gsd-pi 2.76.0 → 2.77.0

package/dist/resources/extensions/gsd/auto.js

@@ -37,8 +37,9 @@ import { getRtkSessionSavings } from "../shared/rtk-session-stats.js";
 import { deactivateGSD } from "../shared/gsd-phase-state.js";
 import { initMetrics, resetMetrics, getLedger, getProjectTotals, formatCost, formatTokenCount, } from "./metrics.js";
 import { setLogBasePath, logWarning } from "./workflow-logger.js";
+import { preflightCleanRoot, postflightPopStash } from "./clean-root-preflight.js";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { readFileSync, existsSync, mkdirSync, writeFileSync, unlinkSync } from "node:fs";
 import { atomicWriteSync } from "./atomic-write.js";
@@ -55,7 +56,7 @@ import { getErrorMessage } from "./error-utils.js";
 import { recoverFailedMigration } from "./migrate-external.js";
 import { initRegistry, convertDispatchRules } from "./rule-registry.js";
 import { emitJournalEvent as _emitJournalEvent } from "./journal.js";
-import { updateProgressWidget as _updateProgressWidget, updateSliceProgressCache, clearSliceProgressCache, hideFooter, } from "./auto-dashboard.js";
+import { updateProgressWidget as _updateProgressWidget, updateSliceProgressCache, clearSliceProgressCache, } from "./auto-dashboard.js";
 import { registerSigtermHandler as _registerSigtermHandler, deregisterSigtermHandler as _deregisterSigtermHandler, } from "./auto-supervisor.js";
 import { isDbAvailable, getMilestone } from "./gsd-db.js";
 import { countPendingCaptures } from "./captures.js";
@@ -136,6 +137,24 @@ function restoreMilestoneLockEnv() {
     s.hadMilestoneLockEnv = false;
     s.milestoneLockEnvCaptured = false;
 }
+function normalizeSessionFilePath(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    const firstLine = trimmed.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    if (!firstLine)
+        return null;
+    // Guard against accidental message concatenation by trimming to .jsonl.
+    const jsonlIndex = firstLine.toLowerCase().indexOf(".jsonl");
+    const candidate = jsonlIndex >= 0 ? firstLine.slice(0, jsonlIndex + ".jsonl".length) : firstLine;
+    if (!isAbsolute(candidate))
+        return null;
+    if (!candidate.toLowerCase().endsWith(".jsonl"))
+        return null;
+    return candidate;
+}
 export function startAutoDetached(ctx, pi, base, verboseMode, options) {
     void startAuto(ctx, pi, base, verboseMode, options).catch((err) => {
         const message = getErrorMessage(err);
@@ -145,8 +164,8 @@ export function startAutoDetached(ctx, pi, base, verboseMode, options) {
     });
 }
 /** Returns true if the project is configured for `isolation:worktree` mode. */
-export function shouldUseWorktreeIsolation() {
-    const prefs = loadEffectiveGSDPreferences()?.preferences?.git;
+export function shouldUseWorktreeIsolation(basePath) {
+    const prefs = loadEffectiveGSDPreferences(basePath)?.preferences?.git;
     if (prefs?.isolation === "worktree")
         return true;
     // Default is false — worktree isolation requires explicit opt-in
@@ -215,7 +234,7 @@ export function getAutoDashboardData() {
     const rtkSavings = sessionId && s.basePath
         ? getRtkSessionSavings(s.basePath, sessionId)
         : null;
-    const rtkEnabled = loadEffectiveGSDPreferences()?.preferences.experimental?.rtk === true;
+    const rtkEnabled = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences.experimental?.rtk === true;
     // Pending capture count — lazy check, non-fatal
     let pendingCaptureCount = 0;
     try {
@@ -393,7 +412,7 @@ function clearUnitTimeout() {
 }
 /** Build snapshot metric opts. */
 function buildSnapshotOpts(_unitType, _unitId) {
