@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/setup/sections/model.test.mjs

@@ -1,240 +0,0 @@
-/**
- * model.test.mjs — model/provider setup section (order 30) tests.
- *
- * The oauth-token mode is the fleet DEFAULT (§3.9): the operator pastes the
- * output of `claude setup-token`, headless reads CLAUDE_CODE_OAUTH_TOKEN from
- * the environment, and .env ends up 0600 with the token + the prefer flag.
- *
- * Run: node --test lib/setup/sections/model.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, writeFileSync, statSync, existsSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import model, { AUTH_MODES, DEFAULT_AUTH_MODE } from "./model.mjs";
-import * as io from "../io.mjs";
-
-const MAESTRO_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
-
-function tmpRoot(envBody) {
-  const root = mkdtempSync(join(tmpdir(), "maestro-modelsec-"));
-  if (envBody !== undefined) writeFileSync(join(root, ".env"), envBody);
-  return root;
-}
-function ctxFor(root, answers = {}, extra = {}) {
-  return { agentRoot: root, maestroRoot: MAESTRO_ROOT, flags: { headless: true }, headless: true, answers, io, ...extra };
-}
-function readEnv(root) { return readFileSync(join(root, ".env"), "utf-8"); }
-function withEnv(patch, fn) {
-  const saved = {};
-  for (const k of Object.keys(patch)) { saved[k] = process.env[k]; if (patch[k] === undefined) delete process.env[k]; else process.env[k] = patch[k]; }
-  return Promise.resolve().then(fn).finally(() => {
-    for (const k of Object.keys(patch)) { if (saved[k] === undefined) delete process.env[k]; else process.env[k] = saved[k]; }
-  });
-}
-
-test("section shape: id/order=30/hooks; oauth-token is the default of three modes", () => {
-  assert.equal(model.id, "model");
-  assert.equal(model.order, 30);
-  for (const h of ["detect", "prompt", "apply", "verify"]) assert.equal(typeof model[h], "function");
-  assert.deepEqual([...AUTH_MODES], ["oauth-token", "subscription", "api-key"]);
-  assert.equal(DEFAULT_AUTH_MODE, "oauth-token");
-});
-
-test("headless with no answers: provider defaults to oauth-token and the token is read from CLAUDE_CODE_OAUTH_TOKEN", async () => {
-  const root = tmpRoot("");
-  try {
-    await withEnv({ CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-fromenv" }, async () => {
-      const ctx = ctxFor(root);
-      await model.prompt(ctx);
-      assert.equal(ctx.answers.model.provider, "oauth-token");
-      assert.equal(ctx.answers.model.hasToken, true);
-      assert.equal(ctx.answers.claudeOauthToken, "sk-ant-oat01-fromenv", "the value lives under the key the checkpoint redacts, never under answers.model");
-      await model.apply(ctx);
-    });
-    const env = readEnv(root);
-    assert.match(env, /^CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-fromenv$/m);
-    assert.match(env, /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
-    assert.doesNotMatch(env, /^ANTHROPIC_API_KEY=/m);
-    assert.equal(statSync(join(root, ".env")).mode & 0o777, 0o600, ".env is chmod 600 after apply");
-    const d = await model.detect(ctxFor(root));
-    assert.equal(d.status, "complete");
-    assert.match(d.summary, /OAuth token/i);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("the prompt copy tells the operator to run `claude setup-token` on any machine and paste the result", async () => {
-  const root = tmpRoot("");
-  try {
-    const seen = [];
-    const spyIo = {
-      ...io,
-      select: async (_ctx, opts) => { seen.push(opts); return opts.default; },
-      secret: async (_ctx, opts) => { seen.push(opts); return "pasted-token"; },
-      confirm: async (_ctx, opts) => { seen.push(opts); return false; },
