gsd-pi 2.76.0 → 2.77.0-dev.1594b263e

package/dist/resources/extensions/gsd/auto/loop.js

@@ -12,13 +12,15 @@ import { _clearCurrentResolve } from "./resolve.js";
 import { runPreDispatch, runDispatch, runGuards, runUnitPhase, runFinalize, } from "./phases.js";
 import { debugLog } from "../debug-logger.js";
 import { isInfrastructureError, isTransientCooldownError, getCooldownRetryAfterMs, COOLDOWN_FALLBACK_WAIT_MS, MAX_COOLDOWN_RETRIES } from "./infra-errors.js";
+import { ModelPolicyDispatchBlockedError } from "../auto-model-selection.js";
 import { resolveEngine } from "../engine-resolver.js";
 import { logWarning } from "../workflow-logger.js";
 import { gsdRoot } from "../paths.js";
+import { atomicWriteSync } from "../atomic-write.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { scheduleSidecarQueue } from "../uok/execution-graph.js";
 import { ExecutionGraphScheduler } from "../uok/execution-graph.js";
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 // ── Stuck detection persistence (#3704) ──────────────────────────────────
 // Persist stuck detection state to disk so it survives session restarts.
@@ -30,6 +32,13 @@ function stuckStatePath(basePath) {
 function loadStuckState(basePath) {
     try {
         const data = JSON.parse(readFileSync(stuckStatePath(basePath), "utf-8"));
+        // Only load state written by a DIFFERENT process (real session restart).
+        // If the PID matches the current process, this state was written by an earlier
+        // autoLoop call in the same process (e.g., a test that completed before this
+        // one), not by a crashed session — skip it to prevent test state pollution.
+        if (data.pid === process.pid) {
+            return { recentUnits: [], stuckRecoveryAttempts: 0 };
+        }
         return {
             recentUnits: Array.isArray(data.recentUnits) ? data.recentUnits : [],
             stuckRecoveryAttempts: typeof data.stuckRecoveryAttempts === "number" ? data.stuckRecoveryAttempts : 0,
@@ -45,6 +54,7 @@ function saveStuckState(basePath, state) {
         const filePath = stuckStatePath(basePath);
         mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
         writeFileSync(filePath, JSON.stringify({
+            pid: process.pid,
             recentUnits: state.recentUnits.slice(-20), // keep last 20 entries
             stuckRecoveryAttempts: state.stuckRecoveryAttempts,
             updatedAt: new Date().toISOString(),
@@ -54,12 +64,64 @@ function saveStuckState(basePath, state) {
         debugLog("autoLoop", { phase: "save-stuck-state-failed", error: err instanceof Error ? err.message : String(err) });
     }
 }
+// ── Custom workflow verification retry persistence ───────────────────────
+// Custom workflows can request verification retries after a step runs. The
+// retry budget must survive an auto-mode restart or a failing verifier can
+// consume a fresh retry budget every session.
+function customVerifyRetryStateDir(s) {
+    return s.activeRunDir ? join(s.activeRunDir, "runtime") : join(gsdRoot(s.basePath), "runtime");
+}
+function customVerifyRetryStatePath(s) {
+    return join(customVerifyRetryStateDir(s), "custom-verify-retries.json");
+}
+function hydrateCustomVerifyRetryCounts(s) {
+    if (s.verificationRetryCount.size > 0) {
+        return s.verificationRetryCount;
+    }
+    try {
+        const raw = JSON.parse(readFileSync(customVerifyRetryStatePath(s), "utf-8"));
+        const counts = raw && typeof raw === "object" && raw.counts && typeof raw.counts === "object"
+            ? raw.counts
+            : {};
+        for (const [key, value] of Object.entries(counts)) {
+            if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+                s.verificationRetryCount.set(key, Math.floor(value));
+            }
+        }
+    }
+    catch (err) {
+        debugLog("autoLoop", { phase: "load-custom-verify-retries-failed", error: err instanceof Error ? err.message : String(err) });
+    }
+    return s.verificationRetryCount;
+}
+function saveCustomVerifyRetryCounts(s) {
+    const retryCounts = s.verificationRetryCount;
+    const filePath = customVerifyRetryStatePath(s);
+    try {
+        if (!retryCounts || retryCounts.size === 0) {
+            unlinkSync(filePath);
+            return;
+        }
+        mkdirSync(customVerifyRetryStateDir(s), { recursive: true });
+        atomicWriteSync(filePath, JSON.stringify({
+            counts: Object.fromEntries(retryCounts),
+            updatedAt: new Date().toISOString(),
+        }) + "\n");
+    }
+    catch (err) {
+        const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
+        if (code !== "ENOENT") {
+            debugLog("autoLoop", { phase: "save-custom-verify-retries-failed", error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+}
 // ── Memory pressure monitoring (#3331) ──────────────────────────────────
 // Check heap usage every N iterations and trigger graceful shutdown before
 // the OS OOM killer sends SIGKILL. The threshold is 90% of the V8 heap
 // limit (--max-old-space-size or default ~1.5-4GB depending on platform).
