@opengsd/gsd-pi 1.2.0-dev.5457a158 → 1.2.0-dev.6ccd27b3

package/src/resources/extensions/gsd/tests/destructive-confirmation.test.ts

@@ -0,0 +1,303 @@
+/**
+ * Tests for the destructive-command confirmation escape hatch.
+ *
+ * Regression target: the destructive-guard hard block had no confirmation
+ * path. Re-issuing a force push after confirming via ask_user_questions hit
+ * the identical HARD BLOCK every time — an unwinnable loop. These tests pin
+ * the block → confirm → allow-once flow and its safety invariants.
+ *
+ * Two layers of coverage:
+ *  1. Unit — the confirmation-token module in isolation (block/confirm/consume
+ *     and every safety invariant).
+ *  2. Integration — the real registerHooks() bash tool_call guard +
+ *     ask_user_questions tool_result handler driven end-to-end, proving the
+ *     loop is escapable through the actual wiring, not just the helper module.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { registerHooks } from "../bootstrap/register-hooks.ts";
+import { classifyCommand } from "../safety/destructive-guard.ts";
+import {
+  DESTRUCTIVE_CONFIRM_GATE_MARKER,
+  confirmDestructiveCommand,
+  consumeDestructiveConfirmation,
+  isDestructiveConfirmGateId,
+  normalizeDestructiveCommand,
+  peekPendingDestructiveCommand,
+  requestDestructiveConfirmation,
+  resetDestructiveConfirmation,
+} from "../safety/destructive-confirmation.ts";
+
+const BASE = "/tmp/gsd-destructive-confirm-test";
+const FORCE_PUSH = "git push --force-with-lease origin feature/PO-566-chart-supply-chain";
+
+function blocked(command: string, basePath: string): boolean {
+  // Mirror the guard's decision: a classified-destructive command is blocked
+  // unless a matching confirmation token is consumed in this same check.
+  if (!classifyCommand(command).destructive) return false;
+  return !consumeDestructiveConfirmation(command, basePath);
+}
+
+test("repro: destructive command loops forever without confirmation", () => {
+  resetDestructiveConfirmation(BASE);
+  // Every attempt blocks — this is the bug the escape hatch fixes.
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "first attempt blocks");
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "retry still blocks");
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "and again — unwinnable loop");
+});
+
+test("block then confirm then retry allows the exact command once", () => {
+  resetDestructiveConfirmation(BASE);
+
+  // 1. Guard blocks and records the pending command.
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "initial attempt blocks");
+  requestDestructiveConfirmation(FORCE_PUSH, BASE);
+  assert.equal(peekPendingDestructiveCommand(BASE), normalizeDestructiveCommand(FORCE_PUSH));
+
+  // 2. User confirms via ask_user_questions affirmative answer.
+  const confirmed = confirmDestructiveCommand(BASE);
+  assert.equal(confirmed, normalizeDestructiveCommand(FORCE_PUSH));
+
+  // 3. Retry in the same turn now passes.
+  assert.equal(blocked(FORCE_PUSH, BASE), false, "confirmed command passes once");
+});
+
+test("confirmation is one-shot — a second destructive command re-blocks", () => {
+  resetDestructiveConfirmation(BASE);
+
+  requestDestructiveConfirmation(FORCE_PUSH, BASE);
+  confirmDestructiveCommand(BASE);
+  assert.equal(blocked(FORCE_PUSH, BASE), false, "first run consumes the token");
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "identical second run re-blocks");
+});
+
+test("confirmation is command-bound — a different command is not approved", () => {
+  resetDestructiveConfirmation(BASE);
+
+  requestDestructiveConfirmation(FORCE_PUSH, BASE);
+  confirmDestructiveCommand(BASE);
+
+  // A different destructive command must not ride the force-push confirmation.
+  assert.equal(blocked("rm -rf node_modules", BASE), true, "unrelated destructive cmd re-blocks");
+  // The original token is still intact for its exact command.
+  assert.equal(blocked(FORCE_PUSH, BASE), false, "original confirmed command still passes once");
+});
+
+test("cosmetic whitespace reformatting still matches the confirmed token", () => {
+  resetDestructiveConfirmation(BASE);
