v1.40.0.0 fix wave: gbrain sync hardening (8 community PRs + migration) (#1547)

* fix(gbrain-sync): fold hostname into code-source id hash + migration (#1414) Cherry-picked from #1468 by 0xDevNinja and extended with the hostname-fold migration that codex review surfaced. Pre-fix `deriveCodeSourceId` hashed the absolute repo path alone, so two machines with identical home-dir layouts (chezmoi-managed dotfiles, ansible-provisioned VMs) derived the same id and clobbered each other's `local_path` in a federated brain. Last-writer-wins, with cryptic "Not a git repository" errors on the loser. Hash key is now `\${hostname}::\${path}`. Conductor worktrees on a single host stay distinct (path entropy unchanged within a host); cross-machine federations stop colliding. Migration (D1=B + codex refinements): every existing user has a pre-#1468 path-only-hash source id in their brain that no longer matches what `deriveCodeSourceId` produces. Without migration, the next sync registers a fresh source and orphans the old one. This commit adds: - \`derivePathOnlyHashLegacyId\` — separate helper for the pre-#1468 form. Distinct from \`deriveLegacyCodeSourceId\` (pre-pathhash v1.x form); both probes run. - \`planHostnameFoldMigration\` — feature-checks \`gbrain sources rename <old> <new>\` (exact argument shape, not just \`--help\`), gates on path-drift (skip migration if old source's \`local_path\` differs from current repo root), and falls back to register-new + sync-OK + remove-old when rename is unsupported. As of gbrain 0.35.0.0 the rename subcommand does not exist, so users go through the cleanup path; the rename path stays dormant until gbrain ships it. - \`removeOrphanedSource\` — called only AFTER new-source sync verifies page_count > 0. Closes the data-loss window codex flagged where "register new, remove old before sync" can wipe pages if sync fails. - \`sourceLocalPath\` — looks up a source's \`local_path\` from \`gbrain sources list --json\` for the drift gate. - Helpers accept an optional \`env\` parameter so tests can inject a gbrain shim via PATH without process-wide PATH mutation (Bun's spawnSync doesn't pick up runtime PATH changes). Pre-positions for commit 4's centralized gbrain-exec helper. - \`if (import.meta.main)\` guard around \`main()\` so the helpers can be imported for in-process unit tests. Tests cover: pure derivation, ids-match degenerate case, no-legacy short-circuit, path-drift skip path, rename path with shim, cleanup fallback when rename unsupported, cleanup fallback when rename call itself fails, source-lookup happy/missing/error paths. \`GSTACK_HOSTNAME\` env var is a test-only knob; production uses \`os.hostname()\`. Fixes #1414 Co-Authored-By: Claude <noreply@anthropic.com> * fix(gbrain-sync): cut source-id slugs on hyphen boundaries (+ #1357) Cherry-picked from #1481 by drummerms and extended with the explicit HTTPS-remote regression case for #1357 (decision D2=A). `constrainSourceId` truncated the slug with `slug.slice(-tailBudget)`, which cut mid-word when the boundary fell inside a token. For a repo where the combined `prefix-org-repo-pathhash` exceeded 32 chars, this produced embarrassing artifacts like `gstack-code-kill-270c0001-c32152` (from `drummerms-av-sow-wiz-skill-270c0001`). Two changes carried from #1481, adapted for the #1468 hostpathhash: 1. `constrainSourceId` now walks hyphen-separated tokens from the right, accumulating whole tokens until adding the next would exceed `tailBudget`. When no token fits, falls through to the existing `${prefix}-${hash}` form. 2. `deriveCodeSourceId` now retries with `repo-only-hostpathhash` (dropping the org segment) when the full `org-repo-hostpathhash` triggers truncation. Keeps the repo name readable when it fits at all. Plus a new test asserting the source id is period-free for the exact HTTPS-with-.git remote shape from #1357 (`https://github.com/foo/bar.git`). canonicalizeRemote strips `.git`; the sanitizer strips any residual non-alnum. The test closes #1357 by pinning the property. Closes #1357 Co-Authored-By: Claude <noreply@anthropic.com> * fix(gbrain): probe CLI without command builtin * fix(gbrain-sync): centralize gbrain spawn surface + seed DATABASE_URL Cherry-picked from #1508 by jasshultz, restructured per codex review #4 and #7 to widen scope and centralize the spawn surface. The bug: gbrain auto-loads .env.local from cwd via dotenv. When /sync-gbrain runs inside a Next.js / Prisma / Rails project whose .env.local defines its own DATABASE_URL (pointing at the app's local DB), gbrain reads that value instead of its own ~/.gbrain/config.json — auth fails, code + memory stages crash. This commit: - Adds lib/gbrain-exec.ts: buildGbrainEnv, spawnGbrain, execGbrainJson, execGbrainText, spawnGbrainAsync (the last one for memory-ingest's streaming gbrain import call). buildGbrainEnv seeds DATABASE_URL from ${GBRAIN_HOME:-$HOME/.gbrain}/config.json, returns a fresh env object (never the caller's by identity — codex review #11), and honors the GSTACK_RESPECT_ENV_DATABASE_URL=1 escape hatch. - Routes every gbrain spawn in bin/gstack-gbrain-sync.ts and bin/gstack-memory-ingest.ts through the helpers. Both files now own zero direct spawnSync("gbrain"|spawn("gbrain"|execFileSync("gbrain" call sites. - Threads buildGbrainEnv into the spawnSync("bun", [memory-ingest], ...) grandchild in runMemoryIngest (codex review #7). Without this, the parent fix is half-baked — the bun child inherits a clean env but needs DATABASE_URL pre-seeded too. spawnGbrainAsync inside memory-ingest provides defense in depth for standalone invocations. - Adds GBRAIN_HOME support — aligns with detectEngineTier (already honors GBRAIN_HOME) so all gstack-side gbrain calls agree on which config file matters. Resolves baseEnv.HOME first, then homedir(), so test injection works without process-wide HOME mutation. - Adds test/build-gbrain-env.test.ts: 10 unit tests covering all five env-seeding branches (seed from config / override caller / GSTACK_RESPECT escape hatch / missing config / unparseable config / no database_url field / GBRAIN_HOME path / object-identity guard / unrelated-vars preservation / idempotent-when-matches). - Adds test/gbrain-exec-invariant.test.ts: static-source check that greps both bin/gstack-gbrain-sync.ts and bin/gstack-memory-ingest.ts for direct spawnSync("gbrain"|spawn("gbrain"|execFileSync("gbrain"| execSync(...gbrain matches and fails the build if any are found. Refactor-proof against future contributors adding a new gbrain spawn without env threading. The