gsd-pi 2.75.0 → 2.76.0-dev.4100bd590

package/src/resources/extensions/gsd/doctor-providers.ts

@@ -11,8 +11,8 @@
  *   - Optional search/tool integrations (Brave, Tavily, Jina, Context7)
  */
 
-import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { delimiter, join } from "node:path";
 import { AuthStorage } from "@gsd/pi-coding-agent";
 import { getEnvApiKey } from "@gsd/pi-ai";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
@@ -37,6 +37,30 @@ export interface ProviderCheckResult {
   required: boolean;
 }
 
+// ── Provider routing constants ────────────────────────────────────────────────
+
+/**
+ * Providers that use external CLI authentication (not API keys).
+ * These are always considered "found" — the host CLI handles auth.
+ */
+const CLI_AUTH_PROVIDERS = new Set([
+  "claude-code",
+  "openai-codex",
+  "google-gemini-cli",
+  "google-antigravity",
+]);
+
+/**
+ * Providers that can serve models normally associated with another provider.
+ * Key = the provider whose models can be served, Value = alternative providers to check.
+ * e.g. GitHub Copilot subscriptions can access Claude and GPT models.
+ */
+const PROVIDER_ROUTES: Record<string, string[]> = {
+  anthropic: ["github-copilot", "claude-code"],
+  openai: ["github-copilot", "openai-codex"],
+  google: ["google-gemini-cli"],
+};
+
 // ── Model → Provider ID mapping ───────────────────────────────────────────────
 
 /**
@@ -48,7 +72,8 @@ function modelToProviderId(model: string): string | null {
 
   // Explicit provider prefix (e.g. "openrouter/deepseek-r1")
   if (model.includes("/")) {
-    const prefix = model.split("/")[0].toLowerCase();
+    const rawPrefix = model.split("/")[0];
+    const prefix = rawPrefix.toLowerCase();
     // Map known prefixes to registry IDs
     const prefixMap: Record<string, string> = {
       "anthropic-vertex": "anthropic-vertex",
@@ -62,6 +87,7 @@ function modelToProviderId(model: string): string | null {
       "github-copilot": "github-copilot",
     };
     if (prefixMap[prefix]) return prefixMap[prefix];
+    return rawPrefix;
   }
 
   const lower = model.toLowerCase();
@@ -121,13 +147,88 @@ function collectConfiguredModelProviders(): Set<string> {
 
 interface KeyLookup {
   found: boolean;
-  source: "auth.json" | "env" | "none";
+  source: "auth.json" | "env" | "models.json" | "none";
   backedOff: boolean;
 }
 
+/**
+ * Map of CLI provider IDs to their binary names on disk.
+ * Used for lightweight binary-presence checks (PATH scan, no subprocess).
+ */
+const CLI_BINARY_MAP: Record<string, string> = {
+  "claude-code": "claude",
+  "openai-codex": "codex",
+  "google-gemini-cli": "gemini",
+  "google-antigravity": "antigravity",
+};
+
+/**
+ * Check if a CLI provider's binary exists anywhere in PATH.
+ * Fast filesystem scan — no subprocess, no network, sub-1ms.
+ */
+function isCliBinaryInPath(providerId: string): boolean {
+  const binary = CLI_BINARY_MAP[providerId];
+  if (!binary) return false;
+
+  const pathDirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+
+  // On Windows, command shims are commonly installed as .cmd/.exe/.bat/.com.
+  // Scan PATHEXT candidates in addition to the bare binary name.
+  const executableNames: string[] = [binary];
+  if (process.platform === "win32") {
+    const rawPathExt = process.env.PATHEXT
+      ?.split(";")
+      .map(ext => ext.trim())
+      .filter(Boolean) ?? [];
+    const normalizedPathExt = rawPathExt.map(ext =>
+      ext.startsWith(".") ? ext.toLowerCase() : `.${ext.toLowerCase()}`,
+    );
+    const defaultExt = [".exe", ".cmd", ".bat", ".com"];
+    for (const ext of [...normalizedPathExt, ...defaultExt]) {
+      const candidate = `${binary}${ext}`;
+      if (!executableNames.includes(candidate)) executableNames.push(candidate);
+    }
+  }
+
+  return pathDirs.some(dir => executableNames.some(name => existsSync(join(dir, name))));
+}
+
+function modelsJsonPaths(): string[] {
+  const home = process.env.HOME ?? "~";
+  return [
+    join(home, ".gsd", "agent", "models.json"),
+    // Keep parity with custom-provider discovery during auto bootstrap.
+    join(home, ".pi", "agent", "models.json"),
+  ];
+}
+
+function hasModelsJsonApiKey(providerId: string): boolean {
+  for (const path of modelsJsonPaths()) {
+    if (!existsSync(path)) continue;
+    try {
+      const parsed = JSON.parse(readFileSync(path, "utf-8")) as {
+        providers?: Record<string, { apiKey?: unknown }>;
+      };
+      const apiKey = parsed.providers?.[providerId]?.apiKey;
+      if (typeof apiKey === "string" && apiKey.trim().length > 0) {
+        return true;
+      }
+    } catch {
+      // Malformed models.json should not break the dashboard health check.
+    }
+  }
+  return false;
+}
+
 function resolveKey(providerId: string): KeyLookup {
   const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
 
