@botbuddy/cli 1.4.2 → 1.5.1

package/src/profile-bootstrap.test.mjs

@@ -1,205 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import { bootstrapProfile, defaultProfileAgentName, profileShellRefresh } from "./profile-bootstrap.mjs";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-
-const execFileAsync = promisify(execFile);
-const bootstrapForTest = (profile, options) => bootstrapProfile(profile, { ensureBackend: () => {}, ...options });
-
-test("BOT-1353: the published CLI identifies this profile-bootstrap release", async () => {
-  const { stdout } = await execFileAsync("node", ["bin/botbuddy.mjs", "--version"], {
-    cwd: new URL("..", import.meta.url),
-  });
-
-  assert.equal(stdout.trim(), "botbuddy v1.4.2");
-});
-
-test("BOT-1382: profile --help succeeds and documents the subcommands", async () => {
-  for (const flag of ["--help", "-h"]) {
-    const { stdout } = await execFileAsync("node", ["bin/botbuddy.mjs", "profile", flag], {
-      cwd: new URL("..", import.meta.url),
-    });
-    assert.match(stdout, /botbuddy profile <setup\|env>/);
-  }
-});
-
-test("BOT-1353: default profile agent names are globally collision-resistant", () => {
-  const first = defaultProfileAgentName("supplyguard-dev");
-  const second = defaultProfileAgentName("supplyguard-dev");
-
-  assert.match(first, /^supplyguard-dev-[a-z0-9-]+-[a-f0-9]{12}$/);
-  assert.notEqual(first, second);
-});
-
-test("BOT-1353: the published CLI tarball contains every profile-bootstrap dependency", async () => {
-  const { stdout } = await execFileAsync("npm", ["pack", "--dry-run", "--json"], {
-    cwd: new URL("..", import.meta.url),
-  });
-  const files = JSON.parse(stdout)[0].files.map(({ path }) => path);
-
-  assert(files.includes("src/profile-bootstrap.mjs"));
-  assert(files.includes("src/agent-credential-store.mjs"));
-  // BOT-1383: the loopback-login runtime files must ship in the tarball too.
-  assert(files.includes("src/auth.mjs"));
-  assert(files.includes("src/oauth-loopback.mjs"));
-});
-
-test("BOT-1353: profile bootstrap binds registration to Supply Guard and stores only the returned agent credential", async () => {
-  const calls = [];
-  const stored = [];
-
-  const result = await bootstrapForTest("supplyguard-dev", {
-    name: "supplyguard-dev-jonos-mbp",
-    call: async (tool, args) => {
-      calls.push({ tool, args });
-      return {
-        ok: true,
-        isError: true,
-        data: {
-          code: "FRESH_CONNECTION_REQUIRED",
-          agent_id: "agent-sg-1",
-          tenant_id: "supply-guard",
-          agent_api_key: "fixture-agent-credential",
-        },
-      };
-    },
-    store: async (entry) => stored.push(entry),
-  });
-
-  assert.deepEqual(calls, [{
-    tool: "register_agent",
-    args: {
-      name: "supplyguard-dev-jonos-mbp",
-      type: "codex",
-      tenant_id: "supply-guard",
-    },
-  }]);
-  assert.deepEqual(stored, [{
-    profile: "supplyguard-dev",
-    tenant: "supply-guard",
-    agentId: "agent-sg-1",
-    name: "supplyguard-dev-jonos-mbp",
-    token: "fixture-agent-credential",
-  }]);
-  assert.deepEqual(result, {
-    schema_version: 1,
-    outcome: "installed",
-    profile: "supplyguard-dev",
-    tenant_id: "supply-guard",
-    agent_id: "agent-sg-1",
-    credential_source: "keychain_profile_slot",
-    shell_refresh: "source <(npx --yes @botbuddy/cli@latest profile env supplyguard-dev)",
-    gui_refresh: "$HOME/.local/bin/botbuddy-mcp-env.sh",
-  });
