@cohortapp/agent-sdk 2.17.0 → 2.18.4

package/lib/claude-bin.test.mjs

@@ -1,131 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync, chmodSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { isSafeExecutable, augmentedPath, daemonClaudeArgs } from "./claude-bin.mjs";
-
-function tmp() {
-  return mkdtempSync(join(tmpdir(), "claude-bin-test-"));
-}
-
-test("isSafeExecutable accepts an owner-only, non-writable regular file", () => {
-  const dir = tmp();
-  try {
-    const p = join(dir, "claude");
-    writeFileSync(p, "#!/bin/sh\n");
-    chmodSync(p, 0o755);
-    assert.equal(isSafeExecutable(p), true);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("isSafeExecutable rejects a world-writable file (swap vector)", () => {
-  const dir = tmp();
-  try {
-    const p = join(dir, "claude");
-    writeFileSync(p, "#!/bin/sh\n");
-    chmodSync(p, 0o757); // world-writable
-    assert.equal(isSafeExecutable(p), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("isSafeExecutable rejects a group-writable file", () => {
-  const dir = tmp();
-  try {
-    const p = join(dir, "claude");
-    writeFileSync(p, "#!/bin/sh\n");
-    chmodSync(p, 0o775); // group-writable
-    assert.equal(isSafeExecutable(p), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("isSafeExecutable rejects a nonexistent path without throwing", () => {
-  assert.equal(isSafeExecutable("/nope/does/not/exist/claude"), false);
-});
-
-test("isSafeExecutable rejects a directory", () => {
-  const dir = tmp();
-  try {
-    assert.equal(isSafeExecutable(dir), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("augmentedPath includes common bin locations and preserves existing PATH", () => {
-  const p = augmentedPath();
-  assert.ok(p.includes("/usr/bin"));
-  assert.ok(p.includes("/opt/homebrew/bin"));
-});
-
-test("daemonClaudeArgs returns strict-mcp-config when the agent has no .mcp.json", () => {
-  // Injected deps, so the result does not depend on the cwd the suite runs from.
-  const args = daemonClaudeArgs("/nope/agent", { existsSync: () => false, env: {} });
-  assert.deepEqual(args, ["--strict-mcp-config"]);
-});
-
-test("daemonClaudeArgs pairs --mcp-config with --strict-mcp-config so the ORG tools load", () => {
-  // The regression this guards: `--strict-mcp-config` alone means "load no MCP
-  // servers at all", which silently killed the agent's own curated org server
-  // and made rung 0 of the execution ladder unreachable.
-  const seen = [];
-  const args = daemonClaudeArgs("/agent", { existsSync: (p) => { seen.push(p); return true; }, env: {} });
-  assert.deepEqual(args, ["--mcp-config", "/agent/.mcp.json", "--strict-mcp-config"]);
-  assert.ok(seen.some((p) => String(p).endsWith("/agent/.mcp.json")));
-});
-
-test("daemonClaudeArgs falls back to $AGENT_ROOT when no root is passed", () => {
-  const args = daemonClaudeArgs(undefined, { existsSync: () => true, env: { AGENT_ROOT: "/from/env" } });
-  assert.deepEqual(args, ["--mcp-config", "/from/env/.mcp.json", "--strict-mcp-config"]);
-});
-
-test("daemonClaudeArgs: DAEMON_LOAD_MCPS=1 still means 'no flags at all'", () => {
-  assert.deepEqual(daemonClaudeArgs("/agent", { existsSync: () => true, env: { DAEMON_LOAD_MCPS: "1" } }), []);
-});
-
-test("daemonClaudeArgs: DAEMON_SKIP_ORG_MCP=1 restores the old blanket behaviour", () => {
-  assert.deepEqual(
-    daemonClaudeArgs("/agent", { existsSync: () => true, env: { DAEMON_SKIP_ORG_MCP: "1" } }),
-    ["--strict-mcp-config"],
-  );
-});
-
-test("daemonClaudeArgs: --bare stays first, ahead of the mcp flags", () => {
-  assert.deepEqual(
-    daemonClaudeArgs("/agent", { existsSync: () => true, env: { DAEMON_BARE_MODE: "1" } }),
-    ["--bare", "--mcp-config", "/agent/.mcp.json", "--strict-mcp-config"],
-  );
-});
-
-test("daemonClaudeArgs never throws on a bad root (a daemon must still spawn)", () => {
-  const args = daemonClaudeArgs("/agent", { existsSync: () => { throw new Error("EACCES"); }, env: {} });
