gsd-pi 2.75.0-next.9c0ec0ba1 → 2.76.0-dev.b072ebb73

package/dist/resources/extensions/gsd/db-writer.js

@@ -205,6 +205,19 @@ export async function nextDecisionId() {
         return 'D001';
     }
 }
+/** Synchronous variant for use inside db.transaction(). */
+function nextDecisionIdSync(adapter) {
+    if (!adapter)
+        return 'D001';
+    const row = adapter
+        .prepare('SELECT MAX(CAST(SUBSTR(id, 2) AS INTEGER)) as max_num FROM decisions')
+        .get();
+    const maxNum = row ? row['max_num'] : null;
+    if (maxNum == null || isNaN(maxNum))
+        return 'D001';
+    const next = maxNum + 1;
+    return `D${String(next).padStart(3, '0')}`;
+}
 // ─── Next Requirement ID ─────────────────────────────────────────────────
 /**
  * Compute the next requirement ID from the current DB state.
@@ -318,32 +331,44 @@ export async function saveRequirementToDb(fields, basePath) {
         throw err;
     }
 }
+// ─── Async Mutex for Decision Saves ───────────────────────────────────────
+//
+// Serializes the entire saveDecisionToDb operation (ID generation + DB upsert
+// + file read + markdown regeneration + file write) so that parallel callers
+// cannot interleave and produce a last-writer-wins race on DECISIONS.md.
+let _decisionSaveLock = Promise.resolve();
+/** Reset the mutex — only for tests. */
+export function _resetDecisionSaveLock() {
+    _decisionSaveLock = Promise.resolve();
+}
 /**
  * Save a new decision to DB and regenerate DECISIONS.md.
  * Auto-assigns the next ID via nextDecisionId().
  *
- * The ID computation (SELECT MAX) and insert are wrapped in a single
- * transaction to prevent parallel tool calls from computing the same ID
- * and silently overwriting each other (#3326, #3339, #3459).
+ * Concurrency: uses an async mutex (promise chain) to serialize the entire
+ * operation — ID generation, DB upsert, file read, markdown regeneration,
+ * and file write — preventing parallel callers from overwriting each other's
+ * output (last-writer-wins race condition).
  *
  * Returns the assigned ID.
  */
 export async function saveDecisionToDb(fields, basePath) {
+    // Serialize via async mutex: each call waits for the previous one to
+    // complete before starting, preventing interleaved DB + file writes.
+    let release;
+    const prev = _decisionSaveLock;
+    _decisionSaveLock = new Promise(r => { release = r; });
+    try {
+        await prev;
+    }
+    catch {
+        // Previous call failed — proceed regardless; the lock chain must continue.
+    }
     try {
         const db = await import('./gsd-db.js');
-        // Atomic ID assignment + insert inside a transaction to prevent
-        // parallel calls from racing on the same MAX(id) value.
+        const adapter = db._getAdapter();
         const id = db.transaction(() => {
-            const adapter = db._getAdapter();
-            if (!adapter)
-                throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
-            const row = adapter
-                .prepare('SELECT MAX(CAST(SUBSTR(id, 2) AS INTEGER)) as max_num FROM decisions')
-                .get();
-            const maxNum = row ? row['max_num'] : null;
-            const nextId = (maxNum == null || isNaN(maxNum))
-                ? 'D001'
-                : `D${String(maxNum + 1).padStart(3, '0')}`;
+            const nextId = nextDecisionIdSync(adapter);
             db.upsertDecision({
                 id: nextId,
                 when_context: fields.when_context ?? '',
@@ -353,12 +378,12 @@ export async function saveDecisionToDb(fields, basePath) {
                 rationale: fields.rationale,
                 revisable: fields.revisable ?? 'Yes',
                 made_by: fields.made_by ?? 'agent',
+                source: fields.source ?? 'discussion',
                 superseded_by: null,
             });
             return nextId;
         });
         // Fetch all decisions (including superseded for the full register)
-        const adapter = db._getAdapter();
         let allDecisions = [];
         if (adapter) {
             const rows = adapter.prepare('SELECT * FROM decisions ORDER BY seq').all();
@@ -433,12 +458,60 @@ export async function saveDecisionToDb(fields, basePath) {
         invalidateStateCache();
         clearPathCache();
         clearParseCache();
+        // ADR-013 dual-write: keep the memory store in sync with every decision
+        // persisted via the legacy gsd_save_decision path. Without this, prompts
+        // that still call gsd_save_decision (discuss.md, plan-milestone.md,
+        // guided-plan-slice.md, et al. during the deprecation window) would
+        // create decisions rows invisible to memory_query and loadMemoryBlock.
+        // Best-effort — never throw, never roll back the decision on failure.
+        try {
+            const { createMemory } = await import('./memory-store.js');
+            const decisionText = (fields.decision ?? '').trim();
+            const choiceText = (fields.choice ?? '').trim();
+            const rationaleText = (fields.rationale ?? '').trim();
+            const contentParts = [];
+            if (decisionText)
+                contentParts.push(decisionText);
+            if (choiceText)
+                contentParts.push(`Chose: ${choiceText}.`);
+            if (rationaleText)
+                contentParts.push(`Rationale: ${rationaleText}.`);
+            const content = contentParts.join(' ').slice(0, 600);
+            if (content) {
+                createMemory({
+                    category: 'architecture',
+                    content,
+                    scope: fields.scope || 'project',
+                    confidence: 0.85,
+                    structuredFields: {
+                        sourceDecisionId: id,
+                        when_context: fields.when_context ?? '',
+                        scope: fields.scope,
+                        decision: fields.decision,
+                        choice: fields.choice,
+                        rationale: fields.rationale,
+                        made_by: fields.made_by ?? 'agent',
+                        revisable: fields.revisable ?? '',
+                    },
+                });
+            }
+        }
+        catch (mirrorErr) {
+            logError('manifest', 'memory-store mirror write failed (non-fatal)', {
+                fn: 'saveDecisionToDb',
+                decisionId: id,
+                error: String(mirrorErr.message),
+            });
+        }
         return { id };
     }
     catch (err) {
         logError('manifest', 'saveDecisionToDb failed', { fn: 'saveDecisionToDb', error: String(err.message) });
         throw err;
     }
+    finally {
+        release();
+    }
 }
 /**
  * Extract a milestone/slice reference from a deferral decision.

