@opengsd/gsd-pi 1.3.0-dev.eed73bea → 1.4.0-dev.5fc22c6f

package/src/resources/extensions/gsd/auto-verification.ts

@@ -29,6 +29,7 @@ import {
   runVerificationGate,
   runVerificationGateForTargets,
   formatFailureContext,
+  formatFailureSignature,
   captureRuntimeErrors,
   runDependencyAudit,
 } from "./verification-gate.js";
@@ -871,10 +872,13 @@ export async function runPostUnitVerification(
         );
       }
       const nextAttempt = attempt + 1;
+      const failureContext = verdict.failureContext || formatFailureContext(result);
+      const failureSignature = formatFailureSignature(result);
       s.verificationRetryCount.set(retryKey, nextAttempt);
       s.pendingVerificationRetry = {
         unitId: s.currentUnit.id,
-        failureContext: verdict.failureContext || formatFailureContext(result),
+        failureContext,
+        ...(failureSignature ? { signature: failureSignature } : {}),
         attempt: nextAttempt,
       };
       const failedCmds = result.checks

package/src/resources/extensions/gsd/auto-worktree.ts

@@ -1199,11 +1199,11 @@ export function teardownAutoWorktree(
   const branch = autoWorktreeBranch(milestoneId);
   const { preserveBranch = false, preserveWorktree = false } = opts;
   const previousCwd = safeCwd(originalBasePath);
+  let clearActiveWorkspace = true;
 
   // Wrap the entire teardown body in a single try/finally so activeWorkspace
-  // is ALWAYS cleared — even if process.chdir throws (e.g. originalBasePath
-  // was deleted before teardown ran). Previously the finally only covered
-  // removeWorktree, leaving the registry stale on a chdir failure (H3 fix).
+  // is cleared on completion or irrecoverable failure — even if process.chdir
+  // throws (e.g. originalBasePath was deleted before teardown ran).
   try {
     try {
       process.chdir(originalBasePath);
@@ -1245,18 +1245,28 @@ export function teardownAutoWorktree(
     // 3. Remove the worktree unless this exit path explicitly preserves it
     //    (slice-parallel dispatch stops the parent loop but keeps the parent
     //    milestone worktree for restart/re-entry).
+    let worktreeRemoved = preserveWorktree;
     if (!preserveWorktree) {
-      removeWorktree(originalBasePath, milestoneId, {
+      worktreeRemoved = removeWorktree(originalBasePath, milestoneId, {
         branch,
         deleteBranch: !preserveBranch,
       });
+      if (!worktreeRemoved) {
+        logWarning(
+          "worktree",
+          `Worktree removal aborted for ${milestoneId}; uncommitted work was preserved. ` +
+            `Manual quarantine recovery may be needed before retrying teardown.`,
+          { worktree: milestoneId },
+        );
+        clearActiveWorkspace = false;
+      }
     }
 
     // Verify cleanup succeeded — warn if the worktree directory is still on disk.
     // On Windows, bash-based cleanup can silently fail when paths contain
     // backslashes (#1436), leaving ~1 GB+ orphaned directories.
     const wtDir = worktreePath(originalBasePath, milestoneId);
-    if (!preserveWorktree && existsSync(wtDir)) {
+    if (!preserveWorktree && worktreeRemoved && existsSync(wtDir)) {
       logWarning(
         "reconcile",
         `Worktree directory still exists after teardown: ${wtDir}. ` +
@@ -1280,10 +1290,12 @@ export function teardownAutoWorktree(
       }
     }
   } finally {
-    // Clear module state unconditionally — regardless of which step above
-    // failed. A stale activeWorkspace causes getActiveAutoWorktreeContext()
-    // to return wrong data for subsequent operations.
-    setActiveWorkspace(null);
+    // Clear module state when teardown completed or failed irrecoverably.
+    // When removeWorktree returns false (quarantine failure), preserve the
+    // registry so recovery logic still sees the active milestone worktree.
+    if (clearActiveWorkspace) {
+      setActiveWorkspace(null);
+    }
   }
 }
 
@@ -1791,14 +1803,31 @@ export function mergeMilestoneToMain(
     } catch (err) {
       logWarning("worktree", `clearProjectRootStateFiles failed during already-merged cleanup: ${err instanceof Error ? err.message : String(err)}`);
     }
+    let worktreeRemoved = true;
     try {
-      removeWorktree(originalBasePath_, milestoneId, {
+      worktreeRemoved = removeWorktree(originalBasePath_, milestoneId, {
         branch: milestoneBranch,
         deleteBranch: false,
       });
     } catch (err) {
+      worktreeRemoved = false;
       logWarning("worktree", `worktree removal failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+
+    if (!worktreeRemoved) {
+      logWarning(
+        "worktree",
+        `Skipping milestone branch deletion for ${milestoneBranch}; worktree removal was aborted to preserve uncommitted milestone work.`,
+      );
+      nudgeGitBranchCache(previousCwd);
+      try {
+        process.chdir(originalBasePath_);
+      } catch (err) {
+        logWarning("worktree", `chdir to project root after already-merged cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      return { commitMessage, pushed: false, prCreated: false, codeFilesChanged: true };
+    }
+
     try {
       nativeBranchDelete(originalBasePath_, milestoneBranch);
     } catch (err) {
@@ -2270,16 +2299,26 @@ export function mergeMilestoneToMain(
 
