gsd-pi 2.80.0-dev.e146beb20 → 2.80.0-dev.e6c48c3af

package/dist/resources/extensions/gsd/bootstrap/exec-tools.js

@@ -3,21 +3,34 @@
 // Exposes the Context Mode runtime tools in-process. Default-on; opt out with
 // `context_mode.enabled: false` in preferences.
 import { Type } from "@sinclair/typebox";
+async function loadContextModePreferences(baseDir) {
+    const [{ loadEffectiveGSDPreferences }, { logWarning }] = await Promise.all([
+        import("../preferences.js"),
+        import("../workflow-logger.js"),
+    ]);
+    try {
+        return loadEffectiveGSDPreferences(baseDir)?.preferences ?? null;
+    }
+    catch (err) {
+        logWarning("tool", `Context Mode tool could not load preferences: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
 export function registerExecTools(pi) {
     pi.registerTool({
         name: "gsd_exec",
         label: "Exec (Sandboxed)",
-        description: "Run a short script (bash/node/python) in a subprocess. Full stdout/stderr persist to " +
+        description: "Run a short script (bash/node/python) in a subprocess. Capped stdout/stderr and metadata persist to " +
             ".gsd/exec/<id>.{stdout,stderr,meta.json}; only a short digest returns in context. Use " +
             "this instead of reading many files or emitting large tool outputs — e.g. have the script " +
             "count/grep/summarize and log the finding. Enabled by default; opt out via " +
             "preferences.context_mode.enabled=false.",
-        promptSnippet: "Run a bash/node/python script in a sandbox; full output is saved to disk and only a digest returns",
+        promptSnippet: "Run a bash/node/python script in a sandbox; capped output is saved to disk and only a digest returns",
         promptGuidelines: [
             "Prefer gsd_exec for analyses that would otherwise read >3 files or produce large tool output.",
             "Write scripts that log the finding (counts, matches, summaries) rather than raw dumps.",
             "The digest is the last ~300 chars of stdout — size your log output accordingly.",
-            "Need the full output? Read the stdout_path returned in details (file on local disk).",
+            "Need persisted output? Read the stdout_path returned in details (file on local disk).",
         ],
         parameters: Type.Object({
             runtime: Type.Union([Type.Literal("bash"), Type.Literal("node"), Type.Literal("python")], { description: "Interpreter: bash (-c), node (-e), or python3 (-c)." }),
@@ -30,21 +43,11 @@ export function registerExecTools(pi) {
             })),
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
-            const [{ executeGsdExec }, { loadEffectiveGSDPreferences }, { logWarning }] = await Promise.all([
-                import("../tools/exec-tool.js"),
-                import("../preferences.js"),
-                import("../workflow-logger.js"),
-            ]);
-            let prefs = null;
-            try {
-                prefs = loadEffectiveGSDPreferences();
-            }
-            catch (err) {
-                logWarning("tool", `gsd_exec could not load preferences: ${err instanceof Error ? err.message : String(err)}`);
-            }
+            const { executeGsdExec } = await import("../tools/exec-tool.js");
+            const baseDir = process.cwd();
             return executeGsdExec(params, {
-                baseDir: process.cwd(),
-                preferences: prefs?.preferences ?? null,
+                baseDir,
+                preferences: await loadContextModePreferences(baseDir),
             });
         },
     });
@@ -56,7 +59,7 @@ export function registerExecTools(pi) {
         promptSnippet: "Search prior gsd_exec runs by substring, runtime, or failing-only filter",
         promptGuidelines: [
             "Use this before re-running an expensive analysis — the prior run's stdout file may still answer.",
-            "The preview shows the trailing ~300 chars of stdout; read stdout_path for the full transcript.",
+            "The preview shows the trailing ~300 chars of stdout; read stdout_path for persisted output.",
         ],
         parameters: Type.Object({
             query: Type.Optional(Type.String({ description: "Substring matched against id and purpose (case-insensitive)." })),
@@ -68,8 +71,10 @@ export function registerExecTools(pi) {
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
             const { executeExecSearch } = await import("../tools/exec-search-tool.js");
+            const baseDir = process.cwd();
             return executeExecSearch(params, {
-                baseDir: process.cwd(),
+                baseDir,
+                preferences: await loadContextModePreferences(baseDir),
             });
         },
     });
@@ -87,8 +92,10 @@ export function registerExecTools(pi) {
         parameters: Type.Object({}),
         async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
             const { executeResume } = await import("../tools/resume-tool.js");
+            const baseDir = process.cwd();
             return executeResume(params, {
-                baseDir: process.cwd(),
+                baseDir,
+                preferences: await loadContextModePreferences(baseDir),
             });
         },
     });

