@opengsd/gsd-pi 1.2.0-dev.b1abb545 → 1.2.0-dev.e8563f58

package/src/resources/extensions/gsd/tests/dynamic-bash-no-cap.test.ts

@@ -0,0 +1,132 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { createBashTool } from "@gsd/pi-coding-agent";
+
+import { registerDynamicTools } from "../bootstrap/dynamic-tools.ts";
+import { createAsyncBashTool } from "../../async-jobs/async-bash-tool.ts";
+
+// These tests assert on the runtime tool objects the agent actually receives —
+// the registered GSD bash tool, the core bash tool, and the async_bash tool —
+// not on source text. The behavioral guarantee (an explicit timeout still
+// fires after the silent 120s cap was removed) is exercised by spawning a real
+// process at the bottom of the file.
+
+/** Capture the GSD-registered `bash` tool object from registerDynamicTools. */
+function registerAndCaptureBash(): any {
+  let captured: any = undefined;
+  const pi = {
+    registerTool: (tool: any) => {
+      if (!captured && tool && tool.name === "bash") captured = tool;
+    },
+  };
+  registerDynamicTools(pi as any);
+  assert.ok(captured, "registerDynamicTools must register a tool named 'bash'");
+  return captured;
+}
+
+// 1. Cap removal: the GSD bash tool no longer injects a default timeout. The
+//    schema's timeout stays optional (no `default`), so an omitted timeout
+//    means "no timeout" rather than a silent 120s cap.
+test("GSD bash tool exposes an optional timeout with no injected default", () => {
+  const bash = registerAndCaptureBash();
+  const timeout = bash.parameters?.properties?.timeout;
+  assert.ok(timeout, "bash tool must expose a `timeout` parameter");
+  assert.equal(
+    "default" in timeout,
+    false,
+    "the timeout schema must not carry a default — an omitted timeout means uncapped",
+  );
+  assert.equal(
+    bash.parameters?.required?.includes?.("timeout") ?? false,
+    false,
+    "timeout must remain optional",
+  );
+});
+
+// 2. Watchdog verbiage is GSD-scoped: the core bash tool (reused by non-GSD
+//    embeddings with no watchdog) must NOT claim a watchdog, while the
+//    GSD-registered tool injects it into both description and timeout schema.
+test("core bash tool does not advertise the auto-mode watchdog", () => {
+  const core = createBashTool(process.cwd(), { spawnHook: (c: any) => c });
+  assert.equal(
+    /stalled-tool watchdog/.test(core.description ?? ""),
+    false,
+    "core bash must not advertise a watchdog — non-GSD embeddings have none",
+  );
+  assert.equal(
+    /stalled-tool watchdog/.test(
+      (core.parameters as any)?.properties?.timeout?.description ?? "",
+    ),
+    false,
+    "core bash timeout schema must not advertise a watchdog",
+  );
+});
+
+test("GSD-registered bash tool advertises the stalled-tool watchdog", () => {
+  const bash = registerAndCaptureBash();
+  assert.equal(
+    /stalled-tool watchdog/.test(bash.description ?? ""),
+    true,
+    "the GSD bash description must name the stalled-tool watchdog",
+  );
+  assert.equal(
+    /stalled-tool watchdog/.test(
+      bash.parameters?.properties?.timeout?.description ?? "",
+    ),
+    true,
+    "the GSD bash timeout schema must name the stalled-tool watchdog",
+  );
+});
+
+// 3. async_bash guidance frames itself as a non-blocking/background choice and
+//    no longer implies sync bash is time-capped.
+test("async_bash guidance is non-blocking and drops the sync-cap implication", () => {
+  const asyncTool: any = createAsyncBashTool(
+    () => ({ register: () => "job-0" }) as any,
+    () => process.cwd(),
+  );
+  const guidance = (asyncTool.promptGuidelines ?? []).join("\n");
+  assert.equal(
+    /more than a few seconds/.test(guidance),
+    false,
+    "async_bash guidance must not imply sync bash is time-capped",
+  );
+  assert.equal(
+    /non-blocking/.test(guidance),
+    true,
+    "async_bash guidance must describe itself as non-blocking",
+  );
+});
+
+// 4. Behavioral passthrough: an explicitly-set timeout is still honored after
+//    the cap removal. A 1s timeout on a 5s sleep must fire well under 5s.
