@opengsd/gsd-pi 1.2.0-dev.955e4da0 → 1.2.0-dev.9ad8ae33

package/src/resources/extensions/gsd/tests/uok-audit-unified.test.ts

@@ -4,6 +4,7 @@ import { mkdtempSync, readFileSync, rmSync, existsSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { emitJournalEvent } from "../journal.ts";
+import { appendEvent } from "../workflow-events.ts";
 import { saveActivityLog } from "../activity-log.ts";
 import { initMetrics, resetMetrics, snapshotUnitMetrics } from "../metrics.ts";
 import { setLogBasePath, logWarning } from "../workflow-logger.ts";
@@ -38,6 +39,12 @@ test("unified audit plane bridges journal/activity/metrics/workflow logger into
       eventType: "iteration-start",
       data: { turnId: "turn-123", unitId: "M001/S01/T01" },
     });
+    appendEvent(basePath, {
+      cmd: "complete-task",
+      params: { milestoneId: "M001", sliceId: "S01", taskId: "T01" },
+      ts: new Date().toISOString(),
+      actor: "agent",
+    });
 
     const activityCtx = makeMockContext([
       { type: "message", message: { role: "assistant", content: [{ type: "text", text: "hello" }] } },
@@ -73,6 +80,7 @@ test("unified audit plane bridges journal/activity/metrics/workflow logger into
     const events = readAuditEvents(basePath);
     const types = new Set(events.map((event) => String(event.type ?? "")));
     assert.ok(types.has("journal-iteration-start"));
+    assert.ok(types.has("workflow-event-complete_task"));
     assert.ok(types.has("activity-log-saved"));
     assert.ok(types.has("unit-metrics-snapshot"));
     assert.ok(types.has("workflow-log-warn"));

package/src/resources/extensions/gsd/tests/verification-verdict.test.ts

@@ -24,6 +24,8 @@ test("execute-task fails closed when no host-owned checks are discovered", () =>
   assert.equal(verdict.reason, "no-host-checks");
   assert.equal(verdict.retryable, false);
   assert.match(verdict.failureContext, /No runnable host-owned verification command/);
+  assert.match(verdict.failureContext, /\.gsd\/PREFERENCES\.md/);
+  assert.match(verdict.failureContext, /\/gsd next/);
 });
 
 test("execute-task passes when non-runnable task-plan prose is the verification source", () => {

package/src/resources/extensions/gsd/tests/web-app-uat.test.ts

@@ -15,6 +15,10 @@ function scaffoldProject(root: string, pkg: Record<string, unknown>): void {
   writeFileSync(join(root, "package.json"), JSON.stringify(pkg, null, 2));
 }
 
+const LEGACY_ENGINE = { engine: "legacy", source: "probe", reason: "test" } as const;
+const MANAGED_ENGINE = { engine: "gsd-browser", source: "probe", reason: "test" } as const;
+const OFF_ENGINE = { engine: "off", source: "env", reason: "test" } as const;
+
 describe("web-app-uat guidance", () => {
   test("returns null for non-web projects", () => {
     const root = mkdtempSync(join(tmpdir(), "gsd-web-uat-"));
@@ -36,15 +40,54 @@ describe("web-app-uat guidance", () => {
         scripts: { dev: "vite" },
       });
       assert.equal(detectWebApp(root), true);
-      const block = buildWebAppUatGuidanceBlock(root);
+      const block = buildWebAppUatGuidanceBlock(root, LEGACY_ENGINE);
       assert.ok(block);
       assert.match(block!, /browser-executable/);
+      assert.match(block!, /Playwright-backed `browser_\*` tools/);
       assert.match(block!, /Playwright scaffolding/);
     } finally {
       rmSync(root, { recursive: true, force: true });
     }
   });
 
