gsd-pi 2.71.0-dev.e17e0ce → 2.72.0-dev.3118184

package/README.md

@@ -40,12 +40,34 @@ One command. Walk away. Come back to a built project with clean git history.
 - **isError flag propagation** — workflow tool execution failures now correctly return `isError: true`, so MCP clients can distinguish success from failure.
 - **Multi-round discuss questions** — new-project discuss phase supports multi-round questioning with structured question gates.
 
-### TUI Fixes
+### Model Selection Hardening
 
+- **Unconfigured models blocked** — models without a configured provider are filtered from selection surfaces, preventing dispatch failures.
+- **Provider readiness required** — saved default model selection now verifies the provider is ready before accepting it.
+- **Session override honored** — `/gsd model` selection persists as a session override across all dispatch phases.
+- **Minimal context guard** — model override logic is skipped in minimal command contexts where it doesn't apply.
+
+### Auto-Mode Resilience
+
+- **Credential cooldown recovery** — auto-mode survives transient 429 rate-limit responses with structured cooldown errors and a bounded retry budget.
+- **Fire-and-forget auto start** — auto start is detached from active turns to prevent blocking.
+- **Scoped forensics** — stuck-loop forensics are now scoped to auto sessions only, preventing false positives in interactive use.
+
+### TUI Improvements
+
+- **Overlay subscription fix** — resolved overlay subscription lifecycle and `Ctrl+Shift+P` shortcut conflict.
+- **Improved overlays and shortcuts** — GSD overlays, keyboard shortcuts, and notification flows redesigned for consistency.
 - **Pinned output restored** — pinned output bar displays above the editor during tool execution again.
 - **Turn completion cleanup** — pinned latest output is cleared on turn completion, preventing stale output from persisting.
 - **Secure input masking** — extension input values are masked in interactive mode when collecting secrets.
 
+### Provider Fixes
+
+- **Full OAuth login URLs** — OAuth login URLs are now displayed in full instead of being truncated.
+- **MiniMax bearer auth** — MiniMax Anthropic API requests use proper bearer authentication.
+- **Case-insensitive tool rendering** — renderable tool matching is now case-insensitive, fixing missed tool output.
+- **Headless idle timeout** — idle timeout is kept off during interactive tool execution in headless mode.
+
 ### Reliability & Internals
 
 - **TOCTOU file locking** — race conditions in event log and custom workflow graph file locking are fixed with proper atomic lock acquisition.
@@ -54,6 +76,9 @@ One command. Walk away. Come back to a built project with clean git history.
 - **Model routing transparency** — dynamic routing is skipped for interactive dispatches; model changes are always shown in the banner.
 - **Capability-aware routing (ADR-004)** — full implementation of capability scoring, `before_model_select` hook, and task metadata extraction.
 - **Multi-model provider strategy (ADR-005)** — infrastructure for multi-provider model selection wired into live paths.
+- **Anti-fabrication guardrails** — discuss prompts enforce turn-taking to prevent fabricated user responses.
+- **Milestone worktree cleanup** — merged worktree cleanup uses the milestone branch instead of generic lookups.
+- **Tool cache control** — `cache_control` breakpoints added to tool definitions for improved prompt caching.
 
 See the full [Changelog](./CHANGELOG.md) for details on every release.
 
@@ -598,8 +623,10 @@ The best practice for working in teams is to ensure unique milestone names acros
 # ── GSD: Runtime / Ephemeral (per-developer, per-session) ──────────────────
 # Crash detection sentinel — PID lock, written per auto-mode session
 .gsd/auto.lock
-# Auto-mode dispatch tracker — prevents re-running completed units
-.gsd/completed-units.json
+# Auto-mode dispatch tracker — prevents re-running completed units (includes archived per-milestone files)
+.gsd/completed-units*.json
+# State manifest — workflow state for recovery
+.gsd/state-manifest.json
 # Derived state cache — regenerated from plan/roadmap files on disk
 .gsd/STATE.md
 # Per-developer token/cost accumulator
@@ -612,6 +639,14 @@ The best practice for working in teams is to ensure unique milestone names acros
 .gsd/worktrees/
 # Parallel orchestration IPC and worker status
 .gsd/parallel/
+# SQLite database and WAL sidecars — checkpoint state, forensics data
+.gsd/gsd.db*
+# Daily-rotated event journal — structured event log for forensics
+.gsd/journal/
+# Doctor run history — diagnostic check results
+.gsd/doctor-history.jsonl
+# Workflow event log — structured event stream
+.gsd/event-log.jsonl
 # Generated HTML reports (regenerable via /gsd export --html)
 .gsd/reports/
 # Session-specific interrupted-work markers
@@ -732,6 +767,14 @@ Use expensive models where quality matters (planning, complex execution) and che
 
