@opengsd/gsd-pi 1.2.0 → 1.3.0-dev.72e3af2a

package/dist/resources/extensions/gsd/auto-start.js

@@ -11,12 +11,15 @@
  * remains in auto.ts — this module handles only the fresh-start path.
  */
 import { deriveState } from "./state.js";
+import { findWorktreeSegment, isGsdWorktreePath } from "./worktree-root.js";
 import { loadFile, getManifestStatus } from "./files.js";
-import { loadEffectiveGSDPreferences, resolveSkillDiscoveryMode, getIsolationMode, } from "./preferences.js";
+import { loadEffectiveGSDPreferences, loadEffectiveGSDPreferencesWithRegistry, modelIdsForProfileResolution, resolveProfileAnchorProvider, resolveDisabledModelProvidersFromPreferences, resolveSkillDiscoveryMode, getIsolationMode, } from "./preferences.js";
 import { ensureGsdSymlink, isInheritedRepo, validateProjectId } from "./repo-identity.js";
 import { migrateToExternalState, recoverFailedMigration } from "./migrate-external.js";
 import { collectSecretsFromManifest } from "../get-secrets-from-user.js";
 import { gsdRoot, resolveMilestoneFile } from "./paths.js";
+import { findMilestoneIds } from "./milestone-ids.js";
+import { milestoneEntryBlockedGuidance } from "./guidance.js";
 import { invalidateAllCaches } from "./cache.js";
 import { writeLock, clearLock, readCrashLock, isLockProcessAlive } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
@@ -24,7 +27,8 @@ import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
 import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeBranchList, nativeBranchExists, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, nativeHasChanges, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
-import { getAutoWorktreePath, checkoutBranchWithStashGuard } from "./auto-worktree.js";
+import { getAutoWorktreePath } from "./auto-worktree.js";
+import { checkoutBranchWithStashGuard } from "./worktree-git-recovery.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
 import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
@@ -34,7 +38,8 @@ import { initRoutingHistory } from "./routing-history.js";
 import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
-import { isDbAvailable, getMilestone, getAllMilestones, insertMilestone, openDatabase, getDbStatus, updateMilestoneStatus } from "./gsd-db.js";
+import { isDbAvailable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
+import { getWorkflowDatabaseStatus, openExistingWorkflowDatabase, openWorkflowDatabase, resolveProjectRootDbPath, } from "./db-workspace.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { extractVerdict } from "./verdict-parser.js";
@@ -42,10 +47,8 @@ import { auditOrphanedPreflightStashes } from "./orphan-stash-audit.js";
 import { parseProject } from "./schemas/parsers.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync, } from "node:fs";
 import { join } from "node:path";
-import { sep as pathSep } from "node:path";
-import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
 import { validateDirectory } from "./validate-directory.js";
 import { isCustomProvider, resolveDefaultSessionModel, resolveDynamicRoutingConfig, } from "./preferences-models.js";
 import { getSessionModelOverride } from "./session-model-override.js";
@@ -76,11 +79,9 @@ export async function openProjectDbIfPresent(basePath) {
     const gsdDbPath = resolveProjectRootDbPath(basePath);
     if (!existsSync(gsdDbPath) || isDbAvailable())
         return;
-    try {
-        openDatabase(gsdDbPath);
-    }
-    catch (err) {
-        logWarning("engine", `gsd-db: failed to open existing database: ${err instanceof Error ? err.message : String(err)}`);
+    const result = openExistingWorkflowDatabase(basePath);
+    if (!result.ok && result.reason === "open-failed") {
+        logWarning("engine", `gsd-db: failed to open existing database: ${result.error?.message ?? "open failed"}`);
     }
 }
 export function reconcileProjectMilestonesFromDisk(basePath) {
@@ -239,7 +240,7 @@ function formatStrandedWorkBlockerMessage(action, activeMilestoneId) {
         `3. Abandon it: run \`/gsd rethink\` and explicitly discard ${target}.`,
     ].join("\n");
 }
-export function auditOrphanedMilestoneBranches(basePath, _isolationMode, gitDeps = {}) {
+export function auditOrphanedMilestoneBranches(basePath, isolationMode, gitDeps = {}) {
     const recovered = [];
     const warnings = [];
     const actions = [];
@@ -286,6 +287,17 @@ export function auditOrphanedMilestoneBranches(basePath, _isolationMode, gitDeps
     catch {
         mergedBranches = new Set();
     }
+    // Detect the branch currently checked out at the project root once — it
+    // does not change across loop iterations and is used below to avoid
+    // requesting a worktree creation for a branch that git already considers
+    // "in use" by the main worktree.
