gsd-pi 2.82.0-dev.c22380fc3 → 2.82.0-dev.e7a7f1ed5

package/dist/resources/extensions/gsd/auto.js

@@ -22,7 +22,7 @@ import { gsdRoot, resolveMilestoneFile, resolveMilestonePath, resolveDir, milest
 import { invalidateAllCaches } from "./cache.js";
 import { clearActivityLogState } from "./activity-log.js";
 import { synthesizeCrashRecovery, getDeepDiagnostic, readActiveMilestoneId, } from "./session-forensics.js";
-import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, emitOpenUnitEndForUnit, } from "./crash-recovery.js";
+import { writeLock, clearLock, clearStaleWorkerLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, emitOpenUnitEndForUnit, } from "./crash-recovery.js";
 import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, } from "./preferences.js";
 import { sendDesktopNotification } from "./notifications.js";
@@ -127,6 +127,12 @@ import { normalizeRealPath } from "./paths.js";
 // ─────────────────────────────────────────────────────────────────────────────
 /** Throttle STATE.md rebuilds — at most once per 30 seconds */
 const STATE_REBUILD_MIN_INTERVAL_MS = 30_000;
+export function formatAutoStopNotification(prefix, totals, unitCount) {
+    return [
+        `${prefix}.`,
+        `Session: ${formatCost(totals.cost)} · ${formatTokenCount(totals.tokens.total)} tokens · ${unitCount} units`,
+    ].join("\n");
+}
 /**
  * Phase B — register this auto-mode process in the workers table so other
  * workers and janitors can detect liveness via heartbeat. Best-effort: if
@@ -707,6 +713,7 @@ export async function cleanupAfterLoopExit(ctx) {
     // visible so the user still has a resumable auto-mode signal on screen.
     if (!s.paused) {
         ctx.ui.setStatus("gsd-auto", undefined);
+        ctx.ui.setWidget("gsd-progress", undefined);
         if (s.completionStopInProgress) {
             s.completionStopInProgress = false;
         }
@@ -1029,7 +1036,7 @@ export async function stopAuto(ctx, pi, reason, options = {}) {
                     : `Auto-mode stopped${reasonSuffix}`;
             if (ledger && ledger.units.length > 0) {
                 const totals = getProjectTotals(ledger.units);
-                ctx?.ui.notify(`${notificationPrefix}. Session: ${formatCost(totals.cost)} · ${formatTokenCount(totals.tokens.total)} tokens · ${ledger.units.length} units`, "info");
+                ctx?.ui.notify(formatAutoStopNotification(notificationPrefix, totals, ledger.units.length), "info");
             }
             else {
                 ctx?.ui.notify(`${notificationPrefix}.`, "info");
@@ -1318,7 +1325,6 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
     s.pendingVerificationRetry = null;
-    s.verificationRetryCount.clear();
     ctx?.ui.setStatus("gsd-auto", "paused");
     ctx?.ui.setWidget("gsd-progress", undefined);
     const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
@@ -1420,6 +1426,13 @@ export function createWiredDispatchAdapter(ctx, pi, dispatchBasePath) {
                 sessionProvider,
                 modelRegistry,
             });
+            if (action.action === "stop") {
+                return {
+                    kind: "blocked",
+                    reason: action.reason,
+                    action: action.level === "warning" ? "pause" : "stop",
+                };
+            }
             if (action.action !== "dispatch")
                 return null;
             return {
@@ -1640,6 +1653,17 @@ export function createWiredAutoOrchestrationModule(ctx, pi, dispatchBasePath, ru
     };
     return createAutoOrchestrator(deps);
 }
+function notifyResumeBlocked(ctx, result) {
+    const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
+    ctx.ui.notify(`Auto-mode blocked: ${result.reason}. Fix and run ${resumeCmd} to resume.`, "warning");
+    setLifecycleOutcome(ctx, {
+        status: "blocked",
+        title: "Auto-mode blocked",
+        detail: result.reason,
+        nextAction: `Fix the blocker, then run ${resumeCmd} to resume.`,
+        commands: ["/gsd status for overview", `${resumeCmd} to resume`, "/gsd doctor to diagnose"],
+    });
+}
 function ensureOrchestrationModule(ctx, pi, basePath) {
     s.orchestration = createWiredAutoOrchestrationModule(ctx, pi, basePath, lockBase());
 }
@@ -1924,7 +1948,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         // This closes the journal gap reported in #3348 where the worker wrote side
         // effects (SUMMARY.md, DB updates) but died before emitting unit-end.
