gsd-pi 2.67.0-dev.46f9884 → 2.67.0-dev.4fb8afe

package/packages/pi-coding-agent/dist/modes/interactive/provider-auth-setup.d.ts

@@ -0,0 +1,13 @@
+import type { ProviderAuthMode } from "../../core/model-registry.js";
+export type ProviderSetupAction = {
+    kind: "oauth-login";
+} | {
+    kind: "status";
+    message: string;
+};
+export declare function getProviderSetupAction(options: {
+    provider: string;
+    authMode: ProviderAuthMode;
+    hasAuth: boolean;
+}): ProviderSetupAction;
+//# sourceMappingURL=provider-auth-setup.d.ts.map

package/packages/pi-coding-agent/dist/modes/interactive/provider-auth-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth-setup.d.ts","sourceRoot":"","sources":["../../../src/modes/interactive/provider-auth-setup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,MAAM,MAAM,mBAAmB,GAC5B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CACjB,GAAG,mBAAmB,CA6BtB"}

package/packages/pi-coding-agent/dist/modes/interactive/provider-auth-setup.js

@@ -0,0 +1,27 @@
+export function getProviderSetupAction(options) {
+    const { provider, authMode, hasAuth } = options;
+    if (authMode === "oauth") {
+        return { kind: "oauth-login" };
+    }
+    if (authMode === "none") {
+        return {
+            kind: "status",
+            message: `${provider} does not need auth setup. Use /model to select it.`,
+        };
+    }
+    if (authMode === "externalCli") {
+        return {
+            kind: "status",
+            message: hasAuth
+                ? `${provider} is already authenticated. Use /model to select it.`
+                : `${provider} uses external CLI auth. Sign in with the provider CLI, then use /model.`,
+        };
+    }
+    return {
+        kind: "status",
+        message: hasAuth
+            ? `${provider} already has credentials configured. Use /model to select it.`
+            : `${provider} uses API-key auth, not OAuth. Configure its credentials, then use /model.`,
+    };
+}
+//# sourceMappingURL=provider-auth-setup.js.map

package/packages/pi-coding-agent/dist/modes/interactive/provider-auth-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth-setup.js","sourceRoot":"","sources":["../../../src/modes/interactive/provider-auth-setup.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,sBAAsB,CAAC,OAItC;IACA,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEhD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,QAAQ,qDAAqD;SACzE,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,OAAO;gBACf,CAAC,CAAC,GAAG,QAAQ,qDAAqD;gBAClE,CAAC,CAAC,GAAG,QAAQ,0EAA0E;SACxF,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;YACf,CAAC,CAAC,GAAG,QAAQ,+DAA+D;YAC5E,CAAC,CAAC,GAAG,QAAQ,4EAA4E;KAC1F,CAAC;AACH,CAAC","sourcesContent":["import type { ProviderAuthMode } from \"../../core/model-registry.js\";\n\nexport type ProviderSetupAction =\n\t| { kind: \"oauth-login\" }\n\t| { kind: \"status\"; message: string };\n\nexport function getProviderSetupAction(options: {\n\tprovider: string;\n\tauthMode: ProviderAuthMode;\n\thasAuth: boolean;\n}): ProviderSetupAction {\n\tconst { provider, authMode, hasAuth } = options;\n\n\tif (authMode === \"oauth\") {\n\t\treturn { kind: \"oauth-login\" };\n\t}\n\n\tif (authMode === \"none\") {\n\t\treturn {\n\t\t\tkind: \"status\",\n\t\t\tmessage: `${provider} does not need auth setup. Use /model to select it.`,\n\t\t};\n\t}\n\n\tif (authMode === \"externalCli\") {\n\t\treturn {\n\t\t\tkind: \"status\",\n\t\t\tmessage: hasAuth\n\t\t\t\t? `${provider} is already authenticated. Use /model to select it.`\n\t\t\t\t: `${provider} uses external CLI auth. Sign in with the provider CLI, then use /model.`,\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"status\",\n\t\tmessage: hasAuth\n\t\t\t? `${provider} already has credentials configured. Use /model to select it.`\n\t\t\t: `${provider} uses API-key auth, not OAuth. Configure its credentials, then use /model.`,\n\t};\n}\n"]}

