gsd-pi 2.78.1 → 2.79.0

package/README.md

@@ -310,7 +310,9 @@ This is what makes GSD different. Run it, walk away, come back to built software
 /gsd auto
 ```
 
-Auto mode is a state machine driven by files on disk. It reads `.gsd/STATE.md`, determines the next unit of work, creates a fresh agent session, injects a focused prompt with all relevant context pre-inlined, and lets the LLM execute. When the LLM finishes, auto mode reads disk state again and dispatches the next unit.
+Auto mode is a state machine driven by the GSD database at the project root. It derives the next unit of work from authoritative SQLite state, creates a fresh agent session, injects a focused prompt with all relevant context pre-inlined, and lets the LLM execute. When the LLM finishes, auto mode persists the result to the database, refreshes markdown projections such as `STATE.md`, and dispatches the next unit.
+
+The database is authoritative for milestones, slices, tasks, requirements, decisions, summaries, and completion status. Markdown under `.gsd/` is a rendered projection for review, prompts, and git-friendly history; it is not a runtime fallback unless you explicitly run a recovery/import command. In worktree mode, project-root DB state remains authoritative and worktree markdown projections are not synced back as state.
 
 **What happens under the hood:**
 
@@ -318,9 +320,9 @@ Auto mode is a state machine driven by files on disk. It reads `.gsd/STATE.md`,
 
 2. **Context pre-loading** — The dispatch prompt includes inlined task plans, slice plans, prior task summaries, dependency summaries, roadmap excerpts, and decisions register. The LLM starts with everything it needs instead of spending tool calls reading files.
 
-3. **Git isolation** — When `git.isolation` is set to `worktree` or `branch`, each milestone runs on its own `milestone/<MID>` branch (in a worktree or in-place). All slice work commits sequentially — no branch switching, no merge conflicts. When the milestone completes, it's squash-merged to main as one clean commit. The default is `none` (work on the current branch), configurable via preferences.
+3. **Git isolation** — When `git.isolation` is set to `worktree` or `branch`, each milestone runs on its own `milestone/<MID>` branch (in a worktree or in-place). All slice work commits sequentially — no branch switching, no merge conflicts. When the milestone completes, it's squash-merged to main as one clean commit. The default is `none` (work on the current branch), configurable via preferences. If `worktree` is configured in a repo with no committed `HEAD`, GSD temporarily behaves as `none` until the first commit exists because git worktrees need a committed start point.
 
-4. **Crash recovery** — A lock file tracks the current unit. If the session dies, the next `/gsd auto` reads the surviving session file, synthesizes a recovery briefing from every tool call that made it to disk, and resumes with full context. Parallel orchestrator state is persisted to disk with PID liveness detection, so multi-worker sessions survive crashes too. In headless mode, crashes trigger automatic restart with exponential backoff (default 3 attempts).
+4. **Crash recovery** — Auto mode persists worker state, unit-dispatch state, and paused-session metadata in the project-root SQLite database. If the session dies, the next `/gsd auto` reconstructs the interrupted unit from DB-backed runtime state, reads the surviving session file, synthesizes a recovery briefing from every tool call that made it to disk, and resumes with full context. Parallel orchestrator IPC still lives under `.gsd/parallel/`, so multi-worker sessions survive crashes too. In headless mode, crashes trigger automatic restart with exponential backoff (default 3 attempts).
 
 5. **Provider error recovery** — Transient provider errors (rate limits, 500/503 server errors, overloaded) auto-resume after a delay. Permanent errors (auth, billing) pause for manual review. The model fallback chain retries transient network errors before switching models.
 
@@ -412,7 +414,7 @@ gsd
 /gsd queue      # queue the next milestone
 ```
 
-Both terminals read and write the same `.gsd/` files on disk. Your decisions in terminal 2 are picked up automatically at the next phase boundary — no need to stop auto mode.
+Both terminals coordinate through the same project-root GSD runtime on local disk. The SQLite database is authoritative, `.gsd/` markdown is refreshed from it, and your decisions in terminal 2 are picked up at the next phase boundary without stopping auto mode.
 
 ### Headless mode — CI and scripts
 
@@ -437,7 +439,7 @@ gsd headless dispatch plan
 
 Headless auto-responds to interactive prompts, detects completion, and exits with structured codes: `0` complete, `1` error/timeout, `2` blocked. Auto-restarts on crash with exponential backoff. Use `gsd headless query` for instant, machine-readable state inspection — returns phase, next dispatch preview, and parallel worker costs as a single JSON object without spawning an LLM session. Pair with [remote questions](./docs/user-docs/remote-questions.md) to route decisions to Slack or Discord when human input is needed.
 
