gsd-pi 2.78.0 → 2.78.1-dev.9d08d820b

package/src/resources/extensions/gsd/tests/memory-tools.test.ts

@@ -1,7 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 
-import { closeDatabase, openDatabase } from '../gsd-db.ts';
+import { _getAdapter, closeDatabase, openDatabase } from '../gsd-db.ts';
 import { createMemory, supersedeMemory } from '../memory-store.ts';
 import {
   executeGsdGraph,
@@ -293,3 +293,35 @@ test('memory-tools: gsd_graph errors when DB is closed', () => {
   assert.ok(result.isError);
   assert.equal(result.details.error, 'db_unavailable');
 });
+
+// ═══════════════════════════════════════════════════════════════════════════
+// regression #4967 — capture_thought must surface real SQL errors
+// ═══════════════════════════════════════════════════════════════════════════
+
+test('memory-tools: capture_thought surfaces underlying SQL error (regression #4967)', () => {
+  openDatabase(':memory:');
+
+  // Simulate the real-world failure mode where the memories table is gone.
+  // The original bug was a "database disk image is malformed" on the memory
+  // store; dropping the table produces a deterministic statement-time SQL
+  // error of the same shape — a thrown sqlite error during INSERT.
+  const adapter = _getAdapter()!;
+  adapter.prepare('DROP TABLE IF EXISTS memory_embeddings').run();
+  adapter.prepare('DROP TABLE IF EXISTS memories_fts').run();
+  adapter.prepare('DROP TABLE IF EXISTS memories').run();
+
+  const result = executeMemoryCapture({
+    category: 'gotcha',
+    content: 'should reveal the real reason',
+  });
+
+  assert.ok(result.isError, 'broken store should produce an error result');
+  assert.equal(result.details.operation, 'memory_capture');
+
+  const err = String(result.details.error ?? '');
+  assert.notEqual(err, 'create_failed', 'must not collapse to opaque create_failed');
+  assert.ok(err.length > 0, 'error detail must be populated');
+  assert.match(err, /memories|no such table/i, 'error must reference the underlying SQL fault');
+
+  closeDatabase();
+});

