gsd-pi 2.63.0 → 2.64.0-dev.05b8a94

package/packages/pi-coding-agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/pi-coding-agent",
-  "version": "2.63.0",
+  "version": "2.64.0",
   "description": "Coding agent CLI (vendored from pi-mono)",
   "type": "module",
   "piConfig": {

package/packages/pi-coding-agent/src/core/agent-session-tool-refresh.test.ts

@@ -0,0 +1,64 @@
+// GSD-2 — Regression tests for #3616: tool list persistence across newSession() calls
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+
+import test, { describe } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const source = readFileSync(
+	join(process.cwd(), "packages/pi-coding-agent/src/core/agent-session.ts"),
+	"utf-8",
+);
+
+describe("#3616 — newSession() must restore full tool set", () => {
+	test("newSession() calls _refreshToolRegistry with includeAllExtensionTools when cwd is unchanged", () => {
+		// Find the newSession method
+		const newSessionStart = source.indexOf("async newSession(options?:");
+		assert.ok(newSessionStart >= 0, "should find newSession method");
+
+		// Get the method body (up to the next top-level method)
+		const methodBody = source.slice(newSessionStart, newSessionStart + 3000);
+
+		// Verify the cwd-changed branch rebuilds tools
+		assert.ok(
+			methodBody.includes("if (this._cwd !== previousCwd)"),
+			"should have cwd-change guard",
+		);
+
+		// Verify the else branch exists and refreshes tools with includeAllExtensionTools
+		const elseIdx = methodBody.indexOf("} else {");
+		assert.ok(elseIdx >= 0, "should have else branch for cwd-unchanged case");
+
+		const elseBranch = methodBody.slice(elseIdx, elseIdx + 800);
+		assert.ok(
+			elseBranch.includes("_refreshToolRegistry"),
+			"else branch should call _refreshToolRegistry",
+		);
+		assert.ok(
+			elseBranch.includes("includeAllExtensionTools: true"),
+			"else branch should pass includeAllExtensionTools: true to restore narrowed tools",
+		);
+	});
+
+	test("newSession() references #3616 in the else-branch comment", () => {
+		const idx = source.indexOf("#3616");
+		assert.ok(idx >= 0, "source should reference issue #3616 for the tool restore fix");
+	});
+
+	test("agent.reset() does not clear _state.tools (tools persist across reset)", () => {
+		// This is a structural invariant — if reset() starts clearing tools,
+		// the newSession() refresh becomes the only defense against tool loss.
+		const agentSource = readFileSync(
+			join(process.cwd(), "packages/pi-agent-core/src/agent.ts"),
+			"utf-8",
+		);
+		const resetStart = agentSource.indexOf("reset()");
+		assert.ok(resetStart >= 0, "should find reset() method");
+		const resetBody = agentSource.slice(resetStart, resetStart + 400);
+		assert.ok(
+			!resetBody.includes("tools"),
+			"reset() should NOT touch _state.tools — tools are managed by agent-session",
+		);
+	});
+});

package/packages/pi-coding-agent/src/core/agent-session.ts

@@ -1577,6 +1577,16 @@ export class AgentSession {
 				activeToolNames: this.getActiveToolNames(),
 				includeAllExtensionTools: true,
 			});
+		} else {
+			// Even when cwd hasn't changed, restore the full tool set (#3616).
+			// Extensions (e.g., discuss flows) may narrow the active tool list
+			// via setActiveTools() during a session. Without this refresh, the
+			// narrowed set persists into the next session — causing tools like
+			// gsd_plan_slice to be missing from auto-mode subagent sessions.
+			this._refreshToolRegistry({
+				activeToolNames: this.getActiveToolNames(),
+				includeAllExtensionTools: true,
+			});
 		}
 
 		// Run setup callback if provided (e.g., to append initial messages)

package/packages/pi-coding-agent/src/core/auth-storage.test.ts

@@ -356,6 +356,59 @@ describe("AuthStorage — oauth credential for non-OAuth provider (#2083)", () =
 	});
 });
 