 ---
 
+## Ecosystem
+
+| Project | Description |
+| ------- | ----------- |
+| [GSD2 Config Utility](https://github.com/jeremymcs/gsd2-config) | Standalone configuration tool for managing GSD preferences, providers, and API keys |
+
+---
+
 ## Star History
 
 <a href="https://star-history.com/#gsd-build/gsd-2&Date">

package/dist/cli.js

@@ -5,8 +5,7 @@ import { agentDir, sessionsDir, authFilePath } from './app-paths.js';
 import { initResources, buildResourceLoader, getNewerManagedResourceVersion } from './resource-loader.js';
 import { ensureManagedTools } from './tool-bootstrap.js';
 import { loadStoredEnvKeys } from './wizard.js';
-import { migratePiCredentials } from './pi-migration.js';
-import { validateConfiguredModel } from './startup-model-validation.js';
+import { migratePiCredentials, getPiDefaultModelAndProvider } from './pi-migration.js';
 import { shouldMigrateAnthropicToClaudeCode } from './provider-migrations.js';
 import { shouldRunOnboarding, runOnboarding } from './onboarding.js';
 import chalk from 'chalk';
@@ -102,6 +101,41 @@ function parseCliArgs(argv) {
     }
     return flags;
 }
+/**
+ * Validate the configured default model against the registry and reset it if
+ * it no longer exists.  Must run AFTER extensions have registered their
+ * providers so that extension models (e.g. pi-claude-cli) are visible.
+ */
+function validateConfiguredModel(modelRegistry, settingsManager) {
+    const configuredProvider = settingsManager.getDefaultProvider();
+    const configuredModel = settingsManager.getDefaultModel();
+    const allModels = modelRegistry.getAll();
+    const availableModels = modelRegistry.getAvailable();
+    const configuredExists = configuredProvider && configuredModel &&
+        allModels.some((m) => m.provider === configuredProvider && m.id === configuredModel);
+    const configuredAvailable = configuredProvider && configuredModel &&
+        availableModels.some((m) => m.provider === configuredProvider && m.id === configuredModel);
+    if (!configuredModel || !configuredExists) {
+        // Model not configured at all, or removed from registry — pick a fallback.
+        // Only fires when the model is genuinely unknown (not just temporarily unavailable).
+        const piDefault = getPiDefaultModelAndProvider();
+        const preferred = (piDefault
+            ? availableModels.find((m) => m.provider === piDefault.provider && m.id === piDefault.model)
+            : undefined) ||
+            availableModels.find((m) => m.provider === 'openai' && m.id === 'gpt-5.4') ||
+            availableModels.find((m) => m.provider === 'openai') ||
+            availableModels.find((m) => m.provider === 'anthropic' && m.id === 'claude-opus-4-6') ||
+            availableModels.find((m) => m.provider === 'anthropic' && m.id.includes('opus')) ||
+            availableModels.find((m) => m.provider === 'anthropic') ||
+            availableModels[0];
+        if (preferred) {
+            settingsManager.setDefaultModelAndProvider(preferred.provider, preferred.id);
+        }
+    }
+    if (settingsManager.getDefaultThinkingLevel() !== 'off' && !configuredExists) {
+        settingsManager.setDefaultThinkingLevel('off');
+    }
+}
 const cliFlags = parseCliArgs(process.argv);
 const isPrintMode = cliFlags.print || cliFlags.mode !== undefined;
 // Early resource-skew check — must run before TTY gate so version mismatch
@@ -234,6 +268,14 @@ if (cliFlags.messages[0] === 'sessions') {
         rl.question(chalk.bold('  Enter session number to resume (or q to quit): '), resolve);
     });
     rl.close();
+    // Clean up stdin state left by readline.createInterface().
+    // Without this, downstream TUI initialization gets corrupted listeners and exhibits
+    // duplicate terminal I/O. Match the pattern used after onboarding cleanup.
+    process.stdin.removeAllListeners('data');
