gsd-pi 2.76.0 → 2.77.0-dev.c9c8932c6

package/dist/resources/extensions/google-search/index.js

@@ -1,379 +1,6 @@
-/**
- * Google Search Extension
- *
- * Provides a `google_search` tool that performs web searches via Gemini's
- * Google Search grounding feature. Uses the user's existing GEMINI_API_KEY
- * and Google Cloud GenAI credits.
- *
- * The tool sends queries to Gemini Flash with `googleSearch: {}` enabled.
- * Gemini internally performs Google searches, synthesizes an answer, and
- * returns it with source URLs from grounding metadata.
- */
-import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead, } from "@gsd/pi-coding-agent";
-import { Text } from "@gsd/pi-tui";
-import { Type } from "@sinclair/typebox";
-let client = null;
-async function getClient() {
-    if (!client) {
-        const { GoogleGenAI } = await import("@google/genai");
-        client = new GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
-    }
-    return client;
-}
-/**
- * Perform a search using OAuth credentials via the Cloud Code Assist API.
- * This is used as a fallback when GEMINI_API_KEY is not set.
- */
-async function searchWithOAuth(query, accessToken, projectId, signal) {
-    const model = process.env.GEMINI_SEARCH_MODEL || "gemini-2.5-flash";
-    const url = `https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse`;
-    const GEMINI_CLI_HEADERS = {
-        ideType: "IDE_UNSPECIFIED",
-        platform: "PLATFORM_UNSPECIFIED",
-        pluginType: "GEMINI",
-    };
-    const executeFetch = async (retries = 3) => {
-        const response = await fetch(url, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${accessToken}`,
-                "Content-Type": "application/json",
-                "User-Agent": "google-cloud-sdk vscode_cloudshelleditor/0.1",
-                "X-Goog-Api-Client": "gl-node/22.17.0",
-                "Client-Metadata": JSON.stringify(GEMINI_CLI_HEADERS),
-            },
-            body: JSON.stringify({
-                project: projectId,
-                model,
-                request: {
-                    contents: [{ parts: [{ text: query }] }],
-                    tools: [{ googleSearch: {} }],
-                },
-                userAgent: "pi-coding-agent",
-            }),
-            signal,
-        });
-        if (!response.ok && retries > 0 && (response.status === 429 || response.status >= 500)) {
-            await new Promise((resolve) => setTimeout(resolve, 1000 * (4 - retries)));
-            return executeFetch(retries - 1);
-        }
-        return response;
-    };
-    const response = await executeFetch();
-    if (!response.ok) {
-        const errorText = await response.text();
-        throw new Error(`Cloud Code Assist API error (${response.status}): ${errorText}`);
-    }
-    // Note: streamGenerateContent returns SSE; for now, we consume all chunks.
-    // For simplicity and to match the previous structure, we'll read to end.
-    const text = await response.text();
-    const jsonLines = text.split("\n")
-        .filter(l => l.startsWith("data:"))
-        .map(l => l.slice(5).trim())
-        .filter(l => l.length > 0);
-    let data;
-    if (jsonLines.length > 0) {
-        // Aggregate chunks if needed, but for now we take the last chunk or assume it's one
-        data = JSON.parse(jsonLines[jsonLines.length - 1]);
-    }
-    else {
-        data = JSON.parse(text);
-    }
-    const candidate = data.response?.candidates?.[0];
-    const answer = candidate?.content?.parts?.find((p) => p.text)?.text ?? "";
-    const grounding = candidate?.groundingMetadata;
-    const sources = [];
-    const seenTitles = new Set();
-    if (grounding?.groundingChunks) {
-        for (const chunk of grounding.groundingChunks) {
-            if (chunk.web) {
-                const title = chunk.web.title ?? "Untitled";
-                if (seenTitles.has(title))
-                    continue;
-                seenTitles.add(title);
-                const domain = chunk.web.domain ?? title;
-                sources.push({
-                    title,
-                    uri: chunk.web.uri ?? "",
-                    domain,
-                });
-            }
-        }
-    }
-    const searchQueries = grounding?.webSearchQueries ?? [];
-    return { answer, sources, searchQueries, cached: false };
-}
-// ── In-session cache ─────────────────────────────────────────────────────────
-const resultCache = new Map();
-function cacheKey(query) {
-    return query.toLowerCase().trim();
-}
-// ── Extension ────────────────────────────────────────────────────────────────
 export default function (pi) {
-    pi.registerTool({
-        name: "google_search",
-        label: "Google Search",
-        description: "Search the web using Google Search via Gemini. " +
-            "Returns an AI-synthesized answer grounded in Google Search results, plus source URLs. " +
