gsd-pi 2.76.0 → 2.77.0-dev.1594b263e

package/src/resources/extensions/gsd/tests/exec-sandbox.test.ts

@@ -0,0 +1,210 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { EXEC_DEFAULTS, runExecSandbox, type ExecSandboxOptions } from '../exec-sandbox.ts';
+import { buildExecOptions, executeGsdExec } from '../tools/exec-tool.ts';
+import { isContextModeEnabled } from '../preferences-types.ts';
+
+function freshBase(): string {
+  return mkdtempSync(join(tmpdir(), 'gsd-exec-test-'));
+}
+
+function cleanup(dir: string): void {
+  rmSync(dir, { recursive: true, force: true });
+}
+
+function baseOpts(base: string, overrides: Partial<ExecSandboxOptions> = {}): ExecSandboxOptions {
+  return {
+    baseDir: base,
+    clamp_timeout_ms: EXEC_DEFAULTS.clampTimeoutMs,
+    default_timeout_ms: 10_000,
+    stdout_cap_bytes: 1_024,
+    stderr_cap_bytes: 1_024,
+    digest_chars: 120,
+    env_allowlist: EXEC_DEFAULTS.envAllowlist,
+    ...overrides,
+  };
+}
+
+test('runExecSandbox: captures stdout, persists artifacts, returns digest', async () => {
+  const base = freshBase();
+  try {
+    const result = await runExecSandbox(
+      { runtime: 'bash', script: 'echo hello world' },
+      baseOpts(base),
+    );
+    assert.equal(result.exit_code, 0);
+    assert.equal(result.timed_out, false);
+    assert.ok(result.digest.includes('hello world'), `digest should contain stdout: ${result.digest}`);
+    assert.ok(result.stdout_path.startsWith(join(base, '.gsd', 'exec')), 'stdout path under .gsd/exec');
+    assert.equal(readFileSync(result.stdout_path, 'utf-8').trim(), 'hello world');
+    const meta = JSON.parse(readFileSync(result.meta_path, 'utf-8')) as Record<string, unknown>;
+    assert.equal(meta.runtime, 'bash');
+    assert.equal(meta.exit_code, 0);
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('runExecSandbox: enforces stdout cap and marks truncation', async () => {
+  const base = freshBase();
+  try {
+    const result = await runExecSandbox(
+      // Emit far more than the cap so truncation triggers.
+      { runtime: 'bash', script: 'head -c 8000 /dev/urandom | base64' },
+      baseOpts(base, { stdout_cap_bytes: 256 }),
+    );
+    assert.equal(result.stdout_truncated, true, 'should mark stdout truncated');
+    assert.ok(result.stdout_bytes <= 256, `stdout_bytes within cap (got ${result.stdout_bytes})`);
+    const stdout = readFileSync(result.stdout_path, 'utf-8');
+    assert.ok(stdout.endsWith('[truncated: stdout cap reached]\n'), 'truncation marker appended');
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('runExecSandbox: enforces timeout and surfaces timed_out', async () => {
+  const base = freshBase();
+  try {
+    const started = Date.now();
+    const result = await runExecSandbox(
+      { runtime: 'bash', script: 'sleep 10' },
+      baseOpts(base, { default_timeout_ms: 150, clamp_timeout_ms: 150 }),
+    );
+    const elapsed = Date.now() - started;
+    assert.equal(result.timed_out, true);
+    assert.ok(elapsed < 5_000, `should return well before 10s (took ${elapsed}ms)`);
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('runExecSandbox: forwards only allowlisted env vars', async () => {
+  const base = freshBase();
+  try {
+    const result = await runExecSandbox(
+      { runtime: 'bash', script: 'echo PATH=$PATH SECRET=$GSD_TEST_SECRET' },
+      baseOpts(base, {
+        env_allowlist: [],
+        env: { PATH: '/usr/bin:/bin', HOME: '/tmp', GSD_TEST_SECRET: 'should-be-blocked' },
+      }),
+    );
+    const stdout = readFileSync(result.stdout_path, 'utf-8');
+    assert.ok(stdout.includes('PATH=/usr/bin:/bin'), 'PATH forwarded');
+    assert.ok(!stdout.includes('should-be-blocked'), 'non-allowlisted var blocked');
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('runExecSandbox: node runtime executes JS', async () => {
