gsd-pi 2.78.1-dev.0fdacd524 → 2.78.1-dev.2d3fd6e71

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -2,7 +2,7 @@ import { join } from "node:path";
 import { isToolCallEventType } from "@gsd/pi-coding-agent";
 import { updateSnapshot } from "../ecosystem/gsd-extension-api.js";
 import { buildMilestoneFileName, resolveMilestonePath, resolveSliceFile, resolveSlicePath } from "../paths.js";
-import { clearDiscussionFlowState, isDepthConfirmationAnswer, isQueuePhaseActive, markDepthVerified, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, isGateQuestionId, setPendingGate, clearPendingGate, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
+import { canonicalToolName, clearDiscussionFlowState, isDepthConfirmationAnswer, isQueuePhaseActive, markApprovalGateVerified, markDepthVerified, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, isGateQuestionId, setPendingGate, clearPendingGate, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
 import { resolveManifest } from "../unit-context-manifest.js";
 import { isBlockedStateFile, isBashWriteToStateFile, BLOCKED_WRITE_ERROR } from "../write-intercept.js";
 import { loadFile, saveFile, formatContinue } from "../files.js";
@@ -17,9 +17,11 @@ import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
 import { initNotificationWidget } from "../notification-widget.js";
 import { extractSubagentAgentClasses } from "./subagent-input.js";
+import { approvalGateIdForUnit, isExplicitApprovalResponse, shouldPauseForUserApprovalQuestion } from "../user-input-boundary.js";
 // Skip the welcome screen on the very first session_start — cli.ts already
 // printed it before the TUI launched. Only re-print on /clear (subsequent sessions).
 let isFirstSession = true;
+let approvalQuestionAbortInFlight = false;
 async function deriveGsdState(basePath) {
     const { deriveState } = await import("../state.js");
     return deriveState(basePath);
@@ -58,8 +60,9 @@ export function registerHooks(pi, ecosystemHandlers) {
             const { initHealthWidget } = await import("../health-widget.js");
             initHealthWidget(ctx);
         }
-        resetWriteGateState();
+        resetWriteGateState(process.cwd());
         resetToolCallLoopGuard();
+        approvalQuestionAbortInFlight = false;
         await resetAskUserQuestionsTurnCache();
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
@@ -106,10 +109,10 @@ export function registerHooks(pi, ecosystemHandlers) {
     pi.on("session_switch", async (_event, ctx) => {
         initNotificationStore(process.cwd());
         installNotifyInterceptor(ctx);
-        resetWriteGateState();
+        resetWriteGateState(process.cwd());
         resetToolCallLoopGuard();
         await resetAskUserQuestionsTurnCache();
-        clearDiscussionFlowState();
+        clearDiscussionFlowState(process.cwd());
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
         // Skip MCP auto-prep when running inside an auto-worktree. The worktree
@@ -134,6 +137,15 @@ export function registerHooks(pi, ecosystemHandlers) {
         // Wait for ecosystem loader to finish (no-op after first turn).
         const { getEcosystemReadyPromise } = await import("../ecosystem/loader.js");
         await getEcosystemReadyPromise();
+        const beforeAgentBasePath = process.cwd();
+        const pendingApprovalGate = getPendingGate();
+        if (pendingApprovalGate && isExplicitApprovalResponse(event.prompt, pendingApprovalGate)) {
+            markApprovalGateVerified(pendingApprovalGate, beforeAgentBasePath);
+            const milestoneId = extractDepthVerificationMilestoneId(pendingApprovalGate);
+            if (milestoneId)
+                markDepthVerified(milestoneId, beforeAgentBasePath);
+            clearPendingGate(beforeAgentBasePath);
+        }
         // GSD's own context injection (existing behavior — unchanged).
