gsd-pi 2.73.0-dev.e1c09f2 → 2.73.1-dev.088d28f

package/src/resources/extensions/gsd/preferences-models.ts

@@ -7,6 +7,8 @@
  */
 
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import type { DynamicRoutingConfig } from "./model-router.js";
 import { defaultRoutingConfig } from "./model-router.js";
 import type { TokenProfile, InlineLevel } from "./types.js";
@@ -185,6 +187,45 @@ export function resolveDefaultSessionModel(
   return undefined;
 }
 
+/**
+ * Returns true if `provider` is defined as a custom provider in the user's
+ * `~/.gsd/agent/models.json` (Ollama, vLLM, LM Studio, OpenAI-compatible
+ * proxies, etc.).
+ *
+ * Used by auto-mode bootstrap to decide whether the session model
+ * (set via `/gsd model`) should override `PREFERENCES.md`.  Custom providers
+ * are never reachable from `PREFERENCES.md` (which only knows built-in
+ * providers), so when the user has explicitly selected one, it must take
+ * priority — otherwise auto-mode tries to start the built-in provider from
+ * PREFERENCES.md and fails with "Not logged in · Please run /login" (#4122).
+ *
+ * Reads models.json directly with a lightweight JSON parse to avoid
+ * pulling in the full model-registry at this call site.  Falls back to
+ * `~/.pi/agent/models.json` for parity with `resolveModelsJsonPath()`.
+ * Any read or parse error yields `false` (treat as not-custom) so a
+ * malformed models.json never breaks the session bootstrap.
+ */
+export function isCustomProvider(provider: string | undefined): boolean {
+  if (!provider) return false;
+  const candidates = [
+    join(homedir(), ".gsd", "agent", "models.json"),
+    join(homedir(), ".pi", "agent", "models.json"),
+  ];
+  for (const path of candidates) {
+    if (!existsSync(path)) continue;
+    try {
+      const raw = readFileSync(path, "utf-8");
+      const parsed = JSON.parse(raw) as { providers?: Record<string, unknown> };
+      if (parsed?.providers && Object.prototype.hasOwnProperty.call(parsed.providers, provider)) {
+        return true;
+      }
+    } catch {
+      // Ignore — malformed models.json must not break bootstrap.
+    }
+  }
+  return false;
+}
+
 /**
  * Determines the next fallback model to try when the current model fails.
  * If the current model is not in the configured list, returns the primary model.

package/src/resources/extensions/gsd/preferences-types.ts

@@ -113,6 +113,7 @@ export const KNOWN_PREFERENCE_KEYS = new Set<string>([
   "discuss_preparation",
   "discuss_web_research",
   "discuss_depth",
+  "flat_rate_providers",
 ]);
 
 /** Canonical list of all dispatch unit types. */
@@ -359,6 +360,17 @@ export interface GSDPreferences {
    * Default: "standard".
    */
   discuss_depth?: "quick" | "standard" | "thorough";
+  /**
+   * Extra provider IDs to treat as flat-rate (no cost benefit from dynamic
+   * routing).  Dynamic routing is suppressed for any provider listed here,
+   * in addition to the built-in list (github-copilot, copilot, claude-code)
+   * and any provider auto-detected via `authMode: "externalCli"`.
+   *
+   * Intended for private subscription-backed proxies, enterprise-gated
+   * deployments, and custom CLI wrappers where every request costs the
+   * same regardless of model.  Case-insensitive.
+   */
+  flat_rate_providers?: string[];
 }
 
 export interface LoadedGSDPreferences {

package/src/resources/extensions/gsd/preferences-validation.ts

@@ -180,6 +180,29 @@ export function validatePreferences(preferences: GSDPreferences): {
     }
   }
 
