@opengsd/gsd-pi 1.2.0-dev.fb12b103 → 1.2.0-dev.fbdca60b

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -33,7 +33,7 @@ import { debugLog } from "./debug-logger.js";
 import { buildSkillActivationBlock, buildSkillDiscoveryVars } from "./skill-activation.js";
 import { findMilestoneIds } from "./milestone-ids.js";
 import { buildRunUatPresentationForType, RUN_UAT_TOOL_PRESENTATION_PLAN_ID } from "./tool-presentation-plan.js";
-import { resolveEffectiveUatType, shouldDispatchUatForContent } from "./uat-policy.js";
+import { classifyUatContentForRun, shouldDispatchUatForContent, } from "./uat-policy.js";
 import { buildWebAppUatGuidanceBlock } from "./web-app-uat.js";
 export { buildSkillActivationBlock, buildSkillDiscoveryVars };
 // ─── Preamble Cap ─────────────────────────────────────────────────────────────
@@ -843,7 +843,7 @@ export async function inlineDecisionsFromDb(base, milestoneId, scope, level) {
 }
 /**
  * Inline requirements with optional milestone and slice scoping from the DB.
- * Falls back to filesystem via inlineGsdRootFile when DB unavailable or empty.
+ * Falls back to filesystem via inlineGsdRootFile only when DB is unavailable.
  */
 export async function inlineRequirementsFromDb(base, milestoneId, sliceId, level) {
     const inlineLevel = level ?? resolveInlineLevel();
@@ -851,14 +851,28 @@ export async function inlineRequirementsFromDb(base, milestoneId, sliceId, level
         const { isDbAvailable } = await import("./gsd-db.js");
         if (isDbAvailable()) {
             const { queryRequirements, formatRequirementsForPrompt } = await import("./context-store.js");
-            const requirements = queryRequirements({ milestoneId, sliceId });
+            let requirements = queryRequirements({ milestoneId, sliceId });
+            let broadenedScope = false;
+            if (requirements.length === 0 && sliceId) {
+                requirements = queryRequirements({ milestoneId });
+                broadenedScope = true;
+            }
+            if (requirements.length === 0 && milestoneId) {
+                requirements = queryRequirements({ status: "active" });
+                broadenedScope = true;
+            }
             if (requirements.length > 0) {
-                // Use compact format for non-full levels to save ~40% tokens
-                const formatted = inlineLevel !== "full"
+                // Use compact format for non-full levels, milestone-scoped calls, and
+                // any cascade stage that broadened past the originally requested scope —
+                // a slice-scoped "full" call that fell through to the project-wide
+                // active fallback must not format those rows as full requirements.
+                const useCompact = inlineLevel !== "full" || !sliceId || broadenedScope;
+                const formatted = useCompact
                     ? formatRequirementsCompact(requirements)
                     : formatRequirementsForPrompt(requirements);
                 return `### Requirements\nSource: \`.gsd/REQUIREMENTS.md\`\n\n${formatted}`;
             }
+            return null;
         }
     }
     catch (err) {
@@ -1267,6 +1281,32 @@ export async function checkNeedsReassessment(base, mid, state) {
  * - No UAT file exists for the slice
  * - UAT result file already exists (idempotent — already ran)
  */
+/**
+ * Resolve the effective UAT mode for the dispatch gate the same way
+ * `buildRunUatPrompt` does: classify the UAT body with the slice's SUMMARY as
+ * supplemental context, so a `browser-executable` UAT whose slice references a
+ * self-contained harness (`npm run test:uat`, `search-uat.mjs`, `npx
+ * playwright test`) is promoted to `runtime-executable` for the gate too.
+ *
+ * Without this, `checkNeedsRunUat` returns `browser-executable` while the
+ * prompt instructs runtime-only execution, causing the dispatch gate to
+ * require browser tools / warm up the browser daemon (or stop dispatch when
+ * browser MCP is unavailable) for UAT runs that never touch the browser. See
