@opengsd/gsd-pi 1.0.2-dev.e70300c → 1.0.2-dev.fb7ddf1

package/scripts/install/detect-existing.js

@@ -5,11 +5,20 @@
 import { createRequire } from 'module'
 import { dirname, join } from 'path'
 import { fileURLToPath } from 'url'
+import { detectPackageManager } from './npm-global.js'
 
 const require = createRequire(import.meta.url)
 const { GSD_PI_BRAND } = require(join(dirname(fileURLToPath(import.meta.url)), '..', 'lib', 'logo.cjs'))
 
 export function parseInstalledVersion(npmListJson) {
+  if (Array.isArray(npmListJson)) {
+    for (const entry of npmListJson) {
+      const found = parseInstalledVersion(entry)
+      if (found) return found
+    }
+    return null
+  }
+
   if (!npmListJson || typeof npmListJson !== 'object') return null
 
   const direct = npmListJson.dependencies?.['@opengsd/gsd-pi']?.version
@@ -30,6 +39,10 @@ export function parseInstalledVersion(npmListJson) {
   return walk(npmListJson)
 }
 
+function getPackageManagerBin(packageManager) {
+  return process.platform === 'win32' ? `${packageManager}.cmd` : packageManager
+}
+
 /**
  * Decide install action for non-interactive or pre-prompt routing.
  */
@@ -39,11 +52,12 @@ export function compareActions({ installed, yesMode }) {
   return 'prompt'
 }
 
-export async function detectInstalledVersion() {
+export async function detectInstalledVersion(options = {}) {
   const { execFileSync } = await import('child_process')
-  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+  const packageManager = options.packageManager ?? detectPackageManager()
+  const bin = getPackageManagerBin(packageManager)
   try {
-    const raw = execFileSync(npm, ['list', '-g', '@opengsd/gsd-pi', '--json'], {
+    const raw = execFileSync(bin, ['list', '-g', '@opengsd/gsd-pi', '--json'], {
       encoding: 'utf-8',
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: 30_000,

package/scripts/install/npm-global.js

@@ -1,14 +1,61 @@
 import { execFileSync, spawn } from 'child_process'
-import { join } from 'path'
+import { homedir } from 'os'
+import { join, resolve as resolvePath, sep } from 'path'
 
-function getNpm() {
-  return process.platform === 'win32' ? 'npm.cmd' : 'npm'
+const PACKAGE_MANAGERS = new Set(['npm', 'pnpm'])
+
+function normalizePackageManager(value) {
+  return PACKAGE_MANAGERS.has(value) ? value : 'npm'
+}
+
+function hasPnpmPath(value = '') {
+  const normalized = value.replace(/\\/g, '/').toLowerCase()
+  return (
+    normalized.includes('/.pnpm/') ||
+    normalized.endsWith('/pnpm') ||
+    normalized.endsWith('/pnpm.cjs') ||
+    normalized.endsWith('/pnpm.js')
+  )
+}
+
+function pathStartsWith(pathValue = '', dir) {
+  if (!pathValue) return false
+  const resolvedPath = resolvePath(pathValue)
+  const resolvedDir = resolvePath(dir)
+  return resolvedPath === resolvedDir || resolvedPath.startsWith(resolvedDir + sep)
+}
+
+function hasPnpmBinPath(env, argv1) {
+  const pnpmBinDirs = []
+  if (env.PNPM_HOME) pnpmBinDirs.push(env.PNPM_HOME)
+  pnpmBinDirs.push(join(homedir(), 'Library', 'pnpm'))
+  pnpmBinDirs.push(join(homedir(), '.local', 'share', 'pnpm'))
+
+  return pnpmBinDirs.some((dir) => pathStartsWith(argv1, dir) || pathStartsWith(env.npm_execpath, dir))
+}
+
+export function detectPackageManager(env = process.env, argv1 = process.argv[1]) {
+  const userAgent = env.npm_config_user_agent || ''
+  if (userAgent.startsWith('pnpm/')) return 'pnpm'
+  // Installer runs under npm during npm install; keep that context authoritative.
+  if (userAgent.startsWith('npm/')) return 'npm'
+
+  if (hasPnpmPath(env.npm_execpath || '')) return 'pnpm'
+  if (hasPnpmPath(argv1 || '')) return 'pnpm'
+  if (hasPnpmBinPath(env, argv1)) return 'pnpm'
+
+  return 'npm'
+}
+
+function getPackageManagerBin(packageManager) {
+  const bin = normalizePackageManager(packageManager)
+  return process.platform === 'win32' ? `${bin}.cmd` : bin
 }
 
