gsd-pi 2.77.0-dev.eaa4973bc → 2.78.0-dev.aeeb2ca00

package/packages/pi-ai/src/utils/oauth/oauth-providers.test.ts

@@ -1,363 +0,0 @@
-import { describe, test } from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import type { Model, Api } from "../../types.js";
-import type { OAuthCredentials } from "./types.js";
-
-// Test files that need to import from the OAuth modules
-import {
-	githubCopilotOAuthProvider,
-	normalizeDomain,
-	getGitHubCopilotBaseUrl,
-} from "./github-copilot.js";
-import { antigravityOAuthProvider } from "./google-antigravity.js";
-import { geminiCliOAuthProvider } from "./google-gemini-cli.js";
-
-const __dirname = fileURLToPath(new URL(".", import.meta.url));
-
-// Local type for Copilot credentials (includes optional fields)
-type CopilotCredentials = OAuthCredentials & {
-	enterpriseUrl?: string;
-	modelLimits?: Record<string, { contextWindow: number; maxTokens: number }>;
-};
-
-// Helper to create a minimal model for testing
-function createModel(overrides: Partial<Model<Api>> = {}): Model<Api> {
-	return {
-		id: "test-model",
-		name: "Test Model",
-		api: "openai-completions",
-		provider: "test-provider",
-		baseUrl: "https://example.com",
-		reasoning: false,
-		input: ["text"],
-		cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-		contextWindow: 128000,
-		maxTokens: 8192,
-		...overrides,
-	} as Model<Api>;
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// GitHub Copilot OAuth Provider Tests
-// ═══════════════════════════════════════════════════════════════════════════
-
-describe("GitHub Copilot OAuth — normalizeDomain", () => {
-	test("returns null for empty input", () => {
-		assert.equal(normalizeDomain(""), null);
-		assert.equal(normalizeDomain("   "), null);
-	});
-
-	test("returns null for invalid domain", () => {
-		assert.equal(normalizeDomain("not a domain!@#"), null);
-	});
-
-	test("extracts hostname from full URL", () => {
-		assert.equal(normalizeDomain("https://github.com"), "github.com");
-		assert.equal(normalizeDomain("https://company.ghe.com"), "company.ghe.com");
-		assert.equal(normalizeDomain("http://example.com/path"), "example.com");
-	});
-
-	test("returns domain as-is when no protocol", () => {
-		assert.equal(normalizeDomain("github.com"), "github.com");
-		assert.equal(normalizeDomain("company.ghe.com"), "company.ghe.com");
-	});
-
-	test("trims whitespace", () => {
-		assert.equal(normalizeDomain("  github.com  "), "github.com");
-	});
-});
-
-describe("GitHub Copilot OAuth — getBaseUrlFromToken", () => {
-	test("extracts API URL from token with proxy-ep", () => {
-		// Token format: tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...
-		const token = "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;other=value";
-		const baseUrl = getGitHubCopilotBaseUrl(token);
-		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
-	});
-
-	test("extracts API URL from enterprise proxy-ep", () => {
-		const token = "tid=123;exp=1234567890;proxy-ep=proxy.company.ghe.com;other=value";
-		const baseUrl = getGitHubCopilotBaseUrl(token);
-		assert.equal(baseUrl, "https://api.company.ghe.com");
-	});
-
-	test("falls back to default when no token provided", () => {
-		const baseUrl = getGitHubCopilotBaseUrl();
-		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
-	});
-
-	test("falls back to default when token has no proxy-ep", () => {
-		const token = "tid=123;exp=1234567890;other=value";
-		const baseUrl = getGitHubCopilotBaseUrl(token);
-		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
-	});
-
-	test("uses enterprise domain when provided", () => {
-		const baseUrl = getGitHubCopilotBaseUrl(undefined, "company.ghe.com");
-		assert.equal(baseUrl, "https://copilot-api.company.ghe.com");
-	});
-
-	test("prioritizes token proxy-ep over enterprise domain", () => {
-		const token = "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;other=value";
-		const baseUrl = getGitHubCopilotBaseUrl(token, "company.ghe.com");