+ * cursor[bot] review on PR #696 for the M007/S01 regression.
+ */
+async function resolveRunUatEffectiveType(base, mid, sliceId, uatContent) {
+    let summaryContent = "";
+    try {
+        const summaryPath = resolveSliceFile(base, mid, sliceId, "SUMMARY");
+        if (summaryPath) {
+            summaryContent = (await loadFile(summaryPath)) ?? "";
+        }
+    }
+    catch (err) {
+        logWarning("prompt", `resolveRunUatEffectiveType SUMMARY load failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return classifyUatContentForRun(uatContent, summaryContent).effectiveType;
+}
 export async function checkNeedsRunUat(base, mid, state, prefs) {
     // DB primary path — fall through to file-based when DB has no data for this milestone
     try {
@@ -1299,7 +1339,8 @@ export async function checkNeedsRunUat(base, mid, state, prefs) {
                     }
                     if (!shouldDispatchUatForContent(uatContent, prefs))
                         continue;
-                    return { sliceId: sid, uatType: resolveEffectiveUatType(uatContent) };
+                    const uatType = await resolveRunUatEffectiveType(base, mid, sid, uatContent);
+                    return { sliceId: sid, uatType };
                 }
                 return null;
             }
@@ -1340,7 +1381,8 @@ export async function checkNeedsRunUat(base, mid, state, prefs) {
         }
         if (!shouldDispatchUatForContent(uatContentFb, prefs))
             continue;
-        return { sliceId: uatSid, uatType: resolveEffectiveUatType(uatContentFb) };
+        const uatType = await resolveRunUatEffectiveType(base, mid, uatSid, uatContentFb);
+        return { sliceId: uatSid, uatType };
     }
     return null;
 }
@@ -3099,10 +3141,25 @@ export async function buildRunUatPrompt(mid, sliceId, uatPath, uatContent, base)
     const rawInlinedContext = `## Inlined Context (preloaded — do not re-read these files)\n\n${composedBody}`;
     const cappedInlinedContext = capPreamble(rawInlinedContext);
     trackPromptContext(contextTelemetry, "cap", cappedInlinedContext.length < rawInlinedContext.length ? "skipped" : "inline", null, cappedInlinedContext.length < rawInlinedContext.length ? `dropped ${rawInlinedContext.length - cappedInlinedContext.length} chars` : "within budget");
-    const inlinedContext = prependContextModeToBlock("run-uat", base, cappedInlinedContext);
+    const uatPolicy = classifyUatContentForRun(uatContent, cappedInlinedContext);
+    const uatType = uatPolicy.effectiveType;
+    const runtimeHarnessOverride = uatPolicy.declaredType === "browser-executable" && uatType === "runtime-executable"
+        ? [
+            "## Runtime harness override",
+            "",
+            "This UAT declares `browser-executable` but the slice references a self-contained verification command (`npm run test:uat`, `search-uat.mjs`, or similar).",
+            "Run **only** that command via `gsd_uat_exec` with `uat-runtime-check` intent.",
+            "Do **not** call `uat-service-start`, do **not** run `npm run start`, `npm run test:server`, or any separate server command.",
+            "Do **not** use `browser_navigate` or other `browser_*` tools — the harness already exercises the browser.",
+            "When the harness exits 0, save **PASS** with `uatType: \"runtime-executable\"` (the effective mode above, not the UAT file header) and **runtime** check modes only.",
+            "",
+        ].join("\n")
+        : "";
+    const inlinedContext = prependContextModeToBlock("run-uat", base, runtimeHarnessOverride
+        ? `${runtimeHarnessOverride}\n${cappedInlinedContext}`
+        : cappedInlinedContext);
     emitPromptContextTelemetry("run-uat", contextTelemetry, inlinedContext);
     const uatResultPath = join(base, relSliceFile(base, mid, sliceId, "ASSESSMENT"));
-    const uatType = resolveEffectiveUatType(uatContent);
     const canonicalPresentation = JSON.stringify(buildRunUatPresentationForType(uatType), null, 2);
     return loadPrompt("run-uat", {
         workingDirectory: base,

