gsd-pi 2.57.0-dev.f22a903 → 2.58.0-dev.778d6ac

package/src/resources/extensions/gsd/tests/doctor-providers.test.ts

@@ -484,3 +484,120 @@ test("runProviderChecks uses object provider field for anthropic-vertex models",
   rmSync(repo, { recursive: true, force: true });
   rmSync(tmpHome, { recursive: true, force: true });
 });
+
+// ─── Cross-provider routing: Codex & Gemini CLI (#2922) ────────────────────
+
+test("runProviderChecks reports ok for Google via google-gemini-cli auth.json (#2922)", () => {
+  const repo = realpathSync(mkdtempSync(join(tmpdir(), "gsd-providers-gemini-cli-repo-")));
+  mkdirSync(join(repo, ".gsd"), { recursive: true });
+  writeFileSync(
+    join(repo, ".gsd", "PREFERENCES.md"),
+    [
+      "---",
+      "models:",
+      "  execution: gemini-2.5-pro",
+      "---",
+      "",
+    ].join("\n"),
+  );
+
+  const tmpHome = realpathSync(mkdtempSync(join(tmpdir(), "gsd-providers-gemini-cli-home-")));
+  const agentDir = join(tmpHome, ".gsd", "agent");
+  mkdirSync(agentDir, { recursive: true });
+
+  // google-gemini-cli OAuth in auth.json (no google API key)
+  const authData = {
+    "google-gemini-cli": { type: "oauth", apiKey: "ya29.gemini-cli-token", expires: Date.now() + 3_600_000 },
+  };
+  writeFileSync(join(agentDir, "auth.json"), JSON.stringify(authData));
+
+  withEnv({
+    HOME: tmpHome,
+    GEMINI_API_KEY: undefined,
+    GOOGLE_API_KEY: undefined,
+  }, () => {
+    withCwd(repo, () => {
+      const results = runProviderChecks();
+      const google = results.find(r => r.name === "google");
+      assert.ok(google, "google result should exist");
+      assert.equal(google!.status, "ok", "should be ok when google-gemini-cli auth is available (#2922)");
+      assert.ok(google!.message.includes("Google Gemini CLI"), "should mention Gemini CLI as the source (#2922)");
+    });
+  });
+
+  rmSync(repo, { recursive: true, force: true });
+  rmSync(tmpHome, { recursive: true, force: true });
+});
+
+test("runProviderChecks reports ok for OpenAI via openai-codex auth.json (#2922)", () => {
+  const repo = realpathSync(mkdtempSync(join(tmpdir(), "gsd-providers-codex-repo-")));
+  mkdirSync(join(repo, ".gsd"), { recursive: true });
+  writeFileSync(
+    join(repo, ".gsd", "PREFERENCES.md"),
+    [
+      "---",
+      "models:",
+      "  execution: gpt-4o",
+      "---",
+      "",
+    ].join("\n"),
+  );
+
