@1agh/maude 1.0.9 → 1.2.0

package/cli/lib/hubs-config.test.mjs

@@ -1,165 +0,0 @@
-import assert from 'node:assert/strict';
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { test } from 'node:test';
-
-import {
-  addHub,
-  getHub,
-  hubsConfigPath,
-  loadHubsConfig,
-  normalizeUrl,
-  removeHub,
-  saveHubsConfig,
-  setHubCodeModules,
-} from './hubs-config.mjs';
-
-function withTmpConfig(fn) {
-  const dir = mkdtempSync(join(tmpdir(), 'maude-hubs-cfg-'));
-  const path = join(dir, 'hubs.json');
-  const prior = process.env.HUBS_CONFIG_PATH;
-  process.env.HUBS_CONFIG_PATH = path;
-  try {
-    return fn(path);
-  } finally {
-    // `env.X = undefined` sets the STRING "undefined", so the override leaked
-    // out of the harness and every later `addHub` in the same process wrote a
-    // file literally named `undefined` into the repo root. `delete` is the
-    // only way to actually unset it.
-    if (prior === undefined) delete process.env.HUBS_CONFIG_PATH;
-    else process.env.HUBS_CONFIG_PATH = prior;
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-test('hubsConfigPath honors HUBS_CONFIG_PATH override', () => {
-  withTmpConfig((path) => {
-    assert.equal(hubsConfigPath(), path);
-  });
-});
-
-test('loadHubsConfig returns empty when file missing', () => {
-  withTmpConfig(() => {
-    assert.deepEqual(loadHubsConfig(), { hubs: {} });
-  });
-});
-
-test('saveHubsConfig writes file at 0600 with parent dir creation', () => {
-  withTmpConfig((path) => {
-    saveHubsConfig({ hubs: { 'https://h.example': { token: 'mau_x', linkedAt: 1 } } });
-    assert.ok(existsSync(path));
-    const parsed = JSON.parse(readFileSync(path, 'utf8'));
-    assert.equal(parsed.hubs['https://h.example'].token, 'mau_x');
-  });
-});
-
-test('addHub upserts the same URL', () => {
-  withTmpConfig(() => {
-    addHub('https://h.example', 'mau_first');
-    addHub('https://h.example', 'mau_second');
-    const { hubs } = loadHubsConfig();
-    assert.equal(Object.keys(hubs).length, 1);
-    assert.equal(hubs['https://h.example'].token, 'mau_second');
-  });
-});
-
-test('removeHub returns false when entry absent, true when removed', () => {
-  withTmpConfig(() => {
-    assert.equal(removeHub('https://nope.example'), false);
-    addHub('https://h.example', 'mau_x');
-    assert.equal(removeHub('https://h.example'), true);
-    assert.equal(getHub('https://h.example'), null);
-  });
-});
-
-test('getHub returns the record when present', () => {
-  withTmpConfig(() => {
-    addHub('https://h.example', 'mau_x');
-    const rec = getHub('https://h.example');
-    assert.ok(rec);
-    assert.equal(rec.token, 'mau_x');
-    assert.equal(typeof rec.linkedAt, 'number');
-  });
-});
-
-test('normalizeUrl lowercases scheme + host, strips trailing slash', () => {
-  assert.equal(normalizeUrl('HTTPS://Foo.Example.com/'), 'https://foo.example.com');
-  assert.equal(normalizeUrl('http://localhost:1234'), 'http://localhost:1234');
-  assert.equal(normalizeUrl('https://foo.example.com/path'), 'https://foo.example.com/path');
-});
-
-test('normalizeUrl throws on bad input', () => {
-  assert.throws(() => normalizeUrl(''), /url must be a non-empty string/);
-  assert.throws(() => normalizeUrl('not a url'), /invalid url/);
-});
-
-test('addHub keys URLs case-insensitively (same hub after host normalization)', () => {
-  withTmpConfig(() => {
-    addHub('https://HUB.example.com', 'mau_first');
-    addHub('https://hub.example.com/', 'mau_second');
-    const { hubs } = loadHubsConfig();
-    assert.equal(Object.keys(hubs).length, 1);
-    assert.equal(hubs['https://hub.example.com'].token, 'mau_second');
-  });
-});
-
-// Cloud Phase 25 C2 — the studio writes `role` into this shared file, and a
-// CLI relink used to replace the record wholesale and drop it. Not an access
-// hole (the cell refuses the write regardless), but it would silently show a
-// viewer the editing UI again, which is exactly what the flag exists to stop.
