@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/scripts/setup/configure-macos.test.mjs

@@ -1,306 +0,0 @@
-/**
- * configure-macos.test.mjs — scripts/setup/configure-macos.sh
- *
- * Covers the 2026-09-08 front-door-session changes (design §6 WP-M3):
- *   - the Terminal.app `ai.maestro.boot-claude-session` job is RETIRED: the
- *     script unloads + removes it if present and never writes it again;
- *   - `--tailscale-ssh` advertises Tailscale SSH and turns Remote Login on,
- *     then prints the tailnet ACL reminder (audit F4: 0/41 peers reachable);
- *   - `--check` reports both Tailscale SSH and Remote Login.
- *
- * The script talks to real macOS tooling (launchctl, tailscale, systemsetup,
- * pmset, defaults …), so every test runs it with a PATH of STUB binaries that
- * append their argv to a log file. Nothing here touches the real machine.
- * Functions are exercised by sourcing the script with
- * MAESTRO_CONFIGURE_MACOS_NO_MAIN=1 (main() is skipped), the same seam the
- * script exposes for exactly this purpose.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync, rmSync } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { join, dirname } from "node:path";
-import { tmpdir } from "node:os";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const SCRIPT = join(__dirname, "configure-macos.sh");
-const scriptSrc = readFileSync(SCRIPT, "utf8");
-
-/**
- * Build a stub-binary directory. Every named stub appends `<name> <argv>` to
- * `calls.log` and prints `stdoutByName[name]` (if any), exiting 0. `sudo` is
- * special: it logs then re-execs the rest of its argv so `sudo systemsetup …`
- * still reaches the systemsetup stub.
- */
-function makeStubs(dir, names, stdoutByName = {}) {
-  const bin = join(dir, "bin");
-  mkdirSync(bin, { recursive: true });
-  const log = join(dir, "calls.log");
-  // osascript is ALWAYS stubbed: the real one can pop a System Events
-  // permission prompt or edit the developer's Login Items.
-  for (const name of new Set([...names, "osascript"])) {
-    const out = stdoutByName[name] ? `printf '%s\\n' ${JSON.stringify(stdoutByName[name])}\n` : "";
-    const body = name === "sudo"
-      ? `#!/bin/bash\necho "sudo $*" >> "${log}"\n# drop sudo flags (-n, -u user) then exec the real command (a sibling stub)\nwhile [ "$1" = "-n" ] || [ "$1" = "-u" ]; do if [ "$1" = "-u" ]; then shift 2; else shift; fi; done\nexec "$@"\n`
-      : `#!/bin/bash\necho "${name} $*" >> "${log}"\n${out}exit 0\n`;
-    writeFileSync(join(bin, name), body);
-    chmodSync(join(bin, name), 0o755);
-  }
-  return { bin, log };
-}
-
-function fixture() {
-  const root = mkdtempSync(join(tmpdir(), "configure-macos-test-"));
-  const home = join(root, "home");
-  mkdirSync(join(home, "Library", "LaunchAgents"), { recursive: true });
-  // The script derives AGENT_DIR from its own location (scripts/setup/../..),
-  // so copy it into a fixture agent dir.
-  const agent = join(root, "agent");
-  mkdirSync(join(agent, "scripts", "setup"), { recursive: true });
-  writeFileSync(join(agent, "scripts", "setup", "configure-macos.sh"), scriptSrc);
-  chmodSync(join(agent, "scripts", "setup", "configure-macos.sh"), 0o755);
-  return { root, home, agent, script: join(agent, "scripts", "setup", "configure-macos.sh") };
-}
-
-function run(fx, stubs, args, extraEnv = {}) {
-  return spawnSync("/bin/bash", [fx.script, ...args], {
-    encoding: "utf8",
-    cwd: fx.agent,
-    env: {
-      HOME: fx.home,
-      // Stubs FIRST so the script can never reach the real launchctl/tailscale.
