@opengsd/gsd-pi 1.2.0-dev.fb12b103 → 1.2.0-dev.fbdca60b

package/src/resources/extensions/gsd/tests/workflow-tool-executors.test.ts

@@ -15,8 +15,11 @@ import {
   upsertRequirement,
   getAllMilestones,
 } from "../gsd-db.ts";
+import { registerAutoWorker } from "../db/auto-workers.ts";
+import { claimMilestoneLease, getMilestoneLease } from "../db/milestone-leases.ts";
 import { deriveState, invalidateStateCache } from "../state.ts";
 import { autoSession } from "../auto-runtime-state.ts";
+import { normalizeRealPath } from "../paths.ts";
 import { markApprovalGateVerified, markDepthVerified, clearDiscussionFlowState, loadWriteGateSnapshot, setPendingGate } from "../bootstrap/write-gate.ts";
 import {
   executeCompleteMilestone,
@@ -94,6 +97,28 @@ function seedMilestone(milestoneId: string, title: string, status = "active"): v
   ).run(milestoneId, title, status, new Date().toISOString());
 }
 
+function validMilestonePlan(milestoneId = "M001"): Parameters<typeof executePlanMilestone>[0] {
+  return {
+    milestoneId,
+    title: "Workflow MCP planning",
+    vision: "Plan milestone over shared executors.",
+    slices: [
+      {
+        sliceId: "S01",
+        title: "Bridge planning",
+        risk: "medium",
+        depends: [],
+        demo: "Milestone plan persists through MCP.",
+        goal: "Persist roadmap state.",
+        successCriteria: "ROADMAP.md renders from DB.",
+        proofLevel: "integration",
+        integrationClosure: "Prompts and MCP call the same handler.",
+        observabilityImpact: "Executor tests cover output paths.",
+      },
+    ],
+  };
+}
+
 function seedSlice(milestoneId: string, sliceId: string, status: string): void {
   const db = _getAdapter();
   if (!db) throw new Error("DB not open");
@@ -461,25 +486,7 @@ test("executePlanMilestone writes roadmap state and rendered roadmap path", asyn
   try {
     openTestDb(base);
 
-    const result = await inProjectDir(base, () => executePlanMilestone({
-      milestoneId: "M001",
-      title: "Workflow MCP planning",
-      vision: "Plan milestone over shared executors.",
-      slices: [
-        {
-          sliceId: "S01",
-          title: "Bridge planning",
-          risk: "medium",
-          depends: [],
-          demo: "Milestone plan persists through MCP.",
-          goal: "Persist roadmap state.",
-          successCriteria: "ROADMAP.md renders from DB.",
-          proofLevel: "integration",
-          integrationClosure: "Prompts and MCP call the same handler.",
-          observabilityImpact: "Executor tests cover output paths.",
-        },
-      ],
-    }, base));
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan(), base));
 
     assert.equal(result.details.operation, "plan_milestone");
     assert.equal(result.details.milestoneId, "M001");
@@ -492,29 +499,257 @@ test("executePlanMilestone writes roadmap state and rendered roadmap path", asyn
   }
 });
 
