gsd-pi 2.73.0 → 2.73.1-dev.06e4302

package/dist/resources/extensions/gsd/auto-start.js

@@ -38,7 +38,7 @@ import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync, } fro
 import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
-import { resolveDefaultSessionModel, resolveDynamicRoutingConfig } from "./preferences-models.js";
+import { isCustomProvider, resolveDefaultSessionModel, resolveDynamicRoutingConfig, } from "./preferences-models.js";
 import { getSessionModelOverride } from "./session-model-override.js";
 /**
  * Bootstrap a fresh auto-mode session. Handles everything from git init
@@ -195,8 +195,18 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     //
     // This preserves #3517 defaults while honoring explicit runtime model
     // selection for subsequent /gsd runs in the same session.
+    //
+    // Exception (#4122): when the session provider is a custom provider declared
+    // in ~/.gsd/agent/models.json (Ollama, vLLM, OpenAI-compatible proxy, etc.),
+    // PREFERENCES.md is skipped entirely. PREFERENCES.md cannot reference custom
+    // providers, so honoring it would silently reroute auto-mode to a built-in
+    // provider the user is not logged into and surface as "Not logged in · Please
+    // run /login" before pausing and resetting to claude-code/claude-sonnet-4-6.
     const manualSessionOverride = getSessionModelOverride(ctx.sessionManager.getSessionId());
-    const preferredModel = resolveDefaultSessionModel(ctx.model?.provider);
+    const sessionProviderIsCustom = isCustomProvider(ctx.model?.provider);
+    const preferredModel = sessionProviderIsCustom
+        ? null
+        : resolveDefaultSessionModel(ctx.model?.provider);
     // Validate the preferred model against the live registry + provider auth so
     // an unconfigured PREFERENCES.md entry (no API key / OAuth) can't become the
     // start-model snapshot. Without this, every subsequent unit would try to
@@ -622,6 +632,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         ctx.ui.setStatus("gsd-auto", s.stepMode ? "next" : "auto");
         ctx.ui.setFooter(hideFooter);
+        // Hide gsd-health during AUTO — gsd-progress is the single source of truth
+        // for last-commit / cost / health signal while auto is running.
+        ctx.ui.setWidget("gsd-health", undefined);
         const modeLabel = s.stepMode ? "Step-mode" : "Auto-mode";
         const pendingCount = (state.registry ?? []).filter((m) => m.status !== "complete" && m.status !== "parked").length;
         const scopeMsg = pendingCount > 1
@@ -636,12 +649,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         const startModelLabel = s.autoModeStartModel
             ? `${s.autoModeStartModel.provider}/${s.autoModeStartModel.id}`
             : ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : "default";
-        // Flat-rate providers (e.g. GitHub Copilot, claude-code) suppress routing
-        // at dispatch time (#3453) — reflect that in the banner.
-        const { isFlatRateProvider } = await import("./auto-model-selection.js");
+        // Flat-rate providers (e.g. GitHub Copilot, claude-code, user-declared
+        // subscription proxies, externalCli CLIs) suppress routing at dispatch
+        // time (#3453) — reflect that in the banner.  Thread the same
+        // FlatRateContext used by selectAndApplyModel so user-declared
+        // flat-rate providers and externalCli auto-detection are respected.
+        const { isFlatRateProvider, buildFlatRateContext } = await import("./auto-model-selection.js");
+        const bannerPrefs = loadEffectiveGSDPreferences()?.preferences;
         const effectiveProvider = s.autoModeStartModel?.provider ?? ctx.model?.provider;
         const effectivelyEnabled = routingConfig.enabled
-            && !(effectiveProvider && isFlatRateProvider(effectiveProvider));
+            && !(effectiveProvider && isFlatRateProvider(effectiveProvider, buildFlatRateContext(effectiveProvider, ctx, bannerPrefs)));
         // The actual ceiling may come from tier_models.heavy, not the start model.
         const effectiveCeiling = (routingConfig.enabled && routingConfig.tier_models?.heavy)
             ? routingConfig.tier_models.heavy

