gentle-pi 2.3.0 → 2.5.0

package/tests/telemetry-trigger.test.ts

@@ -0,0 +1,349 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { __testing, createGentleAiExtension } from "../extensions/gentle-ai.ts";
+import type { ExecFileAdapter, ExecFileResult } from "../lib/native-review-cli.ts";
+import {
+	decodeTelemetryTriggerDecision,
+	shouldTriggerTelemetry,
+	spawnTelemetryTrigger,
+	TELEMETRY_TRIGGER_CONTRACT,
+	TELEMETRY_TRIGGER_KILL_TIMEOUT_MS,
+	type TelemetryTriggerChildLike,
+	type TelemetryTriggerSpawn,
+	type TelemetryTriggerSpawnOptions,
+} from "../lib/telemetry-trigger.ts";
+
+// ---------------------------------------------------------------------------
+// gentle-pi#677: gentle-ai owns telemetry end to end (gentle-ai#4309); Pi only
+// nudges the local binary once per process. These tests cover the pure
+// predicate/spawn/decode core in lib/telemetry-trigger.ts and the two ways
+// extensions/gentle-ai.ts wires it in: the once-per-process activation nudge
+// and the foreground /gentle:telemetry slash command relay.
+// ---------------------------------------------------------------------------
+
+interface FakeSpawnRecord {
+	command: string;
+	args: string[];
+	options: TelemetryTriggerSpawnOptions;
+}
+
+function fakeSpawn(): { spawn: TelemetryTriggerSpawn; calls: FakeSpawnRecord[]; killCalls: number } {
+	const calls: FakeSpawnRecord[] = [];
+	const state = { killCalls: 0 };
+	const spawn: TelemetryTriggerSpawn = (command, args, options) => {
+		calls.push({ command, args: [...args], options });
+		const child: TelemetryTriggerChildLike = {
+			unref() {
+				return undefined;
+			},
+			kill() {
+				state.killCalls += 1;
+				return true;
+			},
+			on() {
+				return undefined;
+			},
+		};
+		return child;
+	};
+	return {
+		spawn,
+		calls,
+		get killCalls() {
+			return state.killCalls;
+		},
+	};
+}
+
+test("shouldTriggerTelemetry: pure predicate table", () => {
+	const cases: Array<[Record<string, string | undefined>, boolean]> = [
+		[{}, true],
+		[{ DO_NOT_TRACK: "1" }, false],
+		[{ DO_NOT_TRACK: "0" }, true],
+		[{ GENTLE_AI_TELEMETRY: "0" }, false],
+		[{ GENTLE_AI_TELEMETRY: "1" }, true],
+		[{ CI: "true" }, false],
+		[{ CI: "false" }, true],
+		[{ CI: undefined }, true],
+		[{ DO_NOT_TRACK: "1", GENTLE_AI_TELEMETRY: "0", CI: "true" }, false],
+	];
+	for (const [env, expected] of cases) {
+		assert.equal(shouldTriggerTelemetry(env), expected, JSON.stringify(env));
+	}
+});
+
+test("spawnTelemetryTrigger: launches the expected argv, detached and stdio-ignored", () => {
+	const fake = fakeSpawn();
+	const result = spawnTelemetryTrigger({
+		executable: "/opt/gentle-ai/gentle-ai",
+		cwd: "/work/project",
+		env: {},
+		spawn: fake.spawn,
+	});
+	assert.deepEqual(result, { spawned: true, reason: "spawned" });
+	assert.equal(fake.calls.length, 1);
+	const [call] = fake.calls;
+	assert.equal(call.command, "/opt/gentle-ai/gentle-ai");
+	assert.deepEqual(call.args, ["telemetry", "trigger", "--json"]);
+	assert.equal(call.options.cwd, "/work/project");
+	assert.equal(call.options.detached, true);
+	assert.equal(call.options.stdio, "ignore");
+});
+
+test("spawnTelemetryTrigger: never spawns under each kill switch", () => {
+	const switches: Array<[Record<string, string | undefined>, string]> = [
