@opengsd/gsd-pi 1.2.0-dev.4c756166 → 1.2.0-dev.6ccd27b3

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -8,25 +8,27 @@
  * manages create, enter, detect, and teardown for auto-mode worktrees.
  */
 import { existsSync, cpSync, readFileSync, readdirSync, mkdirSync, realpathSync, rmSync, unlinkSync, lstatSync as lstatSyncFn, } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep as pathSep } from "node:path";
+import { dirname, isAbsolute, join, relative } from "node:path";
 import { GSDError, GSD_IO_ERROR, GSD_GIT_ERROR } from "./errors.js";
 import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, getSliceTasks, } from "./gsd-db.js";
 import { closeWorkflowDatabase, getWorkflowDatabasePath, openWorkflowDatabasePath, } from "./db-workspace.js";
 import { execFileSync } from "node:child_process";
 import { gsdRoot, resolveGsdPathContract } from "./paths.js";
-import { createWorktree, removeWorktree, resolveGitDir, worktreePath, isInsideWorktreesDir, } from "./worktree-manager.js";
+import { createWorktree, removeWorktree, worktreePath, isInsideWorktreesDir, } from "./worktree-manager.js";
+import { worktreePathFor } from "./worktree-placement.js";
 import { detectWorktreeName, nudgeGitBranchCache, } from "./worktree.js";
-import { isGsdWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
+import { isGsdWorktreePath, projectRootFromWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
 import { autoResolveSafeConflictPaths } from "./git-conflict-resolve.js";
 import { MergeConflictError, readIntegrationBranch, resolveMilestoneIntegrationBranch, RUNTIME_EXCLUSION_PATHS } from "./git-service.js";
-import { buildPullRequestEvidence, createDraftPullRequestFromEvidence, } from "./pull-request-process.js";
+import { publishMilestone } from "./publication.js";
 import { debugLog } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
+import { checkoutBranchWithStashGuard, cleanupConflictState, gsdJsonlFilesWithConflictMarkers, hasConflictMarkers, popStashByRef, removeMergeStateFiles, stashAlreadyExistsFilesFromError, stashRefFromError, } from "./worktree-git-recovery.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { runWorktreePostCreateHook } from "./worktree-post-create-hook.js";
 import { classifyProject } from "./detection.js";
-import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeMergeRegular, nativeConflictFiles, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeMergeAbort, nativeWorktreeList, nativeLsFiles, } from "./native-git-bridge.js";
+import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeMergeRegular, nativeConflictFiles, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeWorktreeList, nativeLsFiles, } from "./native-git-bridge.js";
 import { CLOSEOUT_CONSISTENCY_BLOCKED_REASON, } from "./closeout-consistency-gate.js";
 import { formatCloseoutProofBlock, proveMilestoneCloseout, } from "./milestone-closeout-proof.js";
 import { gsdHome } from "./gsd-home.js";
@@ -61,111 +63,6 @@ const ROOT_STATE_FILES = [
     // Back-sync (worktree → main) must NEVER overwrite the project root's copy
     // because the project root is authoritative for preferences (#2684).
 ];
-/**
- * Pop a stash entry by tracking the unique marker embedded in its message so
- * concurrent stash operations against the same project root cannot cause us to
- * pop the wrong entry.
- *
- * If `stashMarker` is null or no longer present in the stash list (e.g. a
- * concurrent process popped/dropped it), leaves the stash list untouched and
- * returns null.
- *
- * Throws on pop failure so callers can handle conflict cases the same way
- * they would with the prior `git stash pop` form. When throwing after a
- * targeted pop attempt, the error is annotated with the targeted stash ref.
