gsd-pi 2.38.0-dev.96dc7fb → 2.38.0-dev.98b44dc

package/packages/pi-coding-agent/src/core/extensions/loader.ts

@@ -23,6 +23,12 @@ import * as _bundledYaml from "yaml";
 import * as _bundledMcpClient from "@modelcontextprotocol/sdk/client";
 import * as _bundledMcpStdio from "@modelcontextprotocol/sdk/client/stdio.js";
 import * as _bundledMcpStreamableHttp from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import * as _bundledMcpSse from "@modelcontextprotocol/sdk/client/sse.js";
+import * as _bundledMcpServer from "@modelcontextprotocol/sdk/server";
+import * as _bundledMcpServerStdio from "@modelcontextprotocol/sdk/server/stdio.js";
+import * as _bundledMcpServerSse from "@modelcontextprotocol/sdk/server/sse.js";
+import * as _bundledMcpServerStreamableHttp from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import * as _bundledMcpTypes from "@modelcontextprotocol/sdk/types.js";
 import { getAgentDir, isBunBinary } from "../../config.js";
 // NOTE: This import works because loader.ts exports are NOT re-exported from index.ts,
 // avoiding a circular dependency. Extensions can import from @gsd/pi-coding-agent.
@@ -44,8 +50,11 @@ import type {
 	ToolDefinition,
 } from "./types.js";
 
-/** Modules available to extensions via virtualModules (for compiled Bun binary) */
-const VIRTUAL_MODULES: Record<string, unknown> = {
+/**
+ * Statically imported modules for Bun binary virtualModules.
+ * Maps specifier -> module object for subpaths that must be available in compiled binaries.
+ */
+const STATIC_BUNDLED_MODULES: Record<string, unknown> = {
 	"@sinclair/typebox": _bundledTypebox,
 	"@gsd/pi-agent-core": _bundledPiAgentCore,
 	"@gsd/pi-tui": _bundledPiTui,
@@ -58,6 +67,17 @@ const VIRTUAL_MODULES: Record<string, unknown> = {
 	"@modelcontextprotocol/sdk/client/stdio.js": _bundledMcpStdio,
 	"@modelcontextprotocol/sdk/client/streamableHttp": _bundledMcpStreamableHttp,
 	"@modelcontextprotocol/sdk/client/streamableHttp.js": _bundledMcpStreamableHttp,
+	"@modelcontextprotocol/sdk/client/sse": _bundledMcpSse,
+	"@modelcontextprotocol/sdk/client/sse.js": _bundledMcpSse,
+	"@modelcontextprotocol/sdk/server": _bundledMcpServer,
+	"@modelcontextprotocol/sdk/server/stdio": _bundledMcpServerStdio,
+	"@modelcontextprotocol/sdk/server/stdio.js": _bundledMcpServerStdio,
+	"@modelcontextprotocol/sdk/server/sse": _bundledMcpServerSse,
+	"@modelcontextprotocol/sdk/server/sse.js": _bundledMcpServerSse,
+	"@modelcontextprotocol/sdk/server/streamableHttp": _bundledMcpServerStreamableHttp,
+	"@modelcontextprotocol/sdk/server/streamableHttp.js": _bundledMcpServerStreamableHttp,
+	"@modelcontextprotocol/sdk/types": _bundledMcpTypes,
+	"@modelcontextprotocol/sdk/types.js": _bundledMcpTypes,
 	// Aliases for external PI ecosystem packages that import from the original scope
 	"@mariozechner/pi-agent-core": _bundledPiAgentCore,
 	"@mariozechner/pi-tui": _bundledPiTui,
@@ -66,9 +86,198 @@ const VIRTUAL_MODULES: Record<string, unknown> = {
 	"@mariozechner/pi-coding-agent": _bundledPiCodingAgent,
 };
 
+/** Modules available to extensions via virtualModules (for compiled Bun binary) */
+const VIRTUAL_MODULES: Record<string, unknown> = { ...STATIC_BUNDLED_MODULES };
+
 const require = createRequire(import.meta.url);
 const EXTENSION_TIMING_ENABLED = process.env.GSD_STARTUP_TIMING === "1" || process.env.PI_TIMING === "1";
 
