gsd-pi 2.76.0 → 2.77.0-dev.1594b263e

package/dist/resources/extensions/gsd/context-store.js

@@ -180,7 +180,13 @@ export function queryProject() {
 // ─── Knowledge Query ───────────────────────────────────────────────────────
 /**
  * Filter KNOWLEDGE.md sections by keyword matching.
- * Uses H2 sections, matches keywords case-insensitively against:
+ *
+ * Structure-adaptive (issue #4719): files that organise entries as H3 items
+ * under one or more H2 topics are filtered at H3 granularity. Files with only
+ * H2 topic headers (no H3) fall back to H2-level filtering for backwards
+ * compatibility.
+ *
+ * Matches keywords case-insensitively against:
  * 1. Section header text
  * 2. First paragraph of section content (up to first blank line or next heading)
  *
@@ -189,28 +195,38 @@ export function queryProject() {
  *
  * @param content - Full KNOWLEDGE.md content
  * @param keywords - Keywords to match (case-insensitive)
- * @returns Concatenated matching sections with H2 headers, or empty string
+ * @returns Concatenated matching sections with their original heading prefix, or empty string
  */
 export async function queryKnowledge(content, keywords) {
     if (!content || keywords.length === 0)
         return '';
     // Lazy import to avoid circular dependency
     const { extractAllSections } = await import('./files.js');
-    const sections = extractAllSections(content, 2);
+    // Prefer H3 granularity when available; fall back to H2 for H2-only files.
+    // This prevents single-H2-with-many-H3 layouts from returning the entire
+    // file on a keyword match against the H2 header or its first paragraph.
+    const h3Sections = extractAllSections(content, 3);
+    const useH3 = h3Sections.size > 0;
+    const sections = useH3 ? h3Sections : extractAllSections(content, 2);
     if (sections.size === 0)
         return '';
-    // Normalize keywords for case-insensitive matching
-    const normalizedKeywords = keywords.map(k => k.toLowerCase());
+    const prefix = useH3 ? '###' : '##';
+    // Trim, lowercase, drop empties, and de-dupe so callers can pass raw
+    // user-provided strings without risking empty-string / whitespace matches.
+    const normalizedKeywords = [...new Set(keywords
+            .map(k => k.trim().toLowerCase())
+            .filter(k => k.length > 0))];
+    if (normalizedKeywords.length === 0)
+        return '';
     const matchingSections = [];
     for (const [header, body] of sections) {
         // Extract first paragraph: everything up to first blank line or next heading
         const firstParagraph = body.split(/\n\s*\n|\n#/)[0] || '';
-        // Check if any keyword matches header or first paragraph
         const headerLower = header.toLowerCase();
         const paragraphLower = firstParagraph.toLowerCase();
         const matches = normalizedKeywords.some(kw => headerLower.includes(kw) || paragraphLower.includes(kw));
         if (matches) {
-            matchingSections.push(`## ${header}\n\n${body}`);
+            matchingSections.push(`${prefix} ${header}\n\n${body}`);
         }
     }
     return matchingSections.join('\n\n');

