@opengsd/gsd-pi 1.1.1-dev.b2556262 → 1.2.0-dev.0b870afa

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -13,7 +13,7 @@ import { getSessionModelOverride } from "./session-model-override.js";
 import { logWarning } from "./workflow-logger.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { applyModelPolicyFilter } from "./uok/model-policy.js";
-import { isModelBlocked } from "./blocked-models.js";
+import { isModelBlocked, isModelTemporarilyUnavailable } from "./blocked-models.js";
 import { getRequiredWorkflowToolsForAutoUnit, isWorkflowMcpSurfaceTool } from "./workflow-mcp.js";
 /**
  * Thrown when the model-policy gate rejects every candidate model for a unit
@@ -90,6 +90,14 @@ export function getToolBaselineSnapshot(pi) {
         return live;
     return [...new Set([...baseline, ...live])];
 }
+export function getRegisteredToolSnapshot(pi) {
+    if (typeof pi.getAllTools !== "function")
+        return getToolBaselineSnapshot(pi);
+    const names = pi.getAllTools()
+        .map((tool) => tool.name)
+        .filter((name) => typeof name === "string" && name.length > 0);
+    return [...new Set(names)];
+}
 /**
  * Models eligible for the pre-dispatch policy gate. Prefer registry-available
  * models; when that list is empty (common after worktree resume before registry
@@ -210,6 +218,10 @@ function buildModelPolicyBlockReasons(policyDenyReasons, availableModels, routin
             reason: `configured model(s) did not resolve against policy-eligible registry [${eligibleSummary}]`,
         }];
 }
+function isModelUnavailable(basePath, provider, id) {
+    return isModelBlocked(basePath, provider, id) ||
+        isModelTemporarilyUnavailable(basePath, provider, id);
+}
 function restoreToolBaseline(pi) {
     const key = pi;
     const baseline = TOOL_BASELINE.get(key);
@@ -649,8 +661,8 @@ autoModeStartThinkingLevel) {
             // (issue #4513).  The block is persisted in .gsd/runtime/blocked-models.json
             // so it survives /gsd auto restarts — without this, the same dead model
             // gets reselected after every restart.
-            if (isModelBlocked(basePath, model.provider, model.id)) {
-                ctx.ui.notify(`Skipping blocked model ${model.provider}/${model.id} (provider rejected it for this account).`, "warning");
+            if (isModelUnavailable(basePath, model.provider, model.id)) {
+                ctx.ui.notify(`Skipping unavailable model ${model.provider}/${model.id}.`, "warning");
                 continue;
             }
             // Warn if the ID is ambiguous across providers
@@ -716,7 +728,7 @@ autoModeStartThinkingLevel) {
                 const key = `${model.provider.toLowerCase()}/${model.id.toLowerCase()}`;
                 if (!policyAllowedModelKeys.has(key))
                     continue;
-                if (isModelBlocked(basePath, model.provider, model.id))
+                if (isModelUnavailable(basePath, model.provider, model.id))
                     continue;
                 const ok = await pi.setModel(model, { persist: false });
                 if (!ok)
@@ -738,16 +750,16 @@ autoModeStartThinkingLevel) {
         // No model preference for this unit type — re-apply the model captured
         // at auto-mode start to prevent bleed from shared global settings.json (#650).
         const availableModels = buildModelPolicyCandidates(ctx, autoModeStartModel, effectiveSessionModelOverride);
-        const startBlocked = isModelBlocked(basePath, autoModeStartModel.provider, autoModeStartModel.id);
+        const startBlocked = isModelUnavailable(basePath, autoModeStartModel.provider, autoModeStartModel.id);
         if (startBlocked) {
-            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is blocked for this account. Using current session model instead.`, "warning");
+            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is unavailable. Using current session model instead.`, "warning");
         }
         else {
             const startModel = availableModels.find(m => m.provider === autoModeStartModel.provider && m.id === autoModeStartModel.id);
             if (startModel) {
                 const ok = await pi.setModel(startModel, { persist: false });
                 if (!ok) {
-                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelBlocked(basePath, m.provider, m.id));
+                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelUnavailable(basePath, m.provider, m.id));
                     if (byId) {
                         const fallbackOk = await pi.setModel(byId, { persist: false });
                         if (fallbackOk) {
@@ -831,15 +843,34 @@ export function resolveModelId(modelId, availableModels, currentProvider) {
         if (providerMatch)
             return providerMatch;
     }
-    // Prefer "anthropic" as the canonical provider for Anthropic models.
