gsd-pi 2.75.0 → 2.76.0-dev.b072ebb73

package/dist/resources/extensions/shared/interview-ui.js

@@ -24,11 +24,20 @@
  *   Enter / →    submit all answers
  *   Esc          exit confirmation
  */
-import { Editor, Key, matchesKey, truncateToWidth, } from "@gsd/pi-tui";
+import { getMarkdownTheme } from "@gsd/pi-coding-agent";
+import { Editor, Key, Markdown, matchesKey, truncateToWidth, } from "@gsd/pi-tui";
+import { mergeSideBySide } from "./layout-utils.js";
 import { makeUI, INDENT } from "./ui.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
 const OTHER_OPTION_LABEL = "None of the above";
 const OTHER_OPTION_DESCRIPTION = "Select to type your own answer.";
+// Preview layout constants
+const MIN_PREVIEW_WIDTH = 30;
+const MIN_OPTIONS_WIDTH = 30;
+const PREVIEW_RATIO = 0.60; // preview gets the majority of the width
+const DIVIDER_CHARS = " │ ";
+const DIVIDER_WIDTH = 3;
+const PREVIEW_MAX_LINES = 20; // hard cap — keeps total ≤ 24 rows for single-question
 // ─── Wrap-up screen ───────────────────────────────────────────────────────────
 export async function showWrapUpScreen(opts, ctx) {
     return ctx.ui.custom((tui, theme, _kb, done) => {
@@ -461,6 +470,98 @@ export async function showInterviewRound(questions, opts, ctx) {
             push(ui.blank(), ui.hints(["↑/↓ to choose", "1/2 to quick-select", "enter to confirm"]), ui.bar());
             return lines;
         }
+        // ── Preview helpers ──────────────────────────────────────────────
+        let mdThemeCache = null;
+        let previewCache = null;
+        function questionHasAnyPreview() {
+            return questions[currentIdx].options.some((o) => o.preview != null && o.preview.trim().length > 0);
+        }
+        function getCurrentPreview() {
+            const q = questions[currentIdx];
+            const idx = states[currentIdx].cursorIndex;
+            if (idx < q.options.length) {
+                const preview = q.options[idx].preview;
+                return preview && preview.trim().length > 0 ? preview : null;
+            }
+            return null;
+        }
+        function renderOptionsColumn(optWidth) {
+            const ui = makeUI(theme, optWidth);
+            const col = [];
+            const push = (...rows) => { for (const r of rows)
+                col.push(...r); };
+            const q = questions[currentIdx];
+            const st = states[currentIdx];
+            const multiSel = isMultiSelect(currentIdx);
+            push(ui.question(` ${q.question}`));
+            if (multiSel)
+                push(ui.meta("  (Select all that apply)"));
+            push(ui.blank());
+            for (let i = 0; i < q.options.length; i++) {
+                const opt = q.options[i];
+                const isCursor = i === st.cursorIndex;
+                if (multiSel) {
+                    const isChecked = st.checkedIndices.has(i);
+                    if (isCursor && !focusNotes)
+                        push(ui.checkboxSelected(opt.label, opt.description, isChecked));
+                    else
+                        push(ui.checkboxUnselected(opt.label, opt.description, isChecked, focusNotes));
+                }
+                else {
+                    const isCommitted = i === st.committedIndex;
+                    if (isCursor && !focusNotes) {
+                        push(ui.optionSelected(i + 1, opt.label, opt.description, isCommitted));
+                    }
+                    else {
+                        push(ui.optionUnselected(i + 1, opt.label, opt.description, { isCommitted, isFocusDimmed: focusNotes }));
+                    }
+                }
+            }
+            const ndIdx = noneOrDoneIdx(currentIdx);
+            const ndCursor = ndIdx === st.cursorIndex;
+            if (multiSel) {
+                push(ui.blank());
+                if (ndCursor && !focusNotes)
+                    push(ui.doneSelected());
+                else
