@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/session/launch-args.test.mjs

@@ -1,157 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  BOOTSTRAP_PROMPT,
-  SESSION_EXIT_SCRIPT,
-  buildClaudeArgs,
-  detectMux,
-  chooseMux,
-  buildMuxCommands,
-  parseScreenList,
-  parseExitFile,
-} from "./launch-args.mjs";
-
-const UUID = "11111111-2222-4333-8444-555555555555";
-
-test("BOOTSTRAP_PROMPT is the exact resume prompt from the design", () => {
-  assert.equal(
-    BOOTSTRAP_PROMPT,
-    "You are resuming as the main session for this seat. Load the maestro main-session skill (~/.claude/skills/maestro-main-session/SKILL.md or /maestro:main-session) and follow it.",
-  );
-});
-
-test("buildClaudeArgs: fresh id → --session-id; relaunch → --resume; permissions spliced; prompt last", () => {
-  const fresh = buildClaudeArgs({ first: "olivia", sessionId: UUID, mode: "session-id", permissionArgs: ["--dangerously-skip-permissions"] });
-  assert.deepEqual(fresh, ["--name", "olivia-main", "--session-id", UUID, "--dangerously-skip-permissions", BOOTSTRAP_PROMPT]);
-  const resume = buildClaudeArgs({ first: "olivia", sessionId: UUID, mode: "resume", permissionArgs: ["--allowedTools", "Read"], extraArgs: ["--model", "opus"] });
-  assert.deepEqual(resume, ["--name", "olivia-main", "--resume", UUID, "--allowedTools", "Read", "--model", "opus", BOOTSTRAP_PROMPT]);
-});
-
-test("buildClaudeArgs: a non-uuid session id or unknown mode is a defect", () => {
-  assert.throws(() => buildClaudeArgs({ first: "o", sessionId: "nope", mode: "resume" }), /session id/);
-  assert.throws(() => buildClaudeArgs({ first: "o", sessionId: UUID, mode: "attach" }), /mode/);
-});
-
-test("detectMux: probes the fixed candidate paths through injected existsSync", () => {
-  const found = detectMux({ existsSync: (p) => p === "/opt/homebrew/bin/tmux" || p === "/usr/bin/screen" });
-  assert.deepEqual(found, { tmux: "/opt/homebrew/bin/tmux", screen: "/usr/bin/screen" });
-  assert.deepEqual(detectMux({ existsSync: () => false }), { tmux: null, screen: null });
-  // A throwing probe is treated as absent.
-  assert.deepEqual(detectMux({ existsSync: () => { throw new Error("boom"); } }), { tmux: null, screen: null });
-});
-
-test("chooseMux: auto prefers tmux, falls back to screen, null when neither; explicit choice must exist", () => {
-  const both = { tmux: "/opt/homebrew/bin/tmux", screen: "/usr/bin/screen" };
-  assert.deepEqual(chooseMux("auto", both), { kind: "tmux", bin: "/opt/homebrew/bin/tmux" });
-  assert.deepEqual(chooseMux("auto", { tmux: null, screen: "/usr/bin/screen" }), { kind: "screen", bin: "/usr/bin/screen" });
-  assert.equal(chooseMux("auto", { tmux: null, screen: null }), null);
-  assert.deepEqual(chooseMux("screen", both), { kind: "screen", bin: "/usr/bin/screen" });
-  assert.deepEqual(chooseMux("tmux", both), { kind: "tmux", bin: "/opt/homebrew/bin/tmux" });
-  // An explicit mux that is not installed falls back rather than failing the seat.
