@opengsd/gsd-pi 1.2.0-dev.0b870afa → 1.2.0-dev.23d85b63

package/dist/resources/extensions/gsd/auto.js

@@ -25,7 +25,7 @@ import { clearActivityLogState } from "./activity-log.js";
 import { synthesizeCrashRecovery, getDeepDiagnostic, readActiveMilestoneId, } from "./session-forensics.js";
 import { writeLock, clearLock, clearStaleWorkerLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, emitOpenUnitEndForUnit, } from "./crash-recovery.js";
 import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
-import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, resolveEffectiveUnitIsolationMode, } from "./preferences.js";
+import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, loadEffectiveGSDPreferencesWithRegistry, resolveProfileAnchorProvider, getIsolationMode, resolveEffectiveUnitIsolationMode, } from "./preferences.js";
 import { playNotificationBell, sendDesktopNotification } from "./notifications.js";
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, resolveCompactionThresholdPercent, shouldRerootStepSessionForContext, } from "./auto-budget.js";
 import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, isDeterministicPolicyError, } from "./auto-tool-tracking.js";
@@ -507,11 +507,27 @@ export function _setAutoActiveForTest(active) {
  */
 export function _warnIfWorktreeMissingForTest(worktreePath, milestoneId) {
     if (worktreePath && !existsSync(worktreePath)) {
-        logWarning("session", `Worktree was expected at ${worktreePath} but is missing. Continuing in project-root mode. To restart with a fresh worktree, run /gsd-debug or recreate the milestone.`, { file: "auto.ts", milestoneId });
+        logWarning("session", `Worktree was expected at ${worktreePath} but is missing. Resuming from project root; /gsd next will recreate the worktree when isolation is enabled.`, { file: "auto.ts", milestoneId });
         return true;
     }
     return false;
 }
+export function anchorProcessCwdForAutoResume(basePath, fallbackPaths = []) {
+    const candidates = [basePath, ...fallbackPaths].filter((candidate, index, all) => Boolean(candidate) && all.indexOf(candidate) === index);
+    for (const candidate of candidates) {
+        if (!existsSync(candidate))
+            continue;
+        try {
+            process.chdir(candidate);
+            return true;
+        }
+        catch (err) {
+            logWarning("session", `resume cwd anchor failed for ${candidate}: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts", basePath: candidate });
+        }
+    }
+    logWarning("session", `resume cwd anchor failed: no usable directory among ${candidates.join(", ")}`, { file: "auto.ts" });
+    return false;
+}
 export function isAutoPaused() {
     return s.paused;
 }
@@ -751,6 +767,42 @@ function pauseAutoUnitIdentityMatches(expected) {
         s.currentUnit.id === expected.id &&
         s.currentUnit.startedAt === expected.startedAt;
 }
+function shouldPreserveCoordinationForPause(errorContext) {
+    return errorContext?.category === "provider" && errorContext.isTransient === true;
+}
+function resolvePauseLifecyclePresentation(errorContext) {
+    const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
+    const modeLabel = s.stepMode ? "Step" : "Auto";
+    const defaultPresentation = {
+        status: "paused",
+        title: `${modeLabel}-mode paused`,
+        detail: errorContext?.message ?? "Paused by user request.",
+        nextAction: `Type to steer, or run ${resumeCmd} to resume.`,
+        commands: [resumeCmd, "/gsd status for overview", "/gsd notifications for history"],
+        notifyLevel: "info",
+        notifyPrefix: `${modeLabel}-mode paused`,
+    };
+    const message = errorContext?.message ?? "";
+    if (message.includes("completed closeout dispatch history") ||
+        message.includes("completed complete-milestone dispatch history")) {
+        const milestoneMatch = message.match(/Milestone (M\d+[A-Z0-9-]*)/);
+        const milestoneId = milestoneMatch?.[1] ?? "this milestone";
+        return {
+            status: "blocked",
+            title: `${modeLabel}-mode blocked`,
+            detail: message,