package/dist/resources/extensions/gsd/auto-start.js

@@ -18,6 +18,7 @@ import { ensureGsdSymlink, isInheritedRepo, validateProjectId } from "./repo-ide
 import { migrateToExternalState, recoverFailedMigration } from "./migrate-external.js";
 import { collectSecretsFromManifest } from "../get-secrets-from-user.js";
 import { gsdRoot, resolveMilestoneFile } from "./paths.js";
+import { milestoneEntryBlockedGuidance } from "./guidance.js";
 import { invalidateAllCaches } from "./cache.js";
 import { writeLock, clearLock, readCrashLock, isLockProcessAlive } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
@@ -975,9 +976,26 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 state = await deriveState(wtPath);
             }
         }
-        const blockingStrandedRecoveryAction = state.activeMilestone
-            ? strandedRecoveryActions.find((action) => action.milestoneId !== state.activeMilestone?.id) ?? strandedRecoveryAction
-            : strandedRecoveryAction;
+        const requestedMilestoneLock = process.env.GSD_MILESTONE_LOCK?.trim() || null;
+        const lockedActiveMilestone = requestedMilestoneLock && state.activeMilestone?.id === requestedMilestoneLock;
+        let blockingStrandedRecoveryAction;
+        if (lockedActiveMilestone) {
+            // Parallel worker or explicit `/gsd auto Mxxx`: sibling milestones'
+            // stranded work must not block this milestone's resumption, and the
+            // downstream `strandedRecoveryAction` (used for currentMilestoneId,
+            // setActiveMilestoneId, and adoptStrandedMilestone) must be scoped to
+            // the locked milestone only. Falling back to the first sibling action
+            // would mis-target adoption (#742).
+            const lockMatch = strandedRecoveryActions.find((action) => action.milestoneId === requestedMilestoneLock) ?? null;
+            blockingStrandedRecoveryAction = lockMatch;
+            strandedRecoveryAction = lockMatch;
+        }
+        else if (state.activeMilestone) {
+            blockingStrandedRecoveryAction = strandedRecoveryActions.find((action) => action.milestoneId !== state.activeMilestone?.id) ?? strandedRecoveryAction;
+        }
+        else {
+            blockingStrandedRecoveryAction = strandedRecoveryAction;
+        }
         if (blockingStrandedRecoveryAction) {
             if (!state.activeMilestone) {
                 ctx.ui.notify(formatStrandedWorkBlockerMessage(blockingStrandedRecoveryAction, null), "error");
@@ -990,6 +1008,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             strandedRecoveryAction = blockingStrandedRecoveryAction;
             ctx.ui.notify(formatStrandedWorkRecoveryMessage(strandedRecoveryAction), "info");
         }
+        else if (lockedActiveMilestone) {
+            strandedRecoveryAction = null;
+        }
         if (process.env.GSD_HEADLESS === "1" &&
             orphanAuditRecovered &&
             !state.activeMilestone &&
@@ -1272,11 +1293,8 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 if (enterResult.reason === "lease-conflict") {
                     ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: lease is held by another worker.`, "error");
                 }
-                else if (enterResult.reason === "creation-failed") {
-                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: worktree/branch creation failed. Isolation is degraded.`, "error");
-                }
-                else if (enterResult.reason === "isolation-degraded") {
-                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: isolation is degraded from a prior worktree failure. Close processes locking the worktree and retry, or run /gsd doctor fix.`, "error");
+                else if (enterResult.reason === "creation-failed" || enterResult.reason === "isolation-degraded") {
+                    ctx.ui.notify(milestoneEntryBlockedGuidance(s.currentMilestoneId, enterResult.reason), "error");
                 }
                 else if (enterResult.reason === "invalid-milestone-id") {
                     ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: milestone id is invalid.`, "error");