+  const base = freshBase();
+  try {
+    const result = await runExecSandbox(
+      { runtime: 'node', script: 'console.log("node-ok:" + (1+2))' },
+      baseOpts(base),
+    );
+    assert.equal(result.exit_code, 0);
+    assert.ok(result.digest.includes('node-ok:3'));
+  } finally {
+    cleanup(base);
+  }
+});
+
+// ── exec-tool executor ────────────────────────────────────────────────────
+
+test('executeGsdExec: runs by default when context_mode is unset', async () => {
+  const base = freshBase();
+  try {
+    const result = await executeGsdExec(
+      { runtime: 'bash', script: 'echo default-on-run' },
+      { baseDir: base, preferences: {} },
+    );
+    assert.ok(!result.isError, 'should succeed with no preferences');
+    assert.equal(result.details.operation, 'gsd_exec');
+    assert.equal(result.details.exit_code, 0);
+    assert.ok(result.content[0].text.includes('default-on-run'));
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('executeGsdExec: runs when preferences is null (fresh project)', async () => {
+  const base = freshBase();
+  try {
+    const result = await executeGsdExec(
+      { runtime: 'bash', script: 'echo null-prefs-run' },
+      { baseDir: base, preferences: null },
+    );
+    assert.ok(!result.isError, 'null preferences should not disable');
+    assert.ok(result.content[0].text.includes('null-prefs-run'));
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('executeGsdExec: blocked only when context_mode.enabled=false', async () => {
+  const base = freshBase();
+  try {
+    const result = await executeGsdExec(
+      { runtime: 'bash', script: 'echo should-not-run' },
+      { baseDir: base, preferences: { context_mode: { enabled: false } } },
+    );
+    assert.equal(result.isError, true);
+    assert.equal((result.details as { error?: string }).error, 'context_mode_disabled');
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('executeGsdExec: runs when enabled explicitly set to true', async () => {
+  const base = freshBase();
+  try {
+    const result = await executeGsdExec(
+      { runtime: 'bash', script: 'echo explicit-on' },
+      { baseDir: base, preferences: { context_mode: { enabled: true } } },
+    );
+    assert.ok(!result.isError);
+    assert.ok(result.content[0].text.includes('explicit-on'));
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('executeGsdExec: rejects empty script', async () => {
+  const base = freshBase();
+  try {
+    const result = await executeGsdExec(
+      { runtime: 'bash', script: '   ' },
+      { baseDir: base, preferences: { context_mode: { enabled: true } } },
+    );
+    assert.equal(result.isError, true);
+    assert.equal((result.details as { error?: string }).error, 'invalid_params');
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('isContextModeEnabled: defaults to true; only explicit false disables', () => {
+  assert.equal(isContextModeEnabled(undefined), true, 'undefined prefs → on');
+  assert.equal(isContextModeEnabled(null), true, 'null prefs → on');
+  assert.equal(isContextModeEnabled({}), true, 'empty prefs → on');
+  assert.equal(isContextModeEnabled({ context_mode: {} }), true, 'empty block → on');
+  assert.equal(isContextModeEnabled({ context_mode: { enabled: true } }), true);
+  assert.equal(isContextModeEnabled({ context_mode: { enabled: false } }), false);
+});
+
+test('buildExecOptions: clamps out-of-range values to safe defaults', () => {
+  const opts = buildExecOptions('/tmp/base', {
+    enabled: true,
+    exec_timeout_ms: 999_999_999,
+    exec_stdout_cap_bytes: 1,
+    exec_digest_chars: -20,
+  });
+  assert.equal(opts.default_timeout_ms, EXEC_DEFAULTS.clampTimeoutMs, 'timeout clamped to upper bound');
+  assert.equal(opts.stdout_cap_bytes, 4_096, 'stdout cap clamped to floor');
+  assert.equal(opts.digest_chars, 0, 'digest chars clamped to floor');
+});