-    };
-    const ctx = ctxFor(root, {}, { io: spyIo });
-    await model.prompt(ctx);
-    const select = seen.find((o) => o.key === "provider");
-    assert.ok(select, "the provider select ran");
-    assert.equal(select.default, "oauth-token");
-    const tokenChoice = select.choices.find((c) => c.value === "oauth-token");
-    assert.match(tokenChoice.label, /claude setup-token/);
-    const secret = seen.find((o) => o.key === "claudeOauthToken");
-    assert.ok(secret, "the token secret prompt ran");
-    assert.match(secret.message, /claude setup-token/);
-    assert.match(secret.message, /any machine/i);
-    assert.match(secret.message, /paste/i);
-    assert.equal(secret.env, "CLAUDE_CODE_OAUTH_TOKEN");
-    assert.equal(ctx.answers.claudeOauthToken, "pasted-token");
-    assert.equal(ctx.answers.model.hasToken, true);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("apply is idempotent and never clobbers an existing token", async () => {
-  const root = tmpRoot("CLAUDE_CODE_OAUTH_TOKEN=old-token\n");
-  try {
-    const ctx = ctxFor(root, { provider: "oauth-token", claudeOauthToken: "new-token" });
-    await model.prompt(ctx);
-    await model.apply(ctx);
-    await model.apply(ctx);
-    const env = readEnv(root);
-    assert.equal((env.match(/^CLAUDE_CODE_OAUTH_TOKEN=/gm) || []).length, 1);
-    assert.match(env, /^CLAUDE_CODE_OAUTH_TOKEN=old-token$/m);
-    assert.equal((env.match(/^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/gm) || []).length, 1);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("oauth-token chosen but no token available: still writes the prefer flag, detect reports keychain mode", async () => {
-  const root = tmpRoot("");
-  try {
-    await withEnv({ CLAUDE_CODE_OAUTH_TOKEN: undefined }, async () => {
-      const ctx = ctxFor(root);
-      await model.prompt(ctx);
-      await model.apply(ctx);
-    });
-    const env = readEnv(root);
-    assert.doesNotMatch(env, /^CLAUDE_CODE_OAUTH_TOKEN=/m);
-    assert.match(env, /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
-    const d = await model.detect(ctxFor(root));
-    assert.equal(d.status, "complete");
-    assert.match(d.summary, /keychain/i);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("subscription (keychain) and api-key modes keep working", async () => {
-  const a = tmpRoot("");
-  const b = tmpRoot(undefined); // no .env at all → created 0600
-  try {
-    const ca = ctxFor(a, { provider: "subscription" });
-    await model.prompt(ca); await model.apply(ca);
-    assert.match(readEnv(a), /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
-    assert.doesNotMatch(readEnv(a), /^CLAUDE_CODE_OAUTH_TOKEN=/m);
-
-    const cb = ctxFor(b, { provider: "api-key", anthropicApiKey: "sk-ant-api03-x" });
-    await model.prompt(cb); await model.apply(cb);
-    assert.ok(existsSync(join(b, ".env")));
-    assert.match(readEnv(b), /^ANTHROPIC_API_KEY=sk-ant-api03-x$/m);
-    assert.doesNotMatch(readEnv(b), /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=/m);
-    assert.equal(statSync(join(b, ".env")).mode & 0o777, 0o600);
-    const d = await model.detect(ctxFor(b));
-    assert.match(d.summary, /API key/);
-  } finally { rmSync(a, { recursive: true, force: true }); rmSync(b, { recursive: true, force: true }); }
-});
-
-test("legacy flat answers (no answers.model) still resolve; a bare token answer implies oauth-token", async () => {
-  const root = tmpRoot("");
-  try {
-    const ctx = ctxFor(root, { claudeOauthToken: "flat-token" });
-    await model.apply(ctx); // no prompt() — the headless resume path
-    const env = readEnv(root);