+  const tmpHome = realpathSync(mkdtempSync(join(tmpdir(), "gsd-providers-codex-home-")));
+  const agentDir = join(tmpHome, ".gsd", "agent");
+  mkdirSync(agentDir, { recursive: true });
+
+  // openai-codex OAuth in auth.json (no openai API key)
+  const authData = {
+    "openai-codex": { type: "oauth", apiKey: "codex-token", expires: Date.now() + 3_600_000 },
+  };
+  writeFileSync(join(agentDir, "auth.json"), JSON.stringify(authData));
+
+  withEnv({
+    HOME: tmpHome,
+    OPENAI_API_KEY: undefined,
+    // Clear Copilot env vars so it doesn't route through Copilot
+    COPILOT_GITHUB_TOKEN: undefined,
+    GH_TOKEN: undefined,
+    GITHUB_TOKEN: undefined,
+  }, () => {
+    withCwd(repo, () => {
+      const results = runProviderChecks();
+      const openai = results.find(r => r.name === "openai");
+      assert.ok(openai, "openai result should exist");
+      assert.equal(openai!.status, "ok", "should be ok when openai-codex auth is available (#2922)");
+      assert.ok(openai!.message.includes("Codex"), "should mention Codex as the source (#2922)");
+    });
+  });
+
+  rmSync(repo, { recursive: true, force: true });
+  rmSync(tmpHome, { recursive: true, force: true });
+});
+
+test("PROVIDER_ROUTES includes google-gemini-cli as route for google (#2922)", async () => {
+  const { readFileSync: readFS } = await import("node:fs");
+  const { dirname: dirn, join: joinPath } = await import("node:path");
+  const { fileURLToPath: fileUrl } = await import("node:url");
+  const __dir = dirn(fileUrl(import.meta.url));
+  const src = readFS(joinPath(__dir, "..", "doctor-providers.ts"), "utf-8");
+
+  // PROVIDER_ROUTES must map google -> [..., "google-gemini-cli"]
+  assert.ok(
+    src.includes('"google-gemini-cli"'),
+    'PROVIDER_ROUTES must include "google-gemini-cli" as a route (#2922)',
+  );
+});
+
+test("PROVIDER_ROUTES includes openai-codex as route for openai (#2922)", async () => {
+  const { readFileSync: readFS } = await import("node:fs");
+  const { dirname: dirn, join: joinPath } = await import("node:path");
+  const { fileURLToPath: fileUrl } = await import("node:url");
+  const __dir = dirn(fileUrl(import.meta.url));
+  const src = readFS(joinPath(__dir, "..", "doctor-providers.ts"), "utf-8");
+
+  // PROVIDER_ROUTES must map openai -> [..., "openai-codex"]
+  assert.ok(
+    src.includes('"openai-codex"'),
+    'PROVIDER_ROUTES must include "openai-codex" as a route (#2922)',
+  );
+});