package/src/resources/extensions/gsd/tests/execution-entry-missing-context-4671.test.ts

@@ -0,0 +1,173 @@
+/**
+ * Regression tests for #4671 — execution-entry phase + missing CONTEXT.md.
+ *
+ * When a milestone advances to an execution-entry phase (executing /
+ * summarizing / validating-milestone / completing-milestone) without
+ * `CONTEXT.md` on disk, the `pre-planning (no context) → discuss-milestone`
+ * rule no longer fires and the plan-v2 gate only blocks. This rule provides
+ * the recovery by redispatching to discuss-milestone.
+ *
+ * Exercises the dispatch rule from DISPATCH_RULES directly with a
+ * DispatchContext built against a real temp directory.
+ */
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { DISPATCH_RULES, type DispatchContext } from "../auto-dispatch.ts";
+import type { GSDState, Phase } from "../types.ts";
+
+const RULE_NAME_TOKEN = "execution-entry phase (no context)";
+
+function findRule() {
+  const matches = DISPATCH_RULES.filter((r) => r.name.includes(RULE_NAME_TOKEN));
+  if (matches.length !== 1) {
+    throw new Error(
+      `expected exactly one dispatch rule containing "${RULE_NAME_TOKEN}", found ${matches.length}`,
+    );
+  }
+  return matches[0];
+}
+
+function buildState(phase: Phase): GSDState {
+  return {
+    activeMilestone: { id: "M001", title: "Test milestone" },
+    activeSlice: null,
+    activeTask: null,
+    phase,
+    recentDecisions: [],
+    blockers: [],
+    nextAction: "",
+    registry: [],
+  };
+}
+
+function makeBasePath(prefix: string): string {
+  const dir = mkdtempSync(join(tmpdir(), `gsd-4671-${prefix}-`));
+  mkdirSync(join(dir, ".gsd", "milestones", "M001"), { recursive: true });
+  return dir;
+}
+
+function buildCtx(basePath: string, state: GSDState): DispatchContext {
+  return {
+    basePath,
+    mid: "M001",
+    midTitle: "Test milestone",
+    state,
+    prefs: undefined,
+  };
+}
+
+describe("#4671 execution-entry phase missing-context recovery", () => {
+  const executionEntryPhases: Phase[] = [
+    "executing",
+    "summarizing",
+    "validating-milestone",
+    "completing-milestone",
+  ];
+
+  for (const phase of executionEntryPhases) {
+    test(`phase=${phase} with missing CONTEXT.md → dispatches discuss-milestone`, async () => {
+      const basePath = makeBasePath(`missing-${phase}`);
+      try {
+        const action = await findRule().match(buildCtx(basePath, buildState(phase)));
+        assert.ok(action, "rule must return an action when CONTEXT.md is missing");
+        assert.strictEqual(action!.action, "dispatch");
+        if (action!.action === "dispatch") {
+          assert.strictEqual(action!.unitType, "discuss-milestone");
+          assert.strictEqual(action!.unitId, "M001");
+          assert.ok(typeof action!.prompt === "string" && action!.prompt.length > 0);
+        }
+      } finally {
+        rmSync(basePath, { recursive: true, force: true });
+      }
+    });
+  }
+
+  test("phase=executing with CONTEXT.md present → falls through", async () => {
+    const basePath = makeBasePath("has-context");
+    try {
+      writeFileSync(
+        join(basePath, ".gsd", "milestones", "M001", "M001-CONTEXT.md"),
+        "# M001 Context\n\nSome real context.\n",
+      );
+      const action = await findRule().match(buildCtx(basePath, buildState("executing")));
+      assert.strictEqual(action, null, "rule must fall through when CONTEXT.md exists");
+    } finally {
+      rmSync(basePath, { recursive: true, force: true });
+    }
+  });
+
+  test("phase=executing accepts finalized CONTEXT.md from GSD_PROJECT_ROOT fallback", async () => {
+    const projectRoot = makeBasePath("project-root-context");
+    const worktreeBase = makeBasePath("worktree-context");
+    const prevProjectRoot = process.env.GSD_PROJECT_ROOT;
+    try {
+      writeFileSync(
+        join(projectRoot, ".gsd", "milestones", "M001", "M001-CONTEXT.md"),
+        "# M001 Context\n\nFinalized context at project root.\n",
+      );
+      process.env.GSD_PROJECT_ROOT = projectRoot;
+
+      const action = await findRule().match(buildCtx(worktreeBase, buildState("executing")));
+      assert.strictEqual(
+        action,
+        null,
+        "rule must align with plan-v2 project-root fallback before redispatching",
+      );
+    } finally {
+      if (prevProjectRoot === undefined) {
+        delete process.env.GSD_PROJECT_ROOT;
+      } else {
+        process.env.GSD_PROJECT_ROOT = prevProjectRoot;
+      }
+      rmSync(projectRoot, { recursive: true, force: true });
+      rmSync(worktreeBase, { recursive: true, force: true });
+    }
+  });
+
+  test("phase=pre-planning does not trigger this rule (handled by upstream rule)", async () => {
+    const basePath = makeBasePath("pre-planning");
+    try {
+      const action = await findRule().match(buildCtx(basePath, buildState("pre-planning")));
+      assert.strictEqual(
+        action,
+        null,
+        "rule must only target execution-entry phases; pre-planning is handled elsewhere",
+      );
+    } finally {
+      rmSync(basePath, { recursive: true, force: true });
+    }
+  });
+
+  test("empty CONTEXT.md (whitespace only) → rule still fires", async () => {
+    const basePath = makeBasePath("empty-context");
+    try {
+      writeFileSync(
+        join(basePath, ".gsd", "milestones", "M001", "M001-CONTEXT.md"),
+        "   \n\t\n",
+      );
+      const action = await findRule().match(buildCtx(basePath, buildState("summarizing")));
+      assert.ok(action, "rule must fire when CONTEXT.md is empty/whitespace-only");
+      if (action?.action === "dispatch") {
+        assert.strictEqual(action.unitType, "discuss-milestone");
+      }
+    } finally {
+      rmSync(basePath, { recursive: true, force: true });
+    }
+  });
+
+  test("rule ordering: fires BEFORE execution-entry phase handlers", () => {
+    const recoveryIdx = DISPATCH_RULES.findIndex((r) => r.name.includes(RULE_NAME_TOKEN));
+    const summarizingIdx = DISPATCH_RULES.findIndex((r) =>
+      r.name.startsWith("summarizing → complete-slice"),
+    );
+    assert.ok(recoveryIdx > -1, "recovery rule must exist");
+    assert.ok(summarizingIdx > -1, "summarizing rule must exist");
+    assert.ok(
+      recoveryIdx < summarizingIdx,
+      `recovery rule (idx ${recoveryIdx}) must come before summarizing rule (idx ${summarizingIdx}) so it can redispatch before the plan-v2 gate blocks`,
+    );
+  });
+});