-**Multi-session orchestration** — headless mode supports file-based IPC in `.gsd/parallel/` for coordinating multiple GSD workers across milestones. Build orchestrators that spawn, monitor, and budget-cap a fleet of GSD workers.
+**Multi-session orchestration** — headless mode supports DB-backed coordination across multiple GSD workers on the same machine. Worker registration, milestone leases, unit dispatch tracking, and command delivery live in `.gsd/gsd.db`, while `.gsd/parallel/` remains a local runtime area for per-milestone locks and isolation artifacts.
 
 ### First launch
 
@@ -450,6 +452,7 @@ On first run, GSD launches a branded setup wizard that walks you through LLM pro
 | `/gsd`                  | Step mode — executes one unit at a time, pauses between each                  |
 | `/gsd next`             | Explicit step mode (same as bare `/gsd`)                                      |
 | `/gsd auto`             | Autonomous mode — researches, plans, executes, commits, repeats               |
+| `/gsd new-project [--deep]` | Bootstrap a project with staged project-level discovery                  |
 | `/gsd quick`            | Execute a quick task with GSD guarantees, skip planning overhead              |
 | `/gsd stop`             | Stop auto mode gracefully                                                     |
 | `/gsd steer`            | Hard-steer plan documents during execution                                    |
@@ -471,6 +474,7 @@ On first run, GSD launches a branded setup wizard that walks you through LLM pro
 | `/gsd logs`             | Browse activity, debug, and metrics logs                                      |
 | `/gsd export --html`    | Generate HTML report for current or completed milestone                       |
 | `/worktree` (`/wt`)     | Git worktree lifecycle — create, switch, merge, remove                        |
+| `/gsd worktree` (`/gsd wt`) | TUI worktree management — list, merge, clean, remove with safety checks   |
 | `/voice`                | Toggle real-time speech-to-text (macOS, Linux)                                |
 | `/exit`                 | Graceful shutdown — saves session state before exiting                        |
 | `/kill`                 | Kill GSD process immediately                                                  |
@@ -497,11 +501,15 @@ Every dispatch is carefully constructed. The LLM never wastes tool calls on orie
 
 | Artifact           | Purpose                                                         |
 | ------------------ | --------------------------------------------------------------- |
+| `gsd.db`           | Authoritative runtime state for hierarchy and completion        |
 | `PROJECT.md`       | Living doc — what the project is right now                      |
+| `REQUIREMENTS.md`  | Project-level capability contract and out-of-scope list         |
 | `DECISIONS.md`     | Append-only register of architectural decisions                 |
 | `KNOWLEDGE.md`     | Cross-session rules, patterns, and lessons learned              |
 | `RUNTIME.md`       | Runtime context — API endpoints, env vars, services (v2.39)     |
-| `STATE.md`         | Quick-glance dashboard — always read first                      |
+| `runtime/research-decision.json` | Deep-mode marker for project research vs skip       |
+| `research/*.md`    | Optional deep-mode project research: stack, features, architecture, pitfalls |
+| `STATE.md`         | Quick-glance dashboard rendered from the database                |
 | `M001-ROADMAP.md`  | Milestone plan with slice checkboxes, risk levels, dependencies |
 | `M001-CONTEXT.md`  | User decisions from the discuss phase                           |
 | `M001-RESEARCH.md` | Codebase and ecosystem research                                 |
@@ -597,6 +605,7 @@ auto_report: true
 | Setting                           | What it controls                                                                                      |
 | --------------------------------- | ----------------------------------------------------------------------------------------------------- |
 | `models.*`                        | Per-phase model selection — string for a single model, or `{model, fallbacks}` for automatic failover |
+| `planning_depth`                  | `light` / `deep` — opt into staged project discovery before milestone planning                         |
 | `skill_discovery`                 | `auto` / `suggest` / `off` — how GSD finds and applies skills                                         |
 | `auto_supervisor.*`               | Timeout thresholds for auto mode supervision                                                          |
 | `budget_ceiling`                  | USD ceiling — auto mode pauses when reached                                                           |
@@ -605,7 +614,7 @@ auto_report: true
 | `skill_rules`                     | Situational rules for skill routing                                                                   |
 | `skill_staleness_days`            | Skills unused for N days get deprioritized (default: 60, 0 = disabled)                                |
 | `unique_milestone_ids`            | Uses unique milestone names to avoid clashes when working in teams of people                          |
-| `git.isolation`                   | `none` (default), `worktree`, or `branch` — enable worktree or branch isolation for milestone work    |
+| `git.isolation`                   | `none` (default), `worktree`, or `branch` — enable worktree or branch isolation for milestone work. `worktree` requires a committed `HEAD`; zero-commit repos temporarily run as `none`    |
 | `git.manage_gitignore`            | Set `false` to prevent GSD from modifying `.gitignore`                                                |
 | `verification_commands`           | Array of shell commands to run after task execution (e.g., `["npm run lint", "npm run test"]`)        |
 | `verification_auto_fix`           | Auto-retry on verification failures (default: true)                                                   |
@@ -625,19 +634,19 @@ Start GSD with `gsd --debug` to enable structured JSONL diagnostic logging. Debu
 