-      PATH: `${stubs.bin}:/usr/bin:/bin`,
-      TERM: "dumb",
-      ...extraEnv,
-    },
-  });
-}
-
-/** Source the script without running main(), then run `snippet` in that shell. */
-function runFn(fx, stubs, snippet, extraEnv = {}) {
-  return spawnSync("/bin/bash", ["-c", `source "${fx.script}" && ${snippet}`], {
-    encoding: "utf8",
-    cwd: fx.agent,
-    env: {
-      HOME: fx.home,
-      PATH: `${stubs.bin}:/usr/bin:/bin`,
-      MAESTRO_CONFIGURE_MACOS_NO_MAIN: "1",
-      TERM: "dumb",
-      ...extraEnv,
-    },
-  });
-}
-
-const calls = (stubs) => (existsSync(stubs.log) ? readFileSync(stubs.log, "utf8") : "");
-
-// --- static guards on the script source ------------------------------------
-
-test("configure-macos.sh never writes the boot-claude-session plist again", () => {
-  // The Terminal.app boot job (F15: no KeepAlive, no lock, needs a GUI) is
-  // replaced by the launchd `ai.maestro.<first>-session` supervisor job that
-  // generate-plists.sh emits. This script must only ever REMOVE it.
-  assert.ok(!/boot-claude-session\.sh/.test(scriptSrc),
-    "must not reference boot-claude-session.sh at all (the script is retired)");
-  assert.ok(!/<string>\$\{BOOT_SCRIPT\}<\/string>/.test(scriptSrc),
-    "the boot-claude-session plist heredoc must be gone");
-  assert.ok(/retire_boot_claude_session\(\)/.test(scriptSrc), "a retire function must exist");
-});
-
-test("configure-macos.sh exposes a source-only seam and documents --tailscale-ssh", () => {
-  assert.ok(scriptSrc.includes("MAESTRO_CONFIGURE_MACOS_NO_MAIN"), "sourcing seam missing");
-  assert.ok(/--tailscale-ssh/.test(scriptSrc), "--tailscale-ssh flag missing");
-  assert.match(scriptSrc, /tailscale set --ssh/, "must advertise SSH via `tailscale set --ssh`");
-  assert.match(scriptSrc, /systemsetup -setremotelogin on/, "must turn Remote Login on");
-});
-
-// --- retire the legacy boot session job -------------------------------------
-
-test("retire_boot_claude_session unloads and removes a present legacy plist", () => {
-  const fx = fixture();
-  const stubs = makeStubs(fx.root, ["launchctl"]);
-  const plist = join(fx.home, "Library", "LaunchAgents", "ai.maestro.boot-claude-session.plist");
-  writeFileSync(plist, "<plist/>");
-  try {
-    const r = runFn(fx, stubs, "retire_boot_claude_session");
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    assert.ok(!existsSync(plist), "legacy plist must be removed");
-    const c = calls(stubs);
-    assert.match(c, /launchctl (unload|bootout) .*boot-claude-session/, `expected an unload; calls:\n${c}`);
-    assert.match(r.stdout, /boot-claude-session/);
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("retire_boot_claude_session is a no-op when the legacy plist is absent (idempotent)", () => {
-  const fx = fixture();
-  const stubs = makeStubs(fx.root, ["launchctl"]);
-  try {
-    const r = runFn(fx, stubs, "retire_boot_claude_session");
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    // Second run identical.
-    const r2 = runFn(fx, stubs, "retire_boot_claude_session");
-    assert.equal(r2.status, 0, r2.stderr + r2.stdout);
-    assert.ok(!existsSync(join(fx.home, "Library", "LaunchAgents", "ai.maestro.boot-claude-session.plist")));
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-// --- --tailscale-ssh ---------------------------------------------------------
-
-test("--tailscale-ssh advertises SSH, enables Remote Login and prints the ACL reminder", () => {
-  const fx = fixture();
-  const stubs = makeStubs(fx.root, ["tailscale", "sudo", "systemsetup", "launchctl"]);
-  try {
-    const r = run(fx, stubs, ["--tailscale-ssh"]);
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    const c = calls(stubs);
-    assert.match(c, /^tailscale set --ssh$/m, `expected tailscale set --ssh; calls:\n${c}`);
-    assert.match(c, /^sudo (-n )?systemsetup -setremotelogin on$/m, `expected sudo systemsetup -setremotelogin on; calls:\n${c}`);
-    assert.match(c, /^systemsetup -setremotelogin on$/m, "sudo must pass through to systemsetup");
-    // The ACL reminder: SSH is only reachable once the tailnet ACL grants it.
