gsd-pi 2.75.0 → 2.76.0-dev.b072ebb73

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -130,7 +130,7 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
   - `auto_push`: boolean — automatically push commits to the remote after committing. Default: `false`.
   - `push_branches`: boolean — push the milestone branch to the remote after commits. Default: `false`.
   - `remote`: string — git remote name to push to. Default: `"origin"`.
-  - `snapshots`: boolean — create snapshot commits (WIP saves) during long-running tasks. Default: `true`.
+  - `snapshots`: boolean — create WIP snapshot commits (e.g. pre-dispatch and stale-uncommitted-changes safety commits emitted by the doctor). Set to `false` to suppress all doctor-initiated `gsd snapshot:` commits. Default: `true`.
   - `pre_merge_check`: boolean or `"auto"` — run pre-merge checks before merging a worktree back to the integration branch. `true` always runs, `false` never runs, `"auto"` runs when CI is detected. Default: `"auto"`.
   - `commit_type`: string — override the conventional commit type prefix. Must be one of: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf`, `ci`, `build`, `style`. Default: inferred from diff content.
   - `main_branch`: string — the primary branch name for new git repos (e.g., `"main"`, `"master"`, `"trunk"`). Also used by `getMainBranch()` as the preferred branch when auto-detection is ambiguous. Default: `"main"`.
@@ -197,14 +197,14 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
   - `enabled`: boolean — enable kernel wrappers and contract observers. Default: `true`.
   - `legacy_fallback.enabled`: boolean — emergency release fallback that forces legacy orchestration behavior even when `uok.enabled` is `true`. Default: `false`.
     - Runtime override: set `GSD_UOK_FORCE_LEGACY=1` (or `GSD_UOK_LEGACY_FALLBACK=1`) to force legacy behavior for the current process.
-  - `gates.enabled`: boolean — route checks through the unified gate runner and persist `gate_runs`.
-  - `model_policy.enabled`: boolean — enforce policy filtering before model capability scoring.
-  - `execution_graph.enabled`: boolean — enable DAG scheduler facade/adapters for execution.
-  - `gitops.enabled`: boolean — persist turn-level git transaction records.
-  - `gitops.turn_action`: `"commit"` | `"snapshot"` | `"status-only"` — turn transaction mode.
-  - `gitops.turn_push`: boolean — whether turn transactions should include push intent metadata.
-  - `audit_unified.enabled`: boolean — dual-write unified audit envelope events.
-  - `plan_v2.enabled`: boolean — enable bounded clarify/research/draft/compile planning flow.
+  - `gates.enabled`: boolean — route checks through the unified gate runner and persist `gate_runs`. Default: `true`.
+  - `model_policy.enabled`: boolean — enforce policy filtering before model capability scoring. Default: `true`.
+  - `execution_graph.enabled`: boolean — enable DAG scheduler facade/adapters for execution. Default: `true`.
+  - `gitops.enabled`: boolean — persist turn-level git transaction records. Default: `true`.
+  - `gitops.turn_action`: `"commit"` | `"snapshot"` | `"status-only"` — turn transaction mode. Default: `"commit"` (per-task atomic commits).
+  - `gitops.turn_push`: boolean — whether turn transactions should include push intent metadata. Default: `false`.
+  - `audit_unified.enabled`: boolean — dual-write unified audit envelope events. Default: `true`.
+  - `plan_v2.enabled`: boolean — enable bounded clarify/research/draft/compile planning flow. Default: `true`.
 
