@botbuddy/cli 1.5.0 → 1.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {
@@ -8,7 +8,8 @@
   },
   "files": [
     "bin/",
-    "src/"
+    "src/",
+    "!src/**/*.test.mjs"
   ],
   "keywords": [
     "mcp",

package/src/botbuddy-release-repair.json

@@ -0,0 +1 @@
+{"schema_version":1,"source_version":"1.5.1","source_identity":"0f390ab84c23f56dcae6e8cc1331fb2fa8533ae2f026f396f8adb76d9485b2d8"}

package/src/publish-equal.mjs

@@ -4,14 +4,15 @@
 //
 // Used by .github/workflows/publish-cli-package.yml when the version already
 // exists on npm: an equivalent package is a safe idempotent skip; any drift
-// means cli/ changed without a version bump and must fail loudly so the change
-// cannot merge green while staying unpublished.
+// triggers a fresh release-time version allocation so the change cannot merge
+// green while staying unpublished.
 //
 // The comparison excludes ONLY npm-injected manifest fields (notably gitHead,
 // which npm stamps into the tarball's package.json from the publishing commit).
 // Every other manifest field (bin, files, engines, …) and every shipped file
 // is compared, so a genuine metadata change still counts as drift.
 
+import { createHash } from "node:crypto";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
 
@@ -22,6 +23,7 @@ import { join, relative } from "node:path";
 // included, is compared. Key ORDER is still canonicalised so incidental
 // ordering never reads as drift.
 const NPM_INJECTED_KEYS = [];
+const RELEASE_REPAIR_RECEIPT = "src/botbuddy-release-repair.json";
 
 // Deep, key-sorted canonical form so incidental key ordering never reads as a
 // difference.
@@ -112,9 +114,62 @@ export function isPrerelease(v) {
   return parseSemver(v).pre.length > 0;
 }
 
-export function normalizeManifest(json) {
+function compareMain(a, b) {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+function incrementPatch(main) {
+  if (!Number.isSafeInteger(main[2]) || main[2] === Number.MAX_SAFE_INTEGER) {
+    throw new Error(`cannot allocate a patch version after ${main.join(".")}`);
+  }
+  return [main[0], main[1], main[2] + 1];
+}
+
+// Allocate a release-only version once a tarball drifted from an immutable npm
+// version. Stable releases advance from the greatest published stable version,
+// preserving the established latest-tag ordering. Prereleases advance past the
+// greatest published core version and retain a prerelease component, so they
+// cannot accidentally become latest while still being greater than `next`.
+// `unique` is a monotonic CI-run identity, not a timestamp, and is only used
+// after a drift is confirmed.
+export function nextUnpublishedVersion(local, publishedVersions, unique = "release") {
+  const parsedLocal = parseSemver(local);
+  if (!Array.isArray(publishedVersions)) throw new Error("published versions must be an array");
+
+  let greatestStable = parsedLocal.main;
+  let greatestCore = parsedLocal.main;
+  for (const version of publishedVersions) {
+    const parsed = parseSemver(version);
+    if (compareMain(parsed.main, greatestCore) > 0) greatestCore = parsed.main;
+    if (parsed.pre.length === 0 && compareMain(parsed.main, greatestStable) > 0) {
+      greatestStable = parsed.main;
+    }
+  }
+
+  if (parsedLocal.pre.length === 0) return incrementPatch(greatestStable).join(".");
+  if (!/^[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*$/.test(unique)) {
+    throw new Error(`not a prerelease identifier: ${unique}`);
+  }
+  return `${incrementPatch(greatestCore).join(".")}-release.${unique}`;
+}
+
+// Kept as the narrow public helper for the stable publish path and for
+// straightforward unit fixtures. The workflow uses nextUnpublishedVersion so
+// a drifted prerelease remains safely tagged as a prerelease too.
+export function nextUnpublishedStableVersion(local, publishedVersions) {
+  parseStable(local);
+  const next = nextUnpublishedVersion(local, publishedVersions);
+  parseStable(next);
+  return next;
+}
+
+export function normalizeManifest(json, { ignoreVersion = false } = {}) {
   const m = JSON.parse(json);
   for (const k of NPM_INJECTED_KEYS) delete m[k];
+  if (ignoreVersion) delete m.version;
   return JSON.stringify(canon(m));
 }
 