-            "Use this when you need current information from the web: recent events, documentation, " +
-            "product details, technical references, news, etc. " +
-            "Requires GEMINI_API_KEY or Google login. Alternative to Brave-based search tools.",
-        promptSnippet: "Search the web via Google Search to get current information with sources",
-        promptGuidelines: [
-            "Use google_search when you need up-to-date web information that isn't in your training data.",
-            "Be specific with queries for better results, e.g. 'Next.js 15 app router migration guide' not just 'Next.js'.",
-            "The tool returns both an answer and source URLs. Cite sources when sharing results with the user.",
-            "Results are cached per-session, so repeated identical queries are free.",
-            "You can still use fetch_page to read a specific URL if needed after getting results from google_search.",
-        ],
-        parameters: Type.Object({
-            query: Type.String({
-                description: "The search query, e.g. 'latest Node.js LTS version' or 'how to configure Tailwind v4'",
-            }),
-            maxSources: Type.Optional(Type.Number({
-                description: "Maximum number of source URLs to include (default 5, max 10).",
-                minimum: 1,
-                maximum: 10,
-            })),
-        }),
-        async execute(_toolCallId, params, signal, _onUpdate, ctx) {
-            const startTime = Date.now();
-            const maxSources = Math.min(Math.max(params.maxSources ?? 5, 1), 10);
-            // Check for credentials
-            let oauthToken;
-            let projectId;
-            if (!process.env.GEMINI_API_KEY) {
-                const oauthRaw = await ctx.modelRegistry.getApiKeyForProvider("google-gemini-cli");
-                if (oauthRaw) {
-                    try {
-                        const parsed = JSON.parse(oauthRaw);
-                        oauthToken = parsed.token;
-                        projectId = parsed.projectId;
-                    }
-                    catch {
-                        // Fall through to error
-                    }
-                }
-            }
-            if (!process.env.GEMINI_API_KEY && (!oauthToken || !projectId)) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: "Error: No authentication found for Google Search. Please set GEMINI_API_KEY or log in via Google.\n\nExample: export GEMINI_API_KEY=your_key or use /login google",
-                        },
-                    ],
-                    isError: true,
-                    details: {
-                        query: params.query,
-                        sourceCount: 0,
-                        cached: false,
-                        durationMs: Date.now() - startTime,
-                        error: "auth_error: No credentials set",
-                    },
-                };
-            }
-            // Check cache
-            const key = cacheKey(params.query);
-            if (resultCache.has(key)) {
-                const cached = resultCache.get(key);
-                const output = formatOutput(cached, maxSources);
-                return {
-                    content: [{ type: "text", text: output }],
-                    details: {
-                        query: params.query,
-                        sourceCount: cached.sources.length,
-                        cached: true,
-                        durationMs: Date.now() - startTime,
-                    },
-                };
-            }
-            // Call Gemini with Google Search grounding
-            let result;
-            try {
-                if (process.env.GEMINI_API_KEY) {
-                    const ai = await getClient();
-                    // Add a 30-second timeout to prevent hanging (#1100)
-                    const timeoutController = new AbortController();
-                    const timeoutId = setTimeout(() => timeoutController.abort(), 30_000);
-                    const combinedSignal = signal
-                        ? AbortSignal.any([signal, timeoutController.signal])
-                        : timeoutController.signal;
-                    let response;
-                    try {
-                        response = await ai.models.generateContent({
-                            model: process.env.GEMINI_SEARCH_MODEL || "gemini-2.5-flash",
-                            contents: params.query,
-                            config: {
-                                tools: [{ googleSearch: {} }],
-                                abortSignal: combinedSignal,
-                            },
-                        });
-                    }
-                    finally {
-                        clearTimeout(timeoutId);
-                    }
-                    // Extract answer text
-                    const answer = response.text ?? "";
-                    // Extract grounding metadata
