@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/lib/tool-definitions-integration.test.mjs

@@ -1,83 +0,0 @@
-/**
- * tool-definitions-integration.test.mjs — SP5 native-plane hot-refresh.
- *
- * The native tool snapshot (getToolsForAccessLevel) must reflect a CHANGED disk
- * cache without a restart: a granted integration tool appears at the write tiers
- * (ceo + leadership) and never at the read-only default tier. Run:
- * node --test lib/tool-definitions-integration.test.mjs
- */
-
-"use strict";
-
-import { test, before, after, beforeEach } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { getToolNamesForAccessLevel } from "./tool-definitions.js";
-import { writeIntegrationToolsToDisk } from "./org/integration-tools.mjs";
-
-const ENV_KEYS = ["COHORT_AGENT_ROOT", "AGENT_ROOT", "AGENT_DIR"];
-const saved = {};
-let root;
-
-const TOOL = {
-  name: "plugin__stripe__list_charges",
-  title: "list_charges",
-  description: "stripe: List charges",
-  input_schema: { type: "object" },
-  access: "write",
-  binding: { kind: "rpc", method: "integration.invokeTool" },
-  integration: { slug: "stripe", tool: "list_charges" },
-};
-
-before(() => {
-  for (const k of ENV_KEYS) { saved[k] = process.env[k]; delete process.env[k]; }
-  root = mkdtempSync(join(tmpdir(), "td-integration-"));
-  process.env.COHORT_AGENT_ROOT = root;
-});
-after(() => {
-  for (const k of ENV_KEYS) {
-    if (saved[k] === undefined) delete process.env[k];
-    else process.env[k] = saved[k];
-  }
-  try { rmSync(root, { recursive: true, force: true }); } catch { /* best-effort */ }
-});
-beforeEach(() => { process.env.COHORT_AGENT_ROOT = root; });
-
-test("no disk cache → the integration tool is absent everywhere", () => {
-  const ceo = getToolNamesForAccessLevel("ceo");
-  assert.equal(ceo.includes("plugin__stripe__list_charges"), false);
-});
-
-test("after a disk write, the native ceo + leadership tiers expose it (hot-refresh)", () => {
-  writeIntegrationToolsToDisk(root, { version: 1, tools: [TOOL] });
-  assert.ok(
-    getToolNamesForAccessLevel("ceo").includes("plugin__stripe__list_charges"),
-    "ceo sees the granted tool",
-  );
-  assert.ok(
-    getToolNamesForAccessLevel("leadership").includes("plugin__stripe__list_charges"),
-    "leadership sees the granted tool",
-  );
-});
-
-test("the read-only default tier never exposes the write-tier integration tool", () => {
-  writeIntegrationToolsToDisk(root, { version: 1, tools: [TOOL] });
-  assert.equal(
-    getToolNamesForAccessLevel("default").includes("plugin__stripe__list_charges"),
-    false,
-  );
-});
-
-test("a bumped disk cache is reflected on the very next call (no restart)", () => {
-  writeIntegrationToolsToDisk(root, { version: 2, tools: [TOOL] });
-  assert.ok(getToolNamesForAccessLevel("ceo").includes("plugin__stripe__list_charges"));
-  // Revoke everything: next call reflects the empty set.
-  writeIntegrationToolsToDisk(root, { version: 3, tools: [] });
-  assert.equal(
-    getToolNamesForAccessLevel("ceo").includes("plugin__stripe__list_charges"),
-    false,
-  );
-});

package/lib/tool-definitions.test.mjs

@@ -1,437 +0,0 @@
-/**
- * tool-definitions.test.mjs — access-control / privilege-escalation tests for
- * the maestro tool surface (lib/tool-definitions.js).
- *
- * The tool-definitions module is the SoT for which Claude API tools are exposed
- * to a caller given their access level (ceo / leadership / voice / default).
