@opengsd/gsd-pi 1.5.0-dev.553dc518 → 1.5.0-dev.c4c8885f

package/src/resources/extensions/gsd/auto-prompts.ts

@@ -11,7 +11,7 @@
 
 import { loadFile, parseContinue, parseSummary, loadActiveOverrides, formatOverridesSection, parseTaskPlanFile } from "./files.js";
 import type { Override } from "./files.js";
-import { hasVerdict, extractVerdict } from "./verdict-parser.js";
+import { extractVerdict } from "./verdict-parser.js";
 import { loadPrompt, inlineTemplate } from "./prompt-loader.js";
 import {
   resolveMilestoneFile, resolveSliceFile, resolveSlicePath,
@@ -60,11 +60,8 @@ import { debugLog } from "./debug-logger.js";
 import { buildSkillActivationBlock, buildSkillDiscoveryVars } from "./skill-activation.js";
 import { findMilestoneIds } from "./milestone-ids.js";
 import { buildRunUatPresentationForType, RUN_UAT_TOOL_PRESENTATION_PLAN_ID } from "./tool-presentation-plan.js";
-import {
-  classifyUatContentForRun,
-  shouldDispatchUatForContent,
-  type UatType,
-} from "./uat-policy.js";
+import { classifyUatContentForRun } from "./uat-policy.js";
+import { checkNeedsRunUat as resolveNeedsRunUat, type UatDispatchCandidate } from "./uat-dispatch.js";
 import { buildWebAppUatGuidanceBlock } from "./web-app-uat.js";
 
 export { buildSkillActivationBlock, buildSkillDiscoveryVars };
@@ -1514,116 +1511,43 @@ export async function checkNeedsReassessment(
   return { sliceId: lastDone };
 }
 
-/**
- * Check if the most recently completed slice needs a UAT run.
- * Returns { sliceId, uatType } if UAT should be dispatched, null otherwise.
- *
- * Skips when:
- * - No roadmap or no completed slices
- * - uat_dispatch is not enabled and the UAT spec does not require runtime/browser evidence
- * - No UAT file exists for the slice
- * - UAT result file already exists (idempotent — already ran)
- */
-/**
- * Resolve the effective UAT mode for the dispatch gate the same way
- * `buildRunUatPrompt` does: classify the UAT body with the slice's SUMMARY as
- * supplemental context, so a `browser-executable` UAT whose slice references a
- * self-contained harness (`npm run test:uat`, `search-uat.mjs`, `npx
- * playwright test`) is promoted to `runtime-executable` for the gate too.
- *
- * Without this, `checkNeedsRunUat` returns `browser-executable` while the
- * prompt instructs runtime-only execution, causing the dispatch gate to
- * require browser tools / warm up the browser daemon (or stop dispatch when
- * browser MCP is unavailable) for UAT runs that never touch the browser. See
- * cursor[bot] review on PR #696 for the M007/S01 regression.
- */
-async function resolveRunUatEffectiveType(
+
+export function getRoadmapCompletedSliceCandidates(
+  roadmapContent: string,
+): UatDispatchCandidate[] {
+  return parseRoadmap(roadmapContent)
+    .slices.filter((slice) => slice.done)
+    .map((slice) => ({ sliceId: slice.id }))
+    .reverse();
+}
+
+
+export async function loadRoadmapCompletedSliceCandidates(
   base: string,
   mid: string,
-  sliceId: string,
-  uatContent: string,
-): Promise<UatType> {
-  let summaryContent = "";
-  try {
-    const summaryPath = resolveSliceFile(base, mid, sliceId, "SUMMARY");
-    if (summaryPath) {
-      summaryContent = (await loadFile(summaryPath)) ?? "";
-    }
-  } catch (err) {
-    logWarning(
-      "prompt",
-      `resolveRunUatEffectiveType SUMMARY load failed: ${err instanceof Error ? err.message : String(err)}`,
-    );
-  }
-  return classifyUatContentForRun(uatContent, summaryContent).effectiveType;
+): Promise<UatDispatchCandidate[]> {
+  const roadmapPath = resolveMilestoneFile(base, mid, "ROADMAP");
+  const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+  return roadmapContent ? getRoadmapCompletedSliceCandidates(roadmapContent) : [];
 }
 
