gsd-pi 2.82.0 → 3.0.0-dev.1b44e695b

package/src/resources/extensions/gsd/tests/worktree-sync-milestones.test.ts

@@ -607,4 +607,99 @@ describe('worktree-sync-milestones', async () => {
       rmSync(wtBase, { recursive: true, force: true });
     }
   }
+
+  // ─── 16. pre-dispatch sync projects missing future milestone top-level artifacts (#5687) ──
+  console.log('\n=== 16. pre-dispatch sync projects missing future milestone top-level artifacts (#5687) ===');
+  {
+    const mainBase = createBase('main');
+    const wtBase = createBase('wt');
+
+    try {
+      // Canonical .gsd has M003 context draft that complete-milestone needs.
+      const mainM003 = join(mainBase, '.gsd', 'milestones', 'M003');
+      mkdirSync(mainM003, { recursive: true });
+      writeFileSync(join(mainM003, 'M003-CONTEXT-DRAFT.md'), '# M003 Context Draft');
+      writeFileSync(join(mainM003, 'M003-ROADMAP.md'), '# M003 Roadmap');
+
+      // Worktree only has skeletal roadmap for M003.
+      const wtM003 = join(wtBase, '.gsd', 'milestones', 'M003');
+      mkdirSync(wtM003, { recursive: true });
+      writeFileSync(join(wtM003, 'M003-ROADMAP.md'), '# WT Roadmap');
+
+      // Worktree has current milestone file that must not be overwritten.
+      const mainM002 = join(mainBase, '.gsd', 'milestones', 'M002');
+      mkdirSync(mainM002, { recursive: true });
+      writeFileSync(join(mainM002, 'M002-ROADMAP.md'), '# Main M002 Roadmap');
+      const wtM002 = join(wtBase, '.gsd', 'milestones', 'M002');
+      mkdirSync(wtM002, { recursive: true });
+      writeFileSync(join(wtM002, 'M002-ROADMAP.md'), '# Worktree M002 Roadmap');
+
+      // Canonical .gsd has M004 with no corresponding worktree directory at all.
+      const mainM004 = join(mainBase, '.gsd', 'milestones', 'M004');
+      mkdirSync(mainM004, { recursive: true });
+      writeFileSync(join(mainM004, 'M004-CONTEXT-DRAFT.md'), '# M004 Context Draft');
+
+      syncProjectRootToWorktree(mainBase, wtBase, 'M002');
+
+      assert.ok(
+        existsSync(join(wtBase, '.gsd', 'milestones', 'M003', 'M003-CONTEXT-DRAFT.md')),
+        '#5687: future milestone context draft projected into worktree',
+      );
+      assert.equal(
+        readFileSync(join(wtBase, '.gsd', 'milestones', 'M003', 'M003-ROADMAP.md'), 'utf-8'),
+        '# WT Roadmap',
+        '#5687: existing worktree-local M003 file is not overwritten',
+      );
+      assert.equal(
+        readFileSync(join(wtBase, '.gsd', 'milestones', 'M002', 'M002-ROADMAP.md'), 'utf-8'),
+        '# Worktree M002 Roadmap',
+        '#5687: existing worktree-local files are not overwritten',
+      );
+      assert.ok(
+        existsSync(join(wtBase, '.gsd', 'milestones', 'M004', 'M004-CONTEXT-DRAFT.md')),
+        '#5687: future milestone context draft projected into worktree when no wt dir existed',
+      );
+    } finally {
+      cleanup(mainBase);
+      cleanup(wtBase);
+    }
+  }
+
+  // ─── 17. pre-dispatch sync creates absent worktree milestone dir before projecting artifacts (#5687) ──
+  console.log('\n=== 17. pre-dispatch sync creates absent worktree milestone dir before projecting artifacts (#5687) ===');
+  {
+    const mainBase = createBase('main');
+    const wtBase = createBase('wt');
+
+    try {
+      // Canonical .gsd has a future milestone M004 with a context draft.
+      const mainM004 = join(mainBase, '.gsd', 'milestones', 'M004');
+      mkdirSync(mainM004, { recursive: true });
+      writeFileSync(join(mainM004, 'M004-CONTEXT-DRAFT.md'), '# M004 Context Draft');
+
+      // Active milestone M002 exists in both main and worktree.
+      const mainM002 = join(mainBase, '.gsd', 'milestones', 'M002');
+      mkdirSync(mainM002, { recursive: true });
+      writeFileSync(join(mainM002, 'M002-ROADMAP.md'), '# Main M002 Roadmap');
+      const wtM002 = join(wtBase, '.gsd', 'milestones', 'M002');
+      mkdirSync(wtM002, { recursive: true });
+      writeFileSync(join(wtM002, 'M002-ROADMAP.md'), '# Worktree M002 Roadmap');
+
+      // M004 does NOT exist in the worktree at all before sync.
+      assert.ok(
+        !existsSync(join(wtBase, '.gsd', 'milestones', 'M004')),
+        '#5687: worktree M004 dir must not exist before sync',
+      );
+
+      syncProjectRootToWorktree(mainBase, wtBase, 'M002');
+
+      assert.ok(
+        existsSync(join(wtBase, '.gsd', 'milestones', 'M004', 'M004-CONTEXT-DRAFT.md')),
+        '#5687: context draft projected into worktree even when milestone dir was absent',
+      );
+    } finally {
+      cleanup(mainBase);
+      cleanup(wtBase);
+    }
+  }
 });