-  assert.deepEqual(args, ["--strict-mcp-config"]);
-});
-
-// ---------------------------------------------------------------------------
-// MCP by source — bare for tool-free spawns (classifier / responder)
-// ---------------------------------------------------------------------------
-
-test("daemonClaudeArgs: classifier + responder are BARE (no org MCP re-paid)", () => {
-  for (const source of ["classifier", "responder"]) {
-    const args = daemonClaudeArgs("/agent", { existsSync: () => true, env: {}, source });
-    assert.ok(args.includes("--strict-mcp-config"), `${source} keeps strict-mcp-config`);
-    assert.ok(!args.includes("--mcp-config"), `${source} must NOT load the org MCP`);
-  }
-});
-
-test("daemonClaudeArgs: a full work session (no source) still loads the org MCP", () => {
-  const args = daemonClaudeArgs("/agent", { existsSync: () => true, env: {} });
-  assert.ok(args.includes("--mcp-config"), "dispatcher/cadence session keeps full org tools");
-});
-
-test("daemonClaudeArgs: DAEMON_<SOURCE>_MCP=full overrides bare for that source", () => {
-  const args = daemonClaudeArgs("/agent", { existsSync: () => true, env: { DAEMON_CLASSIFIER_MCP: "full" }, source: "classifier" });
-  assert.ok(args.includes("--mcp-config"), "explicit override restores the org MCP for the classifier");
-});

package/lib/cli/board.test.mjs

@@ -1,227 +0,0 @@
-/**
- * board.test.mjs — `maestro board mine|track|claim|complete`.
- * Run: node --test lib/cli/board.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { spawnSync } from "node:child_process";
-import { join } from "node:path";
-
-import { parseBoardArgs, findInboxItemFile, buildTrackParams, runBoard, formatMine, usage } from "./board.mjs";
-
-const CFG = { org: { cohort: { enabled: true, base: "https://org.example", orgId: "acme", token: "nlk_secret" } } };
-
-test("parseBoardArgs: subcommands, flags, errors", () => {
-  assert.deepEqual(parseBoardArgs(["mine"]).sub, "mine");
-  assert.equal(parseBoardArgs(["mine", "--json"]).json, true);
-  const t = parseBoardArgs(["track", "cohort-m1", "--stage", "accepted", "--title", "Build the deck", "--why", "asked in DM"]);
-  assert.equal(t.sub, "track");
-  assert.equal(t.id, "cohort-m1");
-  assert.equal(t.stage, "accepted");
-  assert.equal(t.title, "Build the deck");
-  assert.equal(t.why, "asked in DM");
-  assert.equal(parseBoardArgs(["track", "cohort-m1", "--stage=done"]).stage, "done");
-  assert.equal(parseBoardArgs(["claim", "item_1"]).id, "item_1");
-  const c = parseBoardArgs(["complete", "item_1", "--note", "shipped"]);
-  assert.equal(c.sub, "complete");
-  assert.equal(c.note, "shipped");
-  assert.equal(parseBoardArgs([]).help, true);
-  assert.equal(parseBoardArgs(["--help"]).help, true);
-  assert.match(parseBoardArgs(["track"]).error, /inbox-id/);
-  assert.match(parseBoardArgs(["track", "x"]).error, /--stage/);
-  assert.match(parseBoardArgs(["track", "x", "--stage", "later"]).error, /accepted\|working\|blocked\|review\|done/);
-  assert.match(parseBoardArgs(["claim"]).error, /itemId/);
-  assert.match(parseBoardArgs(["frobnicate"]).error, /unknown/i);
-});
-
-test("findInboxItemFile: prefers live .yaml, then .dispatched, then .processed; null when absent", () => {
-  const files = ["2026-09-08T10-00-00-cohort-m1.yaml.processed", "2026-09-08T10-00-00-cohort-m1.yaml.dispatched", "2026-09-08T10-00-00-cohort-m2.yaml"];
-  assert.equal(findInboxItemFile(files, "cohort-m1"), "2026-09-08T10-00-00-cohort-m1.yaml.dispatched");
-  assert.equal(findInboxItemFile(files, "cohort-m2"), "2026-09-08T10-00-00-cohort-m2.yaml");
-  assert.equal(findInboxItemFile(["2026-09-08T10-00-00-cohort-m1.yaml.processed"], "cohort-m1"), "2026-09-08T10-00-00-cohort-m1.yaml.processed");
-  assert.equal(findInboxItemFile(files, "cohort-m9"), null);
-  assert.equal(findInboxItemFile(files, ""), null);
-  // Does not match a longer id by substring (m1 vs m10).