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -23,6 +23,7 @@ import { approvalGateIdForUnit, isExplicitApprovalResponse, shouldPauseForUserAp
 // printed it before the TUI launched. Only re-print on /clear (subsequent sessions).
 let isFirstSession = true;
 let approvalQuestionAbortInFlight = false;
+let deferredApprovalGate = null;
 async function deriveGsdState(basePath) {
     const { deriveState } = await import("../state.js");
     return deriveState(basePath);
@@ -52,6 +53,62 @@ async function applyDisabledModelProviderPolicy(ctx) {
         // Non-fatal: keep default provider visibility if preferences cannot be loaded.
     }
 }
+/**
+ * Bridge `context_management.compaction_threshold_percent` from GSD preferences
+ * into the agent's runtime compaction settings (#5475). The preference is
+ * validated to (0.5, 0.95) at load time, but defense-in-depth normalization
+ * here protects against a stale or hand-edited prefs file. Calling with
+ * `undefined` clears any prior override so a removed preference does not leak.
+ */
+async function applyCompactionThresholdOverride(ctx) {
+    try {
+        const { loadEffectiveGSDPreferences } = await import("../preferences.js");
+        const prefs = loadEffectiveGSDPreferences();
+        const raw = prefs?.preferences.context_management?.compaction_threshold_percent;
+        const value = typeof raw === "number" && Number.isFinite(raw) && raw > 0 && raw < 1 ? raw : undefined;
+        ctx.setCompactionThresholdOverride(value);
+    }
+    catch {
+        // Non-fatal: leave any existing override in place.
+    }
+}
+function clearDeferredApprovalGate(basePath) {
+    if (!basePath || deferredApprovalGate?.basePath === basePath) {
+        deferredApprovalGate = null;
+    }
+}
+function deferApprovalGate(gateId, basePath) {
+    deferredApprovalGate = { gateId, basePath };
+}
+function activateDeferredApprovalGate(basePath) {
+    if (deferredApprovalGate?.basePath !== basePath)
+        return;
+    setPendingGate(deferredApprovalGate.gateId, basePath);
+    deferredApprovalGate = null;
+}
+function isContextDraftSummarySave(toolName, input) {
+    if (toolName !== "gsd_summary_save" && toolName !== "summary_save")
+        return false;
+    if (!input || typeof input !== "object")
+        return false;
+    return input.artifact_type === "CONTEXT-DRAFT";
+}
+function shouldBlockDeferredApprovalTool(toolName, input, basePath) {
+    if (deferredApprovalGate?.basePath !== basePath)
+        return { block: false };
+    if (toolName === "ask_user_questions")
+        return { block: false };
+    if (isContextDraftSummarySave(toolName, input))
+        return { block: false };
+    return {
+        block: true,
+        reason: [
+            `HARD BLOCK: Approval question "${deferredApprovalGate.gateId}" has been shown to the user.`,
+            `Only CONTEXT-DRAFT persistence may finish in this same assistant turn.`,
+            `Wait for the user's answer before calling additional tools.`,
+        ].join(" "),
+    };
+}
 export function resolveNotificationStoreBasePath(cwd = process.cwd()) {
     return resolveWorktreeProjectRoot(cwd);
 }
@@ -98,9 +155,11 @@ export function registerHooks(pi, ecosystemHandlers) {
         resetWriteGateState(process.cwd());
         resetToolCallLoopGuard();
         approvalQuestionAbortInFlight = false;
+        clearDeferredApprovalGate();
         await resetAskUserQuestionsTurnCache();
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
+        await applyCompactionThresholdOverride(ctx);
         // Skip MCP auto-prep when running inside an auto-worktree (see session_switch below).
         const { isInAutoWorktree } = await import("../auto-worktree.js");
         if (!isInAutoWorktree(process.cwd())) {
@@ -145,10 +204,12 @@ export function registerHooks(pi, ecosystemHandlers) {
         initSessionNotifications(ctx);
         resetWriteGateState(process.cwd());
         resetToolCallLoopGuard();
+        clearDeferredApprovalGate();
         await resetAskUserQuestionsTurnCache();
         clearDiscussionFlowState(process.cwd());
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
+        await applyCompactionThresholdOverride(ctx);
         // Skip MCP auto-prep when running inside an auto-worktree. The worktree
         // already has .mcp.json from createAutoWorktree, and re-running the writer
         // post-chdir rewrites the file mid-run (non-idempotent due to cwd-relative
@@ -180,6 +241,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                 markDepthVerified(milestoneId, beforeAgentBasePath);
             clearPendingGate(beforeAgentBasePath);
         }
+        clearDeferredApprovalGate(beforeAgentBasePath);
         // GSD's own context injection (existing behavior — unchanged).
         const { buildBeforeAgentStartResult } = await import("./system-context.js");
         const gsdResult = await buildBeforeAgentStartResult(event, ctx);
@@ -223,7 +285,12 @@ export function registerHooks(pi, ecosystemHandlers) {
         resetToolCallLoopGuard();
         await resetAskUserQuestionsTurnCache();
         const { handleAgentEnd } = await import("./agent-end-recovery.js");
-        await handleAgentEnd(pi, event, ctx);
+        try {
+            await handleAgentEnd(pi, event, ctx);
+        }
+        finally {
+            activateDeferredApprovalGate(process.cwd());
+        }
     });
     // Squash-merge quick-task branch back to the original branch after the
     // agent turn completes (#2668). cleanupQuickBranch is a no-op when no
@@ -321,11 +388,12 @@ export function registerHooks(pi, ecosystemHandlers) {
             return;
         const gateId = approvalGateIdForUnit(unitType, unitId);
         if (gateId)
-            setPendingGate(gateId, process.cwd());
+            deferApprovalGate(gateId, process.cwd());
         approvalQuestionAbortInFlight = true;
         ctx.ui.notify(`${unitType}${unitId ? ` ${unitId}` : ""} is waiting for your approval - pausing before more tool calls run.`, "info");
-        // The pending gate set above blocks subsequent non-read-only tool calls
-        // via the tool_call hook below, so we do not abort the in-flight stream.
+        // The durable pending gate is activated at agent_end so same-turn
+        // CONTEXT-DRAFT persistence can finish after the text boundary streams.
+        // The tool_call hook below still blocks non-draft tools in this turn.
         // Aborting mid-stream eats the model's question text on external CLI
         // providers (Claude Code SDK) because lastTextContent isn't populated
         // from in-flight builder state — the user only ever sees "Claude Code
@@ -356,6 +424,9 @@ export function registerHooks(pi, ecosystemHandlers) {
         if (loopCheck.block) {
             return { block: true, reason: loopCheck.reason };
         }
+        const deferredGateGuard = shouldBlockDeferredApprovalTool(toolName, event.input, discussionBasePath);
+        if (deferredGateGuard.block)
+            return deferredGateGuard;
         // ── Discussion gate enforcement: track pending gate questions ─────────
         // Only gate-shaped ask_user_questions calls should block execution.
         // The gate stays pending until the user selects the approval option.

