gsd-pi 2.76.0 → 2.77.0-dev.2daa994b6

package/dist/resources/extensions/gsd/auto/loop.js

@@ -15,10 +15,11 @@ import { isInfrastructureError, isTransientCooldownError, getCooldownRetryAfterM
 import { resolveEngine } from "../engine-resolver.js";
 import { logWarning } from "../workflow-logger.js";
 import { gsdRoot } from "../paths.js";
+import { atomicWriteSync } from "../atomic-write.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { scheduleSidecarQueue } from "../uok/execution-graph.js";
 import { ExecutionGraphScheduler } from "../uok/execution-graph.js";
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 // ── Stuck detection persistence (#3704) ──────────────────────────────────
 // Persist stuck detection state to disk so it survives session restarts.
@@ -30,6 +31,13 @@ function stuckStatePath(basePath) {
 function loadStuckState(basePath) {
     try {
         const data = JSON.parse(readFileSync(stuckStatePath(basePath), "utf-8"));
+        // Only load state written by a DIFFERENT process (real session restart).
+        // If the PID matches the current process, this state was written by an earlier
+        // autoLoop call in the same process (e.g., a test that completed before this
+        // one), not by a crashed session — skip it to prevent test state pollution.
+        if (data.pid === process.pid) {
+            return { recentUnits: [], stuckRecoveryAttempts: 0 };
+        }
         return {
             recentUnits: Array.isArray(data.recentUnits) ? data.recentUnits : [],
             stuckRecoveryAttempts: typeof data.stuckRecoveryAttempts === "number" ? data.stuckRecoveryAttempts : 0,
@@ -45,6 +53,7 @@ function saveStuckState(basePath, state) {
         const filePath = stuckStatePath(basePath);
         mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
         writeFileSync(filePath, JSON.stringify({
+            pid: process.pid,
             recentUnits: state.recentUnits.slice(-20), // keep last 20 entries
             stuckRecoveryAttempts: state.stuckRecoveryAttempts,
             updatedAt: new Date().toISOString(),
@@ -54,12 +63,64 @@ function saveStuckState(basePath, state) {
         debugLog("autoLoop", { phase: "save-stuck-state-failed", error: err instanceof Error ? err.message : String(err) });
     }
 }
+// ── Custom workflow verification retry persistence ───────────────────────
+// Custom workflows can request verification retries after a step runs. The
+// retry budget must survive an auto-mode restart or a failing verifier can
+// consume a fresh retry budget every session.
+function customVerifyRetryStateDir(s) {
+    return s.activeRunDir ? join(s.activeRunDir, "runtime") : join(gsdRoot(s.basePath), "runtime");
+}
+function customVerifyRetryStatePath(s) {
+    return join(customVerifyRetryStateDir(s), "custom-verify-retries.json");
+}
+function hydrateCustomVerifyRetryCounts(s) {
+    if (s.verificationRetryCount.size > 0) {
+        return s.verificationRetryCount;
+    }
+    try {
+        const raw = JSON.parse(readFileSync(customVerifyRetryStatePath(s), "utf-8"));
+        const counts = raw && typeof raw === "object" && raw.counts && typeof raw.counts === "object"
+            ? raw.counts
+            : {};
+        for (const [key, value] of Object.entries(counts)) {
+            if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+                s.verificationRetryCount.set(key, Math.floor(value));
+            }
+        }
+    }
+    catch (err) {
+        debugLog("autoLoop", { phase: "load-custom-verify-retries-failed", error: err instanceof Error ? err.message : String(err) });
+    }
+    return s.verificationRetryCount;
+}
+function saveCustomVerifyRetryCounts(s) {
+    const retryCounts = s.verificationRetryCount;
+    const filePath = customVerifyRetryStatePath(s);
+    try {
+        if (!retryCounts || retryCounts.size === 0) {
+            unlinkSync(filePath);
+            return;
+        }
+        mkdirSync(customVerifyRetryStateDir(s), { recursive: true });
+        atomicWriteSync(filePath, JSON.stringify({
+            counts: Object.fromEntries(retryCounts),
+            updatedAt: new Date().toISOString(),
+        }) + "\n");
+    }
+    catch (err) {
+        const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
+        if (code !== "ENOENT") {
+            debugLog("autoLoop", { phase: "save-custom-verify-retries-failed", error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+}
 // ── Memory pressure monitoring (#3331) ──────────────────────────────────
 // Check heap usage every N iterations and trigger graceful shutdown before
 // the OS OOM killer sends SIGKILL. The threshold is 90% of the V8 heap
 // limit (--max-old-space-size or default ~1.5-4GB depending on platform).