+            nextAction: `Run \`/gsd dispatch complete-milestone ${milestoneId}\` to finish closeout, then ${resumeCmd}.`,
+            commands: [
+                `/gsd dispatch complete-milestone ${milestoneId}`,
+                `/gsd status ${milestoneId}`,
+                resumeCmd,
+            ],
+            notifyLevel: "warning",
+            notifyPrefix: `${modeLabel}-mode blocked`,
+        };
+    }
+    return defaultPresentation;
+}
 function setLifecycleOutcome(ctx, input) {
     if (!ctx?.hasUI)
         return;
@@ -783,11 +835,15 @@ function setTerminalCloseoutOutcome(ctx, input) {
         invalidate() { },
     }));
     ctx.ui.setStatus?.("gsd-step", undefined);
+    ctx.ui?.setGsdProgress?.(undefined);
     ctx.ui.setWidget?.("gsd-progress", undefined);
+    const detail = input.allMilestonesComplete && input.milestoneTitle
+        ? `${input.milestoneTitle}. All milestones complete`
+        : `${titleLine}${input.reason ?? "Milestone closeout finished."}`;
     setLifecycleOutcome(ctx, {
         status: "complete",
         title,
-        detail: `${titleLine}${input.reason ?? "Milestone closeout finished."}`,
+        detail,
         nextAction,
         commands: TERMINAL_CLOSEOUT_COMMANDS,
         unitLabel: input.milestoneId ? `complete-milestone ${input.milestoneId}` : null,
@@ -1502,6 +1558,10 @@ export async function pauseAuto(ctx, _pi, _errorContext, options = {}) {
         });
         return;
     }
+    anchorProcessCwdForAutoResume(s.basePath || s.originalBasePath || "", [
+        s.originalBasePath,
+        lockBase(),
+    ].filter((path) => Boolean(path)));
     s.active = false;
     s.paused = true;
     clearUnitTimeout();
@@ -1585,7 +1645,7 @@ export async function pauseAuto(ctx, _pi, _errorContext, options = {}) {
         releaseSessionLock(lockBase());
         clearLock(lockBase());
     }
-    if (s.workerId) {
+    if (s.workerId && !shouldPreserveCoordinationForPause(_errorContext)) {
         try {
             if (s.currentMilestoneId && s.milestoneLeaseToken) {
                 releaseMilestoneLease(s.workerId, s.currentMilestoneId, s.milestoneLeaseToken);
@@ -1611,21 +1671,21 @@ export async function pauseAuto(ctx, _pi, _errorContext, options = {}) {
     s.pendingVerificationRetry = null;
     ctx?.ui.setStatus("gsd-auto", "paused");
     ctx?.ui.setWidget("gsd-progress", undefined);
-    const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
+    const lifecycle = resolvePauseLifecyclePresentation(_errorContext);
     setLifecycleOutcome(ctx, {
-        status: "paused",
-        title: `${s.stepMode ? "Step" : "Auto"}-mode paused`,
-        detail: _errorContext?.message ?? "Paused by user request.",
-        nextAction: `Type to steer, or run ${resumeCmd} to resume.`,
-        commands: [resumeCmd, "/gsd status for overview", "/gsd notifications for history"],
+        status: lifecycle.status,
+        title: lifecycle.title,
+        detail: lifecycle.detail,
+        nextAction: lifecycle.nextAction,
+        commands: lifecycle.commands,
         unitLabel: pausedUnitLabel,
     });
     if (ctx)
         initHealthWidget(ctx);
     const pauseMessage = _errorContext?.message
-        ? `${s.stepMode ? "Step" : "Auto"}-mode paused: ${_errorContext.message}`
-        : `${s.stepMode ? "Step" : "Auto"}-mode paused (Escape). Type to interact, or ${resumeCmd} to resume.`;
-    ctx?.ui.notify(pauseMessage, "info");
+        ? `${lifecycle.notifyPrefix}: ${_errorContext.message}`
+        : `${lifecycle.notifyPrefix} (Escape). Type to interact, or ${lifecycle.commands[0] ?? (s.stepMode ? "/gsd next" : "/gsd auto")} to resume.`;
+    ctx?.ui.notify(pauseMessage, lifecycle.notifyLevel);
 }
 /**
  * Build a WorktreeLifecycle Module wrapping the current session.
@@ -1688,7 +1748,7 @@ function ensureOrchestrationModule(ctx, pi, basePath) {
  * Build the LoopDeps object from auto.ts private scope.
  * This bundles all private functions that autoLoop needs without exporting them.
  */
-function buildLoopDeps(pi) {
+function buildLoopDeps(pi, ctx) {
     // Initialize the unified rule registry with converted dispatch rules.
