gsd-pi 2.66.1-dev.ed243f2 → 2.67.0-dev.43b0159

package/src/resources/extensions/gsd/auto-recovery.ts

@@ -13,7 +13,7 @@ import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
-import { isDbAvailable, getTask, getSlice, getSliceTasks, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
@@ -248,8 +248,7 @@ export function verifyExpectedArtifact(
     if (gateIds.length === 0) return true;
 
     try {
-      const { getPendingGates: getPending } = require("./gsd-db.js");
-      const pending = getPending(mid, sid, "slice");
+      const pending = getPendingGates(mid, sid, "slice");
       const pendingIds = new Set(pending.map((g: any) => g.gate_id));
       // All dispatched gates must no longer be pending
       for (const gid of gateIds) {
@@ -480,22 +479,23 @@ function abortAndResetMerge(
   }
 }
 
+export type MergeReconcileResult = "clean" | "reconciled" | "blocked";
+
 /**
  * Detect leftover merge state from a prior session and reconcile it.
  * If MERGE_HEAD or SQUASH_MSG exists, check whether conflicts are resolved.
- * If resolved: finalize the commit. If still conflicted: abort and reset.
- *
- * Returns true if state was dirty and re-derivation is needed.
+ * If resolved: finalize the commit. If only .gsd conflicts remain: auto-resolve.
+ * If code conflicts remain: fail safe without modifying the worktree.
  */
 export function reconcileMergeState(
   basePath: string,
   ctx: ExtensionContext,
-): boolean {
+): MergeReconcileResult {
   const mergeHeadPath = join(basePath, ".git", "MERGE_HEAD");
   const squashMsgPath = join(basePath, ".git", "SQUASH_MSG");
   const hasMergeHead = existsSync(mergeHeadPath);
   const hasSquashMsg = existsSync(squashMsgPath);
-  if (!hasMergeHead && !hasSquashMsg) return false;
+  if (!hasMergeHead && !hasSquashMsg) return "clean";
 
   const conflictedFiles = nativeConflictFiles(basePath);
   if (conflictedFiles.length === 0) {
@@ -511,7 +511,7 @@ export function reconcileMergeState(
     } catch (err) {
       const errorMessage = getErrorMessage(err);
       ctx.ui.notify(`Failed to finalize leftover merge/squash commit: ${errorMessage}`, "error");
-      return false;
+      return "blocked";
     }
   } else {
     // Still conflicted — try auto-resolving .gsd/ state file conflicts (#530)
@@ -551,15 +551,16 @@ export function reconcileMergeState(
         );
       }
     } else {
-      // Code conflicts present — abort and reset
-      abortAndResetMerge(basePath, hasMergeHead, squashMsgPath);
+      // Code conflicts present — fail safe and preserve any manual resolution
+      // work instead of discarding it with merge --abort/reset --hard.
       ctx.ui.notify(
-        "Detected leftover merge state with unresolved conflicts — cleaned up. Re-deriving state.",
-        "warning",
+        "Detected leftover merge state with unresolved code conflicts. Auto-mode will pause without modifying the worktree so manual conflict resolution is preserved.",
+        "error",
       );
+      return "blocked";
     }
   }
-  return true;
+  return "reconciled";
 }
 
 // ─── Loop Remediation ─────────────────────────────────────────────────────────
@@ -618,4 +619,3 @@ export function buildLoopRemediationSteps(
   }
   return null;
 }
-

package/src/resources/extensions/gsd/auto.ts

@@ -1205,7 +1205,18 @@ export async function startAuto(
     s.active = true;
     s.verbose = verboseMode;
     s.stepMode = requestedStepMode;
-    s.cmdCtx = ctx;
+    // Preserve the original cmdCtx (ExtensionCommandContext with newSession)
+    // when resuming from a provider-error pause. The resume callback receives
+    // an ExtensionContext (from the agent_end hook) which lacks newSession —
+    // using it would crash runUnit with "newSession is not a function".
+    // Only override if the new ctx actually has newSession (user-initiated resume).
+    if ("newSession" in ctx && typeof (ctx as any).newSession === "function") {
+      s.cmdCtx = ctx;
+    } else if (!s.cmdCtx) {
+      // No saved cmdCtx — this shouldn't happen, but handle gracefully
+      s.cmdCtx = ctx as ExtensionCommandContext;
+    }
+    // else: keep existing s.cmdCtx which has the real newSession
     s.basePath = base;
     setLogBasePath(base);
     if (!s.autoStartTime || s.autoStartTime <= 0) s.autoStartTime = Date.now();