- * Because the write tools here can send email, place phone calls, and generate
- * outbound documents, the scoping logic is a privilege boundary: a regression
- * that leaks a CEO-only write tool into the `default` (read-only) surface is a
- * real escalation. These tests pin that boundary plus the structural invariants
- * every tool schema must satisfy to be accepted by the Claude API.
- *
- * Pure assertions over the exported functions; the only dependency is
- * node:test + node:assert and the module under test.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  getToolsForAccessLevel,
-  getToolNamesForAccessLevel,
-  getAllToolsByCategory,
-  normalizeAccessLevel,
-  KNOWN_ACCESS_LEVELS,
-} from "./tool-definitions.js";
-
-// Access levels the module is documented to recognise.
-const KNOWN_LEVELS = ["ceo", "leadership", "voice", "default"];
-
-// Read-only tools must never confer the ability to act. These are the
-// write/side-effecting tools that gate on privilege; none may appear in the
-// `default` surface.
-const WRITE_TOOL_NAMES = new Set([
-  "slack_send",
-  "draft_email",
-  "whatsapp_send",
-  "sms_send",
-  "send_voice_message",
-  "place_voice_call",
-  "queue_update",
-  "create_action_item",
-  "schedule_meeting",
-  "create_reminder",
-  "generate_memo",
-  "generate_report",
-]);
-
-// The most sensitive write tools — CEO-only, must NOT leak down to leadership.
-const CEO_ONLY_WRITE_NAMES = [
-  "whatsapp_send",
-  "sms_send",
-  "place_voice_call",
-  "generate_memo",
-  "generate_report",
-];
-
-/** Resolve a tool by name within an access level's surface (the module has no
- * direct getToolByName export, so this mirrors how a caller would look one up). */
-function findToolByName(accessLevel, name) {
-  return getToolsForAccessLevel(accessLevel).find((t) => t.name === name);
-}
-
-// ---------------------------------------------------------------------------
-// Each access level returns a defined, non-empty tool set
-// ---------------------------------------------------------------------------
-
-for (const level of KNOWN_LEVELS) {
-  test(`getToolsForAccessLevel("${level}") returns a defined, non-empty array`, () => {
-    const tools = getToolsForAccessLevel(level);
-    assert.ok(Array.isArray(tools), `${level} should return an array`);
-    assert.ok(tools.length > 0, `${level} should expose at least one tool`);
-  });
-
-  test(`getToolNamesForAccessLevel("${level}") matches the tool array`, () => {
-    const names = getToolNamesForAccessLevel(level);
-    const tools = getToolsForAccessLevel(level);
-    assert.ok(Array.isArray(names));
-    assert.equal(names.length, tools.length);
-    assert.deepEqual(names, tools.map((t) => t.name));
-  });
-
-  test(`"${level}" surface has no duplicate tool names`, () => {
-    const names = getToolNamesForAccessLevel(level);
-    assert.equal(new Set(names).size, names.length, `${level} has duplicate tools`);
-  });
-}
-
-// ---------------------------------------------------------------------------
-// Unknown access level: least-privilege "default" surface, never empty, no throw
-// (audit M4 + the CEO-case footgun — "CEO" used to yield 0 tools silently)
-// ---------------------------------------------------------------------------
-
-test("unknown access level coerces to the default surface (NOT empty), no throw", () => {
-  let tools;
-  assert.doesNotThrow(() => {
-    tools = getToolsForAccessLevel("intern");
-  });
-  assert.ok(Array.isArray(tools));
-  assert.ok(tools.length > 0, "unknown level must not yield an empty tool set");
-  assert.deepEqual(tools, getToolsForAccessLevel("default"));
-});
-
-test("undefined / null / empty / numeric access levels coerce to default, no throw", () => {
-  const defaultTools = getToolsForAccessLevel("default");
-  for (const bad of [undefined, null, "", 42, {}, []]) {
-    let tools;
-    assert.doesNotThrow(() => {
-      tools = getToolsForAccessLevel(bad);
-    }, `access level ${JSON.stringify(bad)} should not throw`);
-    assert.ok(Array.isArray(tools));
-    assert.deepEqual(
-      tools,
-      defaultTools,
-      `access level ${JSON.stringify(bad)} should fall back to default`,
-    );
-  }
-});
-
-test("access-level lookups are case/whitespace-insensitive (CEO === ceo)", () => {
-  // The CEO-case footgun: "CEO" previously yielded 0 tools (silent under-privilege).
