gsd-pi 2.78.0 → 2.78.1-dev.2d3fd6e71

package/src/resources/extensions/gsd/tests/commands-eval-review.test.ts

@@ -0,0 +1,612 @@
+/**
+ * Unit tests for `/gsd eval-review` (commands-eval-review.ts).
+ *
+ * Each prior review finding is paired with a regression test that asserts
+ * the documented fix behavior. Tests are organized one `describe` per
+ * exported function, with the regression-test cases marked in their `it`
+ * descriptions.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+
+import {
+  EvalReviewArgError,
+  MAX_CONTEXT_BYTES,
+  SLICE_ID_PATTERN,
+  buildEvalReviewContext,
+  buildEvalReviewPrompt,
+  detectEvalReviewState,
+  evalReviewWritePath,
+  findEvalReviewFile,
+  parseEvalReviewArgs,
+  planEvalReviewAction,
+  type EvalReviewArgs,
+  type EvalReviewState,
+} from "../commands-eval-review.js";
+import { GSD_COMMAND_DESCRIPTION, TOP_LEVEL_SUBCOMMANDS } from "../commands/catalog.js";
+import { _clearGsdRootCache } from "../paths.js";
+
+// ─── parseEvalReviewArgs ──────────────────────────────────────────────────────
+
+describe("parseEvalReviewArgs", () => {
+  it("parses a bare slice ID", () => {
+    const result = parseEvalReviewArgs("S07");
+    assert.equal(result.sliceId, "S07");
+    assert.equal(result.force, false);
+    assert.equal(result.show, false);
+  });
+
+  it("recognizes --force", () => {
+    const result = parseEvalReviewArgs("S07 --force");
+    assert.equal(result.force, true);
+  });
+
+  it("recognizes --show", () => {
+    const result = parseEvalReviewArgs("S07 --show");
+    assert.equal(result.show, true);
+  });
+
+  it("treats flag order as irrelevant", () => {
+    const result = parseEvalReviewArgs("--force S07 --show");
+    assert.equal(result.sliceId, "S07");
+    assert.equal(result.force, true);
+    assert.equal(result.show, true);
+  });
+
+  it("collapses multiple whitespace separators", () => {
+    const result = parseEvalReviewArgs("   S07    --force  ");
+    assert.equal(result.sliceId, "S07");
+    assert.equal(result.force, true);
+  });
+
+  it("throws when the slice ID is missing entirely", () => {
+    assert.throws(() => parseEvalReviewArgs(""), EvalReviewArgError);
+    assert.throws(() => parseEvalReviewArgs("   "), EvalReviewArgError);
+    assert.throws(() => parseEvalReviewArgs("--force"), EvalReviewArgError);
+  });
+
+  it("throws on an unknown --* token (regression: --force-wipe must not be silently stripped)", () => {
+    assert.throws(() => parseEvalReviewArgs("S07 --force-wipe"), EvalReviewArgError);
+  });
+
+  it("throws on multiple slice IDs", () => {
+    assert.throws(() => parseEvalReviewArgs("S07 S08"), EvalReviewArgError);
+  });
+
+  it("rejects path-traversal in the slice ID (regression: path-traversal blocker)", () => {
+    assert.throws(() => parseEvalReviewArgs("../../etc/passwd"), EvalReviewArgError);
+    assert.throws(() => parseEvalReviewArgs("S01/../../"), EvalReviewArgError);
+    assert.throws(() => parseEvalReviewArgs("S01/.."), EvalReviewArgError);
+  });
+
+  it("rejects backslash separators in the slice ID", () => {
+    assert.throws(() => parseEvalReviewArgs("S01\\..\\..\\etc"), EvalReviewArgError);
+  });
+
+  it("rejects null bytes in the slice ID", () => {
+    assert.throws(() => parseEvalReviewArgs("S01\0"), EvalReviewArgError);
+  });
+
+  it("rejects unicode look-alikes (Cyrillic Ѕ)", () => {
+    // U+0405 (Cyrillic capital S) ≠ U+0053 (Latin capital S)
