@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/scripts/setup/generate-capability.test.mjs

@@ -1,134 +0,0 @@
-/**
- * Tests for generate-capability.mjs — the sub-agent definition renderer.
- *
- * These exist because the module had NO tests and could not have had any: it
- * called main() at module scope, so importing it regenerated the entire
- * capability surface across the repo. The direct-invocation guard that made this
- * file possible is itself part of the fix.
- *
- * Run: node --test scripts/setup/generate-capability.test.mjs
- * @module scripts/setup/generate-capability.test
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  TOOLS_BY_TIER,
-  renderAgentMd,
-  toolsForAgent,
-} from "./generate-capability.mjs";
-import { checkAgentFile, parseAgentMd } from "../../lib/subagents/schema.mjs";
-
-const PROFILE = { function: "executive-operator", altitude: "c-suite" };
-const AGENT = {
-  id: "chief-of-staff",
-  role: "Chief of Staff",
-  mandate: "Run the principal's office so nothing is dropped.",
-  model: "opus",
-  tier: "lead",
-  towers: ["executive-office"],
-  team: "executive-office",
-};
-
-describe("toolsForAgent", () => {
-  it("grants by tier, least privilege at support", () => {
-    assert.deepEqual(toolsForAgent({ tier: "support" }), [
-      ...TOOLS_BY_TIER.support,
-    ]);
-    assert.ok(!toolsForAgent({ tier: "support" }).includes("Bash"));
-    assert.ok(toolsForAgent({ tier: "core" }).includes("Bash"));
-    assert.ok(toolsForAgent({ tier: "lead" }).includes("WebFetch"));
-  });
-
-  it("never grants Task at any tier (delegation must stay observable)", () => {
-    for (const tier of Object.keys(TOOLS_BY_TIER)) {
-      assert.ok(
-        !toolsForAgent({ tier }).includes("Task"),
-        `${tier} must not carry Task`,
-      );
-    }
-  });
-
-  it("falls back to core for an unknown or missing tier", () => {
-    assert.deepEqual(toolsForAgent({}), [...TOOLS_BY_TIER.core]);
-    assert.deepEqual(toolsForAgent({ tier: "nonsense" }), [
-      ...TOOLS_BY_TIER.core,
-    ]);
-  });
-
-  it("lets a pack override the tier policy explicitly", () => {
-    assert.deepEqual(toolsForAgent({ tier: "support", tools: ["Read"] }), [
-      "Read",
-    ]);
-  });
-
-  it("returns a fresh array so a caller cannot mutate the policy", () => {
-    const got = toolsForAgent({ tier: "core" });
-    got.push("Task");
-    assert.ok(!TOOLS_BY_TIER.core.includes("Task"));
-  });
-});
-
-describe("renderAgentMd", () => {
-  it("produces a definition the registry validator accepts", () => {
-    const res = checkAgentFile(renderAgentMd(AGENT, PROFILE), AGENT.id);
-    assert.equal(res.ok, true, res.errors.join("; "));
-  });
-
-  it("emits tools — the key whose absence broke 57 of 70 agents", () => {
-    const { frontmatter } = parseAgentMd(renderAgentMd(AGENT, PROFILE));
-    assert.ok(Array.isArray(frontmatter.tools));
-    assert.ok(frontmatter.tools.length > 0);
-  });
-
-  it("normalises the model alias to the full id the runtime dispatches on", () => {
-    const { frontmatter } = parseAgentMd(renderAgentMd(AGENT, PROFILE));
-    assert.equal(frontmatter.model, "claude-opus-4-8");
-  });
-
-  it("leaves identity as {{agent.*}} tokens rather than baking it in", () => {
-    // The regression this guards: generating before config/agent.json was
-    // populated baked the empty values in permanently, shipping 57 agents that
-    // said "sub-agent for ( at UNCONFIGURED)".
