@opengsd/gsd-pi 1.1.1-dev.b2556262 → 1.2.0-dev.0b870afa

package/dist/cli-style.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Terminal presentation helpers for CLI-side notices on stderr — warnings,
+ * hints, and names. Pairs with the extension-side glyph set in
+ * resources/extensions/shared/ui.ts. Adopt incrementally: banner-shaped CLI
+ * surfaces (worktree banners today; update checks et al. as they're touched)
+ * should render through these instead of ad-hoc chalk.
+ */
+/** Dim "[gsd] " line tag that prefixes CLI banner lines. */
+export declare function gsdTag(): string;
+/** A yellow warning fragment. */
+export declare function warn(text: string): string;
+/** A dim "what to do next" hint fragment. */
+export declare function hint(text: string): string;
+/** A cyan user-supplied name (worktree, branch, file). */
+export declare function name(text: string): string;
+/** One banner line: tagged warning followed by a tagged hint line. */
+export declare function bannerLines(warning: string, hintText: string): string;

package/dist/cli-style.js

@@ -0,0 +1,28 @@
+/**
+ * Terminal presentation helpers for CLI-side notices on stderr — warnings,
+ * hints, and names. Pairs with the extension-side glyph set in
+ * resources/extensions/shared/ui.ts. Adopt incrementally: banner-shaped CLI
+ * surfaces (worktree banners today; update checks et al. as they're touched)
+ * should render through these instead of ad-hoc chalk.
+ */
+import chalk from 'chalk';
+/** Dim "[gsd] " line tag that prefixes CLI banner lines. */
+export function gsdTag() {
+    return chalk.dim('[gsd] ');
+}
+/** A yellow warning fragment. */
+export function warn(text) {
+    return chalk.yellow(text);
+}
+/** A dim "what to do next" hint fragment. */
+export function hint(text) {
+    return chalk.dim(text);
+}
+/** A cyan user-supplied name (worktree, branch, file). */
+export function name(text) {
+    return chalk.cyan(text);
+}
+/** One banner line: tagged warning followed by a tagged hint line. */
+export function bannerLines(warning, hintText) {
+    return gsdTag() + warning + '\n' + gsdTag() + hint(hintText) + '\n\n';
+}

package/dist/cli-web-branch.d.ts

@@ -20,6 +20,8 @@ export interface CliFlags {
     webPort?: number;
     /** Additional allowed origins for CORS: `--allowed-origins http://192.168.1.10:8080` */
     webAllowedOrigins?: string[];
+    /** Disable the web launcher's bearer token gate: `--no-auth` */
+    webNoAuth?: boolean;
     /** Set by `gsd sessions` when the user picks a specific session to resume */
     _selectedSessionPath?: string;
 }

package/dist/cli-web-branch.js

@@ -52,6 +52,9 @@ export function parseCliArgs(argv) {
             const origins = args[++i].split(',').map(o => o.trim()).filter(Boolean);
             flags.webAllowedOrigins = (flags.webAllowedOrigins ?? []).concat(origins);
         }
+        else if (arg === '--no-auth') {
+            flags.webNoAuth = true;
+        }
         else if (arg === '--model' && i + 1 < args.length) {
             flags.model = args[++i];
         }
@@ -232,14 +235,18 @@ export async function runWebCliBranch(flags, deps = {}) {
     const agentDir = deps.agentDir ?? defaultAgentDir;
     const projectSessionsDir = getProjectSessionsDir(currentCwd, baseSessionsDir);
     migrateLegacyFlatSessions(baseSessionsDir, projectSessionsDir);
-    const status = await (deps.runWebMode ?? launchWebMode)({
+    const launchOptions = {
         cwd: currentCwd,
         projectSessionsDir,
         agentDir,
         host: flags.webHost,
         port: flags.webPort,
         allowedOrigins: flags.webAllowedOrigins,
-    });
+    };
+    if (flags.webNoAuth !== undefined) {
+        launchOptions.noAuth = flags.webNoAuth;
+    }
+    const status = await (deps.runWebMode ?? launchWebMode)(launchOptions);
     if (!status.ok) {
         emitWebModeFailure(stderr, status);
     }