+  // ─── Flat-rate Providers ────────────────────────────────────────────
+  // User-declared flat-rate providers for dynamic routing suppression.
+  // Built-in providers (github-copilot, copilot, claude-code) and any
+  // externalCli provider are already auto-detected; this list layers on
+  // top for private subscription proxies and custom CLI wrappers.
+  if (preferences.flat_rate_providers !== undefined) {
+    if (Array.isArray(preferences.flat_rate_providers)) {
+      const allStrings = preferences.flat_rate_providers.every(
+        (item: unknown) => typeof item === "string",
+      );
+      if (allStrings) {
+        // Strip empty/whitespace-only entries to avoid false matches.
+        validated.flat_rate_providers = preferences.flat_rate_providers
+          .map((s: string) => s.trim())
+          .filter((s: string) => s.length > 0);
+      } else {
+        errors.push("flat_rate_providers must be an array of strings");
+      }
+    } else {
+      errors.push("flat_rate_providers must be an array of strings");
+    }
+  }
+
   // ─── Phase Skip Preferences ─────────────────────────────────────────
   if (preferences.phases !== undefined) {
     if (typeof preferences.phases === "object" && preferences.phases !== null) {

package/src/resources/extensions/gsd/state.ts

@@ -630,13 +630,39 @@ function resolveSliceDependencies(activeMilestoneSlices: SliceRow[]): { activeSl
     }
   }
 
+  // First pass: find a slice with ALL dependencies satisfied (strict)
+  let bestFallback: SliceRow | null = null;
+  let bestFallbackSatisfied = -1;
+
   for (const s of activeMilestoneSlices) {
     if (isStatusDone(s.status)) continue;
     if (isDeferredStatus(s.status)) continue;
     if (s.depends.every(dep => doneSliceIds.has(dep))) {
       return { activeSlice: { id: s.id, title: s.title }, activeSliceRow: s };
     }
+    // Track the slice with the most satisfied dependencies as fallback
+    const satisfied = s.depends.filter(dep => doneSliceIds.has(dep)).length;
+    if (satisfied > bestFallbackSatisfied || (satisfied === bestFallbackSatisfied && !bestFallback)) {
+      bestFallback = s;
+      bestFallbackSatisfied = satisfied;
+    }
   }
+
+  // Fallback: if no slice has all deps met but there ARE incomplete non-deferred
+  // slices, pick the one with the most deps satisfied. This prevents hard-blocking
+  // when dependency metadata is stale (e.g. after reassessment added/removed slices)
+  // or when deps reference slices from previous milestones.
+  if (bestFallback) {
+    const unmet = bestFallback.depends.filter(dep => !doneSliceIds.has(dep));
+    logWarning("state",
+      `No slice has all deps satisfied — falling back to ${bestFallback.id} ` +
+      `(${bestFallbackSatisfied}/${bestFallback.depends.length} deps met, ` +
+      `unmet: ${unmet.join(", ")})`,
+      { mid: activeMilestoneSlices[0]?.milestone_id, sid: bestFallback.id },
+    );
+    return { activeSlice: { id: bestFallback.id, title: bestFallback.title }, activeSliceRow: bestFallback };
+  }
+
   return { activeSlice: null, activeSliceRow: null };
 }
 
@@ -1431,12 +1457,32 @@ export async function _deriveStateImpl(basePath: string): Promise<GSDState> {
       };
     }
   } else {
+    let bestFallbackLegacy: { id: string; title: string; depends: string[] } | null = null;
+    let bestFallbackLegacySatisfied = -1;
+
     for (const s of activeRoadmap.slices) {
       if (s.done) continue;
       if (s.depends.every(dep => doneSliceIds.has(dep))) {
         activeSlice = { id: s.id, title: s.title };
         break;
       }
+      // Track best fallback
+      const satisfied = s.depends.filter(dep => doneSliceIds.has(dep)).length;
+      if (satisfied > bestFallbackLegacySatisfied) {
+        bestFallbackLegacy = s;
+        bestFallbackLegacySatisfied = satisfied;
+      }
+    }
+
+    // Fallback: if no slice has all deps met, pick the one with the most deps satisfied
+    if (!activeSlice && bestFallbackLegacy) {
+      const unmet = bestFallbackLegacy.depends.filter(dep => !doneSliceIds.has(dep));
+      logWarning("state",
+        `No slice has all deps satisfied — falling back to ${bestFallbackLegacy.id} ` +
+        `(${bestFallbackLegacySatisfied}/${bestFallbackLegacy.depends.length} deps met, ` +
+        `unmet: ${unmet.join(", ")})`,
+      );
+      activeSlice = { id: bestFallbackLegacy.id, title: bestFallbackLegacy.title };
     }
   }
 

