gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.1594b263e

package/src/resources/extensions/gsd/worktree-telemetry.ts

@@ -0,0 +1,322 @@
+/**
+ * Worktree telemetry — #4764
+ *
+ * Thin emit helpers + aggregator on top of the existing journal. Separate
+ * module so callers import a tiny surface and don't have to assemble
+ * JournalEntry records by hand. Kernighan: the underlying emit path
+ * (emitJournalEvent) is already battle-tested; this module is just
+ * structured call sites + a summarizer.
+ *
+ * Emitted event types (see journal.ts):
+ *   - worktree-created           worktree entered/created for a milestone
+ *   - worktree-merged            worktree merge back to main completed
+ *   - worktree-orphaned          audit detected an orphaned branch/worktree
+ *   - auto-exit                  auto-mode exited (pause/stop/blocked/error)
+ *   - worktree-sync              syncStateToProjectRoot snapshot
+ *   - canonical-root-redirect    resolveCanonicalMilestoneRoot redirected
+ *
+ * These events are purely observational. They never block, never throw,
+ * and never carry code content — only IDs, counts, durations, and reasons.
+ */
+
+import { randomUUID } from "node:crypto";
+import { emitJournalEvent, queryJournal } from "./journal.js";
+import type { JournalEntry } from "./journal.js";
+
+function now(): string {
+  return new Date().toISOString();
+}
+
+function baseEntry(eventType: JournalEntry["eventType"], data: Record<string, unknown>): JournalEntry {
+  return {
+    ts: now(),
+    flowId: (typeof data.flowId === "string" ? data.flowId : undefined) ?? randomUUID(),
+    seq: typeof data.seq === "number" ? data.seq : 0,
+    eventType,
+    data,
+  };
+}
+
+// ─── Reason literal unions ───────────────────────────────────────────────
+// Closed sets so typos at call sites are rejected at compile time and can't
+// silently fragment the telemetry buckets produced by summarizeWorktreeTelemetry.
+
+export type WorktreeCreatedReason = "create-milestone" | "enter-milestone";
+export type AutoExitReason =
+  | "pause"
+  | "stop"
+  | "blocked"
+  | "merge-conflict"
+  | "merge-failed"
+  | "slice-merge-conflict"
+  | "all-complete"
+  | "no-active-milestone"
+  | "other";
+
+// ─── Emitters ────────────────────────────────────────────────────────────
+
+export function emitWorktreeCreated(
+  projectRoot: string,
+  milestoneId: string,
+  meta: { flowId?: string; reason?: WorktreeCreatedReason } = {},
+): void {
+  emitJournalEvent(projectRoot, baseEntry("worktree-created", {
+    milestoneId,
+    startedAt: now(),
+    flowId: meta.flowId,
+    reason: meta.reason ?? "enter-milestone",
+  }));
+}
+
+export function emitWorktreeMerged(
+  projectRoot: string,
+  milestoneId: string,
+  meta: {
+    flowId?: string;
+    reason?: "milestone-complete" | "all-complete" | "stop-fallback" | "transition" | "other";
+    startedAt?: string;
+    durationMs?: number;
+    sliceCount?: number;
+    taskCount?: number;
+    conflict?: boolean;
+    conflictedFiles?: number;
+  } = {},
+): void {
+  emitJournalEvent(projectRoot, baseEntry("worktree-merged", {
+    milestoneId,
+    endedAt: now(),
+    flowId: meta.flowId,
+    reason: meta.reason ?? "other",
+    startedAt: meta.startedAt,
+    durationMs: meta.durationMs,
+    sliceCount: meta.sliceCount,
+    taskCount: meta.taskCount,
+    conflict: meta.conflict ?? false,
+    conflictedFiles: meta.conflictedFiles ?? 0,
+  }));
+}
+
+export function emitWorktreeOrphaned(
