@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/test/tab-each.test.ts

@@ -1,196 +0,0 @@
-/**
- * tab-each — fan-out command for the live Terminal pane.
- *
- * Source-level guards: command is registered, has a description + usage,
- * scope-check the inner command, restore the original active tab in a
- * finally block (so a mid-batch exception doesn't leave the user looking
- * at a tab they didn't choose).
- *
- * Behavioral logic test: drive handleMetaCommand directly with a mock
- * BrowserManager + executeCommand callback. Verify the iteration order,
- * the JSON shape, the tab restore, and the chrome:// skip.
- */
-
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-import { handleMetaCommand } from '../src/meta-commands';
-import { META_COMMANDS, COMMAND_DESCRIPTIONS } from '../src/commands';
-
-const META_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/meta-commands.ts'), 'utf-8');
-
-describe('tab-each: registration', () => {
-  test('command is in META_COMMANDS', () => {
-    expect(META_COMMANDS.has('tab-each')).toBe(true);
-  });
-
-  test('has a description and usage entry', () => {
-    expect(COMMAND_DESCRIPTIONS['tab-each']).toBeDefined();
-    expect(COMMAND_DESCRIPTIONS['tab-each'].usage).toContain('tab-each');
-    expect(COMMAND_DESCRIPTIONS['tab-each'].category).toBe('Tabs');
-  });
-});
-
-describe('tab-each: source-level guards', () => {
-  test('scope-checks the inner command before fanning out', () => {
-    const block = META_SRC.slice(META_SRC.indexOf("case 'tab-each':"));
-    expect(block).toContain('checkScope(tokenInfo, innerName)');
-    // The scope check must run BEFORE the for-loop. If it ran inside the
-    // loop, a permission failure on the second tab would leave the first
-    // tab already mutated.
-    const checkIdx = block.indexOf('checkScope(tokenInfo, innerName)');
-    const loopIdx = block.indexOf('for (const tab of tabs)');
-    expect(checkIdx).toBeLessThan(loopIdx);
-  });
-
-  test('restores the original active tab in a finally block', () => {
-    const block = META_SRC.slice(META_SRC.indexOf("case 'tab-each':"), META_SRC.indexOf("case 'tab-each':") + 4000);
-    expect(block).toContain('finally');
-    expect(block).toContain('originalActive');
-    expect(block).toContain('switchTab(originalActive');
-  });
-
-  test('uses bringToFront: false so the OS window does NOT jump', () => {
-    const block = META_SRC.slice(META_SRC.indexOf("case 'tab-each':"), META_SRC.indexOf("case 'tab-each':") + 4000);
-    // tab-each is a background operation — pulling focus would steal the
-    // user's foreground app every time claude fans out, which is
-    // unacceptable.
-    expect(block).toContain('bringToFront: false');
-  });
-
-  test('skips chrome:// and chrome-extension:// internal pages', () => {
-    const block = META_SRC.slice(META_SRC.indexOf("case 'tab-each':"), META_SRC.indexOf("case 'tab-each':") + 4000);
-    expect(block).toContain("startsWith('chrome://')");
-    expect(block).toContain("startsWith('chrome-extension://')");
-  });
-});
-
-describe('tab-each: behavior', () => {
-  function mockBm(tabs: Array<{ id: number; url: string; title: string; active: boolean }>) {
-    let activeId = tabs.find(t => t.active)?.id ?? tabs[0]?.id ?? 0;
-    const switched: number[] = [];
-    return {
-      __switched: switched,
-      __activeId: () => activeId,
-      getActiveSession: () => ({}),
-      getActiveTabId: () => activeId,
-      getTabListWithTitles: async () => tabs.map(t => ({ ...t })),
-      switchTab: (id: number, _opts?: any) => { switched.push(id); activeId = id; },
-    } as any;
-  }
-
-  test('iterates every tab, calls executeCommand for each, returns JSON results', async () => {
-    const tabs = [
-      { id: 1, url: 'https://news.example.com', title: 'News', active: true },
-      { id: 2, url: 'https://docs.example.com', title: 'Docs', active: false },
-      { id: 3, url: 'https://github.com', title: 'GitHub', active: false },
-    ];
-    const bm = mockBm(tabs);
-    const calls: Array<{ command: string; args?: string[]; tabId?: number }> = [];
-    const out = await handleMetaCommand(
-      'tab-each',
-      ['snapshot', '-i'],
-      bm,
-      async () => {},
-      null,
-      {
-        executeCommand: async (body) => {
-          calls.push(body);
-          return { status: 200, result: `snap-of-${body.tabId}` };
-        },
-      },
-    );
-
-    const parsed = JSON.parse(out);
-    expect(parsed.command).toBe('snapshot');
-    expect(parsed.args).toEqual(['-i']);
-    expect(parsed.total).toBe(3);
-    expect(parsed.results.map((r: any) => r.tabId)).toEqual([1, 2, 3]);
-    expect(parsed.results.every((r: any) => r.status === 200)).toBe(true);
-    expect(parsed.results[0].output).toBe('snap-of-1');
-
-    // Inner command was dispatched 3 times, once per tab, with the right tabId.