package/src/resources/extensions/gsd/tests/dynamic-routing-default.test.ts

@@ -0,0 +1,20 @@
+/**
+ * Dynamic routing default — verifies routing is enabled by default.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { defaultRoutingConfig } from "../model-router.js";
+
+test("defaultRoutingConfig returns enabled: true", () => {
+  const config = defaultRoutingConfig();
+  assert.equal(config.enabled, true, "dynamic routing should be enabled by default");
+});
+
+test("defaultRoutingConfig enables all routing features", () => {
+  const config = defaultRoutingConfig();
+  assert.equal(config.escalate_on_failure, true);
+  assert.equal(config.budget_pressure, true);
+  assert.equal(config.cross_provider, true);
+  assert.equal(config.hooks, true);
+});

package/src/resources/extensions/gsd/tests/empty-content-abort-loop.test.ts

@@ -0,0 +1,74 @@
+/**
+ * empty-content-abort-loop.test.ts — Regression test for #2695.
+ *
+ * When the LLM sends an assistant message with empty `content: []` and
+ * `stopReason: "aborted"`, this is NOT a fatal abort — it is a non-fatal
+ * end-of-turn. The abort handler in agent-end-recovery.ts must distinguish
+ * this case and NOT pause auto-mode, allowing the loop to continue via
+ * resolveAgentEnd instead of entering a stuck re-dispatch loop.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const RECOVERY_PATH = join(__dirname, "..", "bootstrap", "agent-end-recovery.ts");
+
+function getRecoverySource(): string {
+  return readFileSync(RECOVERY_PATH, "utf-8");
+}
+
+test("agent-end-recovery.ts does not pause on aborted messages with empty content (#2695)", () => {
+  const source = getRecoverySource();
+
+  // The abort handler at `stopReason === "aborted"` must check for empty content
+  // before deciding to pause. An empty content array is a non-fatal agent stop.
+  const abortIdx = source.indexOf('stopReason === "aborted"');
+  assert.ok(abortIdx > -1, "abort handler must exist in agent-end-recovery.ts");
+
+  // Extract the region around the abort handler (enough to see the guard logic)
+  const abortRegion = source.slice(Math.max(0, abortIdx - 200), abortIdx + 600);
+
+  // Must check for empty content before pausing
+  assert.ok(
+    abortRegion.includes("content") && (abortRegion.includes("length") || abortRegion.includes("?.length")),
+    "abort handler must inspect content array length to distinguish empty-content aborts from fatal aborts (#2695)",
+  );
+});
+
+test("agent-end-recovery.ts routes empty-content aborted messages to resolveAgentEnd (#2695)", () => {
+  const source = getRecoverySource();
+
+  // The abort block must have a path that calls resolveAgentEnd for empty-content messages
+  // instead of unconditionally calling pauseAuto
+  const abortIdx = source.indexOf('stopReason === "aborted"');
+  assert.ok(abortIdx > -1, "abort handler must exist");
+
+  // Get the full abort handling block (from the if to the next stopReason check or success path)
+  const afterAbort = source.slice(abortIdx, abortIdx + 800);
+
+  // The abort block must have a code path that calls resolveAgentEnd (for empty-content case)
+  assert.ok(
+    afterAbort.includes("resolveAgentEnd"),
+    "abort handler must route empty-content aborted messages to resolveAgentEnd instead of always pausing (#2695)",
+  );
+});
+
+test("agent-end-recovery.ts checks for errorMessage presence in abort handler (#2695)", () => {
+  const source = getRecoverySource();
+
+  const abortIdx = source.indexOf('stopReason === "aborted"');
+  assert.ok(abortIdx > -1, "abort handler must exist");
+
+  const abortRegion = source.slice(abortIdx, abortIdx + 600);
+
+  // Fatal aborts should have error context (errorMessage field).
+  // The handler should check for this to distinguish fatal from non-fatal aborts.
+  assert.ok(
+    abortRegion.includes("errorMessage"),
+    "abort handler must check for errorMessage to distinguish fatal aborts from empty-content non-fatal stops (#2695)",
+  );
+});

