gsd-pi 2.77.0-dev.c9c8932c6 → 2.77.0-dev.cfd69e714

package/src/resources/extensions/gsd/tests/knowledge.test.ts

@@ -15,7 +15,7 @@ import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, realpathSy
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { GSD_ROOT_FILES, resolveGsdRootFile } from '../paths.ts';
-import { inlineGsdRootFile } from '../auto-prompts.ts';
+import { inlineGsdRootFile, inlineKnowledgeBudgeted } from '../auto-prompts.ts';
 import { appendKnowledge } from '../files.ts';
 import { loadKnowledgeBlock } from '../bootstrap/system-context.ts';
 
@@ -248,3 +248,95 @@ test('loadKnowledgeBlock: reports globalSizeKb above 4KB threshold', () => {
 
   rmSync(tmp, { recursive: true, force: true });
 });
+
+// ─── inlineKnowledgeBudgeted — issue #4719 ─────────────────────────────────
+// Milestone-phase prompts must not inject the full KNOWLEDGE.md. The budgeted
+// helper scopes by milestone-level keywords and caps the injected size.
+
+test('inlineKnowledgeBudgeted: returns scoped H3 entries for single-H2 file', async () => {
+  const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-knowledge-')));
+  const gsdDir = join(tmp, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+
+  const content = `# Project Knowledge
+
+## Patterns
+
+### Database: prepared statements
+Always use prepared statements with SQLite.
+
+### API: versioned paths
+Use /v1/resource style versioning.
+
+### Testing: node:test
+Prefer node:test over external frameworks.
+`;
+  writeFileSync(join(gsdDir, 'KNOWLEDGE.md'), content);
+
+  const result = await inlineKnowledgeBudgeted(tmp, ['database']);
+  assert.ok(result !== null, 'should return content');
+  assert.ok(result!.includes('Database: prepared statements'), 'includes matching H3');
+  assert.ok(!result!.includes('API: versioned paths'), 'excludes non-matching H3');
+
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test('inlineKnowledgeBudgeted: caps payload below budget for large files', async () => {
+  const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-knowledge-')));
+  const gsdDir = join(tmp, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+
+  // Build a 200KB KNOWLEDGE with 500 H3 entries all matching 'shared'
+  const entries = Array.from({ length: 500 }, (_, i) =>
+    `### Entry ${i}: shared topic\n${'filler text '.repeat(30)}\n`,
+  ).join('\n');
+  const content = `# Project Knowledge\n\n## Patterns\n\n${entries}`;
+  writeFileSync(join(gsdDir, 'KNOWLEDGE.md'), content);
+
+  const BUDGET_CHARS = 30_000;
+  const result = await inlineKnowledgeBudgeted(tmp, ['shared'], { maxChars: BUDGET_CHARS });
+  assert.ok(result !== null, 'should return content');
+  // Allow some overhead for header formatting, but must stay close to budget
+  assert.ok(
+    result!.length <= BUDGET_CHARS + 500,
+    `payload ${result!.length} chars should be <= budget ${BUDGET_CHARS} (+overhead)`,
+  );
+  // Far smaller than the raw file
+  assert.ok(
+    result!.length < content.length / 4,
+    `payload should be much smaller than full content (${content.length} chars)`,
+  );
+  assert.match(
+    result!,
+    /\[\.\.\.truncated \d+ chars; rerun with narrower scope if needed\]/,
+    'should include truncation note when budget is exceeded',
+  );
+
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test('inlineKnowledgeBudgeted: returns null when no KNOWLEDGE.md exists', async () => {
+  const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-knowledge-')));
+  const gsdDir = join(tmp, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+
+  const result = await inlineKnowledgeBudgeted(tmp, ['database']);
+  assert.strictEqual(result, null);
+
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test('inlineKnowledgeBudgeted: returns null when no entries match', async () => {
+  const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-knowledge-')));
+  const gsdDir = join(tmp, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+  writeFileSync(
+    join(gsdDir, 'KNOWLEDGE.md'),
+    '# Project Knowledge\n\n## Patterns\n\n### Database\nuse it\n',
+  );
+
+  const result = await inlineKnowledgeBudgeted(tmp, ['nonexistent']);
+  assert.strictEqual(result, null);
+
+  rmSync(tmp, { recursive: true, force: true });
+});