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -130,7 +130,7 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
   - `auto_push`: boolean — automatically push commits to the remote after committing. Default: `false`.
   - `push_branches`: boolean — push the milestone branch to the remote after commits. Default: `false`.
   - `remote`: string — git remote name to push to. Default: `"origin"`.
-  - `snapshots`: boolean — create snapshot commits (WIP saves) during long-running tasks. Default: `true`.
+  - `snapshots`: boolean — create WIP snapshot commits (e.g. pre-dispatch and stale-uncommitted-changes safety commits emitted by the doctor). Set to `false` to suppress all doctor-initiated `gsd snapshot:` commits. Default: `true`.
   - `pre_merge_check`: boolean or `"auto"` — run pre-merge checks before merging a worktree back to the integration branch. `true` always runs, `false` never runs, `"auto"` runs when CI is detected. Default: `"auto"`.
   - `commit_type`: string — override the conventional commit type prefix. Must be one of: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf`, `ci`, `build`, `style`. Default: inferred from diff content.
   - `main_branch`: string — the primary branch name for new git repos (e.g., `"main"`, `"master"`, `"trunk"`). Also used by `getMainBranch()` as the preferred branch when auto-detection is ambiguous. Default: `"main"`.
@@ -201,7 +201,7 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
   - `model_policy.enabled`: boolean — enforce policy filtering before model capability scoring. Default: `true`.
   - `execution_graph.enabled`: boolean — enable DAG scheduler facade/adapters for execution. Default: `true`.
   - `gitops.enabled`: boolean — persist turn-level git transaction records. Default: `true`.
-  - `gitops.turn_action`: `"commit"` | `"snapshot"` | `"status-only"` — turn transaction mode. Default: `"status-only"`.
+  - `gitops.turn_action`: `"commit"` | `"snapshot"` | `"status-only"` — turn transaction mode. Default: `"commit"` (per-task atomic commits).
   - `gitops.turn_push`: boolean — whether turn transactions should include push intent metadata. Default: `false`.
   - `audit_unified.enabled`: boolean — dual-write unified audit envelope events. Default: `true`.
   - `plan_v2.enabled`: boolean — enable bounded clarify/research/draft/compile planning flow. Default: `true`.

