gsd-pi 2.77.0 → 2.78.0

package/src/resources/extensions/gsd/tests/session-lock-regression.test.ts

@@ -243,6 +243,35 @@ describe('session-lock-regression', async () => {
     }
   }
 
+  // ─── 7d. Releasing after ownership loss preserves newer owner ─────────
+  test('releaseSessionLock preserves newer owner after PID mismatch', (t) => {
+    const base = mkdtempSync(join(tmpdir(), 'gsd-session-lock-'));
+    mkdirSync(join(base, '.gsd'), { recursive: true });
+    t.after(() => {
+      rmSync(base, { recursive: true, force: true });
+    });
+
+    const acquired = acquireSessionLock(base);
+    assert.ok(acquired.acquired, 'initial lock acquired');
+
+    const lockFile = join(gsdRoot(base), 'auto.lock');
+    const newerOwner = {
+      pid: process.pid + 1000,
+      startedAt: new Date().toISOString(),
+      unitType: 'execute-task',
+      unitId: 'M001/S01/T02',
+      unitStartedAt: new Date().toISOString(),
+    };
+    writeFileSync(lockFile, JSON.stringify(newerOwner, null, 2));
+
+    releaseSessionLock(base);
+
+    assert.ok(existsSync(lockFile), 'foreign lock file must not be deleted by stale owner release');
+    const after = JSON.parse(readFileSync(lockFile, 'utf-8'));
+    assert.deepStrictEqual(after.pid, newerOwner.pid, 'newer owner PID is preserved');
+    assert.deepStrictEqual(after.unitId, newerOwner.unitId, 'newer owner metadata is preserved');
+  });
+
   // ─── 8. Acquire after release is possible ─────────────────────────────
   console.log('\n=== 8. acquire after release → re-acquirable ===');
   {

package/src/resources/extensions/gsd/tests/sidecar-queue.test.ts

@@ -11,6 +11,7 @@ import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { extractSourceRegion } from "./test-helpers.ts";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SESSION_TS_PATH = join(__dirname, "..", "auto", "session.ts");
@@ -52,7 +53,7 @@ test("SidecarItem type is exported from session.ts", () => {
 test("SidecarItem has required kind field with hook/triage/quick-task union", () => {
   const source = getSessionTsSource();
   const ifaceIdx = source.indexOf("export interface SidecarItem");
-  const ifaceBlock = source.slice(ifaceIdx, ifaceIdx + 500);
+  const ifaceBlock = extractSourceRegion(source, "export interface SidecarItem");
   assert.ok(
     ifaceBlock.includes('"hook"') && ifaceBlock.includes('"triage"') && ifaceBlock.includes('"quick-task"'),
     "SidecarItem.kind must be a union of 'hook' | 'triage' | 'quick-task'",
@@ -77,7 +78,7 @@ test("AutoSession resets sidecarQueue in reset()", () => {
   const source = getSessionTsSource();
   const resetIdx = source.indexOf("reset(): void");
   assert.ok(resetIdx > -1, "AutoSession must have a reset() method");
-  const resetBlock = source.slice(resetIdx, resetIdx + 3000);
+  const resetBlock = extractSourceRegion(source, "reset(): void");
   assert.ok(
     resetBlock.includes("sidecarQueue"),
     "reset() must clear sidecarQueue",

package/src/resources/extensions/gsd/tests/silent-catch-diagnostics.test.ts

@@ -6,6 +6,13 @@
  * Two tests:
  * 1. Auto-mode files must have zero empty catch blocks (fully migrated).
  * 2. All GSD files must not use raw stderr/console in catch blocks.
+ *
+ * Implementation note (#4836): the previous implementation walked every
+ * `{` / `}` character in the source to infer catch-block boundaries. That
+ * ignored string literals, template interpolations, regexes, and comments,
+ * producing both false positives and false negatives. The current
+ * implementation uses the TypeScript compiler API to walk real
+ * `CatchClause` nodes, so lexical accidents cannot flip the verdict.
  */
 
 import { describe, test } from "node:test";
@@ -13,6 +20,7 @@ import assert from "node:assert/strict";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join, dirname, relative } from "node:path";
 import { fileURLToPath } from "node:url";
+import ts from "typescript";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const gsdDir = join(__dirname, "..");
@@ -73,12 +81,6 @@ const MIGRATED_FILES = new Set([
   "auto-verification.ts",
 ]);
 
