@opengsd/gsd-pi 1.2.0-dev.d6c5343c → 1.2.0-dev.ddc97c10

package/dist/mcp-server.js

@@ -29,6 +29,7 @@ function isPlainObject(value) {
 // built via a template string so TypeScript's NodeNext resolver treats them as
 // `any` and skips static checking.
 const MCP_PKG = '@modelcontextprotocol/sdk';
+import { sanitizeSchemaForMoonshot } from '@gsd/pi-ai';
 export function mcpSdkSpecifier(subpath) {
     return `${MCP_PKG}/${subpath}.js`;
 }
@@ -65,7 +66,7 @@ export async function startMcpServer(options) {
         tools: tools.map((t) => ({
             name: t.name,
             description: t.description,
-            inputSchema: t.parameters,
+            inputSchema: sanitizeSchemaForMoonshot(t.parameters),
         })),
     }));
     // tools/call — execute the requested tool and return content blocks.

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-c63bf325c75b710f
+298c30be22e6452d

package/dist/resources/extensions/gsd/auto/orchestrator.js

@@ -12,7 +12,7 @@
 import { debugCount, debugLog, debugTime } from "../debug-logger.js";
 import { reconcileBeforeDispatch } from "../state-reconciliation.js";
 import { isLegalEdge, IllegalPhaseTransitionError } from "../state-transition-matrix.js";
-import { resolveDispatch } from "../auto-dispatch.js";
+import { hasPendingDeepStage, resolveDispatch } from "../auto-dispatch.js";
 import { classifyFailure } from "../recovery-classification.js";
 import { verifyExpectedArtifact, refreshRecoveryDbForArtifact } from "../auto-recovery.js";
 import { invalidateAllCaches } from "../cache.js";
@@ -111,14 +111,25 @@ function shouldAdoptActiveMilestone(state, activeSession, activeDispatchBasePath
 export async function decideOrchestratorDispatch(ctx, pi, dispatchBasePath, session, input) {
     const state = input.stateSnapshot;
     const active = state.activeMilestone;
-    if (!active)
-        return null;
     const activeSession = input.session ?? session;
     const activeDispatchBasePath = activeSession?.basePath || dispatchBasePath;
-    if (activeSession && shouldAdoptActiveMilestone(state, activeSession, activeDispatchBasePath)) {
+    const prefs = loadEffectiveGSDPreferences(activeDispatchBasePath)?.preferences;
+    if (!active) {
+        if (state.phase !== "pre-planning")
+            return null;
+        if (!hasPendingDeepStage(prefs, activeDispatchBasePath)) {
+            return {
+                kind: "blocked",
+                reason: state.nextAction || "No active milestone. Run /gsd unpark <id> or create a new milestone.",
+                action: "stop",
+            };
+        }
+    }
+    if (active && activeSession && shouldAdoptActiveMilestone(state, activeSession, activeDispatchBasePath)) {
         activeSession.currentMilestoneId = active.id;
     }
-    const prefs = loadEffectiveGSDPreferences(activeDispatchBasePath)?.preferences;
+    const dispatchMid = active?.id ?? activeSession?.currentMilestoneId ?? "";
+    const dispatchMidTitle = active?.title ?? "";
     // Derive session-derived dispatch inputs the same way phases.ts:runDispatch does
     // (#5789). Prefer caller-supplied values when present so test harnesses and
     // alternative wirings can inject deterministic snapshots; otherwise pull from
@@ -146,8 +157,15 @@ export async function decideOrchestratorDispatch(ctx, pi, dispatchBasePath, sess
             })
                 ? "true"
                 : "false");
+    // Only replay a milestone-scoped verification retry when a milestone is
+    // active. Pre-PR (#712 fix), `!active` returned null before reaching this
+    // block, so the retry was preserved for a future tick. The new
+    // pre-planning + deep-pending fall-through must keep that contract:
+    // otherwise a stale execute-task / complete-slice / complete-milestone
+    // retry whose target milestone has since been parked would preempt
+    // project-level deep rules like `discuss-project`.
     const pendingRetry = session?.pendingVerificationRetryDispatch;
-    if (session && pendingRetry) {
+    if (session && pendingRetry && active) {
         session.pendingVerificationRetryDispatch = null;
         const alreadyClosedReason = getAlreadyClosedDispatchReason(pendingRetry.unitType, pendingRetry.unitId);
         if (alreadyClosedReason) {
@@ -165,8 +183,8 @@ export async function decideOrchestratorDispatch(ctx, pi, dispatchBasePath, sess
     }
     const action = await resolveDispatch({
         basePath: activeDispatchBasePath,
-        mid: active.id,
-        midTitle: active.title,
+        mid: dispatchMid,
+        midTitle: dispatchMidTitle,
         state,
         prefs,
         session: activeSession,
@@ -211,8 +229,8 @@ export async function decideOrchestratorDispatch(ctx, pi, dispatchBasePath, sess
             prompt: action.prompt,
             pauseAfterUatDispatch: action.pauseAfterDispatch ?? false,
             state,
-            mid: active.id,
-            midTitle: active.title,
+            mid: dispatchMid,
+            midTitle: dispatchMidTitle,
         };
         session.pendingOrchestrationDispatch = pending;
     }

