gsd-pi 2.77.0 → 2.78.0-dev.aeeb2ca00

package/dist/resources/extensions/gsd/guided-flow.js

@@ -10,7 +10,7 @@ import { loadFile, saveFile } from "./files.js";
 import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
 import { parseRoadmapSlices } from "./roadmap-slices.js";
 import { loadPrompt, inlineTemplate } from "./prompt-loader.js";
-import { buildSkillActivationBlock } from "./auto-prompts.js";
+import { buildDiscussMilestonePrompt, buildSkillActivationBlock } from "./auto-prompts.js";
 import { deriveState } from "./state.js";
 import { invalidateAllCaches } from "./cache.js";
 import { startAutoDetached } from "./auto.js";
@@ -27,8 +27,8 @@ import { isInheritedRepo } from "./repo-identity.js";
 import { ensureGitignore, ensurePreferences, untrackRuntimeFiles } from "./gitignore.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { resolveUokFlags } from "./uok/flags.js";
-import { ensurePlanV2Graph } from "./uok/plan-v2.js";
-import { detectProjectState } from "./detection.js";
+import { ensurePlanV2Graph, isMissingFinalizedContextResult } from "./uok/plan-v2.js";
+import { detectProjectState, hasGsdBootstrapArtifacts } from "./detection.js";
 import { showProjectInit, offerMigration } from "./init-wizard.js";
 import { validateDirectory } from "./validate-directory.js";
 import { showConfirm } from "../shared/tui.js";
@@ -65,14 +65,17 @@ function runPlanV2Gate(ctx, basePath, state) {
     const prefs = loadEffectiveGSDPreferences()?.preferences;
     const uokFlags = resolveUokFlags(prefs);
     if (!uokFlags.planV2 || !needsPlanV2Gate(state))
-        return true;
+        return "pass";
     const compiled = ensurePlanV2Graph(basePath, state);
     if (!compiled.ok) {
+        if (isMissingFinalizedContextResult(compiled)) {
+            return "recover-missing-context";
+        }
         const reason = compiled.reason ?? "plan-v2 compilation failed";
         ctx.ui.notify(`Plan gate failed-closed: ${reason}. Complete plan/discuss artifacts before execution.\n\nIf this keeps happening, try: /gsd doctor heal`, "error");
-        return false;
+        return "block";
     }
-    return true;
+    return "pass";
 }
 // ─── Commit Instruction Helpers ──────────────────────────────────────────────
 /** Build commit instruction for planning prompts. .gsd/ is managed externally and always gitignored. */
@@ -255,6 +258,18 @@ function extractAssistantText(msg) {
 }
 /**
  * Return true if the assistant message contains any tool-use block.
+ *
+ * The canonical pi-ai `AssistantMessage.content` (see packages/pi-ai/src/types.ts)
+ * uses `type: "toolCall"` and `type: "serverToolUse"` for tool invocations —
+ * every provider (anthropic-direct, claude-code-cli, openai, etc.) normalizes
+ * incoming tool blocks into these two shapes before they reach guided-flow.
+ *
+ * The Anthropic API wire shape `"tool_use"` / `"server_tool_use"` does NOT appear
+ * in the internal AssistantMessage — those literals are only used when sending
+ * messages back out to the Anthropic API. Matching them here was a latent bug:
+ * `hasToolUse` returned `false` for every real tool call, which let the
+ * empty-turn nudge fire and pre-empt MCP tools that block on the user
+ * (e.g. `ask_user_questions`). See investigation in PR for #4658.
  */
 function hasToolUse(msg) {
     if (!msg)
@@ -262,7 +277,9 @@ function hasToolUse(msg) {
     const content = msg.content;
     if (!Array.isArray(content))
