gsd-pi 2.77.0 → 2.78.0-dev.aeeb2ca00

package/src/resources/extensions/gsd/tests/integration/state-machine-edge-cases.test.ts

@@ -277,6 +277,14 @@ function buildDispatchCtx(
   };
 }
 
+function getUatVerdictGate(): import("../../auto-dispatch.ts").DispatchRule {
+  const rule = DISPATCH_RULES.find(
+    r => r.name === "uat-verdict-gate (non-PASS blocks progression)",
+  );
+  assert.ok(rule, "uat-verdict-gate rule should be registered");
+  return rule;
+}
+
 // ═══════════════════════════════════════════════════════════════════════════
 // Test Suite
 // ═══════════════════════════════════════════════════════════════════════════
@@ -355,10 +363,13 @@ describe("state derivation failures", () => {
     const state2 = await deriveState(base);
     assert.equal(state2.phase, "executing", "cached result should still show executing");
 
-    // After explicit invalidation, should reflect the DB mutation
+    // After explicit invalidation, should reflect the DB mutation and reconcile
+    // missing plan tasks instead of prematurely summarizing a partial DB row set.
     invalidateStateCache();
     const state3 = await deriveState(base);
-    assert.equal(state3.phase, "summarizing", "after cache invalidation should show summarizing");
+    assert.equal(state3.phase, "executing", "after cache invalidation should continue with the missing plan task");
+    assert.equal(state3.activeTask?.id, "T02", "missing plan task T02 should be imported and selected");
+    assert.deepEqual(state3.progress?.tasks, { done: 1, total: 2 });
   });
 
   test("corrupt ROADMAP: binary content does not crash deriveState", async () => {
@@ -691,7 +702,7 @@ describe("transition boundary failures", () => {
     );
   });
 
-  test("blocked state: all slices have unmet deps → fallback picks slice", async () => {
+  test("blocked state: all slices have unmet deps → blocks", async () => {
     base = makeTempDir();
     const mDir = join(base, ".gsd", "milestones", "M001");
     mkdirSync(join(mDir, "slices", "S01", "tasks"), { recursive: true });
@@ -736,9 +747,9 @@ describe("transition boundary failures", () => {
 
     invalidateAllCaches();
     const state = await deriveStateFromDb(base);
-    // With partial-dep fallback, circular deps no longer block — fallback picks first eligible slice
-    assert.equal(state.phase, "planning", "circular deps: fallback picks a slice instead of blocking");
-    assert.ok(state.activeSlice !== null, "activeSlice set via fallback");
+    assert.equal(state.phase, "blocked", "circular deps: no slice should be selected through unmet deps");
+    assert.equal(state.activeSlice, null, "activeSlice should remain null when all deps are blocked");
+    assert.ok(state.blockers.some(b => b.includes("No slice eligible")));
   });
 });
 