 ### Token Optimization
 
-GSD includes a coordinated token optimization system that reduces usage by 40-60% on cost-sensitive workloads. Set a single preference to coordinate model selection, phase skipping, and context compression:
+GSD includes a coordinated token optimization system that reduces usage by 40-60% on cost-sensitive workloads. Set a single preference to coordinate model tier selection, phase skipping, and context compression:
 
 ```yaml
 token_profile: budget # or balanced (default), quality
 ```
 
-| Profile    | Savings | What It Does                                                   |
-| ---------- | ------- | -------------------------------------------------------------- |
-| `budget`   | 40-60%  | Cheap models, skip research/reassess, minimal context inlining |
-| `balanced` | 10-20%  | Default models, skip slice research, standard context          |
-| `quality`  | 0%      | All phases, all context, full model power                      |
+| Profile    | Savings | What It Does                                                                     |
+| ---------- | ------- | -------------------------------------------------------------------------------- |
+| `budget`   | 40-60%  | Light/standard tier defaults, skip research/reassess, minimal context inlining   |
+| `balanced` | 10-20%  | Standard tier for core work, light tier for simple work, standard context        |
+| `quality`  | 0%      | Heavy tier for planning, standard tier for core work, full context               |
 
-**Complexity-based routing** automatically classifies tasks as simple/standard/complex and routes to appropriate models. Simple docs tasks get Haiku; complex architectural work gets Opus. The classification is heuristic (sub-millisecond, no LLM calls) and learns from outcomes via a persistent routing history.
+**Complexity-based routing** automatically classifies tasks as simple/standard/complex and routes to appropriate available models. Token profiles define provider-agnostic tier intentions, so simple docs tasks use a light-tier configured model and complex architectural work can use a heavy-tier configured model. The classification is heuristic (sub-millisecond, no LLM calls) and learns from outcomes via a persistent routing history.
 
 **Budget pressure** graduates model downgrading as you approach your budget ceiling — 50%, 75%, and 90% thresholds progressively shift work to cheaper tiers.
 