 const MEMORY_CHECK_INTERVAL = 5; // check every 5 iterations
 const MEMORY_PRESSURE_THRESHOLD = 0.85; // 85% of heap limit
+const MAX_CUSTOM_ENGINE_VERIFY_RETRIES = 3;
 function checkMemoryPressure() {
     const mem = process.memoryUsage();
     // v8.getHeapStatistics() gives heap_size_limit but requires import
@@ -352,15 +413,41 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                     break;
                 }
                 if (verifyResult === "retry") {
-                    debugLog("autoLoop", { phase: "custom-engine-verify-retry", iteration, unitId: iterData.unitId });
+                    const recoveryKey = `${iterData.unitType}/${iterData.unitId}`;
+                    const retryCounts = hydrateCustomVerifyRetryCounts(s);
+                    const attempts = (retryCounts.get(recoveryKey) ?? 0) + 1;
+                    retryCounts.set(recoveryKey, attempts);
+                    saveCustomVerifyRetryCounts(s);
+                    debugLog("autoLoop", { phase: "custom-engine-verify-retry", iteration, unitId: iterData.unitId, attempts });
                     deps.uokObserver?.onPhaseResult("custom-engine", "retry", {
                         unitType: iterData.unitType,
                         unitId: iterData.unitId,
+                        attempts,
                     });
+                    if (attempts > MAX_CUSTOM_ENGINE_VERIFY_RETRIES) {
+                        const recovery = await policy.recover(iterData.unitType, iterData.unitId, { basePath: s.basePath });
+                        if (recovery.outcome === "pause") {
+                            await deps.pauseAuto(ctx, pi);
+                            finishTurn("paused", "manual-attention", recovery.reason ?? "custom-engine-verify-retry-exhausted");
+                            break;
+                        }
+                        if (recovery.outcome === "skip") {
+                            await deps.stopAuto(ctx, pi, recovery.reason ??
+                                `Custom workflow verification for ${iterData.unitId} requested skip after retry exhaustion, but the custom engine cannot reconcile skipped steps.`);
+                            finishTurn("stopped", "manual-attention", "custom-engine-verify-retry-exhausted");
+                            break;
+                        }
+                        const exhaustedReason = `Custom workflow verification for ${iterData.unitId} requested retry ${attempts} times without passing.`;
+                        await deps.stopAuto(ctx, pi, recovery.outcome === "stop" && recovery.reason ? recovery.reason : exhaustedReason);
+                        finishTurn("stopped", "manual-attention", "custom-engine-verify-retry-exhausted");
+                        break;
+                    }
                     finishTurn("retry");
                     continue;
                 }
                 // Verification passed — mark step complete
+                s.verificationRetryCount?.delete(`${iterData.unitType}/${iterData.unitId}`);
+                saveCustomVerifyRetryCounts(s);
                 debugLog("autoLoop", { phase: "custom-engine-reconcile", iteration, unitId: iterData.unitId });
                 const reconcileResult = await engine.reconcile(engineState, {
                     unitType: iterData.unitType,
@@ -497,6 +584,7 @@ export async function autoLoop(ctx, pi, s, deps, options) {
             consecutiveCooldowns = 0;
             recentErrorMessages.length = 0;
             deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
+            saveStuckState(s.basePath, loopState); // persist across session restarts (#4382)
             debugLog("autoLoop", { phase: "iteration-complete", iteration });
             finishTurn("completed");
         }

package/dist/resources/extensions/gsd/auto/phases.js

@@ -11,12 +11,12 @@ import { MAX_RECOVERY_CHARS, BUDGET_THRESHOLDS, MAX_FINALIZE_TIMEOUTS, } from ".
