gsd-pi 2.80.0-dev.42bd34838 → 2.80.0-dev.488219eb6

package/dist/resources/extensions/gsd/auto/phases.js

@@ -1,3 +1,5 @@
+// Project/App: GSD-2
+// File Purpose: Auto-loop pipeline phases, merge closeout, and finalize handling.
 /**
  * auto/phases.ts — Pipeline phases for the auto-loop.
  *
@@ -42,6 +44,11 @@ import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit,
 function isSamePathLocal(a, b) {
     return normalizeWorktreePathForCompare(a) === normalizeWorktreePathForCompare(b);
 }
+export function shouldDegradeEmptyWorktreeToProjectRoot(worktreeClassification, projectRootClassification) {
+    return (worktreeClassification.kind === "greenfield" &&
+        projectRootClassification.kind !== "greenfield" &&
+        projectRootClassification.kind !== "invalid-repo");
+}
 // ─── Session timeout auto-resume state ────────────────────────────────────────
 let consecutiveSessionTimeouts = 0;
 const MAX_SESSION_TIMEOUT_AUTO_RESUMES = 3;
@@ -71,9 +78,15 @@ const PLAN_V2_GATE_PHASES = new Set([
     "validating-milestone",
     "completing-milestone",
 ]);
-function shouldRunPlanV2Gate(phase) {
+export function shouldRunPlanV2Gate(phase) {
     return PLAN_V2_GATE_PHASES.has(phase);
 }
+export function _shouldProceedWithInvalidRepoClassificationForTest(reason, hasGit) {
+    return reason === "missing .git" && hasGit;
+}
+export function _resolveCurrentUnitStartedAtForTest(currentUnit) {
+    return currentUnit?.startedAt;
+}
 /**
  * Generate and write an HTML milestone report snapshot.
  * Extracted from the milestone-transition block in autoLoop.
@@ -129,6 +142,85 @@ async function closeoutAndStop(ctx, pi, s, deps, reason) {
     }
     await deps.stopAuto(ctx, pi, reason);
 }
+async function stopOnPostflightRecoveryNeeded(ic, result, milestoneId) {
+    if (!result.needsManualRecovery)
+        return null;
+    const { ctx, pi, deps } = ic;
+    const reason = `Post-merge stash restore failed for milestone ${milestoneId}`;
+    ctx.ui.notify(`${reason}. Resolve the working tree before resuming auto-mode. ${result.message}`, "error");
+    await deps.stopAuto(ctx, pi, reason);
+    return { action: "break", reason: "postflight-stash-restore-failed" };
+}
+async function restorePreflightStashOrStop(ic, preflight, milestoneId) {
+    if (!preflight.stashPushed)
+        return null;
+    const { ctx, s, deps } = ic;
+    const result = deps.postflightPopStash(s.originalBasePath || s.basePath, milestoneId, preflight.stashMarker, ctx.ui.notify.bind(ctx.ui));
+    return stopOnPostflightRecoveryNeeded(ic, result, milestoneId);
+}
+/**
+ * Run a milestone merge surrounded by preflight stash + always-on postflight
+ * pop. The previous code popped the stash only after a successful merge, which
+ * leaked `gsd-preflight-stash:M00x:*` entries whenever `mergeAndExit` threw —
+ * leaving the user's pre-merge working tree silently stashed away after a
+ * merge-conflict or other merge error. This helper restores the stash on
+ * every exit path, then surfaces the merge or stash failure (in priority
+ * order) as the loop's stop reason.
+ *
+ * Returns a `break` action when auto-mode must stop, or `null` when the merge
+ * succeeded and the stash (if any) was restored cleanly.
+ */
+export async function _runMilestoneMergeWithStashRestore(ic, milestoneId) {
+    const { ctx, pi, s, deps } = ic;
+    const preflight = deps.preflightCleanRoot(s.originalBasePath || s.basePath, milestoneId, ctx.ui.notify.bind(ctx.ui));
+    let mergeError = null;
+    try {
+        deps.resolver.mergeAndExit(milestoneId, ctx.ui);
+        s.milestoneMergedInPhases = true;
+    }
+    catch (mergeErr) {
+        mergeError = mergeErr;
+    }
+    // Always attempt to restore the stashed working tree, even on merge error.
+    // postflightPopStash itself does not throw; failures surface via the
+    // PostflightResult.needsManualRecovery flag.
