gsd-pi 2.82.0-dev.c22380fc3 → 2.82.0-dev.dfbc5f58f

package/src/resources/GSD-WORKFLOW.md

@@ -448,6 +448,13 @@ What differed from the plan and why (or "None").
 
 The one-liner must be substantive: "JWT auth with refresh rotation using jose" not "Authentication implemented."
 
+When `key_files` or `key_decisions` are empty, render them as empty YAML lists:
+
+```yaml
+key_files: []
+key_decisions: []
+```
+
 **Slice summary:** Written when all tasks in a slice complete. Compresses all task summaries. Includes `drill_down_paths` to each task summary. During slice completion, review task summaries for `key_decisions` and ensure any significant ones are captured in `.gsd/DECISIONS.md`.
 
 **Milestone summary:** Updated each time a slice completes. Compresses all slice summaries. This is what gets injected into later slice planning instead of loading many individual summaries.
@@ -560,7 +567,7 @@ In all modes, slices and tasks commit sequentially on the active branch; there a
 
 1. **Milestone starts** → capture the current integration branch.
 2. **Optional isolation** → create `milestone/M001` only when `git.isolation` is `worktree` or `branch`.
-3. **Per-task commits** — atomic, descriptive, bisectable.
+3. **Per-task commits** — atomic, descriptive, bisectable, and published only after execute-task verification passes.
 4. **Slice completes** → write slice summary, UAT script, roadmap checkbox, and milestone summary.
 5. **Milestone completes** → if isolated, squash-merge the milestone branch back to the captured integration branch and clean up the worktree/branch.
 
@@ -574,6 +581,8 @@ fix: handle empty state rebuild
 
 In `none` mode these commits land directly on the current branch. In isolated modes they land on `milestone/<MID>` and are squashed back at milestone completion.
 
+Execute-task closeout is fail-closed: the system writes verification evidence first, defers the task commit or snapshot until verification passes, and pauses instead of publishing changes when verification fails or cannot complete.
+
 ### Commit Conventions
 
 | When | Format | Example |

package/src/resources/extensions/claude-code-cli/partial-builder.ts

@@ -134,10 +134,11 @@ export function mapUsage(sdkUsage: NonNullableUsage, totalCostUsd: number): Usag
 		output: sdkUsage.output_tokens,
 		cacheRead: sdkUsage.cache_read_input_tokens,
 		cacheWrite: sdkUsage.cache_creation_input_tokens,
+		// Claude Agent SDK result usage is cumulative across its internal loop;
+		// repeated cache reads do not represent additional live context.
 		totalTokens:
 			sdkUsage.input_tokens +
 			sdkUsage.output_tokens +
-			sdkUsage.cache_read_input_tokens +
 			sdkUsage.cache_creation_input_tokens,
 		cost: {
 			input: 0,

package/src/resources/extensions/claude-code-cli/tests/partial-builder.test.ts

@@ -1,7 +1,24 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
-import { mapContentBlock, parseMcpToolName, PartialMessageBuilder } from "../partial-builder.ts";
-import type { BetaContentBlock, BetaRawMessageStreamEvent } from "../sdk-types.ts";
+import { mapContentBlock, mapUsage, parseMcpToolName, PartialMessageBuilder } from "../partial-builder.ts";
+import type { BetaContentBlock, BetaRawMessageStreamEvent, NonNullableUsage } from "../sdk-types.ts";
+
+describe("mapUsage", () => {
+	test("excludes cumulative cache reads from context-sized totalTokens (#5243)", () => {
+		const usage: NonNullableUsage = {
+			input_tokens: 150_000,
+			output_tokens: 2_000,
+			cache_read_input_tokens: 900_000,
+			cache_creation_input_tokens: 3_000,
+		};
+
+		const mapped = mapUsage(usage, 1.23);
+
+		assert.equal(mapped.cacheRead, 900_000);
+		assert.equal(mapped.totalTokens, 155_000);
+		assert.equal(mapped.cost.total, 1.23);
+	});
+});
 
 describe("PartialMessageBuilder — malformed tool arguments (#2574)", () => {
 	/**

package/src/resources/extensions/cmux/index.ts

@@ -374,6 +374,12 @@ export class CmuxClient {
     const stdout = await this.runAsync(["send-surface", "--surface", surfaceId, payload]);
     return stdout !== null;
   }
+
+  // Send Ctrl-C (ETX) to a surface to interrupt the running command.
+  async sendInterrupt(surfaceId: string): Promise<boolean> {
+    const stdout = await this.runAsync(["send-surface", "--surface", surfaceId, "\x03"]);
+    return stdout !== null;
+  }
 }
 
 export function syncCmuxSidebar(preferences: CmuxPreferences | undefined, state: CmuxState): void {

