gsd-pi 2.49.0 → 2.50.0-dev.d210a87

package/README.md

@@ -19,6 +19,8 @@ One command. Walk away. Come back to a built project with clean git history.
 
 <pre><code>npm install -g gsd-pi@latest</code></pre>
 
+> GSD now provisions a managed [RTK](https://github.com/rtk-ai/rtk) binary on supported macOS, Linux, and Windows installs to compress shell-command output in `bash`, `async_bash`, `bg_shell`, and verification flows. GSD forces `RTK_TELEMETRY_DISABLED=1` for all managed invocations. Set `GSD_RTK_DISABLED=1` to disable the integration.
+
 > **📋 NOTICE: New to Node on Mac?** If you installed Node.js via Homebrew, you may be running a development release instead of LTS. **[Read this guide](./docs/node-lts-macos.md)** to pin Node 24 LTS and avoid compatibility issues.
 
 </div>

package/dist/cli.js

@@ -14,6 +14,8 @@ import { parseCliArgs as parseWebCliArgs, runWebCliBranch, migrateLegacyFlatSess
 import { stopWebMode } from './web-mode.js';
 import { getProjectSessionsDir } from './project-sessions.js';
 import { markStartup, printStartupTimings } from './startup-timings.js';
+import { bootstrapRtk, GSD_RTK_DISABLED_ENV } from './rtk.js';
+import { loadEffectiveGSDPreferences } from './resources/extensions/gsd/preferences.js';
 // ---------------------------------------------------------------------------
 // V8 compile cache — Node 22+ can cache compiled bytecode across runs,
 // eliminating repeated parse/compile overhead for unchanged modules.
@@ -114,6 +116,26 @@ if (!process.stdin.isTTY && !isPrintMode && !hasSubcommand && !cliFlags.listMode
     process.stderr.write('[gsd]   gsd --mode text "message"      Text output mode\n');
     process.exit(1);
 }
+async function ensureRtkBootstrap() {
+    if (ensureRtkBootstrap._done)
+        return;
+    // RTK is opt-in via experimental.rtk preference. Default: disabled.
+    // Honor GSD_RTK_DISABLED if already explicitly set in the environment
+    // (env var takes precedence over preferences for manual override).
+    if (!process.env[GSD_RTK_DISABLED_ENV]) {
+        const prefs = loadEffectiveGSDPreferences();
+        const rtkEnabled = prefs?.preferences.experimental?.rtk === true;
+        if (!rtkEnabled) {
+            process.env[GSD_RTK_DISABLED_ENV] = "1";
+        }
+    }
+    const rtkStatus = await bootstrapRtk();
+    ensureRtkBootstrap._done = true;
+    markStartup('bootstrapRtk');
+    if (!rtkStatus.available && rtkStatus.supported && rtkStatus.enabled && rtkStatus.reason) {
+        process.stderr.write(`[gsd] Warning: RTK unavailable — continuing without shell-command compression (${rtkStatus.reason}).\n`);
+    }
+}
 // `gsd <subcommand> --help` — show subcommand-specific help
 const subcommand = cliFlags.messages[0];
 if (subcommand && process.argv.includes('--help')) {
@@ -161,6 +183,7 @@ if (cliFlags.messages[0] === 'web' && cliFlags.messages[1] === 'stop') {
 }
 // `gsd --web [path]` or `gsd web [start] [path]` — launch browser-only web mode
 if (cliFlags.web || (cliFlags.messages[0] === 'web' && cliFlags.messages[1] !== 'stop')) {
+    await ensureRtkBootstrap();
     const webFlags = parseWebCliArgs(process.argv);
     const webBranch = await runWebCliBranch(webFlags, {
         stderr: process.stderr,
@@ -220,6 +243,7 @@ if (cliFlags.messages[0] === 'sessions') {
 }
 // `gsd headless` — run auto-mode without TUI
 if (cliFlags.messages[0] === 'headless') {
+    await ensureRtkBootstrap();
     const { runHeadless, parseHeadlessArgs } = await import('./headless.js');
     await runHeadless(parseHeadlessArgs(process.argv));
     process.exit(0);
@@ -348,6 +372,7 @@ if (!settingsManager.getCollapseChangelog()) {
 // Print / subagent mode — single-shot execution, no TTY required
 // ---------------------------------------------------------------------------
 if (isPrintMode) {
+    await ensureRtkBootstrap();
     const sessionManager = cliFlags.noSession
         ? SessionManager.inMemory()
         : SessionManager.create(process.cwd());
@@ -465,6 +490,7 @@ if (!cliFlags.worktree && !isPrintMode) {
 // ---------------------------------------------------------------------------
 // Interactive mode — normal TTY session
 // ---------------------------------------------------------------------------
+await ensureRtkBootstrap();
 // Per-directory session storage — same encoding as the upstream SDK so that
 // /resume only shows sessions from the current working directory.
 const cwd = process.cwd();