 const MEMORY_CHECK_INTERVAL = 5; // check every 5 iterations
 const MEMORY_PRESSURE_THRESHOLD = 0.85; // 85% of heap limit
+const MAX_CUSTOM_ENGINE_VERIFY_RETRIES = 3;
 function checkMemoryPressure() {
     const mem = process.memoryUsage();
     // v8.getHeapStatistics() gives heap_size_limit but requires import
@@ -352,15 +414,41 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                     break;
                 }
                 if (verifyResult === "retry") {
-                    debugLog("autoLoop", { phase: "custom-engine-verify-retry", iteration, unitId: iterData.unitId });
+                    const recoveryKey = `${iterData.unitType}/${iterData.unitId}`;
+                    const retryCounts = hydrateCustomVerifyRetryCounts(s);
+                    const attempts = (retryCounts.get(recoveryKey) ?? 0) + 1;
+                    retryCounts.set(recoveryKey, attempts);
+                    saveCustomVerifyRetryCounts(s);
+                    debugLog("autoLoop", { phase: "custom-engine-verify-retry", iteration, unitId: iterData.unitId, attempts });
                     deps.uokObserver?.onPhaseResult("custom-engine", "retry", {
                         unitType: iterData.unitType,
                         unitId: iterData.unitId,
+                        attempts,
                     });
+                    if (attempts > MAX_CUSTOM_ENGINE_VERIFY_RETRIES) {
+                        const recovery = await policy.recover(iterData.unitType, iterData.unitId, { basePath: s.basePath });
+                        if (recovery.outcome === "pause") {
+                            await deps.pauseAuto(ctx, pi);
+                            finishTurn("paused", "manual-attention", recovery.reason ?? "custom-engine-verify-retry-exhausted");
+                            break;
+                        }
+                        if (recovery.outcome === "skip") {
+                            await deps.stopAuto(ctx, pi, recovery.reason ??
+                                `Custom workflow verification for ${iterData.unitId} requested skip after retry exhaustion, but the custom engine cannot reconcile skipped steps.`);
+                            finishTurn("stopped", "manual-attention", "custom-engine-verify-retry-exhausted");
+                            break;
+                        }
+                        const exhaustedReason = `Custom workflow verification for ${iterData.unitId} requested retry ${attempts} times without passing.`;
+                        await deps.stopAuto(ctx, pi, recovery.outcome === "stop" && recovery.reason ? recovery.reason : exhaustedReason);
+                        finishTurn("stopped", "manual-attention", "custom-engine-verify-retry-exhausted");
+                        break;
+                    }
                     finishTurn("retry");
                     continue;
                 }
                 // Verification passed — mark step complete
+                s.verificationRetryCount?.delete(`${iterData.unitType}/${iterData.unitId}`);
+                saveCustomVerifyRetryCounts(s);
                 debugLog("autoLoop", { phase: "custom-engine-reconcile", iteration, unitId: iterData.unitId });
                 const reconcileResult = await engine.reconcile(engineState, {
                     unitType: iterData.unitType,
@@ -497,6 +585,7 @@ export async function autoLoop(ctx, pi, s, deps, options) {
             consecutiveCooldowns = 0;
             recentErrorMessages.length = 0;
             deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
+            saveStuckState(s.basePath, loopState); // persist across session restarts (#4382)
             debugLog("autoLoop", { phase: "iteration-complete", iteration });
             finishTurn("completed");
         }
@@ -507,6 +596,48 @@ export async function autoLoop(ctx, pi, s, deps, options) {
             // completion even on failure (#2344). Without this, errors in
             // runFinalize leave the journal incomplete, making diagnosis harder.
             deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration, error: msg } });
+            // ── Pre-send model-policy block: not a retryable error (#4959 / #4850) ──
+            // The model-policy gate runs before the prompt is sent.  When every
+            // candidate model is denied (cross-provider disabled + flat-rate
+            // baseline + tool-policy denial), retrying the same unit produces the
+            // same denial — burning the consecutive-error budget toward a 3-strike
+            // hard stop and corrupting auto-mode state.  Pause for user attention
+            // instead, with the per-model deny reasons surfaced from the typed
+            // error.
+            if (loopErr instanceof ModelPolicyDispatchBlockedError) {
+                debugLog("autoLoop", {
+                    phase: "model-policy-blocked",
+                    iteration,
+                    unitType: loopErr.unitType,
+                    unitId: loopErr.unitId,
+                    reasons: loopErr.reasons,
+                });
+                ctx.ui.notify(`Auto-mode paused: model-policy denied dispatch for ${loopErr.unitType}/${loopErr.unitId}. ${msg}`, "error");
+                deps.emitJournalEvent({
+                    ts: new Date().toISOString(),
+                    flowId,
+                    seq: nextSeq(),
+                    eventType: "unit-end",
+                    data: {
+                        unitType: loopErr.unitType,
+                        unitId: loopErr.unitId,
+                        status: "blocked",
+                        reason: "model-policy-dispatch-blocked",
+                        reasons: loopErr.reasons,
+                    },
+                });
+                // Carry the blocked unit identity into the turn-result observer:
+                // the throw originated inside dispatch, so observedUnitType/Id were
+                // not assigned by the success path at lines 453/631/647 — but the
+                // typed error already names the unit (#4959 / CodeRabbit).
+                observedUnitType = loopErr.unitType;
+                observedUnitId = loopErr.unitId;
+                await deps.pauseAuto(ctx, pi);
+                finishTurn("paused", "manual-attention", msg);
+                // Do NOT increment consecutiveErrors — the failure is configuration,
+                // not a transient runtime fault.
+                break;
+            }
             // ── Infrastructure errors: immediate stop, no retry ──
             // These are unrecoverable (disk full, OOM, etc.). Retrying just burns
             // LLM budget on guaranteed failures.

package/dist/resources/extensions/gsd/auto/phases.js

@@ -11,12 +11,12 @@ import { MAX_RECOVERY_CHARS, BUDGET_THRESHOLDS, MAX_FINALIZE_TIMEOUTS, } from ".
 import { detectStuck } from "./detect-stuck.js";
 import { runUnit } from "./run-unit.js";
 import { debugLog } from "../debug-logger.js";
-import { PROJECT_FILES } from "../detection.js";
+import { PROJECT_FILES, hasProjectFileInAncestor } from "../detection.js";
 import { MergeConflictError } from "../git-service.js";
 import { setCurrentPhase, clearCurrentPhase } from "../../shared/gsd-phase-state.js";
 import { pauseAutoForProviderError } from "../provider-error-pause.js";
 import { resumeAutoAfterProviderDelay } from "../bootstrap/provider-error-resume.js";
-import { join, basename, dirname, parse as parsePath } from "node:path";
+import { join, basename } from "node:path";
 import { existsSync, cpSync, readdirSync } from "node:fs";
 import { logWarning, logError, _resetLogs, drainLogs, drainAndSummarize, formatForNotification, hasAnyIssues, } from "../workflow-logger.js";
 import { gsdRoot } from "../paths.js";
@@ -27,10 +27,11 @@ import { withTimeout, FINALIZE_PRE_TIMEOUT_MS, FINALIZE_POST_TIMEOUT_MS } from "
 import { getEligibleSlices } from "../slice-parallel-eligibility.js";
 import { startSliceParallel } from "../slice-parallel-orchestrator.js";
 import { isDbAvailable, getMilestoneSlices } from "../gsd-db.js";
-import { ensurePlanV2Graph } from "../uok/plan-v2.js";
+import { ensurePlanV2Graph, isMissingFinalizedContextResult } from "../uok/plan-v2.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { UokGateRunner } from "../uok/gate-runner.js";
-import { resetEvidence } from "../safety/evidence-collector.js";
+import { resetEvidence, loadEvidenceFromDisk } from "../safety/evidence-collector.js";
+import { parseUnitId } from "../unit-id.js";
 import { createCheckpoint, cleanupCheckpoint, rollbackToCheckpoint } from "../safety/git-checkpoint.js";
 import { resolveSafetyHarnessConfig } from "../safety/safety-harness.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, supportsStructuredQuestions, } from "../workflow-mcp.js";
@@ -47,7 +48,11 @@ export function resetSessionTimeoutState() {
  * Exported for testing as _resolveReportBasePath.
