gsd-pi 2.78.0-dev.aeeb2ca00 → 2.78.1-dev.84a383f51

package/dist/onboarding.js

@@ -54,7 +54,7 @@ const API_KEY_PREFIXES = {
     anthropic: ['sk-ant-'],
     openai: ['sk-'],
 };
-const OTHER_PROVIDERS = [
+export const OTHER_PROVIDERS = [
     { value: 'google', label: 'Google (Gemini)', hint: 'aistudio.google.com/app/apikey' },
     { value: 'groq', label: 'Groq', hint: 'console.groq.com/keys' },
     { value: 'xai', label: 'xAI (Grok)', hint: 'console.x.ai' },
@@ -148,7 +148,7 @@ function persistDefaultModel(modelId) {
         // Non-fatal: startup fallback logic will still run.
     }
 }
-function detectNativeProviderFromBaseUrl(baseUrl) {
+export function detectNativeProviderFromBaseUrl(baseUrl) {
     try {
         const hostname = new URL(baseUrl).hostname.toLowerCase();
         if (hostname === 'api.minimax.io' || hostname.endsWith('.minimax.io')) {

package/dist/provider-migrations.d.ts

@@ -1,7 +1,7 @@
 import type { AuthStorage } from "@gsd/pi-coding-agent";
 type AnthropicMigrationDeps = {
     authStorage: Pick<AuthStorage, "getCredentialsForProvider">;
-    isClaudeCodeReady: boolean;
+    isClaudeCodeReady: boolean | (() => boolean);
     defaultProvider: string | undefined;
     env?: NodeJS.ProcessEnv;
 };
@@ -11,7 +11,7 @@ type MigrationModel = {
 };
 type AnthropicDefaultMigrationDeps = {
     authStorage: Pick<AuthStorage, "getCredentialsForProvider">;
-    isClaudeCodeReady: boolean;
+    isClaudeCodeReady: boolean | (() => boolean);
     settingsManager: {
         getDefaultProvider(): string | undefined;
         getDefaultModel(): string | undefined;

package/dist/provider-migrations.js

@@ -5,10 +5,13 @@ export function hasDirectAnthropicApiKey(authStorage, env = process.env) {
     return authStorage.getCredentialsForProvider("anthropic").some((credential) => credential?.type === "api_key" && typeof credential?.key === "string" && credential.key.trim().length > 0);
 }
 export function shouldMigrateAnthropicToClaudeCode({ authStorage, isClaudeCodeReady, defaultProvider, env = process.env, }) {
-    if (!isClaudeCodeReady || defaultProvider !== "anthropic") {
+    if (defaultProvider !== "anthropic") {
         return false;
     }
-    return !hasDirectAnthropicApiKey(authStorage, env);
+    if (hasDirectAnthropicApiKey(authStorage, env)) {
+        return false;
+    }
+    return typeof isClaudeCodeReady === "function" ? isClaudeCodeReady() : isClaudeCodeReady;
 }
 export function migrateAnthropicDefaultToClaudeCode({ authStorage, isClaudeCodeReady, settingsManager, modelRegistry, env = process.env, }) {
     const defaultProvider = settingsManager.getDefaultProvider();

package/dist/resource-loader.d.ts

@@ -1,4 +1,4 @@
-import { DefaultResourceLoader } from '@gsd/pi-coding-agent';
+import type { DefaultResourceLoader as DefaultResourceLoaderType } from '@gsd/pi-coding-agent';
 export { discoverExtensionEntryPaths } from './extension-discovery.js';
 export declare function getExtensionKey(entryPath: string, extensionsDir: string): string;
 export declare function readManagedResourceVersion(agentDir: string): string | null;
@@ -63,4 +63,7 @@ export declare function mergedFingerprint(hoisted: string, internal: string): st
  */
 export declare function initResources(agentDir: string, skillsDir?: string): void;
 export declare function hasStaleCompiledExtensionSiblings(extensionsDir: string, sourceDir?: string): boolean;
-export declare function buildResourceLoader(agentDir: string): DefaultResourceLoader;
+interface BuildResourceLoaderOptions {
+    additionalExtensionPaths?: string[];
+}
+export declare function buildResourceLoader(agentDir: string, options?: BuildResourceLoaderOptions): Promise<DefaultResourceLoaderType>;