         return false;
-    return content.some((b) => b && typeof b === "object" && (b.type === "tool_use" || b.type === "tool-use"));
+    return content.some((b) => b &&
+        typeof b === "object" &&
+        (b.type === "toolCall" || b.type === "serverToolUse"));
 }
 /**
  * #4573 — Detect and recover from the "ready phrase without files" failure mode.
@@ -669,8 +686,13 @@ export async function showHeadlessMilestoneCreation(ctx, pi, basePath, seedConte
     const prompt = buildHeadlessDiscussPrompt(nextId, seedContext, basePath);
     // Set pending auto start (auto-mode triggers on "Milestone X ready." via checkAutoStartAfterDiscuss)
     pendingAutoStartMap.set(basePath, { ctx, pi, basePath, milestoneId: nextId, createdAt: Date.now() });
-    // Dispatch — headless milestone creation is a planning activity
-    await dispatchWorkflow(pi, prompt, "gsd-run", ctx, "plan-milestone");
+    // Dispatch as discuss-milestone. The LLM writes PROJECT.md, REQUIREMENTS.md,
+    // and CONTEXT.md, then calls gsd_plan_milestone — this is semantically the
+    // discuss path, just non-interactive. Using "plan-milestone" here caused
+    // model/tool routing to skip discuss-flow tool scoping and
+    // `checkAutoStartAfterDiscuss` guardrails that rely on the
+    // "discuss-"-prefixed unitType.
+    await dispatchWorkflow(pi, prompt, "gsd-run", ctx, "discuss-milestone");
 }
 // ─── Discuss Flow ─────────────────────────────────────────────────────────────
 /**
@@ -1236,9 +1258,7 @@ export async function showSmartEntry(ctx, pi, basePath, options) {
     // A zombie .gsd/ state (symlink exists but missing PREFERENCES.md and
     // milestones/) must trigger the init wizard, not skip it (#2942).
     const gsdPath = gsdRoot(basePath);
-    const hasBootstrapArtifacts = existsSync(gsdPath)
-        && (existsSync(join(gsdPath, "PREFERENCES.md"))
-            || existsSync(join(gsdPath, "milestones")));
+    const hasBootstrapArtifacts = hasGsdBootstrapArtifacts(gsdPath);
     if (!hasBootstrapArtifacts) {
         const detection = detectProjectState(basePath);
         // v1 .planning/ detected — offer migration before anything else
@@ -1322,7 +1342,8 @@ export async function showSmartEntry(ctx, pi, basePath, options) {
     catch (err) {
         logWarning("guided", `STATE.md rebuild failed: ${err.message}`);
     }
-    if (!runPlanV2Gate(ctx, basePath, state))
+    const planV2GateDecision = runPlanV2Gate(ctx, basePath, state);
+    if (planV2GateDecision === "block")
         return;
     if (!state.activeMilestone?.id) {
         // Guard: if a discuss session is already in flight, don't re-inject the prompt.
@@ -1397,6 +1418,11 @@ export async function showSmartEntry(ctx, pi, basePath, options) {
     }
     const milestoneId = state.activeMilestone.id;
     const milestoneTitle = state.activeMilestone.title;
+    if (planV2GateDecision === "recover-missing-context") {
+        pendingAutoStartMap.set(basePath, { ctx, pi, basePath, milestoneId, step: stepMode, createdAt: Date.now() });
+        await dispatchWorkflow(pi, await buildDiscussMilestonePrompt(milestoneId, milestoneTitle, basePath, getStructuredQuestionsAvailability(pi, ctx)), "gsd-discuss", ctx, "discuss-milestone");
+        return;
+    }
     // ── All milestones complete → New milestone ──────────────────────────
     if (state.phase === "complete") {
         const choice = await showNextAction(ctx, {