-    expect(calls).toHaveLength(3);
-    expect(calls.map(c => c.tabId)).toEqual([1, 2, 3]);
-    expect(calls.every(c => c.command === 'snapshot')).toBe(true);
-  });
-
-  test('skips chrome:// pages with status=0 + "skipped" output', async () => {
-    const tabs = [
-      { id: 1, url: 'chrome://newtab', title: 'New Tab', active: true },
-      { id: 2, url: 'https://example.com', title: 'Example', active: false },
-      { id: 3, url: 'chrome-extension://abc/page.html', title: 'Ext', active: false },
-    ];
-    const bm = mockBm(tabs);
-    const calls: any[] = [];
-    const out = await handleMetaCommand(
-      'tab-each',
-      ['text'],
-      bm,
-      async () => {},
-      null,
-      {
-        executeCommand: async (body) => {
-          calls.push(body);
-          return { status: 200, result: `text-of-${body.tabId}` };
-        },
-      },
-    );
-
-    const parsed = JSON.parse(out);
-    expect(parsed.total).toBe(3);
-    // chrome:// and chrome-extension:// → skipped (status 0).
-    expect(parsed.results[0].status).toBe(0);
-    expect(parsed.results[0].output).toContain('skipped');
-    expect(parsed.results[2].status).toBe(0);
-    // Only the real tab dispatched.
-    expect(calls).toHaveLength(1);
-    expect(calls[0].tabId).toBe(2);
-  });
-
-  test('restores the originally active tab even if a tab errors', async () => {
-    const tabs = [
-      { id: 10, url: 'https://a.example', title: 'A', active: false },
-      { id: 20, url: 'https://b.example', title: 'B', active: true }, // initially active
-      { id: 30, url: 'https://c.example', title: 'C', active: false },
-    ];
-    const bm = mockBm(tabs);
-    let calls = 0;
-    const out = await handleMetaCommand(
-      'tab-each',
-      ['text'],
-      bm,
-      async () => {},
-      null,
-      {
-        executeCommand: async (body) => {
-          calls++;
-          if (body.tabId === 20) {
-            return { status: 500, result: JSON.stringify({ error: 'boom' }) };
-          }
-          return { status: 200, result: `ok-${body.tabId}` };
-        },
-      },
-    );
-
-    const parsed = JSON.parse(out);
-    expect(parsed.results.find((r: any) => r.tabId === 20).status).toBe(500);
-    expect(parsed.results.find((r: any) => r.tabId === 20).output).toBe('boom');
-    expect(parsed.results.find((r: any) => r.tabId === 10).status).toBe(200);
-    expect(parsed.results.find((r: any) => r.tabId === 30).status).toBe(200);
-    // Active tab restored to 20 (the one that was active when we started).
-    expect(bm.__activeId()).toBe(20);
-  });
-
-  test('throws on empty args (no inner command)', async () => {
-    const bm = mockBm([{ id: 1, url: 'https://x.example', title: 'X', active: true }]);
-    await expect(handleMetaCommand(
-      'tab-each',
-      [],
-      bm,
-      async () => {},
-      null,
-      { executeCommand: async () => ({ status: 200, result: '' }) },
-    )).rejects.toThrow(/Usage/);
-  });
-});

package/.agent/skills/gstack-browse/test/tab-guardrail.test.ts

@@ -1,118 +0,0 @@
-import { describe, test, expect, beforeEach } from 'bun:test';
-import { BrowserManager } from '../src/browser-manager';
-import { subscribe } from '../src/activity';
-
-// Tests for the tab-count guardrail. Each threshold fires exactly once per
-// upward crossing and re-arms when the count drops back below. The toast
-// UX lives in the sidebar; this exercises the server-side audit-trail
-// invariant that an activity entry is emitted at each crossing.
