@opengsd/gsd-pi 1.0.2-dev.867e002 → 1.0.2-dev.88c4dc5

package/src/resources/extensions/gsd/dashboard-overlay.ts

@@ -8,7 +8,7 @@
  */
 
 import type { Theme } from "@gsd/pi-coding-agent";
-import { truncateToWidth, visibleWidth, matchesKey, Key } from "@gsd/pi-tui";
+import { truncateToWidth, matchesKey, Key } from "@gsd/pi-tui";
 import { deriveState } from "./state.js";
 import { loadFile } from "./files.js";
 import { isDbAvailable, getMilestoneSlices, getSliceTasks } from "./gsd-db.js";
@@ -29,6 +29,7 @@ import { estimateTimeRemaining } from "./auto-dashboard.js";
 import { computeProgressScore, formatProgressLine } from "./progress-score.js";
 import { runEnvironmentChecks, type EnvironmentCheckResult } from "./doctor-environment.js";
 import { formattedShortcutPair } from "./shortcut-defs.js";
+import { renderDialogFrame, renderKeyHints } from "./tui/render-kit.js";
 
 export function unitLabel(type: string): string {
   switch (type) {
@@ -258,35 +259,26 @@ export class GSDDashboardOverlay {
 
     const content = this.buildContentLines(width);
     const viewportHeight = Math.max(5, process.stdout.rows ? process.stdout.rows - 8 : 24);
-    const chromeHeight = 2;
-    const visibleContentRows = Math.max(1, viewportHeight - chromeHeight);
+    const visibleContentRows = Math.max(1, viewportHeight - 4);
     const maxScroll = Math.max(0, content.length - visibleContentRows);
     this.scrollOffset = Math.min(this.scrollOffset, maxScroll);
     const visibleContent = content.slice(this.scrollOffset, this.scrollOffset + visibleContentRows);
-
-    const lines = this.wrapInBox(visibleContent, width);
+    const contentWidth = Math.max(1, width - 4);
+    const footer = renderKeyHints(
+      this.theme,
+      ["↑↓ scroll", "g/G top/end", `Esc/${formattedShortcutPair("dashboard")} close`],
+      contentWidth,
+    );
+    const lines = renderDialogFrame(this.theme, "GSD Dashboard", visibleContent, width, {
+      footer,
+      scroll: { offset: this.scrollOffset, visibleRows: visibleContentRows, totalRows: content.length },
+    });
 
     this.cachedWidth = width;
     this.cachedLines = lines;
     return lines;
   }
 
-  private wrapInBox(inner: string[], width: number): string[] {
-    const th = this.theme;
-    const border = (s: string) => th.fg("borderAccent", s);
-    const innerWidth = width - 4;
-    const lines: string[] = [];
-
-    lines.push(border("╭" + "─".repeat(width - 2) + "╮"));
-    for (const line of inner) {
-      const truncated = truncateToWidth(line, innerWidth);
-      const padWidth = Math.max(0, innerWidth - visibleWidth(truncated));
-      lines.push(border("│") + " " + truncated + " ".repeat(padWidth) + " " + border("│"));
-    }
-    lines.push(border("╰" + "─".repeat(width - 2) + "╯"));
-    return lines;
-  }
-
   private buildContentLines(width: number): string[] {
     const th = this.theme;
     const shellWidth = width - 4;
@@ -303,7 +295,6 @@ export class GSDDashboardOverlay {
     const hr = () => row(th.fg("dim", "─".repeat(contentWidth)));
     const centered = (content: string) => row(centerLine(content, contentWidth));
 