package/src/resources/extensions/gsd/tests/worktree-telemetry.test.ts

@@ -18,6 +18,7 @@ import {
   emitWorktreeOrphaned,
   emitAutoExit,
   emitCanonicalRootRedirect,
+  normalizeAutoExitReason,
   summarizeWorktreeTelemetry,
   percentile,
 } from "../worktree-telemetry.ts";
@@ -87,6 +88,7 @@ test("emitAutoExit records reason and unmerged-work signal", () => {
   try {
     emitAutoExit(base, {
       reason: "pause",
+      rawReason: "Operation aborted",
       milestoneId: "M003",
       milestoneMerged: false,
       isolationMode: "worktree",
@@ -95,12 +97,26 @@ test("emitAutoExit records reason and unmerged-work signal", () => {
     const entries = queryJournal(base, { eventType: "auto-exit" });
     assert.equal(entries.length, 1);
     assert.equal(entries[0].data?.reason, "pause");
+    assert.equal(entries[0].data?.rawReason, "Operation aborted");
     assert.equal(entries[0].data?.milestoneMerged, false);
     assert.equal(entries[0].data?.isolationMode, "worktree");
     assert.equal(entries[0].data?.worktreeActive, true);
   } finally { cleanup(base); }
 });
 
+test("normalizeAutoExitReason maps new buckets and ignores casing", () => {
+  const cases: Array<{ rawReason: string; expected: string }> = [
+    { rawReason: "Provider Error: timeout", expected: "provider-error" },
+    { rawReason: "SESSION CREATION failed", expected: "session-failed" },
+    { rawReason: "Operation Aborted by upstream", expected: "stream-aborted" },
+    { rawReason: "AUTO-MODE STOPPED by user", expected: "unit-aborted" },
+    { rawReason: "Pausing Auto-Mode after 3 retries", expected: "verification-exhausted" },
+  ];
+  for (const { rawReason, expected } of cases) {
+    assert.equal(normalizeAutoExitReason(rawReason), expected);
+  }
+});
+
 test("summarizeWorktreeTelemetry only counts unmerged exits from active worktrees", (t) => {
   const base = makeTmpBase();
   t.after(() => cleanup(base));

package/src/resources/extensions/gsd/tests/worktree-write-gate.test.ts

@@ -123,6 +123,20 @@ describe("shouldBlockWorktreeWrite (#5199)", () => {
     assert.equal(result.block, false);
   });
 
+  test("Case 6b: relative write from active worktree cwd is allowed", () => {
+    projectRoot = makeProject("worktree");
+    const inside = join(projectRoot, ".gsd", "worktrees", "M001");
+    mkdirSync(inside, { recursive: true });
+    const result = shouldBlockWorktreeWrite(
+      "write",
+      "DESIGN.md",
+      inside,
+      /* isAutoLive */ true,
+      null,
+    );
+    assert.equal(result.block, false);
+  });
+
   test("Case 7: isolation=worktree, auto active, effectiveBasePath is project root (cwd never flipped) → block", () => {
     projectRoot = makeProject("worktree");
     const result = shouldBlockWorktreeWrite(
@@ -136,6 +150,19 @@ describe("shouldBlockWorktreeWrite (#5199)", () => {
     assert.match(result.reason ?? "", /HARD BLOCK/);
   });
 