package/dist/resources/extensions/gsd/auto/phases.js

@@ -11,7 +11,7 @@
 import { importExtensionModule } from "@gsd/pi-coding-agent";
 import { USER_DRIVEN_DEEP_UNITS, isAwaitingUserInput, } from "../auto-post-unit.js";
 import { lastAssistantText } from "../consent-question.js";
-import { resolveEffectiveUnitIsolationMode } from "../preferences.js";
+import { resolveEffectiveUnitIsolationMode, getIsolationMode } from "../preferences.js";
 import { MAX_RECOVERY_CHARS, BUDGET_THRESHOLDS, MAX_FINALIZE_TIMEOUTS, } from "./types.js";
 import { detectStuck } from "./detect-stuck.js";
 import { STUCK_WINDOW_SIZE } from "./dispatch-history.js";
@@ -35,9 +35,10 @@ import { writeUnitRuntimeRecord } from "../unit-runtime.js";
 import { withTimeout, FINALIZE_PRE_TIMEOUT_MS, FINALIZE_POST_TIMEOUT_MS } from "./finalize-timeout.js";
 import { getEligibleSlices } from "../slice-parallel-eligibility.js";
 import { isSliceParallelActive, startSliceParallel } from "../slice-parallel-orchestrator.js";
-import { isDbAvailable, getMilestoneSlices, getSlice, getTask } from "../gsd-db.js";
+import { isDbAvailable, getMilestone, getMilestoneSlices, getSlice, getTask } from "../gsd-db.js";
 import { refreshWorkflowDatabaseFromDisk } from "../db-workspace.js";
 import { isClosedStatus } from "../status-guards.js";
+import { findUnmergedCompletedMilestones } from "../unmerged-milestone-guard.js";
 import { setRuntimeKv } from "../db/runtime-kv.js";
 import { getLatestForUnit } from "../db/unit-dispatches.js";
 import { reconcileBeforeSpawn } from "../state-reconciliation.js";
@@ -50,7 +51,8 @@ import { parseUnitId } from "../unit-id.js";
 import { createCheckpoint, cleanupCheckpoint, rollbackToCheckpoint } from "../safety/git-checkpoint.js";
 import { resolveSafetyHarnessConfig } from "../safety/safety-harness.js";
 import { getContextPauseAction } from "../auto-budget.js";
-import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, supportsStructuredQuestions, } from "../workflow-mcp.js";
+import { supportsStructuredQuestions } from "../workflow-mcp.js";
+import { getUnitWorkflowDispatchReadinessError } from "../tool-contract.js";
 import { prepareWorkflowMcpForProject } from "../workflow-mcp-auto-prep.js";
 import { applyThinkingLevelForModel, floorThinkingLevelForUnit, getRegisteredToolSnapshot, getToolBaselineSnapshot, } from "../auto-model-selection.js";
 import { resolveManifest } from "../unit-context-manifest.js";
@@ -600,6 +602,36 @@ async function failClosedOnFinalizeTimeout(ic, iterData, loopState, stage, start
     drainLogs();
     return { action: "break", reason: progressKind };
 }
+export async function shouldSkipTerminalMilestoneCloseout(s, state, mid) {
+    const closeoutMilestoneId = mid ?? s.currentMilestoneId ?? state.lastCompletedMilestone?.id;
+    if (s.completionStopInProgress) {
+        return { skip: true, milestoneId: closeoutMilestoneId };
+    }
+    if (!closeoutMilestoneId) {
+        return { skip: false };
+    }
+    if (isDbAvailable())
+        refreshWorkflowDatabaseFromDisk();
+    const closeoutBasePath = s.originalBasePath || s.canonicalProjectRoot || s.basePath;
+    let closeoutMergePending = false;
+    if (getIsolationMode(closeoutBasePath) !== "none") {
+        try {
+            const blockers = await findUnmergedCompletedMilestones(closeoutBasePath);
+            closeoutMergePending = blockers.some((blocker) => blocker.milestoneId === closeoutMilestoneId);
+        }
+        catch {
+            // Fail open: without git/DB inspection we cannot safely treat closeout as done.
+            closeoutMergePending = true;
+        }
+    }
+    const milestoneAlreadyClosedOut = isDbAvailable()
+        && isClosedStatus(getMilestone(closeoutMilestoneId)?.status ?? "")
+        && !closeoutMergePending;
+    if (milestoneAlreadyClosedOut) {
+        return { skip: true, milestoneId: closeoutMilestoneId };
+    }
+    return { skip: false, milestoneId: closeoutMilestoneId };
+}
 // ─── runPreDispatch ───────────────────────────────────────────────────────────
 /**
  * Phase 1: Pre-dispatch — resource guard, health gate, state derivation,
@@ -962,6 +994,13 @@ export async function runPreDispatch(ic, loopState) {
         deps.setActiveMilestoneId(s.basePath, mid);
     }
     // ── Terminal conditions ──────────────────────────────────────────────
+    if (state.phase === "complete") {
+        const closeoutSkip = await shouldSkipTerminalMilestoneCloseout(s, state, mid);
+        if (closeoutSkip.skip) {
+            debugLog("autoLoop", { phase: "complete", reason: "milestone-already-closed", milestoneId: closeoutSkip.milestoneId });
+            return { action: "break", reason: "milestone-complete" };
+        }
+    }
     if (!mid) {
         if (s.currentUnit) {
             await deps.closeoutUnit(ctx, s.basePath, s.currentUnit.type, s.currentUnit.id, s.currentUnit.startedAt, deps.buildSnapshotOpts(s.currentUnit.type, s.currentUnit.id));
@@ -1769,7 +1808,8 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
     s.currentDispatchedModelId = s.currentUnitModel
         ? `${s.currentUnitModel.provider ?? ""}/${s.currentUnitModel.id ?? ""}`
         : null;
-    const compatibilityError = getWorkflowTransportSupportError(s.currentUnitModel?.provider ?? ctx.model?.provider, getRequiredWorkflowToolsForAutoUnit(unitType), {
+    const compatibilityError = getUnitWorkflowDispatchReadinessError({
+        provider: s.currentUnitModel?.provider ?? ctx.model?.provider,
         projectRoot: s.basePath,
         surface: "auto-mode",
         unitType,
@@ -1848,6 +1888,9 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         causedBy: "unit-start",
     });
     s.lastToolInvocationError = null; // #2883: clear stale error from previous unit
+    if (nextDispatchCount <= 1) {
+        s.toolUnavailableRetries = 0;
+    }
     const unitStartSeq = ic.nextSeq();
     deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: unitStartSeq, eventType: "unit-start", data: { unitType, unitId } });
     deps.captureAvailableSkills();

