gsd-pi 2.28.0 → 2.29.0-dev.7612840

package/src/resources/extensions/gsd/history.ts

@@ -2,6 +2,7 @@
 // Human-readable display of past auto-mode unit executions.
 
 import type { ExtensionCommandContext } from "@gsd/pi-coding-agent";
+import { formatDuration, padRight, truncateWithEllipsis } from "../shared/format-utils.js";
 import {
   getLedger, getProjectTotals, formatCost, formatTokenCount,
   aggregateBySlice, aggregateByPhase, aggregateByModel, loadLedgerFromDisk,
@@ -57,7 +58,7 @@ export async function handleHistory(args: string, ctx: ExtensionCommandContext,
     lines.push(
       padRight(formatRelativeTime(u.finishedAt), 14) +
       padRight(u.type, 20) +
-      padRight(truncate(u.id, 15), 16) +
+      padRight(truncateWithEllipsis(u.id, 15), 16) +
       padRight(shortModel(u.model), 14) +
       padRight(formatCost(u.cost), 10) +
       padRight(formatTokenCount(u.tokens.total), 10) +
@@ -128,18 +129,6 @@ function showModelBreakdown(units: UnitMetrics[], ctx: ExtensionCommandContext):
 
 // ─── Formatting helpers ──────────────────────────────────────────────────────
 
-export function formatDuration(ms: number): string {
-  if (ms < 1000) return `${ms}ms`;
-  const secs = Math.floor(ms / 1000);
-  if (secs < 60) return `${secs}s`;
-  const mins = Math.floor(secs / 60);
-  const remSecs = secs % 60;
-  if (mins < 60) return `${mins}m ${remSecs}s`;
-  const hours = Math.floor(mins / 60);
-  const remMins = mins % 60;
-  return `${hours}h ${remMins}m`;
-}
-
 function formatRelativeTime(timestamp: number): string {
   const diff = Date.now() - timestamp;
   if (diff < 60_000) return "just now";
@@ -152,10 +141,3 @@ function shortModel(model: string): string {
   return model.replace(/^claude-/, "").replace(/^anthropic\//, "");
 }
 
-function truncate(s: string, maxLen: number): string {
-  return s.length > maxLen ? s.slice(0, maxLen - 1) + "…" : s;
-}
-
-function padRight(s: string, len: number): string {
-  return s.length >= len ? s.slice(0, len) : s + " ".repeat(len - s.length);
-}

package/src/resources/extensions/gsd/index.ts

@@ -27,14 +27,15 @@ import { createBashTool, createWriteTool, createReadTool, createEditTool, isTool
 import { Type } from "@sinclair/typebox";
 
 import { debugLog, debugTime } from "./debug-logger.js";
-import { registerGSDCommand, loadToolApiKeys } from "./commands.js";
+import { registerGSDCommand } from "./commands.js";
+import { loadToolApiKeys } from "./commands-config.js";
 import { registerExitCommand } from "./exit-command.js";
 import { registerWorktreeCommand, getWorktreeOriginalCwd, getActiveWorktreeName } from "./worktree-command.js";
 import { getActiveAutoWorktreeContext } from "./auto-worktree.js";
 import { saveFile, formatContinue, loadFile, parseContinue, parseSummary, loadActiveOverrides, formatOverridesSection } from "./files.js";
 import { loadPrompt } from "./prompt-loader.js";
 import { deriveState } from "./state.js";
-import { isAutoActive, isAutoPaused, handleAgentEnd, pauseAuto, getAutoDashboardData, markToolStart, markToolEnd } from "./auto.js";
+import { isAutoActive, isAutoPaused, handleAgentEnd, pauseAuto, getAutoDashboardData, getAutoModeStartModel, markToolStart, markToolEnd } from "./auto.js";
 import { saveActivityLog } from "./activity-log.js";
 import { checkAutoStartAfterDiscuss, getDiscussionMilestoneId, findMilestoneIds, nextMilestoneId } from "./guided-flow.js";
 import { GSDDashboardOverlay } from "./dashboard-overlay.js";
@@ -57,11 +58,31 @@ import { Key } from "@gsd/pi-tui";
 import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { shortcutDesc } from "../shared/terminal.js";
+import { shortcutDesc } from "../shared/mod.js";
 import { Text } from "@gsd/pi-tui";
-import { pauseAutoForProviderError } from "./provider-error-pause.js";
-import { toPosixPath } from "../shared/path-display.js";
+import { pauseAutoForProviderError, classifyProviderError } from "./provider-error-pause.js";
+import { toPosixPath } from "../shared/mod.js";
 import { isParallelActive, shutdownParallel } from "./parallel-orchestrator.js";
+import { DEFAULT_BASH_TIMEOUT_SECS } from "./constants.js";
+
+/**
+ * Ensure the GSD database is available, auto-initializing if needed.
+ * Returns true if the DB is ready, false if initialization failed.
+ */
+async function ensureDbAvailable(): Promise<boolean> {
+  try {
+    const db = await import("./gsd-db.js");
+    if (db.isDbAvailable()) return true;
+
+    // Auto-initialize: open (and create if needed) the DB at the standard path
+    const gsdDir = join(process.cwd(), ".gsd");
+    if (!existsSync(gsdDir)) return false; // No GSD project — can't create DB
+    const dbPath = join(gsdDir, "gsd.db");
+    return db.openDatabase(dbPath);
+  } catch {
+    return false;
+  }
+}
 