-const NPM_OUTPUT_LIMIT = 64 * 1024
+const PM_OUTPUT_LIMIT = 64 * 1024
 
-function runNpm(args) {
-  return execFileSync(getNpm(), args, {
+function runPackageManager(packageManager, args) {
+  return execFileSync(getPackageManagerBin(packageManager), args, {
     encoding: 'utf-8',
     stdio: ['ignore', 'pipe', 'pipe'],
     timeout: 120_000,
@@ -16,30 +63,30 @@ function runNpm(args) {
   }).trim()
 }
 
-function formatNpmFailure(result) {
+function formatPackageManagerFailure(packageManager, result) {
   const output = `${result.stderr}\n${result.stdout}`.trim()
   const meaningful = output
     .split('\n')
-    .filter((line) => !line.includes('npm warn') && !line.includes('npm WARN') && line.trim())
+    .filter((line) => line.trim() && !/^(?:npm\s+warn|warn)\b/i.test(line.trim()))
     .slice(-3)
     .join('; ')
-  return meaningful || result.error?.message || 'npm install failed'
+  return meaningful || result.error?.message || `${packageManager} install failed`
 }
 
 function appendLimited(value, chunk) {
-  if (value.length >= NPM_OUTPUT_LIMIT) return value
-  return value + chunk.slice(0, NPM_OUTPUT_LIMIT - value.length)
+  if (value.length >= PM_OUTPUT_LIMIT) return value
+  return value + chunk.slice(0, PM_OUTPUT_LIMIT - value.length)
 }
 
-function runNpmAsync(args, {
+function runPackageManagerAsync(packageManager, args, {
   captureStdout = false,
   cwd,
   timeout = 300_000,
 } = {}) {
-  const npm = getNpm()
+  const bin = getPackageManagerBin(packageManager)
 
   return new Promise((resolve) => {
-    const child = spawn(npm, args, {
+    const child = spawn(bin, args, {
       cwd,
       shell: process.platform === 'win32',
       stdio: ['ignore', captureStdout ? 'pipe' : 'ignore', 'pipe'],
@@ -85,7 +132,7 @@ function runNpmAsync(args, {
           ok: false,
           stdout,
           stderr,
-          error: new Error(`npm ${args.join(' ')} timed out after ${timeout}ms`),
+          error: new Error(`${packageManager} ${args.join(' ')} timed out after ${timeout}ms`),
         })
         return
       }
@@ -100,20 +147,35 @@ function runNpmAsync(args, {
         ok: false,
         stdout,
         stderr,
-        error: new Error(`npm ${args.join(' ')} failed with ${reason}`),
+        error: new Error(`${packageManager} ${args.join(' ')} failed with ${reason}`),
       })
     })
   })
 }
 
-export function getGlobalPaths() {
-  const prefix = runNpm(['prefix', '-g'])
-  const root = runNpm(['root', '-g'])
+export function getGlobalPaths(options = {}) {
+  const packageManager = normalizePackageManager(options.packageManager ?? detectPackageManager())
+
+  if (packageManager === 'pnpm') {
+    const binDir = runPackageManager(packageManager, ['bin', '-g'])
+    const root = runPackageManager(packageManager, ['root', '-g'])
+    return {
+      prefix: binDir,
+      root,
+      binDir,
+      packageRoot: join(root, '@opengsd', 'gsd-pi'),
+      packageManager,
+    }
+  }
+
+  const prefix = runPackageManager(packageManager, ['prefix', '-g'])
+  const root = runPackageManager(packageManager, ['root', '-g'])
   return {
     prefix,
     root,
     binDir: process.platform === 'win32' ? prefix : join(prefix, 'bin'),
     packageRoot: join(root, '@opengsd', 'gsd-pi'),
+    packageManager,
   }
 }
 