package/dist/resources/extensions/gsd/auto/session.js

@@ -126,6 +126,8 @@ export class AutoSession {
     /** Set when a GSD tool execution ends with isError due to malformed/truncated
      *  JSON arguments. Checked by postUnitPreVerification to break retry loops. */
     lastToolInvocationError = null;
+    /** Consecutive tool-unavailable retries for the current unit (MCP startup race). */
+    toolUnavailableRetries = 0;
     /** Agent-end messages from the just-finished unit, consumed during finalize. */
     lastUnitAgentEndMessages = null;
     /** Set when turn-level git action fails during closeout. */
@@ -306,6 +308,7 @@ export class AutoSession {
         this.lastPreExecFailure = null;
         this.preExecRetryCount.clear();
         this.lastToolInvocationError = null;
+        this.toolUnavailableRetries = 0;
         this.lastUnitAgentEndMessages = null;
         this.lastGitActionFailure = null;
         this.lastGitActionStatus = null;

package/dist/resources/extensions/gsd/auto-direct-dispatch.js

@@ -10,7 +10,7 @@ import { buildResearchSlicePrompt, buildResearchMilestonePrompt, buildPlanSliceP
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { pauseAuto } from "./auto.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
-import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, } from "./workflow-mcp.js";
+import { getUnitWorkflowDispatchReadinessError } from "./tool-contract.js";
 export async function dispatchDirectPhase(ctx, pi, phase, base) {
     const state = await deriveState(base);
     const mid = state.activeMilestone?.id;
@@ -201,7 +201,8 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
             ctx.ui.notify(`Unknown phase "${phase}". Valid phases: research, plan, execute, complete, validate, reassess, uat, replan.`, "warning");
             return;
     }
-    const compatibilityError = getWorkflowTransportSupportError(ctx.model?.provider, getRequiredWorkflowToolsForAutoUnit(unitType), {
+    const compatibilityError = getUnitWorkflowDispatchReadinessError({
+        provider: ctx.model?.provider,
         projectRoot,
         surface: "direct phase dispatch",
         unitType,

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -24,7 +24,8 @@ import { isAutoActive } from "./auto.js";
 import { hostWriteGateAdapter } from "./bootstrap/write-gate.js";
 import { ensureWorkflowPreferencesCaptured } from "./planning-depth.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
-import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, resolveWorkflowMcpProjectRoot, } from "./workflow-mcp.js";
+import { resolveWorkflowMcpProjectRoot } from "./workflow-mcp.js";
+import { getUnitWorkflowDispatchReadinessError } from "./tool-contract.js";
 import { prepareBrowserDaemonForUat } from "./browser-daemon-auto-prep.js";
 import { PROJECT_RESEARCH_INFLIGHT_MARKER, } from "./project-research-policy.js";
 import { isWorkflowPrefsCaptured, resolveDeepProjectSetupState, } from "./deep-project-setup-policy.js";
@@ -512,7 +513,15 @@ export const DISPATCH_RULES = [
             // Transport preflight: verify required MCP tools are actually connected
             // before consuming a retry attempt. Fixes tool-starved sessions burning
             // all MAX_UAT_ATTEMPTS before stopping (#477).
-            const transportError = getWorkflowTransportSupportError(sessionProvider, getRequiredWorkflowToolsForAutoUnit("run-uat"), { projectRoot: basePath, surface: "auto-mode", unitType: "run-uat", authMode: sessionAuthMode, baseUrl: sessionBaseUrl, activeTools });
+            const transportError = getUnitWorkflowDispatchReadinessError({
+                provider: sessionProvider,
+                projectRoot: basePath,
+                surface: "auto-mode",
+                unitType: "run-uat",
+                authMode: sessionAuthMode,
+                baseUrl: sessionBaseUrl,
+                activeTools,
+            });
             if (transportError) {
                 return { action: "stop", reason: transportError, level: "warning" };
             }

