gsd-pi 2.63.0-dev.026d309 → 2.63.0-dev.786f0ff

package/src/resources/extensions/gsd/tests/artifact-corruption-2630.test.ts

@@ -0,0 +1,288 @@
+// GSD — regression tests for issue #2630
+// Milestone/slice artifact rendering must not corrupt existing markdown.
+// Three bugs: (A) milestone title double-prefix, (B) full_uat_md demo fallback,
+// (C) STATE.md title double-prefix.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+  renderPlanContent,
+  renderRoadmapContent,
+  renderStateContent,
+} from '../workflow-projections.ts';
+import type { SliceRow, TaskRow, MilestoneRow } from '../gsd-db.ts';
+import type { GSDState } from '../types.ts';
+
+// ─── Helpers ─────────────────────────────────────────────────────────────
+
+function makeSliceRow(overrides?: Partial<SliceRow>): SliceRow {
+  return {
+    milestone_id: 'M001',
+    id: 'S04',
+    title: 'Dependency-driven scene pipeline and state truth',
+    status: 'complete',
+    risk: 'high',
+    depends: ['S03'],
+    demo: '',
+    created_at: '2026-01-01T00:00:00Z',
+    completed_at: '2026-01-15T00:00:00Z',
+    full_summary_md: '',
+    full_uat_md: `# S04: Dependency-driven scene pipeline and state truth — UAT
+
+**Milestone:** M001
+**Written:** 2026-01-15
+
+## UAT Type: Functional
+
+### Scenario 1: Pipeline processes dependencies
+**Given** a scene with dependencies
+**When** the pipeline runs
+**Then** dependencies are resolved in order`,
+    goal: 'Build dependency-driven scene pipeline',
+    success_criteria: '',
+    proof_level: '',
+    integration_closure: '',
+    observability_impact: '',
+    sequence: 4,
+    replan_triggered_at: null,
+    ...overrides,
+  };
+}
+
+function makeTaskRow(overrides?: Partial<TaskRow>): TaskRow {
+  return {
+    milestone_id: 'M001',
+    slice_id: 'S04',
+    id: 'T01',
+    title: 'Test Task',
+    status: 'done',
+    one_liner: '',
+    narrative: '',
+    verification_result: '',
+    duration: '',
+    completed_at: null,
+    blocker_discovered: false,
+    deviations: '',
+    known_issues: '',
+    key_files: [],
+    key_decisions: [],
+    full_summary_md: '',
+    full_plan_md: '',
+    description: 'Test description',
+    estimate: '30m',
+    files: [],
+    verify: 'npm test',
+    inputs: [],
+    expected_output: [],
+    observability_impact: '',
+    sequence: 0,
+    ...overrides,
+  };
+}
+
+function makeMilestoneRow(overrides?: Partial<MilestoneRow>): MilestoneRow {
+  return {
+    id: 'M001',
+    title: 'Topic-to-pipeline foundation',
+    status: 'active',
+    depends_on: [],
+    created_at: '2026-01-01T00:00:00Z',
+    completed_at: null,
+    vision: 'Build the topic-to-pipeline foundation',
+    success_criteria: [],
+    key_risks: [],
+    proof_strategy: [],
+    verification_contract: '',
+    verification_integration: '',
+    verification_operational: '',
+    verification_uat: '',
+    definition_of_done: [],
+    requirement_coverage: '',
+    boundary_map_markdown: '',
+    ...overrides,
+  };
+}
+
+function makeGSDState(overrides?: Partial<GSDState>): GSDState {
+  return {
+    activeMilestone: { id: 'M001', title: 'Topic-to-pipeline foundation' },
+    activeSlice: { id: 'S01', title: 'Auth Layer' },
+    activeTask: null,
+    phase: 'executing',
+    recentDecisions: [],
+    blockers: [],
+    nextAction: 'Continue execution',
+    registry: [],
+    requirements: undefined,
+    ...overrides,
+  };
+}
+
+// ─── Bug A: milestone title double-prefix ────────────────────────────────
+// When params.title already contains "M001: ", the H1 should NOT become
+// "# M001: M001: Topic-to-pipeline foundation"
+
+test('#2630 renderRoadmapContent: milestone title with pre-existing ID prefix renders without duplication', () => {
+  const milestone = makeMilestoneRow({ title: 'M001: Topic-to-pipeline foundation' });
+  const content = renderRoadmapContent(milestone, []);
+
+  // The H1 must be exactly "# M001: Topic-to-pipeline foundation", not "# M001: M001: ..."
+  assert.ok(
+    content.includes('# M001: Topic-to-pipeline foundation'),
+    `expected single prefix in H1, got: ${content.split('\n')[0]}`,
+  );
+  assert.ok(
+    !content.includes('M001: M001:'),
+    `found double prefix in roadmap H1: ${content.split('\n')[0]}`,
+  );
+});
+
+test('#2630 renderStateContent: active milestone title with pre-existing ID prefix renders without duplication', () => {
+  const state = makeGSDState({
+    activeMilestone: { id: 'M001', title: 'M001: Topic-to-pipeline foundation' },
+  });
+  const content = renderStateContent(state);
+
+  assert.ok(
+    !content.includes('M001: M001:'),
+    `found double prefix in STATE.md: ${content}`,
+  );
+  assert.ok(
+    content.includes('**Active Milestone:** M001: Topic-to-pipeline foundation'),
+    `expected single prefix, got: ${content}`,
+  );
+});
