gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.538325aea

package/scripts/postinstall.js

@@ -1,180 +1,11 @@
 #!/usr/bin/env node
 
-import { exec as execCb, spawnSync } from 'child_process'
-import { createHash, randomUUID } from 'crypto'
-import { chmodSync, copyFileSync, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'fs'
-import { arch, homedir, platform } from 'os'
-import { dirname, resolve, join } from 'path'
-import { Readable } from 'stream'
-import { finished } from 'stream/promises'
-import extractZip from 'extract-zip'
-import { fileURLToPath } from 'url'
-
-const __dirname = dirname(fileURLToPath(import.meta.url))
-const cwd = resolve(__dirname, '..')
-const PLAYWRIGHT_SKIP =
-  process.env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD === '1' ||
-  process.env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD === 'true'
-const RTK_SKIP =
-  process.env.GSD_SKIP_RTK_INSTALL === '1' ||
-  process.env.GSD_SKIP_RTK_INSTALL === 'true' ||
-  process.env.GSD_RTK_DISABLED === '1' ||
-  process.env.GSD_RTK_DISABLED === 'true'
-
-const RTK_VERSION = '0.33.1'
-const RTK_REPO = 'rtk-ai/rtk'
-const RTK_ENV = { ...process.env, RTK_TELEMETRY_DISABLED: '1' }
-const managedBinDir = join(process.env.GSD_HOME || join(homedir(), '.gsd'), 'agent', 'bin')
-const managedBinaryPath = join(managedBinDir, platform() === 'win32' ? 'rtk.exe' : 'rtk')
-
-function run(cmd) {
-  return new Promise((resolvePromise) => {
-    execCb(cmd, { cwd }, (error, stdout, stderr) => {
-      resolvePromise({ ok: !error, stdout, stderr })
-    })
-  })
-}
-
-function logWarn(message) {
-  process.stderr.write(`[gsd] postinstall: ${message}\n`)
-}
-
-function resolveAssetName() {
-  const currentPlatform = platform()
-  const currentArch = arch()
-  if (currentPlatform === 'darwin' && currentArch === 'arm64') return 'rtk-aarch64-apple-darwin.tar.gz'
-  if (currentPlatform === 'darwin' && currentArch === 'x64') return 'rtk-x86_64-apple-darwin.tar.gz'
-  if (currentPlatform === 'linux' && currentArch === 'arm64') return 'rtk-aarch64-unknown-linux-gnu.tar.gz'
-  if (currentPlatform === 'linux' && currentArch === 'x64') return 'rtk-x86_64-unknown-linux-musl.tar.gz'
-  if (currentPlatform === 'win32' && currentArch === 'x64') return 'rtk-x86_64-pc-windows-msvc.zip'
-  return null
-}
-
-function parseChecksums(text) {
-  const checksums = new Map()
-  for (const rawLine of text.split(/\r?\n/)) {
-    const line = rawLine.trim()
-    if (!line) continue
-    const match = line.match(/^([a-f0-9]{64})\s+(.+)$/i)
-    if (!match) continue
-    checksums.set(match[2], match[1].toLowerCase())
-  }
-  return checksums
-}
-
-function sha256File(path) {
-  const hash = createHash('sha256')
-  hash.update(readFileSync(path))
-  return hash.digest('hex')
-}
-
-async function downloadToFile(url, destination) {
-  const response = await fetch(url, { headers: { 'User-Agent': 'gsd-pi-postinstall' } })
-  if (!response.ok) {
-    throw new Error(`download failed (${response.status}) for ${url}`)
-  }
-  if (!response.body) {
-    throw new Error(`download returned no body for ${url}`)
-  }
-  const output = createWriteStream(destination)
-  await finished(Readable.fromWeb(response.body).pipe(output))
-}
-
-function findBinaryRecursively(rootDir, binaryName) {
-  const stack = [rootDir]
-  while (stack.length > 0) {
-    const current = stack.pop()
-    if (!current) continue
-    const entries = readdirSync(current, { withFileTypes: true })
-    for (const entry of entries) {
-      const fullPath = join(current, entry.name)
-      if (entry.isFile() && entry.name === binaryName) return fullPath
-      if (entry.isDirectory()) stack.push(fullPath)
-    }
-  }
-  return null
-}
-
-function validateRtkBinary(binaryPath) {