-  assert(!JSON.stringify(result).includes("fixture-agent-credential"));
-});
-
-test("BOT-1353: profile setup gives the invoking shell a deterministic Keychain refresh", () => {
-  assert.equal(
-    profileShellRefresh("supplyguard-dev"),
-    "if botbuddy_profile_token=\"$(security find-generic-password -a \"$USER\" -s \"BOTBUDDY_SG_AGENT_KEY\" -w)\"; then export BOTBUDDY_SG_AGENT_KEY=\"$botbuddy_profile_token\"; unset botbuddy_profile_token; else unset botbuddy_profile_token; false; fi",
-  );
-  assert.throws(() => profileShellRefresh("unknown"), (error) => error?.code === "profile_required");
-});
-
-test("BOT-1353: bootstrap reconnect is tenant-attested and never installs a wrong-tenant credential", async () => {
-  let stored = false;
-
-  await assert.rejects(
-    bootstrapForTest("supplyguard-dev", {
-      call: async () => ({
-        ok: true,
-        data: {
-          agent_id: "agent-bb-1",
-          tenant_id: "botbuddy",
-          api_key: "fixture-wrong-tenant-credential",
-        },
-      }),
-      store: async () => { stored = true; },
-    }),
-    (err) => err?.code === "profile_credential_wrong_tenant",
-  );
-  assert.equal(stored, false);
-});
-
-test("BOT-1353: profile setup reconnects the stored identity without changing its tenant", async () => {
-  let registration;
-  await bootstrapForTest("supplyguard-dev", {
-    readIdentity: async () => ({ agentId: "agent-sg-1", tenant: "supply-guard", name: "supplyguard-dev-existing", token: "fixture-old-credential" }),
-    call: async (_tool, args) => {
-      registration = args;
-      return { ok: true, data: { agent_id: "agent-sg-1", tenant_id: "supply-guard", api_key: "fixture-reconnected-credential" } };
-    },
-    store: async () => {},
-  });
-  assert.equal(registration.agent_id, "agent-sg-1");
-  assert.equal(registration.name, "supplyguard-dev-existing");
-  assert.equal(registration.tenant_id, "supply-guard");
-});
-
-test("BOT-1353: bootstrap refuses an un-attested registration response without storing its credential", async () => {
-  let stored = false;
-  let retryIdentity;
-
-  await assert.rejects(
-    bootstrapForTest("supplyguard-dev", {
-      call: async () => ({
-        ok: true,
-        data: { agent_id: "agent-sg-1", agent_api_key: "fixture-unattested-credential" },
-      }),
-      store: async () => { stored = true; },
-      recordRetryIdentity: async (entry) => { retryIdentity = entry; },
-    }),
-    (err) => err?.code === "profile_tenant_attestation_missing",
-  );
-  assert.equal(stored, false);
-  assert.deepEqual(retryIdentity, { profile: "supplyguard-dev", agentId: "agent-sg-1", name: retryIdentity.name });
-  assert.match(retryIdentity.name, /^supplyguard-dev-/);
-});
-
-test("BOT-1353: an unattested registration retries the same untrusted agent identity", async () => {
-  let retryIdentity;
-  await assert.rejects(bootstrapForTest("supplyguard-dev", {
-    call: async () => ({ ok: true, data: { agent_id: "agent-sg-pending", api_key: "fixture" } }),
-    recordRetryIdentity: async (entry) => { retryIdentity = entry; },
-  }), (error) => error?.code === "profile_tenant_attestation_missing");
-  let retryArgs;
-  await bootstrapForTest("supplyguard-dev", {
-    readRetryIdentity: async () => ({ agentId: retryIdentity.agentId, name: retryIdentity.name }),
-    call: async (_tool, args) => {
-      retryArgs = args;
-      return { ok: true, data: { agent_id: "agent-sg-pending", tenant_id: "supply-guard", api_key: "fixture" } };
-    },