+                    push(ui.doneUnselected());
+            }
+            else {
+                const ndCommitted = ndIdx === st.committedIndex;
+                if (ndCursor && !focusNotes) {
+                    push(ui.slotSelected(OTHER_OPTION_LABEL, OTHER_OPTION_DESCRIPTION, ndCommitted));
+                }
+                else {
+                    push(ui.slotUnselected(OTHER_OPTION_LABEL, OTHER_OPTION_DESCRIPTION, { isCommitted: ndCommitted, isFocusDimmed: focusNotes }));
+                }
+            }
+            if (st.notesVisible || focusNotes) {
+                push(ui.blank(), ui.notesLabel(focusNotes));
+                if (focusNotes) {
+                    for (const line of getEditor().render(optWidth - 2))
+                        col.push(truncateToWidth(` ${line}`, optWidth));
+                }
+                else if (st.notes) {
+                    push(ui.notesText(st.notes));
+                }
+            }
+            return col;
+        }
+        function renderPreviewColumn(markdown, previewWidth) {
+            if (previewCache && previewCache.markdown === markdown && previewCache.width === previewWidth) {
+                return previewCache.lines;
+            }
+            if (!mdThemeCache)
+                mdThemeCache = getMarkdownTheme();
+            const header = [
+                truncateToWidth(theme.fg("accent", theme.bold(" Preview")), previewWidth),
+                truncateToWidth(theme.fg("dim", " " + "─".repeat(Math.max(0, previewWidth - 2))), previewWidth),
+            ];
+            const md = new Markdown(markdown, 1, 0, mdThemeCache);
+            const lines = [...header, ...md.render(previewWidth)];
+            previewCache = { markdown, width: previewWidth, lines };
+            return lines;
+        }
         // ── Main render ──────────────────────────────────────────────────
         function render(width) {
             if (cachedLines)
@@ -473,6 +574,93 @@ export async function showInterviewRound(questions, opts, ctx) {
                 cachedLines = renderReviewScreen(width);
                 return cachedLines;
             }
+            const useSideBySide = questionHasAnyPreview()
+                && width >= (MIN_OPTIONS_WIDTH + MIN_PREVIEW_WIDTH + DIVIDER_WIDTH);
+            if (useSideBySide) {
+                // ── Preview path ──────────────────────────────────────
+                const ui = makeUI(theme, width);
+                const lines = [];
+                const push = (...rows) => { for (const r of rows)
+                    lines.push(...r); };
+                push(ui.bar());
+                if (isMultiQuestion) {
+                    const unanswered = questions.filter((_, i) => !isQuestionAnswered(i)).length;
+                    const answeredSet = new Set(questions.map((_, i) => i).filter(i => isQuestionAnswered(i)));
+                    push(ui.questionTabs(questions.map(q => q.header), currentIdx, answeredSet));
+                    push(ui.blank());
+                    const progressParts = [
+                        opts.progress,
+                        `Question ${currentIdx + 1}/${questions.length}`,
+                        unanswered > 0 ? `${unanswered} unanswered` : null,
+                    ].filter(Boolean).join("  •  ");
+                    if (progressParts)
+                        push(ui.meta(`  ${progressParts}`));
+                    push(ui.blank());
+                }
+                else {
+                    if (opts.progress)
+                        push(ui.meta(`  ${opts.progress}`), ui.blank());
+                }
+                // Side-by-side body — fixed height per render, capped to terminal.
+                // tuiChrome accounts for elements rendered outside the interview
+                // component: spinner/loader (1-2), status line (1), tool header (1),
+                // plus a safety margin for future additions.
