gsd-pi 2.57.0 → 2.58.0-dev.d63175c

package/packages/daemon/src/launchd.ts

@@ -0,0 +1,242 @@
+import { writeFileSync, unlinkSync, existsSync, chmodSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { execSync } from 'node:child_process';
+import { dirname } from 'node:path';
+
+// --------------- types ---------------
+
+export interface PlistOptions {
+  /** Absolute path to the Node.js binary */
+  nodePath: string;
+  /** Absolute path to the daemon script (cli.js) */
+  scriptPath: string;
+  /** Absolute path to the config file */
+  configPath: string;
+  /** Directory to use as WorkingDirectory in the plist (defaults to homedir) */
+  workingDirectory?: string;
+  /** Override stdout log path */
+  stdoutPath?: string;
+  /** Override stderr log path */
+  stderrPath?: string;
+}
+
+export interface LaunchdStatus {
+  /** Whether the daemon is registered with launchd */
+  registered: boolean;
+  /** PID if currently running, null otherwise */
+  pid: number | null;
+  /** Last exit status code, null if never exited or not available */
+  lastExitStatus: number | null;
+}
+
+export type RunCommandFn = (cmd: string) => string;
+
+// --------------- constants ---------------
+
+const LABEL = 'com.gsd.daemon';
+const PLIST_FILENAME = `${LABEL}.plist`;
+
+// --------------- helpers ---------------
+
+/** Escape special XML characters in a string. */
+export function escapeXml(str: string): string {
+  return str
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+/** Return the canonical plist path under ~/Library/LaunchAgents/. */
+export function getPlistPath(): string {
+  return resolve(homedir(), 'Library', 'LaunchAgents', PLIST_FILENAME);
+}
+
+/**
+ * Build the NVM-aware PATH string.
+ * Includes the directory containing the Node binary so that launchd can find node
+ * even when launched outside a shell session (where NVM isn't sourced).
+ */
+function buildEnvPath(nodePath: string): string {
+  const nodeBinDir = dirname(nodePath);
+  // Keep system essentials and prepend the node binary's directory
+  return `${nodeBinDir}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`;
+}
+
+// --------------- plist generation ---------------
+
+/** Generate valid launchd plist XML for the GSD daemon. */
+export function generatePlist(opts: PlistOptions): string {
+  const home = homedir();
+  const workDir = opts.workingDirectory ?? home;
+  const stdoutPath = opts.stdoutPath ?? resolve(home, '.gsd', 'daemon-stdout.log');
+  const stderrPath = opts.stderrPath ?? resolve(home, '.gsd', 'daemon-stderr.log');
+  const envPath = buildEnvPath(opts.nodePath);
+
+  // Forward ANTHROPIC_API_KEY so the orchestrator LLM can authenticate.
+  // Captured at install time from the current process environment.
+  const anthropicKey = process.env.ANTHROPIC_API_KEY;
+  const anthropicKeyXml = anthropicKey
+    ? `\n\t\t<key>ANTHROPIC_API_KEY</key>\n\t\t<string>${escapeXml(anthropicKey)}</string>`
+    : '';
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+\t<key>Label</key>
+\t<string>${escapeXml(LABEL)}</string>
+
+\t<key>ProgramArguments</key>
+\t<array>
+\t\t<string>${escapeXml(opts.nodePath)}</string>
+\t\t<string>${escapeXml(opts.scriptPath)}</string>
+\t\t<string>--config</string>
+\t\t<string>${escapeXml(opts.configPath)}</string>
+\t</array>
+
+\t<key>KeepAlive</key>
+\t<dict>
+\t\t<key>SuccessfulExit</key>
+\t\t<false/>
+\t</dict>
+
+\t<key>RunAtLoad</key>
+\t<true/>
+
+\t<key>EnvironmentVariables</key>
+\t<dict>
+\t\t<key>PATH</key>
+\t\t<string>${escapeXml(envPath)}</string>
+\t\t<key>HOME</key>
+\t\t<string>${escapeXml(home)}</string>${anthropicKeyXml}
+\t</dict>
+
+\t<key>WorkingDirectory</key>
+\t<string>${escapeXml(workDir)}</string>
+
+\t<key>StandardOutPath</key>
+\t<string>${escapeXml(stdoutPath)}</string>