 import { detectStuck } from "./detect-stuck.js";
 import { runUnit } from "./run-unit.js";
 import { debugLog } from "../debug-logger.js";
-import { PROJECT_FILES } from "../detection.js";
+import { PROJECT_FILES, hasProjectFileInAncestor } from "../detection.js";
 import { MergeConflictError } from "../git-service.js";
 import { setCurrentPhase, clearCurrentPhase } from "../../shared/gsd-phase-state.js";
 import { pauseAutoForProviderError } from "../provider-error-pause.js";
 import { resumeAutoAfterProviderDelay } from "../bootstrap/provider-error-resume.js";
-import { join, basename, dirname, parse as parsePath } from "node:path";
+import { join, basename } from "node:path";
 import { existsSync, cpSync, readdirSync } from "node:fs";
 import { logWarning, logError, _resetLogs, drainLogs, drainAndSummarize, formatForNotification, hasAnyIssues, } from "../workflow-logger.js";
 import { gsdRoot } from "../paths.js";
@@ -27,10 +27,11 @@ import { withTimeout, FINALIZE_PRE_TIMEOUT_MS, FINALIZE_POST_TIMEOUT_MS } from "
 import { getEligibleSlices } from "../slice-parallel-eligibility.js";
 import { startSliceParallel } from "../slice-parallel-orchestrator.js";
 import { isDbAvailable, getMilestoneSlices } from "../gsd-db.js";
-import { ensurePlanV2Graph } from "../uok/plan-v2.js";
+import { ensurePlanV2Graph, isMissingFinalizedContextResult } from "../uok/plan-v2.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { UokGateRunner } from "../uok/gate-runner.js";
-import { resetEvidence } from "../safety/evidence-collector.js";
+import { resetEvidence, loadEvidenceFromDisk } from "../safety/evidence-collector.js";
+import { parseUnitId } from "../unit-id.js";
 import { createCheckpoint, cleanupCheckpoint, rollbackToCheckpoint } from "../safety/git-checkpoint.js";
 import { resolveSafetyHarnessConfig } from "../safety/safety-harness.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, supportsStructuredQuestions, } from "../workflow-mcp.js";
@@ -47,7 +48,11 @@ export function resetSessionTimeoutState() {
  * Exported for testing as _resolveReportBasePath.
  */
 export function _resolveReportBasePath(s) {
-    return s.originalBasePath || s.basePath;
+    // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
+    // originalBasePath is falsy — prevents reports landing in the worktree (#3729).
+    const resolved = s.originalBasePath || s.basePath;
+    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
 }
 /**
  * Resolve the authoritative project base for dispatch guards.
@@ -55,7 +60,12 @@ export function _resolveReportBasePath(s) {
  * unit is running inside an auto worktree.
  */
 export function _resolveDispatchGuardBasePath(s) {
-    return s.originalBasePath || s.basePath;
+    // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
+    // originalBasePath is falsy — prevents guard checks running against the
+    // worktree instead of the project root (#3729).
