gsd-pi 2.82.0-dev.725028083 → 2.82.0-dev.98ea09b1e

package/README.md

@@ -336,7 +336,7 @@ Plan (with integrated research) → Execute (per task) → Complete → Reassess
                                                                               Validate Milestone → Complete Milestone
 ```
 
-**Plan** scouts the codebase, researches relevant docs, and decomposes the slice into tasks with must-haves (mechanically verifiable outcomes). **Execute** runs each task in a fresh context window with only the relevant files pre-loaded — then runs configured verification commands (lint, test, etc.) with auto-fix retries. **Complete** writes the summary, UAT script, marks the roadmap, and commits with meaningful messages derived from task summaries. **Reassess** checks if the roadmap still makes sense given what was learned. **Validate Milestone** runs a reconciliation gate after all slices complete — comparing roadmap success criteria against actual results before sealing the milestone.
+**Plan** scouts the codebase, researches relevant docs, and decomposes the slice into tasks with must-haves (mechanically verifiable outcomes). **Execute** runs each task in a fresh context window with only the relevant files pre-loaded, then runs configured verification commands (lint, test, etc.) with auto-fix retries before the task closeout commit or snapshot is published. Failed or incomplete verification blocks execute-task closeout. **Complete** writes the summary, UAT script, marks the roadmap, and commits with meaningful messages derived from task summaries. **Reassess** checks if the roadmap still makes sense given what was learned. **Validate Milestone** runs a reconciliation gate after all slices complete — comparing roadmap success criteria against actual results before sealing the milestone.
 
 When progressive planning is enabled, the first slice is fully planned up front while later slices may appear in `M###-ROADMAP.md` with a `` `[sketch]` `` badge. A sketch slice has an approved title, dependency shape, demo line, and scope boundary, but it has not yet been expanded into task plans; auto mode runs `refine-slice` just before execution to turn the sketch into a full slice plan using the latest prior-slice summaries.
 
@@ -376,7 +376,7 @@ The database is authoritative for milestones, slices, tasks, requirements, summa
 
 10. **Adaptive replanning** — After each slice completes, the roadmap is reassessed. If the work revealed new information that changes the plan, slices are reordered, added, or removed before continuing.
 
-11. **Verification enforcement** — Configure shell commands (`npm run lint`, `npm run test`, etc.) that run automatically after task execution. Failures trigger auto-fix retries before advancing. Auto-discovered checks from `package.json` run in advisory mode — they log warnings but don't block on pre-existing errors. Configurable via `verification_commands`, `verification_auto_fix`, and `verification_max_retries` preferences.
+11. **Verification enforcement** — Configure simple executable commands (`npm run lint`, `npm run test`, etc.) that run automatically after task execution. Verification commands must not use shell composition or control syntax such as pipes, redirects, semicolons, backticks, or command substitution. Failures trigger auto-fix retries before advancing. Execute-task commits and snapshots are deferred until verification passes; failed or incomplete verification blocks closeout instead of publishing changes. Auto-discovered checks from `package.json` and Python pytest project markers (`python-project`) run in advisory mode — they log warnings but don't block on pre-existing errors. Configurable via `verification_commands`, `verification_auto_fix`, and `verification_max_retries` preferences.
 
 12. **Milestone validation** — After all slices complete, a `validate-milestone` gate compares roadmap success criteria against actual results before sealing the milestone.
 
@@ -502,6 +502,7 @@ On first run, GSD launches a branded setup wizard that walks you through LLM pro
 | `/gsd rethink`          | Conversational project reorganization                                         |
 | `/gsd mcp`              | MCP server status and connectivity                                            |
 | `/gsd status`           | Progress dashboard                                                            |
+| `/gsd brief <mode>`     | Generate a visual HTML brief (diagram, plan, diff, recap, table, slides)      |
 | `/gsd queue`            | Queue future milestones (safe during auto mode)                               |
 | `/gsd prefs`            | Model selection, timeouts, budget ceiling                                     |
 | `/gsd migrate`          | Migrate a v1 `.planning` directory to `.gsd` format                           |
@@ -669,7 +670,7 @@ auto_report: true
 | `context_mode.exec_stdout_cap_bytes` | Persisted stdout cap for `gsd_exec` output (default: 1048576)                                      |
 | `context_mode.exec_digest_chars`  | Trailing stdout characters returned to the agent context (default: 300)                              |
 | `context_mode.exec_env_allowlist` | Environment variables forwarded to sandboxed `gsd_exec` runs in addition to `PATH` and `HOME`        |
-| `verification_commands`           | Array of shell commands to run after task execution (e.g., `["npm run lint", "npm run test"]`)        |
+| `verification_commands`           | Array of simple executable commands to run after task execution (e.g., `["npm run lint", "npm run test"]`); avoid pipes, redirects, semicolons, backticks, and command substitution |
 | `verification_auto_fix`           | Auto-retry on verification failures (default: true)                                                   |
 | `verification_max_retries`        | Max retries for verification failures (default: 2)                                                    |
 | `phases.require_slice_discussion` | Pause auto-mode before each slice for human discussion review                                         |

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-5c6d4acc2e1d8c2b
+d6d64d2fc180293c

package/dist/resources/GSD-WORKFLOW.md

@@ -448,6 +448,13 @@ What differed from the plan and why (or "None").