+/**
+ * Bundled npm packages whose subpath exports should be auto-resolved for extensions.
+ * Each package listed here will have its `exports` field read from package.json,
+ * and all subpath exports will be registered as jiti aliases (Node.js mode) so that
+ * extensions can import any standard subpath without hitting jiti's CJS double-resolve bug.
+ */
+const BUNDLED_PACKAGES_WITH_EXPORTS = [
+	"@modelcontextprotocol/sdk",
+	"yaml",
+];
+
+/**
+ * Read a package's `exports` field and return alias entries mapping
+ * specifiers (e.g. `@modelcontextprotocol/sdk/server`) to resolved file paths.
+ *
+ * Handles:
+ * - Explicit subpath exports: `./client` -> `@pkg/client`
+ * - Wildcard exports (`./*`): scans the package's dist directory for actual files
+ * - Both `.js`-suffixed and bare specifiers for each subpath
+ */
+function resolveSubpathExports(packageName: string): Record<string, string> {
+	const aliases: Record<string, string> = {};
+
+	let packageJsonPath: string;
+	try {
+		// Resolve the package's root directory via its package.json
+		packageJsonPath = require.resolve(`${packageName}/package.json`);
+	} catch {
+		// Package doesn't allow importing package.json via exports — find it manually
+		try {
+			const anyEntry = require.resolve(packageName);
+			// Walk up from the resolved entry to find package.json
+			let dir = path.dirname(anyEntry);
+			while (dir !== path.dirname(dir)) {
+				const candidate = path.join(dir, "package.json");
+				if (fs.existsSync(candidate)) {
+					try {
+						const pkg = JSON.parse(fs.readFileSync(candidate, "utf-8"));
+						if (pkg.name === packageName) {
+							packageJsonPath = candidate;
+							break;
+						}
+					} catch {
+						// not valid JSON, keep walking
+					}
+				}
+				dir = path.dirname(dir);
+			}
+		} catch {
+			return aliases;
+		}
+		if (!packageJsonPath!) return aliases;
+	}
+
+	let pkg: { exports?: Record<string, unknown> };
+	try {
+		pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+	} catch {
+		return aliases;
+	}
+
+	const exports = pkg.exports;
+	if (!exports || typeof exports !== "object") return aliases;
+
+	const packageDir = path.dirname(packageJsonPath);
+
+	for (const [subpath, target] of Object.entries(exports)) {
+		if (subpath === ".") continue; // Root export handled by static imports
+
+		// Handle wildcard exports like "./*"
+		if (subpath.includes("*")) {
+			resolveWildcardExports(packageName, packageDir, subpath, target, aliases);
+			continue;
+		}
+
+		// Explicit subpath: "./client" -> "@pkg/client"
+		const specifier = `${packageName}/${subpath.replace(/^\.\//, "")}`;
+
+		try {
+			const resolved = require.resolve(specifier);
+			aliases[specifier] = resolved;
+
+			// Add .js-suffixed variant if the specifier doesn't already end in .js
+			if (!specifier.endsWith(".js")) {
+				const jsSpecifier = `${specifier}.js`;
+				try {
+					const jsResolved = require.resolve(jsSpecifier);
+					aliases[jsSpecifier] = jsResolved;
+				} catch {
+					// .js variant doesn't resolve — that's fine
+				}
+			}
+
+			// Add bare variant (without .js) if it ends in .js
+			if (specifier.endsWith(".js")) {
+				const bareSpecifier = specifier.slice(0, -3);
+				try {
+					const bareResolved = require.resolve(bareSpecifier);
+					aliases[bareSpecifier] = bareResolved;
+				} catch {
+					// bare variant doesn't resolve — that's fine
+				}
+			}
+		} catch {
+			// Subpath doesn't resolve — skip it
+		}
+	}
+
+	return aliases;
+}
+
+/**
+ * Resolve wildcard export patterns (e.g. `./*`) by scanning the package's
+ * file structure to find all matching files and generate alias entries.
+ */
+function resolveWildcardExports(
+	packageName: string,
+	packageDir: string,
+	subpathPattern: string,
+	target: unknown,
+	aliases: Record<string, string>,
+): void {
+	// Extract the target directory pattern from the export target
+	// e.g. { "require": "./dist/cjs/*" } -> "dist/cjs"
+	let targetDir: string | null = null;
+
+	if (typeof target === "string") {
+		targetDir = target.replace(/\/\*$/, "").replace(/^\.\//, "");
+	} else if (target && typeof target === "object") {
+		const targetObj = target as Record<string, unknown>;
+		// Prefer "require" for CJS compatibility with jiti, fall back to "import"
+		const resolved = targetObj.require ?? targetObj.import ?? targetObj.default;
+		if (typeof resolved === "string") {
+			targetDir = resolved.replace(/\/\*$/, "").replace(/^\.\//, "");
+		}
+	}
+
+	if (!targetDir) return;
+
+	const fullTargetDir = path.join(packageDir, targetDir);
+	if (!fs.existsSync(fullTargetDir)) return;
+
+	// Scan for .js files and generate specifiers
+	const subpathPrefix = subpathPattern.replace(/\/?\*$/, "").replace(/^\.\//, "");
+	scanDirForExports(packageName, fullTargetDir, subpathPrefix, aliases);
+}
+
+/**
+ * Recursively scan a directory for .js files and register them as aliases.
+ */
+function scanDirForExports(
+	packageName: string,
+	dir: string,
+	relativePath: string,
+	aliases: Record<string, string>,
+): void {
+	let entries: fs.Dirent[];
+	try {
+		entries = fs.readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+
+	for (const entry of entries) {
+		const entryRelative = relativePath ? `${relativePath}/${entry.name}` : entry.name;
+
+		if (entry.isDirectory()) {
+			// Skip examples/test directories — extensions don't need them
+			if (entry.name === "examples" || entry.name === "__tests__" || entry.name === "test") continue;
+			scanDirForExports(packageName, path.join(dir, entry.name), entryRelative, aliases);
+		} else if (entry.name.endsWith(".js") && !entry.name.endsWith(".d.js")) {
+			const filePath = path.join(dir, entry.name);
+			const specifier = `${packageName}/${entryRelative}`;
+			// Only add if not already covered by an explicit export
+			if (!(specifier in aliases)) {
+				aliases[specifier] = filePath;
+			}
+			// Also add bare (no .js) variant
+			const bareSpecifier = specifier.replace(/\.js$/, "");
+			if (!(bareSpecifier in aliases)) {
+				aliases[bareSpecifier] = filePath;
+			}
+		}
+	}
+}
+
 function logExtensionTiming(extensionPath: string, ms: number, outcome: "loaded" | "failed"): void {
 	if (!EXTENSION_TIMING_ENABLED) return;
 	console.error(`[startup] extension ${outcome}: ${extensionPath} (${ms}ms)`);
@@ -100,7 +309,19 @@ function getAliases(): Record<string, string> {
 		return fileURLToPath(import.meta.resolve(specifier));
 	};
 