+                const termRows = (typeof process !== "undefined" && process.stdout?.rows) || 24;
+                const footerLines = 3; // blank + hints + bar
+                const tuiChrome = 5;
+                const maxBody = Math.min(PREVIEW_MAX_LINES, Math.max(6, termRows - lines.length - footerLines - tuiChrome));
+                const previewWidth = Math.max(MIN_PREVIEW_WIDTH, Math.floor(width * PREVIEW_RATIO));
+                const leftWidth = Math.max(MIN_OPTIONS_WIDTH, width - previewWidth - DIVIDER_WIDTH);
+                const fullLeft = renderOptionsColumn(leftWidth);
+                const leftLines = fullLeft.slice(0, maxBody);
+                if (fullLeft.length > maxBody) {
+                    const n = fullLeft.length - maxBody + 1;
+                    const lbl = `+${n} lines hidden`;
+                    const d = "─".repeat(Math.max(0, Math.floor((leftWidth - lbl.length - 2) / 2)));
+                    leftLines[maxBody - 1] = truncateToWidth(theme.fg("dim", ` ${d} ${lbl} ${d}`), leftWidth);
+                }
+                const preview = getCurrentPreview();
+                const fullRight = preview ? renderPreviewColumn(preview, previewWidth) : [];
+                const rightLines = fullRight.slice(0, maxBody);
+                if (fullRight.length > maxBody) {
+                    const n = fullRight.length - maxBody + 1;
+                    const lbl = `+${n} lines hidden`;
+                    const d = "─".repeat(Math.max(0, Math.floor((previewWidth - lbl.length - 2) / 2)));
+                    rightLines[maxBody - 1] = truncateToWidth(theme.fg("dim", ` ${d} ${lbl} ${d}`), previewWidth);
+                }
+                while (leftLines.length < maxBody)
+                    leftLines.push("");
+                while (rightLines.length < maxBody)
+                    rightLines.push("");
+                const divider = theme.fg("dim", DIVIDER_CHARS);
+                lines.push(...mergeSideBySide(leftLines, rightLines, leftWidth, divider, width));
+                // Footer
+                push(ui.blank());
+                const isLast = !isMultiQuestion || currentIdx === questions.length - 1;
+                const hints = [];
+                if (focusNotes) {
+                    hints.push("enter to confirm");
+                    hints.push("tab or esc to close notes");
+                }
+                else if (isMultiSelect(currentIdx)) {
+                    hints.push("space to toggle");
+                    if (isMultiQuestion)
+                        hints.push("←/→ navigate questions");
+                    hints.push("tab to add notes");
+                    hints.push(isLast && allAnswered() ? "enter to review" : "enter to next");
+                }
+                else {
+                    hints.push("tab to add notes");
+                    if (isMultiQuestion)
+                        hints.push("←/→ navigate");
+                    hints.push(isLast && allAnswered() ? "enter to review" : "enter to next");
+                }
+                hints.push("esc to exit");
+                push(ui.hints(hints), ui.bar());
+                cachedLines = lines;
+                return lines;
+            }
+            // ── Original path — no preview, untouched ────────────────
             const ui = makeUI(theme, width);
             const lines = [];
             const push = (...rows) => { for (const r of rows)

package/dist/resources/extensions/shared/layout-utils.js

@@ -44,3 +44,20 @@ export function fitColumns(parts, width, separator = "  ") {
     }
     return truncateToWidth(result, width);
 }
+/**
+ * Merge two sets of lines into a side-by-side layout with a vertical divider.
+ *
+ * Each left line is padded to `leftWidth`, then joined with a styled divider
+ * and the corresponding right line. Output lines are truncated to `totalWidth`.
