gsd-pi 2.80.0-dev.4ea7d80e7 → 2.80.0-dev.7582bf37a

package/src/resources/extensions/gsd/auto/resolve.ts

@@ -22,6 +22,10 @@ import { bumpTurnGeneration } from "./turn-epoch.js";
 
 let _currentResolve: ((result: UnitResult) => void) | null = null;
 let _sessionSwitchInFlight = false;
+let _pendingSwitchCancellation: { errorContext?: ErrorContext } | null = null;
+let _sessionSwitchAbortGraceUntil = 0;
+
+const DEFAULT_SESSION_SWITCH_ABORT_GRACE_MS = 2_000;
 
 // ─── Setters (needed for cross-module mutation) ─────────────────────────────
 
@@ -33,10 +37,31 @@ export function _setSessionSwitchInFlight(v: boolean): void {
   _sessionSwitchInFlight = v;
 }
 
+export function _markSessionSwitchAbortGraceWindow(durationMs = DEFAULT_SESSION_SWITCH_ABORT_GRACE_MS): void {
+  _sessionSwitchAbortGraceUntil = Math.max(
+    _sessionSwitchAbortGraceUntil,
+    Date.now() + durationMs,
+  );
+}
+
+export function _clearSessionSwitchAbortGraceWindow(): void {
+  _sessionSwitchAbortGraceUntil = 0;
+}
+
+export function isSessionSwitchAbortGraceActive(now = Date.now()): boolean {
+  return now < _sessionSwitchAbortGraceUntil;
+}
+
 export function _clearCurrentResolve(): void {
   _currentResolve = null;
 }
 
+export function _consumePendingSwitchCancellation(): { errorContext?: ErrorContext } | null {
+  const pending = _pendingSwitchCancellation;
+  _pendingSwitchCancellation = null;
+  return pending;
+}
+
 // ─── resolveAgentEnd ─────────────────────────────────────────────────────────
 
 /**
@@ -96,7 +121,7 @@ export function bumpAndResolveSynthetic(reason: string): void {
  * blocks to ensure the autoLoop is never stuck awaiting a promise that
  * will never resolve. Safe to call when no resolver is pending (no-op).
  */
-export function resolveAgentEndCancelled(errorContext?: ErrorContext): void {
+export function resolveAgentEndCancelled(errorContext?: ErrorContext): boolean {
   if (_currentResolve) {
     // Cancellation supersedes the in-flight turn the same way timeout
     // recovery does — bump the turn epoch so any lingering writes from the
@@ -107,8 +132,22 @@ export function resolveAgentEndCancelled(errorContext?: ErrorContext): void {
     debugLog("resolveAgentEndCancelled", { status: "resolving-cancelled" });
     const r = _currentResolve;
     _currentResolve = null;
+    _pendingSwitchCancellation = null;
     r({ status: "cancelled", ...(errorContext ? { errorContext } : {}) });
+    return true;
   }
+
+  if (_sessionSwitchInFlight) {
+    bumpTurnGeneration(
+      `cancelled-during-switch:${errorContext?.category ?? "unknown"}`,
+    );
+    _pendingSwitchCancellation = errorContext ? { errorContext } : {};
+    debugLog("resolveAgentEndCancelled", { status: "queued-during-switch" });
+    return false;
+  }
+
+  debugLog("resolveAgentEndCancelled", { status: "no-pending-resolve" });
+  return false;
 }
 
 // ─── resetPendingResolve (test helper) ───────────────────────────────────────
@@ -120,6 +159,8 @@ export function resolveAgentEndCancelled(errorContext?: ErrorContext): void {
 export function _resetPendingResolve(): void {
   _currentResolve = null;
   _sessionSwitchInFlight = false;
+  _pendingSwitchCancellation = null;
+  _sessionSwitchAbortGraceUntil = 0;
 }
 
 export function _hasPendingResolveForTest(): boolean {

package/src/resources/extensions/gsd/auto/run-unit.ts

@@ -11,7 +11,13 @@ import type { ExtensionAPI, ExtensionContext } from "@gsd/pi-coding-agent";
 import type { AutoSession } from "./session.js";
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
 import type { UnitResult } from "./types.js";
-import { _clearCurrentResolve, _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import {
+  _clearCurrentResolve,
+  _consumePendingSwitchCancellation,
+  _markSessionSwitchAbortGraceWindow,
+  _setCurrentResolve,
+  _setSessionSwitchInFlight,
+} from "./resolve.js";
 import {
   getCurrentTurnGeneration,
   runWithTurnGeneration,
@@ -43,45 +49,24 @@ export async function runUnit(
 ): Promise<UnitResult> {
   debugLog("runUnit", { phase: "start", unitType, unitId });
 
