@asteroidai/cli 1.9.27 → 1.9.30

package/src/run.test.ts

@@ -1,651 +0,0 @@
-import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-import { CredentialStore } from "./auth/store";
-import { WorkosError } from "./auth/workos";
-import { ALL_COMMANDS } from "./commands";
-import { readEnv, saveConfig } from "./config";
-import { renderReference } from "./reference";
-import { type Deps, run } from "./run";
-
-interface Call {
-  url: string;
-  init: RequestInit;
-}
-
-function jwt(claims: Record<string, unknown>): string {
-  const part = (value: unknown) =>
-    Buffer.from(JSON.stringify(value)).toString("base64url");
-  return `${part({ alg: "none" })}.${part(claims)}.sig`;
-}
-
-function harness(
-  env: Record<string, string>,
-  respond: (call: Call) => Response,
-) {
-  const configDir = mkdtempSync(join(tmpdir(), "asteroid-cli-"));
-  const calls: Call[] = [];
-  const out: string[] = [];
-  const err: string[] = [];
-  const deps: Deps = {
-    env: readEnv({ ASTEROID_CONFIG_DIR: configDir, ...env }),
-    cwd: configDir,
-    fetch: (async (url: string, init: RequestInit) => {
-      const call = { url: String(url), init };
-      calls.push(call);
-      return respond(call);
-    }) as typeof fetch,
-    stdout: (text) => out.push(text),
-    stderr: (text) => err.push(text),
-    writeBytes: () => undefined,
-  };
-  return { deps, calls, out, err, configDir };
-}
-
-const json = (body: unknown, status = 200) =>
-  new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" },
-  });
-
-beforeEach(() => {
-  process.env.ASTEROID_NO_KEYCHAIN = "1";
-});
-
-describe("run", () => {
-  it("sends the API key and prints a table", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () =>
-      json({
-        items: [{ id: "w1", name: "Fill form" }],
-        page: 1,
-        pageSize: 50,
-        total: 1,
-      }),
-    );
-    const code = await run(["workflow", "list"], h.deps);
-    expect(code).toBe(0);
-    expect(h.calls[0].url).toBe(
-      "https://odyssey.asteroid.ai/agents/v2/workflows",
-    );
-    expect(
-      (h.calls[0].init.headers as Record<string, string>)["X-Api-Key"],
-    ).toBe("sk_test");
-    expect(h.out.join("")).toContain("Fill form");
-  });
-
-  it("prints the problem detail and exits 1 on an API error", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () =>
-      json({ detail: "Execution not found", status: 404 }, 404),
-    );
-    const code = await run(["execution", "get", "e1"], h.deps);
-    expect(code).toBe(1);
-    expect(h.err.join("")).toContain("404: Execution not found");
-  });
-
-  it("exits 2 on a usage error without calling the API", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () => json({}));
-    expect(await run(["workflow", "get"], h.deps)).toBe(2);
-    expect(await run(["nope"], h.deps)).toBe(2);
-    expect(h.calls).toHaveLength(0);
-  });
-
-  it("prints raw JSON with --json and names the org on a write", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () =>
-      json({ id: "w1" }),
-    );
-    await run(["workflow", "rename", "w1", "--name", "New", "--json"], h.deps);
-    expect(JSON.parse(h.out.join(""))).toEqual({ id: "w1" });
-    expect(h.err.join("")).toContain("Acting in the API key's organization.");
-    expect(JSON.parse(String(h.calls[0].init.body))).toEqual({ name: "New" });
-  });
-
-  it("mints an org token from the stored sign-in and caches it", async () => {
-    const access = jwt({
-      exp: Date.now() / 1000 + 300,
-      org_id: "org_A",
-      org: { id: "uuid-a", name: "Acme" },
-    });
-    const h = harness({}, (call) => {
-      if (call.url.includes("workos")) {
-        expect(
-          Object.fromEntries(call.init.body as URLSearchParams),
-        ).toMatchObject({
-          grant_type: "refresh_token",
-          refresh_token: "r1",
-          organization_id: "org_A",
-        });
-        return json({
-          access_token: access,
-          refresh_token: "r2",