package/dist/cli.js

@@ -524,7 +524,7 @@ const authStorage = AuthStorage.create(authFilePath);
 markStartup('AuthStorage.create');
 loadStoredEnvKeys(authStorage);
 migratePiCredentials(authStorage);
-// Resolve models.json path with fallback to ~/.pi/agent/models.json
+// Resolve models.json path
 const { resolveModelsJsonPath } = await import('./models-resolver.js');
 const modelsJsonPath = resolveModelsJsonPath();
 const modelRegistry = ModelRegistry.create(authStorage, modelsJsonPath);

package/dist/headless-events.d.ts

@@ -5,6 +5,10 @@
  * and classifies commands as quick (single-turn) vs long-running.
  *
  * Also defines exit code constants and the status→exit-code mapping function.
+ *
+ * The stop/pause notice vocabulary itself (prefixes + message classifiers)
+ * lives in the Stop Notice module — the same module the emitters format with,
+ * so wording stays in lockstep with detection.
  */
 export declare const EXIT_SUCCESS = 0;
 export declare const EXIT_ERROR = 1;
@@ -42,8 +46,6 @@ export declare function mapStatusToExitCode(status: string): number;
  *
  * Blocked detection is separate — checked via isBlockedNotification.
  */
-export declare const PAUSED_PREFIXES: string[];
-export declare const TERMINAL_PREFIXES: string[];
 export declare const IDLE_TIMEOUT_MS = 15000;
 export declare const NEW_MILESTONE_IDLE_TIMEOUT_MS = 120000;
 export declare function canonicalHeadlessToolName(toolName: string | undefined): string;

package/dist/headless-events.js

@@ -5,7 +5,13 @@
  * and classifies commands as quick (single-turn) vs long-running.
  *
  * Also defines exit code constants and the status→exit-code mapping function.
+ *
+ * The stop/pause notice vocabulary itself (prefixes + message classifiers)
+ * lives in the Stop Notice module — the same module the emitters format with,
+ * so wording stays in lockstep with detection.
  */
+import { isBlockedNoticeMessage, isManualResolutionNotice, isPauseNotice, isTerminalNotice, } from './resources/extensions/gsd/stop-notice.js';
+import { canonicalToolName } from './resources/extensions/gsd/engine-hook-contract.js';
 // ---------------------------------------------------------------------------
 // Exit Code Constants
 // ---------------------------------------------------------------------------
@@ -65,40 +71,19 @@ export function mapStatusToExitCode(status) {
  *
  * Blocked detection is separate — checked via isBlockedNotification.
  */
-export const PAUSED_PREFIXES = ['auto-mode paused', 'step-mode paused'];
-export const TERMINAL_PREFIXES = [
-    'auto-mode stopped',
-    'step-mode stopped',
-    'auto-mode complete',
-    'no active milestone',
-    'auto-mode idle',
-];
 export const IDLE_TIMEOUT_MS = 15_000;
 // new-milestone is a long-running creative task where the LLM may pause
 // between tool calls (e.g. after mkdir, before writing files). Use a
 // longer idle timeout to avoid killing the session prematurely (#808).
 export const NEW_MILESTONE_IDLE_TIMEOUT_MS = 120_000;
 const INTERACTIVE_HEADLESS_TOOLS = new Set(['ask_user_questions', 'secure_env_collect']);
+// Delegates to the shared normalizer seam (engine-hook-contract.ts) instead of
+// a hand-rolled parser. Behavior differs from the old parser only on malformed
+// MCP names: `mcp____tool` (empty server) and `mcp__server__` (empty tool) are
+// now returned unchanged rather than partially stripped — neither can match a
+// real tool name, so detection behavior is unaffected.
 export function canonicalHeadlessToolName(toolName) {
-    const name = String(toolName ?? '');
-    if (!name.startsWith('mcp__'))
-        return name;
-    const toolSeparator = name.indexOf('__', 'mcp__'.length);
-    return toolSeparator >= 0 ? name.slice(toolSeparator + 2) : name;
-}
-function isManualResolutionNotification(message) {
-    return (message.includes('resolve manually and re-run /gsd auto') ||
-        message.includes('resolve conflicts manually and run /gsd auto to resume') ||
-        message.includes('resolve and run /gsd auto to resume'));
-}
-function isNonBlockingPauseNotification(message) {
-    return message.includes('idempotent advance: unit already active');
-}
-function isPauseNotification(message) {
-    return PAUSED_PREFIXES.some((prefix) => message.startsWith(prefix));
-}
-function isPauseNotificationRequiringIntervention(message) {
-    return isPauseNotification(message) && !isNonBlockingPauseNotification(message);
+    return canonicalToolName(String(toolName ?? ''));
 }
 function getCommandBlockContent(event) {
     if (event.type !== 'message_start' && event.type !== 'message_end')
@@ -122,20 +107,15 @@ export function isTerminalNotification(event) {
     if (event.type !== 'extension_ui_request' || event.method !== 'notify')
         return false;
     const message = String(event.message ?? '').toLowerCase();
-    return (TERMINAL_PREFIXES.some((prefix) => message.startsWith(prefix)) ||
-        isPauseNotification(message) ||
-        isManualResolutionNotification(message));
+    return isTerminalNotice(message) || isPauseNotice(message) || isManualResolutionNotice(message);
 }
 export function isBlockedNotification(event) {
     if (isBlockingCommandBlock(event))
         return true;
     if (event.type !== 'extension_ui_request' || event.method !== 'notify')
         return false;
-    const message = String(event.message ?? '').toLowerCase();
     // Recoverable pauses need operator intervention in headless mode.
-    return (message.includes('blocked:') ||
-        isPauseNotificationRequiringIntervention(message) ||
-        isManualResolutionNotification(message));
+    return isBlockedNoticeMessage(String(event.message ?? '').toLowerCase());
 }
 export function isMilestoneReadyNotification(event) {
     if (event.type !== 'extension_ui_request' || event.method !== 'notify')