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -156,6 +156,19 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: steering ${unitType} ${unitId} to produce ${expected} (attempt ${attemptNumber}, session ${recoveryAttempts + 1}/${maxRecoveryAttempts}).`, "warning");
         return "recovered";
     }
+    // #4175: For complete-milestone, never write a blocker placeholder — a stub
+    // SUMMARY has no recovery value (milestone is terminal), it does not update
+    // DB status, and downstream merge paths can treat the stub as a legitimate
+    // completion signal. Pause instead so the worktree branch is preserved.
+    if (unitType === "complete-milestone") {
+        writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
+            phase: "paused",
+            recoveryAttempts: recoveryAttempts + 1,
+            lastRecoveryReason: reason,
+        });
+        ctx.ui.notify(`Milestone ${unitId} ${reason}-recovery exhausted ${maxRecoveryAttempts} attempt(s) — worktree branch preserved. Re-run /gsd auto once blockers are resolved.`, "error");
+        return "paused";
+    }
     // Retries exhausted — write a blocker placeholder and advance the pipeline
     // instead of silently stalling.
     const placeholder = writeBlockerPlaceholder(unitType, unitId, basePath, `${reason} recovery exhausted ${maxRecoveryAttempts} attempts without producing the artifact.`);

package/dist/resources/extensions/gsd/auto-verification.js

@@ -10,10 +10,15 @@
  * checks the result and handles control flow.
  */
 import { mkdirSync, writeFileSync } from "node:fs";
-import { resolveSlicePath } from "./paths.js";
+import { resolveSlicePath, resolveMilestoneFile } from "./paths.js";
 import { parseUnitId } from "./unit-id.js";
-import { isDbAvailable, getTask, getSliceTasks } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSliceTasks, getMilestoneSlices } from "./gsd-db.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
+import { extractVerdict } from "./verdict-parser.js";
+import { isClosedStatus } from "./status-guards.js";
+import { loadFile } from "./files.js";
+import { parseRoadmap } from "./parsers-legacy.js";
+import { isMilestoneComplete } from "./state.js";
 import { runVerificationGate, formatFailureContext, captureRuntimeErrors, runDependencyAudit, } from "./verification-gate.js";
 import { writeVerificationJSON } from "./verification-evidence.js";
 import { logWarning } from "./workflow-logger.js";
@@ -22,6 +27,80 @@ import { join } from "node:path";
 function isInfraVerificationFailure(stderr) {
     return /\b(ENOENT|ENOTFOUND|ETIMEDOUT|ECONNRESET|EAI_AGAIN|spawn\s+\S+\s+ENOENT|command not found)\b/i.test(stderr);
 }
+/**
+ * Post-unit guard for `validate-milestone` units (#4094).
+ *
+ * When validate-milestone writes verdict=needs-remediation, the agent is
+ * expected to also call gsd_reassess_roadmap in the same turn to add
+ * remediation slices. If they don't, the state machine re-derives
+ * `phase: validating-milestone` indefinitely (all slices still complete +
+ * verdict still needs-remediation), wasting ~3 dispatches before the stuck
+ * detector fires.
+ *
+ * This guard fires immediately on the first occurrence: if VALIDATION.md
+ * verdict is needs-remediation and no incomplete slices exist for the
