@opengsd/gsd-pi 1.2.0-dev.4c756166 → 1.2.0-dev.6ccd27b3

package/dist/resources/extensions/gsd/auto/workflow-unit-dispatch.js

@@ -1,7 +1,7 @@
 // Project/App: gsd-pi
 // File Purpose: Unit dispatch contract adapter for auto-mode loop.
 import { ExecutionGraphScheduler } from "../uok/execution-graph.js";
-import { runUnitPhase } from "./phases.js";
+import { runUnitPhase } from "./unit-phase.js";
 import { decideDispatchNodeKind } from "./workflow-kernel.js";
 export async function runUnitPhaseViaContract(dispatchContract, ic, iterData, loopState, sidecarItem, deps) {
     if (dispatchContract === "legacy-direct") {

package/dist/resources/extensions/gsd/auto/worktree-safety-phase.js

@@ -0,0 +1,125 @@
+// Project/App: gsd-pi
+// File Purpose: Worktree-safety helpers shared across auto-loop phase modules.
+import { classifyProject } from "../detection.js";
+import { resolveEffectiveUnitIsolationMode } from "../preferences.js";
+import { createWorktreeSafetyModule } from "../worktree-safety.js";
+import { resolveWorktreeProjectRoot } from "../worktree-root.js";
+import { resolveManifest } from "../unit-context-manifest.js";
+import { debugLog } from "../debug-logger.js";
+import { isSamePathLocal } from "./phase-helpers.js";
+import { hasHeldMilestoneLease, reclaimMissingMilestoneLease } from "./milestone-lease-reclaim.js";
+export function shouldDegradeEmptyWorktreeToProjectRoot(worktreeClassification, projectRootClassification) {
+    return (worktreeClassification.kind === "greenfield" &&
+        projectRootClassification.kind !== "greenfield" &&
+        projectRootClassification.kind !== "invalid-repo");
+}
+export function unitWritesSource(unitType) {
+    if (unitType.startsWith("hook/"))
+        return false;
+    // Backward compatibility: sidecar queues from older builds may persist
+    // prefixed unit types (e.g. "sidecar/quick-task").
+    const normalizedUnitType = unitType.startsWith("sidecar/")
+        ? unitType.slice("sidecar/".length)
+        : unitType;
+    const manifest = resolveManifest(normalizedUnitType);
+    if (!manifest)
+        return null;
+    return manifest.tools.mode === "all" || manifest.tools.mode === "docs";
+}
+export function formatWorktreeSafetyFailure(result) {
+    return `Worktree Safety failed (${result.kind}): ${result.reason} ${result.remediation}`;
+}
+export function formatWorktreeSafetyStopReason(result) {
+    if (result.kind === "empty-worktree-with-project-content") {
+        return `Worktree Safety failed (${result.kind}). Run /gsd doctor fix, then /gsd auto.`;
+    }
+    return `Worktree Safety failed (${result.kind}).`;
+}
+export function resolveEmptyWorktreeWithProjectContent(unitRoot, projectRoot) {
+    if (isSamePathLocal(unitRoot, projectRoot))
+        return false;
+    const worktreeClassification = classifyProject(unitRoot);
+    if (worktreeClassification.kind !== "greenfield")
+        return false;
+    const projectRootClassification = classifyProject(projectRoot);
+    return shouldDegradeEmptyWorktreeToProjectRoot(worktreeClassification, projectRootClassification);
+}
+export async function validateSourceWriteWorktreeSafety(ic, unitType, unitId, milestoneId, phase) {
+    const { ctx, pi, s, deps } = ic;
+    if (!s.basePath)
+        return null;
+    // Custom engine workflows (graph-driven, registered via run dirs) define
+    // their own step ids that are not in the GSD UnitContextManifest. Don't
+    // fail closed for those — the custom engine owns its own dispatch
+    // contract. The fail-closed safety check applies only to built-in GSD
+    // units whose Tool Contract is registered in the manifest. Use a truthy
+    // check so undefined (test sessions that never set the field) routes
+    // through the safety check, matching the regression test contract.