-/** Patterns that indicate a catch block already uses workflow-logger */
-const LOGGER_PATTERNS = [
-  /logWarning\s*\(/,
-  /logError\s*\(/,
-];
-
 function getAutoModeFiles(): string[] {
   const files: string[] = [];
 
@@ -124,103 +126,61 @@ function getGsdSourceFiles(): string[] {
   return files;
 }
 
-/**
- * Scan a file for empty catch blocks — catches whose body contains
- * only whitespace and/or comments but no executable statements.
- */
-function findEmptyCatches(filePath: string): Array<{ line: number; text: string }> {
+function parseSourceFile(filePath: string): ts.SourceFile {
   const content = readFileSync(filePath, "utf-8");
-  const lines = content.split("\n");
-  const results: Array<{ line: number; text: string }> = [];
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-
-    // Match catch block opening
-    if (!/\}\s*catch\s*(\([^)]*\))?\s*\{/.test(line)) continue;
-
-    // Inline single-line catch: } catch { ... }
-    const inlineMatch = line.match(/\}\s*catch\s*(\([^)]*\))?\s*\{(.*)\}\s*;?\s*$/);
-    if (inlineMatch) {
-      const body = inlineMatch[2].trim();
-      const stripped = body.replace(/\/\*.*?\*\//g, "").replace(/\/\/.*/g, "").trim();
-      if (!stripped) {
-        results.push({ line: i + 1, text: line.trim() });
-      }
-      continue;
-    }
-
-    // Multi-line catch — scan until matching }
-    let j = i + 1;
-    let depth = 1;
-    const bodyLines: string[] = [];
-    while (j < lines.length && depth > 0) {
-      for (const ch of lines[j]) {
-        if (ch === "{") depth++;
-        else if (ch === "}") depth--;
-      }
-      bodyLines.push(lines[j].trim());
-      j++;
-    }
+  return ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, /*setParentNodes*/ true, ts.ScriptKind.TS);
+}
 
-    const meaningful = bodyLines.slice(0, -1).filter(
-      (l) => l && !l.startsWith("//") && !l.startsWith("/*") && !l.startsWith("*") && l !== "}",
-    );
+function forEachCatchClause(sf: ts.SourceFile, visit: (cc: ts.CatchClause) => void): void {
+  const walk = (node: ts.Node): void => {
+    if (ts.isCatchClause(node)) visit(node);
+    ts.forEachChild(node, walk);
+  };
+  walk(sf);
+}
 
-    if (meaningful.length === 0) {
-      results.push({ line: i + 1, text: line.trim() });
+/**
+ * A catch block is "empty" if its Block has zero statements. Comments
+ * inside the block are trivia and are not Statement nodes, so a
+ * comment-only body still counts as empty — matching the intent of the
+ * old regex check but without its lexical blind spots.
+ */
+function findEmptyCatches(filePath: string): Array<{ line: number }> {
+  const sf = parseSourceFile(filePath);
+  const results: Array<{ line: number }> = [];
+  forEachCatchClause(sf, (cc) => {
+    if (cc.block.statements.length === 0) {
+      const { line } = sf.getLineAndCharacterOfPosition(cc.getStart(sf));
+      results.push({ line: line + 1 });
     }
-  }
-
+  });
   return results;
 }
 
