gsd-pi 2.73.0 → 2.73.1-dev.06e4302

package/src/resources/extensions/gsd/auto-verification.ts

@@ -12,10 +12,15 @@
 
 import type { ExtensionContext, ExtensionAPI } from "@gsd/pi-coding-agent";
 import { mkdirSync, writeFileSync } from "node:fs";
-import { resolveSliceFile, resolveSlicePath } from "./paths.js";
+import { resolveSliceFile, resolveSlicePath, resolveMilestoneFile } from "./paths.js";
 import { parseUnitId } from "./unit-id.js";
-import { isDbAvailable, getTask, getSliceTasks, type TaskRow } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSliceTasks, getMilestoneSlices, type TaskRow } from "./gsd-db.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
+import { extractVerdict } from "./verdict-parser.js";
+import { isClosedStatus } from "./status-guards.js";
+import { loadFile } from "./files.js";
+import { parseRoadmap } from "./parsers-legacy.js";
+import { isMilestoneComplete } from "./state.js";
 import {
   runVerificationGate,
   formatFailureContext,
@@ -43,6 +48,88 @@ function isInfraVerificationFailure(stderr: string): boolean {
   );
 }
 
+/**
+ * Post-unit guard for `validate-milestone` units (#4094).
+ *
+ * When validate-milestone writes verdict=needs-remediation, the agent is
+ * expected to also call gsd_reassess_roadmap in the same turn to add
+ * remediation slices. If they don't, the state machine re-derives
+ * `phase: validating-milestone` indefinitely (all slices still complete +
+ * verdict still needs-remediation), wasting ~3 dispatches before the stuck
+ * detector fires.
+ *
+ * This guard fires immediately on the first occurrence: if VALIDATION.md
+ * verdict is needs-remediation and no incomplete slices exist for the
+ * milestone, pause the auto-loop with a clear blocker.
+ */
+async function runValidateMilestonePostCheck(
+  vctx: VerificationContext,
+  pauseAuto: (ctx?: ExtensionContext, pi?: ExtensionAPI) => Promise<void>,
+): Promise<VerificationResult> {
+  const { s, ctx, pi } = vctx;
+  if (!s.currentUnit) return "continue";
+
+  const { milestone: mid } = parseUnitId(s.currentUnit.id);
+  if (!mid) return "continue";
+
+  const validationFile = resolveMilestoneFile(s.basePath, mid, "VALIDATION");
+  if (!validationFile) return "continue";
+
+  const validationContent = await loadFile(validationFile);
+  if (!validationContent) return "continue";
+
+  const verdict = extractVerdict(validationContent);
+  if (verdict !== "needs-remediation") return "continue";
+
+  const incompleteSliceCount = await countIncompleteSlices(s.basePath, mid);
+
+  // If any non-closed slices exist, the agent successfully queued remediation
+  // work — proceed normally. The state machine will execute those slices and
+  // re-validate per the #3596/#3670 fix.
+  if (incompleteSliceCount > 0) return "continue";
+
+  ctx.ui.notify(
+    `Milestone ${mid} validation returned verdict=needs-remediation but no remediation slices were added. Pausing for human review.`,
+    "error",
+  );
+  process.stderr.write(
+    `validate-milestone: pausing — verdict=needs-remediation with no incomplete slices for ${mid}. ` +
+      `The agent must call gsd_reassess_roadmap to add remediation slices before re-validation.\n`,
+  );
+  await pauseAuto(ctx, pi);
+  return "pause";
+}
+
+/**
+ * Count slices for a milestone that are not in a closed status.
+ * DB-backed projects are authoritative (#4094 peer review); falls back to
+ * roadmap parsing only when the DB is unavailable.
+ */
+async function countIncompleteSlices(basePath: string, milestoneId: string): Promise<number> {
+  if (isDbAvailable()) {
+    const slices = getMilestoneSlices(milestoneId);
+    if (slices.length === 0) {
+      // No DB rows — treat as "unknown", do not pause.
+      return 1;
+    }
+    return slices.filter((slice) => !isClosedStatus(slice.status)).length;
+  }
+
+  // Filesystem fallback: parse the roadmap markdown.
+  try {
+    const roadmapFile = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
+    if (!roadmapFile) return 1;
+    const roadmapContent = await loadFile(roadmapFile);
+    if (!roadmapContent) return 1;
+    const roadmap = parseRoadmap(roadmapContent);
+    if (roadmap.slices.length === 0) return 1;
+    return isMilestoneComplete(roadmap) ? 0 : 1;
+  } catch {
+    // Parsing failures should not cause false-positive pauses.
+    return 1;
+  }
+}
+
 /**
  * Run the verification gate for the current execute-task unit.
  * Returns:
@@ -56,7 +143,15 @@ export async function runPostUnitVerification(
 ): Promise<VerificationResult> {
   const { s, ctx, pi } = vctx;
 