+
+\t<key>StandardErrorPath</key>
+\t<string>${escapeXml(stderrPath)}</string>
+</dict>
+</plist>
+`;
+}
+
+// --------------- install / uninstall / status ---------------
+
+/** Default runCommand using execSync. */
+function defaultRunCommand(cmd: string): string {
+  return execSync(cmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+}
+
+/**
+ * Install the launchd agent: write plist and load it.
+ * Idempotent — unloads first if already loaded.
+ */
+export function install(
+  opts: PlistOptions,
+  runCommand: RunCommandFn = defaultRunCommand,
+): void {
+  const plistPath = getPlistPath();
+  const xml = generatePlist(opts);
+
+  // Unload first if already present (ignore errors)
+  if (existsSync(plistPath)) {
+    try {
+      runCommand(`launchctl unload ${plistPath}`);
+    } catch {
+      // already unloaded — fine
+    }
+  }
+
+  writeFileSync(plistPath, xml, 'utf-8');
+  chmodSync(plistPath, 0o644);
+
+  runCommand(`launchctl load ${plistPath}`);
+
+  // Verify it loaded
+  try {
+    runCommand(`launchctl list ${LABEL}`);
+  } catch {
+    throw new Error(
+      `Plist was written to ${plistPath} and launchctl load succeeded, but launchctl list ${LABEL} failed. The agent may not have started.`,
+    );
+  }
+}
+
+/**
+ * Uninstall the launchd agent: unload and remove plist.
+ * Graceful — does not throw if already uninstalled.
+ */
+export function uninstall(runCommand: RunCommandFn = defaultRunCommand): void {
+  const plistPath = getPlistPath();
+
+  if (existsSync(plistPath)) {
+    try {
+      runCommand(`launchctl unload ${plistPath}`);
+    } catch {
+      // already unloaded — that's fine
+    }
+    unlinkSync(plistPath);
+  }
+  // If plist doesn't exist, nothing to do — already uninstalled
+}
+
+/**
+ * Query launchd for the daemon's status.
+ * Returns structured information about registration, PID, and last exit code.
+ *
+ * Handles two launchctl output formats:
+ * 1. Tabular: "PID\tStatus\tLabel" (older macOS)
+ * 2. JSON-style dict: `"PID" = 1234;` / `"LastExitStatus" = 0;` (newer macOS)
+ */
+export function status(runCommand: RunCommandFn = defaultRunCommand): LaunchdStatus {
+  try {
+    const output = runCommand(`launchctl list ${LABEL}`);
+
+    // --- Try tabular format first ---
+    const lines = output.trim().split('\n');
+    for (const line of lines) {
+      const parts = line.trim().split(/\t+/);
+      if (parts.length >= 3 && parts[2] === LABEL) {
+        const pidStr = parts[0];
+        const statusStr = parts[1];
+
+        const pid = pidStr === '-' ? null : parseInt(pidStr, 10);
+        const lastExitStatus = statusStr != null ? parseInt(statusStr, 10) : null;
+
+        return {
+          registered: true,
+          pid: Number.isNaN(pid!) ? null : pid,
+          lastExitStatus: Number.isNaN(lastExitStatus!) ? null : lastExitStatus,
+        };
+      }
+    }
+
+    // --- Try JSON-style dict format ---
+    // Matches: "PID" = 1234;  or  "LastExitStatus" = 0;
+    const pidMatch = output.match(/"PID"\s*=\s*(\d+)\s*;/);
+    const exitMatch = output.match(/"LastExitStatus"\s*=\s*(\d+)\s*;/);
+
+    if (pidMatch || exitMatch) {
+      const pid = pidMatch ? parseInt(pidMatch[1], 10) : null;
+      const lastExitStatus = exitMatch ? parseInt(exitMatch[1], 10) : null;
+      return {
+        registered: true,
+        pid: Number.isNaN(pid!) ? null : pid,
+        lastExitStatus: Number.isNaN(lastExitStatus!) ? null : lastExitStatus,
+      };
+    }
+
+    // Label resolved (no error) but no parseable output — still registered
+    return { registered: true, pid: null, lastExitStatus: null };
+  } catch {
+    // launchctl list exits non-zero when the label isn't found
+    return { registered: false, pid: null, lastExitStatus: null };
+  }
+}