package/src/resources/extensions/gsd/tests/merge-self-branch-guard.test.ts

@@ -0,0 +1,124 @@
+// gsd-2 / merge-self-branch-guard.test.ts — regression for #5024
+//
+// mergeMilestoneToMain() must fail closed when the resolved integration
+// branch is the same ref as the milestone branch. Stale or corrupt
+// integration metadata (e.g. integrationBranch recorded as "milestone/<MID>")
+// would otherwise let the squash merge resolve to a self-merge: the post-
+// merge no-op safety check (#1792) compares main vs milestone and finds an
+// empty diff (because they're the same ref), so the helper returns success
+// for work that never landed on a distinct integration branch.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  mkdirSync,
+  rmSync,
+  existsSync,
+  realpathSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { execFileSync } from "node:child_process";
+
+import { mergeMilestoneToMain } from "../auto-worktree.ts";
+import { _resetServiceCache } from "../worktree.ts";
+import { _clearGsdRootCache } from "../paths.ts";
+
+function git(args: string[], cwd: string): string {
+  return execFileSync("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
+}
+
+function createTempRepo(): string {
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), "merge-self-guard-")));
+  git(["init"], dir);
+  git(["config", "user.email", "test@test.com"], dir);
+  git(["config", "user.name", "Test"], dir);
+  writeFileSync(join(dir, "README.md"), "# test\n");
+  git(["add", "."], dir);
+  git(["commit", "-m", "init"], dir);
+  git(["branch", "-M", "main"], dir);
+  return dir;
+}
+
+function assertSelfMergeRefIsRejected(recordedIntegrationBranch: string): void {
+  const savedCwd = process.cwd();
+  let tempDir = "";
+
+  // Isolate from user's global preferences so prefs.main_branch can't
+  // override the corrupt-metadata path under test.
+  const originalHome = process.env.HOME;
+  const fakeHome = realpathSync(mkdtempSync(join(tmpdir(), "gsd-fake-home-")));
+  process.env.HOME = fakeHome;
+  _clearGsdRootCache();
+  _resetServiceCache();
+
+  try {
+    tempDir = createTempRepo();
+
+    // Plant corrupt integration metadata: integrationBranch points at the
+    // milestone branch itself. Commit it so mergeMilestoneToMain's
+    // autoCommitDirtyState pre-step has nothing to capture and the
+    // postcondition (no new commits) cleanly reflects the guard.
+    const msDir = join(tempDir, ".gsd", "milestones", "M001");
+    mkdirSync(msDir, { recursive: true });
+    writeFileSync(
+      join(msDir, "M001-META.json"),
+      JSON.stringify({ integrationBranch: recordedIntegrationBranch }),
+    );
+    git(["add", "."], tempDir);
+    git(["commit", "-m", "chore: plant corrupt M001 meta"], tempDir);
+
+    // Create the milestone branch ref so any pre-guard branch operations
+    // wouldn't fail for unrelated reasons.
+    git(["branch", "milestone/M001"], tempDir);
+
+    const mainHeadBefore = git(["rev-parse", "main"], tempDir);
+    const milestoneHeadBefore = git(["rev-parse", "milestone/M001"], tempDir);
+
+    process.chdir(tempDir);
+
+    assert.throws(
+      () => mergeMilestoneToMain(tempDir, "M001", ""),
+      (err: unknown) => {
+        assert.ok(err instanceof Error, "expected an Error to be thrown");
+        assert.match(
+          err.message,
+          /self-merge|same ref/i,
+          "error message should explain the self-merge refusal",
+        );
+        return true;
+      },
+    );
+
+    // Postcondition: neither branch should have been advanced by a merge
+    // commit. The guard fires before checkout/merge, so both refs must be
+    // unchanged from their pre-call state.
+    const mainHeadAfter = git(["rev-parse", "main"], tempDir);
+    const milestoneHeadAfter = git(["rev-parse", "milestone/M001"], tempDir);
+    assert.equal(mainHeadAfter, mainHeadBefore, "main must not have advanced");
+    assert.equal(
+      milestoneHeadAfter,
+      milestoneHeadBefore,
+      "milestone branch must not have advanced",
+    );
+  } finally {
+    process.chdir(savedCwd);
+    process.env.HOME = originalHome;
+    _clearGsdRootCache();
+    _resetServiceCache();
+    if (tempDir && existsSync(tempDir)) {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+    rmSync(fakeHome, { recursive: true, force: true });
+  }
+}
+
+test("mergeMilestoneToMain refuses exact milestone branch self-merge metadata (#5024)", () => {
+  assertSelfMergeRefIsRejected("milestone/M001");
+});
+
+test("mergeMilestoneToMain refuses refs/heads milestone branch self-merge metadata (#5024)", () => {
+  assertSelfMergeRefIsRejected("refs/heads/milestone/M001");
+});