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -13,7 +13,7 @@ import { getSessionModelOverride } from "./session-model-override.js";
 import { logWarning } from "./workflow-logger.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { applyModelPolicyFilter } from "./uok/model-policy.js";
-import { isModelBlocked } from "./blocked-models.js";
+import { isModelBlocked, isModelTemporarilyUnavailable } from "./blocked-models.js";
 import { getRequiredWorkflowToolsForAutoUnit, isWorkflowMcpSurfaceTool } from "./workflow-mcp.js";
 /**
  * Thrown when the model-policy gate rejects every candidate model for a unit
@@ -218,6 +218,10 @@ function buildModelPolicyBlockReasons(policyDenyReasons, availableModels, routin
             reason: `configured model(s) did not resolve against policy-eligible registry [${eligibleSummary}]`,
         }];
 }
+function isModelUnavailable(basePath, provider, id) {
+    return isModelBlocked(basePath, provider, id) ||
+        isModelTemporarilyUnavailable(basePath, provider, id);
+}
 function restoreToolBaseline(pi) {
     const key = pi;
     const baseline = TOOL_BASELINE.get(key);
@@ -657,8 +661,8 @@ autoModeStartThinkingLevel) {
             // (issue #4513).  The block is persisted in .gsd/runtime/blocked-models.json
             // so it survives /gsd auto restarts — without this, the same dead model
             // gets reselected after every restart.
-            if (isModelBlocked(basePath, model.provider, model.id)) {
-                ctx.ui.notify(`Skipping blocked model ${model.provider}/${model.id} (provider rejected it for this account).`, "warning");
+            if (isModelUnavailable(basePath, model.provider, model.id)) {
+                ctx.ui.notify(`Skipping unavailable model ${model.provider}/${model.id}.`, "warning");
                 continue;
             }
             // Warn if the ID is ambiguous across providers
@@ -724,7 +728,7 @@ autoModeStartThinkingLevel) {
                 const key = `${model.provider.toLowerCase()}/${model.id.toLowerCase()}`;
                 if (!policyAllowedModelKeys.has(key))
                     continue;
-                if (isModelBlocked(basePath, model.provider, model.id))
+                if (isModelUnavailable(basePath, model.provider, model.id))
                     continue;
                 const ok = await pi.setModel(model, { persist: false });
                 if (!ok)
@@ -746,16 +750,16 @@ autoModeStartThinkingLevel) {
         // No model preference for this unit type — re-apply the model captured
         // at auto-mode start to prevent bleed from shared global settings.json (#650).
         const availableModels = buildModelPolicyCandidates(ctx, autoModeStartModel, effectiveSessionModelOverride);
-        const startBlocked = isModelBlocked(basePath, autoModeStartModel.provider, autoModeStartModel.id);
+        const startBlocked = isModelUnavailable(basePath, autoModeStartModel.provider, autoModeStartModel.id);
         if (startBlocked) {
-            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is blocked for this account. Using current session model instead.`, "warning");
+            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is unavailable. Using current session model instead.`, "warning");
         }
         else {
             const startModel = availableModels.find(m => m.provider === autoModeStartModel.provider && m.id === autoModeStartModel.id);
             if (startModel) {
                 const ok = await pi.setModel(startModel, { persist: false });
                 if (!ok) {
-                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelBlocked(basePath, m.provider, m.id));
+                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelUnavailable(basePath, m.provider, m.id));
                     if (byId) {
                         const fallbackOk = await pi.setModel(byId, { persist: false });
                         if (fallbackOk) {

