gsd-pi 2.80.0-dev.96f4d89d5 → 2.80.0-dev.b0acf17e9

package/src/resources/extensions/gsd/tests/exec-sandbox.test.ts

@@ -7,6 +7,7 @@ import { join } from 'node:path';
 import { EXEC_DEFAULTS, runExecSandbox, type ExecSandboxOptions } from '../exec-sandbox.ts';
 import { buildExecOptions, executeGsdExec } from '../tools/exec-tool.ts';
 import { isContextModeEnabled } from '../preferences-types.ts';
+import { validatePreferences } from '../preferences-validation.ts';
 
 function freshBase(): string {
   return mkdtempSync(join(tmpdir(), 'gsd-exec-test-'));
@@ -174,6 +175,52 @@ test('executeGsdExec: runs when enabled explicitly set to true', async () => {
   }
 });
 
+test('executeGsdExec: forwards custom exec_env_allowlist from preferences', async () => {
+  const base = freshBase();
+  try {
+    const result = await executeGsdExec(
+      {
+        runtime: 'bash',
+        script: 'printf "allowed=%s blocked=%s\\n" "$GSD_ALLOWED" "$GSD_BLOCKED"',
+      },
+      {
+        baseDir: base,
+        preferences: {
+          context_mode: {
+            enabled: true,
+            exec_env_allowlist: ['GSD_ALLOWED'],
+          },
+        },
+        env: {
+          PATH: '/usr/bin:/bin',
+          HOME: '/tmp',
+          GSD_ALLOWED: 'yes',
+          GSD_BLOCKED: 'no',
+        },
+      },
+    );
+    assert.ok(!result.isError);
+    assert.match(result.content[0].text, /allowed=yes blocked=/);
+    assert.doesNotMatch(result.content[0].text, /blocked=no/);
+  } finally {
+    cleanup(base);
+  }
+});
+
+test('executeGsdExec: enforces per-call timeout override end-to-end', async () => {
+  const base = freshBase();
+  try {
+    const result = await executeGsdExec(
+      { runtime: 'bash', script: 'sleep 2', timeout_ms: 1 },
+      { baseDir: base, preferences: { context_mode: { enabled: true, exec_timeout_ms: 10_000 } } },
+    );
+    assert.equal(result.details.timed_out, true);
+    assert.equal(result.isError, true);
+  } finally {
+    cleanup(base);
+  }
+});
+
 test('executeGsdExec: rejects empty script', async () => {
   const base = freshBase();
   try {
@@ -188,6 +235,24 @@ test('executeGsdExec: rejects empty script', async () => {
   }
 });
 
+test('validatePreferences: rejects invalid context_mode preference values', () => {
+  const result = validatePreferences({
+    context_mode: {
+      enabled: 'false',
+      exec_timeout_ms: 999,
+      exec_stdout_cap_bytes: 1,
+      exec_digest_chars: -1,
+      exec_env_allowlist: ['GOOD_NAME', 'bad-name'],
+    },
+  } as any);
+  assert.ok(result.errors.length > 0);
+  assert.ok(result.errors.includes('context_mode.enabled must be a boolean'));
+  assert.ok(result.errors.includes('context_mode.exec_timeout_ms must be a number between 1000 and 600000'));
+  assert.ok(result.errors.includes('context_mode.exec_stdout_cap_bytes must be a number between 4096 and 16777216'));
+  assert.ok(result.errors.includes('context_mode.exec_digest_chars must be a number between 0 and 4000'));
+  assert.ok(result.errors.includes('context_mode.exec_env_allowlist must be an array of valid env var names'));
+});
+
 test('isContextModeEnabled: defaults to true; only explicit false disables', () => {
   assert.equal(isContextModeEnabled(undefined), true, 'undefined prefs → on');
   assert.equal(isContextModeEnabled(null), true, 'null prefs → on');