package/dist/resources/extensions/gsd/db-writer.js

@@ -205,6 +205,19 @@ export async function nextDecisionId() {
         return 'D001';
     }
 }
+/** Synchronous variant for use inside db.transaction(). */
+function nextDecisionIdSync(adapter) {
+    if (!adapter)
+        return 'D001';
+    const row = adapter
+        .prepare('SELECT MAX(CAST(SUBSTR(id, 2) AS INTEGER)) as max_num FROM decisions')
+        .get();
+    const maxNum = row ? row['max_num'] : null;
+    if (maxNum == null || isNaN(maxNum))
+        return 'D001';
+    const next = maxNum + 1;
+    return `D${String(next).padStart(3, '0')}`;
+}
 // ─── Next Requirement ID ─────────────────────────────────────────────────
 /**
  * Compute the next requirement ID from the current DB state.
@@ -318,32 +331,44 @@ export async function saveRequirementToDb(fields, basePath) {
         throw err;
     }
 }
+// ─── Async Mutex for Decision Saves ───────────────────────────────────────
+//
+// Serializes the entire saveDecisionToDb operation (ID generation + DB upsert
+// + file read + markdown regeneration + file write) so that parallel callers
+// cannot interleave and produce a last-writer-wins race on DECISIONS.md.
+let _decisionSaveLock = Promise.resolve();
+/** Reset the mutex — only for tests. */
+export function _resetDecisionSaveLock() {
+    _decisionSaveLock = Promise.resolve();
+}
 /**
  * Save a new decision to DB and regenerate DECISIONS.md.
  * Auto-assigns the next ID via nextDecisionId().
  *
- * The ID computation (SELECT MAX) and insert are wrapped in a single
- * transaction to prevent parallel tool calls from computing the same ID
- * and silently overwriting each other (#3326, #3339, #3459).
+ * Concurrency: uses an async mutex (promise chain) to serialize the entire
+ * operation — ID generation, DB upsert, file read, markdown regeneration,
+ * and file write — preventing parallel callers from overwriting each other's
+ * output (last-writer-wins race condition).
  *
  * Returns the assigned ID.
  */
 export async function saveDecisionToDb(fields, basePath) {
+    // Serialize via async mutex: each call waits for the previous one to
+    // complete before starting, preventing interleaved DB + file writes.
+    let release;
+    const prev = _decisionSaveLock;
+    _decisionSaveLock = new Promise(r => { release = r; });
+    try {
+        await prev;
+    }
+    catch {
+        // Previous call failed — proceed regardless; the lock chain must continue.
+    }
     try {
         const db = await import('./gsd-db.js');
-        // Atomic ID assignment + insert inside a transaction to prevent
-        // parallel calls from racing on the same MAX(id) value.
+        const adapter = db._getAdapter();
         const id = db.transaction(() => {
-            const adapter = db._getAdapter();
-            if (!adapter)
-                throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
-            const row = adapter
-                .prepare('SELECT MAX(CAST(SUBSTR(id, 2) AS INTEGER)) as max_num FROM decisions')
-                .get();
-            const maxNum = row ? row['max_num'] : null;
-            const nextId = (maxNum == null || isNaN(maxNum))
-                ? 'D001'
-                : `D${String(maxNum + 1).padStart(3, '0')}`;
+            const nextId = nextDecisionIdSync(adapter);
             db.upsertDecision({
                 id: nextId,
                 when_context: fields.when_context ?? '',
@@ -359,7 +384,6 @@ export async function saveDecisionToDb(fields, basePath) {
             return nextId;
         });
         // Fetch all decisions (including superseded for the full register)
-        const adapter = db._getAdapter();
         let allDecisions = [];
         if (adapter) {
             const rows = adapter.prepare('SELECT * FROM decisions ORDER BY seq').all();
@@ -434,12 +458,60 @@ export async function saveDecisionToDb(fields, basePath) {
         invalidateStateCache();
         clearPathCache();
         clearParseCache();
+        // ADR-013 dual-write: keep the memory store in sync with every decision
+        // persisted via the legacy gsd_save_decision path. Without this, prompts
+        // that still call gsd_save_decision (discuss.md, plan-milestone.md,
+        // guided-plan-slice.md, et al. during the deprecation window) would
+        // create decisions rows invisible to memory_query and loadMemoryBlock.
+        // Best-effort — never throw, never roll back the decision on failure.
+        try {
+            const { createMemory } = await import('./memory-store.js');
+            const decisionText = (fields.decision ?? '').trim();
+            const choiceText = (fields.choice ?? '').trim();
+            const rationaleText = (fields.rationale ?? '').trim();
+            const contentParts = [];
+            if (decisionText)
+                contentParts.push(decisionText);
+            if (choiceText)
+                contentParts.push(`Chose: ${choiceText}.`);
+            if (rationaleText)
+                contentParts.push(`Rationale: ${rationaleText}.`);
+            const content = contentParts.join(' ').slice(0, 600);
+            if (content) {
+                createMemory({
+                    category: 'architecture',
+                    content,
+                    scope: fields.scope || 'project',
+                    confidence: 0.85,
+                    structuredFields: {
+                        sourceDecisionId: id,
+                        when_context: fields.when_context ?? '',
+                        scope: fields.scope,
+                        decision: fields.decision,
+                        choice: fields.choice,
+                        rationale: fields.rationale,
+                        made_by: fields.made_by ?? 'agent',
+                        revisable: fields.revisable ?? '',
+                    },
+                });
+            }
+        }
+        catch (mirrorErr) {
+            logError('manifest', 'memory-store mirror write failed (non-fatal)', {
+                fn: 'saveDecisionToDb',
+                decisionId: id,
+                error: String(mirrorErr.message),
+            });
+        }
         return { id };
     }
     catch (err) {
         logError('manifest', 'saveDecisionToDb failed', { fn: 'saveDecisionToDb', error: String(err.message) });
         throw err;
     }
+    finally {
+        release();
+    }
 }
 /**
  * Extract a milestone/slice reference from a deferral decision.

