@botbuddy/cli 1.4.2 → 1.5.1

package/src/run.test.mjs

@@ -1,173 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, renameSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-
-import { EventEmitter } from "node:events";
-import { EXIT, parseRunArgs, terminalStatus, commandHash, contextPath, launchRun, retryTerminalUpdate, runWorker, cancelRun } from "./run.mjs";
-
-test("run: rejects an unowned workload before it can start", () => {
-  const parsed = parseRunArgs(["--environment", "local", "--", "node", "-e", "process.exit(0)"]);
-  assert.ok(parsed.errors.some((e) => e.includes("session-id")));
-  assert.equal(parsed.command[0], "node");
-});
-
-test("run: accepts and forwards a structured rerun reason", async () => {
-  const parsed = parseRunArgs(["--session-id", "session-1", "--environment", "local", "--rerun-reason", '{"code":"source_changed","detail":"retry after fix"}', "--", "node", "-e", "process.exit(0)"]);
-  assert.deepEqual(parsed.opts.rerunReason, { code: "source_changed", detail: "retry after fix" });
-
-  const calls = [];
-  const result = await launchRun(["--session-id", "session-1", "--environment", "local", "--rerun-reason", '{"code":"source_changed","detail":"retry after fix"}', "--", "node", "-e", "process.exit(0)"], {
-    call: async (name, args) => {
-      calls.push({ name, args });
-      return { ok: true, data: { accepted: true, run_credential: "x".repeat(64), receipt_upload: "receipt://tenant/session/run" } };
-    },
-    spawnImpl: () => Object.assign(new EventEmitter(), { unref() {} }),
-  });
-  assert.equal(result.exitCode, EXIT.OK);
-  assert.deepEqual(calls[0].args.rerun_reason, { code: "source_changed", detail: "retry after fix" });
-  unlinkSync(contextPath(result.receipt.run_id));
-});
-
-test("run: rejects an invalid rerun reason before registering a run", () => {
-  const parsed = parseRunArgs(["--session-id", "session-1", "--environment", "local", "--rerun-reason", "not-json", "--", "node", "-e", "process.exit(0)"]);
-  assert.ok(parsed.errors.some((error) => error.includes("rerun-reason")));
-});
-
-test("run: derives complete terminal outcomes", () => {
-  assert.equal(terminalStatus({ exitCode: 0, signal: null }), "success");
-  assert.equal(terminalStatus({ exitCode: 1, signal: null }), "failure");
-  assert.equal(terminalStatus({ exitCode: null, signal: "SIGTERM" }), "cancelled");
-  assert.equal(terminalStatus({ exitCode: null, signal: "SIGTERM", timedOut: true }), "timed_out");
-  assert.equal(terminalStatus({ exitCode: null, signal: null, ownerLost: true }), "owner_lost");
-});
-
-test("run: the detached worker records one receipt after its launcher is gone", async () => {
-  const dir = mkdtempSync(join(tmpdir(), "bb-run-"));
-  const receiptPath = join(dir, "receipt.json");
-  const contextPath = join(dir, "context.json");
-  const updates = [];
-  const context = {
-    context_path: contextPath, run_id: "run-survives-launcher", run_credential: "x".repeat(64), receipt_upload: "receipt://botbuddy/session/run-survives-launcher",
-    command: [process.execPath, "-e", "setTimeout(() => process.exit(0), 30)"], cwd: dir, timeout_seconds: 2, receipt_path: receiptPath,
-  };
-  await import("node:fs/promises").then(({ writeFile }) => writeFile(contextPath, JSON.stringify(context)));
-  await runWorker(contextPath, { call: async (name, args) => { updates.push({ name, args }); return { ok: true, data: {} }; } });
-  const receipt = JSON.parse(readFileSync(receiptPath, "utf8"));
-  assert.equal(receipt.status, "success");
-  assert.equal(updates.length, 1);
-  assert.equal(updates[0].name, "update_command_run");
-  assert.equal(updates[0].args.status, "succeeded");
-  assert.equal(updates[0].args.run_id, context.run_id);
-});
-
-test("run: terminal callbacks retain and retry their sealed context until accepted", async () => {
-  const dir = mkdtempSync(join(tmpdir(), "bb-run-retry-"));
-  const context = { context_path: join(dir, "context.json") };
-  const update = { run_id: "retry-run", run_credential: "x".repeat(64), status: "succeeded" };
-  const attempts = [];
-  await retryTerminalUpdate(context, update, async () => {
-    attempts.push(true);
-    return attempts.length === 1 ? { ok: false, error: "offline" } : { ok: true, data: { accepted: true } };
-  }, { sleep: async () => {} });
-  assert.equal(attempts.length, 2);
-  const retained = JSON.parse(readFileSync(context.context_path, "utf8"));
-  assert.equal(retained.terminal_update.attempts, 1);
-});
-
-test("run: bounds captured output while preserving its total size", async () => {