-
-interface CapturedEntry {
-  type: string;
-  command?: string;
-  error?: string;
-  tabs?: number;
-}
-
-function captureGuardrailEntries(): { entries: CapturedEntry[]; unsubscribe: () => void } {
-  const entries: CapturedEntry[] = [];
-  const unsubscribe = subscribe((entry) => {
-    if (entry.command === 'tab-guardrail') {
-      entries.push({
-        type: entry.type,
-        command: entry.command,
-        error: entry.error,
-        tabs: entry.tabs,
-      });
-    }
-  });
-  return { entries, unsubscribe };
-}
-
-/** Drive the guardrail by writing directly into the manager's pages map. */
-async function setTabCount(bm: BrowserManager, n: number): Promise<void> {
-  // Reach into private state via index access — test-only manipulation that
-  // avoids spinning up a real Chromium just to verify the threshold math.
-  const inner = bm as unknown as {
-    pages: Map<number, unknown>;
-    checkTabGuardrails: () => void;
-    recheckTabGuardrailsOnClose: () => void;
-  };
-  inner.pages.clear();
-  for (let i = 0; i < n; i++) inner.pages.set(i, { fakeTab: true });
-  // Drive whichever direction matches the count change.
-  inner.checkTabGuardrails();
-  inner.recheckTabGuardrailsOnClose();
-  // emitActivity dispatches subscribers via queueMicrotask, so let the
-  // microtask queue drain before the test assertion runs.
-  await new Promise((r) => setTimeout(r, 0));
-}
-
-describe('tab-count guardrail', () => {
-  let bm: BrowserManager;
-  let capture: ReturnType<typeof captureGuardrailEntries>;
-
-  beforeEach(() => {
-    bm = new BrowserManager();
-    capture = captureGuardrailEntries();
-  });
-
-  test('1. no entry fires under the soft threshold', async () => {
-    await setTabCount(bm, 10);
-    await setTabCount(bm, 49);
-    expect(capture.entries).toEqual([]);
-    capture.unsubscribe();
-  });
-
-  test('2. soft threshold (50) fires exactly once on upward crossing', async () => {
-    await setTabCount(bm, 49);
-    await setTabCount(bm, 50);
-    await setTabCount(bm, 51);
-    await setTabCount(bm, 60);
-    expect(capture.entries.length).toBe(1);
-    expect(capture.entries[0].tabs).toBe(50);
-    expect(capture.entries[0].error).toContain('crossed 50');
-    capture.unsubscribe();
-  });
-
-  test('3. hard threshold (200) fires exactly once on upward crossing', async () => {
-    await setTabCount(bm, 199);
-    await setTabCount(bm, 200);
-    await setTabCount(bm, 201);
-    await setTabCount(bm, 220);
-    // 0 → 199 fired the soft threshold; 199 → 200 fires the hard one once.
-    const hardEntries = capture.entries.filter((e) => e.error?.includes('crossed 200'));
-    expect(hardEntries.length).toBe(1);
-    expect(hardEntries[0].tabs).toBe(200);
-    capture.unsubscribe();
-  });
-
-  test('4. both thresholds fire in order when count jumps from 0 → 250', async () => {
-    await setTabCount(bm, 250);
-    expect(capture.entries.length).toBe(2);
-    expect(capture.entries[0].error).toContain('crossed 50');
-    expect(capture.entries[1].error).toContain('crossed 200');
-    capture.unsubscribe();
-  });
-
-  test('5. soft threshold re-arms when tab count drops below it', async () => {
-    await setTabCount(bm, 60);
-    expect(capture.entries.length).toBe(1);
-    await setTabCount(bm, 30);
-    await setTabCount(bm, 55);
-    expect(capture.entries.length).toBe(2);
-    expect(capture.entries[1].error).toContain('crossed 50');
-    capture.unsubscribe();
-  });
-
-  test('6. hard threshold re-arms when tab count drops below it', async () => {
-    await setTabCount(bm, 210);
-    const beforeReArm = capture.entries.filter((e) => e.error?.includes('crossed 200')).length;
-    expect(beforeReArm).toBe(1);
-    await setTabCount(bm, 150);
-    await setTabCount(bm, 220);
-    const afterReArm = capture.entries.filter((e) => e.error?.includes('crossed 200')).length;
-    expect(afterReArm).toBe(2);
-    capture.unsubscribe();
-  });
-});

package/.agent/skills/gstack-browse/test/tab-isolation.test.ts

@@ -1,309 +0,0 @@
-/**
- * Tab isolation tests — verify per-agent tab ownership in BrowserManager.
