gsd-pi 2.80.0-dev.c5f2443b3 → 2.80.0-dev.e51d2c88c

package/dist/resources/extensions/gsd/auto-supervisor.js

@@ -24,7 +24,7 @@ let _currentSigtermHandler = null;
  *
  * Returns the new handler so the caller can store and deregister it later.
  */
-export function registerSigtermHandler(currentBasePath, previousHandler) {
+export function registerSigtermHandler(currentBasePath, previousHandler, onSignalCleanup) {
     // Remove the explicitly-passed previous handler
     if (previousHandler) {
         for (const sig of CLEANUP_SIGNALS)
@@ -37,6 +37,13 @@ export function registerSigtermHandler(currentBasePath, previousHandler) {
             process.off(sig, _currentSigtermHandler);
     }
     const handler = () => {
+        try {
+            onSignalCleanup?.();
+        }
+        catch {
+            void 0;
+            // Signal cleanup is best-effort; lock cleanup and process exit still run.
+        }
         clearLock(currentBasePath);
         releaseSessionLock(currentBasePath);
         process.exit(0);

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -35,13 +35,13 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
             recovery: status,
         });
-        const durableComplete = status.summaryExists && status.taskChecked && status.nextActionAdvanced;
+        const durableComplete = status.dbComplete || (status.summaryExists && status.taskChecked && status.nextActionAdvanced);
         if (durableComplete) {
             writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
                 phase: "finalized",
                 recovery: status,
             });
-            ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
+            ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
             unitRecoveryCount.delete(recoveryKey);
             bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";

package/dist/resources/extensions/gsd/auto.js

@@ -20,7 +20,7 @@ import { gsdRoot, resolveMilestoneFile, resolveMilestonePath, resolveDir, milest
 import { invalidateAllCaches } from "./cache.js";
 import { clearActivityLogState } from "./activity-log.js";
 import { synthesizeCrashRecovery, getDeepDiagnostic, readActiveMilestoneId, } from "./session-forensics.js";
-import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, } from "./crash-recovery.js";
+import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, emitOpenUnitEndForUnit, } from "./crash-recovery.js";
 import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, } from "./preferences.js";
 import { sendDesktopNotification } from "./notifications.js";
@@ -61,6 +61,8 @@ import { isClosedStatus } from "./status-guards.js";
 import { updateProgressWidget as _updateProgressWidget, updateSliceProgressCache, clearSliceProgressCache, } from "./auto-dashboard.js";
 import { registerSigtermHandler as _registerSigtermHandler, deregisterSigtermHandler as _deregisterSigtermHandler, } from "./auto-supervisor.js";
 import { isDbAvailable, getMilestone } from "./gsd-db.js";
+import { markLatestActiveForWorkerCanceled } from "./db/unit-dispatches.js";
+import { writeUnitRuntimeRecord } from "./unit-runtime.js";
 import { countPendingCaptures } from "./captures.js";
 import { CMUX_CHANNELS } from "../shared/cmux-events.js";
 import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
@@ -85,6 +87,16 @@ import { validateDirectory } from "./validate-directory.js";
 import { createAutoOrchestrator } from "./auto/orchestrator.js";
 import { WorktreeResolver, } from "./worktree-resolver.js";
 import { reorderForCaching } from "./prompt-ordering.js";
+import { initTokenCounter } from "./token-counter.js";
+// Warm the tiktoken encoder at extension startup so context-budget computations
+// can use accurate token counts via countTokensSync without paying the load
+// cost mid-prompt-build. Fire-and-forget — failure falls back to the
+// provider-aware char-ratio estimator already used by getCharsPerToken().
+// Catch rejections explicitly: an unhandled rejection at module-import time
+// can destabilize startup before the engine logger is configured.
+void initTokenCounter().catch((err) => {
+    logWarning("engine", `token counter warm-up failed: ${err instanceof Error ? err.message : String(err)}`);
+});
 export { STUB_RECOVERY_THRESHOLD, NEW_SESSION_TIMEOUT_MS, } from "./auto/session.js";
 import { autoSession as s } from "./auto-runtime-state.js";
 import { gsdHome } from "./gsd-home.js";
@@ -112,11 +124,12 @@ const STATE_REBUILD_MIN_INTERVAL_MS = 30_000;
  * the DB is unavailable (e.g. fresh project before init) we skip registration
  * silently rather than blocking session start.
