@botbuddy/cli 1.5.0 → 1.5.2

package/src/docker-hygiene.test.mjs

@@ -1,790 +0,0 @@
-// BOT-1405 — safe, explicit-context OrbStack/Supabase hygiene.
-import test from "node:test";
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-
-import {
-  DOCKER_HELP,
-  EXIT,
-  classifyInventory,
-  branchMatchesTicket,
-  evaluatePressure,
-  formatHumanReceipt,
-  parseDockerArgs,
-  projectMatchesTicket,
-  runDockerCommand,
-  runDockerWorkflow,
-} from "./docker-hygiene.mjs";
-
-const CLI_BIN = fileURLToPath(new URL("../bin/botbuddy.mjs", import.meta.url));
-const OWNED_BRANCH = () => "jmo-codex/bot-1405-orbstack-hygiene";
-const OWNED_LOCK = {
-  held: true,
-  host: "test-mac",
-  slot: "botbuddy-web-bot-1405",
-  resourceId: "00000000-0000-4000-8000-000000001405",
-  resourceName: "supabase_local:test-mac:botbuddy-web-bot-1405",
-};
-const QUEUED_LOCK_ID = "00000000-0000-4000-8000-000000001406";
-const GRANTED_LOCK_RAW = `locked (resource: ${OWNED_LOCK.resourceName}) [resource_id: ${OWNED_LOCK.resourceId}] ⏳ Lock TTL 15m: expires_at 2026-08-28T18:00:00Z (~900s).`;
-
-const ORBSTACK_CONTEXT = [{
-  Name: "orbstack",
-  Metadata: { Description: "OrbStack" },
-  Endpoints: { docker: { Host: "unix:///Users/test/.orbstack/run/docker.sock" } },
-}];
-
-const ORBSTACK_INFO = {
-  ID: "orb-server-id",
-  Name: "orbstack",
-  OperatingSystem: "OrbStack",
-  KernelVersion: "7.0.14-orbstack-test",
-  ServerVersion: "29.4.0",
-};
-
-function container(id, name, project, state, size = 0) {
-  return {
-    Id: id,
-    Name: `/${name}`,
-    Config: { Labels: project ? { "com.supabase.cli.project": project, "com.docker.compose.project": project } : {} },
-    State: {
-      Running: state === "running",
-      Paused: state === "paused",
-      Restarting: state === "restarting",
-      Status: state,
-    },
-    SizeRw: size,
-  };
-}
-
-function network(id, name, project, attached = {}, driver = "bridge") {
-  return {
-    Id: id,
-    Name: name,
-    Driver: driver,
-    Containers: attached,
-    Labels: project ? { "com.supabase.cli.project": project, "com.docker.compose.project": project } : {},
-  };
-}
-
-function baseState() {
-  return {
-    containers: [
-      container("c-stale", "supabase_db_stale", "botbuddy-web-bot-1405", "exited", 1536),
-      container("c-live-stopped", "supabase_vector_live", "live", "exited", 2048),
-      container("c-live", "supabase_db_live", "live", "running"),
-      container("c-starting", "supabase_db_starting", "starting", "created"),
-      container("c-starting-old", "supabase_vector_starting", "starting", "exited", 1024),
-      container("c-unlabelled", "supabase_db_unknown", null, "exited", 4096),
-      container("c-other", "unrelated", "other", "exited", 8192),
-    ],
-    networks: [
-      network("builtin", "bridge", null),
-      network("n-stale", "supabase_network_stale", "botbuddy-web-bot-1405"),
-      network("n-live", "supabase_network_live", "live", { "c-live": { Name: "supabase_db_live" } }),
-      network("n-unlabelled", "supabase_network_unknown", null),
-      network("n-other", "other_empty", "other"),
-    ],
-  };
-}
-
-function fakeDocker({ info = ORBSTACK_INFO, mutateBeforeRevalidation } = {}) {
-  const state = baseState();
-  const calls = [];
-  let inventoryReads = 0;
-
-  const run = (args) => {
-    calls.push([...args]);
-    const command = ["--context", "--host"].includes(args[0]) ? args.slice(2) : args;
-
-    if (command[0] === "context" && command[1] === "inspect") {
-      return { status: 0, stdout: JSON.stringify(ORBSTACK_CONTEXT), stderr: "" };
-    }
-    if (command[0] === "info") return { status: 0, stdout: JSON.stringify(info), stderr: "" };
-    if (command[0] === "container" && command[1] === "ls") {
-      inventoryReads += 1;
-      if (inventoryReads === 2 && mutateBeforeRevalidation) mutateBeforeRevalidation(state);
-      return { status: 0, stdout: state.containers.map((item) => item.Id).join("\n"), stderr: "" };
-    }
-    if (command[0] === "container" && command[1] === "inspect") {