+    const resolved = s.originalBasePath || s.basePath;
+    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
 }
 const PLAN_V2_GATE_PHASES = new Set([
     "executing",
@@ -286,27 +296,42 @@ export async function runPreDispatch(ic, loopState) {
         const compiled = ensurePlanV2Graph(s.basePath, state);
         if (!compiled.ok) {
             const reason = compiled.reason ?? "Plan v2 compilation failed";
+            if (isMissingFinalizedContextResult(compiled)) {
+                await runPreDispatchGate({
+                    gateId: "plan-v2-gate",
+                    gateType: "policy",
+                    outcome: "pass",
+                    failureClass: "none",
+                    rationale: "plan v2 missing context recovery deferred to dispatch",
+                    findings: reason,
+                    milestoneId: state.activeMilestone?.id ?? undefined,
+                });
+            }
+            else {
+                await runPreDispatchGate({
+                    gateId: "plan-v2-gate",
+                    gateType: "policy",
+                    outcome: "manual-attention",
+                    failureClass: "manual-attention",
+                    rationale: "plan v2 compile gate failed",
+                    findings: reason,
+                    milestoneId: state.activeMilestone?.id ?? undefined,
+                });
+                ctx.ui.notify(`Plan gate failed-closed: ${reason}\n\nIf this keeps happening, try: /gsd doctor heal`, "error");
+                await deps.pauseAuto(ctx, pi);
+                return { action: "break", reason: "plan-v2-gate-failed" };
+            }
+        }
+        if (compiled.ok) {
             await runPreDispatchGate({
                 gateId: "plan-v2-gate",
                 gateType: "policy",
-                outcome: "manual-attention",
-                failureClass: "manual-attention",
-                rationale: "plan v2 compile gate failed",
-                findings: reason,
+                outcome: "pass",
+                failureClass: "none",
+                rationale: "plan v2 compile gate passed",
                 milestoneId: state.activeMilestone?.id ?? undefined,
             });
-            ctx.ui.notify(`Plan gate failed-closed: ${reason}`, "error");
-            await deps.pauseAuto(ctx, pi);
-            return { action: "break", reason: "plan-v2-gate-failed" };
         }
-        await runPreDispatchGate({
-            gateId: "plan-v2-gate",
-            gateType: "policy",
-            outcome: "pass",
-            failureClass: "none",
-            rationale: "plan v2 compile gate passed",
-            milestoneId: state.activeMilestone?.id ?? undefined,
-        });
     }
     deps.syncCmuxSidebar(prefs, state);
     let mid = state.activeMilestone?.id;
@@ -389,6 +414,8 @@ export async function runPreDispatch(ic, loopState) {
         loopState.recentUnits.length = 0;
         loopState.stuckRecoveryAttempts = 0;
         // Worktree lifecycle on milestone transition — merge current, enter next
+        // #2909: preflight — warn + stash dirty working tree before merge
+        const preflightTransition = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
         try {
             deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
         }
@@ -405,6 +432,10 @@ export async function runPreDispatch(ic, loopState) {
             await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
             return { action: "break", reason: "merge-failed" };
         }
+        // #2909: postflight — restore stashed changes after successful merge
+        if (preflightTransition.stashPushed) {
+            deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+        }
         // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         deps.invalidateAllCaches();
         state = await deps.deriveState(s.basePath);
@@ -459,6 +490,8 @@ export async function runPreDispatch(ic, loopState) {
         if (incomplete.length === 0 && state.registry.length > 0) {
             // All milestones complete — merge milestone branch before stopping
             if (s.currentMilestoneId) {
+                // #2909: preflight — warn + stash dirty working tree before merge
+                const preflightAllComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
                 try {
                     deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
                     // Prevent stopAuto from attempting the same merge (#2645)
@@ -475,6 +508,10 @@ export async function runPreDispatch(ic, loopState) {
                     await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
                     return { action: "break", reason: "merge-failed" };
                 }
+                // #2909: postflight — restore stashed changes after successful merge
+                if (preflightAllComplete.stashPushed) {
+                    deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+                }
                 // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
             }
             deps.sendDesktopNotification("GSD", "All milestones complete!", "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -539,6 +576,8 @@ export async function runPreDispatch(ic, loopState) {
     if (state.phase === "complete") {
         // Milestone merge on complete (before closeout so branch state is clean)
         if (s.currentMilestoneId) {
+            // #2909: preflight — warn + stash dirty working tree before merge
+            const preflightComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
             try {
                 deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
                 // Prevent stopAuto from attempting the same merge (#2645)
@@ -555,6 +594,10 @@ export async function runPreDispatch(ic, loopState) {
                 await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
                 return { action: "break", reason: "merge-failed" };
             }
+            // #2909: postflight — restore stashed changes after successful merge
+            if (preflightComplete.stashPushed) {
+                deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+            }
             // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         }
         deps.sendDesktopNotification("GSD", `Milestone ${mid} complete!`, "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -823,16 +866,44 @@ export async function runGuards(ic, mid) {
         if (threshold) {
             s.lastBudgetAlertLevel =
                 newBudgetAlertLevel;
-            if (threshold.pct === 100 && budgetEnforcementAction !== "none") {
+            // Emit Layer 2 budget_threshold event (post-plan hook recommendation).