+// ─── Gemini CLI OAuth token detection ─────────────────────────────────────────
+
+describe("AuthStorage — Gemini CLI OAuth token detection", () => {
+	it("rejects Google OAuth access token (ya29. prefix) stored as api_key for google provider", () => {
+		const storage = inMemory({});
+		assert.throws(
+			() => storage.set("google", makeKey("ya29.a0ARrdaM_fake_oauth_token_from_gemini_cli")),
+			(err: Error) => {
+				assert.ok(err.message.includes("OAuth access token"), `Expected message about OAuth token, got: ${err.message}`);
+				assert.ok(
+					err.message.includes("GEMINI_API_KEY") || err.message.includes("google-gemini-cli"),
+					`Expected guidance about GEMINI_API_KEY or google-gemini-cli, got: ${err.message}`,
+				);
+				return true;
+			},
+		);
+	});
+
+	it("rejects Google OAuth access token for google provider via getApiKey when set as env var", async () => {
+		const storage = inMemory({});
+		// Simulate runtime override with OAuth token
+		storage.setRuntimeApiKey("google", "ya29.c.b0AXv0zTPQ_fake_oauth_token");
+		const key = await storage.getApiKey("google");
+		// Should return undefined (blocked) or throw
+		assert.equal(key, undefined, "OAuth token should be blocked for google provider");
+	});
+
+	it("allows legitimate Google API keys (AIza prefix) for google provider", () => {
+		const storage = inMemory({});
+		storage.set("google", makeKey("AIzaSyD_fake_legitimate_api_key_here"));
+		const creds = storage.getCredentialsForProvider("google");
+		assert.equal(creds.length, 1);
+	});
+
+	it("allows ya29 tokens for google-gemini-cli provider (OAuth is expected there)", () => {
+		// google-gemini-cli stores OAuth credentials with type: "oauth", not "api_key"
+		// But if someone somehow stored an api_key, it shouldn't be blocked for OAuth providers
+		const storage = inMemory({});
+		storage.set("google-gemini-cli", makeKey("ya29.a0ARrdaM_token_for_gemini_cli"));
+		const creds = storage.getCredentialsForProvider("google-gemini-cli");
+		assert.equal(creds.length, 1);
+	});
+
+	it("rejects Google OAuth token (ya29. prefix) for openai provider that uses GEMINI_API_KEY indirectly", () => {
+		// Only google provider should be blocked, not others
+		const storage = inMemory({});
+		// This should NOT throw - other providers can have whatever keys they want
+		storage.set("openai", makeKey("ya29.some_value"));
+		const creds = storage.getCredentialsForProvider("openai");
+		assert.equal(creds.length, 1);
+	});
+});
+
 // ─── getAll truncation ────────────────────────────────────────────────────────
 
 describe("AuthStorage — getAll()", () => {

package/packages/pi-coding-agent/src/core/auth-storage.ts

@@ -34,6 +34,46 @@ export type OAuthCredential = {
 
 export type AuthCredential = ApiKeyCredential | OAuthCredential;
 