package/dist/resources/extensions/gsd/clean-root-preflight.js

@@ -3,13 +3,13 @@
  *
  * #2909: Adds a fast-path git status check before milestone completion merges.
  * When the working tree is dirty the user is warned and changes are auto-stashed
- * so the merge can proceed cleanly.  After the merge completes, postflightPopStash
- * restores the stashed changes.
+ * so the merge can proceed cleanly. After the merge completes, postflightPopStash
+ * restores the stashed changes and reports whether manual recovery is needed.
  *
  * Design constraints (from Trek-e approval):
  *  - Warn the user before stashing (no silent surprises)
  *  - git stash push / git stash pop only — no custom stash management layer
- *  - Stash/pop errors are logged but MUST NOT block the merge
+ *  - Stash/pop errors are logged but MUST NOT block the merge itself
  *  - Fast-path status check — clean trees pay no extra cost
  */
 import { execFileSync } from "node:child_process";
@@ -98,7 +98,8 @@ export function preflightCleanRoot(basePath, milestoneId, notify) {
  *
  * Only called when preflightCleanRoot returned stashPushed=true.
  * Any pop error (e.g. conflict) is logged and notified but does NOT throw —
- * the merge already completed successfully.
+ * the merge already completed successfully. Callers must treat
+ * needsManualRecovery=true as a dirty workspace stop, not a clean completion.
  */
 export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
     let stashRef = null;
@@ -108,7 +109,11 @@ export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
             const msg = `No matching GSD preflight stash found for milestone ${milestoneId}; leaving stash list untouched.`;
             logWarning("preflight", msg);
             notify(msg, "warning");
-            return;
+            return {
+                restored: false,
+                needsManualRecovery: true,
+                message: msg,
+            };
         }
         execFileSync("git", ["stash", "pop", stashRef], {
             cwd: basePath,
@@ -116,7 +121,14 @@ export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
             encoding: "utf-8",
             env: GIT_NO_PROMPT_ENV,
         });
-        notify(`Restored stashed changes after milestone ${milestoneId} merge.`, "info");
+        const msg = `Restored stashed changes after milestone ${milestoneId} merge.`;
+        notify(msg, "info");
+        return {
+            restored: true,
+            needsManualRecovery: false,
+            message: msg,
+            stashRef,
+        };
     }
     catch (err) {
         // Pop conflicts mean the merged code collides with the stashed changes.
@@ -127,5 +139,11 @@ export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
         const msg = `git stash pop ${stashRef ?? ""}`.trim() + ` failed after merge of milestone ${milestoneId}: ${err instanceof Error ? err.message : String(err)}. ${restoreHint}`;
         logWarning("preflight", msg);
         notify(msg, "warning");
+        return {
+            restored: false,
+            needsManualRecovery: true,
+            message: msg,
+            ...(stashRef ? { stashRef } : {}),
+        };
     }
 }