package/dist/resources/extensions/gsd/auto-unit-closeout.js

@@ -36,17 +36,17 @@ export function isSuspiciousGhostCompletion(ctx, startedAt, maxElapsedMs = GHOST
         activity.assistantMessages === 0);
 }
 /**
- * Snapshot metrics, save activity log, and fire-and-forget memory extraction
- * for a completed unit. Returns the activity log file path (if any).
+ * Snapshot metrics, save activity log, extract memories, and record the git
+ * transaction for a completed auto-mode unit.
  */
-export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, opts) {
-    const modelId = ctx.model?.id ?? "unknown";
-    snapshotUnitMetrics(ctx, unitType, unitId, startedAt, modelId, opts);
-    const activityFile = saveActivityLog(ctx, basePath, unitType, unitId);
+export async function closeoutAutoUnit(request) {
+    const modelId = request.ctx.model?.id ?? "unknown";
+    snapshotUnitMetrics(request.ctx, request.unitType, request.unitId, request.startedAt, modelId, request.opts);
+    const activityFile = saveActivityLog(request.ctx, request.basePath, request.unitType, request.unitId);
     if (activityFile) {
         try {
-            const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import('./memory-extractor.js');
-            const llmCallFn = buildMemoryLLMCall(ctx);
+            const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import("./memory-extractor.js");
+            const llmCallFn = buildMemoryLLMCall(request.ctx);
             if (llmCallFn) {
                 // Awaited: a fire-and-forget here lets memory-extractor writes land in
                 // .gsd/ after closeoutUnit returns but before the milestone merge
@@ -55,10 +55,10 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
                 // bounded by the extractor's LLM call, which is the acceptable price
                 // for not racing the merge boundary.
                 try {
-                    await extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn);
+                    await extractMemoriesFromUnit(activityFile, request.unitType, request.unitId, llmCallFn);
                 }
                 catch (err) {
-                    logWarning("engine", `memory extraction failed for ${unitType}/${unitId}: ${err.message}`);
+                    logWarning("engine", `memory extraction failed for ${request.unitType}/${request.unitId}: ${err.message}`);
                 }
             }
         }
@@ -66,22 +66,46 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
             logWarning("engine", `operation failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    if (opts?.traceId && opts.turnId && opts.gitAction && opts.gitStatus) {
+    const gitTransaction = resolveGitTransactionOptions(request.opts);
+    if (gitTransaction) {
         writeTurnGitTransaction({
-            basePath,
-            traceId: opts.traceId,
-            turnId: opts.turnId,
-            unitType,
-            unitId,
+            basePath: request.basePath,
+            traceId: gitTransaction.traceId,
+            turnId: gitTransaction.turnId,
+            unitType: request.unitType,
+            unitId: request.unitId,
             stage: "record",
-            action: opts.gitAction,
-            push: opts.gitPush === true,
-            status: opts.gitStatus,
-            error: opts.gitError,
+            action: gitTransaction.gitAction,
+            push: gitTransaction.gitPush === true,
+            status: gitTransaction.gitStatus,
+            error: gitTransaction.gitError,
             metadata: {
                 activityFile,
             },
         });
     }
-    return activityFile ?? undefined;
+    return {
+        ...(activityFile ? { activityFile } : {}),
+        gitTransactionRecorded: Boolean(gitTransaction),
+    };
+}
+function resolveGitTransactionOptions(opts) {
+    if (!opts?.traceId || !opts.turnId || !opts.gitAction || !opts.gitStatus)
+        return null;
+    return {
+        traceId: opts.traceId,
+        turnId: opts.turnId,
+        gitAction: opts.gitAction,
+        gitStatus: opts.gitStatus,
+        gitPush: opts.gitPush,
+        gitError: opts.gitError,
+    };
+}
+/**
+ * Compatibility wrapper for existing auto-loop callers. New code should prefer
+ * closeoutAutoUnit so the closeout request and result stay explicit.
+ */
+export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, opts) {
+    const result = await closeoutAutoUnit({ ctx, basePath, unitType, unitId, startedAt, opts });
+    return result.activityFile;
 }

package/dist/resources/extensions/gsd/auto-unit-tool-scope.js

@@ -1,6 +1,7 @@
 import { parseUnitId } from "./unit-id.js";
 import { AUTO_UNIT_SCOPED_TOOLS, getForbiddenGsdToolReason, } from "./unit-tool-contracts.js";
-import { WORKFLOW_TOOL_ALIAS_PAIRS, canonicalWorkflowSurfaceToolName, isWorkflowSurfaceAliasTool, stripMcpToolPrefix, } from "./workflow-tool-surface.js";
+import { WORKFLOW_TOOL_ALIAS_PAIRS, isWorkflowSurfaceAliasTool, stripMcpToolPrefix, } from "./workflow-tool-surface.js";
+import { canonicalWorkflowToolName } from "./engine-hook-contract.js";
 export { AUTO_UNIT_SCOPED_TOOLS, RUN_UAT_BROWSER_TOOL_NAMES, } from "./unit-tool-contracts.js";
 // Scope-class membership is declared per unit in the Unit Registry (ADR-033).
 // EXECUTE_TASK_UNIT_TYPES = scopeClass "execute-task"; the section-close gate
@@ -22,9 +23,9 @@ const SCOPED_GSD_LIFECYCLE_TOOLS = new Set([
     .map(canonicalWorkflowToolName));
 export const GSD_PHASE_SCOPE_DISPLAY_REASON = "This GSD phase only allows its scoped workflow tools.";
 export const GSD_SECTION_CLOSE_GATE_DISPLAY_REASON = "Gates here close by writing summary sections — gsd_save_gate_result isn't needed.";
-export function canonicalWorkflowToolName(toolName) {
-    return canonicalWorkflowSurfaceToolName(toolName);
-}
+// Normalizer seam lives in engine-hook-contract.ts; re-exported here for
+// existing scope importers.
+export { canonicalWorkflowToolName };
 export function isWorkflowAliasTool(toolName) {
     return isWorkflowSurfaceAliasTool(toolName);
 }