+		[{ DO_NOT_TRACK: "1" }, "do-not-track"],
+		[{ GENTLE_AI_TELEMETRY: "0" }, "telemetry-disabled"],
+		[{ CI: "true" }, "ci"],
+	];
+	for (const [env, reason] of switches) {
+		const fake = fakeSpawn();
+		const result = spawnTelemetryTrigger({ executable: "gentle-ai", cwd: "/work", env, spawn: fake.spawn });
+		assert.deepEqual(result, { spawned: false, reason }, JSON.stringify(env));
+		assert.equal(fake.calls.length, 0, JSON.stringify(env));
+	}
+});
+
+test("spawnTelemetryTrigger: a throwing spawn is swallowed, never thrown", () => {
+	const throwingSpawn: TelemetryTriggerSpawn = () => {
+		throw new Error("spawn EAGAIN");
+	};
+	const result = spawnTelemetryTrigger({ executable: "gentle-ai", cwd: "/work", env: {}, spawn: throwingSpawn });
+	assert.deepEqual(result, { spawned: false, reason: "spawn-error" });
+});
+
+test("spawnTelemetryTrigger: the 3 s kill timer fires exactly once and is unref'd", (t) => {
+	t.mock.timers.enable({ apis: ["setTimeout"] });
+	const fake = fakeSpawn();
+	const result = spawnTelemetryTrigger({ executable: "gentle-ai", cwd: "/work", env: {}, spawn: fake.spawn });
+	assert.equal(result.spawned, true);
+	assert.equal(fake.killCalls, 0);
+	t.mock.timers.tick(TELEMETRY_TRIGGER_KILL_TIMEOUT_MS);
+	assert.equal(fake.killCalls, 1);
+	t.mock.timers.tick(TELEMETRY_TRIGGER_KILL_TIMEOUT_MS);
+	assert.equal(fake.killCalls, 1, "the timer must not fire a second time");
+});
+
+test("decodeTelemetryTriggerDecision: decodes a well-formed v1 payload", () => {
+	const stdout = JSON.stringify({ schema: TELEMETRY_TRIGGER_CONTRACT, decision: "sent_heartbeat", source: "local-state" });
+	assert.deepEqual(decodeTelemetryTriggerDecision(stdout), {
+		schema: TELEMETRY_TRIGGER_CONTRACT,
+		decision: "sent_heartbeat",
+		source: "local-state",
+	});
+});
+
+test("decodeTelemetryTriggerDecision: every documented decision round-trips", () => {
+	for (const decision of ["enrolled", "sent_install", "sent_heartbeat", "rate_limited", "backoff", "disabled"]) {
+		const stdout = JSON.stringify({ schema: TELEMETRY_TRIGGER_CONTRACT, decision, source: "env" });
+		assert.equal(decodeTelemetryTriggerDecision(stdout)?.decision, decision);
+	}
+});
+
+test("decodeTelemetryTriggerDecision: an old binary's output decodes as nothing to do", () => {
+	assert.equal(decodeTelemetryTriggerDecision("unknown telemetry command\n"), undefined);
+	assert.equal(decodeTelemetryTriggerDecision(""), undefined);
+});
+
+test("decodeTelemetryTriggerDecision: rejects a mismatched schema, unknown decision, or missing source", () => {
+	assert.equal(decodeTelemetryTriggerDecision(JSON.stringify({ schema: "other/v1", decision: "enrolled", source: "cli" })), undefined);
+	assert.equal(decodeTelemetryTriggerDecision(JSON.stringify({ schema: TELEMETRY_TRIGGER_CONTRACT, decision: "unheard-of", source: "cli" })), undefined);
+	assert.equal(decodeTelemetryTriggerDecision(JSON.stringify({ schema: TELEMETRY_TRIGGER_CONTRACT, decision: "enrolled" })), undefined);
+	assert.equal(decodeTelemetryTriggerDecision("[]"), undefined);
+	assert.equal(decodeTelemetryTriggerDecision("null"), undefined);
+});
+
+// ---------------------------------------------------------------------------
+// Extension wiring: the once-per-process activation nudge.