-    store: async () => {},
-  });
-  assert.equal(retryArgs.agent_id, "agent-sg-pending");
-  assert.equal(retryArgs.name, retryIdentity.name);
-});
-
-test("BOT-1353: an unavailable Keychain backend fails before agent registration", async () => {
-  let called = false;
-  await assert.rejects(
-    bootstrapProfile("supplyguard-dev", {
-      ensureBackend: () => { throw new Error("unavailable"); },
-      call: async () => { called = true; return { ok: true }; },
-    }),
-    (error) => error?.code === "profile_agent_required",
-  );
-  assert.equal(called, false);
-});
-
-test("BOT-1353: wrong-tenant metadata is replaced by a fresh tenant-bound registration", async () => {
-  let registration;
-  await bootstrapForTest("supplyguard-dev", {
-    readIdentity: async () => ({ agentId: "agent-bb-1", tenant: "botbuddy" }),
-    call: async (_tool, args) => {
-      registration = args;
-      return { ok: true, data: { agent_id: "agent-sg-2", tenant_id: "supply-guard", api_key: "fixture-replacement-credential" } };
-    },
-    store: async () => {},
-  });
-  assert.equal(registration.agent_id, undefined);
-  assert.equal(registration.tenant_id, "supply-guard");
-});

package/src/publish-equal.test.mjs

@@ -1,176 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, chmodSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { normalizeManifest, packagesEquivalent, isHigherStable, isHigher, isPrerelease } from "./publish-equal.mjs";
-
-// BOT-1382: the publish workflow skips an already-published version ONLY when
-// the local package is equivalent to the published tarball. These tests
-// exercise that decision behaviourally (Codex review round 2, line 108): a
-// changed manifest field must count as drift, while npm-injected fields
-// (gitHead) must not.
-
-const BASE_MANIFEST = {
-  name: "@botbuddy/cli",
-  version: "1.4.0",
-  bin: { botbuddy: "./bin/botbuddy.mjs" },
-  files: ["bin/", "src/"],
-  engines: { node: ">=18.0.0" },
-};
-
-function makePkg(manifest, files) {
-  const root = mkdtempSync(join(tmpdir(), "cli-eq-"));
-  const pkg = join(root, "package");
-  mkdirSync(join(pkg, "bin"), { recursive: true });
-  mkdirSync(join(pkg, "src"), { recursive: true });
-  writeFileSync(join(pkg, "package.json"), JSON.stringify(manifest, null, 2));
-  for (const [rel, content] of Object.entries(files)) {
-    writeFileSync(join(pkg, rel), content);
-  }
-  return { root, pkg };
-}
-
-const DEFAULT_FILES = { "bin/botbuddy.mjs": "#!/usr/bin/env node\n", "src/version.mjs": "export const V=1;\n" };
-
-test("isHigherStable: a stable release must strictly exceed the current latest (no backward move)", () => {
-  assert.equal(isHigherStable("1.4.0", "1.2.3"), true);
-  assert.equal(isHigherStable("1.4.1", "1.4.0"), true);
-  assert.equal(isHigherStable("2.0.0", "1.9.9"), true);
-  assert.equal(isHigherStable("1.10.0", "1.9.0"), true); // numeric, not lexical
-  assert.equal(isHigherStable("1.4.0", "1.4.0"), false); // equal is not higher
-  assert.equal(isHigherStable("1.3.5", "1.4.0"), false); // downgrade => backward
-  assert.equal(isHigherStable("1.2.0", "1.10.0"), false); // numeric, not lexical
-});
-
-test("isHigher: full semver precedence incl. prereleases (guards the next tag too)", () => {
-  // Stable still behaves like isHigherStable.
-  assert.equal(isHigher("1.4.0", "1.2.3"), true);
-  assert.equal(isHigher("1.10.0", "1.9.0"), true);
-  assert.equal(isHigher("1.4.0", "1.4.0"), false);
-  // Prerelease precedence (semver §11).