invariant is intentionally narrow — only the two files where the DATABASE_URL bug actually hurts users are guarded. Migrating the spawn sites in lib/gbrain-local-status.ts, lib/gstack-memory-helpers.ts, and bin/gstack-brain-context-load.ts is a follow-up. Co-Authored-By: Jason Shultz <jasshultz@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com> * fix(gbrain-sync): add .gbrain-source to consumer repo .gitignore (#1384) The v1.29.0.0 changelog promised .gbrain-source would be added to the consuming repo's .gitignore so the per-worktree pin stays local, but the change actually only added it to gstack's own .gitignore. Without the consumer-side entry, the pin gets committed and Conductor sibling worktrees of the same repo + branch step on each other's pin every time anyone commits. Add ensureGbrainSourceGitignored after a successful gbrain sources attach in runCodeImport. Idempotent on repeat runs (line-trim match), creates .gitignore if missing, logs a warning and continues on permission errors so a read-only checkout doesn't fail the sync. Gate the top-level main() call behind import.meta.main so tests can import the helper without triggering a full sync run on module load. Tests in test/gbrain-source-gitignore.test.ts cover: create-when-missing, append-without-trailing-newline, append-with-trailing-newline, idempotent on repeat, recognize whitespace-surrounded entry, no-throw on read-only file. 6 pass. * fix(gbrain-sources): bump gbrain sources list --json timeout 10s → 30s Supabase free-tier cold-starts can push `gbrain sources list --json` past 10s (observed 14.5s in the wild), causing probeSource() to throw ETIMEDOUT during /sync-gbrain code stage even though the underlying CLI was healthy. Matches the 30s ceiling already used by `sources add` / `sources remove` in the same file. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(brain-allowlist): sync project-root eng-review-test-plan artifacts (#1452) Cherry-picked from #1465 by genisis0x and extended with the v1.40.0.0 upgrade migration that codex review #5 surfaced. #1465 alone only patches bin/gstack-artifacts-init, which means fresh installs and re-inits pick up the new pattern. But existing users who already ran v1.38.1.0 have a `.migrations/v1.38.1.0.done` marker — that migration won't re-run no matter what we change. So their installed `.brain-allowlist`, `.brain-privacy-map.json`, and `.gitattributes` stay without the new pattern, and `/plan-eng-review` artifacts continue to silently drop out of their federation queue. This commit: - bin/gstack-artifacts-init: adds projects/*/*-eng-review-test-plan-*.md to the three managed blocks. v1.38.1.0 covered design + test-plan; this completes the set for /plan-eng-review. - gstack-upgrade/migrations/v1.40.0.0.sh: targeted in-place repair for existing installs. Same idempotent jq-based shape as v1.38.1.0. Adds the new pattern to .brain-allowlist (before the USER ADDITIONS marker), .brain-privacy-map.json (as class=artifact), and .gitattributes (as merge=union). NEVER commits + pushes — the user controls when the patches ship to their federated artifacts repo. - test/artifacts-init-migration.test.ts: 5 new tests covering the v1.40.0.0 migration applied on top of a post-v1.38.1.0 state, jq patching, gitattributes append, idempotent re-run, and done-marker write when files are missing entirely. Co-Authored-By: Claude <noreply@anthropic.com> * fix(gbrain-install): skip postinstall on Windows MSYS/MINGW + post-install probe Cherry-picked from #1487 by genisis0x and extended with the post-install subcommand probe per T6 / codex review #19. `bun install` in $INSTALL_DIR fails on Windows MSYS/MINGW/Cygwin shells because gbrain's native postinstall script mis-parses path arguments and aborts with a non-zero exit, breaking gstack-gbrain-install for Windows users running git-bash/MSYS2. The package installs cleanly without scripts. This commit: - Adds Windows shell detection via `uname -s` matching MINGW*/MSYS*/CYGWIN*/Windows_NT (#1487's case statement already covers all four — codex review #18 confirmed MINGW* is included). Windows paths get `bun install --ignore-scripts`; macOS and Linux unchanged. - Adds a post-install probe of `gbrain sources --help`. `gbrain --version` already runs (D19 PATH-shadowing validation), but version success doesn't prove the subcommand surface is reachable — and `--ignore-scripts` may have skipped artifacts that subcommands need. Probe failure logs a clear warning (with Windows-specific remediation pointing at re-running `bun install` outside MSYS) but does NOT exit non-zero; users may still get value from gbrain even if the probe fails transiently. Refs #1271 Co-Authored-By: Claude <noreply@anthropic.com> * chore: v1.40.0.0 — gbrain sync hardening wave Bumps VERSION 1.39.2.0 → 1.40.0.0 (MINOR — substantial gbrain capability hardening across sync pipeline, install path, federation allowlist; ~600 net LOC added across 8 community PRs + plan-review refinements). CHANGELOG entry follows the release-summary format: two-line headline, lead paragraph, "numbers that matter" with before/after table across 8 user-visible surfaces, "what this means for builders" closer, itemized Added/Changed/Fixed/NOT fixed/For contributors sections. Per-commit contributor credits: 0xDevNinja, drummerms, Jayesh Betala, Jason Shultz, genisis0x. Also names NikhileshNanduri and realcarsonterry in the wave's "Fixed" section for independent submissions of the .gbrain-source gitignore bug. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: 0xDevNinja <manmit0x@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: drummerms <mike@av2o.com> Co-authored-by: Jayesh Betala <jayesh.betala7@gmail.com> Co-authored-by: Jason Shultz <jasshultz@gmail.com> Co-authored-by: genisis0x <manietdavv@gmail.com>
2026-05-18 02:22:04 +08:00 · 2026-05-17 08:26:36 -07:00
parent 33cb4715ef
commit 026751ea20
18 changed files with 1516 additions and 63 deletions
--- a/test/artifacts-init-migration.test.ts
+++ b/test/artifacts-init-migration.test.ts
@@ -201,3 +201,133 @@ describe('v1.38.1.0 migration', () => {
    }
  });
 });
+
+// ──────────────────────────────────────────────────────────────────────────
+// v1.40.0.0 — `projects/*/*-eng-review-test-plan-*.md` follow-on for #1452.
+// v1.38.1.0 shipped the design + test-plan patterns but missed
+// /plan-eng-review's filename. Codex review #5 flagged that
+// v1.38.1.0's done-marker prevents users who already upgraded from picking
+// up #1465's allowlist edit, so v1.40.0.0 needs its own migration.