-  const upper = getToolNamesForAccessLevel("CEO");
-  const lower = getToolNamesForAccessLevel("ceo");
-  assert.ok(upper.length > 0, "'CEO' must not yield an empty tool set");
-  assert.deepEqual(upper, lower);
-  assert.deepEqual(getToolsForAccessLevel("  Ceo  "), getToolsForAccessLevel("ceo"));
-  assert.deepEqual(
-    getToolNamesForAccessLevel(" Leadership "),
-    getToolNamesForAccessLevel("leadership"),
-  );
-});
-
-test("normalizeAccessLevel maps casing/whitespace to known keys", () => {
-  assert.equal(normalizeAccessLevel("CEO"), "ceo");
-  assert.equal(normalizeAccessLevel("  Ceo  "), "ceo");
-  assert.equal(normalizeAccessLevel("LEADERSHIP"), "leadership");
-  assert.equal(normalizeAccessLevel("Voice"), "voice");
-  assert.equal(normalizeAccessLevel("default"), "default");
-});
-
-test("normalizeAccessLevel coerces unknown/invalid input to least-privilege default", () => {
-  for (const bad of ["intern", "", null, undefined, 42, {}, []]) {
-    assert.equal(
-      normalizeAccessLevel(bad),
-      "default",
-      `${JSON.stringify(bad)} should normalise to default`,
-    );
-  }
-});
-
-test("known access levels return unchanged tool sets (no privilege change)", () => {
-  // Lock the privilege boundary: default must never gain a write tool, and the
-  // ceo surface must remain a superset of leadership.
-  const ceo = getToolNamesForAccessLevel("ceo");
-  const leadership = new Set(getToolNamesForAccessLevel("leadership"));
-  const def = new Set(getToolNamesForAccessLevel("default"));
-  assert.ok(ceo.includes("slack_send"), "ceo retains communication write tools");
-  assert.ok(!def.has("slack_send"), "default must not gain a write tool");
-  for (const name of leadership) {
-    assert.ok(
-      new Set(ceo).has(name),
-      `leadership tool "${name}" must also exist at ceo`,
-    );
-  }
-});
-
-test("KNOWN_ACCESS_LEVELS lists exactly the configured levels", () => {
-  assert.ok(Array.isArray(KNOWN_ACCESS_LEVELS));
-  for (const level of ["ceo", "leadership", "voice", "default"]) {
-    assert.ok(
-      KNOWN_ACCESS_LEVELS.includes(level),
-      `KNOWN_ACCESS_LEVELS should include ${level}`,
-    );
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Privilege boundaries — no escalation
-// ---------------------------------------------------------------------------
-
-test("default (read-only) surface contains NO write/side-effecting tools", () => {
-  const names = new Set(getToolNamesForAccessLevel("default"));
-  for (const write of WRITE_TOOL_NAMES) {
-    assert.equal(
-      names.has(write),
-      false,
-      `default access must not expose write tool "${write}"`,
-    );
-  }
-});
-
-test("default surface is a strict subset of both leadership and ceo surfaces", () => {
-  const defaultNames = new Set(getToolNamesForAccessLevel("default"));
-  const leadershipNames = new Set(getToolNamesForAccessLevel("leadership"));
-  const ceoNames = new Set(getToolNamesForAccessLevel("ceo"));
-
-  for (const name of defaultNames) {
-    assert.ok(leadershipNames.has(name), `leadership missing read tool "${name}"`);
-    assert.ok(ceoNames.has(name), `ceo missing read tool "${name}"`);
-  }
-  // Strict subset: higher levels strictly add capability.
