gsd-pi 2.76.0 → 2.77.0-dev.1d17f366c

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -9,7 +9,7 @@ import { existsSync, cpSync, readFileSync, readdirSync, mkdirSync, realpathSync,
 import { isAbsolute, join, sep as pathSep } from "node:path";
 import { homedir } from "node:os";
 import { GSDError, GSD_IO_ERROR, GSD_GIT_ERROR } from "./errors.js";
-import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, } from "./gsd-db.js";
+import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, closeDatabase, openDatabase, getDbPath, } from "./gsd-db.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { execFileSync } from "node:child_process";
 import { safeCopy, safeCopyRecursive } from "./safe-fs.js";
@@ -180,14 +180,6 @@ function clearProjectRootStateFiles(basePath, milestoneId) {
         }
     }
 }
-function isProjectGsdSymlink(basePath) {
-    try {
-        return lstatSyncFn(join(basePath, ".gsd")).isSymbolicLink();
-    }
-    catch {
-        return false;
-    }
-}
 // ─── Build Artifact Auto-Resolve ─────────────────────────────────────────────
 /** Patterns for machine-generated build artifacts that can be safely
  * auto-resolved by accepting --theirs during merge. These files are
@@ -1429,73 +1421,65 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             });
         }
     }
-    // 7. Stash any pre-existing dirty files so the squash merge is not
-    //    blocked by unrelated local changes (#2151).  clearProjectRootStateFiles
-    //    only removes untracked .gsd/ files; tracked dirty files elsewhere (e.g.
-    //    .planning/work-state.json with stash conflict markers) are invisible to
-    //    that cleanup but will cause `git merge --squash` to reject.
-    let stashed = false;
-    try {
-        const status = execFileSync("git", ["status", "--porcelain"], {
-            cwd: originalBasePath_,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        }).trim();
-        if (status) {
-            // Use --include-untracked to stash untracked files that would block
-            // the squash merge, but EXCLUDE .gsd/milestones/ (#2505).
-            // --include-untracked without exclusion sweeps queued milestone
-            // CONTEXT files into the stash. If stash pop later fails, those files
-            // are permanently trapped in the stash entry and lost on the next
-            // stash push or drop.
-            //
-            // When `.gsd` itself is a symlink, Git rejects pathspecs below it
-            // ("beyond a symbolic link"). In that layout, exclude the whole symlink
-            // and keep stashing real project files that could block the merge.
-            const stashPathspecs = isProjectGsdSymlink(originalBasePath_)
-                ? [".", ":(exclude).gsd"]
-                : [":(exclude).gsd/milestones"];
-            execFileSync("git", [
-                "stash", "push", "--include-untracked",
-                "-m", `gsd: pre-merge stash for ${milestoneId}`,
-                "--", ...stashPathspecs,
-            ], { cwd: originalBasePath_, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
-            stashed = true;
-        }
-    }
-    catch (err) {
-        // Stash failure is non-fatal — proceed without stash and let the merge
-        // report the dirty tree if it fails.
-        logWarning("worktree", `git stash failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    // 7a. Shelter queued milestone directories before the squash merge (#2505).
+    // 7. Shelter queued milestone directories before the squash merge (#2505).
     // The milestone branch may contain copies of queued milestone dirs (via
     // copyPlanningArtifacts), so `git merge --squash` rejects when those same
     // files exist as untracked in the working tree. Temporarily move them to
     // a backup location, then restore after the merge+commit.
+    //
+    // MUST run BEFORE the pre-merge stash (step 7a) so `--include-untracked`
+    // does not sweep queued CONTEXT files into the stash. If stash pop later
+    // fails, files trapped inside the stash are permanently lost (#2505).
     const milestonesDir = join(gsdRoot(originalBasePath_), "milestones");
     const shelterDir = join(gsdRoot(originalBasePath_), ".milestone-shelter");
     const shelteredDirs = [];
+    let shelterRestored = false;
     // Helper: restore sheltered milestone directories (#2505).
