gsd-pi 2.77.0 → 2.78.0-dev.aeeb2ca00

package/src/resources/extensions/gsd/worktree-manager.ts

@@ -30,6 +30,7 @@ import {
   nativeDiffNameStatus,
   nativeDiffNumstat,
   nativeGetCurrentBranch,
+  nativeIsAncestor,
   nativeLogOneline,
   nativeMergeSquash,
   nativeWorktreeAdd,
@@ -37,6 +38,7 @@ import {
   nativeWorktreePrune,
   nativeWorktreeRemove,
 } from "./native-git-bridge.js";
+import { emitCanonicalRootRedirect } from "./worktree-telemetry.js";
 
 // ─── Types ─────────────────────────────────────────────────────────────────
 
@@ -132,6 +134,58 @@ export function isInsideWorktreesDir(basePath: string, targetPath: string): bool
   return resolved === wtDir || resolved.startsWith(wtDir + sep);
 }
 
+/**
+ * Return the canonical path from which a milestone's artifacts should be read.
+ *
+ * If a live git worktree exists for this milestone at `.gsd/worktrees/<MID>/`
+ * (directory present AND a `.git` file indicating a registered worktree),
+ * returns that worktree path. Otherwise returns `basePath` unchanged.
+ *
+ * Readers that cross the session/worktree boundary (validators, the bootstrap
+ * audit, cross-session state queries) should route through this helper so they
+ * don't silently read stale project-root state while live work sits in the
+ * worktree. Writers and tools whose contract is "operate on the path I was
+ * given" should NOT use this helper — they preserve the legacy behavior.
+ *
+ * A stale worktree directory (no `.git` file) is treated as absent. The
+ * createWorktree() path already cleans these up, but readers must not trust
+ * them in the window before cleanup runs.
+ *
+ * Fixes #4761. Used by the #4762 audit for the pre-completion orphan case.
+ */
+export function resolveCanonicalMilestoneRoot(
+  basePath: string,
+  milestoneId: string,
+): string {
+  if (!milestoneId || /[\/\\]|\.\./.test(milestoneId)) return basePath;
+
+  const wtPath = worktreePath(basePath, milestoneId);
+  if (!existsSync(wtPath)) return basePath;
+
+  // A registered git worktree has a .git *file* (not directory) containing
+  // "gitdir: <path>". A standalone .git directory indicates a copied repo
+  // or nested standalone repo — not a worktree registered with this project —
+  // and must not be treated as the canonical root.
+  const gitPath = join(wtPath, ".git");
+  if (!existsSync(gitPath)) return basePath;
+  try {
+    const stat = lstatSync(gitPath);
+    if (!stat.isFile()) return basePath;
+  } catch {
+    return basePath;
+  }
+
+  // #4764 — record the redirect so we can measure how often the #4761 fix
+  // would have mattered. Best-effort; emit is silent on any failure.
+  try {
+    emitCanonicalRootRedirect(basePath, milestoneId, wtPath);
+  } catch (err) {
+    logWarning("worktree", `canonical-root-redirect telemetry failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+
+  return wtPath;
+}
+
 // ─── Core Operations ───────────────────────────────────────────────────────
 
 /**
@@ -174,6 +228,17 @@ export function createWorktree(basePath: string, name: string, opts: { branch?:
   // otherwise fall back to the repo's detected main branch.
   const startPoint = opts.startPoint ?? nativeDetectMainBranch(basePath);
 
+  // Reject early if startPoint resolves to an empty/invalid ref. On an
+  // unborn branch (zero-commit repo) nativeDetectMainBranch returns "",
+  // which would flow into `git worktree add ... ""` and crash with
+  // `fatal: not a valid object name`. (Issue #4980 HIGH-9)
+  if (!startPoint || startPoint.length === 0) {
+    throw new GSDError(
+      GSD_GIT_ERROR,
+      "Repository has no commits yet (unborn branch). Make an initial commit before creating worktrees.",
+    );
+  }
+
   // Check if the branch already exists (leftover from a previous worktree)
   const branchAlreadyExists = nativeBranchExists(basePath, branch);
 