@@ -121,33 +183,41 @@ export function getLocalPackageRoot(cwd = process.cwd()) {
   return join(cwd, 'node_modules', '@opengsd', 'gsd-pi')
 }
 
-export async function installGlobalPackage(version) {
-  const result = await runNpmAsync([
-    'install',
-    '-g',
-    '--ignore-scripts',
-    `@opengsd/gsd-pi@${version}`,
-  ])
+export async function installGlobalPackage(version, options = {}) {
+  const packageManager = normalizePackageManager(options.packageManager ?? detectPackageManager())
+  const packageSpec = `@opengsd/gsd-pi@${version}`
+  const installArgs = packageManager === 'pnpm'
+    ? ['add', '-g', '--ignore-scripts', packageSpec]
+    : ['install', '-g', '--ignore-scripts', packageSpec]
+
+  const result = await runPackageManagerAsync(packageManager, installArgs)
   if (!result.ok) {
-    throw new Error(formatNpmFailure(result))
+    throw new Error(formatPackageManagerFailure(packageManager, result))
   }
-  const rootResult = await runNpmAsync(['root', '-g'], {
+  const rootResult = await runPackageManagerAsync(packageManager, ['root', '-g'], {
     captureStdout: true,
     timeout: 120_000,
   })
   if (!rootResult.ok) {
-    throw new Error(formatNpmFailure(rootResult))
+    throw new Error(formatPackageManagerFailure(packageManager, rootResult))
   }
   return join(rootResult.stdout.trim(), '@opengsd', 'gsd-pi')
 }
 
-export async function installLocalPackage(version, cwd = process.cwd()) {
-  const result = await runNpmAsync(
-    ['install', '--ignore-scripts', `@opengsd/gsd-pi@${version}`],
+export async function installLocalPackage(version, cwd = process.cwd(), options = {}) {
+  const packageManager = normalizePackageManager(options.packageManager ?? detectPackageManager())
+  const packageSpec = `@opengsd/gsd-pi@${version}`
+  const installArgs = packageManager === 'pnpm'
+    ? ['add', '--ignore-scripts', packageSpec]
+    : ['install', '--ignore-scripts', packageSpec]
+
+  const result = await runPackageManagerAsync(
+    packageManager,
+    installArgs,
     { cwd },
   )
   if (!result.ok) {
-    throw new Error(formatNpmFailure(result))
+    throw new Error(formatPackageManagerFailure(packageManager, result))
   }
   return getLocalPackageRoot(cwd)
 }

package/scripts/install.js

@@ -71,6 +71,7 @@ if (HAS_HELP) {
 
   ${colors.yellow}Usage:${colors.reset}
     npx @opengsd/gsd-pi@latest              Install GSD-Pi globally (recommended)
+    pnpm dlx @opengsd/gsd-pi@latest         Install GSD-Pi globally with pnpm
     npx @opengsd/gsd-pi@latest --local      Install to current project (advanced)
 
   ${colors.yellow}Options:${colors.reset}

package/src/resources/extensions/claude-code-cli/stream-adapter.ts

@@ -29,7 +29,7 @@ import { dirname, join } from "node:path";
 import { PartialMessageBuilder, ZERO_USAGE, mapUsage } from "./partial-builder.js";
 import { buildWorkflowMcpServers, resolveWorkflowMcpProjectRoot } from "../gsd/workflow-mcp.js";
 import { loadProjectGSDPreferences } from "../gsd/preferences.js";
-import { discoverMcpServerNames, computeMcpDisallowedTools } from "../gsd/mcp-filter.js";
+import { discoverMcpServerNames, discoverWorkflowMcpServerName, computeMcpDisallowedTools } from "../gsd/mcp-filter.js";
 import { showInterviewRound, type Question, type RoundResult } from "../shared/tui.js";
 import type {
 	SDKAssistantMessage,
@@ -59,6 +59,10 @@ type ToolCallWithExternalResult = ToolCall & {
 	externalResult?: ExternalToolResultPayload;
 };
 
