@agfpd/iapeer 0.2.76 → 0.2.78

package/src/registry/registry.test.ts

@@ -1,432 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdtempSync, rmSync, readFileSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import {
-  clampDescription,
-  findPeer,
-  readPeersIndex,
-  removePeer,
-  upsertPeer,
-  withPeersLock,
-  type PeerRecord,
-} from './index.ts'
-import { MAX_DESCRIPTION_LEN, defaultIntelligenceForRuntime, type Intelligence } from '../core/constants.ts'
-import { writeFileAtomic, resolvePeersPaths } from '../storage/index.ts'
-
-let root: string
-const opts = () => ({ rootDir: root })
-
-beforeEach(() => {
-  root = mkdtempSync(join(tmpdir(), 'iapeer-registry-'))
-})
-afterEach(() => {
-  rmSync(root, { recursive: true, force: true })
-})
-
-// The live arthur record (from ~/.iapeer/peers-profiles.json): a human peer
-// primarily on telegram, also present on claude, with a telegram interface.
-async function seedArthur(): Promise<void> {
-  await upsertPeer(
-    {
-      personality: 'arthur',
-      runtime: 'telegram',
-      runtimes: ['telegram', 'claude'],
-      description: 'Артур — владелец хоста и команды агентов.',
-      intelligence: 'natural',
-      interfaces: { telegram: { user_id: '409502965' } },
-      cwd: '/Users/macmini/Peers/arthur',
-    },
-    opts(),
-  )
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// WITNESS: the OLD upsertPeer record-builder (peers.ts:342-358, full-replace).
-// Pure reproduction so each H1 test shows a real delta — the witness produces
-// the clobbered record, the new upsertPeer preserves the existing fields.
-// ─────────────────────────────────────────────────────────────────────────────
-
-function oldUpsertRecord(
-  args: {
-    personality: string
-    runtime: string
-    runtimes?: readonly string[]
-    description?: string
-    intelligence?: Intelligence
-    interfaces?: Record<string, unknown>
-    cwd: string
-  },
-): PeerRecord {
-  const runtime = args.runtime
-  const runtimes = [runtime, ...(args.runtimes ?? [])].filter((v, i, a) => a.indexOf(v) === i)
-  const description = args.description ?? '' // empty wipes existing
-  const intelligence =
-    args.intelligence !== undefined ? args.intelligence : defaultIntelligenceForRuntime(runtime) // default, not existing
-  return {
-    personality: args.personality,
-    runtime,
-    runtimes,
-    description,
-    intelligence,
-    cwd: args.cwd,
-    ...(args.interfaces ? { interfaces: args.interfaces } : {}),
-  }
-}
-
-// The claude-boot upsert (server.ts:266 path): no intelligence, empty
-// description, single runtime claude, no interfaces.
-const bootUpsertArgs = {
-  personality: 'arthur',
-  runtime: 'claude',
-  runtimes: ['claude'],
-  description: '',
-  cwd: '/Users/macmini/Peers/arthur',
-} as const
-
-// ─────────────────────────────────────────────────────────────────────────────
-// H1: merge-with-existing
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('upsertPeer H1 merge-with-existing', () => {
-  test('claude-boot upsert WITHOUT intelligence does NOT downgrade a natural peer', async () => {
-    await seedArthur()
-
-    // WITNESS (before fix): old builder overwrites with the claude default (artificial)
-    expect(oldUpsertRecord(bootUpsertArgs).intelligence).toBe('artificial')
-
-    // NEW (after fix): registry preserves natural
-    await upsertPeer(bootUpsertArgs, opts())
-    const arthur = findPeer(readPeersIndex(opts()), 'arthur')!
-    expect(arthur.intelligence).toBe('natural')
-  })
-
-  test('runtimes are unioned, not replaced (telegram not dropped on claude boot)', async () => {
-    await seedArthur()
-
-    // WITNESS: old builder drops telegram, leaving only claude
-    expect(oldUpsertRecord(bootUpsertArgs).runtimes).toEqual(['claude'])
-
-    // NEW: union → telegram + claude both present
-    await upsertPeer(bootUpsertArgs, opts())
-    const arthur = findPeer(readPeersIndex(opts()), 'arthur')!