+
+  requestDestructiveConfirmation("git push   --force  origin   main", BASE);
+  confirmDestructiveCommand(BASE);
+  assert.equal(blocked("git push --force origin main", BASE), false, "whitespace-normalized match passes");
+});
+
+test("requesting a new confirmation invalidates a stale confirmed token", () => {
+  resetDestructiveConfirmation(BASE);
+
+  requestDestructiveConfirmation(FORCE_PUSH, BASE);
+  confirmDestructiveCommand(BASE);
+  // New block for a different command before the first was consumed.
+  requestDestructiveConfirmation("git reset --hard HEAD~3", BASE);
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "old confirmation no longer valid after new request");
+});
+
+test("confirm with nothing pending returns null and approves nothing", () => {
+  resetDestructiveConfirmation(BASE);
+  assert.equal(confirmDestructiveCommand(BASE), null, "no pending command -> null");
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "no spurious approval");
+});
+
+test("tokens are isolated per basePath", () => {
+  const a = "/tmp/gsd-confirm-ws-a";
+  const b = "/tmp/gsd-confirm-ws-b";
+  resetDestructiveConfirmation(a);
+  resetDestructiveConfirmation(b);
+
+  requestDestructiveConfirmation(FORCE_PUSH, a);
+  confirmDestructiveCommand(a);
+
+  assert.equal(blocked(FORCE_PUSH, b), true, "workspace B is unaffected by workspace A's confirmation");
+  assert.equal(blocked(FORCE_PUSH, a), false, "workspace A still passes once");
+});
+
+test("gate id marker detection", () => {
+  assert.equal(isDestructiveConfirmGateId(`${DESTRUCTIVE_CONFIRM_GATE_MARKER}_push`), true);
+  assert.equal(isDestructiveConfirmGateId("depth_verification_M001"), false);
+  assert.equal(isDestructiveConfirmGateId(undefined), false);
+  assert.equal(isDestructiveConfirmGateId(123), false);
+});
+
+test("non-destructive commands are never gated regardless of token state", () => {
+  resetDestructiveConfirmation(BASE);
+  assert.equal(blocked("git status", BASE), false);
+  assert.equal(blocked("ls -la", BASE), false);
+});
+
+// ─── Integration: real registerHooks() wiring, driven end-to-end ────────────
+// The unit tests above exercise the token module directly. These drive the
+// actual registered bash tool_call guard and ask_user_questions tool_result
+// handler, proving the loop the user hit is escapable through the real hooks —
+// not just the helper. Mirrors the harness in
+// register-hooks-depth-verification.test.ts.
+
+type Handler = (event: any, ctx?: any) => Promise<any> | any;
+
+function makeHookHarness(): {
+  handlers: Map<string, Handler[]>;
+  pi: any;
+} {
+  const handlers = new Map<string, Handler[]>();
+  const pi = {
+    on(event: string, handler: Handler) {
+      const existing = handlers.get(event) ?? [];
+      existing.push(handler);
+      handlers.set(event, existing);
+    },
+  } as any;
+  return { handlers, pi };
+}
+
+/** Run every bash tool_call guard and return the first block result, if any. */
+async function runBashGuard(
+  handlers: Map<string, Handler[]>,
+  command: string,
+  ctx: any,
+): Promise<{ block?: boolean; reason?: string } | undefined> {
+  let block: { block?: boolean; reason?: string } | undefined;
+  for (const handler of handlers.get("tool_call") ?? []) {
+    const result = await handler(
+      { toolCallId: "bash-1", toolName: "bash", input: { command } },
+      ctx,
+    );
+    if (result?.block) block = result;
+  }
+  return block;
+}
+
+/** Deliver an affirmative ask_user_questions answer for a destructive gate. */
+async function answerConfirmGate(
+  handlers: Map<string, Handler[]>,
+  questionId: string,
+  ctx: any,
+): Promise<void> {
+  const questions = [
+    {
+      id: questionId,
+      question: "Run this destructive command?",
+      options: [{ label: "Yes, run it (Recommended)" }, { label: "No, cancel" }],
+    },
+  ];
+  for (const handler of handlers.get("tool_result") ?? []) {
+    await handler(
+      {
+        toolName: "ask_user_questions",
+        input: { questions },
+        details: {
+          response: { answers: { [questionId]: { selected: "Yes, run it (Recommended)" } } },
