gsd-pi 2.78.1-dev.0fdacd524 → 2.78.1-dev.2d3fd6e71

package/src/resources/extensions/gsd/tests/commands-ship-eval-warn.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Unit tests for the pre-ship eval-review soft-warning helper.
+ *
+ * The helper `checkSliceEvalReview` is a pure-data classifier called by
+ * `handleShip` for each slice in the active milestone. It must:
+ *   - return `absent` on missing file (no exception, no throw)
+ *   - tolerate a TOCTOU race where the file is deleted between
+ *     resolution and read (regression: prior parser would have crashed on this race)
+ *   - report `malformed` on schema-invalid frontmatter (no crash)
+ *   - report `ok` with verdict + overall_score on a valid frontmatter
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, rmSync, writeFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+
+import { checkSliceEvalReview } from "../commands-ship.js";
+import { _clearGsdRootCache, resolveSliceFile } from "../paths.js";
+
+describe("checkSliceEvalReview", () => {
+  let basePath: string;
+  let sliceDir: string;
+
+  beforeEach(() => {
+    basePath = join(tmpdir(), `gsd-ship-eval-${randomUUID()}`);
+    sliceDir = join(basePath, ".gsd", "milestones", "M001", "slices", "S07");
+    mkdirSync(sliceDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    _clearGsdRootCache();
+    rmSync(basePath, { recursive: true, force: true });
+  });
+
+  function writeEvalReview(filename: string, content: string): string {
+    const path = join(sliceDir, filename);
+    writeFileSync(path, content, "utf-8");
+    return path;
+  }
+
+  function happyFrontmatter(overrides: Record<string, string> = {}): string {
+    const fields = {
+      schema: "eval-review/v1",
+      verdict: "PRODUCTION_READY",
+      coverage_score: "85",
+      infrastructure_score: "80",
+      overall_score: "83",
+      generated: "2026-04-28T14:00:00Z",
+      slice: "S07",
+      milestone: "M001",
+      ...overrides,
+    };
+    const lines = ["---"];
+    for (const [k, v] of Object.entries(fields)) lines.push(`${k}: ${v}`);
+    lines.push("gaps: []");
+    lines.push("counts:");
+    lines.push("  blocker: 0");
+    lines.push("  major: 0");
+    lines.push("  minor: 0");
+    lines.push("---");
+    lines.push("");
+    lines.push("# Body — never parsed");
+    return lines.join("\n");
+  }
+
+  it("returns absent when EVAL-REVIEW.md is missing", async () => {
+    const result = await checkSliceEvalReview(basePath, "M001", "S07");
+    assert.equal(result.kind, "absent");
+    assert.equal(result.sliceId, "S07");
+  });
+
+  it("returns ok with verdict and overall_score when frontmatter is valid (PRODUCTION_READY path)", async () => {
+    writeEvalReview("S07-EVAL-REVIEW.md", happyFrontmatter());
+    const result = await checkSliceEvalReview(basePath, "M001", "S07");
+    assert.equal(result.kind, "ok");
+    if (result.kind === "ok") {
+      assert.equal(result.verdict, "PRODUCTION_READY");
+      assert.equal(result.overall_score, 83);
+    }
+  });
+
+  it("returns ok with NOT_IMPLEMENTED verdict (warning path)", async () => {
+    writeEvalReview(
+      "S07-EVAL-REVIEW.md",
+      happyFrontmatter({
+        verdict: "NOT_IMPLEMENTED",
+        coverage_score: "10",
+        infrastructure_score: "20",
+        overall_score: "14",
+      }),
+    );
+    const result = await checkSliceEvalReview(basePath, "M001", "S07");
+    assert.equal(result.kind, "ok");
+    if (result.kind === "ok") {
+      assert.equal(result.verdict, "NOT_IMPLEMENTED");
+      assert.equal(result.overall_score, 14);
+    }
+  });
+
+  it("returns malformed with a JSON-Pointer when verdict is invalid (regression: malformed verdicts must not parse silently)", async () => {
+    writeEvalReview("S07-EVAL-REVIEW.md", happyFrontmatter({ verdict: "MOSTLY_OK" }));
+    const result = await checkSliceEvalReview(basePath, "M001", "S07");
+    assert.equal(result.kind, "malformed");
+    if (result.kind === "malformed") {
+      assert.ok(result.pointer.includes("verdict"), `pointer should reference verdict, got ${result.pointer}`);
+    }
+  });
+
+  it("returns malformed when the file has no frontmatter delimiters at all", async () => {
+    writeEvalReview("S07-EVAL-REVIEW.md", "# Just a body, no frontmatter");
+    const result = await checkSliceEvalReview(basePath, "M001", "S07");
+    assert.equal(result.kind, "malformed");
+  });
+
+  it("returns malformed when the YAML is syntactically broken inside the frontmatter block", async () => {
+    writeEvalReview("S07-EVAL-REVIEW.md", "---\nfoo: : bar\n---\n");
+    const result = await checkSliceEvalReview(basePath, "M001", "S07");
+    assert.equal(result.kind, "malformed");
+  });
+
+  it("treats a TOCTOU race (file deleted after resolution but before read) as absent without throwing (regression: TOCTOU race must surface as absent, not throw)", async () => {
+    const path = writeEvalReview("S07-EVAL-REVIEW.md", happyFrontmatter());
+    // Warm the directory-listing cache used inside resolveSliceFile so the
+    // resolver still sees the file by name on the next call. Then delete the
+    // file. The subsequent checkSliceEvalReview call resolves a path that
+    // points to a missing file — exactly the race a prior existsSync +
+    // readFileSync sequence panicked on.
+    const resolved = resolveSliceFile(basePath, "M001", "S07", "EVAL-REVIEW");
+    assert.equal(resolved, path);
+    unlinkSync(path);
+    const result = await checkSliceEvalReview(basePath, "M001", "S07");
+    assert.equal(result.kind, "absent");
+  });
+
+  it("does NOT trigger a malformed verdict on bodies with prose, tables, or numbered lists (regression: body is never parsed)", async () => {
+    const body = [
+      "",
+      "## Gap Analysis",
+      "1. first numbered item that the previous parser would have grabbed",
+      "2. second numbered item",
+      "",
+      "| dim | sev |",
+      "|---|---|",
+      "| metrics | major |",
+      "",
+      "Some prose paragraph describing the audit.",
+    ].join("\n");
+    writeEvalReview("S07-EVAL-REVIEW.md", happyFrontmatter() + body);
+    const result = await checkSliceEvalReview(basePath, "M001", "S07");
+    assert.equal(result.kind, "ok");
+  });
+});

