gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.1d17f366c

package/scripts/postinstall.js

@@ -1,180 +1,11 @@
 #!/usr/bin/env node
 
-import { exec as execCb, spawnSync } from 'child_process'
-import { createHash, randomUUID } from 'crypto'
-import { chmodSync, copyFileSync, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'fs'
-import { arch, homedir, platform } from 'os'
-import { dirname, resolve, join } from 'path'
-import { Readable } from 'stream'
-import { finished } from 'stream/promises'
-import extractZip from 'extract-zip'
-import { fileURLToPath } from 'url'
-
-const __dirname = dirname(fileURLToPath(import.meta.url))
-const cwd = resolve(__dirname, '..')
-const PLAYWRIGHT_SKIP =
-  process.env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD === '1' ||
-  process.env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD === 'true'
-const RTK_SKIP =
-  process.env.GSD_SKIP_RTK_INSTALL === '1' ||
-  process.env.GSD_SKIP_RTK_INSTALL === 'true' ||
-  process.env.GSD_RTK_DISABLED === '1' ||
-  process.env.GSD_RTK_DISABLED === 'true'
-
-const RTK_VERSION = '0.33.1'
-const RTK_REPO = 'rtk-ai/rtk'
-const RTK_ENV = { ...process.env, RTK_TELEMETRY_DISABLED: '1' }
-const managedBinDir = join(process.env.GSD_HOME || join(homedir(), '.gsd'), 'agent', 'bin')
-const managedBinaryPath = join(managedBinDir, platform() === 'win32' ? 'rtk.exe' : 'rtk')
-
-function run(cmd) {
-  return new Promise((resolvePromise) => {
-    execCb(cmd, { cwd }, (error, stdout, stderr) => {
-      resolvePromise({ ok: !error, stdout, stderr })
-    })
-  })
-}
-
-function logWarn(message) {
-  process.stderr.write(`[gsd] postinstall: ${message}\n`)
-}
-
-function resolveAssetName() {
-  const currentPlatform = platform()
-  const currentArch = arch()
-  if (currentPlatform === 'darwin' && currentArch === 'arm64') return 'rtk-aarch64-apple-darwin.tar.gz'
-  if (currentPlatform === 'darwin' && currentArch === 'x64') return 'rtk-x86_64-apple-darwin.tar.gz'
-  if (currentPlatform === 'linux' && currentArch === 'arm64') return 'rtk-aarch64-unknown-linux-gnu.tar.gz'
-  if (currentPlatform === 'linux' && currentArch === 'x64') return 'rtk-x86_64-unknown-linux-musl.tar.gz'
-  if (currentPlatform === 'win32' && currentArch === 'x64') return 'rtk-x86_64-pc-windows-msvc.zip'
-  return null
-}
-
-function parseChecksums(text) {
-  const checksums = new Map()
-  for (const rawLine of text.split(/\r?\n/)) {
-    const line = rawLine.trim()
-    if (!line) continue
-    const match = line.match(/^([a-f0-9]{64})\s+(.+)$/i)
-    if (!match) continue
-    checksums.set(match[2], match[1].toLowerCase())
-  }
-  return checksums
-}
-
-function sha256File(path) {
-  const hash = createHash('sha256')
-  hash.update(readFileSync(path))
-  return hash.digest('hex')
-}
-
-async function downloadToFile(url, destination) {
-  const response = await fetch(url, { headers: { 'User-Agent': 'gsd-pi-postinstall' } })
-  if (!response.ok) {
-    throw new Error(`download failed (${response.status}) for ${url}`)
-  }
-  if (!response.body) {
-    throw new Error(`download returned no body for ${url}`)
-  }
-  const output = createWriteStream(destination)
-  await finished(Readable.fromWeb(response.body).pipe(output))
-}
-
-function findBinaryRecursively(rootDir, binaryName) {
-  const stack = [rootDir]
-  while (stack.length > 0) {
-    const current = stack.pop()
-    if (!current) continue
-    const entries = readdirSync(current, { withFileTypes: true })
-    for (const entry of entries) {
-      const fullPath = join(current, entry.name)