package/src/resources/extensions/gsd/tests/auto-loop.test.ts

@@ -688,8 +688,8 @@ test("autoLoop exits on terminal blocked state", async (t) => {
 
   assert.ok(deps.callLog.includes("deriveState"), "should have derived state");
   assert.ok(
-    deps.callLog.includes("stopAuto"),
-    "should have called stopAuto for blocked state",
+    deps.callLog.includes("pauseAuto"),
+    "should have called pauseAuto for blocked state",
   );
   assert.ok(
     !deps.callLog.includes("resolveDispatch"),

package/src/resources/extensions/gsd/tests/auto-start-model-capture.test.ts

@@ -33,8 +33,12 @@ test("bootstrapAutoSession checks manual session override before preferences", (
   assert.ok(manualIdx > -1, "auto-start.ts should read session model override first");
 
   // resolveDefaultSessionModel() should still be called for fallback behavior
-  const preferredIdx = source.indexOf("const preferredModel = resolveDefaultSessionModel(");
-  assert.ok(preferredIdx > -1, "auto-start.ts should call resolveDefaultSessionModel()");
+  const preferredIdx = source.indexOf("const preferredModel = ");
+  assert.ok(preferredIdx > -1, "auto-start.ts should build preferredModel");
+  assert.ok(
+    source.indexOf("resolveDefaultSessionModel(") > -1,
+    "auto-start.ts should call resolveDefaultSessionModel()",
+  );
 
   // Session provider should be passed for bare model ID resolution
   const withProviderIdx = source.indexOf("resolveDefaultSessionModel(ctx.model?.provider)");
@@ -47,6 +51,51 @@ test("bootstrapAutoSession checks manual session override before preferences", (
     manualIdx < snapshotIdx && preferredIdx < snapshotIdx,
     "manual override and preference fallback must be resolved before building startModelSnapshot",
   );
+
+  // The validated preferred model must still appear as one of the snapshot
+  // sources so PREFERENCES.md continues to win over a stale settings.json
+  // default for built-in providers.
+  const snapshotBlock = source.slice(snapshotIdx, snapshotIdx + 400);
+  assert.ok(
+    snapshotBlock.includes("validatedPreferredModel") || snapshotBlock.includes("preferredModel"),
+    "startModelSnapshot must still consider preferredModel for built-in providers",
+  );
+});
+
+test("bootstrapAutoSession prefers session model over PREFERENCES.md when provider is custom (#4122)", () => {
+  // Custom providers (Ollama, vLLM, OpenAI-compatible proxies) live in
+  // ~/.gsd/agent/models.json, not PREFERENCES.md.  When the user picks one
+  // via /gsd model, that selection must win over any preferredModel from
+  // PREFERENCES.md, otherwise auto-mode tries to start a built-in provider
+  // the user is not logged into and pauses with "Not logged in".
+  const customCheckIdx = source.indexOf("isCustomProvider(ctx.model?.provider)");
+  assert.ok(
+    customCheckIdx > -1,
+    "auto-start.ts should call isCustomProvider() to detect custom-model sessions",
+  );
+
+  // sessionProviderIsCustom must gate preferredModel resolution so that when the
+  // session provider is custom, preferredModel is null and PREFERENCES.md is
+  // skipped entirely — the snapshot then falls through to ctx.model.
+  const gateIdx = source.indexOf("sessionProviderIsCustom");
+  assert.ok(gateIdx > -1, "auto-start.ts should bind sessionProviderIsCustom");
+
+  const preferredIdx = source.indexOf("const preferredModel = ");
+  assert.ok(preferredIdx > -1, "auto-start.ts should build preferredModel");
+
+  const preferredBlock = source.slice(preferredIdx, preferredIdx + 200);
+  assert.ok(
+    preferredBlock.includes("sessionProviderIsCustom"),
+    "preferredModel must be gated on sessionProviderIsCustom so PREFERENCES.md is skipped for custom providers",
+  );
+
+  const snapshotIdx = source.indexOf("const startModelSnapshot = ");
+  assert.ok(snapshotIdx > -1, "auto-start.ts should build startModelSnapshot");
+
+  assert.ok(
+    customCheckIdx < preferredIdx && preferredIdx < snapshotIdx,
+    "isCustomProvider() must be evaluated before preferredModel, which must be resolved before startModelSnapshot",
+  );
 });
 