-  if (!s.currentUnit || s.currentUnit.type !== "execute-task") {
+  if (!s.currentUnit) {
+    return "continue";
+  }
+
+  if (s.currentUnit.type === "validate-milestone") {
+    return await runValidateMilestonePostCheck(vctx, pauseAuto);
+  }
+
+  if (s.currentUnit.type !== "execute-task") {
     return "continue";
   }
 

package/src/resources/extensions/gsd/auto.ts

@@ -52,6 +52,7 @@ import {
   readCrashLock,
   isLockProcessAlive,
   formatCrashInfo,
+  emitCrashRecoveredUnitEnd,
 } from "./crash-recovery.js";
 import {
   acquireSessionLock,
@@ -186,7 +187,7 @@ import {
   deregisterSigtermHandler as _deregisterSigtermHandler,
   detectWorkingTreeActivity,
 } from "./auto-supervisor.js";
-import { isDbAvailable } from "./gsd-db.js";
+import { isDbAvailable, getMilestone } from "./gsd-db.js";
 import { countPendingCaptures } from "./captures.js";
 import { clearCmuxSidebar, logCmuxEvent, syncCmuxSidebar } from "../cmux/index.js";
 
@@ -198,6 +199,7 @@ import {
   postUnitPostVerification,
 } from "./auto-post-unit.js";
 import { bootstrapAutoSession, openProjectDbIfPresent, type BootstrapDeps } from "./auto-start.js";
+import { initHealthWidget } from "./health-widget.js";
 import { autoLoop, resolveAgentEnd, resolveAgentEndCancelled, _resetPendingResolve, isSessionSwitchInFlight, type LoopDeps, type ErrorContext } from "./auto-loop.js";
 // Slice-level parallelism (#2340)
 import { getEligibleSlices } from "./slice-parallel-eligibility.js";
@@ -649,6 +651,7 @@ function handleLostSessionLock(
   ctx?.ui.setStatus("gsd-auto", undefined);
   ctx?.ui.setWidget("gsd-progress", undefined);
   ctx?.ui.setFooter(undefined);
+  if (ctx) initHealthWidget(ctx);
 }
 
 /**
@@ -683,6 +686,7 @@ function cleanupAfterLoopExit(ctx: ExtensionContext): void {
     ctx.ui.setStatus("gsd-auto", undefined);
     ctx.ui.setWidget("gsd-progress", undefined);
     ctx.ui.setFooter(undefined);
+    initHealthWidget(ctx);
   }
 
   // Restore CWD out of worktree back to original project root
@@ -757,24 +761,36 @@ export async function stopAuto(
           : { notify: () => {} };
         const resolver = buildResolver();
 