-    assert.match(env, /^CLAUDE_CODE_OAUTH_TOKEN=flat-token$/m);
-    assert.match(env, /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("verify uses the injectable probe (ctx.deps.probeClaude) and surfaces auth + detail", async () => {
-  const root = tmpRoot("CLAUDE_CODE_OAUTH_TOKEN=t\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n");
-  try {
-    const seen = [];
-    const probeClaude = (agentRoot) => { seen.push(agentRoot); return { ok: true, mode: "subscription", auth: "unknown", name: "Claude auth", detail: "could not verify" }; };
-    const r = await model.verify(ctxFor(root, {}, { deps: { probeClaude } }));
-    assert.deepEqual(seen, [root]);
-    assert.equal(r.ok, true);
-    assert.equal(r.checks[0].auth, "unknown");
-    assert.equal(r.checks[0].detail, "could not verify");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-// ---------------------------------------------------------------------------
-// Review 2026-09-08 findings
-// ---------------------------------------------------------------------------
-
-test("a .env seeded from .env.example (empty `KEY=` lines) is FILLED IN, not treated as already set", async () => {
-  // .env.example ships `CLAUDE_CODE_OAUTH_TOKEN=` and `MAESTRO_PREFER_SUBSCRIPTION_AUTH=`
-  // as empty placeholders, and doctor's remedy is "copy from .env.example" —
-  // so this is the common path, and it used to leave the seat with no auth.
-  const root = tmpRoot(readFileSync(join(MAESTRO_ROOT, ".env.example"), "utf-8"));
-  try {
-    await withEnv({ CLAUDE_CODE_OAUTH_TOKEN: undefined }, async () => {
-      const ctx = ctxFor(root, { provider: "oauth-token", claudeOauthToken: "sk-ant-oat01-REAL" });
-      await model.prompt(ctx);
-      await model.apply(ctx);
-    });
-    const env = readEnv(root);
-    assert.match(env, /^CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-REAL$/m);
-    assert.equal((env.match(/^CLAUDE_CODE_OAUTH_TOKEN=/gm) || []).length, 1, "the placeholder line is replaced in place, not duplicated");
-    assert.match(env, /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
-    assert.equal((env.match(/^MAESTRO_PREFER_SUBSCRIPTION_AUTH=/gm) || []).length, 1);
-    const d = await model.detect(ctxFor(root));
-    assert.equal(d.status, "complete");
-    assert.match(d.summary, /OAuth token/i);
-    // The api-key lane had the same latent bug.
-    const b = tmpRoot("ANTHROPIC_API_KEY=\n");
-    try {
-      const cb = ctxFor(b, { provider: "api-key", anthropicApiKey: "sk-ant-api03-x" });
-      await model.prompt(cb); await model.apply(cb);
-      assert.match(readEnv(b), /^ANTHROPIC_API_KEY=sk-ant-api03-x$/m);
-      assert.equal((readEnv(b).match(/^ANTHROPIC_API_KEY=/gm) || []).length, 1);
-    } finally { rmSync(b, { recursive: true, force: true }); }
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("the pasted token and API key never sit in ctx.answers.model — nothing for progress.json to leak", async () => {
-  const root = tmpRoot("");
-  try {
-    const spyIo = {
-      ...io,
-      select: async (_ctx, opts) => opts.default,
-      secret: async (_ctx, _opts) => "sk-ant-oat01-PASTED",
-      confirm: async () => false,
-    };
-    const ctx = ctxFor(root, {}, { io: spyIo });
-    await model.prompt(ctx);
-    const flat = JSON.stringify(ctx.answers.model);
-    assert.doesNotMatch(flat, /PASTED/, "answers.model carries no credential value");
-    assert.equal(ctx.answers.model.provider, "oauth-token");
-    assert.equal(ctx.answers.model.hasToken, true);
-    // The secret lives under its own top-level key, which the checkpoint's
-    // SECRET_ANSWER_KEY_RE already strips on every save.
