gsd-pi 2.80.0-dev.c5f2443b3 → 2.80.0-dev.cf9433f56

package/src/resources/extensions/gsd/tests/worktree-write-gate.test.ts

@@ -0,0 +1,179 @@
+// GSD-2 worktree-isolation write gate (#5199).
+//
+// Regression coverage for shouldBlockWorktreeWrite — the helper that prevents
+// the LLM from authoring code at the project root when `git.isolation: worktree`
+// is configured but auto-mode (and its post-unit commit pipeline) hasn't run.
+// Without this gate, writes silently orphan outside git history.
+//
+// Test setup creates a fresh temp project for each isolation case, writes a
+// `.gsd/PREFERENCES.md` with `isolation: "worktree"`, and exercises the helper
+// against the 9 scenarios listed in the issue. No source-grep tests — every
+// assertion exercises the real predicate.
+
+import { test, describe, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { shouldBlockWorktreeWrite } from "../bootstrap/write-gate.js";
+import { invalidateAllCaches } from "../cache.js";
+
+function makeProject(isolation: "none" | "worktree" | "branch" | null): string {
+  const root = mkdtempSync(join(tmpdir(), "wt-write-gate-"));
+  if (isolation !== null) {
+    mkdirSync(join(root, ".gsd"), { recursive: true });
+    writeFileSync(
+      join(root, ".gsd", "PREFERENCES.md"),
+      `---\ngit:\n  isolation: "${isolation}"\n---\n`,
+    );
+  }
+  invalidateAllCaches();
+  return root;
+}
+
+const PLANNING_WRITE_TOOLS = ["write", "edit", "multi_edit", "notebook_edit"];
+
+describe("shouldBlockWorktreeWrite (#5199)", () => {
+  let projectRoot: string;
+  let prevDisableEnv: string | undefined;
+
+  beforeEach(() => {
+    prevDisableEnv = process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD;
+    delete process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD;
+  });
+
+  afterEach(() => {
+    if (projectRoot) {
+      try { rmSync(projectRoot, { recursive: true, force: true }); } catch { /* best-effort */ }
+    }
+    if (prevDisableEnv === undefined) {
+      delete process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD;
+    } else {
+      process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD = prevDisableEnv;
+    }
+    invalidateAllCaches();
+  });
+
+  test("Case 1: every PLANNING_WRITE_TOOLS variant writing to <root>/app.js is blocked", () => {
+    projectRoot = makeProject("worktree");
+    for (const tool of PLANNING_WRITE_TOOLS) {
+      const result = shouldBlockWorktreeWrite(
+        tool,
+        join(projectRoot, "app.js"),
+        projectRoot,
+        /* isAutoLive */ false,
+        /* unitType */ null,
+      );
+      assert.equal(result.block, true, `tool ${tool} should be blocked`);
+      assert.match(result.reason ?? "", /HARD BLOCK/);
+    }
+  });
+
+  test("Case 2: write to <root>/.gsd/PROJECT.md is allowed", () => {
+    projectRoot = makeProject("worktree");
+    const result = shouldBlockWorktreeWrite(
+      "write",
+      join(projectRoot, ".gsd", "PROJECT.md"),
+      projectRoot,
+      false,
+      null,
+    );
+    assert.equal(result.block, false);
+  });
+
+  test("Case 3: write inside <root>/.gsd/worktrees/M001/ is allowed", () => {
+    projectRoot = makeProject("worktree");
+    const target = join(projectRoot, ".gsd", "worktrees", "M001", "src", "app.js");
+    const result = shouldBlockWorktreeWrite("edit", target, projectRoot, false, null);
+    assert.equal(result.block, false);
+  });
+
+  test("Case 4: write to <root>/.gsd/worktrees-extra/M001/app.js (prefix trick) is blocked", () => {
+    projectRoot = makeProject("worktree");
+    const target = join(projectRoot, ".gsd", "worktrees-extra", "M001", "app.js");
+    const result = shouldBlockWorktreeWrite("write", target, projectRoot, false, null);
+    assert.equal(result.block, true);
+    assert.match(result.reason ?? "", /HARD BLOCK/);
+  });
+
+  test("Case 5: isolation=none → allow", () => {
+    projectRoot = makeProject("none");
+    const result = shouldBlockWorktreeWrite(
+      "write",
+      join(projectRoot, "app.js"),
+      projectRoot,
+      false,
+      null,
+    );
+    assert.equal(result.block, false);
+  });
+
+  test("Case 6: isolation=worktree, auto active, effectiveBasePath inside worktree → allow", () => {
+    projectRoot = makeProject("worktree");
+    const inside = join(projectRoot, ".gsd", "worktrees", "M001");
+    mkdirSync(inside, { recursive: true });
+    const result = shouldBlockWorktreeWrite(
+      "write",
+      join(inside, "src", "app.js"),
+      inside,
+      /* isAutoLive */ true,
+      null,
+    );
+    assert.equal(result.block, false);
+  });
+
+  test("Case 7: isolation=worktree, auto active, effectiveBasePath is project root (cwd never flipped) → block", () => {
+    projectRoot = makeProject("worktree");
+    const result = shouldBlockWorktreeWrite(
+      "write",
+      join(projectRoot, "app.js"),
+      projectRoot,
+      /* isAutoLive */ true,
+      null,
+    );
+    assert.equal(result.block, true);
+    assert.match(result.reason ?? "", /HARD BLOCK/);
+  });
+
+  test("Case 8: bootstrap unit type active → allow", () => {
+    projectRoot = makeProject("worktree");
+    for (const unitType of ["discuss-milestone", "plan-milestone", "init"]) {
+      const result = shouldBlockWorktreeWrite(
+        "write",
+        join(projectRoot, "app.js"),
+        projectRoot,
+        false,
+        unitType,
+      );
+      assert.equal(result.block, false, `unit ${unitType} should bypass the guard`);
+    }
+  });
+
+  test("Case 9: GSD_DISABLE_WORKTREE_WRITE_GUARD=1 → allow", () => {
+    projectRoot = makeProject("worktree");
+    process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD = "1";
+    const result = shouldBlockWorktreeWrite(
+      "write",
+      join(projectRoot, "app.js"),
+      projectRoot,
+      false,
+      null,
+    );
+    assert.equal(result.block, false);
+  });
+
+  test("non-planning tools (read/grep/bash) pass through unconditionally", () => {
+    projectRoot = makeProject("worktree");
+    for (const tool of ["read", "grep", "bash", "ls"]) {
+      const result = shouldBlockWorktreeWrite(
+        tool,
+        join(projectRoot, "app.js"),
+        projectRoot,
+        false,
+        null,
+      );
+      assert.equal(result.block, false, `tool ${tool} must not be gated`);
+    }
+  });
+});