+    let currentRootBranch = null;
+    try {
+        currentRootBranch = nativeGetCurrentBranch(basePath) || null;
+    }
+    catch {
+        currentRootBranch = null;
+    }
     for (const branch of milestoneBranches) {
         const milestoneId = branch.replace(/^milestone\//, "");
         const milestone = getMilestone(milestoneId);
@@ -313,7 +325,26 @@ export function auditOrphanedMilestoneBranches(basePath, _isolationMode, gitDeps
             }
             if ((isMerged || commitsAhead === 0) && !worktreeEvidence.dirty)
                 continue;
-            const recoveryMode = worktreeEvidence.path
+            // #812 — the worktree directory being absent on disk does NOT mean the
+            // project is branch-mode. getAutoWorktreePath() returns null whenever the
+            // directory is merely missing (transient/permanent loss after an
+            // interrupted session), which previously collapsed to recoveryMode:
+            // "branch" — silently checking out milestone/<id> in the project root with
+            // no worktree. When the project is *configured* for worktree isolation,
+            // recover as "worktree" so adoptStrandedMilestone re-materializes the
+            // worktree from the existing branch (createAutoWorktree with
+            // reuseExistingBranch) instead of degrading to branch-mode-in-root.
+            //
+            // Exception (#812-followup): if the milestone branch is already checked
+            // out at the project root (e.g. a leftover from the pre-fix #812 recovery
+            // that ran `git checkout milestone/<id>` in the root), git considers that
+            // branch "in use by another worktree" and will refuse `git worktree add`,
+            // causing bootstrap to abort. Degrade to "branch" in that case — the
+            // session resumes on the already-checked-out branch without worktree
+            // creation, same as pre-fix behavior, and the configured isolation is
+            // restored for subsequent milestones after merge/teardown.
+            const isBranchCheckedOutAtRoot = currentRootBranch === branch;
+            const recoveryMode = worktreeEvidence.path || (isolationMode === "worktree" && !isBranchCheckedOutAtRoot)
                 ? "worktree"
                 : "branch";
             const message = strandedWorkMessage({
@@ -405,7 +436,7 @@ export function auditOrphanedMilestoneBranches(basePath, _isolationMode, gitDeps
                         }
                     }
                     else {
-                        warnings.push(`Orphaned worktree directory for ${milestoneId} is outside .gsd/worktrees/ — skipping removal for safety.`);
+                        warnings.push(`Orphaned worktree directory for ${milestoneId} is outside the GSD worktrees containers — skipping removal for safety.`);
                     }
                 }
                 else {
@@ -524,7 +555,7 @@ export function auditOrphanedMilestoneBranches(basePath, _isolationMode, gitDeps
         if (!existsSync(wtDir))
             continue;
         if (!isInsideWorktreesDir(basePath, wtDir)) {
-            warnings.push(`Orphaned worktree directory for ${m.id} is outside .gsd/worktrees/ — skipping removal for safety.`);
+            warnings.push(`Orphaned worktree directory for ${m.id} is outside the GSD worktrees containers — skipping removal for safety.`);
             continue;
         }
         // Try `git worktree remove` first in case the dir is still registered
@@ -742,12 +773,14 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     // phase-specific planning model for a discuss turn (#2829).
     //
     // Precedence:
-    // 1) Explicit session override via /gsd model (this session)
-    // 2) Current session model from settings/session restore (if provider ready)
-    // 3) GSD model preferences from PREFERENCES.md (validated against live auth)
+    // 1) Explicit session override via /gsd model or /gsd auto --model (this session)
+    // 2) GSD model preferences from PREFERENCES.md (validated against live auth)
+    // 3) Current session model from settings/session restore (if provider ready)
     //
-    // This preserves #3517 defaults while honoring explicit runtime model
-    // selection for subsequent /gsd runs in the same session.