package/dist/headless-ui.js

@@ -13,9 +13,19 @@ export function handleExtensionUIRequest(event, writeToStdin) {
     const { id, method } = event;
     let response;
     switch (method) {
-        case 'select':
-            response = { type: 'extension_ui_response', id, value: event.options?.[0] ?? '' };
+        case 'select': {
+            // Lock-guard prompts list "View status" first, but headless needs "Force start"
+            // to proceed. Detect by title and pick the force option.
+            const title = String(event.title ?? '');
+            let selected = event.options?.[0] ?? '';
+            if (title.includes('Auto-mode is running') && event.options) {
+                const forceOption = event.options.find(o => o.toLowerCase().includes('force start'));
+                if (forceOption)
+                    selected = forceOption;
+            }
+            response = { type: 'extension_ui_response', id, value: selected };
             break;
+        }
         case 'confirm':
             response = { type: 'extension_ui_response', id, confirmed: true };
             break;

package/dist/headless.js

@@ -37,8 +37,8 @@ export function parseHeadlessArgs(argv) {
         if (!positionalStarted && arg.startsWith('--')) {
             if (arg === '--timeout' && i + 1 < args.length) {
                 options.timeout = parseInt(args[++i], 10);
-                if (Number.isNaN(options.timeout) || options.timeout <= 0) {
-                    process.stderr.write('[headless] Error: --timeout must be a positive integer (milliseconds)\n');
+                if (Number.isNaN(options.timeout) || options.timeout < 0) {
+                    process.stderr.write('[headless] Error: --timeout must be a non-negative integer (milliseconds, 0 to disable)\n');
                     process.exit(1);
                 }
             }
@@ -132,6 +132,13 @@ async function runHeadlessOnce(options, restartCount) {
     if (isNewMilestone && options.timeout === 300_000) {
         options.timeout = 600_000; // 10 minutes
     }
+    // auto-mode sessions are long-running (minutes to hours) with their own internal
+    // per-unit timeout via auto-supervisor. Disable the overall timeout unless the
+    // user explicitly set --timeout.
+    const isAutoMode = options.command === 'auto';
+    if (isAutoMode && options.timeout === 300_000) {
+        options.timeout = 0;
+    }
     // Supervised mode cannot share stdin with --context -
     if (options.supervised && options.context === '-') {
         process.stderr.write('[headless] Error: --supervised cannot be used with --context - (both require stdin)\n');
@@ -267,12 +274,14 @@ async function runHeadlessOnce(options, restartCount) {
     }
     // Precompute supervised response timeout
     const responseTimeout = options.responseTimeout ?? 30_000;
-    // Overall timeout
-    const timeoutTimer = setTimeout(() => {
-        process.stderr.write(`[headless] Timeout after ${options.timeout / 1000}s\n`);
-        exitCode = 1;
-        resolveCompletion();
-    }, options.timeout);
+    // Overall timeout (disabled when options.timeout === 0, e.g. auto-mode)
+    const timeoutTimer = options.timeout > 0
+        ? setTimeout(() => {
+            process.stderr.write(`[headless] Timeout after ${options.timeout / 1000}s\n`);
+            exitCode = 1;
+            resolveCompletion();
