gsd-pi 2.59.0 → 2.60.0-dev.2580e65

package/src/resources/extensions/gsd/tests/remote-questions.test.ts

@@ -739,6 +739,27 @@ test("config source-level: hydration skips api_key entries with empty keys", ()
   );
 });
 
+test("ask-user-questions source-level: tryRemoteQuestions is called before the hasUI guard", () => {
+  // Regression test for #3480 — remote questions were silently skipped in interactive
+  // mode because tryRemoteQuestions was gated behind `if (!ctx.hasUI)`.
+  // The fix moved the remote call before that guard so configured channels
+  // (Telegram/Slack/Discord) fire regardless of UI availability.
+  const src = readFileSync(
+    join(__dirname, "..", "..", "ask-user-questions.ts"),
+    "utf-8",
+  );
+
+  const remoteCallIdx = src.indexOf("tryRemoteQuestions(params.questions");
+  const hasUIGuardIdx = src.indexOf("if (!ctx.hasUI)");
+
+  assert.ok(remoteCallIdx !== -1, "tryRemoteQuestions call should exist in ask-user-questions.ts");
+  assert.ok(hasUIGuardIdx !== -1, "!ctx.hasUI guard should exist in ask-user-questions.ts");
+  assert.ok(
+    remoteCallIdx < hasUIGuardIdx,
+    "tryRemoteQuestions must be called before the !ctx.hasUI guard — otherwise remote questions are skipped in interactive mode",
+  );
+});
+
 test("config source-level: removeProviderToken uses auth.remove not auth.set with empty key", () => {
   const commandSrc = readFileSync(
     join(__dirname, "..", "..", "remote-questions", "remote-command.ts"),

