@agfpd/iapeer 0.2.77 → 0.2.79

package/src/init/init.test.ts

@@ -1,215 +0,0 @@
-// init — per-peer onboarding: HTTP-MCP .mcp.json wiring (the install-gate-proven
-// transport), doctrine template, and the initPeer orchestration over provisionPeer.
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import {
-  CODEX_BEARER_ENV_VAR,
-  IAPEER_MCP_SERVER_NAME,
-  codexConfigPath,
-  ensureCodexUpdateCheckDisabled,
-  ensureDoctrineTemplate,
-  initPeer,
-  resolveDaemonMcpUrl,
-  writeClaudeMcpConfig,
-  writeCodexMcpConfig,
-} from './index.ts'
-import { readPeersIndex } from '../registry/index.ts'
-import { readPeerProfile } from '../identity/index.ts'
-
-let root: string
-let cwd: string
-function cleanEnv(extra: Record<string, string> = {}): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = { ...process.env, IAPEER_ROOT: root, ...extra }
-  delete env.PEER_PERSONALITY
-  delete env.PEER_IDENTITY
-  delete env.PEER_RUNTIME
-  return env
-}
-
-beforeEach(() => {
-  root = mkdtempSync(join(tmpdir(), 'iapeer-init-root-'))
-  cwd = mkdtempSync(join(tmpdir(), 'iapeer-init-cwd-'))
-})
-afterEach(() => {
-  rmSync(root, { recursive: true, force: true })
-  rmSync(cwd, { recursive: true, force: true })
-})
-
-describe('resolveDaemonMcpUrl', () => {
-  test('no router.json → well-known default loopback URL (IAPEER_PORT respected)', () => {
-    expect(resolveDaemonMcpUrl({ env: cleanEnv() })).toBe('http://127.0.0.1:8765/mcp')
-    expect(resolveDaemonMcpUrl({ env: cleanEnv({ IAPEER_PORT: '9999' }) })).toBe('http://127.0.0.1:9999/mcp')
-  })
-  test('router.json present → its tcp field (daemon-published endpoint)', () => {
-    const stateDir = join(root, 'state', 'iapeer')
-    mkdirSync(stateDir, { recursive: true })
-    writeFileSync(join(stateDir, 'router.json'), JSON.stringify({ sock: '/x.sock', tcp: 'http://127.0.0.1:8765/mcp' }))
-    expect(resolveDaemonMcpUrl({ env: cleanEnv() })).toBe('http://127.0.0.1:8765/mcp')
-  })
-})
-
-describe('writeClaudeMcpConfig', () => {
-  test('writes the iapeer http server with the X-IAPeer-Identity header', () => {
-    const path = writeClaudeMcpConfig(cwd, 'boris', 'http://127.0.0.1:8765/mcp')
-    const doc = JSON.parse(readFileSync(path, 'utf8'))
-    expect(doc.mcpServers[IAPEER_MCP_SERVER_NAME]).toEqual({
-      type: 'http',
-      url: 'http://127.0.0.1:8765/mcp',
-      // env-expanded by claude from the session PEER_IDENTITY; literal fallback for
-      // a manual (no-env) session — identity follows the SESSION, not the cwd file.
