@opengsd/gsd-pi 1.2.0-dev.844675c9 → 1.2.0-dev.8e6112e9

package/src/resources/extensions/gsd/tests/custom-verify-retry-store.test.ts

@@ -17,11 +17,13 @@ function makeSession(activeRunDir: string): {
   activeRunDir: string;
   basePath: string;
   verificationRetryCount: Map<string, number>;
+  exhaustedVerificationUnits: Set<string>;
 } {
   return {
     activeRunDir,
     basePath: activeRunDir,
     verificationRetryCount: new Map<string, number>(),
+    exhaustedVerificationUnits: new Set<string>(),
   };
 }
 
@@ -137,3 +139,68 @@ test("saveCustomVerifyRetryCounts deletes empty retry files and ignores missing
     rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test("saveCustomVerifyRetryCounts persists exhaustedVerificationUnits and hydrateCustomVerifyRetryCounts restores them", () => {
+  const dir = mkdtempSync(join(tmpdir(), "gsd-verify-retries-"));
+  try {
+    const session = makeSession(dir);
+    session.exhaustedVerificationUnits.add("execute-task:M001/S001/T001");
+    session.exhaustedVerificationUnits.add("execute-task:M001/S001/T002");
+
+    saveCustomVerifyRetryCounts(session, {
+      logFailure: () => assert.fail("logFailure should not be called"),
+    });
+
+    const session2 = makeSession(dir);
+    hydrateCustomVerifyRetryCounts(session2, {
+      logFailure: () => assert.fail("logFailure should not be called"),
+    });
+
+    assert.deepEqual(
+      [...session2.exhaustedVerificationUnits].sort(),
+      ["execute-task:M001/S001/T001", "execute-task:M001/S001/T002"],
+    );
+    assert.equal(session2.verificationRetryCount.size, 0);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("saveCustomVerifyRetryCounts keeps file when only exhaustedVerificationUnits is non-empty", () => {
+  const dir = mkdtempSync(join(tmpdir(), "gsd-verify-retries-"));
+  try {
+    const session = makeSession(dir);
+    session.exhaustedVerificationUnits.add("execute-task:M001/S001/T001");
+
+    saveCustomVerifyRetryCounts(session, {
+      logFailure: () => assert.fail("logFailure should not be called"),
+    });
+
+    const saved = JSON.parse(readFileSync(customVerifyRetryStatePath(session), "utf-8"));
+    assert.deepEqual(saved.exhausted, ["execute-task:M001/S001/T001"]);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("hydrateCustomVerifyRetryCounts skips hydration when exhaustedVerificationUnits is already populated", () => {
+  const dir = mkdtempSync(join(tmpdir(), "gsd-verify-retries-"));
+  try {
+    const session = makeSession(dir);
+    session.exhaustedVerificationUnits.add("pre-existing:key");
+    mkdirSync(join(dir, "runtime"));
+    writeFileSync(customVerifyRetryStatePath(session), JSON.stringify({
+      counts: { "execute-task/M001/S001/T001": 2 },
+      exhausted: ["execute-task:M001/S001/T002"],
+    }));
+
+    hydrateCustomVerifyRetryCounts(session, {
+      logFailure: () => assert.fail("logFailure should not be called"),
+    });
+
+    assert.deepEqual([...session.exhaustedVerificationUnits], ["pre-existing:key"]);
+    assert.equal(session.verificationRetryCount.size, 0);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/db-writer.test.ts

@@ -920,9 +920,9 @@ describe('db-writer', () => {
       decision,
     });
 
-    test('detects deferral in scope with M###/S## pattern in choice', () => {
+    test('detects deferral in scope when the scope names the slice', () => {
       const result = extractDeferredSliceRef(
-        fields('deferral of low-priority work', 'Move M001/S03 to backlog', ''),
+        fields('deferral of slice M001/S03', 'Move low-priority work to backlog', ''),
       );
       assert.deepStrictEqual(result, { milestoneId: 'M001', sliceId: 'S03' });
     });
@@ -950,14 +950,14 @@ describe('db-writer', () => {
 
     test('recognises "deferring" variant', () => {
       const result = extractDeferredSliceRef(
-        fields('deferring this slice', 'M005/S02 can wait', ''),
+        fields('slice prioritization', 'deferring M005/S02 until later', ''),
       );
       assert.deepStrictEqual(result, { milestoneId: 'M005', sliceId: 'S02' });
     });
 
     test('recognises "defers" variant', () => {
       const result = extractDeferredSliceRef(
-        fields('team defers slice', 'M100/S10 not urgent', ''),
+        fields('slice prioritization', 'team defers slice M100/S10', ''),
       );
       assert.deepStrictEqual(result, { milestoneId: 'M100', sliceId: 'S10' });
     });
@@ -969,6 +969,17 @@ describe('db-writer', () => {
       assert.deepStrictEqual(result, { milestoneId: 'M003', sliceId: 'S01' });
     });
 
