@botbuddy/cli 1.4.2 → 1.5.1

package/src/auth.test.mjs

@@ -1,404 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import http from "node:http";
-import { EventEmitter } from "node:events";
-
-import { doLogin } from "./auth.mjs";
-import {
-  createLoopbackReceiver,
-  buildAuthorizeUrl,
-  generatePkce,
-  generateState,
-  openBrowser,
-} from "./oauth-loopback.mjs";
-
-// ─── helpers ────────────────────────────────────────────────────────────────
-
-function httpGet(url) {
-  return new Promise((resolve, reject) => {
-    http
-      .get(url, (res) => {
-        let body = "";
-        res.on("data", (c) => (body += c));
-        res.on("end", () => resolve({ status: res.statusCode, body, headers: res.headers }));
-      })
-      .on("error", reject);
-  });
-}
-
-function jsonResponse(obj, status = 200) {
-  return { status, ok: status < 400, json: async () => obj };
-}
-
-// A mock fetch that only ever answers /register and /token. It records every
-// call so tests can assert /authorize is never fetched and the callback URI is
-// identical across registration and token exchange.
-function makeFetch({ tokenResponse, registerResponse } = {}) {
-  const calls = [];
-  const fetchImpl = async (url, opts = {}) => {
-    calls.push({ url, opts });
-    if (url.endsWith("/register")) {
-      const body = JSON.parse(opts.body);
-      return jsonResponse(registerResponse ?? { client_id: "client-123", redirect_uris: body.redirect_uris });
-    }
-    if (url.endsWith("/token")) {
-      return jsonResponse(tokenResponse ?? { access_token: "tok-secret-abc", expires_in: 3600 });
-    }
-    throw new Error(`unexpected fetch: ${url}`);
-  };
-  return { fetchImpl, calls };
-}
-
-// A stand-in for the browser: given the authorize URL, it plays the role of the
-// server-driven redirect and hits the loopback callback with a valid code+state.
-function browserThatCompletes(code = "auth-code-xyz") {
-  return async (authUrl) => {
-    const u = new URL(authUrl);
-    const redirectUri = u.searchParams.get("redirect_uri");
-    const state = u.searchParams.get("state");
-    await httpGet(`${redirectUri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`);
-  };
-}
-
-function captureUrl(line) {
-  const m = String(line).match(/https?:\/\/[^\s\x1b]+/);
-  return m ? m[0] : null;
-}
-
-async function waitFor(pred, timeout = 2000) {
-  const start = Date.now();
-  while (!pred()) {
-    if (Date.now() - start > timeout) throw new Error("waitFor timed out");
-    await new Promise((r) => setTimeout(r, 10));
-  }
-}
-
-const SERVER = "https://server.test/functions/v1/mcp-server";
-
-function baseDeps(overrides = {}) {
-  return {
-    serverUrl: SERVER,
-    saveConfig: () => {},
-    getConfig: () => ({}),
-    log: () => {},
-    errorLog: () => {},
-    timeoutMs: 3000,
-    now: () => 1000,
-    ...overrides,
-  };
-}
-
-// ─── AC-16: happy path ───────────────────────────────────────────────────────
-
-test("BOT-1383: happy path registers, authorizes via browser, exchanges token, saves config", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  const out = [];
-  let saved = null;
-
-  const result = await doLogin(
-    { noBrowser: false },
-    baseDeps({
-      fetch: fetchImpl,
-      openBrowser: browserThatCompletes("code-1"),
-      saveConfig: (c) => { saved = c; },
-      getConfig: () => ({ existing: "keep" }),
-      log: (s) => out.push(String(s)),
-    }),
-  );
-
-  assert.ok(saved, "config was saved");
-  assert.equal(saved.access_token, "tok-secret-abc");
-  assert.equal(saved.client_id, "client-123");
-  assert.equal(saved.existing, "keep", "preserves existing config fields");
-  assert.equal(saved.token_expires_at, 1000 + 3600 * 1000);
-  assert.match(result.redirectUri, /^http:\/\/127\.0\.0\.1:\d+\/callback$/);
-});
-