+
+test('#2630 renderStateContent: registry entry with pre-existing ID prefix renders without duplication', () => {
+  const state = makeGSDState({
+    registry: [
+      { id: 'M001', title: 'M001: Topic-to-pipeline foundation', status: 'active' },
+    ],
+  });
+  const content = renderStateContent(state);
+
+  assert.ok(
+    !content.includes('M001: M001:'),
+    `found double prefix in registry: ${content}`,
+  );
+});
+
+// ─── Bug D: PLAN.md slice title double-prefix ──────────────────────────────
+// When sliceRow.title already contains "S04: ", the H1 should NOT become
+// "# S04: S04: Dependency-driven scene pipeline and state truth"
+
+test('#2630 renderPlanContent: slice title with pre-existing ID prefix renders without duplication', () => {
+  const slice = makeSliceRow({ title: 'S04: Dependency-driven scene pipeline and state truth' });
+  const content = renderPlanContent(slice, []);
+
+  // The H1 must be exactly "# S04: Dependency-driven scene pipeline and state truth"
+  assert.ok(
+    content.includes('# S04: Dependency-driven scene pipeline and state truth'),
+    `expected single prefix in H1, got: ${content.split('\n')[0]}`,
+  );
+  assert.ok(
+    !content.includes('S04: S04:'),
+    `found double prefix in PLAN.md H1: ${content.split('\n')[0]}`,
+  );
+});
+
+test('#2630 renderPlanContent: slice title without prefix still renders correctly', () => {
+  const slice = makeSliceRow({ title: 'Dependency-driven scene pipeline and state truth' });
+  const content = renderPlanContent(slice, []);
+
+  assert.ok(
+    content.startsWith('# S04: Dependency-driven scene pipeline and state truth'),
+    `expected prefixed H1, got: ${content.split('\n')[0]}`,
+  );
+});
+
+// ─── Bug B: full_uat_md as demo fallback ─────────────────────────────────
+// When slice.demo is empty and full_uat_md is a multi-line UAT document,
+// the renderers must NOT inject the entire UAT body.
+
+test('#2630 renderPlanContent: empty demo must not inject full_uat_md body into plan', () => {
+  const slice = makeSliceRow({ demo: '' });
+  const content = renderPlanContent(slice, []);
+
+  // The **Demo:** line must be a single line, not multi-line UAT content
+  const demoLine = content.split('\n').find(l => l.startsWith('**Demo:**'));
+  assert.ok(demoLine, 'should have a Demo line');
+
+  // Must not contain UAT headings or body
+  assert.ok(
+    !content.includes('## UAT Type'),
+    `plan contains UAT body content: ${content}`,
+  );
+  assert.ok(
+    !content.includes('**Milestone:** M001'),
+    `plan contains UAT metadata: ${content}`,
+  );
+
+  // The Demo line must not contain newlines (single line only)
+  assert.ok(
+    !demoLine!.includes('\n'),
+    `Demo line must be single line, got: ${demoLine}`,
+  );
+});
+
+test('#2630 renderPlanContent: null demo must not inject full_uat_md body into plan', () => {
+  const slice = makeSliceRow({ demo: null as unknown as string });
+  const content = renderPlanContent(slice, []);
+
+  assert.ok(
+    !content.includes('## UAT Type'),
+    `plan contains UAT body content when demo is null`,
+  );
+});
+
+test('#2630 renderRoadmapContent: empty demo must not inject full_uat_md into roadmap table', () => {
+  const milestone = makeMilestoneRow();
+  const slices = [makeSliceRow({ demo: '' })];
+
+  const content = renderRoadmapContent(milestone, slices);
+
+  // Roadmap table cell for "After this" must be single-line
+  assert.ok(
+    !content.includes('## UAT Type'),
+    `roadmap contains UAT body content: ${content}`,
+  );
+  assert.ok(
+    !content.includes('**Milestone:** M001'),
+    `roadmap contains UAT metadata: ${content}`,
+  );
+
+  // The table row containing S04 must be a single line
+  const s04Line = content.split('\n').find(l => l.includes('| S04 |'));
+  assert.ok(s04Line, 'should have S04 table row');
+  assert.ok(
+    !s04Line!.includes('# S04:'),
+    `roadmap table cell contains UAT heading: ${s04Line}`,
+  );
+});
+
+test('#2630 renderRoadmapContent: null demo must not inject full_uat_md into roadmap table', () => {
+  const milestone = makeMilestoneRow();
+  const slices = [makeSliceRow({ demo: null as unknown as string })];
+
+  const content = renderRoadmapContent(milestone, slices);
+
+  assert.ok(
+    !content.includes('## UAT Type'),
+    `roadmap contains UAT body content when demo is null`,
+  );
+});
+
+test('#2630 renderPlanContent: with valid demo string does not use full_uat_md', () => {
+  const slice = makeSliceRow({ demo: 'Login flow works end-to-end' });
+  const content = renderPlanContent(slice, []);
+
+  assert.ok(
+    content.includes('**Demo:** After this: Login flow works end-to-end'),
+    `expected demo text, got: ${content}`,
+  );
+  assert.ok(
+    !content.includes('UAT'),
+    `should not contain UAT when demo is provided`,
+  );
+});