+  projectRoot: string,
+  milestoneId: string,
+  meta: {
+    flowId?: string;
+    reason: "in-progress-unmerged" | "complete-unmerged" | "stale-branch";
+    commitsAhead?: number;
+    worktreeDirExists?: boolean;
+  },
+): void {
+  emitJournalEvent(projectRoot, baseEntry("worktree-orphaned", {
+    milestoneId,
+    flowId: meta.flowId,
+    reason: meta.reason,
+    commitsAhead: meta.commitsAhead,
+    worktreeDirExists: meta.worktreeDirExists ?? false,
+    detectedAt: now(),
+  }));
+}
+
+export function emitAutoExit(
+  projectRoot: string,
+  meta: {
+    flowId?: string;
+    /** Must come from the closed AutoExitReason set. Callers with free-form
+     *  reasons (e.g. stopAuto's `reason?: string` parameter) should map to
+     *  the closed set before emitting. */
+    reason: AutoExitReason;
+    milestoneId?: string;
+    milestoneMerged: boolean;
+  },
+): void {
+  emitJournalEvent(projectRoot, baseEntry("auto-exit", {
+    reason: meta.reason,
+    flowId: meta.flowId,
+    milestoneId: meta.milestoneId,
+    milestoneMerged: meta.milestoneMerged,
+    exitedAt: now(),
+  }));
+}
+
+export function emitWorktreeSync(
+  projectRoot: string,
+  milestoneId: string,
+  meta: {
+    flowId?: string;
+    filesCopied?: number;
+    bytesCopied?: number;
+    commitsAhead?: number;
+    worktreeAgeMs?: number;
+  },
+): void {
+  emitJournalEvent(projectRoot, baseEntry("worktree-sync", {
+    milestoneId,
+    flowId: meta.flowId,
+    filesCopied: meta.filesCopied,
+    bytesCopied: meta.bytesCopied,
+    commitsAhead: meta.commitsAhead,
+    worktreeAgeMs: meta.worktreeAgeMs,
+  }));
+}
+
+export function emitCanonicalRootRedirect(
+  projectRoot: string,
+  milestoneId: string,
+  redirectedTo: string,
+  meta: { flowId?: string } = {},
+): void {
+  emitJournalEvent(projectRoot, baseEntry("canonical-root-redirect", {
+    milestoneId,
+    redirectedTo,
+    flowId: meta.flowId,
+  }));
+}
+
+// #4765 — slice-cadence collapse events
+
+export function emitSliceMerged(
+  projectRoot: string,
+  milestoneId: string,
+  sliceId: string,
+  meta: { durationMs?: number; conflict?: boolean; commitSha?: string; flowId?: string } = {},
+): void {
+  emitJournalEvent(projectRoot, baseEntry("slice-merged", {
+    milestoneId,
+    sliceId,
+    mergedAt: now(),
+    durationMs: meta.durationMs,
+    conflict: meta.conflict ?? false,
+    commitSha: meta.commitSha,
+    flowId: meta.flowId,
+  }));
+}
+
+export function emitMilestoneResquash(
+  projectRoot: string,
+  milestoneId: string,
+  meta: { sliceCount: number; startSha?: string; endSha?: string; flowId?: string } = { sliceCount: 0 },
+): void {
+  emitJournalEvent(projectRoot, baseEntry("milestone-resquash", {
+    milestoneId,
+    sliceCount: meta.sliceCount,
+    startSha: meta.startSha,
+    endSha: meta.endSha,
+    resquashedAt: now(),
+    flowId: meta.flowId,
+  }));
+}
+
+// ─── Aggregator ──────────────────────────────────────────────────────────
+
+export interface WorktreeTelemetrySummary {
+  /** Count of worktrees created within the window */
+  worktreesCreated: number;
+  /** Count of worktrees merged within the window */
+  worktreesMerged: number;
+  /** Count of orphan detections within the window */
+  orphansDetected: number;
+  /** Breakdown by orphan reason */
+  orphansByReason: Record<string, number>;
+  /** Merge durations in milliseconds, sorted ascending */
+  mergeDurationsMs: number[];
+  /** Number of merges that hit a conflict */