-    assert.match(r.stdout, /ACL/i, "must print the tailnet ACL reminder");
-    assert.match(r.stdout, /"ssh"/, "the reminder should show the ACL `ssh` rule shape");
-    assert.match(r.stdout, /login\.tailscale\.com\/admin\/acls|admin\/acls/, "the reminder should point at the ACL editor");
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("--tailscale-ssh fails clearly when the tailscale CLI is absent", () => {
-  const fx = fixture();
-  const stubs = makeStubs(fx.root, ["sudo", "systemsetup", "launchctl"]);
-  try {
-    const r = run(fx, stubs, ["--tailscale-ssh"], { MAESTRO_TAILSCALE_BIN: "/nonexistent/tailscale" });
-    assert.notEqual(r.status, 0, "must exit non-zero without tailscale");
-    assert.match(r.stdout + r.stderr, /tailscale/i);
-    const c = calls(stubs);
-    assert.ok(!/setremotelogin/.test(c), "must not touch Remote Login when tailscale is missing");
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-// --- --check reports both ----------------------------------------------------
-
-test("--check reports Tailscale SSH and Remote Login state", () => {
-  const fx = fixture();
-  const stubs = makeStubs(
-    fx.root,
-    ["tailscale", "sudo", "systemsetup", "launchctl", "pmset", "defaults", "pgrep", "curl", "fdesetup", "sysadminctl"],
-    {
-      tailscale: '{"RunSSH": true}',
-      systemsetup: "Remote Login: On",
-      launchctl: "-\t0\tai.maestro.ivy-session",
-    },
-  );
-  try {
-    const r = run(fx, stubs, ["--check"]);
-    // verify_all returns the issue count; other checks (Parsec etc.) will
-    // legitimately fail under stubs, so only the report lines matter here.
-    assert.match(r.stdout, /Tailscale SSH: (on|advertised)/i, `stdout:\n${r.stdout}`);
-    assert.match(r.stdout, /Remote Login: on/i, `stdout:\n${r.stdout}`);
-    assert.match(r.stdout, /session/i, "the check should mention the front-door session job");
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("--check flags Tailscale SSH off and Remote Login off", () => {
-  const fx = fixture();
-  const stubs = makeStubs(
-    fx.root,
-    ["tailscale", "sudo", "systemsetup", "launchctl", "pmset", "defaults", "pgrep", "curl", "fdesetup", "sysadminctl"],
-    { tailscale: '{"RunSSH": false}', systemsetup: "Remote Login: Off" },
-  );
-  try {
-    const r = run(fx, stubs, ["--check"]);
-    assert.match(r.stdout, /Tailscale SSH: off/i, `stdout:\n${r.stdout}`);
-    assert.match(r.stdout, /Remote Login: off/i, `stdout:\n${r.stdout}`);
-    assert.match(r.stdout, /--tailscale-ssh/, "must point the operator at the fix");
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-// --- Tailscale variant (review: F4 on the GUI app) ---------------------------
-//
-// The Tailscale SSH server exists only in the open-source `tailscaled` variant.
-// The fleet runs Tailscale.app (GUI), whose /usr/local/bin/tailscale is a
-// 68-byte shim onto /Applications/Tailscale.app/Contents/MacOS/tailscale and
-// whose daemon cannot honour RunSSH. `--tailscale-ssh` must say so and print
-// the real remedy instead of `tailscale up --ssh`.
-
-function guiShim(fx) {
-  // Same shape as the real shim: a two-line sh script naming Tailscale.app.
-  const shim = join(fx.root, "gui-tailscale");
-  writeFileSync(shim, '#!/bin/sh\n/Applications/Tailscale.app/Contents/MacOS/tailscale "$@"\n');
-  chmodSync(shim, 0o755);
-  return shim;
-}
-
-test("tailscale_variant: GUI shim / Tailscale.app path → gui; tailscaled on PATH → open-source; else unknown", () => {
-  const fx = fixture();
-  const stubs = makeStubs(fx.root, ["tailscale", "launchctl"]);
-  try {
-    const shim = guiShim(fx);
-    assert.equal(runFn(fx, stubs, `tailscale_variant "${shim}"`).stdout.trim(), "gui");
-    assert.equal(runFn(fx, stubs, 'tailscale_variant "/Applications/Tailscale.app/Contents/MacOS/Tailscale"').stdout.trim(), "gui");
-    assert.equal(runFn(fx, stubs, `tailscale_variant "${join(stubs.bin, "tailscale")}"`).stdout.trim(), "unknown");
-    // With a tailscaled next to it, the CLI is the open-source variant.
