@opengsd/gsd-pi 1.2.0-dev.844675c9 → 1.2.0-dev.8e6112e9

package/dist/cli-model-override.d.ts

@@ -0,0 +1,15 @@
+import type { ModelRegistry as ModelRegistryInstance } from '@gsd/pi-coding-agent';
+/**
+ * Apply the --model CLI flag override to the active session.
+ * Searches available models by exact id or provider/id pattern and warns
+ * on stderr when the requested model is not found in the registry.
+ *
+ * The setModel call is intentionally fire-and-forget: provider readiness
+ * checks run later in startup so --model does not block session creation.
+ */
+export declare function applyModelOverride(session: {
+    setModel(model: {
+        provider: string;
+        id: string;
+    }): unknown | Promise<unknown>;
+}, modelRegistry: ModelRegistryInstance, modelFlag: string | undefined): void;

package/dist/cli-model-override.js

@@ -0,0 +1,21 @@
+/**
+ * Apply the --model CLI flag override to the active session.
+ * Searches available models by exact id or provider/id pattern and warns
+ * on stderr when the requested model is not found in the registry.
+ *
+ * The setModel call is intentionally fire-and-forget: provider readiness
+ * checks run later in startup so --model does not block session creation.
+ */
+export function applyModelOverride(session, modelRegistry, modelFlag) {
+    if (!modelFlag)
+        return;
+    const available = modelRegistry.getAvailable();
+    const match = available.find((m) => m.id === modelFlag) ||
+        available.find((m) => `${m.provider}/${m.id}` === modelFlag);
+    if (match) {
+        void session.setModel(match);
+    }
+    else {
+        process.stderr.write(`[gsd] Warning: Model "${modelFlag}" not found. Using configured default.\n`);
+    }
+}

package/dist/cli-style.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Terminal presentation helpers for CLI-side notices on stderr — warnings,
+ * hints, and names. Pairs with the extension-side glyph set in
+ * resources/extensions/shared/ui.ts. Adopt incrementally: banner-shaped CLI
+ * surfaces (worktree banners today; update checks et al. as they're touched)
+ * should render through these instead of ad-hoc chalk.
+ */
+/** Dim "[gsd] " line tag that prefixes CLI banner lines. */
+export declare function gsdTag(): string;
+/** A yellow warning fragment. */
+export declare function warn(text: string): string;
+/** A dim "what to do next" hint fragment. */
+export declare function hint(text: string): string;
+/** A cyan user-supplied name (worktree, branch, file). */
+export declare function name(text: string): string;
+/** One banner line: tagged warning followed by a tagged hint line. */
+export declare function bannerLines(warning: string, hintText: string): string;

package/dist/cli-style.js

@@ -0,0 +1,28 @@
+/**
+ * Terminal presentation helpers for CLI-side notices on stderr — warnings,
+ * hints, and names. Pairs with the extension-side glyph set in
+ * resources/extensions/shared/ui.ts. Adopt incrementally: banner-shaped CLI
+ * surfaces (worktree banners today; update checks et al. as they're touched)
+ * should render through these instead of ad-hoc chalk.
+ */
+import chalk from 'chalk';
+/** Dim "[gsd] " line tag that prefixes CLI banner lines. */
+export function gsdTag() {
+    return chalk.dim('[gsd] ');
+}
+/** A yellow warning fragment. */
+export function warn(text) {
+    return chalk.yellow(text);
+}
+/** A dim "what to do next" hint fragment. */
+export function hint(text) {
+    return chalk.dim(text);
+}
+/** A cyan user-supplied name (worktree, branch, file). */
+export function name(text) {
+    return chalk.cyan(text);
+}
+/** One banner line: tagged warning followed by a tagged hint line. */
+export function bannerLines(warning, hintText) {
+    return gsdTag() + warning + '\n' + gsdTag() + hint(hintText) + '\n\n';
+}