package/src/resources/extensions/gsd/tests/auto-loop.test.ts

@@ -325,7 +325,7 @@ test("auto/phases.ts: selectAndApplyModel called exactly once and before updateP
   // Extract the runUnitPhase function body
   const fnStart = src.indexOf("export async function runUnitPhase");
   assert.ok(fnStart > 0, "runUnitPhase should exist in phases.ts");
-  const fnBody = src.slice(fnStart, fnStart + 8000);
+  const fnBody = src.slice(fnStart, fnStart + 12000);
 
   // selectAndApplyModel must appear exactly once
   const allOccurrences = [...fnBody.matchAll(/selectAndApplyModel\(/g)];
@@ -2107,11 +2107,11 @@ test("autoLoop rejects execute-task with 0 tool calls as hallucinated (#1833)",
   // The task should NOT have been added to completedUnits on the first iteration
   // (0 tool calls), but SHOULD be added on the second iteration (5 tool calls)
   const warningNotification = notifications.find(
-    (n) => n.includes("0 tool calls") && n.includes("hallucinated"),
+    (n) => n.includes("0 tool calls") && n.includes("context exhaustion"),
   );
   assert.ok(
     warningNotification,
-    "should notify about 0 tool calls hallucination",
+    "should notify about 0 tool calls context exhaustion",
   );
 
   // Verify deriveState was called at least twice (two iterations)
@@ -2122,7 +2122,7 @@ test("autoLoop rejects execute-task with 0 tool calls as hallucinated (#1833)",
   );
 });
 
