gsd-pi 2.78.1-dev.82bcf6b71 → 2.78.1-dev.84c045fd2

package/dist/web/standalone/node_modules/{next/node_modules/postcss → postcss}/package.json

@@ -1,14 +1,52 @@
 {
   "name": "postcss",
-  "version": "8.4.31",
+  "version": "8.5.12",
   "description": "Tool for transforming styles with JS plugins",
-  "engines": {
-    "node": "^10 || ^12 || >=14"
+  "keywords": [
+    "css",
+    "manipulation",
+    "parser",
+    "postcss",
+    "preprocessor",
+    "rework",
+    "source map",
+    "transform",
+    "transpiler"
+  ],
+  "homepage": "https://postcss.org/",
+  "bugs": {
+    "url": "https://github.com/postcss/postcss/issues"
   },
+  "license": "MIT",
+  "author": "Andrey Sitnik <andrey@sitnik.es>",
+  "repository": "postcss/postcss",
+  "funding": [
+    {
+      "type": "opencollective",
+      "url": "https://opencollective.com/postcss/"
+    },
+    {
+      "type": "tidelift",
+      "url": "https://tidelift.com/funding/github/npm/postcss"
+    },
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/ai"
+    }
+  ],
+  "main": "./lib/postcss.js",
+  "browser": {
+    "./lib/terminal-highlight": false,
+    "source-map-js": false,
+    "path": false,
+    "url": false,
+    "fs": false
+  },
+  "types": "./lib/postcss.d.ts",
   "exports": {
     ".": {
-      "require": "./lib/postcss.js",
-      "import": "./lib/postcss.mjs"
+      "import": "./lib/postcss.mjs",
+      "require": "./lib/postcss.js"
     },
     "./lib/at-rule": "./lib/at-rule.js",
     "./lib/comment": "./lib/comment.js",
@@ -39,50 +77,12 @@
     "./lib/warning": "./lib/warning.js",
     "./package.json": "./package.json"
   },
-  "main": "./lib/postcss.js",
-  "types": "./lib/postcss.d.ts",
-  "keywords": [
-    "css",
-    "postcss",
-    "rework",
-    "preprocessor",
-    "parser",
-    "source map",
-    "transform",
-    "manipulation",
-    "transpiler"
-  ],
-  "funding": [
-    {
-      "type": "opencollective",
-      "url": "https://opencollective.com/postcss/"
-    },
-    {
-      "type": "tidelift",
-      "url": "https://tidelift.com/funding/github/npm/postcss"
-    },
-    {
-      "type": "github",
-      "url": "https://github.com/sponsors/ai"
-    }
-  ],
-  "author": "Andrey Sitnik <andrey@sitnik.ru>",
-  "license": "MIT",
-  "homepage": "https://postcss.org/",
-  "repository": "postcss/postcss",
-  "bugs": {
-    "url": "https://github.com/postcss/postcss/issues"
-  },
   "dependencies": {
-    "nanoid": "^3.3.6",
-    "picocolors": "^1.0.0",
-    "source-map-js": "^1.0.2"
+    "nanoid": "^3.3.11",
+    "picocolors": "^1.1.1",
+    "source-map-js": "^1.2.1"
   },
-  "browser": {
-    "./lib/terminal-highlight": false,
-    "source-map-js": false,
-    "path": false,
-    "url": false,
-    "fs": false
+  "engines": {
+    "node": "^10 || ^12 || >=14"
   }
 }

package/dist/web/standalone/node_modules/react/cjs/react.development.js

@@ -1276,7 +1276,7 @@
     exports.useTransition = function () {
       return resolveDispatcher().useTransition();
     };
-    exports.version = "19.2.4";
+    exports.version = "19.2.5";
     "undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ &&
       "function" ===
         typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStop &&

package/dist/web/standalone/node_modules/react/cjs/react.production.js

@@ -539,4 +539,4 @@ exports.useSyncExternalStore = function (
 exports.useTransition = function () {
   return ReactSharedInternals.H.useTransition();
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react/package.json