     // Must happen before LoopDeps is assembled so facade functions
     // (resolveDispatch, runPreDispatchHooks, etc.) delegate to the registry.
@@ -1711,7 +1771,7 @@ function buildLoopDeps(pi) {
         invalidateAllCaches,
         deriveState,
         rebuildState,
-        loadEffectiveGSDPreferences,
+        loadEffectiveGSDPreferences: () => loadEffectiveGSDPreferencesWithRegistry(ctx.modelRegistry, s.basePath || undefined, resolveProfileAnchorProvider(ctx.model?.provider, s.autoModeStartModel?.provider)),
         // Pre-dispatch health gate
         preDispatchHealthGate,
         // Worktree state projection (ADR-016 — single Module Interface)
@@ -1944,7 +2004,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                         {
                             const persistedWorktreePath = meta.worktreePath ?? null;
                             if (persistedWorktreePath && !existsSync(persistedWorktreePath)) {
-                                logWarning("session", `Worktree was expected at ${persistedWorktreePath} but is missing. Continuing in project-root mode. To restart with a fresh worktree, run /gsd-debug or recreate the milestone.`, { file: "auto.ts", milestoneId: meta.milestoneId ?? "" });
+                                logWarning("session", `Worktree was expected at ${persistedWorktreePath} but is missing. Resuming from project root; /gsd next will recreate the worktree when isolation is enabled.`, { file: "auto.ts", milestoneId: meta.milestoneId ?? "" });
                             }
                             const rawForScope = (persistedWorktreePath && existsSync(persistedWorktreePath))
                                 ? persistedWorktreePath
@@ -2026,10 +2086,14 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         // worktree directory safely falls back to the project root.
         const resumeWorktreePath = freshStartAssessment.pausedSession?.worktreePath ?? null;
         if (resumeWorktreePath && !existsSync(resumeWorktreePath)) {
-            logWarning("session", `Worktree was expected at ${resumeWorktreePath} but is missing. Continuing in project-root mode. To restart with a fresh worktree, run /gsd-debug or recreate the milestone.`, { file: "auto.ts", milestoneId: s.currentMilestoneId ?? "" });
+            logWarning("session", `Worktree was expected at ${resumeWorktreePath} but is missing. Resuming from project root; /gsd next will recreate the worktree when isolation is enabled.`, { file: "auto.ts", milestoneId: s.currentMilestoneId ?? "" });
         }
         // ADR-016 phase 2 / B3 (#5621): paused-resume worktree-path adoption.
         buildLifecycle().resumeFromPausedSession(base, resumeWorktreePath);
+        anchorProcessCwdForAutoResume(s.basePath || base, [
+            base,
+            s.originalBasePath || base,
+        ]);
         // Rebuild scope now that s.basePath reflects the actual worktree (or project root).
         rebuildScope(s.basePath, s.currentMilestoneId);
         // Ensure the workflow-logger audit log is pinned to the project root
@@ -2069,7 +2133,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             // s.basePath may have been updated to a worktree path by enterMilestone.
             rebuildScope(s.basePath, s.currentMilestoneId);
         }
-        const loopDeps = buildLoopDeps(pi);
+        const loopDeps = buildLoopDeps(pi, ctx);
         ensureOrchestrationModule(ctx, pi, s.basePath || base);
         registerSigtermHandler(lockBase());
         setAutoActiveStatus(ctx, s.stepMode ? "next" : "auto");
@@ -2158,7 +2222,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     // Build scope after bootstrap has populated s.basePath / s.originalBasePath /
     // s.currentMilestoneId (including worktree setup inside bootstrapAutoSession).
     rebuildScope(s.basePath, s.currentMilestoneId);
-    const loopDeps = buildLoopDeps(pi);
+    const loopDeps = buildLoopDeps(pi, ctx);
     ensureOrchestrationModule(ctx, pi, s.basePath || base);
     captureProjectRootEnv(s.originalBasePath || s.basePath);
     registerAutoWorkerForSession(s);

