@akira-tl/forgerelay 0.8.8 → 0.8.10

package/scripts/debug/accept.mjs

@@ -1,396 +1,56 @@
 import assert from "node:assert/strict";
-import { spawn, spawnSync } from "node:child_process";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { once } from "node:events";
-import { connect } from "node:net";
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
-import {
-  createDebugEnvironment,
-  debugBaseUrl,
-  debugMcpUrl,
-  debugRoot,
-  repoRoot,
-} from "./runtime.mjs";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { debugMcpUrl } from "./runtime.mjs";
 import {
   assertCodeIntelligenceShutdown as assertCodeIntelligenceAcceptanceShutdown,
   exerciseCodeIntelligence as exerciseCodeIntelligenceAcceptance,
-  setupCodeIntelligenceProject as setupCodeIntelligenceAcceptanceProject,
 } from "./code-intelligence-accept.mjs";
-
-const packageJson = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8"));
-const acceptanceRoot = resolve(debugRoot, "acceptance");
-const stateDir = resolve(acceptanceRoot, "state");
-const worktreeRoot = resolve(acceptanceRoot, "worktrees");
-const hookLog = resolve(acceptanceRoot, "hooks.jsonl");
-const checkoutWorkspace = resolve(acceptanceRoot, "workspace");
-const lifecycleDeleteWorkspace = resolve(acceptanceRoot, "delete-workspace");
-const codeIntelligenceLog = resolve(acceptanceRoot, "code-intelligence-lsp.jsonl");
-const fakeLanguageServer = resolve(repoRoot, "src", "lsp", "test-fixtures", "fake-lsp-server.mjs");
-const gitProject = resolve(acceptanceRoot, "git-project");
-const releaseProject = resolve(acceptanceRoot, "release-project");
-const releaseRemote = resolve(acceptanceRoot, "release-remote.git");
-const ownerToken = randomBytes(32).toString("base64url");
-const tempAcceptanceRoot = resolve(tmpdir(), `forgerelay-debug-acceptance-${randomUUID()}`);
-
-assertCurlAvailable();
-await assertDebugPortFree();
-rmSync(acceptanceRoot, { recursive: true, force: true });
-mkdirSync(acceptanceRoot, { recursive: true });
-setupGitProject(checkoutWorkspace);
-setupGitProject(lifecycleDeleteWorkspace);
-writeFileSync(join(lifecycleDeleteWorkspace, "keep.txt"), "keep checkout files\n");
-writeFileSync(
-  join(lifecycleDeleteWorkspace, "AGENTS.md"),
-  "INSPECTION_ACCEPTANCE_BOOTSTRAP_SECRET\n",
-);
-setupCodeIntelligenceAcceptanceProject({
-  root: checkoutWorkspace,
-  fakeLanguageServer,
-  logPath: codeIntelligenceLog,
-});
-
-const { env } = createDebugEnvironment({
-  ownerToken,
+import { createAcceptanceHarness } from "./accept/harness.mjs";
+import { runBootstrapAcceptance } from "./accept/bootstrap.mjs";
+import {
+  callTool,
+  curlRequest,
+  exerciseReleaseTagHooks,
+  exerciseSubagentHooks,
+  mcpHeaders,
+  pass,
+  readHookEntries,
+  setupGitProject,
+  stopServer,
+  toolText,
+} from "./accept/support.mjs";
+
+const {
+  packageJson,
+  acceptanceRoot,
   stateDir,
-  worktreeRoot,
   hookLog,
-  widgets: "changes",
-});
-env.FORGERELAY_ARTIFACTS = "1";
-const doctor = spawnSync(process.execPath, ["--import", "tsx", "src/cli.ts", "doctor"], {
-  cwd: repoRoot,
-  env,
-  encoding: "utf8",
-});
-assert.equal(doctor.status, 0, doctor.stderr);
-assert.match(doctor.stdout, /Public base URL: http:\/\/127\.0\.0\.1:7677/);
-assert.match(doctor.stdout, /Tool mode: full/);
-assert.match(doctor.stdout, /Widgets: changes/);
-assert.match(doctor.stdout, /Trust proxy: off/);
-pass("doctor resolved MCP shape", "public URL + tool/widgets/proxy state");
-
-const server = spawn(process.execPath, ["--import", "tsx", "src/cli.ts", "serve"], {
-  cwd: repoRoot,
+  checkoutWorkspace,
+  lifecycleDeleteWorkspace,
+  codeIntelligenceLog,
+  gitProject,
+  releaseProject,
+  releaseRemote,
+  ownerToken,
+  tempAcceptanceRoot,
   env,
-  stdio: ["ignore", "inherit", "inherit"],
-});
+  server,
+} = await createAcceptanceHarness();
 let acceptanceCompleted = false;
 
 try {
-  const health = await waitForHealth(server);
-  assert.deepEqual(health, { ok: true, name: "forgerelay" });
-  pass("health", JSON.stringify(health));
-
-  const protectedResource = jsonRequest(`${debugBaseUrl}/.well-known/oauth-protected-resource/mcp`);
-  assert.equal(protectedResource.status, 200);
-  assert.equal(protectedResource.json.resource, debugMcpUrl);
-  assert.equal(protectedResource.json.resource_name, "ForgeRelay");
-  pass("OAuth protected-resource discovery", protectedResource.json.resource);