@@ -696,25 +705,23 @@ The best practice for working in teams is to ensure unique milestone names acros
 
 ```bash
 # ── GSD: Runtime / Ephemeral (per-developer, per-session) ──────────────────
-# Crash detection sentinel — PID lock, written per auto-mode session
-.gsd/auto.lock
 # Auto-mode dispatch tracker — prevents re-running completed units (includes archived per-milestone files)
 .gsd/completed-units*.json
 # State manifest — workflow state for recovery
 .gsd/state-manifest.json
-# Derived state cache — regenerated from plan/roadmap files on disk
+# Derived state projection — regenerated from the authoritative database
 .gsd/STATE.md
 # Per-developer token/cost accumulator
 .gsd/metrics.json
 # Raw JSONL session dumps — crash recovery forensics, auto-pruned
 .gsd/activity/
-# Unit execution records — dispatch phase, timeouts, recovery tracking
+# Unit execution records — dispatch phase, timeouts, and recovery tracking
 .gsd/runtime/
 # Git worktree working copies
 .gsd/worktrees/
-# Parallel orchestration IPC and worker status
+# Parallel runtime locks and per-milestone isolation artifacts
 .gsd/parallel/
-# SQLite database and WAL sidecars — checkpoint state, forensics data
+# SQLite database and WAL sidecars — authoritative runtime state, local only
 .gsd/gsd.db*
 # Daily-rotated event journal — structured event log for forensics
 .gsd/journal/
@@ -779,7 +786,7 @@ gsd (CLI binary)
 - **`pkg/` shim directory** — `PI_PACKAGE_DIR` points here (not project root) to avoid Pi's theme resolution collision with our `src/` directory. Contains only `piConfig` and theme assets.
 - **Two-file loader pattern** — `loader.ts` sets all env vars with zero SDK imports, then dynamic-imports `cli.ts` which does static SDK imports. This ensures `PI_PACKAGE_DIR` is set before any SDK code evaluates.
 - **Always-overwrite sync** — `npm update -g` takes effect immediately. Bundled extensions and agents are synced to `~/.gsd/agent/` on every launch, not just first run.
-- **State lives on disk** — `.gsd/` is the source of truth. Auto mode reads it, writes it, and advances based on what it finds. No in-memory state survives across sessions.
+- **DB-authoritative state** — the project-root GSD database is the runtime source of truth. `.gsd/` markdown files are rendered projections for review, prompt context, and git history. No in-memory state survives across sessions.
 
 ---
 

package/dist/bundled-resource-path.d.ts

@@ -1,3 +1,10 @@
+export type FileExists = (path: string) => boolean;
+export declare function resolvePackageRoot(importUrl: string): string;
+export declare function hasCompleteBundledResources(resourcesDir: string, fileExists?: FileExists): boolean;
+export declare function resolveBundledResourcesDirFromPackageRoot(packageRoot: string, fileExists?: FileExists): string;
+export declare function resolveBundledResourcesDir(importUrl: string, fileExists?: FileExists): string;
+export declare function resolveBundledResource(importUrl: string, ...segments: string[]): string;
+export declare function resolveBundledGsdExtensionModule(importUrl: string, moduleFile: string, fileExists?: FileExists): string;
 /**
  * Resolve bundled raw resource files from the package root.
  *

package/dist/bundled-resource-path.js

@@ -1,5 +1,38 @@
+import { existsSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+export function resolvePackageRoot(importUrl) {
+    const moduleDir = dirname(fileURLToPath(importUrl));
+    return resolve(moduleDir, "..");
+}
+export function hasCompleteBundledResources(resourcesDir, fileExists = existsSync) {
+    return fileExists(join(resourcesDir, "agents")) &&
+        fileExists(join(resourcesDir, "extensions"));
+}
+export function resolveBundledResourcesDirFromPackageRoot(packageRoot, fileExists = existsSync) {
+    const distResources = join(packageRoot, "dist", "resources");
+    const srcResources = join(packageRoot, "src", "resources");
+    return hasCompleteBundledResources(distResources, fileExists)
+        ? distResources
+        : srcResources;
+}
+export function resolveBundledResourcesDir(importUrl, fileExists = existsSync) {
+    return resolveBundledResourcesDirFromPackageRoot(resolvePackageRoot(importUrl), fileExists);
+}
+export function resolveBundledResource(importUrl, ...segments) {
+    return join(resolveBundledResourcesDir(importUrl), ...segments);
+}
+export function resolveBundledGsdExtensionModule(importUrl, moduleFile, fileExists = existsSync) {
+    const packageRoot = resolvePackageRoot(importUrl);
+    const distResources = join(packageRoot, "dist", "resources");
+    const jsFile = moduleFile.replace(/\.ts$/, ".js");
+    const distModule = join(distResources, "extensions", "gsd", jsFile);
+    if (hasCompleteBundledResources(distResources, fileExists) && fileExists(distModule)) {
+        return distModule;
+    }
+    const tsFile = moduleFile.replace(/\.js$/, ".ts");
+    return join(packageRoot, "src", "resources", "extensions", "gsd", tsFile);
+}
 /**
  * Resolve bundled raw resource files from the package root.
  *
@@ -8,7 +41,6 @@ import { fileURLToPath } from "node:url";