-  const dir = mkdtempSync(join(tmpdir(), "bb-run-output-"));
-  const receiptPath = join(dir, "receipt.json");
-  const contextPath = join(dir, "context.json");
-  const context = {
-    context_path: contextPath, run_id: "bounded-output", run_credential: "x".repeat(64), receipt_upload: "receipt://botbuddy/session/bounded-output",
-    command: [process.execPath, "-e", "process.stdout.write('x'.repeat(50000))"], cwd: dir, timeout_seconds: 2, receipt_path: receiptPath,
-  };
-  await import("node:fs/promises").then(({ writeFile }) => writeFile(contextPath, JSON.stringify(context)));
-  await runWorker(contextPath, { call: async () => ({ ok: true, data: { accepted: true } }) });
-  const receipt = JSON.parse(readFileSync(receiptPath, "utf8"));
-  assert.equal(receipt.output_characters, 50000);
-  assert.ok(receipt.bounded_log.length <= 8192);
-});
-
-test("run: escalates a timed-out SIGTERM-resistant process group to SIGKILL", async () => {
-  const dir = mkdtempSync(join(tmpdir(), "bb-run-timeout-"));
-  const receiptPath = join(dir, "receipt.json");
-  const contextPath = join(dir, "context.json");
-  const context = {
-    context_path: contextPath, run_id: "timeout-escalation", run_credential: "x".repeat(64), receipt_upload: "receipt://botbuddy/session/timeout-escalation",
-    command: [process.execPath, "-e", "process.on('SIGTERM', () => {}); setInterval(() => {}, 1_000)"], cwd: dir, timeout_seconds: 0.03, timeout_grace_ms: 20, receipt_path: receiptPath,
-  };
-  await import("node:fs/promises").then(({ writeFile }) => writeFile(contextPath, JSON.stringify(context)));
-  await runWorker(contextPath, { call: async () => ({ ok: true, data: { accepted: true } }) });
-  const receipt = JSON.parse(readFileSync(receiptPath, "utf8"));
-  assert.equal(receipt.status, "timed_out");
-});
-
-test("run: asynchronous workload spawn errors become terminal owner-loss receipts", async () => {
-  const dir = mkdtempSync(join(tmpdir(), "bb-run-spawn-error-"));
-  const receiptPath = join(dir, "receipt.json");
-  const contextPath = join(dir, "context.json");
-  const context = {
-    context_path: contextPath, run_id: "async-spawn-error", run_credential: "x".repeat(64), receipt_upload: "receipt://botbuddy/session/async-spawn-error",
-    command: ["missing"], cwd: dir, timeout_seconds: 2, receipt_path: receiptPath,
-  };
-  await import("node:fs/promises").then(({ writeFile }) => writeFile(contextPath, JSON.stringify(context)));
-  const child = Object.assign(new EventEmitter(), { pid: 123, stdout: null, stderr: null });
-  // Emit the spawn error only AFTER runWorker has synchronously attached its
-  // 'error' listener (waitForChild runs before the first await). A fixed timer
-  // could otherwise fire while runWorker is still in its initial `await
-  // readFile`, making 'error' an unhandled event that throws under load.
-  await runWorker(contextPath, {
-    spawnImpl: () => { queueMicrotask(() => child.emit("error", new Error("ENOENT"))); return child; },
-    call: async () => ({ ok: true, data: { accepted: true } }),
-  });
-  const receipt = JSON.parse(readFileSync(receiptPath, "utf8"));
-  assert.equal(receipt.status, "owner_lost");
-  assert.match(receipt.reason, /ENOENT/);
-});
-
-test("run: command hashes are stable and command-sensitive", () => {
-  assert.equal(commandHash(["pnpm", "test"]), commandHash(["pnpm", "test"]));
-  assert.notEqual(commandHash(["pnpm", "test"]), commandHash(["pnpm", "test:e2e"]));
-  assert.equal(EXIT.BACKEND, 5);
-});
-
-test("run: cancellation terminates the detached workload process group and records one cancelled receipt", async () => {
-  const dir = mkdtempSync(join(tmpdir(), "bb-run-cancel-"));
-  const runId = `cancel-${Date.now()}`;
-  const receiptPath = join(dir, "receipt.json");
-  const sourceContext = join(dir, "context.json");
-  const updates = [];
-  const canonical = join(process.env.HOME ?? "", ".botbuddy", "command-runs", `${runId}.context.json`);
-  const context = {
-    context_path: canonical, run_id: runId, run_credential: "x".repeat(64), receipt_upload: `receipt://botbuddy/session/${runId}`,
-    command: [process.execPath, "-e", "setTimeout(() => process.exit(0), 10_000)"], cwd: dir, timeout_seconds: 20, receipt_path: receiptPath,
-  };
-  await import("node:fs/promises").then(({ writeFile }) => writeFile(sourceContext, JSON.stringify(context)));
-  // cancelRun intentionally uses the canonical per-user runner directory; link
-  // this deterministic fixture into it without giving the test a live server.
