@opengsd/gsd-pi 1.2.0-dev.0b870afa → 1.2.0-dev.23d85b63

package/dist/resources/extensions/gsd/guided-flow.js

@@ -42,9 +42,14 @@ export { nextMilestoneIdReserved } from "./milestone-id-reservation.js";
 import { parkMilestone, discardMilestone } from "./milestone-actions.js";
 import { buildCloseoutMenuActions, buildIdleMenuSummary, getPrimaryCloseoutRecommendation, handleCloseoutChoice, loadCloseoutContext, } from "./closeout-wizard.js";
 import { buildRequirementsBacklogDiscussContext, countUnmappedActiveRequirements, showRequirementsBacklogReview, } from "./requirements-backlog.js";
-import { selectAndApplyModel } from "./auto-model-selection.js";
+import { selectAndApplyModel, getRegisteredToolSnapshot } from "./auto-model-selection.js";
 import { DISCUSS_TOOLS_ALLOWLIST } from "./constants.js";
-import { supportsStructuredQuestions } from "./workflow-mcp.js";
+import { detectWorkflowMcpLaunchConfig, resolveWorkflowMcpProjectRoot, supportsStructuredQuestions, } from "./workflow-mcp.js";
+import { usesWorkflowMcpTransport } from "./question-transport.js";
+import { getCachedWorkflowMcpProbe, probeAndCacheWorkflowMcp, warmWorkflowMcpProbeInBackground, workflowMcpProbeAdvertisesSurface, WORKFLOW_MCP_PROBE_TIMEOUT_MS, } from "./workflow-mcp-readiness-cache.js";
+import { probeCoversRequiredWorkflowTools } from "./tool-surface-readiness.js";
+import { getRequiredWorkflowToolsForUnit } from "./unit-tool-contracts.js";
+import { isWorkflowToolSurfaceName } from "./workflow-tool-surface.js";
 import { getUnitWorkflowDispatchReadinessError } from "./tool-contract.js";
 import { runPreparation, formatCodebaseBrief, formatPriorContextBrief, } from "./preparation.js";
 import { verifyExpectedArtifact } from "./auto-recovery.js";
@@ -369,6 +374,67 @@ async function dispatchNextDeepProjectSetupStage(entry) {
 export function resolveGuidedDispatchProjectRoot(basePath) {
     return basePath ?? process.cwd();
 }
+/**
+ * Wait until the workflow MCP server is reachable and advertising its tool
+ * surface. Returns failure details when timed out, or null when ready (or MCP
+ * is not the transport). Called inside dispatchWorkflow() so every guided-flow
+ * dispatch path is gated automatically.
+ */
+const MCP_READINESS_TIMEOUT_MS = 15_000;
+const MCP_READINESS_POLL_MS = 200;
+async function awaitWorkflowMcpReadiness(pi, ctx, basePath, options = {}) {
+    const provider = ctx.model?.provider;
+    const authMode = provider ? ctx.modelRegistry.getProviderAuthMode(provider) : undefined;
+    if (!usesWorkflowMcpTransport(authMode, ctx.model?.baseUrl))
+        return null;
+    const projectRoot = resolveWorkflowMcpProjectRoot(basePath);
+    const launch = detectWorkflowMcpLaunchConfig(projectRoot);
+    if (!launch)
+        return null;
+    const requiredTools = options.unitType
+        ? getRequiredWorkflowToolsForUnit(options.unitType).filter(isWorkflowToolSurfaceName)
+        : [];
+    const coversExpectedSurface = (tools) => requiredTools.length > 0
+        ? probeCoversRequiredWorkflowTools(tools, requiredTools)
+        : workflowMcpProbeAdvertisesSurface(tools);
+    const serverPrefix = `mcp__${launch.name}__`;
+    const systemPrompt = () => typeof ctx.getSystemPrompt === "function" ? ctx.getSystemPrompt() : "";
+    const systemPromptCoversExpectedSurface = () => {
+        const prompt = systemPrompt();
+        return requiredTools.length > 0
+            ? requiredTools.every((tool) => prompt.includes(`${serverPrefix}${tool}`))
+            : prompt.includes(serverPrefix);
+    };
+    const sessionAlreadyReady = () => coversExpectedSurface(getRegisteredToolSnapshot(pi)) ||
