@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/read-only-gate.test.ts

@@ -1,188 +0,0 @@
-// Cloud Phase 25 C2 — the local half of the read-only gate.
-//
-// When the linked hub's credential carries the `viewer` role (vouched at
-// workspace sign-in, stored in hubs.json), the LOCAL dev-server refuses
-// project-mutating writes with a legible 403 — so a viewer's clone can never
-// silently diverge from the cell (which refuses the same writes at sync,
-// Phase 25 C1). Writes are default-denied with a short allowlist
-// (READ_ONLY_ALLOWED_WRITES in http.ts): per-user runtime state (camera,
-// ui-prefs) plus the two role-granted verbs the cell itself allows (export,
-// session management).
-
-import { afterAll, describe, expect, test } from 'bun:test';
-import { readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import type { Subprocess } from 'bun';
-
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-const HUB_URL = 'http://hub.invalid:9';
-
-/** Sandbox linked to a hub whose credential vouches `role`. */
-function makeLinkedSandbox(role?: string) {
-  const { root, designRoot } = makeSandbox();
-  const cfgPath = join(designRoot, 'config.json');
-  const cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
-  cfg.linkedHub = { url: HUB_URL, linkedAt: Date.now() };
-  writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));
-  // The hubs.json credential store the role is read from (isHubReadOnly).
-  const hubsPath = join(root, 'hubs.json');
-  writeFileSync(
-    hubsPath,
-    JSON.stringify({
-      hubs: { [HUB_URL]: { token: 't', linkedAt: Date.now(), ...(role ? { role } : {}) } },
-    })
-  );
-  return { root, designRoot, hubsPath };
-}
-
-const procs: Subprocess[] = [];
-afterAll(async () => {
-  for (const p of procs) await killProc(p);
-});
-
-async function boot(role?: string) {
-  const { root, hubsPath } = makeLinkedSandbox(role);
-  const port = nextPort();
-  const proc = await bootServer(root, port, { HUBS_CONFIG_PATH: hubsPath });
-  procs.push(proc);
-  return { base: `http://localhost:${port}` };
-}
-
-describe('read-only gate — viewer role refuses project writes locally', () => {
-  test('viewer: writes 403 read-only, per-user + role-granted writes pass, /_config says so', async () => {
-    const { base } = await boot('viewer');
-
-    // /_config tells the client at boot.
-    const cfg = (await (await fetch(`${base}/_config`)).json()) as { readOnly?: boolean };
-    expect(cfg.readOnly).toBe(true);
-
-    // Project-mutating writes: refused with the legible read-only shape.
-    const editText = await fetch(`${base}/_api/edit-text`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ file: 'ui/fixture.html', text: 'x' }),
-    });
-    expect(editText.status).toBe(403);
-    const body = (await editText.json()) as { error?: string; message?: string };
-    expect(body.error).toBe('read-only');
-    expect(body.message).toContain('viewer');
-
-    // Canvas create + delete-element + git commit: same refusal.
-    for (const [path, method] of [
-      ['/_api/canvas', 'POST'],
-      ['/_api/delete-element', 'POST'],
-      ['/_api/git/commit', 'POST'],
-      ['/_api/fs-mkdir', 'POST'],
-      ['/_api/annotations', 'PUT'],
-      ['/_api/acp/chat', 'POST'],
-      // Cloud Phase 27 D2 — both USED to be on READ_ONLY_ALLOWED_WRITES, on the
-      // reasoning that "viewing another branch is not changing one". Both
-      // rewrite the working TREE, and the tree is shared: a viewer switching
-      // branches replaces the files under whoever is mid-edit. The cell's proxy
-      // refuses them too, but this is the gate the hub-linked desktop and the
-      // self-host path consult, where no manifest runs at all.
-      ['/_api/git/checkout', 'POST'],
-      ['/_api/git/pull', 'POST'],
-    ] as const) {
-      const r = await fetch(base + path, { method, body: '{}' });
-      expect(`${path} ${r.status}`).toBe(`${path} 403`);
-    }
-
-    // canvas-meta: the LAYOUT lane is refused…
-    const layout = await fetch(`${base}/_api/canvas-meta`, {
-      method: 'PATCH',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({
-        file: '.design/ui/fixture.html',
-        patch: { layout: { artboards: [] } },
-      }),
-    });
-    expect(layout.status).toBe(403);
-    // …the VIEWPORT lane (per-user camera) is not.
