gsd-pi 2.78.0 → 2.78.1-dev.8a893322c

package/src/resources/extensions/gsd/auto/phases.ts

@@ -26,6 +26,7 @@ import {
 import { detectStuck } from "./detect-stuck.js";
 import { runUnit } from "./run-unit.js";
 import { debugLog } from "../debug-logger.js";
+import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { PROJECT_FILES, hasProjectFileInAncestor } from "../detection.js";
 import { MergeConflictError } from "../git-service.js";
 import { setCurrentPhase, clearCurrentPhase } from "../../shared/gsd-phase-state.js";
@@ -81,11 +82,7 @@ export function resetSessionTimeoutState(): void {
  * Exported for testing as _resolveReportBasePath.
  */
 export function _resolveReportBasePath(s: Pick<AutoSession, "originalBasePath" | "basePath">): string {
-  // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
-  // originalBasePath is falsy — prevents reports landing in the worktree (#3729).
-  const resolved = s.originalBasePath || s.basePath;
-  const markerIdx = resolved.indexOf("/.gsd/worktrees/");
-  return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
+  return resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
 }
 
 /**
@@ -96,12 +93,7 @@ export function _resolveReportBasePath(s: Pick<AutoSession, "originalBasePath" |
 export function _resolveDispatchGuardBasePath(
   s: Pick<AutoSession, "originalBasePath" | "basePath">,
 ): string {
-  // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
-  // originalBasePath is falsy — prevents guard checks running against the
-  // worktree instead of the project root (#3729).
-  const resolved = s.originalBasePath || s.basePath;
-  const markerIdx = resolved.indexOf("/.gsd/worktrees/");
-  return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
+  return resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
 }
 
 const PLAN_V2_GATE_PHASES: ReadonlySet<Phase> = new Set([
@@ -1342,7 +1334,7 @@ export async function runUnitPhase(
   iterData: IterationData,
   loopState: LoopState,
   sidecarItem?: SidecarItem,
-): Promise<PhaseResult<{ unitStartedAt: number }>> {
+): Promise<PhaseResult<{ unitStartedAt?: number; requestDispatchedAt?: number }>> {
   const { ctx, pi, s, deps, prefs } = ic;
   const { unitType, unitId, prompt, state, mid } = iterData;
 
@@ -1860,7 +1852,7 @@ export async function runUnitPhase(
         );
         // Fall through to next iteration where dispatch will re-derive
         // and re-dispatch this unit.
-        return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt } };
+        return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt, requestDispatchedAt: unitResult.requestDispatchedAt } };
       }
     }
   }
@@ -1924,7 +1916,7 @@ export async function runUnitPhase(
     s.checkpointSha = null;
   }
 
-  return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt } };
+  return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt, requestDispatchedAt: unitResult.requestDispatchedAt } };
 }
 
 // ─── runFinalize ──────────────────────────────────────────────────────────────

package/src/resources/extensions/gsd/auto/run-unit.ts

@@ -171,6 +171,7 @@ export async function runUnit(
   // ── Send the prompt ──
   debugLog("runUnit", { phase: "send-message", unitType, unitId });
 
+  const requestDispatchedAt = Date.now();
   pi.sendMessage(
     { customType: "gsd-auto", content: prompt, display: s.verbose },
     { triggerTurn: true },
@@ -201,6 +202,7 @@ export async function runUnit(
     unitId,
     status: result.status,
   });
+  const finalResult: UnitResult = { ...result, requestDispatchedAt };
 
   // Discard trailing follow-up messages (e.g. async_job_result notifications)
   // from the completed unit. Without this, queued follow-ups trigger wasteful
@@ -216,5 +218,5 @@ export async function runUnit(
     logWarning("engine", "clearQueue failed after unit completion", { error: String(e) });
   }
 
-  return result;
+  return finalResult;
 }

package/src/resources/extensions/gsd/auto/session.ts

@@ -21,6 +21,7 @@ import type { ExtensionAPI, ExtensionCommandContext } from "@gsd/pi-coding-agent
 import type { GitServiceImpl } from "../git-service.js";
 import type { CaptureEntry } from "../captures.js";
 import type { BudgetAlertLevel } from "../auto-budget.js";
+import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 
 // ─── Exported Types ──────────────────────────────────────────────────────────
 