package/dist/resources/extensions/gsd/context-budget.js

@@ -7,7 +7,7 @@
  *
  * @see D001 (module location), D002 (200K fallback), D003 (section-boundary truncation)
  */
-import { getCharsPerToken } from "./token-counter.js";
+import { getCharsPerToken, isAccurateCountingAvailable, countTokensSync, } from "./token-counter.js";
 // ─── Budget ratio constants ──────────────────────────────────────────────────
 // Percentages of total context window allocated to each budget category.
 // These are applied after tokens→chars conversion.
@@ -23,6 +23,22 @@ const CHARS_PER_TOKEN = 4;
 const DEFAULT_CONTEXT_WINDOW = 200_000;
 /** Conservative effective context for Claude Code subscription routing (#4676) */
 const CLAUDE_CODE_EFFECTIVE_CONTEXT_WINDOW = 200_000;
+/**
+ * Cached empirical chars-per-token from a tiktoken probe, keyed by provider.
+ * countTokensSync's fallback path is provider-aware, so we cache per-provider
+ * to preserve that distinction once the encoder warms. The cl100k_base encoder
+ * itself gives a stable ratio for ASCII English so a single probe per provider
+ * key is sufficient. Empty map means "not yet probed" or "encoder unavailable".
+ */
+const _empiricalCharsPerTokenByProvider = new Map();
+/**
+ * Test hook — clears the empirical chars-per-token cache so test cases that
+ * assert against the static char-ratio fallback aren't polluted by a prior
+ * tiktoken-warmed run in the same process. Production code must not call this.
+ */
+export function _resetEmpiricalCacheForTest() {
+    _empiricalCharsPerTokenByProvider.clear();
+}
 /** Percentage of context consumed before suggesting a continue-here checkpoint */
 const CONTINUE_THRESHOLD_PERCENT = 70;
 // ─── Task count bounds ───────────────────────────────────────────────────────
@@ -46,7 +62,26 @@ const TASK_COUNT_TIERS = [
 export function computeBudgets(contextWindow, provider) {
     const effectiveWindow = contextWindow > 0 ? contextWindow : DEFAULT_CONTEXT_WINDOW;
     const charsPerToken = provider ? getCharsPerToken(provider) : CHARS_PER_TOKEN;
-    const totalChars = effectiveWindow * charsPerToken;
+    // Prefer the tiktoken encoder for total-char estimation when it has been
+    // warmed (initTokenCounter resolved). The cl100k_base ratio is stable for
+    // ASCII English, so probe once per provider and cache — computeBudgets is
+    // called multiple times per prompt build and the probe encode is otherwise
+    // wasted work.
+    let totalChars;
+    if (isAccurateCountingAvailable()) {
+        const providerKey = provider ?? "__default__";
+        let empirical = _empiricalCharsPerTokenByProvider.get(providerKey);
+        if (empirical === undefined) {
+            const probe = "the quick brown fox jumps over the lazy dog ".repeat(64);
+            const probeTokens = countTokensSync(probe, provider);
+            empirical = probeTokens > 0 ? probe.length / probeTokens : charsPerToken;
+            _empiricalCharsPerTokenByProvider.set(providerKey, empirical);
+        }
+        totalChars = effectiveWindow * empirical;
+    }
+    else {
+        totalChars = effectiveWindow * charsPerToken;
+    }
     return {
         summaryBudgetChars: Math.floor(totalChars * SUMMARY_RATIO),
         inlineContextBudgetChars: Math.floor(totalChars * INLINE_CONTEXT_RATIO),