package/src/resources/extensions/gsd/tests/silent-catch-diagnostics.test.ts

@@ -0,0 +1,284 @@
+/**
+ * Verify that catch blocks across GSD source files use the centralized
+ * workflow-logger (logWarning/logError) instead of raw process.stderr.write,
+ * console.error, or being completely empty (#3348, #3345).
+ *
+ * Two tests:
+ * 1. Auto-mode files must have zero empty catch blocks (fully migrated).
+ * 2. All GSD files must not use raw stderr/console in catch blocks.
+ */
+
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, dirname, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const gsdDir = join(__dirname, "..");
+
+/** Files exempt from the raw-stderr/console check */
+const EXEMPT_FILES = new Set([
+  "workflow-logger.ts",       // The logger itself
+  "debug-logger.ts",          // Separate opt-in debug system
+]);
+
+/**
+ * Files that have been fully migrated to workflow-logger and must not
+ * regress to empty catch blocks. Covers auto-mode, tools, bootstrap,
+ * and core infrastructure files.
+ */
+const MIGRATED_FILES = new Set([
+  // auto-mode (detected dynamically below)
+  // tools/
+  "tools/complete-task.ts",
+  "tools/complete-slice.ts",
+  "tools/complete-milestone.ts",
+  "tools/plan-milestone.ts",
+  "tools/plan-slice.ts",
+  "tools/plan-task.ts",
+  "tools/reassess-roadmap.ts",
+  "tools/reopen-task.ts",
+  "tools/reopen-slice.ts",
+  "tools/replan-slice.ts",
+  "tools/validate-milestone.ts",
+  // bootstrap/
+  "bootstrap/agent-end-recovery.ts",
+  "bootstrap/system-context.ts",
+  "bootstrap/db-tools.ts",
+  "bootstrap/dynamic-tools.ts",
+  "bootstrap/journal-tools.ts",
+  // core infrastructure
+  "gsd-db.ts",
+  "workflow-logger.ts",
+  "workflow-reconcile.ts",
+  "workflow-migration.ts",
+  "workflow-projections.ts",
+  "workflow-events.ts",
+  "worktree-manager.ts",
+  "parallel-orchestrator.ts",
+  "parallel-merge.ts",
+  "guided-flow.ts",
+  "preferences.ts",
+  "commands-maintenance.ts",
+  "commands-inspect.ts",
+  "safe-fs.ts",
+  "markdown-renderer.ts",
+  "md-importer.ts",
+  "milestone-actions.ts",
+  "milestone-ids.ts",
+  "rule-registry.ts",
+  "custom-verification.ts",
+  "prompt-loader.ts",
+  "auto-verification.ts",
+]);
+
+/** Patterns that indicate a catch block already uses workflow-logger */
+const LOGGER_PATTERNS = [
+  /logWarning\s*\(/,
+  /logError\s*\(/,
+];
+
+function getAutoModeFiles(): string[] {
+  const files: string[] = [];
+
+  // Top-level auto*.ts files
+  for (const f of readdirSync(gsdDir)) {
+    if (f.startsWith("auto") && f.endsWith(".ts") && !f.endsWith(".test.ts")) {
+      files.push(join(gsdDir, f));
+    }
+  }
+
+  // auto/ subdirectory
+  const autoSubDir = join(gsdDir, "auto");
+  for (const f of readdirSync(autoSubDir)) {
+    if (f.endsWith(".ts") && !f.endsWith(".test.ts")) {
+      files.push(join(autoSubDir, f));
+    }
+  }
+
+  return files;
+}
+
+function getGsdSourceFiles(): string[] {
+  const files: string[] = [];
+
+  function walk(dir: string): void {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry);
+      if (entry === "tests" || entry === "node_modules") continue;
+      try {
+        const st = statSync(full);
+        if (st.isDirectory()) {
+          walk(full);
+        } else if (entry.endsWith(".ts") && !entry.endsWith(".test.ts") && !entry.endsWith(".d.ts")) {
+          files.push(full);
+        }
+      } catch {
+        continue;
+      }
+    }
+  }
+
+  walk(gsdDir);
+  return files;
+}
+
+/**
+ * Scan a file for empty catch blocks — catches whose body contains
+ * only whitespace and/or comments but no executable statements.
+ */
+function findEmptyCatches(filePath: string): Array<{ line: number; text: string }> {
+  const content = readFileSync(filePath, "utf-8");
+  const lines = content.split("\n");
+  const results: Array<{ line: number; text: string }> = [];
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+
+    // Match catch block opening
+    if (!/\}\s*catch\s*(\([^)]*\))?\s*\{/.test(line)) continue;
+
+    // Inline single-line catch: } catch { ... }
+    const inlineMatch = line.match(/\}\s*catch\s*(\([^)]*\))?\s*\{(.*)\}\s*;?\s*$/);
+    if (inlineMatch) {
+      const body = inlineMatch[2].trim();
+      const stripped = body.replace(/\/\*.*?\*\//g, "").replace(/\/\/.*/g, "").trim();
