gsd-pi 2.48.0 → 2.49.0-dev.9e177e9

package/src/resources/extensions/gsd/tests/run-uat.test.ts

@@ -171,7 +171,7 @@ test('(k) run-uat prompt template', () => {
   const milestoneId = 'M001';
   const sliceId = 'S01';
   const uatPath = '.gsd/milestones/M001/slices/S01/S01-UAT.md';
-  const uatResultPath = '.gsd/milestones/M001/slices/S01/S01-UAT-RESULT.md';
+  const uatResultPath = '.gsd/milestones/M001/slices/S01/S01-UAT.md';
   const uatType = 'live-runtime';
   const inlinedContext = '<!-- no context -->';
   let promptResult: string | undefined;
@@ -234,7 +234,7 @@ test('(k2) run-uat prompt references gsd_summary_save, not direct write', () =>
     milestoneId: 'M001',
     sliceId: 'S01',
     uatPath: '.gsd/milestones/M001/slices/S01/S01-UAT.md',
-    uatResultPath: '.gsd/milestones/M001/slices/S01/S01-UAT-RESULT.md',
+    uatResultPath: '.gsd/milestones/M001/slices/S01/S01-UAT.md',
     uatType: 'artifact-driven',
     inlinedContext: '<!-- no context -->',
   });
@@ -265,14 +265,13 @@ test('(l) dispatch preconditions via resolveSliceFile', () => {
         'resolveSliceFile(..., "UAT") returns non-null when UAT file exists (dispatch trigger state)',
       );
 
-      const uatResultFilePath = resolveSliceFile(base, 'M001', 'S01', 'UAT-RESULT');
-      assert.deepStrictEqual(
-        uatResultFilePath,
-        null,
-        'resolveSliceFile(..., "UAT-RESULT") returns null when result file missing (dispatch trigger state)',
+      // UAT spec without a verdict line means UAT has not been run yet
+      const rawContent = readFileSync(uatFilePath!, 'utf-8');
+      assert.ok(
+        !/verdict:\s*[\w-]+/i.test(rawContent),
+        'UAT file without verdict indicates UAT has not been run (dispatch trigger state)',
       );
 
-      const rawContent = readFileSync(uatFilePath!, 'utf-8');
       assert.deepStrictEqual(
         extractUatType(rawContent),
         'artifact-driven',
@@ -286,13 +285,18 @@ test('(l) dispatch preconditions via resolveSliceFile', () => {
 test('test block at line 307', () => {
     const base = createFixtureBase();
     try {
-      writeSliceFile(base, 'M001', 'S01', 'UAT', makeUatContent('artifact-driven'));
-      writeSliceFile(base, 'M001', 'S01', 'UAT-RESULT', '# UAT Result\n\nverdict: PASS\n');
+      // Write UAT file with a verdict — simulates completed UAT
+      writeSliceFile(base, 'M001', 'S01', 'UAT', '# UAT Result\n\nverdict: PASS\n');
 
-      const uatResultFilePath = resolveSliceFile(base, 'M001', 'S01', 'UAT-RESULT');
+      const uatFilePath = resolveSliceFile(base, 'M001', 'S01', 'UAT');
       assert.ok(
-        uatResultFilePath !== null,
-        'resolveSliceFile(..., "UAT-RESULT") returns non-null when result file exists (idempotent skip state)',
+        uatFilePath !== null,
+        'resolveSliceFile(..., "UAT") returns non-null when UAT file exists',
+      );
+      const content = readFileSync(uatFilePath!, 'utf-8');
+      assert.ok(
+        /verdict:\s*[\w-]+/i.test(content),
+        'UAT file with verdict indicates UAT has been completed (idempotent skip state)',
       );
     } finally {
       cleanup(base);
@@ -343,6 +347,74 @@ test('(m) non-artifact UAT skip', async () => {
     }
 });
 