-  const result = spawnSync(binaryPath, ['rewrite', 'git status'], {
-    encoding: 'utf-8',
-    env: RTK_ENV,
-    stdio: ['ignore', 'pipe', 'ignore'],
-    timeout: 5000,
-  })
-  return !result.error && result.status === 0 && (result.stdout || '').trim() === 'rtk git status'
-}
-
-async function ensureRtkInstalled() {
-  if (RTK_SKIP) return
-  const assetName = resolveAssetName()
-  if (!assetName) return
-  if (existsSync(managedBinaryPath) && validateRtkBinary(managedBinaryPath)) return
-
-  const tempRoot = join(managedBinDir, `.rtk-postinstall-${randomUUID().slice(0, 8)}`)
-  const archivePath = join(tempRoot, assetName)
-  const extractDir = join(tempRoot, 'extract')
-  const releaseBase = `https://github.com/${RTK_REPO}/releases/download/v${RTK_VERSION}`
-
-  mkdirSync(tempRoot, { recursive: true })
-  mkdirSync(managedBinDir, { recursive: true })
-
-  try {
-    const checksumsResponse = await fetch(`${releaseBase}/checksums.txt`, {
-      headers: { 'User-Agent': 'gsd-pi-postinstall' },
-    })
-    if (!checksumsResponse.ok) {
-      throw new Error(`failed to fetch RTK checksums (${checksumsResponse.status})`)
-    }
-
-    const checksums = parseChecksums(await checksumsResponse.text())
-    const expectedSha = checksums.get(assetName)
-    if (!expectedSha) {
-      throw new Error(`missing checksum for ${assetName}`)
-    }
-
-    await downloadToFile(`${releaseBase}/${assetName}`, archivePath)
-    const actualSha = sha256File(archivePath)
-    if (actualSha !== expectedSha) {
-      throw new Error(`checksum mismatch for ${assetName}`)
-    }
-
-    mkdirSync(extractDir, { recursive: true })
-    if (assetName.endsWith('.zip')) {
-      await extractZip(archivePath, { dir: extractDir })
-    } else {
-      const extractResult = spawnSync('tar', ['xzf', archivePath, '-C', extractDir], {
-        encoding: 'utf-8',
-        timeout: 30000,
-      })
-      if (extractResult.error || extractResult.status !== 0) {
-        throw new Error(extractResult.error?.message || extractResult.stderr?.trim() || `failed to extract ${assetName}`)
-      }
-    }
-
-    const extractedBinary = findBinaryRecursively(extractDir, platform() === 'win32' ? 'rtk.exe' : 'rtk')
-    if (!extractedBinary) {
-      throw new Error(`RTK binary not found in ${assetName}`)
-    }
-
-    copyFileSync(extractedBinary, managedBinaryPath)
-    if (platform() !== 'win32') {
-      chmodSync(managedBinaryPath, 0o755)
-    }
-
-    if (!validateRtkBinary(managedBinaryPath)) {
-      rmSync(managedBinaryPath, { force: true })
-      throw new Error('downloaded RTK binary failed validation')
-    }
-  } catch (error) {
-    logWarn(`RTK install skipped: ${error instanceof Error ? error.message : String(error)}`)
-  } finally {
-    rmSync(tempRoot, { recursive: true, force: true })
-  }
-}
-
-if (!PLAYWRIGHT_SKIP) {
-  await run('npx playwright install chromium')
-}
-
-await ensureRtkInstalled()
+/**
+ * GSD Postinstall
+ *
+ * Thin wrapper that delegates to install.js in postinstall mode
+ * (workspace linking + deps only, no global/local npm install).
+ */
+
+process.env.npm_lifecycle_event = process.env.npm_lifecycle_event || 'postinstall'
+import('./install.js')

package/src/resources/extensions/async-jobs/async-bash-tool.ts

@@ -9,9 +9,9 @@
 import type { ToolDefinition } from "@gsd/pi-coding-agent";
 import {
 	getShellConfig,
-	sanitizeCommand,
 	DEFAULT_MAX_BYTES,
 	DEFAULT_MAX_LINES,
+	sanitizeCommand,
 } from "@gsd/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
 import { spawn, spawnSync } from "node:child_process";

package/src/resources/extensions/aws-auth/index.ts

@@ -139,6 +139,7 @@ export default function (pi: ExtensionAPI) {
 		const refreshed = await runRefresh(refreshCommand, (m, level) => ctx.ui.notify(m, level));
 		if (!refreshed) return;
 