+ */
+export function mergeSideBySide(leftLines, rightLines, leftWidth, divider, totalWidth) {
+    const maxLen = Math.max(leftLines.length, rightLines.length);
+    const merged = [];
+    for (let i = 0; i < maxLen; i++) {
+        const left = i < leftLines.length ? leftLines[i] : "";
+        const right = i < rightLines.length ? rightLines[i] : "";
+        const paddedLeft = padRight(left, leftWidth);
+        merged.push(truncateToWidth(paddedLeft + divider + right, totalWidth));
+    }
+    return merged;
+}

package/dist/resources/extensions/shared/rtk-shared.js

@@ -0,0 +1,47 @@
+import { existsSync } from "node:fs";
+import { homedir as osHomedir } from "node:os";
+import { delimiter, join } from "node:path";
+export const GSD_RTK_DISABLED_ENV = "GSD_RTK_DISABLED";
+export const GSD_RTK_PATH_ENV = "GSD_RTK_PATH";
+export const RTK_TELEMETRY_DISABLED_ENV = "RTK_TELEMETRY_DISABLED";
+export function isTruthy(value) {
+    if (!value)
+        return false;
+    const normalized = value.trim().toLowerCase();
+    return normalized === "1" || normalized === "true" || normalized === "yes";
+}
+export function isRtkEnabled(env = process.env) {
+    return !isTruthy(env[GSD_RTK_DISABLED_ENV]);
+}
+export function getManagedRtkDir(env = process.env) {
+    return join(env.GSD_HOME || join(osHomedir(), ".gsd"), "agent", "bin");
+}
+export function getRtkBinaryName(platform = process.platform) {
+    return platform === "win32" ? "rtk.exe" : "rtk";
+}
+export function getPathValue(env) {
+    const pathKey = Object.keys(env).find((key) => key.toLowerCase() === "path");
+    return pathKey ? env[pathKey] : env.PATH;
+}
+export function resolvePathCandidates(pathValue) {
+    if (!pathValue)
+        return [];
+    return pathValue
+        .split(delimiter)
+        .map((part) => part.trim())
+        .filter(Boolean);
+}
+export function resolveSystemRtkPath(pathValue, platform = process.platform) {
+    const candidates = platform === "win32"
+        ? ["rtk.exe", "rtk.cmd", "rtk.bat", "rtk"]
+        : ["rtk"];
+    for (const dir of resolvePathCandidates(pathValue)) {
+        for (const candidate of candidates) {
+            const fullPath = join(dir, candidate);
+            if (existsSync(fullPath)) {
+                return fullPath;
+            }
+        }
+    }
+    return null;
+}

package/dist/resources/extensions/shared/rtk.js

@@ -1,18 +1,10 @@
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { delimiter, join } from "node:path";
-const GSD_RTK_PATH_ENV = "GSD_RTK_PATH";
-const GSD_RTK_DISABLED_ENV = "GSD_RTK_DISABLED";
+import { join } from "node:path";
+import { GSD_RTK_PATH_ENV, RTK_TELEMETRY_DISABLED_ENV, getManagedRtkDir, getPathValue, getRtkBinaryName, isRtkEnabled, resolveSystemRtkPath, } from "./rtk-shared.js";
 const GSD_RTK_REWRITE_TIMEOUT_MS_ENV = "GSD_RTK_REWRITE_TIMEOUT_MS";
-const RTK_TELEMETRY_DISABLED_ENV = "RTK_TELEMETRY_DISABLED";
 const RTK_REWRITE_TIMEOUT_MS = 5_000;
-function isTruthy(value) {
-    if (!value)
-        return false;
-    const normalized = value.trim().toLowerCase();
-    return normalized === "1" || normalized === "true" || normalized === "yes";
-}
+export { isRtkEnabled };
 function getRewriteTimeoutMs(env = process.env) {
     const configured = Number.parseInt(env[GSD_RTK_REWRITE_TIMEOUT_MS_ENV] ?? "", 10);
     if (Number.isFinite(configured) && configured > 0) {
@@ -20,47 +12,12 @@ function getRewriteTimeoutMs(env = process.env) {
     }
     return RTK_REWRITE_TIMEOUT_MS;
 }
-export function isRtkEnabled(env = process.env) {
-    return !isTruthy(env[GSD_RTK_DISABLED_ENV]);
-}
 export function buildRtkEnv(env = process.env) {
     return {
         ...env,
         [RTK_TELEMETRY_DISABLED_ENV]: "1",
     };
 }
-function getManagedRtkDir(env = process.env) {
-    return join(env.GSD_HOME || join(homedir(), ".gsd"), "agent", "bin");
-}
-function getRtkBinaryName(platform = process.platform) {
-    return platform === "win32" ? "rtk.exe" : "rtk";
-}
-function getPathValue(env) {
-    const pathKey = Object.keys(env).find((key) => key.toLowerCase() === "path");
-    return pathKey ? env[pathKey] : env.PATH;
-}
-function resolvePathCandidates(pathValue) {
-    if (!pathValue)
-        return [];
-    return pathValue
-        .split(delimiter)
-        .map((part) => part.trim())
-        .filter(Boolean);
-}
-function resolveSystemRtkPath(pathValue, platform = process.platform) {
-    const candidates = platform === "win32"
-        ? ["rtk.exe", "rtk.cmd", "rtk.bat", "rtk"]
-        : ["rtk"];
-    for (const dir of resolvePathCandidates(pathValue)) {
-        for (const candidate of candidates) {
-            const fullPath = join(dir, candidate);
-            if (existsSync(fullPath)) {
-                return fullPath;
-            }
-        }
-    }
-    return null;
-}
 export function resolveRtkBinaryPath(options = {}) {
     const env = options.env ?? process.env;
     const platform = options.platform ?? process.platform;

package/dist/resources/skills/api-design/SKILL.md

@@ -0,0 +1,190 @@
+---
+name: api-design
+description: Design or review an HTTP/REST/GraphQL API for versioning, pagination, error shapes, idempotency, auth, and evolvability. Use when asked to "design an API", "shape the endpoints", "design the schema", "add a new endpoint", "review this API", or when building/modifying a public or internal HTTP surface. Complements `design-an-interface` (which is interface-agnostic) by covering HTTP-specific concerns like status codes, cache headers, and breaking-change management.
