gsd-pi 2.29.0 → 2.30.0-dev.7e1bbce

package/README.md

@@ -24,20 +24,21 @@ One command. Walk away. Come back to a built project with clean git history.
 
 ---
 
-## What's New in v2.28
-
-- **`gsd headless query`** — instant JSON snapshot of project state (~50ms, no LLM session)
-- **`/gsd update`** — update GSD to the latest version without leaving your session
-- **`/gsd export --html --all`** — generate retrospective HTML reports for all milestones at once
-- **Reliability hardening** — atomic file writes, OAuth fetch timeouts, RPC exit detection, blob GC, LSP init retry with backoff
-- **RPC utilities** now part of the public API for headless/scripted integrations
-- **npm** established as the canonical package manager
-- **CI/CD Pipeline** — three-stage promotion (Dev → Test → Prod) with automated versioning
-- **Docker support** — containerized builds with multi-stage Dockerfile
-- **`/gsd keys`** — full API key lifecycle management (list, add, remove, test, rotate, doctor)
-- **Milestone parking** — park in-progress milestones to work on something else, unpark to resume
-- **Studio** — experimental Electron desktop app (early preview)
+## What's New in v2.29
+
+- **Node.js 24 LTS** — CI, Docker, and package config all upgraded to Node 24 (Krypton)
+- **`searchExcludeDirs` setting** — blacklist directories from `@` file autocomplete (e.g., `node_modules`, `dist`)
+- **Automated releases** — prod-release now auto-generates changelogs, bumps versions, and publishes to npm
+- **`/gsd logs`** — browse activity, debug, and metrics logs from within a session
+- **Configurable screenshots** — browser-tools now support custom resolution, format, and quality
+- **Pre-commit secret scanning** — automatic detection of hardcoded secrets in CI and locally
 - **Per-project MCP config** — `.gsd/mcp.json` for project-scoped MCP server definitions
+- **API request metrics** — track request counts for Copilot/subscription users
+- **`/gsd keys`** — full API key lifecycle management (list, add, remove, test, rotate, doctor)
+- **Advisory verification gate** — auto-discovered checks (lint/test from package.json) no longer doom-loop on pre-existing errors
+- **Worktree living doc sync** — DECISIONS, REQUIREMENTS, PROJECT, and KNOWLEDGE now sync between worktree and project root
+- **Windows non-ASCII path support** — `cpSync` fallback for usernames with special characters
+- **`needs-discussion` routing** — milestones with draft context now route to the interactive discussion flow instead of stopping
 
 See the full [Changelog](./CHANGELOG.md) for details.
 
@@ -62,6 +63,8 @@ Full documentation is available in the [`docs/`](./docs/) directory:
 - **[CI/CD Pipeline](./docs/ci-cd-pipeline.md)** — three-stage promotion pipeline (Dev → Test → Prod)
 - **[VS Code Extension](./vscode-extension/README.md)** — chat participant, sidebar dashboard, RPC integration
 - **[Visualizer](./docs/visualizer.md)** — workflow visualizer with stats and discussion status
+- **[Remote Questions](./docs/remote-questions.md)** — route decisions to Slack or Discord when human input is needed
+- **[Dynamic Model Routing](./docs/dynamic-model-routing.md)** — complexity-based model selection and budget pressure
 - **[Migration from v1](./docs/migration.md)** — `.planning` → `.gsd` migration
 
 ---
@@ -175,7 +178,7 @@ Auto mode is a state machine driven by files on disk. It reads `.gsd/STATE.md`,
 
 9. **Adaptive replanning** — After each slice completes, the roadmap is reassessed. If the work revealed new information that changes the plan, slices are reordered, added, or removed before continuing.
 