 - `context_management`: configures context hygiene for auto-mode sessions. Keys:
   - `observation_masking`: boolean — mask old tool results to reduce context bloat. Default: `true`.

package/dist/resources/extensions/gsd/doctor-environment.js

@@ -11,6 +11,7 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { execSync } from "node:child_process";
 import { join } from "node:path";
+import { detectPythonExecutable } from "./python-resolver.js";
 // ── Constants ──────────────────────────────────────────────────────────────
 /** Default dev server ports to scan for conflicts. */
 const DEFAULT_DEV_PORTS = [3000, 3001, 4000, 5000, 5173, 8000, 8080, 8888];
@@ -350,7 +351,7 @@ function checkProjectTools(basePath) {
         }
         // Check for Python if pyproject.toml or requirements.txt exists
         if (existsSync(join(basePath, "pyproject.toml")) || existsSync(join(basePath, "requirements.txt"))) {
-            if (!commandExists("python3", basePath) && !commandExists("python", basePath)) {
+            if (detectPythonExecutable() === null) {
                 results.push({
                     name: "python",
                     status: "warning",

package/dist/resources/extensions/gsd/doctor-git-checks.js

@@ -2,7 +2,7 @@ import { existsSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs
 import { join, sep } from "node:path";
 import { loadFile } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
-import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
+import { isDbAvailable, getMilestone } from "./gsd-db.js";
 import { resolveMilestoneFile } from "./paths.js";
 import { deriveState, isMilestoneComplete } from "./state.js";
 import { listWorktrees, resolveGitDir, worktreesDir } from "./worktree-manager.js";
@@ -34,6 +34,35 @@ function isDoctorArtifactOnly(dirPath) {
         return false;
     }
 }
+function normalizePathForComparison(path) {
+    const resolved = existsSync(path) ? realpathSync(path) : path;
+    const normalized = resolved
+        .replaceAll("\\", "/")
+        .replace(/^\/\/\?\//, "")
+        .replace(/\/+$/, "");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function isSameOrNestedPath(candidate, container) {
+    const normalizedCandidate = normalizePathForComparison(candidate);
+    const normalizedContainer = normalizePathForComparison(container);
+    return normalizedCandidate === normalizedContainer ||
+        normalizedCandidate.startsWith(`${normalizedContainer}/`);
+}
+async function isCompletedMilestoneTerminal(basePath, milestoneId) {
+    const summaryPath = resolveMilestoneFile(basePath, milestoneId, "SUMMARY");
+    if (!summaryPath)
+        return false;
+    if (isDbAvailable()) {
+        const milestone = getMilestone(milestoneId);
+        return !!milestone && milestone.status === "complete";
+    }
+    const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
+    const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+    if (!roadmapContent)
+        return false;
+    const roadmap = parseLegacyRoadmap(roadmapContent);
+    return isMilestoneComplete(roadmap);
+}
 export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix, isolationMode = "none") {
     // Degrade gracefully if not a git repo
     if (!nativeIsRepo(basePath)) {
@@ -53,23 +82,9 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
                 // Extract milestone ID from branch name "milestone/M001" → "M001"
                 const milestoneId = wt.branch.replace(/^milestone\//, "");
                 const milestoneEntry = state.registry.find(m => m.id === milestoneId);
-                // Check if milestone is complete via roadmap
-                let isComplete = false;
-                if (milestoneEntry) {
-                    if (isDbAvailable()) {
-                        const dbSlices = getMilestoneSlices(milestoneId);
-                        isComplete = dbSlices.length > 0 && dbSlices.every(s => s.status === "complete");
-                    }
-                    else {
-                        const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
-                        const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
-                        if (roadmapContent) {
-                            const roadmap = parseLegacyRoadmap(roadmapContent);
-                            isComplete = isMilestoneComplete(roadmap);
-                        }
-                    }
-                    // When DB unavailable and no roadmap, isComplete stays false
-                }
+                const isComplete = milestoneEntry
+                    ? await isCompletedMilestoneTerminal(basePath, milestoneId)
+                    : false;
                 if (isComplete) {
                     issues.push({
                         severity: "warning",
@@ -84,8 +99,14 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
                         // pattern in removeWorktree() (#1946). Without this, git cannot
                         // remove the worktree and the doctor enters a deadlock where it
                         // detects the orphan every run but never cleans it up.
-                        const cwd = process.cwd();
-                        if (wt.path === cwd || cwd.startsWith(wt.path + sep)) {
+                        let cwd = basePath;
+                        try {
+                            cwd = process.cwd();
+                        }
+                        catch {
+                            cwd = basePath;
+                        }
+                        if (isSameOrNestedPath(cwd, wt.path)) {
                             try {
                                 process.chdir(basePath);
                             }
@@ -116,17 +137,10 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
                         const milestoneId = branch.replace(/^milestone\//, "");
                         const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
                         let branchMilestoneComplete = false;
-                        if (isDbAvailable()) {
-                            const dbSlices = getMilestoneSlices(milestoneId);
-                            branchMilestoneComplete = dbSlices.length > 0 && dbSlices.every(s => s.status === "complete");
-                        }
-                        else {
-                            const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
-                            if (!roadmapContent)
-                                continue;
-                            const roadmap = parseLegacyRoadmap(roadmapContent);
-                            branchMilestoneComplete = isMilestoneComplete(roadmap);
-                        }
+                        const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+                        if (!roadmapContent)
+                            continue;
+                        branchMilestoneComplete = await isCompletedMilestoneTerminal(basePath, milestoneId);
                         if (branchMilestoneComplete) {
                             issues.push({
                                 severity: "info",
@@ -365,8 +379,12 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
     // auto-commit a safety snapshot so work isn't lost.
     try {
         const prefs = loadEffectiveGSDPreferences()?.preferences ?? {};
+        // `git.snapshots: false` is the canonical toggle that disables WIP
+        // snapshot commits — honour it here as well so both the proactive gate
+        // and the doctor-run path stay consistent (#4420).
+        const snapshotsEnabled = prefs.git?.snapshots !== false;
         const thresholdMinutes = prefs.stale_commit_threshold_minutes ?? 30;
-        if (thresholdMinutes > 0) {
+        if (snapshotsEnabled && thresholdMinutes > 0) {
             const dirty = nativeHasChanges(basePath);
             if (dirty) {
                 const branch = nativeGetCurrentBranch(basePath);