  */
 export function _resolveReportBasePath(s) {
-    return s.originalBasePath || s.basePath;
+    // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
+    // originalBasePath is falsy — prevents reports landing in the worktree (#3729).
+    const resolved = s.originalBasePath || s.basePath;
+    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
 }
 /**
  * Resolve the authoritative project base for dispatch guards.
@@ -55,7 +60,12 @@ export function _resolveReportBasePath(s) {
  * unit is running inside an auto worktree.
  */
 export function _resolveDispatchGuardBasePath(s) {
-    return s.originalBasePath || s.basePath;
+    // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
+    // originalBasePath is falsy — prevents guard checks running against the
+    // worktree instead of the project root (#3729).
+    const resolved = s.originalBasePath || s.basePath;
+    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
 }
 const PLAN_V2_GATE_PHASES = new Set([
     "executing",
@@ -117,6 +127,7 @@ async function generateMilestoneReport(s, ctx, milestoneId) {
 async function closeoutAndStop(ctx, pi, s, deps, reason) {
     if (s.currentUnit) {
         await deps.closeoutUnit(ctx, s.basePath, s.currentUnit.type, s.currentUnit.id, s.currentUnit.startedAt, deps.buildSnapshotOpts(s.currentUnit.type, s.currentUnit.id));
+        s.currentUnit = null;
     }
     await deps.stopAuto(ctx, pi, reason);
 }
@@ -286,27 +297,42 @@ export async function runPreDispatch(ic, loopState) {
         const compiled = ensurePlanV2Graph(s.basePath, state);
         if (!compiled.ok) {
             const reason = compiled.reason ?? "Plan v2 compilation failed";
+            if (isMissingFinalizedContextResult(compiled)) {
+                await runPreDispatchGate({
+                    gateId: "plan-v2-gate",
+                    gateType: "policy",
+                    outcome: "pass",
+                    failureClass: "none",
+                    rationale: "plan v2 missing context recovery deferred to dispatch",
+                    findings: reason,
+                    milestoneId: state.activeMilestone?.id ?? undefined,
+                });
+            }
+            else {
+                await runPreDispatchGate({
+                    gateId: "plan-v2-gate",
+                    gateType: "policy",
+                    outcome: "manual-attention",
+                    failureClass: "manual-attention",
+                    rationale: "plan v2 compile gate failed",
+                    findings: reason,
+                    milestoneId: state.activeMilestone?.id ?? undefined,
+                });
+                ctx.ui.notify(`Plan gate failed-closed: ${reason}\n\nIf this keeps happening, try: /gsd doctor heal`, "error");
+                await deps.pauseAuto(ctx, pi);
+                return { action: "break", reason: "plan-v2-gate-failed" };
+            }
+        }
+        if (compiled.ok) {
             await runPreDispatchGate({
                 gateId: "plan-v2-gate",
                 gateType: "policy",
-                outcome: "manual-attention",
-                failureClass: "manual-attention",
-                rationale: "plan v2 compile gate failed",
-                findings: reason,
+                outcome: "pass",
+                failureClass: "none",
+                rationale: "plan v2 compile gate passed",
                 milestoneId: state.activeMilestone?.id ?? undefined,
             });
-            ctx.ui.notify(`Plan gate failed-closed: ${reason}`, "error");
-            await deps.pauseAuto(ctx, pi);
-            return { action: "break", reason: "plan-v2-gate-failed" };
         }
-        await runPreDispatchGate({
-            gateId: "plan-v2-gate",
-            gateType: "policy",
-            outcome: "pass",
-            failureClass: "none",
-            rationale: "plan v2 compile gate passed",
-            milestoneId: state.activeMilestone?.id ?? undefined,
-        });
     }
     deps.syncCmuxSidebar(prefs, state);
     let mid = state.activeMilestone?.id;
@@ -389,6 +415,8 @@ export async function runPreDispatch(ic, loopState) {
         loopState.recentUnits.length = 0;
         loopState.stuckRecoveryAttempts = 0;
         // Worktree lifecycle on milestone transition — merge current, enter next
+        // #2909: preflight — warn + stash dirty working tree before merge
+        const preflightTransition = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
         try {
             deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