@@ -133,7 +188,7 @@ function walkRelative(root) {
 }
 
 // Compare two extracted `package/` directories. Returns { equal, reason }.
-export function packagesEquivalent(localDir, pubDir) {
+export function packagesEquivalent(localDir, pubDir, { ignoreVersion = false } = {}) {
   const localFiles = walkRelative(localDir);
   const pubFiles = walkRelative(pubDir);
   if (localFiles.join("\n") !== pubFiles.join("\n")) {
@@ -146,7 +201,7 @@ export function packagesEquivalent(localDir, pubDir) {
     const a = readFileSync(join(localDir, rel));
     const b = readFileSync(join(pubDir, rel));
     if (rel === "package.json") {
-      if (normalizeManifest(a.toString("utf8")) !== normalizeManifest(b.toString("utf8"))) {
+      if (normalizeManifest(a.toString("utf8"), { ignoreVersion }) !== normalizeManifest(b.toString("utf8"), { ignoreVersion })) {
         return { equal: false, reason: "package.json differs beyond npm-injected fields (e.g. bin/files/engines)" };
       }
     } else if (!a.equals(b)) {
@@ -164,8 +219,47 @@ export function packagesEquivalent(localDir, pubDir) {
   return { equal: true };
 }
 
+// A release-time repair carries a shipped receipt. It prevents an intentional
+// restore of any historical tarball from being mistaken for an earlier repair
+// of this exact source package. Versions and the receipt itself are excluded
+// so the identity represents only the source package being repaired.
+export function releaseRepairIdentity(packageDir) {
+  const hash = createHash("sha256");
+  for (const rel of walkRelative(packageDir)) {
+    if (rel === RELEASE_REPAIR_RECEIPT) continue;
+    const path = join(packageDir, rel);
+    const content = rel === "package.json"
+      ? normalizeManifest(readFileSync(path, "utf8"), { ignoreVersion: true })
+      : readFileSync(path);
+    hash.update(rel);
+    hash.update("\0");
+    hash.update(String(statSync(path).mode & 0o777));
+    hash.update("\0");
+    hash.update(content);
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+// True only when `candidateDir` bears the receipt emitted by this workflow for
+// the exact local source. A content-only historical match is deliberately not
+// enough: it must still publish so the restored artifact becomes latest.
+export function matchesReleaseRepair(localDir, candidateDir) {
+  try {
+    const receipt = JSON.parse(readFileSync(join(candidateDir, RELEASE_REPAIR_RECEIPT), "utf8"));
+    const localVersion = JSON.parse(readFileSync(join(localDir, "package.json"), "utf8")).version;
+    const sourceIdentity = releaseRepairIdentity(localDir);
+    return receipt.schema_version === 1
+      && receipt.source_version === localVersion
+      && receipt.source_identity === sourceIdentity
+      && releaseRepairIdentity(candidateDir) === sourceIdentity;
+  } catch {
+    return false;
+  }
+}
+
 // CLI: `node cli-publish-equal.mjs <localPackageDir> <publishedPackageDir>`.
-// Exit 0 = equivalent (safe skip); exit 3 = drift (must fail the publish job).
+// Exit 0 = equivalent (safe skip); exit 3 = drift (must allocate a new version).
 if (import.meta.url === `file://${process.argv[1]}`) {
   const args = process.argv.slice(2);
   // `--gt <next> <current>`: exit 0 iff stable `next` > stable `current`.
@@ -192,6 +286,60 @@ if (import.meta.url === `file://${process.argv[1]}`) {
       process.exit(2);
     }
   }
+  // `--next-version <local> <unique>` reads the registry's JSON versions list
+  // on stdin and prints an absent semver suitable for a drifted package.
+  if (args[0] === "--next-version") {
+    const [, local, unique] = args;
+    try {
+      const input = JSON.parse(readFileSync(0, "utf8"));
+      const versions = Array.isArray(input) ? input : [input];
+      console.log(nextUnpublishedVersion(local, versions, unique));
+      process.exit(0);
+    } catch (err) {
+      console.error(String(err.message ?? err));
+      process.exit(2);
+    }
+  }
+  if (args[0] === "--repair-identity") {
+    const [, packageDir] = args;
+    if (!packageDir) {
+      console.error("usage: publish-equal.mjs --repair-identity <packageDir>");
+      process.exit(2);
+    }
+    try {
+      console.log(releaseRepairIdentity(packageDir));
+      process.exit(0);
+    } catch (err) {
+      console.error(String(err.message ?? err));
+      process.exit(2);
+    }
+  }
+  if (args[0] === "--is-release-repair") {
+    const [, localDir, candidateDir] = args;
+    if (!localDir || !candidateDir) {
+      console.error("usage: publish-equal.mjs --is-release-repair <localPackageDir> <candidatePackageDir>");
+      process.exit(2);
+    }
+    process.exit(matchesReleaseRepair(localDir, candidateDir) ? 0 : 3);
+  }
+  // `--ignore-version <localPackageDir> <publishedPackageDir>` compares the
+  // shipped package while disregarding only package.json's version. The
+  // workflow uses this after confirmed drift to recognize an earlier
+  // release-time repair of the same source tarball on a rerun.
+  if (args[0] === "--ignore-version") {
+    const [, localDir, pubDir] = args;
+    if (!localDir || !pubDir) {
+      console.error("usage: publish-equal.mjs --ignore-version <localPackageDir> <publishedPackageDir>");
+      process.exit(2);
+    }
+    const result = packagesEquivalent(localDir, pubDir, { ignoreVersion: true });
+    if (result.equal) {
+      console.log("identical except package version");
+      process.exit(0);
+    }
+    console.error("drift: " + result.reason);
+    process.exit(3);
+  }
   const [localDir, pubDir] = args;
   if (!localDir || !pubDir) {
     console.error("usage: publish-equal.mjs <localPackageDir> <publishedPackageDir> | --gt <next> <current>");