-    assert.equal(ctx.answers.claudeOauthToken, "sk-ant-oat01-PASTED");
-    await model.apply(ctx);
-    assert.match(readEnv(root), /^CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-PASTED$/m);
-
-    const b = tmpRoot("");
-    try {
-      const spyB = { ...spyIo, select: async () => "api-key", secret: async () => "sk-ant-api03-PASTED" };
-      const cb = ctxFor(b, {}, { io: spyB });
-      await model.prompt(cb);
-      assert.doesNotMatch(JSON.stringify(cb.answers.model), /PASTED/);
-      assert.equal(cb.answers.anthropicApiKey, "sk-ant-api03-PASTED");
-      await model.apply(cb);
-      assert.match(readEnv(b), /^ANTHROPIC_API_KEY=sk-ant-api03-PASTED$/m);
-    } finally { rmSync(b, { recursive: true, force: true }); }
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});

package/lib/setup/sections/org.test.mjs

@@ -1,346 +0,0 @@
-/**
- * org.test.mjs — org-enrollment setup section (order 75) tests.
- * Run: node --test lib/setup/sections/org.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import yaml from "js-yaml";
-
-import org, { buildOrgConfig, readOrgConfig, pullProfileIntoAgentConfig, orgContextShapesBacklog, requestPairing, deriveAgentIdentity, orgIdWarning } from "./org.mjs";
-import { isEnabled } from "../../org/client.mjs";
-import { readAgentJson, writeAgentJson } from "../sot.mjs";
-import * as io from "../io.mjs";
-
-/**
- * A deterministic fake fetch for the pairing handshake: records the calls and
- * replies with a pending pairing frame (the shape hq's pairing.request returns).
- * Never touches the network so the pairing tests stay hermetic + fast.
- */
-function fakePairFetch(reply) {
-  const calls = [];
-  const fn = async (url, init) => {
-    calls.push({ url: String(url), init, body: init && init.body ? JSON.parse(init.body) : null });
-    const r = reply ? reply(url, init) : { ok: true, status: 200, body: { ok: true, result: { status: "pending", code: "PAIR-99" } } };
-    return { ok: r.ok !== false, status: r.status || 200, headers: { get: () => undefined }, json: async () => r.body };
-  };
-  fn.calls = calls;
-  return fn;
-}
-
-const MAESTRO_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
-
-function tmpRoot() {
-  const root = mkdtempSync(join(tmpdir(), "maestro-orgsec-"));
-  mkdirSync(join(root, "config"), { recursive: true });
-  return root;
-}
-function ctxFor(root, answers = {}) {
-  return { agentRoot: root, maestroRoot: MAESTRO_ROOT, flags: { headless: true }, answers, io };
-}
-function readCfg(root) {
-  return yaml.load(readFileSync(join(root, "config", "org.yaml"), "utf8"));
-}
-
-test("section shape: id/order=75/hooks", () => {
-  assert.equal(org.id, "org");
-  assert.equal(org.order, 75);
-  for (const h of ["detect", "prompt", "apply", "verify"]) assert.equal(typeof org[h], "function");
-});
-
-test("orgContextShapesBacklog: true iff strategy streams or a ready board are present", () => {
-  assert.equal(orgContextShapesBacklog(null), false);
-  assert.equal(orgContextShapesBacklog({}), false);
-  assert.equal(orgContextShapesBacklog({ strategy: {}, board: [] }), false);
-  assert.equal(orgContextShapesBacklog({ strategy: { streams: [{ code: "GTM" }] } }), true);
-  assert.equal(orgContextShapesBacklog({ board: [{ title: "do a thing" }] }), true);
-});
-
-test("detect: unconfigured before apply", async () => {
-  const root = tmpRoot();
-  const before = await org.detect(ctxFor(root));
-  assert.equal(before.status, "unconfigured");
-  assert.ok(before.missing.includes("config/org.yaml"));
-});
-
-test("apply with base + token writes a valid, ENABLED config/org.yaml", async () => {
-  const root = tmpRoot();
-  await org.apply(ctxFor(root, { orgBase: "https://cohort.example", orgId: "acme", orgToken: "tok-123" }));
-  assert.ok(existsSync(join(root, "config", "org.yaml")));
-  const cfg = readCfg(root);
-  assert.equal(cfg.org.cohort.base, "https://cohort.example");
-  assert.equal(cfg.org.cohort.orgId, "acme");
-  assert.equal(cfg.org.cohort.token, "tok-123");
-  assert.equal(cfg.org.cohort.enabled, true);
-  // The shape is exactly what lib/org/client.isEnabled() consumes.