-10. **Verification enforcement** — Configure shell commands (`npm run lint`, `npm run test`, etc.) that run automatically after task execution. Failures trigger auto-fix retries before advancing. Configurable via `verification_commands`, `verification_auto_fix`, and `verification_max_retries` preferences.
+10. **Verification enforcement** — Configure shell commands (`npm run lint`, `npm run test`, etc.) that run automatically after task execution. Failures trigger auto-fix retries before advancing. Auto-discovered checks from `package.json` run in advisory mode — they log warnings but don't block on pre-existing errors. Configurable via `verification_commands`, `verification_auto_fix`, and `verification_max_retries` preferences.
 
 11. **Milestone validation** — After all slices complete, a `validate-milestone` gate compares roadmap success criteria against actual results before sealing the milestone.
 
@@ -307,6 +310,7 @@ On first run, GSD launches a branded setup wizard that walks you through LLM pro
 | `/gsd cleanup`          | Archive phase directories from completed milestones             |
 | `/gsd doctor`           | Runtime health checks with auto-fix for common issues           |
 | `/gsd keys`             | API key manager — list, add, remove, test, rotate, doctor       |
+| `/gsd logs`             | Browse activity, debug, and metrics logs                        |
 | `/gsd export --html`    | Generate HTML report for current or completed milestone         |
 | `/worktree` (`/wt`)     | Git worktree lifecycle — create, switch, merge, remove          |
 | `/voice`                | Toggle real-time speech-to-text (macOS, Linux)                  |
@@ -447,6 +451,7 @@ auto_report: true
 | `verification_max_retries` | Max retries for verification failures (default: 2)                                               |
 | `require_slice_discussion` | Pause auto-mode before each slice for human discussion review                                    |
 | `auto_report`          | Auto-generate HTML reports after milestone completion (default: true)                                 |
+| `searchExcludeDirs`    | Directories to exclude from `@` file autocomplete (e.g., `["node_modules", ".git", "dist"]`)          |
 
 ### Agent Instructions
 
@@ -478,7 +483,7 @@ See the full [Token Optimization Guide](./docs/token-optimization.md) for detail
 
 ### Bundled Tools
 
-GSD ships with 14 extensions, all loaded automatically:
+GSD ships with 16 extensions, all loaded automatically:
 
 | Extension              | What it provides                                                                                                       |
 | ---------------------- | ---------------------------------------------------------------------------------------------------------------------- |
@@ -490,12 +495,14 @@ GSD ships with 14 extensions, all loaded automatically:
 | **Background Shell**   | Long-running process management with readiness detection                                                               |
 | **Subagent**           | Delegated tasks with isolated context windows                                                                          |
 | **Mac Tools**          | macOS native app automation via Accessibility APIs                                                                     |
-| **MCPorter**           | Lazy on-demand MCP server integration                                                                                  |
+| **MCP Client**         | Native MCP server integration via @modelcontextprotocol/sdk                                                            |
 | **Voice**              | Real-time speech-to-text transcription (macOS, Linux — Ubuntu 22.04+)                                                  |
 | **Slash Commands**     | Custom command creation                                                                                                |
 | **LSP**                | Language Server Protocol integration — diagnostics, go-to-definition, references, hover, symbols, rename, code actions |
 | **Ask User Questions** | Structured user input with single/multi-select                                                                         |
 | **Secure Env Collect** | Masked secret collection without manual .env editing                                                                   |
+| **Remote Questions**   | Route decisions to Slack/Discord when human input is needed in headless/CI mode                                         |
+| **Universal Config**   | Discover and import MCP servers and rules from other AI coding tools                                                    |
 
 ### Bundled Agents
 
@@ -597,7 +604,7 @@ gsd (CLI binary)
 