package/src/resources/extensions/gsd/tools/context-mode-tool-result.ts

@@ -0,0 +1,25 @@
+// Project/App: GSD-2
+// File Purpose: Shared Context Mode tool result helpers.
+
+export interface ToolExecutionResult {
+  content: Array<{ type: "text"; text: string }>;
+  details: Record<string, unknown>;
+  isError?: boolean;
+}
+
+export type ContextModeToolName = "gsd_exec" | "gsd_exec_search" | "gsd_resume";
+
+export function contextModeDisabledResult(operation: ContextModeToolName): ToolExecutionResult {
+  return {
+    content: [
+      {
+        type: "text",
+        text:
+          `${operation} is disabled by \`context_mode.enabled: false\` in preferences. ` +
+          "Remove that override or set it to true to re-enable Context Mode tools.",
+      },
+    ],
+    details: { operation, error: "context_mode_disabled" },
+    isError: true,
+  };
+}

package/src/resources/extensions/gsd/tools/exec-search-tool.ts

@@ -4,6 +4,8 @@
 // re-discover past runs without re-executing. Read-only; no DB writes.
 
 import { searchExecHistory, type ExecSearchOptions } from "../exec-history.js";
+import { isContextModeEnabled, type ContextModeConfig } from "../preferences-types.js";
+import { contextModeDisabledResult, type ToolExecutionResult } from "./context-mode-tool-result.js";
 
 export interface ExecSearchToolParams {
   query?: string;
@@ -12,16 +14,14 @@ export interface ExecSearchToolParams {
   limit?: number;
 }
 