+/**
+ * Back-compat wrapper for callers that import UAT dispatch checks from the
+ * prompt module. UAT dispatch architecture lives in `uat-dispatch.ts`; the
+ * `state` parameter is intentionally ignored because DB/roadmap artifacts are
+ * the source of truth for completed-slice discovery.
+ */
 export async function checkNeedsRunUat(
   base: string, mid: string, state: GSDState, prefs: GSDPreferences | undefined,
-): Promise<{ sliceId: string; uatType: UatType } | null> {
-  // DB primary path — fall through to file-based when DB has no data for this milestone
-  try {
-    const { isDbAvailable, getMilestoneSlices } = await import("./gsd-db.js");
-    if (isDbAvailable()) {
-      const slices = getMilestoneSlices(mid);
-      if (slices.length > 0) {
-        const completedSlices = slices.filter(s => s.status === "complete");
-        if (completedSlices.length === 0) return null;
-        for (const completed of [...completedSlices].reverse()) {
-          const sid = completed.id;
-          const uatFile = resolveSliceFile(base, mid, sid, "UAT");
-          if (!uatFile) continue;
-          const uatContent = await loadFile(uatFile);
-          if (!uatContent) continue;
-          // If the UAT file already contains a verdict, UAT has been run — skip
-          if (hasVerdict(uatContent)) continue;
-          // Also check the ASSESSMENT file — the run-uat prompt writes the verdict
-          // there (via gsd_uat_result_save), not into the
-          // UAT spec file. Without this check the unit re-dispatches indefinitely.
-          const assessmentFile = resolveSliceFile(base, mid, sid, "ASSESSMENT");
-          if (assessmentFile) {
-            const assessmentContent = await loadFile(assessmentFile);
-            if (assessmentContent && hasVerdict(assessmentContent)) continue;
-          }
-          if (!shouldDispatchUatForContent(uatContent, prefs)) continue;
-          const uatType = await resolveRunUatEffectiveType(base, mid, sid, uatContent);
-          return { sliceId: sid, uatType };
-        }
-        return null;
-      }
-    }
-  } catch (err) {
-    logWarning("prompt", `checkNeedsRunUat DB lookup failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
+): Promise<Awaited<ReturnType<typeof resolveNeedsRunUat>>> {
+  void state;
 
-  // File-based fallback using roadmap checkboxes
-  const roadmapPath = resolveMilestoneFile(base, mid, "ROADMAP");
-  if (!roadmapPath) return null;
-  const roadmapContent = await loadFile(roadmapPath);
-  if (!roadmapContent) return null;
-  const parsed = parseRoadmap(roadmapContent);
-  const completedFileSlices = parsed.slices.filter(s => s.done);
-  if (completedFileSlices.length === 0) return null;
-  for (const completed of [...completedFileSlices].reverse()) {
-    const uatSid = completed.id;
-    const uatFileFb = resolveSliceFile(base, mid, uatSid, "UAT");
-    if (!uatFileFb) continue;
-    const uatContentFb = await loadFile(uatFileFb);
-    if (!uatContentFb) continue;
-    // If the UAT file already contains a verdict, UAT has been run — skip
-    if (hasVerdict(uatContentFb)) continue;
-    // Also check the ASSESSMENT file for the file-based fallback path (same
-    // reason as the DB path above — verdict lives in ASSESSMENT, not UAT).
-    const assessmentFileFb = resolveSliceFile(base, mid, uatSid, "ASSESSMENT");
-    if (assessmentFileFb) {
-      const assessmentContentFb = await loadFile(assessmentFileFb);
-      if (assessmentContentFb && hasVerdict(assessmentContentFb)) continue;
-    }
-    if (!shouldDispatchUatForContent(uatContentFb, prefs)) continue;
-    const uatType = await resolveRunUatEffectiveType(base, mid, uatSid, uatContentFb);
-    return { sliceId: uatSid, uatType };
-  }
-  return null;
+  return resolveNeedsRunUat(
+    base,
+    mid,
+    prefs,
+    await loadRoadmapCompletedSliceCandidates(base, mid),
+  );
 }
 