package/src/resources/extensions/gsd/tests/complete-task-rollback-evidence.test.ts

@@ -41,7 +41,7 @@ const VALID_PARAMS = {
   ],
 };
 
-describe("complete-task rollback cleans up verification_evidence (#2724)", () => {
+describe("complete-task projection failures keep DB completion committed", () => {
   let base: string;
 
   afterEach(() => {
@@ -75,7 +75,7 @@ describe("complete-task rollback cleans up verification_evidence (#2724)", () =>
     assert.equal(rows.length, 2, "should have 2 evidence rows after success");
   });
 
-  it("deletes verification_evidence rows on disk-render rollback", async () => {
+  it("keeps task completion and verification_evidence when disk projection write fails", async () => {
     base = makeTmpBase();
     openDatabase(join(base, ".gsd", "gsd.db"));
     insertMilestone({ id: "M001" });
@@ -87,20 +87,19 @@ describe("complete-task rollback cleans up verification_evidence (#2724)", () =>
     writeFileSync(tasksDir, "not-a-directory");
 
     const result = await handleCompleteTask(VALID_PARAMS, base);
-    assert.ok("error" in result, "should return error when disk write fails");
+    assert.ok(!("error" in result), `unexpected error: ${"error" in result ? result.error : ""}`);
+    assert.equal(result.stale, true, "result should report stale projection");
 
-    // Task should be rolled back to pending
     const adapter = _getAdapter()!;
     const task = adapter.prepare(
       `SELECT status FROM tasks WHERE milestone_id = 'M001' AND slice_id = 'S01' AND id = 'T01'`,
     ).get() as { status: string } | undefined;
     assert.ok(task, "task row should still exist");
-    assert.equal(task!.status, "pending", "task status should be rolled back to pending");
+    assert.equal(task!.status, "complete", "task status should remain complete");
 