-  await import("node:fs/promises").then(({ mkdir }) => mkdir(join(process.env.HOME ?? "", ".botbuddy", "command-runs"), { recursive: true }));
-  renameSync(sourceContext, canonical);
-  const worker = runWorker(canonical, { call: async (name, args) => { updates.push({ name, args }); return { ok: true, data: {} }; } });
-  for (let attempt = 0; attempt < 20; attempt++) {
-    // The worker rewrites this file to stamp workload_pid; tolerate a transient
-    // read (an unfinished write, though writeJson is atomic) by retrying.
-    let current;
-    try {
-      current = JSON.parse(readFileSync(canonical, "utf8"));
-    } catch {
-      await new Promise((resolve) => setTimeout(resolve, 25));
-      continue;
-    }
-    if (Number.isInteger(current.workload_pid)) break;
-    await new Promise((resolve) => setTimeout(resolve, 25));
-  }
-  const cancelled = await cancelRun(runId, { call: async () => ({ ok: true, data: {} }) });
-  assert.equal(cancelled.receipt.outcome, "cancellation_requested", JSON.stringify(cancelled.receipt));
-  await worker;
-  const receipt = JSON.parse(readFileSync(receiptPath, "utf8"));
-  assert.equal(receipt.status, "cancelled");
-  assert.equal(updates.filter((u) => u.name === "update_command_run").length, 1);
-});

package/src/stack.test.mjs

@@ -1,434 +0,0 @@
-// BOT-1220 — `botbuddy stack` unit + spawn tests (bb-wait pattern).
-//   * pure helpers: slot derivation, arg parsing, receipt build/truncate, status parse
-//   * --help snapshot (AC-4)
-//   * spawn tests: documented exit codes + exactly ONE JSON-line receipt to stdout (AC-4)
-import test from "node:test";
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { EventEmitter } from "node:events";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
-import { mkdtempSync, writeFileSync, mkdirSync, realpathSync, readFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-
-import {
-  EXIT, STACK_HELP, STACK_SCHEMA_VERSION, DEFAULT_RECEIPT_MAX_BYTES,
-  deriveSlot, parseStackArgs, buildReceipt, truncateReceipt,
-  parseSupabaseStatus, eventStreamBase, resolveLocalSupabaseUrl, resolveStackPath,
-  runStackLifecycle, materializeLeasedTestConfig, waitForLease,
-} from "./stack.mjs";
-
-const BIN = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "botbuddy.mjs");
-
-// Run the real CLI with a throwaway HOME so no ambient ~/.botbuddy config leaks in.
-function runStack(args, extraEnv = {}) {
-  const home = mkdtempSync(join(tmpdir(), "bb-stack-home-"));
-  return spawnSync("node", [BIN, "stack", ...args], {
-    encoding: "utf8",
-    env: { ...process.env, HOME: home, USERPROFILE: home, ...extraEnv },
-  });
-}
-
-// The single JSON-line receipt discipline: stdout is exactly one line and it parses.
-function soleReceipt(res) {
-  const lines = res.stdout.split("\n").filter((l) => l.trim() !== "");
-  assert.equal(lines.length, 1, `expected exactly one stdout line, got ${lines.length}:\n${res.stdout}`);
-  return JSON.parse(lines[0]);
-}
-
-// ── deriveSlot ───────────────────────────────────────────────────────────────
-test("deriveSlot: explicit --slot wins", () => {
-  assert.equal(deriveSlot({ slot: "56322" }, {}), "56322");
-});
-test("deriveSlot: derives <repo>-<ticket> when both given", () => {
-  assert.equal(deriveSlot({ repo: "botbuddy-web", ticket: "BOT-1220" }, {}), "botbuddy-web-bot-1220");
-});
-test("deriveSlot: BB_STACK_SLOT env fallback", () => {
-  assert.equal(deriveSlot({}, { BB_STACK_SLOT: "56999" }), "56999");
-});
-test('deriveSlot: rejects "default"', () => {
-  assert.throws(() => deriveSlot({ slot: "default" }, {}), /default.*rejected/i);
-});
-test("deriveSlot: throws when undeterminable", () => {
-  assert.throws(() => deriveSlot({}, {}), /cannot determine a stack slot/);
-});
-
-// ── parseStackArgs ───────────────────────────────────────────────────────────
-test("parseStackArgs: up options", () => {
-  const { command, opts, errors } = parseStackArgs([
-    "up", "--slot", "56322", "--host", "mac", "--repo", "botbuddy-web",
-    "--ticket", "BOT-1220", "--stack-path", "infra/local", "--idle-ttl", "600", "--timeout", "120", "--no-wait", "--local-exec",
-  ]);
-  assert.equal(errors.length, 0);
-  assert.equal(command, "up");
-  assert.equal(opts.slot, "56322");
-  assert.equal(opts.host, "mac");
-  assert.equal(opts.stackPath, "infra/local");
-  assert.equal(opts.idleTtl, 600);
-  assert.equal(opts.timeout, 120);
-  assert.equal(opts.noWait, true);
-  assert.equal(opts.localExec, true);
-});
-test("parseStackArgs: rejects absolute and escaping stack paths", () => {