-    const title = th.fg("accent", th.bold("GSD Dashboard"));
     const isRemote = !!this.dashData.remoteSession;
     const status = this.dashData.active
       ? `${Date.now() % 2000 < 1000 ? th.fg("success", "●") : th.fg("dim", "○")} ${th.fg("success", "AUTO")}`
@@ -328,7 +319,7 @@ export class GSDDashboardOverlay {
     } else if (isRemote) {
       elapsedParts = th.fg("dim", `since ${this.dashData.remoteSession!.startedAt.replace("T", " ").slice(0, 19)}`);
     }
-    lines.push(row(joinColumns(`${title}  ${status}${worktreeTag}`, elapsedParts, contentWidth)));
+    lines.push(row(joinColumns(`${status}${worktreeTag}`, elapsedParts, contentWidth)));
 
     // Progress score — traffic light indicator (#1221)
     if (this.dashData.active || this.dashData.paused) {
@@ -610,10 +601,6 @@ export class GSDDashboardOverlay {
       }
     }
 
-    lines.push(blank());
-    lines.push(hr());
-    lines.push(centered(th.fg("dim", `↑↓ scroll · g/G top/end · Esc/${formattedShortcutPair("dashboard")} close`)));
-
     return lines;
   }
 

package/src/resources/extensions/gsd/doctor-engine-checks.ts

@@ -3,6 +3,7 @@ import { join } from "node:path";
 
 import type { DoctorIssue } from "./doctor-types.js";
 import { isDbAvailable, _getAdapter } from "./gsd-db.js";
+import { isAfter, latestExplicitReopenAt } from "./milestone-reopen-events.js";
 import { resolveGsdPathContract, resolveMilestoneFile } from "./paths.js";
 import { deriveState } from "./state.js";
 import { readEvents } from "./workflow-events.js";
@@ -151,6 +152,104 @@ export async function checkEngineHealth(
       } catch {
         // Non-fatal — duplicate ID check failed
       }
+
+      // e. Completed milestone dispatch history but DB reopened without an explicit reopen event.
+      try {
+        const reopened = adapter
+          .prepare(
+            `SELECT m.id, m.status, ud.started_at, ud.ended_at
+             FROM milestones m
+             JOIN unit_dispatches ud ON ud.milestone_id = m.id
+             WHERE m.status NOT IN ('complete', 'done', 'skipped', 'closed')
+               AND ud.unit_type = 'complete-milestone'
+               AND ud.unit_id = m.id
+               AND ud.status = 'completed'
+               AND ud.id = (
+                 SELECT latest.id
+                 FROM unit_dispatches latest
+                 WHERE latest.milestone_id = m.id
+                   AND latest.unit_type = 'complete-milestone'
+                   AND latest.unit_id = m.id
+                   AND latest.status = 'completed'
+                 ORDER BY COALESCE(latest.ended_at, latest.started_at) DESC, latest.id DESC
+                 LIMIT 1
+               )
+             ORDER BY m.id`,
+          )
+          .all() as Array<{ id: string; status: string; started_at: string | null; ended_at: string | null }>;
+
+        for (const row of reopened) {
+          const completedAt = row.ended_at ?? row.started_at ?? null;
+          const reopenAt = latestExplicitReopenAt(basePath, row.id);
+          if (reopenAt && (!completedAt || Date.parse(reopenAt) > Date.parse(completedAt))) continue;
+          issues.push({
+            severity: "error",
+            code: "completed_milestone_reopened",
+            scope: "milestone",
+            unitId: row.id,
+            message: `Milestone ${row.id} has completed complete-milestone dispatch history but DB status is ${row.status}. Explicitly reopen or recover before planning it again.`,
+            fixable: false,
+          });
+        }
+      } catch {
+        // Non-fatal — completed-milestone reopen check failed
+      }
+
+      // f. Completion artifacts disagree with open DB hierarchy rows.
+      try {
+        const rows = adapter
+          .prepare(
+            `SELECT a.path, a.artifact_type, a.milestone_id, a.slice_id, a.task_id, a.imported_at,
+                    m.status AS milestone_status,
+                    s.status AS slice_status,
+                    t.status AS task_status,
+                    (SELECT COUNT(*) FROM tasks tt WHERE tt.milestone_id = a.milestone_id AND tt.slice_id = a.slice_id) AS task_count
+             FROM artifacts a
+             JOIN milestones m ON m.id = a.milestone_id
+             LEFT JOIN slices s ON s.milestone_id = a.milestone_id AND s.id = a.slice_id
+             LEFT JOIN tasks t ON t.milestone_id = a.milestone_id AND t.slice_id = a.slice_id AND t.id = a.task_id
+             WHERE a.artifact_type = 'SUMMARY'
+               AND m.status NOT IN ('complete', 'done', 'skipped', 'closed')`,
+          )
+          .all() as Array<{
+            path: string;
+            milestone_id: string;
+            slice_id: string | null;
+            task_id: string | null;
+            imported_at: string | null;
+            slice_status: string | null;
+            task_status: string | null;
+            task_count: number;
+          }>;
+
+        const seen = new Set<string>();
+        for (const row of rows) {
+          const reopenAt = latestExplicitReopenAt(basePath, row.milestone_id);
+          if (!isAfter(row.imported_at, reopenAt)) continue;
+          const isSliceSummary = row.slice_id && !row.task_id && row.slice_status && !["complete", "done", "skipped", "closed"].includes(row.slice_status);
+          const isTaskSummary = row.slice_id && row.task_id && (!row.task_status || !["complete", "done", "skipped", "closed"].includes(row.task_status));
+          const isTaskArtifactWithoutDbTasks = row.slice_id && row.task_id && Number(row.task_count) === 0;
+          if (!isSliceSummary && !isTaskSummary && !isTaskArtifactWithoutDbTasks) continue;
+
+          const unitId = row.task_id
+            ? `${row.milestone_id}/${row.slice_id}/${row.task_id}`
+            : row.slice_id
+              ? `${row.milestone_id}/${row.slice_id}`
+              : row.milestone_id;
+          if (seen.has(unitId)) continue;
+          seen.add(unitId);
+          issues.push({
+            severity: "error",
+            code: "artifact_db_status_divergence",
+            scope: row.task_id ? "task" : row.slice_id ? "slice" : "milestone",
+            unitId,
+            message: `Completion artifact ${row.path} exists while DB state for ${unitId} is still open or missing. Runtime will not import it silently; run explicit recovery/repair after review.`,
+            fixable: false,
+          });
+        }
+      } catch {
+        // Non-fatal — artifact/DB status drift check failed
+      }
     }
   } catch {
     // Non-fatal — DB constraint checks failed entirely