package/dist/resources/extensions/gsd/detection.js

@@ -6,7 +6,7 @@
  * flow to show when entering a project directory.
  */
 import { existsSync, openSync, readSync, closeSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join, parse as parsePath } from "node:path";
 import { homedir } from "node:os";
 import { gsdRoot } from "./paths.js";
 const gsdHome = process.env.GSD_HOME || join(homedir(), ".gsd");
@@ -951,6 +951,54 @@ function resolveVersionCatalogAccessors(basePath, versionCatalogFiles, settingsF
     }
     return accessors;
 }
+/**
+ * Walk ancestor directories of `startDir` looking for any file in
+ * `PROJECT_FILES`. Stops at the filesystem root or at a `.git` boundary
+ * (so ancestors above a git repo root — e.g. `$HOME` or `/usr/local` —
+ * can't trigger false positives). Returns true if an ancestor contains
+ * one of the project markers.
+ *
+ * Used by the worktree health check (#2347) to avoid warning about
+ * monorepos where package.json / Cargo.toml / etc. live in a parent
+ * directory rather than in the worktree's own checkout.
+ *
+ * `existsFn` is injectable so this remains deterministically testable
+ * without touching the real filesystem; defaults to `fs.existsSync`.
+ */
+export function hasProjectFileInAncestor(startDir, existsFn = existsSync) {
+    let checkDir = dirname(startDir);
+    const { root } = parsePath(checkDir);
+    while (checkDir !== root) {
+        if (PROJECT_FILES.some((f) => existsFn(join(checkDir, f)))) {
+            return true;
+        }
+        // Stop at git repository boundary — ancestors above the repo root
+        // may contain unrelated project files. Check AFTER project-file scan
+        // so a repo root containing both .git and a marker is still recognized.
+        if (existsFn(join(checkDir, ".git")))
+            return false;
+        checkDir = dirname(checkDir);
+    }
+    return false;
+}
+/**
+ * Check whether a project's `.gsd/` directory contains the bootstrap artifacts
+ * (`PREFERENCES.md` or `milestones/`) that indicate a completed init run.
+ *
+ * A zombie `.gsd/` state — symlink exists but neither artifact is present —
+ * must be treated as "needs init wizard". The previous guard checked only
+ * `existsSync(gsdRoot(basePath))`, which accepted zombie states and skipped
+ * the wizard (#2942).
+ *
+ * `existsFn` is injectable so tests can run deterministically; defaults to
+ * `fs.existsSync`.
+ */
+export function hasGsdBootstrapArtifacts(gsdPath, existsFn = existsSync) {
+    return (existsFn(gsdPath) &&
+        (existsFn(join(gsdPath, "PREFERENCES.md")) ||
+            existsFn(join(gsdPath, "preferences.md")) ||
+            existsFn(join(gsdPath, "milestones"))));
+}
 export function scanProjectFiles(basePath) {
     const files = [];
     const queue = [{ path: basePath, depth: 0 }];