-		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
-	});
-});
-
-describe("GitHub Copilot OAuth — provider structure", () => {
-	test("has correct id and name", () => {
-		assert.equal(githubCopilotOAuthProvider.id, "github-copilot");
-		assert.equal(githubCopilotOAuthProvider.name, "GitHub Copilot");
-	});
-
-	test("has required methods", () => {
-		assert.equal(typeof githubCopilotOAuthProvider.login, "function");
-		assert.equal(typeof githubCopilotOAuthProvider.refreshToken, "function");
-		assert.equal(typeof githubCopilotOAuthProvider.getApiKey, "function");
-	});
-
-	test("getApiKey returns access token", () => {
-		const credentials: OAuthCredentials = {
-			access: "test-access-token",
-			refresh: "test-refresh-token",
-			expires: Date.now() + 3600000,
-		};
-		const apiKey = githubCopilotOAuthProvider.getApiKey(credentials);
-		assert.equal(apiKey, "test-access-token");
-	});
-
-	test("modifyModels preserves non-Copilot models", () => {
-		if (!githubCopilotOAuthProvider.modifyModels) return;
-		const models = [createModel({ id: "gpt-4", provider: "openai" })];
-		const credentials: OAuthCredentials = {
-			access: "test-token",
-			refresh: "test-refresh",
-			expires: Date.now() + 3600000,
-		};
-		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
-		assert.deepEqual(result, models);
-	});
-
-	test("modifyModels updates Copilot model baseUrl when token has proxy-ep", () => {
-		if (!githubCopilotOAuthProvider.modifyModels) return;
-		const models = [
-			createModel({
-				id: "claude-3.5-sonnet",
-				provider: "github-copilot",
-				baseUrl: "https://api.default.com",
-			}),
-		];
-		const credentials: CopilotCredentials = {
-			access: "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;",
-			refresh: "test-refresh",
-			expires: Date.now() + 3600000,
-		};
-		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
-		assert.equal(result[0].baseUrl, "https://api.individual.githubcopilot.com");
-	});
-
-	test("modifyModels applies model limits when available", () => {
-		if (!githubCopilotOAuthProvider.modifyModels) return;
-		const models = [
-			createModel({
-				id: "claude-3.5-sonnet",
-				provider: "github-copilot",
-				baseUrl: "https://api.default.com",
-			}),
-		];
-		const credentials: CopilotCredentials = {
-			access: "test-token",
-			refresh: "test-refresh",
-			expires: Date.now() + 3600000,
-			modelLimits: {
-				"claude-3.5-sonnet": { contextWindow: 123456, maxTokens: 4096 },
-			},
-		};
-		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
-		assert.equal(result[0].contextWindow, 123456);
-		assert.equal(result[0].maxTokens, 4096);
-	});
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Antigravity OAuth Provider Tests
-// ═══════════════════════════════════════════════════════════════════════════
-
-describe("Antigravity OAuth — provider structure", () => {
-	test("has correct id and name", () => {
-		assert.equal(antigravityOAuthProvider.id, "google-antigravity");
-		assert.equal(antigravityOAuthProvider.name, "Antigravity (Gemini 3, Claude, GPT-OSS)");
-	});
-
-	test("uses callback server", () => {
-		assert.equal(antigravityOAuthProvider.usesCallbackServer, true);
-	});
-
-	test("has required methods", () => {
-		assert.equal(typeof antigravityOAuthProvider.login, "function");
-		assert.equal(typeof antigravityOAuthProvider.refreshToken, "function");
-		assert.equal(typeof antigravityOAuthProvider.getApiKey, "function");
-	});
-
-	test("getApiKey returns JSON with token and projectId", () => {
-		const credentials: OAuthCredentials = {
-			access: "test-access-token",
-			refresh: "test-refresh-token",
-			expires: Date.now() + 3600000,
-			projectId: "test-project-123",
-			email: "test@example.com",
-		};
-		const apiKey = antigravityOAuthProvider.getApiKey(credentials);
-		assert.equal(typeof apiKey, "string");
-		const parsed = JSON.parse(apiKey);
-		assert.equal(parsed.token, "test-access-token");