+  test("Case 7b: relative write from project root cwd is blocked", () => {
+    projectRoot = makeProject("worktree");
+    const result = shouldBlockWorktreeWrite(
+      "write",
+      "DESIGN.md",
+      projectRoot,
+      /* isAutoLive */ true,
+      null,
+    );
+    assert.equal(result.block, true);
+    assert.match(result.reason ?? "", /HARD BLOCK/);
+  });
+
   test("Case 8: bootstrap unit type active → allow", () => {
     projectRoot = makeProject("worktree");
     for (const unitType of ["discuss-milestone", "plan-milestone", "init"]) {

package/src/resources/extensions/gsd/tests/write-gate-planning-unit.test.ts

@@ -26,6 +26,7 @@ const PLANNING_DISPATCH_REVIEW: ToolsPolicy = {
 };
 const READ_ONLY: ToolsPolicy = { mode: 'read-only' };
 const ALL: ToolsPolicy = { mode: 'all' };
+const VERIFICATION: ToolsPolicy = { mode: 'verification' };
 const DOCS: ToolsPolicy = {
   mode: 'docs',
   allowedPathGlobs: ['docs/**', 'README.md', 'README.*.md', 'CHANGELOG.md', '*.md'],
@@ -116,6 +117,11 @@ test('planning-unit: allows read-only bash (cat)', () => {
   assert.strictEqual(r.block, false);
 });
 
+test('planning-unit: allows read-only bash prefixed with cd', () => {
+  const r = shouldBlockPlanningUnit('bash', 'cd .gsd && cat PROJECT.md', BASE, 'plan-slice', PLANNING_DISPATCH);
+  assert.strictEqual(r.block, false);
+});
+
 test('planning-unit: blocks mutating bash (rm -rf)', () => {
   const r = shouldBlockPlanningUnit('bash', 'rm -rf /tmp/foo', BASE, 'discuss-milestone', PLANNING);
   assert.strictEqual(r.block, true);
@@ -157,6 +163,13 @@ test('planning-dispatch: allows subagent dispatch (delegated recon/planner durin
   assert.strictEqual(r.block, false);
 });
 
+test('planning-dispatch: allows markdown agent filenames after identity normalization', () => {
+  const agentClasses = extractSubagentAgentClasses({ agent: 'scout.md' });
+  assert.deepEqual(agentClasses, ['scout']);
+  const r = shouldBlockPlanningUnit('subagent', '', BASE, 'plan-slice', PLANNING_DISPATCH, agentClasses);
+  assert.strictEqual(r.block, false);
+});
+
 test('planning-dispatch: allows task dispatch (delegated recon/planner during slice planning)', () => {
   const r = shouldBlockPlanningUnit('task', '', BASE, 'plan-slice', PLANNING_DISPATCH, ['planner']);
   assert.strictEqual(r.block, false);
@@ -172,6 +185,22 @@ test('planning-dispatch: extracts subagent classes from single, parallel, and ch
     extractSubagentAgentClasses({ chain: [{ agent: 'reviewer' }, { agent: 'security' }] }),
     ['reviewer', 'security'],
   );
+  assert.deepEqual(
+    extractSubagentAgentClasses({
+      chain: [
+        { agent: 'scout' },
+        { parallel: [{ agent: 'reviewer' }, { agent: ' security ' }] },
+      ],
+    }),
+    ['scout', 'reviewer', 'security'],
+  );
+});
+
+test('planning-dispatch: extracts subagent classes without recursing through cycles', () => {
+  const input: { agent: string; parallel?: unknown[] } = { agent: 'scout' };
+  input.parallel = [input, { agent: 'reviewer' }];
+
+  assert.deepEqual(extractSubagentAgentClasses(input), ['scout', 'reviewer']);
 });
 
 test('planning-dispatch: blocks subagent dispatch when agentClasses is undefined (stale caller shim)', () => {
@@ -315,6 +344,36 @@ test('all-mode: execute-task can dispatch subagents', () => {
   assert.strictEqual(r.block, false);
 });
 