+// ──────────────────────────────────────────────────────────────────────────
+const MIGRATION_V1_40 = join(REPO_ROOT, 'gstack-upgrade', 'migrations', 'v1.40.0.0.sh');
+
+function runMigrationV140(fakeHome: string): { code: number; stdout: string; stderr: string } {
+  const proc = Bun.spawnSync({
+    cmd: ['bash', MIGRATION_V1_40],
+    env: { ...process.env, HOME: fakeHome },
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  return {
+    code: proc.exitCode ?? -1,
+    stdout: new TextDecoder().decode(proc.stdout),
+    stderr: new TextDecoder().decode(proc.stderr),
+  };
+}
+
+describe('v1.40.0.0 migration', () => {
+  test('adds eng-review-test-plan pattern to allowlist on top of an installed v1.38.1.0 state', () => {
+    const home = setupFakeHome();
+    try {
+      // Simulate post-v1.38.1.0 state: design + test-plan patterns present,
+      // done-marker set so the v1.38.1.0 migration wouldn't re-run.
+      mkdirSync(join(home, '.gstack', '.migrations'), { recursive: true });
+      writeFileSync(join(home, '.gstack', '.migrations', 'v1.38.1.0.done'), '');
+      writeFileSync(join(home, '.gstack', '.brain-allowlist'), [
+        'projects/*/learnings.jsonl',
+        'projects/*/designs/*.md',
+        'projects/*/*-design-*.md',
+        'projects/*/*-test-plan-*.md',
+        '# ---- USER ADDITIONS BELOW ---- (survives re-init; above is managed)',
+        'projects/*/my-custom.txt',
+      ].join('\n') + '\n');
+
+      const r = runMigrationV140(home);
+      expect(r.code).toBe(0);
+
+      const content = readFileSync(join(home, '.gstack', '.brain-allowlist'), 'utf-8');
+      expect(content).toContain('projects/*/*-eng-review-test-plan-*.md');
+      // New pattern above the user marker.
+      const engRevIdx = content.indexOf('projects/*/*-eng-review-test-plan-*.md');
+      const markerIdx = content.indexOf('# ---- USER ADDITIONS BELOW');
+      expect(engRevIdx).toBeLessThan(markerIdx);
+      // User customizations below the marker preserved.
+      expect(content).toContain('projects/*/my-custom.txt');
+      // v1.40.0.0 done-marker created.
+      expect(existsSync(join(home, '.gstack', '.migrations', 'v1.40.0.0.done'))).toBe(true);
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  test('adds eng-review-test-plan entry to privacy-map.json via jq', () => {
+    const home = setupFakeHome();
+    try {
+      writeFileSync(join(home, '.gstack', '.brain-privacy-map.json'), JSON.stringify([
+        { pattern: 'projects/*/*-design-*.md', class: 'artifact' },
+        { pattern: 'projects/*/*-test-plan-*.md', class: 'artifact' },
+      ], null, 2));
+
+      const r = runMigrationV140(home);
+      expect(r.code).toBe(0);
+
+      const parsed = JSON.parse(readFileSync(join(home, '.gstack', '.brain-privacy-map.json'), 'utf-8'));
+      const patterns = parsed.map((e: any) => e.pattern);
+      expect(patterns).toContain('projects/*/*-eng-review-test-plan-*.md');
+      expect(parsed.find((e: any) => e.pattern === 'projects/*/*-eng-review-test-plan-*.md').class).toBe('artifact');
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  test('adds union-merge rule to gitattributes', () => {
+    const home = setupFakeHome();
+    try {
+      writeFileSync(join(home, '.gstack', '.gitattributes'), [
+        'projects/*/*-design-*.md merge=union',
+        'projects/*/*-test-plan-*.md merge=union',
+      ].join('\n') + '\n');
+
+      const r = runMigrationV140(home);
+      expect(r.code).toBe(0);
+
+      const content = readFileSync(join(home, '.gstack', '.gitattributes'), 'utf-8');
+      expect(content).toContain('projects/*/*-eng-review-test-plan-*.md merge=union');
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  test('is idempotent: re-running is a no-op', () => {
+    const home = setupFakeHome();
+    try {
+      writeFileSync(join(home, '.gstack', '.brain-allowlist'),
+        'projects/*/*-eng-review-test-plan-*.md\n# ---- USER ADDITIONS BELOW ---- (survives re-init; above is managed)\n');
+
+      const r1 = runMigrationV140(home);
+      expect(r1.code).toBe(0);
+
+      const r2 = runMigrationV140(home);
+      expect(r2.code).toBe(0);
+
+      const content = readFileSync(join(home, '.gstack', '.brain-allowlist'), 'utf-8');
+      const occurrences = content.match(/projects\/\*\/\*-eng-review-test-plan-\*\.md/g) || [];
+      expect(occurrences.length).toBe(1);
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  test('writes done-marker even when files are missing', () => {
+    const home = setupFakeHome();
+    try {
+      // No allowlist / privacy-map / gitattributes — fresh-init users with
+      // no federated artifacts yet. Migration should still mark itself done.
+      const r = runMigrationV140(home);
+      expect(r.code).toBe(0);
+      expect(existsSync(join(home, '.gstack', '.migrations', 'v1.40.0.0.done'))).toBe(true);
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+});
--- a/test/build-gbrain-env.test.ts
+++ b/test/build-gbrain-env.test.ts
@@ -0,0 +1,120 @@
+/**
+ * Unit tests for `buildGbrainEnv` in lib/gbrain-exec.ts.
+ *
+ * The helper is the single source of truth for "what DATABASE_URL does
+ * gbrain see when spawned from gstack." The bug it prevents: gbrain's
+ * dotenv autoload pulls a host project's `.env.local` `DATABASE_URL`
+ * instead of gbrain's own `~/.gbrain/config.json`. Every helper test
+ * asserts on the **effective value** of the returned env, never object
+ * identity — Codex review #11 flagged that returning the same mutable
+ * object can leak later mutation.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+
+import { buildGbrainEnv } from "../lib/gbrain-exec";
+
+describe("buildGbrainEnv", () => {
+  let home: string;
+  let gbrainHome: string;
+
+  beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), "gstack-build-env-"));
+    gbrainHome = join(home, ".gbrain");
+    mkdirSync(gbrainHome, { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("seeds DATABASE_URL from ~/.gbrain/config.json when caller env has no DATABASE_URL", () => {
+    writeFileSync(join(gbrainHome, "config.json"), JSON.stringify({ database_url: "postgresql://gbrain/db" }));
+    const baseEnv = { HOME: home };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.DATABASE_URL).toBe("postgresql://gbrain/db");
+  });
+
+  it("overrides caller's DATABASE_URL when config differs", () => {
+    writeFileSync(join(gbrainHome, "config.json"), JSON.stringify({ database_url: "postgresql://gbrain/db" }));
+    const baseEnv = { HOME: home, DATABASE_URL: "postgresql://app-local/wrong" };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.DATABASE_URL).toBe("postgresql://gbrain/db");
+  });
+
+  it("leaves DATABASE_URL untouched when GSTACK_RESPECT_ENV_DATABASE_URL=1", () => {
+    writeFileSync(join(gbrainHome, "config.json"), JSON.stringify({ database_url: "postgresql://gbrain/db" }));
+    const baseEnv = {
+      HOME: home,
+      DATABASE_URL: "postgresql://intentional/app-db",
+      GSTACK_RESPECT_ENV_DATABASE_URL: "1",
+    };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.DATABASE_URL).toBe("postgresql://intentional/app-db");
+  });
+
+  it("returns caller env unchanged when config file is missing", () => {
+    // No config.json written.