-      headers: { 'X-IAPeer-Identity': '${PEER_IDENTITY:-claude-boris}' },
-    })
-  })
-  test('MERGES — preserves other mcpServers, only (re)writes iapeer', () => {
-    writeFileSync(join(cwd, '.mcp.json'), JSON.stringify({ mcpServers: { other: { type: 'http', url: 'https://x/mcp' } } }))
-    writeClaudeMcpConfig(cwd, 'boris', 'http://127.0.0.1:8765/mcp')
-    const doc = JSON.parse(readFileSync(join(cwd, '.mcp.json'), 'utf8'))
-    expect(doc.mcpServers.other).toEqual({ type: 'http', url: 'https://x/mcp' })
-    expect(doc.mcpServers.iapeer.headers['X-IAPeer-Identity']).toBe('${PEER_IDENTITY:-claude-boris}')
-  })
-  test('idempotent — re-running yields the same bytes', () => {
-    const p = writeClaudeMcpConfig(cwd, 'boris', 'http://127.0.0.1:8765/mcp')
-    const first = readFileSync(p, 'utf8')
-    writeClaudeMcpConfig(cwd, 'boris', 'http://127.0.0.1:8765/mcp')
-    expect(readFileSync(p, 'utf8')).toBe(first)
-  })
-})
-
-describe('ensureDoctrineTemplate', () => {
-  test('creates the template when absent', () => {
-    const { path, created } = ensureDoctrineTemplate(cwd)
-    expect(created).toBe(true)
-    expect(existsSync(path)).toBe(true)
-    expect(readFileSync(path, 'utf8')).toContain('Peer doctrine')
-  })
-  test('never overwrites an existing doctrine', () => {
-    mkdirSync(join(cwd, '.iapeer'), { recursive: true })
-    writeFileSync(join(cwd, '.iapeer', 'IAPEER.md'), 'I am boris.')
-    const { created } = ensureDoctrineTemplate(cwd)
-    expect(created).toBe(false)
-    expect(readFileSync(join(cwd, '.iapeer', 'IAPEER.md'), 'utf8')).toBe('I am boris.')
-  })
-})
-
-describe('writeCodexMcpConfig (token-free recipe — dummy bearer + env_http_headers identity)', () => {
-  test('adds [mcp_servers.iapeer] with url + approve + bearer_token_env_var + env_http_headers', () => {
-    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome-'))
-    try {
-      const env: NodeJS.ProcessEnv = { ...process.env, CODEX_HOME: codexHome }
-      const { path, added } = writeCodexMcpConfig('http://127.0.0.1:8765/mcp', { env })
-      expect(added).toBe(true)
-      expect(path).toBe(codexConfigPath({ env }))
-      const toml = readFileSync(path, 'utf8')
-      expect(toml).toContain('[mcp_servers.iapeer]')
-      expect(toml).toContain('url = "http://127.0.0.1:8765/mcp"')
-      expect(toml).toContain('default_tools_approval_mode = "approve"')
-      expect(toml).toContain(`bearer_token_env_var = "${CODEX_BEARER_ENV_VAR}"`)
-      expect(toml).toContain('[mcp_servers.iapeer.env_http_headers]')
-      expect(toml).toContain('"X-IAPeer-Identity" = "PEER_IDENTITY"')
-    } finally {
-      rmSync(codexHome, { recursive: true, force: true })
-    }
-  })
-  test('idempotent — re-run does NOT duplicate the block, and preserves other config', () => {
-    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome2-'))
-    try {
-      const env: NodeJS.ProcessEnv = { ...process.env, CODEX_HOME: codexHome }
-      writeFileSync(codexConfigPath({ env }), '[other]\nkeep = true\n')
-      expect(writeCodexMcpConfig('http://x/mcp', { env }).added).toBe(true)
-      expect(writeCodexMcpConfig('http://x/mcp', { env }).added).toBe(false) // idempotent
-      const toml = readFileSync(codexConfigPath({ env }), 'utf8')
-      expect((toml.match(/\[mcp_servers\.iapeer\]/g) ?? []).length).toBe(1) // no duplicate
-      expect(toml).toContain('[other]') // other config preserved
-      expect(toml).toContain('keep = true')
-    } finally {
-      rmSync(codexHome, { recursive: true, force: true })
-    }
-  })
-})
-
-describe('initPeer orchestration', () => {
-  test('codex peer: profile + registry + token-free codex config + doctrine', async () => {
-    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome3-'))
-    try {
-      const env = cleanEnv({ CODEX_HOME: codexHome })
-      const r = await initPeer({ cwd, runtime: 'codex', personality: 'cpeer', env })
-      expect(readPeerProfile(cwd)?.personality).toBe('cpeer')
-      expect(r.mcpConfigPaths.length).toBe(0) // no claude .mcp.json for a codex peer
-      expect(r.codexMcpConfigPath).toBe(codexConfigPath({ env }))
