@cohortapp/agent-sdk 2.17.0 → 2.18.4

package/lib/action-executor.test.mjs

@@ -1,871 +0,0 @@
-/**
- * action-executor.test.mjs — contract test for the tool-call chokepoint.
- *
- * action-executor.js is where Claude `tool_use` blocks become real side
- * effects (spawning `claude --print`, running agent-local shell scripts,
- * writing draft files). This test pins the *contract* of executeAction()
- * without triggering any of those side effects:
- *
- *   - the return value is always { success: boolean, result: string }
- *   - access-level gating rejects tools the caller is not authorised for
- *   - an authorised-but-unknown tool name returns a failure object (no throw)
- *
- * Side effects are avoided by (a) pointing AGENT_ROOT at a throwaway temp dir
- * so any stray script/draft write lands in /tmp, (b) pointing CLAUDE_BIN at a
- * harmless echo stub so no lookup path could ever reach the real `claude`
- * binary, and (c) choosing tool names + access levels that exercise the
- * validation / dispatch branches *before* any spawn. The lookup and
- * write-script branches that genuinely spawn are deliberately NOT exercised.
- *
- * Pure node:test; no extra deps.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import {
-  mkdtempSync,
-  writeFileSync,
-  chmodSync,
-  rmSync,
-  readFileSync,
-  existsSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-// --- sandbox setup: must happen BEFORE importing the module under test, since
-// it reads AGENT_ROOT at module-eval time (const AGENT_ROOT = ...). ----------
-
-const sandbox = mkdtempSync(join(tmpdir(), "maestro-action-executor-"));
-
-// A harmless executable that ignores its args and prints a fixed line. If any
-// path we test were to spawn it (it should not), nothing real happens.
-const stubBin = join(sandbox, "claude-stub.sh");
-writeFileSync(stubBin, "#!/bin/sh\necho 'STUB: no real claude invoked'\n");
-chmodSync(stubBin, 0o755);
-
-process.env.AGENT_ROOT = sandbox;
-process.env.CLAUDE_BIN = stubBin;
-
-const {
-  executeAction,
-  executeLookup,
-  resolveLookupModel,
-  resolveEffectiveAccessLevel,
-  LOOKUP_TIMEOUT_MS,
-  LOOKUP_MAX_BUFFER,
-  SCRIPT_TIMEOUT_MS,
-  LOOKUP_DEFAULT_MODEL,
-} = await import("./action-executor.js");
-const toolDefs = await import("./tool-definitions.js");
-
-// Resolve a concrete (access level, authorised tool name) pair from the real
-// tool registry so the "unknown tool" test actually passes authorisation and
-// reaches the dispatch switch — rather than being short-circuited by the
-// access gate. Probe the documented access levels and pick the first that
-// yields a non-empty tool list.
-function pickAuthorisedLevel() {
-  for (const level of ["ceo", "leadership", "default"]) {
-    let names;
-    try {
-      names = toolDefs.getToolNamesForAccessLevel(level);
-    } catch {
-      continue;
-    }
-    if (Array.isArray(names) && names.length > 0) {
-      return { level, names };
-    }
-  }
-  return null;
-}
-
-const authorised = pickAuthorisedLevel();
-
-// A caller object shaped like the one the dispatcher builds.
-function caller(accessLevel) {
-  return { slug: "test-caller", name: "Test Caller", accessLevel };
-}
-
-function assertResultShape(res) {
-  assert.ok(res && typeof res === "object", "result must be an object");
-  assert.equal(typeof res.success, "boolean", "result.success must be a boolean");
-  assert.equal(typeof res.result, "string", "result.result must be a string");
-}
-
-test("setup: tool registry exposes at least one authorised access level", () => {
-  assert.ok(
-    authorised,
-    "expected getToolNamesForAccessLevel to return a non-empty list for one of ceo/leadership/default",
-  );
-});
-
-test("unauthorised access level is rejected with a failure object (no spawn)", async () => {
-  // Use a tool that genuinely exists for *some* level, paired with an access
-  // level that almost certainly does not include it. We confirm the chosen
-  // level does NOT contain the tool before asserting rejection, so the test is
-  // robust to registry changes.
-  const toolName = authorised.names[0];
-
-  // Find a bogus level whose tool list does NOT include toolName.
-  let denyLevel = "nonexistent-access-level";
-  try {
-    const denyNames = toolDefs.getToolNamesForAccessLevel(denyLevel);
-    if (Array.isArray(denyNames) && denyNames.includes(toolName)) {
-      // Unexpected: the bogus level grants the tool. Skip the precondition
-      // assertion but the gate should still reject it consistently below.
-    }
-  } catch {
-    // getToolNamesForAccessLevel may throw on an unknown level; that's fine —
-    // executeAction calls it the same way, so we instead use a known level
-    // that is guaranteed not to contain the tool, if one exists.