package/src/resources/extensions/gsd/tests/extension-bootstrap-isolation.test.ts

@@ -1,154 +1,164 @@
-// Structural contracts for GSD extension bootstrap isolation.
+// Behavioural contract for GSD extension bootstrap isolation (#4168, #4172).
 //
-// The /gsd command must survive failures in the full extension bootstrap
-// (register-extension.ts). This guards against the regression where a
-// Windows-specific import failure in register-shortcuts.ts silently
-// prevented /gsd from being registered at all (#4168, #4172).
+// Guarantee: the `/gsd` slash command must be registered on pi even if the
+// full bootstrap (shortcuts, tools, hooks, ecosystem) throws during import or
+// execution. Prior regressions: a Windows-specific failure in register-
+// shortcuts.ts silently prevented /gsd from being registered at all because
+// registerGSDCommand was called inside the same try that loaded shortcuts.
+//
+// These tests exercise the real default export of index.ts (which calls
+// registerGSDCommand via dynamic import, then attempts the full bootstrap)
+// with a minimal mock ExtensionAPI and verify the observable behaviour
+// directly: /gsd is registered in both the happy path and the degraded path.
+//
+// Anti-regression proof (documented in commit):
+//   neuter index.ts to register /gsd inside the same try{} as
+//   register-extension → the degraded-path test fails (no /gsd command
+//   registered when register-extension throws). Restore → passes.
 
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const indexSrc = readFileSync(join(__dirname, "../index.ts"), "utf-8");
-const registerExtSrc = readFileSync(
-  join(__dirname, "../bootstrap/register-extension.ts"),
-  "utf-8",
-);
-
-// ─── index.ts: core /gsd command must be registered before full bootstrap ─────
-
-describe("index.ts bootstrap isolation", () => {
-  test("imports registerGSDCommand from commands/index.js separately", () => {
-    assert.ok(
-      indexSrc.includes('./commands/index.js"') || indexSrc.includes("./commands/index.js'"),
-      "index.ts must import registerGSDCommand from ./commands/index.js",
-    );
-  });
-
-  test("calls registerGSDCommand before importing register-extension.js", () => {
-    const gsdCommandCallPos = indexSrc.indexOf("registerGSDCommand(pi)");
-    const bootstrapImportPos = indexSrc.indexOf(
-      './bootstrap/register-extension.js"',
-    );
 