         const { buildBeforeAgentStartResult } = await import("./system-context.js");
         const gsdResult = await buildBeforeAgentStartResult(event, ctx);
@@ -173,6 +185,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         };
     });
     pi.on("agent_end", async (event, ctx) => {
+        approvalQuestionAbortInFlight = false;
         resetToolCallLoopGuard();
         await resetAskUserQuestionsTurnCache();
         const { handleAgentEnd } = await import("./agent-end-recovery.js");
@@ -278,6 +291,44 @@ export function registerHooks(pi, ecosystemHandlers) {
             safetyLogWarning("context-mode", `failed to write compaction snapshot: ${err instanceof Error ? err.message : String(err)}`);
         }
     });
+    pi.on("message_update", async (event, ctx) => {
+        if (approvalQuestionAbortInFlight)
+            return;
+        const dash = getAutoRuntimeSnapshot();
+        let unitType = dash.currentUnit?.type;
+        let unitId = dash.currentUnit?.id;
+        if (!unitType) {
+            try {
+                const { getPendingDeepProjectSetupUnitForContext } = await import("../guided-flow.js");
+                const pending = getPendingDeepProjectSetupUnitForContext(ctx, process.cwd());
+                unitType = pending?.unitType;
+                unitId = pending?.unitId;
+            }
+            catch {
+                // Best-effort foreground detection only.
+            }
+        }
+        if (!unitType) {
+            const milestoneId = await getDiscussionMilestoneIdFor(process.cwd());
+            if (milestoneId) {
+                unitType = "discuss-milestone";
+                unitId = milestoneId;
+            }
+        }
+        if (!shouldPauseForUserApprovalQuestion(unitType, [event.message]))
+            return;
+        const gateId = approvalGateIdForUnit(unitType, unitId);
+        if (gateId)
+            setPendingGate(gateId, process.cwd());
+        approvalQuestionAbortInFlight = true;
+        ctx.ui.notify(`${unitType}${unitId ? ` ${unitId}` : ""} is waiting for your approval - pausing before more tool calls run.`, "info");
+        // The pending gate set above blocks subsequent non-read-only tool calls
+        // via the tool_call hook below, so we do not abort the in-flight stream.
+        // Aborting mid-stream eats the model's question text on external CLI
+        // providers (Claude Code SDK) because lastTextContent isn't populated
+        // from in-flight builder state — the user only ever sees "Claude Code
+        // stream aborted by caller" instead of the question.
+    });
     pi.on("session_shutdown", async (_event, ctx) => {
         const { isParallelActive, shutdownParallel } = await import("../parallel-orchestrator.js");
         if (isParallelActive()) {
@@ -297,19 +348,20 @@ export function registerHooks(pi, ecosystemHandlers) {
     });
     pi.on("tool_call", async (event) => {
         const discussionBasePath = process.cwd();
+        const toolName = canonicalToolName(event.toolName);
         // ── Loop guard: block repeated identical tool calls ──
-        const loopCheck = checkToolCallLoop(event.toolName, event.input);
+        const loopCheck = checkToolCallLoop(toolName, event.input);
         if (loopCheck.block) {
             return { block: true, reason: loopCheck.reason };
         }
         // ── Discussion gate enforcement: track pending gate questions ─────────
         // Only gate-shaped ask_user_questions calls should block execution.
         // The gate stays pending until the user selects the approval option.
-        if (event.toolName === "ask_user_questions") {
+        if (toolName === "ask_user_questions") {
             const questions = event.input?.questions ?? [];
             const questionId = questions.find((question) => typeof question?.id === "string" && isGateQuestionId(question.id))?.id;
             if (typeof questionId === "string") {
-                setPendingGate(questionId);
+                setPendingGate(questionId, discussionBasePath);
             }
         }
         // ── Discussion gate enforcement: block tool calls while gate is pending ──
@@ -323,7 +375,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                     return bashGuard;
             }
             else {
-                const gateGuard = shouldBlockPendingGate(event.toolName, milestoneId, isQueuePhaseActive());
+                const gateGuard = shouldBlockPendingGate(toolName, milestoneId, isQueuePhaseActive());
                 if (gateGuard.block)
                     return gateGuard;
             }
@@ -343,7 +395,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             else if (isToolCallEventType("bash", event)) {
                 queueInput = event.input.command;
             }
-            const queueGuard = shouldBlockQueueExecution(event.toolName, queueInput, true);
+            const queueGuard = shouldBlockQueueExecution(toolName, queueInput, true);
             if (queueGuard.block)
                 return queueGuard;
         }
@@ -447,9 +499,11 @@ export function registerHooks(pi, ecosystemHandlers) {
             // errors and deterministic policy rejections are handled consistently.