package/dist/cli-web-branch.d.ts

@@ -20,6 +20,8 @@ export interface CliFlags {
     webPort?: number;
     /** Additional allowed origins for CORS: `--allowed-origins http://192.168.1.10:8080` */
     webAllowedOrigins?: string[];
+    /** Disable the web launcher's bearer token gate: `--no-auth` */
+    webNoAuth?: boolean;
     /** Set by `gsd sessions` when the user picks a specific session to resume */
     _selectedSessionPath?: string;
 }

package/dist/cli-web-branch.js

@@ -52,6 +52,9 @@ export function parseCliArgs(argv) {
             const origins = args[++i].split(',').map(o => o.trim()).filter(Boolean);
             flags.webAllowedOrigins = (flags.webAllowedOrigins ?? []).concat(origins);
         }
+        else if (arg === '--no-auth') {
+            flags.webNoAuth = true;
+        }
         else if (arg === '--model' && i + 1 < args.length) {
             flags.model = args[++i];
         }
@@ -232,14 +235,18 @@ export async function runWebCliBranch(flags, deps = {}) {
     const agentDir = deps.agentDir ?? defaultAgentDir;
     const projectSessionsDir = getProjectSessionsDir(currentCwd, baseSessionsDir);
     migrateLegacyFlatSessions(baseSessionsDir, projectSessionsDir);
-    const status = await (deps.runWebMode ?? launchWebMode)({
+    const launchOptions = {
         cwd: currentCwd,
         projectSessionsDir,
         agentDir,
         host: flags.webHost,
         port: flags.webPort,
         allowedOrigins: flags.webAllowedOrigins,
-    });
+    };
+    if (flags.webNoAuth !== undefined) {
+        launchOptions.noAuth = flags.webNoAuth;
+    }
+    const status = await (deps.runWebMode ?? launchWebMode)(launchOptions);
     if (!status.ok) {
         emitWebModeFailure(stderr, status);
     }

package/dist/cli.js

@@ -14,6 +14,7 @@ import { printHelp, printSubcommandHelp } from './help-text.js';
 import { applySecurityOverrides } from './security-overrides.js';
 import { validateConfiguredModel } from './startup-model-validation.js';
 import { migrateAnthropicDefaultToClaudeCode } from './provider-migrations.js';
+import { applyModelOverride } from './cli-model-override.js';
 import { buildHeadlessAutoArgs, parseCliArgs, runWebCliBranch, migrateLegacyFlatSessions, } from './cli-web-branch.js';
 import { stopWebMode } from './web-mode.js';
 import { getProjectSessionsDir } from './project-sessions.js';
@@ -122,24 +123,6 @@ async function reapplyValidatedModelOnFallback(session, modelRegistry, settingsM
         // Provider not ready — leave session on its current model
     }
 }
-/**
- * Apply the --model CLI flag override to the active session.
- * Searches available models by exact id or provider/id pattern and warns
- * on stderr when the requested model is not found in the registry.
- */
-function applyModelOverride(session, modelRegistry, modelFlag) {
-    if (!modelFlag)
-        return;
-    const available = modelRegistry.getAvailable();
-    const match = available.find((m) => m.id === modelFlag) ||
-        available.find((m) => `${m.provider}/${m.id}` === modelFlag);
-    if (match) {
-        void session.setModel(match);
-    }
-    else {
-        process.stderr.write(`[gsd] Warning: Model "${modelFlag}" not found. Using configured default.\n`);
-    }
-}
 const cliFlags = parseCliArgs(process.argv);
 const isPrintMode = cliFlags.print || cliFlags.mode !== undefined;
 // `gsd [subcommand] --help` / `-h` — print help before any subcommand runs.
@@ -524,7 +507,7 @@ const authStorage = AuthStorage.create(authFilePath);
 markStartup('AuthStorage.create');
 loadStoredEnvKeys(authStorage);
 migratePiCredentials(authStorage);
-// Resolve models.json path with fallback to ~/.pi/agent/models.json
+// Resolve models.json path
 const { resolveModelsJsonPath } = await import('./models-resolver.js');
 const modelsJsonPath = resolveModelsJsonPath();
 const modelRegistry = ModelRegistry.create(authStorage, modelsJsonPath);