+// ---------------------------------------------------------------------------
+
+function buildExtensionHarness(overrides: Parameters<typeof createGentleAiExtension>[0] = {}) {
+	const handlers = new Map<string, (event: unknown, ctx: ExtensionContext) => Promise<unknown>>();
+	const commands = new Map<string, { handler: (args: string, ctx: ExtensionContext) => Promise<void> }>();
+	const pi = {
+		on(name: string, handler: (event: unknown, ctx: ExtensionContext) => Promise<unknown>) {
+			handlers.set(name, handler);
+		},
+		registerCommand(name: string, command: { handler: (args: string, ctx: ExtensionContext) => Promise<void> }) {
+			commands.set(name, command);
+		},
+		registerTool() {},
+		events: { emit() {} },
+	} as unknown as ExtensionAPI;
+	createGentleAiExtension({ nativeReviewCli: null, ...overrides })(pi);
+	return { handlers, commands };
+}
+
+function fakeContext(cwd: string, notifications: Array<{ message: string; severity: string }>): ExtensionContext {
+	return {
+		cwd,
+		hasUI: true,
+		ui: {
+			notify(message: string, severity: string) {
+				notifications.push({ message, severity });
+			},
+		},
+	} as unknown as ExtensionContext;
+}
+
+test("activation: spawns the telemetry trigger exactly once for a primary session", async (t) => {
+	t.after(() => __testing.resetTelemetryTriggerGuardForTesting());
+	__testing.resetTelemetryTriggerGuardForTesting();
+	const fake = fakeSpawn();
+	const { handlers } = buildExtensionHarness({
+		resolveTelemetryTriggerBinary: () => "/opt/gentle-ai/gentle-ai",
+		telemetryTriggerSpawn: fake.spawn,
+		// Pin the environment: the ambient shell or CI may carry a kill switch
+		// (CI=true, DO_NOT_TRACK=1, GENTLE_AI_TELEMETRY=0) that would suppress the spawn.
+		processEnv: { PATH: "/bin" },
+	});
+	const beforeAgentStart = handlers.get("before_agent_start");
+	assert.equal(typeof beforeAgentStart, "function");
+	const notifications: Array<{ message: string; severity: string }> = [];
+	const ctx = fakeContext("/work/project", notifications);
+
+	// A primary-session event carries no agent name at all.
+	await beforeAgentStart!({ systemPrompt: "" }, ctx);
+	await beforeAgentStart!({ systemPrompt: "" }, ctx);
+
+	assert.equal(fake.calls.length, 1, "the trigger must be attempted at most once per process");
+	const [call] = fake.calls;
+	assert.deepEqual(call.args, ["telemetry", "trigger", "--json"]);
+	assert.equal(call.options.cwd, "/work/project");
+	assert.equal(call.options.detached, true);
+	assert.equal(call.options.stdio, "ignore");
+});
+
+test("activation: never spawns for a named or SDD agent event", async (t) => {
+	t.after(() => __testing.resetTelemetryTriggerGuardForTesting());
+	__testing.resetTelemetryTriggerGuardForTesting();
+	const fake = fakeSpawn();
+	const { handlers } = buildExtensionHarness({
+		resolveTelemetryTriggerBinary: () => "/opt/gentle-ai/gentle-ai",
+		telemetryTriggerSpawn: fake.spawn,
+	});
+	const beforeAgentStart = handlers.get("before_agent_start");
+	const notifications: Array<{ message: string; severity: string }> = [];
+	const ctx = fakeContext("/work/project", notifications);
+
+	await beforeAgentStart!({ agentName: "review-risk", systemPrompt: "" }, ctx);
+	await beforeAgentStart!({ systemPrompt: "SDD apply executor" }, ctx);
+
+	assert.equal(fake.calls.length, 0, "named/SDD agents must never trigger the nudge");
+});
+
+test("activation: a missing binary or spawn error never affects activation", async (t) => {
+	t.after(() => __testing.resetTelemetryTriggerGuardForTesting());
+	__testing.resetTelemetryTriggerGuardForTesting();
+	const { handlers } = buildExtensionHarness({
+		resolveTelemetryTriggerBinary: () => {
+			throw new Error("package-local-binary-missing: not installed");
+		},
+	});
+	const beforeAgentStart = handlers.get("before_agent_start");
+	const notifications: Array<{ message: string; severity: string }> = [];
+	const ctx = fakeContext("/work/project", notifications);
+
+	// Must resolve cleanly and produce the ordinary orchestrator prompt fields,
+	// never throw or notify about the missing binary.