-          organization_id: "org_A",
-        });
-      }
-      return json({ items: [], page: 1, pageSize: 50, total: 0 });
-    });
-    h.deps.env.workosApiUrl = "https://workos.test";
-    const store = new CredentialStore(h.deps.env);
-    await store.writeLogin({ refreshToken: "r1" });
-    saveConfig(h.deps.env, { org: { workosId: "org_A" } });
-
-    const codes = await Promise.all([
-      run(["workflow", "list"], h.deps),
-      run(["workflow", "list"], h.deps),
-    ]);
-    expect(codes).toEqual([0, 0]);
-    expect(await run(["workflow", "list"], h.deps)).toBe(0);
-
-    const workosCalls = h.calls.filter((c) => c.url.includes("workos"));
-    expect(workosCalls).toHaveLength(1);
-    expect(
-      (h.calls.at(-1)!.init.headers as Record<string, string>).Authorization,
-    ).toBe(`Bearer ${access}`);
-    expect((await store.readLogin())?.refreshToken).toBe("r2");
-    const config = JSON.parse(
-      readFileSync(join(h.configDir, "config.json"), "utf8"),
-    );
-    expect(config.org).toEqual({
-      workosId: "org_A",
-      id: "uuid-a",
-      name: "Acme",
-    });
-  });
-
-  it("asks for an org when none is set", async () => {
-    const h = harness({}, () => json({}));
-    await new CredentialStore(h.deps.env).writeLogin({ refreshToken: "r1" });
-    expect(await run(["workflow", "list"], h.deps)).toBe(1);
-    expect(h.err.join("")).toContain("asteroid use <org>");
-    expect(h.calls).toHaveLength(0);
-  });
-
-  it("sends an SSO or MFA org back to login", async () => {
-    const h = harness({}, () =>
-      json({ error: "sso_required", error_description: "SSO required" }, 400),
-    );
-    h.deps.env.workosApiUrl = "https://workos.test";
-    await new CredentialStore(h.deps.env).writeLogin({ refreshToken: "r1" });
-    saveConfig(h.deps.env, { org: { workosId: "org_A", name: "Acme" } });
-    expect(await run(["workflow", "list"], h.deps)).toBe(1);
-    expect(h.err.join("")).toContain("requires SSO or MFA");
-  });
-
-  it("asks to sign in when there is no credential", async () => {
-    const h = harness({}, () => json({}));
-    expect(await run(["workflow", "list"], h.deps)).toBe(1);
-    expect(h.err.join("")).toContain("asteroid login");
-  });
-});
-
-describe("guards", () => {
-  it("refuses --org with an API key", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () => json({}));
-    expect(await run(["workflow", "list", "--org", "Acme"], h.deps)).toBe(2);
-    expect(h.calls).toHaveLength(0);
-  });
-
-  it("tells a signed-in user that the API key overrides use", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () => json({}));
-    await new CredentialStore(h.deps.env).writeLogin({ refreshToken: "r1" });
-    expect(await run(["use", "org_A"], h.deps)).toBe(2);
-    expect(h.err.join("")).toContain("ignores `asteroid login`");
-    expect(h.err.join("")).toContain("unset ASTEROID_API_KEY");
-  });
-
-  it("names the API key when the API rejects it", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_bad" }, () =>
-      json({ detail: "invalid API key" }, 401),
-    );
-    expect(await run(["workflow", "list"], h.deps)).toBe(1);
-    expect(h.err.join("")).toContain(
-      "401: ASTEROID_API_KEY was rejected: invalid API key.",
-    );
-  });
-
-  it("rejects extra arguments and unknown flags on account commands", async () => {
-    const h = harness({}, () => json({}));
-    expect(await run(["use", "a", "b"], h.deps)).toBe(2);
-    expect(await run(["logout", "--typo", "x"], h.deps)).toBe(2);
-  });
-
-  it("drops the API key when a download redirects to another host", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
-      call.url.startsWith("https://odyssey")
-        ? new Response(null, {
-            status: 303,
-            headers: { location: "https://storage.test/file" },
-          })
-        : new Response("bytes", { status: 200 }),
-    );
-    expect(
-      await run(["execution", "file", "download", "e1", "f1"], h.deps),
-    ).toBe(0);