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -531,11 +531,13 @@ export async function handleAgentEnd(pi, event, ctx) {
             });
             return;
         }
-        // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli)
+        // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli, google-antigravity)
         // which use per-user quotas with shorter windows (#2922).
         if (cls.kind === "rate-limit") {
             const currentProvider = ctx.model?.provider;
-            if (currentProvider === "openai-codex" || currentProvider === "google-gemini-cli") {
+            if (currentProvider === "openai-codex"
+                || currentProvider === "google-gemini-cli"
+                || currentProvider === "google-antigravity") {
                 cls.retryAfterMs = Math.min(cls.retryAfterMs, 30_000);
             }
             const dash = getAutoDashboardData();

package/dist/resources/extensions/gsd/bootstrap/dynamic-tools.js

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { createBashTool, createEditTool, createReadTool, createWriteTool } from "@gsd/pi-coding-agent";
 import { logWarning } from "../workflow-logger.js";
-import { openWorkflowDatabase } from "../db-workspace.js";
+import { getWorkflowDatabaseStatus, openWorkflowDatabase, } from "../db-workspace.js";
 import { getAutoWorktreePath } from "../auto-worktree.js";
 import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { worktreesDirs } from "../worktree-placement.js";
@@ -61,16 +61,46 @@ export function resolveWorkflowToolBasePath(ctx, scope) {
     return cwd;
 }
 export { resolveProjectRootDbPath } from "../db-workspace.js";
+function sqliteProviderHint(status, nodeVersion) {
+    if (status.provider)
+        return `Provider: ${status.provider}.`;
+    const major = Number.parseInt(nodeVersion.split(".")[0] ?? "", 10);
+    if (Number.isFinite(major) && major < 22) {
+        return (`No SQLite provider available. Upgrade Node to >= 22.0.0 (current: v${nodeVersion}), ` +
+            "use the packaged GSD runtime, or install/restore better-sqlite3 in this runtime.");
+    }
+    return ("No SQLite provider available. Use a Node build with node:sqlite enabled, " +
+        "run the packaged GSD runtime, or install/restore better-sqlite3 in this runtime.");
+}
+function dbOpenPhaseHint(status) {
+    if (status.lastPhase === "open")
+        return "The database file could not be opened";
+    if (status.lastPhase === "initSchema")
+        return "The database schema could not be initialized";
+    if (status.lastPhase === "vacuum-recovery")
+        return "Corruption recovery (VACUUM) failed";
+    if (status.attempted)
+        return "The database could not be opened";
+    return "The database provider could not be loaded";
+}
+export function formatWorkflowDatabaseOpenFailure(result, status, nodeVersion = process.versions.node) {
+    if (result.reason === "missing-gsd-dir") {
+        return `ensureDbOpen failed — no .gsd directory found at ${result.location.projectGsd}`;
+    }
+    if (result.reason === "missing-database") {
+        return `ensureDbOpen failed — no GSD database found at ${result.location.projectDb}`;
+    }
+    const resolvedStatus = status ?? getWorkflowDatabaseStatus();
+    const detail = result.error?.message ?? resolvedStatus.lastError?.message ?? "";
+    const detailSuffix = detail ? ` (${detail})` : "";
+    return (`ensureDbOpen failed for ${result.location.projectDb}: ` +
+        `${dbOpenPhaseHint(resolvedStatus)}${detailSuffix}. ${sqliteProviderHint(resolvedStatus, nodeVersion)}`);
+}
 export async function ensureDbOpen(basePath = safeWorkspaceCwd()) {
     const result = openWorkflowDatabase(basePath);
     if (result.ok)
         return true;
-    if (result.reason === "missing-gsd-dir") {
-        logWarning("bootstrap", "ensureDbOpen failed — no .gsd directory found");
-    }
-    else {
-        logWarning("bootstrap", `ensureDbOpen failed: ${result.error?.message ?? "open failed"}`);
-    }
+    logWarning("bootstrap", formatWorkflowDatabaseOpenFailure(result));
     return false;
 }
 export function registerDynamicTools(pi) {

package/dist/resources/extensions/gsd/bootstrap/register-extension.js

@@ -12,7 +12,7 @@ import { registerScheduleWakeupTool } from "./schedule-wakeup-tool.js";
 import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
 import { writeCrashLog } from "./crash-log.js";
-import { logWarning } from "../workflow-logger.js";
+import { logWarning, isGsdExtensionStderrEnabled } from "../workflow-logger.js";
 import { UNIT_TOOL_CONTRACTS } from "../unit-tool-contracts.js";
 // Static import so cmux event listeners are registered synchronously during
 // extension bootstrap. Prior implementation used `void import().then()` which
@@ -37,6 +37,8 @@ export const CRITICAL_GSD_WORKFLOW_TOOL_NAMES = [...new Set(Object.values(UNIT_T
 /** Write to stderr without ever re-throwing — stderr can EPIPE too, which would
  *  re-enter this handler and re-loop. */
 function safeStderr(msg) {
+    if (!isGsdExtensionStderrEnabled())
+        return;
     try {
         process.stderr.write(msg);
     }