package/packages/daemon/src/message-batcher.test.ts

@@ -65,7 +65,7 @@ describe('MessageBatcher', () => {
       await batcher.destroy();
     });
 
-    it('combines embeds into a single send call', async () => {
+    it('skips embeds for batched messages (only content)', async () => {
       const { fn, calls } = createSend();
       const batcher = new MessageBatcher(fn, undefined, { maxBatchSize: 2, flushIntervalMs: 60_000 });
 
@@ -74,7 +74,7 @@ describe('MessageBatcher', () => {
       await new Promise((r) => setTimeout(r, 10));
 
       assert.equal(calls.length, 1);
-      assert.equal(calls[0].embeds.length, 2);
+      assert.equal(calls[0].embeds.length, 0, 'batched sends skip embeds to avoid duplication');
       assert.equal(calls[0].content, 'a\nb');
 
       await batcher.destroy();

package/packages/daemon/src/message-batcher.ts

@@ -162,6 +162,10 @@ export class MessageBatcher {
   /**
    * Build a SendPayload from a batch of FormattedEvents and invoke the send callback.
    * Catches and logs errors — never throws.
+   *
+   * For batched messages (2+ events), we send content-only to avoid duplication
+   * between content text and embed descriptions, and to stay under Discord's
+   * 10-embed limit. Single-event sends include the embed for rich formatting.
    */
   private async doSend(batch: FormattedEvent[]): Promise<void> {
     if (batch.length === 0) return;
@@ -169,10 +173,12 @@ export class MessageBatcher {
     // Combine content lines
     const content = batch.map((e) => e.content).join('\n');
 
-    // Collect all embeds (Discord allows up to 10 per message)
+    // For single events, include the embed for rich formatting.
+    // For batches, skip embeds — the content lines are self-descriptive and
+    // embeds would duplicate the information + risk hitting Discord's 10-embed cap.
     const embeds: unknown[] = [];
-    for (const e of batch) {
-      if (e.embed) embeds.push(e.embed);
+    if (batch.length === 1 && batch[0].embed) {
+      embeds.push(batch[0].embed);
     }
 
     // Collect all component rows (only from the last event with components —

package/packages/daemon/src/orchestrator.test.ts

@@ -201,6 +201,7 @@ function makeMessage(overrides: Partial<{
       send: async (content: string) => {
         sentMessages.push(content);
       },
+      sendTyping: async () => {},
     },
     sentMessages,
   };

package/packages/daemon/src/orchestrator.ts

@@ -12,6 +12,9 @@
  */
 
 import { z } from 'zod';
+import { readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
 import type Anthropic from '@anthropic-ai/sdk';
 import type {
   MessageParam,
@@ -26,6 +29,93 @@ import type { ChannelManager } from './channel-manager.js';
 import type { ProjectInfo, ManagedSession } from './types.js';
 import type { Logger } from './logger.js';
 