-      const requested = new Set(command.slice(command.indexOf("--size") + 1));
-      return { status: 0, stdout: JSON.stringify(state.containers.filter((item) => requested.has(item.Id))), stderr: "" };
-    }
-    if (command[0] === "network" && command[1] === "ls") {
-      return { status: 0, stdout: state.networks.map((item) => item.Id).join("\n"), stderr: "" };
-    }
-    if (command[0] === "network" && command[1] === "inspect") {
-      const requested = new Set(command.slice(2));
-      return { status: 0, stdout: JSON.stringify(state.networks.filter((item) => requested.has(item.Id))), stderr: "" };
-    }
-    if (command[0] === "container" && command[1] === "rm") {
-      state.containers = state.containers.filter((item) => item.Id !== command[2]);
-      return { status: 0, stdout: `${command[2]}\n`, stderr: "" };
-    }
-    if (command[0] === "network" && command[1] === "rm") {
-      state.networks = state.networks.filter((item) => item.Id !== command[2]);
-      return { status: 0, stdout: `${command[2]}\n`, stderr: "" };
-    }
-    return { status: 125, stdout: "", stderr: `unexpected docker argv: ${args.join(" ")}` };
-  };
-
-  return { run, calls, state };
-}
-
-test("parseDockerArgs requires exactly one explicit context or endpoint", () => {
-  assert.match(parseDockerArgs(["hygiene"]).errors.join(" "), /--context.*--endpoint/i);
-  assert.match(
-    parseDockerArgs(["hygiene", "--context", "orbstack", "--endpoint", "unix:///tmp/docker.sock"]).errors.join(" "),
-    /exactly one/i,
-  );
-  assert.deepEqual(parseDockerArgs(["hygiene", "--context", "orbstack"]).errors, []);
-});
-
-test("missing explicit selector fails closed before Docker is called", () => {
-  const calls = [];
-  const result = runDockerWorkflow(["hygiene", "--json"], {
-    runDocker: (args) => {
-      calls.push(args);
-      return { status: 0, stdout: "", stderr: "" };
-    },
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.INVALID);
-  assert.equal(result.receipt.outcome, "error");
-  assert.deepEqual(calls, []);
-});
-
-test("parseDockerArgs rejects invalid pressure boundaries and unknown options", () => {
-  assert.match(parseDockerArgs(["preflight", "--context", "orbstack", "--warn-pressure", "10", "--fail-pressure", "9"]).errors.join(" "), /fail-pressure.*greater/i);
-  assert.match(parseDockerArgs(["hygiene", "--context", "orbstack", "--bogus"]).errors.join(" "), /unknown option/i);
-});
-
-test("parseDockerArgs preserves a following flag when an option value is missing", () => {
-  const parsed = parseDockerArgs(["hygiene", "--context", "--json"]);
-  assert.equal(parsed.opts.json, true);
-  assert.match(parsed.errors.join(" "), /--context needs a value/i);
-});
-
-test("ticket authority matches only explicit project and worktree ticket tokens", () => {
-  assert.equal(projectMatchesTicket("botbuddy-web-bot-1405", "BOT-1405"), true);
-  assert.equal(projectMatchesTicket("bot1405", "BOT-1405"), true);
-  assert.equal(projectMatchesTicket("sgent3836", "ENT-3836"), true);
-  assert.equal(projectMatchesTicket("sgent38360", "ENT-3836"), false);
-  assert.equal(projectMatchesTicket("xymjddoobrfnsmawmtbc", "BOT-1405"), false);
-  assert.equal(branchMatchesTicket("jmo-codex/bot-1405-orbstack-hygiene", "BOT-1405"), true);
-  assert.equal(branchMatchesTicket("jmo-codex/bot-14050-other", "BOT-1405"), false);
-});
-
-test("classifyInventory discovers only inactive stopped Supabase containers and empty labelled bridge networks", () => {
-  const state = baseState();
-  const result = classifyInventory(state);
-
-  assert.deepEqual(result.active_projects, ["live", "starting"]);
-  assert.deepEqual(result.candidates.map((item) => [item.type, item.id, item.name, item.reclaimable_bytes]), [
-    ["container", "c-stale", "supabase_db_stale", 1536],
-    ["network", "n-stale", "supabase_network_stale", 0],
-  ]);
-  assert.ok(result.skipped.some((item) => item.id === "c-live-stopped" && item.reason === "active_stack"));
-  assert.ok(result.skipped.some((item) => item.id === "c-starting-old" && item.reason === "active_stack"));