+	// Auto-discover subpath exports from bundled npm packages.
+	// This ensures extensions can import any standard subpath (e.g. @modelcontextprotocol/sdk/server)
+	// without hitting jiti's CJS double-resolve bug.
+	const autoDiscovered: Record<string, string> = {};
+	for (const packageName of BUNDLED_PACKAGES_WITH_EXPORTS) {
+		const subpathAliases = resolveSubpathExports(packageName);
+		Object.assign(autoDiscovered, subpathAliases);
+	}
+
 	_aliases = {
+		// Auto-discovered subpath exports (lowest priority — overridden by manual entries below)
+		...autoDiscovered,
+		// Manual entries for workspace packages and packages needing special resolution
 		"@gsd/pi-coding-agent": packageIndex,
 		"@gsd/pi-agent-core": resolveWorkspaceOrImport("agent/dist/index.js", "@gsd/pi-agent-core"),
 		"@gsd/pi-tui": resolveWorkspaceOrImport("tui/dist/index.js", "@gsd/pi-tui"),
@@ -108,11 +329,6 @@ function getAliases(): Record<string, string> {
 		"@gsd/pi-ai/oauth": resolveWorkspaceOrImport("ai/dist/oauth.js", "@gsd/pi-ai/oauth"),
 		"@sinclair/typebox": typeboxRoot,
 		"yaml": yamlRoot,
-		"@modelcontextprotocol/sdk/client": require.resolve("@modelcontextprotocol/sdk/client"),
-		"@modelcontextprotocol/sdk/client/stdio": require.resolve("@modelcontextprotocol/sdk/client/stdio.js"),
-		"@modelcontextprotocol/sdk/client/stdio.js": require.resolve("@modelcontextprotocol/sdk/client/stdio.js"),
-		"@modelcontextprotocol/sdk/client/streamableHttp": require.resolve("@modelcontextprotocol/sdk/client/streamableHttp.js"),
-		"@modelcontextprotocol/sdk/client/streamableHttp.js": require.resolve("@modelcontextprotocol/sdk/client/streamableHttp.js"),
 		// Aliases for external PI ecosystem packages that import from the original scope
 		"@mariozechner/pi-coding-agent": packageIndex,
 		"@mariozechner/pi-agent-core": resolveWorkspaceOrImport("agent/dist/index.js", "@gsd/pi-agent-core"),

package/packages/pi-coding-agent/src/core/skills.ts

@@ -81,6 +81,12 @@ export interface LoadSkillsResult {
 	diagnostics: ResourceDiagnostic[];
 }
 