+test('(o) verdict gate: PARTIAL is acceptable for mixed/human-experience/live-runtime UAT types', () => {
+    // This test verifies the contract that extractUatType correctly identifies
+    // the modes where PARTIAL should not block progression.
+    // The verdict gate in auto-dispatch.ts uses this to build acceptableVerdicts.
+    const mixedType = extractUatType(makeUatContent('mixed'));
+    const humanExpType = extractUatType(makeUatContent('human-experience'));
+    const liveRuntimeType = extractUatType(makeUatContent('live-runtime'));
+    const artifactType = extractUatType(makeUatContent('artifact-driven'));
+    const browserType = extractUatType(makeUatContent('browser-executable'));
+    const runtimeExecType = extractUatType(makeUatContent('runtime-executable'));
+
+    // These modes should allow PARTIAL (non-fully-automatable)
+    const partialAcceptableModes = ['mixed', 'human-experience', 'live-runtime'];
+    assert.ok(
+      partialAcceptableModes.includes(mixedType!),
+      `mixed → "${mixedType}" is in partialAcceptableModes`,
+    );
+    assert.ok(
+      partialAcceptableModes.includes(humanExpType!),
+      `human-experience → "${humanExpType}" is in partialAcceptableModes`,
+    );
+    assert.ok(
+      partialAcceptableModes.includes(liveRuntimeType!),
+      `live-runtime → "${liveRuntimeType}" is in partialAcceptableModes`,
+    );
+
+    // These modes should NOT allow PARTIAL (fully automatable)
+    assert.ok(
+      !partialAcceptableModes.includes(artifactType!),
+      `artifact-driven → "${artifactType}" is NOT in partialAcceptableModes`,
+    );
+    assert.ok(
+      !partialAcceptableModes.includes(browserType!),
+      `browser-executable → "${browserType}" is NOT in partialAcceptableModes`,
+    );
+    assert.ok(
+      !partialAcceptableModes.includes(runtimeExecType!),
+      `runtime-executable → "${runtimeExecType}" is NOT in partialAcceptableModes`,
+    );
+});
+
+test('(p) run-uat prompt allows PASS when human-only checks remain as NEEDS-HUMAN', () => {
+    const promptResult = loadPromptFromWorktree('run-uat', {
+      workingDirectory: '/tmp/test-project',
+      milestoneId: 'M001',
+      sliceId: 'S01',
+      uatPath: '.gsd/milestones/M001/slices/S01/S01-UAT.md',
+      uatResultPath: '.gsd/milestones/M001/slices/S01/S01-UAT.md',
+      uatType: 'mixed',
+      inlinedContext: '<!-- no context -->',
+    });
+
+    // PASS verdict should be usable when automatable checks pass (even with NEEDS-HUMAN remaining)
+    assert.ok(
+      /PASS.*automatable checks passed/i.test(promptResult),
+      'prompt defines PASS as valid when all automatable checks passed',
+    );
+    assert.ok(
+      /PARTIAL.*automatable checks.*(skipped|inconclusive)/i.test(promptResult),
+      'prompt reserves PARTIAL for when automatable checks themselves are inconclusive',
+    );
+    // human-experience mode should NOT force PARTIAL when automatable checks pass
+    assert.ok(
+      !promptResult.includes('use an overall verdict of `PARTIAL`'),
+      'prompt does not force PARTIAL verdict for human-experience mode',
+    );
+});
+
 test('(n) stale replay guard', async () => {
     const base = createFixtureBase();
     try {
@@ -364,7 +436,7 @@ test('(n) stale replay guard', async () => {
       );
 
       writeSliceFile(base, 'M001', 'S01', 'UAT', makeUatContent('artifact-driven'));
-      writeSliceFile(base, 'M001', 'S01', 'UAT-RESULT', '---\nverdict: FAIL\n---\n');
+      writeSliceFile(base, 'M001', 'S01', 'UAT', '---\nverdict: FAIL\n---\n');
 