-// ─── AC-16: callback URI identical across registration and token exchange ─────
-
-test("BOT-1383: the callback URI is identical in registration and token exchange", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  await doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes() }));
-
-  const reg = calls.find((c) => c.url.endsWith("/register"));
-  const tok = calls.find((c) => c.url.endsWith("/token"));
-  const regRedirect = JSON.parse(reg.opts.body).redirect_uris[0];
-  const tokRedirect = new URLSearchParams(tok.opts.body.toString()).get("redirect_uri");
-
-  assert.equal(regRedirect, tokRedirect);
-  assert.match(regRedirect, /^http:\/\/127\.0\.0\.1:\d+\/callback$/);
-  assert.doesNotMatch(regRedirect, /19836/, "does not keep the old fixed port");
-});
-
-// ─── AC-16 regression: the CLI never fetches /authorize ───────────────────────
-
-test("BOT-1383 regression: the CLI never fetches /authorize and cannot hit the old redirect path", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  await doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes() }));
-
-  assert.ok(!calls.some((c) => c.url.includes("/authorize")), "no /authorize fetch");
-  assert.deepEqual(
-    calls.map((c) => c.url.replace(SERVER, "")),
-    ["/register", "/token"],
-  );
-});
-
-// ─── AC-4/AC-16: secrets never leak to output ─────────────────────────────────
-
-test("BOT-1383: verifier and access token never appear in terminal output", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  const out = [];
-  await doLogin(
-    {},
-    baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes(), log: (s) => out.push(String(s)), errorLog: (s) => out.push(String(s)) }),
-  );
-
-  const joined = out.join("\n");
-  const tok = calls.find((c) => c.url.endsWith("/token"));
-  const verifier = new URLSearchParams(tok.opts.body.toString()).get("code_verifier");
-
-  assert.ok(verifier && verifier.length >= 43, "verifier present in token exchange");
-  assert.ok(!joined.includes(verifier), "verifier not printed");
-  assert.ok(!joined.includes("tok-secret-abc"), "access token not printed");
-});
-
-// ─── AC-9: browser callback page discloses no secrets and is no-store ─────────
-
-test("BOT-1383: the callback success page is no-store and discloses no secrets", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "state-1" });
-  const { redirectUri } = await receiver.listen();
-  const waited = receiver.waitForCallback({ timeoutMs: 2000 });
-
-  const resp = await httpGet(`${redirectUri}?code=SUPERSECRETCODE&state=state-1`);
-  const { code } = await waited;
-
-  assert.equal(code, "SUPERSECRETCODE");
-  assert.equal(resp.status, 200);
-  assert.equal(resp.headers["cache-control"], "no-store");
-  assert.ok(!resp.body.includes("SUPERSECRETCODE"), "code not in HTML");
-  assert.ok(!resp.body.includes("state-1"), "state not in HTML");
-  // The page fires before token exchange, so it must not claim final success;
-  // it points the user to the terminal for the actual result.
-  assert.match(resp.body, /terminal/i, "directs the user to the terminal");
-  assert.doesNotMatch(resp.body, /succeeded/i, "does not over-claim authentication success");
-  await receiver.close();
-});
-
-// ─── AC-8: state validation ───────────────────────────────────────────────────
-
-test("BOT-1383: a wrong-state request is rejected but the listener keeps waiting", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "good" });
-  const { redirectUri } = await receiver.listen();
-  const waited = receiver.waitForCallback({ timeoutMs: 2000 });
-
-  // A stale/malicious tab or probe with the wrong state must NOT abort the login.
-  const bad = await httpGet(`${redirectUri}?code=stolen&state=bad`);
-  assert.equal(bad.status, 400);
-
-  // The legitimate callback still completes afterward.