+            // Extensions / Layer 0 shell hooks may return an action override.
+            let hookAction;
+            try {
+                const { emitBudgetThreshold } = await import("../hook-emitter.js");
+                const hookResult = await emitBudgetThreshold({
+                    fraction: budgetPct,
+                    spent: totalCost,
+                    limit: budgetCeiling,
+                });
+                if (hookResult?.action)
+                    hookAction = hookResult.action;
+            }
+            catch (hookErr) {
+                logWarning("engine", `budget_threshold hook emission failed: ${hookErr.message}`);
+            }
+            // Apply hook override to enforcement action. "continue" → "none" (no enforcement),
+            // "pause" and "downgrade" map to the matching enforcement path below.
+            let effectiveAction = budgetEnforcementAction;
+            if (hookAction === "continue") {
+                effectiveAction = "none";
+            }
+            else if (hookAction === "pause") {
+                effectiveAction = "pause";
+            }
+            else if (hookAction === "downgrade") {
+                effectiveAction = "warn";
+            }
+            if (threshold.pct === 100 && effectiveAction !== "none") {
                 // 100% — special enforcement logic (halt/pause/warn)
                 const msg = `Budget ceiling ${deps.formatCost(budgetCeiling)} reached (spent ${deps.formatCost(totalCost)}).`;
-                if (budgetEnforcementAction === "halt") {
+                if (effectiveAction === "halt") {
                     deps.sendDesktopNotification("GSD", msg, "error", "budget", basename(s.originalBasePath || s.basePath));
                     await deps.stopAuto(ctx, pi, "Budget ceiling reached");
                     debugLog("autoLoop", { phase: "exit", reason: "budget-halt" });
                     return { action: "break", reason: "budget-halt" };
                 }
-                if (budgetEnforcementAction === "pause") {
+                if (effectiveAction === "pause") {
                     ctx.ui.notify(`${msg} Pausing auto-mode — /gsd auto to override and continue.`, "warning");
                     deps.sendDesktopNotification("GSD", msg, "warning", "budget", basename(s.originalBasePath || s.basePath));
                     deps.logCmuxEvent(prefs, msg, "warning");
@@ -940,22 +1011,9 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         // Monorepo support (#2347): if no project files in the worktree directory,
         // walk parent directories up to the filesystem root. In monorepos,
         // package.json / Cargo.toml etc. live in a parent directory.
-        let hasProjectFileInParent = false;
-        if (!hasProjectFile && !hasSrcDir && !hasXcodeBundle) {
-            let checkDir = dirname(s.basePath);
-            const { root } = parsePath(checkDir);
-            while (checkDir !== root) {
-                // Stop at git repository boundary — ancestors above the repo root
-                // (e.g. ~ or /usr/local) may contain unrelated project files.
-                if (deps.existsSync(join(checkDir, ".git")))
-                    break;
-                if (PROJECT_FILES.some((f) => deps.existsSync(join(checkDir, f)))) {
-                    hasProjectFileInParent = true;
-                    break;
-                }
-                checkDir = dirname(checkDir);
-            }
-        }
+        const hasProjectFileInParent = !hasProjectFile && !hasSrcDir && !hasXcodeBundle
+            ? hasProjectFileInAncestor(s.basePath, deps.existsSync)
+            : false;
         if (!hasProjectFile && !hasSrcDir && !hasXcodeBundle && !hasProjectFileInParent) {
             // Greenfield projects won't have project files yet — the first task creates them.
