gsd-pi 2.78.1-dev.82bcf6b71 → 2.78.1-dev.84c045fd2

package/packages/mcp-server/dist/server.js

@@ -10,9 +10,10 @@
  * cannot resolve the SDK's subpath exports statically (same pattern as
  * src/mcp-server.ts in the main package).
  */
-import { readFile, readdir, stat } from 'node:fs/promises';
+import { readFile, readdir } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
 import { z } from 'zod';
 import { isRemoteConfigured, tryRemoteQuestions } from './remote-questions.js';
 import { readProgress } from './readers/state.js';
@@ -21,7 +22,7 @@ import { readHistory } from './readers/metrics.js';
 import { readCaptures } from './readers/captures.js';
 import { readKnowledge } from './readers/knowledge.js';
 import { buildGraph, writeGraph, writeSnapshot, graphStatus, graphQuery, graphDiff } from './readers/graph.js';
-import { resolveGsdRoot } from './readers/paths.js';
+import { resolveGsdRoot, resolveMilestoneFile } from './readers/paths.js';
 import { runDoctorLite } from './readers/doctor-lite.js';
 import { registerWorkflowTools, validateProjectDir } from './workflow-tools.js';
 import { applySecrets, checkExistingEnvKeys, detectDestination, resolveProjectEnvFilePath } from './env-writer.js';
@@ -30,7 +31,22 @@ import { applySecrets, checkExistingEnvKeys, detectDestination, resolveProjectEn
 // ---------------------------------------------------------------------------
 const MCP_PKG = '@modelcontextprotocol/sdk';
 const SERVER_NAME = 'gsd';
-const SERVER_VERSION = '2.53.0';
+/**
+ * Read the version from this package's package.json so the MCP handshake
+ * always advertises the deployed artifact's version. Falls back to '0.0.0'
+ * if package.json can't be located (e.g. unusual bundling); the fallback
+ * is loud-ish but won't crash the server.
+ */
+const SERVER_VERSION = (() => {
+    try {
+        const require = createRequire(import.meta.url);
+        const pkg = require('../package.json');
+        if (typeof pkg.version === 'string' && pkg.version.length > 0)
+            return pkg.version;
+    }
+    catch { /* fall through */ }
+    return '0.0.0';
+})();
 /** User-interaction timeout — generous but bounded so elicitation can't hang indefinitely (#4586). */
 const ELICIT_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
 /**
@@ -39,37 +55,75 @@ const ELICIT_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
  * was called without an `execFn`, so vercel/convex destinations silently
  * dropped every collected key. This restores the write path.
  */
-function defaultExecFn(cmd, args) {
+function defaultExecFn(cmd, args, opts) {
     return new Promise((res) => {
-        // stdin: ignore — avoids hanging if the child ever prompts interactively.
+        // stdin: pipe only when a caller explicitly supplies input; otherwise
+        // ignore it to avoid hanging if the child ever prompts interactively.
         // stdout: ignore — consumer only cares about stderr + exit code, and an
         //   un-drained pipe deadlocks once the kernel buffer (~64KB) fills.
         // stderr: pipe — captured below for error surfacing.
-        const child = spawn(cmd, args, { stdio: ['ignore', 'ignore', 'pipe'] });
+        const child = spawn(resolveShellCommand(cmd), args, {
+            shell: process.platform === 'win32',
+            stdio: [opts?.stdin === undefined ? 'ignore' : 'pipe', 'ignore', 'pipe'],
+            windowsHide: true,
+        });
         let stderr = '';
-        child.stderr.on('data', (chunk) => {
+        child.stdin?.on('error', () => {
+            // Child exited before consuming stdin; close/error handling below will
+            // surface the real process result.
