@opengsd/gsd-pi 1.2.0-dev.955e4da0 → 1.2.0-dev.a6376d75

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -15,16 +15,15 @@ import { closeWorkflowDatabase, getWorkflowDatabasePath, openWorkflowDatabasePat
 import { execFileSync } from "node:child_process";
 import { gsdRoot, resolveGsdPathContract } from "./paths.js";
 import { createWorktree, removeWorktree, worktreePath, isInsideWorktreesDir, } from "./worktree-manager.js";
+import { worktreePathFor } from "./worktree-placement.js";
 import { detectWorktreeName, nudgeGitBranchCache, } from "./worktree.js";
-import { findWorktreeSegment, isGsdWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
+import { isGsdWorktreePath, projectRootFromWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
 import { autoResolveSafeConflictPaths } from "./git-conflict-resolve.js";
 import { MergeConflictError, readIntegrationBranch, resolveMilestoneIntegrationBranch, RUNTIME_EXCLUSION_PATHS } from "./git-service.js";
-import { buildPullRequestEvidence, createDraftPullRequestFromEvidence, } from "./pull-request-process.js";
+import { publishMilestone } from "./publication.js";
 import { debugLog } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { checkoutBranchWithStashGuard, cleanupConflictState, gsdJsonlFilesWithConflictMarkers, hasConflictMarkers, popStashByRef, removeMergeStateFiles, stashAlreadyExistsFilesFromError, stashRefFromError, } from "./worktree-git-recovery.js";
-// Re-export for existing callers/tests (auto-start.ts, checkout-branch-stash-guard.test.ts).
-export { checkoutBranchWithStashGuard } from "./worktree-git-recovery.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { runWorktreePostCreateHook } from "./worktree-post-create-hook.js";
@@ -184,19 +183,6 @@ function gitPathspecForWorktreePath(basePath, targetPath) {
 export function _gitPathspecForWorktreePath(basePath, targetPath) {
     return gitPathspecForWorktreePath(basePath, targetPath);
 }
-function gitRemoteExists(basePath, remote) {
-    try {
-        execFileSync("git", ["remote", "get-url", remote], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 function findRegularMergeChangedPaths(basePath, milestoneBranch, mainBranch) {
     const changedPaths = new Set();
     let mergeLog = "";
@@ -392,12 +378,9 @@ export function checkResourcesStale(versionOnStart) {
  * Returns the corrected base path.
  */
 export function escapeStaleWorktree(base) {
-    const segment = findWorktreeSegment(base.replaceAll("\\", "/"));
-    if (!segment)
+    const projectRoot = projectRootFromWorktreePath(base);
+    if (projectRoot === null)
         return base;
-    // base is inside .gsd/worktrees/<something> — extract the project root.
-    // Normalization is 1:1 on characters, so the segment index is valid in `base`.
-    const projectRoot = base.slice(0, segment.gsdIdx);
     // Guard: If the candidate project root's .gsd IS the user-level ~/.gsd,
     // the string-slice heuristic matched the wrong /.gsd/ boundary. This happens
     // when .gsd is a symlink into ~/.gsd/projects/<hash> and process.cwd()
@@ -817,6 +800,14 @@ function _resolveIntegrationBranchForReuse(basePath, milestoneId) {
         return null;
     }
 }
+function safeCwd(fallback) {
+    try {
+        return process.cwd();
+    }
+    catch {
+        return fallback;
+    }
+}
 /**
  * When reusing an existing milestone branch, fast-forward it onto the
  * integration branch when that's safe (branch is a strict ancestor of
@@ -966,7 +957,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
     originalBasePath = resolveWorktreeProjectRoot(originalBasePath);
     const branch = autoWorktreeBranch(milestoneId);
     const { preserveBranch = false, preserveWorktree = false } = opts;
-    const previousCwd = process.cwd();
+    const previousCwd = safeCwd(originalBasePath);
     // Wrap the entire teardown body in a single try/finally so activeWorkspace
     // is ALWAYS cleared — even if process.chdir throws (e.g. originalBasePath
     // was deleted before teardown ran). Previously the finally only covered
@@ -1050,7 +1041,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
  * still works after process restart when module state has been reset.