+let loadedSkills: Skill[] = [];
+
+export function getLoadedSkills(): Skill[] {
+	return [...loadedSkills];
+}
+
 /**
  * Validate skill name per Agent Skills spec.
  * Returns array of validation error messages (empty if valid).
@@ -449,8 +455,10 @@ export function loadSkills(options: LoadSkillsOptions = {}): LoadSkillsResult {
 		}
 	}
 
+	loadedSkills = Array.from(skillMap.values());
+
 	return {
-		skills: Array.from(skillMap.values()),
+		skills: [...loadedSkills],
 		diagnostics: [...allDiagnostics, ...collisionDiagnostics],
 	};
 }

package/packages/pi-coding-agent/src/index.ts

@@ -213,6 +213,7 @@ export {
 // Skills
 export {
 	formatSkillsForPrompt,
+	getLoadedSkills,
 	type LoadSkillsFromDirOptions,
 	type LoadSkillsResult,
 	loadSkills,

package/src/resources/extensions/browser-tools/index.ts

@@ -33,6 +33,7 @@ async function registerBrowserTools(pi: ExtensionAPI): Promise<void> {
         codegen,
         actionCache,
         injectionDetection,
+        verify,
       ] = await Promise.all([
         importExtensionModule<typeof import("./lifecycle.js")>(import.meta.url, "./lifecycle.js"),
         importExtensionModule<typeof import("./capture.js")>(import.meta.url, "./capture.js"),
@@ -60,6 +61,7 @@ async function registerBrowserTools(pi: ExtensionAPI): Promise<void> {
         importExtensionModule<typeof import("./tools/codegen.js")>(import.meta.url, "./tools/codegen.js"),
         importExtensionModule<typeof import("./tools/action-cache.js")>(import.meta.url, "./tools/action-cache.js"),
         importExtensionModule<typeof import("./tools/injection-detect.js")>(import.meta.url, "./tools/injection-detect.js"),
+        importExtensionModule<typeof import("./tools/verify.js")>(import.meta.url, "./tools/verify.js"),
       ]);
 
       const deps = {
@@ -132,6 +134,7 @@ async function registerBrowserTools(pi: ExtensionAPI): Promise<void> {
       codegen.registerCodegenTools(pi, deps);
       actionCache.registerActionCacheTools(pi, deps);
       injectionDetection.registerInjectionDetectionTools(pi, deps);
+      verify.registerVerifyTools(pi, deps);
     })().catch((error) => {
       registrationPromise = null;
       throw error;

