gsd-pi 2.33.1 → 2.34.0-dev.0150ae9

package/dist/resources/extensions/gsd/tests/auto-reentrancy-guard.test.ts

@@ -1,127 +0,0 @@
-/**
- * auto-reentrancy-guard.test.ts — Tests for the unconditional reentrancy guard.
- *
- * Regression for #1272: auto-mode stuck-loop where gap watchdog or
- * pendingAgentEndRetry could enter dispatchNextUnit concurrently during
- * recursive skip chains because the reentrancy guard was bypassed when
- * skipDepth > 0.
- *
- * The fix makes the guard unconditional (`if (s.dispatching)` without
- * `&& s.skipDepth === 0`), and defers recursive re-dispatch via
- * setImmediate/setTimeout so s.dispatching is released first.
- */
-
-import {
-  _getDispatching,
-  _setDispatching,
-  _getSkipDepth,
-  _setSkipDepth,
-} from "../auto.ts";
-import { createTestContext } from "./test-helpers.ts";
-
-const { assertEq, assertTrue, report } = createTestContext();
-
-async function main(): Promise<void> {
-  // ─── Test-only accessors work ───────────────────────────────────────────
-  console.log("\n=== reentrancy guard: test accessors round-trip ===");
-  {
-    _setDispatching(false);
-    assertEq(_getDispatching(), false, "dispatching starts false");
-
-    _setDispatching(true);
-    assertEq(_getDispatching(), true, "dispatching set to true");
-
-    _setDispatching(false);
-    assertEq(_getDispatching(), false, "dispatching reset to false");
-  }
-
-  // ─── skipDepth accessors ────────────────────────────────────────────────
-  console.log("\n=== reentrancy guard: skipDepth accessors round-trip ===");
-  {
-    _setSkipDepth(0);
-    assertEq(_getSkipDepth(), 0, "skipDepth starts at 0");
-
-    _setSkipDepth(3);
-    assertEq(_getSkipDepth(), 3, "skipDepth set to 3");
-
-    _setSkipDepth(0);
-    assertEq(_getSkipDepth(), 0, "skipDepth reset to 0");
-  }
-
-  // ─── Guard blocks even when skipDepth > 0 (#1272 regression) ───────────
-  console.log("\n=== reentrancy guard: blocks when dispatching=true regardless of skipDepth ===");
-  {
-    // Simulate the scenario from #1272: dispatching=true + skipDepth>0
-    // The old guard (`if (s.dispatching && s.skipDepth === 0)`) would allow
-    // concurrent entry when skipDepth > 0. The fix makes the check
-    // unconditional on skipDepth.
-    _setDispatching(true);
-    _setSkipDepth(2);
-
-    // Verify dispatching is true — guard should block regardless of skipDepth
-    assertTrue(
-      _getDispatching() === true,
-      "dispatching flag is true during skip chain"
-    );
-
-    // The actual reentrancy guard in dispatchNextUnit checks:
-    //   if (s.dispatching) { return; }
-    // We verify the state that would trigger the guard:
-    const wouldBlock = _getDispatching(); // unconditional check
-    const wouldBlockOld = _getDispatching() && _getSkipDepth() === 0; // old check
-
-    assertTrue(wouldBlock === true, "new guard blocks when dispatching=true, skipDepth=2");
-    assertTrue(wouldBlockOld === false, "old guard WOULD NOT block when dispatching=true, skipDepth=2 (the bug)");
-
-    // Clean up
-    _setDispatching(false);
-    _setSkipDepth(0);
-  }
-
-  // ─── Guard allows entry when dispatching=false ──────────────────────────
-  console.log("\n=== reentrancy guard: allows entry when dispatching=false ===");
-  {
-    _setDispatching(false);
-    _setSkipDepth(0);
-    assertTrue(!_getDispatching(), "guard allows entry when dispatching=false, skipDepth=0");
-
-    _setDispatching(false);
-    _setSkipDepth(3);
-    assertTrue(!_getDispatching(), "guard allows entry when dispatching=false, skipDepth=3");
-
-    _setSkipDepth(0);
-  }
-
-  // ─── skipDepth does not affect guard decision (the fix) ─────────────────
-  console.log("\n=== reentrancy guard: skipDepth is irrelevant to guard decision ===");
-  {
-    for (const depth of [0, 1, 2, 5]) {
-      _setDispatching(true);
-      _setSkipDepth(depth);
-      assertTrue(
-        _getDispatching() === true,
-        `guard blocks at skipDepth=${depth} when dispatching=true`
-      );
-    }
-
-    for (const depth of [0, 1, 2, 5]) {
-      _setDispatching(false);
-      _setSkipDepth(depth);
-      assertTrue(
-        _getDispatching() === false,
-        `guard allows at skipDepth=${depth} when dispatching=false`
-      );
-    }
-
-    // Clean up
-    _setDispatching(false);
-    _setSkipDepth(0);
-  }
-
-  report();
-}
-
-main().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});

package/dist/resources/extensions/gsd/tests/auto-secrets-gate.test.ts

@@ -1,302 +0,0 @@
-/**
- * Integration tests for the secrets collection gate in startAuto().
