gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.1594b263e

package/dist/resources/extensions/claude-code-cli/stream-adapter.js

@@ -3,11 +3,16 @@
  *
  * The SDK runs the full agentic loop (multi-turn, tool execution, compaction)
  * in one call. This adapter translates the SDK's streaming output into
- * AssistantMessageEvents for TUI rendering, then strips tool-call blocks from
- * the final AssistantMessage so GSD's agent loop doesn't try to dispatch them.
+ * AssistantMessageEvents for TUI rendering, then preserves externally executed
+ * tool-call blocks on the final AssistantMessage so Agent Core can render them
+ * while `externalToolExecution` prevents local redispatch.
  */
 import { EventStream } from "@gsd/pi-ai";
 import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
 import { PartialMessageBuilder, ZERO_USAGE, mapUsage } from "./partial-builder.js";
 import { buildWorkflowMcpServers } from "../gsd/workflow-mcp.js";
 import { showInterviewRound } from "../shared/tui.js";
@@ -44,32 +49,81 @@ export function getResultErrorMessage(result) {
 // ---------------------------------------------------------------------------
 // Claude binary resolution
 // ---------------------------------------------------------------------------
-/** Cached result of the `which`/`where claude` lookup so the shell is only spawned once per process. */
+/** Cached result of the Claude executable/script resolution so lookup runs once per process. */
 let cachedClaudePath = null;
+const requireFromHere = createRequire(import.meta.url);
 /** Return the shell command used to locate the `claude` binary on the given platform. */
 export function getClaudeLookupCommand(platform = process.platform) {
     return platform === "win32" ? "where claude" : "which claude";
 }
-/** Extract the first line of `which`/`where` output as the resolved binary path. */
-export function parseClaudeLookupOutput(output) {
-    return output
+/**
+ * Pick the most suitable path from `which`/`where` output.
+ *
+ * On Windows, `where claude` can return shim entries first (for example
+ * `...\\npm\\claude` / `...\\npm\\claude.cmd`) that the Claude Agent SDK treats
+ * as a native executable path and then fails to spawn. Prefer a native
+ * `.exe` candidate when present.
+ */
+export function parseClaudeLookupOutput(output, platform = process.platform) {
+    const lines = output
         .toString()
-        .trim()
-        .split(/\r?\n/)[0] ?? "";
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    if (lines.length === 0)
+        return "";
+    if (platform !== "win32")
+        return lines[0] ?? "";
+    const exeCandidate = lines.find((line) => /\.exe$/i.test(line));
+    if (exeCandidate)
+        return exeCandidate;
+    const cmdCandidate = lines.find((line) => /\.cmd$/i.test(line));
+    if (cmdCandidate)
+        return cmdCandidate;
+    return lines[0] ?? "";
+}
+/** Resolve the SDK-bundled cli.js path if available. */
+export function resolveBundledClaudeCliPath() {
+    try {
+        const sdkEntry = requireFromHere.resolve("@anthropic-ai/claude-agent-sdk");
+        const cliPath = join(dirname(sdkEntry), "cli.js");
+        return existsSync(cliPath) ? cliPath : null;
+    }
+    catch {
+        return null;
+    }
 }
 /**
- * Resolve the path to the system-installed `claude` binary.
- * The SDK defaults to a bundled cli.js which doesn't exist when
- * installed as a library — we need to point it at the real CLI.
+ * Normalize a discovered path for Claude Agent SDK consumption.
+ *
+ * On Windows, the SDK treats non-`.js` paths as native binaries. NPM shims
+ * like `claude`/`claude.cmd` are not native binaries and can fail with
+ * `ENOENT`/`EINVAL` in that mode. When no `.exe` is available, prefer the
+ * SDK-bundled `cli.js` so the SDK runs via Node.