  */
-function registerAutoWorkerForSession(session) {
+function registerAutoWorkerForSession(session, projectRootOverride) {
     if (session.workerId)
         return; // already registered (e.g. resume re-runs)
     try {
-        const projectRootRealpath = normalizeRealPath(session.scope?.workspace.projectRoot
+        const projectRootRealpath = normalizeRealPath(projectRootOverride
+            ?? session.scope?.workspace.projectRoot
             ?? (session.originalBasePath || session.basePath));
         session.workerId = registerAutoWorker({ projectRootRealpath });
     }
@@ -225,8 +238,16 @@ function synthesizePausedSessionRecovery(basePath, unitType, unitId, sessionFile
 export function _synthesizePausedSessionRecoveryForTest(basePath, unitType, unitId, sessionFile) {
     return synthesizePausedSessionRecovery(basePath, unitType, unitId, sessionFile);
 }
+const DETACHED_AUTO_KEEPALIVE_INTERVAL_MS = 30_000;
+function withDetachedAutoKeepalive(run) {
+    const keepAlive = setInterval(() => { }, DETACHED_AUTO_KEEPALIVE_INTERVAL_MS);
+    return run.finally(() => {
+        clearInterval(keepAlive);
+    });
+}
+export const _withDetachedAutoKeepaliveForTest = withDetachedAutoKeepalive;
 export function startAutoDetached(ctx, pi, base, verboseMode, options) {
-    void startAuto(ctx, pi, base, verboseMode, options).catch((err) => {
+    void withDetachedAutoKeepalive(startAuto(ctx, pi, base, verboseMode, options)).catch((err) => {
         const message = getErrorMessage(err);
         ctx.ui.notify(`Auto-start failed: ${message}`, "error");
         logWarning("engine", `auto start error: ${message}`, { file: "auto.ts" });
@@ -264,9 +285,50 @@ export function shouldUseWorktreeIsolation(basePath) {
  */
 // Re-export budget utilities for external consumers
 export { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, } from "./auto-budget.js";
+function closeOutSignalInterruptedUnit(currentBasePath) {
+    const currentUnit = s.currentUnit;
+    if (!currentUnit)
+        return;
+    const reason = "Auto-mode process received a termination signal";
+    const errorContext = {
+        message: reason,
+        category: "aborted",
+        isTransient: false,
+    };
+    const basePath = s.basePath || currentBasePath;
+    try {
+        emitOpenUnitEndForUnit(basePath, currentUnit.type, currentUnit.id, "cancelled", errorContext);
+    }
+    catch (err) {
+        logWarning("engine", `signal unit-end cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+    }
+    try {
+        writeUnitRuntimeRecord(basePath, currentUnit.type, currentUnit.id, currentUnit.startedAt, {
+            phase: "crashed",
+            lastProgressAt: Date.now(),
+            lastProgressKind: "signal",
+        });
+    }
+    catch (err) {
+        logWarning("engine", `signal runtime cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+    }
+    try {
+        if (s.workerId)
+            markLatestActiveForWorkerCanceled(s.workerId, "signal-exit");
+    }
+    catch (err) {
+        logWarning("engine", `signal dispatch cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+    }
+    try {
+        resolveAgentEndCancelled(errorContext);
+    }
+    catch (err) {
+        logWarning("engine", `signal resolve cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+    }
+}
 /** Wrapper: register SIGTERM handler and store reference. */
 function registerSigtermHandler(currentBasePath) {
-    s.sigtermHandler = _registerSigtermHandler(currentBasePath, s.sigtermHandler);
+    s.sigtermHandler = _registerSigtermHandler(currentBasePath, s.sigtermHandler, () => closeOutSignalInterruptedUnit(currentBasePath));
 }
 /** Wrapper: deregister SIGTERM handler and clear reference. */
 function deregisterSigtermHandler() {
@@ -1558,6 +1620,10 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             : new URL("../../../resource-loader.js", import.meta.url).href;
         const { initResources } = await import(resourceLoaderPath);
         initResources(agentDir);
+        // initResources() uses synchronous fs APIs, so the prompt-template cache
+        // can be primed immediately — no need for the legacy 1s setTimeout deferral.