+  test("describes the managed gsd-browser engine when it is the resolved backing", () => {
+    const root = mkdtempSync(join(tmpdir(), "gsd-web-uat-"));
+    try {
+      scaffoldProject(root, {
+        dependencies: { react: "19.0.0" },
+        scripts: { dev: "vite" },
+      });
+      const block = buildWebAppUatGuidanceBlock(root, MANAGED_ENGINE);
+      assert.ok(block);
+      assert.match(block!, /managed gsd-browser engine/);
+      assert.match(block!, /browser-executable/);
+      assert.doesNotMatch(block!, /Playwright-backed/);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test("steers to runtime-executable UAT when browser tools are off", () => {
+    const root = mkdtempSync(join(tmpdir(), "gsd-web-uat-"));
+    try {
+      scaffoldProject(root, {
+        dependencies: { react: "19.0.0" },
+        scripts: { dev: "vite" },
+      });
+      const block = buildWebAppUatGuidanceBlock(root, OFF_ENGINE);
+      assert.ok(block);
+      assert.match(block!, /browser tools are disabled/);
+      assert.doesNotMatch(block!, /- `browser-executable`/);
+      // mixed/live-runtime require browser tools per UAT_MODE_POLICIES, so the
+      // bullet must drop out too — recommending them would dead-end at dispatch.
+      assert.doesNotMatch(block!, /- `mixed`/);
+      assert.doesNotMatch(block!, /interactive `browser_\*` checks/);
+      assert.match(block!, /runtime-executable/);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
   test("detects existing Playwright and npm script", () => {
     const root = mkdtempSync(join(tmpdir(), "gsd-web-uat-"));
     try {

package/src/resources/extensions/gsd/tests/workflow-events.test.ts

@@ -13,6 +13,7 @@ import {
   compactMilestoneEvents,
   type WorkflowEvent,
 } from '../workflow-events.ts';
+import { workflowEventLogPath } from '../workflow-event-ledger.ts';
 
 function tempDir(): string {
   return fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-events-'));
@@ -38,6 +39,24 @@ test('workflow-events: appendEvent creates .gsd dir and event-log.jsonl', () =>
   }
 });
 
+test('workflow-events: appendEvent from canonical worktree writes project ledger', () => {
+  const base = tempDir();
+  try {
+    const worktree = path.join(base, '.gsd-worktrees', 'M001');
+    fs.mkdirSync(worktree, { recursive: true });
+
+    appendEvent(worktree, makeEvent('complete-task', { milestoneId: 'M001', taskId: 'T01' }));
+
+    const projectLog = path.join(base, '.gsd', 'event-log.jsonl');
+    const worktreeLog = path.join(worktree, '.gsd', 'event-log.jsonl');
+    assert.ok(fs.existsSync(projectLog), 'project event ledger should exist');
+    assert.equal(fs.existsSync(worktreeLog), false, 'worktree-local event log should not be the append target');
+    assert.equal(workflowEventLogPath(worktree), projectLog);
+  } finally {
+    cleanupDir(base);
+  }
+});
+
 test('workflow-events: appendEvent writes valid JSON line', () => {
   const base = tempDir();
   try {

package/src/resources/extensions/gsd/tests/workflow-mcp.test.ts

@@ -495,8 +495,8 @@ test("workflow MCP launch config reaches mutation tools over stdio", async () =>
               estimate: "10m",
               files: ["src/resources/extensions/gsd/workflow-mcp.ts"],
               verify: "node --test",
-              inputs: [".gsd/milestones/M001/M001-ROADMAP.md"],
-              expectedOutput: ["S01-PLAN.md", "T01-PLAN.md"],
+              inputs: [],
+              expectedOutput: ["src/bridge-status.md"],
             },
           ],
         },

