gsd-pi 2.73.0-dev.e1c09f2 → 2.73.1-dev.6ddfa43

package/dist/resources/extensions/claude-code-cli/stream-adapter.js

@@ -6,7 +6,7 @@
  * AssistantMessageEvents for TUI rendering, then strips tool-call blocks from
  * the final AssistantMessage so GSD's agent loop doesn't try to dispatch them.
  */
-import { EventStream } from "@gsd/pi-ai";
+import { EventStream, mapThinkingLevelToEffort, supportsAdaptiveThinking } from "@gsd/pi-ai";
 import { execSync } from "node:child_process";
 import { PartialMessageBuilder, ZERO_USAGE, mapUsage } from "./partial-builder.js";
 import { buildWorkflowMcpServers } from "../gsd/workflow-mcp.js";
@@ -437,6 +437,7 @@ export async function resolveClaudePermissionMode(env = process.env) {
  * behaviour pass `permissionMode: "bypassPermissions"` explicitly.
  */
 export function buildSdkOptions(modelId, prompt, overrides, extraOptions = {}) {
+    const { reasoning, ...sdkExtraOptions } = extraOptions;
     const mcpServers = buildWorkflowMcpServers();
     const permissionMode = overrides?.permissionMode ?? "bypassPermissions";
     const disallowedTools = ["AskUserQuestion"];
@@ -455,6 +456,9 @@ export function buildSdkOptions(modelId, prompt, overrides, extraOptions = {}) {
         "Bash(pwd)",
         ...(mcpServers ? Object.keys(mcpServers).map((serverName) => `mcp__${serverName}__*`) : []),
     ];
+    const effort = reasoning && supportsAdaptiveThinking(modelId)
+        ? mapThinkingLevelToEffort(reasoning, modelId)
+        : undefined;
     return {
         pathToClaudeCodeExecutable: getClaudePath(),
         model: modelId,
@@ -469,7 +473,8 @@ export function buildSdkOptions(modelId, prompt, overrides, extraOptions = {}) {
         ...(allowedTools.length > 0 ? { allowedTools } : {}),
         ...(mcpServers ? { mcpServers } : {}),
         betas: modelId.includes("sonnet") ? ["context-1m-2025-08-07"] : [],
-        ...extraOptions,
+        ...(effort ? { effort } : {}),
+        ...sdkExtraOptions,
     };
 }
 function normalizeToolResultContent(content) {
@@ -620,9 +625,10 @@ async function pumpSdkMessages(model, context, options, stream) {
         const permissionMode = await resolveClaudePermissionMode();
         const sdkOpts = buildSdkOptions(modelId, prompt, { permissionMode }, typeof options?.extensionUIContext === "object"
             ? {
+                reasoning: options?.reasoning,
                 onElicitation: createClaudeCodeElicitationHandler(options?.extensionUIContext),
             }
-            : {});
+            : { reasoning: options?.reasoning });
         const queryResult = sdk.query({
             prompt,
             options: {