+    const baseEnv = { HOME: home, DATABASE_URL: "postgresql://app/db" };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.DATABASE_URL).toBe("postgresql://app/db");
+  });
+
+  it("returns caller env unchanged when config file is unparseable", () => {
+    writeFileSync(join(gbrainHome, "config.json"), "{not json");
+    const baseEnv = { HOME: home, DATABASE_URL: "postgresql://app/db" };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.DATABASE_URL).toBe("postgresql://app/db");
+  });
+
+  it("returns caller env unchanged when config has no database_url field", () => {
+    writeFileSync(join(gbrainHome, "config.json"), JSON.stringify({ engine: "pglite" }));
+    const baseEnv = { HOME: home, DATABASE_URL: "postgresql://app/db" };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.DATABASE_URL).toBe("postgresql://app/db");
+  });
+
+  it("honors GBRAIN_HOME when set (config aligned with detectEngineTier)", () => {
+    // Move the config to an alternate dir; set GBRAIN_HOME to point at it.
+    const altGbrainHome = join(home, "alt-gbrain");
+    mkdirSync(altGbrainHome, { recursive: true });
+    writeFileSync(join(altGbrainHome, "config.json"), JSON.stringify({ database_url: "postgresql://alt/db" }));
+    // No file at the default ~/.gbrain location.
+    const baseEnv = { HOME: home, GBRAIN_HOME: altGbrainHome };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.DATABASE_URL).toBe("postgresql://alt/db");
+  });
+
+  it("returns a fresh env object — never the caller's env by identity", () => {
+    // Codex review #11: object-identity equality lets later mutation of the
+    // returned env leak back into the caller's view. The helper MUST clone.
+    writeFileSync(join(gbrainHome, "config.json"), JSON.stringify({ database_url: "postgresql://gbrain/db" }));
+    const baseEnv: NodeJS.ProcessEnv = { HOME: home, FOO: "bar" };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result).not.toBe(baseEnv);
+    // Mutating result must not affect baseEnv.
+    result.FOO = "changed";
+    expect(baseEnv.FOO).toBe("bar");
+  });
+
+  it("preserves unrelated env vars from the base env", () => {
+    writeFileSync(join(gbrainHome, "config.json"), JSON.stringify({ database_url: "postgresql://gbrain/db" }));
+    const baseEnv = { HOME: home, PATH: "/usr/bin", FOO: "bar" };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.PATH).toBe("/usr/bin");
+    expect(result.FOO).toBe("bar");
+    expect(result.HOME).toBe(home);
+  });
+
+  it("does not modify DATABASE_URL when caller's value already matches config", () => {
+    // Subtle: helper should be a no-op when caller already has the right value.
+    // Lets us skip the stderr announce on idempotent re-invocation.
+    writeFileSync(join(gbrainHome, "config.json"), JSON.stringify({ database_url: "postgresql://gbrain/db" }));
+    const baseEnv = { HOME: home, DATABASE_URL: "postgresql://gbrain/db" };
+    const result = buildGbrainEnv({ baseEnv });
+    expect(result.DATABASE_URL).toBe("postgresql://gbrain/db");
+  });
+});
--- a/test/gbrain-exec-invariant.test.ts
+++ b/test/gbrain-exec-invariant.test.ts
@@ -0,0 +1,80 @@
+/**
+ * Static-source invariant: every gbrain CLI invocation in the hot-path
+ * sync code MUST route through `lib/gbrain-exec.ts` (or accept env via
+ * the existing `lib/gbrain-sources.ts` opts surface). A future contributor
+ * who adds a `spawnSync("gbrain", ...)` call directly in
+ * `bin/gstack-gbrain-sync.ts` or `bin/gstack-memory-ingest.ts` silently
+ * regresses the DATABASE_URL fix from #1508 + codex review #7 — gbrain's
+ * dotenv autoload pulls a host project's `.env.local` value instead of
+ * gbrain's own config.
+ *
+ * This test reads each source file directly and asserts zero direct
+ * `spawnSync("gbrain"`, `spawn("gbrain"`, `execFileSync("gbrain"`, or
+ * `execSync(...gbrain` matches. Bun runs TS directly so there is no
+ * compiled artifact to grep — the .ts source is the truth.
+ *
+ * The check is intentionally narrow: only the two files where the bug
+ * actually hurts users are guarded. Other gbrain spawn sites
+ * (`lib/gbrain-sources.ts`, `lib/gbrain-local-status.ts`,
+ * `lib/gstack-memory-helpers.ts`, `bin/gstack-brain-context-load.ts`)
+ * either already accept env from callers or run probes that don't need
+ * DATABASE_URL. Expanding the invariant to those files is a follow-up.
+ */
+
+import { describe, it, expect } from "bun:test";
+import { readFileSync } from "fs";
+import { join } from "path";
+
+const ROOT = join(import.meta.dir, "..");
+
+const GUARDED_FILES = [
+  "bin/gstack-gbrain-sync.ts",
+  "bin/gstack-memory-ingest.ts",
+];
+
+// Patterns that would bypass lib/gbrain-exec.ts. Match the literal `"gbrain"`
+// as the first argument since these helpers are the failure mode.