+  mergeConflicts: number;
+  /** Auto-exit reasons and their counts */
+  exitsByReason: Record<string, number>;
+  /** Auto-exits where the milestone was NOT merged before exit — the #4761 producer metric */
+  exitsWithUnmergedWork: number;
+  /** Count of canonical-root-redirects (how often #4761 validation would have read stale state) */
+  canonicalRedirects: number;
+  /** #4765 — count of successful slice-level merges (slice-cadence feature) */
+  slicesMerged: number;
+  /** #4765 — count of slice-level merge conflicts */
+  sliceMergeConflicts: number;
+  /** #4765 — count of milestone-level re-squash operations */
+  milestoneResquashes: number;
+}
+
+/**
+ * Summarize worktree telemetry across the journal. Optional time window
+ * via filters.after / filters.before (ISO-8601).
+ */
+export function summarizeWorktreeTelemetry(
+  projectRoot: string,
+  filters?: { after?: string; before?: string },
+): WorktreeTelemetrySummary {
+  const entries = queryJournal(projectRoot, filters);
+
+  const summary: WorktreeTelemetrySummary = {
+    worktreesCreated: 0,
+    worktreesMerged: 0,
+    orphansDetected: 0,
+    orphansByReason: {},
+    mergeDurationsMs: [],
+    mergeConflicts: 0,
+    exitsByReason: {},
+    exitsWithUnmergedWork: 0,
+    canonicalRedirects: 0,
+    slicesMerged: 0,
+    sliceMergeConflicts: 0,
+    milestoneResquashes: 0,
+  };
+
+  for (const e of entries) {
+    const d = e.data ?? {};
+    switch (e.eventType) {
+      case "worktree-created":
+        summary.worktreesCreated++;
+        break;
+      case "worktree-merged":
+        summary.worktreesMerged++;
+        if (typeof d.durationMs === "number") summary.mergeDurationsMs.push(d.durationMs);
+        if (d.conflict === true) summary.mergeConflicts++;
+        break;
+      case "worktree-orphaned": {
+        summary.orphansDetected++;
+        const reason = typeof d.reason === "string" ? d.reason : "unknown";
+        summary.orphansByReason[reason] = (summary.orphansByReason[reason] ?? 0) + 1;
+        break;
+      }
+      case "auto-exit": {
+        const reason = typeof d.reason === "string" ? d.reason : "unknown";
+        summary.exitsByReason[reason] = (summary.exitsByReason[reason] ?? 0) + 1;
+        if (d.milestoneMerged === false) summary.exitsWithUnmergedWork++;
+        break;
+      }
+      case "canonical-root-redirect":
+        summary.canonicalRedirects++;
+        break;
+      case "slice-merged":
+        summary.slicesMerged++;
+        if (d.conflict === true) summary.sliceMergeConflicts++;
+        break;
+      case "milestone-resquash":
+        summary.milestoneResquashes++;
+        break;
+      default:
+        break;
+    }
+  }
+
+  summary.mergeDurationsMs.sort((a, b) => a - b);
+  return summary;
+}
+
+/**
+ * Return the p{quantile} of a sorted array using the nearest-rank method.
+ * Quantile in [0,1].
+ *
+ * Prior implementation used Math.floor(q*n), which overstates exact-rank
+ * quantiles by one sample (e.g. p95 of 20 values returned the max instead
+ * of the 19th value). The nearest-rank index is ceil(q*n) - 1, clamped to
+ * [0, n-1].
+ */
+export function percentile(sortedValues: number[], q: number): number | null {
+  if (sortedValues.length === 0) return null;
+  if (q <= 0) return sortedValues[0];
+  if (q >= 1) return sortedValues[sortedValues.length - 1];
+  const idx = Math.min(
+    sortedValues.length - 1,
+    Math.max(0, Math.ceil(q * sortedValues.length) - 1),
+  );
+  return sortedValues[idx];
+}