package/src/resources/extensions/gsd/tests/execute-task-rendering.test.ts

@@ -39,6 +39,7 @@ test("execute-task prompt renders compact execution and completion gates", async
     taskPlanPath: ".gsd/milestones/M001/slices/S01/tasks/T01-PLAN.md",
     priorTaskLines: "- None",
     skillActivation: "Load relevant skills.",
+    inlinedTemplates: "### Output Template: Task Summary\nSource: `templates/task-summary.md`",
     templatesDir: join(fixtureRoot, "templates"),
     taskSummaryTemplatePath: "C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\task-summary.md",
     verificationBudget: "~10K chars",
@@ -46,12 +47,14 @@ test("execute-task prompt renders compact execution and completion gates", async
   });
 
   assert.match(prompt, /You execute\./);
-  assert.match(prompt, /Call `memory_query`/);
+  assert.match(prompt, /Call `memory_query`.*only when no injected memory block exists/s);
   assert.match(prompt, /Before any `Write` that creates an artifact or output file/);
   assert.match(prompt, /Build real behavior/);
   assert.match(prompt, /Background process rule/);
   assert.match(prompt, /blocker_discovered: true/);
-  assert.match(prompt, /C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\task-summary\.md/);
+  assert.match(prompt, /Use the inlined Task Summary template below/);
+  assert.match(prompt, /Read `C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\task-summary\.md` only if the inlined template is absent or visibly truncated/);
+  assert.match(prompt, /### Output Template: Task Summary/);
   assert.doesNotMatch(prompt, /\{\{templatesDir\}\}\/task-summary\.md/);
   assert.match(prompt, /Call `gsd_task_complete`/);
   assert.match(prompt, /Do not run git commands/);

package/src/resources/extensions/gsd/tests/fast-forward-reused-milestone-branch.test.ts