-    writeFileSync(join(stubs.bin, "tailscaled"), "#!/bin/bash\nexit 0\n"); chmodSync(join(stubs.bin, "tailscaled"), 0o755);
-    assert.equal(runFn(fx, stubs, `tailscale_variant "${join(stubs.bin, "tailscale")}"`).stdout.trim(), "open-source");
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("--tailscale-ssh on the GUI app: no `tailscale set --ssh`, the real remedy is printed, Remote Login is still enabled", () => {
-  const fx = fixture();
-  const stubs = makeStubs(fx.root, ["tailscale", "sudo", "systemsetup", "launchctl"], { tailscale: "100.95.116.68" });
-  try {
-    const r = run(fx, stubs, ["--tailscale-ssh"], { MAESTRO_TAILSCALE_BIN: guiShim(fx) });
-    const c = calls(stubs);
-    assert.ok(!/tailscale (set|up) --ssh/.test(c), `must not try to enable SSH on the GUI daemon; calls:\n${c}`);
-    assert.match(r.stdout, /GUI|Tailscale\.app/i, "must name the variant");
-    assert.match(r.stdout, /brew install tailscale/, "must print the open-source remedy");
-    assert.match(r.stdout, /tailscaled/, "must name the daemon that carries the SSH server");
-    assert.match(r.stdout, /Remote Login|ssh .*@100\.95\.116\.68/, "must offer the sshd-over-tailnet-IP fallback");
-    assert.ok(!/is the node up and signed in/.test(r.stdout), "the misleading 'is the node up? try tailscale up --ssh' hint must be gone");
-    assert.match(c, /^systemsetup -setremotelogin on$/m, "Remote Login is the fallback access path and must still be enabled");
-    assert.equal(r.status, 0, "an honest limitation is not a script failure");
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("--check on the GUI app reports Tailscale SSH as unavailable (not a fail-forever 'off') when Remote Login is on", () => {
-  const fx = fixture();
-  const stubs = makeStubs(
-    fx.root,
-    ["tailscale", "sudo", "systemsetup", "launchctl", "pmset", "defaults", "pgrep", "curl", "fdesetup", "sysadminctl"],
-    { tailscale: '{"RunSSH": false}', systemsetup: "Remote Login: On" },
-  );
-  try {
-    const r = run(fx, stubs, ["--check"], { MAESTRO_TAILSCALE_BIN: guiShim(fx) });
-    assert.match(r.stdout, /Tailscale SSH: unavailable/i, `stdout:\n${r.stdout}`);
-    assert.match(r.stdout, /brew install tailscale/, "the check must carry the real remedy too");
-    assert.ok(!/Tailscale SSH: off/.test(r.stdout));
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-// --- --check under sudo: launchctl must look in the user's gui domain ---------
-
-test("gui_launchctl_list uses the caller's domain as a user and `launchctl asuser <uid>` under sudo", () => {
-  const fx = fixture();
-  const stubs = makeStubs(fx.root, ["launchctl"], { launchctl: "-\t0\tai.maestro.ivy-session" });
-  try {
-    // Not root: plain `launchctl list`.
-    const asUser = runFn(fx, stubs, "gui_launchctl_list");
-    assert.match(asUser.stdout, /ai\.maestro\.ivy-session/);
-    assert.match(calls(stubs), /^launchctl list$/m);
-    rmSync(stubs.log, { force: true });
-    // Root via sudo: `id -u` → 0, `id -u <SUDO_USER>` → 501. Stub `id` so the
-    // test never needs real root.