+test("executePlanMilestone refuses a same-milestone lease conflict", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+    seedMilestone("M001", "Existing holder");
+    const holder = registerAutoWorker({ projectRootRealpath: join(base, "other-project") });
+    const lease = claimMilestoneLease(holder, "M001");
+    assert.equal(lease.ok, true);
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M001"), base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details.operation, "plan_milestone");
+    assert.equal(result.details.error, "milestone_lease_conflict");
+    assert.match(result.content[0].text, /Milestone M001 is currently leased/);
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone releases its one-shot milestone lease after planning", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+    seedMilestone("M001", "Existing milestone");
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M001"), base));
+
+    assert.equal(result.isError, undefined);
+    const lease = getMilestoneLease("M001");
+    assert.ok(lease, "planning should participate in milestone lease coordination");
+    assert.equal(lease.status, "released");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone creates a fresh milestone without a one-shot lease", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M042"), base));
+
+    assert.equal(result.isError, undefined);
+    assert.equal(result.details.operation, "plan_milestone");
+    assert.equal(result.details.milestoneId, "M042");
+    assert.equal(getMilestoneLease("M042"), null,
+      "fresh milestone creation must pass through without creating a lease row");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone does not create a placeholder when fresh planning validation fails", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+
+    // handlePlanMilestone rejects empty slice arrays during validation. Fresh
+    // milestone creation must pass through without pre-inserting a leaseable
+    // placeholder row.
+    const invalid = { ...validMilestonePlan("M042"), slices: [] };
+    const result = await inProjectDir(base, () => executePlanMilestone(invalid, base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details.operation, "plan_milestone");
+    const milestones = getAllMilestones();
+    assert.equal(milestones.find(m => m.id === "M042"), undefined,
+      "failed fresh planning must not leave a milestone row behind");
+    assert.equal(getMilestoneLease("M042"), null,
+      "failed fresh planning must not create a lease row");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone does not delete a peer worker's milestone row on lease conflict", async () => {
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+
+    // Simulate a peer worker (different project_root) that has already
+    // created the milestone row and taken its lease. The one-shot executor
+    // must observe the active lease and refuse — without removing the peer's
+    // milestone row or lease. The pre-rollback bug was that
+    // INSERT OR IGNORE's silent no-op was treated as proof of authorship and
+    // the cleanup path then deleted the peer's row.
+    const peer = registerAutoWorker({ projectRootRealpath: join(base, "peer-project") });
+    seedMilestone("M050", "Peer-owned milestone");
+    const peerLease = claimMilestoneLease(peer, "M050");
+    assert.equal(peerLease.ok, true);
+    const peerLeaseToken = peerLease.ok ? peerLease.token : -1;
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M050"), base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details.error, "milestone_lease_conflict");
+    const peerMilestone = getAllMilestones().find(m => m.id === "M050");
+    assert.ok(peerMilestone, "peer milestone row must survive the one-shot conflict path");
+    assert.equal(peerMilestone?.title, "Peer-owned milestone",
+      "peer milestone row must not be clobbered or recreated");
+    const surviving = getMilestoneLease("M050");
+    assert.ok(surviving, "peer lease row must survive");
+    assert.equal(surviving.status, "held", "peer must still hold the lease");
+    assert.equal(surviving.worker_id, peer);
+    assert.equal(surviving.fencing_token, peerLeaseToken,
+      "peer's fencing token must not be incremented by the rejected one-shot");
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone refuses when a foreign active worker holds the lease even while in-process auto is active", async () => {
+  const base = makeTmpBase();
+  autoSession.reset();
+  try {
+    openTestDb(base);
+    seedMilestone("M060", "Foreign-held milestone");
+
+    // In-process auto must still reject a lease held by another worker.
+    const foreign = registerAutoWorker({ projectRootRealpath: join(base, "foreign-project") });
+    const foreignLease = claimMilestoneLease(foreign, "M060");
+    assert.equal(foreignLease.ok, true);
+    const foreignToken = foreignLease.ok ? foreignLease.token : -1;
+
+    const ownAutoWorker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+    autoSession.active = true;
+    autoSession.workerId = ownAutoWorker;
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M060"), base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details.error, "milestone_lease_conflict",