+      if (!stripped) {
+        results.push({ line: i + 1, text: line.trim() });
+      }
+      continue;
+    }
+
+    // Multi-line catch — scan until matching }
+    let j = i + 1;
+    let depth = 1;
+    const bodyLines: string[] = [];
+    while (j < lines.length && depth > 0) {
+      for (const ch of lines[j]) {
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+      }
+      bodyLines.push(lines[j].trim());
+      j++;
+    }
+
+    const meaningful = bodyLines.slice(0, -1).filter(
+      (l) => l && !l.startsWith("//") && !l.startsWith("/*") && !l.startsWith("*") && l !== "}",
+    );
+
+    if (meaningful.length === 0) {
+      results.push({ line: i + 1, text: line.trim() });
+    }
+  }
+
+  return results;
+}
+
+/**
+ * Scan a file for catch blocks that use raw process.stderr.write or
+ * console.error/warn instead of workflow-logger.
+ */
+function findRawStderrCatches(filePath: string): Array<{ line: number; text: string }> {
+  const content = readFileSync(filePath, "utf-8");
+  const lines = content.split("\n");
+  const results: Array<{ line: number; text: string }> = [];
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!/\}\s*catch\s*(\([^)]*\))?\s*\{/.test(line)) continue;
+
+    // Inline single-line catch
+    const inlineMatch = line.match(/\}\s*catch\s*(\([^)]*\))?\s*\{(.*)\}\s*;?\s*$/);
+    if (inlineMatch) {
+      const body = inlineMatch[2];
+      if (!LOGGER_PATTERNS.some((p) => p.test(body))) {
+        if (/process\.stderr\.write/.test(body) || /console\.(error|warn)/.test(body)) {
+          results.push({ line: i + 1, text: line.trim() });
+        }
+      }
+      continue;
+    }
+
+    // Multi-line catch
+    let j = i + 1;
+    let depth = 1;
+    const bodyLines: string[] = [];
+    while (j < lines.length && depth > 0) {
+      for (const ch of lines[j]) {
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+      }
+      bodyLines.push(lines[j]);
+      j++;
+    }
+
+    const bodyText = bodyLines.slice(0, -1).join("\n");
+    if (!LOGGER_PATTERNS.some((p) => p.test(bodyText))) {
+      if (/process\.stderr\.write/.test(bodyText) || /console\.(error|warn)/.test(bodyText)) {
+        results.push({ line: i + 1, text: line.trim() });
+      }
+    }
+  }
+
+  return results;
+}
+
+describe("workflow-logger coverage (#3348)", () => {
+  test("no empty catch blocks remain in migrated files", () => {
+    // Combine auto-mode files + explicitly migrated files
+    const autoFiles = getAutoModeFiles();
+    const allFiles = getGsdSourceFiles();
+    const migratedPaths = new Set(autoFiles);
+    for (const file of allFiles) {
+      const rel = relative(gsdDir, file);
+      if (MIGRATED_FILES.has(rel)) {
+        migratedPaths.add(file);
+      }
+    }
+
+    assert.ok(migratedPaths.size > 0, "should find migrated source files");
+
+    const violations: string[] = [];
+    for (const file of migratedPaths) {
+      const rel = relative(gsdDir, file);
+      const basename = rel.split("/").pop()!;
+      // gsd-db.ts has intentionally silent provider probes
+      if (basename === "gsd-db.ts" || basename === "session-lock.ts") continue;
+
+      const empties = findEmptyCatches(file);
+      for (const empty of empties) {
+        violations.push(`${rel}:${empty.line} — ${empty.text}`);
+      }
+    }
+
+    assert.equal(
+      violations.length,
+      0,
+      `Found ${violations.length} empty catch block(s) in migrated files:\n${violations.join("\n")}`,
+    );
+  });
+
+  test("catch blocks use workflow-logger instead of raw stderr/console", () => {
+    const files = getGsdSourceFiles();
+    assert.ok(files.length > 0, "should find GSD source files");
+
+    const violations: string[] = [];
+    for (const file of files) {
+      const rel = relative(gsdDir, file);
+      const basename = rel.split("/").pop()!;
+      if (EXEMPT_FILES.has(basename)) continue;
+
+      const issues = findRawStderrCatches(file);
+      for (const issue of issues) {
+        violations.push(`${rel}:${issue.line} — ${issue.text}`);
+      }
+    }
+
+    assert.equal(
+      violations.length,
+      0,
+      `Found ${violations.length} catch block(s) using raw stderr/console instead of workflow-logger:\n${violations.join("\n")}`,
+    );
+  });
+});

