gsd-pi 2.80.0-dev.4ea7d80e7 → 2.80.0-dev.4edec4620

package/dist/resources/extensions/gsd/prompts/replan-slice.md

@@ -8,7 +8,7 @@ Your working directory is `{{workingDirectory}}`. All file reads, writes, and sh
 
 A completed task reported `blocker_discovered: true`, meaning the current slice plan cannot be executed as-is. Your job is to rewrite the remaining tasks in the slice plan to address the blocker while preserving all completed work.
 
-All relevant context has been preloaded below — the roadmap, current slice plan, the blocker task summary, and decisions are inlined. Start working immediately without re-reading these files.
+All relevant context has been preloaded below — the roadmap, current slice plan, blocker task summary excerpt, and decisions are inlined. Start working immediately without re-reading these files.
 
 {{inlinedContext}}
 
@@ -30,7 +30,7 @@ Consider these captures when rewriting the remaining tasks — they represent th
 
 ## Instructions
 
-1. Read the blocker task summary carefully. Understand exactly what was discovered and why it blocks the current plan.
+1. Use the inlined blocker summary excerpt first. Read the full blocker task summary only if the excerpt is absent, marked truncated, or lacks the specific blocker evidence needed to replan.
 2. Analyze the remaining `[ ]` tasks in the slice plan. Determine which are still valid, which need modification, and which should be replaced.
 3. **Persist replan state through `gsd_replan_slice`.** Call it with: `milestoneId`, `sliceId`, `blockerTaskId`, `blockerDescription`, `whatChanged`, `updatedTasks` (array of task objects with taskId, title, description, estimate, files, verify, inputs, expectedOutput), `removedTaskIds` (array of task ID strings). The tool structurally enforces preservation of completed tasks, writes replan history to the DB, re-renders `{{planPath}}`, and renders `{{replanPath}}`. Preserve or update the Threat Surface and Requirement Impact sections if the replan changes the slice's security posture or requirement coverage.
 4. If any incomplete task had a `T0x-PLAN.md`, remove or rewrite it to match the new task description.

package/dist/resources/extensions/gsd/prompts/validate-milestone.md

@@ -27,13 +27,13 @@ Roadmap, slice summaries, assessments, requirements, decisions, and project cont
 Call `subagent` with `tasks: [...]` containing ALL THREE reviewers simultaneously:
 
 **Reviewer A - Requirements Coverage**
-Prompt: "Review milestone {{milestoneId}} requirements coverage. Working directory: {{workingDirectory}}. Read `.gsd/{{milestoneId}}/REQUIREMENTS.md` or equivalent. For each requirement, check slice SUMMARY files in `.gsd/{{milestoneId}}/` and mark COVERED, PARTIAL, or MISSING. Output table: Requirement | Status | Evidence. End with one-line verdict: PASS if all covered, NEEDS-ATTENTION if partials exist, FAIL if any missing."
+Prompt: "Review milestone {{milestoneId}} requirements coverage. Working directory: {{workingDirectory}}. Read `.gsd/REQUIREMENTS.md` or use the inlined requirements context. For each requirement, check slice SUMMARY files under `.gsd/milestones/{{milestoneId}}/slices/` and mark COVERED, PARTIAL, or MISSING. Output table: Requirement | Status | Evidence. End with one-line verdict: PASS if all covered, NEEDS-ATTENTION if partials exist, FAIL if any missing."
 
 **Reviewer B - Cross-Slice Integration**
 Prompt: "Review milestone {{milestoneId}} cross-slice integration. Working directory: {{workingDirectory}}. Read `{{roadmapPath}}` and find the boundary map (produces/consumes contracts). For each boundary, confirm producer SUMMARY produced the artifact and consumer SUMMARY consumed it. Output table: Boundary | Producer Summary | Consumer Summary | Status. End with one-line verdict: PASS if all boundaries honored, NEEDS-ATTENTION if any gaps."
 