-  assert.ok(parseStackArgs(["up", "--stack-path", "/tmp/stack"]).errors.length > 0);
-  assert.ok(parseStackArgs(["up", "--stack-path", "../stack"]).errors.length > 0);
-  assert.ok(parseStackArgs(["up", "--stack-path", "sub/../../stack"]).errors.length > 0);
-});
-test("resolveStackPath: canonicalizes an in-worktree directory", () => {
-  const root = mkdtempSync(join(tmpdir(), "bb-stack-root-"));
-  mkdirSync(join(root, "stack"));
-  assert.deepEqual(resolveStackPath(root, "stack"), { worktreeRoot: realpathSync(root), stackPath: "stack" });
-});
-test("parseStackArgs: status/touch/done require a lease_id", () => {
-  for (const c of ["status", "touch", "done"]) {
-    const { errors } = parseStackArgs([c]);
-    assert.ok(errors.some((e) => e.includes("lease_id")), `${c} should require lease_id`);
-  }
-  const { leaseId, errors } = parseStackArgs(["status", "abc-123"]);
-  assert.equal(errors.length, 0);
-  assert.equal(leaseId, "abc-123");
-});
-test("parseStackArgs: unknown option is an error", () => {
-  const { errors } = parseStackArgs(["up", "--bogus"]);
-  assert.ok(errors.some((e) => e.includes("--bogus")));
-});
-test("parseStackArgs: --idle-ttl / --timeout must be positive integers", () => {
-  assert.ok(parseStackArgs(["up", "--idle-ttl", "0"]).errors.length > 0);
-  assert.ok(parseStackArgs(["up", "--timeout", "-5"]).errors.length > 0);
-  assert.ok(parseStackArgs(["up", "--idle-ttl", "x"]).errors.length > 0);
-});
-test("parseStackArgs: --stop sets disposition stop (default destroy)", () => {
-  assert.equal(parseStackArgs(["done", "id"]).opts.disposition, "destroy");
-  assert.equal(parseStackArgs(["done", "id", "--stop"]).opts.disposition, "stop");
-});
-test("BOT-1346: run requires an argv boundary and rejects direct Docker fallback", () => {
-  assert.ok(parseStackArgs(["run", "--repo", "botbuddy-web", "--ticket", "BOT-1346"]).errors.some((e) => e.includes("executable")));
-  assert.ok(parseStackArgs(["run", "--repo", "botbuddy-web", "--ticket", "BOT-1346", "--local-exec", "--", "echo", "ok"]).errors.some((e) => e.includes("forbidden")));
-  const parsed = parseStackArgs(["run", "--repo", "botbuddy-web", "--ticket", "BOT-1346", "--", "node", "-e", "process.exit(0)"]);
-  assert.equal(parsed.errors.length, 0);
-  assert.deepEqual(parsed.childArgv, ["node", "-e", "process.exit(0)"]);
-});
-
-test("BOT-1346: a clean lease-stream EOF honours the original deadline", async () => {
-  const requests = [];
-  const expired = await waitForLease(
-    "lease-1346", () => false, () => false,
-    { timeoutSec: 5, deadlineMs: Date.now() - 1, auth: { Authorization: "Bearer test" } },
-    async (_url, options = {}) => {
-      requests.push(options.method ?? "GET");
-      if (options.method === "POST") return new Response(JSON.stringify({ cursor_start: null }), { status: 200 });
-      return new Response(new ReadableStream({ start(controller) { controller.close(); } }), { status: 200 });
-    },
-  );
-  assert.deepEqual(expired, { timeout: true });
-  assert.deepEqual(requests, ["POST", "GET"]);
-});
-
-test("BOT-1346: a stalled lease-wait registration is aborted at its deadline", async () => {
-  let registrationSignal = null;
-  const result = await waitForLease(
-    "lease-1346", () => false, () => false,
-    { timeoutSec: 0.02, auth: { Authorization: "Bearer test" } },
-    async (_url, options = {}) => {
-      registrationSignal = options.signal;
-      return await new Promise((_resolve, reject) => options.signal.addEventListener("abort", () => reject(new Error("aborted")), { once: true }));
-    },
-  );
-  assert.equal(registrationSignal.aborted, true);
-  assert.deepEqual(result, { timeout: true });
-});
-
-test("BOT-1346: stack run owns active → argv child → signed reap and never exposes connection", async () => {
-  const calls = [];
-  const signals = new EventEmitter();
-  const fakeChild = new EventEmitter(); fakeChild.pid = 4242;
-  let written = null; const removed = []; let childCall = null;
-  const result = await runStackLifecycle(
-    { repo: "botbuddy-web", ticket: "BOT-1346", stackPath: ".", timeout: 5, reapTimeout: 5, connectionFile: "/tmp/bot-1346-connection.json" },
-    ["pnpm", "test:all"],
-    {
-      auth: { Authorization: "Bearer test" }, signals,
-      api: {
-        request: async () => ({ ok: true, data: { success: true, lease_id: "lease-1346", state: "active" } }),
-        get: async () => ({ ok: true, data: { success: true, state: "active", idle_ttl_secs: 30, connection: { db_url: "postgres://secret" } } }),
-        touch: async () => ({ ok: true, data: { success: true } }),