+        systemPromptCoversExpectedSurface();
+    if (sessionAlreadyReady())
+        return null;
+    if (coversExpectedSurface(getCachedWorkflowMcpProbe(projectRoot)?.tools ?? [])) {
+        return null;
+    }
+    const probe = options.probe ?? probeAndCacheWorkflowMcp;
+    const probeTimeoutMs = options.probeTimeoutMs ?? WORKFLOW_MCP_PROBE_TIMEOUT_MS;
+    ctx.ui.setStatus("gsd-step", `Waiting for ${launch.name} MCP server…`);
+    let lastError;
+    const deadline = Date.now() + (options.timeoutMs ?? MCP_READINESS_TIMEOUT_MS);
+    const pollMs = options.pollMs ?? MCP_READINESS_POLL_MS;
+    while (Date.now() < deadline) {
+        if (sessionAlreadyReady()) {
+            ctx.ui.setStatus("gsd-step", "");
+            return null;
+        }
+        const result = await probe(projectRoot, { timeoutMs: probeTimeoutMs });
+        if (result.ok && coversExpectedSurface(result.tools)) {
+            ctx.ui.setStatus("gsd-step", "");
+            return null;
+        }
+        lastError = result.error;
+        await new Promise((r) => setTimeout(r, pollMs));
+    }
+    ctx.ui.setStatus("gsd-step", "");
+    return lastError ? { server: launch.name, error: lastError } : { server: launch.name };
+}
+export const _awaitWorkflowMcpReadinessForTest = awaitWorkflowMcpReadiness;
 /**
  * Read GSD-WORKFLOW.md and dispatch it to the LLM with a contextual note.
  * This is the only way the wizard triggers work — everything else is the LLM's job.
@@ -418,6 +484,25 @@ async function dispatchWorkflow(pi, note, customType = "gsd-run", ctx, unitType,
             ctx.ui.notify(compatibilityError, "error");
             return;
         }
+        // ── Live MCP readiness gate ────────────────────────────────────────
+        // Units with required workflow tools must not dispatch until the MCP
+        // surface covers that exact contract; otherwise the model can race into
+        // "No such tool available" before recovery sees a clean readiness error.
+        warmWorkflowMcpProbeInBackground(projectRoot);
+        const requiredWorkflowTools = getRequiredWorkflowToolsForUnit(unitType).filter(isWorkflowToolSurfaceName);
+        const strictBlocking = requiredWorkflowTools.length > 0
+            && (process.env.GSD_GUIDED_MCP_BLOCKING ?? "").trim() !== "0";
+        if (strictBlocking) {
+            // If the workflow MCP server is configured but still connecting, wait
+            // for it instead of dispatching into a child session that will abort.
+            const readinessFailure = await awaitWorkflowMcpReadiness(pi, ctx, projectRoot, { unitType });
+            if (readinessFailure) {
+                const detail = readinessFailure.error ? ` ${readinessFailure.error}` : "";
+                ctx.ui.notify(`GSD workflow server "${readinessFailure.server}" did not connect in time.${detail} ` +
+                    `Run \`/gsd mcp check ${readinessFailure.server}\` for details.`, "warning");
+                return;
+            }
+        }
     }
     // Scope tools for guided workflow turns (#2949, token-consumption savings).
     // Providers with grammar-based constrained decoding (xAI/Grok) return
@@ -1300,6 +1385,7 @@ async function handleMilestoneActions(ctx, pi, basePath, milestoneId, milestoneT
 }
 export async function showSmartEntry(ctx, pi, basePath, options) {
     const stepMode = options?.step ?? true;
+    warmWorkflowMcpProbeInBackground(basePath);
     // ── Clear stale milestone ID reservations from previous cancelled sessions ──
     // Reservations only need to survive within a single /gsd interaction.
     // Without this, each cancelled session permanently bumps the next ID. (#2488)