             recordToolInvocationError(event.toolName, errorText);
         }
-        if (event.toolName !== "ask_user_questions")
+        const toolName = canonicalToolName(event.toolName);
+        if (toolName !== "ask_user_questions")
             return;
-        const milestoneId = await getDiscussionMilestoneIdFor(process.cwd());
+        const basePath = process.cwd();
+        const milestoneId = await getDiscussionMilestoneIdFor(basePath);
         const queueActive = isQueuePhaseActive();
         const details = event.details;
         // ── Discussion gate enforcement: handle gate question responses ──
@@ -461,15 +515,36 @@ export function registerHooks(pi, ecosystemHandlers) {
         const currentPendingGate = getPendingGate();
         if (currentPendingGate) {
             if (details?.cancelled || !details?.response) {
-                // Gate stays pending — model will be blocked from non-read-only tools
-                // until it re-asks and gets a valid response
+                // Gate stays pending. Direct the agent to the most reliable recovery
+                // path — re-calling ask_user_questions with the same gate id — without
+                // misrepresenting the plain-text path. The plain-text path also works
+                // (isExplicitApprovalResponse on the next before_agent_start clears
+                // the gate when the user replies with an approval keyword), but the
+                // structured re-ask is more deterministic and gives the user a clear UI.
+                resetToolCallLoopGuard();
+                return {
+                    content: [{
+                            type: "text",
+                            text: [
+                                `HARD BLOCK: approval gate "${currentPendingGate}" is still pending.`,
+                                "No user response was received for the confirmation question.",
+                                "Do not infer approval from earlier or prior messages.",
+                                "Do not proceed, write files, save artifacts, or call other tools.",
+                                `Re-call ask_user_questions with the same gate question id ("${currentPendingGate}") and wait for the user's response.`,
+                            ].join(" "),
+                        }],
+                };
             }
             else {
                 const pendingQuestion = questions.find((question) => question?.id === currentPendingGate);
                 if (pendingQuestion) {
                     const answer = details.response?.answers?.[currentPendingGate];
                     if (isDepthConfirmationAnswer(answer?.selected, pendingQuestion.options)) {
-                        clearPendingGate();
+                        markApprovalGateVerified(currentPendingGate, basePath);
+                        const milestoneIdFromGate = extractDepthVerificationMilestoneId(currentPendingGate);
+                        if (milestoneIdFromGate)
+                            markDepthVerified(milestoneIdFromGate, basePath);
+                        clearPendingGate(basePath);
                     }
                 }
             }
@@ -483,8 +558,11 @@ export function registerHooks(pi, ecosystemHandlers) {
                 const answer = details.response?.answers?.[question.id];
                 const inferredMilestoneId = extractDepthVerificationMilestoneId(question.id) ?? milestoneId;
                 if (isDepthConfirmationAnswer(answer?.selected, question.options)) {
-                    markDepthVerified(inferredMilestoneId);
-                    clearPendingGate();
+                    if (currentPendingGate && question.id !== currentPendingGate)
+                        break;
+                    markApprovalGateVerified(question.id, basePath);
+                    markDepthVerified(inferredMilestoneId, basePath);
+                    clearPendingGate(basePath);
                 }
                 break;
             }
@@ -493,7 +571,6 @@ export function registerHooks(pi, ecosystemHandlers) {
             return;
         if (!milestoneId)
             return;
-        const basePath = process.cwd();
         const milestoneDir = resolveMilestonePath(basePath, milestoneId);