 
 The one-liner must be substantive: "JWT auth with refresh rotation using jose" not "Authentication implemented."
 
+When `key_files` or `key_decisions` are empty, render them as empty YAML lists:
+
+```yaml
+key_files: []
+key_decisions: []
+```
+
 **Slice summary:** Written when all tasks in a slice complete. Compresses all task summaries. Includes `drill_down_paths` to each task summary. During slice completion, review task summaries for `key_decisions` and ensure any significant ones are captured in `.gsd/DECISIONS.md`.
 
 **Milestone summary:** Updated each time a slice completes. Compresses all slice summaries. This is what gets injected into later slice planning instead of loading many individual summaries.
@@ -560,7 +567,7 @@ In all modes, slices and tasks commit sequentially on the active branch; there a
 
 1. **Milestone starts** → capture the current integration branch.
 2. **Optional isolation** → create `milestone/M001` only when `git.isolation` is `worktree` or `branch`.
-3. **Per-task commits** — atomic, descriptive, bisectable.
+3. **Per-task commits** — atomic, descriptive, bisectable, and published only after execute-task verification passes.
 4. **Slice completes** → write slice summary, UAT script, roadmap checkbox, and milestone summary.
 5. **Milestone completes** → if isolated, squash-merge the milestone branch back to the captured integration branch and clean up the worktree/branch.
 
@@ -574,6 +581,8 @@ fix: handle empty state rebuild
 
 In `none` mode these commits land directly on the current branch. In isolated modes they land on `milestone/<MID>` and are squashed back at milestone completion.
 
+Execute-task closeout is fail-closed: the system writes verification evidence first, defers the task commit or snapshot until verification passes, and pauses instead of publishing changes when verification fails or cannot complete.
+
 ### Commit Conventions
 
 | When | Format | Example |

package/dist/resources/extensions/claude-code-cli/partial-builder.js

@@ -105,9 +105,10 @@ export function mapUsage(sdkUsage, totalCostUsd) {
         output: sdkUsage.output_tokens,
         cacheRead: sdkUsage.cache_read_input_tokens,
         cacheWrite: sdkUsage.cache_creation_input_tokens,
+        // Claude Agent SDK result usage is cumulative across its internal loop;
+        // repeated cache reads do not represent additional live context.
         totalTokens: sdkUsage.input_tokens +
             sdkUsage.output_tokens +
-            sdkUsage.cache_read_input_tokens +
             sdkUsage.cache_creation_input_tokens,
         cost: {
             input: 0,

package/dist/resources/extensions/cmux/index.js

@@ -319,6 +319,11 @@ export class CmuxClient {
         const stdout = await this.runAsync(["send-surface", "--surface", surfaceId, payload]);
         return stdout !== null;
     }
+    // Send Ctrl-C (ETX) to a surface to interrupt the running command.
+    async sendInterrupt(surfaceId) {
+        const stdout = await this.runAsync(["send-surface", "--surface", surfaceId, "\x03"]);
+        return stdout !== null;
+    }
 }
 export function syncCmuxSidebar(preferences, state) {
     const client = CmuxClient.fromPreferences(preferences);

package/dist/resources/extensions/gsd/auto/infra-errors.js

@@ -6,9 +6,14 @@
  * failures that merit retry.
  */
 /**
- * Error codes indicating infrastructure failures that cannot be recovered by
- * retrying. Each retry re-dispatches the unit at full LLM cost, so we bail
- * immediately rather than burning budget on guaranteed failures.
+ * Error codes indicating infrastructure-level failures from the OS,
+ * filesystem, or network. This set includes permanent resource failures
+ * (ENOSPC, ENOMEM, EROFS), transient resource exhaustion (EAGAIN, ENOBUFS),
+ * and network/offline errors (ECONNREFUSED, ENOTFOUND, ENETUNREACH).