+---
+
+<objective>
+Shape an HTTP or GraphQL API so callers get predictable, evolvable, and honest semantics. The deliverable is a concrete endpoint/schema sketch with: URL or operation names, method/verb, request shape, response shape, error shape, auth model, pagination strategy, and versioning stance. Optimize for "clients that exist in 2 years" over "client that's easy to write today".
+</objective>
+
+<context>
+GSD-2 has `design-an-interface` for general module-interface design; this skill is the HTTP/GraphQL specialization. REST and GraphQL carry baggage — status codes, verbs, nullability, pagination — that a generic interface-design discussion glosses over.
+
+Invocation points:
+- Adding a new public API endpoint
+- Redesigning an internal API boundary between services
+- Code review of a PR that introduces HTTP handlers
+- A slice whose acceptance criteria include "the API works"
+- A GraphQL schema change
+</context>
+
+<core_principle>
+**CALLERS OUTLIVE YOUR ASSUMPTIONS.** An API you ship today has to keep working when your internals change, when the mobile app version two is still in use, and when a third party integrates against it. Design for extension, not just for the current caller.
+
+**HONEST STATUS CODES.** 200 OK with `{"error": "not found"}` is a lie. 404 says not found. Use the HTTP semantics the protocol offers — HTTP clients, caches, and intermediaries rely on them.
+
+**PAGINATION IS NON-OPTIONAL.** Any list endpoint that doesn't paginate will eventually get a request for "all records" that kills your database.
+</core_principle>
+
+<process>
+
+## Step 1: Gather the contract
+
+Answer, or ask (one round, 1–3 questions):
+
+1. **Who are the callers?** Internal service / mobile app / public third-party / same-repo frontend.
+2. **What's the versioning stance?** None / URL-path (`/v1/`) / header-based / GraphQL schema evolution.
+3. **Auth model?** Public / API key / OAuth / session cookie / mTLS / none-but-internal-only.
+4. **Idempotency expectation?** Is a retry safe? Required?
+5. **Consistency model?** Read-your-writes, eventual, serializable?
+
+## Step 2: Resource and operation naming
+
+### REST
+
+- Nouns not verbs in URLs: `POST /users`, not `POST /createUser`.
+- Plural resources: `/users/42`, not `/user/42`.
+- Nested only when the relationship is hierarchical and the child has no independent identity: `/users/42/sessions/3`. Otherwise flat: `/sessions/3?userId=42`.
+- Use subresources for actions that don't fit CRUD: `POST /users/42:deactivate` (colon syntax) or `POST /users/42/actions/deactivate`.
+
+### GraphQL
+
+- Queries are nouns; mutations are verbs: `user(id)`, `createUser(input)`, `deactivateUser(id)`.
+- Group related mutations under an input type: `createUser(input: CreateUserInput!)`.
+- Return the affected object plus any derived/computed fields from mutations — lets clients avoid a refetch.
