gsd-pi 2.74.0 → 2.75.0-dev.2203010a0

package/src/resources/extensions/gsd/memory-store.ts

@@ -3,7 +3,19 @@
 // Storage layer for auto-learned project memories. Follows context-store.ts patterns.
 // All functions degrade gracefully: return empty results when DB unavailable, never throw.
 
-import { isDbAvailable, _getAdapter, transaction } from './gsd-db.js';
+import {
+  isDbAvailable,
+  _getAdapter,
+  transaction,
+  insertMemoryRow,
+  rewriteMemoryId,
+  updateMemoryContentRow,
+  incrementMemoryHitCount,
+  supersedeMemoryRow,
+  markMemoryUnitProcessed,
+  decayMemoriesBefore,
+  supersedeLowestRankedMemories,
+} from './gsd-db.js';
 
 // ─── Types ──────────────────────────────────────────────────────────────────
 
@@ -170,28 +182,22 @@ export function createMemory(fields: {
     const now = new Date().toISOString();
     // Insert with a temporary placeholder ID — seq is auto-assigned
     const placeholder = `_TMP_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-    adapter.prepare(
-      `INSERT INTO memories (id, category, content, confidence, source_unit_type, source_unit_id, created_at, updated_at)
-       VALUES (:id, :category, :content, :confidence, :source_unit_type, :source_unit_id, :created_at, :updated_at)`,
-    ).run({
-      ':id': placeholder,
-      ':category': fields.category,
-      ':content': fields.content,
-      ':confidence': fields.confidence ?? 0.8,
-      ':source_unit_type': fields.source_unit_type ?? null,
-      ':source_unit_id': fields.source_unit_id ?? null,
-      ':created_at': now,
-      ':updated_at': now,
+    insertMemoryRow({
+      id: placeholder,
+      category: fields.category,
+      content: fields.content,
+      confidence: fields.confidence ?? 0.8,
+      sourceUnitType: fields.source_unit_type ?? null,
+      sourceUnitId: fields.source_unit_id ?? null,
+      createdAt: now,
+      updatedAt: now,
     });
-    // Derive the real ID from the assigned seq
+    // Derive the real ID from the assigned seq (SELECT is still fine via adapter)
     const row = adapter.prepare('SELECT seq FROM memories WHERE id = :id').get({ ':id': placeholder });
     if (!row) return placeholder; // fallback — should not happen
     const seq = row['seq'] as number;
     const realId = `MEM${String(seq).padStart(3, '0')}`;
-    adapter.prepare('UPDATE memories SET id = :real_id WHERE id = :placeholder').run({
-      ':real_id': realId,
-      ':placeholder': placeholder,
-    });
+    rewriteMemoryId(placeholder, realId);
     return realId;
   } catch {
     return null;
@@ -203,20 +209,9 @@ export function createMemory(fields: {
  */
 export function updateMemoryContent(id: string, content: string, confidence?: number): boolean {
   if (!isDbAvailable()) return false;
-  const adapter = _getAdapter();
-  if (!adapter) return false;
 
   try {
-    const now = new Date().toISOString();
-    if (confidence != null) {
-      adapter.prepare(
-        'UPDATE memories SET content = :content, confidence = :confidence, updated_at = :updated_at WHERE id = :id',
-      ).run({ ':content': content, ':confidence': confidence, ':updated_at': now, ':id': id });
-    } else {
-      adapter.prepare(
-        'UPDATE memories SET content = :content, updated_at = :updated_at WHERE id = :id',
-      ).run({ ':content': content, ':updated_at': now, ':id': id });
-    }
+    updateMemoryContentRow(id, content, confidence, new Date().toISOString());
     return true;
   } catch {
     return false;
@@ -228,13 +223,9 @@ export function updateMemoryContent(id: string, content: string, confidence?: nu
  */
 export function reinforceMemory(id: string): boolean {
   if (!isDbAvailable()) return false;
-  const adapter = _getAdapter();
-  if (!adapter) return false;
 
