@cohortapp/agent-sdk 2.17.0 → 2.18.4

package/lib/upgrade/launchd-reconcile.test.mjs

@@ -1,272 +0,0 @@
-/**
- * launchd-reconcile.test.mjs — the pure plist reconcile planner + the edge
- * applier with a recorded `exec` (design 2026-09-08, WP-M6 step 2).
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, statSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import {
-  planLaunchdReconcile, applyLaunchdReconcile, readLaunchdState, readLoadedLabels, readHoldReason,
-  parseLaunchctlList, parseLaunchctlPrintServices, labelOf, REWRITE_ONLY_NOTE,
-} from "./launchd-reconcile.mjs";
-
-const G = ["ai.maestro.ivy-daemon", "ai.maestro.ivy-session", "ai.maestro.ivy-autoupdate", "ai.maestro.ivy-inbox-processor"];
-
-function byLabel(plan) {
-  const m = {};
-  for (const a of plan.actions) m[a.label] = a;
-  return m;
-}
-
-test("first hop: the -session job is generated but not installed → install (bootstrap); the rest unchanged", () => {
-  const plan = planLaunchdReconcile({
-    generated: G,
-    installed: ["ai.maestro.ivy-daemon", "ai.maestro.ivy-autoupdate", "ai.maestro.ivy-inbox-processor"],
-    loaded: ["ai.maestro.ivy-daemon", "ai.maestro.ivy-autoupdate", "ai.maestro.ivy-inbox-processor"],
-    sameContent: () => true,
-  });
-  const m = byLabel(plan);
-  assert.equal(m["ai.maestro.ivy-session"].action, "install");
-  assert.equal(m["ai.maestro.ivy-session"].bootstrap, true);
-  assert.equal(m["ai.maestro.ivy-daemon"].action, "unchanged");
-  assert.equal(m["ai.maestro.ivy-inbox-processor"].action, "unchanged");
-  assert.deepEqual(plan.summary, { install: 1, replace: 0, load: 0, unchanged: 3, orphan: 0, held: 0 });
-  assert.equal(plan.hold, null);
-});
-
-test("content differs while loaded: EVERY label is rewritten only — no kickstart, ever (launchd does not re-read a rewritten plist; -autoupdate is the job this upgrade runs inside)", () => {
-  const plan = planLaunchdReconcile({ generated: G, installed: G, loaded: G, sameContent: () => false });
-  const m = byLabel(plan);
-  for (const l of G) {
-    assert.equal(m[l].action, "replace", l);
-    assert.equal(m[l].bootstrap, false, `${l} is loaded: no bootstrap`);
-    assert.equal("restart" in m[l], false, "the plan has no restart concept at all");
-    assert.match(m[l].reason, /content differs; file rewritten; launchd keeps the loaded definition until next login/);
-  }
-  assert.ok(!JSON.stringify(plan).includes("kickstart"), "nothing in the plan says kickstart");
-  assert.deepEqual(plan.summary, { install: 0, replace: 4, load: 0, unchanged: 0, orphan: 0, held: 0 });
-  assert.match(REWRITE_ONLY_NOTE, /bootout gui\/<uid>\/<label> && launchctl bootstrap/);
-});
-
-test("hold (emergency stop / kill-switch): files are still written but NOTHING is bootstrapped; every held row names the reason", () => {
-  const plan = planLaunchdReconcile({
-    generated: G, installed: ["ai.maestro.ivy-daemon", "ai.maestro.ivy-autoupdate"], loaded: [],
-    sameContent: (l) => l === "ai.maestro.ivy-daemon", hold: "emergency stop (.emergency-stop)",
-  });
-  const m = byLabel(plan);
-  assert.equal(m["ai.maestro.ivy-session"].action, "install");
-  assert.equal(m["ai.maestro.ivy-session"].bootstrap, false);
-  assert.equal(m["ai.maestro.ivy-session"].held, true);
-  assert.match(m["ai.maestro.ivy-session"].reason, /held: emergency stop \(\.emergency-stop\)/);
-  assert.equal(m["ai.maestro.ivy-autoupdate"].action, "replace");
-  assert.equal(m["ai.maestro.ivy-autoupdate"].bootstrap, false);
-  assert.equal(m["ai.maestro.ivy-daemon"].action, "load");
-  assert.equal(m["ai.maestro.ivy-daemon"].bootstrap, false);
-  assert.ok(plan.actions.every((a) => a.bootstrap === false));
-  assert.equal(plan.summary.held, 4);
-  assert.equal(plan.hold, "emergency stop (.emergency-stop)");
-});
-
-test("installed but not loaded → bootstrap (same content: load; different: replace + bootstrap)", () => {
-  const plan = planLaunchdReconcile({
-    generated: G, installed: G, loaded: ["ai.maestro.ivy-daemon"],
-    sameContent: (l) => l !== "ai.maestro.ivy-session",
-  });
-  const m = byLabel(plan);
-  assert.equal(m["ai.maestro.ivy-inbox-processor"].action, "load");
-  assert.equal(m["ai.maestro.ivy-inbox-processor"].bootstrap, true);
-  assert.equal(m["ai.maestro.ivy-session"].action, "replace");
-  assert.equal(m["ai.maestro.ivy-session"].bootstrap, true);
-  assert.equal(m["ai.maestro.ivy-daemon"].action, "unchanged");
-});
-
-test("an installed maestro label that is no longer generated is an orphan: reported, never booted out; foreign labels are ignored", () => {
-  const plan = planLaunchdReconcile({
-    generated: ["ai.maestro.ivy-daemon"],
-    installed: ["ai.maestro.ivy-daemon", "ai.maestro.ivy-boot-claude-session", "ai.adaptic.ivy-old", "com.apple.something"],
-    loaded: ["ai.maestro.ivy-daemon"], sameContent: () => true,
-  });
-  const orphans = plan.actions.filter((a) => a.action === "orphan").map((a) => a.label).sort();
-  assert.deepEqual(orphans, ["ai.adaptic.ivy-old", "ai.maestro.ivy-boot-claude-session"]);