-      const toml = readFileSync(r.codexMcpConfigPath!, 'utf8')
-      expect(toml).toContain('[mcp_servers.iapeer]')
-      expect(toml).toContain(`bearer_token_env_var = "${CODEX_BEARER_ENV_VAR}"`) // token-free recipe wired
-    } finally {
-      rmSync(codexHome, { recursive: true, force: true })
-    }
-  })
-
-  test('claude peer: profile + registry + .mcp.json + doctrine, all wired', async () => {
-    const env = cleanEnv()
-    const r = await initPeer({ cwd, runtime: 'claude', personality: 'mypeer', env })
-    // identity + registry (via provision)
-    expect(readPeerProfile(cwd)?.personality).toBe('mypeer')
-    expect(readPeersIndex({ env }).peers.some(p => p.personality === 'mypeer')).toBe(true)
-    // .mcp.json wired to the daemon with the per-peer identity header
-    expect(r.mcpConfigPaths.length).toBe(1)
-    const mcp = JSON.parse(readFileSync(join(cwd, '.mcp.json'), 'utf8'))
-    expect(mcp.mcpServers.iapeer.headers['X-IAPeer-Identity']).toBe('${PEER_IDENTITY:-claude-mypeer}')
-    expect(mcp.mcpServers.iapeer.url).toBe('http://127.0.0.1:8765/mcp')
-    // doctrine template created
-    expect(r.doctrineCreated).toBe(true)
-    expect(existsSync(r.doctrinePath)).toBe(true)
-  })
-
-  test('idempotent — re-init does not throw and keeps an existing doctrine', async () => {
-    const env = cleanEnv()
-    await initPeer({ cwd, runtime: 'claude', personality: 'mypeer', env })
-    writeFileSync(join(cwd, '.iapeer', 'IAPEER.md'), 'custom doctrine')
-    const r2 = await initPeer({ cwd, runtime: 'claude', personality: 'mypeer', env })
-    expect(r2.doctrineCreated).toBe(false)
-    expect(readFileSync(join(cwd, '.iapeer', 'IAPEER.md'), 'utf8')).toBe('custom doctrine')
-  })
-})
-
-describe('ensureCodexUpdateCheckDisabled (boot-gate hygiene — incident 11.06 codex-linus)', () => {
-  test('PREPENDS the top-level key BEFORE the first [section] (TOML top-level scope)', () => {
-    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome3-'))
-    try {
-      const env: NodeJS.ProcessEnv = { ...process.env, CODEX_HOME: codexHome }
-      writeFileSync(codexConfigPath({ env }), 'model = "gpt-5.5"\n\n[projects."/x"]\ntrust_level = "trusted"\n')
-      const { changed } = ensureCodexUpdateCheckDisabled({ env })
-      expect(changed).toBe(true)
-      const toml = readFileSync(codexConfigPath({ env }), 'utf8')
-      expect(toml.startsWith('check_for_update_on_startup = false\n')).toBe(true)
-      expect(toml).toContain('[projects."/x"]') // existing config preserved
-      // idempotent: second run is a no-op
-      expect(ensureCodexUpdateCheckDisabled({ env }).changed).toBe(false)
-      expect((toml.match(/check_for_update_on_startup/g) ?? []).length).toBe(1)
-    } finally {
-      rmSync(codexHome, { recursive: true, force: true })
-    }
-  })
-  test('respects an EXPLICIT existing value (never overrides the operator)', () => {
-    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome4-'))
-    try {
-      const env: NodeJS.ProcessEnv = { ...process.env, CODEX_HOME: codexHome }
-      writeFileSync(codexConfigPath({ env }), 'check_for_update_on_startup = true\n')
-      expect(ensureCodexUpdateCheckDisabled({ env }).changed).toBe(false)
-      expect(readFileSync(codexConfigPath({ env }), 'utf8')).toContain('check_for_update_on_startup = true')
-    } finally {
-      rmSync(codexHome, { recursive: true, force: true })
-    }
-  })
-  test('absent config → created with just the key', () => {
-    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome5-'))
-    try {
-      const env: NodeJS.ProcessEnv = { ...process.env, CODEX_HOME: codexHome }
-      expect(ensureCodexUpdateCheckDisabled({ env }).changed).toBe(true)
-      expect(readFileSync(codexConfigPath({ env }), 'utf8')).toBe('check_for_update_on_startup = false\n')
-    } finally {
-      rmSync(codexHome, { recursive: true, force: true })
-    }
-  })
-})

package/src/init/runtime-resolve.test.ts

@@ -1,49 +0,0 @@
-// resolvePrimaryRuntime — the runtime-aware, CONSISTENT primary-runtime resolution
-// for init/create. Pure (filesystem markers only); no registry / launchd touched.