+    // PREFERENCES.md wins over the ambient session default (#3517) so /gsd auto
+    // does not stick on claude-code/claude-sonnet-4-6 when the user configured
+    // models via /gsd workflow-preferences or PREFERENCES.md. Custom providers
+    // still skip PREFERENCES.md entirely (#4122).
     //
     // Exception (#4122): when the session provider is a custom provider declared
     // in ~/.gsd/agent/models.json (Ollama, vLLM, OpenAI-compatible proxy, etc.),
@@ -757,9 +790,10 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     // run /login" before pausing and resetting to claude-code/claude-sonnet-4-6.
     const manualSessionOverride = getSessionModelOverride(ctx.sessionManager.getSessionId());
     const sessionProviderIsCustom = isCustomProvider(ctx.model?.provider);
+    const profileModelIds = modelIdsForProfileResolution(ctx.modelRegistry, resolveProfileAnchorProvider(ctx.model?.provider), resolveDisabledModelProvidersFromPreferences());
     const preferredModel = sessionProviderIsCustom
         ? null
-        : resolveDefaultSessionModel(ctx.model?.provider);
+        : resolveDefaultSessionModel(ctx.model?.provider, base, profileModelIds, ctx.model?.id);
     // Validate the preferred model against the live registry + provider auth so
     // an unconfigured PREFERENCES.md entry (no API key / OAuth) can't become the
     // start-model snapshot. Without this, every subsequent unit would try to
@@ -782,8 +816,8 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         : null;
     const startThinkingSnapshot = pi.getThinkingLevel();
     const startModelSnapshot = manualSessionOverride
-        ?? currentSessionModel
         ?? validatedPreferredModel
+        ?? currentSessionModel
         ?? null;
     try {
         // Validate GSD_PROJECT_ID early so the user gets immediate feedback
@@ -974,9 +1008,26 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 state = await deriveState(wtPath);
             }
         }
-        const blockingStrandedRecoveryAction = state.activeMilestone
-            ? strandedRecoveryActions.find((action) => action.milestoneId !== state.activeMilestone?.id) ?? strandedRecoveryAction
-            : strandedRecoveryAction;
+        const requestedMilestoneLock = process.env.GSD_MILESTONE_LOCK?.trim() || null;
+        const lockedActiveMilestone = requestedMilestoneLock && state.activeMilestone?.id === requestedMilestoneLock;
+        let blockingStrandedRecoveryAction;
+        if (lockedActiveMilestone) {
+            // Parallel worker or explicit `/gsd auto Mxxx`: sibling milestones'
+            // stranded work must not block this milestone's resumption, and the
+            // downstream `strandedRecoveryAction` (used for currentMilestoneId,
+            // setActiveMilestoneId, and adoptStrandedMilestone) must be scoped to
+            // the locked milestone only. Falling back to the first sibling action
+            // would mis-target adoption (#742).