package/dist/resources/extensions/gsd/doctor-proactive.js

@@ -238,8 +238,11 @@ export async function preDispatchHealthGate(basePath) {
     try {
         if (nativeIsRepo(basePath)) {
             const prefs = loadEffectiveGSDPreferences()?.preferences ?? {};
+            // `git.snapshots: false` is the canonical toggle that disables WIP
+            // snapshot commits — honour it before touching the threshold path (#4420).
+            const snapshotsEnabled = prefs.git?.snapshots !== false;
             const thresholdMinutes = prefs.stale_commit_threshold_minutes ?? 30;
-            if (thresholdMinutes > 0 && nativeHasChanges(basePath)) {
+            if (snapshotsEnabled && thresholdMinutes > 0 && nativeHasChanges(basePath)) {
                 const branch = nativeGetCurrentBranch(basePath);
                 const lastEpoch = nativeLastCommitEpoch(basePath, branch || "HEAD");
                 const nowEpoch = Math.floor(Date.now() / 1000);

package/dist/resources/extensions/gsd/doctor-providers.js

@@ -10,11 +10,33 @@
  *   - Remote questions channel if configured (Slack/Discord/Telegram token)
  *   - Optional search/tool integrations (Brave, Tavily, Jina, Context7)
  */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { delimiter, join } from "node:path";
 import { AuthStorage } from "@gsd/pi-coding-agent";
 import { getEnvApiKey } from "@gsd/pi-ai";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { getAuthPath, PROVIDER_REGISTRY } from "./key-manager.js";
+// ── Provider routing constants ────────────────────────────────────────────────
+/**
+ * Providers that use external CLI authentication (not API keys).
+ * These are always considered "found" — the host CLI handles auth.
+ */
+const CLI_AUTH_PROVIDERS = new Set([
+    "claude-code",
+    "openai-codex",
+    "google-gemini-cli",
+    "google-antigravity",
+]);
+/**
+ * Providers that can serve models normally associated with another provider.
+ * Key = the provider whose models can be served, Value = alternative providers to check.
+ * e.g. GitHub Copilot subscriptions can access Claude and GPT models.
+ */
+const PROVIDER_ROUTES = {
+    anthropic: ["github-copilot", "claude-code"],
+    openai: ["github-copilot", "openai-codex"],
+    google: ["google-gemini-cli"],
+};
 // ── Model → Provider ID mapping ───────────────────────────────────────────────
 /**
  * Infer the auth provider ID from a model string.
@@ -25,7 +47,8 @@ function modelToProviderId(model) {
         return null;
     // Explicit provider prefix (e.g. "openrouter/deepseek-r1")
     if (model.includes("/")) {
-        const prefix = model.split("/")[0].toLowerCase();
+        const rawPrefix = model.split("/")[0];
+        const prefix = rawPrefix.toLowerCase();
         // Map known prefixes to registry IDs
         const prefixMap = {
             "anthropic-vertex": "anthropic-vertex",
@@ -40,6 +63,7 @@ function modelToProviderId(model) {
         };
         if (prefixMap[prefix])
             return prefixMap[prefix];
+        return rawPrefix;
     }
     const lower = model.toLowerCase();
     if (lower.startsWith("claude"))
@@ -96,8 +120,75 @@ function collectConfiguredModelProviders() {
         providers.add("anthropic");
     return providers;
 }
+/**
+ * Map of CLI provider IDs to their binary names on disk.
+ * Used for lightweight binary-presence checks (PATH scan, no subprocess).
+ */
+const CLI_BINARY_MAP = {
+    "claude-code": "claude",
+    "openai-codex": "codex",
+    "google-gemini-cli": "gemini",
+    "google-antigravity": "antigravity",
+};
+/**
+ * Check if a CLI provider's binary exists anywhere in PATH.
+ * Fast filesystem scan — no subprocess, no network, sub-1ms.
+ */
+function isCliBinaryInPath(providerId) {