-    const text = renderAgentMd(AGENT, PROFILE);
-    assert.match(text, /\{\{agent\.fullName\}\}/);
-    assert.match(text, /\{\{agent\.firstName\}\}/);
-    assert.doesNotMatch(text, /UNCONFIGURED/);
-  });
-
-  it("declares exactly the tokens the body uses", () => {
-    const { frontmatter } = parseAgentMd(renderAgentMd(AGENT, PROFILE));
-    assert.deepEqual(frontmatter.tokens, [
-      "agent.company",
-      "agent.firstName",
-      "agent.fullName",
-      "agent.title",
-    ]);
-  });
-
-  it("keeps description on one line even when the mandate would break the grammar", () => {
-    const nasty = {
-      ...AGENT,
-      mandate: "Own the thing.\nAlso: the # other thing.",
-    };
-    const res = checkAgentFile(renderAgentMd(nasty, PROFILE), nasty.id);
-    assert.equal(res.ok, true, res.errors.join("; "));
-    const { frontmatter } = parseAgentMd(renderAgentMd(nasty, PROFILE));
-    assert.ok(!frontmatter.description.includes("\n"));
-  });
-
-  it("is deterministic — re-rendering yields identical bytes", () => {
-    // Non-determinism here would move hashFile() on every regeneration and make
-    // the registry's local-edit detection permanently wrong.
-    assert.equal(renderAgentMd(AGENT, PROFILE), renderAgentMd(AGENT, PROFILE));
-  });
-
-  it("handles an agent serving no towers", () => {
-    const res = checkAgentFile(
-      renderAgentMd({ ...AGENT, towers: [] }, PROFILE),
-      AGENT.id,
-    );
-    assert.equal(res.ok, true, res.errors.join("; "));
-  });
-});

package/scripts/setup/init-agent.test.mjs

@@ -1,370 +0,0 @@
-// init-agent.test.mjs — supply-chain hygiene of scripts/setup/init-agent.sh
-//
-// Item 0.11 (audit setup-onboarding W1/W2, policies-prompts F-15). Covers the
-// global ~/.claude/settings.json handling: it must DEEP-MERGE maestro's
-// additions into any pre-existing settings (preserving the operator's keys)
-// rather than overwrite, and it must never install an allow-all permissions
-// block or wire unpinned third-party (ruflo@latest) hooks.
-//
-// The deep-merge logic is embedded in init-agent.sh as the MAESTRO_MERGE_NODE
-// program (between the BEGIN/END marker comments). We extract that *exact*
-// program and exercise it via a subprocess — no duplicated logic — so the test
-// pins what the script actually ships.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync, writeFileSync, mkdtempSync, mkdirSync, chmodSync, existsSync, rmSync, readdirSync } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { execFileSync } from "node:child_process";
-import { join, dirname } from "node:path";
-import { tmpdir } from "node:os";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const SCRIPT = join(__dirname, "init-agent.sh");
-const scriptSrc = readFileSync(SCRIPT, "utf8");
-
-// --- extract the embedded merge program (single source of truth) -----------
-function extractMergeProgram() {
-  // MAESTRO_MERGE_NODE='<program>' — single-quoted bash heredoc-style literal.
-  const m = scriptSrc.match(/MAESTRO_MERGE_NODE='([\s\S]*?)'\n# --- END maestro settings deep-merge ---/);
-  assert.ok(m, "MAESTRO_MERGE_NODE program not found in init-agent.sh");
-  return m[1];
-}
-
-function makeTmp() {
-  const dir = mkdtempSync(join(tmpdir(), "init-agent-test-"));
-  return dir;
-}
-
-// Run the extracted node merge program: existing settings JSON (or null for a
-// missing file) + additions JSON on stdin -> returns the merged object.
-function runMerge(existing, additions) {
-  const dir = makeTmp();
-  try {
-    const progPath = join(dir, "merge.cjs");
-    const inPath = join(dir, "settings.json");
-    const outPath = join(dir, "out.json");
-    writeFileSync(progPath, extractMergeProgram());
-    if (existing !== null) {
-      writeFileSync(inPath, typeof existing === "string" ? existing : JSON.stringify(existing));
-    }
-    execFileSync(process.execPath, [progPath, inPath, outPath], {
-      input: JSON.stringify(additions),
-    });
-    return JSON.parse(readFileSync(outPath, "utf8"));
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-// The real additions block the script feeds in (subset that matters here).