-    const viewport = await fetch(`${base}/_api/canvas-meta`, {
-      method: 'PATCH',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({
-        file: '.design/ui/fixture.html',
-        patch: { viewport: { x: 0, y: 0, zoom: 1 } },
-      }),
-    });
-    expect(viewport.status).not.toBe(403);
-
-    // Per-user runtime state stays writable (DDR-115 taxonomy).
-    const camera = await fetch(`${base}/_canvas-state`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ file: '.design/ui/fixture.html', viewport: { x: 1, y: 2, zoom: 1 } }),
-    });
-    expect(camera.status).toBe(204);
-
-    // Role-granted verb: export reaches its handler (may 400 on shape, never 403).
-    const exp = await fetch(`${base}/_api/export`, { method: 'POST', body: '{}' });
-    expect(exp.status).not.toBe(403);
-
-    // Reads are untouched.
-    expect((await fetch(`${base}/_index-data`)).status).toBe(200);
-    expect((await fetch(`${base}/_comments-all`)).status).toBe(200);
-  }, 30000);
-
-  test('member (no role on the credential): writes are NOT gated', async () => {
-    const { base } = await boot(undefined);
-    const cfg = (await (await fetch(`${base}/_config`)).json()) as { readOnly?: boolean };
-    expect(cfg.readOnly).toBe(false);
-    // A write reaches its handler (400 on bad shape — not the 403 refusal).
-    const r = await fetch(`${base}/_api/edit-text`, { method: 'POST', body: '{}' });
-    expect(r.status).not.toBe(403);
-  }, 30000);
-});
-
-// ---------------------------------------------------------------------------
-// Cloud Phase 27 — the one write a viewer holds.
-//
-// The role matrix has said `viewer.comment === true` since Phase 25 C4 and the
-// People page promises it in those words. This list did not have it, so a
-// viewer's comment was allowed by the authority (the cell's proxy) and then
-// refused by the defence-in-depth layer behind it. Found by commenting as a
-// viewer against a real cell, not by reading either file.
-
-describe('a viewer may comment — the matrix says so, and so must this gate', () => {
-  test('comment + reply pass; annotate still does not', async () => {
-    const { base } = await boot('viewer');
-
-    const comment = await fetch(`${base}/_comments`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ file: 'ui/Sample.tsx', text: 'looks off to me' }),
-    });
-    expect(comment.status).not.toBe(403);
-
-    const reply = await fetch(`${base}/_api/comments/abc123/reply`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ text: 'agreed' }),
-    });
-    expect(reply.status).not.toBe(403);
-
-    // An annotation is drawn ON the design and versioned with it — the matrix
-    // files it with `edit`, and that distinction has to survive this change.
-    const annotate = await fetch(`${base}/_api/annotations`, {
-      method: 'PUT',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ file: 'ui/Sample.tsx', svg: '<svg/>' }),
-    });
-    expect(annotate.status).toBe(403);
-  });
-
-  test('the reply pattern does not open the whole comment namespace', async () => {
-    const { base } = await boot('viewer');
-    for (const path of [
-      '/_api/comments/abc/delete',
-      '/_api/comments/abc/reply/../../edit-text',
-      '/_api/comments//reply',
-    ]) {
-      const res = await fetch(`${base}${path}`, { method: 'POST' });
-      expect(res.status).not.toBe(200);
-    }
-  });
-});

package/apps/studio/test/read-only-role.test.ts

@@ -1,95 +0,0 @@
-// The client learns it is a viewer at BOOT — Cloud Phase 25 C2.
-//
-// The alternative is learning it from the first refused write, which means
-// drawing somebody an editor and then taking it away. So the role the
-// workspace vouched for at sign-in is persisted with the credential and
-// resolved before the UI paints.
-//
-// This flag decides what the UI OFFERS. It is never what stops a write: the
-// cell enforces that (Phase 25 C1 — a read-only peer token, Hocuspocus
-// dropping SyncStep2/Update, one HTTP gate), and it holds whatever a patched
-// client believes about itself.