+test("GSD bash still forwards an explicit timeout (cap removal did not break passthrough)", async () => {
+  const bash = registerAndCaptureBash();
+
+  const start = Date.now();
+  let resultText = "";
+  try {
+    const result: any = await bash.execute(
+      "t1",
+      { command: "sleep 5", timeout: 1 },
+      undefined,
+      undefined,
+      { cwd: process.cwd() },
+    );
+    resultText = JSON.stringify(result ?? "");
+  } catch (err) {
+    resultText = String(err instanceof Error ? err.message : err);
+  }
+  const elapsed = Date.now() - start;
+
+  assert.equal(
+    /timed out|timeout|exited with code|force-killed/i.test(resultText),
+    true,
+    `explicit 1s timeout should fire before the 5s sleep completes; got: ${resultText}`,
+  );
+  assert.ok(
+    elapsed < 4500,
+    `explicit timeout should fire quickly, not run to completion (elapsed ${elapsed}ms)`,
+  );
+});

package/src/resources/extensions/gsd/tests/engine-hook-contract.test.ts

@@ -0,0 +1,148 @@
+// Engine hook contract: which tool lifecycle hooks fire under which engine,
+// and the consolidated tool-name normalizer seam.
+//
+// 1. Pins the contract arrays (engine-hook-contract.ts) so a change to the
+//    fire matrix is a deliberate, reviewed act.
+// 2. Source-scans register-hooks.ts (in the style of
+//    single-writer-invariant.test.ts) to assert that the concerns documented
+//    as universally mirrored — evidence collection and write-gate (re-)arming —
+//    actually live inside a tool_execution_start handler, not only in the
+//    native-only tool_call handlers.
+// 3. Pins normalizer parity: canonicalHeadlessToolName delegates to
+//    canonicalToolName (strip-only), and canonicalWorkflowToolName adds alias
+//    resolution on top of the same strip.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import {
+  UNIVERSAL_TOOL_HOOKS,
+  NATIVE_ONLY_TOOL_HOOKS,
+  canonicalToolName,
+  canonicalWorkflowToolName,
+} from "../engine-hook-contract.js";
+import { canonicalHeadlessToolName } from "../../../../headless-events.js";
+import { WORKFLOW_TOOL_ALIAS_PAIRS } from "../workflow-tool-surface.js";
+
+test("contract arrays pin the verified fire matrix", () => {
+  assert.deepEqual([...UNIVERSAL_TOOL_HOOKS], ["tool_execution_start", "tool_execution_end"]);
+  assert.deepEqual([...NATIVE_ONLY_TOOL_HOOKS], ["tool_call", "tool_result"]);
+});
+
+// ---------------------------------------------------------------------------
+// Source scan: register-hooks.ts must mirror safety concerns universally
+// ---------------------------------------------------------------------------
+
+const registerHooksSource = readFileSync(
+  join(process.cwd(), "src/resources/extensions/gsd/bootstrap/register-hooks.ts"),
+  "utf8",
+);
+
+/**
+ * Extract the body of every `pi.on("<eventName>", ...)` registration by
+ * scanning balanced parentheses from each registration site.
+ */
+function hookBodies(source: string, eventName: string): string[] {
+  const bodies: string[] = [];
+  const marker = `pi.on("${eventName}"`;
+  let from = 0;
+  for (;;) {
+    const start = source.indexOf(marker, from);
+    if (start < 0) break;
+    let depth = 0;
+    let end = -1;
+    // Scan from pi.on's own opening paren so the whole registration is balanced.
+    for (let i = start + "pi.on".length; i < source.length; i++) {
+      const ch = source[i];
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) {
+          end = i;
+          break;
+        }
+      }
+    }
+    assert.ok(end > start, `unbalanced pi.on("${eventName}") registration`);
+    bodies.push(source.slice(start, end + 1));
+    from = end + 1;
+  }
+  return bodies;
+}
+
+test("tool_execution_start handler mirrors evidence collection and write-gate arming", () => {
+  const bodies = hookBodies(registerHooksSource, "tool_execution_start");
+  assert.ok(bodies.length >= 1, "register-hooks.ts must register a tool_execution_start handler");
+  const merged = bodies.join("\n");
+
+  // Evidence collection: the safety harness records the call on the universal
+  // hook (deduped by toolCallId against the native-only tool_call recording).
+  assert.match(merged, /safetyRecordToolCall\(/);
+  assert.match(merged, /saveEvidenceToDisk\(/);
+
+  // Write-gate (re-)arming: external engines never reach the tool_call
+  // deferApprovalGate path, so the durable pending gate must be armed here.