- *
- * (Issue #4980 HIGH-6)
- */
-function popStashByRef(basePath, stashMarker) {
-    let popArg = null;
-    if (stashMarker) {
-        try {
-            const list = execFileSync("git", ["stash", "list", "--format=%gd%x00%s"], {
-                cwd: basePath,
-                stdio: ["ignore", "pipe", "pipe"],
-                encoding: "utf-8",
-            }).trim().split("\n").filter(Boolean);
-            for (const entry of list) {
-                const [ref, subject] = entry.split("\0");
-                if (ref && subject?.includes(stashMarker)) {
-                    popArg = ref;
-                    break;
-                }
-            }
-        }
-        catch (err) {
-            logWarning("worktree", `stash list lookup failed; leaving stash untouched: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    if (!popArg) {
-        logWarning("worktree", "recorded stash entry could not be resolved; skipping automatic pop");
-        return null;
-    }
-    try {
-        execFileSync("git", ["stash", "pop", popArg], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-    }
-    catch (err) {
-        if (err && typeof err === "object") {
-            err.stashRef = popArg;
-        }
-        throw err;
-    }
-    return popArg;
-}
-/**
- * Extract a stash ref annotation injected by popStashByRef() when git stash
- * pop fails and we need to conditionally drop the exact stash entry later.
- */
-function stashRefFromError(err) {
-    if (!err || typeof err !== "object")
-        return null;
-    const stashRef = err.stashRef;
-    return typeof stashRef === "string" && stashRef.length > 0 ? stashRef : null;
-}
-function stashAlreadyExistsFilesFromError(err) {
-    if (!err || typeof err !== "object")
-        return [];
-    const stderr = err.stderr;
-    const stderrText = typeof stderr === "string"
-        ? stderr
-        : stderr instanceof Uint8Array
-            ? Buffer.from(stderr).toString("utf-8")
-            : "";
-    const message = err instanceof Error ? err.message : String(err);
-    const text = `${stderrText}\n${message}`;
-    const files = new Set();
-    for (const line of text.split("\n")) {
-        const m = line.match(/^(.*?)\s+already exists, no checkout\s*$/i);
-        if (!m)
-            continue;
-        const filePath = m[1]?.trim();
-        if (filePath)
-            files.add(filePath);
-    }
-    return [...files];
-}
-/**
- * Detect whether an on-disk file still contains unresolved merge conflict
- * markers from a failed stash-pop or merge attempt.
- *
- * Returns false when the file cannot be read.
- */
-function hasConflictMarkers(filePath) {
-    try {
-        const content = readFileSync(filePath, "utf-8");
-        return content.includes("<<<<<<<") && content.includes("=======") && content.includes(">>>>>>>");
-    }
-    catch {
-        return false;
-    }
-}
-function gsdJsonlFilesWithConflictMarkers(basePath) {
-    return nativeLsFiles(basePath, ".gsd/*.jsonl").filter((f) => hasConflictMarkers(join(basePath, f)));
-}
 /**
  * Check if two filesystem paths resolve to the same real location.
  * Returns false if either path cannot be resolved (e.g. doesn't exist).
@@ -286,19 +183,6 @@ function gitPathspecForWorktreePath(basePath, targetPath) {
 export function _gitPathspecForWorktreePath(basePath, targetPath) {
     return gitPathspecForWorktreePath(basePath, targetPath);
 }
-function gitRemoteExists(basePath, remote) {
-    try {
-        execFileSync("git", ["remote", "get-url", remote], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 function findRegularMergeChangedPaths(basePath, milestoneBranch, mainBranch) {
     const changedPaths = new Set();
     let mergeLog = "";
@@ -421,51 +305,6 @@ export const SAFE_AUTO_RESOLVE_PATTERNS = [
  * Covers `.gsd/` state files and common build artifacts. */
 export const isSafeToAutoResolve = (filePath) => filePath.startsWith(".gsd/") ||
     SAFE_AUTO_RESOLVE_PATTERNS.some((re) => re.test(filePath));
-function removeMergeStateFiles(basePath, contextLabel) {
-    try {
-        for (const f of ["SQUASH_MSG", "MERGE_MSG", "MERGE_MODE", "MERGE_HEAD", "AUTO_MERGE"]) {
-            const rawPath = execFileSync("git", ["rev-parse", "--git-path", f], {
-                cwd: basePath,
-                stdio: ["ignore", "pipe", "pipe"],
-                encoding: "utf-8",
-            }).trim();
-            const p = rawPath.length > 0
-                ? (isAbsolute(rawPath) ? rawPath : resolve(basePath, rawPath))
-                : join(resolveGitDir(basePath), f);
-            if (existsSync(p))
-                unlinkSync(p);
-        }
-    }
-    catch (err) {
-        logError("worktree", `${contextLabel} merge state cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-function cleanupConflictState(basePath) {
-    // Merge conflicts can leave unmerged index entries; merge-abort alone is not
-    // enough for squash merges (MERGE_HEAD is never written). Reset the merge
-    // index, then remove merge message files that native/libgit2 paths may have
-    // created.