package/src/resources/extensions/gsd/tests/milestone-id-gap-reuse-4996.test.ts

@@ -0,0 +1,152 @@
+// GSD Extension — Regression test for #4996: ghost milestone ID reuse
+// Verifies that isReusableGhostMilestone correctly identifies reclaim-safe stub dirs,
+// and that nextMilestoneIdReserved (guided-flow) prefers the lowest reusable ghost
+// over max+1. Also covers the race-window regression: a queued DB row must NOT be reused.
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { isReusableGhostMilestone } from "../state.ts";
+import { nextMilestoneIdReserved } from "../milestone-id-reservation.ts";
+import {
+  openDatabase,
+  closeDatabase,
+  insertMilestone,
+} from "../gsd-db.ts";
+import { clearReservedMilestoneIds, findMilestoneIds } from "../milestone-ids.ts";
+import { invalidateAllCaches } from "../cache.ts";
+
+function makeBase(prefix = "gsd-gap-4996-"): string {
+  const base = mkdtempSync(join(tmpdir(), prefix));
+  mkdirSync(join(base, ".gsd", "milestones"), { recursive: true });
+  return base;
+}
+
+function stubDir(base: string, mid: string): void {
+  // Create an empty stub — the phantom pattern
+  mkdirSync(join(base, ".gsd", "milestones", mid, "slices"), { recursive: true });
+}
+
+function populateDir(base: string, mid: string): void {
+  mkdirSync(join(base, ".gsd", "milestones", mid), { recursive: true });
+  writeFileSync(join(base, ".gsd", "milestones", mid, `${mid}-CONTEXT.md`), `# ${mid} Context\n`);
+}
+
+describe("isReusableGhostMilestone (#4996)", () => {
+  let base: string;
+
+  afterEach(() => {
+    try { closeDatabase(); } catch { /* ignore */ }
+    try { invalidateAllCaches(); } catch { /* ignore */ }
+    try { rmSync(base, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  it("(a) fails closed when the DB is unavailable", () => {
+    base = makeBase();
+    stubDir(base, "M003");
+    assert.equal(isReusableGhostMilestone(base, "M003"), false, "closed DB should block reusable-ghost claims");
+  });
+
+  it("(b) empty stub dir with an open DB and no DB row is reusable", () => {
+    base = makeBase();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    stubDir(base, "M003");
+    assert.ok(isReusableGhostMilestone(base, "M003"), "empty stub with no DB row should be reusable");
+  });
+
+  it("(c) queued DB row with no content must NOT be reusable (race window regression)", () => {
+    base = makeBase();
+    stubDir(base, "M003");
+    const dbPath = join(base, ".gsd", "gsd.db");
+    openDatabase(dbPath);
+    insertMilestone({ id: "M003", status: "queued" });
+    // Even though no content files exist, the queued DB row means an in-flight discuss
+    // is reserving this ID — it must not be reclaimed.
+    assert.ok(!isReusableGhostMilestone(base, "M003"), "queued DB row must block reuse");
+  });
+
+  it("(d) populated milestone dir is not reusable", () => {
+    base = makeBase();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    populateDir(base, "M001");
+    assert.ok(!isReusableGhostMilestone(base, "M001"), "populated dir must not be reusable");
+  });
+
+  it("(e) stub dir with worktree is not reusable (legitimate in-flight)", () => {
+    base = makeBase();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    stubDir(base, "M003");
+    // Simulate an existing worktree
+    mkdirSync(join(base, ".gsd", "worktrees", "M003"), { recursive: true });
+    assert.ok(!isReusableGhostMilestone(base, "M003"), "dir with worktree must not be reusable");
+  });
+
+  it("(f) active DB row makes dir not reusable", () => {
+    base = makeBase();
+    stubDir(base, "M003");
+    const dbPath = join(base, ".gsd", "gsd.db");
+    openDatabase(dbPath);
+    insertMilestone({ id: "M003", status: "active" });
+    assert.ok(!isReusableGhostMilestone(base, "M003"), "active DB row must block reuse");
+  });
+});
+
+describe("primary regression: M003/M004 stubs returned as next ID (#4996)", () => {
+  let base: string;
+
+  beforeEach(() => {
+    clearReservedMilestoneIds();
+  });
+
+  afterEach(() => {
+    try { closeDatabase(); } catch { /* ignore */ }
+    try { invalidateAllCaches(); } catch { /* ignore */ }
+    try { clearReservedMilestoneIds(); } catch { /* ignore */ }
+    try { rmSync(base, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  it("M001/M002 populated + M003/M004 stubs → isReusableGhostMilestone returns true for M003 and M004", () => {
+    base = makeBase();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    populateDir(base, "M001");
+    populateDir(base, "M002");
+    stubDir(base, "M003");
+    stubDir(base, "M004");
+
+    assert.ok(isReusableGhostMilestone(base, "M003"), "M003 should be identified as reusable ghost");
+    assert.ok(isReusableGhostMilestone(base, "M004"), "M004 should be identified as reusable ghost");
+    assert.ok(!isReusableGhostMilestone(base, "M001"), "M001 should not be reusable");
+    assert.ok(!isReusableGhostMilestone(base, "M002"), "M002 should not be reusable");
+
+    const nextId = nextMilestoneIdReserved(findMilestoneIds(base), false, base);
+    assert.equal(nextId, "M003", "ID reservation should select the lowest reusable ghost");
+  });
+
+  it("when all dirs are populated, no ghost exists and the function returns false for all", () => {
+    base = makeBase();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    populateDir(base, "M001");
+    populateDir(base, "M002");
+
+    assert.ok(!isReusableGhostMilestone(base, "M001"), "M001 is populated, not reusable");
+    assert.ok(!isReusableGhostMilestone(base, "M002"), "M002 is populated, not reusable");
+
+    const nextId = nextMilestoneIdReserved(findMilestoneIds(base), false, base);
+    assert.equal(nextId, "M003", "ID reservation should fall back to max+1 when no ghost is reusable");
+  });
+
+  it("does not return an already-reserved reusable ghost twice", () => {
+    base = makeBase();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    stubDir(base, "M001");
+
+    const firstId = nextMilestoneIdReserved(findMilestoneIds(base), false, base);
+    const secondId = nextMilestoneIdReserved(findMilestoneIds(base), false, base);
+
+    assert.equal(firstId, "M001", "first reservation should reuse the ghost");
+    assert.equal(secondId, "M002", "second reservation must skip the already-reserved ghost");
+  });
+});

