prizmkit 1.1.91 → 1.1.92

package/bundled/dev-pipeline-windows/lib/pipeline.ps1

@@ -34,8 +34,17 @@ function Invoke-PrizmPipeline {
     $envMaxRetryArgs = @('--max-retries', [string]$parsedEnvMaxRetries)
   }
 
+  $envMaxInfraRetryArgs = @()
+  if ($env:MAX_INFRA_RETRIES) {
+    $parsedEnvMaxInfraRetries = 0
+    if (-not [int]::TryParse($env:MAX_INFRA_RETRIES, [ref]$parsedEnvMaxInfraRetries) -or $parsedEnvMaxInfraRetries -lt 1) {
+      throw "MAX_INFRA_RETRIES must be a positive integer: $($env:MAX_INFRA_RETRIES)"
+    }
+    $envMaxInfraRetryArgs = @('--max-infra-retries', [string]$parsedEnvMaxInfraRetries)
+  }
+
   if ($command -in @('help','--help','-h')) {
-    Write-Host "Usage: .\run-$Kind.ps1 run [item-id] [list-path] [--dry-run] [--mode lite|standard|full] [--critic] [--max-retries N] [--timeout seconds]"
+    Write-Host "Usage: .\run-$Kind.ps1 run [item-id] [list-path] [--dry-run] [--mode lite|standard|full] [--critic] [--max-retries N] [--max-infra-retries N] [--timeout seconds]"
     Write-Host "       .\run-$Kind.ps1 status [list-path]"
     Write-Host "       .\run-$Kind.ps1 reset"
     Write-Host ""
@@ -55,7 +64,7 @@ function Invoke-PrizmPipeline {
 
   if ($command -eq 'status') {
     $listPath = if ($remaining.Count -gt 0) { $remaining[0] } else { $defaultList }
-    Invoke-PrizmPythonText $python (@((Join-Path $paths.ScriptsDir $updateScript), $listOption, $listPath, '--state-dir', $stateDir, '--action', 'status') + $envMaxRetryArgs)
+    Invoke-PrizmPythonText $python (@((Join-Path $paths.ScriptsDir $updateScript), $listOption, $listPath, '--state-dir', $stateDir, '--action', 'status') + $envMaxRetryArgs + $envMaxInfraRetryArgs)
     $global:PRIZM_EXIT_CODE = $LASTEXITCODE
     return
   }
@@ -78,6 +87,8 @@ function Invoke-PrizmPipeline {
   }
   $maxRetries = $null
   if ($envMaxRetryArgs.Count -gt 0) { $maxRetries = [int]$envMaxRetryArgs[1] }
+  $maxInfraRetries = $null
+  if ($envMaxInfraRetryArgs.Count -gt 0) { $maxInfraRetries = [int]$envMaxInfraRetryArgs[1] }
   $verboseEnabled = $env:VERBOSE -in @('1','true','yes','on')
   $timeoutSeconds = 0
   if ($env:SESSION_TIMEOUT) {
@@ -153,6 +164,15 @@ function Invoke-PrizmPipeline {
         $maxRetries = $parsedMaxRetries
         continue
       }
+      '^--max-infra-retries$' {
+        $i++
+        $parsedMaxInfraRetries = 0
+        if (-not [int]::TryParse($remaining[$i], [ref]$parsedMaxInfraRetries) -or $parsedMaxInfraRetries -lt 1) {
+          throw "--max-infra-retries must be a positive integer: $($remaining[$i])"
+        }
+        $maxInfraRetries = $parsedMaxInfraRetries
+        continue
+      }
       '^--timeout$' {
         $i++
         if ($i -ge $remaining.Count) { throw '--timeout requires a seconds value.' }
@@ -177,12 +197,15 @@ function Invoke-PrizmPipeline {
   }
   $maxRetryArgs = @()
   if ($maxRetries -ne $null) { $maxRetryArgs = @('--max-retries', [string]$maxRetries) }
+  $maxInfraRetryArgs = @()
+  if ($maxInfraRetries -ne $null) { $maxInfraRetryArgs = @('--max-infra-retries', [string]$maxInfraRetries) }
   if ($verboseEnabled) {
     $modeLabel = if ($mode) { $mode } else { 'auto' }
     $criticLabel = if ($critic) { $critic } else { 'plan-default' }
     $retryLabel = if ($maxRetries -ne $null) { [string]$maxRetries } else { 'default' }
+    $infraRetryLabel = if ($maxInfraRetries -ne $null) { [string]$maxInfraRetries } else { 'default' }
     Write-PrizmInfo "Verbose mode enabled."
-    Write-PrizmInfo "Effective options: mode=$modeLabel critic=$criticLabel maxRetries=$retryLabel timeoutSeconds=$timeoutSeconds staleKillThreshold=$staleKillThreshold dryRun=$dryRun"
+    Write-PrizmInfo "Effective options: mode=$modeLabel critic=$criticLabel maxRetries=$retryLabel maxInfraRetries=$infraRetryLabel timeoutSeconds=$timeoutSeconds staleKillThreshold=$staleKillThreshold dryRun=$dryRun"
   }
 