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -9,10 +9,8 @@ import { resolveModelForComplexity, escalateTier, getEligibleModels, loadCapabil
 import { getLedger, getProjectTotals } from "./metrics.js";
 import { unitPhaseLabel } from "./auto-dashboard.js";
 import { getSessionModelOverride } from "./session-model-override.js";
-export function resolvePreferredModelConfig(unitType, autoModeStartModel, 
-/** When false, only return explicit per-phase model configs — do not
- *  synthesize a routing ceiling from dynamic_routing.tier_models (#3962). */
-isAutoMode = true) {
+import { logWarning } from "./workflow-logger.js";
+export function resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode = true) {
     const explicitConfig = resolveModelWithFallbacksForUnit(unitType);
     if (explicitConfig)
         return explicitConfig;
@@ -24,7 +22,7 @@ isAutoMode = true) {
     if (!routingConfig.enabled || !routingConfig.tier_models)
         return undefined;
     // Don't synthesize a routing config for flat-rate providers (#3453).
-    if (autoModeStartModel && isFlatRateProvider(autoModeStartModel.provider))
+    if (autoModeStartModel && isFlatRateProvider(autoModeStartModel.provider, autoModeStartModel.flatRateCtx))
         return undefined;
     const ceilingModel = routingConfig.tier_models.heavy
         ?? (autoModeStartModel ? `${autoModeStartModel.provider}/${autoModeStartModel.id}` : undefined);
@@ -51,6 +49,17 @@ sessionModelOverride) {
     const effectiveSessionModelOverride = sessionModelOverride === undefined
         ? getSessionModelOverride(ctx.sessionManager.getSessionId())
         : (sessionModelOverride ?? undefined);
+    // Enrich the start model with a flat-rate context up front so routing
+    // synthesis and the dispatch-time guard see the same signals (built-in
+    // list + user `flat_rate_providers` preference + externalCli auto-
+    // detection).  The dispatch-time primary-model check below builds its
+    // own per-provider context when it has a resolved primary model.
+    if (autoModeStartModel) {
+        autoModeStartModel = {
+            ...autoModeStartModel,
+            flatRateCtx: buildFlatRateContext(autoModeStartModel.provider, ctx, prefs),
+        };
+    }
     const modelConfig = effectiveSessionModelOverride
         ? undefined
         : resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode);
@@ -76,12 +85,13 @@ sessionModelOverride) {
         if (routingConfig.enabled) {
             const primaryModel = resolveModelId(modelConfig.primary, availableModels, ctx.model?.provider);
             if (primaryModel) {
-                if (isFlatRateProvider(primaryModel.provider)) {
+                const primaryFlatRateCtx = buildFlatRateContext(primaryModel.provider, ctx, prefs);
+                if (isFlatRateProvider(primaryModel.provider, primaryFlatRateCtx)) {
                     routingConfig.enabled = false;
                 }
             }
-            else if ((autoModeStartModel && isFlatRateProvider(autoModeStartModel.provider))
-                || (ctx.model?.provider && isFlatRateProvider(ctx.model.provider))) {
+            else if ((autoModeStartModel && isFlatRateProvider(autoModeStartModel.provider, autoModeStartModel.flatRateCtx))
+                || (ctx.model?.provider && isFlatRateProvider(ctx.model.provider, buildFlatRateContext(ctx.model.provider, ctx, prefs)))) {
                 // Primary model unresolvable but provider signals indicate flat-rate —
                 // disable routing to prevent quality degradation.
                 routingConfig.enabled = false;
@@ -331,7 +341,40 @@ export function resolveModelId(modelId, availableModels, currentProvider) {
  * Uses case-insensitive matching with alias support to prevent fail-open on
  * provider naming variations (e.g. "copilot" vs "github-copilot").
  */
-const FLAT_RATE_PROVIDERS = new Set(["github-copilot", "copilot", "claude-code"]);
-export function isFlatRateProvider(provider) {
-    return FLAT_RATE_PROVIDERS.has(provider.toLowerCase());
+const BUILTIN_FLAT_RATE = new Set(["github-copilot", "copilot", "claude-code"]);
+export function isFlatRateProvider(provider, opts) {
+    const p = provider.toLowerCase();
+    if (BUILTIN_FLAT_RATE.has(p))
+        return true;
+    if (opts?.userFlatRate?.some(id => id.toLowerCase() === p))
+        return true;
+    if (opts?.authMode === "externalCli")
+        return true;
+    return false;
+}
+/**
+ * Build a FlatRateContext for a given provider from live runtime state.
+ * Safe to call when ctx or prefs are undefined — missing pieces are
+ * treated as "no signal".
+ */
+export function buildFlatRateContext(provider, ctx, prefs) {
+    let authMode;
+    const getAuthMode = ctx?.modelRegistry?.getProviderAuthMode;
+    if (typeof getAuthMode === "function") {
+        try {
+            const mode = getAuthMode(provider);
+            if (mode === "apiKey" || mode === "oauth" || mode === "externalCli" || mode === "none") {
+                authMode = mode;
+            }
+        }
+        catch (err) {
+            // Registry lookup failure must never break flat-rate detection —
+            // fall through with authMode undefined and surface the cause.
+            logWarning("dispatch", `flat-rate auth-mode lookup failed for ${provider}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return {
+        authMode,
+        userFlatRate: prefs?.flat_rate_providers,
+    };
 }