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -1704,13 +1704,24 @@ export async function postUnitPreVerification(pctx, opts) {
             }
             else if (!triggerArtifactVerified) {
                 if (s.lastToolInvocationError && isToolUnavailableError(s.lastToolInvocationError)) {
-                    // Tool-unavailable is the one transient invocation error: the
-                    // workflow MCP server registers its surface asynchronously, so a
-                    // Unit's first call can race the registration. Fall through to the
-                    // bounded verification retry instead of pausing.
-                    debugLog("postUnit", { phase: "tool-unavailable-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError });
-                    ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type}: ${s.lastToolInvocationError}. The tool surface may still be registering — retrying.`, "warning");
+                    // Tool-unavailable is transient: the workflow MCP server registers
+                    // its surface asynchronously, so a Unit's first call can race the
+                    // registration. Retry with escalating delay, bounded at 3 attempts.
+                    // ponytail: MAX constant so the guard, log, and display all agree
+                    const MAX_TOOL_UNAVAIL_RETRIES = 3;
+                    if (s.toolUnavailableRetries >= MAX_TOOL_UNAVAIL_RETRIES) {
+                        debugLog("postUnit", { phase: "tool-unavailable-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, retries: s.toolUnavailableRetries });
+                        ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type} after ${MAX_TOOL_UNAVAIL_RETRIES} retries: ${s.lastToolInvocationError}. MCP server may not be starting — pausing auto-mode.`, "error");
+                        s.lastToolInvocationError = null;
+                        await pauseAuto(ctx, pi);
+                        return "dispatched";
+                    }
+                    s.toolUnavailableRetries++;
+                    const delayMs = s.toolUnavailableRetries * 1000;
+                    debugLog("postUnit", { phase: "tool-unavailable-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError, attempt: s.toolUnavailableRetries, delayMs });
+                    ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Waiting ${delayMs}ms for MCP server — retry ${s.toolUnavailableRetries}/${MAX_TOOL_UNAVAIL_RETRIES}.`, "warning");
                     s.lastToolInvocationError = null;
+                    await new Promise(r => setTimeout(r, delayMs));
                 }
                 else if (s.lastToolInvocationError) {
                     const isUserSkip = /queued user message/i.test(s.lastToolInvocationError);
@@ -1825,6 +1836,7 @@ export async function postUnitPreVerification(pctx, opts) {
                 if (s.pendingVerificationRetry?.unitId === s.currentUnit.id) {
                     s.pendingVerificationRetry = null;
                 }
+                s.toolUnavailableRetries = 0;
                 s.verificationRetryCount.delete(retryKey);
                 s.verificationRetryFailureHashes.delete(retryKey);
                 s.exhaustedVerificationUnits.delete(retryKey);

package/dist/resources/extensions/gsd/auto-unit-closeout.js

@@ -36,17 +36,17 @@ export function isSuspiciousGhostCompletion(ctx, startedAt, maxElapsedMs = GHOST
         activity.assistantMessages === 0);
 }
 /**
- * Snapshot metrics, save activity log, and fire-and-forget memory extraction
- * for a completed unit. Returns the activity log file path (if any).
+ * Snapshot metrics, save activity log, extract memories, and record the git
+ * transaction for a completed auto-mode unit.
  */
-export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, opts) {
-    const modelId = ctx.model?.id ?? "unknown";