   # Validate PRIZMKIT_EFFORT early (fail-fast before any sessions are spawned)
@@ -241,17 +264,27 @@ function Invoke-PrizmPipeline {
 
   function Get-PrizmGitDirtyPaths {
     param([string]$ProjectRoot)
-    $lines = & git -C $ProjectRoot status --porcelain 2>$null
+    $hiddenToolWorktreeExcludes = Get-PrizmHiddenToolWorktreeExcludes
+    $lines = & git -C $ProjectRoot status --porcelain -- . @hiddenToolWorktreeExcludes 2>$null
     $paths = @()
     foreach ($line in $lines) {
       if ([string]::IsNullOrWhiteSpace($line) -or $line.Length -lt 4) { continue }
       $path = $line.Substring(3).Trim()
       if ($path -match ' -> ') { $path = ($path -split ' -> ')[-1].Trim() }
-      $paths += (($path -replace '\\', '/').Trim('"').TrimStart([char[]]@('.', '/')))
+      $paths += (($path -replace '\\', '/').Trim('"').TrimStart([char[]]@('/')))
     }
     return @($paths)
   }
 
+  function Test-PrizmPipelineIgnoredPath {
+    param([string]$Path)
+    $normalizedPath = (($Path -replace '\\', '/').Trim('"').TrimStart([char[]]@('/')))
+    $segments = @($normalizedPath -split '/' | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    if ($segments.Count -lt 2) { return $false }
+    if (-not $segments[0].StartsWith('.')) { return $false }
+    return $segments[1] -in @('worktree', 'worktrees')
+  }
+
   function Test-PrizmPipelineBookkeepingPath {
     param(
       [string]$ProjectRoot,
@@ -270,6 +303,7 @@ function Invoke-PrizmPipeline {
   function Test-PrizmGitWorkDirty {
     param([string]$ProjectRoot, [string]$StateDir, [string]$ListPath)
     foreach ($path in (Get-PrizmGitDirtyPaths $ProjectRoot)) {
+      if (Test-PrizmPipelineIgnoredPath $path) { continue }
       if (-not (Test-PrizmPipelineBookkeepingPath $ProjectRoot $path $StateDir $ListPath)) {
         return $true
       }
@@ -279,7 +313,8 @@ function Invoke-PrizmPipeline {
 
   function Test-PrizmGitDirty {
     param([string]$ProjectRoot)
-    $dirty = & git -C $ProjectRoot status --porcelain 2>$null | Select-Object -First 1
+    $hiddenToolWorktreeExcludes = Get-PrizmHiddenToolWorktreeExcludes
+    $dirty = & git -C $ProjectRoot status --porcelain -- . @hiddenToolWorktreeExcludes 2>$null | Select-Object -First 1
     return -not [string]::IsNullOrWhiteSpace([string]$dirty)
   }
 