-  const good = await httpGet(`${redirectUri}?code=real&state=good`);
-  assert.equal(good.status, 200);
-  const { code } = await waited;
-  assert.equal(code, "real");
-  await receiver.close();
-});
-
-test("BOT-1383: a callback missing the code is rejected", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "good" });
-  const { redirectUri } = await receiver.listen();
-  const rejected = assert.rejects(receiver.waitForCallback({ timeoutMs: 2000 }), /code/i);
-
-  const resp = await httpGet(`${redirectUri}?state=good`);
-  assert.equal(resp.status, 400);
-  await rejected;
-  await receiver.close();
-});
-
-// ─── AC-8: OAuth denial ───────────────────────────────────────────────────────
-
-test("BOT-1383: an OAuth error/denial callback is surfaced", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "s" });
-  const { redirectUri } = await receiver.listen();
-  const rejected = assert.rejects(receiver.waitForCallback({ timeoutMs: 2000 }), (err) => err.code === "access_denied");
-
-  await httpGet(`${redirectUri}?state=s&error=access_denied&error_description=User%20denied`);
-  await rejected;
-  await receiver.close();
-});
-
-// ─── AC-8: duplicate callback completes at most once ──────────────────────────
-
-test("BOT-1383: a duplicate callback completes at most once", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "s" });
-  const { redirectUri } = await receiver.listen();
-  const waited = receiver.waitForCallback({ timeoutMs: 2000 });
-
-  const r1 = await httpGet(`${redirectUri}?code=c1&state=s`);
-  const { code } = await waited;
-  const r2 = await httpGet(`${redirectUri}?code=c2&state=s`);
-
-  assert.equal(code, "c1", "first code wins");
-  assert.equal(r1.status, 200);
-  assert.equal(r2.status, 200, "duplicate handled gracefully");
-  await receiver.close();
-});
-
-// ─── AC-16: unrelated paths keep the listener waiting ─────────────────────────
-
-test("BOT-1383: a request to /favicon.ico does not complete the login", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "s" });
-  const { redirectUri, port } = await receiver.listen();
-  const waited = receiver.waitForCallback({ timeoutMs: 2000 });
-
-  const fav = await httpGet(`http://127.0.0.1:${port}/favicon.ico`);
-  assert.equal(fav.status, 404);
-
-  await httpGet(`${redirectUri}?code=ok&state=s`);
-  const { code } = await waited;
-  assert.equal(code, "ok");
-  await receiver.close();
-});
-
-// ─── AC-11: token failure saves nothing ───────────────────────────────────────
-
-test("BOT-1383: a token-exchange failure errors and saves no credentials", async () => {
-  const { fetchImpl } = makeFetch({ tokenResponse: { error: "invalid_grant" } });
-  let saved = null;
-  await assert.rejects(
-    doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes(), saveConfig: () => { saved = "X"; } })),
-    /Token exchange failed/,
-  );
-  assert.equal(saved, null);
-});
-
-test("BOT-1383: a registration failure errors before any browser launch", async () => {
-  const { fetchImpl } = makeFetch({ registerResponse: { error: "bad" } });
-  let opened = false;
-  await assert.rejects(
-    doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: async () => { opened = true; } })),
-    /Client registration failed/,
-  );
-  assert.equal(opened, false, "no browser launched when registration fails");
-});
-
-// ─── AC-11: timeout closes the listener and saves nothing ─────────────────────
-
-test("BOT-1383: a timeout errors, saves nothing, and never opens a real browser", async () => {
-  const { fetchImpl } = makeFetch();
-  let saved = null;
-  const silentBrowser = async () => {}; // never fires the callback
-  await assert.rejects(
-    doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: silentBrowser, saveConfig: () => { saved = "X"; }, timeoutMs: 120 })),
-    /Timed out/i,
-  );
-  assert.equal(saved, null);
-});
-
-// ─── AC-12: browser-launch failure still allows manual completion ─────────────
-
-test("BOT-1383: a browser-launch failure still allows manual completion", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  const out = [];
-  let saved = null;
-  const failingBrowser = async () => { throw new Error("no browser here"); };
-
-  const login = doLogin(
-    {},
-    baseDeps({ fetch: fetchImpl, openBrowser: failingBrowser, saveConfig: (c) => { saved = c; }, log: (s) => out.push(String(s)) }),
-  );
-
-  // The user opens the printed URL manually: fire the callback ourselves.