package/dist/resource-loader.js

@@ -1,4 +1,3 @@
-import { DefaultResourceLoader, sortExtensionPaths } from '@gsd/pi-coding-agent';
 import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { chmodSync, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, closeSync, readFileSync, readlinkSync, readdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
@@ -7,6 +6,10 @@ import { fileURLToPath } from 'node:url';
 import { compareSemver } from './update-check.js';
 import { discoverExtensionEntryPaths } from './extension-discovery.js';
 import { loadRegistry, readManifestFromEntryPath, isExtensionEnabled, ensureRegistryEntries } from './extension-registry.js';
+let piCodingAgentModulePromise;
+function loadPiCodingAgentModule() {
+    return (piCodingAgentModulePromise ??= import('@gsd/pi-coding-agent'));
+}
 // Resolve resources directory — prefer dist/resources/ (stable, set at build time)
 // over src/resources/ (live working tree, changes with git branch).
 //
@@ -26,6 +29,7 @@ const resourcesDir = (existsSync(distResources) && existsSync(join(distResources
     : srcResources;
 const bundledExtensionsDir = join(resourcesDir, 'extensions');
 const resourceVersionManifestName = 'managed-resources.json';
+const resourceFingerprintFileName = '.managed-resources-content-hash';
 export { discoverExtensionEntryPaths } from './extension-discovery.js';
 export function getExtensionKey(entryPath, extensionsDir) {
     const relPath = relative(extensionsDir, entryPath);
@@ -77,7 +81,7 @@ function writeManagedResourceManifest(agentDir) {
     const manifest = {
         gsdVersion: getBundledGsdVersion(),
         syncedAt: Date.now(),
-        contentHash: computeResourceFingerprint(),
+        contentHash: getCurrentResourceFingerprint(),
         installedExtensionRootFiles,
         installedExtensionDirs,
     };
@@ -125,10 +129,24 @@ export function computeResourceFingerprint(rootDir = resourcesDir) {
     entries.sort();
     return createHash('sha256').update(entries.join('\n')).digest('hex').slice(0, 16);
 }
+function getCurrentResourceFingerprint() {
+    try {
+        const precomputed = readFileSync(join(resourcesDir, resourceFingerprintFileName), 'utf-8').trim();
+        if (/^[a-f0-9]{16}$/i.test(precomputed)) {
+            return precomputed;
+        }
+    }
+    catch {
+        // Source-tree and partial-build workflows may not have a precomputed hash.
+    }
+    return computeResourceFingerprint();
+}
 function collectFileEntries(dir, root, out) {
     if (!existsSync(dir))
         return;
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name === resourceFingerprintFileName)
+            continue;
         const fullPath = join(dir, entry.name);
         if (entry.isDirectory()) {
             collectFileEntries(fullPath, root, out);
@@ -548,7 +566,7 @@ export function initResources(agentDir, skillsDir = join(homedir(), '.agents', '
     // hotfixes within a release). The content hash catches those at ~1ms cost.
     if (manifest && manifest.gsdVersion === currentVersion) {
         // Version matches — check content fingerprint for same-version staleness.
-        const currentHash = computeResourceFingerprint();
+        const currentHash = getCurrentResourceFingerprint();
         const hasStaleExtensionFiles = hasStaleCompiledExtensionSiblings(extensionsDir, bundledExtensionsDir);
         if (manifest.contentHash && manifest.contentHash === currentHash && !hasStaleExtensionFiles) {
             return;
@@ -736,7 +754,8 @@ function getBundledExtensionKeys() {
     }
     return _bundledExtensionKeys;
 }
-export function buildResourceLoader(agentDir) {
+export async function buildResourceLoader(agentDir, options = {}) {
+    const { DefaultResourceLoader, sortExtensionPaths } = await loadPiCodingAgentModule();
     const registry = loadRegistry();
     const piAgentDir = join(homedir(), '.pi', 'agent');
     const piExtensionsDir = join(piAgentDir, 'extensions');
@@ -749,9 +768,13 @@ export function buildResourceLoader(agentDir) {
             return true;
         return isExtensionEnabled(registry, manifest.id);
     });
+    const additionalExtensionPaths = [
+        ...piExtensionPaths,
+        ...(options.additionalExtensionPaths ?? []),
+    ];
     return new DefaultResourceLoader({
         agentDir,
-        additionalExtensionPaths: piExtensionPaths,
+        additionalExtensionPaths,
         bundledExtensionKeys: bundledKeys,
         extensionPathsTransform: (paths) => {
             // 1. Filter community extensions through the GSD registry