package/src/resources/extensions/gsd/bootstrap/agent-end-recovery.ts

@@ -19,7 +19,17 @@ import {
 
 const retryState = createRetryState();
 const MAX_NETWORK_RETRIES = 2;
-const MAX_TRANSIENT_AUTO_RESUMES = 3;
+const MAX_TRANSIENT_AUTO_RESUMES = 8;
+
+/**
+ * Reset the module-level retry state so a resumed auto-session starts fresh.
+ * Called by provider-error-resume.ts before startAuto() — without this, the
+ * consecutiveTransientCount accumulates across pause/resume cycles and locks
+ * out auto-resume after MAX_TRANSIENT_AUTO_RESUMES total (not consecutive) errors.
+ */
+export function resetTransientRetryState(): void {
+  resetRetryState(retryState);
+}
 
 async function pauseTransientWithBackoff(
   cls: ErrorClass,
@@ -114,6 +124,29 @@ export async function handleAgentEnd(
     // ── 1. Classify using rawErrorMsg to avoid prose false-positives ────
     const cls = classifyError(rawErrorMsg, explicitRetryAfterMs);
 
+    // ── 1b. Defer to Core RetryHandler for transient errors ─────────────
+    // The Core RetryHandler (agent-session.ts) processes retryable errors
+    // AFTER this extension handler, in the same _processAgentEvent() call.
+    // For transient errors (overloaded, rate limit, server), the Core will
+    // retry in-context — same session, same conversation — which is strictly
+    // better than our Layer 2 pause+resume (which creates a new session).
+    //
+    // If we react here AND the Core also retries, we race: pauseAuto tears
+    // down the session while agent.continue() starts a new turn.
+    //
+    // Solution: Do nothing for transient errors. The Core RetryHandler
+    // runs next in _processAgentEvent and will either:
+    //   a) Retry successfully → new agent_end (success) → we see it next time
+    //   b) Exhaust retries → the agent stays idle, autoLoop's unit timeout
+    //      or stuck detection handles it
+    //
+    // We do NOT call resolveAgentEnd here — that would unblock autoLoop
+    // prematurely while the Core is still retrying in the same session.
+    // We do NOT call pauseAuto — that would tear down the session.
+    if (isTransient(cls)) {
+      return;
+    }
+
     // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli)
     // which use per-user quotas with shorter windows (#2922).
     if (cls.kind === "rate-limit") {

package/src/resources/extensions/gsd/bootstrap/db-tools.ts

@@ -7,6 +7,16 @@ import { loadEffectiveGSDPreferences } from "../preferences.js";
 import { ensureDbOpen } from "./dynamic-tools.js";
 import { StringEnum } from "@gsd/pi-ai";
 import { logError } from "../workflow-logger.js";
+import { getErrorMessage } from "../error-utils.js";
+import { shouldBlockContextArtifactSave } from "./write-gate.js";
+
+const SUPPORTED_SUMMARY_ARTIFACT_TYPES = ["SUMMARY", "RESEARCH", "CONTEXT", "ASSESSMENT", "CONTEXT-DRAFT"] as const;
+
+export function isSupportedSummaryArtifactType(
+  artifactType: string,
+): artifactType is (typeof SUPPORTED_SUMMARY_ARTIFACT_TYPES)[number] {
+  return (SUPPORTED_SUMMARY_ARTIFACT_TYPES as readonly string[]).includes(artifactType);
+}
 