package/dist/resources/extensions/gsd/journal.js

@@ -11,8 +11,10 @@
  * - queryJournal() enables programmatic filtering by flowId, eventType, unitId, time range
  * - Silent failure: journal writes never throw — absence of events is the failure signal
  */
-import { appendFileSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, } from "node:fs";
 import { join } from "node:path";
+import { isStaleWrite } from "./auto/turn-epoch.js";
+import { withFileLockSync } from "./file-lock.js";
 import { gsdRoot } from "./paths.js";
 import { buildAuditEnvelope, emitUokAuditEvent } from "./uok/audit.js";
 import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
@@ -26,12 +28,25 @@ import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
  * Never throws — all errors are silently caught.
  */
 export function emitJournalEvent(basePath, entry) {
+    // Drop writes from a turn superseded by timeout recovery / cancellation.
+    // See auto/turn-epoch.ts for the full rationale.
+    if (isStaleWrite("journal"))
+        return;
     try {
         const journalDir = join(gsdRoot(basePath), "journal");
         mkdirSync(journalDir, { recursive: true });
         const dateStr = entry.ts.slice(0, 10);
         const filePath = join(journalDir, `${dateStr}.jsonl`);
-        appendFileSync(filePath, JSON.stringify(entry) + "\n");
+        // Ensure file exists so proper-lockfile can acquire a lock against it.
+        if (!existsSync(filePath))
+            closeSync(openSync(filePath, "a"));
+        // onLocked: "skip" — journal writes are best-effort. POSIX O_APPEND
+        // atomicity still protects small entries; the lock mainly serializes
+        // larger writes and gives cross-process exclusivity on platforms where
+        // O_APPEND semantics are weaker (Windows).
+        withFileLockSync(filePath, () => {
+            appendFileSync(filePath, JSON.stringify(entry) + "\n");
+        }, { onLocked: "skip" });
     }
     catch {
         // Silent failure — journal must never break auto-mode

package/dist/resources/extensions/gsd/memory-extractor.js

@@ -62,7 +62,9 @@ export function buildMemoryLLMCall(ctx) {
         // which returns undefined for OAuth users (Claude Max / Claude Pro).
         // See: https://github.com/gsd-build/gsd-2/issues/2959
         const resolvedKeyPromise = ctx.modelRegistry.getApiKey(selectedModel).catch(() => undefined);
-        return async (system, user) => {
+        // Expose on the returned fn so tests can await resolution deterministically
+        // (avoids arbitrary setTimeout polling for an internal microtask).
+        const llmCall = async (system, user) => {
             const { completeSimple } = await import('@gsd/pi-ai');
             const resolvedApiKey = await resolvedKeyPromise;
             const result = await completeSimple(selectedModel, {
@@ -79,6 +81,10 @@ export function buildMemoryLLMCall(ctx) {
                 .map(c => c.text);
             return textParts.join('');
         };
+        // Attach the in-flight API-key resolution so tests (and callers) can
+        // `await llmCall.apiKeyReady` rather than relying on setTimeout polling.
+        llmCall.apiKeyReady = resolvedKeyPromise;
+        return llmCall;
     }
     catch {
         return null;

package/dist/resources/extensions/gsd/milestone-actions.js

@@ -18,6 +18,18 @@ import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
 import { deleteMilestone, getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
 import { removeWorktree } from "./worktree-manager.js";
 import { logWarning } from "./workflow-logger.js";
+import { isAutoActive } from "./auto.js";
+/**
+ * Writer-side assert for mutations that race with auto-mode's squash merge (#4704).
+ * Auto-mode is confirmed not to call parkMilestone/discardMilestone/unparkMilestone
+ * internally — these throws only surface invariant violations from new or forgotten
+ * call sites, which is the correct failure mode to catch loudly.
+ */
+function assertNotAutoActive(action) {
+    if (isAutoActive()) {
+        throw new Error(`${action} cannot run while auto-mode is active. Stop auto-mode first with /gsd stop.`);
+    }
+}
 // ─── Park ──────────────────────────────────────────────────────────────────
 /**
  * Park a milestone — creates a PARKED.md marker file with reason and timestamp.
@@ -25,6 +37,7 @@ import { logWarning } from "./workflow-logger.js";
  * Returns true if successfully parked, false if milestone not found or already parked.
  */
 export function parkMilestone(basePath, milestoneId, reason) {
+    assertNotAutoActive("park milestone");
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;
@@ -65,6 +78,7 @@ export function parkMilestone(basePath, milestoneId, reason) {
  * Returns true if successfully unparked, false if milestone not found or not parked.
  */
 export function unparkMilestone(basePath, milestoneId) {
+    assertNotAutoActive("unpark milestone");
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;
@@ -97,6 +111,7 @@ export function unparkMilestone(basePath, milestoneId) {
  * Returns true if successfully discarded, false if milestone not found.
  */
 export function discardMilestone(basePath, milestoneId) {
+    assertNotAutoActive("discard milestone");
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;