 /**
- * Scan a file for catch blocks that use raw process.stderr.write or
- * console.error/warn instead of workflow-logger.
+ * A catch block uses "raw stderr/console" if its body text calls
+ * process.stderr.write or console.error/warn *and* does NOT also call
+ * logWarning / logError.
+ *
+ * We test against the block's statement subtree text — derived from the
+ * AST node range, not a naive substring of the whole file — so string
+ * literals outside the block can never leak into the decision.
  */
-function findRawStderrCatches(filePath: string): Array<{ line: number; text: string }> {
-  const content = readFileSync(filePath, "utf-8");
-  const lines = content.split("\n");
-  const results: Array<{ line: number; text: string }> = [];
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (!/\}\s*catch\s*(\([^)]*\))?\s*\{/.test(line)) continue;
-
-    // Inline single-line catch
-    const inlineMatch = line.match(/\}\s*catch\s*(\([^)]*\))?\s*\{(.*)\}\s*;?\s*$/);
-    if (inlineMatch) {
-      const body = inlineMatch[2];
-      if (!LOGGER_PATTERNS.some((p) => p.test(body))) {
-        if (/process\.stderr\.write/.test(body) || /console\.(error|warn)/.test(body)) {
-          results.push({ line: i + 1, text: line.trim() });
-        }
-      }
-      continue;
+function findRawStderrCatches(filePath: string): Array<{ line: number }> {
+  const sf = parseSourceFile(filePath);
+  const results: Array<{ line: number }> = [];
+  forEachCatchClause(sf, (cc) => {
+    const bodyText = cc.block.getText(sf);
+    const usesLogger = /\blogWarning\s*\(|\blogError\s*\(/.test(bodyText);
+    if (usesLogger) return;
+    if (
+      /\bprocess\.stderr\.write\b/.test(bodyText) ||
+      /\bconsole\.(?:error|warn)\b/.test(bodyText)
+    ) {
+      const { line } = sf.getLineAndCharacterOfPosition(cc.getStart(sf));
+      results.push({ line: line + 1 });
     }
-
-    // Multi-line catch
-    let j = i + 1;
-    let depth = 1;
-    const bodyLines: string[] = [];
-    while (j < lines.length && depth > 0) {
-      for (const ch of lines[j]) {
-        if (ch === "{") depth++;
-        else if (ch === "}") depth--;
-      }
-      bodyLines.push(lines[j]);
-      j++;
-    }
-
-    const bodyText = bodyLines.slice(0, -1).join("\n");
-    if (!LOGGER_PATTERNS.some((p) => p.test(bodyText))) {
-      if (/process\.stderr\.write/.test(bodyText) || /console\.(error|warn)/.test(bodyText)) {
-        results.push({ line: i + 1, text: line.trim() });
-      }
-    }
-  }
-
+  });
   return results;
 }
 
@@ -248,7 +208,7 @@ describe("workflow-logger coverage (#3348)", () => {
 
       const empties = findEmptyCatches(file);
       for (const empty of empties) {
-        violations.push(`${rel}:${empty.line} — ${empty.text}`);
+        violations.push(`${rel}:${empty.line}`);
       }
     }
 
@@ -271,7 +231,7 @@ describe("workflow-logger coverage (#3348)", () => {
 
       const issues = findRawStderrCatches(file);
       for (const issue of issues) {
-        violations.push(`${rel}:${issue.line} — ${issue.text}`);
+        violations.push(`${rel}:${issue.line}`);
       }
     }
 