package/src/resources/extensions/gsd/tests/mcp-client-security.test.ts

@@ -0,0 +1,47 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  _buildMcpChildEnvForTest,
+  _buildMcpTrustConfirmOptionsForTest,
+} from "../../mcp-client/index.ts";
+
+// Note: four source-grep tests that scanned `mcp-client/index.ts` for
+// Map<> shapes, catch-block structure, and closeAll body were removed
+// under #4827. They encoded implementation shape rather than behaviour —
+// any refactor (extracted helper, different Map key type, rearranged
+// cleanup order) broke the greps without a real regression. Runtime
+// coverage of connectServer/closeAll with a mocked failing transport
+// is tracked as a follow-up.
+
+test("MCP stdio child env only includes safe inherited keys plus explicit config env", () => {
+  const previousSecret = process.env.SECRET_MCP_TEST_TOKEN;
+  const previousPath = process.env.PATH;
+  try {
+    process.env.SECRET_MCP_TEST_TOKEN = "should-not-leak";
+    process.env.PATH = "/usr/bin";
+
+    const env = _buildMcpChildEnvForTest({
+      EXPLICIT_TOKEN: "${SECRET_MCP_TEST_TOKEN}",
+      PLAIN_VALUE: "ok",
+    });
+
+    assert.equal(env.PATH, "/usr/bin");
+    assert.equal(env.SECRET_MCP_TEST_TOKEN, undefined);
+    assert.equal(env.EXPLICIT_TOKEN, "should-not-leak");
+    assert.equal(env.PLAIN_VALUE, "ok");
+  } finally {
+    if (previousSecret === undefined) delete process.env.SECRET_MCP_TEST_TOKEN;
+    else process.env.SECRET_MCP_TEST_TOKEN = previousSecret;
+    if (previousPath === undefined) delete process.env.PATH;
+    else process.env.PATH = previousPath;
+  }
+});
+
+test("MCP stdio trust confirmation is abort-aware", () => {
+  const controller = new AbortController();
+  const options = _buildMcpTrustConfirmOptionsForTest(controller.signal);
+
+  assert.equal(options.timeout, 120_000);
+  assert.equal(options.signal, controller.signal);
+});

package/src/resources/extensions/gsd/tests/memory-extractor.test.ts

@@ -1,4 +1,4 @@
-import { parseMemoryResponse, _resetExtractionState, buildMemoryLLMCall } from '../memory-extractor.ts';
+import { parseMemoryResponse, buildMemoryLLMCall } from '../memory-extractor.ts';
 import {
   openDatabase,
   closeDatabase,
@@ -159,16 +159,6 @@ test('integration: mixed action lifecycle', () => {
   closeDatabase();
 });
 
-// ═══════════════════════════════════════════════════════════════════════════
-// memory-extractor: _resetExtractionState
-// ═══════════════════════════════════════════════════════════════════════════
-
-test('memory-extractor: reset extraction state', () => {
-  // Just verify it doesn't throw
-  _resetExtractionState();
-  assert.ok(true, '_resetExtractionState should not throw');
-});
-
 // ═══════════════════════════════════════════════════════════════════════════
 // memory-extractor: buildMemoryLLMCall resolves OAuth API key via modelRegistry
 // Regression test for #2959 — OAuth users had broken memory extraction
@@ -200,8 +190,8 @@ test('memory-extractor: buildMemoryLLMCall resolves API key from modelRegistry f
   assert.ok(llmCallFn !== null, 'buildMemoryLLMCall should return a function when models are available');
 
   // The function should have resolved the API key eagerly via modelRegistry.getApiKey.
-  // Give the async getApiKey a tick to resolve.
-  await new Promise(resolve => setTimeout(resolve, 50));
+  // Await the exposed promise deterministically instead of polling via setTimeout.
+  await llmCallFn!.apiKeyReady;
   assert.ok(getApiKeyCalled, 'buildMemoryLLMCall must call modelRegistry.getApiKey() to resolve OAuth tokens');
 });
 
@@ -246,8 +236,8 @@ test('memory-extractor: buildMemoryLLMCall prefers haiku model', async () => {
   const llmCallFn = buildMemoryLLMCall(ctx);
   assert.ok(llmCallFn !== null, 'should return a function');
 
