gsd-pi 2.78.0 → 2.78.1-dev.82bcf6b71

package/dist/resources/extensions/gsd/preferences-models.js

@@ -8,7 +8,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { defaultRoutingConfig } from "./model-router.js";
+import { canonicalModelForTier, defaultRoutingConfig, resolveModelForTier } from "./model-router.js";
 import { loadEffectiveGSDPreferences, getGlobalGSDPreferencesPath } from "./preferences.js";
 /**
  * Resolve which model ID to use for a given auto-mode unit type.
@@ -27,7 +27,7 @@ export function resolveModelForUnit(unitType) {
  * - Extended: `planning: { model: claude-opus-4-6, fallbacks: [glm-5, minimax-m2.5] }`
  */
 export function resolveModelWithFallbacksForUnit(unitType) {
-    const prefs = loadEffectiveGSDPreferences();
+    const prefs = loadEffectiveGSDPreferences(undefined, { availableModelIds: [] });
     if (!prefs?.preferences.models)
         return undefined;
     const m = prefs.preferences.models;
@@ -110,7 +110,7 @@ export function resolveModelWithFallbacksForUnit(unitType) {
  * configured.
  */
 export function resolveDefaultSessionModel(sessionProvider) {
-    const prefs = loadEffectiveGSDPreferences();
+    const prefs = loadEffectiveGSDPreferences(undefined, { availableModelIds: [] });
     if (!prefs?.preferences.models)
         return undefined;
     const m = prefs.preferences.models;
@@ -323,22 +323,80 @@ export function resolveAutoSupervisorConfig() {
 }
 // ─── Token Profile Resolution ─────────────────────────────────────────────
 const VALID_TOKEN_PROFILES = new Set(["budget", "balanced", "quality", "burn-max"]);
+/**
+ * Per-phase tier intentions for each token profile.
+ * Profiles express capability tiers, not model IDs. Concrete model
+ * resolution happens at runtime via resolveModelForTier() which is
+ * provider-agnostic — it picks the best available model at each tier.
+ */
+const PROFILE_TIER_MAP = {
+    budget: {
+        planning: "standard",
+        research: "light",
+        execution: "standard",
+        execution_simple: "light",
+        completion: "light",
+        subagent: "light",
+    },
+    balanced: {
+        planning: "standard",
+        research: "standard",
+        execution: "standard",
+        execution_simple: "light",
+        completion: "light",
+        subagent: "light",
+    },
+    quality: {
+        planning: "heavy",
+        research: "standard",
+        execution: "standard",
+        execution_simple: "light",
+        completion: "light",
+        subagent: "standard",
+    },
+    // burn-max intentionally omits a tier map: it never writes model defaults
+    // (it preserves the user's explicit model selection), so resolveProfileDefaults
+    // skips model resolution for this profile.
+    "burn-max": {},
+};
 /**
  * Resolve profile defaults for a given token profile tier.
  * Returns a partial GSDPreferences that is used as the base layer --
  * explicit user preferences always override these defaults.
+ *
+ * Model IDs are resolved from capability tiers, not hardcoded to any
+ * provider. When available models are known (runtime), the resolver picks
+ * the best match across all configured providers. When not known (e.g.,
+ * early startup), falls back to canonical Anthropic model IDs.
+ *
+ * @param profile           The token profile to resolve
+ * @param availableModelIds Optional list of available model IDs for cross-provider resolution.
+ *                          Undefined means the registry is unavailable.
+ * @param routingConfig     Optional routing config for tier model pins.