-    const download = h.calls[1];
-    expect(download.url).toBe("https://storage.test/file");
-    expect(
-      (download.init.headers as Record<string, string>)["X-Api-Key"],
-    ).toBeUndefined();
-  });
-
-  it("does not blame the API key for an error after a cross-host redirect", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
-      call.url.startsWith("https://odyssey")
-        ? new Response(null, {
-            status: 303,
-            headers: { location: "https://storage.test/file" },
-          })
-        : new Response("expired", { status: 403 }),
-    );
-    expect(
-      await run(["execution", "file", "download", "e1", "f1"], h.deps),
-    ).toBe(1);
-    expect(h.err.join("")).toContain("403: expired");
-    expect(h.err.join("")).not.toContain("ASTEROID_API_KEY");
-  });
-
-  it("keeps the method and body on a 307", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
-      call.url.endsWith("/validate")
-        ? new Response(null, {
-            status: 307,
-            headers: { location: "/agents/v2/schema/validate2" },
-          })
-        : json({ valid: true }),
-    );
-    await run(["schema", "validate", "--schema", "{}"], h.deps);
-    expect(h.calls[1].init.method).toBe("POST");
-    expect(h.calls[1].init.body).toBe('{"schema":{}}');
-    expect(
-      (h.calls[1].init.headers as Record<string, string>)["X-Api-Key"],
-    ).toBe("sk_test");
-  });
-
-  it("renders nested object lists as a table", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () =>
-      json({ tools: [{ name: "go_to_url", capability: "web" }] }),
-    );
-    await run(["tool", "list"], h.deps);
-    expect(h.out.join("")).toContain("go_to_url");
-  });
-});
-
-describe("cell width", () => {
-  const long = "x".repeat(80);
-  const reply = () => json({ items: [{ id: "w-1", name: long }] });
-
-  it("keeps cells whole when stdout is not a terminal", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, reply);
-    await run(["workflow", "list"], h.deps);
-    expect(h.out.join("")).toContain(long);
-  });
-
-  it("cuts long cells at a terminal", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, reply);
-    h.deps.stdoutIsTTY = true;
-    await run(["workflow", "list"], h.deps);
-    const out = h.out.join("");
-    expect(out).toContain(`${"x".repeat(59)}…`);
-    expect(out).not.toContain(long);
-  });
-});
-
-describe("terminal safety", () => {
-  it("refuses to print a download to a terminal", async () => {
-    const h = harness(
-      { ASTEROID_API_KEY: "sk_test" },
-      () => new Response("bytes"),
-    );
-    h.deps.stdoutIsTTY = true;
-    expect(await run(["execution", "recording", "e1"], h.deps)).toBe(2);
-    expect(h.err.join("")).toContain("--output");
-  });
-
-  it("cleans control characters out of API errors", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () =>
-      json({ detail: "bad\u001b[2Jthing" }, 400),
-    );
-    await run(["execution", "get", "e1"], h.deps);
-    expect(h.err.join("")).toContain("badthing");
-    expect(h.err.join("")).not.toContain("\u001b");
-  });
-
-  it("fills a body organization from an API key's whoami", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
-      call.url.endsWith("/users/v2/whoami")
-        ? json({ organizationId: "org-from-key" })
-        : json({ id: "w1" }),
-    );
-    expect(await run(["workflow", "create", "--name", "W"], h.deps)).toBe(0);
-    expect(JSON.parse(String(h.calls.at(-1)!.init.body))).toMatchObject({
-      organizationId: "org-from-key",
-      name: "W",
-    });
-  });
-});
-
-describe("files --out", () => {
-  it("writes a pinned version into the folder it is given", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () =>
-      json({
-        rev: 1,
-        version: 2,
-        versionId: "v-2",
-        workflowName: "Fill form",
-        files: [
-          {
-            path: "settings.yaml",
-            kind: "structural",
-            size: 3,