package/dist/headless-events.d.ts

@@ -5,6 +5,10 @@
  * and classifies commands as quick (single-turn) vs long-running.
  *
  * Also defines exit code constants and the status→exit-code mapping function.
+ *
+ * The stop/pause notice vocabulary itself (prefixes + message classifiers)
+ * lives in the Stop Notice module — the same module the emitters format with,
+ * so wording stays in lockstep with detection.
  */
 export declare const EXIT_SUCCESS = 0;
 export declare const EXIT_ERROR = 1;
@@ -42,8 +46,6 @@ export declare function mapStatusToExitCode(status: string): number;
  *
  * Blocked detection is separate — checked via isBlockedNotification.
  */
-export declare const PAUSED_PREFIXES: string[];
-export declare const TERMINAL_PREFIXES: string[];
 export declare const IDLE_TIMEOUT_MS = 15000;
 export declare const NEW_MILESTONE_IDLE_TIMEOUT_MS = 120000;
 export declare function canonicalHeadlessToolName(toolName: string | undefined): string;

package/dist/headless-events.js

@@ -5,7 +5,13 @@
  * and classifies commands as quick (single-turn) vs long-running.
  *
  * Also defines exit code constants and the status→exit-code mapping function.
+ *
+ * The stop/pause notice vocabulary itself (prefixes + message classifiers)
+ * lives in the Stop Notice module — the same module the emitters format with,
+ * so wording stays in lockstep with detection.
  */
+import { isBlockedNoticeMessage, isManualResolutionNotice, isPauseNotice, isTerminalNotice, } from './resources/extensions/gsd/stop-notice.js';
+import { canonicalToolName } from './resources/extensions/gsd/engine-hook-contract.js';
 // ---------------------------------------------------------------------------
 // Exit Code Constants
 // ---------------------------------------------------------------------------
@@ -65,40 +71,19 @@ export function mapStatusToExitCode(status) {
  *
  * Blocked detection is separate — checked via isBlockedNotification.
  */
-export const PAUSED_PREFIXES = ['auto-mode paused', 'step-mode paused'];
-export const TERMINAL_PREFIXES = [
-    'auto-mode stopped',
-    'step-mode stopped',
-    'auto-mode complete',
-    'no active milestone',
-    'auto-mode idle',
-];
 export const IDLE_TIMEOUT_MS = 15_000;
 // new-milestone is a long-running creative task where the LLM may pause
 // between tool calls (e.g. after mkdir, before writing files). Use a
 // longer idle timeout to avoid killing the session prematurely (#808).
 export const NEW_MILESTONE_IDLE_TIMEOUT_MS = 120_000;
 const INTERACTIVE_HEADLESS_TOOLS = new Set(['ask_user_questions', 'secure_env_collect']);
+// Delegates to the shared normalizer seam (engine-hook-contract.ts) instead of
+// a hand-rolled parser. Behavior differs from the old parser only on malformed
+// MCP names: `mcp____tool` (empty server) and `mcp__server__` (empty tool) are
+// now returned unchanged rather than partially stripped — neither can match a
+// real tool name, so detection behavior is unaffected.
 export function canonicalHeadlessToolName(toolName) {
-    const name = String(toolName ?? '');
-    if (!name.startsWith('mcp__'))
-        return name;
-    const toolSeparator = name.indexOf('__', 'mcp__'.length);
-    return toolSeparator >= 0 ? name.slice(toolSeparator + 2) : name;
-}
-function isManualResolutionNotification(message) {
-    return (message.includes('resolve manually and re-run /gsd auto') ||
-        message.includes('resolve conflicts manually and run /gsd auto to resume') ||
-        message.includes('resolve and run /gsd auto to resume'));
-}
-function isNonBlockingPauseNotification(message) {
-    return message.includes('idempotent advance: unit already active');
-}
-function isPauseNotification(message) {
-    return PAUSED_PREFIXES.some((prefix) => message.startsWith(prefix));
-}
-function isPauseNotificationRequiringIntervention(message) {
-    return isPauseNotification(message) && !isNonBlockingPauseNotification(message);
+    return canonicalToolName(String(toolName ?? ''));
 }
 function getCommandBlockContent(event) {
     if (event.type !== 'message_start' && event.type !== 'message_end')
@@ -122,20 +107,15 @@ export function isTerminalNotification(event) {
     if (event.type !== 'extension_ui_request' || event.method !== 'notify')
         return false;
     const message = String(event.message ?? '').toLowerCase();
-    return (TERMINAL_PREFIXES.some((prefix) => message.startsWith(prefix)) ||
-        isPauseNotification(message) ||
-        isManualResolutionNotification(message));
+    return isTerminalNotice(message) || isPauseNotice(message) || isManualResolutionNotice(message);
 }
 export function isBlockedNotification(event) {
     if (isBlockingCommandBlock(event))
         return true;
     if (event.type !== 'extension_ui_request' || event.method !== 'notify')
         return false;
-    const message = String(event.message ?? '').toLowerCase();
     // Recoverable pauses need operator intervention in headless mode.
-    return (message.includes('blocked:') ||
-        isPauseNotificationRequiringIntervention(message) ||
-        isManualResolutionNotification(message));
+    return isBlockedNoticeMessage(String(event.message ?? '').toLowerCase());
 }
 export function isMilestoneReadyNotification(event) {
     if (event.type !== 'extension_ui_request' || event.method !== 'notify')

