gsd-pi 2.79.0-dev.ece5fd8ba → 2.80.0-dev.96f4d89d5

package/src/resources/extensions/gsd/tests/plan-slice-prompt.test.ts

@@ -1,3 +1,6 @@
+// Project/App: GSD-2
+// File Purpose: Verifies GSD planning prompt placeholder rendering and DB-backed tool guidance.
+
 import test from "node:test";
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
@@ -6,6 +9,7 @@ import { fileURLToPath } from "node:url";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const worktreePromptsDir = join(__dirname, "..", "prompts");
+const fixtureRoot = process.env.GSD_TEST_WORKSPACE_ROOT ?? process.cwd();
 
 function loadPrompt(name: string, vars: Record<string, string> = {}): string {
   const path = join(worktreePromptsDir, `${name}.md`);
@@ -17,15 +21,18 @@ function loadPrompt(name: string, vars: Record<string, string> = {}): string {
 }
 
 const BASE_VARS = {
-  workingDirectory: "/tmp/test-project",
+  workingDirectory: fixtureRoot,
   milestoneId: "M001", sliceId: "S01", sliceTitle: "Test Slice",
   slicePath: ".gsd/milestones/M001/slices/S01",
   roadmapPath: ".gsd/milestones/M001/M001-ROADMAP.md",
   researchPath: ".gsd/milestones/M001/slices/S01/S01-RESEARCH.md",
-  outputPath: "/tmp/test-project/.gsd/milestones/M001/slices/S01/S01-PLAN.md",
+  outputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "slices", "S01", "S01-PLAN.md"),
   inlinedContext: "--- test inlined context ---",
   dependencySummaries: "", executorContextConstraints: "",
   sourceFilePaths: "- **Requirements**: `.gsd/REQUIREMENTS.md`",
+  templatesDir: join(fixtureRoot, "templates"),
+  planTemplatePath: "C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\plan.md",
+  taskPlanTemplatePath: "C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\task-plan.md",
   skillActivation: "Load the relevant skills.",
 };
 
@@ -61,6 +68,19 @@ test("plan-slice prompt: DB-backed tool names survive template substitution", ()
   assert.ok(result.includes("canonical write path"), "canonical write path language should survive substitution");
 });
 
+test("plan-slice prompt: compact planning gates survive template substitution", () => {
+  const result = loadPrompt("plan-slice", { ...BASE_VARS, commitInstruction: "Do not commit." });
+  assert.ok(result.includes("planning-dispatch"), "planning-dispatch policy should remain visible");
+  assert.ok(result.includes("Bias toward \"roadmap is fine.\""), "roadmap reassessment brake should remain visible");
+  assert.ok(result.includes("Self-audit before finishing"), "self-audit gate should remain visible");
+  assert.ok(result.includes("Quality gates: non-trivial slices/tasks include specific Q3-Q7 coverage where applicable."));
+  assert.ok(result.includes("C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\plan.md"));
+  assert.ok(result.includes("C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\task-plan.md"));
+  assert.ok(!result.includes("{{templatesDir}}/plan.md"));
+  assert.ok(!result.includes("{{templatesDir}}/task-plan.md"));
+  assert.ok(!result.includes("{{"));
+});
+
 test("plan-slice prompt: footer references gsd_plan_slice tool, not direct write", () => {
   const result = loadPrompt("plan-slice", { ...BASE_VARS, commitInstruction: "Do not commit." });
   assert.ok(
@@ -91,7 +111,7 @@ test("domain-work prompts use skillActivation placeholder", () => {
 
 test("skillActivation default leaves no unresolved placeholder", () => {
   const result = loadPromptWithDefaultSkillActivation("execute-task", {
-    workingDirectory: "/tmp/test-project",
+    workingDirectory: fixtureRoot,
     milestoneId: "M001",
     sliceId: "S01",
     sliceTitle: "Test Slice",
@@ -104,7 +124,8 @@ test("skillActivation default leaves no unresolved placeholder", () => {
     carryForwardSection: "Carry forward",
     resumeSection: "Resume",
     priorTaskLines: "- (no prior tasks)",
-    taskSummaryPath: "/tmp/test-project/.gsd/milestones/M001/slices/S01/tasks/T01-SUMMARY.md",
+    templatesDir: join(fixtureRoot, "templates"),
+    taskSummaryPath: join(fixtureRoot, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01-SUMMARY.md"),
     inlinedTemplates: "Template",
     verificationBudget: "~10K chars",
     overridesSection: "",
@@ -116,7 +137,7 @@ test("skillActivation default leaves no unresolved placeholder", () => {
 