-    writeFileSync(join(stubs.bin, "id"), '#!/bin/bash\nif [ "$1" = "-u" ] && [ -n "$2" ]; then echo 501; else echo 0; fi\n');
-    chmodSync(join(stubs.bin, "id"), 0o755);
-    const asRoot = runFn(fx, stubs, "gui_launchctl_list", { SUDO_USER: "ivy" });
-    assert.match(asRoot.stdout, /ai\.maestro\.ivy-session/);
-    assert.match(calls(stubs), /^launchctl asuser 501 launchctl list$/m, `calls:\n${calls(stubs)}`);
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("--check probes the session and daemon jobs through gui_launchctl_list (never a bare `launchctl list`)", () => {
-  const verify = scriptSrc.slice(scriptSrc.indexOf("verify_all()"), scriptSrc.indexOf("main()"));
-  assert.ok(!/(^|[^_])launchctl list/m.test(verify.replace(/gui_launchctl_list/g, "")),
-    "verify_all must go through gui_launchctl_list so `sudo … --check` sees gui/<uid> jobs");
-  const status = scriptSrc.slice(scriptSrc.indexOf("show_status()"), scriptSrc.indexOf("verify_all()"));
-  assert.ok(!/(^|[^_])launchctl list/m.test(status.replace(/gui_launchctl_list/g, "")), "same for show_status");
-});

package/scripts/setup/gen-subagent-manifest.test.mjs

@@ -1,124 +0,0 @@
-/**
- * gen-subagent-manifest.test.mjs — the layer-0 manifest generator + its CI gate.
- * Run: node --test scripts/setup/gen-subagent-manifest.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { main } from "./gen-subagent-manifest.mjs";
-import { buildManifest, manifestPath, readManifest } from "../../lib/subagents/manifest.mjs";
-import { hashFile, stringifyAgentMd } from "../../lib/subagents/schema.mjs";
-
-const MAESTRO_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
-
-function put(root, slug, body = `# ${slug}\n\nprose\n`, over = {}) {
-  const text = stringifyAgentMd({ name: slug, description: `${slug} does things`, model: "sonnet", tools: ["Read"], ...over }, body);
-  mkdirSync(join(root, "agents", slug), { recursive: true });
-  writeFileSync(join(root, "agents", slug, "agent.md"), text);
-  return text;
-}
-function fixture(version = "1.2.3") {
-  const root = mkdtempSync(join(tmpdir(), "gen-manifest-"));
-  writeFileSync(join(root, "package.json"), JSON.stringify({ version }));
-  return root;
-}
-/** Run main() with its console noise captured. */
-function runMain(argv, root) {
-  const log = console.log, warn = console.warn, error = console.error;
-  const out = [];
-  console.log = console.warn = console.error = (...a) => out.push(a.join(" "));
-  try { return { code: main(argv, root), out: out.join("\n") }; }
-  finally { console.log = log; console.warn = warn; console.error = error; }
-}
-
-test("writes agents/manifest.json with the package version and per-agent shas", () => {
-  const root = fixture("1.2.3");
-  const text = put(root, "alpha");
-  const { code } = runMain([], root);
-  assert.equal(code, 0);
-  assert.equal(existsSync(manifestPath(root)), true);
-  const m = readManifest(root);
-  assert.equal(m.sdkVersion, "1.2.3");
-  assert.equal(m.agents.alpha.sha256, hashFile(text));
-});
-
-test("--check passes when the committed manifest is current", () => {
-  const root = fixture();
-  put(root, "alpha");
-  runMain([], root);
-  const { code, out } = runMain(["--check"], root);
-  assert.equal(code, 0);
-  assert.match(out, /up to date \(1 agents\)/);
-});
-
-test("--check FAILS when an agent.md changed without regenerating the manifest", () => {
-  // Without this gate a shipped agent.md could change while its sha did not,
-  // which would silently reclassify every deployed copy as a local edit and
-  // freeze it forever.