+            const lockMatch = strandedRecoveryActions.find((action) => action.milestoneId === requestedMilestoneLock) ?? null;
+            blockingStrandedRecoveryAction = lockMatch;
+            strandedRecoveryAction = lockMatch;
+        }
+        else if (state.activeMilestone) {
+            blockingStrandedRecoveryAction = strandedRecoveryActions.find((action) => action.milestoneId !== state.activeMilestone?.id) ?? strandedRecoveryAction;
+        }
+        else {
+            blockingStrandedRecoveryAction = strandedRecoveryAction;
+        }
         if (blockingStrandedRecoveryAction) {
             if (!state.activeMilestone) {
                 ctx.ui.notify(formatStrandedWorkBlockerMessage(blockingStrandedRecoveryAction, null), "error");
@@ -989,6 +1040,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             strandedRecoveryAction = blockingStrandedRecoveryAction;
             ctx.ui.notify(formatStrandedWorkRecoveryMessage(strandedRecoveryAction), "info");
         }
+        else if (lockedActiveMilestone) {
+            strandedRecoveryAction = null;
+        }
         if (process.env.GSD_HEADLESS === "1" &&
             orphanAuditRecovered &&
             !state.activeMilestone &&
@@ -1012,7 +1066,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             (state.phase === "pre-planning" || state.phase === "complete") &&
             survivorIsolationMode !== "none" &&
             !detectWorktreeName(base) &&
-            !base.includes(`${pathSep}.gsd${pathSep}worktrees${pathSep}`)) {
+            !isGsdWorktreePath(base)) {
             const milestoneBranch = `milestone/${survivorMilestoneId}`;
             const { nativeBranchExists } = await import("./native-git-bridge.js");
             hasSurvivorBranch = nativeBranchExists(base, milestoneBranch);
@@ -1102,7 +1156,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 state = await deriveState(base);
             }
         }
-        const effectivePrefs = loadEffectiveGSDPreferences(base)?.preferences;
+        const effectivePrefs = loadEffectiveGSDPreferencesWithRegistry(ctx.modelRegistry, base, resolveProfileAnchorProvider(ctx.model?.provider, startModelSnapshot?.provider), startModelSnapshot ? `${startModelSnapshot.provider}/${startModelSnapshot.id}` : undefined)?.preferences;
         const { shouldRunDeepProjectSetup } = await import("./auto-dispatch.js");
         const deepProjectStagePending = shouldRunDeepProjectSetup(state, effectivePrefs, base, { hasSurvivorBranch });
         if (deepProjectStagePending && !strandedRecoveryAction) {
@@ -1248,16 +1302,13 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // (ADR-016 phase 2 / B2, #5620). The redundant assignment that used to
         // live here is gone.
         const isUnderGsdWorktrees = (p) => {
-            // Direct layout: /.gsd/worktrees/
-            const marker = `${pathSep}.gsd${pathSep}worktrees${pathSep}`;
-            if (p.includes(marker))
-                return true;
-            const worktreesSuffix = `${pathSep}.gsd${pathSep}worktrees`;
-            if (p.endsWith(worktreesSuffix))
+            const normalized = p.replaceAll("\\", "/");
+            if (findWorktreeSegment(normalized) !== null)
                 return true;
-            // Symlink-resolved layout: /.gsd/projects/<hash>/worktrees/
-            const symlinkRe = new RegExp(`\\${pathSep}\\.gsd\\${pathSep}projects\\${pathSep}[a-f0-9]+\\${pathSep}worktrees(?:\\${pathSep}|$)`);
-            return symlinkRe.test(p);
+            // The container directory itself (no trailing worktree name), in any layout.
+            return normalized.endsWith("/.gsd/worktrees")
+                || normalized.endsWith("/.gsd-worktrees")
+                || /\/\.gsd\/projects\/[^/]+\/worktrees$/.test(normalized);
         };
         if (s.currentMilestoneId &&
             (getIsolationMode(base) !== "none" || strandedRecoveryAction?.recoveryMode) &&
@@ -1274,11 +1325,8 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 if (enterResult.reason === "lease-conflict") {
                     ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: lease is held by another worker.`, "error");
                 }
-                else if (enterResult.reason === "creation-failed") {
-                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: worktree/branch creation failed. Isolation is degraded.`, "error");
-                }
-                else if (enterResult.reason === "isolation-degraded") {
-                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: isolation is degraded from a prior worktree failure. Close processes locking the worktree and retry, or run /gsd doctor fix.`, "error");
+                else if (enterResult.reason === "creation-failed" || enterResult.reason === "isolation-degraded") {
+                    ctx.ui.notify(milestoneEntryBlockedGuidance(s.currentMilestoneId, enterResult.reason), "error");
                 }
                 else if (enterResult.reason === "invalid-milestone-id") {
                     ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: milestone id is invalid.`, "error");