+    test('does not treat a planning scope reference as a deferred slice', () => {
+      const result = extractDeferredSliceRef(
+        fields(
+          'planning',
+          'Plan S01 as the happy-path money loop only; Defer full duplicate/replay idempotency + polling reconciliation backstop (R006).',
+          'M003/S01 scope boundary for the BTC money loop (which requirements land in the first slice vs deferred follow-on slices).',
+        ),
+      );
+      assert.strictEqual(result, null);
+    });
+
     test('returns null when no deferral keyword is present', () => {
       const result = extractDeferredSliceRef(
         fields('approved work', 'M001/S01 is ready', 'proceed with M001/S01'),

package/src/resources/extensions/gsd/tests/deep-project-auto-loop.test.ts

@@ -6,7 +6,8 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 
-import { runDispatch, runPreDispatch } from "../auto/phases.ts";
+import { runDispatch } from "../auto/dispatch.ts";
+import { runPreDispatch } from "../auto/pre-dispatch.ts";
 import { AutoSession } from "../auto/session.ts";
 import { resolveUnitSupervisionTimeouts } from "../auto-timers.ts";
 import { bootstrapAutoSession } from "../auto-start.ts";
@@ -15,7 +16,7 @@ import { resolveDispatch, setResearchProjectPromptBuilderForTest } from "../auto
 import { resolveExpectedArtifactPath, verifyExpectedArtifact, writeBlockerPlaceholder } from "../auto-recovery.ts";
 import { finalizeProjectResearchTimeout } from "../project-research-policy.ts";
 import { resetRegistry } from "../rule-registry.ts";
-import { approvalGateIdForUnit, isAwaitingUserInput, isExplicitApprovalResponse, shouldPauseForUserApprovalQuestion } from "../user-input-boundary.ts";
+import { approvalGateIdForUnit, isAwaitingUserInput, isExplicitApprovalResponse, shouldPauseForQuestion } from "../consent-question.ts";
 import {
   clearPendingAutoStart,
   checkDeepProjectSetupAfterTurn,
@@ -1402,7 +1403,7 @@ test("deep project setup: user-quoted remote question failure does not pause aut
   ];
 
   assert.equal(isAwaitingUserInput(messages), false);
-  assert.equal(shouldPauseForUserApprovalQuestion("discuss-project", messages), false);
+  assert.equal(shouldPauseForQuestion("discuss-project", messages), false);
 });
 
 test("deep project setup: plain-text approval wait is treated as waiting for user input", () => {
@@ -1426,7 +1427,7 @@ test("deep project setup: opening interview question does not trigger approval a
   ];
 
   assert.equal(isAwaitingUserInput(messages), true);
-  assert.equal(shouldPauseForUserApprovalQuestion("discuss-project", messages), false);
+  assert.equal(shouldPauseForQuestion("discuss-project", messages), false);
 });
 
 test("deep project setup: grounding interview question with requirements context does not trigger approval abort", () => {
@@ -1441,7 +1442,7 @@ test("deep project setup: grounding interview question with requirements context
   ];
 
   assert.equal(isAwaitingUserInput(messages), true);
-  assert.equal(shouldPauseForUserApprovalQuestion("discuss-project", messages), false);
+  assert.equal(shouldPauseForQuestion("discuss-project", messages), false);
 });
 
 test("deep project setup: persistence and anti-goals interview prompt does not trigger approval abort", () => {
@@ -1460,7 +1461,7 @@ test("deep project setup: persistence and anti-goals interview prompt does not t
   ];
 
   assert.equal(isAwaitingUserInput(messages), true);
-  assert.equal(shouldPauseForUserApprovalQuestion("discuss-project", messages), false);
+  assert.equal(shouldPauseForQuestion("discuss-project", messages), false);
 });
 