-    // Verification evidence should be cleaned up — no orphaned rows
     const evidenceRows = adapter.prepare(
       `SELECT * FROM verification_evidence WHERE task_id = 'T01' AND slice_id = 'S01' AND milestone_id = 'M001'`,
     ).all();
-    assert.equal(evidenceRows.length, 0, "verification_evidence should be empty after rollback");
+    assert.equal(evidenceRows.length, 2, "verification_evidence should remain committed");
   });
 });

package/src/resources/extensions/gsd/tests/complete-task.test.ts

@@ -403,12 +403,11 @@ console.log('\n=== complete-task: handler idempotency ===');
   const r1 = await handleCompleteTask(params, basePath);
   assertTrue(!('error' in r1), 'first call should succeed');
 
-  // Verify complete-task did not duplicate T01. State reconciliation may import
-  // the remaining plan task from disk so the DB stays aligned with S01-PLAN.md.
+  // Verify complete-task did not duplicate T01. S01-PLAN.md is a projection,
+  // so the remaining plan task is not imported implicitly.
   const tasks = getSliceTasks('M001', 'S01');
-  assertEq(tasks.length, 2, 'should have T01 plus reconciled T02 after first call');
+  assertEq(tasks.length, 1, 'should only have the completed DB task after first call');
   assertEq(tasks.filter(t => t.id === 'T01').length, 1, 'should have exactly one T01 row after first call');
-  assertEq(tasks.find(t => t.id === 'T02')?.status, 'pending', 'T02 should be reconciled as pending');
 
   // Second call with same params — state machine guard rejects (task is already complete)
   const r2 = await handleCompleteTask(params, basePath);
@@ -419,7 +418,7 @@ console.log('\n=== complete-task: handler idempotency ===');
 
   // Still no duplicate rows from the rejected second call.
   const tasksAfter = getSliceTasks('M001', 'S01');
-  assertEq(tasksAfter.length, 2, 'should still have T01 plus reconciled T02 after rejected second call');
+  assertEq(tasksAfter.length, 1, 'should still only have T01 after rejected second call');
   assertEq(tasksAfter.filter(t => t.id === 'T01').length, 1, 'should still have exactly one T01 row');
 
   cleanupDir(basePath);
@@ -447,10 +446,13 @@ console.log('\n=== complete-task: handler with missing plan file ===');
   const params = makeValidParams();
   const result = await handleCompleteTask(params, basePath);
 
-  // Should succeed even without plan file — just skip checkbox toggle
+  // Should succeed and regenerate the missing plan projection from DB.
   assertTrue(!('error' in result), 'handler should succeed without plan file');
   if (!('error' in result)) {
     assertTrue(fs.existsSync(result.summaryPath), 'summary should be written even without plan file');
+    const planPath = path.join(basePath, '.gsd', 'milestones', 'M001', 'slices', 'S01', 'S01-PLAN.md');
+    assertTrue(fs.existsSync(planPath), 'missing plan projection should be regenerated from DB');
+    assertTrue(fs.readFileSync(planPath, 'utf-8').includes('[x] **T01:'), 'regenerated plan should reflect DB task completion');
   }
 
   cleanupDir(basePath);

package/src/resources/extensions/gsd/tests/completed-at-reconcile.test.ts

@@ -1,15 +1,9 @@
 /**
- * Behavioural regression test for #4129.
+ * Behavioural regression test for DB-authoritative task completion.
  *
- * When deriveStateFromDb's reconcileSliceTasks finds a SUMMARY.md on disk
- * for a task whose DB row is still pending, it flips the row to "complete".
- * Before #4129, the call to updateTaskStatus omitted the completedAt
- * timestamp, leaving completed_at NULL forever.
- *
- * The fix passes new Date().toISOString() as the 5th argument; this test
- * exercises that path end-to-end and asserts the column is populated.
- *
- * Refs #4829 (rewrite from positional source-grep).
+ * A task SUMMARY.md on disk is a projection, not a completion command.
+ * deriveStateFromDb must not flip a pending DB task to complete or invent a
+ * completed_at timestamp from disk evidence.
  */
 
 import { describe, test, beforeEach, afterEach } from 'node:test';
@@ -46,27 +40,26 @@ function setupProject(): void {
     `# M001\n\n## Slices\n\n- [ ] **S01: Slice** \`risk:low\` \`depends:[]\`\n  - After this: works\n`,
   );
 