package/packages/pi-coding-agent/src/modes/interactive/interactive-mode.ts

@@ -82,6 +82,7 @@ import { LoginDialogComponent } from "./components/login-dialog.js";
 import { ModelSelectorComponent, providerDisplayName } from "./components/model-selector.js";
 import { OAuthSelectorComponent } from "./components/oauth-selector.js";
 import { ProviderManagerComponent } from "./components/provider-manager.js";
+import { getProviderSetupAction } from "./provider-auth-setup.js";
 import { ScopedModelsSelectorComponent } from "./components/scoped-models-selector.js";
 import { SessionSelectorComponent } from "./components/session-selector.js";
 import { SettingsSelectorComponent } from "./components/settings-selector.js";
@@ -3412,9 +3413,21 @@ export class InteractiveMode {
 					this.ui.requestRender();
 				},
 				async (provider: string) => {
-					// Enter key → auth setup for selected provider (#3579)
 					done();
-					await this.showLoginDialog(provider);
+
+					const action = getProviderSetupAction({
+						provider,
+						authMode: this.session.modelRegistry.getProviderAuthMode(provider),
+						hasAuth: this.session.modelRegistry.authStorage.hasAuth(provider),
+					});
+
+					if (action.kind === "oauth-login") {
+						await this.showLoginDialog(provider);
+						return;
+					}
+
+					this.showStatus(action.message);
+					this.ui.requestRender();
 				},
 			);
 			return { component, focus: component };

package/packages/pi-coding-agent/src/modes/interactive/provider-auth-setup.ts

@@ -0,0 +1,40 @@
+import type { ProviderAuthMode } from "../../core/model-registry.js";
+
+export type ProviderSetupAction =
+	| { kind: "oauth-login" }
+	| { kind: "status"; message: string };
+
+export function getProviderSetupAction(options: {
+	provider: string;
+	authMode: ProviderAuthMode;
+	hasAuth: boolean;
+}): ProviderSetupAction {
+	const { provider, authMode, hasAuth } = options;
+
+	if (authMode === "oauth") {
+		return { kind: "oauth-login" };
+	}
+
+	if (authMode === "none") {
+		return {
+			kind: "status",
+			message: `${provider} does not need auth setup. Use /model to select it.`,
+		};
+	}
+
+	if (authMode === "externalCli") {
+		return {
+			kind: "status",
+			message: hasAuth
+				? `${provider} is already authenticated. Use /model to select it.`
+				: `${provider} uses external CLI auth. Sign in with the provider CLI, then use /model.`,
+		};
+	}
+
+	return {
+		kind: "status",
+		message: hasAuth
+			? `${provider} already has credentials configured. Use /model to select it.`
+			: `${provider} uses API-key auth, not OAuth. Configure its credentials, then use /model.`,
+	};
+}

package/src/resources/GSD-WORKFLOW.md

@@ -18,7 +18,8 @@ Read these files in order and act on what they say:
 3. **`.gsd/milestones/<active>/M###-CONTEXT.md`** — Milestone-level project decisions, reference paths, constraints. Read this before doing implementation work.
 4. If a slice is active and has one, read **`S##-CONTEXT.md`** — Slice-specific decisions and constraints.
 5. If a slice is active, read its **`S##-PLAN.md`** — Which tasks exist? Which are done?
-6. If a task was interrupted, check for **`continue.md`** in the active slice directory — Resume from there.
+6. If `.gsd/CODEBASE.md` exists, skim it for fast structural orientation before broad code exploration.
+7. If a task was interrupted, check for **`continue.md`** in the active slice directory — Resume from there.
 
 Then do the thing `STATE.md` says to do next.
 