 test("deep project setup: discovery questions before writing PROJECT do not trigger approval abort", () => {
@@ -1479,7 +1480,7 @@ test("deep project setup: discovery questions before writing PROJECT do not trig
   ];
 
   assert.equal(isAwaitingUserInput(messages), true);
-  assert.equal(shouldPauseForUserApprovalQuestion("discuss-project", messages), false);
+  assert.equal(shouldPauseForQuestion("discuss-project", messages), false);
 });
 
 test("deep project setup: discovery question mentioning write intent does not trigger approval abort", () => {
@@ -1491,7 +1492,7 @@ test("deep project setup: discovery question mentioning write intent does not tr
   ];
 
   assert.equal(isAwaitingUserInput(messages), true);
-  assert.equal(shouldPauseForUserApprovalQuestion("discuss-project", messages), false);
+  assert.equal(shouldPauseForQuestion("discuss-project", messages), false);
 });
 
 test("deep project setup: scope discovery question mentioning add does not trigger approval abort", () => {
@@ -1503,7 +1504,7 @@ test("deep project setup: scope discovery question mentioning add does not trigg
   ];
 
   assert.equal(isAwaitingUserInput(messages), true);
-  assert.equal(shouldPauseForUserApprovalQuestion("discuss-project", messages), false);
+  assert.equal(shouldPauseForQuestion("discuss-project", messages), false);
 });
 
 test("deep project setup: requirements preview question from screenshot is treated as waiting", () => {
@@ -1523,12 +1524,12 @@ test("deep project setup: requirements preview question from screenshot is treat
   ];
 
   assert.equal(isAwaitingUserInput(messages), true);
-  assert.equal(shouldPauseForUserApprovalQuestion("discuss-requirements", messages), true);
+  assert.equal(shouldPauseForQuestion("discuss-requirements", messages), true);
 });
 
 test("deep project setup: research decision question triggers approval boundary pause", () => {
   assert.equal(
-    shouldPauseForUserApprovalQuestion("research-decision", [
+    shouldPauseForQuestion("research-decision", [
       {
         role: "assistant",
         content: "Run domain research now? (y/n)",

package/src/resources/extensions/gsd/tests/derive-state-helpers.test.ts

@@ -569,6 +569,42 @@ describe('derive-state-helpers', () => {
     }
   });
 
+  // ─── Batch slice query: multi-milestone slices loaded in one query ─────
+  test('buildRegistryAndFindActive: batched slice query preserves ordering across milestones', async () => {
+    const base = createFixtureBase();
+    try {
+      // M001 is complete so the loop advances past it.
+      writeFile(base, 'milestones/M001/M001-ROADMAP.md', ROADMAP_CONTENT);
+      writeFile(base, 'milestones/M001/M001-SUMMARY.md', '# M001 Summary\n\nDone.');
+      // M002 is a queued shell milestone with no context and no slices — should be deferred.
+      mkdirSync(join(base, '.gsd', 'milestones', 'M002'), { recursive: true });
+      // M003 is the real active milestone with slices in non-trivial sequence order.
+      writeFile(base, 'milestones/M003/M003-CONTEXT.md', '# M003: Real\n\nReal milestone.');
+
+      openDatabase(':memory:');
+      insertMilestone({ id: 'M001', title: 'Complete', status: 'complete' });
+      insertMilestone({ id: 'M002', title: 'Shell', status: 'queued' });
+      insertMilestone({ id: 'M003', title: 'Real', status: 'active' });
+      // Slices intentionally inserted with out-of-order sequences to prove ordering.
+      insertSlice({ id: 'S01', milestoneId: 'M001', title: 'M1 Second', status: 'complete', risk: 'low', depends: [], sequence: 2 });
+      insertSlice({ id: 'S02', milestoneId: 'M001', title: 'M1 First', status: 'complete', risk: 'low', depends: [], sequence: 1 });
+      insertSlice({ id: 'S03', milestoneId: 'M003', title: 'M3 Second', status: 'active', risk: 'low', depends: [], sequence: 5 });
+      insertSlice({ id: 'S04', milestoneId: 'M003', title: 'M3 First', status: 'active', risk: 'low', depends: [], sequence: 3 });
+
+      invalidateStateCache();
+      const state = await deriveStateFromDb(base);
+
+      assert.equal(state.activeMilestone?.id, 'M003', 'batched: M003 is active after complete M001 and shell M002');
+      assert.equal(state.activeSlice?.id, 'S04', 'batched: first slice by sequence is active');
+      assert.equal(state.registry.find(e => e.id === 'M001')?.status, 'complete', 'batched: M001 complete');
+      assert.equal(state.registry.find(e => e.id === 'M002')?.status, 'pending', 'batched: shell M002 deferred to pending');
+      assert.equal(state.registry.find(e => e.id === 'M003')?.status, 'active', 'batched: M003 active');
+    } finally {
+      closeDatabase();
+      cleanup(base);
+    }
+  });
+
   // ─── Deferred queued shell: shell milestone deferred, real one promoted ──
   test('buildRegistryAndFindActive: queued shell deferred, later real milestone becomes active (#3470)', async () => {
     const base = createFixtureBase();