+ *
+ * Transient git failures are retried separately through
+ * TRANSIENT_GIT_RETRY_CODES in native-git-bridge.ts before escalating to the
+ * auto-loop.
  */
 export const INFRA_ERROR_CODES = new Set([
     "ENOSPC", // disk full
@@ -18,6 +23,7 @@ export const INFRA_ERROR_CODES = new Set([
     "EMFILE", // too many open files (process)
     "ENFILE", // too many open files (system)
     "EAGAIN", // resource temporarily unavailable (resource exhaustion)
+    "ENOBUFS", // no buffer space available (transient pipe exhaustion)
     "ECONNREFUSED", // connection refused (offline / local server down)
     "ENOTFOUND", // DNS lookup failed (offline / no network)
     "ENETUNREACH", // network unreachable (offline / no route)

package/dist/resources/extensions/gsd/auto/loop.js

@@ -35,7 +35,7 @@ import { createWorkflowTurnReporter } from "./workflow-turn-reporter.js";
 import { validateWorkflowSessionLock } from "./workflow-session-lock.js";
 import { dequeueSidecarItem } from "./workflow-sidecar-queue.js";
 import { maintainWorkerHeartbeat } from "./workflow-worker-heartbeat.js";
-import { measureMemoryPressure } from "./workflow-memory-pressure.js";
+import { measureMemoryPressure, shouldCheckMemoryPressure, } from "./workflow-memory-pressure.js";
 import { buildSidecarIterationData } from "./workflow-sidecar-iteration.js";
 import { createExecutionGraphUnitDispatchDeps, runUnitPhaseViaContract, } from "./workflow-unit-dispatch.js";
 import { handleCustomEngineDispatchOutcome } from "./workflow-custom-engine-dispatch-outcome.js";
@@ -130,9 +130,9 @@ function logCustomVerifyRetrySaveFailure(err) {
     });
 }
 // ── Memory pressure monitoring (#3331) ──────────────────────────────────
-// Check heap usage every N iterations and trigger graceful shutdown before
-// the OS OOM killer sends SIGKILL. The threshold is 90% of the V8 heap
-// limit (--max-old-space-size or default ~1.5-4GB depending on platform).
+// Check heap usage on session startup, then every N iterations, and trigger
+// graceful shutdown before the OS OOM killer sends SIGKILL. The threshold is
+// 90% of the V8 heap limit (--max-old-space-size or default ~1.5-4GB depending on platform).
 const MEMORY_CHECK_INTERVAL = 5; // check every 5 iterations
 const MAX_CUSTOM_ENGINE_VERIFY_RETRIES = 3;
 async function enforceMinRequestInterval(s, prefs) {
@@ -262,7 +262,7 @@ export async function autoLoop(ctx, pi, s, deps, options) {
         }
         // ── Memory pressure check (#3331) ──
         // Graceful shutdown before OOM killer sends SIGKILL.
-        if (iteration % MEMORY_CHECK_INTERVAL === 0) {
+        if (shouldCheckMemoryPressure(iteration, MEMORY_CHECK_INTERVAL)) {
             const mem = measureMemoryPressure();
             debugLog("autoLoop", { phase: "memory-check", ...mem });
             const memoryDecision = decideMemoryPressure({ ...mem, iteration });

package/dist/resources/extensions/gsd/auto/orchestrator.js

@@ -3,6 +3,15 @@
 function now() {
     return Date.now();
 }
+/**
+ * Size of the dispatch-decision ring buffer used by the Auto Orchestration
+ * module's stuck-loop detector. When the same `${unitType}:${unitId}` key
+ * fills the window, advance() blocks with `action: "stop"`.
+ *
+ * Mirrors the legacy `STUCK_WINDOW_SIZE` in auto/phases.ts so behaviour is
+ * preserved across the eventual cutover (issue #5791).