-    expect(arthur.runtimes).toContain('telegram')
-    expect(arthur.runtimes).toContain('claude')
-  })
-
-  test('empty description does NOT wipe a meaningful existing description', async () => {
-    await seedArthur()
-
-    // WITNESS: old builder wipes it to ''
-    expect(oldUpsertRecord(bootUpsertArgs).description).toBe('')
-
-    // NEW: existing description preserved
-    await upsertPeer(bootUpsertArgs, opts())
-    const arthur = findPeer(readPeersIndex(opts()), 'arthur')!
-    expect(arthur.description).toBe('Артур — владелец хоста и команды агентов.')
-  })
-
-  test('interfaces preserved when absent from args', async () => {
-    await seedArthur()
-
-    // WITNESS: old builder drops interfaces (not in args)
-    expect(oldUpsertRecord(bootUpsertArgs).interfaces).toBeUndefined()
-
-    // NEW: telegram interface preserved
-    await upsertPeer(bootUpsertArgs, opts())
-    const arthur = findPeer(readPeersIndex(opts()), 'arthur')!
-    expect(arthur.interfaces).toEqual({ telegram: { user_id: '409502965' } })
-  })
-
-  test('explicit intelligence in args DOES override existing', async () => {
-    await seedArthur()
-    await upsertPeer({ ...bootUpsertArgs, intelligence: 'artificial' }, opts())
-    const arthur = findPeer(readPeersIndex(opts()), 'arthur')!
-    expect(arthur.intelligence).toBe('artificial')
-  })
-
-  test('explicit non-empty description in args DOES override', async () => {
-    await seedArthur()
-    await upsertPeer({ ...bootUpsertArgs, description: 'new desc' }, opts())
-    expect(findPeer(readPeersIndex(opts()), 'arthur')!.description).toBe('new desc')
-  })
-})
-
-// Regression — the audit's CRITICAL finding: the only production caller (provisionPeer
-// from `iapeer init`) forwards the READ-NORMALIZED contract value (profile.intelligence
-// = 'natural' for a legacy 'human' peer) as an explicit upsert intelligence. The write
-// boundary must treat that as a re-assertion of the SAME nature and keep the legacy raw
-// — NOT migrate the on-disk vocab the live legacy-IAP fleet reads.
-describe('upsertPeer vocab-preservation (registry self-defends the legacy raw)', () => {
-  const arthurCwd = '/Users/macmini/Peers/arthur'
-  async function seedLegacyHuman(): Promise<void> {
-    await upsertPeer({ personality: 'arthur', runtime: 'telegram', runtimes: ['telegram', 'claude'], intelligence: 'human' as never, cwd: arthurCwd }, opts())
-  }
-  test('seeding a legacy human value persists the raw verbatim; read normalizes', async () => {
-    await seedLegacyHuman()
-    const p = findPeer(readPeersIndex(opts()), 'arthur')!
-    expect(p.intelligence).toBe('natural') // READ-normalized contract value
-    expect(p.intelligenceRaw).toBe('human') // RAW on disk preserved
-  })
-  test('re-asserting the SAME nature (read-normalized natural) does NOT migrate human→natural', async () => {
-    await seedLegacyHuman()
-    // exactly what provisionPeer emits on a routine re-init (no explicit --intelligence):
-    await upsertPeer({ personality: 'arthur', runtime: 'telegram', intelligence: 'natural', cwd: arthurCwd }, opts())
-    expect(findPeer(readPeersIndex(opts()), 'arthur')!.intelligenceRaw).toBe('human') // STILL human
-  })
-  test('a GENUINE nature change DOES adopt the new value as the raw', async () => {
-    await seedLegacyHuman()
-    await upsertPeer({ personality: 'arthur', runtime: 'telegram', intelligence: 'artificial', cwd: arthurCwd }, opts())
-    expect(findPeer(readPeersIndex(opts()), 'arthur')!.intelligenceRaw).toBe('artificial')
-  })
-  test('legacy vocab accepted by the write path (read-path symmetry); garbage rejected', async () => {
-    await upsertPeer({ personality: 'srv', runtime: 'notifier', intelligence: 'scripted' as never, cwd: '/tmp/srv' }, opts())
-    const s = findPeer(readPeersIndex(opts()), 'srv')!