+        const { primeCache } = await import("./prompt-loader.js");
+        primeCache();
         // Open the project DB before rebuild/derive so resume uses DB-backed
         // state instead of falling back to stale markdown parsing (#2940).
         await openProjectDbIfPresent(s.basePath);
@@ -1623,6 +1689,10 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         lockBase,
         buildResolver,
     };
+    // Register the worker before bootstrap enters a milestone worktree.
+    // This ensures enterMilestone can claim a lease and seed dispatch claims
+    // for crash-recovery fidelity (#5405).
+    registerAutoWorkerForSession(s, base);
     const ready = await bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, bootstrapDeps, freshStartAssessment);
     if (!ready)
         return;

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -1,10 +1,11 @@
+// GSD-2 + src/resources/extensions/gsd/bootstrap/agent-end-recovery.ts - Handles provider and agent-end recovery for GSD auto-mode.
 import { logWarning } from "../workflow-logger.js";
 import { checkDeepProjectSetupAfterTurn, checkAutoStartAfterDiscuss, maybeHandleReadyPhraseWithoutFiles, maybeHandleEmptyIntentTurn, resetEmptyTurnCounter, } from "../guided-flow.js";
 import { clearPathCache } from "../paths.js";
 import { getAutoDashboardData, getAutoModeStartModel, isAutoActive, pauseAuto, setCurrentDispatchedModelId } from "../auto.js";
 import { getNextFallbackModel, resolveModelWithFallbacksForUnit } from "../preferences.js";
 import { pauseAutoForProviderError } from "../provider-error-pause.js";
-import { isSessionSwitchInFlight, resolveAgentEnd } from "../auto/resolve.js";
+import { isSessionSwitchInFlight, resolveAgentEnd, resolveAgentEndCancelled } from "../auto/resolve.js";
 import { resolveModelId } from "../auto-model-selection.js";
 import { resolveProjectRoot } from "../worktree.js";
 import { clearDiscussionFlowState } from "./write-gate.js";
@@ -47,6 +48,11 @@ export function _buildAbortedPauseContext(lastMsg) {
         isTransient: true,
     };
 }
+export function isUserInitiatedAbortMessage(message) {
+    if (!message)
+        return false;
+    return /\b(?:claude code process aborted by user|request aborted by user|process aborted by user)\b/i.test(message);
+}
 async function pauseTransientWithBackoff(cls, pi, ctx, errorDetail, isRateLimit) {
     retryState.consecutiveTransientCount += 1;
     const baseRetryAfterMs = "retryAfterMs" in cls ? cls.retryAfterMs : 15_000;
@@ -112,9 +118,28 @@ export async function handleAgentEnd(pi, event, ctx) {
         return;
     if (!isAutoActive())
         return;
-    if (isSessionSwitchInFlight())
-        return;
     const lastMsg = event.messages[event.messages.length - 1];
+    if (isSessionSwitchInFlight()) {
+        if (lastMsg && "stopReason" in lastMsg && lastMsg.stopReason === "error") {
+            const rawErrorMsg = ("errorMessage" in lastMsg && lastMsg.errorMessage) ? String(lastMsg.errorMessage) : "";
+            if (isUserInitiatedAbortMessage(rawErrorMsg)) {
+                resolveAgentEndCancelled({
+                    message: rawErrorMsg,
+                    category: "aborted",
+                    isTransient: false,
+                });
+            }
+        }
+        else if (lastMsg && "stopReason" in lastMsg && lastMsg.stopReason === "aborted") {
+            const content = "content" in lastMsg ? lastMsg.content : undefined;
+            const hasEmptyContent = Array.isArray(content) && content.length === 0;
+            const hasErrorMessage = "errorMessage" in lastMsg && !!lastMsg.errorMessage;
+            if (!hasEmptyContent || hasErrorMessage) {
+                resolveAgentEndCancelled(_buildAbortedPauseContext(lastMsg));
+            }
+        }
+        return;
+    }
     if (lastMsg && "stopReason" in lastMsg && lastMsg.stopReason === "aborted") {
         // Empty content with aborted stopReason is a non-fatal agent stop (the LLM
         // chose to end without producing output). Only pause on genuine fatal aborts
@@ -150,6 +175,14 @@ export async function handleAgentEnd(pi, event, ctx) {
         // is in the assistant message text content. Fall back to content when
         // errorMessage looks uninformative.