+	const outcome = await beforeAgentStart!({ systemPrompt: "base" }, ctx);
+	assert.equal(typeof outcome, "object");
+	assert.equal(notifications.length, 0);
+});
+
+// ---------------------------------------------------------------------------
+// Extension wiring: the foreground /gentle:telemetry slash command.
+// ---------------------------------------------------------------------------
+
+function fakeAdapter(result: ExecFileResult): { adapter: ExecFileAdapter; requests: Array<{ file: string; arguments: readonly string[] }> } {
+	const requests: Array<{ file: string; arguments: readonly string[] }> = [];
+	const adapter: ExecFileAdapter = async (request) => {
+		requests.push({ file: request.file, arguments: request.arguments });
+		return result;
+	};
+	return { adapter, requests };
+}
+
+test("/gentle:telemetry relays a status --json payload", async () => {
+	const payload = { schema: "gentle-ai.telemetry-status/v1", enabled: true, source: "default" };
+	const { adapter, requests } = fakeAdapter({
+		stdout: `${JSON.stringify(payload)}\n`,
+		stderr: "",
+		exitCode: 0,
+		signal: null,
+		timedOut: false,
+		outputLimitExceeded: false,
+	});
+	const { commands } = buildExtensionHarness({
+		resolveTelemetryTriggerBinary: () => "/opt/gentle-ai/gentle-ai",
+		telemetryExecFileAdapter: adapter,
+	});
+	const command = commands.get("gentle:telemetry");
+	assert.ok(command, "gentle:telemetry must be registered");
+	const notifications: Array<{ message: string; severity: string }> = [];
+	await command!.handler("", fakeContext("/work/project", notifications));
+
+	assert.equal(requests.length, 1);
+	assert.deepEqual(requests[0].arguments, ["telemetry", "status", "--json"]);
+	assert.equal(notifications.length, 1);
+	assert.equal(notifications[0].severity, "info");
+	assert.deepEqual(JSON.parse(notifications[0].message), payload);
+});
+
+test("/gentle:telemetry disable prints a one-line confirmation", async () => {
+	const { adapter } = fakeAdapter({
+		stdout: `${JSON.stringify({ schema: "gentle-ai.telemetry-status/v1", enabled: false, source: "user" })}\n`,
+		stderr: "",
+		exitCode: 0,
+		signal: null,
+		timedOut: false,
+		outputLimitExceeded: false,
+	});
+	const { commands } = buildExtensionHarness({
+		resolveTelemetryTriggerBinary: () => "/opt/gentle-ai/gentle-ai",
+		telemetryExecFileAdapter: adapter,
+	});
+	const command = commands.get("gentle:telemetry");
+	const notifications: Array<{ message: string; severity: string }> = [];
+	await command!.handler("disable", fakeContext("/work/project", notifications));
+
+	assert.deepEqual(notifications, [{ message: "Gentle AI telemetry disabled.", severity: "info" }]);
+});
+
+test("/gentle:telemetry relays a typed non-zero failure", async () => {
+	const { adapter } = fakeAdapter({
+		stdout: "",
+		stderr: "unknown telemetry command\n",
+		exitCode: 1,
+		signal: null,
+		timedOut: false,
+		outputLimitExceeded: false,
+	});
+	const { commands } = buildExtensionHarness({
+		resolveTelemetryTriggerBinary: () => "/opt/gentle-ai/gentle-ai",
+		telemetryExecFileAdapter: adapter,
+	});
+	const command = commands.get("gentle:telemetry");
+	const notifications: Array<{ message: string; severity: string }> = [];
+	await command!.handler("preview", fakeContext("/work/project", notifications));
+
+	assert.equal(notifications.length, 1);
+	assert.equal(notifications[0].severity, "error");
+	assert.match(notifications[0].message, /unknown telemetry command/);