       const state = {
         activeMilestone: { id: 'M001', title: 'Test roadmap' },
@@ -381,7 +453,7 @@ test('(n) stale replay guard', async () => {
       assert.deepStrictEqual(
         result,
         null,
-        'existing UAT-RESULT with FAIL verdict does not re-dispatch; verdict gate owns blocking',
+        'existing UAT with FAIL verdict does not re-dispatch; verdict gate owns blocking',
       );
     } finally {
       cleanup(base);

package/src/resources/extensions/gsd/tests/session-lock-transient-read.test.ts

@@ -0,0 +1,223 @@
+/**
+ * session-lock-transient-read.test.ts — Tests for transient lock file unreadability (#2324).
+ *
+ * Regression coverage for:
+ *   #2324  onCompromised declares lock lost when the lock file is temporarily
+ *          unreadable (NFS/CIFS latency, macOS APFS snapshot, concurrent process
+ *          briefly holding the file).
+ *
+ * Tests:
+ *   - readExistingLockDataWithRetry retries on transient read failure
+ *   - readExistingLockDataWithRetry returns data when file becomes readable after retries
+ *   - readExistingLockDataWithRetry returns null only when ALL retries exhausted
+ *   - onCompromised does not declare compromise when lock file is transiently unreadable
+ */
+
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, renameSync, unlinkSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { execSync, spawn } from 'node:child_process';
+
+import {
+  acquireSessionLock,
+  getSessionLockStatus,
+  releaseSessionLock,
+  readExistingLockDataWithRetry,
+  type SessionLockData,
+} from '../session-lock.ts';
+import { gsdRoot } from '../paths.ts';
+import { createTestContext } from './test-helpers.ts';
+
+const { assertEq, assertTrue, report } = createTestContext();
+
+async function main(): Promise<void> {
+
+  // ─── 1. readExistingLockDataWithRetry succeeds on first read when file is fine ─
+  console.log('\n=== 1. readExistingLockDataWithRetry reads file normally ===');
+  {
+    const base = mkdtempSync(join(tmpdir(), 'gsd-transient-'));
+    mkdirSync(join(base, '.gsd'), { recursive: true });
+
+    try {
+      const lockFile = join(gsdRoot(base), 'auto.lock');
+      const lockData: SessionLockData = {
+        pid: process.pid,
+        startedAt: new Date().toISOString(),
+        unitType: 'execute-task',
+        unitId: 'M001/S01/T01',
+        unitStartedAt: new Date().toISOString(),
+        sessionFile: 'test-session.json',
+      };
+      writeFileSync(lockFile, JSON.stringify(lockData, null, 2));
+
+      const result = readExistingLockDataWithRetry(lockFile);
+      assertTrue(result !== null, 'data returned for readable file');
+      assertEq(result!.pid, process.pid, 'correct PID read');
+      assertEq(result!.sessionFile, 'test-session.json', 'correct sessionFile read');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  }
+
+  // ─── 2. readExistingLockDataWithRetry returns null for truly missing file ──
+  console.log('\n=== 2. readExistingLockDataWithRetry returns null for missing file ===');
+  {
+    const base = mkdtempSync(join(tmpdir(), 'gsd-transient-'));
+    mkdirSync(join(base, '.gsd'), { recursive: true });
+
+    try {
+      const lockFile = join(gsdRoot(base), 'auto.lock');
+      // File doesn't exist
+      const result = readExistingLockDataWithRetry(lockFile, { maxAttempts: 2, delayMs: 10 });
+      assertEq(result, null, 'null for truly missing file after retries');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  }
+
+  // ─── 3. readExistingLockDataWithRetry recovers after transient rename ──────
+  console.log('\n=== 3. readExistingLockDataWithRetry recovers after transient unavailability ===');
+  {
+    const base = mkdtempSync(join(tmpdir(), 'gsd-transient-'));
+    mkdirSync(join(base, '.gsd'), { recursive: true });
+
+    try {
+      const lockFile = join(gsdRoot(base), 'auto.lock');
+      const tmpFile = lockFile + '.hidden';
+      const lockData: SessionLockData = {
+        pid: process.pid,
+        startedAt: new Date().toISOString(),
+        unitType: 'execute-task',
+        unitId: 'M001/S01/T01',
+        unitStartedAt: new Date().toISOString(),
+        sessionFile: 'recovery-session.json',
+      };
+      writeFileSync(lockFile, JSON.stringify(lockData, null, 2));
+
+      // Simulate transient unavailability: move file away, spawn a child process
+      // to restore it after 100ms. The child runs outside our event loop so it
+      // fires even during busy-wait retries.
+      renameSync(lockFile, tmpFile);
+      spawn('bash', ['-c', `sleep 0.1 && mv "${tmpFile}" "${lockFile}"`], { stdio: 'ignore', detached: true }).unref();
+
+      // With retries (3 attempts, 200ms delay), it should recover on 2nd or 3rd attempt