package/src/resources/extensions/gsd/doctor-providers.ts

@@ -16,7 +16,7 @@ import { delimiter, join } from "node:path";
 import { AuthStorage } from "@gsd/pi-coding-agent";
 import { getEnvApiKey } from "@gsd/pi-ai";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
-import { getAuthPath, PROVIDER_REGISTRY, type ProviderCategory } from "./key-manager.js";
+import { getAuthPath, PROVIDER_REGISTRY, supportsBrowserOAuth, type ProviderCategory } from "./key-manager.js";
 import { homedir } from "node:os";
 
 // ── Types ──────────────────────────────────────────────────────────────────────
@@ -42,11 +42,10 @@ export interface ProviderCheckResult {
 
 /**
  * Providers that use external CLI authentication (not API keys).
- * These are always considered "found" — the host CLI handles auth.
+ * When explicitly selected, the provider's own CLI/session owns auth.
  */
 const CLI_AUTH_PROVIDERS = new Set([
   "claude-code",
-  "openai-codex",
   "google-gemini-cli",
   "google-antigravity",
 ]);
@@ -156,26 +155,30 @@ interface KeyLookup {
  * Map of CLI provider IDs to their binary names on disk.
  * Used for lightweight binary-presence checks (PATH scan, no subprocess).
  */
-const CLI_BINARY_MAP: Record<string, string> = {
-  "claude-code": "claude",
-  "openai-codex": "codex",
-  "google-gemini-cli": "gemini",
-  "google-antigravity": "antigravity",
+const CLI_BINARY_MAP: Record<string, string[]> = {
+  "claude-code": ["claude", "claude-code"],
+  "google-gemini-cli": ["gemini"],
+  "google-antigravity": ["agy"],
 };
 