package/dist/resources/extensions/gsd/auto-start.js

@@ -38,7 +38,7 @@ import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync, } fro
 import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
-import { resolveDefaultSessionModel, resolveDynamicRoutingConfig } from "./preferences-models.js";
+import { isCustomProvider, resolveDefaultSessionModel, resolveDynamicRoutingConfig, } from "./preferences-models.js";
 import { getSessionModelOverride } from "./session-model-override.js";
 /**
  * Bootstrap a fresh auto-mode session. Handles everything from git init
@@ -195,8 +195,18 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     //
     // This preserves #3517 defaults while honoring explicit runtime model
     // selection for subsequent /gsd runs in the same session.
+    //
+    // Exception (#4122): when the session provider is a custom provider declared
+    // in ~/.gsd/agent/models.json (Ollama, vLLM, OpenAI-compatible proxy, etc.),
+    // PREFERENCES.md is skipped entirely. PREFERENCES.md cannot reference custom
+    // providers, so honoring it would silently reroute auto-mode to a built-in
+    // provider the user is not logged into and surface as "Not logged in · Please
+    // run /login" before pausing and resetting to claude-code/claude-sonnet-4-6.
     const manualSessionOverride = getSessionModelOverride(ctx.sessionManager.getSessionId());
-    const preferredModel = resolveDefaultSessionModel(ctx.model?.provider);
+    const sessionProviderIsCustom = isCustomProvider(ctx.model?.provider);
+    const preferredModel = sessionProviderIsCustom
+        ? null
+        : resolveDefaultSessionModel(ctx.model?.provider);
     // Validate the preferred model against the live registry + provider auth so
     // an unconfigured PREFERENCES.md entry (no API key / OAuth) can't become the
     // start-model snapshot. Without this, every subsequent unit would try to
@@ -636,12 +646,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         const startModelLabel = s.autoModeStartModel
             ? `${s.autoModeStartModel.provider}/${s.autoModeStartModel.id}`
             : ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : "default";
-        // Flat-rate providers (e.g. GitHub Copilot, claude-code) suppress routing
-        // at dispatch time (#3453) — reflect that in the banner.
-        const { isFlatRateProvider } = await import("./auto-model-selection.js");
+        // Flat-rate providers (e.g. GitHub Copilot, claude-code, user-declared
+        // subscription proxies, externalCli CLIs) suppress routing at dispatch
+        // time (#3453) — reflect that in the banner.  Thread the same
+        // FlatRateContext used by selectAndApplyModel so user-declared
+        // flat-rate providers and externalCli auto-detection are respected.
+        const { isFlatRateProvider, buildFlatRateContext } = await import("./auto-model-selection.js");
+        const bannerPrefs = loadEffectiveGSDPreferences()?.preferences;
         const effectiveProvider = s.autoModeStartModel?.provider ?? ctx.model?.provider;
         const effectivelyEnabled = routingConfig.enabled
-            && !(effectiveProvider && isFlatRateProvider(effectiveProvider));
+            && !(effectiveProvider && isFlatRateProvider(effectiveProvider, buildFlatRateContext(effectiveProvider, ctx, bannerPrefs)));
         // The actual ceiling may come from tier_models.heavy, not the start model.
         const effectiveCeiling = (routingConfig.enabled && routingConfig.tier_models?.heavy)
             ? routingConfig.tier_models.heavy