package/dist/resources/extensions/gsd/db/unit-dispatches.js

@@ -253,6 +253,45 @@ export function markCanceled(dispatchId, reason) {
      SET status = 'canceled', ended_at = :ended_at, exit_reason = :reason
      WHERE id = :id AND status IN ('pending','claimed','running')`).run({ ":id": dispatchId, ":ended_at": now, ":reason": reason });
 }
+/**
+ * Best-effort signal/crash cleanup: cancel the latest active dispatch owned by
+ * a worker when the process is exiting before the normal loop can settle it.
+ */
+export function markLatestActiveForWorkerCanceled(workerId, reason) {
+    if (!isDbAvailable())
+        return false;
+    const now = new Date().toISOString();
+    const db = _getAdapter();
+    const result = transaction(() => {
+        return db.prepare(`UPDATE unit_dispatches
+       SET status = 'canceled', ended_at = :ended_at, exit_reason = :reason
+       WHERE id = (
+         SELECT id FROM unit_dispatches
+         WHERE worker_id = :worker_id
+           AND status IN ('pending','claimed','running')
+         ORDER BY id DESC
+         LIMIT 1
+       )`).run({
+            ":ended_at": now,
+            ":reason": reason,
+            ":worker_id": workerId,
+        });
+    });
+    const changes = typeof result.changes === "number"
+        ? result.changes
+        : 0;
+    if (changes <= 0)
+        return false;
+    insertAuditEvent({
+        eventId: randomUUID(),
+        traceId: workerId,
+        category: "orchestration",
+        type: "dispatch-canceled",
+        ts: now,
+        payload: { workerId, reason },
+    });
+    return true;
+}
 /**
  * Fetch the most recent N dispatches for a unit. Used by recordDispatchClaim
  * callers to compute attempt_n and by detect-stuck.ts (B3) to consult

package/dist/resources/extensions/gsd/db-base-schema.js

@@ -46,7 +46,8 @@ export function createBaseSchemaObjects(db, hooks) {
       slice_id TEXT DEFAULT NULL,
       task_id TEXT DEFAULT NULL,
       full_content TEXT NOT NULL DEFAULT '',
-      imported_at TEXT NOT NULL DEFAULT ''
+      imported_at TEXT NOT NULL DEFAULT '',
+      content_hash TEXT DEFAULT NULL
     )
   `);
     db.exec(`
@@ -64,7 +65,8 @@ export function createBaseSchemaObjects(db, hooks) {
       hit_count INTEGER NOT NULL DEFAULT 0,
       scope TEXT NOT NULL DEFAULT 'project',
       tags TEXT NOT NULL DEFAULT '[]',
-      structured_fields TEXT DEFAULT NULL
+      structured_fields TEXT DEFAULT NULL,
+      last_hit_at TEXT DEFAULT NULL
     )
   `);
     db.exec(`

package/dist/resources/extensions/gsd/db-migration-steps.js

@@ -379,6 +379,12 @@ export function applyMigrationV26MilestoneCommitAttributions(db) {
   `);
     db.exec("CREATE INDEX IF NOT EXISTS idx_milestone_commit_attr_milestone ON milestone_commit_attributions(milestone_id)");
 }
+export function applyMigrationV27ArtifactHash(db) {
+    ensureColumn(db, "artifacts", "content_hash", "ALTER TABLE artifacts ADD COLUMN content_hash TEXT DEFAULT NULL");
+}
+export function applyMigrationV28MemoryLastHitAt(db) {
+    ensureColumn(db, "memories", "last_hit_at", "ALTER TABLE memories ADD COLUMN last_hit_at TEXT DEFAULT NULL");
+}
 export function applyMigrationV22QualityGateRepair(db, hooks) {
     const qgInfo = db.prepare("PRAGMA table_info(quality_gates)").all();
     const taskIdCol = qgInfo.find((r) => r["name"] === "task_id");