-    // Transport-specific tiebreaker (ADR-012): intentionally keys on provider,
-    // not api — we want the plain Anthropic transport when multiple are available.
-    const anthropicMatch = candidates.find(m => m.provider === "anthropic");
-    if (anthropicMatch)
-        return anthropicMatch;
+    // Subscription/OAuth routes beat pay-per-token API when the same model ID
+    // exists on multiple providers. Order matters — first match wins.
+    for (const provider of BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE) {
+        const match = candidates.find(m => m.provider === provider);
+        if (match)
+            return match;
+    }
     // Fall back to first non-extension candidate, or any candidate
     return candidates.find(m => !EXTENSION_PROVIDERS.has(m.provider)) ?? candidates[0];
 }
+/**
+ * When a bare model ID exists on multiple providers, prefer subscription/OAuth
+ * routes over pay-per-token API keys. Matches PROVIDER_ROUTES in doctor-providers
+ * but applies when *both* sides are authenticated.
+ *
+ * Order rationale:
+ * - openai-codex before github-copilot: ChatGPT-native for shared GPT IDs
+ * - google-gemini-cli before github-copilot: first-party Gemini CLI
+ * - anthropic before github-copilot: first-party Claude API/OAuth over Copilot
+ * - github-copilot before openai/google: Copilot OAuth over platform API keys
+ */
+export const BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE = [
+    "openai-codex",
+    "google-gemini-cli",
+    "anthropic",
+    "github-copilot",
+    "google-antigravity",
+];
 /**
  * Flat-rate providers charge the same per request regardless of model.
  * Dynamic routing provides no cost benefit — it only degrades quality (#3453).

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -16,7 +16,7 @@ import { deriveState } from "./state.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { loadFile, parseSummary, resolveAllOverrides } from "./files.js";
 import { loadPrompt } from "./prompt-loader.js";
-import { isAwaitingUserInput } from "./user-input-boundary.js";
+import { isAwaitingUserInput } from "./consent-question.js";
 import { resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveMilestoneFile, resolveTasksDir, buildTaskFileName, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { rebuildState } from "./doctor.js";
@@ -28,9 +28,9 @@ import { regenerateIfMissing } from "./workflow-projections.js";
 import { WorktreeStateProjection } from "./worktree-state-projection.js";
 import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
-import { isDbAvailable, getDbPath, refreshOpenDatabaseFromDisk, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
-import { renderPlanCheckboxes, renderRoadmapFromDb } from "./markdown-renderer.js";
-import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
+import { isDbAvailable, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
+import { getWorkflowDatabasePath, refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
+import { renderPlanCheckboxes, renderRoadmapFromDb, roadmapRenderMarksSliceDone } from "./markdown-renderer.js";
 import { consumeSignal } from "./session-status-io.js";
 import { checkPostUnitHooks, consumeHookFailure, isRetryPending, consumeRetryTrigger, consumeGateBlock, persistHookState, resolveHookArtifactPath, } from "./post-unit-hooks.js";
 import { hasPendingCaptures, loadPendingCaptures, revertExecutorResolvedCaptures } from "./captures.js";
@@ -38,7 +38,7 @@ import { debugLog } from "./debug-logger.js";
 import { runSafely } from "./auto-utils.js";
 import { isMilestoneCloseoutSettled, runMilestoneCloseoutGitHub, } from "./milestone-closeout.js";
 import { getEvidence, clearEvidenceFromDisk, isExecutionToolName } from "./safety/evidence-collector.js";
-import { validateFileChanges } from "./safety/file-change-validator.js";
+import { validateFileChanges, effectiveFileChangeAllowlist } from "./safety/file-change-validator.js";
 import { crossReferenceEvidence } from "./safety/evidence-cross-ref.js";
 import { validateContent } from "./safety/content-validator.js";
 import { resolveSafetyHarnessConfig } from "./safety/safety-harness.js";
@@ -54,11 +54,12 @@ import { writeTurnGitTransaction } from "./uok/gitops.js";
 import { isClosedStatus } from "./status-guards.js";
 import { detectAbandonMilestone } from "./abandon-detect.js";
 import { getPendingGate } from "./bootstrap/write-gate.js";
-import { isDeterministicPolicyError } from "./auto-tool-tracking.js";
+import { isDeterministicPolicyError, isToolUnavailableError } from "./auto-tool-tracking.js";
 import { formatConnectedStepStack, formatPostUnitStatusCard } from "./auto-status-message.js";
 import { clearProjectResearchInflightMarker, finalizeProjectResearchTimeout, } from "./project-research-policy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { verificationRetryKey } from "./auto/verification-retry-policy.js";
+import { saveCustomVerifyRetryCounts } from "./auto/custom-verify-retry-store.js";
 import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
@@ -506,9 +507,10 @@ export function _hasExecutionToolCallsInSessionForTest(entries) {
         if (e?.type === "toolCall" && isExecutionToolName(e?.name ?? e?.toolName)) {
             return true;
         }
-        if (e?.type !== "message")
-            continue;
-        const msg = e?.message;
+        // Accept both session-manager entries ({type: "message", message}) and
+        // bare agent-end messages ({role, content}) — the auto loop passes the
+        // latter via opts.agentEndMessages.