+// ─── verification mode: bash allowed, writes still scoped ─────────────────
+
+test('verification-mode: run-uat can run build commands', () => {
+  const r = shouldBlockPlanningUnit('bash', 'npm run build 2>&1', BASE, 'run-uat', VERIFICATION);
+  assert.strictEqual(r.block, false);
+});
+
+test('verification-mode: run-uat blocks destructive bash (rm -rf)', () => {
+  const r = shouldBlockPlanningUnit('bash', 'rm -rf dist', BASE, 'run-uat', VERIFICATION);
+  assert.strictEqual(r.block, true);
+  assert.match(r.reason!, /bash is restricted to build\/test verification commands/);
+});
+
+test('verification-mode: run-uat allows read-only investigative bash (git status)', () => {
+  const r = shouldBlockPlanningUnit('bash', 'git status', BASE, 'run-uat', VERIFICATION);
+  assert.strictEqual(r.block, false);
+});
+
+test('verification-mode: run-uat still blocks user source edits', () => {
+  const r = shouldBlockPlanningUnit('edit', join(BASE, 'src', 'main.ts'), BASE, 'run-uat', VERIFICATION);
+  assert.strictEqual(r.block, true);
+  assert.match(r.reason!, /tools-policy "verification"/);
+});
+
+test('verification-mode: run-uat still blocks subagent dispatch', () => {
+  const r = shouldBlockPlanningUnit('subagent', '', BASE, 'run-uat', VERIFICATION);
+  assert.strictEqual(r.block, true);
+  assert.match(r.reason!, /subagent dispatch is not permitted/);
+});
+
 // ─── read-only mode ───────────────────────────────────────────────────────
 
 test('read-only: blocks any edit even to .gsd/', () => {

package/src/resources/extensions/gsd/tools/complete-milestone.ts

@@ -15,6 +15,7 @@ import {
   getMilestone,
   getMilestoneSlices,
   getSliceTasks,
+  getLatestAssessmentByScope,
   updateMilestoneStatus,
 } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
@@ -38,9 +39,9 @@ export interface CompleteMilestoneParams {
   definitionOfDoneResults?: string;
   /** @optional — empty/omitted renders as "Not provided." */
   requirementOutcomes?: string;
-  /** @optional — empty/omitted renders as "(none)" */
+  /** @optional — empty/omitted renders as an empty frontmatter list */
   keyDecisions?: string[];
-  /** @optional — empty/omitted renders as "(none)" */
+  /** @optional — empty/omitted renders as an empty frontmatter list */
   keyFiles?: string[];
   /** @optional — empty/omitted renders as "(none)" */
   lessonsLearned?: string[];
@@ -70,12 +71,12 @@ function renderMilestoneSummaryMarkdown(params: CompleteMilestoneParams, complet
   const lessonsLearned = params.lessonsLearned ?? [];
 
   const keyDecisionsYaml = keyDecisions.length > 0
-    ? keyDecisions.map(d => `  - ${d}`).join("\n")
-    : "  - (none)";
+    ? `\n${keyDecisions.map(d => `  - ${d}`).join("\n")}`
+    : " []";
 
   const keyFilesYaml = keyFiles.length > 0
-    ? keyFiles.map(f => `  - ${f}`).join("\n")
-    : "  - (none)";
+    ? `\n${keyFiles.map(f => `  - ${f}`).join("\n")}`
+    : " []";
 
   const lessonsYaml = lessonsLearned.length > 0
     ? lessonsLearned.map(l => `  - ${l}`).join("\n")
@@ -86,10 +87,8 @@ id: ${params.milestoneId}
 title: "${displayTitle}"
 status: complete
 completed_at: ${completedAt}
-key_decisions:
-${keyDecisionsYaml}
-key_files:
-${keyFilesYaml}
+key_decisions:${keyDecisionsYaml}
+key_files:${keyFilesYaml}
 lessons_learned:
 ${lessonsYaml}
 ---
@@ -158,6 +157,15 @@ export async function handleCompleteMilestone(
       return;
     }
 