+      "in-process auto must NOT skip lease checks when the lease is held by a different active worker");
+    const surviving = getMilestoneLease("M060");
+    assert.ok(surviving);
+    assert.equal(surviving.status, "held");
+    assert.equal(surviving.worker_id, foreign);
+    assert.equal(surviving.fencing_token, foreignToken,
+      "foreign worker's fencing token must not be incremented by the rejected call");
+  } finally {
+    autoSession.reset();
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone proceeds without re-claiming when in-process auto holds the lease itself", async () => {
+  const base = makeTmpBase();
+  autoSession.reset();
+  try {
+    openTestDb(base);
+    seedMilestone("M070", "Auto-held milestone");
+
+    // In-process auto should not re-claim its own lease and bump its token.
+    const ownAutoWorker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+    const heldLease = claimMilestoneLease(ownAutoWorker, "M070");
+    assert.equal(heldLease.ok, true);
+    const heldToken = heldLease.ok ? heldLease.token : -1;
+    autoSession.active = true;
+    autoSession.workerId = ownAutoWorker;
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M070"), base));
+
+    assert.equal(result.isError, undefined, `auto's own plan-milestone call should succeed: ${result.content?.[0]?.text}`);
+    const surviving = getMilestoneLease("M070");
+    assert.ok(surviving);
+    assert.equal(surviving.status, "held", "auto's lease must still be held after the planning call");
+    assert.equal(surviving.worker_id, ownAutoWorker);
+    assert.equal(surviving.fencing_token, heldToken,
+      "auto's fencing token must not be incremented by an in-process plan call");
+  } finally {
+    autoSession.reset();
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone refuses a same-process holder when active auto does not own it", async () => {
+  const base = makeTmpBase();
+  autoSession.reset();
+  try {
+    openTestDb(base);
+    seedMilestone("M080", "Same-process holder");
+    const staleWorker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+    const heldLease = claimMilestoneLease(staleWorker, "M080");
+    assert.equal(heldLease.ok, true);
+    const heldToken = heldLease.ok ? heldLease.token : -1;
+
+    autoSession.active = true;
+    autoSession.workerId = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M080"), base));
+
+    assert.equal(result.isError, true);
+    assert.equal(result.details?.error, "milestone_lease_conflict");
+    const surviving = getMilestoneLease("M080");
+    assert.ok(surviving, "same-process holder lease must remain after conflict");
+    assert.equal(surviving.worker_id, staleWorker);
+    assert.equal(surviving.fencing_token, heldToken);
+    assert.equal(surviving.status, "held");
+  } finally {
+    autoSession.reset();
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
+test("executePlanMilestone takes over a stale same-process lease via reentry instead of waiting for TTL", async () => {
+  const base = makeTmpBase();
+  autoSession.reset();
+  try {
+    openTestDb(base);
+    seedMilestone("M080", "Stale-locked milestone");
+
+    // One-shot planning should reach claimMilestoneLease so its same-process
+    // reentry clause can recover stale worker rows.
+    const staleWorker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(base) });
+    const staleLease = claimMilestoneLease(staleWorker, "M080");
+    assert.equal(staleLease.ok, true);
+    const staleToken = staleLease.ok ? staleLease.token : -1;
+
+    const result = await inProjectDir(base, () => executePlanMilestone(validMilestonePlan("M080"), base));
+
+    assert.equal(result.isError, undefined,
+      `same-process reentry takeover must succeed, not return milestone_lease_conflict: ${result.content?.[0]?.text}`);
+    const after = getMilestoneLease("M080");
+    assert.ok(after, "lease row must remain after takeover + release");
+    assert.equal(after.status, "released", "the executor releases its own claim before returning");
+    assert.notEqual(after.worker_id, staleWorker,
+      "lease must be owned by the new worker after takeover");
+    assert.ok(after.fencing_token > staleToken,
+      `fencing token must monotonically advance on takeover (was ${staleToken}, now ${after.fencing_token})`);
+  } finally {
+    autoSession.reset();
+    closeDatabase();
+    cleanup(base);
+  }
+});
+
 test("executePlanSlice writes task planning state and rendered plan artifacts", async () => {
   const base = makeTmpBase();
   try {
     openTestDb(base);
-    await inProjectDir(base, () => executePlanMilestone({
-      milestoneId: "M001",
-      title: "Workflow MCP planning",
-      vision: "Plan milestone over shared executors.",
-      slices: [
-        {
-          sliceId: "S01",
-          title: "Bridge planning",
-          risk: "medium",
-          depends: [],
-          demo: "Milestone plan persists through MCP.",
-          goal: "Persist roadmap state.",
-          successCriteria: "ROADMAP.md renders from DB.",
-          proofLevel: "integration",
-          integrationClosure: "Prompts and MCP call the same handler.",
-          observabilityImpact: "Executor tests cover output paths.",
-        },
-      ],
-    }, base));
+    await inProjectDir(base, () => executePlanMilestone(validMilestonePlan(), base));
 