-  // Ensure cwd matches basePath BEFORE newSession() captures it. The new
-  // session reads process.cwd() during construction to anchor its tool
-  // runtime and system prompt; if cwd has drifted (async_bash, background
-  // jobs, prior unit cleanup), the session would otherwise be rooted to
-  // the wrong directory. Must be synchronous — no awaits between chdir
-  // and newSession (#1389, #4762 follow-up).
-  try {
-    if (process.cwd() !== s.basePath) {
-      process.chdir(s.basePath);
-    }
-  } catch (e) {
-    const msg = `Failed to chdir to basePath before newSession (basePath: ${s.basePath}): ${String(e)}`;
-    logWarning("engine", msg, { basePath: s.basePath, error: String(e) });
-    return {
-      status: "cancelled",
-      errorContext: {
-        message: msg,
-        category: "session-failed",
-        isTransient: true,
-      },
-    };
-  }
-
   // ── Session creation with timeout ──
   debugLog("runUnit", { phase: "session-create", unitType, unitId });
 
   let sessionResult: { cancelled: boolean };
   let sessionTimeoutHandle: ReturnType<typeof setTimeout> | undefined;
   const mySessionSwitchGeneration = ++sessionSwitchGeneration;
-  // #3731: Cancellation controller for newSession(). When the session-creation
-  // timeout fires, we abort this controller so that the still-in-flight
-  // newSession() discards itself after await this.abort() completes, preventing
-  // it from capturing the (now-root) process.cwd() and rebuilding the tool
-  // runtime with the wrong cwd.
+  // #3731: Cancellation controller for newSession(). When session creation
+  // times out, abort before a late session switch can rebuild the tool runtime
+  // against a stale workspace root.
   const sessionAbortController = new AbortController();
   _setSessionSwitchInFlight(true);
   try {
-    const sessionPromise = s.cmdCtx!.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
+    const sessionPromise = s.cmdCtx!.newSession({
+      abortSignal: sessionAbortController.signal,
+      workspaceRoot: s.basePath,
+    }).finally(() => {
       if (sessionSwitchGeneration === mySessionSwitchGeneration) {
+        _markSessionSwitchAbortGraceWindow();
         _setSessionSwitchInFlight(false);
       }
     });
@@ -97,6 +82,7 @@ export async function runUnit(
     sessionResult = await Promise.race([sessionPromise, timeoutPromise]);
   } catch (sessionErr) {
     if (sessionTimeoutHandle) clearTimeout(sessionTimeoutHandle);
+    _consumePendingSwitchCancellation();
     const msg =
       sessionErr instanceof Error ? sessionErr.message : String(sessionErr);
     debugLog("runUnit", {
@@ -110,17 +96,20 @@ export async function runUnit(
   if (sessionTimeoutHandle) clearTimeout(sessionTimeoutHandle);
 
   if (sessionResult.cancelled) {
+    _consumePendingSwitchCancellation();
     debugLog("runUnit-session-timeout", { unitType, unitId });
     return { status: "cancelled", errorContext: { message: "Session creation timed out", category: "timeout", isTransient: true } };
   }
 
   if (!s.active) {
+    _consumePendingSwitchCancellation();
     return { status: "cancelled" };
   }
 
   if (s.currentUnitModel && typeof pi.setModel === "function") {
     const restored = await pi.setModel(s.currentUnitModel, { persist: false });
     if (!restored) {
+      _consumePendingSwitchCancellation();
       const message =
         `Failed to restore configured model ${s.currentUnitModel.provider}/${s.currentUnitModel.id} after session creation`;
       ctx.ui.notify(
@@ -141,10 +130,19 @@ export async function runUnit(
   // ── Create the agent_end promise (per-unit one-shot) ──
   // This happens after newSession completes so session-switch agent_end events
   // from the previous session cannot resolve the new unit.
+  _markSessionSwitchAbortGraceWindow();
   _setSessionSwitchInFlight(false);
   const unitPromise = new Promise<UnitResult>((resolve) => {
     _setCurrentResolve(resolve);
   });
+  const pendingSwitchCancellation = _consumePendingSwitchCancellation();
+  if (pendingSwitchCancellation) {
+    _clearCurrentResolve();
+    return {
+      status: "cancelled",
+      ...(pendingSwitchCancellation.errorContext ? { errorContext: pendingSwitchCancellation.errorContext } : {}),
+    };
+  }
 
   // ── Provider request-readiness pre-check (#4555) ──
   // Verify the provider can accept requests before dispatching. If the token

package/src/resources/extensions/gsd/auto/session.ts

@@ -178,6 +178,13 @@ export class AutoSession {
    * stale context bleeding into unrelated slices.
    */
   lastPreExecFailure: PreExecFailure | null = null;
+  /**
+   * Tracks how many consecutive times each slice unit has failed pre-execution
+   * checks. Keyed by unitId (e.g. "M001/S01"). Used to break the infinite
+   * plan-slice → pre-exec fail → re-dispatch loop when the planner cannot fix
+   * the issues after MAX_PRE_EXEC_RETRIES re-attempts.
+   */
+  readonly preExecRetryCount: Map<string, number> = new Map();
 