+const BANNED_PATTERNS: Array<{ name: string; regex: RegExp }> = [
+  { name: 'spawnSync("gbrain", ...)', regex: /spawnSync\s*\(\s*["']gbrain["']/g },
+  { name: 'spawn("gbrain", ...)', regex: /\bspawn\s*\(\s*["']gbrain["']/g },
+  { name: 'execFileSync("gbrain", ...)', regex: /execFileSync\s*\(\s*["']gbrain["']/g },
+  { name: 'execSync("...gbrain...")', regex: /execSync\s*\(\s*["'`][^"'`]*\bgbrain\b/g },
+];
+
+describe("gbrain-exec invariant", () => {
+  for (const relpath of GUARDED_FILES) {
+    it(`${relpath} routes every gbrain spawn through lib/gbrain-exec.ts`, () => {
+      const source = readFileSync(join(ROOT, relpath), "utf-8");
+      // Strip block comments and line comments before scanning — a
+      // documentation reference like `// spawnSync("gbrain", ...)` in a
+      // comment shouldn't trip the invariant. The strip is approximate
+      // (sufficient for the patterns we care about); production code
+      // should match cleanly.
+      const stripped = source
+        .replace(/\/\*[\s\S]*?\*\//g, "")
+        .replace(/\/\/.*$/gm, "");
+
+      for (const { name, regex } of BANNED_PATTERNS) {
+        const matches = stripped.match(regex) || [];
+        if (matches.length > 0) {
+          // Find the line numbers to make the failure actionable.
+          const lines = stripped.split("\n");
+          const hits: string[] = [];
+          for (let i = 0; i < lines.length; i++) {
+            if (new RegExp(regex.source).test(lines[i])) {
+              hits.push(`  ${relpath}:${i + 1}: ${lines[i].trim()}`);
+            }
+          }
+          throw new Error(
+            `Found ${matches.length} direct gbrain invocation(s) in ${relpath} matching \`${name}\`:\n${hits.join("\n")}\n\n`
+            + `Route every gbrain spawn through \`spawnGbrain\`/\`execGbrainJson\`/\`execGbrainText\` `
+            + `in lib/gbrain-exec.ts so DATABASE_URL is seeded from gbrain's config.`,
+          );
+        }
+      }
+
+      // Positive assertion: the file should import from lib/gbrain-exec.
+      expect(source).toMatch(/from\s+["']\.\.\/lib\/gbrain-exec["']/);
+    });
+  }
+});
--- a/test/gbrain-local-status.test.ts
+++ b/test/gbrain-local-status.test.ts
@@ -21,6 +21,7 @@ import { describe, it, expect, beforeEach, afterEach } from "bun:test";
 import {
  mkdtempSync,
  writeFileSync,
+  readFileSync,
  mkdirSync,
  rmSync,
  chmodSync,
@@ -160,6 +161,16 @@ describe("lib/gbrain-local-status — five status cases", () => {
    restoreEnv = null;
  });

+  it("probes the gbrain executable directly instead of shelling through command -v", () => {
+    const source = readFileSync(
+      join(import.meta.dir, "..", "lib", "gbrain-local-status.ts"),
+      "utf-8",
+    );
+
+    expect(source).not.toContain('command -v gbrain');
+    expect(source).toContain('execFileSync("gbrain", ["--version"]');
+  });
+
  it("returns 'no-cli' when gbrain is not on PATH", () => {
    env = makeEnv({ withGbrain: false });
    restoreEnv = applyEnv(env);
--- a/test/gbrain-source-gitignore.test.ts
+++ b/test/gbrain-source-gitignore.test.ts
@@ -0,0 +1,96 @@
+/**
+ * Unit tests for the `.gbrain-source` gitignore append done by
+ * `runCodeImport` after a successful `gbrain sources attach`.
+ *
+ * Covers #1384: v1.29.0.0 changelog promised the per-worktree pin would be
+ * ignored in the consuming repo, but the change actually only added
+ * `.gbrain-source` to gstack's own `.gitignore`. Without the consumer-side
+ * entry, Conductor sibling worktrees commit the pin and clobber each other.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync, chmodSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+
+import { ensureGbrainSourceGitignored } from "../bin/gstack-gbrain-sync";
+
+describe("ensureGbrainSourceGitignored", () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "gstack-gbrain-gitignore-"));
+  });
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it("creates .gitignore with the pin entry when none exists", () => {
+    const gitignorePath = join(root, ".gitignore");
+    expect(existsSync(gitignorePath)).toBe(false);
+
+    ensureGbrainSourceGitignored(root);
+
+    expect(existsSync(gitignorePath)).toBe(true);
+    expect(readFileSync(gitignorePath, "utf-8")).toBe(".gbrain-source\n");
+  });
+
+  it("appends the pin entry to an existing .gitignore without trailing newline", () => {
+    const gitignorePath = join(root, ".gitignore");
+    writeFileSync(gitignorePath, "node_modules\n.env");
+
+    ensureGbrainSourceGitignored(root);
+
+    expect(readFileSync(gitignorePath, "utf-8")).toBe(
+      "node_modules\n.env\n.gbrain-source\n",
+    );
+  });
+
+  it("appends the pin entry to an existing .gitignore with trailing newline", () => {
+    const gitignorePath = join(root, ".gitignore");
+    writeFileSync(gitignorePath, "node_modules\n.env\n");
+
+    ensureGbrainSourceGitignored(root);
+
+    expect(readFileSync(gitignorePath, "utf-8")).toBe(
+      "node_modules\n.env\n.gbrain-source\n",
+    );
+  });
+
+  it("is idempotent: does not duplicate the pin entry on a second call", () => {
+    const gitignorePath = join(root, ".gitignore");
+    writeFileSync(gitignorePath, "node_modules\n.gbrain-source\n.env\n");
+
+    ensureGbrainSourceGitignored(root);
+    ensureGbrainSourceGitignored(root);
+
+    const lines = readFileSync(gitignorePath, "utf-8").split("\n");
+    const hits = lines.filter((line) => line.trim() === ".gbrain-source");
+    expect(hits.length).toBe(1);
+  });
+
+  it("recognizes the entry even when it has surrounding whitespace", () => {
+    const gitignorePath = join(root, ".gitignore");
+    writeFileSync(gitignorePath, "node_modules\n  .gbrain-source  \n");
+
+    ensureGbrainSourceGitignored(root);
+
+    const lines = readFileSync(gitignorePath, "utf-8").split("\n");
+    const hits = lines.filter((line) => line.trim() === ".gbrain-source");
+    expect(hits.length).toBe(1);
+  });
+
+  it("does not throw when the .gitignore is read-only", () => {
+    const gitignorePath = join(root, ".gitignore");
+    writeFileSync(gitignorePath, "node_modules\n");
+    const originalMode = statSync(gitignorePath).mode;
+    chmodSync(gitignorePath, 0o444);
+    try {
+      // Must not throw — sync stage continues on write failure.