-  // Wait for the async getApiKey to resolve
-  await new Promise(resolve => setTimeout(resolve, 50));
+  // Await the exposed API-key-ready promise deterministically.
+  await llmCallFn!.apiKeyReady;
   assert.strictEqual(resolvedModelId, 'claude-3-5-haiku-20241022',
     'should resolve API key for haiku model, not sonnet');
 });

package/src/resources/extensions/gsd/tests/merge-conflict-stops-loop.test.ts

@@ -2,65 +2,237 @@
  * merge-conflict-stops-loop.test.ts — #2330
  *
  * When a squash merge has real code conflicts (not just .gsd/ files),
- * the merge retries forever because MergeConflictError is caught
- * silently in mergeAndExit. This test verifies that:
- * 1. worktree-resolver re-throws MergeConflictError for code conflicts
- * 2. auto/phases.ts wraps mergeAndExit calls to stop the loop on conflict
+ * the merge used to retry forever because `MergeConflictError` was
+ * caught silently in `mergeAndExit`. The fix:
+ *
+ *   1. `WorktreeResolver.mergeAndExit` **re-throws** `MergeConflictError`
+ *      (and other unexpected errors) so the caller sees the failure.
+ *   2. `auto/phases.ts` catches `MergeConflictError` from `mergeAndExit`
+ *      and returns `{ action: "break", reason: "merge-conflict" }` +
+ *      calls `stopAuto`, instead of looping.
+ *
+ * The previous version of this file was three source-grep assertions
+ * (`src.includes("MergeConflictError")` / `src.includes("throw err")` /
+ * `extractSourceRegion(..., "instanceof MergeConflictError").includes("stopAuto")`).
+ * Those all pass even if the bug reappears verbatim — the catch block
+ * could swallow the error silently as long as the identifier text
+ * remains somewhere in the file. Called out in #4784 / #4824 as the
+ * canonical source-grep false-coverage case.
+ *
+ * This rewrite tests the invariant at the `WorktreeResolver` layer
+ * (where the re-throw happens) with injected deps: we wire
+ * `mergeMilestoneToMain` to throw `MergeConflictError`, call
+ * `mergeAndExit`, and assert the error propagates. That is the ONLY
+ * assertion that fails if someone reverts the re-throw to a silent
+ * catch.
  */
 
-import { readFileSync } from "node:fs";
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
-import { createTestContext } from "./test-helpers.ts";
-
-const { assertTrue, report } = createTestContext();
-
-const resolverPath = join(import.meta.dirname, "..", "worktree-resolver.ts");
-const resolverSrc = readFileSync(resolverPath, "utf-8");
-
-const phasesPath = join(import.meta.dirname, "..", "auto", "phases.ts");
-const phasesSrc = readFileSync(phasesPath, "utf-8");
-
-console.log("\n=== #2330: Merge conflict stops auto loop ===");
-
-// ── Test 1: worktree-resolver re-throws MergeConflictError ──────────────
-
-const methodStart = resolverSrc.indexOf("Worktree-mode merge:");
-assertTrue(methodStart > 0, "worktree-resolver has _mergeWorktreeMode method");
-
-const methodBody = resolverSrc.slice(methodStart, methodStart + 6000);
-const rethrowsConflict =
-  methodBody.includes("MergeConflictError") &&
-  methodBody.includes("throw err");
-
-assertTrue(
-  rethrowsConflict,
-  "worktree-resolver._mergeWorktreeMode re-throws MergeConflictError (#2330)",
-);
-
-// ── Test 2: auto/phases.ts imports and uses MergeConflictError ──────────
-
-assertTrue(
-  phasesSrc.includes("MergeConflictError") && phasesSrc.includes("mergeAndExit"),
-  "auto/phases.ts handles MergeConflictError from mergeAndExit (#2330)",
-);
-
-// ── Test 3: The handler stops the loop (doesn't just warn) ──────────────
-
-// Find the instanceof MergeConflictError check (not the import line)
-const instanceofIdx = phasesSrc.indexOf("instanceof MergeConflictError");
-assertTrue(instanceofIdx > 0, "auto/phases.ts has instanceof MergeConflictError check");
+import { tmpdir } from "node:os";
+
+import { WorktreeResolver } from "../worktree-resolver.ts";
+import { MergeConflictError } from "../git-service.ts";
+import type { WorktreeResolverDeps } from "../worktree-resolver.ts";
+import type { AutoSession } from "../auto/session.ts";
+
+// ─── Test-only session double ───────────────────────────────────────────
+// `AutoSession` is a large class but `WorktreeResolver` only reads a few
+// fields from it (basePath, originalBasePath, currentMilestoneId).
+function makeSession(basePath: string): AutoSession {
+  return {
+    basePath,
+    originalBasePath: basePath,
+    currentMilestoneId: "M001",
+  } as unknown as AutoSession;
+}
 
