gsd-pi 2.73.1 → 2.74.0-dev.6e23363

package/src/resources/extensions/gsd/tests/integration/state-machine-edge-cases.test.ts

@@ -691,7 +691,7 @@ describe("transition boundary failures", () => {
     );
   });
 
-  test("blocked state: all slices have unmet deps → blocked phase", async () => {
+  test("blocked state: all slices have unmet deps → fallback picks slice", async () => {
     base = makeTempDir();
     const mDir = join(base, ".gsd", "milestones", "M001");
     mkdirSync(join(mDir, "slices", "S01", "tasks"), { recursive: true });
@@ -736,7 +736,9 @@ describe("transition boundary failures", () => {
 
     invalidateAllCaches();
     const state = await deriveStateFromDb(base);
-    assert.equal(state.phase, "blocked", "circular deps should produce blocked phase");
+    // With partial-dep fallback, circular deps no longer block — fallback picks first eligible slice
+    assert.equal(state.phase, "planning", "circular deps: fallback picks a slice instead of blocking");
+    assert.ok(state.activeSlice !== null, "activeSlice set via fallback");
   });
 });
 

package/src/resources/extensions/gsd/tests/journal-integration.test.ts

@@ -92,6 +92,7 @@ function makeMockDeps(
     getPriorSliceCompletionBlocker: () => null,
     getMainBranch: () => "main",
     closeoutUnit: async () => {},
+    autoCommitUnit: async () => null,
     recordOutcome: () => {},
     writeLock: () => {},
     captureAvailableSkills: () => {},
@@ -567,7 +568,15 @@ test("unit-end event contains errorContext when unit is cancelled with structure
   const { resolveAgentEndCancelled, _resetPendingResolve } = await import("../auto-loop.js");
   _resetPendingResolve();
 
-  const deps = makeMockDeps(capture);
+  let pauseCalls = 0;
+  let commitCalls = 0;
+  const deps = makeMockDeps(capture, {
+    pauseAuto: async () => { pauseCalls++; },
+    autoCommitUnit: async () => {
+      commitCalls++;
+      return "commit";
+    },
+  });
   const ic = makeIC(deps);
   const iterData: IterationData = {
     unitType: "execute-task",
@@ -593,10 +602,68 @@ test("unit-end event contains errorContext when unit is cancelled with structure
   // Transient timeout cancellations pause (recoverable) instead of hard-stopping
   assert.equal(result.action, "break");
   assert.equal((result as any).reason, "session-timeout");
+  assert.equal(pauseCalls, 1, "timeout cancellations should pause auto-mode exactly once");
+  assert.equal(commitCalls, 1, "timeout cancellations should flush a unit auto-commit once");
 
   // Verify error classification used structured errorContext on the window entry
   const entry = loopState.recentUnits[loopState.recentUnits.length - 1];
   assert.ok(entry.error, "window entry must have error set");
   assert.ok(entry.error!.startsWith("timeout:"), "error must start with category from errorContext");
   assert.ok(entry.error!.includes("Hard timeout error"), "error must include the errorContext message");
+
+  const endEvents = capture.events.filter(e => e.eventType === "unit-end");
+  assert.equal(endEvents.length, 1, "timeout cancellations should still emit unit-end");
+  assert.equal((endEvents[0].data as any).status, "cancelled");
+  assert.equal((endEvents[0].data as any).artifactVerified, false);
+  assert.equal((endEvents[0].data as any).errorContext.category, "timeout");
+});
+
+test("session-failed cancellations close out and emit unit-end before hard stop", async () => {
+  const capture = createEventCapture();
+  const { resolveAgentEndCancelled, _resetPendingResolve } = await import("../auto-loop.js");
+  _resetPendingResolve();
+
+  let closeoutCalls = 0;
+  let commitCalls = 0;
+  let stopCalls = 0;
+  const deps = makeMockDeps(capture, {
+    closeoutUnit: async () => { closeoutCalls++; },
+    autoCommitUnit: async () => {
+      commitCalls++;
+      return "commit";
+    },
+    stopAuto: async () => { stopCalls++; },
+  });
+  const ic = makeIC(deps);
+  const iterData: IterationData = {
+    unitType: "execute-task",
+    unitId: "M001/S01/T01",
+    prompt: "do stuff",
+    finalPrompt: "do stuff",
+    pauseAfterUatDispatch: false,
+    state: { phase: "executing", activeMilestone: { id: "M001" }, activeSlice: { id: "S01" }, registry: [], blockers: [] } as any,
+    mid: "M001",
+    midTitle: "Test",
+    isRetry: false,
+    previousTier: undefined,
+  };
+  const loopState: LoopState = { recentUnits: [{ key: "execute-task/M001/S01/T01" }], stuckRecoveryAttempts: 0, consecutiveFinalizeTimeouts: 0 };
+
+  const unitPromise = runUnitPhase(ic, iterData, loopState);
+  await new Promise(r => setTimeout(r, 50));
+
+  resolveAgentEndCancelled({ message: "session bootstrap exploded", category: "session-failed", isTransient: false });
+
+  const result = await unitPromise;
+  assert.equal(result.action, "break");
+  assert.equal((result as any).reason, "session-failed");
+  assert.equal(closeoutCalls, 1, "session-failed cancellations should close out the unit before stopping");
+  assert.equal(commitCalls, 1, "session-failed cancellations should try one auto-commit flush");
+  assert.equal(stopCalls, 1, "session-failed cancellations should hard-stop auto-mode");
+
+  const endEvents = capture.events.filter(e => e.eventType === "unit-end");
+  assert.equal(endEvents.length, 1, "session-failed cancellations should emit unit-end");
+  assert.equal((endEvents[0].data as any).status, "cancelled");
+  assert.equal((endEvents[0].data as any).artifactVerified, false);
+  assert.equal((endEvents[0].data as any).errorContext.category, "session-failed");
 });