package/dist/resources/extensions/gsd/auto-verification.js

@@ -1,7 +1,7 @@
 // Project/App: gsd-pi
 // File Purpose: Post-unit verification gate for GSD auto-mode units.
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { gsdProjectionRoot, resolveSlicePath, resolveMilestoneFile } from "./paths.js";
+import { gsdProjectionRoot, resolveSlicePath } from "./paths.js";
 import { resolveMilestoneValidationVerdict } from "./milestone-validation-verdict.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
 import { parseUnitId } from "./unit-id.js";
@@ -9,8 +9,6 @@ import { isDbAvailable, getTask, getSliceTasks, getMilestoneSlices } from "./gsd
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { isClosedStatus } from "./status-guards.js";
 import { loadFile } from "./files.js";
-import { parseRoadmap } from "./parsers-legacy.js";
-import { isMilestoneComplete } from "./state.js";
 import { runVerificationGate, runVerificationGateForTargets, formatFailureContext, captureRuntimeErrors, runDependencyAudit, } from "./verification-gate.js";
 import { writeVerificationJSON } from "./verification-evidence.js";
 import { logWarning } from "./workflow-logger.js";
@@ -25,6 +23,7 @@ import { getSlice } from "./gsd-db.js";
 import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { formatPostUnitStatusCard } from "./auto-status-message.js";
+import { detectWebApp } from "./web-app-uat.js";
 function getCurrentUnitCostStats(unitId) {
     const ledger = getLedger();
     if (!ledger || !Array.isArray(ledger.units) || ledger.units.length === 0) {
@@ -274,32 +273,15 @@ async function runValidateMilestonePostCheck(vctx, pauseAuto) {
  * DB-backed projects are authoritative (#4094 peer review); falls back to
  * roadmap parsing only when the DB is unavailable.
  */
-async function countIncompleteSlices(basePath, milestoneId) {
-    if (isDbAvailable()) {
-        const slices = getMilestoneSlices(milestoneId);
-        if (slices.length === 0) {
-            // No DB rows — treat as "unknown", do not pause.
-            return 1;
-        }
-        return slices.filter((slice) => !isClosedStatus(slice.status)).length;
-    }
-    // Filesystem fallback: parse the roadmap markdown.
-    try {
-        const roadmapFile = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
-        if (!roadmapFile)
-            return 1;
-        const roadmapContent = await loadFile(roadmapFile);
-        if (!roadmapContent)
-            return 1;
-        const roadmap = parseRoadmap(roadmapContent);
-        if (roadmap.slices.length === 0)
-            return 1;
-        return isMilestoneComplete(roadmap) ? 0 : 1;
-    }
-    catch {
-        // Parsing failures should not cause false-positive pauses.
+async function countIncompleteSlices(_basePath, milestoneId) {
+    // DB-authoritative (ADR-017): no markdown fallback. DB unavailable or no
+    // rows means "unknown" — do not pause.
+    if (!isDbAvailable())
         return 1;
-    }
+    const slices = getMilestoneSlices(milestoneId);
+    if (slices.length === 0)
+        return 1;
+    return slices.filter((slice) => !isClosedStatus(slice.status)).length;
 }
 /**
  * Run the verification gate for the current execute-task unit.
@@ -636,14 +618,25 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
             s.pendingVerificationRetry = null;
             return "continue";
         }
+        else if (verdict.reason === "no-host-checks" &&
+            taskAlreadyComplete &&
+            detectWebApp(s.basePath) &&
+            !result.runtimeErrors?.some((e) => e.blocking)) {
+            s.verificationRetryCount.delete(retryKey);
+            s.verificationRetryFailureHashes.delete(retryKey);
+            s.pendingVerificationRetry = null;
+            ctx.ui.notify("No task-level host verification command was found for a completed browser-facing task; continuing so slice UAT can verify the UI with browser tools.", "warning");
+            return "continue";
+        }
         else if (verdict.reason === "no-host-checks") {
             s.verificationRetryCount.delete(retryKey);
             s.verificationRetryFailureHashes.delete(retryKey);
             s.pendingVerificationRetry = null;
-            ctx.ui.notify("Verification gate FAILED — no runnable host-owned verification checks were discovered. Pausing for human review.", "error");
+            const pauseMessage = `Verification failed: ${verdict.failureContext}`;
+            ctx.ui.notify(`Verification gate FAILED — ${verdict.failureContext}`, "error");
             process.stderr.write(`verification-gate: ${verdict.failureContext}\n`);
             await pauseAuto(ctx, pi, {
-                message: "Verification failed: no runnable host-owned verification checks were discovered.",
+                message: pauseMessage,
                 category: "unknown",
             });
             return "pause";