package/dist/help-text.js

@@ -189,6 +189,11 @@ export function printHelp(version) {
     process.stdout.write('  --worktree, -w [name]    Start in an isolated worktree (auto-named if omitted)\n');
     process.stdout.write('  --model <id>             Override model (e.g. provider/model-id)\n');
     process.stdout.write('  --no-session             Disable session persistence\n');
+    process.stdout.write('  --web [path]             Start browser-only web mode\n');
+    process.stdout.write('  --host <host>            Web mode bind address\n');
+    process.stdout.write('  --port <port>            Web mode port\n');
+    process.stdout.write('  --allowed-origins <csv>  Additional allowed web origins\n');
+    process.stdout.write('  --no-auth                Disable web token auth; requires external access control\n');
     process.stdout.write('  --extension <path>       Load additional extension\n');
     process.stdout.write('  --tools <a,b,c>          Restrict available tools\n');
     process.stdout.write('  --list-models [search]   List available models and exit\n');

package/dist/loader.js

@@ -31,7 +31,7 @@ if (firstArg === '--help' || firstArg === '-h') {
 // package.json (already parsed above) and verifies git is available.
 // ---------------------------------------------------------------------------
 {
-    const { MIN_NODE_MAJOR, checkNodeVersion, requireGit } = await import('./runtime-checks.js');
+    const { MIN_NODE_MAJOR, checkNodeVersion, gitAvailableOnPath } = await import('./runtime-checks.js');
     const red = '\x1b[31m';
     const bold = '\x1b[1m';
     const dim = '\x1b[2m';
@@ -48,8 +48,10 @@ if (firstArg === '--help' || firstArg === '-h') {
         process.exit(1);
     }
     // -- git --
-    const { execFileSync } = await import('child_process');
-    const gitOk = requireGit((cmd, args) => execFileSync(cmd, args, { stdio: 'ignore' }));
+    // Presence-check git via a $PATH scan rather than spawning `git --version`:
+    // the subprocess cost ~15ms on every cold start (~5% of startup CPU) just to
+    // confirm git is installed.
+    const gitOk = gitAvailableOnPath();
     if (!gitOk) {
         process.stderr.write(`\n${red}${bold}Error:${reset} GSD requires git but it was not found on PATH.\n\n` +
             `${dim}Install git:${reset}\n` +
@@ -230,6 +232,6 @@ if (missingPackages.length > 0) {
 }
 // Register GSD agent packages for extension imports before CLI loads.
 const { registerAgentBundles } = await import('./register-agent-bundles.js');
-registerAgentBundles();
+await registerAgentBundles();
 // Dynamic import defers ESM evaluation — config.js will see PI_PACKAGE_DIR above
 await import('./cli.js');

