@opengsd/gsd-pi 1.4.0 → 1.5.0

package/src/resources/extensions/gsd/tests/redact-secrets.test.ts

@@ -0,0 +1,56 @@
+// redact-secrets.test.ts
+// Verifies secret-shaped substrings are replaced while benign text and JSON
+// structure are preserved.
+//
+// Fake secrets are assembled from fragments at runtime so external secret
+// scanners (GitGuardian) and the repo secret-scan never see a literal
+// secret-shaped string in this source file — the runtime value still matches
+// the redaction patterns, which is what the test exercises.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { redactSecrets } from "../redact-secrets.js";
+
+const PLACEHOLDER = "«redacted»";
+
+// Fragment-built fakes (never a full secret literal in source).
+const FAKE = {
+  github: "gh" + "p_" + "A".repeat(36), // GitHub PAT shape: ghp_ + 36 chars
+  aws: "AKIA" + "IOSFODNN7EXAMPL0", // AWS access key id shape: AKIA + 16 chars
+  anthropic: "sk-" + "ant-" + "x".repeat(28), // Anthropic key shape
+  bearer: "sk-" + "b".repeat(24), // generic sk- token
+};
+
+test("redacts a Bearer authorization token", () => {
+  const out = redactSecrets(`Authorization: Bearer ${FAKE.bearer}`);
+  assert.ok(out.includes("Authorization:"), "keeps the label context");
+  assert.ok(out.includes(PLACEHOLDER), "redacts the token");
+  assert.ok(!out.includes(FAKE.bearer), "raw token is gone");
+});
+
+test("redacts key=value style secrets", () => {
+  const anth = redactSecrets(`ANTHROPIC_API_KEY="${FAKE.anthropic}"`);
+  assert.ok(anth.includes(PLACEHOLDER) && !anth.includes(FAKE.anthropic));
+  const gh = redactSecrets(`"token": "${FAKE.github}"`);
+  assert.ok(gh.includes(PLACEHOLDER) && !gh.includes(FAKE.github));
+});
+
+test("redacts an AWS access key id", () => {
+  const out = redactSecrets(`aws key ${FAKE.aws} in output`);
+  assert.ok(out.includes(PLACEHOLDER) && !out.includes(FAKE.aws));
+});
+
+test("leaves benign text mentioning 'token' untouched", () => {
+  const line = "The token is passed to the next unit for processing.";
+  assert.equal(redactSecrets(line), line);
+});
+
+test("redacting a JSON string keeps it valid JSON", () => {
+  const original = JSON.stringify({ msg: "using key=SECRETVALUE here", auth: FAKE.github });
+  const redacted = redactSecrets(original);
+  // Must still parse.
+  const parsed = JSON.parse(redacted) as { msg: string; auth: string };
+  // The bare GitHub token is redacted; the non-keyword "key=..." stays (no false structure break).
+  assert.ok(!redacted.includes(FAKE.github));
+  assert.equal(parsed.auth, PLACEHOLDER);
+});

package/src/resources/extensions/gsd/tests/register-hooks-flat-phase-migration.test.ts

