@opengsd/gsd-pi 1.2.0-dev.fbdca60b → 1.3.0-dev.65546769

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -10,6 +10,7 @@ import { shouldIgnoreAgentEndForActiveUnit } from "../auto/unit-runner-events.js
 import { resolveModelId } from "../auto-model-selection.js";
 import { resolveProjectRoot } from "../worktree.js";
 import { clearDiscussionFlowState } from "./write-gate.js";
+import { scheduleFallbackContinuation } from "./fallback-continuation.js";
 import { clearGuidedUnitContext } from "../guided-unit-context.js";
 import { resumeAutoAfterProviderDelay } from "./provider-error-resume.js";
 import { classifyError, createRetryState, resetRetryState, isTransient, } from "../error-classifier.js";
@@ -104,7 +105,7 @@ async function tryProviderModelFallback(params) {
                     setCurrentUnitModelForRecovery(candidate);
                     setCurrentDispatchedModelId({ provider: candidate.provider, id: candidate.id });
                     switchedNotify(`${candidate.provider}/${candidate.id}`);
-                    pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
+                    scheduleFallbackContinuation(pi);
                     return true;
                 }
             }
@@ -123,7 +124,7 @@ async function tryProviderModelFallback(params) {
                 setCurrentUnitModelForRecovery(startModel);
                 setCurrentDispatchedModelId({ provider: startModel.provider, id: startModel.id });
                 switchedNotify(`${startModel.provider}/${startModel.id}`);
-                pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
+                scheduleFallbackContinuation(pi);
                 return true;
             }
         }
@@ -519,7 +520,27 @@ export async function handleAgentEnd(pi, event, ctx) {
         if (shouldDeferTransientErrorToCoreRetry(cls, rawErrorMsg)) {
             return;
         }
+        // ── Tool-schema overload: the active model repeatedly emitted tool-call
+        //    arguments that fail schema validation (e.g. a model whose tool-call
+        //    grammar can't satisfy GSD's schemas). Before hard-pausing, try the
+        //    unit's configured fallbacks and the auto-mode start model — the model
+        //    the user actually selected. This lets auto-mode recover by switching
+        //    back to a schema-capable model instead of aborting outright (#813).
+        //    Do not persistently block the model: schema-overload is request-shape
+        //    specific, mirroring the model-error path above.
         if (cls.kind === "tool-schema") {
+            const dash = getAutoDashboardData();
+            const switched = await tryProviderModelFallback({
+                ctx,
+                pi,
+                rejectedProvider: ctx.model?.provider,
+                rejectedId: ctx.model?.id,
+                basePath: dash.basePath,
+                unitType: dash.currentUnit?.type,
+                switchedNotify: (label) => ctx.ui.notify(`Switched to ${label} after repeated tool schema validation failures.`, "warning"),
+            });
+            if (switched)
+                return;
             await pauseAutoForProviderError(ctx.ui, errorDetail, () => pauseAuto(ctx, pi, {
                 message: `Tool schema error${errorDetail}`,
                 category: "tool-schema",
@@ -531,11 +552,13 @@ export async function handleAgentEnd(pi, event, ctx) {
             });
             return;
         }
-        // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli)
+        // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli, google-antigravity)
         // which use per-user quotas with shorter windows (#2922).
         if (cls.kind === "rate-limit") {
             const currentProvider = ctx.model?.provider;
-            if (currentProvider === "openai-codex" || currentProvider === "google-gemini-cli") {
+            if (currentProvider === "openai-codex"
+                || currentProvider === "google-gemini-cli"
+                || currentProvider === "google-antigravity") {
                 cls.retryAfterMs = Math.min(cls.retryAfterMs, 30_000);
             }
             const dash = getAutoDashboardData();
@@ -570,57 +593,22 @@ export async function handleAgentEnd(pi, event, ctx) {
         // --- Transient errors: try model fallback first, then pause ---
         // Rate limits are often per-model, so switching models can bypass them.