  */
 export function isInAutoWorktree(basePath) {
-    const targetPath = isGsdWorktreePath(basePath) ? basePath : process.cwd();
+    const targetPath = isGsdWorktreePath(basePath) ? basePath : safeCwd("");
     if (!isGsdWorktreePath(targetPath))
         return false;
     const storedBase = getAutoWorktreeOriginalBase();
@@ -1078,7 +1069,9 @@ export function isInAutoWorktree(basePath) {
  */
 export function getAutoWorktreePath(basePath, milestoneId) {
     basePath = resolveWorktreeProjectRoot(basePath);
-    const p = worktreePath(basePath, milestoneId);
+    // basePath is already the resolved project root — go straight to placement
+    // instead of worktreePath(), which would re-resolve the root.
+    const p = worktreePathFor(basePath, milestoneId);
     if (!existsSync(p))
         return null;
     // Validate this is a real git worktree, not a stray directory.
@@ -1738,8 +1731,6 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             const isUntrackedRestoreFailure = stashPopMessage.includes("could not restore untracked files from stash");
             const gsdContentConflicts = [];
             const alreadyExists = stashAlreadyExistsFilesFromError(e);
-            const gsdAlreadyExists = alreadyExists.filter((f) => f.startsWith(".gsd/"));
-            const nonGsdAlreadyExists = alreadyExists.filter((f) => !f.startsWith(".gsd/"));
             // Untracked-file restore failures can leave marker conflicts in tracked
             // .gsd JSONL files without producing `U` status entries.
             if (isUntrackedRestoreFailure) {
@@ -1800,10 +1791,11 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             }
             else if (gsdUU.length === 0 &&
                 nonGsdUU.length === 0 &&
-                gsdAlreadyExists.length > 0 &&
-                nonGsdAlreadyExists.length === 0) {
-                // Untracked-file restore failure from stash pop where all collided
-                // paths are .gsd/ artifacts that already exist after merge.
+                alreadyExists.length > 0) {
+                // Untracked-file restore failure from stash pop where all collided paths
+                // already exist after merge (committed on target). Safe to drop the stash
+                // for the full alreadyExists set — they were untracked on source by
+                // definition of the "already exists, no checkout" failure.
                 if (stashRefForDrop) {
                     try {
                         execFileSync("git", ["stash", "drop", stashRefForDrop], {
@@ -1826,11 +1818,6 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
                     files: nonGsdUU.join(", "),
                 });
             }
-            else if (nonGsdAlreadyExists.length > 0) {
-                logWarning("reconcile", "Stash pop restore collision on non-.gsd files after merge", {
-                    files: nonGsdAlreadyExists.join(", "),
-                });
-            }
             else {
                 logWarning("worktree", "git stash pop failed without resolvable conflict files; leaving stash for manual recovery");
             }
@@ -1922,66 +1909,32 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         }
         catch (err) {
             logWarning("worktree", `chdir to project root after merge failed: ${err instanceof Error ? err.message : String(err)}`);
+            debugLog("mergeMilestoneToMain", {
+                phase: "post-merge-chdir-failed",
+                target: originalBasePath_,
+                error: err instanceof Error ? err.message : String(err),
+            });
         }
     };
     let shouldCleanup = false;
-    let pushed = false;
-    let prCreated = false;
     try {
-        // 10. Auto-push if enabled
-        if (prefs.auto_push === true && prefs.auto_pr !== true && !nothingToCommit) {
-            const remote = prefs.remote ?? "origin";
-            if (gitRemoteExists(originalBasePath_, remote)) {
-                try {
-                    execFileSync("git", ["push", remote, mainBranch], {
-                        cwd: originalBasePath_,
-                        stdio: ["ignore", "pipe", "pipe"],
-                        encoding: "utf-8",
-                    });
-                    pushed = true;
-                }
-                catch (err) {
-                    // Push failure is non-fatal
-                    logWarning("worktree", `git push failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-        // 9b. Auto-create PR if enabled (#2302: no longer gated on pushed/auto_push)