  */
-export function resolveProfileDefaults(profile) {
+export function resolveProfileDefaults(profile, availableModelIds, routingConfig = defaultRoutingConfig()) {
+    // burn-max never writes model defaults — preserve user-selected models.
+    // For the other three profiles, derive concrete model IDs from the tier map
+    // against the available-model list when the registry is provided. If callers
+    // omit the registry entirely, use canonical fallbacks explicitly.
+    const tierMap = PROFILE_TIER_MAP[profile];
+    const resolveTierModel = (tier) => Array.isArray(availableModelIds)
+        ? resolveModelForTier(tier, availableModelIds, routingConfig)
+        : canonicalModelForTier(tier);
+    const models = profile === "burn-max"
+        ? undefined
+        : {
+            planning: resolveTierModel(tierMap.planning),
+            research: resolveTierModel(tierMap.research),
+            execution: resolveTierModel(tierMap.execution),
+            execution_simple: resolveTierModel(tierMap.execution_simple),
+            completion: resolveTierModel(tierMap.completion),
+            subagent: resolveTierModel(tierMap.subagent),
+        };
     switch (profile) {
         case "budget":
             return {
-                models: {
-                    planning: "claude-sonnet-4-5-20250514",
-                    execution: "claude-sonnet-4-5-20250514",
-                    execution_simple: "claude-haiku-4-5-20250414",
-                    completion: "claude-haiku-4-5-20250414",
-                    subagent: "claude-haiku-4-5-20250414",
-                },
+                models,
                 phases: {
                     skip_research: true,
                     skip_reassess: true,
@@ -348,9 +406,7 @@ export function resolveProfileDefaults(profile) {
             };
         case "balanced":
             return {
-                models: {
-                    subagent: "claude-sonnet-4-5-20250514",
-                },
+                models,
                 phases: {
                     skip_research: true,
                     skip_reassess: true,
@@ -359,7 +415,7 @@ export function resolveProfileDefaults(profile) {
             };
         case "quality":
             return {
-                models: {},
+                models,
                 phases: {
                     skip_research: true,
                     skip_slice_research: true,
@@ -384,6 +440,13 @@ export function resolveProfileDefaults(profile) {
             };
     }
 }
+/**
+ * Get the tier intentions for a profile without resolving to model IDs.
+ * Useful for display, debugging, and testing.
+ */
+export function getProfileTierMap(profile) {
+    return { ...PROFILE_TIER_MAP[profile] };
+}
 /**
  * Resolve the effective token profile from preferences.
  * Returns "balanced" when no profile is set (D046).
@@ -428,3 +491,16 @@ export function resolveSearchProviderFromPreferences() {
     const prefs = loadEffectiveGSDPreferences();
     return prefs?.preferences.search_provider;
 }
+/**
+ * Resolve provider IDs excluded from model selection/routing.
+ * Returns a normalized, de-duplicated list.
+ */
+export function resolveDisabledModelProvidersFromPreferences() {
+    const prefs = loadEffectiveGSDPreferences();
+    const raw = prefs?.preferences.disabled_model_providers;
+    if (!Array.isArray(raw))
+        return [];
+    return Array.from(new Set(raw
+        .map((provider) => provider.trim())
+        .filter((provider) => provider.length > 0)));
+}