     const result = await inProjectDir(base, () => executePlanSlice({
       milestoneId: "M001",

package/src/resources/extensions/gsd/tests/worktree-health-dispatch.test.ts

@@ -15,7 +15,7 @@ import { tmpdir } from "node:os";
 import { execSync } from "node:child_process";
 
 import { PROJECT_FILES, classifyProject } from "../detection.js";
-import { _shouldProceedWithInvalidRepoClassificationForTest } from "../auto/phases.ts";
+import { _shouldProceedWithInvalidRepoClassificationForTest } from "../auto/unit-phase.ts";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 

package/src/resources/extensions/gsd/tests/worktree-project-root-degrade.test.ts

@@ -3,7 +3,7 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
 
-import { shouldDegradeEmptyWorktreeToProjectRoot } from "../auto/phases.ts";
+import { shouldDegradeEmptyWorktreeToProjectRoot } from "../auto/worktree-safety-phase.ts";
 import type { ProjectClassification } from "../detection.ts";
 
 function classification(kind: ProjectClassification["kind"]): ProjectClassification {

package/src/resources/extensions/gsd/tests/worktree-safety-phase.test.ts

@@ -0,0 +1,100 @@
+// Project/App: gsd-pi
+// File Purpose: Regression tests for source-write worktree safety phase behavior.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { AutoSession } from "../auto/session.ts";
+import { validateSourceWriteWorktreeSafety } from "../auto/worktree-safety-phase.ts";
+import { closeDatabase, insertMilestone, openDatabase } from "../gsd-db.ts";
+import { registerAutoWorker } from "../db/auto-workers.ts";
+import { claimMilestoneLease, getMilestoneLease, releaseMilestoneLease } from "../db/milestone-leases.ts";
+
+function runGit(args: string[], cwd: string): void {
+  execFileSync("git", args, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+}
+
+test("source-write safety reclaims a released milestone lease for resumed branch sessions", async () => {
+  const projectRoot = mkdtempSync(join(tmpdir(), "gsd-wt-safety-reclaim-"));
+  const previousCwd = process.cwd();
+  const notifications: string[] = [];
+  const stopReasons: string[] = [];
+
+  try {
+    mkdirSync(join(projectRoot, ".gsd"), { recursive: true });
+    runGit(["init", "-b", "auto/M001"], projectRoot);
+    runGit(["config", "user.email", "test@example.com"], projectRoot);
+    runGit(["config", "user.name", "Test User"], projectRoot);
+    process.chdir(projectRoot);
+
+    openDatabase(join(projectRoot, ".gsd", "gsd.db"));
+    insertMilestone({ id: "M001", title: "Milestone 1", status: "active" });
+
+    const priorWorkerId = registerAutoWorker({ projectRootRealpath: projectRoot });
+    const priorLease = claimMilestoneLease(priorWorkerId, "M001");
+    assert.equal(priorLease.ok, true);
+    if (!priorLease.ok) return;
+    assert.equal(releaseMilestoneLease(priorWorkerId, "M001", priorLease.token), true);
+
+    const resumedWorkerId = registerAutoWorker({ projectRootRealpath: projectRoot });
+    const session = new AutoSession();
+    session.basePath = projectRoot;
+    session.originalBasePath = projectRoot;
+    session.currentMilestoneId = null;
+    session.workerId = resumedWorkerId;
+    session.milestoneLeaseToken = null;
+
+    const result = await validateSourceWriteWorktreeSafety(
+      {
+        ctx: {
+          ui: {
+            notify(message: string) {
+              notifications.push(message);
+            },
+          },
+        },
+        pi: {},
+        s: session,
+        deps: {
+          getIsolationMode: () => "branch",
+          autoWorktreeBranch: () => "auto/M001",
+          stopAuto: async (_ctx: unknown, _pi: unknown, reason?: string) => {
+            if (reason) stopReasons.push(reason);
+          },
+        },
+        prefs: undefined,
+        iteration: 1,
+        flowId: "flow-1",
+        nextSeq: () => 1,
+      } as any,
+      "execute-task",
+      "M001/S01/T01",
+      "M001",
+      "resume-pre-dispatch",
+    );
+
+    assert.equal(result, null);
+    assert.equal(session.currentMilestoneId, "M001");
+    assert.equal(session.milestoneLeaseToken, priorLease.token + 1);
+    const lease = getMilestoneLease("M001");
+    assert.equal(lease?.worker_id, resumedWorkerId);
+    assert.equal(lease?.status, "held");
+    assert.equal(stopReasons.length, 0);
+    assert.equal(notifications.length, 0);
+  } finally {
+    try {
+      closeDatabase();
+    } catch {
+      /* noop */
+    }
+    process.chdir(previousCwd);
+    rmSync(projectRoot, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/worktree-safety.test.ts

