gsd-pi 2.71.0-dev.e17e0ce → 2.72.0-dev.593fa74

package/README.md

@@ -40,12 +40,34 @@ One command. Walk away. Come back to a built project with clean git history.
 - **isError flag propagation** — workflow tool execution failures now correctly return `isError: true`, so MCP clients can distinguish success from failure.
 - **Multi-round discuss questions** — new-project discuss phase supports multi-round questioning with structured question gates.
 
-### TUI Fixes
+### Model Selection Hardening
 
+- **Unconfigured models blocked** — models without a configured provider are filtered from selection surfaces, preventing dispatch failures.
+- **Provider readiness required** — saved default model selection now verifies the provider is ready before accepting it.
+- **Session override honored** — `/gsd model` selection persists as a session override across all dispatch phases.
+- **Minimal context guard** — model override logic is skipped in minimal command contexts where it doesn't apply.
+
+### Auto-Mode Resilience
+
+- **Credential cooldown recovery** — auto-mode survives transient 429 rate-limit responses with structured cooldown errors and a bounded retry budget.
+- **Fire-and-forget auto start** — auto start is detached from active turns to prevent blocking.
+- **Scoped forensics** — stuck-loop forensics are now scoped to auto sessions only, preventing false positives in interactive use.
+
+### TUI Improvements
+
+- **Overlay subscription fix** — resolved overlay subscription lifecycle and `Ctrl+Shift+P` shortcut conflict.
+- **Improved overlays and shortcuts** — GSD overlays, keyboard shortcuts, and notification flows redesigned for consistency.
 - **Pinned output restored** — pinned output bar displays above the editor during tool execution again.
 - **Turn completion cleanup** — pinned latest output is cleared on turn completion, preventing stale output from persisting.
 - **Secure input masking** — extension input values are masked in interactive mode when collecting secrets.
 
+### Provider Fixes
+
+- **Full OAuth login URLs** — OAuth login URLs are now displayed in full instead of being truncated.
+- **MiniMax bearer auth** — MiniMax Anthropic API requests use proper bearer authentication.
+- **Case-insensitive tool rendering** — renderable tool matching is now case-insensitive, fixing missed tool output.
+- **Headless idle timeout** — idle timeout is kept off during interactive tool execution in headless mode.
+
 ### Reliability & Internals
 
 - **TOCTOU file locking** — race conditions in event log and custom workflow graph file locking are fixed with proper atomic lock acquisition.
@@ -54,6 +76,9 @@ One command. Walk away. Come back to a built project with clean git history.
 - **Model routing transparency** — dynamic routing is skipped for interactive dispatches; model changes are always shown in the banner.
 - **Capability-aware routing (ADR-004)** — full implementation of capability scoring, `before_model_select` hook, and task metadata extraction.
 - **Multi-model provider strategy (ADR-005)** — infrastructure for multi-provider model selection wired into live paths.
+- **Anti-fabrication guardrails** — discuss prompts enforce turn-taking to prevent fabricated user responses.
+- **Milestone worktree cleanup** — merged worktree cleanup uses the milestone branch instead of generic lookups.
+- **Tool cache control** — `cache_control` breakpoints added to tool definitions for improved prompt caching.
 
 See the full [Changelog](./CHANGELOG.md) for details on every release.
 
@@ -732,6 +757,14 @@ Use expensive models where quality matters (planning, complex execution) and che
 
 ---
 
+## Ecosystem
+
+| Project | Description |
+| ------- | ----------- |
+| [GSD2 Config Utility](https://github.com/jeremymcs/gsd2-config) | Standalone configuration tool for managing GSD preferences, providers, and API keys |
+
+---
+
 ## Star History
 
 <a href="https://star-history.com/#gsd-build/gsd-2&Date">

package/dist/cli.js

@@ -234,6 +234,14 @@ if (cliFlags.messages[0] === 'sessions') {
         rl.question(chalk.bold('  Enter session number to resume (or q to quit): '), resolve);
     });
     rl.close();
+    // Clean up stdin state left by readline.createInterface().
+    // Without this, downstream TUI initialization gets corrupted listeners and exhibits
+    // duplicate terminal I/O. Match the pattern used after onboarding cleanup.
+    process.stdin.removeAllListeners('data');
+    process.stdin.removeAllListeners('keypress');
+    if (process.stdin.setRawMode)
+        process.stdin.setRawMode(false);
+    process.stdin.pause();
     const choice = parseInt(answer, 10);
     if (isNaN(choice) || choice < 1 || choice > toShow.length) {
         process.stderr.write(chalk.dim('Cancelled.\n'));
@@ -471,6 +479,15 @@ if (isPrintMode) {
     if (mode === 'mcp') {
         printStartupTimings();
         const { startMcpServer } = await import('./mcp-server.js');
+        // Activate every registered tool before starting the MCP transport.
+        // `session.agent.state.tools` is the *active* subset, not the full
+        // registry — if we expose only the active set, extension-registered
+        // tools (gsd workflow, browser-tools, mac-tools, search-the-web, …)
+        // are invisible to MCP clients. Flipping the active set to every
+        // known tool name makes `state.tools` mirror the full registry for
+        // this MCP session, which is what an external client expects.
+        const allToolNames = session.getAllTools().map((t) => t.name);
+        session.setActiveToolsByName(allToolNames);
         await startMcpServer({
             tools: session.agent.state.tools ?? [],
             version: process.env.GSD_VERSION || '0.0.0',