@@ -294,12 +329,12 @@ function Invoke-PrizmPipeline {
   }
 
   function Write-PrizmStaleKillMarker {
-    param([string]$MarkerPath, [int]$StaleSeconds, [int]$Threshold)
+    param([string]$MarkerPath, [int]$StaleSeconds, [int]$Threshold, [string]$Reason = 'stale_session')
     $markerDir = Split-Path $MarkerPath -Parent
     if ($markerDir) { New-Item -ItemType Directory -Force -Path $markerDir | Out-Null }
     [ordered]@{
       killed_at = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
-      reason = 'stale_session'
+      reason = $Reason
       stale_seconds = $StaleSeconds
       threshold = $Threshold
     } | ConvertTo-Json -Compress | Set-Content -Path $MarkerPath -Encoding UTF8
@@ -307,14 +342,16 @@ function Invoke-PrizmPipeline {
 
   function Invoke-PrizmGitAutoCommit {
     param([string]$ProjectRoot, [string]$Message)
-    & git -C $ProjectRoot add -A *> $null
+    $hiddenToolWorktreeExcludes = Get-PrizmHiddenToolWorktreeExcludes
+    & git -C $ProjectRoot add -A -- . @hiddenToolWorktreeExcludes *> $null
     & git -C $ProjectRoot commit --no-verify -m $Message *> $null
     return $LASTEXITCODE -eq 0
   }
 
   function Invoke-PrizmGitIncludeRemainingArtifacts {
     param([string]$ProjectRoot, [string]$ItemId)
-    & git -C $ProjectRoot add -A *> $null
+    $hiddenToolWorktreeExcludes = Get-PrizmHiddenToolWorktreeExcludes
+    & git -C $ProjectRoot add -A -- . @hiddenToolWorktreeExcludes *> $null
     & git -C $ProjectRoot commit --no-verify --amend --no-edit *> $null
     if ($LASTEXITCODE -eq 0) { return }
     & git -C $ProjectRoot commit --no-verify -m "chore($ItemId): include remaining session artifacts" *> $null
@@ -657,7 +694,11 @@ function Invoke-PrizmPipeline {
     $devBranchName = ''
     $hadDirtyBaseline = if ($isGitRepository) { Test-PrizmGitWorkDirty $paths.ProjectRoot $stateDir $listPath } else { $false }
     if ($hadDirtyBaseline) {
-      Write-PrizmWarn "Dirty working tree detected before pipeline bookkeeping; session success requires a new commit."
+      Write-PrizmError "Dirty working tree detected before $CurrentItemId; refusing to run on $originalBranch."
+      Write-PrizmError "Commit/stash your changes or start from a clean branch, then rerun the pipeline."
+      $script:PRIZM_ITEM_LIST_STATUS = ''
+      $script:PRIZM_ITEM_EXIT_CODE = 1
+      return
     }
 
     if ($dryRun) {
@@ -672,7 +713,7 @@ function Invoke-PrizmPipeline {
         }
       }
     } else {
-      $start = Invoke-PrizmPythonJson $python (@((Join-Path $paths.ScriptsDir $updateScript), $listOption, $listPath, '--state-dir', $stateDir, '--action', 'start', $idOption, $CurrentItemId, '--session-id', $sessionId) + $maxRetryArgs)
+      $start = Invoke-PrizmPythonJson $python (@((Join-Path $paths.ScriptsDir $updateScript), $listOption, $listPath, '--state-dir', $stateDir, '--action', 'start', $idOption, $CurrentItemId, '--session-id', $sessionId) + $maxRetryArgs + $maxInfraRetryArgs)
       if ($start.retry_count -ne $null) { $retryCount = [string]$start.retry_count }
       if ($start.resume_from_phase -ne $null) { $resumePhase = [string]$start.resume_from_phase }
 
@@ -683,7 +724,10 @@ function Invoke-PrizmPipeline {
           $devBranchName = $candidateBranch
           Write-PrizmInfo "Dev branch: $devBranchName"
         } else {
-          Write-PrizmWarn "Failed to create dev branch; running on current branch: $originalBranch"
+          Write-PrizmError "Failed to create dev branch: $candidateBranch from $originalBranch - aborting to avoid running on $originalBranch"
+          $script:PRIZM_ITEM_LIST_STATUS = ''
+          $script:PRIZM_ITEM_EXIT_CODE = 1
+          return
         }
       }
     }
@@ -739,6 +783,7 @@ function Invoke-PrizmPipeline {
 