 ## Requirements
 
-- **Node.js** ≥ 20.6.0 (22+ recommended)
+- **Node.js** ≥ 22.0.0 (24 LTS recommended)
 - **An LLM provider** — any of the 20+ supported providers (see [Use Any Model](#use-any-model))
 - **Git** — initialized automatically if missing
 

package/dist/cli.js

@@ -59,6 +59,15 @@ function parseCliArgs(argv) {
             process.stdout.write((process.env.GSD_VERSION || '0.0.0') + '\n');
             process.exit(0);
         }
+        else if (arg === '--worktree' || arg === '-w') {
+            // -w with no value → auto-generate name; -w <name> → use that name
+            if (i + 1 < args.length && !args[i + 1].startsWith('-')) {
+                flags.worktree = args[++i];
+            }
+            else {
+                flags.worktree = true;
+            }
+        }
         else if (arg === '--help' || arg === '-h') {
             printHelp(process.env.GSD_VERSION || '0.0.0');
             process.exit(0);
@@ -343,6 +352,48 @@ if (isPrintMode) {
     process.exit(0);
 }
 // ---------------------------------------------------------------------------
+// Worktree subcommand — `gsd worktree <list|merge|clean|remove>`
+// ---------------------------------------------------------------------------
+if (cliFlags.messages[0] === 'worktree' || cliFlags.messages[0] === 'wt') {
+    const { handleList, handleMerge, handleClean, handleRemove } = await import('./worktree-cli.js');
+    const sub = cliFlags.messages[1];
+    const subArgs = cliFlags.messages.slice(2);
+    if (!sub || sub === 'list') {
+        handleList(process.cwd());
+    }
+    else if (sub === 'merge') {
+        await handleMerge(process.cwd(), subArgs);
+    }
+    else if (sub === 'clean') {
+        handleClean(process.cwd());
+    }
+    else if (sub === 'remove' || sub === 'rm') {
+        handleRemove(process.cwd(), subArgs);
+    }
+    else {
+        process.stderr.write(`Unknown worktree command: ${sub}\n`);
+        process.stderr.write('Commands: list, merge [name], clean, remove <name>\n');
+    }
+    process.exit(0);
+}
+// ---------------------------------------------------------------------------
+// Worktree flag (-w) — create/resume a worktree for the interactive session
+// ---------------------------------------------------------------------------
+if (cliFlags.worktree) {
+    const { handleWorktreeFlag } = await import('./worktree-cli.js');
+    handleWorktreeFlag(cliFlags.worktree);
+}
+// ---------------------------------------------------------------------------
+// Active worktree banner — remind user of unmerged worktrees on normal launch
+// ---------------------------------------------------------------------------
+if (!cliFlags.worktree && !isPrintMode) {
+    try {
+        const { handleStatusBanner } = await import('./worktree-cli.js');
+        handleStatusBanner(process.cwd());
+    }
+    catch { /* non-fatal */ }
+}
+// ---------------------------------------------------------------------------
 // Interactive mode — normal TTY session
 // ---------------------------------------------------------------------------
 // Per-directory session storage — same encoding as the upstream SDK so that

