gsd-pi 2.77.0-dev.58d3d4d6c → 2.77.0-dev.cfd69e714

package/src/resources/extensions/gsd/auto-model-selection.ts

@@ -19,6 +19,38 @@ import { logWarning } from "./workflow-logger.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { applyModelPolicyFilter } from "./uok/model-policy.js";
 import { isModelBlocked } from "./blocked-models.js";
+import { getRequiredWorkflowToolsForAutoUnit } from "./workflow-mcp.js";
+
+/**
+ * Thrown when the model-policy gate rejects every candidate model for a unit
+ * dispatch (#4959 / #4681 / #4850).  The auto-loop catches this specifically
+ * to classify the unit as `blocked` rather than counting it as a retryable
+ * iteration error — pre-send policy denial is a configuration problem, not a
+ * transient runtime failure, so retrying just burns the consecutive-error
+ * budget toward a hard stop.
+ */
+export class ModelPolicyDispatchBlockedError extends Error {
+  readonly unitType: string;
+  readonly unitId: string;
+  readonly reasons: ReadonlyArray<{ provider: string; modelId: string; reason: string }>;
+  constructor(
+    unitType: string,
+    unitId: string,
+    reasons: ReadonlyArray<{ provider: string; modelId: string; reason: string }>,
+  ) {
+    const summary = reasons.length === 0
+      ? "no candidate models"
+      : reasons
+          .slice(0, 4)
+          .map((r) => `${r.provider}/${r.modelId} (${r.reason})`)
+          .join("; ");
+    super(`Model policy denied dispatch for ${unitType}/${unitId} before prompt send. Rejected: ${summary}`);
+    this.name = "ModelPolicyDispatchBlockedError";
+    this.unitType = unitType;
+    this.unitId = unitId;
+    this.reasons = reasons;
+  }
+}
 
 export interface ModelSelectionResult {
   /** Routing metadata for metrics recording */
@@ -33,6 +65,51 @@ export interface PreferredModelConfig {
   source: "explicit" | "synthesized";
 }
 
+// Baseline active-tool set per-`pi` instance, captured the first time
+// `selectAndApplyModel` runs against that instance during an auto session
+// and re-applied before each subsequent dispatch.  WeakMap so that test
+// fakes / disposed sessions are garbage-collected normally.  See
+// #4959 / #4681 cross-unit poisoning notes at the call site below.
+//
+// LIFECYCLE: the baseline is tied to a single auto session, NOT to the
+// lifetime of the `pi` instance (which can outlive many auto runs and have
+// the user mutate tools between them).  `clearToolBaseline` MUST be called
+// at auto start AND auto stop so that a second `/gsd auto` run on the same
+// `pi` does not silently restore a stale snapshot from the prior run and
+// undo any tool changes the user made between sessions.
+const TOOL_BASELINE = new WeakMap<object, string[]>();
+
+/**
+ * Drop the captured tool baseline for `pi` so the next `selectAndApplyModel`
+ * call re-captures from the live active set.  Wired into `startAuto` and
+ * `stopAuto` in `auto.ts` to bound the baseline to a single auto session.
+ *
+ * Safe to call when no baseline is recorded (no-op).
+ */
+export function clearToolBaseline(pi: ExtensionAPI | object): void {
+  TOOL_BASELINE.delete(pi as unknown as object);
+}
+
+function restoreToolBaseline(pi: ExtensionAPI): void {
+  const key = pi as unknown as object;
+  const baseline = TOOL_BASELINE.get(key);
+  if (baseline === undefined) {
+    // First call: capture the canonical pre-dispatch tool set.  At auto-mode
+    // start the active set has not yet been narrowed for any provider.
+    // Guarded against test fakes that omit getActiveTools — record an empty
+    // baseline so subsequent calls don't keep re-probing.
+    const initial = typeof pi.getActiveTools === "function" ? pi.getActiveTools() : [];
+    TOOL_BASELINE.set(key, [...initial]);
+    return;
+  }
+  // Restore baseline before the next unit reads getActiveTools / applies
+  // post-selection adjustToolSet.  Older fakes that omit setActiveTools are
+  // tolerated — the test asserts call order on real fakes.
+  if (typeof pi.setActiveTools === "function") {
+    pi.setActiveTools([...baseline]);
+  }
+}
+
 function reapplyThinkingLevel(
   pi: ExtensionAPI,
   level: ReturnType<ExtensionAPI["getThinkingLevel"]> | null | undefined,
@@ -129,6 +206,29 @@ export async function selectAndApplyModel(
   let routing: { tier: string; modelDowngraded: boolean } | null = null;
   let appliedModel: Model<Api> | null = null;
 