-		pi.retryLastTurn();
+		// retryLastTurn removed in pi 0.67.2 — notify user to retry manually
+		ctx.ui.notify("AWS credentials refreshed. Please resend your message to retry.", "info");
 	});
 }

package/src/resources/extensions/bg-shell/bg-shell-lifecycle.ts

@@ -94,13 +94,10 @@ export function registerBgShellLifecycle(pi: ExtensionAPI, state: BgShellSharedS
 	});
 
 	// Session switch resets the agent's context.
-	pi.on("session_switch", async (event, ctx) => {
+	pi.on("session_start", async (_event, ctx) => {
 		state.latestCtx = ctx;
-		if (event.reason === "new" && event.previousSessionFile) {
-			await cleanupSessionProcesses(event.previousSessionFile);
-			syncLatestCtxCwd();
-			if (state.latestCtx) persistManifest(state.latestCtx.cwd);
-		}
+		syncLatestCtxCwd();
+		if (state.latestCtx) persistManifest(state.latestCtx.cwd);
 		buildProcessStateAlert("Session was switched.");
 	});
 
@@ -393,7 +390,7 @@ export function registerBgShellLifecycle(pi: ExtensionAPI, state: BgShellSharedS
 	pi.on("turn_end", refreshHandler as any);
 	pi.on("agent_end", refreshHandler as any);
 	pi.on("session_start", refreshHandler as any);
-	pi.on("session_switch", refreshHandler as any);
+	pi.on("session_before_switch", refreshHandler as any);
 
 	pi.on("tool_execution_end", async (_event, ctx) => {
 		state.latestCtx = ctx;

package/src/resources/extensions/bg-shell/index.ts

@@ -5,7 +5,8 @@
  * block on the full background-process stack before the TUI paints.
  */
 
-import { importExtensionModule, type ExtensionAPI, type ExtensionContext } from "@gsd/pi-coding-agent";
+import { type ExtensionAPI, type ExtensionContext } from "@gsd/pi-coding-agent";
+import { importExtensionModule } from "@gsd/pi-coding-agent";
 import { registerBgShellLifecycle } from "./bg-shell-lifecycle.js";
 
 export interface BgShellSharedState {

package/src/resources/extensions/bg-shell/process-manager.ts

@@ -7,7 +7,8 @@ import { spawn, spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { writeFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
-import { getShellConfig, sanitizeCommand } from "@gsd/pi-coding-agent";
+import { getShellConfig } from "@gsd/pi-coding-agent";
+import { sanitizeCommand } from "@gsd/pi-coding-agent";
 import { rewriteCommandWithRtk } from "../shared/rtk.js";
 import type {
 	BgProcess,

package/src/resources/extensions/browser-tools/index.ts

@@ -1,5 +1,6 @@
 /** browser-tools — pi extension: full browser interaction via Playwright. */
-import { importExtensionModule, type ExtensionAPI } from "@gsd/pi-coding-agent";
+import { type ExtensionAPI } from "@gsd/pi-coding-agent";
+import { importExtensionModule } from "@gsd/pi-coding-agent";
 
 let registrationPromise: Promise<void> | null = null;
 

package/src/resources/extensions/claude-code-cli/index.ts

@@ -19,9 +19,9 @@ import { streamViaClaudeCode } from "./stream-adapter.js";
 export default function claudeCodeCli(pi: ExtensionAPI) {
 	pi.registerProvider("claude-code", {
 		authMode: "externalCli",
+		isReady: isClaudeCodeReady,
 		api: "anthropic-messages",
 		baseUrl: "local://claude-code",
-		isReady: isClaudeCodeReady,
 		streamSimple: streamViaClaudeCode,
 		models: CLAUDE_CODE_MODELS,
 	});