-  assert.ok(!plan.actions.some((a) => a.label === "com.apple.something"));
-  assert.ok(plan.actions.every((a) => a.action !== "bootout"));
-});
-
-test("a throwing sameContent is treated as 'different' (rewrite is the safe direction); .plist suffixes are normalised", () => {
-  const plan = planLaunchdReconcile({ generated: ["ai.maestro.ivy-daemon.plist"], installed: ["ai.maestro.ivy-daemon.plist"], loaded: ["ai.maestro.ivy-daemon"], sameContent: () => { throw new Error("EACCES"); } });
-  assert.equal(plan.actions[0].action, "replace");
-  assert.equal(plan.actions[0].bootstrap, false, "loaded → rewrite only");
-  assert.equal(labelOf("x.plist"), "x");
-});
-
-test("parseLaunchctlPrintServices: the labels inside `services = { … }` of `launchctl print gui/<uid>`; null without that block", () => {
-  const out = [
-    "gui/501 = {", "\ttype = gui", "\thandle = 501",
-    "\tservices = {",
-    "\t\t   46859      - \tapplication.com.microsoft.VSCode.590407.590413",
-    "\t\t       0      0 \tai.maestro.ivy-inbox-processor",
-    "\t\t    4242      - \tai.maestro.ivy-daemon",
-    "\t}",
-    "\tdisabled services = {", "\t\t\"ai.maestro.ivy-old\" => disabled", "\t}", "}", "",
-  ].join("\n");
-  assert.deepEqual(parseLaunchctlPrintServices(out), ["application.com.microsoft.VSCode.590407.590413", "ai.maestro.ivy-inbox-processor", "ai.maestro.ivy-daemon"]);
-  assert.equal(parseLaunchctlPrintServices("Could not find domain for gui/501\n"), null);
-  assert.equal(parseLaunchctlPrintServices(""), null);
-});
-
-test("readLoadedLabels: `launchctl print gui/<uid>` is the source of truth; `launchctl list` only when print is unavailable", () => {
-  const print = { status: 0, stdout: "gui/501 = {\n\tservices = {\n\t\t0\t0\tai.maestro.ivy-daemon\n\t}\n}\n" };
-  const list = { status: 0, stdout: "PID\tStatus\tLabel\n" }; // what ssh sees: no gui-domain agents
-  const both = (cmd, args) => (args[0] === "print" ? print : list);
-  assert.deepEqual(readLoadedLabels({ exec: both, uid: 501 }), { loaded: ["ai.maestro.ivy-daemon"], ok: true, via: "print" });
-  const calls = [];
-  const noPrint = (cmd, args) => { calls.push(args.join(" ")); return args[0] === "print" ? { status: 1, stdout: "", stderr: "Bad request." } : { status: 0, stdout: "PID\tStatus\tLabel\n1\t0\tai.maestro.ivy-daemon\n" }; };
-  assert.deepEqual(readLoadedLabels({ exec: noPrint, uid: 501 }), { loaded: ["ai.maestro.ivy-daemon"], ok: true, via: "list" });
-  assert.deepEqual(calls, ["print gui/501", "list"]);
-  assert.deepEqual(readLoadedLabels({ exec: () => ({ status: 127, stdout: "", stderr: "not found" }), uid: 501 }), { loaded: [], ok: false, via: "none" });
-});
-
-test("readHoldReason: .emergency-stop, state/EMERGENCY_STOP and the two kill-switch files each hold; a clean seat does not", () => {
-  const root = mkdtempSync(join(tmpdir(), "launchd-hold-"));
-  try {
-    const cwd = join(root, "agent"); const home = join(root, "home");
-    mkdirSync(join(cwd, "state"), { recursive: true }); mkdirSync(home, { recursive: true });
-    assert.equal(readHoldReason({ cwd, home }), null);
-    writeFileSync(join(home, ".maestro-no-autoupdate"), ""); assert.match(readHoldReason({ cwd, home }), /kill-switch \(~\/\.maestro-no-autoupdate\)/);
-    writeFileSync(join(cwd, "state", "EMERGENCY_STOP"), ""); assert.match(readHoldReason({ cwd, home }), /emergency stop \(state\/EMERGENCY_STOP\)/);
-    writeFileSync(join(cwd, ".emergency-stop"), ""); assert.match(readHoldReason({ cwd, home }), /emergency stop \(\.emergency-stop\)/, "the emergency stop outranks the kill-switch in the message");
-    rmSync(join(cwd, ".emergency-stop")); rmSync(join(cwd, "state", "EMERGENCY_STOP")); rmSync(join(home, ".maestro-no-autoupdate"));
-    writeFileSync(join(cwd, ".no-autoupdate"), ""); assert.match(readHoldReason({ cwd, home }), /kill-switch \(\.no-autoupdate\)/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("parseLaunchctlList: last column is the label; the header row is dropped; PID '-' still counts as loaded", () => {
-  const out = "PID\tStatus\tLabel\n4242\t0\tai.maestro.ivy-daemon\n-\t0\tai.maestro.ivy-inbox-processor\n";
-  assert.deepEqual(parseLaunchctlList(out), ["ai.maestro.ivy-daemon", "ai.maestro.ivy-inbox-processor"]);
-  assert.deepEqual(parseLaunchctlList(""), []);
-});
-
-// ---------------------------------------------------------------------------
-// applyLaunchdReconcile — the edge, with a recorded exec
-// ---------------------------------------------------------------------------
-
-function fx() {
-  const root = mkdtempSync(join(tmpdir(), "launchd-reconcile-"));
-  const generatedDir = join(root, "plists");
-  const launchAgentsDir = join(root, "LaunchAgents");
-  mkdirSync(generatedDir, { recursive: true });
-  mkdirSync(launchAgentsDir, { recursive: true });
-  return { root, generatedDir, launchAgentsDir };
-}
-
-/** A launchctl/launchd double: `loaded` answers `print gui/<uid>` (the services block) and `print gui/<uid>/<label>`. */
-function recorder(responses = {}, { loaded = [] } = {}) {
-  const calls = [];