-
-import { afterEach, describe, expect, test } from 'bun:test'
-import { mkdirSync, mkdtempSync, rmSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import { resolvePrimaryRuntime } from './index.ts'
-
-const dirs: string[] = []
-function mkTmp(): string {
-  const d = mkdtempSync(join(tmpdir(), 'iapeer-rt-'))
-  dirs.push(d)
-  return d
-}
-afterEach(() => {
-  while (dirs.length) rmSync(dirs.pop()!, { recursive: true, force: true })
-})
-
-describe('resolvePrimaryRuntime', () => {
-  test('explicit runtime wins regardless of markers', () => {
-    const cwd = mkTmp()
-    mkdirSync(join(cwd, '.codex'))
-    expect(resolvePrimaryRuntime(cwd, 'telegram')).toBe('telegram')
-  })
-
-  test('no marker → claude (default)', () => {
-    expect(resolvePrimaryRuntime(mkTmp())).toBe('claude')
-  })
-
-  test('.codex-only folder → codex primary (was the inconsistency: defaulted to claude)', () => {
-    const cwd = mkTmp()
-    mkdirSync(join(cwd, '.codex'))
-    expect(resolvePrimaryRuntime(cwd)).toBe('codex')
-  })
-
-  test('.claude folder → claude', () => {
-    const cwd = mkTmp()
-    mkdirSync(join(cwd, '.claude'))
-    expect(resolvePrimaryRuntime(cwd)).toBe('claude')
-  })
-
-  test('both markers → claude primary (agentic default order)', () => {
-    const cwd = mkTmp()
-    mkdirSync(join(cwd, '.claude'))
-    mkdirSync(join(cwd, '.codex'))
-    expect(resolvePrimaryRuntime(cwd)).toBe('claude')
-  })
-})

package/src/install/install.test.ts

@@ -1,66 +0,0 @@
-// install — the stable binary path + (lightly) the build. iapeerBinPath is the
-// decoupling anchor: the launchd plists reference it, not process.execPath / a src
-// file. The full `bun build --compile` is exercised LIVE (it writes a ~60M binary —
-// too heavy for a unit test); here we pin the path resolution.
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import { iapeerBinPath, iapeerPrevBinPath, installIapeer, rollbackIapeer } from './index.ts'
-
-describe('iapeerBinPath', () => {
-  test('default = <home>/.local/bin/iapeer (stable host-wide path, on $PATH)', () => {
-    expect(iapeerBinPath({ HOME: '/Users/x' } as NodeJS.ProcessEnv)).toBe('/Users/x/.local/bin/iapeer')
-  })
-  test('IAPEER_BIN_DIR override (tests/sandbox — never a real ~/.local/bin)', () => {
-    expect(iapeerBinPath({ HOME: '/Users/x', IAPEER_BIN_DIR: '/tmp/sbx/bin' } as NodeJS.ProcessEnv)).toBe(
-      join('/tmp/sbx/bin', 'iapeer'),
-    )
-  })
-})
-
-// Audit #25 — fail-closed sandbox guard (symmetric to the registry's). installIapeer
-// overwrites the live prod binary ~/.local/bin/iapeer; a sandbox/test that forgets
-// IAPEER_BIN_DIR must be REFUSED, never clobber prod. The guard fires BEFORE the build,
-// so no `bun build --compile` runs here.