-  assert.equal(findInboxItemFile(["x-cohort-m10.yaml"], "cohort-m1"), null);
-});
-
-test("buildTrackParams: identity from the inbox item, stage/title/why passthrough, non-cohort rejected", () => {
-  const item = { id: "cohort-m1", service: "cohort", cohort_channel_id: "C1", raw_ref: "cohort:messaging:m1:7", content: "please build the deck" };
-  const r = buildTrackParams(item, { stage: "accepted", title: "Build the deck", why: "asked in DM" });
-  assert.equal(r.ok, true);
-  assert.equal(r.params.service, "cohort");
-  assert.equal(r.params.channelId, "C1");
-  assert.equal(r.params.messageId, "m1");
-  assert.equal(r.params.stage, "accepted");
-  assert.equal(r.params.title, "Build the deck");
-  assert.equal(r.params.why, "asked in DM");
-  assert.equal(r.params.body, "please build the deck");
-  assert.equal(r.idempotencyKey, "board.track:C1:m1:accepted");
-  const slack = buildTrackParams({ id: "slack-1", service: "slack", channel_id: "C9" }, { stage: "accepted" });
-  assert.equal(slack.ok, false);
-  assert.match(slack.error, /cohort/i);
-  const noStage = buildTrackParams(item, { stage: "later" });
-  assert.equal(noStage.ok, false);
-});
-
-test("formatMine: one line per item, priority/board/col visible; empty → a plain sentence", () => {
-  const out = formatMine([
-    { itemId: "i1", title: "Build the deck", boardName: "Sales", col: "doing", priority: "P1", dueAt: "2026-09-10T00:00:00Z" },
-    { itemId: "i2", title: "Reply to Marc", boardName: "DM: Marc", col: "todo", priority: "P2" },
-  ]);
-  const lines = out.split("\n");
-  assert.equal(lines.length, 2);
-  assert.match(lines[0], /P1/);
-  assert.match(lines[0], /Build the deck/);
-  assert.match(lines[0], /Sales/);
-  assert.match(lines[0], /doing/);
-  assert.match(lines[0], /i1/);
-  assert.match(formatMine([]), /nothing assigned|no items/i);
-  assert.match(usage(), /maestro board mine/);
-});
-
-test("runBoard mine: live read via listMineImpl; --json prints the array; falls back to the cache when the read is empty and the cache exists", async () => {
-  const root = mkdtempSync(join(tmpdir(), "board-cli-"));
-  try {
-    const out = [];
-    const deps = { agentRoot: root, cfg: CFG, listMineImpl: async () => [{ itemId: "i1", title: "Deck", col: "doing", priority: "P1" }], write: (s) => out.push(s) };
-    const r = await runBoard(["mine"], deps);
-    assert.equal(r.code, 0);
-    assert.match(out.join("\n"), /Deck/);
-    out.length = 0;
-    const rj = await runBoard(["mine", "--json"], deps);
-    assert.equal(rj.code, 0);
-    assert.deepEqual(JSON.parse(out.join("")), [{ itemId: "i1", title: "Deck", col: "doing", priority: "P1" }]);
-    // Empty live read + a daemon cache → the cache (marked as such).
-    mkdirSync(join(root, "state", "org"), { recursive: true });
-    writeFileSync(join(root, "state", "org", "board-mine.json"), JSON.stringify({ items: [{ itemId: "c1", title: "Cached item" }], fetchedAt: "2026-09-08T11:00:00Z" }));
-    out.length = 0;
-    const rc = await runBoard(["mine"], { ...deps, listMineImpl: async () => [] });
-    assert.equal(rc.code, 0);
-    assert.match(out.join("\n"), /Cached item/);
-    assert.match(out.join("\n"), /cached/i);
-    // Org disabled → [] and exit 0 (fail-open), never a crash.