+      expect(() => ensureGbrainSourceGitignored(root)).not.toThrow();
+    } finally {
+      chmodSync(gitignorePath, originalMode);
+    }
+  });
+});
--- a/test/gstack-gbrain-sync.test.ts
+++ b/test/gstack-gbrain-sync.test.ts
@@ -7,12 +7,19 @@
 * preview + state file lifecycle + flag composition.
 */

-import { describe, it, expect } from "bun:test";
-import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync, mkdirSync } from "fs";
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync, mkdirSync, chmodSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
 import { spawnSync } from "child_process";

+import {
+  derivePathOnlyHashLegacyId,
+  planHostnameFoldMigration,
+  sourceLocalPath,
+  _resetGbrainSupportsRenameCache,
+} from "../bin/gstack-gbrain-sync";
+
 const SCRIPT = join(import.meta.dir, "..", "bin", "gstack-gbrain-sync.ts");

 function makeTestHome(): string {
@@ -48,6 +55,13 @@ describe("gstack-gbrain-sync CLI", () => {
    expect(r.stderr).toContain("Unknown argument: --bogus");
  });

+  it("uses the shared local gbrain status classifier instead of shelling through command -v", () => {
+    const source = readFileSync(SCRIPT, "utf-8");
+
+    expect(source).not.toContain('command -v gbrain');
+    expect(source).toContain("localEngineStatus");
+  });
+
  it("--dry-run with --code-only reports the code import preview only", () => {
    const home = makeTestHome();
    const gstackHome = join(home, ".gstack");
@@ -215,6 +229,62 @@ describe("gstack-gbrain-sync CLI", () => {
    rmSync(home, { recursive: true, force: true });
  });

+  it("derives distinct source ids for the same absolute path on different hosts", () => {
+    // Issue #1414: two machines with identical home-dir layouts (chezmoi-managed
+    // dotfiles, ansible-provisioned VMs) collide on the same source id when
+    // federated against a shared gbrain DB, because the pre-fix `pathHash` was
+    // sha1(absolute path) only — host-agnostic. Folding hostname into the hash
+    // key keeps them distinct. `GSTACK_HOSTNAME` env var is the test-only knob;
+    // production uses `os.hostname()`.
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const repo = mkdtempSync(join(tmpdir(), "gstack-host-collide-"));
+    spawnSync("git", ["init", "--quiet", "-b", "main"], { cwd: repo });
+    spawnSync("git", ["remote", "add", "origin", "https://github.com/example/multihost.git"], { cwd: repo });
+
+    // Dry-run still gates the code stage on `command -v gbrain`. Drop a no-op
+    // shim on PATH so the stage runs (we only assert the preview line, never
+    // invoke gbrain itself).
+    const bindir = mkdtempSync(join(tmpdir(), "gstack-host-collide-bin-"));
+    const shim = join(bindir, "gbrain");
+    writeFileSync(shim, "#!/bin/sh\nexit 0\n");
+    chmodSync(shim, 0o755);
+    const PATH = `${bindir}:${process.env.PATH || ""}`;
+
+    const runAs = (host: string) =>
+      spawnSync("bun", [SCRIPT, "--dry-run", "--code-only", "--quiet"], {
+        encoding: "utf-8",
+        timeout: 60000,
+        cwd: repo,
+        env: { ...process.env, HOME: home, GSTACK_HOME: gstackHome, GSTACK_HOSTNAME: host, PATH },
+      });
+
+    const a = runAs("machine-a");
+    const b = runAs("machine-b");
+    expect(a.status).toBe(0);
+    expect(b.status).toBe(0);
+    const idA = (a.stdout || "").match(/gbrain sources add (\S+)/)?.[1];
+    const idB = (b.stdout || "").match(/gbrain sources add (\S+)/)?.[1];
+    expect(idA).toBeTruthy();
+    expect(idB).toBeTruthy();
+    expect(idA).not.toBe(idB);
+    // Both still gbrain-valid.
+    const VALID_ID = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;
+    expect(idA!).toMatch(VALID_ID);
+    expect(idB!).toMatch(VALID_ID);
+
+    // Same host + same path stays stable across invocations.
+    const a2 = runAs("machine-a");
+    expect(a2.status).toBe(0);
+    const idA2 = (a2.stdout || "").match(/gbrain sources add (\S+)/)?.[1];
+    expect(idA2).toBe(idA);
+
+    rmSync(repo, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+    rmSync(bindir, { recursive: true, force: true });
+  });
+
  it("dry-run does NOT acquire the lock file (lock is for write paths only)", () => {
    const home = makeTestHome();
    const gstackHome = join(home, ".gstack");
@@ -476,3 +546,295 @@ describe("gstack-gbrain-sync CLI", () => {
    rmSync(home, { recursive: true, force: true });
  });
 });
+
+// ──────────────────────────────────────────────────────────────────────────
+// Hostname-fold migration (v1.40.0.0)
+//
+// Tests for `derivePathOnlyHashLegacyId` and `planHostnameFoldMigration`,
+// which together let an existing user's pre-#1468 path-only-hash source
+// transition to the new hostname-folded id without orphaning pages or
+// creating a data-loss window. See bin/gstack-gbrain-sync.ts and the
+// gbrain-sync-hardening plan.
+// ──────────────────────────────────────────────────────────────────────────
+
+/**
+ * Build a gbrain shim that responds to specific subcommands with canned
+ * output, then return PATH-prepend value. Lets us run helpers in-process
+ * (which spawn `gbrain` from PATH) without a real gbrain CLI.
+ */
+function makeShim(bindir: string, responses: Record<string, { stdout?: string; stderr?: string; exit?: number }>): string {
+  const shim = join(bindir, "gbrain");
+  const cases = Object.entries(responses).map(([key, r]) => {
+    const exit = r.exit ?? 0;
+    const stdout = (r.stdout || "").replace(/'/g, "'\\''");
+    const stderr = (r.stderr || "").replace(/'/g, "'\\''");
+    // Patterns with spaces MUST be double-quoted in sh case statements,
+    // otherwise the shell parses the second word as the start of the next
+    // pattern and errors out.
+    return `  "${key}") printf '%s' '${stdout}'; printf '%s' '${stderr}' >&2; exit ${exit} ;;`;
+  }).join("\n");
+  // Match on the full argument string, joined with literal spaces.