-  assert.equal(isEnabled(cfg), true);
-});
-
-test("apply trims a trailing slash from the base URL", async () => {
-  const root = tmpRoot();
-  await org.apply(ctxFor(root, { orgBase: "https://cohort.example/", orgToken: "tok" }));
-  assert.equal(readCfg(root).org.cohort.base, "https://cohort.example");
-});
-
-test("apply with a pairing code but no token records intent but stays DISABLED", async () => {
-  const root = tmpRoot();
-  const f = fakePairFetch();
-  const ctx = { ...ctxFor(root, { orgBase: "https://cohort.example", orgPairingCode: "PAIR-99" }), pairFetchImpl: f };
-  await org.apply(ctx);
-  const cfg = readCfg(root);
-  assert.equal(cfg.org.cohort.base, "https://cohort.example");
-  assert.equal(cfg.org.cohort.enabled, false, "no token yet → fail-closed on the credential");
-  assert.equal(isEnabled(cfg), false);
-  // The handshake ran (pre-auth, no bearer) and the intent is persisted.
-  assert.equal(f.calls.length, 1);
-  assert.equal(f.calls[0].url, "https://cohort.example/api/v1/pairing.request");
-  assert.equal(f.calls[0].init.headers.authorization, undefined, "pairing.request is UNAUTHENTICATED");
-  assert.equal(f.calls[0].body.code, "PAIR-99");
-  assert.ok(f.calls[0].body.pubkey, "the device public key rides in the handshake");
-  assert.equal(cfg.org.cohort.pairing.code, "PAIR-99");
-  assert.equal(cfg.org.cohort.pairing.status, "pending");
-  assert.equal(ctx.answers.pairingRequested, true);
-});
-
-test("requestPairing: derives agentId from agent.json, persists pairing intent, stays disabled", async () => {
-  const root = tmpRoot();
-  writeAgentJson(root, { firstName: "Alex", lastName: "Rivera", email: "alex.rivera@acme.com", fullName: "Alex Rivera" });
-  const f = fakePairFetch();
-  const res = await requestPairing(root, { base: "https://cohort.example/", code: "TEAM-7", orgId: "acme", fetchImpl: f });
-  assert.equal(res.ok, true);
-  assert.equal(res.agentId, "alex-rivera");
-  assert.equal(res.status, "pending");
-  assert.equal(f.calls[0].body.agentId, "alex-rivera");
-  assert.equal(f.calls[0].body.displayName, "Alex Rivera");
-  const cfg = readCfg(root);
-  assert.equal(cfg.org.cohort.pairing.code, "TEAM-7");
-  assert.equal(cfg.org.cohort.orgId, "acme");
-  assert.equal(isEnabled(cfg), false, "pairing alone never enables the plane");
-  // A device key was materialised under state/org/.
-  assert.ok(existsSync(join(root, "state", "org", "device-key.pem")));
-});
-
-test("requestPairing: short/absent code → fail-open error, no fetch", async () => {
-  const root = tmpRoot();
-  const f = fakePairFetch();
-  assert.equal((await requestPairing(root, { base: "https://n", code: "ab", fetchImpl: f })).ok, false);
-  assert.equal((await requestPairing(root, { code: "abcd", fetchImpl: f })).ok, false, "missing base");
-  assert.equal(f.calls.length, 0);
-});
-
-test("requestPairing: unreachable server records intent + returns ok:false (fail-open)", async () => {
-  const root = tmpRoot();
-  const f = fakePairFetch(() => ({ ok: false, status: 0, body: null }));
-  const res = await requestPairing(root, { base: "https://cohort.example", code: "DOWN-1", fetchImpl: f });
-  assert.equal(res.ok, false);
-  // The intent is still persisted so a later `maestro pair` / setup knows about it.