+      const result = readExistingLockDataWithRetry(lockFile, { maxAttempts: 3, delayMs: 200 });
+      assertTrue(result !== null, 'data recovered after transient unavailability');
+      if (result) {
+        assertEq(result.pid, process.pid, 'correct PID after recovery');
+        assertEq(result.sessionFile, 'recovery-session.json', 'correct sessionFile after recovery');
+      }
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  }
+
+  // ─── 4. readExistingLockDataWithRetry recovers from transient permission error ─
+  console.log('\n=== 4. readExistingLockDataWithRetry recovers from transient permission error ===');
+  {
+    const base = mkdtempSync(join(tmpdir(), 'gsd-transient-'));
+    mkdirSync(join(base, '.gsd'), { recursive: true });
+
+    try {
+      const lockFile = join(gsdRoot(base), 'auto.lock');
+      const lockData: SessionLockData = {
+        pid: process.pid,
+        startedAt: new Date().toISOString(),
+        unitType: 'execute-task',
+        unitId: 'M001/S01/T01',
+        unitStartedAt: new Date().toISOString(),
+        sessionFile: 'perm-session.json',
+      };
+      writeFileSync(lockFile, JSON.stringify(lockData, null, 2));
+
+      // Remove read permission to simulate NFS/CIFS latency, then spawn a child
+      // to restore permissions after 100ms (runs outside our event loop).
+      chmodSync(lockFile, 0o000);
+      spawn('bash', ['-c', `sleep 0.1 && chmod 644 "${lockFile}"`], { stdio: 'ignore', detached: true }).unref();
+
+      const result = readExistingLockDataWithRetry(lockFile, { maxAttempts: 3, delayMs: 200 });
+      assertTrue(result !== null, 'data recovered after transient permission error');
+      if (result) {
+        assertEq(result.pid, process.pid, 'correct PID after permission recovery');
+      }
+
+      // Ensure permissions restored for cleanup
+      try { chmodSync(lockFile, 0o644); } catch { /* best-effort */ }
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  }
+
+  // ─── 5. getSessionLockStatus does not false-positive on transient read failure ─
+  console.log('\n=== 5. getSessionLockStatus tolerates transient lock file unavailability ===');
+  {
+    const base = mkdtempSync(join(tmpdir(), 'gsd-transient-'));
+    mkdirSync(join(base, '.gsd'), { recursive: true });
+
+    try {
+      const result = acquireSessionLock(base);
+      assertTrue(result.acquired, 'lock acquired');
+
+      // Validate works initially
+      const status1 = getSessionLockStatus(base);
+      assertTrue(status1.valid, 'lock valid before transient failure');
+
+      // Temporarily hide the lock file
+      const lockFile = join(gsdRoot(base), 'auto.lock');
+      const tmpFile = lockFile + '.hidden';
+      renameSync(lockFile, tmpFile);
+
+      // Schedule restoration
+      setTimeout(() => {
+        try { renameSync(tmpFile, lockFile); } catch { /* best-effort */ }
+      }, 30);
+
+      // Small delay to ensure restoration runs, then check — with the OS lock
+      // still held, getSessionLockStatus should return valid=true even if the
+      // lock file was briefly missing (it checks _releaseFunction first).
+      await new Promise(r => setTimeout(r, 60));
+      const status2 = getSessionLockStatus(base);
+      assertTrue(status2.valid, 'lock still valid after transient file disappearance (OS lock held)');
+
+      // Restore if not yet restored
+      try { renameSync(tmpFile, lockFile); } catch { /* already restored */ }
+
+      releaseSessionLock(base);
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  }
+
+  // ─── 6. Retry defaults: 3 attempts with 200ms delay ────────────────────────
+  console.log('\n=== 6. Default retry params: function works with defaults ===');
+  {
+    const base = mkdtempSync(join(tmpdir(), 'gsd-transient-'));
+    mkdirSync(join(base, '.gsd'), { recursive: true });
+
+    try {
+      const lockFile = join(gsdRoot(base), 'auto.lock');
+      const lockData: SessionLockData = {
+        pid: process.pid,
+        startedAt: new Date().toISOString(),
+        unitType: 'execute-task',
+        unitId: 'M001/S01/T01',
+        unitStartedAt: new Date().toISOString(),
+        sessionFile: 'status-session.json',
+      };
+      writeFileSync(lockFile, JSON.stringify(lockData, null, 2));
+
+      // Call with no options — uses defaults (3 attempts, 200ms)
+      const result = readExistingLockDataWithRetry(lockFile);
+      assertTrue(result !== null, 'default params work for readable file');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  }
+
+  report();
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/src/resources/extensions/gsd/tests/skill-activation.test.ts