     $elapsedSeconds = 0
     $staleSeconds = 0
+    $staleReason = 'stale_session'
     $previousLogSize = 0
     $previousProgressSignature = ''
     $previousChildActivitySignature = ''
@@ -799,10 +844,13 @@ function Invoke-PrizmPipeline {
       $previousErrorLoopSignature = $errorLoopSignature
 
       if ($errorLoopDetected) {
+        $staleReason = 'error_loop'
         $staleSeconds = $effectiveStaleKillThreshold
       } elseif ($growth -gt 0 -or $childAdvanced -or $progressAdvanced) {
+        $staleReason = 'stale_session'
         $staleSeconds = 0
       } else {
+        $staleReason = 'stale_session'
         $staleSeconds += $waitSeconds
       }
 
@@ -825,8 +873,12 @@ function Invoke-PrizmPipeline {
       }
       if ($effectiveStaleKillThreshold -gt 0 -and $staleSeconds -ge $effectiveStaleKillThreshold) {
         $wasStaleKilled = $true
-        Write-PrizmWarn "Session stale-killed (no progress for ${effectiveStaleKillThreshold}s)"
-        Write-PrizmStaleKillMarker $staleKillMarker $staleSeconds $effectiveStaleKillThreshold
+        if ($staleReason -eq 'error_loop') {
+          Write-PrizmWarn "Session stale-killed due to repeated read-offset/wasted-call error loop"
+        } else {
+          Write-PrizmWarn "Session stale-killed (no progress for ${effectiveStaleKillThreshold}s)"
+        }
+        Write-PrizmStaleKillMarker $staleKillMarker $staleSeconds $effectiveStaleKillThreshold $staleReason
         Stop-PrizmSessionProcess $pidPath
         if ($staleKillGraceSeconds -gt 0) { Start-Sleep -Seconds $staleKillGraceSeconds }
         break
@@ -853,6 +905,15 @@ function Invoke-PrizmPipeline {
     }
     Stop-PrizmProgressParser $parserProcess
 
+    $staleKillReason = ''
+    if (Test-Path $staleKillMarker) {
+      try {
+        $staleKillData = Get-Content $staleKillMarker -Raw | ConvertFrom-Json
+        if ($staleKillData.PSObject.Properties['reason']) { $staleKillReason = [string]$staleKillData.reason }
+      } catch {
+        $staleKillReason = ''
+      }
+    }
     $wasInfraError = ($exitCode -ne 0 -and (Test-PrizmInfraError -SessionLog $sessionLog -ProgressJson $progressJson))
     $wasAiRuntimeError = Test-PrizmAiRuntimeError -SessionLog $sessionLog -ProgressJson $progressJson
     $semanticCompletion = if ($Kind -eq 'feature' -and $isGitRepository) {
@@ -878,16 +939,18 @@ function Invoke-PrizmPipeline {
       Write-PrizmWarn "AI session failed due to AI CLI/provider infrastructure error"
       Write-PrizmWarn "Infrastructure errors are retried without consuming code retry budget"
     } elseif ($wasStaleKilled -or (Test-Path $staleKillMarker)) {
-      Write-PrizmWarn "Session was stale-killed by heartbeat monitor (no progress for too long)"
-      Write-PrizmWarn "Stale-killed sessions are treated as failed; dev branch is preserved for inspection"
+      if ($staleKillReason -eq 'error_loop') {
+        Write-PrizmWarn "Session was killed by heartbeat monitor due to repeated read-offset/wasted-call errors"
+      } else {
+        Write-PrizmWarn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+      }
+      Write-PrizmWarn "Heartbeat-killed sessions are treated as failed; dev branch is preserved for inspection"
     } elseif ($exitCode -ne 0) {
       Write-PrizmWarn "AI session exited with code $exitCode"
     } elseif (-not $isGitRepository) {
       Write-PrizmWarn "AI session exited cleanly, but project is not a git repository; cannot verify work was committed."
     } elseif (Test-PrizmGitCommitsSince $paths.ProjectRoot $baseCommit) {
       $status = 'success'
-    } elseif ($hadDirtyBaseline) {
-      Write-PrizmWarn "AI session exited cleanly but produced no new commits; pre-existing dirty tree will not be auto-committed."
     } elseif (Test-PrizmGitWorkDirty $paths.ProjectRoot $stateDir $listPath) {
       Write-PrizmWarn "AI session exited cleanly but produced no commits; auto-committing dirty work tree."
       if (Invoke-PrizmGitAutoCommit $paths.ProjectRoot "chore($CurrentItemId): auto-commit session work") {
@@ -903,17 +966,12 @@ function Invoke-PrizmPipeline {
     $itemListStatus = ''
     if ($status -eq 'success') {
       if (Test-PrizmGitDirty $paths.ProjectRoot) {
-        if ($hadDirtyBaseline) {
-          Write-PrizmInfo "Auto-committing pipeline bookkeeping artifacts only."
-          Invoke-PrizmGitIncludeBookkeepingArtifacts $paths.ProjectRoot $stateDir $listPath
-        } else {
-          Write-PrizmInfo "Auto-committing remaining session artifacts."
-          Invoke-PrizmGitIncludeRemainingArtifacts $paths.ProjectRoot $CurrentItemId
-        }
+        Write-PrizmInfo "Auto-committing remaining session artifacts."
+        Invoke-PrizmGitIncludeRemainingArtifacts $paths.ProjectRoot $CurrentItemId
       }
 