@@ -4,7 +4,7 @@
   "keywords": [
     "react"
   ],
-  "version": "19.2.4",
+  "version": "19.2.5",
   "homepage": "https://react.dev/",
   "bugs": "https://github.com/facebook/react/issues",
   "license": "MIT",

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server-legacy.browser.production.js

@@ -6600,4 +6600,4 @@ exports.renderToString = function (children, options) {
     'The server used "renderToString" which does not support Suspense. If you intended for this Suspense boundary to render the fallback content on the server consider throwing an Error somewhere within the Suspense boundary. If you intended to have the server wait for the suspended component please switch to "renderToReadableStream" which supports Suspense on the server'
   );
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server-legacy.node.production.js

@@ -6689,4 +6689,4 @@ exports.renderToString = function (children, options) {
     'The server used "renderToString" which does not support Suspense. If you intended for this Suspense boundary to render the fallback content on the server consider throwing an Error somewhere within the Suspense boundary. If you intended to have the server wait for the suspended component please switch to "renderToPipeableStream" which supports Suspense on the server'
   );
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server.browser.production.js

@@ -7147,12 +7147,12 @@ function getPostponedState(request) {
 }
 function ensureCorrectIsomorphicReactVersion() {
   var isomorphicReactPackageVersion = React.version;
-  if ("19.2.4" !== isomorphicReactPackageVersion)
+  if ("19.2.5" !== isomorphicReactPackageVersion)
     throw Error(
       formatProdErrorMessage(
         527,
         isomorphicReactPackageVersion,
-        "19.2.4"
+        "19.2.5"
       )
     );
 }
@@ -7407,4 +7407,4 @@ exports.resumeAndPrerender = function (children, postponedState, options) {
     startWork(request);
   });
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server.edge.production.js

@@ -7251,11 +7251,11 @@ function getPostponedState(request) {
 }
 function ensureCorrectIsomorphicReactVersion() {
   var isomorphicReactPackageVersion = React.version;
-  if ("19.2.4" !== isomorphicReactPackageVersion)
+  if ("19.2.5" !== isomorphicReactPackageVersion)
     throw Error(
       'Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:\n  - react:      ' +
         (isomorphicReactPackageVersion +
-          "\n  - react-dom:  19.2.4\nLearn more: https://react.dev/warnings/version-mismatch")
+          "\n  - react-dom:  19.2.5\nLearn more: https://react.dev/warnings/version-mismatch")
     );
 }
 ensureCorrectIsomorphicReactVersion();
@@ -7509,4 +7509,4 @@ exports.resumeAndPrerender = function (children, postponedState, options) {
     startWork(request);
   });
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server.node.production.js

@@ -7142,11 +7142,11 @@ function getPostponedState(request) {
 }
 function ensureCorrectIsomorphicReactVersion() {
   var isomorphicReactPackageVersion = React.version;
-  if ("19.2.4" !== isomorphicReactPackageVersion)
+  if ("19.2.5" !== isomorphicReactPackageVersion)
     throw Error(
       'Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:\n  - react:      ' +
         (isomorphicReactPackageVersion +
-          "\n  - react-dom:  19.2.4\nLearn more: https://react.dev/warnings/version-mismatch")
+          "\n  - react-dom:  19.2.5\nLearn more: https://react.dev/warnings/version-mismatch")
     );
 }
 ensureCorrectIsomorphicReactVersion();
@@ -7704,4 +7704,4 @@ exports.resumeToPipeableStream = function (children, postponedState, options) {
     }
   };
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom.production.js

@@ -207,4 +207,4 @@ exports.useFormState = function (action, initialState, permalink) {
 exports.useFormStatus = function () {
   return ReactSharedInternals.H.useHostTransitionStatus();
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-dom",
-  "version": "19.2.4",
+  "version": "19.2.5",
   "description": "React package for working with the DOM.",
   "main": "index.js",
   "repository": {
@@ -20,7 +20,7 @@
     "scheduler": "^0.27.0"
   },
   "peerDependencies": {
-    "react": "^19.2.4"
+    "react": "^19.2.5"
   },
   "files": [
     "LICENSE",