package/dist/extension-registry.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Extension Registry — manages manifest reading, registry persistence, and enable/disable state.
+ *
+ * Extensions without manifests always load (backwards compatible).
+ * A fresh install has an empty registry — all extensions enabled by default.
+ * The only way an extension stops loading is an explicit `gsd extensions disable <id>`.
+ */
+export interface ExtensionManifest {
+    id: string;
+    name: string;
+    version: string;
+    description: string;
+    tier: "core" | "bundled" | "community";
+    requires: {
+        platform: string;
+    };
+    provides?: {
+        tools?: string[];
+        commands?: string[];
+        hooks?: string[];
+        shortcuts?: string[];
+    };
+    dependencies?: {
+        extensions?: string[];
+        runtime?: string[];
+    };
+}
+export interface ExtensionRegistryEntry {
+    id: string;
+    enabled: boolean;
+    source: "bundled" | "user" | "project";
+    disabledAt?: string;
+    disabledReason?: string;
+}
+export interface ExtensionRegistry {
+    version: 1;
+    entries: Record<string, ExtensionRegistryEntry>;
+}
+export declare function getRegistryPath(): string;
+export declare function loadRegistry(): ExtensionRegistry;
+export declare function saveRegistry(registry: ExtensionRegistry): void;
+/** Returns true if the extension is enabled (missing entries default to enabled). */
+export declare function isExtensionEnabled(registry: ExtensionRegistry, id: string): boolean;
+export declare function enableExtension(registry: ExtensionRegistry, id: string): void;
+/**
+ * Disable an extension. Returns an error string if the extension is core (cannot disable),
+ * or null on success.
+ */
+export declare function disableExtension(registry: ExtensionRegistry, id: string, manifest: ExtensionManifest | null, reason?: string): string | null;
+/** Read extension-manifest.json from a directory. Returns null if missing or invalid. */
+export declare function readManifest(extensionDir: string): ExtensionManifest | null;
+/**
+ * Given an entry path (e.g. `.../extensions/browser-tools/index.ts`),
+ * resolve the parent directory and read its manifest.
+ */
+export declare function readManifestFromEntryPath(entryPath: string): ExtensionManifest | null;
+/** Scan all subdirectories of extensionsDir for manifests. Returns a Map<id, manifest>. */
+export declare function discoverAllManifests(extensionsDir: string): Map<string, ExtensionManifest>;
+/**
+ * Auto-populate registry entries for newly discovered extensions.
+ * Extensions already in the registry are left untouched.
+ */
+export declare function ensureRegistryEntries(extensionsDir: string): void;