+  const script = `#!/bin/sh\nARGS="$*"\ncase "$ARGS" in\n${cases}\n  *) echo "shim: no match for [$ARGS]" >&2; exit 1 ;;\nesac\n`;
+  writeFileSync(shim, script);
+  chmodSync(shim, 0o755);
+  return shim;
+}
+
+describe("derivePathOnlyHashLegacyId", () => {
+  it("returns the pre-#1468 form (path-only sha1, no hostname)", () => {
+    // Pure function — no subprocess. The same repoPath must yield the same
+    // legacy id regardless of $GSTACK_HOSTNAME, because the pre-#1468 hash
+    // didn't include hostname.
+    const repo = mkdtempSync(join(tmpdir(), "gstack-legacy-id-"));
+    spawnSync("git", ["init", "--quiet", "-b", "main"], { cwd: repo });
+    spawnSync("git", ["remote", "add", "origin", "https://github.com/example/legacy-test.git"], { cwd: repo });
+
+    const cwd = process.cwd();
+    try {
+      process.chdir(repo);
+      const a = derivePathOnlyHashLegacyId(repo);
+      process.env.GSTACK_HOSTNAME = "machine-a";
+      const b = derivePathOnlyHashLegacyId(repo);
+      process.env.GSTACK_HOSTNAME = "machine-b";
+      const c = derivePathOnlyHashLegacyId(repo);
+      expect(a).toBe(b);
+      expect(b).toBe(c);
+      expect(a.startsWith("gstack-code-")).toBe(true);
+      expect(a.length).toBeLessThanOrEqual(32);
+    } finally {
+      delete process.env.GSTACK_HOSTNAME;
+      process.chdir(cwd);
+      rmSync(repo, { recursive: true, force: true });
+    }
+  });
+
+  it("produces a different id than the new hostname-folded form", () => {
+    // The whole point of the migration: the path-only-hash legacy id and the
+    // host-fold id must differ for any non-empty hostname, so the migration
+    // can detect + clean up the orphan.
+    const repo = mkdtempSync(join(tmpdir(), "gstack-legacy-id-distinct-"));
+    spawnSync("git", ["init", "--quiet", "-b", "main"], { cwd: repo });
+    spawnSync("git", ["remote", "add", "origin", "https://github.com/example/distinct.git"], { cwd: repo });
+
+    const cwd = process.cwd();
+    try {
+      process.chdir(repo);
+      process.env.GSTACK_HOSTNAME = "machine-x";
+      const legacy = derivePathOnlyHashLegacyId(repo);
+      // Drive the new id through the CLI so we use the same code path users hit.
+      const home = makeTestHome();
+      const gstackHome = join(home, ".gstack");
+      mkdirSync(gstackHome, { recursive: true });
+      const bindir = mkdtempSync(join(tmpdir(), "gstack-legacy-id-distinct-bin-"));
+      makeShim(bindir, { "--help": { stdout: "gbrain\n" } });
+      const r = spawnSync("bun", [SCRIPT, "--dry-run", "--code-only", "--quiet"], {
+        encoding: "utf-8",
+        timeout: 60000,
+        cwd: repo,
+        env: { ...process.env, HOME: home, GSTACK_HOME: gstackHome, GSTACK_HOSTNAME: "machine-x", PATH: `${bindir}:${process.env.PATH || ""}` },
+      });
+      const newId = (r.stdout || "").match(/gbrain sources add (\S+)/)?.[1];
+      expect(newId).toBeTruthy();
+      expect(newId).not.toBe(legacy);
+      rmSync(home, { recursive: true, force: true });
+      rmSync(bindir, { recursive: true, force: true });
+    } finally {
+      delete process.env.GSTACK_HOSTNAME;
+      process.chdir(cwd);
+      rmSync(repo, { recursive: true, force: true });
+    }
+  });
+});
+
+/**
+ * Build an env dict that prepends `bindir` to PATH. Bun's spawnSync does NOT
+ * pick up runtime mutations of `process.env.PATH` — the env must be passed
+ * explicitly to each spawn for the override to take effect.
+ */
+function envWithBindir(bindir: string): NodeJS.ProcessEnv {
+  return { ...process.env, PATH: `${bindir}:${process.env.PATH || ""}` };
+}
+
+describe("planHostnameFoldMigration", () => {
+  let bindir: string;
+
+  beforeEach(() => {
+    bindir = mkdtempSync(join(tmpdir(), "gstack-mig-plan-bin-"));
+    _resetGbrainSupportsRenameCache();
+  });
+  afterEach(() => {
+    rmSync(bindir, { recursive: true, force: true });
+    _resetGbrainSupportsRenameCache();
+  });
+
+  it("returns ids-match when legacy == new (degenerate case)", () => {
+    const result = planHostnameFoldMigration("/repo/path", "gstack-code-same-abc12345", "gstack-code-same-abc12345");
+    expect(result).toEqual({ kind: "none", reason: "ids-match" });
+  });
+
+  it("returns no-legacy-source when sources list does not include the legacy id", () => {
+    makeShim(bindir, {
+      "sources list --json": { stdout: "[]" },
+    });
+    const result = planHostnameFoldMigration("/repo/path", "new-id", "legacy-id", envWithBindir(bindir));
+    expect(result).toEqual({ kind: "none", reason: "no-legacy-source" });
+  });
+
+  it("returns skipped-path-drift when old source local_path differs from current repo root", () => {
+    makeShim(bindir, {
+      "sources list --json": {
+        stdout: JSON.stringify([{ id: "legacy-id", local_path: "/some/other/repo" }]),
+      },
+    });
+    const result = planHostnameFoldMigration("/repo/here", "new-id", "legacy-id", envWithBindir(bindir));
+    expect(result.kind).toBe("skipped-path-drift");
+    if (result.kind === "skipped-path-drift") {
+      expect(result.oldId).toBe("legacy-id");
+      expect(result.oldPath).toBe("/some/other/repo");
+      expect(result.currentPath).toBe("/repo/here");
+    }
+  });
+
+  it("returns renamed when rename is supported and exits 0", () => {
+    makeShim(bindir, {
+      "sources list --json": {
+        stdout: JSON.stringify([{ id: "legacy-id", local_path: "/repo/here" }]),
+      },
+      "sources rename --help": {
+        stdout: "Usage: gbrain sources rename <old> <new>\n",
+      },
+      "sources rename legacy-id new-id": { exit: 0 },
+    });
+    const result = planHostnameFoldMigration("/repo/here", "new-id", "legacy-id", envWithBindir(bindir));
+    expect(result).toEqual({ kind: "renamed", oldId: "legacy-id", newId: "new-id" });
+  });
+
+  it("returns pending-cleanup when rename is unsupported (current gbrain 0.35.0.0)", () => {
+    makeShim(bindir, {
+      "sources list --json": {
+        stdout: JSON.stringify([{ id: "legacy-id", local_path: "/repo/here" }]),
+      },
+      // No `sources rename --help` match → shim falls into the catch-all and exits 1.