-  // Plan file for the slice so reconcile can populate task list if DB is empty.
+  // Plan file for the slice. It is a projection and must not drive DB state.
   writeFileSync(
     join(basePath, '.gsd', 'milestones', 'M001', 'slices', 'S01', 'S01-PLAN.md'),
     `# S01: Slice\n\n## Tasks\n\n- [ ] **T01: Test task** \`est:30m\`\n  - Do: x\n  - Verify: y\n`,
   );
 
-  // The summary file: this is the on-disk evidence that flips the task
-  // status to "complete" inside reconcileSliceTasks.
+  // The summary file is a projection and must not complete the task.
   writeFileSync(
     join(basePath, '.gsd', 'milestones', 'M001', 'slices', 'S01', 'tasks', 'T01-SUMMARY.md'),
     '---\nid: T01\nparent: S01\nmilestone: M001\nblocker_discovered: false\n---\n# T01\n',
   );
 }
 
-describe('completed_at reconcile (#4129)', () => {
+describe('completed_at DB-authoritative derivation', () => {
   beforeEach(() => {
     setupProject();
     openDatabase(join(basePath, '.gsd', 'gsd.db'));
     insertMilestone({ id: 'M001', title: 'M001', status: 'active' });
     insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Slice', status: 'active' });
-    // Task is "pending" in DB, but SUMMARY.md exists on disk → reconcile flips it.
+    // Task is "pending" in DB, even though SUMMARY.md exists on disk.
     insertTask({ id: 'T01', sliceId: 'S01', milestoneId: 'M001', title: 'Test task', status: 'pending' });
     invalidateStateCache();
   });
@@ -76,24 +69,16 @@ describe('completed_at reconcile (#4129)', () => {
     try { rmSync(basePath, { recursive: true, force: true }); } catch { /* */ }
   });
 
-  test('reconcileSliceTasks sets completed_at when flipping a pending task to complete via SUMMARY.md', async () => {
+  test('deriveStateFromDb does not set completed_at from a disk SUMMARY projection', async () => {
     const before = getTask('M001', 'S01', 'T01');
     assert.strictEqual(before?.status, 'pending', 'task starts pending');
     assert.strictEqual(before?.completed_at, null, 'task starts with completed_at NULL');
 
-    // Trigger the reconcile path (state.ts → reconcileSliceTasks).
+    // Derive runtime state. Disk SUMMARY.md must not mutate the DB row.
     await deriveStateFromDb(basePath);
 
     const after = getTask('M001', 'S01', 'T01');
-    assert.strictEqual(after?.status, 'complete', 'task should be flipped to complete');
-    assert.ok(
-      typeof after?.completed_at === 'string' && after.completed_at.length > 0,
-      `completed_at must be populated by reconcileSliceTasks (#4129); got ${JSON.stringify(after?.completed_at)}`,
-    );
-    // Sanity: timestamp parses as a valid ISO date.
-    assert.ok(
-      !Number.isNaN(Date.parse(after!.completed_at!)),
-      `completed_at should be a valid ISO timestamp, got ${after!.completed_at}`,
-    );
+    assert.strictEqual(after?.status, 'pending', 'task remains pending');
+    assert.strictEqual(after?.completed_at, null, 'completed_at remains NULL');
   });
 });

package/src/resources/extensions/gsd/tests/completed-units-metrics-sync.test.ts

@@ -58,13 +58,26 @@ test("#2313: syncStateToProjectRoot should sync metrics.json", () => {
   );
 });
 
-test("#2313: syncWorktreeStateBack should include metrics.json in ROOT_STATE_FILES", () => {
+test("syncStateToProjectRoot should back-sync completed-units.json", () => {
+  const syncSrcPath = join(import.meta.dirname, "..", "auto-worktree.ts");
+  const syncSrc = readFileSync(syncSrcPath, "utf-8");
+  const fnIdx = syncSrc.indexOf("export function syncStateToProjectRoot(");
+  assert.ok(fnIdx !== -1, "syncStateToProjectRoot exists");
+  const fnBlock = syncSrc.slice(fnIdx, syncSrc.indexOf("// ─── Resource Staleness", fnIdx));
+
+  assert.ok(
+    fnBlock.includes('"completed-units.json"'),
+    "syncStateToProjectRoot should copy completed-units.json back to the project root",
+  );
+});
+
+test("#2313: syncWorktreeStateBack should include metrics.json in ROOT_DIAGNOSTIC_FILES", () => {
   const autoWorktreeSrcPath = join(import.meta.dirname, "..", "auto-worktree.ts");
   const autoWorktreeSrc = readFileSync(autoWorktreeSrcPath, "utf-8");
 