+    let stashResult = null;
+    if (preflight.stashPushed) {
+        stashResult = deps.postflightPopStash(s.originalBasePath || s.basePath, milestoneId, preflight.stashMarker, ctx.ui.notify.bind(ctx.ui));
+    }
+    // Merge failure takes priority over stash recovery — the merge is the
+    // authoritative gate. If the stash also needed manual recovery, the user
+    // already saw the postflightPopStash notify above.
+    if (mergeError) {
+        if (mergeError instanceof MergeConflictError) {
+            ctx.ui.notify(`Merge conflict: ${mergeError.conflictedFiles.join(", ")}. Resolve conflicts manually and run /gsd auto to resume.`, "error");
+            await deps.stopAuto(ctx, pi, `Merge conflict on milestone ${milestoneId}`);
+            return { action: "break", reason: "merge-conflict" };
+        }
+        logError("engine", "Milestone merge failed with non-conflict error", {
+            milestone: milestoneId,
+            error: String(mergeError),
+        });
+        ctx.ui.notify(`Merge failed: ${mergeError instanceof Error ? mergeError.message : String(mergeError)}. Resolve and run /gsd auto to resume.`, "error");
+        await deps.stopAuto(ctx, pi, `Merge error on milestone ${milestoneId}: ${String(mergeError)}`);
+        return { action: "break", reason: "merge-failed" };
+    }
+    if (stashResult) {
+        return stopOnPostflightRecoveryNeeded(ic, stashResult, milestoneId);
+    }
+    return null;
+}
+export async function _runMilestoneMergeOnceWithStashRestore(ic, milestoneId) {
+    if (ic.s.milestoneMergedInPhases) {
+        debugLog("autoLoop", {
+            phase: "milestone-merge-skip",
+            reason: "already-merged-in-phases",
+            milestoneId,
+        });
+        return null;
+    }
+    return _runMilestoneMergeWithStashRestore(ic, milestoneId);
+}
 async function emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, errorContext) {
     ic.deps.emitJournalEvent({
         ts: new Date().toISOString(),
@@ -470,28 +562,12 @@ export async function runPreDispatch(ic, loopState) {
         s.unitLifetimeDispatches.clear();
         loopState.recentUnits.length = 0;
         loopState.stuckRecoveryAttempts = 0;
-        // Worktree lifecycle on milestone transition — merge current, enter next
-        // #2909: preflight — warn + stash dirty working tree before merge
-        const preflightTransition = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
-        try {
-            deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
-        }
-        catch (mergeErr) {
-            if (mergeErr instanceof MergeConflictError) {
-                // Real code conflicts — stop the loop instead of retrying forever (#2330)
-                ctx.ui.notify(`Merge conflict: ${mergeErr.conflictedFiles.join(", ")}. Resolve conflicts manually and run /gsd auto to resume.`, "error");
-                await deps.stopAuto(ctx, pi, `Merge conflict on milestone ${s.currentMilestoneId}`);
-                return { action: "break", reason: "merge-conflict" };
-            }
-            // Non-conflict merge errors — stop auto to avoid advancing with unmerged work
-            logError("engine", "Milestone merge failed with non-conflict error", { milestone: s.currentMilestoneId, error: String(mergeErr) });
-            ctx.ui.notify(`Merge failed: ${mergeErr instanceof Error ? mergeErr.message : String(mergeErr)}. Resolve and run /gsd auto to resume.`, "error");
-            await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
-            return { action: "break", reason: "merge-failed" };
-        }
-        // #2909: postflight — restore stashed changes after successful merge
-        if (preflightTransition.stashPushed) {
-            deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, preflightTransition.stashMarker, ctx.ui.notify.bind(ctx.ui));
+        // Worktree lifecycle on milestone transition — merge current, enter next.
+        // #2909 / #5538-followup: preflight stash + always-on postflight pop.