             // Log a warning but allow execution to proceed. The .git check above is sufficient
@@ -1000,6 +1058,14 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
     const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
     if (safetyConfig.enabled && safetyConfig.evidence_collection) {
         resetEvidence();
+        // Restore persisted evidence so session-restart resumes don't produce
+        // false-positive "no bash calls" warnings (Bug #4385).
+        if (s.basePath && unitType === "execute-task") {
+            const { milestone: eMid, slice: eSid, task: eTid } = parseUnitId(unitId);
+            if (eMid && eSid && eTid) {
+                loadEvidenceFromDisk(s.basePath, eMid, eSid, eTid);
+            }
+        }
     }
     // Only checkpoint code-executing units (not lifecycle/planning units)
     if (safetyConfig.enabled && safetyConfig.checkpoints && unitType === "execute-task") {
@@ -1066,7 +1132,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         logWarning("engine", "Prompt reorder failed", { error: msg });
     }
     // Select and apply model (with tier escalation on retry — normal units only)
-    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride);
+    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride, s.autoModeStartThinkingLevel);
     s.currentUnitRouting =
         modelResult.routing;
     s.currentUnitModel =
@@ -1079,6 +1145,9 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         if (match) {
             const ok = await pi.setModel(match, { persist: false });
             if (ok) {
+                if (s.autoModeStartThinkingLevel) {
+                    pi.setThinkingLevel(s.autoModeStartThinkingLevel);
+                }
                 s.currentUnitModel = match;
                 ctx.ui.notify(`Hook model override: ${match.provider}/${match.id}`, "info");
             }
@@ -1173,20 +1242,32 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         }
     }
     if (unitResult.status === "cancelled") {
-        // Provider-error pause: pauseAuto already handled cleanup and scheduled
-        // recovery. Don't hard-stop — just break out of the loop (#2762).
-        if (unitResult.errorContext?.category === "provider") {
+        const errorCategory = unitResult.errorContext?.category;
+        // Provider-error pause: agent_end recovery normally pauses before this
+        // branch. Provider readiness failures happen before dispatch, so pause here
+        // if nothing upstream already did.
+        if (errorCategory === "provider") {
+            if (!s.paused) {
+                const detail = unitResult.errorContext?.message ?? `Provider unavailable for ${unitType} ${unitId}`;
+                await pauseAutoForProviderError(ctx.ui, detail, () => deps.pauseAuto(ctx, pi), {
+                    isRateLimit: false,
+                    isTransient: Boolean(unitResult.errorContext?.isTransient),
+                    retryAfterMs: unitResult.errorContext?.retryAfterMs,
+                });
+            }
             await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
-            debugLog("autoLoop", { phase: "exit", reason: "provider-pause", isTransient: unitResult.errorContext.isTransient });
+            debugLog("autoLoop", { phase: "exit", reason: "provider-pause", isTransient: unitResult.errorContext?.isTransient });
             return { action: "break", reason: "provider-pause" };
         }
         // Timeout category covers two distinct scenarios:
         //   1. Session creation timeout (120s) — transient, auto-resume with backoff
         //   2. Unit hard timeout (30min+) — stuck agent, pause for manual review
+        // Transient session-failed covers recoverable newSession failures and should
+        // pause instead of hard-stopping.
         // Structural errors (TypeError, is not a function) are NOT transient
         // and must hard-stop to avoid infinite retry loops.