-describe('installIapeer fail-closed sandbox guard', () => {
-  test('THROWS under IAPEER_TEST_SANDBOX=1 when binPath falls through to the REAL ~/.local/bin/iapeer', () => {
-    const env = { IAPEER_TEST_SANDBOX: '1', HOME: '/Users/fake-home' } as NodeJS.ProcessEnv
-    expect(iapeerBinPath(env)).toBe('/Users/fake-home/.local/bin/iapeer')
-    expect(() => installIapeer('/x/entry.ts', env)).toThrow(/refusing to overwrite the REAL prod binary/)
-  })
-})
-
-describe('rollbackIapeer', () => {
-  let binDir: string
-  let env: NodeJS.ProcessEnv
-  beforeEach(() => {
-    binDir = mkdtempSync(join(tmpdir(), 'iapeer-rollback-'))
-    env = { IAPEER_TEST_SANDBOX: '1', HOME: '/Users/x', IAPEER_BIN_DIR: binDir } as NodeJS.ProcessEnv
-  })
-  afterEach(() => {
-    rmSync(binDir, { recursive: true, force: true })
-  })
-
-  test('no .prev → failed (nothing to roll back to), binary untouched', () => {
-    writeFileSync(iapeerBinPath(env), 'CURRENT')
-    const r = rollbackIapeer(env)
-    expect(r.status).toBe('failed')
-    expect(r.reason).toMatch(/nothing to roll back/i)
-    expect(readFileSync(iapeerBinPath(env), 'utf8')).toBe('CURRENT') // unchanged
-  })
-
-  test('restores the .prev bytes over the binary', () => {
-    writeFileSync(iapeerBinPath(env), 'NEW-BROKEN')
-    writeFileSync(iapeerPrevBinPath(env), 'OLD-GOOD')
-    const r = rollbackIapeer(env)
-    expect(r.status).toBe('rolled-back')
-    expect(readFileSync(iapeerBinPath(env), 'utf8')).toBe('OLD-GOOD')
-  })
-
-  test('fail-closed sandbox guard: refuses the REAL prod binary path', () => {
-    const realEnv = { IAPEER_TEST_SANDBOX: '1', HOME: '/Users/fake-home' } as NodeJS.ProcessEnv
-    expect(() => rollbackIapeer(realEnv)).toThrow(/refusing to overwrite the REAL prod binary/)
-  })
-})

package/src/install/signing.test.ts

@@ -1,84 +0,0 @@
-// signInstalledBinary — stable-identity re-sign so TCC grants survive updates
-// (Артур's DX requirement 10.06). DI-runner units; the real keychain flow was
-// proven live (/tmp experiment: two binaries, different CDHash, IDENTICAL
-// designated requirement `identifier "com.agfpd.iapeer" and certificate leaf`).
-// The sandbox guard double-checks process.env, so these tests inject a runner
-// AND call with the flag stripped via a direct env — guard tested separately.
-
-import { describe, expect, test } from 'bun:test'
-import { SIGNING_IDENTIFIER, SIGNING_IDENTITY_CN, signInstalledBinary, type SigningRunner } from './signing.ts'
-
-function harness(opts: { identityExists: boolean; failAt?: 'req' | 'pkcs12' | 'import' | 'codesign' }) {
-  const calls: { cmd: string; args: string[] }[] = []
-  const run: SigningRunner = (cmd, args) => {
-    calls.push({ cmd, args })
-    if (cmd === 'security' && args[0] === 'find-identity') {
-      return { status: 0, stdout: opts.identityExists ? `1) ABC "${SIGNING_IDENTITY_CN}" (CSSMERR_TP_NOT_TRUSTED)\n` : 'no identities\n', stderr: '' }
-    }
-    if (cmd.endsWith('openssl') && args[0] === 'req') return { status: opts.failAt === 'req' ? 1 : 0, stdout: '', stderr: 'req boom' }
-    if (cmd.endsWith('openssl') && args[0] === 'pkcs12') return { status: opts.failAt === 'pkcs12' ? 1 : 0, stdout: '', stderr: 'p12 boom' }
-    if (cmd === 'security' && args[0] === 'import') return { status: opts.failAt === 'import' ? 1 : 0, stdout: '', stderr: 'import boom' }
-    if (cmd === 'codesign') return { status: opts.failAt === 'codesign' ? 1 : 0, stdout: '', stderr: 'sign boom' }
-    return { status: 0, stdout: '', stderr: '' }
-  }
-  return { calls, run }
-}
-
-// NOTE: process.env.IAPEER_TEST_SANDBOX === '1' under `bun run test`, so the
-// guard SHORT-CIRCUITS every real call — these units therefore stub process.env
-// off for the duration of each call.