+        {
+            const stop = await _runMilestoneMergeOnceWithStashRestore(ic, s.currentMilestoneId);
+            if (stop)
+                return stop;
         }
         // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         deps.invalidateAllCaches();
@@ -545,30 +621,12 @@ export async function runPreDispatch(ic, loopState) {
         }
         const incomplete = state.registry.filter((m) => m.status !== "complete" && m.status !== "parked");
         if (incomplete.length === 0 && state.registry.length > 0) {
-            // All milestones complete — merge milestone branch before stopping
+            // All milestones complete — merge milestone branch before stopping.
             if (s.currentMilestoneId) {
-                // #2909: preflight — warn + stash dirty working tree before merge
-                const preflightAllComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
-                try {
-                    deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
-                    // Prevent stopAuto from attempting the same merge (#2645)
-                    s.milestoneMergedInPhases = true;
-                }
-                catch (mergeErr) {
-                    if (mergeErr instanceof MergeConflictError) {
-                        ctx.ui.notify(`Merge conflict: ${mergeErr.conflictedFiles.join(", ")}. Resolve conflicts manually and run /gsd auto to resume.`, "error");
-                        await deps.stopAuto(ctx, pi, `Merge conflict on milestone ${s.currentMilestoneId}`);
-                        return { action: "break", reason: "merge-conflict" };
-                    }
-                    logError("engine", "Milestone merge failed with non-conflict error", { milestone: s.currentMilestoneId, error: String(mergeErr) });
-                    ctx.ui.notify(`Merge failed: ${mergeErr instanceof Error ? mergeErr.message : String(mergeErr)}. Resolve and run /gsd auto to resume.`, "error");
-                    await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
-                    return { action: "break", reason: "merge-failed" };
-                }
-                // #2909: postflight — restore stashed changes after successful merge
-                if (preflightAllComplete.stashPushed) {
-                    deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, preflightAllComplete.stashMarker, ctx.ui.notify.bind(ctx.ui));
-                }
+                // #2909 / #5538-followup: preflight stash + always-on postflight pop.
+                const stop = await _runMilestoneMergeOnceWithStashRestore(ic, s.currentMilestoneId);
+                if (stop)
+                    return stop;
                 // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
             }
             deps.sendDesktopNotification("GSD", "All milestones complete!", "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -631,30 +689,12 @@ export async function runPreDispatch(ic, loopState) {
     }
     // Terminal: complete
     if (state.phase === "complete") {
-        // Milestone merge on complete (before closeout so branch state is clean)
+        // Milestone merge on complete (before closeout so branch state is clean).
         if (s.currentMilestoneId) {
-            // #2909: preflight — warn + stash dirty working tree before merge
-            const preflightComplete = deps.preflightCleanRoot(s.originalBasePath || s.basePath, s.currentMilestoneId, ctx.ui.notify.bind(ctx.ui));
-            try {
-                deps.resolver.mergeAndExit(s.currentMilestoneId, ctx.ui);
-                // Prevent stopAuto from attempting the same merge (#2645)
-                s.milestoneMergedInPhases = true;
-            }
-            catch (mergeErr) {
-                if (mergeErr instanceof MergeConflictError) {
-                    ctx.ui.notify(`Merge conflict: ${mergeErr.conflictedFiles.join(", ")}. Resolve conflicts manually and run /gsd auto to resume.`, "error");
-                    await deps.stopAuto(ctx, pi, `Merge conflict on milestone ${s.currentMilestoneId}`);
-                    return { action: "break", reason: "merge-conflict" };
-                }
-                logError("engine", "Milestone merge failed with non-conflict error", { milestone: s.currentMilestoneId, error: String(mergeErr) });
-                ctx.ui.notify(`Merge failed: ${mergeErr instanceof Error ? mergeErr.message : String(mergeErr)}. Resolve and run /gsd auto to resume.`, "error");
-                await deps.stopAuto(ctx, pi, `Merge error on milestone ${s.currentMilestoneId}: ${String(mergeErr)}`);
-                return { action: "break", reason: "merge-failed" };
-            }
-            // #2909: postflight — restore stashed changes after successful merge
-            if (preflightComplete.stashPushed) {
-                deps.postflightPopStash(s.originalBasePath || s.basePath, s.currentMilestoneId, preflightComplete.stashMarker, ctx.ui.notify.bind(ctx.ui));
-            }
+            // #2909 / #5538-followup: preflight stash + always-on postflight pop.
+            const stop = await _runMilestoneMergeOnceWithStashRestore(ic, s.currentMilestoneId);
+            if (stop)
+                return stop;
             // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
         }
         deps.sendDesktopNotification("GSD", `Milestone ${mid} complete!`, "success", "milestone", basename(s.originalBasePath || s.basePath));
@@ -747,6 +787,48 @@ export async function runDispatch(ic, preData, loopState) {
     let unitId = dispatchResult.unitId;
     let prompt = dispatchResult.prompt;
     const pauseAfterUatDispatch = dispatchResult.pauseAfterDispatch ?? false;
+    // Resolve hooks and prior-slice gating before health/stuck accounting so
+    // those checks run against the final dispatch unit.