-        // Check if the milestone is complete — SUMMARY file is the authoritative signal.
+        // Check if the milestone is complete. DB status is the authoritative
+        // signal — only a successful gsd_complete_milestone call flips it to
+        // "complete" (tools/complete-milestone.ts). SUMMARY file presence is
+        // NOT sufficient: a blocker placeholder stub or a partial write can
+        // leave a file behind without the milestone actually being done,
+        // which previously caused stopAuto to merge a failed milestone and
+        // emit a misleading metadata-only merge warning (#4175).
+        // DB-unavailable projects fall back to SUMMARY-file presence.
         let milestoneComplete = false;
         try {
-          const summaryPath = resolveMilestoneFile(
-            s.originalBasePath || s.basePath,
-            s.currentMilestoneId,
-            "SUMMARY",
-          );
-          if (!summaryPath) {
-            // Also check in the worktree path (SUMMARY may not be synced yet)
-            const wtSummaryPath = resolveMilestoneFile(
-              s.basePath,
+          if (isDbAvailable()) {
+            const dbRow = getMilestone(s.currentMilestoneId);
+            milestoneComplete = dbRow?.status === "complete";
+          } else {
+            const summaryPath = resolveMilestoneFile(
+              s.originalBasePath || s.basePath,
               s.currentMilestoneId,
               "SUMMARY",
             );
-            milestoneComplete = wtSummaryPath !== null;
-          } else {
-            milestoneComplete = true;
+            if (!summaryPath) {
+              // Also check in the worktree path (SUMMARY may not be synced yet)
+              const wtSummaryPath = resolveMilestoneFile(
+                s.basePath,
+                s.currentMilestoneId,
+                "SUMMARY",
+              );
+              milestoneComplete = wtSummaryPath !== null;
+            } else {
+              milestoneComplete = true;
+            }
           }
         } catch (err) {
           // Non-fatal — fall through to preserveBranch path
@@ -942,6 +958,7 @@ export async function stopAuto(
     ctx?.ui.setStatus("gsd-auto", undefined);
     ctx?.ui.setWidget("gsd-progress", undefined);
     ctx?.ui.setFooter(undefined);
+    if (ctx) initHealthWidget(ctx);
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
 
@@ -1043,6 +1060,7 @@ export async function pauseAuto(
   ctx?.ui.setStatus("gsd-auto", "paused");
   ctx?.ui.setWidget("gsd-progress", undefined);
   ctx?.ui.setFooter(undefined);
+  if (ctx) initHealthWidget(ctx);
   const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
   ctx?.ui.notify(
     `${s.stepMode ? "Step" : "Auto"}-mode paused (Escape). Type to interact, or ${resumeCmd} to resume.`,
@@ -1332,6 +1350,10 @@ export async function startAuto(
   }
 
   if (freshStartAssessment.lock) {
+    // Emit a synthetic unit-end for any unit-start that has no closing event.
+    // This closes the journal gap reported in #3348 where the worker wrote side
+    // effects (SUMMARY.md, DB updates) but died before emitting unit-end.
+    emitCrashRecoveredUnitEnd(base, freshStartAssessment.lock);
     clearLock(base);
   }
 

package/src/resources/extensions/gsd/bootstrap/crash-log.ts

@@ -0,0 +1,32 @@
+/**
+ * crash-log.ts — Write crash diagnostics to ~/.gsd/crash/<timestamp>.log
+ *
+ * Zero cross-dependencies: only uses Node.js built-ins so it can be imported
+ * safely from uncaughtException / unhandledRejection handlers and from tests
+ * without pulling in the full extension dependency tree.
+ */
+
+import { appendFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Write a crash log to ~/.gsd/crash/<timestamp>.log (or $GSD_HOME/crash/).
+ * Never throws — must be safe to call from any error handler.
+ */
+export function writeCrashLog(err: Error, source: string): void {
+  try {
+    const crashDir = join(process.env.GSD_HOME ?? join(homedir(), ".gsd"), "crash");
+    mkdirSync(crashDir, { recursive: true });
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const logPath = join(crashDir, `${ts}.log`);
+    const lines = [
+      `[gsd] ${source}: ${err.message}`,
+      `timestamp: ${new Date().toISOString()}`,
+      `pid: ${process.pid}`,
+      err.stack ?? "(no stack trace available)",
+      "",
+    ];
+    appendFileSync(logPath, lines.join("\n"));
+  } catch { /* never throw from crash handler */ }
+}

package/src/resources/extensions/gsd/bootstrap/register-extension.ts

@@ -11,6 +11,9 @@ import { registerJournalTools } from "./journal-tools.js";
 import { registerQueryTools } from "./query-tools.js";
 import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
+import { writeCrashLog } from "./crash-log.js";
+
+export { writeCrashLog } from "./crash-log.js";
 
