@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/test/daemon-log-hygiene.test.ts

@@ -1,135 +0,0 @@
-/**
- * #2461 daemon crash log + F6 log hygiene needles.
- *
- * The detached daemon's stdout/stderr now land in <stateDir>/browse-daemon.log
- * (both spawn paths) instead of 'ignore'. That makes crashes diagnosable —
- * and makes it load-bearing that NOTHING secret or page-derived reaches the
- * daemon's console streams:
- *
- *   - No console.* call anywhere in src/ may pass a token VALUE (AUTH_TOKEN,
- *     state.token, attachToken, INTERNAL_TOKEN, setup keys). Names like
- *     tokenInfo.clientId are fine — the needle targets expressions whose
- *     value IS a token.
- *   - The page-content carrier modules (tab-session, buffers,
- *     content-security, activity) stay console-free, so raw page-derived
- *     strings can't be echoed into the log unsanitized.
- *
- * Source-level, same style as windows-spawn-hide.test.ts.
- */
-
-import { describe, expect, test } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-
-const SRC_DIR = path.join(import.meta.dir, '../src');
-const SRC = (f: string) => fs.readFileSync(path.join(SRC_DIR, f), 'utf-8');
-
-describe('#2461 daemon log wiring', () => {
-  test('both daemon spawn paths capture stdout/stderr to browse-daemon.log', () => {
-    const cli = SRC('cli.ts');
-    // Unix path: fd from openDaemonLogSink wired into stdio.
-    expect(cli).toContain("stdio: ['ignore', daemonLogFd, daemonLogFd]");
-    expect(cli).toMatch(/openDaemonLogSink/);
-    // Windows path: the fd must be opened INSIDE the node -e launcher (an fd
-    // opened in cli.ts wouldn't cross the spawn boundary).
-    expect(cli).toContain("stdio:['ignore',logFd,logFd]");
-    expect(cli).toContain('browse-daemon.log');
-    // The old fully-discarded wiring must not come back on either daemon path.
-    expect(cli).not.toContain("stdio:['ignore','ignore','ignore']");
-  });
-
-  test('log sink is append-mode (accumulates across respawns)', () => {
-    const cli = SRC('cli.ts');
-    // Both spawn paths open through the single daemonLogPath() source (M4),
-    // which itself must build from the state dir.
-    expect(cli).toMatch(/openSync\(daemonLogPath\(\), 'a'\)/);
-    expect(cli).toMatch(/path\.join\(config\.stateDir, 'browse-daemon\.log'\)/);
-    expect(cli).toMatch(/openSync\(\$\{daemonLogPathStr\},'a'\)/);
-  });
-
-  test('append-mode log is growth-bounded: rotated at 10MB before daemon start', () => {
-    const cli = SRC('cli.ts');
-    expect(cli).toMatch(/DAEMON_LOG_MAX_BYTES = 10 \* 1024 \* 1024/);
-    expect(cli).toMatch(/rotateDaemonLogIfOversized\(\);/);
-    // Single generation: rename to .1, matching the repo's 10MB conventions.
-    expect(cli).toMatch(/renameSync\(p, `\$\{p\}\.1`\)/);
-  });
-
-  test('rotation behavior: oversized rotates to a single .1 generation, small/missing are no-ops', () => {
-    const os = require('os');
-    const { rotateDaemonLogIfOversized } = require('../src/cli');
-    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-daemon-log-'));
-    try {
-      const p = path.join(tmp, 'browse-daemon.log');
-      // Missing log: no throw (first launch).
-      rotateDaemonLogIfOversized(p, 1024);
-      // Under the cap: untouched, no generation created.
-      fs.writeFileSync(p, 'x'.repeat(10));
-      rotateDaemonLogIfOversized(p, 1024);
-      expect(fs.existsSync(p)).toBe(true);
-      expect(fs.existsSync(`${p}.1`)).toBe(false);
-      // Over the cap: rotated out of the way so the daemon starts fresh.
-      fs.writeFileSync(p, 'y'.repeat(2048));
-      rotateDaemonLogIfOversized(p, 1024);
-      expect(fs.existsSync(p)).toBe(false);
-      expect(fs.readFileSync(`${p}.1`, 'utf-8')).toContain('y');
-      // Single generation: the next rotation REPLACES .1 (bounded at ~2x cap
-      // total, never a .2).