- *
- * Exercises getManifestStatus() → collectSecretsFromManifest() composition
- * end-to-end using real filesystem state. Proves the gate paths:
- *   1. No manifest exists — gate skips silently
- *   2. Pending keys exist — gate triggers collection (direct call)
- *   3. No pending keys — gate skips silently
- *   4. Pending keys in auto-mode — session pauses instead of blocking (#1146)
- *
- * Uses temp directories with real .gsd/milestones/M001/ structure, mirroring
- * the pattern from manifest-status.test.ts.
- */
-
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { getManifestStatus } from '../files.ts';
-import { collectSecretsFromManifest } from '../../get-secrets-from-user.ts';
-import { AutoSession } from '../auto/session.ts';
-
-function makeTempDir(prefix: string): string {
-  const dir = join(tmpdir(), `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
-
-/** Create the .gsd/milestones/M001/ directory structure and write a secrets manifest. */
-function writeManifest(base: string, content: string): void {
-  const mDir = join(base, '.gsd', 'milestones', 'M001');
-  mkdirSync(mDir, { recursive: true });
-  writeFileSync(join(mDir, 'M001-SECRETS.md'), content);
-}
-
-/** Stub ctx with hasUI: false — collectOneSecret returns null (skip), showSecretsSummary is a no-op. */
-function makeNoUICtx(cwd: string) {
-  return {
-    ui: {},
-    hasUI: false,
-    cwd,
-  };
-}
-
-// ─── Scenario 1: No manifest exists ──────────────────────────────────────────
-
-test('secrets gate: no manifest exists — getManifestStatus returns null', async () => {
-  const tmp = makeTempDir('gate-no-manifest');
-  try {
-    // No .gsd directory at all
-    const result = await getManifestStatus(tmp, 'M001');
-    assert.strictEqual(result, null, 'should return null when no manifest file exists');
-  } finally {
-    rmSync(tmp, { recursive: true, force: true });
-  }
-});
-
-// ─── Scenario 2: Pending keys exist ─────────────────────────────────────────
-
-test('secrets gate: pending keys exist — gate triggers collection, manifest updated on disk', async () => {
-  const tmp = makeTempDir('gate-pending');
-  const savedA = process.env.GSD_GATE_TEST_EXISTING;
-  try {
-    // Simulate one key already in env
-    process.env.GSD_GATE_TEST_EXISTING = 'already-here';
-
-    // Ensure pending keys are NOT in env
-    delete process.env.GSD_GATE_TEST_PEND_A;
-    delete process.env.GSD_GATE_TEST_PEND_B;
-
-    writeManifest(tmp, `# Secrets Manifest
-
-**Milestone:** M001
-**Generated:** 2025-06-20T10:00:00Z
-
-### GSD_GATE_TEST_PEND_A
-
-**Service:** ServiceA
-**Status:** pending
-**Destination:** dotenv
-
-1. Get key A from dashboard
-
-### GSD_GATE_TEST_PEND_B
-
-**Service:** ServiceB
-**Status:** pending
-**Destination:** dotenv
-
-1. Get key B from dashboard
-
-### GSD_GATE_TEST_EXISTING
-
-**Service:** ServiceC
-**Status:** pending
-**Destination:** dotenv
-
-1. Already in env
-`);
-
-    // (a) Verify getManifestStatus shows pending keys
-    const status = await getManifestStatus(tmp, 'M001');
-    assert.notStrictEqual(status, null, 'manifest should exist');
-    assert.ok(status!.pending.length > 0, 'should have pending keys');
-    assert.deepStrictEqual(status!.pending, ['GSD_GATE_TEST_PEND_A', 'GSD_GATE_TEST_PEND_B']);
-    assert.deepStrictEqual(status!.existing, ['GSD_GATE_TEST_EXISTING']);
-
-    // (b) Call collectSecretsFromManifest with no-UI context
-    // With hasUI: false, collectOneSecret returns null → pending keys become "skipped"
-    const result = await collectSecretsFromManifest(tmp, 'M001', makeNoUICtx(tmp));
-
-    // (c) Verify return shape
-    assert.deepStrictEqual(result.applied, [], 'no keys applied (no UI to enter values)');
-    assert.ok(result.skipped.includes('GSD_GATE_TEST_PEND_A'), 'PEND_A should be skipped');
-    assert.ok(result.skipped.includes('GSD_GATE_TEST_PEND_B'), 'PEND_B should be skipped');
-    assert.deepStrictEqual(result.existingSkipped, ['GSD_GATE_TEST_EXISTING']);
-
-    // (d) Verify manifest on disk was updated — pending entries that went through
-    // collection are now "skipped". The existing-in-env entry retains its manifest
-    // status ("pending") because collectSecretsFromManifest only updates entries
-    // that flow through collectOneSecret. At runtime, getManifestStatus overrides
-    // env-present entries to "existing" regardless of manifest status.