-test('a relink preserves the vouched role, and still clears per-machine attestations', () => {
-  withTmpConfig(() => {
-    addHub('https://p.cloud.maude.sh', 'mau_first', { adoptedAt: 111 });
-    // The studio stamps the role after a workspace sign-in.
-    const cfg = loadHubsConfig();
-    cfg.hubs['https://p.cloud.maude.sh'].role = 'viewer';
-    saveHubsConfig(cfg);
-
-    const after = addHub('https://p.cloud.maude.sh', 'mau_second');
-    assert.equal(after.token, 'mau_second');
-    assert.equal(after.role, 'viewer', 'the role survives a relink');
-    assert.equal(after.adoptedAt, undefined, 'a per-machine attestation does not');
-  });
-});
-
-// The code-module consent — the finding was that `codeModulesAllowed` was
-// declared, read by the receiver, and set by NOTHING. So the gate could never
-// open and `code-module` had no transport at all in hub-owned mode: an owner
-// could push one through the door and no peer would ever accept it, which is
-// the same "delivered nowhere" shape the file plane was built to fix.
-//
-// Through `withTmpConfig` like every other test here — the config is a real
-// file on a real path, so a test that skips the harness reads whatever the
-// previous one left behind.
-
-test('the consent records, and survives a token re-save', () => {
-  withTmpConfig(() => {
-    const url = 'https://consent.example.test';
-    addHub(url, 'tok-1');
-    assert.equal(getHub(url).codeModulesAllowed, undefined, 'absent means no');
-
-    setHubCodeModules(url, true);
-    assert.equal(getHub(url).codeModulesAllowed, true);
-
-    // A silent token renewal must not revoke a decision the person made.
-    addHub(url, 'tok-2');
-    assert.equal(getHub(url).codeModulesAllowed, true);
-    assert.equal(getHub(url).token, 'tok-2');
-  });
-});
-
-test('the consent is false for anything that is not an explicit yes', () => {
-  withTmpConfig(() => {
-    const url = 'https://consent-strict.example.test';
-    addHub(url, 't');
-    setHubCodeModules(url, 'yes');
-    assert.equal(getHub(url).codeModulesAllowed, false);
-  });
-});
-
-test('setting consent on an unlinked hub does nothing', () => {
-  withTmpConfig(() => {
-    assert.equal(setHubCodeModules('https://nobody.example.test', true), false);
-  });
-});

package/cli/lib/pkg-root.test.mjs

@@ -1,111 +0,0 @@
-// pkg-root.mjs tests (DDR-166 T0b).
-//
-// The regression this locks down: a naive single-anchor check
-// (`apps/studio/bin/screenshot.sh` alone) false-positives inside the Tauri
-// desktop build, because `stage-resources.mjs` stages a full working copy of
-// `apps/studio` into `target/debug/apps/studio/` for the sidecar's own
-// runtime resolution — that staged copy has no `cli/`, so a compiled `maude`
-// binary walking up from `target/debug/maude` matched it and stopped one
-// level too early, resolving PKG_ROOT to `target/debug` instead of the real
-// repo root. Caught by live testing against the real Tauri build (not a
-// synthetic path), not by static review — worth a regression test.