package/src/resources/extensions/gsd/tests/destructive-confirmation.test.ts

@@ -0,0 +1,303 @@
+/**
+ * Tests for the destructive-command confirmation escape hatch.
+ *
+ * Regression target: the destructive-guard hard block had no confirmation
+ * path. Re-issuing a force push after confirming via ask_user_questions hit
+ * the identical HARD BLOCK every time — an unwinnable loop. These tests pin
+ * the block → confirm → allow-once flow and its safety invariants.
+ *
+ * Two layers of coverage:
+ *  1. Unit — the confirmation-token module in isolation (block/confirm/consume
+ *     and every safety invariant).
+ *  2. Integration — the real registerHooks() bash tool_call guard +
+ *     ask_user_questions tool_result handler driven end-to-end, proving the
+ *     loop is escapable through the actual wiring, not just the helper module.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { registerHooks } from "../bootstrap/register-hooks.ts";
+import { classifyCommand } from "../safety/destructive-guard.ts";
+import {
+  DESTRUCTIVE_CONFIRM_GATE_MARKER,
+  confirmDestructiveCommand,
+  consumeDestructiveConfirmation,
+  isDestructiveConfirmGateId,
+  normalizeDestructiveCommand,
+  peekPendingDestructiveCommand,
+  requestDestructiveConfirmation,
+  resetDestructiveConfirmation,
+} from "../safety/destructive-confirmation.ts";
+
+const BASE = "/tmp/gsd-destructive-confirm-test";
+const FORCE_PUSH = "git push --force-with-lease origin feature/PO-566-chart-supply-chain";
+
+function blocked(command: string, basePath: string): boolean {
+  // Mirror the guard's decision: a classified-destructive command is blocked
+  // unless a matching confirmation token is consumed in this same check.
+  if (!classifyCommand(command).destructive) return false;
+  return !consumeDestructiveConfirmation(command, basePath);
+}
+
+test("repro: destructive command loops forever without confirmation", () => {
+  resetDestructiveConfirmation(BASE);
+  // Every attempt blocks — this is the bug the escape hatch fixes.
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "first attempt blocks");
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "retry still blocks");
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "and again — unwinnable loop");
+});
+
+test("block then confirm then retry allows the exact command once", () => {
+  resetDestructiveConfirmation(BASE);
+
+  // 1. Guard blocks and records the pending command.
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "initial attempt blocks");
+  requestDestructiveConfirmation(FORCE_PUSH, BASE);
+  assert.equal(peekPendingDestructiveCommand(BASE), normalizeDestructiveCommand(FORCE_PUSH));
+
+  // 2. User confirms via ask_user_questions affirmative answer.
+  const confirmed = confirmDestructiveCommand(BASE);
+  assert.equal(confirmed, normalizeDestructiveCommand(FORCE_PUSH));
+
+  // 3. Retry in the same turn now passes.
+  assert.equal(blocked(FORCE_PUSH, BASE), false, "confirmed command passes once");
+});
+
+test("confirmation is one-shot — a second destructive command re-blocks", () => {
+  resetDestructiveConfirmation(BASE);
+
+  requestDestructiveConfirmation(FORCE_PUSH, BASE);
+  confirmDestructiveCommand(BASE);
+  assert.equal(blocked(FORCE_PUSH, BASE), false, "first run consumes the token");
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "identical second run re-blocks");
+});
+
+test("confirmation is command-bound — a different command is not approved", () => {
+  resetDestructiveConfirmation(BASE);
+
+  requestDestructiveConfirmation(FORCE_PUSH, BASE);
+  confirmDestructiveCommand(BASE);
+
+  // A different destructive command must not ride the force-push confirmation.
+  assert.equal(blocked("rm -rf node_modules", BASE), true, "unrelated destructive cmd re-blocks");
+  // The original token is still intact for its exact command.
+  assert.equal(blocked(FORCE_PUSH, BASE), false, "original confirmed command still passes once");
+});
+
+test("cosmetic whitespace reformatting still matches the confirmed token", () => {
+  resetDestructiveConfirmation(BASE);
+