       if ($status -eq 'success') {
-        $updateResult = Invoke-PrizmPythonJson $python (@((Join-Path $paths.ScriptsDir $updateScript), $listOption, $listPath, '--state-dir', $stateDir, '--action', 'update', $idOption, $CurrentItemId, '--session-id', $sessionId, '--session-status', $status) + $maxRetryArgs)
+        $updateResult = Invoke-PrizmPythonJson $python (@((Join-Path $paths.ScriptsDir $updateScript), $listOption, $listPath, '--state-dir', $stateDir, '--action', 'update', $idOption, $CurrentItemId, '--session-id', $sessionId, '--session-status', $status) + $maxRetryArgs + $maxInfraRetryArgs)
         if ($updateResult -and $updateResult.PSObject.Properties['new_status']) {
           $itemListStatus = [string]$updateResult.new_status
         }
@@ -950,7 +1008,7 @@ function Invoke-PrizmPipeline {
           Write-PrizmRuntimeFailureLog $failureLog $CurrentItemId $sessionId $status $exitCode $staleKillMarker $progressJson $checkpointPath $paths.ProjectRoot $baseCommit
         }
       }
-      $updateResult = Invoke-PrizmPythonJson $python (@((Join-Path $paths.ScriptsDir $updateScript), $listOption, $listPath, '--state-dir', $stateDir, '--action', 'update', $idOption, $CurrentItemId, '--session-id', $sessionId, '--session-status', $status) + $maxRetryArgs)
+      $updateResult = Invoke-PrizmPythonJson $python (@((Join-Path $paths.ScriptsDir $updateScript), $listOption, $listPath, '--state-dir', $stateDir, '--action', 'update', $idOption, $CurrentItemId, '--session-id', $sessionId, '--session-status', $status) + $maxRetryArgs + $maxInfraRetryArgs)
       if ($updateResult -and $updateResult.PSObject.Properties['new_status']) {
         $itemListStatus = [string]$updateResult.new_status
       }
@@ -1030,7 +1088,7 @@ function Invoke-PrizmPipeline {
       $global:PRIZM_EXIT_CODE = $lastExitCode
       return
     } elseif ($lastExitCode -ne 0 -and $stopOnFailure) {
-      Write-PrizmInfo "STOP_ON_FAILURE: $nextItemId is $($script:PRIZM_ITEM_LIST_STATUS); retry budget not exhausted, continuing."
+      Write-PrizmInfo "STOP_ON_FAILURE: $nextItemId is $($script:PRIZM_ITEM_LIST_STATUS); code/infra retry budget not exhausted, continuing."
     }
   }
 }

package/bundled/dev-pipeline-windows/scripts/update-bug-status.py

@@ -16,7 +16,7 @@ Usage:
         --bug-list <path> --state-dir <path> \
         --action <get_next|start|update|status|pause|reset|clean|unskip> \
         [--bug-id <id>] [--session-status <status>] \
-        [--session-id <id>] [--max-retries <n>]
+        [--session-id <id>] [--max-retries <n>] [--max-infra-retries <n>]
 """
 