 **Reviewer C - Assessment & Acceptance Criteria**
-Prompt: "Review milestone {{milestoneId}} assessment evidence and acceptance criteria. Working directory: {{workingDirectory}}. Read `.gsd/{{milestoneId}}/CONTEXT.md` for criteria. Check slice ASSESSMENT files. Verify each criterion maps to a passing assessment or clear SUMMARY evidence. Then review inlined milestone verification classes. For each non-empty planned class, output table: Class | Planned Check | Evidence | Verdict. Use the exact class names `Contract`, `Integration`, `Operational`, and `UAT` whenever those classes are present. If no verification classes were planned, say that explicitly. Output sections `Acceptance Criteria` with checklist `[ ] Criterion | Evidence`, and `Verification Classes` with the table. End with one-line verdict: PASS if all criteria and classes are covered, NEEDS-ATTENTION if gaps exist."
+Prompt: "Review milestone {{milestoneId}} assessment evidence and acceptance criteria. Working directory: {{workingDirectory}}. Read `.gsd/milestones/{{milestoneId}}/{{milestoneId}}-CONTEXT.md` for criteria. Check slice SUMMARY/UAT files under `.gsd/milestones/{{milestoneId}}/slices/`. Verify each criterion maps to passing evidence. Then review inlined milestone verification classes. For each non-empty planned class, output table: Class | Planned Check | Evidence | Verdict. Use the exact class names `Contract`, `Integration`, `Operational`, and `UAT` whenever those classes are present. If no verification classes were planned, say that explicitly. Output sections `Acceptance Criteria` with checklist `[ ] Criterion | Evidence`, and `Verification Classes` with the table. End with one-line verdict: PASS if all criteria and classes are covered, NEEDS-ATTENTION if gaps exist."
 
 ### Step 2 - Synthesize Findings
 

package/dist/resources/extensions/gsd/quick.js

@@ -8,8 +8,8 @@
  * Quick tasks live in `.gsd/quick/` and are tracked in STATE.md's
  * "Quick Tasks Completed" table.
  */
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
 import { loadPrompt } from "./prompt-loader.js";
 import { gsdRoot } from "./paths.js";
 import { GitServiceImpl, runGit } from "./git-service.js";
@@ -64,6 +64,37 @@ function ensureQuickDir(basePath, taskNum, slug) {
     mkdirSync(taskDir, { recursive: true });
     return taskDir;
 }
+function isPathInside(parent, child) {
+    const rel = relative(parent, child);
+    return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+function isExternalGsdRoot(basePath, root) {
+    try {
+        return !isPathInside(realpathSync(basePath), realpathSync(root));
+    }
+    catch {
+        return !isPathInside(basePath, root);
+    }
+}
+export function buildQuickCommitInstruction(basePath, root) {
+    const externalState = isExternalGsdRoot(basePath, root);
+    if (externalState) {
+        return [
+            "Commit repo changes atomically, but do not stage or commit `.gsd/quick/...`:",
+            "   - `.gsd/` resolves outside this git repository, so Git cannot stage quick-task summary files from the project repo.",
+            "   - Write the quick summary file directly at the requested path; that file is persisted by GSD external state.",
+            "   - Stage and commit only implementation/test/docs files that live inside the repository.",
+            "   - If the task only writes quick-task research/summary files and no repository files changed, do not run `git commit`; report that there was nothing in the project repo to commit.",
+        ].join("\n");
+    }
+    return [
+        "Commit your changes atomically:",
+        "   - Use conventional commit messages (feat:, fix:, refactor:, etc.)",
+        "   - Stage only relevant files — never commit secrets or runtime files.",
+        "   - Commit logical units separately if the task involves distinct changes.",
+        "   - Quick tasks run outside the auto-mode lifecycle — there is no system auto-commit, so commit directly here.",
+    ].join("\n");
+}
 function quickReturnStatePath(basePath) {
     return join(gsdRoot(basePath), "runtime", "quick-return.json");
 }
@@ -198,6 +229,7 @@ export async function handleQuick(args, ctx, pi) {
         taskDir: taskDirRel,
         branch: actualBranch,
         summaryPath,
+        commitInstruction: buildQuickCommitInstruction(basePath, root),
         date,
         taskNum: String(taskNum),
         slug,