@@ -0,0 +1,219 @@
+// GSD-2 + src/resources/extensions/gsd/tests/fast-forward-reused-milestone-branch.test.ts
+// Regression: when createAutoWorktree reuses an existing milestone branch,
+// it must be fast-forwarded onto integration so the next milestone forks
+// from up-to-date code (#5538-followup).
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+
+import {
+  fastForwardReusedMilestoneBranchIfSafe,
+  _isBranchCheckedOutElsewhere,
+} from "../auto-worktree.js";
+
+const NO_PROMPT_ENV = {
+  ...process.env,
+  GIT_TERMINAL_PROMPT: "0",
+  GIT_AUTHOR_NAME: "test",
+  GIT_AUTHOR_EMAIL: "test@example.com",
+  GIT_COMMITTER_NAME: "test",
+  GIT_COMMITTER_EMAIL: "test@example.com",
+};
+
+function git(cwd: string, ...args: string[]): string {
+  return execFileSync("git", args, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8",
+    env: NO_PROMPT_ENV,
+  });
+}
+
+function rev(cwd: string, ref: string): string {
+  return git(cwd, "rev-parse", ref).trim();
+}
+
+describe("fastForwardReusedMilestoneBranchIfSafe", () => {
+  let repo: string;
+
+  beforeEach(() => {
+    repo = mkdtempSync(join(tmpdir(), "ff-reused-branch-"));
+    git(repo, "init", "-q", "-b", "main");
+    git(repo, "config", "user.email", "test@example.com");
+    git(repo, "config", "user.name", "test");
+    writeFileSync(join(repo, "seed.txt"), "seed\n");
+    git(repo, "add", "seed.txt");
+    git(repo, "commit", "-q", "-m", "initial");
+  });
+
+  afterEach(() => {
+    rmSync(repo, { recursive: true, force: true });
+  });
+
+  test("fast-forwards a milestone branch that is strictly behind integration (regression: stale base)", () => {
+    // Create milestone/M001 from main's initial commit, then advance main.
+    git(repo, "branch", "milestone/M001");
+    const m001Initial = rev(repo, "milestone/M001");
+
+    writeFileSync(join(repo, "seed.txt"), "advanced\n");
+    git(repo, "add", "seed.txt");
+    git(repo, "commit", "-q", "-m", "main moved forward");
+    const mainTip = rev(repo, "main");
+
+    assert.notEqual(m001Initial, mainTip, "main must be ahead before the test");
+
+    fastForwardReusedMilestoneBranchIfSafe(repo, "M001", "milestone/M001");
+
+    assert.equal(
+      rev(repo, "milestone/M001"),
+      mainTip,
+      "milestone/M001 must be fast-forwarded to main's tip",
+    );
+  });
+
+  test("does not touch a milestone branch that has its own commits ahead", () => {
+    // Branch from main, add a unique commit, then advance main.
+    git(repo, "checkout", "-q", "-b", "milestone/M001");
+    writeFileSync(join(repo, "milestone-only.txt"), "milestone work\n");
+    git(repo, "add", "milestone-only.txt");
+    git(repo, "commit", "-q", "-m", "M001 work");
+    const milestoneTip = rev(repo, "milestone/M001");
+
+    git(repo, "checkout", "-q", "main");
+    writeFileSync(join(repo, "seed.txt"), "advanced\n");
+    git(repo, "add", "seed.txt");
+    git(repo, "commit", "-q", "-m", "main moved forward");
+
+    fastForwardReusedMilestoneBranchIfSafe(repo, "M001", "milestone/M001");
+
+    assert.equal(
+      rev(repo, "milestone/M001"),
+      milestoneTip,
+      "diverged milestone branch must NOT be touched (would lose work)",
+    );
+  });
+
+  test("is a no-op when milestone branch is already up-to-date with main", () => {
+    git(repo, "branch", "milestone/M001");
+    const before = rev(repo, "milestone/M001");
+
+    fastForwardReusedMilestoneBranchIfSafe(repo, "M001", "milestone/M001");
+
+    assert.equal(rev(repo, "milestone/M001"), before, "ref must not move");
+  });
+
+  test("does nothing when the milestone branch does not exist", () => {
+    // Should silently return — no error, no side effects.
+    assert.doesNotThrow(() =>
+      fastForwardReusedMilestoneBranchIfSafe(repo, "M999", "milestone/M999"),
+    );
+  });
+
+  test("does nothing in a non-git directory", () => {
+    const nonRepo = mkdtempSync(join(tmpdir(), "ff-not-a-repo-"));
+    try {
+      assert.doesNotThrow(() =>
+        fastForwardReusedMilestoneBranchIfSafe(nonRepo, "M001", "milestone/M001"),