-        if (prefs.auto_pr === true && !nothingToCommit) {
-            const remote = prefs.remote ?? "origin";
-            const prTarget = prefs.pr_target_branch ?? mainBranch;
-            if (gitRemoteExists(originalBasePath_, remote)) {
-                try {
-                    // Push the milestone branch to remote first
-                    execFileSync("git", ["push", remote, milestoneBranch], {
-                        cwd: originalBasePath_,
-                        stdio: ["ignore", "pipe", "pipe"],
-                        encoding: "utf-8",
-                    });
-                    const prEvidence = buildPullRequestEvidence({
-                        milestoneId,
-                        milestoneTitle,
-                        changeType: "feat",
-                        summaries: completedSlices.map((slice) => `### ${slice.id}\n${slice.title}`),
-                        testsRun: ["Auto-created after milestone merge. Run `npm run verify:merge` before marking this draft ready."],
-                        rollbackNotes: ["Close the draft PR or revert the merge commit if review finds a behavior regression."],
-                        how: "Generated by git.auto_pr after the milestone branch was pushed and merged locally.",
-                    });
-                    const prUrl = createDraftPullRequestFromEvidence(originalBasePath_, milestoneId, prEvidence, {
-                        head: milestoneBranch,
-                        base: prTarget,
-                    });
-                    if (!prUrl) {
-                        throw new Error("gh pr create returned no URL");
-                    }
-                    prCreated = true;
-                }
-                catch (err) {
-                    // PR creation failure is non-fatal — gh may not be installed or authenticated
-                    logWarning("worktree", `PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
+        // 10/9b. Publication (auto-push / draft PR) — Publication module seam (ADR-034).
+        const publication = publishMilestone({
+            basePath: originalBasePath_,
+            milestoneId,
+            milestoneTitle,
+            integrationBranch: mainBranch,
+            milestoneBranch,
+            sliceSummaries: completedSlices.map((slice) => `### ${slice.id}\n${slice.title}`),
+            nothingToCommit,
+            prefs: {
+                autoPush: prefs.auto_push === true,
+                autoPr: prefs.auto_pr === true,
+                remote: prefs.remote,
+                prTargetBranch: prefs.pr_target_branch,
+            },
+        });
+        const { pushed, prCreated } = publication;
         // 11. Guard removed — step 9b (#1792) now handles this with a smarter check:
         //     throws only when the milestone has unanchored code changes, passes
         //     through when the code is genuinely already on the integration branch.

package/dist/resources/extensions/gsd/auto.js

@@ -117,6 +117,7 @@ import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { registerAutoWorker, markWorkerStopping, } from "./db/auto-workers.js";
 import { releaseMilestoneLease } from "./db/milestone-leases.js";
 import { normalizeRealPath } from "./paths.js";
+import { formatStopNoticePrefix, isBlockedStopReason, stopNoticeDisplayReason, } from "./stop-notice.js";
 // ── ENCAPSULATION INVARIANT ─────────────────────────────────────────────────
 // ALL mutable auto-mode state lives in the AutoSession class (auto/session.ts).
 // This file must NOT declare module-level `let` or `var` variables for state.
@@ -137,17 +138,7 @@ export function formatAutoStopNotification(prefix, totals, unitCount) {
         `Session: ${formatCost(totals.cost)} · ${formatTokenCount(totals.tokens.total)} tokens · ${unitCount} units`,
     ].join("\n");
 }
-function isBlockedStopReason(reason) {
-    return /^Blocked:\s*/i.test(reason ?? "");
-}
-function formatAutoStopDisplayReason(reason) {
-    return (reason ?? "").replace(/^Blocked:\s*/i, "").trim();
-}
-export function formatAutoStopNotificationPrefix(reason) {
-    const displayReason = formatAutoStopDisplayReason(reason);
-    const prefix = isBlockedStopReason(reason) ? "Auto-mode blocked" : "Auto-mode stopped";
-    return displayReason ? `${prefix} — ${displayReason}` : prefix;
-}
+export { formatStopNoticePrefix as formatAutoStopNotificationPrefix } from "./stop-notice.js";
 function clearSessionModelOverrideForCommandSession(ctx) {
     const sessionId = s.cmdCtx?.sessionManager?.getSessionId?.() ??