package/src/resources/extensions/gsd/tests/md-importer.test.ts

@@ -363,7 +363,7 @@ test('md-importer: schema v1→v2 migration', () => {
   openDatabase(':memory:');
   const adapter = _getAdapter();
   const version = adapter?.prepare('SELECT MAX(version) as v FROM schema_version').get();
-  assert.deepStrictEqual(version?.v, 14, 'new DB should be at schema version 14');
+  assert.deepStrictEqual(version?.v, 15, 'new DB should be at schema version 15');
 
   // Artifacts table should exist
   const tableCheck = adapter?.prepare("SELECT count(*) as c FROM sqlite_master WHERE type='table' AND name='artifacts'").get();
@@ -413,4 +413,3 @@ test('md-importer: round-trip fidelity', () => {
 });
 
 // ═══════════════════════════════════════════════════════════════════════════
-

package/src/resources/extensions/gsd/tests/memory-store.test.ts

@@ -323,10 +323,9 @@ test('memory-store: schema includes memories table', () => {
   const viewCount = adapter.prepare('SELECT count(*) as cnt FROM active_memories').get();
   assert.deepStrictEqual(viewCount?.['cnt'], 0, 'active_memories view should exist');
 
-  // Verify schema version is 14 (after indexes + slice_dependencies)
+  // Verify schema version is 15 (UOK gate/git/audit projection tables included)
   const version = adapter.prepare('SELECT MAX(version) as v FROM schema_version').get();
-  assert.deepStrictEqual(version?.['v'], 14, 'schema version should be 14');
+  assert.deepStrictEqual(version?.['v'], 15, 'schema version should be 15');
 
   closeDatabase();
 });
-

package/src/resources/extensions/gsd/tests/model-isolation.test.ts

@@ -1,6 +1,8 @@
 /**
- * Tests for model config isolation between concurrent instances (#650, #1065)
- * and session-scoped model precedence behavior.
+ * Tests for model config isolation between concurrent instances (#650, #1065),
+ * session-scoped model precedence behavior including manual session override,
+ * GSD preferences override of settings.json defaults (#3517), and custom
+ * provider precedence over PREFERENCES.md when set via `/gsd model` (#4122).
  */
 