         if (!milestoneDir)
             return;

package/dist/resources/extensions/gsd/bootstrap/system-context.js

@@ -1,5 +1,4 @@
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
-import { homedir } from "node:os";
 import { join } from "node:path";
 import { logWarning } from "../workflow-logger.js";
 import { debugTime } from "../debug-logger.js";
@@ -17,7 +16,7 @@ import { deriveState } from "../state.js";
 import { formatOverridesSection, formatShortcut, loadActiveOverrides, loadFile, parseContinue, parseSummary } from "../files.js";
 import { toPosixPath } from "../../shared/mod.js";
 import { autoEnableCmuxPreferences } from "../commands-cmux.js";
-const gsdHome = process.env.GSD_HOME || join(homedir(), ".gsd");
+import { gsdHome } from "../gsd-home.js";
 /**
  * Bundled skill triggers — resolved dynamically at runtime instead of
  * hardcoding absolute paths in the system prompt template. Only skills
@@ -75,7 +74,7 @@ function buildBundledSkillsTable() {
 }
 function warnDeprecatedAgentInstructions() {
     const paths = [
-        join(gsdHome, "agent-instructions.md"),
+        join(gsdHome(), "agent-instructions.md"),
         join(process.cwd(), ".gsd", "agent-instructions.md"),
     ];
     for (const path of paths) {
@@ -119,7 +118,7 @@ export async function buildBeforeAgentStartResult(event, ctx) {
             ctx.ui.notify(`GSD skill preferences: ${report.warnings.length} unresolved skill${report.warnings.length === 1 ? "" : "s"}: ${report.warnings.join(", ")}`, "warning");
         }
     }
-    const { block: knowledgeBlock, globalSizeKb } = loadKnowledgeBlock(gsdHome, process.cwd());
+    const { block: knowledgeBlock, globalSizeKb } = loadKnowledgeBlock(gsdHome(), process.cwd());
     if (globalSizeKb > 4) {
         ctx.ui.notify(`GSD: ~/.gsd/agent/KNOWLEDGE.md is ${globalSizeKb.toFixed(1)}KB — consider trimming to keep system prompt lean.`, "warning");
     }

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -55,18 +55,31 @@ const QUEUE_SAFE_TOOLS = new Set([
  *   true / false        — shell no-ops / test exit codes
  */
 const BASH_READ_ONLY_RE = /^\s*(cat|head|tail|less|more|wc|file|stat|du|df|which|type|echo|printf|ls|find|grep|rg|awk|sed\b(?!.*-i)|sort|uniq|diff|comm|tr|cut|tee\s+-a\s+\/dev\/null|git\s+(log|show|diff|status|branch|tag|remote|rev-parse|ls-files|blame|shortlog|describe|stash\s+list|config\s+--get|cat-file)|gh\s+(issue|pr|api|repo|release)\s+(view|list|diff|status|checks)|mkdir\s+-p\s+\.gsd|rtk\s|npm\s+run\s+(test|test:\w+|lint|lint:\w+|typecheck|type-check|type-check:\w+|check|verify|audit|outdated|format:check|ci|validate)\b|npm\s+(ls|list|info|view|show|outdated|audit|explain|doctor|ping|--version|-v)\b|npx\s|tsx\s|node\s+(--print|--version|-v\b)|python[23]?\s+(-c\s+'[^']*'|--version|-V\b|-m\s+(pip\s+show|pip\s+list|site))|pip[23]?\s+(show|list|freeze|check|index\s+versions)\b|jq\s|yq\s|curl\s+(-s\b|--silent\b)(?!\s+[^|>]*\s-[oO]\b)(?!\s+[^|>]*\s--output\b)[^|>]*$|openssl\s+(version|x509|s_client)|env\b|printenv\b|true\b|false\b)/;
-const verifiedDepthMilestones = new Set();
-let activeQueuePhase = false;
+function createEmptyWriteGateState() {
+    return {
+        verifiedDepthMilestones: new Set(),
+        verifiedApprovalGates: new Set(),
+        activeQueuePhase: false,
+        pendingGateId: null,
+    };
+}
+const writeGateStatesByBasePath = new Map();
+function writeGateStateKey(basePath) {
+    return resolve(basePath);
+}
+function getWriteGateState(basePath = process.cwd()) {
+    const key = writeGateStateKey(basePath);
+    let state = writeGateStatesByBasePath.get(key);
+    if (!state) {
+        state = createEmptyWriteGateState();
+        writeGateStatesByBasePath.set(key, state);
+    }
+    return state;
+}
 /**
- * Discussion gate enforcement state.
- *
- * When ask_user_questions is called with a recognized gate question ID,
- * we track the pending gate. Until the gate is confirmed (user selects the
- * first/recommended option), all non-read-only tool calls are blocked.
- * This mechanically prevents the model from rationalizing past failed or
- * cancelled gate questions.
+ * Discussion gate enforcement state is scoped per basePath so multiple
+ * workspaces can coexist in the same process without sharing gate state.