+ * milestone, pause the auto-loop with a clear blocker.
+ */
+async function runValidateMilestonePostCheck(vctx, pauseAuto) {
+    const { s, ctx, pi } = vctx;
+    if (!s.currentUnit)
+        return "continue";
+    const { milestone: mid } = parseUnitId(s.currentUnit.id);
+    if (!mid)
+        return "continue";
+    const validationFile = resolveMilestoneFile(s.basePath, mid, "VALIDATION");
+    if (!validationFile)
+        return "continue";
+    const validationContent = await loadFile(validationFile);
+    if (!validationContent)
+        return "continue";
+    const verdict = extractVerdict(validationContent);
+    if (verdict !== "needs-remediation")
+        return "continue";
+    const incompleteSliceCount = await countIncompleteSlices(s.basePath, mid);
+    // If any non-closed slices exist, the agent successfully queued remediation
+    // work — proceed normally. The state machine will execute those slices and
+    // re-validate per the #3596/#3670 fix.
+    if (incompleteSliceCount > 0)
+        return "continue";
+    ctx.ui.notify(`Milestone ${mid} validation returned verdict=needs-remediation but no remediation slices were added. Pausing for human review.`, "error");
+    process.stderr.write(`validate-milestone: pausing — verdict=needs-remediation with no incomplete slices for ${mid}. ` +
+        `The agent must call gsd_reassess_roadmap to add remediation slices before re-validation.\n`);
+    await pauseAuto(ctx, pi);
+    return "pause";
+}
+/**
+ * Count slices for a milestone that are not in a closed status.
+ * DB-backed projects are authoritative (#4094 peer review); falls back to
+ * roadmap parsing only when the DB is unavailable.
+ */
+async function countIncompleteSlices(basePath, milestoneId) {
+    if (isDbAvailable()) {
+        const slices = getMilestoneSlices(milestoneId);
+        if (slices.length === 0) {
+            // No DB rows — treat as "unknown", do not pause.
+            return 1;
+        }
+        return slices.filter((slice) => !isClosedStatus(slice.status)).length;
+    }
+    // Filesystem fallback: parse the roadmap markdown.
+    try {
+        const roadmapFile = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
+        if (!roadmapFile)
+            return 1;
+        const roadmapContent = await loadFile(roadmapFile);
+        if (!roadmapContent)
+            return 1;
+        const roadmap = parseRoadmap(roadmapContent);
+        if (roadmap.slices.length === 0)
+            return 1;
+        return isMilestoneComplete(roadmap) ? 0 : 1;
+    }
+    catch {
+        // Parsing failures should not cause false-positive pauses.
+        return 1;
+    }
+}
 /**
  * Run the verification gate for the current execute-task unit.
  * Returns:
@@ -31,7 +110,13 @@ function isInfraVerificationFailure(stderr) {
  */
 export async function runPostUnitVerification(vctx, pauseAuto) {
     const { s, ctx, pi } = vctx;
-    if (!s.currentUnit || s.currentUnit.type !== "execute-task") {
+    if (!s.currentUnit) {
+        return "continue";
+    }
+    if (s.currentUnit.type === "validate-milestone") {
+        return await runValidateMilestonePostCheck(vctx, pauseAuto);
+    }
+    if (s.currentUnit.type !== "execute-task") {
         return "continue";
     }
     try {

