gsd-pi 2.10.12 → 2.12.0

package/dist/resources/extensions/gsd/tests/reassess-prompt.test.ts

@@ -0,0 +1,142 @@
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createTestContext } from './test-helpers.ts';
+
+// loadPrompt reads from ~/.gsd/agent/extensions/gsd/prompts/ (main checkout).
+// In a worktree the file may not exist there yet, so we resolve prompts
+// relative to this test file's location (the worktree copy).
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const worktreePromptsDir = join(__dirname, "..", "prompts");
+
+const { assertTrue, report } = createTestContext();
+/**
+ * Load a prompt template from the worktree prompts directory
+ * and apply variable substitution (mirrors loadPrompt logic).
+ */
+function loadPromptFromWorktree(name: string, vars: Record<string, string> = {}): string {
+  const path = join(worktreePromptsDir, `${name}.md`);
+  let content = readFileSync(path, "utf-8");
+  for (const [key, value] of Object.entries(vars)) {
+    content = content.replaceAll(`{{${key}}}`, value);
+  }
+  return content.trim();
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// Tests
+// ═══════════════════════════════════════════════════════════════════════════
+
+async function main(): Promise<void> {
+
+  // ─── reassess-roadmap prompt loads and substitutes ─────────────────────
+  console.log("\n=== reassess-roadmap prompt loads and substitutes ===");
+  {
+    const testVars = {
+      milestoneId: "M099",
+      completedSliceId: "S03",
+      assessmentPath: ".gsd/milestones/M099/slices/S03/S03-ASSESSMENT.md",
+      roadmapPath: ".gsd/milestones/M099/M099-ROADMAP.md",
+      inlinedContext: "--- test inlined context block ---",
+    };
+
+    let result: string;
+    let threw = false;
+    try {
+      result = loadPromptFromWorktree("reassess-roadmap", testVars);
+    } catch (err) {
+      threw = true;
+      result = "";
+      console.error(`  ERROR: loadPrompt threw: ${err}`);
+    }
+
+    assertTrue(!threw, "loadPrompt does not throw for reassess-roadmap");
+    assertTrue(typeof result === "string" && result.length > 0, "loadPrompt returns a non-empty string");
+
+    // Verify all test variables were substituted into the output
+    assertTrue(result.includes("M099"), "prompt contains milestoneId 'M099'");
+    assertTrue(result.includes("S03"), "prompt contains completedSliceId 'S03'");
+    assertTrue(result.includes(".gsd/milestones/M099/slices/S03/S03-ASSESSMENT.md"), "prompt contains assessmentPath");
+    assertTrue(result.includes(".gsd/milestones/M099/M099-ROADMAP.md"), "prompt contains roadmapPath");
+    assertTrue(result.includes("--- test inlined context block ---"), "prompt contains inlinedContext");
+
+    // Verify no un-substituted variables remain
+    assertTrue(!result.includes("{{milestoneId}}"), "no un-substituted {{milestoneId}}");
+    assertTrue(!result.includes("{{completedSliceId}}"), "no un-substituted {{completedSliceId}}");
+    assertTrue(!result.includes("{{assessmentPath}}"), "no un-substituted {{assessmentPath}}");
+    assertTrue(!result.includes("{{roadmapPath}}"), "no un-substituted {{roadmapPath}}");
+    assertTrue(!result.includes("{{inlinedContext}}"), "no un-substituted {{inlinedContext}}");
+  }
+
+  // ─── reassess-roadmap contains coverage-check instruction ─────────────
+  console.log("\n=== reassess-roadmap contains coverage-check instruction ===");