     // Called on both success and error paths to ensure queued CONTEXT files
-    // are never permanently lost.
+    // are never permanently lost. Idempotent — the error path may fire after
+    // the success path has already restored and removed the shelter dir; a
+    // second call is a no-op instead of logging a misleading "shelter restore
+    // failed: ENOENT" error for shelter sources that were cleaned up legitimately.
     const restoreShelter = () => {
+        if (shelterRestored)
+            return;
+        shelterRestored = true;
         if (shelteredDirs.length === 0)
             return;
+        let restoreFailed = false;
         for (const dirName of shelteredDirs) {
+            const src = join(shelterDir, dirName);
+            // If the shelter source is missing the restore cannot proceed for this
+            // entry. Distinguish "legitimately missing" (shelter dir removed by a
+            // prior successful restore or never copied) from a surprising ENOENT
+            // inside an otherwise-populated shelter.
+            if (!existsSync(src)) {
+                logWarning("worktree", `shelter source missing for ${dirName}; skipping restore (shelter already cleaned or entry never staged)`);
+                continue;
+            }
             try {
                 mkdirSync(milestonesDir, { recursive: true });
-                cpSync(join(shelterDir, dirName), join(milestonesDir, dirName), { recursive: true, force: true });
+                cpSync(src, join(milestonesDir, dirName), { recursive: true, force: true });
             }
             catch (err) { /* best-effort */
-                logError("worktree", `shelter restore failed: ${err instanceof Error ? err.message : String(err)}`);
+                restoreFailed = true;
+                logError("worktree", `shelter restore failed (${dirName}): ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-        try {
-            rmSync(shelterDir, { recursive: true, force: true });
+        // Preserve the shelter if any per-entry restore failed — it is the only
+        // surviving copy of the queued milestone dirs (sources were deleted during
+        // shelter). Deleting it here would permanently lose those files (#2505).
+        if (restoreFailed) {
+            logWarning("worktree", `shelter retained at ${shelterDir} — manual recovery required for unrestored entries`);
+            return;
         }
-        catch (err) { /* best-effort */
-            logWarning("worktree", `shelter cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+        if (existsSync(shelterDir)) {
+            try {
+                rmSync(shelterDir, { recursive: true, force: true });
+            }
+            catch (err) { /* best-effort */
+                logWarning("worktree", `shelter cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
         }
     };
     try {
@@ -1526,6 +1510,54 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         // Non-fatal — proceed with merge; untracked files may block it
         logWarning("worktree", `milestone shelter operation failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    // 7a. Stash pre-existing dirty files so the squash merge is not blocked by
+    //     unrelated local changes (#2151). Includes untracked files to handle
+    //     locally-added files that conflict with tracked files on the milestone
+    //     branch. Passing NO pathspec lets git skip gitignored paths silently;
+    //     adding an explicit pathspec trips a `git add`-style fatal on ignored
+    //     entries (e.g. a gitignored `.gsd` symlink under ADR-002) (#4573).
+    //     Queued CONTEXT files under `.gsd/milestones/*` are already sheltered
+    //     in step 7 above, so they won't be swept into the stash.
+    // On Windows, SQLite holds mandatory file locks on the gsd.db WAL/SHM
+    // sidecars while the connection is open. `git stash --include-untracked`
+    // walks those files and fails with EBUSY (#4704). Close the DB before
+    // stashing so Windows releases the handles; reopen after. No-op on
+    // POSIX, where advisory locks don't block git.
+    const needsDbCycle = process.platform === "win32" && isDbAvailable();
+    const dbPathToReopen = needsDbCycle ? getDbPath() : null;
+    if (needsDbCycle) {
+        try {
+            closeDatabase();
+        }
+        catch (err) {
+            logWarning("worktree", `pre-stash db close failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    let stashed = false;
+    try {
+        const status = execFileSync("git", ["status", "--porcelain"], {
+            cwd: originalBasePath_,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        }).trim();
+        if (status) {
+            execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd: pre-merge stash for ${milestoneId}`], { cwd: originalBasePath_, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
+            stashed = true;
+        }
+    }
+    catch (err) {
+        // Stash failure is non-fatal — proceed without stash and let the merge
+        // report the dirty tree if it fails.