-const MAESTRO_ADDITIONS = {
-  $schema: "https://json.schemastore.org/claude-code-settings.json",
-  enabledPlugins: { "claude-mem": true, "context7@claude-plugins-official": true },
-  effortLevel: "high",
-};
-
-test("deep-merge preserves a pre-existing user key", () => {
-  const existing = {
-    myCustomKey: "keep-me",
-    enabledPlugins: { "user-only-plugin": true },
-  };
-  const merged = runMerge(existing, MAESTRO_ADDITIONS);
-
-  // User's top-level key survives.
-  assert.equal(merged.myCustomKey, "keep-me");
-  // User's plugin survives AND maestro's additions land alongside it (object merge).
-  assert.equal(merged.enabledPlugins["user-only-plugin"], true);
-  assert.equal(merged.enabledPlugins["claude-mem"], true);
-  assert.equal(merged.enabledPlugins["context7@claude-plugins-official"], true);
-  // Maestro scalar additions land when the user had nothing there.
-  assert.equal(merged.effortLevel, "high");
-});
-
-test("existing scalar value wins over maestro addition (no clobber)", () => {
-  const existing = { effortLevel: "low", $schema: "user-schema" };
-  const merged = runMerge(existing, MAESTRO_ADDITIONS);
-  assert.equal(merged.effortLevel, "low", "user's effortLevel must not be overwritten");
-  assert.equal(merged.$schema, "user-schema", "user's $schema must not be overwritten");
-});
-
-test("merge never emits an allow-all permissions block", () => {
-  const merged = runMerge({ someKey: 1 }, MAESTRO_ADDITIONS);
-  // No permissions block introduced by maestro at all.
-  assert.equal(merged.permissions, undefined);
-  const dumped = JSON.stringify(merged);
-  assert.ok(!dumped.includes("Bash(*)"), "must not contain Bash(*) allow-all");
-  assert.ok(!dumped.includes("Write(*)"), "must not contain Write(*) allow-all");
-  assert.ok(!dumped.includes("skipDangerousModePermissionPrompt"), "must not skip dangerous-mode prompt");
-});
-
-test("a pre-existing user permissions block is preserved untouched", () => {
-  const existing = {
-    permissions: { allow: ["Read(/safe/*)"], deny: ["Bash(rm -rf /)"] },
-  };
-  const merged = runMerge(existing, MAESTRO_ADDITIONS);
-  assert.deepEqual(merged.permissions.allow, ["Read(/safe/*)"]);
-  assert.deepEqual(merged.permissions.deny, ["Bash(rm -rf /)"]);
-});
-
-test("merge handles a missing settings file (fresh machine)", () => {
-  const merged = runMerge(null, MAESTRO_ADDITIONS);
-  assert.equal(merged.effortLevel, "high");
-  assert.equal(merged.enabledPlugins["claude-mem"], true);
-  assert.equal(merged.permissions, undefined);
-});
-
-test("merge handles invalid/corrupt existing JSON by starting fresh", () => {
-  const merged = runMerge("{ not valid json", MAESTRO_ADDITIONS);
-  assert.equal(merged.effortLevel, "high");
-  assert.equal(merged.permissions, undefined);
-});
-
-// --- static guards on the script source ------------------------------------
-
-test("init-agent.sh no longer wires unpinned ruflo@latest hooks", () => {
-  assert.ok(!/ruflo@latest/.test(scriptSrc), "ruflo@latest must be removed (supply-chain RCE)");
-  assert.ok(!/\bruflo\b/.test(scriptSrc), "no ruflo references should remain");
-});
-
-test("init-agent.sh additions contain no allow-all permissions or dangerous-skip", () => {
-  const m = scriptSrc.match(/MAESTRO_SETTINGS_ADDITIONS='([\s\S]*?)'\n/);
-  assert.ok(m, "MAESTRO_SETTINGS_ADDITIONS block not found");
-  const additions = JSON.parse(m[1]);
-  assert.equal(additions.permissions, undefined, "additions must not ship a permissions block");
-  assert.equal(additions.skipDangerousModePermissionPrompt, undefined,
-    "additions must not skip the dangerous-mode prompt");
-  assert.ok(!m[1].includes("Bash(*)"), "additions must not contain Bash(*) allow-all");
-});
-
-test("init-agent.sh creates the front-door session state and log directories", () => {
-  // launchd creates StandardOutPath's FILE but not its directory; the session
-  // plist logs to logs/session/. The feed/supervisor write under state/session/.