package/src/resources/extensions/gsd/tests/single-writer-v3-tool-surface.test.ts

@@ -0,0 +1,158 @@
+/**
+ * single-writer-v3-tool-surface — Verifies the MCP tool surface that closes
+ * the remaining gaps from .plans/single-writer-engine-v3-control-plane.md:
+ *
+ *   1. The 8 mutating workflow tools (plan/complete/replan/reassess) expose
+ *      actorName + triggerReason as optional schema params, so an agent can
+ *      self-identify (Stream 2: actor identity passthrough).
+ *
+ *   2. The 3 reversibility handlers (reopen-task/slice/milestone) are
+ *      registered as MCP tools with both canonical and alias names
+ *      (Stream 3: reversibility tools).
+ *
+ *   3. The reopen tools accept the documented core params plus optional
+ *      reason/actorName/triggerReason without rejecting valid payloads.
+ */
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { registerDbTools } from "../bootstrap/db-tools.ts";
+import { Value } from "@sinclair/typebox/value";
+
+function makeMockPi() {
+  const tools: any[] = [];
+  return {
+    registerTool: (tool: any) => tools.push(tool),
+    tools,
+  } as any;
+}
+
+const pi = makeMockPi();
+registerDbTools(pi);
+
+function getTool(name: string) {
+  return pi.tools.find((t: any) => t.name === name);
+}
+
+function getRequiredProps(tool: any): string[] {
+  return tool.parameters.required ?? [];
+}
+
+function getProps(tool: any): string[] {
+  return Object.keys(tool.parameters.properties ?? {});
+}
+
+// ─── Stream 2: actor identity exposure on 8 mutating workflow tools ─────────
+
+const ACTOR_TOOLS = [
+  "gsd_plan_milestone",
+  "gsd_plan_slice",
+  "gsd_plan_task",
+  "gsd_task_complete",
+  "gsd_slice_complete",
+  "gsd_complete_milestone",
+  "gsd_replan_slice",
+  "gsd_reassess_roadmap",
+];
+
+for (const name of ACTOR_TOOLS) {
+  test(`${name} — exposes actorName and triggerReason as optional`, () => {
+    const tool = getTool(name);
+    assert.ok(tool, `${name} must be registered`);
+
+    const props = new Set(getProps(tool));
+    const required = new Set(getRequiredProps(tool));
+
+    assert.ok(props.has("actorName"), `${name} must expose actorName param`);
+    assert.ok(props.has("triggerReason"), `${name} must expose triggerReason param`);
+    assert.ok(!required.has("actorName"), `${name}.actorName must be optional`);
+    assert.ok(!required.has("triggerReason"), `${name}.triggerReason must be optional`);
+  });
+}
+
+// ─── Stream 3: reopen tools registered with canonical + alias names ─────────
+
+const REOPEN_TOOLS = [
+  { canonical: "gsd_task_reopen", alias: "gsd_reopen_task" },
+  { canonical: "gsd_slice_reopen", alias: "gsd_reopen_slice" },
+  { canonical: "gsd_milestone_reopen", alias: "gsd_reopen_milestone" },
+];
+
+for (const { canonical, alias } of REOPEN_TOOLS) {
+  test(`${canonical} — registered with alias ${alias}`, () => {
+    const canonicalTool = getTool(canonical);
+    const aliasTool = getTool(alias);
+    assert.ok(canonicalTool, `${canonical} must be registered`);
+    assert.ok(aliasTool, `${alias} must be registered as alias`);
+    assert.ok(typeof canonicalTool.execute === "function", `${canonical} must have an execute function`);
+    assert.ok(typeof aliasTool.execute === "function", `${alias} must have an execute function`);