package/src/resources/extensions/gsd/tests/workflow-reconcile.test.ts

@@ -89,3 +89,23 @@ test("resolveConflict(pick=main) rewrites the worktree log durably", () => {
   const second = reconcileWorktreeLogs(main, worktree);
   assert.equal(second.conflicts.length, 0, "reconcile should stay clean after choosing main");
 });
+
+test("reconcileWorktreeLogs treats canonical worktree project-ledger appends as already durable", () => {
+  const root = mkdtempSync(join(tmpdir(), "workflow-reconcile-canonical-"));
+  const main = join(root, "main");
+  const worktree = join(main, ".gsd-worktrees", "M001");
+  mkdirSync(worktree, { recursive: true });
+  tmpDirs.push(root);
+
+  appendEvent(worktree, {
+    cmd: "complete-task",
+    params: { milestoneId: "M001", sliceId: "S01", taskId: "T01" },
+    ts: "2026-01-01T00:00:00.000Z",
+    actor: "agent",
+  });
+
+  const result = reconcileWorktreeLogs(main, worktree);
+
+  assert.equal(result.autoMerged, 0, "project-ledger append should not replay the root log");
+  assert.equal(result.conflicts.length, 0, "missing worktree shard is not a conflict");
+});

package/src/resources/extensions/gsd/tests/workflow-tool-executors.test.ts

@@ -15,8 +15,11 @@ import {
   upsertRequirement,
   getAllMilestones,
 } from "../gsd-db.ts";
+import { registerAutoWorker } from "../db/auto-workers.ts";
+import { claimMilestoneLease, getMilestoneLease } from "../db/milestone-leases.ts";
 import { deriveState, invalidateStateCache } from "../state.ts";
 import { autoSession } from "../auto-runtime-state.ts";
+import { normalizeRealPath } from "../paths.ts";
 import { markApprovalGateVerified, markDepthVerified, clearDiscussionFlowState, loadWriteGateSnapshot, setPendingGate } from "../bootstrap/write-gate.ts";
 import {
   executeCompleteMilestone,
@@ -94,6 +97,28 @@ function seedMilestone(milestoneId: string, title: string, status = "active"): v
   ).run(milestoneId, title, status, new Date().toISOString());
 }
 
+function validMilestonePlan(milestoneId = "M001"): Parameters<typeof executePlanMilestone>[0] {
+  return {
+    milestoneId,
+    title: "Workflow MCP planning",
+    vision: "Plan milestone over shared executors.",
+    slices: [
+      {
+        sliceId: "S01",
+        title: "Bridge planning",
+        risk: "medium",
+        depends: [],
+        demo: "Milestone plan persists through MCP.",
+        goal: "Persist roadmap state.",
+        successCriteria: "ROADMAP.md renders from DB.",
+        proofLevel: "integration",
+        integrationClosure: "Prompts and MCP call the same handler.",
+        observabilityImpact: "Executor tests cover output paths.",
+      },
+    ],
+  };
+}
+
 function seedSlice(milestoneId: string, sliceId: string, status: string): void {
   const db = _getAdapter();
   if (!db) throw new Error("DB not open");
@@ -461,25 +486,7 @@ test("executePlanMilestone writes roadmap state and rendered roadmap path", asyn
   try {
     openTestDb(base);
 
-    const result = await inProjectDir(base, () => executePlanMilestone({
-      milestoneId: "M001",
-      title: "Workflow MCP planning",
-      vision: "Plan milestone over shared executors.",
-      slices: [
-        {
-          sliceId: "S01",
-          title: "Bridge planning",
-          risk: "medium",
-          depends: [],
-          demo: "Milestone plan persists through MCP.",
-          goal: "Persist roadmap state.",
-          successCriteria: "ROADMAP.md renders from DB.",
-          proofLevel: "integration",
-          integrationClosure: "Prompts and MCP call the same handler.",
-          observabilityImpact: "Executor tests cover output paths.",
-        },
-      ],
-    }, base));
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan(), base));
 
     assert.equal(result.details.operation, "plan_milestone");
     assert.equal(result.details.milestoneId, "M001");
@@ -492,29 +499,257 @@ test("executePlanMilestone writes roadmap state and rendered roadmap path", asyn
   }
 });
 
