@agfpd/iapeer 0.2.76 → 0.2.78

package/src/daemon/main.test.ts

@@ -1,413 +0,0 @@
-// Daemon production main — the daemon's OWN launchd plist (com.agfpd.iapeer),
-// the composition smoke (startConfiguredDaemon returns a live TCP handle), and the
-// DORMANT H8 bearer seam (off by default → no auth; on only when a token is set).
-// All plist writes go under IAPEER_LAUNCHAGENTS_DIR so the suite never touches the
-// real ~/Library/LaunchAgents.
-
-import { afterEach, describe, expect, test } from 'bun:test'
-import { spawnSync } from 'child_process'
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import {
-  buildDaemonPlistSpec,
-  daemonPlistPath,
-  installDaemonPlist,
-  makeArmEphemeralOnDelivered,
-  makeEphemeralRouteDeps,
-  makeNoteLiveTopic,
-  startConfiguredDaemon,
-  DEFAULT_DAEMON_PORT,
-} from './main.ts'
-import { daemonDiscoveryPath, defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index.ts'
-import {
-  ephemeralQueueDepth,
-  hasEphemeralArmed,
-  peekEphemeralTask,
-  readTopic,
-  resolveWakeMode,
-  setIdleReaped,
-  writeTopic,
-  type LifecycleConfig,
-} from '../lifecycle/index.ts'
-import type { ResolvedCaller } from '../identity/index.ts'
-import { isFoundationOwnedPlist } from '../launch/index.ts'
-import { DAEMON_PLIST_LABEL } from '../core/constants.ts'
-
-const tmpDirs: string[] = []
-function mkTmp(): string {
-  const d = mkdtempSync(join(tmpdir(), 'iapeer-daemon-main-'))
-  tmpDirs.push(d)
-  return d
-}
-afterEach(() => {
-  while (tmpDirs.length) rmSync(tmpDirs.pop()!, { recursive: true, force: true })
-})
-
-function plutilLint(path: string): boolean {
-  return spawnSync('plutil', ['-lint', path], { encoding: 'utf8' }).status === 0
-}
-
-describe('buildDaemonPlistSpec / installDaemonPlist (com.agfpd.iapeer)', () => {
-  test('spec carries the daemon label, default port env, and the INSTALLED iapeer entrypoint (Ф-F)', () => {
-    const spec = buildDaemonPlistSpec({ env: { HOME: '/Users/x' } as NodeJS.ProcessEnv })
-    expect(spec.label).toBe(DAEMON_PLIST_LABEL) // com.agfpd.iapeer — NOT com.iapeer.*
-    expect(spec.environment.IAPEER_PORT).toBe(String(DEFAULT_DAEMON_PORT))
-    // Ф-F: runs the INSTALLED binary `iapeer daemon`, NOT `bun <src>/main.ts` — prod
-    // decoupled from the mutable src tree.
-    expect(spec.programArguments).toEqual(['/Users/x/.local/bin/iapeer', 'daemon'])
-  })
-
-  test('NO bearer token in the plist env by default (H8 seam dormant)', () => {
-    expect(buildDaemonPlistSpec({ env: {} as NodeJS.ProcessEnv }).environment.IAPEER_BEARER_TOKEN).toBeUndefined()
-  })
-
-  test('bearer token is baked into the plist env only when explicitly provided', () => {
-    const spec = buildDaemonPlistSpec({ bearerToken: 's3cret', env: {} as NodeJS.ProcessEnv })
-    expect(spec.environment.IAPEER_BEARER_TOKEN).toBe('s3cret')
-  })
-
-  test('installs a valid, foundation-owned plist under IAPEER_LAUNCHAGENTS_DIR', () => {
-    const root = mkTmp()
-    const env = {
-      IAPEER_LAUNCHAGENTS_DIR: join(root, 'LaunchAgents'),
-      IAPEER_ROOT: join(root, 'iapeer'),
-      HOME: root,
-      PATH: '/usr/bin:/bin',
-    } as NodeJS.ProcessEnv
-    const r = installDaemonPlist({ env, port: 8765, throttleIntervalSecs: 10 })
