gsd-pi 2.28.0 → 2.29.0-dev.7612840

package/src/resources/extensions/gsd/verification-gate.ts

@@ -7,6 +7,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { join, basename } from "node:path";
 import type { AuditWarning, RuntimeError, VerificationCheck, VerificationResult } from "./types.js";
+import { DEFAULT_COMMAND_TIMEOUT_MS } from "./constants.js";
 
 /** Maximum bytes of stdout/stderr to retain per command (10 KB). */
 const MAX_OUTPUT_BYTES = 10 * 1024;
@@ -44,11 +45,12 @@ const PACKAGE_SCRIPT_KEYS = ["typecheck", "lint", "test"] as const;
  *   4. None found
  */
 export function discoverCommands(options: DiscoverCommandsOptions): DiscoveredCommands {
-  // 1. Preference commands
+  // 1. Preference commands (still sanitize — may contain prose from misconfiguration)
   if (options.preferenceCommands && options.preferenceCommands.length > 0) {
     const filtered = options.preferenceCommands
       .map(c => c.trim())
-      .filter(Boolean);
+      .filter(Boolean)
+      .filter(c => isLikelyCommand(c));
     if (filtered.length > 0) {
       return { commands: filtered, source: "preference" };
     }
@@ -110,7 +112,9 @@ const MAX_FAILURE_CONTEXT_CHARS = 10_000;
  * Returns an empty string when all checks pass or the checks array is empty.
  */
 export function formatFailureContext(result: VerificationResult): string {
-  const failures = result.checks.filter((c) => c.exitCode !== 0);
+  // Only include blocking failures in retry context — non-blocking (advisory) failures
+  // should not be injected into retry prompts to avoid noise pollution.
+  const failures = result.checks.filter((c) => c.exitCode !== 0 && c.blocking);
   if (failures.length === 0) return "";
 
   const blocks: string[] = [];
@@ -143,18 +147,81 @@ export function formatFailureContext(result: VerificationResult): string {
 /** Characters that indicate shell injection when found in a command string. */
 const SHELL_INJECTION_PATTERN = /[;|`]|\$\(/;
 
+/**
+ * Known executable first-tokens that are safe to run.
+ * Lowercase commands, common build/test tools, and npm/yarn/pnpm invocations.
+ */
+const KNOWN_COMMAND_PREFIXES = new Set([
+  "npm", "npx", "yarn", "pnpm", "bun", "bunx", "deno",
+  "node", "ts-node", "tsx", "tsc",
+  "sh", "bash", "zsh",
+  "echo", "cat", "ls", "test", "true", "false", "pwd", "env",
+  "make", "cargo", "go", "python", "python3", "pip", "pip3",
+  "ruby", "gem", "bundle", "rake",
+  "java", "javac", "mvn", "gradle",
+  "docker", "docker-compose",
+  "git", "gh",
+  "eslint", "prettier", "vitest", "jest", "mocha", "pytest", "phpunit",
+  "curl", "wget",
+  "grep", "find", "diff", "wc", "sort", "head", "tail",
+]);
+
+/**
+ * Heuristic check: does this string look like an executable shell command
+ * rather than a prose description?
+ *
+ * Returns true when the string appears to be a command. Returns false
+ * for English prose (e.g. "Document exists, contains all 5 scale names").
+ *
+ * Heuristics (any true → command-like):
+ *   1. First token is a known command prefix
+ *   2. First token starts with `.` or `/` (path-like)
+ *   3. Any token starts with `-` (flag-like)
+ *   4. First token contains no uppercase letters (commands are lowercase)
+ *      AND first token does not end with a comma or colon (prose punctuation)
+ *
+ * Heuristics (any true → prose-like):
+ *   1. First token starts with an uppercase letter and the string has 4+ words
+ *   2. String contains commas followed by spaces (prose clause structure)
+ */
+export function isLikelyCommand(cmd: string): boolean {
+  const trimmed = cmd.trim();
+  if (!trimmed) return false;
+
+  const tokens = trimmed.split(/\s+/);
+  const firstToken = tokens[0];
+
+  // Known command prefix → definitely a command
+  if (KNOWN_COMMAND_PREFIXES.has(firstToken)) return true;
+
+  // Path-like first token → command
+  if (firstToken.startsWith("/") || firstToken.startsWith("./") || firstToken.startsWith("../")) return true;
+
+  // Has flag-like tokens → command
+  if (tokens.some(t => t.startsWith("-"))) return true;
+
+  // First token starts with uppercase + 4 or more words → prose
+  if (/^[A-Z]/.test(firstToken) && tokens.length >= 4) return false;
+
+  // Contains comma-space patterns (prose clause separators) → prose
+  if (/,\s/.test(trimmed) && tokens.length >= 4) return false;
+
+  // First token has uppercase letters and no path separators → prose
+  if (/[A-Z]/.test(firstToken) && !firstToken.includes("/")) return false;
+
+  return true;
+}
+
 /**
  * Validate a command string for obvious shell injection patterns.
  * Returns the command unchanged if safe, or null if suspicious.
  */
 function sanitizeCommand(cmd: string): string | null {
   if (SHELL_INJECTION_PATTERN.test(cmd)) return null;
+  if (!isLikelyCommand(cmd)) return null;
   return cmd;
 }
 