+    if (s.activeEngineId)
+        return null;
+    const writesSource = unitWritesSource(unitType);
+    if (writesSource === null) {
+        const msg = `Worktree Safety failed (missing-tool-contract): missing Tool Contract for ${unitType}. Add a UnitContextManifest entry before dispatching this Unit.`;
+        debugLog("worktreeSafety", {
+            phase,
+            unitType,
+            unitId,
+            milestoneId,
+            result: { ok: false, kind: "missing-tool-contract", reason: msg },
+            basePath: s.basePath,
+        });
+        ctx.ui.notify(msg, "error");
+        await deps.stopAuto(ctx, pi, msg);
+        return { action: "break", reason: "missing-tool-contract" };
+    }
+    if (!writesSource)
+        return null;
+    const projectRoot = s.canonicalProjectRoot ?? resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
+    // A degraded session already fell back to the milestone branch in the
+    // project root — validating against the canonical worktree root there
+    // would fail every dispatch with a false invalid-root. The same applies
+    // to a stranded-recovery session that adopted the milestone branch.
+    const isolationMode = resolveEffectiveUnitIsolationMode(deps.getIsolationMode(projectRoot), s.isolationDegraded, s.strandedRecoveryIsolationMode);
+    reclaimMissingMilestoneLease(s, milestoneId, isolationMode, phase);
+    const safety = createWorktreeSafetyModule();
+    const result = safety.validateUnitRoot({
+        unitType,
+        unitId,
+        writeScope: "source-writing",
+        projectRoot,
+        unitRoot: s.basePath,
+        milestoneId,
+        isolationMode,
+        expectedBranch: isolationMode !== "none" && milestoneId ? deps.autoWorktreeBranch(milestoneId) : null,
+        emptyWorktreeWithProjectContent: resolveEmptyWorktreeWithProjectContent(s.basePath, projectRoot),
+        // The milestone lease coordinates concurrent workers on an isolated
+        // milestone worktree/branch, which is established by enterMilestone in
+        // worktree/branch modes. `none` mode has no per-milestone isolation and
+        // does not reliably claim a lease (e.g. a fresh headless resume of an
+        // already-active milestone never re-enters it), so requiring a held lease
+        // there would falsely fail dispatch. Enforce the lease only in isolated
+        // modes; none-mode safety still validates the unit root.
+        lease: s.workerId
+            ? {
+                required: isolationMode !== "none",
+                held: hasHeldMilestoneLease(s, milestoneId),
+                owner: s.workerId,
+            }
+            : undefined,
+    });
+    if (result.ok)
+        return null;
+    const msg = formatWorktreeSafetyFailure(result);
+    debugLog("worktreeSafety", {
+        phase,
+        unitType,
+        unitId,
+        milestoneId,
+        result,
+        basePath: s.basePath,
+        projectRoot,
+    });
+    ctx.ui.notify(msg, "error");
+    await deps.stopAuto(ctx, pi, formatWorktreeSafetyStopReason(result));
+    return { action: "break", reason: result.kind };
+}

package/dist/resources/extensions/gsd/auto-direct-dispatch.js

@@ -4,14 +4,13 @@
  */
 import { deriveState } from "./state.js";
 import { loadFile } from "./files.js";
-import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
-import { parseRoadmap } from "./parsers-legacy.js";
-import { resolveMilestoneFile, resolveSliceFile, relSliceFile, } from "./paths.js";
+import { isDbAvailable, getClosedSliceIds } from "./gsd-db.js";
+import { resolveSliceFile, relSliceFile, } from "./paths.js";
 import { buildResearchSlicePrompt, buildResearchMilestonePrompt, buildPlanSlicePrompt, buildPlanMilestonePrompt, buildExecuteTaskPrompt, buildCompleteSlicePrompt, buildCompleteMilestonePrompt, buildValidateMilestonePrompt, buildReassessRoadmapPrompt, buildRunUatPrompt, buildReplanSlicePrompt, } from "./auto-prompts.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { pauseAuto } from "./auto.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
-import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, } from "./workflow-mcp.js";
+import { getUnitWorkflowDispatchReadinessError } from "./tool-contract.js";
 export async function dispatchDirectPhase(ctx, pi, phase, base) {
     const state = await deriveState(base);
     const mid = state.activeMilestone?.id;
@@ -135,21 +134,9 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
         }
         case "reassess":
         case "reassess-roadmap": {
-            // DB primary path — get completed slices, fall back to file parsing when DB has no data
-            let completedSliceIds = [];
-            if (isDbAvailable()) {
-                completedSliceIds = getMilestoneSlices(mid).filter(s => s.status === "complete").map(s => s.id);
-            }
-            if (completedSliceIds.length === 0) {
-                // File-based fallback: parse roadmap checkboxes
-                const roadmapPath = resolveMilestoneFile(dispatchBase, mid, "ROADMAP");
-                if (roadmapPath) {
-                    const roadmapContent = await loadFile(roadmapPath);
-                    if (roadmapContent) {
-                        completedSliceIds = parseRoadmap(roadmapContent).slices.filter(s => s.done).map(s => s.id);
-                    }
-                }
-            }
+            // DB-authoritative read (ADR-017) — markdown projections are never
+            // consulted for dispatch decisions. No DB rows means no completed slices.