-        release: async (id) => { calls.push(["release", id]); return { ok: true, data: { success: true, state: "reaping" } }; },
-      },
-      wait: async (_id, done) => done("reaped") ? { woke: true, state: "reaped" } : { woke: true, state: "active" },
-      writeConnection: async (path, connection) => { written = { path, connection }; return path; },
-      materializeTestConfig: async () => ({
-        envFile: "/tmp/bot-1346-integration.env",
-        stackConfig: "/tmp/bot-1346-stack.toml",
-      }),
-      removeConnection: async (path) => { removed.push(path); },
-      startChild: (argv, env, cwd) => { childCall = { argv, env, cwd }; queueMicrotask(() => fakeChild.emit("exit", 7, null)); return fakeChild; },
-      clock: { setInterval: () => ({ unref() {} }), clearInterval() {}, setTimeout: () => ({ unref() {} }), clearTimeout() {} },
-    },
-  );
-  assert.equal(result.exitCode, 7, "successful cleanup must not mask the child failure");
-  assert.deepEqual(childCall.argv, ["pnpm", "test:all"], "argv is forwarded without shell parsing");
-  assert.equal(childCall.env.BOTBUDDY_STACK_LEASE_ID, "lease-1346");
-  assert.equal(childCall.env.BOTBUDDY_STACK_CONNECTION_FILE, written.path);
-  assert.equal(childCall.env.BB_INTEGRATION_ENV_FILE, "/tmp/bot-1346-integration.env");
-  assert.equal(childCall.env.BB_STACK_CONFIG, "/tmp/bot-1346-stack.toml");
-  assert.equal(written.connection.db_url, "postgres://secret");
-  assert.deepEqual(removed.sort(), [written.path, "/tmp/bot-1346-integration.env", "/tmp/bot-1346-stack.toml"].sort());
-  assert.deepEqual(calls, [["release", "lease-1346"]]);
-  assert.doesNotMatch(JSON.stringify(result), /postgres:\/\/secret/);
-});
-
-test("BOT-1346: materialized integration environment uses the leased database port", async () => {
-  const root = mkdtempSync(join(tmpdir(), "bb-stack-integration-"));
-  const integrationDir = join(root, "supabase", "functions", "_test", "integration");
-  mkdirSync(integrationDir, { recursive: true });
-  writeFileSync(join(integrationDir, ".env.integration"), "SUPABASE_URL=http://127.0.0.1:56321\nINTEGRATION_DB_PORT=56322\n");
-  const config = await materializeLeasedTestConfig(root, "lease-port", {
-    api_url: "http://127.0.0.1:64321", db_port: 64322, anon_key: "anon", service_role_key: "service", project_id: "leased-project",
-  });
-  assert.match(readFileSync(config.envFile, "utf8"), /^INTEGRATION_DB_PORT=64322$/m);
-  assert.match(readFileSync(config.stackConfig, "utf8"), /port = 64322/);
-});
-
-test("BOT-1346: materialized integration config removes dotenv if its TOML write fails", async () => {
-  const root = mkdtempSync(join(tmpdir(), "bb-stack-integration-"));
-  const integrationDir = join(root, "supabase", "functions", "_test", "integration");
-  mkdirSync(integrationDir, { recursive: true });
-  writeFileSync(join(integrationDir, ".env.integration"), "SUPABASE_URL=http://127.0.0.1:56321\n");
-  const writes = []; const removed = [];
-  await assert.rejects(
-    materializeLeasedTestConfig(root, "lease-cleanup", {
-      api_url: "http://127.0.0.1:64321", db_port: 64322, anon_key: "anon", service_role_key: "service", project_id: "leased-project",
-    }, {
-      writePrivate: async (path) => { writes.push(path); if (writes.length === 2) throw new Error("ENOSPC"); },
-      removePrivate: async (path) => { removed.push(path); },
-    }),
-    /ENOSPC/,
-  );
-  assert.equal(writes.length, 2);
-  assert.deepEqual(removed, [writes[0]]);
-});
-
-test("BOT-1346: queue wait errors retain a failed signed-cleanup receipt", async () => {
-  const result = await runStackLifecycle(
-    { repo: "botbuddy-web", ticket: "BOT-1346", stackPath: ".", timeout: 5, reapTimeout: 5 },
-    ["pnpm", "test:integration"],
-    {
-      auth: { Authorization: "Bearer test" }, signals: new EventEmitter(),
-      api: {
-        request: async () => ({ ok: true, data: { success: true, lease_id: "lease-queue-error", state: "queued" } }),
-        release: async (_leaseId, signal) => {
-          assert(signal instanceof AbortSignal, "cleanup release receives the reap deadline signal");
-          return { ok: false, error: "signed reap unavailable" };
-        },
-      },
-      wait: async () => ({ error: "lease stream broke" }),
-    },
-  );
-  assert.equal(result.exitCode, EXIT.LEASE_FAILED);
-  assert.equal(result.cleanup.ok, false);
-  assert.match(result.cleanup.error, /signed reap unavailable/);
-});
-
-test("BOT-1346: queue timeout receipt retains a failed cleanup result", async () => {