+const CLI_AUTH_PATH_CHECK_PROVIDERS = new Set([
+  "google-gemini-cli",
+  "google-antigravity",
+]);
+
 /**
  * Check if a CLI provider's binary exists anywhere in PATH.
  * Fast filesystem scan — no subprocess, no network, sub-1ms.
  */
 function isCliBinaryInPath(providerId: string): boolean {
-  const binary = CLI_BINARY_MAP[providerId];
-  if (!binary) return false;
+  const binaries = CLI_BINARY_MAP[providerId];
+  if (!binaries) return false;
 
   const pathDirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
 
   // On Windows, command shims are commonly installed as .cmd/.exe/.bat/.com.
   // Scan PATHEXT candidates in addition to the bare binary name.
-  const executableNames: string[] = [binary];
+  const executableNames: string[] = [...binaries];
   if (process.platform === "win32") {
     const rawPathExt = process.env.PATHEXT
       ?.split(";")
@@ -185,9 +188,11 @@ function isCliBinaryInPath(providerId: string): boolean {
       ext.startsWith(".") ? ext.toLowerCase() : `.${ext.toLowerCase()}`,
     );
     const defaultExt = [".exe", ".cmd", ".bat", ".com"];
-    for (const ext of [...normalizedPathExt, ...defaultExt]) {
-      const candidate = `${binary}${ext}`;
-      if (!executableNames.includes(candidate)) executableNames.push(candidate);
+    for (const binary of binaries) {
+      for (const ext of [...normalizedPathExt, ...defaultExt]) {
+        const candidate = `${binary}${ext}`;
+        if (!executableNames.includes(candidate)) executableNames.push(candidate);
+      }
     }
   }
 
@@ -224,12 +229,6 @@ function hasModelsJsonApiKey(providerId: string): boolean {
 function resolveKey(providerId: string): KeyLookup {
   const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
 
-  // claude-code never stores credentials in auth.json — GSD delegates entirely to
-  // the local CLI binary. Presence of the binary in PATH is the only signal.
-  if (providerId === "claude-code") {
-    return { found: isCliBinaryInPath("claude-code"), source: "env", backedOff: false };
-  }
-
   if (providerId === "anthropic-vertex" && process.env.ANTHROPIC_VERTEX_PROJECT_ID) {
     return { found: true, source: "env", backedOff: false };
   }
@@ -242,9 +241,15 @@ function resolveKey(providerId: string): KeyLookup {
       const creds = auth.getCredentialsForProvider(providerId);
       if (creds.length > 0) {
         // Filter out empty placeholder keys (from skipped onboarding)
-        const hasRealKey = creds.some(c =>
-          c.type === "oauth" || (c.type === "api_key" && (c as { key?: string }).key)
-        );
+        const hasRealKey = creds.some(c => {
+          if (c.type === "oauth") return true;
+          if (c.type !== "api_key") return false;
+
+          const key = (c as { key?: string }).key?.trim();
+          if (!key) return false;
+
+          return !(CLI_AUTH_PROVIDERS.has(providerId) && key === "cli");
+        });
         if (hasRealKey) {
           return {
             found: true,
@@ -275,6 +280,12 @@ function resolveKey(providerId: string): KeyLookup {
     return { found: true, source: "models.json", backedOff: false };
   }
 
+  // Cross-provider routes can use a local CLI when it is installed. Explicit
+  // external CLI provider selections are handled in checkLlmProviders() below.
+  if (CLI_AUTH_PROVIDERS.has(providerId) && isCliBinaryInPath(providerId)) {
+    return { found: true, source: "env", backedOff: false };
+  }
+
   return { found: false, source: "none", backedOff: false };
 }
 