@@ -193,6 +194,8 @@ export class AutoSession {
   lastPromptCharCount: number | undefined;
   lastBaselineCharCount: number | undefined;
   pendingQuickTasks: CaptureEntry[] = [];
+  /** Timestamp of the last LLM request dispatch (ms since epoch). Used for proactive rate limiting. */
+  lastRequestTimestamp = 0;
 
   // ── Safety harness ───────────────────────────────────────────────────────
   /** SHA of the pre-unit git checkpoint ref. Cleared on success or rollback. */
@@ -224,12 +227,7 @@ export class AutoSession {
   }
 
   get lockBasePath(): string {
-    // Prefer originalBasePath (project root); fall back to basePath.
-    // Strip /.gsd/worktrees/ suffix if basePath is itself a worktree path
-    // to avoid reading/writing the lock inside the worktree (#3729).
-    const resolved = this.originalBasePath || this.basePath;
-    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
-    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
+    return resolveWorktreeProjectRoot(this.basePath, this.originalBasePath);
   }
 
   reset(): void {
@@ -294,6 +292,7 @@ export class AutoSession {
     this.lastPromptCharCount = undefined;
     this.lastBaselineCharCount = undefined;
     this.pendingQuickTasks = [];
+    this.lastRequestTimestamp = 0;
     this.sidecarQueue = [];
     this.rewriteAttemptCount = 0;
     this.consecutiveCompleteBootstraps = 0;

package/src/resources/extensions/gsd/auto/types.ts

@@ -66,6 +66,7 @@ export interface UnitResult {
   status: "completed" | "cancelled" | "error";
   event?: AgentEndEvent;
   errorContext?: ErrorContext;
+  requestDispatchedAt?: number;
 }
 
 // ─── Phase pipeline types ────────────────────────────────────────────────────

package/src/resources/extensions/gsd/auto-dashboard.ts

@@ -19,6 +19,7 @@ import { getActiveHook } from "./post-unit-hooks.js";
 import { getLedger, getProjectTotals } from "./metrics.js";
 import { getErrorMessage } from "./error-utils.js";
 import { nativeIsRepo } from "./native-git-bridge.js";
+import { getHomeDir } from "./home-dir.js";
 import {
   resolveMilestoneFile,
   resolveSliceFile,
@@ -582,8 +583,8 @@ export function updateProgressWidget(
   let widgetPwd: string;
   {
     let fullPwd = process.cwd();
-    const widgetHome = process.env.HOME || process.env.USERPROFILE;
-    if (widgetHome && fullPwd.startsWith(widgetHome)) {
+    const widgetHome = getHomeDir();
+    if (widgetHome && (fullPwd === widgetHome || fullPwd.startsWith(widgetHome + "/") || fullPwd.startsWith(widgetHome + "\\"))) {
       fullPwd = `~${fullPwd.slice(widgetHome.length)}`;
     }
     const parts = fullPwd.split("/");

package/src/resources/extensions/gsd/auto-dispatch.ts

@@ -797,14 +797,25 @@ export const DISPATCH_RULES: DispatchRule[] = [
       if (state.phase !== "executing" || !state.activeTask) return null;
       if (!state.activeSlice) return null; // fall through
 