-if (instanceofIdx > 0) {
-  const afterHandler = phasesSrc.slice(instanceofIdx, instanceofIdx + 500);
-  const stopsLoop =
-    afterHandler.includes("stopAuto") ||
-    afterHandler.includes('action: "break"') ||
-    afterHandler.includes("reason: \"merge-conflict\"");
+/**
+ * Build a deps object where every method is a no-op or a controlled
+ * value, except the ones the caller explicitly overrides. This is the
+ * boring-tech approach — no mocking library, just plain objects.
+ */
+function makeDeps(
+  overrides: Partial<WorktreeResolverDeps> = {},
+): WorktreeResolverDeps {
+  return {
+    isInAutoWorktree: () => true,
+    shouldUseWorktreeIsolation: () => true,
+    getIsolationMode: () => "worktree",
+    mergeMilestoneToMain: () => ({ pushed: false, codeFilesChanged: true }),
+    syncWorktreeStateBack: () => ({ synced: [] }),
+    teardownAutoWorktree: () => undefined,
+    createAutoWorktree: () => "",
+    enterAutoWorktree: () => "",
+    enterBranchModeForMilestone: () => undefined,
+    getAutoWorktreePath: () => null,
+    autoCommitCurrentBranch: () => undefined,
+    getCurrentBranch: () => "worktree/M001",
+    autoWorktreeBranch: (mid: string) => `worktree/${mid}`,
+    resolveMilestoneFile: () => null, // no roadmap → early return path
+    readFileSync: () => "",
+    GitServiceImpl: class {
+      constructor(_basePath: string, _config: unknown) {}
+    } as never,
+    loadEffectiveGSDPreferences: () => ({ preferences: {} }),
+    invalidateAllCaches: () => undefined,
+    captureIntegrationBranch: () => undefined,
+    ...overrides,
+  };
+}
 
-  assertTrue(
-    stopsLoop,
-    "auto/phases.ts stops the loop when merge conflict is detected (#2330)",
-  );
+function makeNotifyCtx(): {
+  notify: (msg: string, level?: "info" | "warning" | "error" | "success") => void;
+  calls: Array<{ msg: string; level?: string }>;
+} {
+  const calls: Array<{ msg: string; level?: string }> = [];
+  return {
+    notify: (msg, level) => {
+      calls.push({ msg, level });
+    },
+    calls,
+  };
 }
 