-    assert.ok(gsdCommandCallPos >= 0, "must call registerGSDCommand(pi)");
-    assert.ok(bootstrapImportPos >= 0, "must import register-extension.js");
+import registerExtension from "../index.ts";
+
+type RegisterFn = (name: string, def: unknown) => void;
+
+function makePi(overrides: Partial<Record<string, unknown>> = {}) {
+  const registered: Array<[string, unknown]> = [];
+  const registerCommand: RegisterFn = (name, def) => {
+    registered.push([name, def]);
+  };
+  const events = {
+    on: () => {},
+    off: () => {},
+    emit: () => {},
+  };
+  const pi = {
+    registerCommand,
+    registerTool: () => {},
+    registerHook: () => {},
+    registerShortcut: () => {},
+    events,
+    ...overrides,
+  };
+  return { pi, registered };
+}
+
+describe("extension bootstrap isolation (#4168, #4172)", () => {
+  test("happy path: /gsd command is registered", async () => {
+    const { pi, registered } = makePi();
+    await registerExtension(pi as any);
+    const names = registered.map(([n]) => n);
     assert.ok(
-      gsdCommandCallPos < bootstrapImportPos,
-      "registerGSDCommand(pi) must be called BEFORE importing register-extension.js",
+      names.includes("gsd"),
+      `expected 'gsd' in registered commands, got ${JSON.stringify(names)}`,
     );
   });
 
-  test("wraps register-extension.js import in try-catch", () => {
-    // The dynamic import of register-extension.js must be inside a try block
-    const tryPos = indexSrc.indexOf("try {");
-    const bootstrapImportPos = indexSrc.indexOf(
-      './bootstrap/register-extension.js"',
-    );
-    const catchPos = indexSrc.indexOf("catch (err)");
-
-    assert.ok(tryPos >= 0, "must have try block");
-    assert.ok(catchPos >= 0, "must have catch block");
+  test("degraded path: /gsd still registered when registerCommand throws for non-core commands", async () => {
+    // Simulate the Windows-style failure: pi.registerCommand throws for a
+    // specific non-core command ('kill' is a simple target registered by
+    // the full bootstrap) — the full bootstrap must fail but /gsd must
+    // already be registered before the failure occurs.
+    const registered: Array<[string, unknown]> = [];
+    const pi = {
+      registerCommand: (name: string, def: unknown) => {
+        if (name !== "gsd" && name !== "worktree" && name !== "exit") {
+          // Let /gsd, /worktree, /exit succeed (they precede the non-core
+          // loop); throw when the first non-core registration fires.
+        }
+        if (name === "kill") throw new Error("simulated windows failure");
+        registered.push([name, def]);
+      },
+      registerTool: () => {},
+      registerHook: () => {},
+      registerShortcut: () => {},
+      events: { on: () => {}, off: () => {}, emit: () => {} },
+    };
+
+    // registerExtension must not throw — the outer try/catch in index.ts
+    // swallows bootstrap failures after /gsd is already registered.
+    await registerExtension(pi as any);
+
+    const names = registered.map(([n]) => n);
     assert.ok(
-      tryPos < bootstrapImportPos && bootstrapImportPos < catchPos,
-      "register-extension.js import must be wrapped in try-catch",
+      names.includes("gsd"),
+      "expected 'gsd' to be registered even when a later command registration throws",
     );
   });
 
-  test("logs warning on bootstrap failure via workflow-logger", () => {
-    assert.ok(
-      indexSrc.includes("logWarning"),
-      "must use logWarning when bootstrap fails",
-    );
-    assert.ok(
-      indexSrc.includes("Extension setup partially failed"),
-      "warning message must indicate partial failure with /gsd still available",
+  test("degraded path: /gsd registered BEFORE any non-core command", async () => {
+    // Ordering guard: the first registerCommand call must be for 'gsd',
+    // because index.ts awaits registerGSDCommand(pi) before importing
+    // register-extension. Regression scenario: if a future refactor moves
+    // registerGSDCommand into the try block or after other registrations,
+    // a failure in those earlier registrations would take /gsd down too.
+    const calls: string[] = [];
+    const pi = {
+      registerCommand: (name: string) => {
+        calls.push(name);
+      },
+      registerTool: () => {},
+      registerHook: () => {},
+      registerShortcut: () => {},
+      events: { on: () => {}, off: () => {}, emit: () => {} },
+    };
+    await registerExtension(pi as any);
+    assert.ok(calls.length > 0, "expected at least one registerCommand call");
+    assert.equal(
+      calls[0],
+      "gsd",
+      `expected 'gsd' to be the first command registered, got ${JSON.stringify(calls)}`,
     );
   });
 });
 