-export interface ToolExecutionResult {
-  content: Array<{ type: "text"; text: string }>;
-  details: Record<string, unknown>;
-  isError?: boolean;
-}
-
 export function executeExecSearch(
   params: ExecSearchToolParams,
-  opts: { baseDir: string },
+  opts: { baseDir: string; preferences?: { context_mode?: ContextModeConfig } | null },
 ): ToolExecutionResult {
+  if (!isContextModeEnabled(opts.preferences)) {
+    return contextModeDisabledResult("gsd_exec_search");
+  }
+
   const searchOpts: ExecSearchOptions = {
     query: typeof params.query === "string" ? params.query : undefined,
     runtime: params.runtime,

package/src/resources/extensions/gsd/tools/exec-tool.ts

@@ -12,6 +12,7 @@ import {
   type ExecSandboxResult,
 } from "../exec-sandbox.js";
 import { isContextModeEnabled, type ContextModeConfig } from "../preferences-types.js";
+import { contextModeDisabledResult, type ToolExecutionResult } from "./context-mode-tool-result.js";
 
 export interface ExecToolParams {
   runtime: ExecSandboxRequest["runtime"];
@@ -20,17 +21,12 @@ export interface ExecToolParams {
   timeout_ms?: number;
 }
 
-export interface ToolExecutionResult {
-  content: Array<{ type: "text"; text: string }>;
-  details: Record<string, unknown>;
-  isError?: boolean;
-}
-
 export interface ExecToolDeps {
   baseDir: string;
   preferences: { context_mode?: ContextModeConfig } | null;
   /** Optional override for testing. */
   run?: (req: ExecSandboxRequest, opts: ExecSandboxOptions) => Promise<ExecSandboxResult>;
+  env?: NodeJS.ProcessEnv;
   now?: () => Date;
   generateId?: () => string;
 }
@@ -77,21 +73,6 @@ function isEnabled(prefs: ExecToolDeps["preferences"]): boolean {
   return isContextModeEnabled(prefs);
 }
 
-function disabledResult(): ToolExecutionResult {
-  return {
-    content: [
-      {
-        type: "text",
-        text:
-          "gsd_exec is disabled by `context_mode.enabled: false` in preferences. Remove that " +
-          "override (or set it to true) to re-enable sandboxed tool-output execution.",
-      },
-    ],
-    details: { operation: "gsd_exec", error: "context_mode_disabled" },
-    isError: true,
-  };
-}
-
 function paramError(message: string): ToolExecutionResult {
   return {
     content: [{ type: "text", text: `Error: ${message}` }],
@@ -104,7 +85,7 @@ export async function executeGsdExec(
   params: ExecToolParams,
   deps: ExecToolDeps,
 ): Promise<ToolExecutionResult> {
-  if (!isEnabled(deps.preferences)) return disabledResult();
+  if (!isEnabled(deps.preferences)) return contextModeDisabledResult("gsd_exec");
 
   const runtime = params.runtime;
   if (runtime !== "bash" && runtime !== "node" && runtime !== "python") {
@@ -121,7 +102,7 @@ export async function executeGsdExec(
   const opts = buildExecOptions(
     deps.baseDir,
     deps.preferences?.context_mode,
-    { now: deps.now, generateId: deps.generateId },
+    { env: deps.env, now: deps.now, generateId: deps.generateId },
   );
   const run = deps.run ?? runExecSandbox;
 

package/src/resources/extensions/gsd/tools/memory-tools.ts

@@ -308,6 +308,7 @@ function includeSupersededMemories(rankedActive: Memory[]): Memory[] {
         scope: (row["scope"] as string) ?? "project",
         tags,
         structured_fields: structuredFields,
+        last_hit_at: (row["last_hit_at"] as string | null) ?? null,
       };
     });
   } catch {

package/src/resources/extensions/gsd/tools/plan-slice.ts

@@ -18,6 +18,7 @@ import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
+import { validatePlanningPathScope } from "../planning-path-scope.js";
 