-
-  const authorizationServer = jsonRequest(`${debugBaseUrl}/.well-known/oauth-authorization-server`);
-  assert.equal(authorizationServer.status, 200);
-  assert.equal(authorizationServer.json.authorization_endpoint, `${debugBaseUrl}/authorize`);
-  assert.equal(authorizationServer.json.token_endpoint, `${debugBaseUrl}/token`);
-  assert.equal(authorizationServer.json.registration_endpoint, `${debugBaseUrl}/register`);
-  pass("OAuth authorization-server discovery", authorizationServer.json.token_endpoint);
-
-  const unauthorized = curlRequest({
-    method: "POST",
-    url: debugMcpUrl,
-    headers: mcpHeaders(),
-    body: JSON.stringify(initializeRequest(1)),
-  });
-  assert.equal(unauthorized.status, 401);
-  assert.equal(JSON.parse(unauthorized.body).error, "invalid_token");
-  pass("unauthorized MCP is rejected", "HTTP 401 invalid_token");
-
-  const oauth = authorizeDebugClient(authorizationServer.json);
-  pass("OAuth owner-password flow", "registered client and issued access token");
-
-  const initialized = mcpRequest(oauth.accessToken, undefined, initializeRequest(1));
-  assert.equal(initialized.response.status, 200);
-  const sessionId = initialized.response.headers.get("mcp-session-id");
-  assert.ok(sessionId);
-  assert.equal(initialized.message.result.serverInfo.name, "forgerelay");
-  assert.equal(initialized.message.result.serverInfo.title, "ForgeRelay");
-  assert.equal(initialized.message.result.serverInfo.version, packageJson.version);
-  const serverInstructions = initialized.message.result.instructions ?? "";
-  assert.match(serverInstructions, /Shell commands may modify ordinary project files/);
-  assert.match(serverInstructions, /\/etc\/sudoers/);
-  assert.match(serverInstructions, /configuration files through shell only when the user's request explicitly calls for that configuration change/);
-  assert.match(serverInstructions, /Project-work order: open_workspace if needed → activity_panel\(workspaceId\) once → work tools/);
-  assert.ok(serverInstructions.length < 3_000, `server instructions should stay compact, got ${serverInstructions.length} characters`);
-  assert.doesNotMatch(serverInstructions, /fast-forwards the original target branch/);
-  assert.doesNotMatch(serverInstructions, /Do not create or modify files with bash/);
-  pass(
-    "MCP initialize",
-    JSON.stringify(initialized.message.result.serverInfo),
-  );
-
-  const initializedNotification = curlRequest({
-    method: "POST",
-    url: debugMcpUrl,
-    headers: mcpHeaders(oauth.accessToken, sessionId),
-    body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
-  });
-  assert.equal(initializedNotification.status, 202);
-
-  const tools = mcpRequest(oauth.accessToken, sessionId, {
-    jsonrpc: "2.0",
-    id: 2,
-    method: "tools/list",
-    params: {},
-  }).message.result.tools;
-  const toolNames = tools.map((tool) => tool.name);
-  assert.deepEqual(toolNames, [
-    "open_workspace",
-    "activity_panel",
-    "activity_snapshot",
-    "activity_index",
-    "activity_detail",
-    "activity_output",
-    "capability",
-    "close_workspace",
-    "read",
-    "write",
-    "edit",
-    "rename",
-    "delete",
-    "bash",
-  ]);
-  const bashTool = tools.find((tool) => tool.name === "bash");
-  assert.match(bashTool?.description ?? "", /local user's authority/);
-  assert.doesNotMatch(bashTool?.description ?? "", /may modify ordinary project files/);
-  assert.doesNotMatch(bashTool?.description ?? "", /\/etc\/sudoers/);
-  assert.doesNotMatch(bashTool?.description ?? "", /external device or hardware mutations/);
-  assert.doesNotMatch(bashTool?.description ?? "", /Do not use bash to create, move, rename, or delete project files/);
-  assert.equal(bashTool?.inputSchema?.properties?.timeout, undefined);
-  assert.match(bashTool?.description ?? "", /action=process/);
-  assert.equal(bashTool?.inputSchema?.properties?.yieldTimeMs?.maximum, 300000);
-  assert.equal(bashTool?.inputSchema?.properties?.timeoutMs?.maximum, 86400000);
-  assert.match(bashTool?.inputSchema?.properties?.processId?.description ?? "", /action=process/);
-  assert.match(bashTool?.inputSchema?.properties?.interrupt?.description ?? "", /SIGINT/);
-  const openWorkspaceTool = tools.find((tool) => tool.name === "open_workspace");