@@ -868,6 +879,132 @@ describe("dispatch failure modes", () => {
     // run-uat should come before uat-verdict-gate
     assert.ok(runUatIdx < uatGateIdx, "run-uat should precede uat-verdict-gate");
   });
+
+  test("UAT verdict gate: ASSESSMENT FAIL blocks closed slice progression", async () => {
+    base = createFullFixture();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    insertMilestone({ id: "M001", title: "Active", status: "active" });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "First", status: "complete" });
+    insertSlice({ id: "S02", milestoneId: "M001", title: "Second", status: "pending" });
+
+    const s01Dir = join(base, ".gsd", "milestones", "M001", "slices", "S01");
+    writeFileSync(
+      join(s01Dir, "S01-UAT.md"),
+      "# UAT File\n\n## UAT Type\n\n- UAT mode: artifact-driven\n",
+    );
+    writeFileSync(
+      join(s01Dir, "S01-ASSESSMENT.md"),
+      "---\nverdict: FAIL\n---\n# UAT Assessment\n",
+    );
+
+    const ctx = buildDispatchCtx(base, "M001", {
+      phase: "planning",
+      activeSlice: { id: "S02", title: "Second" },
+      activeTask: null,
+    });
+    ctx.prefs = { uat_dispatch: true } as any;
+
+    const result = await getUatVerdictGate().match(ctx);
+    assert.equal(result?.action, "stop", "ASSESSMENT FAIL should block progression");
+    assert.ok(
+      (result as any).reason?.includes('UAT verdict for S01 is "fail"'),
+      "stop reason should report normalized ASSESSMENT verdict",
+    );
+  });
+
+  test("UAT verdict gate: ROADMAP fallback gates done slices when DB is unavailable", async () => {
+    base = createFullFixture();
+    const mDir = join(base, ".gsd", "milestones", "M001");
+    writeFileSync(
+      join(mDir, "M001-ROADMAP.md"),
+      [
+        "# M001: Edge Case Milestone",
+        "",
+        "## Vision",
+        "Prove edge case correctness.",
+        "",
+        "## Success Criteria",
+        "- All edge cases handled",
+        "",
+        "## Slices",
+        "",
+        "- [x] **S01: First Feature** `risk:low` `depends:[]`",
+        "  - After this: First feature proven.",
+        "",
+        "- [ ] **S02: Second Feature** `risk:low` `depends:[]`",
+        "  - After this: Second feature proven.",
+        "",
+        "## Boundary Map",
+        "",
+        "| From | To | Produces | Consumes |",
+        "|------|----|----------|----------|",
+        "| S01 | terminal | feature-a | nothing |",
+        "| S02 | terminal | feature-b | nothing |",
+      ].join("\n"),
+    );
+
+    const s01Dir = join(base, ".gsd", "milestones", "M001", "slices", "S01");
+    writeFileSync(
+      join(s01Dir, "S01-UAT.md"),
+      "# UAT File\n\n## UAT Type\n\n- UAT mode: artifact-driven\n",
+    );
+    writeFileSync(
+      join(s01Dir, "S01-ASSESSMENT.md"),
+      "---\nverdict: needs-remediation\n---\n# UAT Assessment\n",
+    );
+
+    const ctx = buildDispatchCtx(base, "M001", {
+      phase: "planning",
+      activeSlice: { id: "S02", title: "Second" },
+      activeTask: null,
+    });
+    ctx.prefs = { uat_dispatch: true } as any;
+
+    const result = await getUatVerdictGate().match(ctx);
+    assert.equal(result?.action, "stop", "ROADMAP done slices should be gated without DB");
+    assert.ok(
+      (result as any).reason?.includes('UAT verdict for S01 is "needs-remediation"'),
+      "stop reason should report normalized ASSESSMENT verdict from disk fallback",
+    );
+  });
+
+  for (const status of ["done", "skipped"]) {
+    test(`UAT verdict gate: legacy closed status "${status}" is gated`, async () => {
+      base = createFullFixture();
+      openDatabase(join(base, ".gsd", "gsd.db"));
+      insertMilestone({ id: "M001", title: "Active", status: "active" });
+      insertSlice({ id: "S01", milestoneId: "M001", title: "First", status });
+      insertSlice({ id: "S02", milestoneId: "M001", title: "Second", status: "pending" });
+
+      const s01Dir = join(base, ".gsd", "milestones", "M001", "slices", "S01");
+      writeFileSync(
+        join(s01Dir, "S01-UAT.md"),
+        "# UAT File\n\n## UAT Type\n\n- UAT mode: artifact-driven\n",
+      );
+      writeFileSync(
+        join(s01Dir, "S01-ASSESSMENT.md"),
+        "---\nverdict: needs-remediation\n---\n# UAT Assessment\n",
+      );
+
+      const ctx = buildDispatchCtx(base, "M001", {
+        phase: "planning",
+        activeSlice: { id: "S02", title: "Second" },
+        activeTask: null,
+      });
+      ctx.prefs = { uat_dispatch: true } as any;
+
+      const result = await getUatVerdictGate().match(ctx);
+      assert.equal(
+        result?.action,
+        "stop",
+        `${status} slices should be treated as closed for UAT verdict gating`,
+      );
+      assert.ok(
+        (result as any).reason?.includes('UAT verdict for S01 is "needs-remediation"'),
+        "stop reason should report normalized ASSESSMENT verdict",
+      );
+    });
+  }
 });
 