package/src/run.mjs

@@ -132,10 +132,14 @@ export async function runWorker(contextFile, { spawnImpl = spawn, call = callToo
   // Subscribe before any filesystem I/O so a busy parallel test run (or a real
   // fast failure) cannot lose the sole terminal event.
   const completion = waitForChild(child);
-  await writeJson(context.context_path, { ...context, worker_pid: process.pid, workload_pid: child.pid });
+  // Capture pipes before the first await too. A short-lived command can emit
+  // all of its output while context persistence yields to the filesystem; if
+  // these listeners are attached afterwards, its terminal receipt silently
+  // reports zero bytes even though the command wrote successfully (BOT-1411).
   const capture = boundedCapture();
   child.stdout?.on("data", (chunk) => capture.append(chunk));
   child.stderr?.on("data", (chunk) => capture.append(chunk));
+  await writeJson(context.context_path, { ...context, worker_pid: process.pid, workload_pid: child.pid });
   let killTimer;
   const timer = setTimeout(() => {
     timedOut = true;

package/src/auth.test.mjs

@@ -1,404 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import http from "node:http";
-import { EventEmitter } from "node:events";
-
-import { doLogin } from "./auth.mjs";
-import {
-  createLoopbackReceiver,
-  buildAuthorizeUrl,
-  generatePkce,
-  generateState,
-  openBrowser,
-} from "./oauth-loopback.mjs";
-
-// ─── helpers ────────────────────────────────────────────────────────────────
-
-function httpGet(url) {
-  return new Promise((resolve, reject) => {
-    http
-      .get(url, (res) => {
-        let body = "";
-        res.on("data", (c) => (body += c));
-        res.on("end", () => resolve({ status: res.statusCode, body, headers: res.headers }));
-      })
-      .on("error", reject);
-  });
-}
-
-function jsonResponse(obj, status = 200) {
-  return { status, ok: status < 400, json: async () => obj };
-}
-
-// A mock fetch that only ever answers /register and /token. It records every
-// call so tests can assert /authorize is never fetched and the callback URI is
-// identical across registration and token exchange.
-function makeFetch({ tokenResponse, registerResponse } = {}) {
-  const calls = [];
-  const fetchImpl = async (url, opts = {}) => {
-    calls.push({ url, opts });
-    if (url.endsWith("/register")) {
-      const body = JSON.parse(opts.body);
-      return jsonResponse(registerResponse ?? { client_id: "client-123", redirect_uris: body.redirect_uris });
-    }
-    if (url.endsWith("/token")) {
-      return jsonResponse(tokenResponse ?? { access_token: "tok-secret-abc", expires_in: 3600 });
-    }
-    throw new Error(`unexpected fetch: ${url}`);
-  };
-  return { fetchImpl, calls };
-}
-
-// A stand-in for the browser: given the authorize URL, it plays the role of the
-// server-driven redirect and hits the loopback callback with a valid code+state.
-function browserThatCompletes(code = "auth-code-xyz") {
-  return async (authUrl) => {
-    const u = new URL(authUrl);
-    const redirectUri = u.searchParams.get("redirect_uri");
-    const state = u.searchParams.get("state");
-    await httpGet(`${redirectUri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`);
-  };
-}
-
-function captureUrl(line) {
-  const m = String(line).match(/https?:\/\/[^\s\x1b]+/);
-  return m ? m[0] : null;
-}
-
-async function waitFor(pred, timeout = 2000) {
-  const start = Date.now();
-  while (!pred()) {