+interface PromptToolContextOptions {
+	workflowMcpServerName?: string | null;
+}
+
 /** `SimpleStreamOptions` extended with an optional extension UI context for elicitation dialogs. */
 interface ClaudeCodeStreamOptions extends SimpleStreamOptions {
 	extensionUIContext?: ExtensionUIContext;
@@ -331,7 +335,7 @@ function extractMessageText(msg: { role: string; content: unknown }): string {
  * user turns in its own output. XML tags read as document structure and
  * don't get mirrored in free text.
  */
-export function buildPromptFromContext(context: Context): string {
+export function buildPromptFromContext(context: Context, toolContext: PromptToolContextOptions = {}): string {
 	const hasContent = Boolean(context.systemPrompt) || context.messages.some((m) => extractMessageText(m));
 	if (!hasContent) return "";
 
@@ -339,6 +343,14 @@ export function buildPromptFromContext(context: Context): string {
 		"Respond only to the final user message below. " +
 			"Do not emit <user_message>, <assistant_message>, or <prior_system_context> tags in your response.",
 	];
+	const workflowToolLine = toolContext.workflowMcpServerName
+		? "- GSD workflow tools (gsd_exec, gsd_slice_complete, gsd_task_complete, gsd_plan_slice, gsd_save_gate_result, etc.) " +
+			`are MCP tools — call them as mcp__${toolContext.workflowMcpServerName}__<tool_name> ` +
+			`(e.g. mcp__${toolContext.workflowMcpServerName}__gsd_exec, mcp__${toolContext.workflowMcpServerName}__gsd_save_gate_result)\n`
+		: "- GSD workflow MCP tools are unavailable in this Claude Code run.\n";
+	const toolSearchLine = toolContext.workflowMcpServerName
+		? "- ToolSearch is NOT available — never use it to discover tools; invoke the MCP tool directly\n"
+		: "- ToolSearch is NOT available — never use it to discover tools\n";
 
 	// The prior system context lists pi-native tool names (lowercase: bash, read, gsd_exec, etc.)
 	// but this process runs inside Claude Code where tool names differ. Inject a remapping note
@@ -349,10 +361,8 @@ export function buildPromptFromContext(context: Context): string {
 			"You are running inside Claude Code. Use these exact tool names — do not use lowercase or pi-native names:\n" +
 			"- Shell commands: 'Bash' (not 'bash')\n" +
 			"- File operations: 'Read', 'Write', 'Edit', 'Glob', 'Grep' (PascalCase, not lowercase)\n" +
-			"- GSD workflow tools (gsd_exec, gsd_slice_complete, gsd_task_complete, gsd_plan_slice, gsd_save_gate_result, etc.) " +
-			"are MCP tools — call them as mcp__gsd-workflow__<tool_name> " +
-			"(e.g. mcp__gsd-workflow__gsd_exec, mcp__gsd-workflow__gsd_save_gate_result)\n" +
-			"- ToolSearch is NOT available — never use it to discover tools; invoke the MCP tool directly\n" +
+			workflowToolLine +
+			toolSearchLine +
 			"</tool_context>",
 	);
 
@@ -1441,6 +1451,16 @@ function mapThinkingLevelToAnthropicEffort(level: ThinkingLevel | undefined, mod
 	}
 }
 
+function workflowMcpServerNameFromAllowedTools(allowedTools: unknown): string | undefined {
+	if (!Array.isArray(allowedTools)) return undefined;
+	for (const toolName of allowedTools) {
+		if (typeof toolName !== "string") continue;
+		const match = /^mcp__(.+)__\*$/.exec(toolName);
+		if (match?.[1]) return match[1];
+	}
+	return undefined;
+}
+
 /**
  * Build the options object passed to the Claude Agent SDK's `query()` call.
  *
@@ -1468,16 +1488,19 @@ export function buildSdkOptions(
 
 	const preferences = loadProjectGSDPreferences(projectRoot);
 	const mcpConfig = preferences?.preferences.claude_code_mcp;
-	const workflowServerName = mcpServers ? Object.keys(mcpServers)[0] : undefined;
 