-  const exec = (cmd, args) => {
-    calls.push([cmd, ...args]);
-    const key = `${cmd} ${args.slice(0, 2).join(" ")}`;
-    for (const [k, v] of Object.entries(responses)) if (key.startsWith(k)) return typeof v === "function" ? v(args) : v;
-    if (cmd === "launchctl" && args[0] === "print") {
-      const parts = String(args[1]).split("/");
-      if (parts.length === 2) return { status: 0, stdout: `gui/501 = {\n\tservices = {\n${loaded.map((l) => `\t\t0\t0\t${l}`).join("\n")}\n\t}\n}\n`, stderr: "" };
-      return loaded.includes(parts[2]) ? { status: 0, stdout: `${parts[2]} = {\n\tstate = running\n}\n`, stderr: "" } : { status: 113, stdout: "", stderr: `Could not find service "${parts[2]}" in domain for user gui: 501` };
-    }
-    return { status: 0, stdout: "", stderr: "" };
-  };
-  exec.calls = calls;
-  return exec;
-}
-
-test("apply: install copies the plist with mode 600 and bootstraps gui/<uid>; a changed loaded job (cadence, -autoupdate, -daemon alike) is rewritten and never kickstarted", () => {
-  const f = fx();
-  try {
-    writeFileSync(join(f.generatedDir, "ai.maestro.ivy-session.plist"), "<plist>session</plist>");
-    writeFileSync(join(f.generatedDir, "ai.maestro.ivy-inbox-processor.plist"), "<plist>new</plist>");
-    writeFileSync(join(f.launchAgentsDir, "ai.maestro.ivy-inbox-processor.plist"), "<plist>old</plist>");
-    writeFileSync(join(f.generatedDir, "ai.maestro.ivy-autoupdate.plist"), "<plist>au-new</plist>");
-    writeFileSync(join(f.launchAgentsDir, "ai.maestro.ivy-autoupdate.plist"), "<plist>au-old</plist>");
-    writeFileSync(join(f.generatedDir, "ai.maestro.ivy-daemon.plist"), "<plist>daemon-new</plist>");
-    writeFileSync(join(f.launchAgentsDir, "ai.maestro.ivy-daemon.plist"), "<plist>daemon-old</plist>");
-    const exec = recorder({}, { loaded: ["ai.maestro.ivy-inbox-processor", "ai.maestro.ivy-autoupdate", "ai.maestro.ivy-daemon"] });
-    const state = readLaunchdState({ ...f, exec, uid: 501 });
-    assert.equal(state.loadedVia, "print");
-    assert.deepEqual(state.generated.sort(), ["ai.maestro.ivy-autoupdate", "ai.maestro.ivy-daemon", "ai.maestro.ivy-inbox-processor", "ai.maestro.ivy-session"]);
-    const plan = planLaunchdReconcile(state);
-    const r = applyLaunchdReconcile({ plan, ...f, uid: 501, exec });
-    assert.equal(r.ok, true, JSON.stringify(r.results));
-
-    const dst = join(f.launchAgentsDir, "ai.maestro.ivy-session.plist");
-    assert.ok(existsSync(dst));
-    assert.equal(statSync(dst).mode & 0o777, 0o600);
-    assert.equal(readFileSync(join(f.launchAgentsDir, "ai.maestro.ivy-inbox-processor.plist"), "utf8"), "<plist>new</plist>");
-    assert.equal(readFileSync(join(f.launchAgentsDir, "ai.maestro.ivy-autoupdate.plist"), "utf8"), "<plist>au-new</plist>");
-    assert.equal(readFileSync(join(f.launchAgentsDir, "ai.maestro.ivy-daemon.plist"), "utf8"), "<plist>daemon-new</plist>");
-
-    const calls = exec.calls.map((c) => c.join(" "));
-    assert.ok(calls.includes(`launchctl bootstrap gui/501 ${dst}`), calls.join("\n"));
-    assert.ok(!calls.some((c) => /kickstart/.test(c)), `nothing is ever kickstarted: ${calls.join("\n")}`);
-    assert.ok(!calls.some((c) => /bootout|unload/.test(c)));
-    assert.ok(!calls.some((c) => /^launchctl load/.test(c)), "bootstrap succeeded → no domain-less load");
-    const rows = Object.fromEntries(r.results.map((x) => [x.label, x]));
-    assert.match(rows["ai.maestro.ivy-autoupdate"].detail, /replaced \(file only\)/);
-    assert.match(rows["ai.maestro.ivy-inbox-processor"].detail, /until next login/);
-  } finally { rmSync(f.root, { recursive: true, force: true }); }
-});
-
-test("apply: held seat — the session plist is written (600) but no launchctl bootstrap/load happens, and the row says why", () => {
-  const f = fx();
-  try {
-    writeFileSync(join(f.generatedDir, "ai.maestro.ivy-session.plist"), "<plist>session</plist>");
-    const exec = recorder();
-    const plan = planLaunchdReconcile({ generated: ["ai.maestro.ivy-session"], installed: [], loaded: [], hold: "emergency stop (.emergency-stop)" });
-    const r = applyLaunchdReconcile({ plan, ...f, uid: 501, exec });
-    assert.equal(r.ok, true);
-    const dst = join(f.launchAgentsDir, "ai.maestro.ivy-session.plist");
-    assert.ok(existsSync(dst));
-    assert.equal(statSync(dst).mode & 0o777, 0o600);
-    assert.match(r.results[0].detail, /file written; not installed; held: emergency stop/);
-    assert.deepEqual(exec.calls, [], "no launchctl call at all on a held seat");
-  } finally { rmSync(f.root, { recursive: true, force: true }); }
-});
-
-test("apply: bootstrap 5 with the label already loaded in gui/<uid> is success WITHOUT a `launchctl load`; bootstrap failing for a label launchd does not know falls back to load; both failing reports ok:false without throwing", () => {
-  const f = fx();
-  try {
-    writeFileSync(join(f.generatedDir, "ai.maestro.ivy-session.plist"), "<plist/>");
-    writeFileSync(join(f.generatedDir, "ai.maestro.ivy-autoupdate.plist"), "<plist/>");