package/dist/resources/extensions/gsd/auto.js

@@ -19,7 +19,7 @@ import { gsdRoot, resolveMilestoneFile, resolveMilestonePath, resolveDir, milest
 import { invalidateAllCaches } from "./cache.js";
 import { clearActivityLogState } from "./activity-log.js";
 import { synthesizeCrashRecovery, getDeepDiagnostic, readActiveMilestoneId, } from "./session-forensics.js";
-import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, } from "./crash-recovery.js";
+import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, } from "./crash-recovery.js";
 import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, } from "./preferences.js";
 import { sendDesktopNotification } from "./notifications.js";
@@ -55,7 +55,7 @@ import { initRegistry, convertDispatchRules } from "./rule-registry.js";
 import { emitJournalEvent as _emitJournalEvent } from "./journal.js";
 import { updateProgressWidget as _updateProgressWidget, updateSliceProgressCache, clearSliceProgressCache, hideFooter, } from "./auto-dashboard.js";
 import { registerSigtermHandler as _registerSigtermHandler, deregisterSigtermHandler as _deregisterSigtermHandler, } from "./auto-supervisor.js";
-import { isDbAvailable } from "./gsd-db.js";
+import { isDbAvailable, getMilestone } from "./gsd-db.js";
 import { countPendingCaptures } from "./captures.js";
 import { clearCmuxSidebar, logCmuxEvent, syncCmuxSidebar } from "../cmux/index.js";
 // ── Extracted modules ──────────────────────────────────────────────────────
@@ -63,6 +63,7 @@ import { startUnitSupervision } from "./auto-timers.js";
 import { runPostUnitVerification } from "./auto-verification.js";
 import { postUnitPreVerification, postUnitPostVerification, } from "./auto-post-unit.js";
 import { bootstrapAutoSession, openProjectDbIfPresent } from "./auto-start.js";
+import { initHealthWidget } from "./health-widget.js";
 import { autoLoop, resolveAgentEnd, resolveAgentEndCancelled, _resetPendingResolve, isSessionSwitchInFlight } from "./auto-loop.js";
 import { WorktreeResolver, } from "./worktree-resolver.js";
 import { reorderForCaching } from "./prompt-ordering.js";
@@ -397,6 +398,8 @@ function handleLostSessionLock(ctx, lockStatus) {
     ctx?.ui.setStatus("gsd-auto", undefined);
     ctx?.ui.setWidget("gsd-progress", undefined);
     ctx?.ui.setFooter(undefined);
+    if (ctx)
+        initHealthWidget(ctx);
 }
 /**
  * Lightweight cleanup after autoLoop exits via step-wizard break.
@@ -431,6 +434,7 @@ function cleanupAfterLoopExit(ctx) {
         ctx.ui.setStatus("gsd-auto", undefined);
         ctx.ui.setWidget("gsd-progress", undefined);
         ctx.ui.setFooter(undefined);
+        initHealthWidget(ctx);
     }
     // Restore CWD out of worktree back to original project root
     if (s.originalBasePath) {
@@ -501,17 +505,30 @@ export async function stopAuto(ctx, pi, reason) {
                     ? { notify: ctx.ui.notify.bind(ctx.ui) }
                     : { notify: () => { } };
                 const resolver = buildResolver();
-                // Check if the milestone is complete — SUMMARY file is the authoritative signal.
+                // Check if the milestone is complete. DB status is the authoritative
+                // signal — only a successful gsd_complete_milestone call flips it to
+                // "complete" (tools/complete-milestone.ts). SUMMARY file presence is
+                // NOT sufficient: a blocker placeholder stub or a partial write can
+                // leave a file behind without the milestone actually being done,
+                // which previously caused stopAuto to merge a failed milestone and
+                // emit a misleading metadata-only merge warning (#4175).
+                // DB-unavailable projects fall back to SUMMARY-file presence.
                 let milestoneComplete = false;
                 try {
-                    const summaryPath = resolveMilestoneFile(s.originalBasePath || s.basePath, s.currentMilestoneId, "SUMMARY");
-                    if (!summaryPath) {
-                        // Also check in the worktree path (SUMMARY may not be synced yet)
-                        const wtSummaryPath = resolveMilestoneFile(s.basePath, s.currentMilestoneId, "SUMMARY");
-                        milestoneComplete = wtSummaryPath !== null;
+                    if (isDbAvailable()) {
+                        const dbRow = getMilestone(s.currentMilestoneId);
+                        milestoneComplete = dbRow?.status === "complete";
                     }
                     else {
-                        milestoneComplete = true;
+                        const summaryPath = resolveMilestoneFile(s.originalBasePath || s.basePath, s.currentMilestoneId, "SUMMARY");
+                        if (!summaryPath) {
+                            // Also check in the worktree path (SUMMARY may not be synced yet)
+                            const wtSummaryPath = resolveMilestoneFile(s.basePath, s.currentMilestoneId, "SUMMARY");
+                            milestoneComplete = wtSummaryPath !== null;
+                        }
+                        else {
+                            milestoneComplete = true;
+                        }
                     }
                 }
                 catch (err) {
@@ -676,6 +693,8 @@ export async function stopAuto(ctx, pi, reason) {
         ctx?.ui.setStatus("gsd-auto", undefined);
         ctx?.ui.setWidget("gsd-progress", undefined);
         ctx?.ui.setFooter(undefined);
+        if (ctx)
+            initHealthWidget(ctx);
         restoreProjectRootEnv();
         restoreMilestoneLockEnv();
         // Reset all session state in one call
@@ -762,6 +781,8 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     ctx?.ui.setStatus("gsd-auto", "paused");
     ctx?.ui.setWidget("gsd-progress", undefined);
     ctx?.ui.setFooter(undefined);
+    if (ctx)
+        initHealthWidget(ctx);
     const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
     ctx?.ui.notify(`${s.stepMode ? "Step" : "Auto"}-mode paused (Escape). Type to interact, or ${resumeCmd} to resume.`, "info");
 }
@@ -1014,6 +1035,10 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         s.stepMode = requestedStepMode;
     }
     if (freshStartAssessment.lock) {
+        // Emit a synthetic unit-end for any unit-start that has no closing event.
+        // This closes the journal gap reported in #3348 where the worker wrote side
+        // effects (SUMMARY.md, DB updates) but died before emitting unit-end.
+        emitCrashRecoveredUnitEnd(base, freshStartAssessment.lock);
         clearLock(base);
     }
     if (!s.paused) {