   try {
-    adapter.prepare(
-      'UPDATE memories SET hit_count = hit_count + 1, updated_at = :updated_at WHERE id = :id',
-    ).run({ ':updated_at': new Date().toISOString(), ':id': id });
+    incrementMemoryHitCount(id, new Date().toISOString());
     return true;
   } catch {
     return false;
@@ -246,13 +237,9 @@ export function reinforceMemory(id: string): boolean {
  */
 export function supersedeMemory(oldId: string, newId: string): boolean {
   if (!isDbAvailable()) return false;
-  const adapter = _getAdapter();
-  if (!adapter) return false;
 
   try {
-    adapter.prepare(
-      'UPDATE memories SET superseded_by = :new_id, updated_at = :updated_at WHERE id = :old_id',
-    ).run({ ':new_id': newId, ':updated_at': new Date().toISOString(), ':old_id': oldId });
+    supersedeMemoryRow(oldId, newId, new Date().toISOString());
     return true;
   } catch {
     return false;
@@ -284,14 +271,9 @@ export function isUnitProcessed(unitKey: string): boolean {
  */
 export function markUnitProcessed(unitKey: string, activityFile: string): boolean {
   if (!isDbAvailable()) return false;
-  const adapter = _getAdapter();
-  if (!adapter) return false;
 
   try {
-    adapter.prepare(
-      `INSERT OR IGNORE INTO memory_processed_units (unit_key, activity_file, processed_at)
-       VALUES (:key, :file, :at)`,
-    ).run({ ':key': unitKey, ':file': activityFile, ':at': new Date().toISOString() });
+    markMemoryUnitProcessed(unitKey, activityFile, new Date().toISOString());
     return true;
   } catch {
     return false;
@@ -310,7 +292,7 @@ export function decayStaleMemories(thresholdUnits = 20): void {
   if (!adapter) return;
 
   try {
-    // Find the timestamp of the Nth most recent processed unit
+    // Find the timestamp of the Nth most recent processed unit (read-only SELECT)
     const row = adapter.prepare(
       `SELECT processed_at FROM memory_processed_units
        ORDER BY processed_at DESC
@@ -320,11 +302,7 @@ export function decayStaleMemories(thresholdUnits = 20): void {
     if (!row) return; // not enough processed units yet
 
     const cutoff = row['processed_at'] as string;
-    adapter.prepare(
-      `UPDATE memories
-       SET confidence = MAX(0.1, confidence - 0.1), updated_at = :now
-       WHERE superseded_by IS NULL AND updated_at < :cutoff AND confidence > 0.1`,
-    ).run({ ':now': new Date().toISOString(), ':cutoff': cutoff });
+    decayMemoriesBefore(cutoff, new Date().toISOString());
   } catch {
     // non-fatal
   }
@@ -346,16 +324,7 @@ export function enforceMemoryCap(max = 50): void {
     if (count <= max) return;
 
     const excess = count - max;
-    // Batch update: supersede lowest-ranked active memories in a single statement
-    adapter.prepare(
-      `UPDATE memories SET superseded_by = 'CAP_EXCEEDED', updated_at = :now
-       WHERE id IN (
-         SELECT id FROM memories
-         WHERE superseded_by IS NULL
-         ORDER BY (confidence * (1.0 + hit_count * 0.1)) ASC
-         LIMIT :limit
-       )`,
-    ).run({ ':now': new Date().toISOString(), ':limit': excess });
+    supersedeLowestRankedMemories(excess, new Date().toISOString());
   } catch {
     // non-fatal
   }

package/src/resources/extensions/gsd/metrics.ts

@@ -19,6 +19,8 @@ import { gsdRoot } from "./paths.js";
 import { getAndClearSkills } from "./skill-telemetry.js";
 import { loadJsonFile, loadJsonFileOrNull, saveJsonFile } from "./json-persistence.js";
 import { parseUnitId } from "./unit-id.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./uok/audit.js";
+import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
 
