gsd-pi 2.35.0-dev.55dcc60 → 2.35.0-dev.6179610

package/dist/resources/extensions/gsd/migrate-external.js

@@ -5,10 +5,11 @@
  * `~/.gsd/projects/<hash>/` state directory. After migration, a
  * symlink replaces the original directory so all paths remain valid.
  */
-import { existsSync, lstatSync, mkdirSync, readdirSync, renameSync, cpSync, rmSync, symlinkSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSync, cpSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 import { externalGsdRoot } from "./repo-identity.js";
 import { getErrorMessage } from "./error-utils.js";
+import { hasGitTrackedGsdFiles } from "./gitignore.js";
 /**
  * Migrate a legacy in-project `.gsd/` directory to external storage.
  *
@@ -42,6 +43,27 @@ export function migrateToExternalState(basePath) {
     catch (err) {
         return { migrated: false, error: `Cannot stat .gsd: ${getErrorMessage(err)}` };
     }
+    // Skip if .gsd/ contains git-tracked files — the project intentionally
+    // keeps .gsd/ in version control and migration would destroy that.
+    if (hasGitTrackedGsdFiles(basePath)) {
+        return { migrated: false };
+    }
+    // Skip if .gsd/worktrees/ has active worktree directories (#1337).
+    // On Windows, active git worktrees hold OS-level directory handles that
+    // prevent rename/delete. Attempting migration causes EBUSY and data loss.
+    const worktreesDir = join(localGsd, "worktrees");
+    if (existsSync(worktreesDir)) {
+        try {
+            const entries = readdirSync(worktreesDir, { withFileTypes: true });
+            if (entries.some(e => e.isDirectory())) {
+                return { migrated: false };
+            }
+        }
+        catch {
+            // Can't read worktrees dir — skip migration to be safe
+            return { migrated: false };
+        }
+    }
     const externalPath = externalGsdRoot(basePath);
     const migratingPath = join(basePath, ".gsd.migrating");
     try {
@@ -89,7 +111,38 @@ export function migrateToExternalState(basePath) {
         }
         // Create symlink .gsd -> external path
         symlinkSync(externalPath, localGsd, "junction");
-        // Remove .gsd.migrating
+        // Verify the symlink resolves correctly before removing the backup (#1377).
+        // On Windows, junction creation can silently succeed but resolve to the wrong
+        // target, or the external dir may not be accessible. If verification fails,
+        // restore from the backup.
+        try {
+            const resolved = realpathSync(localGsd);
+            const resolvedExternal = realpathSync(externalPath);
+            if (resolved !== resolvedExternal) {
+                // Symlink points to wrong target — restore backup
+                try {
+                    rmSync(localGsd, { force: true });
+                }
+                catch { /* may not exist */ }
+                renameSync(migratingPath, localGsd);
+                return { migrated: false, error: `Migration verification failed: symlink resolves to ${resolved}, expected ${resolvedExternal}` };
+            }
+            // Verify we can read through the symlink
+            readdirSync(localGsd);
+        }
+        catch (verifyErr) {
+            // Symlink broken or unreadable — restore backup
+            try {
+                rmSync(localGsd, { force: true });
+            }
+            catch { /* may not exist */ }
+            try {
+                renameSync(migratingPath, localGsd);
+            }
+            catch { /* best-effort restore */ }
+            return { migrated: false, error: `Migration verification failed: ${getErrorMessage(verifyErr)}` };
+        }
+        // Remove .gsd.migrating only after symlink is verified
         rmSync(migratingPath, { recursive: true, force: true });
         return { migrated: true };
     }

package/dist/resources/extensions/gsd/milestone-ids.js

@@ -67,8 +67,9 @@ export function findMilestoneIds(basePath) {
             .filter((d) => d.isDirectory())
             .map((d) => {
             const match = d.name.match(/^(M\d+(?:-[a-z0-9]{6})?)/);
-            return match ? match[1] : d.name;
-        });
+            return match ? match[1] : null;
+        })
+            .filter((id) => id !== null);
         // Apply custom queue order if available, else fall back to numeric sort
         const customOrder = loadQueueOrder(basePath);
         return sortByQueueOrder(ids, customOrder);