-    snapshotUnitMetrics(ctx, unitType, unitId, startedAt, modelId, opts);
-    const activityFile = saveActivityLog(ctx, basePath, unitType, unitId);
+export async function closeoutAutoUnit(request) {
+    const modelId = request.ctx.model?.id ?? "unknown";
+    snapshotUnitMetrics(request.ctx, request.unitType, request.unitId, request.startedAt, modelId, request.opts);
+    const activityFile = saveActivityLog(request.ctx, request.basePath, request.unitType, request.unitId);
     if (activityFile) {
         try {
-            const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import('./memory-extractor.js');
-            const llmCallFn = buildMemoryLLMCall(ctx);
+            const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import("./memory-extractor.js");
+            const llmCallFn = buildMemoryLLMCall(request.ctx);
             if (llmCallFn) {
                 // Awaited: a fire-and-forget here lets memory-extractor writes land in
                 // .gsd/ after closeoutUnit returns but before the milestone merge
@@ -55,10 +55,10 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
                 // bounded by the extractor's LLM call, which is the acceptable price
                 // for not racing the merge boundary.
                 try {
-                    await extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn);
+                    await extractMemoriesFromUnit(activityFile, request.unitType, request.unitId, llmCallFn);
                 }
                 catch (err) {
-                    logWarning("engine", `memory extraction failed for ${unitType}/${unitId}: ${err.message}`);
+                    logWarning("engine", `memory extraction failed for ${request.unitType}/${request.unitId}: ${err.message}`);
                 }
             }
         }
@@ -66,22 +66,46 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
             logWarning("engine", `operation failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    if (opts?.traceId && opts.turnId && opts.gitAction && opts.gitStatus) {
+    const gitTransaction = resolveGitTransactionOptions(request.opts);
+    if (gitTransaction) {
         writeTurnGitTransaction({
-            basePath,
-            traceId: opts.traceId,
-            turnId: opts.turnId,
-            unitType,
-            unitId,
+            basePath: request.basePath,
+            traceId: gitTransaction.traceId,
+            turnId: gitTransaction.turnId,
+            unitType: request.unitType,
+            unitId: request.unitId,
             stage: "record",
-            action: opts.gitAction,
-            push: opts.gitPush === true,
-            status: opts.gitStatus,
-            error: opts.gitError,
+            action: gitTransaction.gitAction,
+            push: gitTransaction.gitPush === true,
+            status: gitTransaction.gitStatus,
+            error: gitTransaction.gitError,
             metadata: {
                 activityFile,
             },
         });
     }
-    return activityFile ?? undefined;
+    return {
+        ...(activityFile ? { activityFile } : {}),
+        gitTransactionRecorded: Boolean(gitTransaction),
+    };
+}
+function resolveGitTransactionOptions(opts) {
+    if (!opts?.traceId || !opts.turnId || !opts.gitAction || !opts.gitStatus)
+        return null;
+    return {
+        traceId: opts.traceId,
+        turnId: opts.turnId,
+        gitAction: opts.gitAction,
+        gitStatus: opts.gitStatus,
+        gitPush: opts.gitPush,
+        gitError: opts.gitError,
+    };
+}
+/**
+ * Compatibility wrapper for existing auto-loop callers. New code should prefer
+ * closeoutAutoUnit so the closeout request and result stay explicit.
+ */
+export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, opts) {
+    const result = await closeoutAutoUnit({ ctx, basePath, unitType, unitId, startedAt, opts });
+    return result.activityFile;
 }