-  // Find the ROOT_STATE_FILES constant (single source of truth for both sync directions)
-  const constIdx = autoWorktreeSrc.indexOf("ROOT_STATE_FILES");
-  assert.ok(constIdx !== -1, "ROOT_STATE_FILES constant exists");
+  // Find the ROOT_DIAGNOSTIC_FILES constant used for worktree copy-back.
+  const constIdx = autoWorktreeSrc.indexOf("ROOT_DIAGNOSTIC_FILES");
+  assert.ok(constIdx !== -1, "ROOT_DIAGNOSTIC_FILES constant exists");
 
   // Get the array content
   const arrayStart = autoWorktreeSrc.indexOf("[", constIdx);
@@ -73,7 +86,7 @@ test("#2313: syncWorktreeStateBack should include metrics.json in ROOT_STATE_FIL
 
   assert.ok(
     rootFilesBlock.includes("metrics.json"),
-    "metrics.json should be in ROOT_STATE_FILES list",
+    "metrics.json should be in ROOT_DIAGNOSTIC_FILES list",
   );
 });
 

package/src/resources/extensions/gsd/tests/context-budget.test.ts

@@ -199,6 +199,18 @@ describe("context-budget: resolveExecutorContextWindow", () => {
     assert.equal(result, 128_000);
   });
 
+  it("uses conservative effective context for configured claude-code models", () => {
+    const registry = makeRegistry([
+      makeModel("claude-sonnet-4-6", "claude-code", 1_000_000),
+    ]);
+    const prefs: MinimalPreferences = {
+      models: { execution: "claude-code/claude-sonnet-4-6" },
+    };
+
+    const result = resolveExecutorContextWindow(registry, prefs);
+    assert.equal(result, 200_000);
+  });
+
   it("supports provider/model format in preferences", () => {
     const registry = makeRegistry([
       makeModel("gpt-4o", "openai", 128_000),
@@ -246,6 +258,22 @@ describe("context-budget: resolveExecutorContextWindow", () => {
     assert.equal(result, 128_000);
   });
 
+  it("uses conservative effective context for claude-code session window fallback", () => {
+    const registry = makeRegistry([]);
+    const prefs: MinimalPreferences = { models: {} };
+
+    const result = resolveExecutorContextWindow(registry, prefs, 1_000_000, "claude-code");
+    assert.equal(result, 200_000);
+  });
+
+  it("does not cap large non-claude-code session windows", () => {
+    const registry = makeRegistry([]);
+    const prefs: MinimalPreferences = { models: {} };
+
+    const result = resolveExecutorContextWindow(registry, prefs, 1_000_000, "openai");
+    assert.equal(result, 1_000_000);
+  });
+
   it("falls back to 200K when no session and no executor model", () => {
     const registry = makeRegistry([]);
     const prefs: MinimalPreferences = { models: { execution: "missing" } };

package/src/resources/extensions/gsd/tests/crash-recovery.test.ts

@@ -248,6 +248,56 @@ test("readPausedSessionMetadata handles legacy metadata without unitType/unitId"
   }
 });
 