  */
+export function normalizeClaudePathForSdk(resolvedPath, platform = process.platform, bundledCliPath = resolveBundledClaudeCliPath()) {
+    if (platform !== "win32")
+        return resolvedPath;
+    if (/\.exe$/i.test(resolvedPath))
+        return resolvedPath;
+    if (bundledCliPath)
+        return bundledCliPath;
+    return resolvedPath;
+}
+/** Resolve the path passed to `pathToClaudeCodeExecutable`. */
 function getClaudePath() {
     if (cachedClaudePath)
         return cachedClaudePath;
+    const fallback = process.platform === "win32"
+        ? (resolveBundledClaudeCliPath() ?? "claude.cmd")
+        : "claude";
     try {
-        cachedClaudePath = parseClaudeLookupOutput(execSync(getClaudeLookupCommand(), { timeout: 5_000, stdio: "pipe" }));
+        const lookupOutput = execSync(getClaudeLookupCommand(), { timeout: 5_000, stdio: "pipe" });
+        const parsed = parseClaudeLookupOutput(lookupOutput, process.platform);
+        cachedClaudePath = normalizeClaudePathForSdk(parsed || fallback, process.platform);
     }
     catch {
-        cachedClaudePath = "claude"; // fall back to PATH resolution
+        cachedClaudePath = fallback;
     }
     return cachedClaudePath;
 }
@@ -432,6 +486,408 @@ async function promptTextInputElicitation(request, fields, ui, signal) {
     }
     return { action: "accept", content };
 }
+/**
+ * Known CLI tools where the subcommand verb changes the risk profile.
+ * Value = number of subcommand tokens (beyond the executable) to capture
+ * in the "Always Allow" permission pattern.
+ *
+ * `git push` and `git log` are very different → depth 1 → `Bash(git push:*)`
+ * `gh pr create` and `gh pr list` differ at depth 2 → `Bash(gh pr create:*)`
+ * `ping` is always safe → not listed → `Bash(ping:*)`
+ */
+const SUBCOMMAND_DEPTH = {
+    git: 1,
+    gh: 2,
+    npm: 1,
+    npx: 1,
+    yarn: 1,
+    pnpm: 1,
+    docker: 1,
+    kubectl: 1,
+    aws: 2,
+    az: 2,
+    gcloud: 2,
+    cargo: 1,
+    pip: 1,
+    pip3: 1,
+    brew: 1,
+    terraform: 1,
+    helm: 1,
+    dotnet: 1,
+};
+/** Command wrappers to skip when extracting the base executable. */
+const CMD_PASSTHROUGH = new Set(["sudo", "env", "command"]);
+/**
+ * Build a smart permission pattern for Bash "Always Allow".
+ *
+ * Simple commands → `Bash(ping:*)` (any args are fine)
+ * Subcommand-sensitive CLIs → `Bash(git push:*)` (verb is captured, args wildcarded)
+ */
+export function buildBashPermissionPattern(command) {
+    // When the command is a chain like "cd /foo && gh pr list", extract the
+    // last segment — `cd` is just setup, the meaningful operation is what follows.
+    const segments = command.split(/\s*(?:&&|\|\||;)\s*/);
+    // Skip leading `cd` (directory setup) and trailing error suppressors
+    // like `|| true`, `|| :`, `|| echo ...`.  The meaningful command is
+    // the first segment that is *neither* of those.
+    const SETUP_RE = /^\s*cd\s/;
+    const SUPPRESSOR_RE = /^\s*(?:true|:|echo\b)/;
+    let meaningful;
+    if (segments.length > 1) {
+        // Strip suppressors, then strip cd prefixes; take the *last* remaining
+        // segment — that's the meaningful command.