+        }, options.timeout)
+        : null;
     // Event handler
     client.onEvent((event) => {
         const eventObj = event;
@@ -354,7 +363,8 @@ async function runHeadlessOnce(options, restartCount) {
         interrupted = true;
         exitCode = 1;
         client.stop().finally(() => {
-            clearTimeout(timeoutTimer);
+            if (timeoutTimer)
+                clearTimeout(timeoutTimer);
             if (idleTimer)
                 clearTimeout(idleTimer);
             process.exit(exitCode);
@@ -368,7 +378,8 @@ async function runHeadlessOnce(options, restartCount) {
     }
     catch (err) {
         process.stderr.write(`[headless] Error: Failed to start RPC session: ${err instanceof Error ? err.message : String(err)}\n`);
-        clearTimeout(timeoutTimer);
+        if (timeoutTimer)
+            clearTimeout(timeoutTimer);
         process.exit(1);
     }
     // Access stdin writer from the internal process
@@ -376,7 +387,8 @@ async function runHeadlessOnce(options, restartCount) {
     if (!internalProcess?.stdin) {
         process.stderr.write('[headless] Error: Cannot access child process stdin\n');
         await client.stop();
-        clearTimeout(timeoutTimer);
+        if (timeoutTimer)
+            clearTimeout(timeoutTimer);
         process.exit(1);
     }
     stdinWriter = (data) => {
@@ -424,7 +436,10 @@ async function runHeadlessOnce(options, restartCount) {
         if (!options.json) {
             process.stderr.write('[headless] Milestone ready — chaining into auto-mode...\n');
         }
-        // Reset completion state for the auto-mode phase
+        // Reset completion state for the auto-mode phase.
+        // Disable the overall timeout — auto-mode has its own internal supervisor.
+        if (timeoutTimer)
+            clearTimeout(timeoutTimer);
         completed = false;
         milestoneReady = false;
         blocked = false;
@@ -443,7 +458,8 @@ async function runHeadlessOnce(options, restartCount) {
         }
     }
     // Cleanup
-    clearTimeout(timeoutTimer);
+    if (timeoutTimer)
+        clearTimeout(timeoutTimer);
     if (idleTimer)
         clearTimeout(idleTimer);
     pendingResponseTimers.forEach((timer) => clearTimeout(timer));

package/dist/loader.js

@@ -61,6 +61,7 @@ if (firstArg === '--help' || firstArg === '-h') {
     }
 }
 import { agentDir, appRoot } from './app-paths.js';
+import { applyRtkProcessEnv } from './rtk.js';
 import { serializeBundledExtensionPaths } from './bundled-extension-paths.js';
 import { discoverExtensionEntryPaths } from './extension-discovery.js';
 import { loadRegistry, readManifestFromEntryPath, isExtensionEnabled } from './extension-registry.js';
@@ -92,6 +93,9 @@ if (!existsSync(appRoot)) {
 }
 // GSD_CODING_AGENT_DIR — tells pi's getAgentDir() to return ~/.gsd/agent/ instead of ~/.gsd/agent/
 process.env.GSD_CODING_AGENT_DIR = agentDir;
+// RTK environment — make ~/.gsd/agent/bin visible to all child-process paths,
+// not just the bash tool, and force-disable RTK telemetry for GSD-managed use.
+applyRtkProcessEnv(process.env);
 // NODE_PATH — make gsd's own node_modules available to extensions loaded via jiti.
 // Without this, extensions (e.g. browser-tools) can't resolve dependencies like
 // `playwright` because jiti resolves modules from pi-coding-agent's location, not gsd's.

