gsd-pi 2.82.0-dev.ed17d078d → 3.0.0-dev.04f5ccf82

package/src/resources/extensions/gsd/tests/post-execution-checks.test.ts

@@ -127,6 +127,61 @@ import { b } from './b';
     assert.equal(imports.length, 2);
   });
 
+  test("ignores import-looking string literals in test fixtures", () => {
+    const source = `
+const rewritten = source.replace(
+  'import { normalizeZagrebBusinessDeadline } from "./cutoff";',
+  'const helper = true;'
+);
+
+import realThing from "./real-thing";
+`;
+    const imports = extractRelativeImports(source);
+    assert.deepEqual(imports, [
+      { importPath: "./real-thing", lineNum: 7 },
+    ]);
+  });
+
+  test("ignores import-looking lines inside template literals", () => {
+    const source = [
+      "const fixture = `",
+      "import missingThing from './missing-thing';",
+      "`;",
+      "",
+      "import realThing from './real-thing';",
+    ].join("\n");
+    const imports = extractRelativeImports(source);
+    assert.deepEqual(imports, [
+      { importPath: "./real-thing", lineNum: 5 },
+    ]);
+  });
+
+  test("ignores require() inside string literals", () => {
+    const source = [
+      'const fixture = "const x = require(\'./missing\');";',
+      "const otherFixture = 'const y = require(\"./also-missing\");';",
+      "const real = require('./real');",
+    ].join("\n");
+    const imports = extractRelativeImports(source);
+    assert.deepEqual(imports, [
+      { importPath: "./real", lineNum: 3 },
+    ]);
+  });
+
+  test("ignores require() inside template literals", () => {
+    const source = [
+      "const fixture = `",
+      "const x = require('./missing');",
+      "`;",
+      "",
+      "const real = require('./real');",
+    ].join("\n");
+    const imports = extractRelativeImports(source);
+    assert.deepEqual(imports, [
+      { importPath: "./real", lineNum: 5 },
+    ]);
+  });
+
   test("handles empty source", () => {
     const imports = extractRelativeImports("");
     assert.deepEqual(imports, []);
@@ -317,7 +372,23 @@ describe("resolveImportPath", () => {
     assert.ok(result.resolvedPath?.endsWith("route.server.ts"));
   });
 
-  test("missing unknown explicit extension does not match code-extension shadow", (t) => {
+  test("resolves dotted TS module stem like .test-utils via extension probing", (t) => {
+    const dir = mkdtempSync(join(tmpdir(), "post-exec-test-dotted-stem-"));
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    mkdirSync(join(dir, "src", "lib"), { recursive: true });
+    writeFileSync(join(dir, "src", "lib", "test-helpers.test-utils.ts"), "export {};\n");
+    writeFileSync(join(dir, "src", "main.integration.test.ts"), "");
+
+    const result = resolveImportPath(
+      "./lib/test-helpers.test-utils",
+      "src/main.integration.test.ts",
+      dir
+    );
+    assert.ok(result.exists);
+    assert.ok(result.resolvedPath?.endsWith("test-helpers.test-utils.ts"));
+  });
+
+  test("unknown dotted stem falls through to extension probing", (t) => {
     const dir = mkdtempSync(join(tmpdir(), "post-exec-test-unknown-shadow-"));
     t.after(() => rmSync(dir, { recursive: true, force: true }));
     mkdirSync(join(dir, "src"), { recursive: true });
@@ -325,8 +396,8 @@ describe("resolveImportPath", () => {
     writeFileSync(join(dir, "src", "main.ts"), "");
 
     const result = resolveImportPath("./video.mp4", "src/main.ts", dir);
-    assert.ok(!result.exists);
-    assert.equal(result.resolvedPath, null);
+    assert.ok(result.exists);
+    assert.ok(result.resolvedPath?.endsWith("video.mp4.ts"));
   });
 });
 
@@ -810,6 +881,37 @@ describe("runPostExecutionChecks", () => {
     }
   });
 