+  // claude-code never stores credentials in auth.json — GSD delegates entirely to
+  // the local CLI binary. Presence of the binary in PATH is the only signal.
+  if (providerId === "claude-code") {
+    return { found: isCliBinaryInPath("claude-code"), source: "env", backedOff: false };
+  }
+
   if (providerId === "anthropic-vertex" && process.env.ANTHROPIC_VERTEX_PROJECT_ID) {
     return { found: true, source: "env", backedOff: false };
   }
@@ -169,33 +270,15 @@ function resolveKey(providerId: string): KeyLookup {
     return { found: true, source: "env", backedOff: false };
   }
 
+  if (hasModelsJsonApiKey(providerId)) {
+    return { found: true, source: "models.json", backedOff: false };
+  }
+
   return { found: false, source: "none", backedOff: false };
 }
 
 // ── Individual check groups ────────────────────────────────────────────────────
 
-/**
- * Providers that can serve models normally associated with another provider.
- * Key = the provider whose models can be served, Value = alternative providers to check.
- * e.g. GitHub Copilot subscriptions can access Claude and GPT models.
- */
-const PROVIDER_ROUTES: Record<string, string[]> = {
-  anthropic: ["github-copilot"],
-  openai: ["github-copilot", "openai-codex"],
-  google: ["google-gemini-cli"],
-};
-
-/**
- * Providers that use external CLI authentication (not API keys).
- * These are always considered "ok" — the host CLI handles auth.
- */
-const CLI_AUTH_PROVIDERS = new Set([
-  "claude-code",
-  "openai-codex",
-  "google-gemini-cli",
-  "google-antigravity",
-]);
-
 function checkLlmProviders(): ProviderCheckResult[] {
   const required = collectConfiguredModelProviders();
   const results: ProviderCheckResult[] = [];

package/src/resources/extensions/gsd/doctor-runtime-checks.ts

@@ -8,9 +8,10 @@ import { deriveState } from "./state.js";
 import { saveFile } from "./files.js";
 import { nativeIsRepo, nativeForEachRef, nativeUpdateRef } from "./native-git-bridge.js";
 import { readCrashLock, isLockProcessAlive, clearLock } from "./crash-recovery.js";
-import { ensureGitignore } from "./gitignore.js";
+import { ensureGitignore, isGsdGitignored } from "./gitignore.js";
 import { readAllSessionStatuses, isSessionStale, removeSessionStatus } from "./session-status-io.js";
 import { recoverFailedMigration } from "./migrate-external.js";
+import { splitCompletedKey } from "./forensics.js";
 
 export async function checkRuntimeHealth(
   basePath: string,
@@ -118,9 +119,6 @@ export async function checkRuntimeHealth(
       const orphaned: string[] = [];
 
