@amg555/frameforge-mcp 2.7.6 → 2.7.7

package/.agent/skills/gstack-browse/test/sidepanel-font-size.test.ts

@@ -1,147 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as vm from 'vm';
-
-// Sidebar terminal text-size picker. Runs the real sidepanel-terminal.js in a
-// VM with a fake DOM, xterm, WebSocket and chrome.storage, drives one
-// auto-connect to a live terminal, and checks the size the terminal is created
-// with, what persists, and that a live change re-fits and resizes the PTY.
-
-const TERMINAL_JS = path.resolve(
-  import.meta.path, '..', '..', '..', 'extension', 'sidepanel-terminal.js',
-);
-const SIDEPANEL_HTML = path.resolve(
-  import.meta.path, '..', '..', '..', 'extension', 'sidepanel.html',
-);
-
-function fakeElement() {
-  const listeners: Record<string, Array<(e: unknown) => void>> = {};
-  const el: any = {
-    style: {},
-    textContent: '',
-    value: '',
-    classList: { add() {}, remove() {}, contains: () => false },
-    addEventListener(type: string, fn: (e: unknown) => void) { (listeners[type] ||= []).push(fn); },
-    dispatch(type: string) { for (const fn of listeners[type] || []) fn({ target: el }); },
-  };
-  return el;
-}
-
-async function bootSidebar(stored: Record<string, unknown>) {
-  const elements = new Map<string, any>();
-  const terminals: any[] = [];
-  const sent: string[] = [];
-  const frames: Array<() => void> = [];
-  const store = { ...stored };
-
-  class FakeTerminal {
-    options: Record<string, unknown>;
-    cols = 80;
-    rows = 24;
-    constructor(opts: Record<string, unknown>) {
-      this.options = { ...opts };
-      terminals.push(this);
-    }
-    loadAddon() {}
-    open() {}
-    onData() {}
-    refresh() {}
-  }
-  class FakeWebSocket {
-    static OPEN = 1;
-    readyState = 1;
-    binaryType = '';
-    send(msg: unknown) { if (typeof msg === 'string') sent.push(msg); }
-    addEventListener() {}
-    close() {}
-  }
-  const json = (body: unknown) => new Response(JSON.stringify(body), { status: 200 });
-
-  const ctx: any = {
-    console,
-    TextEncoder,
-    Response,
-    document: {
-      readyState: 'complete',
-      addEventListener() {},
-      getElementById(id: string) {
-        if (!elements.has(id)) elements.set(id, fakeElement());
-        return elements.get(id);
-      },
-    },
-    Terminal: FakeTerminal,
-    FitAddon: { FitAddon: class { fit() {} } },
-    WebSocket: FakeWebSocket,
-    ResizeObserver: class { observe() {} },
-    MutationObserver: class { observe() {} },
-    requestAnimationFrame: (fn: () => void) => { frames.push(fn); return frames.length; },
-    setTimeout: () => 0,
-    setInterval: () => 0,
-    clearInterval() {},
-    clearTimeout() {},
-    fetch: async (url: string) =>
-      url.endsWith('/pty-session')
-        ? json({ terminalPort: 4000, sessionId: 'sess', attachToken: 'tok' })
-        : json({ available: true }),
-    chrome: {
-      storage: {
-        local: {
-          get(_keys: string[], cb: (r: Record<string, unknown>) => void) { cb({ ...store }); },
-          set(items: Record<string, unknown>) { Object.assign(store, items); },
-        },
-      },
-      runtime: { sendMessage() {} },
-    },
-    gstackServerPort: 34567,
-    gstackAuthToken: 'auth',
-  };
-  ctx.window = ctx;
-  vm.runInNewContext(fs.readFileSync(TERMINAL_JS, 'utf-8'), ctx);
-  for (let i = 0; i < 50 && terminals.length === 0; i++) await new Promise((r) => setImmediate(r));
-  expect(terminals).toHaveLength(1);
-
-  const flushFrames = () => { for (const fn of frames.splice(0)) fn(); };
-  return { term: terminals[0], picker: elements.get('terminal-fontsize'), store, sent, flushFrames };
-}
-
-describe('sidebar terminal text size', () => {
-  test('defaults to 13px (sm) when nothing is stored', async () => {
-    const { term, picker } = await bootSidebar({});
-    expect(term.options.fontSize).toBe(13);
-    expect(picker.value).toBe('sm');
-  });
-