+    const binary = CLI_BINARY_MAP[providerId];
+    if (!binary)
+        return false;
+    const pathDirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+    // On Windows, command shims are commonly installed as .cmd/.exe/.bat/.com.
+    // Scan PATHEXT candidates in addition to the bare binary name.
+    const executableNames = [binary];
+    if (process.platform === "win32") {
+        const rawPathExt = process.env.PATHEXT
+            ?.split(";")
+            .map(ext => ext.trim())
+            .filter(Boolean) ?? [];
+        const normalizedPathExt = rawPathExt.map(ext => ext.startsWith(".") ? ext.toLowerCase() : `.${ext.toLowerCase()}`);
+        const defaultExt = [".exe", ".cmd", ".bat", ".com"];
+        for (const ext of [...normalizedPathExt, ...defaultExt]) {
+            const candidate = `${binary}${ext}`;
+            if (!executableNames.includes(candidate))
+                executableNames.push(candidate);
+        }
+    }
+    return pathDirs.some(dir => executableNames.some(name => existsSync(join(dir, name))));
+}
+function modelsJsonPaths() {
+    const home = process.env.HOME ?? "~";
+    return [
+        join(home, ".gsd", "agent", "models.json"),
+        // Keep parity with custom-provider discovery during auto bootstrap.
+        join(home, ".pi", "agent", "models.json"),
+    ];
+}
+function hasModelsJsonApiKey(providerId) {
+    for (const path of modelsJsonPaths()) {
+        if (!existsSync(path))
+            continue;
+        try {
+            const parsed = JSON.parse(readFileSync(path, "utf-8"));
+            const apiKey = parsed.providers?.[providerId]?.apiKey;
+            if (typeof apiKey === "string" && apiKey.trim().length > 0) {
+                return true;
+            }
+        }
+        catch {
+            // Malformed models.json should not break the dashboard health check.
+        }
+    }
+    return false;
+}
 function resolveKey(providerId) {
     const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
+    // claude-code never stores credentials in auth.json — GSD delegates entirely to
+    // the local CLI binary. Presence of the binary in PATH is the only signal.
+    if (providerId === "claude-code") {
+        return { found: isCliBinaryInPath("claude-code"), source: "env", backedOff: false };
+    }
     if (providerId === "anthropic-vertex" && process.env.ANTHROPIC_VERTEX_PROJECT_ID) {
         return { found: true, source: "env", backedOff: false };
     }
@@ -134,29 +225,12 @@ function resolveKey(providerId) {
     if (info?.envVar && process.env[info.envVar]) {
         return { found: true, source: "env", backedOff: false };
     }
+    if (hasModelsJsonApiKey(providerId)) {
+        return { found: true, source: "models.json", backedOff: false };
+    }
     return { found: false, source: "none", backedOff: false };
 }
 // ── Individual check groups ────────────────────────────────────────────────────
-/**
- * Providers that can serve models normally associated with another provider.
- * Key = the provider whose models can be served, Value = alternative providers to check.
- * e.g. GitHub Copilot subscriptions can access Claude and GPT models.
- */
-const PROVIDER_ROUTES = {
-    anthropic: ["github-copilot"],
-    openai: ["github-copilot", "openai-codex"],
-    google: ["google-gemini-cli"],
-};
-/**
- * Providers that use external CLI authentication (not API keys).
- * These are always considered "ok" — the host CLI handles auth.
- */
-const CLI_AUTH_PROVIDERS = new Set([
-    "claude-code",
-    "openai-codex",
-    "google-gemini-cli",
-    "google-antigravity",
-]);
 function checkLlmProviders() {
     const required = collectConfiguredModelProviders();
     const results = [];

