gsd-pi 2.65.0 → 2.66.0-dev.6c91c1f

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -7,6 +7,7 @@
  * globals or AutoContext dependency.
  */
 import { parseUnitId } from "./unit-id.js";
+import { appendEvent } from "./workflow-events.js";
 import { clearParseCache } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
 import { isDbAvailable, getTask, getSlice, getSliceTasks, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
@@ -27,13 +28,12 @@ export { resolveExpectedArtifactPath, diagnoseExpectedArtifact };
  * in the git history. Uses `git log --name-only` to inspect all commits on the
  * current branch that touch files outside `.gsd/`.
  *
- * Returns true if at least one non-`.gsd/` file was committed, false otherwise.
- * Non-fatal: returns true on git errors to avoid blocking the pipeline when
- * running outside a git repo (e.g., tests).
+ * Returns "present" if implementation files found, "absent" if only .gsd/ files,
+ * "unknown" if git is unavailable or check failed (callers decide how to handle).
  */
 export function hasImplementationArtifacts(basePath) {
     try {
-        // Verify we're in a git repo — fail open if not
+        // Verify we're in a git repo
         try {
             execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
                 cwd: basePath,
@@ -43,7 +43,7 @@ export function hasImplementationArtifacts(basePath) {
         }
         catch (e) {
             logWarning("recovery", `git rev-parse check failed: ${e.message}`);
-            return true;
+            return "unknown";
         }
         // Strategy: check `git diff --name-only` against the merge-base with the
         // main branch. This captures ALL files changed during the milestone's
@@ -51,20 +51,20 @@ export function hasImplementationArtifacts(basePath) {
         // back to checking the last N commits.
         const mainBranch = detectMainBranch(basePath);
         const changedFiles = getChangedFilesSinceBranch(basePath, mainBranch);
-        // No files changed at all — fail open (could be detached HEAD, single-
+        // No files changed at all — unknown (could be detached HEAD, single-
         // commit repo, or other edge case where git diff returns nothing).
         if (changedFiles.length === 0)
-            return true;
+            return "unknown";
         // Filter out .gsd/ files — only implementation files count.
         // If every changed file is under .gsd/, the milestone produced no
         // implementation code (#1703).
         const implFiles = changedFiles.filter(f => !f.startsWith(".gsd/") && !f.startsWith(".gsd\\"));
-        return implFiles.length > 0;
+        return implFiles.length > 0 ? "present" : "absent";
     }
     catch (e) {
-        // Non-fatal — if git operations fail, don't block the pipeline
+        // Non-fatal — if git operations fail, return unknown so callers can decide
         logWarning("recovery", `implementation artifact check failed: ${e.message}`);
-        return true;
+        return "unknown";
     }
 }
 /**
@@ -238,7 +238,7 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
         if (!hasCheckboxTask && !hasHeadingTask)
             return false;
     }
-    // execute-task: DB status is authoritative. Fall back to heading-style plan
+    // execute-task: DB status is authoritative. Fall back to checked-checkbox
     // detection when the DB is unavailable (unmigrated projects).
     if (unitType === "execute-task") {
         const { milestone: mid, slice: sid, task: tid } = parseUnitId(unitId);
@@ -251,21 +251,25 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
             }
             else if (!isDbAvailable()) {
                 // LEGACY: Pre-migration fallback for projects without DB.
-                // Fall back to plan heading check (format detection, not reconciliation).
-                // Heading-style entries (### T01 --) count as verified because the
-                // summary file existence (checked above) is the real signal.