+    assert.throws(() => parseEvalReviewArgs("Ѕ" + "01"), EvalReviewArgError);
+  });
+
+  it("rejects lowercase 's' prefix", () => {
+    assert.throws(() => parseEvalReviewArgs("s01"), EvalReviewArgError);
+  });
+
+  it("rejects ID without trailing digits", () => {
+    assert.throws(() => parseEvalReviewArgs("S"), EvalReviewArgError);
+    assert.throws(() => parseEvalReviewArgs("Sabc"), EvalReviewArgError);
+  });
+
+  it("accepts multi-digit slice IDs", () => {
+    assert.equal(parseEvalReviewArgs("S100").sliceId, "S100");
+  });
+});
+
+// ─── SLICE_ID_PATTERN export ──────────────────────────────────────────────────
+
+describe("SLICE_ID_PATTERN", () => {
+  it("matches the canonical /^S\\d+$/ shape used elsewhere in the gsd extension", () => {
+    assert.ok(SLICE_ID_PATTERN.test("S01"));
+    assert.ok(SLICE_ID_PATTERN.test("S99"));
+    assert.ok(!SLICE_ID_PATTERN.test("s01"));
+    assert.ok(!SLICE_ID_PATTERN.test("S"));
+    assert.ok(!SLICE_ID_PATTERN.test("S01a"));
+    assert.ok(!SLICE_ID_PATTERN.test("../S01"));
+  });
+});
+
+// ─── detectEvalReviewState ────────────────────────────────────────────────────
+
+describe("detectEvalReviewState", () => {
+  let basePath: string;
+
+  beforeEach(() => {
+    basePath = join(tmpdir(), `gsd-eval-review-test-${randomUUID()}`);
+    mkdirSync(basePath, { recursive: true });
+  });
+
+  afterEach(() => {
+    _clearGsdRootCache();
+    rmSync(basePath, { recursive: true, force: true });
+  });
+
+  function setupSliceLayout(sliceFiles: Record<string, string>): void {
+    const sliceDir = join(basePath, ".gsd", "milestones", "M001", "slices", "S07");
+    mkdirSync(sliceDir, { recursive: true });
+    for (const [filename, content] of Object.entries(sliceFiles)) {
+      writeFileSync(join(sliceDir, filename), content, "utf-8");
+    }
+  }
+
+  it("returns no-slice-dir when the slice directory is missing (regression: no-slice-dir vs no-summary must be distinct states)", () => {
+    mkdirSync(join(basePath, ".gsd", "milestones", "M001", "slices"), { recursive: true });
+    const result = detectEvalReviewState(
+      { sliceId: "S07", force: false, show: false },
+      basePath,
+      "M001",
+    );
+    assert.equal(result.kind, "no-slice-dir");
+    if (result.kind === "no-slice-dir") {
+      assert.equal(result.sliceId, "S07");
+      assert.ok(result.expectedDir.includes("S07"));
+    }
+  });
+
+  it("returns no-summary when the slice directory exists but SUMMARY.md is missing", () => {
+    setupSliceLayout({});
+    const result = detectEvalReviewState(
+      { sliceId: "S07", force: false, show: false },
+      basePath,
+      "M001",
+    );
+    assert.equal(result.kind, "no-summary");
+  });
+
+  it("returns no-summary with specPath populated when only AI-SPEC.md is present", () => {
+    setupSliceLayout({ "S07-AI-SPEC.md": "# spec" });
+    const result = detectEvalReviewState(
+      { sliceId: "S07", force: false, show: false },
+      basePath,
+      "M001",
+    );
+    assert.equal(result.kind, "no-summary");
+    if (result.kind === "no-summary") {
+      assert.ok(result.specPath?.endsWith("S07-AI-SPEC.md"));
+    }
+  });
+
+  it("returns ready when SUMMARY.md is present, with specPath null when AI-SPEC.md is absent", () => {
+    setupSliceLayout({ "S07-SUMMARY.md": "# summary" });
+    const result = detectEvalReviewState(
