@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/test/server-flush-trackers.test.ts

@@ -1,73 +0,0 @@
-/**
- * Regression: flushBuffers state-tracker declaration audit.
- *
- * `flushBuffers()` (server.ts) maintains per-buffer cursors so it only
- * appends *new* entries to each on-disk log on every interval tick:
- *
- *   const newConsoleCount  = consoleBuffer.totalAdded  - lastConsoleFlushed;
- *   const newNetworkCount  = networkBuffer.totalAdded  - lastNetworkFlushed;
- *   const newDialogCount   = dialogBuffer.totalAdded   - lastDialogFlushed;
- *
- * The trackers must be declared with `let X = 0;` at module scope so the
- * subtraction returns a real number on the first tick. If a tracker is
- * referenced inside flushBuffers but never declared at module scope, the
- * interval throws `ReferenceError: X is not defined` every second — the
- * throw is swallowed by the catch at the bottom of flushBuffers (logged
- * as `[browse] Buffer flush failed: <name> is not defined`), the
- * corresponding on-disk log file is *never written*, and the regression
- * is silent in production.
- *
- * This source-level guard catches that exact class of regression — a
- * future flush-perf refactor that adds a fourth buffer cursor (or a
- * future contributor that copy-pastes the `last*Flushed` pattern without
- * the matching declaration) will fail this test before it ships.
- *
- * Pattern matches `terminal-agent.test.ts` and `dual-listener.test.ts`:
- * read source as text, assert an invariant, no daemon required.
- */
-
-import { describe, test, expect } from 'bun:test';
-import { readFileSync } from 'fs';
-import * as path from 'path';
-
-const SERVER_TS = readFileSync(
-  path.resolve(import.meta.dir, '../src/server.ts'),
-  'utf-8',
-);
-
-describe('server.ts — flushBuffers tracker declarations', () => {
-  test('every `last*Flushed` tracker referenced inside flushBuffers is declared at module scope', () => {
-    // Locate the flushBuffers function body. The function is `async function
-    // flushBuffers() { ... }` — match through the closing brace at the start
-    // of a line (one-level-deep function in the file).
-    const fnMatch = SERVER_TS.match(
-      /async function flushBuffers\([^)]*\)[^{]*\{([\s\S]*?)\n\}/,
-    );
-    expect(fnMatch, 'flushBuffers function not found in server.ts').not.toBeNull();
-    const body = fnMatch![1]!;
-
-    // Pull every identifier matching the `lastXxxFlushed` cursor pattern.
-    const trackerMatches = [...body.matchAll(/\blast([A-Z]\w+)Flushed\b/g)];
-    const trackers = Array.from(new Set(trackerMatches.map((m) => `last${m[1]}Flushed`)));
-
-    expect(
-      trackers.length,
-      'flushBuffers should reference at least one last*Flushed tracker',
-    ).toBeGreaterThan(0);
-
-    for (const tracker of trackers) {
-      // Module-level `let X = 0;` declaration (not inside a function body).
-      // Anchored start-of-line to avoid matching nested re-declarations or
-      // string literals.
-      const declared = new RegExp(
-        `(?:^|\\n)let\\s+${tracker}\\s*=\\s*0\\s*;`,
-      ).test(SERVER_TS);
-      expect(
-        declared,
-        `\`${tracker}\` is referenced inside flushBuffers but never declared at module scope ` +
-          `with \`let ${tracker} = 0;\` — the interval will throw ReferenceError every tick ` +
-          `and the corresponding on-disk log will never be written`,
-      ).toBe(true);
-    }
-  });
-});

package/.agent/skills/gstack-browse/test/server-launch-resolution.test.ts

@@ -1,49 +0,0 @@
-/**
- * E4 (#2439): the CLI resolves its server script only when it starts a
- * server. A Windows minimal runtime ships browse.exe + server-node.mjs and no
- * browse/src/server.ts, which used to make every command fail at import.