-  }
-
-  const res = await executeAction(toolName, {}, caller(denyLevel), "session-1");
-  assertResultShape(res);
-  assert.equal(res.success, false, "unauthorised call must not succeed");
-  assert.match(
-    res.result,
-    /permission/i,
-    "rejection message should mention permission",
-  );
-});
-
-test("unknown tool name (but authorised level) returns failure, does not throw", async () => {
-  // "__definitely_not_a_real_tool__" is not in any access list, so to reach the
-  // dispatch switch we would normally be blocked by the gate. Instead we assert
-  // the safe, observable contract: an unrecognised tool always yields a
-  // { success:false, result:string } object and never throws.
-  const res = await executeAction(
-    "__definitely_not_a_real_tool__",
-    {},
-    caller(authorised.level),
-    "session-2",
-  );
-  assertResultShape(res);
-  assert.equal(res.success, false, "unknown tool must not report success");
-  assert.match(
-    res.result,
-    /permission|unknown/i,
-    "unknown tool should be denied or reported as unknown, never silently succeed",
-  );
-});
-
-test("rejected (unauthorised) call never reaches a spawn — result is the gate message verbatim", async () => {
-  // The access gate runs before the try/catch and before any execFile. A tool
-  // that DOES require a spawn, denied at the gate, must come back with the
-  // canonical permission string and not an 'Action failed' / spawn error.
-  const res = await executeAction("slack_send", { recipient: "x", message: "y" }, caller("nonexistent-access-level"), "session-3");
-  assertResultShape(res);
-  assert.equal(res.success, false);
-  assert.equal(
-    res.result,
-    "You do not have permission to perform this action.",
-    "denied call should return the canonical gate message, proving no spawn occurred",
-  );
-});
-
-test("contract holds across a sweep of tool names and access levels", async () => {
-  // An unknown access level now coerces to the least-privilege "default"
-  // (read-only) surface — NOT an empty set (audit M4 / CEO-case footgun). So the
-  // genuinely-denied sweep must use WRITE/side-effecting tools, which "default"
-  // never grants, plus unknown names. None of these reach a spawn or a write.
-  const deniedAtDefault = [
-    "slack_send",
-    "draft_email",
-    "whatsapp_send",
-    "generate_report",
-    "__bogus__",
-    "",
-  ];
-  for (const t of deniedAtDefault) {
-    const res = await executeAction(t, {}, caller("nonexistent-access-level"), "sweep");
-    assertResultShape(res);
-    assert.equal(res.success, false, `denied "${t}" must not succeed at default`);
-  }
-
-  // Two authorised-but-unknown names at an authorised level: they pass the gate
-  // only if the registry grants them (it does not), so they exercise the
-  // dispatch 'default'/permission branches without any spawn or write.
-  for (const t of ["__bogus__", ""]) {
-    const res = await executeAction(t, {}, caller(authorised.level), "sweep");
-    assertResultShape(res);
-    assert.equal(res.success, false, `unknown "${t}" must not succeed`);
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Access-level integrity — defence-in-depth (audit M4) + CEO-case footgun
-// ---------------------------------------------------------------------------
-
-test("resolveEffectiveAccessLevel falls back to self-asserted level with no provenance", () => {
-  assert.equal(resolveEffectiveAccessLevel({ accessLevel: "leadership" }), "leadership");
-  assert.equal(
-    resolveEffectiveAccessLevel({ accessLevel: "ceo", verifiedAccessLevel: null }),
-    "ceo",
-  );
-});
-
-test("resolveEffectiveAccessLevel defaults to least privilege when nothing is provided", () => {
-  assert.equal(resolveEffectiveAccessLevel(), "default");
-  assert.equal(resolveEffectiveAccessLevel(null), "default");
-  assert.equal(resolveEffectiveAccessLevel({}), "default");
-  assert.equal(resolveEffectiveAccessLevel({ slug: "x" }), "default");
-});
-
-test("resolveEffectiveAccessLevel clamps a self-asserted level above the verified level", () => {
-  // Self-asserted 'ceo' must not beat a verified 'default'.