@@ -0,0 +1,73 @@
+// Project/App: gsd-pi
+// File Purpose: Verifies session bootstrap fails closed when flat-phase migration cannot complete.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { registerHooks } from "../bootstrap/register-hooks.ts";
+import { closeDatabase, insertMilestone, openDatabase } from "../gsd-db.ts";
+
+type HookHandler = (event: unknown, ctx: any) => Promise<void> | void;
+
+function createSessionStartHandler(): HookHandler {
+  const handlers = new Map<string, HookHandler>();
+  const pi = {
+    on(event: string, handler: HookHandler) {
+      handlers.set(event, handler);
+    },
+  };
+
+  registerHooks(pi as any, []);
+  const sessionStart = handlers.get("session_start");
+  assert.ok(sessionStart, "session_start handler should be registered");
+  return sessionStart;
+}
+
+function makeContext(basePath: string) {
+  return {
+    cwd: basePath,
+    hasUI: false,
+    ui: {
+      notify: () => {},
+      setStatus: () => {},
+      setWidget: () => {},
+      setWorkingMessage: () => {},
+      onTerminalInput: () => () => {},
+    },
+    model: null,
+    modelRegistry: {
+      setDisabledModelProviders: () => {},
+    },
+    sessionManager: {
+      getSessionId: () => null,
+    },
+    setCompactionThresholdOverride: () => {},
+  };
+}
+
+test("session_start rejects when required flat-phase migration fails", async (t) => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-bootstrap-flat-migration-"));
+  t.after(() => {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  writeFileSync(join(base, ".gsd", "milestones", "M001", "M001-CONTEXT.md"), "# M001: Foundation\n", "utf-8");
+  openDatabase(join(base, ".gsd", "gsd.db"));
+  insertMilestone({ id: "M001", title: "Foundation", status: "active" });
+  closeDatabase();
+
+  writeFileSync(join(base, ".gsd-backups"), "not a directory\n", "utf-8");
+
+  const sessionStart = createSessionStartHandler();
+
+  await assert.rejects(
+    () => Promise.resolve(sessionStart({}, makeContext(base))),
+    /flat-phase migration/,
+  );
+  assert.ok(existsSync(join(base, ".gsd", "milestones", "M001")), "legacy layout should remain for recovery");
+});

package/src/resources/extensions/gsd/tests/register-hooks-loop-guard-auto.test.ts

@@ -1,14 +1,22 @@
 import test from "node:test";
 import assert from "node:assert/strict";
+import { mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
 
 import { autoSession } from "../auto-runtime-state.ts";
 import { registerHooks } from "../bootstrap/register-hooks.ts";
 import { resetToolCallLoopGuard } from "../bootstrap/tool-call-loop-guard.ts";
+import { readUnitHarnessAbort } from "../unit-runtime.ts";
 
 type Handler = (event: any, ctx?: any) => Promise<any> | any;
 
 function makeHookHarness(): {
   emitToolCall: (toolName: string, input: Record<string, unknown>) => Promise<any>;
+  emitToolResult: (event: Record<string, unknown>) => Promise<void>;
+  emitToolExecutionEnd: (event: Record<string, unknown>) => Promise<void>;
+  emitAgentEnd: (event: Record<string, unknown>) => Promise<void>;
 } {
   const handlers = new Map<string, Handler[]>();
   const pi = {
@@ -33,9 +41,38 @@ function makeHookHarness(): {
       assert.ok(loopGuardHandler, "loop-guard tool_call handler should be registered");
       return loopGuardHandler({ toolCallId: `loop-${callId}`, toolName, input }, ctx);
     },
+    async emitToolResult(event: Record<string, unknown>): Promise<void> {
+      callId += 1;
+      for (const handler of handlers.get("tool_result") ?? []) {
+        await handler({
+          toolCallId: `result-${callId}`,
+          ...event,
+        }, ctx);
+      }
+    },
+    async emitToolExecutionEnd(event: Record<string, unknown>): Promise<void> {
+      callId += 1;
+      for (const handler of handlers.get("tool_execution_end") ?? []) {
+        await handler({
+          toolCallId: `exec-${callId}`,
+          ...event,
+        }, ctx);
+      }
+    },
+    async emitAgentEnd(event: Record<string, unknown>): Promise<void> {
+      for (const handler of handlers.get("agent_end") ?? []) {
+        await handler(event, ctx);
+      }
+    },
   };
 }
 