-    out.length = 0;
-    const off = await runBoard(["mine", "--json"], { ...deps, cfg: { org: { cohort: { enabled: false } } }, listMineImpl: async () => { throw new Error("must not be called"); } });
-    assert.equal(off.code, 0);
-    assert.deepEqual(JSON.parse(out.join("")), [{ itemId: "c1", title: "Cached item" }], "cache still served when the org is off");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("runBoard track: reads the inbox item by id from state/inbox/cohort, calls board.track with stage/title/why", async () => {
-  const root = mkdtempSync(join(tmpdir(), "board-cli-"));
-  try {
-    const dir = join(root, "state", "inbox", "cohort");
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, "2026-09-08T10-00-00-cohort-m1.yaml.dispatched"), [
-      "id: cohort-m1",
-      "service: cohort",
-      "channel_id: C1",
-      "raw_ref: cohort:messaging:m1:7",
-      "sender: Marc",
-      "content: |",
-      "  please build the deck",
-      "",
-    ].join("\n"));
-    const calls = [];
-    const out = [];
-    const deps = {
-      agentRoot: root, cfg: CFG, write: (s) => out.push(s),
-      trackImpl: async (params, o) => { calls.push({ params, o }); return { ok: true, result: { tracked: true, taskId: "t1", col: "todo", created: true } }; },
-    };
-    const r = await runBoard(["track", "cohort-m1", "--stage", "accepted", "--title", "Build the deck", "--why", "asked in DM"], deps);
-    assert.equal(r.code, 0, out.join("\n"));
-    assert.equal(calls.length, 1);
-    assert.equal(calls[0].params.channelId, "C1");
-    assert.equal(calls[0].params.messageId, "m1");
-    assert.equal(calls[0].params.stage, "accepted");
-    assert.equal(calls[0].params.title, "Build the deck");
-    assert.equal(calls[0].params.why, "asked in DM");
-    assert.equal(calls[0].o.idempotencyKey, "board.track:C1:m1:accepted");
-    assert.equal(calls[0].o.base, "https://org.example");
-    assert.match(out.join("\n"), /t1/);
-    // Unknown id → exit 1 with a clear message, no call.
-    out.length = 0;
-    const miss = await runBoard(["track", "cohort-nope", "--stage", "done"], deps);
-    assert.equal(miss.code, 1);
-    assert.match(out.join("\n"), /cohort-nope/);
-    assert.equal(calls.length, 1);
-    // Server error frame → exit 1, message shown.
-    const err = await runBoard(["track", "cohort-m1", "--stage", "done"], { ...deps, trackImpl: async () => ({ ok: false, error: { code: "FORBIDDEN_SCOPE", message: "nope" } }) });
-    assert.equal(err.code, 1);
-    assert.match(out.join("\n"), /FORBIDDEN_SCOPE/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("runBoard claim/complete: route to the client with a stable idempotency key; --note wraps into proof.note", async () => {
-  const calls = [];
-  const out = [];
-  const deps = {
-    agentRoot: "/tmp/none", cfg: CFG, write: (s) => out.push(s),
-    claimImpl: async (params, o) => { calls.push({ name: "claim", params, o }); return { ok: true, result: { itemId: params.itemId, leaseToken: "L" } }; },
-    completeImpl: async (params, o) => { calls.push({ name: "complete", params, o }); return { ok: true, result: { itemId: params.itemId, status: "done" } }; },
-  };
-  assert.equal((await runBoard(["claim", "item_1"], deps)).code, 0);
-  assert.equal(calls[0].params.itemId, "item_1");
-  assert.equal(calls[0].o.idempotencyKey, "board.claim:item_1");
-  assert.equal((await runBoard(["complete", "item_1", "--note", "shipped v2"], deps)).code, 0);
-  assert.deepEqual(calls[1].params, { itemId: "item_1", proof: { note: "shipped v2" } });
-  assert.equal((await runBoard(["complete", "item_2"], deps)).code, 0);
-  assert.deepEqual(calls[2].params, { itemId: "item_2" });
-  // A CONFLICT (someone else won the race) is exit 1 and says so.
-  const lost = await runBoard(["claim", "item_1"], { ...deps, claimImpl: async () => ({ ok: false, error: { code: "CONFLICT", message: "already claimed" } }) });
-  assert.equal(lost.code, 1);
-  assert.match(out.join("\n"), /CONFLICT/);
-  // Org disabled → exit 1 with a reason, never a throw.
-  const off = await runBoard(["claim", "item_1"], { ...deps, cfg: { org: { cohort: { enabled: false } } } });
-  assert.equal(off.code, 1);
-  assert.match(out.join("\n"), /org|cohort/i);
-  // --help → exit 0 + usage.