         ctx?.sessionManager?.getSessionId?.();
@@ -521,6 +512,16 @@ export function _warnIfWorktreeMissingForTest(worktreePath, milestoneId) {
     }
     return false;
 }
+export function anchorProcessCwdForAutoResume(basePath) {
+    try {
+        process.chdir(basePath);
+        return true;
+    }
+    catch (err) {
+        logWarning("session", `resume cwd anchor failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts", basePath });
+        return false;
+    }
+}
 export function isAutoPaused() {
     return s.paused;
 }
@@ -566,6 +567,13 @@ export function getAutoModeStartModel() {
 export function setCurrentDispatchedModelId(model) {
     s.currentDispatchedModelId = model ? `${model.provider}/${model.id}` : null;
 }
+/**
+ * Update the active unit model after runtime recovery switches models mid-unit.
+ * The next session restore path reads this field before dispatching again.
+ */
+export function setCurrentUnitModelForRecovery(model) {
+    s.currentUnitModel = model;
+}
 // Tool tracking — delegates to auto-tool-tracking.ts
 export function markToolStart(toolCallId, toolName) {
     _markToolStart(toolCallId, s.active, toolName);
@@ -632,6 +640,35 @@ export function stopAutoRemote(projectRoot) {
         return { found: false, error: err.message };
     }
 }
+/**
+ * Force-stop a remote auto-mode session before stealing its lock.
+ * The normal stop path stays SIGTERM-only so cooperative sessions can clean up;
+ * this path is only for the explicit "Force start" action.
+ */
+export function forceStopAutoRemote(projectRoot) {
+    const lock = readCrashLock(projectRoot);
+    if (!lock)
+        return { found: false };
+    if (lock.pid === process.pid) {
+        clearLock(projectRoot);
+        return { found: false };
+    }
+    if (!isLockProcessAlive(lock)) {
+        clearLock(projectRoot);
+        return { found: false };
+    }
+    try {
+        process.kill(lock.pid, "SIGTERM");
+        if (isLockProcessAlive(lock)) {
+            process.kill(lock.pid, "SIGKILL");
+        }
+        clearLock(projectRoot);
+        return { found: true, pid: lock.pid };
+    }
+    catch (err) {
+        return { found: false, error: err.message };
+    }
+}
 /**
  * Check if a remote auto-mode session is running (from a different process).
  * Reads the crash lock, checks PID liveness, and returns session details.
@@ -724,6 +761,9 @@ function pauseAutoUnitIdentityMatches(expected) {
         s.currentUnit.id === expected.id &&
         s.currentUnit.startedAt === expected.startedAt;
 }
+function shouldPreserveCoordinationForPause(errorContext) {
+    return errorContext?.category === "provider" && errorContext.isTransient === true;
+}
 function setLifecycleOutcome(ctx, input) {
     if (!ctx?.hasUI)
         return;
@@ -990,8 +1030,8 @@ export async function stopAuto(ctx, pi, reason, options = {}) {
     if (!s.active && !s.paused)
         return;
     const loadedPreferences = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences;
-    const stopNotificationPrefix = formatAutoStopNotificationPrefix(reason);
-    const displayReason = formatAutoStopDisplayReason(reason);
+    const stopNotificationPrefix = formatStopNoticePrefix(reason);
+    const displayReason = stopNoticeDisplayReason(reason);
     const isHeadlessStop = process.env.GSD_HEADLESS === "1";
     const completionStopRequested = Boolean(options.completionWidget);
     const preserveCloseoutTranscript = !isHeadlessStop && (options.preserveCloseoutTranscript ?? completionStopRequested);
@@ -1558,7 +1598,7 @@ export async function pauseAuto(ctx, _pi, _errorContext, options = {}) {
         releaseSessionLock(lockBase());
         clearLock(lockBase());
     }
-    if (s.workerId) {
+    if (s.workerId && !shouldPreserveCoordinationForPause(_errorContext)) {
         try {
             if (s.currentMilestoneId && s.milestoneLeaseToken) {
                 releaseMilestoneLease(s.workerId, s.currentMilestoneId, s.milestoneLeaseToken);
@@ -1833,7 +1873,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     if (freshStartAssessment.classification === "running") {
         const pid = freshStartAssessment.lock?.pid;
         ctx.ui.notify(pid
-            ? `Another auto-mode session (PID ${pid}) appears to be running.\nStop it with \`kill ${pid}\` before starting a new session.`
+            ? `Another auto-mode session (PID ${pid}) appears to be running.\nRun \`/gsd stop\` for graceful shutdown, or choose "Force start" from \`/gsd auto\` to terminate it.`
             : "Another auto-mode session appears to be running.", "error");
         return;
     }
@@ -2003,6 +2043,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         }
         // ADR-016 phase 2 / B3 (#5621): paused-resume worktree-path adoption.