-		assert.equal(parsed.projectId, "test-project-123");
-	});
-
-	test("refreshToken throws when projectId is missing", async () => {
-		const credentials: OAuthCredentials = {
-			access: "test-access-token",
-			refresh: "test-refresh-token",
-			expires: Date.now() + 3600000,
-		};
-		await assert.rejects(
-			antigravityOAuthProvider.refreshToken(credentials),
-			/Antigravity credentials missing projectId/,
-		);
-	});
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Gemini CLI OAuth Provider Tests
-// ═══════════════════════════════════════════════════════════════════════════
-
-describe("Gemini CLI OAuth — provider structure", () => {
-	test("has correct id and name", () => {
-		assert.equal(geminiCliOAuthProvider.id, "google-gemini-cli");
-		assert.equal(geminiCliOAuthProvider.name, "Google Cloud Code Assist (Gemini CLI)");
-	});
-
-	test("uses callback server", () => {
-		assert.equal(geminiCliOAuthProvider.usesCallbackServer, true);
-	});
-
-	test("has required methods", () => {
-		assert.equal(typeof geminiCliOAuthProvider.login, "function");
-		assert.equal(typeof geminiCliOAuthProvider.refreshToken, "function");
-		assert.equal(typeof geminiCliOAuthProvider.getApiKey, "function");
-	});
-
-	test("getApiKey returns JSON with token and projectId", () => {
-		const credentials: OAuthCredentials = {
-			access: "test-access-token",
-			refresh: "test-refresh-token",
-			expires: Date.now() + 3600000,
-			projectId: "test-project-456",
-			email: "test@example.com",
-		};
-		const apiKey = geminiCliOAuthProvider.getApiKey(credentials);
-		assert.equal(typeof apiKey, "string");
-		const parsed = JSON.parse(apiKey);
-		assert.equal(parsed.token, "test-access-token");
-		assert.equal(parsed.projectId, "test-project-456");
-	});
-
-	test("refreshToken throws when projectId is missing", async () => {
-		const credentials: OAuthCredentials = {
-			access: "test-access-token",
-			refresh: "test-refresh-token",
-			expires: Date.now() + 3600000,
-		};
-		await assert.rejects(
-			geminiCliOAuthProvider.refreshToken(credentials),
-			/Google Cloud credentials missing projectId/,
-		);
-	});
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Regression tests for credential de-obfuscation
-//
-// These tests verify that OAuth credentials are stored in plaintext
-// (not base64-encoded) after the refactor in commit 289bb325c.
-// ═══════════════════════════════════════════════════════════════════════════
-
-describe("OAuth credentials — de-obfuscated regression", () => {
-	// Verify we can import the modules without decoding errors
-	test("GitHub Copilot module imports successfully", () => {
-		// If the module imports, the CLIENT_ID is valid plaintext
-		assert.ok(githubCopilotOAuthProvider);
-	});
-
-	test("Antigravity module imports successfully", () => {
-		assert.ok(antigravityOAuthProvider);
-	});
-
-	test("Gemini CLI module imports successfully", () => {
-		assert.ok(geminiCliOAuthProvider);
-	});
-
-	test("GitHub Copilot CLIENT_ID is plaintext (not base64)", () => {
-		const content = readFileSync(join(__dirname, "github-copilot.ts"), "utf-8");
-		// Should contain plaintext CLIENT_ID
-		assert.ok(content.includes('CLIENT_ID = "Iv1.b507a08c87ecfe98"'));
-		// Should NOT contain atob calls for de-obfuscation
-		assert.ok(!content.includes("atob("));
-	});
-
-	test("Antigravity CLIENT_ID and CLIENT_SECRET are plaintext", () => {
-		const content = readFileSync(join(__dirname, "google-antigravity.ts"), "utf-8");
-		// Should contain plaintext credentials
-		assert.ok(
-			content.includes(
-				'CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"',
-			),
-		);
-		assert.ok(
-			content.includes('CLIENT_SECRET = "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"'),
-		);
-		// Should NOT contain atob calls for de-obfuscation
-		assert.ok(!content.includes("atob("));
-	});
-
-	test("Gemini CLI CLIENT_ID and CLIENT_SECRET are plaintext", () => {
