gsd-pi 2.80.0-dev.e51d2c88c → 2.80.0-dev.e6c48c3af

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-4a20b588f749081c
+533c696bf1b57db9

package/dist/resources/extensions/gsd/auto/phases.js

@@ -129,6 +129,22 @@ async function closeoutAndStop(ctx, pi, s, deps, reason) {
     }
     await deps.stopAuto(ctx, pi, reason);
 }
+async function stopOnPostflightRecoveryNeeded(ic, result, milestoneId) {
+    if (!result.needsManualRecovery)
+        return null;
+    const { ctx, pi, deps } = ic;
+    const reason = `Post-merge stash restore failed for milestone ${milestoneId}`;
+    ctx.ui.notify(`${reason}. Resolve the working tree before resuming auto-mode. ${result.message}`, "error");
+    await deps.stopAuto(ctx, pi, reason);
+    return { action: "break", reason: "postflight-stash-restore-failed" };
+}
+async function restorePreflightStashOrStop(ic, preflight, milestoneId) {
+    if (!preflight.stashPushed)
+        return null;
+    const { ctx, s, deps } = ic;
+    const result = deps.postflightPopStash(s.originalBasePath || s.basePath, milestoneId, preflight.stashMarker, ctx.ui.notify.bind(ctx.ui));
+    return stopOnPostflightRecoveryNeeded(ic, result, milestoneId);
+}
 async function emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, errorContext) {
     ic.deps.emitJournalEvent({
         ts: new Date().toISOString(),
@@ -475,6 +491,8 @@ export async function runPreDispatch(ic, loopState) {
         const preflightTransition = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
         try {
             deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
+            // Prevent stopAuto() from attempting the same merge again if postflight recovery stops here.
+            s.milestoneMergedInPhases = true;
         }
         catch (mergeErr) {
             if (mergeErr instanceof MergeConflictError) {
@@ -490,8 +508,10 @@ export async function runPreDispatch(ic, loopState) {
             return { action: "break", reason: "merge-failed" };
         }
         // #2909: postflight — restore stashed changes after successful merge
-        if (preflightTransition.stashPushed) {
-            deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, preflightTransition.stashMarker, ctx.ui.notify.bind(ctx.ui));
+        {
+            const postflightStop = await restorePreflightStashOrStop(ic, preflightTransition, s.currentMilestoneId);
+            if (postflightStop)
+                return postflightStop;
         }
         // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         deps.invalidateAllCaches();
@@ -566,8 +586,10 @@ export async function runPreDispatch(ic, loopState) {
                     return { action: "break", reason: "merge-failed" };
                 }
                 // #2909: postflight — restore stashed changes after successful merge
-                if (preflightAllComplete.stashPushed) {
-                    deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, preflightAllComplete.stashMarker, ctx.ui.notify.bind(ctx.ui));
+                {
+                    const postflightStop = await restorePreflightStashOrStop(ic, preflightAllComplete, s.currentMilestoneId);
+                    if (postflightStop)
+                        return postflightStop;
                 }
                 // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
             }
@@ -652,8 +674,10 @@ export async function runPreDispatch(ic, loopState) {
                 return { action: "break", reason: "merge-failed" };
             }
             // #2909: postflight — restore stashed changes after successful merge
-            if (preflightComplete.stashPushed) {
-                deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, preflightComplete.stashMarker, ctx.ui.notify.bind(ctx.ui));
+            {
+                const postflightStop = await restorePreflightStashOrStop(ic, preflightComplete, s.currentMilestoneId);
+                if (postflightStop)
+                    return postflightStop;
             }
             // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         }

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -55,7 +55,10 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     const sessionAbortController = new AbortController();
     _setSessionSwitchInFlight(true);
     try {
-        const sessionPromise = s.cmdCtx.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
+        const sessionPromise = s.cmdCtx.newSession({
+            abortSignal: sessionAbortController.signal,
+            cwd: s.basePath,
+        }).finally(() => {
             if (sessionSwitchGeneration === mySessionSwitchGeneration) {
                 _setSessionSwitchInFlight(false);
             }

package/dist/resources/extensions/gsd/auto-direct-dispatch.js

@@ -246,7 +246,7 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
             ctx.ui.notify(`${msg}. Cancelling dispatch to avoid running in the wrong directory.`, "error");
             return;
         }
-        const result = await ctx.newSession();
+        const result = await ctx.newSession({ cwd: dispatchBase });
         if (result.cancelled) {
             ctx.ui.notify("Session creation cancelled.", "warning");
             return;