 export function handleRecoverableExtensionProcessError(err: Error): boolean {
   if ((err as NodeJS.ErrnoException).code === "EPIPE") {
@@ -33,16 +36,25 @@ export function handleRecoverableExtensionProcessError(err: Error): boolean {
 function installEpipeGuard(): void {
   if (!process.listeners("uncaughtException").some((listener) => listener.name === "_gsdEpipeGuard")) {
     const _gsdEpipeGuard = (err: Error): void => {
-      if (handleRecoverableExtensionProcessError(err)) {
-        return;
-      }
-      // Log unhandled errors instead of re-throwing — throwing inside an
-      // uncaughtException handler is a fatal double-fault in Node.js (#3163).
-      process.stderr.write(`[gsd] uncaught extension error (non-fatal): ${err.message}\n`);
-      if (err.stack) process.stderr.write(`${err.stack}\n`);
+      if (handleRecoverableExtensionProcessError(err)) return;
+      // Write crash log and exit cleanly for unrecoverable errors.
+      // Logging and continuing was the original double-fault fix (#3163), but
+      // continuing in an indeterminate state is worse than a clean exit (#3348).
+      writeCrashLog(err, "uncaughtException");
+      process.exit(1);
     };
     process.on("uncaughtException", _gsdEpipeGuard);
   }
+
+  if (!process.listeners("unhandledRejection").some((listener) => listener.name === "_gsdRejectionGuard")) {
+    const _gsdRejectionGuard = (reason: unknown, _promise: Promise<unknown>): void => {
+      const err = reason instanceof Error ? reason : new Error(String(reason));
+      if (handleRecoverableExtensionProcessError(err)) return;
+      writeCrashLog(err, "unhandledRejection");
+      process.exit(1);
+    };
+    process.on("unhandledRejection", _gsdRejectionGuard);
+  }
 }
 
 export function registerGsdExtension(pi: ExtensionAPI): void {

package/src/resources/extensions/gsd/bootstrap/system-context.ts

@@ -9,6 +9,7 @@ import { debugTime } from "../debug-logger.js";
 import { loadPrompt, getTemplatesDir } from "../prompt-loader.js";
 import { readForensicsMarker } from "../forensics.js";
 import { resolveAllSkillReferences, renderPreferencesForSystemPrompt, loadEffectiveGSDPreferences } from "../preferences.js";
+import { resolveModelWithFallbacksForUnit } from "../preferences-models.js";
 import { resolveSkillReference } from "../preferences-skills.js";
 import { resolveGsdRootFile, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveTaskFiles, resolveTasksDir, relSliceFile, relSlicePath, relTaskFile } from "../paths.js";
 import { ensureCodebaseMapFresh, readCodebaseMap } from "../codebase-generator.js";
@@ -175,7 +176,13 @@ export async function buildBeforeAgentStartResult(
   const forensicsInjection = !injection ? buildForensicsContextInjection(process.cwd(), event.prompt) : null;
 
   const worktreeBlock = buildWorktreeContextBlock();
-  const fullSystem = `${event.systemPrompt}\n\n[SYSTEM CONTEXT — GSD]\n\n${systemContent}${preferenceBlock}${knowledgeBlock}${codebaseBlock}${memoryBlock}${newSkillsBlock}${worktreeBlock}`;
+
+  const subagentModelConfig = resolveModelWithFallbacksForUnit("subagent");
+  const subagentModelBlock = subagentModelConfig
+    ? `\n\n## Subagent Model\n\nWhen spawning subagents via the \`subagent\` tool, always pass \`model: "${subagentModelConfig.primary}"\` in the tool call parameters. Never omit this — always specify it explicitly.`
+    : "";
+
+  const fullSystem = `${event.systemPrompt}\n\n[SYSTEM CONTEXT — GSD]\n\n${systemContent}${preferenceBlock}${knowledgeBlock}${codebaseBlock}${memoryBlock}${newSkillsBlock}${worktreeBlock}${subagentModelBlock}`;
 
   stopContextTimer({
     systemPromptSize: fullSystem.length,

package/src/resources/extensions/gsd/commands-handlers.ts

@@ -28,6 +28,11 @@ import { loadPrompt } from "./prompt-loader.js";
 const UPDATE_REGISTRY_URL = "https://registry.npmjs.org/gsd-pi/latest";
 const UPDATE_FETCH_TIMEOUT_MS = 5000;
 