-    const manifestPath = join(tmp, '.gsd', 'milestones', 'M001', 'M001-SECRETS.md');
-    const updatedContent = readFileSync(manifestPath, 'utf8');
-    assert.ok(
-      updatedContent.includes('**Status:** skipped'),
-      'formerly-pending entries should now have status "skipped" in the manifest file',
-    );
-    // Count: PEND_A → skipped, PEND_B → skipped, EXISTING stays pending on disk
-    const skippedMatches = updatedContent.match(/\*\*Status:\*\* skipped/g);
-    assert.strictEqual(skippedMatches?.length, 2, 'two entries should have status "skipped"');
-    const pendingMatches = updatedContent.match(/\*\*Status:\*\* pending/g);
-    assert.strictEqual(pendingMatches?.length, 1, 'one entry (existing-in-env) retains pending on disk');
-
-    // (e) Verify getManifestStatus now shows no pending
-    const statusAfter = await getManifestStatus(tmp, 'M001');
-    assert.notStrictEqual(statusAfter, null);
-    assert.deepStrictEqual(statusAfter!.pending, [], 'no pending keys after collection');
-  } finally {
-    delete process.env.GSD_GATE_TEST_EXISTING;
-    if (savedA !== undefined) process.env.GSD_GATE_TEST_EXISTING = savedA;
-    delete process.env.GSD_GATE_TEST_PEND_A;
-    delete process.env.GSD_GATE_TEST_PEND_B;
-    rmSync(tmp, { recursive: true, force: true });
-  }
-});
-
-// ─── Scenario 3: No pending keys — all collected or in env ──────────────────
-
-// ─── Scenario 4: Pending keys pause AutoSession instead of blocking (#1146) ──
-
-test('secrets gate: pending keys set pausedForSecrets on AutoSession', async () => {
-  const tmp = makeTempDir('gate-pause-session');
-  try {
-    // Ensure pending keys are NOT in env
-    delete process.env.GSD_PAUSE_TEST_KEY_A;
-    delete process.env.GSD_PAUSE_TEST_KEY_B;
-
-    writeManifest(tmp, `# Secrets Manifest
-
-**Milestone:** M001
-**Generated:** 2025-06-20T10:00:00Z
-
-### GSD_PAUSE_TEST_KEY_A
-
-**Service:** ServiceA
-**Status:** pending
-**Destination:** dotenv
-
-1. Get key A from dashboard
-
-### GSD_PAUSE_TEST_KEY_B
-
-**Service:** ServiceB
-**Status:** pending
-**Destination:** dotenv
-
-1. Get key B from dashboard
-`);
-
-    // Verify manifest has pending keys
-    const status = await getManifestStatus(tmp, 'M001');
-    assert.notStrictEqual(status, null, 'manifest should exist');
-    assert.deepStrictEqual(status!.pending, ['GSD_PAUSE_TEST_KEY_A', 'GSD_PAUSE_TEST_KEY_B']);
-
-    // Simulate what auto-start.ts now does: set pause flags on session
-    const session = new AutoSession();
-    session.active = true;
-    session.currentMilestoneId = 'M001';
-
-    // The new gate logic: if pending keys exist, pause instead of collecting
-    if (status!.pending.length > 0) {
-      session.paused = true;
-      session.pausedForSecrets = true;
-    }
-
-    assert.strictEqual(session.paused, true, 'session should be paused');
-    assert.strictEqual(session.pausedForSecrets, true, 'pausedForSecrets flag should be set');
-
-    // Verify reset() clears pausedForSecrets
-    session.reset();
-    assert.strictEqual(session.pausedForSecrets, false, 'reset() should clear pausedForSecrets');