+  {
+    const prompt = loadPromptFromWorktree("reassess-roadmap", {
+      milestoneId: "M001",
+      completedSliceId: "S01",
+      assessmentPath: ".gsd/milestones/M001/slices/S01/S01-ASSESSMENT.md",
+      roadmapPath: ".gsd/milestones/M001/M001-ROADMAP.md",
+      inlinedContext: "context",
+    });
+
+    // Normalize to lowercase for case-insensitive matching
+    const lower = prompt.toLowerCase();
+
+    // The prompt must mention "each success criterion" or "every success criterion"
+    assertTrue(
+      lower.includes("each success criterion") || lower.includes("every success criterion"),
+      "prompt contains 'each success criterion' or 'every success criterion'"
+    );
+
+    // The prompt must mention "owning slice" or "remaining slice"
+    assertTrue(
+      lower.includes("owning slice") || lower.includes("remaining slice"),
+      "prompt contains 'owning slice' or 'remaining slice'"
+    );
+
+    // The prompt must mention "no remaining owner" or "no owner" or "no slice"
+    assertTrue(
+      lower.includes("no remaining owner") || lower.includes("no owner") || lower.includes("no slice"),
+      "prompt contains 'no remaining owner', 'no owner', or 'no slice'"
+    );
+
+    // The prompt must mention "blocking issue" or "blocking"
+    assertTrue(
+      lower.includes("blocking issue") || lower.includes("blocking"),
+      "prompt contains 'blocking issue' or 'blocking'"
+    );
+  }
+
+  // ─── coverage-check requires at-least-one semantics ───────────────────
+  console.log("\n=== coverage-check requires at-least-one semantics ===");
+  {
+    const prompt = loadPromptFromWorktree("reassess-roadmap", {
+      milestoneId: "M001",
+      completedSliceId: "S01",
+      assessmentPath: ".gsd/milestones/M001/slices/S01/S01-ASSESSMENT.md",
+      roadmapPath: ".gsd/milestones/M001/M001-ROADMAP.md",
+      inlinedContext: "context",
+    });
+
+    const lower = prompt.toLowerCase();
+
+    // The instruction must use "at least one" or equivalent inclusive language
+    assertTrue(
+      lower.includes("at least one") || lower.includes("at-least-one") || lower.includes("one or more"),
+      "prompt uses 'at least one' or equivalent inclusive language for slice ownership"
+    );
+
+    // The instruction must NOT require "exactly one" — that would be too rigid
+    assertTrue(
+      !lower.includes("exactly one owner") && !lower.includes("exactly one slice"),
+      "prompt does NOT use 'exactly one' for slice ownership (would be too rigid)"
+    );
+  }
+
+  report();
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/dist/resources/extensions/gsd/tests/regex-hardening.test.ts

@@ -0,0 +1,281 @@
+// Regex-hardening tests for S02/T02 — proves all 12 regex/parser sites
+// accept both M001 (classic) and M001-abc123 (unique) milestone ID formats.
+//
+// Sections:
+//   (a) Directory scanning regex — findMilestoneIds pattern
+//   (b) Title-strip regex — milestone title cleanup
+//   (c) SLICE_BRANCH_RE — branch name parsing (with/without worktree prefix)
+//   (d) Milestone detection regex — hasExistingMilestones pattern
+//   (e) MILESTONE_CONTEXT_RE — context write-gate filename match
+//   (f) Prompt dispatch regexes — executeMatch and resumeMatch capture
+//   (g) milestoneIdSort — mixed-format ordering
+//   (h) extractMilestoneSeq — numeric extraction from both formats
