gsd-pi 2.71.0-dev.977c553 → 2.71.0-dev.e17e0ce

package/dist/cli.js

@@ -7,6 +7,7 @@ import { ensureManagedTools } from './tool-bootstrap.js';
 import { loadStoredEnvKeys } from './wizard.js';
 import { migratePiCredentials } from './pi-migration.js';
 import { validateConfiguredModel } from './startup-model-validation.js';
+import { shouldMigrateAnthropicToClaudeCode } from './provider-migrations.js';
 import { shouldRunOnboarding, runOnboarding } from './onboarding.js';
 import chalk from 'chalk';
 import { checkForUpdates } from './update-check.js';
@@ -285,7 +286,7 @@ const { resolveModelsJsonPath } = await import('./models-resolver.js');
 const modelsJsonPath = resolveModelsJsonPath();
 const modelRegistry = new ModelRegistry(authStorage, modelsJsonPath);
 markStartup('ModelRegistry');
-const settingsManager = SettingsManager.create(agentDir);
+const settingsManager = SettingsManager.create(process.cwd(), agentDir);
 applySecurityOverrides(settingsManager);
 markStartup('SettingsManager.create');
 // Run onboarding wizard on first launch (no LLM provider configured)
@@ -401,7 +402,11 @@ if (isPrintMode) {
     // Migrate anthropic OAuth users to claude-code provider when CLI is available (#3772).
     // Anthropic blocks third-party apps from using subscription quotas — routing through
     // the local claude CLI binary is TOS-compliant.
-    if (modelRegistry.isProviderRequestReady('claude-code') && settingsManager.getDefaultProvider() === 'anthropic') {
+    if (shouldMigrateAnthropicToClaudeCode({
+        authStorage,
+        isClaudeCodeReady: modelRegistry.isProviderRequestReady('claude-code'),
+        defaultProvider: settingsManager.getDefaultProvider(),
+    })) {
         const currentModelId = settingsManager.getDefaultModel();
         if (currentModelId) {
             const ccModel = modelRegistry.find('claude-code', currentModelId);
@@ -576,7 +581,11 @@ markStartup('createAgentSession');
 // Migrate anthropic OAuth users to claude-code provider when CLI is available (#3772).
 // Anthropic blocks third-party apps from using subscription quotas — routing through
 // the local claude CLI binary is TOS-compliant.
-if (modelRegistry.isProviderRequestReady('claude-code') && settingsManager.getDefaultProvider() === 'anthropic') {
+if (shouldMigrateAnthropicToClaudeCode({
+    authStorage,
+    isClaudeCodeReady: modelRegistry.isProviderRequestReady('claude-code'),
+    defaultProvider: settingsManager.getDefaultProvider(),
+})) {
     const currentModelId = settingsManager.getDefaultModel();
     if (currentModelId) {
         const ccModel = modelRegistry.find('claude-code', currentModelId);

package/dist/headless-events.d.ts

@@ -43,6 +43,8 @@ export declare const NEW_MILESTONE_IDLE_TIMEOUT_MS = 120000;
 export declare function isTerminalNotification(event: Record<string, unknown>): boolean;
 export declare function isBlockedNotification(event: Record<string, unknown>): boolean;
 export declare function isMilestoneReadyNotification(event: Record<string, unknown>): boolean;
+export declare function isInteractiveHeadlessTool(toolName: string | undefined): boolean;
+export declare function shouldArmHeadlessIdleTimeout(toolCallCount: number, interactiveToolCount: number): boolean;
 export declare const FIRE_AND_FORGET_METHODS: Set<string>;
 export declare const QUICK_COMMANDS: Set<string>;
 export declare function isQuickCommand(command: string): boolean;