package/src/resources/extensions/claude-code-cli/partial-builder.ts

@@ -8,17 +8,116 @@
 import type {
 	AssistantMessage,
 	AssistantMessageEvent,
-	ServerToolUseContent,
 	StopReason,
 	TextContent,
 	ThinkingContent,
 	ToolCall,
 	Usage,
-	WebSearchResultContent,
 } from "@gsd/pi-ai";
-import { hasXmlParameterTags, repairToolJson } from "@gsd/pi-ai";
 import type { BetaContentBlock, BetaRawMessageStreamEvent, NonNullableUsage } from "./sdk-types.js";
 
+// ---------------------------------------------------------------------------
+// XML parameter tag utilities (inline replacements for removed pi-ai symbols)
+// ---------------------------------------------------------------------------
+
+/**
+ * Detects XML parameter tags (inline <parameter name="...">...</parameter> form)
+ * or XML wrapper (<parameters>...</parameters>) in streaming tool call JSON.
+ * Replaces removed pi-ai utility (removed in pi 0.67.2).
+ * T-10-05: regex only detects tag presence; does not evaluate content.
+ */
+function hasXmlParameterTags(s: string): boolean {
+	return /<parameter[s\s>]/i.test(s);
+}
+
+/**
+ * Repairs malformed LLM-generated tool JSON using three strategies:
+ *
+ * 1. XML parameter extraction: When inline <parameter name="key">value</parameter>
+ *    tags appear inside a JSON string value, extract each as a top-level key and
+ *    clean the containing string value by truncating at the closing tag boundary.
+ *
+ * 2. YAML bullet repair: When bare "- item" patterns appear as JSON values (not
+ *    quoted), convert each bullet sequence into a JSON array.
+ *
+ * 3. XML wrapper extraction: Extract content from <parameters>...</parameters> wrapper.
+ *
+ * Replaces removed pi-ai utility (removed in pi 0.67.2).
+ * T-10-05: extracts text content only, no evaluation.
+ */
+function repairToolJson(s: string): string {
+	// Strategy 1: XML parameter tags inside JSON string values (#3751)
+	// The raw JSON string may have escaped quotes: <parameter name=\"key\">val</parameter>
+	// or unescaped: <parameter name="key">val</parameter>
+	// We match both forms.
+	if (/<parameter\s+name=/i.test(s)) {
+		try {
+			// Match <parameter name="key"> or <parameter name=\"key\"> in raw JSON text
+			const paramPattern = /<parameter\s+name=(?:\\"|")([^"\\]+)(?:\\"|")>([\s\S]*?)<\/parameter>/gi;
+			const extracted: Record<string, unknown> = {};
+			let match: RegExpExecArray | null;
+			while ((match = paramPattern.exec(s)) !== null) {
+				const key = match[1];
+				// rawVal may contain JSON-escaped characters; unescape for parsing
+				const rawVal = match[2].trim().replace(/\\"/g, '"').replace(/\\n/g, "\n");
+				// Attempt to parse value as JSON; fall back to string
+				try {
+					extracted[key] = JSON.parse(rawVal);
+				} catch {
+					extracted[key] = rawVal;
+				}
+			}
+
+			if (Object.keys(extracted).length > 0) {
+				// Remove the XML parameter block and preceding closing tag from the raw string.
+				// The block looks like: </tagName>\n<parameter ...>...</parameter>...\n (with escaped chars)
+				// We remove from the first </...> closing tag through the last </parameter> tag.
+				const cleaned = s
+					.replace(/<\/[^>]+>(?:\\n|\n)*(?:<parameter[\s\S]*?<\/parameter>(?:\\n|\n)*)+/gi, "")
+					.trim();
+
+				// Parse cleaned base JSON and merge extracted params
+				const base = JSON.parse(cleaned) as Record<string, unknown>;
+				return JSON.stringify({ ...base, ...extracted });
+			}
+		} catch {
+			// Fall through to next strategy
+		}
+	}
+
+	// Strategy 2: YAML bullet lists as unquoted JSON values (#2660)
+	// Pattern: "key": - item1, "key2": - item2
+	if (/:\s*-\s+/.test(s)) {
+		try {
+			// Replace bare YAML bullet sequences with JSON arrays.
+			// Match: "key": - val1, - val2, "nextKey" or end
+			// We need to handle: "key": - item, "nextKey" where - item is the unquoted value
+			const repaired = s.replace(
+				// Match a quoted key followed by colon, then one or more "- item" bullets
+				// terminated by either a comma+quote (next key) or closing brace
+				/"([^"]+)":\s*((?:-\s+[^,\n\-"{}[\]]+(?:,\s*(?![-"\s*{]))?)+)/g,
+				(fullMatch: string, key: string, bulletBlock: string) => {
+					// Extract individual bullet items
+					const items = bulletBlock
+						.split(/,?\s*-\s+/)
+						.map((item: string) => item.trim().replace(/,\s*$/, "").trim())
+						.filter((item: string) => item.length > 0);
+					if (items.length === 0) return fullMatch;
+					return `"${key}": ${JSON.stringify(items)}`;
+				},
+			);
+			const parsed = JSON.parse(repaired);
+			return JSON.stringify(parsed);
+		} catch {
+			// Fall through to next strategy
+		}
+	}
+
+	// Strategy 3: XML wrapper extraction (<parameters>...</parameters>)
+	const m = /<parameters[^>]*>([\s\S]*?)<\/parameters>/i.exec(s);
+	return m ? m[1].trim() : s;
+}
+
 // ---------------------------------------------------------------------------
 // MCP tool name parsing
 // ---------------------------------------------------------------------------
@@ -71,7 +170,7 @@ function toolCallFromBlock(
  */
 export function mapContentBlock(
 	block: BetaContentBlock,
-): TextContent | ThinkingContent | ToolCall | ServerToolUseContent | WebSearchResultContent {
+): TextContent | ThinkingContent | ToolCall {
 	switch (block.type) {
 		case "text":
 			return { type: "text", text: block.text } satisfies TextContent;
@@ -87,19 +186,18 @@ export function mapContentBlock(
 			return toolCallFromBlock(block.id, block.name, block.input);
 
