gsd-pi 2.50.0 → 2.51.0-dev.7d435fe

package/src/resources/extensions/gsd/tools/plan-slice.ts

@@ -7,7 +7,6 @@ import {
   upsertSlicePlanning,
   upsertTaskPlanning,
   insertGateRow,
-  _getAdapter,
 } from "../gsd-db.js";
 import type { GateId } from "../types.js";
 import { invalidateStateCache } from "../state.js";
@@ -146,24 +145,33 @@ export async function handlePlanSlice(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  const parentMilestone = getMilestone(params.milestoneId);
-  if (!parentMilestone) {
-    return { error: `milestone not found: ${params.milestoneId}` };
-  }
-  if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
-    return { error: `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})` };
-  }
-
-  const parentSlice = getSlice(params.milestoneId, params.sliceId);
-  if (!parentSlice) {
-    return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-  }
-  if (parentSlice.status === "complete" || parentSlice.status === "done") {
-    return { error: `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first` };
-  }
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
 
   try {
     transaction(() => {
+      const parentMilestone = getMilestone(params.milestoneId);
+      if (!parentMilestone) {
+        guardError = `milestone not found: ${params.milestoneId}`;
+        return;
+      }
+      if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
+        guardError = `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})`;
+        return;
+      }
+
+      const parentSlice = getSlice(params.milestoneId, params.sliceId);
+      if (!parentSlice) {
+        guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+        return;
+      }
+      if (parentSlice.status === "complete" || parentSlice.status === "done") {
+        guardError = `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first`;
+        return;
+      }
+
       upsertSlicePlanning(params.milestoneId, params.sliceId, {
         goal: params.goal,
         successCriteria: params.successCriteria,
@@ -211,6 +219,10 @@ export async function handlePlanSlice(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   try {
     const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
     invalidateStateCache();

package/src/resources/extensions/gsd/tools/plan-task.ts

@@ -77,21 +77,29 @@ export async function handlePlanTask(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  const parentSlice = getSlice(params.milestoneId, params.sliceId);
-  if (!parentSlice) {
-    return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-  }
-  if (parentSlice.status === "complete" || parentSlice.status === "done") {
-    return { error: `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-  }
-
-  const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
-  if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
-    return { error: `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first` };
-  }
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
 
   try {
     transaction(() => {
+      const parentSlice = getSlice(params.milestoneId, params.sliceId);
+      if (!parentSlice) {
+        guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+        return;
+      }
+      if (parentSlice.status === "complete" || parentSlice.status === "done") {
+        guardError = `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+        return;
+      }
+
+      const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
+      if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
+        guardError = `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first`;
+        return;
+      }
+
       if (!existingTask) {
         insertTask({
           id: params.taskId,
@@ -117,6 +125,10 @@ export async function handlePlanTask(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   try {
     const renderResult = await renderTaskPlanFromDb(basePath, params.milestoneId, params.sliceId, params.taskId);
     invalidateStateCache();

package/src/resources/extensions/gsd/tools/reassess-roadmap.ts

@@ -104,47 +104,6 @@ export async function handleReassessRoadmap(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  // ── Verify milestone exists and is active ────────────────────────
-  const milestone = getMilestone(params.milestoneId);
-  if (!milestone) {
-    return { error: `milestone not found: ${params.milestoneId}` };
-  }
-  if (milestone.status === "complete" || milestone.status === "done") {
-    return { error: `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})` };
-  }
-
-  // ── Verify completedSliceId is actually complete ──────────────────
-  const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
-  if (!completedSlice) {
-    return { error: `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}` };
-  }
-  if (completedSlice.status !== "complete" && completedSlice.status !== "done") {
-    return { error: `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes` };
-  }
-
-  // ── Structural enforcement ────────────────────────────────────────
-  const existingSlices = getMilestoneSlices(params.milestoneId);
-  const completedSliceIds = new Set<string>();
-  for (const slice of existingSlices) {
-    if (slice.status === "complete" || slice.status === "done") {
-      completedSliceIds.add(slice.id);
-    }
-  }
-
-  // Reject modifications to completed slices
-  for (const modifiedSlice of params.sliceChanges.modified) {
-    if (completedSliceIds.has(modifiedSlice.sliceId)) {
-      return { error: `cannot modify completed slice ${modifiedSlice.sliceId}` };
-    }
-  }
-
-  // Reject removal of completed slices
-  for (const removedId of params.sliceChanges.removed) {
-    if (completedSliceIds.has(removedId)) {
-      return { error: `cannot remove completed slice ${removedId}` };
-    }
-  }
-
   // ── Compute assessment artifact path ──────────────────────────────
   // Assessment lives in the completed slice's directory
   const assessmentRelPath = join(
@@ -153,9 +112,58 @@ export async function handleReassessRoadmap(
     `${params.completedSliceId}-ASSESSMENT.md`,
   );
 