+        },
+      },
+      ctx,
+    );
+  }
+}
+
+test("integration: real hooks block a force push, then allow it once after confirmation", async (t) => {
+  const dir = "/tmp/gsd-destructive-confirm-int-allow";
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+  resetDestructiveConfirmation(dir);
+  t.after(() => resetDestructiveConfirmation(dir));
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+
+  // 1. First attempt is hard-blocked by the real guard, with instructions that
+  //    name the destructive_confirm gate.
+  const firstBlock = await runBashGuard(handlers, FORCE_PUSH, ctx);
+  assert.equal(firstBlock?.block, true, "real guard blocks the first attempt");
+  assert.match(firstBlock?.reason ?? "", /HARD BLOCK: destructive Bash command/);
+  assert.match(firstBlock?.reason ?? "", /force push/);
+  assert.match(firstBlock?.reason ?? "", /destructive_confirm/);
+
+  // 2. User answers an affirmative destructive_confirm gate.
+  await answerConfirmGate(handlers, "destructive_confirm_force_push", ctx);
+
+  // 3. Re-issuing the exact command in the same turn now runs once (no block).
+  const secondAttempt = await runBashGuard(handlers, FORCE_PUSH, ctx);
+  assert.equal(secondAttempt, undefined, "confirmed command passes the real guard once");
+
+  // 4. One-shot: an immediate identical third attempt re-blocks.
+  const thirdAttempt = await runBashGuard(handlers, FORCE_PUSH, ctx);
+  assert.equal(thirdAttempt?.block, true, "second run of the same command re-blocks (one-shot)");
+});
+
+test("integration: declining the confirm gate leaves the command blocked", async (t) => {
+  const dir = "/tmp/gsd-destructive-confirm-int-decline";
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+  resetDestructiveConfirmation(dir);
+  t.after(() => resetDestructiveConfirmation(dir));
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+
+  assert.equal((await runBashGuard(handlers, FORCE_PUSH, ctx))?.block, true, "first attempt blocks");
+
+  // Decline: the non-affirmative (non-first) option must NOT promote a token.
+  const questions = [
+    {
+      id: "destructive_confirm_force_push",
+      question: "Run this destructive command?",
+      options: [{ label: "Yes, run it (Recommended)" }, { label: "No, cancel" }],
+    },
+  ];
+  for (const handler of handlers.get("tool_result") ?? []) {
+    await handler(
+      {
+        toolName: "ask_user_questions",
+        input: { questions },
+        details: {
+          response: { answers: { "destructive_confirm_force_push": { selected: "No, cancel" } } },
+        },
+      },
+      ctx,
+    );
+  }
+
+  assert.equal(
+    (await runBashGuard(handlers, FORCE_PUSH, ctx))?.block,
+    true,
+    "declined command stays blocked",
+  );
+});
+
+test("integration: a confirm token does not leak to a different destructive command", async (t) => {
+  const dir = "/tmp/gsd-destructive-confirm-int-bound";
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+  resetDestructiveConfirmation(dir);
+  t.after(() => resetDestructiveConfirmation(dir));
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+
+  await runBashGuard(handlers, FORCE_PUSH, ctx);
+  await answerConfirmGate(handlers, "destructive_confirm_force_push", ctx);
+
+  // A different destructive command must not ride the force-push confirmation.
+  // In the real guard, blocking this command also records it as pending, which
+  // invalidates the stale force-push token (stale-token safety invariant) — so
+  // the original confirmation is consumed/cleared, not left dangling.
+  assert.equal(
+    (await runBashGuard(handlers, "rm -rf build", ctx))?.block,
+    true,
+    "unrelated destructive command is still blocked",
+  );
+  // Because the unrelated block invalidated the stale token, the original
+  // force-push now re-blocks too: a confirmation never survives an intervening
+  // destructive command. This is stricter (safer) than per-command isolation.
+  assert.equal(
+    (await runBashGuard(handlers, FORCE_PUSH, ctx))?.block,
+    true,
+    "force-push token was invalidated by the intervening destructive block",
+  );
+});