 test("custom skillActivation is substituted into execute-task", () => {
   const result = loadPrompt("execute-task", {
-    workingDirectory: "/tmp/test-project",
+    workingDirectory: fixtureRoot,
     milestoneId: "M001",
     sliceId: "S01",
     sliceTitle: "Test Slice",
@@ -129,7 +150,8 @@ test("custom skillActivation is substituted into execute-task", () => {
     carryForwardSection: "Carry forward",
     resumeSection: "Resume",
     priorTaskLines: "- (no prior tasks)",
-    taskSummaryPath: "/tmp/test-project/.gsd/milestones/M001/slices/S01/tasks/T01-SUMMARY.md",
+    templatesDir: join(fixtureRoot, "templates"),
+    taskSummaryPath: join(fixtureRoot, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01-SUMMARY.md"),
     inlinedTemplates: "Template",
     verificationBudget: "~10K chars",
     overridesSection: "",
@@ -153,12 +175,12 @@ test("guided resume prompt substitutes skillActivation", () => {
 
 test("research-milestone prompt substitutes skillActivation", () => {
   const result = loadPrompt("research-milestone", {
-    workingDirectory: "/tmp/test-project",
+    workingDirectory: fixtureRoot,
     milestoneId: "M001",
     milestoneTitle: "Test Milestone",
     milestonePath: ".gsd/milestones/M001",
     contextPath: ".gsd/milestones/M001/M001-CONTEXT.md",
-    outputPath: "/tmp/test-project/.gsd/milestones/M001/M001-RESEARCH.md",
+    outputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "M001-RESEARCH.md"),
     inlinedContext: "Context",
     skillDiscoveryMode: "manual",
     skillDiscoveryInstructions: " Discover skills manually.",
@@ -171,12 +193,12 @@ test("research-milestone prompt substitutes skillActivation", () => {
 
 test("research-milestone prompt references gsd_summary_save, not direct write", () => {
   const result = loadPrompt("research-milestone", {
-    workingDirectory: "/tmp/test-project",
+    workingDirectory: fixtureRoot,
     milestoneId: "M001",
     milestoneTitle: "Test Milestone",
     milestonePath: ".gsd/milestones/M001",
     contextPath: ".gsd/milestones/M001/M001-CONTEXT.md",
-    outputPath: "/tmp/test-project/.gsd/milestones/M001/M001-RESEARCH.md",
+    outputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "M001-RESEARCH.md"),
     inlinedContext: "Context",
     skillDiscoveryMode: "manual",
     skillDiscoveryInstructions: " Discover skills manually.",
@@ -199,7 +221,7 @@ test("research-milestone prompt references gsd_summary_save, not direct write",
 
 test("research-slice prompt substitutes skillActivation", () => {
   const result = loadPrompt("research-slice", {
-    workingDirectory: "/tmp/test-project",
+    workingDirectory: fixtureRoot,
     milestoneId: "M001",
     sliceId: "S01",
     sliceTitle: "Test Slice",
@@ -207,7 +229,7 @@ test("research-slice prompt substitutes skillActivation", () => {
     roadmapPath: ".gsd/milestones/M001/M001-ROADMAP.md",
     contextPath: ".gsd/milestones/M001/M001-CONTEXT.md",
     milestoneResearchPath: ".gsd/milestones/M001/M001-RESEARCH.md",
-    outputPath: "/tmp/test-project/.gsd/milestones/M001/slices/S01/S01-RESEARCH.md",
+    outputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "slices", "S01", "S01-RESEARCH.md"),
     inlinedContext: "Context",
     dependencySummaries: "",
     skillDiscoveryMode: "manual",
@@ -221,15 +243,15 @@ test("research-slice prompt substitutes skillActivation", () => {
 