package/dist/extension-registry.js

@@ -0,0 +1,166 @@
+/**
+ * Extension Registry — manages manifest reading, registry persistence, and enable/disable state.
+ *
+ * Extensions without manifests always load (backwards compatible).
+ * A fresh install has an empty registry — all extensions enabled by default.
+ * The only way an extension stops loading is an explicit `gsd extensions disable <id>`.
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+// ─── Validation ─────────────────────────────────────────────────────────────
+function isRegistry(data) {
+    if (typeof data !== "object" || data === null)
+        return false;
+    const obj = data;
+    return obj.version === 1 && typeof obj.entries === "object" && obj.entries !== null;
+}
+function isManifest(data) {
+    if (typeof data !== "object" || data === null)
+        return false;
+    const obj = data;
+    return (typeof obj.id === "string" &&
+        typeof obj.name === "string" &&
+        typeof obj.version === "string" &&
+        typeof obj.tier === "string");
+}
+// ─── Registry Path ──────────────────────────────────────────────────────────
+export function getRegistryPath() {
+    return join(homedir(), ".gsd", "extensions", "registry.json");
+}
+// ─── Registry I/O ───────────────────────────────────────────────────────────
+function defaultRegistry() {
+    return { version: 1, entries: {} };
+}
+export function loadRegistry() {
+    const filePath = getRegistryPath();
+    try {
+        if (!existsSync(filePath))
+            return defaultRegistry();
+        const raw = readFileSync(filePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        return isRegistry(parsed) ? parsed : defaultRegistry();
+    }
+    catch {
+        return defaultRegistry();
+    }
+}
+export function saveRegistry(registry) {
+    const filePath = getRegistryPath();
+    try {
+        mkdirSync(dirname(filePath), { recursive: true });
+        const tmp = filePath + ".tmp";
+        writeFileSync(tmp, JSON.stringify(registry, null, 2), "utf-8");
+        renameSync(tmp, filePath);
+    }
+    catch {
+        // Non-fatal — don't let persistence failures break operation
+    }
+}
+// ─── Query ──────────────────────────────────────────────────────────────────
+/** Returns true if the extension is enabled (missing entries default to enabled). */
+export function isExtensionEnabled(registry, id) {
+    const entry = registry.entries[id];
+    if (!entry)
+        return true;
+    return entry.enabled;
+}
+// ─── Mutations ──────────────────────────────────────────────────────────────
+export function enableExtension(registry, id) {
+    const entry = registry.entries[id];
+    if (entry) {
+        entry.enabled = true;
+        delete entry.disabledAt;
+        delete entry.disabledReason;
+    }
+    else {
+        registry.entries[id] = { id, enabled: true, source: "bundled" };
+    }
+}
+/**
+ * Disable an extension. Returns an error string if the extension is core (cannot disable),
+ * or null on success.
+ */
+export function disableExtension(registry, id, manifest, reason) {
+    if (manifest?.tier === "core") {
+        return `Cannot disable "${id}" — it is a core extension.`;
+    }
+    const entry = registry.entries[id];
+    if (entry) {
+        entry.enabled = false;
+        entry.disabledAt = new Date().toISOString();
+        entry.disabledReason = reason;
+    }
+    else {
+        registry.entries[id] = {
+            id,
+            enabled: false,
+            source: "bundled",
+            disabledAt: new Date().toISOString(),
+            disabledReason: reason,
+        };
+    }
+    return null;
+}
+// ─── Manifest Reading ───────────────────────────────────────────────────────
+/** Read extension-manifest.json from a directory. Returns null if missing or invalid. */
+export function readManifest(extensionDir) {
+    const manifestPath = join(extensionDir, "extension-manifest.json");
+    if (!existsSync(manifestPath))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(manifestPath, "utf-8"));
+        return isManifest(raw) ? raw : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Given an entry path (e.g. `.../extensions/browser-tools/index.ts`),
+ * resolve the parent directory and read its manifest.
+ */
+export function readManifestFromEntryPath(entryPath) {
+    const dir = dirname(entryPath);
+    return readManifest(dir);
+}
+// ─── Discovery ──────────────────────────────────────────────────────────────
+/** Scan all subdirectories of extensionsDir for manifests. Returns a Map<id, manifest>. */
+export function discoverAllManifests(extensionsDir) {
+    const manifests = new Map();
+    if (!existsSync(extensionsDir))
+        return manifests;
+    for (const entry of readdirSync(extensionsDir, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const manifest = readManifest(join(extensionsDir, entry.name));
+        if (manifest) {
+            manifests.set(manifest.id, manifest);
+        }
+    }
+    return manifests;
+}
+/**
+ * Auto-populate registry entries for newly discovered extensions.
+ * Extensions already in the registry are left untouched.
+ */
+export function ensureRegistryEntries(extensionsDir) {
+    const manifests = discoverAllManifests(extensionsDir);
+    if (manifests.size === 0)
+        return;
+    const registry = loadRegistry();
+    let changed = false;
+    for (const [id, manifest] of manifests) {
+        if (!registry.entries[id]) {
+            registry.entries[id] = {
+                id,
+                enabled: true,
+                source: "bundled",
+            };
+            changed = true;
+        }
+    }
+    if (changed) {
+        saveRegistry(registry);
+    }
+}

package/dist/headless.js

@@ -128,6 +128,10 @@ async function runHeadlessOnce(options, restartCount) {
     let interrupted = false;
     const startTime = Date.now();
     const isNewMilestone = options.command === 'new-milestone';
+    // new-milestone involves codebase investigation + artifact writing — needs more time
+    if (isNewMilestone && options.timeout === 300_000) {
+        options.timeout = 600_000; // 10 minutes
+    }
     // Supervised mode cannot share stdin with --context -
     if (options.supervised && options.context === '-') {
         process.stderr.write('[headless] Error: --supervised cannot be used with --context - (both require stdin)\n');