 		case "server_tool_use":
+			// ServerToolUseContent removed from pi-ai in pi 0.67.2 — represent as text
 			return {
-				type: "serverToolUse",
-				id: block.id,
-				name: block.name,
-				input: block.input,
-			} satisfies ServerToolUseContent;
+				type: "text",
+				text: `[server tool use: ${(block as Record<string, unknown>).name ?? "unknown"}]`,
+			} satisfies TextContent;
 
 		case "web_search_tool_result":
+			// WebSearchResultContent removed from pi-ai in pi 0.67.2 — represent as text
 			return {
-				type: "webSearchResult",
-				toolUseId: block.tool_use_id,
-				content: block.content,
-			} satisfies WebSearchResultContent;
+				type: "text",
+				text: `[web search result]`,
+			} satisfies TextContent;
 
 		default: {
 			const unknown = block as Record<string, unknown>;
@@ -224,15 +322,7 @@ export class PartialMessageBuilder {
 					this.partial.content.push(toolCallFromBlock(block.id, block.name, {}));
 					return { type: "toolcall_start", contentIndex, partial: this.partial };
 				}
-				if (block.type === "server_tool_use") {
-					this.partial.content.push({
-						type: "serverToolUse",
-						id: block.id,
-						name: block.name,
-						input: block.input,
-					});
-					return { type: "server_tool_use", contentIndex, partial: this.partial };
-				}
+				// server_tool_use removed from pi-ai content types in pi 0.67.2 — skip
 				return null;
 			}
 