 // Re-export from shared — import directly from format-utils to avoid pulling
 // in the full barrel (mod.js → ui.js → @gsd/pi-tui) which breaks when loaded
@@ -88,6 +90,7 @@ export function classifyUnitPhase(unitType: string): MetricsPhase {
       return "discussion";
     case "plan-milestone":
     case "plan-slice":
+    case "refine-slice":
       return "planning";
     case "execute-task":
       return "execution";
@@ -143,6 +146,9 @@ export function snapshotUnitMetrics(
     promptCharCount?: number;
     baselineCharCount?: number;
     autoSessionKey?: string;
+    traceId?: string;
+    turnId?: string;
+    causedBy?: string;
   },
 ): UnitMetrics | null {
   if (!ledger) return null;
@@ -235,6 +241,27 @@ export function snapshotUnitMetrics(
   }
   saveLedger(basePath, ledger);
 
+  if (isUnifiedAuditEnabled()) {
+    emitUokAuditEvent(
+      basePath,
+      buildAuditEnvelope({
+        traceId: opts?.traceId ?? `metrics:${unitType}:${unitId}`,
+        turnId: opts?.turnId,
+        causedBy: opts?.causedBy,
+        category: "metrics",
+        type: "unit-metrics-snapshot",
+        payload: {
+          unitType,
+          unitId,
+          model,
+          tokens: unit.tokens,
+          cost: unit.cost,
+          toolCalls: unit.toolCalls,
+        },
+      }),
+    );
+  }
+
   return unit;
 }
 

package/src/resources/extensions/gsd/milestone-validation-gates.ts

@@ -11,7 +11,7 @@
  * dispatch rules, and state derivation. See gate-registry.ts.
  */
 
-import { _getAdapter } from "./gsd-db.js";
+import { isDbAvailable, upsertQualityGate } from "./gsd-db.js";
 import { getGatesForTurn } from "./gate-registry.js";
 
 /**
@@ -31,24 +31,23 @@ export function insertMilestoneValidationGates(
   verdict: string,
   evaluatedAt: string,
 ): void {
-  const db = _getAdapter();
-  if (!db) return;
+  if (!isDbAvailable()) return;
 
   const gateVerdict = verdict === "pass" ? "pass" : "flag";
   const milestoneGates = getGatesForTurn("validate-milestone");
 
   for (const def of milestoneGates) {
-    db.prepare(
-      `INSERT OR REPLACE INTO quality_gates
-       (milestone_id, slice_id, gate_id, scope, task_id, status, verdict, rationale, findings, evaluated_at)
-       VALUES (:mid, :sid, :gid, 'milestone', '', 'complete', :verdict, :rationale, '', :evaluated_at)`,
-    ).run({
-      ":mid": milestoneId,
-      ":sid": sliceId,
-      ":gid": def.id,
-      ":verdict": gateVerdict,
-      ":rationale": `${def.promptSection} — milestone validation verdict: ${verdict}`,
-      ":evaluated_at": evaluatedAt,
+    upsertQualityGate({
+      milestoneId,
+      sliceId,
+      gateId: def.id,
+      scope: "milestone",
+      taskId: "",
+      status: "complete",
+      verdict: gateVerdict,
+      rationale: `${def.promptSection} — milestone validation verdict: ${verdict}`,
+      findings: "",
+      evaluatedAt,
     });
   }
 }