-    if (Date.now() - start > timeout) throw new Error("waitFor timed out");
-    await new Promise((r) => setTimeout(r, 10));
-  }
-}
-
-const SERVER = "https://server.test/functions/v1/mcp-server";
-
-function baseDeps(overrides = {}) {
-  return {
-    serverUrl: SERVER,
-    saveConfig: () => {},
-    getConfig: () => ({}),
-    log: () => {},
-    errorLog: () => {},
-    timeoutMs: 3000,
-    now: () => 1000,
-    ...overrides,
-  };
-}
-
-// ─── AC-16: happy path ───────────────────────────────────────────────────────
-
-test("BOT-1383: happy path registers, authorizes via browser, exchanges token, saves config", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  const out = [];
-  let saved = null;
-
-  const result = await doLogin(
-    { noBrowser: false },
-    baseDeps({
-      fetch: fetchImpl,
-      openBrowser: browserThatCompletes("code-1"),
-      saveConfig: (c) => { saved = c; },
-      getConfig: () => ({ existing: "keep" }),
-      log: (s) => out.push(String(s)),
-    }),
-  );
-
-  assert.ok(saved, "config was saved");
-  assert.equal(saved.access_token, "tok-secret-abc");
-  assert.equal(saved.client_id, "client-123");
-  assert.equal(saved.existing, "keep", "preserves existing config fields");
-  assert.equal(saved.token_expires_at, 1000 + 3600 * 1000);
-  assert.match(result.redirectUri, /^http:\/\/127\.0\.0\.1:\d+\/callback$/);
-});
-
-// ─── AC-16: callback URI identical across registration and token exchange ─────
-
-test("BOT-1383: the callback URI is identical in registration and token exchange", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  await doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes() }));
-
-  const reg = calls.find((c) => c.url.endsWith("/register"));
-  const tok = calls.find((c) => c.url.endsWith("/token"));
-  const regRedirect = JSON.parse(reg.opts.body).redirect_uris[0];
-  const tokRedirect = new URLSearchParams(tok.opts.body.toString()).get("redirect_uri");
-
-  assert.equal(regRedirect, tokRedirect);
-  assert.match(regRedirect, /^http:\/\/127\.0\.0\.1:\d+\/callback$/);
-  assert.doesNotMatch(regRedirect, /19836/, "does not keep the old fixed port");
-});
-
-// ─── AC-16 regression: the CLI never fetches /authorize ───────────────────────
-
-test("BOT-1383 regression: the CLI never fetches /authorize and cannot hit the old redirect path", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  await doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes() }));
-
-  assert.ok(!calls.some((c) => c.url.includes("/authorize")), "no /authorize fetch");
-  assert.deepEqual(
-    calls.map((c) => c.url.replace(SERVER, "")),
-    ["/register", "/token"],
-  );
-});
-
-// ─── AC-4/AC-16: secrets never leak to output ─────────────────────────────────
-
-test("BOT-1383: verifier and access token never appear in terminal output", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  const out = [];
-  await doLogin(
-    {},
-    baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes(), log: (s) => out.push(String(s)), errorLog: (s) => out.push(String(s)) }),
-  );
-
-  const joined = out.join("\n");
-  const tok = calls.find((c) => c.url.endsWith("/token"));
-  const verifier = new URLSearchParams(tok.opts.body.toString()).get("code_verifier");
-
-  assert.ok(verifier && verifier.length >= 43, "verifier present in token exchange");
-  assert.ok(!joined.includes(verifier), "verifier not printed");
-  assert.ok(!joined.includes("tok-secret-abc"), "access token not printed");
-});
-