-    const prefs = loadEffectiveGSDPreferences()?.preferences;
+    const prefs = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences;
     const uokFlags = resolveUokFlags(prefs);
     return {
         ...(s.autoStartTime > 0 ? { autoSessionKey: String(s.autoStartTime) } : {}),
@@ -427,7 +446,7 @@ function handleLostSessionLock(ctx, lockStatus) {
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
     deregisterSigtermHandler();
-    clearCmuxSidebar(loadEffectiveGSDPreferences()?.preferences);
+    clearCmuxSidebar(loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences);
     const base = lockBase();
     const lockFilePath = base ? join(gsdRoot(base), "auto.lock") : "unknown";
     const recoverySuggestion = "\nTo recover, run: gsd doctor --fix";
@@ -443,7 +462,6 @@ function handleLostSessionLock(ctx, lockStatus) {
     ctx?.ui.notify(message, "error");
     ctx?.ui.setStatus("gsd-auto", undefined);
     ctx?.ui.setWidget("gsd-progress", undefined);
-    ctx?.ui.setFooter(undefined);
     if (ctx)
         initHealthWidget(ctx);
 }
@@ -480,7 +498,6 @@ function cleanupAfterLoopExit(ctx) {
     if (!s.paused) {
         ctx.ui.setStatus("gsd-auto", undefined);
         ctx.ui.setWidget("gsd-progress", undefined);
-        ctx.ui.setFooter(undefined);
         initHealthWidget(ctx);
     }
     // Restore CWD out of worktree back to original project root
@@ -498,7 +515,7 @@ function cleanupAfterLoopExit(ctx) {
 export async function stopAuto(ctx, pi, reason) {
     if (!s.active && !s.paused)
         return;
-    const loadedPreferences = loadEffectiveGSDPreferences()?.preferences;
+    const loadedPreferences = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences;
     const reasonSuffix = reason ? ` — ${reason}` : "";
     try {
         // ── Step 1: Timers and locks ──
@@ -695,13 +712,16 @@ export async function stopAuto(ctx, pi, reason) {
         catch (err) { /* non-fatal */
             logWarning("engine", `file unlink failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
         }
-        // ── Step 13: Restore original model (before reset clears IDs) ──
+        // ── Step 13: Restore original model + thinking (before reset clears IDs) ──
         try {
             if (pi && ctx && s.originalModelId && s.originalModelProvider) {
                 const original = ctx.modelRegistry.find(s.originalModelProvider, s.originalModelId);
                 if (original)
                     await pi.setModel(original);
             }
+            if (pi && s.originalThinkingLevel) {
+                pi.setThinkingLevel(s.originalThinkingLevel);
+            }
         }
         catch (e) {
             debugLog("stop-cleanup-model", { error: e instanceof Error ? e.message : String(e) });
@@ -740,7 +760,6 @@ export async function stopAuto(ctx, pi, reason) {
         // UI cleanup
         ctx?.ui.setStatus("gsd-auto", undefined);
         ctx?.ui.setWidget("gsd-progress", undefined);
-        ctx?.ui.setFooter(undefined);
         if (ctx)
             initHealthWidget(ctx);
         restoreProjectRootEnv();
@@ -775,7 +794,7 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     // Pass errorContext so runUnitPhase can distinguish user-initiated pause
     // from provider-error pause and avoid hard-stopping (#2762).
     resolveAgentEndCancelled(_errorContext);
-    s.pausedSessionFile = ctx?.sessionManager?.getSessionFile() ?? null;
+    s.pausedSessionFile = normalizeSessionFilePath(ctx?.sessionManager?.getSessionFile() ?? null);
     // Persist paused-session metadata so resume survives /exit (#1383).
     // The fresh-start bootstrap checks for this file and restores worktree context.