+
+## Step 3: Methods and status codes
+
+### REST
+
+| Method | Intent | Idempotent? | Default success |
+|---|---|---|---|
+| GET | Read | Yes | 200, or 304 if conditional |
+| POST | Create or non-idempotent action | No | 201 with `Location` on create, 200 on action |
+| PUT | Replace (full-object) | Yes | 200 with body, or 204 |
+| PATCH | Partial update | No (usually) | 200 with body |
+| DELETE | Remove | Yes | 204 |
+
+Errors:
+- 400: caller screwed up the request shape
+- 401: no/invalid auth
+- 403: authed but not allowed
+- 404: resource doesn't exist
+- 409: conflict (version mismatch, unique constraint)
+- 410: gone (vs 404 when the resource previously existed and you want to signal that)
+- 422: validation failed
+- 429: rate-limited — include `Retry-After`
+- 500: genuinely unexpected server error
+- 503: service down or overloaded — include `Retry-After`
+
+Never 200-with-error-body. Never 500 for a 4xx cause.
+
+### GraphQL
+
+- Top-level errors (`errors[]`) for transport-level failures. Domain errors (validation, not-found, forbidden) go in the typed return — use a union or result type.
+- Partial results are expected; design the schema so `null` on a field is meaningful, not a signal of generic failure.
+
+## Step 4: Pagination
+
+- **Cursor-based by default.** Opaque cursor string, `limit`, return `nextCursor` when more exists. Scales, stable under writes.
+- **Offset-based only when:** dataset is small, user needs jump-to-page semantics (admin tables), and you're willing to accept stability drift.
+- **Never "return everything"** as default. Put a hard upper bound on `limit` (e.g., 200).
+- GraphQL: use Relay-style connections (`edges`, `pageInfo`) if the ecosystem expects it; otherwise a simpler `{items, nextCursor}` is fine.
+
+## Step 5: Error shape
+
+Standardize one shape and use it everywhere. Example REST:
+
+```json
+{
+  "error": {
+    "code": "user_not_found",
+    "message": "No user with id 42",
+    "details": { "userId": 42 },
+    "requestId": "req_abc123"
+  }
+}
+```
+
+- `code` is machine-readable; stable; documented.
+- `message` is human-readable; can change.
+- `details` carries structured context.
+- `requestId` lets callers report bugs.
+
+Errors don't leak stack traces, file paths, or internal queries.
+
+## Step 6: Idempotency, caching, concurrency
+
+- **Idempotency keys** for POST operations that mustn't double-execute on retry. Caller passes `Idempotency-Key: <uuid>`; server dedupes for a window.
+- **ETags** for GET + conditional updates (`If-Match` on PUT/PATCH).
+- **Cache-Control** on GETs that are safely cacheable.
+- **Optimistic concurrency:** when multiple writers collide, 409 with the current state. Don't silently clobber.
+
+## Step 7: Versioning and evolution
+
+- **Additive changes are free:** new optional fields, new endpoints, new optional query params.
+- **Breaking changes need a plan:** path-versioned (`/v2/`), sunset headers on `/v1/`, deprecation window communicated. Or, for GraphQL, `@deprecated` on fields with a migration note.
+- **Document the contract:** OpenAPI/GraphQL SDL. Keep it in the repo. Make it part of the PR that introduces the change.
+
+## Step 8: Review or write it up
+
+If this is a review, produce findings in the same shape as `security-review` / `review` — file:line, category, recommendation.
+
+If this is a new design, produce:
+
+```markdown
+## <API name>
+
+### Scope
+<what the API is for, who calls it>
+
+### Endpoints / Operations
+- `POST /users` — create user. Request: `{email, name}`. Response 201: `{id, email, name, createdAt}` + `Location: /users/<id>`. Errors: 409 email taken, 422 invalid.
+- ...
+
+### Auth
+<model + where to put the credential>
+
+### Pagination
+<cursor shape, max limit>
+
+### Error shape
+<one canonical shape>
+
+### Idempotency / concurrency
+<rules>
+
+### Versioning
+<stance + how breaking changes will be handled>
+
+### OpenAPI / SDL
+<link or inline>
+```
+
+Append architectural decisions to `.gsd/DECISIONS.md`.