-
-import { describe, expect, test } from 'bun:test';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { saveHubCredential } from '../sync/hub-link.ts';
-import { signInToWorkspace } from '../sync/workspace-signin.ts';
-
-function withHome<T>(fn: (home: string) => T): T {
-  const home = mkdtempSync(join(tmpdir(), 'maude-ro-'));
-  const prevXdg = process.env.XDG_CONFIG_HOME;
-  process.env.XDG_CONFIG_HOME = home;
-  try {
-    return fn(home);
-  } finally {
-    if (prevXdg === undefined) delete process.env.XDG_CONFIG_HOME;
-    else process.env.XDG_CONFIG_HOME = prevXdg;
-    rmSync(home, { recursive: true, force: true });
-  }
-}
-
-describe('the vouched role is persisted with the credential', () => {
-  test('a viewer is recorded as one', () => {
-    withHome((home) => {
-      saveHubCredential('https://p.cloud.maude.sh', 'mau_tok', 'viewer');
-      const cfg = JSON.parse(readFileSync(join(home, 'maude', 'hubs.json'), 'utf8'));
-      expect(cfg.hubs['https://p.cloud.maude.sh'].role).toBe('viewer');
-    });
-  });
-
-  test('a credential written without a role stays write-capable', () => {
-    // The upgrade promise: nobody is demoted by shipping this.
-    withHome((home) => {
-      saveHubCredential('https://p.cloud.maude.sh', 'mau_tok');
-      const cfg = JSON.parse(readFileSync(join(home, 'maude', 'hubs.json'), 'utf8'));
-      expect(cfg.hubs['https://p.cloud.maude.sh'].role).toBeUndefined();
-    });
-  });
-});
-
-describe('sign-in carries the role through to the credential', () => {
-  const okHub = (role: string) =>
-    (async (url: string) => {
-      const u = String(url);
-      if (u.endsWith('/health')) return Response.json({ ok: true, version: '1.0.0' });
-      return Response.json({ token: 'mau_minted', user: { email: 'v@example.com', role } });
-    }) as unknown as typeof fetch;
-
-  test('a viewer sign-in saves the role, and reports it back', async () => {
-    const saved: Array<[string, string, string | undefined]> = [];
-    const res = await signInToWorkspace(
-      { url: 'https://p.cloud.maude.sh', email: 'v@example.com', password: 'x'.repeat(12) },
-      {
-        save: (u, t, r) => saved.push([u, t, r]),
-        fetchImpl: okHub('viewer'),
-      }
-    );
-    expect(res.status).toBe(200);
-    expect(saved[0][2]).toBe('viewer');
-    expect((res.json as { user: { role: string } }).user.role).toBe('viewer');
-  });
-
-  test('a hub that names no role is treated as member, never as viewer', async () => {
-    // Failing OPEN on the UI flag is correct: the cell is what refuses a
-    // write, so a wrong guess here costs a redundant affordance, never
-    // access. Guessing "viewer" instead would lock out every self-hoster
-    // whose hub predates this field.
-    const saved: Array<[string, string, string | undefined]> = [];
-    const res = await signInToWorkspace(
-      { url: 'https://hub.example.com', email: 'm@example.com', password: 'x'.repeat(12) },
-      {
-        save: (u, t, r) => saved.push([u, t, r]),
-        fetchImpl: (async (url: string) => {
-          const u = String(url);
-          if (u.endsWith('/health')) return Response.json({ ok: true, version: '1.0.0' });
-          return Response.json({ token: 'mau_minted', user: { email: 'm@example.com' } });
-        }) as unknown as typeof fetch,
-      }
-    );
-    expect(res.status).toBe(200);
-    expect(saved[0][2]).toBe('member');
-  });
-});

package/apps/studio/test/readiness.test.ts

@@ -1,337 +0,0 @@
-// Readiness probe (DDR-128) — plugin-registry scan + PATH resolution. The
-// login-shell fallback's full correctness is proven on the packaged `.app`
-// (native-verification ceiling); here we cover the registry-scan branches, the
-// no-throw contracts, and the report shape. The probe is async (the fallback shells
-// out off the event loop — DDR-128 hardening), so everything awaits.