package/dist/resources/extensions/gsd/git-service.js

@@ -13,6 +13,7 @@ import { isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
+import { logWarning } from "./workflow-logger.js";
 import { detectWorktreeName, } from "./worktree.js";
 import { SLICE_BRANCH_RE, QUICK_BRANCH_RE, WORKFLOW_BRANCH_RE } from "./branch-patterns.js";
 import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeBranchExists, nativeHasChanges, nativeAddAllWithExclusions, nativeHasStagedChanges, nativeCommit, nativeRmCached, nativeUpdateRef, nativeAddPaths, nativeResetSoft, nativeCommitSubject, _resetHasChangesCache, } from "./native-git-bridge.js";
@@ -535,14 +536,45 @@ export class GitServiceImpl {
         if (keyFiles.length === 0)
             return false;
         const allExclusions = [...RUNTIME_EXCLUSION_PATHS, ...extraExclusions];
-        const paths = Array.from(new Set(keyFiles
+        const normalized = keyFiles
             .map(file => normalizeRepoRelativePath(this.basePath, file))
             .filter((file) => file !== null)
-            .filter(file => !isExcludedScopedPath(file, allExclusions))));
+            .filter(file => !isExcludedScopedPath(file, allExclusions));
+        // Drop entries that don't exist on disk. The LLM occasionally lists files
+        // it intended to write but didn't (or names them with wrong casing/path).
+        // Pre-`b304f738b` `git add -A` swallowed these silently; the scoped
+        // pathspec form passes each path explicitly, so a single bad entry made
+        // the whole commit fail (see #5500). Filter so valid paths still commit.
+        const missing = [];
+        const existing = [];
+        for (const path of normalized) {
+            if (existsSync(join(this.basePath, path))) {
+                existing.push(path);
+            }
+            else {
+                missing.push(path);
+            }
+        }
+        if (missing.length > 0) {
+            logWarning("engine", `scoped stage: dropping ${missing.length} non-existent keyFile(s) from task commit: ${missing.join(", ")}`, { file: "git-service.ts" });
+        }
+        const paths = Array.from(new Set(existing));
         if (paths.length === 0)
             return false;
-        nativeAddPaths(this.basePath, paths);
-        return true;
+        try {
+            nativeAddPaths(this.basePath, paths);
+            return true;
+        }
+        catch (err) {
+            // Defense-in-depth: even after existence filtering, libgit2/git can
+            // still reject paths (gitignore matches, case-only differences on
+            // case-insensitive FS, submodule boundaries). Returning false lets
+            // autoCommit fall through to smartStage so the commit still goes out
+            // — restoring the resilience the unscoped path used to provide.
+            const msg = err instanceof Error ? err.message : String(err);
+            logWarning("engine", `scoped stage failed (${msg}); falling back to smartStage`, { file: "git-service.ts" });
+            return false;
+        }
     }
     /** Tracks whether runtime file cleanup has run this session. */
     _runtimeFilesCleanedUp = false;