+      { sliceId: "S07", force: false, show: false },
+      basePath,
+      "M001",
+    );
+    assert.equal(result.kind, "ready");
+    if (result.kind === "ready") {
+      assert.ok(result.summaryPath.endsWith("S07-SUMMARY.md"));
+      assert.equal(result.specPath, null);
+    }
+  });
+
+  it("returns ready with both paths populated when both files exist", () => {
+    setupSliceLayout({
+      "S07-SUMMARY.md": "# summary",
+      "S07-AI-SPEC.md": "# spec",
+    });
+    const result = detectEvalReviewState(
+      { sliceId: "S07", force: false, show: false },
+      basePath,
+      "M001",
+    );
+    assert.equal(result.kind, "ready");
+    if (result.kind === "ready") {
+      assert.ok(result.summaryPath.endsWith("S07-SUMMARY.md"));
+      assert.ok(result.specPath?.endsWith("S07-AI-SPEC.md"));
+    }
+  });
+});
+
+// ─── buildEvalReviewContext ───────────────────────────────────────────────────
+
+describe("buildEvalReviewContext", () => {
+  let basePath: string;
+  let sliceDir: string;
+
+  beforeEach(() => {
+    basePath = join(tmpdir(), `gsd-eval-ctx-test-${randomUUID()}`);
+    sliceDir = join(basePath, ".gsd", "milestones", "M001", "slices", "S07");
+    mkdirSync(sliceDir, { recursive: true });
+    process.chdir(basePath);
+  });
+
+  afterEach(() => {
+    _clearGsdRootCache();
+    process.chdir(tmpdir());
+    rmSync(basePath, { recursive: true, force: true });
+  });
+
+  function fakeReady(opts: {
+    summaryBytes?: number;
+    specBytes?: number | null;
+  } = {}): Extract<EvalReviewState, { kind: "ready" }> {
+    const summaryPath = join(sliceDir, "S07-SUMMARY.md");
+    writeFileSync(summaryPath, "S".repeat(opts.summaryBytes ?? 512), "utf-8");
+
+    let specPath: string | null = null;
+    if (opts.specBytes != null) {
+      specPath = join(sliceDir, "S07-AI-SPEC.md");
+      writeFileSync(specPath, "P".repeat(opts.specBytes), "utf-8");
+    }
+
+    return {
+      kind: "ready",
+      sliceId: "S07",
+      sliceDir,
+      summaryPath,
+      specPath,
+    };
+  }
+
+  it("inlines SUMMARY without truncation when under the cap", async () => {
+    const state = fakeReady({ summaryBytes: 1024 });
+    const ctx = await buildEvalReviewContext(state, "M001", () => new Date("2026-04-28T14:00:00Z"));
+    assert.equal(ctx.truncated, false);
+    assert.equal(ctx.summary.length, 1024);
+    assert.equal(ctx.spec, null);
+    assert.equal(ctx.generatedAt, "2026-04-28T14:00:00Z");
+  });
+
+  it("truncates SUMMARY when it alone exceeds the cap (regression: prompt-size cap)", async () => {
+    const state = fakeReady({ summaryBytes: MAX_CONTEXT_BYTES + 4096 });
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, true);
+    assert.ok(ctx.summary.includes("[truncated:"));
+    assert.equal(ctx.spec, null, "no budget for spec when summary alone exceeds cap");
+  });
+
+  it("inlines both SUMMARY and SPEC when their combined bytes fit", async () => {
+    const state = fakeReady({ summaryBytes: 1024, specBytes: 2048 });
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, false);
+    assert.equal(ctx.summary.length, 1024);
+    assert.equal(ctx.spec?.length, 2048);
+  });
+
+  it("truncates SPEC to the residual budget when SUMMARY is large", async () => {
+    const summaryBytes = MAX_CONTEXT_BYTES - 1024;
+    const specBytes = 8 * 1024;
+    const state = fakeReady({ summaryBytes, specBytes });