package/dist/resources/extensions/gsd/auto.js

@@ -19,7 +19,7 @@ import { gsdRoot, resolveMilestoneFile, resolveMilestonePath, resolveDir, milest
 import { invalidateAllCaches } from "./cache.js";
 import { clearActivityLogState } from "./activity-log.js";
 import { synthesizeCrashRecovery, getDeepDiagnostic, readActiveMilestoneId, } from "./session-forensics.js";
-import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, } from "./crash-recovery.js";
+import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, } from "./crash-recovery.js";
 import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, } from "./preferences.js";
 import { sendDesktopNotification } from "./notifications.js";
@@ -1014,6 +1014,10 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         s.stepMode = requestedStepMode;
     }
     if (freshStartAssessment.lock) {
+        // Emit a synthetic unit-end for any unit-start that has no closing event.
+        // This closes the journal gap reported in #3348 where the worker wrote side
+        // effects (SUMMARY.md, DB updates) but died before emitting unit-end.
+        emitCrashRecoveredUnitEnd(base, freshStartAssessment.lock);
         clearLock(base);
     }
     if (!s.paused) {

package/dist/resources/extensions/gsd/bootstrap/crash-log.js

@@ -0,0 +1,31 @@
+/**
+ * crash-log.ts — Write crash diagnostics to ~/.gsd/crash/<timestamp>.log
+ *
+ * Zero cross-dependencies: only uses Node.js built-ins so it can be imported
+ * safely from uncaughtException / unhandledRejection handlers and from tests
+ * without pulling in the full extension dependency tree.
+ */
+import { appendFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * Write a crash log to ~/.gsd/crash/<timestamp>.log (or $GSD_HOME/crash/).
+ * Never throws — must be safe to call from any error handler.
+ */
+export function writeCrashLog(err, source) {
+    try {
+        const crashDir = join(process.env.GSD_HOME ?? join(homedir(), ".gsd"), "crash");
+        mkdirSync(crashDir, { recursive: true });
+        const ts = new Date().toISOString().replace(/[:.]/g, "-");
+        const logPath = join(crashDir, `${ts}.log`);
+        const lines = [
+            `[gsd] ${source}: ${err.message}`,
+            `timestamp: ${new Date().toISOString()}`,
+            `pid: ${process.pid}`,
+            err.stack ?? "(no stack trace available)",
+            "",
+        ];
+        appendFileSync(logPath, lines.join("\n"));
+    }
+    catch { /* never throw from crash handler */ }
+}

package/dist/resources/extensions/gsd/bootstrap/register-extension.js

@@ -8,6 +8,8 @@ import { registerJournalTools } from "./journal-tools.js";
 import { registerQueryTools } from "./query-tools.js";
 import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
+import { writeCrashLog } from "./crash-log.js";
+export { writeCrashLog } from "./crash-log.js";
 export function handleRecoverableExtensionProcessError(err) {
     if (err.code === "EPIPE") {
         process.exit(0);
@@ -28,17 +30,26 @@ export function handleRecoverableExtensionProcessError(err) {
 function installEpipeGuard() {
     if (!process.listeners("uncaughtException").some((listener) => listener.name === "_gsdEpipeGuard")) {
         const _gsdEpipeGuard = (err) => {
-            if (handleRecoverableExtensionProcessError(err)) {
+            if (handleRecoverableExtensionProcessError(err))
                 return;
-            }
-            // Log unhandled errors instead of re-throwing — throwing inside an
-            // uncaughtException handler is a fatal double-fault in Node.js (#3163).
-            process.stderr.write(`[gsd] uncaught extension error (non-fatal): ${err.message}\n`);
-            if (err.stack)
-                process.stderr.write(`${err.stack}\n`);
+            // Write crash log and exit cleanly for unrecoverable errors.
+            // Logging and continuing was the original double-fault fix (#3163), but
+            // continuing in an indeterminate state is worse than a clean exit (#3348).
+            writeCrashLog(err, "uncaughtException");
+            process.exit(1);
         };
         process.on("uncaughtException", _gsdEpipeGuard);
     }
+    if (!process.listeners("unhandledRejection").some((listener) => listener.name === "_gsdRejectionGuard")) {
+        const _gsdRejectionGuard = (reason, _promise) => {
+            const err = reason instanceof Error ? reason : new Error(String(reason));
+            if (handleRecoverableExtensionProcessError(err))
+                return;
+            writeCrashLog(err, "unhandledRejection");
+            process.exit(1);
+        };
+        process.on("unhandledRejection", _gsdRejectionGuard);
+    }
 }
 export function registerGsdExtension(pi) {
     registerGSDCommand(pi);