package/dist/web/standalone/package.json

@@ -56,12 +56,12 @@
     "input-otp": "1.4.2",
     "lucide-react": "^0.564.0",
     "motion": "^12.36.0",
-    "next": "16.2.3",
+    "next": "16.2.4",
     "next-themes": "^0.4.6",
     "node-pty": "^1.1.0",
-    "react": "19.2.4",
+    "react": "19.2.5",
     "react-day-picker": "9.13.2",
-    "react-dom": "19.2.4",
+    "react-dom": "19.2.5",
     "react-hook-form": "^7.54.1",
     "react-markdown": "^10.1.0",
     "react-resizable-panels": "^2.1.7",
@@ -75,16 +75,21 @@
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.1",
-    "@tailwindcss/postcss": "^4.2.0",
+    "@tailwindcss/postcss": "^4.2.4",
     "@types/node": "^22",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "esbuild": "^0.27.4",
     "eslint": "^9.38.0",
-    "eslint-config-next": "16.2.3",
-    "postcss": "^8.5",
-    "tailwindcss": "^4.2.0",
+    "eslint-config-next": "16.2.4",
+    "postcss": "8.5.12",
+    "tailwindcss": "^4.2.4",
     "tw-animate-css": "1.3.3",
     "typescript": "5.7.3"
+  },
+  "overrides": {
+    "next": {
+      "postcss": "8.5.12"
+    }
   }
 }

package/dist/worktree-cli.d.ts

@@ -29,10 +29,11 @@ interface ExtensionModules {
     }>;
     removeWorktree: (basePath: string, name: string, opts?: {
         deleteBranch?: boolean;
+        branch?: string;
     }) => void;
-    mergeWorktreeToMain: (basePath: string, name: string, commitMessage: string) => void;
-    diffWorktreeAll: (basePath: string, name: string) => WorktreeDiff;
-    diffWorktreeNumstat: (basePath: string, name: string) => Array<{
+    mergeWorktreeToMain: (basePath: string, name: string, commitMessage: string, branch?: string) => void;
+    diffWorktreeAll: (basePath: string, name: string, branch?: string) => WorktreeDiff;
+    diffWorktreeNumstat: (basePath: string, name: string, branch?: string) => Array<{
         added: number;
         removed: number;
     }>;
@@ -62,7 +63,7 @@ interface WorktreeStatus {
     uncommitted: boolean;
     commits: number;
 }
-declare function getWorktreeStatus(ext: ExtensionModules, basePath: string, name: string, wtPath: string): WorktreeStatus;
+declare function getWorktreeStatus(ext: ExtensionModules, basePath: string, name: string, wtPath: string, branch: string): WorktreeStatus;
 declare function handleList(basePath: string): Promise<void>;
 declare function handleMerge(basePath: string, args: string[]): Promise<void>;
 declare function handleClean(basePath: string): Promise<void>;

