gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.538325aea

package/dist/resources/extensions/remote-questions/config.js

@@ -40,9 +40,20 @@ function hydrateRemoteTokensFromAuth() {
         return;
     try {
         const auth = AuthStorage.create();
+        const authData = auth.data ?? {};
         for (const [providerId, envVar] of needed) {
             try {
-                const creds = auth.getCredentialsForProvider(providerId);
+                const raw = authData[providerId];
+                const creds = Array.isArray(raw)
+                    ? raw
+                    : raw
+                        ? [raw]
+                        : [];
+                if (creds.length === 0) {
+                    const fallbackCred = auth.get(providerId);
+                    if (fallbackCred)
+                        creds.push(fallbackCred);
+                }
                 const apiKeyCred = creds.find((c) => c.type === "api_key" && !!c.key);
                 if (apiKeyCred?.key) {
                     process.env[envVar] = apiKeyCred.key;

package/dist/resources/extensions/universal-config/index.js

@@ -93,7 +93,7 @@ export default function universalConfig(pi) {
         },
     });
     // ── Invalidate cache on session switch ──────────────────────────────────
-    pi.on("session_switch", () => {
+    pi.on("session_before_switch", () => {
         cachedResult = null;
     });
 }

package/dist/resources/skills/verify-before-complete/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: verify-before-complete
-description: Block completion claims until verification evidence has been produced in the current message. Use before marking a task/slice/milestone complete, before creating a commit or PR, before saying "it works" or "tests pass", and any time you are about to claim work is done. The rule is: evidence before claims, always — running the verification must happen now, not "earlier in the session". Fresh output or no claim.
+description: >-
+  Block completion claims until verification evidence has been produced in the current message. Use before marking a task/slice/milestone complete, before creating a commit or PR, before saying "it works" or "tests pass", and any time you are about to claim work is done. The rule is: evidence before claims, always — running the verification must happen now, not "earlier in the session". Fresh output or no claim.
 ---
 
 <objective>

package/dist/resources/skills/write-docs/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: write-docs
-description: Collaborative document authoring workflow for proposals, technical specs, decision docs, README sections, ADRs, and long-form prose that must work for fresh readers. Use when asked to "write the docs", "draft a proposal", "write a spec", "write an RFC", "write the README", or when a document needs to be understandable by someone without this session's context. Three stages: gather context, iterate on structure, reader-test for a stranger.
+description: >-
+  Collaborative document authoring workflow for proposals, technical specs, decision docs, README sections, ADRs, and long-form prose that must work for fresh readers. Use when asked to "write the docs", "draft a proposal", "write a spec", "write an RFC", "write the README", or when a document needs to be understandable by someone without this session's context. Three stages: gather context, iterate on structure, reader-test for a stranger.
 ---
 
 <objective>

package/dist/security-overrides.d.ts

@@ -7,5 +7,8 @@
  *
  * Precedence: env var > settings.json > built-in defaults
  */
-import { type SettingsManager } from '@gsd/pi-coding-agent';
+import type { SettingsManager } from '@gsd/pi-coding-agent';
+export declare const SAFE_COMMAND_PREFIXES: readonly string[];
+export declare function setAllowedCommandPrefixes(prefixes: string[]): void;
+export declare function getAllowedCommandPrefixes(): readonly string[];
 export declare function applySecurityOverrides(settingsManager: SettingsManager): void;

package/dist/security-overrides.js

@@ -7,9 +7,22 @@
  *
  * Precedence: env var > settings.json > built-in defaults
  */
-import { setAllowedCommandPrefixes } from '@gsd/pi-coding-agent';
 import { setFetchAllowedUrls } from './resources/extensions/search-the-web/url-utils.js';
+// ---------------------------------------------------------------------------
+// GSD-owned command prefix allowlist state
+// (setAllowedCommandPrefixes / getAllowedCommandPrefixes were removed from
+//  pi-coding-agent's SettingsManager in 0.67.2 — GSD owns this state now)
+// ---------------------------------------------------------------------------
+export const SAFE_COMMAND_PREFIXES = ['npm', 'npx', 'yarn', 'pnpm', 'node'];
+let _allowedCommandPrefixes = [...SAFE_COMMAND_PREFIXES];
+export function setAllowedCommandPrefixes(prefixes) {
+    _allowedCommandPrefixes = prefixes;
+}
+export function getAllowedCommandPrefixes() {
+    return _allowedCommandPrefixes;
+}
 export function applySecurityOverrides(settingsManager) {
+    const sm = settingsManager;
     // --- Command prefix allowlist ---
     const envPrefixes = process.env.GSD_ALLOWED_COMMAND_PREFIXES;
     if (envPrefixes) {
@@ -19,7 +32,7 @@ export function applySecurityOverrides(settingsManager) {
         }
     }
     else {
-        const settingsPrefixes = settingsManager.getAllowedCommandPrefixes();
+        const settingsPrefixes = sm.getAllowedCommandPrefixes?.();
         if (settingsPrefixes && settingsPrefixes.length > 0) {
             setAllowedCommandPrefixes(settingsPrefixes);
         }
@@ -33,7 +46,7 @@ export function applySecurityOverrides(settingsManager) {
         }
     }
     else {
-        const settingsUrls = settingsManager.getFetchAllowedUrls();
+        const settingsUrls = sm.getFetchAllowedUrls?.();
         if (settingsUrls && settingsUrls.length > 0) {
             setFetchAllowedUrls(settingsUrls);
         }