-  // ── Transaction: DB mutations ─────────────────────────────────────
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
+
   try {
     transaction(() => {
+      // Verify milestone exists and is active
+      const milestone = getMilestone(params.milestoneId);
+      if (!milestone) {
+        guardError = `milestone not found: ${params.milestoneId}`;
+        return;
+      }
+      if (milestone.status === "complete" || milestone.status === "done") {
+        guardError = `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+        return;
+      }
+
+      // Verify completedSliceId is actually complete
+      const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
+      if (!completedSlice) {
+        guardError = `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}`;
+        return;
+      }
+      if (completedSlice.status !== "complete" && completedSlice.status !== "done") {
+        guardError = `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes`;
+        return;
+      }
+
+      // Structural enforcement — reject modifications/removal of completed slices
+      const existingSlices = getMilestoneSlices(params.milestoneId);
+      const completedSliceIds = new Set<string>();
+      for (const slice of existingSlices) {
+        if (slice.status === "complete" || slice.status === "done") {
+          completedSliceIds.add(slice.id);
+        }
+      }
+
+      for (const modifiedSlice of params.sliceChanges.modified) {
+        if (completedSliceIds.has(modifiedSlice.sliceId)) {
+          guardError = `cannot modify completed slice ${modifiedSlice.sliceId}`;
+          return;
+        }
+      }
+
+      for (const removedId of params.sliceChanges.removed) {
+        if (completedSliceIds.has(removedId)) {
+          guardError = `cannot remove completed slice ${removedId}`;
+          return;
+        }
+      }
+
       // Record assessment
       insertAssessment({
         path: assessmentRelPath,
@@ -198,6 +206,10 @@ export async function handleReassessRoadmap(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   // ── Render artifacts ──────────────────────────────────────────────
   try {
     const roadmapResult = await renderRoadmapFromDb(basePath, params.milestoneId);

package/src/resources/extensions/gsd/tools/replan-slice.ts

@@ -90,52 +90,61 @@ export async function handleReplanSlice(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  // ── Verify parent slice exists and is not closed ─────────────────
-  const parentSlice = getSlice(params.milestoneId, params.sliceId);
-  if (!parentSlice) {
-    return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-  }
-  if (parentSlice.status === "complete" || parentSlice.status === "done") {
-    return { error: `cannot replan a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-  }
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
+  let existingTaskIds: Set<string> = new Set();
 
-  // ── Verify blocker task exists and is complete ────────────────────
-  const blockerTask = getTask(params.milestoneId, params.sliceId, params.blockerTaskId);
-  if (!blockerTask) {
-    return { error: `blockerTaskId not found: ${params.milestoneId}/${params.sliceId}/${params.blockerTaskId}` };
-  }
-  if (blockerTask.status !== "complete" && blockerTask.status !== "done") {
-    return { error: `blockerTaskId ${params.blockerTaskId} is not complete (status: ${blockerTask.status}) — the blocker task must be finished before a replan is triggered` };
-  }
+  try {
+    transaction(() => {
+      // Verify parent slice exists and is not closed
+      const parentSlice = getSlice(params.milestoneId, params.sliceId);
+      if (!parentSlice) {
+        guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+        return;
+      }
+      if (parentSlice.status === "complete" || parentSlice.status === "done") {
+        guardError = `cannot replan a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+        return;
+      }
 
