gsd-pi 2.50.0-dev.d210a87 → 2.51.0-dev.7d435fe

package/src/resources/extensions/gsd/tests/remediation-completion-guard.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Regression test for #2675: completing-milestone dispatch rule must
+ * block completion when VALIDATION verdict is "needs-remediation".
+ *
+ * Without this guard, needs-remediation + allSlicesDone causes a loop:
+ * complete-milestone dispatched → agent refuses (correct) → no SUMMARY
+ * → re-dispatch → repeat until stuck detection fires.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { DISPATCH_RULES } from "../auto-dispatch.ts";
+
+/** Find the completing-milestone dispatch rule */
+const completingRule = DISPATCH_RULES.find(r => r.name === "completing-milestone → complete-milestone");
+
+test("completing-milestone dispatch rule exists", () => {
+  assert.ok(completingRule, "rule should exist in DISPATCH_RULES");
+});
+
+test("completing-milestone blocks when VALIDATION verdict is needs-remediation (#2675)", async () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-remediation-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+
+  try {
+    // Write a VALIDATION file with needs-remediation verdict
+    writeFileSync(
+      join(base, ".gsd", "milestones", "M001", "M001-VALIDATION.md"),
+      [
+        "---",
+        "verdict: needs-remediation",
+        "remediation_round: 0",
+        "---",
+        "",
+        "# Validation Report",
+        "",
+        "3 success criteria failed. Remediation required.",
+      ].join("\n"),
+    );
+
+    const ctx = {
+      mid: "M001",
+      midTitle: "Test Milestone",
+      basePath: base,
+      state: { phase: "completing-milestone" } as any,
+      prefs: {} as any,
+      session: undefined,
+    };
+
+    const result = await completingRule!.match(ctx);
+
+    assert.ok(result !== null, "rule should match");
+    assert.equal(result!.action, "stop", "should return stop action");
+    if (result!.action === "stop") {
+      assert.equal(result!.level, "warning", "should be warning level (pausable)");
+      assert.ok(
+        result!.reason.includes("needs-remediation"),
+        "reason should mention needs-remediation",
+      );
+    }
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("completing-milestone proceeds normally when VALIDATION verdict is pass (#2675 guard)", async () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-remediation-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+
+  try {
+    // Write a VALIDATION file with pass verdict
+    writeFileSync(
+      join(base, ".gsd", "milestones", "M001", "M001-VALIDATION.md"),
+      [
+        "---",
+        "verdict: pass",
+        "---",
+        "",
+        "# Validation Report",
+        "",
+        "All criteria met.",
+      ].join("\n"),
+    );
+
+    const ctx = {
+      mid: "M001",
+      midTitle: "Test Milestone",
+      basePath: base,
+      state: { phase: "completing-milestone" } as any,
+      prefs: {} as any,
+      session: undefined,
+    };
+
+    const result = await completingRule!.match(ctx);
+
+    // Should NOT return a stop — should either dispatch or return stop for
+    // a different reason (e.g. missing SUMMARY files, no implementation)
+    if (result && result.action === "stop") {
+      assert.ok(
+        !result.reason.includes("needs-remediation"),
+        "pass verdict should NOT trigger the remediation guard",
+      );
+    }
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/remote-questions.test.ts