-  test('creates the terminal at the stored size; an unknown stored value falls back to sm', async () => {
-    const large = await bootSidebar({ terminalFontSize: 'lg' });
-    expect(large.term.options.fontSize).toBe(17);
-    expect(large.picker.value).toBe('lg');
-
-    const bogus = await bootSidebar({ terminalFontSize: 'huge' });
-    expect(bogus.term.options.fontSize).toBe(13);
-    expect(bogus.picker.value).toBe('sm');
-  });
-
-  test('a live change persists, resizes xterm, and re-sends PTY size after the font re-measures', async () => {
-    const { term, picker, store, sent, flushFrames } = await bootSidebar({});
-    flushFrames();
-    sent.length = 0;
-
-    picker.value = 'xl';
-    picker.dispatch('change');
-    expect(store.terminalFontSize).toBe('xl');
-    expect(term.options.fontSize).toBe(20);
-    expect(sent).toEqual([]);
-
-    flushFrames();
-    flushFrames();
-    expect(sent.map((m) => JSON.parse(m))).toContainEqual({ type: 'resize', cols: 80, rows: 24 });
-  });
-
-  test('the toolbar picker offers every size with sm preselected', () => {
-    const html = fs.readFileSync(SIDEPANEL_HTML, 'utf-8');
-    const select = html.match(/<select id="terminal-fontsize"[\s\S]*?<\/select>/)?.[0] ?? '';
-    expect([...select.matchAll(/value="(\w+)"/g)].map((m) => m[1])).toEqual(['xs', 'sm', 'md', 'lg', 'xl']);
-    expect(select).toContain('<option value="sm" selected>');
-  });
-});

package/.agent/skills/gstack-browse/test/sidepanel-patient-autoconnect.test.ts

@@ -1,70 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-
-// v1.44 patient autoConnect — static-grep invariants for the polling loop.
-//
-// Pre-v1.44 the sidebar gave up at 15s with "Browse server not ready.
-// Reload sidebar to retry." Cold-start the browse server takes ~3-8s on a
-// healthy laptop, longer on Conductor workspaces / slow CI, so the user
-// frequently saw the failure message even when nothing was wrong. The
-// fix: poll forever with ascending status messages and only abort on
-// explicit unrecoverable signals (401 auth invalid).
-
-const CLIENT_JS = path.resolve(
-  import.meta.path,
-  '..',
-  '..',
-  '..',
-  'extension',
-  'sidepanel-terminal.js',
-);
-
-describe('sidepanel tryAutoConnect patience (v1.44+)', () => {
-  test('1. no 15s give-up message', () => {
-    const src = fs.readFileSync(CLIENT_JS, 'utf-8');
-    // The v0.x give-up string must NOT reappear — it's the message users
-    // saw on every cold start and the whole point of v1.44 was to delete it.
-    expect(src).not.toContain('Browse server not ready. Reload sidebar to retry.');
-  });
-
-  test('2. ascending status messages at 15s / 60s / 5min', () => {
-    const src = fs.readFileSync(CLIENT_JS, 'utf-8');
-    expect(src).toContain('Waiting for browse server...');
-    expect(src).toContain('Still waiting');
-    expect(src).toContain('still not responding after 5 min');
-  });
-
-  test('3. sticky abort flag prevents loop spam on 401', () => {
-    const src = fs.readFileSync(CLIENT_JS, 'utf-8');
-    expect(src).toContain('autoConnectAborted');
-    // The mint failure branch must short-circuit on 401 specifically.
-    expect(src).toMatch(/minted\.error.*startsWith\('401'\)/);
-    // tryAutoConnect tick must respect the flag.
-    expect(src).toMatch(/if \(autoConnectAborted\) return/);
-  });
-
-  test('4. forceRestart re-arms the loop by clearing the abort flag', () => {
-    const src = fs.readFileSync(CLIENT_JS, 'utf-8');
-    // forceRestart is the user's "try again" escape hatch — must reset
-    // the sticky flag or 401-once means stuck-forever.
-    const block = sliceBetween(src, 'function forceRestart', 'function repaintIfLive');
-    expect(block).toContain('autoConnectAborted = false');
-  });
-
-  test('5. poll interval is 2s, not the legacy 200ms tight loop', () => {
-    const src = fs.readFileSync(CLIENT_JS, 'utf-8');
-    // 200ms ticks burned CPU and made the give-up window land too fast.