-  assert.deepEqual(chooseMux("tmux", { tmux: null, screen: "/usr/bin/screen" }), { kind: "screen", bin: "/usr/bin/screen" });
-});
-
-test("SESSION_EXIT_SCRIPT records the wrapped command's exit code without interpolating any argument", () => {
-  assert.match(SESSION_EXIT_SCRIPT, /"\$@"/);
-  assert.match(SESSION_EXIT_SCRIPT, /exit "\$rc"/);
-  assert.doesNotMatch(SESSION_EXIT_SCRIPT, /\$\{?[A-Z_]+\}?/); // no env expansion — everything is positional
-});
-
-test("buildMuxCommands (screen): one FOREGROUND command, -D -m -S <name>, claude wrapped by the exit-recording sh", () => {
-  const c = buildMuxCommands({
-    mux: { kind: "screen", bin: "/usr/bin/screen" },
-    muxName: "maestro-olivia",
-    cwd: "/agent",
-    claudeBin: "/Users/o/.local/bin/claude",
-    claudeArgs: ["--name", "olivia-main", "--resume", UUID, "prompt with spaces"],
-    exitFile: "/agent/state/session/last-exit",
-  });
-  assert.equal(c.blocking, true);
-  assert.equal(c.waitProbe, null);
-  assert.equal(c.start.file, "/usr/bin/screen");
-  assert.deepEqual(c.start.args, [
-    "-D", "-m", "-S", "maestro-olivia",
-    "/bin/sh", "-c", SESSION_EXIT_SCRIPT, "maestro-session", "/agent/state/session/last-exit",
-    "/Users/o/.local/bin/claude", "--name", "olivia-main", "--resume", UUID, "prompt with spaces",
-  ]);
-  assert.deepEqual(c.exists, { file: "/usr/bin/screen", args: ["-ls"] });
-});
-
-test("buildMuxCommands (tmux): detached new-session, then a has-session probe the supervisor blocks on", () => {
-  const c = buildMuxCommands({
-    mux: { kind: "tmux", bin: "/opt/homebrew/bin/tmux" },
-    muxName: "maestro-olivia",
-    cwd: "/agent",
-    claudeBin: "claude",
-    claudeArgs: ["--name", "olivia-main"],
-    exitFile: "/agent/state/session/last-exit",
-  });
-  assert.equal(c.blocking, false);
-  assert.equal(c.start.file, "/opt/homebrew/bin/tmux");
-  assert.deepEqual(c.start.args, [
-    "new-session", "-d", "-s", "maestro-olivia", "-c", "/agent",
-    "/bin/sh", "-c", SESSION_EXIT_SCRIPT, "maestro-session", "/agent/state/session/last-exit",
-    "claude", "--name", "olivia-main",
-  ]);
-  assert.deepEqual(c.waitProbe, { file: "/opt/homebrew/bin/tmux", args: ["has-session", "-t", "=maestro-olivia"] });
-  assert.deepEqual(c.exists, c.waitProbe);
-});
-
-test("buildMuxCommands: unknown mux kind is a defect", () => {
-  assert.throws(() => buildMuxCommands({ mux: { kind: "zellij", bin: "z" }, muxName: "m", cwd: "/", claudeBin: "c", claudeArgs: [], exitFile: "/e" }), /mux/);
-});
-
-test("parseScreenList: finds an exact session name in `screen -ls` output, not a prefix", () => {
-  const out = [
-    "There are screens on:",
-    "\t48213.maestro-olivia\t(Detached)",
-    "\t48214.maestro-olivia-old\t(Attached)",
-    "2 Sockets in /var/folders/xx/.screen.",
-    "",
-  ].join("\n");
-  assert.equal(parseScreenList(out, "maestro-olivia"), true);
-  assert.equal(parseScreenList(out, "maestro-oliv"), false);
-  assert.equal(parseScreenList("No Sockets found in /var/folders/xx/.screen.\n", "maestro-olivia"), false);
-  assert.equal(parseScreenList(null, "maestro-olivia"), false);
-});
-
-test("parseScreenList: a `(Dead ???)` socket is NOT a live session (a SIGKILLed screen leaves one behind)", () => {
-  // Verbatim shape of `screen -ls` after the screen process was kill -9'd.
-  const dead = [
-    "There is a screen on:",
-    "\t82332.maestro-olivia\t(Dead ???)",
-    "Remove dead screens with 'screen -wipe'.",
-    "1 Socket in /var/folders/xx/.screen.",
-    "",
-  ].join("\n");
-  assert.equal(parseScreenList(dead, "maestro-olivia"), false);
-  // A dead socket next to a live one with the same name: the live one counts.