         if (cls.kind === "rate-limit" || cls.kind === "network" || cls.kind === "server" || cls.kind === "connection" || cls.kind === "stream") {
-            // Try model fallback
             const dash = getAutoDashboardData();
-            if (dash.currentUnit) {
-                const modelConfig = resolveModelWithFallbacksForUnit(dash.currentUnit.type);
-                if (modelConfig && modelConfig.fallbacks.length > 0) {
-                    const availableModels = ctx.modelRegistry.getAvailable();
-                    const nextModelId = getNextFallbackModel(ctx.model?.id, modelConfig);
-                    if (nextModelId) {
-                        retryState.networkRetryCount = 0;
-                        retryState.currentRetryModelId = undefined;
-                        const modelToSet = resolveModelId(nextModelId, availableModels, ctx.model?.provider);
-                        const modelUnavailable = dash.basePath && modelToSet
-                            ? isModelBlocked(dash.basePath, modelToSet.provider, modelToSet.id) ||
-                                isModelTemporarilyUnavailable(dash.basePath, modelToSet.provider, modelToSet.id)
-                            : false;
-                        if (modelToSet && !modelUnavailable) {
-                            const ok = await pi.setModel(modelToSet, { persist: false });
-                            if (ok) {
-                                setCurrentUnitModelForRecovery(modelToSet);
-                                setCurrentDispatchedModelId({ provider: modelToSet.provider, id: modelToSet.id });
-                                ctx.ui.notify(`Model error${errorDetail}. Switched to fallback: ${nextModelId} and resuming.`, "warning");
-                                pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
-                                return;
-                            }
-                        }
-                    }
-                }
-            }
-            // Try restoring session model
-            const sessionModel = getAutoModeStartModel();
-            if (sessionModel) {
-                const dash = getAutoDashboardData();
-                const sessionModelUnavailable = dash.basePath
-                    ? isModelBlocked(dash.basePath, sessionModel.provider, sessionModel.id) ||
-                        isModelTemporarilyUnavailable(dash.basePath, sessionModel.provider, sessionModel.id)
-                    : false;
-                if (!sessionModelUnavailable && (ctx.model?.id !== sessionModel.id || ctx.model?.provider !== sessionModel.provider)) {
-                    const startModel = ctx.modelRegistry.getAvailable().find((m) => m.provider === sessionModel.provider && m.id === sessionModel.id);
-                    if (startModel) {
-                        const ok = await pi.setModel(startModel, { persist: false });
-                        if (ok) {
-                            setCurrentUnitModelForRecovery(startModel);
-                            setCurrentDispatchedModelId({ provider: startModel.provider, id: startModel.id });
-                            retryState.networkRetryCount = 0;
-                            retryState.currentRetryModelId = undefined;
-                            ctx.ui.notify(`Model error${errorDetail}. Restored session model: ${sessionModel.provider}/${sessionModel.id} and resuming.`, "warning");
-                            pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
-                            return;
-                        }
-                    }
-                }
+            const switched = await tryProviderModelFallback({
+                ctx,
+                pi,
+                rejectedProvider: ctx.model?.provider,
+                rejectedId: ctx.model?.id,
+                basePath: dash.basePath,
+                unitType: dash.currentUnit?.type,
+                switchedNotify: (label) => {
+                    retryState.networkRetryCount = 0;
+                    retryState.currentRetryModelId = undefined;
+                    ctx.ui.notify(`Model error${errorDetail}. Switched to fallback: ${label} and resuming.`, "warning");
+                },
+            });
+            if (switched) {
+                return;
             }
         }
         // --- Transient fallback: pause with auto-resume ---

package/dist/resources/extensions/gsd/bootstrap/fallback-continuation.js

@@ -0,0 +1,25 @@
+// gsd-pi + src/resources/extensions/gsd/bootstrap/fallback-continuation.ts - Dispatches the post-fallback-switch continuation on a fresh turn.
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+/**
+ * Dispatch the post-fallback continuation on a *fresh* turn after the current
+ * run settles.