package/dist/resources/extensions/gsd/bootstrap/crash-log.js

@@ -0,0 +1,31 @@
+/**
+ * crash-log.ts — Write crash diagnostics to ~/.gsd/crash/<timestamp>.log
+ *
+ * Zero cross-dependencies: only uses Node.js built-ins so it can be imported
+ * safely from uncaughtException / unhandledRejection handlers and from tests
+ * without pulling in the full extension dependency tree.
+ */
+import { appendFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * Write a crash log to ~/.gsd/crash/<timestamp>.log (or $GSD_HOME/crash/).
+ * Never throws — must be safe to call from any error handler.
+ */
+export function writeCrashLog(err, source) {
+    try {
+        const crashDir = join(process.env.GSD_HOME ?? join(homedir(), ".gsd"), "crash");
+        mkdirSync(crashDir, { recursive: true });
+        const ts = new Date().toISOString().replace(/[:.]/g, "-");
+        const logPath = join(crashDir, `${ts}.log`);
+        const lines = [
+            `[gsd] ${source}: ${err.message}`,
+            `timestamp: ${new Date().toISOString()}`,
+            `pid: ${process.pid}`,
+            err.stack ?? "(no stack trace available)",
+            "",
+        ];
+        appendFileSync(logPath, lines.join("\n"));
+    }
+    catch { /* never throw from crash handler */ }
+}

package/dist/resources/extensions/gsd/bootstrap/register-extension.js

@@ -8,6 +8,8 @@ import { registerJournalTools } from "./journal-tools.js";
 import { registerQueryTools } from "./query-tools.js";
 import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
+import { writeCrashLog } from "./crash-log.js";
+export { writeCrashLog } from "./crash-log.js";
 export function handleRecoverableExtensionProcessError(err) {
     if (err.code === "EPIPE") {
         process.exit(0);
@@ -28,17 +30,26 @@ export function handleRecoverableExtensionProcessError(err) {
 function installEpipeGuard() {
     if (!process.listeners("uncaughtException").some((listener) => listener.name === "_gsdEpipeGuard")) {
         const _gsdEpipeGuard = (err) => {
-            if (handleRecoverableExtensionProcessError(err)) {
+            if (handleRecoverableExtensionProcessError(err))
                 return;
-            }
-            // Log unhandled errors instead of re-throwing — throwing inside an
-            // uncaughtException handler is a fatal double-fault in Node.js (#3163).
-            process.stderr.write(`[gsd] uncaught extension error (non-fatal): ${err.message}\n`);
-            if (err.stack)
-                process.stderr.write(`${err.stack}\n`);
+            // Write crash log and exit cleanly for unrecoverable errors.
+            // Logging and continuing was the original double-fault fix (#3163), but
+            // continuing in an indeterminate state is worse than a clean exit (#3348).
+            writeCrashLog(err, "uncaughtException");
+            process.exit(1);
         };
         process.on("uncaughtException", _gsdEpipeGuard);
     }
+    if (!process.listeners("unhandledRejection").some((listener) => listener.name === "_gsdRejectionGuard")) {
+        const _gsdRejectionGuard = (reason, _promise) => {
+            const err = reason instanceof Error ? reason : new Error(String(reason));
+            if (handleRecoverableExtensionProcessError(err))
+                return;
+            writeCrashLog(err, "unhandledRejection");
+            process.exit(1);
+        };
+        process.on("unhandledRejection", _gsdRejectionGuard);
+    }
 }
 export function registerGsdExtension(pi) {
     registerGSDCommand(pi);