-    writeFileSync(join(f.generatedDir, "ai.maestro.ivy-inbox-processor.plist"), "<plist/>");
-    const exec = recorder({
-      "launchctl bootstrap": () => ({ status: 5, stdout: "", stderr: "Bootstrap failed: 5: Input/output error" }),
-      "launchctl load": (args) => (args[1].includes("autoupdate") ? { status: 1, stdout: "", stderr: "nope" } : { status: 0, stdout: "", stderr: "" }),
-    }, { loaded: ["ai.maestro.ivy-session"] }); // ssh case: `print gui/501` was consulted for the plan, but here the plan says "install" for all three
-    const plan = planLaunchdReconcile({ generated: ["ai.maestro.ivy-session", "ai.maestro.ivy-autoupdate", "ai.maestro.ivy-inbox-processor"], installed: [], loaded: [] });
-    const r = applyLaunchdReconcile({ plan, ...f, uid: 501, exec });
-    assert.equal(r.ok, false);
-    const rows = Object.fromEntries(r.results.map((x) => [x.label, x]));
-    assert.equal(rows["ai.maestro.ivy-session"].ok, true);
-    assert.match(rows["ai.maestro.ivy-session"].detail, /bootstrap 5 but already loaded in gui\/501/);
-    assert.equal(rows["ai.maestro.ivy-inbox-processor"].ok, true);
-    assert.match(rows["ai.maestro.ivy-inbox-processor"].detail, /via launchctl load/);
-    assert.equal(rows["ai.maestro.ivy-autoupdate"].ok, false);
-    assert.match(rows["ai.maestro.ivy-autoupdate"].detail, /file written but not loaded/);
-    assert.ok(existsSync(join(f.launchAgentsDir, "ai.maestro.ivy-autoupdate.plist")), "the file lands even when loading fails");
-    const calls = exec.calls.map((c) => c.join(" "));
-    assert.ok(!calls.some((c) => /^launchctl load .*ivy-session/.test(c)), `already-loaded label must not be loaded a second time: ${calls.join("\n")}`);
-    assert.ok(calls.includes("launchctl print gui/501/ai.maestro.ivy-session"));
-  } finally { rmSync(f.root, { recursive: true, force: true }); }
-});
-
-test("apply: a missing generated file is reported as a failed row, never thrown", () => {
-  const f = fx();
-  try {
-    const exec = recorder();
-    const plan = planLaunchdReconcile({ generated: ["ai.maestro.ivy-ghost"], installed: [], loaded: [] });
-    const r = applyLaunchdReconcile({ plan, ...f, uid: 501, exec });
-    assert.equal(r.ok, false);
-    assert.match(r.results[0].detail, /install failed/);
-    assert.deepEqual(exec.calls, []);
-  } finally { rmSync(f.root, { recursive: true, force: true }); }
-});

package/lib/upgrade/post-steps.test.mjs

@@ -1,200 +0,0 @@
-/**
- * post-steps.test.mjs — runUpgradePostSteps over a temp agent dir + HOME with
- * a recorded exec. Nothing real is run: generate-plists.sh is a stub the test
- * writes, npm/launchctl are answered by the recorder, and
- * MAESTRO_SKIP_GLOBAL_INSTALL=1 is set throughout.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, statSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { spawnSync } from "node:child_process";
-import { runUpgradePostSteps, UPGRADE_RESULT_REL, STEP_NAMES } from "./post-steps.mjs";
-
-const LABELS = ["ai.maestro.ivy-daemon", "ai.maestro.ivy-session", "ai.maestro.ivy-autoupdate"];
-
-function seat() {
-  const root = mkdtempSync(join(tmpdir(), "post-steps-"));
-  const cwd = join(root, "ivy-ai");
-  const home = join(root, "home");
-  mkdirSync(join(cwd, "scripts", "local-triggers", "plists"), { recursive: true });
-  mkdirSync(join(home, "Library", "LaunchAgents"), { recursive: true });
-  mkdirSync(join(cwd, "config"), { recursive: true });
-  writeFileSync(join(cwd, "config", "agent.json"), JSON.stringify({ firstName: "Ivy" }));
-  // The daemon + autoupdate plists are already installed (an existing seat);
-  // the session plist is what the generator adds on the first hop.
-  for (const l of ["ai.maestro.ivy-daemon", "ai.maestro.ivy-autoupdate"]) writeFileSync(join(home, "Library", "LaunchAgents", `${l}.plist`), `<plist>${l} OLD</plist>`);
-  return { root, cwd, home };
-}
-
-/** A generator stub that renders the three labels and prints the real footer line. */
-function stubGenerator(cwd, { fail = false, autoupdateBody = "" } = {}) {
-  const dir = join(cwd, "scripts", "local-triggers");
-  writeFileSync(join(dir, "generate-plists.sh"), fail
-    ? "#!/bin/bash\necho boom >&2\nexit 3\n"
-    : `#!/bin/bash\nset -e\nD="$(cd "$(dirname "$0")" && pwd)/plists"\nmkdir -p "$D"\nfor l in ${LABELS.join(" ")}; do printf '<plist>%s</plist>' "$l" > "$D/$l.plist"; done\n${autoupdateBody}\necho "Generated 3 plist files in $D"\n`);
-}
-
-/**
- * launchd double. `loaded` is what the gui domain holds: `print gui/<uid>`
- * lists it, `print gui/<uid>/<label>` answers per label. `listShows` is what a
- * domain-less `launchctl list` prints — from ssh that is NOT the gui domain,
- * so it defaults to nothing (the case the reconcile must get right).
- */
-function recorder({ loaded = ["ai.maestro.ivy-daemon", "ai.maestro.ivy-autoupdate"], listShows = [], printOk = true } = {}) {
-  const calls = [];
-  const exec = (cmd, args, opts) => {
-    calls.push([cmd, ...args]);
-    if (cmd === "/bin/bash") {
-      // Run the generator for real — it is the test's own stub.