+        });
+        if (opts?.stdin !== undefined) {
+            child.stdin?.end(opts.stdin, 'utf8');
+        }
+        child.stderr?.on('data', (chunk) => {
             stderr += chunk.toString('utf8');
         });
         child.on('error', (err) => res({ code: 1, stderr: err.message }));
         child.on('close', (code) => res({ code: code ?? 1, stderr }));
     });
 }
+function resolveShellCommand(cmd) {
+    if (process.platform !== 'win32')
+        return cmd;
+    if (cmd === 'vercel')
+        return 'vercel.cmd';
+    if (cmd === 'npx')
+        return 'npx.cmd';
+    return cmd;
+}
 /**
  * Race a promise against a timeout. Rejects with a typed error on timeout so
  * callers can return a specific MCP error response rather than hanging.
+ * If a parent AbortSignal is provided, an abort also rejects the race so
+ * client-side cancellation propagates instead of being absorbed by the
+ * 10-minute elicitation hold.
  *
  * @param timeoutMs - override for testing; defaults to ELICIT_TIMEOUT_MS
  */
-export async function withElicitTimeout(promise, label, timeoutMs = ELICIT_TIMEOUT_MS) {
+export async function withElicitTimeout(promise, label, timeoutMs = ELICIT_TIMEOUT_MS, signal) {
     let timer;
-    const timeout = new Promise((_, reject) => {
+    const racers = [promise];
+    racers.push(new Promise((_, reject) => {
         timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs / 60000} minutes — no user response received`)), timeoutMs);
-    });
+    }));
+    let abortListener;
+    if (signal) {
+        if (signal.aborted) {
+            clearTimeout(timer);
+            throw new Error(`${label} cancelled by client`);
+        }
+        racers.push(new Promise((_, reject) => {
+            abortListener = () => reject(new Error(`${label} cancelled by client`));
+            signal.addEventListener('abort', abortListener, { once: true });
+        }));
+    }
     try {
-        return await Promise.race([promise, timeout]);
+        return await Promise.race(racers);
     }
     finally {
         clearTimeout(timer);
+        if (signal && abortListener)
+            signal.removeEventListener('abort', abortListener);
     }
 }
 // ---------------------------------------------------------------------------
@@ -150,9 +204,8 @@ async function readProjectState(projectDir, query) {
             for (const entry of entries) {
                 if (!entry.isDirectory())
                     continue;
-                const mDir = join(milestonesDir, entry.name);
-                const hasRoadmap = await fileExists(join(mDir, `${entry.name}-ROADMAP.md`));
-                const hasSummary = await fileExists(join(mDir, `${entry.name}-SUMMARY.md`));
+                const hasRoadmap = !!resolveMilestoneFile(gsdDir, entry.name, 'ROADMAP');
+                const hasSummary = !!resolveMilestoneFile(gsdDir, entry.name, 'SUMMARY');
                 milestones.push({ id: entry.name, hasRoadmap, hasSummary });
             }
             result.milestones = milestones;
@@ -163,15 +216,6 @@ async function readProjectState(projectDir, query) {
     }
     return result;
 }
-async function fileExists(path) {
-    try {
-        await stat(path);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 const OTHER_OPTION_LABEL = 'None of the above';
 function normalizeAskUserQuestionsNote(value) {
     return typeof value === 'string' ? value.trim() : '';
@@ -254,6 +298,162 @@ export function formatAskUserQuestionsElicitResult(questions, result) {
     }
     return JSON.stringify({ answers });
 }
+/**
+ * Normalize an MCP elicitation form result into the `RoundResult` shape the
+ * GSD discussion-gate hook reads from `tool_result` `details.response`. The
+ * elicitation `content` map carries `{ [id]: label, [id]__note?: string }`;
+ * the hook expects `{ answers: { [id]: { selected, notes } } }`. Mirrored into
+ * `structuredContent` by `askUserQuestionsHandler`. See #5267.