+  });
+}
+
+// ─── Reopen tool schemas accept minimal core params ──────────────────────────
+
+test("gsd_task_reopen — validates with only milestoneId/sliceId/taskId", () => {
+  const tool = getTool("gsd_task_reopen");
+  assert.ok(tool);
+  const minimal = { milestoneId: "M001", sliceId: "S01", taskId: "T01" };
+  const errors = [...Value.Errors(tool.parameters, minimal)];
+  assert.strictEqual(errors.length, 0, `core params should validate; got: ${errors.map(e => `${e.path}: ${e.message}`).join(", ")}`);
+});
+
+test("gsd_task_reopen — accepts reason + actor fields", () => {
+  const tool = getTool("gsd_task_reopen");
+  assert.ok(tool);
+  const full = {
+    milestoneId: "M001",
+    sliceId: "S01",
+    taskId: "T01",
+    reason: "regression discovered",
+    actorName: "executor-01",
+    triggerReason: "post-completion verification failure",
+  };
+  const errors = [...Value.Errors(tool.parameters, full)];
+  assert.strictEqual(errors.length, 0, `full payload should validate; got: ${errors.map(e => `${e.path}: ${e.message}`).join(", ")}`);
+});
+
+test("gsd_slice_reopen — validates with only milestoneId/sliceId", () => {
+  const tool = getTool("gsd_slice_reopen");
+  assert.ok(tool);
+  const minimal = { milestoneId: "M001", sliceId: "S01" };
+  const errors = [...Value.Errors(tool.parameters, minimal)];
+  assert.strictEqual(errors.length, 0, `core params should validate; got: ${errors.map(e => `${e.path}: ${e.message}`).join(", ")}`);
+});
+
+test("gsd_milestone_reopen — validates with only milestoneId", () => {
+  const tool = getTool("gsd_milestone_reopen");
+  assert.ok(tool);
+  const minimal = { milestoneId: "M001" };
+  const errors = [...Value.Errors(tool.parameters, minimal)];
+  assert.strictEqual(errors.length, 0, `core params should validate; got: ${errors.map(e => `${e.path}: ${e.message}`).join(", ")}`);
+});
+
+// ─── MCP_WORKFLOW_TOOL_SURFACE includes the reopen tools ─────────────────────
+
+test("workflow MCP surface includes the reopen tools", async () => {
+  const { getWorkflowTransportSupportError } = await import("../workflow-mcp.ts");
+  // The error builder reports tools that are required-but-missing from the surface.
+  // If the reopen tools are missing from the surface, the error message will list them.
+  // We probe by asking for a "claude-code" provider (which uses externalCli + local://)
+  // with our reopen tools as required, and assert the surface has them.
+  const err = getWorkflowTransportSupportError(
+    "claude-code",
+    ["gsd_task_reopen", "gsd_slice_reopen", "gsd_milestone_reopen"],
+    { authMode: "externalCli", baseUrl: "local://test" },
+  );
+
+  // err is null when surface satisfies required tools, OR a non-null error mentioning
+  // unrelated infra setup (like "workflow MCP server not configured"). Either way,
+  // the error must NOT name our three reopen tools as missing from the surface.
+  if (err !== null) {
+    assert.ok(
+      !err.includes("gsd_task_reopen") &&
+      !err.includes("gsd_slice_reopen") &&
+      !err.includes("gsd_milestone_reopen"),
+      `surface should include all three reopen tools, but error reports them missing: ${err}`,
+    );
+  }
+});