-      if (entry.isFile() && entry.name === binaryName) return fullPath
-      if (entry.isDirectory()) stack.push(fullPath)
-    }
-  }
-  return null
-}
-
-function validateRtkBinary(binaryPath) {
-  const result = spawnSync(binaryPath, ['rewrite', 'git status'], {
-    encoding: 'utf-8',
-    env: RTK_ENV,
-    stdio: ['ignore', 'pipe', 'ignore'],
-    timeout: 5000,
-  })
-  return !result.error && result.status === 0 && (result.stdout || '').trim() === 'rtk git status'
-}
-
-async function ensureRtkInstalled() {
-  if (RTK_SKIP) return
-  const assetName = resolveAssetName()
-  if (!assetName) return
-  if (existsSync(managedBinaryPath) && validateRtkBinary(managedBinaryPath)) return
-
-  const tempRoot = join(managedBinDir, `.rtk-postinstall-${randomUUID().slice(0, 8)}`)
-  const archivePath = join(tempRoot, assetName)
-  const extractDir = join(tempRoot, 'extract')
-  const releaseBase = `https://github.com/${RTK_REPO}/releases/download/v${RTK_VERSION}`
-
-  mkdirSync(tempRoot, { recursive: true })
-  mkdirSync(managedBinDir, { recursive: true })
-
-  try {
-    const checksumsResponse = await fetch(`${releaseBase}/checksums.txt`, {
-      headers: { 'User-Agent': 'gsd-pi-postinstall' },
-    })
-    if (!checksumsResponse.ok) {
-      throw new Error(`failed to fetch RTK checksums (${checksumsResponse.status})`)
-    }
-
-    const checksums = parseChecksums(await checksumsResponse.text())
-    const expectedSha = checksums.get(assetName)
-    if (!expectedSha) {
-      throw new Error(`missing checksum for ${assetName}`)
-    }
-
-    await downloadToFile(`${releaseBase}/${assetName}`, archivePath)
-    const actualSha = sha256File(archivePath)
-    if (actualSha !== expectedSha) {
-      throw new Error(`checksum mismatch for ${assetName}`)
-    }
-
-    mkdirSync(extractDir, { recursive: true })
-    if (assetName.endsWith('.zip')) {
-      await extractZip(archivePath, { dir: extractDir })
-    } else {
-      const extractResult = spawnSync('tar', ['xzf', archivePath, '-C', extractDir], {
-        encoding: 'utf-8',
-        timeout: 30000,
-      })
-      if (extractResult.error || extractResult.status !== 0) {
-        throw new Error(extractResult.error?.message || extractResult.stderr?.trim() || `failed to extract ${assetName}`)
-      }
-    }
-
-    const extractedBinary = findBinaryRecursively(extractDir, platform() === 'win32' ? 'rtk.exe' : 'rtk')
-    if (!extractedBinary) {
-      throw new Error(`RTK binary not found in ${assetName}`)
-    }
-
-    copyFileSync(extractedBinary, managedBinaryPath)
-    if (platform() !== 'win32') {
-      chmodSync(managedBinaryPath, 0o755)
-    }
-
-    if (!validateRtkBinary(managedBinaryPath)) {
-      rmSync(managedBinaryPath, { force: true })
-      throw new Error('downloaded RTK binary failed validation')
-    }
-  } catch (error) {
-    logWarn(`RTK install skipped: ${error instanceof Error ? error.message : String(error)}`)
-  } finally {
-    rmSync(tempRoot, { recursive: true, force: true })
-  }
-}
-
-if (!PLAYWRIGHT_SKIP) {
-  await run('npx playwright install chromium')
-}
-
-await ensureRtkInstalled()
+/**
+ * GSD Postinstall
+ *
+ * Thin wrapper that delegates to install.js in postinstall mode
+ * (workspace linking + deps only, no global/local npm install).
+ */
+
+process.env.npm_lifecycle_event = process.env.npm_lifecycle_event || 'postinstall'
+import('./install.js')

package/src/resources/extensions/claude-code-cli/readiness.ts

@@ -21,10 +21,11 @@ const CLAUDE_COMMAND = process.platform === "win32" ? "claude.cmd" : "claude";
 