-		const content = readFileSync(join(__dirname, "google-gemini-cli.ts"), "utf-8");
-		// Should contain plaintext credentials
-		assert.ok(
-			content.includes(
-				'CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com"',
-			),
-		);
-		assert.ok(
-			content.includes('CLIENT_SECRET = "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"'),
-		);
-		// Should NOT contain atob calls for de-obfuscation
-		assert.ok(!content.includes("atob("));
-	});
-
-	test("all OAuth files include security explanation comments", () => {
-		const files = [
-			"github-copilot.ts",
-			"google-antigravity.ts",
-			"google-gemini-cli.ts",
-		];
-
-		for (const file of files) {
-			const content = readFileSync(join(__dirname, file), "utf-8");
-			// Should include explanation of why credentials are public
-			assert.ok(
-				content.includes("NOTE: This credential is public") ||
-					content.includes("NOTE: These credentials are public"),
-				`${file} should explain why credentials are public`,
-			);
-			assert.ok(
-				content.includes("obfuscated") ||
-					content.includes("security scanners"),
-				`${file} should reference the security scanner issue`,
-			);
-		}
-	});
-});

package/src/resources/extensions/gsd/tests/auto-start-model-capture.test.ts

@@ -1,143 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const sourcePath = join(import.meta.dirname, "..", "auto-start.ts");
-const source = readFileSync(sourcePath, "utf-8");
-
-test("bootstrapAutoSession snapshots ctx.model before guided-flow entry (#2829)", () => {
-  // The snapshot ordering guarantee still holds: build snapshot before guided-flow.
-  const snapshotIdx = source.indexOf("const startModelSnapshot = manualSessionOverride");
-  assert.ok(snapshotIdx > -1, "auto-start.ts should snapshot model at bootstrap start");
-
-  const firstDiscussIdx = source.indexOf('await showSmartEntry(ctx, pi, base, { step: requestedStepMode });');
-  assert.ok(firstDiscussIdx > -1, "auto-start.ts should route through showSmartEntry during guided flow");
-
-  assert.ok(
-    snapshotIdx < firstDiscussIdx,
-    "auto-start.ts must capture the start model before guided-flow can mutate ctx.model",
-  );
-});
-
-test("bootstrapAutoSession restores autoModeStartModel from the early snapshot (#2829)", () => {
-  const assignmentIdx = source.indexOf("s.autoModeStartModel = {");
-  assert.ok(assignmentIdx > -1, "auto-start.ts should assign autoModeStartModel");
-
-  const snapshotRefIdx = source.indexOf("provider: startModelSnapshot.provider", assignmentIdx);
-  assert.ok(snapshotRefIdx > -1, "autoModeStartModel should be restored from startModelSnapshot");
-});
-
-test("bootstrapAutoSession checks manual session override before preferences", () => {
-  const manualIdx = source.indexOf("const manualSessionOverride = getSessionModelOverride(");
-  assert.ok(manualIdx > -1, "auto-start.ts should read session model override first");
-
-  // resolveDefaultSessionModel() should still be called for fallback behavior
-  const preferredIdx = source.indexOf("const preferredModel = ");
-  assert.ok(preferredIdx > -1, "auto-start.ts should build preferredModel");
-  assert.ok(
-    source.indexOf("resolveDefaultSessionModel(") > -1,
-    "auto-start.ts should call resolveDefaultSessionModel()",
-  );
-
-  // Session provider should be passed for bare model ID resolution
-  const withProviderIdx = source.indexOf("resolveDefaultSessionModel(ctx.model?.provider)");
-  assert.ok(withProviderIdx > -1, "auto-start.ts should pass ctx.model?.provider for bare ID resolution");
-
-  const snapshotIdx = source.indexOf("const startModelSnapshot = manualSessionOverride");
-  assert.ok(snapshotIdx > -1, "startModelSnapshot should prefer manual session override");
-
-  assert.ok(
-    manualIdx < snapshotIdx && preferredIdx < snapshotIdx,
-    "manual override and preference fallback must be resolved before building startModelSnapshot",
-  );
-
-  // Preferred model should still be part of fallback resolution.