-    expect(r.path).toBe(daemonPlistPath(env))
-    expect(r.changed).toBe(true) // first install on a clean host writes
-    expect(existsSync(r.path)).toBe(true)
-    expect(isFoundationOwnedPlist(r.path)).toBe(true)
-    expect(plutilLint(r.path)).toBe(true) // live plutil: valid plist
-    const xml = readFileSync(r.path, 'utf8')
-    expect(xml).toContain(`<string>${DAEMON_PLIST_LABEL}</string>`)
-    expect(xml).toContain('<key>RunAtLoad</key>')
-    expect(xml).toContain('<key>KeepAlive</key>')
-  })
-
-  test('idempotent by content: a re-install of the SAME plist does NOT rewrite the file (changed:false, mtime stable) — no BTM notification spam (owner-caught 11.06)', () => {
-    const root = mkTmp()
-    const env = {
-      IAPEER_LAUNCHAGENTS_DIR: join(root, 'LaunchAgents'),
-      IAPEER_ROOT: join(root, 'iapeer'),
-      HOME: root,
-      PATH: '/usr/bin:/bin',
-    } as NodeJS.ProcessEnv
-    const opts = { env, port: 8765, throttleIntervalSecs: 10 }
-    const first = installDaemonPlist(opts)
-    expect(first.changed).toBe(true)
-    const mtime1 = statSync(first.path).mtimeMs
-    // second identical install — must be a pure no-op (no write → BTM not tripped)
-    const second = installDaemonPlist(opts)
-    expect(second.changed).toBe(false)
-    expect(second.path).toBe(first.path)
-    expect(statSync(second.path).mtimeMs).toBe(mtime1) // file untouched, not just byte-equal
-    // a CHANGED spec (different port → different rendered plist) DOES rewrite
-    const third = installDaemonPlist({ env, port: 9999, throttleIntervalSecs: 10 })
-    expect(third.changed).toBe(true)
-  })
-
-  test('REFUSES to overwrite a foreign com.agfpd.iapeer.plist (collision guard)', () => {
-    const root = mkTmp()
-    const laDir = join(root, 'LaunchAgents')
-    mkdirSync(laDir, { recursive: true })
-    const env = { IAPEER_LAUNCHAGENTS_DIR: laDir, IAPEER_ROOT: join(root, 'iapeer'), HOME: root } as NodeJS.ProcessEnv
-    const path = daemonPlistPath(env)
-    const foreign = '<?xml version="1.0"?>\n<plist><dict><key>Label</key><string>com.agfpd.iapeer</string></dict></plist>\n'
-    writeFileSync(path, foreign)
-    expect(() => installDaemonPlist({ env })).toThrow(/foundation-managed|refus/i)
-    expect(readFileSync(path, 'utf8')).toBe(foreign) // untouched
-    // (the throw must fire BEFORE the write-if-changed read, so the foreign file
-    //  is never even compared — the guard is the first gate.)
-  })
-})
-
-describe('startConfiguredDaemon (composition smoke — TCP loopback)', () => {
-  test('returns a live http handle and closes cleanly', async () => {
-    const root = mkTmp()
-    const env = { IAPEER_ROOT: join(root, 'iapeer'), HOME: root, PATH: '/usr/bin:/bin' } as NodeJS.ProcessEnv
-    const handle = await startConfiguredDaemon({ port: 0, host: '127.0.0.1', env })
-    try {
-      expect(handle.url).toMatch(/^http:\/\/127\.0\.0\.1:\d+\/mcp$/)
-    } finally {
-      await handle.close()
-    }
-  })
-})
-
-// The H8 bearer seam: a validator LAYER on the listener, OFF unless a token is set
-// (Артур 07.06 — H8 DEFERRED, no token provisioning yet). These tests prove the
-// seam is dormant by default and would gate every request once a token is wired.