-test("autoLoop does NOT reject non-execute-task units with 0 tool calls (#1833)", async () => {
+test("autoLoop rejects complete-slice with 0 tool calls as context-exhausted (#2653)", async () => {
   _resetPendingResolve();
 
   const ctx = makeMockCtx();
@@ -2130,6 +2130,7 @@ test("autoLoop does NOT reject non-execute-task units with 0 tool calls (#1833)"
   ctx.sessionManager = { getSessionFile: () => "/tmp/session.json" };
   const pi = makeMockPi();
 
+  let iterationCount = 0;
   const notifications: string[] = [];
   ctx.ui.notify = (msg: string) => { notifications.push(msg); };
 
@@ -2163,7 +2164,7 @@ test("autoLoop does NOT reject non-execute-task units with 0 tool calls (#1833)"
       };
     },
     closeoutUnit: async () => {
-      // complete-slice with 0 tool calls is fine (e.g. it may just update status)
+      // complete-slice with 0 tool calls — context exhausted, no progress
       mockLedger.units.push({
         type: "complete-slice",
         id: "M001/S01",
@@ -2177,31 +2178,51 @@ test("autoLoop does NOT reject non-execute-task units with 0 tool calls (#1833)"
     getLedger: () => mockLedger,
     postUnitPostVerification: async () => {
       deps.callLog.push("postUnitPostVerification");
-      s.active = false;
+      iterationCount++;
+      // Deactivate after 2nd iteration
+      s.active = iterationCount < 2;
       return "continue" as const;
     },
   });
 
   const loopPromise = autoLoop(ctx, pi, s, deps);
 
+  // First iteration: complete-slice with 0 tool calls → rejected
   await new Promise((r) => setTimeout(r, 50));
   resolveAgentEnd(makeEvent());
 
+  // Second iteration: re-dispatched, this time with tool calls
+  await new Promise((r) => setTimeout(r, 50));
+  mockLedger.units.length = 0;
+  (deps as any).closeoutUnit = async () => {
+    mockLedger.units.push({
+      type: "complete-slice",
+      id: "M001/S01",
+      startedAt: s.currentUnit?.startedAt ?? Date.now(),
+      toolCalls: 3,
+      assistantMessages: 2,
+      tokens: { input: 200, output: 400, total: 600, cacheRead: 0, cacheWrite: 0 },
+      cost: 0.30,
+    });
+  };
+  resolveAgentEnd(makeEvent());
+
   await loopPromise;
 
-  // Should NOT have a hallucination warning for non-execute-task units
+  // Should have a warning about 0 tool calls for complete-slice
   const warningNotification = notifications.find(
-    (n) => n.includes("0 tool calls") && n.includes("hallucinated"),
+    (n) => n.includes("0 tool calls"),
   );
   assert.ok(
-    !warningNotification,
-    "should NOT flag non-execute-task units with 0 tool calls",
+    warningNotification,
+    "should flag complete-slice with 0 tool calls as failed (#2653)",
   );
 
-  // Verify the loop ran to completion (postUnitPostVerification was called)
+  // Verify deriveState was called at least twice (two iterations: rejected + retry)
+  const deriveCount = deps.callLog.filter((c) => c === "deriveState").length;
   assert.ok(
-    deps.callLog.includes("postUnitPostVerification"),
-    "complete-slice with 0 tool calls should still complete the post-unit pipeline",
+    deriveCount >= 2,
+    `deriveState should be called at least 2 times for retry (got ${deriveCount})`,
   );
 });
 

package/src/resources/extensions/gsd/tests/cmux.test.ts

@@ -193,6 +193,64 @@ describe("createGridLayout", () => {
   });
 });
 