 test("plan-milestone prompt substitutes skillActivation", () => {
   const result = loadPrompt("plan-milestone", {
-    workingDirectory: "/tmp/test-project",
+    workingDirectory: fixtureRoot,
     milestoneId: "M001",
     milestoneTitle: "Test Milestone",
     milestonePath: ".gsd/milestones/M001",
     contextPath: ".gsd/milestones/M001/M001-CONTEXT.md",
     researchPath: ".gsd/milestones/M001/M001-RESEARCH.md",
-    researchOutputPath: "/tmp/test-project/.gsd/milestones/M001/M001-RESEARCH.md",
-    outputPath: "/tmp/test-project/.gsd/milestones/M001/M001-ROADMAP.md",
-    secretsOutputPath: "/tmp/test-project/.gsd/milestones/M001/M001-SECRETS.md",
+    researchOutputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "M001-RESEARCH.md"),
+    outputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "M001-ROADMAP.md"),
+    secretsOutputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "M001-SECRETS.md"),
     inlinedContext: "Context",
     sourceFilePaths: "- source",
     skillDiscoveryMode: "manual",
@@ -241,6 +263,33 @@ test("plan-milestone prompt substitutes skillActivation", () => {
   assert.ok(!result.includes("{{skillActivation}}"));
 });
 
+test("plan-milestone prompt: compact planning gates survive template substitution", () => {
+  const result = loadPrompt("plan-milestone", {
+    workingDirectory: fixtureRoot,
+    milestoneId: "M001",
+    milestoneTitle: "Test Milestone",
+    milestonePath: ".gsd/milestones/M001",
+    contextPath: ".gsd/milestones/M001/M001-CONTEXT.md",
+    researchPath: ".gsd/milestones/M001/M001-RESEARCH.md",
+    researchOutputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "M001-RESEARCH.md"),
+    outputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "M001-ROADMAP.md"),
+    secretsOutputPath: join(fixtureRoot, ".gsd", "milestones", "M001", "M001-SECRETS.md"),
+    inlinedContext: "Context",
+    sourceFilePaths: "- source",
+    skillDiscoveryMode: "manual",
+    skillDiscoveryInstructions: " Discover skills manually.",
+    skillActivation: "Load milestone planning skills first.",
+  });
+
+  assert.ok(result.includes("Already Planned? Soft Brake"));
+  assert.ok(result.includes("gsd_plan_milestone"));
+  assert.ok(result.includes("Dependency format is comma-separated"));
+  assert.ok(result.includes("phases.progressive_planning"));
+  assert.ok(result.includes("Single-Slice Fast Path"));
+  assert.ok(result.includes("Secrets Manifest"));
+  assert.ok(!result.includes("{{"));
+});
+
 test("guided research slice prompt substitutes skillActivation", () => {
   const result = loadPrompt("guided-research-slice", {
     milestoneId: "M001",

package/src/resources/extensions/gsd/tests/plan-slice.test.ts

@@ -1,3 +1,5 @@
+// GSD Extension — Plan-slice tool integration tests.
+
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, readFileSync, existsSync, writeFileSync } from 'node:fs';
@@ -8,6 +10,7 @@ import { openDatabase, closeDatabase, insertMilestone, insertSlice, getSlice, ge
 import { handlePlanSlice } from '../tools/plan-slice.ts';
 import { parsePlan } from '../parsers-legacy.ts';
 import { parseTaskPlanFile } from '../files.ts';
+import { deriveState, invalidateStateCache } from '../state.ts';
 
 function makeTmpBase(): string {
   const base = mkdtempSync(join(tmpdir(), 'gsd-plan-slice-'));
@@ -98,6 +101,30 @@ test('handlePlanSlice writes slice/task planning state and renders plan artifact
   }
 });
 
+test('handlePlanSlice advances DB-derived state out of planning immediately', async () => {
+  const base = makeTmpBase();
+  openDatabase(join(base, '.gsd', 'gsd.db'));
+
+  try {
+    seedParentSlice();
+
+    invalidateStateCache();
+    const before = await deriveState(base);
+    assert.equal(before.phase, 'planning');
+    assert.equal(before.progress?.tasks?.total, 0);
+
+    const result = await handlePlanSlice(validParams(), base);
+    assert.ok(!('error' in result), `unexpected error: ${'error' in result ? result.error : ''}`);
+
+    invalidateStateCache();
+    const after = await deriveState(base);
+    assert.notEqual(after.phase, 'planning');
+    assert.equal(after.progress?.tasks?.total, 2);
+  } finally {
+    cleanup(base);
+  }
+});
+
 test('handlePlanSlice leaves omitted enrichment fields empty instead of rendering placeholders', async () => {
   const base = makeTmpBase();
   openDatabase(join(base, '.gsd', 'gsd.db'));