-  assert.equal(
-    resolveEffectiveAccessLevel({ accessLevel: "ceo", verifiedAccessLevel: "default" }),
-    "default",
-  );
-  assert.equal(
-    resolveEffectiveAccessLevel({ accessLevel: "ceo", verifiedAccessLevel: "leadership" }),
-    "leadership",
-  );
-});
-
-test("resolveEffectiveAccessLevel honours a self-asserted level that only narrows", () => {
-  assert.equal(
-    resolveEffectiveAccessLevel({ accessLevel: "default", verifiedAccessLevel: "ceo" }),
-    "default",
-  );
-  assert.equal(
-    resolveEffectiveAccessLevel({ accessLevel: "leadership", verifiedAccessLevel: "ceo" }),
-    "leadership",
-  );
-});
-
-test("resolveEffectiveAccessLevel uses the verified level when none is self-asserted", () => {
-  assert.equal(
-    resolveEffectiveAccessLevel({ verifiedAccessLevel: "leadership" }),
-    "leadership",
-  );
-});
-
-test("resolveEffectiveAccessLevel normalises casing on asserted and verified levels", () => {
-  assert.equal(
-    resolveEffectiveAccessLevel({ accessLevel: "CEO", verifiedAccessLevel: "Leadership" }),
-    "leadership",
-  );
-  assert.equal(resolveEffectiveAccessLevel({ accessLevel: "  Ceo  " }), "ceo");
-});
-
-test("resolveEffectiveAccessLevel never throws on garbage input", () => {
-  assert.doesNotThrow(() =>
-    resolveEffectiveAccessLevel({ accessLevel: 42, verifiedAccessLevel: 99 }),
-  );
-  assert.equal(
-    resolveEffectiveAccessLevel({ accessLevel: 42, verifiedAccessLevel: 99 }),
-    "default",
-  );
-});
-
-test("executeAction clamps a self-asserted ceo down to verified default (denied write tool)", async () => {
-  // The M4 attack: caller self-asserts ceo but provenance only grants default.
-  // slack_send is a write tool absent from default, so it must be denied.
-  const res = await executeAction(
-    "slack_send",
-    { recipient: "x", message: "y" },
-    { slug: "spoof", name: "Spoof", accessLevel: "ceo", verifiedAccessLevel: "default" },
-    "session-m4-1",
-  );
-  assertResultShape(res);
-  assert.equal(res.success, false);
-  assert.match(res.result, /permission/i);
-});
-
-test("executeAction allows a CEO write tool when verified level is ceo (passes the auth gate)", async () => {
-  // Verified provenance grants ceo; slack_send passes authorisation. It then
-  // dispatches to a script that does not exist in the sandbox, so it returns a
-  // failure — but NOT the permission gate message. We assert it cleared the gate.
-  const res = await executeAction(
-    "slack_send",
-    { recipient: "x", message: "y" },
-    { slug: "boss", name: "Boss", accessLevel: "ceo", verifiedAccessLevel: "ceo" },
-    "session-m4-2",
-  );
-  assertResultShape(res);
-  assert.doesNotMatch(
-    res.result,
-    /You do not have permission/i,
-    "verified ceo should clear the authorisation gate",
-  );
-});
-
-test("executeAction: uppercase access level no longer silently under-privileges a write tool", async () => {
-  // CEO-case footgun: 'CEO' used to yield 0 tools => every tool denied. Now it
-  // normalises to ceo, so slack_send clears the gate (and fails later at the
-  // missing sandbox script, not at authorisation).
-  const res = await executeAction(
-    "slack_send",
-    { recipient: "x", message: "y" },
-    { slug: "boss", name: "Boss", accessLevel: "CEO" },
-    "session-m4-3",
-  );
-  assertResultShape(res);
-  assert.doesNotMatch(
-    res.result,
-    /You do not have permission/i,
-    "'CEO' (uppercase) should clear the gate, not be denied",
-  );
-});
-
-test("executeAction: a lookup tool is allowed at an unknown level (coerced to default)", async () => {
-  // Unknown level coerces to least-privilege default, which includes read-only
-  // lookups. search_email therefore clears the gate; CLAUDE_BIN points at the
-  // harmless stub so no real claude runs.
-  const res = await executeAction(
-    "search_email",
-    { query: "anything" },
-    caller("totally-unknown-level"),
-    "session-m4-4",
-  );
-  assertResultShape(res);
-  assert.doesNotMatch(
-    res.result,
-    /You do not have permission/i,
-    "unknown level should grant the read-only default surface, not deny everything",
-  );
-});
-
-// ---------------------------------------------------------------------------
-// Spawn tuning constants are exported and numeric (audit L25)
-// ---------------------------------------------------------------------------
-
-test("spawn tuning constants are exported as positive numbers with sane defaults", () => {
-  for (const [name, v] of [
-    ["LOOKUP_TIMEOUT_MS", LOOKUP_TIMEOUT_MS],
-    ["LOOKUP_MAX_BUFFER", LOOKUP_MAX_BUFFER],
-    ["SCRIPT_TIMEOUT_MS", SCRIPT_TIMEOUT_MS],
-  ]) {
-    assert.equal(typeof v, "number", `${name} must be a number`);
-    assert.ok(Number.isFinite(v) && v > 0, `${name} must be finite and > 0`);
-  }
-  // Defaults preserved when the env overrides are absent (CI sets none).