-  for (const d of ["logs/session", "state/session", "state/session/handoffs/done"]) {
-    assert.ok(scriptSrc.includes(`"${d}"`), `DIRS must include ${d}`);
-  }
-});
-
-test("init-agent.sh chmods the .env to 600", () => {
-  assert.ok(/chmod 600 "\$ENV_FILE"/.test(scriptSrc),
-    "the agent .env must be chmod 600 after writing (no world-readable credentials)");
-});
-
-test("init-agent.sh deep-merges rather than cat>-overwriting settings.json", () => {
-  // The old destructive `cat > "$CLAUDE_SETTINGS"` heredoc must be gone.
-  assert.ok(!/cat > "\$CLAUDE_SETTINGS"/.test(scriptSrc),
-    "settings.json must be deep-merged, not overwritten via cat >");
-  assert.ok(scriptSrc.includes("node -e \"$MAESTRO_MERGE_NODE\""),
-    "the merge must run via the embedded node program");
-});
-
-// ---------------------------------------------------------------------------
-// Front-door session prerequisites (design §3.7 / §6 WP-M3): the global SDK
-// install and a terminal multiplexer. The block is embedded in init-agent.sh
-// between BEGIN/END markers; we extract that exact block and run it under
-// bash with stub binaries, so the test pins what the script actually ships.
-// ---------------------------------------------------------------------------
-
-function extractGlobalSdkBlock() {
-  const m = scriptSrc.match(/# --- BEGIN maestro global-sdk check[^\n]*\n([\s\S]*?)# --- END maestro global-sdk check ---/);
-  assert.ok(m, "global-sdk check block (BEGIN/END markers) not found in init-agent.sh");
-  return m[1];
-}
-
-/**
- * Run the extracted block with a stub `npm` (and optional `tmux`) on PATH.
- * `npm ls -g` exits per `installed`; `npm view` prints `latest`; every call is
- * appended to calls.log. Returns {status, stdout, calls}.
- */
-function runGlobalSdkBlock({ installed, installedVersion = "1.0.0", latest = "1.0.0", tmux = false, screenBin, env = {} }) {
-  const dir = makeTmp();
-  try {
-    const bin = join(dir, "bin");
-    const log = join(dir, "calls.log");
-    mkdirSync(bin, { recursive: true });
-    writeFileSync(join(bin, "npm"), `#!/bin/bash
-echo "npm $*" >> "${log}"
-case "$1" in
-  ls) ${installed ? `echo "/usr/local/lib"; echo "└── @cohortapp/agent-sdk@${installedVersion}"; exit 0` : "exit 1"} ;;
-  view) echo "${latest}"; exit 0 ;;
-  install) exit 0 ;;
-esac
-exit 0
-`);
-    chmodSync(join(bin, "npm"), 0o755);
-    if (tmux) { writeFileSync(join(bin, "tmux"), "#!/bin/bash\necho 'tmux 3.4'\n"); chmodSync(join(bin, "tmux"), 0o755); }
-    const prog = `log(){ echo "[init] $1"; }; ok(){ echo "  ok $1"; }; warn(){ echo "  warn $1"; }; fail(){ echo "  FAIL $1"; exit 1; }\n${extractGlobalSdkBlock()}`;
-    writeFileSync(join(dir, "block.sh"), prog);
-    const r = spawnSync("/bin/bash", [join(dir, "block.sh")], {
-      encoding: "utf8",
-      env: { PATH: `${bin}:${env.MAESTRO_TEST_EXTRA_PATH ? `${env.MAESTRO_TEST_EXTRA_PATH}:` : ""}/usr/bin:/bin`, HOME: dir, MAESTRO_SCREEN_BIN: screenBin || join(dir, "no-such-screen"), ...env },
-    });
-    const calls = existsSync(log) ? readFileSync(log, "utf8") : "";