package/dist/resources/extensions/gsd/paths.js

@@ -9,7 +9,8 @@
  * via prefix matching, so existing projects work without migration.
  */
 import { readdirSync, existsSync, realpathSync, Dirent } from "node:fs";
-import { join } from "node:path";
+import { join, dirname, normalize } from "node:path";
+import { spawnSync } from "node:child_process";
 import { nativeScanGsdTree } from "./native-parser-bridge.js";
 import { DIR_CACHE_MAX } from "./constants.js";
 // ─── Directory Listing Cache ──────────────────────────────────────────────────
@@ -263,15 +264,81 @@ const LEGACY_GSD_ROOT_FILES = {
     OVERRIDES: "overrides.md",
     KNOWLEDGE: "knowledge.md",
 };
+// ─── GSD Root Discovery ───────────────────────────────────────────────────────
+const gsdRootCache = new Map();
+/** Exported for tests only — do not call in production code. */
+export function _clearGsdRootCache() {
+    gsdRootCache.clear();
+}
+/**
+ * Resolve the `.gsd` directory for a given project base path.
+ *
+ * Probe order:
+ *   1. basePath/.gsd         — fast path (common case)
+ *   2. git rev-parse root    — handles cwd-is-a-subdirectory
+ *   3. Walk up from basePath — handles moved .gsd in an ancestor (bounded by git root)
+ *   4. basePath/.gsd         — creation fallback (init scenario)
+ *
+ * Result is cached per basePath for the process lifetime.
+ */
 export function gsdRoot(basePath) {
-    const local = join(basePath, ".gsd");
+    const cached = gsdRootCache.get(basePath);
+    if (cached)
+        return cached;
+    const result = probeGsdRoot(basePath);
+    gsdRootCache.set(basePath, result);
+    return result;
+}
+function probeGsdRoot(rawBasePath) {
+    // 1. Fast path — check the input path directly
+    const local = join(rawBasePath, ".gsd");
+    if (existsSync(local))
+        return local;
+    // Resolve symlinks so path comparisons work correctly across platforms
+    // (e.g. macOS /var → /private/var). Use rawBasePath as fallback if not resolvable.
+    let basePath;
     try {
-        const resolved = realpathSync(local);
-        if (resolved !== local)
-            return resolved; // symlink resolved
+        basePath = realpathSync.native(rawBasePath);
+    }
+    catch {
+        basePath = rawBasePath;
+    }
+    // 2. Git root anchor — used as both probe target and walk-up boundary
+    //    Only walk if we're inside a git project — prevents escaping into
+    //    unrelated filesystem territory when running outside any repo.
+    let gitRoot = null;
+    try {
+        const out = spawnSync("git", ["rev-parse", "--show-toplevel"], {
+            cwd: basePath,
+            encoding: "utf-8",
+        });
+        if (out.status === 0) {
+            const r = out.stdout.trim();
+            if (r)
+                gitRoot = normalize(r);
+        }
+    }
+    catch { /* git not available */ }
+    if (gitRoot) {
+        const candidate = join(gitRoot, ".gsd");
+        if (existsSync(candidate))
+            return candidate;
+    }
+    // 3. Walk up from basePath to the git root (only if we are in a subdirectory)
+    if (gitRoot && basePath !== gitRoot) {
+        let cur = dirname(basePath);
+        while (cur !== basePath) {
+            const candidate = join(cur, ".gsd");
+            if (existsSync(candidate))
+                return candidate;
+            if (cur === gitRoot)
+                break;
+            basePath = cur;
+            cur = dirname(cur);
+        }
     }
-    catch { /* doesn't exist yet — fall through */ }
-    return local; // backwards compat: unmigrated projects
+    // 4. Fallback for init/creation
+    return local;
 }
 export function milestonesDir(basePath) {
     return join(gsdRoot(basePath), "milestones");