-      fs.writeFileSync(p, 'z'.repeat(2048));
-      rotateDaemonLogIfOversized(p, 1024);
-      expect(fs.readFileSync(`${p}.1`, 'utf-8')).toContain('z');
-      expect(fs.existsSync(`${p}.2`)).toBe(false);
-    } finally {
-      fs.rmSync(tmp, { recursive: true, force: true });
-    }
-  });
-
-  test('bun-polyfill routes Windows spawns through cross-spawn (ENOENT + cmd.exe injection fix)', () => {
-    const polyfill = SRC('bun-polyfill.cjs');
-    expect(polyfill).toContain("require('cross-spawn')");
-    expect(polyfill).toMatch(/process\.platform === 'win32' \? crossSpawn\.sync : nodeSpawnSync/);
-    expect(polyfill).toMatch(/process\.platform === 'win32' \? crossSpawn : nodeSpawn/);
-    // The rejected-for-cause alternative must not creep back in: shell:true
-    // on Windows routes through cmd.exe and does NOT neutralize & | ^ % < >.
-    // (Strip comments — the header documents WHY shell:true was rejected.)
-    const code = polyfill.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
-    expect(code).not.toMatch(/shell:\s*true/);
-  });
-});
-
-describe('F6 log hygiene: nothing secret or page-derived reaches daemon console', () => {
-  const files = fs.readdirSync(SRC_DIR).filter((f) => f.endsWith('.ts') || f.endsWith('.cjs'));
-
-  test('no console.* call passes a token value', () => {
-    const offenders: string[] = [];
-    for (const file of files) {
-      const content = SRC(file);
-      for (const [idx, line] of content.split('\n').entries()) {
-        if (!/console\.(log|error|warn|info)\(/.test(line)) continue;
-        // Interpolated token values: ${...token} / ${...Token} — the
-        // expression ENDS in token, i.e. the value IS the token. Names like
-        // ${tokenInfo.clientId} don't match.
-        if (/\$\{[^}]*[tT]oken\s*\}/.test(line)) {
-          offenders.push(`${file}:${idx + 1}: ${line.trim().slice(0, 120)}`);
-          continue;
-        }
-        // Bare token args: console.log('x', token) / (..., authToken)
-        if (/console\.(log|error|warn|info)\([^)]*[^a-zA-Z_.][tT]oken\s*[,)]/.test(line)) {
-          offenders.push(`${file}:${idx + 1}: ${line.trim().slice(0, 120)}`);
-        }
-      }
-    }
-    expect(offenders).toEqual([]);
-  });
-
-  test('page-content carrier modules are console-free', () => {
-    // Page-derived strings flow through these modules. Keeping them
-    // console-free guarantees raw page content can't be echoed into
-    // browse-daemon.log without passing an egress sanitizer first.
-    for (const file of ['tab-session.ts', 'buffers.ts', 'content-security.ts', 'activity.ts']) {
-      const content = SRC(file);
-      const calls = content.match(/console\.(log|error|warn|info)\(/g) || [];
-      expect({ file, count: calls.length }).toEqual({ file, count: 0 });
-    }
-  });
-});

package/.agent/skills/gstack-browse/test/daemon-mismatch-refuse.test.ts

@@ -1,178 +0,0 @@
-/**
- * D2: integration test for daemon-mismatch refuse.
- *
- * Stubs a healthy-looking state file with a known configHash, spins up a
- * tiny HTTP listener that answers /health (so the CLI's health check
- * passes), then runs the actual cli.ts binary with a different --proxy
- * value (different configHash). Asserts exit 1 and the disconnect hint
- * in stderr.
- *
- * This catches integration regressions that the unit tests on
- * extractGlobalFlags can't see — specifically the wiring between
- * extractGlobalFlags → ensureServer → state-file diff comparison.