         const rawErrorMsg = ("errorMessage" in lastMsg && lastMsg.errorMessage) ? String(lastMsg.errorMessage) : "";
+        if (isUserInitiatedAbortMessage(rawErrorMsg)) {
+            resolveAgentEndCancelled({
+                message: rawErrorMsg,
+                category: "aborted",
+                isTransient: false,
+            });
+            return;
+        }
         const isUseless = !rawErrorMsg || /^(success|ok|true|error|unknown)$/i.test(rawErrorMsg.trim());
         // #3588: When errorMessage is uninformative, extract the real error from
         // the assistant message text content for display purposes only.

package/dist/resources/extensions/gsd/bootstrap/exec-tools.js

@@ -3,21 +3,34 @@
 // Exposes the Context Mode runtime tools in-process. Default-on; opt out with
 // `context_mode.enabled: false` in preferences.
 import { Type } from "@sinclair/typebox";
+async function loadContextModePreferences(baseDir) {
+    const [{ loadEffectiveGSDPreferences }, { logWarning }] = await Promise.all([
+        import("../preferences.js"),
+        import("../workflow-logger.js"),
+    ]);
+    try {
+        return loadEffectiveGSDPreferences(baseDir)?.preferences ?? null;
+    }
+    catch (err) {
+        logWarning("tool", `Context Mode tool could not load preferences: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
 export function registerExecTools(pi) {
     pi.registerTool({
         name: "gsd_exec",
         label: "Exec (Sandboxed)",
-        description: "Run a short script (bash/node/python) in a subprocess. Full stdout/stderr persist to " +
+        description: "Run a short script (bash/node/python) in a subprocess. Capped stdout/stderr and metadata persist to " +
             ".gsd/exec/<id>.{stdout,stderr,meta.json}; only a short digest returns in context. Use " +
             "this instead of reading many files or emitting large tool outputs — e.g. have the script " +
             "count/grep/summarize and log the finding. Enabled by default; opt out via " +
             "preferences.context_mode.enabled=false.",
-        promptSnippet: "Run a bash/node/python script in a sandbox; full output is saved to disk and only a digest returns",
+        promptSnippet: "Run a bash/node/python script in a sandbox; capped output is saved to disk and only a digest returns",
         promptGuidelines: [
             "Prefer gsd_exec for analyses that would otherwise read >3 files or produce large tool output.",
             "Write scripts that log the finding (counts, matches, summaries) rather than raw dumps.",
             "The digest is the last ~300 chars of stdout — size your log output accordingly.",
-            "Need the full output? Read the stdout_path returned in details (file on local disk).",
+            "Need persisted output? Read the stdout_path returned in details (file on local disk).",
         ],
         parameters: Type.Object({
             runtime: Type.Union([Type.Literal("bash"), Type.Literal("node"), Type.Literal("python")], { description: "Interpreter: bash (-c), node (-e), or python3 (-c)." }),
@@ -30,21 +43,11 @@ export function registerExecTools(pi) {
             })),
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
-            const [{ executeGsdExec }, { loadEffectiveGSDPreferences }, { logWarning }] = await Promise.all([
-                import("../tools/exec-tool.js"),
-                import("../preferences.js"),
-                import("../workflow-logger.js"),
-            ]);
-            let prefs = null;
-            try {
-                prefs = loadEffectiveGSDPreferences();
-            }
-            catch (err) {
-                logWarning("tool", `gsd_exec could not load preferences: ${err instanceof Error ? err.message : String(err)}`);
-            }
+            const { executeGsdExec } = await import("../tools/exec-tool.js");
+            const baseDir = process.cwd();
             return executeGsdExec(params, {
-                baseDir: process.cwd(),
-                preferences: prefs?.preferences ?? null,
+                baseDir,