package/dist/resource-loader.d.ts

@@ -8,9 +8,12 @@ export declare function getNewerManagedResourceVersion(agentDir: string, current
  *
  * - extensions/ → ~/.gsd/agent/extensions/   (overwrite when version changes)
  * - agents/     → ~/.gsd/agent/agents/        (overwrite when version changes)
- * - skills/     → ~/.gsd/agent/skills/        (overwrite when version changes)
  * - GSD-WORKFLOW.md → ~/.gsd/agent/GSD-WORKFLOW.md (fallback for env var miss)
  *
+ * Skills are NOT synced here. They are installed by the user via the
+ * skills.sh CLI (`npx skills add <repo>`) into ~/.agents/skills/ — the
+ * industry-standard Agent Skills ecosystem directory.
+ *
  * Skips the copy when the managed-resources.json version matches the current
  * GSD version, avoiding ~128ms of synchronous cpSync on every startup.
  * After `npm update -g @glittercowboy/gsd`, versions will differ and the

package/dist/resource-loader.js

@@ -1,7 +1,7 @@
 import { DefaultResourceLoader } from '@gsd/pi-coding-agent';
 import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
-import { chmodSync, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, readdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, closeSync, readFileSync, readlinkSync, readdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { compareSemver } from './update-check.js';
@@ -352,9 +352,12 @@ function pruneRemovedBundledExtensions(manifest, agentDir) {
  *
  * - extensions/ → ~/.gsd/agent/extensions/   (overwrite when version changes)
  * - agents/     → ~/.gsd/agent/agents/        (overwrite when version changes)
- * - skills/     → ~/.gsd/agent/skills/        (overwrite when version changes)
  * - GSD-WORKFLOW.md → ~/.gsd/agent/GSD-WORKFLOW.md (fallback for env var miss)
  *
+ * Skills are NOT synced here. They are installed by the user via the
+ * skills.sh CLI (`npx skills add <repo>`) into ~/.agents/skills/ — the
+ * industry-standard Agent Skills ecosystem directory.
+ *
  * Skips the copy when the managed-resources.json version matches the current
  * GSD version, avoiding ~128ms of synchronous cpSync on every startup.
  * After `npm update -g @glittercowboy/gsd`, versions will differ and the
@@ -375,6 +378,9 @@ export function initResources(agentDir) {
     // launch, not just during resource syncs. A stale/broken symlink makes ALL
     // extensions fail to resolve @gsd/* packages, rendering GSD non-functional.
     ensureNodeModulesSymlink(agentDir);
+    // Migrate legacy skills on every launch (not gated by manifest) so that
+    // partial-failure retries don't wait for a version bump.
+    migrateSkillsToEcosystemDir(agentDir);
     // Skip the full copy when both version AND content fingerprint match.
     // Version-only checks miss same-version content changes (npm link dev workflow,
     // hotfixes within a release). The content hash catches those at ~1ms cost.
@@ -389,7 +395,13 @@ export function initResources(agentDir) {
     // Sync bundled resources — overwrite so updates land on next launch.
     syncResourceDir(bundledExtensionsDir, join(agentDir, 'extensions'));
     syncResourceDir(join(resourcesDir, 'agents'), join(agentDir, 'agents'));
-    syncResourceDir(join(resourcesDir, 'skills'), join(agentDir, 'skills'));
+    // Skills are no longer force-synced here. Users install skills via the
+    // skills.sh CLI (`npx skills add <repo>`) into ~/.agents/skills/ which
+    // is the industry-standard Agent Skills ecosystem directory.
+    //
+    // Migration from the legacy ~/.gsd/agent/skills/ directory is handled
+    // above the manifest check so it runs on every launch (including retries
+    // after partial copy failures).
     // Sync GSD-WORKFLOW.md to agentDir as a fallback for when GSD_WORKFLOW_PATH
     // env var is not set (e.g. fork/dev builds, alternative entry points).
     const workflowSrc = join(resourcesDir, 'GSD-WORKFLOW.md');
@@ -405,6 +417,129 @@ export function initResources(agentDir) {
     writeManagedResourceManifest(agentDir);
     ensureRegistryEntries(join(agentDir, 'extensions'));
 }
+// ─── Legacy Skill Migration ──────────────────────────────────────────────────────
+/**
+ * One-time migration: copy user-customized skills from the old
+ * ~/.gsd/agent/skills/ directory into ~/.agents/skills/.
+ *
+ * The migration is conservative:
+ *  - Only skill directories containing a SKILL.md are considered.
+ *  - Copies, does not move — the old directory stays intact so downgrading
+ *    to a pre-migration GSD version still works.
