createRequire() in shared/ui.ts uses CJS resolution which needs a
"require" condition in package.json exports. Without it, Node throws
ERR_PACKAGE_PATH_NOT_EXPORTED.
Verified locally: build, typecheck:extensions, test:unit (0 fail),
test:integration (0 fail), validate-pack all pass.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Slices with declared depends:[S01] now get "dependency slice" message
instead of "earlier slice" from the dispatch guard (PR #1770).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ESM modules don't have require(). Use createRequire(import.meta.url)
which works in both jiti-loaded and native ESM contexts.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
integration_branch_missing is now auto-fixable (fallback to main branch
detection) with warning severity, not error. Test expectations updated.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The test creates a worktree path 11 levels deep, exceeding the 10-level
walk-up limit. In CI, the deep resolved path through a symlinked .gsd
fails to find the .git file and returns the raw path instead of the
project root.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The postinstall script references this file but it wasn't listed in
the package.json files array, causing npm install to fail in CI's
validate-pack step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove duplicate `selfHealRuntimeRecords` import in auto.ts (PRs #1772 and #1773 both added it)
- Add missing `model?: string` to runPreDispatchHooks return type in loop-deps.ts (PR #1781 referenced it)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When verifyExpectedArtifact returns false for a unit type with a known
expected artifact, postUnitPreVerification now returns "retry" instead
of "continue". This sets pendingVerificationRetry on the session so the
next loop iteration re-dispatches with failure context, preventing
13+ blind re-dispatches of the same failed unit before the stuck-loop
detector kicks in.
Closes#1571
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
dispatchHookUnit() previously used a simplistic lookup that only matched
exact model IDs or "provider/id" against ctx.modelRegistry.getAvailable().
Non-Claude models (e.g. openrouter/openai/gpt-5.4-codex) silently fell
back to the session model with no warning.
- Replace simplistic lookup in dispatchHookUnit with resolveModelId() which
handles provider/model, bare-id, and OpenRouter org/model formats
- Add warning notification when a hook model can't be resolved instead of
silent fallback
- Wire sidecar hook model override through runUnitPhase so post-unit hook
model fields are applied after standard model selection
- Consume pre-dispatch hook model field (hookModelOverride) in IterationData
so it reaches the dispatch phase
- Export resolveModelId from auto-model-selection.ts for reuse
- Add resolveModelId to LoopDeps interface for testability
Closes#1720
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The blanket catch in auto/loop.ts treated all errors as transient and retried
up to 3 times, burning ~$20 per retry on guaranteed failures like disk-full.
Infrastructure errors (ENOSPC, ENOMEM, EROFS, EDQUOT, EMFILE, ENFILE) are now
detected before the retry logic and trigger an immediate stop with a clear
error message. Also adds a pre-dispatch disk space check to the health gate
so low-disk conditions are caught before dispatching a unit.
Closes#1694
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
resolveHookArtifactPath() built paths as .gsd/<MID>/slices/... instead
of .gsd/milestones/<MID>/slices/..., causing artifact idempotency checks,
retry_on detection, and skip_if in pre-dispatch hooks to all fail silently.
Closes#1721
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When a milestone has only CONTEXT-DRAFT.md, the survivor branch check
sets hasSurvivorBranch=true and skips all showSmartEntry calls. Auto-mode
then dispatches needs-discussion->stop, creating an infinite loop on
every /gsd run. Add a pre-check: when hasSurvivorBranch is true AND
phase is needs-discussion, route to the interactive discussion handler.
Closes#1726
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Auto-mode launches Playwright/Chrome for browser-based verification but
never closes browsers between units or during stopAuto teardown. Over
retries and re-dispatches, Chrome processes accumulate and spike RAM.
Add closeBrowser() calls in two locations:
- stopAuto() finally block: ensures browser cleanup on any exit path
- postUnitPreVerification(): tears down browser between unit completions
Both use a getBrowser() guard to skip the import when no browser is active,
keeping the lazy-load pattern intact.