 // ─── Prompt Builders ──────────────────────────────────────────────────────
@@ -3909,9 +3833,15 @@ export async function buildReassessRoadmapPrompt(
  * that instructs the coordinator how to dispatch a `subagent` call. Either or
  * both may be absent (ADR-026 / #508).
  */
-function subagentCallSuffix(model?: string, thinking?: string): string {
+function subagentCallSuffix(model?: string, thinking?: string, fallbacks?: string[]): string {
   const parts: string[] = [];
-  if (model) parts.push(`model: "${model}"`);
+  if (model) {
+    let modelHint = `model: "${model}"`;
+    if (fallbacks && fallbacks.length > 0) {
+      modelHint += ` (fallbacks, in order: ${fallbacks.map((f) => `"${f}"`).join(", ")})`;
+    }
+    parts.push(modelHint);
+  }
   if (thinking) parts.push(`thinking: "${thinking}"`);
   return parts.length > 0 ? ` with ${parts.join(" and ")}` : "";
 }
@@ -3922,7 +3852,13 @@ export async function buildReactiveExecutePrompt(
   subagentModel?: string,
   // Reasoning effort travels inside opts here (not as a positional param) so
   // existing positional `opts` callers don't shift (#508).
-  opts?: { sessionContextWindow?: number; modelRegistry?: MinimalModelRegistry; sessionProvider?: string; subagentThinking?: string },
+  opts?: {
+    sessionContextWindow?: number;
+    modelRegistry?: MinimalModelRegistry;
+    sessionProvider?: string;
+    subagentThinking?: string;
+    subagentModelFallbacks?: string[];
+  },
 ): Promise<string> {
   const { loadSliceTaskIO, deriveTaskGraph, graphMetrics } = await import("./reactive-graph.js");
 
@@ -4019,7 +3955,11 @@ export async function buildReactiveExecutePrompt(
       `When done, say: "Task ${tid} complete."`,
     ].join("\n");
 
-    const modelSuffix = subagentCallSuffix(subagentModel, opts?.subagentThinking);
+    const modelSuffix = subagentCallSuffix(
+      subagentModel,
+      opts?.subagentThinking,
+      opts?.subagentModelFallbacks,
+    );
     subagentSections.push([
       `### ${tid}: ${tTitle}`,
       "",