package/dist/resources/extensions/gsd/safety/evidence-collector.js

@@ -14,6 +14,14 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, } from "node:fs";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
+const EXECUTION_TOOL_NAMES = new Set([
+    "bash",
+    "Bash",
+    "gsd_exec",
+    "gsd_exec_search",
+    "mcp__gsd-workflow__gsd_exec",
+    "mcp__gsd-workflow__gsd_exec_search",
+]);
 // ─── Module State ───────────────────────────────────────────────────────────
 let unitEvidence = [];
 // ─── Public API ─────────────────────────────────────────────────────────────
@@ -129,11 +137,11 @@ export function clearEvidenceFromDisk(basePath, milestoneId, sliceId, taskId) {
  * Exit codes and output are filled in by recordToolResult after execution.
  */
 export function recordToolCall(toolCallId, toolName, input) {
-    if (toolName === "bash" || toolName === "Bash") {
+    if (EXECUTION_TOOL_NAMES.has(toolName)) {
         unitEvidence.push({
             kind: "bash",
             toolCallId,
-            command: String(input.command ?? ""),
+            command: String(input.command ?? input.cmd ?? input.query ?? ""),
             exitCode: -1,
             outputSnippet: "",
             timestamp: Date.now(),

package/dist/resources/extensions/gsd/slice-cadence.js

@@ -1,3 +1,5 @@
+// Project/App: GSD-2
+// File Purpose: Slice-cadence merge and milestone resquash git operations.
 /**
  * Slice-cadence collapse — #4765.
  *
@@ -29,6 +31,7 @@ import { logWarning } from "./workflow-logger.js";
 import { emitSliceMerged, emitMilestoneResquash } from "./worktree-telemetry.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
+import { getMilestone, getSlice, isDbAvailable } from "./gsd-db.js";
 /**
  * Auto-worktree milestone branch name. Must match autoWorktreeBranch() in
  * auto-worktree.ts; duplicated here to avoid a cyclic import.
@@ -59,6 +62,46 @@ function cleanupMergeArtifacts(projectRoot) {
         logWarning("worktree", `merge artifact cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+function stripKnownIdPrefix(value, id) {
+    const raw = String(value ?? "").trim();
+    if (!raw)
+        return undefined;
+    const lower = raw.toLowerCase();
+    const idLower = id.toLowerCase();
+    if (lower.startsWith(`${idLower}:`))
+        return raw.slice(id.length + 1).trim() || undefined;
+    return raw;
+}
+function getSliceMergeNames(milestoneId, sliceId) {
+    if (!isDbAvailable())
+        return {};
+    return {
+        milestoneTitle: stripKnownIdPrefix(getMilestone(milestoneId)?.title, milestoneId),
+        sliceTitle: stripKnownIdPrefix(getSlice(milestoneId, sliceId)?.title, sliceId),
+    };
+}
+function buildSliceMergeCommitMessage(milestoneId, sliceId, milestoneBranch) {
+    const names = getSliceMergeNames(milestoneId, sliceId);
+    const sliceLabel = names.sliceTitle ?? sliceId;
+    const subject = `feat: ${sliceLabel} - ${sliceId} of ${milestoneId} (slice-cadence)`;
+    const body = [
+        `Slice: ${sliceId}${names.sliceTitle ? ` - ${names.sliceTitle}` : ""}`,
+        `Milestone: ${milestoneId}${names.milestoneTitle ? ` - ${names.milestoneTitle}` : ""}`,
+        `GSD-Slice: ${sliceId}`,
+        `GSD-Milestone: ${milestoneId}`,
+        `Branch: ${milestoneBranch}`,
+    ];
+    return `${subject}\n\n${body.join("\n")}`;
+}
+function buildMilestoneResquashCommitMessage(milestoneId, sliceCount) {
+    const milestoneTitle = isDbAvailable()
+        ? stripKnownIdPrefix(getMilestone(milestoneId)?.title, milestoneId)
+        : undefined;
+    const subject = milestoneTitle
+        ? `feat: ${milestoneTitle} (${milestoneId}, ${sliceCount} slices re-squashed)`