-/** Default timeout for verification commands (ms). */
-const DEFAULT_COMMAND_TIMEOUT_MS = 120_000;
-
 export interface RunVerificationGateOptions {
   basePath: string;
   unitId: string;
@@ -191,6 +258,10 @@ export function runVerificationGate(options: RunVerificationGateOptions): Verifi
     };
   }
 
+  // Commands from preference and task-plan sources are blocking;
+  // package-json discovered commands are advisory (non-blocking).
+  const blocking = source === "preference" || source === "task-plan";
+
   const checks: VerificationCheck[] = [];
 
   for (const command of commands) {
@@ -226,11 +297,16 @@ export function runVerificationGate(options: RunVerificationGateOptions): Verifi
       stdout: truncate(result.stdout, MAX_OUTPUT_BYTES),
       stderr,
       durationMs,
+      blocking,
     });
   }
 
+  // Gate passes if all blocking checks pass (non-blocking failures are advisory)
+  const blockingChecks = checks.filter(c => c.blocking);
+  const passed = blockingChecks.length === 0 || blockingChecks.every(c => c.exitCode === 0);
+
   return {
-    passed: checks.every(c => c.exitCode === 0),
+    passed,
     checks,
     discoverySource: source,
     timestamp,

package/src/resources/extensions/gsd/visualizer-data.ts

@@ -35,7 +35,7 @@ import type {
 export interface VisualizerMilestone {
   id: string;
   title: string;
-  status: 'complete' | 'active' | 'pending';
+  status: 'complete' | 'active' | 'pending' | 'parked';
   dependsOn: string[];
   slices: VisualizerSlice[];
 }

package/src/resources/extensions/gsd/visualizer-overlay.ts

@@ -15,7 +15,7 @@ import {
   type ProgressFilter,
 } from "./visualizer-views.js";
 import { writeExportFile } from "./export.js";
-import { stripAnsi } from "../shared/format-utils.js";
+import { stripAnsi } from "../shared/mod.js";
 
 const TAB_COUNT = 10;
 const TAB_LABELS = [
@@ -86,6 +86,9 @@ export class GSDVisualizerOverlay {
       this.data = d;
       this.loading = false;
       this.tui.requestRender();
+    }).catch(() => {
+      this.loading = false;
+      this.tui.requestRender();
     });
 
     this.refreshTimer = setInterval(() => {
@@ -94,7 +97,7 @@ export class GSDVisualizerOverlay {
         this.data = d;
         this.invalidate();
         this.tui.requestRender();
-      });
+      }).catch(() => {}); // retry on next interval
     }, 5000);
   }
 

package/src/resources/extensions/gsd/visualizer-views.ts

@@ -4,8 +4,7 @@ import type { Theme } from "@gsd/pi-coding-agent";
 import { truncateToWidth, visibleWidth } from "@gsd/pi-tui";
 import type { VisualizerData, VisualizerMilestone, SliceVerification, VisualizerSliceActivity, VisualizerStats, VisualizerSliceRef } from "./visualizer-data.js";
 import { formatCost, formatTokenCount, classifyUnitPhase } from "./metrics.js";
-import { formatDuration, padRight, joinColumns, sparkline } from "../shared/format-utils.js";
-import { STATUS_GLYPH, STATUS_COLOR } from "../shared/ui.js";
+import { formatDuration, padRight, joinColumns, sparkline, STATUS_GLYPH, STATUS_COLOR } from "../shared/mod.js";
 
 function formatCompletionDate(input: string): string {
   if (!input) return "unknown";
@@ -135,7 +134,7 @@ export function renderProgressView(
     }
 