package/dist/resources/extensions/gsd/health-widget.js

@@ -1,7 +1,7 @@
 // Project/App: gsd-pi
 // File Purpose: Always-on ambient health signal rendered below the editor.
 import { runProviderChecks, summariseProviderIssues } from "./doctor-providers.js";
-import { runEnvironmentChecks } from "./doctor-environment.js";
+import { runEnvironmentChecks, runEnvironmentChecksAsync } from "./doctor-environment.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { nativeIsRepo, nativeLastCommitEpoch, nativeGetCurrentBranch, nativeCommitSubject } from "./native-git-bridge.js";
 import { loadLedgerFromDisk, getProjectTotals } from "./metrics.js";
@@ -9,7 +9,28 @@ import { projectRoot } from "./commands/context.js";
 import { buildHealthLines, detectHealthWidgetProjectState, } from "./health-widget-core.js";
 export const HEALTH_WIDGET_ACTIVE_HINTS = "  /gsd auto to run  ·  /gsd status to inspect  ·  /gsd report for snapshots  ·  /gsd notifications for history  ·  /gsd help";
 // ── Data loader ────────────────────────────────────────────────────────────────
-function loadHealthWidgetData(basePath) {
+// Last-commit lookup is subprocess-backed (native-git-bridge → git spawns),
+// so it is treated like the other expensive checks: skipped on first paint,
+// run only by the background refresh.
+function loadLastCommitInfo(basePath) {
+    try {
+        if (nativeIsRepo(basePath)) {
+            const branch = nativeGetCurrentBranch(basePath);
+            const epoch = nativeLastCommitEpoch(basePath, branch || "HEAD");
+            if (epoch > 0) {
+                return { epoch, message: nativeCommitSubject(basePath, branch || "HEAD") || null };
+            }
+        }
+    }
+    catch { /* non-fatal */ }
+    return { epoch: null, message: null };
+}
+function loadHealthWidgetData(basePath, options) {
+    // `includeChecks` gates the expensive subprocess-backed checks (provider +
+    // environment doctor: `lsof`, `docker`, `node --version`, ...). The initial
+    // synchronous render passes `false` so first paint is never blocked on them;
+    // the async refresh (off the first-paint path) runs the full suite.
+    const includeChecks = options?.includeChecks ?? true;
     let budgetCeiling;
     let budgetSpent = 0;
     let providerIssue = null;
@@ -28,13 +49,57 @@ function loadHealthWidgetData(basePath) {
         }
     }
     catch { /* non-fatal */ }
+    if (includeChecks) {
+        try {
+            const providerResults = runProviderChecks();
+            providerIssue = summariseProviderIssues(providerResults);
+        }
+        catch { /* non-fatal */ }
+        try {
+            const envResults = runEnvironmentChecks(basePath);
+            for (const r of envResults) {
+                if (r.status === "error")
+                    environmentErrorCount++;
+                else if (r.status === "warning")
+                    environmentWarningCount++;
+            }
+        }
+        catch { /* non-fatal */ }
+    }
+    // ── Last commit info ── (git spawns — gated like the other expensive checks)
+    if (includeChecks) {
+        const commit = loadLastCommitInfo(basePath);
+        lastCommitEpoch = commit.epoch;
+        lastCommitMessage = commit.message;
+    }
+    return {
+        projectState,
+        budgetCeiling,
+        budgetSpent,
+        providerIssue,
+        environmentErrorCount,
+        environmentWarningCount,
+        lastCommitEpoch,
+        lastCommitMessage,
+        lastRefreshed: Date.now(),
+    };
+}
+// Non-blocking variant used by the widget's background refresh: the cheap fields
+// come from the synchronous snapshot, then provider + environment checks are
+// layered in off the event-loop critical path (env checks run concurrently via
+// runEnvironmentChecksAsync). Keeps the always-on widget from stalling the UI on
+// its initial enrichment or its 60s refresh.
+async function loadHealthWidgetDataAsync(basePath) {
+    const data = loadHealthWidgetData(basePath, { includeChecks: false });
+    let providerIssue = data.providerIssue;
+    let environmentErrorCount = 0;
+    let environmentWarningCount = 0;
     try {
-        const providerResults = runProviderChecks();
-        providerIssue = summariseProviderIssues(providerResults);
+        providerIssue = summariseProviderIssues(runProviderChecks());
     }
     catch { /* non-fatal */ }
     try {
-        const envResults = runEnvironmentChecks(basePath);
+        const envResults = await runEnvironmentChecksAsync(basePath);
         for (const r of envResults) {
             if (r.status === "error")
                 environmentErrorCount++;
@@ -43,27 +108,14 @@ function loadHealthWidgetData(basePath) {
         }
     }
     catch { /* non-fatal */ }
-    // ── Last commit info ──
-    try {
-        if (nativeIsRepo(basePath)) {
-            const branch = nativeGetCurrentBranch(basePath);
-            const epoch = nativeLastCommitEpoch(basePath, branch || "HEAD");
-            if (epoch > 0) {
-                lastCommitEpoch = epoch;
-                lastCommitMessage = nativeCommitSubject(basePath, branch || "HEAD") || null;
-            }
-        }
-    }
-    catch { /* non-fatal */ }
+    const commit = loadLastCommitInfo(basePath);
     return {
-        projectState,
-        budgetCeiling,
-        budgetSpent,
+        ...data,
         providerIssue,
         environmentErrorCount,
         environmentWarningCount,
-        lastCommitEpoch,
-        lastCommitMessage,
+        lastCommitEpoch: commit.epoch,
+        lastCommitMessage: commit.message,
         lastRefreshed: Date.now(),
     };
 }
@@ -77,8 +129,13 @@ export function initHealthWidget(ctx) {
     if (!ctx.hasUI)
         return;
     const basePath = projectRoot();
-    // String-array fallback — used in RPC mode (factory is a no-op there)
-    const initialData = loadHealthWidgetData(basePath);
+    // String-array fallback — used in RPC mode (factory is a no-op there).
+    // Skip the expensive provider/environment doctor checks here: this runs
+    // synchronously on the interactive-startup path, where running them would
+    // block first paint by ~0.9s (lsof/docker probes, otherwise run again
+    // immediately by the factory below). The factory's async refresh fills in
+    // real health once the screen is up.
+    const initialData = loadHealthWidgetData(basePath, { includeChecks: false });
     ctx.ui.setWidget("gsd-health", buildHealthLines(initialData), { placement: "belowEditor" });
     // Factory-based widget for TUI mode — replaces the string-array above
     ctx.ui.setWidget("gsd-health", (_tui, _theme) => {
@@ -91,7 +148,7 @@ export function initHealthWidget(ctx) {
                 return;
             refreshInFlight = true;
             try {
-                data = loadHealthWidgetData(basePath);
+                data = await loadHealthWidgetDataAsync(basePath);
                 cachedLines = undefined;
                 if (!isDisposed)
                     _tui.requestRender();
@@ -101,9 +158,11 @@ export function initHealthWidget(ctx) {
                 refreshInFlight = false;
             }
         };
-        // Fire first enrichment immediately. requestRender() inside is a no-op
-        // if the widget has not yet rendered, so this is safe before factory return.
-        void refresh();
+        // Fire the first full enrichment off the first-paint path. setTimeout(0)
+        // yields to the initial render + input loop, so the expensive doctor checks
+        // (provider + environment) never delay the moment the user sees the UI.
+        // requestRender() inside refresh repaints the widget once data is ready.
+        setTimeout(() => { void refresh(); }, 0);
         const refreshTimer = setInterval(() => {
             void refresh();
         }, REFRESH_INTERVAL_MS);