package/dist/headless-events.js

@@ -65,6 +65,7 @@ export const IDLE_TIMEOUT_MS = 15_000;
 // between tool calls (e.g. after mkdir, before writing files). Use a
 // longer idle timeout to avoid killing the session prematurely (#808).
 export const NEW_MILESTONE_IDLE_TIMEOUT_MS = 120_000;
+const INTERACTIVE_HEADLESS_TOOLS = new Set(['ask_user_questions', 'secure_env_collect']);
 export function isTerminalNotification(event) {
     if (event.type !== 'extension_ui_request' || event.method !== 'notify')
         return false;
@@ -83,6 +84,12 @@ export function isMilestoneReadyNotification(event) {
         return false;
     return /milestone\s+m\d+.*ready/i.test(String(event.message ?? ''));
 }
+export function isInteractiveHeadlessTool(toolName) {
+    return INTERACTIVE_HEADLESS_TOOLS.has(String(toolName ?? ''));
+}
+export function shouldArmHeadlessIdleTimeout(toolCallCount, interactiveToolCount) {
+    return toolCallCount > 0 && interactiveToolCount === 0;
+}
 // ---------------------------------------------------------------------------
 // Quick Command Detection
 // ---------------------------------------------------------------------------

package/dist/headless.js

@@ -17,7 +17,7 @@ import { resolve } from 'node:path';
 import { RpcClient, SessionManager } from '@gsd/pi-coding-agent';
 import { getProjectSessionsDir } from './project-sessions.js';
 import { loadAndValidateAnswerFile, AnswerInjector } from './headless-answers.js';
-import { isTerminalNotification, isBlockedNotification, isMilestoneReadyNotification, isQuickCommand, FIRE_AND_FORGET_METHODS, IDLE_TIMEOUT_MS, NEW_MILESTONE_IDLE_TIMEOUT_MS, EXIT_SUCCESS, EXIT_ERROR, EXIT_BLOCKED, EXIT_CANCELLED, mapStatusToExitCode, } from './headless-events.js';
+import { isTerminalNotification, isBlockedNotification, isMilestoneReadyNotification, isQuickCommand, FIRE_AND_FORGET_METHODS, IDLE_TIMEOUT_MS, NEW_MILESTONE_IDLE_TIMEOUT_MS, isInteractiveHeadlessTool, shouldArmHeadlessIdleTimeout, EXIT_SUCCESS, EXIT_ERROR, EXIT_BLOCKED, EXIT_CANCELLED, mapStatusToExitCode, } from './headless-events.js';
 import { VALID_OUTPUT_FORMATS } from './headless-types.js';
 import { handleExtensionUIRequest, formatProgress, formatThinkingLine, formatTextStart, formatTextEnd, formatThinkingStart, formatThinkingEnd, startSupervisedStdinReader, } from './headless-ui.js';
 import { loadContext, bootstrapGsdProject, } from './headless-context.js';
@@ -282,6 +282,7 @@ async function runHeadlessOnce(options, restartCount) {
     let exitCode = 0;
     let milestoneReady = false; // tracks "Milestone X ready." for auto-chaining
     const recentEvents = [];
+    const interactiveToolCallIds = new Set();
     // JSON batch mode: cost aggregation (cumulative-max pattern per K004)
     let cumulativeCostUsd = 0;
     let cumulativeInputTokens = 0;
@@ -365,7 +366,7 @@ async function runHeadlessOnce(options, restartCount) {
     function resetIdleTimer() {
         if (idleTimer)
             clearTimeout(idleTimer);
-        if (toolCallCount > 0) {
+        if (shouldArmHeadlessIdleTimeout(toolCallCount, interactiveToolCallIds.size)) {
             idleTimer = setTimeout(() => {
                 completed = true;
                 resolveCompletion();
@@ -386,13 +387,25 @@ async function runHeadlessOnce(options, restartCount) {
     client.onEvent((event) => {
         const eventObj = event;
         trackEvent(eventObj);
+        const eventType = String(eventObj.type ?? '');
+        if (eventType === 'tool_execution_start') {
+            const toolCallId = String(eventObj.toolCallId ?? eventObj.id ?? '');
+            if (toolCallId && isInteractiveHeadlessTool(String(eventObj.toolName ?? ''))) {
+                interactiveToolCallIds.add(toolCallId);
+            }
+        }
+        else if (eventType === 'tool_execution_end') {
+            const toolCallId = String(eventObj.toolCallId ?? eventObj.id ?? '');
+            if (toolCallId) {
+                interactiveToolCallIds.delete(toolCallId);
+            }
+        }
         resetIdleTimer();
         // Answer injector: observe events for question metadata
         injector?.observeEvent(eventObj);
         // --json / --output-format stream-json: forward events as JSONL to stdout (filtered if --events)
         // --output-format json (batch mode): suppress streaming, track cost for final result
         if (options.json && options.outputFormat === 'stream-json') {
-            const eventType = String(eventObj.type ?? '');
             if (!options.eventFilter || options.eventFilter.has(eventType)) {
                 process.stdout.write(JSON.stringify(eventObj) + '\n');
             }