 test("bootstrapAutoSession validates preferred model against live registry auth (#unconfigured-models)", () => {

package/src/resources/extensions/gsd/tests/crash-handler-secondary.test.ts

@@ -0,0 +1,235 @@
+/**
+ * Regression tests for #3348 secondary issues — crash handler gaps surfaced after #3696
+ *
+ * 1. register-extension.ts: writeCrashLog writes to ~/.gsd/crash/ directory
+ * 2. register-extension.ts: _gsdRejectionGuard registered for unhandledRejection
+ * 3. register-extension.ts: _gsdEpipeGuard exits with code 1 for unrecoverable errors (no log-and-continue)
+ * 4. crash-recovery.ts: emitCrashRecoveredUnitEnd closes open unit-start journal entries
+ */
+
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+function makeTmpBase(): string {
+  const base = join(tmpdir(), `gsd-test-${randomUUID()}`);
+  mkdirSync(join(base, '.gsd'), { recursive: true });
+  return base;
+}
+
+// ─── register-extension source assertions ────────────────────────────────────
+
+const registerExtSrc = readFileSync(
+  join(__dirname, '..', 'bootstrap', 'register-extension.ts'),
+  'utf-8',
+);
+
+describe('register-extension crash handler secondary fixes (#3348)', () => {
+  test('writeCrashLog is exported and writes a file to the crash directory', async () => {
+    // Dynamic import so GSD_HOME can be pointed at a temp dir without polluting ~/.gsd
+    const tmpHome = join(tmpdir(), `gsd-crash-test-${randomUUID()}`);
+    const origHome = process.env.GSD_HOME;
+    process.env.GSD_HOME = tmpHome;
+    try {
+      const { writeCrashLog } = await import('../bootstrap/crash-log.ts');
+      const err = new Error('test crash from secondary regression test');
+      writeCrashLog(err, 'uncaughtException');
+
+      const crashDir = join(tmpHome, 'crash');
+      assert.ok(existsSync(crashDir), 'crash directory should be created');
+
+      const logs = readdirSync(crashDir).filter((f) => f.endsWith('.log'));
+      assert.equal(logs.length, 1, 'exactly one crash log should be written');
+
+      const content = readFileSync(join(crashDir, logs[0]), 'utf-8');
+      assert.ok(content.includes('test crash from secondary regression test'), 'log should contain error message');
+      assert.ok(content.includes('uncaughtException'), 'log should identify the source');
+      assert.ok(content.includes('pid:'), 'log should include process pid');
+    } finally {
+      process.env.GSD_HOME = origHome;
+      rmSync(tmpHome, { recursive: true, force: true });
+    }
+  });
+
+  test('_gsdRejectionGuard is registered for unhandledRejection', () => {
+    assert.match(
+      registerExtSrc,
+      /_gsdRejectionGuard/,
+      '_gsdRejectionGuard handler should be defined',
+    );
+    assert.match(
+      registerExtSrc,
+      /unhandledRejection/,
+      'installEpipeGuard should register an unhandledRejection handler',
+    );
+  });
+
+  test('_gsdEpipeGuard calls process.exit(1) for unrecoverable errors, not log-and-continue', () => {
+    // The original #3696 fix replaced "throw err" with a log-and-continue.
+    // The secondary fix replaces that with writeCrashLog + process.exit(1).
+    assert.ok(
+      !registerExtSrc.includes('process.stderr.write(`[gsd] uncaught extension error (non-fatal)'),
+      '_gsdEpipeGuard should NOT log errors as non-fatal and continue',
+    );
+    assert.match(
+      registerExtSrc,
+      /process\.exit\(1\)/,
+      '_gsdEpipeGuard should call process.exit(1) for unrecoverable errors',
+    );
+  });
+
+  test('writeCrashLog never throws even when directory is unwritable', async () => {
+    const { writeCrashLog } = await import('../bootstrap/crash-log.ts');
+    const origHome = process.env.GSD_HOME;
+    // Point at a path that will fail to mkdir (e.g. a file that exists as non-dir)
+    const tmpFile = join(tmpdir(), `gsd-not-a-dir-${randomUUID()}`);
+    // Don't create it — mkdirSync with bad path should be caught internally
+    process.env.GSD_HOME = join(tmpFile, 'nested', 'deeply');
+    try {
+      // Should not throw
+      assert.doesNotThrow(() => {
+        writeCrashLog(new Error('should not throw'), 'test');
+      });
+    } finally {
+      process.env.GSD_HOME = origHome;
+    }
+  });
+});
+
+// ─── emitCrashRecoveredUnitEnd ────────────────────────────────────────────────
+
+describe('emitCrashRecoveredUnitEnd (#3348)', () => {