+                // Require a CHECKED checkbox — a bare heading or unchecked checkbox
+                // does not prove gsd_complete_task ran. Summary file on disk alone
+                // is not sufficient evidence (could be a rogue write) (#3607).
                 const planAbs = resolveSliceFile(base, mid, sid, "PLAN");
                 if (planAbs && existsSync(planAbs)) {
                     const planContent = readFileSync(planAbs, "utf-8");
                     const escapedTid = tid.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-                    const hdRe = new RegExp(`^#{2,4}\\s+${escapedTid}\\s*(?:--|—|:)`, "m");
                     const cbRe = new RegExp(`^- \\[[xX]\\] \\*\\*${escapedTid}:`, "m");
-                    if (!hdRe.test(planContent) && !cbRe.test(planContent))
+                    if (!cbRe.test(planContent))
                         return false;
                 }
+                else {
+                    return false; // no plan file → cannot verify
+                }
+            }
+            else {
+                // DB available but task row not found — completion tool never ran (#3607)
+                return false;
             }
-            // else: DB available but task not found — summary file exists (checked above),
-            // so treat as verified (task may not be imported yet)
         }
     }
     // plan-slice must also produce individual task plan files for every task listed
@@ -350,7 +354,7 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
     // A milestone with only .gsd/ plan files and zero implementation code is
     // not genuinely complete — the LLM wrote plan files but skipped actual work.
     if (unitType === "complete-milestone") {
-        if (!hasImplementationArtifacts(base))
+        if (hasImplementationArtifacts(base) === "absent")
             return false;
     }
     return true;
@@ -382,21 +386,35 @@ export function writeBlockerPlaceholder(unitType, unitId, base, reason) {
     // re-derives the same unit indefinitely (#2531, #2653).
     if (isDbAvailable()) {
         const { milestone: mid, slice: sid, task: tid } = parseUnitId(unitId);
+        const ts = new Date().toISOString();
         if (unitType === "execute-task" && mid && sid && tid) {
             try {
-                updateTaskStatus(mid, sid, tid, "complete", new Date().toISOString());
+                updateTaskStatus(mid, sid, tid, "complete", ts);
             }
             catch (e) {
                 logWarning("recovery", `updateTaskStatus failed during context exhaustion: ${e instanceof Error ? e.message : String(e)}`);
             }
+            // Append event so worktree reconciliation can replay this recovery completion
+            try {
+                appendEvent(base, { cmd: "complete-task", params: { milestoneId: mid, sliceId: sid, taskId: tid }, ts, actor: "system", trigger_reason: "blocker-placeholder-recovery" });
+            }
+            catch (e) {
+                logWarning("recovery", `appendEvent failed for task recovery: ${e instanceof Error ? e.message : String(e)}`);
+            }
         }
         if (unitType === "complete-slice" && mid && sid) {
             try {
-                updateSliceStatus(mid, sid, "complete", new Date().toISOString());
+                updateSliceStatus(mid, sid, "complete", ts);
             }
             catch (e) {
                 logWarning("recovery", `updateSliceStatus failed during context exhaustion: ${e instanceof Error ? e.message : String(e)}`);
             }
+            try {
+                appendEvent(base, { cmd: "complete-slice", params: { milestoneId: mid, sliceId: sid }, ts, actor: "system", trigger_reason: "blocker-placeholder-recovery" });
+            }
+            catch (e) {
+                logWarning("recovery", `appendEvent failed for slice recovery: ${e instanceof Error ? e.message : String(e)}`);
+            }
         }
     }
     return diagnoseExpectedArtifact(unitType, unitId, base);
@@ -451,7 +469,7 @@ export function reconcileMergeState(basePath, ctx) {
     if (conflictedFiles.length === 0) {
         // All conflicts resolved — finalize the merge/squash commit
         try {
-            const commitSha = nativeCommit(basePath, ""); // --no-edit equivalent: use empty message placeholder
+            const commitSha = nativeCommit(basePath, "chore(gsd): reconcile merge state");
             if (commitSha) {
                 const mode = hasMergeHead ? "merge" : "squash commit";
                 ctx.ui.notify(`Finalized leftover ${mode} from prior session.`, "info");

package/dist/resources/extensions/gsd/auto-start.js

@@ -20,11 +20,12 @@ import { synthesizeCrashRecovery } from "./session-forensics.js";
 import { writeLock, clearLock, readCrashLock, formatCrashInfo, isLockProcessAlive, } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
-import { nativeInit, nativeAddAll, nativeCommit, } from "./native-git-bridge.js";
+import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
 import { getAutoWorktreePath } from "./auto-worktree.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
+import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
 import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
@@ -35,7 +36,7 @@ import { hideFooter } from "./auto-dashboard.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { parseUnitId } from "./unit-id.js";
-import { existsSync, mkdirSync, readdirSync, statSync, unlinkSync, } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
 import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
@@ -48,11 +49,8 @@ import { resolveDefaultSessionModel } from "./preferences-models.js";
  * Returns false if the bootstrap aborted (e.g., guided flow returned,
  * concurrent session detected). Returns true when ready to dispatch.