package/dist/resources/extensions/gsd/doctor-environment.js

@@ -11,6 +11,7 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { execSync } from "node:child_process";
 import { join } from "node:path";
+import { detectPythonExecutable } from "./python-resolver.js";
 // ── Constants ──────────────────────────────────────────────────────────────
 /** Default dev server ports to scan for conflicts. */
 const DEFAULT_DEV_PORTS = [3000, 3001, 4000, 5000, 5173, 8000, 8080, 8888];
@@ -350,7 +351,7 @@ function checkProjectTools(basePath) {
         }
         // Check for Python if pyproject.toml or requirements.txt exists
         if (existsSync(join(basePath, "pyproject.toml")) || existsSync(join(basePath, "requirements.txt"))) {
-            if (!commandExists("python3", basePath) && !commandExists("python", basePath)) {
+            if (detectPythonExecutable() === null) {
                 results.push({
                     name: "python",
                     status: "warning",

package/dist/resources/extensions/gsd/doctor-git-checks.js

@@ -2,7 +2,7 @@ import { existsSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs
 import { join, sep } from "node:path";
 import { loadFile } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
-import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
+import { isDbAvailable, getMilestone } from "./gsd-db.js";
 import { resolveMilestoneFile } from "./paths.js";
 import { deriveState, isMilestoneComplete } from "./state.js";
 import { listWorktrees, resolveGitDir, worktreesDir } from "./worktree-manager.js";
@@ -34,6 +34,35 @@ function isDoctorArtifactOnly(dirPath) {
         return false;
     }
 }
+function normalizePathForComparison(path) {
+    const resolved = existsSync(path) ? realpathSync(path) : path;
+    const normalized = resolved
+        .replaceAll("\\", "/")
+        .replace(/^\/\/\?\//, "")
+        .replace(/\/+$/, "");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function isSameOrNestedPath(candidate, container) {
+    const normalizedCandidate = normalizePathForComparison(candidate);
+    const normalizedContainer = normalizePathForComparison(container);
+    return normalizedCandidate === normalizedContainer ||
+        normalizedCandidate.startsWith(`${normalizedContainer}/`);
+}
+async function isCompletedMilestoneTerminal(basePath, milestoneId) {
+    const summaryPath = resolveMilestoneFile(basePath, milestoneId, "SUMMARY");
+    if (!summaryPath)
+        return false;
+    if (isDbAvailable()) {
+        const milestone = getMilestone(milestoneId);
+        return !!milestone && milestone.status === "complete";
+    }
+    const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
+    const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+    if (!roadmapContent)
+        return false;
+    const roadmap = parseLegacyRoadmap(roadmapContent);
+    return isMilestoneComplete(roadmap);
+}
 export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix, isolationMode = "none") {
     // Degrade gracefully if not a git repo
     if (!nativeIsRepo(basePath)) {
@@ -53,23 +82,9 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
                 // Extract milestone ID from branch name "milestone/M001" → "M001"
                 const milestoneId = wt.branch.replace(/^milestone\//, "");
                 const milestoneEntry = state.registry.find(m => m.id === milestoneId);
-                // Check if milestone is complete via roadmap
-                let isComplete = false;
-                if (milestoneEntry) {
-                    if (isDbAvailable()) {
-                        const dbSlices = getMilestoneSlices(milestoneId);
-                        isComplete = dbSlices.length > 0 && dbSlices.every(s => s.status === "complete");
-                    }
-                    else {
-                        const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
-                        const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
-                        if (roadmapContent) {
-                            const roadmap = parseLegacyRoadmap(roadmapContent);
-                            isComplete = isMilestoneComplete(roadmap);
-                        }
-                    }
-                    // When DB unavailable and no roadmap, isComplete stays false
-                }
+                const isComplete = milestoneEntry
+                    ? await isCompletedMilestoneTerminal(basePath, milestoneId)
+                    : false;
                 if (isComplete) {
                     issues.push({
                         severity: "warning",
@@ -84,8 +99,14 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
                         // pattern in removeWorktree() (#1946). Without this, git cannot
                         // remove the worktree and the doctor enters a deadlock where it
                         // detects the orphan every run but never cleans it up.
-                        const cwd = process.cwd();
-                        if (wt.path === cwd || cwd.startsWith(wt.path + sep)) {
+                        let cwd = basePath;
+                        try {
+                            cwd = process.cwd();
+                        }
+                        catch {
+                            cwd = basePath;
+                        }
+                        if (isSameOrNestedPath(cwd, wt.path)) {
                             try {
                                 process.chdir(basePath);
                             }
@@ -116,17 +137,10 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
                         const milestoneId = branch.replace(/^milestone\//, "");
                         const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
                         let branchMilestoneComplete = false;
-                        if (isDbAvailable()) {
-                            const dbSlices = getMilestoneSlices(milestoneId);
-                            branchMilestoneComplete = dbSlices.length > 0 && dbSlices.every(s => s.status === "complete");
-                        }
-                        else {
-                            const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
-                            if (!roadmapContent)
-                                continue;
-                            const roadmap = parseLegacyRoadmap(roadmapContent);
-                            branchMilestoneComplete = isMilestoneComplete(roadmap);
-                        }
+                        const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+                        if (!roadmapContent)
+                            continue;
+                        branchMilestoneComplete = await isCompletedMilestoneTerminal(basePath, milestoneId);
                         if (branchMilestoneComplete) {
                             issues.push({
                                 severity: "info",
@@ -365,8 +379,12 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
     // auto-commit a safety snapshot so work isn't lost.
     try {
         const prefs = loadEffectiveGSDPreferences()?.preferences ?? {};
+        // `git.snapshots: false` is the canonical toggle that disables WIP
+        // snapshot commits — honour it here as well so both the proactive gate
+        // and the doctor-run path stay consistent (#4420).
+        const snapshotsEnabled = prefs.git?.snapshots !== false;
         const thresholdMinutes = prefs.stale_commit_threshold_minutes ?? 30;
-        if (thresholdMinutes > 0) {
+        if (snapshotsEnabled && thresholdMinutes > 0) {
             const dirty = nativeHasChanges(basePath);
             if (dirty) {
                 const branch = nativeGetCurrentBranch(basePath);