     try {
@@ -829,7 +848,6 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     s.verificationRetryCount.clear();
     ctx?.ui.setStatus("gsd-auto", "paused");
     ctx?.ui.setWidget("gsd-progress", undefined);
-    ctx?.ui.setFooter(undefined);
     if (ctx)
         initHealthWidget(ctx);
     const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
@@ -975,6 +993,9 @@ function buildLoopDeps() {
         },
         // Journal
         emitJournalEvent: (entry) => _emitJournalEvent(s.basePath, entry),
+        // Clean-root preflight gate (#2909)
+        preflightCleanRoot,
+        postflightPopStash,
     };
 }
 /**
@@ -1031,7 +1052,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                     unlinkSync(pausedPath);
                 }
                 catch (e) {
-                    logWarning("session", `pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                    if (e.code !== "ENOENT") {
+                        logWarning("session", `pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                    }
                 }
                 ctx.ui.notify(`Resuming paused custom workflow${meta.activeRunDir ? ` (${meta.activeRunDir})` : ""}.`, "info");
             }
@@ -1049,7 +1072,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                             unlinkSync(pausedPath);
                         }
                         catch (err) {
-                            logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                            if (err.code !== "ENOENT") {
+                                logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                            }
                         }
                         ctx.ui.notify(`Paused milestone ${meta.milestoneId} is ${!mDir ? "missing" : "already complete"}. Starting fresh.`, "info");
                     }
@@ -1057,7 +1082,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                         s.currentMilestoneId = meta.milestoneId;
                         s.originalBasePath = meta.originalBasePath || base;
                         s.stepMode = meta.stepMode ?? requestedStepMode;
-                        s.pausedSessionFile = meta.sessionFile ?? null;
+                        s.pausedSessionFile = normalizeSessionFilePath(meta.sessionFile ?? null);
                         s.pausedUnitType = meta.unitType ?? null;
                         s.pausedUnitId = meta.unitId ?? null;
                         s.autoStartTime = meta.autoStartTime || Date.now();
@@ -1067,7 +1092,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                             unlinkSync(pausedPath);
                         }
                         catch (e) {
-                            logWarning("session", `pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                            if (e.code !== "ENOENT") {
+                                logWarning("session", `pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                            }
                         }
                         ctx.ui.notify(`Resuming paused session for ${meta.milestoneId}${meta.worktreePath && existsSync(meta.worktreePath) ? ` (worktree)` : ""}.`, "info");
                     }
@@ -1077,7 +1104,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                         unlinkSync(pausedPath);
                     }
                     catch (e) {
-                        logWarning("session", `stale pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                        if (e.code !== "ENOENT") {
+                            logWarning("session", `stale pause file cleanup failed: ${e instanceof Error ? e.message : String(e)}`, { file: "auto.ts" });
+                        }
                     }
                 }
             }
@@ -1133,7 +1162,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
                 unlinkSync(s.pausedSessionFile);
             }
             catch (err) {
-                logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                if (err.code !== "ENOENT") {
+                    logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                }
             }
             s.pausedSessionFile = null;
         }
@@ -1143,6 +1174,17 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         s.stepMode = requestedStepMode;
         s.cmdCtx = ctx;
         s.basePath = base;
+        // ── Resume worktree: if the paused session was inside a milestone worktree,
+        // apply that path as the dispatch basePath immediately (#3723).
+        // This ensures the dispatch loop runs from the worktree directory even when
+        // enterMilestone guard conditions differ between the original and resumed
+        // session (e.g. isolation mode changed, detectWorktreeName differs across
+        // process restarts).  We guard with existsSync so a stale or deleted
+        // worktree directory safely falls back to the project root.
+        const resumeWorktreePath = freshStartAssessment.pausedSession?.worktreePath;
+        if (resumeWorktreePath && existsSync(resumeWorktreePath)) {
+            s.basePath = resumeWorktreePath;
+        }
         // Ensure the workflow-logger audit log is pinned to the project root