+  test('emits synthetic unit-end when unit-start has no matching unit-end', async () => {
+    const base = makeTmpBase();
+    try {
+      const { emitJournalEvent, queryJournal } = await import('../journal.ts');
+      const { emitCrashRecoveredUnitEnd } = await import('../crash-recovery.ts');
+
+      const flowId = randomUUID();
+      const unitStartSeq = 5;
+
+      // Emit a unit-start with no corresponding unit-end (simulating a crash)
+      emitJournalEvent(base, {
+        ts: new Date().toISOString(),
+        flowId,
+        seq: unitStartSeq,
+        eventType: 'unit-start',
+        data: { unitType: 'execute-task', unitId: 'M001/S01/T01' },
+      });
+
+      const lock = {
+        pid: 99999,
+        startedAt: new Date().toISOString(),
+        unitType: 'execute-task',
+        unitId: 'M001/S01/T01',
+        unitStartedAt: new Date().toISOString(),
+      };
+
+      emitCrashRecoveredUnitEnd(base, lock);
+
+      const events = queryJournal(base);
+      const ends = events.filter((e) => e.eventType === 'unit-end');
+      assert.equal(ends.length, 1, 'should emit exactly one unit-end');
+      assert.equal(ends[0].data?.unitId, 'M001/S01/T01');
+      assert.equal(ends[0].data?.status, 'crash-recovered');
+      assert.equal(ends[0].causedBy?.flowId, flowId);
+      assert.equal(ends[0].causedBy?.seq, unitStartSeq);
+      assert.ok(ends[0].seq > unitStartSeq, 'unit-end seq must be higher than unit-start seq');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  test('is a no-op when unit-end was already emitted (e.g. hard timeout fired)', async () => {
+    const base = makeTmpBase();
+    try {
+      const { emitJournalEvent, queryJournal } = await import('../journal.ts');
+      const { emitCrashRecoveredUnitEnd } = await import('../crash-recovery.ts');
+
+      const flowId = randomUUID();
+      emitJournalEvent(base, {
+        ts: new Date().toISOString(),
+        flowId,
+        seq: 3,
+        eventType: 'unit-start',
+        data: { unitType: 'plan-slice', unitId: 'M001/S02' },
+      });
+      // Hard timeout already emitted a unit-end
+      emitJournalEvent(base, {
+        ts: new Date().toISOString(),
+        flowId,
+        seq: 4,
+        eventType: 'unit-end',
+        data: { unitType: 'plan-slice', unitId: 'M001/S02', status: 'cancelled' },
+        causedBy: { flowId, seq: 3 },
+      });
+
+      const lock = {
+        pid: 99999,
+        startedAt: new Date().toISOString(),
+        unitType: 'plan-slice',
+        unitId: 'M001/S02',
+        unitStartedAt: new Date().toISOString(),
+      };
+      emitCrashRecoveredUnitEnd(base, lock);
+
+      const ends = queryJournal(base).filter((e) => e.eventType === 'unit-end');
+      assert.equal(ends.length, 1, 'should not emit a duplicate unit-end');
+      assert.equal(ends[0].data?.status, 'cancelled', 'original unit-end should be preserved');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  test('is a no-op for "starting" pseudo-units (bootstrap crash)', async () => {
+    const base = makeTmpBase();
+    try {
+      const { queryJournal } = await import('../journal.ts');
+      const { emitCrashRecoveredUnitEnd } = await import('../crash-recovery.ts');
+
+      const lock = {
+        pid: 99999,
+        startedAt: new Date().toISOString(),
+        unitType: 'starting',
+        unitId: 'bootstrap',
+        unitStartedAt: new Date().toISOString(),
+      };
+      emitCrashRecoveredUnitEnd(base, lock);
+
+      const events = queryJournal(base);
+      assert.equal(events.length, 0, 'should emit nothing for starting/bootstrap pseudo-units');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  test('is a no-op when no unit-start exists in the journal', async () => {
+    const base = makeTmpBase();
+    try {
+      const { queryJournal } = await import('../journal.ts');
+      const { emitCrashRecoveredUnitEnd } = await import('../crash-recovery.ts');
+
+      const lock = {
+        pid: 99999,
+        startedAt: new Date().toISOString(),
+        unitType: 'execute-task',
+        unitId: 'M002/S01/T03',
+        unitStartedAt: new Date().toISOString(),
+      };
+      emitCrashRecoveredUnitEnd(base, lock);
+
+      const events = queryJournal(base);
+      assert.equal(events.length, 0, 'should emit nothing when there is no journal entry to close');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+});