+ *
+ * #804: At `agent_end` time the agent's run is still tearing down — its
+ * `isStreaming` flag stays `true` until `finishRun()` clears it in the `finally`
+ * block that fires *after* the awaited `agent_end` listeners return (see
+ * pi-agent-core/src/agent.ts processEvents comment). A synchronous
+ * `sendMessage({ triggerTurn: true, deliverAs: "steer" })` from inside that
+ * listener is therefore routed down the `isStreaming` branch and queued as a
+ * steering message against the turn that just errored out — which is never
+ * consumed, so the fallback model is selected but no new turn ever starts (the
+ * reported symptom: "switched but work stays stopped").
+ *
+ * Deferring to a macrotask lets `finishRun()` flip `isStreaming` to `false`
+ * first; the plain `triggerTurn` (no `deliverAs`) then dispatches a fresh turn
+ * on the freshly-selected fallback model, mirroring the network-retry path.
+ */
+export function scheduleFallbackContinuation(pi) {
+    setTimeout(() => {
+        pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
+    }, 0);
+}

package/dist/resources/extensions/gsd/bootstrap/register-extension.js

@@ -12,7 +12,7 @@ import { registerScheduleWakeupTool } from "./schedule-wakeup-tool.js";
 import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
 import { writeCrashLog } from "./crash-log.js";
-import { logWarning } from "../workflow-logger.js";
+import { logWarning, isGsdExtensionStderrEnabled } from "../workflow-logger.js";
 import { UNIT_TOOL_CONTRACTS } from "../unit-tool-contracts.js";
 // Static import so cmux event listeners are registered synchronously during
 // extension bootstrap. Prior implementation used `void import().then()` which
@@ -37,6 +37,8 @@ export const CRITICAL_GSD_WORKFLOW_TOOL_NAMES = [...new Set(Object.values(UNIT_T
 /** Write to stderr without ever re-throwing — stderr can EPIPE too, which would
  *  re-enter this handler and re-loop. */
 function safeStderr(msg) {
+    if (!isGsdExtensionStderrEnabled())
+        return;
     try {
         process.stderr.write(msg);
     }
@@ -125,10 +127,30 @@ export function installEpipeGuard() {
         process.on("unhandledRejection", _gsdRejectionGuard);
     }
 }
+/**
+ * Assert that critical GSD workflow tools were registered.
+ *
+ * During extension loading, getAllTools() is a throwing stub
+ * ("Extension runtime not initialized") that only becomes real after
+ * runner.bindCore(). Calling it here used to throw, propagating to index.ts's
+ * catch and firing "Extension setup partially failed" — which, under Claude
+ * Code CLI, left the model's tool surface incomplete and trapped units in a
+ * finalize-retry loop. Tolerate the pre-bind throw and defer the real check to
+ * the first before_agent_start (where applyMinimalGsdToolSurface already
+ * re-reads the registered surface post-bind).
+ */
 function assertCriticalGsdWorkflowToolsRegistered(pi) {
     if (typeof pi.getAllTools !== "function")
         return;
-    const registered = new Set(pi.getAllTools().map((tool) => tool.name));
+    let registered;
+    try {
+        registered = new Set(pi.getAllTools().map((tool) => tool.name));
+    }
+    catch {
+        // Pre-bind runtime: getAllTools() is not yet wired. The critical-tools
+        // invariant is re-checked post-bind during the first before_agent_start.
+        return;
+    }
     const missing = CRITICAL_GSD_WORKFLOW_TOOL_NAMES.filter((toolName) => !registered.has(toolName));
     if (missing.length === 0)
         return;

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -1,13 +1,13 @@
 // Project/App: gsd-pi
 // File Purpose: Registers GSD extension runtime hooks and token-saving tool policies.