-  // ── Structural enforcement ────────────────────────────────────────
-  const existingTasks = getSliceTasks(params.milestoneId, params.sliceId);
-  const completedTaskIds = new Set<string>();
-  for (const task of existingTasks) {
-    if (task.status === "complete" || task.status === "done") {
-      completedTaskIds.add(task.id);
-    }
-  }
+      // Verify blocker task exists and is complete
+      const blockerTask = getTask(params.milestoneId, params.sliceId, params.blockerTaskId);
+      if (!blockerTask) {
+        guardError = `blockerTaskId not found: ${params.milestoneId}/${params.sliceId}/${params.blockerTaskId}`;
+        return;
+      }
+      if (blockerTask.status !== "complete" && blockerTask.status !== "done") {
+        guardError = `blockerTaskId ${params.blockerTaskId} is not complete (status: ${blockerTask.status}) — the blocker task must be finished before a replan is triggered`;
+        return;
+      }
 
-  // Reject updates to completed tasks
-  for (const updatedTask of params.updatedTasks) {
-    if (completedTaskIds.has(updatedTask.taskId)) {
-      return { error: `cannot modify completed task ${updatedTask.taskId}` };
-    }
-  }
+      // Structural enforcement — reject modifications/removal of completed tasks
+      const existingTasks = getSliceTasks(params.milestoneId, params.sliceId);
+      const completedTaskIds = new Set<string>();
+      for (const task of existingTasks) {
+        if (task.status === "complete" || task.status === "done") {
+          completedTaskIds.add(task.id);
+        }
+      }
 
-  // Reject removal of completed tasks
-  for (const removedId of params.removedTaskIds) {
-    if (completedTaskIds.has(removedId)) {
-      return { error: `cannot remove completed task ${removedId}` };
-    }
-  }
+      for (const updatedTask of params.updatedTasks) {
+        if (completedTaskIds.has(updatedTask.taskId)) {
+          guardError = `cannot modify completed task ${updatedTask.taskId}`;
+          return;
+        }
+      }
+
+      for (const removedId of params.removedTaskIds) {
+        if (completedTaskIds.has(removedId)) {
+          guardError = `cannot remove completed task ${removedId}`;
+          return;
+        }
+      }
 
-  // ── Transaction: DB mutations ─────────────────────────────────────
-  const existingTaskIds = new Set(existingTasks.map((t) => t.id));
+      existingTaskIds = new Set(existingTasks.map((t) => t.id));
 
-  try {
-    transaction(() => {
       // Record replan history
       insertReplanHistory({
         milestoneId: params.milestoneId,
@@ -189,6 +198,10 @@ export async function handleReplanSlice(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   // ── Render artifacts ──────────────────────────────────────────────
   try {
     const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);

package/src/resources/extensions/gsd/tools/validate-milestone.ts

@@ -9,7 +9,8 @@ import { join } from "node:path";
 
 import {
   transaction,
-  _getAdapter,
+  insertAssessment,
+  deleteAssessmentByScope,
 } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -76,7 +77,7 @@ export async function handleValidateMilestone(
     return { error: `verdict must be one of: ${VALIDATION_VERDICTS.join(", ")}` };
   }
 
-  // ── Filesystem render ──────────────────────────────────────────────────
+  // ── Resolve paths and render markdown ────────────────────────────────
   const validationMd = renderValidationMarkdown(params);
 
   let validationPath: string;
@@ -89,32 +90,37 @@ export async function handleValidateMilestone(
     validationPath = join(manualDir, `${params.milestoneId}-VALIDATION.md`);
   }
 
+  // ── DB write first — matches complete-task/complete-slice pattern ───
+  // Write DB before disk so a crash between the two leaves a recoverable
+  // state: the DB row exists but the file is missing, which projection
+  // rendering can regenerate. The inverse (file exists, no DB row) is
+  // harder to detect and recover from (#2725).
+  const validatedAt = new Date().toISOString();
+
+  transaction(() => {
+    insertAssessment({
+      path: validationPath,
+      milestoneId: params.milestoneId,
+      sliceId: null,
+      taskId: null,
+      status: params.verdict,
+      scope: 'milestone-validation',
+      fullContent: validationMd,
+    });
+  });
+
+  // ── Filesystem render (outside transaction) ────────────────────────────
+  // If disk render fails, roll back the DB row so state stays consistent.
   try {
     await saveFile(validationPath, validationMd);
   } catch (renderErr) {
     process.stderr.write(
-      `gsd-db: validate_milestone — disk render failed: ${(renderErr as Error).message}\n`,
+      `gsd-db: validate_milestone — disk render failed, rolling back DB row: ${(renderErr as Error).message}\n`,
     );
+    deleteAssessmentByScope(params.milestoneId, 'milestone-validation');
     return { error: `disk render failed: ${(renderErr as Error).message}` };
   }
 