-function withSandboxOff<T>(fn: () => T): T {
-  const prev = process.env.IAPEER_TEST_SANDBOX
-  delete process.env.IAPEER_TEST_SANDBOX
-  try {
-    return fn()
-  } finally {
-    if (prev !== undefined) process.env.IAPEER_TEST_SANDBOX = prev
-  }
-}
-
-describe('signInstalledBinary (stable identity → TCC grants survive updates)', () => {
-  test('sandbox guard: never touches the keychain under IAPEER_TEST_SANDBOX', () => {
-    const h = harness({ identityExists: true })
-    const r = signInstalledBinary('/x/iapeer', { IAPEER_TEST_SANDBOX: '1' } as NodeJS.ProcessEnv, h.run)
-    expect(r.state).toBe('skipped-sandbox')
-    expect(h.calls.length).toBe(0)
-  })
-
-  test('existing identity → single codesign with the stable identifier', () => {
-    const h = harness({ identityExists: true })
-    const r = withSandboxOff(() => signInstalledBinary('/x/iapeer', {} as NodeJS.ProcessEnv, h.run))
-    expect(r.state).toBe('signed')
-    const sign = h.calls.find(c => c.cmd === 'codesign')!
-    expect(sign.args).toEqual(['-f', '-s', SIGNING_IDENTITY_CN, '--identifier', SIGNING_IDENTIFIER, '/x/iapeer'])
-    // identity lookup is NOT -v (an untrusted self-signed identity must be found)
-    const find = h.calls.find(c => c.args[0] === 'find-identity')!
-    expect(find.args).not.toContain('-v')
-  })
-
-  test('no identity → created once (openssl req → pkcs12 → import -T codesign), then signed', () => {
-    const h = harness({ identityExists: false })
-    const r = withSandboxOff(() => signInstalledBinary('/x/iapeer', {} as NodeJS.ProcessEnv, h.run))
-    expect(r.state).toBe('signed-new-identity')
-    const seq = h.calls.map(c => `${c.cmd.split('/').pop()}:${c.args[0]}`)
-    expect(seq).toEqual(['security:find-identity', 'openssl:req', 'openssl:pkcs12', 'security:import', 'codesign:-f'])
-    const imp = h.calls.find(c => c.args[0] === 'import')!
-    expect(imp.args).toContain('-T') // codesign pre-authorized in the key ACL
-    expect(imp.args).toContain('/usr/bin/codesign')
-  })
-
-  test('identity-creation failure → failed-soft with the loud TCC consequence, codesign never attempted', () => {
-    const h = harness({ identityExists: false, failAt: 'import' })
-    const r = withSandboxOff(() => signInstalledBinary('/x/iapeer', {} as NodeJS.ProcessEnv, h.run))
-    expect(r.state).toBe('failed-soft')
-    expect(r.detail).toContain('TCC prompts will re-appear')
-    expect(h.calls.some(c => c.cmd === 'codesign')).toBe(false)
-  })
-
-  test('codesign failure → failed-soft (install never breaks on a signing hiccup)', () => {
-    const h = harness({ identityExists: true, failAt: 'codesign' })
-    const r = withSandboxOff(() => signInstalledBinary('/x/iapeer', {} as NodeJS.ProcessEnv, h.run))
-    expect(r.state).toBe('failed-soft')
-    expect(r.detail).toContain('sign boom')
-  })
-})

package/src/launch/bootdeliver.test.ts

@@ -1,108 +0,0 @@
-// Ф-#8b: cold-wake boot first-message delivery via load-buffer + bracketed
-// paste-buffer — the SAME byte-path as warm delivery (transport.deliverViaTmux),
-// replacing the old `send-keys -l` retype. Proven hermetically against a REAL
-// tmux (gated like sockdir.test.ts) with a fake tui adapter whose "runtime" is
-// `cat >> <file>`: whatever the boot path injects into the pane lands verbatim in
-// the file, and the ready-gate keys on that file's mtime (the activity proxy).