         buildLifecycle().resumeFromPausedSession(base, resumeWorktreePath);
+        anchorProcessCwdForAutoResume(s.basePath || base);
         // Rebuild scope now that s.basePath reflects the actual worktree (or project root).
         rebuildScope(s.basePath, s.currentMilestoneId);
         // Ensure the workflow-logger audit log is pinned to the project root

package/dist/resources/extensions/gsd/blocked-models.js

@@ -9,12 +9,16 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { withFileLockSync } from "./file-lock.js";
+const temporaryBlockedModels = new Map();
 function blockedModelsPath(basePath) {
     return join(gsdRoot(basePath), "runtime", "blocked-models.json");
 }
 function modelKey(provider, id) {
     return `${provider.toLowerCase()}/${id.toLowerCase()}`;
 }
+function temporaryModelKey(basePath, provider, id) {
+    return `${basePath}:${modelKey(provider, id)}`;
+}
 function readFileSafe(path) {
     if (!existsSync(path))
         return { version: 1, blocked: [] };
@@ -41,6 +45,30 @@ export function isModelBlocked(basePath, provider, id) {
     const target = modelKey(provider, id);
     return loadBlockedModels(basePath).some((e) => modelKey(e.provider, e.id) === target);
 }
+export function blockModelUntil(basePath, provider, id, blockedUntil, reason) {
+    const key = temporaryModelKey(basePath, provider, id);
+    if (blockedUntil <= Date.now()) {
+        temporaryBlockedModels.delete(key);
+        return;
+    }
+    temporaryBlockedModels.set(key, { provider, id, reason, blockedUntil });
+}
+export function isModelTemporarilyUnavailable(basePath, provider, id, now = Date.now()) {
+    if (!provider || !id)
+        return false;
+    const key = temporaryModelKey(basePath, provider, id);
+    const entry = temporaryBlockedModels.get(key);
+    if (!entry)
+        return false;
+    if (entry.blockedUntil <= now) {
+        temporaryBlockedModels.delete(key);
+        return false;
+    }
+    return true;
+}
+export function clearTemporaryModelBlocksForTest() {
+    temporaryBlockedModels.clear();
+}
 export function blockModel(basePath, provider, id, reason) {
     const path = blockedModelsPath(basePath);
     mkdirSync(dirname(path), { recursive: true });

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -2,7 +2,7 @@
 import { logWarning } from "../workflow-logger.js";
 import { checkDeepProjectSetupAfterTurn, checkAutoStartAfterDiscuss, maybeHandleReadyPhraseWithoutFiles, maybeHandleEmptyIntentTurn, resetEmptyTurnCounter, } from "../guided-flow.js";
 import { clearPathCache } from "../paths.js";
-import { getAutoDashboardData, getAutoModeStartModel, isAutoActive, isAutoCompletionStopInProgress, pauseAuto, setCurrentDispatchedModelId, } from "../auto.js";
+import { getAutoDashboardData, getAutoModeStartModel, isAutoActive, isAutoCompletionStopInProgress, pauseAuto, setCurrentDispatchedModelId, setCurrentUnitModelForRecovery, } from "../auto.js";
 import { getNextFallbackModel, resolveModelWithFallbacksForUnit } from "../preferences.js";
 import { pauseAutoForProviderError } from "../provider-error-pause.js";
 import { isSessionSwitchAbortGraceActive, isSessionSwitchInFlight, resolveAgentEnd, resolveAgentEndCancelled, } from "../auto/resolve.js";
@@ -13,9 +13,10 @@ import { clearDiscussionFlowState } from "./write-gate.js";
 import { clearGuidedUnitContext } from "../guided-unit-context.js";
 import { resumeAutoAfterProviderDelay } from "./provider-error-resume.js";
 import { classifyError, createRetryState, resetRetryState, isTransient, } from "../error-classifier.js";
-import { blockModel, isModelBlocked } from "../blocked-models.js";
+import { blockModel, blockModelUntil, isModelBlocked, isModelTemporarilyUnavailable } from "../blocked-models.js";
 import { getProjectGSDPreferencesPath } from "../preferences.js";
-import { formatProviderErrorGuidance, resolveProviderErrorGuidance, } from "../provider-error-guidance.js";
+import { resolveProviderErrorGuidance } from "../provider-error-guidance.js";
+import { formatGuidance } from "../guidance.js";