-  } finally {
-    delete process.env.GSD_PAUSE_TEST_KEY_A;
-    delete process.env.GSD_PAUSE_TEST_KEY_B;
-    rmSync(tmp, { recursive: true, force: true });
-  }
-});
-
-test('secrets gate: no pending keys do not set pausedForSecrets', async () => {
-  const tmp = makeTempDir('gate-no-pause');
-  const savedKey = process.env.GSD_NO_PAUSE_TEST_KEY;
-  try {
-    process.env.GSD_NO_PAUSE_TEST_KEY = 'already-set';
-
-    writeManifest(tmp, `# Secrets Manifest
-
-**Milestone:** M001
-**Generated:** 2025-06-20T10:00:00Z
-
-### GSD_NO_PAUSE_TEST_KEY
-
-**Service:** ServiceX
-**Status:** pending
-**Destination:** dotenv
-
-1. Already in env
-`);
-
-    const status = await getManifestStatus(tmp, 'M001');
-    assert.notStrictEqual(status, null, 'manifest should exist');
-    assert.deepStrictEqual(status!.pending, [], 'no pending keys — already in env');
-
-    // Simulate gate logic — no pending keys, no pause
-    const session = new AutoSession();
-    session.active = true;
-
-    if (status!.pending.length > 0) {
-      session.paused = true;
-      session.pausedForSecrets = true;
-    }
-
-    assert.strictEqual(session.paused, false, 'session should NOT be paused');
-    assert.strictEqual(session.pausedForSecrets, false, 'pausedForSecrets should NOT be set');
-  } finally {
-    delete process.env.GSD_NO_PAUSE_TEST_KEY;
-    if (savedKey !== undefined) process.env.GSD_NO_PAUSE_TEST_KEY = savedKey;
-    rmSync(tmp, { recursive: true, force: true });
-  }
-});
-
-// ─── Scenario 3: No pending keys — all collected or in env ──────────────────
-
-test('secrets gate: no pending keys — getManifestStatus shows pending.length === 0', async () => {
-  const tmp = makeTempDir('gate-no-pending');
-  const savedKey = process.env.GSD_GATE_TEST_ENVKEY;
-  try {
-    process.env.GSD_GATE_TEST_ENVKEY = 'some-value';
-
-    writeManifest(tmp, `# Secrets Manifest
-
-**Milestone:** M001
-**Generated:** 2025-06-20T10:00:00Z
-
-### ALREADY_COLLECTED
-
-**Service:** ServiceX
-**Status:** collected
-**Destination:** dotenv
-
-1. Was collected previously
-
-### ALREADY_SKIPPED
-
-**Service:** ServiceY
-**Status:** skipped
-**Destination:** dotenv
-
-1. Not needed
-
-### GSD_GATE_TEST_ENVKEY
-
-**Service:** ServiceZ
-**Status:** pending
-**Destination:** dotenv
-
-1. In env already
-`);
-
-    const result = await getManifestStatus(tmp, 'M001');
-    assert.notStrictEqual(result, null, 'manifest should exist');
-    assert.deepStrictEqual(result!.pending, [], 'no pending keys — gate would skip');
-    assert.deepStrictEqual(result!.collected, ['ALREADY_COLLECTED']);
-    assert.deepStrictEqual(result!.skipped, ['ALREADY_SKIPPED']);
-    assert.deepStrictEqual(result!.existing, ['GSD_GATE_TEST_ENVKEY']);
-  } finally {
-    delete process.env.GSD_GATE_TEST_ENVKEY;
-    if (savedKey !== undefined) process.env.GSD_GATE_TEST_ENVKEY = savedKey;
-    rmSync(tmp, { recursive: true, force: true });
-  }
-});

package/dist/resources/extensions/gsd/tests/auto-session-encapsulation.test.ts

@@ -1,257 +0,0 @@
-/**
- * auto-session-encapsulation.test.ts — Guards the AutoSession encapsulation invariant.