+
+import { test } from 'node:test';
+
+import {
+  MILESTONE_ID_RE,
+  extractMilestoneSeq,
+  milestoneIdSort,
+} from '../guided-flow.ts';
+
+import { SLICE_BRANCH_RE } from '../worktree.ts';
+import { createTestContext } from './test-helpers.ts';
+
+
+const { assertEq, assertTrue, report } = createTestContext();
+// ─── Tests ─────────────────────────────────────────────────────────────────
+
+async function main(): Promise<void> {
+  console.log('regex-hardening tests');
+
+  // (a) Directory scanning regex — used in state.ts, workspace-index.ts, files.ts
+  //     Pattern: /^(M\d+(?:-[a-z0-9]{6})?)/
+  {
+    console.log('  (a) Directory scanning regex');
+    const DIR_SCAN_RE = /^(M\d+(?:-[a-z0-9]{6})?)/;
+
+    // Classic format matches
+    assertTrue(DIR_SCAN_RE.test('M001'), 'dir scan matches M001');
+    assertTrue(DIR_SCAN_RE.test('M042'), 'dir scan matches M042');
+    assertTrue(DIR_SCAN_RE.test('M999'), 'dir scan matches M999');
+    assertEq(('M001' as string).match(DIR_SCAN_RE)?.[1], 'M001', 'captures M001');
+
+    // Unique format matches
+    assertTrue(DIR_SCAN_RE.test('M001-abc123'), 'dir scan matches M001-abc123');
+    assertTrue(DIR_SCAN_RE.test('M042-z9a8b7'), 'dir scan matches M042-z9a8b7');
+    assertEq(('M001-abc123' as string).match(DIR_SCAN_RE)?.[1], 'M001-abc123', 'captures M001-abc123 from dir name');
+
+    // Rejects
+    assertTrue(!DIR_SCAN_RE.test('S01'), 'dir scan rejects S01');
+    assertTrue(!DIR_SCAN_RE.test('X001'), 'dir scan rejects X001');
+    assertTrue(!DIR_SCAN_RE.test('.DS_Store'), 'dir scan rejects .DS_Store');
+    assertTrue(!DIR_SCAN_RE.test('notes'), 'dir scan rejects notes');
+  }
+
+  // (b) Title-strip regex — used in state.ts, workspace-index.ts
+  //     Pattern: /^M\d+(?:-[a-z0-9]{6})?[^:]*:\s*/
+  {
+    console.log('  (b) Title-strip regex');
+    const TITLE_STRIP_RE = /^M\d+(?:-[a-z0-9]{6})?[^:]*:\s*/;
+
+    // Classic format strip
+    assertEq('M001: Title'.replace(TITLE_STRIP_RE, ''), 'Title', 'strips M001: Title → Title');
+    assertEq('M042: Payment Integration'.replace(TITLE_STRIP_RE, ''), 'Payment Integration', 'strips M042: Payment Integration');
+
+    // Unique format strip
+    assertEq('M001-abc123: Title'.replace(TITLE_STRIP_RE, ''), 'Title', 'strips M001-abc123: Title → Title');
+    assertEq('M042-z9a8b7: Dashboard'.replace(TITLE_STRIP_RE, ''), 'Dashboard', 'strips M042-z9a8b7: Dashboard');
+
+    // Em dash in title — current format (M001: Title) correctly preserves em dash in title body
+    assertEq(
+      'M001: Foundation — Build Core'.replace(TITLE_STRIP_RE, ''),
+      'Foundation — Build Core',
+      'strips M001: prefix and preserves em dash in title body',
+    );
+    assertEq(
+      'M001-abc123: Foundation — Build Core'.replace(TITLE_STRIP_RE, ''),
+      'Foundation — Build Core',
+      'strips M001-abc123: prefix and preserves em dash in title body (unique format)',
+    );
+
+    // Edge case: dash-style separator (M001 — Title: Subtitle preserves colon in body)
+    assertEq(
+      'M001 — Unique Milestone IDs: Foo'.replace(TITLE_STRIP_RE, ''),
+      'Foo',
+      'strips M001 — Unique Milestone IDs: Foo → Foo (first colon consumed)',
+    );
+
+    // Edge case: colon inside title body preserved
+    assertEq(
+      'M001: Note: important'.replace(TITLE_STRIP_RE, ''),