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, true);
+    assert.ok(ctx.spec?.includes("[truncated:"));
+  });
+
+  it("returns spec=null when no AI-SPEC.md exists (best-practices audit mode)", async () => {
+    const state = fakeReady({ summaryBytes: 256 });
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.spec, null);
+  });
+
+  it("emits a spec-elision marker when SUMMARY consumed the entire byte budget", async () => {
+    const state = fakeReady({ summaryBytes: MAX_CONTEXT_BYTES, specBytes: 1024 });
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, true);
+    assert.ok(ctx.spec?.includes("[truncated:"));
+    assert.ok(ctx.spec?.toLowerCase().includes("ai-spec"));
+  });
+
+  it("degrades to a marker (not a throw) when AI-SPEC.md read fails — spec is optional", async () => {
+    const state = fakeReady({ summaryBytes: 512, specBytes: 256 });
+    rmSync(state.specPath!);
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, true);
+    assert.ok(ctx.spec?.includes("[truncated:"));
+    assert.ok(ctx.spec?.toLowerCase().includes("failed to read"));
+  });
+
+  it("does not emit a U+FFFD replacement character when the cap falls mid multi-byte UTF-8 sequence", async () => {
+    const path = join(sliceDir, "S07-SUMMARY.md");
+    const filler = "x".repeat(MAX_CONTEXT_BYTES - 1);
+    const fourByteCodepoint = "\u{1F600}";
+    writeFileSync(path, filler + fourByteCodepoint, "utf-8");
+    const state: Extract<EvalReviewState, { kind: "ready" }> = {
+      kind: "ready",
+      sliceId: "S07",
+      sliceDir,
+      summaryPath: path,
+      specPath: null,
+    };
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, true);
+    assert.ok(!ctx.summary.includes("\u{FFFD}"), "must not contain replacement char at the truncation boundary");
+  });
+
+  it("keeps total summary+spec byte length within MAX_CONTEXT_BYTES under truncation", async () => {
+    const summaryPath = join(sliceDir, "S07-SUMMARY.md");
+    const specPath = join(sliceDir, "S07-AI-SPEC.md");
+    writeFileSync(summaryPath, "S".repeat(MAX_CONTEXT_BYTES * 2), "utf-8");
+    writeFileSync(specPath, "P".repeat(MAX_CONTEXT_BYTES * 2), "utf-8");
+    const state: Extract<EvalReviewState, { kind: "ready" }> = {
+      kind: "ready",
+      sliceId: "S07",
+      sliceDir,
+      summaryPath,
+      specPath,
+    };
+    const ctx = await buildEvalReviewContext(state, "M001");
+    const summaryBytes = Buffer.byteLength(ctx.summary, "utf-8");
+    const specBytes = ctx.spec ? Buffer.byteLength(ctx.spec, "utf-8") : 0;
+    assert.ok(
+      summaryBytes + specBytes <= MAX_CONTEXT_BYTES,
+      `total ${summaryBytes + specBytes} must not exceed cap ${MAX_CONTEXT_BYTES}`,
+    );
+    assert.ok(ctx.summary.includes("[truncated:"));
+  });
+
+  it("keeps single-file truncation within maxBytes (regression: marker bytes count toward cap)", async () => {
+    const summaryPath = join(sliceDir, "S07-SUMMARY.md");
+    writeFileSync(summaryPath, "S".repeat(MAX_CONTEXT_BYTES * 2), "utf-8");
+    const state: Extract<EvalReviewState, { kind: "ready" }> = {
+      kind: "ready",
+      sliceId: "S07",
+      sliceDir,
+      summaryPath,
+      specPath: null,
+    };
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, true);
+    const totalBytes = Buffer.byteLength(ctx.summary, "utf-8");
+    assert.ok(totalBytes <= MAX_CONTEXT_BYTES, `${totalBytes} > ${MAX_CONTEXT_BYTES}`);