package/dist/help-text.js

@@ -29,6 +29,37 @@ const SUBCOMMAND_HELP = {
         '',
         'Compare with --continue (-c) which always resumes the most recent session.',
     ].join('\n'),
+    worktree: [
+        'Usage: gsd worktree <command> [args]',
+        '',
+        'Manage isolated git worktrees for parallel work streams.',
+        '',
+        'Commands:',
+        '  list                 List worktrees with status (files changed, commits, dirty)',
+        '  merge [name]         Squash-merge a worktree into main and clean up',
+        '  clean                Remove all worktrees that have been merged or are empty',
+        '  remove <name>        Remove a worktree (--force to remove with unmerged changes)',
+        '',
+        'The -w flag creates/resumes worktrees for interactive sessions:',
+        '  gsd -w               Auto-name a new worktree, or resume the only active one',
+        '  gsd -w my-feature    Create or resume a named worktree',
+        '',
+        'Lifecycle:',
+        '  1. gsd -w             Create worktree, start session inside it',
+        '  2. (work normally)    All changes happen on the worktree branch',
+        '  3. Ctrl+C             Exit — dirty work is auto-committed',
+        '  4. gsd -w             Resume where you left off',
+        '  5. gsd worktree merge Squash-merge into main when done',
+        '',
+        'Examples:',
+        '  gsd -w                              Start in a new auto-named worktree',
+        '  gsd -w auth-refactor                Create/resume "auth-refactor" worktree',
+        '  gsd worktree list                   See all worktrees and their status',
+        '  gsd worktree merge auth-refactor    Merge and clean up',
+        '  gsd worktree clean                  Remove all merged/empty worktrees',
+        '  gsd worktree remove old-branch      Remove a specific worktree',
+        '  gsd worktree remove old-branch --force  Remove even with unmerged changes',
+    ].join('\n'),
     headless: [
         'Usage: gsd headless [flags] [command] [args...]',
         '',
@@ -72,6 +103,8 @@ const SUBCOMMAND_HELP = {
         'Exit codes: 0 = complete, 1 = error/timeout, 2 = blocked',
     ].join('\n'),
 };
+// Alias: `gsd wt --help` → same as `gsd worktree --help`
+SUBCOMMAND_HELP['wt'] = SUBCOMMAND_HELP['worktree'];
 export function printHelp(version) {
     process.stdout.write(`GSD v${version} — Get Shit Done\n\n`);
     process.stdout.write('Usage: gsd [options] [message...]\n\n');
@@ -79,6 +112,7 @@ export function printHelp(version) {
     process.stdout.write('  --mode <text|json|rpc|mcp> Output mode (default: interactive)\n');
     process.stdout.write('  --print, -p              Single-shot print mode\n');
     process.stdout.write('  --continue, -c           Resume the most recent session\n');
+    process.stdout.write('  --worktree, -w [name]    Start in an isolated worktree (auto-named if omitted)\n');
     process.stdout.write('  --model <id>             Override model (e.g. claude-opus-4-6)\n');
     process.stdout.write('  --no-session             Disable session persistence\n');
     process.stdout.write('  --extension <path>       Load additional extension\n');
@@ -90,6 +124,7 @@ export function printHelp(version) {
     process.stdout.write('  config                   Re-run the setup wizard\n');
     process.stdout.write('  update                   Update GSD to the latest version\n');
     process.stdout.write('  sessions                 List and resume a past session\n');
+    process.stdout.write('  worktree <cmd>           Manage worktrees (list, merge, clean, remove)\n');
     process.stdout.write('  headless [cmd] [args]    Run /gsd commands without TUI (default: auto)\n');
     process.stdout.write('\nRun gsd <subcommand> --help for subcommand-specific help.\n');
 }