         }
@@ -405,6 +433,10 @@ export async function runPreDispatch(ic, loopState) {
             await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
             return { action: "break", reason: "merge-failed" };
         }
+        // #2909: postflight — restore stashed changes after successful merge
+        if (preflightTransition.stashPushed) {
+            deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+        }
         // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         deps.invalidateAllCaches();
         state = await deps.deriveState(s.basePath);
@@ -459,6 +491,8 @@ export async function runPreDispatch(ic, loopState) {
         if (incomplete.length === 0 && state.registry.length > 0) {
             // All milestones complete — merge milestone branch before stopping
             if (s.currentMilestoneId) {
+                // #2909: preflight — warn + stash dirty working tree before merge
+                const preflightAllComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
                 try {
                     deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
                     // Prevent stopAuto from attempting the same merge (#2645)
@@ -475,6 +509,10 @@ export async function runPreDispatch(ic, loopState) {
                     await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
                     return { action: "break", reason: "merge-failed" };
                 }
+                // #2909: postflight — restore stashed changes after successful merge
+                if (preflightAllComplete.stashPushed) {
+                    deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+                }
                 // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
             }
             deps.sendDesktopNotification("GSD", "All milestones complete!", "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -539,6 +577,8 @@ export async function runPreDispatch(ic, loopState) {
     if (state.phase === "complete") {
         // Milestone merge on complete (before closeout so branch state is clean)
         if (s.currentMilestoneId) {
+            // #2909: preflight — warn + stash dirty working tree before merge
+            const preflightComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
             try {
                 deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
                 // Prevent stopAuto from attempting the same merge (#2645)
@@ -555,6 +595,10 @@ export async function runPreDispatch(ic, loopState) {
                 await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
                 return { action: "break", reason: "merge-failed" };
             }
+            // #2909: postflight — restore stashed changes after successful merge
+            if (preflightComplete.stashPushed) {
+                deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+            }
             // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         }
         deps.sendDesktopNotification("GSD", `Milestone ${mid} complete!`, "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -639,10 +683,14 @@ export async function runDispatch(ic, preData, loopState) {
     const pauseAfterUatDispatch = dispatchResult.pauseAfterDispatch ?? false;
     // ── Sliding-window stuck detection with graduated recovery ──
     const derivedKey = `${unitType}/${unitId}`;
+    // Always record this dispatch in the sliding window so detectStuck() has
+    // accurate history. Skipping the push when pendingVerificationRetry is set
+    // caused infinite artifact-retry loops to be invisible to stuck detection
+    // (#2007). Only the *response* to a stuck signal is suppressed during retries.
+    loopState.recentUnits.push({ key: derivedKey });
+    if (loopState.recentUnits.length > STUCK_WINDOW_SIZE)
+        loopState.recentUnits.shift();
     if (!s.pendingVerificationRetry) {
-        loopState.recentUnits.push({ key: derivedKey });
-        if (loopState.recentUnits.length > STUCK_WINDOW_SIZE)
-            loopState.recentUnits.shift();
         const stuckSignal = detectStuck(loopState.recentUnits);
         if (stuckSignal) {
             debugLog("autoLoop", {
@@ -823,16 +871,44 @@ export async function runGuards(ic, mid) {
         if (threshold) {
             s.lastBudgetAlertLevel =
                 newBudgetAlertLevel;
-            if (threshold.pct === 100 && budgetEnforcementAction !== "none") {
+            // Emit Layer 2 budget_threshold event (post-plan hook recommendation).