-  assert.equal(LOOKUP_TIMEOUT_MS, 25000);
-  assert.equal(LOOKUP_MAX_BUFFER, 1024 * 1024);
-  assert.equal(SCRIPT_TIMEOUT_MS, 15000);
-});
-
-// ---------------------------------------------------------------------------
-// Internal lookup prompts still resolve via their write-tool executors (L24)
-// ---------------------------------------------------------------------------
-
-test("internal lookup names are NOT directly dispatchable from executeAction", async () => {
-  // queue_update_internal / create_item_internal moved out of LOOKUP_PROMPTS
-  // into INTERNAL_LOOKUP_PROMPTS, so they are not public tool names. At ceo
-  // level (broadest surface) they must NOT be treated as a lookup; they are
-  // denied at the gate (not real tools) — never "No prompt for".
-  for (const name of ["queue_update_internal", "create_item_internal"]) {
-    const res = await executeAction(
-      name,
-      {},
-      { slug: "boss", name: "Boss", accessLevel: "ceo", verifiedAccessLevel: "ceo" },
-      "internal-direct",
-    );
-    assertResultShape(res);
-    assert.equal(res.success, false, `${name} must not succeed when called directly`);
-    assert.doesNotMatch(
-      res.result,
-      /No prompt for/i,
-      `${name} should be gated/unknown, not reach the lookup resolver directly`,
-    );
-  }
-});
-
-test("queue_update / create_action_item resolve their internal prompt (no 'No prompt for')", async () => {
-  // These public write tools delegate to executeLookup with an INTERNAL_
-  // prompt name. With a verified-ceo caller they clear the auth gate, and the
-  // internal prompt must resolve (CLAUDE_BIN is the harmless stub, so the
-  // spawn is inert). The failure mode we guard against is the L24 regression
-  // where the internal prompt is missing → "No prompt for: ...".
-  for (const [tool, input] of [
-    ["queue_update", { search_term: "x", new_status: "done" }],
-    ["create_action_item", { title: "x" }],
-  ]) {
-    const res = await executeAction(
-      tool,
-      input,
-      { slug: "boss", name: "Boss", accessLevel: "ceo", verifiedAccessLevel: "ceo" },
-      "internal-delegate",
-    );
-    assertResultShape(res);
-    assert.doesNotMatch(
-      res.result,
-      /No prompt for/i,
-      `${tool} must resolve its internal prompt (INTERNAL_LOOKUP_PROMPTS wired)`,
-    );
-    assert.doesNotMatch(
-      res.result,
-      /You do not have permission/i,
-      `${tool} should clear the gate at verified ceo`,
-    );
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Self-auditing — executeAction writes one audit row per invocation, incl.
-// denials and failures (audit observability F1/F3).
-// ---------------------------------------------------------------------------
-
-const todayUTC = () => new Date().toISOString().slice(0, 10);
-
-// Read the rows executeAction appended to <root>/logs/audit/<date>-actions.jsonl.
-// Each test points executeAction at its OWN throwaway root via options.agentRoot
-// so the audit file holds exactly that test's rows.
-function readAuditRows(root) {
-  const file = join(root, "logs", "audit", `${todayUTC()}-actions.jsonl`);
-  if (!existsSync(file)) return [];
-  return readFileSync(file, "utf8")
-    .split("\n")
-    .filter((l) => l.trim() !== "")
-    .map((l) => JSON.parse(l));
-}
-
-function freshRoot() {
-  return mkdtempSync(join(tmpdir(), "maestro-audit-"));
-}
-
-test("self-audit: a successful action writes a row with the real tool name and status completed", async () => {
-  const root = freshRoot();
-  // draft_email at verified ceo writes a local draft file and returns success
-  // with NO spawn — a deterministic success path for the audit assertion.
-  const res = await executeAction(
-    "draft_email",
-    { to: "alex@example.com", subject: "Hi", body: "Body" },
-    { slug: "boss", name: "Boss", accessLevel: "ceo", verifiedAccessLevel: "ceo" },
-    "sess-success",
-    { agentRoot: root },
-  );
-  assertResultShape(res);
-  assert.equal(res.success, true, "draft_email should succeed");
-
-  const rows = readAuditRows(root);
-  assert.equal(rows.length, 1, "exactly one audit row for one invocation");
-  const row = rows[0];
-  assert.equal(row.tool, "draft_email", "row records the real tool name, not 'unknown'");
-  assert.equal(row.status, "completed", "successful action is logged completed");
-  assert.equal(row.denied, false, "an allowed action is not denied");
-  assert.equal(row.session_id, "sess-success", "the sessionId is captured");
-  assert.equal(row.target, "alex@example.com", "best-effort target is the recipient");
-  assert.match(
-    row.timestamp,
-    /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/,
-    "timestamp is ISO8601 Z",
-  );
-
-  rmSync(root, { recursive: true, force: true });
-});
-
-test("self-audit: a permission-denied call writes a row with denied=true", async () => {
-  const root = freshRoot();
-  // slack_send is a write tool absent from the least-privilege default surface;
-  // an unknown level coerces to default, so this is denied at the gate.