-
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { test } from 'node:test';
-
-import { isPkgRoot, resolvePkgRoot, resolveTauriResourcePkgRoot } from './pkg-root.mjs';
-
-function makeRealRoot(base) {
-  mkdirSync(join(base, 'apps', 'studio', 'bin'), { recursive: true });
-  writeFileSync(join(base, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
-  mkdirSync(join(base, 'cli', 'commands'), { recursive: true });
-  writeFileSync(join(base, 'cli', 'commands', 'design.mjs'), 'export const run = () => {};\n');
-}
-
-test('isPkgRoot requires BOTH anchors — the staged-resources false-positive is rejected', () => {
-  const tmp = mkdtempSync(join(tmpdir(), 'maude-pkgroot-'));
-  try {
-    // The exact shape of the bug: apps/studio/bin/screenshot.sh present
-    // (mirrors stage-resources.mjs's staged copy), no cli/ at all.
-    mkdirSync(join(tmp, 'apps', 'studio', 'bin'), { recursive: true });
-    writeFileSync(join(tmp, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
-    assert.equal(isPkgRoot(tmp), false);
-
-    // cli/ alone, no apps/studio — also not a real root.
-    const tmp2 = mkdtempSync(join(tmpdir(), 'maude-pkgroot-'));
-    try {
-      mkdirSync(join(tmp2, 'cli', 'commands'), { recursive: true });
-      writeFileSync(join(tmp2, 'cli', 'commands', 'design.mjs'), '');
-      assert.equal(isPkgRoot(tmp2), false);
-    } finally {
-      rmSync(tmp2, { recursive: true, force: true });
-    }
-
-    // Both anchors together — a genuine package root.
-    makeRealRoot(tmp);
-    assert.equal(isPkgRoot(tmp), true);
-  } finally {
-    rmSync(tmp, { recursive: true, force: true });
-  }
-});
-
-test('resolveTauriResourcePkgRoot finds the .app sibling Resources tree (RCA G2)', () => {
-  // Mirror the packaged macOS layout: binary in Contents/MacOS, staged tree in
-  // the SIBLING Contents/Resources — NOT an ancestor of the binary, which is why
-  // the plain walk-up misses it and every `maude design <verb>` broke.
-  const app = mkdtempSync(join(tmpdir(), 'maude-app-'));
-  try {
-    const macosDir = join(app, 'Contents', 'MacOS');
-    const resources = join(app, 'Contents', 'Resources');
-    mkdirSync(macosDir, { recursive: true });
-    makeRealRoot(resources); // stages apps/studio/bin/screenshot.sh + cli/commands/design.mjs
-
-    // From the binary's own dir, the sibling probe must find Resources.
-    assert.equal(resolveTauriResourcePkgRoot(macosDir), resources);
-
-    // Regression guard: Resources WITHOUT cli/ (the shipped-broken v0.45.1 shape)
-    // must NOT resolve — that's exactly the false-positive isPkgRoot rejects.
-    const broken = mkdtempSync(join(tmpdir(), 'maude-app-broken-'));
-    try {
-      const bMacos = join(broken, 'Contents', 'MacOS');
-      const bRes = join(broken, 'Contents', 'Resources', 'apps', 'studio', 'bin');
-      mkdirSync(bMacos, { recursive: true });
-      mkdirSync(bRes, { recursive: true });
-      writeFileSync(join(bRes, 'screenshot.sh'), '#!/bin/sh\n'); // no cli/ staged
-      assert.equal(resolveTauriResourcePkgRoot(bMacos), null);
-    } finally {
-      rmSync(broken, { recursive: true, force: true });
-    }
-  } finally {
-    rmSync(app, { recursive: true, force: true });
-  }
-});
-
-test('resolvePkgRoot honors MAUDE_PKG_ROOT only when it actually satisfies both anchors', () => {
-  const real = mkdtempSync(join(tmpdir(), 'maude-pkgroot-real-'));
-  const fake = mkdtempSync(join(tmpdir(), 'maude-pkgroot-fake-'));
-  const prevOverride = process.env.MAUDE_PKG_ROOT;
-  try {
-    makeRealRoot(real);
-    // Fake: only the staged-resources-shaped anchor, same false-positive shape.