-    expect(s.intelligence).toBe('absent') // scripted → absent (normalized)
-    expect(s.intelligenceRaw).toBe('scripted') // raw preserved
-    await expect(upsertPeer({ personality: 'bad', runtime: 'claude', intelligence: 'sentient' as never, cwd: '/tmp/bad' }, opts())).rejects.toThrow(/artificial\|natural\|absent/)
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// New peer: runtime default DOES apply when there is no existing
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('upsertPeer new peer (no existing) — defaults apply', () => {
-  test('new claude peer without intelligence → artificial (runtime default)', async () => {
-    await upsertPeer({ personality: 'fresh', runtime: 'claude', cwd: '/tmp/fresh' }, opts())
-    expect(findPeer(readPeersIndex(opts()), 'fresh')!.intelligence).toBe('artificial')
-  })
-
-  test('new telegram peer without intelligence → natural (runtime default)', async () => {
-    await upsertPeer({ personality: 'someone', runtime: 'telegram', cwd: '/tmp/someone' }, opts())
-    expect(findPeer(readPeersIndex(opts()), 'someone')!.intelligence).toBe('natural')
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Concurrency: single locked writer — no lost update
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('registry locked writer — concurrent upsert does not clobber', () => {
-  test('two parallel upserts of the same personality both survive (runtimes union)', async () => {
-    await upsertPeer({ personality: 'p', runtime: 'claude', cwd: '/tmp/p' }, opts())
-
-    // Both add a distinct runtime concurrently. Under the lock each reads the
-    // other's write; an unlocked read-modify-write would lose one.
-    await Promise.all([
-      upsertPeer({ personality: 'p', runtime: 'claude', runtimes: ['codex'], cwd: '/tmp/p' }, opts()),
-      upsertPeer({ personality: 'p', runtime: 'claude', runtimes: ['telegram'], cwd: '/tmp/p' }, opts()),
-    ])
-
-    const p = findPeer(readPeersIndex(opts()), 'p')!
-    expect(p.runtimes).toContain('claude')
-    expect(p.runtimes).toContain('codex')
-    expect(p.runtimes).toContain('telegram')
-
-    // exactly one record for the personality (no duplicate / no clobber)
-    expect(readPeersIndex(opts()).peers.filter(x => x.personality === 'p')).toHaveLength(1)
-  })
-
-  test('many parallel upserts of distinct peers all land', async () => {
-    const names = Array.from({ length: 12 }, (_, i) => `peer-${i}`)
-    await Promise.all(
-      names.map(n => upsertPeer({ personality: n, runtime: 'claude', cwd: `/tmp/${n}` }, opts())),
-    )
-    const index = readPeersIndex(opts())
-    for (const n of names) expect(findPeer(index, n)).not.toBeNull()
-    expect(index.peers).toHaveLength(12)
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Structural invariant #3: peers file is unreachable past the locked API
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('registry single-writer is structural (#3)', () => {
-  test('storage.writeFileAtomic REFUSES the peers-profiles.json path', () => {
-    const { peersFile } = resolvePeersPaths(opts())
-    expect(() => writeFileAtomic(peersFile, '{"version":2,"peers":[]}')).toThrow(/registry/)
-  })
-
-  test('after a refused bypass, the registry file written by upsert is intact JSON', async () => {
-    await seedArthur()
-    const { peersFile } = resolvePeersPaths(opts())
-    expect(() => writeFileAtomic(peersFile, 'CLOBBER')).toThrow()
-    const parsed = JSON.parse(readFileSync(peersFile, 'utf8'))
-    expect(parsed.version).toBe(2)
-    expect(parsed.peers[0].personality).toBe('arthur')
-  })
-
-  test('removePeer also goes through the locked writer', async () => {
-    await seedArthur()
-    await removePeer('arthur', opts())