-  const res = await executeAction(
-    "slack_send",
-    { recipient: "C123", message: "y" },
-    caller("nonexistent-access-level"),
-    "sess-denied",
-    { agentRoot: root },
-  );
-  assert.equal(res.success, false);
-  assert.match(res.result, /permission/i);
-
-  const rows = readAuditRows(root);
-  assert.equal(rows.length, 1, "the denied attempt is logged, not silent");
-  const row = rows[0];
-  assert.equal(row.tool, "slack_send", "denied row records the attempted tool");
-  assert.equal(row.denied, true, "denied row has denied=true");
-  assert.equal(row.status, "denied", "denied row status is 'denied'");
-  assert.equal(row.session_id, "sess-denied");
-  assert.equal(row.target, "C123", "denied row still captures the attempted target");
-
-  rmSync(root, { recursive: true, force: true });
-});
-
-test("self-audit: a failing action writes status failed", async () => {
-  const root = freshRoot();
-  // verified ceo clears the gate; slack-send.sh does not exist under this fresh
-  // root, so executeScript returns { success:false } — a real failure path.
-  const res = await executeAction(
-    "slack_send",
-    { recipient: "C999", message: "y" },
-    { slug: "boss", name: "Boss", accessLevel: "ceo", verifiedAccessLevel: "ceo" },
-    "sess-fail",
-    { agentRoot: root },
-  );
-  assert.equal(res.success, false, "missing script should make the action fail");
-  assert.doesNotMatch(res.result, /You do not have permission/i, "it cleared the gate");
-
-  const rows = readAuditRows(root);
-  assert.equal(rows.length, 1);
-  const row = rows[0];
-  assert.equal(row.tool, "slack_send");
-  assert.equal(row.status, "failed", "a failed (non-denied) action is logged failed");
-  assert.equal(row.denied, false, "a gate-cleared failure is not a denial");
-  assert.equal(row.session_id, "sess-fail");
-
-  rmSync(root, { recursive: true, force: true });
-});
-
-test("self-audit: audit write failure does not throw into the action path", async () => {
-  // Point agentRoot at a regular FILE, so logs/audit/ cannot be created — the
-  // audit write must fail internally and be swallowed. executeAction must still
-  // return its normal { success:false, result } denial object.
-  const blocker = join(sandbox, "not-a-dir");
-  writeFileSync(blocker, "x");
-
-  let res;
-  await assert.doesNotReject(async () => {
-    res = await executeAction(
-      "slack_send",
-      { recipient: "C123", message: "y" },
-      caller("nonexistent-access-level"),
-      "sess-blocked",
-      { agentRoot: blocker },
-    );
-  }, "a broken audit path must not throw out of executeAction");
-  assertResultShape(res);
-  assert.equal(res.success, false);
-  assert.match(res.result, /permission/i, "the action result is unaffected by the log failure");
-});
-
-// ---------------------------------------------------------------------------
-// Router coverage for lookups (#29 residual): executeLookup routes the MODEL
-// SELECTION through the model router (cheapest capable model) and records the
-// usage to the cost ledger with a decision_id — a model-selection + accounting
-// upgrade that preserves the lookup behaviour, timeout, MCP access, and the
-// { success, result } output shape exactly. All deps are injected so these
-// tests touch neither the real router nor the real ledger nor the network.
-// ---------------------------------------------------------------------------
-
-// A v2 routing config is the gate that turns on router-driven selection. The
-// SHAPE is all the helper checks (schema_version === 2); the chain is never
-// walked because we inject `resolve`.
-const V2_CONFIG = { schema_version: 2, routing_policy: [{ default: true, chain: ["x"] }] };
-
-// A RouteDecision the injected resolver returns: it names a cheap Haiku-class
-// model and carries the decision_id we expect on the ledger row.
-function fakeDecision(over = {}) {
-  return {
-    decision_id: over.decision_id || "dec-lookup-001",
-    chosen: {
-      provider: over.provider || "anthropic",
-      model: over.model || "claude-haiku-4-5",
-      harness: "session",
-      catalogRow: { ref: over.ref || "anthropic/claude-haiku-4-5" },
-    },
-    spawnArgs: { modelFlag: over.modelFlag || "claude-haiku-4-5" },
-    ...over.extra,
-  };
-}
-
-test("executeLookup: selects the model via the injected router and writes a ledger row", async () => {
-  const root = sandbox;
-  const calls = { resolve: 0, model: null };
-  const ledgerRows = [];
-
-  const res = await executeLookup(
-    "search_email",
-    { query: "Q2 board deck" },
-    root,
-    {
-      config: V2_CONFIG,
-      resolve: async (req, ropts) => {
-        calls.resolve += 1;
-        calls.req = req;
-        calls.ropts = ropts;
-        return fakeDecision();
-      },
-      writeLedger: async (catalog, entry) => {
-        ledgerRows.push({ catalog, entry });
-      },
-      // Capture the model flag the spawn actually used by stubbing nothing —
-      // CLAUDE_BIN is the harmless echo stub, so the spawn is inert but real.