+    assert.ok(ctx.summary.includes("[truncated:"));
+  });
+
+  it("populates outputPath using the canonical slice file naming", async () => {
+    const state = fakeReady({ summaryBytes: 64 });
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.ok(ctx.outputPath.endsWith("S07-EVAL-REVIEW.md"));
+  });
+
+  it("emits the short fallback marker when AI-SPEC read fails with a verbose error", async () => {
+    const state = fakeReady({ summaryBytes: MAX_CONTEXT_BYTES - 80, specBytes: 256 });
+    rmSync(state.specPath!);
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, true);
+    assert.ok(ctx.spec, "spec must surface as a marker, not null");
+    assert.ok(ctx.spec!.includes("[truncated:"));
+    assert.ok(Buffer.byteLength(ctx.summary, "utf-8") + Buffer.byteLength(ctx.spec!, "utf-8") <= MAX_CONTEXT_BYTES);
+  });
+
+  it("does not load the full file into memory beyond the cap (regression: streaming readCapped)", async () => {
+    const summaryPath = join(sliceDir, "S07-SUMMARY.md");
+    const giant = MAX_CONTEXT_BYTES * 8;
+    writeFileSync(summaryPath, "S".repeat(giant), "utf-8");
+    const state: Extract<EvalReviewState, { kind: "ready" }> = {
+      kind: "ready",
+      sliceId: "S07",
+      sliceDir,
+      summaryPath,
+      specPath: null,
+    };
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, true);
+    assert.ok(Buffer.byteLength(ctx.summary, "utf-8") <= MAX_CONTEXT_BYTES);
+    assert.ok(ctx.summary.includes("bytes elided to fit eval-review context cap"));
+  });
+
+  it("does not pre-reserve spec budget when no AI-SPEC.md exists", async () => {
+    const summaryBytes = MAX_CONTEXT_BYTES - 64;
+    const state = fakeReady({ summaryBytes });
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.equal(ctx.truncated, false, "summary must fit without truncation when no spec is reserved");
+    assert.equal(Buffer.byteLength(ctx.summary, "utf-8"), summaryBytes);
+    assert.equal(ctx.spec, null);
+  });
+
+  it("includes a small AI-SPEC even when remaining is below MIN_USEFUL_SPEC_BYTES", async () => {
+    const summaryBytes = MAX_CONTEXT_BYTES - 200;
+    const specBytes = 100;
+    const state = fakeReady({ summaryBytes, specBytes });
+    const ctx = await buildEvalReviewContext(state, "M001");
+    assert.ok(ctx.spec, "spec must be inlined when it actually fits");
+    assert.equal(Buffer.byteLength(ctx.spec!, "utf-8"), specBytes);
+    assert.ok(!ctx.spec!.includes("[truncated:"), "small spec must not be replaced by a marker");
+  });
+});
+
+// ─── evalReviewWritePath ──────────────────────────────────────────────────────
+
+describe("evalReviewWritePath", () => {
+  it("computes the canonical write path purely from inputs", () => {
+    const sliceDir = join("/repo", ".gsd", "milestones", "M001", "slices", "S07");
+    const expected = join(sliceDir, "S07-EVAL-REVIEW.md");
+    assert.equal(evalReviewWritePath(sliceDir, "S07"), expected);
+  });
+
+  it("does not touch the filesystem", () => {
+    const sliceDir = join("/nonexistent", "path", "abc");
+    const result = evalReviewWritePath(sliceDir, "S99");
+    assert.ok(result.endsWith("S99-EVAL-REVIEW.md"));
+  });
+});
+
+// ─── findEvalReviewFile ───────────────────────────────────────────────────────
+
+describe("findEvalReviewFile", () => {
+  let basePath: string;
+
+  beforeEach(() => {
+    basePath = join(tmpdir(), `gsd-find-eval-${randomUUID()}`);