+
+</process>
+
+<anti_patterns>
+
+- **200 OK with `{"error": "..."}`.** Lies to caches, proxies, retry libraries.
+- **Unbounded list endpoints.** `GET /users` without a `limit` cap will bite you.
+- **Offset pagination at scale.** Drifts under writes; slow at high offsets.
+- **Free-form error messages with no code.** Machine callers can't branch on prose.
+- **Breaking changes in-place.** Callers break; versioning exists for a reason.
+- **Ignoring idempotency on retriable POSTs.** Double-charges, duplicate records.
+- **Auth checks at the handler only, not the service layer.** Defense in depth.
+
+</anti_patterns>
+
+<success_criteria>
+
+- [ ] Every endpoint/operation has named request, response, and error shapes.
+- [ ] Status codes match HTTP semantics — no 200-with-error.
+- [ ] List endpoints paginate; max limit is documented.
+- [ ] A single error shape is used everywhere, with a machine-readable code.
+- [ ] Versioning stance is stated — even if the answer is "additive only for now."
+- [ ] OpenAPI/SDL reflects the design and lives in the repo.
+- [ ] Decisions appear in `.gsd/DECISIONS.md`.
+
+</success_criteria>

package/dist/resources/skills/create-mcp-server/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: create-mcp-server
+description: Build, iterate, and evaluate Model Context Protocol (MCP) servers that expose external services as tools an LLM can call. Use when asked to "build an MCP server", "create an MCP tool", "wrap this API as MCP", "expose X to Claude", or when extending GSD with custom tool integrations. Covers research, schema/tool design, error handling, pagination, testing via MCP Inspector, and producing a 10-question eval set that proves the server actually enables real work.
+---
+
+<objective>
+Produce a high-quality MCP server that an LLM can actually use — not one that merely parses spec-compliant. Quality is measured by how well the server enables real-world task completion, which means the tool descriptions, error messages, and pagination behave under model reasoning, not just at the wire level.
+</objective>
+
+<context>
+GSD-2 consumes MCP heavily — see `src/resources/extensions/mcp-client/`, `src/resources/extensions/gsd/mcp-project-config.ts`, `src/resources/extensions/gsd/workflow-mcp.ts`, and `/gsd mcp` commands. Users frequently want to extend GSD with project-specific MCP servers (internal APIs, data sources, domain tools). This skill fills the authoring gap between "MCP exists" and "I have a working server."
+
+Invocation points:
+- User describes a service or API they want an LLM to reach
+- `/gsd mcp init` scaffolds config but there's a tool integration to build
+- Replacing a hand-rolled extension with a standard MCP server
+</context>
+
+<core_principle>
+**THE QUALITY METRIC IS TASK COMPLETION, NOT SCHEMA VALIDITY.** A server that lists 30 tools with cryptic names and empty descriptions passes the protocol but fails the point. The tool description is the only thing an LLM has to decide whether to call it — write it like documentation for a stranger under time pressure.
+
+**DESIGN FOR THE MODEL, NOT THE API.** A raw REST endpoint is rarely the right tool. Group, filter, and pre-shape responses so the model gets what it needs to reason, not a 40KB JSON blob it has to summarize. Fewer, deeper tools beat many, shallow ones.
+</core_principle>
+
+<process>
+
+## Step 1: Research and scope
+
+1. **Study modern MCP design.** Read the latest MCP protocol docs (not training data — fetch them). Read 2–3 reference implementations to see current patterns.
+2. **Pick a framework.** TypeScript is the default — the reference SDK is the most mature. Python is fine for data-heavy or ML adjacencies.
+3. **Analyze the target API.** Map the external service's endpoints, auth, rate limits, pagination, error shapes. Identify what a human workflow on top of it actually looks like — that's the cut line for tool design.
+4. **Produce a brief.** One page: what the server does, who calls it, the 5–10 tools you plan to expose, and the top 3 design trade-offs. Confirm with the user.