  */
-/** Guard: tracks consecutive bootstrap attempts that found phase === "complete".
- *  Prevents the recursive dialog loop described in #1348 where
- *  bootstrapAutoSession → showSmartEntry → checkAutoStartAfterDiscuss → startAuto
- *  cycles indefinitely when the discuss workflow doesn't produce a milestone. */
-let _consecutiveCompleteBootstraps = 0;
+// Guard constant for consecutive bootstrap attempts that found phase === "complete".
+// Counter moved to AutoSession.consecutiveCompleteBootstraps so s.reset() clears it.
 const MAX_CONSECUTIVE_COMPLETE_BOOTSTRAPS = 2;
 export async function openProjectDbIfPresent(basePath) {
     const gsdDbPath = resolveProjectRootDbPath(basePath);
@@ -65,6 +63,117 @@ export async function openProjectDbIfPresent(basePath) {
         logWarning("engine", `gsd-db: failed to open existing database: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/**
+ * Audit for orphaned milestone branches at bootstrap.
+ *
+ * After a milestone completes, the teardown step (merge branch → main,
+ * delete branch, remove worktree) runs as a post-completion engine step.
+ * If the session ends between completion and teardown, the branch and
+ * worktree are orphaned — the DB says "complete" so auto-mode won't
+ * re-enter the milestone, and the teardown is never retried.
+ *
+ * This audit runs on every fresh bootstrap to catch that gap:
+ * 1. Lists all local `milestone/*` branches.
+ * 2. For each, checks if the milestone's DB status is "complete".
+ * 3. If the branch is already merged into main → deletes the branch
+ *    and cleans up any orphaned worktree directory (safe, no data loss).
+ * 4. If the branch is NOT merged → preserves it and warns the user
+ *    so they can merge manually (data safety first).
+ *
+ * Returns a summary of actions taken for the caller to surface via notify.
+ */
+export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
+    const recovered = [];
+    const warnings = [];
+    // Skip in none mode — no milestone branches are created
+    if (isolationMode === "none")
+        return { recovered, warnings };
+    // Skip if DB not available — can't determine completion status
+    if (!isDbAvailable())
+        return { recovered, warnings };
+    let milestoneBranches;
+    try {
+        milestoneBranches = nativeBranchList(basePath, "milestone/*");
+    }
+    catch {
+        // git branch list failed — skip audit
+        return { recovered, warnings };
+    }
+    if (milestoneBranches.length === 0)
+        return { recovered, warnings };
+    // Detect main branch for merge-check
+    let mainBranch;
+    try {
+        mainBranch = nativeDetectMainBranch(basePath);
+    }
+    catch {
+        mainBranch = "main";
+    }
+    // Get branches already merged into main
+    let mergedBranches;
+    try {
+        mergedBranches = new Set(nativeBranchListMerged(basePath, mainBranch, "milestone/*"));
+    }
+    catch {
+        mergedBranches = new Set();
+    }
+    for (const branch of milestoneBranches) {
+        const milestoneId = branch.replace(/^milestone\//, "");
+        const milestone = getMilestone(milestoneId);
+        // Only audit completed milestones
+        if (!milestone || milestone.status !== "complete")
+            continue;
+        const isMerged = mergedBranches.has(branch);
+        if (isMerged) {
+            // Branch is merged — safe to delete branch and clean up worktree dir
+            try {
+                nativeBranchDelete(basePath, branch, true);
+                recovered.push(`Deleted merged branch ${branch} for completed milestone ${milestoneId}.`);
+            }
+            catch (err) {
+                warnings.push(`Failed to delete merged branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            // Clean up orphaned worktree directory if it exists
+            const wtDir = getWorktreeDir(basePath, milestoneId);
+            if (existsSync(wtDir)) {
+                // Try git worktree remove first (handles registered worktrees)