package/src/resources/extensions/gsd/tests/status-guards.test.ts

@@ -13,6 +13,10 @@ test('isClosedStatus: "done" returns true', () => {
   assert.equal(isClosedStatus('done'), true);
 });
 
+test('isClosedStatus: "skipped" returns true', () => {
+  assert.equal(isClosedStatus('skipped'), true);
+});
+
 test('isClosedStatus: "pending" returns false', () => {
   assert.equal(isClosedStatus('pending'), false);
 });

package/src/resources/extensions/gsd/tests/stop-backtrack.test.ts

@@ -0,0 +1,216 @@
+/**
+ * Unit tests for stop/backtrack capture classifications and milestone regression (#3487).
+ *
+ * Tests:
+ * - "stop" and "backtrack" are valid classification types
+ * - loadStopCaptures returns unexecuted stop+backtrack captures
+ * - loadBacktrackCaptures returns only backtrack captures
+ * - revertExecutorResolvedCaptures reverts silenced captures
+ * - executeBacktrack writes trigger and regression markers
+ * - readBacktrackTrigger parses trigger file
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, readFileSync, writeFileSync, rmSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { isClosedStatus } from "../status-guards.ts";
+import {
+  appendCapture,
+  loadAllCaptures,
+  loadStopCaptures,
+  loadBacktrackCaptures,
+  markCaptureResolved,
+  revertExecutorResolvedCaptures,
+  hasPendingCaptures,
+} from "../captures.ts";
+import {
+  executeBacktrack,
+  readBacktrackTrigger,
+} from "../triage-resolution.ts";
+
+function makeTempDir(prefix: string): string {
+  const dir = join(
+    tmpdir(),
+    `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+  );
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+function setupGsdDir(tmp: string): void {
+  mkdirSync(join(tmp, ".gsd"), { recursive: true });
+}
+
+// ─── Classification Types ─────────────────────────────────────────────────────
+
+test("stop is a valid classification", () => {
+  const tmp = makeTempDir("stop-class");
+  setupGsdDir(tmp);
+  const id = appendCapture(tmp, "stop running immediately");
+  markCaptureResolved(tmp, id, "stop", "Halt auto-mode", "User said stop", "M005");
+  const all = loadAllCaptures(tmp);
+  const cap = all.find(c => c.id === id);
+  assert.equal(cap?.classification, "stop");
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test("backtrack is a valid classification", () => {
+  const tmp = makeTempDir("bt-class");
+  setupGsdDir(tmp);
+  const id = appendCapture(tmp, "restart from M003");
+  markCaptureResolved(tmp, id, "backtrack", "Backtrack to M003", "User wants to restart", "M005");
+  const all = loadAllCaptures(tmp);
+  const cap = all.find(c => c.id === id);
+  assert.equal(cap?.classification, "backtrack");
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+// ─── loadStopCaptures ─────────────────────────────────────────────────────────
+
+test("loadStopCaptures returns unexecuted stop and backtrack captures", () => {
+  const tmp = makeTempDir("load-stop");
+  setupGsdDir(tmp);
+  const stopId = appendCapture(tmp, "halt execution");
+  const btId = appendCapture(tmp, "go back to M003");
+  const noteId = appendCapture(tmp, "just a note");
+  markCaptureResolved(tmp, stopId, "stop", "Halt", "User stop", "M005");
+  markCaptureResolved(tmp, btId, "backtrack", "Backtrack to M003", "User backtrack", "M005");
+  markCaptureResolved(tmp, noteId, "note", "Info only", "Not actionable", "M005");
+
+  const stops = loadStopCaptures(tmp);
+  assert.equal(stops.length, 2);
+  assert.ok(stops.some(c => c.classification === "stop"));
+  assert.ok(stops.some(c => c.classification === "backtrack"));
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test("loadBacktrackCaptures returns only backtrack captures", () => {
+  const tmp = makeTempDir("load-bt");
+  setupGsdDir(tmp);
+  const stopId = appendCapture(tmp, "halt execution");
+  const btId = appendCapture(tmp, "go back to M003");
+  markCaptureResolved(tmp, stopId, "stop", "Halt", "User stop", "M005");
+  markCaptureResolved(tmp, btId, "backtrack", "Backtrack to M003", "User backtrack", "M005");
+
+  const bts = loadBacktrackCaptures(tmp);
+  assert.equal(bts.length, 1);
+  assert.equal(bts[0].classification, "backtrack");