     // Milestone header line
-    const msStatus = ms.status === "complete" ? "done" : ms.status === "active" ? "active" : "pending";
+    const msStatus = ms.status === "complete" ? "done" : ms.status === "active" ? "active" : ms.status === "parked" ? "paused" : "pending";
     const statusGlyph = th.fg(STATUS_COLOR[msStatus], STATUS_GLYPH[msStatus]);
     const statusLabel = th.fg(STATUS_COLOR[msStatus], ms.status);
 

package/src/resources/extensions/gsd/worktree-command.ts

@@ -12,9 +12,9 @@
 
 import type { ExtensionAPI, ExtensionCommandContext } from "@gsd/pi-coding-agent";
 import { loadPrompt } from "./prompt-loader.js";
-import { autoCommitCurrentBranch } from "./worktree.js";
+import { autoCommitCurrentBranch, getMainBranch, resolveGitHeadPath, nudgeGitBranchCache } from "./worktree.js";
 import { runWorktreePostCreateHook } from "./auto-worktree.js";
-import { showConfirm } from "../shared/confirm-ui.js";
+import { showConfirm } from "../shared/mod.js";
 import { gsdRoot, milestonesDir } from "./paths.js";
 import {
   createWorktree,
@@ -23,7 +23,6 @@ import {
   mergeWorktreeToMain,
   diffWorktreeAll,
   diffWorktreeNumstat,
-  getMainBranch,
   getWorktreeGSDDiff,
   getWorktreeCodeDiff,
   getWorktreeLog,
@@ -32,9 +31,9 @@ import {
 } from "./worktree-manager.js";
 import { inferCommitType } from "./git-service.js";
 import type { FileLineStat } from "./worktree-manager.js";
-import { existsSync, realpathSync, readFileSync, readdirSync, rmSync, unlinkSync, utimesSync } from "node:fs";
+import { existsSync, realpathSync, readdirSync, rmSync, unlinkSync } from "node:fs";
 import { nativeMergeAbort } from "./native-git-bridge.js";
-import { join, resolve, sep } from "node:path";
+import { join, sep } from "node:path";
 
 /**
  * Tracks the original project root so we can switch back.
@@ -47,52 +46,6 @@ export function getWorktreeOriginalCwd(): string | null {
   return originalCwd;
 }
 
-/**
- * Resolve the git HEAD file path for a given directory.
- * Handles both normal repos (.git is a directory) and worktrees (.git is a file).
- */
-function resolveGitHeadPath(dir: string): string | null {
-  const gitPath = join(dir, ".git");
-  if (!existsSync(gitPath)) return null;
-
-  try {
-    const content = readFileSync(gitPath, "utf8").trim();
-    if (content.startsWith("gitdir: ")) {
-      // Worktree — .git is a file pointing to the real gitdir
-      const gitDir = resolve(dir, content.slice(8));
-      const headPath = join(gitDir, "HEAD");
-      return existsSync(headPath) ? headPath : null;
-    }
-    // Normal repo — .git is a directory
-    const headPath = join(dir, ".git", "HEAD");
-    return existsSync(headPath) ? headPath : null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Nudge pi's FooterDataProvider to re-read the git branch.
- *
- * The footer caches the branch and watches a single .git dir for changes.
- * After process.chdir() into a worktree (or back), the watcher is stale —
- * it's still watching the old git dir. We touch HEAD in both the old and
- * new git dirs to ensure the watcher fires regardless of which one it's
- * monitoring. This clears cachedBranch; the next getGitBranch() call uses
- * the new process.cwd() and picks up the correct branch.
- */
-function nudgeGitBranchCache(previousCwd: string): void {
-  const now = new Date();
-  for (const dir of [previousCwd, process.cwd()]) {
-    try {
-      const headPath = resolveGitHeadPath(dir);
-      if (headPath) utimesSync(headPath, now, now);
-    } catch {
-      // Best-effort — branch display may be stale
-    }
-  }
-}
-
 /** Get the name of the active worktree, or null if not in one. */
 export function getActiveWorktreeName(): string | null {
   if (!originalCwd) return null;