+ *  - Collision-safe — if a skill name already exists in the target, the
+ *    existing ecosystem skill wins (user may have already installed a newer
+ *    version via skills.sh).
+ *  - Writes a `.migrated-to-agents` marker inside the legacy directory so
+ *    the migration runs at most once.
+ */
+function migrateSkillsToEcosystemDir(agentDir) {
+    const legacyDir = join(agentDir, 'skills');
+    const markerPath = join(legacyDir, '.migrated-to-agents');
+    // Already migrated or no legacy dir — nothing to do
+    if (!existsSync(legacyDir))
+        return;
+    // Atomic marker check — 'wx' fails if file already exists, preventing races
+    // when two GSD processes start simultaneously.
+    let markerFd;
+    try {
+        markerFd = openSync(markerPath, 'wx');
+    }
+    catch {
+        return; // marker already exists (another process won the race, or already migrated)
+    }
+    try {
+        const ecosystemDir = join(homedir(), '.agents', 'skills');
+        mkdirSync(ecosystemDir, { recursive: true });
+        const entries = readdirSync(legacyDir, { withFileTypes: true });
+        let migrated = 0;
+        let candidates = 0;
+        for (const entry of entries) {
+            // Handle both real directories and symlinks pointing to directories
+            const isDir = entry.isDirectory();
+            const isSymlink = entry.isSymbolicLink();
+            if (!isDir && !isSymlink)
+                continue;
+            const sourcePath = join(legacyDir, entry.name);
+            // For symlinks, verify the target is a directory
+            if (isSymlink) {
+                try {
+                    const stat = statSync(sourcePath);
+                    if (!stat.isDirectory())
+                        continue;
+                }
+                catch {
+                    continue; // broken symlink — skip
+                }
+            }
+            const skillMd = join(sourcePath, 'SKILL.md');
+            if (!existsSync(skillMd))
+                continue;
+            const target = join(ecosystemDir, entry.name);
+            if (existsSync(target))
+                continue; // ecosystem version wins
+            candidates++;
+            try {
+                if (isSymlink) {
+                    // Recreate the symlink in the ecosystem directory using an absolute
+                    // target. Relative symlinks would resolve from the new parent dir
+                    // (~/.agents/skills/) instead of the original (~/.gsd/agent/skills/),
+                    // pointing to the wrong location.
+                    const rawTarget = readlinkSync(sourcePath);
+                    const absTarget = resolve(dirname(sourcePath), rawTarget);
+                    symlinkSync(absTarget, target);
+                }
+                else {
+                    cpSync(sourcePath, target, { recursive: true });
+                }
+                migrated++;
+            }
+            catch {
+                // non-fatal — skip this skill
+            }
+        }
+        // If any skills failed to copy, remove the marker so migration retries
+        // on the next launch.  This keeps the legacy dir as fallback until every
+        // skill has been successfully migrated.
+        if (migrated < candidates) {
+            try {
+                closeSync(markerFd);
+                markerFd = -1;
+            }
+            catch { /* non-fatal */ }
+            try {
+                unlinkSync(markerPath);
+            }
+            catch { /* non-fatal */ }
+            return;
+        }
+        // Write migration info to the marker
+        try {
+            writeFileSync(markerFd, `Migrated ${migrated} skill(s) to ${ecosystemDir} on ${new Date().toISOString()}\n`);
+        }
+        catch { /* non-fatal */ }
+    }
+    catch {
+        // can't create ecosystem dir or read legacy dir — close fd first (required on Windows
+        // where unlinkSync fails on open handles), then remove marker so we retry next launch
+        try {
+            closeSync(markerFd);
+            markerFd = -1;
+        }
+        catch { /* non-fatal */ }
+        try {
+            unlinkSync(markerPath);
+        }
+        catch { /* non-fatal */ }
+    }
+    finally {
+        if (markerFd !== -1) {
+            try {
+                closeSync(markerFd);
+            }
+            catch { /* non-fatal */ }
+        }
+    }
+}
 export function hasStaleCompiledExtensionSiblings(extensionsDir) {
     if (!existsSync(extensionsDir))
         return false;