-    expect(findPeer(readPeersIndex(opts()), 'arthur')).toBeNull()
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// VOCAB read-compat: legacy human/scripted on disk → contract natural/absent
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('registry read-compat (legacy intelligence vocab)', () => {
-  test('legacy registry file (human/scripted) reads as natural/absent, does not crash', () => {
-    const { peersFile } = resolvePeersPaths(opts())
-    // a legacy file as it exists on the live host today (pre-migration)
-    writeFileSync(
-      peersFile,
-      JSON.stringify({
-        version: 2,
-        peers: [
-          { personality: 'arthur', runtime: 'telegram', runtimes: ['telegram', 'claude'], description: 'Артур', intelligence: 'human', cwd: '/Users/macmini/Peers/arthur' },
-          { personality: 'cronjob', runtime: 'cron', runtimes: ['cron'], description: '', intelligence: 'scripted', cwd: '/tmp/cronjob' },
-          { personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: 'b', intelligence: 'artificial', cwd: '/tmp/boris' },
-        ],
-      }),
-    )
-    const index = readPeersIndex(opts())
-    expect(findPeer(index, 'arthur')!.intelligence).toBe('natural') // human → natural
-    expect(findPeer(index, 'cronjob')!.intelligence).toBe('absent') // scripted → absent
-    expect(findPeer(index, 'boris')!.intelligence).toBe('artificial') // pass-through
-  })
-
-  test('genuinely unknown intelligence value still throws', () => {
-    const { peersFile } = resolvePeersPaths(opts())
-    writeFileSync(
-      peersFile,
-      JSON.stringify({
-        version: 2,
-        peers: [{ personality: 'x', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'bogus', cwd: '/tmp/x' }],
-      }),
-    )
-    expect(() => readPeersIndex(opts())).toThrow(/intelligence/)
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Fix A — GOLDEN round-trip: a registry write PRESERVES every peer's RAW vocab
-// verbatim (legacy-safe). The incident: removePeer rewrote the live registry,
-// persisting the IN-MEMORY normalization (arthur human→natural) → the legacy IAP
-// (human/artificial/scripted only) read "natural" as corrupted → fleet transport
-// down. The fix persists the raw on-disk vocab; normalization is in-memory only.
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('Fix A — registry write preserves raw intelligence vocab (legacy-safe)', () => {
-  const seedFullVocab = () => {
-    const { peersFile } = resolvePeersPaths(opts())
-    writeFileSync(
-      peersFile,
-      JSON.stringify({
-        version: 2,
-        peers: [
-          { personality: 'phuman', runtime: 'telegram', runtimes: ['telegram'], description: '', intelligence: 'human', cwd: '/a' },
-          { personality: 'pscripted', runtime: 'notifier', runtimes: ['notifier'], description: '', intelligence: 'scripted', cwd: '/b' },
-          { personality: 'partificial', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial', cwd: '/c' },
-          { personality: 'pnatural', runtime: 'telegram', runtimes: ['telegram'], description: '', intelligence: 'natural', cwd: '/d' },
-          { personality: 'pabsent', runtime: 'notifier', runtimes: ['notifier'], description: '', intelligence: 'absent', cwd: '/e' },
-        ],
-      }),
-    )
-  }
-  const onDiskVocab = () => {
-    const disk = JSON.parse(readFileSync(resolvePeersPaths(opts()).peersFile, 'utf8'))
-    return Object.fromEntries((disk.peers as { personality: string; intelligence: string }[]).map(p => [p.personality, p.intelligence]))
-  }
-
-  test('in-memory read NORMALIZES (human→natural, scripted→absent) for foundation logic', () => {
-    seedFullVocab()
-    const idx = readPeersIndex(opts())
-    expect(findPeer(idx, 'phuman')!.intelligence).toBe('natural')