package/dist/resources/extensions/gsd/preferences-types.js

@@ -61,6 +61,7 @@ export const KNOWN_PREFERENCE_KEYS = new Set([
     "post_unit_hooks",
     "pre_dispatch_hooks",
     "dynamic_routing",
+    "disabled_model_providers",
     "uok",
     "token_profile",
     "phases",
@@ -79,6 +80,7 @@ export const KNOWN_PREFERENCE_KEYS = new Set([
     "service_tier",
     "forensics_dedup",
     "show_token_cost",
+    "min_request_interval_ms",
     "stale_commit_threshold_minutes",
     "context_management",
     "experimental",

package/dist/resources/extensions/gsd/preferences-validation.js

@@ -620,6 +620,26 @@ export function validatePreferences(preferences) {
             errors.push("dynamic_routing must be an object");
         }
     }
+    // ─── Disabled Model Providers ───────────────────────────────────────
+    if (preferences.disabled_model_providers !== undefined) {
+        if (Array.isArray(preferences.disabled_model_providers)) {
+            const allStrings = preferences.disabled_model_providers.every((provider) => typeof provider === "string");
+            if (!allStrings) {
+                errors.push("disabled_model_providers must be an array of strings");
+            }
+            else {
+                const normalized = preferences.disabled_model_providers
+                    .map((provider) => provider.trim())
+                    .filter((provider) => provider.length > 0);
+                if (normalized.length > 0) {
+                    validated.disabled_model_providers = Array.from(new Set(normalized));
+                }
+            }
+        }
+        else {
+            errors.push("disabled_model_providers must be an array of strings");
+        }
+    }
     // ─── Context Management ──────────────────────────────────────────────
     if (preferences.context_management !== undefined) {
         if (typeof preferences.context_management === "object" && preferences.context_management !== null) {
@@ -1153,6 +1173,18 @@ export function validatePreferences(preferences) {
             errors.push("show_token_cost must be a boolean");
         }
     }
+    // ─── Auto-Mode Request Interval ───────────────────────────────────
+    if (preferences.min_request_interval_ms !== undefined) {
+        if (typeof preferences.min_request_interval_ms === "number" &&
+            Number.isFinite(preferences.min_request_interval_ms) &&
+            preferences.min_request_interval_ms >= 0 &&
+            preferences.min_request_interval_ms <= 2_147_483_647) {
+            validated.min_request_interval_ms = Math.floor(preferences.min_request_interval_ms);
+        }
+        else {
+            errors.push("min_request_interval_ms must be a non-negative number <= 2147483647");
+        }
+    }
     // ─── Experimental Features ────────────────────────────────────────
     if (preferences.experimental !== undefined) {
         if (typeof preferences.experimental === "object" && preferences.experimental !== null) {

package/dist/resources/extensions/gsd/preferences.js

@@ -35,7 +35,7 @@ export function resolveSkillStalenessDays(basePath) {
     return prefs?.preferences.skill_staleness_days ?? 60;
 }
 // ─── Re-exports: models ─────────────────────────────────────────────────────
-export { resolveModelForUnit, resolveModelWithFallbacksForUnit, getNextFallbackModel, isTransientNetworkError, validateModelId, updatePreferencesModels, resolveDynamicRoutingConfig, resolveAutoSupervisorConfig, resolveProfileDefaults, resolveEffectiveProfile, resolveInlineLevel, resolveContextSelection, resolveSearchProviderFromPreferences, } from "./preferences-models.js";
+export { resolveModelForUnit, resolveModelWithFallbacksForUnit, getNextFallbackModel, isTransientNetworkError, validateModelId, updatePreferencesModels, resolveDynamicRoutingConfig, resolveAutoSupervisorConfig, resolveProfileDefaults, getProfileTierMap, resolveEffectiveProfile, resolveInlineLevel, resolveContextSelection, resolveSearchProviderFromPreferences, resolveDisabledModelProvidersFromPreferences, } from "./preferences-models.js";
 // ─── Path Constants & Getters ───────────────────────────────────────────────
 function gsdHome() {
     return process.env.GSD_HOME || join(homedir(), ".gsd");
@@ -76,7 +76,7 @@ export function loadProjectGSDPreferences(basePath) {
     return loadPreferencesFile(projectPreferencesPath(basePath), "project")
         ?? loadPreferencesFile(legacyProjectPreferencesPathLowercase(basePath), "project");
 }
-export function loadEffectiveGSDPreferences(basePath) {
+export function loadEffectiveGSDPreferences(basePath, opts) {
     const globalPreferences = loadGlobalGSDPreferences();
     const projectPreferences = loadProjectGSDPreferences(basePath);
     if (!globalPreferences && !projectPreferences)
@@ -105,7 +105,7 @@ export function loadEffectiveGSDPreferences(basePath) {
     // Explicit user preferences always override profile defaults.
     const profile = result.preferences.token_profile;
     if (profile) {
-        const profileDefaults = _resolveProfileDefaults(profile);
+        const profileDefaults = _resolveProfileDefaults(profile, opts?.availableModelIds, result.preferences.dynamic_routing);
         result = {
             ...result,
             preferences: mergePreferences(profileDefaults, result.preferences),
@@ -293,6 +293,7 @@ function mergePreferences(base, override) {
         dynamic_routing: (base.dynamic_routing || override.dynamic_routing)
             ? { ...(base.dynamic_routing ?? {}), ...(override.dynamic_routing ?? {}) }
             : undefined,
+        disabled_model_providers: mergeStringLists(base.disabled_model_providers, override.disabled_model_providers),
         uok: (base.uok || override.uok)
             ? {
                 enabled: override.uok?.enabled ?? base.uok?.enabled,
@@ -346,6 +347,7 @@ function mergePreferences(base, override) {
         service_tier: override.service_tier ?? base.service_tier,
         forensics_dedup: override.forensics_dedup ?? base.forensics_dedup,
         show_token_cost: override.show_token_cost ?? base.show_token_cost,
+        min_request_interval_ms: override.min_request_interval_ms ?? base.min_request_interval_ms,
         codebase: (base.codebase || override.codebase)
             ? {
                 ...(base.codebase ?? {}),