-    try {
-        nativeMergeAbort(basePath);
-    }
-    catch (err) {
-        // MERGE_HEAD absent (squash merge path) — abort is a no-op, which is fine.
-        debugLog("conflict-cleanup:merge-abort-skipped", {
-            error: err instanceof Error ? err.message : String(err),
-        });
-    }
-    try {
-        execFileSync("git", ["reset", "--merge"], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-    }
-    catch (err) {
-        logError("worktree", `git reset --merge failed after merge conflict: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    removeMergeStateFiles(basePath, "conflict");
-}
 // ─── Dispatch-Level Sync (project root ↔ worktree) ──────────────────────────
 /**
  * Sync milestone artifacts from project root INTO worktree before deriveState.
@@ -539,19 +378,9 @@ export function checkResourcesStale(versionOnStart) {
  * Returns the corrected base path.
  */
 export function escapeStaleWorktree(base) {
-    // Direct layout: /.gsd/worktrees/
-    const directMarker = `${pathSep}.gsd${pathSep}worktrees${pathSep}`;
-    let idx = base.indexOf(directMarker);
-    if (idx === -1) {
-        // Symlink-resolved layout: /.gsd/projects/<hash>/worktrees/
-        const symlinkRe = new RegExp(`\\${pathSep}\\.gsd\\${pathSep}projects\\${pathSep}[a-f0-9]+\\${pathSep}worktrees\\${pathSep}`);
-        const match = base.match(symlinkRe);
-        if (!match || match.index === undefined)
-            return base;
-        idx = match.index;
-    }
-    // base is inside .gsd/worktrees/<something> — extract the project root
-    const projectRoot = base.slice(0, idx);
+    const projectRoot = projectRootFromWorktreePath(base);
+    if (projectRoot === null)
+        return base;
     // Guard: If the candidate project root's .gsd IS the user-level ~/.gsd,
     // the string-slice heuristic matched the wrong /.gsd/ boundary. This happens
     // when .gsd is a symlink into ~/.gsd/projects/<hash> and process.cwd()
@@ -908,109 +737,6 @@ export function enterBranchModeForMilestone(basePath, milestoneId) {
     }
     checkoutBranchWithStashGuard(basePath, branch, `enter-branch-mode:${milestoneId}`);
 }
-export function checkoutBranchWithStashGuard(basePath, branch, reason) {
-    let stashMarker = null;
-    let stashed = false;
-    const status = nativeWorkingTreeStatus(basePath).trim();
-    if (status.length > 0) {
-        stashMarker = `gsd-checkout-stash:${reason}:${process.pid}:${Date.now()}:${process.hrtime.bigint().toString(36)}`;
-        const stashListBefore = execFileSync("git", ["stash", "list"], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd: checkout stash [${stashMarker}]`], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        const stashListAfter = execFileSync("git", ["stash", "list"], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        stashed = stashListAfter !== stashListBefore;
-    }
-    // Checkout and stash-restore are split so we can distinguish two failure
-    // modes: (a) checkout failed → HEAD did not move, restore stash and rethrow;
-    // (b) checkout succeeded but stash pop failed → HEAD moved to `branch` but
-    // the working-tree changes remain in the stash list. We surface a distinct
-    // error in case (b) so callers don't assume the branch switch was rolled back.