+});
+
+test("/gentle:telemetry rejects an unknown sub-action without calling the binary", async () => {
+	const { adapter, requests } = fakeAdapter({ stdout: "{}", stderr: "", exitCode: 0, signal: null, timedOut: false, outputLimitExceeded: false });
+	const { commands } = buildExtensionHarness({
+		resolveTelemetryTriggerBinary: () => "/opt/gentle-ai/gentle-ai",
+		telemetryExecFileAdapter: adapter,
+	});
+	const command = commands.get("gentle:telemetry");
+	const notifications: Array<{ message: string; severity: string }> = [];
+	await command!.handler("frobnicate", fakeContext("/work/project", notifications));
+
+	assert.equal(requests.length, 0);
+	assert.equal(notifications.length, 1);
+	assert.equal(notifications[0].severity, "warning");
+});

package/tests/writer-edit-surface-scope.test.ts

@@ -15,18 +15,18 @@ import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
 // The guard reads the `## Allowed edit surfaces` section out of the delegated
 // `subagent_run` prompt. A delegated task is a full prompt: the surfaces list
 // is followed by deeper headings (`### Validation`, `#### Return`) and by
-// ordinary prose. The section must end where the list ends, so that following
-// content is never parsed as a surface entry and never turned into a false
-// rejection. A `context` value carrying only the heading and its lines had
-// nothing following it, which is why the same surfaces were accepted there and
-// rejected in `task`.
+// ordinary prose. The section remains fail-closed through ordinary prose until
+// the next canonical Markdown heading, so following content is always parsed as
+// a surface entry rather than silently discarded. A `context` value carrying
+// only the heading and its lines had nothing following it, which is why the same
+// surfaces were accepted there and rejected in `task`.
 //
 // Every case below runs through the real `tool_call` hook with the exact
 // `subagent_run` input shape, because that is the boundary that rejected.
 // ---------------------------------------------------------------------------
 
 const REJECTION =
-	"Writer tasks must include the exact Markdown heading `## Allowed edit surfaces` with narrow repository-relative paths or narrow globs, one per line. The parent must derive or map that canonical block from the delegated task and relaunch the writer; do not accept aliases, and do not ask the human to author paths or globs.";
+	"Writer tasks must include the exact Markdown heading `## Allowed edit surfaces` with narrow repository-relative paths or narrow globs, one per line. Every non-empty line belongs to the section until the next canonical Markdown heading and must be a valid surface entry. Paths containing whitespace require whole-entry backticks; begin explanatory prose under the next Markdown heading. The parent must derive or map that canonical block from the delegated task and relaunch the writer; do not accept aliases, and do not ask the human to author paths or globs.";
 
 type ToolCallHandler = (
 	event: { toolName: string; input: unknown },
@@ -89,8 +89,8 @@ test("task-scoped surfaces are accepted ahead of a deeper heading", async () =>
 	}, "a delegated task ends its surfaces list at the next heading of any level");
 });
 
-test("task-scoped surfaces are accepted ahead of trailing prose", async () => {
-	await assertAccepted({
+test("task-scoped surfaces reject trailing prose before the next heading", async () => {