+  // ── Restore active-tool baseline before policy evaluation (#4959, #4681, #4850) ──
+  // Per-unit narrowing at the bottom of this function (line ~417) calls
+  // `pi.setActiveTools(finalToolNames)` and monotonically narrows the active
+  // set across units.  Without restoration, a previously-dispatched unit on a
+  // narrow-API provider (e.g. openai-completions) leaves the active set
+  // missing tools that the next unit's selected model fully supports, but
+  // `pi.getActiveTools()` snapshot-as-hard-gate (the old behaviour) blocked
+  // dispatch with "tool policy denied" anyway.
+  //
+  // The baseline is captured once per `pi` instance via a WeakMap and
+  // re-applied here so each unit starts from a clean slate.  Soft adaptation
+  // (adjustToolSet at the bottom of this function) still trims for the
+  // selected model.
+  //
+  // Auto-mode only (#4965): `guided-flow.ts:dispatchWorkflow` also calls
+  // `selectAndApplyModel` with `isAutoMode=false`. Guided-flow has its own
+  // narrow/restore via discuss-tool-scoping (guided-flow.ts:587-622) and no
+  // baseline-clear hook of its own, so an unconditional restore here would
+  // resurrect an auto-era baseline on guided-flow dispatches — silently
+  // overwriting any tool changes made interactively between auto sessions.
+  // The baseline is structurally an auto-mode concept; gate it accordingly.
+  if (isAutoMode) restoreToolBaseline(pi);
+
   if (modelConfig) {
     const availableModels = ctx.modelRegistry.getAvailable();
     const modelPolicyTraceId = `model:${ctx.sessionManager.getSessionId()}:${Date.now()}`;
@@ -160,7 +260,16 @@ export async function selectAndApplyModel(
       ? extractTaskMetadata(unitId, basePath)
       : undefined;
 
+    let policyDenyReasons: Array<{ provider: string; modelId: string; reason: string }> = [];
     if (uokFlags.modelPolicy) {
+      // Use the workflow-spec required-tool subset for the unit type rather
+      // than the live `pi.getActiveTools()` snapshot (#4959).  The active set
+      // is poisoned by per-unit narrowing for narrow-API providers — using it
+      // as a hard gate promotes soft adaptation (adjustToolSet at line ~417)
+      // into a layering violation that throws before dispatch.  The smaller
+      // workflow-required subset reflects what the unit actually needs; soft
+      // adaptation post-selection still trims provider-incompatible tools.
+      const requiredTools = getRequiredWorkflowToolsForAutoUnit(unitType);
       const policy = applyModelPolicyFilter(
         availableModels,
         {
@@ -171,15 +280,18 @@ export async function selectAndApplyModel(
           taskMetadata: taskMetadataForPolicy,
           currentProvider: ctx.model?.provider,
           allowCrossProvider: routingConfig.cross_provider !== false,
-          requiredTools: pi.getActiveTools(),
+          requiredTools,
         },
       );
       routingEligibleModels = policy.eligible;
       policyAllowedModelKeys = new Set(
         policy.eligible.map((m) => `${m.provider.toLowerCase()}/${m.id.toLowerCase()}`),
       );
+      policyDenyReasons = policy.decisions
+        .filter((d) => !d.allowed)
+        .map((d) => ({ provider: d.provider, modelId: d.modelId, reason: d.reason }));
       if (routingEligibleModels.length === 0) {
-        throw new Error(`Model policy denied all candidate models for ${unitType}/${unitId}`);
+        throw new ModelPolicyDispatchBlockedError(unitType, unitId, policyDenyReasons);
       }
     }
 
