@opengsd/gsd-pi 1.3.0 → 1.4.0-dev.c18009cd

package/packages/mcp-server/README.md

@@ -114,7 +114,7 @@ These tools use the same GSD workflow handlers as the native in-process tool pat
 
 `gsd_decision_save` and its `gsd_save_decision` alias persist new decisions to the ADR-013 memory store, not to the legacy `decisions` table. The assigned `D###` ID is recorded in `memories.structured_fields.sourceDecisionId`, and `.gsd/DECISIONS.md` is refreshed as a projection from memory-backed decisions. The legacy table may still be read by compatibility and inspection paths during the cutover window, but it is no longer a write target.
 
-`gsd_summary_save` computes artifact paths from the supplied IDs. `milestone_id` is required for milestone-, slice-, and task-scoped artifact types (`SUMMARY`, `RESEARCH`, `CONTEXT`, `ASSESSMENT`, `CONTEXT-DRAFT`) and should be omitted only for root-level `PROJECT`, `PROJECT-DRAFT`, `REQUIREMENTS`, and `REQUIREMENTS-DRAFT` artifacts. For final `REQUIREMENTS` saves, the tool renders content from active database requirement rows; callers must create those rows with `gsd_requirement_save` first.
+`gsd_summary_save` computes artifact paths from the supplied IDs. `milestone_id` is required for milestone-, slice-, and task-scoped artifact types (`SUMMARY`, `RESEARCH`, `CONTEXT`, `ASSESSMENT`, `CONTEXT-DRAFT`) and should be omitted only for root-level `PROJECT`, `PROJECT-DRAFT`, `REQUIREMENTS`, and `REQUIREMENTS-DRAFT` artifacts. The `content` field has a schema `maxLength` of 50,000 characters per save; callers that produce larger artifacts should save incrementally by writing a substantive draft, then re-save the enriched artifact as more detail is available. For final `REQUIREMENTS` saves, the tool renders content from active database requirement rows; callers must create those rows with `gsd_requirement_save` first.
 
 ### Interactive tools
 
@@ -211,6 +211,16 @@ Cancel a running session. Aborts the current operation and stops the agent proce
 
 **Returns:** `{ cancelled: true }`
 
+### `gsd_cancel_by_project`
+
+Cancel the active session for a project directory when `sessionId` is unavailable (e.g. Hermes `/gsd cancel`).
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `projectDir` | `string` | ✅ | Absolute path to the project directory |
+
+**Returns:** `{ cancelled: true, projectDir: "..." }`
+
 ### `gsd_query`
 
 Query GSD project state from the filesystem without an active session. Returns STATE.md, PROJECT.md, requirements, and milestone listing.

package/packages/mcp-server/dist/cli-errors.d.ts

@@ -4,8 +4,19 @@ interface GlobalErrorRuntime {
     stderr: {
         write(message: string): unknown;
     };
+    exit(code: number): never;
 }
 export declare function formatUnknownError(error: unknown): string;
+/**
+ * Install process-global error handlers that log and then terminate.
+ *
+ * A repeating throw against a dead stdio transport (e.g. an orphaned server
+ * whose parent pipe has closed) would otherwise log-and-loop, pegging the CPU
+ * indefinitely because the handler returns without exiting. Terminating after
+ * logging guarantees the process crashes out of the loop; the client (Claude
+ * Code) owns restart/backoff, and the PID registry sweep cleans up the stale
+ * entry on the next spawn. See #783.
+ */
 export declare function installGlobalErrorHandlers(runtime?: GlobalErrorRuntime): void;
 export {};
 //# sourceMappingURL=cli-errors.d.ts.map

package/packages/mcp-server/dist/cli-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-errors.d.ts","sourceRoot":"","sources":["../src/cli-errors.ts"],"names":[],"mappings":"AAAA,KAAK,gBAAgB,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAEnE,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC;IACzE,MAAM,EAAE;QACN,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;KACjC,CAAC;CACH;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKzD;AAED,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,kBAAkD,GAAG,IAAI,CAQ5G"}
+{"version":3,"file":"cli-errors.d.ts","sourceRoot":"","sources":["../src/cli-errors.ts"],"names":[],"mappings":"AAAA,KAAK,gBAAgB,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAEnE,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC;IACzE,MAAM,EAAE;QACN,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;KACjC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,kBAA6D,GAAG,IAAI,CAUvH"}

package/packages/mcp-server/dist/cli-errors.js

@@ -4,12 +4,24 @@ export function formatUnknownError(error) {
     }
     return String(error);
 }
+/**
+ * Install process-global error handlers that log and then terminate.
+ *
+ * A repeating throw against a dead stdio transport (e.g. an orphaned server
+ * whose parent pipe has closed) would otherwise log-and-loop, pegging the CPU
+ * indefinitely because the handler returns without exiting. Terminating after
+ * logging guarantees the process crashes out of the loop; the client (Claude
+ * Code) owns restart/backoff, and the PID registry sweep cleans up the stale
+ * entry on the next spawn. See #783.
+ */
 export function installGlobalErrorHandlers(runtime = process) {
     runtime.on('uncaughtException', (error) => {
         runtime.stderr.write(`[gsd-mcp-server] Uncaught exception: ${formatUnknownError(error)}\n`);
+        runtime.exit(1);
     });
     runtime.on('unhandledRejection', (reason) => {
         runtime.stderr.write(`[gsd-mcp-server] Unhandled rejection: ${formatUnknownError(reason)}\n`);
+        runtime.exit(1);
     });
 }
 //# sourceMappingURL=cli-errors.js.map

package/packages/mcp-server/dist/cli-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-errors.js","sourceRoot":"","sources":["../src/cli-errors.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAA8B,OAA6B;IACpG,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["type GlobalErrorEvent = 'uncaughtException' | 'unhandledRejection';\n\ninterface GlobalErrorRuntime {\n  on(event: GlobalErrorEvent, listener: (error: unknown) => void): unknown;\n  stderr: {\n    write(message: string): unknown;\n  };\n}\n\nexport function formatUnknownError(error: unknown): string {\n  if (error instanceof Error) {\n    return error.stack ?? `${error.name}: ${error.message}`;\n  }\n  return String(error);\n}\n\nexport function installGlobalErrorHandlers(runtime: GlobalErrorRuntime = process as GlobalErrorRuntime): void {\n  runtime.on('uncaughtException', (error) => {\n    runtime.stderr.write(`[gsd-mcp-server] Uncaught exception: ${formatUnknownError(error)}\\n`);\n  });\n\n  runtime.on('unhandledRejection', (reason) => {\n    runtime.stderr.write(`[gsd-mcp-server] Unhandled rejection: ${formatUnknownError(reason)}\\n`);\n  });\n}\n"]}
+{"version":3,"file":"cli-errors.js","sourceRoot":"","sources":["../src/cli-errors.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAA8B,OAAwC;IAC/G,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["type GlobalErrorEvent = 'uncaughtException' | 'unhandledRejection';\n\ninterface GlobalErrorRuntime {\n  on(event: GlobalErrorEvent, listener: (error: unknown) => void): unknown;\n  stderr: {\n    write(message: string): unknown;\n  };\n  exit(code: number): never;\n}\n\nexport function formatUnknownError(error: unknown): string {\n  if (error instanceof Error) {\n    return error.stack ?? `${error.name}: ${error.message}`;\n  }\n  return String(error);\n}\n\n/**\n * Install process-global error handlers that log and then terminate.\n *\n * A repeating throw against a dead stdio transport (e.g. an orphaned server\n * whose parent pipe has closed) would otherwise log-and-loop, pegging the CPU\n * indefinitely because the handler returns without exiting. Terminating after\n * logging guarantees the process crashes out of the loop; the client (Claude\n * Code) owns restart/backoff, and the PID registry sweep cleans up the stale\n * entry on the next spawn. See #783.\n */\nexport function installGlobalErrorHandlers(runtime: GlobalErrorRuntime = process as unknown as GlobalErrorRuntime): void {\n  runtime.on('uncaughtException', (error) => {\n    runtime.stderr.write(`[gsd-mcp-server] Uncaught exception: ${formatUnknownError(error)}\\n`);\n    runtime.exit(1);\n  });\n\n  runtime.on('unhandledRejection', (reason) => {\n    runtime.stderr.write(`[gsd-mcp-server] Unhandled rejection: ${formatUnknownError(reason)}\\n`);\n    runtime.exit(1);\n  });\n}\n"]}