+  requestDestructiveConfirmation("git push   --force  origin   main", BASE);
+  confirmDestructiveCommand(BASE);
+  assert.equal(blocked("git push --force origin main", BASE), false, "whitespace-normalized match passes");
+});
+
+test("requesting a new confirmation invalidates a stale confirmed token", () => {
+  resetDestructiveConfirmation(BASE);
+
+  requestDestructiveConfirmation(FORCE_PUSH, BASE);
+  confirmDestructiveCommand(BASE);
+  // New block for a different command before the first was consumed.
+  requestDestructiveConfirmation("git reset --hard HEAD~3", BASE);
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "old confirmation no longer valid after new request");
+});
+
+test("confirm with nothing pending returns null and approves nothing", () => {
+  resetDestructiveConfirmation(BASE);
+  assert.equal(confirmDestructiveCommand(BASE), null, "no pending command -> null");
+  assert.equal(blocked(FORCE_PUSH, BASE), true, "no spurious approval");
+});
+
+test("tokens are isolated per basePath", () => {
+  const a = "/tmp/gsd-confirm-ws-a";
+  const b = "/tmp/gsd-confirm-ws-b";
+  resetDestructiveConfirmation(a);
+  resetDestructiveConfirmation(b);
+
+  requestDestructiveConfirmation(FORCE_PUSH, a);
+  confirmDestructiveCommand(a);
+
+  assert.equal(blocked(FORCE_PUSH, b), true, "workspace B is unaffected by workspace A's confirmation");
+  assert.equal(blocked(FORCE_PUSH, a), false, "workspace A still passes once");
+});
+
+test("gate id marker detection", () => {
+  assert.equal(isDestructiveConfirmGateId(`${DESTRUCTIVE_CONFIRM_GATE_MARKER}_push`), true);
+  assert.equal(isDestructiveConfirmGateId("depth_verification_M001"), false);
+  assert.equal(isDestructiveConfirmGateId(undefined), false);
+  assert.equal(isDestructiveConfirmGateId(123), false);
+});
+
+test("non-destructive commands are never gated regardless of token state", () => {
+  resetDestructiveConfirmation(BASE);
+  assert.equal(blocked("git status", BASE), false);
+  assert.equal(blocked("ls -la", BASE), false);
+});
+
+// ─── Integration: real registerHooks() wiring, driven end-to-end ────────────
+// The unit tests above exercise the token module directly. These drive the
+// actual registered bash tool_call guard and ask_user_questions tool_result
+// handler, proving the loop the user hit is escapable through the real hooks —
+// not just the helper. Mirrors the harness in
+// register-hooks-depth-verification.test.ts.
+
+type Handler = (event: any, ctx?: any) => Promise<any> | any;
+
+function makeHookHarness(): {
+  handlers: Map<string, Handler[]>;
+  pi: any;
+} {
+  const handlers = new Map<string, Handler[]>();
+  const pi = {
+    on(event: string, handler: Handler) {
+      const existing = handlers.get(event) ?? [];
+      existing.push(handler);
+      handlers.set(event, existing);
+    },
+  } as any;
+  return { handlers, pi };
+}
+
+/** Run every bash tool_call guard and return the first block result, if any. */
+async function runBashGuard(
+  handlers: Map<string, Handler[]>,
+  command: string,
+  ctx: any,
+): Promise<{ block?: boolean; reason?: string } | undefined> {
+  let block: { block?: boolean; reason?: string } | undefined;
+  for (const handler of handlers.get("tool_call") ?? []) {
+    const result = await handler(
+      { toolCallId: "bash-1", toolName: "bash", input: { command } },
+      ctx,
+    );
+    if (result?.block) block = result;
+  }
+  return block;
+}
+
+/** Deliver an affirmative ask_user_questions answer for a destructive gate. */
+async function answerConfirmGate(
+  handlers: Map<string, Handler[]>,
+  questionId: string,
+  ctx: any,
+): Promise<void> {
+  const questions = [
+    {
+      id: questionId,
+      question: "Run this destructive command?",
+      options: [{ label: "Yes, run it (Recommended)" }, { label: "No, cancel" }],
+    },
+  ];
+  for (const handler of handlers.get("tool_result") ?? []) {
+    await handler(
+      {
+        toolName: "ask_user_questions",
+        input: { questions },
+        details: {
+          response: { answers: { [questionId]: { selected: "Yes, run it (Recommended)" } } },
+        },