package/dist/resources/extensions/gsd/bootstrap/system-context.js

@@ -6,6 +6,7 @@ import { debugTime } from "../debug-logger.js";
 import { loadPrompt, getTemplatesDir } from "../prompt-loader.js";
 import { readForensicsMarker } from "../forensics.js";
 import { resolveAllSkillReferences, renderPreferencesForSystemPrompt, loadEffectiveGSDPreferences } from "../preferences.js";
+import { resolveModelWithFallbacksForUnit } from "../preferences-models.js";
 import { resolveSkillReference } from "../preferences-skills.js";
 import { resolveGsdRootFile, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveTaskFiles, resolveTasksDir, relSliceFile, relSlicePath, relTaskFile } from "../paths.js";
 import { ensureCodebaseMapFresh, readCodebaseMap } from "../codebase-generator.js";
@@ -147,7 +148,11 @@ export async function buildBeforeAgentStartResult(event, ctx) {
     // Re-inject forensics context on follow-up turns (#2941)
     const forensicsInjection = !injection ? buildForensicsContextInjection(process.cwd(), event.prompt) : null;
     const worktreeBlock = buildWorktreeContextBlock();
-    const fullSystem = `${event.systemPrompt}\n\n[SYSTEM CONTEXT — GSD]\n\n${systemContent}${preferenceBlock}${knowledgeBlock}${codebaseBlock}${memoryBlock}${newSkillsBlock}${worktreeBlock}`;
+    const subagentModelConfig = resolveModelWithFallbacksForUnit("subagent");
+    const subagentModelBlock = subagentModelConfig
+        ? `\n\n## Subagent Model\n\nWhen spawning subagents via the \`subagent\` tool, always pass \`model: "${subagentModelConfig.primary}"\` in the tool call parameters. Never omit this — always specify it explicitly.`
+        : "";
+    const fullSystem = `${event.systemPrompt}\n\n[SYSTEM CONTEXT — GSD]\n\n${systemContent}${preferenceBlock}${knowledgeBlock}${codebaseBlock}${memoryBlock}${newSkillsBlock}${worktreeBlock}${subagentModelBlock}`;
     stopContextTimer({
         systemPromptSize: fullSystem.length,
         injectionSize: injection?.length ?? forensicsInjection?.length ?? 0,

package/dist/resources/extensions/gsd/commands-handlers.js

@@ -17,6 +17,11 @@ import { projectRoot } from "./commands/context.js";
 import { loadPrompt } from "./prompt-loader.js";
 const UPDATE_REGISTRY_URL = "https://registry.npmjs.org/gsd-pi/latest";
 const UPDATE_FETCH_TIMEOUT_MS = 5000;
+function resolveInstallCommand(pkg) {
+    if ('bun' in process.versions)
+        return `bun add -g ${pkg}`;
+    return `npm install -g ${pkg}`;
+}
 async function fetchLatestVersionForCommand() {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), UPDATE_FETCH_TIMEOUT_MS);
@@ -344,13 +349,14 @@ export async function handleUpdate(ctx) {
         return;
     }
     ctx.ui.notify(`Updating: v${current} → v${latest}...`, "info");
+    const installCmd = resolveInstallCommand(`${NPM_PACKAGE}@latest`);
     try {
-        execSync(`npm install -g ${NPM_PACKAGE}@latest`, {
+        execSync(installCmd, {
             stdio: ["ignore", "pipe", "ignore"],
         });
         ctx.ui.notify(`Updated to v${latest}. Restart your GSD session to use the new version.`, "info");
     }
     catch {
-        ctx.ui.notify(`Update failed. Try manually: npm install -g ${NPM_PACKAGE}@latest`, "error");
+        ctx.ui.notify(`Update failed. Try manually: ${installCmd}`, "error");
     }
 }