+    mkdirSync(join(basePath, ".gsd", "milestones", "M001", "slices", "S07"), { recursive: true });
+  });
+
+  afterEach(() => {
+    _clearGsdRootCache();
+    rmSync(basePath, { recursive: true, force: true });
+  });
+
+  it("returns null when EVAL-REVIEW.md is absent", () => {
+    assert.equal(findEvalReviewFile(basePath, "M001", "S07"), null);
+  });
+
+  it("returns the absolute path when EVAL-REVIEW.md is present", () => {
+    const target = join(basePath, ".gsd", "milestones", "M001", "slices", "S07", "S07-EVAL-REVIEW.md");
+    writeFileSync(target, "---\nschema: eval-review/v1\n---\n", "utf-8");
+    const found = findEvalReviewFile(basePath, "M001", "S07");
+    assert.equal(found, target);
+  });
+});
+
+// ─── planEvalReviewAction ─────────────────────────────────────────────────────
+
+describe("planEvalReviewAction", () => {
+  function args(overrides: Partial<EvalReviewArgs> = {}): EvalReviewArgs {
+    return { sliceId: "S07", force: false, show: false, ...overrides };
+  }
+  const noSliceDir: EvalReviewState = { kind: "no-slice-dir", sliceId: "S07", expectedDir: "/tmp/x" };
+  const noSummary: EvalReviewState = { kind: "no-summary", sliceId: "S07", sliceDir: "/tmp/x", specPath: null };
+  const ready: EvalReviewState = { kind: "ready", sliceId: "S07", sliceDir: "/tmp/x", summaryPath: "/tmp/x/SUMMARY.md", specPath: null };
+
+  it("returns no-slice-dir before checking show or anything else", () => {
+    assert.equal(planEvalReviewAction(args({ show: true }), noSliceDir, "/tmp/r.md").kind, "no-slice-dir");
+    assert.equal(planEvalReviewAction(args({ force: true }), noSliceDir, null).kind, "no-slice-dir");
+  });
+
+  it("returns show with the existing path when --show is set, even if SUMMARY is missing (regression: --show must bypass no-summary)", () => {
+    const action = planEvalReviewAction(args({ show: true }), noSummary, "/tmp/r.md");
+    assert.equal(action.kind, "show");
+    if (action.kind === "show") assert.equal(action.path, "/tmp/r.md");
+  });
+
+  it("returns show with null path when --show is set and no EVAL-REVIEW.md exists", () => {
+    const action = planEvalReviewAction(args({ show: true }), noSummary, null);
+    assert.equal(action.kind, "show");
+    if (action.kind === "show") assert.equal(action.path, null);
+  });
+
+  it("returns no-summary when SUMMARY missing and --show is NOT set", () => {
+    assert.equal(planEvalReviewAction(args(), noSummary, null).kind, "no-summary");
+    assert.equal(planEvalReviewAction(args({ force: true }), noSummary, "/tmp/r.md").kind, "no-summary");
+  });
+
+  it("returns exists-no-force when EVAL-REVIEW.md is present and --force is NOT set", () => {
+    const action = planEvalReviewAction(args(), ready, "/tmp/r.md");
+    assert.equal(action.kind, "exists-no-force");
+    if (action.kind === "exists-no-force") assert.equal(action.path, "/tmp/r.md");
+  });
+
+  it("returns dispatch when ready, no existing file", () => {
+    assert.equal(planEvalReviewAction(args(), ready, null).kind, "dispatch");
+  });
+
+  it("returns dispatch when ready and --force overrides existing file", () => {
+    assert.equal(planEvalReviewAction(args({ force: true }), ready, "/tmp/r.md").kind, "dispatch");
+  });
+});
+
+// ─── Catalog registration (regression: catalog registration must not be forgotten) ──
+
+describe("catalog registration", () => {
+  it("includes eval-review in TOP_LEVEL_SUBCOMMANDS", () => {