+                try {
+                    nativeWorktreeRemove(basePath, wtDir, true);
+                }
+                catch (e) {
+                    // Not a registered worktree — expected for orphaned dirs
+                    logWarning("engine", `worktree remove failed (expected for orphaned dirs): ${e instanceof Error ? e.message : String(e)}`);
+                }
+                // If the directory still exists after git worktree remove (either it
+                // wasn't registered or the remove was a noop), fall back to direct
+                // filesystem removal — but only inside .gsd/worktrees/ for safety (#2365).
+                if (existsSync(wtDir)) {
+                    if (isInsideWorktreesDir(basePath, wtDir)) {
+                        try {
+                            rmSync(wtDir, { recursive: true, force: true });
+                            recovered.push(`Removed orphaned worktree directory for ${milestoneId}.`);
+                        }
+                        catch (err2) {
+                            warnings.push(`Failed to remove worktree directory for ${milestoneId}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                        }
+                    }
+                    else {
+                        warnings.push(`Orphaned worktree directory for ${milestoneId} is outside .gsd/worktrees/ — skipping removal for safety.`);
+                    }
+                }
+                else {
+                    recovered.push(`Removed orphaned worktree directory for ${milestoneId}.`);
+                }
+            }
+        }
+        else {
+            // Branch is NOT merged — preserve for safety, warn the user
+            warnings.push(`Branch ${branch} exists for completed milestone ${milestoneId} but is NOT merged into ${mainBranch}. ` +
+                `This may contain unmerged work. Merge manually or run \`/gsd health --fix\` to resolve.`);
+        }
+    }
+    return { recovered, warnings };
+}
 export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, deps) {
     const { shouldUseWorktreeIsolation, registerSigtermHandler, lockBase, buildResolver, } = deps;
     const lockResult = acquireSessionLock(base);
@@ -194,6 +303,26 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Open the project-root DB before deriveState so DB-backed state
         // derivation (queue-order, task status) works on a cold start (#2841).
         await openProjectDbIfPresent(base);
+        // ── Orphaned milestone branch audit ──
+        // Catches completed milestones whose teardown (merge + branch delete)
+        // was lost due to session ending between completion and teardown.
+        // Must run after DB open and before worktree entry.
+        try {
+            const auditResult = auditOrphanedMilestoneBranches(base, getIsolationMode());
+            for (const msg of auditResult.recovered) {
+                ctx.ui.notify(`Orphan audit: ${msg}`, "info");
+            }
+            for (const msg of auditResult.warnings) {
+                ctx.ui.notify(`Orphan audit: ${msg}`, "warning");
+            }
+            if (auditResult.recovered.length > 0) {
+                debugLog("orphan-audit", { recovered: auditResult.recovered, warnings: auditResult.warnings });
+            }
+        }
+        catch (err) {
+            // Non-fatal — the audit is defensive, never block bootstrap
+            logWarning("bootstrap", `orphaned milestone branch audit failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
         let state = await deriveState(base);
         // Stale worktree state recovery (#654)
         if (state.activeMilestone &&
@@ -263,9 +392,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 // Guard against recursive dialog loop (#1348):
                 // If we've entered this branch multiple times in quick succession,
                 // the discuss workflow isn't producing a milestone. Break the cycle.