 // ─────────────────────────────────────────────────────────────────────────
@@ -1155,7 +1292,7 @@ describe("dispatch guard integration", () => {
     assert.ok(existsSync(validationPath), "VALIDATION file should be written");
     const content = readFileSync(validationPath, "utf-8");
     assert.ok(content.includes("verdict: pass"), "should contain pass verdict");
-    assert.ok(content.includes("skipped by preference"), "should note it was skipped");
+    assert.ok(content.includes("`skip_milestone_validation` preference"), "should note it was skipped via the preference path (#4781)");
   });
 
   test("rewrite-docs circuit breaker: exceeding MAX attempts resolves all overrides", async () => {

package/src/resources/extensions/gsd/tests/integration/state-machine-live-validation.test.ts

@@ -936,9 +936,11 @@ describe("state-machine-live-validation", () => {
       insertMilestone({ id: "M001", title: "Active", status: "active" });
       insertSlice({ id: "S01", milestoneId: "M001", title: "First", status: "in_progress" });
       insertTask({ id: "T01", sliceId: "S01", milestoneId: "M001", status: "pending" });
+      insertTask({ id: "T02", sliceId: "S01", milestoneId: "M001", status: "pending" });
 
       // Complete task + slice
       await handleCompleteTask(makeTaskParams("T01", "S01", "M001") as any, base);
+      await handleCompleteTask(makeTaskParams("T02", "S01", "M001") as any, base);
       await handleCompleteSlice(makeSliceParams("S01", "M001") as any, base);
       assert.ok(isClosedStatus(getSlice("M001", "S01")!.status));
 
@@ -946,9 +948,11 @@ describe("state-machine-live-validation", () => {
       await handleReopenSlice({ milestoneId: "M001", sliceId: "S01" }, base);
       assert.equal(getSlice("M001", "S01")!.status, "in_progress");
       assert.equal(getTask("M001", "S01", "T01")!.status, "pending");
+      assert.equal(getTask("M001", "S01", "T02")!.status, "pending");
 
       // Re-complete task + slice succeeds
       await handleCompleteTask(makeTaskParams("T01", "S01", "M001") as any, base);
+      await handleCompleteTask(makeTaskParams("T02", "S01", "M001") as any, base);
       const r = await handleCompleteSlice(makeSliceParams("S01", "M001") as any, base);
       assert.ok(!("error" in r), `re-complete slice: ${JSON.stringify(r)}`);
       assert.ok(isClosedStatus(getSlice("M001", "S01")!.status));

package/src/resources/extensions/gsd/tests/integration/state-machine-runtime-failures.test.ts

@@ -48,9 +48,7 @@ import type { WindowEntry } from "../../auto/types.ts";
 import {
   AutoSession,
   NEW_SESSION_TIMEOUT_MS,
-  MAX_UNIT_DISPATCHES,
   STUB_RECOVERY_THRESHOLD,
-  MAX_LIFETIME_DISPATCHES,
 } from "../../auto/session.ts";
 
 // ── Auto-loop types ──────────────────────────────────────────────────────
@@ -364,14 +362,6 @@ describe("session management", () => {
     assert.equal(NEW_SESSION_TIMEOUT_MS, 120_000, "session timeout should be 120s");
   });
 
-  test("MAX_UNIT_DISPATCHES limits retries for a single unit", () => {
-    assert.equal(MAX_UNIT_DISPATCHES, 3, "max unit dispatches should be 3");
-  });
-
-  test("MAX_LIFETIME_DISPATCHES is the absolute limit per unit", () => {
-    assert.equal(MAX_LIFETIME_DISPATCHES, 6, "max lifetime dispatches should be 6");
-  });
-
   test("STUB_RECOVERY_THRESHOLD triggers recovery after N stub completions", () => {
     assert.equal(STUB_RECOVERY_THRESHOLD, 2, "stub recovery threshold should be 2");
   });
@@ -392,12 +382,8 @@ describe("session management", () => {
     s.unitDispatchCount.set(unitId, 2);
     assert.equal(s.unitDispatchCount.get(unitId), 2);
 