@@ -44,6 +45,7 @@ All artifacts live in `.gsd/` at the project root:
 .gsd/
   STATE.md                                  # Dashboard — always read first (derived cache; runtime, gitignored)
   DECISIONS.md                              # Append-only decisions register
+  CODEBASE.md                               # Generated codebase map cache (auto-refreshed by GSD)
   milestones/
     M001/
       M001-ROADMAP.md                       # Milestone plan (checkboxes = state)

package/src/resources/extensions/claude-code-cli/stream-adapter.ts

@@ -18,6 +18,7 @@ import type {
 import { EventStream } from "@gsd/pi-ai";
 import { execSync } from "node:child_process";
 import { PartialMessageBuilder, ZERO_USAGE, mapUsage } from "./partial-builder.js";
+import { buildWorkflowMcpServers } from "../gsd/workflow-mcp.js";
 import type {
 	SDKAssistantMessage,
 	SDKMessage,
@@ -152,6 +153,89 @@ export function makeStreamExhaustedErrorMessage(model: string, lastTextContent:
 	return message;
 }
 
+/**
+ * Claude Code executes its own internal tool loop inside the SDK call. The
+ * streamed and final assistant messages should therefore contain only
+ * user-facing content (text/thinking), not replayable tool blocks that GSD
+ * would render again.
+ */
+function isUserFacingClaudeCodeBlock(block: AssistantMessage["content"][number]): boolean {
+	return block.type === "text" || block.type === "thinking";
+}
+
+function filterUserFacingClaudeCodeContent(
+	blocks: AssistantMessage["content"],
+): AssistantMessage["content"] {
+	return blocks.filter(isUserFacingClaudeCodeBlock);
+}
+
+function remapClaudeCodeContentIndex(
+	blocks: AssistantMessage["content"],
+	contentIndex: number,
+): number {
+	let visibleCount = 0;
+	for (let i = 0; i <= contentIndex && i < blocks.length; i++) {
+		if (isUserFacingClaudeCodeBlock(blocks[i]!)) visibleCount++;
+	}
+	return Math.max(0, visibleCount - 1);
+}
+
+function sanitizeClaudeCodePartial(
+	partial: AssistantMessage,
+): AssistantMessage {
+	return {
+		...partial,
+		content: filterUserFacingClaudeCodeContent(partial.content),
+	};
+}
+
+export function sanitizeClaudeCodeStreamingEvent(
+	event: AssistantMessageEvent,
+): AssistantMessageEvent | null {
+	switch (event.type) {
+		case "toolcall_start":
+		case "toolcall_delta":
+		case "toolcall_end":
+		case "server_tool_use":
+		case "web_search_result":
+			return null;
+		case "text_start":
+		case "text_delta":
+		case "text_end":
+		case "thinking_start":
+		case "thinking_delta":
+		case "thinking_end":
+			return {
+				...event,
+				contentIndex: remapClaudeCodeContentIndex(event.partial.content, event.contentIndex),
+				partial: sanitizeClaudeCodePartial(event.partial),
+			};
+		default:
+			return event;
+	}
+}
+
+export function buildFinalClaudeCodeContent(
+	blocks: AssistantMessage["content"],
+	lastThinkingContent: string,
+	lastTextContent: string,
+	resultText?: string,
+): AssistantMessage["content"] {
+	const finalContent = filterUserFacingClaudeCodeContent(blocks);
+	if (finalContent.length > 0) return finalContent;
+
+	if (lastThinkingContent) {
+		finalContent.push({ type: "thinking", thinking: lastThinkingContent });
+	}
+	if (lastTextContent) {
+		finalContent.push({ type: "text", text: lastTextContent });
+	}
+	if (finalContent.length === 0 && resultText) {
+		finalContent.push({ type: "text", text: resultText });
+	}
+	return finalContent;
+}
+
 // ---------------------------------------------------------------------------
 // SDK options builder
 // ---------------------------------------------------------------------------
@@ -163,6 +247,7 @@ export function makeStreamExhaustedErrorMessage(model: string, lastTextContent:
  * beta flags, and other configuration without mocking the full SDK.
  */
 export function buildSdkOptions(modelId: string, prompt: string): Record<string, unknown> {
+	const mcpServers = buildWorkflowMcpServers();
 	return {
 		pathToClaudeCodeExecutable: getClaudePath(),
 		model: modelId,
@@ -173,6 +258,7 @@ export function buildSdkOptions(modelId: string, prompt: string): Record<string,
 		allowDangerouslySkipPermissions: true,
 		settingSources: ["project"],
 		systemPrompt: { type: "preset", preset: "claude_code" },
+		...(mcpServers ? { mcpServers } : {}),
 		betas: modelId.includes("sonnet") ? ["context-1m-2025-08-07"] : [],
 	};
 }
@@ -211,8 +297,6 @@ async function pumpSdkMessages(
 	/** Track the last text content seen across all assistant turns for the final message. */
 	let lastTextContent = "";
 	let lastThinkingContent = "";
-	/** Collect tool calls from intermediate SDK turns for tool_execution events. */
-	const intermediateToolCalls: AssistantMessage["content"] = [];
 