-  const root = fixture();
-  put(root, "alpha");
-  runMain([], root);
-  put(root, "alpha", "# alpha\n\nEDITED UPSTREAM\n");
-  const { code, out } = runMain(["--check"], root);
-  assert.equal(code, 1);
-  assert.match(out, /STALE/);
-  assert.match(out, /gen-subagent-manifest\.mjs && git add/);
-});
-
-test("--check fails when the manifest has never been generated", () => {
-  const root = fixture();
-  put(root, "alpha");
-  const { code, out } = runMain(["--check"], root);
-  assert.equal(code, 1);
-  assert.match(out, /does not exist/);
-});
-
-test("--check ignores generatedAt (a per-run timestamp must not make CI permanently red)", () => {
-  const root = fixture();
-  put(root, "alpha");
-  runMain([], root);
-  const doc = JSON.parse(readFileSync(manifestPath(root), "utf8"));
-  doc.generatedAt = "1999-01-01T00:00:00.000Z";
-  writeFileSync(manifestPath(root), JSON.stringify(doc, null, 2));
-  assert.equal(runMain(["--check"], root).code, 0);
-});
-
-test("an invalid agent.md is REPORTED, and only --strict makes it an exit code", () => {
-  const root = fixture();
-  put(root, "alpha", "# alpha\n\nprose\n", { name: "wrong-name" });
-  const loose = runMain([], root);
-  assert.equal(loose.code, 0);
-  assert.match(loose.out, /agents\/alpha\/agent\.md is invalid/);
-  assert.match(loose.out, /must equal the directory name/);
-  assert.equal(runMain(["--strict"], root).code, 2);
-});
-
-test("empty agents/<slug>/ directories are warned about", () => {
-  const root = fixture();
-  put(root, "alpha");
-  mkdirSync(join(root, "agents", "hollow"), { recursive: true });
-  const { out } = runMain([], root);
-  assert.match(out, /have no agent\.md: hollow/);
-});
-
-test("regenerating carries the previous sha into history", () => {
-  const root = fixture();
-  const v1 = put(root, "alpha", "v1\n");
-  runMain([], root);
-  put(root, "alpha", "v2\n");
-  runMain([], root);
-  assert.deepEqual(readManifest(root).agents.alpha.history, [hashFile(v1)]);
-});
-
-test("the REAL SDK tree would pass the gate (no invalid shipped agents)", () => {
-  // Nothing is written to disk — buildManifest is pure. This only proves the
-  // shipped corpus is generatable, so `--check` can be wired into CI safely.
-  const { invalid } = buildManifest({ maestroRoot: MAESTRO_ROOT, sdkVersion: "test" });
-  assert.deepEqual(invalid.map((i) => i.slug), []);
-});

package/scripts/setup/generate-agent-package-json.test.mjs

@@ -1,143 +0,0 @@
-/**
- * Tests for generate-agent-package-json.mjs — the generated-agent dependency fix
- * (gaps-product-quality P0-1).
- *
- * Asserts the corrected package.json: a pinned `@cohortapp/agent-sdk` plus the real
- * runtime deps (`better-sqlite3`, `js-yaml`) are always present, the version
- * pin normaliser behaves, and the writer round-trips to disk.
- *
- * @module scripts/setup/generate-agent-package-json.test
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
-import path from "node:path";
-import os from "node:os";
-
-import {
-  buildAgentPackageJson,
-  writeAgentPackageJson,
-  pinMaestroVersion,
-  FRAMEWORK_RUNTIME_DEPS,
-  AGENT_EXTRA_DEPS,
-} from "./generate-agent-package-json.mjs";
-
-describe("buildAgentPackageJson: the P0-1 dependency fix", () => {
-  it("depends on a PINNED @cohortapp/agent-sdk (the npm update path is no longer a no-op)", () => {
-    const pkg = buildAgentPackageJson({ name: "acme-ai", frameworkVersion: "1.18.0" });
-    assert.equal(pkg.dependencies["@cohortapp/agent-sdk"], "^1.18.0");
-  });
-
-  it("includes the real framework runtime deps (better-sqlite3 + js-yaml)", () => {
-    const pkg = buildAgentPackageJson({ name: "acme-ai", frameworkVersion: "1.18.0" });
-    assert.equal(pkg.dependencies["better-sqlite3"], FRAMEWORK_RUNTIME_DEPS["better-sqlite3"]);
-    assert.equal(pkg.dependencies["js-yaml"], FRAMEWORK_RUNTIME_DEPS["js-yaml"]);
-  });
-
-  it("keeps the agent's own direct deps (email/SDK stack)", () => {
-    const pkg = buildAgentPackageJson({ name: "acme-ai" });
-    for (const dep of Object.keys(AGENT_EXTRA_DEPS)) {
-      assert.equal(pkg.dependencies[dep], AGENT_EXTRA_DEPS[dep], `missing ${dep}`);
-    }
-  });
-
-  it("produces the expected scaffold shape", () => {
-    const pkg = buildAgentPackageJson({ name: "acme-ai" });
-    assert.equal(pkg.name, "acme-ai");
-    assert.equal(pkg.type, "module");
-    assert.equal(pkg.private, true);
-    assert.equal(pkg.version, "1.0.0");
-    assert.ok(pkg.scripts && typeof pkg.scripts === "object");
-    // upgrade/init/doctor scripts shell @cohortapp/agent-sdk — now actually installed.