+            // Extensions / Layer 0 shell hooks may return an action override.
+            let hookAction;
+            try {
+                const { emitBudgetThreshold } = await import("../hook-emitter.js");
+                const hookResult = await emitBudgetThreshold({
+                    fraction: budgetPct,
+                    spent: totalCost,
+                    limit: budgetCeiling,
+                });
+                if (hookResult?.action)
+                    hookAction = hookResult.action;
+            }
+            catch (hookErr) {
+                logWarning("engine", `budget_threshold hook emission failed: ${hookErr.message}`);
+            }
+            // Apply hook override to enforcement action. "continue" → "none" (no enforcement),
+            // "pause" and "downgrade" map to the matching enforcement path below.
+            let effectiveAction = budgetEnforcementAction;
+            if (hookAction === "continue") {
+                effectiveAction = "none";
+            }
+            else if (hookAction === "pause") {
+                effectiveAction = "pause";
+            }
+            else if (hookAction === "downgrade") {
+                effectiveAction = "warn";
+            }
+            if (threshold.pct === 100 && effectiveAction !== "none") {
                 // 100% — special enforcement logic (halt/pause/warn)
                 const msg = `Budget ceiling ${deps.formatCost(budgetCeiling)} reached (spent ${deps.formatCost(totalCost)}).`;
-                if (budgetEnforcementAction === "halt") {
+                if (effectiveAction === "halt") {
                     deps.sendDesktopNotification("GSD", msg, "error", "budget", basename(s.originalBasePath || s.basePath));
                     await deps.stopAuto(ctx, pi, "Budget ceiling reached");
                     debugLog("autoLoop", { phase: "exit", reason: "budget-halt" });
                     return { action: "break", reason: "budget-halt" };
                 }
-                if (budgetEnforcementAction === "pause") {
+                if (effectiveAction === "pause") {
                     ctx.ui.notify(`${msg} Pausing auto-mode — /gsd auto to override and continue.`, "warning");
                     deps.sendDesktopNotification("GSD", msg, "warning", "budget", basename(s.originalBasePath || s.basePath));
                     deps.logCmuxEvent(prefs, msg, "warning");
@@ -940,22 +1016,9 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         // Monorepo support (#2347): if no project files in the worktree directory,
         // walk parent directories up to the filesystem root. In monorepos,
         // package.json / Cargo.toml etc. live in a parent directory.
-        let hasProjectFileInParent = false;
-        if (!hasProjectFile && !hasSrcDir && !hasXcodeBundle) {
-            let checkDir = dirname(s.basePath);
-            const { root } = parsePath(checkDir);
-            while (checkDir !== root) {
-                // Stop at git repository boundary — ancestors above the repo root
-                // (e.g. ~ or /usr/local) may contain unrelated project files.
-                if (deps.existsSync(join(checkDir, ".git")))
-                    break;
-                if (PROJECT_FILES.some((f) => deps.existsSync(join(checkDir, f)))) {
-                    hasProjectFileInParent = true;
-                    break;
-                }
-                checkDir = dirname(checkDir);
-            }
-        }
+        const hasProjectFileInParent = !hasProjectFile && !hasSrcDir && !hasXcodeBundle
+            ? hasProjectFileInAncestor(s.basePath, deps.existsSync)
+            : false;
         if (!hasProjectFile && !hasSrcDir && !hasXcodeBundle && !hasProjectFileInParent) {
             // Greenfield projects won't have project files yet — the first task creates them.
             // Log a warning but allow execution to proceed. The .git check above is sufficient
@@ -1000,6 +1063,14 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
     const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
     if (safetyConfig.enabled && safetyConfig.evidence_collection) {
         resetEvidence();
+        // Restore persisted evidence so session-restart resumes don't produce
+        // false-positive "no bash calls" warnings (Bug #4385).