package/src/resources/extensions/gsd/worktree-manager.ts

@@ -17,6 +17,7 @@
 
 import { existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
+import { GSDError, GSD_PARSE_ERROR, GSD_STALE_STATE, GSD_LOCK_HELD, GSD_GIT_ERROR, GSD_MERGE_CONFLICT } from "./errors.js";
 import {
   nativeBranchDelete,
   nativeBranchExists,
@@ -70,10 +71,6 @@ function normalizePathForComparison(path: string): string {
   return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 
-export function getMainBranch(basePath: string): string {
-  return nativeDetectMainBranch(basePath);
-}
-
 // ─── resolveGitDir ─────────────────────────────────────────────────────────
 
 /**
@@ -125,14 +122,14 @@ export function worktreeBranchName(name: string): string {
 export function createWorktree(basePath: string, name: string, opts: { branch?: string; startPoint?: string; reuseExistingBranch?: boolean } = {}): WorktreeInfo {
   // Validate name: alphanumeric, hyphens, underscores only
   if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
-    throw new Error(`Invalid worktree name "${name}". Use only letters, numbers, hyphens, and underscores.`);
+    throw new GSDError(GSD_PARSE_ERROR, `Invalid worktree name "${name}". Use only letters, numbers, hyphens, and underscores.`);
   }
 
   const wtPath = worktreePath(basePath, name);
   const branch = opts.branch ?? worktreeBranchName(name);
 
   if (existsSync(wtPath)) {
-    throw new Error(`Worktree "${name}" already exists at ${wtPath}`);
+    throw new GSDError(GSD_STALE_STATE, `Worktree "${name}" already exists at ${wtPath}`);
   }
 
   // Ensure the .gsd/worktrees/ directory exists
@@ -155,7 +152,8 @@ export function createWorktree(basePath: string, name: string, opts: { branch?:
     const branchInUse = worktreeEntries.some(entry => entry.branch === branch);
 
     if (branchInUse) {
-      throw new Error(
+      throw new GSDError(
+        GSD_LOCK_HELD,
         `Branch "${branch}" is already in use by another worktree. ` +
         `Remove the existing worktree first with /worktree remove ${name}.`,
       );
@@ -436,12 +434,12 @@ export function mergeWorktreeToMain(basePath: string, name: string, commitMessag
   const current = nativeGetCurrentBranch(basePath);
 
   if (current !== mainBranch) {
-    throw new Error(`Must be on ${mainBranch} to merge. Currently on ${current}.`);
+    throw new GSDError(GSD_GIT_ERROR, `Must be on ${mainBranch} to merge. Currently on ${current}.`);
   }
 
   const result = nativeMergeSquash(basePath, branch);
   if (!result.success) {
-    throw new Error(`Merge conflicts detected in: ${result.conflicts.join(", ")}`);
+    throw new GSDError(GSD_MERGE_CONFLICT, `Merge conflicts detected in: ${result.conflicts.join(", ")}`);
   }
 
   nativeCommit(basePath, commitMessage);

package/src/resources/extensions/gsd/worktree.ts

@@ -12,7 +12,8 @@
  * SLICE_BRANCH_RE) remain for backwards compatibility with legacy branches.
  */
 
-import { sep } from "node:path";
+import { existsSync, readFileSync, utimesSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
 
 import { GitServiceImpl, writeIntegrationBranch, type TaskCommitContext } from "./git-service.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
@@ -177,4 +178,43 @@ export function autoCommitCurrentBranch(
   return getService(basePath).autoCommit(unitType, unitId, [], taskContext);
 }
 