@@ -235,7 +347,11 @@ export async function selectAndApplyModel(
         );
         const availableModelIds = routingEligibleModels.map(m => `${m.provider}/${m.id}`);
 
-        // Escalate tier on retry when escalate_on_failure is enabled (default: true)
+        // Escalate tier on retry when escalate_on_failure is enabled (default: true).
+        // #4973: Deterministic policy errors are short-circuited at the postUnit
+        // level (auto-post-unit.ts writes a placeholder and returns "continue"),
+        // so this code path only runs for legitimate model-quality retries where
+        // tier escalation is the right response.
         if (
           retryContext?.isRetry &&
           retryContext.previousTier &&
@@ -249,6 +365,17 @@ export async function selectAndApplyModel(
               `Tier escalation: ${retryContext.previousTier} → ${escalated} (retry after failure)`,
               "info",
             );
+          } else {
+            // #4973: Already at max tier — keep previousTier rather than letting
+            // fresh classification silently downgrade the model back to a lower tier.
+            // Without this, a light-start unit on retry 3 would revert to the light
+            // model after escalating to heavy on retries 1 and 2.
+            const tierOrder: Record<string, number> = { light: 0, standard: 1, heavy: 2 };
+            const prevOrder = tierOrder[retryContext.previousTier] ?? 0;
+            const freshOrder = tierOrder[classification.tier] ?? 0;
+            if (prevOrder > freshOrder) {
+              classification = { ...classification, tier: retryContext.previousTier as ComplexityTier, reason: "retained escalated tier from retry" };
+            }
           }
         }
 
@@ -443,7 +570,7 @@ export async function selectAndApplyModel(
     }
 
     if (uokFlags.modelPolicy && policyAllowedModelKeys && !attemptedPolicyEligible) {
-      throw new Error(`Model policy denied dispatch for ${unitType}/${unitId} before prompt send`);
+      throw new ModelPolicyDispatchBlockedError(unitType, unitId, policyDenyReasons);
     }
   } else if (autoModeStartModel) {
     // No model preference for this unit type — re-apply the model captured

package/src/resources/extensions/gsd/auto-post-unit.ts

@@ -65,16 +65,28 @@ import { resolveExpectedArtifactPath as resolveArtifactForContent } from "./auto
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { getSliceTasks } from "./gsd-db.js";
 import { runPreExecutionChecks, type PreExecutionResult } from "./pre-execution-checks.js";
-import { writePreExecutionEvidence } from "./verification-evidence.js";
+import { writePreExecutionEvidence, type PreExecutionCheckJSON } from "./verification-evidence.js";
 import { ensureCodebaseMapFresh } from "./codebase-generator.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { UokGateRunner } from "./uok/gate-runner.js";
 import { writeTurnGitTransaction } from "./uok/gitops.js";
 import { isClosedStatus } from "./status-guards.js";
 import { detectAbandonMilestone } from "./abandon-detect.js";
+import { isDeterministicPolicyError } from "./auto-tool-tracking.js";
 
 /** Maximum verification retry attempts before escalating to blocker placeholder (#2653). */
 const MAX_VERIFICATION_RETRIES = 3;
+/** Keep failure toasts short while still showing concrete examples. */
+const MAX_NOTIFICATION_DETAILS = 3;
+const NOTIFICATION_BULLET = "•";
+
+function formatPreExecutionCheckDetail(check: PreExecutionCheckJSON): string {
+  const category = check.category?.trim() || "unknown category";
+  const target = check.target?.trim() || "unknown target";
+  const message = check.message.split(/\r?\n/, 1)[0]?.trim() || "No details provided";
+  return `  ${NOTIFICATION_BULLET} [${category}] ${target}: ${message}`;
+}
+
 const COMPLETE_MILESTONE_DB_SETTLE_MS = 1500;
 const COMPLETE_MILESTONE_DB_SETTLE_POLL_MS = 100;
 