@@ -75,7 +75,7 @@ test("buildSkillActivationBlock activates skills via prefer_skills when context
       prefer_skills: ["react"],
     });
 
-    assert.match(result, /Call Skill\('react'\)/);
+    assert.match(result, /Call Skill\(\{ skill: 'react' \}\)/);
     assert.doesNotMatch(result, /swiftui/);
   } finally {
     cleanup(base);
@@ -92,7 +92,7 @@ test("buildSkillActivationBlock includes always_use_skills from preferences usin
       always_use_skills: ["swift-testing"],
     });
 
-    assert.equal(result, "<skill_activation>Call Skill('swift-testing').</skill_activation>");
+    assert.equal(result, "<skill_activation>Call Skill({ skill: 'swift-testing' }).</skill_activation>");
   } finally {
     cleanup(base);
   }
@@ -120,8 +120,8 @@ test("buildSkillActivationBlock includes skill_rules matches and task-plan skill
       skill_rules: [{ when: "prisma database schema", use: ["prisma"] }],
     });
 
-    assert.match(result, /Call Skill\('accessibility'\)/);
-    assert.match(result, /Call Skill\('prisma'\)/);
+    assert.match(result, /Call Skill\(\{ skill: 'accessibility' \}\)/);
+    assert.match(result, /Call Skill\(\{ skill: 'prisma' \}\)/);
   } finally {
     cleanup(base);
   }
@@ -191,3 +191,43 @@ test("buildSkillActivationBlock does not activate skills from extraContext or ta
     cleanup(base);
   }
 });
+
+test("buildSkillActivationBlock rejects skill names with special characters", () => {
+  const base = makeTempBase();
+  try {
+    // Skill names with quotes, braces, or other non-alphanumeric characters are
+    // rejected by the SAFE_SKILL_NAME guard to prevent prompt injection.
+    writeSkill(base, "my-skill's", "Skill with apostrophe in name.");
+    loadOnlyTestSkills(base);
+
+    const result = buildBlock(base, {}, {
+      always_use_skills: ["my-skill's"],
+    });
+
+    // Unsafe skill name is filtered out — empty result
+    assert.equal(result, "");
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("buildSkillActivationBlock allows valid skill names and rejects invalid ones", () => {
+  const base = makeTempBase();
+  try {
+    writeSkill(base, "react", "React skill.");
+    writeSkill(base, "bad'name", "Injection attempt.");
+    writeSkill(base, "good-skill-2", "Another valid skill.");
+    loadOnlyTestSkills(base);
+
+    const result = buildBlock(base, {}, {
+      always_use_skills: ["react", "bad'name", "good-skill-2"],
+    });
+
+    assert.match(result, /skill_activation/);
+    assert.match(result, /Call Skill\(\{ skill: 'react' \}\)/);
+    assert.match(result, /Call Skill\(\{ skill: 'good-skill-2' \}\)/);
+    assert.doesNotMatch(result, /bad'name/);
+  } finally {
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/tool-naming.test.ts