-    mkdirSync(join(fake, 'apps', 'studio', 'bin'), { recursive: true });
-    writeFileSync(join(fake, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
-
-    process.env.MAUDE_PKG_ROOT = real;
-    assert.equal(resolvePkgRoot(), real);
-
-    process.env.MAUDE_PKG_ROOT = fake;
-    // Falls through past the (rejected) override to whatever the real
-    // walk-up finds in THIS test process — just assert it's NOT the fake
-    // dir, since accepting it would be exactly the regression.
-    assert.notEqual(resolvePkgRoot(), fake);
-  } finally {
-    if (prevOverride === undefined) delete process.env.MAUDE_PKG_ROOT;
-    else process.env.MAUDE_PKG_ROOT = prevOverride;
-    rmSync(real, { recursive: true, force: true });
-    rmSync(fake, { recursive: true, force: true });
-  }
-});

package/cli/lib/plugin-cli-reachability.test.mjs

@@ -1,57 +0,0 @@
-// DDR-061 + DDR-062 regression guard.
-//
-// DDR-061: a plugin must NEVER invoke a `cli/lib/*.mjs` module by a relative
-// path unconditionally: in a marketplace install the plugin is copied alone into
-// `cache/<marketplace>/<plugin>/<version>/`, so the sibling `cli/` does not
-// exist and the call crashes with MODULE_NOT_FOUND. The reachable contract is
-// the on-PATH `maude` binary (a declared plugin dependency).
-//
-// So any plugin file that runs `node … cli/lib/<x>.mjs` is only allowed when the
-// SAME file also offers a `command -v maude` fallback (the sibling-first /
-// maude-fallback pattern). This test fails loudly if a new straggler lands.
-//
-// DDR-062: plugin MARKDOWN must reach the studio bash helpers through
-// `maude design <verb>`, never `bash "$CLAUDE_PLUGIN_ROOT/dev-server/bin/<x>.sh"`
-// or `bash apps/studio/bin/<x>.sh`. The marketplace never copies the studio app
-// beside a plugin, and a flow command's $CLAUDE_PLUGIN_ROOT points at
-// plugins/flow (no bin/ at all). Per DDR-095 the helpers live under
-// apps/studio/bin (was plugins/design/dev-server/bin). Prose mentions of the
-// path are fine; INVOCATIONS (bash/sh/exec/$( prefixed) are banned.
-
-import assert from 'node:assert/strict';
-import { execSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { test } from 'node:test';
-
-test('no plugin runs `node cli/lib/*.mjs` without an on-PATH maude fallback', () => {
-  const out = execSync(
-    String.raw`grep -rlE 'node[^\n]*cli/lib/[a-z0-9_-]+\.mjs' plugins/ || true`,
-    {
-      encoding: 'utf8',
-    }
-  );
-  const files = out.trim().split('\n').filter(Boolean);
-  const offenders = files.filter((f) => !/command -v maude/.test(readFileSync(f, 'utf8')));
-  assert.deepEqual(
-    offenders,
-    [],
-    `These plugin files invoke a relative cli/lib module with no \`command -v maude\` fallback — they will crash in a marketplace install (DDR-061). Route through \`maude <subcommand>\` or guard with a sibling-exists check + maude fallback:\n  ${offenders.join('\n  ')}`
-  );
-});
-
-test('no plugin markdown invokes a $CLAUDE_PLUGIN_ROOT/dev-server/bin/*.sh helper (DDR-062)', () => {
-  // INVOCATION = the bin path preceded by bash / sh / exec, or inside a $(…)
-  // command substitution. Prose mentions of the path (backtick-wrapped, no verb)
-  // are exempt — they don't run anything. Matches both the $CLAUDE_PLUGIN_ROOT
-  // form and the repo-relative `plugins/<x>/dev-server/bin/` form.