Closes#1733
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
After milestone transitions in auto-mode, STATE.md remained stale because
rebuildState() was never called. Additionally, completed-units.json retained
entries from the previous milestone, causing dispatch to skip units in the
new milestone context. This adds rebuildState() to the milestone transition
block (bypassing the 30-second throttle) and resets completed-units tracking
when the active milestone changes.
Closes#1576
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
handleAgentEnd, pauseAuto, and supervision timer catch blocks could
leave the unitPromise unresolved, causing autoLoop to hang permanently
on `await unitPromise`. Add resolveAgentEndCancelled() and call it on
every exit path that previously skipped resolution.
Closes#1666
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pauseAuto now calls closeoutUnit() and clearUnitRuntimeRecord() for the
current unit before setting s.active = false, preventing stale
"dispatched" runtime records from accumulating on disk.
The resume path in startAuto now calls selfHealRuntimeRecords() before
entering autoLoop to clean any stale records that survived from prior
sessions (e.g. if clearUnitRuntimeRecord failed silently during pause).
Closes#1625
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When auto-mode dies after a subagent completes but before agent_end is
processed, the runtime record stays permanently at "phase": "dispatched"
with no recovery path. selfHealRuntimeRecords was only called from the
manual guided-flow wizard, never from auto-loop startup.
Add selfHealRuntimeRecords(basePath, ctx) before both autoLoop call
sites in startAuto (resume path and fresh-start path) so stale
dispatched records are cleared on every auto-mode entry.
Closes#1727
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The dispatch guard checked slices linearly by position, creating deadlocks
when a positionally-earlier slice depended on a positionally-later one
(e.g. S05 depends_on S06). Now checks declared dependencies for slices
that have them, falling back to positional ordering for backward compat.
Closes#1638
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The await_job tool previously blocked the entire agent session with no
escape hatch. This adds a configurable timeout parameter (default 120s)
that races against the job promises. On timeout, jobs continue running
in the background and the agent regains control.
Closes#1690
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When the coordinator process restarts after a crash, the in-memory
orchestrator state is lost even though workers may still be running.
restoreState() only reads orchestrator.json, which can be missing or
corrupt. This adds restoreRuntimeState() as a fallback that rebuilds
coordinator state from live session status files under .gsd/parallel/.
Also adds:
- Worker stderr logging to per-milestone .stderr.log files for
post-mortem diagnostics
- refreshWorkerStatuses(restoreIfNeeded) option for lazy state recovery
from the /gsd parallel status command path
- getWorkerStatuses(basePath) auto-refreshes before returning
- Dead workers with no session file are marked stopped/error instead
of staying permanently 'running'
Builds on #873 (crash recovery) and #932 (PID tracking).
Add defensive fallback in auto-prompts.ts so a missing getLoadedSkills
export degrades gracefully (empty skill list) instead of crashing every
auto-mode dispatch iteration.
Add ensure-workspace-builds.cjs postinstall script that detects missing
dist/ directories in workspace packages and rebuilds them automatically.
This prevents stale-build issues after fresh clones where dist/ is
gitignored but required at runtime by jiti-loaded extensions.
Closes#1734
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Three fixes for the session lock false positive loop:
1. Multi-path cleanup: Lock files accumulate across main project .gsd/,
worktree .gsd/, and projects registry paths, but cleanup only targeted
the current gsdRoot(). Added a _lockDirRegistry Set that tracks all
paths where locks are created. Both the exit handler and
releaseSessionLock() now clean all registered paths.
2. onCompromised hardening: When proper-lockfile fires onCompromised past
the stale window, check if the lock file metadata still contains our
PID before declaring compromise. Long subagent executions can stall
the event loop beyond the 30-min stale window without actual takeover.
3. Error messages: Include the lock file path and PID in error messages,
and suggest `gsd doctor --fix` as the recovery path.