@@ -44,7 +44,7 @@ console.log('\n── Tool naming: registration count ──');
 const pi = makeMockPi();
 registerDbTools(pi);
 
-assert.deepStrictEqual(pi.tools.length, 26, 'Should register exactly 26 tools (13 canonical + 13 aliases)');
+assert.deepStrictEqual(pi.tools.length, 27, 'Should register exactly 27 tools (13 canonical + 13 aliases + 1 gate tool)');
 
 // ─── Both names exist for each pair ──────────────────────────────────────────
 

package/src/resources/extensions/gsd/tests/validate-milestone.test.ts

@@ -6,7 +6,8 @@ import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
 
 import { deriveState, isValidationTerminal } from "../state.ts";
-import { resolveExpectedArtifactPath, verifyExpectedArtifact, diagnoseExpectedArtifact, buildLoopRemediationSteps } from "../auto-recovery.ts";
+import { resolveExpectedArtifactPath, diagnoseExpectedArtifact } from "../auto-artifact-paths.ts";
+import { verifyExpectedArtifact, buildLoopRemediationSteps } from "../auto-recovery.ts";
 import { resolveDispatch, type DispatchContext } from "../auto-dispatch.ts";
 import type { GSDState } from "../types.ts";
 import { clearPathCache } from "../paths.ts";

package/src/resources/extensions/gsd/tests/verification-gate.test.ts

@@ -226,8 +226,6 @@ describe("verification-gate: execution", () => {
 
   test("all commands pass → gate passes", () => {
     const result = runVerificationGate({
-      basePath: tmp,
-      unitId: "T01",
       cwd: tmp,
       preferenceCommands: ["echo hello", "echo world"],
     });
@@ -243,8 +241,6 @@ describe("verification-gate: execution", () => {
 
   test("one command fails → gate fails with exit code + stderr", () => {
     const result = runVerificationGate({
-      basePath: tmp,
-      unitId: "T01",
       cwd: tmp,
       preferenceCommands: ["echo ok", "sh -c 'echo err >&2; exit 1'"],
     });
@@ -257,8 +253,6 @@ describe("verification-gate: execution", () => {
 
   test("no commands discovered → gate passes with 0 checks", () => {
     const result = runVerificationGate({
-      basePath: tmp,
-      unitId: "T01",
       cwd: tmp,
     });
     assert.equal(result.passed, true);
@@ -268,8 +262,6 @@ describe("verification-gate: execution", () => {
 
   test("command not found → exit code 127", () => {
     const result = runVerificationGate({
-      basePath: tmp,
-      unitId: "T01",
       cwd: tmp,
       preferenceCommands: ["__nonexistent_command_xyz_42__"],
     });
@@ -289,8 +281,6 @@ describe("verification-gate: execution", () => {
     const script = [
       `import { runVerificationGate } from ${JSON.stringify(pathToFileURL(gatePath).href)};`,
       `runVerificationGate({`,
-      `  basePath: ${JSON.stringify(tmp)},`,
-      `  unitId: "T-DEP",`,
       `  cwd: ${JSON.stringify(tmp)},`,
       `  preferenceCommands: ["echo dep0190-check"],`,
       `});`,
@@ -317,8 +307,6 @@ describe("verification-gate: execution", () => {
 