  */
-let pendingGateId = null;
 /**
  * Recognized gate question ID patterns.
  * These appear in discuss.md (depth/requirements/roadmap).
@@ -76,14 +89,18 @@ const GATE_QUESTION_PATTERNS = [
 ];
 /**
  * Tools that are safe to call while a gate is pending.
- * Includes read-only tools and ask_user_questions itself (so the model can re-ask).
+ * Only ask_user_questions may run: once the assistant asks for confirmation,
+ * further reads/searches bury the actual question in tool output.
  */
 const GATE_SAFE_TOOLS = new Set([
     "ask_user_questions",
-    "read", "grep", "find", "ls", "glob",
-    "search-the-web", "resolve_library", "get_library_docs", "fetch_page",
-    "search_and_read",
 ]);
+export function canonicalToolName(toolName) {
+    if (!toolName.startsWith("mcp__"))
+        return toolName;
+    const toolSeparator = toolName.indexOf("__", "mcp__".length);
+    return toolSeparator >= 0 ? toolName.slice(toolSeparator + 2) : toolName;
+}
 /**
  * Persistence is ON by default (opt-out).
  * Set GSD_PERSIST_WRITE_GATE_STATE="0" or GSD_PERSIST_WRITE_GATE_STATE="false"
@@ -94,23 +111,25 @@ function shouldPersistWriteGateSnapshot(env = process.env) {
     const v = env.GSD_PERSIST_WRITE_GATE_STATE;
     return v !== "0" && v !== "false";
 }
-function writeGateSnapshotPath(basePath = process.cwd()) {
+function writeGateSnapshotPath(basePath) {
     return join(basePath, ".gsd", "runtime", "write-gate-state.json");
 }
-function currentWriteGateSnapshot() {
+function currentWriteGateSnapshot(basePath = process.cwd()) {
+    const state = getWriteGateState(basePath);
     return {
-        verifiedDepthMilestones: [...verifiedDepthMilestones].sort(),
-        activeQueuePhase,
-        pendingGateId,
+        verifiedDepthMilestones: [...state.verifiedDepthMilestones].sort(),
+        verifiedApprovalGates: [...state.verifiedApprovalGates].sort(),
+        activeQueuePhase: state.activeQueuePhase,
+        pendingGateId: state.pendingGateId,
     };
 }
-function persistWriteGateSnapshot(basePath = process.cwd()) {
+function persistWriteGateSnapshot(basePath) {
     if (!shouldPersistWriteGateSnapshot())
         return;
     const path = writeGateSnapshotPath(basePath);
     mkdirSync(join(basePath, ".gsd", "runtime"), { recursive: true });
     const tempPath = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-    writeFileSync(tempPath, JSON.stringify(currentWriteGateSnapshot(), null, 2), "utf-8");
+    writeFileSync(tempPath, JSON.stringify(currentWriteGateSnapshot(basePath), null, 2), "utf-8");
     try {
         renameSync(tempPath, path);
     }
@@ -126,7 +145,7 @@ function persistWriteGateSnapshot(basePath = process.cwd()) {
         }
     }
 }
-function clearPersistedWriteGateSnapshot(basePath = process.cwd()) {
+function clearPersistedWriteGateSnapshot(basePath) {
     if (!shouldPersistWriteGateSnapshot())
         return;
     const path = writeGateSnapshotPath(basePath);
@@ -142,18 +161,23 @@ function normalizeWriteGateSnapshot(value) {
     const verified = Array.isArray(record.verifiedDepthMilestones)
         ? record.verifiedDepthMilestones.filter((item) => typeof item === "string")
         : [];
+    const verifiedGates = Array.isArray(record.verifiedApprovalGates)
+        ? record.verifiedApprovalGates.filter((item) => typeof item === "string")
+        : [];
     return {
         verifiedDepthMilestones: [...new Set(verified)].sort(),
+        verifiedApprovalGates: [...new Set(verifiedGates)].sort(),
         activeQueuePhase: record.activeQueuePhase === true,
         pendingGateId: typeof record.pendingGateId === "string" ? record.pendingGateId : null,
     };
 }
 const EMPTY_SNAPSHOT = {
     verifiedDepthMilestones: [],
+    verifiedApprovalGates: [],
     activeQueuePhase: false,
     pendingGateId: null,
 };
-export function loadWriteGateSnapshot(basePath = process.cwd()) {
+export function loadWriteGateSnapshot(basePath) {
     const path = writeGateSnapshotPath(basePath);
     if (!existsSync(path)) {
         // When persist mode is active and the file has been deleted, treat it as a
@@ -161,55 +185,66 @@ export function loadWriteGateSnapshot(basePath = process.cwd()) {
         // In non-persist mode the file is never written, so fall back to in-memory.