-import { existsSync, mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { isToolCallEventType } from "@gsd/pi-coding-agent";
 import { ALWAYS_PRESERVED_SHIM_TOOL_NAMES } from "@gsd/pi-ai";
 import { updateSnapshot } from "../ecosystem/gsd-extension-api.js";
-import { buildMilestoneFileName, clearPathCache, milestonesDir, resolveMilestonePath, resolveSliceFile, resolveSlicePath } from "../paths.js";
-import { applyAskUserQuestionsGateResult, clearDiscussionFlowState, formatPendingAskUserQuestionsGateMessage, hostWriteGateAdapter, isApprovalGateVerifiedInSnapshot, isDepthConfirmationAnswer, isMilestoneDepthVerified, isMilestoneDepthVerifiedInSnapshot, isQueuePhaseActive, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeWrite, isGateQuestionId, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
+import { buildMilestoneFileName, canonicalPhaseDirName, clearPathCache, milestonesDir, legacyMilestonesDir, resolveMilestonePath, resolveSliceFile, resolveSlicePath } from "../paths.js";
+import { applyAskUserQuestionsGateResult, clearDiscussionFlowState, formatPendingAskUserQuestionsGateMessage, formatTimedOutAskUserQuestionsGateMessage, hostWriteGateAdapter, isApprovalGateVerifiedInSnapshot, isDepthConfirmationAnswer, isMilestoneDepthVerified, isMilestoneDepthVerifiedInSnapshot, isQueuePhaseActive, resetWriteGateState, shouldBlockContextWrite, shouldBlockPlanningUnit, shouldBlockQueueExecution, shouldBlockWorktreeBash, shouldBlockWorktreeWrite, isGateQuestionId, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
 import { canonicalToolName } from "../engine-hook-contract.js";
 import { resolveManifest } from "../unit-context-manifest.js";
 import { isBlockedStateFile, isBashWriteToStateFile, BLOCKED_WRITE_ERROR } from "../write-intercept.js";
@@ -21,7 +21,7 @@ import { recordToolCall as safetyRecordToolCall, recordToolResult as safetyRecor
 import { parseUnitId } from "../unit-id.js";
 import { classifyCommand } from "../safety/destructive-guard.js";
 import { confirmDestructiveCommand, consumeDestructiveConfirmation, isDestructiveConfirmGateId, requestDestructiveConfirmation, } from "../safety/destructive-confirmation.js";
-import { logWarning as safetyLogWarning } from "../workflow-logger.js";
+import { logWarning as safetyLogWarning, setStderrLoggingEnabled } from "../workflow-logger.js";
 import { isUnitCloseoutTool, runInteractiveUnitCloseout } from "../unit-closeout.js";
 import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
@@ -110,6 +110,15 @@ async function installWelcomeHeader(ctx) {
         /* non-fatal */
     }
 }
+/** Suppress the startup welcome banner without restoring the built-in pi header. */
+function suppressWelcomeHeader(ctx) {
+    if (!ctx.hasUI || typeof ctx.ui?.setHeader !== "function")
+        return;
+    ctx.ui.setHeader(() => ({
+        render() { return []; },
+        invalidate() { },
+    }));
+}
 /**
  * Approval gates whose durable arming is deferred until tool execution /
  * agent end, keyed by basePath. A Map (not a single slot) so concurrent
@@ -517,7 +526,7 @@ function isContextDraftSummarySave(toolName, input) {
  */
 function resolveAskUserQuestionsGateDetails(event) {
     const hasRoundShape = (value) => !!value && typeof value === "object" &&
-        (value.cancelled !== undefined || value.response !== undefined);
+        (value.cancelled !== undefined || value.timed_out !== undefined || value.response !== undefined);
     const details = event.details;
     if (hasRoundShape(details))
         return details;
@@ -557,8 +566,24 @@ function formatQuestionExchange(questions, answers) {
     return lines.join("\n");
 }
 async function ensureMilestoneShell(basePath, milestoneId) {
+    // When no milestone dir exists yet, prefer the legacy container when it has
+    // at least one milestone subdirectory; an empty milestones/ dir (e.g. one
+    // created by an old bootstrapGsdProject) is not a real legacy layout.