package/dist/resources/extensions/gsd/dispatch-guard.js

@@ -2,9 +2,10 @@
 import { resolveMilestoneFile } from "./paths.js";
 import { findMilestoneIds } from "./guided-flow.js";
 import { parseUnitId } from "./unit-id.js";
-import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
+import { isDbAvailable, getMilestoneSlices, getMilestone } from "./gsd-db.js";
 import { parseRoadmap } from "./parsers-legacy.js";
 import { isClosedStatus } from "./status-guards.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { readFileSync } from "node:fs";
 const SLICE_DISPATCH_TYPES = new Set([
     "research-slice",
@@ -39,8 +40,33 @@ export function getPriorSliceCompletionBlocker(base, _mainBranch, unitType, unit
     for (const mid of milestoneIds) {
         if (resolveMilestoneFile(base, mid, "PARKED"))
             continue;
-        if (resolveMilestoneFile(base, mid, "SUMMARY"))
-            continue;
+        // DB/SUMMARY completion check (#4663 sibling to #4658).
+        // Prior behavior treated any SUMMARY file on disk as proof of milestone
+        // completion, which is wrong when the SUMMARY is a failure-path report
+        // (verification FAILED, blocker placeholder, etc.). Resolve as follows:
+        //   1. When DB is available and status is closed → skip (authoritative).
+        //   2. When SUMMARY exists but looks like a failure/blocker report →
+        //      do not short-circuit; fall through to the slice-level check so
+        //      the guard can still block dependents of an active milestone.
+        //   3. Otherwise (SUMMARY without failure markers) → skip. Preserves
+        //      the #1716 contract where a completed milestone with unchecked
+        //      remediation slices is still treated as done.
+        const summaryPath = resolveMilestoneFile(base, mid, "SUMMARY");
+        if (isDbAvailable()) {
+            const milestoneRow = getMilestone(mid);
+            if (milestoneRow && isClosedStatus(milestoneRow.status))
+                continue;
+        }
+        if (summaryPath) {
+            let summaryContent = null;
+            try {
+                summaryContent = readFileSync(summaryPath, "utf-8");
+            }
+            catch { /* ignore */ }
+            if (!summaryContent || classifyMilestoneSummaryContent(summaryContent) !== "failure") {
+                continue;
+            }
+        }
         let slices = null;
         if (isDbAvailable()) {
             const rows = getMilestoneSlices(mid);

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -159,7 +159,7 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
 
 - `phases`: fine-grained control over which phases run. Usually set by `token_profile`, but can be overridden. Keys:
   - `skip_research`: boolean — skip milestone-level research. Default: `false`.
-  - `reassess_after_slice`: boolean — run roadmap reassessment after each completed slice. Default: `true`.
+  - `reassess_after_slice`: boolean — run a dedicated roadmap-reassessment unit after each completed slice. Default: `false` (per ADR-003 §4). The plan-slice agent for the next slice performs JIT reassessment via a prompt preamble at zero additional token cost; a dedicated reassess session is opt-in. Set to `true` (e.g. via the `burn-max` profile) if you want the explicit session.
   - `skip_reassess`: boolean — force-disable roadmap reassessment even if `reassess_after_slice` is enabled. Default: `false`.
   - `skip_slice_research`: boolean — skip per-slice research. Default: `false`.
 