-    // Exceeding MAX_UNIT_DISPATCHES
-    s.unitDispatchCount.set(unitId, MAX_UNIT_DISPATCHES + 1);
-    assert.ok(
-      s.unitDispatchCount.get(unitId)! > MAX_UNIT_DISPATCHES,
-      "should track count beyond max for detection",
-    );
+    s.unitDispatchCount.set(unitId, 4);
+    assert.equal(s.unitDispatchCount.get(unitId), 4);
   });
 
   test("AutoSession toJSON() provides diagnostic snapshot", () => {

package/src/resources/extensions/gsd/tests/integration/worktree-e2e.test.ts

@@ -200,6 +200,17 @@ Test
 
 ## Boundary Map
 _None_
+`);
+      writeFileSync(join(msDir, "M001-SUMMARY.md"), `---
+id: M001
+title: "Test Milestone"
+status: complete
+completed_at: 2026-04-18T00:00:00Z
+---
+
+# M001: Test Milestone
+
+Completed.
 `);
       run("git add -A", repo);
       run("git commit -m \"add milestone\"", repo);

package/src/resources/extensions/gsd/tests/interactive-routing-bypass.test.ts

@@ -8,6 +8,7 @@ import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { extractSourceRegion } from "./test-helpers.ts";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -62,7 +63,7 @@ describe("interactive routing bypass (#3962)", () => {
     );
     // The function should check isAutoMode before routing synthesis
     const fnIdx = modelSelectionSrc.indexOf("function resolvePreferredModelConfig");
-    const fnBody = modelSelectionSrc.slice(fnIdx, fnIdx + 900);
+    const fnBody = extractSourceRegion(modelSelectionSrc, "function resolvePreferredModelConfig");
     assert.ok(
       fnBody.includes("isAutoMode"),
       "resolvePreferredModelConfig should accept isAutoMode parameter",
@@ -137,8 +138,13 @@ describe("model downgrade notifications always visible (#3962)", () => {
     const escalatedIdx = modelSelectionSrc.indexOf("if (escalated)");
     assert.ok(escalatedIdx > 0, "escalation block should exist");
 
-    // Get the block from "if (escalated)" to the next closing brace pattern
-    const block = modelSelectionSrc.slice(escalatedIdx, escalatedIdx + 400);
+    // Get the block from "if (escalated)" to the next distinctive marker
+    // (the capability-override loading that immediately follows).
+    const block = extractSourceRegion(
+      modelSelectionSrc,
+      "if (escalated)",
+      "// Load user capability overrides",
+    );
     assert.ok(
       block.includes("Tier escalation:"),
       "escalation block should contain the notification",

package/src/resources/extensions/gsd/tests/interrupted-session-ui.test.ts

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
@@ -126,11 +126,8 @@ test("guided-flow stale paused-session scenario is suppressed when no resumable
   }
 });
 
-test("guided-flow source uses step-aware resume and clears stale paused metadata without changing discuss handoff semantics", () => {
-  const source = readFileSync(join(import.meta.dirname, "..", "guided-flow.ts"), "utf-8");
-  assert.ok(source.includes('const interrupted = await assessInterruptedSession(basePath);'));
-  assert.ok(source.includes('resumeLabel = interrupted.pausedSession?.stepMode'));
-  assert.ok(source.includes('step: interrupted.pausedSession?.stepMode ?? false'));
-  assert.ok(source.includes('unlinkSync(join(gsdRoot(basePath), "runtime", "paused-session.json"))'));
-  assert.ok(source.includes('pendingAutoStartMap.set(basePath,'));
-});
+// Note: the prior source-grep test that scanned guided-flow.ts for five
+// string literals was removed under #4827. The invariants it encoded
+// (step-aware resume + stale paused-session cleanup + pendingAutoStartMap
+// side effect) should be covered by a runtime drive of guided-flow —
+// tracked as a follow-up.