-  assert.ok(result.skipped.some((item) => item.id === "c-unlabelled" && item.reason === "missing_project_identity"));
-  assert.ok(result.skipped.some((item) => item.id === "n-live" && item.reason === "attached_containers"));
-  assert.ok(result.skipped.some((item) => item.id === "n-unlabelled" && item.reason === "missing_project_identity"));
-  assert.equal(result.skipped.some((item) => item.id === "builtin" || item.id === "n-other" || item.id === "c-other"), false);
-});
-
-test("dry-run inventories exact candidates but invokes no mutation command", () => {
-  const fake = fakeDocker();
-  const result = runDockerWorkflow(["hygiene", "--context", "orbstack", "--json"], {
-    runDocker: fake.run,
-    platform: "darwin",
-    now: () => new Date("2026-08-28T12:00:00.000Z"),
-  });
-
-  assert.equal(result.exitCode, EXIT.OK);
-  assert.equal(result.receipt.apply, false);
-  assert.deepEqual(result.receipt.candidates.map((item) => item.id), ["c-stale", "n-stale"]);
-  assert.deepEqual(result.receipt.deleted, []);
-  assert.equal(result.receipt.reclaimed_space_bytes, 0);
-  assert.equal(fake.calls.some((args) => args.includes("rm") || args.includes("prune")), false);
-  assert.ok(fake.calls.every((args) => args[0] === "--context" || args[0] === "context"));
-});
-
-test("discovery inspects large container inventories in bounded batches", () => {
-  const fake = fakeDocker();
-  for (let i = 0; i < 22; i += 1) {
-    fake.state.containers.push(container(`c-scale-${i}`, `supabase_db_scale_${i}`, `scale-${i}`, "running"));
-  }
-  const result = runDockerWorkflow(["hygiene", "--context", "orbstack", "--json"], {
-    runDocker: fake.run,
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.OK);
-  const inspectCalls = fake.calls.filter((args) => args.includes("container") && args.includes("inspect"));
-  assert.ok(inspectCalls.length >= 3);
-  assert.ok(inspectCalls.every((args) => args.slice(args.indexOf("--size") + 1).length <= 10));
-});
-
-test("apply removes only revalidated IDs without force, prune, or volume flags", () => {
-  const fake = fakeDocker();
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405",
-    "--candidate-id", "c-stale", "--candidate-id", "n-stale", "--json",
-  ], {
-    runDocker: fake.run,
-    resolveBranch: OWNED_BRANCH,
-    lockAuthority: OWNED_LOCK,
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.OK);
-  assert.deepEqual(result.receipt.deleted.map((item) => [item.type, item.id]), [["container", "c-stale"], ["network", "n-stale"]]);
-  assert.equal(result.receipt.reclaimed_space_bytes, 1536);
-
-  const mutations = fake.calls.filter((args) => args.includes("rm"));
-  assert.deepEqual(mutations, [
-    ["--context", "orbstack", "container", "rm", "c-stale"],
-    ["--context", "orbstack", "network", "rm", "n-stale"],
-  ]);
-  for (const args of fake.calls) {
-    assert.equal(args.some((arg) => arg === "prune" || arg === "--volumes" || arg === "-v" || arg === "--force"), false, args.join(" "));
-    assert.equal(args[0] === "volume" || args.includes("volume"), false, args.join(" "));
-  }
-});
-
-test("apply refuses without a ticket and exact reviewed candidate IDs before Docker is called", () => {
-  const calls = [];
-  const result = runDockerWorkflow(["hygiene", "--context", "orbstack", "--apply", "--json"], {
-    runDocker: (args) => {
-      calls.push(args);
-      return { status: 0, stdout: "", stderr: "" };
-    },
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.INVALID);
-  assert.match(result.receipt.errors.join(" "), /--ticket/i);
-  assert.match(result.receipt.errors.join(" "), /--candidate-id/i);
-  assert.deepEqual(calls, []);
-});
-
-test("apply refuses when the current worktree branch does not own the ticket", () => {
-  const calls = [];
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405",
-    "--candidate-id", "c-stale", "--json",
-  ], {
-    runDocker: (args) => {
-      calls.push(args);
-      return { status: 0, stdout: "", stderr: "" };
-    },