-                _consecutiveCompleteBootstraps++;
-                if (_consecutiveCompleteBootstraps > MAX_CONSECUTIVE_COMPLETE_BOOTSTRAPS) {
-                    _consecutiveCompleteBootstraps = 0;
+                s.consecutiveCompleteBootstraps++;
+                if (s.consecutiveCompleteBootstraps > MAX_CONSECUTIVE_COMPLETE_BOOTSTRAPS) {
+                    s.consecutiveCompleteBootstraps = 0;
                     ctx.ui.notify("All milestones are complete and the discussion didn't produce a new one. " +
                         "Run /gsd to start a new milestone manually.", "warning");
                     return releaseLockAndReturn();
@@ -277,7 +406,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 if (postState.activeMilestone &&
                     postState.phase !== "complete" &&
                     postState.phase !== "pre-planning") {
-                    _consecutiveCompleteBootstraps = 0; // Successfully advanced past "complete"
+                    s.consecutiveCompleteBootstraps = 0; // Successfully advanced past "complete"
                     state = postState;
                 }
                 else if (postState.activeMilestone &&
@@ -338,7 +467,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             return releaseLockAndReturn();
         }
         // Successfully resolved an active milestone — reset the re-entry guard
-        _consecutiveCompleteBootstraps = 0;
+        s.consecutiveCompleteBootstraps = 0;
         // ── Initialize session state ──
         s.active = true;
         s.stepMode = requestedStepMode;
@@ -373,6 +502,22 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             }
             setActiveMilestoneId(base, s.currentMilestoneId);
         }
+        // Guard against stale milestone branch when isolation:none (#3613).
+        // A prior session with isolation:branch/worktree may have left HEAD on
+        // milestone/<MID>. Auto-checkout back to the integration branch.
+        if (getIsolationMode() === "none" && nativeIsRepo(base)) {
+            try {
+                const currentBranch = nativeGetCurrentBranch(base);
+                if (currentBranch.startsWith("milestone/")) {
+                    const integrationBranch = nativeDetectMainBranch(base);
+                    nativeCheckoutBranch(base, integrationBranch);
+                    logWarning("bootstrap", `Returned to "${integrationBranch}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
+                }
+            }
+            catch (err) {
+                logWarning("bootstrap", `Could not auto-checkout from stale milestone branch: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
         // ── Auto-worktree setup ──
         s.originalBasePath = base;
         const isUnderGsdWorktrees = (p) => {
@@ -448,6 +593,24 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 id: startModelSnapshot.id,
             };
         }
+        // Apply worker model override from parallel orchestrator (#worker-model).
+        // GSD_WORKER_MODEL is injected by the coordinator when parallel.worker_model
+        // is configured, so parallel milestone workers use a cheaper model than the
+        // coordinator session (e.g. Haiku for execution, Sonnet for planning).
+        const workerModelOverride = process.env.GSD_WORKER_MODEL;
+        if (workerModelOverride && process.env.GSD_PARALLEL_WORKER === "1") {
+            const availableModels = ctx.modelRegistry.getAvailable();
+            const { resolveModelId } = await import("./auto-model-selection.js");
+            const overrideModel = resolveModelId(workerModelOverride, availableModels, ctx.model?.provider);
+            if (overrideModel) {
+                const ok = await pi.setModel(overrideModel, { persist: false });
+                if (ok) {
+                    // Update start model so all subsequent units use this as the baseline
+                    s.autoModeStartModel = { provider: overrideModel.provider, id: overrideModel.id };
+                    ctx.ui.notify(`Worker model override: ${overrideModel.provider}/${overrideModel.id}`, "info");
+                }
+            }
+        }
         // Snapshot installed skills
         if (resolveSkillDiscoveryMode() !== "off") {
             snapshotSkills();

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -92,3 +92,13 @@ export function isToolInvocationError(errorMsg) {
         return false;
     return TOOL_INVOCATION_ERROR_RE.test(errorMsg);
 }
+/**
+ * Returns true if the error message indicates the tool was skipped because
+ * a queued user message interrupted the turn (#3595).  Retrying will produce
+ * the same skip, so the unit should be paused rather than retried.