@@ -125,7 +137,7 @@ import {
   describeNextUnit,
 } from "./auto-dashboard.js";
 import { existsSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
+import { join, relative } from "node:path";
 import { _resetHasChangesCache } from "./native-git-bridge.js";
 import { autoCommitCurrentBranch } from "./worktree.js";
 
@@ -253,6 +265,14 @@ export function detectRogueFileWrites(
   return rogues;
 }
 
+/**
+ * Maximum number of times to retry a unit whose expected artifact is missing
+ * after execution. Matches the bounded pattern used by runPostUnitVerification
+ * in auto-verification.ts. Exceeding this limit pauses auto-mode instead of
+ * looping indefinitely (#2007).
+ */
+const MAX_ARTIFACT_VERIFICATION_RETRIES = 3;
+
 export const STEP_COMPLETE_FALLBACK_MESSAGE =
   "Step complete. Run /clear, then /gsd to continue (or /gsd auto to run continuously).";
 
@@ -905,16 +925,35 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
       // When artifact verification fails for a unit type that has a known expected
       // artifact, return "retry" so the caller re-dispatches with failure context
       // instead of blindly re-dispatching the same unit (#1571).
-      // After MAX_VERIFICATION_RETRIES, escalate to writeBlockerPlaceholder so the
-      // pipeline can advance instead of looping forever (#2653).
+      // Retries are capped at MAX_ARTIFACT_VERIFICATION_RETRIES to prevent
+      // unbounded loops (#2007).
+      //
+      // Pre-checks short-circuit retry for known-unrecoverable failures:
+      // - Deterministic policy rejection (#4973): structural write-gate failure
+      //   that will recur on every retry, so write a blocker placeholder.
+      // - DB infra failure (#2517): completion tool returned db_unavailable, so
+      //   the artifact was never written. Retrying can never succeed.
+      // - Tool invocation error (#2883/#3595): malformed JSON args or queued
+      //   user message — retry will produce the same failure.
       //
-      // HOWEVER, if the DB is unavailable (db_unavailable), the artifact was never
-      // written because the completion tool failed at the infra level. Retrying
-      // can never succeed and produces a costly re-dispatch loop (#2517).
-      if (!triggerArtifactVerified && !isDbAvailable()) {
-        // DB infra failure — do NOT retry; the completion tool returned
-        // db_unavailable so the artifact was never written. Retrying would
-        // produce an infinite re-dispatch loop (#2517).
+      // #4973: Deterministic policy rejections (e.g. context_write_blocked from the
+      // write-gate) are checked FIRST — before the DB-availability check — because
+      // they are structural gates that will fire on every retry regardless of DB or
+      // model tier. Short-circuit immediately by writing a blocker placeholder.
+      if (!triggerArtifactVerified && s.lastToolInvocationError && isDeterministicPolicyError(s.lastToolInvocationError)) {
+        const retryKey = `${s.currentUnit.type}:${s.currentUnit.id}`;
+        debugLog("postUnit", { phase: "deterministic-policy-error-placeholder", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError });
+        const reason = `Deterministic policy rejection for ${s.currentUnit.type} "${s.currentUnit.id}": ${s.lastToolInvocationError}. Retrying cannot resolve this gate — writing blocker placeholder to advance pipeline.`;
+        s.lastToolInvocationError = null;
+        s.pendingVerificationRetry = null;
+        s.verificationRetryCount.delete(retryKey);
+        writeBlockerPlaceholder(s.currentUnit.type, s.currentUnit.id, s.basePath, reason);
+        ctx.ui.notify(
+          `${s.currentUnit.type} ${s.currentUnit.id} — deterministic policy rejection, wrote blocker placeholder (no retries) (#4973)`,
+          "warning",
+        );
+        // Fall through to "continue" — do NOT enter the retry or db-unavailable paths.
+      } else if (!triggerArtifactVerified && !isDbAvailable()) {
         debugLog("postUnit", { phase: "artifact-verify-skip-db-unavailable", unitType: s.currentUnit.type, unitId: s.currentUnit.id });
         const dbSkipDiag = diagnoseExpectedArtifact(s.currentUnit.type, s.currentUnit.id, s.basePath);
         ctx.ui.notify(
@@ -922,9 +961,6 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
           "error",
         );
       } else if (!triggerArtifactVerified) {
-        // #2883/#3595: If the artifact is missing because the tool invocation
-        // failed (malformed JSON) or was skipped (queued user message), retrying
-        // will produce the same failure. Pause auto-mode instead of looping.
         if (s.lastToolInvocationError) {
           const isUserSkip = /queued user message/i.test(s.lastToolInvocationError);
           const errMsg = isUserSkip
@@ -941,68 +977,36 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
         if (hasExpectedArtifact) {
           const retryKey = `${s.currentUnit.type}:${s.currentUnit.id}`;
           const attempt = (s.verificationRetryCount.get(retryKey) ?? 0) + 1;