+        logWarning("worktree", `git stash failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (needsDbCycle && dbPathToReopen) {
+        try {
+            openDatabase(dbPathToReopen);
+        }
+        catch (err) {
+            logWarning("worktree", `post-stash db reopen failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     // 7b. Clean up stale merge state before attempting squash merge (#2912).
     // A leftover MERGE_HEAD (from a previous failed merge, libgit2 native path,
     // or interrupted operation) causes `git merge --squash` to refuse with
@@ -1761,16 +1793,32 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     // When a milestone only produced .gsd/ metadata (summaries, roadmaps) but no
     // real code, the user sees "milestone complete" but nothing changed in their
     // codebase. Surface this so the caller can warn the user.
+    //
+    // Bug #4385 fix: use `git diff-tree --root` instead of `git diff HEAD~1 HEAD`.
+    // `HEAD~1` does not exist on initial commits and is unreliable on shallow clones
+    // and merge commits. `diff-tree --root` handles all three cases correctly.
+    // The empty-tree hash (4b825dc…) is the universal fallback for refs that don't exist.
+    const GIT_EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
     let codeFilesChanged = false;
     if (!nothingToCommit) {
         try {
-            const mergedFiles = nativeDiffNumstat(originalBasePath_, "HEAD~1", "HEAD");
-            codeFilesChanged = mergedFiles.some((entry) => !entry.path.startsWith(".gsd/"));
+            const diffTreeOutput = execFileSync("git", ["diff-tree", "--root", "--no-commit-id", "-r", "--name-only", "HEAD"], { cwd: originalBasePath_, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
+            const mergedFiles = diffTreeOutput ? diffTreeOutput.split("\n").filter(Boolean) : [];
+            codeFilesChanged = mergedFiles.some((f) => !f.startsWith(".gsd/"));
         }
         catch (e) {
-            // If HEAD~1 doesn't exist (first commit), assume code was changed
-            logWarning("worktree", `diff numstat failed (assuming code changed): ${e.message}`);
-            codeFilesChanged = true;
+            // diff-tree failed (e.g. unborn HEAD in a brand-new repo) — fall back to
+            // comparing against the empty tree so initial-commit repos still report changes.
+            try {
+                const fallbackOutput = execFileSync("git", ["diff", "--name-only", GIT_EMPTY_TREE, "HEAD"], { cwd: originalBasePath_, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
+                const fallbackFiles = fallbackOutput ? fallbackOutput.split("\n").filter(Boolean) : [];
+                codeFilesChanged = fallbackFiles.some((f) => !f.startsWith(".gsd/"));
+            }
+            catch {
+                // Truly unable to determine — assume code was changed to avoid silent data loss
+                logWarning("worktree", `diff-tree and empty-tree fallback both failed (assuming code changed): ${e.message}`);
+                codeFilesChanged = true;
+            }
         }
     }
     // 10. Auto-push if enabled

package/dist/resources/extensions/gsd/auto.js

@@ -37,8 +37,9 @@ import { getRtkSessionSavings } from "../shared/rtk-session-stats.js";
 import { deactivateGSD } from "../shared/gsd-phase-state.js";
 import { initMetrics, resetMetrics, getLedger, getProjectTotals, formatCost, formatTokenCount, } from "./metrics.js";
 import { setLogBasePath, logWarning } from "./workflow-logger.js";
+import { preflightCleanRoot, postflightPopStash } from "./clean-root-preflight.js";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { readFileSync, existsSync, mkdirSync, writeFileSync, unlinkSync } from "node:fs";
 import { atomicWriteSync } from "./atomic-write.js";
@@ -50,16 +51,24 @@ import { pruneQueueOrder } from "./queue-order.js";
 import { startCommandPolling as _startCommandPolling, isRemoteConfigured } from "../remote-questions/manager.js";
 import { debugLog, isDebugEnabled, writeDebugSummary } from "./debug-logger.js";