+ */
+export function isQueuedUserMessageSkip(errorMsg) {
+    if (!errorMsg)
+        return false;
+    return /^Skipped due to queued user message\.?$/i.test(errorMsg.trim());
+}

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -135,8 +135,10 @@ function clearProjectRootStateFiles(basePath, milestoneId) {
             unlinkSync(file);
         }
         catch (err) {
-            /* non-fatal — file may not exist */
-            logWarning("worktree", `file unlink failed: ${err instanceof Error ? err.message : String(err)}`);
+            // ENOENT is expected — file may not exist (#3597)
+            if (err.code !== "ENOENT") {
+                logWarning("worktree", `file unlink failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
         }
     }
     // Clean up entire synced milestone directory and runtime/units.
@@ -160,8 +162,11 @@ function clearProjectRootStateFiles(basePath, milestoneId) {
                             unlinkSync(join(basePath, f));
                         }
                         catch (err) {
-                            /* non-fatal */
-                            logWarning("worktree", `untracked file unlink failed: ${err instanceof Error ? err.message : String(err)}`);
+                            // ENOENT/EISDIR are expected for already-removed or directory entries (#3597)
+                            const code = err.code;
+                            if (code !== "ENOENT" && code !== "EISDIR") {
+                                logWarning("worktree", `untracked file unlink failed: ${err instanceof Error ? err.message : String(err)}`);
+                            }
                         }
                     }
                 }
@@ -656,6 +661,10 @@ export function syncWorktreeStateBack(mainBasePath, worktreePath, milestoneId) {
             .filter((d) => d.isDirectory())
             .map((d) => d.name);
         for (const mid of wtMilestones) {
+            // Skip the current milestone being merged — its files are already in the
+            // milestone branch and would conflict with the squash merge (#3641).
+            if (mid === milestoneId)
+                continue;
             syncMilestoneDir(wtGsd, mainGsd, mid, synced);
         }
     }
@@ -901,11 +910,19 @@ export function createAutoWorktree(basePath, milestoneId) {
         });
     }
     else {
-        // Fresh start — create branch from integration branch
+        // Fresh start — create branch from integration branch.
+        // Use the same 3-tier fallback as mergeMilestoneToMain (#3461):
+        //   1. META.json integration branch (explicit per-milestone override)
+        //   2. git.main_branch preference (user's configured working branch)
+        //   3. nativeDetectMainBranch (origin/HEAD auto-detection)
+        // Without tier 2, projects with main_branch=dev but origin/HEAD→master
+        // would fork worktrees from the wrong (stale) branch.
         const integrationBranch = readIntegrationBranch(basePath, milestoneId) ?? undefined;
+        const gitPrefs = loadEffectiveGSDPreferences()?.preferences?.git;
+        const startPoint = integrationBranch ?? gitPrefs?.main_branch ?? undefined;
         info = createWorktree(basePath, milestoneId, {
             branch,
-            startPoint: integrationBranch,
+            startPoint,
         });
     }
     // Copy .gsd/ planning artifacts from the source repo into the new worktree.
@@ -1235,7 +1252,12 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     //    checkout and leave the user with a broken merge state (#1668).
     const prefs = loadEffectiveGSDPreferences()?.preferences?.git ?? {};
     const integrationBranch = readIntegrationBranch(originalBasePath_, milestoneId);
-    const mainBranch = integrationBranch ?? prefs.main_branch ?? nativeDetectMainBranch(originalBasePath_);
+    // Validate prefs.main_branch exists before using it — a stale preference
+    // (e.g. "master" when repo uses "main") causes merge failure (#3589).