package/src/resources/extensions/gsd/tests/skill-activation.test.ts

@@ -4,7 +4,13 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { loadSkills } from "@gsd/pi-coding-agent";
-import { buildSkillActivationBlock } from "../auto-prompts.js";
+import {
+  buildPlanMilestonePrompt,
+  buildResearchMilestonePrompt,
+  buildSkillActivationBlock,
+} from "../auto-prompts.js";
+import { warnIfManifestHasMissingSkills } from "../skill-manifest.js";
+import { _resetLogs, drainLogs, setStderrLoggingEnabled } from "../workflow-logger.js";
 import type { GSDPreferences } from "../preferences.js";
 
 function makeTempBase(): string {
@@ -25,6 +31,11 @@ function loadOnlyTestSkills(base: string): void {
   loadSkills({ cwd: base, includeDefaults: false, skillPaths: [join(base, "skills")] });
 }
 
+function writeProjectPreferences(base: string, preferences: string): void {
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  writeFileSync(join(base, ".gsd", "PREFERENCES.md"), `---\n${preferences}---\n`);
+}
+
 function buildBlock(
   base: string,
   params: Partial<Parameters<typeof buildSkillActivationBlock>[0]> = {},
@@ -231,3 +242,111 @@ test("buildSkillActivationBlock allows valid skill names and rejects invalid one
     cleanup(base);
   }
 });
+
+// ─── Per-unit-type skill manifest (RFC #4779) ─────────────────────────────────
+
+test("buildSkillActivationBlock: explicit always_use_skills bypass the unit-type manifest", () => {
+  const base = makeTempBase();
+  try {
+    // write-docs is in the research-milestone manifest; swiftui is not.
+    // Both are in always_use_skills — a user-explicit source — so BOTH
+    // should activate regardless of the manifest. User intent wins over
+    // unit-type defaults. See RFC #4779 and skill-manifest.ts rationale.
+    writeSkill(base, "write-docs", "Use when writing docs or RFCs.");
+    writeSkill(base, "swiftui", "Use for SwiftUI views.");
+    loadOnlyTestSkills(base);
+
+    const result = buildBlock(base, { unitType: "research-milestone" }, {
+      always_use_skills: ["write-docs", "swiftui"],
+    });
+
+    assert.match(result, /Call Skill\(\{ skill: 'write-docs' \}\)/);
+    assert.match(result, /Call Skill\(\{ skill: 'swiftui' \}\)/);
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("buildSkillActivationBlock falls through to all skills for unknown unit type", () => {
+  const base = makeTempBase();
+  try {
+    writeSkill(base, "swiftui", "Use for SwiftUI views.");
+    loadOnlyTestSkills(base);
+
+    const result = buildBlock(base, { unitType: "unknown-unit-type" }, {
+      always_use_skills: ["swiftui"],
+    });
+
+    // Unknown unit type = wildcard fallback (pre-manifest behavior).
+    assert.match(result, /Call Skill\(\{ skill: 'swiftui' \}\)/);
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("buildSkillActivationBlock without unitType preserves pre-manifest behavior", () => {
+  const base = makeTempBase();
+  try {
+    writeSkill(base, "swiftui", "Use for SwiftUI views.");
+    loadOnlyTestSkills(base);
+
+    // No unitType param — filter should no-op.
+    const result = buildBlock(base, {}, {
+      always_use_skills: ["swiftui"],
+    });
+
+    assert.match(result, /Call Skill\(\{ skill: 'swiftui' \}\)/);
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("milestone prompt builders propagate always_use_skills through buildSkillActivationBlock", async () => {
+  const base = makeTempBase();
+  try {
+    // Both skills are in always_use_skills — explicit user intent bypasses
+    // the unit-type manifest, so both activate in both milestone flows.
+    writeSkill(base, "write-docs", "Use when writing docs or RFCs.");
+    writeSkill(base, "swiftui", "Use for SwiftUI views.");
+    writeProjectPreferences(base, "always_use_skills:\n  - write-docs\n  - swiftui\n");
+    loadOnlyTestSkills(base);
+
+    const researchPrompt = await buildResearchMilestonePrompt("M001", "Test", base);
+    assert.match(researchPrompt, /Call Skill\(\{ skill: 'write-docs' \}\)/);
+    assert.match(researchPrompt, /Call Skill\(\{ skill: 'swiftui' \}\)/);
+
+    const planPrompt = await buildPlanMilestonePrompt("M001", "Test", base);
+    assert.match(planPrompt, /Call Skill\(\{ skill: 'write-docs' \}\)/);
+    assert.match(planPrompt, /Call Skill\(\{ skill: 'swiftui' \}\)/);
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("skill manifest strict warnings require GSD_SKILL_MANIFEST_STRICT=1", (t) => {
+  const previousStrict = process.env.GSD_SKILL_MANIFEST_STRICT;
+  const previousStderr = setStderrLoggingEnabled(false);
+  t.after(() => {
+    if (previousStrict === undefined) {
+      delete process.env.GSD_SKILL_MANIFEST_STRICT;
+    } else {
+      process.env.GSD_SKILL_MANIFEST_STRICT = previousStrict;
+    }
+    setStderrLoggingEnabled(previousStderr);
+    _resetLogs();
+  });
+
+  process.env.GSD_SKILL_MANIFEST_STRICT = "0";
+  _resetLogs();
+  warnIfManifestHasMissingSkills("research-milestone", new Set());
+  assert.equal(drainLogs().length, 0, "strict=0 must preserve silent behavior");
+
+  process.env.GSD_SKILL_MANIFEST_STRICT = "1";
+  _resetLogs();
+  warnIfManifestHasMissingSkills("research-milestone", new Set());
+  const logs = drainLogs();
+  assert.ok(
+    logs.some(log => log.message.includes("skill-manifest: references uninstalled skill")),
+    "strict=1 should warn about missing manifest entries",
+  );
+});