+function resolveInstallCommand(pkg: string): string {
+  if ('bun' in process.versions) return `bun add -g ${pkg}`;
+  return `npm install -g ${pkg}`;
+}
+
 async function fetchLatestVersionForCommand(): Promise<string | null> {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), UPDATE_FETCH_TIMEOUT_MS);
@@ -431,8 +436,9 @@ export async function handleUpdate(ctx: ExtensionCommandContext): Promise<void>
 
   ctx.ui.notify(`Updating: v${current} → v${latest}...`, "info");
 
+  const installCmd = resolveInstallCommand(`${NPM_PACKAGE}@latest`);
   try {
-    execSync(`npm install -g ${NPM_PACKAGE}@latest`, {
+    execSync(installCmd, {
       stdio: ["ignore", "pipe", "ignore"],
     });
     ctx.ui.notify(
@@ -441,7 +447,7 @@ export async function handleUpdate(ctx: ExtensionCommandContext): Promise<void>
     );
   } catch {
     ctx.ui.notify(
-      `Update failed. Try manually: npm install -g ${NPM_PACKAGE}@latest`,
+      `Update failed. Try manually: ${installCmd}`,
       "error",
     );
   }

package/src/resources/extensions/gsd/crash-recovery.ts

@@ -15,6 +15,7 @@ import { join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { effectiveLockFile } from "./session-lock.js";
+import { emitJournalEvent, queryJournal } from "./journal.js";
 
 export interface LockData {
   pid: number;
@@ -118,3 +119,61 @@ export function formatCrashInfo(lock: LockData): string {
 
   return lines.join("\n");
 }
+
+/**
+ * Emit a synthetic unit-end event for a unit that crashed without emitting its own.
+ *
+ * Queries the journal to find the most recent unit-start for the crashed unit.
+ * If a matching unit-end already exists (e.g. the hard timeout fired), this is a
+ * no-op. Called during crash recovery, before clearing the stale lock.
+ *
+ * Addresses the gap reported in #3348 where `unit-start` was emitted but no
+ * `unit-end` followed — side effects landed but the worker died before closeout.
+ */
+export function emitCrashRecoveredUnitEnd(basePath: string, lock: LockData): void {
+  // Skip bootstrap / starting pseudo-units — they have no meaningful unit-start event.
+  if (!lock.unitType || !lock.unitId || lock.unitType === "starting") return;
+
+  try {
+    const all = queryJournal(basePath);
+
+    // Find the most recent unit-start for this unitId
+    const starts = all.filter(
+      (e) => e.eventType === "unit-start" && e.data?.unitId === lock.unitId,
+    );
+    if (starts.length === 0) return;
+
+    const lastStart = starts[starts.length - 1];
+
+    // Check if a unit-end was already emitted (e.g. hard timeout fired after the crash)
+    const alreadyClosed = all.some(
+      (e) =>
+        e.eventType === "unit-end" &&
+        e.data?.unitId === lock.unitId &&
+        e.causedBy?.flowId === lastStart.flowId &&
+        e.causedBy?.seq === lastStart.seq,
+    );
+    if (alreadyClosed) return;
+
+    // Find the highest seq in this flow for monotonic ordering
+    const maxSeq = all
+      .filter((e) => e.flowId === lastStart.flowId)
+      .reduce((max, e) => Math.max(max, e.seq), lastStart.seq);
+
+    emitJournalEvent(basePath, {
+      ts: new Date().toISOString(),
+      flowId: lastStart.flowId,
+      seq: maxSeq + 1,
+      eventType: "unit-end",
+      data: {
+        unitType: lock.unitType,
+        unitId: lock.unitId,
+        status: "crash-recovered",
+        artifactVerified: false,
+      },
+      causedBy: { flowId: lastStart.flowId, seq: lastStart.seq },
+    });
+  } catch {
+    // Never throw from crash recovery path — journal failure must not block recovery
+  }
+}

package/src/resources/extensions/gsd/docs/preferences-reference.md

@@ -157,7 +157,7 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
 
 - `phases`: fine-grained control over which phases run. Usually set by `token_profile`, but can be overridden. Keys:
   - `skip_research`: boolean — skip milestone-level research. Default: `false`.
-  - `reassess_after_slice`: boolean — run roadmap reassessment after each completed slice. Default: `false`.
+  - `reassess_after_slice`: boolean — run roadmap reassessment after each completed slice. Default: `true`.
   - `skip_reassess`: boolean — force-disable roadmap reassessment even if `reassess_after_slice` is enabled. Default: `false`.
   - `skip_slice_research`: boolean — skip per-slice research. Default: `false`.
 