 	try {
 		// Dynamic import — the SDK is an optional dependency.
@@ -281,16 +365,10 @@ async function pumpSdkMessages(
 					if (!builder) break;
 
 					const assistantEvent = builder.handleEvent(event);
-					if (assistantEvent) {
-						// Skip toolcall events — the agent loop's externalToolExecution
-						// path emits tool_execution_start/end events after streamSimple
-						// returns. Streaming toolcall events would render tool calls
-						// out of order in the TUI's accumulated message content.
-						const t = assistantEvent.type;
-						if (t !== "toolcall_start" && t !== "toolcall_delta" && t !== "toolcall_end") {
-							stream.push(assistantEvent);
-						}
-					}
+					const sanitizedEvent = assistantEvent
+						? sanitizeClaudeCodeStreamingEvent(assistantEvent)
+						: null;
+					if (sanitizedEvent) stream.push(sanitizedEvent);
 					break;
 				}
 
@@ -318,9 +396,6 @@ async function pumpSdkMessages(
 								lastTextContent = block.text;
 							} else if (block.type === "thinking" && block.thinking) {
 								lastThinkingContent = block.thinking;
-							} else if (block.type === "toolCall") {
-								// Collect tool calls for externalToolExecution rendering
-								intermediateToolCalls.push(block);
 							}
 						}
 					}
@@ -331,35 +406,12 @@ async function pumpSdkMessages(
 				// -- Result (terminal) --
 				case "result": {
 					const result = msg as SDKResultMessage;
-
-					// Build final message. Include intermediate tool calls so the
-					// agent loop's externalToolExecution path emits tool_execution
-					// events for proper TUI rendering, followed by the text response.
-					const finalContent: AssistantMessage["content"] = [];
-
-					// Add tool calls from intermediate turns first (renders above text)
-					finalContent.push(...intermediateToolCalls);
-
-					// Add text/thinking from the last turn
-					if (builder && builder.message.content.length > 0) {
-						for (const block of builder.message.content) {
-							if (block.type === "text" || block.type === "thinking") {
-								finalContent.push(block);
-							}
-						}
-					} else {
-						if (lastThinkingContent) {
-							finalContent.push({ type: "thinking", thinking: lastThinkingContent });
-						}
-						if (lastTextContent) {
-							finalContent.push({ type: "text", text: lastTextContent });
-						}
-					}
-
-					// Fallback: use the SDK's result text if we have no content
-					if (finalContent.length === 0 && result.subtype === "success" && result.result) {
-						finalContent.push({ type: "text", text: result.result });
-					}
+					const finalContent = buildFinalClaudeCodeContent(
+						builder?.message.content ?? [],
+						lastThinkingContent,
+						lastTextContent,
+						result.subtype === "success" ? result.result : undefined,
+					);
 