-  out.length = 0;
-  assert.equal((await runBoard(["--help"], deps)).code, 0);
-  assert.match(out.join("\n"), /maestro board/);
-});
-
-test("bin: `maestro board --help` dispatches to lib/cli/board and exits 0", () => {
-  const cli = new URL("../../bin/maestro.mjs", import.meta.url).pathname;
-  const r = spawnSync(process.execPath, [cli, "board", "--help"], { encoding: "utf8" });
-  assert.equal(r.status, 0, r.stderr);
-  assert.match(r.stdout, /maestro board mine/);
-});
-
-test("runBoard track: an inbox item renamed by the daemon between the directory listing and the read (.yaml → .dispatched) is re-listed, not reported as ENOENT", async () => {
-  const yaml = ["id: cohort-m9", "service: cohort", "channel_id: C9", "raw_ref: cohort:messaging:m9:1", "content: hi", ""].join("\n");
-  let listings = 0;
-  let reads = 0;
-  const calls = [];
-  const out = [];
-  const deps = {
-    agentRoot: "/virtual", cfg: CFG, write: (s) => out.push(s),
-    readdirImpl: () => { listings += 1; return listings === 1 ? ["2026-09-08T10-00-00-cohort-m9.yaml"] : ["2026-09-08T10-00-00-cohort-m9.yaml.dispatched"]; },
-    readFileImpl: (p) => {
-      reads += 1;
-      if (String(p).endsWith(".yaml")) { const e = new Error("ENOENT: no such file"); e.code = "ENOENT"; throw e; }
-      return yaml;
-    },
-    trackImpl: async (params, o) => { calls.push({ params, o }); return { ok: true, result: { tracked: true, taskId: "t9", col: "done" } }; },
-  };
-  const r = await runBoard(["track", "cohort-m9", "--stage", "done"], deps);
-  assert.equal(r.code, 0, out.join("\n"));
-  assert.equal(listings, 2, "re-listed once after the rename");
-  assert.equal(reads, 2);
-  assert.equal(calls[0].params.messageId, "m9");
-  // Gone for good (retired between listings) → the documented "not found" exit, never a raw ENOENT.
-  out.length = 0;
-  const gone = await runBoard(["track", "cohort-m9", "--stage", "done"], {
-    ...deps,
-    readdirImpl: () => ["2026-09-08T10-00-00-cohort-m9.yaml"],
-    readFileImpl: () => { const e = new Error("ENOENT"); e.code = "ENOENT"; throw e; },
-  });
-  assert.equal(gone.code, 1);
-  assert.match(out.join("\n"), /no inbox item cohort-m9/);
-  assert.ok(!/ENOENT/.test(out.join("\n")));
-});

package/lib/cli/design.test.mjs

@@ -1,270 +0,0 @@
-/**
- * design.test.mjs — `maestro design sync` (WP-M7 mechanic 4).
- *
- * Drives the REAL `runDesign` against a temp agent dir with an injected
- * `branding.getFoundation`. Two claims carry the command and both are load
- * bearing:
- *
- *   · FAIL-OPEN MEANS "WRITE NOTHING". A seat's DESIGN.md is what every design
- *     skill grounds on. A failed read must leave the last-good file exactly
- *     where it is and exit non-zero — the opposite of half-writing a file that
- *     then looks authoritative.