-  assert.equal(isHigher("2.0.0-rc.2", "2.0.0-rc.1"), true);
-  assert.equal(isHigher("2.0.0-rc.10", "2.0.0-rc.2"), true); // numeric identifiers compare numerically
-  assert.equal(isHigher("2.0.0-rc.1", "1.9.0-rc.1"), true); // higher core wins
-  assert.equal(isHigher("1.9.0-rc.1", "2.0.0-rc.1"), false); // lower core => backward
-  assert.equal(isHigher("2.0.0-rc.1", "2.0.0-rc.1"), false); // equal is not higher
-  assert.equal(isHigher("2.0.0", "2.0.0-rc.1"), true); // a release outranks its prerelease
-  assert.equal(isHigher("2.0.0-rc.1", "2.0.0"), false);
-});
-
-test("isPrerelease: reads the semver prerelease component, not a raw hyphen (build metadata is stable)", () => {
-  assert.equal(isPrerelease("2.0.0-rc.1"), true);
-  assert.equal(isPrerelease("1.4.0"), false);
-  assert.equal(isPrerelease("1.4.0+build-1"), false); // hyphen in build metadata is NOT a prerelease
-  assert.equal(isPrerelease("2.0.0-rc.1+build-1"), true);
-  assert.equal(isPrerelease("1.4.0+2026-08-27"), false);
-});
-
-test("normalizeManifest only canonicalises key order — it ignores NO manifest fields", () => {
-  // npm does not inject gitHead or _-prefixed fields into the packed tarball
-  // (verified against the published @botbuddy/cli tarball), so every field —
-  // gitHead and _-prefixed included — is compared; a change is drift.
-  for (const change of [
-    { gitHead: "aaaa" },
-    { _id: "@botbuddy/cli@1.4.0" },
-    { _npmUser: "alice" },
-  ]) {
-    const a = JSON.stringify({ ...BASE_MANIFEST });
-    const b = JSON.stringify({ ...BASE_MANIFEST, ...change });
-    assert.notEqual(normalizeManifest(a), normalizeManifest(b));
-  }
-});
-
-test("normalizeManifest treats key-order-only differences as identical", () => {
-  const a = JSON.stringify({ name: "x", version: "1.0.0", bin: { a: "1", b: "2" } });
-  const b = JSON.stringify({ bin: { b: "2", a: "1" }, version: "1.0.0", name: "x" });
-  assert.equal(normalizeManifest(a), normalizeManifest(b));
-});
-
-test("a byte-identical package => equivalent (idempotent skip)", () => {
-  const local = makePkg({ ...BASE_MANIFEST }, DEFAULT_FILES);
-  const pub = makePkg({ ...BASE_MANIFEST }, DEFAULT_FILES);
-  try {
-    assert.equal(packagesEquivalent(local.pkg, pub.pkg).equal, true);
-  } finally {
-    rmSync(local.root, { recursive: true, force: true });
-    rmSync(pub.root, { recursive: true, force: true });
-  }
-});
-
-test("a package differing only in gitHead => drift (npm does not inject it into the tarball)", () => {
-  const local = makePkg({ ...BASE_MANIFEST, gitHead: "local" }, DEFAULT_FILES);
-  const pub = makePkg({ ...BASE_MANIFEST, gitHead: "published" }, DEFAULT_FILES);
-  try {
-    assert.equal(packagesEquivalent(local.pkg, pub.pkg).equal, false);
-  } finally {
-    rmSync(local.root, { recursive: true, force: true });
-    rmSync(pub.root, { recursive: true, force: true });
-  }
-});
-
-test("an authored README manifest field change counts as drift (only npm-injected fields are ignored)", () => {
-  const pubManifest = { ...BASE_MANIFEST, readme: "# One", readmeFilename: "README.md" };
-  const localManifest = { ...BASE_MANIFEST, readme: "# Two — changed", readmeFilename: "README.md" };
-  const local = makePkg(localManifest, DEFAULT_FILES);
-  const pub = makePkg(pubManifest, DEFAULT_FILES);
-  try {
-    assert.equal(packagesEquivalent(local.pkg, pub.pkg).equal, false);
-  } finally {
-    rmSync(local.root, { recursive: true, force: true });
-    rmSync(pub.root, { recursive: true, force: true });
-  }
-});
-