  * `src/resources/**`, not next to the compiled entry point.
  */
 export function resolveBundledSourceResource(importUrl, ...segments) {
-    const moduleDir = dirname(fileURLToPath(importUrl));
-    const packageRoot = resolve(moduleDir, "..");
+    const packageRoot = resolvePackageRoot(importUrl);
     return join(packageRoot, "src", "resources", ...segments);
 }

package/dist/claude-cli-check.js

@@ -5,6 +5,21 @@
 // Set GSD_CLAUDE_DEBUG=1 to log probe output to stderr. Useful when
 // diagnosing platform-specific detection failures (Issue #4997).
 import { execFileSync } from 'node:child_process';
+/**
+ * Spawn the Claude CLI without triggering Node's DEP0190.
+ *
+ * Passing `args` together with `shell: true` is deprecated in Node 22+
+ * because the args are concatenated into the command string without
+ * escaping. On Windows we still need a shell to resolve `.cmd` shims, so
+ * we invoke `cmd /c <command> <args...>` explicitly. On POSIX we don't
+ * need a shell at all.
+ */
+function spawnClaude(command, args, opts) {
+    if (process.platform === 'win32') {
+        return execFileSync('cmd', ['/c', command, ...args], opts);
+    }
+    return execFileSync(command, args, opts);
+}
 /**
  * Platform-correct binary name for the Claude Code CLI.
  *
@@ -44,10 +59,9 @@ function debugLog(...parts) {
 function findWorkingCommand() {
     for (const command of CLAUDE_COMMAND_CANDIDATES) {
         try {
-            execFileSync(command, ['--version'], {
+            spawnClaude(command, ['--version'], {
                 timeout: VERSION_TIMEOUT_MS,
                 stdio: 'pipe',
-                shell: process.platform === 'win32',
             });
             debugLog('version probe ok via', command);
             return command;
@@ -93,10 +107,9 @@ function parseAuthStatus(output) {
 function probeAuth(command) {
     // Try --json first (newer CLIs).
     try {
-        const out = execFileSync(command, ['auth', 'status', '--json'], {
+        const out = spawnClaude(command, ['auth', 'status', '--json'], {
             timeout: AUTH_TIMEOUT_MS,
             stdio: 'pipe',
-            shell: process.platform === 'win32',
         }).toString();
         debugLog('auth status --json output:', out.slice(0, 200));
         const parsed = parseAuthStatus(out);
@@ -108,10 +121,9 @@ function probeAuth(command) {
     }
     // Fallback: plain `auth status` (older CLIs that don't accept --json).
     try {
-        const out = execFileSync(command, ['auth', 'status'], {
+        const out = spawnClaude(command, ['auth', 'status'], {
             timeout: AUTH_TIMEOUT_MS,
             stdio: 'pipe',
-            shell: process.platform === 'win32',
         }).toString();
         debugLog('auth status output:', out.slice(0, 200));
         return parseAuthStatus(out);

package/dist/cli-auto-routing.d.ts

@@ -0,0 +1 @@
+export declare function shouldRedirectAutoToHeadless(subcommand: string | undefined, stdinIsTTY: boolean | undefined, stdoutIsTTY: boolean | undefined): boolean;

package/dist/cli-auto-routing.js

@@ -0,0 +1,5 @@
+export function shouldRedirectAutoToHeadless(subcommand, stdinIsTTY, stdoutIsTTY) {
+    if (subcommand !== 'auto')
+        return false;
+    return stdinIsTTY !== true || stdoutIsTTY !== true;
+}

package/dist/cli-policy.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Subcommands that must bypass the managed-resource-mismatch gate.
+ *
+ * When the synced resource manifest claims a newer gsd version than the
+ * running binary, exitIfManagedResourcesAreNewer() blocks every command
+ * with a "Version mismatch detected" diagnostic. The `update` subcommand
+ * MUST bypass that gate so the user can recover by upgrading the binary —
+ * otherwise they're stuck in a broken state with no escape hatch.
+ *
+ * Any new bypassed subcommand goes here. cli.ts dispatches on this
+ * predicate before calling exitIfManagedResourcesAreNewer().
+ */
+export declare function shouldBypassManagedResourceMismatchGate(firstMessage: string | undefined): boolean;

package/dist/cli-policy.js

@@ -0,0 +1,17 @@
+// Policy helpers for cli.ts — extracted as pure functions so they can be
+// unit-tested without executing cli.ts's top-level script body.
+/**
+ * Subcommands that must bypass the managed-resource-mismatch gate.
+ *
+ * When the synced resource manifest claims a newer gsd version than the
+ * running binary, exitIfManagedResourcesAreNewer() blocks every command
+ * with a "Version mismatch detected" diagnostic. The `update` subcommand
+ * MUST bypass that gate so the user can recover by upgrading the binary —
+ * otherwise they're stuck in a broken state with no escape hatch.
+ *
+ * Any new bypassed subcommand goes here. cli.ts dispatches on this
+ * predicate before calling exitIfManagedResourcesAreNewer().
+ */
+export function shouldBypassManagedResourceMismatchGate(firstMessage) {
+    return firstMessage === 'update';
+}

package/dist/cli.js

@@ -1,4 +1,3 @@