@@ -176,6 +176,54 @@ describe("Worktree Safety module", () => {
     assert.equal(result.branch, "milestone/M001");
   });
 
+  test("rejects non-project root for source-writing Unit when isolation mode is branch", () => {
+    const safety = createWorktreeSafetyModule({
+      existsSync: () => true,
+      lstatSync: () => ({ isFile: () => true }),
+      listRegisteredWorktrees: () => [{ path: unitRoot, branch: "milestone/M001" }],
+    });
+
+    const result = safety.validateUnitRoot({
+      unitType: "execute-task",
+      unitId: "M001/S01/T01",
+      writeScope: "source-writing",
+      projectRoot,
+      unitRoot,
+      milestoneId: "M001",
+      isolationMode: "branch",
+    });
+
+    assert.equal(result.ok, false);
+    assert.equal(result.kind, "invalid-root");
+    assert.equal(result.details?.expectedRoot, projectRoot);
+    assert.equal(result.details?.unitRoot, unitRoot);
+  });
+
+  test("rejects branch mismatch for source-writing Unit when isolation mode is branch", () => {
+    const safety = createWorktreeSafetyModule({
+      existsSync: () => true,
+      lstatSync: () => ({ isFile: () => false }),
+      listRegisteredWorktrees: () => [{ path: projectRoot, branch: "main" }],
+      getCurrentBranch: () => "main",
+    });
+
+    const result = safety.validateUnitRoot({
+      unitType: "execute-task",
+      unitId: "M001/S01/T01",
+      writeScope: "source-writing",
+      projectRoot,
+      unitRoot: projectRoot,
+      milestoneId: "M001",
+      isolationMode: "branch",
+      expectedBranch: "milestone/M001",
+    });
+
+    assert.equal(result.ok, false);
+    assert.equal(result.kind, "branch-mismatch");
+    assert.equal(result.details?.branch, "main");
+    assert.equal(result.details?.expectedBranch, "milestone/M001");
+  });
+
   test("rejects non-project root for source-writing Unit when isolation mode is none", () => {
     const safety = createWorktreeSafetyModule({
       existsSync: () => true,
@@ -420,6 +468,30 @@ describe("Worktree Safety module", () => {
     assert.equal(result.kind, "empty-worktree-with-project-content");
   });
 