-    return { status: r.status, stdout: r.stdout + r.stderr, calls };
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-test("global SDK present and current: verified, nothing installed", () => {
-  const r = runGlobalSdkBlock({ installed: true, installedVersion: "2.0.0", latest: "2.0.0", tmux: true });
-  assert.equal(r.status, 0, r.stdout);
-  assert.match(r.calls, /^npm ls -g @cohortapp\/agent-sdk/m, `must verify with npm ls -g; calls:\n${r.calls}`);
-  assert.ok(!/npm install -g/.test(r.calls), `must not install; calls:\n${r.calls}`);
-  assert.match(r.stdout, /Global SDK.*2\.0\.0/);
-});
-
-test("global SDK missing: installs @latest", () => {
-  const r = runGlobalSdkBlock({ installed: false, tmux: true });
-  assert.equal(r.status, 0, r.stdout);
-  assert.match(r.calls, /^npm install -g @cohortapp\/agent-sdk@latest/m, `expected a global install; calls:\n${r.calls}`);
-});
-
-test("global SDK outdated: upgrades to @latest", () => {
-  const r = runGlobalSdkBlock({ installed: true, installedVersion: "1.0.0", latest: "2.0.0", tmux: true });
-  assert.equal(r.status, 0, r.stdout);
-  assert.match(r.calls, /^npm install -g @cohortapp\/agent-sdk@latest/m, `expected an upgrade; calls:\n${r.calls}`);
-});
-
-test("MAESTRO_SKIP_GLOBAL_INSTALL=1 verifies but never installs or upgrades", () => {
-  for (const scenario of [{ installed: false }, { installed: true, installedVersion: "1.0.0", latest: "2.0.0" }]) {
-    const r = runGlobalSdkBlock({ ...scenario, tmux: true, env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" } });
-    assert.equal(r.status, 0, r.stdout);
-    assert.match(r.calls, /^npm ls -g @cohortapp\/agent-sdk/m, "still verifies");
-    assert.ok(!/npm install/.test(r.calls), `must not install under the skip flag; calls:\n${r.calls}`);
-    assert.match(r.stdout, /MAESTRO_SKIP_GLOBAL_INSTALL/, "must say why it skipped");
-  }
-});
-
-test("multiplexer: tmux preferred, /usr/bin/screen accepted, neither → warning naming brew install tmux", () => {
-  const withTmux = runGlobalSdkBlock({ installed: true, tmux: true });
-  assert.match(withTmux.stdout, /tmux/);
-  const dir = makeTmp();
-  try {
-    const screen = join(dir, "screen");
-    writeFileSync(screen, "#!/bin/bash\necho 'Screen version 4.00.03'\n"); chmodSync(screen, 0o755);
-    const withScreen = runGlobalSdkBlock({ installed: true, tmux: false, screenBin: screen });
-    assert.equal(withScreen.status, 0, withScreen.stdout);
-    assert.match(withScreen.stdout, /screen/i);
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-  const neither = runGlobalSdkBlock({ installed: true, tmux: false });
-  assert.equal(neither.status, 0, "a missing multiplexer is a warning, not a fatal (screen ships with macOS)");
-  assert.match(neither.stdout, /brew install tmux/);
-});
-
-// ---------------------------------------------------------------------------
-// Review fixes (2026-09-08): the global-sdk block also verifies PATH and never
-// blocks on the registry; Step 5 never unload/loads a live session or daemon.