+describe("CmuxClient stdio isolation", () => {
+  test("runSync and runAsync explicitly set stdio to prevent terminal interference", () => {
+    // Read the cmux index source and verify that execFileSync/spawn calls
+    // inside runSync/runAsync include stdio options that isolate stdin and stderr.
+    // This prevents the cmux CLI child process from inheriting the parent's
+    // stdin/stderr, which can steal keyboard input or corrupt TUI rendering (#1922).
+    const cmuxIndexPath = path.resolve(
+      path.dirname(fileURLToPath(import.meta.url)),
+      "../../cmux/index.ts",
+    );
+    const source = fs.readFileSync(cmuxIndexPath, "utf-8");
+
+    // Extract runSync method body
+    const runSyncMatch = source.match(/private runSync\(args: string\[\]\)[^{]*\{([\s\S]*?)\n  \}/);
+    assert.ok(runSyncMatch, "runSync method must exist");
+    const runSyncBody = runSyncMatch[1];
+    assert.ok(
+      runSyncBody.includes('stdio:'),
+      "runSync must explicitly set stdio to prevent terminal interference (see #1922)",
+    );
+    assert.ok(
+      runSyncBody.includes('"ignore"'),
+      "runSync stdio must ignore stdin to prevent stealing keyboard input from TUI",
+    );
+
+    // Extract runAsync method body
+    const runAsyncMatch = source.match(/private async runAsync\(args: string\[\]\)[^{]*\{([\s\S]*?)\n  \}/);
+    assert.ok(runAsyncMatch, "runAsync method must exist");
+    const runAsyncBody = runAsyncMatch[1];
+    assert.ok(
+      runAsyncBody.includes('stdio:'),
+      "runAsync must explicitly set stdio to prevent terminal interference (see #1922)",
+    );
+    assert.ok(
+      runAsyncBody.includes('"ignore"'),
+      "runAsync stdio must ignore stdin to prevent stealing keyboard input from TUI",
+    );
+  });
+
+  test("isCmuxCliAvailable uses stdio ignore to prevent terminal interference", () => {
+    const cmuxIndexPath = path.resolve(
+      path.dirname(fileURLToPath(import.meta.url)),
+      "../../cmux/index.ts",
+    );
+    const source = fs.readFileSync(cmuxIndexPath, "utf-8");
+
+    // Find isCmuxCliAvailable or the cli-check function body
+    const fnMatch = source.match(/function isCmuxCliAvailable[\s\S]*?\{([\s\S]*?)\n\}/);
+    if (!fnMatch) return; // function may be inlined or renamed — skip rather than fail
+
+    const fnBody = fnMatch[1];
+    assert.ok(
+      fnBody.includes('"ignore"') || !fnBody.includes('execFileSync'),
+      "isCmuxCliAvailable must not inherit parent stdio (see #1922)",
+    );
+  });
+});
+
 describe("cmux extension discovery opt-out", () => {
   test("cmux directory has package.json with pi manifest to prevent auto-discovery as extension", () => {
     const cmuxDir = path.resolve(

package/src/resources/extensions/gsd/tests/cold-resume-db-reopen.test.ts

@@ -0,0 +1,51 @@
+/**
+ * cold-resume-db-reopen.test.ts — Regression test for #2940.
+ *
+ * Validates that the paused-session resume path in auto.ts opens the project
+ * database before calling rebuildState() / deriveState(), matching the fresh
+ * bootstrap path in auto-start.ts.
+ *
+ * Without this, cold resume falls back to markdown parsing which misreads
+ * done cells and redispatches wrong slices.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { createTestContext } from "./test-helpers.ts";
+
+const { assertTrue, report } = createTestContext();
+
+const autoSrc = readFileSync(join(import.meta.dirname, "..", "auto.ts"), "utf-8");
+
+console.log("\n=== #2940: resume path opens DB before rebuildState/deriveState ===");
+
+// The resume block is the `if (s.paused) { ... }` section that calls rebuildState/deriveState.
+// Locate the resume section by finding `s.paused = false;` followed by `rebuildState`.
+const resumeSectionStart = autoSrc.indexOf("if (s.paused) {", autoSrc.indexOf("// If resuming from paused state"));
+assertTrue(resumeSectionStart > 0, "auto.ts has the paused-session resume block");
+
+const resumeSection = autoSrc.slice(resumeSectionStart, resumeSectionStart + 3000);
+
+// The resume path must open the DB before rebuildState/deriveState
+const rebuildIdx = resumeSection.indexOf("rebuildState(");
+assertTrue(rebuildIdx > 0, "resume block calls rebuildState");
+
+const deriveIdx = resumeSection.indexOf("deriveState(");
+assertTrue(deriveIdx > 0, "resume block calls deriveState");
+
+// There must be a DB open call before the first rebuildState call
+const dbOpenPatterns = [
+  "openProjectDbIfPresent(",
+  "openDatabase(",
+  "ensureDbOpen(",
+];
+
+const preDeriveSection = resumeSection.slice(0, rebuildIdx);
+const hasDbOpen = dbOpenPatterns.some(pat => preDeriveSection.includes(pat));
+assertTrue(
+  hasDbOpen,
+  "resume path must open DB before rebuildState/deriveState (#2940)",
+);
+
+report();