-                    const candidate = response.candidates?.[0];
-                    const grounding = candidate?.groundingMetadata;
-                    // Parse sources from grounding chunks
-                    const sources = [];
-                    const seenTitles = new Set();
-                    if (grounding?.groundingChunks) {
-                        for (const chunk of grounding.groundingChunks) {
-                            if (chunk.web) {
-                                const title = chunk.web.title ?? "Untitled";
-                                // Dedupe by title since URIs are redirect URLs that differ per call
-                                if (seenTitles.has(title))
-                                    continue;
-                                seenTitles.add(title);
-                                // domain field is not available via Gemini API, use title as fallback
-                                // (title is typically the domain name, e.g. "wikipedia.org")
-                                const domain = chunk.web.domain ?? title;
-                                sources.push({
-                                    title,
-                                    uri: chunk.web.uri ?? "",
-                                    domain,
-                                });
-                            }
-                        }
-                    }
-                    // Extract search queries Gemini actually performed
-                    const searchQueries = grounding?.webSearchQueries ?? [];
-                    result = { answer, sources, searchQueries, cached: false };
-                }
-                else {
-                    result = await searchWithOAuth(params.query, oauthToken, projectId, signal);
-                }
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                let errorType = "api_error";
-                if (msg.includes("401") || msg.includes("UNAUTHENTICATED")) {
-                    errorType = "auth_error";
-                }
-                else if (msg.includes("429") || msg.includes("RESOURCE_EXHAUSTED") || msg.includes("quota")) {
-                    errorType = "rate_limit";
-                }
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `Google Search failed (${errorType}): ${msg}`,
-                        },
-                    ],
-                    isError: true,
-                    details: {
-                        query: params.query,
-                        sourceCount: 0,
-                        cached: false,
-                        durationMs: Date.now() - startTime,
-                        error: `${errorType}: ${msg}`,
-                    },
-                };
-            }
-            // Cache the result
-            resultCache.set(key, result);
-            // Format and truncate output
-            const rawOutput = formatOutput(result, maxSources);
-            const truncation = truncateHead(rawOutput, {
-                maxLines: DEFAULT_MAX_LINES,
-                maxBytes: DEFAULT_MAX_BYTES,
-            });
-            let finalText = truncation.content;
-            if (truncation.truncated) {
-                finalText +=
-                    `\n\n[Truncated: showing ${truncation.outputLines}/${truncation.totalLines} lines` +
-                        ` (${formatSize(truncation.outputBytes)} of ${formatSize(truncation.totalBytes)})]`;
-            }
-            return {
-                content: [{ type: "text", text: finalText }],
-                details: {
-                    query: params.query,
-                    sourceCount: result.sources.length,
-                    cached: false,
-                    durationMs: Date.now() - startTime,
-                },
-            };
-        },
-        renderCall(args, theme) {
-            let text = theme.fg("toolTitle", theme.bold("google_search "));
-            text += theme.fg("accent", `"${args.query}"`);
-            return new Text(text, 0, 0);
-        },
-        renderResult(result, { isPartial, expanded }, theme) {
-            const d = result.details;
-            if (isPartial)
-                return new Text(theme.fg("warning", "Searching Google..."), 0, 0);
-            if (result.isError || d?.error) {
-                return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
-            }
-            let text = theme.fg("success", `${d?.sourceCount ?? 0} sources`);
-            text += theme.fg("dim", ` (${d?.durationMs ?? 0}ms)`);
-            if (d?.cached)
-                text += theme.fg("dim", " · cached");
-            if (expanded) {
-                const content = result.content[0];
-                if (content?.type === "text") {
-                    const preview = content.text.split("\n").slice(0, 8).join("\n");
-                    text += "\n\n" + theme.fg("dim", preview);
-                    if (content.text.split("\n").length > 8) {