-    expect(findPeer(idx, 'pscripted')!.intelligence).toBe('absent')
-    expect(findPeer(idx, 'partificial')!.intelligence).toBe('artificial')
-  })
-
-  test('GOLDEN: an upsert write preserves EVERY peer raw vocab (human→human, scripted→scripted, …)', async () => {
-    seedFullVocab()
-    await upsertPeer({ personality: 'trigger', runtime: 'claude', cwd: '/t', intelligence: 'artificial' }, opts())
-    const v = onDiskVocab()
-    expect(v.phuman).toBe('human') // NOT 'natural' — preserved
-    expect(v.pscripted).toBe('scripted') // NOT 'absent' — preserved
-    expect(v.partificial).toBe('artificial')
-    expect(v.pnatural).toBe('natural')
-    expect(v.pabsent).toBe('absent')
-    expect(v.trigger).toBe('artificial')
-    // the intelligenceRaw shadow field never leaks to disk
-    const disk = JSON.parse(readFileSync(resolvePeersPaths(opts()).peersFile, 'utf8'))
-    expect((disk.peers as Record<string, unknown>[]).every(p => p.intelligenceRaw === undefined)).toBe(true)
-  })
-
-  test('INCIDENT scenario: removePeer of one peer preserves the legacy vocab of the others', async () => {
-    seedFullVocab()
-    await removePeer('partificial', opts()) // the exact op that broke the live registry
-    const v = onDiskVocab()
-    expect(v.partificial).toBeUndefined() // removed
-    expect(v.phuman).toBe('human') // arthur-like human peer: vocab INTACT (the fix)
-    expect(v.pscripted).toBe('scripted')
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Companion fix — test/sandbox isolation is FAIL-CLOSED. The incident root cause
-// (#1): a sandbox run resolved the registry to the REAL ~/.iapeer and rewrote it.
-// Under IAPEER_TEST_SANDBOX=1, withPeersLock REFUSES to write the HOME-default
-// root — a test/sandbox MUST divert via IAPEER_ROOT. (The whole `bun test` run is
-// marked via package.json, so every locked write during tests is guarded.)
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('Companion fix — withPeersLock fail-closed sandbox isolation', () => {
-  test('THROWS when IAPEER_TEST_SANDBOX=1 and the root falls through to HOME/.iapeer', async () => {
-    // fake HOME, NO IAPEER_ROOT override → resolves to <fakeHome>/.iapeer (the
-    // "forgot to divert" case the incident hit). Guard fires BEFORE any FS write.
-    const fakeHome = mkdtempSync(join(tmpdir(), 'iapeer-guard-home-'))
-    const env = { HOME: fakeHome, IAPEER_TEST_SANDBOX: '1' } as NodeJS.ProcessEnv
-    await expect(withPeersLock({ env }, () => 'wrote')).rejects.toThrow(/refusing to write the REAL registry/i)
-    rmSync(fakeHome, { recursive: true, force: true })
-  })
-
-  test('ALLOWS the same run when IAPEER_ROOT diverts the root away from HOME/.iapeer', async () => {
-    const fakeHome = mkdtempSync(join(tmpdir(), 'iapeer-guard-home-'))
-    const env = { HOME: fakeHome, IAPEER_ROOT: join(fakeHome, 'sbx'), IAPEER_TEST_SANDBOX: '1' } as NodeJS.ProcessEnv
-    const out = await withPeersLock({ env }, () => 'ok')
-    expect(out).toBe('ok')
-    rmSync(fakeHome, { recursive: true, force: true })
-  })
-
-  test('NO guard when the sandbox flag is absent (rootDir-isolated tests are unaffected)', async () => {
-    // opts() = { rootDir: <mkdtemp> }, env defaults to process.env (no flag in the
-    // passed env object) → guard short-circuits, the normal locked write proceeds.
-    const out = await withPeersLock({ rootDir: root, env: {} as NodeJS.ProcessEnv }, () => 'ok')
-    expect(out).toBe('ok')
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// clampDescription boundary — the limit was raised 250 → 450 so self-documenting
-// API-peer descriptions (notifier timer/watcher, ~408 chars) survive intact. The
-// boundary is exact: length == MAX passes untouched, length == MAX+1 truncates.