+  test("does not fail on import-looking strings in task key files", () => {
+    tempDir = join(tmpdir(), `post-exec-test-${Date.now()}`);
+    mkdirSync(tempDir, { recursive: true });
+    mkdirSync(join(tempDir, "tests"), { recursive: true });
+    writeFileSync(join(tempDir, "tests", "real-thing.ts"), "export default true;");
+    writeFileSync(
+      join(tempDir, "tests", "source-verifier.test.ts"),
+      `
+const rewritten = source.replace(
+  'import { normalizeZagrebBusinessDeadline } from "./cutoff";',
+  'const helper = true;'
+);
+
+import realThing from "./real-thing";
+assert.ok(realThing);
+`
+    );
+
+    try {
+      const task = createTask({
+        id: "T03",
+        key_files: ["tests/source-verifier.test.ts"],
+      });
+      const result = runPostExecutionChecks(task, [], tempDir);
+      assert.equal(result.status, "pass");
+      assert.deepEqual(result.checks, []);
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
   test("returns fail status when blocking failure exists", () => {
     tempDir = join(tmpdir(), `post-exec-test-${Date.now()}`);
     mkdirSync(tempDir, { recursive: true });

package/src/resources/extensions/gsd/tests/post-unit-git-failure.test.ts

@@ -11,8 +11,15 @@ const source = readFileSync(
 
 test("postUnitPreVerification blocks on git action failure", () => {
   const failureBlock = extractSourceRegion(source, 'if (gitResult.status === "failed")');
-  assert.ok(failureBlock.includes('ctx.ui.notify(failureMsg, "error")'));
+  assert.ok(failureBlock.includes('ctx.ui.notify(failureMsg, opts?.softFailure ? "warning" : "error")'));
   assert.ok(failureBlock.includes("await pauseAuto(ctx, pi)"));
   assert.ok(failureBlock.includes('return "dispatched"'));
   assert.ok(!failureBlock.includes("git-action-failed-nonblocking"));
 });
+
+test("buildTaskCommitContextForUnit filters placeholder key_files entries", () => {
+  const keyFilesBlock = extractSourceRegion(source, "keyFiles:");
+  assert.ok(keyFilesBlock.includes("normalized.length > 0"));
+  assert.ok(keyFilesBlock.includes("!normalized.includes(\"{{\")"));
+  assert.ok(keyFilesBlock.includes("/^(?:\\(none\\)|none\\.?|n\\/a)$/i.test(normalized)"));
+});

package/src/resources/extensions/gsd/tests/post-unit-state-rebuild.test.ts

@@ -8,8 +8,32 @@ import assert from "node:assert/strict";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
+import { createRequire } from "node:module";
 import { AutoSession } from "../auto/session.ts";
 import { postUnitPreVerification } from "../auto-post-unit.ts";
+import {
+  _getAdapter,
+  closeDatabase,
+  getTask,
+  insertMilestone,
+  insertSlice,
+  insertTask,
+  openDatabase,
+} from "../gsd-db.ts";
+
+const _require = createRequire(import.meta.url);
+
+function openRawSqliteForTest(dbPath: string): { exec(sql: string): void; close(): void } {
+  try {
+    const mod = _require("node:sqlite") as { DatabaseSync: new (path: string) => { exec(sql: string): void; close(): void } };
+    return new mod.DatabaseSync(dbPath);
+  } catch {
+    type SqliteCtor = new (path: string) => { exec(sql: string): void; close(): void };
+    const mod = _require("better-sqlite3") as SqliteCtor | { default: SqliteCtor };
+    const DatabaseCtor: SqliteCtor = typeof mod === "function" ? mod : mod.default;
+    return new DatabaseCtor(dbPath);
+  }
+}
 