-  const pattern = String.raw`(bash|sh|exec) +"?(\$\{?CLAUDE_PLUGIN_ROOT\}?|plugins/[a-z]+)/dev-server/bin/[A-Za-z0-9_-]+\.sh|\$\("?\$?\{?CLAUDE_PLUGIN_ROOT\}?/dev-server/bin/[A-Za-z0-9_-]+\.sh|(bash|sh|exec) +"?[^"\n]*apps/studio/bin/[A-Za-z0-9_-]+\.sh|\$\("?[^"\n]*apps/studio/bin/[A-Za-z0-9_-]+\.sh`;
-  const out = execSync(`grep -rnE '${pattern}' plugins --include='*.md' || true`, {
-    encoding: 'utf8',
-  });
-  const hits = out.trim().split('\n').filter(Boolean);
-  assert.deepEqual(
-    hits,
-    [],
-    `These plugin markdown lines INVOKE a dev-server bin helper directly — they break in marketplace installs (the dev-server is never copied beside a plugin) and in flow commands (whose $CLAUDE_PLUGIN_ROOT has no dev-server/). Route through \`maude design <verb>\` instead (DDR-062):\n  ${hits.join('\n  ')}`
-  );
-});

package/cli/lib/plugin-name-namespace.test.mjs

@@ -1,71 +0,0 @@
-// DDR-006 (superseded) regression guard.
-//
-// Claude Code now prepends the `<plugin>:` namespace to every plugin
-// command/agent/skill itself (fixed upstream in Claude Code 2.1.216 — see
-// changelog "Fixed plugin skills with a `name` frontmatter field losing
-// their plugin prefix in slash-command autocomplete" — and Claude Code
-// 2.1.218 explicitly reserves `:` in agent names for that namespacing).
-// Baking the prefix into our own `name:` frontmatter, which DDR-006
-// (2026-05-13) required as a workaround for the OLD (opposite) bug, now
-// produces a doubled prefix — `/design:design:new`, `flow:flow:a11y-auditor`.
-//
-// Two invariants this guards:
-//   1. `name:` frontmatter in plugins/{design,flow}/{commands,agents,skills}/
-//      must be the BARE slug — no `design:`/`flow:` prefix.
-//   2. `subagent_type:` references to our OWN plugin agents must carry
-//      exactly ONE `<plugin>:` prefix (the form the runtime's own namespace
-//      + our bare `name:` resolves to) — never zero (broken lookup against
-//      a namespaced registry) and never two (stale pre-fix leftover).
-
-import assert from 'node:assert/strict';
-import { execSync } from 'node:child_process';
-import { test } from 'node:test';
-
-function grep(pattern, extraArgs = '') {
-  const out = execSync(
-    `grep -rn ${extraArgs} '${pattern}' plugins/design plugins/flow --include='*.md' || true`,
-    { encoding: 'utf8' }
-  );
-  return out.trim().split('\n').filter(Boolean);
-}
-
-test('no plugin name: frontmatter carries a redundant design:/flow: prefix', () => {
-  const offenders = grep('^name: \\(design\\|flow\\):');
-  assert.deepEqual(
-    offenders,
-    [],
-    `These files declare name: with the plugin prefix baked in — Claude Code adds the plugin namespace itself now, so this doubles into e.g. /design:design:new (DDR-006 superseded):\n  ${offenders.join('\n  ')}`
-  );
-});
-
-test('no doubled design:design: / flow:flow: namespace anywhere in plugin markdown', () => {
-  const offenders = grep('design:design:\\|flow:flow:');
-  assert.deepEqual(
-    offenders,
-    [],
-    `Doubled plugin namespace found — strip one level (DDR-006 superseded):\n  ${offenders.join('\n  ')}`
-  );
-});
-
-test('subagent_type references to our own plugin agents carry exactly one <plugin>: prefix', () => {
-  // Bare `subagent_type: <slug>` where <slug> looks like one of our
-  // agent-style names (-critic/-agent/-auditor/-hacker/-keeper/-director/
-  // -analyst suffix) but has no plugin prefix — excludes Claude Code
-  // built-ins (e.g. code-simplifier, which is not one of our plugin agents)
-  // and the `"<critic-name>"` template placeholder.