+    const validatedPrefBranch = prefs.main_branch && nativeBranchExists(originalBasePath_, prefs.main_branch)
+        ? prefs.main_branch
+        : undefined;
+    const mainBranch = integrationBranch ?? validatedPrefBranch ?? nativeDetectMainBranch(originalBasePath_);
     // Remove transient project-root state files before any branch or merge
     // operation. Untracked milestone metadata can otherwise block squash merges.
     clearProjectRootStateFiles(originalBasePath_, milestoneId);

package/dist/resources/extensions/gsd/auto.js

@@ -23,7 +23,7 @@ import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSes
 import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, } from "./preferences.js";
 import { sendDesktopNotification } from "./notifications.js";
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, } from "./auto-budget.js";
-import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, } from "./auto-tool-tracking.js";
+import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, } from "./auto-tool-tracking.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
 import { selectAndApplyModel, resolveModelId } from "./auto-model-selection.js";
 import { resetRoutingHistory, recordOutcome } from "./routing-history.js";
@@ -201,7 +201,7 @@ export function markToolEnd(toolCallId) {
 export function recordToolInvocationError(toolName, errorMsg) {
     if (!s.active)
         return;
-    if (isToolInvocationError(errorMsg)) {
+    if (isToolInvocationError(errorMsg) || isQueuedUserMessageSkip(errorMsg)) {
         s.lastToolInvocationError = `${toolName}: ${errorMsg}`;
     }
 }
@@ -845,12 +845,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                     s.stepMode = meta.stepMode ?? requestedStepMode;
                     s.autoStartTime = meta.autoStartTime || Date.now();
                     s.paused = true;
-                    try {
-                        unlinkSync(pausedPath);
-                    }
-                    catch (err) { /* non-fatal */
-                        logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
-                    }
+                    // Don't delete pause file yet — defer until lock is acquired.
+                    // If lock fails, the file must survive for retry.
+                    s.pausedSessionFile = pausedPath;
                     ctx.ui.notify(`Resuming paused custom workflow${meta.activeRunDir ? ` (${meta.activeRunDir})` : ""}.`, "info");
                 }
                 else if (meta.milestoneId) {
@@ -873,13 +870,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                         s.stepMode = meta.stepMode ?? requestedStepMode;
                         s.autoStartTime = meta.autoStartTime || Date.now();
                         s.paused = true;
-                        // Clean up the persisted file — we're consuming it
-                        try {
-                            unlinkSync(pausedPath);
-                        }
-                        catch (err) { /* non-fatal */
-                            logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
-                        }
+                        // Don't delete pause file yet — defer until lock is acquired.
+                        // If lock fails, the file must survive for retry.
+                        s.pausedSessionFile = pausedPath;
                         ctx.ui.notify(`Resuming paused session for ${meta.milestoneId}${meta.worktreePath ? ` (worktree)` : ""}.`, "info");
                     }
                 }
@@ -893,9 +886,22 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     if (s.paused) {
         const resumeLock = acquireSessionLock(base);
         if (!resumeLock.acquired) {
+            // Reset paused state so isAutoPaused() doesn't stick true after lock failure.
+            // Pause file is preserved on disk for retry — not deleted.
+            s.paused = false;
             ctx.ui.notify(`Cannot resume: ${resumeLock.reason}`, "error");
             return;
         }
+        // Lock acquired — now safe to delete the pause file
+        if (s.pausedSessionFile) {
+            try {
+                unlinkSync(s.pausedSessionFile);
+            }
+            catch (err) {
+                logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+            }
+            s.pausedSessionFile = null;
+        }
         s.paused = false;
         s.active = true;
         s.verbose = verboseMode;

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -79,11 +79,24 @@ export async function handleAgentEnd(pi, event, ctx) {
         return;
     }
     if (lastMsg && "stopReason" in lastMsg && lastMsg.stopReason === "error") {
-        const errorDetail = "errorMessage" in lastMsg && lastMsg.errorMessage ? `: ${lastMsg.errorMessage}` : "";
-        const errorMsg = ("errorMessage" in lastMsg && lastMsg.errorMessage) ? String(lastMsg.errorMessage) : "";
+        // #3588: errorMessage can be useless (e.g. "success") while the real error
+        // is in the assistant message text content. Fall back to content when
+        // errorMessage looks uninformative.