-    try {
-        nativeCheckoutBranch(basePath, branch);
-    }
-    catch (checkoutErr) {
-        if (stashed) {
-            try {
-                popStashByRef(basePath, stashMarker);
-            }
-            catch (restoreErr) {
-                logWarning("worktree", `git stash pop failed during checkout restore: ${restoreErr instanceof Error ? restoreErr.message : String(restoreErr)}`);
-            }
-        }
-        throw checkoutErr;
-    }
-    if (stashed) {
-        try {
-            popStashByRef(basePath, stashMarker);
-        }
-        catch (popErr) {
-            const msg = popErr instanceof Error ? popErr.message : String(popErr);
-            const stderr = popErr && typeof popErr === "object"
-                ? popErr.stderr
-                : undefined;
-            const stderrText = typeof stderr === "string"
-                ? stderr
-                : stderr instanceof Uint8Array
-                    ? Buffer.from(stderr).toString("utf-8")
-                    : "";
-            const stashPopMessage = `${stderrText}\n${msg}`.trim();
-            const alreadyExists = stashAlreadyExistsFilesFromError(popErr);
-            const gsdAlreadyExists = alreadyExists.filter((f) => f.startsWith(".gsd/"));
-            const nonGsdAlreadyExists = alreadyExists.filter((f) => !f.startsWith(".gsd/"));
-            const isUntrackedRestoreFailure = stashPopMessage.includes("could not restore untracked files from stash");
-            const stashRefForDrop = stashRefFromError(popErr);
-            const nonGsdUnmerged = nativeConflictFiles(basePath).filter((f) => !f.startsWith(".gsd/"));
-            const gsdContentConflicts = isUntrackedRestoreFailure
-                ? gsdJsonlFilesWithConflictMarkers(basePath)
-                : [];
-            const gsdConflictFiles = [...new Set([...gsdAlreadyExists, ...gsdContentConflicts])];
-            if (isUntrackedRestoreFailure &&
-                gsdConflictFiles.length > 0 &&
-                nonGsdAlreadyExists.length === 0 &&
-                nonGsdUnmerged.length === 0) {
-                for (const f of gsdConflictFiles) {
-                    execFileSync("git", ["checkout", "HEAD", "--", f], {
-                        cwd: basePath,
-                        stdio: ["ignore", "pipe", "pipe"],
-                        encoding: "utf-8",
-                    });
-                    nativeAddPaths(basePath, [f]);
-                }
-                if (stashRefForDrop) {
-                    try {
-                        execFileSync("git", ["stash", "drop", stashRefForDrop], {
-                            cwd: basePath,
-                            stdio: ["ignore", "pipe", "pipe"],
-                            encoding: "utf-8",
-                        });
-                    }
-                    catch (err) { /* stash may already be consumed */
-                        logWarning("worktree", `git stash drop failed: ${err instanceof Error ? err.message : String(err)}`);
-                    }
-                }
-                else {
-                    logWarning("worktree", "recorded stash entry could not be resolved; skipping automatic drop");
-                }
-                return;
-            }
-            const wrapped = new Error(`checkout to '${branch}' succeeded but stash restore failed; working tree changes remain in the stash list. Original error: ${msg}`);
-            if (stashRefForDrop)
-                wrapped.stashRef = stashRefForDrop;
-            throw wrapped;
-        }
-    }
-}
 // ─── Public API ────────────────────────────────────────────────────────────
 /**
  * Create a new auto-worktree for a milestone, chdir into it, and store
@@ -1074,6 +800,14 @@ function _resolveIntegrationBranchForReuse(basePath, milestoneId) {
         return null;
     }
 }
+function safeCwd(fallback) {
+    try {
+        return process.cwd();
+    }
+    catch {
+        return fallback;
+    }
+}
 /**
  * When reusing an existing milestone branch, fast-forward it onto the
  * integration branch when that's safe (branch is a strict ancestor of
@@ -1223,7 +957,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
     originalBasePath = resolveWorktreeProjectRoot(originalBasePath);
     const branch = autoWorktreeBranch(milestoneId);
     const { preserveBranch = false, preserveWorktree = false } = opts;
-    const previousCwd = process.cwd();
+    const previousCwd = safeCwd(originalBasePath);
     // Wrap the entire teardown body in a single try/finally so activeWorkspace
     // is ALWAYS cleared — even if process.chdir throws (e.g. originalBasePath
     // was deleted before teardown ran). Previously the finally only covered
@@ -1307,7 +1041,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
  * still works after process restart when module state has been reset.