 /**
  * Windows installs vary: some environments expose `claude.cmd` (npm shim),
- * others expose a `claude` shim on PATH (for example Git Bash wrappers).
- * Try both to avoid false "not installed" results in readiness checks.
+ * `claude.exe` (direct binary install), or a bare `claude` shim on PATH
+ * (for example Git Bash wrappers). Try all three to avoid false "not
+ * installed" results in readiness checks.
  */
-const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude"] : [CLAUDE_COMMAND];
+const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude.exe", "claude"] : [CLAUDE_COMMAND];
 
 function execClaude(args: string[]): Buffer {
 	let lastError: unknown;

package/src/resources/extensions/claude-code-cli/stream-adapter.ts

@@ -3,8 +3,9 @@
  *
  * The SDK runs the full agentic loop (multi-turn, tool execution, compaction)
  * in one call. This adapter translates the SDK's streaming output into
- * AssistantMessageEvents for TUI rendering, then strips tool-call blocks from
- * the final AssistantMessage so GSD's agent loop doesn't try to dispatch them.
+ * AssistantMessageEvents for TUI rendering, then preserves externally executed
+ * tool-call blocks on the final AssistantMessage so Agent Core can render them
+ * while `externalToolExecution` prevents local redispatch.
  */
 
 import type {
@@ -692,18 +693,22 @@ export function makeAbortedMessage(model: string, lastTextContent: string): Assi
 /**
  * Resolve the Claude Code permission mode for the current run.
  *
- * GSD subagents run underneath a host Claude Code session the user has
- * already consented to, and their work (edits, shell inspection, MCP calls)
- * spans the full workflow toolset. Defaulting the inner SDK to
- * `bypassPermissions` avoids per-tool approval prompts that offer no
- * meaningful safety beyond what the host session and the subagent prompts
- * already enforce. `GSD_CLAUDE_CODE_PERMISSION_MODE` lets security-conscious
- * users opt into a stricter mode (`acceptEdits`, `default`, `plan`).
+ * Defaults to `acceptEdits`, which auto-approves file reads/edits but
+ * surfaces a permission dialog for dangerous operations (e.g. general Bash,
+ * Agent, WebFetch). This prevents tools outside the allowlist from being
+ * silently denied — the SDK emits an `extension_ui_request` event so the
+ * user sees a prompt instead of a silent refusal that Claude Code mistakes
+ * for user rejection (#4383).
  *
- * Tradeoff: bypass means a prompt-injection payload read from an untrusted
- * file could trigger tool calls without a second gate. Accepted for GSD
- * because the workflow is explicit user intent and the alternative
- * (#4099) is continuous approval fatigue that blocks real work.
+ * Set `GSD_CLAUDE_CODE_PERMISSION_MODE` to `bypassPermissions` to restore
+ * the old always-approve behaviour, or to `default` / `plan` for stricter
+ * modes.
+ *
+ * When `GSD_HEADLESS=1` is set (auto-mode / non-interactive runs), the
+ * default flips to `bypassPermissions` because there is no UI to approve
+ * permission dialogs — `acceptEdits` would hang verification commands like
+ * `npx tsc --noEmit` or `npx vitest run` indefinitely (#4657). Explicit
+ * overrides still win, so users can opt back into `acceptEdits` in headless.
  */
 export async function resolveClaudePermissionMode(
 	env: NodeJS.ProcessEnv = process.env,
@@ -712,6 +717,12 @@ export async function resolveClaudePermissionMode(
 	if (override === "bypassPermissions" || override === "acceptEdits" || override === "default" || override === "plan") {
 		return override;
 	}
+	if (env.GSD_HEADLESS === "1") {
+		console.warn(
+			"[claude-code-cli] Headless mode detected (GSD_HEADLESS=1): defaulting permissionMode to 'bypassPermissions' so verification Bash commands can run. Set GSD_CLAUDE_CODE_PERMISSION_MODE=acceptEdits to opt out.",
+		);
+		return "bypassPermissions";
+	}
 	return "bypassPermissions";
 }
 