+        const trimmed = segments.filter(s => !SUPPRESSOR_RE.test(s));
+        const core = trimmed.filter(s => !SETUP_RE.test(s));
+        meaningful = core.length > 0 ? core[core.length - 1] : trimmed[trimmed.length - 1];
+    }
+    meaningful = meaningful || segments[0] || command;
+    const rawTokens = meaningful.trim().split(/\s+/);
+    // Skip sudo/env wrappers and leading VAR=val assignments
+    let idx = 0;
+    while (idx < rawTokens.length) {
+        if (CMD_PASSTHROUGH.has(rawTokens[idx])) {
+            idx++;
+            continue;
+        }
+        if (/^[A-Za-z_]\w*=/.test(rawTokens[idx])) {
+            idx++;
+            continue;
+        }
+        break;
+    }
+    const tokens = rawTokens.slice(idx).filter(Boolean);
+    if (tokens.length === 0)
+        return "Bash(*)";
+    // Strip path and .exe from executable name
+    const base = tokens[0].replace(/^.*[\\/]/, "").replace(/\.exe$/i, "");
+    const depth = SUBCOMMAND_DEPTH[base];
+    if (depth !== undefined) {
+        // Capture base + N subcommand tokens: "gh pr list" → Bash(gh pr list:*)
+        const significant = [base, ...tokens.slice(1, 1 + depth)].join(" ");
+        return `Bash(${significant}:*)`;
+    }
+    // Simple command — any args are fine: "ping" → Bash(ping:*)
+    return `Bash(${base}:*)`;
+}
+/**
+ * Build the list of granularity options presented after a user chooses
+ * "Always Allow" for a Bash command.
+ *
+ * Rather than assuming the user wants the default smart pattern, the UI
+ * shows every meaningful prefix so the user explicitly picks the scope:
+ *
+ *   "gh pr list --limit 5" → [
+ *     "Bash(gh:*)",         // allow any gh command
+ *     "Bash(gh pr:*)",      // allow any gh pr subcommand
+ *     "Bash(gh pr list:*)", // allow just this verb
+ *   ]
+ *
+ * Flags (tokens starting with `-`) terminate the subcommand chain — they
+ * are call-site arguments, not stable verbs. Subcommand depth is capped
+ * at 3 to keep the menu short (max 4 options).
+ *
+ * Returns a single-entry list when there is no meaningful subcommand to
+ * choose from (e.g. `ls -la`). Callers can skip the second dialog in
+ * that case.
+ */
+export function buildBashPermissionPatternOptions(command) {
+    const segments = command.split(/\s*(?:&&|\|\||;)\s*/);
+    const SETUP_RE = /^\s*cd\s/;
+    const SUPPRESSOR_RE = /^\s*(?:true|:|echo\b)/;
+    let meaningful;
+    if (segments.length > 1) {
+        const trimmed = segments.filter(s => !SUPPRESSOR_RE.test(s));
+        const core = trimmed.filter(s => !SETUP_RE.test(s));
+        meaningful = core.length > 0 ? core[core.length - 1] : trimmed[trimmed.length - 1];
+    }
+    meaningful = meaningful || segments[0] || command;
+    const rawTokens = meaningful.trim().split(/\s+/);
+    let idx = 0;
+    while (idx < rawTokens.length) {
+        if (CMD_PASSTHROUGH.has(rawTokens[idx])) {
+            idx++;
+            continue;
+        }
+        if (/^[A-Za-z_]\w*=/.test(rawTokens[idx])) {
+            idx++;
+            continue;
+        }
+        break;
+    }
+    const tokens = rawTokens.slice(idx).filter(Boolean);
+    if (tokens.length === 0)
+        return ["Bash(*)"];
+    const base = tokens[0].replace(/^.*[\\/]/, "").replace(/\.exe$/i, "");
+    // Collect up to 3 subcommand tokens, stopping at the first flag.
+    const subTokens = [];
+    for (let i = 1; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t.startsWith("-"))
+            break;
+        subTokens.push(t);
+        if (subTokens.length >= 3)
+            break;
+    }
+    const patterns = [`Bash(${base}:*)`];
+    for (let i = 1; i <= subTokens.length; i++) {
+        patterns.push(`Bash(${[base, ...subTokens.slice(0, i)].join(" ")}:*)`);
+    }
+    return patterns;
+}
+/**
+ * Read Bash allow-rule patterns from project and user settings files.
+ *
+ * Returns the ruleContent portion (e.g. `"gh pr list:*"`) for each
+ * `Bash(...)` entry found in `permissions.allow`.