+  assert.match(merged, /hostWriteGateAdapter\.setPending\(/);
+});
+
+test("mirrored concerns also exist on the native-only tool_call side (dedup pairing)", () => {
+  const bodies = hookBodies(registerHooksSource, "tool_call");
+  assert.ok(bodies.length >= 1, "register-hooks.ts must register tool_call handlers");
+  const merged = bodies.join("\n");
+  assert.match(merged, /safetyRecordToolCall\(/);
+  assert.match(merged, /deferApprovalGate\(/);
+});
+
+test("tool_execution_end handler mirrors error classification and evidence persistence", () => {
+  const bodies = hookBodies(registerHooksSource, "tool_execution_end");
+  assert.ok(bodies.length >= 1, "register-hooks.ts must register a tool_execution_end handler");
+  const merged = bodies.join("\n");
+  assert.match(merged, /recordToolInvocationError\(/);
+  assert.match(merged, /safetyRecordToolResult\(/);
+});
+
+// ---------------------------------------------------------------------------
+// Normalizer parity
+// ---------------------------------------------------------------------------
+
+test("canonicalHeadlessToolName matches canonicalToolName on the edge-case table", () => {
+  const cases: Array<{ input: string; expected: string }> = [
+    { input: "mcp__server__tool", expected: "tool" },
+    { input: "mcp__gsd-workflow__gsd_status", expected: "gsd_status" },
+    { input: "plain", expected: "plain" },
+    { input: "ask_user_questions", expected: "ask_user_questions" },
+    // Nested underscores: only the first server/tool delimiter splits.
+    { input: "mcp__s__a__b", expected: "a__b" },
+    { input: "", expected: "" },
+    { input: "mcp__", expected: "mcp__" },
+    // Malformed names stay unchanged (strict parser: empty server/tool → no strip).
+    { input: "mcp____tool", expected: "mcp____tool" },
+    { input: "mcp__server__", expected: "mcp__server__" },
+  ];
+  for (const { input, expected } of cases) {
+    assert.equal(canonicalToolName(input), expected, `canonicalToolName(${JSON.stringify(input)})`);
+    assert.equal(
+      canonicalHeadlessToolName(input),
+      canonicalToolName(input),
+      `headless/strip parity for ${JSON.stringify(input)}`,
+    );
+  }
+  assert.equal(canonicalHeadlessToolName(undefined), "");
+});
+
+test("canonicalWorkflowToolName = prefix strip + workflow alias resolution", () => {
+  // Non-alias names behave exactly like canonicalToolName.
+  for (const name of ["mcp__server__tool", "plain", "mcp__s__a__b"]) {
+    assert.equal(canonicalWorkflowToolName(name), canonicalToolName(name));
+  }
+  // Alias names additionally resolve to the canonical workflow tool.
+  assert.ok(WORKFLOW_TOOL_ALIAS_PAIRS.length > 0, "expected at least one workflow alias");
+  for (const { alias, canonical } of WORKFLOW_TOOL_ALIAS_PAIRS) {
+    assert.equal(canonicalWorkflowToolName(alias), canonical);
+    assert.equal(canonicalWorkflowToolName(`mcp__gsd-workflow__${alias}`), canonical);
+    // Plain strip must NOT resolve aliases — that distinction is the seam.
+    assert.equal(canonicalToolName(alias), alias);
+  }
+});

package/src/resources/extensions/gsd/tests/evidence-xref-gsd-exec.test.ts

@@ -0,0 +1,157 @@
+// Project/App: gsd-pi
+// File Purpose: Regression tests for evidence cross-referencing of gsd_exec /
+// gsd_uat_exec tool calls. Mirrors the live false-positive where an
+// execute-task agent ran its verification commands through gsd_exec (script
+// body in the `script` argument) and the cross-referencer reported
+// "No bash tool call found" despite successful execution.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  resetEvidence,
+  getEvidence,
+  recordToolCall,
+  recordToolResult,
+  isExecutionToolName,
+  type BashEvidence,
+} from "../safety/evidence-collector.ts";
+import { crossReferenceEvidence } from "../safety/evidence-cross-ref.ts";
+
+function gsdExecResult(exitCode: number, id = "4858202d-2ed7-4a0a-9ef7-4e159e65da83"): unknown {
+  return {
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        operation: "gsd_exec",
+        id,
+        runtime: "bash",
+        exit_code: exitCode,
+        signal: null,
+        timed_out: false,
+        duration_ms: 272,
+        stdout_bytes: 592,
+        stderr_bytes: 0,
+        meta_path: `/tmp/does-not-exist/.gsd/exec/${id}.meta.json`,
+      }),
+    }],
+  };
+}
+
+test("evidence-xref: verification run through gsd_exec script matches the claimed command", () => {
+  resetEvidence();
+
+  // The live false positive: agent runs `node --test tests/verify-s01.test.js`
+  // inside a gsd_exec script with a cd prefix and exit-code echo suffix.