package/dist/mcp-server.js

@@ -1,10 +1,10 @@
 // MCP SDK subpath imports use wildcard exports (./*) that NodeNext resolves
 // at runtime but TypeScript cannot statically type-check. We construct the
 // specifiers dynamically so tsc treats them as `any`.
-// Use createRequire to resolve wildcard subpaths — CJS resolver auto-appends
-// .js, which the ESM wildcard export map does not (#3603).
-import { createRequire } from 'node:module';
-const _require = createRequire(import.meta.url);
+//
+// Use explicit .js subpaths for modules that are loaded dynamically at runtime.
+// Recent Node / SDK combinations do not reliably resolve the extensionless
+// wildcard targets for `server/stdio` and `types` (#3914).
 const MCP_PKG = '@modelcontextprotocol/sdk';
 /**
  * Starts a native MCP (Model Context Protocol) server over stdin/stdout.
@@ -23,8 +23,8 @@ const MCP_PKG = '@modelcontextprotocol/sdk';
 export async function startMcpServer(options) {
     const { tools, version = '0.0.0' } = options;
     const serverMod = await import(`${MCP_PKG}/server`);
-    const stdioMod = await import(_require.resolve(`${MCP_PKG}/server/stdio`));
-    const typesMod = await import(_require.resolve(`${MCP_PKG}/types`));
+    const stdioMod = await import(`${MCP_PKG}/server/stdio.js`);
+    const typesMod = await import(`${MCP_PKG}/types.js`);
     const Server = serverMod.Server;
     const StdioServerTransport = stdioMod.StdioServerTransport;
     const { ListToolsRequestSchema, CallToolRequestSchema } = typesMod;

package/dist/provider-migrations.d.ts

@@ -0,0 +1,10 @@
+import type { AuthStorage } from "@gsd/pi-coding-agent";
+type AnthropicMigrationDeps = {
+    authStorage: Pick<AuthStorage, "getCredentialsForProvider">;
+    isClaudeCodeReady: boolean;
+    defaultProvider: string | undefined;
+    env?: NodeJS.ProcessEnv;
+};
+export declare function hasDirectAnthropicApiKey(authStorage: Pick<AuthStorage, "getCredentialsForProvider">, env?: NodeJS.ProcessEnv): boolean;
+export declare function shouldMigrateAnthropicToClaudeCode({ authStorage, isClaudeCodeReady, defaultProvider, env, }: AnthropicMigrationDeps): boolean;
+export {};

package/dist/provider-migrations.js

@@ -0,0 +1,12 @@
+export function hasDirectAnthropicApiKey(authStorage, env = process.env) {
+    if ((env.ANTHROPIC_API_KEY ?? "").trim()) {
+        return true;
+    }
+    return authStorage.getCredentialsForProvider("anthropic").some((credential) => credential?.type === "api_key" && typeof credential?.key === "string" && credential.key.trim().length > 0);
+}
+export function shouldMigrateAnthropicToClaudeCode({ authStorage, isClaudeCodeReady, defaultProvider, env = process.env, }) {
+    if (!isClaudeCodeReady || defaultProvider !== "anthropic") {
+        return false;
+    }
+    return !hasDirectAnthropicApiKey(authStorage, env);
+}