-// ---------------------------------------------------------------------------
-
-test("global SDK block: `npm view` carries a fetch timeout so an offline init-agent does not hang for minutes", () => {
-  const r = runGlobalSdkBlock({ installed: true, installedVersion: "2.0.0", latest: "2.0.0", tmux: true });
-  assert.match(r.calls, /^npm view @cohortapp\/agent-sdk version.*--fetch-timeout=\d+/m, `calls:\n${r.calls}`);
-});
-
-test("global SDK block: verifies that maestro and cohort-mcp resolve on PATH (spec §3.7(6))", () => {
-  const missing = runGlobalSdkBlock({ installed: true, installedVersion: "2.0.0", latest: "2.0.0", tmux: true });
-  assert.equal(missing.status, 0, missing.stdout);
-  assert.match(missing.stdout, /warn.*maestro.*not on PATH|warn.*not on PATH.*maestro/i, `must warn when maestro is missing from PATH:\n${missing.stdout}`);
-  assert.match(missing.stdout, /cohort-mcp/, "must name cohort-mcp too");
-  // Present on PATH → ok lines naming both.
-  const dir = makeTmp();
-  try {
-    const extra = join(dir, "gbin");
-    mkdirSync(extra, { recursive: true });
-    for (const b of ["maestro", "cohort-mcp"]) { writeFileSync(join(extra, b), "#!/bin/bash\nexit 0\n"); chmodSync(join(extra, b), 0o755); }
-    const present = runGlobalSdkBlock({ installed: true, installedVersion: "2.0.0", latest: "2.0.0", tmux: true, env: { MAESTRO_TEST_EXTRA_PATH: extra } });
-    assert.equal(present.status, 0, present.stdout);
-    assert.match(present.stdout, /ok.*maestro on PATH/i, present.stdout);
-    assert.match(present.stdout, /ok.*cohort-mcp on PATH/i, present.stdout);
-    assert.ok(!/not on PATH/.test(present.stdout));
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-});
-
-function extractLaunchdBlock() {
-  const m = scriptSrc.match(/# --- BEGIN maestro launchd install[^\n]*\n([\s\S]*?)# --- END maestro launchd install ---/);
-  assert.ok(m, "launchd install block (BEGIN/END markers) not found in init-agent.sh");
-  return m[1];
-}
-
-/**
- * Run Step 5 with a stub launchctl whose `list <label>` exits 0 for labels in
- * `loaded`. Generated plists live in scripts/local-triggers/plists/ of a
- * fixture agent dir. Returns {status, stdout, calls, home}.
- */
-function runLaunchdBlock({ plists, loaded = [], supervisor = true, migrate = false }) {
-  const dir = makeTmp();
-  const agent = join(dir, "agent");
-  const home = join(dir, "home");
-  const bin = join(dir, "bin");
-  const log = join(dir, "calls.log");
-  mkdirSync(join(agent, "scripts", "local-triggers", "plists"), { recursive: true });
-  mkdirSync(join(agent, "scripts", "session"), { recursive: true });
-  mkdirSync(join(agent, "scripts", "poller-launchd"), { recursive: true });
-  mkdirSync(join(home, "Library", "LaunchAgents"), { recursive: true });
-  mkdirSync(bin, { recursive: true });
-  for (const label of plists) writeFileSync(join(agent, "scripts", "local-triggers", "plists", `${label}.plist`), `<plist>${label}</plist>\n`);
-  if (supervisor) writeFileSync(join(agent, "scripts", "session", "supervisor.sh"), "#!/bin/bash\n");
-  if (migrate) { writeFileSync(join(agent, "scripts", "poller-launchd", "migrate.sh"), `#!/bin/bash\necho "migrate $*" >> "${log}"\n`); chmodSync(join(agent, "scripts", "poller-launchd", "migrate.sh"), 0o755); }
-  writeFileSync(join(bin, "launchctl"), `#!/bin/bash
-echo "launchctl $*" >> "${log}"
-if [ "$1" = "list" ] && [ -n "$2" ]; then case " ${loaded.join(" ")} " in *" $2 "*) exit 0 ;; *) exit 1 ;; esac; fi
-exit 0
-`);