-          s.verificationRetryCount.set(retryKey, attempt);
-
-          if (attempt > MAX_VERIFICATION_RETRIES) {
-            // #4175: For complete-milestone, a blocker placeholder is harmful —
-            // the stub SUMMARY has no recovery value (milestone is terminal),
-            // it does not update DB status (so deriveState never advances),
-            // and it fools stopAuto's presence check into merging a milestone
-            // that was never legitimately completed. Pause auto-mode with a
-            // clear single failure signal and preserve the worktree branch.
-            if (s.currentUnit.type === "complete-milestone") {
-              debugLog("postUnit", {
-                phase: "artifact-verify-pause-complete-milestone",
-                unitType: s.currentUnit.type,
-                unitId: s.currentUnit.id,
-                attempt,
-                maxRetries: MAX_VERIFICATION_RETRIES,
-              });
-              s.verificationRetryCount.delete(retryKey);
-              s.pendingVerificationRetry = null;
-              ctx.ui.notify(
-                `Milestone ${s.currentUnit.id} verification failed after ${MAX_VERIFICATION_RETRIES} retries — worktree branch preserved. Re-run /gsd auto once blockers are resolved.`,
-                "error",
-              );
-              await pauseAuto(ctx, pi);
-              return "dispatched";
-            }
-
-            // Retries exhausted — write a blocker placeholder so the pipeline
-            // can advance past this stuck unit (#2653).
-            debugLog("postUnit", {
-              phase: "artifact-verify-escalate",
-              unitType: s.currentUnit.type,
-              unitId: s.currentUnit.id,
-              attempt,
-              maxRetries: MAX_VERIFICATION_RETRIES,
-            });
-            const reason = `Artifact verification failed after ${MAX_VERIFICATION_RETRIES} retries for ${s.currentUnit.type} "${s.currentUnit.id}".`;
-            writeBlockerPlaceholder(s.currentUnit.type, s.currentUnit.id, s.basePath, reason);
-            ctx.ui.notify(
-              `${s.currentUnit.type} ${s.currentUnit.id} — verification retries exhausted (${MAX_VERIFICATION_RETRIES}), wrote blocker placeholder to advance pipeline`,
-              "warning",
-            );
-            // Reset retry count and fall through to "continue" so the loop
-            // re-derives state with the placeholder in place.
+          if (attempt > MAX_ARTIFACT_VERIFICATION_RETRIES) {
             s.verificationRetryCount.delete(retryKey);
-            s.pendingVerificationRetry = null;
-            // Do NOT return "retry" — fall through to "continue" below.
-          } else {
-            s.pendingVerificationRetry = {
-              unitId: s.currentUnit.id,
-              failureContext: `Artifact verification failed: expected artifact for ${s.currentUnit.type} "${s.currentUnit.id}" was not found on disk after unit execution (attempt ${attempt}).`,
-              attempt,
-            };
-            debugLog("postUnit", { phase: "artifact-verify-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
+            debugLog("postUnit", { phase: "artifact-verify-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
             ctx.ui.notify(
-              `Artifact missing for ${s.currentUnit.type} ${s.currentUnit.id} — retrying (attempt ${attempt})`,
-              "warning",
+              `Artifact still missing for ${s.currentUnit.type} ${s.currentUnit.id} after ${MAX_ARTIFACT_VERIFICATION_RETRIES} retries — pausing auto-mode`,
+              "error",
             );
-            return "retry";
+            await pauseAuto(ctx, pi);
+            return "dispatched";
           }
+          s.verificationRetryCount.set(retryKey, attempt);
+          s.pendingVerificationRetry = {
+            unitId: s.currentUnit.id,
+            failureContext: `Artifact verification failed: expected artifact for ${s.currentUnit.type} "${s.currentUnit.id}" was not found on disk after unit execution (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES}).`,
+            attempt,
+          };
+          debugLog("postUnit", { phase: "artifact-verify-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
+          ctx.ui.notify(
+            `Artifact missing for ${s.currentUnit.type} ${s.currentUnit.id} — retrying (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES})`,
+            "warning",
+          );
+          return "retry";
         }
       }
+
+      // Verification succeeded — clear the retry counter so a future failure
+      // of the same unit gets a full retry budget instead of the stale count.
+      if (triggerArtifactVerified) {
+        s.verificationRetryCount.delete(`${s.currentUnit.type}:${s.currentUnit.id}`);
+      }
     } else {
       // Hook unit completed — no additional processing needed
     }
@@ -1242,8 +1246,11 @@ export async function postUnitPostVerification(pctx: PostUnitContext): Promise<"
 