@@ -196,6 +261,21 @@ export function createWorktree(basePath: string, name: string, opts: { branch?:
       // from prior sessions that must not be reset.
       nativeWorktreeAdd(basePath, wtPath, branch);
     } else {
+      // Ancestry guard: refuse to force-reset a branch that has commits not
+      // reachable from startPoint. A crash-then-resume cycle that didn't
+      // write the resume file would silently orphan prior-session commits
+      // (recoverable from reflog for 90d, then gone — branch is also
+      // deleted at teardown). (Issue #4980 HIGH-3)
+      const branchIsAncestor = nativeIsAncestor(basePath, branch, startPoint);
+      if (!branchIsAncestor) {
+        throw new GSDError(
+          GSD_GIT_ERROR,
+          `Branch "${branch}" already exists with commits not reachable from "${startPoint}". ` +
+          `Refusing to force-reset — would orphan prior work. ` +
+          `If you intend to keep those commits, retry with reuseExistingBranch=true. ` +
+          `If you intend to discard, run \`git branch -D ${branch}\` manually first.`,
+        );
+      }
       // Reset the stale branch to the start point, then attach worktree to it
       nativeBranchForceReset(basePath, branch, startPoint);
       nativeWorktreeAdd(basePath, wtPath, branch);
@@ -451,17 +531,38 @@ export function removeWorktree(
         (line: string) => line.startsWith("+") || line.startsWith("-"),
       );
       if (hasSubmoduleChanges) {
-        // Stash submodule changes so they are not lost during force removal.
-        // The stash is created in the worktree before it's torn down.
+        // Save submodule changes to a labeled rescue branch instead of the
+        // shared stash list. Stash is per-repo (not per-worktree), so an
+        // entry created here would appear in the user's main-tree stash
+        // list and reference paths that disappear after worktree removal.
+        // A branch persists in the shared .git refs after worktree removal
+        // and is discoverable via `git branch --list 'gsd/submodule-rescue/*'`.
+        // (Issue #4980 HIGH-11)
+        const rescueBranch = `gsd/submodule-rescue/${name}-${Date.now()}`;
         try {
           execFileSync(
-            "git", ["stash", "push", "-m", "gsd: auto-stash submodule changes before worktree teardown"],
+            "git", ["add", "-A"],
+            { cwd: resolvedWtPath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
+          );
+          execFileSync(
+            "git", ["commit", "-m", `gsd: rescue submodule changes from worktree ${name}`, "--allow-empty"],
             { cwd: resolvedWtPath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
           );
-          logWarning("reconcile", `Stashed uncommitted submodule changes before worktree teardown`, { worktree: name, path: resolvedWtPath });
-        } catch {
-          // Stash failed — warn the user that submodule changes may be lost
-          logWarning("reconcile", `Submodule changes detected — stash failed, changes may be lost during force removal`, { worktree: name, path: resolvedWtPath });
+          execFileSync(
+            "git", ["branch", rescueBranch, "HEAD"],
+            { cwd: resolvedWtPath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
+          );
+          logWarning(
+            "reconcile",
+            `Saved uncommitted submodule changes to rescue branch ${rescueBranch}`,
+            { worktree: name, path: resolvedWtPath, rescueBranch },
+          );
+        } catch (err) {
+          logWarning(
+            "reconcile",
+            `Submodule rescue branch creation failed — changes may be lost during force removal: ${err instanceof Error ? err.message : String(err)}`,
+            { worktree: name, path: resolvedWtPath },
+          );
         }
       }
     } catch (e) {
@@ -559,6 +660,7 @@ const SKIP_PATHS = [
   ".gsd/worktrees/",
   ".gsd/runtime/",
   ".gsd/activity/",
+  ".gsd/audit/",
   ".gsd/forensics/",
   ".gsd/parallel/",
   ".gsd/journal/",

package/src/resources/extensions/gsd/worktree-resolver.ts

@@ -20,6 +20,9 @@ import type { AutoSession } from "./auto/session.js";
 import { debugLog } from "./debug-logger.js";
 import { MergeConflictError } from "./git-service.js";
 import { emitJournalEvent } from "./journal.js";
+import { emitWorktreeCreated, emitWorktreeMerged } from "./worktree-telemetry.js";
+import { getCollapseCadence, getMilestoneResquash, resquashMilestoneOnMain } from "./slice-cadence.js";
+import { loadEffectiveGSDPreferences } from "./preferences.js";
 