-    // 2s is the v1.44 cadence — verify the tight-loop literal is gone.
-    expect(src).toContain('setTimeout(tick, 2000)');
-    expect(src).not.toContain('setTimeout(tick, 200)');
-  });
-});
-
-function sliceBetween(source: string, start: string, end: string): string {
-  const i = source.indexOf(start);
-  if (i === -1) throw new Error(`marker not found: ${start}`);
-  const j = source.indexOf(end, i + start.length);
-  if (j === -1) throw new Error(`end marker not found: ${end}`);
-  return source.slice(i, j);
-}

package/.agent/skills/gstack-browse/test/sidepanel-reattach.test.ts

@@ -1,93 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-
-// v1.44 Commit 3 — client-side re-attach loop.
-//
-// On unexpected WS close (anything other than clean 1000 / 4001 / 4404),
-// the sidebar now silently posts /pty-session/reattach with backoff,
-// opens a new WS with the fresh attachToken, writes RIS to xterm when
-// the agent sends {type:"reattach-begin"}, then treats the next binary
-// frame as the scrollback replay payload. Static-grep tripwires defend
-// the load-bearing protocol invariants; live re-attach exercises belong
-// in the e2e tier.
-
-const TERMINAL_JS = path.resolve(
-  import.meta.path, '..', '..', '..', 'extension', 'sidepanel-terminal.js',
-);
-
-describe('sidepanel re-attach loop (v1.44+ Commit 3)', () => {
-  test('1. STATE.RECONNECTING exists for the in-flight re-attach window', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    expect(src).toContain("RECONNECTING: 'reconnecting'");
-  });
-
-  test('2. backoff schedule matches the eng-review plan (1s/2s/4s/8s, 60s window)', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    expect(src).toContain('REATTACH_BACKOFF_MS = [1000, 2000, 4000, 8000]');
-    expect(src).toContain('REATTACH_WINDOW_MS = 60_000');
-  });
-
-  test('3. startReattachLoop posts /pty-session/reattach with sessionId', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    expect(src).toMatch(/function startReattachLoop\(prevSessionId\)/);
-    const block = sliceBetween(src, 'function startReattachLoop', 'function openReattachWebSocket');
-    expect(block).toContain('/pty-session/reattach');
-    expect(block).toContain('sessionId: prevSessionId');
-  });
-
-  test('4. 410 Gone from re-attach short-circuits to ENDED (no retry loop)', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    const block = sliceBetween(src, 'function startReattachLoop', 'function openReattachWebSocket');
-    // 410 = lease window expired. Retrying wouldn't help; fall through
-    // so the user clicks Restart for a fresh session.
-    expect(block).toContain('resp.status === 410');
-    expect(block).toContain('setState(STATE.ENDED)');
-  });
-
-  test('5. 401 from re-attach sticky-aborts auto-connect', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    const block = sliceBetween(src, 'function startReattachLoop', 'function openReattachWebSocket');
-    expect(block).toContain('resp.status === 401');
-    expect(block).toContain('autoConnectAborted = true');
-  });
-
-  test('6. openReattachWebSocket handles {type:"reattach-begin"} → RIS to xterm', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    const block = sliceBetween(src, 'function openReattachWebSocket', 'async function checkClaudeAvailable');
-    expect(block).toContain("msg.type === 'reattach-begin'");
-    // RIS (\x1bc) is the full-reset escape that clears xterm cleanly
-    // before the replay binary arrives.
-    expect(block).toContain("term.write('\\x1bc')");
-    expect(block).toContain('nextBinaryIsReplay = true');
-  });
-
-  test('7. live connect()/forceRestart() close handlers trigger re-attach on transient close', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    // Both the connect() and forceRestart() close handlers must route
-    // through startReattachLoop for non-clean codes. Count = 3
-    // (open-reattach close handler + connect close + forceRestart close).
-    const occurrences = (src.match(/startReattachLoop\(currentSessionId\)/g) || []).length;
-    expect(occurrences).toBeGreaterThanOrEqual(3);
-  });
-
-  test('8. clean codes (1000 / 4001 / 4404) bypass the re-attach loop', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    // The branch guard MUST exclude these codes from re-attach. 1000 =
-    // PTY exited (claude quit), 4001 = intentional restart, 4404 = no
-    // claude on PATH. Re-attaching in those cases would be wasted work
-    // (or actively wrong — a force-restart that re-attaches to its own
-    // pre-restart session is the bug we're avoiding).