  */
 export function isInAutoWorktree(basePath) {
-    const targetPath = isGsdWorktreePath(basePath) ? basePath : process.cwd();
+    const targetPath = isGsdWorktreePath(basePath) ? basePath : safeCwd("");
     if (!isGsdWorktreePath(targetPath))
         return false;
     const storedBase = getAutoWorktreeOriginalBase();
@@ -1335,7 +1069,9 @@ export function isInAutoWorktree(basePath) {
  */
 export function getAutoWorktreePath(basePath, milestoneId) {
     basePath = resolveWorktreeProjectRoot(basePath);
-    const p = worktreePath(basePath, milestoneId);
+    // basePath is already the resolved project root — go straight to placement
+    // instead of worktreePath(), which would re-resolve the root.
+    const p = worktreePathFor(basePath, milestoneId);
     if (!existsSync(p))
         return null;
     // Validate this is a real git worktree, not a stray directory.
@@ -1995,8 +1731,6 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             const isUntrackedRestoreFailure = stashPopMessage.includes("could not restore untracked files from stash");
             const gsdContentConflicts = [];
             const alreadyExists = stashAlreadyExistsFilesFromError(e);
-            const gsdAlreadyExists = alreadyExists.filter((f) => f.startsWith(".gsd/"));
-            const nonGsdAlreadyExists = alreadyExists.filter((f) => !f.startsWith(".gsd/"));
             // Untracked-file restore failures can leave marker conflicts in tracked
             // .gsd JSONL files without producing `U` status entries.
             if (isUntrackedRestoreFailure) {
@@ -2057,10 +1791,11 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             }
             else if (gsdUU.length === 0 &&
                 nonGsdUU.length === 0 &&
-                gsdAlreadyExists.length > 0 &&
-                nonGsdAlreadyExists.length === 0) {
-                // Untracked-file restore failure from stash pop where all collided
-                // paths are .gsd/ artifacts that already exist after merge.
+                alreadyExists.length > 0) {
+                // Untracked-file restore failure from stash pop where all collided paths
+                // already exist after merge (committed on target). Safe to drop the stash
+                // for the full alreadyExists set — they were untracked on source by
+                // definition of the "already exists, no checkout" failure.