+test("readPausedSessionMetadata drops stale discuss-milestone pseudo PROJECT metadata", () => {
+  const base = makeTmpBase();
+  try {
+    const runtimeDir = join(base, ".gsd", "runtime");
+    const pausedPath = join(runtimeDir, "paused-session.json");
+    mkdirSync(runtimeDir, { recursive: true });
+    writeFileSync(
+      pausedPath,
+      JSON.stringify({
+        milestoneId: null,
+        originalBasePath: base,
+        unitType: "discuss-milestone",
+        unitId: "PROJECT",
+      }, null, 2),
+      "utf-8",
+    );
+
+    const meta = readPausedSessionMetadata(base);
+    assert.equal(meta, null);
+    assert.equal(existsSync(pausedPath), false);
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("readPausedSessionMetadata drops stale deep setup pseudo-unit metadata", () => {
+  const base = makeTmpBase();
+  try {
+    const runtimeDir = join(base, ".gsd", "runtime");
+    const pausedPath = join(runtimeDir, "paused-session.json");
+    mkdirSync(runtimeDir, { recursive: true });
+    writeFileSync(
+      pausedPath,
+      JSON.stringify({
+        milestoneId: "WORKFLOW-PREFS",
+        originalBasePath: base,
+        unitType: "workflow-preferences",
+        unitId: "WORKFLOW-PREFS",
+      }, null, 2),
+      "utf-8",
+    );
+
+    const meta = readPausedSessionMetadata(base);
+    assert.equal(meta, null);
+    assert.equal(existsSync(pausedPath), false);
+  } finally {
+    cleanup(base);
+  }
+});
+
 test("assessInterruptedSession returns none when no lock and no paused session exist", async () => {
   const base = makeTmpBase();
   try {

package/src/resources/extensions/gsd/tests/custom-engine-loop-integration.test.ts

@@ -12,7 +12,8 @@ import { mkdtempSync, rmSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
-import { autoLoop, resolveAgentEnd, _hasPendingResolveForTest, _resetPendingResolve } from "../auto-loop.js";
+import { autoLoop } from "../auto/loop.js";
+import { resolveAgentEnd, _hasPendingResolveForTest, _resetPendingResolve } from "../auto/resolve.js";
 import type { LoopDeps } from "../auto/loop-deps.js";
 import type { SessionLockStatus } from "../session-lock.js";
 import { writeGraph, readGraph, type WorkflowGraph, type GraphStep } from "../graph.ts";

package/src/resources/extensions/gsd/tests/db-path-worktree-symlink.test.ts

@@ -47,7 +47,7 @@ const symlinkResult = resolveProjectRootDbPath(symlinkPath);
 assertEq(
   symlinkResult,
   join("/home/user/myproject/.gsd/projects/abc123def", "gsd.db"),
-  "/.gsd/projects/<hash>/worktrees/ resolves to hash-level DB (#2517, updated for #2952)",
+  "/.gsd/projects/<hash>/worktrees/ resolves to external project state DB",
 );
 
 // Windows-style separators for symlink layout
@@ -57,7 +57,7 @@ if (sep === "\\") {
   assertEq(
     winResult,
     join("C:\\Users\\dev\\project\\.gsd\\projects\\abc123def", "gsd.db"),
-    "Windows /.gsd/projects/<hash>/worktrees/ resolves to hash-level DB",
+    "Windows /.gsd/projects/<hash>/worktrees/ resolves to external project state DB",
   );
 } else {
   // On non-Windows, test forward-slash variant explicitly
@@ -66,7 +66,7 @@ if (sep === "\\") {
   assertEq(
     fwdResult,
     join("/home/user/myproject/.gsd/projects/abc123def", "gsd.db"),
-    "Forward-slash /.gsd/projects/<hash>/worktrees/ resolves to hash-level DB on POSIX",
+    "Forward-slash /.gsd/projects/<hash>/worktrees/ resolves to external project state DB on POSIX",
   );
 }
 
@@ -76,7 +76,7 @@ const deepResult = resolveProjectRootDbPath(deepSymlinkPath);
 assertEq(
   deepResult,
   join("/home/user/myproject/.gsd/projects/deadbeef42", "gsd.db"),
-  "Deep /.gsd/projects/<hash>/worktrees/ path resolves to hash-level DB (#2952)",
+  "Deep /.gsd/projects/<hash>/worktrees/ path resolves to external project state DB",
 );
 