+ */
+export const STUCK_WINDOW_SIZE = 6;
 export class AutoOrchestrator {
     status = {
         phase: "idle",
@@ -10,11 +19,13 @@ export class AutoOrchestrator {
     };
     deps;
     lastAdvanceKey = null;
+    dispatchKeyWindow = [];
     constructor(deps) {
         this.deps = deps;
     }
     async start(_sessionContext) {
         this.lastAdvanceKey = null;
+        this.dispatchKeyWindow = [];
         this.status.phase = "running";
         this.bumpTransition();
         await this.deps.runtime.journalTransition({ name: "start" });
@@ -24,18 +35,70 @@ export class AutoOrchestrator {
     async advance() {
         try {
             await this.deps.runtime.ensureLockOwnership();
+            const staleMsg = this.deps.health.checkResourcesStale();
+            if (staleMsg) {
+                await this.deps.uokGate.emit({
+                    gateId: "resource-version-guard",
+                    gateType: "policy",
+                    outcome: "fail",
+                    failureClass: "policy",
+                    rationale: "resource version guard blocked dispatch",
+                    findings: staleMsg,
+                });
+                const blocked = { kind: "blocked", reason: staleMsg, action: "stop" };
+                await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
+                await this.deps.health.postAdvanceRecord(blocked);
+                return blocked;
+            }
+            await this.deps.uokGate.emit({
+                gateId: "resource-version-guard",
+                gateType: "policy",
+                outcome: "pass",
+                failureClass: "none",
+                rationale: "resource version guard passed",
+            });
             const gate = await this.deps.health.preAdvanceGate();
-            if (!gate.allow) {
-                const blocked = { kind: "blocked", reason: gate.reason ?? "health gate blocked" };
+            if (gate.kind === "fail") {
+                await this.deps.uokGate.emit({
+                    gateId: "pre-dispatch-health-gate",
+                    gateType: "execution",
+                    outcome: "manual-attention",
+                    failureClass: "manual-attention",
+                    rationale: "pre-dispatch health gate blocked dispatch",
+                    findings: gate.reason,
+                });
+                const blocked = { kind: "blocked", reason: gate.reason, action: "pause" };
                 await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
                 await this.deps.health.postAdvanceRecord(blocked);
                 return blocked;
             }
+            if (gate.kind === "threw") {
+                await this.deps.uokGate.emit({
+                    gateId: "pre-dispatch-health-gate",
+                    gateType: "execution",
+                    outcome: "manual-attention",
+                    failureClass: "manual-attention",
+                    rationale: "pre-dispatch health gate threw unexpectedly",
+                    findings: String(gate.error),
+                });
+                // intentional fall-through: matches runPreDispatch behaviour
+            }
+            else {
+                await this.deps.uokGate.emit({
+                    gateId: "pre-dispatch-health-gate",
+                    gateType: "execution",
+                    outcome: "pass",
+                    failureClass: "none",
+                    rationale: "pre-dispatch health gate passed",
+                    findings: gate.fixesApplied?.join(", ") ?? "",
+                });
+            }
             const reconciliation = await this.deps.stateReconciliation.reconcileBeforeDispatch();
             if (!reconciliation.ok || !reconciliation.stateSnapshot) {
                 const blocked = {
                     kind: "blocked",
-                    reason: reconciliation.reason,
+                    reason: reconciliation.reason ?? "state reconciliation produced no snapshot",
+                    action: "pause",
                     stateSnapshot: reconciliation.stateSnapshot,
                 };
                 await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
@@ -48,14 +111,60 @@ export class AutoOrchestrator {
                 this.status.phase = "stopped";
                 this.status.activeUnit = undefined;
                 this.lastAdvanceKey = null;
+                this.dispatchKeyWindow = [];
                 this.bumpTransition();
                 await this.deps.runtime.journalTransition({ name: "advance-stopped", reason: stopped.reason });
                 await this.deps.health.postAdvanceRecord(stopped);
                 return stopped;
             }
+            if (!("unitType" in decision)) {
+                const blocked = {
+                    kind: "blocked",
+                    reason: decision.reason,
+                    action: decision.action,
+                    stateSnapshot: reconciliation.stateSnapshot,
+                };
+                await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
+                await this.deps.health.postAdvanceRecord(blocked);
+                return blocked;
+            }
             const nextKey = `${decision.unitType}:${decision.unitId}`;
-            if (this.lastAdvanceKey === nextKey) {
-                const blocked = { kind: "blocked", reason: "idempotent advance: unit already active" };
+            // Record every dispatch decision in the ring buffer before pre-flight
+            // checks so the stuck-loop detector observes the full decision history
+            // (including decisions that idempotency would otherwise short-circuit).
+            // The ring is capped at STUCK_WINDOW_SIZE and evicts oldest-first.
+            this.dispatchKeyWindow.push(nextKey);
+            if (this.dispatchKeyWindow.length > STUCK_WINDOW_SIZE) {
+                this.dispatchKeyWindow.shift();
+            }
+            // Idempotency: same key as immediately previous successful advance.