-  assert.ok(leadershipNames.size > defaultNames.size, "leadership should add tools over default");
-  assert.ok(ceoNames.size > defaultNames.size, "ceo should add tools over default");
-});
-
-test("leadership surface is a subset of ceo (no leadership-only tool exceeds ceo)", () => {
-  const leadershipNames = getToolNamesForAccessLevel("leadership");
-  const ceoNames = new Set(getToolNamesForAccessLevel("ceo"));
-  for (const name of leadershipNames) {
-    assert.ok(
-      ceoNames.has(name),
-      `leadership tool "${name}" is not present in ceo — privilege inversion`,
-    );
-  }
-});
-
-test("ceo has strictly more capability than leadership", () => {
-  const leadershipNames = new Set(getToolNamesForAccessLevel("leadership"));
-  const ceoNames = new Set(getToolNamesForAccessLevel("ceo"));
-  assert.ok(ceoNames.size > leadershipNames.size, "ceo should outrank leadership in tool count");
-});
-
-test("sensitive CEO-only write tools never leak into the leadership surface", () => {
-  const leadershipNames = new Set(getToolNamesForAccessLevel("leadership"));
-  for (const name of CEO_ONLY_WRITE_NAMES) {
-    assert.equal(
-      leadershipNames.has(name),
-      false,
-      `CEO-only write tool "${name}" must not appear at leadership level`,
-    );
-    // sanity: it really is a CEO tool, otherwise the assertion above is vacuous.
-    assert.ok(
-      new Set(getToolNamesForAccessLevel("ceo")).has(name),
-      `expected "${name}" to be a CEO tool`,
-    );
-  }
-});
-
-test("any voice write tool is also granted at ceo level (voice ⊆ ceo for write tools)", () => {
-  const ceoNames = new Set(getToolNamesForAccessLevel("ceo"));
-  const voiceTools = getToolsForAccessLevel("voice");
-  for (const tool of voiceTools) {
-    if (WRITE_TOOL_NAMES.has(tool.name)) {
-      assert.ok(
-        ceoNames.has(tool.name),
-        `voice write tool "${tool.name}" is not authorised at ceo level — escalation`,
-      );
-    }
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Name-based lookup: unknown name resolves to nothing, no throw
-// ---------------------------------------------------------------------------
-
-test("looking up an unknown tool name returns undefined without throwing", () => {
-  let found;
-  assert.doesNotThrow(() => {
-    found = findToolByName("ceo", "definitely_not_a_real_tool");
-  });
-  assert.equal(found, undefined);
-});
-
-test("looking up a known write tool at default level resolves to undefined (scoped out)", () => {
-  assert.equal(findToolByName("default", "place_voice_call"), undefined);
-  // ...but it does resolve at ceo level.
-  const atCeo = findToolByName("ceo", "place_voice_call");
-  assert.ok(atCeo);
-  assert.equal(atCeo.name, "place_voice_call");
-});
-
-// ---------------------------------------------------------------------------
-// Structural invariants — every tool is a valid Claude API tool schema
-// ---------------------------------------------------------------------------
-
-/** Collect every distinct tool object exposed across all surfaces + categories. */
-function allDistinctTools() {
-  const byName = new Map();
-  for (const level of KNOWN_LEVELS) {
-    for (const tool of getToolsForAccessLevel(level)) {
-      byName.set(tool.name, tool);
-    }
-  }
-  for (const tools of Object.values(getAllToolsByCategory())) {
-    for (const tool of tools) byName.set(tool.name, tool);
-  }
-  return [...byName.values()];
-}
-
-test("every tool definition has a non-empty string name", () => {
-  for (const tool of allDistinctTools()) {
-    assert.equal(typeof tool.name, "string", `tool name not a string: ${JSON.stringify(tool)}`);
-    assert.ok(tool.name.length > 0, "tool name is empty");
-    // Claude API tool names: letters, numbers, underscores, hyphens.