 					const finalMessage: AssistantMessage = {
 						role: "assistant",

package/src/resources/extensions/claude-code-cli/tests/stream-adapter.test.ts

@@ -1,13 +1,18 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
 import {
-	makeStreamExhaustedErrorMessage,
 	buildPromptFromContext,
+	buildFinalClaudeCodeContent,
 	buildSdkOptions,
 	getClaudeLookupCommand,
+	makeStreamExhaustedErrorMessage,
 	parseClaudeLookupOutput,
+	sanitizeClaudeCodeStreamingEvent,
 } from "../stream-adapter.ts";
-import type { Context, Message } from "@gsd/pi-ai";
+import type { AssistantMessage, Context, Message } from "@gsd/pi-ai";
 
 // ---------------------------------------------------------------------------
 // Existing tests — exhausted stream fallback (#2575)
@@ -127,6 +132,210 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			"non-sonnet models should have empty betas",
 		);
 	});
+
+	test("buildSdkOptions includes workflow MCP server config when env is set", () => {
+		const prev = {
+			GSD_WORKFLOW_MCP_COMMAND: process.env.GSD_WORKFLOW_MCP_COMMAND,
+			GSD_WORKFLOW_MCP_NAME: process.env.GSD_WORKFLOW_MCP_NAME,
+			GSD_WORKFLOW_MCP_ARGS: process.env.GSD_WORKFLOW_MCP_ARGS,
+			GSD_WORKFLOW_MCP_ENV: process.env.GSD_WORKFLOW_MCP_ENV,
+			GSD_WORKFLOW_MCP_CWD: process.env.GSD_WORKFLOW_MCP_CWD,
+		};
+		try {
+			process.env.GSD_WORKFLOW_MCP_COMMAND = "node";
+			process.env.GSD_WORKFLOW_MCP_NAME = "gsd-workflow";
+			process.env.GSD_WORKFLOW_MCP_ARGS = JSON.stringify(["packages/mcp-server/dist/cli.js"]);
+			process.env.GSD_WORKFLOW_MCP_ENV = JSON.stringify({ GSD_CLI_PATH: "/tmp/gsd" });
+			process.env.GSD_WORKFLOW_MCP_CWD = "/tmp/project";
+
+			const options = buildSdkOptions("claude-sonnet-4-20250514", "test");
+			assert.deepEqual(options.mcpServers, {
+				"gsd-workflow": {
+					command: "node",
+					args: ["packages/mcp-server/dist/cli.js"],
+					env: {
+						GSD_CLI_PATH: "/tmp/gsd",
+						GSD_PERSIST_WRITE_GATE_STATE: "1",
+						GSD_WORKFLOW_PROJECT_ROOT: "/tmp/project",
+					},
+					cwd: "/tmp/project",
+				},
+			});
+		} finally {
+			process.env.GSD_WORKFLOW_MCP_COMMAND = prev.GSD_WORKFLOW_MCP_COMMAND;
+			process.env.GSD_WORKFLOW_MCP_NAME = prev.GSD_WORKFLOW_MCP_NAME;
+			process.env.GSD_WORKFLOW_MCP_ARGS = prev.GSD_WORKFLOW_MCP_ARGS;
+			process.env.GSD_WORKFLOW_MCP_ENV = prev.GSD_WORKFLOW_MCP_ENV;
+			process.env.GSD_WORKFLOW_MCP_CWD = prev.GSD_WORKFLOW_MCP_CWD;
+		}
+	});
+
+	test("buildSdkOptions omits workflow MCP server config when env is unset", () => {
+		const prev = {
+			GSD_WORKFLOW_MCP_COMMAND: process.env.GSD_WORKFLOW_MCP_COMMAND,
+			GSD_WORKFLOW_MCP_NAME: process.env.GSD_WORKFLOW_MCP_NAME,
+			GSD_WORKFLOW_MCP_ARGS: process.env.GSD_WORKFLOW_MCP_ARGS,
+			GSD_WORKFLOW_MCP_ENV: process.env.GSD_WORKFLOW_MCP_ENV,
+			GSD_WORKFLOW_MCP_CWD: process.env.GSD_WORKFLOW_MCP_CWD,
+		};
+		try {