-      // Only activate when reactive_execution is explicitly enabled
+      // Reactive dispatch is on by default when there are enough ready tasks to
+      // benefit from parallelism. Users opt out explicitly via
+      // `reactive_execution.enabled: false`. The downstream safety checks
+      // (graph ambiguity, ready-task count, conflict-free selection) still gate
+      // every actual dispatch, so the worst-case "default-on" outcome is the
+      // same fall-through to sequential execution as before.
       const reactiveConfig = prefs?.reactive_execution;
-      if (!reactiveConfig?.enabled) return null;
+      if (reactiveConfig?.enabled === false) return null;
 
       const sid = state.activeSlice.id;
       const sTitle = state.activeSlice.title;
-      const maxParallel = reactiveConfig.max_parallel ?? 2;
-      const subagentModel = reactiveConfig.subagent_model ?? resolveModelWithFallbacksForUnit("subagent")?.primary;
+      const maxParallel = reactiveConfig?.max_parallel ?? 2;
+      const subagentModel = reactiveConfig?.subagent_model ?? resolveModelWithFallbacksForUnit("subagent")?.primary;
+      // Default-on safety threshold: only activate reactive dispatch when at
+      // least N tasks are ready. Users who explicitly enabled reactive_execution
+      // keep the legacy threshold of 2 (matches the prior "any parallelism is
+      // better than none" intent). Default-on installs require >=3 to avoid
+      // surprising users with parallelism on small slices.
+      const minReadyTasksForReactive = reactiveConfig?.enabled === true ? 2 : 3;
 
       // Dry-run mode: max_parallel=1 means graph is derived and logged but
       // execution remains sequential
@@ -831,8 +842,9 @@ export const DISPATCH_RULES: DispatchRule[] = [
         const completed = new Set(graph.filter((n) => n.done).map((n) => n.id));
         const readyIds = getReadyTasks(graph, completed, new Set());
 
-        // Only activate reactive dispatch when >1 task is ready
-        if (readyIds.length <= 1) return null;
+        // Only activate reactive dispatch when enough tasks are ready.
+        // Threshold is 2 when explicitly opted in, 3 when default-on.
+        if (readyIds.length < minReadyTasksForReactive) return null;
 
         const uokFlags = resolveUokFlags(prefs);
         const selected = uokFlags.executionGraph

package/src/resources/extensions/gsd/auto-prompts.ts

@@ -37,7 +37,7 @@ import { composeInlinedContext, type ArtifactResolver } from "./unit-context-com
 import { logWarning } from "./workflow-logger.js";
 import { inlineGraphSubgraph } from "./graph-context.js";
 import { buildExtractionStepsBlock } from "./commands-extract-learnings.js";
-import { warnIfManifestHasMissingSkills } from "./skill-manifest.js";
+import { resolveSkillManifest, warnIfManifestHasMissingSkills } from "./skill-manifest.js";
 
 // ─── Preamble Cap ─────────────────────────────────────────────────────────────
 
@@ -776,6 +776,25 @@ function formatSkillActivationBlock(skillNames: string[]): string {
   return `<skill_activation>${calls}.</skill_activation>`;
 }
 
+/**
+ * Manifest-driven recommendations block — informational only, does NOT
+ * auto-invoke. Lists per-unit-type skills that are installed but not already
+ * activated by explicit user intent (always_use_skills / prefer_skills /
+ * skill_rules / task-plan skills_used). Surfaces relevant skills to the
+ * model so they can be invoked when the model judges them useful.
+ *
+ * This is the additive complement to the existing activation directive:
+ * activation force-invokes (explicit intent), recommendations remind
+ * (manifest defaults). User intent is preserved as the stronger signal
+ * (RFC #4779 design principle); this block only adds visibility.
+ */
+function formatSkillRecommendationsBlock(unitType: string | undefined, skillNames: string[]): string {
+  if (!unitType) return "";
+  const safe = skillNames.filter(name => SAFE_SKILL_NAME.test(name));
+  if (safe.length === 0) return "";
+  return `<skill_recommendations unit="${unitType}">For this unit type, also consider invoking: ${safe.join(", ")}. Use Skill({ skill: 'name' }) when relevant — these are recommendations, not requirements.</skill_recommendations>`;
+}
+
 export function buildSkillActivationBlock(params: {
   base: string;
   milestoneId: string;
@@ -846,10 +865,49 @@ export function buildSkillActivationBlock(params: {
     }
   }
 