+            const completedSliceIds = isDbAvailable() ? getClosedSliceIds(mid) : [];
             if (completedSliceIds.length === 0) {
                 ctx.ui.notify("Cannot dispatch reassess-roadmap: no completed slices.", "warning");
                 return;
@@ -173,20 +160,9 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
             // incomplete) slice. After slice completion, state.activeSlice advances
             // to the next incomplete slice, so we find the last done slice from the
             // roadmap instead (#1693).
-            let uatCompletedSliceIds = [];
-            if (isDbAvailable()) {
-                uatCompletedSliceIds = getMilestoneSlices(mid).filter(s => s.status === "complete").map(s => s.id);
-            }
-            if (uatCompletedSliceIds.length === 0) {
-                // File-based fallback: parse roadmap checkboxes
-                const roadmapPath = resolveMilestoneFile(dispatchBase, mid, "ROADMAP");
-                if (roadmapPath) {
-                    const roadmapContent = await loadFile(roadmapPath);
-                    if (roadmapContent) {
-                        uatCompletedSliceIds = parseRoadmap(roadmapContent).slices.filter(s => s.done).map(s => s.id);
-                    }
-                }
-            }
+            // DB-authoritative read (ADR-017) — no markdown fallback for dispatch
+            // decisions.
+            const uatCompletedSliceIds = isDbAvailable() ? getClosedSliceIds(mid) : [];
             if (uatCompletedSliceIds.length === 0) {
                 ctx.ui.notify("Cannot dispatch run-uat: no completed slices.", "warning");
                 return;
@@ -225,7 +201,8 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
             ctx.ui.notify(`Unknown phase "${phase}". Valid phases: research, plan, execute, complete, validate, reassess, uat, replan.`, "warning");
             return;
     }
-    const compatibilityError = getWorkflowTransportSupportError(ctx.model?.provider, getRequiredWorkflowToolsForAutoUnit(unitType), {
+    const compatibilityError = getUnitWorkflowDispatchReadinessError({
+        provider: ctx.model?.provider,
         projectRoot,
         surface: "direct phase dispatch",
         unitType,

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -2,11 +2,10 @@
 // File Purpose: Declarative auto-mode dispatch rules and dispatch resolver.
 import { loadFile, extractUatType, loadActiveOverrides } from "./files.js";
 import { getUatBrowserToolSupportError } from "./uat-policy.js";
-import { isDbAvailable, getMilestoneSlices, getPendingGatesForTurn, markPendingGatesOmittedForTurn, getMilestone, insertArtifact, insertAssessment, setSliceSketchFlag, transaction, getAssessment, } from "./gsd-db.js";
+import { isDbAvailable, getMilestoneSlices, getMilestoneSliceSummaries, getClosedSliceIds, getPendingGatesForTurn, markPendingGatesOmittedForTurn, getMilestone, insertArtifact, insertAssessment, setSliceSketchFlag, transaction, getAssessment, } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { extractVerdict, isAcceptableUatVerdict } from "./verdict-parser.js";
 import { gsdRoot, resolveGsdPathContract, resolveMilestoneFile, resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, relTaskFile, relSliceFile, buildMilestoneFileName, buildSliceFileName, buildTaskFileName, gsdProjectionRoot, } from "./paths.js";
-import { parseRoadmap } from "./parsers-legacy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
 import { logWarning, logError } from "./workflow-logger.js";
@@ -19,10 +18,15 @@ import { selectReactiveDispatchBatch } from "./uok/execution-graph.js";
 import { getMilestonePipelineVariant } from "./milestone-scope-classifier.js";
 import { EXECUTION_ENTRY_PHASES, hasFinalizedMilestoneContext } from "./uok/plan-v2.js";
 import { isAutoActive } from "./auto.js";
-import { markDepthVerified } from "./bootstrap/write-gate.js";
+// Host adapter explicitly: auto-dispatch runs in the extension host, and the
+// ambient write-gate exports env-sniff the adapter per call (they are reserved
+// for the workflow MCP child's dynamic-import surface).