package/dist/help-text.js

@@ -189,6 +189,11 @@ export function printHelp(version) {
     process.stdout.write('  --worktree, -w [name]    Start in an isolated worktree (auto-named if omitted)\n');
     process.stdout.write('  --model <id>             Override model (e.g. provider/model-id)\n');
     process.stdout.write('  --no-session             Disable session persistence\n');
+    process.stdout.write('  --web [path]             Start browser-only web mode\n');
+    process.stdout.write('  --host <host>            Web mode bind address\n');
+    process.stdout.write('  --port <port>            Web mode port\n');
+    process.stdout.write('  --allowed-origins <csv>  Additional allowed web origins\n');
+    process.stdout.write('  --no-auth                Disable web token auth; requires external access control\n');
     process.stdout.write('  --extension <path>       Load additional extension\n');
     process.stdout.write('  --tools <a,b,c>          Restrict available tools\n');
     process.stdout.write('  --list-models [search]   List available models and exit\n');

package/dist/mcp-server.js

@@ -29,6 +29,7 @@ function isPlainObject(value) {
 // built via a template string so TypeScript's NodeNext resolver treats them as
 // `any` and skips static checking.
 const MCP_PKG = '@modelcontextprotocol/sdk';
+import { sanitizeSchemaForMoonshot } from '@gsd/pi-ai';
 export function mcpSdkSpecifier(subpath) {
     return `${MCP_PKG}/${subpath}.js`;
 }
@@ -65,7 +66,7 @@ export async function startMcpServer(options) {
         tools: tools.map((t) => ({
             name: t.name,
             description: t.description,
-            inputSchema: t.parameters,
+            inputSchema: sanitizeSchemaForMoonshot(t.parameters),
         })),
     }));
     // tools/call — execute the requested tool and return content blocks.