-  await waitFor(() => out.some((l) => l.includes("/authorize?")));
-  const authUrl = captureUrl(out.find((l) => l.includes("/authorize?")));
-  const u = new URL(authUrl);
-  await httpGet(`${u.searchParams.get("redirect_uri")}?code=manual&state=${u.searchParams.get("state")}`);
-
-  await login;
-  assert.ok(saved && saved.access_token === "tok-secret-abc");
-  assert.ok(out.join("\n").includes("Couldn't open a browser"), "prints manual guidance");
-});
-
-// ─── AC-13: re-running login uses a fresh listener and state ───────────────────
-
-test("BOT-1383: re-running login uses an independent state and listener", async () => {
-  async function runOnce() {
-    const { fetchImpl } = makeFetch();
-    const out = [];
-    let saved = null;
-    await doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes(), saveConfig: (c) => { saved = c; }, log: (s) => out.push(String(s)) }));
-    const authUrl = captureUrl(out.find((l) => l.includes("/authorize?")));
-    return { state: new URL(authUrl).searchParams.get("state"), saved };
-  }
-  const a = await runOnce();
-  const b = await runOnce();
-
-  assert.ok(a.saved.access_token && b.saved.access_token, "both logins succeed");
-  assert.notEqual(a.state, b.state, "each login mints a fresh state");
-});
-
-// ─── AC-11: listener cleanup frees the socket ─────────────────────────────────
-
-test("BOT-1383: closing the receiver frees the socket", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "s" });
-  const { port } = await receiver.listen();
-  await receiver.close();
-  await assert.rejects(httpGet(`http://127.0.0.1:${port}/callback?state=s&code=c`), /ECONNREFUSED/);
-});
-
-// ─── AC-5: browser opener uses argument-based spawning per platform ────────────
-
-test("BOT-1383: openBrowser spawns an argument-based opener per platform, never a shell", async () => {
-  const spawned = [];
-  const fakeSpawn = (cmd, args, opts) => {
-    spawned.push({ cmd, args, opts });
-    const ee = new EventEmitter();
-    ee.unref = () => {};
-    setImmediate(() => ee.emit("spawn"));
-    return ee;
-  };
-  const url = "https://x.test/authorize?a=b&c=d";
-  await openBrowser(url, { platform: "darwin", spawn: fakeSpawn });
-  await openBrowser(url, { platform: "linux", spawn: fakeSpawn });
-  await openBrowser(url, { platform: "win32", spawn: fakeSpawn });
-
-  assert.deepEqual(spawned[0].args, [url]);
-  assert.equal(spawned[0].cmd, "open");
-  assert.equal(spawned[1].cmd, "xdg-open");
-  // Windows must NOT route the URL through cmd.exe (which splits on `&`); the
-  // whole URL is a single argv entry to rundll32's FileProtocolHandler.
-  assert.equal(spawned[2].cmd, "rundll32");
-  assert.deepEqual(spawned[2].args, ["url.dll,FileProtocolHandler", url], "URL is one unparsed argv entry");
-  assert.ok(spawned.every((s) => s.cmd !== "cmd"), "never invokes cmd.exe");
-  // The `&`-bearing URL survives intact as a single argument on every platform.
-  assert.ok(spawned.every((s) => s.args.includes(url)), "full URL passed as one discrete argument");
-  assert.ok(spawned.every((s) => s.opts.shell !== true), "never spawns a shell");
-});
-
-test("BOT-1383: openBrowser rejects when the opener cannot spawn", async () => {
-  const fakeSpawn = () => {
-    const ee = new EventEmitter();
-    setImmediate(() => ee.emit("error", new Error("ENOENT xdg-open")));
-    return ee;
-  };
-  await assert.rejects(openBrowser("https://x", { platform: "linux", spawn: fakeSpawn }), /ENOENT/);
-});
-
-// ─── unit sanity for the pure builders ────────────────────────────────────────
-
-test("BOT-1383: buildAuthorizeUrl carries PKCE S256 and never the verifier", () => {
-  const { codeVerifier, codeChallenge } = generatePkce();
-  const state = generateState();
-  const url = buildAuthorizeUrl({
-    serverUrl: SERVER,
-    clientId: "c1",
-    redirectUri: "http://127.0.0.1:5555/callback",
-    state,
-    codeChallenge,
-  });
-  const u = new URL(url);
-  assert.equal(u.searchParams.get("code_challenge_method"), "S256");
-  assert.equal(u.searchParams.get("code_challenge"), codeChallenge);
-  assert.equal(u.searchParams.get("response_type"), "code");
-  assert.equal(u.searchParams.get("redirect_uri"), "http://127.0.0.1:5555/callback");
-  assert.ok(!url.includes(codeVerifier), "verifier never in the browser URL");
-});

package/src/discovery.test.mjs

@@ -1,195 +0,0 @@
-// BOT-876: unit coverage for the CLI's generic call + discovery commands.