package/dist/resources/extensions/gsd/milestone-scope-classifier.js

@@ -0,0 +1,299 @@
+// GSD-2 — Milestone scope classifier (#4781 / ADR-003 companion).
+//
+// Pure heuristics over milestone planning fields. Produces a PipelineVariant
+// that downstream dispatch logic can use to shape the auto-mode sequence.
+// No LLM calls, no file I/O, sub-millisecond.
+//
+// Distinct from `complexity-classifier.ts`, which decides *model tier*
+// (light/standard/heavy) for an individual unit. This module decides
+// *pipeline topology* for an entire milestone at plan-milestone time.
+//
+// This file ships the classifier in isolation. Dispatch-side wiring
+// lands in follow-up PRs so the classification contract can be reviewed
+// and tested before any behavior change reaches users.
+// ─── Keyword sets ─────────────────────────────────────────────────────────
+/**
+ * Override keywords that force `standard` (at minimum) regardless of
+ * apparent triviality. Presence of any of these signals work that is
+ * either security-sensitive, irreversible, or requires runtime verification
+ * a "trivial" pipeline would skip.
+ *
+ * Matched as case-insensitive word-boundary substrings. Conservative — err
+ * on the side of including a keyword; over-classifying to `standard` costs
+ * units, under-classifying could ship broken auth/security/migration work.
+ */
+const OVERRIDE_KEYWORDS = [
+    // Security-sensitive
+    "security", "auth", "authn", "authz", "authentication", "authorization",
+    "credential", "secret", "password", "token", "oauth", "encrypt", "decrypt",
+    "vulnerability", "exploit", "permission", "rbac", "acl",
+    // Data-migration / irreversible
+    "migration", "migrate", "schema change", "data migration",
+    "backfill", "drop column", "drop table",
+    // Compliance / regulatory
+    "compliance", "gdpr", "hipaa", "soc2", "pci",
+    // Infra / deploy — runtime verification needed
+    "deploy", "rollout", "canary", "production database",
+];
+/**
+ * Keywords that contribute to `complex` classification on their own.
+ * Different from OVERRIDE_KEYWORDS in that a single match bumps to
+ * complex, not just to standard.
+ */
+const COMPLEX_KEYWORDS = [
+    "multi-service", "distributed", "consensus", "saga", "eventual consistency",
+    "breaking change", "api contract change", "schema redesign",
+    "architect", "architecture", "refactor core",
+];
+/**
+ * Trivial-signal keywords: presence strongly suggests a simple, contained
+ * deliverable. Only effective when combined with low file count / no tests
+ * / no override keywords.
+ */
+const TRIVIAL_KEYWORDS = [
+    "single file", "one file", "static html", "static page",
+    "one-page", "landing page", "readme", "docs only", "typo", "rename",
+    "spelling", "comment", "changelog",
+    // Browser-only / no-build deliverable shapes (b23 forensic case).
+    "pure html", "browser-based", "no build step", "no build tooling",
+    "localstorage", "client-only", "no backend", "no server", "no backend.",
+];
+// ─── Heuristics ───────────────────────────────────────────────────────────
+/**
+ * Estimate how many distinct files the milestone will touch, based on
+ * explicit mentions in the input text. Returns `null` when no hint is
+ * discoverable — callers should treat that as "unknown, no signal."
+ */
+function extractFileCountHint(text) {
+    // Explicit phrasing: "a single file", "two files", "3 files"
+    const singleFileMatch = /\b(a|one|single)\s+(file|page)\b/i.test(text);
+    if (singleFileMatch)
+        return 1;
+    const digitMatch = text.match(/\b(\d+)\s+files?\b/i);
+    if (digitMatch) {
+        const n = parseInt(digitMatch[1], 10);
+        if (!Number.isNaN(n))
+            return n;
+    }
+    const wordMatch = text.match(/\b(two|three|four|five|six|seven|eight|nine|ten)\s+files?\b/i);
+    if (wordMatch) {
+        const wordMap = {
+            two: 2, three: 3, four: 4, five: 5,
+            six: 6, seven: 7, eight: 8, nine: 9, ten: 10,
+        };
+        return wordMap[wordMatch[1].toLowerCase()] ?? null;
+    }
+    return null;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function containsAnyKeyword(haystack, keywords) {
+    const lower = haystack.toLowerCase();
+    const hits = [];
+    for (const kw of keywords) {
+        // Word-boundary match to prevent substring collisions (e.g. "auth"