+  // Heuristic auto-match (gated on skill_discovery: "auto").
+  // For each installed skill, check if its name or description appears in the
+  // unit's context tokens (milestone/slice/task titles). Only consider skills
+  // already on the unit-type manifest allowlist — this keeps the heuristic
+  // narrow and avoids wildly off-topic activations.
+  // Users who set `skill_discovery: "off"` or "suggest" do not get
+  // auto-matched skills (the recommendations block still surfaces manifest
+  // skills passively); only "auto" actually adds them to the activation
+  // directive set. Default `skill_discovery` is "suggest", so this is opt-in.
+  if ((prefs?.skill_discovery ?? "suggest") === "auto") {
+    const manifestAllow = resolveSkillManifest(params.unitType);
+    const allowSet = manifestAllow ? new Set(manifestAllow) : null;
+    for (const skill of visibleSkills) {
+      const normalized = normalizeSkillReference(skill.name);
+      if (matched.has(normalized) || avoided.has(normalized)) continue;
+      // Respect the manifest allowlist when present; wildcard (null) lets all
+      // installed skills compete for keyword match.
+      if (allowSet && !allowSet.has(normalized)) continue;
+      if (skillMatchesContext(skill, contextTokens)) {
+        matched.add(normalized);
+      }
+    }
+  }
+
   const ordered = [...matched]
     .filter(name => installedNames.has(name) && !avoided.has(name))
     .sort();
-  return formatSkillActivationBlock(ordered);
+  const activationBlock = formatSkillActivationBlock(ordered);
+
+  // Manifest-driven recommendations (additive, does not override explicit intent).
+  // Only surface skills the manifest declares for this unit type that are
+  // installed and not already in matched/avoided.
+  const matchedSet = new Set(ordered);
+  const manifestList = resolveSkillManifest(params.unitType);
+  const recommendations = (manifestList ?? [])
+    .filter(name => installedNames.has(name) && !avoided.has(name) && !matchedSet.has(name))
+    .sort();
+  const recommendationsBlock = formatSkillRecommendationsBlock(params.unitType, recommendations);
+
+  if (!activationBlock && !recommendationsBlock) return "";
+  if (!activationBlock) return recommendationsBlock;
+  if (!recommendationsBlock) return activationBlock;
+  return `${activationBlock}\n${recommendationsBlock}`;
 }
 
 /**

package/src/resources/extensions/gsd/auto-recovery.ts

@@ -9,6 +9,7 @@
 
 import type { ExtensionContext } from "@gsd/pi-coding-agent";
 import { parseUnitId } from "./unit-id.js";
+import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
@@ -213,13 +214,40 @@ function getChangedFilesSinceBranch(basePath: string, targetBranch: string): { o
 function getChangedFilesFromMilestoneTaggedCommits(
   basePath: string,
   milestoneId: string,
+): { ok: boolean; matched: boolean; files: string[] } {
+  // Primary: path-scoped log against .gsd/milestones/<id>. Fast and unbounded
+  // by depth when .gsd/ is tracked in git.
+  const scoped = scanGsdTaggedCommits(basePath, milestoneId, [
+    "log", "--format=%H%x1f%B%x1e", "HEAD", "--", `.gsd/milestones/${milestoneId}`,
+  ]);
+  if (!scoped.ok) return scoped;
+  if (scoped.matched) return scoped;
+
+  // Fallback (#5033): when .gsd/ is gitignored / external / untracked, the
+  // path-scoped scan matches no commits even though GSD-tagged commits
+  // referencing the milestone exist on the integration branch. Re-scan all
+  // of HEAD's history and rely on commitMatchesMilestone to bind by
+  // explicit milestone mention in the message body.
+  //
+  // Intentionally unbounded — symmetric with the primary scan, and avoids
+  // reintroducing the rolling-depth failure class removed in #4699 where
+  // milestone evidence aged out behind unrelated activity.
+  return scanGsdTaggedCommits(basePath, milestoneId, [
+    "log", "--format=%H%x1f%B%x1e", "HEAD",
+  ]);
+}
+
+function scanGsdTaggedCommits(
+  basePath: string,
+  milestoneId: string,
+  gitArgs: readonly string[],
 ): { ok: boolean; matched: boolean; files: string[] } {
   try {
-    const logOutput = execFileSync(
-      "git",
-      ["log", "--format=%H%x1f%B%x1e", "HEAD", "--", `.gsd/milestones/${milestoneId}`],
-      { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
-    );
+    const logOutput = execFileSync("git", [...gitArgs], {
+      cwd: basePath,
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf-8",
+    });
     const records = logOutput
       .split("\x1e")
       .map((record) => record.trim())
@@ -270,15 +298,25 @@ function commitMatchesMilestone(message: string, milestoneId: string, files: rea
   if (commitTrailerStartsWithMilestone(message, milestoneId)) return true;
 