-  const mixed = [
-    "There are screens on:",
-    "\t82332.maestro-olivia\t(Dead ???)",
-    "\t90001.maestro-olivia\t(Detached)",
-    "2 Sockets in /var/folders/xx/.screen.",
-    "",
-  ].join("\n");
-  assert.equal(parseScreenList(mixed, "maestro-olivia"), true);
-});
-
-test("buildMuxCommands: screen has a `wipe` (dead-socket cleanup) and both muxes a `stop`; tmux has no wipe", () => {
-  const base = { muxName: "maestro-olivia", cwd: "/agent", claudeBin: "claude", claudeArgs: [], exitFile: "/e" };
-  const s = buildMuxCommands({ ...base, mux: { kind: "screen", bin: "/usr/bin/screen" } });
-  assert.deepEqual(s.wipe, { file: "/usr/bin/screen", args: ["-wipe"] });
-  assert.deepEqual(s.stop, { file: "/usr/bin/screen", args: ["-S", "maestro-olivia", "-X", "quit"] });
-  const t = buildMuxCommands({ ...base, mux: { kind: "tmux", bin: "/opt/homebrew/bin/tmux" } });
-  assert.equal(t.wipe, null);
-  assert.deepEqual(t.stop, { file: "/opt/homebrew/bin/tmux", args: ["kill-session", "-t", "=maestro-olivia"] });
-});
-
-test("parseExitFile: integer or null", () => {
-  assert.equal(parseExitFile("0\n"), 0);
-  assert.equal(parseExitFile(" 1 "), 1);
-  assert.equal(parseExitFile("137"), 137);
-  assert.equal(parseExitFile(""), null);
-  assert.equal(parseExitFile("abc"), null);
-  assert.equal(parseExitFile(null), null);
-});

package/lib/session/liveness.test.mjs

@@ -1,100 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { join } from "node:path";
-
-import {
-  FEED_VERSION,
-  HEARTBEAT_INTERVAL_MS,
-  STALE_MS,
-  DAEMON_STALE_MS,
-  buildHeartbeat,
-  parseHeartbeat,
-  heartbeatLiveness,
-  writeHeartbeat,
-  sessionLiveness,
-  isSessionLive,
-  isDaemonStale,
-} from "./liveness.mjs";
-
-const T0 = Date.parse("2026-09-08T10:00:00Z");
-const UUID = "11111111-2222-4333-8444-555555555555";
-
-test("constants: 15 s beat, 90 s stale, 5 min daemon stale", () => {
-  assert.equal(HEARTBEAT_INTERVAL_MS, 15_000);
-  assert.equal(STALE_MS, 90_000);
-  assert.equal(DAEMON_STALE_MS, 5 * 60_000);
-  assert.equal(typeof FEED_VERSION, "string");
-});
-
-test("buildHeartbeat: exactly the documented fields, ts from the injected clock", () => {
-  const hb = buildHeartbeat({ pid: 10, ppid: 9, sessionId: UUID, name: "olivia-main", now: T0 });
-  assert.deepEqual(hb, { pid: 10, ppid: 9, sessionId: UUID, name: "olivia-main", ts: "2026-09-08T10:00:00.000Z", feedVersion: FEED_VERSION });
-});
-
-test("parseHeartbeat: round-trip; junk → null", () => {
-  const hb = buildHeartbeat({ pid: 10, ppid: 9, sessionId: UUID, name: "n", now: T0 });
-  assert.deepEqual(parseHeartbeat(JSON.stringify(hb)), hb);
-  assert.equal(parseHeartbeat("{"), null);
-  assert.equal(parseHeartbeat(JSON.stringify({ pid: 1 })), null); // no ts
-  assert.equal(parseHeartbeat(JSON.stringify({ ts: "yesterday" })), null);
-  assert.equal(parseHeartbeat(undefined), null);
-});
-
-test("heartbeatLiveness: fresh → live; older than staleMs → stale; slightly future-dated beats are live", () => {
-  const hb = buildHeartbeat({ pid: 1, ppid: 0, sessionId: UUID, name: "n", now: T0 });
-  assert.deepEqual(heartbeatLiveness(hb, { now: T0 + 30_000 }), { live: true, reason: "fresh", ageMs: 30_000 });
-  assert.deepEqual(heartbeatLiveness(hb, { now: T0 + 90_000 }), { live: false, reason: "stale", ageMs: 90_000 });
-  assert.equal(heartbeatLiveness(hb, { now: T0 + 89_999 }).live, true);
-  assert.equal(heartbeatLiveness(hb, { now: T0 + 10_000, staleMs: 5_000 }).live, false);
-  assert.equal(heartbeatLiveness(hb, { now: T0 - 5_000 }).live, true);
-  assert.deepEqual(heartbeatLiveness(null, { now: T0 }), { live: false, reason: "missing", ageMs: null });
-});
-
-test("heartbeatLiveness: a beat further in the FUTURE than staleMs is clock skew, not liveness (fail-open to dispatch)", () => {
-  // The feed beat at T0, the session died, and NTP stepped the clock back
-  // 20 min: without a bound the dead session would read as live for 20 min
-  // and the daemon would withhold dispatch the whole time.