package/src/resources/extensions/gsd/auto/contracts.ts

@@ -47,12 +47,20 @@ export interface DispatchAdapter {
     sessionProvider?: string;
     /** Model registry for executor-model lookups inside the budget engine. */
     modelRegistry?: MinimalModelRegistry;
-  }): Promise<{
-    unitType: string;
-    unitId: string;
-    reason: string;
-    preconditions: string[];
-  } | null>;
+  }): Promise<
+    | {
+        kind: "blocked";
+        reason: string;
+        action: "pause" | "stop";
+      }
+    | {
+        unitType: string;
+        unitId: string;
+        reason: string;
+        preconditions: string[];
+      }
+    | null
+  >;
 }
 
 export interface RecoveryAdapter {

package/src/resources/extensions/gsd/auto/infra-errors.ts

@@ -7,9 +7,14 @@
  */
 
 /**
- * Error codes indicating infrastructure failures that cannot be recovered by
- * retrying. Each retry re-dispatches the unit at full LLM cost, so we bail
- * immediately rather than burning budget on guaranteed failures.
+ * Error codes indicating infrastructure-level failures from the OS,
+ * filesystem, or network. This set includes permanent resource failures
+ * (ENOSPC, ENOMEM, EROFS), transient resource exhaustion (EAGAIN, ENOBUFS),
+ * and network/offline errors (ECONNREFUSED, ENOTFOUND, ENETUNREACH).
+ *
+ * Transient git failures are retried separately through
+ * TRANSIENT_GIT_RETRY_CODES in native-git-bridge.ts before escalating to the
+ * auto-loop.
  */
 export const INFRA_ERROR_CODES: ReadonlySet<string> = new Set([
   "ENOSPC",   // disk full
@@ -19,6 +24,7 @@ export const INFRA_ERROR_CODES: ReadonlySet<string> = new Set([
   "EMFILE",   // too many open files (process)
   "ENFILE",   // too many open files (system)
   "EAGAIN",       // resource temporarily unavailable (resource exhaustion)
+  "ENOBUFS",      // no buffer space available (transient pipe exhaustion)
   "ECONNREFUSED", // connection refused (offline / local server down)
   "ENOTFOUND",    // DNS lookup failed (offline / no network)
   "ENETUNREACH",  // network unreachable (offline / no route)

package/src/resources/extensions/gsd/auto/loop.ts

@@ -78,7 +78,10 @@ import { createWorkflowTurnReporter } from "./workflow-turn-reporter.js";
 import { validateWorkflowSessionLock } from "./workflow-session-lock.js";
 import { dequeueSidecarItem } from "./workflow-sidecar-queue.js";
 import { maintainWorkerHeartbeat } from "./workflow-worker-heartbeat.js";
-import { measureMemoryPressure } from "./workflow-memory-pressure.js";
+import {
+  measureMemoryPressure,
+  shouldCheckMemoryPressure,
+} from "./workflow-memory-pressure.js";
 import { buildSidecarIterationData } from "./workflow-sidecar-iteration.js";
 import {
   createExecutionGraphUnitDispatchDeps,
@@ -203,9 +206,9 @@ function logCustomVerifyRetrySaveFailure(err: unknown): void {
 }
 
 // ── Memory pressure monitoring (#3331) ──────────────────────────────────
-// Check heap usage every N iterations and trigger graceful shutdown before
-// the OS OOM killer sends SIGKILL. The threshold is 90% of the V8 heap
-// limit (--max-old-space-size or default ~1.5-4GB depending on platform).
+// Check heap usage on session startup, then every N iterations, and trigger
+// graceful shutdown before the OS OOM killer sends SIGKILL. The threshold is
+// 90% of the V8 heap limit (--max-old-space-size or default ~1.5-4GB depending on platform).
 const MEMORY_CHECK_INTERVAL = 5; // check every 5 iterations
 const MAX_CUSTOM_ENGINE_VERIFY_RETRIES = 3;
 
@@ -372,7 +375,7 @@ export async function autoLoop(
 
     // ── Memory pressure check (#3331) ──
     // Graceful shutdown before OOM killer sends SIGKILL.
-    if (iteration % MEMORY_CHECK_INTERVAL === 0) {
+    if (shouldCheckMemoryPressure(iteration, MEMORY_CHECK_INTERVAL)) {
       const mem = measureMemoryPressure();
       debugLog("autoLoop", { phase: "memory-check", ...mem });
       const memoryDecision = decideMemoryPressure({ ...mem, iteration });

package/src/resources/extensions/gsd/auto/orchestrator.ts

@@ -128,6 +128,17 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         await this.deps.health.postAdvanceRecord(stopped);
         return stopped;
       }
+      if (!("unitType" in decision)) {
+        const blocked: AutoAdvanceResult = {
+          kind: "blocked",
+          reason: decision.reason,
+          action: decision.action,
+          stateSnapshot: reconciliation.stateSnapshot,
+        };
+        await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
+        await this.deps.health.postAdvanceRecord(blocked);
+        return blocked;
+      }
 
       const nextKey = `${decision.unitType}:${decision.unitId}`;
 

package/src/resources/extensions/gsd/auto/phases.ts

@@ -1327,9 +1327,15 @@ export async function runDispatch(
   }
 
   const guardBasePath = _resolveDispatchGuardBasePath(s);
+  let mainBranch = "main";
+  try {
+    mainBranch = deps.getMainBranch(guardBasePath);
+  } catch (err) {
+    debugLog("autoLoop", { phase: "getMainBranch-failed", error: String(err) });
+  }
   const priorSliceBlocker = deps.getPriorSliceCompletionBlocker(
     guardBasePath,
-    deps.getMainBranch(guardBasePath),
+    mainBranch,
     unitType,
     unitId,
   );

package/src/resources/extensions/gsd/auto/workflow-memory-pressure.ts

@@ -19,6 +19,19 @@ export interface MeasureMemoryPressureDeps {
   heapLimitBytes: () => number;
 }
 