         if (shouldPersistWriteGateSnapshot())
             return EMPTY_SNAPSHOT;
-        return currentWriteGateSnapshot();
+        return currentWriteGateSnapshot(basePath);
     }
     try {
         return normalizeWriteGateSnapshot(JSON.parse(readFileSync(path, "utf-8")));
     }
     catch {
-        return currentWriteGateSnapshot();
+        return currentWriteGateSnapshot(basePath);
     }
 }
-export function isDepthVerified() {
-    return verifiedDepthMilestones.size > 0;
+export function isDepthVerified(basePath = process.cwd()) {
+    return getWriteGateState(basePath).verifiedDepthMilestones.size > 0;
 }
 /**
  * Check whether a specific milestone has passed depth verification.
  */
-export function isMilestoneDepthVerified(milestoneId) {
+export function isMilestoneDepthVerified(milestoneId, basePath = process.cwd()) {
     if (!milestoneId)
         return false;
-    return verifiedDepthMilestones.has(milestoneId);
+    return getWriteGateState(basePath).verifiedDepthMilestones.has(milestoneId);
 }
 export function isMilestoneDepthVerifiedInSnapshot(snapshot, milestoneId) {
     if (!milestoneId)
         return false;
     return snapshot.verifiedDepthMilestones.includes(milestoneId);
 }
-export function isQueuePhaseActive() {
-    return activeQueuePhase;
+export function isQueuePhaseActive(basePath = process.cwd()) {
+    return getWriteGateState(basePath).activeQueuePhase;
 }
-export function setQueuePhaseActive(active) {
-    activeQueuePhase = active;
-    persistWriteGateSnapshot();
+export function setQueuePhaseActive(active, basePath) {
+    getWriteGateState(basePath).activeQueuePhase = active;
+    persistWriteGateSnapshot(basePath);
 }
-export function resetWriteGateState() {
-    verifiedDepthMilestones.clear();
-    pendingGateId = null;
-    persistWriteGateSnapshot();
+export function resetWriteGateState(basePath) {
+    const state = getWriteGateState(basePath);
+    state.verifiedDepthMilestones.clear();
+    state.verifiedApprovalGates.clear();
+    state.pendingGateId = null;
+    persistWriteGateSnapshot(basePath);
 }
-export function clearDiscussionFlowState() {
-    verifiedDepthMilestones.clear();
-    activeQueuePhase = false;
-    pendingGateId = null;
-    clearPersistedWriteGateSnapshot();
+export function clearDiscussionFlowState(basePath) {
+    writeGateStatesByBasePath.delete(writeGateStateKey(basePath));
+    clearPersistedWriteGateSnapshot(basePath);
 }
 export function markDepthVerified(milestoneId, basePath = process.cwd()) {
     if (!milestoneId)
         return;
-    verifiedDepthMilestones.add(milestoneId);
+    getWriteGateState(basePath).verifiedDepthMilestones.add(milestoneId);
     persistWriteGateSnapshot(basePath);
 }
+export function markApprovalGateVerified(gateId, basePath = process.cwd()) {
+    if (!gateId)
+        return;
+    getWriteGateState(basePath).verifiedApprovalGates.add(gateId);
+    persistWriteGateSnapshot(basePath);
+}
+export function isApprovalGateVerifiedInSnapshot(snapshot, gateId) {
+    if (!gateId)
+        return false;
+    return (snapshot.verifiedApprovalGates ?? []).includes(gateId);
+}
 /**
  * Check whether a question ID matches a recognized gate pattern.
  */
@@ -234,29 +269,34 @@ function extractContextMilestoneId(inputPath) {
 /**
  * Mark a gate as pending (called when ask_user_questions is invoked with a gate ID).