-  const hb = buildHeartbeat({ pid: 1, ppid: 0, sessionId: UUID, name: "n", now: T0 });
-  assert.deepEqual(heartbeatLiveness(hb, { now: T0 - 20 * 60_000 }), { live: false, reason: "skew", ageMs: -20 * 60_000 });
-  assert.deepEqual(heartbeatLiveness(hb, { now: T0 - 90_000 }), { live: false, reason: "skew", ageMs: -90_000 });
-  assert.equal(heartbeatLiveness(hb, { now: T0 - 89_999 }).live, true);
-  assert.equal(heartbeatLiveness(hb, { now: T0 - 6_000, staleMs: 5_000 }).reason, "skew");
-});
-
-test("heartbeatLiveness: a beat whose pid is known-dead is not live even when fresh", () => {
-  const hb = buildHeartbeat({ pid: 4242, ppid: 0, sessionId: UUID, name: "n", now: T0 });
-  const r = heartbeatLiveness(hb, { now: T0 + 1_000, pidAlive: () => false });
-  assert.deepEqual(r, { live: false, reason: "pid-dead", ageMs: 1_000 });
-  // pid liveness is optional: without a probe, freshness decides.
-  assert.equal(heartbeatLiveness(hb, { now: T0 + 1_000 }).live, true);
-});
-
-test("writeHeartbeat: atomic write to state/session/heartbeat.json; failure is a value", () => {
-  const disk = {};
-  const hb = buildHeartbeat({ pid: 1, ppid: 0, sessionId: UUID, name: "n", now: T0 });
-  assert.deepEqual(writeHeartbeat("/agent", hb, { writeJsonAtomic: (p, o) => { disk[p] = o; } }), { ok: true });
-  assert.deepEqual(disk[join("/agent", "state", "session", "heartbeat.json")], hb);
-  const bad = writeHeartbeat("/agent", hb, { writeJsonAtomic: () => { throw new Error("ENOSPC"); } });
-  assert.equal(bad.ok, false);
-  assert.match(bad.error, /ENOSPC/);
-});
-
-test("sessionLiveness / isSessionLive read the heartbeat file through injected fs", () => {
-  const hb = buildHeartbeat({ pid: process.pid, ppid: 0, sessionId: UUID, name: "n", now: T0 });
-  const deps = { readFileSync: (p) => { assert.equal(p, join("/agent", "state", "session", "heartbeat.json")); return JSON.stringify(hb); } };
-  const r = sessionLiveness("/agent", { now: T0 + 1_000, ...deps });
-  assert.equal(r.live, true);
-  assert.equal(r.heartbeat.sessionId, UUID);
-  assert.equal(isSessionLive("/agent", { now: T0 + 1_000, ...deps }), true);
-  assert.equal(isSessionLive("/agent", { now: T0 + 100_000, ...deps }), false);
-  assert.equal(isSessionLive("/agent", { now: T0, readFileSync: () => { throw new Error("ENOENT"); } }), false);
-  assert.deepEqual(sessionLiveness("/agent", { now: T0, readFileSync: () => { throw new Error("ENOENT"); } }), { live: false, reason: "missing", ageMs: null, heartbeat: null });
-});
-
-test("isDaemonStale: fresh health file → not stale; old health + dead pid → stale; a live pid rescues an old file", () => {
-  assert.equal(isDaemonStale({ healthMtimeMs: T0 - 60_000, pidAlive: false, now: T0 }), false);
-  assert.equal(isDaemonStale({ healthMtimeMs: T0 - 6 * 60_000, pidAlive: false, now: T0 }), true);
-  assert.equal(isDaemonStale({ healthMtimeMs: T0 - 6 * 60_000, pidAlive: true, now: T0 }), false);
-  assert.equal(isDaemonStale({ healthMtimeMs: null, pidAlive: null, now: T0 }), true);
-  assert.equal(isDaemonStale({ healthMtimeMs: null, pidAlive: true, now: T0 }), false);
-});

package/lib/session/status-summary.test.mjs

@@ -1,118 +0,0 @@
-/**
- * status-summary.test.mjs — the pure session-status core the cohort-mcp
- * `session_status` tool, the SessionStart primer and `maestro board` share.