@@ -724,3 +724,32 @@ test("resolveRemoteConfig returns null when preferences are absent (no env side-
     if (savedTelegram !== undefined) process.env.TELEGRAM_BOT_TOKEN = savedTelegram;
   }
 });
+
+test("config source-level: hydration skips api_key entries with empty keys", () => {
+  const configSrc = readFileSync(
+    join(__dirname, "..", "..", "remote-questions", "config.ts"),
+    "utf-8",
+  );
+  // The find() call in hydrateRemoteTokensFromAuth must filter for non-empty keys,
+  // not just match on type === "api_key". This prevents stale empty-key entries
+  // (left by removeProviderToken) from shadowing valid tokens.
+  assert.ok(
+    configSrc.includes('c.type === "api_key" && !!c.key'),
+    "hydrateRemoteTokensFromAuth find() should require a non-empty key",
+  );
+});
+
+test("config source-level: removeProviderToken uses auth.remove not auth.set with empty key", () => {
+  const commandSrc = readFileSync(
+    join(__dirname, "..", "..", "remote-questions", "remote-command.ts"),
+    "utf-8",
+  );
+  // removeProviderToken should call auth.remove(provider), not auth.set(provider, { key: "" }).
+  // Setting an empty key pollutes the credentials array and shadows valid tokens.
+  const fnStart = commandSrc.indexOf("function removeProviderToken");
+  assert.ok(fnStart !== -1, "removeProviderToken should exist");
+  const fnEnd = commandSrc.indexOf("\n}", fnStart);
+  const fnBody = commandSrc.slice(fnStart, fnEnd);
+  assert.ok(fnBody.includes("auth.remove("), "removeProviderToken should call auth.remove()");
+  assert.ok(!fnBody.includes('key: ""'), "removeProviderToken should not set an empty key");
+});

package/src/resources/extensions/gsd/tests/terminated-transient.test.ts

@@ -1,73 +1,84 @@
 /**
  * terminated-transient.test.ts — Regression test for #2309.
  *
- * classifyProviderError should treat 'terminated' errors (process killed,
+ * classifyError should treat 'terminated' errors (process killed,
  * connection reset) as transient with auto-resume, not permanent.
  */
 
 import test from "node:test";
 import assert from "node:assert/strict";
-import { classifyProviderError } from "../provider-error-pause.ts";
+import { classifyError, isTransient } from "../error-classifier.ts";
 
 test("#2309: 'terminated' errors should be classified as transient", () => {
-  const result = classifyProviderError("terminated");
-  assert.equal(result.isTransient, true, "'terminated' should be transient");
-  assert.equal(result.isRateLimit, false, "'terminated' is not a rate limit");
-  assert.ok(result.suggestedDelayMs > 0, "'terminated' should have a retry delay");
+  const result = classifyError("terminated");
+  assert.equal(isTransient(result), true, "'terminated' should be transient");
+  assert.equal(result.kind, "connection", "'terminated' matches connection");
+  assert.ok("retryAfterMs" in result && result.retryAfterMs > 0, "'terminated' should have a retry delay");
+  assert.equal("retryAfterMs" in result && result.retryAfterMs, 15_000, "'terminated' should use 15s backoff");
 });
 
-test("#2309: 'connection reset' errors should be classified as transient", () => {
-  const result = classifyProviderError("connection reset by peer");
-  assert.equal(result.isTransient, true, "'connection reset' should be transient");
+test("#2309: 'connection reset by peer' errors should be classified as transient (network)", () => {
+  const result = classifyError("connection reset by peer");
+  assert.equal(isTransient(result), true, "'connection reset by peer' should be transient");
+  assert.equal(result.kind, "network", "'connection reset by peer' matches NETWORK_RE (connection.*reset) before CONNECTION_RE");
+  assert.equal("retryAfterMs" in result && result.retryAfterMs, 3_000, "network errors use 3s backoff");
 });
 
 test("#2309: 'other side closed' errors should be classified as transient", () => {
-  const result = classifyProviderError("other side closed the connection");
-  assert.equal(result.isTransient, true, "'other side closed' should be transient");
+  const result = classifyError("other side closed the connection");
+  assert.equal(isTransient(result), true, "'other side closed' should be transient");
+  assert.equal(result.kind, "connection", "'other side closed' matches CONNECTION_RE");
 });
 
 test("#2309: 'fetch failed' errors should be classified as transient", () => {
-  const result = classifyProviderError("fetch failed: network error");
-  assert.equal(result.isTransient, true, "'fetch failed' should be transient");
+  const result = classifyError("fetch failed: network error");
+  assert.equal(isTransient(result), true, "'fetch failed' should be transient");
+  assert.equal(result.kind, "network", "'fetch failed' matches NETWORK_RE");
+  assert.equal("retryAfterMs" in result && result.retryAfterMs, 3_000, "network errors use 3s backoff");
 });
 