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('clampDescription — MAX_DESCRIPTION_LEN boundary (450)', () => {
-  test('the limit is 450', () => {
-    expect(MAX_DESCRIPTION_LEN).toBe(450)
-  })
-  test('a 450-char description passes through untouched', () => {
-    const at = 'x'.repeat(450)
-    const r = clampDescription(at)
-    expect(r.truncated).toBe(false)
-    expect(r.description).toBe(at)
-    expect(r.description.length).toBe(450)
-  })
-  test('a 451-char description is truncated to 450', () => {
-    const over = 'y'.repeat(451)
-    const r = clampDescription(over)
-    expect(r.truncated).toBe(true)
-    expect(r.description.length).toBe(450)
-    expect(r.description).toBe('y'.repeat(450))
-  })
-  test('upsertPeer persists a full 450-char description (no clamp at the boundary)', async () => {
-    const desc = 'z'.repeat(450)
-    await upsertPeer({ personality: 'verbose', runtime: 'claude', cwd: '/tmp/verbose', description: desc }, opts())
-    expect(findPeer(readPeersIndex(opts()), 'verbose')!.description).toBe(desc)
-  })
-})

package/src/runtime/runtime.test.ts

@@ -1,226 +0,0 @@
-// runtime contract — manifest read/write, the per-peer self-config hook (env
-// passthrough + fail states), and deployRuntime (declared-set provisioning). All under
-// IAPEER_ROOT / IAPEER_LAUNCHAGENTS_DIR temp dirs; IAPEER_TEST_SANDBOX skips the real
-// launchctl, so deploy provisions (folder + registry + plist) without loading a job.
-
-import { afterEach, describe, expect, test } from 'bun:test'
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import { readRuntimeManifest, runtimeSelfConfig, writeRuntimeManifest, type RuntimeManifest } from './index.ts'
-import {
-  deployRuntime,
-  installRuntimePackage,
-  onboardRuntime,
-  resolveRuntimePackage,
-  RUNTIME_PACKAGES,
-} from './deploy.ts'
-import { findPeer, readPeersIndex } from '../registry/index.ts'
-import { launchdPlistPath } from '../launch/index.ts'
-
-const roots: string[] = []
-function mkTmp(): string {
-  const d = mkdtempSync(join(tmpdir(), 'iapeer-rtm-'))
-  roots.push(d)
-  return d
-}
-afterEach(() => {
-  while (roots.length) rmSync(roots.pop()!, { recursive: true, force: true })
-})
-
-function envFor(root: string, path?: string): NodeJS.ProcessEnv {
-  return {
-    IAPEER_ROOT: join(root, 'iapeer'),
-    IAPEER_LAUNCHAGENTS_DIR: join(root, 'LA'),
-    IAPEER_TEST_SANDBOX: '1',
-    HOME: root,
-    ...(path ? { PATH: path } : {}),
-  } as NodeJS.ProcessEnv
-}
-
-/** A stub runtime launcher (so provision's resolveExecutable succeeds) + a stub
- *  self-config hook that records the per-peer env it was handed. */
-function stubBins(): { dir: string; launcher: string; hook: string; marker: (p: string) => string } {
-  const dir = mkTmp()
-  const launcher = join(dir, 'notifier-runtime')
-  writeFileSync(launcher, '#!/bin/sh\nexec sleep 1\n', { mode: 0o755 })
-  const hook = join(dir, 'self-config.sh')
-  // record IAPEER_PEER_* to a marker file named by personality → proves env passthrough
-  writeFileSync(
-    hook,
-    '#!/bin/sh\nprintf "%s|%s|%s" "$IAPEER_PEER_PERSONALITY" "$IAPEER_PEER_RUNTIME" "$IAPEER_PEER_INTELLIGENCE" > "$IAPEER_ROOT/sc-$IAPEER_PEER_PERSONALITY"\nexit 0\n',
-    { mode: 0o755 },
-  )
-  return { dir, launcher, hook, marker: p => join(dir, p) }
-}
-
-describe('runtime manifest', () => {
-  test('write → read round-trip preserves runtime / selfConfig / peers', () => {
-    const env = envFor(mkTmp())
-    writeRuntimeManifest(
-      { runtime: 'notifier', selfConfig: { command: 'notifier-runtime', args: ['self-config'] }, peers: [{ personality: 'timer', intelligence: 'absent' }] },
-      { env },
-    )
-    const m = readRuntimeManifest('notifier', { env })!