 // ── Agent Instructions ────────────────────────────────────────────────────
 // Lightweight "always follow" files injected into every GSD agent session.
@@ -92,15 +113,51 @@ function loadAgentInstructions(): string | null {
 }
 
 // ── Depth verification state ──────────────────────────────────────────────
-let depthVerificationDone = false;
+// Tracks which milestones have passed depth verification.
+// Single-milestone flows set '*' (wildcard). Multi-milestone flows set per-ID.
+const depthVerifiedMilestones = new Set<string>();
+
+// ── Queue phase tracking ──────────────────────────────────────────────────
+// When true, the LLM is in a queue flow writing CONTEXT.md files.
+// The write-gate applies during queue flows just like discussion flows.
+let activeQueuePhase = false;
 
 // ── Network error retry counters ──────────────────────────────────────────
 // Tracks per-model retry attempts for transient network errors.
 // Cleared when a model switch occurs or retries are exhausted.
 const networkRetryCounters = new Map<string, number>();
 
+// ── Transient error escalation ───────────────────────────────────────────
+// Tracks consecutive transient auto-resume attempts. Each attempt doubles
+// the delay. After MAX_TRANSIENT_AUTO_RESUMES consecutive failures, auto-mode
+// pauses indefinitely to avoid infinite rapid-fire retries (#1166).
+const MAX_TRANSIENT_AUTO_RESUMES = 5;
+let consecutiveTransientErrors = 0;
+
 export function isDepthVerified(): boolean {
-  return depthVerificationDone;
+  return depthVerifiedMilestones.has("*") || depthVerifiedMilestones.size > 0;
+}
+
+/** Check whether a specific milestone has passed depth verification. */
+export function isDepthVerifiedFor(milestoneId: string): boolean {
+  // Wildcard means "all milestones verified" (single-milestone flow)
+  if (depthVerifiedMilestones.has("*")) return true;
+  return depthVerifiedMilestones.has(milestoneId);
+}
+
+/** Mark a specific milestone as depth-verified. */
+export function markDepthVerified(milestoneId: string): void {
+  depthVerifiedMilestones.add(milestoneId);
+}
+
+/** Check whether a queue phase is active. */
+export function isQueuePhaseActive(): boolean {
+  return activeQueuePhase;
+}
+
+/** Set the queue phase state — called from guided-flow-queue.ts on dispatch. */
+export function setQueuePhaseActive(active: boolean): void {
+  activeQueuePhase = active;
 }
 
 // ── Write-gate: block CONTEXT.md writes during discussion without depth verification ──
@@ -111,14 +168,35 @@ export function shouldBlockContextWrite(
   inputPath: string,
   milestoneId: string | null,
   depthVerified: boolean,
+  queuePhaseActive?: boolean,
 ): { block: boolean; reason?: string } {
   if (toolName !== "write") return { block: false };
-  if (!milestoneId) return { block: false };
+
+  // Gate applies during both discussion (milestoneId set) and queue (queuePhaseActive) flows
+  const inDiscussion = milestoneId !== null;
+  const inQueue = queuePhaseActive ?? false;
+  if (!inDiscussion && !inQueue) return { block: false };
+
   if (!MILESTONE_CONTEXT_RE.test(inputPath)) return { block: false };
-  if (depthVerified) return { block: false };
+
+  // For discussion flows: check global depth verification (backward compat)
+  if (inDiscussion && depthVerified) return { block: false };
+
+  // For queue flows: extract milestone ID from the path and check per-milestone verification
+  if (inQueue) {
+    const pathMatch = inputPath.match(/\/(M\d+(?:-[a-z0-9]{6})?)-CONTEXT\.md$/);
+    const targetMid = pathMatch?.[1];
+    if (targetMid && depthVerifiedMilestones.has(targetMid)) return { block: false };
+    // Wildcard passes all
+    if (depthVerifiedMilestones.has("*")) return { block: false };
+  }
+
   return {
     block: true,
-    reason: `Blocked: Cannot write to milestone CONTEXT.md during discussion phase without depth verification. Call ask_user_questions with question id "depth_verification" first to confirm discussion depth before writing context.`,
+    reason: `Blocked: Cannot write milestone CONTEXT.md without depth verification. ` +
+      `Use ask_user_questions with a question id containing "depth_verification" first. ` +
+      `For multi-milestone flows, include the milestone ID in the question id (e.g., "depth_verification_M001"). ` +
+      `This ensures each milestone's context has been critically examined before being written.`,
   };
 }
 