 const retryState = createRetryState();
 const MAX_NETWORK_RETRIES = 2;
 function isObjectRecord(value) {
@@ -95,9 +96,12 @@ async function tryProviderModelFallback(params) {
             if (!nextModelId)
                 break;
             const candidate = resolveModelId(nextModelId, availableModels, rejectedProvider);
-            if (candidate && !isModelBlocked(basePath, candidate.provider, candidate.id)) {
+            if (candidate &&
+                !isModelBlocked(basePath, candidate.provider, candidate.id) &&
+                !isModelTemporarilyUnavailable(basePath, candidate.provider, candidate.id)) {
                 const ok = await pi.setModel(candidate, { persist: false });
                 if (ok) {
+                    setCurrentUnitModelForRecovery(candidate);
                     setCurrentDispatchedModelId({ provider: candidate.provider, id: candidate.id });
                     switchedNotify(`${candidate.provider}/${candidate.id}`);
                     pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
@@ -110,11 +114,13 @@ async function tryProviderModelFallback(params) {
     const sessionModel = getAutoModeStartModel();
     if (sessionModel &&
         !(sessionModel.provider === rejectedProvider && sessionModel.id === rejectedId) &&
-        !isModelBlocked(basePath, sessionModel.provider, sessionModel.id)) {
+        !isModelBlocked(basePath, sessionModel.provider, sessionModel.id) &&
+        !isModelTemporarilyUnavailable(basePath, sessionModel.provider, sessionModel.id)) {
         const startModel = availableModels.find((m) => m.provider === sessionModel.provider && m.id === sessionModel.id);
         if (startModel) {
             const ok = await pi.setModel(startModel, { persist: false });
             if (ok) {
+                setCurrentUnitModelForRecovery(startModel);
                 setCurrentDispatchedModelId({ provider: startModel.provider, id: startModel.id });
                 switchedNotify(`${startModel.provider}/${startModel.id}`);
                 pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
@@ -486,7 +492,7 @@ export async function handleAgentEnd(pi, event, ctx) {
                 preferencesPath: dash.basePath ? getProjectGSDPreferencesPath(dash.basePath) : undefined,
                 hasConfiguredFallbacks: (modelConfig?.fallbacks.length ?? 0) > 0,
             });
-            const guidanceText = formatProviderErrorGuidance(guidance);
+            const guidanceText = formatGuidance(guidance);
             await pauseForProviderModelRejection(ctx, pi, {
                 errorDetail,
                 rawErrorMsg,
@@ -532,6 +538,10 @@ export async function handleAgentEnd(pi, event, ctx) {
             if (currentProvider === "openai-codex" || currentProvider === "google-gemini-cli") {
                 cls.retryAfterMs = Math.min(cls.retryAfterMs, 30_000);
             }
+            const dash = getAutoDashboardData();
+            if (dash.basePath && ctx.model?.provider && ctx.model?.id) {
+                blockModelUntil(dash.basePath, ctx.model.provider, ctx.model.id, Date.now() + cls.retryAfterMs, rawErrorMsg || displayMsg || "rate limit");
+            }
         }
         // ── 2. Decide & Act ──────────────────────────────────────────────────
         // --- Network errors: same-model retry with backoff ---
@@ -571,9 +581,14 @@ export async function handleAgentEnd(pi, event, ctx) {
                         retryState.networkRetryCount = 0;
                         retryState.currentRetryModelId = undefined;
                         const modelToSet = resolveModelId(nextModelId, availableModels, ctx.model?.provider);
-                        if (modelToSet) {
+                        const modelUnavailable = dash.basePath && modelToSet
+                            ? isModelBlocked(dash.basePath, modelToSet.provider, modelToSet.id) ||
+                                isModelTemporarilyUnavailable(dash.basePath, modelToSet.provider, modelToSet.id)
+                            : false;
+                        if (modelToSet && !modelUnavailable) {