+      );
+    } finally {
+      rmSync(nonRepo, { recursive: true, force: true });
+    }
+  });
+
+  test("skips fast-forward when branch is checked out in another worktree (peer-review regression)", () => {
+    // Codex peer review caught: `nativeUpdateRef` succeeds even when the
+    // branch is checked out in a linked worktree, leaving that worktree's
+    // HEAD inconsistent with its index/work tree. The fix calls
+    // `nativeWorktreeList` first and skips the FF if any worktree owns the
+    // target branch. This test sets up the exact scenario.
+    git(repo, "branch", "milestone/M001");
+    const m001Initial = rev(repo, "milestone/M001");
+
+    // Add a linked worktree that checks out milestone/M001.
+    const wtPath = join(repo, "..", `${basename(repo)}-wt`);
+    git(repo, "worktree", "add", wtPath, "milestone/M001");
+
+    // Advance main so a fast-forward would otherwise apply.
+    writeFileSync(join(repo, "seed.txt"), "advanced\n");
+    git(repo, "add", "seed.txt");
+    git(repo, "commit", "-q", "-m", "main moved forward");
+
+    try {
+      fastForwardReusedMilestoneBranchIfSafe(repo, "M001", "milestone/M001");
+
+      assert.equal(
+        rev(repo, "milestone/M001"),
+        m001Initial,
+        "milestone/M001 must NOT move while a linked worktree has it checked out",
+      );
+    } finally {
+      git(repo, "worktree", "remove", "--force", wtPath);
+      rmSync(wtPath, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("_isBranchCheckedOutElsewhere", () => {
+  let repo: string;
+
+  beforeEach(() => {
+    repo = mkdtempSync(join(tmpdir(), "is-checked-out-"));
+    git(repo, "init", "-q", "-b", "main");
+    git(repo, "config", "user.email", "test@example.com");
+    git(repo, "config", "user.name", "test");
+    writeFileSync(join(repo, "seed.txt"), "seed\n");
+    git(repo, "add", "seed.txt");
+    git(repo, "commit", "-q", "-m", "initial");
+  });
+
+  afterEach(() => {
+    rmSync(repo, { recursive: true, force: true });
+  });
+
+  test("returns true when branch is checked out in a linked worktree", () => {
+    git(repo, "branch", "milestone/M001");
+    const wtPath = join(repo, "..", `${basename(repo)}-wt`);
+    git(repo, "worktree", "add", wtPath, "milestone/M001");
+    try {
+      assert.equal(_isBranchCheckedOutElsewhere(repo, "milestone/M001"), true);
+    } finally {
+      git(repo, "worktree", "remove", "--force", wtPath);
+      rmSync(wtPath, { recursive: true, force: true });
+    }
+  });
+
+  test("returns true when branch is checked out in the main worktree itself", () => {
+    // The default checkout. `git worktree list --porcelain` reports the
+    // primary worktree too, so a branch checked out there counts as
+    // "checked out elsewhere" relative to a fresh ref update intent.
+    git(repo, "checkout", "-q", "-b", "milestone/M002");
+    assert.equal(_isBranchCheckedOutElsewhere(repo, "milestone/M002"), true);
+  });
+
+  test("returns false when branch exists but is not checked out anywhere", () => {
+    git(repo, "branch", "milestone/M003");
+    assert.equal(_isBranchCheckedOutElsewhere(repo, "milestone/M003"), false);
+  });
+
+  test("returns false for an unknown branch in a clean repo", () => {
+    assert.equal(_isBranchCheckedOutElsewhere(repo, "milestone/M999"), false);
+  });
+
+  test("returns false on a non-git directory (empty worktree list)", () => {
+    // nativeWorktreeList does not throw on a non-repo — it returns []. The
+    // parent function `fastForwardReusedMilestoneBranchIfSafe` never reaches
+    // this code path on a non-repo because `nativeBranchExists` short-circuits
+    // earlier. Documenting actual behavior so future readers don't expect a
+    // fail-safe `true` here.
+    const nonRepo = mkdtempSync(join(tmpdir(), "is-checked-out-not-repo-"));
+    try {
+      assert.equal(_isBranchCheckedOutElsewhere(nonRepo, "milestone/M001"), false);
+    } finally {
+      rmSync(nonRepo, { recursive: true, force: true });
+    }
+  });
+});