package/dist/resources/extensions/gsd/doctor-proactive.js

@@ -238,8 +238,11 @@ export async function preDispatchHealthGate(basePath) {
     try {
         if (nativeIsRepo(basePath)) {
             const prefs = loadEffectiveGSDPreferences()?.preferences ?? {};
+            // `git.snapshots: false` is the canonical toggle that disables WIP
+            // snapshot commits — honour it before touching the threshold path (#4420).
+            const snapshotsEnabled = prefs.git?.snapshots !== false;
             const thresholdMinutes = prefs.stale_commit_threshold_minutes ?? 30;
-            if (thresholdMinutes > 0 && nativeHasChanges(basePath)) {
+            if (snapshotsEnabled && thresholdMinutes > 0 && nativeHasChanges(basePath)) {
                 const branch = nativeGetCurrentBranch(basePath);
                 const lastEpoch = nativeLastCommitEpoch(basePath, branch || "HEAD");
                 const nowEpoch = Math.floor(Date.now() / 1000);

package/dist/resources/extensions/gsd/doctor-providers.js

@@ -10,8 +10,8 @@
  *   - Remote questions channel if configured (Slack/Discord/Telegram token)
  *   - Optional search/tool integrations (Brave, Tavily, Jina, Context7)
  */
-import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { delimiter, join } from "node:path";
 import { AuthStorage } from "@gsd/pi-coding-agent";
 import { getEnvApiKey } from "@gsd/pi-ai";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
@@ -47,7 +47,8 @@ function modelToProviderId(model) {
         return null;
     // Explicit provider prefix (e.g. "openrouter/deepseek-r1")
     if (model.includes("/")) {
-        const prefix = model.split("/")[0].toLowerCase();
+        const rawPrefix = model.split("/")[0];
+        const prefix = rawPrefix.toLowerCase();
         // Map known prefixes to registry IDs
         const prefixMap = {
             "anthropic-vertex": "anthropic-vertex",
@@ -62,6 +63,7 @@ function modelToProviderId(model) {
         };
         if (prefixMap[prefix])
             return prefixMap[prefix];
+        return rawPrefix;
     }
     const lower = model.toLowerCase();
     if (lower.startsWith("claude"))
@@ -136,8 +138,49 @@ function isCliBinaryInPath(providerId) {
     const binary = CLI_BINARY_MAP[providerId];
     if (!binary)
         return false;
-    const pathDirs = (process.env.PATH ?? "").split(":");
-    return pathDirs.some(dir => dir && existsSync(join(dir, binary)));
+    const pathDirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+    // On Windows, command shims are commonly installed as .cmd/.exe/.bat/.com.
+    // Scan PATHEXT candidates in addition to the bare binary name.
+    const executableNames = [binary];
+    if (process.platform === "win32") {
+        const rawPathExt = process.env.PATHEXT
+            ?.split(";")
+            .map(ext => ext.trim())
+            .filter(Boolean) ?? [];
+        const normalizedPathExt = rawPathExt.map(ext => ext.startsWith(".") ? ext.toLowerCase() : `.${ext.toLowerCase()}`);
+        const defaultExt = [".exe", ".cmd", ".bat", ".com"];
+        for (const ext of [...normalizedPathExt, ...defaultExt]) {
+            const candidate = `${binary}${ext}`;
+            if (!executableNames.includes(candidate))
+                executableNames.push(candidate);
+        }
+    }
+    return pathDirs.some(dir => executableNames.some(name => existsSync(join(dir, name))));
+}
+function modelsJsonPaths() {
+    const home = process.env.HOME ?? "~";
+    return [