-  // ── DB write — store in assessments table ──────────────────────────────
-  const validatedAt = new Date().toISOString();
-
-  transaction(() => {
-    const adapter = _getAdapter()!;
-    adapter.prepare(
-      `INSERT OR REPLACE INTO assessments (path, milestone_id, slice_id, task_id, status, scope, full_content, created_at)
-       VALUES (:path, :mid, NULL, NULL, :verdict, 'milestone-validation', :content, :created_at)`,
-    ).run({
-      ":path": validationPath,
-      ":mid": params.milestoneId,
-      ":verdict": params.verdict,
-      ":content": validationMd,
-      ":created_at": validatedAt,
-    });
-  });
-
   invalidateStateCache();
   clearPathCache();
   clearParseCache();

package/src/resources/extensions/gsd/types.ts

@@ -157,6 +157,8 @@ export interface Summary {
   whatHappened: string;
   deviations: string;
   filesModified: FileModified[];
+  followUps: string;
+  knownLimitations: string;
 }
 
 // ─── Continue-Here ─────────────────────────────────────────────────────────

package/src/resources/extensions/gsd/undo.ts

@@ -7,6 +7,7 @@ import type { ExtensionCommandContext, ExtensionAPI } from "@gsd/pi-coding-agent
 import { existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { nativeRevertCommit, nativeRevertAbort } from "./native-git-bridge.js";
+import { parseUnitId } from "./unit-id.js";
 import { deriveState } from "./state.js";
 import { invalidateAllCaches } from "./cache.js";
 import { gsdRoot, resolveTasksDir, resolveSlicePath, resolveTaskFile, buildTaskFileName, buildSliceFileName } from "./paths.js";
@@ -65,11 +66,11 @@ export async function handleUndo(args: string, ctx: ExtensionCommandContext, _pi
   }
 
   // 1. Delete summary artifact
-  const parts = unitId.split("/");
+  const { milestone, slice, task } = parseUnitId(unitId);
   let summaryRemoved = false;
-  if (parts.length === 3) {
+  if (task !== undefined && slice !== undefined) {
     // Task-level: M001/S01/T01
-    const [mid, sid, tid] = parts;
+    const [mid, sid, tid] = [milestone, slice, task];
     const tasksDir = resolveTasksDir(basePath, mid, sid);
     if (tasksDir) {
       const summaryFile = join(tasksDir, buildTaskFileName(tid, "SUMMARY"));
@@ -78,9 +79,9 @@ export async function handleUndo(args: string, ctx: ExtensionCommandContext, _pi
         summaryRemoved = true;
       }
     }
-  } else if (parts.length === 2) {
+  } else if (slice !== undefined) {
     // Slice-level: M001/S01
-    const [mid, sid] = parts;
+    const [mid, sid] = [milestone, slice];
     const slicePath = resolveSlicePath(basePath, mid, sid);
     if (slicePath) {
       for (const suffix of ["SUMMARY", "COMPLETE"]) {
@@ -95,8 +96,8 @@ export async function handleUndo(args: string, ctx: ExtensionCommandContext, _pi
 
   // 2. Uncheck task in PLAN if execute-task
   let planUpdated = false;
-  if (unitType === "execute-task" && parts.length === 3) {
-    const [mid, sid, tid] = parts;
+  if (unitType === "execute-task" && task !== undefined && slice !== undefined) {
+    const [mid, sid, tid] = [milestone, slice, task];
     planUpdated = uncheckTaskInPlan(basePath, mid, sid, tid);
   }
 

package/src/resources/extensions/gsd/unit-runtime.ts

@@ -8,6 +8,7 @@ import {
   resolveTaskFile,
 } from "./paths.js";
 import { loadFile, parseTaskPlanMustHaves, countMustHavesMentionedInSummary } from "./files.js";
+import { parseUnitId } from "./unit-id.js";
 