 import argparse
@@ -75,7 +75,8 @@ def parse_args():
         help="Session outcome status (required for 'update' action)",
     )
     parser.add_argument("--session-id", default=None, help="Session ID (optional, for 'update' action)")
-    parser.add_argument("--max-retries", type=int, default=3, help="Maximum retry count (default: 3)")
+    parser.add_argument("--max-retries", type=int, default=3, help="Maximum code retry count (default: 3)")
+    parser.add_argument("--max-infra-retries", type=int, default=3, help="Maximum infrastructure retry count (default: 3)")
     parser.add_argument("--project-root", default=None, help="Project root directory. Required for 'clean' action.")
     return parser.parse_args()
 
@@ -98,6 +99,9 @@ def load_bug_status(state_dir, bug_id):
             "bug_id": bug_id,
             "retry_count": 0,
             "max_retries": 3,
+            "max_infra_retries": 3,
+            "infra_error_count": 0,
+            "last_infra_error_session_id": None,
             "sessions": [],
             "last_session_id": None,
             "resume_from_phase": None,
@@ -111,6 +115,9 @@ def load_bug_status(state_dir, bug_id):
             "bug_id": bug_id,
             "retry_count": 0,
             "max_retries": 3,
+            "max_infra_retries": 3,
+            "infra_error_count": 0,
+            "last_infra_error_session_id": None,
             "sessions": [],
             "last_session_id": None,
             "resume_from_phase": None,
@@ -234,6 +241,7 @@ def action_get_next(bug_list_data, state_dir):
         "title": chosen.get("title", ""),
         "severity": chosen.get("severity", "medium"),
         "retry_count": chosen_status_data.get("retry_count", 0),
+        "infra_error_count": chosen_status_data.get("infra_error_count", 0),
         "resume_from_phase": chosen_status_data.get("resume_from_phase", None),
     }
     print(json.dumps(result, indent=2, ensure_ascii=False))
@@ -248,6 +256,7 @@ def action_update(args, bug_list_path, state_dir):
     session_status = args.session_status
     session_id = args.session_id
     max_retries = args.max_retries
+    max_infra_retries = args.max_infra_retries
 
     if not bug_id:
         error_out("--bug-id is required for 'update' action")
@@ -262,6 +271,8 @@ def action_update(args, bug_list_path, state_dir):
     new_status = get_bug_status_from_list(bug_list_path, bug_id)
 
     if session_status == "success":
+        bs["infra_error_count"] = 0
+        bs["last_infra_error_session_id"] = None
         new_status = "completed"
         bs["resume_from_phase"] = None
         err = update_bug_in_list(bug_list_path, bug_id, "completed")
@@ -286,11 +297,25 @@ def action_update(args, bug_list_path, state_dir):
             error_out("Failed to update .prizmkit/plans/bug-fix-list.json: {}".format(err))
             return
     elif session_status == "infra_error":
-        new_status = "pending"
-        bs["infra_error_count"] = bs.get("infra_error_count", 0) + 1
+        # AI CLI/provider outage, auth failure, gateway error, etc.
+        # Infra failures do not consume the code retry budget, but they still
+        # need their own bounded budget so a flaky provider cannot loop forever.
+        infra_error_count = bs.get("infra_error_count", 0) + 1
+        bs["infra_error_count"] = infra_error_count
         bs["last_infra_error_session_id"] = session_id
+        bs["max_infra_retries"] = max_infra_retries
+        bs["degraded_reason"] = "infra_error"
+        if session_id:
+            bs["last_session_id"] = session_id
         bs["resume_from_phase"] = None
 
+        if infra_error_count >= max_infra_retries:
+            new_status = "failed"
+            if session_id:
+                bs["last_failed_session_id"] = session_id
+        else:
+            new_status = "pending"
+
         err = update_bug_in_list(bug_list_path, bug_id, new_status)
         if err:
             error_out("Failed to update .prizmkit/plans/bug-fix-list.json: {}".format(err))
@@ -338,6 +363,8 @@ def action_update(args, bug_list_path, state_dir):
         "session_status": session_status,
         "new_status": new_status,
         "retry_count": bs["retry_count"],
+        "infra_error_count": bs.get("infra_error_count", 0),
+        "max_infra_retries": max_infra_retries,
         "resume_from_phase": bs.get("resume_from_phase"),
         "updated_at": bs["updated_at"],
     }
@@ -577,6 +604,8 @@ def action_reset(args, bug_list_path, state_dir):
     old_retry = bs.get("retry_count", 0)
 