package/dist/resource-loader.js

@@ -2,7 +2,7 @@ import { DefaultResourceLoader, sortExtensionPaths } from '@gsd/pi-coding-agent'
 import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { chmodSync, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, closeSync, readFileSync, readlinkSync, readdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
-import { dirname, join, relative, resolve } from 'node:path';
+import { basename, dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { compareSemver } from './update-check.js';
 import { discoverExtensionEntryPaths } from './extension-discovery.js';
@@ -254,34 +254,160 @@ function copyDirRecursive(src, dest) {
  * ~/.gsd/agent/extensions/ have no ancestor node_modules, so imports of
  * @gsd/* packages fail. The symlink makes Node's standard resolution find
  * them without requiring every call site to use jiti.
+ *
+ * Layout differences by install method:
+ * - Source/monorepo: packageRoot/node_modules has everything → simple symlink
+ * - npm/bun global: deps hoisted to dirname(packageRoot), including @gsd/* → simple symlink
+ * - pnpm global: external deps hoisted, but @gsd/* stays in packageRoot/node_modules
+ *   → merged directory with symlinks from both roots (#3529, #3564)
  */
 function ensureNodeModulesSymlink(agentDir) {
     const agentNodeModules = join(agentDir, 'node_modules');
-    const gsdNodeModules = join(packageRoot, 'node_modules');
+    const internalNodeModules = join(packageRoot, 'node_modules');
+    const hoistedNodeModules = dirname(packageRoot);
+    const isGlobalInstall = basename(hoistedNodeModules) === 'node_modules';
+    if (!isGlobalInstall) {
+        // Source/monorepo: internal node_modules has everything
+        reconcileSymlink(agentNodeModules, internalNodeModules);
+        return;
+    }
+    // Global install: check if workspace scopes (@gsd/*) are hoisted.
+    // npm/bun hoist everything; pnpm keeps workspace packages internal.
+    if (!hasMissingWorkspaceScopes(hoistedNodeModules, internalNodeModules)) {
+        // Everything is hoisted — simple symlink to parent node_modules
+        reconcileSymlink(agentNodeModules, hoistedNodeModules);
+        return;
+    }
+    // pnpm-style layout: create a real directory merging both roots
+    reconcileMergedNodeModules(agentNodeModules, hoistedNodeModules, internalNodeModules);
+}
+/** Check if any @gsd* scopes exist in internal but not in hoisted node_modules */
+function hasMissingWorkspaceScopes(hoisted, internal) {
+    if (!existsSync(internal))
+        return false;
     try {
-        const stat = lstatSync(agentNodeModules);
+        for (const entry of readdirSync(internal, { withFileTypes: true })) {
+            if (entry.isDirectory() && entry.name.startsWith('@gsd') &&
+                !existsSync(join(hoisted, entry.name))) {
+                return true;
+            }
+        }
+    }
+    catch { /* non-fatal */ }
+    return false;
+}
+/** Ensure a symlink at `link` points to `target`, fixing stale/wrong entries */
+function reconcileSymlink(link, target) {
+    try {
+        const stat = lstatSync(link);
         if (stat.isSymbolicLink()) {
-            const existing = readlinkSync(agentNodeModules);
-            // Symlink exists — verify it points to the correct, existing target
-            if (existing === gsdNodeModules && existsSync(agentNodeModules))
+            const existing = readlinkSync(link);
+            if (existing === target && existsSync(link))
                 return; // correct and target exists
-            // Stale or wrong target — remove and recreate
+            unlinkSync(link);
+        }
+        else {
+            // Real directory (or merged dir from previous pnpm fix) — remove it
+            rmSync(link, { recursive: true, force: true });
+        }
+    }
+    catch {
+        // lstatSync throws if path doesn't exist — fine, we'll create below
+    }
+    try {
+        symlinkSync(target, link, 'junction');
+    }
+    catch (err) {
+        console.error(`[gsd] WARN: Failed to symlink ${link} → ${target}: ${err instanceof Error ? err.message : err}`);
+    }