@@ -171,7 +249,6 @@ export default function (pi: ExtensionAPI) {
   // the timeout parameter, commands run indefinitely, causing hangs on
   // Windows where process killing is unreliable (see #40). We wrap execute
   // to inject a 120-second default when no timeout is provided.
-  const DEFAULT_BASH_TIMEOUT_SECS = 120;
   const baseBash = createBashTool(process.cwd(), {
     spawnHook: (ctx) => ({ ...ctx, cwd: process.cwd() }),
   });
@@ -270,14 +347,8 @@ export default function (pi: ExtensionAPI) {
       when_context: Type.Optional(Type.String({ description: "When/context for the decision (e.g. milestone ID)" })),
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
-      // Check DB availability
-      let dbAvailable = false;
-      try {
-        const db = await import("./gsd-db.js");
-        dbAvailable = db.isDbAvailable();
-      } catch { /* dynamic import failed */ }
-
-      if (!dbAvailable) {
+      // Ensure DB is available (auto-initialize if needed)
+      if (!await ensureDbAvailable()) {
         return {
           content: [{ type: "text" as const, text: "Error: GSD database is not available. Cannot save decision." }],
           isError: true,
@@ -337,13 +408,8 @@ export default function (pi: ExtensionAPI) {
       supporting_slices: Type.Optional(Type.String({ description: "Supporting slices" })),
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
-      let dbAvailable = false;
-      try {
-        const db = await import("./gsd-db.js");
-        dbAvailable = db.isDbAvailable();
-      } catch { /* dynamic import failed */ }
-
-      if (!dbAvailable) {
+      // Ensure DB is available (auto-initialize if needed)
+      if (!await ensureDbAvailable()) {
         return {
           content: [{ type: "text" as const, text: "Error: GSD database is not available. Cannot update requirement." }],
           isError: true,
@@ -411,13 +477,8 @@ export default function (pi: ExtensionAPI) {
       content: Type.String({ description: "The full markdown content of the artifact" }),
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
-      let dbAvailable = false;
-      try {
-        const db = await import("./gsd-db.js");
-        dbAvailable = db.isDbAvailable();
-      } catch { /* dynamic import failed */ }
-
-      if (!dbAvailable) {
+      // Ensure DB is available (auto-initialize if needed)
+      if (!await ensureDbAvailable()) {
         return {
           content: [{ type: "text" as const, text: "Error: GSD database is not available. Cannot save artifact." }],
           isError: true,
@@ -479,6 +540,11 @@ export default function (pi: ExtensionAPI) {
   // The LLM cannot generate random suffixes for unique_milestone_ids on its
   // own. This tool calls back into the TS code that owns ID generation,
   // ensuring the preference is always respected and IDs are always valid.
+  //
+  // Reservation set: tracks IDs returned by this tool but not yet persisted
+  // to disk, preventing duplicate M001 when called multiple times (#961).
+  const reservedMilestoneIds = new Set<string>();
+
   pi.registerTool({
     name: "gsd_generate_milestone_id",
     label: "Generate Milestone ID",
@@ -499,10 +565,13 @@ export default function (pi: ExtensionAPI) {
         const basePath = process.cwd();
         const existingIds = findMilestoneIds(basePath);
         const uniqueEnabled = !!loadEffectiveGSDPreferences()?.preferences?.unique_milestone_ids;
-        const newId = nextMilestoneId(existingIds, uniqueEnabled);
+        // Combine on-disk IDs with previously reserved (but not yet persisted) IDs
+        const allIds = [...new Set([...existingIds, ...reservedMilestoneIds])];
+        const newId = nextMilestoneId(allIds, uniqueEnabled);
+        reservedMilestoneIds.add(newId);
         return {
           content: [{ type: "text" as const, text: newId }],
-          details: { operation: "generate_milestone_id", id: newId, existingCount: existingIds.length, uniqueEnabled },
+          details: { operation: "generate_milestone_id", id: newId, existingCount: existingIds.length, reservedCount: reservedMilestoneIds.size, uniqueEnabled },
         };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -517,6 +586,10 @@ export default function (pi: ExtensionAPI) {
 