+  recordToolCall("tc-exec-1", "gsd_exec", {
+    script: 'cd /work/.gsd/worktrees/M001 && node --test tests/verify-s01.test.js; echo "EXIT=$?"',
+    purpose: "T02: run node --test contract checks against T01 index.html",
+  });
+  recordToolResult("tc-exec-1", "gsd_exec", gsdExecResult(0), false);
+
+  const mismatches = crossReferenceEvidence(
+    [{ command: "node --test tests/verify-s01.test.js", exitCode: 0, verdict: "passed" }],
+    getEvidence(),
+  );
+
+  assert.deepEqual(mismatches, [], "gsd_exec-executed verification must not be flagged as missing");
+});
+
+test("evidence-xref: multi-line gsd_exec script matches claims for each embedded command", () => {
+  resetEvidence();
+
+  recordToolCall("tc-exec-2", "gsd_exec", {
+    script: [
+      "cd /work/.gsd/worktrees/M001",
+      "sed -i '' \"s/'todos'/'tasks-v1'/\" index.html",
+      "node --test tests/verify-s01.test.js > /dev/null 2>&1",
+      'echo "BROKEN_EXIT=$?"',
+    ].join("\n"),
+    purpose: "T02: deliberate contract break must fail, then restore",
+  });
+  recordToolResult("tc-exec-2", "gsd_exec", gsdExecResult(0), false);
+
+  const mismatches = crossReferenceEvidence(
+    [{ command: "node --test tests/verify-s01.test.js > /dev/null 2>&1", exitCode: 0, verdict: "passed" }],
+    getEvidence(),
+  );
+
+  assert.deepEqual(mismatches, [], "command embedded in a multi-line script must match");
+});
+
+test("evidence-xref: claimed pass with failing gsd_exec exit_code is still an error", () => {
+  resetEvidence();
+
+  recordToolCall("tc-exec-3", "gsd_exec", {
+    script: "node --test tests/verify-s01.test.js",
+    purpose: "verification",
+  });
+  // gsd_exec reports failures via the JSON envelope's exit_code (and isError).
+  recordToolResult("tc-exec-3", "gsd_exec", gsdExecResult(1), true);
+
+  const mismatches = crossReferenceEvidence(
+    [{ command: "node --test tests/verify-s01.test.js", exitCode: 0, verdict: "passed" }],
+    getEvidence(),
+  );
+
+  assert.equal(mismatches.length, 1);
+  assert.equal(mismatches[0].severity, "error");
+  assert.match(mismatches[0].reason, /Claimed exitCode=0 but actual exitCode=1/);
+});
+
+test("evidence-collector: gsd_uat_exec and MCP-namespaced variants are execution tools", () => {
+  assert.equal(isExecutionToolName("gsd_uat_exec"), true);
+  assert.equal(isExecutionToolName("mcp__gsd-workflow__gsd_uat_exec"), true);
+  assert.equal(isExecutionToolName("mcp__gsd-workflow__gsd_exec"), true);
+
+  resetEvidence();
+  recordToolCall("tc-uat-1", "gsd_uat_exec", { script: "curl -fsS http://localhost:3000/health" });
+  const bash = getEvidence().filter((e): e is BashEvidence => e.kind === "bash");
+  assert.equal(bash.length, 1, "gsd_uat_exec must record bash evidence");
+  assert.equal(bash[0].command, "curl -fsS http://localhost:3000/health");
+});
+
+test("evidence-xref: blank-command evidence does not satisfy arbitrary claims", () => {
+  // Before script extraction existed, gsd_exec calls were recorded with
+  // command: "" — and `"x".includes("")` made them match every claim,
+  // masking genuine fabrications. Blank entries must never match.