-// ─── AC-9: browser callback page discloses no secrets and is no-store ─────────
-
-test("BOT-1383: the callback success page is no-store and discloses no secrets", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "state-1" });
-  const { redirectUri } = await receiver.listen();
-  const waited = receiver.waitForCallback({ timeoutMs: 2000 });
-
-  const resp = await httpGet(`${redirectUri}?code=SUPERSECRETCODE&state=state-1`);
-  const { code } = await waited;
-
-  assert.equal(code, "SUPERSECRETCODE");
-  assert.equal(resp.status, 200);
-  assert.equal(resp.headers["cache-control"], "no-store");
-  assert.ok(!resp.body.includes("SUPERSECRETCODE"), "code not in HTML");
-  assert.ok(!resp.body.includes("state-1"), "state not in HTML");
-  // The page fires before token exchange, so it must not claim final success;
-  // it points the user to the terminal for the actual result.
-  assert.match(resp.body, /terminal/i, "directs the user to the terminal");
-  assert.doesNotMatch(resp.body, /succeeded/i, "does not over-claim authentication success");
-  await receiver.close();
-});
-
-// ─── AC-8: state validation ───────────────────────────────────────────────────
-
-test("BOT-1383: a wrong-state request is rejected but the listener keeps waiting", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "good" });
-  const { redirectUri } = await receiver.listen();
-  const waited = receiver.waitForCallback({ timeoutMs: 2000 });
-
-  // A stale/malicious tab or probe with the wrong state must NOT abort the login.
-  const bad = await httpGet(`${redirectUri}?code=stolen&state=bad`);
-  assert.equal(bad.status, 400);
-
-  // The legitimate callback still completes afterward.
-  const good = await httpGet(`${redirectUri}?code=real&state=good`);
-  assert.equal(good.status, 200);
-  const { code } = await waited;
-  assert.equal(code, "real");
-  await receiver.close();
-});
-
-test("BOT-1383: a callback missing the code is rejected", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "good" });
-  const { redirectUri } = await receiver.listen();
-  const rejected = assert.rejects(receiver.waitForCallback({ timeoutMs: 2000 }), /code/i);
-
-  const resp = await httpGet(`${redirectUri}?state=good`);
-  assert.equal(resp.status, 400);
-  await rejected;
-  await receiver.close();
-});
-
-// ─── AC-8: OAuth denial ───────────────────────────────────────────────────────
-
-test("BOT-1383: an OAuth error/denial callback is surfaced", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "s" });
-  const { redirectUri } = await receiver.listen();
-  const rejected = assert.rejects(receiver.waitForCallback({ timeoutMs: 2000 }), (err) => err.code === "access_denied");
-
-  await httpGet(`${redirectUri}?state=s&error=access_denied&error_description=User%20denied`);
-  await rejected;
-  await receiver.close();
-});
-
-// ─── AC-8: duplicate callback completes at most once ──────────────────────────
-
-test("BOT-1383: a duplicate callback completes at most once", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "s" });
-  const { redirectUri } = await receiver.listen();
-  const waited = receiver.waitForCallback({ timeoutMs: 2000 });
-
-  const r1 = await httpGet(`${redirectUri}?code=c1&state=s`);
-  const { code } = await waited;
-  const r2 = await httpGet(`${redirectUri}?code=c2&state=s`);
-
-  assert.equal(code, "c1", "first code wins");
-  assert.equal(r1.status, 200);
-  assert.equal(r2.status, 200, "duplicate handled gracefully");
-  await receiver.close();
-});
-