package/dist/resources/extensions/gsd/crash-recovery.js

@@ -14,6 +14,7 @@ import { join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { effectiveLockFile } from "./session-lock.js";
+import { emitJournalEvent, queryJournal } from "./journal.js";
 function lockPath(basePath) {
     return join(gsdRoot(basePath), effectiveLockFile());
 }
@@ -110,3 +111,53 @@ export function formatCrashInfo(lock) {
     }
     return lines.join("\n");
 }
+/**
+ * Emit a synthetic unit-end event for a unit that crashed without emitting its own.
+ *
+ * Queries the journal to find the most recent unit-start for the crashed unit.
+ * If a matching unit-end already exists (e.g. the hard timeout fired), this is a
+ * no-op. Called during crash recovery, before clearing the stale lock.
+ *
+ * Addresses the gap reported in #3348 where `unit-start` was emitted but no
+ * `unit-end` followed — side effects landed but the worker died before closeout.
+ */
+export function emitCrashRecoveredUnitEnd(basePath, lock) {
+    // Skip bootstrap / starting pseudo-units — they have no meaningful unit-start event.
+    if (!lock.unitType || !lock.unitId || lock.unitType === "starting")
+        return;
+    try {
+        const all = queryJournal(basePath);
+        // Find the most recent unit-start for this unitId
+        const starts = all.filter((e) => e.eventType === "unit-start" && e.data?.unitId === lock.unitId);
+        if (starts.length === 0)
+            return;
+        const lastStart = starts[starts.length - 1];
+        // Check if a unit-end was already emitted (e.g. hard timeout fired after the crash)
+        const alreadyClosed = all.some((e) => e.eventType === "unit-end" &&
+            e.data?.unitId === lock.unitId &&
+            e.causedBy?.flowId === lastStart.flowId &&
+            e.causedBy?.seq === lastStart.seq);
+        if (alreadyClosed)
+            return;
+        // Find the highest seq in this flow for monotonic ordering
+        const maxSeq = all
+            .filter((e) => e.flowId === lastStart.flowId)
+            .reduce((max, e) => Math.max(max, e.seq), lastStart.seq);
+        emitJournalEvent(basePath, {
+            ts: new Date().toISOString(),
+            flowId: lastStart.flowId,
+            seq: maxSeq + 1,
+            eventType: "unit-end",
+            data: {
+                unitType: lock.unitType,
+                unitId: lock.unitId,
+                status: "crash-recovered",
+                artifactVerified: false,
+            },
+            causedBy: { flowId: lastStart.flowId, seq: lastStart.seq },
+        });
+    }
+    catch {
+        // Never throw from crash recovery path — journal failure must not block recovery
+    }
+}