   // Meaningful execute-task commits currently store task scope as Sxx/Tyy
-  // rather than Mxx/Sxx/Tyy. Bind those commits back to the milestone only
-  // when the commit also touched this milestone's artifacts.
+  // rather than Mxx/Sxx/Tyy. Bind those commits back to the milestone when
+  // either the commit touched this milestone's artifacts, or — for projects
+  // where .gsd/ is gitignored/external (#5033) — the message explicitly
+  // names the milestone.
   if (/^GSD-Task:\s*S[^/\s]+\/T\S+/m.test(message)) {
-    return files.some((file) => isMilestoneArtifactPath(file, milestoneId));
+    if (files.some((file) => isMilestoneArtifactPath(file, milestoneId))) return true;
+    if (commitMessageMentionsMilestone(message, milestoneId)) return true;
   }
 
   return false;
 }
 
+function commitMessageMentionsMilestone(message: string, milestoneId: string): boolean {
+  if (!MILESTONE_ID_RE.test(milestoneId)) return false;
+
+  const escapedMilestone = milestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\b${escapedMilestone}\\b`).test(message);
+}
+
 function commitTrailerStartsWithMilestone(message: string, milestoneId: string): boolean {
   const escapedMilestone = milestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const trailerPattern = new RegExp(

package/src/resources/extensions/gsd/auto-runtime-state.ts

@@ -0,0 +1,51 @@
+// GSD auto-mode runtime state
+import { AutoSession } from "./auto/session.js";
+import type { CurrentUnit } from "./auto/session.js";
+import {
+  isDeterministicPolicyError,
+  isQueuedUserMessageSkip,
+  isToolInvocationError,
+  markToolEnd as markTrackedToolEnd,
+  markToolStart as markTrackedToolStart,
+} from "./auto-tool-tracking.js";
+
+export const autoSession = new AutoSession();
+
+export type AutoRuntimeSnapshot = {
+  active: boolean;
+  paused: boolean;
+  currentUnit: CurrentUnit | null;
+  basePath: string;
+};
+
+export function getAutoRuntimeSnapshot(): AutoRuntimeSnapshot {
+  return {
+    active: autoSession.active,
+    paused: autoSession.paused,
+    currentUnit: autoSession.currentUnit ? { ...autoSession.currentUnit } : null,
+    basePath: autoSession.basePath,
+  };
+}
+
+export function isAutoActive(): boolean {
+  return autoSession.active;
+}
+
+export function isAutoPaused(): boolean {
+  return autoSession.paused;
+}
+
+export function markToolStart(toolCallId: string, toolName?: string): void {
+  markTrackedToolStart(toolCallId, autoSession.active, toolName);
+}
+
+export function markToolEnd(toolCallId: string): void {
+  markTrackedToolEnd(toolCallId);
+}
+
+export function recordToolInvocationError(toolName: string, errorMsg: string): void {
+  if (!autoSession.active) return;
+  if (isToolInvocationError(errorMsg) || isQueuedUserMessageSkip(errorMsg) || isDeterministicPolicyError(errorMsg)) {
+    autoSession.lastToolInvocationError = `${toolName}: ${errorMsg}`;
+  }
+}

package/src/resources/extensions/gsd/auto-start.ts

@@ -315,7 +315,7 @@ export function auditOrphanedMilestoneBranches(
       // Branch is NOT merged — preserve for safety, warn the user
       warnings.push(
         `Branch ${branch} exists for completed milestone ${milestoneId} but is NOT merged into ${mainBranch}. ` +
-        `This may contain unmerged work. Merge manually or run \`/gsd health --fix\` to resolve.`,
+        `This may contain unmerged work. Merge manually or run \`/gsd doctor fix\` to resolve.`,
       );
 