@@ -285,15 +296,32 @@ function checkLlmProviders(): ProviderCheckResult[] {
   const results: ProviderCheckResult[] = [];
 
   for (const providerId of required) {
-    // CLI-authenticated providers don't need API keys — skip key check
+    // CLI-authenticated providers don't need API keys. The provider's own
+    // request path validates CLI sessions when it is used.
     if (CLI_AUTH_PROVIDERS.has(providerId)) {
       const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
+      const label = info?.label ?? providerId;
+      if (CLI_AUTH_PATH_CHECK_PROVIDERS.has(providerId) && !isCliBinaryInPath(providerId)) {
+        const binaries = CLI_BINARY_MAP[providerId]?.map(binary => `\`${binary}\``).join(" or ");
+        results.push({
+          name: providerId,
+          label,
+          category: "llm",
+          status: "error",
+          message: `${label} — CLI not found`,
+          detail: binaries
+            ? `Install ${label} and ensure ${binaries} is on PATH`
+            : `Install ${label} and ensure its CLI is on PATH`,
+          required: true,
+        });
+        continue;
+      }
       results.push({
         name: providerId,
-        label: info?.label ?? providerId,
+        label,
         category: "llm",
         status: "ok",
-        message: `${info?.label ?? providerId} — CLI auth (no key needed)`,
+        message: `${label} — CLI auth (no key needed)`,
         required: true,
       });
       continue;
@@ -333,7 +361,7 @@ function checkLlmProviders(): ProviderCheckResult[] {
         message: `${label} — not configured`,
         detail: providerId === "anthropic-vertex"
           ? "Set ANTHROPIC_VERTEX_PROJECT_ID and authenticate with Google ADC"
-          : info?.hasOAuth
+          : info && supportsBrowserOAuth(info)
           ? `Run /gsd keys to authenticate`
           : `Set ${envVar} or run /gsd keys`,
         required: true,

package/src/resources/extensions/gsd/doctor-types.ts

@@ -83,6 +83,8 @@ export type DoctorIssueCode =
   | "db_orphaned_task"
   | "db_orphaned_slice"
   | "db_done_task_no_summary"
+  | "artifact_db_status_divergence"
+  | "completed_milestone_reopened"
   | "db_duplicate_id"
   | "db_unavailable"
   | "projection_drift"

package/src/resources/extensions/gsd/doctor.ts

@@ -514,13 +514,18 @@ export async function runGSDDoctor(basePath: string, options?: { fix?: boolean;
           try {
             if (!lstatSync(join(slicesDir, entry)).isDirectory()) continue;
           } catch { continue; }
+          if (entry === "parallel-research") continue;
           if (!knownSliceIds.has(entry)) {
+            const quarantineExample = `.gsd/quarantine/milestones/${milestoneId}/slices/${entry}-manual-review`;
             issues.push({
               severity: "warning",
               code: "orphaned_slice_directory",
               scope: "milestone",
               unitId: milestoneId,
-              message: `Directory "${entry}" exists in ${milestoneId}/slices/ but is not referenced in the roadmap`,
+              message:
+                `Directory "${entry}" exists in ${milestoneId}/slices/ but is not referenced in the roadmap or DB. ` +
+                `Review it; if stale, move or delete it. To preserve it, move it under ${quarantineExample}. ` +
+                "If it contains work to keep, copy or merge that content into a DB-backed slice before resuming.",
               file: `${relMilestonePath(basePath, milestoneId)}/slices/${entry}`,
               fixable: false,
             });

package/src/resources/extensions/gsd/git-conflict-state.ts

@@ -3,7 +3,7 @@
 
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 
 import { autoResolveSafeConflictPaths } from "./git-conflict-resolve.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
@@ -14,6 +14,21 @@ function splitZeroDelimited(output: string): string[] {
   return output.split("\0").filter(Boolean);
 }
 