   // ── Tool invocation errors (#2883) ──────────────────────────────────
   /** Set when a GSD tool execution ends with isError due to malformed/truncated
@@ -343,6 +350,7 @@ export class AutoSession {
     this.rewriteAttemptCount = 0;
     this.consecutiveCompleteBootstraps = 0;
     this.lastPreExecFailure = null;
+    this.preExecRetryCount.clear();
     this.lastToolInvocationError = null;
     this.lastUnitAgentEndMessages = null;
     this.lastGitActionFailure = null;

package/src/resources/extensions/gsd/auto/workflow-dispatch-claim.ts

@@ -9,6 +9,16 @@ export type DispatchClaimOutcome =
   | { kind: "skip"; reason: "already-active" | "stale-lease"; existingId?: number; existingWorker?: string }
   | { kind: "degraded" };
 
+export type DispatchLeaseOutcome =
+  | { kind: "ready"; token: number; recovered: boolean }
+  | { kind: "degraded"; reason: "missing-worker" | "missing-milestone" }
+  | { kind: "blocked"; reason: string }
+  | { kind: "failed"; reason: string };
+
+type ClaimMilestoneLeaseResult =
+  | { ok: true; token: number; expiresAt: string }
+  | { ok: false; error: "held_by"; byWorker: string; expiresAt: string };
+
 interface RecentDispatch {
   attempt_n?: number | null;
 }
@@ -44,6 +54,58 @@ export interface OpenDispatchClaimDeps {
   logClaimFailed: (err: unknown) => void;
 }
 
+export interface EnsureDispatchLeaseDeps {
+  claimMilestoneLease: (workerId: string, milestoneId: string) => ClaimMilestoneLeaseResult;
+  logLeaseRecovered: (details: {
+    milestoneId: string;
+    workerId: string;
+    token: number;
+    recovered: boolean;
+  }) => void;
+  logLeaseRecoveryFailed: (details: {
+    milestoneId?: string;
+    workerId?: string;
+    reason: string;
+  }) => void;
+}
+
+export function ensureDispatchLease(
+  s: AutoSession,
+  milestoneId: string | undefined,
+  deps: EnsureDispatchLeaseDeps,
+  opts: { forceReclaim?: boolean } = {},
+): DispatchLeaseOutcome {
+  if (!s.workerId) return { kind: "degraded", reason: "missing-worker" };
+  if (!milestoneId) return { kind: "degraded", reason: "missing-milestone" };
+  if (!opts.forceReclaim && typeof s.milestoneLeaseToken === "number") {
+    return { kind: "ready", token: s.milestoneLeaseToken, recovered: false };
+  }
+
+  s.milestoneLeaseToken = null;
+  try {
+    const claim = deps.claimMilestoneLease(s.workerId, milestoneId);
+    if (!claim.ok) {
+      const reason = `Milestone ${milestoneId} is held by worker ${claim.byWorker} until ${claim.expiresAt}.`;
+      deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+      return { kind: "blocked", reason };
+    }
+
+    s.currentMilestoneId = milestoneId;
+    s.milestoneLeaseToken = claim.token;
+    deps.logLeaseRecovered({
+      milestoneId,
+      workerId: s.workerId,
+      token: claim.token,
+      recovered: opts.forceReclaim === true,
+    });
+    return { kind: "ready", token: claim.token, recovered: opts.forceReclaim === true };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+    return { kind: "failed", reason };
+  }
+}
+
 export function openDispatchClaim(
   s: AutoSession,
   flowId: string,
@@ -51,7 +113,7 @@ export function openDispatchClaim(
   iterData: IterationData,
   deps: OpenDispatchClaimDeps,
 ): DispatchClaimOutcome {
-  if (!s.workerId || s.milestoneLeaseToken === null) return { kind: "degraded" };
+  if (!s.workerId || typeof s.milestoneLeaseToken !== "number") return { kind: "degraded" };
   const mid = iterData.mid;
   if (!mid) return { kind: "degraded" };
 

package/src/resources/extensions/gsd/auto/workflow-worker-heartbeat.ts

@@ -15,6 +15,11 @@ export interface MaintainWorkerHeartbeatDeps {
     fencingToken: number,
   ) => boolean;
   logHeartbeatFailure: (err: unknown) => void;
+  logLeaseRefreshMiss?: (details: {
+    workerId: string;
+    milestoneId: string;
+    fencingToken: number;
+  }) => void;
 }
 