+  const mismatches = crossReferenceEvidence(
+    [{ command: "node --test tests/verify-s01.test.js", exitCode: 0, verdict: "passed" }],
+    [{
+      kind: "bash",
+      toolCallId: "tc-blank",
+      command: "",
+      exitCode: 0,
+      outputSnippet: "",
+      timestamp: 1,
+    }],
+  );
+
+  assert.equal(mismatches.length, 1);
+  assert.equal(mismatches[0].severity, "warning");
+  assert.match(mismatches[0].reason, /No bash tool call found/);
+});
+
+test("evidence-collector: exit code falls back to .gsd/exec meta.json when result text omits it", (t) => {
+  const dir = mkdtempSync(join(tmpdir(), "gsd-exec-meta-"));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+
+  const metaPath = join(dir, "run-1.meta.json");
+  writeFileSync(metaPath, JSON.stringify({ id: "run-1", exit_code: 7 }));
+
+  resetEvidence();
+  recordToolCall("tc-meta-1", "gsd_exec", { script: "exit 7" });
+  // Truncated result: meta_path survives but exit_code was cut off.
+  recordToolResult(
+    "tc-meta-1",
+    "gsd_exec",
+    { content: [{ type: "text", text: `{"operation":"gsd_exec","meta_path":${JSON.stringify(metaPath)}` }] },
+    false,
+  );
+
+  const bash = getEvidence().filter((e): e is BashEvidence => e.kind === "bash");
+  assert.equal(bash[0].exitCode, 7, "exit code must be recovered from meta.json");
+});

package/src/resources/extensions/gsd/tests/exec-graceful-kill.test.ts

@@ -0,0 +1,193 @@
+// Project/App: gsd-pi
+// File Purpose: Deterministic timing tests for the exec-sandbox graceful-kill
+// ladder + hard-deadline force-resolve (S04/T02).
+//
+// T01 extended runExecSandbox's timeout path to a graceful
+// SIGTERM -> grace -> SIGKILL ladder (via killProcessTree) plus a caller-side
+// force-resolve hard deadline so a non-closing ("D-state") child can never hang
+// the awaiting promise. A true D-state child is non-portable, so we simulate the
+// exact symptom deterministically:
+//   1. A SIGTERM-cooperative child (trap 'exit 0' TERM) closes promptly on the
+//      first SIGTERM — proving the ladder resolves via `close` well before the
+//      force-resolve deadline.
+//   2. A SIGTERM-ignoring (trap '' TERM) child combined with a LARGE
+//      kill_grace_ms (so SIGKILL never fires in-window) and a SHORT
+//      force_resolve_delay_ms — the only way the promise can settle is the
+//      hard deadline, proving the no-hang guarantee.
+//
+// Unlike the sync bash path (which throws on force-resolve), runExecSandbox
+// always RESOLVES; force-resolve calls finalize(null, "SIGKILL") and preserves
+// timed_out === true so the agent can still distinguish a graceful timeout exit
+// from a forced kill.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { EXEC_DEFAULTS, runExecSandbox, type ExecSandboxOptions } from '../exec-sandbox.ts';
+
+const isWin = process.platform === 'win32';
+
+function freshBase(): string {
+  return mkdtempSync(join(tmpdir(), 'gsd-exec-gracekill-'));
+}
+
+function cleanup(dir: string): void {
+  rmSync(dir, { recursive: true, force: true });
+}
+
+function baseOpts(base: string, overrides: Partial<ExecSandboxOptions> = {}): ExecSandboxOptions {
+  return {
+    baseDir: base,
+    clamp_timeout_ms: EXEC_DEFAULTS.clampTimeoutMs,
+    default_timeout_ms: 10_000,
+    stdout_cap_bytes: 1_024,
+    stderr_cap_bytes: 1_024,
+    digest_chars: 120,
+    env_allowlist: EXEC_DEFAULTS.envAllowlist,
+    ...overrides,
+  };
+}
+
+// Wall-clock guard: reject if the call has not settled by `ms`. Proves no-hang
+// independently of the assertions on timing/markers.
+function wallClockGuard<T>(promise: Promise<T>, ms: number): Promise<T> {
+  return Promise.race([
+    promise,
+    new Promise<never>((_, reject) => {
+      const t = setTimeout(() => reject(new Error(`Call did not settle within ${ms}ms (hang)`)), ms);
+      if (typeof t === 'object' && 'unref' in t) t.unref();
+    }),
+  ]);
+}
+
+// Clean up a detached child (and its process group) that a large kill_grace_ms
+// intentionally leaves alive past the force-resolve deadline.