+      },
+      ctx,
+    );
+  }
+}
+
+test("integration: real hooks block a force push, then allow it once after confirmation", async (t) => {
+  const dir = "/tmp/gsd-destructive-confirm-int-allow";
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+  resetDestructiveConfirmation(dir);
+  t.after(() => resetDestructiveConfirmation(dir));
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+
+  // 1. First attempt is hard-blocked by the real guard, with instructions that
+  //    name the destructive_confirm gate.
+  const firstBlock = await runBashGuard(handlers, FORCE_PUSH, ctx);
+  assert.equal(firstBlock?.block, true, "real guard blocks the first attempt");
+  assert.match(firstBlock?.reason ?? "", /HARD BLOCK: destructive Bash command/);
+  assert.match(firstBlock?.reason ?? "", /force push/);
+  assert.match(firstBlock?.reason ?? "", /destructive_confirm/);
+
+  // 2. User answers an affirmative destructive_confirm gate.
+  await answerConfirmGate(handlers, "destructive_confirm_force_push", ctx);
+
+  // 3. Re-issuing the exact command in the same turn now runs once (no block).
+  const secondAttempt = await runBashGuard(handlers, FORCE_PUSH, ctx);
+  assert.equal(secondAttempt, undefined, "confirmed command passes the real guard once");
+
+  // 4. One-shot: an immediate identical third attempt re-blocks.
+  const thirdAttempt = await runBashGuard(handlers, FORCE_PUSH, ctx);
+  assert.equal(thirdAttempt?.block, true, "second run of the same command re-blocks (one-shot)");
+});
+
+test("integration: declining the confirm gate leaves the command blocked", async (t) => {
+  const dir = "/tmp/gsd-destructive-confirm-int-decline";
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+  resetDestructiveConfirmation(dir);
+  t.after(() => resetDestructiveConfirmation(dir));
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+
+  assert.equal((await runBashGuard(handlers, FORCE_PUSH, ctx))?.block, true, "first attempt blocks");
+
+  // Decline: the non-affirmative (non-first) option must NOT promote a token.
+  const questions = [
+    {
+      id: "destructive_confirm_force_push",
+      question: "Run this destructive command?",
+      options: [{ label: "Yes, run it (Recommended)" }, { label: "No, cancel" }],
+    },
+  ];
+  for (const handler of handlers.get("tool_result") ?? []) {
+    await handler(
+      {
+        toolName: "ask_user_questions",
+        input: { questions },
+        details: {
+          response: { answers: { "destructive_confirm_force_push": { selected: "No, cancel" } } },
+        },
+      },
+      ctx,
+    );
+  }
+
+  assert.equal(
+    (await runBashGuard(handlers, FORCE_PUSH, ctx))?.block,
+    true,
+    "declined command stays blocked",
+  );
+});
+
+test("integration: a confirm token does not leak to a different destructive command", async (t) => {
+  const dir = "/tmp/gsd-destructive-confirm-int-bound";
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+  resetDestructiveConfirmation(dir);
+  t.after(() => resetDestructiveConfirmation(dir));
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+
+  await runBashGuard(handlers, FORCE_PUSH, ctx);
+  await answerConfirmGate(handlers, "destructive_confirm_force_push", ctx);
+
+  // A different destructive command must not ride the force-push confirmation.
+  // In the real guard, blocking this command also records it as pending, which
+  // invalidates the stale force-push token (stale-token safety invariant) — so
+  // the original confirmation is consumed/cleared, not left dangling.
+  assert.equal(
+    (await runBashGuard(handlers, "rm -rf build", ctx))?.block,
+    true,
+    "unrelated destructive command is still blocked",
+  );
+  // Because the unrelated block invalidated the stale token, the original
+  // force-push now re-blocks too: a confirmation never survives an intervening
+  // destructive command. This is stricter (safer) than per-command isolation.
+  assert.equal(
+    (await runBashGuard(handlers, FORCE_PUSH, ctx))?.block,
+    true,
+    "force-push token was invalidated by the intervening destructive block",
+  );
+});