- *
- * All mutable auto-mode state must live in AutoSession (auto/session.ts).
- * auto.ts must not declare module-level `let` or `var` variables.
- *
- * These tests parse auto.ts source to detect violations, so they fail at
- * test time — before a PR merges — when someone accidentally adds mutable
- * module-level state to auto.ts instead of AutoSession.
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const AUTO_TS_PATH = join(__dirname, "..", "auto.ts");
-const SESSION_TS_PATH = join(__dirname, "..", "auto", "session.ts");
-
-function getAutoTsSource(): string {
-  return readFileSync(AUTO_TS_PATH, "utf-8");
-}
-
-function getSessionTsSource(): string {
-  return readFileSync(SESSION_TS_PATH, "utf-8");
-}
-
-// ── Invariant 1: No module-level mutable variables in auto.ts ────────────────
-
-test("auto.ts has no module-level let declarations", () => {
-  const source = getAutoTsSource();
-  const lines = source.split("\n");
-  const violations: string[] = [];
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]!;
-    // Match lines starting with `let ` or `export let ` (module-level)
-    // Skip lines inside functions/blocks (indented)
-    if (/^(export\s+)?let\s+/.test(line)) {
-      violations.push(`line ${i + 1}: ${line.trim()}`);
-    }
-  }
-
-  assert.equal(
-    violations.length,
-    0,
-    `auto.ts must not have module-level \`let\` declarations. ` +
-    `All mutable state belongs in AutoSession (auto/session.ts).\n` +
-    `Violations:\n${violations.join("\n")}`,
-  );
-});
-
-test("auto.ts has no module-level var declarations", () => {
-  const source = getAutoTsSource();
-  const lines = source.split("\n");
-  const violations: string[] = [];
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]!;
-    if (/^(export\s+)?var\s+/.test(line)) {
-      violations.push(`line ${i + 1}: ${line.trim()}`);
-    }
-  }
-
-  assert.equal(
-    violations.length,
-    0,
-    `auto.ts must not have module-level \`var\` declarations. ` +
-    `All mutable state belongs in AutoSession (auto/session.ts).\n` +
-    `Violations:\n${violations.join("\n")}`,
-  );
-});
-
-// ── Invariant 2: AutoSession singleton is the only mutable module-level binding ──
-
-test("auto.ts has exactly one module-level const for AutoSession", () => {
-  const source = getAutoTsSource();
-  const lines = source.split("\n");
-
-  const sessionConsts = lines.filter(line =>
-    /^const\s+\w+\s*=\s*new\s+AutoSession/.test(line),
-  );
-
-  assert.equal(
-    sessionConsts.length,
-    1,
-    `auto.ts should have exactly one \`const s = new AutoSession()\`. ` +
-    `Found ${sessionConsts.length}: ${sessionConsts.join(", ")}`,
-  );
-});
-
-// ── Invariant 3: AutoSession.reset() covers all instance properties ──────────
-
-test("AutoSession.reset() references every instance property", () => {
-  const source = getSessionTsSource();
-
-  // Extract property names from class body (lines like `  propName = ...` or `  propName:`)
-  // Skip readonly collections (Maps/Sets) that use .clear() instead of reassignment
-  const propertyPattern = /^\s+(readonly\s+)?(\w+)\s*[:=]/;
-  const properties: string[] = [];
-  let inClass = false;
-  let inMethod = false;
-  let braceDepth = 0;
-
-  for (const line of source.split("\n")) {
-    if (/^export class AutoSession/.test(line)) {
-      inClass = true;
-      braceDepth = 0;
-      continue;
-    }
-    if (!inClass) continue;
-
-    // Track brace depth to distinguish properties from method bodies
-    for (const ch of line) {
-      if (ch === "{") braceDepth++;
-      if (ch === "}") braceDepth--;
-    }
-
-    // Class-level properties are at brace depth 1 (inside the class, outside methods)
-    if (braceDepth === 1 && !inMethod) {
-      const match = line.match(propertyPattern);
-      if (match && match[2]) {
-        const propName = match[2];
-        // Skip method-like names and type-only declarations
-        if (!["constructor", "clearTimers", "resetDispatchCounters", "lockBasePath",
-               "completeCurrentUnit", "reset", "toJSON"].includes(propName)) {
-          properties.push(propName);
-        }
-      }
-    }
-