+        // must not match "author", "api" must not match "capital"). Phrases
+        // containing non-word characters (hyphens, slashes) still work because
+        // `\b` sits at the word-char / non-word-char transition, so
+        // `\bbrowser-based\b` matches "browser-based" bounded by whitespace
+        // or punctuation on either side.
+        const pattern = new RegExp(String.raw `\b${escapeRegExp(kw)}\b`, "i");
+        if (pattern.test(lower))
+            hits.push(kw);
+    }
+    return hits;
+}
+/**
+ * True when `term` appears in the text without an immediately preceding
+ * negator (no / without / not / zero / skip) in the same clause. Used to
+ * keep phrases like "no backend" or "no tests" from flipping a trivial-
+ * class milestone to standard. Best-effort; imperfect English parsing,
+ * biased toward false negatives (if unsure, treats term as present —
+ * which routes to standard, the safe pipeline).
+ */
+function mentionsWithoutNegation(text, term) {
+    const lower = text.toLowerCase();
+    const termPattern = new RegExp(String.raw `\b${term}\b`, "gi");
+    const matches = Array.from(lower.matchAll(termPattern));
+    for (const m of matches) {
+        const start = m.index ?? 0;
+        const windowStart = Math.max(0, start - 30);
+        const window = lower.slice(windowStart, start);
+        // Negator anywhere in the 30-char lookback window counts as negation —
+        // covers "no backend", "without a server", "not using api", "zero
+        // dependencies on an api". If a sentence break intervenes between the
+        // negator and the term, treat as a different clause (positive mention).
+        const hasNegator = /(^|[^a-z0-9])(no|without|not|zero|skip(s|ping)?|drops?)\b/i.test(window);
+        const hasSentenceBreak = /[.;!?]/.test(window);
+        if (hasNegator && !hasSentenceBreak)
+            continue;
+        return true;
+    }
+    return false;
+}
+function mentionsTests(haystack) {
+    return mentionsWithoutNegation(haystack, "test")
+        || mentionsWithoutNegation(haystack, "tests")
+        || mentionsWithoutNegation(haystack, "testing")
+        || mentionsWithoutNegation(haystack, "spec")
+        || mentionsWithoutNegation(haystack, "unit test")
+        || mentionsWithoutNegation(haystack, "integration test");
+}
+function mentionsBackend(haystack) {
+    return mentionsWithoutNegation(haystack, "api")
+        || mentionsWithoutNegation(haystack, "backend")
+        || mentionsWithoutNegation(haystack, "server")
+        || mentionsWithoutNegation(haystack, "database")
+        || mentionsWithoutNegation(haystack, "endpoint");
+}
+// ─── DB adapter ───────────────────────────────────────────────────────────
+/**
+ * Shape adapter: convert a milestone DB row into the classifier input
+ * object. Keeps `milestone-scope-classifier.ts` free of DB types at the
+ * module boundary — callers can either use this helper or hand-build the
+ * input themselves (e.g. from plan-milestone tool params before insert).
+ */
+export function milestoneRowToScopeInput(row) {
+    return {
+        title: row.title,
+        vision: row.vision,
+        successCriteria: row.success_criteria,
+        keyRisks: row.key_risks,
+        definitionOfDone: row.definition_of_done,
+        requirementCoverage: row.requirement_coverage,
+        verificationContract: row.verification_contract,
+        verificationIntegration: row.verification_integration,
+        verificationOperational: row.verification_operational,
+        verificationUat: row.verification_uat,
+    };
+}
+/**
+ * Compute the pipeline variant for a milestone by reading its planning
+ * fields from the DB and running the classifier. Returns `null` when
+ * classification is unavailable (DB closed, milestone missing, unexpected
+ * error) — callers MUST treat null as "run the full pipeline" so a
+ * classification failure never silently downshifts dispatch.
+ */
+export async function getMilestonePipelineVariant(mid) {
+    try {
+        const { isDbAvailable, getMilestone } = await import("./gsd-db.js");
+        if (!isDbAvailable())
+            return null;
+        const row = getMilestone(mid);
+        if (!row)
+            return null;
+        return classifyMilestoneScope(milestoneRowToScopeInput(row)).variant;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Public API ───────────────────────────────────────────────────────────