-describe('H8 bearer seam (dormant by default)', () => {
-  const INIT = JSON.stringify({
-    jsonrpc: '2.0', id: 1, method: 'initialize',
-    params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 't', version: '0' } },
-  })
-  const headers = (auth?: string): Record<string, string> => ({
-    'content-type': 'application/json',
-    accept: 'application/json, text/event-stream',
-    ...(auth ? { authorization: auth } : {}),
-  })
-
-  async function withDaemon(opts: Parameters<typeof startDaemon>[0], fn: (h: DaemonHandle) => Promise<void>) {
-    const h = await startDaemon(opts)
-    try {
-      await fn(h)
-    } finally {
-      await h.close()
-    }
-  }
-
-  test('NO token → request is NOT 401 (auth layer off)', async () => {
-    await withDaemon({ port: 0, host: '127.0.0.1' }, async h => {
-      const res = await fetch(h.url!, { method: 'POST', headers: headers(), body: INIT })
-      expect(res.status).not.toBe(401)
-    })
-  })
-
-  test('token set → no Authorization is 401, correct Bearer passes the layer', async () => {
-    await withDaemon({ port: 0, host: '127.0.0.1', bearerToken: 'secret' }, async h => {
-      const noAuth = await fetch(h.url!, { method: 'POST', headers: headers(), body: INIT })
-      expect(noAuth.status).toBe(401)
-      const wrong = await fetch(h.url!, { method: 'POST', headers: headers('Bearer nope'), body: INIT })
-      expect(wrong.status).toBe(401)
-      const ok = await fetch(h.url!, { method: 'POST', headers: headers('Bearer secret'), body: INIT })
-      expect(ok.status).not.toBe(401) // passed the auth layer (MCP handles the rest)
-      await ok.body?.cancel()
-    })
-  })
-})
-
-// Dual-listen (Ф2 consolidation): the daemon serves a 0600 unix socket (local
-// same-uid callers: notifier/telegram/CLI) AND TCP (agent MCP) over ONE handler,
-// and writes router.json (both addresses) for daemon-aware `iap send`.
-describe('dual-listen + router.json discovery', () => {
-  const INIT = JSON.stringify({
-    jsonrpc: '2.0', id: 1, method: 'initialize',
-    params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 't', version: '0' } },
-  })
-  const mcpHeaders = { 'content-type': 'application/json', accept: 'application/json, text/event-stream' }
-
-  test('binds socket + TCP over one handler; router.json carries both; close cleans up', async () => {
-    const root = mkTmp()
-    const env = { IAPEER_ROOT: join(root, 'iapeer') } as NodeJS.ProcessEnv
-    const sockExpected = defaultDaemonSocketPath({ env })
-    const h = await startDaemon({ port: 0, host: '127.0.0.1', socketPath: sockExpected, discovery: true, env })
-    try {
-      // TCP listener answers the MCP handler
-      const tcp = await fetch(h.url!, { method: 'POST', headers: mcpHeaders, body: INIT })
-      expect(tcp.ok).toBe(true)
-      await tcp.body?.cancel()
-      // unix-socket listener answers the SAME handler (bun fetch `unix` option)
-      const unixInit = { unix: h.socketPath!, method: 'POST', headers: mcpHeaders, body: INIT } as unknown as RequestInit
-      const sock = await fetch('http://localhost/mcp', unixInit)
-      expect(sock.ok).toBe(true)
-      await sock.body?.cancel()
-      // socket is 0600 (same-uid)
-      expect((statSync(h.socketPath!).mode & 0o777).toString(8)).toBe('600')
-      // router.json carries BOTH addresses
-      const rj = JSON.parse(readFileSync(daemonDiscoveryPath({ env }), 'utf8'))
-      expect(rj.sock).toBe(sockExpected)
-      expect(rj.tcp).toBe(h.url)
-    } finally {
-      await h.close()
-    }
-    // clean shutdown removed the socket file AND router.json
-    expect(existsSync(sockExpected)).toBe(false)