-// ─── AC-16: unrelated paths keep the listener waiting ─────────────────────────
-
-test("BOT-1383: a request to /favicon.ico does not complete the login", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "s" });
-  const { redirectUri, port } = await receiver.listen();
-  const waited = receiver.waitForCallback({ timeoutMs: 2000 });
-
-  const fav = await httpGet(`http://127.0.0.1:${port}/favicon.ico`);
-  assert.equal(fav.status, 404);
-
-  await httpGet(`${redirectUri}?code=ok&state=s`);
-  const { code } = await waited;
-  assert.equal(code, "ok");
-  await receiver.close();
-});
-
-// ─── AC-11: token failure saves nothing ───────────────────────────────────────
-
-test("BOT-1383: a token-exchange failure errors and saves no credentials", async () => {
-  const { fetchImpl } = makeFetch({ tokenResponse: { error: "invalid_grant" } });
-  let saved = null;
-  await assert.rejects(
-    doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes(), saveConfig: () => { saved = "X"; } })),
-    /Token exchange failed/,
-  );
-  assert.equal(saved, null);
-});
-
-test("BOT-1383: a registration failure errors before any browser launch", async () => {
-  const { fetchImpl } = makeFetch({ registerResponse: { error: "bad" } });
-  let opened = false;
-  await assert.rejects(
-    doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: async () => { opened = true; } })),
-    /Client registration failed/,
-  );
-  assert.equal(opened, false, "no browser launched when registration fails");
-});
-
-// ─── AC-11: timeout closes the listener and saves nothing ─────────────────────
-
-test("BOT-1383: a timeout errors, saves nothing, and never opens a real browser", async () => {
-  const { fetchImpl } = makeFetch();
-  let saved = null;
-  const silentBrowser = async () => {}; // never fires the callback
-  await assert.rejects(
-    doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: silentBrowser, saveConfig: () => { saved = "X"; }, timeoutMs: 120 })),
-    /Timed out/i,
-  );
-  assert.equal(saved, null);
-});
-
-// ─── AC-12: browser-launch failure still allows manual completion ─────────────
-
-test("BOT-1383: a browser-launch failure still allows manual completion", async () => {
-  const { fetchImpl, calls } = makeFetch();
-  const out = [];
-  let saved = null;
-  const failingBrowser = async () => { throw new Error("no browser here"); };
-
-  const login = doLogin(
-    {},
-    baseDeps({ fetch: fetchImpl, openBrowser: failingBrowser, saveConfig: (c) => { saved = c; }, log: (s) => out.push(String(s)) }),
-  );
-
-  // The user opens the printed URL manually: fire the callback ourselves.
-  await waitFor(() => out.some((l) => l.includes("/authorize?")));
-  const authUrl = captureUrl(out.find((l) => l.includes("/authorize?")));
-  const u = new URL(authUrl);
-  await httpGet(`${u.searchParams.get("redirect_uri")}?code=manual&state=${u.searchParams.get("state")}`);
-
-  await login;
-  assert.ok(saved && saved.access_token === "tok-secret-abc");
-  assert.ok(out.join("\n").includes("Couldn't open a browser"), "prints manual guidance");
-});
-
-// ─── AC-13: re-running login uses a fresh listener and state ───────────────────
-
-test("BOT-1383: re-running login uses an independent state and listener", async () => {
-  async function runOnce() {
-    const { fetchImpl } = makeFetch();
-    const out = [];
-    let saved = null;
-    await doLogin({}, baseDeps({ fetch: fetchImpl, openBrowser: browserThatCompletes(), saveConfig: (c) => { saved = c; }, log: (s) => out.push(String(s)) }));