- */
-
-import { describe, test, expect } from 'bun:test';
-import { spawn } from 'child_process';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import * as http from 'http';
-
-async function startFakeHealthServer(token: string): Promise<{ port: number; close: () => Promise<void> }> {
-  const server = http.createServer((req, res) => {
-    if (req.url === '/health') {
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ status: 'healthy', token }));
-      return;
-    }
-    res.writeHead(404);
-    res.end();
-  });
-  await new Promise<void>((resolve, reject) => {
-    server.once('error', reject);
-    server.listen(0, '127.0.0.1', () => resolve());
-  });
-  const addr = server.address();
-  if (!addr || typeof addr === 'string') throw new Error('fake server: bad address');
-  return {
-    port: addr.port,
-    close: () => new Promise((r) => server.close(() => r())),
-  };
-}
-
-async function runCli(args: string[], env: Record<string, string>, timeoutMs = 10000): Promise<{ code: number; stdout: string; stderr: string }> {
-  const cliPath = path.resolve(__dirname, '../src/cli.ts');
-  return new Promise((resolve) => {
-    const proc = spawn('bun', ['run', cliPath, ...args], {
-      timeout: timeoutMs,
-      env,
-    });
-    let stdout = ''; let stderr = '';
-    proc.stdout.on('data', (d) => stdout += d.toString());
-    proc.stderr.on('data', (d) => stderr += d.toString());
-    proc.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
-  });
-}
-
-describe('D2 daemon-mismatch refuse (CLI integration)', () => {
-  test('refuses when existing daemon has different configHash', async () => {
-    // Set up a fake healthy daemon with a config-hash that won't match.
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'browse-mismatch-'));
-    const stateFile = path.join(tmpDir, 'browse.json');
-    const fakeServer = await startFakeHealthServer('fake-token');
-
-    fs.writeFileSync(stateFile, JSON.stringify({
-      pid: process.pid, // alive (current bun process); health check is what really gates this
-      port: fakeServer.port,
-      token: 'fake-token',
-      startedAt: new Date().toISOString(),
-      serverPath: '',
-      mode: 'launched',
-      configHash: 'aaaaaaaaaaaaaaaa', // 16-char hex; won't match new --proxy hash
-    }, null, 2));
-
-    const cliEnv: Record<string, string> = {};
-    for (const [k, v] of Object.entries(process.env)) {
-      if (v !== undefined) cliEnv[k] = v;
-    }
-    cliEnv.BROWSE_STATE_FILE = stateFile;
-
-    try {
-      const result = await runCli(
-        ['--proxy', 'socks5://example.com:1080', 'status'],
-        cliEnv,
-      );
-      expect(result.code).toBe(1);
-      expect(result.stderr.toLowerCase()).toMatch(/different config|mismatch|browse disconnect/);
-    } finally {
-      await fakeServer.close();
-      try { fs.unlinkSync(stateFile); } catch { /* ignore */ }
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-  }, 15000);
-
-  test('refuses when existing plain daemon meets a --proxy invocation', async () => {
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'browse-mismatch-plain-'));
-    const stateFile = path.join(tmpDir, 'browse.json');
-    const fakeServer = await startFakeHealthServer('fake-token');
-
-    // Plain daemon (no configHash) — represents the existing-default case.
-    fs.writeFileSync(stateFile, JSON.stringify({
-      pid: process.pid,
-      port: fakeServer.port,
-      token: 'fake-token',
-      startedAt: new Date().toISOString(),
-      serverPath: '',
-      mode: 'launched',
-    }, null, 2));
-
-    const cliEnv: Record<string, string> = {};
-    for (const [k, v] of Object.entries(process.env)) {
-      if (v !== undefined) cliEnv[k] = v;
-    }
-    cliEnv.BROWSE_STATE_FILE = stateFile;
-
-    try {
-      const result = await runCli(
-        ['--headed', 'status'],
-        cliEnv,
-      );
-      expect(result.code).toBe(1);
-      expect(result.stderr.toLowerCase()).toMatch(/without --proxy|browse disconnect/);
-    } finally {
-      await fakeServer.close();
-      try { fs.unlinkSync(stateFile); } catch { /* ignore */ }
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-  }, 15000);
-
-  test('reuses existing daemon when configHash matches', async () => {
-    // A successful match: build a fake daemon with the SAME configHash the
-    // CLI would compute for `--proxy socks5://reuse.example:1080`.