- */
-import { describe, expect, test } from 'bun:test';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { resolveServerLaunch } from '../src/cli';
-
-function withRuntime<T>(files: string[], fn: (dir: string) => T): T {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'browse-runtime-'));
-  try {
-    for (const f of files) fs.writeFileSync(path.join(dir, f), '// stub\n');
-    return fn(dir);
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-const COMPILED_META = path.join(os.tmpdir(), '$bunfs', 'root');
-
-describe('resolveServerLaunch', () => {
-  test('Windows minimal runtime starts the adjacent Node bundle without server.ts', () => {
-    withRuntime(['server-node.mjs'], (dir) => {
-      expect(resolveServerLaunch('win32', {}, COMPILED_META, path.join(dir, 'browse.exe')))
-        .toEqual({ runtime: 'node', script: path.join(dir, 'server-node.mjs') });
-    });
-  });
-
-  test('Windows without the Node bundle names the build fix', () => {
-    withRuntime([], (dir) => {
-      expect(() => resolveServerLaunch('win32', {}, COMPILED_META, path.join(dir, 'browse.exe')))
-        .toThrow('server-node.mjs not found. Run `bun run build`');
-    });
-  });
-
-  test('macOS/Linux start server.ts with Bun, honoring BROWSE_SERVER_SCRIPT', () => {
-    expect(resolveServerLaunch('linux', { BROWSE_SERVER_SCRIPT: 'custom-server.ts' }, COMPILED_META, ''))
-      .toEqual({ runtime: 'bun', script: 'custom-server.ts' });
-  });
-
-  test('importing the CLI resolves nothing: a missing server is reported only when one is started', () => {
-    const src = fs.readFileSync(path.join(import.meta.dir, '..', 'src', 'cli.ts'), 'utf-8');
-    expect(src).not.toMatch(/^const \w+ = resolve(Server|NodeServer)\w*\(/m);
-    expect(src).toMatch(/async function startServer\([^)]*\)[^{]*\{\n\s*const server = resolveServerLaunch\(\);/);
-  });
-});

package/.agent/skills/gstack-browse/test/server-lock-errors.test.ts

@@ -1,124 +0,0 @@
-/**
- * acquireServerLock error honesty (#1084 regression).
- *
- * The old code wrapped fs.openSync(lockPath, 'wx') in a bare `catch {}` —
- * EVERY errno (EACCES, EIO, ENOSPC, ENOENT) fell into the "lock already
- * held" path and surfaced as "another instance is starting the server",
- * a phantom 15s contention timeout that masked the real filesystem error.
- *
- * New contract:
- *   - EEXIST + live holder  → null (real contention)
- *   - EEXIST + dead holder  → stale lock removed, acquired
- *   - ENOENT (dir missing)  → create dir, retry once, acquired
- *   - anything else         → ServerLockError with the real errno
- */
-
-import { describe, test, expect, afterAll } from 'bun:test';
-import { canRevokeWrites } from '../../test/helpers/fs-caps';
-import * as fs from 'fs';
-// Default (CJS) export — its properties are mutable in Bun, unlike the frozen
-// `* as fs` namespace, and mutations propagate to cli.ts's own fs import.
-// Used only for the depth-cap livelock simulations below (restored in finally).
-import fsMutable from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { acquireServerLock, ServerLockError } from '../src/cli';
-
-const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'browse-lock-'));
-afterAll(() => {
-  // Restore write perm so cleanup can delete the read-only dir.
-  try { fs.chmodSync(path.join(tmpRoot, 'rodir'), 0o700); } catch {}
-  fs.rmSync(tmpRoot, { recursive: true, force: true });
-});
-
-describe('acquireServerLock (#1084 error honesty)', () => {
-  test('happy path: acquires and releases', () => {
-    const lockPath = path.join(tmpRoot, 'happy.lock');
-    const release = acquireServerLock(lockPath);
-    expect(release).not.toBeNull();
-    expect(fs.readFileSync(lockPath, 'utf8').trim()).toBe(String(process.pid));
-    release!();
-    expect(fs.existsSync(lockPath)).toBe(false);
-  });
-
-  test('EACCES throws ServerLockError with the real errno — NOT phantom contention', () => {
-    if (!canRevokeWrites()) return; // chmod is advisory here (win32, root, DAC-override containers)
-    const rodir = path.join(tmpRoot, 'rodir');
-    fs.mkdirSync(rodir, { recursive: true });
-    fs.chmodSync(rodir, 0o500); // r-x: open('wx') inside fails EACCES
-    const lockPath = path.join(rodir, 'browse.json.lock');
-    let thrown: any = null;
-    try {