 test("postUnitPreVerification rebuilds STATE.md after a completed unit", async () => {
   const base = mkdtempSync(join(tmpdir(), "gsd-post-unit-state-"));
@@ -47,3 +71,63 @@ test("postUnitPreVerification rebuilds STATE.md after a completed unit", async (
     rmSync(base, { recursive: true, force: true });
   }
 });
+
+test("postUnitPreVerification refreshes DB before checking execute-task completion", async () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-post-unit-db-refresh-"));
+  try {
+    const sliceDir = join(base, ".gsd", "milestones", "M001", "slices", "S01");
+    const tasksDir = join(sliceDir, "tasks");
+    mkdirSync(tasksDir, { recursive: true });
+    writeFileSync(
+      join(base, ".gsd", "milestones", "M001", "M001-ROADMAP.md"),
+      "# Roadmap\n\n## Slices\n\n- [ ] **S01: Slice** `risk:low` `depends:[]`\n",
+    );
+    writeFileSync(
+      join(sliceDir, "S01-PLAN.md"),
+      "# S01: Slice\n\n## Tasks\n\n- [ ] **T01: Do work** `est:30m`\n",
+    );
+    writeFileSync(
+      join(tasksDir, "T01-SUMMARY.md"),
+      "---\nid: T01\nparent: S01\nmilestone: M001\n---\n# T01\nDone.\n",
+    );
+
+    const dbPath = join(base, ".gsd", "gsd.db");
+    openDatabase(dbPath);
+    insertMilestone({ id: "M001", title: "Milestone", status: "active" });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "Slice", status: "pending" });
+    insertTask({ id: "T01", sliceId: "S01", milestoneId: "M001", title: "Do work", status: "pending" });
+    const adapterBefore = _getAdapter();
+
+    const externalDb = openRawSqliteForTest(dbPath);
+    try {
+      externalDb.exec("UPDATE tasks SET status = 'complete', completed_at = '2026-05-14T00:00:00.000Z' WHERE milestone_id = 'M001' AND slice_id = 'S01' AND id = 'T01'");
+    } finally {
+      externalDb.close();
+    }
+
+    const s = new AutoSession();
+    s.basePath = base;
+    s.originalBasePath = base;
+    s.currentMilestoneId = "M001";
+    s.currentUnit = { type: "execute-task", id: "M001/S01/T01", startedAt: Date.now() };
+
+    const result = await postUnitPreVerification({
+      s,
+      ctx: { ui: { notify() {} } } as any,
+      pi: {} as any,
+      buildSnapshotOpts: () => ({}),
+      lockBase: () => base,
+      stopAuto: async () => {},
+      pauseAuto: async () => {},
+      updateProgressWidget: () => {},
+    }, { skipSettleDelay: true, skipWorktreeSync: true });
+
+    assert.equal(result, "continue");
+    assert.notEqual(_getAdapter(), adapterBefore, "post-unit flow must reopen the DB before deriving state");
+    assert.equal(getTask("M001", "S01", "T01")?.status, "complete");
+    assert.equal(s.pendingVerificationRetry, null);
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/pre-execution-checks.test.ts

@@ -9,6 +9,7 @@
  *   2. File path consistency — files exist vs prior expected_output
  *   3. Task ordering — detect impossible read-before-create
  *   4. Interface contracts — contradictory function signatures
+ *   5. Verify commands — reject unsafe or non-runnable task verification
  */
 
 import { describe, test, mock } from "node:test";
@@ -22,6 +23,7 @@ import {
   checkFilePathConsistency,
   checkTaskOrdering,
   checkInterfaceContracts,
+  checkVerificationCommands,
   runPreExecutionChecks,
   normalizeFilePath,
   type PreExecutionResult,
@@ -126,6 +128,12 @@ import type { Request } from 'express';
     assert.deepEqual(packages, []);
   });
 