 import { reconcileMergeState, } from "./auto-recovery.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { resolveDispatch, DISPATCH_RULES } from "./auto-dispatch.js";
 import { getErrorMessage } from "./error-utils.js";
 import { recoverFailedMigration } from "./migrate-external.js";
 import { initRegistry, convertDispatchRules } from "./rule-registry.js";
 import { emitJournalEvent as _emitJournalEvent } from "./journal.js";
-import { updateProgressWidget as _updateProgressWidget, updateSliceProgressCache, clearSliceProgressCache, hideFooter, } from "./auto-dashboard.js";
+import { updateProgressWidget as _updateProgressWidget, updateSliceProgressCache, clearSliceProgressCache, } from "./auto-dashboard.js";
 import { registerSigtermHandler as _registerSigtermHandler, deregisterSigtermHandler as _deregisterSigtermHandler, } from "./auto-supervisor.js";
 import { isDbAvailable, getMilestone } from "./gsd-db.js";
 import { countPendingCaptures } from "./captures.js";
-import { clearCmuxSidebar, logCmuxEvent, syncCmuxSidebar } from "../cmux/index.js";
+import { CMUX_CHANNELS } from "../shared/cmux-events.js";
+function makeCmuxEmitters(pi) {
+    return {
+        syncCmuxSidebar: (preferences, state) => pi.events.emit(CMUX_CHANNELS.SIDEBAR, { action: "sync", preferences, state }),
+        logCmuxEvent: (preferences, message, level) => pi.events.emit(CMUX_CHANNELS.LOG, { preferences, message, level: level ?? "info" }),
+        clearCmuxSidebar: (preferences) => pi.events.emit(CMUX_CHANNELS.SIDEBAR, { action: "clear", preferences }),
+    };
+}
 // ── Extracted modules ──────────────────────────────────────────────────────
 import { startUnitSupervision } from "./auto-timers.js";
 import { runPostUnitVerification } from "./auto-verification.js";
@@ -136,6 +145,24 @@ function restoreMilestoneLockEnv() {
     s.hadMilestoneLockEnv = false;
     s.milestoneLockEnvCaptured = false;
 }
+function normalizeSessionFilePath(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    const firstLine = trimmed.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    if (!firstLine)
+        return null;
+    // Guard against accidental message concatenation by trimming to .jsonl.
+    const jsonlIndex = firstLine.toLowerCase().indexOf(".jsonl");
+    const candidate = jsonlIndex >= 0 ? firstLine.slice(0, jsonlIndex + ".jsonl".length) : firstLine;
+    if (!isAbsolute(candidate))
+        return null;
+    if (!candidate.toLowerCase().endsWith(".jsonl"))
+        return null;
+    return candidate;
+}
 export function startAutoDetached(ctx, pi, base, verboseMode, options) {
     void startAuto(ctx, pi, base, verboseMode, options).catch((err) => {
         const message = getErrorMessage(err);
@@ -145,8 +172,8 @@ export function startAutoDetached(ctx, pi, base, verboseMode, options) {
     });
 }
 /** Returns true if the project is configured for `isolation:worktree` mode. */
-export function shouldUseWorktreeIsolation() {
-    const prefs = loadEffectiveGSDPreferences()?.preferences?.git;
+export function shouldUseWorktreeIsolation(basePath) {
+    const prefs = loadEffectiveGSDPreferences(basePath)?.preferences?.git;
     if (prefs?.isolation === "worktree")
         return true;
     // Default is false — worktree isolation requires explicit opt-in
@@ -215,7 +242,7 @@ export function getAutoDashboardData() {
     const rtkSavings = sessionId && s.basePath
         ? getRtkSessionSavings(s.basePath, sessionId)
         : null;
-    const rtkEnabled = loadEffectiveGSDPreferences()?.preferences.experimental?.rtk === true;
+    const rtkEnabled = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences.experimental?.rtk === true;
     // Pending capture count — lazy check, non-fatal
     let pendingCaptureCount = 0;
     try {
@@ -248,6 +275,10 @@ export function getAutoDashboardData() {
 export function isAutoActive() {
     return s.active;
 }
+/** Test-only seam for validating auto-mode guards (#4704). Do not use in production code. */
+export function _setAutoActiveForTest(active) {
+    s.active = active;
+}
 export function isAutoPaused() {
     return s.paused;
 }
@@ -393,7 +424,7 @@ function clearUnitTimeout() {
 }