 export function maintainWorkerHeartbeat(
@@ -26,11 +31,19 @@ export function maintainWorkerHeartbeat(
   try {
     deps.heartbeatAutoWorker(session.workerId);
     if (session.currentMilestoneId && session.milestoneLeaseToken) {
-      deps.refreshMilestoneLease(
+      const refreshed = deps.refreshMilestoneLease(
         session.workerId,
         session.currentMilestoneId,
         session.milestoneLeaseToken,
       );
+      if (!refreshed) {
+        deps.logLeaseRefreshMiss?.({
+          workerId: session.workerId,
+          milestoneId: session.currentMilestoneId,
+          fencingToken: session.milestoneLeaseToken,
+        });
+        session.milestoneLeaseToken = null;
+      }
     }
   } catch (err) {
     deps.logHeartbeatFailure(err);

package/src/resources/extensions/gsd/auto-direct-dispatch.ts

@@ -31,7 +31,6 @@ import { loadEffectiveGSDPreferences } from "./preferences.js";
 import type { MinimalModelRegistry } from "./context-budget.js";
 import { pauseAuto } from "./auto.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
-import { logWarning } from "./workflow-logger.js";
 import {
   getWorkflowTransportSupportError,
   getRequiredWorkflowToolsForAutoUnit,
@@ -290,38 +289,13 @@ export async function dispatchDirectPhase(
 
   ctx.ui.notify(`Dispatching ${unitType} for ${unitId}...`, "info");
 
-  const originalCwd = process.cwd();
-
-  try {
-    // Ensure cwd matches dispatchBase BEFORE newSession() captures it. Synchronous —
-    // no awaits between chdir and newSession.
-    try {
-      if (process.cwd() !== dispatchBase) {
-        process.chdir(dispatchBase);
-      }
-    } catch (err) {
-      const msg = `Failed to chdir before direct-dispatch newSession (basePath: ${dispatchBase}): ${err instanceof Error ? err.message : String(err)}`;
-      logWarning("engine", msg, { file: "auto-direct-dispatch.ts", basePath: dispatchBase, error: err instanceof Error ? err.message : String(err) });
-      ctx.ui.notify(`${msg}. Cancelling dispatch to avoid running in the wrong directory.`, "error");
-      return;
-    }
-
-    const result = await ctx.newSession();
-    if (result.cancelled) {
-      ctx.ui.notify("Session creation cancelled.", "warning");
-      return;
-    }
-    pi.sendMessage(
-      { customType: "gsd-dispatch", content: prompt, display: false },
-      { triggerTurn: true },
-    );
-  } finally {
-    try {
-      if (process.cwd() !== originalCwd) {
-        process.chdir(originalCwd);
-      }
-    } catch (err) {
-      logWarning("engine", `Failed to restore cwd after direct dispatch: ${err instanceof Error ? err.message : String(err)}`, { file: "auto-direct-dispatch.ts", basePath: originalCwd });
-    }
+  const result = await ctx.newSession({ workspaceRoot: dispatchBase });
+  if (result.cancelled) {
+    ctx.ui.notify("Session creation cancelled.", "warning");
+    return;
   }
+  pi.sendMessage(
+    { customType: "gsd-dispatch", content: prompt, display: false },
+    { triggerTurn: true },
+  );
 }

package/src/resources/extensions/gsd/auto-dispatch.ts

@@ -938,6 +938,22 @@ export const DISPATCH_RULES: DispatchRule[] = [
       const unitId = `${mid}/${sid}`;
       let priorPreExecFailure: { blockingFindings: string[]; verdictExcerpt: string } | undefined;
       if (session?.lastPreExecFailure?.unitId === unitId) {
+        // Circuit breaker: stop re-dispatching after 2 failed retries. The
+        // planner has had multiple attempts with injected failure context and
+        // still cannot produce a valid plan — human review is required.
+        const MAX_PRE_EXEC_RETRIES = 2;
+        const retryCount = session.preExecRetryCount?.get(unitId) ?? 0;
+        if (retryCount >= MAX_PRE_EXEC_RETRIES) {
+          const findings = session.lastPreExecFailure.blockingFindings.join("; ");
+          session.lastPreExecFailure = null;
+          session.preExecRetryCount?.delete(unitId);
+          return {
+            action: "stop",
+            reason: `Pre-execution checks failed ${retryCount} times for ${unitId} — manual intervention required. Blocking findings: ${findings}. Fix the plan manually, then run /gsd auto to resume.`,
+            level: "error",
+            matchedRule: "planning → plan-slice",
+          };
+        }
         priorPreExecFailure = {
           blockingFindings: session.lastPreExecFailure.blockingFindings,
           verdictExcerpt: session.lastPreExecFailure.verdictExcerpt,