+// ---------------------------------------------------------------------------
+// OAuth token resolution — reads GSD's auth.json, refreshes if expired
+// ---------------------------------------------------------------------------
+
+interface OAuthCredentials {
+  type: 'oauth';
+  refresh: string;
+  access: string;
+  expires: number;
+}
+
+const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+const CLIENT_ID = atob('OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl');
+
+/**
+ * Read the Anthropic OAuth access token from GSD's auth.json.
+ * If expired, refresh it and write the new credentials back.
+ * Falls back to ANTHROPIC_API_KEY env var if no OAuth credential exists.
+ */
+async function resolveAnthropicApiKey(logger?: Logger): Promise<string> {
+  // Try env var first (explicit override)
+  if (process.env.ANTHROPIC_API_KEY) {
+    return process.env.ANTHROPIC_API_KEY;
+  }
+
+  const authPath = join(homedir(), '.gsd', 'agent', 'auth.json');
+  let authData: Record<string, unknown>;
+  try {
+    authData = JSON.parse(readFileSync(authPath, 'utf-8'));
+  } catch {
+    throw new Error(
+      'No Anthropic auth found. Run `gsd login` to authenticate, or set ANTHROPIC_API_KEY.',
+    );
+  }
+
+  const cred = authData.anthropic as OAuthCredentials | undefined;
+  if (!cred || cred.type !== 'oauth' || !cred.access) {
+    throw new Error(
+      'No Anthropic OAuth credential in auth.json. Run `gsd login` to authenticate.',
+    );
+  }
+
+  // If token is still valid, use it
+  if (Date.now() < cred.expires) {
+    return cred.access;
+  }
+
+  // Token expired — refresh it
+  logger?.info('orchestrator: refreshing Anthropic OAuth token');
+  const response = await fetch(TOKEN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      grant_type: 'refresh_token',
+      client_id: CLIENT_ID,
+      refresh_token: cred.refresh,
+    }),
+    signal: AbortSignal.timeout(30_000),
+  });
+
+  if (!response.ok) {
+    const error = await response.text();
+    throw new Error(`Anthropic token refresh failed: ${error}`);
+  }
+
+  const data = (await response.json()) as {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+  };
+
+  const newCred: OAuthCredentials = {
+    type: 'oauth',
+    refresh: data.refresh_token,
+    access: data.access_token,
+    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+  };
+
+  // Write back to auth.json
+  authData.anthropic = newCred;
+  writeFileSync(authPath, JSON.stringify(authData, null, 2), 'utf-8');
+  chmodSync(authPath, 0o600);
+  logger?.info('orchestrator: Anthropic OAuth token refreshed');
+
+  return newCred.access;
+}
+
 // ---------------------------------------------------------------------------
 // Configuration
 // ---------------------------------------------------------------------------
@@ -164,11 +254,13 @@ export class Orchestrator {
 
   /**
    * Lazily initialise the Anthropic client. Dynamic import handles K007 module resolution.
+   * Resolves auth from GSD's OAuth credentials (auth.json), refreshing if needed.
    */
   private async getClient(): Promise<Anthropic> {
     if (this.client) return this.client;
+    const apiKey = await resolveAnthropicApiKey(this.deps.logger);
     const { default: AnthropicSDK } = await import('@anthropic-ai/sdk');
-    this.client = new AnthropicSDK();
+    this.client = new AnthropicSDK({ apiKey });
     return this.client;
   }
 
@@ -204,6 +296,9 @@ export class Orchestrator {
     this.history.push({ role: 'user', content });
 
     try {
+      // Show typing indicator while processing
+      await message.channel.sendTyping().catch(() => {});
+
       const responseText = await this.runAgentLoop();
 