+// ─── Git HEAD Resolution ────────────────────────────────────────────────────
 
+/**
+ * Resolve the git HEAD file path for a given directory.
+ * Handles both normal repos (.git is a directory) and worktrees (.git is a file
+ * containing a `gitdir:` pointer to the real gitdir).
+ */
+export function resolveGitHeadPath(dir: string): string | null {
+  const gitPath = join(dir, ".git");
+  if (!existsSync(gitPath)) return null;
+
+  try {
+    const content = readFileSync(gitPath, "utf8").trim();
+    if (content.startsWith("gitdir: ")) {
+      const gitDir = resolve(dir, content.slice(8));
+      const headPath = join(gitDir, "HEAD");
+      return existsSync(headPath) ? headPath : null;
+    }
+    const headPath = join(dir, ".git", "HEAD");
+    return existsSync(headPath) ? headPath : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Nudge pi's FooterDataProvider to re-read the git branch after chdir.
+ * Touches HEAD in both old and new cwd to fire the fs watcher.
+ */
+export function nudgeGitBranchCache(previousCwd: string): void {
+  const now = new Date();
+  for (const dir of [previousCwd, process.cwd()]) {
+    try {
+      const headPath = resolveGitHeadPath(dir);
+      if (headPath) utimesSync(headPath, now, now);
+    } catch {
+      // Best-effort
+    }
+  }
+}

package/src/resources/extensions/mcporter/index.ts

@@ -102,22 +102,34 @@ async function runMcporter(
 }
 
 /**
- * Read .mcp.json from the project root (cwd) and return servers not already
- * discovered by mcporter. This bridges the gap where mcporter doesn't scan
- * the standard .mcp.json config used by Claude Code, Cursor, etc.
+ * Read MCP server configs from project-level files (.mcp.json and .gsd/mcp.json)
+ * and return servers not already discovered by mcporter.
+ *
+ * Search order:
+ *   1. .mcp.json (Claude Code / Cursor standard)
+ *   2. .gsd/mcp.json (GSD-specific per-project config, #716)
+ *
+ * Project config overrides global — servers found here take precedence over
+ * identically-named servers from mcporter's global discovery.
  */
 function readProjectMcpJson(knownNames: Set<string>): McpServer[] {
 	const servers: McpServer[] = [];
-	try {
-		const mcpJsonPath = join(process.cwd(), ".mcp.json");
-		if (!existsSync(mcpJsonPath)) return servers;
-		const raw = readFileSync(mcpJsonPath, "utf-8");
-		const data = JSON.parse(raw) as Record<string, unknown>;
-		const mcpServers = (data.mcpServers ?? data.servers) as Record<string, Record<string, unknown>> | undefined;
-		if (!mcpServers || typeof mcpServers !== "object") return servers;
+	const configPaths = [
+		join(process.cwd(), ".mcp.json"),
+		join(process.cwd(), ".gsd", "mcp.json"),
+	];
 
-		for (const [name, config] of Object.entries(mcpServers)) {
-			if (knownNames.has(name)) continue; // Already discovered by mcporter
+	for (const mcpJsonPath of configPaths) {
+		try {
+			if (!existsSync(mcpJsonPath)) continue;
+			const raw = readFileSync(mcpJsonPath, "utf-8");
+			const data = JSON.parse(raw) as Record<string, unknown>;
+			const mcpServers = (data.mcpServers ?? data.servers) as Record<string, Record<string, unknown>> | undefined;
+			if (!mcpServers || typeof mcpServers !== "object") continue;
+
+			for (const [name, config] of Object.entries(mcpServers)) {
+				if (knownNames.has(name)) continue; // Already discovered
+				knownNames.add(name); // Prevent duplicates across config files
 			const transport = (config.type as string) ?? (config.command ? "stdio" : config.url ? "http" : "unknown");
 			servers.push({
 				name,
@@ -126,8 +138,9 @@ function readProjectMcpJson(knownNames: Set<string>): McpServer[] {
 				tools: [], // Tools unknown until mcp_discover is called
 			});
 		}
-	} catch {
-		// Non-fatal — .mcp.json may not exist or be malformed
+		} catch {
+			// Non-fatal — config file may not exist or be malformed
+		}
 	}
 	return servers;
 }