 import { describe, it, beforeEach, afterEach } from "node:test";
@@ -214,3 +216,90 @@ describe("manual session model override precedence", () => {
       "should be null when no model source is available");
   });
 });
+
+// ─── Custom provider session model wins over PREFERENCES.md (#4122) ─────────
+
+describe("custom provider session model overrides PREFERENCES.md (#4122)", () => {
+  // Mirrors the auto-start.ts logic:
+  //   sessionProviderIsCustom && ctx.model
+  //     ? ctx.model
+  //     : (preferredModel ?? ctx.model ?? null)
+  function selectStartModel(args: {
+    ctxModel: { provider: string; id: string } | null;
+    preferredModel: { provider: string; id: string } | undefined;
+    sessionProviderIsCustom: boolean;
+  }): { provider: string; id: string } | null {
+    const { ctxModel, preferredModel, sessionProviderIsCustom } = args;
+    if (sessionProviderIsCustom && ctxModel) {
+      return { provider: ctxModel.provider, id: ctxModel.id };
+    }
+    return preferredModel
+      ?? (ctxModel ? { provider: ctxModel.provider, id: ctxModel.id } : null);
+  }
+
+  it("custom provider from /gsd model wins over PREFERENCES.md built-in default", () => {
+    // User runs `/gsd model ollama/llama3.1:8b`, then `/gsd auto`.
+    // PREFERENCES.md still has the project-template claude-code default.
+    const ctxModel = { provider: "ollama", id: "llama3.1:8b" };
+    const preferredModel = { provider: "claude-code", id: "claude-sonnet-4-6" };
+
+    const snapshot = selectStartModel({
+      ctxModel,
+      preferredModel,
+      sessionProviderIsCustom: true,
+    });
+
+    assert.equal(snapshot?.provider, "ollama",
+      "custom-provider session model must win over PREFERENCES.md");
+    assert.equal(snapshot?.id, "llama3.1:8b",
+      "custom-provider session model id must be preserved");
+    assert.notEqual(snapshot?.provider, "claude-code",
+      "claude-code from PREFERENCES.md must NOT be selected when session is custom");
+  });
+
+  it("built-in session provider still defers to PREFERENCES.md (#3517 preserved)", () => {
+    // ctx.model is a built-in provider (claude-code) but PREFERENCES.md has
+    // an explicit openai-codex preference.  PREFERENCES.md should still win.
+    const ctxModel = { provider: "claude-code", id: "claude-sonnet-4-6" };
+    const preferredModel = { provider: "openai-codex", id: "gpt-5.4" };
+
+    const snapshot = selectStartModel({
+      ctxModel,
+      preferredModel,
+      sessionProviderIsCustom: false,
+    });
+
+    assert.equal(snapshot?.provider, "openai-codex",
+      "PREFERENCES.md must still win when session provider is built-in");
+    assert.equal(snapshot?.id, "gpt-5.4");
+  });
+
+  it("custom provider with no PREFERENCES.md still uses ctx.model", () => {
+    const ctxModel = { provider: "vllm", id: "qwen2.5-coder:32b" };
+
+    const snapshot = selectStartModel({
+      ctxModel,
+      preferredModel: undefined,
+      sessionProviderIsCustom: true,
+    });
+
+    assert.equal(snapshot?.provider, "vllm");
+    assert.equal(snapshot?.id, "qwen2.5-coder:32b");
+  });
+
+  it("null ctx.model with custom flag falls through to preferredModel", () => {
+    // Defensive: sessionProviderIsCustom can only be true if ctx.model exists,
+    // but verify the guard works if that invariant is ever broken.
+    const preferredModel = { provider: "claude-code", id: "claude-sonnet-4-6" };
+
+    const snapshot = selectStartModel({
+      ctxModel: null,
+      preferredModel,
+      sessionProviderIsCustom: true,
+    });
+
+    assert.equal(snapshot?.provider, "claude-code",
+      "should fall back to preferredModel when ctx.model is null");
+  });
+});
+

package/src/resources/extensions/gsd/tests/native-git-bridge-exec-fallback.test.ts