package/dist/resources/.managed-resources-content-hash

@@ -0,0 +1 @@
+afb1073f61989a78

package/dist/resources/extensions/claude-code-cli/readiness.js

@@ -6,8 +6,12 @@
  * model-availability check.
  *
  * Auth verification runs `claude auth status --json` and inspects the
- * `loggedIn` field, falling back to a text heuristic when the JSON shape
- * is unavailable (older Claude CLI builds).
+ * `loggedIn` field, falling back to plain `claude auth status` and a text
+ * heuristic when the JSON shape is unavailable (older Claude CLI builds).
+ *
+ * Set GSD_CLAUDE_DEBUG=1 to print the probe's binary selection and auth
+ * outputs to stderr — useful when diagnosing platform-specific detection
+ * failures (Issue #4997).
  */
 import { execFileSync } from "node:child_process";
 /**
@@ -24,42 +28,45 @@ const CLAUDE_COMMAND = process.platform === "win32" ? "claude.cmd" : "claude";
  * installed" results in readiness checks.
  */
 const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude.exe", "claude"] : [CLAUDE_COMMAND];
-// Codes treated as "this candidate didn't run — try the next one" rather than
-// fatal failures. ENOENT/EINVAL cover the original Windows .cmd shim cases.
-// ETIMEDOUT and EAGAIN cover slow-spawn cases where cmd.exe wrapping plus
-// the Claude CLI startup path together exceed the per-attempt timeout
-// (Issue #4997 regression on Windows + Node 25).
-const SOFT_FAIL_CODES = new Set(["ENOENT", "EINVAL", "ETIMEDOUT", "EAGAIN"]);
 // Keep the version probe snappy — `claude --version` is a quick path.
 const VERSION_TIMEOUT_MS = 5_000;
 // Auth status can be much slower on Windows because the spawn goes through
 // cmd.exe → claude.cmd → node → Claude CLI. 15s leaves headroom on cold spawns
 // without making startup feel hung when the CLI is genuinely missing.
 const AUTH_TIMEOUT_MS = 15_000;
+function debugLog(...parts) {
+    if (process.env.GSD_CLAUDE_DEBUG) {
+        process.stderr.write(`[claude-readiness] ${parts.map((p) => (typeof p === "string" ? p : JSON.stringify(p))).join(" ")}\n`);
+    }
+}
 /**
- * Run the requested Claude CLI command against each supported executable name.
- * Returns the first successful output buffer and rethrows hard failures.
+ * Find the first candidate that responds to `--version`. Returns the
+ * candidate name on success, null if none worked.
+ *
+ * On Windows with `shell: true`, a missing candidate surfaces as a
+ * non-zero exit from cmd.exe rather than ENOENT — so we cannot rely on
+ * the error code to decide "try next". Treat any failure as "try next"
+ * for the version probe; the only thing that matters for binary
+ * detection is whether *some* candidate produces a `claude --version`
+ * line.
  */
-function execClaude(args, timeoutMs) {
-    let lastError;
+function findWorkingCommand() {
     for (const command of CLAUDE_COMMAND_CANDIDATES) {
         try {
-            return execFileSync(command, args, {
-                timeout: timeoutMs,
+            execFileSync(command, ["--version"], {
+                timeout: VERSION_TIMEOUT_MS,
                 stdio: "pipe",
                 shell: process.platform === "win32",
             });
+            debugLog("version probe ok via", command);
+            return command;
         }
         catch (error) {
-            lastError = error;
-            const code = error?.code;
-            if (code && SOFT_FAIL_CODES.has(code)) {
-                continue;
-            }
-            throw error;
+            debugLog("version probe failed for", command, "code=", error?.code);
+            continue;
         }
     }
-    throw lastError ?? new Error(`Claude CLI executable not found (tried: ${CLAUDE_COMMAND_CANDIDATES.join(", ")})`);