+			delete process.env.GSD_WORKFLOW_MCP_COMMAND;
+			delete process.env.GSD_WORKFLOW_MCP_NAME;
+			delete process.env.GSD_WORKFLOW_MCP_ARGS;
+			delete process.env.GSD_WORKFLOW_MCP_ENV;
+			delete process.env.GSD_WORKFLOW_MCP_CWD;
+
+			const originalCwd = process.cwd();
+			const emptyDir = mkdtempSync(join(tmpdir(), "claude-mcp-none-"));
+			process.chdir(emptyDir);
+			const options = buildSdkOptions("claude-sonnet-4-20250514", "test");
+			process.chdir(originalCwd);
+			assert.equal((options as any).mcpServers, undefined);
+			rmSync(emptyDir, { recursive: true, force: true });
+		} finally {
+			process.env.GSD_WORKFLOW_MCP_COMMAND = prev.GSD_WORKFLOW_MCP_COMMAND;
+			process.env.GSD_WORKFLOW_MCP_NAME = prev.GSD_WORKFLOW_MCP_NAME;
+			process.env.GSD_WORKFLOW_MCP_ARGS = prev.GSD_WORKFLOW_MCP_ARGS;
+			process.env.GSD_WORKFLOW_MCP_ENV = prev.GSD_WORKFLOW_MCP_ENV;
+			process.env.GSD_WORKFLOW_MCP_CWD = prev.GSD_WORKFLOW_MCP_CWD;
+		}
+	});
+
+	test("buildSdkOptions auto-detects local workflow MCP dist CLI when present", () => {
+		const prev = {
+			GSD_WORKFLOW_MCP_COMMAND: process.env.GSD_WORKFLOW_MCP_COMMAND,
+			GSD_WORKFLOW_MCP_NAME: process.env.GSD_WORKFLOW_MCP_NAME,
+			GSD_WORKFLOW_MCP_ARGS: process.env.GSD_WORKFLOW_MCP_ARGS,
+			GSD_WORKFLOW_MCP_ENV: process.env.GSD_WORKFLOW_MCP_ENV,
+			GSD_WORKFLOW_MCP_CWD: process.env.GSD_WORKFLOW_MCP_CWD,
+			GSD_CLI_PATH: process.env.GSD_CLI_PATH,
+		};
+		const originalCwd = process.cwd();
+		const repoDir = mkdtempSync(join(tmpdir(), "claude-mcp-detect-"));
+		try {
+			delete process.env.GSD_WORKFLOW_MCP_COMMAND;
+			delete process.env.GSD_WORKFLOW_MCP_NAME;
+			delete process.env.GSD_WORKFLOW_MCP_ARGS;
+			delete process.env.GSD_WORKFLOW_MCP_ENV;
+			delete process.env.GSD_WORKFLOW_MCP_CWD;
+			process.env.GSD_CLI_PATH = "/tmp/gsd";
+
+			const distDir = join(repoDir, "packages", "mcp-server", "dist");
+			mkdirSync(distDir, { recursive: true });
+			writeFileSync(join(distDir, "cli.js"), "#!/usr/bin/env node\n");
+			process.chdir(repoDir);
+			const resolvedRepoDir = realpathSync(repoDir);
+
+			const options = buildSdkOptions("claude-sonnet-4-20250514", "test");
+			assert.deepEqual(options.mcpServers, {
+				"gsd-workflow": {
+					command: process.execPath,
+					args: [realpathSync(resolve(repoDir, "packages", "mcp-server", "dist", "cli.js"))],
+					env: {
+						GSD_CLI_PATH: "/tmp/gsd",
+						GSD_PERSIST_WRITE_GATE_STATE: "1",
+						GSD_WORKFLOW_PROJECT_ROOT: resolvedRepoDir,
+					},
+					cwd: resolvedRepoDir,
+				},
+			});
+		} finally {
+			process.chdir(originalCwd);
+			rmSync(repoDir, { recursive: true, force: true });
+			process.env.GSD_WORKFLOW_MCP_COMMAND = prev.GSD_WORKFLOW_MCP_COMMAND;
+			process.env.GSD_WORKFLOW_MCP_NAME = prev.GSD_WORKFLOW_MCP_NAME;
+			process.env.GSD_WORKFLOW_MCP_ARGS = prev.GSD_WORKFLOW_MCP_ARGS;