+        const rawErrorMsg = ("errorMessage" in lastMsg && lastMsg.errorMessage) ? String(lastMsg.errorMessage) : "";
+        const isUseless = !rawErrorMsg || /^(success|ok|true|error|unknown)$/i.test(rawErrorMsg.trim());
+        // #3588: When errorMessage is uninformative, extract the real error from
+        // the assistant message text content for display purposes only.
+        // Classification still uses rawErrorMsg to avoid false positives from prose.
+        let displayMsg = rawErrorMsg;
+        if (isUseless && "content" in lastMsg && Array.isArray(lastMsg.content)) {
+            const textBlock = lastMsg.content.find((b) => b.type === "text" && b.text);
+            if (textBlock)
+                displayMsg = textBlock.text.slice(0, 300);
+        }
+        const errorDetail = displayMsg ? `: ${displayMsg}` : "";
         const explicitRetryAfterMs = ("retryAfterMs" in lastMsg && typeof lastMsg.retryAfterMs === "number") ? lastMsg.retryAfterMs : undefined;
-        // ── 1. Classify ──────────────────────────────────────────────────────
-        const cls = classifyError(errorMsg, explicitRetryAfterMs);
+        // ── 1. Classify using rawErrorMsg to avoid prose false-positives ────
+        const cls = classifyError(rawErrorMsg, explicitRetryAfterMs);
         // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli)
         // which use per-user quotas with shorter windows (#2922).
         if (cls.kind === "rate-limit") {

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -943,6 +943,16 @@ export function registerDbTools(pi) {
             }
             updateSliceStatus(params.milestoneId, params.sliceId, "skipped");
             invalidateStateCache();
+            // Rebuild STATE.md so it reflects the skip immediately (#3477).
+            // Without this, /gsd auto reads stale STATE.md and resumes the skipped slice.
+            try {
+                const basePath = process.cwd();
+                const { rebuildState } = await import("../doctor.js");
+                await rebuildState(basePath);
+            }
+            catch (err) {
+                logError("tool", `skip_slice rebuildState failed: ${err.message}`, { tool: "gsd_skip_slice" });
+            }
             return {
                 content: [{ type: "text", text: `Skipped slice ${params.sliceId} (${params.milestoneId}). Reason: ${params.reason ?? "User-directed skip"}. Auto-mode will advance past this slice.` }],
                 details: {

package/dist/resources/extensions/gsd/bootstrap/query-tools.js

@@ -17,10 +17,12 @@ export function registerQueryTools(pi) {
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
             try {
-                // Strictly read-only: only use an already-open DB connection.
-                // Do NOT call ensureDbOpen() — it can create/migrate the DB as a side effect.
-                const { isDbAvailable, getMilestone, getSliceStatusSummary, getSliceTaskCounts, _getAdapter, } = await import("../gsd-db.js");
-                if (!isDbAvailable()) {
+                // Open the DB if not already open — safe for read-only use since
+                // ensureDbOpen() only creates/migrates when .gsd/ has content (#3644).
+                const { ensureDbOpen } = await import("./dynamic-tools.js");
+                const dbAvailable = await ensureDbOpen();
+                const { getMilestone, getSliceStatusSummary, getSliceTaskCounts, _getAdapter, } = await import("../gsd-db.js");
+                if (!dbAvailable) {
                     return {
                         content: [{ type: "text", text: "Error: GSD database is not available." }],
                         details: { operation: "milestone_status", error: "db_unavailable" },