@@ -0,0 +1,140 @@
+// native-git-bridge-exec-fallback.test.ts — regression for #4180
+//
+// nativeCommit, nativeIsRepo, and nativeResetHard used execSync() (string
+// command) in their fallback paths. On Windows, execSync spawns cmd.exe which
+// cannot resolve git when Git for Windows is installed via MSYS2/bash but not
+// in cmd.exe's PATH. All other fallback paths in this file use execFileSync()
+// which invokes the binary directly — these three must do the same.
+//
+// Static-analysis tests fail before the fix (source still has execSync calls)
+// and pass after (replaced with execFileSync). Integration tests verify the
+// fallback functions behave correctly on all platforms.
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { execFileSync } from "node:child_process";
+import { nativeIsRepo, nativeCommit, nativeResetHard } from "../native-git-bridge.js";
+
+// ─── Static analysis ──────────────────────────────────────────────────────
+// Verify the fallback paths of the three affected functions do not call the
+// raw execSync() string-command variant. Replacing all execFileSync( tokens
+// first ensures we match only the bare execSync( form.
+
+const SRC_PATH = join(import.meta.dirname, "..", "native-git-bridge.ts");
+
+function extractFunctionBody(src: string, fnName: string): string {
+  const idx = src.indexOf(`export function ${fnName}`);
+  if (idx === -1) throw new Error(`${fnName} not found in source`);
+  return src.slice(idx, idx + 1500);
+}
+
+function hasRawExecSync(body: string): boolean {
+  const withoutFileSync = body.replace(/execFileSync\(/g, "__FILESYNC__");
+  return withoutFileSync.includes("execSync(");
+}
+
+describe("native-git-bridge #4180: fallback paths use execFileSync not execSync", () => {
+  const src = readFileSync(SRC_PATH, "utf-8");
+
+  test("nativeIsRepo fallback does not use raw execSync", () => {
+    const body = extractFunctionBody(src, "nativeIsRepo");
+    assert.equal(
+      hasRawExecSync(body),
+      false,
+      "nativeIsRepo fallback must use execFileSync to avoid cmd.exe PATH failures on Windows",
+    );
+  });
+
+  test("nativeCommit fallback does not use raw execSync", () => {
+    const body = extractFunctionBody(src, "nativeCommit");
+    assert.equal(
+      hasRawExecSync(body),
+      false,
+      "nativeCommit fallback must use execFileSync to avoid cmd.exe PATH failures on Windows",
+    );
+  });
+
+  test("nativeResetHard fallback does not use raw execSync", () => {
+    const body = extractFunctionBody(src, "nativeResetHard");
+    assert.equal(
+      hasRawExecSync(body),
+      false,
+      "nativeResetHard fallback must use execFileSync to avoid cmd.exe PATH failures on Windows",
+    );
+  });
+});
+
+// ─── Integration tests ────────────────────────────────────────────────────
+// Verify correct runtime behaviour through the fallback path (native module
+// is disabled by default in tests — GSD_ENABLE_NATIVE_GSD_GIT is not set).
+
+function git(args: string[], cwd: string): string {
+  return execFileSync("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
+}
+
+describe("native-git-bridge #4180: fallback runtime behaviour", () => {
+  let repo: string;
+
+  beforeEach(() => {
+    repo = mkdtempSync(join(tmpdir(), "ngb4180-"));
+    git(["init"], repo);
+    git(["config", "user.email", "test@test.com"], repo);
+    git(["config", "user.name", "Test"], repo);
+    writeFileSync(join(repo, "file.txt"), "initial\n");
+    git(["add", "."], repo);
+    git(["commit", "-m", "init"], repo);
+  });
+
+  afterEach(() => {
+    rmSync(repo, { recursive: true, force: true });
+  });
+
+  test("nativeIsRepo returns true for a valid git repository", () => {
+    assert.equal(nativeIsRepo(repo), true);
+  });
+
+  test("nativeIsRepo returns false for a plain directory", (t) => {
+    const dir = mkdtempSync(join(tmpdir(), "ngb4180-notrepo-"));
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    assert.equal(nativeIsRepo(dir), false);
+  });
+
+  test("nativeCommit commits staged changes and returns non-null output", () => {
+    writeFileSync(join(repo, "file.txt"), "modified\n");
+    git(["add", "."], repo);
+
+    const result = nativeCommit(repo, "test: regression commit #4180");
+    assert.ok(result !== null, "should return output string for a successful commit");
+
+    const subject = git(["log", "-1", "--format=%s"], repo);
+    assert.equal(subject, "test: regression commit #4180");
+  });
+
+  test("nativeCommit returns null when nothing is staged", () => {
+    const result = nativeCommit(repo, "test: nothing staged");
+    assert.equal(result, null);
+  });
+
+  test("nativeCommit respects the allowEmpty option", () => {
+    const result = nativeCommit(repo, "test: empty commit #4180", { allowEmpty: true });
+    assert.ok(result !== null, "allow-empty commit should return output");
+
+    const subject = git(["log", "-1", "--format=%s"], repo);
+    assert.equal(subject, "test: empty commit #4180");
+  });
+
+  test("nativeResetHard discards unstaged working tree changes", () => {
+    writeFileSync(join(repo, "file.txt"), "dirty content\n");
+
+    const statusBefore = git(["status", "--short"], repo);
+    assert.ok(statusBefore.length > 0, "repo should be dirty before reset");
+
+    nativeResetHard(repo);
+
+    const content = readFileSync(join(repo, "file.txt"), "utf-8");
+    assert.equal(content, "initial\n", "file should be restored to HEAD content after hard reset");
+  });
+});

package/src/resources/extensions/gsd/tests/post-exec-retry-bypass.test.ts

@@ -14,7 +14,7 @@ import { join } from "node:path";
 
 import { runPostUnitVerification, type VerificationContext } from "../auto-verification.ts";
 import { AutoSession } from "../auto/session.ts";
-import { openDatabase, closeDatabase, insertMilestone, insertSlice, insertTask } from "../gsd-db.ts";
+import { openDatabase, closeDatabase, insertMilestone, insertSlice, insertTask, _getAdapter } from "../gsd-db.ts";
 import { invalidateAllCaches } from "../cache.ts";
 import { _clearGsdRootCache } from "../paths.ts";
 