         emitCrashRecoveredUnitEnd(base, freshStartAssessment.lock);
-        clearLock(base);
+        clearStaleWorkerLock(base);
     }
     if (!s.paused) {
         s.pendingCrashRecovery =
@@ -1987,6 +2011,8 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             initMetrics(base);
         if (s.currentMilestoneId)
             setActiveMilestoneId(base, s.currentMilestoneId);
+        await openProjectDbIfPresent(base);
+        registerAutoWorkerForSession(s, base);
         // Re-register health level notification callback lost across process restart
         setLevelChangeCallback((_from, to, summary) => {
             const level = to === "red" ? "error" : to === "yellow" ? "warning" : "info";
@@ -2062,7 +2088,12 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         }
         pi.events.emit(CMUX_CHANNELS.LOG, { preferences: loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, message: s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", level: "progress" });
         try {
-            await s.orchestration?.resume();
+            const resumeResult = await s.orchestration?.resume();
+            if (resumeResult?.kind === "blocked") {
+                notifyResumeBlocked(ctx, resumeResult);
+                await cleanupAfterLoopExit(ctx);
+                return;
+            }
         }
         catch (err) {
             debugLog("resume-orchestration-resume", { error: err instanceof Error ? err.message : String(err) });
@@ -2083,6 +2114,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     const bootstrapDeps = {
         shouldUseWorktreeIsolation,
         registerSigtermHandler,
+        registerAutoWorkerForSession: (projectRoot) => registerAutoWorkerForSession(s, projectRoot),
         lockBase,
         buildLifecycle,
     };

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -10,6 +10,7 @@ import { shouldIgnoreAgentEndForActiveUnit } from "../auto/unit-runner-events.js
 import { resolveModelId } from "../auto-model-selection.js";
 import { resolveProjectRoot } from "../worktree.js";
 import { clearDiscussionFlowState } from "./write-gate.js";
+import { clearGuidedUnitContext } from "../guided-unit-context.js";
 import { resumeAutoAfterProviderDelay } from "./provider-error-resume.js";
 import { classifyError, createRetryState, resetRetryState, isTransient, } from "../error-classifier.js";
 import { blockModel, isModelBlocked } from "../blocked-models.js";
@@ -18,6 +19,9 @@ const MAX_NETWORK_RETRIES = 2;
 function isObjectRecord(value) {
     return !!value && typeof value === "object";
 }
+export function _hasEmptyAgentEndContent(content) {
+    return content == null || (Array.isArray(content) && content.length === 0);
+}
 /**
  * Cap on auto-resume attempts for sustained transient-provider errors.
  *
@@ -57,6 +61,11 @@ export function isUserInitiatedAbortMessage(message) {
         return false;
     return /\b(?:claude code process aborted by user|request aborted by user|process aborted by user)\b/i.test(message);
 }
+export function shouldDeferTransientErrorToCoreRetry(cls, rawErrorMsg) {
+    if (!isTransient(cls) || cls.kind === "rate-limit")
+        return false;
+    return !/retry failed after \d+ attempts:/i.test(rawErrorMsg);
+}
 function isBareClaudeCodeSessionSwitchAbortMarker(message) {
     if (!message)
         return false;
@@ -150,6 +159,13 @@ export function resolveAgentEndErrorDisplay(rawErrorMsg, content) {
     }
     return rawErrorMsg;
 }
+export function isTerminalDeletedWorktreeProviderError(message) {
+    if (!message)
+        return false;
+    if (!/\bdoes not exist\b/i.test(message))
+        return false;
+    return /[/\\]\.gsd[/\\](?:projects[/\\][^/\\]+[/\\])?worktrees[/\\][^/\\\s"']+/i.test(message);
+}
 async function pauseTransientWithBackoff(cls, pi, ctx, errorDetail, isRateLimit) {
     retryState.consecutiveTransientCount += 1;
     const baseRetryAfterMs = "retryAfterMs" in cls ? cls.retryAfterMs : 15_000;
@@ -187,8 +203,10 @@ export async function handleAgentEnd(pi, event, ctx) {
     // falsely report files as missing — producing a spurious "ready signal
     // rejected" loop even though the files are on disk.