-                        text += "\n" + theme.fg("muted", "...");
-                    }
-                }
-            }
-            return new Text(text, 0, 0);
-        },
-    });
-    // ── Session cleanup ─────────────────────────────────────────────────────
-    pi.on("session_shutdown", async () => {
-        resultCache.clear();
-        client = null;
-    });
-    // ── Startup notification ─────────────────────────────────────────────────
     pi.on("session_start", async (_event, ctx) => {
-        if (process.env.GEMINI_API_KEY)
-            return;
-        const hasOAuth = await ctx.modelRegistry.authStorage.hasAuth("google-gemini-cli");
-        if (!hasOAuth) {
-            ctx.ui.notify("Google Search: No authentication set. Log in via Google or set GEMINI_API_KEY to use google_search.", "warning");
-        }
+        ctx.ui.notify("google_search has moved to @gsd-extensions/google-search. " +
+            "Install: gsd extensions install @gsd-extensions/google-search", "warning");
     });
 }
-// ── Output formatting ────────────────────────────────────────────────────────
-function formatOutput(result, maxSources) {
-    const lines = [];
-    // Answer
-    if (result.answer) {
-        lines.push(result.answer);
-    }
-    else {
-        lines.push("(No answer text returned from search)");
-    }
-    // Sources
-    if (result.sources.length > 0) {
-        lines.push("");
-        lines.push("Sources:");
-        const sourcesToShow = result.sources.slice(0, maxSources);
-        for (let i = 0; i < sourcesToShow.length; i++) {
-            const s = sourcesToShow[i];
-            lines.push(`[${i + 1}] ${s.title} - ${s.domain}`);
-            lines.push(`    ${s.uri}`);
-        }
-        if (result.sources.length > maxSources) {
-            lines.push(`(${result.sources.length - maxSources} more sources omitted)`);
-        }
-    }
-    else {
-        lines.push("");
-        lines.push("(No source URLs found in grounding metadata)");
-    }
-    // Search queries
-    if (result.searchQueries.length > 0) {
-        lines.push("");
-        lines.push(`Searches performed: ${result.searchQueries.map((q) => `"${q}"`).join(", ")}`);
-    }
-    return lines.join("\n");
-}

package/dist/resources/extensions/gsd/auto/loop.js

@@ -30,6 +30,13 @@ function stuckStatePath(basePath) {
 function loadStuckState(basePath) {
     try {
         const data = JSON.parse(readFileSync(stuckStatePath(basePath), "utf-8"));
+        // Only load state written by a DIFFERENT process (real session restart).
+        // If the PID matches the current process, this state was written by an earlier
+        // autoLoop call in the same process (e.g., a test that completed before this
+        // one), not by a crashed session — skip it to prevent test state pollution.
+        if (data.pid === process.pid) {
+            return { recentUnits: [], stuckRecoveryAttempts: 0 };
+        }
         return {
             recentUnits: Array.isArray(data.recentUnits) ? data.recentUnits : [],
             stuckRecoveryAttempts: typeof data.stuckRecoveryAttempts === "number" ? data.stuckRecoveryAttempts : 0,
@@ -45,6 +52,7 @@ function saveStuckState(basePath, state) {
         const filePath = stuckStatePath(basePath);
         mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
         writeFileSync(filePath, JSON.stringify({
+            pid: process.pid,
             recentUnits: state.recentUnits.slice(-20), // keep last 20 entries
             stuckRecoveryAttempts: state.stuckRecoveryAttempts,
             updatedAt: new Date().toISOString(),
@@ -497,6 +505,7 @@ export async function autoLoop(ctx, pi, s, deps, options) {
             consecutiveCooldowns = 0;
             recentErrorMessages.length = 0;
             deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
+            saveStuckState(s.basePath, loopState); // persist across session restarts (#4382)
             debugLog("autoLoop", { phase: "iteration-complete", iteration });
             finishTurn("completed");
         }

package/dist/resources/extensions/gsd/auto/phases.js

@@ -30,7 +30,8 @@ import { isDbAvailable, getMilestoneSlices } from "../gsd-db.js";
 import { ensurePlanV2Graph } from "../uok/plan-v2.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { UokGateRunner } from "../uok/gate-runner.js";
-import { resetEvidence } from "../safety/evidence-collector.js";
+import { resetEvidence, loadEvidenceFromDisk } from "../safety/evidence-collector.js";
+import { parseUnitId } from "../unit-id.js";
 import { createCheckpoint, cleanupCheckpoint, rollbackToCheckpoint } from "../safety/git-checkpoint.js";
 import { resolveSafetyHarnessConfig } from "../safety/safety-harness.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, supportsStructuredQuestions, } from "../workflow-mcp.js";
@@ -47,7 +48,11 @@ export function resetSessionTimeoutState() {
  * Exported for testing as _resolveReportBasePath.