- *   · IDEMPOTENT BY BYTES. A second run against an unchanged foundation must
- *     not touch a single mtime, so the 15-minute daemon poll never churns the
- *     tree or wakes an editor's file watcher.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, writeFileSync, statSync, utimesSync, existsSync, rmSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { execFileSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-
-import { runDesign, parseDesignArgs, describeFrame, workspaceName, usage } from "./design.mjs";
-
-const NOW = Date.parse("2026-09-08T12:00:00Z");
-const FIXTURE = JSON.parse(readFileSync(new URL("../design/fixtures/foundation.json", import.meta.url), "utf8"));
-const CFG = { org: { cohort: { enabled: true, base: "https://os.example.test", token: "nlk_t", orgId: "org_1", orgName: "Northwind" } } };
-
-const okFrame = (over = {}) => ({
-  ok: true,
-  result: {
-    foundation: FIXTURE,
-    version: { id: "bv_01HQZ", seq: 7, label: "V2.7" },
-    headVersionId: "bv_01HQZ",
-    isHead: true,
-    unversioned: false,
-    history: [],
-    ...over,
-  },
-});
-
-function harness(t, opts = {}) {
-  const root = mkdtempSync(join(tmpdir(), "maestro-design-cli-"));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const lines = [];
-  const calls = [];
-  const deps = {
-    agentRoot: root,
-    cfg: opts.cfg === undefined ? CFG : opts.cfg,
-    now: opts.now === undefined ? NOW : opts.now,
-    write: (s) => lines.push(s),
-    getFoundationImpl: opts.getFoundationImpl || (async (params, o) => { calls.push({ params, o }); return okFrame(); }),
-  };
-  return { root, lines, calls, deps, out: () => lines.join("\n") };
-}
-
-// ── argument parsing ────────────────────────────────────────────────────────
-
-test("parseDesignArgs handles the flags, both spellings, and rejects the rest", () => {
-  assert.deepEqual(parseDesignArgs(["sync"]), { sub: "sync", out: null, json: false, help: false, error: null });
-  assert.equal(parseDesignArgs(["sync", "--json"]).json, true);
-  assert.equal(parseDesignArgs(["sync", "--out", "docs"]).out, "docs");
-  assert.equal(parseDesignArgs(["sync", "--out=docs"]).out, "docs");
-  assert.equal(parseDesignArgs([]).help, true);
-  assert.equal(parseDesignArgs(["--help"]).help, true);
-  assert.equal(parseDesignArgs(["-h"]).help, true);
-  assert.match(parseDesignArgs(["shove"]).error, /unknown design command: shove/);
-  assert.match(parseDesignArgs(["sync", "--wat"]).error, /unknown argument --wat/);
-  assert.match(parseDesignArgs(["sync", "--out", ""]).error, /--out needs a directory/);
-
-  // A MISSING value is an error, not a silent fallback to the agent dir —
-  // which is precisely the directory the operator was trying not to write to.
-  assert.match(parseDesignArgs(["sync", "--out"]).error, /--out needs a directory/);
-  assert.equal(parseDesignArgs(["sync", "--out"]).out, null);
-  assert.match(parseDesignArgs(["sync", "--out", "--json"]).error, /--out needs a directory, not --json/);
-  assert.equal(parseDesignArgs(["sync", "--out", "--json"]).json, false, "and --json was not eaten as a path");
-});
-
-test("`--out` with no path exits 1 and writes nothing at all", async (t) => {
-  const h = harness(t);
-  const r = await runDesign(["sync", "--out"], h.deps);
-  assert.equal(r.code, 1);
-  assert.match(h.out(), /--out needs a directory/);
-  assert.equal(h.calls.length, 0, "not even a read is spent");
-  assert.deepEqual(readdirSync(h.root), [], "and no DESIGN.md lands in the agent dir by accident");
-});
-
-test("--help and a bad argument both print the usage; only the bad argument is an error", async (t) => {
-  const h = harness(t);
-  assert.deepEqual(await runDesign(["--help"], h.deps), { code: 0 });
-  assert.match(h.out(), /maestro design sync/);
-
-  const h2 = harness(t);
-  const r = await runDesign(["sync", "--nope"], h2.deps);
-  assert.equal(r.code, 1);
-  assert.match(h2.out(), /error: unknown argument --nope/);
-  assert.match(h2.out(), /maestro design sync/, "the usage follows the error");
-  assert.ok(usage().includes("design_propose_change"), "the usage says how a change is actually made");
-});
-
-// ── the happy path ──────────────────────────────────────────────────────────
-
-test("sync writes DESIGN.md, PRODUCT.md and the snapshot, and reads the SAVED foundation", async (t) => {
-  const h = harness(t);
-  const r = await runDesign(["sync"], h.deps);
-
-  assert.equal(r.code, 0);
-  assert.deepEqual(r.data.written, ["DESIGN.md", "PRODUCT.md"]);
-  assert.ok(existsSync(join(h.root, "DESIGN.md")));
-  assert.ok(existsSync(join(h.root, "PRODUCT.md")));
-  assert.ok(existsSync(join(h.root, "state", "design", "foundation.json")));
-  assert.match(h.out(), /design sync: wrote DESIGN\.md, PRODUCT\.md/);