 /**
  * Register an alias tool that shares the same execute function as its canonical counterpart.
@@ -283,13 +293,23 @@ export function registerDbTools(pi: ExtensionAPI): void {
         details: { operation: "save_summary", error: "db_unavailable" } as any,
       };
     }
-    const validTypes = ["SUMMARY", "RESEARCH", "CONTEXT", "ASSESSMENT"];
-    if (!validTypes.includes(params.artifact_type)) {
+    if (!isSupportedSummaryArtifactType(params.artifact_type)) {
       return {
-        content: [{ type: "text" as const, text: `Error: Invalid artifact_type "${params.artifact_type}". Must be one of: ${validTypes.join(", ")}` }],
+        content: [{ type: "text" as const, text: `Error: Invalid artifact_type "${params.artifact_type}". Must be one of: ${SUPPORTED_SUMMARY_ARTIFACT_TYPES.join(", ")}` }],
         details: { operation: "save_summary", error: "invalid_artifact_type" } as any,
       };
     }
+    const contextGuard = shouldBlockContextArtifactSave(
+      params.artifact_type,
+      params.milestone_id ?? null,
+      params.slice_id ?? null,
+    );
+    if (contextGuard.block) {
+      return {
+        content: [{ type: "text" as const, text: `Error saving artifact: ${contextGuard.reason ?? "context write blocked"}` }],
+        details: { operation: "save_summary", error: "context_write_blocked" } as any,
+      };
+    }
     try {
       let relativePath: string;
       if (params.task_id && params.slice_id) {
@@ -333,16 +353,17 @@ export function registerDbTools(pi: ExtensionAPI): void {
       "Computes the file path from milestone/slice/task IDs automatically.",
     promptSnippet: "Save a GSD artifact (summary/research/context/assessment) to DB and disk",
     promptGuidelines: [
-      "Use gsd_summary_save to persist structured artifacts (SUMMARY, RESEARCH, CONTEXT, ASSESSMENT).",
+      "Use gsd_summary_save to persist structured artifacts (SUMMARY, RESEARCH, CONTEXT, ASSESSMENT, CONTEXT-DRAFT).",
       "milestone_id is required. slice_id and task_id are optional — they determine the file path.",
       "The tool computes the relative path automatically: milestones/M001/M001-SUMMARY.md, milestones/M001/slices/S01/S01-SUMMARY.md, etc.",
-      "artifact_type must be one of: SUMMARY, RESEARCH, CONTEXT, ASSESSMENT.",
+      "artifact_type must be one of: SUMMARY, RESEARCH, CONTEXT, ASSESSMENT, CONTEXT-DRAFT.",
+      "Use CONTEXT-DRAFT for incremental draft persistence; use CONTEXT for the final milestone context after depth verification.",
     ],
     parameters: Type.Object({
       milestone_id: Type.String({ description: "Milestone ID (e.g. M001)" }),
       slice_id: Type.Optional(Type.String({ description: "Slice ID (e.g. S01)" })),
       task_id: Type.Optional(Type.String({ description: "Task ID (e.g. T01)" })),
-      artifact_type: Type.String({ description: "One of: SUMMARY, RESEARCH, CONTEXT, ASSESSMENT" }),
+      artifact_type: Type.String({ description: "One of: SUMMARY, RESEARCH, CONTEXT, ASSESSMENT, CONTEXT-DRAFT" }),
       content: Type.String({ description: "The full markdown content of the artifact" }),
     }),
     execute: summarySaveExecute,

package/src/resources/extensions/gsd/bootstrap/provider-error-resume.ts

@@ -5,6 +5,7 @@ import type {
 } from "@gsd/pi-coding-agent";
 
 import { getAutoDashboardData, startAuto, type AutoDashboardData } from "../auto.js";
+import { resetTransientRetryState } from "./agent-end-recovery.js";
 
 type AutoResumeSnapshot = Pick<AutoDashboardData, "active" | "paused" | "stepMode" | "basePath">;
 
@@ -42,6 +43,11 @@ export async function resumeAutoAfterProviderDelay(
     return "missing-base";
   }
 
+  // Reset the transient retry counter before restarting — without this,
+  // consecutiveTransientCount accumulates across pause/resume cycles and
+  // permanently locks out auto-resume after MAX_TRANSIENT_AUTO_RESUMES errors.
+  resetTransientRetryState();
+
   await deps.startAuto(
     ctx as ExtensionCommandContext,
     pi,

package/src/resources/extensions/gsd/bootstrap/register-hooks.ts

@@ -6,7 +6,7 @@ import { isToolCallEventType } from "@gsd/pi-coding-agent";
 import { buildMilestoneFileName, resolveMilestonePath, resolveSliceFile, resolveSlicePath } from "../paths.js";
 import { buildBeforeAgentStartResult } from "./system-context.js";
 import { handleAgentEnd } from "./agent-end-recovery.js";
-import { clearDiscussionFlowState, isDepthVerified, isDepthConfirmationAnswer, isQueuePhaseActive, markDepthVerified, resetWriteGateState, shouldBlockContextWrite, shouldBlockQueueExecution } from "./write-gate.js";
+import { clearDiscussionFlowState, isDepthConfirmationAnswer, isQueuePhaseActive, markDepthVerified, resetWriteGateState, shouldBlockContextWrite, shouldBlockQueueExecution, isGateQuestionId, setPendingGate, clearPendingGate, getPendingGate, shouldBlockPendingGate, shouldBlockPendingGateBash, extractDepthVerificationMilestoneId } from "./write-gate.js";
 import { isBlockedStateFile, isBashWriteToStateFile, BLOCKED_WRITE_ERROR } from "../write-intercept.js";
 import { cleanupQuickBranch } from "../quick.js";
 import { getDiscussionMilestoneId } from "../guided-flow.js";
@@ -24,6 +24,7 @@ import { logWarning as safetyLogWarning } from "../workflow-logger.js";
 import { installNotifyInterceptor } from "./notify-interceptor.js";
 import { initNotificationStore } from "../notification-store.js";
 import { initNotificationWidget } from "../notification-widget.js";
+import { initHealthWidget } from "../health-widget.js";
 
