@opengsd/gsd-pi 1.6.0 → 1.7.0

package/README.md

@@ -28,16 +28,12 @@ See [CHANGELOG.md](./CHANGELOG.md) for release-by-release fixes and [Legacy Rele
 ## Latest Release Highlights
 
 <!-- release-highlights:start -->
-Latest release: **v1.6.0**
-
-- **skills:** Load .claude/skills into the catalog (mirror Claude Code).
-- **gsd:** Extract uat dispatch discovery.
-- **daemon:** Split orchestrator agent loop.
-- **daemon:** Extract orchestrator tool execution.
-- **uok:** Scope audit degradation to kernel workspace.
-- **browser-tools:** Abort pending daemon starts on close.
-- **browser-tools:** Guard managed daemon connection lifecycle.
-- **worktree:** Centralize changed scan.
+Latest release: **v1.7.0**
+
+- **cloud:** Add device-flow login to daemon + @opengsd/gsd-cloud agent (#1278).
+- **issue:** [Bug]: Unattended `gsd headless auto` has no resumer for the parallel/slice_parallel worker pause signal → terminal exit 10 after the first unit.
+- **issue:** Complete-slice's reopen reason never reaches the re-dispatched execute-task (follow-up to #1225).
+- **issue:** [Feature Request]: gsd-browser daemon has no automatic teardown — orphaned Chrome process survives session/task completion.
 
 <!-- release-highlights:end -->
 

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-d89940a8e727f2ea
+1995c618cd0898a5

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -31,7 +31,7 @@ import { normalizeWorktreePathForCompare } from "./worktree-root.js";
 import { isDbAvailable, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
 import { getWorkflowDatabasePath, refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
 import { renderPlanCheckboxes, renderRoadmapFromDb, roadmapRenderMarksSliceDone } from "./markdown-renderer.js";
-import { consumeSignal } from "./session-status-io.js";
+import { awaitWorkerResume, consumeSignal } from "./session-status-io.js";
 import { checkPostUnitHooks, consumeHookFailure, isRetryPending, consumeRetryTrigger, consumeGateBlock, persistHookState, resolveHookArtifactPath, } from "./post-unit-hooks.js";
 import { hasPendingCaptures, loadPendingCaptures, revertExecutorResolvedCaptures } from "./captures.js";
 import { debugLog } from "./debug-logger.js";
@@ -1051,8 +1051,24 @@ export async function postUnitPreVerification(pctx, opts) {
                 return "dispatched";
             }
             if (signal.signal === "pause") {
-                await pauseAuto(ctx, pi);
-                return "dispatched";
+                // A worker `pause` is a *temporary* coordination request: the docs
+                // contract (docs/user-docs/parallel-orchestration.md) is "finish current
+                // unit, wait" followed by a matching `resume`. Only the interactive
+                // dashboard runtime owns a resumer — unattended `gsd headless auto` does
+                // not — so a terminal pauseAuto() here strands the worker at exit 10
+                // (BLOCKED) after its first unit, with nothing able to lift it (#1273).
+                // Wait for the coordinator to resume (or stop) us instead. If no resumer
+                // lifts the pause within the window, degrade to in-process serialization
+                // and continue the dispatch loop rather than halting the run forever.
+                const resumeOutcome = await awaitWorkerResume(s.basePath, milestoneLock);
+                if (resumeOutcome === "stop") {
+                    await stopAuto(ctx, pi);
+                    return "dispatched";
+                }
+                if (resumeOutcome === "timeout") {
+                    logWarning("parallel", `pause signal for ${milestoneLock} was not resumed (no headless resumer, #1273); continuing dispatch`);
+                }
+                // "resume" or "timeout": fall through and continue post-unit processing.
             }
         }
     }