-    expect(m.runtime).toBe('notifier')
-    expect(m.selfConfig).toEqual({ command: 'notifier-runtime', args: ['self-config'] })
-    expect(m.peers?.[0].personality).toBe('timer')
-  })
-
-  test('absent manifest → null; runtime mismatch → throws', () => {
-    const env = envFor(mkTmp())
-    expect(readRuntimeManifest('notifier', { env })).toBeNull()
-    // hand-write a manifest whose runtime field disagrees with its folder
-    const path = join(env.IAPEER_ROOT as string, 'runtimes', 'notifier')
-    writeFileSync(join(mkTmp(), 'ignore'), '') // keep tmp tracking happy
-    rmSync(path, { recursive: true, force: true })
-    writeRuntimeManifest({ runtime: 'notifier' }, { env })
-    // corrupt the on-disk runtime field
-    const file = join(path, 'runtime.json')
-    writeFileSync(file, JSON.stringify({ runtime: 'telegram' }))
-    expect(() => readRuntimeManifest('notifier', { env })).toThrow(/mismatch/)
-  })
-})
-
-describe('runtimeSelfConfig (per-peer hook)', () => {
-  test('absent when no manifest declares a hook', () => {
-    const env = envFor(mkTmp())
-    const r = runtimeSelfConfig({ personality: 'timer', cwd: mkTmp(), runtime: 'notifier', intelligence: 'absent' }, { env })
-    expect(r.state).toBe('absent')
-  })
-
-  test('configured: hook runs with IAPEER_PEER_* env (NOT bare PEER_*)', () => {
-    const root = mkTmp()
-    const env = envFor(root)
-    const { hook } = stubBins()
-    writeRuntimeManifest({ runtime: 'notifier', selfConfig: hook }, { env })
-    const cwd = mkTmp()
-    const r = runtimeSelfConfig({ personality: 'timer', cwd, runtime: 'notifier', intelligence: 'absent' }, { env })
-    expect(r.state).toBe('configured')
-    // the hook wrote the per-peer env it received
-    const recorded = readFileSync(join(env.IAPEER_ROOT as string, 'sc-timer'), 'utf8')
-    expect(recorded).toBe('timer|notifier|absent')
-  })
-
-  test('failed: a non-zero hook is reported (caller decides fail-closed)', () => {
-    const root = mkTmp()
-    const env = envFor(root)
-    const dir = mkTmp()
-    const hook = join(dir, 'bad.sh')
-    writeFileSync(hook, '#!/bin/sh\necho boom >&2\nexit 3\n', { mode: 0o755 })
-    writeRuntimeManifest({ runtime: 'notifier', selfConfig: hook }, { env })
-    const r = runtimeSelfConfig({ personality: 'timer', cwd: mkTmp(), runtime: 'notifier', intelligence: 'absent' }, { env })
-    expect(r.state).toBe('failed')
-    expect(r.detail).toContain('boom')
-  })
-})
-
-describe('deployRuntime (declared-set, mode a)', () => {
-  test('provisions the whole declared peer-set (folder + registry + plist + self-config)', async () => {
-    const root = mkTmp()
-    const { dir: bindir, launcher, hook } = stubBins()
-    const env = envFor(root, bindir)
-    writeRuntimeManifest(
-      {
-        runtime: 'notifier',
-        selfConfig: hook,
-        peers: [
-          { personality: 'timer', intelligence: 'absent' },
-          { personality: 'watcher', intelligence: 'absent' },
-        ],
-      },
-      { env },
-    )
-
-    void launcher // resolved by provision via env.PATH (bindir holds notifier-runtime)
-    const r = await deployRuntime({ runtime: 'notifier', env })
-    expect(r.operatorAddOnly).toBe(false)
-    expect(r.peers.map(p => p.personality).sort()).toEqual(['timer', 'watcher'])
-    for (const p of r.peers) {
-      expect(p.selfConfig).toBe('configured')
-      expect(p.bootstrap).toBe('skipped-sandbox') // sandbox: not loaded
-      expect(findPeer(readPeersIndex({ env }), p.personality)).not.toBeNull()
-      expect(existsSync(launchdPlistPath(p.personality, env))).toBe(true)