-            content: "a: 1",
-          },
-        ],
-      }),
-    );
-    const dir = join(h.configDir, "pulled");
-
-    const code = await run(
-      ["workflow", "version", "pull", "w1", "v-2", "--out", dir],
-      h.deps,
-    );
-
-    expect(code).toBe(0);
-    expect(h.calls[0].url).toBe(
-      "https://odyssey.asteroid.ai/agents/v2/workflows/w1/versions/v-2/files?contents=all",
-    );
-    expect(readFileSync(join(dir, "settings.yaml"), "utf8")).toBe("a: 1");
-  });
-});
-
-describe("workflow pull and push", () => {
-  const tree = {
-    rev: 1,
-    version: 2,
-    versionId: "v-2",
-    workflowName: "Fill form",
-    files: [
-      { path: "settings.yaml", kind: "structural", size: 4, content: "a: 1" },
-    ],
-  };
-
-  it("pulls into ./<workflow-name>/head and pushes from there with no arguments", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
-      call.init.method === "PATCH" ? json({}) : json({ ...tree, rev: 2 }),
-    );
-
-    expect(await run(["workflow", "pull", "w1"], h.deps)).toBe(0);
-    const head = join(h.configDir, "Fill_form", "head");
-    expect(readFileSync(join(head, "settings.yaml"), "utf8")).toBe("a: 1");
-
-    writeFileSync(join(head, "settings.yaml"), "a: 2");
-    const code = await run(["workflow", "push"], { ...h.deps, cwd: head });
-
-    expect(code).toBe(0);
-    const patch = h.calls.find((call) => call.init.method === "PATCH")!;
-    expect(patch.url).toBe(
-      "https://odyssey.asteroid.ai/agents/v2/workflows/w1/head/files",
-    );
-    expect(JSON.parse(String(patch.init.body))).toMatchObject({ baseRev: 2 });
-  });
-
-  it("pushes the folder --from names, taking the workflow from its manifest", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
-      call.init.method === "PATCH" ? json({}) : json({ ...tree, rev: 2 }),
-    );
-    await run(["workflow", "pull", "w9"], h.deps);
-    const head = join(h.configDir, "Fill_form", "head");
-    writeFileSync(join(head, "settings.yaml"), "a: 3");
-
-    const code = await run(["workflow", "push", "--from", head], h.deps);
-
-    expect(code).toBe(0);
-    const patch = h.calls.find((call) => call.init.method === "PATCH")!;
-    expect(patch.url).toBe(
-      "https://odyssey.asteroid.ai/agents/v2/workflows/w9/head/files",
-    );
-  });
-});
-
-describe("workflow pull with a filter", () => {
-  it("refuses a partial tree, which would delete the files it leaves out", async () => {
-    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () => json({}));
-
-    const code = await run(
-      ["workflow", "pull", "w1", "--paths", "a.md"],
-      h.deps,
-    );
-
-    expect(code).toBe(2);
-    expect(h.calls).toEqual([]);
-    expect(h.err.join("")).toContain("cannot take --paths");
-  });
-});
-
-describe("staff access", () => {
-  const own = { workosId: "org_OWN", id: "uuid-own", name: "Asteroid" };
-  const signIn = jwt({ exp: Date.now() / 1000 + 300, org_id: "org_OWN" });
-  const minted = {
-    token: "staff-token-1",
-    grantId: "grant-1",
-    organizationId: "uuid-acme",
-    organizationName: "Acme",
-    workosOrganizationId: "org_ACME",
-    reason: "SUP-412",
-    expiresAt: new Date(Date.now() + 8 * 3600_000).toISOString(),
-  };
-
-  async function signedIn(
-    respond: (call: Call) => Response,
-    email = "ed@asteroid.ai",
-  ) {
-    const h = harness({}, respond);
-    h.deps.env.workosApiUrl = "https://workos.test";
-    const store = new CredentialStore(h.deps.env);
-    await store.writeLogin({ refreshToken: "r1", email });
-    store.cacheToken("org_OWN", {
-      accessToken: signIn,
-      expiresAt: Date.now() + 300_000,
-    });
-    saveConfig(h.deps.env, { org: own, orgs: [own] });
-    return { ...h, store };
-  }
-
-  const auth = (call: Call) =>
-    (call.init.headers as Record<string, string>).Authorization;
-  const config = (dir: string) =>
-    JSON.parse(readFileSync(join(dir, "config.json"), "utf8"));
-
-  it("mints a token with the sign-in, then acts in the org with it", async () => {