+        : `feat: ${milestoneId} (${sliceCount} slices re-squashed)`;
+    return `${subject}\n\nMilestone: ${milestoneId}${milestoneTitle ? ` - ${milestoneTitle}` : ""}\nGSD-Milestone: ${milestoneId}`;
+}
 function advanceMilestoneBranch(projectRoot, worktreeCwd, milestoneBranch, mainBranch) {
     let worktreeBranch = null;
     try {
@@ -173,7 +216,7 @@ export function mergeSliceToMain(projectRoot, milestoneId, sliceId) {
             throw new MergeConflictError(conflictedFiles, "squash", milestoneBranch, mainBranch);
         }
         // Commit the squash with a slice-scoped message
-        const commitSha = nativeCommit(projectRoot, `gsd: merge ${sliceId} of ${milestoneId} (slice-cadence)`);
+        const commitSha = nativeCommit(projectRoot, buildSliceMergeCommitMessage(milestoneId, sliceId, milestoneBranch));
         // Advance the milestone branch to main so the next slice's commits start
         // from a clean base. When the milestone branch is checked out in an auto
         // worktree, Git refuses a project-root branch -f; reset from inside the
@@ -255,7 +298,7 @@ export function resquashMilestoneOnMain(projectRoot, milestoneId, startSha) {
             stdio: ["ignore", "pipe", "pipe"],
             encoding: "utf-8",
         });
-        const newSha = nativeCommit(projectRoot, `gsd: complete milestone ${milestoneId} (${sliceCount} slices re-squashed)`, { allowEmpty: true });
+        const newSha = nativeCommit(projectRoot, buildMilestoneResquashCommitMessage(milestoneId, sliceCount), { allowEmpty: true });
         try {
             emitMilestoneResquash(projectRoot, milestoneId, {
                 sliceCount,

package/dist/resources/extensions/gsd/slice-parallel-orchestrator.js

@@ -33,6 +33,19 @@ let sliceState = null;
 const SLICE_ORCHESTRATOR_STATE_FILE = "slice-orchestrator.json";
 const TMP_SUFFIX = ".tmp";
 export const SLICE_WORKER_AUTO_ARGS = ["headless", "--json", "auto"];
+export function _resolveSliceParallelMaxWorkersForTest(maxWorkers) {
+    return maxWorkers ?? 2;
+}
+export function _buildSliceWorkerEnvForTest(basePath, milestoneId, sliceId, workerToken, sourceEnv = process.env) {
+    return {
+        ...sourceEnv,
+        GSD_SLICE_LOCK: sliceId,
+        GSD_MILESTONE_LOCK: milestoneId,
+        GSD_PROJECT_ROOT: basePath,
+        GSD_PARALLEL_WORKER: "1",
+        GSD_SLICE_WORKER_TOKEN: workerToken,
+    };
+}
 function sliceStateFilePath(basePath) {
     return join(gsdRoot(basePath), SLICE_ORCHESTRATOR_STATE_FILE);
 }
@@ -281,7 +294,7 @@ export async function startSliceParallel(basePath, milestoneId, eligibleSlices,
     if (process.env.GSD_PARALLEL_WORKER) {
         return { started: [], errors: [{ sid: "all", error: "Cannot start slice-parallel from within a parallel worker" }] };
     }
-    const maxWorkers = opts.maxWorkers ?? 2;
+    const maxWorkers = _resolveSliceParallelMaxWorkersForTest(opts.maxWorkers);
     const budgetCeiling = opts.budgetCeiling;
     // Initialize orchestrator state
     sliceState = {
@@ -506,14 +519,7 @@ function spawnSliceWorker(basePath, milestoneId, sliceId) {
     try {
         child = spawn(process.execPath, [binPath, ...SLICE_WORKER_AUTO_ARGS], {
             cwd: worker.worktreePath,
-            env: {
-                ...process.env,
-                GSD_SLICE_LOCK: sliceId,
-                GSD_MILESTONE_LOCK: milestoneId,
-                GSD_PROJECT_ROOT: basePath,
-                GSD_PARALLEL_WORKER: "1",
-                GSD_SLICE_WORKER_TOKEN: worker.workerToken,
-            },
+            env: _buildSliceWorkerEnvForTest(basePath, milestoneId, sliceId, worker.workerToken),
             stdio: ["ignore", "pipe", "pipe"],
             detached: false,
         });