-  const snapshotBlock = source.slice(snapshotIdx, snapshotIdx + 400);
-  assert.ok(
-    snapshotBlock.includes("validatedPreferredModel") || snapshotBlock.includes("preferredModel"),
-    "startModelSnapshot must still consider preferredModel for built-in providers",
-  );
-});
-
-test("bootstrapAutoSession prioritizes current session model over PREFERENCES.md default", () => {
-  const snapshotIdx = source.indexOf("const startModelSnapshot = manualSessionOverride");
-  assert.ok(snapshotIdx > -1, "auto-start.ts should build startModelSnapshot");
-
-  const snapshotBlock = source.slice(snapshotIdx, snapshotIdx + 500);
-  const currentIdx = snapshotBlock.indexOf("currentSessionModel");
-  const preferredIdx = snapshotBlock.indexOf("validatedPreferredModel");
-
-  assert.ok(currentIdx > -1, "startModelSnapshot should include currentSessionModel");
-  assert.ok(preferredIdx > -1, "startModelSnapshot should include validatedPreferredModel");
-  assert.ok(
-    currentIdx < preferredIdx,
-    "startModelSnapshot should prefer currentSessionModel before validatedPreferredModel",
-  );
-});
-
-test("bootstrapAutoSession prefers session model over PREFERENCES.md when provider is custom (#4122)", () => {
-  // Custom providers (Ollama, vLLM, OpenAI-compatible proxies) live in
-  // ~/.gsd/agent/models.json, not PREFERENCES.md.  When the user picks one
-  // via /gsd model, that selection must win over any preferredModel from
-  // PREFERENCES.md, otherwise auto-mode tries to start a built-in provider
-  // the user is not logged into and pauses with "Not logged in".
-  const customCheckIdx = source.indexOf("isCustomProvider(ctx.model?.provider)");
-  assert.ok(
-    customCheckIdx > -1,
-    "auto-start.ts should call isCustomProvider() to detect custom-model sessions",
-  );
-
-  // sessionProviderIsCustom must gate preferredModel resolution so that when the
-  // session provider is custom, preferredModel is null and PREFERENCES.md is
-  // skipped entirely — the snapshot then falls through to ctx.model.
-  const gateIdx = source.indexOf("sessionProviderIsCustom");
-  assert.ok(gateIdx > -1, "auto-start.ts should bind sessionProviderIsCustom");
-
-  const preferredIdx = source.indexOf("const preferredModel = ");
-  assert.ok(preferredIdx > -1, "auto-start.ts should build preferredModel");
-
-  const preferredBlock = source.slice(preferredIdx, preferredIdx + 200);
-  assert.ok(
-    preferredBlock.includes("sessionProviderIsCustom"),
-    "preferredModel must be gated on sessionProviderIsCustom so PREFERENCES.md is skipped for custom providers",
-  );
-
-  const snapshotIdx = source.indexOf("const startModelSnapshot = ");
-  assert.ok(snapshotIdx > -1, "auto-start.ts should build startModelSnapshot");
-
-  assert.ok(
-    customCheckIdx < preferredIdx && preferredIdx < snapshotIdx,
-    "isCustomProvider() must be evaluated before preferredModel, which must be resolved before startModelSnapshot",
-  );
-});
-
-test("bootstrapAutoSession validates preferred model against live registry auth (#unconfigured-models)", () => {
-  // The raw PREFERENCES.md value must be validated against getAvailable()
-  // before being captured as the snapshot, so an unconfigured provider
-  // (no API key / OAuth) can't become autoModeStartModel.