         if (unitResult.errorContext?.isTransient &&
-            unitResult.errorContext?.category === "timeout") {
+            errorCategory === "timeout") {
             const isSessionCreationTimeout = unitResult.errorContext.message?.includes("Session creation timed out");
             if (isSessionCreationTimeout) {
                 consecutiveSessionTimeouts += 1;
@@ -1229,6 +1310,15 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
             await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
             return { action: "break", reason: "unit-hard-timeout" };
         }
+        if (unitResult.errorContext?.isTransient &&
+            errorCategory === "session-failed") {
+            ctx.ui.notify(`Session creation failed transiently for ${unitType} ${unitId}: ${unitResult.errorContext?.message ?? "unknown"}. Pausing auto-mode (recoverable).`, "warning");
+            debugLog("autoLoop", { phase: "session-start-transient-pause", unitType, unitId, category: errorCategory });
+            await deps.pauseAuto(ctx, pi);
+            await deps.autoCommitUnit?.(s.basePath, unitType, unitId, ctx);
+            await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
+            return { action: "break", reason: "session-timeout" };
+        }
         // All other cancelled states (structural errors, non-transient failures): hard stop
         if (s.currentUnit) {
             await deps.closeoutUnit(ctx, s.basePath, unitType, unitId, s.currentUnit.startedAt, deps.buildSnapshotOpts(unitType, unitId));
@@ -1387,6 +1477,20 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         }
         else {
             // s.pendingVerificationRetry was set by postUnitPreVerification.
+            // Emit a dedicated journal event so forensics can distinguish bounded
+            // verification retries from genuine stuck-loop dispatch repetitions (#4540).
+            const retryInfo = s.pendingVerificationRetry;
+            deps.emitJournalEvent({
+                ts: new Date().toISOString(),
+                flowId: ic.flowId,
+                seq: ic.nextSeq(),
+                eventType: "artifact-verification-retry",
+                data: {
+                    unitType: preUnitSnapshot?.type,
+                    unitId: retryInfo?.unitId,
+                    attempt: retryInfo?.attempt,
+                },
+            });
             // Continue the loop — next iteration will inject the retry context into the prompt.
             debugLog("autoLoop", { phase: "artifact-verification-retry", iteration: ic.iteration });
             return { action: "continue" };

package/dist/resources/extensions/gsd/auto/resolve.js

@@ -8,6 +8,7 @@
  * Imports from: auto/types
  */
 import { debugLog } from "../debug-logger.js";
+import { bumpTurnGeneration } from "./turn-epoch.js";
 // ─── Per-unit one-shot promise state ────────────────────────────────────────
 //
 // A single module-level resolve function scoped to the current unit execution.
@@ -56,6 +57,22 @@ export function resolveAgentEnd(event) {
 export function isSessionSwitchInFlight() {
     return _sessionSwitchInFlight;
 }
+// ─── bumpAndResolveSynthetic ────────────────────────────────────────────────
+/**
+ * Bump the turn epoch and synthetically resolve the pending unit promise —
+ * the exact sequence timeout recovery must perform when it advances past a
+ * timed-out unit. Using this helper enforces the invariant "bump iff we are
+ * actually superseding the turn" so a future caller cannot resolve without
+ * bumping (orphaned writes leak) or bump without resolving (next turn starts
+ * already stale).
+ *
+ * NOT to be used for steering retries that keep the same turn alive — those
+ * do not supersede the turn and must not bump.
+ */
+export function bumpAndResolveSynthetic(reason) {
+    bumpTurnGeneration(reason);
+    resolveAgentEnd({ messages: [], _synthetic: reason });
+}
 // ─── resolveAgentEndCancelled ─────────────────────────────────────────────────
 /**
  * Force-resolve the pending unit promise with { status: "cancelled" }.
@@ -66,6 +83,10 @@ export function isSessionSwitchInFlight() {
  */
 export function resolveAgentEndCancelled(errorContext) {
     if (_currentResolve) {
+        // Cancellation supersedes the in-flight turn the same way timeout
+        // recovery does — bump the turn epoch so any lingering writes from the
+        // cancelled turn drop themselves.
+        bumpTurnGeneration(`cancelled:${errorContext?.category ?? "unknown"}`);
         debugLog("resolveAgentEndCancelled", { status: "resolving-cancelled" });
         const r = _currentResolve;
         _currentResolve = null;
@@ -81,6 +102,9 @@ export function _resetPendingResolve() {
     _currentResolve = null;
     _sessionSwitchInFlight = false;
 }
+export function _hasPendingResolveForTest() {
+    return _currentResolve !== null;
+}
 /**
  * No-op for backward compatibility with tests that previously set the
  * active session. The module no longer holds a session reference.