+// ============================================================================
+// Google OAuth token detection
+// ============================================================================
+
+/**
+ * Providers that use Google AI Studio API keys (not OAuth tokens).
+ * OAuth access tokens (ya29.*) are not valid API keys for these providers.
+ */
+const GOOGLE_API_KEY_PROVIDERS = new Set(["google"]);
+
+/**
+ * Detect if a string is a Google OAuth access token rather than an API key.
+ * Google OAuth access tokens start with "ya29." — these are issued by
+ * Google's OAuth2 token endpoint and are not valid as AI Studio API keys.
+ *
+ * Users who installed Google's Gemini CLI may have these tokens and
+ * mistakenly set them as GEMINI_API_KEY.
+ */
+export function isGoogleOAuthToken(key: string): boolean {
+	return key.startsWith("ya29.");
+}
+
+/**
+ * Validate that an API key is not a Google OAuth token being used for
+ * a provider that requires actual API keys (e.g., Google AI Studio).
+ * Throws a descriptive error if the key appears to be an OAuth token.
+ */
+function validateNotGoogleOAuthToken(provider: string, key: string): void {
+	if (GOOGLE_API_KEY_PROVIDERS.has(provider) && isGoogleOAuthToken(key)) {
+		throw new Error(
+			`The provided key for "${provider}" appears to be a Google OAuth access token (ya29.*), ` +
+				`not a valid API key. Google AI Studio requires an API key starting with "AIza...". ` +
+				`\n\nIf you're using Google's Gemini CLI, its OAuth tokens are not compatible. ` +
+				`Either:\n` +
+				`  1. Get an API key from https://aistudio.google.com/apikey and set GEMINI_API_KEY\n` +
+				`  2. Use '/login google-gemini-cli' to authenticate via Cloud Code Assist`,
+		);
+	}
+}
+
 /**
  * On-disk format: each provider maps to a single credential or an array of credentials.
  * Single credentials are normalized to arrays at load time for internal use.
@@ -360,6 +400,9 @@ export class AuthStorage {
 	 */
 	set(provider: string, credential: AuthCredential): void {
 		if (credential.type === "api_key") {
+			// Block Google OAuth tokens being stored as API keys for AI Studio providers
+			validateNotGoogleOAuthToken(provider, credential.key);
+
 			const existing = this.getCredentialsForProvider(provider);
 			// Deduplicate: don't add if same key already exists
 			const isDuplicate = existing.some(
@@ -762,6 +805,16 @@ export class AuthStorage {
 		// Runtime override takes highest priority
 		const runtimeKey = this.runtimeOverrides.get(providerId);
 		if (runtimeKey) {
+			// Block Google OAuth tokens used as runtime API key overrides
+			if (GOOGLE_API_KEY_PROVIDERS.has(providerId) && isGoogleOAuthToken(runtimeKey)) {
+				this.recordError(
+					new Error(
+						`Blocked Google OAuth access token (ya29.*) for provider "${providerId}". ` +
+							`Use an API key from https://aistudio.google.com/apikey or '/login google-gemini-cli'.`,
+					),
+				);
+				return undefined;
+			}
 			return runtimeKey;
 		}
 
@@ -780,7 +833,19 @@ export class AuthStorage {
 
 		// Fall back to environment variable
 		const envKey = getEnvApiKey(providerId);
-		if (envKey) return envKey;
+		if (envKey) {
+			// Block Google OAuth tokens from environment variables (e.g., GEMINI_API_KEY=ya29.*)
+			if (GOOGLE_API_KEY_PROVIDERS.has(providerId) && isGoogleOAuthToken(envKey)) {
+				this.recordError(
+					new Error(
+						`GEMINI_API_KEY contains a Google OAuth access token (ya29.*), not an API key. ` +
+							`Get an API key from https://aistudio.google.com/apikey or use '/login google-gemini-cli'.`,
+					),
+				);
+				return undefined;
+			}
+			return envKey;
+		}
 
 		// Fall back to custom resolver (e.g., models.json custom providers)
 		return this.fallbackResolver?.(providerId) ?? undefined;

package/packages/pi-coding-agent/src/core/extensions/loader.test.ts

@@ -4,7 +4,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { isProjectTrusted, trustProject, getUntrustedExtensionPaths } from "./project-trust.js";
-import { containsTypeScriptSyntax, loadExtensions } from "./loader.js";
+import { containsTypeScriptSyntax, loadExtensions, resetExtensionLoaderCache } from "./loader.js";
 
 // ─── helpers ──────────────────────────────────────────────────────────────────
 