 test("#2309: 'connection refused' errors should be classified as transient", () => {
-  const result = classifyProviderError("ECONNREFUSED: connection refused");
-  assert.equal(result.isTransient, true, "'connection refused' should be transient");
+  const result = classifyError("ECONNREFUSED: connection refused");
+  assert.equal(isTransient(result), true, "'connection refused' should be transient");
+  assert.equal(result.kind, "network", "'ECONNREFUSED' matches NETWORK_RE (same-model retry)");
 });
 
 test("#2309: permanent errors are still permanent", () => {
-  const authResult = classifyProviderError("unauthorized: invalid API key");
-  assert.equal(authResult.isTransient, false, "auth errors should stay permanent");
-  assert.equal(authResult.suggestedDelayMs, 0, "permanent errors have no delay");
+  const authResult = classifyError("unauthorized: invalid API key");
+  assert.equal(isTransient(authResult), false, "auth errors should stay permanent");
+  assert.equal(authResult.kind, "permanent", "auth errors are permanent");
+  assert.equal("retryAfterMs" in authResult, false, "permanent errors have no retryAfterMs");
 });
 
 test("#2309: rate limits are still transient", () => {
-  const rlResult = classifyProviderError("rate limit exceeded (429)");
-  assert.equal(rlResult.isTransient, true, "rate limits are still transient");
-  assert.equal(rlResult.isRateLimit, true, "rate limits are flagged as rate limits");
+  const rlResult = classifyError("rate limit exceeded (429)");
+  assert.equal(isTransient(rlResult), true, "rate limits are still transient");
+  assert.equal(rlResult.kind, "rate-limit", "rate limits are flagged as rate-limit kind");
 });
 
 // --- #2572: stream-truncation JSON parse errors should be transient ---
 
 test("#2572: 'Expected double-quoted property name' (truncated stream) is transient", () => {
-  const result = classifyProviderError("Expected double-quoted property name in JSON at position 23 (line 1 column 24)");
-  assert.equal(result.isTransient, true, "truncated-stream JSON parse error should be transient");
-  assert.equal(result.isRateLimit, false, "not a rate limit");
-  assert.equal(result.suggestedDelayMs, 15_000, "should use 15s backoff like connection errors");
+  const result = classifyError("Expected double-quoted property name in JSON at position 23 (line 1 column 24)");
+  assert.equal(isTransient(result), true, "truncated-stream JSON parse error should be transient");
+  assert.equal(result.kind, "stream", "JSON parse errors are stream kind");
+  assert.equal("retryAfterMs" in result && result.retryAfterMs, 15_000, "should use 15s backoff");
 });
 
 test("#2572: 'Unexpected end of JSON input' (truncated stream) is transient", () => {
-  const result = classifyProviderError("Unexpected end of JSON input");
-  assert.equal(result.isTransient, true, "'Unexpected end of JSON input' should be transient");
+  const result = classifyError("Unexpected end of JSON input");
+  assert.equal(isTransient(result), true, "'Unexpected end of JSON input' should be transient");
+  assert.equal(result.kind, "stream", "JSON parse errors are stream kind");
 });
 
 test("#2572: 'Unexpected token' in JSON (truncated stream) is transient", () => {
-  const result = classifyProviderError("Unexpected token < in JSON at position 0");
-  assert.equal(result.isTransient, true, "'Unexpected token in JSON' should be transient");
+  const result = classifyError("Unexpected token < in JSON at position 0");
+  assert.equal(isTransient(result), true, "'Unexpected token in JSON' should be transient");
+  assert.equal(result.kind, "stream", "JSON parse errors are stream kind");
 });
 
 test("#2572: 'SyntaxError' with JSON context (truncated stream) is transient", () => {
-  const result = classifyProviderError("SyntaxError: JSON.parse: unexpected character at line 1 column 1");
-  assert.equal(result.isTransient, true, "'SyntaxError...JSON' should be transient");
+  const result = classifyError("SyntaxError: JSON.parse: unexpected character at line 1 column 1");
+  assert.equal(isTransient(result), true, "'SyntaxError...JSON' should be transient");
+  assert.equal(result.kind, "stream", "JSON parse errors are stream kind");
 });

package/src/resources/extensions/gsd/tests/token-cost-display.test.ts

@@ -63,13 +63,13 @@ test("show_token_cost defaults to undefined (disabled) when not set", () => {
   assert.equal(preferences.show_token_cost, undefined);
 });
 