package/dist/resources/extensions/gsd/mcp-bridge.js

@@ -0,0 +1,10 @@
+// mcp-bridge.ts — stable runtime seam for MCP server consumption (phase 1).
+export { loadWriteGateSnapshot, shouldBlockPendingGateInSnapshot, shouldBlockQueueExecutionInSnapshot, } from "./bootstrap/write-gate.js";
+export { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
+export { _getAdapter, checkpointDatabase, closeDatabase, getAllMilestones, getDb, getGateResults, getMilestoneSlices, getPendingGates, getSliceTasks, insertDecision, insertMilestone, insertSlice, openDatabase, upsertMilestonePlanning, } from "./gsd-db.js";
+export { invalidateStateCache, isReusableGhostMilestone } from "./state.js";
+export { loadEffectiveGSDPreferences } from "./preferences.js";
+export { saveDecisionToDb, saveRequirementToDb, updateRequirementInDb, } from "./db-writer.js";
+export { rebuildState } from "./doctor.js";
+export { queryJournal } from "./journal.js";
+export { claimReservedId, findMilestoneIds, getReservedMilestoneIds, milestoneIdSort, nextMilestoneId, } from "./milestone-ids.js";

package/dist/resources/extensions/gsd/memory-relations.js

@@ -3,7 +3,7 @@
 // Phase 4 companion to memory-store.ts. Edges live in the `memory_relations`
 // table and are created by (a) explicit LINK actions emitted by the memory
 // extractor, or (b) future `/gsd memory link` CLI commands. All writes go
-// through the single-writer gate in `gsd-db.ts`.
+// through typed writer wrappers re-exported by `gsd-db.ts`.
 import { _getAdapter, deleteMemoryRelationsFor, insertMemoryRelationRow, isDbAvailable, } from "./gsd-db.js";
 export const VALID_RELATIONS = [
     "related_to",

package/dist/resources/extensions/gsd/milestone-settlement.js

@@ -43,8 +43,8 @@ export function evaluateAllCompleteSettlement(input) {
         reason: "merge-pending",
         action: "pause",
         message: `Milestone ${milestoneId} is complete, but its worktree branch has not been merged to main. ` +
-            `Retry with \`/gsd dispatch complete-milestone ${milestoneId}\` or merge manually.`,
-        nextAction: `Retry \`/gsd dispatch complete-milestone ${milestoneId}\` or merge manually.`,
+            `Retry with \`/gsd dispatch complete-milestone ${milestoneId}\` to finish the system-owned merge.`,
+        nextAction: `Retry \`/gsd dispatch complete-milestone ${milestoneId}\`.`,
         milestoneId,
     };
 }

package/dist/resources/extensions/gsd/notifications.js

@@ -2,31 +2,36 @@
 // Cross-platform desktop notifications for auto-mode events.
 import { execFileSync } from "node:child_process";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
-import { sendRemoteNotification } from "../remote-questions/notify.js";
+import { sendRemoteNotification as _sendRemoteNotification } from "../remote-questions/notify.js";
+/** Swappable dispatcher for remote notifications — exported so tests can mock it. */
+export const remoteNotificationDispatcher = {
+    send: _sendRemoteNotification,
+};
 /**
  * Send a native desktop notification. Non-blocking, non-fatal.
  * macOS: osascript, Linux: notify-send, Windows: skipped.
  */
-export function sendDesktopNotification(title, message, level = "info", kind = "complete", projectName) {
+export function sendDesktopNotification(title, message, level = "info", kind = "complete", projectName, deps = {}) {
     // When a projectName is provided and the title is the default "GSD",
     // replace it with a project-qualified title for multi-project clarity.
     if (projectName && title === "GSD") {
         title = formatNotificationTitle(projectName);
     }
-    const loaded = loadEffectiveGSDPreferences()?.preferences;
+    const loadedPreferences = loadEffectiveGSDPreferences()?.preferences;
+    const notifications = deps.notifications ?? loadedPreferences?.notifications;
     // Remote notifications fire independently of desktop preferences.
     // sendRemoteNotification handles "not configured" gracefully (early return).
-    void sendRemoteNotification(title, message).catch(() => { });
-    if (!shouldSendDesktopNotification(kind, loaded?.notifications))
+    void remoteNotificationDispatcher.send(title, message).catch(() => { });
+    if (!shouldSendDesktopNotification(kind, notifications))
         return;
     // cmux delivery and desktop delivery are independent — if cmux import or
     // delivery fails, we must still attempt the native desktop notification.
     const runCmux = async () => {
         try {
             const { CmuxClient, emitOsc777Notification, resolveCmuxConfig } = await import("../cmux/index.js");
-            const cmux = resolveCmuxConfig(loaded);
+            const cmux = resolveCmuxConfig(loadedPreferences);
             if (cmux.notifications) {
-                const delivered = CmuxClient.fromPreferences(loaded).notify(title, message);
+                const delivered = CmuxClient.fromPreferences(loadedPreferences).notify(title, message);
                 if (delivered)
                     return true;
                 emitOsc777Notification(title, message);