         // even when auto-mode is entered via a path that bypasses the
         // bootstrap/dynamic-tools ensureDbOpen() → setLogBasePath() chain
@@ -1161,7 +1203,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         });
         // ── Auto-worktree / branch-mode: re-enter on resume ──
         if (s.currentMilestoneId &&
-            getIsolationMode() !== "none" &&
+            getIsolationMode(s.originalBasePath || s.basePath) !== "none" &&
             s.originalBasePath &&
             !isInAutoWorktree(s.basePath) &&
             !detectWorktreeName(s.basePath) &&
@@ -1172,7 +1214,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         }
         registerSigtermHandler(lockBase());
         ctx.ui.setStatus("gsd-auto", s.stepMode ? "next" : "auto");
-        ctx.ui.setFooter(hideFooter);
+        ctx.ui.setWidget("gsd-health", undefined);
         ctx.ui.notify(s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", "info");
         restoreHookState(s.basePath);
         // Re-sync managed resources on resume so long-lived auto sessions pick up
@@ -1194,7 +1236,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         await openProjectDbIfPresent(s.basePath);
         try {
             await rebuildState(s.basePath);
-            syncCmuxSidebar(loadEffectiveGSDPreferences()?.preferences, await deriveState(s.basePath));
+            syncCmuxSidebar(loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, await deriveState(s.basePath));
         }
         catch (e) {
             debugLog("resume-rebuild-state-failed", {
@@ -1224,7 +1266,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         }
         updateSessionLock(lockBase(), "resuming", s.currentMilestoneId ?? "unknown");
         writeLock(lockBase(), "resuming", s.currentMilestoneId ?? "unknown");
-        logCmuxEvent(loadEffectiveGSDPreferences()?.preferences, s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", "progress");
+        logCmuxEvent(loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", "progress");
         captureProjectRootEnv(s.originalBasePath || s.basePath);
         startAutoCommandPolling(s.basePath);
         await runAutoLoopWithUok({
@@ -1250,13 +1292,13 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         return;
     captureProjectRootEnv(s.originalBasePath || s.basePath);
     try {
-        syncCmuxSidebar(loadEffectiveGSDPreferences()?.preferences, await deriveState(s.basePath));
+        syncCmuxSidebar(loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, await deriveState(s.basePath));
     }
     catch (err) {
         // Best-effort only — sidebar sync must never block auto-mode startup
         logWarning("engine", `cmux sync failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
     }
-    logCmuxEvent(loadEffectiveGSDPreferences()?.preferences, requestedStepMode ? "Step-mode started." : "Auto-mode started.", "progress");
+    logCmuxEvent(loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, requestedStepMode ? "Step-mode started." : "Auto-mode started.", "progress");
     startAutoCommandPolling(s.basePath);
     // Dispatch the first unit
     await runAutoLoopWithUok({
@@ -1361,8 +1403,8 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
                 `Ensure the model is defined in models.json and has auth configured.`, "warning");
         }
     }
-    const sessionFile = ctx.sessionManager.getSessionFile();
-    writeLock(lockBase(), hookUnitType, triggerUnitId, sessionFile);
+    const sessionFile = normalizeSessionFilePath(ctx.sessionManager.getSessionFile());
+    writeLock(lockBase(), hookUnitType, triggerUnitId, sessionFile ?? undefined);
     clearUnitTimeout();
     const supervisor = resolveAutoSupervisorConfig();
     const hookHardTimeoutMs = (supervisor.hard_timeout_minutes ?? 30) * 60 * 1000;

package/dist/resources/extensions/gsd/blocked-models.js

@@ -0,0 +1,68 @@
+// GSD — Persistent per-project blocklist of provider/model pairs that the
+// provider has rejected at request time for account entitlement reasons.
+//
+// Lives at `.gsd/runtime/blocked-models.json` so the block survives /gsd auto
+// restarts.  Auto-mode model selection skips blocked entries; agent-end
+// recovery adds entries when a runtime rejection is classified as
+// `unsupported-model`.  See issue #4513.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { gsdRoot } from "./paths.js";
+import { withFileLockSync } from "./file-lock.js";
+function blockedModelsPath(basePath) {
+    return join(gsdRoot(basePath), "runtime", "blocked-models.json");
+}
+function modelKey(provider, id) {
+    return `${provider.toLowerCase()}/${id.toLowerCase()}`;
+}
+function readFileSafe(path) {
+    if (!existsSync(path))
+        return { version: 1, blocked: [] };
+    try {
+        const raw = readFileSync(path, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (!parsed || !Array.isArray(parsed.blocked)) {
+            return { version: 1, blocked: [] };
+        }
+        const blocked = parsed.blocked.filter((e) => !!e && typeof e.provider === "string" && typeof e.id === "string");
+        return { version: 1, blocked };
+    }
+    catch {
+        // Corrupted JSON: treat as empty so a bad file never blocks dispatch.