package/src/resources/extensions/gsd/tests/milestone-report-path.test.ts

@@ -10,7 +10,7 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
 
-import { _resolveReportBasePath } from "../auto/phases.ts";
+import { _resolveDispatchGuardBasePath, _resolveReportBasePath } from "../auto/phases.ts";
 
 describe("_resolveReportBasePath", () => {
   test("uses originalBasePath when set (worktree scenario)", () => {
@@ -48,4 +48,21 @@ describe("_resolveReportBasePath", () => {
 
     assert.equal(_resolveReportBasePath(session), "/home/user/repo");
   });
+
+  test("uses GSD_PROJECT_ROOT for symlink-resolved worktree paths", () => {
+    const savedProjectRoot = process.env.GSD_PROJECT_ROOT;
+    process.env.GSD_PROJECT_ROOT = "/real/project";
+    try {
+      const session = {
+        originalBasePath: "",
+        basePath: "/Users/dev/.gsd/projects/abc123/worktrees/M001/slices/S01",
+      };
+
+      assert.equal(_resolveReportBasePath(session), "/real/project");
+      assert.equal(_resolveDispatchGuardBasePath(session), "/real/project");
+    } finally {
+      if (savedProjectRoot === undefined) delete process.env.GSD_PROJECT_ROOT;
+      else process.env.GSD_PROJECT_ROOT = savedProjectRoot;
+    }
+  });
 });

package/src/resources/extensions/gsd/tests/model-router.test.ts

@@ -5,6 +5,7 @@ import {
   resolveModelForComplexity,
   escalateTier,
   defaultRoutingConfig,
+  resolveModelForTier,
   scoreModel,
   computeTaskRequirements,
   scoreEligibleModels,
@@ -248,6 +249,172 @@ test("#2192: known model is still downgraded normally", () => {
   assert.notEqual(result.modelId, "claude-opus-4-6");
 });
 