package/dist/resources/extensions/gsd/auto.js

@@ -720,6 +720,8 @@ export async function stopAuto(ctx, pi, reason) {
             if (s.workerId) {
                 markWorkerStopping(s.workerId);
             }
+            s.workerId = null;
+            s.milestoneLeaseToken = null;
         }
         catch (e) {
             debugLog("stop-cleanup-coordination", { error: e instanceof Error ? e.message : String(e) });
@@ -852,6 +854,21 @@ export async function stopAuto(ctx, pi, reason) {
         catch (e) {
             debugLog("stop-cleanup-basepath", { error: e instanceof Error ? e.message : String(e) });
         }
+        // Re-root the active command session/tool runtime after worktree teardown.
+        // mergeAndExit restores process.cwd(), but AgentSession has already captured
+        // its own cwd for tools and system prompt; refresh it before returning to the
+        // user so follow-up commands do not target a removed milestone worktree.
+        if (s.originalBasePath && ctx && s.cmdCtx) {
+            try {
+                const result = await s.cmdCtx.newSession({ cwd: s.basePath });
+                if (result.cancelled) {
+                    logWarning("engine", "post-stop session re-root was cancelled", { file: "auto.ts", basePath: s.basePath });
+                }
+            }
+            catch (err) {
+                logWarning("engine", `post-stop session re-root failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts", basePath: s.basePath });
+            }
+        }
         // ── Step 8: Ledger notification ──
         try {
             const ledger = getLedger();
@@ -1831,7 +1848,7 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
         }
         return false;
     }
-    const result = await s.cmdCtx.newSession();
+    const result = await s.cmdCtx.newSession({ cwd: s.basePath });
     if (result.cancelled) {
         await stopAuto(ctx, pi);
         return false;

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -23,6 +23,7 @@ import { approvalGateIdForUnit, isExplicitApprovalResponse, shouldPauseForUserAp
 // printed it before the TUI launched. Only re-print on /clear (subsequent sessions).
 let isFirstSession = true;
 let approvalQuestionAbortInFlight = false;
+let deferredApprovalGate = null;
 async function deriveGsdState(basePath) {
     const { deriveState } = await import("../state.js");
     return deriveState(basePath);
@@ -71,6 +72,43 @@ async function applyCompactionThresholdOverride(ctx) {
         // Non-fatal: leave any existing override in place.
     }
 }
+function clearDeferredApprovalGate(basePath) {
+    if (!basePath || deferredApprovalGate?.basePath === basePath) {
+        deferredApprovalGate = null;
+    }
+}
+function deferApprovalGate(gateId, basePath) {
+    deferredApprovalGate = { gateId, basePath };
+}
+function activateDeferredApprovalGate(basePath) {
+    if (deferredApprovalGate?.basePath !== basePath)
+        return;
+    setPendingGate(deferredApprovalGate.gateId, basePath);
+    deferredApprovalGate = null;
+}
+function isContextDraftSummarySave(toolName, input) {
+    if (toolName !== "gsd_summary_save" && toolName !== "summary_save")
+        return false;
+    if (!input || typeof input !== "object")
+        return false;
+    return input.artifact_type === "CONTEXT-DRAFT";
+}
+function shouldBlockDeferredApprovalTool(toolName, input, basePath) {
+    if (deferredApprovalGate?.basePath !== basePath)
+        return { block: false };
+    if (toolName === "ask_user_questions")
+        return { block: false };
+    if (isContextDraftSummarySave(toolName, input))
+        return { block: false };
+    return {
+        block: true,
+        reason: [
+            `HARD BLOCK: Approval question "${deferredApprovalGate.gateId}" has been shown to the user.`,
+            `Only CONTEXT-DRAFT persistence may finish in this same assistant turn.`,
+            `Wait for the user's answer before calling additional tools.`,
+        ].join(" "),
+    };
+}
 export function resolveNotificationStoreBasePath(cwd = process.cwd()) {
     return resolveWorktreeProjectRoot(cwd);
 }
@@ -117,6 +155,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         resetWriteGateState(process.cwd());
         resetToolCallLoopGuard();
         approvalQuestionAbortInFlight = false;
+        clearDeferredApprovalGate();
         await resetAskUserQuestionsTurnCache();
         await syncServiceTierStatus(ctx);
         await applyDisabledModelProviderPolicy(ctx);
@@ -165,6 +204,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         initSessionNotifications(ctx);
         resetWriteGateState(process.cwd());
         resetToolCallLoopGuard();
+        clearDeferredApprovalGate();
         await resetAskUserQuestionsTurnCache();
         clearDiscussionFlowState(process.cwd());
         await syncServiceTierStatus(ctx);
@@ -201,6 +241,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                 markDepthVerified(milestoneId, beforeAgentBasePath);
             clearPendingGate(beforeAgentBasePath);
         }
+        clearDeferredApprovalGate(beforeAgentBasePath);
         // GSD's own context injection (existing behavior — unchanged).
         const { buildBeforeAgentStartResult } = await import("./system-context.js");
         const gsdResult = await buildBeforeAgentStartResult(event, ctx);
@@ -244,7 +285,12 @@ export function registerHooks(pi, ecosystemHandlers) {
         resetToolCallLoopGuard();
         await resetAskUserQuestionsTurnCache();
         const { handleAgentEnd } = await import("./agent-end-recovery.js");
-        await handleAgentEnd(pi, event, ctx);
+        try {
+            await handleAgentEnd(pi, event, ctx);
+        }
+        finally {
+            activateDeferredApprovalGate(process.cwd());
+        }
     });
     // Squash-merge quick-task branch back to the original branch after the
     // agent turn completes (#2668). cleanupQuickBranch is a no-op when no
@@ -342,11 +388,12 @@ export function registerHooks(pi, ecosystemHandlers) {
             return;
         const gateId = approvalGateIdForUnit(unitType, unitId);
         if (gateId)
-            setPendingGate(gateId, process.cwd());
+            deferApprovalGate(gateId, process.cwd());
         approvalQuestionAbortInFlight = true;
         ctx.ui.notify(`${unitType}${unitId ? ` ${unitId}` : ""} is waiting for your approval - pausing before more tool calls run.`, "info");
-        // The pending gate set above blocks subsequent non-read-only tool calls
-        // via the tool_call hook below, so we do not abort the in-flight stream.
+        // The durable pending gate is activated at agent_end so same-turn
+        // CONTEXT-DRAFT persistence can finish after the text boundary streams.
+        // The tool_call hook below still blocks non-draft tools in this turn.
         // Aborting mid-stream eats the model's question text on external CLI
         // providers (Claude Code SDK) because lastTextContent isn't populated
         // from in-flight builder state — the user only ever sees "Claude Code
@@ -377,6 +424,9 @@ export function registerHooks(pi, ecosystemHandlers) {
         if (loopCheck.block) {
             return { block: true, reason: loopCheck.reason };
         }
+        const deferredGateGuard = shouldBlockDeferredApprovalTool(toolName, event.input, discussionBasePath);
+        if (deferredGateGuard.block)
+            return deferredGateGuard;
         // ── Discussion gate enforcement: track pending gate questions ─────────
         // Only gate-shaped ask_user_questions calls should block execution.
         // The gate stays pending until the user selects the approval option.