+        return { version: 1, blocked: [] };
+    }
+}
+export function loadBlockedModels(basePath) {
+    return readFileSafe(blockedModelsPath(basePath)).blocked;
+}
+export function isModelBlocked(basePath, provider, id) {
+    if (!provider || !id)
+        return false;
+    const target = modelKey(provider, id);
+    return loadBlockedModels(basePath).some((e) => modelKey(e.provider, e.id) === target);
+}
+export function blockModel(basePath, provider, id, reason) {
+    const path = blockedModelsPath(basePath);
+    mkdirSync(dirname(path), { recursive: true });
+    // Ensure the file exists before we try to lock it — proper-lockfile requires
+    // the target path to exist (file-lock.ts falls through to an unlocked call
+    // otherwise).
+    if (!existsSync(path)) {
+        writeFileSync(path, JSON.stringify({ version: 1, blocked: [] }, null, 2) + "\n", "utf-8");
+    }
+    withFileLockSync(path, () => {
+        const current = readFileSafe(path);
+        const target = modelKey(provider, id);
+        if (current.blocked.some((e) => modelKey(e.provider, e.id) === target)) {
+            return;
+        }
+        const next = {
+            version: 1,
+            blocked: [
+                ...current.blocked,
+                { provider, id, reason, blockedAt: Date.now() },
+            ],
+        };
+        writeFileSync(path, JSON.stringify(next, null, 2) + "\n", "utf-8");
+    });
+}

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -1,5 +1,5 @@
 import { logWarning } from "../workflow-logger.js";
-import { checkAutoStartAfterDiscuss } from "../guided-flow.js";
+import { checkAutoStartAfterDiscuss, maybeHandleReadyPhraseWithoutFiles, maybeHandleEmptyIntentTurn, resetEmptyTurnCounter, } from "../guided-flow.js";
 import { getAutoDashboardData, getAutoModeStartModel, isAutoActive, pauseAuto, setCurrentDispatchedModelId } from "../auto.js";
 import { getNextFallbackModel, resolveModelWithFallbacksForUnit } from "../preferences.js";
 import { pauseAutoForProviderError } from "../provider-error-pause.js";
@@ -8,6 +8,7 @@ import { resolveModelId } from "../auto-model-selection.js";
 import { clearDiscussionFlowState } from "./write-gate.js";
 import { resumeAutoAfterProviderDelay } from "./provider-error-resume.js";
 import { classifyError, createRetryState, resetRetryState, isTransient, } from "../error-classifier.js";
+import { blockModel, isModelBlocked } from "../blocked-models.js";
 const retryState = createRetryState();
 const MAX_NETWORK_RETRIES = 2;
 const MAX_TRANSIENT_AUTO_RESUMES = 8;
@@ -52,6 +53,19 @@ export async function handleAgentEnd(pi, event, ctx) {
         clearDiscussionFlowState();
         return;
     }
+    // #4573 — When the LLM emits "Milestone X ready." but the required files
+    // are missing, `checkAutoStartAfterDiscuss` returns false silently. Surface
+    // that and nudge the LLM to complete the writes before the user hits the
+    // downstream "All milestones complete" warning loop.
+    if (maybeHandleReadyPhraseWithoutFiles(event))
+        return;
+    // #4573 — Empty-turn recovery: if the LLM announced intent in prose but
+    // emitted no tool calls, nudge it to execute. Fires only when auto-mode is
+    // active or a discussion autostart is pending (non-auto interactive discuss
+    // is user-driven). Runs before `isAutoActive` early return so pending
+    // discussions (where isAutoActive may be false) still get recovered.
+    if (maybeHandleEmptyIntentTurn(event, isAutoActive()))
+        return;
     if (!isAutoActive())
         return;
     if (isSessionSwitchInFlight())
@@ -106,6 +120,81 @@ export async function handleAgentEnd(pi, event, ctx) {
         const explicitRetryAfterMs = ("retryAfterMs" in lastMsg && typeof lastMsg.retryAfterMs === "number") ? lastMsg.retryAfterMs : undefined;
         // ── 1. Classify using rawErrorMsg to avoid prose false-positives ────
         const cls = classifyError(rawErrorMsg, explicitRetryAfterMs);
+        // ── 1a. Unsupported-model: provider rejected this model for the current
+        //        account/plan at request time (#4513).  Persist a block so the
+        //        same dead model isn't reselected on the next /gsd auto restart,
+        //        then try a fallback before pausing.