+    return null;
 }
 /**
  * Decide auth state from `claude auth status` output.
@@ -71,6 +78,8 @@ function execClaude(args, timeoutMs) {
  */
 function parseAuthStatus(output) {
     const trimmed = output.trim();
+    if (!trimmed)
+        return null;
     if (trimmed.startsWith("{")) {
         try {
             const parsed = JSON.parse(trimmed);
@@ -86,8 +95,41 @@ function parseAuthStatus(output) {
     if (/not logged in|no credentials|unauthenticated|not authenticated/.test(lower)) {
         return false;
     }
-    // Exit-0 with non-error output and no negative markers — treat as authed.
-    return true;
+    if (/logged in|authenticated|signed in|email|subscription/.test(lower)) {
+        return true;
+    }
+    return null;
+}
+function probeAuth(command) {
+    // Try --json first (newer CLIs).
+    try {
+        const out = execFileSync(command, ["auth", "status", "--json"], {
+            timeout: AUTH_TIMEOUT_MS,
+            stdio: "pipe",
+            shell: process.platform === "win32",
+        }).toString();
+        debugLog("auth status --json output:", out.slice(0, 200));
+        const parsed = parseAuthStatus(out);
+        if (parsed !== null)
+            return parsed;
+    }
+    catch (error) {
+        debugLog("auth status --json threw:", error.message?.slice(0, 200));
+    }
+    // Fallback: plain `auth status` (older CLIs that don't accept --json).
+    try {
+        const out = execFileSync(command, ["auth", "status"], {
+            timeout: AUTH_TIMEOUT_MS,
+            stdio: "pipe",
+            shell: process.platform === "win32",
+        }).toString();
+        debugLog("auth status output:", out.slice(0, 200));
+        return parseAuthStatus(out);
+    }
+    catch (error) {
+        debugLog("auth status threw:", error.message?.slice(0, 200));
+        return null;
+    }
 }
 let cachedBinaryPresent = null;
 let cachedAuthed = null;
@@ -104,33 +146,23 @@ function refreshCache() {
     }
     // Set timestamp first to prevent re-entrant checks during the same window
     lastCheckMs = now;
-    // Check binary presence
-    try {
-        execClaude(["--version"], VERSION_TIMEOUT_MS);
-        cachedBinaryPresent = true;
-    }
-    catch {
+    const command = findWorkingCommand();
+    if (!command) {
         cachedBinaryPresent = false;
         cachedAuthed = false;
         return;
     }
-    // Request JSON explicitly so older CLI builds that defaulted to text and
-    // newer builds that default to JSON produce a consistent shape.
-    try {
-        const output = execClaude(["auth", "status", "--json"], AUTH_TIMEOUT_MS).toString();
-        cachedAuthed = parseAuthStatus(output);
-    }
-    catch (error) {
-        const code = error?.code;
-        // Spawn-shape failures (timeout, transient) shouldn't be treated as
-        // "definitely not authed" — leave the previous value if we have one,
-        // otherwise default to false. The version probe already established
-        // the binary works, so a flaky auth probe is more likely transient.
-        if (code && SOFT_FAIL_CODES.has(code) && cachedAuthed !== null) {
-            return;
-        }
-        cachedAuthed = false;
+    cachedBinaryPresent = true;
+    const authed = probeAuth(command);
+    if (authed === null) {
+        // Couldn't determine auth state from CLI output. Don't clobber a
+        // previously known-good cache; otherwise default to false so we don't
+        // silently route requests to an unauthenticated CLI.
+        if (cachedAuthed === null)
+            cachedAuthed = false;
+        return;
     }
+    cachedAuthed = authed;
 }
 /**
  * Whether the `claude` binary is installed (regardless of auth state).