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -7,7 +7,7 @@ import { isToolCallEventType } from "@gsd/pi-coding-agent";
 import { ALWAYS_PRESERVED_SHIM_TOOL_NAMES } from "@gsd/pi-ai";
 import { updateSnapshot } from "../ecosystem/gsd-extension-api.js";
 import { buildMilestoneFileName, clearPathCache, milestonesDir, resolveMilestonePath, resolveSliceFile, resolveSlicePath } from "../paths.js";
-import { applyAskUserQuestionsGateResult, clearDiscussionFlowState, formatPendingAskUserQuestionsGateMessage, hostWriteGateAdapter, isApprovalGateVerifiedInSnapshot, isDepthConfirmationAnswer, isMilestoneDepthVerified, isMilestoneDepthVerifiedInSnapshot, isQueuePhaseActive, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeWrite, isGateQuestionId, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
+import { applyAskUserQuestionsGateResult, clearDiscussionFlowState, formatPendingAskUserQuestionsGateMessage, hostWriteGateAdapter, isApprovalGateVerifiedInSnapshot, isDepthConfirmationAnswer, isMilestoneDepthVerified, isMilestoneDepthVerifiedInSnapshot, isQueuePhaseActive, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeBash, shouldBlockWorktreeWrite, isGateQuestionId, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
 import { canonicalToolName } from "../engine-hook-contract.js";
 import { resolveManifest } from "../unit-context-manifest.js";
 import { isBlockedStateFile, isBashWriteToStateFile, BLOCKED_WRITE_ERROR } from "../write-intercept.js";
@@ -21,7 +21,7 @@ import { recordToolCall as safetyRecordToolCall, recordToolResult as safetyRecor
 import { parseUnitId } from "../unit-id.js";
 import { classifyCommand } from "../safety/destructive-guard.js";
 import { confirmDestructiveCommand, consumeDestructiveConfirmation, isDestructiveConfirmGateId, requestDestructiveConfirmation, } from "../safety/destructive-confirmation.js";
-import { logWarning as safetyLogWarning } from "../workflow-logger.js";
+import { logWarning as safetyLogWarning, setStderrLoggingEnabled } from "../workflow-logger.js";
 import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
 import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
@@ -110,6 +110,15 @@ async function installWelcomeHeader(ctx) {
         /* non-fatal */
     }
 }
+/** Suppress the startup welcome banner without restoring the built-in pi header. */
+function suppressWelcomeHeader(ctx) {
+    if (!ctx.hasUI || typeof ctx.ui?.setHeader !== "function")
+        return;
+    ctx.ui.setHeader(() => ({
+        render() { return []; },
+        invalidate() { },
+    }));
+}
 /**
  * Approval gates whose durable arming is deferred until tool execution /
  * agent end, keyed by basePath. A Map (not a single slot) so concurrent
@@ -629,6 +638,9 @@ function initSessionNotifications(ctx) {
     installNotifyInterceptor(ctx);
     initNotificationWidget(ctx);
     notifyPreferenceDiagnostics(ctx, contextBasePath(ctx), { surface: "session-start" });
+    if (ctx.hasUI) {
+        setStderrLoggingEnabled(false);
+    }
 }
 async function prepareWorkflowMcpForHookContext(ctx, basePath) {
     // Skip MCP auto-prep when running inside an auto-worktree. The worktree
@@ -671,7 +683,15 @@ export function registerHooks(pi, ecosystemHandlers) {
         }
         catch { /* non-fatal */ }
         if (!preserveCloseoutSurface) {
-            await installWelcomeHeader(ctx);
+            // Per-unit newSession() during auto/step runs fires session_start again.
+            // Keep the welcome banner startup-only — do not overwrite the empty header
+            // that updateProgressWidget installs once work begins.
+            if (isAutoActive() || isAutoPaused()) {
+                suppressWelcomeHeader(ctx);
+            }
+            else {
+                await installWelcomeHeader(ctx);
+            }
         }
         await loadToolApiKeysForSession();
         if (isAutoActive() || preserveCloseoutSurface) {
@@ -818,6 +838,10 @@ export function registerHooks(pi, ecosystemHandlers) {
     pi.on("message_end", async (event) => {
         const { suppressTerminalDeletedWorktreeMessageEnd } = await import("./agent-end-recovery.js");
         suppressTerminalDeletedWorktreeMessageEnd(event);
+        if (isAutoActive()) {
+            const { sanitizePrematureCloseoutMessageEnd } = await import("../auto-closeout-messaging.js");
+            sanitizePrematureCloseoutMessageEnd(event);
+        }
     });
     // Squash-merge quick-task branch back to the original branch after the
     // agent turn completes (#2668). cleanupQuickBranch is a no-op when no
@@ -1094,6 +1118,11 @@ export function registerHooks(pi, ecosystemHandlers) {
             if (wtGuard.block)
                 return wtGuard;
         }
+        if (isToolCallEventType("bash", event)) {
+            const wtBashGuard = shouldBlockWorktreeBash(event.input.command, dash.basePath ?? discussionBasePath, isAutoActive(), dash.currentUnit?.type);
+            if (wtBashGuard.block)
+                return wtBashGuard;
+        }
         // ── Single-writer engine: block direct writes to STATE.md ──────────
         // Covers write, edit, and bash tools to prevent bypass vectors.
         if (isToolCallEventType("write", event)) {