package/dist/mcp-server.js

@@ -1,10 +1,15 @@
-// MCP SDK subpath imports use wildcard exports (./*) that NodeNext resolves
-// at runtime but TypeScript cannot statically type-check. We construct the
-// specifiers dynamically so tsc treats them as `any`.
+// MCP SDK subpath imports use wildcard exports (./*) in @modelcontextprotocol/sdk's
+// package.json export map. The wildcard maps "./foo" → "./dist/cjs/foo" (no .js
+// suffix), so bare subpath specifiers like `${MCP_PKG}/server/stdio` resolve to
+// a non-existent file. Historically the workaround (#3603) used createRequire so
+// the CJS resolver could auto-append `.js`; that no longer works with current
+// Node + SDK releases (#3914) — `_require.resolve` also fails with
+// "Cannot find module .../dist/cjs/server/stdio".
 //
-// Use explicit .js subpaths for modules that are loaded dynamically at runtime.
-// Recent Node / SDK combinations do not reliably resolve the extensionless
-// wildcard targets for `server/stdio` and `types` (#3914).
+// The reliable convention (matching packages/mcp-server/{server,cli}.ts) is to
+// write the `.js` suffix explicitly on every wildcard subpath. Specifiers are
+// built via a template string so TypeScript's NodeNext resolver treats them as
+// `any` and skips static checking.
 const MCP_PKG = '@modelcontextprotocol/sdk';
 /**
  * Starts a native MCP (Model Context Protocol) server over stdin/stdout.
@@ -22,7 +27,7 @@ const MCP_PKG = '@modelcontextprotocol/sdk';
  */
 export async function startMcpServer(options) {
     const { tools, version = '0.0.0' } = options;
-    const serverMod = await import(`${MCP_PKG}/server`);
+    const serverMod = await import(`${MCP_PKG}/server/index.js`);
     const stdioMod = await import(`${MCP_PKG}/server/stdio.js`);
     const typesMod = await import(`${MCP_PKG}/types.js`);
     const Server = serverMod.Server;
@@ -42,8 +47,14 @@ export async function startMcpServer(options) {
             inputSchema: t.parameters,
         })),
     }));
-    // tools/call — execute the requested tool and return content blocks
-    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    // tools/call — execute the requested tool and return content blocks.
+    //
+    // The MCP SDK passes an `extra` argument to request handlers that includes
+    // an AbortSignal scoped to the RPC request (cancelled when the client
+    // cancels the tool call or the transport closes). Threading it into
+    // AgentTool.execute ensures long-running tools (Bash, WebFetch, grep on
+    // huge trees) actually stop when the client gives up on the result.
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
         const { name, arguments: args } = request.params;
         const tool = toolMap.get(name);
         if (!tool) {
@@ -52,20 +63,32 @@ export async function startMcpServer(options) {
                 content: [{ type: 'text', text: `Unknown tool: ${name}` }],
             };
         }
+        const signal = extra?.signal;
         try {
-            const result = await tool.execute(`mcp-${Date.now()}`, args ?? {}, undefined, // no AbortSignal
-            undefined);
-            // Convert AgentToolResult content blocks to MCP content format
+            const result = await tool.execute(`mcp-${Date.now()}`, args ?? {}, signal, undefined);
+            // Convert AgentToolResult content blocks to MCP content format.
+            // text and image pass through; any other shape is serialized as text
+            // so the client sees the payload rather than an empty response.
             const content = result.content.map((block) => {
                 if (block.type === 'text')
                     return { type: 'text', text: block.text ?? '' };
-                if (block.type === 'image')
-                    return { type: 'image', data: block.data ?? '', mimeType: block.mimeType ?? 'image/png' };
+                if (block.type === 'image') {
+                    return {
+                        type: 'image',
+                        data: block.data ?? '',
+                        mimeType: block.mimeType ?? 'image/png',
+                    };
+                }
+                // Preserve unknown block types (resource, resource_link, audio, ...)
+                // by stringifying into a text block so clients see the payload.
                 return { type: 'text', text: JSON.stringify(block) };
             });
             return { content };
         }
         catch (err) {
+            // AbortError from a cancelled tool surfaces as a normal error — MCP
+            // clients interpret `isError: true` as a failed call, which is the
+            // correct behaviour for a cancelled request.
             const message = err instanceof Error ? err.message : String(err);
             return { isError: true, content: [{ type: 'text', text: message }] };
         }