  */
-export function setPendingGate(gateId) {
-    pendingGateId = gateId;
-    persistWriteGateSnapshot();
+export function setPendingGate(gateId, basePath) {
+    const state = getWriteGateState(basePath);
+    state.pendingGateId = gateId;
+    state.verifiedApprovalGates.delete(gateId);
+    const milestoneId = extractDepthVerificationMilestoneId(gateId);
+    if (milestoneId)
+        state.verifiedDepthMilestones.delete(milestoneId);
+    persistWriteGateSnapshot(basePath);
 }
 /**
  * Clear the pending gate (called when the user confirms).
  */
-export function clearPendingGate() {
-    pendingGateId = null;
-    persistWriteGateSnapshot();
+export function clearPendingGate(basePath) {
+    getWriteGateState(basePath).pendingGateId = null;
+    persistWriteGateSnapshot(basePath);
 }
 /**
  * Get the currently pending gate, if any.
  */
-export function getPendingGate() {
-    return pendingGateId;
+export function getPendingGate(basePath = process.cwd()) {
+    return getWriteGateState(basePath).pendingGateId;
 }
 /**
  * Check whether a tool call should be blocked because a discussion gate
  * is pending (ask_user_questions was called but not confirmed).
  *
  * Returns { block: true, reason } if the tool should be blocked.
- * Read-only tools and ask_user_questions itself are always allowed.
+ * ask_user_questions itself is allowed so the model can re-ask the gate.
  */
 export function shouldBlockPendingGate(toolName, milestoneId, queuePhaseActive) {
     return shouldBlockPendingGateInSnapshot(currentWriteGateSnapshot(), toolName, milestoneId, queuePhaseActive);
@@ -264,16 +304,14 @@ export function shouldBlockPendingGate(toolName, milestoneId, queuePhaseActive)
 export function shouldBlockPendingGateInSnapshot(snapshot, toolName, _milestoneId, _queuePhaseActive) {
     if (!snapshot.pendingGateId)
         return { block: false };
-    if (GATE_SAFE_TOOLS.has(toolName))
+    if (GATE_SAFE_TOOLS.has(canonicalToolName(toolName)))
         return { block: false };
-    // Bash read-only commands are also safe
-    if (toolName === "bash")
-        return { block: false }; // bash is checked separately below
     return {
         block: true,
         reason: [
             `HARD BLOCK: Discussion gate "${snapshot.pendingGateId}" has not been confirmed by the user.`,
-            `You MUST re-call ask_user_questions with the gate question before making any other tool calls.`,
+            `The assistant already asked for user confirmation, so do not call more tools.`,
+            `Wait for the user's answer, or re-call ask_user_questions with the gate question if the question was not delivered.`,
             `If the previous ask_user_questions call failed, errored, was cancelled, or the user's response`,
             `did not match a provided option, you MUST re-ask — never rationalize past the block.`,
             `Do NOT proceed, do NOT use alternative approaches, do NOT skip the gate.`,
@@ -282,7 +320,7 @@ export function shouldBlockPendingGateInSnapshot(snapshot, toolName, _milestoneI
 }
 /**
  * Check whether a bash command should be blocked because a discussion gate is pending.
- * Read-only bash commands are allowed; mutating commands are blocked.
+ * All bash is blocked while waiting for confirmation so the question stays visible.