-report();
+describe("WorktreeResolver.mergeAndExit re-throws MergeConflictError (#2330)", () => {
+  let baseDir: string;
+
+  beforeEach(() => {
+    baseDir = mkdtempSync(join(tmpdir(), "merge-conflict-stops-loop-"));
+    // Fake out a milestone directory so mergeAndExit reaches mergeMilestoneToMain.
+    mkdirSync(join(baseDir, ".gsd", "milestones", "M001"), { recursive: true });
+  });
+
+  afterEach(() => {
+    try {
+      rmSync(baseDir, { recursive: true, force: true });
+    } catch {
+      // best-effort
+    }
+  });
+
+  test("propagates MergeConflictError with conflicted file list", () => {
+    const conflicted = ["src/feature.ts", "README.md"];
+    const roadmapPath = join(baseDir, ".gsd", "milestones", "M001", "M001-ROADMAP.md");
+    const deps = makeDeps({
+      resolveMilestoneFile: (_base, _mid, type) =>
+        type === "ROADMAP" ? roadmapPath : null,
+      readFileSync: () => "# M001\n",
+      mergeMilestoneToMain: () => {
+        throw new MergeConflictError(conflicted, "squash", "worktree/M001", "main");
+      },
+    });
+
+    const resolver = new WorktreeResolver(makeSession(baseDir), deps);
+    const ctx = makeNotifyCtx();
+
+    assert.throws(
+      () => resolver.mergeAndExit("M001", ctx),
+      (err: unknown) => {
+        assert.ok(
+          err instanceof MergeConflictError,
+          `expected MergeConflictError, got: ${err}`,
+        );
+        assert.deepEqual(err.conflictedFiles, conflicted);
+        assert.equal(err.strategy, "squash");
+        assert.equal(err.branch, "worktree/M001");
+        assert.equal(err.mainBranch, "main");
+        return true;
+      },
+    );
+  });
+
+  test("propagates non-conflict errors too (#4380 — never swallow silently)", () => {
+    const roadmapPath = join(baseDir, ".gsd", "milestones", "M001", "M001-ROADMAP.md");
+    class FakePermError extends Error {}
+    const deps = makeDeps({
+      resolveMilestoneFile: (_base, _mid, type) =>
+        type === "ROADMAP" ? roadmapPath : null,
+      readFileSync: () => "# M001\n",
+      mergeMilestoneToMain: () => {
+        throw new FakePermError("EACCES: permission denied");
+      },
+    });
+
+    const resolver = new WorktreeResolver(makeSession(baseDir), deps);
+    const ctx = makeNotifyCtx();
+
+    assert.throws(
+      () => resolver.mergeAndExit("M001", ctx),
+      (err: unknown) => {
+        assert.ok(
+          err instanceof FakePermError,
+          `expected FakePermError, got: ${err}`,
+        );
+        return true;
+      },
+    );
+  });
+
+  test("successful merge does not throw", () => {
+    const roadmapPath = join(baseDir, ".gsd", "milestones", "M001", "M001-ROADMAP.md");
+    const deps = makeDeps({
+      resolveMilestoneFile: (_base, _mid, type) =>
+        type === "ROADMAP" ? roadmapPath : null,
+      readFileSync: () => "# M001\n",
+      mergeMilestoneToMain: () => ({ pushed: false, codeFilesChanged: true }),
+    });
+
+    const resolver = new WorktreeResolver(makeSession(baseDir), deps);
+    const ctx = makeNotifyCtx();
+
+    // Should not throw — the success path.
+    assert.doesNotThrow(() => resolver.mergeAndExit("M001", ctx));
+  });
+});
+
+// ─── phases.ts handler contract ──────────────────────────────────────────
+//
+// The inline handler at `auto/phases.ts:580-598 / 695-712 / 823-840`:
+//
+//   if (mergeErr instanceof MergeConflictError) {
+//     ctx.ui.notify(`Merge conflict: ${mergeErr.conflictedFiles.join(", ")}. ...`);
+//     await deps.stopAuto(...);
+//     return { action: "break", reason: "merge-conflict" };
+//   }
+//
+// Testing it end-to-end requires constructing a full `IterationContext`
+// + `LoopState` + `deps` surface (hundreds of fields). Extracting the
+// handler into a reusable helper is the right refactor and is tracked
+// alongside this issue. In the meantime, defend the contract between
+// the thrower and the handler: if the fields the handler formats drift,
+// the handler silently regresses.
+
+describe("Merge-conflict handler contract (#2330 — phases.ts inline pattern)", () => {
+  test("MergeConflictError exposes fields the phases.ts handler formats", () => {
+    const err = new MergeConflictError(
+      ["a.ts", "b.ts"],
+      "squash",
+      "worktree/M001",
+      "main",
+    );
+    assert.deepEqual(err.conflictedFiles, ["a.ts", "b.ts"]);
+    assert.equal(err.strategy, "squash");
+    assert.equal(err.branch, "worktree/M001");
+    assert.equal(err.mainBranch, "main");
+    // instanceof is the type-discriminant the handler uses.
+    assert.ok(err instanceof MergeConflictError);
+    // The class extends Error so the non-conflict fallback message path
+    // (`String(mergeErr)` / `mergeErr.message`) still works.
+    assert.ok(err instanceof Error);
+    assert.match(err.message, /worktree\/M001/);
+    assert.match(err.message, /main/);
+  });
+
+  test("MergeConflictError with empty conflicted list still serializes (edge)", () => {
+    // The handler's `conflictedFiles.join(", ")` must not crash on empty
+    // list. Defensive: some producers could legitimately emit a
+    // zero-length array.
+    const err = new MergeConflictError([], "merge", "feature/x", "main");
+    assert.deepEqual(err.conflictedFiles, []);
+    assert.equal(err.conflictedFiles.join(", "), "");
+    assert.ok(err instanceof MergeConflictError);
+  });
+});