-  const cfg = readCfg(root);
-  assert.equal(cfg.org.cohort.pairing.code, "DOWN-1");
-  assert.equal(cfg.org.cohort.pairing.status, "error");
-});
-
-test("deriveAgentIdentity: COHORT_AGENT_ID wins, else email local-part, else name", () => {
-  const root = tmpRoot();
-  writeAgentJson(root, { email: "robin.vega@x.io", fullName: "Robin Vega" });
-  assert.equal(deriveAgentIdentity(root).agentId, "robin-vega");
-  const saved = process.env.COHORT_AGENT_ID;
-  process.env.COHORT_AGENT_ID = "Robin The Bot";
-  try { assert.equal(deriveAgentIdentity(root).agentId, "robin-the-bot"); }
-  finally { if (saved === undefined) delete process.env.COHORT_AGENT_ID; else process.env.COHORT_AGENT_ID = saved; }
-});
-
-test("detect: surfaces a pending pairing handshake honestly", async () => {
-  const root = tmpRoot();
-  const f = fakePairFetch();
-  await org.apply({ ...ctxFor(root, { orgBase: "https://cohort.example", orgPairingCode: "SEE-ME" }), pairFetchImpl: f });
-  const d = await org.detect(ctxFor(root));
-  assert.equal(d.status, "partial");
-  assert.match(d.summary, /pairing pending \(code SEE-ME\)/);
-});
-
-test("apply with nothing supplied writes a disabled stub (idempotent artefact)", async () => {
-  const root = tmpRoot();
-  await org.apply(ctxFor(root, {}));
-  assert.ok(existsSync(join(root, "config", "org.yaml")));
-  const cfg = readCfg(root);
-  assert.equal(isEnabled(cfg), false);
-});
-
-test("apply is idempotent and preserves operator fields (trustedSignersPem)", async () => {
-  const root = tmpRoot();
-  // Operator pre-seeds pinned signer PEMs.
-  writeFileSync(
-    join(root, "config", "org.yaml"),
-    yaml.dump({ org: { cohort: { base: "https://old", token: "old-tok", trustedSignersPem: ["-----PEM-----"] } } })
-  );
-  await org.apply(ctxFor(root, { orgBase: "https://cohort.new", orgToken: "new-tok" }));
-  const cfg = readCfg(root);
-  assert.equal(cfg.org.cohort.base, "https://cohort.new");
-  assert.equal(cfg.org.cohort.token, "new-tok");
-  // The pinned signer PEMs survive the merge.
-  assert.deepEqual(cfg.org.cohort.trustedSignersPem, ["-----PEM-----"]);
-  // Re-applying with no answers must not clobber the now-enabled config.
-  await org.apply(ctxFor(root, {}));
-  const cfg2 = readCfg(root);
-  assert.equal(cfg2.org.cohort.base, "https://cohort.new");
-  assert.equal(cfg2.org.cohort.token, "new-tok");
-  assert.equal(isEnabled(cfg2), true);
-});
-
-test("buildOrgConfig: pure merge keeps existing cohort fields", () => {
-  const existing = { org: { cohort: { base: "https://a", token: "t", orgId: "x" } }, other: 1 };
-  const next = buildOrgConfig(existing, { orgId: undefined });
-  assert.equal(next.other, 1, "unrelated top-level keys preserved");
-  assert.equal(next.org.cohort.base, "https://a");
-  assert.equal(next.org.cohort.orgId, "x");
-});
-
-test("readOrgConfig returns {} when file absent (never throws)", async () => {
-  const root = tmpRoot();
-  assert.deepEqual(await readOrgConfig(root), {});
-});
-
-test("detect: complete after an enabled apply", async () => {
-  const root = tmpRoot();
-  await org.apply(ctxFor(root, { orgBase: "https://cohort.example", orgToken: "tok" }));
-  const d = await org.detect(ctxFor(root));
-  assert.equal(d.status, "complete");
-});
-
-test("detect: partial when file present but not enabled", async () => {
-  const root = tmpRoot();
-  // A too-short code never opens a handshake (requestPairing fail-opens before
-  // any fetch), so this exercises the plain not-enabled partial branch.