package/dist/resources/extensions/gsd/prompt-loader.js

@@ -7,14 +7,13 @@
  * Templates live at prompts/ relative to this module's directory.
  * They use {{variableName}} syntax for substitution.
  *
- * All templates are eagerly loaded into cache at module init via warmCache().
- * This prevents a running session from being invalidated when another `gsd`
- * launch overwrites ~/.gsd/agent/ with newer templates via initResources().
- * Without eager caching, the in-memory extension code (which knows variable
- * set A) can read a newer template from disk (which expects variable set B),
- * causing a "template declares {{X}} but no value was provided" crash
- * mid-session — especially for late-loading templates like complete-milestone
- * that aren't read until the end of a long auto-mode run.
+ * Templates are snapshotted shortly after module init via warmCache().
+ * This keeps import/extension-registration fast while still preventing a
+ * running session from being invalidated when another `gsd` launch overwrites
+ * ~/.gsd/agent/ with newer templates via initResources(). Without caching, the
+ * in-memory extension code (which knows variable set A) can read a newer
+ * template from disk (which expects variable set B), causing a
+ * "template declares {{X}} but no value was provided" crash mid-session.
  */
 import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { GSDError, GSD_PARSE_ERROR } from "./errors.js";
@@ -69,8 +68,8 @@ const templatesDir = join(__extensionDir, "templates");
 export function getTemplatesDir() {
     return templatesDir;
 }
-// Cache all templates eagerly at module load — a running session uses the
-// template versions that were on disk at startup, immune to later overwrites.
+// Cache all templates from a startup snapshot — a running session uses the
+// template versions that were on disk near startup, immune to later overwrites.
 const templateCache = new Map();
 /**
  * Eagerly read all .md files from prompts/ and templates/ into cache.
@@ -112,8 +111,20 @@ function warmCache() {
         }
     }
 }
-// Snapshot all templates at module load time
-warmCache();
+let warmCacheScheduled = false;
+function scheduleWarmCache() {
+    if (warmCacheScheduled)
+        return;
+    warmCacheScheduled = true;
+    const run = () => {
+        warmCache();
+    };
+    const timer = setTimeout(run, 1000);
+    timer.unref?.();
+}
+// Snapshot the full prompt/template tree after import so extension startup only
+// pays for prompts that are actually needed immediately.
+scheduleWarmCache();
 /**
  * Load a prompt template and substitute variables.
  *

package/dist/resources/extensions/gsd/prompts/complete-milestone.md

@@ -16,6 +16,16 @@ Start with what the excerpts give you. Read full files when the section heads si
 
 **On-demand Read ordering:** Complete all slice SUMMARY Reads you need for cross-slice synthesis, the Decision Re-evaluation table, and LEARNINGS **before** calling `gsd_complete_milestone` (step 10). Once that tool runs, the milestone is marked complete in the DB — running out of tool budget between step 10 and the LEARNINGS write (step 12) leaves the milestone committed without its LEARNINGS artifact.
 
+### Delegate Review Work
+
+This unit runs under the `planning-dispatch` tools-policy: you may use the `subagent` tool to delegate review work that benefits from a fresh context window. For non-trivial milestones, delegate before drafting LEARNINGS:
+
+- **Cross-slice integrations or new public APIs** → dispatch the **reviewer** agent with the milestone diff and roadmap; treat its findings as input to your Decision Re-evaluation and LEARNINGS sections.
+- **Touched auth, network, parsing, file IO, shell exec, or crypto** → dispatch the **security** agent for an OWASP-style audit across the merged slices.
+- **Significant test surface added or changed** → dispatch the **tester** agent to assess coverage gaps relative to the milestone success criteria.
+
+Subagents read the diff and report findings — they do **not** write user source. Apply their feedback into the milestone summary and any captured decisions before calling `gsd_complete_milestone`.
+
 {{inlinedContext}}
 
 Then:

package/dist/resources/extensions/gsd/prompts/complete-slice.md

@@ -20,6 +20,16 @@ All relevant context has been preloaded below — the slice plan, all task summa
 
 **Match effort to complexity.** A simple slice with 1-2 tasks needs a brief summary and lightweight verification. A complex slice with 5 tasks across multiple subsystems needs thorough verification and a detailed summary. Scale the work below accordingly.
 