- *
- * These test the ownership Map and checkTabAccess() logic directly,
- * without launching a browser (pure logic tests).
- */
-
-import { describe, it, expect, beforeEach } from 'bun:test';
-import { BrowserManager } from '../src/browser-manager';
-
-// We test the ownership methods directly. BrowserManager can't call newTab()
-// without a browser, so we test the ownership map + access checks via
-// the public API that doesn't require Playwright.
-
-describe('Tab Isolation', () => {
-  let bm: BrowserManager;
-
-  beforeEach(() => {
-    bm = new BrowserManager();
-  });
-
-  describe('getTabOwner', () => {
-    it('returns null for tabs with no owner', () => {
-      expect(bm.getTabOwner(1)).toBeNull();
-      expect(bm.getTabOwner(999)).toBeNull();
-    });
-  });
-
-  describe('checkTabAccess', () => {
-    // Root token — unconstrained.
-    it('root can always access any tab (read)', () => {
-      expect(bm.checkTabAccess(1, 'root', { isWrite: false })).toBe(true);
-    });
-
-    it('root can always access any tab (write)', () => {
-      expect(bm.checkTabAccess(1, 'root', { isWrite: true })).toBe(true);
-    });
-
-    // Shared-policy tokens — local skill spawns + default scoped clients.
-    // These can read/write ANY tab (the user's natural tabs are unowned, so
-    // the bundled hackernews-frontpage skill needs to drive them). Capability
-    // is gated by scope checks + rate limits, not tab ownership. This is the
-    // contract that lets `$B skill run <name>` work end-to-end on a fresh
-    // session where the daemon's active tab has no claimed owner.
-    it('shared scoped agent can read an unowned tab', () => {
-      expect(bm.checkTabAccess(1, 'agent-1', { isWrite: false })).toBe(true);
-    });
-
-    it('shared scoped agent CAN write to an unowned tab (skill ergonomics)', () => {
-      // Pre-fix: this returned false and broke every browser-skill spawn.
-      // The user's natural tabs have no claimed owner, so the skill's first
-      // goto (a write) hit "Tab not owned by your agent". Bundled
-      // hackernews-frontpage failed identically — see commit log for
-      // v1.20.0.0.
-      expect(bm.checkTabAccess(1, 'agent-1', { isWrite: true })).toBe(true);
-    });
-
-    it('shared scoped agent can read another agent tab', () => {
-      expect(bm.checkTabAccess(1, 'agent-2', { isWrite: false })).toBe(true);
-    });
-
-    it('shared scoped agent can write to another agent tab', () => {
-      // Local trust: a skill spawn behaves like root for tab access.
-      // Parallel-skill clobber-protection is not a goal of this layer.
-      expect(bm.checkTabAccess(1, 'agent-2', { isWrite: true })).toBe(true);
-    });
-
-    // Own-only-policy tokens — pair-agent / tunnel. Strict ownership for
-    // every read and write. The v1.6.0.0 dual-listener threat model.
-    it('own-only scoped agent CANNOT read an unowned tab', () => {
-      expect(bm.checkTabAccess(1, 'agent-1', { isWrite: false, ownOnly: true })).toBe(false);
-    });
-
-    it('own-only scoped agent CANNOT write to an unowned tab', () => {
-      expect(bm.checkTabAccess(1, 'agent-1', { isWrite: true, ownOnly: true })).toBe(false);
-    });
-
-    it('own-only scoped agent can read its own tab', () => {
-      bm.transferTab = bm.transferTab.bind(bm);
-      // We can't create a real tab without a browser, but we can prime the
-      // ownership map by calling the public access check with a known
-      // owner (transferTab requires a real page; instead, simulate via
-      // private map injection through transferTab's check).
-      // Workaround: assert the read+ownership shape through a stand-in.
-      // Use the read-side claim that an agent-owned tab passes ownership
-      // checks; this is exercised end-to-end by browser-skill-commands
-      // and pair-agent tests where real tabs exist.
-      // For the unit layer: assert false-on-mismatch as the contract.