   // ── session_start: render branded GSD header + load tool keys + remote status ──
   pi.on("session_start", async (_event, ctx) => {
+    // Clear depth verification and queue phase state from any prior session
+    depthVerifiedMilestones.clear();
+    activeQueuePhase = false;
+
     // Theme access throws in RPC mode (no TUI) — header is decorative, skip it
     try {
       const theme = ctx.ui.theme;
@@ -561,7 +634,7 @@ export default function (pi: ExtensionAPI) {
         return;
       }
 
-      await ctx.ui.custom<void>(
+      const result = await ctx.ui.custom<void>(
         (tui, theme, _kb, done) => {
           return new GSDDashboardOverlay(tui, theme, () => done());
         },
@@ -575,6 +648,12 @@ export default function (pi: ExtensionAPI) {
           },
         },
       );
+
+      // Fallback for RPC mode where ctx.ui.custom() returns undefined.
+      if (result === undefined) {
+        const { fireStatusViaCommand } = await import("./commands.js");
+        await fireStatusViaCommand(ctx);
+      }
     },
   });
 
@@ -712,7 +791,8 @@ export default function (pi: ExtensionAPI) {
   pi.on("agent_end", async (event, ctx: ExtensionContext) => {
     // If discuss phase just finished, start auto-mode
     if (checkAutoStartAfterDiscuss()) {
-      depthVerificationDone = false;
+      depthVerifiedMilestones.clear();
+      activeQueuePhase = false;
       return;
     }
 
@@ -817,18 +897,76 @@ export default function (pi: ExtensionAPI) {
         }
       }
 
-      // Detect rate-limit errors and extract retry delay for auto-resume
-      const isRateLimit = /rate.?limit|too many requests|429/i.test(errorMsg);
-      const retryAfterMs = ("retryAfterMs" in lastMsg && typeof lastMsg.retryAfterMs === "number")
+      // ── Session model recovery (#1065) ──────────────────────────────────
+      // Before pausing, attempt to restore the model captured at auto-mode
+      // start. This prevents cross-session model leakage: when fallback
+      // chains are exhausted (or absent), the session retries with the model
+      // the user originally chose instead of reading (possibly stale) global
+      // preferences that another concurrent session may have modified.
+      const sessionModel = getAutoModeStartModel();
+      if (sessionModel) {
+        const currentModelId = ctx.model?.id;
+        const currentProvider = ctx.model?.provider;
+        // Only attempt recovery if the current model diverged from the session model
+        if (currentModelId !== sessionModel.id || currentProvider !== sessionModel.provider) {
+          const availableModels = ctx.modelRegistry.getAvailable();
+          const startModel = availableModels.find(
+            m => m.provider === sessionModel.provider && m.id === sessionModel.id,
+          );
+          if (startModel) {
+            const ok = await pi.setModel(startModel, { persist: false });
+            if (ok) {
+              networkRetryCounters.clear();
+              ctx.ui.notify(
+                `Model error${errorDetail}. Restored session model: ${sessionModel.provider}/${sessionModel.id} and resuming.`,
+                "warning",
+              );
+              pi.sendMessage(
+                { customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false },
+                { triggerTurn: true },
+              );
+              return;
+            }
+          }
+        }
+      }
+
+      // Classify the error: transient (auto-resume) vs permanent (manual resume)
+      const classification = classifyProviderError(errorMsg);
+
+      // Extract explicit retry-after from the message or response metadata
+      const explicitRetryAfterMs = ("retryAfterMs" in lastMsg && typeof lastMsg.retryAfterMs === "number")
         ? lastMsg.retryAfterMs
-        : (() => { const m = errorMsg.match(/reset in (\d+)s/i); return m ? Number(m[1]) * 1000 : undefined; })();
+        : undefined;
+      let retryAfterMs = explicitRetryAfterMs ?? classification.suggestedDelayMs;
+
+      // ── Escalating backoff for repeated transient errors ──────────────
+      // Each consecutive transient auto-resume doubles the delay. After
+      // MAX_TRANSIENT_AUTO_RESUMES consecutive failures, treat as permanent
+      // to avoid infinite rapid-fire retries (#1166).
+      let effectiveTransient = classification.isTransient;
+      if (classification.isTransient) {
+        consecutiveTransientErrors++;
+        if (consecutiveTransientErrors > MAX_TRANSIENT_AUTO_RESUMES) {
+          effectiveTransient = false;
+          ctx.ui.notify(
+            `${consecutiveTransientErrors} consecutive transient errors. Pausing indefinitely — resume manually with /gsd auto.`,
+            "error",
+          );
+          consecutiveTransientErrors = 0;
+        } else {
+          // Escalate: base delay × 2^(consecutive-1) → 30s, 60s, 120s, 240s, 480s
+          retryAfterMs = retryAfterMs * 2 ** (consecutiveTransientErrors - 1);
+        }
+      }
 