+    const legacy = legacyMilestonesDir(basePath);
+    const isLegacyLayout = existsSync(legacy) && (() => {
+        try {
+            return readdirSync(legacy).some(e => statSync(join(legacy, e)).isDirectory());
+        }
+        catch {
+            return false;
+        }
+    })();
+    const container = isLegacyLayout ? legacy : milestonesDir(basePath);
+    const fallbackDirName = isLegacyLayout
+        ? milestoneId
+        : canonicalPhaseDirName(milestoneId, `New milestone ${milestoneId}`);
     const milestoneDir = resolveMilestonePath(basePath, milestoneId)
-        ?? join(milestonesDir(basePath), milestoneId);
+        ?? join(container, fallbackDirName);
     mkdirSync(milestoneDir, { recursive: true });
     clearPathCache();
     try {
@@ -584,10 +609,14 @@ async function saveDiscussionQuestionRound(basePath, milestoneId, questions, det
     const answers = details?.response?.answers;
     const timestamp = new Date().toISOString();
     const exchange = formatQuestionExchange(questions, answers);
-    const discussionPath = join(milestoneDir, buildMilestoneFileName(milestoneId, "DISCUSSION"));
+    // Layout-aware filename: legacy dirs use MID-SUFFIX.md; flat-phase use NN-SUFFIX.md.
+    const legacyBase = legacyMilestonesDir(basePath);
+    const isLegacyDir = milestoneDir.startsWith(legacyBase + "/") || milestoneDir.startsWith(legacyBase + "\\");
+    const milestoneFileName = (suffix) => isLegacyDir ? `${milestoneId}-${suffix}.md` : buildMilestoneFileName(milestoneId, suffix);
+    const discussionPath = join(milestoneDir, milestoneFileName("DISCUSSION"));
     const existingDiscussion = await loadFile(discussionPath) ?? `# ${milestoneId} Discussion Log\n\n`;
     await saveFile(discussionPath, `${existingDiscussion}## Exchange — ${timestamp}\n\n${exchange}---\n\n`);
-    const draftPath = join(milestoneDir, buildMilestoneFileName(milestoneId, "CONTEXT-DRAFT"));
+    const draftPath = join(milestoneDir, milestoneFileName("CONTEXT-DRAFT"));
     const existingDraft = await loadFile(draftPath);
     const draftHeader = existingDraft
         ?? [
@@ -629,6 +658,9 @@ function initSessionNotifications(ctx) {
     installNotifyInterceptor(ctx);
     initNotificationWidget(ctx);
     notifyPreferenceDiagnostics(ctx, contextBasePath(ctx), { surface: "session-start" });
+    if (ctx.hasUI) {
+        setStderrLoggingEnabled(false);
+    }
 }
 async function prepareWorkflowMcpForHookContext(ctx, basePath) {
     // Skip MCP auto-prep when running inside an auto-worktree. The worktree
@@ -663,6 +695,29 @@ export function registerHooks(pi, ecosystemHandlers) {
         await applyDisabledModelProviderPolicy(ctx);
         await applyCompactionThresholdOverride(ctx);
         await prepareWorkflowMcpForHookContext(ctx, basePath);
+        // Migrate legacy .gsd/milestones/ to flat-phase .gsd/phases/ when detected.
+        // Best-effort — never blocks session startup. Skipped inside auto-worktrees
+        // (migration already ran on the project root before the worktree was created).
+        try {
+            const { isInAutoWorktree } = await import("../auto-worktree.js");
+            if (!isInAutoWorktree(basePath)) {
+                const { needsFlatPhaseMigration } = await import("../flat-phase-migration.js");
+                if (needsFlatPhaseMigration(basePath)) {
+                    const { ensureDbOpen } = await import("./dynamic-tools.js");
+                    const opened = await ensureDbOpen(basePath);
+                    if (opened) {
+                        const { migrateToFlatPhase } = await import("../flat-phase-migration.js");
+                        await migrateToFlatPhase(basePath);
+                    }
+                    else {
+                        safetyLogWarning("bootstrap", "flat-phase migration deferred: legacy .gsd/milestones/ layout detected but the workflow database could not be opened — will retry on next session");
+                    }
+                }
+            }
+        }
+        catch (err) {
+            safetyLogWarning("bootstrap", `flat-phase migration: ${err instanceof Error ? err.message : String(err)}`);
+        }
         // Apply show_token_cost preference (#1515)
         try {
             const { loadEffectiveGSDPreferences } = await import("../preferences.js");
@@ -671,7 +726,15 @@ export function registerHooks(pi, ecosystemHandlers) {
         }
         catch { /* non-fatal */ }
         if (!preserveCloseoutSurface) {
-            await installWelcomeHeader(ctx);
+            // Per-unit newSession() during auto/step runs fires session_start again.