package/src/resources/extensions/gsd/tests/event-replay-idempotency.test.ts

@@ -0,0 +1,140 @@
+// GSD State Machine Regression Tests — Event Replay & Reconciliation (#3161)
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  openDatabase,
+  closeDatabase,
+  insertMilestone,
+  insertSlice,
+  insertTask,
+  getTask,
+  updateTaskStatus,
+  insertVerificationEvidence,
+  upsertDecision,
+} from "../gsd-db.ts";
+import { extractEntityKey } from "../workflow-reconcile.ts";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+const MID = "M001";
+const SID = "S01";
+const TID = "T01";
+const TS = new Date().toISOString();
+
+function setupDb(): void {
+  openDatabase(":memory:");
+  insertMilestone({ id: MID, title: "Test Milestone" });
+  insertSlice({ id: SID, milestoneId: MID, title: "Test Slice" });
+  insertTask({ id: TID, sliceId: SID, milestoneId: MID, title: "Test Task" });
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+describe("event-replay-idempotency", () => {
+  beforeEach(() => {
+    setupDb();
+  });
+
+  afterEach(() => {
+    closeDatabase();
+  });
+
+  test("updateTaskStatus is idempotent for complete_task replay", () => {
+    // Simulates replaying a complete_task event twice (e.g. crash recovery)
+    updateTaskStatus(MID, SID, TID, "done", TS);
+    updateTaskStatus(MID, SID, TID, "done", TS);
+
+    const task = getTask(MID, SID, TID);
+    assert.ok(task !== null, "task should exist after status update");
+    assert.equal(task!.status, "done", "status should be 'done' after double replay");
+  });
+
+  test("updateTaskStatus is idempotent for start_task replay", () => {
+    // Simulates replaying a start_task event twice
+    updateTaskStatus(MID, SID, TID, "in-progress");
+    updateTaskStatus(MID, SID, TID, "in-progress");
+
+    const task = getTask(MID, SID, TID);
+    assert.ok(task !== null, "task should exist after status update");
+    assert.equal(task!.status, "in-progress", "status should be 'in-progress' after double replay");
+  });
+
+  test("updateTaskStatus for report_blocker does not set blocker_discovered flag (M4)", () => {
+    // M4 finding: report_blocker replay only calls updateTaskStatus("blocked").
+    // The blocker_discovered column is NOT set during replay — this is a known
+    // lossy replay: status is recovered but the blocker flag is not.
+    updateTaskStatus(MID, SID, TID, "blocked");
+
+    const task = getTask(MID, SID, TID);
+    assert.ok(task !== null, "task should exist after blocked status update");
+    assert.equal(task!.status, "blocked", "status should be 'blocked'");
+    assert.equal(
+      task!.blocker_discovered,
+      false,
+      "blocker_discovered should remain false — report_blocker replay is lossy (M4 finding)",
+    );
+  });
+
+  test("insertVerificationEvidence is NOT idempotent — duplicates accumulate (M5)", () => {
+    // M5 finding: insertVerificationEvidence uses a plain INSERT (no ON CONFLICT),
+    // so replaying the same record_verification event twice produces two rows.
+    // Both calls must succeed without throwing — the duplication is the risk.
+    const evidence = {
+      taskId: TID,
+      sliceId: SID,
+      milestoneId: MID,
+      command: "npm test",
+      exitCode: 0,
+      verdict: "pass",
+      durationMs: 1200,
+    };
+
+    assert.doesNotThrow(
+      () => insertVerificationEvidence(evidence),
+      "first insertVerificationEvidence call should not throw",
+    );
+    assert.doesNotThrow(
+      () => insertVerificationEvidence(evidence),
+      "second insertVerificationEvidence call should not throw — duplicates accumulate silently (M5 finding)",
+    );
+  });
+
+  test("upsertDecision is idempotent via INSERT OR REPLACE", () => {
+    // save_decision replay uses upsertDecision which is INSERT OR REPLACE,
+    // so replaying the same decision id twice overwrites without error.
+    const base = {
+      id: "arch:logging",
+      when_context: "during planning",
+      scope: "arch",
+      decision: "logging",
+      rationale: "structured logs",
+      revisable: "yes" as const,
+      made_by: "agent" as const,
+      superseded_by: null,
+    };
+
+    upsertDecision({ ...base, choice: "structured" });
+    upsertDecision({ ...base, choice: "unstructured" });
+
+    // No error means the second call replaced the first — idempotent at the id level.
+    // The final choice is "unstructured" per INSERT OR REPLACE semantics.
+  });
+
+  test("unknown event commands in replayEvents are silently skipped — extractEntityKey returns null for unknown commands", () => {
+    // replayEvents uses a switch/default that silently skips unrecognised commands.
+    // We verify this via extractEntityKey which follows the same command set.
+    // A future_command not in the switch must return null (not throw).
+    const event = {
+      cmd: "future_command",
+      params: { foo: "bar" },
+      ts: new Date().toISOString(),
+      hash: "0000000000000000",
+      actor: "agent" as const,
+      session_id: "test-session",
+    };
+
+    const key = extractEntityKey(event);
+    assert.equal(key, null, "extractEntityKey should return null for unknown commands");
+  });
+});