package/src/resources/extensions/gsd/model-cost-table.ts

@@ -22,7 +22,8 @@ export interface ModelCostEntry {
  */
 export const BUNDLED_COST_TABLE: ModelCostEntry[] = [
   // Anthropic
-  { id: "claude-opus-4-6", inputPer1k: 0.015, outputPer1k: 0.075, updatedAt: "2025-03-15" },
+  { id: "claude-opus-4-6", inputPer1k: 0.005, outputPer1k: 0.025, updatedAt: "2026-04-16" },
+  { id: "claude-opus-4-7", inputPer1k: 0.005, outputPer1k: 0.025, updatedAt: "2026-04-16" },
   { id: "claude-sonnet-4-6", inputPer1k: 0.003, outputPer1k: 0.015, updatedAt: "2025-03-15" },
   { id: "claude-haiku-4-5", inputPer1k: 0.0008, outputPer1k: 0.004, updatedAt: "2025-03-15" },
   { id: "claude-sonnet-4-5-20250514", inputPer1k: 0.003, outputPer1k: 0.015, updatedAt: "2025-03-15" },
@@ -55,6 +56,7 @@ export const BUNDLED_COST_TABLE: ModelCostEntry[] = [
   { id: "gpt-5.3-codex", inputPer1k: 0.005, outputPer1k: 0.02, updatedAt: "2026-03-29" },
   { id: "gpt-5.3-codex-spark", inputPer1k: 0.0003, outputPer1k: 0.0012, updatedAt: "2026-03-29" },
   { id: "gpt-5.4", inputPer1k: 0.005, outputPer1k: 0.02, updatedAt: "2026-03-29" },
+  { id: "gpt-5.4-mini", inputPer1k: 0.00075, outputPer1k: 0.0045, updatedAt: "2026-04-18" },
 
   // Google
   { id: "gemini-2.0-flash", inputPer1k: 0.0001, outputPer1k: 0.0004, updatedAt: "2025-03-15" },

package/src/resources/extensions/gsd/model-router.ts

@@ -23,6 +23,14 @@ export interface DynamicRoutingConfig {
   budget_pressure?: boolean;       // default: true
   cross_provider?: boolean;        // default: true
   hooks?: boolean;                 // default: true
+  /**
+   * Opt into dynamic routing for flat-rate providers (e.g. claude-code,
+   * GitHub Copilot). Default false preserves the #3453 bypass that skips
+   * routing when the subscription makes per-request cost identical.
+   * Enable only when you want per-task model selection across a flat-rate
+   * subscription (e.g. haiku for research, opus for architecture). (#4386)
+   */
+  allow_flat_rate_providers?: boolean;
 }
 
 export interface RoutingDecision {
@@ -73,6 +81,7 @@ export const MODEL_CAPABILITY_TIER: Record<string, ComplexityTier> = {
   "gpt-4.1-nano": "light",
   "gpt-5-mini": "light",
   "gpt-5-nano": "light",
+  "gpt-5.4-mini": "light",
   "gpt-5.1-codex-mini": "light",
   "gpt-5.3-codex-spark": "light",
   "gemini-2.0-flash": "light",
@@ -90,6 +99,7 @@ export const MODEL_CAPABILITY_TIER: Record<string, ComplexityTier> = {
 