+ */
+function readBashAllowRulesFromSettings() {
+    const rules = [];
+    const paths = [
+        join(process.cwd(), ".claude", "settings.local.json"),
+        join(process.cwd(), ".claude", "settings.json"),
+    ];
+    try {
+        paths.push(join(homedir(), ".claude", "settings.json"));
+    }
+    catch {
+        // homedir() can throw on some platforms
+    }
+    for (const settingsPath of paths) {
+        try {
+            if (!existsSync(settingsPath))
+                continue;
+            const raw = JSON.parse(readFileSync(settingsPath, "utf8"));
+            const allow = raw?.permissions?.allow;
+            if (!Array.isArray(allow))
+                continue;
+            for (const entry of allow) {
+                if (typeof entry !== "string")
+                    continue;
+                const m = /^Bash\((.+)\)$/.exec(entry);
+                if (m)
+                    rules.push(m[1]);
+            }
+        }
+        catch {
+            // Ignore malformed settings files
+        }
+    }
+    return rules;
+}
+/**
+ * Check if a Bash compound command matches saved allow rules after
+ * extracting the meaningful segment.
+ *
+ * The SDK's built-in matcher refuses to match prefix rules against
+ * compound commands (e.g. `cd /path && gh pr list`). Claude Code
+ * routinely prepends `cd <cwd> &&` to commands, causing saved rules
+ * to never match on re-invocation. This function strips safe leading
+ * segments (only `cd` commands) and checks the remaining operation
+ * against saved rules.
+ *
+ * For compound commands, returns true only when all leading segments
+ * are `cd` commands and the final segment matches a saved rule.
+ * For simple (single-segment) commands, checks directly against saved
+ * rules — this covers the case where a rule was added mid-session and
+ * the SDK's in-memory cache is stale.
+ */
+export function bashCommandMatchesSavedRules(command) {
+    const segments = command.split(/\s*(?:&&|\|\||;)\s*/).filter(Boolean);
+    if (segments.length === 0)
+        return false;
+    let meaningful;
+    if (segments.length === 1) {
+        meaningful = segments[0].trim();
+    }
+    else {
+        // Strip trailing error suppressors (|| true, || :, || echo ...)
+        // and leading cd segments.  The first remaining segment is the
+        // meaningful command.  All other non-cd, non-suppressor segments
+        // must be absent — otherwise we can't safely auto-approve.
+        const SETUP_RE = /^cd\s/;
+        const SUPPRESSOR_RE = /^\s*(?:true|:|echo\b)/;
+        const trimmed = segments.filter(s => !SUPPRESSOR_RE.test(s.trim()));
+        const core = trimmed.filter(s => !SETUP_RE.test(s.trim()));
+        if (core.length !== 1)
+            return false; // ambiguous — multiple real commands
+        meaningful = core[0].trim();
+    }
+    if (!meaningful)
+        return false;
+    const rules = readBashAllowRulesFromSettings();
+    if (rules.length === 0)
+        return false;
+    for (const rule of rules) {
+        const prefixMatch = /^(.+):\*$/.exec(rule);
+        if (prefixMatch) {
+            const prefix = prefixMatch[1];
+            if (meaningful === prefix || meaningful.startsWith(prefix + " ")) {
+                return true;
+            }
+            continue;
+        }
+        // Exact match
+        if (meaningful === rule)
+            return true;
+    }
+    return false;
+}
+/** Format the tool input into a human-readable summary for the permission prompt. */
+function formatToolInput(toolName, input) {
+    // Bash — show the command
+    if (input.command && typeof input.command === "string") {
+        const cmd = input.command.length > 300 ? input.command.slice(0, 300) + "…" : input.command;
+        return cmd;
+    }
+    // File-oriented tools — show path
+    if (input.file_path && typeof input.file_path === "string") {
+        return `${toolName}: ${input.file_path}`;
+    }
+    // Generic fallback — compact JSON, truncated
+    const json = JSON.stringify(input);
+    if (json.length <= 200)
+        return json;
+    return json.slice(0, 200) + "…";
+}
+/**
+ * Create a canUseTool handler that routes SDK permission requests through the
+ * extension UI's select dialog, or auto-approves when no UI is available.
+ *
+ * Presents three options:
+ * - **Allow** — approve this one invocation
+ * - **Always Allow** — approve and pass `suggestions` back as `updatedPermissions`
+ *   so the SDK remembers the choice for the rest of the session
+ * - **Deny** — reject the invocation
+ *
+ * Follows the same pattern as {@link createClaudeCodeElicitationHandler}:
+ * takes an optional UI context and returns the callback or undefined.