package/src/resources/extensions/gsd/tests/derive-state-crossval.test.ts

@@ -351,8 +351,9 @@ skills_used: []
       const dbState = await deriveStateFromDb(base);
 
       assertStatesEqual(dbState, fileState, 'E-blocked');
-      assert.deepStrictEqual(dbState.phase, 'blocked', 'E-blocked: phase is blocked');
-      assert.ok(dbState.blockers.length > 0, 'E-blocked: has blockers');
+      // With partial-dep fallback, circular deps no longer block — fallback picks first eligible slice
+      assert.deepStrictEqual(dbState.phase, 'planning', 'E-blocked: phase is planning (fallback picks a slice)');
+      assert.ok(dbState.activeSlice !== null, 'E-blocked: activeSlice is set via fallback');
 
       closeDatabase();
     } finally {

package/src/resources/extensions/gsd/tests/derive-state-db.test.ts

@@ -616,9 +616,10 @@ describe('derive-state-db', async () => {
       invalidateStateCache();
       const dbState = await deriveStateFromDb(base);
 
-      assert.deepStrictEqual(dbState.phase, 'blocked', 'blocked-db: phase is blocked');
+      // With partial-dep fallback, circular deps no longer block — fallback picks first eligible slice
+      assert.deepStrictEqual(dbState.phase, 'planning', 'blocked-db: phase is planning (fallback picks a slice)');
       assert.deepStrictEqual(dbState.phase, fileState.phase, 'blocked-db: phase matches filesystem');
-      assert.ok(dbState.blockers.length > 0, 'blocked-db: has blockers');
+      assert.ok(dbState.activeSlice !== null, 'blocked-db: activeSlice is set via fallback');
 
       closeDatabase();
     } finally {

package/src/resources/extensions/gsd/tests/derive-state.test.ts

@@ -446,9 +446,9 @@ Continue from step 2.
 
       const state2 = await deriveState(base2);
 
-      assert.deepStrictEqual(state2.phase, 'blocked', 'blocked-B: phase is blocked');
-      assert.deepStrictEqual(state2.activeSlice, null, 'blocked-B: activeSlice is null');
-      assert.ok(state2.blockers.length > 0, 'blocked-B: blockers array is non-empty');
+      // With partial-dep fallback, S01 is picked despite unmet dep on S99
+      assert.deepStrictEqual(state2.phase, 'planning', 'blocked-B: phase is planning (fallback picks S01)');
+      assert.deepStrictEqual(state2.activeSlice?.id, 'S01', 'blocked-B: activeSlice is S01 via fallback');
     } finally {
       cleanup(base2);
     }