-
-import { describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { probeReadiness, resolveOnPath } from '../readiness.ts';
-
-const MARKET_OK = {
-  maude: { source: { source: 'github', repo: '1aGh/maude' }, installLocation: '/x' },
-};
-const INSTALLED_BOTH = {
-  version: 2,
-  plugins: {
-    'design@maude': [{ scope: 'user', version: '0.29.0' }],
-    'flow@maude': [{ scope: 'user', version: '0.29.0' }],
-  },
-};
-const INSTALLED_DESIGN_ONLY = { version: 2, plugins: { 'design@maude': [{ scope: 'user' }] } };
-// `/flow` is no longer part of the chat (2026-07-03) — the gate tracks `design`
-// alone, so a registry with flow-but-not-design is the "design missing" case.
-const INSTALLED_FLOW_ONLY = { version: 2, plugins: { 'flow@maude': [{ scope: 'user' }] } };
-
-function fixtureClaudeDir(opts: { markets?: unknown; installed?: unknown }): string {
-  const dir = mkdtempSync(join(tmpdir(), 'maude-readiness-'));
-  const pluginsDir = join(dir, 'plugins');
-  mkdirSync(pluginsDir, { recursive: true });
-  if (opts.markets !== undefined)
-    writeFileSync(join(pluginsDir, 'known_marketplaces.json'), JSON.stringify(opts.markets));
-  if (opts.installed !== undefined)
-    writeFileSync(join(pluginsDir, 'installed_plugins.json'), JSON.stringify(opts.installed));
-  return dir;
-}
-
-async function withClaudeDir<T>(dir: string, fn: () => Promise<T> | T): Promise<T> {
-  const saved = process.env.CLAUDE_CONFIG_DIR;
-  process.env.CLAUDE_CONFIG_DIR = dir;
-  try {
-    return await fn();
-  } finally {
-    if (saved === undefined) delete process.env.CLAUDE_CONFIG_DIR;
-    else process.env.CLAUDE_CONFIG_DIR = saved;
-  }
-}
-
-/** Plugins row under the given ~/.claude fixture. `nativeBootstrap:false` sets
- *  MAUDE_NO_PLUGIN_BOOTSTRAP to force the web / manual (DDR-128) path — needed to
- *  isolate the registry scan, since this suite runs in the dev tree where the
- *  bundled plugin dirs resolve and DDR-143 auto-load would otherwise mask it. */
-const pluginsItem = async (dir: string, opts: { nativeBootstrap?: boolean } = {}) => {
-  const savedOptOut = process.env.MAUDE_NO_PLUGIN_BOOTSTRAP;
-  if (opts.nativeBootstrap === false) process.env.MAUDE_NO_PLUGIN_BOOTSTRAP = '1';
-  try {
-    return (await withClaudeDir(dir, () => probeReadiness())).items.find(
-      (i) => i.id === 'plugins'
-    )!;
-  } finally {
-    if (savedOptOut === undefined) delete process.env.MAUDE_NO_PLUGIN_BOOTSTRAP;
-    else process.env.MAUDE_NO_PLUGIN_BOOTSTRAP = savedOptOut;
-  }
-};
-
-// Registry-scan branches under the WEB / manual path (auto-bootstrap opted out) —
-// the pure DDR-128 detect-and-guide behavior, still what a `maude design serve`
-// user sees.
-describe('readiness — plugin registry scan (web / manual path)', () => {
-  test('design@maude + marketplace present → plugins item is present, no remediation', async () => {
-    const item = await pluginsItem(
-      fixtureClaudeDir({ markets: MARKET_OK, installed: INSTALLED_DESIGN_ONLY }),
-      { nativeBootstrap: false }
-    );
-    expect(item.status).toBe('present');
-    expect(item.remediation).toBeUndefined();
-  });
-
-  test('design@maude NOT installed → missing, names the absent design@maude + offers the fix', async () => {
-    // flow-only registry: `/flow` is irrelevant to the chat now, so this reads as
-    // "design missing" — the gate tracks design alone.