 /** Build snapshot metric opts. */
 function buildSnapshotOpts(_unitType, _unitId) {
-    const prefs = loadEffectiveGSDPreferences()?.preferences;
+    const prefs = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences;
     const uokFlags = resolveUokFlags(prefs);
     return {
         ...(s.autoStartTime > 0 ? { autoSessionKey: String(s.autoStartTime) } : {}),
@@ -427,7 +458,6 @@ function handleLostSessionLock(ctx, lockStatus) {
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
     deregisterSigtermHandler();
-    clearCmuxSidebar(loadEffectiveGSDPreferences()?.preferences);
     const base = lockBase();
     const lockFilePath = base ? join(gsdRoot(base), "auto.lock") : "unknown";
     const recoverySuggestion = "\nTo recover, run: gsd doctor --fix";
@@ -443,7 +473,6 @@ function handleLostSessionLock(ctx, lockStatus) {
     ctx?.ui.notify(message, "error");
     ctx?.ui.setStatus("gsd-auto", undefined);
     ctx?.ui.setWidget("gsd-progress", undefined);
-    ctx?.ui.setFooter(undefined);
     if (ctx)
         initHealthWidget(ctx);
 }
@@ -480,7 +509,6 @@ function cleanupAfterLoopExit(ctx) {
     if (!s.paused) {
         ctx.ui.setStatus("gsd-auto", undefined);
         ctx.ui.setWidget("gsd-progress", undefined);
-        ctx.ui.setFooter(undefined);
         initHealthWidget(ctx);
     }
     // Restore CWD out of worktree back to original project root
@@ -498,7 +526,7 @@ function cleanupAfterLoopExit(ctx) {
 export async function stopAuto(ctx, pi, reason) {
     if (!s.active && !s.paused)
         return;
-    const loadedPreferences = loadEffectiveGSDPreferences()?.preferences;
+    const loadedPreferences = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences;
     const reasonSuffix = reason ? ` — ${reason}` : "";
     try {
         // ── Step 1: Timers and locks ──
@@ -657,8 +685,12 @@ export async function stopAuto(ctx, pi, reason) {
         }
         // ── Step 9: Cmux sidebar / event log ──
         try {
-            clearCmuxSidebar(loadedPreferences);
-            logCmuxEvent(loadedPreferences, `Auto-mode stopped${reasonSuffix || ""}.`, reason?.startsWith("Blocked:") ? "warning" : "info");
+            pi?.events.emit(CMUX_CHANNELS.SIDEBAR, { action: "clear", preferences: loadedPreferences });
+            pi?.events.emit(CMUX_CHANNELS.LOG, {
+                preferences: loadedPreferences,
+                message: `Auto-mode stopped${reasonSuffix || ""}.`,
+                level: reason?.startsWith("Blocked:") ? "warning" : "info",
+            });
         }
         catch (e) {
             debugLog("stop-cleanup-cmux", { error: e instanceof Error ? e.message : String(e) });
@@ -695,13 +727,16 @@ export async function stopAuto(ctx, pi, reason) {
         catch (err) { /* non-fatal */
             logWarning("engine", `file unlink failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
         }
-        // ── Step 13: Restore original model (before reset clears IDs) ──
+        // ── Step 13: Restore original model + thinking (before reset clears IDs) ──
         try {
             if (pi && ctx && s.originalModelId && s.originalModelProvider) {
                 const original = ctx.modelRegistry.find(s.originalModelProvider, s.originalModelId);
                 if (original)
                     await pi.setModel(original);
             }
+            if (pi && s.originalThinkingLevel) {
+                pi.setThinkingLevel(s.originalThinkingLevel);
+            }
         }
         catch (e) {
             debugLog("stop-cleanup-model", { error: e instanceof Error ? e.message : String(e) });
@@ -740,7 +775,6 @@ export async function stopAuto(ctx, pi, reason) {
         // UI cleanup
         ctx?.ui.setStatus("gsd-auto", undefined);
         ctx?.ui.setWidget("gsd-progress", undefined);
-        ctx?.ui.setFooter(undefined);
         if (ctx)
             initHealthWidget(ctx);
         restoreProjectRootEnv();
@@ -775,7 +809,7 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     // Pass errorContext so runUnitPhase can distinguish user-initiated pause
     // from provider-error pause and avoid hard-stopping (#2762).