package/packages/mcp-server/dist/cli-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-runner.d.ts","sourceRoot":"","sources":["../src/cli-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAoBtD,UAAU,kBAAkB;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,UAAU,aAAa;IACrB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,yBAAyB;IACjC,KAAI,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACnD;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;IAC/B,2BAA2B,CAAC,EAAE,MAAM,IAAI,CAAC;IACzC,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC7D,4BAA4B,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5D,qBAAqB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,oBAAoB,CAAC,EAAE,MAAM,kBAAkB,CAAC;IAChD,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,kBAAkB,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IAC7F,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,oBAAoB,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC;IAChG,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC3D,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IAClE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAkBD,wBAAsB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAuHzF"}
+{"version":3,"file":"cli-runner.d.ts","sourceRoot":"","sources":["../src/cli-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAiCtD,UAAU,kBAAkB;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,UAAU,aAAa;IACrB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,yBAAyB;IACjC,KAAI,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACnD;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;IAC/B,2BAA2B,CAAC,EAAE,MAAM,IAAI,CAAC;IACzC,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC7D,4BAA4B,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5D,qBAAqB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,oBAAoB,CAAC,EAAE,MAAM,kBAAkB,CAAC;IAChD,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,kBAAkB,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IAC7F,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,oBAAoB,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC;IAChG,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC3D,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IAClE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAkBD,wBAAsB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IzF"}

package/packages/mcp-server/dist/cli-runner.js

@@ -9,6 +9,18 @@ const MCP_PKG = '@modelcontextprotocol/sdk';
 const STDIN_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
 const STDIN_IDLE_CHECK_INTERVAL_MS = 60 * 1000;
 const CLEANUP_STEP_TIMEOUT_MS = 2 * 1000;
+/**
+ * Cadence for the ref-held parent-liveness monitor.
+ *
+ * Separate from the `.unref()`'d idle watchdog: a process already pegged at
+ * ~100% CPU starves its event loop, so the watchdog timer may never fire and a
+ * spinning orphan lingers until the next spawn sweeps it. This monitor is
+ * ref-held (NOT `.unref()`'d) so the libuv loop keeps scheduling it under load,
+ * and it exits the process itself the moment the parent is gone — independent
+ * of the external PID-registry sweep that only runs on the next launch. See
+ * #783.
+ */
+const ORPHAN_PARENT_LOSS_CHECK_INTERVAL_MS = 10 * 1000;
 function createDefaultIsOrphaned(initialParentPid) {
     return () => {
         if (process.ppid !== initialParentPid)
@@ -52,6 +64,7 @@ export async function runMcpServerCli(options = {}) {
     let registered = false;
     let cleaningUp = false;
     let idleWatchdog;
+    let orphanMonitor;
     let trackedStdin;
     let sessionManager;
     let server;
@@ -79,6 +92,8 @@ export async function runMcpServerCli(options = {}) {
     async function stopRuntime() {
         if (idleWatchdog)
             stopInterval(idleWatchdog);
+        if (orphanMonitor)
+            stopInterval(orphanMonitor);
         trackedStdin?.close();
         if (registered)
             unregisterInstance(projectDir);
@@ -118,6 +133,24 @@ export async function runMcpServerCli(options = {}) {
             }
         }, STDIN_IDLE_CHECK_INTERVAL_MS);
         idleWatchdog.unref();
+        // Ref-held parent-liveness monitor (#783). The idle watchdog above is
+        // `.unref()`'d, so a process pegged at ~100% CPU (e.g. a repeating throw
+        // against a dead stdio pipe) starves its event loop and the watchdog never
+        // fires — the orphan spins until the next launch sweeps it. This monitor is
+        // NOT unref'd: the loop keeps scheduling it under load, so parent loss is
+        // detected in seconds regardless of CPU state. It still requires the same
+        // idle gate as the watchdog so an active session whose parent briefly
+        // appears gone is not killed (#783 "stays alive when parent is gone but
+        // stdin is still active").
+        orphanMonitor = startInterval(() => {
+            if (!isOrphaned())
+                return;
+            const idleMs = trackedStdin ? now() - trackedStdin.lastActivityAt() : 0;
+            if (idleMs <= STDIN_IDLE_TIMEOUT_MS)
+                return;
+            stderr.write(`[gsd-mcp-server] Parent process is gone; shutting down to avoid orphan spin\n`);
+            void cleanup();
+        }, ORPHAN_PARENT_LOSS_CHECK_INTERVAL_MS);
         // Fail closed (ADR-036): warm the executor / write-gate bridges BEFORE
         // connecting the transport. If a bridge is broken we must not advertise the
         // workflow tool surface — a rejection here propagates to the catch below so