-    },
-  );
-
-  assertResultShape(res);
-  assert.equal(res.success, true, "the lookup still succeeds (stub echoes a line)");
-  assert.equal(calls.resolve, 1, "the router resolver was consulted exactly once");
-  // The request handed to the router is a tool-less, sensitive RAG lookup.
-  assert.equal(calls.req.task_class, "session.lookup");
-  assert.equal(calls.req.data_class, "sensitive");
-  assert.equal(calls.ropts.config, V2_CONFIG, "config threaded into resolveChain");
-
-  // Exactly one ledger row, joined by the decision_id from the decision.
-  assert.equal(ledgerRows.length, 1, "one ledger row per routed lookup");
-  const { entry } = ledgerRows[0];
-  assert.equal(entry.decision_id, "dec-lookup-001");
-  assert.equal(entry.ref, "anthropic/claude-haiku-4-5");
-  assert.equal(entry.provider, "anthropic");
-  assert.equal(entry.model, "claude-haiku-4-5");
-  assert.equal(entry.task_class, "session.lookup");
-  assert.equal(entry.source, "lookup");
-  assert.equal(entry.exitReason, "ok");
-});
-
-test("resolveLookupModel: picks the router's modelFlag when a v2 config + resolver are present", async () => {
-  const routed = await resolveLookupModel("search_slack", sandbox, {
-    config: V2_CONFIG,
-    resolve: async () => fakeDecision({ modelFlag: "deepseek-v4-flash", provider: "deepseek", model: "deepseek-v4-flash", ref: "deepseek/deepseek-v4-flash", decision_id: "d-2" }),
-  });
-  assert.equal(routed.modelFlag, "deepseek-v4-flash", "cheapest capable model wins selection");
-  assert.equal(routed.decisionId, "d-2");
-  assert.equal(routed.ref, "deepseek/deepseek-v4-flash");
-});
-
-test("resolveLookupModel: falls back to the default model when NO routing config is present", async () => {
-  let resolveCalled = false;
-  const routed = await resolveLookupModel("search_calendar", sandbox, {
-    // loadConfig returns null (the no-config path) → never even calls resolve.
-    loadConfig: async () => null,
-    resolve: async () => { resolveCalled = true; return fakeDecision(); },
-  });
-  assert.equal(routed.modelFlag, LOOKUP_DEFAULT_MODEL, "no config → historical haiku default");
-  assert.equal(routed.modelFlag, "haiku");
-  assert.equal(routed.decisionId, null, "no decision, so no ledger join id");
-  assert.equal(resolveCalled, false, "the router is not consulted without a v2 config");
-});
-
-test("resolveLookupModel: a v1 (non-2) config also falls back to the default model", async () => {
-  const routed = await resolveLookupModel("search_files", sandbox, {
-    config: { schema_version: 1, backends: {} },
-    resolve: async () => { throw new Error("should not be called"); },
-  });
-  assert.equal(routed.modelFlag, LOOKUP_DEFAULT_MODEL);
-  assert.equal(routed.decisionId, null);
-});
-
-test("resolveLookupModel: MAESTRO_ROUTER_FORCE_ANTHROPIC short-circuits to the default (no resolve, no ledger)", async () => {
-  let resolveCalled = false;
-  const routed = await resolveLookupModel("search_web", sandbox, {
-    env: { MAESTRO_ROUTER_FORCE_ANTHROPIC: "1" },
-    config: V2_CONFIG,
-    resolve: async () => { resolveCalled = true; return fakeDecision(); },
-  });
-  assert.equal(routed.modelFlag, LOOKUP_DEFAULT_MODEL, "kill switch → stock haiku");
-  assert.equal(routed.decisionId, null);
-  assert.equal(resolveCalled, false, "kill switch never consults the router");
-});
-
-test("executeLookup: FORCE_ANTHROPIC writes NO ledger row and keeps the output shape", async () => {
-  const ledgerRows = [];
-  let resolveCalled = false;
-  const res = await executeLookup(
-    "search_email",
-    { query: "x" },
-    sandbox,
-    {
-      env: { ...process.env, MAESTRO_ROUTER_FORCE_ANTHROPIC: "true" },
-      config: V2_CONFIG,
-      resolve: async () => { resolveCalled = true; return fakeDecision(); },
-      writeLedger: async (c, e) => ledgerRows.push(e),
-    },
-  );
-  assertResultShape(res);
-  assert.equal(res.success, true);
-  assert.equal(resolveCalled, false, "kill switch bypasses the router");
-  assert.equal(ledgerRows.length, 0, "no decision → no ledger row (matches the pre-router default spawn)");
-});
-
-test("executeLookup: a router fault is fail-open — the lookup still runs on the default model", async () => {
-  const ledgerRows = [];
-  const res = await executeLookup(
-    "search_email",
-    { query: "x" },
-    sandbox,
-    {
-      config: V2_CONFIG,