package/dist/resources/extensions/gsd/clean-root-preflight.js

@@ -3,13 +3,13 @@
  *
  * #2909: Adds a fast-path git status check before milestone completion merges.
  * When the working tree is dirty the user is warned and changes are auto-stashed
- * so the merge can proceed cleanly.  After the merge completes, postflightPopStash
- * restores the stashed changes.
+ * so the merge can proceed cleanly. After the merge completes, postflightPopStash
+ * restores the stashed changes and reports whether manual recovery is needed.
  *
  * Design constraints (from Trek-e approval):
  *  - Warn the user before stashing (no silent surprises)
  *  - git stash push / git stash pop only — no custom stash management layer
- *  - Stash/pop errors are logged but MUST NOT block the merge
+ *  - Stash/pop errors are logged but MUST NOT block the merge itself
  *  - Fast-path status check — clean trees pay no extra cost
  */
 import { execFileSync } from "node:child_process";
@@ -98,7 +98,8 @@ export function preflightCleanRoot(basePath, milestoneId, notify) {
  *
  * Only called when preflightCleanRoot returned stashPushed=true.
  * Any pop error (e.g. conflict) is logged and notified but does NOT throw —
- * the merge already completed successfully.
+ * the merge already completed successfully. Callers must treat
+ * needsManualRecovery=true as a dirty workspace stop, not a clean completion.
  */
 export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
     let stashRef = null;
@@ -108,7 +109,11 @@ export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
             const msg = `No matching GSD preflight stash found for milestone ${milestoneId}; leaving stash list untouched.`;
             logWarning("preflight", msg);
             notify(msg, "warning");
-            return;
+            return {
+                restored: false,
+                needsManualRecovery: true,
+                message: msg,
+            };
         }
         execFileSync("git", ["stash", "pop", stashRef], {
             cwd: basePath,
@@ -116,7 +121,14 @@ export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
             encoding: "utf-8",
             env: GIT_NO_PROMPT_ENV,
         });
-        notify(`Restored stashed changes after milestone ${milestoneId} merge.`, "info");
+        const msg = `Restored stashed changes after milestone ${milestoneId} merge.`;
+        notify(msg, "info");
+        return {
+            restored: true,
+            needsManualRecovery: false,
+            message: msg,
+            stashRef,
+        };
     }
     catch (err) {
         // Pop conflicts mean the merged code collides with the stashed changes.
@@ -127,5 +139,11 @@ export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
         const msg = `git stash pop ${stashRef ?? ""}`.trim() + ` failed after merge of milestone ${milestoneId}: ${err instanceof Error ? err.message : String(err)}. ${restoreHint}`;
         logWarning("preflight", msg);
         notify(msg, "warning");
+        return {
+            restored: false,
+            needsManualRecovery: true,
+            message: msg,
+            ...(stashRef ? { stashRef } : {}),
+        };
     }
 }