+function makeRuntimeBase(): string {
+  const base = join(tmpdir(), `gsd-hook-runtime-${randomUUID()}`);
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  return base;
+}
+
 test("register-hooks keeps loop-guard block reason interactive outside auto-mode", async (t) => {
   autoSession.reset();
   resetToolCallLoopGuard();
@@ -101,3 +138,241 @@ test("register-hooks rewrites loop-guard block reason for auto-mode per-tool blo
   assert.match(block.reason, /auto-mode recovery\/replan path/);
   assert.doesNotMatch(block.reason, /respond to the user in text/);
 });
+
+test("register-hooks does not record normal product tool failures as harness aborts", async (t) => {
+  const base = makeRuntimeBase();
+  const startedAt = Date.now();
+  autoSession.reset();
+  resetToolCallLoopGuard();
+  autoSession.active = true;
+  autoSession.basePath = base;
+  autoSession.currentUnit = { type: "gate-evaluate", id: "M001/S01/gates+Q3", startedAt };
+  t.after(() => {
+    autoSession.reset();
+    resetToolCallLoopGuard();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  const { emitToolExecutionEnd } = makeHookHarness();
+  await emitToolExecutionEnd({
+    toolName: "mcp__gsd-workflow__browser_click",
+    isError: true,
+    result: {
+      content: [{ type: "text", text: "Element not found: #submit" }],
+    },
+  });
+
+  const abort = readUnitHarnessAbort(base, "gate-evaluate", "M001/S01/gates+Q3", startedAt);
+  assert.equal(abort, null);
+});
+
+test("register-hooks does not classify normal gsd_uat_exec nonzero exits as harness aborts", async (t) => {
+  const base = makeRuntimeBase();
+  const startedAt = Date.now();
+  autoSession.reset();
+  resetToolCallLoopGuard();
+  autoSession.active = true;
+  autoSession.basePath = base;
+  autoSession.currentUnit = { type: "run-uat", id: "M001/S01", startedAt };
+  t.after(() => {
+    autoSession.reset();
+    resetToolCallLoopGuard();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  const { emitToolExecutionEnd } = makeHookHarness();
+  await emitToolExecutionEnd({
+    toolName: "gsd_uat_exec",
+    isError: true,
+    result: {
+      content: [{ type: "text", text: "gsd_exec[exec-1] runtime=bash exit=1 duration=12ms" }],
+      details: {
+        operation: "gsd_uat_exec",
+        exit_code: 1,
+        aborted: false,
+        force_resolved: false,
+      },
+    },
+  });
+
+  const abort = readUnitHarnessAbort(base, "run-uat", "M001/S01", startedAt);
+  assert.equal(abort, null);
+});
+
+test("register-hooks records exec deadline timeouts as harness aborts", async () => {
+  for (const scenario of [
+    { toolName: "gsd_exec", unitType: "gate-evaluate", unitId: "M001/S01/gates+Q3" },
+    { toolName: "gsd_uat_exec", unitType: "run-uat", unitId: "M001/S01" },
+  ]) {
+    const base = makeRuntimeBase();
+    const startedAt = Date.now();
+    autoSession.reset();
+    resetToolCallLoopGuard();
+    autoSession.active = true;
+    autoSession.basePath = base;
+    autoSession.currentUnit = { type: scenario.unitType, id: scenario.unitId, startedAt };
+
+    try {
+      const { emitToolExecutionEnd } = makeHookHarness();
+      await emitToolExecutionEnd({
+        toolName: scenario.toolName,
+        isError: true,
+        result: {
+          content: [{ type: "text", text: "gsd_exec[exec-timeout] runtime=bash timeout duration=600000ms" }],
+          details: {
+            operation: scenario.toolName,
+            exit_code: null,
+            aborted: false,
+            force_resolved: false,
+            timed_out: true,
+          },
+        },
+      });
+
+      const abort = readUnitHarnessAbort(base, scenario.unitType, scenario.unitId, startedAt);
+      assert.equal(abort?.kind, "tool-error");
+      assert.equal(abort?.toolName, scenario.toolName);
+      assert.match(abort?.reason ?? "", /timeout/);
+    } finally {
+      autoSession.reset();
+      resetToolCallLoopGuard();
+      rmSync(base, { recursive: true, force: true });
+    }
+  }
+});
+
+test("register-hooks preserves retryable harness abort after later successful tools", async (t) => {
+  const base = makeRuntimeBase();
+  const startedAt = Date.now();
+  autoSession.reset();