-test("empty preferences.md does not enable show_token_cost", () => {
+test("empty PREFERENCES.md does not enable show_token_cost", () => {
   const prefs = parsePreferencesMarkdown("---\nversion: 1\n---\n");
   assert.ok(prefs);
   assert.equal(prefs.show_token_cost, undefined);
 });
 
-test("preferences.md with show_token_cost: true enables the preference", () => {
+test("PREFERENCES.md with show_token_cost: true enables the preference", () => {
   const prefs = parsePreferencesMarkdown("---\nshow_token_cost: true\n---\n");
   assert.ok(prefs);
   assert.equal(prefs.show_token_cost, true);

package/src/resources/extensions/gsd/tests/vacuous-truth-slices.test.ts

@@ -0,0 +1,115 @@
+/**
+ * Regression test for #2667: deriveStateFromDb must NOT treat an empty
+ * slice array as "all slices done" due to JavaScript's vacuous-truth
+ * behavior of Array.prototype.every on an empty array.
+ *
+ * [].every(predicate) === true in JavaScript. Without a length > 0 guard,
+ * this causes a premature phase transition to validating-milestone when
+ * the DB returns 0 slices (e.g. after a worktree DB wipe).
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { deriveStateFromDb, invalidateStateCache } from "../state.ts";
+import {
+  openDatabase,
+  closeDatabase,
+  insertMilestone,
+  insertSlice,
+} from "../gsd-db.ts";
+
+test("deriveStateFromDb does NOT skip to validating when slice array is empty (#2667)", async () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-vacuous-truth-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+
+  try {
+    // Set up a milestone with a roadmap that references slices,
+    // but the DB has NO slice rows (simulating a worktree DB wipe)
+    writeFileSync(
+      join(base, ".gsd", "milestones", "M001", "M001-ROADMAP.md"),
+      [
+        "# M001: Test Milestone",
+        "",
+        "## Slices",
+        "",
+        "### S01 — First Slice",
+        "Do something.",
+        "",
+        "### S02 — Second Slice",
+        "Do another thing.",
+      ].join("\n"),
+    );
+
+    openDatabase(":memory:");
+    // Milestone exists but NO slices inserted — simulates DB wipe
+    insertMilestone({ id: "M001", title: "Test Milestone", status: "active" });
+
+    invalidateStateCache();
+    const state = await deriveStateFromDb(base);
+
+    // The phase must NOT be "validating-milestone" or "completing-milestone"
+    // because no slices have been executed — the empty array should not
+    // trigger the "all slices done" code path.
+    assert.notEqual(
+      state.phase,
+      "validating-milestone",
+      "empty slice array must not trigger validating-milestone (vacuous truth)",
+    );
+    assert.notEqual(
+      state.phase,
+      "completing-milestone",
+      "empty slice array must not trigger completing-milestone (vacuous truth)",
+    );
+
+    closeDatabase();
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("deriveStateFromDb correctly reaches validating when all slices are done (#2667 guard)", async () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-vacuous-truth-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001", "slices", "S01"), { recursive: true });
+
+  try {
+    writeFileSync(
+      join(base, ".gsd", "milestones", "M001", "M001-ROADMAP.md"),
+      [
+        "# M001: Test Milestone",
+        "",
+        "## Slices",
+        "",
+        "### S01 — First Slice",
+        "Do something.",
+      ].join("\n"),
+    );
+
+    // Write a slice summary so the filesystem recognizes it as complete
+    writeFileSync(
+      join(base, ".gsd", "milestones", "M001", "slices", "S01", "S01-SUMMARY.md"),
+      "# S01 Summary\n\nDone.",
+    );
+
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Test Milestone", status: "active" });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "First Slice", status: "complete", risk: "low", depends: [] });
+
+    invalidateStateCache();
+    const state = await deriveStateFromDb(base);
+
+    // With one slice that IS complete, phase should advance
+    assert.ok(
+      state.phase === "validating-milestone" || state.phase === "completing-milestone",
+      `expected validating or completing phase, got "${state.phase}"`,
+    );
+
+    closeDatabase();
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/validate-milestone-write-order.test.ts