package/dist/resources/extensions/gsd/gsd-db.js

@@ -1352,6 +1352,25 @@ export function setSliceSummaryMd(milestoneId, sliceId, summaryMd, uatMd) {
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
     currentDb.prepare(`UPDATE slices SET full_summary_md = :summary_md, full_uat_md = :uat_md WHERE milestone_id = :mid AND id = :sid`).run({ ":mid": milestoneId, ":sid": sliceId, ":summary_md": summaryMd, ":uat_md": uatMd });
 }
+function parseTaskArrayColumn(raw) {
+    if (typeof raw !== "string" || raw.trim() === "")
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed))
+            return parsed.map((value) => String(value));
+        if (parsed === null || parsed === undefined || parsed === "")
+            return [];
+        return [String(parsed)];
+    }
+    catch {
+        // Older/corrupt rows may contain comma-separated strings instead of JSON.
+        return raw
+            .split(",")
+            .map((value) => value.trim())
+            .filter(Boolean);
+    }
+}
 function rowToTask(row) {
     const parseTaskArray = (value) => {
         if (Array.isArray(value)) {
@@ -1390,8 +1409,8 @@ function rowToTask(row) {
         blocker_discovered: row["blocker_discovered"] === 1,
         deviations: row["deviations"],
         known_issues: row["known_issues"],
-        key_files: JSON.parse(row["key_files"] || "[]"),
-        key_decisions: JSON.parse(row["key_decisions"] || "[]"),
+        key_files: parseTaskArrayColumn(row["key_files"]),
+        key_decisions: parseTaskArrayColumn(row["key_decisions"]),
         full_summary_md: row["full_summary_md"],
         description: row["description"] ?? "",
         estimate: row["estimate"] ?? "",
@@ -1855,6 +1874,21 @@ export function deleteSlice(milestoneId, sliceId) {
         currentDb.prepare(`DELETE FROM slices WHERE milestone_id = :mid AND id = :sid`).run({ ":mid": milestoneId, ":sid": sliceId });
     });
 }
+export function deleteMilestone(milestoneId) {
+    if (!currentDb)
+        throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+    transaction(() => {
+        currentDb.prepare(`DELETE FROM verification_evidence WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM quality_gates WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM tasks WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM slice_dependencies WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM slices WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM replan_history WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM assessments WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM artifacts WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM milestones WHERE id = :mid`).run({ ":mid": milestoneId });
+    });
+}
 export function updateSliceFields(milestoneId, sliceId, fields) {
     if (!currentDb)
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");

package/dist/resources/extensions/gsd/milestone-actions.js

@@ -15,7 +15,8 @@ import { join } from "node:path";
 import { resolveMilestonePath, resolveMilestoneFile, buildMilestoneFileName, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
-import { getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { deleteMilestone, getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { removeWorktree } from "./worktree-manager.js";
 import { logWarning } from "./workflow-logger.js";
 // ─── Park ──────────────────────────────────────────────────────────────────
 /**
@@ -99,12 +100,29 @@ export function discardMilestone(basePath, milestoneId) {
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;
+    try {
+        removeWorktree(basePath, milestoneId, {
+            branch: `milestone/${milestoneId}`,
+            deleteBranch: true,
+        });
+    }
+    catch (err) {
+        logWarning("engine", `discardMilestone worktree cleanup failed for ${milestoneId}: ${err.message}`);
+    }
     rmSync(mDir, { recursive: true, force: true });
     // Prune from queue order if present
     const order = loadQueueOrder(basePath);
     if (order && order.includes(milestoneId)) {
         saveQueueOrder(basePath, order.filter(id => id !== milestoneId));
     }
+    if (isDbAvailable()) {
+        try {
+            deleteMilestone(milestoneId);
+        }
+        catch (err) {
+            logWarning("engine", `discardMilestone DB cleanup failed for ${milestoneId}: ${err.message}`);
+        }
+    }
     invalidateAllCaches();
     return true;
 }