package/src/resources/extensions/gsd/tests/post-execution-checks.test.ts

@@ -304,6 +304,30 @@ describe("resolveImportPath", () => {
     assert.ok(!result.exists);
     assert.equal(result.resolvedPath, null);
   });
+
+  test("resolves dotted TS module stem like .server via extension probing", (t) => {
+    const dir = mkdtempSync(join(tmpdir(), "post-exec-test-server-dot-"));
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    mkdirSync(join(dir, "src"), { recursive: true });
+    writeFileSync(join(dir, "src", "route.server.ts"), "export {};\n");
+    writeFileSync(join(dir, "src", "main.ts"), "");
+
+    const result = resolveImportPath("./route.server", "src/main.ts", dir);
+    assert.ok(result.exists);
+    assert.ok(result.resolvedPath?.endsWith("route.server.ts"));
+  });
+
+  test("missing unknown explicit extension does not match code-extension shadow", (t) => {
+    const dir = mkdtempSync(join(tmpdir(), "post-exec-test-unknown-shadow-"));
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    mkdirSync(join(dir, "src"), { recursive: true });
+    writeFileSync(join(dir, "src", "video.mp4.ts"), "export {};\n");
+    writeFileSync(join(dir, "src", "main.ts"), "");
+
+    const result = resolveImportPath("./video.mp4", "src/main.ts", dir);
+    assert.ok(!result.exists);
+    assert.equal(result.resolvedPath, null);
+  });
 });
 
 // ─── Import Resolution Check Tests ───────────────────────────────────────────
@@ -334,6 +358,28 @@ describe("checkImportResolution", () => {
     }
   });
 
+  test("ignores generated React Router +types imports", () => {
+    tempDir = join(tmpdir(), `post-exec-test-${Date.now()}`);
+    mkdirSync(tempDir, { recursive: true });
+    mkdirSync(join(tempDir, "app", "routes"), { recursive: true });
+    writeFileSync(
+      join(tempDir, "app", "routes", "root.tsx"),
+      "import type { Route } from './+types/root';\nexport default function Root() { return null; }"
+    );
+
+    try {
+      const task = createTask({
+        id: "T01",
+        key_files: ["app/routes/root.tsx"],
+      });
+
+      const results = checkImportResolution(task, [], tempDir);
+      assert.deepEqual(results, []);
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
   test("fails when import doesn't resolve", () => {
     tempDir = join(tmpdir(), `post-exec-test-${Date.now()}`);
     mkdirSync(tempDir, { recursive: true });