-  const validationIdx = source.indexOf("ctx.modelRegistry.getAvailable()");
-  assert.ok(validationIdx > -1, "auto-start.ts should validate preferred model against getAvailable()");
-
-  const resolveModelIdIdx = source.indexOf("resolveModelId");
-  assert.ok(resolveModelIdIdx > -1, "auto-start.ts should resolve preferred model against the registry");
-
-  const warningIdx = source.indexOf("is not configured; falling back to session default");
-  assert.ok(warningIdx > -1, "auto-start.ts should warn when preferred model is unconfigured");
-});
-
-test("bootstrapAutoSession snapshots and persists thinking level for auto-mode lifecycle", () => {
-  const captureIdx = source.indexOf("const startThinkingSnapshot = pi.getThinkingLevel()");
-  assert.ok(captureIdx > -1, "auto-start.ts should snapshot thinking level at bootstrap start");
-
-  const originalThinkingIdx = source.indexOf("s.originalThinkingLevel = startThinkingSnapshot ?? null");
-  assert.ok(originalThinkingIdx > -1, "auto-start.ts should store originalThinkingLevel from snapshot");
-
-  const autoThinkingIdx = source.indexOf("s.autoModeStartThinkingLevel = startThinkingSnapshot ?? null");
-  assert.ok(autoThinkingIdx > -1, "auto-start.ts should store autoModeStartThinkingLevel from snapshot");
-
-  assert.ok(
-    captureIdx < originalThinkingIdx && captureIdx < autoThinkingIdx,
-    "thinking snapshot must be captured before session state assignment",
-  );
-});

package/src/resources/extensions/gsd/tests/complete-milestone-false-merge.test.ts

@@ -1,157 +0,0 @@
-/**
- * complete-milestone-false-merge.test.ts — Regression test for #4175.
- *
- * Before the fix, a failed complete-milestone unit could leave a stub
- * SUMMARY blocker placeholder on disk. stopAuto's SUMMARY-presence check
- * then treated the milestone as complete and merged the worktree branch
- * into main — emitting a misleading metadata-only merge warning for a
- * milestone that was never legitimately finished.
- *
- * The fix has three cooperating parts:
- *   1. stopAuto uses DB status (authoritative) instead of SUMMARY presence
- *      when the project DB is available.
- *   2. postUnitPreVerification pauses auto-mode for complete-milestone
- *      after retries are exhausted instead of writing a blocker placeholder.
- *   3. recoverTimedOutUnit pauses for complete-milestone instead of
- *      writing a blocker placeholder.
- *
- * This test guards all three via source inspection so a future refactor
- * cannot silently reintroduce the false-merge path.
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const gsdDir = join(import.meta.dirname, "..");
-const autoSrc = readFileSync(join(gsdDir, "auto.ts"), "utf-8");
-const postUnitSrc = readFileSync(join(gsdDir, "auto-post-unit.ts"), "utf-8");
-const timeoutSrc = readFileSync(join(gsdDir, "auto-timeout-recovery.ts"), "utf-8");
-
-test("#4175: stopAuto uses DB status as the authoritative milestone-complete signal", () => {
-  const step4Idx = autoSrc.indexOf("Step 4: Auto-worktree exit");
-  assert.ok(step4Idx !== -1, "Step 4 comment exists in stopAuto");
-  const step5Idx = autoSrc.indexOf("Step 5:", step4Idx);
-  const step4Block = autoSrc.slice(step4Idx, step5Idx);
-
-  assert.ok(
-    step4Block.includes("isDbAvailable()"),
-    "Step 4 should branch on isDbAvailable() so DB is consulted when present",
-  );
-  assert.ok(
-    step4Block.includes("getMilestone(s.currentMilestoneId)"),
-    "Step 4 should read authoritative milestone status via getMilestone()",
-  );
-  assert.ok(
-    /status\s*===\s*"complete"/.test(step4Block),
-    'Step 4 should compare the DB row status to "complete"',
-  );
-});
-
-test("#4175: stopAuto imports getMilestone from gsd-db", () => {
-  assert.ok(
-    /import\s*\{[^}]*\bgetMilestone\b[^}]*\}\s*from\s*"\.\/gsd-db\.js"/.test(autoSrc),
-    "auto.ts should import getMilestone from ./gsd-db.js",
-  );
-});
-
-test("#4175: stopAuto still falls back to SUMMARY presence when DB is unavailable", () => {
-  const step4Idx = autoSrc.indexOf("Step 4: Auto-worktree exit");
-  const step5Idx = autoSrc.indexOf("Step 5:", step4Idx);
-  const step4Block = autoSrc.slice(step4Idx, step5Idx);
-
-  assert.ok(
-    step4Block.includes("resolveMilestoneFile"),
-    "Step 4 should keep SUMMARY-file resolution for DB-unavailable projects",
-  );
-  assert.ok(
-    step4Block.includes("preserveBranch"),
-    "Step 4 should still preserve branch for incomplete milestones (fallback path)",
-  );
-});
-
-test("#4175: postUnitPreVerification pauses complete-milestone after retries exhausted", () => {
-  // The pause branch must live inside the retries-exhausted block, above the
-  // writeBlockerPlaceholder call — otherwise the stub SUMMARY is still written.