package/dist/resources/extensions/gsd/tools/complete-milestone.js

@@ -17,8 +17,7 @@ import { renderAllProjections, stripIdPrefix } from "../workflow-projections.js"
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning, logError } from "../workflow-logger.js";
-function renderMilestoneSummaryMarkdown(params) {
-    const now = new Date().toISOString();
+function renderMilestoneSummaryMarkdown(params, completedAt) {
     const displayTitle = stripIdPrefix(params.title, params.milestoneId);
     // Apply defaults for optional enrichment fields (#2771)
     const keyDecisions = params.keyDecisions ?? [];
@@ -37,7 +36,7 @@ function renderMilestoneSummaryMarkdown(params) {
 id: ${params.milestoneId}
 title: "${displayTitle}"
 status: complete
-completed_at: ${now}
+completed_at: ${completedAt}
 key_decisions:
 ${keyDecisionsYaml}
 key_files:
@@ -56,15 +55,15 @@ ${params.narrative}
 
 ## Success Criteria Results
 
-${params.successCriteriaResults ?? "Not provided."}
+${params.successCriteriaResults || "Not provided."}
 
 ## Definition of Done Results
 
-${params.definitionOfDoneResults ?? "Not provided."}
+${params.definitionOfDoneResults || "Not provided."}
 
 ## Requirement Outcomes
 
-${params.requirementOutcomes ?? "Not provided."}
+${params.requirementOutcomes || "Not provided."}
 
 ## Deviations
 
@@ -131,7 +130,7 @@ export async function handleCompleteMilestone(params, basePath) {
         return { error: guardError };
     }
     // ── Filesystem operations (outside transaction) ─────────────────────────
-    const summaryMd = renderMilestoneSummaryMarkdown(params);
+    const summaryMd = renderMilestoneSummaryMarkdown(params, completedAt);
     let summaryPath;
     const milestoneDir = resolveMilestonePath(basePath, params.milestoneId);
     if (milestoneDir) {

package/dist/resources/extensions/gsd/tools/complete-task.js

@@ -46,7 +46,7 @@ function taskGateFieldForId(id, params) {
  * Normalize a list parameter that may arrive as a string (newline-delimited
  * bullet list from the LLM) into a string array (#3361).
  */
-function normalizeListParam(value) {
+export function normalizeListParam(value) {
     if (Array.isArray(value))
         return value.map(String);
     if (typeof value === "string" && value.trim()) {

package/dist/resources/extensions/gsd/tools/context-mode-tool-result.js

@@ -0,0 +1,15 @@
+// Project/App: GSD-2
+// File Purpose: Shared Context Mode tool result helpers.
+export function contextModeDisabledResult(operation) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: `${operation} is disabled by \`context_mode.enabled: false\` in preferences. ` +
+                    "Remove that override or set it to true to re-enable Context Mode tools.",
+            },
+        ],
+        details: { operation, error: "context_mode_disabled" },
+        isError: true,
+    };
+}