+                preferences: await loadContextModePreferences(baseDir),
             });
         },
     });
@@ -56,7 +59,7 @@ export function registerExecTools(pi) {
         promptSnippet: "Search prior gsd_exec runs by substring, runtime, or failing-only filter",
         promptGuidelines: [
             "Use this before re-running an expensive analysis — the prior run's stdout file may still answer.",
-            "The preview shows the trailing ~300 chars of stdout; read stdout_path for the full transcript.",
+            "The preview shows the trailing ~300 chars of stdout; read stdout_path for persisted output.",
         ],
         parameters: Type.Object({
             query: Type.Optional(Type.String({ description: "Substring matched against id and purpose (case-insensitive)." })),
@@ -68,8 +71,10 @@ export function registerExecTools(pi) {
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
             const { executeExecSearch } = await import("../tools/exec-search-tool.js");
+            const baseDir = process.cwd();
             return executeExecSearch(params, {
-                baseDir: process.cwd(),
+                baseDir,
+                preferences: await loadContextModePreferences(baseDir),
             });
         },
     });
@@ -87,8 +92,10 @@ export function registerExecTools(pi) {
         parameters: Type.Object({}),
         async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
             const { executeResume } = await import("../tools/resume-tool.js");
+            const baseDir = process.cwd();
             return executeResume(params, {
-                baseDir: process.cwd(),
+                baseDir,
+                preferences: await loadContextModePreferences(baseDir),
             });
         },
     });

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -2,7 +2,7 @@ import { join } from "node:path";
 import { isToolCallEventType } from "@gsd/pi-coding-agent";
 import { updateSnapshot } from "../ecosystem/gsd-extension-api.js";
 import { buildMilestoneFileName, resolveMilestonePath, resolveSliceFile, resolveSlicePath } from "../paths.js";
-import { canonicalToolName, clearDiscussionFlowState, isDepthConfirmationAnswer, isQueuePhaseActive, markApprovalGateVerified, markDepthVerified, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, isGateQuestionId, setPendingGate, clearPendingGate, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
+import { canonicalToolName, clearDiscussionFlowState, isDepthConfirmationAnswer, isQueuePhaseActive, markApprovalGateVerified, markDepthVerified, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeWrite, isGateQuestionId, setPendingGate, clearPendingGate, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
 import { resolveManifest } from "../unit-context-manifest.js";
 import { isBlockedStateFile, isBashWriteToStateFile, BLOCKED_WRITE_ERROR } from "../write-intercept.js";
 import { loadFile, saveFile, formatContinue } from "../files.js";
@@ -52,6 +52,25 @@ async function applyDisabledModelProviderPolicy(ctx) {
         // Non-fatal: keep default provider visibility if preferences cannot be loaded.
     }
 }
+/**
+ * Bridge `context_management.compaction_threshold_percent` from GSD preferences
+ * into the agent's runtime compaction settings (#5475). The preference is
+ * validated to (0.5, 0.95) at load time, but defense-in-depth normalization
+ * here protects against a stale or hand-edited prefs file. Calling with
+ * `undefined` clears any prior override so a removed preference does not leak.
+ */
+async function applyCompactionThresholdOverride(ctx) {
+    try {
+        const { loadEffectiveGSDPreferences } = await import("../preferences.js");
+        const prefs = loadEffectiveGSDPreferences();
+        const raw = prefs?.preferences.context_management?.compaction_threshold_percent;
+        const value = typeof raw === "number" && Number.isFinite(raw) && raw > 0 && raw < 1 ? raw : undefined;
+        ctx.setCompactionThresholdOverride(value);
+    }
+    catch {
+        // Non-fatal: leave any existing override in place.