@@ -140,6 +140,43 @@ function createBasicTask(): void {
   });
 }
 
+function createPostExecFailureTask(): void {
+  insertMilestone({ id: "M001" });
+  insertSlice({
+    id: "S01",
+    milestoneId: "M001",
+    title: "Test Slice",
+    risk: "low",
+  });
+
+  const srcDir = join(tempDir, "src");
+  mkdirSync(srcDir, { recursive: true });
+  writeFileSync(
+    join(srcDir, "broken.ts"),
+    "import { missing } from './does-not-exist.js';\nexport const ok = 1;\n",
+    "utf-8",
+  );
+
+  insertTask({
+    id: "T01",
+    sliceId: "S01",
+    milestoneId: "M001",
+    title: "Task with broken import",
+    status: "pending",
+    keyFiles: ["src/broken.ts"],
+    planning: {
+      description: "Task that introduces an unresolved import in key files",
+      estimate: "1h",
+      files: ["src/broken.ts"],
+      verify: "echo pass",
+      inputs: [],
+      expectedOutput: [],
+      observabilityImpact: "",
+    },
+    sequence: 0,
+  });
+}
+
 // ─── Tests ───────────────────────────────────────────────────────────────────
 
 describe("Post-execution blocking failure retry bypass", () => {
@@ -249,6 +286,47 @@ describe("Post-execution blocking failure retry bypass", () => {
     // This test mainly confirms the wiring is correct
     assert.equal(result, "continue");
   });
+
+  test("uok gate runner persists post-execution gate failures when enabled", async () => {
+    createPostExecFailureTask();
+    writePreferences({
+      enhanced_verification: true,
+      enhanced_verification_post: true,
+      verification_auto_fix: true,
+      verification_max_retries: 2,
+      uok: {
+        enabled: true,
+        gates: { enabled: true },
+      },
+    });
+
+    const ctx = makeMockCtx();
+    const pi = makeMockPi();
+    const pauseAutoMock = mock.fn(async () => {});
+    const s = makeMockSession(tempDir, { type: "execute-task", id: "M001/S01/T01" });
+    const vctx: VerificationContext = { s, ctx, pi };
+
+    const result = await runPostUnitVerification(vctx, pauseAutoMock);
+
+    assert.equal(result, "pause");
+    assert.equal(pauseAutoMock.mock.callCount(), 1);
+
+    const adapter = _getAdapter();
+    const row = adapter
+      ?.prepare(
+        `SELECT gate_id, outcome, failure_class
+         FROM gate_runs
+         WHERE gate_id = 'post-execution-checks'
+         ORDER BY id DESC
+         LIMIT 1`,
+      )
+      .get() as { gate_id: string; outcome: string; failure_class: string } | undefined;
+
+    assert.ok(row, "post-execution gate run should be persisted when uok.gates is enabled");
+    assert.equal(row?.gate_id, "post-execution-checks");
+    assert.equal(row?.outcome, "fail");
+    assert.equal(row?.failure_class, "artifact");
+  });
 });
 
 describe("Post-execution retry behavior", () => {

package/src/resources/extensions/gsd/tests/post-unit-state-rebuild.test.ts

@@ -21,7 +21,8 @@ test("postUnitPreVerification rebuilds STATE.md before worktree sync", () => {
   const fnStart = source.indexOf("export async function postUnitPreVerification");
   assert.ok(fnStart > 0, "postUnitPreVerification should exist");
 