-import { AuthStorage, DefaultResourceLoader, ModelRegistry, runPackageCommand, SettingsManager, SessionManager, createAgentSession, InteractiveMode, runPrintMode, runRpcMode, } from '@gsd/pi-coding-agent';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { agentDir, sessionsDir, authFilePath } from './app-paths.js';
@@ -9,6 +8,8 @@ import { migratePiCredentials } from './pi-migration.js';
 import { shouldRunOnboarding, runOnboarding } from './onboarding.js';
 import chalk from 'chalk';
 import { checkForUpdates } from './update-check.js';
+import { shouldBypassManagedResourceMismatchGate } from './cli-policy.js';
+import { shouldRedirectAutoToHeadless } from './cli-auto-routing.js';
 import { printHelp, printSubcommandHelp } from './help-text.js';
 import { applySecurityOverrides } from './security-overrides.js';
 import { validateConfiguredModel } from './startup-model-validation.js';
@@ -17,8 +18,11 @@ import { buildHeadlessAutoArgs, parseCliArgs, runWebCliBranch, migrateLegacyFlat
 import { stopWebMode } from './web-mode.js';
 import { getProjectSessionsDir } from './project-sessions.js';
 import { markStartup, printStartupTimings } from './startup-timings.js';
-import { bootstrapRtk, GSD_RTK_DISABLED_ENV } from './rtk.js';
-import { loadEffectiveGSDPreferences } from './resources/extensions/gsd/preferences.js';
+import { applyRtkProcessEnv, GSD_RTK_DISABLED_ENV, isTruthy } from './rtk-shared.js';
+let piCodingAgentModulePromise;
+function loadPiCodingAgentModule() {
+    return (piCodingAgentModulePromise ??= import('@gsd/pi-coding-agent'));
+}
 // ---------------------------------------------------------------------------
 // V8 compile cache — Node 22+ can cache compiled bytecode across runs,
 // eliminating repeated parse/compile overhead for unchanged modules.
@@ -129,27 +133,53 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
 // so concurrent callers await the same initialization.
 let rtkBootstrapPromise;
 async function doRtkBootstrap() {
+    let rtkStatus;
+    let rtkDisabled = isTruthy(process.env[GSD_RTK_DISABLED_ENV]);
     // RTK is opt-in via experimental.rtk preference. Default: disabled.
     // Honor GSD_RTK_DISABLED if already explicitly set in the environment
     // (env var takes precedence over preferences for manual override).
-    if (!process.env[GSD_RTK_DISABLED_ENV]) {
+    if (!rtkDisabled) {
+        const { loadEffectiveGSDPreferences } = await import('./resources/extensions/gsd/preferences.js');
         const prefs = loadEffectiveGSDPreferences();
         const rtkEnabled = prefs?.preferences.experimental?.rtk === true;
         if (!rtkEnabled) {
             process.env[GSD_RTK_DISABLED_ENV] = '1';
+            rtkDisabled = true;
         }
     }
-    const rtkStatus = await bootstrapRtk();
+    markStartup('rtkPreferenceCheck');
+    if (rtkDisabled) {
+        applyRtkProcessEnv(process.env);
+        rtkStatus = {
+            enabled: false,
+            supported: true,
+            available: false,
+            source: 'disabled',
+            reason: `${GSD_RTK_DISABLED_ENV} is set`,
+        };
+    }
+    else {
+        const { bootstrapRtk } = await import('./rtk.js');
+        rtkStatus = await bootstrapRtk();
+    }
     markStartup('bootstrapRtk');
     if (!rtkStatus.available && rtkStatus.supported && rtkStatus.enabled && rtkStatus.reason) {
         process.stderr.write(`[gsd] Warning: RTK unavailable — continuing without shell-command compression (${rtkStatus.reason}).\n`);
     }
 }
 function ensureRtkBootstrap() {
-    return (rtkBootstrapPromise ??= doRtkBootstrap());
-}
-// `gsd update` — update to the latest version via npm
-if (cliFlags.messages[0] === 'update') {
+    if (!rtkBootstrapPromise) {
+        markStartup('preRtkBootstrap');
+        rtkBootstrapPromise = doRtkBootstrap();
+    }
+    return rtkBootstrapPromise;
+}
+// `gsd update` — update to the latest version via npm.
+// MUST run before exitIfManagedResourcesAreNewer(): when the bundled resource
+// manifest is from a newer version than the running binary, every other
+// command is blocked — only `update` should bypass the gate so the user can
+// actually upgrade out of the broken state. See shouldBypassManagedResourceMismatchGate.
+if (shouldBypassManagedResourceMismatchGate(cliFlags.messages[0])) {
     const { runUpdate } = await import('./update-cmd.js');
     await runUpdate();
     process.exit(0);
@@ -246,20 +276,25 @@ const hasSubcommand = cliFlags.messages.length > 0;
 if (!process.stdin.isTTY && !isPrintMode && !hasSubcommand && !cliFlags.listModels && !cliFlags.web) {
     printNonTtyErrorAndExit(undefined, false);
 }
-const packageCommand = await runPackageCommand({
-    appName: 'gsd',
-    args: process.argv.slice(2),
-    cwd: process.cwd(),
-    agentDir,
-    stdout: process.stdout,
-    stderr: process.stderr,
-    allowedCommands: new Set(['install', 'remove', 'list']),
-});
-if (packageCommand.handled) {
-    process.exit(packageCommand.exitCode);
+const packageCommandNames = new Set(['install', 'remove', 'list']);
+if (packageCommandNames.has(cliFlags.messages[0])) {
+    const { runPackageCommand } = await loadPiCodingAgentModule();
+    const packageCommand = await runPackageCommand({
+        appName: 'gsd',