package/dist/models-resolver.d.ts

@@ -1,20 +1,10 @@
 /**
- * Models.json resolution with fallback to ~/.pi/agent/models.json
+ * Models.json resolution for GSD.
  *
- * GSD uses ~/.gsd/agent/models.json, but for a smooth migration/development
- * experience, this module provides resolution logic that:
- *
- * 1. Reads ~/.gsd/agent/models.json if it exists
- * 2. Falls back to ~/.pi/agent/models.json if GSD file doesn't exist
- * 3. Merges both files if both exist (GSD takes precedence)
+ * Uses ~/.gsd/agent/models.json exclusively.
  */
 /**
- * Resolve the path to models.json with fallback logic.
- *
- * Priority:
- * 1. ~/.gsd/agent/models.json (exists) → return this path
- * 2. ~/.pi/agent/models.json (exists) → return this path (fallback)
- * 3. Neither exists → return GSD path (will be created)
+ * Resolve the path to models.json.
  *
  * @returns The path to use for models.json
  */

package/dist/models-resolver.js

@@ -1,35 +1,16 @@
 /**
- * Models.json resolution with fallback to ~/.pi/agent/models.json
+ * Models.json resolution for GSD.
  *
- * GSD uses ~/.gsd/agent/models.json, but for a smooth migration/development
- * experience, this module provides resolution logic that:
- *
- * 1. Reads ~/.gsd/agent/models.json if it exists
- * 2. Falls back to ~/.pi/agent/models.json if GSD file doesn't exist
- * 3. Merges both files if both exist (GSD takes precedence)
+ * Uses ~/.gsd/agent/models.json exclusively.
  */
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { agentDir } from './app-paths.js';
 const GSD_MODELS_PATH = join(agentDir, 'models.json');
-const PI_MODELS_PATH = join(homedir(), '.pi', 'agent', 'models.json');
 /**
- * Resolve the path to models.json with fallback logic.
- *
- * Priority:
- * 1. ~/.gsd/agent/models.json (exists) → return this path
- * 2. ~/.pi/agent/models.json (exists) → return this path (fallback)
- * 3. Neither exists → return GSD path (will be created)
+ * Resolve the path to models.json.
  *
  * @returns The path to use for models.json
  */
 export function resolveModelsJsonPath() {
-    if (existsSync(GSD_MODELS_PATH)) {
-        return GSD_MODELS_PATH;
-    }
-    if (existsSync(PI_MODELS_PATH)) {
-        return PI_MODELS_PATH;
-    }
     return GSD_MODELS_PATH;
 }

package/dist/project-sessions.js

@@ -1,6 +1,8 @@
-import { join } from "node:path";
+import { join, normalize } from "node:path";
 import { sessionsDir as defaultSessionsDir } from "./app-paths.js";
 export function getProjectSessionsDir(cwd, baseSessionsDir = defaultSessionsDir) {
-    const safePath = `--${cwd.replace(/^[/\\]/, "").replace(/[/\\:]/g, "-")}--`;
+    // Normalize the cwd path to prevent directory traversal
+    const normalizedCwd = normalize(cwd).replace(/^[/\\]/, "").replace(/[/\\:]/g, "-");
+    const safePath = `--${normalizedCwd}--`;
     return join(baseSessionsDir, safePath);
 }

package/dist/resource-loader.js

@@ -701,9 +701,8 @@ function collectRelativeFiles(rootDir) {
     return files;
 }
 /**
- * Constructs a DefaultResourceLoader that loads extensions from both
- * ~/.gsd/agent/extensions/ (GSD's default) and ~/.pi/agent/extensions/ (pi's default).
- * This allows users to use extensions from either location.
+ * Constructs a DefaultResourceLoader that loads extensions from
+ * ~/.gsd/agent/extensions/ (GSD's default) only.
  */
 // Cache bundled extension keys at module load — avoids re-scanning the extensions
 // directory in buildResourceLoader() (already scanned by loader.ts for env var).
@@ -718,19 +717,8 @@ export async function buildResourceLoader(agentDir, options = {}) {
     const { DefaultResourceLoader } = await loadPiCodingAgentModule();
     const { sortExtensionPaths } = await import('./extension-sort.js');
     const registry = loadRegistry();
-    const piAgentDir = join(homedir(), '.pi', 'agent');
-    const piExtensionsDir = join(piAgentDir, 'extensions');
     const bundledKeys = getBundledExtensionKeys();
-    const piExtensionPaths = discoverExtensionEntryPaths(piExtensionsDir)
-        .filter((entryPath) => !bundledKeys.has(getExtensionKey(entryPath, piExtensionsDir)))
-        .filter((entryPath) => {
-        const manifest = readManifestFromEntryPath(entryPath);
-        if (!manifest)
-            return true;
-        return isExtensionEnabled(registry, manifest.id);
-    });
     const additionalExtensionPaths = [
-        ...piExtensionPaths,
         ...(options.additionalExtensionPaths ?? []),
     ];
     return new DefaultResourceLoader({