package/packages/mcp-server/dist/cli-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-runner.js","sourceRoot":"","sources":["../src/cli-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAA8B,MAAM,qBAAqB,CAAC;AAE9F,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAE5C,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,CAAC;AAsCzC,SAAS,uBAAuB,CAAC,gBAAwB;IACvD,OAAO,GAAG,EAAE;QACV,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC;IAC9C,OAAO,MAAM,CAAC,GAAG,OAAO,kBAAkB,CAAiE,CAAC;AAC9G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkC,EAAE;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAS,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,2BAA2B,IAAI,2BAA2B,CAAC;IACnF,MAAM,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,4BAA4B,IAAI,4BAA4B,CAAC;IAC1F,MAAM,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,IAAI,qBAAqB,CAAC;IAClF,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,IAAI,CAC9C,KAAK,EAAE,OAA2B,EAAE,EAAE,CAAC,eAAe,CAAC,OAAyB,CAAC,CAClF,CAAC;IACF,MAAM,eAAe,GAAG,OAAO,CAAC,0BAA0B,IAAI,iCAAiC,CAAC;IAChG,MAAM,WAAW,GAAG,OAAO,CAAC,uBAAuB,IAAI,uBAAuB,CAAC;IAE/E,OAAO,EAAE,CAAC;IAEV,MAAM,UAAU,GAAG,GAAG,CAAC,yBAAyB,IAAI,GAAG,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,YAAwD,CAAC;IAC7D,IAAI,YAA+C,CAAC;IACpD,IAAI,cAA8C,CAAC;IACnD,IAAI,MAAiC,CAAC;IAEtC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,IAAgC;QAC3E,IAAI,OAAkD,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5B,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC5B,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;wBACxB,MAAM,CAAC,KAAK,CAAC,4CAA4C,KAAK,IAAI,CAAC,CAAC;wBACpE,OAAO,EAAE,CAAC;oBACZ,CAAC,EAAE,oBAAoB,CAAC,CAAC;oBACzB,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;QACT,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,YAAY,EAAE,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU;YAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,cAAc,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,MAAM,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,IAAI,GAAG,CAAC;QAC7B,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACpD,MAAM,WAAW,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC;IAED,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAED,cAAc,GAAG,oBAAoB,EAAE,CAAC;QACxC,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QAElD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACzD,YAAY,GAAG,2BAA2B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEvE,YAAY,GAAG,aAAa,CAAC,GAAG,EAAE;YAChC,IAAI,YAAY,IAAI,GAAG,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,GAAG,qBAAqB,IAAI,UAAU,EAAE,EAAE,CAAC;gBAClG,MAAM,CAAC,KAAK,CACV,yDAAyD,qBAAqB,GAAG,IAAI,+CAA+C,CACrI,CAAC;gBACF,KAAK,OAAO,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACjC,YAAY,CAAC,KAAK,EAAE,CAAC;QAErB,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,mBAAmB;QACnB,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAClG,CAAC;QACF,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import type { Readable, Writable } from 'node:stream';\n\nimport { SessionManager } from './session-manager.js';\nimport { createMcpServer } from './server.js';\nimport { loadStoredCredentialEnvKeys } from './tool-credentials.js';\nimport { warmWorkflowToolBridges } from './workflow-tools.js';\nimport { isMcpProbeSession } from './probe-mode.js';\nimport {\n  registerMcpInstance,\n  sweepProjectOrphanMcpServers,\n  unregisterMcpInstance,\n} from './pid-registry.js';\nimport { createActivityTrackingInput, type ActivityTrackingInput } from './stdio-watchdog.js';\n\nconst MCP_PKG = '@modelcontextprotocol/sdk';\n\nconst STDIN_IDLE_TIMEOUT_MS = 5 * 60 * 1000;\nconst STDIN_IDLE_CHECK_INTERVAL_MS = 60 * 1000;\nconst CLEANUP_STEP_TIMEOUT_MS = 2 * 1000;\n\ninterface SessionManagerLike {\n  cleanup(): Promise<void>;\n}\n\ninterface McpServerLike {\n  connect(transport: unknown): Promise<void>;\n  close(): Promise<void>;\n}\n\ninterface StdioTransportConstructor {\n  new(input?: Readable, output?: Writable): unknown;\n}\n\nexport interface RunMcpServerCliOptions {\n  cwd?: () => string;\n  env?: NodeJS.ProcessEnv;\n  exit?: (code: number) => never;\n  loadStoredCredentialEnvKeys?: () => void;\n  registerMcpInstance?: (projectDir: string) => boolean | void;\n  sweepProjectOrphanMcpServers?: (projectDir: string) => void;\n  unregisterMcpInstance?: (projectDir: string) => void;\n  createSessionManager?: () => SessionManagerLike;\n  createMcpServer?: (sessionManager: SessionManagerLike) => Promise<{ server: McpServerLike }>;\n  importStdioServerTransport?: () => Promise<{ StdioServerTransport: StdioTransportConstructor }>;\n  warmWorkflowToolBridges?: () => Promise<unknown> | unknown;\n  stdin?: Readable;\n  stdout?: Writable;\n  stderr?: Writable;\n  onSignal?: (signal: NodeJS.Signals, listener: () => void) => void;\n  now?: () => number;\n  setInterval?: typeof setInterval;\n  clearInterval?: typeof clearInterval;\n  isOrphaned?: () => boolean;\n  cleanupStepTimeoutMs?: number;\n}\n\nfunction createDefaultIsOrphaned(initialParentPid: number): () => boolean {\n  return () => {\n    if (process.ppid !== initialParentPid) return true;\n    try {\n      process.kill(initialParentPid, 0);\n      return false;\n    } catch (err) {\n      return (err as NodeJS.ErrnoException).code === 'ESRCH';\n    }\n  };\n}\n\nasync function importDefaultStdioServerTransport(): Promise<{ StdioServerTransport: StdioTransportConstructor }> {\n  return import(`${MCP_PKG}/server/stdio.js`) as Promise<{ StdioServerTransport: StdioTransportConstructor }>;\n}\n\nexport async function runMcpServerCli(options: RunMcpServerCliOptions = {}): Promise<void> {\n  const cwd = options.cwd ?? (() => process.cwd());\n  const env = options.env ?? process.env;\n  const exit = options.exit ?? ((code: number): never => process.exit(code));\n  const stdin = options.stdin ?? process.stdin;\n  const stdout = options.stdout ?? process.stdout;\n  const stderr = options.stderr ?? process.stderr;\n  const onSignal = options.onSignal ?? ((signal, listener) => process.on(signal, listener));\n  const now = options.now ?? (() => Date.now());\n  const startInterval = options.setInterval ?? setInterval;\n  const stopInterval = options.clearInterval ?? clearInterval;\n  const isOrphaned = options.isOrphaned ?? createDefaultIsOrphaned(process.ppid);\n  const cleanupStepTimeoutMs = options.cleanupStepTimeoutMs ?? CLEANUP_STEP_TIMEOUT_MS;\n  const loadEnv = options.loadStoredCredentialEnvKeys ?? loadStoredCredentialEnvKeys;\n  const registerInstance = options.registerMcpInstance ?? registerMcpInstance;\n  const sweepOrphans = options.sweepProjectOrphanMcpServers ?? sweepProjectOrphanMcpServers;\n  const unregisterInstance = options.unregisterMcpInstance ?? unregisterMcpInstance;\n  const createSessionManager = options.createSessionManager ?? (() => new SessionManager());\n  const createServer = options.createMcpServer ?? (\n    async (manager: SessionManagerLike) => createMcpServer(manager as SessionManager)\n  );\n  const importTransport = options.importStdioServerTransport ?? importDefaultStdioServerTransport;\n  const warmBridges = options.warmWorkflowToolBridges ?? warmWorkflowToolBridges;\n\n  loadEnv();\n\n  const projectDir = env.GSD_WORKFLOW_PROJECT_ROOT || cwd();\n  const probeSession = isMcpProbeSession(env);\n  let registered = false;\n  let cleaningUp = false;\n  let idleWatchdog: ReturnType<typeof setInterval> | undefined;\n  let trackedStdin: ActivityTrackingInput | undefined;\n  let sessionManager: SessionManagerLike | undefined;\n  let server: McpServerLike | undefined;\n\n  async function runCleanupStep(label: string, step: () => Promise<void> | void): Promise<void> {\n    let timeout: ReturnType<typeof setTimeout> | undefined;\n    try {\n      await Promise.race([\n        Promise.resolve().then(step),\n        new Promise<void>((resolve) => {\n          timeout = setTimeout(() => {\n            stderr.write(`[gsd-mcp-server] Cleanup step timed out: ${label}\\n`);\n            resolve();\n          }, cleanupStepTimeoutMs);\n          timeout.unref();\n        }),\n      ]);\n    } catch {\n    } finally {\n      if (timeout) clearTimeout(timeout);\n    }\n  }\n\n  async function stopRuntime(): Promise<void> {\n    if (idleWatchdog) stopInterval(idleWatchdog);\n    trackedStdin?.close();\n    if (registered) unregisterInstance(projectDir);\n    await runCleanupStep('session manager cleanup', () => sessionManager?.cleanup());\n    await runCleanupStep('server close', () => server?.close());\n  }\n\n  async function cleanup(code = 0): Promise<void> {\n    if (cleaningUp) return;\n    cleaningUp = true;\n    stderr.write('[gsd-mcp-server] Shutting down...