package/dist/resources/extensions/async-jobs/async-bash-tool.js

@@ -12,6 +12,7 @@ import { createWriteStream } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
+import { rewriteCommandWithRtk } from "../shared/rtk.js";
 const schema = Type.Object({
     command: Type.String({ description: "Bash command to execute in the background" }),
     timeout: Type.Optional(Type.Number({ description: "Timeout in seconds (optional)" })),
@@ -93,7 +94,8 @@ function executeBashInBackground(command, cwd, signal, timeout) {
             reject(err);
         } };
         const { shell, args } = getShellConfig();
-        const resolvedCommand = sanitizeCommand(command);
+        const rewrittenCommand = rewriteCommandWithRtk(command);
+        const resolvedCommand = sanitizeCommand(rewrittenCommand);
         const child = spawn(shell, [...args, resolvedCommand], {
             cwd,
             detached: true,

package/dist/resources/extensions/bg-shell/interaction.js

@@ -2,6 +2,7 @@
  * Expect-style interactions: send_and_wait, run on session, query shell environment.
  */
 import { randomUUID } from "node:crypto";
+import { rewriteCommandWithRtk } from "../shared/rtk.js";
 // ── Query Shell Environment ────────────────────────────────────────────────
 export async function queryShellEnv(bg, timeout, signal) {
     const sentinel = `__GSD_ENV_${randomUUID().slice(0, 8)}__`;
@@ -97,9 +98,10 @@ export async function runOnSession(bg, command, timeout, signal) {
     // Snapshot current output buffer position
     const startIndex = bg.output.length;
     // Write the sentinel-wrapped command to stdin
+    const rewrittenCommand = rewriteCommandWithRtk(command);
     const wrappedCommand = [
         `echo ${startMarker}`,
-        command,
+        rewrittenCommand,
         `${exitVar}=$?`,
         `echo ${endMarker} $${exitVar}`,
     ].join("\n");

package/dist/resources/extensions/bg-shell/process-manager.js

@@ -7,6 +7,7 @@ import { randomUUID } from "node:crypto";
 import { writeFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { getShellConfig, sanitizeCommand } from "@gsd/pi-coding-agent";
+import { rewriteCommandWithRtk } from "../shared/rtk.js";
 import { MAX_BUFFER_LINES, MAX_EVENTS, DEAD_PROCESS_TTL, } from "./types.js";
 import { restoreWindowsVTInput, formatUptime } from "./utilities.js";
 import { analyzeLine } from "./output-formatter.js";
@@ -101,7 +102,9 @@ export function startProcess(opts) {
     const env = { ...process.env, ...(opts.env || {}) };
     const { shell, args: shellArgs } = getShellConfig();
     // Shell sessions default to the user's shell if no command specified
-    const command = processType === "shell" && !opts.command ? shell : opts.command;
+    const command = processType === "shell" && !opts.command
+        ? shell
+        : rewriteCommandWithRtk(opts.command);
     const proc = spawn(shell, [...shellArgs, sanitizeCommand(command)], {
         cwd: opts.cwd,
         stdio: ["pipe", "pipe", "pipe"],

package/dist/resources/extensions/claude-code-cli/partial-builder.js

@@ -210,7 +210,12 @@ export class PartialMessageBuilder {
                         block.arguments = JSON.parse(jsonStr);
                     }
                     catch {
+                        // Stream was truncated mid-tool-call — JSON is garbage.
+                        // Preserve the raw string for diagnostics but signal the
+                        // malformation explicitly so downstream consumers can
+                        // distinguish this from a healthy tool completion (#2574).
                         block.arguments = { _raw: jsonStr };
+                        return { type: "toolcall_end", contentIndex, toolCall: block, partial: this.partial, malformedArguments: true };
                     }
                     return { type: "toolcall_end", contentIndex, toolCall: block, partial: this.partial };
                 }