+// ─── Cross-provider fallback ──────────────────────────────────────────────────
+
+test("uses cross-provider equivalent when configured primary is unavailable", () => {
+  const config = { ...defaultRoutingConfig(), enabled: true };
+  // Profile default says claude-opus-4-6 for planning, but user is on GPT only
+  const result = resolveModelForComplexity(
+    makeClassification("heavy"),
+    { primary: "claude-opus-4-6", fallbacks: [] },
+    config,
+    ["gpt-4o", "gpt-4o-mini", "o1"],
+  );
+  // o1 is the heavy-tier GPT model — should be selected as cross-provider equivalent
+  assert.equal(result.modelId, "o1");
+  assert.equal(result.wasDowngraded, false);
+  assert.match(result.reason, /cross-provider/);
+});
+
+test("cross-provider: selects standard-tier equivalent when primary unavailable", () => {
+  const config = { ...defaultRoutingConfig(), enabled: true };
+  // Planning configured with Opus, but only GPT standard models available
+  const result = resolveModelForComplexity(
+    makeClassification("heavy"),
+    { primary: "claude-opus-4-6", fallbacks: [] },
+    config,
+    ["gpt-4o", "gpt-4o-mini"],
+  );
+  // gpt-4o is standard tier, not heavy — no heavy-tier model available
+  // Should fall back to gpt-4o (best available)
+  assert.ok(result.modelId === "gpt-4o" || result.modelId === "claude-opus-4-6");
+  assert.equal(result.wasDowngraded, false);
+});
+
+test("cross-provider: configured primary available by bare ID wins over equivalent", () => {
+  const config = { ...defaultRoutingConfig(), enabled: true };
+  // Provider-prefixed ID — bare match should find it
+  const result = resolveModelForComplexity(
+    makeClassification("heavy"),
+    { primary: "claude-opus-4-6", fallbacks: [] },
+    config,
+    ["anthropic/claude-opus-4-6", "o1"],
+  );
+  assert.equal(result.modelId, "claude-opus-4-6");
+  assert.equal(result.wasDowngraded, false);
+});
+
+// ─── resolveModelForTier (provider-agnostic tier resolution) ────────────────
+
+test("resolveModelForTier: returns canonical Anthropic model when no available models", () => {
+  assert.equal(resolveModelForTier("heavy", []), "claude-opus-4-6");
+  assert.equal(resolveModelForTier("standard", []), "claude-sonnet-4-6");
+  assert.equal(resolveModelForTier("light", []), "claude-haiku-4-5");
+});
+
+test("resolveModelForTier: returns canonical model when it is available", () => {
+  assert.equal(
+    resolveModelForTier("heavy", ["claude-opus-4-6", "claude-sonnet-4-6"]),
+    "claude-opus-4-6",
+  );
+});
+
+test("resolveModelForTier: does not prefer canonical over cheaper same-tier model", () => {
+  const result = resolveModelForTier("light", ["claude-haiku-4-5", "gpt-4o-mini"]);
+  assert.equal(result, "gpt-4o-mini");
+});
+
+test("resolveModelForTier: honors configured tier_models pins", () => {
+  const config: DynamicRoutingConfig = {
+    ...defaultRoutingConfig(),
+    tier_models: { light: "claude-haiku-4-5" },
+  };
+  const result = resolveModelForTier("light", ["claude-haiku-4-5", "gpt-4o-mini"], config);
+  assert.equal(result, "claude-haiku-4-5");
+});
+
+test("resolveModelForTier: picks cross-provider equivalent when Anthropic unavailable", () => {
+  // Only OpenAI models available
+  const result = resolveModelForTier("heavy", ["gpt-4o", "gpt-4o-mini", "o1"]);
+  // o1 is the heavy-tier model in the OpenAI lineup
+  assert.equal(result, "o1");
+});
+
+test("resolveModelForTier: picks standard-tier cross-provider model", () => {
+  const result = resolveModelForTier("standard", ["gpt-4o", "gpt-4o-mini"]);
+  assert.equal(result, "gpt-4o");
+});
+
+test("resolveModelForTier: picks light-tier cross-provider model", () => {
+  const result = resolveModelForTier("light", ["gpt-4o", "gpt-4o-mini"]);
+  assert.equal(result, "gpt-4o-mini");
+});
+
+test("resolveModelForTier: falls back to canonical when no tier match available", () => {