-  const result = await runStackLifecycle(
-    { repo: "botbuddy-web", ticket: "BOT-1346", stackPath: ".", timeout: 5, reapTimeout: 5 }, ["pnpm", "test:integration"],
-    {
-      auth: { Authorization: "Bearer test" }, signals: new EventEmitter(),
-      api: {
-        request: async () => ({ ok: true, data: { success: true, lease_id: "lease-queued", state: "queued" } }),
-        release: async () => ({ ok: false, error: "release rejected" }),
-      },
-      wait: async () => ({ timeout: true }),
-      clock: { setInterval: () => ({ unref() {} }), clearInterval() {}, setTimeout: () => ({ unref() {} }), clearTimeout() {} },
-    },
-  );
-  assert.equal(result.exitCode, EXIT.TIMEOUT);
-  assert.equal(result.cleanup.ok, false);
-  assert.match(result.cleanup.error, /release rejected/);
-});
-
-test("BOT-1346: interruption during lease creation releases the lease once its ID arrives", async () => {
-  const signals = new EventEmitter();
-  let resolveRequest; let releases = 0;
-  const pending = runStackLifecycle(
-    { repo: "botbuddy-web", ticket: "BOT-1346", stackPath: ".", timeout: 5, reapTimeout: 5 }, ["pnpm", "test:integration"],
-    {
-      auth: { Authorization: "Bearer test" }, signals,
-      api: {
-        request: () => new Promise((resolve) => { resolveRequest = resolve; }),
-        release: async () => { releases++; return { ok: true, data: { success: true, state: "reaping" } }; },
-      },
-      wait: async () => ({ woke: true, state: "reaped" }),
-      clock: { setInterval: () => ({ unref() {} }), clearInterval() {}, setTimeout: () => ({ unref() {} }), clearTimeout() {} },
-    },
-  );
-  signals.emit("SIGINT");
-  resolveRequest({ ok: true, data: { success: true, lease_id: "lease-interrupted-request", state: "queued" } });
-  const result = await pending;
-  assert.equal(result.exitCode, 130);
-  assert.equal(releases, 1);
-  assert.equal(result.cleanup.ok, true);
-});
-
-test("BOT-1346: forced hard TTL cannot turn an incomplete child run into success", async () => {
-  const fakeChild = new EventEmitter(); fakeChild.pid = 4244;
-  let hardTimeout;
-  const result = await runStackLifecycle(
-    { repo: "botbuddy-web", ticket: "BOT-1346", stackPath: ".", timeout: 5, reapTimeout: 5, hardTtl: 1 }, ["node", "-e", "process.exit(0)"],
-    {
-      auth: { Authorization: "Bearer test" }, signals: new EventEmitter(),
-      api: {
-        request: async () => ({ ok: true, data: { success: true, lease_id: "lease-ttl", state: "active" } }),
-        get: async () => ({ ok: true, data: { success: true, state: "active", connection: {} } }),
-        touch: async () => ({ ok: true, data: { success: true } }),
-        release: async () => ({ ok: true, data: { success: true, state: "reaping" } }),
-      },
-      wait: async () => ({ woke: true, state: "reaped" }), writeConnection: async (path) => path, removeConnection: async () => {},
-      startChild: () => { queueMicrotask(() => { hardTimeout(); fakeChild.emit("exit", 0, null); }); return fakeChild; },
-      clock: { setInterval: () => ({ unref() {} }), clearInterval() {}, setTimeout: (fn) => { hardTimeout = fn; return { unref() {} }; }, clearTimeout() {} },
-    },
-  );
-  assert.equal(result.exitCode, EXIT.TIMEOUT);
-});
-
-test("BOT-1346: a fenced lease cannot report a gracefully-stopped child as success", async () => {
-  const fakeChild = new EventEmitter(); fakeChild.pid = 4245;
-  let heartbeat;
-  const result = await runStackLifecycle(
-    { repo: "botbuddy-web", ticket: "BOT-1346", stackPath: ".", timeout: 5, reapTimeout: 5 }, ["node", "-e", "process.exit(0)"],
-    {
-      auth: { Authorization: "Bearer test" }, signals: new EventEmitter(),
-      api: {
-        request: async () => ({ ok: true, data: { success: true, lease_id: "lease-fenced", state: "active" } }),
-        get: async () => ({ ok: true, data: { success: true, state: "active", connection: {} } }),
-        touch: async () => ({ ok: false, error: "lease unavailable" }),
-        release: async () => ({ ok: true, data: { success: true, state: "reaping" } }),
-      },
-      wait: async () => ({ woke: true, state: "reaped" }), writeConnection: async (path) => path, removeConnection: async () => {},
-      startChild: () => { queueMicrotask(async () => { await heartbeat(); fakeChild.emit("exit", 0, null); }); return fakeChild; },
-      clock: { setInterval: (fn) => { heartbeat = fn; return { unref() {} }; }, clearInterval() {}, setTimeout: () => ({ unref() {} }), clearTimeout() {} },
-    },
-  );
-  assert.equal(result.exitCode, EXIT.LEASE_FAILED);