-  const section = source.slice(fnStart, fnStart + 8000);
+  const fnEnd = source.indexOf("export async function postUnitPostVerification", fnStart);
+  const section = source.slice(fnStart, fnEnd > fnStart ? fnEnd : undefined);
   const rebuildIdx = section.indexOf('await runSafely("postUnit", "state-rebuild"');
   const syncIdx = section.indexOf('await runSafely("postUnit", "worktree-sync"');
 

package/src/resources/extensions/gsd/tests/pre-execution-pause-wiring.test.ts

@@ -17,7 +17,7 @@ import { join } from "node:path";
 
 import { postUnitPostVerification, type PostUnitContext } from "../auto-post-unit.ts";
 import { AutoSession } from "../auto/session.ts";
-import { openDatabase, closeDatabase, insertMilestone, insertSlice, insertTask } from "../gsd-db.ts";
+import { openDatabase, closeDatabase, insertMilestone, insertSlice, insertTask, _getAdapter } from "../gsd-db.ts";
 import { invalidateAllCaches } from "../cache.ts";
 import { _clearGsdRootCache } from "../paths.ts";
 
@@ -454,4 +454,43 @@ describe("Pre-execution checks → pauseAuto wiring", () => {
       "postUnitPostVerification should return 'continue' when pre-execution checks are disabled"
     );
   });
+
+  test("uok gate runner persists pre-execution gate outcomes when enabled", async () => {
+    writePreferences({
+      enhanced_verification: true,
+      enhanced_verification_pre: true,
+      enhanced_verification_strict: true,
+      uok: {
+        enabled: true,
+        gates: { enabled: true },
+      },
+    });
+
+    createFailingTasks();
+
+    const ctx = makeMockCtx();
+    const pi = makeMockPi();
+    const pauseAutoMock = mock.fn(async () => {});
+    const s = makeMockSession(tempDir, { type: "plan-slice", id: "M001/S01" });
+    const pctx = makePostUnitContext(s, ctx, pi, pauseAutoMock);
+
+    const result = await postUnitPostVerification(pctx);
+    assert.equal(result, "stopped");
+
+    const adapter = _getAdapter();
+    const row = adapter
+      ?.prepare(
+        `SELECT gate_id, outcome, failure_class
+         FROM gate_runs
+         WHERE gate_id = 'pre-execution-checks'
+         ORDER BY id DESC
+         LIMIT 1`,
+      )
+      .get() as { gate_id: string; outcome: string; failure_class: string } | undefined;
+
+    assert.ok(row, "pre-execution gate run should be persisted when uok.gates is enabled");
+    assert.equal(row?.gate_id, "pre-execution-checks");
+    assert.equal(row?.outcome, "fail");
+    assert.equal(row?.failure_class, "input");
+  });
 });

package/src/resources/extensions/gsd/tests/preferences.test.ts

@@ -134,6 +134,53 @@ test("invalid value types produce errors and fall back to undefined", () => {
   }
 });
 
+test("flat_rate_providers: accepts string array", () => {
+  const { errors, preferences } = validatePreferences({
+    flat_rate_providers: ["my-proxy", "private-cli"],
+  });
+  assert.equal(errors.length, 0);
+  assert.deepEqual(preferences.flat_rate_providers, ["my-proxy", "private-cli"]);
+});
+
+test("flat_rate_providers: trims whitespace and drops empty entries", () => {
+  const { errors, preferences } = validatePreferences({
+    flat_rate_providers: ["  my-proxy  ", "", "   ", "private-cli"],
+  });
+  assert.equal(errors.length, 0);
+  assert.deepEqual(preferences.flat_rate_providers, ["my-proxy", "private-cli"]);
+});
+
+test("flat_rate_providers: non-array rejected", () => {
+  const { errors } = validatePreferences({
+    flat_rate_providers: "my-proxy" as any,
+  });
+  assert.ok(
+    errors.some(e => e.includes("flat_rate_providers")),
+    "should error on non-array value",
+  );
+});
+
+test("flat_rate_providers: non-string elements rejected", () => {
+  const { errors } = validatePreferences({
+    flat_rate_providers: ["ok", 123 as any, "also-ok"],
+  });
+  assert.ok(
+    errors.some(e => e.includes("flat_rate_providers")),
+    "should error when array contains non-strings",
+  );
+});
+
+test("flat_rate_providers is a recognized preference key (no warning)", () => {
+  const { warnings } = validatePreferences({
+    flat_rate_providers: ["my-proxy"],
+  });
+  assert.equal(
+    warnings.filter(w => w.includes("flat_rate_providers")).length,
+    0,
+    "flat_rate_providers must be in KNOWN_PREFERENCE_KEYS",
+  );
+});
+
 test("valid values pass through correctly", () => {
   const { preferences: p1 } = validatePreferences({ budget_enforcement: "halt" });
   assert.equal(p1.budget_enforcement, "halt");