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+// ─── revertExecutorResolvedCaptures ───────────────────────────────────────────
+
+test("revertExecutorResolvedCaptures reverts captures resolved without classification", () => {
+  const tmp = makeTempDir("revert-exec");
+  setupGsdDir(tmp);
+  const id = appendCapture(tmp, "stop everything");
+
+  // Simulate an executor writing Status: resolved directly (no classification)
+  const capPath = join(tmp, ".gsd", "CAPTURES.md");
+  let content = readFileSync(capPath, "utf-8");
+  content = content.replace("**Status:** pending", "**Status:** resolved");
+  writeFileSync(capPath, content, "utf-8");
+
+  // Verify it's now "resolved" without classification
+  assert.equal(hasPendingCaptures(tmp), false);
+
+  // Revert should detect and fix it
+  const reverted = revertExecutorResolvedCaptures(tmp);
+  assert.equal(reverted, 1);
+
+  // Should be pending again
+  assert.equal(hasPendingCaptures(tmp), true);
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test("revertExecutorResolvedCaptures does NOT revert properly triaged captures", () => {
+  const tmp = makeTempDir("revert-skip");
+  setupGsdDir(tmp);
+  const id = appendCapture(tmp, "restart from M003");
+  markCaptureResolved(tmp, id, "backtrack", "Backtrack to M003", "User wants restart", "M005");
+
+  // This capture was properly triaged — should NOT be reverted
+  const reverted = revertExecutorResolvedCaptures(tmp);
+  assert.equal(reverted, 0);
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+// ─── executeBacktrack ─────────────────────────────────────────────────────────
+
+test("executeBacktrack writes trigger and regression markers", () => {
+  const tmp = makeTempDir("exec-bt");
+  setupGsdDir(tmp);
+
+  // Create target milestone directory
+  mkdirSync(join(tmp, ".gsd", "milestones", "M003"), { recursive: true });
+
+  const targetMid = executeBacktrack(tmp, "M005", {
+    id: "CAP-test123",
+    text: "restart from M003 — milestones after 2 failed",
+    timestamp: new Date().toISOString(),
+    status: "resolved",
+    classification: "backtrack",
+    resolution: "Backtrack to M003",
+    rationale: "User directive",
+  });
+
+  assert.equal(targetMid, "M003");
+
+  // Check trigger file exists
+  const triggerPath = join(tmp, ".gsd", "BACKTRACK-TRIGGER.md");
+  assert.ok(existsSync(triggerPath));
+  const triggerContent = readFileSync(triggerPath, "utf-8");
+  assert.ok(triggerContent.includes("M005"));
+  assert.ok(triggerContent.includes("M003"));
+
+  // Check regression marker exists on target milestone
+  const regressionPath = join(tmp, ".gsd", "milestones", "M003", "M003-REGRESSION.md");
+  assert.ok(existsSync(regressionPath));
+  const regressionContent = readFileSync(regressionPath, "utf-8");
+  assert.ok(regressionContent.includes("M005"));
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+// ─── readBacktrackTrigger ─────────────────────────────────────────────────────
+
+test("readBacktrackTrigger parses trigger file", () => {
+  const tmp = makeTempDir("read-bt");
+  setupGsdDir(tmp);
+  mkdirSync(join(tmp, ".gsd", "milestones", "M003"), { recursive: true });
+
+  executeBacktrack(tmp, "M005", {
+    id: "CAP-abc",
+    text: "go back to M003",
+    timestamp: new Date().toISOString(),
+    status: "resolved",
+    classification: "backtrack",
+    resolution: "Backtrack to M003",
+    rationale: "Regression",
+  });
+
+  const trigger = readBacktrackTrigger(tmp);
+  assert.ok(trigger);
+  assert.equal(trigger.target, "M003");
+  assert.equal(trigger.from, "M005");
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test("readBacktrackTrigger returns null when no trigger exists", () => {
+  const tmp = makeTempDir("no-bt");
+  setupGsdDir(tmp);
+  const trigger = readBacktrackTrigger(tmp);
+  assert.equal(trigger, null);
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+// ─── Slice Skip Status (#3477) ──────────────────────────────────────────────
+
+test("isClosedStatus treats 'skipped' as closed", () => {
+  assert.equal(isClosedStatus("skipped"), true);
+  assert.equal(isClosedStatus("complete"), true);
+  assert.equal(isClosedStatus("done"), true);
+  assert.equal(isClosedStatus("pending"), false);
+  assert.equal(isClosedStatus("active"), false);
+});