-    resolveBranch: () => "jmo-codex/bot-9999-other-work",
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.INVALID);
-  assert.equal(result.receipt.outcome, "refused");
-  assert.match(result.receipt.errors.join(" "), /does not own BOT-1405/i);
-  assert.deepEqual(calls, []);
-});
-
-test("apply refuses before Docker inventory when no confirmed stack lock is present", () => {
-  const calls = [];
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    runDocker: (args) => {
-      calls.push(args);
-      return { status: 0, stdout: "", stderr: "" };
-    },
-    resolveBranch: OWNED_BRANCH,
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.equal(result.receipt.outcome, "refused");
-  assert.match(result.receipt.errors.join(" "), /confirmed BotBuddy supabase_local lock/i);
-  assert.deepEqual(calls, []);
-});
-
-test("runDockerCommand holds and releases the ticket stack lock around apply", async () => {
-  const fake = fakeDocker();
-  const events = [];
-  const callTool = async (tool, args) => {
-    events.push([tool, args]);
-    if (tool === "acquire_lock") {
-      return {
-        ok: true,
-        isError: false,
-        data: { raw: GRANTED_LOCK_RAW },
-      };
-    }
-    if (tool === "release_lock") return { ok: true, isError: false, data: { raw: "released" } };
-    throw new Error(`unexpected tool ${tool}`);
-  };
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    callTool,
-    machineHost: "test-mac",
-    workflowOptions: { runDocker: fake.run, resolveBranch: OWNED_BRANCH, platform: "darwin" },
-  });
-
-  assert.equal(result.exitCode, EXIT.OK);
-  assert.deepEqual(events.map(([tool]) => tool), ["acquire_lock", "release_lock"]);
-  assert.deepEqual(events[0][1], {
-    resource_type: "container",
-    subtype: "supabase_local",
-    host: "test-mac",
-    slot: "botbuddy-web-bot-1405",
-    mode: "lock",
-    ticket_id: "BOT-1405",
-    no_pr_reason: "local OrbStack hygiene",
-  });
-  assert.deepEqual(events[1][1], { resource_id: OWNED_LOCK.resourceId });
-  assert.equal(result.receipt.authority.stack_lock.released, true);
-});
-
-test("runDockerCommand takes the shared project file lock before the BotBuddy lock and Docker", async () => {
-  const fake = fakeDocker();
-  const events = [];
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    resolveProjectId: () => "xymjddoobrfnsmawmtbc",
-    fileLockPathForProject: (projectId) => `/tmp/${projectId}.lock`,
-    acquireFileLock: async (path) => {
-      events.push(["file_acquire", path]);
-      return { path, release: () => events.push(["file_release", path]) };
-    },
-    callTool: async (tool) => {
-      events.push([tool]);
-      return tool === "acquire_lock"
-        ? { ok: true, isError: false, data: { raw: GRANTED_LOCK_RAW } }
-        : { ok: true, isError: false, data: { raw: "released" } };
-    },
-    machineHost: "test-mac",
-    workflowOptions: {
-      runDocker: (args, options) => { events.push(["docker", args]); return fake.run(args, options); },
-      resolveBranch: OWNED_BRANCH,
-      platform: "darwin",
-    },
-  });
-
-  assert.equal(result.exitCode, EXIT.OK);
-  assert.deepEqual(events[0], ["file_acquire", "/tmp/xymjddoobrfnsmawmtbc.lock"]);
-  assert.equal(events[1][0], "acquire_lock");
-  assert.ok(events.findIndex(([kind]) => kind === "docker") > 1);
-  assert.ok(events.findIndex(([kind]) => kind === "release_lock") < events.findIndex(([kind]) => kind === "file_release"));
-  assert.deepEqual(result.receipt.authority.file_lock, {
-    project_id: "xymjddoobrfnsmawmtbc", path: "/tmp/xymjddoobrfnsmawmtbc.lock", held: false, released: true,
-  });
-});
-
-test("runDockerCommand refuses before BotBuddy or Docker when the project file lock cannot be acquired", async () => {
-  const calls = [];
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    resolveProjectId: () => "xymjddoobrfnsmawmtbc",
-    acquireFileLock: async () => { throw new Error("held by another worktree"); },
-    callTool: async (tool) => { calls.push(tool); throw new Error("must not call BotBuddy"); },