package/src/resources/extensions/gsd/auto-recovery.ts

@@ -234,12 +234,56 @@ export function refreshRecoveryDbForArtifact(
   }
 
   if (!isClosedStatus(task.status)) {
-    return {
-      ok: false,
-      fatal: true,
-      reason: "execute-task-artifact-db-mismatch",
-      message: `Stuck recovery found execute-task ${unitId} artifacts, but the DB task status is still '${task.status}' after refresh.`,
-    };
+    // The artifact was already confirmed on disk by verifyExpectedArtifact
+    // upstream (Gate 1 accepts a checked disk checkbox as proof of completion),
+    // but the DB task row is still open. A bare refreshWorkflowDatabaseFromDisk
+    // never promotes the disk checkbox into task status (the checkbox is
+    // rendered *from* the DB, never *into* it), so this divergence can never
+    // self-heal. Promote the task to align the DB with disk instead of failing
+    // shut — otherwise the lowest-pending derivation re-picks the same task
+    // forever and execute-task hard-stops with "state did not advance" (#1204).
+    // Mirrors the promotion pattern used by the context-exhaustion and
+    // reactive-execute-blocker recovery paths.
+    const ts = new Date().toISOString();
+    // Only the DB promotion is load-bearing: if it throws, nothing advanced
+    // and failing shut is correct. The plan checkbox rewrite and cache clears
+    // are best-effort follow-ups — a throw there must NOT abort recovery, or
+    // the DB is left complete without ever emitting the stuck-artifact-recovery
+    // event (#1221), stranding worktree reconciliation.
+    try {
+      updateTaskStatus(mid, sid, tid, "complete", ts);
+    } catch (e) {
+      return {
+        ok: false,
+        fatal: true,
+        reason: "execute-task-artifact-db-promote-failed",
+        message: `Stuck recovery found execute-task ${unitId} artifacts, but promoting the DB task status from '${task.status}' failed: ${getErrorMessage(e)}`,
+      };
+    }
+    try {
+      const artifactBase = resolveArtifactVerificationBase(unitId, basePath);
+      const planPath = resolveExpectedArtifactPath("plan-slice", `${mid}/${sid}`, artifactBase);
+      if (planPath && existsSync(planPath)) {
+        const planContent = readFileSync(planPath, "utf-8");
+        const updatedPlan = planContent.replace(
+          new RegExp(`^(\\s*-\\s+)\\[ \\]\\s+\\*\\*${tid}:`, "m"),
+          `$1[x] **${tid}:`,
+        );
+        if (updatedPlan !== planContent) {
+          atomicWriteSync(planPath, updatedPlan);
+        }
+      }
+      clearPathCache();
+      clearParseCache();
+    } catch (e) {
+      logWarning("recovery", `stuck-artifact plan checkbox sync failed after DB promotion of ${unitId}: ${getErrorMessage(e)}`);
+    }
+    // Append event so worktree reconciliation can replay this recovery completion.
+    try {
+      appendEvent(basePath, { cmd: "complete-task", params: { milestoneId: mid, sliceId: sid, taskId: tid }, ts, actor: "system", trigger_reason: "stuck-artifact-recovery" });
+    } catch (e) {
+      logWarning("recovery", `appendEvent failed for stuck-artifact task promotion: ${getErrorMessage(e)}`);
+    }
   }
 
   return { ok: true };

package/src/resources/extensions/gsd/auto-start.ts

@@ -73,10 +73,10 @@ import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
 import { queryJournal } from "./journal.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
-import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
+import { restoreHookState, resetHookState, reconcileRestoredHookDispatch } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
-import { isDbAvailable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
+import { isDbAvailable, probeDbWritable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
 import {
   getWorkflowDatabaseStatus,
   openExistingWorkflowDatabase,
@@ -205,35 +205,43 @@ export function reconcileProjectMilestonesFromDisk(basePath: string): number {
 export function reconcileMergedMilestonesFromJournal(basePath: string): number {
   if (!isDbAvailable()) return 0;
 
-  const mergedAtByMilestone = new Map<string, string>();
-  for (const entry of queryJournal(basePath, { eventType: "worktree-merged" })) {
-    const data = entry.data ?? {};
-    const milestoneId = typeof data.milestoneId === "string" ? data.milestoneId : null;
-    if (!milestoneId) continue;
-    if (data.conflict === true) continue;
-
-    const endedAt = typeof data.endedAt === "string" ? data.endedAt : entry.ts;
-    const previous = mergedAtByMilestone.get(milestoneId);
-    if (!previous || endedAt > previous) mergedAtByMilestone.set(milestoneId, endedAt);
-  }
-
-  let closed = 0;
-  for (const [milestoneId, completedAt] of mergedAtByMilestone) {
-    const existing = getMilestone(milestoneId);
-    if (!existing) {
-      insertMilestone({ id: milestoneId, title: milestoneId, status: "complete" });
-      updateMilestoneStatus(milestoneId, "complete", completedAt);
-      closed++;
-      continue;
+  try {
+    const mergedAtByMilestone = new Map<string, string>();
+    for (const entry of queryJournal(basePath, { eventType: "worktree-merged" })) {
+      const data = entry.data ?? {};
+      const milestoneId = typeof data.milestoneId === "string" ? data.milestoneId : null;
+      if (!milestoneId) continue;
+      if (data.conflict === true) continue;
+
+      const endedAt = typeof data.endedAt === "string" ? data.endedAt : entry.ts;
+      const previous = mergedAtByMilestone.get(milestoneId);
+      if (!previous || endedAt > previous) mergedAtByMilestone.set(milestoneId, endedAt);
     }
-    if (!isClosedStatus(existing.status)) {
-      updateMilestoneStatus(milestoneId, "complete", completedAt);
-      closed++;
+
+    let closed = 0;
+    for (const [milestoneId, completedAt] of mergedAtByMilestone) {
+      const existing = getMilestone(milestoneId);
+      if (!existing) {
+        insertMilestone({ id: milestoneId, title: milestoneId, status: "complete" });
+        updateMilestoneStatus(milestoneId, "complete", completedAt);
+        closed++;
+        continue;
+      }
+      if (!isClosedStatus(existing.status)) {
+        updateMilestoneStatus(milestoneId, "complete", completedAt);
+        closed++;
+      }
     }
-  }
 