+function hasGitMarker(basePath: string): boolean {
+  try {
+    let dir = resolve(basePath);
+    for (let i = 0; i < 30; i++) {
+      if (existsSync(join(dir, ".git"))) return true;
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch {
+    // Fall through to the git probes, which will report unknown on failure.
+  }
+  return false;
+}
+
 export function listUnmergedGitPaths(basePath: string): string[] | null {
   try {
     const output = spawnSync("git", ["diff", "--name-only", "--diff-filter=U", "-z"], {
@@ -75,6 +90,15 @@ export interface GitConflictProbeResult {
 }
 
 export function probeGitConflictState(basePath: string): GitConflictProbeResult {
+  if (!hasGitMarker(basePath)) {
+    return {
+      status: "clean",
+      unmerged: [],
+      checkFailures: [],
+      mergeStateBlockers: [],
+    };
+  }
+
   const unmerged = listUnmergedGitPaths(basePath);
   if (unmerged === null) {
     return {

package/src/resources/extensions/gsd/guided-flow.ts

@@ -1218,7 +1218,7 @@ async function dispatchWorkflow(
 
     if (unitType) setGuidedUnitContext(projectRoot, unitType);
     try {
-      pi.sendMessage(
+      await pi.sendMessage(
         {
           customType,
           content: buildWorkflowDispatchContent({ workflow, workflowPath, task: note }),
@@ -1231,10 +1231,9 @@ async function dispatchWorkflow(
       throw err;
     }
   } finally {
-    // Restore full tool set after the message is queued. The LLM turn has
-    // already captured the scoped set — restoring prevents the narrowed
-    // tools from leaking into subsequent dispatches (#3628). The finally
-    // block ensures restoration even if sendMessage throws.
+    // Restore full tool/skill surface after the turn completes. Awaiting
+    // sendMessage ensures scoped skills stay in _baseSystemPrompt through
+    // before_agent_start (#3628, skill token savings).
     restoreGsdWorkflowTools(pi, savedTools);
   }
 }
@@ -1358,7 +1357,7 @@ function buildHeadlessDiscussPrompt(nextId: string, seedContext: string, _basePa
  * Run preparation phase if enabled, then build the discuss prompt.
  * Preparation analyzes the codebase and prior context, injecting the results
  * as supplementary context into the standard discuss template. The discuss
- * template drives the conversation (asks "What's the vision?" first), while
+ * template drives the conversation with a variable vision opener, while
  * the preparation briefs give the agent grounding in the existing codebase.
  *
  * @param ctx - Extension command context with UI for progress notifications

package/src/resources/extensions/gsd/key-manager.ts

@@ -22,6 +22,7 @@ import { gsdHome } from "./gsd-home.js";
 // ─── Provider Registry ─────────────────────────────────────────────────────────
 
 export type ProviderCategory = "llm" | "tool" | "search" | "remote";
+export type ProviderAuthMode = "apiKey" | "browserOAuth" | "externalCli" | "cloudIdentity" | "none";
 
 export interface ProviderInfo {
   id: string;
@@ -29,24 +30,24 @@ export interface ProviderInfo {
   category: ProviderCategory;
   envVar?: string;
   prefixes?: string[];
-  hasOAuth?: boolean;
+  authMode?: ProviderAuthMode;
   dashboardUrl?: string;
 }
 