package/src/resources/extensions/gsd/tests/discuss-routing-fixes.test.ts

@@ -39,7 +39,11 @@ function makeDiscussPi() {
     tmp,
     pi: {
       getActiveTools: () => ["gsd_summary_save", "bash"],
+      emitAdjustToolSet: async () => undefined,
+      emitBeforeModelSelect: async () => undefined,
+      setModel: async () => true,
       setActiveTools: () => {},
+      setThinkingLevel: () => {},
       sendMessage: (message: { content?: unknown }) => {
         sent.push(message);
       },
@@ -53,6 +57,7 @@ function makeDiscussPi() {
 }
 
 function makeDiscussCtx(notifications: Array<{ message: string; level?: string }> = []) {
+  const model = { provider: "anthropic", id: "claude-sonnet-4-6", api: "anthropic-messages" };
   return {
     hasUI: true,
     sessionManager: {
@@ -65,8 +70,13 @@ function makeDiscussCtx(notifications: Array<{ message: string; level?: string }
       setStatus: () => {},
     },
     waitForIdle: async () => {},
-    model: undefined,
-    modelRegistry: { getProviderAuthMode: () => undefined },
+    model,
+    modelRegistry: {
+      getAvailable: () => [model],
+      getAll: () => [model],
+      getProviderAuthMode: () => "apiKey",
+      isProviderRequestReady: () => true,
+    },
   };
 }
 

package/src/resources/extensions/gsd/tests/dispatch-complete-milestone-guard.test.ts

@@ -14,7 +14,15 @@ import { execFileSync } from "node:child_process";
 
 import { DISPATCH_RULES, resolveDispatch, type DispatchContext } from "../auto-dispatch.ts";
 import { AutoSession } from "../auto/session.ts";
-import { closeDatabase, insertAssessment, insertGateRow, insertMilestone, insertSlice, openDatabase } from "../gsd-db.ts";
+import {
+  closeDatabase,
+  getPendingGates,
+  insertAssessment,
+  insertGateRow,
+  insertMilestone,
+  insertSlice,
+  openDatabase,
+} from "../gsd-db.ts";
 
 function makeBase(): string {
   const base = mkdtempSync(join(tmpdir(), "gsd-complete-dispatch-"));
@@ -243,7 +251,7 @@ describe("complete phase dispatch guard (#5683)", () => {
     assert.equal(result?.reason, "All milestones complete.");
   });
 
-  test("blocks terminal stop when closed milestone still has pending gates", async () => {
+  test("closes stale pending gates from milestone validation before terminal stop", async () => {
     base = makeBase();
     openDatabase(join(base, ".gsd", "gsd.db"));
     insertMilestone({ id: "M001", title: "Milestone One", status: "complete" });
@@ -268,10 +276,33 @@ describe("complete phase dispatch guard (#5683)", () => {
 
     const result = await rule.match(ctx);
 
+    assert.equal(result?.action, "stop");
+    assert.equal(result?.reason, "All milestones complete.");
+    assert.deepEqual(getPendingGates("M001", "S01"), []);
+  });
+
+  test("blocks terminal stop when pending gates have no closeout evidence", async () => {
+    base = makeBase();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    insertMilestone({ id: "M001", title: "Milestone One", status: "complete" });
+    insertSlice({ milestoneId: "M001", id: "S01", title: "Done", status: "complete" });
+    insertGateRow({
+      milestoneId: "M001",
+      sliceId: "S01",
+      gateId: "Q3",
+      scope: "slice",
+      status: "pending",
+    });
+
+    const ctx = buildDispatchCtx(base);
+    ctx.state.phase = "complete";
+
+    const result = await rule.match(ctx);
+
     assert.equal(result?.action, "stop");
     assert.equal(result?.level, "warning");
     assert.match(result?.reason ?? "", /closeout-consistency-blocked/);
-    assert.match(result?.reason ?? "", /quality gate Q3 is still pending/);
+    assert.match(result?.reason ?? "", /latest milestone validation is "absent"/);
   });
 });