package/dist/resources/extensions/gsd/doctor-git-checks.js

@@ -2,7 +2,7 @@ import { existsSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs
 import { join, sep } from "node:path";
 import { loadFile } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
-import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
+import { isDbAvailable, getMilestone } from "./gsd-db.js";
 import { resolveMilestoneFile } from "./paths.js";
 import { deriveState, isMilestoneComplete } from "./state.js";
 import { listWorktrees, resolveGitDir, worktreesDir } from "./worktree-manager.js";
@@ -48,6 +48,21 @@ function isSameOrNestedPath(candidate, container) {
     return normalizedCandidate === normalizedContainer ||
         normalizedCandidate.startsWith(`${normalizedContainer}/`);
 }
+async function isCompletedMilestoneTerminal(basePath, milestoneId) {
+    const summaryPath = resolveMilestoneFile(basePath, milestoneId, "SUMMARY");
+    if (!summaryPath)
+        return false;
+    if (isDbAvailable()) {
+        const milestone = getMilestone(milestoneId);
+        return !!milestone && milestone.status === "complete";
+    }
+    const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
+    const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+    if (!roadmapContent)
+        return false;
+    const roadmap = parseLegacyRoadmap(roadmapContent);
+    return isMilestoneComplete(roadmap);
+}
 export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix, isolationMode = "none") {
     // Degrade gracefully if not a git repo
     if (!nativeIsRepo(basePath)) {
@@ -67,23 +82,9 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
                 // Extract milestone ID from branch name "milestone/M001" → "M001"
                 const milestoneId = wt.branch.replace(/^milestone\//, "");
                 const milestoneEntry = state.registry.find(m => m.id === milestoneId);
-                // Check if milestone is complete via roadmap
-                let isComplete = false;
-                if (milestoneEntry) {
-                    if (isDbAvailable()) {
-                        const dbSlices = getMilestoneSlices(milestoneId);
-                        isComplete = dbSlices.length > 0 && dbSlices.every(s => s.status === "complete");
-                    }
-                    else {
-                        const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
-                        const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
-                        if (roadmapContent) {
-                            const roadmap = parseLegacyRoadmap(roadmapContent);
-                            isComplete = isMilestoneComplete(roadmap);
-                        }
-                    }
-                    // When DB unavailable and no roadmap, isComplete stays false
-                }
+                const isComplete = milestoneEntry
+                    ? await isCompletedMilestoneTerminal(basePath, milestoneId)
+                    : false;
                 if (isComplete) {
                     issues.push({
                         severity: "warning",
@@ -136,17 +137,10 @@ export async function checkGitHealth(basePath, issues, fixesApplied, shouldFix,
                         const milestoneId = branch.replace(/^milestone\//, "");
                         const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
                         let branchMilestoneComplete = false;
-                        if (isDbAvailable()) {
-                            const dbSlices = getMilestoneSlices(milestoneId);
-                            branchMilestoneComplete = dbSlices.length > 0 && dbSlices.every(s => s.status === "complete");
-                        }
-                        else {
-                            const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
-                            if (!roadmapContent)
-                                continue;
-                            const roadmap = parseLegacyRoadmap(roadmapContent);
-                            branchMilestoneComplete = isMilestoneComplete(roadmap);
-                        }
+                        const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+                        if (!roadmapContent)
+                            continue;
+                        branchMilestoneComplete = await isCompletedMilestoneTerminal(basePath, milestoneId);
                         if (branchMilestoneComplete) {
                             issues.push({
                                 severity: "info",