+ *
+ * When UI is unavailable (headless / auto-mode sub-agents), returns a handler
+ * that always approves — replacing the old GSD_AUTO_MODE → bypassPermissions
+ * workaround.
+ */
+export function createClaudeCodeCanUseToolHandler(ui) {
+    if (!ui)
+        return undefined;
+    return async (toolName, _input, options) => {
+        // Abort early if the signal is already fired
+        if (options.signal.aborted) {
+            return { behavior: "deny", message: "Aborted", toolUseID: options.toolUseID };
+        }
+        // For Bash compound commands (e.g. "cd /path && gh pr list"),
+        // check if the meaningful operation matches a saved allow rule.
+        // The SDK's built-in matcher rejects prefix rules for compound
+        // commands, but cd-prefixed commands are routine and the actual
+        // operation is already approved.
+        if (toolName === "Bash" && typeof _input.command === "string") {
+            if (bashCommandMatchesSavedRules(_input.command)) {
+                return { behavior: "allow", updatedInput: _input, toolUseID: options.toolUseID };
+            }
+        }
+        const inputSummary = formatToolInput(toolName, _input);
+        const title = options.title || `Allow Claude Code to use: ${toolName}?`;
+        const body = [
+            options.description,
+            inputSummary,
+        ].filter(Boolean).join("\n");
+        // The 2nd menu (level picker) lets the user choose the exact pattern,
+        // so the 1st menu just shows "Always Allow" without a command suffix.
+        const alwaysAllowLabel = "Always Allow";
+        try {
+            const choice = await ui.select(`${title}\n${body}`, ["Allow", alwaysAllowLabel, "Deny"], { signal: options.signal });
+            if (options.signal.aborted) {
+                return { behavior: "deny", message: "Aborted", toolUseID: options.toolUseID };
+            }
+            if (choice === alwaysAllowLabel) {
+                // Pass the SDK's own suggestions back as updatedPermissions so
+                // it knows how to persist them (PermissionUpdate[] shape).
+                // For Bash, patch the ruleContent with the user-chosen
+                // granularity pattern (e.g. "gh", "gh pr", "gh pr list") so
+                // the saved rule matches the scope the user actually wants.
+                let perms = options.suggestions;
+                let notifyLabel;
+                if (toolName === "Bash" && typeof _input.command === "string") {
+                    // Present every meaningful prefix so the user picks the
+                    // scope explicitly rather than getting a blanket match.
+                    const patternOptions = buildBashPermissionPatternOptions(_input.command);
+                    let chosenPattern;
+                    if (patternOptions.length <= 1) {
+                        // No subcommand choice to make (e.g. "ls -la") — use
+                        // the single available pattern directly.
+                        chosenPattern = patternOptions[0] ?? buildBashPermissionPattern(_input.command);
+                    }
+                    else {
+                        const levelChoiceRaw = await ui.select("Save permission at which level?", patternOptions, { signal: options.signal });
+                        if (options.signal.aborted) {
+                            return { behavior: "deny", message: "Aborted", toolUseID: options.toolUseID };
+                        }
+                        const levelChoice = Array.isArray(levelChoiceRaw) ? levelChoiceRaw[0] : levelChoiceRaw;
+                        if (!levelChoice || !patternOptions.includes(levelChoice)) {
+                            // User dismissed the level picker — cancel the
+                            // tool use. Falling back to a one-time allow
+                            // here would leave the spawned agent running
+                            // with no clear signal that the user bailed.