       await pauseAutoForProviderError(ctx.ui, errorDetail, () => pauseAuto(ctx, pi), {
-        isRateLimit,
+        isRateLimit: classification.isRateLimit,
+        isTransient: effectiveTransient,
         retryAfterMs,
         resume: () => {
           pi.sendMessage(
-            { customType: "gsd-auto-timeout-recovery", content: "Continue execution \u2014 rate limit window elapsed.", display: false },
+            { customType: "gsd-auto-timeout-recovery", content: "Continue execution \u2014 provider error recovery delay elapsed.", display: false },
             { triggerTurn: true },
           );
         },
@@ -838,6 +976,7 @@ export default function (pi: ExtensionAPI) {
 
     try {
       networkRetryCounters.clear(); // Clear network retry state on successful unit completion
+      consecutiveTransientErrors = 0; // Reset escalating backoff on success
       await handleAgentEnd(ctx, pi);
     } catch (err) {
       // Safety net: if handleAgentEnd throws despite its internal try-catch,
@@ -919,7 +1058,11 @@ export default function (pi: ExtensionAPI) {
     }
   });
 
-  // ── tool_call: block CONTEXT.md writes during discussion without depth verification ──
+  // ── tool_call: block CONTEXT.md writes without depth verification ──
+  // Active during both discussion flows (pendingAutoStart set) and
+  // queue flows (activeQueuePhase set). For multi-milestone queue flows,
+  // each milestone must pass its own depth verification before its
+  // CONTEXT.md can be written.
   pi.on("tool_call", async (event) => {
     if (!isToolCallEventType("write", event)) return;
     const result = shouldBlockContextWrite(
@@ -927,29 +1070,48 @@ export default function (pi: ExtensionAPI) {
       event.input.path,
       getDiscussionMilestoneId(),
       isDepthVerified(),
+      activeQueuePhase,
     );
     if (result.block) return result;
   });
 
   // ── tool_result: persist discussion exchanges & detect depth gate ──────
+  // Handles both discussion flows and queue flows. For queue flows,
+  // depth verification question IDs may include milestone IDs
+  // (e.g., "depth_verification_M001") for per-milestone gating.
   pi.on("tool_result", async (event) => {
     if (event.toolName !== "ask_user_questions") return;
 
     const milestoneId = getDiscussionMilestoneId();
-    if (!milestoneId) return;
+    // Queue flows don't set pendingAutoStart, so milestoneId may be null.
+    // Depth gate detection still applies — it sets per-milestone flags.
+    const inQueue = activeQueuePhase;
 
     const details = event.details as any;
     if (details?.cancelled || !details?.response) return;
 
     // ── Depth gate detection ──────────────────────────────────────────
+    // Supports two patterns:
+    //   1. "depth_verification" — wildcard, marks all milestones verified
+    //   2. "depth_verification_M001" — per-milestone verification
     const questions: any[] = (event.input as any)?.questions ?? [];
     for (const q of questions) {
       if (typeof q.id === "string" && q.id.includes("depth_verification")) {
-        depthVerificationDone = true;
+        // Extract milestone ID from question ID if present
+        const midMatch = q.id.match(/depth_verification[_-](M\d+(?:-[a-z0-9]{6})?)/i);
+        if (midMatch) {
+          depthVerifiedMilestones.add(midMatch[1]);
+        } else {
+          // Wildcard — all milestones verified (backward compat for single-milestone)
+          depthVerifiedMilestones.add("*");
+        }
         break;
       }
     }
 
+    // Discussion persistence only applies when in a discussion flow with a known milestone
+    if (!milestoneId) return;
+
     // ── Persist exchange to DISCUSSION.md ──────────────────────────────
     const basePath = process.cwd();
     const milestoneDir = resolveMilestonePath(basePath, milestoneId);