@@ -1295,23 +1343,14 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         // ── DB lifecycle ──
         const gsdDbPath = resolveProjectRootDbPath(s.basePath);
-        const gsdDirPath = join(s.basePath, ".gsd");
-        if (existsSync(gsdDirPath) && !existsSync(gsdDbPath)) {
-            try {
-                const { openDatabase: openDb } = await import("./gsd-db.js");
-                openDb(gsdDbPath);
-            }
-            catch (err) {
-                logError("engine", `failed to initialize project database: ${err.message}`);
-            }
+        const initialDbOpen = openWorkflowDatabase(s.basePath);
+        if (!initialDbOpen.ok && initialDbOpen.reason === "open-failed") {
+            logError("engine", `failed to initialize project database: ${initialDbOpen.error?.message ?? "open failed"}`);
         }
         if (_shouldAbortBootstrapForUnavailableDbForTest(gsdDbPath, isDbAvailable())) {
-            try {
-                const { openDatabase: openDb } = await import("./gsd-db.js");
-                openDb(gsdDbPath);
-            }
-            catch (err) {
-                logError("engine", `failed to open existing database: ${err.message}`);
+            const retryDbOpen = openWorkflowDatabase(s.basePath);
+            if (!retryDbOpen.ok && retryDbOpen.reason === "open-failed") {
+                logError("engine", `failed to open existing database: ${retryDbOpen.error?.message ?? "open failed"}`);
             }
         }
         // Gate: abort bootstrap if the DB file exists but the provider is
@@ -1320,7 +1359,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // call returns "db_unavailable", triggering artifact-retry which
         // re-dispatches the same task — producing an infinite loop (#2419).
         if (existsSync(gsdDbPath) && !isDbAvailable()) {
-            const dbStatus = getDbStatus();
+            const dbStatus = getWorkflowDatabaseStatus();
             const phaseHint = dbStatus.lastPhase === "open"
                 ? "The database file could not be opened"
                 : dbStatus.lastPhase === "initSchema"
@@ -1401,7 +1440,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // FlatRateContext used by selectAndApplyModel so user-declared
         // flat-rate providers and externalCli auto-detection are respected.
         const { isFlatRateProvider, buildFlatRateContext } = await import("./auto-model-selection.js");
-        const bannerPrefs = loadEffectiveGSDPreferences(base)?.preferences;
+        const bannerPrefs = loadEffectiveGSDPreferencesWithRegistry(ctx.modelRegistry, base, resolveProfileAnchorProvider(ctx.model?.provider, s.autoModeStartModel?.provider), s.autoModeStartModel ? `${s.autoModeStartModel.provider}/${s.autoModeStartModel.id}` : undefined)?.preferences;
         const effectiveProvider = s.autoModeStartModel?.provider ?? ctx.model?.provider;
         const effectivelyEnabled = routingConfig.enabled
             && (routingConfig.allow_flat_rate_providers
@@ -1442,31 +1481,26 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         // Pre-flight: validate milestone queue
         try {
-            const msDir = join(base, ".gsd", "milestones");
-            if (existsSync(msDir)) {
-                const milestoneIds = readdirSync(msDir, { withFileTypes: true })
-                    .filter((d) => d.isDirectory() && /^M\d{3}/.test(d.name))
-                    .map((d) => d.name.match(/^(M\d{3})/)?.[1] ?? d.name);
-                if (milestoneIds.length > 1) {
-                    const issues = [];
-                    for (const id of milestoneIds) {
-                        // Skip completed/parked milestones — a leftover CONTEXT-DRAFT.md
-                        // on a finished milestone is harmless residue, not an actionable warning.
-                        if (isDbAvailable()) {
-                            const ms = getMilestone(id);
-                            if (ms?.status === "complete" || ms?.status === "parked")
-                                continue;
-                        }
-                        const draft = resolveMilestoneFile(base, id, "CONTEXT-DRAFT");
-                        if (draft)
-                            issues.push(`${id}: has CONTEXT-DRAFT.md (will pause for discussion)`);
-                    }
-                    if (issues.length > 0) {
-                        ctx.ui.notify(`Pre-flight: ${milestoneIds.length} milestones queued.\n${issues.map((i) => `  ⚠ ${i}`).join("\n")}`, "warning");
-                    }
-                    else {
-                        ctx.ui.notify(`Pre-flight: ${milestoneIds.length} milestones queued. All have full context.`, "info");
+            const milestoneIds = findMilestoneIds(base);
+            if (milestoneIds.length > 1) {
+                const issues = [];
+                for (const id of milestoneIds) {
+                    // Skip completed/parked milestones — a leftover CONTEXT-DRAFT.md
+                    // on a finished milestone is harmless residue, not an actionable warning.