package/dist/resources/extensions/gsd/auto/infra-errors.js

@@ -17,6 +17,7 @@ export const INFRA_ERROR_CODES = new Set([
     "EDQUOT", // disk quota exceeded
     "EMFILE", // too many open files (process)
     "ENFILE", // too many open files (system)
+    "EAGAIN", // resource temporarily unavailable (resource exhaustion)
     "ECONNREFUSED", // connection refused (offline / local server down)
     "ENOTFOUND", // DNS lookup failed (offline / no network)
     "ENETUNREACH", // network unreachable (offline / no route)

package/dist/resources/extensions/gsd/auto/phases.js

@@ -219,6 +219,8 @@ export async function runPreDispatch(ic, loopState) {
             if (s.currentMilestoneId) {
                 try {
                     deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
+                    // Prevent stopAuto from attempting the same merge (#2645)
+                    s.milestoneMergedInPhases = true;
                 }
                 catch (mergeErr) {
                     if (mergeErr instanceof MergeConflictError) {
@@ -284,6 +286,8 @@ export async function runPreDispatch(ic, loopState) {
         if (s.currentMilestoneId) {
             try {
                 deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
+                // Prevent stopAuto from attempting the same merge (#2645)
+                s.milestoneMergedInPhases = true;
             }
             catch (mergeErr) {
                 if (mergeErr instanceof MergeConflictError) {
@@ -334,7 +338,18 @@ export async function runDispatch(ic, preData, loopState) {
     });
     if (dispatchResult.action === "stop") {
         deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: ic.nextSeq(), eventType: "dispatch-stop", rule: dispatchResult.matchedRule, data: { reason: dispatchResult.reason } });
-        await closeoutAndStop(ctx, pi, s, deps, dispatchResult.reason);
+        // Warning-level stops are recoverable human checkpoints (e.g. UAT verdict
+        // gate) — pause instead of hard-stopping so the session is resumable with
+        // `/gsd auto`. Error/info-level stops remain hard stops for infrastructure
+        // failures and terminal conditions respectively.
+        // See: https://github.com/gsd-build/gsd-2/issues/2474
+        if (dispatchResult.level === "warning") {
+            ctx.ui.notify(dispatchResult.reason, "warning");
+            await deps.pauseAuto(ctx, pi);
+        }
+        else {
+            await closeoutAndStop(ctx, pi, s, deps, dispatchResult.reason);
+        }
         debugLog("autoLoop", { phase: "exit", reason: "dispatch-stop" });
         return { action: "break", reason: "dispatch-stop" };
     }
@@ -721,18 +736,18 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
     deps.updateSessionLock(deps.lockBase(), unitType, unitId, sessionFile);
     deps.writeLock(deps.lockBase(), unitType, unitId, sessionFile);
     // Tag the most recent window entry with error info for stuck detection
-    if (unitResult.status === "error" || unitResult.status === "cancelled") {
-        const lastEntry = loopState.recentUnits[loopState.recentUnits.length - 1];
-        if (lastEntry) {
+    const lastEntry = loopState.recentUnits[loopState.recentUnits.length - 1];
+    if (lastEntry) {
+        if (unitResult.errorContext) {
+            lastEntry.error = `${unitResult.errorContext.category}:${unitResult.errorContext.message}`.slice(0, 200);
+        }
+        else if (unitResult.status === "error" || unitResult.status === "cancelled") {
             lastEntry.error = `${unitResult.status}:${unitType}/${unitId}`;
         }
-    }
-    else if (unitResult.event?.messages?.length) {
-        const lastMsg = unitResult.event.messages[unitResult.event.messages.length - 1];
-        const msgStr = typeof lastMsg === "string" ? lastMsg : JSON.stringify(lastMsg);
-        if (/error|fail|exception/i.test(msgStr)) {
-            const lastEntry = loopState.recentUnits[loopState.recentUnits.length - 1];
-            if (lastEntry) {
+        else if (unitResult.event?.messages?.length) {
+            const lastMsg = unitResult.event.messages[unitResult.event.messages.length - 1];
+            const msgStr = typeof lastMsg === "string" ? lastMsg : JSON.stringify(lastMsg);
+            if (/error|fail|exception/i.test(msgStr)) {
                 lastEntry.error = msgStr.slice(0, 200);
             }
         }
@@ -779,7 +794,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         s.unitDispatchCount.delete(`${unitType}/${unitId}`);
         s.unitRecoveryCount.delete(`${unitType}/${unitId}`);
     }
-    deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: ic.nextSeq(), eventType: "unit-end", data: { unitType, unitId, status: unitResult.status, artifactVerified }, causedBy: { flowId: ic.flowId, seq: unitStartSeq } });
+    deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: ic.nextSeq(), eventType: "unit-end", data: { unitType, unitId, status: unitResult.status, artifactVerified, ...(unitResult.errorContext ? { errorContext: unitResult.errorContext } : {}) }, causedBy: { flowId: ic.flowId, seq: unitStartSeq } });
     return { action: "next", data: { unitStartedAt: s.currentUnit.startedAt } };
 }
 // ─── runFinalize ──────────────────────────────────────────────────────────────