-  const f = fakePairFetch();
-  await org.apply({ ...ctxFor(root, { orgBase: "https://cohort.example", orgPairingCode: "P" }), pairFetchImpl: f });
-  assert.equal(f.calls.length, 0, "a <4-char code does not hit the network");
-  const d = await org.detect(ctxFor(root));
-  assert.equal(d.status, "partial");
-});
-
-test("verify is NON-BLOCKING and never hard-fails when not enrolled", async () => {
-  const root = tmpRoot();
-  await org.apply(ctxFor(root, {})); // disabled stub
-  const res = await org.verify(ctxFor(root));
-  assert.equal(res.ok, true, "an un-enrolled agent must not fail setup");
-  const byName = Object.fromEntries(res.checks.map((c) => [c.name, c.ok]));
-  assert.equal(byName["config/org.yaml present"], true);
-  // The optional-enrollment warn is present with a remedy.
-  const warn = res.checks.find((c) => /not enrolled/.test(c.name));
-  assert.ok(warn && warn.remedy);
-});
-
-// --- Cohort-driven setup pull (COHORT_API_KEY + COHORT_ORG_ID) ----------
-
-const PULL_PROFILE = {
-  slug: "robin", kind: "agent", displayName: "Robin Vega", firstName: "Robin", lastName: "Vega",
-  title: "VP Eng", team: "Platform", role: "engineering-lead", agentEmail: "robin@example.com",
-  supervisor: { displayName: "Layla Al-Masri", title: "CTO", email: "layla@example.com" },
-};
-
-function withCohortEnv(vars, fn) {
-  const keys = ["COHORT_API_KEY", "COHORT_ORG_ID", "COHORT_AGENT_ID", "COHORT_BASE"];
-  const saved = Object.fromEntries(keys.map((k) => [k, process.env[k]]));
-  for (const k of keys) delete process.env[k];
-  Object.assign(process.env, vars);
-  return Promise.resolve()
-    .then(fn)
-    .finally(() => { for (const k of keys) { if (saved[k] === undefined) delete process.env[k]; else process.env[k] = saved[k]; } });
-}
-
-test("pullProfileIntoAgentConfig: env + mocked profile populates config/agent.json", async () => {
-  const root = tmpRoot();
-  await withCohortEnv({ COHORT_API_KEY: "k", COHORT_ORG_ID: "acme", COHORT_AGENT_ID: "robin", COHORT_BASE: "https://cohort.example" }, async () => {
-    const plan = await pullProfileIntoAgentConfig(root, { fetchSelfProfileImpl: async () => ({ ok: true, result: PULL_PROFILE }) });
-    assert.equal(plan.pulled, true);
-  });
-  const id = readAgentJson(root);
-  assert.equal(id.firstName, "Robin");
-  assert.equal(id.email, "robin@example.com");
-  assert.equal(id.function, "technical-leader");
-  assert.equal(id.principal.fullName, "Layla Al-Masri");
-});
-
-test("apply: with COHORT_* env present, pulls the profile into config/agent.json", async () => {
-  const root = tmpRoot();
-  // The real fetchSelfProfile is exercised via an injected global fetch.