+ */
+export function buildAskUserQuestionsRoundResult(questions, result) {
+    const answers = {};
+    const content = result.content ?? {};
+    for (const question of questions) {
+        if (question.allowMultiple) {
+            const list = normalizeAskUserQuestionsAnswers(content[question.id], true);
+            answers[question.id] = { selected: list, notes: '' };
+            continue;
+        }
+        const list = normalizeAskUserQuestionsAnswers(content[question.id], false);
+        const selected = list[0] ?? '';
+        const notes = selected === OTHER_OPTION_LABEL
+            ? normalizeAskUserQuestionsNote(content[`${question.id}__note`])
+            : '';
+        answers[question.id] = { selected, notes };
+    }
+    // `endInterview: false` mirrors the local extension's `RoundResult` shape and
+    // matches the remote path's `toRoundResultResponse` so register-hooks reads
+    // identical payloads regardless of channel. See peer review #5267-Q2.
+    return { endInterview: false, answers };
+}
+function isLocalElicitFallbackError(err) {
+    if (!(err instanceof Error))
+        return false;
+    const message = err.message.toLowerCase();
+    return (message.includes('timed out after') ||
+        message.includes('elicit') ||
+        message.includes('elicitation') ||
+        message.includes('host') ||
+        message.includes('not supported') ||
+        message.includes('method not found') ||
+        message.includes('-32601'));
+}
+function formatErrorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Defensive guard for the `details.response` payload from `tryRemoteQuestions`.
+ * Accepts only an object with a plain `answers` map; anything else (null,
+ * stringified JSON, missing) falls back to `null` so the gate hook routes
+ * the cancel branch instead of crashing on `details.response.answers[id]`.
+ */
+function isRoundResultLike(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const answers = value['answers'];
+    return !!answers && typeof answers === 'object' && !Array.isArray(answers);
+}
+export async function askUserQuestionsHandler(questions, extra, deps) {
+    try {
+        const validationError = validateAskUserQuestionsPayload(questions);
+        if (validationError)
+            return errorContent(validationError);
+        // Local-first: try the MCP host's elicitation channel (Claude Code,
+        // Cursor, etc.) before any configured remote channel. A misconfigured
+        // remote (e.g. expired Discord token returning 401) must not block the
+        // depth-verification gate when the user is sitting in front of the host.
+        let localElicitError;
+        try {
+            const elicitation = await withElicitTimeout(deps.elicitInput(buildAskUserQuestionsElicitRequest(questions)), 'ask_user_questions');
+            if (elicitation.action === 'accept' && elicitation.content) {
+                const structured = {
+                    questions,
+                    response: buildAskUserQuestionsRoundResult(questions, elicitation),
+                    cancelled: false,
+                };
+                return {
+                    content: [{ type: 'text', text: formatAskUserQuestionsElicitResult(questions, elicitation) }],
+                    structuredContent: structured,
+                };
+            }
+        }
+        catch (err) {
+            if (!isLocalElicitFallbackError(err))
+                throw err;
+            localElicitError = err;
+            console.warn(`[gsd:mcp] ask_user_questions local elicitation unavailable; trying remote fallback: ${formatErrorMessage(err)}`);
+        }
+        // Local cancelled / unavailable — fall back to the configured remote
+        // channel (Discord, Slack, Telegram) if one is set.
+        if (deps.isRemoteConfigured()) {
+            let remoteResult;
+            try {
+                remoteResult = await deps.tryRemoteQuestions(questions, extra?.signal);
+            }
+            catch (err) {
+                if (localElicitError) {
+                    throw new Error(`Local elicitation failed (${formatErrorMessage(localElicitError)}); remote fallback failed (${formatErrorMessage(err)})`);
+                }
+                throw err;
+            }
+            if (remoteResult) {
+                const details = remoteResult.details;
+                if (details?.['timed_out'] || details?.['error']) {
+                    // Mirror the timeout/error into structuredContent so the gate hook's
+                    // `details?.cancelled || !details?.response` branch fires correctly
+                    // (gate stays pending, model re-asks) instead of silently dropping
+                    // because no `details` made it across the MCP wire. See #5267.