+            // Keep the welcome banner startup-only — do not overwrite the empty header
+            // that updateProgressWidget installs once work begins.
+            if (isAutoActive() || isAutoPaused()) {
+                suppressWelcomeHeader(ctx);
+            }
+            else {
+                await installWelcomeHeader(ctx);
+            }
         }
         await loadToolApiKeysForSession();
         if (isAutoActive() || preserveCloseoutSurface) {
@@ -818,6 +881,10 @@ export function registerHooks(pi, ecosystemHandlers) {
     pi.on("message_end", async (event) => {
         const { suppressTerminalDeletedWorktreeMessageEnd } = await import("./agent-end-recovery.js");
         suppressTerminalDeletedWorktreeMessageEnd(event);
+        if (isAutoActive()) {
+            const { sanitizePrematureCloseoutMessageEnd } = await import("../auto-closeout-messaging.js");
+            sanitizePrematureCloseoutMessageEnd(event);
+        }
     });
     // Squash-merge quick-task branch back to the original branch after the
     // agent turn completes (#2668). cleanupQuickBranch is a no-op when no
@@ -1094,6 +1161,11 @@ export function registerHooks(pi, ecosystemHandlers) {
             if (wtGuard.block)
                 return wtGuard;
         }
+        if (isToolCallEventType("bash", event)) {
+            const wtBashGuard = shouldBlockWorktreeBash(event.input.command, dash.basePath ?? discussionBasePath, isAutoActive(), dash.currentUnit?.type);
+            if (wtBashGuard.block)
+                return wtBashGuard;
+        }
         // ── Single-writer engine: block direct writes to STATE.md ──────────
         // Covers write, edit, and bash tools to prevent bypass vectors.
         if (isToolCallEventType("write", event)) {
@@ -1252,6 +1324,23 @@ export function registerHooks(pi, ecosystemHandlers) {
                     }],
             };
         }
+        if (gateResult.status === "timeout") {
+            // Host elicitation timed out before the user answered. The gate stays
+            // pending (fail-closed), but we reset the loop guard and return a
+            // timeout-specific message so the model does NOT immediately re-ask —
+            // that would just hit the same timeout again. Auto-mode pauses and
+            // waits for the user to respond on a new turn (#852).
+            resetToolCallLoopGuard();
+            if (ctx) {
+                await maybePauseAutoForApprovalGate(ctx, pi, true, "Depth confirmation timed out waiting for a response — pausing auto-mode. Reply to resume.");
+            }
+            return {
+                content: [{
+                        type: "text",
+                        text: formatTimedOutAskUserQuestionsGateMessage(gateResult.pendingGateId),
+                    }],
+            };
+        }
         if (gateResult.status === "verified") {
             clearDeferredApprovalGate(basePath);
         }
@@ -1269,6 +1358,16 @@ export function registerHooks(pi, ecosystemHandlers) {
             }
             return;
         }
+        if (roundOutcome === "timeout") {
+            // Non-gate (consent/decision) question timed out at the host elicitation.
+            // Same policy as the gate-timeout branch above: reset the loop guard and
+            // pause-and-wait so the model does not re-ask into the same timeout (#852).
+            resetToolCallLoopGuard();
+            if (ctx) {
+                await maybePauseAutoForApprovalGate(ctx, pi, true, "A user question timed out waiting for a response — pausing auto-mode. Reply to resume.");
+            }
+            return;
+        }
         if (roundOutcome === "waiting") {
             resetToolCallLoopGuard();
             if (ctx) {