+        if (s.basePath && unitType === "execute-task") {
+            const { milestone: eMid, slice: eSid, task: eTid } = parseUnitId(unitId);
+            if (eMid && eSid && eTid) {
+                loadEvidenceFromDisk(s.basePath, eMid, eSid, eTid);
+            }
+        }
     }
     // Only checkpoint code-executing units (not lifecycle/planning units)
     if (safetyConfig.enabled && safetyConfig.checkpoints && unitType === "execute-task") {
@@ -1066,7 +1137,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         logWarning("engine", "Prompt reorder failed", { error: msg });
     }
     // Select and apply model (with tier escalation on retry — normal units only)
-    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride);
+    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride, s.autoModeStartThinkingLevel);
     s.currentUnitRouting =
         modelResult.routing;
     s.currentUnitModel =
@@ -1079,6 +1150,9 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         if (match) {
             const ok = await pi.setModel(match, { persist: false });
             if (ok) {
+                if (s.autoModeStartThinkingLevel) {
+                    pi.setThinkingLevel(s.autoModeStartThinkingLevel);
+                }
                 s.currentUnitModel = match;
                 ctx.ui.notify(`Hook model override: ${match.provider}/${match.id}`, "info");
             }
@@ -1173,20 +1247,32 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         }
     }
     if (unitResult.status === "cancelled") {
-        // Provider-error pause: pauseAuto already handled cleanup and scheduled
-        // recovery. Don't hard-stop — just break out of the loop (#2762).
-        if (unitResult.errorContext?.category === "provider") {
+        const errorCategory = unitResult.errorContext?.category;
+        // Provider-error pause: agent_end recovery normally pauses before this
+        // branch. Provider readiness failures happen before dispatch, so pause here
+        // if nothing upstream already did.
+        if (errorCategory === "provider") {
+            if (!s.paused) {
+                const detail = unitResult.errorContext?.message ?? `Provider unavailable for ${unitType} ${unitId}`;
+                await pauseAutoForProviderError(ctx.ui, detail, () => deps.pauseAuto(ctx, pi), {
+                    isRateLimit: false,
+                    isTransient: Boolean(unitResult.errorContext?.isTransient),
+                    retryAfterMs: unitResult.errorContext?.retryAfterMs,
+                });
+            }
             await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
-            debugLog("autoLoop", { phase: "exit", reason: "provider-pause", isTransient: unitResult.errorContext.isTransient });
+            debugLog("autoLoop", { phase: "exit", reason: "provider-pause", isTransient: unitResult.errorContext?.isTransient });
             return { action: "break", reason: "provider-pause" };
         }
         // Timeout category covers two distinct scenarios:
         //   1. Session creation timeout (120s) — transient, auto-resume with backoff
         //   2. Unit hard timeout (30min+) — stuck agent, pause for manual review
+        // Transient session-failed covers recoverable newSession failures and should
+        // pause instead of hard-stopping.
         // Structural errors (TypeError, is not a function) are NOT transient
         // and must hard-stop to avoid infinite retry loops.
         if (unitResult.errorContext?.isTransient &&
-            unitResult.errorContext?.category === "timeout") {
+            errorCategory === "timeout") {
             const isSessionCreationTimeout = unitResult.errorContext.message?.includes("Session creation timed out");
             if (isSessionCreationTimeout) {
                 consecutiveSessionTimeouts += 1;
@@ -1229,6 +1315,15 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
             await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
             return { action: "break", reason: "unit-hard-timeout" };
         }
+        if (unitResult.errorContext?.isTransient &&
+            errorCategory === "session-failed") {
+            ctx.ui.notify(`Session creation failed transiently for ${unitType} ${unitId}: ${unitResult.errorContext?.message ?? "unknown"}. Pausing auto-mode (recoverable).`, "warning");
+            debugLog("autoLoop", { phase: "session-start-transient-pause", unitType, unitId, category: errorCategory });
+            await deps.pauseAuto(ctx, pi);
+            await deps.autoCommitUnit?.(s.basePath, unitType, unitId, ctx);
+            await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
+            return { action: "break", reason: "session-timeout" };
+        }
         // All other cancelled states (structural errors, non-transient failures): hard stop
         if (s.currentUnit) {
             await deps.closeoutUnit(ctx, s.basePath, unitType, unitId, s.currentUnit.startedAt, deps.buildSnapshotOpts(unitType, unitId));
@@ -1387,6 +1482,20 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         }
         else {
             // s.pendingVerificationRetry was set by postUnitPreVerification.