+  resetToolCallLoopGuard();
+  autoSession.active = true;
+  autoSession.basePath = base;
+  autoSession.currentUnit = { type: "run-uat", id: "M001/S01", startedAt };
+  t.after(() => {
+    autoSession.reset();
+    resetToolCallLoopGuard();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  const { emitToolExecutionEnd, emitToolResult } = makeHookHarness();
+  await emitToolExecutionEnd({
+    toolName: "mcp__gsd-workflow__browser_click",
+    isError: true,
+    result: {
+      content: [{ type: "text", text: "No such tool available: browser_click" }],
+    },
+  });
+
+  const recorded = readUnitHarnessAbort(base, "run-uat", "M001/S01", startedAt);
+  assert.equal(recorded?.kind, "tool-error");
+
+  await emitToolResult({
+    toolName: "read",
+    isError: false,
+    input: { path: "README.md" },
+    result: {
+      content: [{ type: "text", text: "file contents" }],
+    },
+  });
+  assert.equal(
+    readUnitHarnessAbort(base, "run-uat", "M001/S01", startedAt)?.kind,
+    "tool-error",
+    "successful native tool_result must not clear the harness abort",
+  );
+
+  await emitToolExecutionEnd({
+    toolName: "read",
+    isError: false,
+    result: {
+      content: [{ type: "text", text: "file contents" }],
+    },
+  });
+  assert.equal(
+    readUnitHarnessAbort(base, "run-uat", "M001/S01", startedAt)?.kind,
+    "tool-error",
+    "successful universal tool_execution_end must not clear the harness abort",
+  );
+});
+
+test("register-hooks does not record save-tool validation errors as harness aborts", async (t) => {
+  const base = makeRuntimeBase();
+  const startedAt = Date.now();
+  autoSession.reset();
+  resetToolCallLoopGuard();
+  autoSession.active = true;
+  autoSession.basePath = base;
+  autoSession.currentUnit = { type: "run-uat", id: "M001/S01", startedAt };
+  t.after(() => {
+    autoSession.reset();
+    resetToolCallLoopGuard();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  const { emitToolExecutionEnd } = makeHookHarness();
+  await emitToolExecutionEnd({
+    toolName: "gsd_uat_result_save",
+    isError: true,
+    result: {
+      content: [{ type: "text", text: "Error: UAT Assessment requires at least one fresh gsd_uat_exec evidence reference" }],
+      details: { operation: "save_uat_result", error: "uat_missing_fresh_evidence" },
+    },
+  });
+
+  const abort = readUnitHarnessAbort(base, "run-uat", "M001/S01", startedAt);
+  assert.equal(abort, null);
+});
+
+test("register-hooks does not record pending approval hard-blocks as harness aborts", async (t) => {
+  const base = makeRuntimeBase();
+  const startedAt = Date.now();
+  autoSession.reset();
+  resetToolCallLoopGuard();
+  autoSession.active = true;
+  autoSession.basePath = base;
+  autoSession.currentUnit = { type: "gate-evaluate", id: "M001/S01/gates+Q3", startedAt };
+  t.after(() => {
+    autoSession.reset();
+    resetToolCallLoopGuard();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  const { emitToolExecutionEnd } = makeHookHarness();
+  await emitToolExecutionEnd({
+    toolName: "gsd_summary_save",
+    isError: true,
+    result: {
+      content: [{
+        type: "text",
+        text: 'HARD BLOCK: Discussion gate "depth:M001" has not been confirmed by the user.',
+      }],
+    },
+  });
+
+  const abort = readUnitHarnessAbort(base, "gate-evaluate", "M001/S01/gates+Q3", startedAt);
+  assert.equal(abort, null);
+});
+
+test("register-hooks only records agent_end turn aborts for aborted or error stop reasons", async (t) => {
+  const base = makeRuntimeBase();
+  const startedAt = Date.now();
+  autoSession.reset();
+  resetToolCallLoopGuard();
+  autoSession.active = true;
+  autoSession.basePath = base;
+  autoSession.currentUnit = { type: "gate-evaluate", id: "M001/S01/gates+Q3", startedAt };
+  t.after(() => {
+    autoSession.reset();
+    resetToolCallLoopGuard();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  const { emitAgentEnd } = makeHookHarness();
+  await emitAgentEnd({
+    abortOrigin: "auto-context",
+    messages: [{ stopReason: "stop" }],
+  });
+
+  const abort = readUnitHarnessAbort(base, "gate-evaluate", "M001/S01/gates+Q3", startedAt);
+  assert.equal(abort, null);
+});