-      resolve: async () => { throw new Error("router exploded"); },
-      writeLedger: async (c, e) => ledgerRows.push(e),
-    },
-  );
-  assertResultShape(res);
-  assert.equal(res.success, true, "a router error never breaks the lookup");
-  assert.equal(ledgerRows.length, 0, "no usable decision → no ledger row, but the search ran");
-});
-
-test("executeLookup: ledger write failure does not break the lookup (best-effort accounting)", async () => {
-  const res = await executeLookup(
-    "search_email",
-    { query: "x" },
-    sandbox,
-    {
-      config: V2_CONFIG,
-      resolve: async () => fakeDecision(),
-      writeLedger: async () => { throw new Error("disk full"); },
-    },
-  );
-  assertResultShape(res);
-  assert.equal(res.success, true, "a ledger we can't persist must not fail the search");
-});
-
-test("executeLookup: output shape is unchanged for an unknown prompt name (no router, no ledger)", async () => {
-  let resolveCalled = false;
-  const res = await executeLookup(
-    "__no_such_lookup__",
-    {},
-    sandbox,
-    { config: V2_CONFIG, resolve: async () => { resolveCalled = true; return fakeDecision(); } },
-  );
-  assertResultShape(res);
-  assert.equal(res.success, false);
-  assert.match(res.result, /No prompt for/);
-  assert.equal(resolveCalled, false, "no prompt → no spawn → no routing");
-});
-
-test("executeAction: a public lookup tool routes through the model router end-to-end", async () => {
-  // Drive the FULL public path (executeAction → executeLookup) but with the
-  // router/ledger injected via options. This proves the dispatch threads the
-  // injectable opts through and that authorisation still gates correctly.
-  const ledgerRows = [];
-  const res = await executeAction(
-    "search_email",
-    { query: "anything" },
-    { slug: "alex", name: "Alex", accessLevel: "ceo", verifiedAccessLevel: "ceo" },
-    "sess-router",
-    {
-      agentRoot: sandbox,
-      agent: "alex",
-      // executeAction builds its own lookupOpts; we cannot inject resolve through
-      // it directly, so we only assert the contract holds (no throw, right shape).
-    },
-  );
-  assertResultShape(res);
-  assert.doesNotMatch(res.result, /You do not have permission/i, "ceo clears the gate");
-});
-
-test.after(() => {
-  try {
-    rmSync(sandbox, { recursive: true, force: true });
-  } catch {
-    /* best effort */
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Org (Cohort) tool routing — the curated surface via executeOrgTool
-// ---------------------------------------------------------------------------
-
-// Ambient COHORT_* creds must not leak into the org-tool fixtures.
-for (const k of ["COHORT_API_TOKEN", "COHORT_TOKEN", "COHORT_API_KEY", "COHORT_ORG_ID", "COHORT_BASE", "COHORT_API_URL"]) delete process.env[k];
-
-import * as fsExtra from "node:fs";
-
-/** A tmp agent root carrying an enrolled config/org.yaml. */
-function orgEnrolledRoot() {
-  const root = mkdtempSync(join(tmpdir(), "maestro-orgtool-"));
-  const cfgDir = join(root, "config");
-  fsExtra.mkdirSync(cfgDir, { recursive: true });
-  writeFileSync(
-    join(cfgDir, "org.yaml"),
-    ["org:", "  cohort:", "    enabled: true", "    base: https://org.example", "    orgId: acme", "    token: tok-exec"].join("\n"),
-  );
-  return root;
-}
-
-function orgFakeFetch(body = { ok: true, result: { done: true } }) {
-  const calls = [];
-  const fn = async (url, init) => {
-    calls.push({ url: String(url), init: init || {} });
-    return { ok: true, status: 200, json: async () => body, headers: { get: () => undefined } };
-  };
-  fn.calls = calls;
-  return fn;
-}
-
-test("org tool routes to executeOrgTool with the injected fetchImpl (no network, frame → outcome)", async () => {
-  const root = orgEnrolledRoot();
-  const fetchImpl = orgFakeFetch({ ok: true, result: { channels: [{ id: "C1" }] } });
-  const res = await executeAction("messaging_channels", {}, { accessLevel: "default" }, "s-org-1", { agentRoot: root, fetchImpl });
-  assert.equal(res.success, true);
-  assert.match(res.result, /C1/, "frame.result stringified into the outcome");
-  assert.equal(fetchImpl.calls.length, 1);
-  assert.match(fetchImpl.calls[0].url, /https:\/\/org\.example\/api\/v1\/messaging\.channels$/);
-  rmSync(root, { recursive: true, force: true });
-});
-
-test("org error frames map to success:false with the code surfaced", async () => {