-  assert.ok(openWorkspaceTool?.inputSchema?.properties?.workspaceId);
-  assert.ok(openWorkspaceTool?.inputSchema?.properties?.newWorkspace);
-  assert.ok(openWorkspaceTool?.outputSchema?.properties?.staleWorkspaces);
-  assert.ok(openWorkspaceTool?.outputSchema?.properties?.capabilityFingerprint);
-  assert.ok(openWorkspaceTool?.outputSchema?.properties?.capabilityCatalog);
-  assert.ok(openWorkspaceTool?.outputSchema?.properties?.capabilityGuides);
-  const capabilityTool = tools.find((tool) => tool.name === "capability");
-  assert.deepEqual(capabilityTool?._meta?.["openai/fileParams"], ["file"]);
-  const activityPanelTool = tools.find((tool) => tool.name === "activity_panel");
-  const activityTemplateUri = activityPanelTool?._meta?.ui?.resourceUri;
-  assert.match(
-    activityTemplateUri ?? "",
-    /^ui:\/\/forgerelay\/activity-panel-app-[0-9a-f]{12}\.html$/,
-  );
-  assert.deepEqual(activityPanelTool?._meta?.ui?.visibility, ["model", "app"]);
-  pass("MCP tools/list", `${toolNames.length} tools: ${toolNames.join(", ")}`);
-
-  const resources = mcpRequest(oauth.accessToken, sessionId, {
-    jsonrpc: "2.0",
-    id: 21,
-    method: "resources/list",
-    params: {},
-  }).message.result.resources;
-  const currentActivityResource = resources.find((resource) => resource.uri === activityTemplateUri);
-  assert.ok(currentActivityResource);
-  assert.equal(currentActivityResource._meta?.ui?.domain, debugBaseUrl);
-  assert.equal(
-    resources.some((resource) => /^ui:\/\/forgerelay\/workspace-lifecycle-app-/.test(resource.uri)),
-    false,
-  );
-  assert.ok(resources.some((resource) => resource.uri === "ui://forgerelay/workspace-app.html"));
-
-  const resourceTemplates = mcpRequest(oauth.accessToken, sessionId, {
-    jsonrpc: "2.0",
-    id: 22,
-    method: "resources/templates/list",
-    params: {},
-  }).message.result.resourceTemplates;
-  assert.ok(resourceTemplates.some(
-    (resourceTemplate) => resourceTemplate.uriTemplate === "ui://forgerelay/workspace-lifecycle-app-{revision}.html",
-  ));
-  assert.ok(resourceTemplates.some(
-    (resourceTemplate) => resourceTemplate.uriTemplate === "ui://forgerelay/activity-panel-app-{revision}.html",
-  ));
-
-  const readTemplate = (id, uri) => mcpRequest(oauth.accessToken, sessionId, {
-    jsonrpc: "2.0",
-    id,
-    method: "resources/read",
-    params: { uri },
-  }).message.result.contents[0];
-
-  const activityTemplate = readTemplate(24, activityTemplateUri);
-  assert.equal(activityTemplate.uri, activityTemplateUri);
-  assert.equal(activityTemplate.mimeType, "text/html;profile=mcp-app");
-  assert.match(activityTemplate.text ?? "", /activity-panel-app-[^\"]+\.js/);
-  assert.equal(activityTemplate._meta?.ui?.domain, debugBaseUrl);
-  assert.ok(activityTemplate._meta?.ui?.csp?.resourceDomains?.includes(debugBaseUrl));
-  const scriptUrl = activityTemplate.text?.match(/<script type="module" crossorigin src="([^"]+)"/)?.[1];
-  assert.ok(scriptUrl);
-  const scriptAsset = curlRequest({ method: "GET", url: scriptUrl });
-  assert.equal(scriptAsset.status, 200, scriptAsset.body);
-
-  const legacyTemplate = readTemplate(25, "ui://forgerelay/workspace-app.html");
-  assert.equal(legacyTemplate.uri, "ui://forgerelay/workspace-app.html");
-  assert.equal(legacyTemplate.mimeType, "text/html;profile=mcp-app");
-  pass("MCP app templates", `${activityTemplateUri} + historical compatibility templates`);
-
-  const workspaceConversationMeta = { "openai/session": "acceptance-workspace" };
-  const opened = callTool(oauth.accessToken, sessionId, 3, "open_workspace", {
-    path: checkoutWorkspace,
-  }, workspaceConversationMeta);
-  const workspaceId = opened.structuredContent.workspaceId;
-  assert.match(workspaceId, /^ws_/);
-  assert.equal(opened.structuredContent.action, "open");
-  assert.equal(opened.structuredContent.root, checkoutWorkspace);
-  assert.equal(opened.structuredContent.mode, "checkout");
-  assert.equal(typeof opened.structuredContent.contextFingerprint, "string");
-  assert.deepEqual(opened.structuredContent.capabilityFingerprint, {
-    version: packageJson.version,
-    toolMode: "full",
-    capabilities: [
-      "workspace.close",
-      "worktree.managed",
-      "filesystem.rename-move",
-      "filesystem.delete",
-      "process.lifecycle",
-      "hooks.lifecycle",
-      "capability-guides.read",
-      "code.intelligence",