-      acquireServerLock(lockPath); // old code: returned null (phantom contention)
-    } catch (err) {
-      thrown = err;
-    }
-    expect(thrown).toBeInstanceOf(ServerLockError);
-    expect(thrown.code).toBe('EACCES');
-    expect(thrown.message).toContain('E_SERVER_LOCK (EACCES)');
-    expect(thrown.message).toContain(lockPath);
-  });
-
-  test('ENOENT (missing lock dir) creates the dir and acquires', () => {
-    const lockPath = path.join(tmpRoot, 'newdir', 'browse.json.lock');
-    // old code: openSync ENOENT → bare catch → readFileSync ENOENT → null
-    const release = acquireServerLock(lockPath);
-    expect(release).not.toBeNull();
-    expect(fs.existsSync(lockPath)).toBe(true);
-    release!();
-  });
-
-  test('EEXIST + dead holder: removes stale lock and acquires', () => {
-    const lockPath = path.join(tmpRoot, 'stale.lock');
-    fs.writeFileSync(lockPath, '999999999\n'); // PID that cannot be alive
-    const release = acquireServerLock(lockPath);
-    expect(release).not.toBeNull();
-    release!();
-  });
-
-  test('EEXIST + live holder: returns null (real contention, no throw)', () => {
-    const lockPath = path.join(tmpRoot, 'live.lock');
-    fs.writeFileSync(lockPath, `${process.pid}\n`); // this test process is alive
-    expect(acquireServerLock(lockPath)).toBeNull();
-    fs.unlinkSync(lockPath);
-  });
-
-  test('EEXIST + garbage lockfile content: NaN pid is treated as stale, lock acquired', () => {
-    const lockPath = path.join(tmpRoot, 'garbage.lock');
-    fs.writeFileSync(lockPath, 'not-a-pid\n'); // parseInt → NaN → falsy → stale path
-    const release = acquireServerLock(lockPath);
-    expect(release).not.toBeNull();
-    // Our pid replaced the garbage — the stale lock was removed and re-acquired.
-    expect(fs.readFileSync(lockPath, 'utf8').trim()).toBe(String(process.pid));
-    release!();
-    expect(fs.existsSync(lockPath)).toBe(false);
-  });
-
-  // NOTE: the "stale lock that survives unlink" livelock variant is deliberately
-  // not simulated here — the source removes locks through safeUnlink's own fs
-  // binding, which a test-side fs monkey-patch cannot reliably intercept in Bun.
-  // The depth cap itself is exercised by the vanish-race test below.
-
-  test('depth cap: holder that vanishes between open and read returns null after 5 retries', () => {
-    // The EEXIST → readFileSync ENOENT race: the lock exists at openSync but
-    // is gone by the read (holder released in between). Repeated forever
-    // (open/release storm), the same depth cap must bound the retry loop.
-    const lockPath = path.join(tmpRoot, 'vanish.lock');
-    fs.writeFileSync(lockPath, `${process.pid}\n`);
-    const origRead = fsMutable.readFileSync;
-    try {
-      (fsMutable as any).readFileSync = (p: fs.PathLike | number, ...rest: unknown[]) => {
-        if (p === lockPath) {
-          const e: NodeJS.ErrnoException = new Error('mock: lock vanished before read');
-          e.code = 'ENOENT';
-          throw e;
-        }
-        return (origRead as any)(p, ...rest);
-      };
-      expect(acquireServerLock(lockPath)).toBeNull();
-    } finally {
-      (fsMutable as any).readFileSync = origRead;
-      fs.unlinkSync(lockPath);
-    }
-  });
-});

package/.agent/skills/gstack-browse/test/server-no-import-side-effects.test.ts

@@ -1,110 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-import * as path from 'path';
-import * as os from 'os';
-import * as fs from 'fs';
-
-/**
- * Guard the core refactor invariant: importing browse/src/server.ts must NOT
- * auto-start. Before this PR, the module called `start().catch(...)` at module
- * load time, which made the file impossible for embedders (gbrowser phoenix
- * overlay) to import without spawning a daemon. The fix wraps that kickoff in
- * `if (import.meta.main)` so the side effects only run when the module is the
- * process entry point.
- *
- * Approach: spawn a fresh Bun subprocess that imports the module and emits a
- * structured snapshot (initial vs post-import process state). Parent asserts
- * that no listeners were bound, no Bun.serve started, and no SIGINT handlers
- * were registered. The subprocess uses HOME=tmp + GSTACK_HOME=tmp so any
- * accidental state-dir write lands in a place we can verify is empty.