-      const r = spawnSync(cmd, args, { encoding: "utf8", cwd: opts && opts.cwd });
-      return { status: r.status, stdout: r.stdout, stderr: r.stderr };
-    }
-    if (cmd === "launchctl" && args[0] === "print") {
-      if (!printOk) return { status: 1, stdout: "", stderr: "Bad request." };
-      const parts = String(args[1]).split("/");
-      if (parts.length === 2) return { status: 0, stdout: `gui/501 = {\n\tservices = {\n${loaded.map((l) => `\t\t0\t0\t${l}`).join("\n")}\n\t}\n}\n`, stderr: "" };
-      return loaded.includes(parts[2]) ? { status: 0, stdout: `${parts[2]} = {}\n`, stderr: "" } : { status: 113, stdout: "", stderr: `Could not find service "${parts[2]}" in domain for user gui: 501` };
-    }
-    if (cmd === "launchctl" && args[0] === "list") return { status: 0, stdout: `PID Status Label\n${listShows.map((l) => `1 0 ${l}`).join("\n")}\n`, stderr: "" };
-    if (cmd === "launchctl" && args[0] === "bootstrap") {
-      const label = String(args[2]).replace(/^.*\//, "").replace(/\.plist$/, "");
-      if (loaded.includes(label)) return { status: 5, stdout: "", stderr: "Bootstrap failed: 5: Input/output error" };
-      loaded.push(label);
-      return { status: 0, stdout: "", stderr: "" };
-    }
-    if (cmd === "launchctl") return { status: 0, stdout: "", stderr: "" };
-    return { status: 1, stdout: "", stderr: "unexpected" };
-  };
-  exec.calls = calls;
-  return exec;
-}
-test("first hop on an existing seat: plists regenerated, the -session job installed (600 + bootstrap), the changed daemon AND autoupdate plists rewritten but never kickstarted, global-setup run, result file written", async () => {
-  const s = seat();
-  try {
-    stubGenerator(s.cwd);
-    const exec = recorder();
-    let setupRuns = 0;
-    const said = [];
-    const r = await runUpgradePostSteps({
-      cwd: s.cwd, home: s.home, uid: 501, env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" }, exec, sdkVersion: "2.12.0", from: "2.11.17", now: Date.parse("2026-09-08T12:00:00Z"),
-      globalSetup: async () => { setupRuns++; },
-      say: { log: (m) => said.push(m), ok: (m) => said.push(`ok ${m}`), warn: (m) => said.push(`warn ${m}`) },
-    });
-    assert.equal(r.from, "2.11.17");
-    assert.equal(r.to, "2.12.0");
-    assert.equal(r.at, "2026-09-08T12:00:00.000Z");
-    assert.deepEqual(Object.keys(r.steps), STEP_NAMES);
-    assert.equal(r.steps.plists.ok, true, r.steps.plists.detail);
-    assert.match(r.steps.plists.detail, /regenerated 3 plist/);
-    assert.equal(r.steps.launchd.ok, true, r.steps.launchd.detail);
-    assert.match(r.steps.launchd.detail, /1 installed, 2 replaced/);
-    assert.equal(r.steps.globalSetup.ok, true);
-    assert.equal(setupRuns, 1);
-    assert.equal(r.steps.globalInstall.ok, true);
-    assert.match(r.steps.globalInstall.detail, /skipped .*MAESTRO_SKIP_GLOBAL_INSTALL/);
-    assert.equal(typeof r.steps.verify.ok, "boolean");
-
-    const dst = join(s.home, "Library", "LaunchAgents", "ai.maestro.ivy-session.plist");
-    assert.ok(existsSync(dst), "session plist must be installed");
-    assert.equal(statSync(dst).mode & 0o777, 0o600);
-    const calls = exec.calls.map((c) => c.join(" "));
-    assert.ok(calls.includes(`launchctl bootstrap gui/501 ${dst}`), calls.join("\n"));
-    assert.ok(!calls.some((c) => /kickstart/.test(c)), `nothing is kickstarted — least of all the -autoupdate job this upgrade runs inside: ${calls.join("\n")}`);
-    assert.ok(!calls.some((c) => /bootout|unload/.test(c)));
-    assert.ok(!calls.some((c) => /^launchctl load/.test(c)), "bootstrap succeeded → no domain-less load");
-    assert.ok(calls.includes("launchctl print gui/501"), "loaded-ness is read from the gui domain, not a domain-less `launchctl list`");
-    assert.ok(!calls.includes("launchctl list"), calls.join("\n"));
-    assert.ok(said.some((m) => /ai\.maestro\.ivy-autoupdate: replaced \(file only\)/.test(m)), said.join("\n"));
-    assert.ok(!said.some((m) => /kickstart/.test(m)));
-    assert.ok(!calls.some((c) => /^npm install/.test(c)), "no global install under the skip flag");
-
-    const file = JSON.parse(readFileSync(join(s.cwd, UPGRADE_RESULT_REL), "utf8"));
-    assert.deepEqual(file, { from: "2.11.17", to: "2.12.0", at: "2026-09-08T12:00:00.000Z", steps: r.steps });
-    assert.ok(said.some((m) => /^ok launchd:/.test(m)), said.join("\n"));
-  } finally { rmSync(s.root, { recursive: true, force: true }); }
-});
-
-test("fail-open: a failing generator, a throwing global-setup and a missing launchctl are each ONE failed step; the rest still run and the result file is still written", async () => {
-  const s = seat();
-  try {
-    stubGenerator(s.cwd, { fail: true });
-    const exec = (cmd, args, opts) => {
-      if (cmd === "/bin/bash") { const r = spawnSync(cmd, args, { encoding: "utf8", cwd: opts && opts.cwd }); return { status: r.status, stdout: r.stdout, stderr: r.stderr }; }
-      return { status: 127, stdout: "", stderr: "launchctl: command not found" };
-    };
-    const r = await runUpgradePostSteps({ cwd: s.cwd, home: s.home, uid: 501, env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" }, exec, sdkVersion: "2.12.0", globalSetup: async () => { throw new Error("no ~/.claude"); } });