+    });
+    const result = planHostnameFoldMigration("/repo/here", "new-id", "legacy-id", envWithBindir(bindir));
+    expect(result).toEqual({ kind: "pending-cleanup", oldId: "legacy-id" });
+  });
+
+  it("returns pending-cleanup when rename is supported but the rename call itself fails", () => {
+    makeShim(bindir, {
+      "sources list --json": {
+        stdout: JSON.stringify([{ id: "legacy-id", local_path: "/repo/here" }]),
+      },
+      "sources rename --help": {
+        stdout: "Usage: gbrain sources rename <old> <new>\n",
+      },
+      "sources rename legacy-id new-id": { exit: 1, stderr: "rename failed: db locked" },
+    });
+    const result = planHostnameFoldMigration("/repo/here", "new-id", "legacy-id", envWithBindir(bindir));
+    expect(result).toEqual({ kind: "pending-cleanup", oldId: "legacy-id" });
+  });
+});
+
+describe("constrainSourceId truncation (hyphen-boundary cut)", () => {
+  // PR #1481 (Drummerms): the old slug.slice(-tailBudget) cut mid-word when
+  // the boundary fell inside a token. For a long repo like
+  // `drummerms-av-sow-wiz-skill-270c0001` the truncated tail used to end in
+  // `kill-270c0001` (from `skill`). The new tokenized cut walks hyphen
+  // boundaries from the right and only keeps whole tokens.
+  //
+  // Exercised via the dry-run preview (`gbrain sources add gstack-code-…`),
+  // since constrainSourceId is module-private.
+  it("never produces mid-word truncation artifacts like `kill` (from `skill`)", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const repo = mkdtempSync(join(tmpdir(), "gstack-hyphen-cut-"));
+    spawnSync("git", ["init", "--quiet", "-b", "main"], { cwd: repo });
+    // Remote chosen to be long enough that constrainSourceId truncates and
+    // the boundary lands inside the word `skill`.
+    spawnSync("git", ["remote", "add", "origin", "https://github.com/drummerms-av-sow-wiz/skill-270c0001.git"], { cwd: repo });
+
+    const r = spawnSync("bun", [SCRIPT, "--dry-run", "--code-only", "--quiet"], {
+      encoding: "utf-8",
+      timeout: 60000,
+      cwd: repo,
+      env: { ...process.env, HOME: home, GSTACK_HOME: gstackHome },
+    });
+    expect(r.status).toBe(0);
+    const id = (r.stdout || "").match(/gbrain sources add (\S+)/)?.[1];
+    expect(id).toBeTruthy();
+    // The id must not contain the mid-word fragment `kill` (left over from
+    // slicing inside `skill`). Tokens that survive truncation must be whole.
+    expect(id).not.toMatch(/(^|-)kill(-|$)/);
+    // Still gbrain-valid.
+    expect(id!.length).toBeLessThanOrEqual(32);
+    expect(id!).toMatch(/^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/);
+
+    rmSync(repo, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  // Closes #1357: HTTPS remotes ending in `.git` used to pass periods through
+  // to the source id. canonicalizeRemote strips the `.git` suffix; the
+  // sanitizer also strips any residual non-alnum. Test asserts the source id
+  // is period-free for the exact case from the issue.
+  it("produces a period-free source id for HTTPS remotes ending in .git (#1357)", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const repo = mkdtempSync(join(tmpdir(), "gstack-https-period-"));
+    spawnSync("git", ["init", "--quiet", "-b", "main"], { cwd: repo });
+    spawnSync("git", ["remote", "add", "origin", "https://github.com/foo/bar.git"], { cwd: repo });
+
+    const r = spawnSync("bun", [SCRIPT, "--dry-run", "--code-only", "--quiet"], {
+      encoding: "utf-8",
+      timeout: 60000,
+      cwd: repo,
+      env: { ...process.env, HOME: home, GSTACK_HOME: gstackHome },
+    });
+    expect(r.status).toBe(0);
+    const id = (r.stdout || "").match(/gbrain sources add (\S+)/)?.[1];
+    expect(id).toBeTruthy();
+    expect(id).not.toContain(".");
+    expect(id!).toMatch(/^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/);
+
+    rmSync(repo, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  });
+});
+
+describe("sourceLocalPath", () => {
+  let bindir: string;
+  beforeEach(() => {
+    bindir = mkdtempSync(join(tmpdir(), "gstack-source-lp-bin-"));
+  });
+  afterEach(() => {
+    rmSync(bindir, { recursive: true, force: true });
+  });
+
+  it("returns local_path when the source exists", () => {
+    makeShim(bindir, {
+      "sources list --json": {
+        stdout: JSON.stringify([
+          { id: "other-source", local_path: "/x" },
+          { id: "target-id", local_path: "/repo/match" },
+        ]),
+      },
+    });
+    expect(sourceLocalPath("target-id", envWithBindir(bindir))).toBe("/repo/match");
+  });
+
+  it("returns null when the source is missing", () => {
+    makeShim(bindir, {
+      "sources list --json": { stdout: "[]" },
+    });
+    expect(sourceLocalPath("missing-id", envWithBindir(bindir))).toBeNull();
+  });
+
+  it("returns null when gbrain exits non-zero or returns malformed JSON", () => {
+    makeShim(bindir, {
+      "sources list --json": { exit: 2, stderr: "db unreachable" },
+    });
+    expect(sourceLocalPath("any-id", envWithBindir(bindir))).toBeNull();
+  });
+});
--- a/test/gstack-memory-ingest.test.ts
+++ b/test/gstack-memory-ingest.test.ts
@@ -421,6 +421,16 @@ esac
 }

 describe("gstack-memory-ingest writer (gbrain v0.20+ batch `import` interface)", () => {
+  it("probes the gbrain executable directly instead of shelling through command -v", () => {
+    const source = readFileSync(SCRIPT, "utf-8");
+
+    expect(source).not.toContain('command -v gbrain');
+    // v1.40.0.0: probe routes through lib/gbrain-exec.ts's execGbrainText helper
+    // (codex review #4 — centralized gbrain spawn surface). Pre-v1.40 the call
+    // was a direct `execFileSync("gbrain", ["--help"], ...)` inline.
+    expect(source).toContain('execGbrainText(["--help"]');
+  });
+
  it("invokes `gbrain import <dir> --no-embed --json` exactly once with hierarchical staging", () => {
    const home = makeTestHome();
    const gstackHome = join(home, ".gstack");