-      "workspace.tasks",
-      "batch.execute",
-      ...(process.platform === "linux" ? ["artifact.native-download"] : []),
-      "ui.mcp-app",
-      "review.changes",
-    ],
-  });
-  const capabilityCatalog = opened.structuredContent.capabilityCatalog;
-  assert.deepEqual(capabilityCatalog.map((entry) => entry.name), [
-    "hooks.check",
-    "review.changes",
-    "code.intelligence",
-    "workspace.tasks",
-    "batch.execute",
-    ...(process.platform === "linux" ? ["artifact.download"] : []),
-  ]);
-  assert.equal(capabilityCatalog[0].available, true);
-  assert.equal(capabilityCatalog[0].guide.name, "lifecycle-hooks");
-
-  const checkoutTaskStatePath = join(stateDir, "workspaces", workspaceId, "tasks.json");
-  assert.ok(existsSync(checkoutTaskStatePath));
-  const checkoutTaskList = callTool(oauth.accessToken, sessionId, 130, "capability", {
-    workspaceId,
-    name: "workspace.tasks",
-    action: "run",
-    arguments: { operation: "list.create", name: "7677 release tasks" },
-  });
-  assert.equal(checkoutTaskList.isError, undefined);
-  const checkoutListId = checkoutTaskList.structuredContent.result.lists[0].id;
-  const checkoutTask = callTool(oauth.accessToken, sessionId, 131, "capability", {
-    workspaceId,
-    name: "workspace.tasks",
-    action: "run",
-    arguments: {
-      operation: "task.create",
-      listId: checkoutListId,
-      subject: "Verify v0.8.3 Task persistence",
-      content: "created through real MCP",
-      status: "in_progress",
-    },
-  });
-  assert.equal(checkoutTask.isError, undefined);
-  const checkoutTaskId = checkoutTask.structuredContent.result.lists[0].tasks[0].id;
-  const taskFingerprintBeforeExternal = checkoutTask.structuredContent.result.fingerprint;
-  const externalTaskState = JSON.parse(readFileSync(checkoutTaskStatePath, "utf8"));
-  externalTaskState.lists[0].tasks[0].content = "reloaded external task edit";
-  writeFileSync(checkoutTaskStatePath, `${JSON.stringify(externalTaskState, null, 2)}\n`);
-  const reloadedCheckoutTasks = callTool(oauth.accessToken, sessionId, 132, "capability", {
-    workspaceId,
-    name: "workspace.tasks",
-    action: "run",
-    arguments: {
-      operation: "get",
-      level: "detail",
-      listId: checkoutListId,
-      taskId: checkoutTaskId,
-    },
-  });
-  assert.equal(reloadedCheckoutTasks.isError, undefined);
-  assert.equal(reloadedCheckoutTasks.structuredContent.result.task.id, checkoutTaskId);
-  assert.equal(reloadedCheckoutTasks.structuredContent.result.task.content, "reloaded external task edit");
-  assert.notEqual(reloadedCheckoutTasks.structuredContent.result.fingerprint, taskFingerprintBeforeExternal);
-
-  const checkoutTaskSummary = callTool(oauth.accessToken, sessionId, 150, "capability", {
-    workspaceId,
-    name: "workspace.tasks",
-    action: "run",
-    arguments: { operation: "get" },
-  });
-  const summaryProjection = checkoutTaskSummary.structuredContent.result;
-  assert.equal(summaryProjection.level, "summary");
-  assert.equal(summaryProjection.lists[0].id, checkoutListId);
-  assert.equal(summaryProjection.lists[0].taskCount, 1);
-  assert.equal(summaryProjection.lists[0].unfinishedTaskCount, 1);
-  assert.equal(JSON.stringify(summaryProjection).includes(checkoutTaskId), false);
-  assert.equal(JSON.stringify(summaryProjection).includes("reloaded external task edit"), false);
-
-  const checkoutTaskHeaders = callTool(oauth.accessToken, sessionId, 151, "capability", {
-    workspaceId,
-    name: "workspace.tasks",
-    action: "run",
-    arguments: { operation: "get", level: "headers", listId: checkoutListId },
-  });
-  const headersProjection = checkoutTaskHeaders.structuredContent.result;
-  assert.equal(headersProjection.level, "headers");
-  assert.equal(headersProjection.lists.length, 1);
-  assert.equal(headersProjection.lists[0].tasks[0].id, checkoutTaskId);
-  assert.equal(headersProjection.lists[0].tasks[0].subject, "Verify v0.8.3 Task persistence");
-  assert.equal("content" in headersProjection.lists[0].tasks[0], false);
-
-  const checkoutTaskDetail = callTool(oauth.accessToken, sessionId, 152, "capability", {
-    workspaceId,
-    name: "workspace.tasks",
-    action: "run",
-    arguments: {
-      operation: "get",
-      level: "detail",
-      listId: checkoutListId,
-      taskId: checkoutTaskId,