+import { hostWriteGateAdapter } from "./bootstrap/write-gate.js";
 import { ensureWorkflowPreferencesCaptured } from "./planning-depth.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
-import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, } from "./workflow-mcp.js";
+import { resolveWorkflowMcpProjectRoot } from "./workflow-mcp.js";
+import { getUnitWorkflowDispatchReadinessError } from "./tool-contract.js";
+import { prepareBrowserDaemonForUat } from "./browser-daemon-auto-prep.js";
 import { PROJECT_RESEARCH_INFLIGHT_MARKER, } from "./project-research-policy.js";
 import { isWorkflowPrefsCaptured, resolveDeepProjectSetupState, } from "./deep-project-setup-policy.js";
 import { annotateBackgroundable } from "./delegation-policy.js";
@@ -289,30 +293,13 @@ function persistSliceAssessmentBackfill(assessmentRelPath, mid, sliceId, content
     });
 }
 function backfillMissingAssessmentsFromSummaries(basePath, mid) {
-    const completedSliceIds = new Set();
-    if (isDbAvailable()) {
-        for (const slice of getMilestoneSlices(mid)) {
-            if (slice.status === "complete" || slice.status === "done") {
-                completedSliceIds.add(slice.id);
-            }
-        }
-    }
-    else {
-        const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-        if (!roadmapFile)
-            return;
-        try {
-            const roadmap = parseRoadmap(readFileSync(roadmapFile, "utf-8"));
-            for (const slice of roadmap.slices) {
-                if (slice.done)
-                    completedSliceIds.add(slice.id);
-            }
-        }
-        catch {
-            return;
-        }
-    }
-    for (const sliceId of completedSliceIds) {
+    // DB-authoritative (ADR-017): no markdown fallback. Without DB rows there
+    // is nothing to backfill.
+    if (!isDbAvailable())
+        return;
+    // Canonical closed vocabulary (complete/done/skipped/closed) — a skipped or
+    // closed slice with a SUMMARY gets the same assessment backfill treatment.
+    for (const sliceId of getClosedSliceIds(mid)) {
         const summaryPath = resolveSliceFile(basePath, mid, sliceId, "SUMMARY");
         if (!summaryPath || !existsSync(summaryPath))
             continue;
@@ -488,7 +475,7 @@ export const DISPATCH_RULES = [
             // deadlock. Deep planning is still user-driven even inside auto-mode,
             // so it must wait for explicit approval instead of taking this bypass.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -526,7 +513,15 @@ export const DISPATCH_RULES = [
             // Transport preflight: verify required MCP tools are actually connected
             // before consuming a retry attempt. Fixes tool-starved sessions burning
             // all MAX_UAT_ATTEMPTS before stopping (#477).
-            const transportError = getWorkflowTransportSupportError(sessionProvider, getRequiredWorkflowToolsForAutoUnit("run-uat"), { projectRoot: basePath, surface: "auto-mode", unitType: "run-uat", authMode: sessionAuthMode, baseUrl: sessionBaseUrl, activeTools });
+            const transportError = getUnitWorkflowDispatchReadinessError({
+                provider: sessionProvider,
+                projectRoot: basePath,
+                surface: "auto-mode",
+                unitType: "run-uat",
+                authMode: sessionAuthMode,
+                baseUrl: sessionBaseUrl,
+                activeTools,
+            });
             if (transportError) {
                 return { action: "stop", reason: transportError, level: "warning" };
             }
@@ -540,6 +535,16 @@ export const DISPATCH_RULES = [
             if (browserToolError) {
                 return { action: "stop", reason: browserToolError, level: "warning" };
             }
+            const browserDaemonError = prepareBrowserDaemonForUat({
+                uatType,
+                sessionProvider,
+                sessionAuthMode,
+                sessionBaseUrl,
+                projectRoot: resolveWorkflowMcpProjectRoot(basePath),
+            });
+            if (browserDaemonError) {
+                return { action: "stop", reason: browserDaemonError, level: "warning" };
+            }
             // Cap run-uat dispatch attempts to prevent infinite replay (#3624).
             // Check before incrementing so an exhausted counter cannot create a
             // no-progress skip loop that starves later dispatch rules.
@@ -569,24 +574,11 @@ export const DISPATCH_RULES = [
             // Only applies when UAT dispatch is enabled
             if (!prefs?.uat_dispatch)
                 return null;
-            // DB-first: prefer closed slices from DB; fall back to ROADMAP on disk.