-    const h = await signedIn((call) => {
-      if (call.url.endsWith("/users/v2/staff-tokens")) return json(minted, 201);
-      return json({ id: "w1", name: "New" }, 201);
-    });
-
-    expect(await run(["use", "uuid-acme", "--reason", "SUP-412"], h.deps)).toBe(
-      0,
-    );
-    const mint = h.calls[0];
-    expect(mint.init.method).toBe("POST");
-    expect(auth(mint)).toBe(`Bearer ${signIn}`);
-    expect(JSON.parse(String(mint.init.body))).toEqual({
-      organization: "uuid-acme",
-      reason: "SUP-412",
-    });
-    expect(h.err.join("")).toContain("Staff access to Acme (uuid-acme)");
-    expect(h.err.join("")).toContain("audited");
-    expect(config(h.configDir).org).toEqual({
-      workosId: "org_ACME",
-      id: "uuid-acme",
-      name: "Acme",
-    });
-    expect(config(h.configDir).orgs).toEqual([own]);
-
-    expect(await run(["workflow", "create", "--name", "New"], h.deps)).toBe(0);
-    expect(auth(h.calls.at(-1)!)).toBe("Bearer staff-token-1");
-    expect(h.err.join("")).toContain(
-      "Acting in Acme (uuid-acme) with staff access (SUP-412).",
-    );
-  });
-
-  it("asks for a reason before it mints anything", async () => {
-    const h = await signedIn(() => json(minted, 201));
-    expect(await run(["use", "uuid-acme"], h.deps)).toBe(2);
-    expect(h.err.join("")).toContain("--reason <why>");
-    expect(h.calls).toHaveLength(0);
-  });
-
-  it("shows a customer no staff hint", async () => {
-    const h = await signedIn(
-      (call) =>
-        json(
-          {
-            error: "organization_membership_not_found",
-            error_description: "not a member",
-          },
-          400,
-        ),
-      "pat@customer.com",
-    );
-    expect(await run(["use", "uuid-acme"], h.deps)).toBe(2);
-    expect(await run(["use", "org_ACME"], h.deps)).toBe(2);
-    expect(await run(["workflow", "list", "--org", "nope"], h.deps)).toBe(1);
-    const err = h.err.join("");
-    expect(err).toContain("you are not a member of org_ACME.");
-    expect(err).toContain("unknown organization nope.");
-    expect(err).not.toMatch(/staff|--reason|audited/);
-    expect(h.calls.some((c) => c.url.includes("staff-tokens"))).toBe(false);
-  });
-
-  it("takes the staff path when the refresh says you are not a member", async () => {
-    const h = await signedIn((call) => {
-      if (call.url.includes("workos"))
-        return json(
-          {
-            error: "organization_membership_not_found",
-            error_description: "not a member",
-          },
-          400,
-        );
-      return json(minted, 201);
-    });
-    expect(await run(["use", "org_ACME"], h.deps)).toBe(2);
-    expect(h.err.join("")).toContain("you are not a member of org_ACME");
-
-    expect(await run(["use", "org_ACME", "--reason", "SUP-412"], h.deps)).toBe(
-      0,
-    );
-    expect(h.calls.at(-1)!.url).toContain("/users/v2/staff-tokens");
-  });
-
-  it("tells a non-staff person that staff access is for staff", async () => {
-    const h = await signedIn(() => json({ error: "forbidden" }, 403));
-    expect(await run(["use", "uuid-acme", "--reason", "x"], h.deps)).toBe(1);
-    expect(h.err.join("")).toContain("staff access is for Asteroid staff only");
-    expect(await h.store.staffTokens()).toEqual([]);
-  });
-
-  it("uses a held staff token for one command with --org", async () => {
-    const h = await signedIn(() => json({ items: [] }));
-    await h.store.saveStaffToken({
-      ...minted,
-      org: { workosId: "org_ACME", id: "uuid-acme", name: "Acme" },
-      expiresAt: Date.now() + 3600_000,
-    });
-    expect(await run(["workflow", "list", "--org", "Acme"], h.deps)).toBe(0);
-    expect(auth(h.calls[0])).toBe("Bearer staff-token-1");
-    expect(await run(["workflow", "list"], h.deps)).toBe(0);
-    expect(auth(h.calls[1])).toBe(`Bearer ${signIn}`);
-  });
-
-  // resolveAuth treats a token within 30 s of its expiry as expired.