@@ -235,3 +235,41 @@ describe("loadExtensions", () => {
 		);
 	});
 });
+
+// ─── resetExtensionLoaderCache ───────────────────────────────────────────────
+
+describe("resetExtensionLoaderCache", () => {
+	let tmpDir: string;
+
+	beforeEach(() => {
+		tmpDir = makeTempDir();
+		// Always start with a clean cache so tests are independent
+		resetExtensionLoaderCache();
+	});
+
+	afterEach(() => {
+		resetExtensionLoaderCache();
+		cleanDir(tmpDir);
+	});
+
+	it("clears the jiti singleton so a fresh instance is created on next load", async () => {
+		// Write a minimal valid extension that returns a name
+		const extPath = path.join(tmpDir, "cache-ext.ts");
+		fs.writeFileSync(
+			extPath,
+			`export default function activate(api: any) { return { name: "cache-ext" }; }\n`,
+		);
+
+		// First load — creates the jiti singleton and caches the module
+		const result1 = await loadExtensions([extPath], tmpDir);
+		assert.equal(result1.extensions.length, 1, "first load should succeed");
+
+		// Reset the cache — nulls the singleton
+		resetExtensionLoaderCache();
+
+		// Second load — should create a new jiti instance (not reuse the old one)
+		// and still successfully load the extension
+		const result2 = await loadExtensions([extPath], tmpDir);
+		assert.equal(result2.extensions.length, 1, "load after reset should succeed with fresh jiti");
+	});
+});

package/packages/pi-coding-agent/src/core/extensions/loader.ts

@@ -624,6 +624,39 @@ export function containsTypeScriptSyntax(source: string): boolean {
 	return TS_SYNTAX_PATTERNS.some((pattern) => pattern.test(source));
 }
 
+/**
+ * Shared jiti instance for loading extension modules.
+ *
+ * Before this fix (#2108), each extension created a NEW jiti instance with
+ * `moduleCache: false`, causing shared dependencies (e.g. @gsd/pi-agent-core)
+ * to be recompiled for every extension — turning a ~3s parallel load into a
+ * ~15-30s serial compilation bottleneck.
+ *
+ * Using a single shared instance with `moduleCache: true` means shared modules
+ * are compiled once and reused across all extensions.
+ */
+let _extensionLoaderJiti: ReturnType<typeof createJiti> | null = null;
+
+/**
+ * Reset the shared jiti singleton so the next call to getExtensionLoaderJiti()
+ * creates a fresh instance.  This prevents memory leaks in long-running daemon
+ * processes (every loaded module stays cached forever) and ensures stale modules
+ * are not returned when extension source changes on disk.
+ */
+export function resetExtensionLoaderCache(): void {
+	_extensionLoaderJiti = null;
+}
+
+function getExtensionLoaderJiti() {
+	if (!_extensionLoaderJiti) {
+		_extensionLoaderJiti = createJiti(import.meta.url, {
+			moduleCache: true,
+			...getJitiOptions(),
+		});
+	}
+	return _extensionLoaderJiti;
+}
+
 async function loadExtensionModule(extensionPath: string) {
 	// Pre-compiled extension loading: if the source is .ts and a sibling .js
 	// file exists with matching or newer mtime, use native import() to skip
@@ -643,10 +676,7 @@ async function loadExtensionModule(extensionPath: string) {
 		}
 	}
 
-	const jiti = createJiti(import.meta.url, {
-		moduleCache: false,
-		...getJitiOptions(),
-	});
+	const jiti = getExtensionLoaderJiti();
 
 	const module = await jiti.import(extensionPath, { default: true });
 	const factory = module as ExtensionFactory;

package/packages/pi-coding-agent/src/core/extensions/provider-registration.test.ts