+                            return {
+                                behavior: "deny",
+                                message: "User cancelled permission selection",
+                                toolUseID: options.toolUseID,
+                            };
+                        }
+                        chosenPattern = levelChoice;
+                    }
+                    notifyLabel = chosenPattern;
+                    // Extract the ruleContent portion from "Bash(gh pr list:*)" → "gh pr list:*"
+                    const ruleContent = chosenPattern.replace(/^Bash\(/, "").replace(/\)$/, "");
+                    if (perms && Array.isArray(perms) && perms.length > 0) {
+                        // Clone suggestions and patch ruleContent on any Bash addRules entry
+                        perms = perms.map((s) => {
+                            if (s.type === "addRules" && Array.isArray(s.rules)) {
+                                return {
+                                    ...s,
+                                    rules: s.rules.map((r) => r.toolName === "Bash" ? { ...r, ruleContent } : r),
+                                };
+                            }
+                            return s;
+                        });
+                    }
+                    else {
+                        // No suggestions from SDK — build a proper PermissionUpdate
+                        perms = [{
+                                type: "addRules",
+                                rules: [{ toolName: "Bash", ruleContent }],
+                                behavior: "allow",
+                                destination: "localSettings",
+                            }];
+                    }
+                }
+                // Notify with the resolved pattern (label already previewed it)
+                if (notifyLabel) {
+                    ui.notify(`Saved: ${notifyLabel}`, "info");
+                }
+                return {
+                    behavior: "allow",
+                    updatedInput: _input,
+                    toolUseID: options.toolUseID,
+                    ...(perms ? { updatedPermissions: perms } : {}),
+                };
+            }
+            if (choice === "Allow") {
+                return {
+                    behavior: "allow",
+                    updatedInput: _input,
+                    toolUseID: options.toolUseID,
+                };
+            }
+            return { behavior: "deny", message: "User denied", toolUseID: options.toolUseID };
+        }
+        catch {
+            return { behavior: "deny", message: "Aborted", toolUseID: options.toolUseID };
+        }
+    };
+}
+// ---------------------------------------------------------------------------
+// Elicitation handler
+// ---------------------------------------------------------------------------
 /** Create an SDK elicitation handler that routes requests through the extension UI dialogs, or undefined if no UI is available. */
 export function createClaudeCodeElicitationHandler(ui) {
     if (!ui)
@@ -484,24 +940,32 @@ export function makeAbortedMessage(model, lastTextContent) {
 /**
  * Resolve the Claude Code permission mode for the current run.
  *
- * GSD subagents run underneath a host Claude Code session the user has
- * already consented to, and their work (edits, shell inspection, MCP calls)
- * spans the full workflow toolset. Defaulting the inner SDK to
- * `bypassPermissions` avoids per-tool approval prompts that offer no
- * meaningful safety beyond what the host session and the subagent prompts
- * already enforce. `GSD_CLAUDE_CODE_PERMISSION_MODE` lets security-conscious
- * users opt into a stricter mode (`acceptEdits`, `default`, `plan`).
+ * Defaults to `acceptEdits`, which auto-approves file reads/edits but
+ * surfaces a permission dialog for dangerous operations (e.g. general Bash,
+ * Agent, WebFetch). This prevents tools outside the allowlist from being
+ * silently denied — the SDK emits an `extension_ui_request` event so the
+ * user sees a prompt instead of a silent refusal that Claude Code mistakes
+ * for user rejection (#4383).
+ *
+ * Set `GSD_CLAUDE_CODE_PERMISSION_MODE` to `bypassPermissions` to restore
+ * the old always-approve behaviour, or to `default` / `plan` for stricter
+ * modes.
  *
- * Tradeoff: bypass means a prompt-injection payload read from an untrusted
- * file could trigger tool calls without a second gate. Accepted for GSD
- * because the workflow is explicit user intent and the alternative
- * (#4099) is continuous approval fatigue that blocks real work.
+ * When `GSD_HEADLESS=1` is set (auto-mode / non-interactive runs), the
+ * default flips to `bypassPermissions` because there is no UI to approve
+ * permission dialogs — `acceptEdits` would hang verification commands like
+ * `npx tsc --noEmit` or `npx vitest run` indefinitely (#4657). Explicit
+ * overrides still win, so users can opt back into `acceptEdits` in headless.