-test("a changed manifest field (bin/files/engines) counts as drift", () => {
-  for (const change of [
-    { bin: { botbuddy: "./bin/other.mjs" } },
-    { files: ["bin/", "src/", "README.md"] },
-    { engines: { node: ">=20.0.0" } },
-  ]) {
-    const local = makePkg({ ...BASE_MANIFEST, ...change }, DEFAULT_FILES);
-    const pub = makePkg({ ...BASE_MANIFEST }, DEFAULT_FILES);
-    try {
-      assert.equal(packagesEquivalent(local.pkg, pub.pkg).equal, false);
-    } finally {
-      rmSync(local.root, { recursive: true, force: true });
-      rmSync(pub.root, { recursive: true, force: true });
-    }
-  }
-});
-
-test("changed shipped source content counts as drift", () => {
-  const local = makePkg({ ...BASE_MANIFEST }, { ...DEFAULT_FILES, "src/version.mjs": "export const V=2;\n" });
-  const pub = makePkg({ ...BASE_MANIFEST }, DEFAULT_FILES);
-  try {
-    assert.equal(packagesEquivalent(local.pkg, pub.pkg).equal, false);
-  } finally {
-    rmSync(local.root, { recursive: true, force: true });
-    rmSync(pub.root, { recursive: true, force: true });
-  }
-});
-
-test("a changed executable bit counts as drift (npm pack preserves file mode)", () => {
-  const local = makePkg({ ...BASE_MANIFEST }, DEFAULT_FILES);
-  const pub = makePkg({ ...BASE_MANIFEST }, DEFAULT_FILES);
-  try {
-    chmodSync(join(local.pkg, "bin/botbuddy.mjs"), 0o755);
-    chmodSync(join(pub.pkg, "bin/botbuddy.mjs"), 0o644);
-    assert.equal(packagesEquivalent(local.pkg, pub.pkg).equal, false);
-  } finally {
-    rmSync(local.root, { recursive: true, force: true });
-    rmSync(pub.root, { recursive: true, force: true });
-  }
-});
-
-test("an added/removed shipped file counts as drift", () => {
-  const local = makePkg({ ...BASE_MANIFEST }, { ...DEFAULT_FILES, "src/extra.mjs": "export const X=1;\n" });
-  const pub = makePkg({ ...BASE_MANIFEST }, DEFAULT_FILES);
-  try {
-    assert.equal(packagesEquivalent(local.pkg, pub.pkg).equal, false);
-  } finally {
-    rmSync(local.root, { recursive: true, force: true });
-    rmSync(pub.root, { recursive: true, force: true });
-  }
-});

package/src/publish-workflow.test.mjs

@@ -1,122 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { readFileSync } from "node:fs";
-
-// BOT-1382: the CLI publish workflow is the artifact under test. These
-// contract assertions make its trigger, working directory, skip behaviour,
-// and post-publish verification reviewable locally, without a YAML parser
-// dependency (the CLI package intentionally has none).
-const wf = readFileSync(
-  new URL("../../.github/workflows/publish-cli-package.yml", import.meta.url),
-  "utf8",
-);
-
-test("BOT-1382: triggers ONLY on main pushes touching cli/ or the workflow — no credential-bearing dispatch", () => {
-  assert.match(wf, /on:/);
-  assert.match(wf, /branches:\s*\[main\]/);
-  assert.match(wf, /- "cli\/\*\*"/);
-  assert.match(wf, /- "\.github\/workflows\/publish-cli-package\.yml"/);
-  // workflow_dispatch is intentionally NOT enabled: it accepts an arbitrary
-  // --ref, so a feature branch could run its own (guard-stripped) workflow with
-  // NPM_TOKEN. The on: block must not declare it.
-  assert.doesNotMatch(wf, /^\s*workflow_dispatch:/m);
-});
-
-test("BOT-1382: read-only contents permission and a static, non-cancelling concurrency group", () => {
-  assert.match(wf, /permissions:\s*\n\s*contents: read/);
-  assert.match(wf, /cancel-in-progress: false/);
-  // A STATIC group serializes publishes so the backward-move guard is correct
-  // (a per-commit key would let runs race the guard and corrupt the dist-tag).