-    expect(existsSync(daemonDiscoveryPath({ env }))).toBe(false)
-  })
-
-  test('port-only stays TCP-only — no socket, no router.json (backward compat)', async () => {
-    const root = mkTmp()
-    const env = { IAPEER_ROOT: join(root, 'iapeer') } as NodeJS.ProcessEnv
-    const h = await startDaemon({ port: 0, host: '127.0.0.1', env })
-    try {
-      expect(h.socketPath).toBeUndefined()
-      expect(existsSync(daemonDiscoveryPath({ env }))).toBe(false)
-    } finally {
-      await h.close()
-    }
-  })
-})
-
-describe('startDaemon composerQueue shutdown seam', () => {
-  test('close() fails pending busy-composer queue before tearing listeners down', async () => {
-    const reasons: string[] = []
-    const h = await startDaemon({
-      port: 0,
-      host: '127.0.0.1',
-      composerQueue: {
-        tryEnqueue: async () => null,
-        failAll: async reason => {
-          reasons.push(reason)
-        },
-      },
-    })
-    await h.close()
-    expect(reasons).toEqual(['daemon shutting down/restarting before queued delivery completed'])
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// wake_policy:ephemeral M2 — makeArmEphemeralOnDelivered (the arm-on-outbound
-// composition: ephemeral caller's ok send ⇒ .ephemeral-armed for its identity)
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('makeArmEphemeralOnDelivered (M2 arm-on-outbound)', () => {
-  function caller(cwd: string): ResolvedCaller {
-    return {
-      personality: 'w',
-      runtime: 'claude',
-      address: 'claude-w',
-      description: '',
-      intelligence: 'artificial',
-      cwd,
-      record: { personality: 'w', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial', cwd },
-    } as ResolvedCaller
-  }
-
-  test('EPHEMERAL caller → armed for the CALLER identity; plain caller → no-op', () => {
-    const stateDir = join(mkTmp(), 'lifecycle')
-    const cfg = { stateDir } as LifecycleConfig
-    const arm = makeArmEphemeralOnDelivered(cfg)
-    // ephemeral worker cwd
-    const eph = mkTmp()
-    mkdirSync(join(eph, '.iapeer'), { recursive: true })
-    writeFileSync(
-      join(eph, '.iapeer', 'peer-profile.json'),
-      JSON.stringify({ personality: 'w', runtime: 'claude', wake_policy: 'ephemeral' }),
-    )
-    arm(caller(eph))
-    expect(hasEphemeralArmed(cfg, 'claude-w')).toBe(true)
-    // plain peer cwd (no wake_policy) → never armed
-    const plainCfg = { stateDir: join(mkTmp(), 'lifecycle') } as LifecycleConfig
-    const plain = mkTmp()
-    mkdirSync(join(plain, '.iapeer'), { recursive: true })
-    writeFileSync(
-      join(plain, '.iapeer', 'peer-profile.json'),
-      JSON.stringify({ personality: 'w', runtime: 'claude' }),
-    )
-    makeArmEphemeralOnDelivered(plainCfg)(caller(plain))
-    expect(hasEphemeralArmed(plainCfg, 'claude-w')).toBe(false)
-  })
-
-  test('missing profile / unreadable cwd → no-op, never throws (best-effort)', () => {
-    const cfg = { stateDir: join(mkTmp(), 'lifecycle') } as LifecycleConfig
-    const arm = makeArmEphemeralOnDelivered(cfg)
-    expect(() => arm(caller('/tmp/no-such-peer-cwd-anywhere'))).not.toThrow()
-    expect(hasEphemeralArmed(cfg, 'claude-w')).toBe(false)
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// wake_policy:"ephemeral" M3 — makeEphemeralRouteDeps (enqueue + async drain kick)
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('makeEphemeralRouteDeps (M3 serial-queue composition)', () => {
-  const workerPeer = {
-    personality: 'w',
-    runtime: 'claude' as const,
-    runtimes: ['claude' as const],
-    description: '',
-    intelligence: 'artificial' as const,
-    cwd: '/tmp/w',
-  }
-