+            // This is the soft, fast-path block kept from #5786. It only fires when
+            // the ring is NOT yet saturated for this key — once the ring is full of
+            // `nextKey`, the stuck-loop verdict takes precedence (see below). Both
+            // checks coexist: idempotency for the common immediate-repeat case,
+            // stuck-loop for the saturated-window case.
+            const matchingCount = this.dispatchKeyWindow.filter((k) => k === nextKey).length;
+            if (this.lastAdvanceKey === nextKey && matchingCount < STUCK_WINDOW_SIZE) {
+                const blocked = { kind: "blocked", reason: "idempotent advance: unit already active", action: "stop" };
+                await this.deps.runtime.journalTransition({
+                    name: "advance-blocked",
+                    reason: blocked.reason,
+                    unitType: decision.unitType,
+                    unitId: decision.unitId,
+                });
+                await this.deps.health.postAdvanceRecord(blocked);
+                return blocked;
+            }
+            // Stuck-loop detection: when the ring is saturated with copies of
+            // `nextKey` (count >= STUCK_WINDOW_SIZE), the orchestrator has been
+            // picking the same unit across the whole window and must hard-stop with
+            // a diagnosable reason.
+            if (matchingCount >= STUCK_WINDOW_SIZE) {
+                const blocked = {
+                    kind: "blocked",
+                    reason: `stuck-loop: ${nextKey} picked ${matchingCount} times`,
+                    action: "stop",
+                };
                 await this.deps.runtime.journalTransition({
                     name: "advance-blocked",
                     reason: blocked.reason,
@@ -70,6 +179,7 @@ export class AutoOrchestrator {
                 const blocked = {
                     kind: "blocked",
                     reason: contract.reason,
+                    action: "pause",
                     stateSnapshot: reconciliation.stateSnapshot,
                 };
                 await this.deps.runtime.journalTransition({
@@ -86,6 +196,7 @@ export class AutoOrchestrator {
                 const blocked = {
                     kind: "blocked",
                     reason: worktree.reason,
+                    action: "pause",
                     stateSnapshot: reconciliation.stateSnapshot,
                 };
                 await this.deps.runtime.journalTransition({
@@ -108,7 +219,11 @@ export class AutoOrchestrator {
                 unitId: decision.unitId,
             });
             await this.deps.worktree.syncAfterUnit(decision.unitType, decision.unitId);
-            const advanced = { kind: "advanced", stateSnapshot: reconciliation.stateSnapshot };
+            const advanced = {
+                kind: "advanced",
+                unit: { unitType: decision.unitType, unitId: decision.unitId },
+                stateSnapshot: reconciliation.stateSnapshot,
+            };
             await this.deps.health.postAdvanceRecord(advanced);
             return advanced;
         }
@@ -134,6 +249,7 @@ export class AutoOrchestrator {
             }
             if (result.kind === "stopped") {
                 this.lastAdvanceKey = null;
+                this.dispatchKeyWindow = [];
                 this.status.activeUnit = undefined;
             }
             this.bumpTransition();
@@ -158,6 +274,7 @@ export class AutoOrchestrator {
     }
     async resume() {
         this.lastAdvanceKey = null;
+        this.dispatchKeyWindow = [];
         this.status.phase = "running";
         this.bumpTransition();
         await this.deps.runtime.journalTransition({ name: "resume" });
@@ -172,6 +289,7 @@ export class AutoOrchestrator {
         this.status.phase = "stopped";
         this.status.activeUnit = undefined;
         this.lastAdvanceKey = null;
+        this.dispatchKeyWindow = [];
         this.bumpTransition();
         await this.deps.runtime.journalTransition({ name: "stop", reason });
         await this.deps.notifications.notifyLifecycle({ name: "stop", detail: reason });

package/dist/resources/extensions/gsd/auto/phases.js

@@ -968,7 +968,14 @@ export async function runDispatch(ic, preData, loopState) {
         prompt = preDispatchResult.prompt;
     }
     const guardBasePath = _resolveDispatchGuardBasePath(s);
-    const priorSliceBlocker = deps.getPriorSliceCompletionBlocker(guardBasePath, deps.getMainBranch(guardBasePath), unitType, unitId);
+    let mainBranch = "main";
+    try {
+        mainBranch = deps.getMainBranch(guardBasePath);
+    }
+    catch (err) {
+        debugLog("autoLoop", { phase: "getMainBranch-failed", error: String(err) });
+    }
+    const priorSliceBlocker = deps.getPriorSliceCompletionBlocker(guardBasePath, mainBranch, unitType, unitId);
     if (priorSliceBlocker) {
         await deps.stopAuto(ctx, pi, priorSliceBlocker);
         debugLog("autoLoop", { phase: "exit", reason: "prior-slice-blocker" });

package/dist/resources/extensions/gsd/auto/workflow-memory-pressure.js

@@ -4,6 +4,18 @@ import { createRequire } from "node:module";
 const require = createRequire(import.meta.url);
 const DEFAULT_MEMORY_PRESSURE_THRESHOLD = 0.85;
 const DEFAULT_HEAP_LIMIT_MB = 4096;
+/**
+ * Returns true on auto-mode startup, then every configured interval.