package/dist/resources/extensions/gsd/preferences-models.js

@@ -6,6 +6,8 @@
  * and dynamic routing configuration.
  */
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { defaultRoutingConfig } from "./model-router.js";
 import { loadEffectiveGSDPreferences, getGlobalGSDPreferencesPath } from "./preferences.js";
 /**
@@ -161,6 +163,47 @@ export function resolveDefaultSessionModel(sessionProvider) {
     }
     return undefined;
 }
+/**
+ * Returns true if `provider` is defined as a custom provider in the user's
+ * `~/.gsd/agent/models.json` (Ollama, vLLM, LM Studio, OpenAI-compatible
+ * proxies, etc.).
+ *
+ * Used by auto-mode bootstrap to decide whether the session model
+ * (set via `/gsd model`) should override `PREFERENCES.md`.  Custom providers
+ * are never reachable from `PREFERENCES.md` (which only knows built-in
+ * providers), so when the user has explicitly selected one, it must take
+ * priority — otherwise auto-mode tries to start the built-in provider from
+ * PREFERENCES.md and fails with "Not logged in · Please run /login" (#4122).
+ *
+ * Reads models.json directly with a lightweight JSON parse to avoid
+ * pulling in the full model-registry at this call site.  Falls back to
+ * `~/.pi/agent/models.json` for parity with `resolveModelsJsonPath()`.
+ * Any read or parse error yields `false` (treat as not-custom) so a
+ * malformed models.json never breaks the session bootstrap.
+ */
+export function isCustomProvider(provider) {
+    if (!provider)
+        return false;
+    const candidates = [
+        join(homedir(), ".gsd", "agent", "models.json"),
+        join(homedir(), ".pi", "agent", "models.json"),
+    ];
+    for (const path of candidates) {
+        if (!existsSync(path))
+            continue;
+        try {
+            const raw = readFileSync(path, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed?.providers && Object.prototype.hasOwnProperty.call(parsed.providers, provider)) {
+                return true;
+            }
+        }
+        catch {
+            // Ignore — malformed models.json must not break bootstrap.
+        }
+    }
+    return false;
+}
 /**
  * Determines the next fallback model to try when the current model fails.
  * If the current model is not in the configured list, returns the primary model.

package/dist/resources/extensions/gsd/preferences-types.js

@@ -83,6 +83,7 @@ export const KNOWN_PREFERENCE_KEYS = new Set([
     "discuss_preparation",
     "discuss_web_research",
     "discuss_depth",
+    "flat_rate_providers",
 ]);
 /** Canonical list of all dispatch unit types. */
 export const KNOWN_UNIT_TYPES = [

package/dist/resources/extensions/gsd/preferences-validation.js

@@ -155,6 +155,28 @@ export function validatePreferences(preferences) {
             errors.push(`search_provider must be one of: brave, tavily, ollama, native, auto`);
         }
     }
+    // ─── Flat-rate Providers ────────────────────────────────────────────
+    // User-declared flat-rate providers for dynamic routing suppression.
+    // Built-in providers (github-copilot, copilot, claude-code) and any
+    // externalCli provider are already auto-detected; this list layers on
+    // top for private subscription proxies and custom CLI wrappers.
+    if (preferences.flat_rate_providers !== undefined) {
+        if (Array.isArray(preferences.flat_rate_providers)) {
+            const allStrings = preferences.flat_rate_providers.every((item) => typeof item === "string");
+            if (allStrings) {
+                // Strip empty/whitespace-only entries to avoid false matches.
+                validated.flat_rate_providers = preferences.flat_rate_providers
+                    .map((s) => s.trim())
+                    .filter((s) => s.length > 0);
+            }
+            else {
+                errors.push("flat_rate_providers must be an array of strings");
+            }
+        }
+        else {
+            errors.push("flat_rate_providers must be an array of strings");
+        }
+    }
     // ─── Phase Skip Preferences ─────────────────────────────────────────
     if (preferences.phases !== undefined) {
         if (typeof preferences.phases === "object" && preferences.phases !== null) {