 // ─── Dependency Interface ──────────────────────────────────────────────────
 
@@ -290,6 +293,19 @@ export class WorktreeResolver {
         eventType: "worktree-enter",
         data: { milestoneId, wtPath, created: !existingPath },
       });
+      // #4764 — record creation/enter as a lifecycle event so the telemetry
+      // aggregator can pair it with the eventual worktree-merged event.
+      try {
+        emitWorktreeCreated(this.s.originalBasePath || this.s.basePath, milestoneId, {
+          reason: existingPath ? "enter-milestone" : "create-milestone",
+        });
+      } catch (telemetryErr) {
+        debugLog("WorktreeResolver", {
+          action: "enterMilestone",
+          phase: "telemetry-emit",
+          error: telemetryErr instanceof Error ? telemetryErr.message : String(telemetryErr),
+        });
+      }
       ctx.notify(`Entered worktree for ${milestoneId} at ${wtPath}`, "info");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -398,6 +414,10 @@ export class WorktreeResolver {
   mergeAndExit(milestoneId: string, ctx: NotifyCtx): void {
     this.validateMilestoneId(milestoneId);
 
+    // #4764 — telemetry: record start timestamp so we can emit merge duration.
+    const mergeStartedAt = new Date().toISOString();
+    const mergeStartMs = Date.now();
+
     // If worktree creation failed earlier, skip merge — work is on current branch (#2483)
     if (this.s.isolationDegraded) {
       debugLog("WorktreeResolver", {
@@ -444,17 +464,79 @@ export class WorktreeResolver {
       return;
     }
 
+    let actuallyMerged = false;
     if (
       mode === "worktree" || inWorktree
     ) {
-      this._mergeWorktreeMode(milestoneId, ctx);
+      actuallyMerged = this._mergeWorktreeMode(milestoneId, ctx);
     } else if (mode === "branch") {
-      this._mergeBranchMode(milestoneId, ctx);
+      actuallyMerged = this._mergeBranchMode(milestoneId, ctx);
+    }
+
+    // The remainder of this function emits telemetry and runs re-squash.
+    // Both are gated on actuallyMerged — if the _merge* helper took a
+    // no-merge path (missing originalBase, no roadmap, wrong branch) the
+    // milestone branch was intentionally left unmerged and we must not
+    // emit a worktree-merged event or collapse commits on main.
+    if (!actuallyMerged) {
+      // Always clear the start-SHA tracker to avoid leaking across sessions.
+      this.s.milestoneStartShas.delete(milestoneId);
+      return;
+    }
+
+    // #4765 — when collapse_cadence=slice AND milestone_resquash=true, the
+    // N per-slice commits on main should be collapsed into one milestone
+    // commit. Done AFTER the primary merge-and-teardown so the branch and
+    // worktree are already cleaned up; we operate on main directly.
+    try {
+      const startSha = this.s.milestoneStartShas.get(milestoneId);
+      if (startSha) {
+        const prefs = loadEffectiveGSDPreferences(this.s.originalBasePath || this.s.basePath)?.preferences;
+        if (getCollapseCadence(prefs) === "slice" && getMilestoneResquash(prefs)) {
+          const result = resquashMilestoneOnMain(
+            this.s.originalBasePath || this.s.basePath,
+            milestoneId,
+            startSha,
+          );
+          if (result.resquashed) {
+            ctx.notify(
+              `slice-cadence: re-squashed slice commits for ${milestoneId} into a single milestone commit.`,
+              "info",
+            );
+          }
+        }
+        this.s.milestoneStartShas.delete(milestoneId);
+      }
+    } catch (err) {
+      debugLog("WorktreeResolver", {
+        action: "mergeAndExit",
+        milestoneId,
+        phase: "resquash",
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+
+    // #4764 — record merge completion. Only reaches here when an actual
+    // merge ran; failure paths throw out of _merge* before this point and
+    // no-merge paths returned above.
+    try {
+      emitWorktreeMerged(this.s.originalBasePath || this.s.basePath, milestoneId, {
+        reason: "milestone-complete",
+        startedAt: mergeStartedAt,
+        durationMs: Date.now() - mergeStartMs,
+      });
+    } catch (telemetryErr) {
+      debugLog("WorktreeResolver", {
+        action: "mergeAndExit",
+        phase: "telemetry-emit",
+        error: telemetryErr instanceof Error ? telemetryErr.message : String(telemetryErr),
+      });
     }
   }
 