+  // Only unknown models available — getModelTier classifies unknowns as
+  // "standard", so a request for "heavy" finds no match and the canonical
+  // Anthropic ID is returned as a documented fallback.
+  const result = resolveModelForTier("heavy", ["some-custom-model"]);
+  assert.equal(result, "claude-opus-4-6");
+});
+
+test("resolveModelForTier: handles provider-prefixed available models", () => {
+  const result = resolveModelForTier("heavy", ["anthropic/claude-opus-4-6"]);
+  assert.equal(result, "claude-opus-4-6");
+});
+
+test("resolveModelForTier: picks Gemini models when only Google available", () => {
+  const result = resolveModelForTier("light", ["gemini-2.5-pro", "gemini-2.0-flash"]);
+  assert.equal(result, "gemini-2.0-flash");
+});
+
+// ─── Behavioral: profile defaults are provider-agnostic at runtime ──────────
+
+test("resolveProfileDefaults: balanced with only OpenAI models returns OpenAI IDs", async () => {
+  const { resolveProfileDefaults } = await import("../preferences-models.js");
+  const defaults = resolveProfileDefaults("balanced", ["gpt-4o", "gpt-4o-mini"]);
+  assert.ok(defaults.models, "balanced should populate models");
+  // All slots must resolve to an available OpenAI ID — not a claude- canonical.
+  for (const [phase, modelId] of Object.entries(defaults.models!)) {
+    assert.ok(typeof modelId === "string" && modelId.length > 0, `${phase} should resolve to a model ID`);
+    assert.ok(
+      !String(modelId).startsWith("claude-"),
+      `${phase} resolved to ${modelId} but no claude-* model is available — should be OpenAI`,
+    );
+  }
+});
+
+test("resolveProfileDefaults: budget with only OpenAI models picks gpt-4o-mini for light slots", async () => {
+  const { resolveProfileDefaults } = await import("../preferences-models.js");
+  const defaults = resolveProfileDefaults("budget", ["gpt-4o", "gpt-4o-mini"]);
+  // light-tier slots in budget: research, execution_simple, completion, subagent
+  assert.equal(defaults.models?.research, "gpt-4o-mini");
+  assert.equal(defaults.models?.execution_simple, "gpt-4o-mini");
+  assert.equal(defaults.models?.completion, "gpt-4o-mini");
+  assert.equal(defaults.models?.subagent, "gpt-4o-mini");
+  // standard-tier slots: planning, execution
+  assert.equal(defaults.models?.planning, "gpt-4o");
+  assert.equal(defaults.models?.execution, "gpt-4o");
+});
+
+test("resolveProfileDefaults: honors dynamic routing tier_models pins", async () => {
+  const { resolveProfileDefaults } = await import("../preferences-models.js");
+  const defaults = resolveProfileDefaults(
+    "budget",
+    ["claude-haiku-4-5", "gpt-4o-mini", "gpt-4o"],
+    { ...defaultRoutingConfig(), tier_models: { light: "claude-haiku-4-5" } },
+  );
+  assert.equal(defaults.models?.research, "claude-haiku-4-5");
+  assert.equal(defaults.models?.execution_simple, "claude-haiku-4-5");
+  assert.equal(defaults.models?.completion, "claude-haiku-4-5");
+  assert.equal(defaults.models?.subagent, "claude-haiku-4-5");
+});
+
+test("resolveProfileDefaults: empty availableModelIds falls back to canonical Anthropic IDs", async () => {
+  const { resolveProfileDefaults } = await import("../preferences-models.js");
+  const defaults = resolveProfileDefaults("balanced", []);
+  // Documented fallback only — when registry is unavailable at bootstrap.
+  const planningModel = defaults.models?.planning;
+  assert.ok(typeof planningModel === "string" && planningModel.startsWith("claude-"));
+});
+
+test("resolveProfileDefaults: burn-max omits models so user choice is preserved", async () => {
+  const { resolveProfileDefaults } = await import("../preferences-models.js");
+  const defaults = resolveProfileDefaults("burn-max", ["gpt-4o"]);
+  assert.equal(defaults.models, undefined, "burn-max must not write model defaults");
+  assert.equal(defaults.dynamic_routing?.enabled, false);
+});
+
 // ─── Capability Scoring (ADR-004 Phase 2) ───────────────────────────────────
 