-    assert.match(tool.name, /^[a-zA-Z0-9_-]+$/, `tool name "${tool.name}" has invalid chars`);
-  }
-});
-
-test("every tool definition has a non-empty string description", () => {
-  for (const tool of allDistinctTools()) {
-    assert.equal(typeof tool.description, "string", `${tool.name} description not a string`);
-    assert.ok(tool.description.trim().length > 0, `${tool.name} has empty description`);
-  }
-});
-
-test("every tool definition has an object-typed input_schema with properties", () => {
-  for (const tool of allDistinctTools()) {
-    assert.ok(tool.input_schema, `${tool.name} missing input_schema`);
-    assert.equal(typeof tool.input_schema, "object", `${tool.name} input_schema not an object`);
-    assert.equal(tool.input_schema.type, "object", `${tool.name} input_schema.type !== "object"`);
-    assert.equal(
-      typeof tool.input_schema.properties,
-      "object",
-      `${tool.name} input_schema.properties missing`,
-    );
-    // Every name in `required` must actually be declared in properties.
-    if (Array.isArray(tool.input_schema.required)) {
-      for (const req of tool.input_schema.required) {
-        assert.ok(
-          Object.prototype.hasOwnProperty.call(tool.input_schema.properties, req),
-          `${tool.name} requires "${req}" but it is not declared in properties`,
-        );
-      }
-    }
-  }
-});
-
-// ---------------------------------------------------------------------------
-// getAllToolsByCategory shape
-// ---------------------------------------------------------------------------
-
-test("getAllToolsByCategory returns all seven categories, each a non-empty array", () => {
-  const cats = getAllToolsByCategory();
-  const expected = [
-    "communication",
-    "search",
-    "knowledge",
-    "operations",
-    "analysis",
-    "documents",
-    "org",
-  ];
-  assert.deepEqual(Object.keys(cats).sort(), [...expected].sort());
-  for (const key of expected) {
-    assert.ok(Array.isArray(cats[key]), `${key} is not an array`);
-    assert.ok(cats[key].length > 0, `${key} category is empty`);
-  }
-});
-
-test("every categorised tool is a structurally valid tool definition", () => {
-  for (const [cat, tools] of Object.entries(getAllToolsByCategory())) {
-    for (const tool of tools) {
-      assert.ok(tool.name, `tool in ${cat} missing name`);
-      assert.ok(tool.description, `${tool.name} in ${cat} missing description`);
-      assert.equal(tool.input_schema?.type, "object", `${tool.name} in ${cat} bad input_schema`);
-    }
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Category 7 — Org (Cohort): the curated surface from lib/org/tool-surface.mjs
-// ---------------------------------------------------------------------------
-
-import { getOrgTools, emailFamilyAvailable } from "./org/tool-surface.mjs";
-
-test("org category mirrors the tool-surface table exactly (one SoT, two planes)", () => {
-  const org = getAllToolsByCategory().org;
-  const table = getOrgTools();
-  assert.deepEqual(org.map((t) => t.name), table.map((t) => t.name), "same tools, same order");
-  for (const t of org) {
-    assert.ok(t.name && t.description && t.input_schema?.type === "object");
-    assert.equal(t.access, undefined, "table-internal fields are stripped from the Claude schema");
-    assert.equal(t.binding, undefined, "binding never leaks into the Claude schema");
-  }
-});
-
-test("org access monotonicity: default ⊂ leadership ⊂ ceo on the org subset", () => {
-  const table = getOrgTools();
-  const orgNames = new Set(table.map((t) => t.name));