package/src/resources/extensions/browser-tools/tools/verify.ts

@@ -0,0 +1,117 @@
+import type { ExtensionAPI } from "@gsd/pi-coding-agent";
+import { Type } from "@sinclair/typebox";
+import type { ToolDeps } from "../state.js";
+
+export function registerVerifyTools(pi: ExtensionAPI, deps: ToolDeps): void {
+	pi.registerTool({
+		name: "browser_verify",
+		label: "Browser Verify",
+		description:
+			"Run a structured browser verification flow: navigate to a URL, run checks (element visibility, text content), capture screenshots as evidence, and return structured pass/fail results.",
+		promptGuidelines: [
+			"Use browser_verify for UAT verification flows that need structured evidence.",
+			"Each check produces a pass/fail result with captured evidence.",
+			"Prefer this over manual navigation + assertion sequences for verification tasks.",
+		],
+		parameters: Type.Object({
+			url: Type.String({ description: "URL to navigate to" }),
+			checks: Type.Array(
+				Type.Object({
+					description: Type.String({ description: "What this check verifies" }),
+					selector: Type.Optional(Type.String({ description: "CSS selector to check" })),
+					expectedText: Type.Optional(Type.String({ description: "Expected text content" })),
+					expectedVisible: Type.Optional(Type.Boolean({ description: "Whether element should be visible" })),
+					screenshot: Type.Optional(Type.Boolean({ description: "Capture screenshot as evidence" })),
+				}),
+				{ description: "Verification checks to run" },
+			),
+			timeout: Type.Optional(Type.Number({ description: "Navigation timeout in ms", default: 10000 })),
+		}),
+		async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
+			const startTime = Date.now();
+			const { page } = await deps.ensureBrowser();
+			const timeout = params.timeout ?? 10000;
+
+			try {
+				await page.goto(params.url, { waitUntil: "domcontentloaded", timeout });
+			} catch (navErr) {
+				const msg = navErr instanceof Error ? navErr.message : String(navErr);
+				return {
+					content: [{ type: "text" as const, text: `Navigation failed: ${msg}` }],
+					details: {
+						url: params.url,
+						passed: false,
+						checks: params.checks.map((c) => ({ description: c.description, passed: false, error: msg })),
+						duration: Date.now() - startTime,
+					},
+				};
+			}
+
+			const results: Array<{
+				description: string;
+				passed: boolean;
+				actual?: string;
+				evidence?: string;
+				error?: string;
+			}> = [];
+
+			for (const check of params.checks) {
+				try {
+					let passed = true;
+					let actual: string | undefined;
+					let evidence: string | undefined;
+
+					if (check.selector) {
+						const element = await page.$(check.selector);
+
+						if (check.expectedVisible !== undefined) {
+							const isVisible = element ? await element.isVisible() : false;
+							passed = isVisible === check.expectedVisible;
+							actual = `visible=${isVisible}`;
+						}
+
+						if (check.expectedText !== undefined && element) {
+							const text = await element.textContent();
+							passed = passed && (text?.includes(check.expectedText) ?? false);
+							actual = `text="${text?.slice(0, 200)}"`;
+						}
+
+						if (!element && (check.expectedVisible === true || check.expectedText)) {
+							passed = false;
+							actual = "element not found";
+						}
+					}
+
+					if (check.screenshot) {
+						try {
+							const buf = await page.screenshot({ type: "png" });
+							evidence = `screenshot captured (${buf.length} bytes)`;
+						} catch {
+							evidence = "screenshot failed";
+						}
+					}
+
+					results.push({ description: check.description, passed, actual, evidence });
+				} catch (checkErr) {
+					results.push({
+						description: check.description,
+						passed: false,
+						error: checkErr instanceof Error ? checkErr.message : String(checkErr),
+					});
+				}
+			}
+
+			const allPassed = results.every((r) => r.passed);
+			const summary = results.map((r) => `${r.passed ? "PASS" : "FAIL"}: ${r.description}${r.actual ? ` (${r.actual})` : ""}${r.error ? ` — ${r.error}` : ""}`).join("\n");
+			return {
+				content: [{ type: "text" as const, text: `Verification ${allPassed ? "PASSED" : "FAILED"} (${results.filter(r => r.passed).length}/${results.length})\n\n${summary}` }],
+				details: {
+					url: params.url,
+					passed: allPassed,
+					checks: results,
+					duration: Date.now() - startTime,
+				},
+			};
+		},
+	});
+}

package/src/resources/extensions/env-utils.ts

@@ -0,0 +1,31 @@
+// GSD Extension — Environment variable utilities
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+//
+// Pure utility for checking existing env keys in .env files and process.env.
+// Extracted from get-secrets-from-user.ts to avoid pulling in @gsd/pi-tui
+// when only env-checking is needed (e.g. from files.ts during report generation).
+
+import { readFile } from "node:fs/promises";
+
+/**
+ * Check which keys already exist in a .env file or process.env.
+ * Returns the subset of `keys` that are already set.
+ */
+export async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {
+	let fileContent = "";
+	try {
+		fileContent = await readFile(envFilePath, "utf8");
+	} catch {
+		// ENOENT or other read error — proceed with empty content
+	}
+
+	const existing: string[] = [];
+	for (const key of keys) {
+		const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		const regex = new RegExp(`^${escaped}\\s*=`, "m");
+		if (regex.test(fileContent) || key in process.env) {
+			existing.push(key);
+		}
+	}
+	return existing;
+}

package/src/resources/extensions/get-secrets-from-user.ts

@@ -67,30 +67,11 @@ async function writeEnvKey(filePath: string, key: string, value: string): Promis
 
 // ─── Exported utilities ───────────────────────────────────────────────────────
 
-/**
- * Check which keys already exist in the .env file or process.env.
- * Returns the subset of `keys` that are already set.
- * Handles ENOENT gracefully (still checks process.env).
- * Empty-string values count as existing.
- */
-export async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {
-	let fileContent = "";
-	try {
-		fileContent = await readFile(envFilePath, "utf8");
-	} catch {
-		// ENOENT or other read error — proceed with empty content
-	}
-
-	const existing: string[] = [];
-	for (const key of keys) {
-		const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-		const regex = new RegExp(`^${escaped}\\s*=`, "m");
-		if (regex.test(fileContent) || key in process.env) {
-			existing.push(key);
-		}
-	}
-	return existing;
-}
+// Re-export from env-utils.ts so existing consumers still work.
+// The implementation lives in env-utils.ts to avoid pulling @gsd/pi-tui
+// into modules that only need env-checking (e.g. files.ts during reports).
+import { checkExistingEnvKeys } from "./env-utils.js";
+export { checkExistingEnvKeys };
 
 /**
  * Detect the write destination based on project files in basePath.