+        args: process.argv.slice(2),
+        cwd: process.cwd(),
+        agentDir,
+        stdout: process.stdout,
+        stderr: process.stderr,
+        allowedCommands: packageCommandNames,
+    });
+    if (packageCommand.handled) {
+        process.exit(packageCommand.exitCode);
+    }
 }
 // `gsd config` — replay the setup wizard and exit
 if (cliFlags.messages[0] === 'config') {
+    const { AuthStorage } = await loadPiCodingAgentModule();
     const authStorage = AuthStorage.create(authFilePath);
     loadStoredEnvKeys(authStorage);
     await runOnboarding(authStorage);
@@ -291,6 +326,7 @@ if (cliFlags.web || (cliFlags.messages[0] === 'web' && cliFlags.messages[1] !==
 }
 // `gsd sessions` — list past sessions and pick one to resume
 if (cliFlags.messages[0] === 'sessions') {
+    const { SessionManager } = await loadPiCodingAgentModule();
     const cwd = process.cwd();
     const safePath = `--${cwd.replace(/^[/\\]/, '').replace(/[/\\:]/g, '-')}--`;
     const projectSessionsDir = join(sessionsDir, safePath);
@@ -374,12 +410,41 @@ function flushPendingProviderRegistrations(resourceLoader, modelRegistry) {
     }
     runtime.pendingProviderRegistrations = [];
 }
-// `gsd auto [args...]` — shorthand for `gsd headless auto [args...]` (#2732)
-// Without this, `gsd auto` falls through to the interactive TUI which hangs
-// when stdin/stdout are piped (non-TTY environments).
-if (cliFlags.messages[0] === 'auto') {
+// `gsd auto [args...]` with piped stdin/stdout — shorthand for
+// `gsd headless auto [args...]` (#2732). Keep terminal TTY launches in the
+// interactive path so Warp/iTerm/Terminal retain foreground ownership.
+if (shouldRedirectAutoToHeadless(cliFlags.messages[0], process.stdin.isTTY, process.stdout.isTTY)) {
     await runHeadlessFromAuto(buildHeadlessAutoArgs(cliFlags));
 }
+// ---------------------------------------------------------------------------
+// Worktree subcommand — `gsd worktree <list|merge|clean|remove>`
+// ---------------------------------------------------------------------------
+if (!isPrintMode &&
+    cliFlags.listModels === undefined &&
+    (cliFlags.messages[0] === 'worktree' || cliFlags.messages[0] === 'wt')) {
+    const { handleList, handleMerge, handleClean, handleRemove } = await import('./worktree-cli.js');
+    const sub = cliFlags.messages[1];
+    const subArgs = cliFlags.messages.slice(2);
+    if (!sub || sub === 'list') {
+        await handleList(process.cwd());
+    }
+    else if (sub === 'merge') {
+        await handleMerge(process.cwd(), subArgs);
+    }
+    else if (sub === 'clean') {
+        await handleClean(process.cwd());
+    }
+    else if (sub === 'remove' || sub === 'rm') {
+        await handleRemove(process.cwd(), subArgs);
+    }
+    else {
+        process.stderr.write(`Unknown worktree command: ${sub}\n`);
+        process.stderr.write('Commands: list, merge [name], clean, remove <name>\n');
+    }
+    process.exit(0);
+}
+const { AuthStorage, DefaultResourceLoader, ModelRegistry, SettingsManager, SessionManager, createAgentSession, InteractiveMode, runPrintMode, runRpcMode, } = await loadPiCodingAgentModule();
+markStartup('loadPiCodingAgent');
 // Pi's tool bootstrap can mis-detect already-installed fd/rg on some systems
 // because spawnSync(..., ["--version"]) returns EPERM despite a zero exit code.
 // Provision local managed binaries first so Pi sees them without probing PATH.
@@ -431,11 +496,7 @@ if (cliFlags.listModels !== undefined) {
         additionalExtensionPaths: cliFlags.extensions.length > 0 ? cliFlags.extensions : undefined,
     });
     await listModelsLoader.reload();
-    const listModelsExtensions = listModelsLoader.getExtensions();
-    for (const { name, config } of listModelsExtensions.runtime.pendingProviderRegistrations) {
-        modelRegistry.registerProvider(name, config);
-    }
-    listModelsExtensions.runtime.pendingProviderRegistrations = [];
+    flushPendingProviderRegistrations(listModelsLoader, modelRegistry);
     const models = modelRegistry.getAvailable();
     if (models.length === 0) {
         console.log('No models available. Set API keys in environment variables.');
@@ -483,6 +544,7 @@ if (!settingsManager.getQuietStartup()) {
 if (!settingsManager.getCollapseChangelog()) {
     settingsManager.setCollapseChangelog(true);
 }
+markStartup('startupSettings');
 // ---------------------------------------------------------------------------
 // Print / subagent mode — single-shot execution, no TTY required
 // ---------------------------------------------------------------------------
@@ -515,7 +577,7 @@ if (isPrintMode) {
     flushPendingProviderRegistrations(resourceLoader, modelRegistry);
     migrateAnthropicDefaultToClaudeCode({
         authStorage,
-        isClaudeCodeReady: modelRegistry.isProviderRequestReady('claude-code'),
+        isClaudeCodeReady: () => modelRegistry.isProviderRequestReady('claude-code'),
         settingsManager,
         modelRegistry,
     });
@@ -577,31 +639,6 @@ if (isPrintMode) {
     process.exit(0);
 }
 // ---------------------------------------------------------------------------