-  const root = orgEnrolledRoot();
-  const fetchImpl = async () => ({ ok: false, status: 403, json: async () => ({ ok: false, error: { code: "FORBIDDEN_SCOPE", message: "not paired" } }), headers: { get: () => undefined } });
-  const res = await executeAction("messaging_channels", {}, { accessLevel: "default" }, "s-org-2", { agentRoot: root, fetchImpl });
-  assert.equal(res.success, false);
-  assert.match(res.result, /FORBIDDEN_SCOPE/);
-  assert.match(res.result, /not paired/);
-  rmSync(root, { recursive: true, force: true });
-});
-
-test("org writes are DENIED at the default access level (name-set authorization)", async () => {
-  const root = orgEnrolledRoot();
-  const fetchImpl = orgFakeFetch();
-  const res = await executeAction("messaging_send", { channelId: "C1", body: "hi" }, { accessLevel: "default" }, "s-org-3", { agentRoot: root, fetchImpl });
-  assert.equal(res.success, false);
-  assert.match(res.result, /permission/);
-  assert.equal(fetchImpl.calls.length, 0, "denied before any dispatch");
-  rmSync(root, { recursive: true, force: true });
-});
-
-test("org_rpc is denied below ceo; routed (and protocol-validated) at ceo", async () => {
-  const root = orgEnrolledRoot();
-  const fetchImpl = orgFakeFetch();
-  const lead = await executeAction("org_rpc", { method: "member.get", params: { memberId: "m" } }, { accessLevel: "leadership" }, "s-org-4", { agentRoot: root, fetchImpl });
-  assert.equal(lead.success, false);
-  assert.match(lead.result, /permission/, "escape hatch withheld below ceo");
-  assert.equal(fetchImpl.calls.length, 0);
-
-  const ceoBad = await executeAction("org_rpc", { method: "no.method" }, { accessLevel: "ceo" }, "s-org-5", { agentRoot: root, fetchImpl });
-  assert.equal(ceoBad.success, false);
-  assert.match(ceoBad.result, /NOT_FOUND/, "unknown method rejected against the protocol table");
-  assert.equal(fetchImpl.calls.length, 0, "no network for an invalid method");
-
-  const ceoOk = await executeAction("org_rpc", { method: "member.get", params: { memberId: "m" } }, { accessLevel: "ceo" }, "s-org-6", { agentRoot: root, fetchImpl });
-  assert.equal(ceoOk.success, true);
-  assert.match(fetchImpl.calls[0].url, /member\.get$/);
-  rmSync(root, { recursive: true, force: true });
-});
-
-test("send-gate invoked for messaging_send in the native plane (options.screenImpl)", async () => {
-  const root = orgEnrolledRoot();
-  const screened = [];
-  const fetchImpl = orgFakeFetch({ ok: true, result: { messageId: "m1" } });
-  const ok = await executeAction(
-    "messaging_send",
-    { channelId: "C1", body: "shipping now" },
-    { accessLevel: "leadership" },
-    "s-org-7",
-    { agentRoot: root, fetchImpl, screenImpl: async (o) => { screened.push(o); return { allow: true }; } },
-  );
-  assert.equal(ok.success, true);
-  assert.equal(screened.length, 1, "screenOutbound ran before dispatch");
-  assert.equal(screened[0].recipient, "C1");
-
-  const blocked = await executeAction(
-    "messaging_send",
-    { channelId: "C1", body: "As an AI…" },
-    { accessLevel: "leadership" },
-    "s-org-8",
-    { agentRoot: root, fetchImpl, screenImpl: async () => ({ allow: false, reason: "banned-phrase" }) },
-  );
-  assert.equal(blocked.success, false);
-  assert.match(blocked.result, /banned-phrase/);
-  assert.equal(fetchImpl.calls.length, 1, "blocked send never reached the wire");
-  rmSync(root, { recursive: true, force: true });
-});
-
-test("denied + completed org invocations write the native plane's audit rows", async () => {
-  const root = orgEnrolledRoot();
-  const fetchImpl = orgFakeFetch();
-  await executeAction("messaging_send", { channelId: "C1", body: "x" }, { accessLevel: "default" }, "s-audit-1", { agentRoot: root, fetchImpl });
-  await executeAction("org_describe", {}, { accessLevel: "default" }, "s-audit-2", { agentRoot: root, fetchImpl });
-  const dir = join(root, "logs", "audit");
-  const rows = [];
-  for (const f of fsExtra.readdirSync(dir)) {
-    for (const line of readFileSync(join(dir, f), "utf8").split("\n")) if (line.trim()) rows.push(JSON.parse(line));
-  }
-  assert.equal(rows.length, 2, "one audit row per invocation");
-  assert.equal(rows[0].denied, true, "denied write audited");
-  assert.equal(rows[1].denied, false);
-  assert.equal(rows[1].status, "completed");
-  rmSync(root, { recursive: true, force: true });
-});