+
+## Step 2: Set up the project
+
+Skeleton:
+
+```text
+server/
+  src/
+    index.ts         # MCP entry point — stdio or sse transport
+    client.ts        # API client with auth, retries, typed errors
+    tools/           # one file per tool, or grouped by domain
+    pagination.ts    # shared cursor handling
+    errors.ts        # MCP-friendly error formatting
+  package.json       # @modelcontextprotocol/sdk as dep
+  tsconfig.json
+  README.md          # how to run, env vars, rate-limit notes
+  evals.xml          # 10 eval questions (Phase 4)
+```
+
+Core infrastructure goes first: API client with typed errors, pagination helpers, consistent retry/timeout behavior. Do not inline these per tool.
+
+## Step 3: Implement tools
+
+For each tool:
+
+1. **Name:** verb-noun, lowercase, snake_case. `search_issues`, `get_customer`, `create_deployment`. Not `do_thing` or `api_v2_post`.
+2. **Description (frontmatter):** 2–4 sentences. State what the tool does, when to use it, when NOT to use it, and any required fields or quirks. This is the model's entire interface to the tool — write it carefully.
+3. **Input schema (JSON Schema):** required fields marked, every field has a description, enums enumerated, examples included for free-form strings.
+4. **Output shape:** typed, minimal, decision-ready. If the raw API returns 40 fields and only 6 matter for follow-up calls, return 6.
+5. **Error handling:** never return raw HTTP errors. Translate to human-readable messages: "Rate limit exceeded (retry in 30s)", "Authorization expired", "No record found for ID X". Include the action the caller should take next.
+6. **Pagination:** expose cursors explicitly. Do not leak "page N of M" into the model — leak "more results available, pass `cursor: abc123` to continue."
+
+## Step 4: Build and test with MCP Inspector
+
+1. Run the server under MCP Inspector. Verify it registers, every tool lists with its description, inputs schema-validate, outputs shape correctly.
+2. Call every tool at least once manually through the Inspector UI. Check error paths.
+3. Fix any "looks fine in isolation, breaks under the Inspector's framing" issues.
+
+## Step 5: Produce the eval set
+
+Write 10 evaluation questions in `evals.xml` that exercise the server end-to-end. Each question should require 2+ tool calls and at least one decision the model has to make based on earlier output. Cover:
+
+- Happy path (2–3 questions)
+- Error recovery (2 questions — "the first call failed, what next?")
+- Pagination (1 question)
+- Decision under partial information (2–3 questions)
+- Cross-tool composition (1–2 questions)
+
+Format:
+
+```xml
+<evals>
+  <eval id="1">
+    <question>...user request...</question>
+    <expected>...concrete observable answer or tool-call sequence...</expected>
+  </eval>
+</evals>
+```
+
+Run the evals. If the model can't complete them, the server — not the model — needs work. Iterate on descriptions, error messages, and tool granularity.
+
+## Step 6: Wire into GSD
+
+Write the project's `.mcp.json` entry using `/gsd mcp init` as a starting point. Document env vars and startup in README.md. If the server is globally useful, suggest the user file it as a durable skill via `spike-wrap-up` or publish it.
+
+</process>
+
+<anti_patterns>
+
+- **One-to-one REST mapping.** If the API has 30 endpoints, you likely want 6 tools.
+- **Empty or auto-generated descriptions.** "Calls the /users endpoint" tells the model nothing it can reason with.
+- **Raw error passthrough.** `{"error": "500"}` is useless. Translate.
+- **Page-based pagination leaked as "page 1 of 5".** Use opaque cursors.
+- **Skipping the Inspector.** If you didn't run it under the Inspector, you didn't test it.
+- **No evals.** Without evals you have no signal on whether real task completion works.
+
+</anti_patterns>
+
+<success_criteria>
+
+- [ ] Every tool has a description that could guide a cold-start model correctly.
+- [ ] Errors are translated to actionable, human-readable messages.
+- [ ] Pagination uses opaque cursors; no leaked page numbers.
+- [ ] `evals.xml` has 10 questions; the model completes ≥8 without handholding.
+- [ ] MCP Inspector test passes cleanly.
+- [ ] README documents env, startup, and rate-limit behavior.
+- [ ] Server is reachable from GSD via `.mcp.json` entry.
+
+</success_criteria>