 // Skip the welcome screen on the very first session_start — cli.ts already
 // printed it before the TUI launched. Only re-print on /clear (subsequent sessions).
@@ -39,6 +40,7 @@ export function registerHooks(pi: ExtensionAPI): void {
     initNotificationStore(process.cwd());
     installNotifyInterceptor(ctx);
     initNotificationWidget(ctx);
+    initHealthWidget(ctx);
     resetWriteGateState();
     resetToolCallLoopGuard();
     resetAskUserQuestionsCache();
@@ -162,12 +164,50 @@ export function registerHooks(pi: ExtensionAPI): void {
   });
 
   pi.on("tool_call", async (event) => {
+    const discussionBasePath = process.cwd();
     // ── Loop guard: block repeated identical tool calls ──
     const loopCheck = checkToolCallLoop(event.toolName, event.input as Record<string, unknown>);
     if (loopCheck.block) {
       return { block: true, reason: loopCheck.reason };
     }
 
+    // ── Discussion gate enforcement: track pending gate questions ─────────
+    // Only gate-shaped ask_user_questions calls should block execution.
+    // The gate stays pending until the user selects the approval option.
+    if (event.toolName === "ask_user_questions") {
+      const milestoneId = getDiscussionMilestoneId(discussionBasePath);
+      const inDiscussion = milestoneId !== null || isQueuePhaseActive();
+      if (inDiscussion) {
+        const questions: any[] = (event.input as any)?.questions ?? [];
+        const questionId = questions.find((question) => typeof question?.id === "string" && isGateQuestionId(question.id))?.id;
+        if (typeof questionId === "string") {
+          setPendingGate(questionId);
+        }
+      }
+    }
+
+    // ── Discussion gate enforcement: block tool calls while gate is pending ──
+    // If ask_user_questions was called with a gate ID but hasn't been confirmed,
+    // block all non-read-only tool calls to prevent the model from skipping gates.
+    if (getPendingGate()) {
+      const milestoneId = getDiscussionMilestoneId(discussionBasePath);
+      if (isToolCallEventType("bash", event)) {
+        const bashGuard = shouldBlockPendingGateBash(
+          event.input.command,
+          milestoneId,
+          isQueuePhaseActive(),
+        );
+        if (bashGuard.block) return bashGuard;
+      } else {
+        const gateGuard = shouldBlockPendingGate(
+          event.toolName,
+          milestoneId,
+          isQueuePhaseActive(),
+        );
+        if (gateGuard.block) return gateGuard;
+      }
+    }
+
     // ── Queue-mode execution guard (#2545): block source-code mutations ──
     // When /gsd queue is active, the agent should only create milestones,
     // not execute work. Block write/edit to non-.gsd/ paths and bash commands
@@ -210,8 +250,7 @@ export function registerHooks(pi: ExtensionAPI): void {
     const result = shouldBlockContextWrite(
       event.toolName,
       event.input.path,
-      getDiscussionMilestoneId(),
-      isDepthVerified(),
+      getDiscussionMilestoneId(discussionBasePath),
       isQueuePhaseActive(),
     );
     if (result.block) return result;
@@ -239,21 +278,43 @@ export function registerHooks(pi: ExtensionAPI): void {
 
   pi.on("tool_result", async (event) => {
     if (event.toolName !== "ask_user_questions") return;
-    const milestoneId = getDiscussionMilestoneId();
+    const milestoneId = getDiscussionMilestoneId(process.cwd());
     const queueActive = isQueuePhaseActive();
     if (!milestoneId && !queueActive) return;
 
     const details = event.details as any;
-    if (details?.cancelled || !details?.response) return;
 