+}
+/**
+ * Create a real node_modules directory containing symlinks from both the
+ * hoisted root (external deps) and internal root (@gsd/* workspace packages).
+ * Used for pnpm global installs where @gsd/* isn't hoisted.
+ */
+function reconcileMergedNodeModules(agentNodeModules, hoisted, internal) {
+    // Fast path: if already merged for this packageRoot + same directory contents, skip.
+    // The fingerprint includes entry names from both roots so `pnpm add/remove` triggers rebuild.
+    const marker = join(agentNodeModules, '.gsd-merged');
+    const fingerprint = mergedFingerprint(hoisted, internal);
+    try {
+        if (existsSync(marker) && readFileSync(marker, 'utf-8').trim() === fingerprint)
+            return;
+    }
+    catch { /* rebuild */ }
+    // Remove any existing symlink or stale merged directory
+    try {
+        const stat = lstatSync(agentNodeModules);
+        if (stat.isSymbolicLink()) {
             unlinkSync(agentNodeModules);
         }
         else {
-            // Real directory (not a symlink) is blocking — remove it
             rmSync(agentNodeModules, { recursive: true, force: true });
         }
     }
-    catch {
-        // lstatSync throws if path doesn't exist — that's fine, we'll create below
+    catch { /* doesn't exist */ }
+    mkdirSync(agentNodeModules, { recursive: true });
+    let linkedCount = 0;
+    // Symlink entries from the hoisted node_modules (external deps)
+    try {
+        for (const entry of readdirSync(hoisted, { withFileTypes: true })) {
+            // Skip the gsd-pi package itself and dotfiles
+            if (entry.name === basename(packageRoot))
+                continue;
+            if (entry.name.startsWith('.'))
+                continue;
+            try {
+                symlinkSync(join(hoisted, entry.name), join(agentNodeModules, entry.name));
+                linkedCount++;
+            }
+            catch { /* skip individual */ }
+        }
     }
+    catch (err) {
+        console.error(`[gsd] WARN: Failed to read hoisted node_modules at ${hoisted}: ${err instanceof Error ? err.message : err}`);
+    }
+    // Overlay internal node_modules entries that weren't hoisted.
+    // This covers @gsd/* workspace packages AND optional deps like
+    // @anthropic-ai/claude-agent-sdk that npm keeps internal.
     try {
-        symlinkSync(gsdNodeModules, agentNodeModules, 'junction');
+        for (const entry of readdirSync(internal, { withFileTypes: true })) {
+            if (entry.name.startsWith('.'))
+                continue;
+            const link = join(agentNodeModules, entry.name);
+            // Replace hoisted symlink with internal version (internal takes precedence)
+            try {
+                lstatSync(link);
+                unlinkSync(link);
+            }
+            catch { /* didn't exist — will create below */ }
+            try {
+                symlinkSync(join(internal, entry.name), link);
+                linkedCount++;
+            }
+            catch { /* skip individual */ }
+        }
     }
     catch (err) {
-        // This failure makes GSD non-functional — extensions can't resolve @gsd/* packages
-        console.error(`[gsd] WARN: Failed to symlink ${agentNodeModules} → ${gsdNodeModules}: ${err instanceof Error ? err.message : err}`);
+        console.error(`[gsd] WARN: Failed to read internal node_modules at ${internal}: ${err instanceof Error ? err.message : err}`);
+    }
+    // Only stamp marker if we actually linked something — avoids caching a broken state
+    if (linkedCount > 0) {
+        try {
+            writeFileSync(marker, fingerprint);
+        }
+        catch { /* non-fatal */ }
+    }
+}
+/** Build a cache fingerprint from packageRoot + sorted entry names of both directories */
+function mergedFingerprint(hoisted, internal) {
+    try {
+        const h = readdirSync(hoisted).sort().join(',');
+        const i = readdirSync(internal).sort().join(',');
+        return `${packageRoot}\n${h}\n${i}`;
+    }
+    catch {
+        return packageRoot; // fallback: at least invalidate on version change
     }
 }
 /**