package/dist/worktree-cli.js

@@ -65,9 +65,9 @@ async function loadExtensionModules() {
     return _ext;
 }
 // ─── Status Helpers ─────────────────────────────────────────────────────────
-function getWorktreeStatus(ext, basePath, name, wtPath) {
-    const diff = ext.diffWorktreeAll(basePath, name);
-    const numstat = ext.diffWorktreeNumstat(basePath, name);
+function getWorktreeStatus(ext, basePath, name, wtPath, branch) {
+    const diff = ext.diffWorktreeAll(basePath, name, branch);
+    const numstat = ext.diffWorktreeNumstat(basePath, name, branch);
     const filesChanged = diff.added.length + diff.modified.length + diff.removed.length;
     let linesAdded = 0;
     let linesRemoved = 0;
@@ -85,7 +85,7 @@ function getWorktreeStatus(ext, basePath, name, wtPath) {
     let commits = 0;
     try {
         const mainBranch = ext.nativeDetectMainBranch(basePath);
-        commits = ext.nativeCommitCountBetween(basePath, mainBranch, ext.worktreeBranchName(name));
+        commits = ext.nativeCommitCountBetween(basePath, mainBranch, branch);
     }
     catch (error) {
         logDebugFailure('native commit count', error);
@@ -93,7 +93,7 @@ function getWorktreeStatus(ext, basePath, name, wtPath) {
     return {
         name,
         path: wtPath,
-        branch: ext.worktreeBranchName(name),
+        branch,
         exists: existsSync(wtPath),
         filesChanged,
         linesAdded,
@@ -129,7 +129,7 @@ async function handleList(basePath) {
     }
     process.stderr.write(chalk.bold('\nWorktrees\n\n'));
     for (const wt of worktrees) {
-        const status = getWorktreeStatus(ext, basePath, wt.name, wt.path);
+        const status = getWorktreeStatus(ext, basePath, wt.name, wt.path, wt.branch);
         process.stderr.write(formatStatus(status) + '\n\n');
     }
 }
@@ -158,11 +158,11 @@ async function doMerge(ext, basePath, name) {
         process.stderr.write(chalk.red(`Worktree "${name}" not found.\n`));
         process.exit(1);
     }
-    const status = getWorktreeStatus(ext, basePath, name, wt.path);
+    const status = getWorktreeStatus(ext, basePath, name, wt.path, wt.branch);
     if (status.filesChanged === 0 && !status.uncommitted) {
         process.stderr.write(chalk.dim(`Worktree "${name}" has no changes to merge.\n`));
         // Clean up empty worktree
-        ext.removeWorktree(basePath, name, { deleteBranch: true });
+        ext.removeWorktree(basePath, name, { deleteBranch: true, branch: wt.branch });
         process.stderr.write(chalk.green(`Removed empty worktree ${chalk.bold(name)}.\n`));
         return;
     }
@@ -181,8 +181,8 @@ async function doMerge(ext, basePath, name) {
     process.stderr.write(`\nMerging ${chalk.bold.cyan(name)} → ${chalk.magenta(ext.nativeDetectMainBranch(basePath))}\n`);
     process.stderr.write(chalk.dim(`  ${status.filesChanged} files, ${chalk.green(`+${status.linesAdded}`)} ${chalk.red(`-${status.linesRemoved}`)}\n\n`));
     try {
-        ext.mergeWorktreeToMain(basePath, name, commitMessage);
-        ext.removeWorktree(basePath, name, { deleteBranch: true });
+        ext.mergeWorktreeToMain(basePath, name, commitMessage, wt.branch);
+        ext.removeWorktree(basePath, name, { deleteBranch: true, branch: wt.branch });
         process.stderr.write(chalk.green(`✓ Merged and cleaned up ${chalk.bold(name)}\n`));
         process.stderr.write(chalk.dim(`  commit: ${commitMessage}\n`));
     }
@@ -204,10 +204,10 @@ async function handleClean(basePath) {
     }
     let cleaned = 0;
     for (const wt of worktrees) {
-        const status = getWorktreeStatus(ext, basePath, wt.name, wt.path);
+        const status = getWorktreeStatus(ext, basePath, wt.name, wt.path, wt.branch);
         if (status.filesChanged === 0 && !status.uncommitted) {
             try {
-                ext.removeWorktree(basePath, wt.name, { deleteBranch: true });
+                ext.removeWorktree(basePath, wt.name, { deleteBranch: true, branch: wt.branch });
                 process.stderr.write(chalk.green(`  ✓ Removed ${chalk.bold(wt.name)} (clean)\n`));
                 cleaned++;
             }
@@ -236,7 +236,7 @@ async function handleRemove(basePath, args) {
         process.stderr.write(chalk.red(`Worktree "${name}" not found.\n`));
         process.exit(1);
     }
-    const status = getWorktreeStatus(ext, basePath, name, wt.path);
+    const status = getWorktreeStatus(ext, basePath, name, wt.path, wt.branch);
     if (status.filesChanged > 0 || status.uncommitted) {
         process.stderr.write(chalk.yellow(`⚠ Worktree "${name}" has unmerged changes (${status.filesChanged} files).\n`));
         process.stderr.write(chalk.yellow('  Use --force to remove anyway, or merge first: gsd worktree merge ' + name + '\n'));
@@ -244,7 +244,7 @@ async function handleRemove(basePath, args) {
             process.exit(1);
         }
     }
-    ext.removeWorktree(basePath, name, { deleteBranch: true });
+    ext.removeWorktree(basePath, name, { deleteBranch: true, branch: wt.branch });
     process.stderr.write(chalk.green(`✓ Removed worktree ${chalk.bold(name)}\n`));
 }
 // ─── Subcommand: status (default when no args) ─────────────────────────────
@@ -256,7 +256,7 @@ async function handleStatusBanner(basePath) {
         return;
     const withChanges = worktrees.filter(wt => {
         try {
-            const diff = ext.diffWorktreeAll(basePath, wt.name);
+            const diff = ext.diffWorktreeAll(basePath, wt.name, wt.branch);
             return diff.added.length + diff.modified.length + diff.removed.length > 0;
         }
         catch (error) {
@@ -282,7 +282,7 @@ async function handleWorktreeFlag(worktreeFlag) {
         const existing = ext.listWorktrees(basePath);
         const withChanges = existing.filter(wt => {
             try {
-                const diff = ext.diffWorktreeAll(basePath, wt.name);
+                const diff = ext.diffWorktreeAll(basePath, wt.name, wt.branch);
                 return diff.added.length + diff.modified.length + diff.removed.length > 0;
             }
             catch (error) {
@@ -305,7 +305,7 @@ async function handleWorktreeFlag(worktreeFlag) {
             // Multiple active worktrees — show them and ask user to pick
             process.stderr.write(chalk.yellow(`${withChanges.length} worktrees have unmerged changes:\n\n`));
             for (const wt of withChanges) {
-                const status = getWorktreeStatus(ext, basePath, wt.name, wt.path);
+                const status = getWorktreeStatus(ext, basePath, wt.name, wt.path, wt.branch);
                 process.stderr.write(formatStatus(status) + '\n\n');
             }
             process.stderr.write(chalk.dim('Specify which one: gsd -w <name>\n'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-pi",
-  "version": "2.78.1-dev.82bcf6b71",
+  "version": "2.78.1-dev.84c045fd2",
   "description": "GSD — Get Shit Done coding agent",
   "license": "MIT",
   "repository": {
@@ -143,7 +143,7 @@
     "typescript": "^5.4.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.2.83",
+    "@anthropic-ai/claude-agent-sdk": "0.2.83",
     "@gsd-build/engine-darwin-arm64": ">=2.10.2",
     "@gsd-build/engine-darwin-x64": ">=2.10.2",
     "@gsd-build/engine-linux-arm64-gnu": ">=2.10.2",