-  assert.match(h.out(), /foundation bv_01HQZ/);
-
-  assert.equal(h.calls.length, 1);
-  assert.deepEqual(h.calls[0].params, { historyLimit: 0 }, "no history is fetched — the seat only needs the head");
-  assert.equal(h.calls[0].o.base, "https://os.example.test", "the agent's own connection is used");
-  assert.equal(h.calls[0].o.orgId, "org_1");
-
-  const design = readFileSync(join(h.root, "DESIGN.md"), "utf8");
-  assert.match(design, /^---\nname: "Northwind"\n/, "the heading comes from the org config, not the foundation prose");
-  assert.match(design, /\{colors\.primary\}/);
-  assert.equal(statSync(join(h.root, "DESIGN.md")).mode & 0o777, 0o644);
-  assert.equal(statSync(join(h.root, "PRODUCT.md")).mode & 0o777, 0o644);
-});
-
-test("--json prints the machine result and still writes the files", async (t) => {
-  const h = harness(t);
-  const r = await runDesign(["sync", "--json"], h.deps);
-  assert.equal(r.code, 0);
-  const doc = JSON.parse(h.out());
-  assert.deepEqual(doc.written, ["DESIGN.md", "PRODUCT.md"]);
-  assert.equal(doc.version, "bv_01HQZ");
-  assert.equal(doc.outDir, h.root);
-});
-
-test("--out puts the docs elsewhere and keeps the snapshot under the agent root", async (t) => {
-  const h = harness(t);
-  const outDir = join(h.root, "brand");
-  const r = await runDesign(["sync", "--out", outDir], h.deps);
-  assert.equal(r.code, 0);
-  assert.ok(existsSync(join(outDir, "DESIGN.md")));
-  assert.ok(!existsSync(join(h.root, "DESIGN.md")));
-  assert.ok(existsSync(join(h.root, "state", "design", "foundation.json")));
-});
-
-test("re-running against an unchanged foundation rewrites nothing", async (t) => {
-  const h = harness(t);
-  await runDesign(["sync"], h.deps);
-  const old = new Date(NOW - 86_400_000);
-  for (const rel of ["DESIGN.md", "PRODUCT.md"]) utimesSync(join(h.root, rel), old, old);
-  const before = ["DESIGN.md", "PRODUCT.md"].map((rel) => statSync(join(h.root, rel)).mtimeMs);
-
-  const r = await runDesign(["sync"], { ...h.deps, now: NOW + 3_600_000 });
-  assert.equal(r.code, 0);
-  assert.deepEqual(r.data.written, []);
-  assert.deepEqual(r.data.unchanged, ["DESIGN.md", "PRODUCT.md"]);
-  assert.match(h.out(), /design sync: unchanged \(DESIGN\.md, PRODUCT\.md\)/);
-  assert.deepEqual(["DESIGN.md", "PRODUCT.md"].map((rel) => statSync(join(h.root, rel)).mtimeMs), before);
-});
-
-// ── the failure postures ────────────────────────────────────────────────────
-
-test("an error frame exits 1 and writes NOTHING", async (t) => {
-  const h = harness(t, { getFoundationImpl: async () => ({ ok: false, error: { code: "FORBIDDEN", message: "design.read is not granted to this seat." } }) });
-  const r = await runDesign(["sync"], h.deps);
-  assert.equal(r.code, 1);
-  assert.match(h.out(), /FORBIDDEN: design\.read is not granted to this seat\./);
-  assert.match(h.out(), /Nothing was written\./);
-  assert.deepEqual(readdirSync(h.root), [], "not one file, not even the state dir");
-});
-
-test("a transport throw exits 1, says so, and leaves the last-good files exactly as they were", async (t) => {
-  const h = harness(t);
-  await runDesign(["sync"], h.deps); // establish a good DESIGN.md first
-  const good = readFileSync(join(h.root, "DESIGN.md"), "utf8");
-  const old = new Date(NOW - 86_400_000);
-  utimesSync(join(h.root, "DESIGN.md"), old, old);
-  const mtime = statSync(join(h.root, "DESIGN.md")).mtimeMs;
-
-  const r = await runDesign(["sync"], { ...h.deps, getFoundationImpl: async () => { throw new Error("fetch failed: ECONNREFUSED"); } });
-  assert.equal(r.code, 1);
-  assert.match(h.out(), /could not read the brand foundation — fetch failed: ECONNREFUSED/);
-  assert.match(h.out(), /Nothing was written\./);
-  assert.equal(readFileSync(join(h.root, "DESIGN.md"), "utf8"), good, "the last-good file is untouched");
-  assert.equal(statSync(join(h.root, "DESIGN.md")).mtimeMs, mtime);
-});
-
-test("a workspace with no foundation yet is named as such, not rendered as an empty brand", async (t) => {
-  const h = harness(t, { getFoundationImpl: async () => ({ ok: true, result: { foundation: null, headVersionId: null, unversioned: true, history: [] } }) });
-  const r = await runDesign(["sync"], h.deps);
-  assert.equal(r.code, 1);
-  assert.match(h.out(), /no brand foundation yet — set one up in Design first/);
-  assert.deepEqual(readdirSync(h.root), []);
-});
-
-test("hq's stock defaults are refused: an unversioned workspace writes nothing and is told why", async (t) => {
-  // The FRAME HQ ACTUALLY SENDS for a workspace that never saved a foundation:
-  // a complete `dsDefaults()` palette, `unversioned: true`, `headVersionId:
-  // null`. The `foundation: null` case above cannot occur in production, so
-  // this is the guard that has to hold.