package/src/resources/extensions/gsd/tests/pr-evidence-equivalence.test.ts

@@ -0,0 +1,102 @@
+// Project/App: GSD-2
+// File Purpose: Golden-fixture equivalence tests pinning PR-body output for buildPrEvidence and formatSwarmLanePRBody.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+import { buildPrEvidence, type PrEvidenceInput } from "../pr-evidence.ts";
+import {
+  formatSwarmLanePRBody,
+  type SwarmLanePRData,
+} from "../../github-sync/templates.ts";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const FIXTURES_DIR = join(__dirname, "fixtures", "pr-body");
+
+const UPDATE = process.env.UPDATE_GOLDENS === "1";
+
+function compareGolden(name: string, actual: string): void {
+  const path = join(FIXTURES_DIR, name);
+  if (UPDATE) {
+    writeFileSync(path, actual, "utf8");
+    return;
+  }
+  const expected = readFileSync(path, "utf8");
+  assert.equal(actual, expected, `golden mismatch for ${name}`);
+}
+
+const SHIP_BASIC: PrEvidenceInput = {
+  milestoneId: "M001",
+  milestoneTitle: "Authentication",
+  changeType: "feat",
+  linkedIssue: "Closes #123",
+  summaries: ["### S01\nImplemented login flow."],
+  roadmapItems: ["- [x] **S01: Login**"],
+  metrics: ["**Units executed:** 3"],
+  testsRun: ["npm test", "npm run typecheck:extensions"],
+  why: "Users need to authenticate before accessing protected resources.",
+  how: "Added password hash check and session token issuance.",
+  rollbackNotes: ["Revert the merge commit."],
+};
+
+const SHIP_EMPTY_OPTIONALS: PrEvidenceInput = {
+  milestoneId: "M001",
+  milestoneTitle: "Authentication",
+  changeType: "feat",
+};
+
+const SWARM_WITH_BLOCKERS: SwarmLanePRData = {
+  lane: {
+    id: "writer",
+    branch: "lane/single-writer",
+    owner: "@owner",
+    latestCommit: "abc1234",
+    changedContracts: ["WriterToken"],
+    testEvidence: ["npm run typecheck:extensions"],
+    blockers: ["Awaiting state-lane writer-sequence merge", "Parity report incomplete"],
+  },
+  impactArea: "Single-writer UOK metadata.",
+  transitionRisks: ["Writer token lifecycle regression"],
+  rollbackPlan: ["Disable writer sequence enrichment"],
+  linkedIssue: 123,
+};
+
+const SWARM_NO_BLOCKERS: SwarmLanePRData = {
+  lane: {
+    id: "writer",
+    branch: "lane/single-writer",
+    owner: "@owner",
+    latestCommit: "abc1234",
+    changedContracts: ["WriterToken"],
+    testEvidence: ["npm run typecheck:extensions"],
+  },
+  impactArea: "Single-writer UOK metadata.",
+  transitionRisks: ["Writer token lifecycle regression"],
+  rollbackPlan: ["Disable writer sequence enrichment"],
+  linkedIssue: 123,
+};
+
+test("pr-evidence golden: commands-ship basic", () => {
+  compareGolden("commands-ship-basic.md", buildPrEvidence(SHIP_BASIC).body);
+});
+
+test("pr-evidence golden: commands-ship empty optionals", () => {
+  compareGolden("commands-ship-empty-optionals.md", buildPrEvidence(SHIP_EMPTY_OPTIONALS).body);
+});
+
+test("pr-evidence golden: swarm-lane with blockers", () => {
+  const body = formatSwarmLanePRBody(SWARM_WITH_BLOCKERS);
+  compareGolden("swarm-lane-with-blockers.md", body);
+  // Cross-check: top-level ## Blockers heading must appear (regression guard
+  // for the silent-drop fixed in this PR).
+  assert.ok(body.includes("\n## Blockers\n"), "swarm-lane body must emit a top-level ## Blockers heading");
+});
+
+test("pr-evidence golden: swarm-lane no blockers (no Blockers heading)", () => {
+  const body = formatSwarmLanePRBody(SWARM_NO_BLOCKERS);
+  compareGolden("swarm-lane-no-blockers.md", body);
+  assert.ok(!body.includes("## Blockers"), "swarm-lane body without blockers must not emit ## Blockers heading");
+});