         // Write evidence JSON to slice artifacts directory
         const slicePath = resolveSlicePath(s.basePath, mid, sid);
+        const evidenceFileName = `${sid}-PRE-EXEC-VERIFY.json`;
+        let evidencePath = join(".gsd", "milestones", mid, "slices", sid, evidenceFileName);
         if (slicePath) {
           writePreExecutionEvidence(result, slicePath, mid, sid);
+          evidencePath = relative(s.basePath, join(slicePath, evidenceFileName)) || evidenceFileName;
         }
 
         if (uokFlags.gates) {
@@ -1280,9 +1287,11 @@ export async function postUnitPostVerification(pctx: PostUnitContext): Promise<"
         if (result.status === "fail") {
           const blockingChecks = result.checks.filter(c => !c.passed && c.blocking);
           const blockingCount = blockingChecks.length;
-          const details = blockingChecks.slice(0, 3).map(c => `  \u2022 ${c.message}`).join("\n");
-          const suffix = blockingChecks.length > 3 ? `\n  \u2022 ...and ${blockingChecks.length - 3} more` : "";
-          const evidenceNote = `\nSee ${sid}-PRE-EXEC-VERIFY.json for full details.`;
+          const details = blockingChecks.slice(0, MAX_NOTIFICATION_DETAILS).map(formatPreExecutionCheckDetail).join("\n");
+          const suffix = blockingChecks.length > MAX_NOTIFICATION_DETAILS
+            ? `\n  ${NOTIFICATION_BULLET} ...and ${blockingChecks.length - MAX_NOTIFICATION_DETAILS} more`
+            : "";
+          const evidenceNote = `\nSee ${evidencePath} for full details.`;
           ctx.ui.notify(
             `Pre-execution checks failed: ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} found\n${details}${suffix}${evidenceNote}`,
             "error",