package/dist/resources/extensions/gsd/post-unit-hooks.js

@@ -111,10 +111,13 @@ function dequeueNextHook(basePath) {
         };
         // Build the prompt with variable substitution
         const [mid, sid, tid] = triggerUnitId.split("/");
-        const prompt = config.prompt
+        let prompt = config.prompt
             .replace(/\{milestoneId\}/g, mid ?? "")
             .replace(/\{sliceId\}/g, sid ?? "")
             .replace(/\{taskId\}/g, tid ?? "");
+        // Inject browser safety instruction for hooks that may use browser tools (#1345).
+        // Vite HMR and other persistent connections prevent networkidle from resolving.
+        prompt += "\n\n**Browser tool safety:** Do NOT use `browser_wait_for` with `condition: \"network_idle\"` — it hangs indefinitely when dev servers keep persistent connections (Vite HMR, WebSocket). Use `selector_visible`, `text_visible`, or `delay` instead.";
         return {
             hookName: config.name,
             prompt,

package/dist/resources/extensions/gsd/preferences-validation.js

@@ -14,9 +14,24 @@ export function validatePreferences(preferences) {
     const warnings = [];
     const validated = {};
     // ─── Unknown Key Detection ──────────────────────────────────────────
+    // Common key migration hints for pi-level settings that don't map to GSD prefs
+    const KEY_MIGRATION_HINTS = {
+        taskIsolation: 'use "git.isolation" instead (values: worktree, branch, none)',
+        task_isolation: 'use "git.isolation" instead (values: worktree, branch, none)',
+        isolation: 'use "git.isolation" instead (values: worktree, branch, none)',
+        manage_gitignore: 'use "git.manage_gitignore" instead',
+        auto_push: 'use "git.auto_push" instead',
+        main_branch: 'use "git.main_branch" instead',
+    };
     for (const key of Object.keys(preferences)) {
         if (!KNOWN_PREFERENCE_KEYS.has(key)) {
-            warnings.push(`unknown preference key "${key}" — ignored`);
+            const hint = KEY_MIGRATION_HINTS[key];
+            if (hint) {
+                warnings.push(`unknown preference key "${key}" — ${hint}`);
+            }
+            else {
+                warnings.push(`unknown preference key "${key}" — ignored`);
+            }
         }
     }
     if (preferences.version !== undefined) {

package/dist/resources/extensions/gsd/preferences.js

@@ -15,6 +15,7 @@ import { join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { parse as parseYaml } from "yaml";
 import { normalizeStringArray } from "../shared/mod.js";
+import { resolveProfileDefaults as _resolveProfileDefaults } from "./preferences-models.js";
 import { MODE_DEFAULTS, } from "./preferences-types.js";
 import { validatePreferences } from "./preferences-validation.js";
 import { formatSkillRef } from "./preferences-skills.js";
@@ -79,6 +80,17 @@ export function loadEffectiveGSDPreferences() {
             ...(mergedWarnings.length > 0 ? { warnings: mergedWarnings } : {}),
         };
     }
+    // Apply token-profile defaults as the lowest-priority layer so that
+    // `token_profile: budget` sets models and phase-skips automatically.
+    // Explicit user preferences always override profile defaults.
+    const profile = result.preferences.token_profile;
+    if (profile) {
+        const profileDefaults = _resolveProfileDefaults(profile);
+        result = {
+            ...result,
+            preferences: mergePreferences(profileDefaults, result.preferences),
+        };
+    }
     // Apply mode defaults as the lowest-priority layer
     if (result.preferences.mode) {
         result = {

package/dist/resources/extensions/gsd/prompts/complete-milestone.md

@@ -28,6 +28,8 @@ Then:
 
 **Important:** Do NOT skip the success criteria and definition of done verification (steps 3-4). The milestone summary must reflect actual verified outcomes, not assumed success. If any criterion was not met, document it clearly in the summary and do not mark the milestone as passing verification.
 