   // Heavy-tier models (most capable)
   "claude-opus-4-6": "heavy",
+  "claude-opus-4-7": "heavy",
   "claude-3-opus-latest": "heavy",
   "gpt-4-turbo": "heavy",
   "gpt-5": "heavy",
@@ -114,7 +124,8 @@ const MODEL_COST_PER_1K_INPUT: Record<string, number> = {
   "claude-3-5-haiku-latest": 0.0008,
   "claude-sonnet-4-6": 0.003,
   "claude-sonnet-4-5-20250514": 0.003,
-  "claude-opus-4-6": 0.015,
+  "claude-opus-4-6": 0.005,
+  "claude-opus-4-7": 0.005,
   "gpt-4o-mini": 0.00015,
   "gpt-4o": 0.0025,
   "gpt-4.1": 0.002,
@@ -123,6 +134,7 @@ const MODEL_COST_PER_1K_INPUT: Record<string, number> = {
   "gpt-5": 0.01,
   "gpt-5-mini": 0.0003,
   "gpt-5-nano": 0.0001,
+  "gpt-5.4-mini": 0.00075,
   "gpt-5-pro": 0.015,
   "gpt-5.1": 0.005,
   "gpt-5.1-codex-max": 0.003,
@@ -146,6 +158,7 @@ const MODEL_COST_PER_1K_INPUT: Record<string, number> = {
 export const MODEL_CAPABILITY_PROFILES: Record<string, ModelCapabilities> = {
   // ── Anthropic ──────────────────────────────────────────────────────────────
   "claude-opus-4-6":              { coding: 95, debugging: 90, research: 85, reasoning: 95, speed: 30, longContext: 80, instruction: 90 },
+  "claude-opus-4-7":              { coding: 95, debugging: 90, research: 85, reasoning: 95, speed: 30, longContext: 80, instruction: 90 },
   "claude-sonnet-4-6":            { coding: 85, debugging: 80, research: 75, reasoning: 80, speed: 60, longContext: 75, instruction: 85 },
   "claude-sonnet-4-5-20250514":   { coding: 85, debugging: 80, research: 75, reasoning: 80, speed: 60, longContext: 75, instruction: 85 },
   "claude-3-5-sonnet-latest":     { coding: 82, debugging: 78, research: 72, reasoning: 78, speed: 62, longContext: 70, instruction: 82 },
@@ -164,6 +177,7 @@ export const MODEL_CAPABILITY_PROFILES: Record<string, ModelCapabilities> = {
   "gpt-5":                        { coding: 92, debugging: 88, research: 85, reasoning: 92, speed: 40, longContext: 85, instruction: 90 },
   "gpt-5-mini":                   { coding: 62, debugging: 52, research: 48, reasoning: 52, speed: 88, longContext: 52, instruction: 74 },
   "gpt-5-nano":                   { coding: 42, debugging: 32, research: 28, reasoning: 32, speed: 95, longContext: 32, instruction: 62 },
+  "gpt-5.4-mini":                 { coding: 70, debugging: 60, research: 55, reasoning: 60, speed: 84, longContext: 60, instruction: 78 },
   "gpt-5-pro":                    { coding: 94, debugging: 90, research: 88, reasoning: 94, speed: 35, longContext: 88, instruction: 92 },
   "gpt-5.1":                      { coding: 93, debugging: 89, research: 86, reasoning: 93, speed: 42, longContext: 86, instruction: 91 },
   "gpt-5.1-codex-max":            { coding: 90, debugging: 85, research: 70, reasoning: 85, speed: 55, longContext: 75, instruction: 85 },

package/src/resources/extensions/gsd/native-git-bridge.ts

@@ -6,7 +6,7 @@
 // execSync calls because git2 credential handling is too complex.
 
 import { execSync, execFileSync } from "node:child_process";
-import { existsSync, readFileSync, unlinkSync, rmSync } from "node:fs";
+import { existsSync, readFileSync, unlinkSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { GSDError, GSD_GIT_ERROR } from "./errors.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
@@ -323,7 +323,7 @@ export function nativeIsRepo(basePath: string): boolean {
     return native.gitIsRepo(basePath);
   }
   try {
-    execSync("git rev-parse --git-dir", { cwd: basePath, stdio: "pipe" });
+    execFileSync("git", ["rev-parse", "--git-dir"], { cwd: basePath, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -690,6 +690,134 @@ export function nativeAddTracked(basePath: string): void {
   gitFileExec(basePath, ["add", "-u"]);
 }
 