                 if (stashRefForDrop) {
                     try {
                         execFileSync("git", ["stash", "drop", stashRefForDrop], {
@@ -2083,11 +1818,6 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
                     files: nonGsdUU.join(", "),
                 });
             }
-            else if (nonGsdAlreadyExists.length > 0) {
-                logWarning("reconcile", "Stash pop restore collision on non-.gsd files after merge", {
-                    files: nonGsdAlreadyExists.join(", "),
-                });
-            }
             else {
                 logWarning("worktree", "git stash pop failed without resolvable conflict files; leaving stash for manual recovery");
             }
@@ -2179,66 +1909,32 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         }
         catch (err) {
             logWarning("worktree", `chdir to project root after merge failed: ${err instanceof Error ? err.message : String(err)}`);
+            debugLog("mergeMilestoneToMain", {
+                phase: "post-merge-chdir-failed",
+                target: originalBasePath_,
+                error: err instanceof Error ? err.message : String(err),
+            });
         }
     };
     let shouldCleanup = false;
-    let pushed = false;
-    let prCreated = false;
     try {
-        // 10. Auto-push if enabled
-        if (prefs.auto_push === true && prefs.auto_pr !== true && !nothingToCommit) {
-            const remote = prefs.remote ?? "origin";
-            if (gitRemoteExists(originalBasePath_, remote)) {
-                try {
-                    execFileSync("git", ["push", remote, mainBranch], {
-                        cwd: originalBasePath_,
-                        stdio: ["ignore", "pipe", "pipe"],
-                        encoding: "utf-8",
-                    });
-                    pushed = true;
-                }
-                catch (err) {
-                    // Push failure is non-fatal
-                    logWarning("worktree", `git push failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-        // 9b. Auto-create PR if enabled (#2302: no longer gated on pushed/auto_push)
-        if (prefs.auto_pr === true && !nothingToCommit) {
-            const remote = prefs.remote ?? "origin";
-            const prTarget = prefs.pr_target_branch ?? mainBranch;
-            if (gitRemoteExists(originalBasePath_, remote)) {
-                try {
-                    // Push the milestone branch to remote first
-                    execFileSync("git", ["push", remote, milestoneBranch], {
-                        cwd: originalBasePath_,
-                        stdio: ["ignore", "pipe", "pipe"],
-                        encoding: "utf-8",
-                    });
-                    const prEvidence = buildPullRequestEvidence({
-                        milestoneId,
-                        milestoneTitle,
-                        changeType: "feat",
-                        summaries: completedSlices.map((slice) => `### ${slice.id}\n${slice.title}`),
-                        testsRun: ["Auto-created after milestone merge. Run `npm run verify:merge` before marking this draft ready."],
-                        rollbackNotes: ["Close the draft PR or revert the merge commit if review finds a behavior regression."],
-                        how: "Generated by git.auto_pr after the milestone branch was pushed and merged locally.",
-                    });
-                    const prUrl = createDraftPullRequestFromEvidence(originalBasePath_, milestoneId, prEvidence, {
-                        head: milestoneBranch,
-                        base: prTarget,
-                    });
-                    if (!prUrl) {
-                        throw new Error("gh pr create returned no URL");
-                    }
-                    prCreated = true;
-                }
-                catch (err) {
-                    // PR creation failure is non-fatal — gh may not be installed or authenticated
-                    logWarning("worktree", `PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
+        // 10/9b. Publication (auto-push / draft PR) — Publication module seam (ADR-034).
+        const publication = publishMilestone({
+            basePath: originalBasePath_,
+            milestoneId,
+            milestoneTitle,
+            integrationBranch: mainBranch,
+            milestoneBranch,
+            sliceSummaries: completedSlices.map((slice) => `### ${slice.id}\n${slice.title}`),
+            nothingToCommit,
+            prefs: {
+                autoPush: prefs.auto_push === true,
+                autoPr: prefs.auto_pr === true,
+                remote: prefs.remote,
+                prTargetBranch: prefs.pr_target_branch,
+            },
+        });
+        const { pushed, prCreated } = publication;
         // 11. Guard removed — step 9b (#1792) now handles this with a smarter check:
         //     throws only when the milestone has unanchored code changes, passes
         //     through when the code is genuinely already on the integration branch.