package/src/resources/extensions/gsd/tests/forensics-context-persist.test.ts

@@ -0,0 +1,129 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const gsdDir = join(__dirname, "..");
+
+/**
+ * Test suite for #2941: Forensics report context lost on follow-up turns.
+ *
+ * The forensics flow sends a one-shot message via sendMessage() with
+ * triggerTurn: true. On follow-up turns, the context is gone because
+ * there's no re-injection mechanism like buildGuidedExecuteContextInjection
+ * provides for task execution.
+ *
+ * Fix: write an active-forensics.json marker when forensics starts, and
+ * have buildBeforeAgentStartResult() re-inject the forensics prompt on
+ * subsequent turns.
+ */
+
+describe("forensics context persistence (#2941)", () => {
+  // ─── Source-level invariant tests ──────────────────────────────────────────
+
+  it("forensics.ts writes active-forensics marker after saving report", () => {
+    const src = readFileSync(join(gsdDir, "forensics.ts"), "utf-8");
+    assert.ok(
+      src.includes("active-forensics.json"),
+      "forensics.ts must reference active-forensics.json marker file",
+    );
+    assert.ok(
+      src.includes("writeForensicsMarker"),
+      "forensics.ts must call writeForensicsMarker to persist session state",
+    );
+  });
+
+  it("system-context.ts checks for active forensics marker in buildBeforeAgentStartResult", () => {
+    const src = readFileSync(join(gsdDir, "bootstrap", "system-context.ts"), "utf-8");
+    assert.ok(
+      src.includes("active-forensics.json"),
+      "system-context.ts must check for active-forensics.json marker",
+    );
+    assert.ok(
+      src.includes("gsd-forensics"),
+      "system-context.ts must inject gsd-forensics customType message",
+    );
+  });
+
+  it("system-context.ts exports clearForensicsMarker for cleanup", () => {
+    const src = readFileSync(join(gsdDir, "bootstrap", "system-context.ts"), "utf-8");
+    assert.ok(
+      src.includes("clearForensicsMarker"),
+      "system-context.ts must export clearForensicsMarker function",
+    );
+  });
+
+  // ─── Functional tests using temp directories ──────────────────────────────
+
+  const tmpBase = join(__dirname, "__tmp_forensics_persist__");
+
+  beforeEach(() => {
+    rmSync(tmpBase, { recursive: true, force: true });
+    mkdirSync(join(tmpBase, ".gsd", "runtime"), { recursive: true });
+    mkdirSync(join(tmpBase, ".gsd", "forensics"), { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(tmpBase, { recursive: true, force: true });
+  });
+
+  it("writeForensicsMarker creates marker with reportPath and promptContent", async () => {
+    const { writeForensicsMarker } = await import("../forensics.ts");
+
+    const reportPath = join(tmpBase, ".gsd", "forensics", "report-2026-01-01.md");
+    writeFileSync(reportPath, "# Test Report", "utf-8");
+
+    writeForensicsMarker(tmpBase, reportPath, "Test forensics prompt content");
+
+    const markerPath = join(tmpBase, ".gsd", "runtime", "active-forensics.json");
+    assert.ok(existsSync(markerPath), "marker file must be created");
+
+    const marker = JSON.parse(readFileSync(markerPath, "utf-8"));
+    assert.equal(marker.reportPath, reportPath);
+    assert.equal(marker.promptContent, "Test forensics prompt content");
+    assert.ok(marker.createdAt, "marker must have createdAt timestamp");
+  });
+
+  it("readForensicsMarker returns null when no marker exists", async () => {
+    const { readForensicsMarker } = await import("../forensics.ts");
+
+    const result = readForensicsMarker(join(tmpBase, "nonexistent"));
+    assert.equal(result, null);
+  });
+
+  it("readForensicsMarker returns marker data when file exists", async () => {
+    const { readForensicsMarker } = await import("../forensics.ts");
+
+    const markerPath = join(tmpBase, ".gsd", "runtime", "active-forensics.json");
+    const markerData = {
+      reportPath: "/some/report.md",
+      promptContent: "forensics prompt",
+      createdAt: new Date().toISOString(),
+    };
+    writeFileSync(markerPath, JSON.stringify(markerData), "utf-8");
+
+    const result = readForensicsMarker(tmpBase);
+    assert.ok(result);
+    assert.equal(result.reportPath, "/some/report.md");
+    assert.equal(result.promptContent, "forensics prompt");
+  });
+
+  it("clearForensicsMarker removes the marker file", async () => {
+    const { clearForensicsMarker } = await import("../bootstrap/system-context.ts");
+
+    const markerPath = join(tmpBase, ".gsd", "runtime", "active-forensics.json");
+    writeFileSync(markerPath, JSON.stringify({ reportPath: "/x", promptContent: "y", createdAt: new Date().toISOString() }), "utf-8");
+    assert.ok(existsSync(markerPath), "precondition: marker must exist");
+
+    clearForensicsMarker(tmpBase);
+    assert.ok(!existsSync(markerPath), "marker must be removed after clear");
+  });
+
+  it("clearForensicsMarker is a no-op when no marker exists", async () => {
+    const { clearForensicsMarker } = await import("../bootstrap/system-context.ts");
+    // Should not throw
+    clearForensicsMarker(join(tmpBase, "nonexistent"));
+  });
+});