 	// Always discover project MCPs — needed for both duplicate detection and filtering.
 	const discovered = discoverMcpServerNames(projectRoot);
+	const injectedWorkflowServerName = mcpServers ? Object.keys(mcpServers)[0] : undefined;
+	const projectWorkflowServerName = discoverWorkflowMcpServerName(projectRoot);
+	const workflowServerName = projectWorkflowServerName ?? injectedWorkflowServerName;
 
 	// If the workflow MCP is already declared in the project's .mcp.json or
 	// .claude/settings.json, do not inject it again via mcpServers. Passing the
 	// same server name from two sources causes a duplicate registration conflict
 	// that prevents the MCP server from loading (tools become unavailable).
-	const workflowAlreadyInProject = workflowServerName !== undefined && discovered.includes(workflowServerName);
+	const workflowAlreadyInProject = projectWorkflowServerName !== undefined
+		|| (injectedWorkflowServerName !== undefined && discovered.includes(injectedWorkflowServerName));
 	let filteredMcpServers = workflowAlreadyInProject ? undefined : mcpServers;
 	let extraDisallowedTools: string[] = [];
 	let workflowExplicitlyBlocked = false;
@@ -1847,8 +1870,6 @@ async function pumpSdkMessages(
 			options.signal.addEventListener("abort", () => controller.abort(), { once: true });
 		}
 
-		const prompt = buildPromptFromContext(context);
-		const queryPrompt = buildSdkQueryPrompt(context, prompt);
 		const permissionMode = await resolveClaudePermissionMode();
 		const uiContext = (options as ClaudeCodeStreamOptions | undefined)?.extensionUIContext;
 		const onExternalToolCall = (options as ClaudeCodeStreamOptions | undefined)?.onExternalToolCall;
@@ -1862,7 +1883,7 @@ async function pumpSdkMessages(
 				({ behavior: "allow", toolUseID: opts.toolUseID }));
 		const sdkOpts = buildSdkOptions(
 			modelId,
-			prompt,
+			"",
 			{ permissionMode },
 			{
 				cwd,
@@ -1875,6 +1896,10 @@ async function pumpSdkMessages(
 					: {}),
 			},
 		);
+		const prompt = buildPromptFromContext(context, {
+			workflowMcpServerName: workflowMcpServerNameFromAllowedTools(sdkOpts.allowedTools),
+		});
+		const queryPrompt = buildSdkQueryPrompt(context, prompt);
 
 		const queryResult = sdk.query({
 			prompt: queryPrompt,

package/src/resources/extensions/claude-code-cli/tests/stream-adapter.test.ts

@@ -407,6 +407,30 @@ describe("stream-adapter — no transcript fabrication (#4102)", () => {
 		const prompt = buildPromptFromContext(context);
 		assert.equal(prompt, "", "empty context must not emit a bare directive");
 	});
+
+	test("buildPromptFromContext uses the active workflow MCP server name", () => {
+		const context: Context = {
+			messages: [{ role: "user", content: "Check status" } as Message],
+		};
+
+		const prompt = buildPromptFromContext(context, { workflowMcpServerName: "custom-workflow" });
+
+		assert.ok(prompt.includes("mcp__custom-workflow__<tool_name>"));
+		assert.ok(prompt.includes("mcp__custom-workflow__gsd_exec"));
+		assert.ok(!prompt.includes("mcp__gsd-workflow__<tool_name>"));
+	});
+
+	test("buildPromptFromContext does not advertise workflow MCP tools when unavailable", () => {
+		const context: Context = {
+			messages: [{ role: "user", content: "Check status" } as Message],
+		};
+
+		const prompt = buildPromptFromContext(context);
+
+		assert.ok(prompt.includes("GSD workflow MCP tools are unavailable"));
+		assert.ok(!prompt.includes("mcp__gsd-workflow__<tool_name>"));
+		assert.ok(!prompt.includes("mcp__gsd-workflow__gsd_exec"));
+	});
 });
 
 describe("stream-adapter — Claude Code external tool results", () => {
@@ -921,18 +945,21 @@ describe("stream-adapter — session persistence (#2859)", () => {
 		}
 	});
 