-    assert.equal(r.steps.plists.ok, false);
-    assert.match(r.steps.plists.detail, /exited 3 \(boom\)/);
-    assert.equal(r.steps.launchd.ok, false);
-    assert.match(r.steps.launchd.detail, /launchctl unavailable/);
-    assert.equal(r.steps.globalSetup.ok, false);
-    assert.match(r.steps.globalSetup.detail, /no ~\/\.claude/);
-    assert.equal(r.steps.globalInstall.ok, true);
-    assert.equal(r.from, null);
-    assert.ok(existsSync(join(s.cwd, UPGRADE_RESULT_REL)));
-    assert.ok(!existsSync(join(s.home, "Library", "LaunchAgents", "ai.maestro.ivy-session.plist")), "nothing installed when launchd is unreachable");
-  } finally { rmSync(s.root, { recursive: true, force: true }); }
-});
-
-test("no generator on disk (a stripped repo): the plists step fails, launchd sees nothing generated, no launchctl write happens", async () => {
-  const s = seat();
-  try {
-    const exec = recorder();
-    const r = await runUpgradePostSteps({ cwd: s.cwd, home: s.home, uid: 501, env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" }, exec, sdkVersion: "2.12.0", globalSetup: async () => {} });
-    assert.equal(r.steps.plists.ok, false);
-    assert.match(r.steps.launchd.detail, /0 installed, 0 replaced/);
-    assert.ok(!exec.calls.some((c) => c[0] === "launchctl" && c[1] !== "print"));
-  } finally { rmSync(s.root, { recursive: true, force: true }); }
-});
-
-test("held seat: under .emergency-stop the session plist is written but NOT bootstrapped; the step and the result file say why; the kill-switch holds the same way", async () => {
-  for (const marker of [".emergency-stop", join("state", "EMERGENCY_STOP"), ".no-autoupdate"]) {
-    const s = seat();
-    try {
-      stubGenerator(s.cwd);
-      mkdirSync(join(s.cwd, "state"), { recursive: true });
-      writeFileSync(join(s.cwd, marker), "2026-09-08T12:00:00Z\n");
-      // emergency-stop.sh unloaded everything: nothing is loaded in gui/501.
-      const exec = recorder({ loaded: [] });
-      const r = await runUpgradePostSteps({ cwd: s.cwd, home: s.home, uid: 501, env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" }, exec, sdkVersion: "2.12.0", globalSetup: async () => {} });
-      assert.equal(r.steps.launchd.ok, true, r.steps.launchd.detail);
-      assert.match(r.steps.launchd.detail, /3 not bootstrapped — held: (emergency stop|autoupdate kill-switch)/, `${marker}: ${r.steps.launchd.detail}`);
-      const dst = join(s.home, "Library", "LaunchAgents", "ai.maestro.ivy-session.plist");
-      assert.ok(existsSync(dst), "the file still lands so the next login / an explicit start has it");
-      assert.equal(statSync(dst).mode & 0o777, 0o600);
-      const calls = exec.calls.map((c) => c.join(" "));
-      assert.ok(!calls.some((c) => /bootstrap|^launchctl load|kickstart/.test(c)), `${marker}: no job may start under a hold: ${calls.join("\n")}`);
-      const file = JSON.parse(readFileSync(join(s.cwd, UPGRADE_RESULT_REL), "utf8"));
-      assert.match(file.steps.launchd.detail, /held/);
-    } finally { rmSync(s.root, { recursive: true, force: true }); }
-  }
-});
-
-test("from ssh: a domain-less `launchctl list` shows nothing, but `print gui/<uid>` shows the jobs — nothing is re-loaded and nothing is double-registered", async () => {
-  const s = seat();
-  try {
-    stubGenerator(s.cwd);
-    const exec = recorder({ loaded: ["ai.maestro.ivy-daemon", "ai.maestro.ivy-autoupdate"], listShows: [] });
-    const r = await runUpgradePostSteps({ cwd: s.cwd, home: s.home, uid: 501, env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" }, exec, sdkVersion: "2.12.0", globalSetup: async () => {} });
-    assert.equal(r.steps.launchd.ok, true, r.steps.launchd.detail);
-    assert.match(r.steps.launchd.detail, /1 installed, 2 replaced, 0 loaded/);
-    const calls = exec.calls.map((c) => c.join(" "));
-    assert.equal(calls.filter((c) => /^launchctl bootstrap/.test(c)).length, 1, "only the session job is bootstrapped");
-    assert.ok(!calls.some((c) => /^launchctl load/.test(c)), `no domain-less load from ssh: ${calls.join("\n")}`);
-    assert.ok(!/launchctl list/.test(r.steps.launchd.detail));
-  } finally { rmSync(s.root, { recursive: true, force: true }); }
-});
-
-test("when `launchctl print` is unavailable the reconcile falls back to `launchctl list` and says so in the step detail", async () => {
-  const s = seat();
-  try {
-    stubGenerator(s.cwd);
-    const exec = recorder({ loaded: [], listShows: ["ai.maestro.ivy-daemon", "ai.maestro.ivy-autoupdate"], printOk: false });
-    const r = await runUpgradePostSteps({ cwd: s.cwd, home: s.home, uid: 501, env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" }, exec, sdkVersion: "2.12.0", globalSetup: async () => {} });
-    assert.match(r.steps.launchd.detail, /loaded-ness from `launchctl list`/);
-    assert.match(r.steps.launchd.detail, /1 installed, 2 replaced/);
-  } finally { rmSync(s.root, { recursive: true, force: true }); }
-});

package/lib/upgrade/verify.test.mjs

@@ -1,164 +0,0 @@
-/**
- * verify.test.mjs — buildVerifyReport is pure; collectVerifyInputs reads a
- * temp HOME + agent dir with a recorded exec (never the real npm/launchctl).