+### Delegate Review Work
+
+This unit runs under the `planning-dispatch` tools-policy: you may use the `subagent` tool to delegate review work that benefits from a fresh context window. Strongly consider delegating when the slice is non-trivial:
+
+- **Cross-cutting code or new abstractions** → dispatch the **reviewer** agent with the slice diff and plan; apply High/Critical findings before completing.
+- **Touched auth, network, parsing, file IO, shell exec, or crypto** → dispatch the **security** agent for an OWASP-style audit.
+- **Added or modified tests** → dispatch the **tester** agent to assess coverage gaps relative to the slice plan.
+
+Subagents read the diff and report findings — they do **not** write user source. You remain responsible for acting on their feedback before calling `gsd_complete_slice` with `milestoneId` and `sliceId`.
+
 Then:
 1. Use the **Slice Summary** and **UAT** output templates from the inlined context above
 2. {{skillActivation}}

package/dist/resources/extensions/gsd/prompts/guided-discuss-milestone.md

@@ -1,3 +1,5 @@
+**Working directory:** `{{workingDirectory}}`. All file reads, writes, and shell commands MUST operate relative to this directory. Do NOT `cd` to any other directory.
+
 Discuss milestone {{milestoneId}} ("{{milestoneTitle}}"). Identify gray areas, ask the user about them, and write `{{milestoneId}}-CONTEXT.md` in the milestone directory with the decisions. Use the **Context** output template below. If a `GSD Skill Preferences` block is present in system context, use it to decide which skills to load and follow; do not override required artifact rules.
 
 **Structured questions available: {{structuredQuestionsAvailable}}**

package/dist/resources/extensions/gsd/prompts/parallel-research-slices.md

@@ -1,5 +1,7 @@
 # Parallel Slice Research
 
+**Working directory:** `{{workingDirectory}}`. All file reads, writes, and shell commands MUST operate relative to this directory. Do NOT `cd` to any other directory.
+
 You are dispatching parallel research agents for **{{sliceCount}} slices** in milestone **{{mid}} — {{midTitle}}**.
 
 ## Slices to Research

package/dist/resources/extensions/gsd/prompts/plan-slice.md

@@ -20,6 +20,16 @@ Pay particular attention to **Forward Intelligence** sections — they contain h
 
 You have full tool access. Before decomposing, explore the relevant code to ground your plan in reality.
 
+### Delegate Recon and Sub-Decomposition When Useful
+
+This unit runs under the `planning-dispatch` tools-policy: you may use the `subagent` tool to delegate work that benefits from an isolated context window. Prefer delegation over inline work when:
+
+- You'd otherwise read more than ~3 files to understand a subsystem → dispatch the **scout** agent for codebase recon and work from its compressed report.
+- The slice spans multiple subsystems and the decomposition isn't obvious → dispatch the **planner** agent or use the **decompose-into-slices** skill on a focused sub-area, then integrate.
+- You need current external information (library docs, API behavior, recent changes) → dispatch the **researcher** agent.
+
+**Do not** dispatch implementation-tier agents (`worker`, `refactorer`, `tester`) from this unit — they would write user source and bypass this unit's write isolation. Implementation belongs in `execute-task`.
+
 ### Verify Roadmap Assumptions (JIT Reassessment — ADR-003 §4)
 
 Before planning this slice, verify that the roadmap's assumptions still hold given prior slice summaries. Check inlined dependency summaries (below) for discovered constraints, changed approaches, or flagged fragility.

package/dist/resources/extensions/gsd/prompts/refine-slice.md

@@ -20,6 +20,16 @@ Pay particular attention to **Forward Intelligence** sections — they contain h
 