package/src/resources/extensions/gsd/tests/finalize-survivor-branch.test.ts

@@ -0,0 +1,132 @@
+// GSD-2 + src/resources/extensions/gsd/tests/finalize-survivor-branch.test.ts
+// Regression: a thrown error from `_mergeBranchMode` (made fail-loud in
+// commit 68ef58a3c) must be caught at the survivor-finalize call site so
+// bootstrap surfaces an error notify instead of an unhandled exception
+// propagating to the slash-command caller (#5549 post-merge audit, R2).
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { _finalizeSurvivorBranch } from "../auto-start.js";
+import type { WorktreeResolver } from "../worktree-resolver.js";
+
+interface FakeResolverState {
+  mergeCalls: Array<{ milestoneId: string }>;
+  shouldThrow?: unknown;
+}
+
+function fakeResolver(state: FakeResolverState): WorktreeResolver {
+  return {
+    mergeAndExit: (milestoneId: string) => {
+      state.mergeCalls.push({ milestoneId });
+      if (state.shouldThrow) throw state.shouldThrow;
+    },
+  } as unknown as WorktreeResolver;
+}
+
+interface FakeUiState {
+  notifications: Array<{ message: string; level: string }>;
+}
+
+function fakeUi(state: FakeUiState): {
+  notify: (msg: string, level?: "info" | "warning" | "error" | "success") => void;
+} {
+  return {
+    notify: (message: string, level?: "info" | "warning" | "error" | "success") => {
+      state.notifications.push({ message, level: level ?? "info" });
+    },
+  };
+}
+
+test("happy path: survivor merge runs, returns merged:true, info notify announces the merge", () => {
+  const resolverState: FakeResolverState = { mergeCalls: [] };
+  const uiState: FakeUiState = { notifications: [] };
+  const result = _finalizeSurvivorBranch(
+    fakeResolver(resolverState),
+    "M001",
+    fakeUi(uiState),
+  );
+
+  assert.deepEqual(result, { merged: true });
+  assert.deepEqual(resolverState.mergeCalls, [{ milestoneId: "M001" }]);
+  assert.equal(uiState.notifications.length, 1);
+  assert.equal(uiState.notifications[0].level, "info");
+  assert.match(
+    uiState.notifications[0].message,
+    /Milestone M001 is complete but branch\/worktree was not finalized/,
+  );
+});
+
+test("regression: thrown error from mergeAndExit (e.g. wrong-branch) is caught and surfaced as error notify", () => {
+  // Pre-PR-5549 commit 5: `_mergeBranchMode` returned false silently.
+  // Post-commit 5: it throws. Without this fix, the throw at auto-start.ts
+  // line ~810 would bubble through `bootstrapAutoSession` to
+  // `startAutoDetached`'s top-level .catch as an unhandled-exception log
+  // — observable as a stack trace instead of a clean failure notification.
+  const boom = new Error("dirty working tree blocks checkout");
+  const resolverState: FakeResolverState = { mergeCalls: [], shouldThrow: boom };
+  const uiState: FakeUiState = { notifications: [] };
+
+  // Must not throw.
+  const result = _finalizeSurvivorBranch(
+    fakeResolver(resolverState),
+    "M001",
+    fakeUi(uiState),
+  );
+
+  assert.equal(result.merged, false);
+  assert.equal(result.error, boom);
+
+  // Two notifies: info (announce) + error (the failure detail).
+  assert.equal(uiState.notifications.length, 2);
+  assert.equal(uiState.notifications[0].level, "info");
+  assert.equal(uiState.notifications[1].level, "error");
+  assert.match(
+    uiState.notifications[1].message,
+    /Survivor-branch finalization for M001 failed/,
+  );
+  assert.match(uiState.notifications[1].message, /dirty working tree blocks checkout/);
+  assert.match(uiState.notifications[1].message, /Resolve manually/);
+});
+
+test("non-Error thrown values are stringified into the user-facing message", () => {
+  const resolverState: FakeResolverState = {
+    mergeCalls: [],
+    shouldThrow: "git lock contention",
+  };
+  const uiState: FakeUiState = { notifications: [] };
+
+  const result = _finalizeSurvivorBranch(
+    fakeResolver(resolverState),
+    "M001",
+    fakeUi(uiState),
+  );
+
+  assert.equal(result.merged, false);
+  assert.equal(result.error, resolverState.shouldThrow);
+  assert.equal(uiState.notifications[1].level, "error");
+  assert.match(uiState.notifications[1].message, /git lock contention/);
+});
+
+test("inner notifications from mergeAndExit's NotifyCtx reach the same UI", () => {
+  // The resolver's NotifyCtx must be wired to ui.notify so messages emitted
+  // inside mergeAndExit (e.g. "Milestone Mxxx merged. Pushed to remote.")
+  // appear in the same UI stream as the outer notifies.
+  const uiState: FakeUiState = { notifications: [] };
+  const ui = fakeUi(uiState);
+
+  const resolver = {
+    mergeAndExit: (_milestoneId: string, ctx: { notify: (msg: string, level?: "info" | "warning" | "error" | "success") => void }) => {
+      ctx.notify("Milestone M001 merged.", "success");
+    },
+  } as unknown as WorktreeResolver;
+
+  const result = _finalizeSurvivorBranch(resolver, "M001", ui);
+
+  assert.equal(result.merged, true);
+  // 1: outer announce
+  // 2: inner success
+  assert.equal(uiState.notifications.length, 2);
+  assert.equal(uiState.notifications[1].level, "success");
+  assert.equal(uiState.notifications[1].message, "Milestone M001 merged.");
+});