  */
 export function _resolveReportBasePath(s) {
-    return s.originalBasePath || s.basePath;
+    // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
+    // originalBasePath is falsy — prevents reports landing in the worktree (#3729).
+    const resolved = s.originalBasePath || s.basePath;
+    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
 }
 /**
  * Resolve the authoritative project base for dispatch guards.
@@ -55,7 +60,12 @@ export function _resolveReportBasePath(s) {
  * unit is running inside an auto worktree.
  */
 export function _resolveDispatchGuardBasePath(s) {
-    return s.originalBasePath || s.basePath;
+    // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
+    // originalBasePath is falsy — prevents guard checks running against the
+    // worktree instead of the project root (#3729).
+    const resolved = s.originalBasePath || s.basePath;
+    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
 }
 const PLAN_V2_GATE_PHASES = new Set([
     "executing",
@@ -295,7 +305,7 @@ export async function runPreDispatch(ic, loopState) {
                 findings: reason,
                 milestoneId: state.activeMilestone?.id ?? undefined,
             });
-            ctx.ui.notify(`Plan gate failed-closed: ${reason}`, "error");
+            ctx.ui.notify(`Plan gate failed-closed: ${reason}\n\nIf this keeps happening, try: /gsd doctor heal`, "error");
             await deps.pauseAuto(ctx, pi);
             return { action: "break", reason: "plan-v2-gate-failed" };
         }
@@ -389,6 +399,8 @@ export async function runPreDispatch(ic, loopState) {
         loopState.recentUnits.length = 0;
         loopState.stuckRecoveryAttempts = 0;
         // Worktree lifecycle on milestone transition — merge current, enter next
+        // #2909: preflight — warn + stash dirty working tree before merge
+        const preflightTransition = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
         try {
             deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
         }
@@ -405,6 +417,10 @@ export async function runPreDispatch(ic, loopState) {
             await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
             return { action: "break", reason: "merge-failed" };
         }
+        // #2909: postflight — restore stashed changes after successful merge
+        if (preflightTransition.stashPushed) {
+            deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+        }
         // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         deps.invalidateAllCaches();
         state = await deps.deriveState(s.basePath);
@@ -459,6 +475,8 @@ export async function runPreDispatch(ic, loopState) {
         if (incomplete.length === 0 && state.registry.length > 0) {
             // All milestones complete — merge milestone branch before stopping
             if (s.currentMilestoneId) {
+                // #2909: preflight — warn + stash dirty working tree before merge
+                const preflightAllComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
                 try {
                     deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
                     // Prevent stopAuto from attempting the same merge (#2645)
@@ -475,6 +493,10 @@ export async function runPreDispatch(ic, loopState) {
                     await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
                     return { action: "break", reason: "merge-failed" };
                 }
+                // #2909: postflight — restore stashed changes after successful merge
+                if (preflightAllComplete.stashPushed) {
+                    deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+                }
                 // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
             }
             deps.sendDesktopNotification("GSD", "All milestones complete!", "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -539,6 +561,8 @@ export async function runPreDispatch(ic, loopState) {
     if (state.phase === "complete") {
         // Milestone merge on complete (before closeout so branch state is clean)
         if (s.currentMilestoneId) {
+            // #2909: preflight — warn + stash dirty working tree before merge
+            const preflightComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
             try {
                 deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
                 // Prevent stopAuto from attempting the same merge (#2645)
@@ -555,6 +579,10 @@ export async function runPreDispatch(ic, loopState) {
                 await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
                 return { action: "break", reason: "merge-failed" };
             }
+            // #2909: postflight — restore stashed changes after successful merge
+            if (preflightComplete.stashPushed) {
+                deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
+            }
             // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         }
         deps.sendDesktopNotification("GSD", `Milestone ${mid} complete!`, "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -823,16 +851,44 @@ export async function runGuards(ic, mid) {
         if (threshold) {
             s.lastBudgetAlertLevel =
                 newBudgetAlertLevel;
-            if (threshold.pct === 100 && budgetEnforcementAction !== "none") {
+            // Emit Layer 2 budget_threshold event (post-plan hook recommendation).