+    // Defense-in-depth: only a passing milestone validation permits closeout.
+    const validation = getLatestAssessmentByScope(params.milestoneId, "milestone-validation");
+    if (validation?.status !== "pass") {
+      guardError =
+        `Refusing to complete ${params.milestoneId}: latest milestone-validation verdict is ` +
+        `"${validation?.status ?? "absent"}". Only verdict=pass permits closeout.`;
+      return;
+    }
+
     // Verify all slices are complete
     const slices = getMilestoneSlices(params.milestoneId);
     if (slices.length === 0) {

package/src/resources/extensions/gsd/tools/complete-slice.ts

@@ -104,12 +104,12 @@ function renderSliceSummaryMarkdown(params: CompleteSliceParams): string {
     : "  []";
 
   const keyFilesYaml = keyFiles.length > 0
-    ? keyFiles.map(f => `  - ${f}`).join("\n")
-    : "  - (none)";
+    ? `\n${keyFiles.map(f => `  - ${f}`).join("\n")}`
+    : " []";
 
   const keyDecisionsYaml = keyDecisions.length > 0
-    ? keyDecisions.map(d => `  - ${d}`).join("\n")
-    : "  - (none)";
+    ? `\n${keyDecisions.map(d => `  - ${d}`).join("\n")}`
+    : " []";
 
   const patternsYaml = patternsEstablished.length > 0
     ? patternsEstablished.map(p => `  - ${p}`).join("\n")
@@ -155,10 +155,8 @@ requires:
 ${requiresYaml}
 affects:
 ${affectsYaml}
-key_files:
-${keyFilesYaml}
-key_decisions:
-${keyDecisionsYaml}
+key_files:${keyFilesYaml}
+key_decisions:${keyDecisionsYaml}
 patterns_established:
 ${patternsYaml}
 observability_surfaces:
@@ -234,6 +232,34 @@ ${params.uatContent}
 `;
 }
 
+function parseRequirementSection(
+  summaryMd: string,
+  heading: "Requirements Advanced" | "Requirements Validated" | "Requirements Invalidated or Re-scoped",
+  field: "how" | "proof" | "what",
+): Array<{ id: string; how?: string; proof?: string; what?: string }> {
+  const headingLine = `## ${heading}\n\n`;
+  const start = summaryMd.indexOf(headingLine);
+  if (start === -1) return [];
+  const contentStart = start + headingLine.length;
+  const nextHeading = summaryMd.indexOf("\n\n## ", contentStart);
+  const content = nextHeading === -1
+    ? summaryMd.slice(contentStart)
+    : summaryMd.slice(contentStart, nextHeading);
+  return content
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.startsWith("- "))
+    .map((line) => line.slice(2).trim())
+    .map((line) => {
+      const pair = line.match(/^(.+?)\s*(?:—|-)\s+(.+)$/);
+      const id = pair ? pair[1].trim() : line.trim();
+      const detail = pair ? pair[2].trim() : "";
+      if (!id || !detail) return null;
+      return { id, [field]: detail };
+    })
+    .filter((entry): entry is { id: string; how?: string; proof?: string; what?: string } => entry !== null);
+}
+
 /**
  * Handle the complete_slice operation end-to-end.
  *
@@ -279,6 +305,7 @@ export async function handleCompleteSlice(
   // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
   const completedAt = new Date().toISOString();
   let guardError: string | null = null;
+  let existingSummaryMd = "";
 
   transaction(() => {
     // State machine preconditions (inside txn for atomicity).
@@ -291,6 +318,7 @@ export async function handleCompleteSlice(
     }
 
     const slice = getSlice(params.milestoneId, params.sliceId);
+    existingSummaryMd = slice?.full_summary_md?.trim() ?? "";
     if (slice && isClosedStatus(slice.status)) {
       if (isStaleWrite("complete-slice")) {
         guardError = "__stale_duplicate__";
@@ -349,8 +377,27 @@ export async function handleCompleteSlice(
     return { error: guardError };
   }
 