+        const msg = e?.type === "message" ? e?.message : e;
         if (!msg || msg.role !== "assistant" || !Array.isArray(msg.content))
             continue;
         for (const block of msg.content) {
@@ -720,7 +722,7 @@ export const USER_DRIVEN_DEEP_UNITS = new Set([
     "discuss-milestone",
     "research-decision",
 ]);
-export { isAwaitingUserInput } from "./user-input-boundary.js";
+export { isAwaitingUserInput } from "./consent-question.js";
 function artifactValidationKind(unitType) {
     if (unitType === "discuss-project")
         return "project";
@@ -798,11 +800,13 @@ async function repairCompleteSliceRoadmapProjection(unitType, unitId, basePath)
     if (!summaryPath || !existsSync(summaryPath) || !uatPath || !existsSync(uatPath)) {
         return false;
     }
+    // Stale-render detection (ADR-017): the DB already says the slice is closed;
+    // this only checks whether the rendered ROADMAP projection reflects it, to
+    // decide whether a repair re-render is needed.
     const roadmapPath = resolveMilestoneFile(artifactBase, mid, "ROADMAP");
     if (roadmapPath && existsSync(roadmapPath)) {
         try {
-            const roadmap = parseLegacyRoadmap(readFileSync(roadmapPath, "utf-8"));
-            if (roadmap.slices.find((roadmapSlice) => roadmapSlice.id === sid)?.done) {
+            if (roadmapRenderMarksSliceDone(readFileSync(roadmapPath, "utf-8"), sid)) {
                 return false;
             }
         }
@@ -1052,9 +1056,9 @@ export async function postUnitPreVerification(pctx, opts) {
     if (!opts?.skipSettleDelay) {
         await new Promise(r => setTimeout(r, 100));
     }
-    const dbPath = getDbPath();
+    const dbPath = getWorkflowDatabasePath();
     if (isDbAvailable() && dbPath && dbPath !== ":memory:") {
-        const refreshed = refreshOpenDatabaseFromDisk();
+        const refreshed = refreshWorkflowDatabaseFromDisk();
         if (!refreshed) {
             logWarning("db", "post-unit database refresh failed; derived state may be stale");
         }
@@ -1288,6 +1292,7 @@ export async function postUnitPreVerification(pctx, opts) {
             const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
             if (safetyConfig.enabled) {
                 const { milestone: sMid, slice: sSid, task: sTid } = parseUnitId(s.currentUnit.id);
+                const fileChangeAllowlist = effectiveFileChangeAllowlist(safetyConfig.file_change_allowlist, prefs?.git?.manage_gitignore);
                 // File change validation (execute-task only, after unit execution)
                 if (safetyConfig.file_change_validation && s.currentUnit.type === "execute-task" && sMid && sSid && sTid) {
                     try {
@@ -1302,7 +1307,7 @@ export async function postUnitPreVerification(pctx, opts) {
                             const plannedFiles = getPlannedKeyFiles(sliceTaskRows.map((taskRow) => ({
                                 files: taskRow.files,
                             })));
-                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
                             if (audit && audit.violations.length > 0) {
                                 const warnings = audit.violations.filter(v => v.severity === "warning");
                                 for (const v of warnings) {
@@ -1318,7 +1323,7 @@ export async function postUnitPreVerification(pctx, opts) {
                             if (taskRow) {
                                 const expectedOutput = taskRow.expected_output ?? [];
                                 const plannedFiles = taskRow.files ?? [];
-                                const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+                                const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
                                 if (audit && audit.violations.length > 0) {
                                     const warnings = audit.violations.filter(v => v.severity === "warning");
                                     for (const v of warnings) {
@@ -1698,7 +1703,27 @@ export async function postUnitPreVerification(pctx, opts) {