   const finalizeMilestoneCleanup = (): void => {
     // 12. Remove worktree directory first (must happen before branch deletion)
+    let worktreeRemoved = true;
     try {
-      removeWorktree(originalBasePath_, milestoneId, {
+      worktreeRemoved = removeWorktree(originalBasePath_, milestoneId, {
         branch: milestoneBranch,
         deleteBranch: false,
       });
     } catch (err) {
+      worktreeRemoved = false;
       // Best-effort -- worktree dir may already be gone
       logWarning("worktree", `worktree removal failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 
+    if (!worktreeRemoved) {
+      logWarning(
+        "worktree",
+        `Skipping milestone branch deletion for ${milestoneBranch}; worktree removal was aborted to preserve uncommitted milestone work.`,
+      );
+      return;
+    }
+
     // 13. Delete milestone branch (after worktree removal so ref is unlocked)
     try {
       nativeBranchDelete(originalBasePath_, milestoneBranch);

package/src/resources/extensions/gsd/auto.ts

@@ -97,8 +97,10 @@ import {
   getNewBudgetAlertLevel,
   getBudgetEnforcementAction,
   getContextPauseAction,
+  HARD_CONTEXT_REROOT_THRESHOLD_PERCENT,
   resolveCompactionThresholdPercent,
   shouldRerootStepSessionForContext,
+  shouldWarnStepSessionForContext,
 } from "./auto-budget.js";
 import {
   markToolStart as _markToolStart,
@@ -701,6 +703,7 @@ export {
   getContextPauseAction,
   resolveCompactionThresholdPercent,
   shouldRerootStepSessionForContext,
+  shouldWarnStepSessionForContext,
 } from "./auto-budget.js";
 
 function closeOutSignalInterruptedUnit(currentBasePath: string): void {
@@ -1048,6 +1051,12 @@ export function stopAutoRemote(projectRoot: string): {
  * The normal stop path stays SIGTERM-only so cooperative sessions can clean up;
  * this path is only for the explicit "Force start" action.
  */
+// Grace window between SIGTERM and SIGKILL so the target can run its cleanup
+// handler (lock release, DB snapshot flush, worktree teardown). Polled so a
+// process that exits early is not made to wait the full window.
+const FORCE_STOP_GRACE_MS = 3000;
+const FORCE_STOP_POLL_MS = 100;
+
 export function forceStopAutoRemote(projectRoot: string): {
   found: boolean;
   pid?: number;
@@ -1068,6 +1077,13 @@ export function forceStopAutoRemote(projectRoot: string): {
 
   try {
     process.kill(lock.pid, "SIGTERM");
+    // Poll for graceful exit before escalating. Synchronous sleep keeps this
+    // function sync for its callers (Atomics.wait times out with no notify).
+    const deadline = Date.now() + FORCE_STOP_GRACE_MS;
+    while (Date.now() < deadline) {
+      if (!isLockProcessAlive(lock)) break;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, FORCE_STOP_POLL_MS);
+    }
     if (isLockProcessAlive(lock)) {
       process.kill(lock.pid, "SIGKILL");
     }
@@ -1375,9 +1391,10 @@ export async function rerootCommandSession(
 }
 
 /**
- * After a completed step-mode unit, reclaim context headroom when usage is at
- * or above the compaction threshold. Writes a context-mode snapshot first, then
- * re-roots the visible command session while leaving the NEXT progress surface.
+ * After a completed step-mode unit, warn when usage reaches the configurable
+ * soft context threshold. At the fixed hard boundary, write a context-mode
+ * snapshot and re-root the visible command session while leaving the NEXT
+ * progress surface.
  */
 export async function maybeRerootStepSessionForHighContext(
   ctx: ExtensionContext,
@@ -1392,7 +1409,19 @@ export async function maybeRerootStepSessionForHighContext(
   const prefs = loadEffectiveGSDPreferences(workspaceRoot);
   const compactionThreshold = prefs?.preferences.context_management?.compaction_threshold_percent;
 