Closes#1578
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The ensureNodeModulesSymlink function silently failed when: a real
directory existed instead of a symlink, the symlink target moved after
npm upgrade, or the symlink pointed to a deleted location. All three
cases left extensions unable to resolve @gsd/* packages, making GSD
completely non-functional.
Three fixes:
1. Use lstatSync to detect real directories vs symlinks and handle each
2. Verify the symlink target actually exists before considering it valid
3. Log a warning on symlinkSync failure instead of silently swallowing
4. Move ensureNodeModulesSymlink before the early-return version check
so it runs on EVERY launch, not just during resource syncs
Closes#1688
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The eager top-level import of @gsd/pi-tui in shared/ui.ts caused any
command that transitively loaded the shared/mod barrel (including /exit)
to fail when extensions were loaded from ~/.gsd/agent/extensions/ where
@gsd/pi-tui has no node_modules resolution path.
Replaced the static import with a lazy require() accessor that defers
resolution to the first makeUI() call, so modules that import shared/mod
for non-TUI exports (constants, format utils, etc.) no longer trigger
the unresolvable dependency.
Closes#1640
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Milestones were being marked complete with only .gsd/ plan files and
zero implementation code. Add hasImplementationArtifacts() that checks
git diff against the main branch to verify non-.gsd/ files exist.
Applied in both verifyExpectedArtifact (post-unit gate) and the
completing-milestone dispatch rule (pre-dispatch guard).
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When the process crashes between marking a task [x] in PLAN.md and
writing SUMMARY.md, the task appears done but has no summary. The doctor
previously papered over this by creating a stub summary, silently losing
the task. Now it unchecks the task so it re-executes on next run.
- Add markTaskUndoneInPlan to roadmap-mutations.ts
- Change doctor task_done_missing_summary fix: uncheck instead of stub
- Add markTaskUndoneInPlan helper to doctor.ts for async file ops
- Add test coverage for both the mutation and doctor behavior
Closes#1650
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When mergeAndExit cannot find the roadmap at the project root, it now
tries the worktree path as a fallback. If neither location has a roadmap,
the teardown preserves the branch (preserveBranch: true) so commits are
not orphaned when the worktree is pruned.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The crash lock was written with the session file path from before
runUnit() called newSession(), causing crash recovery to look up the
previous unit's session file instead of the current one. This meant
recovery reported "No session data recovered" even when 261KB of session
data was on disk.
Split the lock write into two phases: a preliminary lock (unit info only,
no session path) before runUnit for crash identification, then a full
lock update with the correct session file path after runUnit returns.
Closes#1710
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When .gsd is a symlink, git rejects `:!.gsd/...` pathspecs with
"beyond a symbolic link". nativeAddAllWithExclusions now catches this
error and falls back to plain `git add -A` (which respects .gitignore).
Auto-commit failures in postUnit are elevated from debug-only to a
visible warning notification so silent work loss is surfaced.
Closes#1712
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When nativeCommit returns null (nothing to commit), the worktree directory
and milestone branch are now preserved instead of unconditionally deleted.
This prevents data loss on WSL where git's stat cache can cause
autoCommitCurrentBranch to skip commits.
Additionally, nativeMergeSquash now re-throws non-conflict git failures
(bad ref, corrupt repo) instead of masking them as { success: true }.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When .gsd is a symlink, `worktreesDir()` returns the symlink path while
`nativeWorktreeList()` returns the resolved real path. The Set membership
check always fails, causing all worktrees to be flagged as orphaned and
deleted. Apply `realpathSync` and path separator normalization to both
sides of the comparison.
Closes#1715
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The extension loader emits "Extension does not export a valid factory
function" for shared libraries like cmux that live in the extensions/
directory but are not extensions. Previous fixes (#1537, #1545) added
pi manifest opt-out checks in the three discovery layers, but a
defense-in-depth gap remained: if any discovery path fails to filter
a library, loadExtension() reports it as a broken extension.