+  const effectiveParams: CompleteSliceParams = { ...params };
+  if (existingSummaryMd) {
+    // Keep these heading names in lock-step with renderSliceSummaryMarkdown's
+    // section titles so omitted CompleteSliceParams requirement fields can be
+    // backfilled from previously rendered summary markdown.
+    if (effectiveParams.requirementsAdvanced === undefined) {
+      const parsed = parseRequirementSection(existingSummaryMd, "Requirements Advanced", "how");
+      if (parsed.length > 0) effectiveParams.requirementsAdvanced = parsed as Array<{ id: string; how: string }>;
+    }
+    if (effectiveParams.requirementsValidated === undefined) {
+      const parsed = parseRequirementSection(existingSummaryMd, "Requirements Validated", "proof");
+      if (parsed.length > 0) effectiveParams.requirementsValidated = parsed as Array<{ id: string; proof: string }>;
+    }
+    if (effectiveParams.requirementsInvalidated === undefined) {
+      const parsed = parseRequirementSection(existingSummaryMd, "Requirements Invalidated or Re-scoped", "what");
+      if (parsed.length > 0) effectiveParams.requirementsInvalidated = parsed as Array<{ id: string; what: string }>;
+    }
+  }
+
   // Render summary markdown
-  const summaryMd = renderSliceSummaryMarkdown(params);
+  const summaryMd = renderSliceSummaryMarkdown(effectiveParams);
 
   // Resolve and write summary to disk
   let summaryPath: string;
@@ -365,7 +412,7 @@ export async function handleCompleteSlice(
     summaryPath = join(manualSliceDir, `${params.sliceId}-SUMMARY.md`);
   }
 
-  const uatMd = renderUatMarkdown(params);
+  const uatMd = renderUatMarkdown(effectiveParams);
   const uatPath = summaryPath.replace(/-SUMMARY\.md$/, "-UAT.md");
   setSliceSummaryMd(params.milestoneId, params.sliceId, summaryMd, uatMd);
   let projectionStale = false;

package/src/resources/extensions/gsd/tools/exec-tool.ts

@@ -1,8 +1,5 @@
-// GSD Exec Tool — executor for the gsd_exec MCP tool.
-//
-// Thin wrapper around exec-sandbox.ts that reads effective options from
-// the project preferences (context_mode block) and formats the result
-// for MCP return.
+// Project/App: GSD-2
+// File Purpose: Executor for the gsd_exec MCP tool.
 
 import {
   EXEC_DEFAULTS,
@@ -11,6 +8,7 @@ import {
   type ExecSandboxRequest,
   type ExecSandboxResult,
 } from "../exec-sandbox.js";
+import path from "node:path";
 import { isContextModeEnabled, type ContextModeConfig } from "../preferences-types.js";
 import { contextModeDisabledResult, type ToolExecutionResult } from "./context-mode-tool-result.js";
 
@@ -81,6 +79,93 @@ function paramError(message: string): ToolExecutionResult {
   };
 }
 