package/dist/resources/extensions/gsd/auto.js

@@ -25,7 +25,7 @@ import { clearActivityLogState } from "./activity-log.js";
 import { synthesizeCrashRecovery, getDeepDiagnostic, readActiveMilestoneId, } from "./session-forensics.js";
 import { writeLock, clearLock, clearStaleWorkerLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, emitOpenUnitEndForUnit, } from "./crash-recovery.js";
 import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
-import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, } from "./preferences.js";
+import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, resolveEffectiveUnitIsolationMode, } from "./preferences.js";
 import { playNotificationBell, sendDesktopNotification } from "./notifications.js";
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, resolveCompactionThresholdPercent, shouldRerootStepSessionForContext, } from "./auto-budget.js";
 import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, isDeterministicPolicyError, } from "./auto-tool-tracking.js";
@@ -117,6 +117,7 @@ import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { registerAutoWorker, markWorkerStopping, } from "./db/auto-workers.js";
 import { releaseMilestoneLease } from "./db/milestone-leases.js";
 import { normalizeRealPath } from "./paths.js";
+import { formatStopNoticePrefix, isBlockedStopReason, stopNoticeDisplayReason, } from "./stop-notice.js";
 // ── ENCAPSULATION INVARIANT ─────────────────────────────────────────────────
 // ALL mutable auto-mode state lives in the AutoSession class (auto/session.ts).
 // This file must NOT declare module-level `let` or `var` variables for state.
@@ -137,17 +138,7 @@ export function formatAutoStopNotification(prefix, totals, unitCount) {
         `Session: ${formatCost(totals.cost)} · ${formatTokenCount(totals.tokens.total)} tokens · ${unitCount} units`,
     ].join("\n");
 }
-function isBlockedStopReason(reason) {
-    return /^Blocked:\s*/i.test(reason ?? "");
-}
-function formatAutoStopDisplayReason(reason) {
-    return (reason ?? "").replace(/^Blocked:\s*/i, "").trim();
-}
-export function formatAutoStopNotificationPrefix(reason) {
-    const displayReason = formatAutoStopDisplayReason(reason);
-    const prefix = isBlockedStopReason(reason) ? "Auto-mode blocked" : "Auto-mode stopped";
-    return displayReason ? `${prefix} — ${displayReason}` : prefix;
-}
+export { formatStopNoticePrefix as formatAutoStopNotificationPrefix } from "./stop-notice.js";
 function clearSessionModelOverrideForCommandSession(ctx) {
     const sessionId = s.cmdCtx?.sessionManager?.getSessionId?.() ??
         ctx?.sessionManager?.getSessionId?.();
@@ -346,14 +337,11 @@ export function startAutoDetached(ctx, pi, base, verboseMode, options) {
 export function shouldUseWorktreeIsolation(basePath) {
     return getIsolationMode(basePath) === "worktree";
 }
-function resolveEffectiveUnitIsolationMode(configuredMode, isolationDegraded) {
-    return configuredMode === "worktree" && isolationDegraded ? "branch" : configuredMode;
-}
-export function _resolveEffectiveUnitIsolationModeForTest(configuredMode, isolationDegraded) {
-    return resolveEffectiveUnitIsolationMode(configuredMode, isolationDegraded);
+export function _resolveEffectiveUnitIsolationModeForTest(configuredMode, isolationDegraded, strandedRecoveryIsolationMode = null) {
+    return resolveEffectiveUnitIsolationMode(configuredMode, isolationDegraded, strandedRecoveryIsolationMode);
 }
 function getEffectiveUnitIsolationMode(basePath) {
-    return resolveEffectiveUnitIsolationMode(getIsolationMode(basePath), s.isolationDegraded);
+    return resolveEffectiveUnitIsolationMode(getIsolationMode(basePath), s.isolationDegraded, s.strandedRecoveryIsolationMode);
 }
 /** Crash recovery prompt — set by startAuto, consumed by the main loop */
 /** Pending verification retry — set when gate fails with retries remaining, consumed by autoLoop */
@@ -569,6 +557,13 @@ export function getAutoModeStartModel() {
 export function setCurrentDispatchedModelId(model) {
     s.currentDispatchedModelId = model ? `${model.provider}/${model.id}` : null;
 }
+/**
+ * Update the active unit model after runtime recovery switches models mid-unit.