-//
-// pty note: `cat` reads the pane pty in CANONICAL mode (line-buffered, ~1 KiB
-// line cap on macOS) — real TUIs run raw and have no such cap. The fixture
-// message therefore uses many sub-1-KiB LINES to total multi-KiB; what this test
-// pins is the INJECTION path (one bracketed paste, no option-parsing traps, no
-// key-by-key retype), not the tty discipline.
-
-import { afterEach, describe, expect, test } from 'bun:test'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import { spawnSync } from 'child_process'
-import { launch } from './index.ts'
-import type { LaunchConfig, LaunchSpec, RuntimeAdapter } from './types.ts'
-
-const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0
-
-const dirs: string[] = []
-function mkTmp(): string {
-  const d = mkdtempSync(join(tmpdir(), 'iapeer-bootdeliver-'))
-  dirs.push(d)
-  return d
-}
-afterEach(() => {
-  while (dirs.length) rmSync(dirs.pop()!, { recursive: true, force: true })
-})
-
-/** Fake tui adapter: the "runtime" appends its pty input to `recvPath`; the
- *  activity proxy is that file's mtime (absent → null, exactly like a missing
- *  transcript), so the boot baseline is 0 and the ready-gate flips on receipt. */
-function catAdapter(recvPath: string): RuntimeAdapter {
-  return {
-    runtime: 'claude', // any tui Runtime — the adapter object itself is what launch consumes
-    kind: 'tui',
-    usesDoctrine: false,
-    deliveryMarkers: { promptGlyphs: [] },
-    buildArgv: () => ['/bin/sh', '-c', `cat >> ${recvPath}`],
-    bootDialogKeys: () => null,
-    isInputReady: () => true,
-    newestActivityMtime: () => {
-      try {
-        return statSync(recvPath).mtimeMs
-      } catch {
-        return null
-      }
-    },
-    resolveResume: () => ({ ok: true }),
-    executeControl: () => null,
-  }
-}
-
-describe('boot first-message delivery (load-buffer + bracketed paste)', () => {
-  test.if(tmuxAvailable)(
-    'a multi-line, dash-leading, multi-KiB first message lands INTACT and launch goes READY',
-    async () => {
-      const root = mkTmp()
-      const recv = join(root, 'received.txt')
-      const sock = join(root, 'tmux-iap-claude-bootd.sock')
-      // The fixture stresses every historical boot-inject trap at once:
-      //   • leading '-'  — the send-keys option-parsing trap (audit #6);
-      //   • quotes/$()/; — shell-metachar corruption if anything re-quoted the body;
-      //   • multi-KiB    — a size send-keys -l replayed key-by-key (8 × ~700 B lines).
-      const firstMessage = [
-        '- dash-leading first line (the send-keys option-parsing trap)',
-        `quotes "double" 'single' and $dollar \`backtick\` ; semicolon`,
-        ...Array.from({ length: 8 }, (_, i) => `${i}:${'x'.repeat(700)}`),
-      ].join('\n')
-      const spec: LaunchSpec = {
-        personality: 'bootd',
-        runtime: 'claude',
-        cwd: root,
-        identity: 'claude-bootd',
-        socketPath: sock,
-        intelligence: 'artificial',
-      }
-      const cfg: LaunchConfig = {
-        claudeBin: 'unused',
-        codexBin: 'unused',
-        sockDir: root,
-        bootDeadlineSecs: 10,
-        readyGateSecs: 8,
-        logDir: join(root, 'logs'),
-      }
-      // pty-supervisor hosting is the DEFAULT now; this fixture exercises the legacy TMUX boot/delivery
-      // path (load-buffer + bracketed paste) explicitly, so opt this peer OUT of pty with a .no-pty-host
-      // marker (otherwise launch hosts it under the supervisor and the tmux-path assertions never apply).