+  test("ignores @/ path alias imports", () => {
+    const desc = `import { handler } from '@/app/api/hello/route';`;
+    const packages = extractPackageReferences(desc);
+    assert.deepEqual(packages, []);
+  });
+
   test("normalizes package subpaths", () => {
     const desc = "npm install lodash/get";
     const packages = extractPackageReferences(desc);
@@ -415,6 +423,40 @@ describe("checkFilePathConsistency with path normalization", () => {
       rmSync(tempDir, { recursive: true, force: true });
     }
   });
+
+  test("absolute input path matches relative expected_output within basePath (#5519)", () => {
+    tempDir = join(tmpdir(), `pre-exec-test-${Date.now()}`);
+    mkdirSync(tempDir, { recursive: true });
+
+    try {
+      const absGenerated = join(tempDir, "src/new-file.ts");
+      const tasks = [
+        createTask({
+          id: "T01",
+          sequence: 0,
+          files: [],
+          inputs: [],
+          expected_output: ["src/new-file.ts"],
+        }),
+        createTask({
+          id: "T02",
+          sequence: 1,
+          files: [],
+          inputs: [absGenerated],
+          expected_output: [],
+        }),
+      ];
+
+      const results = checkFilePathConsistency(tasks, tempDir);
+      assert.deepEqual(
+        results,
+        [],
+        "Should pass because absolute/relative paths under basePath must compare equal",
+      );
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("checkTaskOrdering with path normalization", () => {
@@ -486,6 +528,38 @@ describe("checkTaskOrdering with path normalization", () => {
     const results = checkTaskOrdering(tasks, "/tmp");
     assert.deepEqual(results, [], "Should pass - T02 reads file that T01 already created");
   });
+
+  test("absolute input matches later relative expected_output and triggers ordering violation (#5519)", () => {
+    const tempDir = join(tmpdir(), `pre-exec-ordering-abs-rel-${Date.now()}`);
+    mkdirSync(tempDir, { recursive: true });
+
+    try {
+      const tasks = [
+        createTask({
+          id: "T01",
+          sequence: 0,
+          files: [],
+          inputs: [join(tempDir, "src/new-file.ts")],
+          expected_output: [],
+        }),
+        createTask({
+          id: "T02",
+          sequence: 1,
+          files: [],
+          inputs: [],
+          expected_output: ["src/new-file.ts"],
+        }),
+      ];
+
+      const results = checkTaskOrdering(tasks, tempDir);
+      assert.equal(results.length, 1, "Should detect violation for equivalent absolute/relative paths");
+      assert.ok(results[0].message.includes("sequence violation"));
+      assert.ok(results[0].message.includes("T01"));
+      assert.ok(results[0].message.includes("T02"));
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
 });
 
 // ─── Task Ordering Tests ─────────────────────────────────────────────────────
@@ -812,6 +886,33 @@ function process(a: number): number
   });
 });
 
+describe("checkVerificationCommands", () => {
+  test("accepts pipe-free pytest Verify command", () => {
+    const results = checkVerificationCommands([
+      createTask({
+        id: "T01",
+        verify: "python3 -m pytest tests/ -q --tb=short",
+      }),
+    ]);
+
+    assert.deepEqual(results, []);
+  });
+
+  test("rejects piped pytest Verify command", () => {
+    const results = checkVerificationCommands([
+      createTask({
+        id: "T01",
+        verify: "python3 -m pytest tests/ -q --tb=short 2>&1 | tail -5",
+      }),
+    ]);
+
+    assert.equal(results.length, 1);
+    assert.equal(results[0]?.category, "tool");
+    assert.equal(results[0]?.blocking, true);
+    assert.match(results[0]?.message ?? "", /shell control syntax/);
+  });
+});
+
 // ─── runPreExecutionChecks Integration Tests ─────────────────────────────────
 
 describe("runPreExecutionChecks", () => {
@@ -847,6 +948,30 @@ describe("runPreExecutionChecks", () => {
     }
   });
 
+  test("returns fail status for unsafe Verify command before execution", async () => {
+    tempDir = join(tmpdir(), `pre-exec-test-${Date.now()}`);
+    mkdirSync(tempDir, { recursive: true });
+
+    try {
+      const tasks = [
+        createTask({
+          id: "T01",
+          verify: "python3 -m pytest tests/ -q --tb=short 2>&1 | tail -5",
+        }),
+      ];
+
+      const result = await runPreExecutionChecks(tasks, tempDir);
+
+      assert.equal(result.status, "fail");
+      assert.equal(result.checks.length, 1);
+      assert.equal(result.checks[0]?.category, "tool");
+      assert.equal(result.checks[0]?.blocking, true);
+      assert.match(result.checks[0]?.message ?? "", /Unsafe or non-runnable Verify command/);
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
   test("returns fail status when blocking failure exists", async () => {
     tempDir = join(tmpdir(), `pre-exec-test-${Date.now()}`);
     mkdirSync(tempDir, { recursive: true });
@@ -1993,6 +2118,28 @@ describe("checkFilePathConsistency quote-wrapped annotation (#3747)", () => {
     );
   });
 