-// Worktree subcommand — `gsd worktree <list|merge|clean|remove>`
-// ---------------------------------------------------------------------------
-if (cliFlags.messages[0] === 'worktree' || cliFlags.messages[0] === 'wt') {
-    const { handleList, handleMerge, handleClean, handleRemove } = await import('./worktree-cli.js');
-    const sub = cliFlags.messages[1];
-    const subArgs = cliFlags.messages.slice(2);
-    if (!sub || sub === 'list') {
-        await handleList(process.cwd());
-    }
-    else if (sub === 'merge') {
-        await handleMerge(process.cwd(), subArgs);
-    }
-    else if (sub === 'clean') {
-        await handleClean(process.cwd());
-    }
-    else if (sub === 'remove' || sub === 'rm') {
-        await handleRemove(process.cwd(), subArgs);
-    }
-    else {
-        process.stderr.write(`Unknown worktree command: ${sub}\n`);
-        process.stderr.write('Commands: list, merge [name], clean, remove <name>\n');
-    }
-    process.exit(0);
-}
-// ---------------------------------------------------------------------------
 // Worktree flag (-w) — create/resume a worktree for the interactive session
 // ---------------------------------------------------------------------------
 if (cliFlags.worktree) {
@@ -613,21 +650,12 @@ if (cliFlags.worktree) {
 // ---------------------------------------------------------------------------
 if (!cliFlags.worktree && !isPrintMode) {
     try {
-        const { handleStatusBanner } = await import('./worktree-cli.js');
-        await handleStatusBanner(process.cwd());
+        const { showWorktreeStatusBanner } = await import('./worktree-status-banner.js');
+        showWorktreeStatusBanner(process.cwd());
     }
     catch { /* non-fatal */ }
 }
-// ---------------------------------------------------------------------------
-// Auto-redirect: `gsd auto` with piped stdout → headless mode (#2732)
-// When stdout is not a TTY (e.g. `gsd auto | cat`, `gsd auto > file`),
-// the TUI cannot render and the process hangs. Redirect to headless mode
-// which handles non-interactive output gracefully.
-// ---------------------------------------------------------------------------
-if (cliFlags.messages[0] === 'auto' && !process.stdout.isTTY) {
-    process.stderr.write('[gsd] stdout is not a terminal — running auto-mode in headless mode.\n');
-    await runHeadlessFromAuto(cliFlags.messages.slice(1));
-}
+markStartup('worktreeStatusBanner');
 // ---------------------------------------------------------------------------
 // Interactive mode — normal TTY session
 // ---------------------------------------------------------------------------
@@ -651,7 +679,9 @@ markStartup('initResources');
 // Overlap resource loading with session manager setup — both are independent.
 // resourceLoader.reload() is the most expensive step (jiti compilation), so
 // starting it early shaves ~50-200ms off interactive startup.
-const resourceLoader = buildResourceLoader(agentDir);
+const resourceLoader = await buildResourceLoader(agentDir, {
+    additionalExtensionPaths: cliFlags.extensions.length > 0 ? cliFlags.extensions : undefined,
+});
 const resourceLoadPromise = resourceLoader.reload();
 // While resources load, let session manager finish any async I/O it needs.
 // Then await the resource promise before creating the agent session.
@@ -660,10 +690,11 @@ markStartup('resourceLoader.reload');
 flushPendingProviderRegistrations(resourceLoader, modelRegistry);
 migrateAnthropicDefaultToClaudeCode({
     authStorage,
-    isClaudeCodeReady: modelRegistry.isProviderRequestReady('claude-code'),
+    isClaudeCodeReady: () => modelRegistry.isProviderRequestReady('claude-code'),
     settingsManager,
     modelRegistry,
 });
+markStartup('providerMigrations');
 const { session, extensionsResult, modelFallbackMessage: interactiveFallbackMsg } = await createAgentSession({
     authStorage,
     modelRegistry,

package/dist/headless-query.d.ts

@@ -14,6 +14,28 @@
  * bypassing the extension loader's jiti setup (#1137).
  */
 import type { GSDState } from './resources/extensions/gsd/types.js';
+/**
+ * Resolve the GSD extensions root for headless-query. Prefers the synced
+ * agent directory (so headless-query loads the same extension copy as
+ * interactive/auto modes — #3471) and falls back to the bundled source
+ * resource for source-tree dev workflows.
+ *
+ * Pure on the given inputs (env + fs probe + bundled resolver) so the
+ * #3471 contract can be exercised in tests without spawning a subprocess.
+ */
+export declare function resolveGsdAgentExtensionsDir(env?: NodeJS.ProcessEnv): string;
+/**
+ * Decide whether headless-query should load extensions from the agent
+ * sync directory (#3471) or fall back to bundled source. Returns the
+ * agent dir alongside the decision so a caller can use it directly.
+ */
+export declare function shouldUseAgentExtensionsDir(opts: {
+    env?: NodeJS.ProcessEnv;
+    fileExists?: (path: string) => boolean;
+}): {
+    agentDir: string;
+    useAgentDir: boolean;
+};
 export interface QuerySnapshot {
     state: GSDState;
     next: {