+**File system safety:** When scanning milestone directories for evidence, use `ls` or `find` to list directory contents first — never pass a directory path (e.g. `tasks/`, `slices/`) directly to the `read` tool. The `read` tool only accepts file paths, not directories.
+
 **You MUST write `{{milestoneSummaryPath}}` AND update PROJECT.md before finishing.**
 
 When done, say: "Milestone {{milestoneId}} complete."

package/dist/resources/extensions/gsd/prompts/validate-milestone.md

@@ -67,4 +67,6 @@ If verdict is `needs-remediation`:
 
 **You MUST write `{{validationPath}}` before finishing.**
 
+**File system safety:** When scanning milestone directories for evidence, use `ls` or `find` to list directory contents first — never pass a directory path (e.g. `tasks/`, `slices/`) directly to the `read` tool. The `read` tool only accepts file paths, not directories.
+
 When done, say: "Milestone {{milestoneId}} validation complete — verdict: <verdict>."

package/dist/resources/extensions/gsd/roadmap-mutations.js

@@ -0,0 +1,55 @@
+/**
+ * Roadmap Mutations — shared utilities for modifying roadmap checkbox state.
+ *
+ * Extracts the duplicated "flip slice checkbox" pattern that existed in
+ * doctor.ts, mechanical-completion.ts, and auto-recovery.ts.
+ */
+import { readFileSync } from "node:fs";
+import { atomicWriteSync } from "./atomic-write.js";
+import { resolveMilestoneFile } from "./paths.js";
+import { clearParseCache } from "./files.js";
+/**
+ * Mark a slice as done ([x]) in the milestone roadmap.
+ * Idempotent — no-op if already checked or if the slice isn't found.
+ *
+ * @returns true if the roadmap was modified, false if no change was needed
+ */
+export function markSliceDoneInRoadmap(basePath, mid, sid) {
+    const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
+    if (!roadmapFile)
+        return false;
+    let content;
+    try {
+        content = readFileSync(roadmapFile, "utf-8");
+    }
+    catch {
+        return false;
+    }
+    const updated = content.replace(new RegExp(`^(\\s*-\\s+)\\[ \\]\\s+\\*\\*${sid}:`, "m"), `$1[x] **${sid}:`);
+    if (updated === content)
+        return false;
+    atomicWriteSync(roadmapFile, updated);
+    clearParseCache();
+    return true;
+}
+/**
+ * Mark a task as done ([x]) in the slice plan.
+ * Idempotent — no-op if already checked or if the task isn't found.
+ *
+ * @returns true if the plan was modified, false if no change was needed
+ */
+export function markTaskDoneInPlan(basePath, planPath, tid) {
+    let content;
+    try {
+        content = readFileSync(planPath, "utf-8");
+    }
+    catch {
+        return false;
+    }
+    const updated = content.replace(new RegExp(`^(\\s*-\\s+)\\[ \\]\\s+\\*\\*${tid}:`, "m"), `$1[x] **${tid}:`);
+    if (updated === content)
+        return false;
+    atomicWriteSync(planPath, updated);
+    clearParseCache();
+    return true;
+}