     clearPathCache();
+    const basePath = resolveAgentEndBasePath();
+    clearGuidedUnitContext(basePath);
     try {
-        if (await checkDeepProjectSetupAfterTurn(event, ctx, resolveAgentEndBasePath())) {
+        if (await checkDeepProjectSetupAfterTurn(event, ctx, basePath)) {
             return;
         }
     }
@@ -196,22 +214,22 @@ export async function handleAgentEnd(pi, event, ctx) {
         const message = err instanceof Error ? err.message : String(err);
         logWarning("bootstrap", `checkDeepProjectSetupAfterTurn failed: ${message}`);
     }
-    if (checkAutoStartAfterDiscuss()) {
-        clearDiscussionFlowState(resolveAgentEndBasePath() ?? process.cwd());
+    if (checkAutoStartAfterDiscuss(basePath)) {
+        clearDiscussionFlowState(basePath ?? process.cwd());
         return;
     }
     // #4573 — When the LLM emits "Milestone X ready." but the required files
     // are missing, `checkAutoStartAfterDiscuss` returns false silently. Surface
     // that and nudge the LLM to complete the writes before the user hits the
     // downstream "All milestones complete" warning loop.
-    if (maybeHandleReadyPhraseWithoutFiles(event))
+    if (maybeHandleReadyPhraseWithoutFiles(event, basePath))
         return;
     // #4573 — Empty-turn recovery: if the LLM announced intent in prose but
     // emitted no tool calls, nudge it to execute. Fires only when auto-mode is
     // active or a discussion autostart is pending (non-auto interactive discuss
     // is user-driven). Runs before `isAutoActive` early return so pending
     // discussions (where isAutoActive may be false) still get recovered.
-    if (maybeHandleEmptyIntentTurn(event, isAutoActive()))
+    if (maybeHandleEmptyIntentTurn(event, isAutoActive(), basePath))
         return;
     if (!isAutoActive())
         return;
@@ -246,7 +264,7 @@ export async function handleAgentEnd(pi, event, ctx) {
         // that carry error context — e.g. errorMessage field or non-empty content
         // indicating a mid-stream failure. (#2695)
         const content = "content" in lastMsg ? lastMsg.content : undefined;
-        const hasEmptyContent = Array.isArray(content) && content.length === 0;
+        const hasEmptyContent = _hasEmptyAgentEndContent(content);
         const hasErrorMessage = "errorMessage" in lastMsg && !!lastMsg.errorMessage;
         if (hasEmptyContent && !hasErrorMessage) {
             // Non-fatal: treat as a normal agent end so the loop can continue
@@ -292,6 +310,12 @@ export async function handleAgentEnd(pi, event, ctx) {
         // the assistant message text content for display purposes only.
         // Classification still uses rawErrorMsg to avoid false positives from prose.
         const displayMsg = resolveAgentEndErrorDisplay(rawErrorMsg, "content" in lastMsg ? lastMsg.content : undefined);
+        if (isAutoCompletionStopInProgress() &&
+            isTerminalDeletedWorktreeProviderError(`${rawErrorMsg}\n${displayMsg}`)) {
+            resetRetryState(retryState);
+            logWarning("bootstrap", `Ignoring stale deleted-worktree provider error during terminal completion reroot: ${displayMsg || rawErrorMsg}`);
+            return;
+        }
         const errorDetail = displayMsg ? `: ${displayMsg}` : "";
         const explicitRetryAfterMs = ("retryAfterMs" in lastMsg && typeof lastMsg.retryAfterMs === "number") ? lastMsg.retryAfterMs : undefined;
         // ── 1. Classify using rawErrorMsg to avoid prose false-positives ────
@@ -375,7 +399,7 @@ export async function handleAgentEnd(pi, event, ctx) {
         // Core retries transient failures in-session after this handler.
         // Keep that behavior for non-rate-limit classes to avoid pause/retry races,
         // but let rate-limit continue into model fallback logic below (#4373).