-    },
-  });
-  const detailProjection = checkoutTaskDetail.structuredContent.result;
-  assert.equal(detailProjection.level, "detail");
-  assert.equal(detailProjection.task.id, checkoutTaskId);
-  assert.equal(detailProjection.task.content, "reloaded external task edit");
-  pass("workspace.tasks progressive disclosure", "summary -> headers -> one Task detail through real MCP");
-
-  for (let index = 0; index < 29; index += 1) {
-    const semanticWork = callTool(oauth.accessToken, sessionId, 160 + index, "read", {
-      workspaceId,
-      path: "README.md",
-    });
-    assert.doesNotMatch(toolText(semanticWork), /Reminder: this Workspace has unfinished active Tasks/);
-  }
-  const reminderWork = callTool(oauth.accessToken, sessionId, 189, "read", {
+  const {
+    oauth,
+    sessionId,
+    workspaceConversationMeta,
+    opened,
     workspaceId,
-    path: "README.md",
-  });
-  assert.match(toolText(reminderWork), /Reminder: this Workspace has unfinished active Tasks/);
-  assert.equal(toolText(reminderWork).includes("reloaded external task edit"), false);
-  pass("workspace.tasks reminder", "default 30 semantic work calls emitted one body-free reminder");
+    capabilityCatalog,
+    checkoutListId,
+    checkoutTaskId,
+  } = await runBootstrapAcceptance({ server, packageJson, ownerToken, checkoutWorkspace, stateDir });
 
   const repeatedOpen = callTool(oauth.accessToken, sessionId, 84, "open_workspace", {
     path: checkoutWorkspace,
@@ -1068,8 +728,8 @@ try {
     `${compositeWorkspaceId} close -> closed/non-routable -> same-id reopen -> delete; member Workspace preserved`,
   );
 
-  exerciseReleaseTagHooks(oauth.accessToken, sessionId);
-  exerciseSubagentHooks(env, stateDir, workspaceId, checkoutWorkspace);
+  exerciseReleaseTagHooks(oauth.accessToken, sessionId, { acceptanceRoot, releaseProject, releaseRemote });
+  exerciseSubagentHooks(env, stateDir, workspaceId, checkoutWorkspace, acceptanceRoot);
 
   const hookEntries = readHookEntries(hookLog);
   const hookEvents = hookEntries.map((entry) => entry.event);
@@ -1112,426 +772,3 @@ if (acceptanceCompleted) {
   console.log("\nForgeRelay 7677 acceptance passed.");
   console.log(`Artifacts: ${acceptanceRoot}`);
 }
-
-function authorizeDebugClient(metadata) {
-  const redirectUri = `${debugBaseUrl}/debug/callback`;
-  const registration = jsonRequest(metadata.registration_endpoint, {
-    method: "POST",
-    body: JSON.stringify({
-      client_name: "ForgeRelay 7677 acceptance",
-      redirect_uris: [redirectUri],
-      token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-    }),
-    headers: { "content-type": "application/json" },
-  });
-  assert.equal(registration.status, 201);
-
-  const verifier = randomBytes(32).toString("base64url");
-  const challenge = createHash("sha256").update(verifier).digest("base64url");
-  const authorizationBody = new URLSearchParams({
-    response_type: "code",
-    client_id: registration.json.client_id,
-    redirect_uri: redirectUri,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    scope: "devspace",
-    resource: debugMcpUrl,
-    state: "forgerelay-debug-acceptance",
-    owner_token: ownerToken,
-  }).toString();
-  const authorization = curlRequest({
-    method: "POST",
-    url: metadata.authorization_endpoint,
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: authorizationBody,
-  });
-  assert.equal(authorization.status, 302);
-  const redirect = new URL(authorization.headers.get("location"));
-  assert.equal(redirect.origin + redirect.pathname, redirectUri);
-  assert.equal(redirect.searchParams.get("state"), "forgerelay-debug-acceptance");
-  const code = redirect.searchParams.get("code");
-  assert.ok(code);
-
-  const token = jsonRequest(metadata.token_endpoint, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: registration.json.client_id,
-      code,
-      redirect_uri: redirectUri,
-      code_verifier: verifier,
-      resource: debugMcpUrl,
-    }).toString(),
-  });
-  assert.equal(token.status, 200);
-  assert.equal(token.json.token_type, "bearer");
-  assert.equal(token.json.scope, "devspace");
-  assert.ok(token.json.access_token);
-  return { accessToken: token.json.access_token };
-}
-
-function initializeRequest(id) {
-  return {
-    jsonrpc: "2.0",
-    id,
-    method: "initialize",
-    params: {