+    const preDispatchResult = deps.runPreDispatchHooks(unitType, unitId, prompt, s.basePath);
+    if (preDispatchResult.firedHooks.length > 0) {
+        ctx.ui.notify(`Pre-dispatch hook${preDispatchResult.firedHooks.length > 1 ? "s" : ""}: ${preDispatchResult.firedHooks.join(", ")}`, "info");
+        deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: ic.nextSeq(), eventType: "pre-dispatch-hook", data: { firedHooks: preDispatchResult.firedHooks, action: preDispatchResult.action } });
+    }
+    if (preDispatchResult.action === "skip") {
+        ctx.ui.notify(`Skipping ${unitType} ${unitId} (pre-dispatch hook).`, "info");
+        await new Promise((r) => setImmediate(r));
+        return { action: "continue" };
+    }
+    if (preDispatchResult.action === "replace") {
+        prompt = preDispatchResult.prompt ?? prompt;
+        if (preDispatchResult.unitType)
+            unitType = preDispatchResult.unitType;
+    }
+    else if (preDispatchResult.prompt) {
+        prompt = preDispatchResult.prompt;
+    }
+    const guardBasePath = _resolveDispatchGuardBasePath(s);
+    const priorSliceBlocker = deps.getPriorSliceCompletionBlocker(guardBasePath, deps.getMainBranch(guardBasePath), unitType, unitId);
+    if (priorSliceBlocker) {
+        await deps.stopAuto(ctx, pi, priorSliceBlocker);
+        debugLog("autoLoop", { phase: "exit", reason: "prior-slice-blocker" });
+        return { action: "break", reason: "prior-slice-blocker" };
+    }
+    // Execute-task needs a real writable checkout. The same health check also
+    // exists in runUnitPhase, but the stuck-window detector runs before that
+    // phase. Check here too so repeated derivations of a broken worktree stop
+    // with the actionable worktree error instead of the generic stuck-loop error.
+    if (s.basePath && unitType === "execute-task") {
+        const gitMarker = join(s.basePath, ".git");
+        const hasGit = deps.existsSync(gitMarker);
+        if (!hasGit) {
+            const msg = `Worktree health check failed: ${s.basePath} has no .git — refusing to dispatch ${unitType} ${unitId}`;
+            debugLog("autoLoop", { phase: "dispatch-worktree-health-fail", basePath: s.basePath, hasGit });
+            ctx.ui.notify(msg, "error");
+            await deps.stopAuto(ctx, pi, msg);
+            return { action: "break", reason: "worktree-invalid" };
+        }
+    }
     // ── Sliding-window stuck detection with graduated recovery ──
     const derivedKey = `${unitType}/${unitId}`;
     // Always record this dispatch in the sliding window so detectStuck() has
@@ -863,32 +945,6 @@ export async function runDispatch(ic, preData, loopState) {
             }
         }
     }
-    // Pre-dispatch hooks
-    const preDispatchResult = deps.runPreDispatchHooks(unitType, unitId, prompt, s.basePath);
-    if (preDispatchResult.firedHooks.length > 0) {
-        ctx.ui.notify(`Pre-dispatch hook${preDispatchResult.firedHooks.length > 1 ? "s" : ""}: ${preDispatchResult.firedHooks.join(", ")}`, "info");
-        deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: ic.nextSeq(), eventType: "pre-dispatch-hook", data: { firedHooks: preDispatchResult.firedHooks, action: preDispatchResult.action } });
-    }
-    if (preDispatchResult.action === "skip") {
-        ctx.ui.notify(`Skipping ${unitType} ${unitId} (pre-dispatch hook).`, "info");
-        await new Promise((r) => setImmediate(r));
-        return { action: "continue" };
-    }
-    if (preDispatchResult.action === "replace") {
-        prompt = preDispatchResult.prompt ?? prompt;
-        if (preDispatchResult.unitType)
-            unitType = preDispatchResult.unitType;
-    }
-    else if (preDispatchResult.prompt) {
-        prompt = preDispatchResult.prompt;
-    }
-    const guardBasePath = _resolveDispatchGuardBasePath(s);
-    const priorSliceBlocker = deps.getPriorSliceCompletionBlocker(guardBasePath, deps.getMainBranch(guardBasePath), unitType, unitId);