-  const orgAt = (level) => getToolNamesForAccessLevel(level).filter((n) => orgNames.has(n));
-  const def = orgAt("default");
-  const lead = orgAt("leadership");
-  const ceo = orgAt("ceo");
-  for (const n of def) assert.ok(lead.includes(n), `default org tool ${n} must exist at leadership`);
-  for (const n of lead) assert.ok(ceo.includes(n), `leadership org tool ${n} must exist at ceo`);
-  // default = exactly the reads; leadership adds exactly the writes; ceo adds the hatches
-  const reads = table.filter((t) => t.access === "read").map((t) => t.name).sort();
-  const writes = table.filter((t) => t.access === "write").map((t) => t.name).sort();
-  assert.deepEqual([...def].sort(), reads, "every level's lookup set = the org reads");
-  assert.deepEqual(lead.filter((n) => !def.includes(n)).sort(), writes, "leadership adds the org writes");
-});
-
-test("escape hatches (org_rpc / org_read) are CEO-only in the native plane", () => {
-  const def = new Set(getToolNamesForAccessLevel("default"));
-  const lead = new Set(getToolNamesForAccessLevel("leadership"));
-  const voice = new Set(getToolNamesForAccessLevel("voice"));
-  const ceo = new Set(getToolNamesForAccessLevel("ceo"));
-  for (const hatch of ["org_rpc", "org_read"]) {
-    assert.ok(ceo.has(hatch), `${hatch} present at ceo`);
-    assert.ok(!def.has(hatch), `${hatch} must NOT reach default`);
-    assert.ok(!lead.has(hatch), `${hatch} must NOT reach leadership`);
-    assert.ok(!voice.has(hatch), `${hatch} must NOT reach voice`);
-  }
-});
-
-test("org writes gate on leadership+: default/voice never gain messaging_send-class tools", () => {
-  const def = new Set(getToolNamesForAccessLevel("default"));
-  for (const w of ["messaging_send", "board_claim", "task_create", "decision_propose", "email_send", "email_mark_read", "escalation_raise"]) {
-    if (getOrgTools().some((t) => t.name === w)) {
-      assert.ok(!def.has(w), `org write ${w} must not reach the default (read-only) surface`);
-      assert.ok(new Set(getToolNamesForAccessLevel("leadership")).has(w), `${w} present at leadership`);
-    }
-  }
-});
-
-test("voice curation: conversation-sized org tools only", () => {
-  const voice = new Set(getToolNamesForAccessLevel("voice"));
-  for (const n of ["org_whoami", "messaging_history", "messaging_send", "board_ready"]) {
-    assert.ok(voice.has(n), `${n} curated into voice`);
-  }
-  for (const n of ["org_rpc", "org_read", "email_send", "knowledge_append", "decision_propose"]) {
-    assert.ok(!voice.has(n), `${n} must NOT reach the voice surface`);
-  }
-});
-
-test("email tools present in the native surface iff the vendored protocol carries the family", () => {
-  const lead = new Set(getToolNamesForAccessLevel("leadership"));
-  const def = new Set(getToolNamesForAccessLevel("default"));
-  if (emailFamilyAvailable()) {
-    assert.ok(def.has("email_inbox") && def.has("email_message") && def.has("email_thread"), "email reads in every level's lookup set");
-    assert.ok(lead.has("email_send") && lead.has("email_mark_read"), "email writes at leadership+");
-  } else {
-    for (const n of ["email_inbox", "email_send", "email_mark_read"]) {
-      assert.ok(!def.has(n) && !lead.has(n), `${n} absent while the family is unvendored`);
-    }
-  }
-});

package/lib/upgrade/global-refresh.test.mjs

@@ -1,65 +0,0 @@
-/**
- * global-refresh.test.mjs — planGlobalRefresh is pure; refreshGlobalInstall
- * never reaches a real npm (exec is injected AND MAESTRO_SKIP_GLOBAL_INSTALL=1
- * is honoured).