+  test("bare path with parenthetical annotation strips suffix before path check", (t) => {
+    const tempDir = join(tmpdir(), `pre-exec-paren-${Date.now()}`);
+    mkdirSync(join(tempDir, "src"), { recursive: true });
+    writeFileSync(join(tempDir, "src/paren.ts"), "// content");
+    t.after(() => rmSync(tempDir, { recursive: true, force: true }));
+
+    const tasks = [
+      createTask({
+        id: "T01",
+        inputs: ["src/paren.ts (note)"],
+        expected_output: [],
+      }),
+    ];
+
+    const results = checkFilePathConsistency(tasks, tempDir);
+    assert.equal(
+      results.length,
+      0,
+      "Parenthetical suffix should be stripped and resolved to the real file",
+    );
+  });
+
   test("prose value with spaces inside quotes is skipped (not a path)", () => {
     // "some description text" contains spaces — should not be checked as a path
     const tasks = [

package/src/resources/extensions/gsd/tests/pre-execution-pause-wiring.test.ts

@@ -556,6 +556,60 @@ describe("Pre-execution checks → pauseAuto wiring", () => {
     );
   });
 
+  test("files absent from s.basePath but present in canonicalProjectRoot do not block", async () => {
+    writePreferences({
+      enhanced_verification: true,
+      enhanced_verification_pre: true,
+      enhanced_verification_strict: false,
+    });
+
+    const worktreeDir = join(tempDir, "worktree-missing-src");
+    mkdirSync(join(worktreeDir, ".gsd", "milestones", "M001", "slices", "S01", "tasks"), { recursive: true });
+
+    mkdirSync(join(tempDir, "src", "engine"), { recursive: true });
+    writeFileSync(join(tempDir, "src", "engine", "bus.ts"), "export const bus = {};");
+
+    insertMilestone({ id: "M001" });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "Test Slice", risk: "low" });
+    insertTask({
+      id: "T01",
+      sliceId: "S01",
+      milestoneId: "M001",
+      title: "Task that reads canonical-root source files",
+      status: "pending",
+      planning: {
+        description: "Reads src/engine/bus.ts from canonical root",
+        estimate: "1h",
+        files: [],
+        verify: "npm test",
+        inputs: ["`src/engine/bus.ts` — lifecycle helper subscription API"],
+        expectedOutput: ["src/engine/helper.ts"],
+        observabilityImpact: "",
+      },
+      sequence: 0,
+    });
+
+    const ctx = makeMockCtx();
+    const pi = makeMockPi();
+    const pauseAutoMock = mock.fn(async () => {});
+    const s = makeMockSession(worktreeDir, { type: "plan-slice", id: "M001/S01" });
+    Object.defineProperty(s, "canonicalProjectRoot", { get: () => tempDir });
+
+    const pctx = makePostUnitContext(s, ctx, pi, pauseAutoMock);
+    const result = await postUnitPostVerification(pctx);
+
+    assert.equal(
+      pauseAutoMock.mock.callCount(),
+      0,
+      "pauseAuto should NOT be called when referenced files exist in canonicalProjectRoot",
+    );
+    assert.equal(
+      result,
+      "continue",
+      "postUnitPostVerification should return 'continue' when canonical root files satisfy pre-exec inputs",
+    );
+  });
+
   test("uok gate runner persists pre-execution gate outcomes when enabled", async () => {
     writePreferences({
       enhanced_verification: true,