package/src/resources/extensions/mcp-client/auth.ts

@@ -37,7 +37,18 @@ export type McpHttpAuthConfig = McpHttpAuthHeaders & McpHttpOAuthConfig;
 function resolveEnvValue(value: string): string {
 	return value.replace(
 		/\$\{([^}]+)\}/g,
-		(_match, varName) => process.env[varName] ?? "",
+		(_match, varName) => {
+			const resolved = process.env[varName];
+			if (resolved === undefined || resolved === "") {
+				// eslint-disable-next-line no-console
+				console.warn(
+					`[mcp-client auth] Environment variable "${varName}" referenced in MCP server config is unset. ` +
+					`Requests will go out with a malformed header and the remote server will likely reject them with 401.`,
+				);
+				return "";
+			}
+			return resolved;
+		},
 	);
 }
 

package/src/resources/extensions/mcp-client/index.ts

@@ -11,7 +11,7 @@
  *   mcp_call      — Call a tool on an MCP server (lazy connect)
  */
 
-import type { ExtensionAPI } from "@gsd/pi-coding-agent";
+import type { ExtensionAPI, ExtensionContext } from "@gsd/pi-coding-agent";
 import {
 	truncateHead,
 	DEFAULT_MAX_BYTES,
@@ -33,6 +33,7 @@ import type { McpHttpAuthConfig } from "./auth.js";
 interface McpServerConfig {
 	name: string;
 	transport: "stdio" | "http" | "unknown";
+	sourcePath: string;
 	command?: string;
 	args?: string[];
 	env?: Record<string, string>;
@@ -58,8 +59,40 @@ interface ManagedConnection {
 // ─── Connection Manager ───────────────────────────────────────────────────────
 
 const connections = new Map<string, ManagedConnection>();
+const pendingConnections = new Map<string, Promise<Client>>();
 let configCache: McpServerConfig[] | null = null;
 const toolCache = new Map<string, McpToolSchema[]>();
+const trustedStdioServers = new Set<string>();
+
+const CHILD_ENV_ALLOWLIST = new Set([
+	"PATH",
+	"Path",
+	"HOME",
+	"USER",
+	"USERNAME",
+	"USERPROFILE",
+	"SHELL",
+	"TMPDIR",
+	"TEMP",
+	"TMP",
+	"SystemRoot",
+	"WINDIR",
+	"APPDATA",
+	"LOCALAPPDATA",
+	"XDG_CONFIG_HOME",
+	"XDG_CACHE_HOME",
+]);
+
+function stdioTrustKey(config: McpServerConfig): string {
+	return JSON.stringify({
+		name: config.name,
+		sourcePath: config.sourcePath,
+		command: config.command,
+		args: config.args ?? [],
+		cwd: config.cwd,
+		env: config.env ?? {},
+	});
+}
 
 function readConfigs(): McpServerConfig[] {
 	if (configCache) return configCache;
@@ -99,6 +132,7 @@ function readConfigs(): McpServerConfig[] {
 				servers.push({
 					name,
 					transport,
+					sourcePath: configPath,
 					...(hasCommand && {
 						command: config.command as string,
 						args: Array.isArray(config.args) ? (config.args as string[]) : undefined,
@@ -121,7 +155,57 @@ function readConfigs(): McpServerConfig[] {
 	return servers;
 }
 
-function getServerConfig(name: string): McpServerConfig | undefined {
+export function _buildMcpChildEnvForTest(configEnv: Record<string, string> | undefined): Record<string, string> {
+	const childEnv: Record<string, string> = {};
+	for (const key of CHILD_ENV_ALLOWLIST) {
+		const value = process.env[key];
+		if (typeof value === "string") childEnv[key] = value;
+	}
+	return {
+		...childEnv,
+		...(configEnv ? resolveEnv(configEnv) : {}),
+	};
+}
+
+export function _buildMcpTrustConfirmOptionsForTest(signal?: AbortSignal): { timeout: number; signal?: AbortSignal } {
+	return signal ? { timeout: 120_000, signal } : { timeout: 120_000 };
+}
+
+async function assertTrustedStdioServer(
+	config: McpServerConfig,
+	ctx?: ExtensionContext,
+	signal?: AbortSignal,
+): Promise<string | undefined> {
+	if (config.transport !== "stdio") return undefined;
+	const trustKey = stdioTrustKey(config);
+	if (trustedStdioServers.has(trustKey)) return undefined;
+
+	if (!ctx?.hasUI) {
+		throw new Error(
+			`MCP server "${config.name}" is a project-local stdio command from ${config.sourcePath}. ` +
+			"Run this from an interactive GSD session and approve the server before use.",
+		);
+	}
+
+	const commandLine = [config.command, ...(config.args ?? [])].filter(Boolean).join(" ");
+	const envKeys = Object.keys(config.env ?? {});
+	const envSummary = envKeys.length > 0
+		? `\n\nConfigured environment keys: ${envKeys.join(", ")}`
+		: "\n\nNo explicit environment keys configured.";
+	const approved = await ctx.ui.confirm(
+		`Trust MCP server "${config.name}"?`,
+		`Project config ${config.sourcePath} wants to start:\n\n${commandLine}${envSummary}\n\nOnly approve MCP servers you trust.`,
+		_buildMcpTrustConfirmOptionsForTest(signal),
+	);
+	if (!approved) {
+		throw new Error(`MCP server "${config.name}" was not approved by the user.`);
+	}
+	return trustKey;
+}
+
+// Exported for tests (see tests/server-name-spaces.test.ts).
+// Production call sites treat this as module-private.
+export function getServerConfig(name: string): McpServerConfig | undefined {
 	const trimmed = name.trim();
 	return readConfigs().find((s) =>
 		s.name === trimmed ||
@@ -145,7 +229,7 @@ function resolveEnv(env: Record<string, string>): Record<string, string> {
 	return resolved;
 }
 