- */
-describe('server.ts module import has no auto-start side effects', () => {
-  test('importing server.ts does not bind Bun.serve, register signal handlers, or write state', async () => {
-    const tmpHome = path.join(os.tmpdir(), `browse-no-sfx-${Date.now()}-${process.pid}`);
-    fs.mkdirSync(tmpHome, { recursive: true });
-    const tmpGstack = path.join(tmpHome, '.gstack');
-
-    const childScript = `
-const sigintBefore = process.listenerCount('SIGINT');
-const sigtermBefore = process.listenerCount('SIGTERM');
-const uncaughtBefore = process.listenerCount('uncaughtException');
-
-// Snapshot any keys that look like our state path.
-const fs = require('fs');
-const path = require('path');
-
-await import(${JSON.stringify(path.resolve(import.meta.dir, '../src/server.ts'))});
-
-// After import, sleep a tick so any setTimeout(0)-style init can run.
-await new Promise(r => setTimeout(r, 50));
-
-const sigintAfter = process.listenerCount('SIGINT');
-const sigtermAfter = process.listenerCount('SIGTERM');
-const uncaughtAfter = process.listenerCount('uncaughtException');
-
-// Check that the gstack home directory wasn't populated as a side effect.
-// A lone \`.gitignore\` (the state-dir ignore guard, contents "*") is expected
-// and is NOT leaked state — ensureStateDir writes it so persisted cookies/logs
-// can never be git-committed. Any OTHER entry (browse.json, session-state.json,
-// logs) would be a real auto-start write and must still fail the guard.
-let gstackPopulated = false;
-try {
-  const entries = fs.readdirSync(${JSON.stringify(tmpGstack)}).filter(e => e !== '.gitignore');
-  gstackPopulated = entries.length > 0;
-} catch {
-  // Doesn't exist — that's the win we want.
-}
-
-console.log(JSON.stringify({
-  sigintBefore, sigintAfter,
-  sigtermBefore, sigtermAfter,
-  uncaughtBefore, uncaughtAfter,
-  gstackPopulated,
-}));
-// Force exit so any background intervals don't keep this child alive
-// (the test framework would see a hang otherwise — which itself is a
-// signal that side effects DID run).
-process.exit(0);
-`;
-
-    const proc = Bun.spawn(['bun', '-e', childScript], {
-      env: {
-        ...process.env,
-        HOME: tmpHome,
-        GSTACK_HOME: tmpGstack,
-        // Empty so the AUTH_TOKEN env path doesn't deterministically set a token.
-        AUTH_TOKEN: '',
-        // Force a stub state file so resolveConfig() at module load (if it
-        // happens) won't crawl the host's real .gstack/.
-        BROWSE_STATE_FILE: path.join(tmpGstack, 'browse.json'),
-      },
-      stdout: 'pipe',
-      stderr: 'pipe',
-    });
-
-    const stdout = await new Response(proc.stdout).text();
-    const stderr = await new Response(proc.stderr).text();
-    await proc.exited;
-
-    // The last JSON line in stdout is our snapshot.
-    const jsonLine = stdout.trim().split('\n').filter(l => l.startsWith('{')).pop();
-    expect(jsonLine, `child stderr: ${stderr}`).toBeDefined();
-
-    const snapshot = JSON.parse(jsonLine!);
-
-    // No new signal handlers registered (gated on import.meta.main, which
-    // is false in the subprocess because `bun -e` is the entry point).
-    expect(snapshot.sigintAfter).toBe(snapshot.sigintBefore);
-    expect(snapshot.sigtermAfter).toBe(snapshot.sigtermBefore);
-    expect(snapshot.uncaughtAfter).toBe(snapshot.uncaughtBefore);
-
-    // gstack home should remain empty — initRegistry/initAuditLog/etc. side
-    // effects from module load are acceptable (they happen at module level),
-    // but only insofar as they don't bind listeners or write project state.
-    // The presence/absence test here proves we didn't bind Bun.serve (which
-    // would also try to write the state file).
-    expect(snapshot.gstackPopulated).toBe(false);
-
-    // Cleanup
-    try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch { /* best effort */ }
-  }, 30_000);
-});

package/.agent/skills/gstack-browse/test/server-proxy-fail-fast.test.ts

@@ -1,98 +0,0 @@
-/**
- * Integration test: server.ts startup fail-fast on bad SOCKS5 upstream.