package/dist/mcp-server.js

@@ -29,6 +29,7 @@ function isPlainObject(value) {
 // built via a template string so TypeScript's NodeNext resolver treats them as
 // `any` and skips static checking.
 const MCP_PKG = '@modelcontextprotocol/sdk';
+import { sanitizeSchemaForMoonshot } from '@gsd/pi-ai';
 export function mcpSdkSpecifier(subpath) {
     return `${MCP_PKG}/${subpath}.js`;
 }
@@ -65,7 +66,7 @@ export async function startMcpServer(options) {
         tools: tools.map((t) => ({
             name: t.name,
             description: t.description,
-            inputSchema: t.parameters,
+            inputSchema: sanitizeSchemaForMoonshot(t.parameters),
         })),
     }));
     // tools/call — execute the requested tool and return content blocks.

package/dist/models-resolver.d.ts

@@ -1,20 +1,10 @@
 /**
- * Models.json resolution with fallback to ~/.pi/agent/models.json
+ * Models.json resolution for GSD.
  *
- * GSD uses ~/.gsd/agent/models.json, but for a smooth migration/development
- * experience, this module provides resolution logic that:
- *
- * 1. Reads ~/.gsd/agent/models.json if it exists
- * 2. Falls back to ~/.pi/agent/models.json if GSD file doesn't exist
- * 3. Merges both files if both exist (GSD takes precedence)
+ * Uses ~/.gsd/agent/models.json exclusively.
  */
 /**
- * Resolve the path to models.json with fallback logic.
- *
- * Priority:
- * 1. ~/.gsd/agent/models.json (exists) → return this path
- * 2. ~/.pi/agent/models.json (exists) → return this path (fallback)
- * 3. Neither exists → return GSD path (will be created)
+ * Resolve the path to models.json.
  *
  * @returns The path to use for models.json
  */

package/dist/models-resolver.js

@@ -1,35 +1,16 @@
 /**
- * Models.json resolution with fallback to ~/.pi/agent/models.json
+ * Models.json resolution for GSD.
  *
- * GSD uses ~/.gsd/agent/models.json, but for a smooth migration/development
- * experience, this module provides resolution logic that:
- *
- * 1. Reads ~/.gsd/agent/models.json if it exists
- * 2. Falls back to ~/.pi/agent/models.json if GSD file doesn't exist
- * 3. Merges both files if both exist (GSD takes precedence)
+ * Uses ~/.gsd/agent/models.json exclusively.
  */
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { agentDir } from './app-paths.js';
 const GSD_MODELS_PATH = join(agentDir, 'models.json');
-const PI_MODELS_PATH = join(homedir(), '.pi', 'agent', 'models.json');
 /**
- * Resolve the path to models.json with fallback logic.
- *
- * Priority:
- * 1. ~/.gsd/agent/models.json (exists) → return this path
- * 2. ~/.pi/agent/models.json (exists) → return this path (fallback)
- * 3. Neither exists → return GSD path (will be created)
+ * Resolve the path to models.json.
  *
  * @returns The path to use for models.json
  */
 export function resolveModelsJsonPath() {
-    if (existsSync(GSD_MODELS_PATH)) {
-        return GSD_MODELS_PATH;
-    }
-    if (existsSync(PI_MODELS_PATH)) {
-        return PI_MODELS_PATH;
-    }
     return GSD_MODELS_PATH;
 }

package/dist/register-agent-bundles.d.ts

@@ -1,2 +1,11 @@
-/** Register GSD agent packages for extension virtual module resolution. */
-export declare function registerAgentBundles(): void;
+/**
+ * Register GSD agent packages for extension virtual module resolution.
+ *
+ * The eager `@gsd/agent-core` and `@gsd/agent-modes` barrels are only consumed
+ * by the Bun-binary extension loader (which has no filesystem and resolves
+ * bundled packages through `virtualModules`). On the Node/dev path the loader
+ * resolves those same specifiers by file path via `getAliases()`, so importing
+ * the full barrels at startup there is ~400ms of wasted module loading.
+ * Load them only when actually needed (Bun), keeping Node startup lean.
+ */
+export declare function registerAgentBundles(): Promise<void>;