  */
 export async function resolveClaudePermissionMode(env = process.env) {
     const override = env.GSD_CLAUDE_CODE_PERMISSION_MODE?.trim();
     if (override === "bypassPermissions" || override === "acceptEdits" || override === "default" || override === "plan") {
         return override;
     }
+    if (env.GSD_HEADLESS === "1") {
+        console.warn("[claude-code-cli] Headless mode detected (GSD_HEADLESS=1): defaulting permissionMode to 'bypassPermissions' so verification Bash commands can run. Set GSD_CLAUDE_CODE_PERMISSION_MODE=acceptEdits to opt out.");
+        return "bypassPermissions";
+    }
     return "bypassPermissions";
 }
 // NOTE: These helpers intentionally mirror @gsd/pi-ai anthropic-shared
@@ -555,20 +1019,24 @@ export function buildSdkOptions(modelId, prompt, overrides, extraOptions = {}) {
     const { reasoning, ...sdkExtraOptions } = extraOptions;
     const mcpServers = buildWorkflowMcpServers();
     const permissionMode = overrides?.permissionMode ?? "bypassPermissions";
-    const disallowedTools = ["AskUserQuestion"];
-    // Pre-authorize the safe built-ins and every registered workflow MCP
-    // server's tools. `acceptEdits` mode (the interactive default) only
-    // auto-approves file edits — Read/Glob/Grep, basic shell inspection, and
-    // every `mcp__gsd-workflow__*` call still surface as "This command
-    // requires approval" and block GSD actions (#4099).
+    // Globally unblock all tools. Users reported that the `acceptEdits` default
+    // plus a narrow allowlist silently declined most Bash/Agent/WebFetch calls
+    // when `extensionUIContext` wasn't threaded through. Default to
+    // bypassPermissions and an empty disallow list so every tool — including
+    // `AskUserQuestion` and every `mcp__*` workflow tool — is auto-approved.
+    // Opt back into gated mode with GSD_CLAUDE_CODE_PERMISSION_MODE=acceptEdits.
+    const disallowedTools = [];
     const allowedTools = [
         "Read",
         "Write",
         "Edit",
         "Glob",
         "Grep",
-        "Bash(ls:*)",
-        "Bash(pwd)",
+        "Bash",
+        "Agent",
+        "WebFetch",
+        "WebSearch",
+        "AskUserQuestion",
         ...(mcpServers ? Object.keys(mcpServers).map((serverName) => `mcp__${serverName}__*`) : []),
     ];
     const supportsAdaptive = modelSupportsAdaptiveThinking(modelId);
@@ -755,6 +1223,39 @@ function attachExternalResultsToToolBlocks(toolBlocks, toolResultsById) {
         block.externalResult = externalResult;
     }
 }
+/**
+ * Build the final assistant content that Agent Core consumes in
+ * `externalToolExecution` mode. This preserves tool-call blocks, attaches any
+ * SDK-produced external results by tool-call id, and then appends the final
+ * text/thinking blocks for the completed turn.
+ */
+export function buildFinalAssistantContent(params) {
+    const mergedToolBlocks = [...params.intermediateToolBlocks];
+    if (params.pendingContent) {
+        mergePendingToolCalls(mergedToolBlocks, params.pendingContent);
+    }
+    attachExternalResultsToToolBlocks(mergedToolBlocks, params.toolResultsById);
+    const finalContent = [...mergedToolBlocks];
+    if (params.pendingContent && params.pendingContent.length > 0) {
+        for (const block of params.pendingContent) {
+            if (block.type === "text" || block.type === "thinking") {
+                finalContent.push(block);
+            }
+        }
+    }
+    else {
+        if (params.lastThinkingContent) {
+            finalContent.push({ type: "thinking", thinking: params.lastThinkingContent });
+        }
+        if (params.lastTextContent) {
+            finalContent.push({ type: "text", text: params.lastTextContent });
+        }
+    }
+    if (finalContent.length === 0 && params.fallbackResultText) {
+        finalContent.push({ type: "text", text: params.fallbackResultText });
+    }
+    return finalContent;
+}
 /**
  * Merge tool-call blocks from the active partial-message builder into the
  * running list of intermediate tool calls, preserving order and de-duping
@@ -784,8 +1285,9 @@ export function mergePendingToolCalls(intermediate, pending) {
  * GSD streamSimple function that delegates to the Claude Agent SDK.
  *
  * Emits AssistantMessageEvent deltas for real-time TUI rendering
- * (thinking, text, tool calls). The final AssistantMessage has tool-call
- * blocks stripped so the agent loop ends the turn without local dispatch.