+        if (cls.kind === "unsupported-model") {
+            const dash = getAutoDashboardData();
+            const rejectedProvider = ctx.model?.provider;
+            const rejectedId = ctx.model?.id;
+            if (dash.basePath && rejectedProvider && rejectedId) {
+                try {
+                    blockModel(dash.basePath, rejectedProvider, rejectedId, rawErrorMsg || "unsupported for account");
+                    ctx.ui.notify(`Blocked ${rejectedProvider}/${rejectedId} for this project — provider rejected it for the current account.`, "warning");
+                }
+                catch (err) {
+                    const m = err instanceof Error ? err.message : String(err);
+                    logWarning("bootstrap", `Failed to persist blocked model: ${m}`);
+                }
+            }
+            // Try configured fallback chain, skipping anything already blocked.
+            if (dash.currentUnit && dash.basePath) {
+                const modelConfig = resolveModelWithFallbacksForUnit(dash.currentUnit.type);
+                if (modelConfig && modelConfig.fallbacks.length > 0) {
+                    const availableModels = ctx.modelRegistry.getAvailable();
+                    let cursorModelId = ctx.model?.id;
+                    while (true) {
+                        const nextModelId = getNextFallbackModel(cursorModelId, modelConfig);
+                        if (!nextModelId)
+                            break;
+                        const candidate = resolveModelId(nextModelId, availableModels, ctx.model?.provider);
+                        if (candidate && !isModelBlocked(dash.basePath, candidate.provider, candidate.id)) {
+                            const ok = await pi.setModel(candidate, { persist: false });
+                            if (ok) {
+                                setCurrentDispatchedModelId({ provider: candidate.provider, id: candidate.id });
+                                ctx.ui.notify(`Switched to fallback ${candidate.provider}/${candidate.id} after account entitlement rejection.`, "warning");
+                                pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
+                                return;
+                            }
+                        }
+                        cursorModelId = nextModelId;
+                    }
+                }
+                // Fallback chain exhausted — try the auto-mode start model if it isn't
+                // the same one we just blocked and isn't itself blocked.
+                const sessionModel = getAutoModeStartModel();
+                if (sessionModel &&
+                    !(sessionModel.provider === rejectedProvider && sessionModel.id === rejectedId) &&
+                    !isModelBlocked(dash.basePath, sessionModel.provider, sessionModel.id)) {
+                    const startModel = ctx.modelRegistry
+                        .getAvailable()
+                        .find((m) => m.provider === sessionModel.provider && m.id === sessionModel.id);
+                    if (startModel) {
+                        const ok = await pi.setModel(startModel, { persist: false });
+                        if (ok) {
+                            setCurrentDispatchedModelId({ provider: startModel.provider, id: startModel.id });
+                            ctx.ui.notify(`Restored auto-mode start model ${startModel.provider}/${startModel.id} after entitlement rejection.`, "warning");
+                            pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
+                            return;
+                        }
+                    }
+                }
+            }
+            // No usable fallback — pause with a clearly named message.
+            const blockedLabel = rejectedProvider && rejectedId ? `${rejectedProvider}/${rejectedId}` : "current model";
+            const pauseDetail = `Model ${blockedLabel} blocked for this account${errorDetail}. Configure a different model and restart /gsd auto.`;
+            await pauseAutoForProviderError(ctx.ui, pauseDetail, () => pauseAuto(ctx, pi, {
+                message: pauseDetail,
+                category: "provider",
+                isTransient: false,
+            }), {
+                isRateLimit: false,
+                isTransient: false,
+                retryAfterMs: 0,
+            });
+            return;
+        }
         // ── 1b. Defer to Core RetryHandler for most transient errors ────────
         // Core retries transient failures in-session after this handler.
         // Keep that behavior for non-rate-limit classes to avoid pause/retry races,
@@ -210,6 +299,9 @@ export async function handleAgentEnd(pi, event, ctx) {
     // ── Success path ─────────────────────────────────────────────────────────
     try {
         resetRetryState(retryState);
+        // #4573 — Reset the empty-turn counter on any successful agent turn so
+        // transient stalls don't accumulate across independent units.