package/dist/resources/extensions/gsd/session-lock.js

@@ -32,8 +32,17 @@ let _lockPid = 0;
 let _lockCompromised = false;
 /** Whether we've already registered a process.on('exit') handler. */
 let _exitHandlerRegistered = false;
+/** Snapshotted lock file path — captured at acquireSessionLock time to avoid
+ *  gsdRoot() resolving differently in worktree vs project root contexts (#1363). */
+let _snapshotLockPath = null;
+/** Timestamp when the session lock was acquired — used to detect false-positive
+ *  onCompromised events from event loop stalls within the stale window (#1362). */
+let _lockAcquiredAt = 0;
 const LOCK_FILE = "auto.lock";
 function lockPath(basePath) {
+    // If we have a snapshotted path from acquisition, use it for consistency
+    if (_snapshotLockPath)
+        return _snapshotLockPath;
     return join(gsdRoot(basePath), LOCK_FILE);
 }
 // ─── Stray Lock Cleanup ─────────────────────────────────────────────────────
@@ -175,8 +184,17 @@ export function acquireSessionLock(basePath) {
             onCompromised: () => {
                 // proper-lockfile detected mtime drift (system sleep, event loop stall, etc.).
                 // Default handler throws inside setTimeout — an uncaught exception that crashes
-                // or corrupts process state. Instead, set a flag so validateSessionLock() can
-                // detect the compromise gracefully on the next dispatch cycle.
+                // or corrupts process state.
+                //
+                // False-positive suppression (#1362): If we're still within the stale window
+                // (30 min since acquisition), the mtime mismatch is from an event loop stall
+                // during a long LLM call — not a real takeover. Log and continue.
+                const elapsed = Date.now() - _lockAcquiredAt;
+                if (elapsed < 1_800_000) {
+                    process.stderr.write(`[gsd] Lock heartbeat mismatch after ${Math.round(elapsed / 1000)}s — event loop stall, continuing.\n`);
+                    return; // Suppress false positive
+                }
+                // Past the stale window — this is a real compromise
                 _lockCompromised = true;
                 _releaseFunction = null;
             },
@@ -185,6 +203,8 @@ export function acquireSessionLock(basePath) {
         _lockedPath = basePath;
         _lockPid = process.pid;
         _lockCompromised = false;
+        _lockAcquiredAt = Date.now();
+        _snapshotLockPath = lp; // Snapshot the resolved path for consistent access (#1363)
         // Safety net: clean up lock dir on process exit if _releaseFunction
         // wasn't called (e.g., normal exit after clean completion) (#1245).
         ensureExitHandler(gsdDir);
@@ -211,6 +231,14 @@ export function acquireSessionLock(basePath) {
                     stale: 1_800_000, // 30 minutes — match primary lock settings
                     update: 10_000,
                     onCompromised: () => {
+                        // Same false-positive suppression as the primary lock (#1512).
+                        // Without this, the retry path fires _lockCompromised unconditionally
+                        // on benign mtime drift (laptop sleep, heavy LLM event loop stalls).
+                        const elapsed = Date.now() - _lockAcquiredAt;
+                        if (elapsed < 1_800_000) {
+                            process.stderr.write(`[gsd] Lock heartbeat mismatch after ${Math.round(elapsed / 1000)}s — event loop stall, continuing.\n`);
+                            return;
+                        }
                         _lockCompromised = true;
                         _releaseFunction = null;
                     },
@@ -219,6 +247,8 @@ export function acquireSessionLock(basePath) {
                 _lockedPath = basePath;
                 _lockPid = process.pid;
                 _lockCompromised = false;
+                _lockAcquiredAt = Date.now();
+                _snapshotLockPath = lp; // Snapshot for retry path too (#1363)
                 // Safety net — uses centralized handler to avoid double-registration
                 ensureExitHandler(gsdDir);
                 atomicWriteSync(lp, JSON.stringify(lockData, null, 2));
@@ -293,6 +323,25 @@ export function updateSessionLock(basePath, unitType, unitId, completedUnits, se
 export function validateSessionLock(basePath) {
     // Lock was compromised by proper-lockfile (mtime drift from sleep, stall, etc.)
     if (_lockCompromised) {
+        // Recovery gate (#1512): Before declaring the lock lost, check if the lock
+        // file still contains our PID. If it does, no other process took over — the
+        // onCompromised fired from benign mtime drift (laptop sleep, event loop stall
+        // beyond the stale window). Attempt re-acquisition instead of giving up.
+        const lp = lockPath(basePath);
+        const existing = readExistingLockData(lp);
+        if (existing && existing.pid === process.pid) {
+            // Lock file still ours — try to re-acquire the OS lock
+            try {
+                const result = acquireSessionLock(basePath);
+                if (result.acquired) {
+                    process.stderr.write(`[gsd] Lock recovered after onCompromised — lock file PID matched, re-acquired.\n`);
+                    return true;
+                }
+            }
+            catch {
+                // Re-acquisition failed — fall through to return false
+            }
+        }
         return false;
     }
     // If we have an OS-level lock, we're still the owner
@@ -348,6 +397,8 @@ export function releaseSessionLock(basePath) {
     _lockedPath = null;
     _lockPid = 0;
     _lockCompromised = false;
+    _lockAcquiredAt = 0;
+    _snapshotLockPath = null;
 }
 /**
  * Check if a session lock exists and return its data (for crash recovery).