+function isDotGsdIgnored(basePath: string): boolean {
+  for (const path of [".gsd", ".gsd/"]) {
+    try {
+      execFileSync("git", ["check-ignore", "-q", path], {
+        cwd: basePath,
+        stdio: "pipe",
+        env: GIT_NO_PROMPT_ENV,
+      });
+      return true;
+    } catch {
+      // exit 1 means this form is not ignored; try the next variant
+    }
+  }
+  return false;
+}
+
+/**
+ * Determine whether the project opts out of GSD-managed `.gitignore` via
+ * `git.manage_gitignore: false` in `.gsd/PREFERENCES.md`. Uses a minimal
+ * inline parser to avoid importing the full preferences module (which would
+ * introduce a circular dependency back into this low-level bridge).
+ *
+ * Returns true when management is disabled. Any parse failure or missing
+ * file returns false (default: GSD may manage `.gitignore`).
+ */
+function isGitignoreManagementDisabled(basePath: string): boolean {
+  const prefsPath = join(basePath, ".gsd", "PREFERENCES.md");
+  if (!existsSync(prefsPath)) return false;
+  try {
+    const content = readFileSync(prefsPath, "utf-8");
+    // Look for `manage_gitignore: false` under a `git:` block. The preference
+    // is indented; a loose regex is sufficient since we only care about the
+    // explicit opt-out case.
+    return /^\s*manage_gitignore\s*:\s*false\s*$/m.test(content);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Self-heal path for the symlinked-`.gsd` staging failure: append `.gsd` to
+ * `.gitignore` so subsequent `git add -A` calls succeed without the symlink
+ * pathspec error. Honors the `git.manage_gitignore: false` opt-out.
+ *
+ * Returns true when `.gitignore` now contains an entry covering `.gsd`
+ * (either pre-existing or newly appended). Returns false when the opt-out
+ * is set or the write fails.
+ */
+function trySelfHealGsdGitignore(basePath: string): boolean {
+  if (isGitignoreManagementDisabled(basePath)) return false;
+
+  const gitignorePath = join(basePath, ".gitignore");
+  try {
+    const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "";
+    const lines = new Set(
+      existing.split("\n").map(l => l.trim()).filter(l => l && !l.startsWith("#")),
+    );
+    if (lines.has(".gsd") || lines.has(".gsd/")) return true;
+
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    const block = `${prefix}\n# ── GSD self-heal: .gsd is a symlink to external state ──\n.gsd\n`;
+    writeFileSync(gitignorePath, existing + block, "utf-8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Stage untracked files individually while skipping anything under `.gsd`.
+ * Used as a last-resort when `.gsd` is a symlink, not gitignored, and
+ * `git.manage_gitignore: false` forbids the self-heal path. Protects user
+ * work by never silently dropping new real files.
+ */
+function stageUntrackedExcludingDotGsd(basePath: string): void {
+  // Stage tracked modifications first. `git add -u` never fails on pathspec
+  // issues because it doesn't walk untracked trees.
+  gitFileExec(basePath, ["add", "-u"]);
+
+  // Enumerate untracked paths via porcelain output. `?? ` prefix marks
+  // untracked files (status respects `.gitignore`).
+  const status = gitFileExec(basePath, ["status", "--porcelain=v1", "-z"], true);
+  if (!status) return;
+
+  const untracked: string[] = [];
+  for (const entry of status.split("\0")) {
+    if (!entry) continue;
+    // Porcelain format: "XY path" where XY is the 2-char status code.
+    if (entry.length < 4) continue;
+    const code = entry.slice(0, 2);
+    const path = entry.slice(3);
+    if (code !== "??") continue;
+    // Skip GSD runtime artifacts. Under `manage_gitignore: false` the user
+    // may not have these in `.gitignore`, so we filter explicitly to avoid
+    // committing transient state (.gsd external link, migration lock,
+    // background shell scratch dir).
+    if (path === ".gsd" || path.startsWith(".gsd/")) continue;
+    if (path === ".gsd-id" || path === ".gsd.migrating") continue;
+    if (path === ".bg-shell" || path.startsWith(".bg-shell/")) continue;
+    untracked.push(path);
+  }
+
+  if (untracked.length === 0) return;
+  // Stage in chunks to avoid exceeding ARG_MAX on large change sets.
+  const CHUNK = 200;
+  for (let i = 0; i < untracked.length; i += CHUNK) {
+    gitFileExec(basePath, ["add", "--", ...untracked.slice(i, i + CHUNK)]);
+  }
+}
+
+/**
+ * Handle `nativeAddAllWithExclusions` failing with "beyond a symbolic link"
+ * when `.gsd` is a symlink. Self-heals by adding `.gsd` to `.gitignore`, or
+ * falls back to explicit per-file staging so user work is never dropped.
+ */
+function fallbackStageWithSymlinkedDotGsd(basePath: string): void {
+  if (isDotGsdIgnored(basePath)) {
+    gitFileExec(basePath, ["add", "-A"]);
+    return;
+  }
+  if (trySelfHealGsdGitignore(basePath)) {
+    gitFileExec(basePath, ["add", "-A"]);
+    return;
+  }
+  // `manage_gitignore: false` — protect work by staging files explicitly.
+  stageUntrackedExcludingDotGsd(basePath);
+}
+
 /**
  * Stage all files with pathspec exclusions (git add -A -- ':!pattern' ...).
  * Excluded paths are never hashed by git, preventing hangs on large
@@ -724,12 +852,12 @@ export function nativeAddAllWithExclusions(basePath: string, exclusions: readonl
       return;
     }
     // When .gsd is a symlink, git rejects `:!.gsd/...` pathspecs with
-    // "beyond a symbolic link". Fall back to `git add -u` which only
-    // stages changes to already-tracked files — O(tracked) not O(filesystem).
-    // Using `git add -A` here would traverse the entire working tree,
-    // hanging indefinitely on repos with large untracked data dirs. (#1977)
+    // "beyond a symbolic link". Hand off to the self-heal fallback which
+    // either adds `.gsd` to `.gitignore` and retries `git add -A`, or stages
+    // real files explicitly when `git.manage_gitignore: false` forbids the
+    // self-heal path. Either way, user work is protected from silent drops.
     if (stderr.includes("beyond a symbolic link")) {
-      gitFileExec(basePath, ["add", "-u"]);
+      fallbackStageWithSymlinkedDotGsd(basePath);
       return;
     }
     throw new GSDError(GSD_GIT_ERROR, `git add -A with exclusions failed in ${basePath}: ${getErrorMessage(err)}`);
@@ -790,16 +918,15 @@ export function nativeCommit(
 