+    process.stdin.removeAllListeners('keypress');
+    if (process.stdin.setRawMode)
+        process.stdin.setRawMode(false);
+    process.stdin.pause();
     const choice = parseInt(answer, 10);
     if (isNaN(choice) || choice < 1 || choice > toShow.length) {
         process.stderr.write(chalk.dim('Cancelled.\n'));
@@ -312,8 +354,22 @@ if (!isPrintMode) {
 if (!isPrintMode && process.stdout.columns && process.stdout.columns < 40) {
     process.stderr.write(chalk.yellow(`[gsd] Terminal width is ${process.stdout.columns} columns (minimum recommended: 40). Output may be unreadable.\n`));
 }
-// --list-models: print available models and exit (no TTY needed)
+// --list-models: load extensions so that extension-registered providers (e.g.
+// pi-claude-cli) appear in the listing, then flush their pending registrations
+// into the model registry before printing.
 if (cliFlags.listModels !== undefined) {
+    exitIfManagedResourcesAreNewer(agentDir);
+    initResources(agentDir);
+    const listModelsLoader = new DefaultResourceLoader({
+        agentDir,
+        additionalExtensionPaths: cliFlags.extensions.length > 0 ? cliFlags.extensions : undefined,
+    });
+    await listModelsLoader.reload();
+    const listModelsExtensions = listModelsLoader.getExtensions();
+    for (const { name, config } of listModelsExtensions.runtime.pendingProviderRegistrations) {
+        modelRegistry.registerProvider(name, config);
+    }
+    listModelsExtensions.runtime.pendingProviderRegistrations = [];
     const models = modelRegistry.getAvailable();
     if (models.length === 0) {
         console.log('No models available. Set API keys in environment variables.');
@@ -453,6 +509,10 @@ if (isPrintMode) {
             process.stderr.write(`[gsd] ${prefix}: ${err.error}\n`);
         }
     }
+    // Validate configured model now that extension providers are registered.
+    // Must run after createAgentSession() which flushes pendingProviderRegistrations
+    // so extension models (e.g. pi-claude-cli) are visible in the registry.
+    validateConfiguredModel(modelRegistry, settingsManager);
     // Apply --model override if specified
     if (cliFlags.model) {
         const available = modelRegistry.getAvailable();
@@ -471,6 +531,15 @@ if (isPrintMode) {
     if (mode === 'mcp') {
         printStartupTimings();
         const { startMcpServer } = await import('./mcp-server.js');
+        // Activate every registered tool before starting the MCP transport.
+        // `session.agent.state.tools` is the *active* subset, not the full
+        // registry — if we expose only the active set, extension-registered
+        // tools (gsd workflow, browser-tools, mac-tools, search-the-web, …)
+        // are invisible to MCP clients. Flipping the active set to every
+        // known tool name makes `state.tools` mirror the full registry for
+        // this MCP session, which is what an external client expects.
+        const allToolNames = session.getAllTools().map((t) => t.name);
+        session.setActiveToolsByName(allToolNames);
         await startMcpServer({
             tools: session.agent.state.tools ?? [],
             version: process.env.GSD_VERSION || '0.0.0',
@@ -631,6 +700,10 @@ if (extensionsResult.errors.length > 0) {
         process.stderr.write(`[gsd] ${prefix}: ${err.error}\n`);
     }
 }
+// Validate configured model now that extension providers are registered.
+// Must run after createAgentSession() which flushes pendingProviderRegistrations
+// so extension models (e.g. pi-claude-cli) are visible in the registry.
+validateConfiguredModel(modelRegistry, settingsManager);
 // Restore scoped models from settings on startup.
 // The upstream InteractiveMode reads enabledModels from settings when /scoped-models is opened,
 // but doesn't apply them to the session at startup — so Ctrl+P cycles all models instead of