package/dist/resources/extensions/gsd/preferences-models.js

@@ -74,8 +74,9 @@ function resolveWinningPhase(models, chain) {
  * - Legacy: `planning: claude-opus-4-6`
  * - Extended: `planning: { model: claude-opus-4-6, fallbacks: [glm-5, minimax-m2.5] }`
  */
-export function resolveModelWithFallbacksForUnit(unitType) {
-    const prefs = loadEffectiveGSDPreferences(undefined, { availableModelIds: [] });
+export function resolveModelWithFallbacksForUnit(unitType, basePath, availableModelIds) {
+    const loadOpts = availableModelIds !== undefined ? { availableModelIds } : undefined;
+    const prefs = loadEffectiveGSDPreferences(basePath, loadOpts);
     const chain = phaseChainForUnit(unitType);
     if (!chain)
         return undefined;
@@ -119,8 +120,9 @@ export function resolveModelWithFallbacksForUnit(unitType) {
  * floor. Session level, defaults, the floor, and capability clamping are NOT
  * applied here.
  */
-export function resolveThinkingLevelForUnit(unitType) {
-    const prefs = loadEffectiveGSDPreferences(undefined, { availableModelIds: [] })?.preferences;
+export function resolveThinkingLevelForUnit(unitType, basePath, availableModelIds) {
+    const loadOpts = availableModelIds !== undefined ? { availableModelIds } : undefined;
+    const prefs = loadEffectiveGSDPreferences(basePath, loadOpts)?.preferences;
     if (!prefs)
         return undefined;
     const chain = phaseChainForUnit(unitType);
@@ -162,8 +164,9 @@ export function resolveThinkingLevelForUnit(unitType) {
  * Returns `{ provider, id }` or `undefined` if no model preference is
  * configured.
  */
-export function resolveDefaultSessionModel(sessionProvider, basePath) {
-    const prefs = loadEffectiveGSDPreferences(basePath, { availableModelIds: [] });
+export function resolveDefaultSessionModel(sessionProvider, basePath, availableModelIds) {
+    const loadOpts = availableModelIds !== undefined ? { availableModelIds } : undefined;
+    const prefs = loadEffectiveGSDPreferences(basePath, loadOpts);
     const models = prefs?.preferences?.models;
     if (!models)
         return undefined;
@@ -377,7 +380,9 @@ export function resolveAutoSupervisorConfig() {
     };
 }
 // ─── Token Profile Resolution ─────────────────────────────────────────────
-const VALID_TOKEN_PROFILES = new Set(["budget", "balanced", "quality", "burn-max"]);
+export const VALID_TOKEN_PROFILES = new Set(["budget", "balanced", "quality", "burn-max"]);
+/** D046: balanced is the implicit profile when `token_profile` is omitted. */
+export const DEFAULT_TOKEN_PROFILE = "balanced";
 /**
  * Per-phase tier intentions for each token profile.
  * Profiles express capability tiers, not model IDs. Concrete model
@@ -421,8 +426,11 @@ const PROFILE_TIER_MAP = {
  *
  * Model IDs are resolved from capability tiers, not hardcoded to any
  * provider. When available models are known (runtime), the resolver picks
- * the best match across all configured providers. When not known (e.g.,
- * early startup), falls back to canonical Anthropic model IDs.
+ * the best match on the anchor provider (session / auto-start model). Callers
+ * scope the available-model list via `modelIdsForProfileResolution` so token
+ * profiles do not hop to a cheaper provider (e.g. Gemini Flash) when the user
+ * is working on OpenAI or Anthropic. When not known (e.g., early startup),
+ * falls back to canonical Anthropic model IDs.
  *
  * @param profile           The token profile to resolve
  * @param availableModelIds Optional list of available model IDs for cross-provider resolution.