-  if (!shouldRerootStepSessionForContext(contextPercent, compactionThreshold)) {
+  const shouldWarn = shouldWarnStepSessionForContext(contextPercent, compactionThreshold);
+  const shouldReroot = shouldRerootStepSessionForContext(contextPercent);
+  if (!shouldWarn && !shouldReroot) {
+    return { rerooted: false };
+  }
+
+  const displayPercent = (contextPercent as number).toFixed(1);
+  const thresholdDisplay = resolveCompactionThresholdPercent(compactionThreshold).toFixed(0);
+  if (!shouldReroot) {
+    ctx.ui.notify(
+      `Step complete — context at ${displayPercent}% (soft threshold: ${thresholdDisplay}%). Use /compact when convenient; continuing in this session is still safe.`,
+      "info",
+    );
     return { rerooted: false };
   }
 
@@ -1401,12 +1430,10 @@ export async function maybeRerootStepSessionForHighContext(
   const { writeContextModeCompactionSnapshot } = await import("./context-mode-snapshot.js");
   await writeContextModeCompactionSnapshot(snapshotBase);
 
-  const displayPercent = (contextPercent as number).toFixed(1);
-  const thresholdDisplay = resolveCompactionThresholdPercent(compactionThreshold).toFixed(0);
   const result = await rerootCommandSession(cmdCtx, workspaceRoot);
   if (result.status === "ok") {
     ctx.ui.notify(
-      `Step complete — context at ${displayPercent}% (threshold: ${thresholdDisplay}%). Fresh session ready for /gsd next.`,
+      `Step complete — context at ${displayPercent}% (hard threshold: ${HARD_CONTEXT_REROOT_THRESHOLD_PERCENT}%). Fresh session ready for /gsd next.`,
       "info",
     );
     return { rerooted: true };
@@ -2102,7 +2129,7 @@ export function _selectStopAutoWorktreeExit(args: {
 /**
  * Pause auto-mode without destroying state. Context is preserved.
  * The user can interact with the agent, then `/gsd auto` resumes
- * from disk state. Called when the user presses Escape during auto-mode.
+ * from disk state. Called when the user presses Escape or runs `/gsd pause`.
  */
 export async function pauseAuto(
   ctx?: ExtensionContext,
@@ -2129,6 +2156,7 @@ export async function pauseAuto(
 
   s.active = false;
   s.paused = true;
+  if (options.abortActiveTurn && ctx && !ctx.isIdle()) ctx.abort();
   clearUnitTimeout();
   stopAutoCommandPolling();
 

package/src/resources/extensions/gsd/bootstrap/core-session-tools.ts

@@ -0,0 +1,44 @@
+// Project/App: gsd-pi
+// File Purpose: Canonical core session tool surface shared by auto-mode scoping and loop guards.
+
+/** Base tools available during auto-mode execution before unit-specific GSD tools are added. */
+export const MINIMAL_AUTO_BASE_TOOL_NAMES = [
+  "ask_user_questions",
+  "bash",
+  "bg_shell",
+  "edit",
+  "find",
+  "glob",
+  "grep",
+  "fetch_page",
+  "search-the-web",
+  "ls",
+  "read",
+  "subagent",
+  "write",
+  "ToolSearch",
+] as const;
+
+/** Tools excluded from the high per-turn loop-guard cap (strict or orchestration). */
+const NON_REPEATABLE_FROM_MINIMAL_BASE = new Set<string>([
+  "ask_user_questions",
+  "subagent",
+  "ToolSearch",
+]);
+
+/** Additional core tools not in MINIMAL_AUTO_BASE but routinely multi-called per turn. */
+const EXTRA_INHERENTLY_REPEATABLE = [
+  "gsd_exec",
+  "multi_edit",
+  "todo_write",
+  "notebook_edit",
+  "search_and_read",
+] as const;
+
+/** Core session tools that may be invoked many times per agent turn. */
+export const INHERENTLY_REPEATABLE_TOOL_NAMES = [
+  ...MINIMAL_AUTO_BASE_TOOL_NAMES.filter((name) => !NON_REPEATABLE_FROM_MINIMAL_BASE.has(name)),
+  ...EXTRA_INHERENTLY_REPEATABLE,
+] as const;
+
+export const INHERENTLY_REPEATABLE_TOOL_SET = new Set<string>(INHERENTLY_REPEATABLE_TOOL_NAMES);