package/dist/resources/extensions/gsd/auto/loop.js

@@ -163,6 +163,17 @@ function resolveDispatchNodeKind(unitType, sidecarItem) {
     }
     return "unit";
 }
+async function enforceMinRequestInterval(s, prefs) {
+    const minInterval = prefs?.min_request_interval_ms ?? 0;
+    if (minInterval > 0 && s.lastRequestTimestamp > 0) {
+        const elapsed = Date.now() - s.lastRequestTimestamp;
+        if (elapsed < minInterval) {
+            const waitMs = minInterval - elapsed;
+            debugLog("autoLoop", { phase: "rate-limit-wait", waitMs });
+            await new Promise(r => setTimeout(r, waitMs));
+        }
+    }
+}
 async function runUnitPhaseViaContract(dispatchContract, ic, iterData, loopState, sidecarItem) {
     if (dispatchContract === "legacy-direct") {
         return runUnitPhase(ic, iterData, loopState, sidecarItem);
@@ -392,7 +403,13 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                     break;
                 }
                 // ── Unit execution (shared with dev path) ──
+                await enforceMinRequestInterval(s, prefs);
                 const unitPhaseResult = await runUnitPhaseViaContract(dispatchContract, ic, iterData, loopState);
+                if (unitPhaseResult.action === "next") {
+                    const requestTimestamp = unitPhaseResult.data.requestDispatchedAt ?? unitPhaseResult.data.unitStartedAt;
+                    if (typeof requestTimestamp === "number")
+                        s.lastRequestTimestamp = requestTimestamp;
+                }
                 deps.uokObserver?.onPhaseResult("unit", unitPhaseResult.action, {
                     unitType: iterData.unitType,
                     unitId: iterData.unitId,
@@ -555,7 +572,13 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                     sidecarKind: sidecarItem.kind,
                 });
             }
+            await enforceMinRequestInterval(s, prefs);
             const unitPhaseResult = await runUnitPhaseViaContract(dispatchContract, ic, iterData, loopState, sidecarItem);
+            if (unitPhaseResult.action === "next") {
+                const requestTimestamp = unitPhaseResult.data.requestDispatchedAt ?? unitPhaseResult.data.unitStartedAt;
+                if (typeof requestTimestamp === "number")
+                    s.lastRequestTimestamp = requestTimestamp;
+            }
             deps.uokObserver?.onPhaseResult("unit", unitPhaseResult.action, {
                 unitType: iterData.unitType,
                 unitId: iterData.unitId,

package/dist/resources/extensions/gsd/auto/phases.js

@@ -1365,7 +1365,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
                 ctx.ui.notify(`${unitType} ${unitId} completed with 0 tool calls — context exhaustion, will retry`, "warning");
                 // Fall through to next iteration where dispatch will re-derive
                 // and re-dispatch this unit.
-                return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt } };
+                return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt, requestDispatchedAt: unitResult.requestDispatchedAt } };
             }
         }
     }
@@ -1418,7 +1418,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         }
         s.checkpointSha = null;
     }
-    return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt } };
+    return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt, requestDispatchedAt: unitResult.requestDispatchedAt } };
 }
 // ─── runFinalize ──────────────────────────────────────────────────────────────
 /**

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -138,6 +138,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     const capturedTurnGen = getCurrentTurnGeneration();
     // ── Send the prompt ──
     debugLog("runUnit", { phase: "send-message", unitType, unitId });
+    const requestDispatchedAt = Date.now();
     pi.sendMessage({ customType: "gsd-auto", content: prompt, display: s.verbose }, { triggerTurn: true });
     // ── Await agent_end with absolute timeout (H4 fix) ──
     // If supervision fails to resolve unitPromise within 30s, treat as cancelled.
@@ -160,6 +161,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
         unitId,
         status: result.status,
     });
+    const finalResult = { ...result, requestDispatchedAt };
     // Discard trailing follow-up messages (e.g. async_job_result notifications)
     // from the completed unit. Without this, queued follow-ups trigger wasteful
     // LLM turns before the next session can start (#1642).
@@ -174,5 +176,5 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     catch (e) {
         logWarning("engine", "clearQueue failed after unit completion", { error: String(e) });
     }
-    return result;
+    return finalResult;
 }

package/dist/resources/extensions/gsd/auto/session.js

@@ -118,6 +118,8 @@ export class AutoSession {
     lastPromptCharCount;
     lastBaselineCharCount;
     pendingQuickTasks = [];
+    /** Timestamp of the last LLM request dispatch (ms since epoch). Used for proactive rate limiting. */
+    lastRequestTimestamp = 0;
     // ── Safety harness ───────────────────────────────────────────────────────
     /** SHA of the pre-unit git checkpoint ref. Cleared on success or rollback. */
     checkpointSha = null;
@@ -215,6 +217,7 @@ export class AutoSession {
         this.lastPromptCharCount = undefined;
         this.lastBaselineCharCount = undefined;
         this.pendingQuickTasks = [];
+        this.lastRequestTimestamp = 0;
         this.sidecarQueue = [];
         this.rewriteAttemptCount = 0;
         this.consecutiveCompleteBootstraps = 0;