package/dist/mcp-server.js

@@ -1,10 +1,15 @@
-// MCP SDK subpath imports use wildcard exports (./*) that NodeNext resolves
-// at runtime but TypeScript cannot statically type-check. We construct the
-// specifiers dynamically so tsc treats them as `any`.
+// MCP SDK subpath imports use wildcard exports (./*) in @modelcontextprotocol/sdk's
+// package.json export map. The wildcard maps "./foo" → "./dist/cjs/foo" (no .js
+// suffix), so bare subpath specifiers like `${MCP_PKG}/server/stdio` resolve to
+// a non-existent file. Historically the workaround (#3603) used createRequire so
+// the CJS resolver could auto-append `.js`; that no longer works with current
+// Node + SDK releases (#3914) — `_require.resolve` also fails with
+// "Cannot find module .../dist/cjs/server/stdio".
 //
-// Use explicit .js subpaths for modules that are loaded dynamically at runtime.
-// Recent Node / SDK combinations do not reliably resolve the extensionless
-// wildcard targets for `server/stdio` and `types` (#3914).
+// The reliable convention (matching packages/mcp-server/{server,cli}.ts) is to
+// write the `.js` suffix explicitly on every wildcard subpath. Specifiers are
+// built via a template string so TypeScript's NodeNext resolver treats them as
+// `any` and skips static checking.
 const MCP_PKG = '@modelcontextprotocol/sdk';
 /**
  * Starts a native MCP (Model Context Protocol) server over stdin/stdout.
@@ -22,7 +27,7 @@ const MCP_PKG = '@modelcontextprotocol/sdk';
  */
 export async function startMcpServer(options) {
     const { tools, version = '0.0.0' } = options;
-    const serverMod = await import(`${MCP_PKG}/server`);
+    const serverMod = await import(`${MCP_PKG}/server/index.js`);
     const stdioMod = await import(`${MCP_PKG}/server/stdio.js`);
     const typesMod = await import(`${MCP_PKG}/types.js`);
     const Server = serverMod.Server;
@@ -42,8 +47,14 @@ export async function startMcpServer(options) {
             inputSchema: t.parameters,
         })),
     }));
-    // tools/call — execute the requested tool and return content blocks
-    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    // tools/call — execute the requested tool and return content blocks.
+    //
+    // The MCP SDK passes an `extra` argument to request handlers that includes
+    // an AbortSignal scoped to the RPC request (cancelled when the client
+    // cancels the tool call or the transport closes). Threading it into
+    // AgentTool.execute ensures long-running tools (Bash, WebFetch, grep on
+    // huge trees) actually stop when the client gives up on the result.
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
         const { name, arguments: args } = request.params;
         const tool = toolMap.get(name);
         if (!tool) {
@@ -52,20 +63,32 @@ export async function startMcpServer(options) {
                 content: [{ type: 'text', text: `Unknown tool: ${name}` }],
             };
         }
+        const signal = extra?.signal;
         try {
-            const result = await tool.execute(`mcp-${Date.now()}`, args ?? {}, undefined, // no AbortSignal
-            undefined);
-            // Convert AgentToolResult content blocks to MCP content format
+            const result = await tool.execute(`mcp-${Date.now()}`, args ?? {}, signal, undefined);
+            // Convert AgentToolResult content blocks to MCP content format.
+            // text and image pass through; any other shape is serialized as text
+            // so the client sees the payload rather than an empty response.
             const content = result.content.map((block) => {
                 if (block.type === 'text')
                     return { type: 'text', text: block.text ?? '' };
-                if (block.type === 'image')
-                    return { type: 'image', data: block.data ?? '', mimeType: block.mimeType ?? 'image/png' };
+                if (block.type === 'image') {
+                    return {
+                        type: 'image',
+                        data: block.data ?? '',
+                        mimeType: block.mimeType ?? 'image/png',
+                    };
+                }
+                // Preserve unknown block types (resource, resource_link, audio, ...)
+                // by stringifying into a text block so clients see the payload.
                 return { type: 'text', text: JSON.stringify(block) };
             });
             return { content };
         }
         catch (err) {
+            // AbortError from a cancelled tool surfaces as a normal error — MCP
+            // clients interpret `isError: true` as a failed call, which is the
+            // correct behaviour for a cancelled request.
             const message = err instanceof Error ? err.message : String(err);
             return { isError: true, content: [{ type: 'text', text: message }] };
         }

package/dist/onboarding.js

@@ -277,6 +277,16 @@ async function runLlmStep(p, pc, authStorage) {
         p.log.info('Your Claude subscription will be used for inference. No API key needed.');
         // Store sentinel so hasAuth('claude-code') returns true on future boots
         authStorage.set('claude-code', { type: 'api_key', key: 'cli' });
+        // Persist claude-code as the default provider so the startup migration in
+        // cli.ts does not need to fire and the user is not left on "anthropic".
+        const settingsPath = join(agentDir, 'settings.json');
+        try {
+            const raw = existsSync(settingsPath) ? JSON.parse(readFileSync(settingsPath, 'utf-8')) : {};
+            raw.defaultProvider = 'claude-code';
+            mkdirSync(dirname(settingsPath), { recursive: true });
+            writeFileSync(settingsPath, JSON.stringify(raw, null, 2), 'utf-8');
+        }
+        catch { /* non-fatal — startup migration will catch it */ }
         return true;
     }
     // ── Step 2: Which provider? ──────────────────────────────────────────────