-    assert.match(pkg.scripts.upgrade, /@cohortapp\/agent-sdk upgrade/);
-    assert.ok(pkg.devDependencies.sharp);
-  });
-
-  it("dependency keys are sorted for stable serialization", () => {
-    const pkg = buildAgentPackageJson({ name: "acme-ai", frameworkVersion: "1.18.0" });
-    const keys = Object.keys(pkg.dependencies);
-    assert.deepEqual(keys, [...keys].sort());
-    // the SDK is pinned and present among the (sorted) dependency keys
-    assert.ok(keys.includes("@cohortapp/agent-sdk"));
-  });
-
-  it("trims the name and honours a custom description", () => {
-    const pkg = buildAgentPackageJson({ name: "  bot-ai  ", description: "Bot." });
-    assert.equal(pkg.name, "bot-ai");
-    assert.equal(pkg.description, "Bot.");
-  });
-
-  it("throws when name is missing", () => {
-    assert.throws(() => buildAgentPackageJson({}), /name is required/);
-    assert.throws(() => buildAgentPackageJson({ name: "   " }), /name is required/);
-  });
-});
-
-describe("pinMaestroVersion", () => {
-  it("caret-pins a bare semver", () => {
-    assert.equal(pinMaestroVersion("1.18.0"), "^1.18.0");
-  });
-
-  it("caret-pins a partial version", () => {
-    assert.equal(pinMaestroVersion("1.18"), "^1.18");
-    assert.equal(pinMaestroVersion("2"), "^2");
-  });
-
-  it("passes through an existing range/tag/operator verbatim", () => {
-    assert.equal(pinMaestroVersion("^1.18.0"), "^1.18.0");
-    assert.equal(pinMaestroVersion("~1.18.0"), "~1.18.0");
-    assert.equal(pinMaestroVersion(">=1.0.0"), ">=1.0.0");
-    assert.equal(pinMaestroVersion("latest"), "latest");
-    assert.equal(pinMaestroVersion("*"), "*");
-  });
-
-  it("handles a prerelease semver", () => {
-    assert.equal(pinMaestroVersion("1.18.0-rc.1"), "^1.18.0-rc.1");
-  });
-
-  it("falls back to 'latest' for empty/invalid input (dep still present)", () => {
-    assert.equal(pinMaestroVersion(""), "latest");
-    assert.equal(pinMaestroVersion(undefined), "latest");
-    assert.equal(pinMaestroVersion(null), "latest");
-  });
-});
-
-describe("writeAgentPackageJson", () => {
-  it("atomically writes a valid, parseable package.json to disk", () => {
-    const dir = mkdtempSync(path.join(os.tmpdir(), "agent-pkg-"));
-    try {
-      const returned = writeAgentPackageJson(dir, {
-        name: "disk-ai",
-        frameworkVersion: "1.18.0",
-      });
-      const onDisk = JSON.parse(readFileSync(path.join(dir, "package.json"), "utf8"));
-      assert.equal(onDisk.name, "disk-ai");
-      assert.equal(onDisk.dependencies["@cohortapp/agent-sdk"], "^1.18.0");
-      assert.equal(onDisk.dependencies["better-sqlite3"], FRAMEWORK_RUNTIME_DEPS["better-sqlite3"]);
-      assert.equal(onDisk.dependencies["js-yaml"], FRAMEWORK_RUNTIME_DEPS["js-yaml"]);
-      assert.deepEqual(onDisk, returned);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("throws when targetDir is missing", () => {
-    assert.throws(() => writeAgentPackageJson("", { name: "x" }), /targetDir is required/);
-  });
-});
-
-describe("parity with the framework's declared runtime deps", () => {
-  it("FRAMEWORK_RUNTIME_DEPS matches the maestro package.json dependencies", () => {
-    const repoRoot = path.resolve(
-      path.dirname(new URL(import.meta.url).pathname),
-      "..",
-      "..",
-    );
-    const pkg = JSON.parse(readFileSync(path.join(repoRoot, "package.json"), "utf8"));
-    // Every framework runtime dep we inject must exist in the framework itself.
-    for (const dep of Object.keys(FRAMEWORK_RUNTIME_DEPS)) {
-      assert.ok(pkg.dependencies[dep], `framework no longer declares ${dep}`);
-    }
-  });
-});