package/dist/resources/extensions/gsd/auto-verification.js

@@ -23,6 +23,7 @@ import { getSlice } from "./gsd-db.js";
 import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { formatPostUnitStatusCard } from "./auto-status-message.js";
+import { detectWebApp } from "./web-app-uat.js";
 function getCurrentUnitCostStats(unitId) {
     const ledger = getLedger();
     if (!ledger || !Array.isArray(ledger.units) || ledger.units.length === 0) {
@@ -617,14 +618,25 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
             s.pendingVerificationRetry = null;
             return "continue";
         }
+        else if (verdict.reason === "no-host-checks" &&
+            taskAlreadyComplete &&
+            detectWebApp(s.basePath) &&
+            !result.runtimeErrors?.some((e) => e.blocking)) {
+            s.verificationRetryCount.delete(retryKey);
+            s.verificationRetryFailureHashes.delete(retryKey);
+            s.pendingVerificationRetry = null;
+            ctx.ui.notify("No task-level host verification command was found for a completed browser-facing task; continuing so slice UAT can verify the UI with browser tools.", "warning");
+            return "continue";
+        }
         else if (verdict.reason === "no-host-checks") {
             s.verificationRetryCount.delete(retryKey);
             s.verificationRetryFailureHashes.delete(retryKey);
             s.pendingVerificationRetry = null;
-            ctx.ui.notify("Verification gate FAILED — no runnable host-owned verification checks were discovered. Pausing for human review.", "error");
+            const pauseMessage = `Verification failed: ${verdict.failureContext}`;
+            ctx.ui.notify(`Verification gate FAILED — ${verdict.failureContext}`, "error");
             process.stderr.write(`verification-gate: ${verdict.failureContext}\n`);
             await pauseAuto(ctx, pi, {
-                message: "Verification failed: no runnable host-owned verification checks were discovered.",
+                message: pauseMessage,
                 category: "unknown",
             });
             return "pause";