       // Send response to Discord
@@ -215,6 +310,12 @@ export class Orchestrator {
       });
     } catch (err) {
       const errorMsg = err instanceof Error ? err.message : String(err);
+
+      // Invalidate cached client on auth errors so next call re-resolves OAuth token
+      if (errorMsg.includes('authentication') || errorMsg.includes('apiKey') || errorMsg.includes('authToken') || errorMsg.includes('401')) {
+        this.client = null;
+      }
+
       this.deps.logger.error('orchestrator error', {
         error: errorMsg,
         userId: message.author.id,
@@ -436,5 +537,8 @@ export interface DiscordMessageLike {
   author: { id: string; bot: boolean };
   channelId: string;
   content: string;
-  channel: { send: (content: string) => Promise<unknown> };
+  channel: {
+    send: (content: string) => Promise<unknown>;
+    sendTyping: () => Promise<unknown>;
+  };
 }

package/packages/pi-coding-agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/pi-coding-agent",
-  "version": "2.57.0",
+  "version": "2.58.0",
   "description": "Coding agent CLI (vendored from pi-mono)",
   "type": "module",
   "piConfig": {

package/pkg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glittercowboy/gsd",
-  "version": "2.57.0",
+  "version": "2.58.0",
   "piConfig": {
     "name": "gsd",
     "configDir": ".gsd"

package/src/resources/extensions/gsd/auto/infra-errors.ts

@@ -41,5 +41,8 @@ export function isInfrastructureError(err: unknown): string | null {
   for (const code of INFRA_ERROR_CODES) {
     if (msg.includes(code)) return code;
   }
+  // SQLite WAL corruption is not transient — retrying burns LLM budget
+  // for guaranteed failures (#2823).
+  if (msg.includes("database disk image is malformed")) return "SQLITE_CORRUPT";
   return null;
 }

package/src/resources/extensions/gsd/auto-dispatch.ts

@@ -677,13 +677,13 @@ export const DISPATCH_RULES: DispatchRule[] = [
             if (validationPath) {
               const validationContent = await loadFile(validationPath);
               if (validationContent) {
-                // Accept either the structured template format (table with MET/N/A)
+                // Accept either the structured template format (table with MET/N/A/SATISFIED)
                 // or prose evidence patterns the validation agent may emit.
                 const structuredMatch =
                   validationContent.includes("Operational") &&
-                  (validationContent.includes("MET") || validationContent.includes("N/A"));
+                  (validationContent.includes("MET") || validationContent.includes("N/A") || validationContent.includes("SATISFIED"));
                 const proseMatch =
-                  /[Oo]perational[\s:][^\n]*(?:pass|verified|confirmed|met|complete|true|yes|addressed|covered|n\/a|not\s+applicable)/i.test(validationContent);
+                  /[Oo]perational[\s\S]{0,500}?(?:✅|pass|verified|confirmed|met|complete|true|yes|addressed|covered|satisfied|partially|n\/a|not[\s-]+applicable)/i.test(validationContent);
                 const hasOperationalCheck = structuredMatch || proseMatch;
                 if (!hasOperationalCheck) {
                   return {

package/src/resources/extensions/gsd/auto-worktree.ts

@@ -1264,12 +1264,17 @@ export function mergeMilestoneToMain(
   // 1. Auto-commit dirty state in worktree before leaving
   autoCommitDirtyState(worktreeCwd);
 
-  // Reconcile worktree DB into main DB before leaving worktree context
+  // Reconcile worktree DB into main DB before leaving worktree context.
+  // Skip when both paths resolve to the same physical file (shared WAL /
+  // symlink layout) — ATTACHing a WAL-mode file to itself corrupts the
+  // database (#2823).
   if (isDbAvailable()) {
     try {
       const worktreeDbPath = join(worktreeCwd, ".gsd", "gsd.db");
       const mainDbPath = join(originalBasePath_, ".gsd", "gsd.db");
-      reconcileWorktreeDb(mainDbPath, worktreeDbPath);
+      if (!isSamePath(worktreeDbPath, mainDbPath)) {
+        reconcileWorktreeDb(mainDbPath, worktreeDbPath);
+      }
     } catch {
       /* non-fatal */
     }

package/src/resources/extensions/gsd/auto.ts

@@ -1061,6 +1061,11 @@ export async function startAuto(
   verboseMode: boolean,
   options?: { step?: boolean },
 ): Promise<void> {
+  if (s.active) {
+    debugLog("startAuto", { phase: "already-active", skipping: true });
+    return;
+  }
+
   const requestedStepMode = options?.step ?? false;
 