-    if (priorSliceBlocker) {
-        await deps.stopAuto(ctx, pi, priorSliceBlocker);
-        debugLog("autoLoop", { phase: "exit", reason: "prior-slice-blocker" });
-        return { action: "break", reason: "prior-slice-blocker" };
-    }
     return {
         action: "next",
         data: {
@@ -1108,7 +1164,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         if (projectClassification.kind === "invalid-repo") {
             const msg = `Worktree health check failed: ${s.basePath} classified as invalid-repo (${projectClassification.reason}) — refusing to dispatch ${unitType} ${unitId}`;
             debugLog("runUnitPhase", { phase: "worktree-health-invalid-repo", basePath: s.basePath, classification: projectClassification });
-            if (projectClassification.reason === "missing .git" && hasGit) {
+            if (_shouldProceedWithInvalidRepoClassificationForTest(projectClassification.reason, hasGit)) {
                 ctx.ui.notify(`Warning: ${s.basePath} project classification could not confirm .git; assuming it has no project content yet — proceeding as greenfield project because worktree health reported .git present`, "warning");
             }
             else {
@@ -1118,6 +1174,25 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
             }
         }
         else if (projectClassification.kind === "greenfield") {
+            const projectRoot = s.canonicalProjectRoot;
+            if (!isSamePathLocal(s.basePath, projectRoot)) {
+                const projectRootClassification = classifyProject(projectRoot);
+                if (shouldDegradeEmptyWorktreeToProjectRoot(projectClassification, projectRootClassification)) {
+                    debugLog("runUnitPhase", {
+                        phase: "worktree-health-degrade-to-project-root",
+                        worktreePath: s.basePath,
+                        projectRoot,
+                        worktreeClassification: projectClassification,
+                        projectRootClassification,
+                    });
+                    ctx.ui.notify(`Warning: ${s.basePath} has no project content, but ${projectRoot} does. Continuing in project root because the milestone worktree cannot represent untracked project files.`, "warning");
+                    s.basePath = projectRoot;
+                    s.isolationDegraded = true;
+                    projectClassification = projectRootClassification;
+                }
+            }
+        }
+        if (projectClassification.kind === "greenfield") {
             debugLog("runUnitPhase", { phase: "worktree-health-greenfield", basePath: s.basePath, classification: projectClassification });
             ctx.ui.notify(`Warning: ${s.basePath} has no project content yet — proceeding as greenfield project`, "warning");
         }
@@ -1471,7 +1546,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
     {
         const currentLedger = deps.getLedger();
         if (currentLedger?.units) {
-            const lastUnit = [...currentLedger.units].reverse().find((u) => u.type === unitType && u.id === unitId && u.startedAt === s.currentUnit?.startedAt);
+            const lastUnit = [...currentLedger.units].reverse().find((u) => u.type === unitType && u.id === unitId && u.startedAt === _resolveCurrentUnitStartedAtForTest(s.currentUnit));
             if (lastUnit && lastUnit.toolCalls === 0) {
                 if (USER_DRIVEN_DEEP_UNITS.has(unitType) && isAwaitingUserInput(s.lastUnitAgentEndMessages ?? undefined)) {
                     debugLog("runUnitPhase", {
@@ -1490,7 +1565,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
                     ctx.ui.notify(`${unitType} ${unitId} completed with 0 tool calls — context exhaustion, will retry`, "warning");
                     // Fall through to next iteration where dispatch will re-derive
                     // and re-dispatch this unit.