package/src/resources/extensions/gsd/tests/repository-registry.test.ts

@@ -83,7 +83,7 @@ test("defaultRepositoryTargets returns [project] for a single-repo project regis
   assert.deepEqual(defaultRepositoryTargets(registry), ["project"]);
 });
 
-test("defaultRepositoryTargets returns [project] for a parent-mode registry", (t) => {
+test("defaultRepositoryTargets returns declared child repos for a parent-mode registry", (t) => {
   const base = mkdtempSync(join(tmpdir(), "gsd-repo-registry-"));
   t.after(() => rmSync(base, { recursive: true, force: true }));
   mkdirSync(join(base, ".gsd"), { recursive: true });
@@ -98,7 +98,46 @@ test("defaultRepositoryTargets returns [project] for a parent-mode registry", (t
     },
   });
 
-  assert.deepEqual(defaultRepositoryTargets(registry), ["project"]);
+  assert.deepEqual(defaultRepositoryTargets(registry), ["frontend"]);
+});
+
+test("defaultRepositoryTargets returns all child repos (declaration order) in parent mode", (t) => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-repo-registry-"));
+  t.after(() => rmSync(base, { recursive: true, force: true }));
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  mkdirSync(join(base, "frontend"), { recursive: true });
+  mkdirSync(join(base, "backend"), { recursive: true });
+
+  const registry = createRepositoryRegistryFromPreferences(base, {
+    workspace: {
+      mode: "parent",
+      repositories: {
+        frontend: { path: "frontend" },
+        backend: { path: "backend" },
+      },
+    },
+  });
+
+  assert.deepEqual(defaultRepositoryTargets(registry), ["frontend", "backend"]);
+});
+
+test("defaultRepositoryTargets excludes the implicit project repo in parent mode", (t) => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-repo-registry-"));
+  t.after(() => rmSync(base, { recursive: true, force: true }));
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  mkdirSync(join(base, "frontend"), { recursive: true });
+
+  const registry = createRepositoryRegistryFromPreferences(base, {
+    workspace: {
+      mode: "parent",
+      repositories: {
+        frontend: { path: "frontend" },
+      },
+    },
+  });
+
+  const targets = defaultRepositoryTargets(registry);
+  assert.ok(!targets.includes("project"), "implicit project repo must not be a default target in parent mode");
 });
 
 test("repository registry keeps project root anchored to .gsd project in monorepo subdirectory", (t) => {

package/src/resources/extensions/gsd/tests/require-slice-discussion-dispatch.test.ts

@@ -16,6 +16,13 @@ import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { DISPATCH_RULES, type DispatchContext } from "../auto-dispatch.ts";
+import {
+  closeDatabase,
+  insertAssessment,
+  insertMilestone,
+  insertSlice,
+  openDatabase,
+} from "../gsd-db.ts";
 import type { GSDState } from "../types.ts";
 import type { GSDPreferences } from "../preferences.ts";
 
@@ -87,6 +94,54 @@ describe("require_slice_discussion dispatch rule (#3454)", () => {
     }
   });
 
