjectGSDPreferences, } from "./preferences.js";
 import { ensurePreferencesFile, serializePreferencesToFrontmatter } from "./commands-prefs-wizard.js";
@@ -63,7 +62,8 @@ async function writeProjectCmuxPreferences(ctx, updater) {
 function resolveProjectPreferencesWritePath() {
     return loadProjectGSDPreferences()?.path ?? getProjectGSDPreferencesPath();
 }
-function formatCmuxStatus() {
+async function formatCmuxStatus() {
+    const { CmuxClient, detectCmuxEnvironment, resolveCmuxConfig } = await import("../cmux/index.js");
     const loaded = loadEffectiveGSDPreferences();
     const detected = detectCmuxEnvironment();
     const resolved = resolveCmuxConfig(loaded?.preferences);
@@ -87,7 +87,8 @@ function formatCmuxStatus() {
         `Capabilities: access=${accessMode}, methods=${methods}`,
     ].join("\n");
 }
-function ensureCmuxAvailableForEnable(ctx) {
+async function ensureCmuxAvailableForEnable(ctx) {
+    const { detectCmuxEnvironment } = await import("../cmux/index.js");
     const detected = detectCmuxEnvironment();
     if (detected.available)
         return true;
@@ -97,11 +98,11 @@ function ensureCmuxAvailableForEnable(ctx) {
 export async function handleCmux(args, ctx) {
     const trimmed = args.trim();
     if (!trimmed || trimmed === "status") {
-        ctx.ui.notify(formatCmuxStatus(), "info");
+        ctx.ui.notify(await formatCmuxStatus(), "info");
         return;
     }
     if (trimmed === "on") {
-        if (!ensureCmuxAvailableForEnable(ctx))
+        if (!await ensureCmuxAvailableForEnable(ctx))
             return;
         await writeProjectCmuxPreferences(ctx, (prefs) => {
             prefs.cmux = {
@@ -122,6 +123,7 @@ export async function handleCmux(args, ctx) {
         await writeProjectCmuxPreferences(ctx, (prefs) => {
             prefs.cmux = { ...(prefs.cmux ?? {}), enabled: false };
         });
+        const { clearCmuxSidebar } = await import("../cmux/index.js");
         clearCmuxSidebar(effective);
         ctx.ui.notify("cmux integration disabled in project preferences.", "info");
         return;
@@ -130,7 +132,7 @@ export async function handleCmux(args, ctx) {
     if (parts.length === 2 && ["notifications", "sidebar", "splits", "browser"].includes(parts[0]) && ["on", "off"].includes(parts[1])) {
         const feature = parts[0];
         const enabled = parts[1] === "on";
-        if (enabled && !ensureCmuxAvailableForEnable(ctx))
+        if (enabled && !await ensureCmuxAvailableForEnable(ctx))
             return;
         await writeProjectCmuxPreferences(ctx, (prefs) => {
             const next = { ...(prefs.cmux ?? {}) };
@@ -140,6 +142,7 @@ export async function handleCmux(args, ctx) {
             prefs.cmux = next;
         });
         if (!enabled && feature === "sidebar") {
+            const { clearCmuxSidebar } = await import("../cmux/index.js");
             clearCmuxSidebar(loadEffectiveGSDPreferences()?.preferences);
         }
         const note = feature === "browser" && enabled