   // Escape stale worktree cwd from a previous milestone (#608).

package/src/resources/extensions/gsd/bootstrap/db-tools.ts

@@ -924,7 +924,7 @@ export function registerDbTools(pi: ExtensionAPI): void {
     promptSnippet: "Validate a GSD milestone (DB write + VALIDATION.md render)",
     promptGuidelines: [
       "Use gsd_validate_milestone when all slices are done and the milestone needs validation before completion.",
-      "Parameters: milestoneId, verdict, remediationRound, successCriteriaChecklist, sliceDeliveryAudit, crossSliceIntegration, requirementCoverage, verdictRationale, remediationPlan (optional).",
+      "Parameters: milestoneId, verdict, remediationRound, successCriteriaChecklist, sliceDeliveryAudit, crossSliceIntegration, requirementCoverage, verificationClasses (optional), verdictRationale, remediationPlan (optional).",
       "If verdict is 'needs-remediation', also provide remediationPlan and use gsd_reassess_roadmap to add remediation slices to the roadmap.",
       "On success, returns validationPath where VALIDATION.md was written.",
     ],
@@ -936,6 +936,7 @@ export function registerDbTools(pi: ExtensionAPI): void {
       sliceDeliveryAudit: Type.String({ description: "Markdown table auditing each slice's claimed vs delivered output" }),
       crossSliceIntegration: Type.String({ description: "Markdown describing any cross-slice boundary mismatches" }),
       requirementCoverage: Type.String({ description: "Markdown describing any unaddressed requirements" }),
+      verificationClasses: Type.Optional(Type.String({ description: "Markdown describing verification class compliance and gaps" })),
       verdictRationale: Type.String({ description: "Why this verdict was chosen" }),
       remediationPlan: Type.Optional(Type.String({ description: "Remediation plan (required if verdict is needs-remediation)" })),
     }),

package/src/resources/extensions/gsd/dispatch-guard.ts

@@ -26,9 +26,20 @@ export function getPriorSliceCompletionBlocker(
   const { milestone: targetMid, slice: targetSid } = parseUnitId(unitId);
   if (!targetMid || !targetSid) return null;
 
+  // Parallel worker isolation: when GSD_MILESTONE_LOCK is set, this worker
+  // is scoped to a single milestone. Skip the cross-milestone dependency
+  // check — other milestones are being handled by their own workers.
+  // Without this, the dispatch guard sees incomplete slices in M010/M011
+  // (cloned into the worktree DB) and blocks M012 from ever starting. #2797
+  const milestoneLock = process.env.GSD_MILESTONE_LOCK;
+
   // Use findMilestoneIds to respect custom queue order.
   // Only check milestones that come BEFORE the target in queue order.
-  const allIds = findMilestoneIds(base);
+  // When locked to a specific milestone, only check that milestone's
+  // intra-slice dependencies — skip all cross-milestone checks.
+  const allIds = milestoneLock && targetMid === milestoneLock
+    ? [targetMid]
+    : findMilestoneIds(base);
   const targetIdx = allIds.indexOf(targetMid);
   if (targetIdx < 0) return null;
   const milestoneIds = allIds.slice(0, targetIdx + 1);

package/src/resources/extensions/gsd/gsd-db.ts

@@ -6,7 +6,7 @@
 // Schema is initialized on first open with WAL mode for file-backed DBs.
 