Add isNonExtensionLibrary() check in loadExtension() itself. When a
module does not export a factory function, the loader now checks the
nearest package.json for a "pi" manifest with no declared extensions
before reporting an error. Libraries with "pi": {} are silently
skipped instead of producing a spurious error on every startup.
Fixes#1709
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
consumeRetryTrigger() cleared the in-memory retry flag but did not undo
the doctor's [x] checkbox, delete SUMMARY.md, remove from completedUnits,
or delete the retry artifact. On the next loop iteration, deriveState()
saw the task as done and advanced past it — silently losing the retry.
When consumeRetryTrigger() returns a trigger, the code now:
1. Unchecks [x] → [ ] for the task in PLAN.md
2. Deletes SUMMARY.md for the task
3. Removes the unit from s.completedUnits and flushes to completed-units.json
4. Deletes the retry_on artifact (e.g. NEEDS-REWORK.md)
5. Invalidates caches so deriveState reads fresh disk state
Also extends the retry trigger type to include retryArtifact so the
consumer knows which artifact to clean up.
Fixes#1714
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes#1726
Two bugs in bootstrapAutoSession():
1. The survivor branch check (Milestone branch recovery #601) included
needs-discussion in its phase filter. A branch created by a prior failed
bootstrap would set hasSurvivorBranch=true, skipping all showSmartEntry
calls and sending the session straight to auto-mode dispatch.
2. The !hasSurvivorBranch block only handled phase==="complete" and
phase==="pre-planning" with showSmartEntry calls. needs-discussion fell
through with no handler, reaching auto-mode which dispatched
"needs-discussion -> stop" immediately. Next /gsd run repeated the cycle.
Fix: Remove needs-discussion from the survivor branch phase filter (only
check pre-planning). Add an explicit needs-discussion handler that routes
to showSmartEntry and aborts if the discussion does not promote the draft.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
parseRoadmapSlices() only understood checkbox format. When LLMs generated
markdown tables (## Slice Overview with pipe-delimited rows), the parser
returned empty results causing all_tasks_done_roadmap_not_checked errors
and auto-mode loops.
Add parseTableSlices() to detect and parse table format including slice
IDs, titles, risk levels, completion status, and dependencies. Broaden
heading matcher to accept alternate slice section headings.
Fixes#1736
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes#1725
Added extractContextTitle() helper to parse the H1 heading from
CONTEXT.md or CONTEXT-DRAFT.md files. When a milestone has no
ROADMAP.md or SUMMARY.md, the title is now extracted from the
context file's heading (e.g. '# M005: Platform Foundation')
instead of falling back to the bare milestone ID.
This affects the 'no roadmap, no summary' branch in _deriveStateImpl()
where milestone titles were previously hardcoded to the milestone ID.
Four fixes for auto-mode telemetry and display bugs:
1. Metrics idempotency guard (metrics.ts)
- snapshotUnitMetrics now deduplicates entries by type+id+startedAt
- Prevents idle-watchdog from creating N duplicate entries per unit
- On duplicate: updates existing entry in-place instead of appending
- Observed: 31 duplicate entries for a single plan-slice unit
2. Elapsed time zero-guard (auto.ts, auto-dashboard.ts, dashboard-overlay.ts)
- getAutoDashboardData guards against autoStartTime=0 (uninitialized)
- formatAutoElapsed rejects negative, NaN, and >30-day values
- Dashboard overlay adds 30-day sanity check before formatting
- Observed: dashboard showed '492804h' (Date.now() - 0)
3. Em/en-dash title auto-fix (doctor.ts)
- Doctor now sanitizes em/en dashes in milestone H1 titles when fix=true
- Replaces Unicode dashes with ASCII hyphens in the roadmap file
- Prevents state document delimiter ambiguity
- delimiter_in_title issues are now marked fixable=true
4. Tests for all three fix areas
- Metrics: idempotency guard, simulated watchdog duplicate pattern
- Dashboard: negative/NaN autoStartTime handling
- Doctor: em-dash auto-fix with fix=true and fix=false verification
Root cause analysis:
- The idle watchdog (auto-timers.ts) calls closeoutUnit every 15s when
idle is detected. closeoutUnit calls snapshotUnitMetrics which blindly
appended to ledger.units. Each watchdog tick created a new entry with
identical type/id/startedAt but incremented finishedAt.