package/src/resources/extensions/gsd/tests/pr-evidence-hardening.test.ts

@@ -0,0 +1,165 @@
+// Project/App: GSD-2
+// File Purpose: Hardening tests for buildPrEvidence — HTML-comment stripping, fake commit-trailer removal, and per-item length capping.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildPrEvidence, type PrEvidenceInput } from "../pr-evidence.ts";
+
+test("pr-evidence hardening: strips HTML comments from summaries", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    summaries: ["visible<!-- hidden secret -->tail"],
+  });
+  assert.ok(!evidence.body.includes("<!--"), "raw <!-- must not appear");
+  assert.ok(!evidence.body.includes("hidden secret"), "comment contents must be stripped");
+  assert.ok(evidence.body.includes("visibletail"), "non-comment text must remain");
+});
+
+test("pr-evidence hardening: removes Co-Authored-By trailer from why", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    why: "Real reason here.\nCo-Authored-By: Evil <e@evil.com>\nMore reason.",
+  });
+  assert.ok(!evidence.body.includes("Evil <e@evil.com>"));
+  assert.ok(!/Co-Authored-By:/i.test(evidence.body));
+  assert.ok(evidence.body.includes("Real reason here."));
+  assert.ok(evidence.body.includes("More reason."));
+});
+
+test("pr-evidence hardening: removes Signed-off-by trailer from how", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    how: "Step one.\nSigned-off-by: Forged <f@x.com>\nStep two.",
+  });
+  assert.ok(!evidence.body.includes("Forged <f@x.com>"));
+  assert.ok(!/Signed-off-by:/i.test(evidence.body));
+  assert.ok(evidence.body.includes("Step one."));
+  assert.ok(evidence.body.includes("Step two."));
+});
+
+test("pr-evidence hardening: trailer-name match is case-insensitive", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    why: "ok\nco-authored-by: lower <l@l.com>\nSIGNED-OFF-BY: upper <u@u.com>\nend",
+  });
+  assert.ok(!evidence.body.includes("lower <l@l.com>"));
+  assert.ok(!evidence.body.includes("upper <u@u.com>"));
+  assert.ok(evidence.body.includes("ok"));
+  assert.ok(evidence.body.includes("end"));
+});
+
+test("pr-evidence hardening: caps oversize summaries item with truncation suffix", () => {
+  const big = "A".repeat(5 * 1024); // 5 KB
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    summaries: [big],
+  });
+  // Find the truncated A-block in the body and assert it is bounded.
+  const lines = evidence.body.split("\n");
+  const longLine = lines.find((l) => l.startsWith("AAAA"));
+  assert.ok(longLine, "expected truncated A-line in body");
+  assert.ok(longLine!.endsWith(" … [truncated]"), "must end with truncation suffix");
+  assert.ok(
+    Buffer.byteLength(longLine!, "utf8") <= 2048,
+    `truncated item must be within 2 KB cap, got ${Buffer.byteLength(longLine!, "utf8")}`,
+  );
+});
+
+test("pr-evidence hardening: HTML comment split across summary items is preserved literally", () => {
+  // Documented behavior: each item is sanitized independently. A comment
+  // that begins in one item and closes in the next is NOT joined, so the
+  // open/close markers remain as literal text. This is intentional — joining
+  // items before sanitizing would let an attacker straddle items to inject
+  // an aligned comment that hides the second item from rendered view.
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    summaries: ["first item ends <!--", "--> second item begins"],
+  });
+  // The literal markers survive because each item was sanitized alone.
+  assert.ok(evidence.body.includes("<!--"), "open marker preserved as literal");
+  assert.ok(evidence.body.includes("-->"), "close marker preserved as literal");
+  assert.ok(evidence.body.includes("first item ends"));
+  assert.ok(evidence.body.includes("second item begins"));
+});
+
+test("pr-evidence hardening: clean input is byte-identical to pre-hardening output", () => {
+  // This test is the contract that protects the golden fixtures: the
+  // sanitizer must be a true no-op for well-formed input. If this fails,
+  // there is a bug in the sanitizer (not in the goldens).
+  const cleanInput: PrEvidenceInput = {
+    milestoneId: "M001",
+    milestoneTitle: "Authentication",
+    changeType: "feat",
+    linkedIssue: "Closes #123",
+    summaries: ["### S01\nImplemented login flow."],
+    blockers: ["Awaiting design review"],
+    roadmapItems: ["- [x] **S01: Login**"],
+    metrics: ["**Units executed:** 3"],
+    testsRun: ["npm test", "npm run typecheck:extensions"],
+    why: "Users need to authenticate before accessing protected resources.",
+    how: "Added password hash check and session token issuance.",
+    rollbackNotes: ["Revert the merge commit."],
+  };
+
+  const expected = [
+    "## TL;DR",
+    "",
+    "**What:** Ship milestone M001 - Authentication",
+    "**Why:** Users need to authenticate before accessing protected resources.",
+    "**How:** Added password hash check and session token issuance.",
+    "",
+    "## What",
+    "",
+    "### S01\nImplemented login flow.",
+    "",
+    "## Blockers",
+    "",
+    "- Awaiting design review",
+    "",
+    "## Why",
+    "",
+    "Users need to authenticate before accessing protected resources.",
+    "",
+    "## How",
+    "",
+    "Added password hash check and session token issuance.",
+    "",
+    "## Linked Issue",
+    "",
+    "Closes #123",
+    "",
+    "## Roadmap",
+    "",
+    "- [x] **S01: Login**",
+    "",
+    "## Metrics",
+    "",
+    "- **Units executed:** 3",
+    "",
+    "## Tests Run",
+    "",
+    "- npm test",
+    "- npm run typecheck:extensions",
+    "",
+    "## Change Type",
+    "",
+    "- [x] `feat` - New feature or capability",
+    "- [ ] `fix` - Bug fix",
+    "- [ ] `refactor` - Code restructuring",
+    "- [ ] `test` - Adding or updating tests",
+    "- [ ] `docs` - Documentation only",
+    "- [ ] `chore` - Build, CI, or tooling changes",
+    "",
+    "## Rollback And Compatibility",
+    "",
+    "- Revert the merge commit.",
+    "",
+    "## AI Assistance Disclosure",
+    "",
+    "This PR was prepared with AI assistance.",
+  ].join("\n");
+
+  const actual = buildPrEvidence(cleanInput).body;
+  assert.equal(actual, expected, "clean input must produce byte-identical output (sanitizer is no-op)");
+});