       // #4764 telemetry

package/src/resources/extensions/gsd/auto-tool-tracking.ts

@@ -151,8 +151,6 @@ export const DETERMINISTIC_POLICY_ERROR_STRINGS = [
  */
 export function isDeterministicPolicyError(errorMsg: string): boolean {
   if (!errorMsg) return false;
-  return (
-    DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg) ||
-    DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s))
-  );
+  return DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg)
+    || DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s));
 }

package/src/resources/extensions/gsd/auto-worktree.ts

@@ -46,6 +46,11 @@ import {
   resolveGitHeadPath,
   nudgeGitBranchCache,
 } from "./worktree.js";
+import {
+  isGsdWorktreePath,
+  normalizeWorktreePathForCompare,
+  resolveWorktreeProjectRoot,
+} from "./worktree-root.js";
 import { MergeConflictError, readIntegrationBranch, RUNTIME_EXCLUSION_PATHS } from "./git-service.js";
 import { debugLog } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
@@ -990,6 +995,12 @@ export function autoWorktreeBranch(milestoneId: string): string {
   return `milestone/${milestoneId}`;
 }
 
+function normalizeLocalBranchRef(branch: string): string {
+  return branch.startsWith("refs/heads/")
+    ? branch.slice("refs/heads/".length)
+    : branch;
+}
+
 // ─── Branch-mode Entry ─────────────────────────────────────────────────────
 
 /**
@@ -1196,6 +1207,18 @@ export function createAutoWorktree(
   basePath: string,
   milestoneId: string,
 ): string {
+  basePath = resolveWorktreeProjectRoot(basePath);
+
+  // Check if repo has commits — git worktree requires a valid HEAD
+  try {
+    execFileSync("git", ["rev-parse", "--verify", "HEAD"], { cwd: basePath, stdio: "pipe" });
+  } catch {
+    throw new GSDError(
+      GSD_GIT_ERROR,
+      `Cannot create worktree: repository has no commits yet. Worktree isolation requires at least one commit.`,
+    );
+  }
+
   const branch = autoWorktreeBranch(milestoneId);
 
   // Check if the milestone branch already exists — it survives auto-mode
@@ -1345,6 +1368,8 @@ export function teardownAutoWorktree(
   milestoneId: string,
   opts: { preserveBranch?: boolean } = {},
 ): void {
+  originalBasePath = resolveWorktreeProjectRoot(originalBasePath);
+
   const branch = autoWorktreeBranch(milestoneId);
   const { preserveBranch = false } = opts;
   const previousCwd = process.cwd();
@@ -1396,16 +1421,28 @@ export function teardownAutoWorktree(
 
 /**
  * Detect if the process is currently inside an auto-worktree.
- * Checks both module state and git branch prefix.
+ * Uses the current directory structure plus git branch prefix so detection
+ * still works after process restart when module state has been reset.
  */
 export function isInAutoWorktree(basePath: string): boolean {
-  if (!originalBase) return false;
   const cwd = process.cwd();
-  const resolvedBase = existsSync(basePath) ? realpathSync(basePath) : basePath;
-  const wtDir = join(resolvedBase, ".gsd", "worktrees");
-  if (!cwd.startsWith(wtDir)) return false;
-  const branch = nativeGetCurrentBranch(cwd);
-  return branch.startsWith("milestone/");
+  if (!isGsdWorktreePath(cwd)) return false;
+
+  const projectRoot = resolveWorktreeProjectRoot(basePath, originalBase);
+  const cwdProjectRoot = resolveWorktreeProjectRoot(cwd, originalBase);
+  if (
+    normalizeWorktreePathForCompare(projectRoot) !==
+    normalizeWorktreePathForCompare(cwdProjectRoot)
+  ) {
+    return false;
+  }
+
+  try {
+    const branch = nativeGetCurrentBranch(cwd);
+    return branch.startsWith("milestone/");
+  } catch {
+    return false;
+  }
 }
 