package/src/resources/extensions/gsd/tests/preferences-mcp.test.ts

@@ -0,0 +1,128 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { resolveModelMcpConfig } from "../preferences-mcp.ts";
+import { validatePreferences } from "../preferences-validation.ts";
+import type { ClaudeCodeMcpConfig } from "../preferences-types.ts";
+
+// ─── resolveModelMcpConfig ──────────────────────────────────────────────────
+
+describe("resolveModelMcpConfig", () => {
+  it("returns entry when modelId starts with configured prefix", () => {
+    const config: ClaudeCodeMcpConfig = {
+      per_model: {
+        "claude-haiku": { allowed_servers: ["a"] },
+      },
+    };
+    const result = resolveModelMcpConfig("claude-haiku-4-5-20251001", config);
+    assert.deepEqual(result, { allowed_servers: ["a"] });
+  });
+
+  it("longest-prefix-wins when multiple prefixes match", () => {
+    const config: ClaudeCodeMcpConfig = {
+      per_model: {
+        "claude-haiku": { allowed_servers: ["short"] },
+        "claude-haiku-4-5": { allowed_servers: ["long"] },
+      },
+    };
+    const result = resolveModelMcpConfig("claude-haiku-4-5-20251001", config);
+    assert.deepEqual(result, { allowed_servers: ["long"] });
+  });
+
+  it("returns undefined when no prefix matches", () => {
+    const config: ClaudeCodeMcpConfig = {
+      per_model: {
+        "claude-haiku": { allowed_servers: ["a"] },
+      },
+    };
+    const result = resolveModelMcpConfig("claude-opus-4-7", config);
+    assert.equal(result, undefined);
+  });
+
+  it("returns undefined for empty per_model", () => {
+    const config: ClaudeCodeMcpConfig = { per_model: {} };
+    const result = resolveModelMcpConfig("claude-sonnet-4-6", config);
+    assert.equal(result, undefined);
+  });
+
+  it("returns entry when modelId exactly equals key", () => {
+    const config: ClaudeCodeMcpConfig = {
+      per_model: {
+        "claude-haiku-4-5-20251001": { blocked_servers: ["x"] },
+      },
+    };
+    const result = resolveModelMcpConfig("claude-haiku-4-5-20251001", config);
+    assert.deepEqual(result, { blocked_servers: ["x"] });
+  });
+
+  it("returns entry with both allowed_servers and blocked_servers", () => {
+    const config: ClaudeCodeMcpConfig = {
+      per_model: {
+        "claude-sonnet": { allowed_servers: ["a", "b"], blocked_servers: ["c"] },
+      },
+    };
+    const result = resolveModelMcpConfig("claude-sonnet-4-6", config);
+    assert.deepEqual(result, { allowed_servers: ["a", "b"], blocked_servers: ["c"] });
+  });
+});
+
+// ─── validatePreferences — claude_code_mcp ─────────────────────────────────
+
+describe("validatePreferences — claude_code_mcp", () => {
+  it("passes with a valid claude_code_mcp block", () => {
+    const { errors, warnings, preferences } = validatePreferences({
+      claude_code_mcp: {
+        per_model: {
+          "claude-haiku": { allowed_servers: ["mcp-a"], blocked_servers: ["mcp-b"] },
+        },
+      },
+    });
+    assert.deepEqual(errors, []);
+    assert.deepEqual(warnings, []);
+    assert.deepEqual(preferences.claude_code_mcp, {
+      per_model: {
+        "claude-haiku": { allowed_servers: ["mcp-a"], blocked_servers: ["mcp-b"] },
+      },
+    });
+  });
+
+  it("warns and ignores when claude_code_mcp is not an object", () => {
+    const { errors, warnings } = validatePreferences({
+      claude_code_mcp: "bad-value" as unknown as object,
+    });
+    assert.deepEqual(errors, []);
+    assert.ok(
+      warnings.some((w) => w.includes("claude_code_mcp must be an object")),
+      `expected warning about non-object, got: ${JSON.stringify(warnings)}`,
+    );
+  });
+
+  it("warns when per_model entry has non-array allowed_servers", () => {
+    const { errors, warnings } = validatePreferences({
+      claude_code_mcp: {
+        per_model: {
+          "claude-haiku": { allowed_servers: "not-an-array" as unknown as string[] },
+        },
+      },
+    });
+    assert.deepEqual(errors, []);
+    assert.ok(
+      warnings.some((w) => w.includes("allowed_servers")),
+      `expected warning about allowed_servers, got: ${JSON.stringify(warnings)}`,
+    );
+  });
+
+  it("warns when per_model entry has non-array blocked_servers", () => {
+    const { errors, warnings } = validatePreferences({
+      claude_code_mcp: {
+        per_model: {
+          "claude-haiku": { blocked_servers: 42 as unknown as string[] },
+        },
+      },
+    });
+    assert.deepEqual(errors, []);
+    assert.ok(
+      warnings.some((w) => w.includes("blocked_servers")),
+      `expected warning about blocked_servers, got: ${JSON.stringify(warnings)}`,
+    );
+  });
+});