package/dist/resources/extensions/gsd/git-service.js

@@ -13,6 +13,7 @@ import { isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
+import { logWarning } from "./workflow-logger.js";
 import { detectWorktreeName, } from "./worktree.js";
 import { SLICE_BRANCH_RE, QUICK_BRANCH_RE, WORKFLOW_BRANCH_RE } from "./branch-patterns.js";
 import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeBranchExists, nativeHasChanges, nativeAddAllWithExclusions, nativeHasStagedChanges, nativeCommit, nativeRmCached, nativeUpdateRef, nativeAddPaths, nativeResetSoft, nativeCommitSubject, _resetHasChangesCache, } from "./native-git-bridge.js";
@@ -535,14 +536,45 @@ export class GitServiceImpl {
         if (keyFiles.length === 0)
             return false;
         const allExclusions = [...RUNTIME_EXCLUSION_PATHS, ...extraExclusions];
-        const paths = Array.from(new Set(keyFiles
+        const normalized = keyFiles
             .map(file => normalizeRepoRelativePath(this.basePath, file))
             .filter((file) => file !== null)
-            .filter(file => !isExcludedScopedPath(file, allExclusions))));
+            .filter(file => !isExcludedScopedPath(file, allExclusions));
+        // Drop entries that don't exist on disk. The LLM occasionally lists files
+        // it intended to write but didn't (or names them with wrong casing/path).
+        // Pre-`b304f738b` `git add -A` swallowed these silently; the scoped
+        // pathspec form passes each path explicitly, so a single bad entry made
+        // the whole commit fail (see #5500). Filter so valid paths still commit.
+        const missing = [];
+        const existing = [];
+        for (const path of normalized) {
+            if (existsSync(join(this.basePath, path))) {
+                existing.push(path);
+            }
+            else {
+                missing.push(path);
+            }
+        }
+        if (missing.length > 0) {
+            logWarning("engine", `scoped stage: dropping ${missing.length} non-existent keyFile(s) from task commit: ${missing.join(", ")}`, { file: "git-service.ts" });
+        }
+        const paths = Array.from(new Set(existing));
         if (paths.length === 0)
             return false;
-        nativeAddPaths(this.basePath, paths);
-        return true;
+        try {
+            nativeAddPaths(this.basePath, paths);
+            return true;
+        }
+        catch (err) {
+            // Defense-in-depth: even after existence filtering, libgit2/git can
+            // still reject paths (gitignore matches, case-only differences on
+            // case-insensitive FS, submodule boundaries). Returning false lets
+            // autoCommit fall through to smartStage so the commit still goes out
+            // — restoring the resilience the unscoped path used to provide.
+            const msg = err instanceof Error ? err.message : String(err);
+            logWarning("engine", `scoped stage failed (${msg}); falling back to smartStage`, { file: "git-service.ts" });
+            return false;
+        }
     }
     /** Tracks whether runtime file cleanup has run this session. */
     _runtimeFilesCleanedUp = false;

package/dist/resources/extensions/gsd/pre-execution-checks.js

@@ -328,6 +328,8 @@ function shouldValidateInputAsPath(raw) {
     const trimmed = raw.trim();
     if (!trimmed)
         return false;
+    if (isRuntimeOnlyInput(trimmed))
+        return false;
     const candidate = extractPathFromAnnotation(trimmed);
     if (!candidate)
         return false;
@@ -349,6 +351,9 @@ function shouldValidateInputAsPath(raw) {
         /[\\/]/.test(candidate) ||
         /[*?[\]{}]/.test(candidate));
 }
+function isRuntimeOnlyInput(raw) {
+    return /\(\s*runtime\s*\)/i.test(raw);
+}
 function containsGlobPattern(candidate) {
     return ["*", "?", "[", "]", "{", "}"].some((char) => candidate.includes(char));
 }
@@ -461,6 +466,8 @@ export function checkTaskOrdering(tasks, basePath) {
         const task = tasks[i];
         const filesToCheck = [...task.inputs];
         for (const file of filesToCheck) {
+            if (isRuntimeOnlyInput(file))
+                continue;
             if (!shouldValidateInputAsPath(file))
                 continue;
             const normalizedFile = normalizeFilePath(file);

package/dist/resources/extensions/gsd/prompts/complete-milestone.md

@@ -6,6 +6,8 @@ You are executing GSD auto-mode.
 