 // Non-worktree path should be unchanged

package/src/resources/extensions/gsd/tests/db-writer-path-containment.test.ts

@@ -0,0 +1,152 @@
+// GSD-2 + db-writer path containment: regression tests for path.relative-based traversal guard
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { openDatabase, closeDatabase } from "../gsd-db.ts";
+import { createWorkspace, scopeMilestone } from "../workspace.ts";
+import {
+  saveArtifactToDbForWorkspace,
+  saveArtifactToDbByScope,
+} from "../db-writer.ts";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+function makeProjectDir(base: string): string {
+  mkdirSync(join(base, ".gsd", "milestones"), { recursive: true });
+  return base;
+}
+
+// ─── Tests ───────────────────────────────────────────────────────────────────
+
+describe("saveArtifactToDbForWorkspace: path.relative containment guard", () => {
+  let tmp: string;
+  let projectDir: string;
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), "gsd-path-contain-fw-"));
+    projectDir = makeProjectDir(tmp);
+    openDatabase(join(projectDir, ".gsd", "gsd.db"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  // Attack: /foo/.gsd-other/file resolves to a path that startsWith("/foo/.gsd")
+  // but is NOT inside /foo/.gsd/. The path.relative fix correctly detects this.
+  test("rejects sibling directory that startsWith would have accepted", async () => {
+    // Create a sibling directory next to .gsd that shares the prefix
+    const sibling = join(projectDir, ".gsd-other");
+    mkdirSync(sibling, { recursive: true });
+
+    const ws = createWorkspace(projectDir);
+    // Craft an opts.path that traverses out of .gsd into .gsd-other
+    // resolve(gsdDir, "../.gsd-other/evil.md") === projectDir + "/.gsd-other/evil.md"
+    // which startsWith(projectDir + "/.gsd") because ".gsd-other" starts with ".gsd"
+    const traversalPath = "../.gsd-other/evil.md";
+
+    await assert.rejects(
+      () =>
+        saveArtifactToDbForWorkspace(ws, {
+          path: traversalPath,
+          artifact_type: "CONTEXT",
+          content: "attack",
+        }),
+      /path escapes \.gsd\/ directory/,
+    );
+  });
+
+  test("rejects absolute path input", async () => {
+    const ws = createWorkspace(projectDir);
+    await assert.rejects(
+      () =>
+        saveArtifactToDbForWorkspace(ws, {
+          path: "/etc/passwd",
+          artifact_type: "CONTEXT",
+          content: "attack",
+        }),
+      /path escapes \.gsd\/ directory/,
+    );
+  });
+
+  test("accepts a legitimate path inside .gsd/", async () => {
+    const ws = createWorkspace(projectDir);
+    // Should not throw — CONTEXT.md inside .gsd is valid
+    await assert.doesNotReject(() =>
+      saveArtifactToDbForWorkspace(ws, {
+        path: "CONTEXT.md",
+        artifact_type: "CONTEXT",
+        content: "# Context\n",
+      }),
+    );
+  });
+});
+
+describe("saveArtifactToDbByScope: path.relative containment guard", () => {
+  let tmp: string;
+  let projectDir: string;
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), "gsd-path-contain-bs-"));
+    projectDir = makeProjectDir(tmp);
+    openDatabase(join(projectDir, ".gsd", "gsd.db"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("rejects sibling directory that startsWith would have accepted", async () => {
+    const sibling = join(projectDir, ".gsd-other");
+    mkdirSync(sibling, { recursive: true });
+
+    const ws = createWorkspace(projectDir);
+    const scope = scopeMilestone(ws, "M001");
+    const traversalPath = "../.gsd-other/evil.md";
+
+    await assert.rejects(
+      () =>
+        saveArtifactToDbByScope(scope, {
+          path: traversalPath,
+          artifact_type: "CONTEXT",
+          content: "attack",
+        }),
+      /path escapes \.gsd\/ directory/,
+    );
+  });
+
+  test("rejects absolute path input", async () => {
+    const ws = createWorkspace(projectDir);
+    const scope = scopeMilestone(ws, "M001");
+    await assert.rejects(
+      () =>
+        saveArtifactToDbByScope(scope, {
+          path: "/etc/passwd",
+          artifact_type: "CONTEXT",
+          content: "attack",
+        }),
+      /path escapes \.gsd\/ directory/,
+    );
+  });
+
+  test("accepts a legitimate milestone-relative path inside .gsd/", async () => {
+    mkdirSync(join(projectDir, ".gsd", "milestones", "M001"), {
+      recursive: true,
+    });
+    const ws = createWorkspace(projectDir);
+    const scope = scopeMilestone(ws, "M001");
+    await assert.doesNotReject(() =>
+      saveArtifactToDbByScope(scope, {
+        path: "milestones/M001/M001-CONTEXT.md",
+        artifact_type: "CONTEXT",
+        content: "# Context\n",
+      }),
+    );
+  });
+});