+                    if (isDbAvailable()) {
+                        const ms = getMilestone(id);
+                        if (ms?.status === "complete" || ms?.status === "parked")
+                            continue;
                     }
+                    const draft = resolveMilestoneFile(base, id, "CONTEXT-DRAFT");
+                    if (draft)
+                        issues.push(`${id}: has CONTEXT-DRAFT.md (will pause for discussion)`);
+                }
+                if (issues.length > 0) {
+                    ctx.ui.notify(`Pre-flight: ${milestoneIds.length} milestones queued.\n${issues.map((i) => `  ⚠ ${i}`).join("\n")}`, "warning");
+                }
+                else {
+                    ctx.ui.notify(`Pre-flight: ${milestoneIds.length} milestones queued. All have full context.`, "info");
                 }
             }
         }

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -4,7 +4,7 @@
  * and blocker placeholder generation.
  */
 import { readUnitRuntimeRecord, writeUnitRuntimeRecord, formatExecuteTaskRecoveryStatus, inspectExecuteTaskDurability, } from "./unit-runtime.js";
-import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, writeBlockerPlaceholder, } from "./auto-recovery.js";
+import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, verifyExpectedArtifact, writeBlockerPlaceholder, } from "./auto-recovery.js";
 import { existsSync } from "node:fs";
 import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 import { finalizeProjectResearchTimeout } from "./project-research-policy.js";
@@ -128,10 +128,10 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
-    // Check if the artifact already exists on disk — agent may have written it
+    // Check if the artifact is already valid on disk — agent may have written it
     // without signaling completion.
     const artifactPath = resolveExpectedArtifactPath(unitType, unitId, basePath);
-    if (artifactPath && existsSync(artifactPath)) {
+    if (artifactPath && existsSync(artifactPath) && verifyExpectedArtifact(unitType, unitId, basePath)) {
         writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
             phase: "finalized",
             recoveryAttempts: recoveryAttempts + 1,

package/dist/resources/extensions/gsd/auto-timers.js

@@ -233,11 +233,24 @@ export function startUnitSupervision(sctx) {
         }
     }, 15000);
     // ── 3. Hard timeout ──
-    s.unitTimeoutHandle = setTimeout(async () => {
+    const hardTimeoutBody = async () => {
         try {
             s.unitTimeoutHandle = null;
             if (!s.active)
                 return;
+            // User-interactive tools (ask_user_questions, secure_env_collect) block
+            // waiting for human input by design. Unlike the idle watchdog (above),
+            // the hard timeout had no interactive exemption, so a long human
+            // deliberation crossing the hard cap would still closeout + recover
+            // (triggerTurn) and abort the turn hosting the elicitation, reintroducing
+            // the self-cancel loop on slow answers (#2676). Re-arm instead of firing
+            // while a human is being asked, mirroring the idle watchdog's
+            // refresh-and-return. Conditional on hasInteractiveToolInFlight(), so a
+            // genuinely hung non-interactive unit still hits the hard cap.
+            if (getInFlightToolCount() > 0 && hasInteractiveToolInFlight()) {
+                s.unitTimeoutHandle = setTimeout(hardTimeoutBody, hardTimeoutMs);
+                return;
+            }
             const expectedCurrentUnit = s.currentUnit
                 ? { type: s.currentUnit.type, id: s.currentUnit.id, startedAt: s.currentUnit.startedAt }
                 : null;
@@ -269,7 +282,8 @@ export function startUnitSupervision(sctx) {
                 logWarning("timer", `notification failed: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-    }, hardTimeoutMs);
+    };
+    s.unitTimeoutHandle = setTimeout(hardTimeoutBody, hardTimeoutMs);
     // ── 4. Context-pressure continue-here monitor ──
     if (s.continueHereHandle) {
         clearInterval(s.continueHereHandle);

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -4,12 +4,23 @@
  * can distinguish "waiting for tool completion" from "truly idle".