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -800,6 +800,14 @@ function _resolveIntegrationBranchForReuse(basePath, milestoneId) {
         return null;
     }
 }
+function safeCwd(fallback) {
+    try {
+        return process.cwd();
+    }
+    catch {
+        return fallback;
+    }
+}
 /**
  * When reusing an existing milestone branch, fast-forward it onto the
  * integration branch when that's safe (branch is a strict ancestor of
@@ -949,7 +957,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
     originalBasePath = resolveWorktreeProjectRoot(originalBasePath);
     const branch = autoWorktreeBranch(milestoneId);
     const { preserveBranch = false, preserveWorktree = false } = opts;
-    const previousCwd = process.cwd();
+    const previousCwd = safeCwd(originalBasePath);
     // Wrap the entire teardown body in a single try/finally so activeWorkspace
     // is ALWAYS cleared — even if process.chdir throws (e.g. originalBasePath
     // was deleted before teardown ran). Previously the finally only covered
@@ -1033,7 +1041,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
  * still works after process restart when module state has been reset.
  */
 export function isInAutoWorktree(basePath) {
-    const targetPath = isGsdWorktreePath(basePath) ? basePath : process.cwd();
+    const targetPath = isGsdWorktreePath(basePath) ? basePath : safeCwd("");
     if (!isGsdWorktreePath(targetPath))
         return false;
     const storedBase = getAutoWorktreeOriginalBase();
@@ -1901,6 +1909,11 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         }
         catch (err) {
             logWarning("worktree", `chdir to project root after merge failed: ${err instanceof Error ? err.message : String(err)}`);
+            debugLog("mergeMilestoneToMain", {
+                phase: "post-merge-chdir-failed",
+                target: originalBasePath_,
+                error: err instanceof Error ? err.message : String(err),
+            });
         }
     };
     let shouldCleanup = false;