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -7,6 +7,7 @@
  * globals or AutoContext dependency.
  */
 import { parseUnitId } from "./unit-id.js";
+import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
@@ -168,8 +169,35 @@ function getChangedFilesSinceBranch(basePath, targetBranch) {
     }
 }
 function getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId) {
+    // Primary: path-scoped log against .gsd/milestones/<id>. Fast and unbounded
+    // by depth when .gsd/ is tracked in git.
+    const scoped = scanGsdTaggedCommits(basePath, milestoneId, [
+        "log", "--format=%H%x1f%B%x1e", "HEAD", "--", `.gsd/milestones/${milestoneId}`,
+    ]);
+    if (!scoped.ok)
+        return scoped;
+    if (scoped.matched)
+        return scoped;
+    // Fallback (#5033): when .gsd/ is gitignored / external / untracked, the
+    // path-scoped scan matches no commits even though GSD-tagged commits
+    // referencing the milestone exist on the integration branch. Re-scan all
+    // of HEAD's history and rely on commitMatchesMilestone to bind by
+    // explicit milestone mention in the message body.
+    //
+    // Intentionally unbounded — symmetric with the primary scan, and avoids
+    // reintroducing the rolling-depth failure class removed in #4699 where
+    // milestone evidence aged out behind unrelated activity.
+    return scanGsdTaggedCommits(basePath, milestoneId, [
+        "log", "--format=%H%x1f%B%x1e", "HEAD",
+    ]);
+}
+function scanGsdTaggedCommits(basePath, milestoneId, gitArgs) {
     try {
-        const logOutput = execFileSync("git", ["log", "--format=%H%x1f%B%x1e", "HEAD", "--", `.gsd/milestones/${milestoneId}`], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
+        const logOutput = execFileSync("git", [...gitArgs], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
         const records = logOutput
             .split("\x1e")
             .map((record) => record.trim())
@@ -213,13 +241,24 @@ function commitMatchesMilestone(message, milestoneId, files) {
     if (commitTrailerStartsWithMilestone(message, milestoneId))
         return true;
     // Meaningful execute-task commits currently store task scope as Sxx/Tyy
-    // rather than Mxx/Sxx/Tyy. Bind those commits back to the milestone only
-    // when the commit also touched this milestone's artifacts.
+    // rather than Mxx/Sxx/Tyy. Bind those commits back to the milestone when
+    // either the commit touched this milestone's artifacts, or — for projects
+    // where .gsd/ is gitignored/external (#5033) — the message explicitly
+    // names the milestone.
     if (/^GSD-Task:\s*S[^/\s]+\/T\S+/m.test(message)) {
-        return files.some((file) => isMilestoneArtifactPath(file, milestoneId));
+        if (files.some((file) => isMilestoneArtifactPath(file, milestoneId)))
+            return true;
+        if (commitMessageMentionsMilestone(message, milestoneId))
+            return true;
     }
     return false;
 }
+function commitMessageMentionsMilestone(message, milestoneId) {
+    if (!MILESTONE_ID_RE.test(milestoneId))
+        return false;
+    const escapedMilestone = milestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`\\b${escapedMilestone}\\b`).test(message);
+}
 function commitTrailerStartsWithMilestone(message, milestoneId) {
     const escapedMilestone = milestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const trailerPattern = new RegExp(`^GSD-(?:Task|Unit):\\s*${escapedMilestone}(?:$|[\\s/])`, "m");

package/dist/resources/extensions/gsd/auto-runtime-state.js

@@ -0,0 +1,31 @@
+// GSD auto-mode runtime state
+import { AutoSession } from "./auto/session.js";
+import { isDeterministicPolicyError, isQueuedUserMessageSkip, isToolInvocationError, markToolEnd as markTrackedToolEnd, markToolStart as markTrackedToolStart, } from "./auto-tool-tracking.js";
+export const autoSession = new AutoSession();
+export function getAutoRuntimeSnapshot() {
+    return {
+        active: autoSession.active,
+        paused: autoSession.paused,
+        currentUnit: autoSession.currentUnit ? { ...autoSession.currentUnit } : null,
+        basePath: autoSession.basePath,
+    };
+}
+export function isAutoActive() {
+    return autoSession.active;
+}
+export function isAutoPaused() {
+    return autoSession.paused;
+}
+export function markToolStart(toolCallId, toolName) {
+    markTrackedToolStart(toolCallId, autoSession.active, toolName);
+}
+export function markToolEnd(toolCallId) {
+    markTrackedToolEnd(toolCallId);
+}
+export function recordToolInvocationError(toolName, errorMsg) {
+    if (!autoSession.active)
+        return;
+    if (isToolInvocationError(errorMsg) || isQueuedUserMessageSkip(errorMsg) || isDeterministicPolicyError(errorMsg)) {
+        autoSession.lastToolInvocationError = `${toolName}: ${errorMsg}`;
+    }
+}