\\n');\n    await stopRuntime();\n    exit(code);\n  }\n\n  onSignal('SIGTERM', () => void cleanup());\n  onSignal('SIGINT', () => void cleanup());\n  stdin.once('end', () => void cleanup());\n  stdin.once('close', () => void cleanup());\n  stdin.once('error', () => void cleanup(1));\n\n  try {\n    if (!probeSession) {\n      sweepOrphans(projectDir);\n      if (registerInstance(projectDir) === false) {\n        throw new Error('refusing to start: existing MCP server PID could not be verified');\n      }\n      registered = true;\n    }\n\n    sessionManager = createSessionManager();\n    ({ server } = await createServer(sessionManager));\n\n    const { StdioServerTransport } = await importTransport();\n    trackedStdin = createActivityTrackingInput(stdin, now);\n    const transport = new StdioServerTransport(trackedStdin.input, stdout);\n\n    idleWatchdog = startInterval(() => {\n      if (trackedStdin && now() - trackedStdin.lastActivityAt() > STDIN_IDLE_TIMEOUT_MS && isOrphaned()) {\n        stderr.write(\n          `[gsd-mcp-server] Idle stdin watchdog: no activity for ${STDIN_IDLE_TIMEOUT_MS / 1000}s and parent process is gone, shutting down\\n`,\n        );\n        void cleanup();\n      }\n    }, STDIN_IDLE_CHECK_INTERVAL_MS);\n    idleWatchdog.unref();\n\n    // Fail closed (ADR-036): warm the executor / write-gate bridges BEFORE\n    // connecting the transport. If a bridge is broken we must not advertise the\n    // workflow tool surface — a rejection here propagates to the catch below so\n    // startup aborts and the client never sees tools that would error on first\n    // call. A healthy warm-up pre-pays the bridge import so the first real tool\n    // call stays fast.\n    await warmBridges();\n    stderr.write('[gsd-mcp-server] workflow bridges ready\\n');\n\n    await server.connect(transport);\n    stderr.write('[gsd-mcp-server] MCP server started on stdio\\n');\n  } catch (err) {\n    stderr.write(\n      `[gsd-mcp-server] Fatal: failed to start — ${err instanceof Error ? err.message : String(err)}\\n`,\n    );\n    await cleanup(1);\n  }\n}\n"]}
+{"version":3,"file":"cli-runner.js","sourceRoot":"","sources":["../src/cli-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAA8B,MAAM,qBAAqB,CAAC;AAE9F,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAE5C,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAsCvD,SAAS,uBAAuB,CAAC,gBAAwB;IACvD,OAAO,GAAG,EAAE;QACV,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC;IAC9C,OAAO,MAAM,CAAC,GAAG,OAAO,kBAAkB,CAAiE,CAAC;AAC9G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkC,EAAE;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAS,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,2BAA2B,IAAI,2BAA2B,CAAC;IACnF,MAAM,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,4BAA4B,IAAI,4BAA4B,CAAC;IAC1F,MAAM,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,IAAI,qBAAqB,CAAC;IAClF,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,IAAI,CAC9C,KAAK,EAAE,OAA2B,EAAE,EAAE,CAAC,eAAe,CAAC,OAAyB,CAAC,CAClF,CAAC;IACF,MAAM,eAAe,GAAG,OAAO,CAAC,0BAA0B,IAAI,iCAAiC,CAAC;IAChG,MAAM,WAAW,GAAG,OAAO,CAAC,uBAAuB,IAAI,uBAAuB,CAAC;IAE/E,OAAO,EAAE,CAAC;IAEV,MAAM,UAAU,GAAG,GAAG,CAAC,yBAAyB,IAAI,GAAG,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,YAAwD,CAAC;IAC7D,IAAI,aAAyD,CAAC;IAC9D,IAAI,YAA+C,CAAC;IACpD,IAAI,cAA8C,CAAC;IACnD,IAAI,MAAiC,CAAC;IAEtC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,IAAgC;QAC3E,IAAI,OAAkD,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5B,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC5B,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;wBACxB,MAAM,CAAC,KAAK,CAAC,4CAA4C,KAAK,IAAI,CAAC,CAAC;wBACpE,OAAO,EAAE,CAAC;oBACZ,CAAC,EAAE,oBAAoB,CAAC,CAAC;oBACzB,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;QACT,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,YAAY,EAAE,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU;YAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,cAAc,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,MAAM,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,IAAI,GAAG,CAAC;QAC7B,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACpD,MAAM,WAAW,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC;IAED,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAED,cAAc,GAAG,oBAAoB,EAAE,CAAC;QACxC,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QAElD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACzD,YAAY,GAAG,2BAA2B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEvE,YAAY,GAAG,aAAa,CAAC,GAAG,EAAE;YAChC,IAAI,YAAY,IAAI,GAAG,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,GAAG,qBAAqB,IAAI,UAAU,EAAE,EAAE,CAAC;gBAClG,MAAM,CAAC,KAAK,CACV,yDAAyD,qBAAqB,GAAG,IAAI,+CAA+C,CACrI,CAAC;gBACF,KAAK,OAAO,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACjC,YAAY,CAAC,KAAK,EAAE,CAAC;QAErB,sEAAsE;QACtE,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,2BAA2B;QAC3B,aAAa,GAAG,aAAa,CAAC,GAAG,EAAE;YACjC,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO;YAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,IAAI,MAAM,IAAI,qBAAqB;gBAAE,OAAO;YAC5C,MAAM,CAAC,KAAK,CACV,+EAA+E,CAChF,CAAC;YACF,KAAK,OAAO,EAAE,CAAC;QACjB,CAAC,EAAE,oCAAoC,CAAC,CAAC;QAEzC,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,mBAAmB;QACnB,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAClG,CAAC;QACF,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import type { Readable, Writable } from 'node:stream';\n\nimport { SessionManager } from './session-manager.js';\nimport { createMcpServer } from './server.js';\nimport { loadStoredCredentialEnvKeys } from './tool-credentials.js';\nimport { warmWorkflowToolBridges } from './workflow-tools.js';\nimport { isMcpProbeSession } from './probe-mode.js';\nimport {\n  registerMcpInstance,\n  sweepProjectOrphanMcpServers,\n  unregisterMcpInstance,\n} from './pid-registry.js';\nimport { createActivityTrackingInput, type ActivityTrackingInput } from './stdio-watchdog.js';\n\nconst MCP_PKG = '@modelcontextprotocol/sdk';\n\nconst STDIN_IDLE_TIMEOUT_MS = 5 * 60 * 1000;\nconst STDIN_IDLE_CHECK_INTERVAL_MS = 60 * 1000;\nconst CLEANUP_STEP_TIMEOUT_MS = 2 * 1000;\n\n/**\n * Cadence for the ref-held parent-liveness monitor.\n *\n * Separate from the `.unref()`'d idle watchdog: a process already pegged at\n * ~100% CPU starves its event loop, so the watchdog timer may never fire and a\n * spinning orphan lingers until the next spawn sweeps it. This monitor is\n * ref-held (NOT `.unref()`'d) so the libuv loop keeps scheduling it under load,\n * and it exits the process itself the moment the parent is gone — independent\n * of the external PID-registry sweep that only runs on the next launch. See\n * #783.