package/src/resources/extensions/gsd/tests/discuss-routing-fixes.test.ts

@@ -39,7 +39,11 @@ function makeDiscussPi() {
     tmp,
     pi: {
       getActiveTools: () => ["gsd_summary_save", "bash"],
+      emitAdjustToolSet: async () => undefined,
+      emitBeforeModelSelect: async () => undefined,
+      setModel: async () => true,
       setActiveTools: () => {},
+      setThinkingLevel: () => {},
       sendMessage: (message: { content?: unknown }) => {
         sent.push(message);
       },
@@ -53,6 +57,7 @@ function makeDiscussPi() {
 }
 
 function makeDiscussCtx(notifications: Array<{ message: string; level?: string }> = []) {
+  const model = { provider: "anthropic", id: "claude-sonnet-4-6", api: "anthropic-messages" };
   return {
     hasUI: true,
     sessionManager: {
@@ -65,8 +70,13 @@ function makeDiscussCtx(notifications: Array<{ message: string; level?: string }
       setStatus: () => {},
     },
     waitForIdle: async () => {},
-    model: undefined,
-    modelRegistry: { getProviderAuthMode: () => undefined },
+    model,
+    modelRegistry: {
+      getAvailable: () => [model],
+      getAll: () => [model],
+      getProviderAuthMode: () => "apiKey",
+      isProviderRequestReady: () => true,
+    },
   };
 }
 