-  assert.match(wf, /group: publish-cli-package\n/);
-  assert.doesNotMatch(wf, /group: publish-cli-package-\$\{\{ github\.sha \}\}/);
-});
-
-test("BOT-1382: Node 20 on the public npm registry", () => {
-  assert.match(wf, /node-version: 20/);
-  assert.match(wf, /registry-url: "https:\/\/registry\.npmjs\.org"/);
-});
-
-test("BOT-1382: fails loudly on a missing NPM_TOKEN and never echoes it", () => {
-  assert.match(wf, /NPM_TOKEN repo secret is not set/);
-  assert.match(wf, /secrets\.NPM_TOKEN/);
-  // The token must only ever flow through env, never be printed.
-  assert.doesNotMatch(wf, /echo[^\n]*\$\{?NPM_TOKEN/);
-});
-
-test("BOT-1382: reads name and version dynamically and never hard-codes the version", () => {
-  assert.match(wf, /require\('\.\/cli\/package\.json'\)\.name/);
-  assert.match(wf, /require\('\.\/cli\/package\.json'\)\.version/);
-  assert.doesNotMatch(wf, /1\.4\.0/);
-});
-
-test("BOT-1382: prerelease is classified structurally, not by a raw hyphen", () => {
-  assert.match(wf, /publish-equal\.mjs" --is-prerelease/);
-  // The naive raw-hyphen classifier must be gone (build metadata like
-  // 1.4.0+build-1 is a stable release).
-  assert.doesNotMatch(wf, /\[\[ "\$LOCAL" == \*-\* \]\]/);
-});
-
-test("BOT-1382: the exact-version probe fails closed — only E404 means unpublished", () => {
-  const check = wf.slice(wf.indexOf("Decide publish vs skip"), wf.indexOf("Guard against moving a dist-tag backward"));
-  assert.match(check, /E404/);
-  assert.match(check, /registry error/);
-  assert.doesNotMatch(check, /npm view "\$\{PKG_NAME\}@\$\{LOCAL\}" version >\/dev\/null 2>&1/);
-});
-
-test("BOT-1382: runs the full CLI test suite before publishing", () => {
-  assert.match(wf, /node --test cli\/src\/\*\.test\.mjs/);
-});
-
-test("BOT-1382: performs an npm pack dry-run from cli/ before publishing", () => {
-  assert.match(wf, /working-directory: cli/);
-  assert.match(wf, /npm pack --dry-run/);
-});
-
-test("BOT-1382: skips an already-published version and otherwise publishes with public access", () => {
-  assert.match(wf, /npm view "\$\{PKG_NAME\}@\$\{LOCAL\}" version/);
-  assert.match(wf, /npm publish --access public/);
-  assert.match(wf, /if: steps\.check\.outputs\.published == 'false'/);
-});
-
-test("BOT-1382: verifies the public artifact — exact version, latest tag, and profile/wait --help", () => {
-  assert.match(wf, /npm view "\$\{PKG_NAME\}@\$\{LOCAL\}" version/);
-  assert.match(wf, /npm view "\$\{PKG_NAME\}@latest" version/);
-  assert.match(wf, /profile --help/);
-  assert.match(wf, /wait --help/);
-});
-
-test("BOT-1382: a changed CLI that reuses a published version fails instead of silently skipping", () => {
-  // Only a byte-identical published package is an idempotent skip; a changed
-  // cli/ that reused a published (immutable) version must fail loudly. The
-  // decision is delegated to the unit-tested publish-equal helper.
-  assert.match(wf, /dist\.tarball/);
-  assert.match(wf, /versions are immutable/);
-  assert.match(wf, /cli\/src\/publish-equal\.mjs/);
-});
-
-test("BOT-1382: prereleases publish under a non-latest tag and must not move latest", () => {
-  assert.match(wf, /--tag next/);
-  assert.match(wf, /moved the latest dist-tag/);
-});
-
-test("BOT-1382: a publish that would move a dist-tag backward is refused (latest for stable, next for prerelease)", () => {
-  assert.match(wf, /Guard against moving a dist-tag backward/);
-  assert.match(wf, /publish-equal\.mjs" --gt/);
-  assert.match(wf, /move the \$\{TAG\} dist-tag backward/);
-  // The guarded tag is chosen by prerelease-ness: next for prereleases, latest otherwise.