-  test('deliver = enqueue to disk + fast {queued, qd} ack + drain kick (NOT awaited wake)', async () => {
-    const stateDir = join(mkTmp(), 'lifecycle')
-    const cfg = { stateDir } as LifecycleConfig
-    const kicks: string[] = []
-    const deps = makeEphemeralRouteDeps(cfg, {} as NodeJS.ProcessEnv, (p, rt) => kicks.push(`${rt}-${p}`))
-
-    const r1 = await deps.deliver({ peer: workerPeer, envelope: '<iap>task one</iap>', topic: 't1' })
-    const r2 = await deps.deliver({ peer: workerPeer, envelope: '<iap>task two</iap>' })
-
-    expect(r1.ok && r1.value.queued).toBe(true)
-    expect(r1.ok && r1.value.queuedBy).toBe('ephemeral')
-    expect(r1.ok && r1.value.queueDepth).toBe(1)
-    expect(r1.ok && r1.value.woke).toBe(false)
-    expect(r2.ok && r2.value.queueDepth).toBe(2)
-    expect(kicks).toEqual(['claude-w', 'claude-w']) // drain kicked per enqueue
-    // durable FIFO on disk, head intact
-    expect(ephemeralQueueDepth(cfg, 'claude-w')).toBe(2)
-    expect(peekEphemeralTask(cfg, 'claude-w')).toMatchObject({ task: '<iap>task one</iap>', topic: 't1' })
-  })
-
-  test('enqueue failure → fail-loud delivery error (never a false queued ack)', async () => {
-    const root = mkTmp()
-    const blocker = join(root, 'state-is-a-file')
-    writeFileSync(blocker, 'not a dir')
-    const cfg = { stateDir: join(blocker, 'lifecycle') } as LifecycleConfig // mkdir must fail
-    const deps = makeEphemeralRouteDeps(cfg, {} as NodeJS.ProcessEnv, () => {})
-    const r = await deps.deliver({ peer: workerPeer, envelope: 'x' })
-    expect(r.ok).toBe(false)
-    if (!r.ok) expect(r.error.message).toMatch(/enqueue failed/)
-  })
-
-  test('runtime override resolves through the registry gate (undeclared → fail-loud)', async () => {
-    const cfg = { stateDir: join(mkTmp(), 'lifecycle') } as LifecycleConfig
-    const deps = makeEphemeralRouteDeps(cfg, {} as NodeJS.ProcessEnv, () => {})
-    const r = await deps.deliver({ peer: workerPeer, envelope: 'x', runtime: 'codex' })
-    expect(r.ok).toBe(false) // 'codex' is not declared for this worker
-  })
-})
-
-// ─────────────────────────────────────────────────────────────────────────────
-// makeNoteLiveTopic — the live-delivered-topic composition (fresh-vs-resume seam):
-// the .topic marker must track the topic the session last WORKED ON, not the one
-// it woke with (defect 11.06: a day-stale wake-time marker false-freshed the
-// stop→start resume of a long-lived executor).
-// ─────────────────────────────────────────────────────────────────────────────
-
-describe('makeNoteLiveTopic (live-delivered topic → .topic marker)', () => {
-  function noteCfg(): LifecycleConfig {
-    const root = mkTmp()
-    return { stateDir: join(root, 'state'), eventLogDir: join(root, 'logs') } as LifecycleConfig
-  }
-
-  test('topic SHIFT → marker updated + ev=topic-note logged; same topic → no churn, no log spam', () => {
-    const cfg = noteCfg()
-    const note = makeNoteLiveTopic(cfg, {} as NodeJS.ProcessEnv)
-    writeTopic(cfg, 'claude-x', 'topic-a') // the wake established topic A
-    note('claude-x', 'topic-b') // a live delivery switches the work to B
-    expect(readTopic(cfg, 'claude-x')).toBe('topic-b')
-    const logPath = join(cfg.eventLogDir, 'lifecycle.log')
-    const log = readFileSync(logPath, 'utf8')
-    expect(log).toContain('ev=topic-note')
-    expect(log).toContain('identity=claude-x')
-    expect(log).toContain('topic=topic-b')
-    // the common case — every further message continues topic B → strictly nothing
-    note('claude-x', 'topic-b')
-    note('claude-x', 'topic-b')
-    expect(readFileSync(logPath, 'utf8').match(/ev=topic-note/g)?.length).toBe(1)