@@ -0,0 +1,90 @@
+import { describe, it, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, existsSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+
+import { handleValidateMilestone } from "../tools/validate-milestone.js";
+import { openDatabase, closeDatabase, _getAdapter, insertMilestone } from "../gsd-db.js";
+import { clearPathCache } from "../paths.js";
+import { clearParseCache } from "../files.js";
+
+function makeTmpBase(): string {
+  const base = join(tmpdir(), `gsd-val-handler-${randomUUID()}`);
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  return base;
+}
+
+const VALID_PARAMS = {
+  milestoneId: "M001",
+  verdict: "pass" as const,
+  remediationRound: 0,
+  successCriteriaChecklist: "- [x] All pass",
+  sliceDeliveryAudit: "| S01 | delivered |",
+  crossSliceIntegration: "No issues",
+  requirementCoverage: "All covered",
+  verdictRationale: "Everything checks out",
+};
+
+describe("handleValidateMilestone write ordering (#2725)", () => {
+  let base: string;
+
+  afterEach(() => {
+    clearPathCache();
+    clearParseCache();
+    try { closeDatabase(); } catch { /* */ }
+    if (base) {
+      try { rmSync(base, { recursive: true, force: true }); } catch { /* */ }
+    }
+  });
+
+  it("writes DB row and disk file on success", async () => {
+    base = makeTmpBase();
+    const dbPath = join(base, ".gsd", "gsd.db");
+    openDatabase(dbPath);
+    insertMilestone({ id: "M001" });
+
+    const result = await handleValidateMilestone(VALID_PARAMS, base);
+    assert.ok(!("error" in result), `unexpected error: ${"error" in result ? result.error : ""}`);
+
+    // DB row exists
+    const adapter = _getAdapter()!;
+    const row = adapter.prepare(
+      `SELECT status, scope FROM assessments WHERE milestone_id = 'M001' AND scope = 'milestone-validation'`,
+    ).get() as { status: string; scope: string } | undefined;
+    assert.ok(row, "assessment row should exist in DB");
+    assert.equal(row!.status, "pass");
+
+    // Disk file exists
+    const filePath = join(base, ".gsd", "milestones", "M001", "M001-VALIDATION.md");
+    assert.ok(existsSync(filePath), "VALIDATION.md should exist on disk");
+  });
+
+  it("rolls back DB row when disk write fails", async () => {
+    base = makeTmpBase();
+    const dbPath = join(base, ".gsd", "gsd.db");
+    openDatabase(dbPath);
+    insertMilestone({ id: "M001" });
+
+    // Force disk write failure by replacing the milestone directory with a
+    // regular file. saveFile() will fail because it cannot write inside a
+    // non-directory. This works cross-platform (chmod is ignored on Windows).
+    const milestoneDir = join(base, ".gsd", "milestones", "M001");
+    rmSync(milestoneDir, { recursive: true, force: true });
+    writeFileSync(milestoneDir, "not-a-directory");
+
+    const result = await handleValidateMilestone(VALID_PARAMS, base);
+
+    // Should return error
+    assert.ok("error" in result, "should return error when disk write fails");
+    assert.ok(result.error.includes("disk render failed"));
+
+    // DB row should have been rolled back (deleted)
+    const adapter = _getAdapter()!;
+    const row = adapter.prepare(
+      `SELECT * FROM assessments WHERE milestone_id = 'M001' AND scope = 'milestone-validation'`,
+    ).get();
+    assert.equal(row, undefined, "assessment row should be deleted after disk-write rollback");
+  });
+});

package/src/resources/extensions/gsd/tests/workflow-logger.test.ts

@@ -1,8 +1,11 @@
 // GSD Extension — Workflow Logger Tests
 // Tests for the centralized warning/error accumulator.
 