- autoStartTime defaults to 0 in the session class. If getAutoDashboardData
is called before auto-start sets the value, elapsed = Date.now() - 0.
- Milestone titles with em-dashes (U+2014) are written by the LLM during
roadmap creation and never sanitized, causing permanent doctor warnings.
saveJsonFile() used raw writeFileSync which could produce corrupt/partial
files on crash or SIGKILL. This affected 4 callers: queue-order.ts,
metrics.ts, routing-history.ts, and reactive-graph.ts.
Fix: replace writeFileSync with write-to-tmp + renameSync (the same
pattern already used by writeJsonFileAtomic). The rename is atomic on
POSIX filesystems, ensuring the target file is always either the old
valid content or the new valid content — never a partial write.
Tests: 8 new tests covering:
- File creation with valid JSON
- No .tmp file leakage on success
- Parent directory auto-creation
- Atomic overwrite of existing files
- Round-trip compatibility with loadJsonFile
- Equivalence with writeJsonFileAtomic
- Large data objects
- Non-fatal on permission errors
Use Node's os module instead of hardcoded Unix paths:
- tui.ts: path.join(os.tmpdir(), 'tui') for debug dir
- cmux/index.ts: join(tmpdir(), 'cmux.sock') for default socket path
- voice/index.ts: os.homedir() as fallback instead of '/tmp'
Fixes portability on Windows and macOS where /tmp may not exist
or resolves to a different path (e.g. /private/tmp on macOS).
The discuss prompts (discuss.md, guided-discuss-milestone.md,
guided-discuss-slice.md) and queue.md had no web search budget guidance.
The mandatory investigation pass, question rounds, focused research, and
requirements all compete for the same per-turn web_search quota.
Research prompts (research-milestone.md, research-slice.md) already had
budget awareness. This commit adds consistent guidance to all four
discussion/queue prompts:
- Explicit per-turn budget note (typically 3-5 searches)
- Prefer resolve_library/get_library_docs over web_search for library docs
- Prefer search_and_read for one-shot topic research
- Target 2-3 searches in investigation, save budget for later phases
- Distribute searches across turns rather than clustering
- Clarify that multiple text spans per result are normal formatting
CI workflow:
- Replace fetch-depth: 0 with shallow clones (depth 1-2) in lint and
build jobs — saves ~30-60s per job
- Remove fetch-depth: 0 from build and windows-portability (default
depth 1 is sufficient for build/test)
Pipeline workflow:
- Add cache: 'npm' to dev-publish, test-verify, and prod-release
setup-node steps — saves ~1-2 min per job on npm ci
- Move ${{ }} expressions from run: blocks to env: variables in
prod-release and update-builder to prevent command injection vectors
- Use fetch-depth: 2 in update-builder (only needs parent diff)
Build-native workflow:
- Replace hardcoded sleep 30 + single verification with exponential
backoff polling (5s → 10s → 20s → 30s cap, max 5 attempts)
- Replace fixed 15s retry intervals in post-publish smoke test with
exponential backoff (5s → 10s → 20s → 30s cap, 8 attempts)
- Replace fixed 15s dist-tag verification loop with exponential
backoff (6 attempts vs 10 × 15s)
Estimated savings: ~5-10 min per full CI+pipeline run, ~1-3 min per
native build publish.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: TÂCHES <afromanguy@me.com>