-      expect(bm.checkTabAccess(1, 'someone-else', { isWrite: false, ownOnly: true })).toBe(false);
-    });
-
-    it('own-only scoped agent CANNOT write to another agent tab', () => {
-      expect(bm.checkTabAccess(1, 'agent-2', { isWrite: true, ownOnly: true })).toBe(false);
-    });
-  });
-
-  describe('transferTab', () => {
-    it('throws for non-existent tab', () => {
-      expect(() => bm.transferTab(999, 'agent-1')).toThrow('Tab 999 not found');
-    });
-  });
-
-  // D3: revocation must release tab ownership, or a same-name re-pair inherits
-  // the revoked agent's authenticated tabs (own-only access keys on
-  // owner === clientId). Prime the ownership map directly — newTab needs a
-  // real browser (see the file header note on private-map injection).
-  describe('releaseClientTabs (D3)', () => {
-    it('deletes only the target client\'s ownership and returns the released ids', () => {
-      const own = (bm as any).tabOwnership as Map<number, string>;
-      own.set(1, 'codex'); own.set(2, 'codex'); own.set(3, 'other');
-      const released = bm.releaseClientTabs('codex').sort((a, b) => a - b);
-      expect(released).toEqual([1, 2]);
-      expect(bm.getTabOwner(1)).toBeNull();
-      expect(bm.getTabOwner(2)).toBeNull();
-      expect(bm.getTabOwner(3)).toBe('other');
-    });
-
-    it('after release, own-only access to the freed tab is denied even for the same name', () => {
-      const own = (bm as any).tabOwnership as Map<number, string>;
-      own.set(1, 'codex');
-      expect(bm.checkTabAccess(1, 'codex', { ownOnly: true })).toBe(true); // owns it
-      bm.releaseClientTabs('codex');
-      // Ownership gone → a re-paired 'codex' can no longer read/write tab 1.
-      expect(bm.checkTabAccess(1, 'codex', { ownOnly: true })).toBe(false);
-    });
-
-    it('is a no-op on a client that owns nothing', () => {
-      expect(bm.releaseClientTabs('nobody')).toEqual([]);
-    });
-  });
-});
-
-// Test the instruction block generator
-import { generateInstructionBlock } from '../src/cli';
-
-describe('generateInstructionBlock', () => {
-  it('generates a valid instruction block with setup key', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_test123',
-      serverUrl: 'https://test.ngrok.dev',
-      scopes: ['read', 'write'],
-      expiresAt: '2026-04-06T00:00:00Z',
-    });
-
-    expect(block).toContain('gsk_setup_test123');
-    expect(block).toContain('https://test.ngrok.dev/connect');
-    expect(block).toContain('STEP 1');
-    expect(block).toContain('STEP 2');
-    expect(block).toContain('STEP 3');
-    expect(block).toContain('COMMAND REFERENCE');
-    expect(block).toContain('read + write access');
-    expect(block).toContain('tabId');
-    expect(block).toContain('@ref');
-    expect(block).not.toContain('undefined');
-  });
-
-  it('uses localhost URL when no tunnel', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_local',
-      serverUrl: 'http://127.0.0.1:45678',
-      scopes: ['read', 'write'],
-      expiresAt: 'in 24 hours',
-    });
-
-    expect(block).toContain('http://127.0.0.1:45678/connect');
-  });
-
-  it('shows admin scope description when admin included', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_admin',
-      serverUrl: 'https://test.ngrok.dev',
-      scopes: ['read', 'write', 'admin', 'meta'],
-      expiresAt: '2026-04-06T00:00:00Z',
-    });
-
-    expect(block).toContain('admin access');
-    expect(block).toContain('execute JS');
-    expect(block).not.toContain('re-pair with --admin');
-  });
-
-  it('shows re-pair hint when control not included', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_nocontrol',
-      serverUrl: 'https://test.ngrok.dev',
-      scopes: ['read', 'write', 'admin', 'meta'],
-      expiresAt: '2026-04-06T00:00:00Z',
-    });
-
-    expect(block).toContain('re-pair with --control');
-  });
-
-  it('includes newtab as step 2 (agents must own their tab)', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_test',
-      serverUrl: 'https://test.ngrok.dev',
-      scopes: ['read', 'write'],