-	test("buildSdkOptions prefers custom workflow MCP question tools over native AskUserQuestion", () => {
-		const restore = setWorkflowMcpEnv({
-			GSD_WORKFLOW_MCP_COMMAND: "node",
+		test("buildSdkOptions prefers custom workflow MCP question tools over native AskUserQuestion", () => {
+			const restore = setWorkflowMcpEnv({
+				GSD_WORKFLOW_MCP_COMMAND: "node",
 			GSD_WORKFLOW_MCP_NAME: "custom-workflow",
 			GSD_WORKFLOW_MCP_ARGS: JSON.stringify(["packages/mcp-server/dist/cli.js"]),
-			GSD_WORKFLOW_MCP_ENV: JSON.stringify({ GSD_CLI_PATH: "/tmp/gsd" }),
-			GSD_WORKFLOW_MCP_CWD: "/tmp/project",
-		});
-		try {
+				GSD_WORKFLOW_MCP_ENV: JSON.stringify({ GSD_CLI_PATH: "/tmp/gsd" }),
+				GSD_WORKFLOW_MCP_CWD: "/tmp/project",
+			});
+			const originalCwd = process.cwd();
+			const emptyDir = mkdtempSync(join(tmpdir(), "claude-mcp-custom-inject-"));
+			try {
+				process.chdir(emptyDir);
 
-			const options = buildSdkOptions("claude-sonnet-4-20250514", "test");
-			const mcpServers = options.mcpServers as Record<string, any>;
+				const options = buildSdkOptions("claude-sonnet-4-20250514", "test");
+				const mcpServers = options.mcpServers as Record<string, any>;
 			assert.ok(mcpServers?.["custom-workflow"], "expected custom workflow server config");
 			assert.deepEqual(options.disallowedTools, ["AskUserQuestion"]);
 			assert.deepEqual(options.allowedTools, [
@@ -945,12 +972,14 @@ describe("stream-adapter — session persistence (#2859)", () => {
 				"Agent",
 				"WebFetch",
 				"WebSearch",
-				"mcp__custom-workflow__*",
-			]);
-		} finally {
-			restore();
-		}
-	});
+					"mcp__custom-workflow__*",
+				]);
+			} finally {
+				process.chdir(originalCwd);
+				rmSync(emptyDir, { recursive: true, force: true });
+				restore();
+			}
+		});
 
 	test("buildSdkOptions auto-discovers bundled MCP server even without env hints", () => {
 		// Use setWorkflowMcpEnv with no values to save current state;
@@ -1059,7 +1088,7 @@ describe("stream-adapter — session persistence (#2859)", () => {
 		}
 	});
 