-                    return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt, requestDispatchedAt: unitResult.requestDispatchedAt } };
+                    return { action: "next", data: { unitStartedAt: _resolveCurrentUnitStartedAtForTest(s.currentUnit), requestDispatchedAt: unitResult.requestDispatchedAt } };
                 }
             }
         }
@@ -1544,7 +1619,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         }
         s.checkpointSha = null;
     }
-    return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt, requestDispatchedAt: unitResult.requestDispatchedAt } };
+    return { action: "next", data: { unitStartedAt: _resolveCurrentUnitStartedAtForTest(s.currentUnit), requestDispatchedAt: unitResult.requestDispatchedAt } };
 }
 // ─── runFinalize ──────────────────────────────────────────────────────────────
 /**
@@ -1677,6 +1752,11 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         debugLog("autoLoop", { phase: "exit", reason: "step-wizard" });
         return { action: "break", reason: "step-wizard" };
     }
+    if (preUnitSnapshot?.type === "complete-milestone" && s.currentMilestoneId) {
+        const stop = await _runMilestoneMergeOnceWithStashRestore(ic, s.currentMilestoneId);
+        if (stop)
+            return stop;
+    }
     // Both pre and post verification completed without timeout — reset counter
     loopState.consecutiveFinalizeTimeouts = 0;
     if (preUnitSnapshot) {

package/dist/resources/extensions/gsd/auto/resolve.js

@@ -18,6 +18,8 @@ import { bumpTurnGeneration } from "./turn-epoch.js";
 let _currentResolve = null;
 let _sessionSwitchInFlight = false;
 let _pendingSwitchCancellation = null;
+let _sessionSwitchAbortGraceUntil = 0;
+const DEFAULT_SESSION_SWITCH_ABORT_GRACE_MS = 2_000;
 // ─── Setters (needed for cross-module mutation) ─────────────────────────────
 export function _setCurrentResolve(fn) {
     _currentResolve = fn;
@@ -25,6 +27,15 @@ export function _setCurrentResolve(fn) {
 export function _setSessionSwitchInFlight(v) {
     _sessionSwitchInFlight = v;
 }
+export function _markSessionSwitchAbortGraceWindow(durationMs = DEFAULT_SESSION_SWITCH_ABORT_GRACE_MS) {
+    _sessionSwitchAbortGraceUntil = Math.max(_sessionSwitchAbortGraceUntil, Date.now() + durationMs);
+}
+export function _clearSessionSwitchAbortGraceWindow() {
+    _sessionSwitchAbortGraceUntil = 0;
+}
+export function isSessionSwitchAbortGraceActive(now = Date.now()) {
+    return now < _sessionSwitchAbortGraceUntil;
+}
 export function _clearCurrentResolve() {
     _currentResolve = null;
 }
@@ -118,6 +129,7 @@ export function _resetPendingResolve() {
     _currentResolve = null;
     _sessionSwitchInFlight = false;
     _pendingSwitchCancellation = null;
+    _sessionSwitchAbortGraceUntil = 0;
 }
 export function _hasPendingResolveForTest() {
     return _currentResolve !== null;

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -1,6 +1,6 @@
 // GSD-2 + src/resources/extensions/gsd/auto/run-unit.ts - Runs one GSD auto-mode unit from session creation through agent completion.
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
-import { _clearCurrentResolve, _consumePendingSwitchCancellation, _setCurrentResolve, _setSessionSwitchInFlight, } from "./resolve.js";
+import { _clearCurrentResolve, _consumePendingSwitchCancellation, _markSessionSwitchAbortGraceWindow, _setCurrentResolve, _setSessionSwitchInFlight, } from "./resolve.js";
 import { getCurrentTurnGeneration, runWithTurnGeneration, } from "./turn-epoch.js";
 import { debugLog } from "../debug-logger.js";
 import { logWarning } from "../workflow-logger.js";
@@ -19,44 +19,23 @@ let sessionSwitchGeneration = 0;
  */
 export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     debugLog("runUnit", { phase: "start", unitType, unitId });
-    // Ensure cwd matches basePath BEFORE newSession() captures it. The new
-    // session reads process.cwd() during construction to anchor its tool
-    // runtime and system prompt; if cwd has drifted (async_bash, background
-    // jobs, prior unit cleanup), the session would otherwise be rooted to
-    // the wrong directory. Must be synchronous — no awaits between chdir
-    // and newSession (#1389, #4762 follow-up).
-    try {
-        if (process.cwd() !== s.basePath) {
-            process.chdir(s.basePath);
-        }
-    }
-    catch (e) {
-        const msg = `Failed to chdir to basePath before newSession (basePath: ${s.basePath}): ${String(e)}`;
-        logWarning("engine", msg, { basePath: s.basePath, error: String(e) });
-        return {
-            status: "cancelled",
-            errorContext: {
-                message: msg,
-                category: "session-failed",
-                isTransient: true,
-            },
-        };
-    }
     // ── Session creation with timeout ──
     debugLog("runUnit", { phase: "session-create", unitType, unitId });
     let sessionResult;
     let sessionTimeoutHandle;
     const mySessionSwitchGeneration = ++sessionSwitchGeneration;
-    // #3731: Cancellation controller for newSession(). When the session-creation
-    // timeout fires, we abort this controller so that the still-in-flight
-    // newSession() discards itself after await this.abort() completes, preventing
-    // it from capturing the (now-root) process.cwd() and rebuilding the tool
-    // runtime with the wrong cwd.