-// ─── register-extension.ts: no double-registration + defensive wrapping ───────
-
-describe("register-extension.ts defensive registration", () => {
-  test("does NOT import or call registerGSDCommand (avoids double-registration)", () => {
-    // registerGSDCommand is now called by index.ts, not register-extension.ts
-    assert.ok(
-      !registerExtSrc.includes("import { registerGSDCommand }"),
-      "register-extension.ts must NOT import registerGSDCommand",
-    );
-
-    // Check the function body of registerGsdExtension doesn't call it
-    const funcBodyStart = registerExtSrc.indexOf(
-      "export function registerGsdExtension",
-    );
-    const funcBody = registerExtSrc.slice(funcBodyStart);
-    assert.ok(
-      !funcBody.includes("registerGSDCommand(pi)"),
-      "registerGsdExtension must NOT call registerGSDCommand(pi)",
-    );
-  });
-
-  test("still registers worktree, exit, and kill commands", () => {
-    const funcBodyStart = registerExtSrc.indexOf(
-      "export function registerGsdExtension",
-    );
-    const funcBody = registerExtSrc.slice(funcBodyStart);
-
-    assert.ok(
-      funcBody.includes("registerWorktreeCommand(pi)"),
-      "must register worktree command",
-    );
-    assert.ok(
-      funcBody.includes("registerExitCommand(pi)"),
-      "must register exit command",
-    );
-    assert.ok(
-      funcBody.includes('"kill"'),
-      "must register kill command",
-    );
-  });
-
-  test("wraps non-critical registrations in individual try-catch blocks", () => {
-    const funcBodyStart = registerExtSrc.indexOf(
-      "export function registerGsdExtension",
-    );
-    const funcBody = registerExtSrc.slice(funcBodyStart);
-
-    // Each non-critical registration should be wrapped with error handling
-    const registrationNames = [
-      "dynamic-tools",
-      "db-tools",
-      "journal-tools",
-      "query-tools",
-      "shortcuts",
-      "hooks",
-    ];
-
-    for (const name of registrationNames) {
-      assert.ok(
-        funcBody.includes(`"${name}"`),
-        `non-critical registration "${name}" must be present`,
-      );
-    }
-
-    // Must have try-catch inside the registration loop
+// Behavioural contract for registerGsdExtension itself: each non-core
+// registration is wrapped in its own try/catch so one failure does not
+// prevent siblings from loading.
+
+import { registerGsdExtension } from "../bootstrap/register-extension.ts";
+
+describe("registerGsdExtension defensive registration", () => {
+  test("a failing shortcut registration does not prevent kill command registration", async () => {
+    // `shortcuts` is registered via a non-critical slot that is wrapped in
+    // its own try/catch. `kill` is registered before the non-critical loop
+    // as a critical command. Simulate: registerShortcut throws. Expect:
+    // 'kill' is still registered, registerGsdExtension does not throw.
+    const registered: string[] = [];
+    const pi = {
+      registerCommand: (name: string) => {
+        registered.push(name);
+      },
+      registerTool: () => {},
+      registerHook: () => {},
+      registerShortcut: () => {
+        throw new Error("simulated platform-specific shortcut failure");
+      },
+      events: { on: () => {}, off: () => {}, emit: () => {} },
+    };
+    assert.doesNotThrow(() => registerGsdExtension(pi as any));
     assert.ok(
-      funcBody.includes("try {") && funcBody.includes("catch (err)"),
-      "must have try-catch for non-critical registrations",
+      registered.includes("kill"),
+      `expected 'kill' to be registered despite shortcut failure, got ${JSON.stringify(registered)}`,
     );
   });
 
-  test("logs warning when a non-critical registration fails", () => {
-    assert.ok(
-      registerExtSrc.includes("Failed to register"),
-      "must log descriptive warning for individual registration failures",
-    );
+  test("does NOT register /gsd (caller's responsibility, avoids double-registration)", () => {
+    const registered: string[] = [];
+    const pi = {
+      registerCommand: (name: string) => {
+        registered.push(name);
+      },
+      registerTool: () => {},
+      registerHook: () => {},
+      registerShortcut: () => {},
+      events: { on: () => {}, off: () => {}, emit: () => {} },
+    };
+    registerGsdExtension(pi as any);
     assert.ok(
-      registerExtSrc.includes("logWarning"),
-      "must use logWarning from workflow-logger",
+      !registered.includes("gsd"),
+      `registerGsdExtension must NOT register 'gsd' (it is registered separately by index.ts), got ${JSON.stringify(registered)}`,
     );
   });
 });