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -10,6 +10,7 @@ import { compileSubagentPermissionContract } from "../unit-context-manifest.js";
 import { logWarning } from "../workflow-logger.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { worktreesDirs } from "../worktree-placement.js";
+import { bashReferencesProjectRootOutsideWorktree } from "../worktree-shell-guard.js";
 import { evaluateGateAnswer } from "../consent-verdict.js";
 /**
  * Regex matching milestone CONTEXT.md file names in both legacy M001
@@ -1116,6 +1117,30 @@ function isPathContained(target, container) {
         return true;
     return target.startsWith(container.endsWith(sep) ? container : container + sep);
 }
+function formatWorktreeIsolationBlockReason(tool, displayTarget, isAutoLive, effectiveBasePath) {
+    if (isGsdWorktreePath(effectiveBasePath)) {
+        return [
+            `HARD BLOCK: ${tool} target "${displayTarget}" is outside the active milestone worktree`,
+            `while \`git.isolation: worktree\` is configured. Source edits must stay inside`,
+            `\`.gsd-worktrees/<MID>/\` (or \`.gsd/\` planning artifacts) so the auto-mode commit`,
+            `pipeline captures them. Writing to the project root leaks changes that block milestone merge.`,
+            `Use a relative path under the worktree cwd or an absolute path inside the worktree directory.`,
+            ...(isAutoLive ? [] : [
+                "This guard also applies to subagent children spawned from the worktree — do not",
+                "`cd` to the project root or reference its paths in shell commands.",
+            ]),
+        ].join(" ");
+    }
+    return [
+        `HARD BLOCK: Worktree isolation is configured (\`git.isolation: worktree\`) but auto-mode is`,
+        `not running and the target "${displayTarget}" is not inside \`.gsd/worktrees/<MID>/\`.`,
+        `Code edits at the project root would be lost — only the auto-mode commit pipeline`,
+        `(auto-post-unit) commits work, and it never runs outside the loop.`,
+        `Required action: start auto-mode with \`/gsd\` so the milestone worktree is created,`,
+        `then write inside it. To disable this guard for self-hosting development, set`,
+        `GSD_DISABLE_WORKTREE_WRITE_GUARD=1.`,
+    ].join(" ");
+}
 /**
  * Block planning-write tool calls that would land code at the project root
  * while `git.isolation: worktree` is in effect and auto-mode hasn't created
@@ -1133,10 +1158,9 @@ function isPathContained(target, container) {
  *   5. Target is inside `<projectRoot>/.gsd/worktrees/` (a real worktree).
  *   6. Target is inside `<projectRoot>/.gsd/` and isn't masquerading as a
  *      worktrees sibling (rejects the `.gsd/worktrees-extra/…` prefix trick).
- *   7. Auto is live AND `effectiveBasePath` is itself a `.gsd/worktrees/…` path.
  *
- * Otherwise: block with a message that points the agent at `/gsd` to start
- * auto-mode.
+ * Otherwise: block with a message that points the agent at the active worktree
+ * or `/gsd` to start auto-mode.
  */
 export function shouldBlockWorktreeWrite(toolName, targetPath, effectiveBasePath, isAutoLive, currentUnitType) {
     const tool = canonicalToolName(toolName);
@@ -1180,24 +1204,40 @@ export function shouldBlockWorktreeWrite(toolName, targetPath, effectiveBasePath
             return { block: false };
         // fall through: looks like worktrees<something> sibling — block
     }
-    // Auto is live and the caller is operating inside a worktree path —
-    // host tool's write happens in worktree context; let it through.
-    if (isAutoLive && isGsdWorktreePath(effectiveBasePath))
-        return { block: false };
     // Block. Provide enough context that the agent can self-correct.
     const displayTarget = isPathContained(realTarget, realRoot)
         ? relative(realRoot, realTarget) || "."
         : realTarget;
     return {
         block: true,
-        reason: [
-            `HARD BLOCK: Worktree isolation is configured (\`git.isolation: worktree\`) but auto-mode is`,
-            `not running and the target "${displayTarget}" is not inside \`.gsd/worktrees/<MID>/\`.`,
-            `Code edits at the project root would be lost — only the auto-mode commit pipeline`,
-            `(auto-post-unit) commits work, and it never runs outside the loop.`,
-            `Required action: start auto-mode with \`/gsd\` so the milestone worktree is created,`,
-            `then write inside it. To disable this guard for self-hosting development, set`,
-            `GSD_DISABLE_WORKTREE_WRITE_GUARD=1.`,
-        ].join(" "),
+        reason: formatWorktreeIsolationBlockReason(tool, displayTarget, isAutoLive, effectiveBasePath),
+    };
+}
+/**
+ * Block bash commands that reference the project root while executing inside an
+ * active milestone worktree under `git.isolation: worktree`.
+ *
+ * Mirrors the gsd_exec sandbox rule so native bash cannot bypass write/edit gates.
+ */
+export function shouldBlockWorktreeBash(command, effectiveBasePath, isAutoLive, currentUnitType) {
+    if (process.env.GSD_DISABLE_WORKTREE_WRITE_GUARD === "1")
+        return { block: false };
+    if (getIsolationMode(effectiveBasePath) !== "worktree")
+        return { block: false };
+    if (currentUnitType && WORKTREE_GATE_BOOTSTRAP_UNITS.has(currentUnitType))
+        return { block: false };
+    // Block whenever the effective cwd is inside a milestone worktree — not only
+    // during live auto-mode. Reactive-execute subagents run as fresh pi children
+    // without an auto session, but still inherit the worktree cwd and must not
+    // shell out to the project root (the native bash bypass that caused root-write leaks).
+    if (!isGsdWorktreePath(effectiveBasePath))
+        return { block: false };
+    if (!command.trim())
+        return { block: false };
+    if (!bashReferencesProjectRootOutsideWorktree(command, effectiveBasePath))
+        return { block: false };
+    return {
+        block: true,
+        reason: formatWorktreeIsolationBlockReason("bash", "project root path reference in shell command", isAutoLive, effectiveBasePath),
     };
 }