package/dist/resources/extensions/gsd/crash-recovery.js

@@ -14,6 +14,7 @@ import { join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { effectiveLockFile } from "./session-lock.js";
+import { emitJournalEvent, queryJournal } from "./journal.js";
 function lockPath(basePath) {
     return join(gsdRoot(basePath), effectiveLockFile());
 }
@@ -110,3 +111,53 @@ export function formatCrashInfo(lock) {
     }
     return lines.join("\n");
 }
+/**
+ * Emit a synthetic unit-end event for a unit that crashed without emitting its own.
+ *
+ * Queries the journal to find the most recent unit-start for the crashed unit.
+ * If a matching unit-end already exists (e.g. the hard timeout fired), this is a
+ * no-op. Called during crash recovery, before clearing the stale lock.
+ *
+ * Addresses the gap reported in #3348 where `unit-start` was emitted but no
+ * `unit-end` followed — side effects landed but the worker died before closeout.
+ */
+export function emitCrashRecoveredUnitEnd(basePath, lock) {
+    // Skip bootstrap / starting pseudo-units — they have no meaningful unit-start event.
+    if (!lock.unitType || !lock.unitId || lock.unitType === "starting")
+        return;
+    try {
+        const all = queryJournal(basePath);
+        // Find the most recent unit-start for this unitId
+        const starts = all.filter((e) => e.eventType === "unit-start" && e.data?.unitId === lock.unitId);
+        if (starts.length === 0)
+            return;
+        const lastStart = starts[starts.length - 1];
+        // Check if a unit-end was already emitted (e.g. hard timeout fired after the crash)
+        const alreadyClosed = all.some((e) => e.eventType === "unit-end" &&
+            e.data?.unitId === lock.unitId &&
+            e.causedBy?.flowId === lastStart.flowId &&
+            e.causedBy?.seq === lastStart.seq);
+        if (alreadyClosed)
+            return;
+        // Find the highest seq in this flow for monotonic ordering
+        const maxSeq = all
+            .filter((e) => e.flowId === lastStart.flowId)
+            .reduce((max, e) => Math.max(max, e.seq), lastStart.seq);
+        emitJournalEvent(basePath, {
+            ts: new Date().toISOString(),
+            flowId: lastStart.flowId,
+            seq: maxSeq + 1,
+            eventType: "unit-end",
+            data: {
+                unitType: lock.unitType,
+                unitId: lock.unitId,
+                status: "crash-recovered",
+                artifactVerified: false,
+            },
+            causedBy: { flowId: lastStart.flowId, seq: lastStart.seq },
+        });
+    }
+    catch {
+        // Never throw from crash recovery path — journal failure must not block recovery
+    }
+}

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -157,7 +157,7 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
 
 - `phases`: fine-grained control over which phases run. Usually set by `token_profile`, but can be overridden. Keys:
   - `skip_research`: boolean — skip milestone-level research. Default: `false`.
-  - `reassess_after_slice`: boolean — run roadmap reassessment after each completed slice. Default: `false`.
+  - `reassess_after_slice`: boolean — run roadmap reassessment after each completed slice. Default: `true`.
   - `skip_reassess`: boolean — force-disable roadmap reassessment even if `reassess_after_slice` is enabled. Default: `false`.
   - `skip_slice_research`: boolean — skip per-slice research. Default: `false`.
 