-    expect(src).toContain('code === 1000');
-    expect(src).toContain('code === 4001');
-    expect(src).toContain('code === 4404');
-  });
-});
-
-function sliceBetween(source: string, start: string, end: string): string {
-  const i = source.indexOf(start);
-  if (i === -1) throw new Error(`marker not found: ${start}`);
-  const j = source.indexOf(end, i + start.length);
-  if (j === -1) throw new Error(`end marker not found: ${end}`);
-  return source.slice(i, j);
-}

package/.agent/skills/gstack-browse/test/sidepanel-restart-dispose.test.ts

@@ -1,106 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-
-// v1.44 Commit 2C — client-side restart + dispose wiring.
-//
-// Pre-v1.44 forceRestart only closed the client WS and disposed xterm;
-// the old PTY died asynchronously via the agent's WS close handler.
-// Race window between kill and mint, two claude instances briefly,
-// no prompt visible until the user typed.
-//
-// Now forceRestart POSTs /pty-restart (one transaction: dispose + mint),
-// opens the new WS with the fresh attachToken from the response, and
-// sends {type:"start"} for the eager spawn. pagehide handler in
-// sidepanel.js sendBeacon /pty-dispose so browser quit / panel close
-// doesn't leak a 60s-zombie claude.
-
-const TERMINAL_JS = path.resolve(
-  import.meta.path, '..', '..', '..', 'extension', 'sidepanel-terminal.js',
-);
-const SIDEPANEL_JS = path.resolve(
-  import.meta.path, '..', '..', '..', 'extension', 'sidepanel.js',
-);
-
-describe('sidepanel-terminal: forceRestart via /pty-restart (v1.44+)', () => {
-  test('1. mintSession callers read the 4-tuple (sessionId + attachToken)', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    // The new shape lands in `minted.sessionId` and `minted.attachToken`.
-    expect(src).toContain('const { terminalPort, sessionId } = minted');
-    expect(src).toContain('minted.attachToken || minted.ptySessionToken');
-    // Backward-compat fallback to ptySessionToken kept so a partially-
-    // updated extension still works against a fresh server.
-  });
-
-  test('2. eager spawn via {type:"start"} on ws.open', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    // Replaces the legacy `ws.send(TextEncoder().encode("\\n"))` newline
-    // hack that nudged the lazy-binary-spawn.
-    expect(src).toMatch(/ws\.send\(JSON\.stringify\(\{\s*type:\s*'start'\s*\}\)\)/);
-    expect(src).not.toContain("TextEncoder().encode('\\n')");
-  });
-
-  test('3. forceRestart sends 4001 close code (intentional restart)', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    expect(src).toMatch(/ws\.close\(4001/);
-  });
-
-  test('4. forceRestart POSTs /pty-restart with current sessionId', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    expect(src).toContain('/pty-restart');
-    expect(src).toContain('priorSessionId ? { sessionId: priorSessionId } : {}');
-  });
-
-  test('5. forceRestart 401 triggers sticky abort (no spam loop)', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    // Same defense pattern as connect() — 401 must flip the sticky flag
-    // or every 2s the user sees a fresh "Auth invalid" message.
-    const block = sliceBetween(src, 'async function forceRestart', 'function repaintIfLive');
-    expect(block).toContain('resp.status === 401');
-    expect(block).toContain('autoConnectAborted = true');
-  });
-
-  test('6. currentSessionId is exposed on window for sidepanel.js pagehide', () => {
-    const src = fs.readFileSync(TERMINAL_JS, 'utf-8');
-    expect(src).toContain('window.gstackPtySession = currentSessionId');
-  });
-});
-
-describe('sidepanel: pagehide → sendBeacon /pty-dispose (v1.44+)', () => {
-  test('7. pagehide handler fires sendBeacon to /pty-dispose', () => {
-    const src = fs.readFileSync(SIDEPANEL_JS, 'utf-8');
-    expect(src).toMatch(/window\.addEventListener\('pagehide'/);
-    expect(src).toContain('navigator.sendBeacon');
-    expect(src).toContain('/pty-dispose');
-  });
-
-  test('8. pagehide payload carries sessionId + authToken in body (sendBeacon-compat)', () => {
-    const src = fs.readFileSync(SIDEPANEL_JS, 'utf-8');
-    // sendBeacon can't set custom headers — server route accepts body-auth.