@@ -773,20 +784,24 @@ export function buildSdkOptions(
 	const { reasoning, ...sdkExtraOptions } = extraOptions;
 	const mcpServers = buildWorkflowMcpServers();
 	const permissionMode = overrides?.permissionMode ?? "bypassPermissions";
-	const disallowedTools = ["AskUserQuestion"];
-	// Pre-authorize the safe built-ins and every registered workflow MCP
-	// server's tools. `acceptEdits` mode (the interactive default) only
-	// auto-approves file edits — Read/Glob/Grep, basic shell inspection, and
-	// every `mcp__gsd-workflow__*` call still surface as "This command
-	// requires approval" and block GSD actions (#4099).
+	// Globally unblock all tools. Users reported that the `acceptEdits` default
+	// plus a narrow allowlist silently declined most Bash/Agent/WebFetch calls
+	// when `extensionUIContext` wasn't threaded through. Default to
+	// bypassPermissions and an empty disallow list so every tool — including
+	// `AskUserQuestion` and every `mcp__*` workflow tool — is auto-approved.
+	// Opt back into gated mode with GSD_CLAUDE_CODE_PERMISSION_MODE=acceptEdits.
+	const disallowedTools: string[] = [];
 	const allowedTools = [
 		"Read",
 		"Write",
 		"Edit",
 		"Glob",
 		"Grep",
-		"Bash(ls:*)",
-		"Bash(pwd)",
+		"Bash",
+		"Agent",
+		"WebFetch",
+		"WebSearch",
+		"AskUserQuestion",
 		...(mcpServers ? Object.keys(mcpServers).map((serverName) => `mcp__${serverName}__*`) : []),
 	];
 	const supportsAdaptive = modelSupportsAdaptiveThinking(modelId);
@@ -994,6 +1009,49 @@ function attachExternalResultsToToolBlocks(
 	}
 }
 