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'browse-match-'));
-    const stateFile = path.join(tmpDir, 'browse.json');
-    const fakeServer = await startFakeHealthServer('fake-token');
-
-    const { computeConfigHash } = await import('../src/proxy-config');
-    const matchingHash = computeConfigHash({
-      proxyUrl: 'socks5://reuse.example:1080',
-      headed: false,
-    });
-
-    fs.writeFileSync(stateFile, JSON.stringify({
-      pid: process.pid,
-      port: fakeServer.port,
-      token: 'fake-token',
-      startedAt: new Date().toISOString(),
-      serverPath: '',
-      mode: 'launched',
-      configHash: matchingHash,
-    }, null, 2));
-
-    const cliEnv: Record<string, string> = {};
-    for (const [k, v] of Object.entries(process.env)) {
-      if (v !== undefined) cliEnv[k] = v;
-    }
-    cliEnv.BROWSE_STATE_FILE = stateFile;
-
-    try {
-      const result = await runCli(
-        ['--proxy', 'socks5://reuse.example:1080', 'status'],
-        cliEnv,
-      );
-      // Status command would fail to actually return useful data because our
-      // fake server doesn't implement /command, but the CLI must NOT exit
-      // with the mismatch error code path (which is exit 1 + 'different
-      // config' in stderr). Acceptable outcomes:
-      //   - exit 0 (status returned ok somehow)
-      //   - exit !=0 from a different reason (bad token, command-handler missing)
-      // The thing we assert is: stderr does NOT contain the mismatch hint.
-      expect(result.stderr).not.toMatch(/different config|run 'browse disconnect' first/i);
-    } finally {
-      await fakeServer.close();
-      try { fs.unlinkSync(stateFile); } catch { /* ignore */ }
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-  }, 15000);
-});

package/.agent/skills/gstack-browse/test/data-platform.test.ts

@@ -1,176 +0,0 @@
-/**
- * Tests for the browser data platform: media extraction, network capture,
- * path security, and structured data extraction.
- */
-
-import { describe, it, expect } from 'bun:test';
-import { SizeCappedBuffer, type CapturedResponse } from '../src/network-capture';
-import { validateTempPath, validateOutputPath, validateReadPath } from '../src/path-security';
-import { TEMP_DIR } from '../src/platform';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-
-// ─── SizeCappedBuffer ─────────────────────────────────────────
-
-describe('SizeCappedBuffer', () => {
-  function makeEntry(size: number, url = 'https://example.com'): CapturedResponse {
-    return {
-      url,
-      status: 200,
-      headers: {},
-      body: 'x'.repeat(size),
-      contentType: 'text/plain',
-      timestamp: Date.now(),
-      size,
-      bodyTruncated: false,
-    };
-  }
-
-  it('stores entries within capacity', () => {
-    const buf = new SizeCappedBuffer(1000);
-    buf.push(makeEntry(100));
-    buf.push(makeEntry(200));
-    expect(buf.length).toBe(2);
-    expect(buf.byteSize).toBe(300);
-  });
-
-  it('evicts oldest entries when over capacity', () => {
-    const buf = new SizeCappedBuffer(500);
-    buf.push(makeEntry(200, 'https://a.com'));
-    buf.push(makeEntry(200, 'https://b.com'));
-    buf.push(makeEntry(200, 'https://c.com')); // should evict first entry
-    expect(buf.length).toBe(2);
-    const urls = buf.toArray().map(e => e.url);
-    expect(urls).toContain('https://b.com');
-    expect(urls).toContain('https://c.com');
-    expect(urls).not.toContain('https://a.com');
-  });
-
-  it('evicts multiple entries for one large push', () => {
-    const buf = new SizeCappedBuffer(500);
-    buf.push(makeEntry(100));
-    buf.push(makeEntry(100));
-    buf.push(makeEntry(100));
-    buf.push(makeEntry(400)); // evicts first two (need totalSize + 400 <= 500, so totalSize <= 100)
-    expect(buf.length).toBe(2); // one 100-byte entry + one 400-byte entry
-    expect(buf.byteSize).toBe(500);
-  });
-
-  it('clear resets buffer', () => {