-    // Detect method start/end
-    if (braceDepth === 1 && /^\s+(get |async )?(\w+)\s*\(/.test(line)) {
-      inMethod = true;
-    }
-    if (braceDepth === 1 && inMethod) {
-      inMethod = false;
-    }
-  }
-
-  // Extract the reset() method body
-  const resetMatch = source.match(/reset\(\): void \{([\s\S]*?)^\s{2}\}/m);
-  assert.ok(resetMatch, "AutoSession.reset() method not found");
-  const resetBody = resetMatch![1]!;
-
-  // completedKeySet is intentionally not cleared (documented in reset())
-  const intentionallySkipped = new Set(["completedKeySet"]);
-
-  const missingFromReset: string[] = [];
-  for (const prop of properties) {
-    if (intentionallySkipped.has(prop)) continue;
-    // Check if the property name appears in reset body (as `this.prop` assignment or `.clear()`)
-    if (!resetBody.includes(`this.${prop}`)) {
-      missingFromReset.push(prop);
-    }
-  }
-
-  assert.equal(
-    missingFromReset.length,
-    0,
-    `AutoSession.reset() must reference every instance property. ` +
-    `Missing: ${missingFromReset.join(", ")}. ` +
-    `If a property should persist across resets, add it to the intentionallySkipped set in this test.`,
-  );
-});
-
-// ── Invariant 4: AutoSession.toJSON() provides diagnostic visibility ─────────
-
-test("AutoSession.toJSON() includes key diagnostic properties", () => {
-  const source = getSessionTsSource();
-
-  const toJSONMatch = source.match(/toJSON\(\)[\s\S]*?return \{([\s\S]*?)\};/);
-  assert.ok(toJSONMatch, "AutoSession.toJSON() method not found");
-  const toJSONBody = toJSONMatch![1]!;
-
-  // These are the minimum properties needed for diagnostic snapshots
-  const requiredDiagnostics = [
-    "active",
-    "paused",
-    "basePath",
-    "currentMilestoneId",
-    "currentUnit",
-    "dispatching",
-  ];
-
-  const missing = requiredDiagnostics.filter(prop => !toJSONBody.includes(prop));
-
-  assert.equal(
-    missing.length,
-    0,
-    `AutoSession.toJSON() must include diagnostic properties: ${missing.join(", ")}`,
-  );
-});
-
-// ── Invariant 5: No state-bearing module-level consts that should be in AutoSession ──
-
-test("auto.ts module-level consts are only AutoSession instance, true constants, or static accessors", () => {
-  const source = getAutoTsSource();
-  const lines = source.split("\n");
-  const violations: string[] = [];
-
-  // Patterns that are acceptable at module level
-  const allowedPatterns = [
-    /^const s = new AutoSession/,                 // The session singleton
-    /^const [A-Z_]+\s*=/,                          // UPPER_CASE constants
-    /^const \w+StateAccessors/,                    // Static accessor objects
-    /^const \w+:\s*\w+\s*=/,                       // Typed constants
-  ];
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]!;
-    if (!/^(export\s+)?const\s+/.test(line)) continue;
-
-    const isAllowed = allowedPatterns.some(p => p.test(line.replace(/^export\s+/, "")));
-    if (!isAllowed) {
-      // Check if it looks like mutable state (arrays, objects with mutable semantics)
-      if (/= new (Map|Set|Array)\(/.test(line) || /= \[\]/.test(line)) {
-        violations.push(`line ${i + 1}: ${line.trim()}`);
-      }
-    }
-  }
-
-  assert.equal(
-    violations.length,
-    0,
-    `auto.ts has module-level const declarations that look like mutable state. ` +
-    `Move these into AutoSession:\n${violations.join("\n")}`,
-  );
-});
-
-// ── Invariant 6: session.ts file exists and exports AutoSession ──────────────
-
-test("auto/session.ts exports AutoSession class", () => {
-  const source = getSessionTsSource();
-  assert.ok(
-    /export class AutoSession/.test(source),
-    "auto/session.ts must export the AutoSession class",
-  );
-});
-
-test("AutoSession has a reset() method", () => {
-  const source = getSessionTsSource();
-  assert.ok(
-    /reset\(\): void/.test(source),
-    "AutoSession must have a reset(): void method",
-  );
-});
-
-test("AutoSession has a toJSON() method", () => {
-  const source = getSessionTsSource();
-  assert.ok(
-    /toJSON\(\)/.test(source),
-    "AutoSession must have a toJSON() method for diagnostics",
-  );
-});