     bs["retry_count"] = 0
+    bs["infra_error_count"] = 0
+    bs["last_infra_error_session_id"] = None
     bs["sessions"] = []
     bs["last_session_id"] = None
     bs["resume_from_phase"] = None
@@ -652,6 +681,8 @@ def action_clean(args, bug_list_path, state_dir):
     old_retry = bs.get("retry_count", 0)
 
     bs["retry_count"] = 0
+    bs["infra_error_count"] = 0
+    bs["last_infra_error_session_id"] = None
     bs["sessions"] = []
     bs["last_session_id"] = None
     bs["resume_from_phase"] = None
@@ -740,6 +771,8 @@ def action_start(args, bug_list_path, state_dir):
         "bug_id": bug_id,
         "old_status": old_status,
         "new_status": "in_progress",
+        "retry_count": bs.get("retry_count", 0),
+        "infra_error_count": bs.get("infra_error_count", 0),
         "updated_at": bs["updated_at"],
     }
     print(json.dumps(result, indent=2, ensure_ascii=False))
@@ -816,6 +849,8 @@ def action_unskip(args, bug_list_path, state_dir):
     for bid in to_reset:
         bs = load_bug_status(state_dir, bid)
         bs["retry_count"] = 0
+        bs["infra_error_count"] = 0
+        bs["last_infra_error_session_id"] = None
         bs["sessions"] = []
         bs["last_session_id"] = None
         bs["resume_from_phase"] = None

package/bundled/dev-pipeline-windows/scripts/update-feature-status.py

@@ -17,7 +17,7 @@ Usage:
         --feature-list <path> --state-dir <path> \
         --action <get_next|start|update|status|pause|reset|clean|complete|unskip> \
         [--feature-id <id>] [--session-status <status>] \
-        [--session-id <id>] [--max-retries <n>] \
+        [--session-id <id>] [--max-retries <n>] [--max-infra-retries <n>] \
         [--features <filter>]
 """
 
@@ -94,7 +94,13 @@ def parse_args():
         "--max-retries",
         type=int,
         default=3,
-        help="Maximum retry count before marking as failed (default: 3)",
+        help="Maximum code retry count before marking as failed (default: 3)",
+    )
+    parser.add_argument(
+        "--max-infra-retries",
+        type=int,
+        default=3,
+        help="Maximum infrastructure retry count before marking as failed (default: 3)",
     )
     parser.add_argument(
         "--feature-slug",
@@ -170,6 +176,9 @@ def load_feature_status(state_dir, feature_id):
             "feature_id": feature_id,
             "retry_count": 0,
             "max_retries": 3,
+            "max_infra_retries": 3,
+            "infra_error_count": 0,
+            "last_infra_error_session_id": None,
             "sessions": [],
             "last_session_id": None,
             "resume_from_phase": None,
@@ -183,6 +192,9 @@ def load_feature_status(state_dir, feature_id):
             "feature_id": feature_id,
             "retry_count": 0,
             "max_retries": 3,
+            "max_infra_retries": 3,
+            "infra_error_count": 0,
+            "last_infra_error_session_id": None,
             "sessions": [],
             "last_session_id": None,
             "resume_from_phase": None,
@@ -565,6 +577,7 @@ def action_get_next(feature_list_data, state_dir, feature_filter=None):
         "feature_id": chosen_id,
         "title": chosen.get("title", ""),
         "retry_count": chosen_status_data.get("retry_count", 0),
+        "infra_error_count": chosen_status_data.get("infra_error_count", 0),
         "resume_from_phase": chosen_status_data.get("resume_from_phase", None),
     }
     print(json.dumps(result, indent=2, ensure_ascii=False))
@@ -585,6 +598,7 @@ def action_update(args, feature_list_path, state_dir):
     session_status = args.session_status
     session_id = args.session_id
     max_retries = args.max_retries
+    max_infra_retries = args.max_infra_retries
 