package/src/resources/extensions/remote-questions/discord-adapter.ts

@@ -2,11 +2,12 @@
  * Remote Questions — Discord adapter
  */
 
-import type { ChannelAdapter, RemotePrompt, RemoteDispatchResult, RemoteAnswer, RemotePromptRef } from "./types.js";
+import { type ChannelAdapter, type RemotePrompt, type RemoteDispatchResult, type RemoteAnswer, type RemotePromptRef } from "./types.js";
 import { formatForDiscord, parseDiscordResponse, DISCORD_NUMBER_EMOJIS } from "./format.js";
+import { apiRequest } from "./http-client.js";
 
 const DISCORD_API = "https://discord.com/api/v10";
-const PER_REQUEST_TIMEOUT_MS = 15_000;
+
 export class DiscordAdapter implements ChannelAdapter {
   readonly name = "discord" as const;
   private botUserId: string | null = null;
@@ -137,23 +138,11 @@ export class DiscordAdapter implements ChannelAdapter {
     return parseDiscordResponse([], String(replies[0].content), prompt.questions);
   }
 
-  private async discordApi(method: string, path: string, body?: unknown): Promise<any> {
-    const headers: Record<string, string> = { Authorization: `Bot ${this.token}` };
-    const init: RequestInit = { method, headers };
-    if (body) {
-      headers["Content-Type"] = "application/json";
-      init.body = JSON.stringify(body);
-    }
-
-    init.signal = AbortSignal.timeout(PER_REQUEST_TIMEOUT_MS);
-    const response = await fetch(`${DISCORD_API}${path}`, init);
-    if (response.status === 204) return {};
-    if (!response.ok) {
-      const text = await response.text().catch(() => "");
-      // Limit error body length to avoid leaking verbose Discord error responses
-      const safeText = text.length > 200 ? text.slice(0, 200) + "…" : text;
-      throw new Error(`Discord API HTTP ${response.status}: ${safeText}`);
-    }
-    return response.json();
+  private async discordApi(method: "GET" | "POST" | "PUT" | "DELETE", path: string, body?: unknown): Promise<any> {
+    return apiRequest(`${DISCORD_API}${path}`, method, body, {
+      authScheme: "Bot",
+      authToken: this.token,
+      errorLabel: "Discord API",
+    });
   }
 }

package/src/resources/extensions/remote-questions/http-client.ts

@@ -0,0 +1,76 @@
+/**
+ * Remote Questions — shared HTTP client
+ *
+ * Centralizes timeout, error handling, and JSON serialization logic
+ * used by all channel adapters (Discord, Slack, Telegram).
+ */
+
+import { PER_REQUEST_TIMEOUT_MS } from "./types.js";
+
+export interface ApiRequestOptions {
+  /** Authorization header scheme. Omit to skip the Authorization header entirely. */
+  authScheme?: "Bearer" | "Bot";
+  /** Token for the Authorization header. Ignored when authScheme is omitted. */
+  authToken?: string;
+  /** Max chars of error body to include in thrown Error. Default 200. */
+  safeErrorLength?: number;
+  /** Label used in error messages (e.g. "Discord API", "Slack API"). Default "HTTP". */
+  errorLabel?: string;
+  /** Content-Type override. Default "application/json" when body is present. */
+  contentType?: string;
+}
+
+/**
+ * Makes an HTTP request with standardized timeout, error handling, and JSON
+ * serialization.
+ *
+ * - Sets `AbortSignal.timeout(PER_REQUEST_TIMEOUT_MS)` on every request.
+ * - Serializes `body` as JSON and sets Content-Type when provided.
+ * - Returns `{}` for 204 No Content responses.
+ * - Truncates error response bodies to `safeErrorLength` chars (default 200).
+ */
+export async function apiRequest(
+  url: string,
+  method: "GET" | "POST" | "PUT" | "DELETE",
+  body?: unknown,
+  options: ApiRequestOptions = {},
+): Promise<any> {
+  const {
+    authScheme,
+    authToken,
+    safeErrorLength = 200,
+    errorLabel = "HTTP",
+    contentType,
+  } = options;
+
+  const headers: Record<string, string> = {};
+  if (authScheme && authToken) {
+    headers["Authorization"] = `${authScheme} ${authToken}`;
+  }
+
+  const init: RequestInit = {
+    method,
+    headers,
+    signal: AbortSignal.timeout(PER_REQUEST_TIMEOUT_MS),
+  };
+
+  if (body !== undefined) {
+    headers["Content-Type"] = contentType ?? "application/json";
+    init.body = JSON.stringify(body);
+  }
+
+  const response = await fetch(url, init);
+
+  if (response.status === 204) return {};
+
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    const safeText =
+      text.length > safeErrorLength
+        ? text.slice(0, safeErrorLength) + "\u2026"
+        : text;
+    throw new Error(`${errorLabel} HTTP ${response.status}: ${safeText}`);
+  }
+
+  return response.json();
+}