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -4,7 +4,8 @@
  * Imports from: auto/types, auto/resolve
  */
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
-import { _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { _clearCurrentResolve, _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { getCurrentTurnGeneration, runWithTurnGeneration, } from "./turn-epoch.js";
 import { debugLog } from "../debug-logger.js";
 import { logWarning } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
@@ -26,15 +27,24 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     let sessionResult;
     let sessionTimeoutHandle;
     const mySessionSwitchGeneration = ++sessionSwitchGeneration;
+    // #3731: Cancellation controller for newSession(). When the session-creation
+    // timeout fires, we abort this controller so that the still-in-flight
+    // newSession() discards itself after await this.abort() completes, preventing
+    // it from capturing the (now-root) process.cwd() and rebuilding the tool
+    // runtime with the wrong cwd.
+    const sessionAbortController = new AbortController();
     _setSessionSwitchInFlight(true);
     try {
-        const sessionPromise = s.cmdCtx.newSession().finally(() => {
+        const sessionPromise = s.cmdCtx.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
             if (sessionSwitchGeneration === mySessionSwitchGeneration) {
                 _setSessionSwitchInFlight(false);
             }
         });
         const timeoutPromise = new Promise((resolve) => {
-            sessionTimeoutHandle = setTimeout(() => resolve({ cancelled: true }), NEW_SESSION_TIMEOUT_MS);
+            sessionTimeoutHandle = setTimeout(() => {
+                sessionAbortController.abort();
+                resolve({ cancelled: true });
+            }, NEW_SESSION_TIMEOUT_MS);
         });
         sessionResult = await Promise.race([sessionPromise, timeoutPromise]);
     }
@@ -92,6 +102,40 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     catch (e) {
         logWarning("engine", "Failed to chdir to basePath before dispatch", { basePath: s.basePath, error: String(e) });
     }
+    // ── Provider request-readiness pre-check (#4555) ──
+    // Verify the provider can accept requests before dispatching. If the token
+    // has expired since bootstrap, return cancelled immediately so the unit is
+    // not wasted on a guaranteed 401.
+    {
+        const provider = s.currentUnitModel?.provider ?? ctx.model?.provider;
+        const registry = ctx.modelRegistry;
+        if (provider && registry != null && typeof registry.isProviderRequestReady === "function") {
+            let ready = false;
+            try {
+                ready = registry.isProviderRequestReady(provider);
+            }
+            catch {
+                ready = false;
+            }
+            if (!ready) {
+                _clearCurrentResolve();
+                return {
+                    status: "cancelled",
+                    errorContext: {
+                        message: `Provider ${provider} is not request-ready (login/token expired)`,
+                        category: "provider",
+                        isTransient: false,
+                    },
+                };
+            }
+        }
+    }
+    // ── Capture turn generation for stale-write detection ──
+    // Any write site reached via the sendMessage → tool-call → await chain
+    // below sees this generation via AsyncLocalStorage. If a timeout recovery
+    // or cancellation bumps the generation while this turn is in flight, those
+    // writes see themselves as stale and self-drop.
+    const capturedTurnGen = getCurrentTurnGeneration();
     // ── Send the prompt ──
     debugLog("runUnit", { phase: "send-message", unitType, unitId });
     pi.sendMessage({ customType: "gsd-auto", content: prompt, display: s.verbose }, { triggerTurn: true });
@@ -107,7 +151,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
             resolve({ status: "cancelled", errorContext: { message: "Unit hard timeout — supervision may have failed", category: "timeout", isTransient: true } });
         }, UNIT_HARD_TIMEOUT_MS);
     });
-    const result = await Promise.race([unitPromise, timeoutResult]);
+    const result = await runWithTurnGeneration(capturedTurnGen, () => Promise.race([unitPromise, timeoutResult]));
     if (unitTimeoutHandle)
         clearTimeout(unitTimeoutHandle);
     debugLog("runUnit", {