- *
- * Spawns the actual server.ts with BROWSE_PROXY_URL pointing at a port
- * that listens but rejects every CONNECT. Asserts:
- *   - exit code 1
- *   - stderr contains "FAIL upstream" (proof the testUpstream pre-flight ran)
- *   - stderr does NOT contain raw credentials (proof redaction works on
- *     the failure path)
- *   - exits within the 5s budget + retry overhead
- */
-
-import { describe, test, expect } from 'bun:test';
-import { spawn } from 'child_process';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import * as net from 'net';
-
-async function startRejectingUpstream(): Promise<{ port: number; close: () => Promise<void> }> {
-  // Accepts TCP connections, completes the SOCKS5 username/password auth
-  // handshake by REJECTING (status 0x01), then closes. Our testUpstream()
-  // should retry 3x and exhaust within ~5s.
-  const server = net.createServer((sock) => {
-    sock.once('data', (greeting) => {
-      if (greeting[0] !== 0x05) { sock.destroy(); return; }
-      const methods = greeting.subarray(2, 2 + greeting[1]);
-      if (!methods.includes(0x02)) { sock.write(Buffer.from([0x05, 0xFF])); sock.destroy(); return; }
-      sock.write(Buffer.from([0x05, 0x02]));
-      sock.once('data', () => {
-        // Reject auth (0x01)
-        try { sock.write(Buffer.from([0x01, 0x01])); } catch { /* peer gone */ }
-        sock.destroy();
-      });
-    });
-    sock.on('error', () => sock.destroy());
-  });
-  await new Promise<void>((resolve, reject) => {
-    server.once('error', reject);
-    server.listen(0, '127.0.0.1', () => resolve());
-  });
-  const addr = server.address();
-  if (!addr || typeof addr === 'string') throw new Error('rejecting upstream: bad address');
-  return {
-    port: addr.port,
-    close: () => new Promise((r) => server.close(() => r())),
-  };
-}
-
-describe('server fail-fast on bad SOCKS5 upstream', () => {
-  test('exits 1 with redacted error within budget', async () => {
-    const upstream = await startRejectingUpstream();
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'browse-fail-fast-'));
-    const stateFile = path.join(tmpDir, 'browse.json');
-
-    const serverPath = path.resolve(__dirname, '../src/server.ts');
-    const env: Record<string, string> = {};
-    for (const [k, v] of Object.entries(process.env)) {
-      if (v !== undefined) env[k] = v;
-    }
-    env.BROWSE_STATE_FILE = stateFile;
-    env.BROWSE_PARENT_PID = '0'; // disable watchdog so we can isolate the proxy failure
-    env.BROWSE_HEADLESS_SKIP = '1'; // skip the chromium launch (we only test the proxy gate)
-    env.BROWSE_PROXY_URL = `socks5://baduser:badpass@127.0.0.1:${upstream.port}`;
-
-    const start = Date.now();
-    const result = await new Promise<{ code: number; stdout: string; stderr: string; ms: number }>((resolve) => {
-      const proc = spawn('bun', ['run', serverPath], {
-        timeout: 30000,
-        env,
-      });
-      let stdout = ''; let stderr = '';
-      proc.stdout.on('data', (d) => stdout += d.toString());
-      proc.stderr.on('data', (d) => stderr += d.toString());
-      proc.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr, ms: Date.now() - start }));
-    });
-
-    try {
-      // Expectation 1: exit 1
-      expect(result.code).toBe(1);
-      // Expectation 2: stderr names the failure mode and references the upstream
-      const combined = result.stdout + result.stderr;
-      expect(combined).toMatch(/FAIL upstream/);
-      // Expectation 3: redaction. Raw 'baduser' and 'badpass' must NEVER
-      // appear in any output, even on the failure path.
-      expect(combined).not.toContain('baduser');
-      expect(combined).not.toContain('badpass');
-      // Expectation 4: budget. testUpstream caps at 5s plus a small amount
-      // of script startup overhead (~3-5s for `bun run`). Cap at 30s as a
-      // generous upper bound so the assertion is meaningful but not flaky.
-      expect(result.ms).toBeLessThan(30000);
-    } finally {
-      await upstream.close();
-      try { fs.unlinkSync(stateFile); } catch { /* ignore */ }
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-  }, 60000);
-});

package/.agent/skills/gstack-browse/test/server-pty-lease-routes.test.ts

@@ -1,156 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-import { stubRouteContext, callRoute } from './route-test-harness';
-import { mintLease, validateLease } from '../src/pty-session-lease';
-import { validatePtySessionToken } from '../src/pty-session-cookie';
-import type { RouteContext } from '../src/routes/table';
-
-// Server-side route behavior for the v1.44 lease + restart + dispose +
-// lease-refresh wiring. The routes reach the terminal-agent only through
-// RouteContext.terminal, so a stub records every grant and restart the
-// daemon would send over loopback. The loopback helpers themselves
-// (grantPtyToken / restartPtySession in server.ts) keep source tripwires.