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -2299,6 +2299,26 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
     trackPromptContext(contextTelemetry, "runtime", runtimeContext ? "inline" : "skipped", runtimeContext, runtimeContext ? undefined : "missing");
     let phaseAnchorSection = planAnchor ? formatAnchorForPrompt(planAnchor) : "";
     trackPromptContext(contextTelemetry, "plan-anchor", phaseAnchorSection ? "inline" : "skipped", phaseAnchorSection, phaseAnchorSection ? undefined : "missing");
+    // #1272: inject a pending reopen reason into this task's prompt. When a gate
+    // (e.g. complete-slice's full-suite run) reopened the task via gsd_task_reopen
+    // with a diagnosis, surface it here so the re-dispatched executor fixes the
+    // regression instead of re-running the original (green) scoped verify. Claim
+    // is one-shot (artifact deleted on read). Not feature-gated — a reopened task
+    // must always know why. Prepended so it sits above the plan anchor.
+    try {
+        const { claimReopenReasonForInjection } = await import("./reopen-reason.js");
+        const reopenClaimed = claimReopenReasonForInjection(base, mid, sid, tid);
+        if (reopenClaimed) {
+            const block = reopenClaimed.injectionBlock + "\n\n---\n\n";
+            phaseAnchorSection = phaseAnchorSection
+                ? `${block}${phaseAnchorSection}`
+                : block;
+            trackPromptContext(contextTelemetry, "reopen-reason", "inline", reopenClaimed.injectionBlock);
+        }
+    }
+    catch (reopenErr) {
+        logWarning("prompt", `reopen reason injection failed: ${reopenErr.message}`);
+    }
     // ADR-011 Phase 2: inject any resolved-but-unapplied escalation override
     // into this task's prompt. Claim is atomic via DB UPDATE WHERE IS NULL, so
     // if a parallel build already injected it, we skip. Feature-gated by

package/dist/resources/extensions/gsd/auto.js

@@ -58,6 +58,7 @@ import { isInAutoWorktree } from "./auto-worktree-entry.js";
 import { getAutoWorktreePath } from "./auto-worktree-path-resolution.js";
 import { checkResourcesStale } from "./auto-worktree-resource-version.js";
 import { escapeStaleWorktree } from "./auto-worktree-runtime-cleanup.js";
+import { teardownWarmedBrowserDaemons } from "./browser-daemon-auto-prep.js";
 import { teardownAutoWorktree } from "./auto-worktree-teardown.js";
 import { pruneQueueOrder } from "./queue-order.js";
 import { startCommandPolling as _startCommandPolling, isRemoteConfigured } from "../remote-questions/manager.js";
@@ -1003,6 +1004,17 @@ export async function cleanupAfterLoopExit(ctx) {
         /* best-effort — mirror stopAuto cleanup */
         logWarning("session", `lock cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
     }
+    // Symmetric teardown for the browser-UAT warm-up preflight (#1259): stop any
+    // gsd-browser daemon this session started so the Chrome process does not
+    // linger after the loop exits. Re-warms on the next browser-backed run-uat.
+    try {
+        for (const { projectRoot, error } of teardownWarmedBrowserDaemons()) {
+            logWarning("session", `gsd-browser daemon stop failed for ${projectRoot}: ${error}`, { file: "auto.ts" });
+        }
+    }
+    catch (err) {
+        logWarning("session", `browser daemon teardown failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+    }
     // A transient provider-error pause intentionally leaves the paused badge
     // visible so the user still has a resumable auto-mode signal on screen.
     if (!s.paused) {