-    const item = await pluginsItem(
-      fixtureClaudeDir({ markets: MARKET_OK, installed: INSTALLED_FLOW_ONLY }),
-      { nativeBootstrap: false }
-    );
-    expect(item.status).toBe('missing');
-    expect(item.detail).toContain('design@maude');
-    expect(item.remediation).toContain('/plugin install');
-  });
-
-  test('registry absent → unknown (Claude Code internal contract; never throws)', async () => {
-    const item = await pluginsItem(fixtureClaudeDir({}), { nativeBootstrap: false });
-    expect(item.status).toBe('unknown');
-  });
-
-  test('plugin presence is the gate — a foreign-repo marketplace does not change a design-installed verdict', async () => {
-    const item = await pluginsItem(
-      fixtureClaudeDir({
-        markets: { other: { source: { repo: 'someone/else' } } },
-        installed: INSTALLED_BOTH,
-      }),
-      { nativeBootstrap: false }
-    );
-    expect(item.status).toBe('present');
-  });
-});
-
-// DDR-143 / DDR-168 — on the native/desktop path the ACP session ALWAYS loads
-// the bundled plugins, so the row is satisfied even against a pristine
-// registry, AND even when a marketplace copy is also installed at the user
-// level (DDR-168 removed the old scan-gated no-op — the bundled copy wins
-// regardless of disk state). This suite runs in the dev tree, so the bundled
-// plugin dirs resolve → native context is on by default (no opt-out).
-describe('readiness — plugin auto-bootstrap (native, DDR-143/DDR-168)', () => {
-  test('pristine registry → present + "Bundled with this app" detail, no manual remediation', async () => {
-    const item = await pluginsItem(fixtureClaudeDir({}));
-    expect(item.status).toBe('present');
-    expect(item.detail).toContain('Bundled with this app');
-    expect(item.remediation).toBeUndefined();
-  });
-
-  test('design NOT installed (flow-only registry) → still present (design is bundled, no red wall)', async () => {
-    const item = await pluginsItem(
-      fixtureClaudeDir({ markets: MARKET_OK, installed: INSTALLED_FLOW_ONLY })
-    );
-    expect(item.status).toBe('present');
-    expect(item.detail).toContain('Bundled with this app');
-    expect(item.remediation).toBeUndefined();
-  });
-
-  test('design ALSO installed on disk → present, STILL reads as bundled (DDR-168 — no more "is installed" framing)', async () => {
-    const item = await pluginsItem(
-      fixtureClaudeDir({ markets: MARKET_OK, installed: INSTALLED_DESIGN_ONLY })
-    );
-    expect(item.status).toBe('present');
-    expect(item.detail).toContain('Bundled with this app');
-  });
-});
-
-// Issue #107 — the `claude` row must never assert "not signed in" about a CLI
-// whose auth status it could not READ. That lie is what a mise-shim user hit:
-// signed in in the terminal, told otherwise by the app, and routed to a Sign-in
-// button whose poll re-ran the same failing probe until it timed out.
-describe('readiness — claude row, unreadable auth status (#107)', () => {
-  const claudeItem = async (bin: string) => {
-    const saved = process.env.MAUDE_CLAUDE_BIN;
-    process.env.MAUDE_CLAUDE_BIN = bin;
-    try {
-      return (await probeReadiness()).items.find((i) => i.id === 'claude')!;
-    } finally {
-      if (saved === undefined) delete process.env.MAUDE_CLAUDE_BIN;
-      else process.env.MAUDE_CLAUDE_BIN = saved;
-    }
-  };
-
-  test('resolvable CLI + unreadable status → unknown, not a "not signed in" claim', async () => {
-    // `sh` resolves as a binary but answers nothing useful to `auth status --json`.
-    const item = await claudeItem('/bin/sh');
-    expect(item.status).toBe('unknown');
-    expect(item.detail).not.toContain('not signed in');
-    expect(item.detail).toContain("couldn't read");
-  });
-
-  test('the remediation names the wrapper cause but keeps the path OUT of the copyable sentence', async () => {
-    const item = await claudeItem('/bin/sh');
-    expect(item.remediation ?? '').toMatch(/shim|wrapper/i);
-    // The row has a Copy affordance and `copyFix` strips backticks, so a path
-    // with shell metacharacters would ride onto the clipboard inside a sentence
-    // the user is told to paste — and it would turn the possibly-hijacked binary
-    // into an instruction to RUN it (attacker R2-2). It renders on its own line.