package/dist/resources/extensions/gsd/state.js

@@ -33,11 +33,12 @@ export function isValidationTerminal(validationContent) {
     const verdict = match[1].match(/verdict:\s*(\S+)/);
     if (!verdict)
         return false;
+    const v = verdict[1] === 'passed' ? 'pass' : verdict[1];
     // 'pass' and 'needs-attention' are always terminal.
     // 'needs-remediation' is treated as terminal to prevent infinite loops
     // when no remediation slices exist in the roadmap (#832). The validation
     // report is preserved on disk for manual review.
-    return verdict[1] === 'pass' || verdict[1] === 'needs-attention' || verdict[1] === 'needs-remediation';
+    return v === 'pass' || v === 'needs-attention' || v === 'needs-remediation';
 }
 const CACHE_TTL_MS = 100;
 let _stateCache = null;

package/dist/resources/extensions/gsd/templates/plan.md

@@ -113,6 +113,14 @@
   - Tasks execute sequentially in order (T01, T02, T03, ...)
   - est: is informational (e.g. 30m, 1h, 2h) and optional
 
+  Verify field rules:
+  - MUST be a mechanically executable command: `npm test`, `grep -q "pattern" file`, `test -f path`
+  - For content/document tasks: verify file existence, section count, YAML validity, or word count
+    NOT exact phrasing, specific formulas, or "zero TBD" aspirational criteria
+  - If no command can verify the output, write: "Manual review — file exists and is non-empty"
+  - BAD: "Sections 3.1 and 3.2 exist with exact formulas. Zero TBD/TODO."
+  - GOOD: `grep -c "^## " doc.md` returns >= 4 (4+ sections), `! grep -q "TBD\|TODO" doc.md`
+
   Integration closure rule:
   - At least one slice in any multi-boundary milestone should perform real composition/wiring, not just contract hardening
   - For the final assembly slice, verification must exercise the real entrypoint or runtime path

package/dist/resources/extensions/gsd/worktree-resolver.js

@@ -12,6 +12,8 @@
  * Key invariant: `createAutoWorktree()` and `enterAutoWorktree()` call
  * `process.chdir()` internally — this class MUST NOT double-chdir.
  */
+import { existsSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
 import { debugLog } from "./debug-logger.js";
 // ─── WorktreeResolver ──────────────────────────────────────────────────────
 export class WorktreeResolver {
@@ -253,6 +255,16 @@ export class WorktreeResolver {
                 fallback: "chdir-to-project-root",
             });
             ctx.notify(`Milestone merge failed: ${msg}`, "warning");
+            // Clean up stale merge state left by failed squash-merge (#1389)
+            try {
+                const gitDir = join(originalBase || this.s.basePath, ".git");
+                for (const f of ["SQUASH_MSG", "MERGE_HEAD", "MERGE_MSG"]) {
+                    const p = join(gitDir, f);
+                    if (existsSync(p))
+                        unlinkSync(p);
+                }
+            }
+            catch { /* best-effort */ }
             // Error recovery: always restore to project root
             if (originalBase) {
                 try {