-  const retriesExhaustedIdx = postUnitSrc.indexOf(
-    "if (attempt > MAX_VERIFICATION_RETRIES)",
-  );
-  assert.ok(
-    retriesExhaustedIdx !== -1,
-    "retries-exhausted guard exists in postUnitPreVerification",
-  );
-
-  const blockerCallIdx = postUnitSrc.indexOf("writeBlockerPlaceholder", retriesExhaustedIdx);
-  assert.ok(
-    blockerCallIdx !== -1,
-    "blocker placeholder call still exists for non-milestone units",
-  );
-
-  const exhaustedBlock = postUnitSrc.slice(retriesExhaustedIdx, blockerCallIdx);
-
-  assert.ok(
-    /s\.currentUnit\.type\s*===\s*"complete-milestone"/.test(exhaustedBlock),
-    "retries-exhausted block should specifically handle complete-milestone",
-  );
-  assert.ok(
-    /pauseAuto\s*\(\s*ctx\s*,\s*pi\s*\)/.test(exhaustedBlock),
-    "complete-milestone path should call pauseAuto instead of falling through",
-  );
-  // The pause branch must return so execution never reaches writeBlockerPlaceholder.
-  assert.ok(
-    /return\s+"dispatched"\s*;/.test(exhaustedBlock),
-    "complete-milestone pause branch should return before the placeholder call",
-  );
-});
-
-test("#4658: postUnitPreVerification waits briefly for DB-close on complete-milestone before retrying", () => {
-  assert.ok(
-    /async function waitForMilestoneDbClose/.test(postUnitSrc),
-    "auto-post-unit should define a DB settle helper for complete-milestone",
-  );
-  assert.ok(
-    /setTimeout\(resolve,\s*COMPLETE_MILESTONE_DB_SETTLE_POLL_MS\)/.test(postUnitSrc),
-    "DB settle helper should poll with a bounded timeout window",
-  );
-  assert.ok(
-    /s\.currentUnit\.type\s*===\s*"complete-milestone"[\s\S]*waitForMilestoneDbClose/.test(postUnitSrc),
-    "complete-milestone path should invoke DB settle check before retry flow",
-  );
-});
-
-test("#4175: recoverTimedOutUnit pauses complete-milestone instead of writing a blocker placeholder", () => {
-  // The complete-milestone pause branch must sit immediately above the
-  // "retries exhausted" writeBlockerPlaceholder call so a failed
-  // complete-milestone never produces a stub SUMMARY. Anchor on the
-  // comment that precedes that specific placeholder call rather than the
-  // function's earlier writeBlockerPlaceholder use sites or its import.
-  // Use lastIndexOf so we find the final retries-exhausted block in
-  // recoverTimedOutUnit, not an earlier helper with the same comment.
-  const exhaustedAnchor = "Retries exhausted — write a blocker placeholder";
-  const exhaustedIdx = timeoutSrc.lastIndexOf(exhaustedAnchor);
-  assert.ok(
-    exhaustedIdx !== -1,
-    "retries-exhausted blocker-placeholder path still exists for non-milestone units",
-  );
-
-  const guardIdx = timeoutSrc.lastIndexOf(
-    'unitType === "complete-milestone"',
-    exhaustedIdx,
-  );
-  assert.ok(
-    guardIdx !== -1,
-    "complete-milestone guard should appear above the retries-exhausted placeholder call",
-  );
-
-  const guardBlock = timeoutSrc.slice(guardIdx, exhaustedIdx);
-  assert.ok(
-    /return\s+"paused"\s*;/.test(guardBlock),
-    "complete-milestone guard should return 'paused' before the placeholder call",
-  );
-  // The guard itself must not call writeBlockerPlaceholder.
-  assert.ok(
-    !guardBlock.includes("writeBlockerPlaceholder"),
-    "complete-milestone guard must not write a blocker placeholder",
-  );
-});