package/dist/resources/extensions/gsd/doctor-runtime-checks.js

@@ -6,9 +6,10 @@ import { deriveState } from "./state.js";
 import { saveFile } from "./files.js";
 import { nativeIsRepo, nativeForEachRef, nativeUpdateRef } from "./native-git-bridge.js";
 import { readCrashLock, isLockProcessAlive, clearLock } from "./crash-recovery.js";
-import { ensureGitignore } from "./gitignore.js";
+import { ensureGitignore, isGsdGitignored } from "./gitignore.js";
 import { readAllSessionStatuses, isSessionStale, removeSessionStatus } from "./session-status-io.js";
 import { recoverFailedMigration } from "./migrate-external.js";
+import { splitCompletedKey } from "./forensics.js";
 export async function checkRuntimeHealth(basePath, issues, fixesApplied, shouldFix) {
     const root = gsdRoot(basePath);
     // ── Stale crash lock ──────────────────────────────────────────────────
@@ -107,9 +108,6 @@ export async function checkRuntimeHealth(basePath, issues, fixesApplied, shouldF
             const keys = JSON.parse(raw);
             const orphaned = [];
             for (const key of keys) {
-                // Key format: "unitType/unitId" e.g. "execute-task/M001/S01/T01"
-                // Hook units have compound types: "hook/<hookName>/unitId"
-                const { splitCompletedKey } = await import("./forensics.js");
                 const parsed = splitCompletedKey(key);
                 if (!parsed)
                     continue;
@@ -352,6 +350,26 @@ export async function checkRuntimeHealth(basePath, issues, fixesApplied, shouldF
                         fixable: false,
                     });
                 }
+                // ── Symlinked .gsd without .gitignore entry (#4423) ──
+                // When `.gsd` is a symlink AND not gitignored, `git add -A -- :!.gsd/...`
+                // pathspecs fail with "beyond a symbolic link". Without self-heal this
+                // silently drops new user files during auto-commit.
+                if (nativeIsRepo(basePath) && !isGsdGitignored(basePath)) {
+                    issues.push({
+                        severity: "warning",
+                        code: "symlinked_gsd_unignored",
+                        scope: "project",
+                        unitId: "project",
+                        message: ".gsd is a symlink to external state but is not listed in .gitignore. This causes git pathspec exclusions to fail and can lead to silently dropped new files during auto-commit. Add `.gsd` to .gitignore.",
+                        file: ".gitignore",
+                        fixable: true,
+                    });
+                    if (shouldFix("symlinked_gsd_unignored")) {
+                        const modified = ensureGitignore(basePath);
+                        if (modified)
+                            fixesApplied.push("added .gsd to .gitignore (symlinked external state)");
+                    }
+                }
             }
         }
     }