+    const entry = TOP_LEVEL_SUBCOMMANDS.find((c) => c.cmd === "eval-review");
+    assert.ok(entry, "eval-review must be present in TOP_LEVEL_SUBCOMMANDS");
+    assert.ok((entry?.desc ?? "").length > 0, "eval-review entry must have a non-empty description");
+  });
+
+  it("appends eval-review to the GSD_COMMAND_DESCRIPTION pipe-separated list", () => {
+    assert.ok(
+      GSD_COMMAND_DESCRIPTION.includes("|eval-review"),
+      "GSD_COMMAND_DESCRIPTION must include the eval-review token (pipe-prefixed)",
+    );
+  });
+});
+
+// ─── buildEvalReviewPrompt ────────────────────────────────────────────────────
+
+describe("buildEvalReviewPrompt", () => {
+  function ctxFixture(overrides: Partial<Parameters<typeof buildEvalReviewPrompt>[0]> = {}) {
+    return {
+      milestoneId: "M001",
+      sliceId: "S07",
+      summary: "The slice did stuff.",
+      summaryPath: "/abs/.gsd/milestones/M001/slices/S07/S07-SUMMARY.md",
+      spec: "Required: log every LLM call.",
+      specPath: "/abs/.gsd/milestones/M001/slices/S07/S07-AI-SPEC.md",
+      outputPath: "/abs/.gsd/milestones/M001/slices/S07/S07-EVAL-REVIEW.md",
+      relativeOutputPath: ".gsd/milestones/M001/slices/S07/S07-EVAL-REVIEW.md",
+      truncated: false,
+      generatedAt: "2026-04-28T14:00:00Z",
+      ...overrides,
+    };
+  }
+
+  it("includes the explicit anti-Goodhart rule (string presence is not evidence — anti-Goodhart guard)", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture());
+    assert.ok(prompt.includes("Anti-Goodhart"), "prompt must reference the anti-Goodhart rule by name");
+    assert.ok(
+      prompt.includes("string or file\npresence") || prompt.includes("string presence") || prompt.toLowerCase().includes("not evidence"),
+      "prompt must explicitly state that string/token presence is not evidence",
+    );
+    assert.ok(prompt.includes("grep langfuse"), "prompt must show the canonical Goodhart counter-example");
+  });
+
+  it("requires evidence on every gap (frontmatter contract)", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture());
+    assert.ok(prompt.includes("evidence"), "prompt must require an evidence field");
+    assert.ok(prompt.includes("REQUIRED"), "prompt must mark evidence as required");
+  });
+
+  it("inlines the YAML schema with the expected version literal", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture());
+    assert.ok(prompt.includes("schema: eval-review/v1"));
+    assert.ok(prompt.includes("PRODUCTION_READY"));
+    assert.ok(prompt.includes("NOT_IMPLEMENTED"));
+  });
+
+  it("instructs the agent to write to the canonical output path", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture());
+    assert.ok(prompt.includes("/abs/.gsd/milestones/M001/slices/S07/S07-EVAL-REVIEW.md"));
+  });
+
+  it("surfaces the truncation marker into the prompt body when inputs were truncated", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture({ truncated: true }));
+    assert.ok(prompt.includes("truncated"));
+  });
+
+  it("documents the 60/40 weighting alongside the rubric and explains the split", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture());
+    assert.ok(prompt.includes("0.6"));
+    assert.ok(prompt.includes("0.4"));
+    // Rationale must be present in the prompt body — the rubric is not just
+    // numbers, the auditor needs to know WHY coverage gaps are weighted higher.