 export interface PlanSliceTaskInput {
   taskId: string;
@@ -141,6 +142,18 @@ export async function handlePlanSlice(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
+  const pathScopeError = validatePlanningPathScope(
+    basePath,
+    params.tasks.flatMap((task, index) => [
+      { field: `tasks[${index}].files`, values: task.files },
+      { field: `tasks[${index}].inputs`, values: task.inputs },
+      { field: `tasks[${index}].expectedOutput`, values: task.expectedOutput },
+    ]),
+  );
+  if (pathScopeError) {
+    return { error: `validation failed: ${pathScopeError}` };
+  }
+
   // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
   // Guards must be inside the transaction so the state they check cannot
   // change between the read and the write (#2723).

package/src/resources/extensions/gsd/tools/plan-task.ts

@@ -8,6 +8,7 @@ import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
+import { validatePlanningPathScope } from "../planning-path-scope.js";
 
 export interface PlanTaskParams {
   milestoneId: string;
@@ -66,6 +67,15 @@ export async function handlePlanTask(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
+  const pathScopeError = validatePlanningPathScope(basePath, [
+    { field: "files", values: params.files },
+    { field: "inputs", values: params.inputs },
+    { field: "expectedOutput", values: params.expectedOutput },
+  ]);
+  if (pathScopeError) {
+    return { error: `validation failed: ${pathScopeError}` };
+  }
+
   // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
   // Guards must be inside the transaction so the state they check cannot
   // change between the read and the write (#2723).

package/src/resources/extensions/gsd/tools/resume-tool.ts

@@ -3,22 +3,22 @@
 // re-deriving project memory state.
 
 import { readCompactionSnapshot } from "../compaction-snapshot.js";
+import { isContextModeEnabled, type ContextModeConfig } from "../preferences-types.js";
+import { contextModeDisabledResult, type ToolExecutionResult } from "./context-mode-tool-result.js";
 
 export interface ResumeToolParams {
   /** Ignored — reserved for future variant (e.g. dated snapshots). */
   _variant?: string;
 }
 
-export interface ToolExecutionResult {
-  content: Array<{ type: "text"; text: string }>;
-  details: Record<string, unknown>;
-  isError?: boolean;
-}
-
 export function executeResume(
   _params: ResumeToolParams,
-  opts: { baseDir: string },
+  opts: { baseDir: string; preferences?: { context_mode?: ContextModeConfig } | null },
 ): ToolExecutionResult {
+  if (!isContextModeEnabled(opts.preferences)) {
+    return contextModeDisabledResult("gsd_resume");
+  }
+
   const snapshot = readCompactionSnapshot(opts.baseDir);
   if (snapshot == null) {
     return {

package/src/resources/extensions/gsd/tools/workflow-tool-executors.ts

@@ -813,7 +813,7 @@ export async function executeMilestoneStatus(
 
       return {
         content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-        details: { operation: "milestone_status", milestoneId: milestone.id, sliceCount: slices.length },
+        details: { operation: "milestone_status", ...result },
       };
     });
   } catch (err) {

package/src/resources/extensions/gsd/unit-context-composer.ts

@@ -112,8 +112,22 @@ const CONTEXT_MODE_LANE_LABELS: Record<Exclude<ContextModePolicy, "none">, strin
   docs: "documentation",
 };
 
-const CONTEXT_MODE_GUIDANCE =
-  "Use `gsd_exec` for noisy commands, `gsd_exec_search` before reruns, and `gsd_resume` after compaction or resume.";
+const CONTEXT_MODE_GUIDANCE_BY_LANE: Record<Exclude<ContextModePolicy, "none">, string> = {
+  interview:
+    "Use `gsd_resume` to restore prior discussion, `gsd_exec` for noisy discovery, and `gsd_exec_search` before repeating scans.",
+  research:
+    "Use `gsd_exec` for noisy research scans, `gsd_exec_search` before reruns, and `gsd_resume` to restore prior findings.",
+  planning:
+    "Use `gsd_resume` for planning continuity, `gsd_exec` for noisy checks, and `gsd_exec_search` before rerunning diagnostics.",
+  execution:
+    "Use `gsd_exec` for builds, tests, and diagnostics, `gsd_exec_search` before reruns, and `gsd_resume` after compaction or resume.",
+  verification:
+    "Use `gsd_exec` for verification commands, `gsd_exec_search` to reuse prior evidence, and `gsd_resume` after compaction or resume.",
+  orchestration:
+    "Use `gsd_resume` before resuming orchestration, `gsd_exec_search` to reuse prior runs, and `gsd_exec` for noisy coordination checks.",
+  docs:
+    "Use `gsd_resume` for prior context, `gsd_exec_search` for saved evidence, and `gsd_exec` for noisy doc validation commands.",
+};
 