+      'Note: important',
+      'preserves colons in title body',
+    );
+
+    // No match — leaves non-milestone strings alone
+    assertEq('S01: Slice Title'.replace(TITLE_STRIP_RE, ''), 'S01: Slice Title', 'does not strip S01 prefix');
+  }
+
+  // (c) SLICE_BRANCH_RE — from worktree.ts
+  //     Pattern: /^gsd\/(?:([a-zA-Z0-9_-]+)\/)?(M\d+(?:-[a-z0-9]{6})?)\/(S\d+)$/
+  {
+    console.log('  (c) SLICE_BRANCH_RE');
+
+    // Classic format — no worktree prefix
+    {
+      const m = 'gsd/M001/S01'.match(SLICE_BRANCH_RE);
+      assertTrue(m !== null, 'matches gsd/M001/S01');
+      assertEq(m?.[1], undefined, 'no worktree prefix for gsd/M001/S01');
+      assertEq(m?.[2], 'M001', 'captures M001');
+      assertEq(m?.[3], 'S01', 'captures S01');
+    }
+
+    // Unique format — no worktree prefix
+    {
+      const m = 'gsd/M001-abc123/S01'.match(SLICE_BRANCH_RE);
+      assertTrue(m !== null, 'matches gsd/M001-abc123/S01');
+      assertEq(m?.[1], undefined, 'no worktree prefix for unique format');
+      assertEq(m?.[2], 'M001-abc123', 'captures M001-abc123');
+      assertEq(m?.[3], 'S01', 'captures S01');
+    }
+
+    // Classic format — with worktree prefix
+    {
+      const m = 'gsd/worktree/M001/S01'.match(SLICE_BRANCH_RE);
+      assertTrue(m !== null, 'matches gsd/worktree/M001/S01');
+      assertEq(m?.[1], 'worktree', 'captures worktree prefix');
+      assertEq(m?.[2], 'M001', 'captures M001 with worktree');
+      assertEq(m?.[3], 'S01', 'captures S01 with worktree');
+    }
+
+    // Unique format — with worktree prefix
+    {
+      const m = 'gsd/worktree/M001-abc123/S01'.match(SLICE_BRANCH_RE);
+      assertTrue(m !== null, 'matches gsd/worktree/M001-abc123/S01');
+      assertEq(m?.[1], 'worktree', 'captures worktree prefix with unique format');
+      assertEq(m?.[2], 'M001-abc123', 'captures M001-abc123 with worktree');
+      assertEq(m?.[3], 'S01', 'captures S01 with worktree and unique format');
+    }
+
+    // Rejects
+    assertTrue(!SLICE_BRANCH_RE.test('gsd/S01'), 'rejects gsd/S01 (no milestone)');
+    assertTrue(!SLICE_BRANCH_RE.test('main'), 'rejects main');
+    assertTrue(!SLICE_BRANCH_RE.test('gsd/M001'), 'rejects gsd/M001 (no slice)');
+    assertTrue(!SLICE_BRANCH_RE.test('feature/M001/S01'), 'rejects feature/ prefix');
+  }
+
+  // (d) Milestone detection regex — used in worktree-command.ts (hasExistingMilestones)
+  //     Pattern: /^M\d+(?:-[a-z0-9]{6})?/
+  {
+    console.log('  (d) Milestone detection regex');
+    const MILESTONE_DETECT_RE = /^M\d+(?:-[a-z0-9]{6})?/;
+
+    // Classic format matches
+    assertTrue(MILESTONE_DETECT_RE.test('M001'), 'detect matches M001');
+    assertTrue(MILESTONE_DETECT_RE.test('M042'), 'detect matches M042');
+
+    // Unique format matches
+    assertTrue(MILESTONE_DETECT_RE.test('M001-abc123'), 'detect matches M001-abc123');
+    assertTrue(MILESTONE_DETECT_RE.test('M042-z9a8b7'), 'detect matches M042-z9a8b7');
+
+    // Rejects
+    assertTrue(!MILESTONE_DETECT_RE.test('S01'), 'detect rejects S01');
+    assertTrue(!MILESTONE_DETECT_RE.test('notes'), 'detect rejects notes');
+    assertTrue(!MILESTONE_DETECT_RE.test('.DS_Store'), 'detect rejects .DS_Store');
+  }
+
+  // (e) MILESTONE_CONTEXT_RE — used in index.ts (write-gate)
+  //     Pattern: /M\d+(?:-[a-z0-9]{6})?-CONTEXT\.md$/
+  {
+    console.log('  (e) MILESTONE_CONTEXT_RE');