  */
 import { stripMcpToolPrefix } from "@gsd/pi-ai";
+import { TOOL_SURFACE_NOT_READY } from "./tool-surface-readiness.js";
 const inFlightTools = new Map();
 /**
  * Tools that block waiting for human input by design.
  * The idle watchdog must not treat these as stalled.
  */
 const INTERACTIVE_TOOLS = new Set(["ask_user_questions", "secure_env_collect"]);
+/**
+ * Mode-agnostic refcount of in-flight interactive elicitations that are an
+ * active human boundary (the model ASKED via ask_user_questions). Unlike the
+ * `inFlightTools` Map, this is NOT gated by auto-session.active, so it is true
+ * in FOREGROUND (where s.active is false). Kept SEPARATE from inFlightTools so
+ * getInFlightToolCount()/getOldestInFlightToolAgeMs()/hasInteractiveToolInFlight()
+ * and the auto-watchdog accounting are byte-for-byte unchanged. A refcount (not
+ * a boolean) handles nested/back-to-back elicitations in a single turn.
+ */
+let interactiveElicitationDepth = 0;
 /**
  * Mark a tool execution as in-flight.
  * Records start time and tool name so the idle watchdog can detect tools
@@ -26,6 +37,27 @@ export function markToolStart(toolCallId, isActive, toolName) {
 export function markToolEnd(toolCallId) {
     inFlightTools.delete(toolCallId);
 }
+/**
+ * Mark an interactive elicitation (the model asking via ask_user_questions) as
+ * in flight. Ungated by auto-session.active so it is observable in foreground.
+ */
+export function markInteractiveElicitationStart() {
+    interactiveElicitationDepth++;
+}
+/**
+ * Mark an interactive elicitation as completed. Idempotent below zero.
+ */
+export function markInteractiveElicitationEnd() {
+    if (interactiveElicitationDepth > 0)
+        interactiveElicitationDepth--;
+}
+/**
+ * Returns true if any interactive elicitation is currently the active human
+ * boundary. True in ALL modes (foreground and auto) while one is in flight.
+ */
+export function isInteractiveElicitationInFlight() {
+    return interactiveElicitationDepth > 0;
+}
 /**
  * Returns the age (ms) of the oldest currently in-flight tool, or 0 if none.
  */
@@ -75,6 +107,7 @@ export function hasInteractiveToolInFlight() {
  */
 export function clearInFlightTools() {
     inFlightTools.clear();
+    interactiveElicitationDepth = 0;
 }
 // ─── Tool invocation error classification (#2883) ────────────────────────
 /**
@@ -85,6 +118,14 @@ export function clearInFlightTools() {
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Input validation error|Invalid arguments for tool|MCP error -32602|No such tool available|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON|does not provide an export named|Named export .* not found|Cannot find module|ERR_MODULE_NOT_FOUND|ERR_MODULE_NOT_EXPORTED|ERR_PACKAGE_PATH_NOT_EXPORTED/i;
 const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
+/**
+ * Matches the runtime's "tool not registered" error. Unlike the deterministic
+ * invocation failures above, this one is usually transient: the workflow MCP
+ * server registers its tool surface asynchronously after session start, so a
+ * Unit's first tool call can race the registration. Callers should retry
+ * (bounded) instead of breaking the loop.
+ */
+const TOOL_UNAVAILABLE_ERROR_RE = new RegExp(`No such tool available|${TOOL_SURFACE_NOT_READY}`, "i");
 /**
  * Returns true if the error message indicates a deterministic invocation or
  * policy failure (as opposed to a normal tool execution error).
@@ -94,6 +135,15 @@ export function isToolInvocationError(errorMsg) {
         return false;
     return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
+/**
+ * Returns true if the error message indicates the called tool was not on the
+ * session's tool surface (MCP startup race — see TOOL_UNAVAILABLE_ERROR_RE).