-	test("buildSdkOptions does not inject workflow MCP when already declared in project .mcp.json (avoids duplicate registration)", () => {
+		test("buildSdkOptions does not inject workflow MCP when already declared in project .mcp.json (avoids duplicate registration)", () => {
 		const restore = setWorkflowMcpEnv({
 			GSD_WORKFLOW_MCP_COMMAND: "node",
 			GSD_WORKFLOW_MCP_NAME: "gsd-workflow",
@@ -1089,10 +1118,48 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			process.chdir(originalCwd);
 			rmSync(projectDir, { recursive: true, force: true });
 			restore();
-		}
-	});
+			}
+		});
+
+		test("buildSdkOptions uses project-declared custom workflow MCP namespace", () => {
+			const restore = setWorkflowMcpEnv({
+				GSD_WORKFLOW_MCP_COMMAND: "node",
+				GSD_WORKFLOW_MCP_NAME: "gsd-workflow",
+				GSD_WORKFLOW_MCP_ARGS: JSON.stringify(["packages/mcp-server/dist/cli.js"]),
+				GSD_WORKFLOW_MCP_ENV: JSON.stringify({ GSD_CLI_PATH: "/tmp/gsd" }),
+				GSD_WORKFLOW_MCP_CWD: "/tmp/project",
+			});
+			const originalCwd = process.cwd();
+			const projectDir = mkdtempSync(join(tmpdir(), "claude-mcp-custom-project-"));
+			try {
+				writeFileSync(
+					join(projectDir, ".mcp.json"),
+					JSON.stringify({
+						mcpServers: {
+							"custom-workflow": {
+								command: "node",
+								args: ["custom-cli.js"],
+								env: { GSD_WORKFLOW_PROJECT_ROOT: projectDir },
+							},
+						},
+					}),
+				);
+				process.chdir(projectDir);
+				const options = buildSdkOptions("claude-sonnet-4-20250514", "test");
+				assert.equal(options.mcpServers, undefined, "should not inject default workflow MCP when project declares a workflow server");
+				const allowedTools = options.allowedTools as string[];
+				assert.ok(allowedTools.includes("mcp__custom-workflow__*"), "allowedTools must use the project workflow namespace");
+				assert.ok(!allowedTools.includes("mcp__gsd-workflow__*"), "allowedTools must not advertise the absent default namespace");
+				const disallowedTools = options.disallowedTools as string[];
+				assert.ok(disallowedTools.includes("AskUserQuestion"), "AskUserQuestion should be suppressed when workflow is available");
+			} finally {
+				process.chdir(originalCwd);
+				rmSync(projectDir, { recursive: true, force: true });
+				restore();
+			}
+		});
 
-	test("buildSdkOptions preserves runtime callbacks such as onElicitation", () => {
+		test("buildSdkOptions preserves runtime callbacks such as onElicitation", () => {
 		const restore = setWorkflowMcpEnv({});
 		const onElicitation = async () => ({ action: "decline" as const });
 		try {

package/src/resources/extensions/context7/index.ts

@@ -132,6 +132,19 @@ function formatLibraryList(libs: C7Library[], query: string): string {
 	return lines.join("\n");
 }
 
+function getFirstTextContent(result: { content?: unknown }): string | undefined {
+	const content = result.content;
+	if (!Array.isArray(content)) return undefined;
+	const textBlock = content.find(
+		(block: unknown) =>
+			typeof block === "object" &&
+			block !== null &&
+			(block as { type?: unknown }).type === "text" &&
+			typeof (block as { text?: unknown }).text === "string",
+	) as { text: string } | undefined;
+	return textBlock?.text.trim() || undefined;
+}
+
 // ─── Tool details types ───────────────────────────────────────────────────────
 
 interface ResolveDetails {
@@ -234,7 +247,7 @@ export default function (pi: ExtensionAPI) {
 			const d = result.details as ResolveDetails | undefined;
 			if (isPartial) return new Text(theme.fg("warning", "Searching Context7..."), 0, 0);
 			if ((result as any).isError || d?.error) {
-				return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
+				return new Text(theme.fg("error", `Error: ${d?.error ?? getFirstTextContent(result) ?? "unknown"}`), 0, 0);
 			}
 			let text = theme.fg("success", `${d?.resultCount ?? 0} ${d?.resultCount === 1 ? "library" : "libraries"} found`);
 			if (d?.cached) text += theme.fg("dim", " (cached)");
@@ -389,7 +402,7 @@ export default function (pi: ExtensionAPI) {
 
 			if (isPartial) return new Text(theme.fg("warning", "Fetching documentation..."), 0, 0);
 			if ((result as any).isError || d?.error) {
-				return new Text(theme.fg("error", `Error: ${d?.error ?? "unknown"}`), 0, 0);
+				return new Text(theme.fg("error", `Error: ${d?.error ?? getFirstTextContent(result) ?? "unknown"}`), 0, 0);
 			}
 
 			let text = theme.fg("success", `${(d?.charCount ?? 0).toLocaleString()} chars`);