 test("defaultRoutingConfig includes capability_routing: true", () => {
@@ -279,14 +446,8 @@ test("scoreModel computes weighted average of capability × requirement", () =>
   assert.ok(Math.abs(score - 88.21) < 0.1, `score ${score} should be ~88.21`);
 });
 
-test("scoreModel returns 50 for empty requirements", () => {
-  const caps: ModelCapabilities = {
-    coding: 90, debugging: 80, research: 70,
-    reasoning: 85, speed: 50, longContext: 60, instruction: 75,
-  };
-  const score = scoreModel(caps, {});
-  assert.equal(score, 50);
-});
+// (Removed duplicate "scoreModel returns 50 for empty requirements" — the
+// `describe("scoreModel")` block below has the same scenario.)
 
 test("computeTaskRequirements returns base vector for known unit type", () => {
   const reqs = computeTaskRequirements("execute-task");

package/src/resources/extensions/gsd/tests/native-git-infra-errors.test.ts

@@ -0,0 +1,50 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { git } from "./test-utils.ts";
+import { GSD_GIT_ERROR } from "../errors.js";
+
+test("nativeAddAllWithExclusions preserves infrastructure failures from git add", async () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-native-git-infra-"));
+  const repo = join(base, "repo");
+  const bin = join(base, "bin");
+  mkdirSync(repo);
+  mkdirSync(bin);
+
+  const fakeGit = join(bin, "git");
+  writeFileSync(
+    fakeGit,
+    "#!/bin/sh\n" +
+      "echo 'fatal: ENFILE: file table overflow' >&2\n" +
+      "exit 1\n",
+    "utf-8",
+  );
+  chmodSync(fakeGit, 0o755);
+
+  const originalPath = process.env.PATH ?? "";
+  try {
+    git(repo, "init");
+    git(repo, "config", "user.email", "test@example.com");
+    git(repo, "config", "user.name", "Test User");
+    writeFileSync(join(repo, "README.md"), "# Test\n", "utf-8");
+
+    process.env.PATH = `${bin}:${originalPath}`;
+    const { nativeAddAllWithExclusions } = await import("../native-git-bridge.ts");
+
+    assert.throws(
+      () => nativeAddAllWithExclusions(repo, [".gsd/activity/"]),
+      (err) => {
+        const shaped = err as { code?: string; stderr?: string; message?: string };
+        assert.notEqual(shaped.code, GSD_GIT_ERROR);
+        assert.match(`${shaped.stderr ?? ""}${shaped.message ?? ""}`, /ENFILE/);
+        return true;
+      },
+    );
+  } finally {
+    process.env.PATH = originalPath;
+    rmSync(base, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/orphaned-worktree-audit.test.ts

@@ -101,6 +101,14 @@ describe("auditOrphanedMilestoneBranches", () => {
       result.warnings.some(w => w.includes("NOT merged")),
       "should warn about unmerged branch",
     );
+    assert.ok(
+      result.warnings.some(w => w.includes("/gsd doctor fix")),
+      `warning should suggest the real remediation command; got: ${JSON.stringify(result.warnings)}`,
+    );
+    assert.ok(
+      result.warnings.every(w => !w.includes("/gsd health --fix")),
+      `warning must not suggest the removed health --fix command; got: ${JSON.stringify(result.warnings)}`,
+    );
 
     // Branch should still exist (data safety)
     const branches = run("git branch --list milestone/M001", dir);