-    const buf = new SizeCappedBuffer(1000);
-    buf.push(makeEntry(100));
-    buf.push(makeEntry(200));
-    buf.clear();
-    expect(buf.length).toBe(0);
-    expect(buf.byteSize).toBe(0);
-  });
-
-  it('exports to JSONL file', () => {
-    const buf = new SizeCappedBuffer(1000);
-    buf.push(makeEntry(10, 'https://a.com'));
-    buf.push(makeEntry(20, 'https://b.com'));
-
-    const tmpFile = path.join(os.tmpdir(), `test-export-${Date.now()}.jsonl`);
-    try {
-      const count = buf.exportToFile(tmpFile);
-      expect(count).toBe(2);
-      const lines = fs.readFileSync(tmpFile, 'utf-8').trim().split('\n');
-      expect(lines.length).toBe(2);
-      const parsed = JSON.parse(lines[0]);
-      expect(parsed.url).toBe('https://a.com');
-    } finally {
-      fs.unlinkSync(tmpFile);
-    }
-  });
-
-  it('summary shows entries', () => {
-    const buf = new SizeCappedBuffer(1000);
-    buf.push(makeEntry(1024, 'https://api.example.com/graphql'));
-    const summary = buf.summary();
-    expect(summary).toContain('1 responses');
-    expect(summary).toContain('graphql');
-    expect(summary).toContain('1KB');
-  });
-
-  it('summary shows empty message when no entries', () => {
-    const buf = new SizeCappedBuffer(1000);
-    expect(buf.summary()).toBe('No captured responses.');
-  });
-});
-
-// ─── validateTempPath ─────────────────────────────────────────
-
-describe('validateTempPath', () => {
-  let tmpFile: string;
-
-  it('allows paths within /tmp that exist', () => {
-    tmpFile = path.join(TEMP_DIR, `test-temp-path-${Date.now()}.jpg`);
-    fs.writeFileSync(tmpFile, 'test');
-    try {
-      expect(() => validateTempPath(tmpFile)).not.toThrow();
-    } finally {
-      fs.unlinkSync(tmpFile);
-    }
-  });
-
-  it('rejects non-existent files', () => {
-    expect(() => validateTempPath('/tmp/nonexistent-file-12345.jpg')).toThrow(/not found/i);
-  });
-
-  it('rejects paths in cwd', () => {
-    // Create a real file in cwd to test the path check (not the existence check)
-    const cwdFile = path.join(process.cwd(), 'package.json');
-    expect(() => validateTempPath(cwdFile)).toThrow(/temp directory/i);
-  });
-
-  it('rejects absolute paths outside safe dirs', () => {
-    expect(() => validateTempPath('/etc/passwd')).toThrow();
-  });
-});
-
-// ─── Command registration ─────────────────────────────────────
-
-describe('command registration', () => {
-  it('all new commands have descriptions', () => {
-    // The load-time validation in commands.ts throws if any command
-    // is missing from COMMAND_DESCRIPTIONS. If this import succeeds,
-    // all commands are properly registered.
-    const { COMMAND_DESCRIPTIONS, ALL_COMMANDS } = require('../src/commands');
-    const newCommands = ['media', 'data', 'download', 'scrape', 'archive'];
-    for (const cmd of newCommands) {
-      expect(ALL_COMMANDS.has(cmd)).toBe(true);
-      expect(COMMAND_DESCRIPTIONS[cmd]).toBeTruthy();
-    }
-  });
-
-  it('new commands are in correct scope sets', () => {
-    const { SCOPE_READ, SCOPE_WRITE } = require('../src/token-registry');
-    expect(SCOPE_READ.has('media')).toBe(true);
-    expect(SCOPE_READ.has('data')).toBe(true);
-    expect(SCOPE_WRITE.has('download')).toBe(true);
-    expect(SCOPE_WRITE.has('scrape')).toBe(true);
-    expect(SCOPE_WRITE.has('archive')).toBe(true);
-  });
-
-  it('media and data are in PAGE_CONTENT_COMMANDS', () => {
-    const { PAGE_CONTENT_COMMANDS } = require('../src/commands');
-    expect(PAGE_CONTENT_COMMANDS.has('media')).toBe(true);
-    expect(PAGE_CONTENT_COMMANDS.has('data')).toBe(true);
-  });
-});
-
-// ─── MIME type mapping ─────────────────────────────────────────
-
-describe('mimeToExt', () => {
-  // mimeToExt is a private function in write-commands.ts,
-  // so we test it indirectly through command behavior.
-  // This test verifies the source contains the expected mappings.