-  assert.equal(result.fenced, true);
-});
-
-test("BOT-1346: stack run reports failed signed cleanup after a successful child", async () => {
-  const fakeChild = new EventEmitter(); fakeChild.pid = 4243;
-  const result = await runStackLifecycle(
-    { repo: "botbuddy-web", ticket: "BOT-1346", stackPath: ".", timeout: 5, reapTimeout: 5 },
-    ["node", "-e", "process.exit(0)"],
-    {
-      auth: { Authorization: "Bearer test" }, signals: new EventEmitter(),
-      api: {
-        request: async () => ({ ok: true, data: { success: true, lease_id: "lease-unreaped", state: "active" } }),
-        get: async () => ({ ok: true, data: { success: true, state: "active", connection: {} } }),
-        touch: async () => ({ ok: true, data: { success: true } }),
-        release: async () => ({ ok: true, data: { success: true, state: "reaping" } }),
-      },
-      wait: async () => ({ timeout: true }),
-      writeConnection: async (path) => path,
-      removeConnection: async () => {},
-      startChild: () => { queueMicrotask(() => fakeChild.emit("exit", 0, null)); return fakeChild; },
-      clock: { setInterval: () => ({ unref() {} }), clearInterval() {}, setTimeout: () => ({ unref() {} }), clearTimeout() {} },
-    },
-  );
-  assert.equal(result.childExitCode, 0);
-  assert.equal(result.exitCode, EXIT.CLEANUP_FAILED);
-  assert.equal(result.cleanup.ok, false);
-});
-
-// ── receipts ─────────────────────────────────────────────────────────────────
-test("buildReceipt: stamps schema_version", () => {
-  assert.equal(buildReceipt({ command: "up" }).schema_version, STACK_SCHEMA_VERSION);
-});
-test("truncateReceipt: in-budget receipt is returned unchanged", () => {
-  const r = buildReceipt({ command: "up", outcome: "active", lease_id: "x", exit_code: 0 });
-  assert.deepEqual(truncateReceipt(r, DEFAULT_RECEIPT_MAX_BYTES), r);
-});
-test("truncateReceipt: collapses the oversized connection block first, keeps lease_id + exit_code", () => {
-  const big = "k".repeat(20000);
-  const r = buildReceipt({ command: "up", outcome: "active", lease_id: "lease-1", exit_code: 0, connection: { service_role_key: big } });
-  const t = truncateReceipt(r, DEFAULT_RECEIPT_MAX_BYTES);
-  assert.ok(Buffer.byteLength(JSON.stringify(t), "utf8") <= DEFAULT_RECEIPT_MAX_BYTES);
-  assert.equal(t.lease_id, "lease-1");
-  assert.equal(t.exit_code, 0);
-  assert.ok(t.connection.connection_truncated || t.truncated);
-});
-
-// ── parseSupabaseStatus ──────────────────────────────────────────────────────
-test("parseSupabaseStatus: JSON form", () => {
-  const conn = parseSupabaseStatus(JSON.stringify({ API_URL: "http://127.0.0.1:56321", DB_URL: "postgresql://x", ANON_KEY: "anon", SERVICE_ROLE_KEY: "svc" }));
-  assert.equal(conn.api_url, "http://127.0.0.1:56321");
-  assert.equal(conn.service_role_key, "svc");
-});
-test("parseSupabaseStatus: plain key/value fallback", () => {
-  const conn = parseSupabaseStatus("API URL: http://127.0.0.1:56321\nanon key: theanon\nservice_role key: thesvc\n");
-  assert.equal(conn.api_url, "http://127.0.0.1:56321");
-  assert.equal(conn.anon_key, "theanon");
-});
-
-// ── eventStreamBase ──────────────────────────────────────────────────────────
-test("eventStreamBase: derives the event-stream URL from the mcp-server URL", () => {
-  assert.equal(eventStreamBase("https://api.bot-buddy.ai/functions/v1/mcp-server"), "https://api.bot-buddy.ai/functions/v1/event-stream");
-  assert.equal(eventStreamBase("http://127.0.0.1:56321/functions/v1/mcp-server/"), "http://127.0.0.1:56321/functions/v1/event-stream");
-});
-
-// ── resolveLocalSupabaseUrl (Codex P1: never bake the prod origin) ───────────
-test("resolveLocalSupabaseUrl: honours an already-local VITE_SUPABASE_URL", () => {
-  assert.equal(resolveLocalSupabaseUrl({ VITE_SUPABASE_URL: "http://127.0.0.1:56321" }), "http://127.0.0.1:56321");
-  assert.equal(resolveLocalSupabaseUrl({ VITE_SUPABASE_URL: "http://localhost:54321" }), "http://localhost:54321");
-});
-test("resolveLocalSupabaseUrl: derives the [api] port from supabase/config.toml", () => {
-  const dir = mkdtempSync(join(tmpdir(), "bb-stack-cfg-"));
-  mkdirSync(join(dir, "supabase"));
-  writeFileSync(join(dir, "supabase", "config.toml"), "[api]\nenabled = true\nport = 56321\n\n[db]\nport = 56322\n");
-  assert.equal(resolveLocalSupabaseUrl({}, dir), "http://127.0.0.1:56321");
-});
-test("resolveLocalSupabaseUrl: ignores a NON-local exported origin (refuses → null)", () => {
-  // A prod VITE_SUPABASE_URL must NOT be trusted, and no config.toml here ⇒ null (caller refuses).