package/dist/resources/extensions/gsd/tools/exec-search-tool.js

@@ -3,7 +3,12 @@
 // Scans .gsd/exec/*.meta.json and returns a ranked summary so agents can
 // re-discover past runs without re-executing. Read-only; no DB writes.
 import { searchExecHistory } from "../exec-history.js";
+import { isContextModeEnabled } from "../preferences-types.js";
+import { contextModeDisabledResult } from "./context-mode-tool-result.js";
 export function executeExecSearch(params, opts) {
+    if (!isContextModeEnabled(opts.preferences)) {
+        return contextModeDisabledResult("gsd_exec_search");
+    }
     const searchOpts = {
         query: typeof params.query === "string" ? params.query : undefined,
         runtime: params.runtime,

package/dist/resources/extensions/gsd/tools/exec-tool.js

@@ -5,6 +5,7 @@
 // for MCP return.
 import { EXEC_DEFAULTS, runExecSandbox, } from "../exec-sandbox.js";
 import { isContextModeEnabled } from "../preferences-types.js";
+import { contextModeDisabledResult } from "./context-mode-tool-result.js";
 export function buildExecOptions(baseDir, cfg, extras) {
     const allowlist = Array.isArray(cfg?.exec_env_allowlist) ? cfg.exec_env_allowlist : EXEC_DEFAULTS.envAllowlist;
     const stdoutCap = clampNumber(cfg?.exec_stdout_cap_bytes, EXEC_DEFAULTS.stdoutCapBytes, 4_096, 16_777_216);
@@ -33,19 +34,6 @@ function clampNumber(value, fallback, min, max) {
 function isEnabled(prefs) {
     return isContextModeEnabled(prefs);
 }
-function disabledResult() {
-    return {
-        content: [
-            {
-                type: "text",
-                text: "gsd_exec is disabled by `context_mode.enabled: false` in preferences. Remove that " +
-                    "override (or set it to true) to re-enable sandboxed tool-output execution.",
-            },
-        ],
-        details: { operation: "gsd_exec", error: "context_mode_disabled" },
-        isError: true,
-    };
-}
 function paramError(message) {
     return {
         content: [{ type: "text", text: `Error: ${message}` }],
@@ -55,7 +43,7 @@ function paramError(message) {
 }
 export async function executeGsdExec(params, deps) {
     if (!isEnabled(deps.preferences))
-        return disabledResult();
+        return contextModeDisabledResult("gsd_exec");
     const runtime = params.runtime;
     if (runtime !== "bash" && runtime !== "node" && runtime !== "python") {
         return paramError(`invalid runtime "${String(runtime)}" — must be bash | node | python`);
@@ -67,7 +55,7 @@ export async function executeGsdExec(params, deps) {
     if (Buffer.byteLength(script, "utf8") > 200_000) {
         return paramError("script exceeds the 200 KB length limit");
     }
-    const opts = buildExecOptions(deps.baseDir, deps.preferences?.context_mode, { now: deps.now, generateId: deps.generateId });
+    const opts = buildExecOptions(deps.baseDir, deps.preferences?.context_mode, { env: deps.env, now: deps.now, generateId: deps.generateId });
     const run = deps.run ?? runExecSandbox;
     try {
         const result = await run({

package/dist/resources/extensions/gsd/tools/memory-tools.js

@@ -256,6 +256,7 @@ function includeSupersededMemories(rankedActive) {
                 scope: row["scope"] ?? "project",
                 tags,
                 structured_fields: structuredFields,
+                last_hit_at: row["last_hit_at"] ?? null,
             };
         });
     }