package/dist/resources/extensions/gsd/preferences.js

@@ -16,7 +16,7 @@ import { gsdRoot } from "./paths.js";
 import { parse as parseYaml } from "yaml";
 import { normalizeStringArray } from "../shared/format-utils.js";
 import { logWarning } from "./workflow-logger.js";
-import { resolveProfileDefaults as _resolveProfileDefaults } from "./preferences-models.js";
+import { DEFAULT_TOKEN_PROFILE, resolveProfileDefaults as _resolveProfileDefaults, VALID_TOKEN_PROFILES, resolveDisabledModelProvidersFromPreferences, } from "./preferences-models.js";
 import { nativeHasCommittedHead, nativeIsRepo } from "./native-git-bridge.js";
 import { KNOWN_PREFERENCE_KEYS, MODE_DEFAULTS, formatSkillRef, } from "./preferences-types.js";
 import { validatePreferences } from "./preferences-validation.js";
@@ -67,6 +67,74 @@ export function getLegacyGlobalGSDPreferencesPath() {
 export function getProjectGSDPreferencesPath(basePath) {
     return projectPreferencesPath(basePath);
 }
+/** Format registry models the same way tier resolution and prefs persistence use. */
+export function availableModelIdsFromRegistry(registry) {
+    return registry.getAvailable().map((m) => `${m.provider}/${m.id}`);
+}
+/**
+ * Keep only provider-qualified model IDs for a single provider (case-insensitive).
+ * Bare IDs are excluded — tier resolution requires provider/model form.
+ */
+export function restrictModelIdsToProvider(modelIds, provider) {
+    const normalized = provider.trim().toLowerCase();
+    if (!normalized)
+        return modelIds;
+    return modelIds.filter((id) => {
+        const slash = id.indexOf("/");
+        if (slash <= 0)
+            return false;
+        return id.slice(0, slash).toLowerCase() === normalized;
+    });
+}
+/**
+ * Model IDs for token-profile tier resolution. When an anchor provider is known
+ * (session model / auto-start snapshot), stay on that provider instead of picking
+ * the globally cheapest tier match across every logged-in provider (e.g. Gemini
+ * Flash beating GPT mini on cost).
+ */
+export function modelIdsForProfileResolution(registry, anchorProvider, disabledProviders) {
+    let all = availableModelIdsFromRegistry(registry);
+    if (disabledProviders?.length) {
+        const blocked = new Set(disabledProviders.map((p) => p.trim().toLowerCase()).filter((p) => p.length > 0));
+        all = all.filter((id) => {
+            const slash = id.indexOf("/");
+            if (slash <= 0)
+                return true;
+            return !blocked.has(id.slice(0, slash).toLowerCase());
+        });
+    }
+    if (all.length === 0)
+        return undefined;
+    if (!anchorProvider?.trim())
+        return all;
+    // Stay on the anchor provider — do not fall back to the full registry when the
+    // scoped list is empty (that reintroduces cross-provider cost picks like Gemini).
+    return restrictModelIdsToProvider(all, anchorProvider);
+}
+/** Provider anchor for token-profile tier resolution (auto-start model wins). */
+export function resolveProfileAnchorProvider(sessionProvider, autoModeStartProvider) {
+    const start = autoModeStartProvider?.trim();
+    if (start)
+        return start;
+    const session = sessionProvider?.trim();
+    return session || undefined;
+}
+/**
+ * Load effective preferences with token-profile tiers resolved against models
+ * the user can actually call (from the live registry), not canonical Anthropic
+ * fallbacks.
+ */
+export function loadEffectiveGSDPreferencesWithRegistry(registry, basePath, anchorProvider) {
+    if (!registry) {
+        return loadEffectiveGSDPreferences(basePath);
+    }
+    const disabledProviders = resolveDisabledModelProvidersFromPreferences();
+    const availableModelIds = modelIdsForProfileResolution(registry, anchorProvider, disabledProviders);
+    if (!availableModelIds) {
+        return loadEffectiveGSDPreferences(basePath);
+    }
+    return loadEffectiveGSDPreferences(basePath, { availableModelIds });
+}
 /**
  * Normalize a value loaded from disk (or passed from another component) into
  * a plain, mutable bare preferences object.
@@ -138,12 +206,24 @@ export function loadEffectiveGSDPreferences(basePath, opts) {
     // Apply token-profile defaults as the lowest-priority layer so that
     // `token_profile: budget` sets models and phase-skips automatically.
     // Explicit user preferences always override profile defaults.
-    const profile = result.preferences.token_profile;
-    if (profile) {
-        const profileDefaults = _resolveProfileDefaults(profile, opts?.availableModelIds, result.preferences.dynamic_routing);
+    const explicitProfile = result.preferences.token_profile;
+    let profileForDefaults;
+    if (explicitProfile) {
+        if (VALID_TOKEN_PROFILES.has(explicitProfile)) {
+            profileForDefaults = explicitProfile;
+        }
+    }
+    else {
+        profileForDefaults = DEFAULT_TOKEN_PROFILE;
+    }
+    if (profileForDefaults) {
+        const profileDefaults = _resolveProfileDefaults(profileForDefaults, opts?.availableModelIds, result.preferences.dynamic_routing);
+        const defaultsToApply = explicitProfile
+            ? profileDefaults
+            : withoutProfilePhaseDefaults(profileDefaults);
         result = {
             ...result,
-            preferences: mergePreferences(profileDefaults, result.preferences),
+            preferences: mergePreferences(defaultsToApply, result.preferences),
         };
     }
     // Apply mode defaults as the lowest-priority layer
@@ -156,6 +236,12 @@ export function loadEffectiveGSDPreferences(basePath, opts) {
     result = stripInheritedPlanningDepth(result, projectHasPlanningDepth);
     return result;
 }
+function withoutProfilePhaseDefaults(defaults) {
+    if (defaults.phases === undefined)
+        return defaults;
+    const { phases: _phases, ...rest } = defaults;
+    return rest;
+}
 function mergePreferenceMetadata(primary, secondary) {
     const mergedWarnings = [
         ...(primary.warnings ?? []),

package/dist/resources/extensions/gsd/prompts/complete-milestone.md

@@ -12,6 +12,10 @@ If any inlined plan, summary, verification command, or prior artifact names an a
 
 All slices are complete. Verify the integrated work, persist milestone completion, refresh project state, and write the final record future milestones will rely on.
 