   // Fallback: use git commit with stdin pipe for safe multi-line messages
   try {
-    const result = execSync(
-      `git commit --no-verify -F -${options?.allowEmpty ? " --allow-empty" : ""}`,
-      {
-        cwd: basePath,
-        stdio: ["pipe", "pipe", "pipe"],
-        encoding: "utf-8",
-        env: GIT_NO_PROMPT_ENV,
-        input: message,
-      },
-    ).trim();
+    const args = ["commit", "--no-verify", "-F", "-"];
+    if (options?.allowEmpty) args.push("--allow-empty");
+    const result = execFileSync("git", args, {
+      cwd: basePath,
+      stdio: ["pipe", "pipe", "pipe"],
+      encoding: "utf-8",
+      env: GIT_NO_PROMPT_ENV,
+      input: message,
+    }).trim();
     return result;
   } catch (err: unknown) {
     const errObj = err as { stdout?: string; stderr?: string; message?: string };
@@ -940,7 +1067,7 @@ export function nativeResetHard(basePath: string): void {
     native.gitResetHard(basePath);
     return;
   }
-  execSync("git reset --hard HEAD", { cwd: basePath, stdio: "pipe" });
+  execFileSync("git", ["reset", "--hard", "HEAD"], { cwd: basePath, stdio: "pipe" });
 }
 
 /**

package/src/resources/extensions/gsd/notification-widget.ts

@@ -1,60 +1,42 @@
-// GSD Extension — Notification Widget
-// Always-on ambient widget rendered belowEditor showing unread count and
-// the most recent notification message. Refreshes every 30 seconds.
-// Widget key: "gsd-notifications", placement: "belowEditor"
+// GSD Extension — Notification Status
+// Always-on ambient notification chip surfaced as an extension status on the
+// footer pwd row. Refreshes on store change + on a 30s timer. Hidden when
+// unread=0. Key sorts late so the chip renders to the right of other
+// extension statuses.
 