package/src/resources/extensions/gsd/tests/skill-manifest.test.ts

@@ -0,0 +1,112 @@
+// GSD2 + skill-manifest.test — unit coverage for the skill manifest resolver
+//
+// Focused tests for `resolveSkillManifest` and `filterSkillsByManifest`.
+// Covers the wildcard semantics, the newly seeded unit-type entries
+// (complete-milestone, validate-milestone, reassess-roadmap, research-slice,
+// plan-slice, refine-slice, replan-slice, run-uat), and the deliberate
+// wildcard fallback for the execute-task hot path (RFC #4779).
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  resolveSkillManifest,
+  filterSkillsByManifest,
+} from "../skill-manifest.js";
+
+const NEWLY_WIRED_UNIT_TYPES = [
+  "complete-milestone",
+  "validate-milestone",
+  "reassess-roadmap",
+  "research-slice",
+  "plan-slice",
+  "refine-slice",
+  "replan-slice",
+  "run-uat",
+] as const;
+
+test("resolveSkillManifest returns null for undefined unit type (wildcard)", () => {
+  assert.equal(resolveSkillManifest(undefined), null);
+});
+
+test("resolveSkillManifest returns null for unknown unit types (wildcard fallback)", () => {
+  assert.equal(resolveSkillManifest("nonexistent-unit-type"), null);
+});
+
+test("resolveSkillManifest returns null for execute-task (intentional wildcard)", () => {
+  // execute-task is the implementation hot path; allowlisting it requires
+  // per-task skill hints from task-plan frontmatter. Documented in
+  // skill-manifest.ts — regression guard.
+  assert.equal(resolveSkillManifest("execute-task"), null);
+});
+
+for (const unitType of NEWLY_WIRED_UNIT_TYPES) {
+  test(`resolveSkillManifest returns a non-empty allowlist for '${unitType}'`, () => {
+    const allowlist = resolveSkillManifest(unitType);
+    assert.ok(allowlist !== null, `${unitType} should resolve to an allowlist, not wildcard`);
+    assert.ok(allowlist.length > 0, `${unitType} allowlist should not be empty`);
+    // Every entry must be lowercase (normalized).
+    for (const name of allowlist) {
+      assert.equal(name, name.toLowerCase(), `${unitType} entry '${name}' should be lowercase`);
+    }
+  });
+}
+
+test("resolveSkillManifest: slice-level manifests include decompose-into-slices", () => {
+  // Planning-shaped slice flows all benefit from the decomposition skill.
+  // Sanity-check a representative entry from each.
+  for (const unitType of ["research-slice", "plan-slice", "refine-slice", "replan-slice"] as const) {
+    const allowlist = resolveSkillManifest(unitType);
+    assert.ok(
+      allowlist?.includes("decompose-into-slices"),
+      `${unitType} should list decompose-into-slices`,
+    );
+  }
+});
+
+test("resolveSkillManifest: validation / completion flows include verify-before-complete", () => {
+  for (const unitType of ["complete-milestone", "validate-milestone", "run-uat"] as const) {
+    const allowlist = resolveSkillManifest(unitType);
+    assert.ok(
+      allowlist?.includes("verify-before-complete"),
+      `${unitType} should list verify-before-complete`,
+    );
+  }
+});
+
+test("filterSkillsByManifest: pass-through when unit type is unknown", () => {
+  const skills = [{ name: "swiftui" }, { name: "solidity-security" }];
+  const result = filterSkillsByManifest(skills, "nonexistent-unit-type");
+  assert.deepEqual(result, skills);
+});
+
+test("filterSkillsByManifest: pass-through when unitType is undefined", () => {
+  const skills = [{ name: "swiftui" }];
+  const result = filterSkillsByManifest(skills, undefined);
+  assert.deepEqual(result, skills);
+});
+
+test("filterSkillsByManifest: restricts to allowlisted names for known unit type", () => {
+  // research-slice allowlists include decompose-into-slices but not swiftui.
+  const skills = [
+    { name: "decompose-into-slices" },
+    { name: "swiftui" },
+    { name: "write-docs" },
+  ];
+  const result = filterSkillsByManifest(skills, "research-slice");
+  const names = result.map(s => s.name);
+  assert.ok(names.includes("decompose-into-slices"));
+  assert.ok(names.includes("write-docs"));
+  assert.ok(!names.includes("swiftui"));
+});
+
+test("filterSkillsByManifest: matching is case-insensitive via normalize", () => {
+  const skills = [
+    { name: "Write-Docs" }, // different case from manifest entry
+    { name: "SWIFTUI" },
+  ];
+  const result = filterSkillsByManifest(skills, "research-milestone");
+  const names = result.map(s => s.name);
+  assert.ok(names.includes("Write-Docs"));
+  assert.ok(!names.includes("SWIFTUI"));
+});