 ## Your Role in the Pipeline
 
+### Delegate Recon When Useful
+
+This unit runs under the `planning-dispatch` tools-policy: you may use the `subagent` tool to delegate recon and sub-decomposition. Prefer delegation over inline work when:
+
+- You'd otherwise read more than ~3 files to understand a subsystem touched by the sketch → dispatch the **scout** agent and work from its compressed report.
+- A specific area of the refinement needs deeper architectural analysis → dispatch the **planner** agent for a focused sub-plan, then integrate.
+- You need current external information (library docs, API behavior) → dispatch the **researcher** agent.
+
+**Do not** dispatch implementation-tier agents (`worker`, `refactorer`, `tester`) — they would write user source and bypass write isolation. Implementation belongs in `execute-task`.
+
 ### Respect the Sketch Scope
 
 The sketch scope inlined above is a **hard constraint**. Plan within it. If, after exploring the codebase, the scope is too narrow to deliver the goal, surface this as a deviation in the plan's narrative and still produce the plan — do not silently expand the scope.

package/dist/resources/extensions/gsd/prompts/rewrite-docs.md

@@ -1,5 +1,7 @@
 You are executing GSD auto-mode.
 
+**Working directory:** `{{workingDirectory}}`. All file reads, writes, and shell commands MUST operate relative to this directory. Do NOT `cd` to any other directory.
+
 ## UNIT: Rewrite Documents — Apply Override(s) for Milestone {{milestoneId}} ("{{milestoneTitle}}")
 
 An override was issued by the user that changes a fundamental decision or approach. Your job is to propagate this change across all active planning documents so they are internally consistent and future tasks execute correctly.

package/dist/resources/extensions/gsd/slice-parallel-orchestrator.js

@@ -32,6 +32,7 @@ let sliceState = null;
 // on next session start. (Issue #4980 HIGH-8)
 const SLICE_ORCHESTRATOR_STATE_FILE = "slice-orchestrator.json";
 const TMP_SUFFIX = ".tmp";
+export const SLICE_WORKER_AUTO_ARGS = ["headless", "--json", "auto"];
 function sliceStateFilePath(basePath) {
     return join(gsdRoot(basePath), SLICE_ORCHESTRATOR_STATE_FILE);
 }
@@ -272,7 +273,7 @@ export function getSliceOrchestratorState() {
 /**
  * Start parallel execution for eligible slices within a milestone.
  *
- * For each eligible slice: create a worktree, spawn `gsd --mode json --print "/gsd auto"`
+ * For each eligible slice: create a worktree, spawn `gsd headless --json auto`
  * with env GSD_SLICE_LOCK=<SID> + GSD_MILESTONE_LOCK=<MID> + GSD_PARALLEL_WORKER=1.
  */
 export async function startSliceParallel(basePath, milestoneId, eligibleSlices, opts = {}) {
@@ -482,8 +483,13 @@ function resolveGsdBin() {
 }
 /**
  * Spawn a worker process for a slice.
- * The worker runs `gsd --mode json --print "/gsd auto"` in the slice's worktree
+ * The worker runs `gsd headless --json auto` in the slice's worktree
  * with GSD_SLICE_LOCK, GSD_MILESTONE_LOCK, and GSD_PARALLEL_WORKER set.
+ *
+ * Print-mode slash commands return after the command handler schedules
+ * auto-mode, so the worker process can exit before doing any LLM work. The
+ * headless auto entrypoint keeps the process alive until auto-mode reaches a
+ * terminal notification, matching milestone-level parallel workers.
  */
 function spawnSliceWorker(basePath, milestoneId, sliceId) {
     if (!sliceState)
@@ -498,7 +504,7 @@ function spawnSliceWorker(basePath, milestoneId, sliceId) {
         return false;
     let child;
     try {
-        child = spawn(process.execPath, [binPath, "--mode", "json", "--print", "/gsd auto"], {
+        child = spawn(process.execPath, [binPath, ...SLICE_WORKER_AUTO_ARGS], {
             cwd: worker.worktreePath,
             env: {
                 ...process.env,