     resolveAgentEndCancelled(_errorContext);
-    s.pausedSessionFile = ctx?.sessionManager?.getSessionFile() ?? null;
+    s.pausedSessionFile = normalizeSessionFilePath(ctx?.sessionManager?.getSessionFile() ?? null);
     // Persist paused-session metadata so resume survives /exit (#1383).
     // The fresh-start bootstrap checks for this file and restores worktree context.
     try {
@@ -829,7 +863,6 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     s.verificationRetryCount.clear();
     ctx?.ui.setStatus("gsd-auto", "paused");
     ctx?.ui.setWidget("gsd-progress", undefined);
-    ctx?.ui.setFooter(undefined);
     if (ctx)
         initHealthWidget(ctx);
     const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
@@ -874,11 +907,12 @@ function buildResolver() {
  * Build the LoopDeps object from auto.ts private scope.
  * This bundles all private functions that autoLoop needs without exporting them.
  */
-function buildLoopDeps() {
+function buildLoopDeps(pi) {
     // Initialize the unified rule registry with converted dispatch rules.
     // Must happen before LoopDeps is assembled so facade functions
     // (resolveDispatch, runPreDispatchHooks, etc.) delegate to the registry.
     initRegistry(convertDispatchRules(DISPATCH_RULES));
+    const cmux = makeCmuxEmitters(pi);
     return {
         lockBase,
         buildSnapshotOpts,
@@ -886,8 +920,11 @@ function buildLoopDeps() {
         pauseAuto,
         clearUnitTimeout,
         updateProgressWidget,
-        syncCmuxSidebar,
-        logCmuxEvent,
+        ...cmux,
+        handleLostSessionLock: (ctx, lockStatus) => {
+            cmux.clearCmuxSidebar(loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences);
+            handleLostSessionLock(ctx, lockStatus);
+        },
         // State and cache
         invalidateAllCaches,
         deriveState,
@@ -902,7 +939,6 @@ function buildLoopDeps() {
         // Session lock
         validateSessionLock: getSessionLockStatus,
         updateSessionLock,
-        handleLostSessionLock,
         // Milestone transition
         sendDesktopNotification,
         setActiveMilestoneId,
@@ -975,6 +1011,9 @@ function buildLoopDeps() {
         },
         // Journal
         emitJournalEvent: (entry) => _emitJournalEvent(s.basePath, entry),
+        // Clean-root preflight gate (#2909)
+        preflightCleanRoot,
+        postflightPopStash,
     };
 }
 /**
@@ -1031,7 +1070,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                     unlinkSync(pausedPath);
                 }
                 catch (e) {
-                    logWarning("session", `pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                    if (e.code !== "ENOENT") {
+                        logWarning("session", `pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                    }
                 }
                 ctx.ui.notify(`Resuming paused custom workflow${meta.activeRunDir ? ` (${meta.activeRunDir})` : ""}.`, "info");
             }
@@ -1044,12 +1085,23 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                     // Validate the milestone still exists and isn't already complete (#1664).