+/**
+ * Build the final assistant content that Agent Core consumes in
+ * `externalToolExecution` mode. This preserves tool-call blocks, attaches any
+ * SDK-produced external results by tool-call id, and then appends the final
+ * text/thinking blocks for the completed turn.
+ */
+export function buildFinalAssistantContent(params: {
+	intermediateToolBlocks: AssistantMessage["content"];
+	pendingContent?: AssistantMessage["content"];
+	toolResultsById: ReadonlyMap<string, ExternalToolResultPayload>;
+	lastThinkingContent?: string;
+	lastTextContent?: string;
+	fallbackResultText?: string;
+}): AssistantMessage["content"] {
+	const mergedToolBlocks = [...params.intermediateToolBlocks];
+	if (params.pendingContent) {
+		mergePendingToolCalls(mergedToolBlocks, params.pendingContent);
+	}
+	attachExternalResultsToToolBlocks(mergedToolBlocks, params.toolResultsById);
+
+	const finalContent: AssistantMessage["content"] = [...mergedToolBlocks];
+	if (params.pendingContent && params.pendingContent.length > 0) {
+		for (const block of params.pendingContent) {
+			if (block.type === "text" || block.type === "thinking") {
+				finalContent.push(block);
+			}
+		}
+	} else {
+		if (params.lastThinkingContent) {
+			finalContent.push({ type: "thinking", thinking: params.lastThinkingContent });
+		}
+		if (params.lastTextContent) {
+			finalContent.push({ type: "text", text: params.lastTextContent });
+		}
+	}
+
+	if (finalContent.length === 0 && params.fallbackResultText) {
+		finalContent.push({ type: "text", text: params.fallbackResultText });
+	}
+
+	return finalContent;
+}
+
 /**
  * Merge tool-call blocks from the active partial-message builder into the
  * running list of intermediate tool calls, preserving order and de-duping
@@ -1025,8 +1083,9 @@ export function mergePendingToolCalls(
  * GSD streamSimple function that delegates to the Claude Agent SDK.
  *
  * Emits AssistantMessageEvent deltas for real-time TUI rendering
- * (thinking, text, tool calls). The final AssistantMessage has tool-call
- * blocks stripped so the agent loop ends the turn without local dispatch.
+ * (thinking, text, tool calls). The final AssistantMessage preserves
+ * SDK-executed tool-call blocks for Agent Core's `externalToolExecution`
+ * path, which renders the results without dispatching the tools locally.
  */
 export function streamViaClaudeCode(
 	model: Model<any>,
@@ -1227,46 +1286,15 @@ async function pumpSdkMessages(
 				// -- Result (terminal) --
 				case "result": {
 					const result = msg as SDKResultMessage;
-
-					// Build final message. Include intermediate tool calls so the
-					// agent loop's externalToolExecution path emits tool_execution
-					// events for proper TUI rendering, followed by the text response.
-					const finalContent: AssistantMessage["content"] = [];
-
-					// If the final turn ended without a synthetic user message
-					// (e.g. stop_reason: "tool_use" followed directly by result,
-					// or a turn with text but no tool execution), the `builder`
-					// still holds toolCall blocks that were never pushed into
-					// `intermediateToolBlocks`. Fold them in here so they aren't
-					// dropped from the final AssistantMessage.
-					if (builder) {
-						mergePendingToolCalls(intermediateToolBlocks, builder.message.content);
-					}
-
-					// Add tool calls from intermediate turns first (renders above text)
-					attachExternalResultsToToolBlocks(intermediateToolBlocks, toolResultsById);
-					finalContent.push(...intermediateToolBlocks);
-
-					// Add text/thinking from the last turn
-					if (builder && builder.message.content.length > 0) {
-						for (const block of builder.message.content) {
-							if (block.type === "text" || block.type === "thinking") {
-								finalContent.push(block);
-							}
-						}
-					} else {
-						if (lastThinkingContent) {
-							finalContent.push({ type: "thinking", thinking: lastThinkingContent });
-						}
-						if (lastTextContent) {
-							finalContent.push({ type: "text", text: lastTextContent });
-						}
-					}
-
-					// Fallback: use the SDK's result text if we have no content
-					if (finalContent.length === 0 && result.subtype === "success" && result.result) {
-						finalContent.push({ type: "text", text: result.result });
-					}
+					const finalContent = buildFinalAssistantContent({
+						intermediateToolBlocks,
+						pendingContent: builder?.message.content,
+						toolResultsById,
+						lastThinkingContent,
+						lastTextContent,
+						fallbackResultText:
+							result.subtype === "success" && result.result ? result.result : undefined,
+					});
 