-    }
-  })
-
-  test('a runtime with no declared peers → operatorAddOnly (telegram = mode b)', async () => {
-    const root = mkTmp()
-    const env = envFor(root)
-    writeRuntimeManifest({ runtime: 'telegram', selfConfig: 'telegram-runtime self-config' }, { env })
-    const r = await deployRuntime({ runtime: 'telegram', env })
-    expect(r.operatorAddOnly).toBe(true)
-    expect(r.peers.length).toBe(0)
-  })
-})
-
-describe('§6 — package registry + npx install + onboardRuntime', () => {
-  test('resolveRuntimePackage: built-in registry, --package override', () => {
-    expect(resolveRuntimePackage('telegram')).toBe(RUNTIME_PACKAGES.telegram)
-    expect(resolveRuntimePackage('notifier')).toBe('@agfpd/notifier-runtime')
-    expect(resolveRuntimePackage('telegram', '@me/fork')).toBe('@me/fork') // override wins
-    expect(resolveRuntimePackage('webhook')).toBeUndefined() // no mapping
-  })
-
-  test('installRuntimePackage: skipped when manifest present (idempotent)', () => {
-    const env = envFor(mkTmp())
-    writeRuntimeManifest({ runtime: 'notifier' }, { env })
-    let called = false
-    const r = installRuntimePackage({ runtime: 'notifier', env, runNpx: () => ((called = true), { ok: true }) })
-    expect(r.state).toBe('skipped')
-    expect(called).toBe(false) // never ran npx — package already installed
-  })
-
-  test('installRuntimePackage: ran (npx invoked) when no manifest', () => {
-    const env = envFor(mkTmp())
-    let gotPkg = ''
-    const r = installRuntimePackage({
-      runtime: 'notifier',
-      env,
-      runNpx: pkg => ((gotPkg = pkg), { ok: true }),
-    })
-    expect(r.state).toBe('ran')
-    expect(gotPkg).toBe('@agfpd/notifier-runtime') // resolved from the registry
-  })
-
-  test('installRuntimePackage: no-package when no mapping + no --package + no manifest', () => {
-    const env = envFor(mkTmp())
-    const r = installRuntimePackage({ runtime: 'webhook', env, runNpx: () => ({ ok: true }) })
-    expect(r.state).toBe('no-package')
-  })
-
-  test('onboardRuntime: npx (self-deploy manifest) → deploy declared set', async () => {
-    const root = mkTmp()
-    const bindir = mkTmp()
-    writeFileSync(join(bindir, 'notifier-runtime'), '#!/bin/sh\nexec sleep 1\n', { mode: 0o755 })
-    const hook = join(bindir, 'sc.sh')
-    writeFileSync(hook, '#!/bin/sh\nexit 0\n', { mode: 0o755 })
-    const env = envFor(root, bindir)
-
-    // simulate the package self-deploying its manifest on npx (bin pre-staged on PATH)
-    const runNpx = (_pkg: string, e: NodeJS.ProcessEnv) => {
-      const m: RuntimeManifest = {
-        runtime: 'notifier',
-        selfConfig: hook,
-        peers: [{ personality: 'sbxt', intelligence: 'absent' }],
-      }
-      writeRuntimeManifest(m, { env: e })
-      return { ok: true }
-    }
-
-    const r = await onboardRuntime({ runtime: 'notifier', env, runNpx })
-    expect(r.install.state).toBe('ran')
-    expect(r.deploy?.peers.map(p => p.personality)).toEqual(['sbxt'])
-    expect(r.deploy?.peers[0].selfConfig).toBe('configured')
-    expect(r.deploy?.peers[0].bootstrap).toBe('skipped-sandbox')
-    expect(findPeer(readPeersIndex({ env }), 'sbxt')).not.toBeNull()
-  })
-
-  test('onboardRuntime: failed npx aborts before deploy (fail-closed)', async () => {
-    const env = envFor(mkTmp())
-    await expect(
-      onboardRuntime({ runtime: 'notifier', env, runNpx: () => ({ ok: false, detail: 'network' }) }),
-    ).rejects.toThrow(/npx install.*failed/)
-    expect(findPeer(readPeersIndex({ env }), 'sbxt')).toBeNull()
-  })
-})