+### Closeout messaging (auto-mode)
+
+You write closeout artifacts; **GSD auto-mode** decides when the milestone is actually **done**. Never say "Milestone {{milestoneId}} is complete" or "Milestone {{milestoneId}} complete." in this unit — not even after `gsd_complete_milestone` succeeds. GSD announces completion only after post-unit verification passes.
+
 Preloaded context includes roadmap, requirements, decisions, project context, and compact slice-summary excerpts. Slice summaries are excerpts, not full files: use them first, then selectively read full SUMMARY.md files listed under "On-demand Slice Summaries" only when section headings indicate needed evidence for LEARNINGS, Decision Re-evaluation, deviations, limitations, or cross-slice narrative.
 
 Start with what the excerpts give you. Read full files when the section heads signal richer context you need.
@@ -31,7 +35,9 @@ Subagents report only; they do not write user source. Fold any findings into Dec
 
 ## Steps
 
-1. **Duplicate completion guard:** Call `gsd_milestone_status` for `{{milestoneId}}` before any durable writes. If the returned milestone **status is `complete`**, this is a stale or duplicate closeout turn: do NOT mutate requirements, do NOT refresh the project document, do NOT write LEARNINGS, and do NOT persist milestone completion again. Say: "Milestone {{milestoneId}} is already complete." and stop.
+1. **Duplicate completion guard:** Call `gsd_milestone_status` for `{{milestoneId}}` before any durable writes. If the returned milestone **status is `complete`**:
+   - **Verification-retry turn** (prompt begins with `VERIFICATION FAILED`): do NOT stop or declare completion. Repair the closeout evidence in the failure context. Skip step 13 if the milestone is already complete in the DB.
+   - **Otherwise** (stale duplicate closeout): do NOT mutate requirements, do NOT refresh the project document, do NOT write LEARNINGS, and do NOT persist milestone completion again. Say: "Milestone {{milestoneId}} closeout already recorded." and stop.
 2. Use the **Milestone Summary** output template from the inlined context above
 3. {{skillActivation}}
 4. **Verify code changes exist.** Compare milestone work against the integration branch (`main`, `master`, or recorded branch), using merge-base as older revision and `HEAD` as newer. If the diff lists non-`.gsd/` files, pass. If `HEAD` equals the integration branch/merge-base, treat it as a self-diff retry: inspect milestone-scoped commit evidence (`GSD-Unit: {{milestoneId}}` or production `GSD-Task: Sxx/Tyy` trailers touching `.gsd/milestones/{{milestoneId}}/`) and verify those commits touched non-`.gsd/` files. Record **verification failure** only when neither source shows implementation files.
@@ -84,7 +90,7 @@ Subagents report only; they do not write user source. Fold any findings into Dec
    - `deviations` (string) — Deviations from the original plan
 
 14. Do not commit manually — the system auto-commits your changes after this unit completes.
-- After `gsd_complete_milestone` succeeds, emit only one closeout line: "Milestone {{milestoneId}} complete." Do not add a second final-status block, repeat the tool result, or restate the closeout summary.
+- After `gsd_complete_milestone` succeeds, emit only one closeout line: "Milestone {{milestoneId}} closeout submitted." Do not say the milestone is complete, do not add a second final-status block, repeat the tool result, or restate the closeout summary.
 
 **Important:** Do NOT skip code-change, success-criteria, or definition-of-done verification (steps 4-6). The summary must reflect verified outcomes. Verification failures block completion; there is no override. If a verification tool fails, errors, or returns unexpected output, treat it as failure.
 

package/dist/resources/extensions/gsd/prompts/complete-slice.md

@@ -12,6 +12,10 @@ If any inlined plan, summary, verification command, or prior artifact names an a
 
 You are the closer: verify assembled task work delivers the slice goal, then compress it into a downstream-ready summary and UAT.
 