-      expiresAt: '2026-04-06T00:00:00Z',
-    });
-
-    expect(block).toContain('Create your own tab');
-    expect(block).toContain('"command": "newtab"');
-  });
-
-  it('includes error troubleshooting section', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_test',
-      serverUrl: 'https://test.ngrok.dev',
-      scopes: ['read', 'write'],
-      expiresAt: '2026-04-06T00:00:00Z',
-    });
-
-    expect(block).toContain('401');
-    expect(block).toContain('403');
-    expect(block).toContain('429');
-  });
-
-  it('teaches the snapshot→@ref pattern', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_snap',
-      serverUrl: 'https://test.ngrok.dev',
-      scopes: ['read', 'write'],
-      expiresAt: '2026-04-06T00:00:00Z',
-    });
-
-    // Must explain the snapshot→@ref workflow
-    expect(block).toContain('snapshot');
-    expect(block).toContain('@e1');
-    expect(block).toContain('@e2');
-    expect(block).toContain("Always snapshot first");
-    expect(block).toContain("Don't guess selectors");
-  });
-
-  it('shows SERVER URL prominently', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_url',
-      serverUrl: 'https://my-tunnel.ngrok.dev',
-      scopes: ['read', 'write'],
-      expiresAt: '2026-04-06T00:00:00Z',
-    });
-
-    expect(block).toContain('SERVER: https://my-tunnel.ngrok.dev');
-  });
-
-  it('includes newtab in COMMAND REFERENCE', () => {
-    const block = generateInstructionBlock({
-      setupKey: 'gsk_setup_ref',
-      serverUrl: 'https://test.ngrok.dev',
-      scopes: ['read', 'write'],
-      expiresAt: '2026-04-06T00:00:00Z',
-    });
-
-    expect(block).toContain('"command": "newtab"');
-    expect(block).toContain('"command": "goto"');
-    expect(block).toContain('"command": "snapshot"');
-    expect(block).toContain('"command": "click"');
-    expect(block).toContain('"command": "fill"');
-  });
-});
-
-// Test CLI source-level behavior (pair-agent headed mode, ngrok detection)
-import * as fs from 'fs';
-import * as path from 'path';
-
-const CLI_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/cli.ts'), 'utf-8');
-
-describe('pair-agent CLI behavior', () => {
-  // Extract the pair-agent block: from "pair-agent" dispatch to "process.exit(0)"
-  const pairStart = CLI_SRC.indexOf("command === 'pair-agent'");
-  const pairEnd = CLI_SRC.indexOf('process.exit(0)', pairStart);
-  const pairBlock = CLI_SRC.slice(pairStart, pairEnd);
-
-  it('auto-switches to headed mode unless --headless', () => {
-    expect(pairBlock).toContain("state.mode !== 'headed'");
-    expect(pairBlock).toContain("--headless");
-    expect(pairBlock).toContain("connect");
-  });
-
-  it('uses process.execPath for binary path (not argv[1] which is virtual in compiled)', () => {
-    expect(pairBlock).toContain('process.execPath');
-    // browseBin should be set to execPath, not argv[1]
-    expect(pairBlock).toContain('const browseBin = process.execPath');
-  });
-
-  it('isNgrokAvailable checks gstack env, NGROK_AUTHTOKEN, and native config', () => {
-    const ngrokBlock = CLI_SRC.slice(
-      CLI_SRC.indexOf('function isNgrokAvailable'),
-      CLI_SRC.indexOf('// ─── Pair-Agent DX')
-    );
-    // Three sources checked (paths are in path.join() calls, check the string literals)
-    expect(ngrokBlock).toContain("'ngrok.env'");
-    expect(ngrokBlock).toContain('NGROK_AUTHTOKEN');
-    expect(ngrokBlock).toContain("'ngrok.yml'");
-    // Checks macOS, Linux XDG, and legacy paths
-    expect(ngrokBlock).toContain("'Application Support'");
-    expect(ngrokBlock).toContain("'.config'");
-    expect(ngrokBlock).toContain("'.ngrok2'");
-  });
-
-  it('calls POST /tunnel/start when ngrok is available (not restart)', () => {
-    const handleBlock = CLI_SRC.slice(
-      CLI_SRC.indexOf('async function handlePairAgent'),
-      CLI_SRC.indexOf('function main()')
-    );
-    expect(handleBlock).toContain('/tunnel/start');
-    // Must NOT contain server restart logic
-    expect(handleBlock).not.toContain('Bun.spawn([\'bun\', \'run\'');
-    expect(handleBlock).not.toContain('BROWSE_TUNNEL');
-  });
-});