package/dist/resources/extensions/gsd/state.js

@@ -60,6 +60,48 @@ export function isGhostMilestone(basePath, mid) {
     const summary = resolveMilestoneFile(basePath, mid, "SUMMARY");
     return !context && !draft && !roadmap && !summary;
 }
+/**
+ * A "reusable ghost" milestone is an orphaned filesystem stub that is safe
+ * to reclaim as the next milestone ID.
+ *
+ * Stricter than `isGhostMilestone`: returns true ONLY when ALL of the
+ * following hold:
+ *   1. No DB row exists for `mid` (any status, including "queued") — a DB row
+ *      means the milestone was intentionally registered by
+ *      `gsd_milestone_generate_id` and may have an in-flight discuss flow.
+ *      Reusing it would collide with that flow. (#4996 race window)
+ *   2. No worktree directory exists at `gsdRoot/worktrees/{mid}` — a worktree
+ *      means the milestone is legitimately in-flight.
+ *   3. No content files exist (CONTEXT, CONTEXT-DRAFT, ROADMAP, SUMMARY) —
+ *      any content means the discuss flow already ran.
+ *
+ * The looser `isGhostMilestone` also classifies queued-row-without-content as
+ * a ghost to help state queries filter phantoms. `isReusableGhostMilestone`
+ * intentionally does NOT reclaim those — a queued row is sufficient proof of
+ * a live in-flight ID reservation.
+ *
+ * Used by `nextMilestoneIdReserved` and both MCP ID-generator tools to fill
+ * gaps left by phantom directories before resorting to max+1.
+ */
+export function isReusableGhostMilestone(basePath, mid) {
+    // Condition 1: no DB row (any status).
+    if (!isDbAvailable())
+        return false;
+    const dbRow = getMilestone(mid);
+    if (dbRow != null)
+        return false;
+    // Condition 2: no worktree.
+    const root = gsdRoot(basePath);
+    const wtPath = join(root, 'worktrees', mid);
+    if (existsSync(wtPath))
+        return false;
+    // Condition 3: no content files.
+    const context = resolveMilestoneFile(basePath, mid, "CONTEXT");
+    const draft = resolveMilestoneFile(basePath, mid, "CONTEXT-DRAFT");
+    const roadmap = resolveMilestoneFile(basePath, mid, "ROADMAP");
+    const summary = resolveMilestoneFile(basePath, mid, "SUMMARY");
+    return !context && !draft && !roadmap && !summary;
+}
 // ─── Query Functions ───────────────────────────────────────────────────────
 /**
  * Check if all tasks in a slice plan are done.

package/dist/resources/extensions/gsd/templates/PREFERENCES.md

@@ -39,6 +39,7 @@ dynamic_routing:
   budget_pressure:
   cross_provider:
   hooks:
+disabled_model_providers: []
 uok:
   enabled: true
   legacy_fallback:

package/dist/resources/extensions/gsd/tools/memory-tools.js

@@ -59,8 +59,25 @@ export function executeMemoryCapture(params) {
     const scope = normalizeScope(params.scope);
     const tags = normalizeTags(params.tags);
     const structuredFields = normalizeStructuredFields(params.structuredFields);
-    const id = createMemory({ category, content, confidence, scope, tags, structuredFields });
+    let id;
+    try {
+        id = createMemory({ category, content, confidence, scope, tags, structuredFields });
+    }
+    catch (err) {
+        // Surface the underlying SQL message (e.g. "database disk image is
+        // malformed", "no such table: memories") so the operator gets the
+        // actionable signal instead of an opaque "create_failed". See #4967.
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: "text", text: `Error: failed to create memory: ${message}` }],
+            details: { operation: "memory_capture", error: message },
+            isError: true,
+        };
+    }
     if (!id) {
+        // DB unavailable or adapter missing — distinct from the SQL-error path
+        // above. Keep the legacy create_failed token here so any consumers that
+        // explicitly key on the unavailable case continue to work.
         return {
             content: [{ type: "text", text: "Error: failed to create memory." }],
             details: { operation: "memory_capture", error: "create_failed" },