-  /** Worktree-mode merge: read roadmap, merge, teardown, reset paths. */
-  private _mergeWorktreeMode(milestoneId: string, ctx: NotifyCtx): void {
+  /** Worktree-mode merge: read roadmap, merge, teardown, reset paths.
+   *  Returns true when a squash-merge actually ran (false on skip paths). */
+  private _mergeWorktreeMode(milestoneId: string, ctx: NotifyCtx): boolean {
     const originalBase = this.s.originalBasePath;
     if (!originalBase) {
       debugLog("WorktreeResolver", {
@@ -464,9 +546,10 @@ export class WorktreeResolver {
         skipped: true,
         reason: "missing-original-base",
       });
-      return;
+      return false;
     }
 
+    let merged = false;
     try {
       const { synced } = this.deps.syncWorktreeStateBack(
         originalBase,
@@ -515,6 +598,7 @@ export class WorktreeResolver {
           milestoneId,
           roadmapContent,
         );
+        merged = true;
 
         // #2945 Bug 3: mergeMilestoneToMain performs best-effort worktree
         // cleanup internally (step 12), but it can silently fail on Windows
@@ -618,10 +702,12 @@ export class WorktreeResolver {
       result: "done",
       basePath: this.s.basePath,
     });
+    return merged;
   }
 
-  /** Branch-mode merge: check current branch, merge if on milestone branch. */
-  private _mergeBranchMode(milestoneId: string, ctx: NotifyCtx): void {
+  /** Branch-mode merge: check current branch, merge if on milestone branch.
+   *  Returns true when a merge actually ran (false on skip paths). */
+  private _mergeBranchMode(milestoneId: string, ctx: NotifyCtx): boolean {
     try {
       const currentBranch = this.deps.getCurrentBranch(this.s.basePath);
       const milestoneBranch = this.deps.autoWorktreeBranch(milestoneId);
@@ -636,7 +722,7 @@ export class WorktreeResolver {
           currentBranch,
           milestoneBranch,
         });
-        return;
+        return false;
       }
 
       const roadmapPath = this.deps.resolveMilestoneFile(
@@ -652,7 +738,7 @@ export class WorktreeResolver {
           skipped: true,
           reason: "no-roadmap",
         });
-        return;
+        return false;
       }
 
       const roadmapContent = this.deps.readFileSync(roadmapPath, "utf-8");
@@ -683,6 +769,7 @@ export class WorktreeResolver {
         mode: "branch",
         result: "success",
       });
+      return true;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       debugLog("WorktreeResolver", {