package/src/resources/extensions/gsd/tests/complete-milestone.test.ts

@@ -264,6 +264,146 @@ describe("complete-milestone", () => {
     );
   });
 
+  test("sanitizeCompleteMilestoneParams normalizes string parameters", async () => {
+    const { sanitizeCompleteMilestoneParams } = await import("../bootstrap/sanitize-complete-milestone.ts");
+
+    // Simulate params as they might arrive from the SDK after partial JSON parse:
+    // - numbers instead of strings
+    // - null instead of arrays
+    // - extra whitespace in strings
+    // - undefined optional fields
+    const raw: any = {
+      milestoneId: "  M011 ",
+      title: 42,                              // number instead of string
+      oneLiner: "  One-liner with spaces  ",
+      narrative: "# Big markdown\n\nWith newlines and `backticks`\n\n```ts\ncode();\n```\n",
+      successCriteriaResults: null,            // null instead of string
+      definitionOfDoneResults: undefined,      // undefined instead of string
+      requirementOutcomes: 12345,              // number instead of string
+      keyDecisions: "not an array",            // string instead of array
+      keyFiles: null,                          // null instead of array
+      lessonsLearned: [" lesson one ", null, "", "  lesson two  "],
+      followUps: "  follow up  ",
+      deviations: undefined,
+      verificationPassed: "true",             // string instead of boolean
+    };
+
+    const sanitized = sanitizeCompleteMilestoneParams(raw);
+
+    // String fields are trimmed and coerced
+    assert.strictEqual(sanitized.milestoneId, "M011");
+    assert.strictEqual(sanitized.title, "42");
+    assert.strictEqual(sanitized.oneLiner, "One-liner with spaces");
+    assert.ok(sanitized.narrative.includes("# Big markdown"), "narrative preserves markdown");
+    assert.strictEqual(sanitized.successCriteriaResults, "");
+    assert.strictEqual(sanitized.definitionOfDoneResults, "");
+    assert.strictEqual(sanitized.requirementOutcomes, "12345");
+
+    // Array fields are normalized
+    assert.ok(Array.isArray(sanitized.keyDecisions), "keyDecisions is an array");
+    assert.deepStrictEqual(sanitized.keyDecisions, []);
+    assert.ok(Array.isArray(sanitized.keyFiles), "keyFiles is an array");
+    assert.deepStrictEqual(sanitized.keyFiles, []);
+    assert.deepStrictEqual(sanitized.lessonsLearned, ["lesson one", "lesson two"]);
+
+    // Optional fields — toStr() returns "" for undefined/null
+    assert.strictEqual(sanitized.followUps, "follow up");
+    assert.strictEqual(sanitized.deviations, "");
+
+    // Boolean coercion
+    assert.strictEqual(sanitized.verificationPassed, true);
+  });
+
+  test("sanitizeCompleteMilestoneParams handles large markdown content", async () => {
+    const { sanitizeCompleteMilestoneParams } = await import("../bootstrap/sanitize-complete-milestone.ts");
+
+    // Generate a large markdown string (~25k characters to exceed the 23667 position from the bug)
+    const largeMd = "# Milestone Summary\n\n" +
+      Array.from({ length: 500 }, (_, i) =>
+        `## Section ${i}\n\n` +
+        `- [x] Task ${i} completed with \`code\` and **bold** text\n` +
+        `  - Sub-item with special chars: <, >, &, ", '\n` +
+        `  - Another sub-item: \`\`\`ts\nconst x = ${i};\n\`\`\`\n`
+      ).join("\n");
+
+    assert.ok(largeMd.length > 23667, `generated markdown is ${largeMd.length} chars, must exceed 23667`);
+
+    const raw: any = {
+      milestoneId: "M011",
+      title: "Content Depth, Narrative & Onboarding",
+      oneLiner: "Large milestone with many slices",
+      narrative: largeMd,
+      successCriteriaResults: largeMd,
+      definitionOfDoneResults: largeMd,