package/dist/resources/extensions/gsd/closeout-wizard.js

@@ -13,7 +13,7 @@ import { isClosedStatus } from "./status-guards.js";
 import { findUnmergedCompletedMilestones, } from "./unmerged-milestone-guard.js";
 import { appendRequirementsBacklogToSummary } from "./requirements-backlog.js";
 import { nativeBranchList, nativeIsRepo } from "./native-git-bridge.js";
-import { allWorktreesDirs } from "./worktree-manager.js";
+import { allWorktreesDirs, isMilestoneWorktreeResidueCandidate, pruneEphemeralGhostWorktreeDirectories, } from "./worktree-manager.js";
 const MILESTONE_MERGE_CLOSEOUT_COMMANDS = [
     "/gsd status for overview",
     "/gsd visualize to inspect",
@@ -28,9 +28,13 @@ function listMilestoneWorktreeIds(basePath) {
         for (const entry of readdirSync(wtDir)) {
             if (!MILESTONE_ID_RE.test(entry))
                 continue;
+            const fullPath = join(wtDir, entry);
             try {
-                if (statSync(join(wtDir, entry)).isDirectory())
-                    ids.add(entry);
+                if (!statSync(fullPath).isDirectory())
+                    continue;
+                if (!isMilestoneWorktreeResidueCandidate(basePath, fullPath))
+                    continue;
+                ids.add(entry);
             }
             catch {
                 // skip unreadable entries
@@ -70,6 +74,7 @@ function isStrandedMilestoneId(milestoneId) {
 export function detectIdleMilestoneResidueHint(basePath) {
     if (!nativeIsRepo(basePath))
         return null;
+    pruneEphemeralGhostWorktreeDirectories(basePath);
     const gsdDir = join(basePath, ".gsd");
     const dbPath = join(gsdDir, "gsd.db");
     if (!existsSync(gsdDir) || !existsSync(dbPath)) {