package/packages/mcp-server/README.md

@@ -80,43 +80,43 @@ Add to `.cursor/mcp.json`:
 The workflow MCP surface includes:
 
 - `gsd_decision_save`
-- `gsd_save_decision`
 - `gsd_requirement_update`
-- `gsd_update_requirement`
 - `gsd_requirement_save`
-- `gsd_save_requirement`
 - `gsd_milestone_generate_id`
-- `gsd_generate_milestone_id`
 - `gsd_plan_milestone`
 - `gsd_plan_slice`
 - `gsd_plan_task`
-- `gsd_task_plan`
 - `gsd_replan_slice`
-- `gsd_slice_replan`
 - `gsd_task_complete`
-- `gsd_complete_task`
 - `gsd_slice_complete`
-- `gsd_complete_slice`
 - `gsd_skip_slice`
 - `gsd_validate_milestone`
-- `gsd_milestone_validate`
 - `gsd_complete_milestone`
-- `gsd_milestone_complete`
 - `gsd_reassess_roadmap`
-- `gsd_roadmap_reassess`
 - `gsd_save_gate_result`
 - `gsd_summary_save`
 - `gsd_milestone_status`
 - `gsd_journal_query`
 
+**Aliases (kept for backwards compatibility — prefer the canonical name above):** `gsd_save_decision`, `gsd_update_requirement`, `gsd_save_requirement`, `gsd_generate_milestone_id`, `gsd_task_plan`, `gsd_slice_replan`, `gsd_complete_task`, `gsd_complete_slice`, `gsd_milestone_validate`, `gsd_milestone_complete`, `gsd_roadmap_reassess`.
+
 These tools use the same GSD workflow handlers as the native in-process tool path wherever a shared handler exists.
 