-            let closedSliceIds;
-            if (isDbAvailable()) {
-                closedSliceIds = getMilestoneSlices(mid)
-                    .filter(s => isClosedStatus(s.status))
-                    .map(s => s.id);
-            }
-            else {
-                // Filesystem fallback for degraded / unmigrated projects.
-                // `slice.done` in the parsed ROADMAP is the disk-level closed signal.
-                const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-                const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
-                if (!roadmapContent)
-                    return null;
-                const roadmap = parseRoadmap(roadmapContent);
-                closedSliceIds = roadmap.slices.filter(s => s.done).map(s => s.id);
-            }
-            for (const sliceId of closedSliceIds) {
+            // DB-authoritative (ADR-017): closed slices come from the DB only; the
+            // ROADMAP projection is never parsed for gate decisions.
+            if (!isDbAvailable())
+                return null;
+            for (const sliceId of getClosedSliceIds(mid)) {
                 const result = await readUatGateVerdict(basePath, mid, sliceId);
                 if (!result)
                     continue;
@@ -641,7 +633,7 @@ export const DISPATCH_RULES = [
             // H6 fix (#4973): keep the non-deep auto-mode bypass, but do not
             // pre-verify deep planning's user-facing milestone approval gate.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -823,7 +815,7 @@ export const DISPATCH_RULES = [
             // H6 fix (#4973): keep the non-deep auto-mode bypass, but do not
             // pre-verify deep planning's user-facing milestone approval gate.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -905,18 +897,18 @@ export const DISPATCH_RULES = [
             // behavior.
             if (await getMilestonePipelineVariant(mid) === "trivial")
                 return null;
-            // Load roadmap to find all slices
-            const roadmapFile = resolveExistingExpectedArtifact("plan-milestone", mid, basePath) ??
-                resolveMilestoneFile(basePath, mid, "ROADMAP");
-            const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
-            if (!roadmapContent)
+            // DB-authoritative slice list (ADR-017): the ROADMAP projection is
+            // never parsed for dispatch decisions. No DB / no rows → skip this rule.
+            if (!isDbAvailable())
+                return null;
+            const dbSlices = getMilestoneSliceSummaries(mid);
+            if (dbSlices.length === 0)
                 return null;
-            const roadmap = parseRoadmap(roadmapContent);
             // Find slices that need research (no RESEARCH file, dependencies done)
             const milestoneResearchFile = resolveExistingExpectedArtifact("research-milestone", mid, basePath) ??
                 resolveMilestoneFile(basePath, mid, "RESEARCH");
             const researchReadySlices = [];
-            for (const slice of roadmap.slices) {
+            for (const slice of dbSlices) {
                 if (slice.done)
                     continue;
                 // Skip S01 when milestone research exists
@@ -926,7 +918,7 @@ export const DISPATCH_RULES = [
                 if (resolveExistingExpectedArtifact("research-slice", `${mid}/${slice.id}`, basePath))
                     continue;
                 // Skip if dependencies aren't done (check for SUMMARY files)
-                const depsComplete = (slice.depends ?? []).every((depId) => !!resolveExistingExpectedArtifact("complete-slice", `${mid}/${depId}`, basePath));
+                const depsComplete = slice.depends.every((depId) => !!resolveExistingExpectedArtifact("complete-slice", `${mid}/${depId}`, basePath));
                 if (!depsComplete)
                     continue;
                 researchReadySlices.push({ id: slice.id, title: slice.title });

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -13,7 +13,7 @@ import { getSessionModelOverride } from "./session-model-override.js";
 import { logWarning } from "./workflow-logger.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { applyModelPolicyFilter } from "./uok/model-policy.js";
-import { isModelBlocked } from "./blocked-models.js";
+import { isModelBlocked, isModelTemporarilyUnavailable } from "./blocked-models.js";
 import { getRequiredWorkflowToolsForAutoUnit, isWorkflowMcpSurfaceTool } from "./workflow-mcp.js";
 /**
  * Thrown when the model-policy gate rejects every candidate model for a unit
@@ -218,6 +218,10 @@ function buildModelPolicyBlockReasons(policyDenyReasons, availableModels, routin
             reason: `configured model(s) did not resolve against policy-eligible registry [${eligibleSummary}]`,
         }];
 }
+function isModelUnavailable(basePath, provider, id) {
+    return isModelBlocked(basePath, provider, id) ||
+        isModelTemporarilyUnavailable(basePath, provider, id);
+}
 function restoreToolBaseline(pi) {
     const key = pi;
     const baseline = TOOL_BASELINE.get(key);
@@ -657,8 +661,8 @@ autoModeStartThinkingLevel) {
             // (issue #4513).  The block is persisted in .gsd/runtime/blocked-models.json
             // so it survives /gsd auto restarts — without this, the same dead model
             // gets reselected after every restart.