package/dist/resources/extensions/gsd/auto-start.js

@@ -208,7 +208,7 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
         else {
             // Branch is NOT merged — preserve for safety, warn the user
             warnings.push(`Branch ${branch} exists for completed milestone ${milestoneId} but is NOT merged into ${mainBranch}. ` +
-                `This may contain unmerged work. Merge manually or run \`/gsd health --fix\` to resolve.`);
+                `This may contain unmerged work. Merge manually or run \`/gsd doctor fix\` to resolve.`);
             // #4764 telemetry
             try {
                 emitWorktreeOrphaned(basePath, milestoneId, {

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -139,6 +139,6 @@ export const DETERMINISTIC_POLICY_ERROR_STRINGS = [
 export function isDeterministicPolicyError(errorMsg) {
     if (!errorMsg)
         return false;
-    return (DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg) ||
-        DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s)));
+    return DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg)
+        || DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s));
 }

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -857,6 +857,11 @@ export function runWorktreePostCreateHook(sourceDir, worktreeDir, hookPath) {
 export function autoWorktreeBranch(milestoneId) {
     return `milestone/${milestoneId}`;
 }
+function normalizeLocalBranchRef(branch) {
+    return branch.startsWith("refs/heads/")
+        ? branch.slice("refs/heads/".length)
+        : branch;
+}
 // ─── Branch-mode Entry ─────────────────────────────────────────────────────
 /**
  * Enter branch isolation mode for a milestone.
@@ -1033,6 +1038,13 @@ function reconcilePlanCheckboxes(projectRoot, wtPath, milestoneId) {
     }
 }
 export function createAutoWorktree(basePath, milestoneId) {
+    // Check if repo has commits — git worktree requires a valid HEAD
+    try {
+        execFileSync("git", ["rev-parse", "--verify", "HEAD"], { cwd: basePath, stdio: "pipe" });
+    }
+    catch {
+        throw new GSDError(GSD_GIT_ERROR, `Cannot create worktree: repository has no commits yet. Worktree isolation requires at least one commit.`);
+    }
     const branch = autoWorktreeBranch(milestoneId);
     // Check if the milestone branch already exists — it survives auto-mode
     // stop/pause and contains committed work from prior sessions. If it exists,
@@ -1408,6 +1420,10 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         }
     }
     // 3. chdir to original base
+    // Note: previousCwd captures the cwd at this point — i.e. the worktree cwd
+    // entering the function. Subsequent throws restore to previousCwd, leaving
+    // the caller in worktree-cwd; callers (worktree-resolver) are responsible
+    // for any further cwd movement on the error path.
     const previousCwd = process.cwd();
     process.chdir(originalBasePath_);
     // 4. Resolve integration branch — prefer milestone metadata, then preferences,
@@ -1422,6 +1438,20 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         ? prefs.main_branch
         : undefined;
     const mainBranch = integrationBranch ?? validatedPrefBranch ?? nativeDetectMainBranch(originalBasePath_);
+    // Fail closed when the resolved integration branch is the milestone branch
+    // itself (#5024). Stale or corrupt metadata (e.g. integrationBranch recorded
+    // as "milestone/<MID>") would otherwise let the squash merge resolve to a
+    // self-merge: nothing-to-commit + empty self-diff in the post-merge safety
+    // check (#1792) collapse to a false success, and the worktree-resolver
+    // emits worktree-merged for work that never landed on a distinct
+    // integration branch.
+    if (normalizeLocalBranchRef(mainBranch) === milestoneBranch) {
+        process.chdir(previousCwd);
+        throw new GSDError(GSD_GIT_ERROR, `Resolved integration branch "${mainBranch}" is the same ref as milestone branch ` +
+            `"${milestoneBranch}" — refusing to self-merge. Integration branch metadata is invalid; ` +
+            `set a distinct main_branch in GSD preferences or repair the milestone integration record ` +
+            `before retrying milestone completion.`);
+    }
     // Remove transient project-root state files before any branch or merge
     // operation. Untracked milestone metadata can otherwise block squash merges.
     clearProjectRootStateFiles(originalBasePath_, milestoneId);