-  assert.match(wf, /if \[\[ "\$PRERELEASE" == "true" \]\]; then TAG="next"; else TAG="latest"; fi/);
-});
-
-test("BOT-1382: publishing is restricted to main even via workflow_dispatch", () => {
-  assert.match(wf, /must only run on main/);
-  assert.match(wf, /GITHUB_REF.*!= "refs\/heads\/main"|"\$\{GITHUB_REF\}" != "refs\/heads\/main"/);
-});
-
-test("BOT-1382: the backward-move guard reads the dist-tag fail-closed — a registry error aborts, only E404 is a first publish", () => {
-  // A non-404 read failure must abort rather than be treated as "no tag".
-  const guard = wf.slice(wf.indexOf("Guard against moving a dist-tag backward"));
-  assert.match(guard, /E404/);
-  assert.match(guard, /registry error/);
-  // The guard must NOT swallow read errors into an empty "first publish".
-  assert.doesNotMatch(guard.slice(0, guard.indexOf("Publish to npm")), /2>\/dev\/null \|\| true/);
-});

package/src/quiet-runner.test.mjs

@@ -1,109 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mkdtemp, readFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { QuietRunner, boundedSnapshot, failureTail } from "./quiet-runner.mjs";
-
-test("quiet runner writes complete output while waking only for transitions and terminal state", async () => {
-  const artifactDir = await mkdtemp(join(tmpdir(), "botbuddy-quiet-runner-"));
-  const notifications = []; const heartbeats = [];
-  const runner = new QuietRunner({
-    artifactDir, now: (() => { let now = 0; return () => (now += 1_000); })(),
-    launch: async () => ({ async *poll() { yield { output: "waiting\\n" }; yield { output: "ready\\n", transition: "tests_started" }; yield { output: "done\\n", terminal: true, exitCode: 0 }; } }),
-    notify: async (value) => notifications.push(value), heartbeat: async (value) => heartbeats.push(value),
-  });
-  const result = await runner.run({ runId: "run-1", command: ["pnpm", "test"] });
-  assert.equal(result.status, "succeeded");
-  assert.equal(await readFile(result.receipt_path, "utf8"), "waiting\\nready\\ndone\\n");
-  assert.equal(notifications.length, 2, "unchanged polls never wake the agent");
-  assert.equal(notifications[0].reason, "meaningful_transition");
-  assert.equal(notifications[1].reason, "terminal");
-  assert.equal(heartbeats.at(-1).status, "terminal");
-});
-
-test("quiet runner sanitizes failure and snapshots stay bounded", async () => {
-  const artifactDir = await mkdtemp(join(tmpdir(), "botbuddy-quiet-runner-"));
-  const runner = new QuietRunner({ artifactDir, launch: async () => ({ async *poll() { yield { output: `token=super-secret\\n${"x".repeat(3_000)}`, terminal: true, exitCode: 1 }; } }) });
-  const result = await runner.run({ runId: "run-2", command: ["false"] });
-  assert.equal(result.failure.exit_code, 1);
-  assert.equal(result.failure.tail.length <= 2048, true);
-  assert.equal(result.failure.tail.includes("super-secret"), false);
-  assert.equal(boundedSnapshot({ status: "running", elapsedSeconds: 1, transition: "x".repeat(5_000), receiptPath: "receipt://x", nextWakeCondition: "terminal" }).length <= 800, true);
-});
-
-test("quiet runner redacts bearer headers and known credential prefixes", () => {
-  const tail = failureTail("Authorization: Bearer bb_live_abc123\\nsk-proj-secret\\nghp_githubsecret\\ntoken=plain-secret\\n{\"password\":\"hunter2\",\"api_key\":\"opaque-secret\"}");
-  assert.equal(tail.includes("bb_live_abc123"), false);
-  assert.equal(tail.includes("sk-proj-secret"), false);
-  assert.equal(tail.includes("ghp_githubsecret"), false);
-  assert.equal(tail.includes("plain-secret"), false);
-  assert.equal(tail.includes("hunter2"), false);