package/src/resources/extensions/gsd/tests/flat-rate-routing-guard.test.ts

@@ -6,14 +6,11 @@
 
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join } from "node:path";
 import { buildFlatRateContext, isFlatRateProvider, resolvePreferredModelConfig } from "../auto-model-selection.ts";
 
-const __dirname_4386 = dirname(fileURLToPath(import.meta.url));
-
 describe("flat-rate provider routing guard (#3453)", () => {
 
   test("isFlatRateProvider returns true for github-copilot", () => {
@@ -306,18 +303,3 @@ describe("flat-rate routing opt-in (#4386)", () => {
     );
   });
 });
-
-// ─── Banner transparency: auto-start respects the opt-in (#4386) ────────────
-
-describe("auto-start banner respects allow_flat_rate_providers (#4386)", () => {
-  test("banner expression gates flat-rate disable on allow_flat_rate_providers", () => {
-    const src = readFileSync(
-      join(__dirname_4386, "..", "auto-start.ts"),
-      "utf-8",
-    );
-    assert.ok(
-      src.includes("routingConfig.allow_flat_rate_providers"),
-      "auto-start banner must read allow_flat_rate_providers so the banner reflects the opt-in",
-    );
-  });
-});

package/src/resources/extensions/gsd/tests/frontmatter-parse-noise.test.ts

@@ -7,36 +7,28 @@
 
 import { describe, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const prefsSrc = readFileSync(
-  join(__dirname, '..', 'preferences.ts'),
-  'utf-8',
-);
+import { _resetParseWarningFlag, parsePreferencesMarkdown } from "../preferences.ts";
+import { drainLogs } from "../workflow-logger.ts";
 
 describe('frontmatter parse noise suppression (#3693)', () => {
-  test('_warnedFrontmatterParse flag is defined', () => {
-    assert.match(prefsSrc, /_warnedFrontmatterParse/,
-      '_warnedFrontmatterParse flag should exist in preferences.ts');
-  });
+  test('invalid frontmatter emits one warning per reset', () => {
+    _resetParseWarningFlag();
+    drainLogs();
 
-  test('parseFrontmatterBlock function exists', () => {
-    assert.match(prefsSrc, /function parseFrontmatterBlock\(/,
-      'parseFrontmatterBlock function should be defined');
-  });
+    const invalidPrefs = [
+      "---",
+      "models: [unterminated",
+      "---",
+    ].join("\n");
 
-  test('flag is checked before warning', () => {
-    assert.match(prefsSrc, /if\s*\(\s*!_warnedFrontmatterParse\s*\)/,
-      'should check !_warnedFrontmatterParse before logging');
-  });
+    assert.deepEqual(parsePreferencesMarkdown(invalidPrefs), {});
+    assert.deepEqual(parsePreferencesMarkdown(invalidPrefs), {});
 
-  test('flag is set to true after first warning', () => {
-    assert.match(prefsSrc, /_warnedFrontmatterParse\s*=\s*true/,
-      'should set _warnedFrontmatterParse = true after warning');
+    const warnings = drainLogs().filter((entry) =>
+      entry.severity === "warn" &&
+      entry.component === "guided" &&
+      entry.message.includes("YAML parse error in preferences frontmatter")
+    );
+    assert.equal(warnings.length, 1);
   });
 });

package/src/resources/extensions/gsd/tests/gsd-db.test.ts

@@ -30,6 +30,10 @@ import {
   insertTask,
   getTask,
   getSliceTasks,
+  deleteMilestone,
+  clearEngineHierarchy,
+  recordMilestoneCommitAttribution,
+  getMilestoneCommitAttributionShas,
   checkpointDatabase,
   refreshOpenDatabaseFromDisk,
   tryCreateMemoriesFts,
@@ -1047,6 +1051,46 @@ describe('gsd-db', () => {
     });
   });
 