package/dist/resources/extensions/gsd/unit-context-manifest.js

@@ -73,6 +73,18 @@ const COMMON_BUDGET_SMALL = 250_000; // ~65K tokens
 // allowed-path set for the docs policy lives in one reviewable place.
 const TOOLS_ALL = { mode: "all" };
 const TOOLS_PLANNING = { mode: "planning" };
+// Like TOOLS_PLANNING but permits dispatch to read-only recon/planning
+// specialists. Runtime-enforced by write-gate.ts before the subagent tool runs.
+const TOOLS_PLANNING_DISPATCH_RECON = {
+    mode: "planning-dispatch",
+    allowedSubagents: ["scout", "planner"],
+};
+// Like TOOLS_PLANNING_DISPATCH_RECON, but for closeout units that fan out
+// verification work to review-tier specialists.
+const TOOLS_PLANNING_DISPATCH_REVIEW = {
+    mode: "planning-dispatch",
+    allowedSubagents: ["reviewer", "security", "tester"],
+};
 const TOOLS_DOCS = {
     mode: "docs",
     // Globs are resolved relative to project basePath. The set is intentionally
@@ -177,7 +189,11 @@ export const UNIT_MANIFESTS = {
         memory: "prompt-relevant",
         codebaseMap: false,
         preferences: "active-only",
-        tools: TOOLS_PLANNING,
+        // planning-dispatch: completion is a high-leverage place to fan out to
+        // reviewer / security / tester subagents. They read the diff and report
+        // findings; they do not write user source. Write isolation to .gsd/ is
+        // preserved.
+        tools: TOOLS_PLANNING_DISPATCH_REVIEW,
         artifacts: {
             // #4780 landed slice-summary as excerpt for this unit; phase 2 of
             // the architecture will read this manifest as the source of truth
@@ -209,7 +225,10 @@ export const UNIT_MANIFESTS = {
         memory: "prompt-relevant",
         codebaseMap: true,
         preferences: "active-only",
-        tools: TOOLS_PLANNING,
+        // planning-dispatch: allows subagent dispatch so the planner can fan out
+        // to scout for codebase recon and to planner/decompose-style specialists
+        // for sub-decomposition. Write-isolation to .gsd/ is preserved.
+        tools: TOOLS_PLANNING_DISPATCH_RECON,
         artifacts: {
             inline: ["roadmap", "slice-research", "dependency-summaries", "requirements", "decisions", "templates"],
             excerpt: [],
@@ -223,7 +242,10 @@ export const UNIT_MANIFESTS = {
         memory: "prompt-relevant",
         codebaseMap: true,
         preferences: "active-only",
-        tools: TOOLS_PLANNING,
+        // See plan-slice — same rationale: dispatch to scout/planner-style
+        // specialists during refinement is materially better than re-doing recon
+        // inline.
+        tools: TOOLS_PLANNING_DISPATCH_RECON,
         artifacts: {
             inline: ["slice-plan", "slice-research", "dependency-summaries", "templates"],
             excerpt: [],
@@ -251,7 +273,10 @@ export const UNIT_MANIFESTS = {
         memory: "prompt-relevant",
         codebaseMap: false,
         preferences: "active-only",
-        tools: TOOLS_PLANNING,
+        // See complete-milestone — same rationale: dispatch to reviewer / security /
+        // tester subagents to fan out review work without bloating this unit's
+        // context.
+        tools: TOOLS_PLANNING_DISPATCH_REVIEW,
         artifacts: {
             // Phase 3 migration (#4782): matches today's actual
             // buildCompleteSlicePrompt inlining order. Overrides prepend +

package/dist/resources/extensions/gsd/visualizer-overlay.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import { writeExportFile } from "./export.js";
 import { gsdRoot } from "./paths.js";
 import { stripAnsi } from "../shared/mod.js";
-const TAB_COUNT = 10;
+export const TAB_COUNT = 10;
 const TAB_LABELS = [
     "1 Progress",
     "2 Timeline",

package/dist/resources/extensions/gsd/watch/header-renderer.js

@@ -96,13 +96,15 @@ export function readGitBranch(projectRoot) {
     }
 }
 /**
- * Read MCP server names from .mcp.json or .gsd/mcp.json.
+ * Read MCP server names from .mcp.json, .gsd/mcp.json, and the global
+ * ~/.gsd/mcp.json (or $GSD_HOME/mcp.json).
  * Returns array of server name strings.
  */
 export function readMcpServerNames(projectRoot) {
     const configPaths = [
         join(projectRoot, ".mcp.json"),
         join(projectRoot, ".gsd", "mcp.json"),
+        join(process.env.GSD_HOME || join(homedir(), ".gsd"), "mcp.json"),
     ];
     const names = [];
     const seen = new Set();