package/src/resources/extensions/gsd/tests/dispatch-history.test.ts

@@ -0,0 +1,328 @@
+// gsd-pi — Dispatch History module tests (#482 / #442 deepening)
+//
+// Covers: canonical key building and legacy-key normalization, window
+// record/evict semantics, ledger error attachment, cross-session rehydration
+// from unit_dispatches (the #482 regression: a fresh history rehydrated from
+// the DB must detect a re-dispatch loop that spans session restarts),
+// retry-budget suppression, and clearOnRecovery.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  openDatabase,
+  closeDatabase,
+  insertMilestone,
+} from "../gsd-db.ts";
+import { registerAutoWorker } from "../db/auto-workers.ts";
+import { claimMilestoneLease } from "../db/milestone-leases.ts";
+import { recordDispatchClaim, markFailed, markCanceled } from "../db/unit-dispatches.ts";
+import {
+  buildDispatchKey,
+  createDispatchHistory,
+  lookupLatestLedgerError,
+  normalizeDispatchKey,
+  parseDispatchKey,
+  STUCK_WINDOW_SIZE,
+} from "../auto/dispatch-history.ts";
+
+function makeBase(): string {
+  const base = mkdtempSync(join(tmpdir(), "gsd-dispatch-history-"));
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  return base;
+}
+
+function cleanup(base: string): void {
+  try { closeDatabase(); } catch { /* noop */ }
+  try { rmSync(base, { recursive: true, force: true }); } catch { /* noop */ }
+}
+
+interface LedgerFixture {
+  base: string;
+  worker: string;
+  token: number;
+  claim(unitType: string, unitId: string): number;
+}
+
+function makeLedgerFixture(t: { after(fn: () => void): void }): LedgerFixture {
+  const base = makeBase();
+  t.after(() => cleanup(base));
+  openDatabase(join(base, ".gsd", "gsd.db"));
+  insertMilestone({ id: "M001", title: "T", status: "active" });
+  const worker = registerAutoWorker({ projectRootRealpath: base });
+  const lease = claimMilestoneLease(worker, "M001");
+  assert.equal(lease.ok, true);
+  if (!lease.ok) throw new Error("lease claim failed");
+  return {
+    base,
+    worker,
+    token: lease.token,
+    claim(unitType: string, unitId: string): number {
+      const claim = recordDispatchClaim({
+        traceId: `${unitType}-${unitId}-${Math.random()}`,
+        workerId: worker,
+        milestoneLeaseToken: lease.token,
+        milestoneId: "M001",
+        unitType,
+        unitId,
+      });
+      assert.equal(claim.ok, true);
+      if (!claim.ok) throw new Error("claim failed");
+      return claim.dispatchId;
+    },
+  };
+}
+
+function historyFor(scopeId: string | null) {
+  return createDispatchHistory({ resolveScopeId: () => scopeId });
+}
+
+// ─── Key format ──────────────────────────────────────────────────────────────
+
+test("buildDispatchKey produces the canonical unitType:unitId format", () => {
+  assert.equal(buildDispatchKey("execute-task", "M001/S01/T01"), "execute-task:M001/S01/T01");
+});
+
+test("normalizeDispatchKey converts legacy slash keys and keeps canonical keys", () => {
+  assert.equal(normalizeDispatchKey("execute-task/M001/S01/T01"), "execute-task:M001/S01/T01");
+  assert.equal(normalizeDispatchKey("execute-task:M001/S01/T01"), "execute-task:M001/S01/T01");
+  assert.equal(normalizeDispatchKey("opaque"), "opaque");
+});
+
+test("parseDispatchKey splits canonical and legacy keys at the unit type", () => {
+  assert.deepEqual(parseDispatchKey("complete-slice:M001/S01"), {
+    unitType: "complete-slice",
+    unitId: "M001/S01",
+  });
+  assert.deepEqual(parseDispatchKey("complete-slice/M001/S01"), {
+    unitType: "complete-slice",
+    unitId: "M001/S01",
+  });
+  assert.equal(parseDispatchKey("opaque"), null);
+});
+
+// ─── Window record/evict ─────────────────────────────────────────────────────
+
+test("recordDispatch caps the window at the window size, evicting oldest-first", () => {
+  const history = historyFor(null);
+  for (let i = 0; i < STUCK_WINDOW_SIZE + 2; i++) {
+    history.recordDispatch("execute-task", `M001/S01/T${i}`);
+  }
+  const window = history.getRecentWindow();
+  assert.equal(window.length, STUCK_WINDOW_SIZE);
+  assert.equal(window[0].key, "execute-task:M001/S01/T2");
+  assert.equal(window[window.length - 1].key, `execute-task:M001/S01/T${STUCK_WINDOW_SIZE + 1}`);
+});
+
+test("countMatching counts entries for the canonical key", () => {
+  const history = historyFor(null);
+  history.recordDispatch("execute-task", "M001/S01/T01");
+  history.recordDispatch("complete-slice", "M001/S01");
+  history.recordDispatch("execute-task", "M001/S01/T01");
+  assert.equal(history.countMatching("execute-task:M001/S01/T01"), 2);
+  assert.equal(history.countMatching("complete-slice:M001/S01"), 1);
+});
+
+test("clearOnRecovery empties the window", () => {
+  const history = historyFor(null);
+  history.recordDispatch("execute-task", "M001/S01/T01");