-    // Both fields must be in the payload or the server rejects.
-    expect(src).toMatch(/JSON\.stringify\(\{\s*sessionId,\s*authToken\s*\}\)/);
-    expect(src).toContain('window.gstackPtySession');
-    expect(src).toContain('window.gstackAuthToken');
-  });
-
-  test('9. pagehide handler is best-effort (try/catch swallows failures)', () => {
-    const src = fs.readFileSync(SIDEPANEL_JS, 'utf-8');
-    // The 60s detach window catches any sendBeacon that fails, so the
-    // handler MUST not throw — uncaught throws can interfere with the
-    // browser's unload sequence. Slice between pagehide and end-of-file
-    // (it's the last addEventListener in sidepanel.js by design).
-    const i = src.indexOf("addEventListener('pagehide'");
-    expect(i).toBeGreaterThan(-1);
-    const block = src.slice(i);
-    expect(block).toMatch(/try \{/);
-    expect(block).toMatch(/} catch /);
-  });
-});
-
-function sliceBetween(source: string, start: string, end: string): string {
-  const i = source.indexOf(start);
-  if (i === -1) throw new Error(`marker not found: ${start}`);
-  const j = source.indexOf(end, i + start.length);
-  if (j === -1) throw new Error(`end marker not found: ${end}`);
-  return source.slice(i, j);
-}

package/.agent/skills/gstack-browse/test/skill-token.test.ts

@@ -1,167 +0,0 @@
-/**
- * skill-token tests — verify scoped tokens minted per spawn behave correctly:
- *   - mint creates a session token bound to the right clientId
- *   - default scopes are read+write (no admin/control)
- *   - TTL = spawnTimeout + 30s slack
- *   - revoke kills the token
- *   - revoking an already-revoked token is idempotent (returns false)
- *   - the clientId encoding survives round-trip
- *   - generated spawn ids are unique
- */
-
-import { describe, it, expect, beforeEach } from 'bun:test';
-import {
-  initRegistry, __resetRegistry, validateToken, checkScope,
-} from '../src/token-registry';
-import {
-  generateSpawnId,
-  skillClientId,
-  mintSkillToken,
-  revokeSkillToken,
-} from '../src/skill-token';
-
-describe('skill-token', () => {
-  beforeEach(() => {
-    // __resetRegistry zeroes rootToken so the new initRegistry mismatch guard
-    // doesn't fire on the immediate initRegistry call.
-    __resetRegistry();
-    initRegistry('root-token-for-tests');
-  });
-
-  describe('generateSpawnId', () => {
-    it('returns a hex string', () => {
-      const id = generateSpawnId();
-      expect(id).toMatch(/^[0-9a-f]+$/);
-      expect(id.length).toBe(16); // 8 bytes -> 16 hex chars
-    });
-
-    it('returns unique ids on each call', () => {
-      const ids = new Set<string>();
-      for (let i = 0; i < 50; i++) ids.add(generateSpawnId());
-      expect(ids.size).toBe(50);
-    });
-  });
-
-  describe('skillClientId', () => {
-    it('encodes skillName + spawnId deterministically', () => {
-      expect(skillClientId('hackernews-frontpage', 'abc123')).toBe('skill:hackernews-frontpage:abc123');
-    });
-  });
-
-  describe('mintSkillToken', () => {
-    it('mints a session token for the spawn', () => {
-      const info = mintSkillToken({
-        skillName: 'hn-frontpage',
-        spawnId: 'spawn1',
-        spawnTimeoutSeconds: 60,
-      });
-      expect(info.token).toStartWith('gsk_sess_');
-      expect(info.clientId).toBe('skill:hn-frontpage:spawn1');
-      expect(info.type).toBe('session');
-    });
-
-    it('defaults to read+write scopes (no admin)', () => {
-      const info = mintSkillToken({
-        skillName: 'hn-frontpage',
-        spawnId: 'spawn1',
-        spawnTimeoutSeconds: 60,
-      });
-      expect(info.scopes).toEqual(['read', 'write']);
-      expect(info.scopes).not.toContain('admin');
-      expect(info.scopes).not.toContain('control');
-    });
-
-    it('TTL is spawnTimeout + 30s slack', () => {
-      const before = Date.now();
-      const info = mintSkillToken({
-        skillName: 'x', spawnId: 'y', spawnTimeoutSeconds: 60,
-      });
-      const after = Date.now();
-      const expiresMs = new Date(info.expiresAt!).getTime();
-      // Token expires ~90s after mint (60s + 30s slack), allow some test fuzz.