+/**
+ * Classify a milestone's pipeline variant based on its planning inputs.
+ *
+ * Precedence (matches implementation order — complex-first so that
+ * security-sensitive architecture refactors correctly route to complex
+ * rather than standard; the override hit is still recorded in
+ * `signals.triggeredOverride` for telemetry):
+ *  1. Complex-signal keyword OR ≥ 8 file hint OR architecture/refactor-core
+ *     language → `complex`.
+ *  2. Override keyword → `standard` (at minimum). Prevents trivial
+ *     misclassification of security / auth / migration work.
+ *  3. Trivial-signal keyword AND ≤ 2 file hint AND no tests mentioned AND
+ *     no backend mentioned → `trivial`.
+ *  4. Otherwise → `standard`.
+ *
+ * Ambiguity → `standard` (today's default). Safe to run the full pipeline.
+ */
+export function classifyMilestoneScope(input) {
+    const haystack = [
+        input.title ?? "",
+        input.vision ?? "",
+        (input.successCriteria ?? []).join("\n"),
+        (input.keyRisks ?? []).map(r => `${r.risk ?? ""} ${r.whyItMatters ?? ""}`).join("\n"),
+        (input.definitionOfDone ?? []).join("\n"),
+        input.requirementCoverage ?? "",
+        input.verificationContract ?? "",
+        input.verificationIntegration ?? "",
+        input.verificationOperational ?? "",
+        input.verificationUat ?? "",
+    ].join("\n");
+    const overrideHits = containsAnyKeyword(haystack, OVERRIDE_KEYWORDS);
+    const complexHits = containsAnyKeyword(haystack, COMPLEX_KEYWORDS);
+    const trivialHits = containsAnyKeyword(haystack, TRIVIAL_KEYWORDS);
+    const fileCountHint = extractFileCountHint(haystack);
+    const hasTests = mentionsTests(haystack);
+    const hasBackend = mentionsBackend(haystack);
+    const reasons = [];
+    // Rule 2: complex-class signals. Evaluated before override because a
+    // complex + override input should land in complex, not standard.
+    if (complexHits.length > 0) {
+        reasons.push(`complex keywords: ${complexHits.slice(0, 3).join(", ")}`);
+    }
+    if (fileCountHint !== null && fileCountHint >= 8) {
+        reasons.push(`file count hint: ${fileCountHint}`);
+    }
+    const isComplex = complexHits.length > 0 || (fileCountHint !== null && fileCountHint >= 8);
+    if (isComplex) {
+        return {
+            variant: "complex",
+            reasons,
+            signals: {
+                triggeredOverride: overrideHits.length > 0,
+                complexCount: complexHits.length,
+                trivialCount: trivialHits.length,
+                fileCountHint,
+            },
+        };
+    }
+    // Rule 1: override keywords force standard.
+    if (overrideHits.length > 0) {
+        return {
+            variant: "standard",
+            reasons: [`override keywords: ${overrideHits.slice(0, 3).join(", ")}`],
+            signals: {
+                triggeredOverride: true,
+                complexCount: complexHits.length,
+                trivialCount: trivialHits.length,
+                fileCountHint,
+            },
+        };
+    }
+    // Rule 3: trivial signals — require ALL of: trivial-keyword, low file
+    // hint (or nothing suggesting high count), no test mention, no backend
+    // mention.
+    const fileCountOk = fileCountHint === null || fileCountHint <= 2;
+    const trivial = trivialHits.length > 0 &&
+        fileCountOk &&
+        !hasTests &&
+        !hasBackend;
+    if (trivial) {
+        reasons.push(`trivial keywords: ${trivialHits.slice(0, 3).join(", ")}`);
+        if (fileCountHint !== null)
+            reasons.push(`file count hint: ${fileCountHint}`);
+        reasons.push("no tests mentioned", "no backend mentioned");
+        return {
+            variant: "trivial",
+            reasons,
+            signals: {
+                triggeredOverride: false,
+                complexCount: complexHits.length,
+                trivialCount: trivialHits.length,
+                fileCountHint,
+            },
+        };
+    }
+    // Rule 4: fallback.
+    return {
+        variant: "standard",
+        reasons: reasons.length > 0 ? reasons : ["no strong signals — default"],
+        signals: {
+            triggeredOverride: overrideHits.length > 0,
+            complexCount: complexHits.length,
+            trivialCount: trivialHits.length,
+            fileCountHint,
+        },
+    };
+}