+`gsd_summary_save` computes artifact paths from the supplied IDs. `milestone_id` is required for milestone-, slice-, and task-scoped artifact types (`SUMMARY`, `RESEARCH`, `CONTEXT`, `ASSESSMENT`, `CONTEXT-DRAFT`) and should be omitted only for root-level `PROJECT`, `PROJECT-DRAFT`, `REQUIREMENTS`, and `REQUIREMENTS-DRAFT` artifacts. For final `REQUIREMENTS` saves, the tool renders content from active database requirement rows; callers must create those rows with `gsd_requirement_save` first.
+
 ### Interactive tools
 
 The packaged server exposes `ask_user_questions` through MCP form elicitation. This keeps the existing GSD answer payload shape while allowing Claude Code CLI and other elicitation-capable clients to surface structured user choices.
 
 The packaged server also exposes `secure_env_collect` through MCP form elicitation. Secret values are written directly to the selected destination and are not included in tool output. For dotenv writes, `envFilePath` must resolve inside the validated project directory; parent traversal and symlink escapes are rejected.
 
+`secure_env_collect` refuses to set variables that control the MCP server runtime itself, including `GSD_WORKFLOW_EXECUTORS_MODULE`, `GSD_WORKFLOW_WRITE_GATE_MODULE`, `GSD_WORKFLOW_PROJECT_ROOT`, `GSD_CLI_PATH`, `NODE_OPTIONS`, `NODE_PATH`, `PATH`, `LD_PRELOAD`, and `DYLD_INSERT_LIBRARIES`. These values must be configured by the operator in the MCP server environment, not collected from an MCP tool call.
+
+Secret handling differs by destination:
+
+- `dotenv`: accepted values are written to the project env file and hydrated into the current MCP server process so the active session can use them.
+- `vercel` and `convex`: accepted values are pushed to the remote destination but are not added to `process.env`; restart or configure the consuming runtime normally if the current process needs that value.
+
 Current support boundary:
 
 - when running inside the GSD monorepo checkout, the MCP server auto-discovers the shared workflow executor module
@@ -236,6 +236,8 @@ Resolve a pending blocker in a session by sending a response to the blocked UI r
 
 The server also hydrates supported model-provider and tool credentials from `~/.gsd/agent/auth.json` on startup. Keys saved through `/gsd config` or `/gsd keys` become available to the MCP server process automatically, and any explicitly-set environment variable still wins.
 