+### Closeout messaging (auto-mode)
+
+You write closeout artifacts; **GSD auto-mode** decides when the slice is actually **done**. Never say "Slice {{sliceId}} complete" in this unit — not even after `gsd_slice_complete` succeeds. GSD announces completion only after post-unit verification passes.
+
 {{inlinedContext}}
 
 {{gatesToClose}}
@@ -38,7 +42,7 @@ Use `subagent` only when useful: reviewer, security, or tester. Apply findings b
 10. Prepare `gsd_slice_complete` content with camelCase fields `milestoneId`, `sliceId`, `sliceTitle`, `oneLiner`, `narrative`, `verification`, and `uatContent`.
 11. Draft concrete UAT with preconditions, steps, expected outcomes, edge cases, and UAT Type. Declare the type as a bullet under a `## UAT Type` heading, exactly like `- UAT mode: browser-executable`.
     **Web apps:** when inlined Web App UAT guidance is present, declare `browser-executable` or `runtime-executable` (not `artifact-driven`) for localhost/browser/screenshot steps; include dev-server preconditions and name Playwright specs when they exist.
-12. Review the inlined task-summary excerpts for DECISIONS.md/KNOWLEDGE.md-worthy decisions and gotchas. Read full `*-SUMMARY.md` only if needed. Capture with `capture_thought`; do not append knowledge files.
+12. Review the inlined task-summary excerpts for DECISIONS.md/KNOWLEDGE.md-worthy decisions and gotchas. Read full `*-SUMMARY.md` only if needed. Capture with `gsd_capture_thought` (MCP-scoped `mcp__...__gsd_capture_thought`), not bare `capture_thought`; do not append knowledge files.
 13. When verification passes, call `gsd_slice_complete`. The DB-backed tool is the canonical write path. Do **not** manually write `{{sliceSummaryPath}}`. Do **not** manually write `{{sliceUatPath}}`. Do not edit roadmap checkboxes.
 14. Do not run git commands.
 15. If the current project state needs refresh, call `gsd_summary_save` with `artifact_type: "PROJECT"` and the full updated project markdown as `content`; omit `milestone_id`. Do not write or edit `.gsd/PROJECT.md` directly.
@@ -49,4 +53,4 @@ Use `subagent` only when useful: reviewer, security, or tester. Apply findings b
 
 **You MUST call `gsd_slice_complete` with summary and UAT content only after verification passes.**
 
-When done, say: "Slice {{sliceId}} complete." Say this exactly once — if you already said it in a prior message, do not repeat it.
+When done, say: "Slice {{sliceId}} closeout submitted." Do not say the slice is complete. Say this exactly once — if you already said it in a prior message, do not repeat it.

package/dist/resources/extensions/gsd/prompts/execute-task.md

@@ -52,6 +52,7 @@ You execute. The inlined task plan is authoritative. Verify referenced files and
 
 - If task sections exist for Failure Modes (Q5), Load Profile (Q6), Negative Tests (Q7), or Observability Impact, implement and verify them.
 - Verify must-haves with concrete commands or observable behavior.
+- Run verification commands through `gsd_exec` / Context Mode evidence when workflow MCP tools are presented. Use `gsd_exec_search` before rerunning noisy checks, and `gsd_resume` after compaction or resume. Do not call direct `bash` for final verification evidence in this unit.
 - Run slice-level verification from the slice plan. Final tasks need all checks passing; intermediate tasks should record partial passes.
 - Populate `## Verification Evidence` with `formatEvidenceTable` rows: command, exit code, verdict, duration. If no checks were found, say so.
 - For UI/browser/DOM/user-visible web changes, exercise the real flow and record explicit checks.
@@ -62,9 +63,13 @@ Keep about **{{verificationBudget}}** for verification and summary. If context i
 
 ## Completion Contract
 
+### Closeout messaging (auto-mode)
+
+You write task closeout artifacts; **GSD auto-mode** decides when the task is actually **done**. Never say "Task {{taskId}} complete" in this unit — not even after `gsd_task_complete` succeeds. GSD announces completion only after post-unit verification passes.
+
 - If the plan is fundamentally invalid, set `blocker_discovered: true` in the summary and explain.
 - For downstream-impacting ambiguity that cannot be resolved from code, plans, or decisions, include an `escalation` object with question, options, recommendation, rationale, and `continueWithDefault`.
-- Capture meaningful architecture/pattern/observability decisions with `capture_thought`; capture non-obvious gotchas or conventions only when they save future investigation.
+- Capture meaningful architecture/pattern/observability decisions with `gsd_capture_thought` (or MCP-scoped `mcp__...__gsd_capture_thought`) when workflow MCP tools are presented; capture non-obvious gotchas or conventions only when they save future investigation.
 - Use the inlined Task Summary template below. Read `{{taskSummaryTemplatePath}}` only if the inlined template is absent or visibly truncated.
 - Call `gsd_task_complete` with camelCase fields `milestoneId`, `sliceId`, `taskId`, `oneLiner`, `narrative`, `verification`, and `verificationEvidence`. Include `blockerDiscovered: true` when a stale-path safety failure or other plan-invalidating blocker prevents execution.
 - The DB-backed tool is the canonical write path. Do **not** manually write `{{taskSummaryPath}}` or edit PLAN.md checkboxes; the tool renders the summary and updates state.
@@ -76,4 +81,4 @@ Keep about **{{verificationBudget}}** for verification and summary. If context i
 
 **You MUST call `gsd_task_complete` before finishing, including when the stale-path safety rule stops execution.**
 
-When done, say: "Task {{taskId}} complete." Say this exactly once — if you already said it in a prior message, do not repeat it.
+When done, say: "Task {{taskId}} closeout submitted." Do not say the task is complete. Say this exactly once — if you already said it in a prior message, do not repeat it.