-
-const SERVER_TS = path.resolve(import.meta.path, '..', '..', 'src', 'server.ts');
-const ROOT = 'lease-routes-root-token-0123456789';
-
-function terminalContext(port: number | null = 4242, granted = true) {
-  const grants: Array<{ token: string; sessionId?: string }> = [];
-  const restarts: string[] = [];
-  let idleResets = 0;
-  const ctx = stubRouteContext({
-    isRootTokenValue: (token) => token === ROOT,
-    resetIdleTimer: () => { idleResets++; },
-    terminal: {
-      readPort: () => port,
-      grantToken: async (token, sessionId) => { grants.push({ token, sessionId }); return granted; },
-      restartSession: async (sessionId) => { restarts.push(sessionId); return true; },
-    },
-  });
-  return { ctx, grants, restarts, idleResets: () => idleResets };
-}
-
-async function post(ctx: RouteContext, route: string, body?: unknown, headers?: Record<string, string>) {
-  const resp = await callRoute('POST', route, ctx, { body, headers });
-  return { status: resp.status, body: await resp.json() as any, headers: resp.headers };
-}
-
-describe('server: PTY lease routes (v1.44+ Commit 2)', () => {
-  test('1. /pty-session returns the 4-tuple shape (sessionId, attachToken, leaseExpiresAt)', async () => {
-    const t = terminalContext();
-    const resp = await post(t.ctx, '/pty-session');
-    expect(resp.status).toBe(200);
-    expect(resp.body.terminalPort).toBe(4242);
-    expect(validateLease(resp.body.sessionId).ok).toBe(true);
-    expect(resp.body.leaseExpiresAt).toBeGreaterThan(Date.now());
-    // The attach token is granted to the agent bound to the new sessionId.
-    expect(t.grants).toEqual([{ token: resp.body.attachToken, sessionId: resp.body.sessionId }]);
-    expect(validatePtySessionToken(resp.body.attachToken)).toBe(true);
-    // Backward compat: legacy ptySessionToken alias preserved for one release.
-    expect(resp.body.ptySessionToken).toBe(resp.body.attachToken);
-    expect(resp.headers.get('set-cookie')).toContain(resp.body.attachToken);
-
-    const notReady = await post(terminalContext(null).ctx, '/pty-session');
-    expect(notReady).toMatchObject({ status: 503, body: { error: 'terminal-agent not ready' } });
-    const refused = terminalContext(4242, false);
-    const failed = await post(refused.ctx, '/pty-session');
-    expect(failed).toMatchObject({ status: 503, body: { error: 'failed to grant terminal session' } });
-    // A refused grant revokes both the token and the lease it minted.
-    expect(validatePtySessionToken(refused.grants[0].token)).toBe(false);
-    expect(validateLease(refused.grants[0].sessionId!).ok).toBe(false);
-  });
-
-  test('2. /pty-session/reattach validates lease + mints fresh attachToken', async () => {
-    const t = terminalContext();
-    // Validate-first: rejects unknown/expired sessionId with 410 Gone so
-    // the client knows to fall back to a fresh /pty-session.
-    expect(await post(t.ctx, '/pty-session/reattach', { sessionId: 'no-such-session' }))
-      .toMatchObject({ status: 410, body: { error: 'lease expired or unknown' } });
-    expect(await post(t.ctx, '/pty-session/reattach', {})).toMatchObject({ status: 410 });
-    expect(t.grants).toEqual([]);
-    // Mint fresh token bound to SAME sessionId.
-    const lease = mintLease();
-    const resp = await post(t.ctx, '/pty-session/reattach', { sessionId: lease.sessionId });
-    expect(resp.status).toBe(200);
-    expect(resp.body.sessionId).toBe(lease.sessionId);
-    expect(t.grants).toEqual([{ token: resp.body.attachToken, sessionId: lease.sessionId }]);
-  });
-
-  test('3. /pty-restart is one transaction — dispose + revoke + fresh mint', async () => {
-    const t = terminalContext();
-    const old = mintLease();
-    const resp = await post(t.ctx, '/pty-restart', { sessionId: old.sessionId });
-    // Disposes the old session on the agent and revokes its lease...