-  })
-
-  test('acceptance scenario (boris 11.06): woke with topic A → worked live-delivered topic B → clean stop-park → wake with topic B = RESUME, not fresh', () => {
-    const cfg = noteCfg()
-    const id = 'claude-x'
-    // executor peer cwd: no telegram interface (not human-conversational), no wake_policy
-    const cwd = mkTmp()
-    mkdirSync(join(cwd, '.iapeer'), { recursive: true })
-    writeFileSync(join(cwd, '.iapeer', 'peer-profile.json'), JSON.stringify({ personality: 'x', runtime: 'claude' }))
-    writeTopic(cfg, id, 'topic-a') // session woke with topic A (the stale pre-fix marker)
-    makeNoteLiveTopic(cfg)(id, 'topic-b') // ...then took topic-B messages in the LIVE session all day
-    setIdleReaped(cfg, id) // deliberate stop = clean park (stopPeer's promise)
-    const hasTranscript = () => ({ ok: true, ref: 'uuid-1' })
-    // pre-fix this read the stale 'topic-a' → cause=idle-reaped-new-topic → FRESH (context lost)
-    expect(resolveWakeMode(cfg, id, cwd, undefined, hasTranscript, 'topic-b')).toEqual({
-      resume: true,
-      resumeRef: 'uuid-1',
-      cause: 'idle-reaped-resume',
-    })
-  })
-
-  test('marker/log failure → no-op, never throws (a delivered message must stand)', () => {
-    const root = mkTmp()
-    const blocker = join(root, 'state-is-a-file')
-    writeFileSync(blocker, 'not a dir')
-    const cfg = { stateDir: join(blocker, 'state'), eventLogDir: join(blocker, 'logs') } as LifecycleConfig // mkdir must fail
-    expect(() => makeNoteLiveTopic(cfg)('claude-x', 'topic-b')).not.toThrow()
-  })
-})

package/src/enable/enable.test.ts

@@ -1,95 +0,0 @@
-// enable — the PURE fleet-safety + idempotency logic: parse `claude plugin list
-// --json`, match the entry for THIS peer's projectPath (realpath), and detect a
-// plugin's `setup` from iapeer.json (SIMPLE vs СЛОЖНЫЙ). The spawn/install paths are
-// live-verified on a throwaway test-peer (project-scope is keyed by projectPath, so a
-// test install never touches a live peer's entry).
-
-import { describe, expect, test } from 'bun:test'
-import { mkdtempSync, rmSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import { findPeerScopedEntry, parseCodexPluginStatus, parseInstalledPlugins, readSetupDescriptor } from './index.ts'
-
-// a realistic `claude plugin list --json` array (the live shape: id/scope/enabled/
-// projectPath/installPath), two live peers + the same plugin user-scope.
-const LIST = JSON.stringify([
-  { id: 'Inter-Agent-Protocol@agfpd', scope: 'project', enabled: true, projectPath: '/Users/x/agents/linus', installPath: '/c/iap/0.7.11' },
-  { id: 'peer-voice@agfpd', scope: 'project', enabled: true, projectPath: '/Users/x/agents/boris', installPath: '/c/pv/0.1.8' },
-  { id: 'peer-voice@agfpd', scope: 'user', enabled: false, installPath: '/c/pv/0.1.8' },
-])
-
-describe('parseInstalledPlugins', () => {
-  test('parses the flat array into typed entries; tolerates junk', () => {
-    const e = parseInstalledPlugins(LIST)
-    expect(e.length).toBe(3)
-    expect(e[0]).toMatchObject({ id: 'Inter-Agent-Protocol@agfpd', scope: 'project', enabled: true, projectPath: '/Users/x/agents/linus' })
-    expect(parseInstalledPlugins('not json')).toEqual([])
-    expect(parseInstalledPlugins('{"not":"array"}')).toEqual([])
-    expect(parseInstalledPlugins('[1, null, {"no":"id"}]')).toEqual([]) // entries without a string id are dropped
-  })
-})
-
-describe('findPeerScopedEntry (per-peer, fleet-safe)', () => {
-  test('matches ONLY the project-scope entry for this peer cwd', () => {
-    const e = parseInstalledPlugins(LIST)