-
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  CallUsageError,
-  discoveryUrlFor,
-  formatDiscovery,
-  parseCallArgs,
-} from "./discovery.mjs";
-
-const SERVER = "https://api.bot-buddy.ai/functions/v1/mcp-server";
-
-// ─── parseCallArgs ──────────────────────────────────────────────
-
-test("call with no arguments yields an empty args object", () => {
-  assert.deepEqual(parseCallArgs(["list_agents"]), {
-    tool: "list_agents",
-    args: {},
-    usedJson: false,
-  });
-});
-
-test("--json supplies the whole arguments object", () => {
-  const { tool, args } = parseCallArgs([
-    "register_agent",
-    "--json",
-    '{"name":"claude-1","type":"claude"}',
-  ]);
-  assert.equal(tool, "register_agent");
-  assert.deepEqual(args, { name: "claude-1", type: "claude" });
-});
-
-test("--json accepts nested structures", () => {
-  const { args } = parseCallArgs([
-    "register_agent",
-    "--json",
-    '{"resources":[{"resource_type":"mcp_server","subtype":"playwright_lane"}]}',
-  ]);
-  assert.deepEqual(args.resources, [
-    { resource_type: "mcp_server", subtype: "playwright_lane" },
-  ]);
-});
-
-test("--key value flags build the arguments object", () => {
-  const { args } = parseCallArgs(["create_task", "--title", "Fix the thing", "--priority", "2"]);
-  assert.deepEqual(args, { title: "Fix the thing", priority: 2 });
-});
-
-test("numeric and boolean flag values are coerced off the command line", () => {
-  // A tool whose schema says `number` would reject the string "2".
-  const { args } = parseCallArgs([
-    "t",
-    "--count", "2",
-    "--ratio", "1.5",
-    "--negative", "-3",
-    "--yes", "true",
-    "--no", "false",
-    "--nothing", "null",
-  ]);
-  assert.deepEqual(args, {
-    count: 2, ratio: 1.5, negative: -3, yes: true, no: false, nothing: null,
-  });
-});
-
-test("values that only look numeric stay strings", () => {
-  const { args } = parseCallArgs([
-    "t",
-    "--ticket", "BOT-876",
-    "--version", "1.2.3",
-    "--hex", "0x10",
-    "--padded", "007",
-  ]);
-  assert.equal(args.ticket, "BOT-876");
-  assert.equal(args.version, "1.2.3");
-  assert.equal(args.hex, "0x10");
-  // "007" is unambiguously numeric; losing the padding is acceptable, but a
-  // leading-zero identifier is common enough to pin the behaviour.
-  assert.equal(args.padded, 7);
-});
-
-test("a valueless flag is a boolean true", () => {
-  const { args } = parseCallArgs(["t", "--force", "--name", "x"]);
-  assert.deepEqual(args, { force: true, name: "x" });
-});
-
-test("a trailing valueless flag is a boolean true", () => {
-  const { args } = parseCallArgs(["t", "--force"]);
-  assert.deepEqual(args, { force: true });
-});
-
-test("flags after --json override the blob", () => {
-  const { args } = parseCallArgs(["t", "--json", '{"name":"a"}', "--name", "b"]);
-  assert.equal(args.name, "b");
-});
-
-test("a missing tool name is a usage error", () => {
-  assert.throws(() => parseCallArgs([]), CallUsageError);
-  assert.throws(() => parseCallArgs(["--json", "{}"]), CallUsageError);
-});
-
-test("malformed --json is reported clearly, not swallowed", () => {
-  assert.throws(() => parseCallArgs(["t", "--json", "{not json}"]), (e) => {
-    assert.ok(e instanceof CallUsageError);
-    assert.match(e.message, /not valid JSON/);
-    return true;
-  });
-});
-
-test("--json must be an object, not an array or scalar", () => {
-  for (const bad of ["[1,2]", '"a string"', "42", "null"]) {
-    assert.throws(() => parseCallArgs(["t", "--json", bad]), CallUsageError, `accepted ${bad}`);
-  }
-});
-
-test("--json with no value is a usage error", () => {
-  assert.throws(() => parseCallArgs(["t", "--json"]), CallUsageError);
-});
-
-test("a bare positional argument is rejected rather than silently ignored", () => {
-  assert.throws(() => parseCallArgs(["t", "oops"]), (e) => {
-    assert.match(e.message, /--key value or --json/);
-    return true;
-  });
-});
-
-// ─── discoveryUrlFor ────────────────────────────────────────────
-
-test("discovery URL is derived from the server URL", () => {