package/dist/loader.js

@@ -29,6 +29,7 @@ if (firstArg === '--help' || firstArg === '-h') {
 import { agentDir, appRoot } from './app-paths.js';
 import { serializeBundledExtensionPaths } from './bundled-extension-paths.js';
 import { discoverExtensionEntryPaths } from './extension-discovery.js';
+import { loadRegistry, readManifestFromEntryPath, isExtensionEnabled } from './extension-registry.js';
 import { renderLogo } from './logo.js';
 // pkg/ is a shim directory: contains gsd's piConfig (package.json) and pi's
 // theme assets (dist/modes/interactive/theme/) without a src/ directory.
@@ -86,7 +87,15 @@ process.env.GSD_WORKFLOW_PATH = join(resourcesDir, 'GSD-WORKFLOW.md');
 // where initResources() will sync them.
 const bundledExtDir = join(resourcesDir, 'extensions');
 const agentExtDir = join(agentDir, 'extensions');
-const discoveredExtensionPaths = discoverExtensionEntryPaths(bundledExtDir).map((entryPath) => join(agentExtDir, relative(bundledExtDir, entryPath)));
+const registry = loadRegistry();
+const discoveredExtensionPaths = discoverExtensionEntryPaths(bundledExtDir)
+    .map((entryPath) => join(agentExtDir, relative(bundledExtDir, entryPath)))
+    .filter((entryPath) => {
+    const manifest = readManifestFromEntryPath(entryPath);
+    if (!manifest)
+        return true; // no manifest = always load
+    return isExtensionEnabled(registry, manifest.id);
+});
 process.env.GSD_BUNDLED_EXTENSION_PATHS = serializeBundledExtensionPaths(discoveredExtensionPaths);
 // Respect HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars for all outbound requests.
 // pi-coding-agent's cli.ts sets this, but GSD bypasses that entry point — so we

package/dist/resource-loader.js

@@ -6,6 +6,7 @@ import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { compareSemver } from './update-check.js';
 import { discoverExtensionEntryPaths } from './extension-discovery.js';
+import { loadRegistry, readManifestFromEntryPath, isExtensionEnabled, ensureRegistryEntries } from './extension-registry.js';
 // Resolve resources directory — prefer dist/resources/ (stable, set at build time)
 // over src/resources/ (live working tree, changes with git branch).
 //
@@ -218,6 +219,7 @@ export function initResources(agentDir) {
     // overwrite them (covers extensions, agents, and skills in one walk).
     makeTreeWritable(agentDir);
     writeManagedResourceManifest(agentDir);
+    ensureRegistryEntries(join(agentDir, 'extensions'));
 }
 /**
  * Constructs a DefaultResourceLoader that loads extensions from both
@@ -234,10 +236,18 @@ function getBundledExtensionKeys() {
     return _bundledExtensionKeys;
 }
 export function buildResourceLoader(agentDir) {
+    const registry = loadRegistry();
     const piAgentDir = join(homedir(), '.pi', 'agent');
     const piExtensionsDir = join(piAgentDir, 'extensions');
     const bundledKeys = getBundledExtensionKeys();
-    const piExtensionPaths = discoverExtensionEntryPaths(piExtensionsDir).filter((entryPath) => !bundledKeys.has(getExtensionKey(entryPath, piExtensionsDir)));
+    const piExtensionPaths = discoverExtensionEntryPaths(piExtensionsDir)
+        .filter((entryPath) => !bundledKeys.has(getExtensionKey(entryPath, piExtensionsDir)))
+        .filter((entryPath) => {
+        const manifest = readManifestFromEntryPath(entryPath);
+        if (!manifest)
+            return true;
+        return isExtensionEnabled(registry, manifest.id);
+    });
     return new DefaultResourceLoader({
         agentDir,
         additionalExtensionPaths: piExtensionPaths,

package/dist/resources/extensions/async-jobs/extension-manifest.json

@@ -0,0 +1,13 @@
+{
+  "id": "async-jobs",
+  "name": "Async Jobs",
+  "version": "1.0.0",
+  "description": "Run bash commands in the background with job tracking and cancellation",
+  "tier": "bundled",
+  "requires": { "platform": ">=2.29.0" },
+  "provides": {
+    "tools": ["async_bash", "await_job", "cancel_job"],
+    "commands": ["jobs"],
+    "hooks": ["session_start"]
+  }
+}

package/dist/resources/extensions/bg-shell/extension-manifest.json

@@ -0,0 +1,14 @@
+{
+  "id": "bg-shell",
+  "name": "Background Shell",
+  "version": "1.0.0",
+  "description": "Run and manage background shell processes with interactive monitoring",
+  "tier": "bundled",
+  "requires": { "platform": ">=2.29.0" },
+  "provides": {
+    "tools": ["bg_shell"],
+    "commands": ["bg"],
+    "hooks": ["session_shutdown"],
+    "shortcuts": ["Ctrl+Alt+B"]
+  }
+}

package/dist/resources/extensions/bg-shell/process-manager.ts

@@ -375,6 +375,19 @@ export function cleanupAll(): void {
 	processes.clear();
 }
 