  */
 export function shouldBlockPendingGateBash(command, milestoneId, queuePhaseActive) {
     return shouldBlockPendingGateBashInSnapshot(currentWriteGateSnapshot(), command, milestoneId, queuePhaseActive);
@@ -290,14 +328,12 @@ export function shouldBlockPendingGateBash(command, milestoneId, queuePhaseActiv
 export function shouldBlockPendingGateBashInSnapshot(snapshot, command, _milestoneId, _queuePhaseActive) {
     if (!snapshot.pendingGateId)
         return { block: false };
-    // Allow read-only bash commands
-    if (BASH_READ_ONLY_RE.test(command))
-        return { block: false };
     return {
         block: true,
         reason: [
             `HARD BLOCK: Discussion gate "${snapshot.pendingGateId}" has not been confirmed by the user.`,
-            `You MUST re-call ask_user_questions with the gate question before running mutating commands.`,
+            `The assistant already asked for user confirmation, so do not run bash commands.`,
+            `Wait for the user's answer, or re-call ask_user_questions with the gate question if the question was not delivered.`,
             `If the previous ask_user_questions call failed, errored, was cancelled, or the user's response`,
             `did not match a provided option, you MUST re-ask — never rationalize past the block.`,
         ].join(" "),
@@ -390,6 +426,49 @@ export function shouldBlockContextArtifactSaveInSnapshot(snapshot, artifactType,
         ].join(" "),
     };
 }
+const FINAL_ROOT_ARTIFACTS = new Set(["PROJECT", "REQUIREMENTS"]);
+function requiredRootApprovalGateForArtifact(artifactType) {
+    if (artifactType === "PROJECT")
+        return "depth_verification_project_confirm";
+    if (artifactType === "REQUIREMENTS")
+        return "depth_verification_requirements_confirm";
+    return null;
+}
+/**
+ * Final root project artifacts are the output of the project/requirements
+ * approval gates. Drafts remain writable so the agent can prepare previews,
+ * but PROJECT.md and REQUIREMENTS.md must wait for explicit approval. Deep
+ * mode can additionally require a positive verified gate, not just no pending
+ * gate, so missed detectors fail closed.
+ */
+export function shouldBlockRootArtifactSaveInSnapshot(snapshot, artifactType, opts = {}) {
+    if (!FINAL_ROOT_ARTIFACTS.has(artifactType))
+        return { block: false };
+    if (snapshot.pendingGateId) {
+        return {
+            block: true,
+            reason: [
+                `HARD BLOCK: Cannot save ${artifactType}.md because discussion gate "${snapshot.pendingGateId}" has not been confirmed by the user.`,
+                `This is a mechanical gate — wait for explicit user approval before writing final project setup artifacts.`,
+                `If approval was requested in plain text, the user must reply with explicit approval before this write is allowed.`,
+            ].join(" "),
+        };
+    }
+    if (opts.requireVerifiedApproval) {
+        const requiredGate = requiredRootApprovalGateForArtifact(artifactType);
+        if (requiredGate && !isApprovalGateVerifiedInSnapshot(snapshot, requiredGate)) {
+            return {
+                block: true,
+                reason: [
+                    `HARD BLOCK: Cannot save ${artifactType}.md before explicit approval gate "${requiredGate}" is verified.`,
+                    `Deep planning root artifacts are fail-closed: absence of a pending gate is not approval.`,
+                    `Ask the user to confirm the ${artifactType}.md preview and wait for an explicit approval response.`,
+                ].join(" "),
+            };
+        }
+    }
+    return { block: false };
+}
 /**
  * Queue-mode execution guard (#2545).
  *

package/dist/resources/extensions/gsd/branch-patterns.js

@@ -3,11 +3,11 @@
  *
  * gsd/<worktree>/<milestone>/<slice>  → SLICE_BRANCH_RE
  * gsd/quick/<id>-<slug>               → QUICK_BRANCH_RE
- * gsd/<workflow>/<...>                 → WORKFLOW_BRANCH_RE (non-milestone gsd/ branches)
+ * gsd/<workflow-template>/<...>        → WORKFLOW_BRANCH_RE
  */
 /** Matches gsd/ slice branches: gsd/[worktree/]M001[-hash]/S01 */
 export const SLICE_BRANCH_RE = /^gsd\/(?:([a-zA-Z0-9_-]+)\/)?(M\d+(?:-[a-z0-9]{6})?)\/(S\d+)$/;
 /** Matches gsd/quick/ task branches */
 export const QUICK_BRANCH_RE = /^gsd\/quick\//;
-/** Matches gsd/ workflow branches (non-milestone, e.g. gsd/workflow-name/...) */
-export const WORKFLOW_BRANCH_RE = /^gsd\/(?!M\d)[\w-]+\//;
+/** Matches GSD-generated workflow template branches, not arbitrary user gsd/* branches. */
+export const WORKFLOW_BRANCH_RE = /^gsd\/(?:hotfix|bugfix|small-feature|refactor|spike|security-audit|dep-upgrade|full-project)\//;