package/dist/resources/extensions/gsd/auto.js

@@ -557,6 +557,13 @@ export function getAutoModeStartModel() {
 export function setCurrentDispatchedModelId(model) {
     s.currentDispatchedModelId = model ? `${model.provider}/${model.id}` : null;
 }
+/**
+ * Update the active unit model after runtime recovery switches models mid-unit.
+ * The next session restore path reads this field before dispatching again.
+ */
+export function setCurrentUnitModelForRecovery(model) {
+    s.currentUnitModel = model;
+}
 // Tool tracking — delegates to auto-tool-tracking.ts
 export function markToolStart(toolCallId, toolName) {
     _markToolStart(toolCallId, s.active, toolName);
@@ -623,6 +630,35 @@ export function stopAutoRemote(projectRoot) {
         return { found: false, error: err.message };
     }
 }
+/**
+ * Force-stop a remote auto-mode session before stealing its lock.
+ * The normal stop path stays SIGTERM-only so cooperative sessions can clean up;
+ * this path is only for the explicit "Force start" action.
+ */
+export function forceStopAutoRemote(projectRoot) {
+    const lock = readCrashLock(projectRoot);
+    if (!lock)
+        return { found: false };
+    if (lock.pid === process.pid) {
+        clearLock(projectRoot);
+        return { found: false };
+    }
+    if (!isLockProcessAlive(lock)) {
+        clearLock(projectRoot);
+        return { found: false };
+    }
+    try {
+        process.kill(lock.pid, "SIGTERM");
+        if (isLockProcessAlive(lock)) {
+            process.kill(lock.pid, "SIGKILL");
+        }
+        clearLock(projectRoot);
+        return { found: true, pid: lock.pid };
+    }
+    catch (err) {
+        return { found: false, error: err.message };
+    }
+}
 /**
  * Check if a remote auto-mode session is running (from a different process).
  * Reads the crash lock, checks PID liveness, and returns session details.
@@ -1824,7 +1860,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     if (freshStartAssessment.classification === "running") {
         const pid = freshStartAssessment.lock?.pid;
         ctx.ui.notify(pid
-            ? `Another auto-mode session (PID ${pid}) appears to be running.\nStop it with \`kill ${pid}\` before starting a new session.`
+            ? `Another auto-mode session (PID ${pid}) appears to be running.\nRun \`/gsd stop\` for graceful shutdown, or choose "Force start" from \`/gsd auto\` to terminate it.`
             : "Another auto-mode session appears to be running.", "error");
         return;
     }

package/dist/resources/extensions/gsd/blocked-models.js

@@ -9,12 +9,16 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { withFileLockSync } from "./file-lock.js";
+const temporaryBlockedModels = new Map();
 function blockedModelsPath(basePath) {
     return join(gsdRoot(basePath), "runtime", "blocked-models.json");
 }
 function modelKey(provider, id) {
     return `${provider.toLowerCase()}/${id.toLowerCase()}`;
 }
+function temporaryModelKey(basePath, provider, id) {
+    return `${basePath}:${modelKey(provider, id)}`;
+}
 function readFileSafe(path) {
     if (!existsSync(path))
         return { version: 1, blocked: [] };
@@ -41,6 +45,30 @@ export function isModelBlocked(basePath, provider, id) {
     const target = modelKey(provider, id);
     return loadBlockedModels(basePath).some((e) => modelKey(e.provider, e.id) === target);
 }
+export function blockModelUntil(basePath, provider, id, blockedUntil, reason) {
+    const key = temporaryModelKey(basePath, provider, id);
+    if (blockedUntil <= Date.now()) {
+        temporaryBlockedModels.delete(key);
+        return;
+    }
+    temporaryBlockedModels.set(key, { provider, id, reason, blockedUntil });
+}
+export function isModelTemporarilyUnavailable(basePath, provider, id, now = Date.now()) {
+    if (!provider || !id)
+        return false;
+    const key = temporaryModelKey(basePath, provider, id);
+    const entry = temporaryBlockedModels.get(key);
+    if (!entry)
+        return false;
+    if (entry.blockedUntil <= now) {
+        temporaryBlockedModels.delete(key);
+        return false;
+    }
+    return true;
+}
+export function clearTemporaryModelBlocksForTest() {
+    temporaryBlockedModels.clear();
+}
 export function blockModel(basePath, provider, id, reason) {
     const path = blockedModelsPath(basePath);
     mkdirSync(dirname(path), { recursive: true });