+			process.env.GSD_WORKFLOW_MCP_ENV = prev.GSD_WORKFLOW_MCP_ENV;
+			process.env.GSD_WORKFLOW_MCP_CWD = prev.GSD_WORKFLOW_MCP_CWD;
+			process.env.GSD_CLI_PATH = prev.GSD_CLI_PATH;
+		}
+	});
+});
+
+describe("stream-adapter — final content filtering (#3861)", () => {
+	test("buildFinalClaudeCodeContent strips intermediate tool calls from the final assistant message", () => {
+		const finalContent = buildFinalClaudeCodeContent(
+			[
+				{ type: "toolCall", id: "tc_1", name: "Read", arguments: {} },
+				{ type: "thinking", thinking: "Planning next step" },
+				{ type: "text", text: "Done." },
+			] as any,
+			"",
+			"",
+		);
+
+		assert.deepEqual(finalContent, [
+			{ type: "thinking", thinking: "Planning next step" },
+			{ type: "text", text: "Done." },
+		]);
+	});
+
+	test("buildFinalClaudeCodeContent falls back to cached text when the final turn only had tool calls", () => {
+		const finalContent = buildFinalClaudeCodeContent(
+			[
+				{ type: "toolCall", id: "tc_2", name: "Edit", arguments: { file_path: "app.ts" } },
+			] as any,
+			"",
+			"User-facing answer",
+		);
+
+		assert.deepEqual(finalContent, [{ type: "text", text: "User-facing answer" }]);
+	});
+});
+
+describe("stream-adapter — streaming content filtering follow-up (#3867)", () => {
+	function makePartial(content: AssistantMessage["content"]): AssistantMessage {
+		return {
+			role: "assistant",
+			content,
+			api: "anthropic-messages",
+			provider: "claude-code",
+			model: "claude-sonnet-4-20250514",
+			usage: {
+				input: 0,
+				output: 0,
+				cacheRead: 0,
+				cacheWrite: 0,
+				totalTokens: 0,
+				cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+			},
+			stopReason: "stop",
+			timestamp: Date.now(),
+		};
+	}
+
+	test("sanitizeClaudeCodeStreamingEvent strips tool calls from streamed partials and remaps contentIndex", () => {
+		const event = sanitizeClaudeCodeStreamingEvent({
+			type: "text_delta",
+			contentIndex: 2,
+			delta: "Done.",
+			partial: makePartial([
+				{ type: "toolCall", id: "tc_1", name: "ToolSearch", arguments: {} },
+				{ type: "thinking", thinking: "Planning next step" },
+				{ type: "text", text: "Done." },
+			] as any),
+		});
+
+		assert.ok(event, "text events should still be forwarded");
+		assert.equal(event!.type, "text_delta");
+		assert.equal((event! as any).contentIndex, 1);
+		assert.deepEqual((event! as any).partial.content, [
+			{ type: "thinking", thinking: "Planning next step" },
+			{ type: "text", text: "Done." },
+		]);
+	});
+
+	test("sanitizeClaudeCodeStreamingEvent suppresses internal tool streaming events entirely", () => {
+		const event = sanitizeClaudeCodeStreamingEvent({
+			type: "toolcall_start",
+			contentIndex: 0,
+			partial: makePartial([
+				{ type: "toolCall", id: "tc_1", name: "Bash", arguments: {} },
+			] as any),
+		});
+
+		assert.equal(event, null);
+	});
 });
 