package/dist/resources/GSD-WORKFLOW.md

@@ -275,7 +275,7 @@ Work flows through these phases. Each phase produces a file.
 **How to do it manually:**
 1. Read the roadmap to understand the scope.
 2. Identify 3-5 gray areas — implementation decisions the user cares about.
-3. Use `ask_user_questions` to discuss each area.
+3. Use `ask_user_questions` to discuss each area, one round at a time. Never fabricate user input; wait for the user's actual response before the next round.
 4. Write decisions to the appropriate context file (`M###-CONTEXT.md` or `S##-CONTEXT.md`).
 5. Do NOT discuss how to implement — only what the user wants.
 

package/dist/resources/extensions/claude-code-cli/stream-adapter.js

@@ -29,6 +29,15 @@ function createAssistantStream() {
         throw new Error("Unexpected event type for final result");
     });
 }
+export function getResultErrorMessage(result) {
+    if ("errors" in result && Array.isArray(result.errors) && result.errors.length > 0) {
+        return result.errors.join("; ");
+    }
+    if ("result" in result && typeof result.result === "string" && result.result.trim().length > 0) {
+        return result.result.trim();
+    }
+    return result.subtype === "success" ? "claude_code_request_failed" : result.subtype;
+}
 // ---------------------------------------------------------------------------
 // Claude binary resolution
 // ---------------------------------------------------------------------------
@@ -666,10 +675,7 @@ async function pumpSdkMessages(model, context, options, stream) {
                         timestamp: Date.now(),
                     };
                     if (result.is_error) {
-                        const errText = "errors" in result
-                            ? result.errors?.join("; ")
-                            : result.subtype;
-                        finalMessage.errorMessage = errText;
+                        finalMessage.errorMessage = getResultErrorMessage(result);
                         stream.push({ type: "error", reason: "error", error: finalMessage });
                     }
                     else {

package/dist/resources/extensions/gsd/auto/infra-errors.js

@@ -47,3 +47,37 @@ export function isInfrastructureError(err) {
         return "SQLITE_CORRUPT";
     return null;
 }
+/**
+ * Default wait duration when a cooldown error is detected but no specific
+ * expiry is available from AuthStorage (e.g., error propagated across
+ * process boundary without structured backoff data).
+ */
+export const COOLDOWN_FALLBACK_WAIT_MS = 35_000; // 35s — slightly longer than the 30s rate-limit backoff
+/** Maximum consecutive cooldown retries before the auto-loop gives up. */
+export const MAX_COOLDOWN_RETRIES = 5;
+/**
+ * Detect whether an error is a transient credential cooldown that should
+ * be waited out rather than counted as a consecutive failure.
+ *
+ * Prefers the structured `CredentialCooldownError` (code: AUTH_COOLDOWN)
+ * thrown by sdk.ts. Falls back to message matching for errors that
+ * propagated across process boundaries without the typed class.
+ */
+export function isTransientCooldownError(err) {
+    if (err && typeof err === "object" && err.code === "AUTH_COOLDOWN") {
+        return true;
+    }
+    // Fallback: message match for cross-process error propagation
+    const msg = err instanceof Error ? err.message : String(err);
+    return /in a cooldown window/i.test(msg);
+}
+/**
+ * Extract retryAfterMs from a CredentialCooldownError, if available.
+ * Returns undefined for unstructured errors or when no retry hint exists.
+ */
+export function getCooldownRetryAfterMs(err) {
+    if (err && typeof err === "object" && err.code === "AUTH_COOLDOWN") {
+        return err.retryAfterMs;
+    }
+    return undefined;
+}