-  chmodSync(join(bin, "launchctl"), 0o755);
-  const prog = `set -u
-log(){ echo "[init] $1"; }; ok(){ echo "  ok $1"; }; warn(){ echo "  warn $1"; }
-AGENT_DIR="${agent}"
-LAUNCH_AGENTS_DIR="$HOME/Library/LaunchAgents"
-PLIST_DIR="$AGENT_DIR/scripts/local-triggers/plists"
-${extractLaunchdBlock()}`;
-  writeFileSync(join(dir, "block.sh"), prog);
-  const r = spawnSync("/bin/bash", [join(dir, "block.sh")], { encoding: "utf8", env: { PATH: `${bin}:/usr/bin:/bin`, HOME: home } });
-  const calls = existsSync(log) ? readFileSync(log, "utf8") : "";
-  const installed = readdirSync(join(home, "Library", "LaunchAgents"));
-  rmSync(dir, { recursive: true, force: true });
-  return { status: r.status, stdout: r.stdout + r.stderr, calls, installed };
-}
-
-test("Step 5: a LOADED session or daemon job is rewritten but never unloaded/loaded on a re-run (WP-M6 'never bootout')", () => {
-  const r = runLaunchdBlock({
-    plists: ["ai.maestro.ivy-session", "ai.maestro.ivy-daemon", "ai.maestro.ivy-daily-brief"],
-    loaded: ["ai.maestro.ivy-session", "ai.maestro.ivy-daemon", "ai.maestro.ivy-daily-brief"],
-  });
-  assert.equal(r.status, 0, r.stdout);
-  assert.ok(!/launchctl (unload|bootout)[^\n]*-session/.test(r.calls), `must not unload the session job; calls:\n${r.calls}`);
-  assert.ok(!/launchctl load[^\n]*-session/.test(r.calls), `must not re-load a loaded session job; calls:\n${r.calls}`);
-  assert.ok(!/launchctl (unload|bootout|load)[^\n]*-daemon/.test(r.calls), `must not unload/load a loaded daemon; calls:\n${r.calls}`);
-  // The trigger job keeps today's unload + load (its script may have changed).
-  assert.match(r.calls, /launchctl unload[^\n]*daily-brief/);
-  assert.match(r.calls, /launchctl load[^\n]*daily-brief/);
-  // Files are still refreshed for all three.
-  assert.deepEqual(r.installed.sort(), ["ai.maestro.ivy-daemon.plist", "ai.maestro.ivy-daily-brief.plist", "ai.maestro.ivy-session.plist"]);
-  assert.match(r.stdout, /kept running/i);
-});
-
-test("Step 5: a NOT-loaded session/daemon job is installed and loaded (first run)", () => {
-  const r = runLaunchdBlock({ plists: ["ai.maestro.ivy-session", "ai.maestro.ivy-daemon"], loaded: [] });
-  assert.equal(r.status, 0, r.stdout);
-  assert.match(r.calls, /launchctl load[^\n]*ai\.maestro\.ivy-session\.plist/);
-  assert.match(r.calls, /launchctl load[^\n]*ai\.maestro\.ivy-daemon\.plist/);
-  assert.ok(!/launchctl unload/.test(r.calls), "nothing to unload on a first run");
-});
-
-test("Step 5: the session plist is skipped when scripts/session/supervisor.sh is absent (launchd would retry every 30 s forever)", () => {
-  const r = runLaunchdBlock({ plists: ["ai.maestro.ivy-session", "ai.maestro.ivy-daemon"], loaded: [], supervisor: false });
-  assert.equal(r.status, 0, r.stdout);
-  assert.ok(!/-session/.test(r.calls), `must not load a session plist with no supervisor; calls:\n${r.calls}`);
-  assert.ok(!r.installed.includes("ai.maestro.ivy-session.plist"));
-  assert.match(r.stdout, /supervisor\.sh/);
-  assert.match(r.calls, /launchctl load[^\n]*-daemon/);
-});
-
-test("Step 5: runs the poller-plist migration (audit F6 follow-through) when it ships", () => {
-  const r = runLaunchdBlock({ plists: ["ai.maestro.ivy-daemon"], migrate: true });
-  assert.equal(r.status, 0, r.stdout);
-  assert.match(r.calls, /^migrate/m, `calls:\n${r.calls}`);
-  const without = runLaunchdBlock({ plists: ["ai.maestro.ivy-daemon"], migrate: false });
-  assert.equal(without.status, 0, "an absent migrate.sh is not an error");
-});