+test("executePlanMilestone refuses a same-milestone lease conflict", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+    seedMilestone("M001", "Existing holder");
+    const holder = registerAutoWorker({ projectRootRealpath: join(base, "other-project") });
+    const lease = claimMilestoneLease(holder, "M001");
+    assert.equal(lease.ok, true);
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M001"), base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details.operation, "plan_milestone");
+    assert.equal(result.details.error, "milestone_lease_conflict");
+    assert.match(result.content[0].text, /Milestone M001 is currently leased/);
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone releases its one-shot milestone lease after planning", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+    seedMilestone("M001", "Existing milestone");
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M001"), base));
+
+    assert.equal(result.isError, undefined);
+    const lease = getMilestoneLease("M001");
+    assert.ok(lease, "planning should participate in milestone lease coordination");
+    assert.equal(lease.status, "released");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone creates a fresh milestone without a one-shot lease", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M042"), base));
+
+    assert.equal(result.isError, undefined);
+    assert.equal(result.details.operation, "plan_milestone");
+    assert.equal(result.details.milestoneId, "M042");
+    assert.equal(getMilestoneLease("M042"), null,
+      "fresh milestone creation must pass through without creating a lease row");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone does not create a placeholder when fresh planning validation fails", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+
+    // handlePlanMilestone rejects empty slice arrays during validation. Fresh
+    // milestone creation must pass through without pre-inserting a leaseable
+    // placeholder row.
+    const invalid = { ...validMilestonePlan("M042"), slices: [] };
+    const result = await inProjectDir(base, () => executePlanMilestone(invalid, base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details.operation, "plan_milestone");
+    const milestones = getAllMilestones();
+    assert.equal(milestones.find(m => m.id === "M042"), undefined,
+      "failed fresh planning must not leave a milestone row behind");
+    assert.equal(getMilestoneLease("M042"), null,
+      "failed fresh planning must not create a lease row");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone does not delete a peer worker's milestone row on lease conflict", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+
+    // Simulate a peer worker (different project_root) that has already
+    // created the milestone row and taken its lease. The one-shot executor
+    // must observe the active lease and refuse — without removing the peer's
+    // milestone row or lease. The pre-rollback bug was that
+    // INSERT OR IGNORE's silent no-op was treated as proof of authorship and
+    // the cleanup path then deleted the peer's row.
+    const peer = registerAutoWorker({ projectRootRealpath: join(base, "peer-project") });
+    seedMilestone("M050", "Peer-owned milestone");
+    const peerLease = claimMilestoneLease(peer, "M050");
+    assert.equal(peerLease.ok, true);
+    const peerLeaseToken = peerLease.ok ? peerLease.token : -1;
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M050"), base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details.error, "milestone_lease_conflict");
+    const peerMilestone = getAllMilestones().find(m => m.id === "M050");
+    assert.ok(peerMilestone, "peer milestone row must survive the one-shot conflict path");
+    assert.equal(peerMilestone?.title, "Peer-owned milestone",
+      "peer milestone row must not be clobbered or recreated");
+    const surviving = getMilestoneLease("M050");
+    assert.ok(surviving, "peer lease row must survive");
+    assert.equal(surviving.status, "held", "peer must still hold the lease");
+    assert.equal(surviving.worker_id, peer);
+    assert.equal(surviving.fencing_token, peerLeaseToken,
+      "peer's fencing token must not be incremented by the rejected one-shot");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone refuses when a foreign active worker holds the lease even while in-process auto is active", async () => {
+  const base = makeTmpBase();
+  autoSession.reset();
+  try {
+    openTestDb(base);
+    seedMilestone("M060", "Foreign-held milestone");
+
+    // In-process auto must still reject a lease held by another worker.
+    const foreign = registerAutoWorker({ projectRootRealpath: join(base, "foreign-project") });
+    const foreignLease = claimMilestoneLease(foreign, "M060");
+    assert.equal(foreignLease.ok, true);
+    const foreignToken = foreignLease.ok ? foreignLease.token : -1;
+
+    const ownAutoWorker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+    autoSession.active = true;
+    autoSession.workerId = ownAutoWorker;
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M060"), base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details.error, "milestone_lease_conflict",