-    expect(item.remediation ?? '').not.toContain('/bin/sh');
-    // Nor does it coach an un-content-pinned PATH override at a confused user
-    // (attacker F4 — Maude would be clipboard-loading the incantation).
-    expect(item.remediation ?? '').not.toContain('MAUDE_CLAUDE_BIN');
-  });
-
-  test('the resolved path stays visible in the unknown state (DDR-166 Decision 3)', async () => {
-    // The row must still say WHICH binary it resolved — that display is the
-    // control against an invisible PATH hijack, and the unknown state is exactly
-    // where a hijack is most likely.
-    expect((await claudeItem('/bin/sh')).resolvedPath).toBe('/bin/sh');
-  });
-
-  test('no Sign-in button offered — its success signal is the probe that just failed', async () => {
-    expect((await claudeItem('/bin/sh')).action).toBeUndefined();
-  });
-
-  test('unknown still leaves the report not-ready (claude is a required item)', async () => {
-    const saved = process.env.MAUDE_CLAUDE_BIN;
-    process.env.MAUDE_CLAUDE_BIN = '/bin/sh';
-    try {
-      expect((await probeReadiness()).ready).toBe(false);
-    } finally {
-      if (saved === undefined) delete process.env.MAUDE_CLAUDE_BIN;
-      else process.env.MAUDE_CLAUDE_BIN = saved;
-    }
-  });
-
-  // Attacker R2-3 — a metered user could suppress DDR-123's billing warning by
-  // OMITTING apiProvider rather than forging 'firstParty'. Absent is not
-  // first-party; over-warning is the safe direction.
-  test('an absent apiProvider still trips the metered-billing warning', async () => {
-    const noisy = join(import.meta.dir, 'fixtures', 'noisy-claude-auth.mjs');
-    const saved = process.env.MAUDE_CLAUDE_BIN;
-    process.env.MAUDE_CLAUDE_BIN = noisy;
-    process.env.FAKE_CLAUDE_OUT = '{"loggedIn":true}'; // signed in, no provider field
-    try {
-      const item = (await probeReadiness()).items.find((i) => i.id === 'claude')!;
-      expect(item.status).toBe('present');
-      expect(item.detail).toContain('may bill metered API usage');
-      expect(item.detail).not.toContain('Pro/Max subscription.');
-    } finally {
-      delete process.env.FAKE_CLAUDE_OUT;
-      if (saved === undefined) delete process.env.MAUDE_CLAUDE_BIN;
-      else process.env.MAUDE_CLAUDE_BIN = saved;
-    }
-  });
-
-  test('an explicit firstParty still reads as on-subscription, with no warning', async () => {
-    const noisy = join(import.meta.dir, 'fixtures', 'noisy-claude-auth.mjs');
-    const saved = process.env.MAUDE_CLAUDE_BIN;
-    process.env.MAUDE_CLAUDE_BIN = noisy;
-    process.env.FAKE_CLAUDE_OUT =
-      '{"loggedIn":true,"apiProvider":"firstParty","subscriptionType":"max"}';
-    try {
-      const item = (await probeReadiness()).items.find((i) => i.id === 'claude')!;
-      expect(item.detail).toContain('Pro/Max subscription');
-      expect(item.detail).not.toContain('metered');
-    } finally {
-      delete process.env.FAKE_CLAUDE_OUT;
-      if (saved === undefined) delete process.env.MAUDE_CLAUDE_BIN;
-      else process.env.MAUDE_CLAUDE_BIN = saved;
-    }
-  });
-
-  test('a signed-out CLI is still reported as signed out, with the Sign-in action intact', async () => {
-    const saved = process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS;
-    process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS = 'signed-out';
-    try {
-      const item = (await probeReadiness()).items.find((i) => i.id === 'claude')!;
-      expect(item.status).toBe('missing');
-      expect(item.detail).toContain('not signed in');
-      expect(item.action).toBe('signin');
-    } finally {
-      if (saved === undefined) delete process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS;
-      else process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS = saved;
-    }
-  });
-});
-
-describe('readiness — resolveOnPath', () => {
-  test('finds a binary that is on PATH', async () => {
-    const hit = await resolveOnPath('sh');
-    expect(hit).not.toBeNull();
-    expect(existsSync(hit!)).toBe(true);
-  });
-
-  test('returns null for a bogus binary without throwing', async () => {
-    expect(await resolveOnPath('maude-definitely-not-real-xyz')).toBeNull();
-  });
-
-  test('login-shell fallback recovers a binary hidden from the app PATH', async () => {
-    const saved = process.env.PATH;
-    try {
-      // Simulate the truncated/empty GUI env so Bun.which misses and the fallback fires.