package/dist/web/standalone/.next/BUILD_ID

@@ -1 +1 @@
-_XD_gUDcZNBbWV5rI8RgS
+r6AvNu-aMwn4nwqjHqAfw

package/dist/web/standalone/.next/app-path-routes-manifest.json

@@ -9,39 +9,39 @@
   "/api/cleanup/route": "/api/cleanup",
   "/api/doctor/route": "/api/doctor",
   "/api/export-data/route": "/api/export-data",
-  "/api/browse-directories/route": "/api/browse-directories",
   "/api/captures/route": "/api/captures",
   "/api/forensics/route": "/api/forensics",
-  "/api/history/route": "/api/history",
+  "/api/browse-directories/route": "/api/browse-directories",
+  "/api/experimental/route": "/api/experimental",
   "/api/git/route": "/api/git",
+  "/api/history/route": "/api/history",
   "/api/hooks/route": "/api/hooks",
-  "/api/knowledge/route": "/api/knowledge",
   "/api/inspect/route": "/api/inspect",
-  "/api/experimental/route": "/api/experimental",
+  "/api/knowledge/route": "/api/knowledge",
   "/api/live-state/route": "/api/live-state",
   "/api/notifications/route": "/api/notifications",
   "/api/preferences/route": "/api/preferences",
   "/api/recovery/route": "/api/recovery",
   "/api/onboarding/route": "/api/onboarding",
-  "/api/session/browser/route": "/api/session/browser",
   "/api/projects/route": "/api/projects",
+  "/api/session/browser/route": "/api/session/browser",
   "/api/session/command/route": "/api/session/command",
-  "/api/session/manage/route": "/api/session/manage",
-  "/api/session/events/route": "/api/session/events",
+  "/api/files/route": "/api/files",
   "/api/settings-data/route": "/api/settings-data",
   "/api/shutdown/route": "/api/shutdown",
+  "/api/session/events/route": "/api/session/events",
   "/api/skill-health/route": "/api/skill-health",
+  "/api/session/manage/route": "/api/session/manage",
   "/api/steer/route": "/api/steer",
-  "/api/files/route": "/api/files",
   "/api/terminal/input/route": "/api/terminal/input",
-  "/api/terminal/resize/route": "/api/terminal/resize",
   "/api/switch-root/route": "/api/switch-root",
+  "/api/terminal/resize/route": "/api/terminal/resize",
   "/api/terminal/sessions/route": "/api/terminal/sessions",
   "/api/terminal/stream/route": "/api/terminal/stream",
+  "/api/update/route": "/api/update",
   "/api/undo/route": "/api/undo",
   "/api/visualizer/route": "/api/visualizer",
   "/api/terminal/upload/route": "/api/terminal/upload",
-  "/api/update/route": "/api/update",
   "/api/remote-questions/route": "/api/remote-questions",
   "/page": "/"
 }

package/dist/web/standalone/.next/build-manifest.json

@@ -4,8 +4,8 @@
   ],
   "devFiles": [],
   "lowPriorityFiles": [
-    "static/_XD_gUDcZNBbWV5rI8RgS/_buildManifest.js",
-    "static/_XD_gUDcZNBbWV5rI8RgS/_ssgManifest.js"
+    "static/r6AvNu-aMwn4nwqjHqAfw/_buildManifest.js",
+    "static/r6AvNu-aMwn4nwqjHqAfw/_ssgManifest.js"
   ],
   "rootMainFiles": [
     "static/chunks/webpack-b868033a5834586d.js",

package/dist/web/standalone/.next/prerender-manifest.json

@@ -78,8 +78,8 @@
   "dynamicRoutes": {},
   "notFoundRoutes": [],
   "preview": {
-    "previewModeId": "4283da6741183fc0cc8d512df6295628",
-    "previewModeSigningKey": "cdf7d7cfc64c1c34a89272bf9cd51d42b833e77ed6cca6783bb040758c5debcb",
-    "previewModeEncryptionKey": "05a6e01cb4dec0b5ed78f3ef384323f7926e7212560fac1b76e648ccf9b43ed0"
+    "previewModeId": "1ad2aeb0370b98cc01860d4aa27c2cc6",
+    "previewModeSigningKey": "d1af9f025aa721de88357535f1bcb3b731aa041032a52fdda4caf17b0a7d3960",
+    "previewModeEncryptionKey": "812d78941c2b0688748da1f190f3e6071d14c1206bf1b75b1407d9e101368741"
   }
 }