-    workflowOptions: { runDocker: (args) => { calls.push(args); throw new Error("must not call Docker"); } },
-  });
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.match(result.receipt.errors.join(" "), /file lock.*another worktree/i);
-  assert.deepEqual(calls, []);
-});
-
-test("runDockerCommand fails closed on a busy stack lock without Docker inventory", async () => {
-  const fake = fakeDocker();
-  const calls = [];
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    callTool: async (tool, args) => {
-      calls.push([tool, args]);
-      return tool === "acquire_lock"
-        ? {
-          ok: true,
-          isError: true,
-          data: {
-            success: false,
-            queued: true,
-            message: "held by another session",
-            resource_id: OWNED_LOCK.resourceId,
-            resource_lock_id: QUEUED_LOCK_ID,
-            resource_name: OWNED_LOCK.resourceName,
-          },
-        }
-        : { ok: true, isError: false, data: { success: true, retired: true } };
-    },
-    machineHost: "test-mac",
-    workflowOptions: { runDocker: fake.run, resolveBranch: OWNED_BRANCH, platform: "darwin" },
-  });
-
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.equal(result.receipt.outcome, "refused");
-  assert.match(result.receipt.errors.join(" "), /held by another session/i);
-  assert.deepEqual(calls.map(([tool]) => tool), ["acquire_lock", "retire_queued_lock_attempt"]);
-  assert.deepEqual(calls[1][1], { resource_id: OWNED_LOCK.resourceId, resource_lock_id: QUEUED_LOCK_ID });
-  assert.deepEqual(result.receipt.authority.queued_lock_attempt, {
-    resource_id: OWNED_LOCK.resourceId,
-    resource_lock_id: QUEUED_LOCK_ID,
-    resource_name: OWNED_LOCK.resourceName,
-    retired: true,
-    already_absent: false,
-  });
-  assert.deepEqual(fake.calls, []);
-});
-
-test("runDockerCommand reports a failed queued-attempt retirement and still refuses Docker", async () => {
-  const fake = fakeDocker();
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    callTool: async (tool) => tool === "acquire_lock"
-      ? {
-        ok: true,
-        isError: true,
-        data: { success: false, queued: true, message: "busy", resource_id: OWNED_LOCK.resourceId, resource_lock_id: QUEUED_LOCK_ID },
-      }
-      : { ok: false, isError: true, error: "relay unavailable" },
-    machineHost: "test-mac",
-    workflowOptions: { runDocker: fake.run, resolveBranch: OWNED_BRANCH, platform: "darwin" },
-  });
-
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.match(result.receipt.errors.join(" "), /retire queued lock attempt.*relay unavailable/i);
-  assert.equal(result.receipt.authority.queued_lock_attempt.retired, false);
-  assert.equal(result.receipt.authority.queued_lock_attempt.already_absent, false);
-  assert.deepEqual(fake.calls, []);
-});
-
-test("runDockerCommand refuses a reentrant already-held lock without releasing its owner", async () => {
-  const fake = fakeDocker();
-  const calls = [];
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    callTool: async (tool, args) => {
-      calls.push([tool, args]);
-      return {
-        ok: true,
-        isError: false,
-        data: {
-          raw: `Exclusive lock already held (resource: ${OWNED_LOCK.resourceName}) [resource_id: ${OWNED_LOCK.resourceId}]`,
-        },
-      };
-    },
-    machineHost: "test-mac",
-    workflowOptions: { runDocker: fake.run, resolveBranch: OWNED_BRANCH, platform: "darwin" },
-  });
-
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.equal(result.receipt.outcome, "refused");
-  assert.match(result.receipt.errors.join(" "), /already held/i);
-  assert.deepEqual(calls.map(([tool]) => tool), ["acquire_lock"]);
-  assert.deepEqual(fake.calls, []);
-});
-
-test("apply stops Docker work before the advertised lock budget can lapse", () => {
-  const fake = fakeDocker();
-  let elapsed = 0;
-  const timedRun = (args, options) => {
-    assert.ok(options.timeoutMs > 0 && options.timeoutMs <= 30_000);
-    elapsed += 10_000;
-    return fake.run(args);
-  };