+ * The next session restore path reads this field before dispatching again.
+ */
+export function setCurrentUnitModelForRecovery(model) {
+    s.currentUnitModel = model;
+}
 // Tool tracking — delegates to auto-tool-tracking.ts
 export function markToolStart(toolCallId, toolName) {
     _markToolStart(toolCallId, s.active, toolName);
@@ -635,6 +630,35 @@ export function stopAutoRemote(projectRoot) {
         return { found: false, error: err.message };
     }
 }
+/**
+ * Force-stop a remote auto-mode session before stealing its lock.
+ * The normal stop path stays SIGTERM-only so cooperative sessions can clean up;
+ * this path is only for the explicit "Force start" action.
+ */
+export function forceStopAutoRemote(projectRoot) {
+    const lock = readCrashLock(projectRoot);
+    if (!lock)
+        return { found: false };
+    if (lock.pid === process.pid) {
+        clearLock(projectRoot);
+        return { found: false };
+    }
+    if (!isLockProcessAlive(lock)) {
+        clearLock(projectRoot);
+        return { found: false };
+    }
+    try {
+        process.kill(lock.pid, "SIGTERM");
+        if (isLockProcessAlive(lock)) {
+            process.kill(lock.pid, "SIGKILL");
+        }
+        clearLock(projectRoot);
+        return { found: true, pid: lock.pid };
+    }
+    catch (err) {
+        return { found: false, error: err.message };
+    }
+}
 /**
  * Check if a remote auto-mode session is running (from a different process).
  * Reads the crash lock, checks PID liveness, and returns session details.
@@ -727,6 +751,9 @@ function pauseAutoUnitIdentityMatches(expected) {
         s.currentUnit.id === expected.id &&
         s.currentUnit.startedAt === expected.startedAt;
 }
+function shouldPreserveCoordinationForPause(errorContext) {
+    return errorContext?.category === "provider" && errorContext.isTransient === true;
+}
 function setLifecycleOutcome(ctx, input) {
     if (!ctx?.hasUI)
         return;
@@ -993,8 +1020,8 @@ export async function stopAuto(ctx, pi, reason, options = {}) {
     if (!s.active && !s.paused)
         return;
     const loadedPreferences = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences;
-    const stopNotificationPrefix = formatAutoStopNotificationPrefix(reason);
-    const displayReason = formatAutoStopDisplayReason(reason);
+    const stopNotificationPrefix = formatStopNoticePrefix(reason);
+    const displayReason = stopNoticeDisplayReason(reason);
     const isHeadlessStop = process.env.GSD_HEADLESS === "1";
     const completionStopRequested = Boolean(options.completionWidget);
     const preserveCloseoutTranscript = !isHeadlessStop && (options.preserveCloseoutTranscript ?? completionStopRequested);
@@ -1561,7 +1588,7 @@ export async function pauseAuto(ctx, _pi, _errorContext, options = {}) {
         releaseSessionLock(lockBase());
         clearLock(lockBase());
     }
-    if (s.workerId) {
+    if (s.workerId && !shouldPreserveCoordinationForPause(_errorContext)) {
         try {
             if (s.currentMilestoneId && s.milestoneLeaseToken) {
                 releaseMilestoneLease(s.workerId, s.currentMilestoneId, s.milestoneLeaseToken);
@@ -1836,7 +1863,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     if (freshStartAssessment.classification === "running") {
         const pid = freshStartAssessment.lock?.pid;
         ctx.ui.notify(pid
-            ? `Another auto-mode session (PID ${pid}) appears to be running.\nStop it with \`kill ${pid}\` before starting a new session.`
+            ? `Another auto-mode session (PID ${pid}) appears to be running.\nRun \`/gsd stop\` for graceful shutdown, or choose "Force start" from \`/gsd auto\` to terminate it.`
             : "Another auto-mode session appears to be running.", "error");
         return;
     }