\n */\nconst ORPHAN_PARENT_LOSS_CHECK_INTERVAL_MS = 10 * 1000;\n\ninterface SessionManagerLike {\n  cleanup(): Promise<void>;\n}\n\ninterface McpServerLike {\n  connect(transport: unknown): Promise<void>;\n  close(): Promise<void>;\n}\n\ninterface StdioTransportConstructor {\n  new(input?: Readable, output?: Writable): unknown;\n}\n\nexport interface RunMcpServerCliOptions {\n  cwd?: () => string;\n  env?: NodeJS.ProcessEnv;\n  exit?: (code: number) => never;\n  loadStoredCredentialEnvKeys?: () => void;\n  registerMcpInstance?: (projectDir: string) => boolean | void;\n  sweepProjectOrphanMcpServers?: (projectDir: string) => void;\n  unregisterMcpInstance?: (projectDir: string) => void;\n  createSessionManager?: () => SessionManagerLike;\n  createMcpServer?: (sessionManager: SessionManagerLike) => Promise<{ server: McpServerLike }>;\n  importStdioServerTransport?: () => Promise<{ StdioServerTransport: StdioTransportConstructor }>;\n  warmWorkflowToolBridges?: () => Promise<unknown> | unknown;\n  stdin?: Readable;\n  stdout?: Writable;\n  stderr?: Writable;\n  onSignal?: (signal: NodeJS.Signals, listener: () => void) => void;\n  now?: () => number;\n  setInterval?: typeof setInterval;\n  clearInterval?: typeof clearInterval;\n  isOrphaned?: () => boolean;\n  cleanupStepTimeoutMs?: number;\n}\n\nfunction createDefaultIsOrphaned(initialParentPid: number): () => boolean {\n  return () => {\n    if (process.ppid !== initialParentPid) return true;\n    try {\n      process.kill(initialParentPid, 0);\n      return false;\n    } catch (err) {\n      return (err as NodeJS.ErrnoException).code === 'ESRCH';\n    }\n  };\n}\n\nasync function importDefaultStdioServerTransport(): Promise<{ StdioServerTransport: StdioTransportConstructor }> {\n  return import(`${MCP_PKG}/server/stdio.js`) as Promise<{ StdioServerTransport: StdioTransportConstructor }>;\n}\n\nexport async function runMcpServerCli(options: RunMcpServerCliOptions = {}): Promise<void> {\n  const cwd = options.cwd ?? (() => process.cwd());\n  const env = options.env ?? process.env;\n  const exit = options.exit ?? ((code: number): never => process.exit(code));\n  const stdin = options.stdin ?? process.stdin;\n  const stdout = options.stdout ?? process.stdout;\n  const stderr = options.stderr ?? process.stderr;\n  const onSignal = options.onSignal ?? ((signal, listener) => process.on(signal, listener));\n  const now = options.now ?? (() => Date.now());\n  const startInterval = options.setInterval ?? setInterval;\n  const stopInterval = options.clearInterval ?? clearInterval;\n  const isOrphaned = options.isOrphaned ?? createDefaultIsOrphaned(process.ppid);\n  const cleanupStepTimeoutMs = options.cleanupStepTimeoutMs ?? CLEANUP_STEP_TIMEOUT_MS;\n  const loadEnv = options.loadStoredCredentialEnvKeys ?? loadStoredCredentialEnvKeys;\n  const registerInstance = options.registerMcpInstance ?? registerMcpInstance;\n  const sweepOrphans = options.sweepProjectOrphanMcpServers ?? sweepProjectOrphanMcpServers;\n  const unregisterInstance = options.unregisterMcpInstance ?? unregisterMcpInstance;\n  const createSessionManager = options.createSessionManager ?? (() => new SessionManager());\n  const createServer = options.createMcpServer ?? (\n    async (manager: SessionManagerLike) => createMcpServer(manager as SessionManager)\n  );\n  const importTransport = options.importStdioServerTransport ?? importDefaultStdioServerTransport;\n  const warmBridges = options.warmWorkflowToolBridges ?? warmWorkflowToolBridges;\n\n  loadEnv();\n\n  const projectDir = env.GSD_WORKFLOW_PROJECT_ROOT || cwd();\n  const probeSession = isMcpProbeSession(env);\n  let registered = false;\n  let cleaningUp = false;\n  let idleWatchdog: ReturnType<typeof setInterval> | undefined;\n  let orphanMonitor: ReturnType<typeof setInterval> | undefined;\n  let trackedStdin: ActivityTrackingInput | undefined;\n  let sessionManager: SessionManagerLike | undefined;\n  let server: McpServerLike | undefined;\n\n  async function runCleanupStep(label: string, step: () => Promise<void> | void): Promise<void> {\n    let timeout: ReturnType<typeof setTimeout> | undefined;\n    try {\n      await Promise.race([\n        Promise.resolve().then(step),\n        new Promise<void>((resolve) => {\n          timeout = setTimeout(() => {\n            stderr.write(`[gsd-mcp-server] Cleanup step timed out: ${label}\\n`);\n            resolve();\n          }, cleanupStepTimeoutMs);\n          timeout.unref();\n        }),\n      ]);\n    } catch {\n    } finally {\n      if (timeout) clearTimeout(timeout);\n    }\n  }\n\n  async function stopRuntime(): Promise<void> {\n    if (idleWatchdog) stopInterval(idleWatchdog);\n    if (orphanMonitor) stopInterval(orphanMonitor);\n    trackedStdin?.close();\n    if (registered) unregisterInstance(projectDir);\n    await runCleanupStep('session manager cleanup', () => sessionManager?.cleanup());\n    await runCleanupStep('server close', () => server?.close());\n  }\n\n  async function cleanup(code = 0): Promise<void> {\n    if (cleaningUp) return;\n    cleaningUp = true;\n    stderr.write('[gsd-mcp-server] Shutting down...\\n');\n    await stopRuntime();\n    exit(code);\n  }\n\n  onSignal('SIGTERM', () => void cleanup());\n  onSignal('SIGINT', () => void cleanup());\n  stdin.once('end', () => void cleanup());\n  stdin.once('close', () => void cleanup());\n  stdin.once('error', () => void cleanup(1));\n\n  try {\n    if (!probeSession) {\n      sweepOrphans(projectDir);\n      if (registerInstance(projectDir) === false) {\n        throw new Error('refusing to start: existing MCP server PID could not be verified');\n      }\n      registered = true;\n    }\n\n    sessionManager = createSessionManager();\n    ({ server } = await createServer(sessionManager));\n\n    const { StdioServerTransport } = await importTransport();\n    trackedStdin = createActivityTrackingInput(stdin, now);\n    const transport = new StdioServerTransport(trackedStdin.input, stdout);\n\n    idleWatchdog = startInterval(() => {\n      if (trackedStdin && now() - trackedStdin.lastActivityAt() > STDIN_IDLE_TIMEOUT_MS && isOrphaned()) {\n        stderr.write(\n          `[gsd-mcp-server] Idle stdin watchdog: no activity for ${STDIN_IDLE_TIMEOUT_MS / 1000}s and parent process is gone, shutting down\\n`,\n        );\n        void cleanup();\n      }\n    }, STDIN_IDLE_CHECK_INTERVAL_MS);\n    idleWatchdog.unref();\n\n    // Ref-held parent-liveness monitor (#783). The idle watchdog above is\n    // `.unref()`'d, so a process pegged at ~100% CPU (e.g. a repeating throw\n    // against a dead stdio pipe) starves its event loop and the watchdog never\n    // fires — the orphan spins until the next launch sweeps it. This monitor is\n    // NOT unref'd: the loop keeps scheduling it under load, so parent loss is\n    // detected in seconds regardless of CPU state. It still requires the same\n    // idle gate as the watchdog so an active session whose parent briefly\n    // appears gone is not killed (#783 \"stays alive when parent is gone but\n    // stdin is still active\").\n    orphanMonitor = startInterval(() => {\n      if (!isOrphaned()) return;\n      const idleMs = trackedStdin ? now() - trackedStdin.lastActivityAt() : 0;\n      if (idleMs <= STDIN_IDLE_TIMEOUT_MS) return;\n      stderr.write(\n        `[gsd-mcp-server] Parent process is gone; shutting down to avoid orphan spin\\n`,\n      );\n      void cleanup();\n    }, ORPHAN_PARENT_LOSS_CHECK_INTERVAL_MS);\n\n    // Fail closed (ADR-036): warm the executor / write-gate bridges BEFORE\n    // connecting the transport. If a bridge is broken we must not advertise the\n    // workflow tool surface — a rejection here propagates to the catch below so\n    // startup aborts and the client never sees tools that would error on first\n    // call. A healthy warm-up pre-pays the bridge import so the first real tool\n    // call stays fast.\n    await warmBridges();\n    stderr.write('[gsd-mcp-server] workflow bridges ready\\n');\n\n    await server.connect(transport);\n    stderr.write('[gsd-mcp-server] MCP server started on stdio\\n');\n  } catch (err) {\n    stderr.write(\n      `[gsd-mcp-server] Fatal: failed to start — ${err instanceof Error ? err.message : String(err)}\\n`,\n    );\n    await cleanup(1);\n  }\n}\n"]}