                 ctx.ui.notify(`Artifact missing for ${s.currentUnit.type} ${s.currentUnit.id} — DB unavailable, skipping retry.${dbSkipDiag ? ` Expected: ${dbSkipDiag}` : ""}`, "error");
             }
             else if (!triggerArtifactVerified) {
-                if (s.lastToolInvocationError) {
+                if (s.lastToolInvocationError && isToolUnavailableError(s.lastToolInvocationError)) {
+                    // Tool-unavailable is transient: the workflow MCP server registers
+                    // its surface asynchronously, so a Unit's first call can race the
+                    // registration. Retry with escalating delay, bounded at 3 attempts.
+                    // ponytail: MAX constant so the guard, log, and display all agree
+                    const MAX_TOOL_UNAVAIL_RETRIES = 3;
+                    if (s.toolUnavailableRetries >= MAX_TOOL_UNAVAIL_RETRIES) {
+                        debugLog("postUnit", { phase: "tool-unavailable-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, retries: s.toolUnavailableRetries });
+                        ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type} after ${MAX_TOOL_UNAVAIL_RETRIES} retries: ${s.lastToolInvocationError}. MCP server may not be starting — pausing auto-mode.`, "error");
+                        s.lastToolInvocationError = null;
+                        await pauseAuto(ctx, pi);
+                        return "dispatched";
+                    }
+                    s.toolUnavailableRetries++;
+                    const delayMs = s.toolUnavailableRetries * 1000;
+                    debugLog("postUnit", { phase: "tool-unavailable-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError, attempt: s.toolUnavailableRetries, delayMs });
+                    ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Waiting ${delayMs}ms for MCP server — retry ${s.toolUnavailableRetries}/${MAX_TOOL_UNAVAIL_RETRIES}.`, "warning");
+                    s.lastToolInvocationError = null;
+                    await new Promise(r => setTimeout(r, delayMs));
+                }
+                else if (s.lastToolInvocationError) {
                     const isUserSkip = /queued user message/i.test(s.lastToolInvocationError);
                     const errMsg = isUserSkip
                         ? `Tool skipped for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Queued user message interrupted the turn — pausing auto-mode.`
@@ -1786,12 +1811,14 @@ export async function postUnitPreVerification(pctx, opts) {
                             }
                         }
                         s.exhaustedVerificationUnits.add(retryKey);
+                        saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                         debugLog("postUnit", { phase: "artifact-verify-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
                         ctx.ui.notify(`${failureDetails} Pausing auto-mode after ${MAX_ARTIFACT_VERIFICATION_RETRIES} retries.`, "error");
                         await pauseAuto(ctx, pi);
                         return "dispatched";
                     }
                     s.verificationRetryCount.set(retryKey, attempt);
+                    saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                     s.pendingVerificationRetry = {
                         unitId: s.currentUnit.id,
                         failureContext: `${failureDetails} (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES}).`,
@@ -1809,8 +1836,11 @@ export async function postUnitPreVerification(pctx, opts) {
                 if (s.pendingVerificationRetry?.unitId === s.currentUnit.id) {
                     s.pendingVerificationRetry = null;
                 }
+                s.toolUnavailableRetries = 0;
                 s.verificationRetryCount.delete(retryKey);
                 s.verificationRetryFailureHashes.delete(retryKey);
+                s.exhaustedVerificationUnits.delete(retryKey);
+                saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                 if (s.currentUnit.type === "complete-milestone") {
                     const { milestone: mid } = parseUnitId(s.currentUnit.id);
                     if (mid) {