+      "in-process auto must NOT skip lease checks when the lease is held by a different active worker");
+    const surviving = getMilestoneLease("M060");
+    assert.ok(surviving);
+    assert.equal(surviving.status, "held");
+    assert.equal(surviving.worker_id, foreign);
+    assert.equal(surviving.fencing_token, foreignToken,
+      "foreign worker's fencing token must not be incremented by the rejected call");
+  } finally {
+    autoSession.reset();
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone proceeds without re-claiming when in-process auto holds the lease itself", async () => {
+  const base = makeTmpBase();
+  autoSession.reset();
+  try {
+    openTestDb(base);
+    seedMilestone("M070", "Auto-held milestone");
+
+    // In-process auto should not re-claim its own lease and bump its token.
+    const ownAutoWorker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+    const heldLease = claimMilestoneLease(ownAutoWorker, "M070");
+    assert.equal(heldLease.ok, true);
+    const heldToken = heldLease.ok ? heldLease.token : -1;
+    autoSession.active = true;
+    autoSession.workerId = ownAutoWorker;
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M070"), base));
+
+    assert.equal(result.isError, undefined, `auto's own plan-milestone call should succeed: ${result.content?.[0]?.text}`);
+    const surviving = getMilestoneLease("M070");
+    assert.ok(surviving);
+    assert.equal(surviving.status, "held", "auto's lease must still be held after the planning call");
+    assert.equal(surviving.worker_id, ownAutoWorker);
+    assert.equal(surviving.fencing_token, heldToken,
+      "auto's fencing token must not be incremented by an in-process plan call");
+  } finally {
+    autoSession.reset();
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone refuses a same-process holder when active auto does not own it", async () => {
+  const base = makeTmpBase();
+  autoSession.reset();
+  try {
+    openTestDb(base);
+    seedMilestone("M080", "Same-process holder");
+    const staleWorker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+    const heldLease = claimMilestoneLease(staleWorker, "M080");
+    assert.equal(heldLease.ok, true);
+    const heldToken = heldLease.ok ? heldLease.token : -1;
+
+    autoSession.active = true;
+    autoSession.workerId = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M080"), base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details?.error, "milestone_lease_conflict");
+    const surviving = getMilestoneLease("M080");
+    assert.ok(surviving, "same-process holder lease must remain after conflict");
+    assert.equal(surviving.worker_id, staleWorker);
+    assert.equal(surviving.fencing_token, heldToken);
+    assert.equal(surviving.status, "held");
+  } finally {
+    autoSession.reset();
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone takes over a stale same-process lease via reentry instead of waiting for TTL", async () => {
+  const base = makeTmpBase();
+  autoSession.reset();
+  try {
+    openTestDb(base);
+    seedMilestone("M080", "Stale-locked milestone");
+
+    // One-shot planning should reach claimMilestoneLease so its same-process
+    // reentry clause can recover stale worker rows.
+    const staleWorker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+    const staleLease = claimMilestoneLease(staleWorker, "M080");
+    assert.equal(staleLease.ok, true);
+    const staleToken = staleLease.ok ? staleLease.token : -1;
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M080"), base));
+
+    assert.equal(result.isError, undefined,
+      `same-process reentry takeover must succeed, not return milestone_lease_conflict: ${result.content?.[0]?.text}`);
+    const after = getMilestoneLease("M080");
+    assert.ok(after, "lease row must remain after takeover + release");
+    assert.equal(after.status, "released", "the executor releases its own claim before returning");
+    assert.notEqual(after.worker_id, staleWorker,
+      "lease must be owned by the new worker after takeover");
+    assert.ok(after.fencing_token > staleToken,
+      `fencing token must monotonically advance on takeover (was ${staleToken}, now ${after.fencing_token})`);
+  } finally {
+    autoSession.reset();
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
 test("executePlanSlice writes task planning state and rendered plan artifacts", async () => {
   const base = makeTmpBase();
   try {
     openTestDb(base);
-    await inProjectDir(base, () => executePlanMilestone({
-      milestoneId: "M001",
-      title: "Workflow MCP planning",
-      vision: "Plan milestone over shared executors.",
-      slices: [
-        {
-          sliceId: "S01",
-          title: "Bridge planning",
-          risk: "medium",
-          depends: [],
-          demo: "Milestone plan persists through MCP.",
-          goal: "Persist roadmap state.",
-          successCriteria: "ROADMAP.md renders from DB.",
-          proofLevel: "integration",
-          integrationClosure: "Prompts and MCP call the same handler.",
-          observabilityImpact: "Executor tests cover output paths.",
-        },
-      ],
-    }, base));
+    await inProjectDir(base, () => executePlanMilestone(validMilestonePlan(), base));
 