package/src/resources/extensions/remote-questions/manager.ts

@@ -9,6 +9,7 @@ import { DiscordAdapter } from "./discord-adapter.js";
 import { SlackAdapter } from "./slack-adapter.js";
 import { TelegramAdapter } from "./telegram-adapter.js";
 import { createPromptRecord, writePromptRecord, markPromptAnswered, markPromptDispatched, markPromptStatus, updatePromptRecord } from "./store.js";
+import { sanitizeError } from "../shared/sanitize.js";
 
 interface ToolResult {
   content: Array<{ type: "text"; text: string }>;
@@ -70,7 +71,7 @@ export async function tryRemoteQuestions(
         channel: config.channel,
         timed_out: true,
         promptId: prompt.id,
-        threadUrl: dispatch.ref.threadUrl,
+        threadUrl: dispatch.ref.threadUrl ?? null,
         status: signal?.aborted ? "cancelled" : "timed_out",
       },
     };
@@ -79,11 +80,9 @@ export async function tryRemoteQuestions(
   markPromptAnswered(prompt.id, answer);
 
   // Best-effort acknowledgement gives remote users a visible receipt signal.
-  if (dispatch.ref) {
-    try {
-      await adapter.acknowledgeAnswer?.(dispatch.ref);
-    } catch { /* best-effort */ }
-  }
+  try {
+    await adapter.acknowledgeAnswer?.(dispatch.ref);
+  } catch { /* best-effort */ }
 
   return {
     content: [{ type: "text", text: JSON.stringify({ answers: formatForTool(answer) }) }],
@@ -92,7 +91,7 @@ export async function tryRemoteQuestions(
       channel: config.channel,
       timed_out: false,
       promptId: prompt.id,
-      threadUrl: dispatch.ref.threadUrl,
+      threadUrl: dispatch.ref.threadUrl ?? null,
       questions,
       response: answer,
       status: "answered",
@@ -177,23 +176,6 @@ function formatForTool(answer: RemoteAnswer): Record<string, { answers: string[]
   return out;
 }
 
-// Strip token-like strings from error messages before surfacing
-const TOKEN_PATTERNS = [
-  /xoxb-[A-Za-z0-9\-]+/g,    // Slack bot tokens
-  /xoxp-[A-Za-z0-9\-]+/g,    // Slack user tokens
-  /xoxa-[A-Za-z0-9\-]+/g,    // Slack app tokens
-  /\d{8,10}:[A-Za-z0-9_-]{35}/g, // Telegram bot tokens
-  /[A-Za-z0-9_\-.]{20,}/g,   // Long opaque secrets (Discord tokens, etc.)
-];
-
-export function sanitizeError(msg: string): string {
-  let sanitized = msg;
-  for (const pattern of TOKEN_PATTERNS) {
-    sanitized = sanitized.replace(pattern, "[REDACTED]");
-  }
-  return sanitized;
-}
-
 function errorResult(message: string, channel: string): ToolResult {
   return {
     content: [{ type: "text", text: sanitizeError(message) }],

package/src/resources/extensions/remote-questions/mod.ts

@@ -0,0 +1,16 @@
+// Barrel file — re-exports consumed by external modules
+
+export { handleRemote } from "./remote-command.js";
+export { createPromptRecord, writePromptRecord } from "./store.js";
+export { getLatestPromptSummary } from "./status.js";
+export {
+	parseSlackReply,
+	parseDiscordResponse,
+	formatForDiscord,
+	formatForSlack,
+	parseSlackReactionResponse,
+	formatForTelegram,
+	parseTelegramResponse,
+} from "./format.js";
+export { resolveRemoteConfig, isValidChannelId } from "./config.js";
+export { sendRemoteNotification } from "./notify.js";