- * Run: node --test lib/session/status-summary.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  summarizeSessionStatus, readSessionStatus, statusLine, buildPrimerContext, DEFAULT_STALE_MS,
-} from "./status-summary.mjs";
-
-const NOW = Date.parse("2026-09-08T12:00:00Z");
-
-test("summarizeSessionStatus: live when the heartbeat is fresh, stale past staleMs, absent when missing", () => {
-  const fresh = summarizeSessionStatus({
-    heartbeat: { pid: 1, sessionId: "abc", name: "alex-main", ts: new Date(NOW - 10_000).toISOString() },
-    now: NOW,
-  });
-  assert.equal(fresh.live, true);
-  assert.equal(fresh.state, "live");
-  assert.equal(fresh.name, "alex-main");
-  assert.equal(fresh.ageMs, 10_000);
-  const stale = summarizeSessionStatus({ heartbeat: { ts: NOW - DEFAULT_STALE_MS - 1 }, now: NOW });
-  assert.equal(stale.live, false);
-  assert.equal(stale.state, "stale");
-  const none = summarizeSessionStatus({ heartbeat: null, now: NOW });
-  assert.equal(none.live, false);
-  assert.equal(none.state, "absent");
-  const garbage = summarizeSessionStatus({ heartbeat: { ts: "not a date" }, now: NOW });
-  assert.equal(garbage.state, "absent", "unparseable ts is absent, never a throw");
-});
-
-test("summarizeSessionStatus: counts peers, open handoffs and board-mine items; tolerates garbage", () => {
-  const s = summarizeSessionStatus({
-    heartbeat: { ts: NOW },
-    peers: [{ name: "alex-research" }, { name: "alex-deck" }],
-    handoffs: ["t1.json", "t2.json", "t3.json"],
-    boardMine: { items: [{ itemId: "a" }, { itemId: "b" }], fetchedAt: new Date(NOW - 60_000).toISOString() },
-    now: NOW,
-  });
-  assert.equal(s.peers.length, 2);
-  assert.equal(s.peerCount, 2);
-  assert.equal(s.handoffsOpen, 3);
-  assert.equal(s.boardMineCount, 2);
-  assert.equal(s.boardMineFetchedAt, new Date(NOW - 60_000).toISOString());
-  const g = summarizeSessionStatus({ peers: "x", handoffs: null, boardMine: [1, 2, 3], now: NOW });
-  assert.equal(g.peerCount, 0);
-  assert.equal(g.handoffsOpen, 0);
-  assert.equal(g.boardMineCount, 3, "a bare array is accepted as the item list");
-  const g2 = summarizeSessionStatus({ boardMine: { nope: true }, now: NOW });
-  assert.equal(g2.boardMineCount, 0);
-  assert.equal(g2.boardMineFetchedAt, null);
-});
-
-test("statusLine: one line a primer can inject", () => {
-  const s = summarizeSessionStatus({
-    heartbeat: { ts: NOW - 5_000, name: "alex-main" },
-    peers: [{ name: "alex-deck" }],
-    handoffs: ["a"],
-    boardMine: { items: [{}, {}] },
-    now: NOW,
-  });
-  const line = statusLine(s);
-  assert.equal(line.split("\n").length, 1);
-  assert.match(line, /alex-main/);
-  assert.match(line, /live/);
-  assert.match(line, /1 peer/);
-  assert.match(line, /1 open handoff/);
-  assert.match(line, /2 board item/);
-  const absent = statusLine(summarizeSessionStatus({ now: NOW }));
-  assert.match(absent, /not running|absent/i);
-});
-
-test("readSessionStatus: reads state/session/{heartbeat,peers}.json, handoffs/*.json and state/org/board-mine.json; fail-open", () => {
-  const root = mkdtempSync(join(tmpdir(), "status-summary-"));
-  try {
-    assert.equal(readSessionStatus(root, { now: NOW }).state, "absent", "empty root → absent, no throw");
-    mkdirSync(join(root, "state", "session", "handoffs", "done"), { recursive: true });
-    mkdirSync(join(root, "state", "org"), { recursive: true });
-    writeFileSync(join(root, "state", "session", "heartbeat.json"), JSON.stringify({ pid: 9, name: "alex-main", ts: NOW - 1000 }));
-    writeFileSync(join(root, "state", "session", "peers.json"), JSON.stringify([{ name: "alex-deck", muxName: "m" }]));
-    writeFileSync(join(root, "state", "session", "handoffs", "t1.json"), "{}");
-    writeFileSync(join(root, "state", "session", "handoffs", "t2.json"), "{}");
-    writeFileSync(join(root, "state", "session", "handoffs", "notes.txt"), "x");
-    writeFileSync(join(root, "state", "session", "handoffs", "done", "t0.json"), "{}");
-    writeFileSync(join(root, "state", "org", "board-mine.json"), JSON.stringify({ items: [{ itemId: "i1" }], fetchedAt: "2026-09-08T11:59:00.000Z" }));
-    const s = readSessionStatus(root, { now: NOW });
-    assert.equal(s.live, true);
-    assert.equal(s.name, "alex-main");
-    assert.equal(s.peerCount, 1);
-    assert.equal(s.handoffsOpen, 2, "only *.json in handoffs/, not done/ or other files");
-    assert.equal(s.boardMineCount, 1);
-    // peers.json may also be an object with a `peers` array.