package/packages/mcp-server/dist/cli.d.ts

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 /**
  * @opengsd/mcp-server CLI — stdio transport entry point.
  *

package/packages/mcp-server/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG"}

package/packages/mcp-server/dist/cli.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 /**
  * @opengsd/mcp-server CLI — stdio transport entry point.
  *

package/packages/mcp-server/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,0BAA0B,EAAE,CAAC;AAE7B,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAChF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["/**\n * @opengsd/mcp-server CLI — stdio transport entry point.\n *\n * Connects the MCP server to stdin/stdout for use by Claude Code,\n * Cursor, and other MCP-compatible clients.\n */\n\nimport { installGlobalErrorHandlers } from './cli-errors.js';\nimport { runMcpServerCli } from './cli-runner.js';\n\ninstallGlobalErrorHandlers();\n\nrunMcpServerCli().catch((err) => {\n  process.stderr.write(\n    `[gsd-mcp-server] Fatal: ${err instanceof Error ? err.message : String(err)}\\n`\n  );\n  process.exit(1);\n});\n"]}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,0BAA0B,EAAE,CAAC;AAE7B,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAChF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\n/**\n * @opengsd/mcp-server CLI — stdio transport entry point.\n *\n * Connects the MCP server to stdin/stdout for use by Claude Code,\n * Cursor, and other MCP-compatible clients.\n */\n\nimport { installGlobalErrorHandlers } from './cli-errors.js';\nimport { runMcpServerCli } from './cli-runner.js';\n\ninstallGlobalErrorHandlers();\n\nrunMcpServerCli().catch((err) => {\n  process.stderr.write(\n    `[gsd-mcp-server] Fatal: ${err instanceof Error ? err.message : String(err)}\\n`\n  );\n  process.exit(1);\n});\n"]}

package/packages/mcp-server/dist/server.d.ts

@@ -42,10 +42,14 @@ export interface McpToolExtra {
     requestId?: string | number;
     sendNotification?: (notification: unknown) => void | Promise<void>;
 }
+interface ElicitRequestOptions {
+    timeout?: number;
+    signal?: AbortSignal;
+}
 interface McpServerInstance {
     tool(name: string, description: string, params: Record<string, unknown>, handler: (args: Record<string, unknown>, extra?: McpToolExtra) => Promise<unknown>): unknown;
     server: {
-        elicitInput(params: AskUserQuestionsElicitRequest | ElicitRequestFormParams, options?: unknown): Promise<AskUserQuestionsElicitResult>;
+        elicitInput(params: AskUserQuestionsElicitRequest | ElicitRequestFormParams, options?: ElicitRequestOptions): Promise<AskUserQuestionsElicitResult>;
     };
     connect(transport: unknown): Promise<void>;
     close(): Promise<void>;
@@ -97,6 +101,13 @@ interface AskUserQuestionsStructuredContent {
     questions: AskUserQuestion[];
     response: AskUserQuestionsRoundResult | null;
     cancelled: boolean;
+    /**
+     * True when the host elicitation timed out before the user answered.
+     * Distinct from `cancelled` (deliberate user dismissal): a timeout must not
+     * be laundered into a re-ask loop, so the gate hook treats it as "waiting"
+     * and pauses auto-mode (#852).
+     */
+    timed_out?: boolean;
 }
 interface AskUserQuestionsWriteGateModule {
     isGateQuestionId(questionId: string): boolean;
@@ -116,6 +127,15 @@ interface AskUserQuestionsWriteGateModule {
 }
 export declare function buildAskUserQuestionsElicitRequest(questions: AskUserQuestion[]): AskUserQuestionsElicitRequest;
 export declare function formatAskUserQuestionsElicitResult(questions: AskUserQuestion[], result: AskUserQuestionsElicitResult): string;
+/**
+ * Format the user-visible message returned when the host elicitation times out
+ * before the user answers. The message is LLM-facing: it tells the model the
+ * question was not answered, that it must NOT re-ask in the same turn, and that
+ * auto-mode is paused until the user responds. The gate hook routes this to a
+ * `timed_out` verdict so the depth-verification gate stays pending (fail-closed)
+ * without becoming a permanent block (#852).
+ */
+export declare function formatAskUserQuestionsTimeoutMessage(err: unknown): string;
 /**
  * Normalize an MCP elicitation form result into the `RoundResult` shape the
  * GSD discussion-gate hook reads from `tool_result` `details.response`. The
@@ -125,12 +145,34 @@ export declare function formatAskUserQuestionsElicitResult(questions: AskUserQue
  */
 export declare function buildAskUserQuestionsRoundResult(questions: AskUserQuestion[], result: AskUserQuestionsElicitResult): AskUserQuestionsRoundResult;
 interface AskUserQuestionsHandlerDeps {
-    elicitInput(params: AskUserQuestionsElicitRequest): Promise<AskUserQuestionsElicitResult>;
+    elicitInput(params: AskUserQuestionsElicitRequest, options?: ElicitRequestOptions): Promise<AskUserQuestionsElicitResult>;
     isRemoteConfigured(): boolean;
     tryRemoteQuestions(questions: AskUserQuestion[], signal?: AbortSignal): Promise<RemoteToolResult | null>;
     writeGate?: AskUserQuestionsWriteGateModule | null;
     writeGateBasePath?: string;
 }
+/**
+ * Detect an elicitation-side timeout error so the handler returns a clean
+ * "timed_out" result rather than a raw error the model will retry.
+ *
+ * The MCP SDK surfaces request deadline expiry as
+ * (`MCP error -32001: Request timed out`); `withElicitTimeout` also enforces
+ * the 10-minute user window (`… timed out after … minutes`). Both surface as
+ * elicitation fallback errors that should never become a raw `errorContent`
+ * response — without recognition they re-throw, skip
+ * `recordAskUserQuestionsGateResult`, leave the depth-verification gate
+ * pending, and the model loops on the blocked call (#852).
+ */
+export declare function isLocalElicitTimeoutError(err: unknown): boolean;
+/**
+ * Detect a client-side cancellation of the tools/call. `withElicitTimeout`
+ * rejects with `<label> cancelled by client` when the tool-call AbortSignal
+ * fires. This is the caller tearing down the request, not a channel failure,
+ * so the handler must return a clean cancelled result rather than re-throwing
+ * into a raw `isError` response that skips `recordAskUserQuestionsGateResult`
+ * and leaves the depth-verification gate pending with no cancellation signal.
+ */
+export declare function isLocalElicitClientAbortError(err: unknown): boolean;
 export declare function askUserQuestionsHandler(questions: AskUserQuestion[], extra: McpToolExtra | undefined, deps: AskUserQuestionsHandlerDeps): Promise<ToolContent>;
 export type ElicitInputFn = (params: {
     message: string;
@@ -157,7 +199,7 @@ type ToolContent = {
     }>;
     structuredContent?: Record<string, unknown>;
 };
-export declare function secureEnvCollectHandler(args: Record<string, unknown>, elicitInput: ElicitInputFn): Promise<ToolContent>;
+export declare function secureEnvCollectHandler(args: Record<string, unknown>, elicitInput: ElicitInputFn, signal?: AbortSignal): Promise<ToolContent>;
 /**
  * Create and configure an MCP server with session, read-only, and workflow tools.
  *