 export const PROVIDER_REGISTRY: ProviderInfo[] = [
   // LLM Providers
-  { id: "anthropic",        label: "Anthropic (Claude)",      category: "llm", envVar: "ANTHROPIC_API_KEY",      prefixes: ["sk-ant-"], hasOAuth: true, dashboardUrl: "console.anthropic.com" },
+  { id: "anthropic",        label: "Anthropic (Claude)",      category: "llm", envVar: "ANTHROPIC_API_KEY",      prefixes: ["sk-ant-"], authMode: "apiKey", dashboardUrl: "console.anthropic.com" },
   // Claude Code CLI: routes through the local `claude` binary — no API key,
   // authentication is handled by the CLI's own OAuth flow.
   // Referenced by doctor-providers.ts, auto-model-selection.ts, and others;
   // must be in the canonical registry so all consumers see the same catalog.
   // See: https://github.com/open-gsd/gsd-pi/issues/4541
-  { id: "claude-code",      label: "Claude Code CLI",         category: "llm",                                   hasOAuth: true },
+  { id: "claude-code",      label: "Claude Code CLI",         category: "llm",                                   authMode: "externalCli" },
   { id: "openai",           label: "OpenAI",                  category: "llm", envVar: "OPENAI_API_KEY",         prefixes: ["sk-"],     dashboardUrl: "platform.openai.com/api-keys" },
-  { id: "github-copilot",   label: "GitHub Copilot",          category: "llm", envVar: "GITHUB_TOKEN",           hasOAuth: true },
-  { id: "openai-codex",     label: "ChatGPT Plus/Pro (Codex)",category: "llm",                                   hasOAuth: true },
-  { id: "google-gemini-cli",label: "Google Gemini CLI",       category: "llm",                                   hasOAuth: true },
-  { id: "google-antigravity",label: "Antigravity",            category: "llm",                                   hasOAuth: true },
+  { id: "github-copilot",   label: "GitHub Copilot",          category: "llm", envVar: "GITHUB_TOKEN",           authMode: "browserOAuth" },
+  { id: "openai-codex",     label: "ChatGPT Plus/Pro (Codex)",category: "llm",                                   authMode: "browserOAuth" },
+  { id: "google-gemini-cli",label: "Google Gemini CLI",       category: "llm",                                   authMode: "externalCli" },
+  { id: "google-antigravity",label: "Antigravity",            category: "llm",                                   authMode: "externalCli" },
   { id: "google",           label: "Google (Gemini)",         category: "llm", envVar: "GEMINI_API_KEY",         dashboardUrl: "aistudio.google.com/apikey" },
   { id: "groq",             label: "Groq",                    category: "llm", envVar: "GROQ_API_KEY",           dashboardUrl: "console.groq.com" },
   { id: "xai",              label: "xAI (Grok)",              category: "llm", envVar: "XAI_API_KEY",            dashboardUrl: "console.x.ai" },
@@ -77,6 +78,21 @@ export const PROVIDER_REGISTRY: ProviderInfo[] = [
 
 // ─── Utilities ──────────────────────────────────────────────────────────────────
 
+export function getProviderAuthMode(provider: ProviderInfo): ProviderAuthMode {
+  return provider.authMode ?? "apiKey";
+}
+
+export function supportsBrowserOAuth(provider: ProviderInfo): boolean {
+  return getProviderAuthMode(provider) === "browserOAuth";
+}
+
+export function supportsStoredApiKey(provider: ProviderInfo): boolean {
+  const mode = getProviderAuthMode(provider);
+  if (mode === "externalCli" || mode === "cloudIdentity" || mode === "none") return false;
+  if (mode === "browserOAuth") return Boolean(provider.envVar || provider.prefixes?.length);
+  return true;
+}
+
 /**
  * Mask an API key for display: show first 4 + last 4 chars.
  * Keys shorter than 12 chars show only first 2 + last 2.
@@ -104,10 +120,13 @@ export function formatDuration(ms: number): string {
 /**
  * Describe a credential's type and status.
  */
-export function describeCredential(cred: AuthCredential): string {
+export function describeCredential(cred: AuthCredential, provider?: ProviderInfo): string {
   if (cred.type === "api_key") {
     const apiCred = cred as ApiKeyCredential;
     if (!apiCred.key) return "empty key";
+    if (apiCred.key === "cli" && provider && getProviderAuthMode(provider) === "externalCli") {
+      return "external CLI";
+    }
     return `API key (${maskKey(apiCred.key)})`;
   }
   if (cred.type === "oauth") {
@@ -171,7 +190,7 @@ export function getAllKeyStatuses(auth: AuthStorage): KeyStatus[] {
       const desc =
         creds.length > 1
           ? `${creds.length} keys (round-robin)`
-          : describeCredential(firstCred);
+          : describeCredential(firstCred, provider);
       return {
         provider,
         configured: true,
@@ -289,9 +308,28 @@ export async function handleAddKey(
     provider = PROVIDER_REGISTRY[idx];
   }
 