package/src/resources/extensions/gsd/worktree-telemetry.ts

@@ -0,0 +1,322 @@
+/**
+ * Worktree telemetry — #4764
+ *
+ * Thin emit helpers + aggregator on top of the existing journal. Separate
+ * module so callers import a tiny surface and don't have to assemble
+ * JournalEntry records by hand. Kernighan: the underlying emit path
+ * (emitJournalEvent) is already battle-tested; this module is just
+ * structured call sites + a summarizer.
+ *
+ * Emitted event types (see journal.ts):
+ *   - worktree-created           worktree entered/created for a milestone
+ *   - worktree-merged            worktree merge back to main completed
+ *   - worktree-orphaned          audit detected an orphaned branch/worktree
+ *   - auto-exit                  auto-mode exited (pause/stop/blocked/error)
+ *   - worktree-sync              syncStateToProjectRoot snapshot
+ *   - canonical-root-redirect    resolveCanonicalMilestoneRoot redirected
+ *
+ * These events are purely observational. They never block, never throw,
+ * and never carry code content — only IDs, counts, durations, and reasons.
+ */
+
+import { randomUUID } from "node:crypto";
+import { emitJournalEvent, queryJournal } from "./journal.js";
+import type { JournalEntry } from "./journal.js";
+
+function now(): string {
+  return new Date().toISOString();
+}
+
+function baseEntry(eventType: JournalEntry["eventType"], data: Record<string, unknown>): JournalEntry {
+  return {
+    ts: now(),
+    flowId: (typeof data.flowId === "string" ? data.flowId : undefined) ?? randomUUID(),
+    seq: typeof data.seq === "number" ? data.seq : 0,
+    eventType,
+    data,
+  };
+}
+
+// ─── Reason literal unions ───────────────────────────────────────────────
+// Closed sets so typos at call sites are rejected at compile time and can't
+// silently fragment the telemetry buckets produced by summarizeWorktreeTelemetry.
+
+export type WorktreeCreatedReason = "create-milestone" | "enter-milestone";
+export type AutoExitReason =
+  | "pause"
+  | "stop"
+  | "blocked"
+  | "merge-conflict"
+  | "merge-failed"
+  | "slice-merge-conflict"
+  | "all-complete"
+  | "no-active-milestone"
+  | "other";
+
+// ─── Emitters ────────────────────────────────────────────────────────────
+
+export function emitWorktreeCreated(
+  projectRoot: string,
+  milestoneId: string,
+  meta: { flowId?: string; reason?: WorktreeCreatedReason } = {},
+): void {
+  emitJournalEvent(projectRoot, baseEntry("worktree-created", {
+    milestoneId,
+    startedAt: now(),
+    flowId: meta.flowId,
+    reason: meta.reason ?? "enter-milestone",
+  }));
+}
+
+export function emitWorktreeMerged(
+  projectRoot: string,
+  milestoneId: string,
+  meta: {
+    flowId?: string;
+    reason?: "milestone-complete" | "all-complete" | "stop-fallback" | "transition" | "other";
+    startedAt?: string;
+    durationMs?: number;
+    sliceCount?: number;
+    taskCount?: number;
+    conflict?: boolean;
+    conflictedFiles?: number;
+  } = {},
+): void {
+  emitJournalEvent(projectRoot, baseEntry("worktree-merged", {
+    milestoneId,
+    endedAt: now(),
+    flowId: meta.flowId,
+    reason: meta.reason ?? "other",
+    startedAt: meta.startedAt,
+    durationMs: meta.durationMs,
+    sliceCount: meta.sliceCount,
+    taskCount: meta.taskCount,
+    conflict: meta.conflict ?? false,
+    conflictedFiles: meta.conflictedFiles ?? 0,
+  }));
+}
+
+export function emitWorktreeOrphaned(
+  projectRoot: string,
+  milestoneId: string,
+  meta: {
+    flowId?: string;
+    reason: "in-progress-unmerged" | "complete-unmerged" | "stale-branch";
+    commitsAhead?: number;
+    worktreeDirExists?: boolean;
+  },
+): void {
+  emitJournalEvent(projectRoot, baseEntry("worktree-orphaned", {