 Your working directory is `{{workingDirectory}}`. All file reads, writes, and shell commands MUST operate relative to this directory. Do NOT `cd` to any other directory.
 
+If any inlined plan, summary, verification command, or prior artifact names an absolute path outside `{{workingDirectory}}`, treat that path as stale context. Convert it to the equivalent relative path under `{{workingDirectory}}` before reading, writing, or executing. If no equivalent path exists under `{{workingDirectory}}`, record a verification failure and stop; do not edit or run commands in another checkout.
+
 ## Mission
 
 All slices are complete. Verify the integrated work, persist milestone completion, refresh project state, and write the final record future milestones will rely on.

package/dist/resources/extensions/gsd/worktree-resolver.js

@@ -22,7 +22,7 @@ import { emitWorktreeCreated, emitWorktreeMerged } from "./worktree-telemetry.js
 import { getCollapseCadence, getMilestoneResquash, resquashMilestoneOnMain } from "./slice-cadence.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { resolveWorktreeProjectRoot, normalizeWorktreePathForCompare } from "./worktree-root.js";
-import { claimMilestoneLease, releaseMilestoneLease } from "./db/milestone-leases.js";
+import { claimMilestoneLease, refreshMilestoneLease, releaseMilestoneLease } from "./db/milestone-leases.js";
 // ─── Path Comparison Helper ────────────────────────────────────────────────
 /**
  * Compare two paths for physical identity, tolerating trailing slashes,
@@ -119,24 +119,40 @@ export class WorktreeResolver {
         // milestone (re-entry within the same session).
         if (this.s.workerId) {
             if (this.s.currentMilestoneId === milestoneId && this.s.milestoneLeaseToken !== null) {
-                // Already held — no-op, the heartbeat in loop.ts refreshes TTL.
-            }
-            else {
-                // If we held a different milestone, release it first so other
-                // workers don't have to wait for TTL.
-                if (this.s.currentMilestoneId && this.s.currentMilestoneId !== milestoneId && this.s.milestoneLeaseToken !== null) {
-                    try {
-                        releaseMilestoneLease(this.s.workerId, this.s.currentMilestoneId, this.s.milestoneLeaseToken);
-                    }
-                    catch (err) {
-                        debugLog("WorktreeResolver", {
-                            action: "enterMilestone",
-                            milestoneId,
-                            releasePriorLeaseError: err instanceof Error ? err.message : String(err),
-                        });
-                    }
+                const refreshed = refreshMilestoneLease(this.s.workerId, milestoneId, this.s.milestoneLeaseToken);
+                if (refreshed) {
+                    debugLog("WorktreeResolver", {
+                        action: "enterMilestone",
+                        milestoneId,
+                        leaseRefreshed: true,
+                        fencingToken: this.s.milestoneLeaseToken,
+                    });
+                }
+                else {
+                    debugLog("WorktreeResolver", {
+                        action: "enterMilestone",
+                        milestoneId,
+                        staleLeaseToken: this.s.milestoneLeaseToken,
+                    });
                     this.s.milestoneLeaseToken = null;
                 }
+            }
+            // If we held a different milestone, release it first so other
+            // workers don't have to wait for TTL.
+            if (this.s.currentMilestoneId && this.s.currentMilestoneId !== milestoneId && this.s.milestoneLeaseToken !== null) {
+                try {
+                    releaseMilestoneLease(this.s.workerId, this.s.currentMilestoneId, this.s.milestoneLeaseToken);
+                }
+                catch (err) {
+                    debugLog("WorktreeResolver", {
+                        action: "enterMilestone",
+                        milestoneId,
+                        releasePriorLeaseError: err instanceof Error ? err.message : String(err),
+                    });
+                }
+                this.s.milestoneLeaseToken = null;
+            }
+            if (this.s.milestoneLeaseToken === null) {
                 try {
                     const claim = claimMilestoneLease(this.s.workerId, milestoneId);
                     if (claim.ok) {