-    expect(findPeerScopedEntry(e, 'peer-voice', 'agfpd', '/Users/x/agents/boris')?.enabled).toBe(true)
-    // a DIFFERENT peer cwd → no match (never reports another peer's install as ours)
-    expect(findPeerScopedEntry(e, 'peer-voice', 'agfpd', '/Users/x/agents/darwin')).toBeNull()
-    // user-scope is not a per-peer match
-    expect(findPeerScopedEntry(e, 'peer-voice', 'agfpd', '/Users/x/agents/boris')?.scope).toBe('project')
-  })
-  test('absent plugin for this peer → null (drives install, not false-skip)', () => {
-    const e = parseInstalledPlugins(LIST)
-    expect(findPeerScopedEntry(e, 'MergeMind', 'agfpd', '/Users/x/agents/linus')).toBeNull()
-  })
-})
-
-// the real `codex plugin list --json` shape (codex-cli 0.138, live-captured fields)
-const CODEX_LIST = JSON.stringify({
-  installed: [
-    { pluginId: 'peer-voice@agfpd', installed: true, enabled: true },
-    { pluginId: 'MergeMind@agfpd', installed: true, enabled: false },
-    { pluginId: 'spawned-peer@agfpd', installed: false, enabled: false }, // marketplace-known, not installed
-  ],
-})
-
-describe('parseCodexPluginStatus', () => {
-  test('reads the installed/enabled flags per plugin id', () => {
-    expect(parseCodexPluginStatus(CODEX_LIST, 'peer-voice@agfpd')).toBe('enabled')
-    expect(parseCodexPluginStatus(CODEX_LIST, 'spawned-peer@agfpd')).toBe('absent') // installed:false
-    expect(parseCodexPluginStatus(CODEX_LIST, 'MergeMind@agfpd')).toBe('disabled') // installed, not enabled
-    expect(parseCodexPluginStatus(CODEX_LIST, 'totp-presence@agfpd')).toBe('absent') // not in array
-    expect(parseCodexPluginStatus('', 'x@agfpd')).toBe('absent') // empty
-    expect(parseCodexPluginStatus('not json', 'x@agfpd')).toBe('absent') // malformed → fail-safe
-    expect(parseCodexPluginStatus('{"no":"installed-array"}', 'x@agfpd')).toBe('absent')
-  })
-})
-
-describe('readSetupDescriptor (SIMPLE vs СЛОЖНЫЙ)', () => {
-  test('no installPath / no iapeer.json → null (SIMPLE: install+enable only)', () => {
-    expect(readSetupDescriptor(undefined)).toBeNull()
-    const dir = mkdtempSync(join(tmpdir(), 'iapeer-enable-simple-'))
-    try {
-      expect(readSetupDescriptor(dir)).toBeNull() // peer-voice-like: no manifest
-    } finally {
-      rmSync(dir, { recursive: true, force: true })
-    }
-  })
-  test('iapeer.json with setup string → returns it; with {command,args} → object', () => {
-    const dir = mkdtempSync(join(tmpdir(), 'iapeer-enable-complex-'))
-    try {
-      writeFileSync(join(dir, 'iapeer.json'), JSON.stringify({ setup: 'bin/setup' }))
-      expect(readSetupDescriptor(dir)).toBe('bin/setup')
-      writeFileSync(join(dir, 'iapeer.json'), JSON.stringify({ setup: { command: 'node', args: ['setup.js'] } }))
-      expect(readSetupDescriptor(dir)).toEqual({ command: 'node', args: ['setup.js'] })
-      // requires present but NO setup → still SIMPLE (iapeer does not resolve requires)
-      writeFileSync(join(dir, 'iapeer.json'), JSON.stringify({ requires: ['telegram'] }))
-      expect(readSetupDescriptor(dir)).toBeNull()
-      // malformed manifest → treated as SIMPLE, never throws
-      writeFileSync(join(dir, 'iapeer.json'), '{ broken')
-      expect(readSetupDescriptor(dir)).toBeNull()
-    } finally {
-      rmSync(dir, { recursive: true, force: true })
-    }
-  })
-})

package/src/enable/provisionCommand.test.ts

@@ -1,107 +0,0 @@
-// Provision-command executor — the v1.2 inversion joint. Pins the four contract
-// requirements: per-arg placeholder substitution WITHOUT a shell (injection
-// class), absolute command, timeout, structured outcomes. The fake provider is
-// a tmp shell script that journals its argv — no real provider involved.