+ *
+ * Iteration 1 is checked explicitly so early session memory pressure cannot
+ * bypass the periodic interval guard.
+ */
+export function shouldCheckMemoryPressure(iteration, interval) {
+    if (!Number.isInteger(interval) || interval <= 0) {
+        throw new Error("Memory pressure check interval must be a positive integer");
+    }
+    return iteration === 1 || iteration % interval === 0;
+}
 function defaultHeapLimitBytes() {
     const v8 = require("node:v8");
     const limit = v8.getHeapStatistics?.().heap_size_limit;

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -102,6 +102,9 @@ function missingSliceStop(mid, phase) {
         level: "error",
     };
 }
+function isRegistryMilestoneComplete(state, mid) {
+    return state.registry.some((milestone) => milestone.id === mid && milestone.status === "complete");
+}
 /**
  * Check for milestone slices missing SUMMARY files.
  * Returns array of missing slice IDs, or empty array if all present or DB unavailable.
@@ -247,6 +250,8 @@ export const DISPATCH_RULES = [
                 return null;
             if (!MILESTONE_ID_RE.test(mid))
                 return null;
+            if (isRegistryMilestoneComplete(state, mid))
+                return null;
             // Align with the plan-v2 gate's lookup semantics: whitespace-only counts
             // as missing, and an auto worktree may fall back to GSD_PROJECT_ROOT.
             if (hasFinalizedMilestoneContext(basePath, mid))
@@ -557,6 +562,8 @@ export const DISPATCH_RULES = [
         match: async ({ state, mid, midTitle, basePath, prefs, structuredQuestionsAvailable }) => {
             if (state.phase !== "pre-planning")
                 return null;
+            if (isRegistryMilestoneComplete(state, mid))
+                return null;
             const contextFile = resolveMilestoneFile(basePath, mid, "CONTEXT");
             const hasContext = !!(contextFile && (await loadFile(contextFile)));
             if (hasContext)
@@ -1091,19 +1098,19 @@ export const DISPATCH_RULES = [
                     return { action: "skip" };
                 }
             }
-            // Safety guard (#2675): block completion when VALIDATION verdict is
-            // needs-remediation. The state machine treats needs-remediation as
-            // terminal (to prevent validate-milestone loops per #832), but
-            // completing-milestone should NOT proceed — remediation work is needed.
+            // Safety guard (#2675, #5747): block completion when VALIDATION
+            // verdict is non-passing. The state machine treats these verdicts as
+            // terminal, but completing-milestone should NOT proceed — remediation
+            // or human attention is needed.
             const validationFile = resolveMilestoneFile(basePath, mid, "VALIDATION");
             if (validationFile) {
                 const validationContent = await loadFile(validationFile);
                 if (validationContent) {
                     const verdict = extractVerdict(validationContent);
-                    if (verdict === "needs-remediation") {
+                    if (verdict === "needs-remediation" || verdict === "needs-attention") {
                         return {
                             action: "stop",
-                            reason: `Cannot complete milestone ${mid}: VALIDATION verdict is "needs-remediation". Address the remediation findings and re-run validation, or update the verdict manually.`,
+                            reason: `Cannot complete milestone ${mid}: VALIDATION verdict is "${verdict}". Address the validation findings and re-run validation, or update the verdict manually.`,
                             level: "warning",
                         };
                     }

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -494,6 +494,8 @@ autoModeStartThinkingLevel) {
  * Handles formats: "provider/model", "bare-id", "org/model-name" (OpenRouter).
  */
 export function resolveModelId(modelId, availableModels, currentProvider) {
+    if (!modelId)
+        return undefined;
     const slashIdx = modelId.indexOf("/");
     if (slashIdx !== -1) {
         const maybeProvider = modelId.substring(0, slashIdx);