-      mkdirSync(cfg.logDir, { recursive: true })
-      writeFileSync(join(cfg.logDir, `${spec.identity}.no-pty-host`), '')
-      try {
-        const r = await launch(spec, catAdapter(recv), firstMessage, cfg)
-        expect(r.status).toBe('READY')
-        const got = readFileSync(recv, 'utf8')
-        expect(got).toContain('- dash-leading first line (the send-keys option-parsing trap)')
-        expect(got).toContain(`quotes "double" 'single' and $dollar \`backtick\` ; semicolon`)
-        for (let i = 0; i < 8; i++) expect(got).toContain(`${i}:${'x'.repeat(700)}`)
-      } finally {
-        spawnSync('tmux', ['-S', sock, 'kill-server'], { stdio: 'ignore' })
-      }
-    },
-    60000,
-  )
-})

package/src/launch/bootstrap.test.ts

@@ -1,56 +0,0 @@
-// launchctlBootstrap — the AUTO-load primitive guards. The happy `loaded` path is
-// proven LIVE (it calls real launchctl); the unit tests cover the three guards that
-// must hold WITHOUT touching launchd: foreign-plist refusal, sandbox skip, and the
-// foundation-owned gate. (The test script sets IAPEER_TEST_SANDBOX=1, so the skip
-// branch is the default; the foreign-refusal branch is checked first regardless.)
-
-import { afterEach, describe, expect, test } from 'bun:test'
-import { mkdtempSync, rmSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import { launchctlBootstrap, installAlwaysOnPlist } from './index.ts'
-
-const dirs: string[] = []
-function mkTmp(): string {
-  const d = mkdtempSync(join(tmpdir(), 'iapeer-boot-'))
-  dirs.push(d)
-  return d
-}
-afterEach(() => {
-  while (dirs.length) rmSync(dirs.pop()!, { recursive: true, force: true })
-})
-
-describe('launchctlBootstrap guards', () => {
-  test('refuses a NON-foundation plist (no ownership sentinel) — fleet guard, checked first', () => {
-    const dir = mkTmp()
-    const foreign = join(dir, 'com.iapeer.boris.plist')
-    writeFileSync(foreign, '<?xml version="1.0"?><plist><dict></dict></plist>')
-    // refused-foreign wins even with IAPEER_TEST_SANDBOX=1 (the guard is checked before sandbox)
-    const r = launchctlBootstrap('boris', foreign, { IAPEER_TEST_SANDBOX: '1' } as NodeJS.ProcessEnv)
-    expect(r.state).toBe('refused-foreign')
-    expect(r.label).toBe('com.iapeer.boris')
-  })
-
-  test('a foundation-owned plist under IAPEER_TEST_SANDBOX=1 → skipped-sandbox (no launchctl)', () => {
-    const root = mkTmp()
-    const bindir = mkTmp()
-    const bin = join(bindir, 'notifier-runtime')
-    writeFileSync(bin, '#!/bin/sh\nexec sleep 1\n', { mode: 0o755 })
-    const env = {
-      IAPEER_LAUNCHAGENTS_DIR: join(root, 'LA'),
-      HOME: root,
-      PATH: bindir,
-      IAPEER_TEST_SANDBOX: '1',
-    } as NodeJS.ProcessEnv
-    const cwd = join(root, 'timer')
-    const plist = installAlwaysOnPlist({ personality: 'timer', runtime: 'notifier', cwd, runtimeBin: bin, env })
-    const r = launchctlBootstrap('timer', plist, env)
-    expect(r.state).toBe('skipped-sandbox')
-    expect(r.label).toBe('com.iapeer.timer')
-  })
-
-  test('absent/unreadable plist → refused-foreign (not provably ours)', () => {
-    const r = launchctlBootstrap('ghost', join(mkTmp(), 'nope.plist'), { IAPEER_TEST_SANDBOX: '1' } as NodeJS.ProcessEnv)
-    expect(r.state).toBe('refused-foreign')
-  })
-})