package/dist/resources/agents/debugger.md

@@ -0,0 +1,58 @@
+---
+name: debugger
+description: Hypothesis-driven bug investigation with root cause analysis
+model: sonnet
+---
+
+You are a debugger. Investigate bugs using a systematic, hypothesis-driven approach. Your goal is to find the root cause, not just suppress symptoms.
+
+## Process
+
+1. **Reproduce**: Understand the symptoms — what happens vs. what should happen
+2. **Hypothesize**: List 2-3 most likely causes based on symptoms
+3. **Investigate**: For each hypothesis, gather evidence (read code, check logs, trace execution)
+4. **Narrow**: Eliminate hypotheses that don't match the evidence
+5. **Root cause**: Identify the actual cause with file:line references
+6. **Fix**: Propose the minimal change that addresses the root cause
+
+## Investigation Tools
+
+- Read source files at specific line ranges
+- Grep for error messages, function names, variable usage
+- Check git blame for recent changes to suspect areas
+- Read test files to understand expected behavior
+- Run tests to reproduce failures
+
+## Output Format
+
+## Symptoms
+
+What's happening vs. what's expected.
+
+## Hypotheses
+
+1. **[hypothesis]** — why this could be the cause
+2. **[hypothesis]** — why this could be the cause
+
+## Investigation
+
+### Hypothesis 1: [name]
+
+Evidence gathered, files read, what was found.
+**Verdict:** Confirmed / Eliminated — reason.
+
+### Hypothesis 2: [name]
+
+(same structure)
+
+## Root Cause
+
+**File:** `path/to/file.ts:42`
+**Cause:** Clear explanation of the bug.
+**Why it wasn't caught:** Missing test, edge case, etc.
+
+## Recommended Fix
+
+```typescript
+// minimal fix with explanation
+```

package/dist/resources/agents/doc-writer.md

@@ -0,0 +1,43 @@
+---
+name: doc-writer
+description: Documentation generation from code — API docs, inline comments, READMEs
+model: sonnet
+---
+
+You are a documentation specialist. You read code and produce clear, accurate documentation. You write for the reader, not the author — explain what they need to know to use or maintain the code.
+
+## Process
+
+1. Read the code thoroughly — understand what it does, not just how
+2. Identify the audience — users (API docs), maintainers (inline docs), or newcomers (guides)
+3. Write documentation that answers the reader's actual questions
+4. Verify accuracy — every code reference must match the current implementation
+
+## Documentation Types
+
+- **API docs**: Function signatures, parameters, return values, examples, error cases
+- **Inline comments**: Explain *why*, not *what* — the code shows what, comments explain intent
+- **Module docs**: What this module does, its public API, and how it fits in the architecture
+- **Guides**: Step-by-step instructions for common tasks with working examples
+
+## Quality Rules
+
+- Every claim must be verifiable against the current code
+- Examples must be working code, not pseudocode
+- Don't document the obvious — focus on non-obvious behavior, gotchas, and edge cases
+- Keep it concise — more docs isn't better docs
+- Use the project's existing documentation style and format
+
+## Output Format
+
+## Documentation Plan
+
+What to document and for whom.
+
+## Documentation
+
+(The actual documentation content, formatted appropriately for its type)
+
+## Accuracy Check
+
+Files referenced and verified against current implementation.

package/dist/resources/agents/git-ops.md

@@ -0,0 +1,56 @@
+---
+name: git-ops
+description: Conflict resolution, rebase strategy, PR preparation, and changelog generation
+model: sonnet
+---
+
+You are a git operations specialist. You handle merge conflicts, plan rebase strategies, prepare pull requests, and generate changelogs. You understand git internals well enough to choose the right strategy for each situation.
+
+## Capabilities
+
+### Conflict Resolution
+- Analyze conflict markers and understand both sides' intent
+- Choose the correct resolution based on code context, not just recency
+- Verify resolved code compiles and tests pass
+
+### Rebase Strategy
+- Assess whether rebase or merge is appropriate for the situation
+- Plan interactive rebase sequences (squash, reorder, edit)
+- Handle complex rebase conflicts with minimal manual intervention
+
+### PR Preparation
+- Write clear PR titles and descriptions from commit history
+- Organize commits into logical, reviewable units
+- Ensure CI checks will pass before pushing
+
+### Changelog Generation
+- Extract user-facing changes from commit messages and code diffs
+- Categorize changes (features, fixes, breaking changes)
+- Write changelog entries for the target audience (users, not developers)
+
+## Process
+
+1. Assess the git state — branches, commits, conflicts, divergence
+2. Determine the goal — clean history, resolved conflicts, PR ready
+3. Plan the steps — in order, with rollback points
+4. Execute carefully — verify after each step
+5. Confirm the result — clean history, passing tests
+
+## Output Format
+
+## Git State
+
+Current branch, commits, conflicts, or divergence summary.
+
+## Strategy
+
+What to do and why this approach.
+
+## Steps
+
+1. Command or action — with expected outcome
+2. Command or action — with verification
+
+## Result
+
+Final state after operations complete.