+        join(home, ".gsd", "agent", "models.json"),
+        // Keep parity with custom-provider discovery during auto bootstrap.
+        join(home, ".pi", "agent", "models.json"),
+    ];
+}
+function hasModelsJsonApiKey(providerId) {
+    for (const path of modelsJsonPaths()) {
+        if (!existsSync(path))
+            continue;
+        try {
+            const parsed = JSON.parse(readFileSync(path, "utf-8"));
+            const apiKey = parsed.providers?.[providerId]?.apiKey;
+            if (typeof apiKey === "string" && apiKey.trim().length > 0) {
+                return true;
+            }
+        }
+        catch {
+            // Malformed models.json should not break the dashboard health check.
+        }
+    }
+    return false;
 }
 function resolveKey(providerId) {
     const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
@@ -182,6 +225,9 @@ function resolveKey(providerId) {
     if (info?.envVar && process.env[info.envVar]) {
         return { found: true, source: "env", backedOff: false };
     }
+    if (hasModelsJsonApiKey(providerId)) {
+        return { found: true, source: "models.json", backedOff: false };
+    }
     return { found: false, source: "none", backedOff: false };
 }
 // ── Individual check groups ────────────────────────────────────────────────────

package/dist/resources/extensions/gsd/doctor-runtime-checks.js

@@ -6,7 +6,7 @@ import { deriveState } from "./state.js";
 import { saveFile } from "./files.js";
 import { nativeIsRepo, nativeForEachRef, nativeUpdateRef } from "./native-git-bridge.js";
 import { readCrashLock, isLockProcessAlive, clearLock } from "./crash-recovery.js";
-import { ensureGitignore } from "./gitignore.js";
+import { ensureGitignore, isGsdGitignored } from "./gitignore.js";
 import { readAllSessionStatuses, isSessionStale, removeSessionStatus } from "./session-status-io.js";
 import { recoverFailedMigration } from "./migrate-external.js";
 import { splitCompletedKey } from "./forensics.js";
@@ -350,6 +350,26 @@ export async function checkRuntimeHealth(basePath, issues, fixesApplied, shouldF
                         fixable: false,
                     });
                 }
+                // ── Symlinked .gsd without .gitignore entry (#4423) ──
+                // When `.gsd` is a symlink AND not gitignored, `git add -A -- :!.gsd/...`
+                // pathspecs fail with "beyond a symbolic link". Without self-heal this
+                // silently drops new user files during auto-commit.
+                if (nativeIsRepo(basePath) && !isGsdGitignored(basePath)) {
+                    issues.push({
+                        severity: "warning",
+                        code: "symlinked_gsd_unignored",
+                        scope: "project",
+                        unitId: "project",
+                        message: ".gsd is a symlink to external state but is not listed in .gitignore. This causes git pathspec exclusions to fail and can lead to silently dropped new files during auto-commit. Add `.gsd` to .gitignore.",
+                        file: ".gitignore",
+                        fixable: true,
+                    });
+                    if (shouldFix("symlinked_gsd_unignored")) {
+                        const modified = ensureGitignore(basePath);
+                        if (modified)
+                            fixesApplied.push("added .gsd to .gitignore (symlinked external state)");
+                    }
+                }
             }
         }
     }