package/dist/resources/extensions/gsd/tools/plan-slice.js

@@ -8,6 +8,7 @@ import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
+import { validatePlanningPathScope } from "../planning-path-scope.js";
 function validateTasks(value) {
     if (!Array.isArray(value) || value.length === 0) {
         throw new Error("tasks must be a non-empty array");
@@ -91,6 +92,14 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
+    const pathScopeError = validatePlanningPathScope(basePath, params.tasks.flatMap((task, index) => [
+        { field: `tasks[${index}].files`, values: task.files },
+        { field: `tasks[${index}].inputs`, values: task.inputs },
+        { field: `tasks[${index}].expectedOutput`, values: task.expectedOutput },
+    ]));
+    if (pathScopeError) {
+        return { error: `validation failed: ${pathScopeError}` };
+    }
     // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
     // Guards must be inside the transaction so the state they check cannot
     // change between the read and the write (#2723).

package/dist/resources/extensions/gsd/tools/plan-task.js

@@ -8,6 +8,7 @@ import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
+import { validatePlanningPathScope } from "../planning-path-scope.js";
 function validateParams(params) {
     if (!isNonEmptyString(params?.milestoneId))
         throw new Error("milestoneId is required");
@@ -41,6 +42,14 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
+    const pathScopeError = validatePlanningPathScope(basePath, [
+        { field: "files", values: params.files },
+        { field: "inputs", values: params.inputs },
+        { field: "expectedOutput", values: params.expectedOutput },
+    ]);
+    if (pathScopeError) {
+        return { error: `validation failed: ${pathScopeError}` };
+    }
     // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
     // Guards must be inside the transaction so the state they check cannot
     // change between the read and the write (#2723).

package/dist/resources/extensions/gsd/tools/resume-tool.js

@@ -2,7 +2,12 @@
 // agents can re-orient after compaction or session resume without
 // re-deriving project memory state.
 import { readCompactionSnapshot } from "../compaction-snapshot.js";
+import { isContextModeEnabled } from "../preferences-types.js";
+import { contextModeDisabledResult } from "./context-mode-tool-result.js";
 export function executeResume(_params, opts) {
+    if (!isContextModeEnabled(opts.preferences)) {
+        return contextModeDisabledResult("gsd_resume");
+    }
     const snapshot = readCompactionSnapshot(opts.baseDir);
     if (snapshot == null) {
         return {

package/dist/resources/extensions/gsd/tools/workflow-tool-executors.js

@@ -680,7 +680,7 @@ export async function executeMilestoneStatus(params, basePath = process.cwd()) {
             };
             return {
                 content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-                details: { operation: "milestone_status", milestoneId: milestone.id, sliceCount: slices.length },
+                details: { operation: "milestone_status", ...result },
             };
         });
     }

package/dist/resources/extensions/gsd/unit-context-composer.js

@@ -80,7 +80,15 @@ const CONTEXT_MODE_LANE_LABELS = {
     orchestration: "orchestration",
     docs: "documentation",
 };
-const CONTEXT_MODE_GUIDANCE = "Use `gsd_exec` for noisy commands, `gsd_exec_search` before reruns, and `gsd_resume` after compaction or resume.";
+const CONTEXT_MODE_GUIDANCE_BY_LANE = {
+    interview: "Use `gsd_resume` to restore prior discussion, `gsd_exec` for noisy discovery, and `gsd_exec_search` before repeating scans.",
+    research: "Use `gsd_exec` for noisy research scans, `gsd_exec_search` before reruns, and `gsd_resume` to restore prior findings.",
+    planning: "Use `gsd_resume` for planning continuity, `gsd_exec` for noisy checks, and `gsd_exec_search` before rerunning diagnostics.",
+    execution: "Use `gsd_exec` for builds, tests, and diagnostics, `gsd_exec_search` before reruns, and `gsd_resume` after compaction or resume.",
+    verification: "Use `gsd_exec` for verification commands, `gsd_exec_search` to reuse prior evidence, and `gsd_resume` after compaction or resume.",
+    orchestration: "Use `gsd_resume` before resuming orchestration, `gsd_exec_search` to reuse prior runs, and `gsd_exec` for noisy coordination checks.",
+    docs: "Use `gsd_resume` for prior context, `gsd_exec_search` for saved evidence, and `gsd_exec` for noisy doc validation commands.",
+};
 /**
  * Render the Context Mode instruction lane for a unit type. Unknown unit
  * types, disabled config, and explicit `contextMode: "none"` all omit the
@@ -93,14 +101,15 @@ export function composeContextModeInstructions(unitType, opts) {
     if (!manifest || manifest.contextMode === "none")
         return "";
     const lane = CONTEXT_MODE_LANE_LABELS[manifest.contextMode];
+    const guidance = CONTEXT_MODE_GUIDANCE_BY_LANE[manifest.contextMode];
     if (opts.renderMode === "nested") {
-        return `Context Mode (${lane} lane): ${CONTEXT_MODE_GUIDANCE}`;
+        return `Context Mode (${lane} lane): ${guidance}`;
     }
     return [
         "## Context Mode",
         "",
         `Lane: **${lane} lane**.`,
-        CONTEXT_MODE_GUIDANCE,
+        guidance,
     ].join("\n");
 }
 const SECTION_SEPARATOR = "\n\n---\n\n";