-  assert.equal(tail.includes("opaque-secret"), false);
-  assert.match(tail, /Authorization: Bearer \[REDACTED\]/);
-});
-
-test("quiet runner redacts a credential even when it crosses the failure-tail boundary", () => {
-  const secret = "x".repeat(3_000);
-  const tail = failureTail(`token=${secret}`);
-  assert.equal(tail.includes(secret.slice(-64)), false);
-  assert.match(tail, /token=\[REDACTED\]/);
-});
-
-test("quiet runner redacts a credential before bounded capture drops its label", async () => {
-  const artifactDir = await mkdtemp(join(tmpdir(), "botbuddy-quiet-runner-"));
-  const secret = "x".repeat(70_000);
-  const runner = new QuietRunner({ artifactDir, launch: async () => ({ async *poll() { yield { output: `token=${secret}`, terminal: true, exitCode: 1 }; } }) });
-  const result = await runner.run({ runId: "large-secret", command: ["false"] });
-  assert.equal(result.failure.tail.includes(secret.slice(-64)), false);
-  assert.match(result.failure.tail, /token=\[REDACTED\]/);
-});
-
-test("quiet runner redacts a credential whose label and value arrive in separate polls", async () => {
-  const artifactDir = await mkdtemp(join(tmpdir(), "botbuddy-quiet-runner-"));
-  const secret = "x".repeat(70_000);
-  const runner = new QuietRunner({ artifactDir, launch: async () => ({ async *poll() {
-    yield { output: "token=" };
-    yield { output: secret, terminal: true, exitCode: 1 };
-  } }) });
-  const result = await runner.run({ runId: "split-large-secret", command: ["false"] });
-  assert.equal(result.failure.tail.includes(secret.slice(-64)), false);
-  assert.match(result.failure.tail, /token=\[REDACTED\]/);
-});
-
-test("bounded snapshots remain parseable JSON when fields are oversized", () => {
-  const snapshot = boundedSnapshot({ status: "running", elapsedSeconds: 1, transition: '"'.repeat(5_000), receiptPath: "receipt://" + "\\".repeat(5_000), nextWakeCondition: "x".repeat(5_000) });
-  assert.equal(snapshot.length <= 800, true);
-  assert.equal(JSON.parse(snapshot).status, "running");
-});
-
-test("quiet runner keeps only bounded failure state while recording a large receipt", async () => {
-  const artifactDir = await mkdtemp(join(tmpdir(), "botbuddy-quiet-runner-"));
-  const output = "x".repeat(200_000);
-  const runner = new QuietRunner({ artifactDir, launch: async () => ({ async *poll() { yield { output, terminal: true, exitCode: 1 }; } }) });
-  const result = await runner.run({ runId: "large-output", command: ["false"] });
-  assert.equal(result.output_characters, output.length);
-  assert.equal((await readFile(result.receipt_path)).length, output.length);
-  assert.equal(result.failure.tail.length <= 2048, true);
-});
-
-test("quiet runner preserves a registered receipt URI while writing its local artifact", async () => {
-  const artifactDir = await mkdtemp(join(tmpdir(), "botbuddy-quiet-runner-"));
-  const transitions = [];
-  const runner = new QuietRunner({
-    artifactDir,
-    launch: async () => ({ async *poll() { yield { output: "complete\\n", transition: "finished", terminal: true, exitCode: 0 }; } }),
-  });
-
-  const result = await runner.run({
-    runId: "registered-receipt",
-    command: ["pnpm", "test"],
-    receiptPath: "receipt://tenant/registered-receipt",
-    onTransition: async (transition) => transitions.push(transition),
-  });
-
-  assert.equal(result.receipt_path, "receipt://tenant/registered-receipt");
-  assert.equal(result.receipt.artifact_uri, "receipt://tenant/registered-receipt");
-  assert.equal(await readFile(result.receipt.path, "utf8"), "complete\\n");
-  assert.equal(transitions[0].receipt_path, "receipt://tenant/registered-receipt");
-});