+  // ─── milestone_commit_attributions teardown ───────────────────────────────
+
+  describe('milestone commit attribution teardown', () => {
+    test('deleteMilestone removes persisted milestone commit attributions', () => {
+      openDatabase(':memory:');
+      insertMilestone({ id: 'M001', title: 'Milestone', status: 'active' });
+      recordMilestoneCommitAttribution({
+        commitSha: '0123456789abcdef0123456789abcdef01234567',
+        milestoneId: 'M001',
+        source: 'backfill',
+        confidence: 0.8,
+        files: ['app.js'],
+        createdAt: '2026-05-05T00:00:00.000Z',
+      });
+
+      assert.deepEqual(getMilestoneCommitAttributionShas('M001'), ['0123456789abcdef0123456789abcdef01234567']);
+      deleteMilestone('M001');
+      assert.deepEqual(getMilestoneCommitAttributionShas('M001'), []);
+      closeDatabase();
+    });
+
+    test('clearEngineHierarchy removes persisted milestone commit attributions', () => {
+      openDatabase(':memory:');
+      insertMilestone({ id: 'M001', title: 'Milestone', status: 'active' });
+      recordMilestoneCommitAttribution({
+        commitSha: 'fedcba9876543210fedcba9876543210fedcba98',
+        milestoneId: 'M001',
+        source: 'backfill',
+        confidence: 0.8,
+        files: ['app.js'],
+        createdAt: '2026-05-05T00:00:00.000Z',
+      });
+
+      assert.deepEqual(getMilestoneCommitAttributionShas('M001'), ['fedcba9876543210fedcba9876543210fedcba98']);
+      clearEngineHierarchy();
+      assert.deepEqual(getMilestoneCommitAttributionShas('M001'), []);
+      closeDatabase();
+    });
+  });
+
   // ─── getDbStatus ───────────────────────────────────────────────────────────
 
   describe('getDbStatus', () => {

package/src/resources/extensions/gsd/tests/has-pending-deep-stage.test.ts

@@ -15,7 +15,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 
-import { hasPendingDeepStage } from "../auto-dispatch.ts";
+import { hasPendingDeepStage, shouldRunDeepProjectSetup } from "../auto-dispatch.ts";
 import type { GSDPreferences } from "../preferences.ts";
 import { loadEffectiveGSDPreferences } from "../preferences.ts";
 
@@ -57,6 +57,38 @@ test("hasPendingDeepStage: returns true in deep mode when nothing has been captu
   }
 });
 
+test("shouldRunDeepProjectSetup: complete state wins over pending deep setup", async () => {
+  const base = makeBase();
+  try {
+    assert.equal(hasPendingDeepStage(deepPrefs, base), true);
+    assert.equal(
+      shouldRunDeepProjectSetup({ phase: "complete" }, deepPrefs, base),
+      false,
+      "completed projects must not restart deep setup and loop through auto-mode",
+    );
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("shouldRunDeepProjectSetup: only setup phases can trigger pending deep setup", () => {
+  const base = makeBase();
+  try {
+    assert.equal(hasPendingDeepStage(deepPrefs, base), true);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "pre-planning" }, deepPrefs, base), true);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "needs-discussion" }, deepPrefs, base), true);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "planning" }, deepPrefs, base), true);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "executing" }, deepPrefs, base), false);
+    assert.equal(shouldRunDeepProjectSetup({ phase: "blocked" }, deepPrefs, base), false);
+    assert.equal(
+      shouldRunDeepProjectSetup({ phase: "pre-planning" }, deepPrefs, base, { hasSurvivorBranch: true }),
+      false,
+    );
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
 test("hasPendingDeepStage: returns true in deep mode when only some gates pass", () => {
   // workflow-preferences captured but PROJECT.md still missing.
   const base = makeBase();