+    const CONTEXT_RE = /M\d+(?:-[a-z0-9]{6})?-CONTEXT\.md$/;
+
+    // Classic format matches
+    assertTrue(CONTEXT_RE.test('M001-CONTEXT.md'), 'context matches M001-CONTEXT.md');
+    assertTrue(CONTEXT_RE.test('.gsd/milestones/M001/M001-CONTEXT.md'), 'context matches full path classic format');
+
+    // Unique format matches
+    assertTrue(CONTEXT_RE.test('M001-abc123-CONTEXT.md'), 'context matches M001-abc123-CONTEXT.md');
+    assertTrue(CONTEXT_RE.test('.gsd/milestones/M001-abc123/M001-abc123-CONTEXT.md'), 'context matches full path unique format');
+
+    // Rejects
+    assertTrue(!CONTEXT_RE.test('M001-ROADMAP.md'), 'context rejects M001-ROADMAP.md');
+    assertTrue(!CONTEXT_RE.test('M001-SUMMARY.md'), 'context rejects M001-SUMMARY.md');
+    assertTrue(!CONTEXT_RE.test('CONTEXT.md'), 'context rejects bare CONTEXT.md');
+  }
+
+  // (f) Prompt dispatch regexes — used in index.ts (executeMatch, resumeMatch)
+  {
+    console.log('  (f) Prompt dispatch regexes');
+    const EXECUTE_RE = /Execute the next task:\s+(T\d+)\s+\("([^"]+)"\)\s+in slice\s+(S\d+)\s+of milestone\s+(M\d+(?:-[a-z0-9]{6})?)/i;
+    const RESUME_RE = /Resume interrupted work\.[\s\S]*?slice\s+(S\d+)\s+of milestone\s+(M\d+(?:-[a-z0-9]{6})?)/i;
+
+    // Execute — classic format
+    {
+      const prompt = 'Execute the next task: T01 ("Write tests") in slice S01 of milestone M001';
+      const m = prompt.match(EXECUTE_RE);
+      assertTrue(m !== null, 'execute matches classic format');
+      assertEq(m?.[1], 'T01', 'execute captures T01');
+      assertEq(m?.[3], 'S01', 'execute captures S01');
+      assertEq(m?.[4], 'M001', 'execute captures M001');
+    }
+
+    // Execute — unique format
+    {
+      const prompt = 'Execute the next task: T02 ("Build feature") in slice S03 of milestone M001-abc123';
+      const m = prompt.match(EXECUTE_RE);
+      assertTrue(m !== null, 'execute matches unique format');
+      assertEq(m?.[1], 'T02', 'execute captures T02 (unique format)');
+      assertEq(m?.[3], 'S03', 'execute captures S03 (unique format)');
+      assertEq(m?.[4], 'M001-abc123', 'execute captures M001-abc123');
+    }
+
+    // Resume — classic format
+    {
+      const prompt = 'Resume interrupted work.\nContinuing slice S02 of milestone M001';
+      const m = prompt.match(RESUME_RE);
+      assertTrue(m !== null, 'resume matches classic format');
+      assertEq(m?.[1], 'S02', 'resume captures S02');
+      assertEq(m?.[2], 'M001', 'resume captures M001');
+    }
+
+    // Resume — unique format
+    {
+      const prompt = 'Resume interrupted work.\nContinuing slice S01 of milestone M042-z9a8b7';
+      const m = prompt.match(RESUME_RE);
+      assertTrue(m !== null, 'resume matches unique format');
+      assertEq(m?.[1], 'S01', 'resume captures S01 (unique format)');
+      assertEq(m?.[2], 'M042-z9a8b7', 'resume captures M042-z9a8b7');
+    }
+  }
+
+  // (g) milestoneIdSort — mixed-format ordering
+  {
+    console.log('  (g) milestoneIdSort');
+    const mixed = ['M002-abc123', 'M001', 'M001-xyz789'];
+    const sorted = [...mixed].sort(milestoneIdSort);
+    assertEq(sorted, ['M001', 'M001-xyz789', 'M002-abc123'], 'sorts mixed IDs by sequence number');
+
+    // Stable within same seq — preserves insertion order
+    const sameSorted = ['M001-abc123', 'M001'].sort(milestoneIdSort);