@@ -0,0 +1,81 @@
+// GSD2 — Regression test: pendingProviderRegistrations must be flushed exactly once (#3576)
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+/**
+ * This test validates that the provider preflush pattern in sdk.ts clears
+ * pendingProviderRegistrations after iterating, so bindCore() doesn't
+ * re-register the same providers.
+ *
+ * The bug: createAgentSession() iterated pendingProviderRegistrations but
+ * did not clear the array. Later, bindCore() replayed and registered the
+ * same providers again, stacking wrappers.
+ */
+
+interface ProviderEntry {
+  name: string;
+  config: Record<string, unknown>;
+}
+
+interface MockRuntime {
+  pendingProviderRegistrations: ProviderEntry[];
+}
+
+describe("provider registration preflush", () => {
+  it("clears pending registrations after preflush so bindCore does not replay", () => {
+    const registered: string[] = [];
+    const runtime: MockRuntime = {
+      pendingProviderRegistrations: [
+        { name: "ollama", config: { type: "ollama" } },
+        { name: "custom-provider", config: { type: "custom" } },
+      ],
+    };
+
+    // Simulate sdk.ts preflush (lines 220-223)
+    for (const { name } of runtime.pendingProviderRegistrations) {
+      registered.push(name);
+    }
+    // The fix: clear after preflush
+    runtime.pendingProviderRegistrations = [];
+
+    // Simulate bindCore() flush (runner.ts lines 268-271)
+    for (const { name } of runtime.pendingProviderRegistrations) {
+      registered.push(name);
+    }
+    runtime.pendingProviderRegistrations = [];
+
+    assert.deepEqual(
+      registered,
+      ["ollama", "custom-provider"],
+      "each provider should be registered exactly once",
+    );
+  });
+
+  it("without the fix, providers are registered twice", () => {
+    const registered: string[] = [];
+    const runtime: MockRuntime = {
+      pendingProviderRegistrations: [
+        { name: "ollama", config: { type: "ollama" } },
+      ],
+    };
+
+    // Old behavior: preflush without clearing
+    for (const { name } of runtime.pendingProviderRegistrations) {
+      registered.push(name);
+    }
+    // NOT clearing — simulating the old bug
+
+    // bindCore() replays the same queue
+    for (const { name } of runtime.pendingProviderRegistrations) {
+      registered.push(name);
+    }
+
+    assert.deepEqual(
+      registered,
+      ["ollama", "ollama"],
+      "without clearing, providers are registered twice (demonstrating the bug)",
+    );
+  });
+});

package/packages/pi-coding-agent/src/core/extensions/types.ts

@@ -1341,6 +1341,8 @@ export interface ProviderModelConfig {
 	headers?: Record<string, string>;
 	/** OpenAI compatibility settings. */
 	compat?: Model<Api>["compat"];
+	/** Opaque provider-specific options (e.g. Ollama keep_alive, num_gpu). */
+	providerOptions?: Record<string, unknown>;
 }
 
 /** Extension factory function type. Supports both sync and async initialization. */

package/packages/pi-coding-agent/src/core/model-registry.ts

@@ -467,6 +467,18 @@ export class ModelRegistry {
 				this.customProviderApiKeys.set(providerName, providerConfig.apiKey);
 			}
 
+			// Register custom providers so isProviderRequestReady() can find
+			// them (#3531). Without this, models.json providers with apiKey
+			// fail the auth check and are invisible to the fallback resolver.
+			if (!this.registeredProviders.has(providerName)) {
+				this.registeredProviders.set(providerName, {
+					authMode: providerConfig.apiKey ? "apiKey" : "none",
+					apiKey: providerConfig.apiKey,
+					baseUrl: providerConfig.baseUrl,
+					isReady: providerConfig.apiKey ? () => true : undefined,
+				} as any);
+			}
+
 			for (const modelDef of modelDefs) {
 				const api = modelDef.api || providerConfig.api;
 				if (!api) continue;
@@ -742,6 +754,7 @@ export class ModelRegistry {
 					maxTokens: modelDef.maxTokens,
 					headers,
 					compat: modelDef.compat,
+					providerOptions: modelDef.providerOptions,
 				} as Model<Api>);
 			}
 