-        if (isTransient(cls) && cls.kind !== "rate-limit") {
+        if (shouldDeferTransientErrorToCoreRetry(cls, rawErrorMsg)) {
             return;
         }
         // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli)

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -468,17 +468,18 @@ export function registerDbTools(pi) {
         promptGuidelines: [
             "Use gsd_plan_milestone for milestone planning instead of writing ROADMAP.md directly.",
             "Keep parameters flat and provide the full milestone planning payload, including slices.",
+            "Milestone and slice titles must not contain forward slash (/), en dash, or em dash characters.",
             "The tool validates input, writes milestone and slice planning data transactionally, renders ROADMAP.md from DB, and clears both state and parse caches after success.",
             "Use the canonical name gsd_plan_milestone; gsd_milestone_plan is only an alias.",
         ],
         parameters: Type.Object({
             // ── Core identification + content (required) ──────────────────────
             milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
-            title: Type.String({ description: "Milestone title" }),
+            title: Type.String({ description: "Milestone title; must not contain forward slash (/), en dash, or em dash characters" }),
             vision: Type.String({ description: "Milestone vision" }),
             slices: Type.Array(Type.Object({
                 sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
-                title: Type.String({ description: "Slice title" }),
+                title: Type.String({ description: "Slice title; must not contain forward slash (/), en dash, or em dash characters" }),
                 risk: Type.String({ description: "Slice risk" }),
                 depends: Type.Array(Type.String(), { description: "Slice dependency IDs" }),
                 demo: Type.String({ description: "Roadmap demo text / After this" }),
@@ -546,10 +547,10 @@ export function registerDbTools(pi) {
                 title: Type.String({ description: "Task title" }),
                 description: Type.String({ description: "Task description / steps block" }),
                 estimate: Type.String({ description: "Task estimate string" }),
-                files: Type.Array(Type.String(), { description: "Files likely touched" }),
+                files: Type.Array(Type.String(), { description: "Array<string> of files likely touched; pass [\"path\"] or [], never a single string" }),
                 verify: Type.String({ description: "Verification command or block" }),
-                inputs: Type.Array(Type.String(), { description: "Input files or references" }),
-                expectedOutput: Type.Array(Type.String(), { description: "Expected output files or artifacts" }),
+                inputs: Type.Array(Type.String(), { description: "Array<string> of input files or references; pass [\"path\"] or [], never a single string" }),
+                expectedOutput: Type.Array(Type.String(), { description: "Array<string> of expected output files or artifacts; pass [\"path\"] or [], never a single string" }),
                 observabilityImpact: Type.Optional(Type.String({ description: "Task observability impact" })),
             }), { description: "Planned tasks for the slice" }),
             // ── Enrichment metadata (optional — defaults to empty) ────────────
@@ -622,10 +623,10 @@ export function registerDbTools(pi) {
             title: Type.String({ description: "Task title" }),
             description: Type.String({ description: "Task description / steps block" }),
             estimate: Type.String({ description: "Task estimate string" }),
-            files: Type.Array(Type.String(), { description: "Files likely touched" }),
+            files: Type.Array(Type.String(), { description: "Array<string> of files likely touched; pass [\"path\"] or [], never a single string" }),
             verify: Type.String({ description: "Verification command or block" }),
-            inputs: Type.Array(Type.String(), { description: "Input files or references" }),
-            expectedOutput: Type.Array(Type.String(), { description: "Expected output files or artifacts" }),
+            inputs: Type.Array(Type.String(), { description: "Array<string> of input files or references; pass [\"path\"] or [], never a single string" }),
+            expectedOutput: Type.Array(Type.String(), { description: "Array<string> of expected output files or artifacts; pass [\"path\"] or [], never a single string" }),
             observabilityImpact: Type.Optional(Type.String({ description: "Task observability impact" })),
             // Single-writer v3 audit trail (Stream 2): caller-provided actor identity + causation.
             actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail (e.g. 'executor-01', 'gsd-orchestrator')" })),

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -24,6 +24,7 @@ import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { extractSubagentAgentClasses } from "./subagent-input.js";
 import { approvalGateIdForUnit, isExplicitApprovalResponse, shouldPauseForUserApprovalQuestion } from "../user-input-boundary.js";
 import { resolveSkillManifest } from "../skill-manifest.js";
+import { getGuidedUnitContext } from "../guided-unit-context.js";
 let approvalQuestionAbortInFlight = false;
 async function loadWelcomeScreenModule() {
     const candidates = [];
@@ -675,7 +676,8 @@ export function registerHooks(pi, ecosystemHandlers) {
         // subagent dispatch. Closes the b23 bug class where a discuss-milestone
         // turn used the host Edit tool to modify user source files.