package/src/resources/extensions/gsd/gsd-db.ts

@@ -1564,6 +1564,23 @@ export interface TaskRow {
   sequence: number;
 }
 
+function parseTaskArrayColumn(raw: unknown): string[] {
+  if (typeof raw !== "string" || raw.trim() === "") return [];
+
+  try {
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed)) return parsed.map((value) => String(value));
+    if (parsed === null || parsed === undefined || parsed === "") return [];
+    return [String(parsed)];
+  } catch {
+    // Older/corrupt rows may contain comma-separated strings instead of JSON.
+    return raw
+      .split(",")
+      .map((value) => value.trim())
+      .filter(Boolean);
+  }
+}
+
 function rowToTask(row: Record<string, unknown>): TaskRow {
   const parseTaskArray = (value: unknown): string[] => {
     if (Array.isArray(value)) {
@@ -1603,8 +1620,8 @@ function rowToTask(row: Record<string, unknown>): TaskRow {
     blocker_discovered: (row["blocker_discovered"] as number) === 1,
     deviations: row["deviations"] as string,
     known_issues: row["known_issues"] as string,
-    key_files: JSON.parse((row["key_files"] as string) || "[]"),
-    key_decisions: JSON.parse((row["key_decisions"] as string) || "[]"),
+    key_files: parseTaskArrayColumn(row["key_files"]),
+    key_decisions: parseTaskArrayColumn(row["key_decisions"]),
     full_summary_md: row["full_summary_md"] as string,
     description: (row["description"] as string) ?? "",
     estimate: (row["estimate"] as string) ?? "",
@@ -2200,6 +2217,39 @@ export function deleteSlice(milestoneId: string, sliceId: string): void {
   });
 }
 
+export function deleteMilestone(milestoneId: string): void {
+  if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+  transaction(() => {
+    currentDb!.prepare(
+      `DELETE FROM verification_evidence WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM quality_gates WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM tasks WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM slice_dependencies WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM slices WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM replan_history WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM assessments WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM artifacts WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM milestones WHERE id = :mid`,
+    ).run({ ":mid": milestoneId });
+  });
+}
+
 export function updateSliceFields(milestoneId: string, sliceId: string, fields: {
   title?: string;
   risk?: string;

package/src/resources/extensions/gsd/milestone-actions.ts

@@ -20,7 +20,8 @@ import {
 } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
-import { getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { deleteMilestone, getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { removeWorktree } from "./worktree-manager.js";
 import { logWarning } from "./workflow-logger.js";
 
 // ─── Park ──────────────────────────────────────────────────────────────────
@@ -110,6 +111,15 @@ export function discardMilestone(basePath: string, milestoneId: string): boolean
   const mDir = resolveMilestonePath(basePath, milestoneId);
   if (!mDir || !existsSync(mDir)) return false;
 
+  try {
+    removeWorktree(basePath, milestoneId, {
+      branch: `milestone/${milestoneId}`,
+      deleteBranch: true,
+    });
+  } catch (err) {
+    logWarning("engine", `discardMilestone worktree cleanup failed for ${milestoneId}: ${(err as Error).message}`);
+  }
+
   rmSync(mDir, { recursive: true, force: true });
 
   // Prune from queue order if present
@@ -118,6 +128,14 @@ export function discardMilestone(basePath: string, milestoneId: string): boolean
     saveQueueOrder(basePath, order.filter(id => id !== milestoneId));
   }
 