-  const bareOffenders = grep(
-    'subagent_type:.*"\\?[a-z][a-z0-9-]*\\(-critic\\|-agent\\|-auditor\\|-hacker\\|-keeper\\|-director\\|-analyst\\)"\\?'
-  ).filter((line) => !/design:|flow:|<critic-name>|code-simplifier/.test(line));
-  assert.deepEqual(
-    bareOffenders,
-    [],
-    `These subagent_type references to a plugin-owned agent are missing the <plugin>: prefix and will fail to resolve against the namespaced registry:\n  ${bareOffenders.join('\n  ')}`
-  );
-
-  const doubledOffenders = grep('subagent_type:.*\\(design:design:\\|flow:flow:\\)');
-  assert.deepEqual(
-    doubledOffenders,
-    [],
-    `These subagent_type references are double-prefixed (DDR-006 superseded):\n  ${doubledOffenders.join('\n  ')}`
-  );
-});

package/cli/lib/reconstruct-toolset.test.mjs

@@ -1,194 +0,0 @@
-// DDR-174 regression guard (T15).
-//
-// The whole security architecture of `/design:import --reconstruct` rests on
-// ONE fact: every agent turn that ever reads the untrusted source image —
-// `reconstruct-agent` (authoring) AND `reconstruct-critic` (the reality-check
-// comparator) — has `tools: Read, Write, Glob, Grep` and NEVER `Bash`,
-// `WebSearch`, or `WebFetch`. DDR-174's own Consequences section calls for
-// exactly this test: "a targeted grep-based test mirroring
-// plugin-cli-reachability.test.mjs's pattern should assert BOTH the authoring
-// agent's AND the comparator agent's frontmatter never gain
-// Bash/WebSearch/WebFetch, not just this DDR's prose." A future maintainer
-// "helpfully" widening either agent's toolset (e.g. "just give it Bash so it
-// can screenshot itself") would silently reopen DDR-174's entire closure —
-// this fails loudly instead.
-
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import { test } from 'node:test';
-
-const AGENTS = [
-  'plugins/design/agents/reconstruct-agent.md',
-  'plugins/design/agents/reconstruct-critic.md',
-];
-
-const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---/;
-
-function readFrontmatter(path) {
-  const text = readFileSync(path, 'utf8');
-  const fm = FRONTMATTER_RE.exec(text);
-  assert.ok(fm, `${path}: no frontmatter block found`);
-  return fm[1];
-}
-
-function readToolsLine(path) {
-  const fm = readFrontmatter(path);
-  const toolsLine = fm.split('\n').find((l) => l.startsWith('tools:'));
-  assert.ok(toolsLine, `${path}: frontmatter has no tools: line`);
-  return toolsLine;
-}
-
-for (const path of AGENTS) {
-  test(`${path}: tools: line never grants Bash`, () => {
-    const line = readToolsLine(path);
-    assert.ok(
-      !/\bBash\b/.test(line),
-      `${path} declares Bash — this reopens DDR-174's core closure (the agent reads an untrusted image and must never hold a shell). Line: ${line}`
-    );
-  });
-
-  test(`${path}: tools: line never grants WebSearch or WebFetch`, () => {
-    const line = readToolsLine(path);
-    assert.ok(
-      !/\bWebSearch\b/.test(line) && !/\bWebFetch\b/.test(line),
-      `${path} declares WebSearch/WebFetch — DDR-174 requires these agents have no tool call that reaches the network. Line: ${line}`
-    );
-  });
-
-  test(`${path}: tools: line is exactly Read, Write, Glob, Grep`, () => {
-    const line = readToolsLine(path);
-    const tools = line
-      .replace(/^tools:\s*/, '')
-      .split(',')
-      .map((t) => t.trim())
-      .filter(Boolean);
-    assert.deepEqual(
-      [...tools].sort(),
-      ['Glob', 'Grep', 'Read', 'Write'],
-      `${path}: expected exactly Read/Write/Glob/Grep per DDR-174 Decision 1, got: ${line}`
-    );
-  });
-
-  // DDR-174 Addendum (post-implementation adversarial review) — Write has no
-  // path restriction (Claude Code has no per-subagent path-scoping mechanism,
-  // verified authoritatively, not assumed) and the only real closure for a
-  // non-bypassPermissions session is a human approval prompt on any write.