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    runDocker: timedRun,
-    resolveBranch: OWNED_BRANCH,
-    lockAuthority: OWNED_LOCK,
-    deadlineAt: 55_000,
-    monotonicNow: () => elapsed,
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.DELETE_FAILED);
-  assert.match(result.receipt.errors.join(" "), /lock safety budget expired/i);
-  assert.equal(fake.calls.some((args) => args.includes("rm")), false);
-});
-
-test("apply preserves a successful deletion receipt when its Docker call crosses the lock budget", () => {
-  const fake = fakeDocker();
-  let elapsed = 0;
-  const timedRun = (args, options) => {
-    assert.ok(options.timeoutMs > 0 && options.timeoutMs <= 30_000);
-    const result = fake.run(args);
-    if (args.includes("rm")) elapsed = 1_001;
-    return result;
-  };
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale",
-    "--candidate-id", "n-stale", "--json",
-  ], {
-    runDocker: timedRun,
-    resolveBranch: OWNED_BRANCH,
-    lockAuthority: OWNED_LOCK,
-    deadlineAt: 1_000,
-    monotonicNow: () => elapsed,
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.DELETE_FAILED);
-  assert.equal(result.receipt.outcome, "partial_failure");
-  assert.deepEqual(result.receipt.deleted.map((item) => item.id), ["c-stale"]);
-  assert.equal(result.receipt.reclaimed_space_bytes, 1536);
-  assert.match(result.receipt.errors.join(" "), /budget expired after successful.*c-stale/i);
-  assert.equal(fake.calls.some((args) => args.includes("network") && args.includes("rm")), false);
-});
-
-test("runDockerCommand attempts fallback release when a grant has no identity", async () => {
-  const fake = fakeDocker();
-  const calls = [];
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    callTool: async (tool, args) => {
-      calls.push([tool, args]);
-      return tool === "acquire_lock"
-        ? { ok: true, isError: false, data: { raw: "lock granted" } }
-        : { ok: true, isError: false, data: { raw: "released" } };
-    },
-    machineHost: "test-mac",
-    workflowOptions: { runDocker: fake.run, resolveBranch: OWNED_BRANCH, platform: "darwin" },
-  });
-
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.match(result.receipt.errors.join(" "), /without a releasable identity/i);
-  assert.deepEqual(calls.map(([tool]) => tool), ["acquire_lock", "release_lock"]);
-  assert.deepEqual(calls[1][1], { resource_name: "supabase_local:test-mac:botbuddy-web-bot-1405" });
-  assert.deepEqual(fake.calls, []);
-});
-
-test("runDockerCommand releases and refuses a grant without safe TTL metadata", async () => {
-  const fake = fakeDocker();
-  const calls = [];
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    callTool: async (tool, args) => {
-      calls.push([tool, args]);
-      return tool === "acquire_lock"
-        ? { ok: true, isError: false, data: { raw: `locked (resource: ${OWNED_LOCK.resourceName}) [resource_id: ${OWNED_LOCK.resourceId}]` } }
-        : { ok: true, isError: false, data: { raw: "released" } };
-    },
-    machineHost: "test-mac",
-    workflowOptions: { runDocker: fake.run, resolveBranch: OWNED_BRANCH, platform: "darwin" },
-  });
-
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.match(result.receipt.errors.join(" "), /safe remaining TTL/i);
-  assert.deepEqual(calls.map(([tool]) => tool), ["acquire_lock", "release_lock"]);
-  assert.deepEqual(calls[1][1], { resource_id: OWNED_LOCK.resourceId });
-  assert.deepEqual(fake.calls, []);
-});
-
-test("runDockerCommand reports lock-release failure as non-zero after cleanup", async () => {
-  const fake = fakeDocker();
-  const result = await runDockerCommand([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405", "--candidate-id", "c-stale", "--json",
-  ], {
-    callTool: async (tool) => tool === "acquire_lock"
-      ? { ok: true, isError: false, data: { raw: GRANTED_LOCK_RAW } }
-      : { ok: false, isError: true, error: "release unavailable" },
-    machineHost: "test-mac",
-    workflowOptions: { runDocker: fake.run, resolveBranch: OWNED_BRANCH, platform: "darwin" },