+function cleanupByPidFile(pidFile: string): void {
+  if (!existsSync(pidFile)) return;
+  const pid = Number.parseInt(readFileSync(pidFile, 'utf-8').trim(), 10);
+  if (!Number.isFinite(pid) || pid <= 0) return;
+  if (isWin) return; // best-effort; test is skipped on win32
+  try {
+    process.kill(-pid, 'SIGKILL');
+  } catch {
+    try {
+      process.kill(pid, 'SIGKILL');
+    } catch {
+      // already gone
+    }
+  }
+}
+
+test(
+  'runExecSandbox: SIGTERM-cooperative child exits promptly within grace on timeout',
+  { skip: isWin ? 'Unix-primary graceful semantics' : false, timeout: 20_000 },
+  async (t) => {
+    const base = freshBase();
+    t.after(() => cleanup(base));
+
+    const KILL_GRACE_MS = 5_000;
+    const FORCE_RESOLVE_DELAY_MS = 8_000; // grace + hard-deadline; must NOT be reached
+    const TIMEOUT_MS = 300;
+
+    // Child traps SIGTERM and exits 0, then sleeps long. The first SIGTERM from
+    // the ladder ends it immediately -> `close` fires -> finalize via close,
+    // well before the force-resolve deadline.
+    const script = `trap 'exit 0' TERM; sleep 30`;
+
+    const result = await wallClockGuard(
+      runExecSandbox(
+        { runtime: 'bash', script, timeout_ms: TIMEOUT_MS },
+        baseOpts(base, {
+          kill_grace_ms: KILL_GRACE_MS,
+          force_resolve_delay_ms: FORCE_RESOLVE_DELAY_MS,
+        }),
+      ),
+      15_000,
+    );
+
+    // timed_out is preserved even though the child exited cooperatively.
+    assert.equal(result.timed_out, true, 'timeout fired so timed_out must be true');
+    // Proves SIGTERM (close) resolved it, NOT the force-resolve deadline:
+    // a force-resolve would land at ~TIMEOUT_MS + FORCE_RESOLVE_DELAY_MS (~8.3s).
+    assert.ok(
+      result.duration_ms < KILL_GRACE_MS,
+      `expected prompt close well under grace (${KILL_GRACE_MS}ms), got ${result.duration_ms}ms`,
+    );
+    // A clean SIGTERM-trapped exit resolves via `close` with an exit code,
+    // not the force-resolve sentinel (exit_code null / signal SIGKILL).
+    assert.notEqual(
+      result.signal,
+      'SIGKILL',
+      'cooperative child must not be force-resolved as SIGKILL',
+    );
+    assert.equal(result.force_resolved, false, 'a cooperative close must not be flagged as force-resolved');
+  },
+);
+
+test(
+  'runExecSandbox: SIGTERM-ignoring (non-closing) child force-resolves via hard deadline without hanging',
+  { skip: isWin ? 'Unix-primary graceful semantics; force-resolve covered on POSIX' : false, timeout: 20_000 },
+  async (t) => {
+    const base = freshBase();
+    const pidFile = join(base, 'child.pid');
+    t.after(() => {
+      cleanupByPidFile(pidFile);
+      cleanup(base);
+    });
+
+    // Timing seams: SIGKILL never fires in-window (grace huge), so the only way
+    // the promise can settle is the hard deadline -> proves the caller-side
+    // force-resolve.
+    const KILL_GRACE_MS = 30_000;
+    const FORCE_RESOLVE_DELAY_MS = 800;
+    // Generous timeout so the SIGTERM trap is reliably installed before the kill
+    // fires, even under heavy parallel test load. A too-tight timeout can race
+    // the shell's startup: the kill lands before `trap '' TERM` runs, SIGTERM
+    // takes its default action, the child closes on SIGTERM, and the
+    // force-resolve path never runs (flaky 'SIGTERM' instead of 'SIGKILL').
+    const TIMEOUT_MS = 1_500;
+
+    // Install the SIGTERM trap FIRST (before any other command) so the shell is
+    // already immune by the time the kill fires; then record the detached
+    // shell's PID (process-group leader) for cleanup. The shell loops forever
+    // holding its stdout pipe open -> `close` never fires in-window -> the
+    // caller's hard deadline must force-resolve.