+  history.recordDispatch("execute-task", "M001/S01/T01");
+  history.clearOnRecovery();
+  assert.equal(history.getRecentWindow().length, 0);
+  assert.equal(history.detectStuck(), null);
+});
+
+// ─── Ledger error attachment + detect-stuck delegation ──────────────────────
+
+test("recordDispatch attaches the latest ledger error on repeats so repeat-error detection fires", (t) => {
+  const f = makeLedgerFixture(t);
+  const dispatchId = f.claim("execute-task", "M001/S01/T01");
+  markFailed(dispatchId, { errorSummary: "boom: deterministic failure" });
+
+  const history = historyFor(f.base);
+  history.recordDispatch("execute-task", "M001/S01/T01");
+  history.recordDispatch("execute-task", "M001/S01/T01");
+  history.recordDispatch("execute-task", "M001/S01/T01");
+
+  const window = history.getRecentWindow();
+  // First dispatch of a unit skips the ledger lookup (zero DB cost on the
+  // common path); repeats attach the latest error.
+  assert.equal(window[0].error, undefined);
+  assert.equal(window[1].error, "boom: deterministic failure");
+  assert.equal(window[2].error, "boom: deterministic failure");
+  const verdict = history.detectStuck();
+  assert.equal(verdict?.stuck, true);
+  assert.match(verdict?.reason ?? "", /Same error repeated/);
+});
+
+test("lookupLatestLedgerError matches the bare unit id, not the compound key", (t) => {
+  const f = makeLedgerFixture(t);
+  const dispatchId = f.claim("execute-task", "M001/S01/T01");
+  markFailed(dispatchId, { errorSummary: "boom: deterministic failure" });
+
+  // The ledger keys rows by the bare unit id with the unit type in its own
+  // column. The shared lookup (also used by dispatch.ts's runDispatch path)
+  // must use the bare id; a compound `unitType/unitId` value misses entirely,
+  // which previously silently dropped repeat-error detection on that path.
+  assert.equal(
+    lookupLatestLedgerError("execute-task", "M001/S01/T01"),
+    "boom: deterministic failure",
+  );
+  assert.equal(
+    lookupLatestLedgerError("execute-task", "execute-task/M001/S01/T01"),
+    undefined,
+    "a compound key must not match the bare-id ledger row",
+  );
+  assert.equal(
+    lookupLatestLedgerError("plan-slice", "M001/S01/T01"),
+    undefined,
+    "a different unit type on the same id must not be attached",
+  );
+});
+
+test("recordDispatch never attaches another unit type's ledger error for the same unit id", (t) => {
+  const f = makeLedgerFixture(t);
+  const dispatchId = f.claim("plan-slice", "M001/S01");
+  markFailed(dispatchId, { errorSummary: "boom: plan failure" });
+
+  const history = historyFor(f.base);
+  history.recordDispatch("execute-task", "M001/S01");
+  history.recordDispatch("execute-task", "M001/S01");
+
+  assert.ok(history.getRecentWindow().every((entry) => entry.error === undefined));
+  assert.equal(history.detectStuck(), null);
+});
+
+test("detectStuck fires on three consecutive same-key dispatches without errors", () => {
+  const history = historyFor(null);
+  for (let i = 0; i < 3; i++) history.recordDispatch("plan-slice", "M001/S01");
+  const verdict = history.detectStuck();
+  assert.equal(verdict?.stuck, true);
+  assert.match(verdict?.reason ?? "", /plan-slice:M001\/S01 derived 3 consecutive times/);
+});
+
+// ─── Retry-budget suppression ────────────────────────────────────────────────
+
+test("a bare-id ledger row for a different unit type does not suppress the stuck verdict", (t) => {
+  const f = makeLedgerFixture(t);
+  // Retry backoff is open for plan-slice:M001/S01 only (bare-id ledger row).
+  const dispatchId = f.claim("plan-slice", "M001/S01");
+  markFailed(dispatchId, { errorSummary: "", retryAfterMs: 60_000 });
+
+  const history = historyFor(f.base);
+  for (let i = 0; i < 3; i++) history.recordDispatch("execute-task", "M001/S01");
+  const verdict = history.detectStuck();
+  assert.equal(verdict?.stuck, true, "another unit type's backoff must not suppress this unit");
+});
+
+test("consecutive-repeat verdict is suppressed while the retry budget drains", (t) => {
+  const f = makeLedgerFixture(t);
+  // markCanceled leaves error_summary null so the repeat-error rule (which is
+  // never suppressed) cannot fire; the suppression target is rule 2/2b.
+  const first = f.claim("plan-slice", "M001/S01");
+  markCanceled(first, "retry");
+  const second = f.claim("plan-slice", "M001/S01");
+  markFailed(second, { errorSummary: "", retryAfterMs: 60_000 });
+
+  const history = historyFor(f.base);
+  for (let i = 0; i < 3; i++) history.recordDispatch("plan-slice", "M001/S01");
+  assert.equal(history.detectStuck(), null, "stuck verdict must be suppressed inside the retry backoff window");
+});
+
+test("exhausted retry budget does not suppress the stuck verdict", (t) => {
+  const f = makeLedgerFixture(t);
+  const ids: number[] = [];