+            // Emit a dedicated journal event so forensics can distinguish bounded
+            // verification retries from genuine stuck-loop dispatch repetitions (#4540).
+            const retryInfo = s.pendingVerificationRetry;
+            deps.emitJournalEvent({
+                ts: new Date().toISOString(),
+                flowId: ic.flowId,
+                seq: ic.nextSeq(),
+                eventType: "artifact-verification-retry",
+                data: {
+                    unitType: preUnitSnapshot?.type,
+                    unitId: retryInfo?.unitId,
+                    attempt: retryInfo?.attempt,
+                },
+            });
             // Continue the loop — next iteration will inject the retry context into the prompt.
             debugLog("autoLoop", { phase: "artifact-verification-retry", iteration: ic.iteration });
             return { action: "continue" };
@@ -1444,6 +1553,8 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
     }
     // Both pre and post verification completed without timeout — reset counter
     loopState.consecutiveFinalizeTimeouts = 0;
+    s.currentUnit = null;
+    clearCurrentPhase();
     // Surface accumulated workflow-logger issues for this unit to the user.
     // Warnings/errors logged during the unit are buffered in the logger and
     // drained here so the user sees a single consolidated post-unit alert.

package/dist/resources/extensions/gsd/auto/resolve.js

@@ -8,6 +8,7 @@
  * Imports from: auto/types
  */
 import { debugLog } from "../debug-logger.js";
+import { bumpTurnGeneration } from "./turn-epoch.js";
 // ─── Per-unit one-shot promise state ────────────────────────────────────────
 //
 // A single module-level resolve function scoped to the current unit execution.
@@ -56,6 +57,22 @@ export function resolveAgentEnd(event) {
 export function isSessionSwitchInFlight() {
     return _sessionSwitchInFlight;
 }
+// ─── bumpAndResolveSynthetic ────────────────────────────────────────────────
+/**
+ * Bump the turn epoch and synthetically resolve the pending unit promise —
+ * the exact sequence timeout recovery must perform when it advances past a
+ * timed-out unit. Using this helper enforces the invariant "bump iff we are
+ * actually superseding the turn" so a future caller cannot resolve without
+ * bumping (orphaned writes leak) or bump without resolving (next turn starts
+ * already stale).
+ *
+ * NOT to be used for steering retries that keep the same turn alive — those
+ * do not supersede the turn and must not bump.
+ */
+export function bumpAndResolveSynthetic(reason) {
+    bumpTurnGeneration(reason);
+    resolveAgentEnd({ messages: [], _synthetic: reason });
+}
 // ─── resolveAgentEndCancelled ─────────────────────────────────────────────────
 /**
  * Force-resolve the pending unit promise with { status: "cancelled" }.
@@ -66,6 +83,10 @@ export function isSessionSwitchInFlight() {
  */
 export function resolveAgentEndCancelled(errorContext) {
     if (_currentResolve) {
+        // Cancellation supersedes the in-flight turn the same way timeout
+        // recovery does — bump the turn epoch so any lingering writes from the
+        // cancelled turn drop themselves.
+        bumpTurnGeneration(`cancelled:${errorContext?.category ?? "unknown"}`);
         debugLog("resolveAgentEndCancelled", { status: "resolving-cancelled" });
         const r = _currentResolve;
         _currentResolve = null;
@@ -81,6 +102,9 @@ export function _resetPendingResolve() {
     _currentResolve = null;
     _sessionSwitchInFlight = false;
 }
+export function _hasPendingResolveForTest() {
+    return _currentResolve !== null;
+}
 /**
  * No-op for backward compatibility with tests that previously set the
  * active session. The module no longer holds a session reference.