                     const mDir = resolveMilestonePath(base, meta.milestoneId);
                     const summaryFile = resolveMilestoneFile(base, meta.milestoneId, "SUMMARY");
-                    if (!mDir || summaryFile) {
+                    let summaryIsTerminal = false;
+                    if (summaryFile) {
+                        try {
+                            summaryIsTerminal = classifyMilestoneSummaryContent(readFileSync(summaryFile, "utf-8")) !== "failure";
+                        }
+                        catch {
+                            summaryIsTerminal = false;
+                        }
+                    }
+                    if (!mDir || summaryIsTerminal) {
                         try {
                             unlinkSync(pausedPath);
                         }
                         catch (err) {
-                            logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                            if (err.code !== "ENOENT") {
+                                logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                            }
                         }
                         ctx.ui.notify(`Paused milestone ${meta.milestoneId} is ${!mDir ? "missing" : "already complete"}. Starting fresh.`, "info");
                     }
@@ -1057,7 +1109,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                         s.currentMilestoneId = meta.milestoneId;
                         s.originalBasePath = meta.originalBasePath || base;
                         s.stepMode = meta.stepMode ?? requestedStepMode;
-                        s.pausedSessionFile = meta.sessionFile ?? null;
+                        s.pausedSessionFile = normalizeSessionFilePath(meta.sessionFile ?? null);
                         s.pausedUnitType = meta.unitType ?? null;
                         s.pausedUnitId = meta.unitId ?? null;
                         s.autoStartTime = meta.autoStartTime || Date.now();
@@ -1067,7 +1119,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                             unlinkSync(pausedPath);
                         }
                         catch (e) {
-                            logWarning("session", `pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                            if (e.code !== "ENOENT") {
+                                logWarning("session", `pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                            }
                         }
                         ctx.ui.notify(`Resuming paused session for ${meta.milestoneId}${meta.worktreePath && existsSync(meta.worktreePath) ? ` (worktree)` : ""}.`, "info");
                     }
@@ -1077,7 +1131,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                         unlinkSync(pausedPath);
                     }
                     catch (e) {
-                        logWarning("session", `stale pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                        if (e.code !== "ENOENT") {
+                            logWarning("session", `stale pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                        }
                     }
                 }
             }
@@ -1133,7 +1189,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                 unlinkSync(s.pausedSessionFile);
             }
             catch (err) {
-                logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                if (err.code !== "ENOENT") {
+                    logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                }
             }
             s.pausedSessionFile = null;
         }
@@ -1143,6 +1201,17 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         s.stepMode = requestedStepMode;
         s.cmdCtx = ctx;
         s.basePath = base;
+        // ── Resume worktree: if the paused session was inside a milestone worktree,
+        // apply that path as the dispatch basePath immediately (#3723).
+        // This ensures the dispatch loop runs from the worktree directory even when
+        // enterMilestone guard conditions differ between the original and resumed
+        // session (e.g. isolation mode changed, detectWorktreeName differs across
+        // process restarts).  We guard with existsSync so a stale or deleted
+        // worktree directory safely falls back to the project root.