package/dist/resources/extensions/gsd/auto/resolve.js

@@ -64,12 +64,12 @@ export function isSessionSwitchInFlight() {
  * blocks to ensure the autoLoop is never stuck awaiting a promise that
  * will never resolve. Safe to call when no resolver is pending (no-op).
  */
-export function resolveAgentEndCancelled() {
+export function resolveAgentEndCancelled(errorContext) {
     if (_currentResolve) {
         debugLog("resolveAgentEndCancelled", { status: "resolving-cancelled" });
         const r = _currentResolve;
         _currentResolve = null;
-        r({ status: "cancelled" });
+        r({ status: "cancelled", ...(errorContext ? { errorContext } : {}) });
     }
 }
 // ─── resetPendingResolve (test helper) ───────────────────────────────────────

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -41,13 +41,13 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
             unitId,
             error: msg,
         });
-        return { status: "cancelled" };
+        return { status: "cancelled", errorContext: { message: `Session creation failed: ${msg}`, category: "session-failed", isTransient: true } };
     }
     if (sessionTimeoutHandle)
         clearTimeout(sessionTimeoutHandle);
     if (sessionResult.cancelled) {
         debugLog("runUnit-session-timeout", { unitType, unitId });
-        return { status: "cancelled" };
+        return { status: "cancelled", errorContext: { message: "Session creation timed out", category: "timeout", isTransient: true } };
     }
     if (!s.active) {
         return { status: "cancelled" };

package/dist/resources/extensions/gsd/auto/session.js

@@ -61,6 +61,13 @@ export class AutoSession {
     lastStateRebuildAt = 0;
     // ── Sidecar queue ─────────────────────────────────────────────────────
     sidecarQueue = [];
+    // ── Isolation degradation ────────────────────────────────────────────
+    /** Set to true when worktree creation fails; prevents merge of nonexistent branch. */
+    isolationDegraded = false;
+    // ── Merge guard ──────────────────────────────────────────────────────
+    /** Set to true after phases.ts successfully calls mergeAndExit, so that
+     *  stopAuto does not attempt the same merge a second time (#2645). */
+    milestoneMergedInPhases = false;
     // ── Dispatch circuit breakers ──────────────────────────────────────
     rewriteAttemptCount = 0;
     // ── Metrics ──────────────────────────────────────────────────────────────
@@ -140,6 +147,8 @@ export class AutoSession {
         this.pendingQuickTasks = [];
         this.sidecarQueue = [];
         this.rewriteAttemptCount = 0;
+        this.isolationDegraded = false;
+        this.milestoneMergedInPhases = false;
         // Signal handler
         this.sigtermHandler = null;
         // Loop promise state lives in auto-loop.ts module scope