package/dist/resources/extensions/gsd/commands/handlers/core.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { computeProgressScore, formatProgressLine } from "../../progress-score.js";
-import { getGlobalGSDPreferencesPath, getProjectGSDPreferencesPath } from "../../preferences.js";
+import { getGlobalGSDPreferencesPath, getProjectGSDPreferencesPath, modelIdsForProfileResolution, resolveProfileAnchorProvider, resolveDisabledModelProvidersFromPreferences } from "../../preferences.js";
 import { ensurePreferencesFile, handlePrefs, handlePrefsMode, handlePrefsWizard, handleLanguage } from "../../commands-prefs-wizard.js";
 import { runEnvironmentChecks } from "../../doctor-environment.js";
 import { deriveState } from "../../state.js";
@@ -257,7 +257,10 @@ export async function handleSetup(args, ctx, pi) {
         return;
     }
     if (args === "model") {
-        await handleModel("", ctx, pi);
+        // Default model picker: persist settings.json default only — do not pin the
+        // session override that /gsd model uses, or PREFERENCES.md per-phase models
+        // are ignored for the rest of this session (#model-prefs-precedence).
+        await handleModel("", ctx, pi, { pinSession: false });
         return;
     }
     if (args === "keys") {
@@ -361,7 +364,7 @@ async function resolveRequestedModel(query, ctx) {
         return undefined;
     return selectModelByProvider(`Multiple models match "${query}"`, partialMatches, ctx, ctx.model);
 }
-async function handleModel(trimmedArgs, ctx, pi) {
+async function handleModel(trimmedArgs, ctx, pi, options) {
     const availableModels = ctx.modelRegistry.getAvailable();
     if (availableModels.length === 0) {
         ctx.ui.notify("No available models found. Check provider auth and model discovery.", "warning");
@@ -395,15 +398,18 @@ async function handleModel(trimmedArgs, ctx, pi) {
     }
     // /gsd model is an explicit per-session pin for GSD dispatches.
     // This is captured at auto bootstrap so it survives internal session
-    // switches during /gsd auto and /gsd next runs.
+    // switches during /gsd auto and /gsd next runs. /gsd setup model skips
+    // this pin so PREFERENCES.md per-phase models keep precedence.
+    const pinSession = options?.pinSession !== false;
     const sessionId = ctx.sessionManager?.getSessionId?.();
-    if (sessionId) {
+    if (pinSession && sessionId) {
         setSessionModelOverride(sessionId, {
             provider: targetModel.provider,
             id: targetModel.id,
         });
     }
-    ctx.ui.notify(`Model: ${targetModel.provider}/${targetModel.id}`, "info");
+    const pinNote = pinSession ? "" : " (default updated; per-phase prefs still apply in auto)";
+    ctx.ui.notify(`Model: ${targetModel.provider}/${targetModel.id}${pinNote}`, "info");
 }
 export async function handleCoreCommand(trimmed, ctx, pi) {
     if (trimmed === "help" || trimmed === "h" || trimmed === "?" || trimmed.startsWith("help ")) {
@@ -470,7 +476,15 @@ export async function handleCoreCommand(trimmed, ctx, pi) {
     }
     if (trimmed === "show-config") {
         const { GSDConfigOverlay, formatConfigText } = await import("../../config-overlay.js");
-        const result = await ctx.ui.custom((tui, theme, _kb, done) => new GSDConfigOverlay(tui, theme, () => done(true)), {
+        const basePath = projectRoot();
+        const anchorProvider = resolveProfileAnchorProvider(ctx.model?.provider);
+        const disabledProviders = resolveDisabledModelProvidersFromPreferences();
+        const availableModelIds = modelIdsForProfileResolution(ctx.modelRegistry, anchorProvider, disabledProviders);
+        const configOptions = {
+            basePath,
+            ...(availableModelIds && availableModelIds.length > 0 ? { availableModelIds } : {}),
+        };
+        const result = await ctx.ui.custom((tui, theme, _kb, done) => new GSDConfigOverlay(tui, theme, () => done(true), configOptions), {
             overlay: true,
             overlayOptions: {
                 width: "65%",
@@ -480,7 +494,7 @@ export async function handleCoreCommand(trimmed, ctx, pi) {
             },
         });
         if (result === undefined) {
-            ctx.ui.notify(formatConfigText(), "info");
+            ctx.ui.notify(formatConfigText(configOptions), "info");
         }
         return true;
     }

package/dist/resources/extensions/gsd/commands/handlers/ops.js

@@ -50,7 +50,7 @@ export async function handleOpsCommand(trimmed, ctx, pi) {
         ["execute-task", "execute"],
         ["complete-slice", "complete"],
         ["validate-milestone", "validate-milestone"],
-        ["complete-milestone", "complete"],
+        ["complete-milestone", "complete-milestone"],
     ]);
     const aliasPhase = directDispatchAlias.get(trimmed);
     if (aliasPhase) {
@@ -230,7 +230,7 @@ Examples:
     if (trimmed === "dispatch" || trimmed.startsWith("dispatch ")) {
         const phase = trimmed.replace(/^dispatch\s*/, "").trim();
         if (!phase) {
-            ctx.ui.notify("Usage: /gsd dispatch <phase>  (research|plan|execute|complete|validate|reassess|uat|replan)", "warning");
+            ctx.ui.notify("Usage: /gsd dispatch <phase>  (research|plan|execute|complete|complete-milestone|validate|reassess|uat|replan)", "warning");
             return true;
         }
         const basePath = projectRoot();

package/dist/resources/extensions/gsd/commands-mcp-status.js

@@ -59,7 +59,7 @@ export function formatMcpStatusReport(servers) {
                 : s.connected
                     ? `connected — ${s.toolCount} tools`
                     : s.available
-                        ? `available — ${s.toolCount} tools`
+                        ? `probe available — ${s.toolCount} tools`
                         : "disconnected";
         const warningText = s.envWarnings?.length ? ` — ${s.envWarnings.length} warning(s)` : "";
         lines.push(`  ${icon} ${s.name} (${s.transport}) — ${status}${warningText}`);
@@ -83,7 +83,7 @@ export function formatMcpServerDetail(server) {
         lines.push(`  Error:     ${server.error}`);
     }
     else if (server.connected || server.available) {
-        lines.push(`  Status:    ${server.connected ? "connected" : "available"}`);
+        lines.push(`  Status:    ${server.connected ? "connected" : "probe available"}`);
         lines.push(`  Tools:     ${server.toolCount}`);
         if (server.tools.length > 0) {
             lines.push("");