package/dist/resources/extensions/remote-questions/remote-command.js

@@ -2,12 +2,12 @@
  * Remote Questions — /gsd remote command
  */
 import { AuthStorage } from "@gsd/pi-coding-agent";
-import { CURSOR_MARKER, Editor, Key, matchesKey, truncateToWidth } from "@gsd/pi-tui";
+import { Editor, Key, matchesKey, truncateToWidth } from "@gsd/pi-tui";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { getGlobalGSDPreferencesPath, loadEffectiveGSDPreferences } from "../gsd/preferences.js";
 import { getRemoteConfigStatus, isValidChannelId, resolveRemoteConfig } from "./config.js";
-import { sanitizeError } from "../shared/sanitize.js";
+import { maskEditorLine, sanitizeError } from "../shared/mod.js";
 import { getLatestPromptSummary } from "./status.js";
 export async function handleRemote(subcommand, ctx, _pi) {
     const trimmed = subcommand.trim();
@@ -339,26 +339,6 @@ function removeRemoteQuestionsConfig() {
     const next = frontmatter ? `---\n${frontmatter}\n---${content.slice(fmMatch[0].length)}` : content.slice(fmMatch[0].length).replace(/^\n+/, "");
     writeFileSync(prefsPath, next, "utf-8");
 }
-function maskEditorLine(line) {
-    let output = "";
-    let i = 0;
-    while (i < line.length) {
-        if (line.startsWith(CURSOR_MARKER, i)) {
-            output += CURSOR_MARKER;
-            i += CURSOR_MARKER.length;
-            continue;
-        }
-        const ansiMatch = /^\x1b\[[0-9;]*m/.exec(line.slice(i));
-        if (ansiMatch) {
-            output += ansiMatch[0];
-            i += ansiMatch[0].length;
-            continue;
-        }
-        output += line[i] === " " ? " " : "*";
-        i += 1;
-    }
-    return output;
-}
 async function promptMaskedInput(ctx, label, hint) {
     if (!ctx.hasUI)
         return null;

package/dist/resources/extensions/shared/mod.js

@@ -6,6 +6,6 @@ export { toPosixPath } from "./path-display.js";
 export { showInterviewRound } from "./interview-ui.js";
 export { showNextAction } from "./next-action-ui.js";
 export { showConfirm } from "./confirm-ui.js";
-export { sanitizeError } from "./sanitize.js";
+export { sanitizeError, maskEditorLine } from "./sanitize.js";
 export { formatDateShort, truncateWithEllipsis } from "./format-utils.js";
 export { splitFrontmatter, parseFrontmatterMap } from "./frontmatter.js";

package/dist/resources/extensions/shared/sanitize.js

@@ -1,6 +1,8 @@
 /**
  * Sanitize error messages by redacting token-like strings before surfacing.
+ * Also provides maskEditorLine for masking sensitive TUI editor input.
  */
+import { CURSOR_MARKER } from "@gsd/pi-tui";
 const TOKEN_PATTERNS = [
     /xoxb-[A-Za-z0-9\-]+/g, // Slack bot tokens
     /xoxp-[A-Za-z0-9\-]+/g, // Slack user tokens
@@ -15,3 +17,31 @@ export function sanitizeError(msg) {
     }
     return sanitized;
 }
+/**
+ * Replace editor visible text with masked characters while preserving
+ * ANSI cursor/sequencer codes. Keeps border/metadata lines readable.
+ */
+export function maskEditorLine(line) {
+    if (line.startsWith("─")) {
+        return line;
+    }
+    let output = "";
+    let i = 0;
+    while (i < line.length) {
+        if (line.startsWith(CURSOR_MARKER, i)) {
+            output += CURSOR_MARKER;
+            i += CURSOR_MARKER.length;
+            continue;
+        }
+        const ansiMatch = /^\x1b\[[0-9;]*m/.exec(line.slice(i));
+        if (ansiMatch) {
+            output += ansiMatch[0];
+            i += ansiMatch[0].length;
+            continue;
+        }
+        const ch = line[i];
+        output += ch === " " ? " " : "*";
+        i += 1;
+    }
+    return output;
+}