package/src/resources/extensions/get-secrets-from-user.ts

@@ -13,6 +13,7 @@ import { resolve } from "node:path";
 import type { ExtensionAPI, Theme } from "@gsd/pi-coding-agent";
 import { Editor, type EditorTheme, Key, matchesKey, Text, truncateToWidth, wrapTextWithAnsi } from "@gsd/pi-tui";
 import { Type } from "@sinclair/typebox";
+import { renderSharedDialogFrame } from "./shared/dialog-frame.js";
 import { makeUI } from "./shared/tui.js";
 import { maskEditorLine, type ProgressStatus } from "./shared/mod.js";
 import { parseSecretsManifest, formatSecretsManifest } from "./gsd/files.js";
@@ -43,6 +44,10 @@ function maskPreview(value: string): string {
 	return `${value.slice(0, 4)}${"*".repeat(Math.max(4, value.length - 8))}${value.slice(-4)}`;
 }
 
+function dialogContentWidth(width: number): number {
+	return width < 4 ? Math.max(1, width) : Math.max(1, width - 4);
+}
+
 function shellEscapeSingle(value: string): string {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -168,10 +173,10 @@ async function collectOneSecret(
 
 		function render(width: number): string[] {
 			if (cachedLines) return cachedLines;
+			const contentWidth = dialogContentWidth(width);
 			const lines: string[] = [];
-			const add = (s: string) => lines.push(truncateToWidth(s, width));
+			const add = (s: string) => lines.push(truncateToWidth(s, contentWidth));
 
-			add(theme.fg("accent", "─".repeat(width)));
 			add(theme.fg("dim", ` Page ${pageIndex + 1}/${totalPages} · Secure Env Setup`));
 			lines.push("");
 
@@ -187,7 +192,7 @@ async function collectOneSecret(
 				for (let g = 0; g < guidance.length; g++) {
 					const prefix = `  ${g + 1}. `;
 					const step = guidance[g] as string;
-					const wrappedLines = wrapTextWithAnsi(step, width - 4);
+					const wrappedLines = wrapTextWithAnsi(step, Math.max(1, contentWidth - 4));
 					for (let w = 0; w < wrappedLines.length; w++) {
 						const indent = w === 0 ? prefix : " ".repeat(prefix.length);
 						lines.push(theme.fg("dim", `${indent}${wrappedLines[w]}`));
@@ -205,16 +210,15 @@ async function collectOneSecret(
 
 			// Editor
 			add(theme.fg("muted", " Enter value:"));
-			for (const line of editor.render(width - 2)) {
+			for (const line of editor.render(Math.max(1, contentWidth - 2))) {
 				add(theme.fg("text", maskEditorLine(line)));
 			}
 
 			lines.push("");
-			add(theme.fg("dim", ` enter to confirm  |  ctrl+s or esc to skip  |  esc cancels`));
-			add(theme.fg("accent", "─".repeat(width)));
+			const footer = theme.fg("dim", " enter to confirm  |  ctrl+s or esc to skip  |  esc cancels");
 
-			cachedLines = lines;
-			return lines;
+			cachedLines = renderSharedDialogFrame(theme, "Secure Env Setup", lines, width, { footer });
+			return cachedLines;
 		}
 
 		return {
@@ -286,13 +290,11 @@ export async function showSecretsSummary(
 		function render(width: number): string[] {
 			if (cachedLines) return cachedLines;
 
-			const ui = makeUI(theme, width);
+			const contentWidth = dialogContentWidth(width);
+			const ui = makeUI(theme, contentWidth);
 			const lines: string[] = [];
 			const push = (...rows: string[][]) => { for (const r of rows) lines.push(...r); };
 
-			push(ui.bar());
-			push(ui.blank());
-			push(ui.header("  Secrets Summary"));
 			push(ui.blank());
 
 			for (const entry of entries) {
@@ -314,11 +316,10 @@ export async function showSecretsSummary(
 			}
 
 			push(ui.blank());
-			push(ui.hints(["any key to continue"]));
-			push(ui.bar());
+			const footer = ui.hints(["any key to continue"])[0] ?? "";
 
-			cachedLines = lines;
-			return lines;
+			cachedLines = renderSharedDialogFrame(theme, "Secrets Summary", lines, width, { footer });
+			return cachedLines;
 		}
 
 		return {