package/dist/resources/extensions/gsd/doctor.js

@@ -154,8 +154,14 @@ function auditRequirements(content) {
         const owner = block.match(/^-\s+Primary owning slice:\s+(.+)$/m)?.[1]?.trim().toLowerCase() ?? "";
         const notes = block.match(/^-\s+Notes:\s+(.+)$/m)?.[1]?.trim().toLowerCase() ?? "";
         if (status === "active" && (!owner || owner === "none" || owner === "none yet")) {
+            // #4414: Downgrade to warning. A newly-created requirement has
+            // primary_owner='' by default until the planning agent wires it to
+            // a slice via gsd_requirement_update. Flagging this as an error
+            // during normal planning is noisy — the real failure mode is when
+            // it persists past milestone completion, which is covered by other
+            // audits. Keep the signal but don't treat it as a blocker.
             issues.push({
-                severity: "error",
+                severity: "warning",
                 code: "active_requirement_missing_owner",
                 scope: "project",
                 unitId: requirementId,

package/dist/resources/extensions/gsd/ecosystem/gsd-extension-api.js

@@ -101,6 +101,7 @@ export function createGSDExtensionAPI(pi, sharedHandlers) {
         // ── Event emission ─────────────────────────────────────────────────
         emitBeforeModelSelect: (...args) => pi.emitBeforeModelSelect(...args),
         emitAdjustToolSet: (...args) => pi.emitAdjustToolSet(...args),
+        emitExtensionEvent: (...args) => pi.emitExtensionEvent(...args),
         // ── Tool / command / shortcut / flag registration ──────────────────
         registerTool: ((tool) => pi.registerTool(tool)),
         registerCommand: (...args) => pi.registerCommand(...args),

package/dist/resources/extensions/gsd/error-classifier.js

@@ -19,7 +19,10 @@ export function resetRetryState(state) {
 }
 // ── Classification ──────────────────────────────────────────────────────────
 const PERMANENT_RE = /auth|unauthorized|forbidden|invalid.*key|invalid.*api|billing|quota exceeded|account/i;
-const RATE_LIMIT_RE = /rate.?limit|too many requests|429/i;
+// Include provider-specific quota-window phrasing like:
+// - "You've hit your limit"
+// - "usage limit" / "quota reached"
+const RATE_LIMIT_RE = /rate.?limit|too many requests|429|hit your limit|usage limit|quota (?:reached|hit)|limit.*resets?/i;
 // OpenRouter affordability-style quota errors should be treated as transient
 // so core retry logic can lower maxTokens and continue in-session.
 const AFFORDABILITY_RE = /requires more credits|can only afford|insufficient credits|not enough credits|fewer max_tokens/i;
@@ -36,7 +39,7 @@ const RESET_DELAY_RE = /reset in (\d+)s/i;
  *
  * Classification order:
  *  1. Permanent (auth/billing/quota) — unless also rate-limited
- *  2. Rate limit (429, rate.?limit, too many requests)
+ *  2. Rate limit (429, rate.?limit, too many requests, hit-your-limit/quota-window phrasing)
  *  3. Network (ECONNRESET, ETIMEDOUT, socket hang up, fetch failed, dns)
  *  4. Stream truncation (malformed JSON from mid-stream cut)
  *  5. Server (500/502/503, overloaded, server_error)