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function normalizeScanPath(value: string): string {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+
+function parseWorktreeBase(baseDir: string): { originalRoot: string; worktreeRoot: string } | null {
+  const normalizedBase = normalizeScanPath(baseDir);
+  const marker = "/.gsd/worktrees/";
+  const markerIndex = normalizedBase.indexOf(marker);
+  if (markerIndex <= 0) return null;
+  return {
+    originalRoot: normalizedBase.slice(0, markerIndex),
+    worktreeRoot: normalizedBase,
+  };
+}
+
+function pathInside(parent: string, target: string): boolean {
+  const parentWithSep = parent.endsWith("/") ? parent : `${parent}/`;
+  return target === parent || target.startsWith(parentWithSep);
+}
+
+function stripWrappingQuotes(value: string): string {
+  const trimmed = value.trim();
+  if (trimmed.length < 2) return trimmed;
+  const first = trimmed[0];
+  const last = trimmed[trimmed.length - 1];
+  if ((first === "'" || first === '"' || first === "`") && last === first) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+
+function extractPathLikeValues(script: string): string[] {
+  const values: string[] = [];
+  const push = (candidate: string) => {
+    const cleaned = stripWrappingQuotes(candidate).trim();
+    if (!cleaned) return;
+    values.push(cleaned);
+  };
+  const pushQuotedLiterals = (source: string, depth = 0) => {
+    for (const match of source.matchAll(/(["'`])((?:\\.|(?!\1).)*)\1/g)) {
+      push(match[2]);
+      if (depth < 2 && /["'`]/.test(match[2])) {
+        pushQuotedLiterals(match[2], depth + 1);
+      }
+    }
+  };
+
+  for (const match of script.matchAll(/(?:^|[;\n\r]|\&\&|\|\|)\s*cd\s+([^\n\r;|&]+)/g)) {
+    push(match[1]);
+  }
+  for (const match of script.matchAll(/process\.chdir\(\s*([^\n\r;]+?)\s*\)/g)) {
+    push(match[1]);
+    pushQuotedLiterals(match[1]);
+  }
+  pushQuotedLiterals(script);
+  return values;
+}
+
+function resolvesToOriginalRootOutsideWorktree(script: string, baseDir: string): boolean {
+  const parsed = parseWorktreeBase(baseDir);
+  if (!parsed) return false;
+
+  const normalizedWorktree = normalizeScanPath(path.resolve(parsed.worktreeRoot));
+  const normalizedOriginalRoot = normalizeScanPath(path.resolve(parsed.originalRoot));
+  for (const value of extractPathLikeValues(script)) {
+    const resolved = normalizeScanPath(path.resolve(normalizedWorktree, value));
+    if (pathInside(normalizedOriginalRoot, resolved) && !pathInside(normalizedWorktree, resolved)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function scriptReferencesOriginalRootFromWorktree(script: string, baseDir: string): boolean {
+  const parsed = parseWorktreeBase(baseDir);
+  if (!parsed) return false;
+  const normalizedScript = script.replace(/\\/g, "/");
+  const originalRootPattern = new RegExp(
+    `${escapeRegExp(parsed.originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd/worktrees(?:/|$)))`,
+  );
+  return originalRootPattern.test(normalizedScript);
+}
+
 export async function executeGsdExec(
   params: ExecToolParams,
   deps: ExecToolDeps,
@@ -98,6 +183,14 @@ export async function executeGsdExec(
   if (Buffer.byteLength(script, "utf8") > 200_000) {
     return paramError("script exceeds the 200 KB length limit");
   }
+  if (
+    resolvesToOriginalRootOutsideWorktree(script, deps.baseDir)
+    || scriptReferencesOriginalRootFromWorktree(script, deps.baseDir)
+  ) {
+    return paramError(
+      "script references the original project root while running inside a milestone worktree; use the active worktree path or relative paths",
+    );
+  }
 
   const opts = buildExecOptions(
     deps.baseDir,

package/src/resources/extensions/gsd/tools/plan-milestone.ts

@@ -1,6 +1,6 @@
 import { clearParseCache } from "../files.js";
 import { isClosedStatus } from "../status-guards.js";
-import { isNonEmptyString, validateStringArray } from "../validation.js";
+import { isNonEmptyString, validateStringArray, validateTitle } from "../validation.js";
 import {
   transaction,
   getMilestone,
@@ -148,6 +148,8 @@ function validateSlices(value: unknown): PlanMilestoneSliceInput[] {
     if (seen.has(sliceId)) throw new Error(`slices[${index}].sliceId must be unique`);
     seen.add(sliceId);
     if (!isNonEmptyString(title)) throw new Error(`slices[${index}].title must be a non-empty string`);
+    const titleIssue = validateTitle(title);
+    if (titleIssue) throw new Error(`slices[${index}].title is invalid: ${titleIssue}`);
     if (!isNonEmptyString(risk)) throw new Error(`slices[${index}].risk must be a non-empty string`);
     if (!Array.isArray(depends) || depends.some((item) => !isNonEmptyString(item))) {
       throw new Error(`slices[${index}].depends must be an array of non-empty strings`);
@@ -190,6 +192,8 @@ function validateParams(params: PlanMilestoneParams): PlanMilestoneParams {
   if (!isNonEmptyString(params?.milestoneId)) throw new Error("milestoneId is required");
   if (!isNonEmptyString(params?.title)) throw new Error("title is required");
   if (!isNonEmptyString(params?.vision)) throw new Error("vision is required");
+  const milestoneTitleIssue = validateTitle(params.title);
+  if (milestoneTitleIssue) throw new Error(`title is invalid: ${milestoneTitleIssue}`);
 
   return {
     ...params,