-    const authUrl = captureUrl(out.find((l) => l.includes("/authorize?")));
-    return { state: new URL(authUrl).searchParams.get("state"), saved };
-  }
-  const a = await runOnce();
-  const b = await runOnce();
-
-  assert.ok(a.saved.access_token && b.saved.access_token, "both logins succeed");
-  assert.notEqual(a.state, b.state, "each login mints a fresh state");
-});
-
-// ─── AC-11: listener cleanup frees the socket ─────────────────────────────────
-
-test("BOT-1383: closing the receiver frees the socket", async () => {
-  const receiver = createLoopbackReceiver({ expectedState: "s" });
-  const { port } = await receiver.listen();
-  await receiver.close();
-  await assert.rejects(httpGet(`http://127.0.0.1:${port}/callback?state=s&code=c`), /ECONNREFUSED/);
-});
-
-// ─── AC-5: browser opener uses argument-based spawning per platform ────────────
-
-test("BOT-1383: openBrowser spawns an argument-based opener per platform, never a shell", async () => {
-  const spawned = [];
-  const fakeSpawn = (cmd, args, opts) => {
-    spawned.push({ cmd, args, opts });
-    const ee = new EventEmitter();
-    ee.unref = () => {};
-    setImmediate(() => ee.emit("spawn"));
-    return ee;
-  };
-  const url = "https://x.test/authorize?a=b&c=d";
-  await openBrowser(url, { platform: "darwin", spawn: fakeSpawn });
-  await openBrowser(url, { platform: "linux", spawn: fakeSpawn });
-  await openBrowser(url, { platform: "win32", spawn: fakeSpawn });
-
-  assert.deepEqual(spawned[0].args, [url]);
-  assert.equal(spawned[0].cmd, "open");
-  assert.equal(spawned[1].cmd, "xdg-open");
-  // Windows must NOT route the URL through cmd.exe (which splits on `&`); the
-  // whole URL is a single argv entry to rundll32's FileProtocolHandler.
-  assert.equal(spawned[2].cmd, "rundll32");
-  assert.deepEqual(spawned[2].args, ["url.dll,FileProtocolHandler", url], "URL is one unparsed argv entry");
-  assert.ok(spawned.every((s) => s.cmd !== "cmd"), "never invokes cmd.exe");
-  // The `&`-bearing URL survives intact as a single argument on every platform.
-  assert.ok(spawned.every((s) => s.args.includes(url)), "full URL passed as one discrete argument");
-  assert.ok(spawned.every((s) => s.opts.shell !== true), "never spawns a shell");
-});
-
-test("BOT-1383: openBrowser rejects when the opener cannot spawn", async () => {
-  const fakeSpawn = () => {
-    const ee = new EventEmitter();
-    setImmediate(() => ee.emit("error", new Error("ENOENT xdg-open")));
-    return ee;
-  };
-  await assert.rejects(openBrowser("https://x", { platform: "linux", spawn: fakeSpawn }), /ENOENT/);
-});
-
-// ─── unit sanity for the pure builders ────────────────────────────────────────
-
-test("BOT-1383: buildAuthorizeUrl carries PKCE S256 and never the verifier", () => {
-  const { codeVerifier, codeChallenge } = generatePkce();
-  const state = generateState();
-  const url = buildAuthorizeUrl({
-    serverUrl: SERVER,
-    clientId: "c1",
-    redirectUri: "http://127.0.0.1:5555/callback",
-    state,
-    codeChallenge,
-  });
-  const u = new URL(url);
-  assert.equal(u.searchParams.get("code_challenge_method"), "S256");
-  assert.equal(u.searchParams.get("code_challenge"), codeChallenge);
-  assert.equal(u.searchParams.get("response_type"), "code");
-  assert.equal(u.searchParams.get("redirect_uri"), "http://127.0.0.1:5555/callback");
-  assert.ok(!url.includes(codeVerifier), "verifier never in the browser URL");
-});