                             const ok = await pi.setModel(modelToSet, { persist: false });
                             if (ok) {
+                                setCurrentUnitModelForRecovery(modelToSet);
                                 setCurrentDispatchedModelId({ provider: modelToSet.provider, id: modelToSet.id });
                                 ctx.ui.notify(`Model error${errorDetail}. Switched to fallback: ${nextModelId} and resuming.`, "warning");
                                 pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
@@ -586,11 +601,17 @@ export async function handleAgentEnd(pi, event, ctx) {
             // Try restoring session model
             const sessionModel = getAutoModeStartModel();
             if (sessionModel) {
-                if (ctx.model?.id !== sessionModel.id || ctx.model?.provider !== sessionModel.provider) {
+                const dash = getAutoDashboardData();
+                const sessionModelUnavailable = dash.basePath
+                    ? isModelBlocked(dash.basePath, sessionModel.provider, sessionModel.id) ||
+                        isModelTemporarilyUnavailable(dash.basePath, sessionModel.provider, sessionModel.id)
+                    : false;
+                if (!sessionModelUnavailable && (ctx.model?.id !== sessionModel.id || ctx.model?.provider !== sessionModel.provider)) {
                     const startModel = ctx.modelRegistry.getAvailable().find((m) => m.provider === sessionModel.provider && m.id === sessionModel.id);
                     if (startModel) {
                         const ok = await pi.setModel(startModel, { persist: false });
                         if (ok) {
+                            setCurrentUnitModelForRecovery(startModel);
                             setCurrentDispatchedModelId({ provider: startModel.provider, id: startModel.id });
                             retryState.networkRetryCount = 0;
                             retryState.currentRetryModelId = undefined;

package/dist/resources/extensions/gsd/bootstrap/dynamic-tools.js

@@ -4,9 +4,8 @@ import { existsSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createBashTool, createEditTool, createReadTool, createWriteTool } from "@gsd/pi-coding-agent";
-import { DEFAULT_BASH_TIMEOUT_SECS } from "../constants.js";
 import { logWarning } from "../workflow-logger.js";
-import { openWorkflowDatabase } from "../db-workspace.js";
+import { getWorkflowDatabaseStatus, openWorkflowDatabase, } from "../db-workspace.js";
 import { getAutoWorktreePath } from "../auto-worktree.js";
 import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { worktreesDirs } from "../worktree-placement.js";
@@ -62,16 +61,46 @@ export function resolveWorkflowToolBasePath(ctx, scope) {
     return cwd;
 }
 export { resolveProjectRootDbPath } from "../db-workspace.js";
+function sqliteProviderHint(status, nodeVersion) {
+    if (status.provider)
+        return `Provider: ${status.provider}.`;
+    const major = Number.parseInt(nodeVersion.split(".")[0] ?? "", 10);
+    if (Number.isFinite(major) && major < 22) {
+        return (`No SQLite provider available. Upgrade Node to >= 22.0.0 (current: v${nodeVersion}), ` +
+            "use the packaged GSD runtime, or install/restore better-sqlite3 in this runtime.");
+    }
+    return ("No SQLite provider available. Use a Node build with node:sqlite enabled, " +
+        "run the packaged GSD runtime, or install/restore better-sqlite3 in this runtime.");
+}
+function dbOpenPhaseHint(status) {
+    if (status.lastPhase === "open")
+        return "The database file could not be opened";
+    if (status.lastPhase === "initSchema")
+        return "The database schema could not be initialized";
+    if (status.lastPhase === "vacuum-recovery")
+        return "Corruption recovery (VACUUM) failed";
+    if (status.attempted)
+        return "The database could not be opened";
+    return "The database provider could not be loaded";
+}
+export function formatWorkflowDatabaseOpenFailure(result, status, nodeVersion = process.versions.node) {