package/dist/register-agent-bundles.js

@@ -1,12 +1,26 @@
-import * as agentCore from '@gsd/agent-core';
-import * as agentModes from '@gsd/agent-modes';
+import { isBunBinary } from '@gsd/pi-coding-agent/config.js';
 import { registerExtensionBundledModules } from '@gsd/pi-coding-agent/core/extensions/loader.js';
 let registered = false;
-/** Register GSD agent packages for extension virtual module resolution. */
-export function registerAgentBundles() {
+/**
+ * Register GSD agent packages for extension virtual module resolution.
+ *
+ * The eager `@gsd/agent-core` and `@gsd/agent-modes` barrels are only consumed
+ * by the Bun-binary extension loader (which has no filesystem and resolves
+ * bundled packages through `virtualModules`). On the Node/dev path the loader
+ * resolves those same specifiers by file path via `getAliases()`, so importing
+ * the full barrels at startup there is ~400ms of wasted module loading.
+ * Load them only when actually needed (Bun), keeping Node startup lean.
+ */
+export async function registerAgentBundles() {
     if (registered)
         return;
     registered = true;
+    if (!isBunBinary)
+        return;
+    const [agentCore, agentModes] = await Promise.all([
+        import('@gsd/agent-core'),
+        import('@gsd/agent-modes'),
+    ]);
     registerExtensionBundledModules({
         '@gsd/agent-core': agentCore,
         '@gsd/agent-modes': agentModes,

package/dist/resource-loader.d.ts

@@ -22,6 +22,9 @@ export declare function readManagedResourceVersion(agentDir: string): string | n
  * directory (e.g. pre-install verification).
  */
 export declare function computeResourceFingerprint(rootDir?: string): string;
+export declare function setGsdBrowserPackageSkillPathForTests(skillPath: string | null | undefined): void;
+export declare function collectGsdBrowserPackageSkillReferences(content: string): string[];
+export declare function hasStaleGsdBrowserPackageSkill(skillsDir: string): boolean;
 export declare function getNewerManagedResourceVersion(agentDir: string, currentVersion: string): string | null;
 /**
  * Syncs a single bundled resource directory into the agent directory.
@@ -49,18 +52,20 @@ export declare function reconcileMergedNodeModules(agentNodeModules: string, hoi
 /** Build a cache fingerprint from packageRoot + sorted entry names of both directories */
 export declare function mergedFingerprint(hoisted: string, internal: string): string;
 /**
- * Syncs all bundled resources to agentDir (~/.gsd/agent/) on every launch.
+ * Initializes managed resources under agentDir (~/.gsd/agent/).
  *
  * - extensions/ → ~/.gsd/agent/extensions/   (overwrite when version changes)
  * - shared/     → ~/.gsd/agent/shared/       (overwrite when version changes)
  * - agents/     → ~/.gsd/agent/agents/        (overwrite when version changes)
  * - skills/     → ~/.gsd/agent/skills/        (overwrite when version changes)
+ * - gsd-browser skill → ~/.gsd/agent/skills/gsd-browser/ from @opengsd/gsd-browser
  * - GSD-WORKFLOW.md → ~/.gsd/agent/GSD-WORKFLOW.md (fallback for env var miss)
  *
- * Skips the copy when the managed-resources.json version matches the current
- * GSD version, avoiding ~128ms of synchronous cpSync on every startup.
- * After `npm update -g @glittercowboy/gsd`, versions will differ and the
- * copy runs once to land the new resources.
+ * Skips the full copy only when the managed-resources.json version, content
+ * fingerprint, and package-owned gsd-browser skill all match the current
+ * install, avoiding ~128ms of synchronous cpSync on steady-state startup.
+ * After `npm update -g @opengsd/gsd-pi`, versions will differ and the copy
+ * runs once to land the new resources.
  *
  * Inspectable: `ls ~/.gsd/agent/extensions/`
  */