         const dash = getAutoRuntimeSnapshot();
-        const activeUnitType = dash.currentUnit?.type;
+        const guidedUnit = getGuidedUnitContext(discussionBasePath);
+        const activeUnitType = dash.currentUnit?.type ?? guidedUnit?.unitType;
         if (activeUnitType) {
             const manifest = resolveManifest(activeUnitType);
             if (manifest) {
@@ -694,7 +696,7 @@ export function registerHooks(pi, ecosystemHandlers) {
                     // Subagent inputs use { agent }, { tasks: [{ agent }] }, or { chain: [{ agent }] }.
                     agentClasses = extractSubagentAgentClasses(event.input);
                 }
-                const planningGuard = shouldBlockPlanningUnit(event.toolName, planningInput, dash.basePath || discussionBasePath, activeUnitType, manifest.tools, agentClasses);
+                const planningGuard = shouldBlockPlanningUnit(event.toolName, planningInput, dash.basePath || guidedUnit?.basePath || discussionBasePath, activeUnitType, manifest.tools, agentClasses);
                 if (planningGuard.block)
                     return planningGuard;
             }

package/dist/resources/extensions/gsd/bootstrap/subagent-input.js

@@ -1,22 +1,34 @@
 export function extractSubagentAgentClasses(input) {
     if (!input || typeof input !== "object")
         return [];
-    const record = input;
     const agentClasses = [];
+    const visited = new WeakSet();
     const addAgentClass = (value) => {
-        if (typeof value === "string" && value.trim().length > 0)
-            agentClasses.push(value.trim());
+        if (typeof value !== "string")
+            return;
+        const normalized = value.trim().replace(/\.md$/i, "");
+        if (normalized.length > 0)
+            agentClasses.push(normalized);
     };
-    const addFromItems = (value) => {
+    const visitItems = (value) => {
         if (!Array.isArray(value))
             return;
         for (const item of value) {
-            if (item && typeof item === "object")
-                addAgentClass(item.agent);
+            visit(item);
         }
     };
-    addAgentClass(record.agent);
-    addFromItems(record.tasks);
-    addFromItems(record.chain);
+    const visit = (value) => {
+        if (!value || typeof value !== "object")
+            return;
+        if (visited.has(value))
+            return;
+        visited.add(value);
+        const record = value;
+        addAgentClass(record.agent);
+        visitItems(record.tasks);
+        visitItems(record.chain);
+        visitItems(record.parallel);
+    };
+    visit(input);
     return agentClasses;
 }

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -3,6 +3,7 @@ import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readlinkS
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { minimatch } from "minimatch";
 import { getIsolationMode } from "../preferences.js";
+import { compileSubagentPermissionContract } from "../unit-context-manifest.js";
 import { logWarning } from "../workflow-logger.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
 /**
@@ -58,6 +59,7 @@ const QUEUE_SAFE_TOOLS = new Set([
  *   true / false        — shell no-ops / test exit codes
  */
 const BASH_READ_ONLY_RE = /^\s*(cat|head|tail|less|more|wc|file|stat|du|df|which|type|echo|printf|ls|find|grep|rg|awk|sed\b(?!.*-i)|sort|uniq|diff|comm|tr|cut|tee\s+-a\s+\/dev\/null|git\s+(log|show|diff|status|branch|tag|remote|rev-parse|ls-files|blame|shortlog|describe|stash\s+list|config\s+--get|cat-file)|gh\s+(issue|pr|api|repo|release)\s+(view|list|diff|status|checks)|mkdir\s+-p\s+\.gsd|rtk\s|npm\s+run\s+(test|test:\w+|lint|lint:\w+|typecheck|type-check|type-check:\w+|check|verify|audit|outdated|format:check|ci|validate)\b|npm\s+(ls|list|info|view|show|outdated|audit|explain|doctor|ping|--version|-v)\b|npx\s|tsx\s|node\s+(--print|--version|-v\b)|python[23]?\s+(-c\s+'[^']*'|--version|-V\b|-m\s+(pip\s+show|pip\s+list|site))|pip[23]?\s+(show|list|freeze|check|index\s+versions)\b|jq\s|yq\s|curl\s+(-s\b|--silent\b)(?!\s+[^|>]*\s-[oO]\b)(?!\s+[^|>]*\s--output\b)[^|>]*$|openssl\s+(version|x509|s_client)|env\b|printenv\b|true\b|false\b)/;
+const BASH_VERIFICATION_RE = /^\s*(npm\s+(run\s+(build|test|test:\w+|lint|lint:\w+|typecheck|type-check|verify|ci|validate)\b|test\b)|pnpm\s+(build|test|lint|typecheck|verify)\b|yarn\s+(build|test|lint|typecheck|verify)\b|vitest\b|jest\b|go\s+test\b)/;
 function createEmptyWriteGateState() {
     return {
         verifiedDepthMilestones: new Set(),
@@ -642,6 +644,9 @@ function blockReason(unitType, mode, what) {
  *                    and listed in the policy's allowedSubagents.