 					const finalMessage: AssistantMessage = {
 						role: "assistant",

package/src/resources/extensions/claude-code-cli/tests/stream-adapter.test.ts

@@ -8,6 +8,7 @@ import {
 	getResultErrorMessage,
 	makeAbortedMessage,
 	mergePendingToolCalls,
+	buildFinalAssistantContent,
 	resolveClaudePermissionMode,
 	buildPromptFromContext,
 	buildSdkQueryPrompt,
@@ -539,6 +540,71 @@ describe("stream-adapter — Claude Code external tool results", () => {
 			},
 		]);
 	});
+
+	test("buildFinalAssistantContent preserves intermediate tool calls with attached external results", () => {
+		const finalContent = buildFinalAssistantContent({
+			intermediateToolBlocks: [
+				{
+					type: "toolCall",
+					id: "tool-bash-1",
+					name: "bash",
+					arguments: { command: "echo hi" },
+				} as any,
+			],
+			pendingContent: [{ type: "text", text: "All done." }],
+			toolResultsById: new Map([
+				[
+					"tool-bash-1",
+					{
+						content: [{ type: "text", text: "hi\n" }],
+						details: { source: "claude-code" },
+						isError: false,
+					},
+				],
+			]),
+		});
+
+		assert.equal(finalContent[0]?.type, "toolCall");
+		assert.deepEqual((finalContent[0] as any).externalResult, {
+			content: [{ type: "text", text: "hi\n" }],
+			details: { source: "claude-code" },
+			isError: false,
+		});
+		assert.deepEqual(finalContent[1], { type: "text", text: "All done." });
+	});
+
+	test("buildFinalAssistantContent keeps final-turn tool calls when result arrives without a synthetic user boundary", () => {
+		const finalContent = buildFinalAssistantContent({
+			intermediateToolBlocks: [],
+			pendingContent: [
+				{
+					type: "toolCall",
+					id: "tool-read-1",
+					name: "read",
+					arguments: { path: "README.md" },
+				} as any,
+				{ type: "text", text: "Read complete." },
+			],
+			toolResultsById: new Map([
+				[
+					"tool-read-1",
+					{
+						content: [{ type: "text", text: "file contents" }],
+						details: { path: "README.md" },
+						isError: false,
+					},
+				],
+			]),
+		});
+
+		assert.equal(finalContent[0]?.type, "toolCall");
+		assert.deepEqual((finalContent[0] as any).externalResult, {
+			content: [{ type: "text", text: "file contents" }],
+			details: { path: "README.md" },
+			isError: false,
+		});
+		assert.deepEqual(finalContent[1], { type: "text", text: "Read complete." });
+	});
 });
 
 describe("stream-adapter — session persistence (#2859)", () => {
@@ -695,15 +761,18 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			assert.equal(srv.env.GSD_CLI_PATH, "/tmp/gsd");
 			assert.equal(srv.env.GSD_PERSIST_WRITE_GATE_STATE, "1");
 			assert.equal(srv.env.GSD_WORKFLOW_PROJECT_ROOT, "/tmp/project");
-			assert.deepEqual(options.disallowedTools, ["AskUserQuestion"]);
+			assert.deepEqual(options.disallowedTools, []);
 			assert.deepEqual(options.allowedTools, [
 				"Read",
 				"Write",
 				"Edit",
 				"Glob",
 				"Grep",
-				"Bash(ls:*)",
-				"Bash(pwd)",
+				"Bash",
+				"Agent",
+				"WebFetch",
+				"WebSearch",
+				"AskUserQuestion",
 				"mcp__gsd-workflow__*",
 			]);
 		} finally {
@@ -715,7 +784,7 @@ describe("stream-adapter — session persistence (#2859)", () => {
 		}
 	});
 