-      protocolVersion: "2025-06-18",
-      capabilities: {
-        extensions: {
-          "io.modelcontextprotocol/ui": {
-            mimeTypes: ["text/html;profile=mcp-app"],
-          },
-        },
-      },
-      clientInfo: { name: "forgerelay-debug-acceptance", version: "1.0.0" },
-    },
-  };
-}
-
-function mcpRequest(accessToken, sessionId, request) {
-  const response = curlRequest({
-    method: "POST",
-    url: debugMcpUrl,
-    headers: mcpHeaders(accessToken, sessionId),
-    body: JSON.stringify(request),
-  });
-  assert.equal(response.status, 200, response.body);
-  return { response, message: parseMcpMessage(response.body, request.id) };
-}
-
-function callTool(accessToken, sessionId, id, name, args, meta) {
-  const message = mcpRequest(accessToken, sessionId, {
-    jsonrpc: "2.0",
-    id,
-    method: "tools/call",
-    params: {
-      name,
-      arguments: args,
-      ...(meta ? { _meta: meta } : {}),
-    },
-  }).message;
-  assert.equal(message.id, id);
-  assert.ok(message.result, `tool ${name} did not return a result`);
-  return message.result;
-}
-
-function mcpHeaders(accessToken, sessionId) {
-  return {
-    ...(accessToken ? { authorization: `Bearer ${accessToken}` } : {}),
-    ...(sessionId ? { "mcp-session-id": sessionId } : {}),
-    "content-type": "application/json",
-    accept: "application/json, text/event-stream",
-  };
-}
-
-function parseMcpMessage(body, expectedId) {
-  const dataLines = body
-    .split(/\r?\n/)
-    .filter((line) => line.startsWith("data:"))
-    .map((line) => line.slice(5).trim())
-    .filter(Boolean);
-  const messages = dataLines.length > 0
-    ? dataLines.map((line) => JSON.parse(line))
-    : [JSON.parse(body)];
-  return messages.find((message) => message.id === expectedId) ?? messages[0];
-}
-
-function jsonRequest(url, options = {}) {
-  const response = curlRequest({
-    method: options.method ?? "GET",
-    url,
-    headers: options.headers,
-    body: options.body,
-  });
-  return { ...response, json: JSON.parse(response.body) };
-}
-
-function curlRequest({ method = "GET", url, headers = {}, body }) {
-  const marker = `__FORGERELAY_DEBUG_STATUS_${randomUUID()}__`;
-  const args = [
-    "--silent",
-    "--show-error",
-    "--max-time",
-    "15",
-    "--request",
-    method,
-    "--dump-header",
-    "-",
-    "--output",
-    "-",
-    "--write-out",
-    `\n${marker}%{http_code}`,
-  ];
-  for (const [name, value] of Object.entries(headers)) {
-    args.push("--header", `${name}: ${value}`);
-  }
-  if (body !== undefined) {
-    args.push("--data-binary", "@-");
-  }
-  args.push(url);
-
-  const result = spawnSync("curl", args, {
-    cwd: repoRoot,
-    input: body,
-    encoding: "utf8",
-    maxBuffer: 20 * 1024 * 1024,
-  });
-  if (result.status !== 0) {
-    throw new Error(`curl ${method} ${url} failed: ${result.stderr.trim() || `exit ${result.status}`}`);
-  }
-
-  const statusMarker = `\n${marker}`;
-  const markerIndex = result.stdout.lastIndexOf(statusMarker);
-  assert.notEqual(markerIndex, -1, `curl response did not contain status marker for ${url}`);
-  const rawResponse = result.stdout.slice(0, markerIndex);
-  const status = Number(result.stdout.slice(markerIndex + statusMarker.length).trim());
-  const separator = rawResponse.indexOf("\r\n\r\n") >= 0 ? "\r\n\r\n" : "\n\n";
-  const headerEnd = rawResponse.indexOf(separator);
-  assert.notEqual(headerEnd, -1, `curl response did not contain headers for ${url}`);
-  const headerBlock = rawResponse.slice(0, headerEnd);
-  const responseBody = rawResponse.slice(headerEnd + separator.length);
-  const responseHeaders = new Map();
-  for (const line of headerBlock.split(/\r?\n/).slice(1)) {
-    const colon = line.indexOf(":");
-    if (colon < 0) continue;
-    responseHeaders.set(line.slice(0, colon).trim().toLowerCase(), line.slice(colon + 1).trim());
-  }
-  return { status, headers: responseHeaders, body: responseBody };
-}
-
-async function waitForHealth(child) {
-  for (let attempt = 0; attempt < 60; attempt += 1) {
-    if (child.exitCode !== null) {
-      throw new Error(`debug server exited before health check: ${child.exitCode}`);
-    }
-    try {
-      const response = jsonRequest(`${debugBaseUrl}/healthz`);
-      if (response.status === 200) return response.json;
-    } catch {
-      // Server is still starting.