package/dist/resources/extensions/gsd/browser-daemon-auto-prep.js

@@ -1,9 +1,16 @@
 import { execFileSync } from "node:child_process";
 import { resolve } from "node:path";
 import { resolveAmbientBrowserEngineResolution, resolveBrowserEngineResolution, } from "../browser-tools/engine/selection.js";
-import { resolveGsdBrowserCliAvailability, resolveGsdBrowserDaemonStartInvocation, } from "../shared/gsd-browser-cli.js";
+import { resolveGsdBrowserCliAvailability, resolveGsdBrowserDaemonStartInvocation, resolveGsdBrowserDaemonStopInvocation, } from "../shared/gsd-browser-cli.js";
 import { uatTypeIncludesBrowser } from "./uat-policy.js";
 const DEFAULT_DAEMON_START_TIMEOUT_MS = 30_000;
+const DEFAULT_DAEMON_STOP_TIMEOUT_MS = 15_000;
+/**
+ * Project roots whose gsd-browser daemon this process warmed via
+ * {@link prepareBrowserDaemonForUat}. Teardown only stops daemons we actually
+ * started, so non-browser auto-mode sessions never spawn a stray `daemon stop`.
+ */
+const warmedDaemonProjectRoots = new Set();
 function isEnvDisabled(value) {
     if (!value)
         return false;
@@ -77,7 +84,66 @@ export function prepareBrowserDaemonForUat(ctx) {
     if (!shouldWarmBrowserDaemonForUat(ctx))
         return null;
     const result = ensureBrowserDaemonStarted(ctx.projectRoot, { env: ctx.env });
-    if (result.ok)
+    if (result.ok) {
+        warmedDaemonProjectRoots.add(resolve(ctx.projectRoot));
         return null;
+    }
     return `Cannot dispatch browser-backed run-uat: gsd-browser daemon failed to start (${result.error}). Ensure Chrome/Chromium is installed, run \`gsd-browser daemon health\` with the project session flags from .mcp.json, or set GSD_BROWSER_PATH to a Chromium binary.`;
 }
+/**
+ * Best-effort stop of a gsd-browser session daemon warmed for browser UAT.
+ * Mirrors {@link ensureBrowserDaemonStarted}; returns the failure detail rather
+ * than throwing so teardown can stay non-fatal.
+ */
+export function stopBrowserDaemon(projectRoot, options = {}) {
+    const env = options.env ?? process.env;
+    const availability = resolveGsdBrowserCliAvailability(env);
+    if (!availability.available) {
+        return { ok: false, error: availability.detail };
+    }
+    let invocation;
+    try {
+        invocation = resolveGsdBrowserDaemonStopInvocation(projectRoot, env);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+    try {
+        execFileSync(invocation.command, invocation.args, {
+            cwd: invocation.cwd,
+            env: { ...process.env, ...env, ...(invocation.env ?? {}) },
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: options.timeoutMs ?? DEFAULT_DAEMON_STOP_TIMEOUT_MS,
+            encoding: "utf-8",
+        });
+        return { ok: true };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/**
+ * Tear down every gsd-browser daemon this process warmed for browser UAT,
+ * clearing the tracked set. Called on auto-mode loop exit so the Chrome process
+ * does not survive session/task completion (mirrors the warm-up preflight).
+ * Best-effort: returns the project roots whose stop failed for logging.
+ */
+export function teardownWarmedBrowserDaemons(options = {}) {
+    if (warmedDaemonProjectRoots.size === 0)
+        return [];
+    const failures = [];
+    for (const projectRoot of warmedDaemonProjectRoots) {
+        const result = stopBrowserDaemon(projectRoot, { env: options.env });
+        if (!result.ok) {
+            failures.push({ projectRoot, error: result.error });
+        }
+    }
+    warmedDaemonProjectRoots.clear();
+    return failures;
+}