package/dist/resources/extensions/gsd/auto.js

@@ -512,6 +512,16 @@ export function _warnIfWorktreeMissingForTest(worktreePath, milestoneId) {
     }
     return false;
 }
+export function anchorProcessCwdForAutoResume(basePath) {
+    try {
+        process.chdir(basePath);
+        return true;
+    }
+    catch (err) {
+        logWarning("session", `resume cwd anchor failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts", basePath });
+        return false;
+    }
+}
 export function isAutoPaused() {
     return s.paused;
 }
@@ -557,6 +567,13 @@ export function getAutoModeStartModel() {
 export function setCurrentDispatchedModelId(model) {
     s.currentDispatchedModelId = model ? `${model.provider}/${model.id}` : null;
 }
+/**
+ * Update the active unit model after runtime recovery switches models mid-unit.
+ * The next session restore path reads this field before dispatching again.
+ */
+export function setCurrentUnitModelForRecovery(model) {
+    s.currentUnitModel = model;
+}
 // Tool tracking — delegates to auto-tool-tracking.ts
 export function markToolStart(toolCallId, toolName) {
     _markToolStart(toolCallId, s.active, toolName);
@@ -623,6 +640,35 @@ export function stopAutoRemote(projectRoot) {
         return { found: false, error: err.message };
     }
 }
+/**
+ * Force-stop a remote auto-mode session before stealing its lock.
+ * The normal stop path stays SIGTERM-only so cooperative sessions can clean up;
+ * this path is only for the explicit "Force start" action.
+ */
+export function forceStopAutoRemote(projectRoot) {
+    const lock = readCrashLock(projectRoot);
+    if (!lock)
+        return { found: false };
+    if (lock.pid === process.pid) {
+        clearLock(projectRoot);
+        return { found: false };
+    }
+    if (!isLockProcessAlive(lock)) {
+        clearLock(projectRoot);
+        return { found: false };
+    }
+    try {
+        process.kill(lock.pid, "SIGTERM");
+        if (isLockProcessAlive(lock)) {
+            process.kill(lock.pid, "SIGKILL");
+        }
+        clearLock(projectRoot);
+        return { found: true, pid: lock.pid };
+    }
+    catch (err) {
+        return { found: false, error: err.message };
+    }
+}
 /**
  * Check if a remote auto-mode session is running (from a different process).
  * Reads the crash lock, checks PID liveness, and returns session details.
@@ -715,6 +761,9 @@ function pauseAutoUnitIdentityMatches(expected) {
         s.currentUnit.id === expected.id &&
         s.currentUnit.startedAt === expected.startedAt;
 }
+function shouldPreserveCoordinationForPause(errorContext) {
+    return errorContext?.category === "provider" && errorContext.isTransient === true;
+}
 function setLifecycleOutcome(ctx, input) {
     if (!ctx?.hasUI)
         return;
@@ -1549,7 +1598,7 @@ export async function pauseAuto(ctx, _pi, _errorContext, options = {}) {
         releaseSessionLock(lockBase());
         clearLock(lockBase());
     }
-    if (s.workerId) {
+    if (s.workerId && !shouldPreserveCoordinationForPause(_errorContext)) {
         try {
             if (s.currentMilestoneId && s.milestoneLeaseToken) {
                 releaseMilestoneLease(s.workerId, s.currentMilestoneId, s.milestoneLeaseToken);
@@ -1824,7 +1873,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     if (freshStartAssessment.classification === "running") {
         const pid = freshStartAssessment.lock?.pid;
         ctx.ui.notify(pid
-            ? `Another auto-mode session (PID ${pid}) appears to be running.\nStop it with \`kill ${pid}\` before starting a new session.`
+            ? `Another auto-mode session (PID ${pid}) appears to be running.\nRun \`/gsd stop\` for graceful shutdown, or choose "Force start" from \`/gsd auto\` to terminate it.`
             : "Another auto-mode session appears to be running.", "error");
         return;
     }
@@ -1994,6 +2043,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         }
         // ADR-016 phase 2 / B3 (#5621): paused-resume worktree-path adoption.
         buildLifecycle().resumeFromPausedSession(base, resumeWorktreePath);
+        anchorProcessCwdForAutoResume(s.basePath || base);
         // Rebuild scope now that s.basePath reflects the actual worktree (or project root).
         rebuildScope(s.basePath, s.currentMilestoneId);
         // Ensure the workflow-logger audit log is pinned to the project root

package/dist/resources/extensions/gsd/blocked-models.js

@@ -9,12 +9,16 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { withFileLockSync } from "./file-lock.js";
+const temporaryBlockedModels = new Map();
 function blockedModelsPath(basePath) {
     return join(gsdRoot(basePath), "runtime", "blocked-models.json");
 }
 function modelKey(provider, id) {
     return `${provider.toLowerCase()}/${id.toLowerCase()}`;
 }
+function temporaryModelKey(basePath, provider, id) {
+    return `${basePath}:${modelKey(provider, id)}`;
+}
 function readFileSafe(path) {
     if (!existsSync(path))
         return { version: 1, blocked: [] };
@@ -41,6 +45,30 @@ export function isModelBlocked(basePath, provider, id) {
     const target = modelKey(provider, id);
     return loadBlockedModels(basePath).some((e) => modelKey(e.provider, e.id) === target);
 }
+export function blockModelUntil(basePath, provider, id, blockedUntil, reason) {
+    const key = temporaryModelKey(basePath, provider, id);
+    if (blockedUntil <= Date.now()) {
+        temporaryBlockedModels.delete(key);
+        return;
+    }
+    temporaryBlockedModels.set(key, { provider, id, reason, blockedUntil });
+}
+export function isModelTemporarilyUnavailable(basePath, provider, id, now = Date.now()) {
+    if (!provider || !id)
+        return false;
+    const key = temporaryModelKey(basePath, provider, id);
+    const entry = temporaryBlockedModels.get(key);
+    if (!entry)
+        return false;
+    if (entry.blockedUntil <= now) {
+        temporaryBlockedModels.delete(key);
+        return false;
+    }
+    return true;
+}
+export function clearTemporaryModelBlocksForTest() {
+    temporaryBlockedModels.clear();
+}
 export function blockModel(basePath, provider, id, reason) {
     const path = blockedModelsPath(basePath);
     mkdirSync(dirname(path), { recursive: true });