package/src/resources/extensions/gsd/tests/journal-integration.test.ts

@@ -21,6 +21,13 @@ import type { IterationContext, LoopState, PreDispatchData, IterationData } from
 import type { SessionLockStatus } from "../session-lock.js";
 import { runDispatch, runUnitPhase, runPreDispatch, runFinalize } from "../auto/phases.js";
 import { readUnitRuntimeRecord } from "../unit-runtime.js";
+import {
+  closeDatabase,
+  insertMilestone,
+  insertSlice,
+  insertTask,
+  openDatabase,
+} from "../gsd-db.js";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -644,6 +651,63 @@ test("terminal event is emitted on blocked state", async () => {
   assert.deepEqual((terminalEvents[0].data as any).blockers, ["Missing API key"]);
 });
 
+test("#4671: plan-v2 missing CONTEXT.md reaches dispatch recovery instead of pausing", async () => {
+  const basePath = mkdtempSync(join(tmpdir(), "gsd-4671-predispatch-"));
+  mkdirSync(join(basePath, ".gsd", "milestones", "M001", "slices", "S01", "tasks"), { recursive: true });
+  openDatabase(join(basePath, ".gsd", "gsd.db"));
+  try {
+    insertMilestone({ id: "M001", title: "Test", status: "active" });
+    insertSlice({
+      id: "S01",
+      milestoneId: "M001",
+      title: "Slice 1",
+      status: "in_progress",
+      sequence: 1,
+    });
+    insertTask({
+      id: "T01",
+      milestoneId: "M001",
+      sliceId: "S01",
+      title: "Task 1",
+      status: "pending",
+      keyFiles: ["src/task.ts"],
+      sequence: 1,
+    });
+
+    let pauseCalls = 0;
+    const capture = createEventCapture();
+    const deps = makeMockDeps(capture, {
+      pauseAuto: async () => { pauseCalls++; },
+      deriveState: async () => ({
+        phase: "executing",
+        activeMilestone: { id: "M001", title: "Test", status: "active" },
+        activeSlice: { id: "S01", title: "Slice 1" },
+        activeTask: { id: "T01", title: "Task 1" },
+        registry: [{ id: "M001", status: "active" }],
+        blockers: [],
+        recentDecisions: [],
+        nextAction: "dispatch",
+      }) as any,
+    });
+    const ic = makeIC(deps, {
+      prefs: { uok: { plan_v2: { enabled: true } } } as any,
+    });
+    ic.s.basePath = basePath;
+
+    const result = await runPreDispatch(ic, {
+      recentUnits: [],
+      stuckRecoveryAttempts: 0,
+      consecutiveFinalizeTimeouts: 0,
+    });
+
+    assert.equal(result.action, "next");
+    assert.equal(pauseCalls, 0, "missing CONTEXT.md should be handled by dispatch recovery, not plan gate pause");
+  } finally {
+    closeDatabase();
+    rmSync(basePath, { recursive: true, force: true });
+  }
+});
+
 test("milestone-transition event is emitted when milestone changes", async () => {
   const capture = createEventCapture();
   const deps = makeMockDeps(capture, {

package/src/resources/extensions/gsd/tests/knowledge.test.ts

@@ -15,7 +15,7 @@ import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, realpathSy
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { GSD_ROOT_FILES, resolveGsdRootFile } from '../paths.ts';
-import { inlineGsdRootFile } from '../auto-prompts.ts';
+import { inlineGsdRootFile, inlineKnowledgeBudgeted } from '../auto-prompts.ts';
 import { appendKnowledge } from '../files.ts';
 import { loadKnowledgeBlock } from '../bootstrap/system-context.ts';
 