package/dist/resources/extensions/gsd/doctor.js

@@ -154,8 +154,14 @@ function auditRequirements(content) {
         const owner = block.match(/^-\s+Primary owning slice:\s+(.+)$/m)?.[1]?.trim().toLowerCase() ?? "";
         const notes = block.match(/^-\s+Notes:\s+(.+)$/m)?.[1]?.trim().toLowerCase() ?? "";
         if (status === "active" && (!owner || owner === "none" || owner === "none yet")) {
+            // #4414: Downgrade to warning. A newly-created requirement has
+            // primary_owner='' by default until the planning agent wires it to
+            // a slice via gsd_requirement_update. Flagging this as an error
+            // during normal planning is noisy — the real failure mode is when
+            // it persists past milestone completion, which is covered by other
+            // audits. Keep the signal but don't treat it as a blocker.
             issues.push({
-                severity: "error",
+                severity: "warning",
                 code: "active_requirement_missing_owner",
                 scope: "project",
                 unitId: requirementId,

package/dist/resources/extensions/gsd/ecosystem/gsd-extension-api.js

@@ -101,6 +101,7 @@ export function createGSDExtensionAPI(pi, sharedHandlers) {
         // ── Event emission ─────────────────────────────────────────────────
         emitBeforeModelSelect: (...args) => pi.emitBeforeModelSelect(...args),
         emitAdjustToolSet: (...args) => pi.emitAdjustToolSet(...args),
+        emitExtensionEvent: (...args) => pi.emitExtensionEvent(...args),
         // ── Tool / command / shortcut / flag registration ──────────────────
         registerTool: ((tool) => pi.registerTool(tool)),
         registerCommand: (...args) => pi.registerCommand(...args),

package/dist/resources/extensions/gsd/error-classifier.js

@@ -19,11 +19,14 @@ export function resetRetryState(state) {
 }
 // ── Classification ──────────────────────────────────────────────────────────
 const PERMANENT_RE = /auth|unauthorized|forbidden|invalid.*key|invalid.*api|billing|quota exceeded|account/i;
-const RATE_LIMIT_RE = /rate.?limit|too many requests|429/i;
+// Include provider-specific quota-window phrasing like:
+// - "You've hit your limit"
+// - "usage limit" / "quota reached"
+const RATE_LIMIT_RE = /rate.?limit|too many requests|429|hit your limit|usage limit|quota (?:reached|hit)|limit.*resets?/i;
 // OpenRouter affordability-style quota errors should be treated as transient
 // so core retry logic can lower maxTokens and continue in-session.
 const AFFORDABILITY_RE = /requires more credits|can only afford|insufficient credits|not enough credits|fewer max_tokens/i;
-const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns/i;
+const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns|unexpected eof/i;
 const SERVER_RE = /internal server error|500|502|503|overloaded|server_error|api_error|service.?unavailable/i;
 // ECONNRESET/ECONNREFUSED are in NETWORK_RE (same-model retry first).
 const CONNECTION_RE = /terminated|connection.?(?:refused|error)|other side closed|EPIPE|network.?(?:is\s+)?unavailable|stream_exhausted(?:_without_result)?/i;
@@ -36,7 +39,7 @@ const RESET_DELAY_RE = /reset in (\d+)s/i;
  *
  * Classification order:
  *  1. Permanent (auth/billing/quota) — unless also rate-limited
- *  2. Rate limit (429, rate.?limit, too many requests)
+ *  2. Rate limit (429, rate.?limit, too many requests, hit-your-limit/quota-window phrasing)
  *  3. Network (ECONNRESET, ETIMEDOUT, socket hang up, fetch failed, dns)
  *  4. Stream truncation (malformed JSON from mid-stream cut)
  *  5. Server (500/502/503, overloaded, server_error)