-  it("refuses a staff token in its last 30 s and says how to renew it", async () => {
-    const h = await signedIn(() => json({ items: [] }));
-    await h.store.saveStaffToken({
-      ...minted,
-      org: { workosId: "org_ACME", id: "uuid-acme", name: "Acme" },
-      expiresAt: Date.now() + 10_000,
-    });
-    expect(await run(["workflow", "list", "--org", "org_ACME"], h.deps)).toBe(
-      1,
-    );
-    expect(h.err.join("")).toContain("has expired");
-    expect(h.calls).toHaveLength(0);
-  });
-
-  it("revokes every staff token on --exit and goes back to your org", async () => {
-    const h = await signedIn((call) => {
-      if (call.url.endsWith("/users/v2/staff-tokens")) return json(minted, 201);
-      return new Response(null, { status: 204 });
-    });
-    expect(await run(["use", "uuid-acme", "--reason", "SUP-412"], h.deps)).toBe(
-      0,
-    );
-
-    expect(await run(["use", "--exit"], h.deps)).toBe(0);
-    const revoke = h.calls.at(-1)!;
-    expect(revoke.init.method).toBe("DELETE");
-    expect(revoke.url).toBe(
-      "https://odyssey.asteroid.ai/users/v2/staff-tokens/grant-1",
-    );
-    expect(auth(revoke)).toBe(`Bearer ${signIn}`);
-    expect(await h.store.staffTokens()).toEqual([]);
-    expect(config(h.configDir).org).toEqual(own);
-    expect(h.err.join("")).toContain("Now using Asteroid (uuid-own)");
-  });
-
-  it("keeps a staff token on --exit when the revoke fails", async () => {
-    const h = await signedIn(() => json({ message: "down" }, 500));
-    await h.store.saveStaffToken({
-      ...minted,
-      org: { workosId: "org_ACME", id: "uuid-acme", name: "Acme" },
-      expiresAt: Date.now() + 3600_000,
-    });
-    expect(await run(["use", "--exit"], h.deps)).toBe(1);
-    expect(await h.store.staffTokens()).toHaveLength(1);
-    expect(h.err.join("")).toContain("Run `asteroid use --exit` again");
-  });
-
-  it("revokes a minted token it could not save", async () => {
-    const h = await signedIn((call) => {
-      if (call.url.endsWith("/users/v2/staff-tokens")) return json(minted, 201);
-      return new Response(null, { status: 204 });
-    });
-    const save = vi
-      .spyOn(CredentialStore.prototype, "saveStaffToken")
-      .mockRejectedValue(new WorkosError("keychain", "keychain locked"));
-    try {
-      expect(
-        await run(["use", "uuid-acme", "--reason", "SUP-412"], h.deps),
-      ).toBe(1);
-    } finally {
-      save.mockRestore();
-    }
-    const revoke = h.calls.at(-1)!;
-    expect(revoke.init.method).toBe("DELETE");
-    expect(revoke.url).toContain("/users/v2/staff-tokens/grant-1");
-  });
-
-  it("refuses an option as the reason", async () => {
-    const h = await signedIn(() => json(minted, 201));
-    expect(await run(["use", "uuid-acme", "--reason", "--exit"], h.deps)).toBe(
-      2,
-    );
-    expect(h.calls).toHaveLength(0);
-  });
-
-  it("rejects an org with --exit", async () => {
-    const h = await signedIn(() => json({}));
-    expect(await run(["use", "uuid-acme", "--exit"], h.deps)).toBe(2);
-    expect(h.calls).toHaveLength(0);
-  });
-});
-
-describe("reference", () => {
-  it("matches the generated agent-docs page", () => {
-    const page = readFileSync(
-      new URL("../../../docs/cli/reference.mdx", import.meta.url),
-      "utf8",
-    );
-    expect(page).toBe(renderReference(ALL_COMMANDS));
-  });
-});