package/dist/resources/extensions/gsd/gsd-db.js

@@ -22,6 +22,7 @@
 // intentionally independent store for cross-worktree claim races and is
 // excluded from this invariant.
 import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
 import { existsSync, copyFileSync, mkdirSync, realpathSync } from "node:fs";
 import { dirname } from "node:path";
 import { GSDError, GSD_STALE_STATE } from "./errors.js";
@@ -36,7 +37,7 @@ import { rowToActiveDecision, rowToActiveRequirement, rowToDecision, rowToRequir
 import { rowToGate } from "./db-gate-rows.js";
 import { rowToArtifact, rowToMilestone } from "./db-milestone-artifact-rows.js";
 import { backupDatabaseBeforeMigration } from "./db-migration-backup.js";
-import { applyMigrationV2Artifacts, applyMigrationV3Memories, applyMigrationV4DecisionMadeBy, applyMigrationV5HierarchyTables, applyMigrationV6SliceSummaries, applyMigrationV7Dependencies, applyMigrationV8PlanningFields, applyMigrationV9Ordering, applyMigrationV10ReplanTrigger, applyMigrationV11TaskPlanning, applyMigrationV12QualityGates, applyMigrationV13HotPathIndexes, applyMigrationV14SliceDependencies, applyMigrationV15AuditTables, applyMigrationV16EscalationSource, applyMigrationV17TaskEscalation, applyMigrationV18MemorySources, applyMigrationV19MemoryFts, applyMigrationV20MemoryRelations, applyMigrationV21StructuredMemories, applyMigrationV22QualityGateRepair, applyMigrationV23MilestoneQueue, applyMigrationV26MilestoneCommitAttributions, } from "./db-migration-steps.js";
+import { applyMigrationV2Artifacts, applyMigrationV3Memories, applyMigrationV4DecisionMadeBy, applyMigrationV5HierarchyTables, applyMigrationV6SliceSummaries, applyMigrationV7Dependencies, applyMigrationV8PlanningFields, applyMigrationV9Ordering, applyMigrationV10ReplanTrigger, applyMigrationV11TaskPlanning, applyMigrationV12QualityGates, applyMigrationV13HotPathIndexes, applyMigrationV14SliceDependencies, applyMigrationV15AuditTables, applyMigrationV16EscalationSource, applyMigrationV17TaskEscalation, applyMigrationV18MemorySources, applyMigrationV19MemoryFts, applyMigrationV20MemoryRelations, applyMigrationV21StructuredMemories, applyMigrationV22QualityGateRepair, applyMigrationV23MilestoneQueue, applyMigrationV26MilestoneCommitAttributions, applyMigrationV27ArtifactHash, applyMigrationV28MemoryLastHitAt, } from "./db-migration-steps.js";
 import { isMemoriesFtsAvailableSchema, tryCreateMemoriesFtsSchema } from "./db-memory-fts-schema.js";
 import { createDbOpenState } from "./db-open-state.js";
 import { createRuntimeKvTableV25 } from "./db-runtime-kv-schema.js";
@@ -52,7 +53,7 @@ const providerLoader = createSqliteProviderLoader({
     nodeVersion: process.versions.node,
     writeStderr: (message) => process.stderr.write(message),
 });
-export const SCHEMA_VERSION = 26;
+export const SCHEMA_VERSION = 28;
 function initSchema(db, fileBacked) {
     if (fileBacked)
         db.exec("PRAGMA journal_mode=WAL");
@@ -250,6 +251,14 @@ function migrateSchema(db) {
             applyMigrationV26MilestoneCommitAttributions(db);
             recordSchemaVersion(db, 26);
         }
+        if (currentVersion < 27) {
+            applyMigrationV27ArtifactHash(db);
+            recordSchemaVersion(db, 27);
+        }
+        if (currentVersion < 28) {
+            applyMigrationV28MemoryLastHitAt(db);
+            recordSchemaVersion(db, 28);
+        }
         db.exec("COMMIT");
     }
     catch (err) {
@@ -821,8 +830,9 @@ export function clearArtifacts() {
 export function insertArtifact(a) {
     if (!currentDb)
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
-    currentDb.prepare(`INSERT OR REPLACE INTO artifacts (path, artifact_type, milestone_id, slice_id, task_id, full_content, imported_at)
-     VALUES (:path, :artifact_type, :milestone_id, :slice_id, :task_id, :full_content, :imported_at)`).run({
+    const contentHash = createHash("sha256").update(a.full_content).digest("hex");
+    currentDb.prepare(`INSERT OR REPLACE INTO artifacts (path, artifact_type, milestone_id, slice_id, task_id, full_content, imported_at, content_hash)
+     VALUES (:path, :artifact_type, :milestone_id, :slice_id, :task_id, :full_content, :imported_at, :content_hash)`).run({
         ":path": a.path,
         ":artifact_type": a.artifact_type,
         ":milestone_id": a.milestone_id,
@@ -830,6 +840,7 @@ export function insertArtifact(a) {
         ":task_id": a.task_id,
         ":full_content": a.full_content,
         ":imported_at": new Date().toISOString(),
+        ":content_hash": contentHash,
     });
 }
 export function insertMilestone(m) {
@@ -1521,6 +1532,13 @@ export function reconcileWorktreeDb(mainDbPath, worktreeDbPath) {
             const hasEscalationAwaiting = wtTaskInfo.some((col) => col["name"] === "escalation_awaiting_review");
             const hasEscalationArtifact = wtTaskInfo.some((col) => col["name"] === "escalation_artifact_path");
             const hasEscalationOverride = wtTaskInfo.some((col) => col["name"] === "escalation_override_applied_at");
+            const wtArtifactInfo = adapter.prepare("PRAGMA wt.table_info('artifacts')").all();