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-fc4ebdcd3723ade9
+9afebd3db70730bd

package/dist/resources/GSD-WORKFLOW.md

@@ -470,13 +470,13 @@ key_decisions: []
 
 **After a slice completes:**
 1. Write slice `S##-SUMMARY.md` (compresses all task summaries).
-2. Write slice `S##-UAT.md` — a non-blocking human test script derived from the slice's must-haves and demo sentence. The agent does NOT wait for UAT results.
+2. Write slice `S##-UAT.md` — a human test script derived from the slice's must-haves and demo sentence.
 3. Mark the slice checkbox in `M###-ROADMAP.md` as `[x]`.
 4. Update `STATE.md` with new position.
 5. Update milestone `M###-SUMMARY.md` with the completed slice's contributions.
-6. Continue to next slice immediately. The user tests the UAT whenever convenient.
-7. If the user reports UAT failures later, create fix tasks in the current or a new slice.
-8. If all slices done → milestone complete.
+6. Continue to next slice immediately. UAT can run after slice completion; automatic milestone closure requires each slice assessment to record `PASS`.
+7. If UAT is missing or non-PASS at milestone closeout, run `/gsd dispatch uat`, request a slice-specific UAT rerun when needed, or create remediation work with `/gsd dispatch reassess`.
+8. If all slices are done and UAT plus milestone validation pass → milestone complete.
 
 ---
 
@@ -605,6 +605,7 @@ Commit types: `feat`, `fix`, `test`, `refactor`, `docs`, `perf`, `chore`
 |---------|-----|
 | Bad task | Revert the task commit on the active branch |
 | Bad milestone squash | Revert the squash commit on the integration branch |
+| UAT missing or non-PASS at closeout | Run `/gsd dispatch uat`, request a slice-specific UAT rerun when needed, or create remediation work with `/gsd dispatch reassess` |
 | UAT failure after merge | Create follow-up fix tasks in the current or next milestone |
 