-  // `permissionMode: default` is what makes that prompt happen instead of
-  // silently inheriting the parent session's (possibly bypassPermissions)
-  // mode. A future maintainer removing this line silently re-widens the
-  // agent's effective write reach for every downstream consumer NOT running
-  // bypassPermissions.
-  test(`${path}: frontmatter declares permissionMode: default (DDR-174 Addendum)`, () => {
-    const fm = readFrontmatter(path);
-    const line = fm.split('\n').find((l) => l.startsWith('permissionMode:'));
-    assert.ok(
-      line,
-      `${path}: missing permissionMode: default — without it this agent silently inherits the parent session's permission mode (e.g. bypassPermissions), losing the one real per-write approval gate available for its unrestricted Write tool (DDR-174 Addendum)`
-    );
-    assert.equal(
-      line.replace(/^permissionMode:\s*/, '').trim(),
-      'default',
-      `${path}: permissionMode must be exactly "default" (prompts on every write), not a looser mode. Line: ${line}`
-    );
-  });
-}
-
-test('import.md diff-check is whole-repo scoped, not just $DESIGN_ROOT (DDR-174 Addendum)', () => {
-  // The first implementation scoped `git status --porcelain -- "$DESIGN_ROOT"`,
-  // which made a write to .claude/settings.json, CLAUDE.md, or plugins/**
-  // structurally invisible to the check — an adversarial review built a full
-  // exploit chain out of exactly that gap. Assert the pathspec was actually
-  // widened, not just documented as widened in prose.
-  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
-  assert.ok(
-    !/git -C "\$REPO" status --porcelain -- "\$DESIGN_ROOT"/.test(importMd),
-    'import.md must NOT scope the diff-check to $DESIGN_ROOT only — this was the exact gap the DDR-174 Addendum closes (a write outside $DESIGN_ROOT, e.g. to .claude/settings.json, would be invisible to a $DESIGN_ROOT-scoped check)'
-  );
-  const wholeRepoOccurrences = (importMd.match(/git -C "\$REPO" status --porcelain\b/g) || [])
-    .length;
-  assert.ok(
-    wholeRepoOccurrences >= 2,
-    `import.md must run an UNSCOPED \`git -C "$REPO" status --porcelain\` for both the BEFORE (step 4) and AFTER (step 5b) snapshots — found ${wholeRepoOccurrences} occurrence(s)`
-  );
-});
-
-test('import.md snapshots the two well-known global Claude Code config paths (DDR-174 Addendum)', () => {
-  // A repo-scoped git diff can never see $HOME/.claude/** — these are the two
-  // specific files an adversarial review named as attack targets (a planted
-  // hook, or a poisoned global CLAUDE.md loaded into every future session).
-  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
-  assert.ok(
-    importMd.includes('$HOME/.claude/settings.json') &&
-      importMd.includes('$HOME/.claude/CLAUDE.md'),
-    'import.md must snapshot $HOME/.claude/settings.json and $HOME/.claude/CLAUDE.md before/after each round and hard-fail on any change (DDR-174 Addendum) — these are outside any repo-scoped diff check'
-  );
-});
-
-test('import.md stat calls are portable (GNU-first, BSD-fallback), not BSD-only (DDR-174 Addendum confirmation pass)', () => {
-  // The first Addendum revision used BSD-only `stat -f` unconditionally — it
-  // silently no-ops on Linux (a platform this project ships a .deb for),
-  // because GNU `stat -f` means something else entirely and errors out,
-  // swallowed by the trailing `2>/dev/null`. Both empty strings compare
-  // equal, so the check trivially "passes" without ever having checked
-  // anything. Assert every stat call tries GNU syntax (`stat -c`) first.