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { buildVerifyReport, formatVerifyReport, parseDaemonHealth, collectVerifyInputs, runVerify } from "./verify.mjs";
-import { IDENTITY_BEGIN, IDENTITY_END, CLAUDE_MD_BEGIN, CLAUDE_MD_END, mergeSessionSettings } from "../collective/global-config.mjs";
-
-const G = ["ai.maestro.ivy-daemon", "ai.maestro.ivy-session"];
-const allMarkers = { identityConfigured: true, identity: true, collective: true, mcp: true, settings: true, pointer: true, skills: true };
-
-function good(over = {}) {
-  return {
-    expected: "2.12.0", globalVersion: "2.12.0", localVersion: "2.12.0", manifestPresent: true, manifestVersion: "2.12.0",
-    daemon: { version: "2.12.0", updatedAt: "2026-09-08T12:00:00Z" },
-    plists: { generated: G, installed: G, loaded: G, launchctlOk: true }, markers: allMarkers, ...over,
-  };
-}
-
-const byName = (r) => Object.fromEntries(r.rows.map((x) => [x.name, x]));
-
-test("a seat wholly on the expected version is ok with no mismatches", () => {
-  const r = buildVerifyReport(good());
-  assert.equal(r.ok, true, JSON.stringify(r.rows));
-  assert.deepEqual(r.mismatches, []);
-  assert.ok(r.rows.every((x) => x.level === "ok"));
-  assert.match(formatVerifyReport(r).pop(), /seat is on 2\.12\.0/);
-});
-
-test("global bin behind → fail; under MAESTRO_SKIP_GLOBAL_INSTALL it is a warn", () => {
-  const r = buildVerifyReport(good({ globalVersion: "2.11.17" }));
-  assert.equal(r.ok, false);
-  assert.deepEqual(r.mismatches, ["global"]);
-  assert.match(byName(r).global.msg, /npm i -g @cohortapp\/agent-sdk@2\.12\.0 --no-audit --no-fund/);
-  const s = buildVerifyReport(good({ globalVersion: "", skipGlobal: true }));
-  assert.equal(s.ok, true);
-  assert.equal(byName(s).global.level, "warn");
-  assert.equal(buildVerifyReport(good({ globalVersion: "" })).mismatches[0], "global");
-});
-
-test("local / manifest / daemon: missing is a warn, a different version is a fail; daemonRestartPending downgrades the daemon row", () => {
-  assert.equal(byName(buildVerifyReport(good({ localVersion: "" }))).local.level, "warn");
-  assert.deepEqual(buildVerifyReport(good({ localVersion: "2.11.17" })).mismatches, ["local"]);
-  assert.equal(byName(buildVerifyReport(good({ manifestPresent: false }))).manifest.level, "warn");
-  assert.equal(byName(buildVerifyReport(good({ manifestVersion: "" }))).manifest.level, "warn");
-  assert.deepEqual(buildVerifyReport(good({ manifestVersion: "2.11.17" })).mismatches, ["manifest"]);
-  assert.equal(byName(buildVerifyReport(good({ daemon: { version: "" } }))).daemon.level, "warn");
-  assert.deepEqual(buildVerifyReport(good({ daemon: { version: "2.11.17" } })).mismatches, ["daemon"]);
-  const pending = buildVerifyReport(good({ daemon: { version: "2.11.17" }, daemonRestartPending: true }));
-  assert.equal(pending.ok, true);
-  assert.match(byName(pending).daemon.msg, /autoupdate kickstarts/);
-});
-
-test("plists: a generated label that is not installed, or installed but not loaded, is a fail naming the label", () => {
-  const notInstalled = buildVerifyReport(good({ plists: { generated: G, installed: [G[0]], loaded: [G[0]], launchctlOk: true } }));
-  assert.deepEqual(notInstalled.mismatches, ["plists"]);
-  assert.match(byName(notInstalled).plists.msg, /not installed: ai\.maestro\.ivy-session/);
-  const notLoaded = buildVerifyReport(good({ plists: { generated: G, installed: G, loaded: [G[0]], launchctlOk: true } }));
-  assert.match(byName(notLoaded).plists.msg, /not loaded: ai\.maestro\.ivy-session/);
-  const noLaunchctl = buildVerifyReport(good({ plists: { generated: G, installed: G, loaded: [], launchctlOk: false } }));
-  assert.equal(noLaunchctl.ok, true, "cannot prove loaded without launchctl → warn");
-  assert.equal(byName(buildVerifyReport(good({ plists: { generated: [], installed: [], loaded: [] } }))).plists.level, "warn");
-});
-
-test("global-setup markers: any missing marker is a fail; an unconfigured identity is a warn", () => {
-  const r = buildVerifyReport(good({ markers: { ...allMarkers, mcp: false, skills: false } }));
-  assert.deepEqual(r.mismatches, ["global-setup"]);
-  assert.match(byName(r)["global-setup"].msg, /cohort MCP server/);
-  assert.match(byName(r)["global-setup"].msg, /maestro-main-session\/SKILL\.md/);
-  const unconf = buildVerifyReport(good({ markers: { ...allMarkers, identityConfigured: false, identity: false } }));
-  assert.equal(unconf.ok, true);
-  assert.equal(unconf.rows.filter((x) => x.name === "global-setup")[0].level, "warn");
-  const noId = buildVerifyReport(good({ markers: { ...allMarkers, identity: false } }));
-  assert.equal(noId.ok, false);
-});
-
-test("parseDaemonHealth reads sdk_version / updated / pid from the flat YAML the daemon writes", () => {
-  const y = "updated: 2026-09-08T12:00:00.000Z\nuptime_s: 40\nsdk_version: 2.12.0\npid: 4242\ndispatcher:\n  {\n  }\n";
-  assert.deepEqual(parseDaemonHealth(y), { version: "2.12.0", updatedAt: "2026-09-08T12:00:00.000Z", pid: 4242 });