package/dist/resources/extensions/gsd/doctor-providers.js

@@ -10,8 +10,8 @@
  *   - Remote questions channel if configured (Slack/Discord/Telegram token)
  *   - Optional search/tool integrations (Brave, Tavily, Jina, Context7)
  */
-import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { delimiter, join } from "node:path";
 import { AuthStorage } from "@gsd/pi-coding-agent";
 import { getEnvApiKey } from "@gsd/pi-ai";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
@@ -47,7 +47,8 @@ function modelToProviderId(model) {
         return null;
     // Explicit provider prefix (e.g. "openrouter/deepseek-r1")
     if (model.includes("/")) {
-        const prefix = model.split("/")[0].toLowerCase();
+        const rawPrefix = model.split("/")[0];
+        const prefix = rawPrefix.toLowerCase();
         // Map known prefixes to registry IDs
         const prefixMap = {
             "anthropic-vertex": "anthropic-vertex",
@@ -62,6 +63,7 @@ function modelToProviderId(model) {
         };
         if (prefixMap[prefix])
             return prefixMap[prefix];
+        return rawPrefix;
     }
     const lower = model.toLowerCase();
     if (lower.startsWith("claude"))
@@ -136,8 +138,49 @@ function isCliBinaryInPath(providerId) {
     const binary = CLI_BINARY_MAP[providerId];
     if (!binary)
         return false;
-    const pathDirs = (process.env.PATH ?? "").split(":");
-    return pathDirs.some(dir => dir && existsSync(join(dir, binary)));
+    const pathDirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+    // On Windows, command shims are commonly installed as .cmd/.exe/.bat/.com.
+    // Scan PATHEXT candidates in addition to the bare binary name.
+    const executableNames = [binary];
+    if (process.platform === "win32") {
+        const rawPathExt = process.env.PATHEXT
+            ?.split(";")
+            .map(ext => ext.trim())
+            .filter(Boolean) ?? [];
+        const normalizedPathExt = rawPathExt.map(ext => ext.startsWith(".") ? ext.toLowerCase() : `.${ext.toLowerCase()}`);
+        const defaultExt = [".exe", ".cmd", ".bat", ".com"];
+        for (const ext of [...normalizedPathExt, ...defaultExt]) {
+            const candidate = `${binary}${ext}`;
+            if (!executableNames.includes(candidate))
+                executableNames.push(candidate);
+        }
+    }
+    return pathDirs.some(dir => executableNames.some(name => existsSync(join(dir, name))));
+}
+function modelsJsonPaths() {
+    const home = process.env.HOME ?? "~";
+    return [
+        join(home, ".gsd", "agent", "models.json"),
+        // Keep parity with custom-provider discovery during auto bootstrap.
+        join(home, ".pi", "agent", "models.json"),
+    ];
+}
+function hasModelsJsonApiKey(providerId) {
+    for (const path of modelsJsonPaths()) {
+        if (!existsSync(path))
+            continue;
+        try {
+            const parsed = JSON.parse(readFileSync(path, "utf-8"));
+            const apiKey = parsed.providers?.[providerId]?.apiKey;
+            if (typeof apiKey === "string" && apiKey.trim().length > 0) {
+                return true;
+            }
+        }
+        catch {
+            // Malformed models.json should not break the dashboard health check.
+        }
+    }
+    return false;
 }
 function resolveKey(providerId) {
     const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
@@ -182,6 +225,9 @@ function resolveKey(providerId) {
     if (info?.envVar && process.env[info.envVar]) {
         return { found: true, source: "env", backedOff: false };
     }
+    if (hasModelsJsonApiKey(providerId)) {
+        return { found: true, source: "models.json", backedOff: false };
+    }
     return { found: false, source: "none", backedOff: false };
 }
 // ── Individual check groups ────────────────────────────────────────────────────

package/dist/resources/extensions/gsd/ecosystem/gsd-extension-api.js

@@ -101,6 +101,7 @@ export function createGSDExtensionAPI(pi, sharedHandlers) {
         // ── Event emission ─────────────────────────────────────────────────
         emitBeforeModelSelect: (...args) => pi.emitBeforeModelSelect(...args),
         emitAdjustToolSet: (...args) => pi.emitAdjustToolSet(...args),
+        emitExtensionEvent: (...args) => pi.emitExtensionEvent(...args),
         // ── Tool / command / shortcut / flag registration ──────────────────
         registerTool: ((tool) => pi.registerTool(tool)),
         registerCommand: (...args) => pi.registerCommand(...args),