-    }
-    await delay(100);
-  }
-  throw new Error("debug server did not become healthy on 127.0.0.1:7677");
-}
-
-async function stopServer(child) {
-  if (child.exitCode !== null) return;
-  child.kill("SIGTERM");
-  const exited = once(child, "exit");
-  await Promise.race([
-    exited,
-    delay(3000).then(() => {
-      if (child.exitCode === null) child.kill("SIGKILL");
-    }),
-  ]);
-}
-
-function setupGitProject(root) {
-  mkdirSync(root, { recursive: true });
-  writeFileSync(join(root, "README.md"), "debug git project\n", "utf8");
-  runGit(root, ["init"]);
-  runGit(root, ["config", "user.email", "forgerelay-debug@example.com"]);
-  runGit(root, ["config", "user.name", "ForgeRelay Debug"]);
-  runGit(root, ["add", "."]);
-  runGit(root, ["commit", "-m", "Initial debug commit"]);
-}
-
-function runGit(cwd, args) {
-  const result = spawnSync("git", args, { cwd, encoding: "utf8" });
-  if (result.status !== 0) {
-    throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim()}`);
-  }
-}
-
-function gitOutput(cwd, args, options = {}) {
-  const gitArgs = options.gitDir ? ["--git-dir", cwd, ...args] : args;
-  const result = spawnSync("git", gitArgs, {
-    ...(options.gitDir ? {} : { cwd }),
-    encoding: "utf8",
-  });
-  if (result.status !== 0) {
-    throw new Error(`git ${gitArgs.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim()}`);
-  }
-  return result.stdout.trim();
-}
-
-function exerciseReleaseTagHooks(accessToken, sessionId) {
-  setupGitProject(releaseProject);
-  runGit(acceptanceRoot, ["init", "--bare", releaseRemote]);
-  runGit(releaseProject, ["remote", "add", "origin", releaseRemote]);
-  mkdirSync(join(releaseProject, ".forgerelay", "hooks"), { recursive: true });
-  writeFileSync(
-    join(releaseProject, ".forgerelay", "release-check.mjs"),
-    [
-      'import { writeFileSync } from "node:fs";',
-      'const payload = process.env.FORGERELAY_HOOK_PAYLOAD ?? "{}";',
-      'const parsed = JSON.parse(payload);',
-      'writeFileSync("release-ci-ran.txt", payload);',
-      'if (parsed.command === "git push origin v0.2.1") process.exit(17);',
-      "",
-    ].join("\n"),
-  );
-  writeFileSync(
-    join(releaseProject, ".forgerelay", "hooks", "release-tag-local-ci.json"),
-    JSON.stringify({
-      event: "BeforeTool",
-      matcher: { tool: "bash", commandRegex: "git push origin v0\\.2\\.[01]" },
-      command: "node .forgerelay/release-check.mjs",
-      timeoutSeconds: 30,
-      report: true,
-    }, null, 2) + "\n",
-  );
-  runGit(releaseProject, ["add", ".forgerelay"]);
-  runGit(releaseProject, ["commit", "-m", "Add release hook fixture"]);
-  runGit(releaseProject, ["tag", "v0.2.0"]);
-  runGit(releaseProject, ["tag", "v0.2.1"]);
-
-  const opened = callTool(accessToken, sessionId, 11, "open_workspace", {
-    path: releaseProject,
-  });
-  const releaseWorkspaceId = opened.structuredContent.workspaceId;
-
-  const pushed = callTool(accessToken, sessionId, 12, "bash", {
-    workspaceId: releaseWorkspaceId,
-    command: "git status --short && git push origin v0.2.0 && echo release-pushed",
-  });
-  assert.equal(pushed.isError, undefined);
-  assert.match(toolText(pushed), /release-tag-local-ci \(BeforeTool, project\) passed/);
-  assert.ok(existsSync(join(releaseProject, "release-ci-ran.txt")));
-  assert.deepEqual(JSON.parse(readFileSync(join(releaseProject, "release-ci-ran.txt"), "utf8")), {
-    tool: "bash",
-    action: "run",
-    command: "git push origin v0.2.0",
-    workingDirectory: ".",
-    originalCommand: "git status --short && git push origin v0.2.0 && echo release-pushed",
-  });
-  assert.equal(
-    gitOutput(releaseRemote, ["rev-parse", "refs/tags/v0.2.0"], { gitDir: true }),
-    gitOutput(releaseProject, ["rev-parse", "v0.2.0"]),
-  );
-
-  const blocked = callTool(accessToken, sessionId, 13, "bash", {
-    workspaceId: releaseWorkspaceId,
-    command: "git status --short && git push origin v0.2.1 && echo should-not-run",
-  });
-  assert.equal(blocked.isError, true);
-  assert.match(toolText(blocked), /release-tag-local-ci.*failed/);
-  const missingTag = spawnSync("git", ["--git-dir", releaseRemote, "show-ref", "--verify", "--quiet", "refs/tags/v0.2.1"]);
-  assert.notEqual(missingTag.status, 0, "blocked release tag unexpectedly reached the remote");
-  pass("release tag hook gate", "local Hook passed before v0.2.0 push and blocked v0.2.1 before remote mutation");