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import { runProvisionCommand } from './provisionCommand.ts'
-
-let dir: string
-beforeEach(() => {
-  dir = mkdtempSync(join(tmpdir(), 'iapeer-provcmd-'))
-})
-afterEach(() => {
-  rmSync(dir, { recursive: true, force: true })
-})
-
-/** A fake provider command journaling each argv element on its own line. */
-function fakeProvider(name: string, body?: string): string {
-  const p = join(dir, name)
-  writeFileSync(p, `#!/bin/sh\n${body ?? `printf '%s\\n' "$@" > '${dir}/journal.txt'`}\n`)
-  chmodSync(p, 0o755)
-  return p
-}
-
-describe('runProvisionCommand (v1.2 executor)', () => {
-  test('per-arg substitution of {cwd}/{runtime}/{personality}/{occasion}, argv passed verbatim (no shell)', () => {
-    const cmd = fakeProvider('prov.sh')
-    const o = runProvisionCommand({
-      block: {
-        command: cmd,
-        // both shapes: bare placeholder arg and embedded `--k={v}`; plus an arg
-        // full of shell metacharacters that MUST stay literal (no shell layer)
-        args: ['provision-peer', '--cwd', '{cwd}', '--runtime={runtime}', '--occasion', '{occasion}', '$(reboot) `id` ; rm -rf /'],
-      },
-      cwd: '/tmp/some peer dir',
-      runtime: 'claude',
-      personality: 'tw-prov',
-      occasion: 'birth',
-    })
-    expect(o.state).toBe('ok')
-    expect(o.exitCode).toBe(0)
-    const journal = readFileSync(join(dir, 'journal.txt'), 'utf8').split('\n')
-    expect(journal[0]).toBe('provision-peer')
-    expect(journal[1]).toBe('--cwd')
-    expect(journal[2]).toBe('/tmp/some peer dir') // spaces survive — single argv element
-    expect(journal[3]).toBe('--runtime=claude') // embedded substitution
-    expect(journal[4]).toBe('--occasion')
-    expect(journal[5]).toBe('birth')
-    expect(journal[6]).toBe('$(reboot) `id` ; rm -rf /') // LITERAL — never shell-parsed
-  })
-
-  test('{personality} placeholder is supported (optional for the provider)', () => {
-    const cmd = fakeProvider('prov.sh')
-    const o = runProvisionCommand({
-      block: { command: cmd, args: ['{personality}'] },
-      cwd: '/x',
-      runtime: 'codex',
-      personality: 'boris',
-      occasion: 'sweep-on',
-    })
-    expect(o.state).toBe('ok')
-    expect(readFileSync(join(dir, 'journal.txt'), 'utf8').trim()).toBe('boris')
-  })
-
-  test('non-zero exit → failed with exit code and stderr tail', () => {
-    const cmd = fakeProvider('prov.sh', `echo 'no such peer' >&2; exit 3`)
-    const o = runProvisionCommand({
-      block: { command: cmd, args: [] },
-      cwd: '/x',
-      runtime: 'claude',
-      personality: 'p',
-      occasion: 'off-peer',
-    })
-    expect(o.state).toBe('failed')
-    expect(o.exitCode).toBe(3)
-    expect(o.detail).toContain('no such peer')
-  })
-
-  test('timeout → state=timeout, never hangs the joint', () => {
-    const cmd = fakeProvider('prov.sh', 'sleep 30')
-    const o = runProvisionCommand({
-      block: { command: cmd, args: [] },
-      cwd: '/x',
-      runtime: 'claude',
-      personality: 'p',
-      occasion: 'remove',
-      timeoutMs: 300,
-    })
-    expect(o.state).toBe('timeout')
-    expect(o.durationMs).toBeLessThan(5000)
-  })
-
-  test('missing/non-executable command → not-executable (never throws)', () => {
-    const o = runProvisionCommand({
-      block: { command: join(dir, 'nope.sh'), args: [] },
-      cwd: '/x',
-      runtime: 'claude',
-      personality: 'p',
-      occasion: 'birth',
-    })
-    expect(o.state).toBe('not-executable')
-    expect(o.exitCode).toBeNull()
-  })
-})