+/**
+ * Kill all alive, non-persistent bg processes.
+ * Called between auto-mode units to prevent orphaned servers from
+ * keeping ports bound across task boundaries (#1209).
+ */
+export function killSessionProcesses(): void {
+	for (const [id, bg] of processes) {
+		if (bg.alive && !bg.persistAcrossSessions) {
+			killProcess(id, "SIGTERM");
+		}
+	}
+}
+
 async function waitForProcessExit(bg: BgProcess, timeoutMs: number): Promise<boolean> {
 	if (!bg.alive) return true;
 	await new Promise<void>((resolve) => {

package/dist/resources/extensions/browser-tools/extension-manifest.json

@@ -0,0 +1,37 @@
+{
+  "id": "browser-tools",
+  "name": "Browser Tools",
+  "version": "1.0.0",
+  "description": "Playwright-based web automation, screenshots, and analysis",
+  "tier": "bundled",
+  "requires": { "platform": ">=2.29.0" },
+  "provides": {
+    "tools": [
+      "browser_navigate", "browser_go_back", "browser_go_forward", "browser_reload",
+      "browser_click", "browser_drag", "browser_type", "browser_upload_file",
+      "browser_scroll", "browser_hover", "browser_key_press", "browser_select_option",
+      "browser_set_checked", "browser_screenshot", "browser_wait_for",
+      "browser_get_console_logs", "browser_get_network_logs", "browser_get_dialog_logs",
+      "browser_evaluate", "browser_get_accessibility_tree", "browser_find",
+      "browser_get_page_source", "browser_close",
+      "browser_trace_start", "browser_trace_stop", "browser_export_har",
+      "browser_timeline", "browser_session_summary", "browser_debug_bundle",
+      "browser_assert", "browser_diff", "browser_batch",
+      "browser_snapshot_refs", "browser_get_ref", "browser_click_ref",
+      "browser_hover_ref", "browser_fill_ref",
+      "browser_list_pages", "browser_switch_page", "browser_close_page",
+      "browser_list_frames", "browser_select_frame",
+      "browser_analyze_form", "browser_fill_form",
+      "browser_find_best", "browser_act",
+      "browser_save_pdf", "browser_save_state", "browser_restore_state",
+      "browser_mock_route", "browser_block_urls", "browser_clear_routes",
+      "browser_emulate_device", "browser_extract",
+      "browser_visual_diff", "browser_zoom_region",
+      "browser_generate_test", "browser_action_cache", "browser_check_injection"
+    ],
+    "hooks": ["session_shutdown"]
+  },
+  "dependencies": {
+    "runtime": ["playwright"]
+  }
+}

package/dist/resources/extensions/context7/extension-manifest.json

@@ -0,0 +1,12 @@
+{
+  "id": "context7",
+  "name": "Context7",
+  "version": "1.0.0",
+  "description": "Fetch up-to-date library documentation and code examples from Context7",
+  "tier": "bundled",
+  "requires": { "platform": ">=2.29.0" },
+  "provides": {
+    "tools": ["resolve_library", "get_library_docs"],
+    "hooks": ["session_start"]
+  }
+}

package/dist/resources/extensions/google-search/extension-manifest.json

@@ -0,0 +1,12 @@
+{
+  "id": "google-search",
+  "name": "Google Search",
+  "version": "1.0.0",
+  "description": "Web search via Google with AI-synthesized answers and source citations",
+  "tier": "bundled",
+  "requires": { "platform": ">=2.29.0" },
+  "provides": {
+    "tools": ["google_search"],
+    "hooks": ["session_start"]
+  }
+}