+            const hasArtifactContentHash = wtArtifactInfo.some((col) => col["name"] === "content_hash");
+            const wtMemoryInfo = adapter.prepare("PRAGMA wt.table_info('memories')").all();
+            const hasMemoryScope = wtMemoryInfo.some((col) => col["name"] === "scope");
+            const hasMemoryTags = wtMemoryInfo.some((col) => col["name"] === "tags");
+            const hasMemoryStructuredFields = wtMemoryInfo.some((col) => col["name"] === "structured_fields");
+            const hasMemoryLastHitAt = wtMemoryInfo.some((col) => col["name"] === "last_hit_at");
             const decConf = adapter.prepare(`SELECT m.id FROM decisions m INNER JOIN wt.decisions w ON m.id = w.id WHERE m.decision != w.decision OR m.choice != w.choice OR m.rationale != w.rationale OR ${hasMadeBy ? "m.made_by != w.made_by" : "'agent' != 'agent'"} OR m.superseded_by IS NOT w.superseded_by`).all();
             for (const row of decConf)
                 conflicts.push(`decision ${row["id"]}: modified in both`);
@@ -1553,12 +1571,17 @@ export function reconcileWorktreeDb(mainDbPath, worktreeDbPath) {
                  supporting_slices, validation, notes, full_content, superseded_by
           FROM wt.requirements
         `).run());
+                // V27: preserve content_hash. If the worktree predates V27 (no column),
+                // fall back to the main DB's existing hash so reconcile doesn't null
+                // out integrity fingerprints on artifacts that were unchanged in wt.
                 merged.artifacts = countChanges(adapter.prepare(`
           INSERT OR REPLACE INTO artifacts (
-            path, artifact_type, milestone_id, slice_id, task_id, full_content, imported_at
+            path, artifact_type, milestone_id, slice_id, task_id, full_content, imported_at, content_hash
           )
-          SELECT path, artifact_type, milestone_id, slice_id, task_id, full_content, imported_at
-          FROM wt.artifacts
+          SELECT w.path, w.artifact_type, w.milestone_id, w.slice_id, w.task_id, w.full_content, w.imported_at,
+                 ${hasArtifactContentHash ? "w.content_hash" : "m.content_hash"}
+          FROM wt.artifacts w
+          LEFT JOIN artifacts m ON m.path = w.path
         `).run());
                 // Merge milestones — worktree may have updated status/planning fields.
                 // Never downgrade status: complete > active > pre-planning (#4372).
@@ -1656,15 +1679,25 @@ export function reconcileWorktreeDb(mainDbPath, worktreeDbPath) {
           FROM wt.tasks w
           LEFT JOIN tasks m ON m.milestone_id = w.milestone_id AND m.slice_id = w.slice_id AND m.id = w.id
         `).run());
-                // Merge memories — keep worktree-learned insights
+                // Merge memories — keep worktree-learned insights.
+                // V18 (scope, tags), V21 (structured_fields), V28 (last_hit_at): for each
+                // column the wt may not yet have (older worktree DB), fall back to the
+                // main DB's existing value via LEFT JOIN so reconcile never silently
+                // resets these fields to defaults on rows that already had them.
                 merged.memories = countChanges(adapter.prepare(`
           INSERT OR REPLACE INTO memories (
             seq, id, category, content, confidence, source_unit_type, source_unit_id,
-            created_at, updated_at, superseded_by, hit_count
+            created_at, updated_at, superseded_by, hit_count,
+            scope, tags, structured_fields, last_hit_at
           )
-          SELECT seq, id, category, content, confidence, source_unit_type, source_unit_id,
-                 created_at, updated_at, superseded_by, hit_count
-          FROM wt.memories
+          SELECT w.seq, w.id, w.category, w.content, w.confidence, w.source_unit_type, w.source_unit_id,
+                 w.created_at, w.updated_at, w.superseded_by, w.hit_count,
+                 ${hasMemoryScope ? "w.scope" : "COALESCE(m.scope, 'project')"},
+                 ${hasMemoryTags ? "w.tags" : "COALESCE(m.tags, '[]')"},
+                 ${hasMemoryStructuredFields ? "w.structured_fields" : "m.structured_fields"},
+                 ${hasMemoryLastHitAt ? "w.last_hit_at" : "m.last_hit_at"}
+          FROM wt.memories w
+          LEFT JOIN memories m ON m.id = w.id
         `).run());
                 // Merge verification evidence — append-only, use INSERT OR IGNORE to avoid duplicates
                 merged.verification_evidence = countChanges(adapter.prepare(`
@@ -2423,7 +2456,7 @@ export function updateMemoryContentRow(id, content, confidence, updatedAt) {
 export function incrementMemoryHitCount(id, updatedAt) {
     if (!currentDb)
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
-    currentDb.prepare("UPDATE memories SET hit_count = hit_count + 1, updated_at = :updated_at WHERE id = :id").run({ ":updated_at": updatedAt, ":id": id });
+    currentDb.prepare("UPDATE memories SET hit_count = hit_count + 1, updated_at = :updated_at, last_hit_at = :last_hit_at WHERE id = :id").run({ ":updated_at": updatedAt, ":last_hit_at": updatedAt, ":id": id });
 }
 export function supersedeMemoryRow(oldId, newId, updatedAt) {
     if (!currentDb)