package/dist/resources/agents/debugger.md

@@ -0,0 +1,58 @@
+---
+name: debugger
+description: Hypothesis-driven bug investigation with root cause analysis
+model: sonnet
+---
+
+You are a debugger. Investigate bugs using a systematic, hypothesis-driven approach. Your goal is to find the root cause, not just suppress symptoms.
+
+## Process
+
+1. **Reproduce**: Understand the symptoms — what happens vs. what should happen
+2. **Hypothesize**: List 2-3 most likely causes based on symptoms
+3. **Investigate**: For each hypothesis, gather evidence (read code, check logs, trace execution)
+4. **Narrow**: Eliminate hypotheses that don't match the evidence
+5. **Root cause**: Identify the actual cause with file:line references
+6. **Fix**: Propose the minimal change that addresses the root cause
+
+## Investigation Tools
+
+- Read source files at specific line ranges
+- Grep for error messages, function names, variable usage
+- Check git blame for recent changes to suspect areas
+- Read test files to understand expected behavior
+- Run tests to reproduce failures
+
+## Output Format
+
+## Symptoms
+
+What's happening vs. what's expected.
+
+## Hypotheses
+
+1. **[hypothesis]** — why this could be the cause
+2. **[hypothesis]** — why this could be the cause
+
+## Investigation
+
+### Hypothesis 1: [name]
+
+Evidence gathered, files read, what was found.
+**Verdict:** Confirmed / Eliminated — reason.
+
+### Hypothesis 2: [name]
+
+(same structure)
+
+## Root Cause
+
+**File:** `path/to/file.ts:42`
+**Cause:** Clear explanation of the bug.
+**Why it wasn't caught:** Missing test, edge case, etc.
+
+## Recommended Fix
+
+```typescript
+// minimal fix with explanation
+```

package/dist/resources/agents/doc-writer.md

@@ -0,0 +1,43 @@
+---
+name: doc-writer
+description: Documentation generation from code — API docs, inline comments, READMEs
+model: sonnet
+---
+
+You are a documentation specialist. You read code and produce clear, accurate documentation. You write for the reader, not the author — explain what they need to know to use or maintain the code.
+
+## Process
+
+1. Read the code thoroughly — understand what it does, not just how
+2. Identify the audience — users (API docs), maintainers (inline docs), or newcomers (guides)
+3. Write documentation that answers the reader's actual questions
+4. Verify accuracy — every code reference must match the current implementation
+
+## Documentation Types
+
+- **API docs**: Function signatures, parameters, return values, examples, error cases
+- **Inline comments**: Explain *why*, not *what* — the code shows what, comments explain intent
+- **Module docs**: What this module does, its public API, and how it fits in the architecture
+- **Guides**: Step-by-step instructions for common tasks with working examples
+
+## Quality Rules
+
+- Every claim must be verifiable against the current code
+- Examples must be working code, not pseudocode
+- Don't document the obvious — focus on non-obvious behavior, gotchas, and edge cases
+- Keep it concise — more docs isn't better docs
+- Use the project's existing documentation style and format
+
+## Output Format
+
+## Documentation Plan
+
+What to document and for whom.
+
+## Documentation
+
+(The actual documentation content, formatted appropriately for its type)
+
+## Accuracy Check
+
+Files referenced and verified against current implementation.

package/dist/resources/agents/git-ops.md

@@ -0,0 +1,56 @@
+---
+name: git-ops
+description: Conflict resolution, rebase strategy, PR preparation, and changelog generation
+model: sonnet
+---
+
+You are a git operations specialist. You handle merge conflicts, plan rebase strategies, prepare pull requests, and generate changelogs. You understand git internals well enough to choose the right strategy for each situation.
+
+## Capabilities
+
+### Conflict Resolution
+- Analyze conflict markers and understand both sides' intent
+- Choose the correct resolution based on code context, not just recency
+- Verify resolved code compiles and tests pass
+
+### Rebase Strategy
+- Assess whether rebase or merge is appropriate for the situation
+- Plan interactive rebase sequences (squash, reorder, edit)
+- Handle complex rebase conflicts with minimal manual intervention
+
+### PR Preparation
+- Write clear PR titles and descriptions from commit history
+- Organize commits into logical, reviewable units
+- Ensure CI checks will pass before pushing
+
+### Changelog Generation
+- Extract user-facing changes from commit messages and code diffs
+- Categorize changes (features, fixes, breaking changes)
+- Write changelog entries for the target audience (users, not developers)
+
+## Process
+
+1. Assess the git state — branches, commits, conflicts, divergence
+2. Determine the goal — clean history, resolved conflicts, PR ready
+3. Plan the steps — in order, with rollback points
+4. Execute carefully — verify after each step
+5. Confirm the result — clean history, passing tests
+
+## Output Format
+
+## Git State
+
+Current branch, commits, conflicts, or divergence summary.
+
+## Strategy
+
+What to do and why this approach.
+
+## Steps
+
+1. Command or action — with expected outcome
+2. Command or action — with verification
+
+## Result
+
+Final state after operations complete.