  *   - "docs"       → like "planning" but also allows writes to paths
  *                    matching `allowedPathGlobs` relative to basePath.
+ *   - "verification"
+ *                  → allows Bash for project verification commands, but keeps
+ *                    writes restricted to .gsd/ and blocks subagent dispatch.
  *
  * `pathOrCommand` is the file path for write/edit-shaped tools and the
  * shell command for bash. Other tools ignore this argument.
@@ -673,7 +678,7 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
         // Unknown tool in read-only mode — block by default.
         return { block: true, reason: blockReason(unitType, policy.mode, `tool "${tool}" is not on the read-only allowlist`) };
     }
-    // planning / planning-dispatch / docs modes share the same surface for safe tools, bash, and subagent.
+    // planning / planning-dispatch / docs / verification modes share the same surface for safe tools, bash, and subagent.
     if (PLANNING_SAFE_TOOLS.has(tool))
         return { block: false };
     if (tool.startsWith("gsd_"))
@@ -681,7 +686,8 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
     if (PLANNING_SUBAGENT_TOOLS.has(tool)) {
         if (policy.mode === "planning-dispatch") {
             const requested = (agentClasses ?? []).map(a => a.trim()).filter(Boolean);
-            const allowedSubagents = Array.isArray(policy.allowedSubagents) ? policy.allowedSubagents : [];
+            const dispatchContract = compileSubagentPermissionContract(policy);
+            const allowedSubagents = dispatchContract.allowedSubagents;
             const allowed = new Set(allowedSubagents);
             // When agentClasses is undefined, the caller has not been updated to extract
             // agent identities yet. Block and warn so stale callers surface in telemetry
@@ -718,6 +724,14 @@ export function shouldBlockPlanningUnit(toolName, pathOrCommand, basePath, unitT
         return { block: true, reason: blockReason(unitType, policy.mode, `subagent dispatch is not permitted in planning units`) };
     }
     if (tool === "bash") {
+        if (policy.mode === "verification") {
+            if (BASH_VERIFICATION_RE.test(pathOrCommand) || BASH_READ_ONLY_RE.test(pathOrCommand))
+                return { block: false };
+            return {
+                block: true,
+                reason: blockReason(unitType, policy.mode, `bash is restricted to build/test verification commands (npm run build, npm test, etc.); cannot run "${pathOrCommand.slice(0, 80)}${pathOrCommand.length > 80 ? "…" : ""}"`),
+            };
+        }
         if (BASH_READ_ONLY_RE.test(pathOrCommand))
             return { block: false };
         return {

package/dist/resources/extensions/gsd/clean-root-preflight.js

@@ -8,14 +8,153 @@
  *
  * Design constraints (from Trek-e approval):
  *  - Warn the user before stashing (no silent surprises)
- *  - git stash push / git stash pop only — no custom stash management layer
- *  - Stash/pop errors are logged but MUST NOT block the merge itself
+ *  - git stash push / git stash apply+drop for targeted restore
+ *  - Stash/apply errors are logged but MUST NOT block the merge itself
  *  - Fast-path status check — clean trees pay no extra cost
  */
 import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
 import { logWarning } from "./workflow-logger.js";
 import { nativeHasChanges } from "./native-git-bridge.js";
+function gitText(basePath, args) {
+    return execFileSync("git", args, {
+        cwd: basePath,
+        stdio: ["ignore", "pipe", "pipe"],
+        encoding: "utf-8",
+        env: GIT_NO_PROMPT_ENV,
+    });
+}
+function gitBuffer(basePath, args) {
+    return execFileSync("git", args, {
+        cwd: basePath,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: GIT_NO_PROMPT_ENV,
+    });
+}
+function errorText(err) {
+    if (!err || typeof err !== "object")
+        return String(err);
+    const parts = [];