-async function getOrConnect(name: string, signal?: AbortSignal): Promise<Client> {
+async function getOrConnect(name: string, signal?: AbortSignal, ctx?: ExtensionContext): Promise<Client> {
 	const config = getServerConfig(name);
 	if (!config) throw new Error(`Unknown MCP server: "${name}". Use mcp_servers to list available servers.`);
 
@@ -154,14 +238,29 @@ async function getOrConnect(name: string, signal?: AbortSignal): Promise<Client>
 	const existing = connections.get(config.name);
 	if (existing) return existing.client;
 
+	const pending = pendingConnections.get(config.name);
+	if (pending) return pending;
+
+	const connectionPromise = connectServer(config, signal, ctx);
+	pendingConnections.set(config.name, connectionPromise);
+	try {
+		return await connectionPromise;
+	} finally {
+		pendingConnections.delete(config.name);
+	}
+}
+
+async function connectServer(config: McpServerConfig, signal?: AbortSignal, ctx?: ExtensionContext): Promise<Client> {
 	const client = new Client({ name: "gsd", version: "1.0.0" });
 	let transport: StdioClientTransport | StreamableHTTPClientTransport;
+	let approvedTrustKey: string | undefined;
 
 	if (config.transport === "stdio" && config.command) {
+		approvedTrustKey = await assertTrustedStdioServer(config, ctx, signal);
 		transport = new StdioClientTransport({
 			command: config.command,
 			args: config.args,
-			env: config.env ? { ...process.env, ...resolveEnv(config.env) } as Record<string, string> : undefined,
+			env: _buildMcpChildEnvForTest(config.env),
 			cwd: config.cwd,
 			stderr: "pipe",
 		});
@@ -179,9 +278,24 @@ async function getOrConnect(name: string, signal?: AbortSignal): Promise<Client>
 		throw new Error(`Server "${config.name}" has unsupported transport: ${config.transport}`);
 	}
 
-	await client.connect(transport, { signal, timeout: 30000 });
-	connections.set(config.name, { client, transport });
-	return client;
+	try {
+		await client.connect(transport, { signal, timeout: 30000 });
+		if (approvedTrustKey) trustedStdioServers.add(approvedTrustKey);
+		connections.set(config.name, { client, transport });
+		return client;
+	} catch (err) {
+		try {
+			await transport.close();
+		} catch {
+			// Best-effort cleanup after a failed or aborted connection attempt.
+		}
+		try {
+			await client.close();
+		} catch {
+			// Best-effort cleanup after a failed or aborted connection attempt.
+		}
+		throw err;
+	}
 }
 
 async function closeAll(): Promise<void> {
@@ -191,9 +305,16 @@ async function closeAll(): Promise<void> {
 		} catch {
 			// Best-effort cleanup
 		}
+		try {
+			await conn.transport.close();
+		} catch {
+			// Best-effort cleanup
+		}
 		connections.delete(name);
 	});
 	await Promise.allSettled(closing);
+	pendingConnections.clear();
+	trustedStdioServers.clear();
 	toolCache.clear();
 }
 
@@ -331,7 +452,7 @@ export default function (pi: ExtensionAPI) {
 			}),
 		}),
 
-		async execute(_id, params, signal) {
+		async execute(_id, params, signal, _onUpdate, ctx) {
 			try {
 				// Return cached tools if available
 				const cached = toolCache.get(params.server);
@@ -348,7 +469,7 @@ export default function (pi: ExtensionAPI) {
 					};
 				}
 
-				const client = await getOrConnect(params.server, signal);
+				const client = await getOrConnect(params.server, signal, ctx);
 				const result = await client.listTools(undefined, { signal, timeout: 30000 });
 				const tools: McpToolSchema[] = (result.tools ?? []).map((t) => ({
 					name: t.name,
@@ -423,9 +544,9 @@ export default function (pi: ExtensionAPI) {
 			),
 		}),
 
-		async execute(_id, params, signal) {
+		async execute(_id, params, signal, _onUpdate, ctx) {
 			try {
-				const client = await getOrConnect(params.server, signal);
+				const client = await getOrConnect(params.server, signal, ctx);
 				const result = await client.callTool(
 					{ name: params.tool, arguments: params.args ?? {} },
 					undefined,