 /**
@@ -1420,6 +1457,8 @@ export function getAutoWorktreePath(
   basePath: string,
   milestoneId: string,
 ): string | null {
+  basePath = resolveWorktreeProjectRoot(basePath);
+
   const p = worktreePath(basePath, milestoneId);
   if (!existsSync(p)) return null;
 
@@ -1448,6 +1487,8 @@ export function enterAutoWorktree(
   basePath: string,
   milestoneId: string,
 ): string {
+  basePath = resolveWorktreeProjectRoot(basePath);
+
   const p = worktreePath(basePath, milestoneId);
   if (!existsSync(p)) {
     throw new GSDError(
@@ -1504,6 +1545,10 @@ export function getAutoWorktreeOriginalBase(): string | null {
   return originalBase;
 }
 
+export function _resetAutoWorktreeOriginalBaseForTests(): void {
+  originalBase = null;
+}
+
 export function getActiveAutoWorktreeContext(): {
   originalBase: string;
   worktreeName: string;
@@ -1511,11 +1556,14 @@ export function getActiveAutoWorktreeContext(): {
 } | null {
   if (!originalBase) return null;
   const cwd = process.cwd();
-  const resolvedBase = existsSync(originalBase)
-    ? realpathSync(originalBase)
-    : originalBase;
-  const wtDir = join(resolvedBase, ".gsd", "worktrees");
-  if (!cwd.startsWith(wtDir)) return null;
+  if (!isGsdWorktreePath(cwd)) return null;
+  const cwdProjectRoot = resolveWorktreeProjectRoot(cwd, originalBase);
+  if (
+    normalizeWorktreePathForCompare(cwdProjectRoot) !==
+    normalizeWorktreePathForCompare(originalBase)
+  ) {
+    return null;
+  }
   const worktreeName = detectWorktreeName(cwd);
   if (!worktreeName) return null;
   const branch = nativeGetCurrentBranch(cwd);
@@ -1636,6 +1684,10 @@ export function mergeMilestoneToMain(
   }
 
   // 3. chdir to original base
+  // Note: previousCwd captures the cwd at this point — i.e. the worktree cwd
+  // entering the function. Subsequent throws restore to previousCwd, leaving
+  // the caller in worktree-cwd; callers (worktree-resolver) are responsible
+  // for any further cwd movement on the error path.
   const previousCwd = process.cwd();
   process.chdir(originalBasePath_);
 
@@ -1656,6 +1708,24 @@ export function mergeMilestoneToMain(
   const mainBranch =
     integrationBranch ?? validatedPrefBranch ?? nativeDetectMainBranch(originalBasePath_);
 
+  // Fail closed when the resolved integration branch is the milestone branch
+  // itself (#5024). Stale or corrupt metadata (e.g. integrationBranch recorded
+  // as "milestone/<MID>") would otherwise let the squash merge resolve to a
+  // self-merge: nothing-to-commit + empty self-diff in the post-merge safety
+  // check (#1792) collapse to a false success, and the worktree-resolver
+  // emits worktree-merged for work that never landed on a distinct
+  // integration branch.
+  if (normalizeLocalBranchRef(mainBranch) === milestoneBranch) {
+    process.chdir(previousCwd);
+    throw new GSDError(
+      GSD_GIT_ERROR,
+      `Resolved integration branch "${mainBranch}" is the same ref as milestone branch ` +
+      `"${milestoneBranch}" — refusing to self-merge. Integration branch metadata is invalid; ` +
+      `set a distinct main_branch in GSD preferences or repair the milestone integration record ` +
+      `before retrying milestone completion.`,
+    );
+  }
+
   // Remove transient project-root state files before any branch or merge
   // operation. Untracked milestone metadata can otherwise block squash merges.
   clearProjectRootStateFiles(originalBasePath_, milestoneId);