+    // #3731: Cancellation controller for newSession(). When session creation
+    // times out, abort before a late session switch can rebuild the tool runtime
+    // against a stale workspace root.
     const sessionAbortController = new AbortController();
     _setSessionSwitchInFlight(true);
     try {
-        const sessionPromise = s.cmdCtx.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
+        const sessionPromise = s.cmdCtx.newSession({
+            abortSignal: sessionAbortController.signal,
+            workspaceRoot: s.basePath,
+        }).finally(() => {
             if (sessionSwitchGeneration === mySessionSwitchGeneration) {
+                _markSessionSwitchAbortGraceWindow();
                 _setSessionSwitchInFlight(false);
             }
         });
@@ -111,6 +90,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     // ── Create the agent_end promise (per-unit one-shot) ──
     // This happens after newSession completes so session-switch agent_end events
     // from the previous session cannot resolve the new unit.
+    _markSessionSwitchAbortGraceWindow();
     _setSessionSwitchInFlight(false);
     const unitPromise = new Promise((resolve) => {
         _setCurrentResolve(resolve);

package/dist/resources/extensions/gsd/auto/session.js

@@ -106,6 +106,13 @@ export class AutoSession {
      * stale context bleeding into unrelated slices.
      */
     lastPreExecFailure = null;
+    /**
+     * Tracks how many consecutive times each slice unit has failed pre-execution
+     * checks. Keyed by unitId (e.g. "M001/S01"). Used to break the infinite
+     * plan-slice → pre-exec fail → re-dispatch loop when the planner cannot fix
+     * the issues after MAX_PRE_EXEC_RETRIES re-attempts.
+     */
+    preExecRetryCount = new Map();
     // ── Tool invocation errors (#2883) ──────────────────────────────────
     /** Set when a GSD tool execution ends with isError due to malformed/truncated
      *  JSON arguments. Checked by postUnitPreVerification to break retry loops. */
@@ -258,6 +265,7 @@ export class AutoSession {
         this.rewriteAttemptCount = 0;
         this.consecutiveCompleteBootstraps = 0;
         this.lastPreExecFailure = null;
+        this.preExecRetryCount.clear();
         this.lastToolInvocationError = null;
         this.lastUnitAgentEndMessages = null;
         this.lastGitActionFailure = null;

package/dist/resources/extensions/gsd/auto/workflow-dispatch-claim.js

@@ -1,7 +1,39 @@
 // Project/App: GSD-2
 // File Purpose: Best-effort unit dispatch claim adapter for auto-mode loop.
+export function ensureDispatchLease(s, milestoneId, deps, opts = {}) {
+    if (!s.workerId)
+        return { kind: "degraded", reason: "missing-worker" };
+    if (!milestoneId)
+        return { kind: "degraded", reason: "missing-milestone" };
+    if (!opts.forceReclaim && typeof s.milestoneLeaseToken === "number") {
+        return { kind: "ready", token: s.milestoneLeaseToken, recovered: false };
+    }
+    s.milestoneLeaseToken = null;
+    try {
+        const claim = deps.claimMilestoneLease(s.workerId, milestoneId);
+        if (!claim.ok) {
+            const reason = `Milestone ${milestoneId} is held by worker ${claim.byWorker} until ${claim.expiresAt}.`;
+            deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+            return { kind: "blocked", reason };
+        }
+        s.currentMilestoneId = milestoneId;
+        s.milestoneLeaseToken = claim.token;
+        deps.logLeaseRecovered({
+            milestoneId,
+            workerId: s.workerId,
+            token: claim.token,
+            recovered: opts.forceReclaim === true,
+        });
+        return { kind: "ready", token: claim.token, recovered: opts.forceReclaim === true };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+        return { kind: "failed", reason };
+    }
+}
 export function openDispatchClaim(s, flowId, turnId, iterData, deps) {
-    if (!s.workerId || s.milestoneLeaseToken === null)
+    if (!s.workerId || typeof s.milestoneLeaseToken !== "number")
         return { kind: "degraded" };
     const mid = iterData.mid;
     if (!mid)

package/dist/resources/extensions/gsd/auto/workflow-worker-heartbeat.js

@@ -6,7 +6,15 @@ export function maintainWorkerHeartbeat(session, deps) {
     try {
         deps.heartbeatAutoWorker(session.workerId);
         if (session.currentMilestoneId && session.milestoneLeaseToken) {
-            deps.refreshMilestoneLease(session.workerId, session.currentMilestoneId, session.milestoneLeaseToken);