+    const stderr = err.stderr;
+    const stdout = err.stdout;
+    for (const value of [stderr, stdout]) {
+        if (typeof value === "string")
+            parts.push(value);
+        else if (value instanceof Uint8Array)
+            parts.push(Buffer.from(value).toString("utf-8"));
+    }
+    parts.push(err instanceof Error ? err.message : String(err));
+    return parts.filter(Boolean).join("\n");
+}
+function parseAlreadyExistsNoCheckoutPaths(text) {
+    const paths = [];
+    for (const line of text.split(/\r?\n/)) {
+        const match = /^(.+?) already exists, no checkout$/i.exec(line.trim());
+        if (match?.[1])
+            paths.push(match[1]);
+    }
+    return [...new Set(paths)];
+}
+function readZeroDelimitedPaths(output) {
+    return output.split("\0").filter(Boolean);
+}
+function listStashUntrackedPaths(basePath, stashRef) {
+    try {
+        const output = gitText(basePath, ["ls-tree", "-r", "-z", "--name-only", `${stashRef}^3`]);
+        return readZeroDelimitedPaths(output);
+    }
+    catch {
+        return null;
+    }
+}
+function listStashTrackedPaths(basePath, stashRef) {
+    try {
+        const output = gitText(basePath, ["diff", "--name-only", "-z", `${stashRef}^1`, stashRef]);
+        return readZeroDelimitedPaths(output);
+    }
+    catch {
+        return null;
+    }
+}
+function isWorktreeClean(basePath) {
+    try {
+        return gitText(basePath, ["status", "--porcelain"]).trim() === "";
+    }
+    catch {
+        return null;
+    }
+}
+function stashBlobEqualsWorktreeFile(basePath, stashRef, path) {
+    try {
+        const worktreePath = join(basePath, path);
+        if (!existsSync(worktreePath))
+            return false;
+        const worktreeContent = readFileSync(worktreePath);
+        const stashContent = gitBuffer(basePath, ["show", `${stashRef}^3:${path}`]);
+        return Buffer.compare(worktreeContent, stashContent) === 0;
+    }
+    catch {
+        return null;
+    }
+}
+function reconcileAlreadyPresentUntrackedStash(basePath, milestoneId, stashRef, err) {
+    const text = errorText(err);
+    const collidedPaths = parseAlreadyExistsNoCheckoutPaths(text);
+    if (collidedPaths.length === 0)
+        return null;
+    const untrackedPaths = listStashUntrackedPaths(basePath, stashRef);
+    if (!untrackedPaths || untrackedPaths.length === 0)
+        return null;
+    const trackedPaths = listStashTrackedPaths(basePath, stashRef);
+    if (trackedPaths === null || trackedPaths.length > 0)
+        return null;
+    const untrackedPathSet = new Set(untrackedPaths);
+    if (!collidedPaths.every((path) => untrackedPathSet.has(path)))
+        return null;
+    if (!untrackedPaths.every((path) => existsSync(join(basePath, path))))
+        return null;
+    if (isWorktreeClean(basePath) !== true)
+        return null;
+    const blobComparisons = untrackedPaths.map((path) => stashBlobEqualsWorktreeFile(basePath, stashRef, path));
+    if (blobComparisons.some((result) => result === null))
+        return null;
+    const allIdentical = blobComparisons.every(Boolean);
+    if (allIdentical) {
+        let dropped = true;
+        try {
+            execFileSync("git", ["stash", "drop", stashRef], {
+                cwd: basePath,
+                stdio: ["ignore", "pipe", "pipe"],
+                encoding: "utf-8",
+                env: GIT_NO_PROMPT_ENV,
+            });
+        }
+        catch (err) {
+            dropped = false;
+            logWarning("preflight", `git stash drop ${stashRef} failed after identical preflight stash reconciliation: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return {
+            restored: true,
+            needsManualRecovery: false,
+            message: dropped
+                ? `Preflight stash for milestone ${milestoneId} contained files already present after merge; identical stash dropped.`
+                : `Preflight stash for milestone ${milestoneId} contained files already present after merge, but ${stashRef} could not be dropped and remains as a backup.`,