+    milestoneId,
+    flowId: meta.flowId,
+    reason: meta.reason,
+    commitsAhead: meta.commitsAhead,
+    worktreeDirExists: meta.worktreeDirExists ?? false,
+    detectedAt: now(),
+  }));
+}
+
+export function emitAutoExit(
+  projectRoot: string,
+  meta: {
+    flowId?: string;
+    /** Must come from the closed AutoExitReason set. Callers with free-form
+     *  reasons (e.g. stopAuto's `reason?: string` parameter) should map to
+     *  the closed set before emitting. */
+    reason: AutoExitReason;
+    milestoneId?: string;
+    milestoneMerged: boolean;
+  },
+): void {
+  emitJournalEvent(projectRoot, baseEntry("auto-exit", {
+    reason: meta.reason,
+    flowId: meta.flowId,
+    milestoneId: meta.milestoneId,
+    milestoneMerged: meta.milestoneMerged,
+    exitedAt: now(),
+  }));
+}
+
+export function emitWorktreeSync(
+  projectRoot: string,
+  milestoneId: string,
+  meta: {
+    flowId?: string;
+    filesCopied?: number;
+    bytesCopied?: number;
+    commitsAhead?: number;
+    worktreeAgeMs?: number;
+  },
+): void {
+  emitJournalEvent(projectRoot, baseEntry("worktree-sync", {
+    milestoneId,
+    flowId: meta.flowId,
+    filesCopied: meta.filesCopied,
+    bytesCopied: meta.bytesCopied,
+    commitsAhead: meta.commitsAhead,
+    worktreeAgeMs: meta.worktreeAgeMs,
+  }));
+}
+
+export function emitCanonicalRootRedirect(
+  projectRoot: string,
+  milestoneId: string,
+  redirectedTo: string,
+  meta: { flowId?: string } = {},
+): void {
+  emitJournalEvent(projectRoot, baseEntry("canonical-root-redirect", {
+    milestoneId,
+    redirectedTo,
+    flowId: meta.flowId,
+  }));
+}
+
+// #4765 — slice-cadence collapse events
+
+export function emitSliceMerged(
+  projectRoot: string,
+  milestoneId: string,
+  sliceId: string,
+  meta: { durationMs?: number; conflict?: boolean; commitSha?: string; flowId?: string } = {},
+): void {
+  emitJournalEvent(projectRoot, baseEntry("slice-merged", {
+    milestoneId,
+    sliceId,
+    mergedAt: now(),
+    durationMs: meta.durationMs,
+    conflict: meta.conflict ?? false,
+    commitSha: meta.commitSha,
+    flowId: meta.flowId,
+  }));
+}
+
+export function emitMilestoneResquash(
+  projectRoot: string,
+  milestoneId: string,
+  meta: { sliceCount: number; startSha?: string; endSha?: string; flowId?: string } = { sliceCount: 0 },
+): void {
+  emitJournalEvent(projectRoot, baseEntry("milestone-resquash", {
+    milestoneId,
+    sliceCount: meta.sliceCount,
+    startSha: meta.startSha,
+    endSha: meta.endSha,
+    resquashedAt: now(),
+    flowId: meta.flowId,
+  }));
+}
+
+// ─── Aggregator ──────────────────────────────────────────────────────────
+
+export interface WorktreeTelemetrySummary {
+  /** Count of worktrees created within the window */
+  worktreesCreated: number;
+  /** Count of worktrees merged within the window */
+  worktreesMerged: number;
+  /** Count of orphan detections within the window */
+  orphansDetected: number;
+  /** Breakdown by orphan reason */
+  orphansByReason: Record<string, number>;
+  /** Merge durations in milliseconds, sorted ascending */
+  mergeDurationsMs: number[];
+  /** Number of merges that hit a conflict */
+  mergeConflicts: number;
+  /** Auto-exit reasons and their counts */
+  exitsByReason: Record<string, number>;
+  /** Auto-exits where the milestone was NOT merged before exit — the #4761 producer metric */
+  exitsWithUnmergedWork: number;
+  /** Count of canonical-root-redirects (how often #4761 validation would have read stale state) */
+  canonicalRedirects: number;
+  /** #4765 — count of successful slice-level merges (slice-cadence feature) */
+  slicesMerged: number;
+  /** #4765 — count of slice-level merge conflicts */