package/dist/resources/extensions/gsd/gsd-db.js

@@ -1352,6 +1352,25 @@ export function setSliceSummaryMd(milestoneId, sliceId, summaryMd, uatMd) {
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
     currentDb.prepare(`UPDATE slices SET full_summary_md = :summary_md, full_uat_md = :uat_md WHERE milestone_id = :mid AND id = :sid`).run({ ":mid": milestoneId, ":sid": sliceId, ":summary_md": summaryMd, ":uat_md": uatMd });
 }
+function parseTaskArrayColumn(raw) {
+    if (typeof raw !== "string" || raw.trim() === "")
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed))
+            return parsed.map((value) => String(value));
+        if (parsed === null || parsed === undefined || parsed === "")
+            return [];
+        return [String(parsed)];
+    }
+    catch {
+        // Older/corrupt rows may contain comma-separated strings instead of JSON.
+        return raw
+            .split(",")
+            .map((value) => value.trim())
+            .filter(Boolean);
+    }
+}
 function rowToTask(row) {
     const parseTaskArray = (value) => {
         if (Array.isArray(value)) {
@@ -1390,8 +1409,8 @@ function rowToTask(row) {
         blocker_discovered: row["blocker_discovered"] === 1,
         deviations: row["deviations"],
         known_issues: row["known_issues"],
-        key_files: JSON.parse(row["key_files"] || "[]"),
-        key_decisions: JSON.parse(row["key_decisions"] || "[]"),
+        key_files: parseTaskArrayColumn(row["key_files"]),
+        key_decisions: parseTaskArrayColumn(row["key_decisions"]),
         full_summary_md: row["full_summary_md"],
         description: row["description"] ?? "",
         estimate: row["estimate"] ?? "",
@@ -1855,6 +1874,21 @@ export function deleteSlice(milestoneId, sliceId) {
         currentDb.prepare(`DELETE FROM slices WHERE milestone_id = :mid AND id = :sid`).run({ ":mid": milestoneId, ":sid": sliceId });
     });
 }
+export function deleteMilestone(milestoneId) {
+    if (!currentDb)
+        throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+    transaction(() => {
+        currentDb.prepare(`DELETE FROM verification_evidence WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM quality_gates WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM tasks WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM slice_dependencies WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM slices WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM replan_history WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM assessments WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM artifacts WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM milestones WHERE id = :mid`).run({ ":mid": milestoneId });
+    });
+}
 export function updateSliceFields(milestoneId, sliceId, fields) {
     if (!currentDb)
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");

package/dist/resources/extensions/gsd/milestone-actions.js

@@ -15,7 +15,8 @@ import { join } from "node:path";
 import { resolveMilestonePath, resolveMilestoneFile, buildMilestoneFileName, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
-import { getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { deleteMilestone, getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { removeWorktree } from "./worktree-manager.js";
 import { logWarning } from "./workflow-logger.js";
 // ─── Park ──────────────────────────────────────────────────────────────────
 /**
@@ -99,12 +100,29 @@ export function discardMilestone(basePath, milestoneId) {
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;
+    try {
+        removeWorktree(basePath, milestoneId, {
+            branch: `milestone/${milestoneId}`,
+            deleteBranch: true,
+        });
+    }
+    catch (err) {
+        logWarning("engine", `discardMilestone worktree cleanup failed for ${milestoneId}: ${err.message}`);
+    }
     rmSync(mDir, { recursive: true, force: true });
     // Prune from queue order if present
     const order = loadQueueOrder(basePath);
     if (order && order.includes(milestoneId)) {
         saveQueueOrder(basePath, order.filter(id => id !== milestoneId));
     }
+    if (isDbAvailable()) {
+        try {
+            deleteMilestone(milestoneId);
+        }
+        catch (err) {
+            logWarning("engine", `discardMilestone DB cleanup failed for ${milestoneId}: ${err.message}`);
+        }
+    }
     invalidateAllCaches();
     return true;
 }

package/dist/resources/extensions/gsd/notification-widget.js

@@ -1,6 +1,6 @@
 // GSD Extension — Notification Widget
 // Always-on ambient widget rendered belowEditor showing unread count and
-// the most recent notification message. Refreshes every 5 seconds.
+// the most recent notification message. Refreshes every 30 seconds.
 // Widget key: "gsd-notifications", placement: "belowEditor"
 import { getUnreadCount, onNotificationStoreChange } from "./notification-store.js";
 import { formattedShortcutPair } from "./shortcut-defs.js";
@@ -12,7 +12,7 @@ export function buildNotificationWidgetLines() {
     return [`  🔔 Notifications: ${unread} unread  (${formattedShortcutPair("notifications")})`];
 }
 // ─── Widget init ────────────────────────────────────────────────────────
-const REFRESH_INTERVAL_MS = 5_000;
+const REFRESH_INTERVAL_MS = 30_000;
 /**
  * Initialize the always-on notification widget (belowEditor).
  * Call once from session_start after the notification store is initialized.