-  });
-
-  assert.equal(result.exitCode, EXIT.DELETE_FAILED);
-  assert.equal(result.receipt.outcome, "partial_failure");
-  assert.match(result.receipt.errors.join(" "), /release unavailable/i);
-  assert.equal(result.receipt.authority.stack_lock.held, true);
-});
-
-test("apply refuses candidate IDs outside the ticket-owned project without deleting anything", () => {
-  const fake = fakeDocker();
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "ENT-9999",
-    "--lock-slot", "supplyspark-ent-sgent9999",
-    "--candidate-id", "c-stale", "--json",
-  ], {
-    runDocker: fake.run,
-    resolveBranch: () => "jmo-codex/ent-9999-hygiene",
-    lockAuthority: { ...OWNED_LOCK, slot: "supplyspark-ent-sgent9999" },
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.INVALID);
-  assert.equal(result.receipt.outcome, "refused");
-  assert.match(result.receipt.errors.join(" "), /does not belong to ENT-9999/i);
-  assert.equal(fake.calls.some((args) => args.includes("rm")), false);
-});
-
-test("apply never adds a newly eligible or unselected candidate to the reviewed set", () => {
-  const fake = fakeDocker();
-  fake.state.containers.push(container("c-other-stale", "supabase_db_other", "botbuddy-web-bot-1405", "exited", 99));
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405",
-    "--candidate-id", "c-stale", "--json",
-  ], { runDocker: fake.run, resolveBranch: OWNED_BRANCH, lockAuthority: OWNED_LOCK, platform: "darwin" });
-
-  assert.equal(result.exitCode, EXIT.OK);
-  assert.deepEqual(result.receipt.deleted.map((item) => item.id), ["c-stale"]);
-  assert.equal(fake.calls.some((args) => args.includes("rm") && args.includes("c-other-stale")), false);
-  assert.equal(fake.calls.some((args) => args.includes("rm") && args.includes("n-stale")), false);
-});
-
-test("apply refuses a candidate whose stack becomes active before deletion", () => {
-  const fake = fakeDocker({
-    mutateBeforeRevalidation: (state) => state.containers.push(container("c-new-live", "supabase_rest_stale", "botbuddy-web-bot-1405", "running")),
-  });
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405",
-    "--candidate-id", "c-stale", "--candidate-id", "n-stale", "--json",
-  ], {
-    runDocker: fake.run,
-    resolveBranch: OWNED_BRANCH,
-    lockAuthority: OWNED_LOCK,
-    platform: "darwin",
-  });
-
-  assert.equal(result.receipt.deleted.some((item) => item.id === "c-stale"), false);
-  assert.equal(result.receipt.deleted.some((item) => item.id === "n-stale"), false);
-  assert.equal(result.exitCode, EXIT.DELETE_FAILED);
-  assert.equal(result.receipt.outcome, "refused");
-  assert.ok(result.receipt.skipped.some((item) => item.id === "c-stale" && item.reason === "active_stack"));
-  assert.ok(result.receipt.skipped.some((item) => item.id === "n-stale" && item.reason === "active_stack"));
-  assert.equal(fake.calls.some((args) => args.includes("rm") && args.includes("c-stale")), false);
-  assert.equal(fake.calls.some((args) => args.includes("rm") && args.includes("n-stale")), false);
-});
-
-test("malformed Docker inventory fails closed without mutation", () => {
-  const fake = fakeDocker();
-  const run = (args) => {
-    if (args.includes("container") && args.includes("inspect")) {
-      fake.calls.push([...args]);
-      return { status: 0, stdout: "not-json", stderr: "" };
-    }
-    return fake.run(args);
-  };
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "orbstack", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405",
-    "--candidate-id", "c-stale", "--json",
-  ], {
-    runDocker: run,
-    resolveBranch: OWNED_BRANCH,
-    lockAuthority: OWNED_LOCK,
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.match(result.receipt.errors.join(" "), /malformed JSON/i);
-  assert.equal(fake.calls.some((args) => args.includes("rm") || args.includes("prune")), false);
-});
-
-test("wrong Docker server refuses before inventory or mutation", () => {
-  const fake = fakeDocker({ info: { ...ORBSTACK_INFO, OperatingSystem: "Docker Desktop", KernelVersion: "linuxkit" } });