-import { describe, test, beforeEach } from "node:test";
+import { describe, test, beforeEach, afterEach } from "node:test";
 import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { makeTempDir, cleanup } from "./test-utils.ts";
 import {
   logWarning,
   logError,
@@ -14,6 +17,7 @@ import {
   hasAnyIssues,
   summarizeLogs,
   formatForNotification,
+  setLogBasePath,
   _resetLogs,
 } from "../workflow-logger.ts";
 
@@ -222,6 +226,44 @@ describe("workflow-logger", () => {
     });
   });
 
+  describe("audit log persistence", () => {
+    let dir: string;
+
+    beforeEach(() => {
+      dir = makeTempDir("wl-audit-");
+    });
+
+    afterEach(() => {
+      setLogBasePath("");
+      cleanup(dir);
+    });
+
+    test("writes entry to .gsd/audit-log.jsonl after setLogBasePath", () => {
+      setLogBasePath(dir);
+      logWarning("engine", "audit test entry");
+
+      const auditPath = join(dir, ".gsd", "audit-log.jsonl");
+      assert.ok(existsSync(auditPath), "audit-log.jsonl should exist");
+      const content = readFileSync(auditPath, "utf-8");
+      const entry = JSON.parse(content.trim());
+      assert.equal(entry.severity, "warn");
+      assert.equal(entry.component, "engine");
+      assert.equal(entry.message, "audit test entry");
+    });
+
+    test("_resetLogs does not clear the audit base path", () => {
+      setLogBasePath(dir);
+      _resetLogs();
+      logWarning("engine", "post-reset entry");
+
+      const auditPath = join(dir, ".gsd", "audit-log.jsonl");
+      assert.ok(existsSync(auditPath), "audit-log.jsonl should exist after _resetLogs");
+      const content = readFileSync(auditPath, "utf-8");
+      const entry = JSON.parse(content.trim());
+      assert.equal(entry.message, "post-reset entry");
+    });
+  });
+
   describe("buffer limit", () => {
     test("caps at MAX_BUFFER entries, dropping oldest", () => {
       const OVER = 110;
@@ -237,6 +279,44 @@ describe("workflow-logger", () => {
     });
   });
 
+  describe("audit log persistence", () => {
+    let dir: string;
+
+    beforeEach(() => {
+      dir = makeTempDir("wl-audit-");
+    });
+
+    afterEach(() => {
+      setLogBasePath("");
+      cleanup(dir);
+    });
+
+    test("writes entry to .gsd/audit-log.jsonl after setLogBasePath", () => {
+      setLogBasePath(dir);
+      logWarning("engine", "audit test entry");
+
+      const auditPath = join(dir, ".gsd", "audit-log.jsonl");
+      assert.ok(existsSync(auditPath), "audit-log.jsonl should exist");
+      const content = readFileSync(auditPath, "utf-8");
+      const entry = JSON.parse(content.trim());
+      assert.equal(entry.severity, "warn");
+      assert.equal(entry.component, "engine");
+      assert.equal(entry.message, "audit test entry");
+    });
+
+    test("_resetLogs does not clear the audit base path", () => {
+      setLogBasePath(dir);
+      _resetLogs();
+      logWarning("engine", "post-reset entry");
+
+      const auditPath = join(dir, ".gsd", "audit-log.jsonl");
+      assert.ok(existsSync(auditPath), "audit-log.jsonl should exist after _resetLogs");
+      const content = readFileSync(auditPath, "utf-8");
+      const entry = JSON.parse(content.trim());
+      assert.equal(entry.message, "post-reset entry");
+    });
+  });
+
   describe("stderr output", () => {
     test("writes WARN prefix to stderr for warnings", (t) => {
       const written: string[] = [];