package/src/resources/extensions/gsd/bootstrap/db-tools.ts

@@ -690,8 +690,9 @@ export function registerDbTools(pi: ExtensionAPI): void {
     promptSnippet: "Plan a slice via DB write + PLAN render + cache invalidation",
     promptGuidelines: [
       "Use gsd_plan_slice for slice planning instead of writing S##-PLAN.md or task PLAN files directly.",
-      "Keep parameters flat and provide the full slice planning payload, including tasks.",
-      "The tool validates input, requires an existing parent slice, writes slice/task planning data, renders PLAN.md and task plan files from DB, and clears both state and parse caches after success.",
+      "For incremental planning, call gsd_plan_slice with slice metadata only, then call gsd_plan_task once per task.",
+      "When tasks is omitted or empty, the tool writes only slice planning metadata and preserves existing tasks.",
+      "When tasks is non-empty, the tool validates input, requires an existing parent slice, writes slice/task planning data, renders PLAN.md and task plan files from DB, and clears both state and parse caches after success.",
       "Use the canonical name gsd_plan_slice; gsd_slice_plan is only an alias.",
     ],
     parameters: Type.Object({
@@ -699,7 +700,7 @@ export function registerDbTools(pi: ExtensionAPI): void {
       milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
       sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
       goal: Type.String({ description: "Slice goal" }),
-      tasks: Type.Array(Type.Object({
+      tasks: Type.Optional(Type.Array(Type.Object({
         taskId: Type.String({ description: "Task ID (e.g. T01)" }),
         title: Type.String({ description: "Task title" }),
         description: Type.String({ description: "Task description / steps block" }),
@@ -709,12 +710,14 @@ export function registerDbTools(pi: ExtensionAPI): void {
         inputs: Type.Array(Type.String(), { description: "Array<string> of input files or references; pass [\"path\"] or [], never a single string" }),
         expectedOutput: Type.Array(Type.String(), { description: "Array<string> of files this task creates or overwrites; pass [\"path\"] or [], never prose or a single string" }),
         observabilityImpact: Type.Optional(Type.String({ description: "Task observability impact" })),
-      }), { description: "Planned tasks for the slice" }),
+        targetRepositories: Type.Optional(Type.Array(Type.String(), { description: "Repository id(s) this task touches (parent workspace); must match a Declared Repository. Omit for single-repo projects." })),
+      }), { description: "Optional full task replacement for the slice. Omit for incremental planning, then call gsd_plan_task once per task." })),
       // ── Enrichment metadata (optional — defaults to empty) ────────────
       successCriteria: Type.Optional(Type.String({ description: "Slice success criteria block" })),
       proofLevel: Type.Optional(Type.String({ description: "Slice proof level" })),
       integrationClosure: Type.Optional(Type.String({ description: "Slice integration closure" })),
       observabilityImpact: Type.Optional(Type.String({ description: "Slice observability impact" })),
+      targetRepositories: Type.Optional(Type.Array(Type.String(), { description: "Slice-wide default repository id(s) (parent workspace); must match a Declared Repository. Omit for single-repo projects." })),
       // Single-writer v3 audit trail (Stream 2): caller-provided actor identity + causation.
       actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail (e.g. 'executor-01', 'gsd-orchestrator')" })),
       triggerReason: Type.Optional(Type.String({ description: "Caller-provided reason this action was triggered (e.g. 'plan-phase complete')" })),
@@ -788,6 +791,7 @@ export function registerDbTools(pi: ExtensionAPI): void {
       inputs: Type.Array(Type.String(), { description: "Array<string> of input files or references; pass [\"path\"] or [], never a single string" }),
       expectedOutput: Type.Array(Type.String(), { description: "Array<string> of files this task creates or overwrites; pass [\"path\"] or [], never prose or a single string" }),
       observabilityImpact: Type.Optional(Type.String({ description: "Task observability impact" })),
+      targetRepositories: Type.Optional(Type.Array(Type.String(), { description: "Repository id(s) this task touches (parent workspace); must match a Declared Repository. Omit for single-repo projects." })),
       // Single-writer v3 audit trail (Stream 2): caller-provided actor identity + causation.
       actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail (e.g. 'executor-01', 'gsd-orchestrator')" })),
       triggerReason: Type.Optional(Type.String({ description: "Caller-provided reason this action was triggered (e.g. 'plan-phase complete')" })),

package/src/resources/extensions/gsd/bootstrap/register-extension.ts

@@ -18,6 +18,7 @@ import { registerShortcuts } from "./register-shortcuts.js";
 import { writeCrashLog } from "./crash-log.js";
 import { logWarning, isGsdExtensionStderrEnabled } from "../workflow-logger.js";
 import { UNIT_TOOL_CONTRACTS } from "../unit-tool-contracts.js";
+import { installManifestFlushOnProcessTeardown } from "../workflow-manifest.js";
 // Static import so cmux event listeners are registered synchronously during
 // extension bootstrap. Prior implementation used `void import().then()` which
 // queued listener registration as a microtask — any CMUX_CHANNELS emit fired
@@ -196,6 +197,7 @@ export function registerGsdExtension(pi: ExtensionAPI): void {
     });
 
   installEpipeGuard();
+  installManifestFlushOnProcessTeardown();
 
   // Ecosystem handlers captured by the GSDExtensionAPI wrapper for the
   // GSD-owned `before_agent_start` dispatch step (#3338).