+    const script = `trap '' TERM; echo $$ > '${pidFile}'; while true; do sleep 1; done`;
+
+    const start = Date.now();
+    const result = await wallClockGuard(
+      runExecSandbox(
+        { runtime: 'bash', script, timeout_ms: TIMEOUT_MS },
+        baseOpts(base, {
+          kill_grace_ms: KILL_GRACE_MS,
+          force_resolve_delay_ms: FORCE_RESOLVE_DELAY_MS,
+        }),
+      ),
+      8_000,
+    );
+    const elapsed = Date.now() - start;
+
+    // (a) Did not hang and settled well before the SIGKILL grace would fire.
+    assert.ok(
+      elapsed < KILL_GRACE_MS,
+      `expected force-resolve before SIGKILL grace (${KILL_GRACE_MS}ms), took ${elapsed}ms`,
+    );
+    // (b) Settled in the force-resolve band: >= timeout (kill initiated) and
+    //     roughly timeout + force_resolve_delay (generous CI slack, but kept below
+    //     the 8000ms wallClockGuard so the upper bound is actually reachable).
+    assert.ok(
+      elapsed >= TIMEOUT_MS && elapsed <= TIMEOUT_MS + FORCE_RESOLVE_DELAY_MS + 4_000,
+      `expected settle near ${TIMEOUT_MS + FORCE_RESOLVE_DELAY_MS}ms, took ${elapsed}ms`,
+    );
+    // (c) Force-resolve preserves timed_out and surfaces the SIGKILL sentinel
+    //     (exit_code null) plus the explicit force_resolved flag, so the agent can
+    //     tell a forced kill (D-state hard deadline) from a clean SIGKILL exit.
+    assert.equal(result.timed_out, true, 'force-resolve must preserve timed_out');
+    assert.equal(result.exit_code, null, 'force-resolve exit_code must be null');
+    assert.equal(result.signal, 'SIGKILL', 'force-resolve must mark signal SIGKILL');
+    assert.equal(result.force_resolved, true, 'force-resolve must set force_resolved=true');
+  },
+);

package/src/resources/extensions/gsd/tests/exec-tool.test.ts

@@ -2,7 +2,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 
 import { registerExecTools } from "../bootstrap/exec-tools.ts";
-import { executeUatExec } from "../tools/exec-tool.ts";
+import { executeGsdExec, executeUatExec } from "../tools/exec-tool.ts";
 import type { ExecSandboxRequest, ExecSandboxResult } from "../exec-sandbox.ts";
 
 function makeExecResult(request: ExecSandboxRequest): ExecSandboxResult {
@@ -12,6 +12,7 @@ function makeExecResult(request: ExecSandboxRequest): ExecSandboxResult {
     exit_code: 0,
     signal: null,
     timed_out: false,
+    force_resolved: false,
     duration_ms: 1,
     stdout_bytes: 12,
     stderr_bytes: 0,
@@ -51,6 +52,33 @@ test("executeUatExec accepts evidence-mode aliases for intent", async () => {
   assert.equal(requests[0]?.metadata?.intent, "uat-artifact-check");
 });
 
+test("gsd_exec surfaces a force-resolved (D-state) kill distinctly from a clean exit", async () => {
+  // A hard-deadline force-resolve sets force_resolved=true with a synthetic SIGKILL
+  // signal and null exit code. The tool result must carry that flag in details and
+  // render it as exit=timeout(force-killed) so the agent can tell it apart from a
+  // normally-exited or cleanly-timed-out command.
+  const result = await executeGsdExec(
+    { runtime: "bash", script: "sleep 60" },
+    {
+      baseDir: "/tmp/gsd-exec-force-resolved-test",
+      preferences: null,
+      run: async (request) => ({
+        ...makeExecResult(request),
+        exit_code: null,
+        signal: "SIGKILL",
+        timed_out: true,
+        force_resolved: true,
+        digest: "[no stdout \u2014 timed out]",
+      }),
+    },
+  );
+
+  assert.equal(result.isError, true, "a force-resolved kill is an error result");
+  assert.equal(result.details?.force_resolved, true, "details must expose force_resolved");
+  const text = result.content.map((c) => c.text ?? "").join("\n");
+  assert.match(text, /exit=timeout\(force-killed\)/, "summary must distinguish a force-killed result");
+});
+
 test("registerExecTools exposes gsd_uat_exec intent as recoverable string schema", () => {
   const tools: Array<{ name: string; parameters: any }> = [];
   registerExecTools({