+            // Extensions / Layer 0 shell hooks may return an action override.
+            let hookAction;
+            try {
+                const { emitBudgetThreshold } = await import("../hook-emitter.js");
+                const hookResult = await emitBudgetThreshold({
+                    fraction: budgetPct,
+                    spent: totalCost,
+                    limit: budgetCeiling,
+                });
+                if (hookResult?.action)
+                    hookAction = hookResult.action;
+            }
+            catch (hookErr) {
+                logWarning("engine", `budget_threshold hook emission failed: ${hookErr.message}`);
+            }
+            // Apply hook override to enforcement action. "continue" → "none" (no enforcement),
+            // "pause" and "downgrade" map to the matching enforcement path below.
+            let effectiveAction = budgetEnforcementAction;
+            if (hookAction === "continue") {
+                effectiveAction = "none";
+            }
+            else if (hookAction === "pause") {
+                effectiveAction = "pause";
+            }
+            else if (hookAction === "downgrade") {
+                effectiveAction = "warn";
+            }
+            if (threshold.pct === 100 && effectiveAction !== "none") {
                 // 100% — special enforcement logic (halt/pause/warn)
                 const msg = `Budget ceiling ${deps.formatCost(budgetCeiling)} reached (spent ${deps.formatCost(totalCost)}).`;
-                if (budgetEnforcementAction === "halt") {
+                if (effectiveAction === "halt") {
                     deps.sendDesktopNotification("GSD", msg, "error", "budget", basename(s.originalBasePath || s.basePath));
                     await deps.stopAuto(ctx, pi, "Budget ceiling reached");
                     debugLog("autoLoop", { phase: "exit", reason: "budget-halt" });
                     return { action: "break", reason: "budget-halt" };
                 }
-                if (budgetEnforcementAction === "pause") {
+                if (effectiveAction === "pause") {
                     ctx.ui.notify(`${msg} Pausing auto-mode — /gsd auto to override and continue.`, "warning");
                     deps.sendDesktopNotification("GSD", msg, "warning", "budget", basename(s.originalBasePath || s.basePath));
                     deps.logCmuxEvent(prefs, msg, "warning");
@@ -1000,6 +1056,14 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
     const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
     if (safetyConfig.enabled && safetyConfig.evidence_collection) {
         resetEvidence();
+        // Restore persisted evidence so session-restart resumes don't produce
+        // false-positive "no bash calls" warnings (Bug #4385).