package/dist/resources/extensions/gsd/milestone-summary-classifier.js

@@ -0,0 +1,37 @@
+/**
+ * Shared milestone SUMMARY classifier.
+ *
+ * SUMMARY presence alone is not enough to prove milestone completion: recovery
+ * and blocker paths also write SUMMARY files. Keep this leaf module free of
+ * state/auto imports so state derivation, dispatch guards, and recovery can
+ * share one definition without cycles.
+ */
+import { splitFrontmatter, parseFrontmatterMap } from "../shared/frontmatter.js";
+import { isClosedStatus } from "./status-guards.js";
+export function classifyMilestoneSummaryContent(content) {
+    const [fmLines] = splitFrontmatter(content);
+    const fm = fmLines ? parseFrontmatterMap(fmLines) : null;
+    const rawStatus = typeof fm?.status === "string" ? fm.status.trim().toLowerCase() : "";
+    if (rawStatus) {
+        if (isClosedStatus(rawStatus))
+            return "success";
+        if (["active", "pending", "blocked", "failed", "failure", "incomplete"].includes(rawStatus)) {
+            return "failure";
+        }
+    }
+    const failureSignal = /(?:^|\n)\s*#\s*BLOCKER\b/i.test(content)
+        || /auto-mode recovery failed/i.test(content)
+        || /verification\s+failed/i.test(content)
+        || /(?:^|\n)\s*(?:status|verdict|outcome|result)\s*[:=-]\s*not complete\b/i.test(content);
+    if (failureSignal)
+        return "failure";
+    return "unknown";
+}
+/**
+ * Legacy-compatible terminal check for state derivation.
+ * Unknown summaries remain terminal to preserve old handwritten SUMMARY files;
+ * explicit failure summaries do not.
+ */
+export function isTerminalMilestoneSummaryContent(content) {
+    return classifyMilestoneSummaryContent(content) !== "failure";
+}

package/dist/resources/extensions/gsd/model-cost-table.js

@@ -43,6 +43,9 @@ export const BUNDLED_COST_TABLE = [
     { id: "gpt-5.3-codex-spark", inputPer1k: 0.0003, outputPer1k: 0.0012, updatedAt: "2026-03-29" },
     { id: "gpt-5.4", inputPer1k: 0.005, outputPer1k: 0.02, updatedAt: "2026-03-29" },
     { id: "gpt-5.4-mini", inputPer1k: 0.00075, outputPer1k: 0.0045, updatedAt: "2026-04-18" },
+    // GPT-5.5 API list price, also used for live Codex OAuth routing.
+    // Source: https://openai.com/api/pricing/
+    { id: "gpt-5.5", inputPer1k: 0.005, outputPer1k: 0.03, updatedAt: "2026-04-23" },
     // Google
     { id: "gemini-2.0-flash", inputPer1k: 0.0001, outputPer1k: 0.0004, updatedAt: "2025-03-15" },
     { id: "gemini-flash-2.0", inputPer1k: 0.0001, outputPer1k: 0.0004, updatedAt: "2025-03-15" },