package/dist/resources/extensions/gsd/unit-runtime.js

@@ -4,6 +4,8 @@ import { atomicWriteSync } from "./atomic-write.js";
 import { gsdRoot, relSliceFile, relTaskFile, resolveSliceFile, resolveTaskFile, } from "./paths.js";
 import { loadFile, parseTaskPlanMustHaves, countMustHavesMentionedInSummary } from "./files.js";
 import { parseUnitId } from "./unit-id.js";
+import { getTask, isDbAvailable, refreshOpenDatabaseFromDisk } from "./gsd-db.js";
+import { isClosedStatus } from "./status-guards.js";
 // Per-record advisory lock — prevents read-modify-write races between
 // concurrent writers updating disjoint fields of the same runtime record.
 // Within a single Node process this is moot (writeUnitRuntimeRecord is sync),
@@ -67,6 +69,17 @@ function withRecordLock(recordPath, fn) {
         catch { /* best-effort */ }
     }
 }
+export const IN_FLIGHT_RUNTIME_PHASES = new Set([
+    "dispatched",
+    "wrapup-warning-sent",
+    "timeout",
+    "finalize-timeout",
+    "crashed",
+    "paused",
+]);
+export function isInFlightRuntimePhase(phase) {
+    return IN_FLIGHT_RUNTIME_PHASES.has(phase);
+}
 function runtimeDir(basePath) {
     return join(gsdRoot(basePath), "runtime", "units");
 }
@@ -154,6 +167,12 @@ export async function inspectExecuteTaskDurability(basePath, unitId) {
     const escapedTid = tid.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const taskChecked = !!planContent && new RegExp(`^- \\[[xX]\\] \\*\\*${escapedTid}:`, "m").test(planContent);
     const nextActionAdvanced = !new RegExp(`Execute ${tid}\\b`).test(stateContent);
+    let dbComplete = false;
+    if (isDbAvailable()) {
+        refreshOpenDatabaseFromDisk();
+        const task = getTask(mid, sid, tid);
+        dbComplete = !!task && isClosedStatus(task.status);
+    }
     // Must-have coverage: load task plan and count mentions in summary
     let mustHaveCount = 0;
     let mustHavesMentionedInSummary = 0;
@@ -177,11 +196,14 @@ export async function inspectExecuteTaskDurability(basePath, unitId) {
         summaryExists,
         taskChecked,
         nextActionAdvanced,
+        dbComplete,
         mustHaveCount,
         mustHavesMentionedInSummary,
     };
 }
 export function formatExecuteTaskRecoveryStatus(status) {
+    if (status.dbComplete)
+        return "DB task status is closed";
     const missing = [];
     if (!status.summaryExists)
         missing.push(`summary missing (${status.summaryPath})`);