@@ -248,3 +248,95 @@ test('loadKnowledgeBlock: reports globalSizeKb above 4KB threshold', () => {
 
   rmSync(tmp, { recursive: true, force: true });
 });
+
+// ─── inlineKnowledgeBudgeted — issue #4719 ─────────────────────────────────
+// Milestone-phase prompts must not inject the full KNOWLEDGE.md. The budgeted
+// helper scopes by milestone-level keywords and caps the injected size.
+
+test('inlineKnowledgeBudgeted: returns scoped H3 entries for single-H2 file', async () => {
+  const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-knowledge-')));
+  const gsdDir = join(tmp, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+
+  const content = `# Project Knowledge
+
+## Patterns
+
+### Database: prepared statements
+Always use prepared statements with SQLite.
+
+### API: versioned paths
+Use /v1/resource style versioning.
+
+### Testing: node:test
+Prefer node:test over external frameworks.
+`;
+  writeFileSync(join(gsdDir, 'KNOWLEDGE.md'), content);
+
+  const result = await inlineKnowledgeBudgeted(tmp, ['database']);
+  assert.ok(result !== null, 'should return content');
+  assert.ok(result!.includes('Database: prepared statements'), 'includes matching H3');
+  assert.ok(!result!.includes('API: versioned paths'), 'excludes non-matching H3');
+
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test('inlineKnowledgeBudgeted: caps payload below budget for large files', async () => {
+  const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-knowledge-')));
+  const gsdDir = join(tmp, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+
+  // Build a 200KB KNOWLEDGE with 500 H3 entries all matching 'shared'
+  const entries = Array.from({ length: 500 }, (_, i) =>
+    `### Entry ${i}: shared topic\n${'filler text '.repeat(30)}\n`,
+  ).join('\n');
+  const content = `# Project Knowledge\n\n## Patterns\n\n${entries}`;
+  writeFileSync(join(gsdDir, 'KNOWLEDGE.md'), content);
+
+  const BUDGET_CHARS = 30_000;
+  const result = await inlineKnowledgeBudgeted(tmp, ['shared'], { maxChars: BUDGET_CHARS });
+  assert.ok(result !== null, 'should return content');
+  // Allow some overhead for header formatting, but must stay close to budget
+  assert.ok(
+    result!.length <= BUDGET_CHARS + 500,
+    `payload ${result!.length} chars should be <= budget ${BUDGET_CHARS} (+overhead)`,
+  );
+  // Far smaller than the raw file
+  assert.ok(
+    result!.length < content.length / 4,
+    `payload should be much smaller than full content (${content.length} chars)`,
+  );
+  assert.match(
+    result!,
+    /\[\.\.\.truncated \d+ chars; rerun with narrower scope if needed\]/,
+    'should include truncation note when budget is exceeded',
+  );
+
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test('inlineKnowledgeBudgeted: returns null when no KNOWLEDGE.md exists', async () => {
+  const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-knowledge-')));
+  const gsdDir = join(tmp, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+
+  const result = await inlineKnowledgeBudgeted(tmp, ['database']);
+  assert.strictEqual(result, null);
+
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+test('inlineKnowledgeBudgeted: returns null when no entries match', async () => {
+  const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'gsd-knowledge-')));
+  const gsdDir = join(tmp, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+  writeFileSync(
+    join(gsdDir, 'KNOWLEDGE.md'),
+    '# Project Knowledge\n\n## Patterns\n\n### Database\nuse it\n',
+  );
+
+  const result = await inlineKnowledgeBudgeted(tmp, ['nonexistent']);
+  assert.strictEqual(result, null);
+
+  rmSync(tmp, { recursive: true, force: true });
+});