 export type UnitRuntimePhase =
   | "dispatched"
@@ -128,7 +129,7 @@ export async function inspectExecuteTaskDurability(
   basePath: string,
   unitId: string,
 ): Promise<ExecuteTaskRecoveryStatus | null> {
-  const [mid, sid, tid] = unitId.split("/");
+  const { milestone: mid, slice: sid, task: tid } = parseUnitId(unitId);
   if (!mid || !sid || !tid) return null;
 
   const planAbs = resolveSliceFile(basePath, mid, sid, "PLAN");

package/src/resources/extensions/gsd/verification-gate.ts

@@ -8,6 +8,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, basename } from "node:path";
 import type { AuditWarning, RuntimeError, VerificationCheck, VerificationResult } from "./types.js";
 import { DEFAULT_COMMAND_TIMEOUT_MS } from "./constants.js";
+import { rewriteCommandWithRtk } from "../shared/rtk.js";
 
 /** Maximum bytes of stdout/stderr to retain per command (10 KB). */
 const MAX_OUTPUT_BYTES = 10 * 1024;
@@ -257,10 +258,11 @@ export function runVerificationGate(options: RunVerificationGateOptions): Verifi
 
   for (const command of commands) {
     const start = Date.now();
+    const rewrittenCommand = rewriteCommandWithRtk(command);
     // Pass the command string as an argument to the shell explicitly
     // to avoid Node.js DEP0190 (spawnSync with shell: true and no args).
     const shellBin = process.platform === "win32" ? "cmd" : "sh";
-    const shellArgs = process.platform === "win32" ? ["/c", command] : ["-c", command];
+    const shellArgs = process.platform === "win32" ? ["/c", rewrittenCommand] : ["-c", rewrittenCommand];
     const result: SpawnSyncReturns<string> = spawnSync(shellBin, shellArgs, {
       cwd: options.cwd,
       stdio: "pipe",

package/src/resources/extensions/gsd/workflow-logger.ts

@@ -199,7 +199,6 @@ export function readAuditLog(basePath?: string): LogEntry[] {
  */
 export function _resetLogs(): void {
   _buffer = [];
-  _auditBasePath = null;
 }
 
 // ─── Internal ───────────────────────────────────────────────────────────

package/src/resources/extensions/remote-questions/config.ts

@@ -59,7 +59,7 @@ function hydrateRemoteTokensFromAuth(): void {
     for (const [providerId, envVar] of needed) {
       try {
         const creds = auth.getCredentialsForProvider(providerId);
-        const apiKeyCred = creds.find((c: { type: string }) => c.type === "api_key") as
+        const apiKeyCred = creds.find((c: { type: string; key?: string }) => c.type === "api_key" && !!c.key) as
           | { type: "api_key"; key: string }
           | undefined;
         if (apiKeyCred?.key) {

package/src/resources/extensions/remote-questions/remote-command.ts

@@ -312,7 +312,7 @@ function saveProviderToken(provider: string, token: string): void {
 
 function removeProviderToken(provider: string): void {
   const auth = getAuthStorage();
-  auth.set(provider, { type: "api_key", key: "" });
+  auth.remove(provider);
 }
 
 export function saveRemoteQuestionsConfig(channel: "slack" | "discord" | "telegram", channelId: string): void {

package/src/resources/extensions/search-the-web/native-search.ts

@@ -28,7 +28,7 @@ export const MAX_NATIVE_SEARCHES_PER_SESSION = 15;
 
 /** When true, skip native web search injection and keep Brave/custom tools active on Anthropic. */
 export function preferBraveSearch(): boolean {
-  // preferences.md takes priority over env var
+  // PREFERENCES.md takes priority over env var
   const prefsPref = resolveSearchProviderFromPreferences();
   if (prefsPref === "brave" || prefsPref === "tavily" || prefsPref === "ollama") return true;
   if (prefsPref === "native") return false;

package/src/resources/extensions/search-the-web/provider.ts

@@ -105,7 +105,7 @@ export function resolveSearchProvider(overridePreference?: string): SearchProvid
   if (overridePreference && VALID_PREFERENCES.has(overridePreference)) {
     pref = overridePreference as SearchProviderPreference
   } else {
-    // preferences.md takes priority over auth.json
+    // PREFERENCES.md takes priority over auth.json
     const mdPref = resolveSearchProviderFromPreferences()
     if (mdPref && mdPref !== 'auto' && mdPref !== 'native') {
       pref = mdPref as SearchProviderPreference