-  if (closed > 0) invalidateAllCaches();
-  return closed;
+    if (closed > 0) invalidateAllCaches();
+    return closed;
+  } catch (err) {
+    logWarning(
+      "bootstrap",
+      `merged-milestone journal reconciliation failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return 0;
+  }
 }
 
 /**
@@ -1624,6 +1632,10 @@ export async function bootstrapAutoSession(
     s.unitLifetimeDispatches.clear();
     resetHookState();
     restoreHookState(base);
+    // A restored activeHook has no live dispatch (the sidecar queue is not
+    // persisted); re-enqueue it so the hook runs instead of blocking the next
+    // unrelated unit's close-out (#1246).
+    reconcileRestoredHookDispatch(base, s.sidecarQueue);
     resetProactiveHealing();
     // Notify user on health level transitions (green→yellow→red and back)
     setLevelChangeCallback((_from, to, summary) => {
@@ -1778,6 +1790,23 @@ export async function bootstrapAutoSession(
       return releaseLockAndReturn();
     }
 
+    // Gate: confirm the handle is actually writable, not just open. A
+    // schema-current DB does zero writes during open, so a read-only /
+    // DBMOVED handle otherwise passes the check above and only fails much
+    // later at the first authoritative write (the uok-kernel-enter audit)
+    // with an opaque "readonly database" error (#1234).
+    if (existsSync(gsdDbPath) && isDbAvailable()) {
+      const writable = probeDbWritable();
+      if (!writable.ok) {
+        const detail = writable.detail ? ` (${writable.detail})` : "";
+        ctx.ui.notify(
+          `SQLite database is not writable: ${gsdDbPath}.${detail} Check file/WAL permissions or reopen a stale handle before running auto-mode.`,
+          "error",
+        );
+        return releaseLockAndReturn();
+      }
+    }
+
     // Initialize metrics
     initMetrics(s.basePath);
 
@@ -1815,7 +1844,7 @@ export async function bootstrapAutoSession(
 
     // Snapshot installed skills
     if (resolveSkillDiscoveryMode(base) !== "off") {
-      snapshotSkills();
+      snapshotSkills({ cwd: s.basePath });
     }
 
     setAutoActiveStatus(ctx, s.stepMode ? "next" : "auto");

package/src/resources/extensions/gsd/auto-timeout-recovery.ts

@@ -21,6 +21,8 @@ import { existsSync } from "node:fs";
 
 import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 import { finalizeProjectResearchTimeout } from "./project-research-policy.js";
+import { applySupervisorModelIfConfigured } from "./auto-model-selection.js";
+import { getInFlightToolCount } from "./auto-tool-tracking.js";
 
 export interface RecoveryContext {
   basePath: string;
@@ -122,13 +124,17 @@ export async function recoverTimedOutUnit(
             "If full completion is impossible, write the partial artifact/state needed for recovery and make the blocker explicit.",
           ];
 