-  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
-  // Only scan actual shell inside fenced ```bash blocks — prose elsewhere
-  // legitimately mentions `stat -f` by name when explaining the old bug.
-  const codeBlocks = [...importMd.matchAll(/```bash\n([\s\S]*?)```/g)].map((m) => m[1]).join('\n');
-  const bareStatF = codeBlocks.match(/(?<!\|\| )\bstat -f\b/g) || [];
-  assert.deepEqual(
-    bareStatF,
-    [],
-    `import.md has a \`stat -f\` call in executable shell with no \`stat -c\` GNU fallback tried first — this silently no-ops on Linux (DDR-174 Addendum confirmation-pass finding). Found ${bareStatF.length} bare occurrence(s).`
-  );
-  const statCOccurrences = (codeBlocks.match(/stat -c '/g) || []).length;
-  assert.ok(
-    statCOccurrences >= 4,
-    `expected at least 4 GNU-first \`stat -c\` attempts (2 for the non-git repo-wide fallback, 2 for the global-config snapshot) — found ${statCOccurrences}`
-  );
-});
-
-test('import.md non-git fallback excludes _history/ (DDR-174 Addendum confirmation pass)', () => {
-  // The reconstruct loop writes its own screenshots/verdict files under
-  // _history/_reconstruct/<slug>/ every round. A git-repo target gets this
-  // excluded for free via .gitignore; the non-git `find`-based fallback has
-  // no such filter and would false-positive-abort on its own round-1 output
-  // the moment round 2's diff check runs, in a non-git target repo.
-  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
-  const findOccurrences = importMd.match(/find "\$REPO" -type f[^\n]*/g) || [];
-  assert.ok(
-    findOccurrences.length >= 2,
-    'expected the non-git fallback find command in both step 4 and step 5b'
-  );
-  for (const line of findOccurrences) {
-    assert.ok(
-      line.includes("-not -path '*/_history/*'"),
-      `non-git fallback find command must exclude _history/ (its own round-N artifacts) or every multi-round run in a non-git target repo false-positive-aborts: ${line}`
-    );
-  }
-});
-
-test('import.md uses mktemp for the _active.json patch, not a fixed /tmp filename (DDR-174 Addendum)', () => {
-  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
-  assert.ok(
-    !/\/tmp\/active\.json\.tmp/.test(importMd),
-    'import.md must not use a fixed, predictable /tmp filename for the _active.json patch — a symlink race target on a shared machine (DDR-174 Addendum adversarial finding)'
-  );
-  assert.ok(/mktemp/.test(importMd), 'import.md must use mktemp for its temp file(s)');
-});
-
-test('design-critic.md is never repurposed as the reconstruct comparator (DDR-174 Decision 1 Round-2)', () => {
-  // The comparator must be reconstruct-critic (Bash-free), never the default
-  // Bash-capable design-critic — assert import.md's orchestrator spawns the
-  // dedicated agent, not design-critic, for the reality-check step.
-  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
-  const reconstructSection = importMd.slice(importMd.indexOf('## `--reconstruct'));
-  assert.ok(
-    reconstructSection.includes('design:reconstruct-critic'),
-    'import.md --reconstruct mode must spawn design:reconstruct-critic for the reality-check step'
-  );
-  assert.ok(
-    !/subagent_type:\s*"design:design-critic"/.test(reconstructSection),
-    'import.md --reconstruct mode must NOT spawn the default design-critic as its comparator (DDR-174 Decision 1 Round-2) — it is Bash-capable and reopens the trifecta this DDR closes'
-  );
-});