+        if (s.basePath && unitType === "execute-task") {
+            const { milestone: eMid, slice: eSid, task: eTid } = parseUnitId(unitId);
+            if (eMid && eSid && eTid) {
+                loadEvidenceFromDisk(s.basePath, eMid, eSid, eTid);
+            }
+        }
     }
     // Only checkpoint code-executing units (not lifecycle/planning units)
     if (safetyConfig.enabled && safetyConfig.checkpoints && unitType === "execute-task") {
@@ -1066,7 +1130,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         logWarning("engine", "Prompt reorder failed", { error: msg });
     }
     // Select and apply model (with tier escalation on retry — normal units only)
-    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride);
+    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride, s.autoModeStartThinkingLevel);
     s.currentUnitRouting =
         modelResult.routing;
     s.currentUnitModel =
@@ -1079,6 +1143,9 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         if (match) {
             const ok = await pi.setModel(match, { persist: false });
             if (ok) {
+                if (s.autoModeStartThinkingLevel) {
+                    pi.setThinkingLevel(s.autoModeStartThinkingLevel);
+                }
                 s.currentUnitModel = match;
                 ctx.ui.notify(`Hook model override: ${match.provider}/${match.id}`, "info");
             }
@@ -1173,20 +1240,23 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         }
     }
     if (unitResult.status === "cancelled") {
+        const errorCategory = unitResult.errorContext?.category;
         // Provider-error pause: pauseAuto already handled cleanup and scheduled
         // recovery. Don't hard-stop — just break out of the loop (#2762).
-        if (unitResult.errorContext?.category === "provider") {
+        if (errorCategory === "provider") {
             await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
-            debugLog("autoLoop", { phase: "exit", reason: "provider-pause", isTransient: unitResult.errorContext.isTransient });
+            debugLog("autoLoop", { phase: "exit", reason: "provider-pause", isTransient: unitResult.errorContext?.isTransient });
             return { action: "break", reason: "provider-pause" };
         }
         // Timeout category covers two distinct scenarios:
         //   1. Session creation timeout (120s) — transient, auto-resume with backoff
         //   2. Unit hard timeout (30min+) — stuck agent, pause for manual review
+        // Transient session-failed covers recoverable newSession failures and should
+        // pause instead of hard-stopping.
         // Structural errors (TypeError, is not a function) are NOT transient
         // and must hard-stop to avoid infinite retry loops.
         if (unitResult.errorContext?.isTransient &&
-            unitResult.errorContext?.category === "timeout") {
+            errorCategory === "timeout") {
             const isSessionCreationTimeout = unitResult.errorContext.message?.includes("Session creation timed out");
             if (isSessionCreationTimeout) {
                 consecutiveSessionTimeouts += 1;
@@ -1229,6 +1299,15 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
             await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
             return { action: "break", reason: "unit-hard-timeout" };
         }
+        if (unitResult.errorContext?.isTransient &&
+            errorCategory === "session-failed") {
+            ctx.ui.notify(`Session creation failed transiently for ${unitType} ${unitId}: ${unitResult.errorContext?.message ?? "unknown"}. Pausing auto-mode (recoverable).`, "warning");
+            debugLog("autoLoop", { phase: "session-start-transient-pause", unitType, unitId, category: errorCategory });
+            await deps.pauseAuto(ctx, pi);
+            await deps.autoCommitUnit?.(s.basePath, unitType, unitId, ctx);
+            await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
+            return { action: "break", reason: "session-timeout" };
+        }
         // All other cancelled states (structural errors, non-transient failures): hard stop
         if (s.currentUnit) {
             await deps.closeoutUnit(ctx, s.basePath, unitType, unitId, s.currentUnit.startedAt, deps.buildSnapshotOpts(unitType, unitId));
@@ -1387,6 +1466,20 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         }
         else {
             // s.pendingVerificationRetry was set by postUnitPreVerification.
+            // Emit a dedicated journal event so forensics can distinguish bounded
+            // verification retries from genuine stuck-loop dispatch repetitions (#4540).
+            const retryInfo = s.pendingVerificationRetry;
+            deps.emitJournalEvent({
+                ts: new Date().toISOString(),
+                flowId: ic.flowId,
+                seq: ic.nextSeq(),
+                eventType: "artifact-verification-retry",
+                data: {
+                    unitType: preUnitSnapshot?.type,
+                    unitId: retryInfo?.unitId,
+                    attempt: retryInfo?.attempt,
+                },
+            });
             // Continue the loop — next iteration will inject the retry context into the prompt.
             debugLog("autoLoop", { phase: "artifact-verification-retry", iteration: ic.iteration });
             return { action: "continue" };