     const result = await inProjectDir(base, () => executePlanSlice({
       milestoneId: "M001",
@@ -528,8 +763,8 @@ test("executePlanSlice writes task planning state and rendered plan artifacts",
           estimate: "15m",
           files: ["src/resources/extensions/gsd/tools/workflow-tool-executors.ts"],
           verify: "node --test",
-          inputs: [".gsd/milestones/M001/M001-ROADMAP.md"],
-          expectedOutput: ["S01-PLAN.md", "T01-PLAN.md"],
+          inputs: [],
+          expectedOutput: ["src/bridge-status.md"],
         },
       ],
     }, base));

package/src/resources/extensions/gsd/tests/worktree-teardown-safety.test.ts

@@ -25,6 +25,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { execSync } from "node:child_process";
 import { describe, it, after } from "node:test";
+import assert from "node:assert/strict";
 
 import { createWorktree, removeWorktree, worktreePath, isInsideWorktreesDir } from "../worktree-manager.ts";
 import { createTestContext } from "./test-helpers.ts";
@@ -86,6 +87,27 @@ describe("worktree-teardown-safety", () => {
     );
   });
 
+  it("removeWorktree survives when current working directory was deleted", () => {
+    const tempDir = createTempRepo();
+    dirs.push(tempDir);
+
+    const wt = createWorktree(tempDir, "deleted-cwd");
+    assertTrue(existsSync(wt.path), "worktree created successfully");
+
+    const safeCwd = process.cwd();
+    try {
+      process.chdir(wt.path);
+      rmSync(wt.path, { recursive: true, force: true });
+
+      assert.doesNotThrow(
+        () => removeWorktree(tempDir, "deleted-cwd"),
+        "removeWorktree should not call process.cwd() unguarded from a deleted cwd",
+      );
+    } finally {
+      process.chdir(safeCwd);
+    }
+  });
+
   it("path validation rejects paths outside .gsd/worktrees/", () => {
     const tempDir = createTempRepo();
     dirs.push(tempDir);

package/src/resources/extensions/gsd/tests/worktree.test.ts

@@ -9,6 +9,7 @@ import {
   detectWorktreeName,
   getCurrentBranch,
   getMainBranch,
+  nudgeGitBranchCache,
   getSliceBranchName,
   parseSliceBranch,
   resolveProjectRoot,
@@ -95,6 +96,23 @@ describe('worktree', async () => {
   assert.ok(!SLICE_BRANCH_RE.test("gsd/"), "regex rejects bare gsd/");
   assert.ok(!SLICE_BRANCH_RE.test("worktree/foo"), "regex rejects worktree/foo");
 
+  console.log("\n=== nudgeGitBranchCache deleted cwd ===");
+  {
+    const safeCwd = process.cwd();
+    const deletedCwd = mkdtempSync(join(tmpdir(), "gsd-deleted-cwd-"));
+    try {
+      process.chdir(deletedCwd);
+      rmSync(deletedCwd, { recursive: true, force: true });
+
+      assert.doesNotThrow(
+        () => nudgeGitBranchCache(safeCwd),
+        "nudgeGitBranchCache should not call process.cwd() unguarded from a deleted cwd",
+      );
+    } finally {
+      process.chdir(safeCwd);
+    }
+  }
+
   console.log("\n=== detectWorktreeName ===");
   assert.deepStrictEqual(detectWorktreeName("/projects/myapp"), null, "no worktree in plain path");
   assert.deepStrictEqual(detectWorktreeName("/projects/myapp/.gsd/worktrees/feature-auth"), "feature-auth", "detects worktree name");