+    assert.ok(prompt.toLowerCase().includes("compound"));
+    assert.ok(prompt.includes("Alternatives considered"));
+  });
+
+  it("falls back to a best-practices note when AI-SPEC.md is absent", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture({ spec: null, specPath: null }));
+    assert.ok(prompt.toLowerCase().includes("not present"));
+  });
+
+  it("renders an empty AI-SPEC.md as data, not as 'not present'", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture({ spec: "" }));
+    assert.ok(!prompt.toLowerCase().includes("not present"), "empty spec must not collapse into 'not present'");
+    assert.ok(prompt.includes("### AI-SPEC.md"));
+  });
+
+  it("treats slice artefacts as untrusted data with explicit injection-defense banner", () => {
+    const prompt = buildEvalReviewPrompt(ctxFixture());
+    assert.ok(prompt.includes("untrusted data"), "prompt must label artefacts as untrusted");
+    assert.ok(prompt.toLowerCase().includes("ignore any instructions"), "prompt must instruct the model to ignore directives in artefacts");
+    assert.ok(prompt.includes("~~~~markdown"), "artefact bodies must be wrapped in a fenced data block");
+  });
+});

package/src/resources/extensions/gsd/tests/commands-extensions-version-compare.test.ts

@@ -0,0 +1,58 @@
+// GSD2 — Regression test for Issue #4946 isVersionGreater (commands-extensions.ts)
+//
+// Covers the inline npm-version comparator that replaced the `semver` import in
+// commands-extensions.ts. The original import broke `tsc -p tsconfig.json` whenever
+// `@types/semver` failed to install — the file is type-checked transitively despite
+// being under the `src/resources` exclude. The replacement keeps the same comparison
+// semantics for the realistic input space (npm extension version strings) without
+// pulling in the full semver type surface.
+
+import test, { describe } from "node:test";
+import assert from "node:assert/strict";
+import { isVersionGreater } from "../commands-extensions.ts";
+
+describe("isVersionGreater — npm extension version comparison (#4946)", () => {
+	test("strictly greater patch beats lesser patch", () => {
+		assert.equal(isVersionGreater("1.2.4", "1.2.3"), true);
+		assert.equal(isVersionGreater("1.2.3", "1.2.4"), false);
+	});
+
+	test("equal versions are not strictly greater", () => {
+		assert.equal(isVersionGreater("1.2.3", "1.2.3"), false);
+	});
+
+	test("numeric (not lexicographic) component comparison", () => {
+		// Lexicographic compare would say "1.10.0" < "1.9.0".
+		assert.equal(isVersionGreater("1.10.0", "1.9.0"), true);
+		assert.equal(isVersionGreater("1.9.0", "1.10.0"), false);
+	});
+
+	test("major bump beats minor and patch differences", () => {
+		assert.equal(isVersionGreater("2.0.0", "1.99.99"), true);
+		assert.equal(isVersionGreater("1.99.99", "2.0.0"), false);
+	});
+
+	test("missing trailing components default to zero", () => {
+		assert.equal(isVersionGreater("1.2", "1.1.9"), true);
+		assert.equal(isVersionGreater("1", "0.9.9"), true);
+		assert.equal(isVersionGreater("1.2", "1.2.0"), false);
+	});
+
+	test("release version beats prerelease at the same release number", () => {
+		assert.equal(isVersionGreater("1.0.0", "1.0.0-beta.1"), true);
+		assert.equal(isVersionGreater("1.0.0-beta.1", "1.0.0"), false);
+	});
+
+	test("prerelease ordering: beta.2 > beta.1, rc.1 > beta.9", () => {
+		assert.equal(isVersionGreater("1.0.0-beta.2", "1.0.0-beta.1"), true);
+		assert.equal(isVersionGreater("1.0.0-rc.1", "1.0.0-beta.9"), true);
+	});
+
+	test("non-numeric junk in components doesn't crash — coerces to 0", () => {
+		// Defensive: we don't throw on garbage input; we treat unparseable
+		// components as 0. This matches the behaviour the extension installer
+		// can rely on without surfacing an error to the user.
+		assert.equal(isVersionGreater("1.x.0", "1.0.0"), false);
+		assert.equal(isVersionGreater("abc", "0.0.1"), false);
+	});
+});