 /**
  * Render the Context Mode instruction lane for a unit type. Unknown unit
@@ -129,15 +143,16 @@ export function composeContextModeInstructions(
   if (!manifest || manifest.contextMode === "none") return "";
 
   const lane = CONTEXT_MODE_LANE_LABELS[manifest.contextMode];
+  const guidance = CONTEXT_MODE_GUIDANCE_BY_LANE[manifest.contextMode];
   if (opts.renderMode === "nested") {
-    return `Context Mode (${lane} lane): ${CONTEXT_MODE_GUIDANCE}`;
+    return `Context Mode (${lane} lane): ${guidance}`;
   }
 
   return [
     "## Context Mode",
     "",
     `Lane: **${lane} lane**.`,
-    CONTEXT_MODE_GUIDANCE,
+    guidance,
   ].join("\n");
 }
 

package/src/resources/extensions/gsd/unit-runtime.ts

@@ -10,6 +10,8 @@ import {
 } from "./paths.js";
 import { loadFile, parseTaskPlanMustHaves, countMustHavesMentionedInSummary } from "./files.js";
 import { parseUnitId } from "./unit-id.js";
+import { getTask, isDbAvailable, refreshOpenDatabaseFromDisk } from "./gsd-db.js";
+import { isClosedStatus } from "./status-guards.js";
 
 // Per-record advisory lock — prevents read-modify-write races between
 // concurrent writers updating disjoint fields of the same runtime record.
@@ -67,17 +69,32 @@ export type UnitRuntimePhase =
   | "wrapup-warning-sent"
   | "timeout"
   | "finalize-timeout"
+  | "crashed"
   | "recovered"
   | "finalized"
   | "paused"
   | "skipped";
 
+export const IN_FLIGHT_RUNTIME_PHASES: ReadonlySet<UnitRuntimePhase> = new Set([
+  "dispatched",
+  "wrapup-warning-sent",
+  "timeout",
+  "finalize-timeout",
+  "crashed",
+  "paused",
+]);
+
+export function isInFlightRuntimePhase(phase: UnitRuntimePhase): boolean {
+  return IN_FLIGHT_RUNTIME_PHASES.has(phase);
+}
+
 export interface ExecuteTaskRecoveryStatus {
   planPath: string;
   summaryPath: string;
   summaryExists: boolean;
   taskChecked: boolean;
   nextActionAdvanced: boolean;
+  dbComplete: boolean;
   mustHaveCount: number;
   mustHavesMentionedInSummary: number;
 }
@@ -199,6 +216,12 @@ export async function inspectExecuteTaskDurability(
   const escapedTid = tid.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const taskChecked = !!planContent && new RegExp(`^- \\[[xX]\\] \\*\\*${escapedTid}:`, "m").test(planContent);
   const nextActionAdvanced = !new RegExp(`Execute ${tid}\\b`).test(stateContent);
+  let dbComplete = false;
+  if (isDbAvailable()) {
+    refreshOpenDatabaseFromDisk();
+    const task = getTask(mid, sid, tid);
+    dbComplete = !!task && isClosedStatus(task.status);
+  }
 