package/dist/resources/extensions/subagent/index.js

@@ -20,6 +20,7 @@ import { StringEnum } from "@gsd/pi-ai";
 import { getMarkdownTheme } from "@gsd/pi-coding-agent";
 import { Container, Markdown, Spacer, Text } from "@gsd/pi-tui";
 import { Type } from "@sinclair/typebox";
+import { formatTokenCount } from "../shared/mod.js";
 import { discoverAgents } from "./agents.js";
 import { createIsolation, mergeDeltaPatches, readIsolationMode, } from "./isolation.js";
 import { registerWorker, updateWorker } from "./worker-registry.js";
@@ -58,31 +59,22 @@ async function stopLiveSubagents() {
         }
     }
 }
-function formatTokens(count) {
-    if (count < 1000)
-        return count.toString();
-    if (count < 10000)
-        return `${(count / 1000).toFixed(1)}k`;
-    if (count < 1000000)
-        return `${Math.round(count / 1000)}k`;
-    return `${(count / 1000000).toFixed(1)}M`;
-}
 function formatUsageStats(usage, model) {
     const parts = [];
     if (usage.turns)
         parts.push(`${usage.turns} turn${usage.turns > 1 ? "s" : ""}`);
     if (usage.input)
-        parts.push(`↑${formatTokens(usage.input)}`);
+        parts.push(`↑${formatTokenCount(usage.input)}`);
     if (usage.output)
-        parts.push(`↓${formatTokens(usage.output)}`);
+        parts.push(`↓${formatTokenCount(usage.output)}`);
     if (usage.cacheRead)
-        parts.push(`R${formatTokens(usage.cacheRead)}`);
+        parts.push(`R${formatTokenCount(usage.cacheRead)}`);
     if (usage.cacheWrite)
-        parts.push(`W${formatTokens(usage.cacheWrite)}`);
+        parts.push(`W${formatTokenCount(usage.cacheWrite)}`);
     if (usage.cost)
         parts.push(`$${(Number(usage.cost) || 0).toFixed(4)}`);
     if (usage.contextTokens && usage.contextTokens > 0) {
-        parts.push(`ctx:${formatTokens(usage.contextTokens)}`);
+        parts.push(`ctx:${formatTokenCount(usage.contextTokens)}`);
     }
     if (model)
         parts.push(model);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-pi",
-  "version": "2.35.0-dev.55dcc60",
+  "version": "2.35.0-dev.6179610",
   "description": "GSD — Get Shit Done coding agent",
   "license": "MIT",
   "repository": {
@@ -50,6 +50,7 @@
     "copy-themes": "node scripts/copy-themes.cjs",
     "copy-export-html": "node scripts/copy-export-html.cjs",
     "test:unit": "node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/resources/extensions/gsd/tests/*.test.ts src/resources/extensions/gsd/tests/*.test.mjs src/tests/*.test.ts",
+    "test:marketplace": "GSD_TEST_CLONE_MARKETPLACES=1 node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/resources/extensions/gsd/tests/claude-import-tui.test.ts src/resources/extensions/gsd/tests/plugin-importer-live.test.ts src/tests/marketplace-discovery.test.ts",
     "test:coverage": "c8 --reporter=text --reporter=lcov --exclude='src/resources/extensions/gsd/tests/**' --exclude='src/tests/**' --exclude='scripts/**' --exclude='native/**' --exclude='node_modules/**' --check-coverage --statements=50 --lines=50 --branches=20 --functions=20 node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/resources/extensions/gsd/tests/*.test.ts src/resources/extensions/gsd/tests/*.test.mjs src/tests/*.test.ts",
     "test:integration": "node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/resources/extensions/gsd/tests/*integration*.test.ts src/tests/integration/*.test.ts",
     "test": "npm run test:unit && npm run test:integration",