package/packages/mcp-server/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAmF9D;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,SAAoB,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CA8BZ;AA6KD,UAAU,uBAAuB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED,UAAU,iBAAiB;IACzB,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GACjF,OAAO,CAAC;IACX,MAAM,EAAE;QACN,WAAW,CACT,MAAM,EAAE,6BAA6B,GAAG,uBAAuB,EAC/D,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,4BAA4B,CAAC,CAAC;KAC1C,CAAC;IACF,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,qBAAqB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAMD,KAAK,4BAA4B,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;AAEzE,UAAU,4BAA4B;IACpC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;CACxD;AAED,UAAU,6BAA6B;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,UAAU,iCAAiC;IACzC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,2BAA2B;IACnC,YAAY,EAAE,KAAK,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;CAC5D;AAED,UAAU,iCAAiC;IACzC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,QAAQ,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC7C,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,+BAA+B;IACvC,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC;IAC3F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,wBAAwB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1E,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvE,+BAA+B,CAAC,CAAC,OAAO,EAAE;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,eAAe,EAAE,CAAC;QAC7B,OAAO,EAAE,iCAAiC,CAAC;KAC5C,GAAG,OAAO,CAAC;CACb;AAiCD,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,6BAA6B,CAmD9G;AAED,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,eAAe,EAAE,EAC5B,MAAM,EAAE,4BAA4B,GACnC,MAAM,CAkBR;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,eAAe,EAAE,EAC5B,MAAM,EAAE,4BAA4B,GACnC,2BAA2B,CAuB7B;AAED,UAAU,2BAA2B;IACnC,WAAW,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC1F,kBAAkB,IAAI,OAAO,CAAC;IAC9B,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzG,SAAS,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA2HD,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,eAAe,EAAE,EAC5B,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,WAAW,CAAC,CA0GtB;AAMD,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC9F,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAE9F,KAAK,WAAW,GACZ;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC/F;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEnH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,aAAa,GACzB,OAAO,CAAC,WAAW,CAAC,CAsGtB;AAMD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC;IACT,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC,CAqcD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAmF9D;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,SAAoB,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CA8BZ;AA6KD,UAAU,uBAAuB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED,UAAU,oBAAoB;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,UAAU,iBAAiB;IACzB,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GACjF,OAAO,CAAC;IACX,MAAM,EAAE;QACN,WAAW,CACT,MAAM,EAAE,6BAA6B,GAAG,uBAAuB,EAC/D,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAAC;KAC1C,CAAC;IACF,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,qBAAqB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAMD,KAAK,4BAA4B,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;AAEzE,UAAU,4BAA4B;IACpC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;CACxD;AAED,UAAU,6BAA6B;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,UAAU,iCAAiC;IACzC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,2BAA2B;IACnC,YAAY,EAAE,KAAK,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;CAC5D;AAED,UAAU,iCAAiC;IACzC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,QAAQ,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC7C,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,+BAA+B;IACvC,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC;IAC3F,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,wBAAwB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1E,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvE,+BAA+B,CAAC,CAAC,OAAO,EAAE;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,eAAe,EAAE,CAAC;QAC7B,OAAO,EAAE,iCAAiC,CAAC;KAC5C,GAAG,OAAO,CAAC;CACb;AAiCD,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,6BAA6B,CAmD9G;AAED,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,eAAe,EAAE,EAC5B,MAAM,EAAE,4BAA4B,GACnC,MAAM,CAkBR;AAED;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAQzE;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,eAAe,EAAE,EAC5B,MAAM,EAAE,4BAA4B,GACnC,2BAA2B,CAuB7B;AAED,UAAU,2BAA2B;IACnC,WAAW,CACT,MAAM,EAAE,6BAA6B,EACrC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACzC,kBAAkB,IAAI,OAAO,CAAC;IAC9B,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzG,SAAS,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA6FD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAQ/D;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGnE;AAiCD,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,eAAe,EAAE,EAC5B,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,WAAW,CAAC,CAgKtB;AAMD,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC9F,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAE9F,KAAK,WAAW,GACZ;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC/F;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEnH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,aAAa,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAwGtB;AAMD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC;IACT,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC,CA2dD"}