     if not feature_id:
         error_out("--feature-id is required for 'update' action")
@@ -600,6 +614,8 @@ def action_update(args, feature_list_path, state_dir):
     new_status = current_list_status
 
     if session_status == "success":
+        fs["infra_error_count"] = 0
+        fs["last_infra_error_session_id"] = None
         # No-op guard: if this exact successful session was already recorded,
         # avoid rewriting state files again (prevents post-commit dirty changes).
         existing_sessions = fs.get("sessions", [])
@@ -616,6 +632,8 @@ def action_update(args, feature_list_path, state_dir):
                 "session_status": session_status,
                 "new_status": "completed",
                 "retry_count": fs.get("retry_count", 0),
+                "infra_error_count": fs.get("infra_error_count", 0),
+                "max_infra_retries": max_infra_retries,
                 "resume_from_phase": fs.get("resume_from_phase"),
                 "updated_at": fs.get("updated_at"),
                 "no_op": True,
@@ -654,15 +672,24 @@ def action_update(args, feature_list_path, state_dir):
             return
     elif session_status == "infra_error":
         # AI CLI/provider outage, auth failure, gateway error, etc.
-        # This is outside the code's control, so keep the item pending without
-        # consuming the task's retry budget.
-        new_status = "pending"
-        fs["infra_error_count"] = fs.get("infra_error_count", 0) + 1
+        # Infra failures do not consume the code retry budget, but they still
+        # need their own bounded budget so a flaky provider cannot loop forever.
+        infra_error_count = fs.get("infra_error_count", 0) + 1
+        fs["infra_error_count"] = infra_error_count
         fs["last_infra_error_session_id"] = session_id
+        fs["max_infra_retries"] = max_infra_retries
+        fs["degraded_reason"] = "infra_error"
         if session_id:
             fs["last_session_id"] = session_id
         fs["resume_from_phase"] = None
 
+        if infra_error_count >= max_infra_retries:
+            new_status = "failed"
+            if session_id:
+                fs["last_failed_session_id"] = session_id
+        else:
+            new_status = "pending"
+
         err = update_feature_in_list(feature_list_path, feature_id, new_status)
         if err:
             error_out("Failed to update .prizmkit/plans/feature-list.json: {}".format(err))
@@ -714,6 +741,8 @@ def action_update(args, feature_list_path, state_dir):
         "session_status": session_status,
         "new_status": new_status,
         "retry_count": fs["retry_count"],
+        "infra_error_count": fs.get("infra_error_count", 0),
+        "max_infra_retries": max_infra_retries,
         "resume_from_phase": fs.get("resume_from_phase"),
         "updated_at": fs["updated_at"],
     }
@@ -1143,6 +1172,8 @@ def action_start(args, feature_list_path, state_dir):
         "feature_id": feature_id,
         "old_status": old_status,
         "new_status": "in_progress",
+        "retry_count": fs.get("retry_count", 0),
+        "infra_error_count": fs.get("infra_error_count", 0),
         "updated_at": fs["updated_at"],
     }
     print(json.dumps(result, indent=2, ensure_ascii=False))
@@ -1171,6 +1202,8 @@ def action_reset(args, feature_list_path, state_dir):
 
     # Reset runtime fields
     fs["retry_count"] = 0
+    fs["infra_error_count"] = 0
+    fs["last_infra_error_session_id"] = None
     fs["sessions"] = []
     fs["last_session_id"] = None
     fs["resume_from_phase"] = None
@@ -1264,6 +1297,8 @@ def action_clean(args, feature_list_path, state_dir):
     old_retry = fs.get("retry_count", 0)
 
     fs["retry_count"] = 0
+    fs["infra_error_count"] = 0
+    fs["last_infra_error_session_id"] = None
     fs["sessions"] = []
     fs["last_session_id"] = None
     fs["resume_from_phase"] = None
@@ -1423,6 +1458,8 @@ def action_unskip(args, feature_list_path, state_dir):
     for fid in to_reset:
         fs = load_feature_status(state_dir, fid)
         fs["retry_count"] = 0
+        fs["infra_error_count"] = 0
+        fs["last_infra_error_session_id"] = None
         fs["sessions"] = []
         fs["last_session_id"] = None
         fs["resume_from_phase"] = None