package/dist/resources/extensions/gsd/error-classifier.js

@@ -22,18 +22,35 @@ const PERMANENT_RE = /auth|unauthorized|forbidden|invalid.*key|invalid.*api|bill
 // Include provider-specific quota-window phrasing like:
 // - "You've hit your limit"
 // - "usage limit" / "quota reached"
-const RATE_LIMIT_RE = /rate.?limit|too many requests|429|hit your limit|usage limit|quota (?:reached|hit)|limit.*resets?/i;
+// - "out of extra usage"
+const RATE_LIMIT_RE = /rate.?limit|too many requests|429|hit your limit|usage limit|out of extra usage|quota (?:reached|hit)|limit.*resets?/i;
 // OpenRouter affordability-style quota errors should be treated as transient
 // so core retry logic can lower maxTokens and continue in-session.
 const AFFORDABILITY_RE = /requires more credits|can only afford|insufficient credits|not enough credits|fewer max_tokens/i;
-const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns|unexpected eof/i;
-const SERVER_RE = /internal server error|500|502|503|overloaded|server_error|api_error|service.?unavailable/i;
+// "Stream idle timeout" and "partial response received" are emitted by the SDK/harness
+// for mid-stream disconnects. Both indicate a transient network-level interruption.
+// See: https://github.com/gsd-build/gsd-2/issues/4558
+const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns|unexpected eof|stream idle timeout|partial response received/i;
+// Context overflow errors (context window/length exceeded) should be treated as server-class
+// transient errors so auto-mode can retry with reduced budget or fall back to a larger-context model.
+// See: https://github.com/gsd-build/gsd-2/issues/4528
+const SERVER_RE = /internal server error|500|502|503|overloaded|server_error|api_error|service.?unavailable|context (?:window|length) exceed|context window exceed/i;
 // ECONNRESET/ECONNREFUSED are in NETWORK_RE (same-model retry first).
 const CONNECTION_RE = /terminated|connection.?(?:refused|error)|other side closed|EPIPE|network.?(?:is\s+)?unavailable|stream_exhausted(?:_without_result)?/i;
 // Catch-all for V8 JSON.parse errors: all modern variants end with "in JSON at position \d+".
 // This eliminates the need to enumerate every error message variant individually.
 const STREAM_RE = /in JSON at position \d+|Unexpected end of JSON|SyntaxError.*JSON/i;
 const RESET_DELAY_RE = /reset in (\d+)s/i;
+// Provider-side model entitlement rejection: the SDK accepted the model switch,
+// but the provider refused at request time because the current account/plan/tier
+// cannot use that model.  Must match all three of: a model/deployment token,
+// a negative-entitlement indicator, and an account/plan/tier/subscription token.
+// Requiring all three keeps generic "account suspended" errors in `permanent`
+// (no model token) while catching the phrasings providers actually use.
+// See issue #4513.
+const UNSUPPORTED_MODEL_MODEL_RE = /\b(?:model|deployment)\b/i;
+const UNSUPPORTED_MODEL_INDICATOR_RE = /\bnot support(?:ed|s)?\b|\bunsupported\b|\bnot available\b|\bunavailable\b|\bno access\b|\bdoes(?:n['’]t| not) (?:have access|support)\b|\bnot authori[sz]ed\b/i;
+const UNSUPPORTED_MODEL_SCOPE_RE = /\b(?:account|plan|tier|subscription)\b/i;
 /**
  * Classify an error message into one of the ErrorClass kinds.
  *
@@ -49,6 +66,17 @@ const RESET_DELAY_RE = /reset in (\d+)s/i;
 export function classifyError(errorMsg, retryAfterMs) {
     const isPermanent = PERMANENT_RE.test(errorMsg);
     const isRateLimit = RATE_LIMIT_RE.test(errorMsg) || AFFORDABILITY_RE.test(errorMsg);
+    const isUnsupportedModel = UNSUPPORTED_MODEL_MODEL_RE.test(errorMsg) &&
+        UNSUPPORTED_MODEL_INDICATOR_RE.test(errorMsg) &&
+        UNSUPPORTED_MODEL_SCOPE_RE.test(errorMsg);
+    // 0. Unsupported model (account/plan entitlement rejection) — checked before
+    //    `permanent` because PERMANENT_RE also matches /account/i and would
+    //    otherwise swallow these errors, blocking the blocklist-driven fallback.
+    //    Rate limit still wins when both patterns appear (a throttled account is
+    //    not an entitlement failure).
+    if (isUnsupportedModel && !isRateLimit) {
+        return { kind: "unsupported-model" };
+    }
     // 1. Permanent — but rate limit takes precedence
     if (isPermanent && !isRateLimit) {
         return { kind: "permanent" };