-      expect(expiresMs).toBeGreaterThanOrEqual(before + 90_000 - 1_000);
-      expect(expiresMs).toBeLessThanOrEqual(after + 90_000 + 1_000);
-    });
-
-    it('minted token validates and grants browser-driving scope', () => {
-      const info = mintSkillToken({
-        skillName: 'hn', spawnId: 's1', spawnTimeoutSeconds: 60,
-      });
-      const validated = validateToken(info.token);
-      expect(validated).not.toBeNull();
-      expect(checkScope(validated!, 'goto')).toBe(true);
-      expect(checkScope(validated!, 'click')).toBe(true);
-      expect(checkScope(validated!, 'snapshot')).toBe(true);
-      expect(checkScope(validated!, 'text')).toBe(true);
-    });
-
-    it('minted token denies admin commands (eval, js, cookies, storage)', () => {
-      const info = mintSkillToken({
-        skillName: 'hn', spawnId: 's1', spawnTimeoutSeconds: 60,
-      });
-      const validated = validateToken(info.token);
-      expect(validated).not.toBeNull();
-      expect(checkScope(validated!, 'eval')).toBe(false);
-      expect(checkScope(validated!, 'js')).toBe(false);
-      expect(checkScope(validated!, 'cookies')).toBe(false);
-      expect(checkScope(validated!, 'storage')).toBe(false);
-    });
-
-    it('minted token denies control commands (state, stop, restart)', () => {
-      const info = mintSkillToken({
-        skillName: 'hn', spawnId: 's1', spawnTimeoutSeconds: 60,
-      });
-      const validated = validateToken(info.token);
-      expect(checkScope(validated!, 'stop')).toBe(false);
-      expect(checkScope(validated!, 'restart')).toBe(false);
-      expect(checkScope(validated!, 'state')).toBe(false);
-    });
-
-    it('rateLimit is unlimited (skill scripts run as fast as daemon allows)', () => {
-      const info = mintSkillToken({
-        skillName: 'hn', spawnId: 's1', spawnTimeoutSeconds: 60,
-      });
-      expect(info.rateLimit).toBe(0);
-    });
-
-    it('two spawns of the same skill mint distinct tokens', () => {
-      const a = mintSkillToken({ skillName: 'hn', spawnId: 's1', spawnTimeoutSeconds: 60 });
-      const b = mintSkillToken({ skillName: 'hn', spawnId: 's2', spawnTimeoutSeconds: 60 });
-      expect(a.token).not.toBe(b.token);
-      expect(a.clientId).not.toBe(b.clientId);
-      // Both remain valid until revoked.
-      expect(validateToken(a.token)).not.toBeNull();
-      expect(validateToken(b.token)).not.toBeNull();
-    });
-  });
-
-  describe('revokeSkillToken', () => {
-    it('revokes the token for a given spawn', () => {
-      const info = mintSkillToken({ skillName: 'hn', spawnId: 's1', spawnTimeoutSeconds: 60 });
-      expect(validateToken(info.token)).not.toBeNull();
-
-      const ok = revokeSkillToken('hn', 's1');
-      expect(ok).toBe(true);
-      expect(validateToken(info.token)).toBeNull();
-    });
-
-    it('idempotent — revoking again returns false (already gone)', () => {
-      mintSkillToken({ skillName: 'hn', spawnId: 's1', spawnTimeoutSeconds: 60 });
-      expect(revokeSkillToken('hn', 's1')).toBe(true);
-      expect(revokeSkillToken('hn', 's1')).toBe(false);
-    });
-
-    it('revoking unknown spawn is a no-op (returns false)', () => {
-      expect(revokeSkillToken('nonexistent', 'whatever')).toBe(false);
-    });
-
-    it('revoking one spawn does not affect a sibling spawn', () => {
-      const a = mintSkillToken({ skillName: 'hn', spawnId: 's1', spawnTimeoutSeconds: 60 });
-      const b = mintSkillToken({ skillName: 'hn', spawnId: 's2', spawnTimeoutSeconds: 60 });
-
-      expect(revokeSkillToken('hn', 's1')).toBe(true);
-      expect(validateToken(a.token)).toBeNull();
-      expect(validateToken(b.token)).not.toBeNull();
-    });
-  });
-});