+ */
+export function isToolUnavailableError(errorMsg) {
+    if (!errorMsg)
+        return false;
+    return TOOL_UNAVAILABLE_ERROR_RE.test(errorMsg);
+}
 /**
  * Returns true if the error message indicates the tool was skipped because
  * a queued user message interrupted the turn (#3595).  Retrying will produce

package/dist/resources/extensions/gsd/auto-unit-closeout.js

@@ -36,17 +36,17 @@ export function isSuspiciousGhostCompletion(ctx, startedAt, maxElapsedMs = GHOST
         activity.assistantMessages === 0);
 }
 /**
- * Snapshot metrics, save activity log, and fire-and-forget memory extraction
- * for a completed unit. Returns the activity log file path (if any).
+ * Snapshot metrics, save activity log, extract memories, and record the git
+ * transaction for a completed auto-mode unit.
  */
-export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, opts) {
-    const modelId = ctx.model?.id ?? "unknown";
-    snapshotUnitMetrics(ctx, unitType, unitId, startedAt, modelId, opts);
-    const activityFile = saveActivityLog(ctx, basePath, unitType, unitId);
+export async function closeoutAutoUnit(request) {
+    const modelId = request.ctx.model?.id ?? "unknown";
+    snapshotUnitMetrics(request.ctx, request.unitType, request.unitId, request.startedAt, modelId, request.opts);
+    const activityFile = saveActivityLog(request.ctx, request.basePath, request.unitType, request.unitId);
     if (activityFile) {
         try {
-            const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import('./memory-extractor.js');
-            const llmCallFn = buildMemoryLLMCall(ctx);
+            const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import("./memory-extractor.js");
+            const llmCallFn = buildMemoryLLMCall(request.ctx);
             if (llmCallFn) {
                 // Awaited: a fire-and-forget here lets memory-extractor writes land in
                 // .gsd/ after closeoutUnit returns but before the milestone merge
@@ -55,10 +55,10 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
                 // bounded by the extractor's LLM call, which is the acceptable price
                 // for not racing the merge boundary.
                 try {
-                    await extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn);
+                    await extractMemoriesFromUnit(activityFile, request.unitType, request.unitId, llmCallFn);
                 }
                 catch (err) {
-                    logWarning("engine", `memory extraction failed for ${unitType}/${unitId}: ${err.message}`);
+                    logWarning("engine", `memory extraction failed for ${request.unitType}/${request.unitId}: ${err.message}`);
                 }
             }
         }
@@ -66,22 +66,46 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
             logWarning("engine", `operation failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    if (opts?.traceId && opts.turnId && opts.gitAction && opts.gitStatus) {
+    const gitTransaction = resolveGitTransactionOptions(request.opts);
+    if (gitTransaction) {
         writeTurnGitTransaction({
-            basePath,
-            traceId: opts.traceId,
-            turnId: opts.turnId,
-            unitType,
-            unitId,
+            basePath: request.basePath,
+            traceId: gitTransaction.traceId,
+            turnId: gitTransaction.turnId,
+            unitType: request.unitType,
+            unitId: request.unitId,
             stage: "record",
-            action: opts.gitAction,
-            push: opts.gitPush === true,
-            status: opts.gitStatus,
-            error: opts.gitError,
+            action: gitTransaction.gitAction,
+            push: gitTransaction.gitPush === true,
+            status: gitTransaction.gitStatus,
+            error: gitTransaction.gitError,
             metadata: {
                 activityFile,
             },
         });
     }
-    return activityFile ?? undefined;
+    return {
+        ...(activityFile ? { activityFile } : {}),
+        gitTransactionRecorded: Boolean(gitTransaction),
+    };
+}
+function resolveGitTransactionOptions(opts) {
+    if (!opts?.traceId || !opts.turnId || !opts.gitAction || !opts.gitStatus)
+        return null;
+    return {
+        traceId: opts.traceId,
+        turnId: opts.turnId,
+        gitAction: opts.gitAction,
+        gitStatus: opts.gitStatus,
+        gitPush: opts.gitPush,
+        gitError: opts.gitError,
+    };
+}
+/**
+ * Compatibility wrapper for existing auto-loop callers. New code should prefer
+ * closeoutAutoUnit so the closeout request and result stay explicit.
+ */
+export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, opts) {
+    const result = await closeoutAutoUnit({ ctx, basePath, unitType, unitId, startedAt, opts });
+    return result.activityFile;
 }