package/dist/resources/extensions/gsd/model-router.js

@@ -43,6 +43,7 @@ export const MODEL_CAPABILITY_TIER = {
     "gpt-5.2-codex": "heavy",
     "gpt-5.3-codex": "heavy",
     "gpt-5.4": "heavy",
+    "gpt-5.5": "heavy",
     "o1": "heavy",
     "o3": "heavy",
     "o4-mini": "heavy",
@@ -76,6 +77,7 @@ const MODEL_COST_PER_1K_INPUT = {
     "gpt-5.3-codex": 0.005,
     "gpt-5.3-codex-spark": 0.0003,
     "gpt-5.4": 0.005,
+    "gpt-5.5": 0.005,
     "o4-mini": 0.005,
     "o4-mini-deep-research": 0.005,
     "gemini-2.0-flash": 0.0001,
@@ -116,6 +118,10 @@ export const MODEL_CAPABILITY_PROFILES = {
     "gpt-5.3-codex": { coding: 94, debugging: 91, research: 74, reasoning: 89, speed: 50, longContext: 80, instruction: 89 },
     "gpt-5.3-codex-spark": { coding: 68, debugging: 58, research: 42, reasoning: 52, speed: 90, longContext: 50, instruction: 74 },
     "gpt-5.4": { coding: 95, debugging: 92, research: 88, reasoning: 94, speed: 42, longContext: 88, instruction: 92 },
+    // GPT-5.5 scores are relative to the existing gpt-5.4 profile and backed by
+    // OpenAI's 2026-04-23 published eval deltas across coding, tool use, and long context.
+    // Source: https://openai.com/index/introducing-gpt-5-5/
+    "gpt-5.5": { coding: 96, debugging: 93, research: 89, reasoning: 95, speed: 42, longContext: 90, instruction: 93 },
     // ── OpenAI o-series (reasoning-first) ──────────────────────────────────────
     "o1": { coding: 78, debugging: 82, research: 78, reasoning: 90, speed: 20, longContext: 65, instruction: 82 },
     "o3": { coding: 80, debugging: 85, research: 80, reasoning: 92, speed: 25, longContext: 70, instruction: 85 },

package/dist/resources/extensions/gsd/native-git-bridge.js

@@ -740,15 +740,44 @@ export function nativeResetPaths(basePath, paths) {
         gitExec(basePath, ["reset", "HEAD", "--", p], true);
     }
 }
+/**
+ * Read `commit.gpgsign` from the repo config. Returns true only if the value
+ * is the literal string "true". Any other state (unset, false, error) → false.
+ *
+ * Used by nativeCommit to route signing-required commits through the git CLI,
+ * because the libgit2 native path does not invoke configured signers.
+ * (Issue #4980 CRIT-2)
+ */
+function shouldSignCommits(basePath) {
+    try {
+        const result = execFileSync("git", ["config", "--get", "commit.gpgsign"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+            env: GIT_NO_PROMPT_ENV,
+        }).trim();
+        return result === "true";
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Create a commit from the current index.
  * Returns the commit SHA on success, or null if nothing to commit.
  * Native: libgit2 commit create.
- * Fallback: `git commit --no-verify -F -`.
+ * Fallback: `git commit -F -` (runs hooks; honors commit.gpgsign).
+ *
+ * The fallback intentionally does NOT use --no-verify — user pre-commit /
+ * commit-msg / prepare-commit-msg hooks must fire on every GSD-automated
+ * commit. (Issue #4980 CRIT-1)
  */
 export function nativeCommit(basePath, message, options) {
     const native = loadNative();
-    if (native) {
+    // libgit2's commit-create does not invoke configured GPG/SSH signers. When
+    // commit.gpgsign=true, route through the git CLI fallback so signing
+    // happens. (Issue #4980 CRIT-2)
+    if (native && !shouldSignCommits(basePath)) {
         try {
             return native.gitCommit(basePath, message, options?.allowEmpty);
         }
@@ -759,9 +788,10 @@ export function nativeCommit(basePath, message, options) {
             throw e;
         }
     }
-    // Fallback: use git commit with stdin pipe for safe multi-line messages
+    // Fallback / signed-commit path: use git CLI with stdin pipe for safe
+    // multi-line messages. Hooks run; commit.gpgsign honored.
     try {
-        const args = ["commit", "--no-verify", "-F", "-"];
+        const args = ["commit", "-F", "-"];
         if (options?.allowEmpty)
             args.push("--allow-empty");
         const result = execFileSync("git", args, {