-}
-
-function exerciseSubagentHooks(runtimeEnv, debugStateDir, workspaceId, workspaceRoot) {
-  const seedScript = [
-    'import { SubagentSessionStore } from "./src/subagents/sessions/store.js";',
-    'const store = new SubagentSessionStore(process.env.FORGERELAY_STATE_DIR);',
-    'const record = store.create({',
-    `  workspaceId: ${JSON.stringify(workspaceId)},`,
-    `  workspaceRoot: ${JSON.stringify(workspaceRoot)},`,
-    '  profileName: "debug-missing-profile",',
-    '  provider: "codex",',
-    '  activeRun: { id: "run_debug_acceptance", startedAt: new Date().toISOString() },',
-    '});',
-    'store.close();',
-    'process.stdout.write(record.id);',
-  ].join("\n");
-  const seeded = spawnSync(process.execPath, ["--import", "tsx", "--input-type=module", "-e", seedScript], {
-    cwd: repoRoot,
-    env: { ...runtimeEnv, FORGERELAY_STATE_DIR: debugStateDir },
-    encoding: "utf8",
-  });
-  if (seeded.status !== 0) {
-    throw new Error(`unable to seed debug subagent: ${seeded.stderr.trim()}`);
-  }
-  const agentId = seeded.stdout.trim();
-  assert.match(agentId, /^agt_/);
-
-  const promptFile = join(acceptanceRoot, "subagent-prompt.txt");
-  writeFileSync(promptFile, "debug acceptance prompt that must not reach a provider\n", "utf8");
-  const worker = spawnSync(
-    process.execPath,
-    ["--import", "tsx", "src/cli.ts", "agents", "__worker", agentId, "--prompt-file", promptFile],
-    { cwd: repoRoot, env: runtimeEnv, encoding: "utf8", maxBuffer: 2 * 1024 * 1024 },
-  );
-  if (worker.status !== 0) {
-    throw new Error(`debug subagent worker failed to execute: ${worker.stderr.trim()}`);
-  }
-
-  const inspectScript = [
-    'import { SubagentSessionStore } from "./src/subagents/sessions/store.js";',
-    'import { SubagentDeliveryMailbox } from "./src/subagents/sessions/delivery-mailbox.js";',
-    'const store = new SubagentSessionStore(process.env.FORGERELAY_STATE_DIR);',
-    `const record = store.get(${JSON.stringify(agentId)});`,
-    `const deliveries = new SubagentDeliveryMailbox(process.env.FORGERELAY_STATE_DIR).claimSession(${JSON.stringify(workspaceId)}, ${JSON.stringify(agentId)});`,
-    'store.close();',
-    'process.stdout.write(JSON.stringify({ status: record?.status, latestRun: record?.latestRun, delivery: deliveries[0] }));',
-  ].join("\n");
-  const inspected = spawnSync(process.execPath, ["--import", "tsx", "--input-type=module", "-e", inspectScript], {
-    cwd: repoRoot,
-    env: runtimeEnv,
-    encoding: "utf8",
-  });
-  if (inspected.status !== 0) {
-    throw new Error(`unable to inspect debug subagent: ${inspected.stderr.trim()}`);
-  }
-  const record = JSON.parse(inspected.stdout);
-  assert.equal(record.status, "idle");
-  assert.equal(record.latestRun?.status, "failed");
-  assert.equal(record.delivery?.outcome, "failed");
-  assert.match(record.delivery?.error ?? "", /Subagent profile not found/);
-  pass("subagent hook path", `${agentId} stopped in deterministic failed Run without calling a provider`);
-}
-
-function toolText(result) {
-  return (result.content ?? [])
-    .filter((entry) => entry?.type === "text" && typeof entry.text === "string")
-    .map((entry) => entry.text)
-    .join("\n");
-}
-
-function readHookEntries(path) {
-  return readFileSync(path, "utf8")
-    .trim()
-    .split(/\r?\n/)
-    .filter(Boolean)
-    .map((line) => JSON.parse(line));
-}
-
-async function assertDebugPortFree() {
-  await new Promise((resolvePromise, rejectPromise) => {
-    const socket = connect({ host: "127.0.0.1", port: 7677 });
-    socket.setTimeout(500);
-    socket.once("connect", () => {
-      socket.destroy();
-      rejectPromise(new Error("debug port 7677 is already in use; stop the existing debug server first"));
-    });
-    socket.once("error", (error) => {
-      socket.destroy();
-      if (error.code === "ECONNREFUSED") {
-        resolvePromise();
-        return;
-      }
-      rejectPromise(error);
-    });
-    socket.once("timeout", () => {
-      socket.destroy();
-      resolvePromise();
-    });
-  });
-}
-
-function assertCurlAvailable() {
-  const result = spawnSync("curl", ["--version"], { encoding: "utf8" });
-  if (result.status !== 0) {
-    throw new Error("npm run debug:accept requires curl on PATH.");
-  }
-}
-
-function pass(label, detail) {
-  console.log(`✓ ${label}: ${detail}`);
-}