+    assertEq(sameSorted[0], 'M001-abc123', 'same seq preserves order (first)');
+    assertEq(sameSorted[1], 'M001', 'same seq preserves order (second)');
+
+    // Classic format only
+    const oldOnly = ['M003', 'M001', 'M002'];
+    assertEq([...oldOnly].sort(milestoneIdSort), ['M001', 'M002', 'M003'], 'sorts classic-format IDs');
+
+    // Unique format only
+    const newOnly = ['M003-abc123', 'M001-def456', 'M002-ghi789'];
+    assertEq([...newOnly].sort(milestoneIdSort), ['M001-def456', 'M002-ghi789', 'M003-abc123'], 'sorts unique-format IDs');
+  }
+
+  // (h) extractMilestoneSeq — numeric extraction from both formats
+  {
+    console.log('  (h) extractMilestoneSeq');
+
+    // Classic format
+    assertEq(extractMilestoneSeq('M001'), 1, 'M001 → 1');
+    assertEq(extractMilestoneSeq('M042'), 42, 'M042 → 42');
+    assertEq(extractMilestoneSeq('M999'), 999, 'M999 → 999');
+
+    // Unique format — confirms dispatch-guard refactor correctness
+    assertEq(extractMilestoneSeq('M001-abc123'), 1, 'M001-abc123 → 1');
+    assertEq(extractMilestoneSeq('M042-z9a8b7'), 42, 'M042-z9a8b7 → 42');
+    assertEq(extractMilestoneSeq('M100-xyz789'), 100, 'M100-xyz789 → 100');
+
+    // Invalid → 0 (not NaN — the old parseInt(slice(1)) bug)
+    assertEq(extractMilestoneSeq(''), 0, 'empty → 0');
+    assertEq(extractMilestoneSeq('notes'), 0, 'notes → 0');
+    assertEq(extractMilestoneSeq('S01'), 0, 'S01 → 0');
+    assertTrue(!Number.isNaN(extractMilestoneSeq('M001-abc123')), 'unique format does not return NaN');
+    assertTrue(!Number.isNaN(extractMilestoneSeq('M001-ABCDEF')), 'invalid format does not return NaN');
+  }
+
+  report();
+}
+
+test('regex-hardening: all 12 sites accept both formats', async () => {
+  await main();
+});

package/dist/resources/extensions/gsd/tests/remote-questions.test.ts

@@ -0,0 +1,155 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { parseSlackReply, parseDiscordResponse } from "../../remote-questions/format.ts";
+import { resolveRemoteConfig, isValidChannelId } from "../../remote-questions/config.ts";
+import { sanitizeError } from "../../remote-questions/manager.ts";
+
+test("parseSlackReply handles single-number single-question answers", () => {
+  const result = parseSlackReply("2", [{
+    id: "choice",
+    header: "Choice",
+    question: "Pick one",
+    allowMultiple: false,
+    options: [
+      { label: "Alpha", description: "A" },
+      { label: "Beta", description: "B" },
+    ],
+  }]);
+
+  assert.deepEqual(result, { answers: { choice: { answers: ["Beta"] } } });
+});
+
+test("parseSlackReply handles multiline multi-question answers", () => {
+  const result = parseSlackReply("1\ncustom note", [
+    {
+      id: "first",
+      header: "First",
+      question: "Pick one",
+      allowMultiple: false,
+      options: [
+        { label: "Alpha", description: "A" },
+        { label: "Beta", description: "B" },
+      ],
+    },
+    {
+      id: "second",
+      header: "Second",
+      question: "Explain",
+      allowMultiple: false,
+      options: [
+        { label: "Gamma", description: "G" },
+        { label: "Delta", description: "D" },
+      ],
+    },
+  ]);
+
+  assert.deepEqual(result, {
+    answers: {
+      first: { answers: ["Alpha"] },
+      second: { answers: [], user_note: "custom note" },
+    },
+  });
+});
+
+test("parseDiscordResponse handles single-question reactions", () => {