+    if (result.reason === "missing-gsd-dir") {
+        return `ensureDbOpen failed — no .gsd directory found at ${result.location.projectGsd}`;
+    }
+    if (result.reason === "missing-database") {
+        return `ensureDbOpen failed — no GSD database found at ${result.location.projectDb}`;
+    }
+    const resolvedStatus = status ?? getWorkflowDatabaseStatus();
+    const detail = result.error?.message ?? resolvedStatus.lastError?.message ?? "";
+    const detailSuffix = detail ? ` (${detail})` : "";
+    return (`ensureDbOpen failed for ${result.location.projectDb}: ` +
+        `${dbOpenPhaseHint(resolvedStatus)}${detailSuffix}. ${sqliteProviderHint(resolvedStatus, nodeVersion)}`);
+}
 export async function ensureDbOpen(basePath = safeWorkspaceCwd()) {
     const result = openWorkflowDatabase(basePath);
     if (result.ok)
         return true;
-    if (result.reason === "missing-gsd-dir") {
-        logWarning("bootstrap", "ensureDbOpen failed — no .gsd directory found");
-    }
-    else {
-        logWarning("bootstrap", `ensureDbOpen failed: ${result.error?.message ?? "open failed"}`);
-    }
+    logWarning("bootstrap", formatWorkflowDatabaseOpenFailure(result));
     return false;
 }
 export function registerDynamicTools(pi) {
@@ -79,18 +108,36 @@ export function registerDynamicTools(pi) {
     const baseBash = createBashTool(fallbackRoot, {
         spawnHook: (ctx) => ctx,
     });
+    // The auto-mode stalled-tool watchdog only exists in GSD/auto-mode, so the
+    // watchdog verbiage is injected here (the GSD-registered tool) rather than in
+    // core bash.ts, which is reused by non-GSD embeddings that have no watchdog.
+    const WATCHDOG_DETAIL = "Genuine hangs are caught by the auto-mode stalled-tool watchdog (stalled: 5m / idle: 10m / soft: 20m / hard: 30m).";
+    const gsdBashDescription = `${baseBash.description} ${WATCHDOG_DETAIL}`;
+    const gsdBashParameters = (() => {
+        const params = baseBash.parameters;
+        if (!params?.properties?.timeout)
+            return params;
+        return {
+            ...params,
+            properties: {
+                ...params.properties,
+                timeout: {
+                    ...params.properties.timeout,
+                    description: `${params.properties.timeout.description} ${WATCHDOG_DETAIL}`,
+                },
+            },
+        };
+    })();
     const dynamicBash = {
         ...baseBash,
+        description: gsdBashDescription,
+        parameters: gsdBashParameters,
         execute: async (toolCallId, params, signal, onUpdate, ctx) => {
             const basePath = resolveCtxCwd(ctx);
             const fresh = createBashTool(basePath, {
                 spawnHook: (spawnCtx) => ({ ...spawnCtx, cwd: basePath }),
             });
-            const paramsWithTimeout = {
-                ...params,
-                timeout: params.timeout ?? DEFAULT_BASH_TIMEOUT_SECS,
-            };
-            return fresh.execute(toolCallId, paramsWithTimeout, signal, onUpdate, ctx);
+            return fresh.execute(toolCallId, params, signal, onUpdate, ctx);
         },
     };
     pi.registerTool(dynamicBash);

package/dist/resources/extensions/gsd/bootstrap/exec-tools.js

@@ -114,8 +114,8 @@ export function registerExecTools(pi) {
         ],
         parameters: Type.Object({
             query: Type.Optional(Type.String({ description: "Substring matched against id and purpose (case-insensitive)." })),
-            runtime: Type.Optional(Type.Union([Type.Literal("bash"), Type.Literal("node"), Type.Literal("python")], {
-                description: "Restrict to one runtime.",
+            runtime: Type.Optional(Type.String({
+                description: "Restrict to one runtime: bash, node, or python.",
             })),
             failing_only: Type.Optional(Type.Boolean({ description: "Only non-zero exit codes and timeouts." })),
             limit: Type.Optional(Type.Number({ description: "Max results (default 20, cap 200)", minimum: 1, maximum: 200 })),