package/src/resources/extensions/gsd/tests/pr-evidence.test.ts

@@ -0,0 +1,79 @@
+// Project/App: GSD-2
+// File Purpose: Tests for the shared GSD pull request evidence generator.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildPrEvidence, type PrChangeType } from "../pr-evidence.ts";
+
+test("pr-evidence: generated body includes contribution-required sections", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    milestoneTitle: "Authentication",
+    linkedIssue: "Closes #123",
+    summaries: ["### S01\nImplemented login."],
+    roadmapItems: ["- [x] **S01: Login**"],
+    metrics: ["**Units executed:** 3"],
+    testsRun: ["npm test"],
+    rollbackNotes: ["Revert the merge commit."],
+  });
+
+  assert.equal(evidence.title, "feat: Authentication");
+  for (const section of [
+    "## TL;DR",
+    "## What",
+    "## Why",
+    "## How",
+    "## Linked Issue",
+    "## Tests Run",
+    "## Change Type",
+    "## Rollback And Compatibility",
+    "## AI Assistance Disclosure",
+  ]) {
+    assert.ok(evidence.body.includes(section), `missing section: ${section}`);
+  }
+  assert.ok(evidence.body.includes("Closes #123"));
+  assert.ok(evidence.body.includes("npm test"));
+  assert.ok(evidence.body.includes("This PR was prepared with AI assistance."));
+});
+
+test("pr-evidence: every change type selects exactly one checklist row", () => {
+  const changeTypes: PrChangeType[] = ["feat", "fix", "refactor", "test", "docs", "chore"];
+
+  for (const changeType of changeTypes) {
+    const evidence = buildPrEvidence({ milestoneId: "M001", changeType });
+    const checkedRows = evidence.body.split("\n").filter((line) => line.startsWith("- [x] `"));
+    assert.deepEqual(checkedRows, [
+      `- [x] \`${changeType}\` - ${{
+        feat: "New feature or capability",
+        fix: "Bug fix",
+        refactor: "Code restructuring",
+        test: "Adding or updating tests",
+        docs: "Documentation only",
+        chore: "Build, CI, or tooling changes",
+      }[changeType]}`,
+    ]);
+  }
+});
+
+test("pr-evidence: missing issue, tests, and rollback data are explicit", () => {
+  const evidence = buildPrEvidence({ milestoneId: "M001", aiAssisted: false });
+
+  assert.ok(evidence.body.includes("Not specified. Add an issue link"));
+  assert.ok(evidence.body.includes("Not specified. Add exact verification commands"));
+  assert.ok(evidence.body.includes("No behavior-changing rollback notes recorded."));
+  assert.ok(!evidence.body.includes("## AI Assistance Disclosure"));
+});
+
+test("pr-evidence: subject metadata supports non-milestone PRs", () => {
+  const evidence = buildPrEvidence({
+    milestoneId: "M001",
+    subjectId: "S01",
+    subjectKind: "slice",
+    milestoneTitle: "Auth Slice",
+  });
+
+  assert.equal(evidence.title, "feat: Auth Slice");
+  assert.ok(evidence.body.includes("Ship slice S01 - Auth Slice"));
+  assert.ok(evidence.body.includes("Slice work is complete and ready for review."));
+});