 describe("stream-adapter — Windows Claude path lookup (#3770)", () => {

package/src/resources/extensions/get-secrets-from-user.ts

@@ -47,6 +47,14 @@ function shellEscapeSingle(value: string): string {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
+function isSafeEnvVarKey(key: string): boolean {
+	return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
+}
+
+function isSupportedDeploymentEnvironment(env: string): boolean {
+	return env === "development" || env === "preview" || env === "production";
+}
+
 function hydrateProcessEnv(key: string, value: string): void {
 	// Make newly collected secrets immediately visible to the current session.
 	// Some extensions read process.env directly and do not reload .env on every call.
@@ -330,12 +338,22 @@ async function applySecrets(
 
 	if ((destination === "vercel" || destination === "convex") && opts.exec) {
 		const env = opts.environment ?? "development";
+		if (!isSupportedDeploymentEnvironment(env)) {
+			errors.push(`environment: unsupported target environment "${env}"`);
+			return { applied, errors };
+		}
 		for (const { key, value } of provided) {
+			if (!isSafeEnvVarKey(key)) {
+				errors.push(`${key}: invalid environment variable name`);
+				continue;
+			}
 			const cmd = destination === "vercel"
 				? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`
-				: `npx convex env set ${key} ${shellEscapeSingle(value)}`;
+				: "";
 			try {
-				const result = await opts.exec("sh", ["-c", cmd]);
+				const result = destination === "vercel"
+					? await opts.exec("sh", ["-c", cmd])
+					: await opts.exec("npx", ["convex", "env", "set", key, value]);
 				if (result.code !== 0) {
 					errors.push(`${key}: ${result.stderr.slice(0, 200)}`);
 				} else {

package/src/resources/extensions/gsd/auto/phases.ts

@@ -41,6 +41,10 @@ import { isDbAvailable, getMilestoneSlices } from "../gsd-db.js";
 import { resetEvidence } from "../safety/evidence-collector.js";
 import { createCheckpoint, cleanupCheckpoint, rollbackToCheckpoint } from "../safety/git-checkpoint.js";
 import { resolveSafetyHarnessConfig } from "../safety/safety-harness.js";
+import {
+  getWorkflowTransportSupportError,
+  getRequiredWorkflowToolsForAutoUnit,
+} from "../workflow-mcp.js";
 
 // ─── generateMilestoneReport ──────────────────────────────────────────────────
 
@@ -1216,6 +1220,27 @@ export async function runUnitPhase(
     ? `${(s.currentUnitModel as any).provider ?? ""}/${(s.currentUnitModel as any).id ?? ""}`
     : null;
 
+  const compatibilityError = getWorkflowTransportSupportError(
+    s.currentUnitModel?.provider ?? ctx.model?.provider,
+    getRequiredWorkflowToolsForAutoUnit(unitType),
+    {
+      projectRoot: s.basePath,
+      surface: "auto-mode",
+      unitType,
+      authMode: s.currentUnitModel?.provider
+        ? ctx.modelRegistry.getProviderAuthMode(s.currentUnitModel.provider)
+        : ctx.model?.provider
+          ? ctx.modelRegistry.getProviderAuthMode(ctx.model.provider)
+          : undefined,
+      baseUrl: (s.currentUnitModel as any)?.baseUrl ?? ctx.model?.baseUrl,
+    },
+  );
+  if (compatibilityError) {
+    ctx.ui.notify(compatibilityError, "error");
+    await deps.stopAuto(ctx, pi, compatibilityError);
+    return { action: "break", reason: "workflow-capability" };
+  }
+
   // Progress widget + preconditions — deferred to after model selection so the
   // widget's first render tick shows the correct model (#2899).
   deps.updateProgressWidget(ctx, unitType, unitId, state);