-            if (isModelBlocked(basePath, model.provider, model.id)) {
-                ctx.ui.notify(`Skipping blocked model ${model.provider}/${model.id} (provider rejected it for this account).`, "warning");
+            if (isModelUnavailable(basePath, model.provider, model.id)) {
+                ctx.ui.notify(`Skipping unavailable model ${model.provider}/${model.id}.`, "warning");
                 continue;
             }
             // Warn if the ID is ambiguous across providers
@@ -724,7 +728,7 @@ autoModeStartThinkingLevel) {
                 const key = `${model.provider.toLowerCase()}/${model.id.toLowerCase()}`;
                 if (!policyAllowedModelKeys.has(key))
                     continue;
-                if (isModelBlocked(basePath, model.provider, model.id))
+                if (isModelUnavailable(basePath, model.provider, model.id))
                     continue;
                 const ok = await pi.setModel(model, { persist: false });
                 if (!ok)
@@ -746,16 +750,16 @@ autoModeStartThinkingLevel) {
         // No model preference for this unit type — re-apply the model captured
         // at auto-mode start to prevent bleed from shared global settings.json (#650).
         const availableModels = buildModelPolicyCandidates(ctx, autoModeStartModel, effectiveSessionModelOverride);
-        const startBlocked = isModelBlocked(basePath, autoModeStartModel.provider, autoModeStartModel.id);
+        const startBlocked = isModelUnavailable(basePath, autoModeStartModel.provider, autoModeStartModel.id);
         if (startBlocked) {
-            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is blocked for this account. Using current session model instead.`, "warning");
+            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is unavailable. Using current session model instead.`, "warning");
         }
         else {
             const startModel = availableModels.find(m => m.provider === autoModeStartModel.provider && m.id === autoModeStartModel.id);
             if (startModel) {
                 const ok = await pi.setModel(startModel, { persist: false });
                 if (!ok) {
-                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelBlocked(basePath, m.provider, m.id));
+                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelUnavailable(basePath, m.provider, m.id));
                     if (byId) {
                         const fallbackOk = await pi.setModel(byId, { persist: false });
                         if (fallbackOk) {
@@ -839,15 +843,34 @@ export function resolveModelId(modelId, availableModels, currentProvider) {
         if (providerMatch)
             return providerMatch;
     }
-    // Prefer "anthropic" as the canonical provider for Anthropic models.
-    // Transport-specific tiebreaker (ADR-012): intentionally keys on provider,
-    // not api — we want the plain Anthropic transport when multiple are available.
-    const anthropicMatch = candidates.find(m => m.provider === "anthropic");
-    if (anthropicMatch)
-        return anthropicMatch;
+    // Subscription/OAuth routes beat pay-per-token API when the same model ID
+    // exists on multiple providers. Order matters — first match wins.
+    for (const provider of BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE) {
+        const match = candidates.find(m => m.provider === provider);
+        if (match)
+            return match;
+    }
     // Fall back to first non-extension candidate, or any candidate
     return candidates.find(m => !EXTENSION_PROVIDERS.has(m.provider)) ?? candidates[0];
 }
+/**
+ * When a bare model ID exists on multiple providers, prefer subscription/OAuth
+ * routes over pay-per-token API keys. Matches PROVIDER_ROUTES in doctor-providers
+ * but applies when *both* sides are authenticated.
+ *
+ * Order rationale:
+ * - openai-codex before github-copilot: ChatGPT-native for shared GPT IDs
+ * - google-gemini-cli before github-copilot: first-party Gemini CLI
+ * - anthropic before github-copilot: first-party Claude API/OAuth over Copilot
+ * - github-copilot before openai/google: Copilot OAuth over platform API keys
+ */
+export const BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE = [
+    "openai-codex",
+    "google-gemini-cli",
+    "anthropic",
+    "github-copilot",
+    "google-antigravity",
+];
 /**
  * Flat-rate providers charge the same per request regardless of model.
  * Dynamic routing provides no cost benefit — it only degrades quality (#3453).