+            stashRef,
+            resolution: dropped ? "already-present-dropped" : "already-present-preserved",
+            collidedPaths,
+        };
+    }
+    return {
+        restored: false,
+        needsManualRecovery: false,
+        message: `Preflight stash for milestone ${milestoneId} contained untracked files already present after merge. Keeping merged files and preserving ${stashRef} as a backup.`,
+        stashRef,
+        resolution: "already-present-preserved",
+        collidedPaths,
+    };
+}
 function findPreflightStashRef(basePath, milestoneId, stashMarker) {
     const markerPrefix = `gsd-preflight-stash:${milestoneId}:`;
     let fallbackRef = null;
@@ -115,28 +254,50 @@ export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
                 message: msg,
             };
         }
-        execFileSync("git", ["stash", "pop", stashRef], {
+        execFileSync("git", ["stash", "apply", stashRef], {
             cwd: basePath,
             stdio: ["ignore", "pipe", "pipe"],
             encoding: "utf-8",
             env: GIT_NO_PROMPT_ENV,
         });
+        let dropWarning = null;
+        try {
+            execFileSync("git", ["stash", "drop", stashRef], {
+                cwd: basePath,
+                stdio: ["ignore", "pipe", "pipe"],
+                encoding: "utf-8",
+                env: GIT_NO_PROMPT_ENV,
+            });
+        }
+        catch (err) {
+            dropWarning = ` Stash was restored, but git stash drop ${stashRef} failed: ${err instanceof Error ? err.message : String(err)}.`;
+            logWarning("preflight", dropWarning.trim());
+        }
         const msg = `Restored stashed changes after milestone ${milestoneId} merge.`;
-        notify(msg, "info");
+        notify(`${msg}${dropWarning ?? ""}`, dropWarning ? "warning" : "info");
         return {
             restored: true,
             needsManualRecovery: false,
-            message: msg,
+            message: `${msg}${dropWarning ?? ""}`,
             stashRef,
+            resolution: "applied",
         };
     }
     catch (err) {
-        // Pop conflicts mean the merged code collides with the stashed changes.
+        if (stashRef) {
+            const reconciled = reconcileAlreadyPresentUntrackedStash(basePath, milestoneId, stashRef, err);
+            if (reconciled) {
+                logWarning("preflight", reconciled.message);
+                notify(reconciled.message, reconciled.resolution === "already-present-preserved" ? "warning" : "info");
+                return reconciled;
+            }
+        }
+        // Apply conflicts mean the merged code collides with the stashed changes.
         // Log a warning — the user needs to resolve manually, but the merge succeeded.
         const restoreHint = stashRef
-            ? `Run "git stash pop ${stashRef}" or "git stash apply ${stashRef}" manually to restore the correct stash.`
+            ? `Run "git stash apply ${stashRef}" manually to restore the correct stash, then "git stash drop ${stashRef}" after recovery.`
             : `Run "git stash list" to find the matching GSD preflight stash before restoring manually.`;
-        const msg = `git stash pop ${stashRef ?? ""}`.trim() + ` failed after merge of milestone ${milestoneId}: ${err instanceof Error ? err.message : String(err)}. ${restoreHint}`;
+        const msg = `git stash apply ${stashRef ?? ""}`.trim() + ` failed after merge of milestone ${milestoneId}: ${err instanceof Error ? err.message : String(err)}. ${restoreHint}`;
         logWarning("preflight", msg);
         notify(msg, "warning");
         return {
@@ -144,6 +305,7 @@ export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
             needsManualRecovery: true,
             message: msg,
             ...(stashRef ? { stashRef } : {}),
+            resolution: "manual-recovery",
         };
     }
 }