-  it('write-commands.ts contains MIME mappings', () => {
-    const src = fs.readFileSync(path.join(import.meta.dir, '../src/write-commands.ts'), 'utf-8');
-    expect(src).toContain("'image/png': '.png'");
-    expect(src).toContain("'image/jpeg': '.jpg'");
-    expect(src).toContain("'video/mp4': '.mp4'");
-    expect(src).toContain("'audio/mpeg': '.mp3'");
-  });
-});

package/.agent/skills/gstack-browse/test/dia-gui-readiness.test.ts

@@ -1,174 +0,0 @@
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { createHash } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
-import { chmodSync, copyFileSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { parseGuiReadiness, runGuiReadiness, validateGuiReadinessAuthority } from '../../.github/scripts/qualify-dia-macos';
-
-const root = realpathSync(mkdtempSync(path.join(tmpdir(), 'dia-gui-readiness-test-')));
-const source = path.resolve(import.meta.dir, '../../.github/scripts/dia-gui-readiness.c');
-const executable = path.join(root, 'metadata-probe');
-const names = ['chrome', 'chromium', 'arc', 'dia', 'comet', 'brave', 'edge', 'safari', 'cookies'];
-const observation = () => ({ protocol: 1, supported: true, identity: { effectiveUidMatches: true, homeMatchesRegistered: true },
-  security: { status: 0, graphicAccess: true, rootSession: false, tty: false, remote: false },
-  quartz: { present: true, sameUid: true, loginDone: true, onConsole: true }, browserRoots: null as any });
-
-beforeAll(() => {
-  const wrapper = path.join(root, 'metadata-probe.c');
-  writeFileSync(wrapper, `#define main native_readiness_main\n#include ${JSON.stringify(source)}\n#undef main
-    int main(int argc, char **argv) {
-      if (argc != 2) return 2;
-      int home = open(argv[1], O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_NONBLOCK);
-      if (home < 0) return 2;
-      print_browser_roots(home, getuid()); close(home); printf("\\n"); return 0;
-    }`);
-  const compiler = Bun.which('clang');
-  if (!compiler) throw new Error('clang is required for the POSIX metadata regression');
-  const compiled = spawnSync(compiler, ['-std=c11', '-O2', '-Wall', '-Wextra', wrapper,
-    ...(process.platform === 'darwin' ? ['-framework', 'Security', '-framework', 'ApplicationServices'] : []), '-o', executable],
-  { encoding: 'utf8', timeout: 30_000 });
-  if (compiled.status !== 0) throw new Error('metadata_fixture_compile_failed');
-});
-
-afterAll(() => rmSync(root, { recursive: true, force: true }));
-
-const inspect = (home: string) => {
-  const result = spawnSync(executable, [home], { encoding: 'utf8', timeout: 5000 });
-  expect(result.status).toBe(0);
-  expect(result.stderr).toBe('');
-  return JSON.parse(result.stdout);
-};
-
-describe('read-only GUI readiness', () => {
-  test('metadata inspection reports missing fixed roots without creating state', () => {
-    const home = realpathSync(mkdtempSync(path.join(root, 'empty-')));
-    const before = readdirSync(home);
-    const result = inspect(home);
-    expect(Object.keys(result)).toEqual(names);
-    for (const name of names) expect(result[name]).toEqual({ state: 'absent', kind: null, ownerMatches: null, ancestorBlocked: false });
-    expect(readdirSync(home)).toEqual(before);
-    expect(lstatSync(home).mode & 0o777).toBe(0o700);
-  });
-
-  test('metadata inspection never follows ancestor or target symlinks', () => {
-    const outside = realpathSync(mkdtempSync(path.join(root, 'other-')));
-    writeFileSync(path.join(outside, 'private-sentinel'), 'unchanged fixture contents');
-    const linked = realpathSync(mkdtempSync(path.join(root, 'linked-')));
-    symlinkSync(outside, path.join(linked, 'Library'), 'dir');
-    const blocked = inspect(linked);
-    for (const name of names) expect(blocked[name]).toEqual({ state: 'unavailable', kind: 'symlink', ownerMatches: true, ancestorBlocked: true });
-    const home = realpathSync(mkdtempSync(path.join(root, 'target-')));
-    mkdirSync(path.join(home, 'Library'));
-    symlinkSync(outside, path.join(home, 'Library/Safari'), 'dir');