   test("each check has durationMs", () => {
     const result = runVerificationGate({
-      basePath: tmp,
-      unitId: "T01",
       cwd: tmp,
       preferenceCommands: ["echo fast"],
     });
@@ -330,8 +318,6 @@ describe("verification-gate: execution", () => {
   test("one command fails — remaining commands still run (non-short-circuit)", () => {
     // First fails, second and third should still execute
     const result = runVerificationGate({
-      basePath: tmp,
-      unitId: "T02",
       cwd: tmp,
       preferenceCommands: [
         "sh -c 'exit 1'",
@@ -351,8 +337,6 @@ describe("verification-gate: execution", () => {
   test("gate execution uses cwd for spawnSync", () => {
     // pwd should report the temp dir
     const result = runVerificationGate({
-      basePath: tmp,
-      unitId: "T02",
       cwd: tmp,
       preferenceCommands: ["pwd"],
     });

package/src/resources/extensions/gsd/tests/worktree-resolver.test.ts

@@ -846,3 +846,70 @@ test("GitService is rebuilt with originalBasePath after exitMilestone", () => {
 
   assert.equal(gitServiceBasePath, "/project"); // project root, not worktree
 });
+
+// ─── Isolation Degradation Tests (#2483) ──────────────────────────────────
+
+test("enterMilestone sets isolationDegraded when worktree creation throws (#2483)", () => {
+  const s = makeSession();
+  const deps = makeDeps({
+    getAutoWorktreePath: () => null,
+    createAutoWorktree: () => {
+      throw new Error("empty repo");
+    },
+  });
+  const ctx = makeNotifyCtx();
+  const resolver = new WorktreeResolver(s, deps);
+
+  resolver.enterMilestone("M001", ctx);
+
+  assert.equal(s.isolationDegraded, true);
+  assert.equal(s.basePath, "/project"); // unchanged — error recovery
+});
+
+test("enterMilestone is no-op when isolationDegraded is true (#2483)", () => {
+  const s = makeSession();
+  s.isolationDegraded = true;
+  const deps = makeDeps();
+  const ctx = makeNotifyCtx();
+  const resolver = new WorktreeResolver(s, deps);
+
+  resolver.enterMilestone("M001", ctx);
+
+  assert.equal(s.basePath, "/project"); // unchanged
+  assert.equal(findCalls(deps.calls, "createAutoWorktree").length, 0);
+  assert.equal(findCalls(deps.calls, "enterAutoWorktree").length, 0);
+  assert.equal(findCalls(deps.calls, "shouldUseWorktreeIsolation").length, 0);
+});
+
+test("mergeAndExit is no-op when isolationDegraded is true (#2483)", () => {
+  const s = makeSession({
+    basePath: "/project",
+    originalBasePath: "/project",
+  });
+  s.isolationDegraded = true;
+  const deps = makeDeps({
+    getIsolationMode: () => "worktree",
+  });
+  const ctx = makeNotifyCtx();
+  const resolver = new WorktreeResolver(s, deps);
+
+  resolver.mergeAndExit("M001", ctx);
+
+  assert.equal(findCalls(deps.calls, "mergeMilestoneToMain").length, 0);
+  assert.equal(findCalls(deps.calls, "teardownAutoWorktree").length, 0);
+  assert.equal(findCalls(deps.calls, "getIsolationMode").length, 0);
+  assert.ok(
+    ctx.messages.some(
+      (m) => m.level === "info" && m.msg.includes("isolation was degraded"),
+    ),
+  );
+});
+
+test("isolationDegraded is reset by session.reset() (#2483)", () => {
+  const s = new AutoSession();
+  s.isolationDegraded = true;
+
+  s.reset();
+
+  assert.equal(s.isolationDegraded, false);
+});

package/src/resources/extensions/gsd/tests/worktree-sync-milestones.test.ts

@@ -27,7 +27,7 @@ import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, readFileSync
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 
-import { syncProjectRootToWorktree } from '../auto-worktree-sync.ts';
+import { syncProjectRootToWorktree } from '../auto-worktree.ts';
 import { syncGsdStateToWorktree, syncWorktreeStateBack } from '../auto-worktree.ts';
 import { describe, test } from 'node:test';
 import assert from 'node:assert/strict';