package/dist/resources/extensions/gsd/reopen-reason.js

@@ -0,0 +1,98 @@
+// Project/App: gsd-pi
+// File Purpose: Persist a reopened task's failure diagnosis and inject it into the re-dispatched execute-task prompt.
+// GSD Extension — follow-up to #1225 (#1272)
+//
+// When complete-slice's gate reopens a task via gsd_task_reopen, the operator
+// supplies a `reason` explaining exactly what the full-suite gate caught and
+// how to fix it. That reason previously only landed in the workflow event log
+// (audit trail) and never reached the re-dispatched executor, so the executor
+// re-ran the original (green) verify and re-completed the task without touching
+// the regression. This module is the "inject unresolved context into the next
+// dispatch" mechanism for reopen reasons — a lightweight, file-based sibling of
+// escalation.js#claimOverrideForInjection, keyed by (milestone, slice, task).
+import { existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { legacyMilestonesDir, resolveSlicePath, resolveTasksDir } from "./paths.js";
+import { atomicWriteSync } from "./atomic-write.js";
+import { logWarning } from "./workflow-logger.js";
+/**
+ * Canonical reopen-reason artifact path, parallel to T##-SUMMARY.md and
+ * T##-ESCALATION.json:
+ *   .gsd/milestones/{M}/slices/{S}/tasks/{T}-REOPEN.json
+ * Flat-phase: the artifact sits directly in the phase dir. Legacy layouts
+ * without a tasks/ subdir return null (caller degrades gracefully).
+ */
+export function reopenReasonArtifactPath(basePath, milestoneId, sliceId, taskId) {
+    const tDir = resolveTasksDir(basePath, milestoneId, sliceId);
+    if (tDir)
+        return join(tDir, `${taskId}-REOPEN.json`);
+    if (existsSync(legacyMilestonesDir(basePath)))
+        return null;
+    const phaseDir = resolveSlicePath(basePath, milestoneId, sliceId);
+    if (!phaseDir)
+        return null;
+    return join(phaseDir, `${taskId}-REOPEN.json`);
+}
+/**
+ * Persist the reopen reason so the next execute-task dispatch can surface it.
+ * A no-op when the reason is empty or the artifact path cannot be resolved —
+ * reopen itself must still succeed even if we cannot attach context.
+ */
+export function writeReopenReason(basePath, milestoneId, sliceId, taskId, reason) {
+    const trimmed = reason.trim();
+    if (!trimmed)
+        return;
+    const path = reopenReasonArtifactPath(basePath, milestoneId, sliceId, taskId);
+    if (!path) {
+        logWarning("tool", `reopen-reason: cannot resolve artifact path for ${milestoneId}/${sliceId}/${taskId}; reopen reason not attached to next dispatch`);
+        return;
+    }
+    const artifact = {
+        version: 1,
+        milestoneId, sliceId, taskId,
+        reason: trimmed,
+        createdAt: new Date().toISOString(),
+    };
+    mkdirSync(join(path, ".."), { recursive: true });
+    atomicWriteSync(path, JSON.stringify(artifact, null, 2));
+}
+/**
+ * If a reopen reason is pending for this task, claim it (one-shot: the artifact
+ * is deleted on read) and return the markdown block to prepend to the executor's
+ * prompt. Returns null when nothing is pending or the artifact is malformed.
+ */
+export function claimReopenReasonForInjection(basePath, milestoneId, sliceId, taskId) {
+    const path = reopenReasonArtifactPath(basePath, milestoneId, sliceId, taskId);
+    if (!path || !existsSync(path))
+        return null;
+    let art = null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        if (parsed && parsed.version === 1 && typeof parsed.reason === "string" && parsed.reason.trim()) {
+            art = parsed;
+        }
+    }
+    catch {
+        art = null;
+    }
+    // Claim (delete) regardless of validity so a malformed artifact doesn't
+    // wedge every future dispatch of this task.
+    try {
+        unlinkSync(path);
+    }
+    catch { /* already gone */ }
+    if (!art)
+        return null;
+    return { injectionBlock: formatReopenReasonBlock(art) };
+}
+function formatReopenReasonBlock(art) {
+    return [
+        `## Reopened — Reason (from ${art.taskId})`,
+        "",
+        "This task was previously marked complete but a downstream gate (e.g. complete-slice's full-suite run) reopened it. The verify command in your task plan passed in isolation — it did **not** catch the regression below. Do **not** call `gsd_task_complete` until you have reproduced and fixed exactly what this diagnosis describes, then re-run the specific failing command it names (not just the original scoped verify).",
+        "",
+        "**Diagnosis / fix instructions from the gate:**",
+        "",
+        art.reason.trim(),
+    ].join("\n");
+}

package/dist/resources/extensions/gsd/session-status-io.js

@@ -18,6 +18,11 @@ const PARALLEL_DIR = "parallel";
 const STATUS_SUFFIX = ".status.json";
 const SIGNAL_SUFFIX = ".signal.json";
 const DEFAULT_STALE_TIMEOUT_MS = 30_000;
+// How long a paused worker waits for the coordinator to lift the pause before
+// it degrades to in-process serialization (#1273). Kept below the stale
+// timeout so the wait never races the coordinator's liveness detection.
+const DEFAULT_RESUME_WAIT_MS = 10_000;
+const DEFAULT_RESUME_POLL_MS = 250;
 function isSessionStatus(data) {
     return data !== null && typeof data === "object" && "milestoneId" in data && "pid" in data;
 }
@@ -105,6 +110,32 @@ export function consumeSignal(basePath, milestoneId) {
     }
     return msg;
 }
+/**
+ * Wait for a coordinator to lift a `pause` on a worker by sending `resume`
+ * (or `stop`). Polls the signal file until one of those arrives or the timeout
+ * elapses. Intervening `pause`/`rebase` signals are consumed and ignored so a
+ * repeated pause doesn't reset the wait.
+ *
+ * A worker's `pause` is only ever lifted by the interactive/dashboard resumer;
+ * unattended `gsd headless auto` owns no resumer, so callers use the `"timeout"`
+ * result to degrade to in-process serialization instead of stranding the worker
+ * at a terminal pause it cannot resume (#1273).
+ */
+export async function awaitWorkerResume(basePath, milestoneId, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_RESUME_WAIT_MS;
+    const pollMs = opts.pollMs ?? DEFAULT_RESUME_POLL_MS;
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const msg = consumeSignal(basePath, milestoneId);
+        if (msg?.signal === "resume")
+            return "resume";
+        if (msg?.signal === "stop")
+            return "stop";
+        if (Date.now() >= deadline)
+            return "timeout";
+        await new Promise((resolve) => setTimeout(resolve, pollMs));
+    }
+}
 // ─── Stale Detection ───────────────────────────────────────────────────────
 /** Check whether a session is stale (PID dead or heartbeat timed out). */
 export function isSessionStale(status, timeoutMs = DEFAULT_STALE_TIMEOUT_MS) {