+        resetEmptyTurnCounter();
         resolveAgentEnd(event);
     }
     catch (err) {

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -19,6 +19,18 @@ function registerAlias(pi, toolDef, aliasName, canonicalName) {
         promptGuidelines: [`Alias for ${canonicalName} — prefer the canonical name.`],
     });
 }
+/**
+ * Read a tool result's structured payload, accommodating MCP's `details` →
+ * `structuredContent` rename (#4472, #4477). In-process executions still
+ * deliver the payload on `result.details`; MCP-routed executions deliver it
+ * on `result.structuredContent` (post `adaptExecutorResult` transform). All
+ * `renderResult` callbacks in this file route through this helper so a future
+ * field rename only needs to be applied in one place.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- result shape varies by tool
+function readDetails(result) {
+    return result?.details ?? result?.structuredContent;
+}
 export function registerDbTools(pi) {
     // ─── gsd_decision_save (formerly gsd_save_decision) ─────────────────────
     const decisionSaveExecute = async (_toolCallId, params, _signal, _onUpdate, _ctx) => {
@@ -92,7 +104,7 @@ export function registerDbTools(pi) {
             return new Text(text, 0, 0);
         },
         renderResult(result, _options, theme) {
-            const d = result.details;
+            const d = readDetails(result);
             if (result.isError || d?.error) {
                 return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
             }
@@ -175,7 +187,7 @@ export function registerDbTools(pi) {
             return new Text(text, 0, 0);
         },
         renderResult(result, _options, theme) {
-            const d = result.details;
+            const d = readDetails(result);
             if (result.isError || d?.error) {
                 return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
             }
@@ -255,7 +267,7 @@ export function registerDbTools(pi) {
             return new Text(text, 0, 0);
         },
         renderResult(result, _options, theme) {
-            const d = result.details;
+            const d = readDetails(result);
             if (result.isError || d?.error) {
                 return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
             }
@@ -301,7 +313,7 @@ export function registerDbTools(pi) {
             return new Text(text, 0, 0);
         },
         renderResult(result, _options, theme) {
-            const d = result.details;
+            const d = readDetails(result);
             if (result.isError || d?.error) {
                 return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
             }
@@ -382,7 +394,7 @@ export function registerDbTools(pi) {
             return new Text(theme.fg("toolTitle", theme.bold("milestone_generate_id")), 0, 0);
         },
         renderResult(result, _options, theme) {
-            const d = result.details;
+            const d = readDetails(result);
             if (result.isError || d?.error) {
                 return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
             }
@@ -967,13 +979,31 @@ export function registerDbTools(pi) {
             text += theme.fg("dim", ` → ${args.verdict ?? ""}`);
             return new Text(text, 0, 0);
         },
+        /**
+         * Render the save_gate_result tool output for the TUI.
+         *
+         * Prefers structured fields, but falls back to `content[0].text` when the
+         * structured payload is empty. Defensive: the structural fix on this
+         * branch plumbs `details` through MCP via `structuredContent`, but older
+         * hosts, a future handler that forgets `structuredContent`, or any drop
+         * of non-standard return fields would otherwise render as
+         * "undefined: undefined". Same fallback applies to error rendering, and
+         * we strip a leading `Error:` from the fallback text to avoid producing
+         * `Error: Error: ...`.
+         */
         renderResult(result, _options, theme) {
-            const d = result.details;
+            const d = readDetails(result);
             if (result.isError || d?.error) {
-                return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
+                const rawMsg = d?.error ?? result.content?.[0]?.text ?? "unknown";
+                const msg = rawMsg.replace(/^\s*Error:\s*/i, "");
+                return new Text(theme.fg("error", `Error: ${msg}`), 0, 0);
+            }
+            if (!d?.gateId || !d?.verdict) {
+                const text = result.content?.[0]?.text ?? "Gate result saved";
+                return new Text(theme.fg("success", text), 0, 0);
             }
-            const color = d?.verdict === "flag" ? "warning" : "success";
-            return new Text(theme.fg(color, `${d?.gateId}: ${d?.verdict}`), 0, 0);
+            const color = d.verdict === "flag" ? "warning" : "success";
+            return new Text(theme.fg(color, `${d.gateId}: ${d.verdict}`), 0, 0);
         },
     };
     pi.registerTool(saveGateResultTool);