+      requirementOutcomes: largeMd,
+      keyDecisions: ["decision 1", "decision 2"],
+      keyFiles: ["file1.ts", "file2.ts"],
+      lessonsLearned: ["lesson 1"],
+      followUps: "Some follow-ups",
+      deviations: "Some deviations",
+      verificationPassed: true,
+    };
+
+    const sanitized = sanitizeCompleteMilestoneParams(raw);
+
+    // Large content should pass through without truncation or corruption
+    assert.strictEqual(sanitized.narrative, largeMd.trim());
+    assert.strictEqual(sanitized.successCriteriaResults, largeMd.trim());
+    assert.strictEqual(sanitized.definitionOfDoneResults, largeMd.trim());
+    assert.strictEqual(sanitized.requirementOutcomes, largeMd.trim());
+  });
+
+  test("milestoneCompleteExecute uses sanitized params", async () => {
+    // This test verifies that the execute function sanitizes params before passing
+    // to handleCompleteMilestone. We test indirectly: if we pass numeric milestoneId,
+    // the handler should still receive a string (and return a meaningful error, not a crash).
+    const { handleCompleteMilestone } = await import("../tools/complete-milestone.ts");
+    const { sanitizeCompleteMilestoneParams } = await import("../bootstrap/sanitize-complete-milestone.ts");
+    const base = createFixtureBase();
+    try {
+      // Simulate what milestoneCompleteExecute should do: sanitize then call handler
+      const raw: any = {
+        milestoneId: 42,           // number — would crash without sanitization
+        title: "Test",
+        oneLiner: "Test",
+        narrative: "Test narrative",
+        successCriteriaResults: "Results",
+        definitionOfDoneResults: "Done",
+        requirementOutcomes: "Outcomes",
+        keyDecisions: null,        // null — would crash .length without sanitization
+        keyFiles: "not-array",     // string — would crash .map without sanitization
+        lessonsLearned: undefined, // undefined — would crash .map without sanitization
+        followUps: "",
+        deviations: "",
+        verificationPassed: true,
+      };
+
+      const sanitized = sanitizeCompleteMilestoneParams(raw);
+
+      // Verify sanitization didn't crash and produced valid typed params
+      assert.strictEqual(typeof sanitized.milestoneId, "string", "milestoneId is a string after sanitization");
+      assert.ok(Array.isArray(sanitized.keyDecisions), "keyDecisions is array after sanitization");
+      assert.ok(Array.isArray(sanitized.keyFiles), "keyFiles is array after sanitization");
+      assert.ok(Array.isArray(sanitized.lessonsLearned), "lessonsLearned is array after sanitization");
+      assert.strictEqual(typeof sanitized.verificationPassed, "boolean", "verificationPassed is boolean after sanitization");
+
+      // Calling handleCompleteMilestone may throw GSD_STALE_STATE (no DB in test env)
+      // but it should NOT throw TypeError from type mismatches — that's the bug fix.
+      try {
+        await handleCompleteMilestone(sanitized, base);
+      } catch (err: any) {
+        // GSD_STALE_STATE or "No database open" is acceptable — it means we got past
+        // the type-sensitive code and failed on DB access, which is expected in tests.
+        assert.ok(
+          err.code === "GSD_STALE_STATE" || err.message?.includes("database"),
+          `expected DB error, got: ${err.message}`,
+        );
+      }
+    } finally {
+      cleanup(base);
+    }
+  });
+
   test("deriveState completing-milestone integration", async () => {
     const { deriveState, isMilestoneComplete } = await import("../state.ts");
     const { invalidateAllCaches: invalidateAllCachesDynamic } = await import("../cache.ts");