+  if (isDbAvailable()) {
+    try {
+      deleteMilestone(milestoneId);
+    } catch (err) {
+      logWarning("engine", `discardMilestone DB cleanup failed for ${milestoneId}: ${(err as Error).message}`);
+    }
+  }
+
   invalidateAllCaches();
   return true;
 }

package/src/resources/extensions/gsd/notification-widget.ts

@@ -1,6 +1,6 @@
 // GSD Extension — Notification Widget
 // Always-on ambient widget rendered belowEditor showing unread count and
-// the most recent notification message. Refreshes every 5 seconds.
+// the most recent notification message. Refreshes every 30 seconds.
 // Widget key: "gsd-notifications", placement: "belowEditor"
 
 import type { ExtensionContext } from "@gsd/pi-coding-agent";
@@ -19,7 +19,7 @@ export function buildNotificationWidgetLines(): string[] {
 
 // ─── Widget init ────────────────────────────────────────────────────────
 
-const REFRESH_INTERVAL_MS = 5_000;
+const REFRESH_INTERVAL_MS = 30_000;
 
 /**
  * Initialize the always-on notification widget (belowEditor).

package/src/resources/extensions/gsd/preferences-models.ts

@@ -7,6 +7,8 @@
  */
 
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import type { DynamicRoutingConfig } from "./model-router.js";
 import { defaultRoutingConfig } from "./model-router.js";
 import type { TokenProfile, InlineLevel } from "./types.js";
@@ -185,6 +187,45 @@ export function resolveDefaultSessionModel(
   return undefined;
 }
 
+/**
+ * Returns true if `provider` is defined as a custom provider in the user's
+ * `~/.gsd/agent/models.json` (Ollama, vLLM, LM Studio, OpenAI-compatible
+ * proxies, etc.).
+ *
+ * Used by auto-mode bootstrap to decide whether the session model
+ * (set via `/gsd model`) should override `PREFERENCES.md`.  Custom providers
+ * are never reachable from `PREFERENCES.md` (which only knows built-in
+ * providers), so when the user has explicitly selected one, it must take
+ * priority — otherwise auto-mode tries to start the built-in provider from
+ * PREFERENCES.md and fails with "Not logged in · Please run /login" (#4122).
+ *
+ * Reads models.json directly with a lightweight JSON parse to avoid
+ * pulling in the full model-registry at this call site.  Falls back to
+ * `~/.pi/agent/models.json` for parity with `resolveModelsJsonPath()`.
+ * Any read or parse error yields `false` (treat as not-custom) so a
+ * malformed models.json never breaks the session bootstrap.
+ */
+export function isCustomProvider(provider: string | undefined): boolean {
+  if (!provider) return false;
+  const candidates = [
+    join(homedir(), ".gsd", "agent", "models.json"),
+    join(homedir(), ".pi", "agent", "models.json"),
+  ];
+  for (const path of candidates) {
+    if (!existsSync(path)) continue;
+    try {
+      const raw = readFileSync(path, "utf-8");
+      const parsed = JSON.parse(raw) as { providers?: Record<string, unknown> };
+      if (parsed?.providers && Object.prototype.hasOwnProperty.call(parsed.providers, provider)) {
+        return true;
+      }
+    } catch {
+      // Ignore — malformed models.json must not break bootstrap.
+    }
+  }
+  return false;
+}
+
 /**
  * Determines the next fallback model to try when the current model fails.
  * If the current model is not in the configured list, returns the primary model.

package/src/resources/extensions/gsd/preferences-types.ts

@@ -113,6 +113,7 @@ export const KNOWN_PREFERENCE_KEYS = new Set<string>([
   "discuss_preparation",
   "discuss_web_research",
   "discuss_depth",
+  "flat_rate_providers",
 ]);
 
 /** Canonical list of all dispatch unit types. */
@@ -359,6 +360,17 @@ export interface GSDPreferences {
    * Default: "standard".
    */
   discuss_depth?: "quick" | "standard" | "thorough";
+  /**
+   * Extra provider IDs to treat as flat-rate (no cost benefit from dynamic
+   * routing).  Dynamic routing is suppressed for any provider listed here,
+   * in addition to the built-in list (github-copilot, copilot, claude-code)
+   * and any provider auto-detected via `authMode: "externalCli"`.
+   *
+   * Intended for private subscription-backed proxies, enterprise-gated
+   * deployments, and custom CLI wrappers where every request costs the
+   * same regardless of model.  Case-insensitive.
+   */
+  flat_rate_providers?: string[];
 }
 
 export interface LoadedGSDPreferences {