package/dist/resources/extensions/gsd/tools/reopen-task.js

@@ -15,6 +15,7 @@ import { flushWorkflowProjections } from "../projection-flush.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
+import { writeReopenReason } from "../reopen-reason.js";
 import { existsSync, unlinkSync } from "node:fs";
 import { join, basename, dirname } from "node:path";
 import { resolveTasksDir, resolveSlicePath, clearPathCache } from "../paths.js";
@@ -89,6 +90,20 @@ export async function handleReopenTask(params, basePath) {
         logWarning("tool", `reopen-task artifact cleanup warning: ${cleanupErr.message}`);
     }
     clearPathCache();
+    // ── Persist the reopen reason for the next execute-task dispatch (#1272) ──
+    // Without this, the re-dispatched executor receives the original task plan
+    // and verify command with zero signal that it was reopened — it re-runs the
+    // (still-green) scoped verify and re-completes the task, never touching the
+    // regression the gate actually caught. buildExecuteTaskPrompt claims this
+    // artifact and prepends the diagnosis to the next dispatch.
+    if (params.reason && params.reason.trim() !== "") {
+        try {
+            writeReopenReason(basePath, params.milestoneId, params.sliceId, params.taskId, params.reason);
+        }
+        catch (reasonErr) {
+            logWarning("tool", `reopen-task reason persistence warning: ${reasonErr.message}`);
+        }
+    }
     // ── Post-mutation hook ───────────────────────────────────────────────────
     try {
         await flushWorkflowProjections(basePath, { milestoneId: params.milestoneId });

package/dist/resources/extensions/shared/gsd-browser-cli.js

@@ -307,11 +307,12 @@ export function resolveGsdBrowserMcpLaunchConfig(projectRoot, env = process.env,
     };
 }
 /**
- * CLI invocation that starts the gsd-browser session daemon with the same
- * session and identity flags as {@link resolveGsdBrowserMcpLaunchConfig}, so
- * browser UAT can warm Chrome/CDP before the first MCP navigation.
+ * CLI invocation that runs a `daemon <action>` command against the gsd-browser
+ * session daemon with the same session and identity flags as
+ * {@link resolveGsdBrowserMcpLaunchConfig}, so start (warm-up) and stop
+ * (teardown) address the exact same managed daemon.
  */
-export function resolveGsdBrowserDaemonStartInvocation(projectRoot, env = process.env, options = {}) {
+function resolveGsdBrowserDaemonInvocation(action, projectRoot, env, options) {
     const launch = resolveGsdBrowserMcpLaunchConfig(projectRoot, env, options);
     const mcpIndex = launch.args.indexOf("mcp");
     if (mcpIndex < 0) {
@@ -321,8 +322,24 @@ export function resolveGsdBrowserDaemonStartInvocation(projectRoot, env = proces
     const sessionFlags = launch.args.slice(mcpIndex + 1);
     return {
         command: launch.command,
-        args: [...prefix, "daemon", "start", ...sessionFlags],
+        args: [...prefix, "daemon", action, ...sessionFlags],
         cwd: launch.cwd,
         ...(launch.env ? { env: launch.env } : {}),
     };
 }
+/**
+ * CLI invocation that starts the gsd-browser session daemon with the same
+ * session and identity flags as {@link resolveGsdBrowserMcpLaunchConfig}, so
+ * browser UAT can warm Chrome/CDP before the first MCP navigation.
+ */
+export function resolveGsdBrowserDaemonStartInvocation(projectRoot, env = process.env, options = {}) {
+    return resolveGsdBrowserDaemonInvocation("start", projectRoot, env, options);
+}
+/**
+ * CLI invocation that stops the gsd-browser session daemon warmed for browser
+ * UAT, so the Chrome process is torn down instead of lingering after the
+ * triggering task/session ends.
+ */
+export function resolveGsdBrowserDaemonStopInvocation(projectRoot, env = process.env, options = {}) {
+    return resolveGsdBrowserDaemonInvocation("stop", projectRoot, env, options);
+}