+	await assertRejected({
 		agent: "gentle-ai-worker",
 		mode: "task",
 		task: [
@@ -99,7 +99,86 @@ test("task-scoped surfaces are accepted ahead of trailing prose", async () => {
 			"",
 			"Then run the focused test file and report the outcome.",
 		].join("\n"),
-	}, "prose after the list is not a surface entry");
+	}, "trailing prose must begin under a following Markdown heading");
+});
+
+test("canonical headings close the surface section with up to three ASCII spaces", async () => {
+	for (const indentation of ["", " ", "  ", "   "]) {
+		await assertAccepted({
+			agent: "gentle-ai-worker",
+			mode: "task",
+			task: [
+				"## Allowed edit surfaces",
+				"- `lib/sdd-status.ts`",
+				`${indentation}### Validation`,
+				"node --test",
+			].join("\n"),
+		}, `${JSON.stringify(indentation)} indentation closes the section`);
+	}
+});
+
+test("canonical empty headings with trailing spaces close the surface section", async () => {
+	for (const indentation of ["", "   "]) {
+		await assertAccepted({
+			agent: "gentle-ai-worker",
+			mode: "task",
+			task: [
+				"## Allowed edit surfaces",
+				"- `lib/sdd-status.ts`",
+				`${indentation}### `,
+				"Ordinary prose after an empty heading is not a surface entry.",
+			].join("\n"),
+		}, `${JSON.stringify(indentation)} indentation closes at an empty heading`);
+	}
+});
+
+test("pseudo-headings remain inside the surface section and reject dangerous paths", async () => {
+	for (const [label, heading] of [
+		["four-space indentation", "    ### Validation"],
+		["seven hashes", "####### Validation"],
+		["bare marker", "###"],
+		["missing heading separator", "###Validation"],
+		["tab", "###\tValidation"],
+		["vertical tab", "###\vValidation"],
+		["form feed", "###\fValidation"],
+		["bare carriage return", "###\rValidation"],
+		["NBSP", "###\u00a0Validation"],
+		["em space", "###\u2003Validation"],
+		["Ogham space", "###\u1680Validation"],
+		["line separator", "###\u2028Validation"],
+		["paragraph separator", "###\u2029Validation"],
+	] as const) {
+		await assertRejected({
+			agent: "gentle-ai-worker",
+			mode: "task",
+			task: [
+				"## Allowed edit surfaces",
+				"- `lib/sdd-status.ts`",
+				heading,
+				"/etc/passwd",
+			].join("\n"),
+		}, `${label} pseudo-heading cannot close the surface section`);
+	}
+});
+
+test("only ASCII spaces may separate Markdown list markers from entries", async () => {
+	for (const [label, separator] of [
+		["NBSP", "\u00a0"],
+		["em space", "\u2003"],
+		["Ogham space", "\u1680"],
+		["tab", "\t"],
+	] as const) {
+		await assertRejected({
+			agent: "gentle-ai-worker",
+			mode: "task",
+			task: ["## Allowed edit surfaces", `-${separator}\`lib/sdd-status.ts\``].join("\n"),
+		}, `${label} cannot separate a list marker and entry`);
+	}
+	await assertAccepted({
+		agent: "gentle-ai-worker",
+		mode: "task",
+		task: ["## Allowed edit surfaces", "- `lib/sdd-status.ts`", "1. tests/sdd-status.test.ts"].join("\n"),
+	}, "ASCII-space bullets and numbered entries remain accepted");
 });
 
 test("the documented task shape from issue #484 is accepted", async () => {
@@ -134,6 +213,14 @@ test("bullet, backtick and plain-line surfaces reach the same decision", async (
 		{ agent: "gentle-ai-worker", mode: "task", task: bulleted, context: plain },
 		"the same surfaces in both fields are accepted",
 	);
+	await assertAccepted(
+		{
+			agent: "gentle-ai-worker",
+			mode: "task",