-    expect(inspect(home).safari).toEqual({ state: 'present', kind: 'symlink', ownerMatches: true, ancestorBlocked: false });
-    expect(readdirSync(outside)).toEqual(['private-sentinel']);
-    expect(readFileSync(path.join(outside, 'private-sentinel'), 'utf8')).toBe('unchanged fixture contents');
-  });
-
-  test('wrong ancestor types and access failures are unavailable, never absent', () => {
-    const home = realpathSync(mkdtempSync(path.join(root, 'wrong-type-')));
-    writeFileSync(path.join(home, 'Library'), 'not a directory');
-    expect(inspect(home).dia).toEqual({ state: 'unavailable', kind: 'file', ownerMatches: true, ancestorBlocked: true });
-    const denied = realpathSync(mkdtempSync(path.join(root, 'denied-')));
-    const library = path.join(denied, 'Library');
-    mkdirSync(library, { mode: 0o700 });
-    chmodSync(library, 0);
-    try {
-      expect(inspect(denied).dia).toEqual({ state: 'unavailable', kind: 'directory', ownerMatches: true, ancestorBlocked: true });
-      expect(lstatSync(library).mode & 0o777).toBe(0);
-    } finally { chmodSync(library, 0o700); }
-  });
-
-  test('present root metadata does not open contents or change them', () => {
-    const home = realpathSync(mkdtempSync(path.join(root, 'present-')));
-    const safari = path.join(home, 'Library/Safari');
-    mkdirSync(safari, { recursive: true });
-    const file = path.join(safari, 'private-sentinel');
-    writeFileSync(file, 'private fixture content');
-    chmodSync(file, 0);
-    const before = lstatSync(file);
-    const result = inspect(home);
-    expect(result.safari).toEqual({ state: 'present', kind: 'directory', ownerMatches: true, ancestorBlocked: false });
-    expect(lstatSync(file).mode).toBe(before.mode);
-    expect(lstatSync(file).mtimeMs).toBe(before.mtimeMs);
-    expect(JSON.stringify(result)).not.toContain('private');
-    chmodSync(file, 0o600);
-    expect(readFileSync(file, 'utf8')).toBe('private fixture content');
-  });
-
-  test('GUI usability requires both the security capability and the caller-owned logged-in Quartz session', () => {
-    const original = observation();
-    const before = JSON.stringify(original);
-    Object.freeze(original.identity); Object.freeze(original.security); Object.freeze(original.quartz); Object.freeze(original);
-    expect(parseGuiReadiness(original, false).usableGui).toBe(true);
-    expect(JSON.stringify(original)).toBe(before);
-    for (const changed of [
-      { ...observation(), security: { ...observation().security, graphicAccess: false } },
-      { ...observation(), quartz: { present: false, sameUid: null, loginDone: null, onConsole: null } },
-      { ...observation(), quartz: { present: true, sameUid: false, loginDone: null, onConsole: null } },
-      { ...observation(), quartz: { ...observation().quartz, loginDone: false } },
-      { ...observation(), identity: { effectiveUidMatches: true, homeMatchesRegistered: false } },
-      { ...observation(), security: { status: -60500, graphicAccess: null, rootSession: null, tty: null, remote: null } },
-    ]) expect(parseGuiReadiness(changed, false).usableGui).toBe(false);
-  });
-
-  test('schema rejects extra identity text, cross-UID session details and false absence claims', () => {
-    for (const changed of [
-      { ...observation(), username: 'private-name' },
-      { ...observation(), quartz: { ...observation().quartz, uid: 501 } },
-      { ...observation(), quartz: { present: true, sameUid: false, loginDone: true, onConsole: true } },
-      { ...observation(), security: { ...observation().security, status: -1 } },
-      { ...observation(), security: { ...observation().security, graphicAccess: 1 } },
-    ]) expect(() => parseGuiReadiness(changed, false)).toThrow('invalid_gui_readiness_receipt');
-    const roots = Object.fromEntries(names.map(name => [name, { state: 'absent', kind: null, ownerMatches: null, ancestorBlocked: false }]));
-    expect(parseGuiReadiness({ ...observation(), browserRoots: roots }, true).browserRoots).toEqual(roots);