-  const result = runDockerWorkflow([
-    "hygiene", "--context", "desktop-linux", "--apply", "--ticket", "BOT-1405",
-    "--lock-slot", "botbuddy-web-bot-1405",
-    "--candidate-id", "c-stale", "--json",
-  ], {
-    runDocker: fake.run,
-    resolveBranch: OWNED_BRANCH,
-    lockAuthority: OWNED_LOCK,
-    platform: "darwin",
-  });
-
-  assert.equal(result.exitCode, EXIT.DOCKER);
-  assert.equal(result.receipt.outcome, "error");
-  assert.match(result.receipt.errors.join(" "), /not OrbStack/i);
-  assert.equal(fake.calls.some((args) => args.includes("container") || args.includes("network")), false);
-});
-
-test("endpoint mode pins every daemon call to the exact endpoint", () => {
-  const fake = fakeDocker();
-  const endpoint = "unix:///Users/test/.orbstack/run/docker.sock";
-  const result = runDockerWorkflow(["hygiene", "--endpoint", endpoint, "--json"], {
-    runDocker: fake.run,
-    platform: "darwin",
-  });
-  assert.equal(result.exitCode, EXIT.OK);
-  assert.ok(fake.calls.every((args) => args[0] === "--host" && args[1] === endpoint));
-});
-
-test("preflight boundary returns ok, warn, and fail without mutation", () => {
-  assert.equal(evaluatePressure({ bridgeNetworks: 2, attachedEndpoints: 1, projectedEndpoints: 1, warn: 8, fail: 10 }).status, "ok");
-  assert.equal(evaluatePressure({ bridgeNetworks: 2, attachedEndpoints: 1, projectedEndpoints: 1, warn: 7, fail: 10 }).status, "warn");
-  const failed = evaluatePressure({ bridgeNetworks: 2, attachedEndpoints: 1, projectedEndpoints: 1, warn: 6, fail: 7 });
-  assert.equal(failed.status, "fail");
-  assert.equal(failed.projected_pressure_units, 7);
-
-  const fake = fakeDocker();
-  const result = runDockerWorkflow(["preflight", "--context", "orbstack", "--projected-endpoints", "1", "--warn-pressure", "6", "--fail-pressure", "7", "--json"], {
-    runDocker: fake.run,
-    platform: "darwin",
-  });
-  assert.equal(result.exitCode, EXIT.PRESSURE);
-  assert.equal(result.receipt.pressure.status, "fail");
-  assert.equal(fake.calls.some((args) => args.includes("rm") || args.includes("prune")), false);
-});
-
-test("human receipt contains context, candidates, skips, reclaim, and recommendation", () => {
-  const fake = fakeDocker();
-  const { receipt } = runDockerWorkflow(["hygiene", "--context", "orbstack", "--ticket", "BOT-1405"], {
-    runDocker: fake.run,
-    platform: "darwin",
-    now: () => new Date("2026-08-28T12:00:00.000Z"),
-  });
-  const human = formatHumanReceipt(receipt);
-  for (const value of ["orbstack", "BOT-1405", "supabase_db_stale", "supabase_network_stale", "active_stack", "0 B", "--apply", "--candidate-id c-stale"]) {
-    assert.ok(human.includes(value), `human receipt missing ${value}`);
-  }
-});
-
-test("help documents dry-run, apply, explicit selectors, and no-volume guarantee", () => {
-  for (const value of ["docker hygiene", "docker preflight", "--context", "--endpoint", "--apply", "dry-run", "never removes volumes"]) {
-    assert.ok(DOCKER_HELP.toLowerCase().includes(value.toLowerCase()), `help missing ${value}`);
-  }
-});
-
-test("published CLI route exposes docker help and one-line JSON failures", () => {
-  const help = spawnSync(process.execPath, [CLI_BIN, "docker", "help"], { encoding: "utf8" });
-  assert.equal(help.status, 0, help.stderr);
-  assert.match(help.stdout, /botbuddy docker hygiene/);
-
-  const invalid = spawnSync(process.execPath, [CLI_BIN, "docker", "hygiene", "--json"], { encoding: "utf8" });
-  assert.equal(invalid.status, EXIT.INVALID);
-  assert.equal(invalid.stderr, "");
-  const lines = invalid.stdout.trim().split("\n");
-  assert.equal(lines.length, 1);
-  assert.equal(JSON.parse(lines[0]).outcome, "error");
-
-  const missingValue = spawnSync(process.execPath, [CLI_BIN, "docker", "hygiene", "--context", "--json"], { encoding: "utf8" });
-  assert.equal(missingValue.status, EXIT.INVALID);
-  assert.equal(missingValue.stdout.trim().split("\n").length, 1);
-  assert.match(JSON.parse(missingValue.stdout).errors.join(" "), /--context needs a value/i);
-});