package/src/resources/extensions/gsd/tests/tool-naming.test.ts

@@ -45,7 +45,7 @@ console.log('\n── Tool naming: registration count ──');
 const pi = makeMockPi();
 registerDbTools(pi);
 
-assert.deepStrictEqual(pi.tools.length, 29, 'Should register exactly 29 tools (14 canonical + 14 aliases + 1 gate tool)');
+assert.deepStrictEqual(pi.tools.length, 30, 'Should register exactly 30 tools (14 canonical + 14 aliases + 1 gate tool + 1 gsd_skip_slice)');
 
 // ─── Both names exist for each pair ──────────────────────────────────────────
 

package/src/resources/extensions/gsd/tests/workflow-logger-audit.test.ts

@@ -0,0 +1,120 @@
+// GSD Extension — Workflow Logger Audit Persistence Tests
+// Validates error-only persistence, sanitization, and warning ephemeral behavior.
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  logWarning,
+  logError,
+  setLogBasePath,
+  _resetLogs,
+  peekLogs,
+  drainLogs,
+} from "../workflow-logger.ts";
+
+function createTempProject(): string {
+  const tmp = mkdtempSync(join(tmpdir(), "gsd-wflog-test-"));
+  mkdirSync(join(tmp, ".gsd"), { recursive: true });
+  return tmp;
+}
+
+function readAuditLines(basePath: string): Record<string, unknown>[] {
+  const auditPath = join(basePath, ".gsd", "audit-log.jsonl");
+  if (!existsSync(auditPath)) return [];
+  const content = readFileSync(auditPath, "utf-8").trim();
+  if (!content) return [];
+  return content.split("\n").map((line) => JSON.parse(line));
+}
+
+describe("workflow-logger audit persistence", () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = createTempProject();
+    _resetLogs();
+    setLogBasePath(tmp);
+  });
+
+  afterEach(() => {
+    _resetLogs();
+    setLogBasePath(null as unknown as string);
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("logError persists to audit-log.jsonl", () => {
+    logError("engine", "something broke");
+    const lines = readAuditLines(tmp);
+    assert.equal(lines.length, 1);
+    assert.equal(lines[0].severity, "error");
+    assert.equal(lines[0].component, "engine");
+  });
+
+  test("logWarning does NOT persist to audit-log.jsonl", () => {
+    logWarning("engine", "something fishy");
+    const lines = readAuditLines(tmp);
+    assert.equal(lines.length, 0, "warnings must not be persisted to audit log");
+  });
+
+  test("logWarning still appears in in-memory buffer", () => {
+    logWarning("recovery", "probe miss");
+    const entries = peekLogs();
+    assert.equal(entries.length, 1);
+    assert.equal(entries[0].severity, "warn");
+    assert.equal(entries[0].component, "recovery");
+  });
+
+  test("persisted error messages are truncated at 200 chars", () => {
+    const longMessage = "x".repeat(300);
+    logError("engine", longMessage);
+    const lines = readAuditLines(tmp);
+    assert.equal(lines.length, 1);
+    const msg = lines[0].message as string;
+    assert.ok(msg.length <= 215, `message should be truncated, got ${msg.length} chars`);
+    assert.ok(msg.endsWith("…[truncated]"));
+  });
+
+  test("persisted errors have context filtered to safe allowlist", () => {
+    logError("tool", "tool failed", {
+      fn: "saveDecisionToDb",
+      tool: "gsd_decision_save",
+      error: "SQLITE_BUSY: database is locked",
+      file: "/home/user/project/gsd.db",
+    });
+    const lines = readAuditLines(tmp);
+    assert.equal(lines.length, 1);
+    const ctx = lines[0].context as Record<string, string>;
+    assert.ok(ctx, "context should exist");
+    assert.equal(ctx.fn, "saveDecisionToDb");
+    assert.equal(ctx.tool, "gsd_decision_save");
+    assert.equal(ctx.error, undefined, "error key must be stripped from persisted context");
+    assert.equal(ctx.file, undefined, "file key must be stripped from persisted context");
+  });
+
+  test("persisted errors omit context when no safe keys present", () => {
+    logError("bootstrap", "ensureDbOpen failed", {
+      error: "ENOENT",
+      cwd: "/home/user/project",
+    });
+    const lines = readAuditLines(tmp);
+    assert.equal(lines.length, 1);
+    assert.equal(lines[0].context, undefined, "context should be omitted when no safe keys match");
+  });
+
+  test("mixed warnings and errors only persist errors", () => {
+    logWarning("recovery", "main not found");
+    logWarning("recovery", "master not found");
+    logError("engine", "fatal failure");
+    logWarning("prompt", "cache miss");
+
+    const lines = readAuditLines(tmp);
+    assert.equal(lines.length, 1, "only the error should be persisted");
+    assert.equal(lines[0].severity, "error");
+
+    const buffered = drainLogs();
+    assert.equal(buffered.length, 4, "all entries should be in the in-memory buffer");
+  });
+});