+    // ── Discussion gate enforcement: handle gate question responses ──
+    // If the result is cancelled or has no response, the pending gate stays active
+    // so the model is blocked from non-read-only tools until it re-asks.
+    // If the user responded at all (even "needs adjustment"), clear the pending gate
+    // because the user engaged — the prompt handles the re-ask-after-adjustment flow.
     const questions: any[] = (event.input as any)?.questions ?? [];
+    const currentPendingGate = getPendingGate();
+    if (currentPendingGate) {
+      if (details?.cancelled || !details?.response) {
+        // Gate stays pending — model will be blocked from non-read-only tools
+        // until it re-asks and gets a valid response
+      } else {
+        const pendingQuestion = questions.find((question) => question?.id === currentPendingGate);
+        if (pendingQuestion) {
+          const answer = details.response?.answers?.[currentPendingGate];
+          if (isDepthConfirmationAnswer(answer?.selected, pendingQuestion.options)) {
+            clearPendingGate();
+          }
+        }
+      }
+    }
+
+    if (details?.cancelled || !details?.response) return;
+
     for (const question of questions) {
       if (typeof question.id === "string" && question.id.includes("depth_verification")) {
         // Only unlock the gate if the user selected the first option (confirmation).
         // Cross-references against the question's defined options to reject free-form "Other" text.
         const answer = details.response?.answers?.[question.id];
         if (isDepthConfirmationAnswer(answer?.selected, question.options)) {
-          markDepthVerified();
+          markDepthVerified(extractDepthVerificationMilestoneId(question.id) ?? milestoneId);
         }
         break;
       }

package/src/resources/extensions/gsd/bootstrap/register-shortcuts.ts

@@ -7,18 +7,20 @@ import { Key } from "@gsd/pi-tui";
 import { GSDDashboardOverlay } from "../dashboard-overlay.js";
 import { GSDNotificationOverlay } from "../notification-overlay.js";
 import { ParallelMonitorOverlay } from "../parallel-monitor-overlay.js";
+import { projectRoot } from "../commands/context.js";
 import { shortcutDesc } from "../../shared/mod.js";
 
 export function registerShortcuts(pi: ExtensionAPI): void {
   pi.registerShortcut(Key.ctrlAlt("g"), {
     description: shortcutDesc("Open GSD dashboard", "/gsd status"),
     handler: async (ctx) => {
-      if (!existsSync(join(process.cwd(), ".gsd"))) {
+      const basePath = projectRoot();
+      if (!existsSync(join(basePath, ".gsd"))) {
         ctx.ui.notify("No .gsd/ directory found. Run /gsd to start.", "info");
         return;
       }
-      await ctx.ui.custom<void>(
-        (tui, theme, _kb, done) => new GSDDashboardOverlay(tui, theme, () => done()),
+      await ctx.ui.custom<boolean>(
+        (tui, theme, _kb, done) => new GSDDashboardOverlay(tui, theme, () => done(true)),
         {
           overlay: true,
           overlayOptions: {
@@ -35,8 +37,8 @@ export function registerShortcuts(pi: ExtensionAPI): void {
   pi.registerShortcut(Key.ctrlAlt("n"), {
     description: shortcutDesc("Open notification history", "/gsd notifications"),
     handler: async (ctx) => {
-      await ctx.ui.custom<void>(
-        (tui, theme, _kb, done) => new GSDNotificationOverlay(tui, theme, () => done()),
+      await ctx.ui.custom<boolean>(
+        (tui, theme, _kb, done) => new GSDNotificationOverlay(tui, theme, () => done(true)),
         {
           overlay: true,
           overlayOptions: {
@@ -54,13 +56,14 @@ export function registerShortcuts(pi: ExtensionAPI): void {
   pi.registerShortcut(Key.ctrlAlt("p"), {
     description: shortcutDesc("Open parallel worker monitor", "/gsd parallel watch"),
     handler: async (ctx) => {
-      const parallelDir = join(process.cwd(), ".gsd", "parallel");
+      const basePath = projectRoot();
+      const parallelDir = join(basePath, ".gsd", "parallel");
       if (!existsSync(parallelDir)) {
         ctx.ui.notify("No parallel workers found. Run /gsd parallel start first.", "info");
         return;
       }
-      await ctx.ui.custom<void>(
-        (tui, theme, _kb, done) => new ParallelMonitorOverlay(tui, theme, () => done()),
+      await ctx.ui.custom<boolean>(
+        (tui, theme, _kb, done) => new ParallelMonitorOverlay(tui, theme, () => done(true)),
         {
           overlay: true,
           overlayOptions: {