+    }
+}
 export function resolveNotificationStoreBasePath(cwd = process.cwd()) {
     return resolveWorktreeProjectRoot(cwd);
 }
@@ -101,6 +120,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         await resetAskUserQuestionsTurnCache();
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
+        await applyCompactionThresholdOverride(ctx);
         // Skip MCP auto-prep when running inside an auto-worktree (see session_switch below).
         const { isInAutoWorktree } = await import("../auto-worktree.js");
         if (!isInAutoWorktree(process.cwd())) {
@@ -149,6 +169,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         clearDiscussionFlowState(process.cwd());
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
+        await applyCompactionThresholdOverride(ctx);
         // Skip MCP auto-prep when running inside an auto-worktree. The worktree
         // already has .mcp.json from createAutoWorktree, and re-running the writer
         // post-chdir rewrites the file mid-run (non-idempotent due to cwd-relative
@@ -432,6 +453,16 @@ export function registerHooks(pi, ecosystemHandlers) {
                     return planningGuard;
             }
         }
+        // ── Worktree-isolation write gate (#5199) ────────────────────────────
+        // Block planning-write tools from landing code at the project root when
+        // git.isolation=worktree but auto-mode hasn't created the milestone
+        // worktree yet. Without this, writes silently orphan outside git history.
+        if (isToolCallEventType("write", event) || isToolCallEventType("edit", event)) {
+            const wtBasePath = resolveWorktreeProjectRoot(dash.basePath ?? discussionBasePath);
+            const wtGuard = shouldBlockWorktreeWrite(event.toolName, event.input.path, wtBasePath, isAutoActive(), dash.currentUnit?.type);
+            if (wtGuard.block)
+                return wtGuard;
+        }
         // ── Single-writer engine: block direct writes to STATE.md ──────────
         // Covers write, edit, and bash tools to prevent bypass vectors.
         if (isToolCallEventType("write", event)) {

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -1,7 +1,9 @@
-import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { minimatch } from "minimatch";
+import { getIsolationMode } from "../preferences.js";
 import { logWarning } from "../workflow-logger.js";
+import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
 /**
  * Regex matching milestone CONTEXT.md file names in both legacy M001
  * and unique M001-abc123 formats. Exported so regex-hardening tests
@@ -728,3 +730,129 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
     // avoids breaking gsd_* MCP tools or future safe additions.
     return { block: false };
 }
+// ─── Worktree isolation write gate (#5199) ────────────────────────────────
+//
+// When `git.isolation: worktree` is configured, the per-unit commit pipeline
+// only runs inside the auto-mode loop (`auto-post-unit.ts`). If the LLM
+// authors code at the project root before auto-mode is started, those writes
+// land in the working tree but never reach a commit — they're silently
+// orphaned outside git history. This guard blocks those writes at the
+// tool_call seam so the agent receives a clear error instead.
+const WORKTREE_GATE_BOOTSTRAP_UNITS = new Set([
+    "discuss-milestone",
+    "plan-milestone",
+    "init",
+]);
+function realpathOrResolve(p) {
+    const abs = resolve(p);
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        // Path doesn't exist (yet) — realpath the deepest existing ancestor so
+        // platforms where /tmp -> /private/tmp don't break containment checks.
+        let dir = abs;
+        const tail = [];
+        while (dir && dir !== resolve(dir, "..")) {
+            try {
+                const real = realpathSync(dir);
+                return tail.length ? join(real, ...tail.reverse()) : real;
+            }
+            catch {
+                const idx = dir.lastIndexOf(sep);
+                if (idx <= 0)
+                    break;
+                tail.push(dir.slice(idx + 1));
+                dir = dir.slice(0, idx) || sep;
+            }
+        }
+        return abs;
+    }
+}
+function isPathContained(target, container) {
+    if (target === container)
+        return true;
+    return target.startsWith(container.endsWith(sep) ? container : container + sep);
+}
+/**
+ * Block planning-write tool calls that would land code at the project root
+ * while `git.isolation: worktree` is in effect and auto-mode hasn't created
+ * (or flipped cwd into) the milestone worktree.
+ *
+ * Pure / unit-testable. Callers in `register-hooks.ts` supply the resolved
+ * project root and current auto liveness; this function does no I/O beyond
+ * realpath resolution.
+ *
+ * Allow rules (in order):
+ *   1. Tool isn't a planning-write (write/edit/multi_edit/notebook_edit).
+ *   2. `GSD_DISABLE_WORKTREE_WRITE_GUARD=1` self-hosting bypass.
+ *   3. Isolation mode is not "worktree".