   // Must-have coverage: load task plan and count mentions in summary
   let mustHaveCount = 0;
@@ -225,12 +248,14 @@ export async function inspectExecuteTaskDurability(
     summaryExists,
     taskChecked,
     nextActionAdvanced,
+    dbComplete,
     mustHaveCount,
     mustHavesMentionedInSummary,
   };
 }
 
 export function formatExecuteTaskRecoveryStatus(status: ExecuteTaskRecoveryStatus): string {
+  if (status.dbComplete) return "DB task status is closed";
   const missing = [] as string[];
   if (!status.summaryExists) missing.push(`summary missing (${status.summaryPath})`);
   if (!status.taskChecked) missing.push(`task checkbox unchecked in ${status.planPath}`);

package/src/resources/extensions/gsd/working-output-messages.ts

@@ -0,0 +1,120 @@
+// GSD-2 + src/resources/extensions/gsd/working-output-messages.ts - Formats and audits user-facing working-state messages.
+
+export type WorkingOutputSurface =
+  | "loader"
+  | "dashboard"
+  | "status"
+  | "notification"
+  | "assistant"
+  | "tool";
+
+export type WorkingHealthState =
+  | "healthy"
+  | "waiting"
+  | "recovering"
+  | "stalled"
+  | "provider-error"
+  | "timeout"
+  | "stopped";
+
+export interface WorkingOutputContext {
+  unitType?: string;
+  unitId?: string;
+  health?: WorkingHealthState;
+  elapsedMs?: number;
+  recoveryAttempts?: number;
+}
+
+export interface WorkingOutputMessage {
+  surface: WorkingOutputSurface;
+  message: string;
+  context?: WorkingOutputContext;
+}
+
+export interface WorkingOutputFinding {
+  code:
+    | "empty-message"
+    | "generic-working-message"
+    | "misleading-healthy-message"
+    | "fake-zero-progress"
+    | "missing-action";
+  severity: "error" | "warning";
+  detail: string;
+}
+
+const ACTION_RE = /\b(?:wait|pause|paused|retry|retrying|recover|recovering|resume|stop|stopped|run|press|type|configure|restart)\b/i;
+
+export function formatAutoUnitWorkingMessage(unitType: string, unitId: string): string {
+  switch (unitType) {
+    case "research-milestone":
+    case "research-slice":
+      return `Researching ${unitId}: waiting for provider response`;
+    case "plan-milestone":
+    case "plan-slice":
+      return `Planning ${unitId}: waiting for provider response`;
+    case "execute-task":
+      return `Executing ${unitId}: waiting for provider response`;
+    case "complete-slice":
+    case "complete-milestone":
+      return `Completing ${unitId}: waiting for provider response`;
+    default:
+      return `${unitType} ${unitId}: waiting for provider response`;
+  }
+}
+
+export function evaluateWorkingOutputMessage(
+  item: WorkingOutputMessage,
+): WorkingOutputFinding[] {
+  const findings: WorkingOutputFinding[] = [];
+  const message = item.message.trim();
+  const health = item.context?.health;
+
+  if (!message) {
+    findings.push({
+      code: "empty-message",
+      severity: "error",
+      detail: `${item.surface} message is empty`,
+    });
+    return findings;
+  }
+
+  if (/^Working(?:\.\.\.)?(?:\s|\(|$)/i.test(message)) {
+    findings.push({
+      code: "generic-working-message",
+      severity: "warning",
+      detail: `${item.surface} message should say what work is running`,
+    });
+  }
+
+  if (/Progressing well/i.test(message) && health && health !== "healthy") {
+    findings.push({
+      code: "misleading-healthy-message",
+      severity: "error",
+      detail: `${item.surface} says progress is healthy while runtime health is ${health}`,
+    });
+  }
+
+  if (/\b0\s*\/\s*0\s+slices\b/i.test(message)) {
+    findings.push({
+      code: "fake-zero-progress",
+      severity: "warning",
+      detail: `${item.surface} should hide roadmap progress before roadmap slices exist`,
+    });
+  }
+
+  if ((health === "stalled" || health === "provider-error" || health === "timeout") && !ACTION_RE.test(message)) {
+    findings.push({
+      code: "missing-action",
+      severity: "warning",
+      detail: `${item.surface} should give the user a next action for ${health}`,
+    });
+  }
+
+  return findings;
+}
+
+export function evaluateWorkingOutputMessages(
+  items: WorkingOutputMessage[],
+): WorkingOutputFinding[] {
+  return items.flatMap(evaluateWorkingOutputMessage);
+}