 import type { ExtensionContext } from "@gsd/pi-coding-agent";
 
 import { getUnreadCount, onNotificationStoreChange } from "./notification-store.js";
 import { formattedShortcutPair } from "./shortcut-defs.js";
 
-// ─── Pure rendering ──���────────────────────────���─────────────────────────
+// Key chosen to sort after alphabetic extension keys so the chip lands on the
+// far right of the extension-status block.
+const STATUS_KEY = "zz-notifications";
 
-export function buildNotificationWidgetLines(): string[] {
+export function buildNotificationChip(): string {
   const unread = getUnreadCount();
-  if (unread === 0) return [];
-
-  return [`  🔔 Notifications: ${unread} unread  (${formattedShortcutPair("notifications")})`];
+  if (unread === 0) return "";
+  return `🔔 ${unread} unread (${formattedShortcutPair("notifications")})`;
 }
 
-// ─── Widget init ────────────────────────────────────────────────────────
+// Retained for backwards compatibility with tests and the RPC fallback path
+// that still expected a line-array widget. Returns empty when no unread.
+export function buildNotificationWidgetLines(): string[] {
+  const chip = buildNotificationChip();
+  return chip ? [`  ${chip}`] : [];
+}
 
 const REFRESH_INTERVAL_MS = 30_000;
 
-/**
- * Initialize the always-on notification widget (belowEditor).
- * Call once from session_start after the notification store is initialized.
- */
 export function initNotificationWidget(ctx: ExtensionContext): void {
   if (!ctx.hasUI) return;
 
-  // String-array fallback for RPC mode
-  ctx.ui.setWidget("gsd-notifications", buildNotificationWidgetLines(), { placement: "belowEditor" });
-
-  // Factory-based widget for TUI mode
-  ctx.ui.setWidget("gsd-notifications", (_tui, _theme) => {
-    let cachedLines: string[] | undefined;
-
-    const refresh = () => {
-      cachedLines = undefined;
-      _tui.requestRender();
-    };
-
-    const unsubscribe = onNotificationStoreChange(refresh);
-    const refreshTimer = setInterval(refresh, REFRESH_INTERVAL_MS);
-
-    return {
-      render(_width: number): string[] {
-        if (!cachedLines) cachedLines = buildNotificationWidgetLines();
-        return cachedLines;
-      },
-      invalidate(): void {
-        cachedLines = undefined;
-      },
-      dispose(): void {
-        unsubscribe();
-        clearInterval(refreshTimer);
-      },
-    };
-  }, { placement: "belowEditor" });
+  const push = () => {
+    const chip = buildNotificationChip();
+    ctx.ui.setStatus(STATUS_KEY, chip.length > 0 ? chip : undefined);
+  };
+  push();
+
+  onNotificationStoreChange(push);
+  setInterval(push, REFRESH_INTERVAL_MS).unref?.();
 }

package/src/resources/extensions/gsd/notifications.ts

@@ -5,6 +5,7 @@ import { execFileSync } from "node:child_process";
 import type { NotificationPreferences } from "./types.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { CmuxClient, emitOsc777Notification, resolveCmuxConfig } from "../cmux/index.js";
+import { sendRemoteNotification } from "../remote-questions/notify.js";
 
 export type NotifyLevel = "info" | "success" | "warning" | "error";
 export type NotificationKind = "complete" | "error" | "budget" | "milestone" | "attention";
@@ -31,6 +32,11 @@ export function sendDesktopNotification(
     title = formatNotificationTitle(projectName);
   }
   const loaded = loadEffectiveGSDPreferences()?.preferences;
+
+  // Remote notifications fire independently of desktop preferences.
+  // sendRemoteNotification handles "not configured" gracefully (early return).
+  void sendRemoteNotification(title, message).catch(() => {});
+
   if (!shouldSendDesktopNotification(kind, loaded?.notifications)) return;
 
   const cmux = resolveCmuxConfig(loaded);