+Remote secrets pushed by `secure_env_collect` to Vercel or Convex are not hydrated into the MCP server process after the push. Use explicit MCP `env` configuration or a process restart when an operator-level value must be visible to the running server.
+
 ## Architecture
 
 ```

package/packages/mcp-server/dist/env-writer.d.ts

@@ -14,6 +14,7 @@ export declare function detectDestination(basePath: string): "dotenv" | "vercel"
  */
 export declare function writeEnvKey(filePath: string, key: string, value: string): Promise<void>;
 export declare function isSafeEnvVarKey(key: string): boolean;
+export declare function isSecuritySensitiveEnvKey(key: string): boolean;
 export declare function isSupportedDeploymentEnvironment(env: string): boolean;
 export declare function resolveProjectEnvFilePath(projectDir: string, envFilePath?: string): string;
 export declare function shellEscapeSingle(value: string): string;
@@ -21,6 +22,9 @@ interface ApplyResult {
     applied: string[];
     errors: string[];
 }
+interface ExecOptions {
+    stdin?: string;
+}
 /**
  * Apply collected secrets to the target destination.
  * Dotenv writes are handled directly; vercel/convex shell out via execFn.
@@ -31,7 +35,7 @@ export declare function applySecrets(provided: Array<{
 }>, destination: "dotenv" | "vercel" | "convex", opts: {
     envFilePath: string;
     environment?: string;
-    execFn?: (cmd: string, args: string[]) => Promise<{
+    execFn?: (cmd: string, args: string[], opts?: ExecOptions) => Promise<{
         code: number;
         stderr: string;
     }>;

package/packages/mcp-server/dist/env-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-writer.d.ts","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBjG;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAalF;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD7F;AAmBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErE;AAOD,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,SAAS,GAAG,MAAM,CAmB1F;AAMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAMD,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAC3C,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrF,GACA,OAAO,CAAC,WAAW,CAAC,CAkDtB"}
+{"version":3,"file":"env-writer.d.ts","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBjG;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAalF;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD7F;AAmBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAqBD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErE;AAOD,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,SAAS,GAAG,MAAM,CAmB1F;AAMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAMD,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAC3C,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG,GACA,OAAO,CAAC,WAAW,CAAC,CA+DtB"}

package/packages/mcp-server/dist/env-writer.js

@@ -1,5 +1,4 @@
 // @gsd-build/mcp-server — Environment variable write utilities
-// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
 //
 // Shared helpers for writing env vars to .env files, detecting project
 // destinations, and checking existing keys. Used by secure_env_collect
@@ -135,6 +134,27 @@ function assertWritableEnvFileTarget(filePath) {
 export function isSafeEnvVarKey(key) {
     return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
 }
+/**
+ * Keys that influence the MCP server's own runtime — module loading, project
+ * sandbox, CLI resolution. Allowing the LLM to set these via secure_env_collect
+ * would let a misbehaving caller swap the workflow executor module mid-session
+ * (RCE chain) or escape the project sandbox. We refuse to write or hydrate
+ * these keys even when isSafeEnvVarKey() would otherwise accept them.
+ */
+const SECURITY_SENSITIVE_KEYS = new Set([
+    "GSD_WORKFLOW_EXECUTORS_MODULE",
+    "GSD_WORKFLOW_WRITE_GATE_MODULE",
+    "GSD_WORKFLOW_PROJECT_ROOT",
+    "GSD_CLI_PATH",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PATH",
+    "LD_PRELOAD",
+    "DYLD_INSERT_LIBRARIES",
+]);
+export function isSecuritySensitiveEnvKey(key) {
+    return SECURITY_SENSITIVE_KEYS.has(key.toUpperCase());
+}
 export function isSupportedDeploymentEnvironment(env) {
     return env === "development" || env === "preview" || env === "production";
 }
@@ -177,10 +197,20 @@ export async function applySecrets(provided, destination, opts) {
     const errors = [];
     if (destination === "dotenv") {
         for (const { key, value } of provided) {
+            if (!isSafeEnvVarKey(key)) {
+                errors.push(`${key}: invalid environment variable name`);
+                continue;
+            }
+            if (isSecuritySensitiveEnvKey(key)) {
+                errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);
+                continue;
+            }
             try {
                 await writeEnvKey(opts.envFilePath, key, value);
                 applied.push(key);
-                // Hydrate process.env so the current session sees the new value
+                // Hydrate process.env so the current session sees the new value.
+                // Sensitive keys are excluded above so a malicious caller cannot
+                // swap our module-loading or sandbox configuration mid-session.
                 process.env[key] = value;
             }
             catch (err) {
@@ -200,19 +230,22 @@ export async function applySecrets(provided, destination, opts) {
                 errors.push(`${key}: invalid environment variable name`);
                 continue;
             }
-            const cmd = destination === "vercel"
-                ? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`
-                : "";
+            if (isSecuritySensitiveEnvKey(key)) {
+                errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);
+                continue;
+            }
             try {
                 const result = destination === "vercel"
-                    ? await opts.execFn("sh", ["-c", cmd])
-                    : await opts.execFn("npx", ["convex", "env", "set", key, value]);
+                    ? await opts.execFn("vercel", ["env", "add", key, env], { stdin: value })
+                    : await opts.execFn("npx", ["convex", "env", "set", key], { stdin: value });
                 if (result.code !== 0) {
                     errors.push(`${key}: ${result.stderr.slice(0, 200)}`);
                 }
                 else {
                     applied.push(key);
-                    process.env[key] = value;
+                    // Do NOT hydrate process.env after pushing to a remote destination:
+                    // no in-process reader needs a freshly-pushed remote secret, and
+                    // every spawned child would inherit the plaintext value.
                 }
             }
             catch (err) {