-    writeFileSync(join(root, "state", "session", "peers.json"), JSON.stringify({ peers: [{ name: "a" }, { name: "b" }] }));
-    assert.equal(readSessionStatus(root, { now: NOW }).peerCount, 2);
-    // Corrupt files are absent, not fatal.
-    writeFileSync(join(root, "state", "session", "heartbeat.json"), "{not json");
-    assert.equal(readSessionStatus(root, { now: NOW }).state, "absent");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("buildPrimerContext: identity block + status line + counts; empty when there is no agent identity", () => {
-  const status = summarizeSessionStatus({ heartbeat: { ts: NOW, name: "alex-main" }, handoffs: ["a", "b"], boardMine: { items: [{}] }, now: NOW });
-  const ctx = buildPrimerContext({ agentJson: { fullName: "Alex Rivera", firstName: "Alex" }, agentRoot: "/r/alex-ai", status });
-  assert.match(ctx, /maestro:identity/);
-  assert.match(ctx, /Alex Rivera/);
-  assert.match(ctx, /alex-main/);
-  assert.match(ctx, /2 open handoffs/);
-  assert.match(ctx, /1 board item/);
-  assert.equal(buildPrimerContext({ agentJson: {}, agentRoot: "/r", status }), "", "no identity → nothing to say");
-  assert.equal(buildPrimerContext({ agentJson: null, agentRoot: "/r", status }), "");
-});

package/lib/session-permissions.test.mjs

@@ -1,120 +0,0 @@
-/**
- * session-permissions.test.mjs — node:test coverage for the H1 permission
- * scoping helper. Pure-function tests: no real claude spawn, no filesystem.
- *
- * Each test that mutates MAESTRO_SCOPED_PERMISSIONS saves + restores it in a
- * try/finally so the env change can't leak into other tests in the same node
- * --test process.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  sessionPermissionArgs,
-  CONSERVATIVE_DEFAULT_ALLOWLIST,
-} from "./session-permissions.mjs";
-import { getCadenceDef } from "../scripts/daemon/cadence-handlers.mjs";
-
-/**
- * Run `fn` with MAESTRO_SCOPED_PERMISSIONS set to `value` (or deleted when
- * value is undefined), restoring the prior value afterwards.
- */
-function withScopedEnv(value, fn) {
-  const prev = process.env.MAESTRO_SCOPED_PERMISSIONS;
-  try {
-    if (value === undefined) delete process.env.MAESTRO_SCOPED_PERMISSIONS;
-    else process.env.MAESTRO_SCOPED_PERMISSIONS = value;
-    return fn();
-  } finally {
-    if (prev === undefined) delete process.env.MAESTRO_SCOPED_PERMISSIONS;
-    else process.env.MAESTRO_SCOPED_PERMISSIONS = prev;
-  }
-}
-
-test("default (env unset) returns the skip-permissions arg — UNCHANGED behaviour", () => {
-  withScopedEnv(undefined, () => {
-    assert.deepEqual(
-      sessionPermissionArgs({ cadence: "daily-morning-brief", mode: "escalate" }),
-      ["--dangerously-skip-permissions"],
-    );
-    // Also unchanged when called with no args at all.