-    expect(t.restarts).toEqual([old.sessionId]);
-    expect(validateLease(old.sessionId).ok).toBe(false);
-    // ...then returns a fresh 4-tuple from the same handler, so the client
-    // doesn't need a separate /pty-session round-trip.
-    expect(resp.status).toBe(200);
-    expect(resp.body.sessionId).not.toBe(old.sessionId);
-    expect(validateLease(resp.body.sessionId).ok).toBe(true);
-    expect(t.grants).toEqual([{ token: resp.body.attachToken, sessionId: resp.body.sessionId }]);
-    expect(resp.body.leaseExpiresAt).toBeGreaterThan(Date.now());
-    // Missing sessionId is non-fatal: no dispose, fresh mint still happens.
-    const fresh = terminalContext();
-    expect((await post(fresh.ctx, '/pty-restart', {})).status).toBe(200);
-    expect(fresh.restarts).toEqual([]);
-  });
-
-  test('4. /pty-dispose accepts body-token (sendBeacon-compatible)', async () => {
-    // sendBeacon can't set custom headers, so the route MUST accept the
-    // auth token in the request body — and both paths must match the root
-    // token, never just trust a body-supplied value.
-    const lease = mintLease();
-    const t = terminalContext();
-    expect(await post(t.ctx, '/pty-dispose', { authToken: ROOT, sessionId: lease.sessionId }))
-      .toMatchObject({ status: 200, body: { ok: true } });
-    expect(t.restarts).toEqual([lease.sessionId]);
-    expect(validateLease(lease.sessionId).ok).toBe(false);
-    expect(await post(t.ctx, '/pty-dispose', {}, { Authorization: `Bearer ${ROOT}` })).toMatchObject({ status: 200 });
-    for (const [body, headers] of [
-      [{ authToken: 'not-the-root-token', sessionId: 'x' }, undefined],
-      [{ sessionId: 'x' }, { Authorization: 'Bearer not-the-root-token' }],
-      [{ sessionId: 'x' }, undefined],
-    ] as const) {
-      expect(await post(t.ctx, '/pty-dispose', body, headers as any)).toMatchObject({ status: 401, body: { error: 'Unauthorized' } });
-    }
-    expect(t.restarts).toEqual([lease.sessionId]);
-  });
-
-  test('5. /internal/lease-refresh resets the daemon idle timer (T6)', async () => {
-    const t = terminalContext();
-    // Refresh failure (unknown / expired) MUST 410, not 200, so the agent
-    // knows to close the WS and force a clean re-auth.
-    expect(await post(t.ctx, '/internal/lease-refresh', { sessionId: 'no-such-session' }))
-      .toMatchObject({ status: 410, body: { error: 'lease expired or unknown' } });
-    expect(t.idleResets()).toBe(0);
-    const lease = mintLease();
-    const resp = await post(t.ctx, '/internal/lease-refresh', { sessionId: lease.sessionId });
-    expect(resp.status).toBe(200);
-    expect(resp.body.ok).toBe(true);
-    expect(resp.body.expiresAt).toBeGreaterThanOrEqual(lease.expiresAt);
-    expect(t.idleResets()).toBe(1);
-  });
-
-  test('6. grantPtyToken loopback carries sessionId binding', () => {
-    const src = fs.readFileSync(SERVER_TS, 'utf-8');
-    expect(src).toMatch(/grantPtyToken\(token: string, sessionId\?: string\)/);
-    expect(src).toContain('sessionId ? { token, sessionId } : { token }');
-  });
-
-  test('7. restartPtySession helper exists and POSTs the agent /internal/restart', () => {
-    const src = fs.readFileSync(SERVER_TS, 'utf-8');
-    expect(src).toMatch(/async function restartPtySession\(sessionId: string\)/);
-    expect(src).toContain('/internal/restart');
-    expect(src).toContain('JSON.stringify({ sessionId })');
-  });
-});
-
-function sliceBetween(source: string, start: string, end: string): string {
-  const i = source.indexOf(start);
-  if (i === -1) throw new Error(`marker not found: ${start}`);
-  const j = source.indexOf(end, i + start.length);
-  if (j === -1) throw new Error(`end marker not found: ${end}`);
-  return source.slice(i, j);
-}