+ *   4. Active unit is a bootstrap unit (discuss-milestone/plan-milestone/init).
+ *   5. Target is inside `<projectRoot>/.gsd/worktrees/` (a real worktree).
+ *   6. Target is inside `<projectRoot>/.gsd/` and isn't masquerading as a
+ *      worktrees sibling (rejects the `.gsd/worktrees-extra/…` prefix trick).
+ *   7. Auto is live AND `effectiveBasePath` is itself a `.gsd/worktrees/…` path.
+ *
+ * Otherwise: block with a message that points the agent at `/gsd` to start
+ * auto-mode.
+ */
+export function shouldBlockWorktreeWrite(toolName, targetPath, effectiveBasePath, isAutoLive, currentUnitType) {
+    const tool = canonicalToolName(toolName);
+    if (!PLANNING_WRITE_TOOLS.has(tool))
+        return { block: false };
+    if (process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD === "1")
+        return { block: false };
+    if (getIsolationMode(effectiveBasePath) !== "worktree")
+        return { block: false };
+    if (currentUnitType && WORKTREE_GATE_BOOTSTRAP_UNITS.has(currentUnitType))
+        return { block: false };
+    if (!targetPath) {
+        return {
+            block: true,
+            reason: [
+                `HARD BLOCK: ${tool} called with empty path while \`git.isolation: worktree\` is configured`,
+                `and auto-mode is not active. Refusing to allow writes that cannot be located.`,
+            ].join(" "),
+        };
+    }
+    // Resolve the target relative to the project root, then realpath to defeat
+    // symlink-based escapes and prefix tricks (e.g. .gsd/worktrees-extra/).
+    const projectRoot = resolveWorktreeProjectRoot(effectiveBasePath);
+    const absTarget = isAbsolute(targetPath) ? targetPath : resolve(projectRoot, targetPath);
+    const realTarget = realpathOrResolve(absTarget);
+    const realRoot = realpathOrResolve(projectRoot);
+    const realGsd = realpathOrResolve(join(projectRoot, ".gsd"));
+    const realWorktreesDir = realpathOrResolve(join(projectRoot, ".gsd", "worktrees"));
+    // Allow writes inside the legitimate worktrees subtree.
+    if (isPathContained(realTarget, realWorktreesDir))
+        return { block: false };
+    // Allow writes to .gsd/ planning artifacts, but reject siblings whose name
+    // starts with "worktrees" (the worktrees-extra prefix trick — case 4).
+    if (isPathContained(realTarget, realGsd)) {
+        const rel = relative(realGsd, realTarget);
+        const firstSeg = rel.split(/[\/\\]/)[0] ?? "";
+        if (!firstSeg.startsWith("worktrees"))
+            return { block: false };
+        // fall through: looks like worktrees<something> sibling — block
+    }
+    // Auto is live and the caller is operating inside a worktree path —
+    // host tool's write happens in worktree context; let it through.
+    if (isAutoLive && isGsdWorktreePath(effectiveBasePath))
+        return { block: false };
+    // Block. Provide enough context that the agent can self-correct.
+    const displayTarget = isPathContained(realTarget, realRoot)
+        ? relative(realRoot, realTarget) || "."
+        : realTarget;
+    return {
+        block: true,
+        reason: [
+            `HARD BLOCK: Worktree isolation is configured (\`git.isolation: worktree\`) but auto-mode is`,
+            `not running and the target "${displayTarget}" is not inside \`.gsd/worktrees/<MID>/\`.`,
+            `Code edits at the project root would be lost — only the auto-mode commit pipeline`,
+            `(auto-post-unit) commits work, and it never runs outside the loop.`,
+            `Required action: start auto-mode with \`/gsd\` so the milestone worktree is created,`,
+            `then write inside it. To disable this guard for self-hosting development, set`,
+            `GSD_DISABLE_WORKTREE_WRITE_GUARD=1.`,
+        ].join(" "),
+    };
+}

package/dist/resources/extensions/gsd/clean-root-preflight.js

@@ -16,6 +16,31 @@ import { execFileSync } from "node:child_process";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
 import { logWarning } from "./workflow-logger.js";
 import { nativeHasChanges } from "./native-git-bridge.js";
+function findPreflightStashRef(basePath, milestoneId, stashMarker) {
+    const markerPrefix = `gsd-preflight-stash:${milestoneId}:`;
+    let fallbackRef = null;
+    try {
+        const list = execFileSync("git", ["stash", "list", "--format=%gd%x00%s"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+            env: GIT_NO_PROMPT_ENV,
+        });
+        for (const line of list.split("\n")) {
+            const [ref, subject] = line.split("\x00");
+            if (!ref || !subject)
+                continue;
+            if (stashMarker && subject.includes(stashMarker))
+                return ref;
+            if (!fallbackRef && subject.includes(markerPrefix))
+                fallbackRef = ref;
+        }
+    }
+    catch (err) {
+        logWarning("preflight", `stash list failed before restore: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return fallbackRef;
+}
 /**
  * Check the working tree for dirty files before a milestone merge.