+  sliceMergeConflicts: number;
+  /** #4765 — count of milestone-level re-squash operations */
+  milestoneResquashes: number;
+}
+
+/**
+ * Summarize worktree telemetry across the journal. Optional time window
+ * via filters.after / filters.before (ISO-8601).
+ */
+export function summarizeWorktreeTelemetry(
+  projectRoot: string,
+  filters?: { after?: string; before?: string },
+): WorktreeTelemetrySummary {
+  const entries = queryJournal(projectRoot, filters);
+
+  const summary: WorktreeTelemetrySummary = {
+    worktreesCreated: 0,
+    worktreesMerged: 0,
+    orphansDetected: 0,
+    orphansByReason: {},
+    mergeDurationsMs: [],
+    mergeConflicts: 0,
+    exitsByReason: {},
+    exitsWithUnmergedWork: 0,
+    canonicalRedirects: 0,
+    slicesMerged: 0,
+    sliceMergeConflicts: 0,
+    milestoneResquashes: 0,
+  };
+
+  for (const e of entries) {
+    const d = e.data ?? {};
+    switch (e.eventType) {
+      case "worktree-created":
+        summary.worktreesCreated++;
+        break;
+      case "worktree-merged":
+        summary.worktreesMerged++;
+        if (typeof d.durationMs === "number") summary.mergeDurationsMs.push(d.durationMs);
+        if (d.conflict === true) summary.mergeConflicts++;
+        break;
+      case "worktree-orphaned": {
+        summary.orphansDetected++;
+        const reason = typeof d.reason === "string" ? d.reason : "unknown";
+        summary.orphansByReason[reason] = (summary.orphansByReason[reason] ?? 0) + 1;
+        break;
+      }
+      case "auto-exit": {
+        const reason = typeof d.reason === "string" ? d.reason : "unknown";
+        summary.exitsByReason[reason] = (summary.exitsByReason[reason] ?? 0) + 1;
+        if (d.milestoneMerged === false) summary.exitsWithUnmergedWork++;
+        break;
+      }
+      case "canonical-root-redirect":
+        summary.canonicalRedirects++;
+        break;
+      case "slice-merged":
+        summary.slicesMerged++;
+        if (d.conflict === true) summary.sliceMergeConflicts++;
+        break;
+      case "milestone-resquash":
+        summary.milestoneResquashes++;
+        break;
+      default:
+        break;
+    }
+  }
+
+  summary.mergeDurationsMs.sort((a, b) => a - b);
+  return summary;
+}
+
+/**
+ * Return the p{quantile} of a sorted array using the nearest-rank method.
+ * Quantile in [0,1].
+ *
+ * Prior implementation used Math.floor(q*n), which overstates exact-rank
+ * quantiles by one sample (e.g. p95 of 20 values returned the max instead
+ * of the 19th value). The nearest-rank index is ceil(q*n) - 1, clamped to
+ * [0, n-1].
+ */
+export function percentile(sortedValues: number[], q: number): number | null {
+  if (sortedValues.length === 0) return null;
+  if (q <= 0) return sortedValues[0];
+  if (q >= 1) return sortedValues[sortedValues.length - 1];
+  const idx = Math.min(
+    sortedValues.length - 1,
+    Math.max(0, Math.ceil(q * sortedValues.length) - 1),
+  );
+  return sortedValues[idx];
+}

package/src/resources/extensions/mcp-client/auth.ts

@@ -37,7 +37,18 @@ export type McpHttpAuthConfig = McpHttpAuthHeaders & McpHttpOAuthConfig;
 function resolveEnvValue(value: string): string {
 	return value.replace(
 		/\$\{([^}]+)\}/g,
-		(_match, varName) => process.env[varName] ?? "",
+		(_match, varName) => {
+			const resolved = process.env[varName];
+			if (resolved === undefined || resolved === "") {
+				// eslint-disable-next-line no-console
+				console.warn(
+					`[mcp-client auth] Environment variable "${varName}" referenced in MCP server config is unset. ` +
+					`Requests will go out with a malformed header and the remote server will likely reject them with 401.`,
+				);
+				return "";
+			}
+			return resolved;
+		},
 	);
 }