package/src/resources/extensions/gsd/tests/forensics-db-completion.test.ts

@@ -0,0 +1,96 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const gsdDir = join(__dirname, "..");
+
+/**
+ * Tests for #3129: forensics reads DB for completion status instead of legacy file.
+ *
+ * The old loadCompletedKeys() reads completed-units.json which is never populated
+ * during normal auto-mode completion. The DB (milestones/slices/tasks tables) is
+ * the authoritative source for completion status.
+ */
+describe("forensics DB completion status (#3129)", () => {
+  const forensicsSrc = readFileSync(join(gsdDir, "forensics.ts"), "utf-8");
+  const stateSrc = readFileSync(join(gsdDir, "state.ts"), "utf-8");
+
+  // ── Primary fix: forensics queries DB for completion counts ──────────
+
+  it("ForensicReport has dbCompletionCounts field for DB-sourced completion data", () => {
+    assert.ok(
+      forensicsSrc.includes("dbCompletionCounts"),
+      "ForensicReport must include dbCompletionCounts field for DB-sourced completion data",
+    );
+  });
+
+  it("buildForensicReport queries DB for completed milestones, slices, and tasks", () => {
+    assert.ok(
+      forensicsSrc.includes("getDbCompletionCounts"),
+      "buildForensicReport must call getDbCompletionCounts to query DB completion status",
+    );
+  });
+
+  it("getDbCompletionCounts checks isDbAvailable before querying", () => {
+    assert.ok(
+      forensicsSrc.includes("isDbAvailable"),
+      "getDbCompletionCounts must check isDbAvailable() before querying the DB",
+    );
+  });
+
+  it("getDbCompletionCounts queries getAllMilestones for milestone completion", () => {
+    assert.ok(
+      forensicsSrc.includes("getAllMilestones"),
+      "getDbCompletionCounts must use getAllMilestones() to count completed milestones",
+    );
+  });
+
+  it("completion counting uses isClosedStatus for consistent status checks", () => {
+    assert.ok(
+      forensicsSrc.includes("isClosedStatus"),
+      "forensics must use isClosedStatus() for consistent status checks",
+    );
+  });
+
+  it("report rendering shows DB completion counts instead of just legacy key count", () => {
+    assert.ok(
+      forensicsSrc.includes("milestones complete"),
+      "report must show '__ milestones complete' from DB data",
+    );
+    assert.ok(
+      forensicsSrc.includes("slices complete"),
+      "report must show '__ slices complete' from DB data",
+    );
+    assert.ok(
+      forensicsSrc.includes("tasks complete"),
+      "report must show '__ tasks complete' from DB data",
+    );
+  });
+
+  it("falls back to completed-units.json only when DB is unavailable", () => {
+    // loadCompletedKeys should still exist as fallback
+    assert.ok(
+      forensicsSrc.includes("loadCompletedKeys"),
+      "loadCompletedKeys must still exist as fallback for non-DB projects",
+    );
+    // But the report should prefer DB counts
+    assert.ok(
+      forensicsSrc.includes("dbCompletionCounts"),
+      "report must prefer dbCompletionCounts over legacy completedKeys",
+    );
+  });
+
+  // ── Secondary fix: STATE.md label when all milestones complete ───────
+
+  it("state.ts returns null activeMilestone when all milestones are complete", () => {
+    // When phase is "complete", activeMilestone should be null, not the last milestone
+    // The last completed milestone should be in a separate field
+    assert.ok(
+      stateSrc.includes("lastCompletedMilestone"),
+      "GSDState must have lastCompletedMilestone field for the final milestone when phase=complete",
+    );
+  });
+});

package/src/resources/extensions/gsd/tests/forensics-dedup.test.ts

@@ -46,3 +46,34 @@ describe("forensics dedup (#2096)", () => {
       "opt-in notice must mention duplicate detection");
   });
 });
+
+describe("forensics dedup ordering (#2704)", () => {
+  it("{{dedupSection}} appears before Investigation Protocol in the prompt template", () => {
+    const prompt = readFileSync(join(gsdDir, "prompts", "forensics.md"), "utf-8");
+    const dedupIndex = prompt.indexOf("{{dedupSection}}");
+    const investigationIndex = prompt.indexOf("## Investigation Protocol");
+    assert.ok(dedupIndex !== -1, "prompt must contain {{dedupSection}}");
+    assert.ok(investigationIndex !== -1, "prompt must contain ## Investigation Protocol");
+    assert.ok(
+      dedupIndex < investigationIndex,
+      `{{dedupSection}} (index ${dedupIndex}) must appear before Investigation Protocol (index ${investigationIndex}) — dedup should run before expensive investigation to avoid wasting tokens on already-fixed bugs`,
+    );
+  });
+
+  it("DEDUP_PROMPT_SECTION contains a decision gate to skip investigation", () => {
+    const source = readFileSync(join(gsdDir, "forensics.ts"), "utf-8");
+    // The dedup section must instruct the agent to skip investigation when a match is found
+    assert.ok(
+      source.includes("Skip full investigation") || source.includes("skip full investigation") || source.includes("Skip investigation"),
+      "DEDUP_PROMPT_SECTION must contain a decision gate telling the agent to skip full investigation when a duplicate is found",
+    );
+  });
+
+  it("DEDUP_PROMPT_SECTION heading reflects pre-investigation role", () => {
+    const source = readFileSync(join(gsdDir, "forensics.ts"), "utf-8");
+    assert.ok(
+      source.includes("Pre-Investigation") || source.includes("pre-investigation"),
+      "DEDUP_PROMPT_SECTION heading must indicate it runs before investigation, not just before issue creation",
+    );
+  });
+});