-	test("buildSdkOptions disables AskUserQuestion for custom workflow MCP server names", () => {
+	test("buildSdkOptions auto-approves every tool for custom workflow MCP server names", () => {
 		const prev = {
 			GSD_WORKFLOW_MCP_COMMAND: process.env.GSD_WORKFLOW_MCP_COMMAND,
 			GSD_WORKFLOW_MCP_NAME: process.env.GSD_WORKFLOW_MCP_NAME,
@@ -733,15 +802,18 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			const options = buildSdkOptions("claude-sonnet-4-20250514", "test");
 			const mcpServers = options.mcpServers as Record<string, any>;
 			assert.ok(mcpServers?.["custom-workflow"], "expected custom workflow server config");
-			assert.deepEqual(options.disallowedTools, ["AskUserQuestion"]);
+			assert.deepEqual(options.disallowedTools, []);
 			assert.deepEqual(options.allowedTools, [
 				"Read",
 				"Write",
 				"Edit",
 				"Glob",
 				"Grep",
-				"Bash(ls:*)",
-				"Bash(pwd)",
+				"Bash",
+				"Agent",
+				"WebFetch",
+				"WebSearch",
+				"AskUserQuestion",
 				"mcp__custom-workflow__*",
 			]);
 		} finally {
@@ -779,9 +851,9 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			const mcpServers = (options as any).mcpServers;
 			if (mcpServers) {
 				assert.ok(mcpServers["gsd-workflow"], "if present, must be gsd-workflow");
-				assert.deepEqual((options as any).disallowedTools, ["AskUserQuestion"]);
+				assert.deepEqual((options as any).disallowedTools, []);
 			} else {
-				assert.deepEqual((options as any).disallowedTools, ["AskUserQuestion"]);
+				assert.deepEqual((options as any).disallowedTools, []);
 			}
 			rmSync(emptyDir, { recursive: true, force: true });
 		} finally {
@@ -828,7 +900,7 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			assert.equal(srv.env.GSD_CLI_PATH, "/tmp/gsd");
 			assert.equal(srv.env.GSD_PERSIST_WRITE_GATE_STATE, "1");
 			assert.equal(srv.env.GSD_WORKFLOW_PROJECT_ROOT, resolvedRepoDir);
-			assert.deepEqual(options.disallowedTools, ["AskUserQuestion"]);
+			assert.deepEqual(options.disallowedTools, []);
 		} finally {
 			process.chdir(originalCwd);
 			rmSync(repoDir, { recursive: true, force: true });
@@ -1216,11 +1288,15 @@ describe("stream-adapter — permission mode (F10)", () => {
 		}
 	}
 
-	test("buildSdkOptions defaults to bypassPermissions for backwards compatibility", () => {
+	test("buildSdkOptions defaults to bypassPermissions (globally unblocks all tools)", () => {
 		clearWorkflowMcpEnv();
 		const opts = buildSdkOptions("claude-sonnet-4-6", "test");
 		assert.equal(opts.permissionMode, "bypassPermissions");
-		assert.equal(opts.allowDangerouslySkipPermissions, true);
+		assert.equal(
+			opts.allowDangerouslySkipPermissions,
+			true,
+			"allowDangerouslySkipPermissions must be true when permissionMode is bypassPermissions",
+		);
 	});
 
 	test("buildSdkOptions respects explicit acceptEdits override", () => {
@@ -1234,6 +1310,11 @@ describe("stream-adapter — permission mode (F10)", () => {
 		);
 	});
 
+	test("resolveClaudePermissionMode defaults to bypassPermissions when no env var is set (globally unblocks all tools)", async () => {
+		const mode = await resolveClaudePermissionMode({});
+		assert.equal(mode, "bypassPermissions");
+	});
+
 	test("resolveClaudePermissionMode honours the GSD_CLAUDE_CODE_PERMISSION_MODE env override", async () => {
 		const env = { GSD_CLAUDE_CODE_PERMISSION_MODE: "acceptEdits" } as NodeJS.ProcessEnv;
 		const mode = await resolveClaudePermissionMode(env);
@@ -1249,6 +1330,27 @@ describe("stream-adapter — permission mode (F10)", () => {
 			`expected bypass or acceptEdits, got ${mode}`,
 		);
 	});
+
+	test("resolveClaudePermissionMode flips to bypassPermissions when GSD_HEADLESS=1 (#4657)", async () => {
+		const originalWarn = console.warn;
+		console.warn = () => {};
+		try {
+			const env = { GSD_HEADLESS: "1" } as NodeJS.ProcessEnv;
+			const mode = await resolveClaudePermissionMode(env);
+			assert.equal(mode, "bypassPermissions");
+		} finally {
+			console.warn = originalWarn;
+		}
+	});
+
+	test("resolveClaudePermissionMode: explicit override wins over GSD_HEADLESS=1", async () => {
+		const env = {
+			GSD_HEADLESS: "1",
+			GSD_CLAUDE_CODE_PERMISSION_MODE: "acceptEdits",
+		} as NodeJS.ProcessEnv;
+		const mode = await resolveClaudePermissionMode(env);
+		assert.equal(mode, "acceptEdits");
+	});
 });
 
 describe("stream-adapter — Windows Claude path lookup (#3770)", () => {