+        const resumeWorktreePath = freshStartAssessment.pausedSession?.worktreePath;
+        if (resumeWorktreePath && existsSync(resumeWorktreePath)) {
+            s.basePath = resumeWorktreePath;
+        }
         // Ensure the workflow-logger audit log is pinned to the project root
         // even when auto-mode is entered via a path that bypasses the
         // bootstrap/dynamic-tools ensureDbOpen() → setLogBasePath() chain
@@ -1161,7 +1230,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         });
         // ── Auto-worktree / branch-mode: re-enter on resume ──
         if (s.currentMilestoneId &&
-            getIsolationMode() !== "none" &&
+            getIsolationMode(s.originalBasePath || s.basePath) !== "none" &&
             s.originalBasePath &&
             !isInAutoWorktree(s.basePath) &&
             !detectWorktreeName(s.basePath) &&
@@ -1172,7 +1241,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         }
         registerSigtermHandler(lockBase());
         ctx.ui.setStatus("gsd-auto", s.stepMode ? "next" : "auto");
-        ctx.ui.setFooter(hideFooter);
+        ctx.ui.setWidget("gsd-health", undefined);
         ctx.ui.notify(s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", "info");
         restoreHookState(s.basePath);
         // Re-sync managed resources on resume so long-lived auto sessions pick up
@@ -1194,7 +1263,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         await openProjectDbIfPresent(s.basePath);
         try {
             await rebuildState(s.basePath);
-            syncCmuxSidebar(loadEffectiveGSDPreferences()?.preferences, await deriveState(s.basePath));
+            pi.events.emit(CMUX_CHANNELS.SIDEBAR, { action: "sync", preferences: loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, state: await deriveState(s.basePath) });
         }
         catch (e) {
             debugLog("resume-rebuild-state-failed", {
@@ -1224,14 +1293,14 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         }
         updateSessionLock(lockBase(), "resuming", s.currentMilestoneId ?? "unknown");
         writeLock(lockBase(), "resuming", s.currentMilestoneId ?? "unknown");
-        logCmuxEvent(loadEffectiveGSDPreferences()?.preferences, s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", "progress");
+        pi.events.emit(CMUX_CHANNELS.LOG, { preferences: loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, message: s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", level: "progress" });
         captureProjectRootEnv(s.originalBasePath || s.basePath);
         startAutoCommandPolling(s.basePath);
         await runAutoLoopWithUok({
             ctx,
             pi,
             s,
-            deps: buildLoopDeps(),
+            deps: buildLoopDeps(pi),
             runKernelLoop: runUokKernelLoop,
             runLegacyLoop: runLegacyAutoLoop,
         });
@@ -1250,20 +1319,20 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         return;
     captureProjectRootEnv(s.originalBasePath || s.basePath);
     try {
-        syncCmuxSidebar(loadEffectiveGSDPreferences()?.preferences, await deriveState(s.basePath));
+        pi.events.emit(CMUX_CHANNELS.SIDEBAR, { action: "sync", preferences: loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, state: await deriveState(s.basePath) });
     }
     catch (err) {
         // Best-effort only — sidebar sync must never block auto-mode startup
         logWarning("engine", `cmux sync failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
     }
-    logCmuxEvent(loadEffectiveGSDPreferences()?.preferences, requestedStepMode ? "Step-mode started." : "Auto-mode started.", "progress");
+    pi.events.emit(CMUX_CHANNELS.LOG, { preferences: loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, message: requestedStepMode ? "Step-mode started." : "Auto-mode started.", level: "progress" });
     startAutoCommandPolling(s.basePath);
     // Dispatch the first unit
     await runAutoLoopWithUok({
         ctx,
         pi,
         s,
-        deps: buildLoopDeps(),
+        deps: buildLoopDeps(pi),
         runKernelLoop: runUokKernelLoop,
         runLegacyLoop: runLegacyAutoLoop,
     });
@@ -1361,8 +1430,8 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
                 `Ensure the model is defined in models.json and has auth configured.`, "warning");
         }
     }
-    const sessionFile = ctx.sessionManager.getSessionFile();
-    writeLock(lockBase(), hookUnitType, triggerUnitId, sessionFile);
+    const sessionFile = normalizeSessionFilePath(ctx.sessionManager.getSessionFile());
+    writeLock(lockBase(), hookUnitType, triggerUnitId, sessionFile ?? undefined);
     clearUnitTimeout();
     const supervisor = resolveAutoSupervisorConfig();
     const hookHardTimeoutMs = (supervisor.hard_timeout_minutes ?? 30) * 60 * 1000;