-  // If OAuth is available, offer choice
-  if (provider.hasOAuth) {
-    const methods = ["API key", "Browser login (OAuth)"];
+  const authMode = getProviderAuthMode(provider);
+  if (authMode === "externalCli") {
+    ctx.ui.notify(
+      `${provider.label} is authenticated by its own local CLI. ` +
+      `Sign in with that CLI first, then run /login to activate it in GSD.`,
+      "info",
+    );
+    return false;
+  }
+
+  if (authMode === "cloudIdentity") {
+    ctx.ui.notify(
+      `${provider.label} uses cloud identity credentials. Configure the provider's cloud CLI or environment, then restart GSD.`,
+      "info",
+    );
+    return false;
+  }
+
+  if (supportsBrowserOAuth(provider)) {
+    const methods = supportsStoredApiKey(provider)
+      ? ["API token/key", "Browser login (OAuth)"]
+      : ["Browser login (OAuth)"];
     const method = await ctx.ui.select(
       `${provider.label} — how do you want to authenticate?`,
       methods,
@@ -308,6 +346,11 @@ export async function handleAddKey(
     }
   }
 
+  if (!supportsStoredApiKey(provider)) {
+    ctx.ui.notify(`${provider.label} does not accept a GSD-stored API key. Use /login.`, "info");
+    return false;
+  }
+
   // API key input
   const input = await ctx.ui.input(
     `API key for ${provider.label}:`,
@@ -387,7 +430,7 @@ export async function handleRemoveKey(
 
   // Multi-key handling
   if (creds.length > 1) {
-    const options = creds.map((c, i) => `[${i + 1}] ${describeCredential(c)}`);
+    const options = creds.map((c, i) => `[${i + 1}] ${describeCredential(c, provider)}`);
     options.push("Remove all");
 
     const choice = await ctx.ui.select(
@@ -411,7 +454,7 @@ export async function handleRemoveKey(
   } else {
     const confirmed = await ctx.ui.confirm(
       "Remove key?",
-      `Remove ${describeCredential(creds[0])} for ${provider.label}?`,
+      `Remove ${describeCredential(creds[0], provider)} for ${provider.label}?`,
     );
     if (!confirmed) return false;
     auth.remove(provider.id);

package/src/resources/extensions/gsd/milestone-reopen-events.ts

@@ -0,0 +1,28 @@
+import { join } from "node:path";
+
+import { gsdRoot } from "./paths.js";
+import { readEvents } from "./workflow-events.js";
+
+export function latestExplicitReopenAt(basePath: string, milestoneId: string): string | null {
+  const root = gsdRoot(basePath);
+  const candidates = [
+    join(root, "event-log.jsonl"),
+    join(root, `event-log-${milestoneId}.jsonl.archived`),
+  ];
+
+  let latest: string | null = null;
+  for (const file of candidates) {
+    for (const event of readEvents(file)) {
+      const eventMilestoneId = (event.params as { milestoneId?: unknown }).milestoneId;
+      if (event.cmd !== "reopen-milestone" || eventMilestoneId !== milestoneId) continue;
+      if (!latest || event.ts > latest) latest = event.ts;
+    }
+  }
+  return latest;
+}
+
+export function isAfter(value: string | null | undefined, cutoff: string | null): boolean {
+  if (!cutoff) return true;
+  if (!value) return true;
+  return Date.parse(value) > Date.parse(cutoff);
+}