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { planGlobalRefresh, parseGlobalVersion, refreshGlobalInstall, readGlobalVersion } from "./global-refresh.mjs";
-
-const ARGV = ["npm", "install", "-g", "@cohortapp/agent-sdk@2.12.0", "--no-audit", "--no-fund"];
-
-test("planGlobalRefresh: install when absent or behind, none when equal, skip under MAESTRO_SKIP_GLOBAL_INSTALL", () => {
-  assert.deepEqual(planGlobalRefresh({ version: "2.12.0", globalVersion: "" }), { action: "install", reason: "not installed globally", argv: ARGV });
-  assert.deepEqual(planGlobalRefresh({ version: "2.12.0", globalVersion: "2.11.17" }), { action: "install", reason: "global install is 2.11.17, agent dir is 2.12.0", argv: ARGV });
-  assert.equal(planGlobalRefresh({ version: "2.12.0", globalVersion: "2.12.0" }).action, "none");
-  const s = planGlobalRefresh({ version: "2.12.0", globalVersion: "1.0.0", skip: true });
-  assert.equal(s.action, "skip");
-  assert.deepEqual(s.argv, ARGV, "the skipped command is still reported so an operator can run it by hand");
-  assert.equal(planGlobalRefresh({ version: "", globalVersion: "1.0.0" }).action, "skip");
-});
-
-test("parseGlobalVersion reads npm ls --json, tolerates the tree form and the not-installed shape", () => {
-  assert.equal(parseGlobalVersion(JSON.stringify({ dependencies: { "@cohortapp/agent-sdk": { version: "2.11.17" } } })), "2.11.17");
-  assert.equal(parseGlobalVersion(JSON.stringify({ name: "lib", dependencies: {} })), "");
-  assert.equal(parseGlobalVersion("/opt/homebrew/lib\n└── @cohortapp/agent-sdk@2.12.0\n"), "2.12.0");
-  assert.equal(parseGlobalVersion(""), "");
-  assert.equal(parseGlobalVersion("not json"), "");
-});
-
-function recorder(responses) {
-  const calls = [];
-  const exec = (cmd, args) => { calls.push([cmd, ...args]); return responses(cmd, args); };
-  exec.calls = calls;
-  return exec;
-}
-
-test("refreshGlobalInstall: with MAESTRO_SKIP_GLOBAL_INSTALL=1 nothing is executed and the row says what was skipped", () => {
-  const exec = recorder(() => ({ status: 0, stdout: "", stderr: "" }));
-  const r = refreshGlobalInstall({ version: "2.12.0", env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" }, exec });
-  assert.equal(r.ok, true);
-  assert.equal(r.action, "skip");
-  assert.match(r.detail, /npm install -g @cohortapp\/agent-sdk@2\.12\.0 --no-audit --no-fund/);
-  assert.deepEqual(exec.calls, [], "no npm call at all under the skip flag");
-});
-
-test("refreshGlobalInstall: runs the pinned install through exec when behind; reports a failure as ok:false with the tail of stderr", () => {
-  const behind = recorder((cmd, args) => (args[0] === "ls"
-    ? { status: 1, stdout: JSON.stringify({ dependencies: { "@cohortapp/agent-sdk": { version: "2.11.17" } } }), stderr: "" }
-    : { status: 0, stdout: "", stderr: "" }));
-  const r = refreshGlobalInstall({ version: "2.12.0", env: {}, exec: behind });
-  assert.equal(r.ok, true);
-  assert.deepEqual(behind.calls[1], ARGV);
-
-  const same = recorder(() => ({ status: 0, stdout: JSON.stringify({ dependencies: { "@cohortapp/agent-sdk": { version: "2.12.0" } } }), stderr: "" }));
-  const n = refreshGlobalInstall({ version: "2.12.0", env: {}, exec: same });
-  assert.equal(n.action, "none");
-  assert.equal(same.calls.length, 1, "only the read");
-
-  const fail = recorder((cmd, args) => (args[0] === "ls" ? { status: 1, stdout: "{}", stderr: "" } : { status: 243, stdout: "", stderr: "npm ERR! code EACCES\nnpm ERR! permission denied\n" }));
-  const f = refreshGlobalInstall({ version: "2.12.0", env: {}, exec: fail });
-  assert.equal(f.ok, false);
-  assert.match(f.detail, /permission denied/);
-  assert.equal(readGlobalVersion({ exec: fail }), "");
-});