 ---

package/dist/resources/extensions/ask-user-questions.js

@@ -114,6 +114,61 @@ function errorResult(message, questions = [], options) {
         details: { questions, response: null, cancelled: true, interrupted: options?.interrupted === true },
     };
 }
+/** Parse the LLM-facing JSON payload back into a RoundResult for TUI rendering. */
+function parseLlmAnswersContent(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed?.answers || typeof parsed.answers !== "object")
+            return null;
+        const answers = {};
+        for (const [id, entry] of Object.entries(parsed.answers)) {
+            const list = Array.isArray(entry?.answers) ? [...entry.answers] : [];
+            let notes = "";
+            const noteIdx = list.findIndex((item) => typeof item === "string" && item.startsWith("user_note:"));
+            if (noteIdx >= 0) {
+                notes = list.splice(noteIdx, 1)[0].replace(/^user_note:\s*/, "");
+            }
+            if (list.length === 0)
+                continue;
+            answers[id] = {
+                selected: list.length === 1 ? list[0] : list,
+                notes,
+            };
+        }
+        if (Object.keys(answers).length === 0)
+            return null;
+        return { endInterview: false, answers };
+    }
+    catch {
+        return null;
+    }
+}
+function isCancelledResultContent(text) {
+    return /\bwas cancelled before receiving a response\b/i.test(text)
+        || /\bwas interrupted before receiving a response\b/i.test(text);
+}
+function renderAnswerLines(questions, response, theme) {
+    const lines = [];
+    for (const q of questions) {
+        const answer = response.answers[q.id];
+        if (!answer) {
+            lines.push(`${theme.fg("accent", q.header)}: ${theme.fg("dim", "(no answer)")}`);
+            continue;
+        }
+        const selected = answer.selected;
+        const notes = answer.notes;
+        const multiSel = !!q.allowMultiple;
+        const answerText = multiSel && Array.isArray(selected)
+            ? selected.join(", ")
+            : (Array.isArray(selected) ? selected[0] : selected) ?? "(no answer)";
+        let line = `${theme.fg("success", "✓ ")}${theme.fg("accent", q.header)}: ${answerText}`;
+        if (notes) {
+            line += ` ${theme.fg("muted", `[note: ${notes}]`)}`;
+        }
+        lines.push(line);
+    }
+    return new Text(lines.join("\n"), 0, 0);
+}
 /** Convert the shared RoundResult into the JSON the LLM expects. */
 function formatForLLM(result) {
     const answers = {};
@@ -318,11 +373,17 @@ export default function AskUserQuestions(pi) {
             }
             return new Text(text, 0, 0);
         },
-        renderResult(result, _options, theme) {
+        renderResult(result, _options, theme, context) {
             const details = result.details;
+            const contentText = result.content[0]?.type === "text" ? result.content[0].text : "";
+            const questionsFromArgs = context?.args?.questions;
+            const parsedResponse = contentText ? parseLlmAnswersContent(contentText) : null;
             if (!details) {
-                const text = result.content[0];
-                return new Text(text?.type === "text" ? text.text : "", 0, 0);
+                const questions = questionsFromArgs;
+                if (questions?.length && parsedResponse) {
+                    return renderAnswerLines(questions, parsedResponse, theme);
+                }
+                return new Text(contentText, 0, 0);
             }
             // Remote channel result (discriminated on details.remote === true)
             if (details.remote) {
@@ -352,30 +413,24 @@ export default function AskUserQuestions(pi) {
                 }
                 return new Text(lines.join("\n"), 0, 0);
             }
-            if (details.cancelled || !details.response) {
+            const questions = details.questions ?? questionsFromArgs;
+            const response = details.response ?? parsedResponse;
+            const explicitCancel = details.cancelled === true || isCancelledResultContent(contentText);
+            if (explicitCancel && !response) {
                 const interrupted = "interrupted" in details && details.interrupted === true;
                 return new Text(theme.fg("warning", interrupted ? "Interrupted" : "Cancelled"), 0, 0);
             }
-            const lines = [];
-            for (const q of details.questions) {
-                const answer = details.response.answers[q.id];
-                if (!answer) {
-                    lines.push(`${theme.fg("accent", q.header)}: ${theme.fg("dim", "(no answer)")}`);
-                    continue;
-                }
-                const selected = answer.selected;
-                const notes = answer.notes;
-                const multiSel = !!q.allowMultiple;
-                const answerText = multiSel && Array.isArray(selected)
-                    ? selected.join(", ")
-                    : (Array.isArray(selected) ? selected[0] : selected) ?? "(no answer)";
-                let line = `${theme.fg("success", "✓ ")}${theme.fg("accent", q.header)}: ${answerText}`;
-                if (notes) {
-                    line += ` ${theme.fg("muted", `[note: ${notes}]`)}`;
-                }
-                lines.push(line);
+            if (questions?.length && response) {
+                return renderAnswerLines(questions, response, theme);
+            }
+            if (contentText) {
+                return new Text(contentText, 0, 0);
+            }
+            if (details.cancelled || !details.response) {
+                const interrupted = "interrupted" in details && details.interrupted === true;
+                return new Text(theme.fg("warning", interrupted ? "Interrupted" : "Cancelled"), 0, 0);
             }
-            return new Text(lines.join("\n"), 0, 0);
+            return new Text("", 0, 0);
         },
     });
 }