-  assert.equal(discoveryUrlFor(SERVER), `${SERVER}/discovery`);
-  assert.equal(discoveryUrlFor(`${SERVER}/`), `${SERVER}/discovery`);
-});
-
-test("discovery URL encodes a requested tool", () => {
-  assert.equal(discoveryUrlFor(SERVER, "get_totp_code"), `${SERVER}/discovery?tool=get_totp_code`);
-});
-
-// ─── formatDiscovery ────────────────────────────────────────────
-
-const DOC = {
-  tools: [
-    { name: "register_agent", description: "Register an agent. Extra detail here.", inputSchema: { type: "object" } },
-    { name: "list_agents", description: "List all agents", inputSchema: { type: "object" } },
-  ],
-};
-
-test("the index lists every tool, sorted, one line each", () => {
-  const out = formatDiscovery(DOC);
-  const lines = out.split("\n").filter((l) => l.startsWith("  "));
-  assert.equal(lines.length, 2);
-  assert.match(lines[0], /list_agents/);
-  assert.match(lines[1], /register_agent/);
-  assert.match(out, /2 tools available/);
-});
-
-test("the index truncates a description to its first sentence", () => {
-  const out = formatDiscovery(DOC);
-  assert.match(out, /Register an agent\./);
-  assert.doesNotMatch(out, /Extra detail here/);
-});
-
-test("a single tool renders its full schema and an invocation example", () => {
-  const out = formatDiscovery(DOC, { tool: "register_agent" });
-  assert.match(out, /^register_agent/);
-  assert.match(out, /botbuddy call register_agent/);
-  assert.match(out, /"type": "object"/);
-  // register_agent carries no `auth` note → no Auth section.
-  assert.doesNotMatch(out, /Auth:/);
-});
-
-test("a single tool with an agent-identity note renders an Auth section", () => {
-  // BOT-971: the server stamps `auth` on discovery entries for agent-gated
-  // tools; `botbuddy help <tool>` must surface it (matching help({ tool })).
-  const doc = {
-    tools: [{
-      name: "acquire_resources",
-      description: "Batch lock",
-      inputSchema: { type: "object" },
-      auth: "Requires an agent identity — call register_agent first.",
-    }],
-  };
-  const out = formatDiscovery(doc, { tool: "acquire_resources" });
-  assert.match(out, /Auth:/);
-  assert.match(out, /register_agent/);
-});
-
-test("an unknown tool is reported, not rendered empty", () => {
-  assert.match(formatDiscovery(DOC, { tool: "nope" }), /Unknown tool: nope/);
-});
-
-test("a malformed discovery document does not throw", () => {
-  assert.equal(formatDiscovery(null), "No tools found.");
-  assert.equal(formatDiscovery({}), "No tools found.");
-});

package/src/locks.test.mjs

@@ -1,60 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import { buildAcquireResourcesPayload } from "./locks.mjs";
-
-test("locks --mcp emits a typed host-scoped Playwright lane request", () => {
-  const payload = buildAcquireResourcesPayload(["--mcp", "--ticket", "BOT-660"], {
-    defaultHost: "macbook-pro",
-  });
-
-  assert.deepEqual(payload, {
-    resources: [
-      {
-        resource_type: "mcp_server",
-        subtype: "playwright_lane",
-        host: "macbook-pro",
-      },
-    ],
-    ticket_id: "BOT-660",
-  });
-});
-
-test("locks --mcp can pin a lane slot and preserve PR metadata", () => {
-  const payload = buildAcquireResourcesPayload(
-    ["--mcp", "--host", "Jonos-MBP.localdomain", "--lane", "4", "--pr", "#197"],
-    { defaultHost: "ignored-host" },
-  );
-
-  assert.deepEqual(payload, {
-    resources: [
-      {
-        resource_type: "mcp_server",
-        subtype: "playwright_lane",
-        host: "Jonos-MBP.localdomain",
-        slot: "4",
-      },
-    ],
-    pr_id: "#197",
-  });
-});
-
-test("locks --port emits typed Vite port metadata with slot and URL", () => {
-  const payload = buildAcquireResourcesPayload(
-    ["--port", "frontend", "--vite-port", "4179", "--url", "http://127.0.0.1:4179"],
-    { defaultHost: "macbook-pro" },
-  );
-
-  assert.deepEqual(payload, {
-    resources: [
-      {
-        resource_type: "port",
-        port_type: "frontend",
-        subtype: "vite_port",
-        host: "macbook-pro",
-        slot: "4179",
-        url: "http://127.0.0.1:4179",
-      },
-    ],
-  });
-});