package/dist/resources/extensions/gsd/auto/loop.js

@@ -11,7 +11,7 @@ import { MAX_LOOP_ITERATIONS, } from "./types.js";
 import { _clearCurrentResolve } from "./resolve.js";
 import { runPreDispatch, runDispatch, runGuards, runUnitPhase, runFinalize, } from "./phases.js";
 import { debugLog } from "../debug-logger.js";
-import { isInfrastructureError } from "./infra-errors.js";
+import { isInfrastructureError, isTransientCooldownError, getCooldownRetryAfterMs, COOLDOWN_FALLBACK_WAIT_MS, MAX_COOLDOWN_RETRIES } from "./infra-errors.js";
 import { resolveEngine } from "../engine-resolver.js";
 /**
  * Main auto-mode execution loop. Iterates: derive → dispatch → guards →
@@ -26,6 +26,7 @@ export async function autoLoop(ctx, pi, s, deps) {
     let iteration = 0;
     const loopState = { recentUnits: [], stuckRecoveryAttempts: 0, consecutiveFinalizeTimeouts: 0 };
     let consecutiveErrors = 0;
+    let consecutiveCooldowns = 0;
     const recentErrorMessages = [];
     while (s.active) {
         iteration++;
@@ -158,6 +159,7 @@ export async function autoLoop(ctx, pi, s, deps) {
                 });
                 deps.clearUnitTimeout();
                 consecutiveErrors = 0;
+                consecutiveCooldowns = 0;
                 recentErrorMessages.length = 0;
                 deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
                 debugLog("autoLoop", { phase: "iteration-complete", iteration });
@@ -220,6 +222,7 @@ export async function autoLoop(ctx, pi, s, deps) {
             if (finalizeResult.action === "continue")
                 continue;
             consecutiveErrors = 0; // Iteration completed successfully
+            consecutiveCooldowns = 0;
             recentErrorMessages.length = 0;
             deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
             debugLog("autoLoop", { phase: "iteration-complete", iteration });
@@ -246,6 +249,34 @@ export async function autoLoop(ctx, pi, s, deps) {
                 await deps.stopAuto(ctx, pi, `Infrastructure error (${infraCode}): not recoverable by retry`);
                 break;
             }
+            // ── Credential cooldown: wait and retry with bounded budget ──
+            // A 429 triggers a 30s credential backoff in AuthStorage. If the SDK's
+            // getApiKey() retries couldn't outlast the window, the error surfaces
+            // here. Wait for the cooldown to clear rather than counting it as a
+            // consecutive failure — but cap retries so we don't spin for hours
+            // on persistent quota exhaustion.
+            if (isTransientCooldownError(loopErr)) {
+                consecutiveCooldowns++;
+                const retryAfterMs = getCooldownRetryAfterMs(loopErr);
+                debugLog("autoLoop", {
+                    phase: "cooldown-wait",
+                    iteration,
+                    consecutiveCooldowns,
+                    retryAfterMs,
+                    error: msg,
+                });
+                if (consecutiveCooldowns > MAX_COOLDOWN_RETRIES) {
+                    ctx.ui.notify(`Auto-mode stopped: ${consecutiveCooldowns} consecutive credential cooldowns — rate limit or quota may be persistently exhausted.`, "error");
+                    await deps.stopAuto(ctx, pi, `${consecutiveCooldowns} consecutive credential cooldowns exceeded retry budget`);
+                    break;
+                }
+                const waitMs = (retryAfterMs !== undefined && retryAfterMs > 0 && retryAfterMs <= 60_000)
+                    ? retryAfterMs + 500 // Use structured hint + small buffer
+                    : COOLDOWN_FALLBACK_WAIT_MS;
+                ctx.ui.notify(`Credentials in cooldown (${consecutiveCooldowns}/${MAX_COOLDOWN_RETRIES}) — waiting ${Math.round(waitMs / 1000)}s before retrying.`, "warning");
+                await new Promise(resolve => setTimeout(resolve, waitMs));
+                continue; // Retry iteration without incrementing consecutiveErrors
+            }
             consecutiveErrors++;
             recentErrorMessages.push(msg.length > 120 ? msg.slice(0, 120) + "..." : msg);
             debugLog("autoLoop", {

package/dist/resources/extensions/gsd/auto/phases.js

@@ -857,7 +857,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         logWarning("engine", "Prompt reorder failed", { error: msg });
     }
     // Select and apply model (with tier escalation on retry — normal units only)
-    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier });
+    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride);
     s.currentUnitRouting =
         modelResult.routing;
     s.currentUnitModel =

package/dist/resources/extensions/gsd/auto/session.js

@@ -36,6 +36,10 @@ export class AutoSession {
     previousProjectRootEnv = null;
     hadProjectRootEnv = false;
     projectRootEnvCaptured = false;
+    previousMilestoneLockEnv = null;
+    hadMilestoneLockEnv = false;
+    milestoneLockEnvCaptured = false;
+    sessionMilestoneLock = null;
     gitService = null;
     // ── Dispatch counters ────────────────────────────────────────────────────
     unitDispatchCount = new Map();
@@ -52,6 +56,8 @@ export class AutoSession {
     currentMilestoneId = null;
     // ── Model state ──────────────────────────────────────────────────────────
     autoModeStartModel = null;
+    /** Explicit /gsd model pin captured at bootstrap (session-scoped policy override). */
+    manualSessionModelOverride = null;
     currentUnitModel = null;
     /** Fully-qualified model ID (provider/id) set after selectAndApplyModel + hook overrides (#2899). */
     currentDispatchedModelId = null;
@@ -140,6 +146,10 @@ export class AutoSession {
         this.previousProjectRootEnv = null;
         this.hadProjectRootEnv = false;
         this.projectRootEnvCaptured = false;
+        this.previousMilestoneLockEnv = null;
+        this.hadMilestoneLockEnv = false;
+        this.milestoneLockEnvCaptured = false;
+        this.sessionMilestoneLock = null;
         this.gitService = null;
         // Dispatch
         this.unitDispatchCount.clear();
@@ -151,6 +161,7 @@ export class AutoSession {
         this.currentMilestoneId = null;
         // Model
         this.autoModeStartModel = null;
+        this.manualSessionModelOverride = null;
         this.currentUnitModel = null;
         this.currentDispatchedModelId = null;
         this.originalModelId = null;