+                    const failedStructured = {
+                        questions,
+                        response: null,
+                        cancelled: true,
+                    };
+                    return {
+                        content: [{ type: 'text', text: remoteResult.content[0]?.text ?? 'Remote questions timed out or failed' }],
+                        structuredContent: failedStructured,
+                    };
+                }
+                // Successful remote answer — surface the normalized RoundResult that
+                // remote-questions.ts attached to `details.response` so the gate hook
+                // sees `details.response.answers[id].selected` on this path too.
+                // A malformed `response` (failing isRoundResultLike) is reported as
+                // an explicit cancellation rather than a silent `cancelled: false`
+                // with `response: null` — the latter would lie to any consumer that
+                // reads `structuredContent.cancelled` independently of `.response`.
+                const hasValidResponse = isRoundResultLike(details?.['response']);
+                const acceptedStructured = hasValidResponse
+                    ? {
+                        questions,
+                        response: details['response'],
+                        cancelled: false,
+                    }
+                    : {
+                        questions,
+                        response: null,
+                        cancelled: true,
+                    };
+                return {
+                    content: [{ type: 'text', text: remoteResult.content[0]?.text ?? '' }],
+                    structuredContent: acceptedStructured,
+                };
+            }
+        }
+        if (localElicitError)
+            throw localElicitError;
+        const cancelledStructured = {
+            questions,
+            response: null,
+            cancelled: true,
+        };
+        return {
+            content: [{ type: 'text', text: 'ask_user_questions was cancelled before receiving a response' }],
+            structuredContent: cancelledStructured,
+        };
+    }
+    catch (err) {
+        return errorContent(err instanceof Error ? err.message : String(err));
+    }
+}
 export async function secureEnvCollectHandler(args, elicitInput) {
     const { projectDir, keys, destination, envFilePath, environment } = args;
     try {
@@ -532,35 +732,11 @@ export async function createMcpServer(sessionManager) {
         })).describe('Questions to show the user. Prefer 1 and do not exceed 3.'),
     }, async (args, extra) => {
         const { questions } = args;
-        try {
-            const validationError = validateAskUserQuestionsPayload(questions);
-            if (validationError)
-                return errorContent(validationError);
-            // Delegate to remote-questions manager when a remote channel is configured
-            // (Discord, Slack, Telegram). This path is the only one reachable for
-            // Claude Code-under-gsd sessions, which have no local TUI.
-            if (isRemoteConfigured()) {
-                const remoteResult = await tryRemoteQuestions(questions, extra?.signal);
-                if (remoteResult) {
-                    const details = remoteResult.details;
-                    if (details?.['timed_out'] || details?.['error']) {
-                        // Surface timeout/error as plain text so the LLM knows to retry
-                        return textContent(remoteResult.content[0]?.text ?? 'Remote questions timed out or failed');
-                    }
-                    return textContent(remoteResult.content[0]?.text ?? '');
-                }
-                // resolveRemoteConfig() returned null between isRemoteConfigured() and
-                // tryRemoteQuestions() (e.g. env var was cleared) — fall through to local.
-            }
-            const elicitation = await withElicitTimeout(server.server.elicitInput(buildAskUserQuestionsElicitRequest(questions)), 'ask_user_questions');
-            if (elicitation.action !== 'accept' || !elicitation.content) {
-                return textContent('ask_user_questions was cancelled before receiving a response');
-            }
-            return textContent(formatAskUserQuestionsElicitResult(questions, elicitation));
-        }
-        catch (err) {
-            return errorContent(err instanceof Error ? err.message : String(err));
-        }
+        return askUserQuestionsHandler(questions, extra, {
+            elicitInput: (params) => server.server.elicitInput(params),
+            isRemoteConfigured,
+            tryRemoteQuestions,
+        });
     });
     // -----------------------------------------------------------------------
     // secure_env_collect — collect secrets via MCP form elicitation