-      process.env.PATH = '';
-      const hit = await resolveOnPath('sh');
-      // When a login shell is usable it must recover an absolute, real path. In a
-      // sandbox with no usable login shell the fallback returns null — we don't fail
-      // on that, but a non-null result must be a real absolute path.
-      if (hit !== null) {
-        expect(hit.startsWith('/')).toBe(true);
-        expect(existsSync(hit)).toBe(true);
-      }
-    } finally {
-      if (saved === undefined) delete process.env.PATH;
-      else process.env.PATH = saved;
-    }
-  });
-});
-
-describe('readiness — report shape', () => {
-  test('always returns the five items with stable ids and a boolean ready', async () => {
-    const report = await probeReadiness();
-    expect(report.items.map((i) => i.id)).toEqual([
-      'claude',
-      'maude',
-      'plugins',
-      'agent-browser',
-      'adapter',
-    ]);
-    expect(typeof report.ready).toBe('boolean');
-  });
-
-  test('screenshot engine: required + present (bundled) on native → never blocks ready', async () => {
-    // Native (this dev tree): agent-browser is bundled, so the row is first-class
-    // (required) but PRESENT — it can't turn `ready` false.
-    const ab = (await probeReadiness()).items.find((i) => i.id === 'agent-browser')!;
-    expect(ab.required).toBe(true);
-    expect(ab.status).toBe('present');
-  });
-
-  test('screenshot engine: optional on the web/opt-out path', async () => {
-    const saved = process.env.MAUDE_NO_PLUGIN_BOOTSTRAP;
-    process.env.MAUDE_NO_PLUGIN_BOOTSTRAP = '1'; // force native=false
-    try {
-      const ab = (await probeReadiness()).items.find((i) => i.id === 'agent-browser')!;
-      expect(ab.required).toBe(false);
-    } finally {
-      if (saved === undefined) delete process.env.MAUDE_NO_PLUGIN_BOOTSTRAP;
-      else process.env.MAUDE_NO_PLUGIN_BOOTSTRAP = saved;
-    }
-  });
-
-  test('adapter row tracks the real chat gate (resolveAdapterEntry) and is required', async () => {
-    const saved = process.env.MAUDE_ACP_ADAPTER_ENTRY;
-    try {
-      // Point the override at a real file → the bridge is "bundled".
-      process.env.MAUDE_ACP_ADAPTER_ENTRY = import.meta.path;
-      const present = (await probeReadiness()).items.find((i) => i.id === 'adapter')!;
-      expect(present.required).toBe(true);
-      expect(present.status).toBe('present');
-
-      // Point it at a missing path → the row goes missing with remediation, the
-      // honest signal the v0.31–0.32 builds lacked (all other rows green, chat dead).
-      process.env.MAUDE_ACP_ADAPTER_ENTRY = join(tmpdir(), 'no-such-acp-adapter-xyz');
-      const missing = (await probeReadiness()).items.find((i) => i.id === 'adapter')!;
-      expect(missing.status).toBe('missing');
-      expect(missing.remediation).toBeDefined();
-    } finally {
-      if (saved === undefined) delete process.env.MAUDE_ACP_ADAPTER_ENTRY;
-      else process.env.MAUDE_ACP_ADAPTER_ENTRY = saved;
-    }
-  });
-});