package/dist/resources/extensions/gsd/auto-dashboard.js

@@ -10,7 +10,6 @@ import { getActiveHook } from "./post-unit-hooks.js";
 import { getLedger, getProjectTotals } from "./metrics.js";
 import { getErrorMessage } from "./error-utils.js";
 import { isDbAvailable, getMilestoneSlices, getSliceTasks } from "./gsd-db.js";
-import { formatShortcut } from "./files.js";
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { truncateToWidth, visibleWidth } from "@gsd/pi-tui";
@@ -23,6 +22,7 @@ import { resolveServiceTierIcon, getEffectiveServiceTier } from "./service-tier.
 import { parseUnitId } from "./unit-id.js";
 import { formatRtkSavingsLabel, getRtkSessionSavings, } from "../shared/rtk-session-stats.js";
 import { logWarning } from "./workflow-logger.js";
+import { formattedShortcutPair } from "./shortcut-defs.js";
 // ─── UAT Slice Extraction ─────────────────────────────────────────────────────
 /**
  * Extract the target slice ID from a run-uat unit ID (e.g. "M001/S01" → "S01").
@@ -282,12 +282,23 @@ function getLastCommit(basePath) {
 }
 // ─── Footer Factory ───────────────────────────────────────────────────────────
 /**
- * Footer factory that renders zero lines — hides the built-in footer entirely.
- * All footer info (pwd, branch, tokens, cost, model) is shown inside the
- * progress widget instead, so there's no gap or redundancy.
+ * Footer factory used by auto-mode.
+ * Keep footer minimal but preserve extension status context from setStatus().
  */
-export const hideFooter = () => ({
-    render(_width) { return []; },
+function sanitizeFooterStatus(text) {
+    return text.replace(/\s+/g, " ").trim();
+}
+export const hideFooter = (_tui, theme, footerData) => ({
+    render(width) {
+        const extensionStatuses = footerData.getExtensionStatuses();
+        if (extensionStatuses.size === 0)
+            return [];
+        const statusLine = Array.from(extensionStatuses.entries())
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([, text]) => sanitizeFooterStatus(text))
+            .join(" ");
+        return [truncateToWidth(theme.fg("dim", statusLine), width, theme.fg("dim", "..."))];
+    },
     invalidate() { },
     dispose() { },
 });
@@ -522,13 +533,6 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                         : theme.fg("dim", elapsed))
                     : "";
                 lines.push(rightAlign(headerLeft, headerRight, width));
-                // Worktree/branch right-aligned below header
-                const branchLabel = worktreeName && cachedBranch
-                    ? `${worktreeName} (${cachedBranch})`
-                    : cachedBranch ?? "";
-                if (branchLabel) {
-                    lines.push(rightAlign("", theme.fg("dim", branchLabel), width));
-                }
                 // Show health signal details when degraded (yellow/red)
                 if (score.level !== "green" && score.signals.length > 0 && widgetMode !== "min") {
                     // Show up to 3 most relevant signals in compact form
@@ -776,16 +780,18 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                 // Hints line
                 const hintParts = [];
                 hintParts.push("esc pause");
-                hintParts.push(`${formatShortcut("Ctrl+Alt+G")} dashboard`);
+                hintParts.push(`${formattedShortcutPair("dashboard")} dashboard`);
+                hintParts.push(`${formattedShortcutPair("parallel")} parallel`);
                 const hintStr = theme.fg("dim", hintParts.join(" | "));
                 const commitStr = lastCommit
                     ? theme.fg("dim", `${lastCommit.timeAgo} ago: ${commitMsg}`)
                     : "";
+                const locationStr = theme.fg("dim", widgetPwd);
                 if (commitStr) {
-                    lines.push(rightAlign(`${pad}${commitStr}`, hintStr, width));
+                    lines.push(rightAlign(`${pad}${locationStr} · ${commitStr}`, hintStr, width));
                 }
                 else {
-                    lines.push(rightAlign("", hintStr, width));
+                    lines.push(rightAlign(`${pad}${locationStr}`, hintStr, width));
                 }
                 lines.push(...ui.bar());
                 cachedLines = lines;