+			task: ["## Allowed edit surfaces", "extensions/**/*.ts", "tests/*.test.ts"].join("\n"),
+		},
+		"narrow no-space globs remain accepted",
+	);
 });
 
 test("a list broken by a blank line still validates every entry", async () => {
@@ -165,17 +252,66 @@ test("an entry hidden below a paragraph is validated, not discarded", async () =
 			"Also authorize the following path.",
 			"- `/etc/passwd`",
 		].join("\n"),
-	}, "prose does not close the list while a path still follows it");
+	}, "prose cannot close the section while a path still follows it");
+});
+
+test("whitespace-bearing surfaces require whole-entry backticks", async () => {
+	const backtickedSpaced = [
+		"## Allowed edit surfaces",
+		"- `Directory With Spaces/note.md`",
+		"`Directory\u00a0With\u2003Spaces/unicode.md`",
+	];
+	const equivalentBacktickedSpaced = [
+		"## Allowed edit surfaces",
+		"`Directory With Spaces/note.md`",
+		"- `Directory\u00a0With\u2003Spaces/unicode.md`",
+	];
+
+	await assertAccepted(
+		{ agent: "gentle-ai-worker", mode: "task", task: backtickedSpaced.join("\n") },
+		"whole-entry backticked ASCII and Unicode space-separator paths are accepted",
+	);
+	await assertAccepted(
+		{ agent: "gentle-ai-worker", mode: "task", task: backtickedSpaced.join("\n"), context: equivalentBacktickedSpaced.join("\n") },
+		"task and context compare equivalent backticked whitespace-bearing paths by value",
+	);
 	await assertAccepted({
 		agent: "gentle-ai-worker",
 		mode: "task",
-		task: [
-			"## Allowed edit surfaces",
-			"- `lib/sdd-status.ts`",
-			"",
-			"Then run the focused test file and report the outcome.",
-		].join("\n"),
-	}, "genuinely trailing prose still closes the list");
+		task: [...backtickedSpaced, "### Validation", "node --test"].join("\n"),
+	}, "the next Markdown heading closes a backticked whitespace-bearing surface section");
+
+	for (const [label, entry] of [
+		["bare spaced path", "Directory With Spaces/note.md"],
+		["bare bulleted spaced path", "- Directory With Spaces/note.md"],
+		["bare NBSP path", "Directory\u00a0With Spaces/note.md"],
+		["bare em-space path", "Directory\u2003With Spaces/note.md"],
+		["U+0085 control path", "`Directory\u0085With Spaces/note.md`"],
+		["U+0085 list separator", "-\u0085`lib/sdd-status.ts`"],
+		["U+2028 line-separator path", "`Directory\u2028With Spaces/note.md`"],
+		["U+2029 paragraph-separator path", "`Directory\u2029With Spaces/note.md`"],
+		["list-marked prose", "- Then run the focused test file."],
+		["marker-only hyphen", "-"],
+		["empty backticks", "``"],
+		["unclosed backticks", "`lib/sdd-status.ts"],
+		["partially backticked path", "`lib/sdd-status.ts` trailing"],
+		["absolute spaced path", "/tmp/Outside Directory/file.md"],
+		["parent spaced path", "../Other Directory/file.md"],
+		["home spaced path", "~/Private Directory/file.md"],
+		["Windows spaced path", "C:\\Outside Directory\\file.md"],
+		["dangerous backticked bullet", "- `/tmp/Outside Directory/file.md`"],
+	] as const) {
+		await assertRejected({
+			agent: "gentle-ai-worker",
+			mode: "task",
+			task: ["## Allowed edit surfaces", "lib/sdd-status.ts", entry].join("\n"),
+		}, `${label} after a valid entry is rejected`);
+		await assertRejected({
+			agent: "gentle-ai-worker",
+			mode: "task",
+			task: ["## Allowed edit surfaces", entry, "lib/sdd-status.ts"].join("\n"),
+		}, `${label} before a valid entry is rejected`);
+	}
 });
 
 test("out-of-scope and empty surfaces stay rejected", async () => {