package/packages/mcp-server/dist/server.js

@@ -351,6 +351,23 @@ export function formatAskUserQuestionsElicitResult(questions, result) {
     }
     return JSON.stringify({ answers });
 }
+/**
+ * Format the user-visible message returned when the host elicitation times out
+ * before the user answers. The message is LLM-facing: it tells the model the
+ * question was not answered, that it must NOT re-ask in the same turn, and that
+ * auto-mode is paused until the user responds. The gate hook routes this to a
+ * `timed_out` verdict so the depth-verification gate stays pending (fail-closed)
+ * without becoming a permanent block (#852).
+ */
+export function formatAskUserQuestionsTimeoutMessage(err) {
+    const reason = err instanceof Error ? err.message : 'host elicitation timed out';
+    return [
+        `ask_user_questions timed out waiting for a response (${reason}).`,
+        'The user did not answer within the host elicitation window.',
+        'Do not re-ask the same question in this turn — that will only time out again.',
+        'Auto-mode is paused. Wait for the user to respond, or re-ask on a new turn once they confirm readiness.',
+    ].join(' ');
+}
 /**
  * Normalize an MCP elicitation form result into the `RoundResult` shape the
  * GSD discussion-gate hook reads from `tool_result` `details.response`. The
@@ -460,12 +477,48 @@ async function recordAskUserQuestionsGateResult(structured, deps) {
         writeGate.clearPendingGate(basePath);
     }
 }
+/**
+ * Detect an elicitation-side timeout error so the handler returns a clean
+ * "timed_out" result rather than a raw error the model will retry.
+ *
+ * The MCP SDK surfaces request deadline expiry as
+ * (`MCP error -32001: Request timed out`); `withElicitTimeout` also enforces
+ * the 10-minute user window (`… timed out after … minutes`). Both surface as
+ * elicitation fallback errors that should never become a raw `errorContent`
+ * response — without recognition they re-throw, skip
+ * `recordAskUserQuestionsGateResult`, leave the depth-verification gate
+ * pending, and the model loops on the blocked call (#852).
+ */
+export function isLocalElicitTimeoutError(err) {
+    if (!(err instanceof Error))
+        return false;
+    const message = err.message.toLowerCase();
+    return (message.includes('-32001') ||
+        message.includes('request timed out') ||
+        message.includes('timed out after'));
+}
+/**
+ * Detect a client-side cancellation of the tools/call. `withElicitTimeout`
+ * rejects with `<label> cancelled by client` when the tool-call AbortSignal
+ * fires. This is the caller tearing down the request, not a channel failure,
+ * so the handler must return a clean cancelled result rather than re-throwing
+ * into a raw `isError` response that skips `recordAskUserQuestionsGateResult`
+ * and leaves the depth-verification gate pending with no cancellation signal.
+ */
+export function isLocalElicitClientAbortError(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.message.toLowerCase().includes('cancelled by client');
+}
 function isLocalElicitFallbackError(err) {
+    if (isLocalElicitTimeoutError(err))
+        return true;
+    if (isLocalElicitClientAbortError(err))
+        return true;
     if (!(err instanceof Error))
         return false;
     const message = err.message.toLowerCase();
-    return (message.includes('timed out after') ||
-        message.includes('elicit') ||
+    return (message.includes('elicit') ||
         message.includes('elicitation') ||
         message.includes('host') ||
         message.includes('not supported') ||
@@ -498,8 +551,13 @@ export async function askUserQuestionsHandler(questions, extra, deps) {
         // remote (e.g. expired Discord token returning 401) must not block the
         // depth-verification gate when the user is sitting in front of the host.
         let localElicitError;
+        let localElicitTimedOut = false;
+        let localElicitCancelledByClient = false;
         try {
-            const elicitation = await withElicitTimeout(deps.elicitInput(buildAskUserQuestionsElicitRequest(questions)), 'ask_user_questions');
+            const elicitation = await withElicitTimeout(deps.elicitInput(buildAskUserQuestionsElicitRequest(questions), {
+                timeout: ELICIT_TIMEOUT_MS,
+                ...(extra?.signal ? { signal: extra.signal } : {}),
+            }), 'ask_user_questions', undefined, extra?.signal);
             if (elicitation.action === 'accept' && elicitation.content) {
                 const structured = {
                     questions,
@@ -517,7 +575,54 @@ export async function askUserQuestionsHandler(questions, extra, deps) {
             if (!isLocalElicitFallbackError(err))
                 throw err;
             localElicitError = err;
-            console.warn(`[gsd:mcp] ask_user_questions local elicitation unavailable; trying remote fallback: ${formatErrorMessage(err)}`);
+            // A timeout is the host user not answering, not a channel failure.
+            // Returning here (instead of falling through to remote) gives the gate
+            // hook a clean `timed_out` signal so it pauses auto-mode and waits for
+            // the user instead of looping on the blocked call (#852).
+            if (isLocalElicitTimeoutError(err)) {
+                localElicitTimedOut = true;
+            }
+            else if (isLocalElicitClientAbortError(err)) {
+                // The caller aborted the tools/call. Handled below (do not fall
+                // through to remote; the signal is already aborted and no one is
+                // there to answer it either).
+                localElicitCancelledByClient = true;
+            }
+            else {
+                console.warn(`[gsd:mcp] ask_user_questions local elicitation unavailable; trying remote fallback: ${formatErrorMessage(err)}`);
+            }
+        }
+        // Host-side timeout: the user is at the host but didn't respond. Do not
+        // fall through to remote (no one is there to answer it either). Return a
+        // clean `timed_out` result so the gate hook pauses and the model stops
+        // retrying the blocked call.
+        if (localElicitTimedOut) {
+            const timedOutStructured = {
+                questions,
+                response: null,
+                cancelled: true,
+                timed_out: true,
+            };
+            return {
+                content: [{ type: 'text', text: formatAskUserQuestionsTimeoutMessage(localElicitError) }],
+                structuredContent: timedOutStructured,
+            };
+        }
+        // Client aborted the tools/call. Do not fall through to remote (the signal
+        // is already aborted and no one is there to answer). Return a clean
+        // `cancelled` result so the gate hook sees a cancellation (gate stays
+        // pending, model re-asks) instead of a raw `isError` that skips the gate
+        // result recording entirely.
+        if (localElicitCancelledByClient) {
+            const cancelledStructured = {
+                questions,
+                response: null,
+                cancelled: true,
+            };
+            return {
+                content: [{ type: 'text', text: 'ask_user_questions was cancelled by the client' }],
+                structuredContent: cancelledStructured,
+            };
         }
         // Local cancelled / unavailable — fall back to the configured remote
         // channel (Discord, Slack, Telegram) if one is set.
@@ -591,7 +696,7 @@ export async function askUserQuestionsHandler(questions, extra, deps) {
         return errorContent(err instanceof Error ? err.message : String(err));
     }
 }
-export async function secureEnvCollectHandler(args, elicitInput) {
+export async function secureEnvCollectHandler(args, elicitInput, signal) {
     const { projectDir, keys, destination, envFilePath, environment } = args;
     try {
         const resolvedProjectDir = validateProjectDir(projectDir);
@@ -633,7 +738,7 @@ export async function secureEnvCollectHandler(args, elicitInput) {
                 properties,
                 required,
             },
-        }), 'secure_env_collect');
+        }), 'secure_env_collect', undefined, signal);
         if (elicitation.action !== 'accept' || !elicitation.content) {
             return textContent('secure_env_collect was cancelled by user.');
         }
@@ -795,6 +900,21 @@ export async function createMcpServer(sessionManager) {
         }
     });
     // -----------------------------------------------------------------------
+    // gsd_cancel_by_project — cancel by projectDir only (Hermes /gsd cancel)
+    // -----------------------------------------------------------------------
+    server.tool('gsd_cancel_by_project', 'Cancel the active GSD session for a project directory. Use when sessionId is unknown (e.g. Hermes gateway /gsd cancel).', {
+        projectDir: z.string().describe('Absolute path to the project directory'),
+    }, async (args) => {
+        const { projectDir } = args;
+        try {
+            await sessionManager.cancelSessionByDir(validateProjectDir(projectDir));
+            return jsonContent({ cancelled: true, projectDir });
+        }
+        catch (err) {
+            return errorContent(err instanceof Error ? err.message : String(err));
+        }
+    });
+    // -----------------------------------------------------------------------
     // gsd_query — read project state from filesystem (no session needed).
     //
     // `query` is optional: when omitted the tool returns all fields (STATE.md,
@@ -852,7 +972,7 @@ export async function createMcpServer(sessionManager) {
     }, async (args, extra) => {
         const { questions } = args;
         return askUserQuestionsHandler(questions, extra, {
-            elicitInput: (params) => server.server.elicitInput(params),
+            elicitInput: (params, options) => server.server.elicitInput(params, options),
             isRemoteConfigured,
             tryRemoteQuestions,
         });
@@ -870,7 +990,7 @@ export async function createMcpServer(sessionManager) {
         destination: z.enum(['dotenv', 'vercel', 'convex']).optional().describe('Where to write secrets. Auto-detected from project files if omitted.'),
         envFilePath: z.string().optional().describe('Path to .env file (dotenv only). Defaults to .env in projectDir.'),
         environment: z.enum(['development', 'preview', 'production']).optional().describe('Target environment (vercel/convex only)'),
-    }, async (args) => secureEnvCollectHandler(args, (params) => server.server.elicitInput(params)));
+    }, async (args, extra) => secureEnvCollectHandler(args, (params) => server.server.elicitInput(params), extra?.signal));
     // =======================================================================
     // READ-ONLY TOOLS — no session required, pure filesystem reads
     // =======================================================================