package/src/resources/extensions/gsd/tests/mcp-client-security.test.ts

@@ -0,0 +1,47 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  _buildMcpChildEnvForTest,
+  _buildMcpTrustConfirmOptionsForTest,
+} from "../../mcp-client/index.ts";
+
+// Note: four source-grep tests that scanned `mcp-client/index.ts` for
+// Map<> shapes, catch-block structure, and closeAll body were removed
+// under #4827. They encoded implementation shape rather than behaviour —
+// any refactor (extracted helper, different Map key type, rearranged
+// cleanup order) broke the greps without a real regression. Runtime
+// coverage of connectServer/closeAll with a mocked failing transport
+// is tracked as a follow-up.
+
+test("MCP stdio child env only includes safe inherited keys plus explicit config env", () => {
+  const previousSecret = process.env.SECRET_MCP_TEST_TOKEN;
+  const previousPath = process.env.PATH;
+  try {
+    process.env.SECRET_MCP_TEST_TOKEN = "should-not-leak";
+    process.env.PATH = "/usr/bin";
+
+    const env = _buildMcpChildEnvForTest({
+      EXPLICIT_TOKEN: "${SECRET_MCP_TEST_TOKEN}",
+      PLAIN_VALUE: "ok",
+    });
+
+    assert.equal(env.PATH, "/usr/bin");
+    assert.equal(env.SECRET_MCP_TEST_TOKEN, undefined);
+    assert.equal(env.EXPLICIT_TOKEN, "should-not-leak");
+    assert.equal(env.PLAIN_VALUE, "ok");
+  } finally {
+    if (previousSecret === undefined) delete process.env.SECRET_MCP_TEST_TOKEN;
+    else process.env.SECRET_MCP_TEST_TOKEN = previousSecret;
+    if (previousPath === undefined) delete process.env.PATH;
+    else process.env.PATH = previousPath;
+  }
+});
+
+test("MCP stdio trust confirmation is abort-aware", () => {
+  const controller = new AbortController();
+  const options = _buildMcpTrustConfirmOptionsForTest(controller.signal);
+
+  assert.equal(options.timeout, 120_000);
+  assert.equal(options.signal, controller.signal);
+});

package/src/resources/extensions/gsd/tests/memory-extractor.test.ts

@@ -1,4 +1,4 @@
-import { parseMemoryResponse, _resetExtractionState, buildMemoryLLMCall } from '../memory-extractor.ts';
+import { parseMemoryResponse, buildMemoryLLMCall } from '../memory-extractor.ts';
 import {
   openDatabase,
   closeDatabase,
@@ -159,16 +159,6 @@ test('integration: mixed action lifecycle', () => {
   closeDatabase();
 });
 
-// ═══════════════════════════════════════════════════════════════════════════
-// memory-extractor: _resetExtractionState
-// ═══════════════════════════════════════════════════════════════════════════
-
-test('memory-extractor: reset extraction state', () => {
-  // Just verify it doesn't throw
-  _resetExtractionState();
-  assert.ok(true, '_resetExtractionState should not throw');
-});
-
 // ═══════════════════════════════════════════════════════════════════════════
 // memory-extractor: buildMemoryLLMCall resolves OAuth API key via modelRegistry
 // Regression test for #2959 — OAuth users had broken memory extraction
@@ -200,8 +190,8 @@ test('memory-extractor: buildMemoryLLMCall resolves API key from modelRegistry f
   assert.ok(llmCallFn !== null, 'buildMemoryLLMCall should return a function when models are available');
 
   // The function should have resolved the API key eagerly via modelRegistry.getApiKey.
-  // Give the async getApiKey a tick to resolve.
-  await new Promise(resolve => setTimeout(resolve, 50));
+  // Await the exposed promise deterministically instead of polling via setTimeout.
+  await llmCallFn!.apiKeyReady;
   assert.ok(getApiKeyCalled, 'buildMemoryLLMCall must call modelRegistry.getApiKey() to resolve OAuth tokens');
 });
 
@@ -246,8 +236,8 @@ test('memory-extractor: buildMemoryLLMCall prefers haiku model', async () => {
   const llmCallFn = buildMemoryLLMCall(ctx);
   assert.ok(llmCallFn !== null, 'should return a function');
 
-  // Wait for the async getApiKey to resolve
-  await new Promise(resolve => setTimeout(resolve, 50));
+  // Await the exposed API-key-ready promise deterministically.
+  await llmCallFn!.apiKeyReady;
   assert.strictEqual(resolvedModelId, 'claude-3-5-haiku-20241022',
     'should resolve API key for haiku model, not sonnet');
 });