-  const empty = mkdtempSync(join(tmpdir(), "bb-stack-nocfg-"));
-  assert.equal(resolveLocalSupabaseUrl({ VITE_SUPABASE_URL: "https://api.bot-buddy.ai" }, empty), null);
-});
-
-// ── --help snapshot (AC-4) ───────────────────────────────────────────────────
-test("STACK_HELP documents the four subcommands and every exit code", () => {
-  for (const s of ["stack up", "stack status", "stack touch", "stack done", "--local-exec", "--no-wait"]) {
-    assert.ok(STACK_HELP.includes(s), `help missing ${s}`);
-  }
-  for (const s of ["0 ok", "2 park timed out", "3 not authenticated", "4 invalid", "5 backend", "6 lease failed", "7 internal"]) {
-    assert.ok(STACK_HELP.includes(s), `help missing exit-code doc ${s}`);
-  }
-});
-
-// ── spawn tests: exit codes + single-line receipt (bb-wait pattern) ──────────
-test("spawn: `stack help` prints usage and exits 0", () => {
-  const res = runStack(["help"]);
-  assert.equal(res.status, 0);
-  assert.ok(res.stdout.includes("botbuddy stack"));
-});
-test("spawn: invalid slot 'default' → exit 4 with a single JSON-line receipt", () => {
-  const res = runStack(["up", "--slot", "default"]);
-  assert.equal(res.status, EXIT.INVALID);
-  const r = soleReceipt(res);
-  assert.equal(r.schema_version, STACK_SCHEMA_VERSION);
-  assert.equal(r.command, "up");
-  assert.equal(r.outcome, "error");
-  assert.equal(r.exit_code, EXIT.INVALID);
-});
-test("spawn: `stack status` without a lease_id → exit 4", () => {
-  const res = runStack(["status"]);
-  assert.equal(res.status, EXIT.INVALID);
-  soleReceipt(res);
-});
-test("spawn: `stack up` with a valid slot but no auth → exit 3", () => {
-  const res = runStack(["up", "--slot", "56322"]);
-  assert.equal(res.status, EXIT.AUTH);
-  const r = soleReceipt(res);
-  assert.equal(r.exit_code, EXIT.AUTH);
-  assert.equal(r.command, "up");
-});
-test("spawn: unknown subcommand → exit 4", () => {
-  const res = runStack(["frobnicate"]);
-  assert.equal(res.status, EXIT.INVALID);
-});

package/src/wait-profile.test.mjs

@@ -1,30 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import { resolveAgentProfile } from "./wait-profile.mjs";
-
-test("BOT-1344: a profiled public wait reads its tenant-bound Keychain credential without a shell export", async () => {
-  const profile = await resolveAgentProfile({
-    explicitProfile: "botbuddy-dev",
-    env: {},
-    readCredential: async (name) => {
-      assert.equal(name, "botbuddy-dev");
-      return "fixture-keychain-agent-credential";
-    },
-  });
-
-  assert.equal(profile.token, "fixture-keychain-agent-credential");
-  assert.equal(profile.tenant, "botbuddy");
-  assert(!JSON.stringify(profile).includes("BOTBUDDY_AGENT_KEY"));
-});
-
-test("BOT-1344: a one-off wait token overrides the Keychain profile credential", async () => {
-  const profile = await resolveAgentProfile({
-    explicitProfile: "botbuddy-dev",
-    explicitToken: "fixture-diagnostic-token",
-    env: { BOTBUDDY_BB_AGENT_KEY: "fixture-ci-token" },
-    readCredential: async () => "fixture-keychain-agent-credential",
-  });
-
-  assert.equal(profile.token, "fixture-diagnostic-token");
-});