+ * (thinking, text, tool calls). The final AssistantMessage preserves
+ * SDK-executed tool-call blocks for Agent Core's `externalToolExecution`
+ * path, which renders the results without dispatching the tools locally.
  */
 export function streamViaClaudeCode(model, context, options) {
     const stream = createAssistantStream();
@@ -815,12 +1317,21 @@ async function pumpSdkMessages(model, context, options, stream) {
         const prompt = buildPromptFromContext(context);
         const queryPrompt = buildSdkQueryPrompt(context, prompt);
         const permissionMode = await resolveClaudePermissionMode();
-        const sdkOpts = buildSdkOptions(modelId, prompt, { permissionMode }, typeof options?.extensionUIContext === "object"
-            ? {
-                reasoning: options?.reasoning,
-                onElicitation: createClaudeCodeElicitationHandler(options?.extensionUIContext),
-            }
-            : { reasoning: options?.reasoning });
+        const uiContext = options?.extensionUIContext;
+        const canUseToolHandler = createClaudeCodeCanUseToolHandler(uiContext);
+        // When no UI is available (headless / auto-mode), auto-approve all
+        // tool requests. This replaces the old bypassPermissions workaround.
+        const canUseToolFallback = canUseToolHandler
+            ?? (async (_toolName, _input, opts) => ({ behavior: "allow", toolUseID: opts.toolUseID }));
+        const sdkOpts = buildSdkOptions(modelId, prompt, { permissionMode }, {
+            reasoning: options?.reasoning,
+            canUseTool: canUseToolFallback,
+            ...(uiContext
+                ? {
+                    onElicitation: createClaudeCodeElicitationHandler(uiContext),
+                }
+                : {}),
+        });
         const queryResult = sdk.query({
             prompt: queryPrompt,
             options: {
@@ -948,42 +1459,14 @@ async function pumpSdkMessages(model, context, options, stream) {
                 // -- Result (terminal) --
                 case "result": {
                     const result = msg;
-                    // Build final message. Include intermediate tool calls so the
-                    // agent loop's externalToolExecution path emits tool_execution
-                    // events for proper TUI rendering, followed by the text response.
-                    const finalContent = [];
-                    // If the final turn ended without a synthetic user message
-                    // (e.g. stop_reason: "tool_use" followed directly by result,
-                    // or a turn with text but no tool execution), the `builder`
-                    // still holds toolCall blocks that were never pushed into
-                    // `intermediateToolBlocks`. Fold them in here so they aren't
-                    // dropped from the final AssistantMessage.
-                    if (builder) {
-                        mergePendingToolCalls(intermediateToolBlocks, builder.message.content);
-                    }
-                    // Add tool calls from intermediate turns first (renders above text)
-                    attachExternalResultsToToolBlocks(intermediateToolBlocks, toolResultsById);
-                    finalContent.push(...intermediateToolBlocks);
-                    // Add text/thinking from the last turn
-                    if (builder && builder.message.content.length > 0) {
-                        for (const block of builder.message.content) {
-                            if (block.type === "text" || block.type === "thinking") {
-                                finalContent.push(block);
-                            }
-                        }
-                    }
-                    else {
-                        if (lastThinkingContent) {
-                            finalContent.push({ type: "thinking", thinking: lastThinkingContent });
-                        }
-                        if (lastTextContent) {
-                            finalContent.push({ type: "text", text: lastTextContent });
-                        }
-                    }
-                    // Fallback: use the SDK's result text if we have no content
-                    if (finalContent.length === 0 && result.subtype === "success" && result.result) {
-                        finalContent.push({ type: "text", text: result.result });
-                    }
+                    const finalContent = buildFinalAssistantContent({
+                        intermediateToolBlocks,
+                        pendingContent: builder?.message.content,
+                        toolResultsById,
+                        lastThinkingContent,
+                        lastTextContent,
+                        fallbackResultText: result.subtype === "success" && result.result ? result.result : undefined,
+                    });
                     const finalMessage = {
                         role: "assistant",
                         content: finalContent,