+      const recoveryTrigger = getInFlightToolCount() === 0;
+      if (recoveryTrigger) {
+        await applySupervisorModelIfConfigured(ctx, pi, basePath);
+      }
       pi.sendMessage(
         {
           customType: "gsd-auto-timeout-recovery",
           display: verbose,
           content: steeringLines.join("\n"),
         },
-        { triggerTurn: true, deliverAs: "steer" },
+        { triggerTurn: recoveryTrigger, deliverAs: "steer" },
       );
       ctx.ui.notify(
         `${reason === "idle" ? "Idle" : "Timeout"} recovery: steering ${unitType} ${unitId} to finish durable output (attempt ${attemptNumber}, session ${recoveryAttempts + 1}/${maxRecoveryAttempts}).`,
@@ -249,13 +255,17 @@ export async function recoverTimedOutUnit(
           "If blocked, write the partial artifact and explicitly record the blocker instead of going silent.",
         ];
 
+    const recoveryTrigger = getInFlightToolCount() === 0;
+    if (recoveryTrigger) {
+      await applySupervisorModelIfConfigured(ctx, pi, basePath);
+    }
     pi.sendMessage(
       {
         customType: "gsd-auto-timeout-recovery",
         display: verbose,
         content: steeringLines.join("\n"),
       },
-      { triggerTurn: true, deliverAs: "steer" },
+      { triggerTurn: recoveryTrigger, deliverAs: "steer" },
     );
     ctx.ui.notify(
       `${reason === "idle" ? "Idle" : "Timeout"} recovery: steering ${unitType} ${unitId} to produce ${expected} (attempt ${attemptNumber}, session ${recoveryAttempts + 1}/${maxRecoveryAttempts}).`,

package/src/resources/extensions/gsd/auto-timers.ts

@@ -19,6 +19,7 @@ import {
   hasInteractiveToolInFlight,
 } from "./auto-tool-tracking.js";
 import { detectWorkingTreeActivity } from "./auto-supervisor.js";
+import { applySupervisorModelIfConfigured } from "./auto-model-selection.js";
 import { closeoutUnit, type CloseoutOptions } from "./auto-unit-closeout.js";
 import { saveActivityLog } from "./activity-log.js";
 import { recoverTimedOutUnit, type RecoveryContext } from "./auto-timeout-recovery.js";
@@ -158,7 +159,7 @@ export function startUnitSupervision(sctx: SupervisionContext): void {
       : idleTimeoutMs;
 
   // ── 1. Soft timeout warning ──
-  s.wrapupWarningHandle = setTimeout(() => {
+  s.wrapupWarningHandle = setTimeout(async () => {
     s.wrapupWarningHandle = null;
     if (!s.active || !s.currentUnit) return;
     writeUnitRuntimeRecord(s.basePath, unitType, unitId, s.currentUnit.startedAt, {
@@ -169,6 +170,9 @@ export function startUnitSupervision(sctx: SupervisionContext): void {
     // Triggering during active tool calls causes tool results to be skipped
     // with "Skipped due to queued user message", leading to provider errors (#3512).
     const softTrigger = getInFlightToolCount() === 0;
+    if (softTrigger) {
+      await applySupervisorModelIfConfigured(ctx, pi, s.basePath);
+    }
     pi.sendMessage(
       {
         customType: "gsd-auto-wrapup",
@@ -351,7 +355,7 @@ export function startUnitSupervision(sctx: SupervisionContext): void {
     ctx.model?.provider,
   );
   const continueHereThreshold = computeBudgets(executorContextWindow).continueThresholdPercent;
-  s.continueHereHandle = setInterval(() => {
+  s.continueHereHandle = setInterval(async () => {
     if (!s.active || !s.currentUnit || !s.cmdCtx) return;
     const runtime = readUnitRuntimeRecord(s.basePath, unitType, unitId);
     if (runtime?.continueHereFired) return;
@@ -382,6 +386,9 @@ export function startUnitSupervision(sctx: SupervisionContext): void {
 
     // Only trigger a new turn if no tools are currently in flight (#3512).
     const contextTrigger = getInFlightToolCount() === 0;
+    if (contextTrigger) {
+      await applySupervisorModelIfConfigured(ctx, pi, s.basePath);
+    }
     pi.sendMessage(
       {
         customType: "gsd-auto-wrapup",