+  test("rejects a source-writing Unit when the milestone lease is required but not held", () => {
+    const safety = createWorktreeSafetyModule({
+      existsSync: () => true,
+      lstatSync: () => ({ isFile: () => false }),
+      listRegisteredWorktrees: () => [{ path: projectRoot, branch: "main" }],
+      getCurrentBranch: () => "main",
+    });
+
+    const result = safety.validateUnitRoot({
+      unitType: "execute-task",
+      unitId: "M001/S01/T01",
+      writeScope: "source-writing",
+      projectRoot,
+      unitRoot: projectRoot,
+      milestoneId: "M001",
+      isolationMode: "none",
+      lease: { required: true, held: false, owner: "worker-1" },
+    });
+
+    assert.equal(result.ok, false);
+    assert.equal(result.kind, "lease-lost");
+    assert.equal(result.details?.owner, "worker-1");
+  });
+
   test("default adapter proves registered worktree and current branch", (t) => {
     const base = makeBaseRepo();
     t.after(() => rmSync(base, { recursive: true, force: true }));

package/src/resources/extensions/gsd/tests/worktree-teardown-safety.test.ts

@@ -25,6 +25,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { execSync } from "node:child_process";
 import { describe, it, after } from "node:test";
+import assert from "node:assert/strict";
 
 import { createWorktree, removeWorktree, worktreePath, isInsideWorktreesDir } from "../worktree-manager.ts";
 import { createTestContext } from "./test-helpers.ts";
@@ -86,6 +87,27 @@ describe("worktree-teardown-safety", () => {
     );
   });
 
+  it("removeWorktree survives when current working directory was deleted", () => {
+    const tempDir = createTempRepo();
+    dirs.push(tempDir);
+
+    const wt = createWorktree(tempDir, "deleted-cwd");
+    assertTrue(existsSync(wt.path), "worktree created successfully");
+
+    const safeCwd = process.cwd();
+    try {
+      process.chdir(wt.path);
+      rmSync(wt.path, { recursive: true, force: true });
+
+      assert.doesNotThrow(
+        () => removeWorktree(tempDir, "deleted-cwd"),
+        "removeWorktree should not call process.cwd() unguarded from a deleted cwd",
+      );
+    } finally {
+      process.chdir(safeCwd);
+    }
+  });
+
   it("path validation rejects paths outside .gsd/worktrees/", () => {
     const tempDir = createTempRepo();
     dirs.push(tempDir);

package/src/resources/extensions/gsd/tests/worktree.test.ts

@@ -9,6 +9,7 @@ import {
   detectWorktreeName,
   getCurrentBranch,
   getMainBranch,
+  nudgeGitBranchCache,
   getSliceBranchName,
   parseSliceBranch,
   resolveProjectRoot,
@@ -95,6 +96,23 @@ describe('worktree', async () => {
   assert.ok(!SLICE_BRANCH_RE.test("gsd/"), "regex rejects bare gsd/");
   assert.ok(!SLICE_BRANCH_RE.test("worktree/foo"), "regex rejects worktree/foo");
 
+  console.log("\n=== nudgeGitBranchCache deleted cwd ===");
+  {
+    const safeCwd = process.cwd();
+    const deletedCwd = mkdtempSync(join(tmpdir(), "gsd-deleted-cwd-"));
+    try {
+      process.chdir(deletedCwd);
+      rmSync(deletedCwd, { recursive: true, force: true });
+
+      assert.doesNotThrow(
+        () => nudgeGitBranchCache(safeCwd),
+        "nudgeGitBranchCache should not call process.cwd() unguarded from a deleted cwd",
+      );
+    } finally {
+      process.chdir(safeCwd);
+    }
+  }
+
   console.log("\n=== detectWorktreeName ===");
   assert.deepStrictEqual(detectWorktreeName("/projects/myapp"), null, "no worktree in plain path");
   assert.deepStrictEqual(detectWorktreeName("/projects/myapp/.gsd/worktrees/feature-auth"), "feature-auth", "detects worktree name");