  *
@@ -47,7 +72,8 @@ export function preflightCleanRoot(basePath, milestoneId, notify) {
     notify(warnMsg, "warning");
     // Push the stash
     try {
-        execFileSync("git", ["stash", "push", "--include-untracked", "-m", "gsd-preflight-stash"], {
+        const stashMarker = `gsd-preflight-stash:${milestoneId}:${process.pid}:${Date.now()}:${process.hrtime.bigint().toString(36)}`;
+        execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd-preflight-stash [${stashMarker}]`], {
             cwd: basePath,
             stdio: ["ignore", "pipe", "pipe"],
             encoding: "utf-8",
@@ -55,6 +81,7 @@ export function preflightCleanRoot(basePath, milestoneId, notify) {
         });
         return {
             stashPushed: true,
+            stashMarker,
             summary: `Stashed uncommitted changes before merge (milestone ${milestoneId}).`,
         };
     }
@@ -73,9 +100,17 @@ export function preflightCleanRoot(basePath, milestoneId, notify) {
  * Any pop error (e.g. conflict) is logged and notified but does NOT throw —
  * the merge already completed successfully.
  */
-export function postflightPopStash(basePath, milestoneId, notify) {
+export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
+    let stashRef = null;
     try {
-        execFileSync("git", ["stash", "pop"], {
+        stashRef = findPreflightStashRef(basePath, milestoneId, stashMarker);
+        if (!stashRef) {
+            const msg = `No matching GSD preflight stash found for milestone ${milestoneId}; leaving stash list untouched.`;
+            logWarning("preflight", msg);
+            notify(msg, "warning");
+            return;
+        }
+        execFileSync("git", ["stash", "pop", stashRef], {
             cwd: basePath,
             stdio: ["ignore", "pipe", "pipe"],
             encoding: "utf-8",
@@ -86,7 +121,10 @@ export function postflightPopStash(basePath, milestoneId, notify) {
     catch (err) {
         // Pop conflicts mean the merged code collides with the stashed changes.
         // Log a warning — the user needs to resolve manually, but the merge succeeded.
-        const msg = `git stash pop failed after merge of milestone ${milestoneId}: ${err instanceof Error ? err.message : String(err)}. Run "git stash pop" manually to restore your changes.`;
+        const restoreHint = stashRef
+            ? `Run "git stash pop ${stashRef}" or "git stash apply ${stashRef}" manually to restore the correct stash.`
+            : `Run "git stash list" to find the matching GSD preflight stash before restoring manually.`;
+        const msg = `git stash pop ${stashRef ?? ""}`.trim() + ` failed after merge of milestone ${milestoneId}: ${err instanceof Error ? err.message : String(err)}. ${restoreHint}`;
         logWarning("preflight", msg);
         notify(msg, "warning");
     }

package/dist/resources/extensions/gsd/commands/dispatcher.js

@@ -33,5 +33,10 @@ export async function handleGSDCommand(args, ctx, pi) {
     }
     if (handled)
         return;
+    if (trimmed.includes(" ")) {
+        const { handleDo } = await import("../commands-do.js");
+        await handleDo(trimmed, ctx, pi);
+        return;
+    }
     ctx.ui.notify(`Unknown: /gsd ${trimmed}. Run /gsd help for available commands.`, "warning");
 }