-    expect(() => parseGuiReadiness({ ...observation(), browserRoots: roots }, false)).toThrow('invalid_gui_readiness_receipt');
-    expect(() => parseGuiReadiness({ ...observation(), browserRoots: { ...roots, dia: { state: 'absent', kind: 'symlink', ownerMatches: true, ancestorBlocked: true } } }, true))
-      .toThrow('invalid_gui_readiness_receipt');
-  });
-
-  test('GUI authority cannot carry browser/comparison authority or placeholder destination hashes', () => {
-    const account: any = { work: '/private/tmp/dn-fixture', guiReadiness: { mode: 'gui-readiness-only', executable: '/private/tmp/dn-fixture/bin/gui-readiness',
-      executableSha256: 'a'.repeat(64), sourceSha256: 'b'.repeat(64) } };
-    expect(() => validateGuiReadinessAuthority(account, 'coordinator')).not.toThrow();
-    for (const changed of [{ ...account, launchComparison: {} }, { ...account, destinationExecutable: '' }, { ...account, destinationSha256: 'a'.repeat(64) },
-      { ...account, guiReadiness: null }, { ...account, guiReadiness: { ...account.guiReadiness, executableSha256: ['a'.repeat(64)] } },
-      { ...account, guiReadiness: { ...account.guiReadiness, executable: '/unowned/probe' } }]) {
-      expect(() => validateGuiReadinessAuthority(changed, 'coordinator')).toThrow('gui_readiness_authority_invalid');
-    }
-    expect(() => validateGuiReadinessAuthority(account, 'comparison-driver')).toThrow('gui_readiness_authority_invalid');
-  });
-
-  test('the registered probe validates hashes, bounds execution, and discards unrecognized output', async () => {
-    const hash = (file: string) => createHash('sha256').update(readFileSync(file)).digest('hex');
-    const exeHash = hash(executable);
-    const sourceHash = hash(source);
-    const input = observation();
-    const execute = ((command: string, args: string[], options: any) => {
-      expect(command).toBe(executable); expect(args).toEqual([]);
-      expect(options.timeout).toBeGreaterThan(0); expect(options.timeout).toBeLessThanOrEqual(5000);
-      expect(options.killSignal).toBe('SIGKILL'); expect(options.maxBuffer).toBe(16 * 1024);
-      return { status: 0, stdout: JSON.stringify(input), stderr: 'private diagnostic text' };
-    }) as typeof spawnSync;
-    const result = await runGuiReadiness(executable, exeHash, source, sourceHash, false, { HOME: root }, 5000, execute);
-    expect(result.available).toBe(true);
-    expect(JSON.stringify(result)).not.toContain('private diagnostic');
-    await expect(runGuiReadiness(executable, 'c'.repeat(64), source, sourceHash, false, {}, 5000, execute)).rejects.toThrow('gui_readiness_inputs_changed');
-    const malformed = (() => ({ status: 0, stdout: JSON.stringify({ ...input, username: 'private-name' }), stderr: '' })) as typeof spawnSync;
-    expect((await runGuiReadiness(executable, exeHash, source, sourceHash, false, {}, 5000, malformed)).available).toBe(false);
-    for (const timeout of [0, NaN, Infinity]) await expect(runGuiReadiness(executable, exeHash, source, sourceHash, false, {}, timeout, execute)).rejects.toThrow('gui_readiness_budget_exhausted');
-  });
-
-  test('the readiness launcher loads without node_modules or Playwright and rejects conflicting CLI modes', () => {
-    const directory = path.join(root, 'no-dependencies/.github/scripts');
-    mkdirSync(directory, { recursive: true });
-    for (const file of ['run-dia-native-qualification.ts', 'qualify-dia-macos.ts']) copyFileSync(path.resolve(import.meta.dir, '../../.github/scripts', file), path.join(directory, file));
-    for (const args of [['--gui-readiness-only'], ['--gui-readiness-only', '--launch-comparison', 'node']]) {
-      const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros', '--config=/dev/null', path.join(directory, 'run-dia-native-qualification.ts'), ...args],
-        { cwd: root, env: { HOME: root, PATH: '/usr/bin:/bin' }, encoding: 'utf8', timeout: 5000 });
-      expect(result.status).toBe(2); expect(result.stderr).toBe('');
-      expect(JSON.parse(result.stdout).reason).toBe('fresh_account_launcher_preflight_failed');
-    }
-  });
-});