+  test("includes prior non-PASS UAT warning when the just-closed slice failed", async () => {
+    const basePath = makeBasePath("prior-fail");
+    const dbDir = mkdtempSync(join(tmpdir(), "gsd-req-slice-db-"));
+    const dbPath = join(dbDir, "test.db");
+    try {
+      openDatabase(dbPath);
+      mkdirSync(join(basePath, ".gsd", "milestones", "M001", "slices", "S02"), { recursive: true });
+
+      insertMilestone({ id: "M001", title: "Test milestone" });
+      insertSlice({ id: "S01", milestoneId: "M001", title: "Completed slice", status: "complete", sequence: 1 });
+      insertSlice({ id: "S02", milestoneId: "M001", title: "Next slice", status: "pending", sequence: 2 });
+
+      const assessmentPath = ".gsd/milestones/M001/slices/S01/S01-ASSESSMENT.md";
+      const assessmentBody = [
+        "---",
+        "verdict: fail",
+        "---",
+        "",
+        "# S01 UAT Assessment",
+      ].join("\n");
+      writeFileSync(join(basePath, assessmentPath), assessmentBody, "utf-8");
+      insertAssessment({
+        path: assessmentPath,
+        milestoneId: "M001",
+        sliceId: "S01",
+        status: "fail",
+        scope: "run-uat",
+        fullContent: assessmentBody,
+      });
+
+      const prefs = { phases: { require_slice_discussion: true } } as unknown as GSDPreferences;
+      const state = buildState({ activeSlice: { id: "S02", title: "Next slice" } });
+      const action = await findRule().match(buildCtx(basePath, prefs, state));
+
+      assert.ok(action, "rule must still pause for discussion");
+      assert.strictEqual(action!.action, "stop");
+      if (action!.action === "stop") {
+        assert.match(action!.reason, /S02 requires discussion/);
+        assert.match(action!.reason, /slice just closed \(S01\)/);
+        assert.match(action!.reason, /non-PASS UAT verdict \(FAIL\)/);
+      }
+    } finally {
+      closeDatabase();
+      rmSync(basePath, { recursive: true, force: true });
+      rmSync(dbDir, { recursive: true, force: true });
+    }
+  });
+
   // ─── Negative cases: rule falls through ───────────────────────────────
 
   test("falls through (null) when preference is disabled", async () => {

package/src/resources/extensions/gsd/tests/root-write-leak-guard.test.ts

@@ -3,11 +3,11 @@
 
 import test from "node:test";
 import assert from "node:assert/strict";
-import { closeSync, ftruncateSync, openSync, statSync, writeFileSync } from "node:fs";
+import { closeSync, ftruncateSync, openSync, statSync } from "node:fs";
 import { join } from "node:path";
 
-import { captureRootDirtySnapshot } from "../root-write-leak-guard.ts";
-import { cleanup, createFile, git, makeTempRepo } from "./test-utils.ts";
+import { captureRootDirtySnapshot, detectRootWriteLeak } from "../root-write-leak-guard.ts";
+import { cleanup, createFile, makeTempRepo } from "./test-utils.ts";
 
 test("captureRootDirtySnapshot ignores unignored GSD root runtime directories", () => {
   const base = makeTempRepo("gsd-root-dirty-runtime-");
@@ -34,11 +34,7 @@ test("captureRootDirtySnapshot does not read dirty files larger than Node's Buff
     const relPath = "large.bin";
     const absPath = join(base, relPath);
 
-    writeFileSync(absPath, "tracked\n", "utf-8");
-    git(base, "add", relPath);
-    git(base, "commit", "-m", "track large fixture");
-
-    const fd = openSync(absPath, "r+");
+    const fd = openSync(absPath, "w");
     try {
       ftruncateSync(fd, 2_200 * 1024 * 1024);
     } finally {
@@ -51,9 +47,35 @@ test("captureRootDirtySnapshot does not read dirty files larger than Node's Buff
     const snapshot = captureRootDirtySnapshot(base);
     const entry = snapshot.get(relPath);
 
-    assert.equal(entry?.status, "M");
+    assert.equal(entry?.status, "??");
     assert.match(entry?.fingerprint ?? "", /^large:\d+:/);
   } finally {
     cleanup(base);
   }
 });
+
+test("detectRootWriteLeak reports changed baseline untracked root files", () => {
+  const base = makeTempRepo("gsd-root-dirty-baseline-");
+  try {
+    const relPath = "notes/todo.md";
+    createFile(base, relPath, "before\n");
+    const before = captureRootDirtySnapshot(base);
+
+    createFile(base, relPath, "after\n");
+    const leak = detectRootWriteLeak({
+      rootPath: base,
+      worktreePath: join(base, ".gsd", "worktrees", "M001"),
+      unitType: "execute-task",
+      unitId: "M001/S01/T01",
+      before,
+    });
+
+    assert.ok(leak, "changed baseline untracked file should be reported as a leak");
+    assert.deepEqual(
+      leak.files.map((file) => file.path),
+      [relPath],
+    );
+  } finally {
+    cleanup(base);
+  }
+});