+  const result = parseDiscordResponse([{ emoji: "2️⃣", count: 1 }], null, [{
+    id: "choice",
+    header: "Choice",
+    question: "Pick one",
+    allowMultiple: false,
+    options: [
+      { label: "Alpha", description: "A" },
+      { label: "Beta", description: "B" },
+    ],
+  }]);
+
+  assert.deepEqual(result, { answers: { choice: { answers: ["Beta"] } } });
+});
+
+test("parseDiscordResponse rejects multi-question reaction parsing", () => {
+  const result = parseDiscordResponse([{ emoji: "1️⃣", count: 1 }], null, [
+    {
+      id: "first",
+      header: "First",
+      question: "Pick one",
+      allowMultiple: false,
+      options: [{ label: "Alpha", description: "A" }],
+    },
+    {
+      id: "second",
+      header: "Second",
+      question: "Pick one",
+      allowMultiple: false,
+      options: [{ label: "Beta", description: "B" }],
+    },
+  ]);
+
+  assert.match(String(result.answers.first.user_note), /single-question prompts/i);
+  assert.match(String(result.answers.second.user_note), /single-question prompts/i);
+});
+
+test("parseSlackReply truncates user_note longer than 500 chars", () => {
+  const longText = "x".repeat(600);
+  const result = parseSlackReply(longText, [{
+    id: "q1",
+    header: "Q1",
+    question: "Pick",
+    allowMultiple: false,
+    options: [{ label: "A", description: "a" }],
+  }]);
+
+  const note = result.answers.q1.user_note!;
+  assert.ok(note.length <= 502, `note should be truncated, got ${note.length} chars`);
+  assert.ok(note.endsWith("…"), "truncated note should end with ellipsis");
+});
+
+test("isValidChannelId rejects invalid Slack channel IDs", () => {
+  // Too short
+  assert.equal(isValidChannelId("slack", "C123"), false);
+  // Contains invalid chars (URL injection)
+  assert.equal(isValidChannelId("slack", "https://evil.com"), false);
+  // Lowercase
+  assert.equal(isValidChannelId("slack", "c12345678"), false);
+  // Too long
+  assert.equal(isValidChannelId("slack", "C1234567890AB"), false);
+  // Valid: 9-12 uppercase alphanumeric
+  assert.equal(isValidChannelId("slack", "C12345678"), true);
+  assert.equal(isValidChannelId("slack", "C12345678AB"), true);
+  assert.equal(isValidChannelId("slack", "C1234567890A"), true);
+});
+
+test("isValidChannelId rejects invalid Discord channel IDs", () => {
+  // Too short
+  assert.equal(isValidChannelId("discord", "12345"), false);
+  // Contains letters (not a snowflake)
+  assert.equal(isValidChannelId("discord", "abc12345678901234"), false);
+  // URL injection
+  assert.equal(isValidChannelId("discord", "https://evil.com"), false);
+  // Too long (21 digits)
+  assert.equal(isValidChannelId("discord", "123456789012345678901"), false);
+  // Valid: 17-20 digit snowflake
+  assert.equal(isValidChannelId("discord", "12345678901234567"), true);
+  assert.equal(isValidChannelId("discord", "11234567890123456789"), true);
+});
+
+test("sanitizeError strips Slack token patterns from error messages", () => {
+  assert.equal(
+    sanitizeError("Auth failed: xoxb-1234-5678-abcdef"),
+    "Auth failed: [REDACTED]",
+  );
+  assert.equal(
+    sanitizeError("Bad token xoxp-abc-def-ghi in request"),
+    "Bad token [REDACTED] in request",
+  );
+});
+
+test("sanitizeError strips long opaque secrets", () => {
+  const fakeDiscordToken = "MTIzNDU2Nzg5MDEyMzQ1Njc4OQ.G1x2y3.abcdefghijklmnop";