 import { createRequire } from "node:module";
-import { existsSync, copyFileSync, mkdirSync } from "node:fs";
+import { existsSync, copyFileSync, mkdirSync, realpathSync } from "node:fs";
 import { dirname } from "node:path";
 import type { Decision, Requirement, GateRow, GateId, GateScope, GateStatus, GateVerdict } from "./types.js";
 import { GSDError, GSD_STALE_STATE } from "./errors.js";
@@ -1761,6 +1761,11 @@ export function reconcileWorktreeDb(
 ): ReconcileResult {
   const zero: ReconcileResult = { decisions: 0, requirements: 0, artifacts: 0, milestones: 0, slices: 0, tasks: 0, memories: 0, verification_evidence: 0, conflicts: [] };
   if (!existsSync(worktreeDbPath)) return zero;
+  // Guard: bail when both paths resolve to the same physical file.
+  // ATTACHing a WAL-mode DB to itself corrupts the WAL (#2823).
+  try {
+    if (realpathSync(mainDbPath) === realpathSync(worktreeDbPath)) return zero;
+  } catch { /* path resolution failed — fall through to existing checks */ }
   // Sanitize path: reject any characters that could break ATTACH syntax.
   // ATTACH DATABASE doesn't support parameterized paths in all providers,
   // so we use strict allowlist validation instead.

package/src/resources/extensions/gsd/parallel-orchestrator.ts

@@ -519,8 +519,19 @@ function createMilestoneWorktree(basePath: string, milestoneId: string): string
 
 /**
  * Spawn a worker process for a milestone.
- * The worker runs `gsd --print "/gsd auto"` in the milestone's worktree
+ * The worker runs `gsd headless --json auto` in the milestone's worktree
  * with GSD_MILESTONE_LOCK set to isolate state derivation.
+ *
+ * IMPORTANT: We use `headless --json auto` instead of `--print "/gsd auto"`.
+ * --print mode calls session.prompt() which returns immediately after the
+ * extension command handler fires, because auto-mode's ctx.newSession()
+ * resets the session and unblocks the outer prompt() await. This causes
+ * process.exit(0) to fire before any LLM work happens. See #2792.
+ *
+ * The headless subcommand uses an RPC client that keeps the process alive
+ * until auto-mode emits a terminal notification or the idle timer fires.
+ * It outputs NDJSON events to stdout (with --json), which our
+ * processWorkerLine() parser already understands.
  */
 export function spawnWorker(
   basePath: string,
@@ -537,7 +548,7 @@ export function spawnWorker(
 
   let child: ChildProcess;
   try {
-    child = spawn(process.execPath, [binPath, "--mode", "json", "--print", "/gsd auto"], {
+    child = spawn(process.execPath, [binPath, "headless", "--json", "auto"], {
       cwd: worker.worktreePath,
       env: {
         ...process.env,
@@ -577,9 +588,10 @@ export function spawnWorker(
   }
 
   // ── NDJSON stdout monitoring ────────────────────────────────────────
-  // Workers run with --mode json, emitting one JSON event per line.
-  // We parse message_end events to extract cost/token usage, keeping
-  // the coordinator's cost tracking in sync with actual API spend.
+  // Workers run via `headless --json`, which forwards all RPC events
+  // as NDJSON to stdout. We parse message_end events to extract
+  // cost/token usage, keeping the coordinator's cost tracking in sync
+  // with actual API spend.
   if (child.stdout) {
     let stdoutBuffer = "";
     child.stdout.on("data", (data: Buffer) => {
@@ -808,7 +820,12 @@ export async function stopParallel(
       } catch { /* process may already be dead */ }
     }
 
-    const exitedAfterTerm = await waitForWorkerExit(worker, 750);
+    // Wait for the headless process to cascade SIGTERM to its RPC child.
+    // The headless signal handler calls client.stop() which sends SIGTERM
+    // to the RPC child and waits up to 1000ms. The previous 750ms window
+    // was insufficient — the parent got SIGKILL before the child died,
+    // leaving orphaned RPC processes holding auto.lock. See #2798.
+    const exitedAfterTerm = await waitForWorkerExit(worker, 3000);
     if (!exitedAfterTerm && worker.pid > 0) {
       try {
         if (worker.process) {