-  const h = harness(t, {
-    getFoundationImpl: async () => ({
-      ok: true,
-      result: {
-        foundation: { ...FIXTURE, colors: [{ name: "Ink", value: "#0d0d0d" }] },
-        version: null,
-        headVersionId: null,
-        isHead: false,
-        unversioned: true,
-        history: [],
-      },
-    }),
-  });
-  const r = await runDesign(["sync"], h.deps);
-  assert.equal(r.code, 1);
-  assert.match(h.out(), /never saved a brand foundation/);
-  assert.match(h.out(), /stock defaults, which are not your brand/);
-  assert.match(h.out(), /Nothing was written\./);
-  assert.deepEqual(readdirSync(h.root), [], "no DESIGN.md wearing another product's palette");
-});
-
-test("an older hq that omits `unversioned` is judged by the version identity instead", async (t) => {
-  const h = harness(t, {
-    getFoundationImpl: async () => ({ ok: true, result: { foundation: FIXTURE, version: null, headVersionId: null, history: [] } }),
-  });
-  const r = await runDesign(["sync"], h.deps);
-  assert.equal(r.code, 1);
-  assert.match(h.out(), /never saved a brand foundation/);
-  assert.deepEqual(readdirSync(h.root), []);
-});
-
-test("a seat that is not enrolled in the org exits 1 and points at setup", async (t) => {
-  const h = harness(t, { cfg: { org: { cohort: { enabled: false } } } });
-  const r = await runDesign(["sync"], h.deps);
-  assert.equal(r.code, 1);
-  assert.match(h.out(), /not enabled for this agent — run `maestro setup --only org`/);
-  assert.equal(h.calls.length, 0, "no hq call is attempted");
-  assert.deepEqual(readdirSync(h.root), []);
-});
-
-test("a write failure is reported, not thrown", async (t) => {
-  const h = harness(t);
-  const r = await runDesign(["sync"], { ...h.deps, syncImpl: () => { throw new Error("EROFS: read-only file system"); } });
-  assert.equal(r.code, 1);
-  assert.match(h.out(), /could not write the design files — EROFS/);
-});
-
-test("describeFrame turns any frame into one readable line", () => {
-  assert.equal(describeFrame({ ok: false, error: { code: "RATE_LIMITED", message: "Slow down." } }), "RATE_LIMITED: Slow down.");
-  assert.equal(describeFrame({ ok: false, error: { message: "no code" } }), "error: no code");
-  assert.equal(describeFrame(null), "no response");
-  assert.equal(describeFrame({ ok: true }), "no response");
-});
-
-test("workspaceName is the one shared with the daemon", async () => {
-  const { workspaceName: fromWriter } = await import("../design/write.mjs");
-  assert.equal(workspaceName, fromWriter, "one definition, so the CLI and the daemon cannot render different headings");
-});
-
-// ── the bin seam ────────────────────────────────────────────────────────────
-
-test("`maestro design` is wired into bin/maestro.mjs", () => {
-  const bin = fileURLToPath(new URL("../../bin/maestro.mjs", import.meta.url));
-  const out = execFileSync(process.execPath, [bin, "design", "--help"], { encoding: "utf8" });
-  assert.match(out, /maestro design sync \[--out <dir>\] \[--json\]/);
-  assert.match(execFileSync(process.execPath, [bin, "--help"], { encoding: "utf8" }), /design sync/, "and listed in the top-level help");
-});