+  assert.ok(!sanitizeError(`Token: ${fakeDiscordToken}`).includes(fakeDiscordToken));
+});
+
+test("sanitizeError preserves short safe messages", () => {
+  assert.equal(sanitizeError("HTTP 401: Unauthorized"), "HTTP 401: Unauthorized");
+  assert.equal(sanitizeError("Connection refused"), "Connection refused");
+});
+

package/dist/resources/extensions/gsd/tests/remote-status.test.ts

@@ -0,0 +1,99 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { createPromptRecord, writePromptRecord } from "../../remote-questions/store.ts";
+import { getLatestPromptSummary } from "../../remote-questions/status.ts";
+
+function withTempHome(fn: (tempHome: string) => void | Promise<void>) {
+  return async () => {
+    const savedHome = process.env.HOME;
+    const savedUserProfile = process.env.USERPROFILE;
+    const tempHome = join(tmpdir(), `gsd-remote-status-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(join(tempHome, ".gsd", "runtime", "remote-questions"), { recursive: true });
+    process.env.HOME = tempHome;
+    process.env.USERPROFILE = tempHome;
+    try {
+      await fn(tempHome);
+    } finally {
+      process.env.HOME = savedHome;
+      process.env.USERPROFILE = savedUserProfile;
+      rmSync(tempHome, { recursive: true, force: true });
+    }
+  };
+}
+
+test("getLatestPromptSummary returns latest stored prompt", withTempHome(() => {
+  const recordA = createPromptRecord({
+    id: "a-prompt",
+    channel: "slack",
+    createdAt: 1,
+    timeoutAt: 10,
+    pollIntervalMs: 5000,
+    questions: [],
+  });
+  recordA.updatedAt = 1;
+  writePromptRecord(recordA);
+
+  const recordB = createPromptRecord({
+    id: "z-prompt",
+    channel: "discord",
+    createdAt: 2,
+    timeoutAt: 10,
+    pollIntervalMs: 5000,
+    questions: [],
+  });
+  recordB.updatedAt = 2;
+  recordB.status = "answered";
+  writePromptRecord(recordB);
+
+  const latest = getLatestPromptSummary();
+  assert.equal(latest?.id, "z-prompt");
+  assert.equal(latest?.status, "answered");
+}));
+
+test("getLatestPromptSummary sorts by updatedAt, not filename", withTempHome(() => {
+  // Record with alphabetically-LAST id but OLDEST timestamp
+  const old = createPromptRecord({
+    id: "zzz-oldest",
+    channel: "slack",
+    createdAt: 1000,
+    timeoutAt: 9999,
+    pollIntervalMs: 5000,
+    questions: [],
+  });
+  old.updatedAt = 1000;
+  writePromptRecord(old);
+
+  // Record with alphabetically-FIRST id but NEWEST timestamp
+  const newest = createPromptRecord({
+    id: "aaa-newest",
+    channel: "discord",
+    createdAt: 3000,
+    timeoutAt: 9999,
+    pollIntervalMs: 5000,
+    questions: [],
+  });
+  newest.updatedAt = 3000;
+  newest.status = "answered";
+  writePromptRecord(newest);
+
+  // Record in between
+  const middle = createPromptRecord({
+    id: "mmm-middle",
+    channel: "slack",
+    createdAt: 2000,
+    timeoutAt: 9999,
+    pollIntervalMs: 5000,
+    questions: [],
+  });
+  middle.updatedAt = 2000;
+  writePromptRecord(middle);
+
+  const latest = getLatestPromptSummary();
+  // Should return "aaa-newest" (updatedAt=3000), NOT "zzz-oldest" (alphabetically last)
+  assert.equal(latest?.id, "aaa-newest", "should pick the most recently updated prompt, not the alphabetically last filename");
+  assert.equal(latest?.status, "answered");
+  assert.equal(latest?.updatedAt, 3000);
+}));