       for (const key of keys) {
-        // Key format: "unitType/unitId" e.g. "execute-task/M001/S01/T01"
-        // Hook units have compound types: "hook/<hookName>/unitId"
-        const { splitCompletedKey } = await import("./forensics.js");
         const parsed = splitCompletedKey(key);
         if (!parsed) continue;
         const { unitType, unitId } = parsed;
@@ -383,6 +381,27 @@ export async function checkRuntimeHealth(
             fixable: false,
           });
         }
+
+        // ── Symlinked .gsd without .gitignore entry (#4423) ──
+        // When `.gsd` is a symlink AND not gitignored, `git add -A -- :!.gsd/...`
+        // pathspecs fail with "beyond a symbolic link". Without self-heal this
+        // silently drops new user files during auto-commit.
+        if (nativeIsRepo(basePath) && !isGsdGitignored(basePath)) {
+          issues.push({
+            severity: "warning",
+            code: "symlinked_gsd_unignored",
+            scope: "project",
+            unitId: "project",
+            message: ".gsd is a symlink to external state but is not listed in .gitignore. This causes git pathspec exclusions to fail and can lead to silently dropped new files during auto-commit. Add `.gsd` to .gitignore.",
+            file: ".gitignore",
+            fixable: true,
+          });
+
+          if (shouldFix("symlinked_gsd_unignored")) {
+            const modified = ensureGitignore(basePath);
+            if (modified) fixesApplied.push("added .gsd to .gitignore (symlinked external state)");
+          }
+        }
       }
     }
   } catch {

package/src/resources/extensions/gsd/doctor-types.ts

@@ -23,6 +23,7 @@ export type DoctorIssueCode =
   | "state_file_stale"
   | "state_file_missing"
   | "gitignore_missing_patterns"
+  | "symlinked_gsd_unignored"
   | "unresolvable_dependency"
   | "failed_migration"
   | "broken_symlink"

package/src/resources/extensions/gsd/doctor.ts

@@ -172,8 +172,14 @@ function auditRequirements(content: string | null): DoctorIssue[] {
     const notes = block.match(/^-\s+Notes:\s+(.+)$/m)?.[1]?.trim().toLowerCase() ?? "";
 
     if (status === "active" && (!owner || owner === "none" || owner === "none yet")) {
+      // #4414: Downgrade to warning. A newly-created requirement has
+      // primary_owner='' by default until the planning agent wires it to
+      // a slice via gsd_requirement_update. Flagging this as an error
+      // during normal planning is noisy — the real failure mode is when
+      // it persists past milestone completion, which is covered by other
+      // audits. Keep the signal but don't treat it as a blocker.
       issues.push({
-        severity: "error",
+        severity: "warning",
         code: "active_requirement_missing_owner",
         scope: "project",
         unitId: requirementId,

package/src/resources/extensions/gsd/ecosystem/gsd-extension-api.ts

@@ -160,6 +160,8 @@ export function createGSDExtensionAPI(
       pi.emitBeforeModelSelect(...args),
     emitAdjustToolSet: (...args: Parameters<ExtensionAPI["emitAdjustToolSet"]>) =>
       pi.emitAdjustToolSet(...args),
+    emitExtensionEvent: (...args: Parameters<ExtensionAPI["emitExtensionEvent"]>) =>
+      pi.emitExtensionEvent(...args),
 
     // ── Tool / command / shortcut / flag registration ──────────────────
     registerTool: ((tool: any) => pi.registerTool(tool)) as ExtensionAPI["registerTool"],

package/src/resources/extensions/gsd/error-classifier.ts

@@ -19,6 +19,7 @@ export type ErrorClass =
   | { kind: "stream";       retryAfterMs: number }
   | { kind: "connection";   retryAfterMs: number }
   | { kind: "model-error" }
+  | { kind: "unsupported-model" }
   | { kind: "permanent" }
   | { kind: "unknown" };
 