+            const refreshed = deps.refreshMilestoneLease(session.workerId, session.currentMilestoneId, session.milestoneLeaseToken);
+            if (!refreshed) {
+                deps.logLeaseRefreshMiss?.({
+                    workerId: session.workerId,
+                    milestoneId: session.currentMilestoneId,
+                    fencingToken: session.milestoneLeaseToken,
+                });
+                session.milestoneLeaseToken = null;
+            }
         }
     }
     catch (err) {

package/dist/resources/extensions/gsd/auto-direct-dispatch.js

@@ -11,7 +11,6 @@ import { buildResearchSlicePrompt, buildResearchMilestonePrompt, buildPlanSliceP
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { pauseAuto } from "./auto.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
-import { logWarning } from "./workflow-logger.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, } from "./workflow-mcp.js";
 export async function dispatchDirectPhase(ctx, pi, phase, base) {
     const state = await deriveState(base);
@@ -231,36 +230,10 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
         return;
     }
     ctx.ui.notify(`Dispatching ${unitType} for ${unitId}...`, "info");
-    const originalCwd = process.cwd();
-    try {
-        // Ensure cwd matches dispatchBase BEFORE newSession() captures it. Synchronous —
-        // no awaits between chdir and newSession.
-        try {
-            if (process.cwd() !== dispatchBase) {
-                process.chdir(dispatchBase);
-            }
-        }
-        catch (err) {
-            const msg = `Failed to chdir before direct-dispatch newSession (basePath: ${dispatchBase}): ${err instanceof Error ? err.message : String(err)}`;
-            logWarning("engine", msg, { file: "auto-direct-dispatch.ts", basePath: dispatchBase, error: err instanceof Error ? err.message : String(err) });
-            ctx.ui.notify(`${msg}. Cancelling dispatch to avoid running in the wrong directory.`, "error");
-            return;
-        }
-        const result = await ctx.newSession();
-        if (result.cancelled) {
-            ctx.ui.notify("Session creation cancelled.", "warning");
-            return;
-        }
-        pi.sendMessage({ customType: "gsd-dispatch", content: prompt, display: false }, { triggerTurn: true });
-    }
-    finally {
-        try {
-            if (process.cwd() !== originalCwd) {
-                process.chdir(originalCwd);
-            }
-        }
-        catch (err) {
-            logWarning("engine", `Failed to restore cwd after direct dispatch: ${err instanceof Error ? err.message : String(err)}`, { file: "auto-direct-dispatch.ts", basePath: originalCwd });
-        }
+    const result = await ctx.newSession({ workspaceRoot: dispatchBase });
+    if (result.cancelled) {
+        ctx.ui.notify("Session creation cancelled.", "warning");
+        return;
     }
+    pi.sendMessage({ customType: "gsd-dispatch", content: prompt, display: false }, { triggerTurn: true });
 }

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -791,6 +791,22 @@ export const DISPATCH_RULES = [
             const unitId = `${mid}/${sid}`;
             let priorPreExecFailure;
             if (session?.lastPreExecFailure?.unitId === unitId) {
+                // Circuit breaker: stop re-dispatching after 2 failed retries. The
+                // planner has had multiple attempts with injected failure context and
+                // still cannot produce a valid plan — human review is required.
+                const MAX_PRE_EXEC_RETRIES = 2;
+                const retryCount = session.preExecRetryCount?.get(unitId) ?? 0;
+                if (retryCount >= MAX_PRE_EXEC_RETRIES) {
+                    const findings = session.lastPreExecFailure.blockingFindings.join("; ");
+                    session.lastPreExecFailure = null;
+                    session.preExecRetryCount?.delete(unitId);
+                    return {
+                        action: "stop",
+                        reason: `Pre-execution checks failed ${retryCount} times for ${unitId} — manual intervention required. Blocking findings: ${findings}. Fix the plan manually, then run /gsd auto to resume.`,
+                        level: "error",
+                        matchedRule: "planning → plan-slice",
+                    };
+                }
                 priorPreExecFailure = {
                     blockingFindings: session.lastPreExecFailure.blockingFindings,
                     verdictExcerpt: session.lastPreExecFailure.verdictExcerpt,