-  const savedFetch = globalThis.fetch;
-  const calls = [];
-  globalThis.fetch = async (url) => {
-    calls.push(String(url));
-    return { ok: true, status: 200, headers: { get: () => undefined }, json: async () => PULL_PROFILE };
-  };
-  try {
-    await withCohortEnv({ COHORT_API_KEY: "k", COHORT_ORG_ID: "acme", COHORT_AGENT_ID: "robin", COHORT_BASE: "https://cohort.example" }, async () => {
-      const ctx = ctxFor(root, { orgBase: "https://cohort.example", orgToken: "tok" });
-      await org.apply(ctx);
-      assert.equal(ctx.answers.cohortPulled, true, "apply records that a pull happened");
-    });
-  } finally {
-    globalThis.fetch = savedFetch;
-  }
-  assert.ok(calls.some((u) => u.includes("/api/v1/org/members/robin")), "hit the org-data members endpoint");
-  const id = readAgentJson(root);
-  assert.equal(id.firstName, "Robin");
-  assert.equal(id.title, "VP Eng");
-});
-
-test("apply: absent COHORT_* env → no pull, config/agent.json untouched (manual path)", async () => {
-  const root = tmpRoot();
-  await withCohortEnv({}, async () => {
-    const ctx = ctxFor(root, { orgBase: "https://cohort.example", orgToken: "tok" });
-    await org.apply(ctx);
-    assert.equal(ctx.answers.cohortPulled, undefined);
-  });
-  assert.equal(readAgentJson(root), null, "no agent.json written by the org section");
-});
-
-test("verify does NOT block / hard-fail on an unreachable enabled server (fail-open)", async () => {
-  const root = tmpRoot();
-  // Point at an unroutable endpoint; the client's fetch will fail fast.
-  await org.apply(ctxFor(root, { orgBase: "http://127.0.0.1:0", orgToken: "tok" }));
-  const res = await org.verify(ctxFor(root));
-  // Reachability is best-effort: ok stays true so setup never blocks on the network.
-  assert.equal(res.ok, true);
-  const reach = res.checks.find((c) => /reachab/i.test(c.name));
-  assert.ok(reach, "a reachability check is recorded");
-  assert.equal(reach.ok, true, "reachability must never hard-fail setup");
-});
-
-// ---------------------------------------------------------------------------
-// F2 (audit 2026-09-08): the wizard must not silently accept the org SLUG as
-// COHORT_ORG_ID — hq compares the pin with strict equality against the org ID
-// (`org_default_<slug>`), so a slug 401s every call.
-// ---------------------------------------------------------------------------
-
-test("orgIdWarning: a slug-shaped value gets a warning naming the ID form; an ID or blank gets none", () => {
-  assert.equal(orgIdWarning(""), null);
-  assert.equal(orgIdWarning("org_default_acme"), null);
-  const w = orgIdWarning("acme");
-  assert.match(w, /slug/i);
-  assert.match(w, /org_default_acme/);
-  assert.match(w, /401/);
-});
-
-test("verify: a slug-shaped orgId in config/org.yaml is a failing check with the remedy; the ID form passes", async () => {
-  const root = tmpRoot();
-  try {
-    await org.apply(ctxFor(root, { orgBase: "https://cohort.example", orgId: "acme", orgToken: "tok-123" }));
-    const bad = await org.verify(ctxFor(root));
-    const shape = bad.checks.find((c) => /COHORT_ORG_ID/.test(c.name));
-    assert.ok(shape, "the shape check ran");
-    assert.equal(shape.ok, false);
-    assert.match(shape.remedy, /org_default_acme/);
-    assert.equal(bad.ok, false);
-
-    writeFileSync(join(root, "config", "org.yaml"), "org:\n  cohort:\n    enabled: true\n    base: https://cohort.example\n    orgId: org_default_acme\n    token: tok-123\n");
-    const good = await org.verify(ctxFor(root));
-    const shape2 = good.checks.find((c) => /COHORT_ORG_ID/.test(c.name));
-    assert.ok(shape2 && shape2.ok === true, "the ID form is accepted");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});