-  assert.deepEqual(parseDaemonHealth(""), { version: "", updatedAt: "", pid: null });
-});
-
-// ---------------------------------------------------------------------------
-// collectVerifyInputs — the edge over a temp HOME + agent dir
-// ---------------------------------------------------------------------------
-
-function seat({ version = "2.12.0", withSetup = true } = {}) {
-  const root = mkdtempSync(join(tmpdir(), "verify-"));
-  const cwd = join(root, "ivy-ai");
-  const home = join(root, "home");
-  const claudeDir = join(home, ".claude");
-  mkdirSync(join(cwd, "config"), { recursive: true });
-  mkdirSync(join(cwd, "node_modules", "@cohortapp", "agent-sdk"), { recursive: true });
-  mkdirSync(join(cwd, ".maestro"), { recursive: true });
-  mkdirSync(join(cwd, "state", "dashboards"), { recursive: true });
-  mkdirSync(join(cwd, "scripts", "local-triggers", "plists"), { recursive: true });
-  mkdirSync(join(home, "Library", "LaunchAgents"), { recursive: true });
-  mkdirSync(join(claudeDir, "skills", "maestro-main-session"), { recursive: true });
-  writeFileSync(join(cwd, "config", "agent.json"), JSON.stringify({ firstName: "Ivy", fullName: "Ivy Tester" }));
-  writeFileSync(join(cwd, "package.json"), JSON.stringify({ name: "ivy-ai" }));
-  writeFileSync(join(cwd, "node_modules", "@cohortapp", "agent-sdk", "package.json"), JSON.stringify({ name: "@cohortapp/agent-sdk", version }));
-  writeFileSync(join(cwd, ".maestro", "shipped-manifest.json"), JSON.stringify({ version: 1, sdkVersion: version, files: [] }));
-  writeFileSync(join(cwd, "state", "dashboards", "daemon-health.yaml"), `updated: 2026-09-08T12:00:00Z\nsdk_version: ${version}\n`);
-  for (const l of G) {
-    writeFileSync(join(cwd, "scripts", "local-triggers", "plists", `${l}.plist`), `<plist>${l}</plist>`);
-    writeFileSync(join(home, "Library", "LaunchAgents", `${l}.plist`), `<plist>${l}</plist>`);
-  }
-  if (withSetup) {
-    writeFileSync(join(claudeDir, "CLAUDE.md"), `${CLAUDE_MD_BEGIN}\nx\n${CLAUDE_MD_END}\n${IDENTITY_BEGIN}\nid\n${IDENTITY_END}\n`);
-    writeFileSync(join(home, ".claude.json"), JSON.stringify({ mcpServers: { cohort: { command: "cohort-mcp", args: [], env: { COHORT_AGENT_ROOT: cwd } } } }));
-    writeFileSync(join(claudeDir, "settings.json"), JSON.stringify(mergeSessionSettings({}, { agentRoot: cwd }).settings));
-    writeFileSync(join(claudeDir, "maestro-agent.json"), JSON.stringify({ agentRepo: cwd }));
-    writeFileSync(join(claudeDir, "skills", "maestro-main-session", "SKILL.md"), "# skill");
-  }
-  return { root, cwd, home };
-}
-
-function execFor({ globalVersion = "2.12.0", loaded = G } = {}) {
-  const calls = [];
-  const exec = (cmd, args) => {
-    calls.push([cmd, ...args]);
-    if (cmd === "npm") return { status: 0, stdout: JSON.stringify({ dependencies: { "@cohortapp/agent-sdk": { version: globalVersion } } }), stderr: "" };
-    if (cmd === "launchctl") return { status: 0, stdout: `PID\tStatus\tLabel\n${loaded.map((l) => `1\t0\t${l}`).join("\n")}\n`, stderr: "" };
-    return { status: 1, stdout: "", stderr: "" };
-  };
-  exec.calls = calls;
-  return exec;
-}
-
-test("collectVerifyInputs reads a fully-set-up seat as all-ok; runVerify agrees", () => {
-  const s = seat();
-  try {
-    const exec = execFor();
-    const inputs = collectVerifyInputs({ cwd: s.cwd, home: s.home, env: {}, exec, expected: "2.12.0" });
-    assert.equal(inputs.globalVersion, "2.12.0");
-    assert.equal(inputs.localVersion, "2.12.0");
-    assert.equal(inputs.manifestVersion, "2.12.0");
-    assert.equal(inputs.daemon.version, "2.12.0");
-    assert.deepEqual(inputs.plists.generated.sort(), G);
-    assert.deepEqual(inputs.markers, { identityConfigured: true, identity: true, collective: true, mcp: true, settings: true, pointer: true, skills: true });
-    const r = runVerify({ cwd: s.cwd, home: s.home, env: {}, exec, expected: "2.12.0" });
-    assert.equal(r.ok, true, JSON.stringify(r.rows));
-    assert.ok(exec.calls.some((c) => c[0] === "npm" && c[1] === "ls" && c[2] === "-g"));
-  } finally { rmSync(s.root, { recursive: true, force: true }); }
-});
-
-test("collectVerifyInputs: a seat with no global-setup and a stale global bin reports both mismatches; MAESTRO_SKIP_GLOBAL_INSTALL skips the npm read", () => {
-  const s = seat({ withSetup: false });
-  try {
-    const exec = execFor({ globalVersion: "2.11.17", loaded: [G[0]] });
-    const r = runVerify({ cwd: s.cwd, home: s.home, env: {}, exec, expected: "2.12.0" });
-    assert.equal(r.ok, false);
-    assert.deepEqual(r.mismatches.sort(), ["global", "global-setup", "plists"]);
-    const skipExec = execFor();
-    const inputs = collectVerifyInputs({ cwd: s.cwd, home: s.home, env: { MAESTRO_SKIP_GLOBAL_INSTALL: "1" }, exec: skipExec, expected: "2.12.0" });
-    assert.equal(inputs.skipGlobal, true);
-    assert.ok(!skipExec.calls.some((c) => c[0] === "npm"), "no npm call under the skip flag");
-  } finally { rmSync(s.root, { recursive: true, force: true }); }
-});