@@ -917,5 +930,6 @@ export interface ProviderConfigInput {
 		maxTokens: number;
 		headers?: Record<string, string>;
 		compat?: Model<Api>["compat"];
+		providerOptions?: Record<string, unknown>;
 	}>;
 }

package/packages/pi-coding-agent/src/core/model-resolver.ts

@@ -13,7 +13,7 @@ import type { ModelRegistry } from "./model-registry.js";
 /** Default model IDs for each known provider */
 const defaultModelPerProvider: Record<KnownProvider, string> = {
 	"amazon-bedrock": "us.anthropic.claude-opus-4-6-v1",
-	anthropic: "claude-opus-4-6[1m]",
+	anthropic: "claude-opus-4-6",
 	"anthropic-vertex": "claude-sonnet-4-6",
 	openai: "gpt-5.4",
 	"azure-openai-responses": "gpt-5.2",
@@ -24,7 +24,7 @@ const defaultModelPerProvider: Record<KnownProvider, string> = {
 	"google-vertex": "gemini-3-pro-preview",
 	"github-copilot": "gpt-4o",
 	openrouter: "openai/gpt-5.1-codex",
-	"vercel-ai-gateway": "anthropic/claude-opus-4-6[1m]",
+	"vercel-ai-gateway": "anthropic/claude-opus-4-6",
 	xai: "grok-4-fast-non-reasoning",
 	groq: "openai/gpt-oss-120b",
 	cerebras: "zai-glm-4.6",
@@ -507,7 +507,7 @@ export async function findInitialModel(options: {
 		const found = modelRegistry.find(defaultProvider, defaultModelId);
 		if (found) {
 			// Check if the provider's recommended default is a higher-capability variant
-			// of the saved model (e.g. saved "claude-opus-4-6" vs recommended "claude-opus-4-6[1m]").
+			// of the saved model (e.g. saved "claude-opus-4-6" vs recommended "claude-opus-4-6-extended").
 			// If so, prefer the recommended variant to avoid using a smaller context window (#1125).
 			const recommendedId = defaultModelPerProvider[defaultProvider as KnownProvider];
 			if (recommendedId && recommendedId !== defaultModelId && recommendedId.startsWith(defaultModelId)) {

package/packages/pi-coding-agent/src/core/resource-loader-cache-reset.test.ts

@@ -0,0 +1,42 @@
+// GSD-2 — Regression test for #3616: reload() must reset jiti extension loader cache
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+
+import test, { describe } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const source = readFileSync(
+	join(process.cwd(), "packages/pi-coding-agent/src/core/resource-loader.ts"),
+	"utf-8",
+);
+
+describe("#3616 — reload() must invalidate jiti module cache", () => {
+	test("resource-loader imports resetExtensionLoaderCache from loader.js", () => {
+		assert.ok(
+			source.includes("resetExtensionLoaderCache"),
+			"resource-loader.ts should import resetExtensionLoaderCache",
+		);
+		assert.ok(
+			source.includes('from "./extensions/loader.js"'),
+			"resetExtensionLoaderCache should be imported from extensions/loader.js",
+		);
+	});
+
+	test("reload() calls resetExtensionLoaderCache before loadExtensions", () => {
+		const reloadStart = source.indexOf("async reload(): Promise<void>");
+		assert.ok(reloadStart >= 0, "should find reload() method");
+		const reloadBody = source.slice(reloadStart, reloadStart + 4000);
+
+		const resetIdx = reloadBody.indexOf("resetExtensionLoaderCache()");
+		assert.ok(resetIdx >= 0, "reload() should call resetExtensionLoaderCache()");
+
+		const loadIdx = reloadBody.indexOf("loadExtensions(");
+		assert.ok(loadIdx >= 0, "reload() should call loadExtensions");
+
+		assert.ok(
+			resetIdx < loadIdx,
+			"resetExtensionLoaderCache() must be called BEFORE loadExtensions to ensure fresh modules",
+		);
+	});
+});