@@ -289,7 +379,9 @@ export class PartialMessageBuilder {
 							// malformation explicitly so downstream consumers can
 							// distinguish this from a healthy tool completion (#2574).
 							block.arguments = { _raw: jsonStr };
-							return { type: "toolcall_end", contentIndex, toolCall: block, partial: this.partial, malformedArguments: true };
+							// malformedArguments removed from the toolcall_end type in pi 0.67.2;
+							// cast to any to preserve the runtime signal for downstream consumers (#2574)
+							return { type: "toolcall_end", contentIndex, toolCall: block, partial: this.partial, malformedArguments: true } as any;
 						}
 					}
 					return { type: "toolcall_end", contentIndex, toolCall: block, partial: this.partial };

package/src/resources/extensions/claude-code-cli/readiness.ts

@@ -21,10 +21,11 @@ const CLAUDE_COMMAND = process.platform === "win32" ? "claude.cmd" : "claude";
 
 /**
  * Windows installs vary: some environments expose `claude.cmd` (npm shim),
- * others expose a `claude` shim on PATH (for example Git Bash wrappers).
- * Try both to avoid false "not installed" results in readiness checks.
+ * `claude.exe` (direct binary install), or a bare `claude` shim on PATH
+ * (for example Git Bash wrappers). Try all three to avoid false "not
+ * installed" results in readiness checks.
  */
-const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude"] : [CLAUDE_COMMAND];
+const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude.exe", "claude"] : [CLAUDE_COMMAND];
 
 function execClaude(args: string[]): Buffer {
 	let lastError: unknown;

package/src/resources/extensions/claude-code-cli/stream-adapter.ts

@@ -548,8 +548,9 @@ async function promptElicitationWithDialogs(
 		const title = buildElicitationPromptTitle(request, question);
 
 		if (question.allowMultiple) {
+			// allowMultiple removed from ExtensionUIDialogOptions in pi 0.67.2;
+			// fall back to single-select (result is wrapped in array below)
 			const selected = await ui.select(title, question.options.map((option) => option.label), {
-				allowMultiple: true,
 				signal,
 			});
 			if (Array.isArray(selected)) {
@@ -692,18 +693,22 @@ export function makeAbortedMessage(model: string, lastTextContent: string): Assi
 /**
  * Resolve the Claude Code permission mode for the current run.
  *
- * GSD subagents run underneath a host Claude Code session the user has
- * already consented to, and their work (edits, shell inspection, MCP calls)
- * spans the full workflow toolset. Defaulting the inner SDK to
- * `bypassPermissions` avoids per-tool approval prompts that offer no
- * meaningful safety beyond what the host session and the subagent prompts
- * already enforce. `GSD_CLAUDE_CODE_PERMISSION_MODE` lets security-conscious
- * users opt into a stricter mode (`acceptEdits`, `default`, `plan`).
+ * Defaults to `acceptEdits`, which auto-approves file reads/edits but
+ * surfaces a permission dialog for dangerous operations (e.g. general Bash,
+ * Agent, WebFetch). This prevents tools outside the allowlist from being
+ * silently denied — the SDK emits an `extension_ui_request` event so the
+ * user sees a prompt instead of a silent refusal that Claude Code mistakes
+ * for user rejection (#4383).
+ *
+ * Set `GSD_CLAUDE_CODE_PERMISSION_MODE` to `bypassPermissions` to restore
+ * the old always-approve behaviour, or to `default` / `plan` for stricter
+ * modes.
  *
- * Tradeoff: bypass means a prompt-injection payload read from an untrusted
- * file could trigger tool calls without a second gate. Accepted for GSD
- * because the workflow is explicit user intent and the alternative
- * (#4099) is continuous approval fatigue that blocks real work.
+ * When `GSD_HEADLESS=1` is set (auto-mode / non-interactive runs), the
+ * default flips to `bypassPermissions` because there is no UI to approve
+ * permission dialogs — `acceptEdits` would hang verification commands like
+ * `npx tsc --noEmit` or `npx vitest run` indefinitely (#4657). Explicit
+ * overrides still win, so users can opt back into `acceptEdits` in headless.
  */
 export async function resolveClaudePermissionMode(
 	env: NodeJS.ProcessEnv = process.env,
@@ -712,7 +717,13 @@ export async function resolveClaudePermissionMode(
 	if (override === "bypassPermissions" || override === "acceptEdits" || override === "default" || override === "plan") {
 		return override;
 	}
-	return "bypassPermissions";
+	if (env.GSD_HEADLESS === "1") {
+		console.warn(
+			"[claude-code-cli] Headless mode detected (GSD_HEADLESS=1): defaulting permissionMode to 'bypassPermissions' so verification Bash commands can run. Set GSD_CLAUDE_CODE_PERMISSION_MODE=acceptEdits to opt out.",
+		);
+		return "bypassPermissions";
+	}
+	return "acceptEdits";
 }
 