-    assert.deepEqual(sessionPermissionArgs(), ["--dangerously-skip-permissions"]);
-  });
-});
-
-test("non-'1' values do NOT enable scoped mode (only the exact opt-in '1' counts)", () => {
-  for (const v of ["0", "true", "yes", "", "01"]) {
-    withScopedEnv(v, () => {
-      assert.deepEqual(
-        sessionPermissionArgs({ cadence: "daily-morning-brief" }),
-        ["--dangerously-skip-permissions"],
-        `value ${JSON.stringify(v)} must not enable scoped mode`,
-      );
-    });
-  }
-});
-
-test("scoped mode emits --allowedTools from the cadence registry allowlist", () => {
-  // Pick a cadence that carries an explicit allowedTools fixture in the
-  // registry. meeting-prep is read-leaning so it's a natural scoped fixture.
-  const cadence = "meeting-prep";
-  const def = getCadenceDef(cadence);
-  assert.ok(Array.isArray(def?.allowedTools) && def.allowedTools.length > 0,
-    `test fixture expects ${cadence} to declare a non-empty allowedTools array in the registry`);
-  withScopedEnv("1", () => {
-    const args = sessionPermissionArgs({ cadence, mode: def.mode });
-    assert.equal(args.length, 2);
-    assert.equal(args[0], "--allowedTools");
-    assert.equal(args[1], def.allowedTools.join(","));
-  });
-});
-
-test("scoped mode falls back to the conservative default for an unknown cadence", () => {
-  withScopedEnv("1", () => {
-    const args = sessionPermissionArgs({ cadence: "totally-unknown-cadence-xyz" });
-    assert.deepEqual(args, ["--allowedTools", CONSERVATIVE_DEFAULT_ALLOWLIST.join(",")]);
-  });
-});
-
-test("scoped mode falls back to the conservative default when cadence is omitted", () => {
-  withScopedEnv("1", () => {
-    const args = sessionPermissionArgs({});
-    assert.deepEqual(args, ["--allowedTools", CONSERVATIVE_DEFAULT_ALLOWLIST.join(",")]);
-  });
-});
-
-test("conservative default allowlist is read-only / search-only (no write, shell, send, or control-plane tools)", () => {
-  const banned = [
-    "Bash", "Write", "Edit", "exec", "spawn", "shell", "run",
-    "send_slack", "send_email", "cron", "schedule", "gateway",
-  ];
-  for (const tool of CONSERVATIVE_DEFAULT_ALLOWLIST) {
-    assert.ok(
-      !banned.includes(tool),
-      `conservative default must not include the dangerous tool ${tool}`,
-    );
-  }
-  // And it must be non-empty so scoped mode never emits an empty allowlist.
-  assert.ok(CONSERVATIVE_DEFAULT_ALLOWLIST.length > 0);
-});
-
-test("main session: scoped mode never hands the interactive front door the --print allowlist (it would hang on the first prompt)", () => {
-  withScopedEnv("1", () => {
-    // No main-session allowlist configured → bypass, because nobody is
-    // attached to answer a y/n prompt inside the multiplexer.
-    assert.deepEqual(sessionPermissionArgs({ source: "main-session" }), ["--dangerously-skip-permissions"]);
-    assert.deepEqual(sessionPermissionArgs({ source: "main-session", allowedTools: [] }), ["--dangerously-skip-permissions"]);
-    assert.deepEqual(sessionPermissionArgs({ source: "main-session", allowedTools: "Read" }), ["--dangerously-skip-permissions"]);
-    // An operator-defined main-session allowlist IS honoured.
-    assert.deepEqual(
-      sessionPermissionArgs({ source: "main-session", allowedTools: ["Read", " Monitor ", "", 3, "mcp__cohort__*"] }),
-      ["--allowedTools", "Read,Monitor,mcp__cohort__*"],
-    );
-    // Other sources are untouched by the new option.
-    assert.deepEqual(sessionPermissionArgs({ source: "responder", allowedTools: ["Bash"] }), ["--allowedTools", CONSERVATIVE_DEFAULT_ALLOWLIST.join(",")]);
-  });
-  withScopedEnv(undefined, () => {
-    assert.deepEqual(sessionPermissionArgs({ source: "main-session", allowedTools: ["Read"] }), ["--dangerously-skip-permissions"]);
-  });
-});