+/**
+ * Returns true on auto-mode startup, then every configured interval.
+ *
+ * Iteration 1 is checked explicitly so early session memory pressure cannot
+ * bypass the periodic interval guard.
+ */
+export function shouldCheckMemoryPressure(iteration: number, interval: number): boolean {
+  if (!Number.isInteger(interval) || interval <= 0) {
+    throw new Error("Memory pressure check interval must be a positive integer");
+  }
+  return iteration === 1 || iteration % interval === 0;
+}
+
 function defaultHeapLimitBytes(): number {
   const v8 = require("node:v8") as {
     getHeapStatistics?: () => { heap_size_limit?: number };

package/src/resources/extensions/gsd/auto-dispatch.ts

@@ -239,6 +239,12 @@ function missingSliceStop(mid: string, phase: string): DispatchAction {
   };
 }
 
+function isRegistryMilestoneComplete(state: GSDState, mid: string): boolean {
+  return state.registry.some((milestone) =>
+    milestone.id === mid && milestone.status === "complete"
+  );
+}
+
 /**
  * Check for milestone slices missing SUMMARY files.
  * Returns array of missing slice IDs, or empty array if all present or DB unavailable.
@@ -395,6 +401,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
     match: async ({ state, mid, midTitle, basePath, prefs, structuredQuestionsAvailable }) => {
       if (!EXECUTION_ENTRY_PHASES.has(state.phase)) return null;
       if (!MILESTONE_ID_RE.test(mid)) return null;
+      if (isRegistryMilestoneComplete(state, mid)) return null;
       // Align with the plan-v2 gate's lookup semantics: whitespace-only counts
       // as missing, and an auto worktree may fall back to GSD_PROJECT_ROOT.
       if (hasFinalizedMilestoneContext(basePath, mid)) return null;
@@ -709,6 +716,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
     name: "pre-planning (no context) → discuss-milestone",
     match: async ({ state, mid, midTitle, basePath, prefs, structuredQuestionsAvailable }) => {
       if (state.phase !== "pre-planning") return null;
+      if (isRegistryMilestoneComplete(state, mid)) return null;
       const contextFile = resolveMilestoneFile(basePath, mid, "CONTEXT");
       const hasContext = !!(contextFile && (await loadFile(contextFile)));
       if (hasContext) return null; // fall through to next rule
@@ -1322,19 +1330,19 @@ export const DISPATCH_RULES: DispatchRule[] = [
         }
       }
 
-      // Safety guard (#2675): block completion when VALIDATION verdict is
-      // needs-remediation. The state machine treats needs-remediation as
-      // terminal (to prevent validate-milestone loops per #832), but
-      // completing-milestone should NOT proceed — remediation work is needed.
+      // Safety guard (#2675, #5747): block completion when VALIDATION
+      // verdict is non-passing. The state machine treats these verdicts as
+      // terminal, but completing-milestone should NOT proceed — remediation
+      // or human attention is needed.
       const validationFile = resolveMilestoneFile(basePath, mid, "VALIDATION");
       if (validationFile) {
         const validationContent = await loadFile(validationFile);
         if (validationContent) {
           const verdict = extractVerdict(validationContent);
-          if (verdict === "needs-remediation") {
+          if (verdict === "needs-remediation" || verdict === "needs-attention") {
             return {
               action: "stop",
-              reason: `Cannot complete milestone ${mid}: VALIDATION verdict is "needs-remediation". Address the remediation findings and re-run validation, or update the verdict manually.`,
+              reason: `Cannot complete milestone ${mid}: VALIDATION verdict is "${verdict}". Address the validation findings and re-run validation, or update the verdict manually.`,
               level: "warning",
             };
           }

package/src/resources/extensions/gsd/auto-model-selection.ts

@@ -615,10 +615,11 @@ export async function selectAndApplyModel(
  * Handles formats: "provider/model", "bare-id", "org/model-name" (OpenRouter).
  */
 export function resolveModelId<T extends { id: string; provider: string }>(
-  modelId: string,
+  modelId: string | undefined,
   availableModels: T[],
   currentProvider: string | undefined,
 ): T | undefined {
+  if (!modelId) return undefined;
   const slashIdx = modelId.indexOf("/");
 
   if (slashIdx !== -1) {