+  for (let i = 0; i < 3; i++) {
+    const id = f.claim("plan-slice", "M001/S01");
+    markCanceled(id, "retry");
+    ids.push(id);
+  }
+  const last = f.claim("plan-slice", "M001/S01");
+  // attempt_n defaults to 1 here; bump via a fresh claim is unnecessary —
+  // exhaust by omitting next_run_at instead (no scheduled retry → no backoff).
+  markFailed(last, { errorSummary: "" });
+
+  const history = historyFor(f.base);
+  for (let i = 0; i < 3; i++) history.recordDispatch("plan-slice", "M001/S01");
+  const verdict = history.detectStuck();
+  assert.equal(verdict?.stuck, true);
+});
+
+// ─── Rehydration (#482 regression) ───────────────────────────────────────────
+
+test("rehydrate seeds the window from the ledger with normalized canonical keys", (t) => {
+  const f = makeLedgerFixture(t);
+  for (let i = 0; i < 2; i++) {
+    const id = f.claim("execute-task", "M001/S01/T01");
+    markFailed(id, { errorSummary: "" });
+  }
+
+  const history = historyFor(f.base);
+  const count = history.rehydrate();
+  assert.equal(count, 2);
+  assert.deepEqual(
+    history.getRecentWindow().map((e) => e.key),
+    ["execute-task:M001/S01/T01", "execute-task:M001/S01/T01"],
+  );
+});
+
+test("#482 regression: a re-dispatch loop spanning a session restart is detected as stuck", (t) => {
+  const f = makeLedgerFixture(t);
+  // Session 1: the same unit was dispatched twice and never made progress.
+  for (let i = 0; i < 2; i++) {
+    const id = f.claim("execute-task", "M001/S01/T01");
+    markFailed(id, { errorSummary: "" });
+  }
+
+  // Session 2: a brand-new history (fresh orchestrator) rehydrates from the
+  // ledger; the very next decision for the same unit trips the stuck verdict
+  // instead of silently re-dispatching forever.
+  const restarted = historyFor(f.base);
+  restarted.rehydrate();
+  restarted.recordDispatch("execute-task", "M001/S01/T01");
+  const verdict = restarted.detectStuck();
+  assert.equal(verdict?.stuck, true);
+  assert.match(verdict?.reason ?? "", /execute-task:M001\/S01\/T01 derived 3 consecutive times/);
+});
+
+test("rehydrate mirrors recordDispatch error attachment so repeat-error detection fires after the next dispatch", (t) => {
+  const f = makeLedgerFixture(t);
+  // Session 1: two failed dispatches for the same unit, same error summary.
+  for (let i = 0; i < 2; i++) {
+    const id = f.claim("execute-task", "M001/S01/T01");
+    markFailed(id, { errorSummary: "boom: deterministic failure" });
+  }
+
+  // Session 2: fresh history rehydrates from the ledger. Just like the live
+  // recordDispatch path, the first occurrence of a unit skips the ledger
+  // lookup; only repeats carry the error. So rehydration alone does not trip
+  // Rule 1 — keeping the post-restart window no more aggressive than the live
+  // one (Rule 1 has no retry-budget suppression).
+  const restarted = historyFor(f.base);
+  const count = restarted.rehydrate();
+  assert.equal(count, 2);
+  const window = restarted.getRecentWindow();
+  assert.equal(window[0].error, undefined);
+  assert.equal(window[1].error, "boom: deterministic failure");
+  assert.equal(restarted.detectStuck(), null);
+
+  // The next dispatch of the same unit attaches the error again, giving two
+  // consecutive matching errors → Rule 1 fires, exactly as in the live path.
+  restarted.recordDispatch("execute-task", "M001/S01/T01");
+  const verdict = restarted.detectStuck();
+  assert.equal(verdict?.stuck, true);
+  assert.match(verdict?.reason ?? "", /Same error repeated/);
+});
+
+test("rehydrate degrades to an empty window without a scope or ledger", () => {
+  const noScope = historyFor(null);
+  assert.equal(noScope.rehydrate(), 0);
+  assert.equal(noScope.getRecentWindow().length, 0);
+
+  const noDb = historyFor("/nonexistent/scope");
+  assert.equal(noDb.rehydrate(), 0);
+  assert.equal(noDb.getRecentWindow().length, 0);
+});

package/src/resources/extensions/gsd/tests/dispatch-run-uat-browser-tools.test.ts

@@ -9,6 +9,7 @@ import { join } from "node:path";
 
 import { DISPATCH_RULES, type DispatchContext } from "../auto-dispatch.ts";
 import type { GSDState } from "../types.ts";
+import { BROWSER_AUTOMATION_CONTRACT_TOOLS } from "./browser-automation-contract-fixture.ts";
 
 type DispatchRuleEntry = (typeof DISPATCH_RULES)[number];
 
@@ -80,7 +81,7 @@ test("run-uat browser preflight uses registered tools when the active surface is
   assert.match(blocked?.action === "stop" ? blocked.reason : "", /run-uat tool surface has none/);
 
   const dispatched = await runUatRule().match(makeContext(basePath, {
-    registeredTools: ["browser_navigate"],
+    registeredTools: [...BROWSER_AUTOMATION_CONTRACT_TOOLS.piProvider],
   }));
   assert.equal(dispatched?.action, "dispatch");
   assert.equal(dispatched?.action === "dispatch" ? dispatched.unitType : undefined, "run-uat");