@@ -43,11 +44,14 @@ export function resetRetryState(state: RetryState): void {
 // ── Classification ──────────────────────────────────────────────────────────
 
 const PERMANENT_RE = /auth|unauthorized|forbidden|invalid.*key|invalid.*api|billing|quota exceeded|account/i;
-const RATE_LIMIT_RE = /rate.?limit|too many requests|429/i;
+// Include provider-specific quota-window phrasing like:
+// - "You've hit your limit"
+// - "usage limit" / "quota reached"
+const RATE_LIMIT_RE = /rate.?limit|too many requests|429|hit your limit|usage limit|quota (?:reached|hit)|limit.*resets?/i;
 // OpenRouter affordability-style quota errors should be treated as transient
 // so core retry logic can lower maxTokens and continue in-session.
 const AFFORDABILITY_RE = /requires more credits|can only afford|insufficient credits|not enough credits|fewer max_tokens/i;
-const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns/i;
+const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns|unexpected eof/i;
 const SERVER_RE = /internal server error|500|502|503|overloaded|server_error|api_error|service.?unavailable/i;
 // ECONNRESET/ECONNREFUSED are in NETWORK_RE (same-model retry first).
 const CONNECTION_RE = /terminated|connection.?(?:refused|error)|other side closed|EPIPE|network.?(?:is\s+)?unavailable|stream_exhausted(?:_without_result)?/i;
@@ -56,12 +60,24 @@ const CONNECTION_RE = /terminated|connection.?(?:refused|error)|other side close
 const STREAM_RE = /in JSON at position \d+|Unexpected end of JSON|SyntaxError.*JSON/i;
 const RESET_DELAY_RE = /reset in (\d+)s/i;
 
+// Provider-side model entitlement rejection: the SDK accepted the model switch,
+// but the provider refused at request time because the current account/plan/tier
+// cannot use that model.  Must match all three of: a model/deployment token,
+// a negative-entitlement indicator, and an account/plan/tier/subscription token.
+// Requiring all three keeps generic "account suspended" errors in `permanent`
+// (no model token) while catching the phrasings providers actually use.
+// See issue #4513.
+const UNSUPPORTED_MODEL_MODEL_RE = /\b(?:model|deployment)\b/i;
+const UNSUPPORTED_MODEL_INDICATOR_RE =
+  /\bnot support(?:ed|s)?\b|\bunsupported\b|\bnot available\b|\bunavailable\b|\bno access\b|\bdoes(?:n['’]t| not) (?:have access|support)\b|\bnot authori[sz]ed\b/i;
+const UNSUPPORTED_MODEL_SCOPE_RE = /\b(?:account|plan|tier|subscription)\b/i;
+
 /**
  * Classify an error message into one of the ErrorClass kinds.
  *
  * Classification order:
  *  1. Permanent (auth/billing/quota) — unless also rate-limited
- *  2. Rate limit (429, rate.?limit, too many requests)
+ *  2. Rate limit (429, rate.?limit, too many requests, hit-your-limit/quota-window phrasing)
  *  3. Network (ECONNRESET, ETIMEDOUT, socket hang up, fetch failed, dns)
  *  4. Stream truncation (malformed JSON from mid-stream cut)
  *  5. Server (500/502/503, overloaded, server_error)
@@ -71,6 +87,19 @@ const RESET_DELAY_RE = /reset in (\d+)s/i;
 export function classifyError(errorMsg: string, retryAfterMs?: number): ErrorClass {
   const isPermanent = PERMANENT_RE.test(errorMsg);
   const isRateLimit = RATE_LIMIT_RE.test(errorMsg) || AFFORDABILITY_RE.test(errorMsg);
+  const isUnsupportedModel =
+    UNSUPPORTED_MODEL_MODEL_RE.test(errorMsg) &&
+    UNSUPPORTED_MODEL_INDICATOR_RE.test(errorMsg) &&
+    UNSUPPORTED_MODEL_SCOPE_RE.test(errorMsg);
+
+  // 0. Unsupported model (account/plan entitlement rejection) — checked before
+  //    `permanent` because PERMANENT_RE also matches /account/i and would
+  //    otherwise swallow these errors, blocking the blocklist-driven fallback.
+  //    Rate limit still wins when both patterns appear (a throttled account is
+  //    not an entitlement failure).
+  if (isUnsupportedModel && !isRateLimit) {
+    return { kind: "unsupported-model" };
+  }
 
   // 1. Permanent — but rate limit takes precedence
   if (isPermanent && !isRateLimit) {