 // NOTE: These helpers intentionally mirror @gsd/pi-ai anthropic-shared
@@ -772,7 +783,7 @@ export function buildSdkOptions(
 ): Record<string, unknown> {
 	const { reasoning, ...sdkExtraOptions } = extraOptions;
 	const mcpServers = buildWorkflowMcpServers();
-	const permissionMode = overrides?.permissionMode ?? "bypassPermissions";
+	const permissionMode = overrides?.permissionMode ?? "acceptEdits";
 	const disallowedTools = ["AskUserQuestion"];
 	// Pre-authorize the safe built-ins and every registered workflow MCP
 	// server's tools. `acceptEdits` mode (the interactive default) only
@@ -987,7 +998,8 @@ function attachExternalResultsToToolBlocks(
 	toolResultsById: ReadonlyMap<string, ExternalToolResultPayload>,
 ): void {
 	for (const block of toolBlocks) {
-		if (block.type !== "toolCall" && block.type !== "serverToolUse") continue;
+		// serverToolUse removed from AssistantMessage content in pi 0.67.2
+		if (block.type !== "toolCall") continue;
 		const externalResult = toolResultsById.get(block.id);
 		if (!externalResult) continue;
 		(block as ToolCallWithExternalResult & { id: string }).externalResult = externalResult;
@@ -1178,8 +1190,9 @@ async function pumpSdkMessages(
 								lastTextContent = block.text;
 							} else if (block.type === "thinking" && block.thinking) {
 								lastThinkingContent = block.thinking;
-							} else if (block.type === "toolCall" || block.type === "serverToolUse") {
+							} else if (block.type === "toolCall") {
 								// Collect tool blocks for externalToolExecution rendering
+								// (serverToolUse removed from pi-ai content types in pi 0.67.2)
 								intermediateToolBlocks.push(block);
 							}
 						}
@@ -1210,13 +1223,8 @@ async function pumpSdkMessages(
 									toolCall: block,
 									partial: builder.message,
 								});
-							} else if (block.type === "serverToolUse") {
-								stream.push({
-									type: "server_tool_use",
-									contentIndex,
-									partial: builder.message,
-								});
 							}
+							// serverToolUse/server_tool_use removed from pi-ai in pi 0.67.2
 						}
 					}
 

package/src/resources/extensions/claude-code-cli/tests/provider-registration.test.ts

@@ -0,0 +1,27 @@
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import type { ExtensionAPI } from "@gsd/pi-coding-agent";
+import claudeCodeCli from "../index.ts";
+
+describe("claude-code provider registration", () => {
+	test("registers as externalCli with readiness gate", () => {
+		const calls: Array<{ name: string; config: Record<string, unknown> }> = [];
+		const pi = {
+			registerProvider(name: string, config: Record<string, unknown>) {
+				calls.push({ name, config });
+			},
+		} as unknown as ExtensionAPI;
+
+		claudeCodeCli(pi);
+
+		assert.equal(calls.length, 1);
+		assert.equal(calls[0].name, "claude-code");
+		assert.equal(calls[0].config.authMode, "externalCli");
+		assert.equal(typeof calls[0].config.isReady, "function");
+		assert.equal(calls[0].config.baseUrl, "local://claude-code");
+		assert.equal(calls[0].config.api, "anthropic-messages");
+		assert.equal(typeof calls[0].config.streamSimple, "function");
+		assert.ok(Array.isArray(calls[0].config.models));
+		assert.ok((calls[0].config.models as unknown[]).length > 0);
+	});
+});