@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/scripts/poller-launchd/install.test.mjs

@@ -1,243 +0,0 @@
-/**
- * install.test.mjs — scripts/poller-launchd/{install.sh, poller.plist.template,
- * launchd-poller-wrapper.sh}
- *
- * Audit F6: install.sh used to grep SLACK_USER_TOKEN out of .env and `sed` it
- * into the rendered plist — an unescaped substitution that left the secret in
- * a 0644 file under ~/Library/LaunchAgents. Now the plist runs
- * launchd-poller-wrapper.sh, which sources .env (0600) at start and execs
- * node; the plist carries no secret and is chmod 600 regardless.
- *
- * install.sh calls launchctl; the tests stub it. The wrapper resolves node
- * via MAESTRO_NODE_BIN first so a stub node can prove .env reached the child.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync, statSync, copyFileSync, rmSync, realpathSync } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { join, dirname } from "node:path";
-import { tmpdir } from "node:os";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const installSrc = readFileSync(join(__dirname, "install.sh"), "utf8");
-const templateSrc = readFileSync(join(__dirname, "poller.plist.template"), "utf8");
-
-const SECRET = "xoxp-not-a-real-token-0123456789";
-
-function fixture() {
-  const root = mkdtempSync(join(tmpdir(), "poller-launchd-test-"));
-  const agent = join(root, "agent");
-  const home = join(root, "home");
-  const bin = join(root, "bin");
-  const log = join(root, "calls.log");
-  mkdirSync(join(agent, "scripts", "poller-launchd"), { recursive: true });
-  mkdirSync(join(agent, "scripts", "poller"), { recursive: true });
-  mkdirSync(join(agent, "config"), { recursive: true });
-  mkdirSync(join(agent, "logs", "polling"), { recursive: true });
-  mkdirSync(join(home, "Library", "LaunchAgents"), { recursive: true });
-  mkdirSync(bin, { recursive: true });
-  for (const f of ["install.sh", "poller.plist.template", "launchd-poller-wrapper.sh"]) {
-    if (existsSync(join(__dirname, f))) copyFileSync(join(__dirname, f), join(agent, "scripts", "poller-launchd", f));
-  }
-  for (const f of ["install.sh", "launchd-poller-wrapper.sh"]) {
-    const p = join(agent, "scripts", "poller-launchd", f);
-    if (existsSync(p)) chmodSync(p, 0o755);
-  }
-  writeFileSync(join(agent, "config", "agent.json"), JSON.stringify({ firstName: "Ivy" }));
-  // dotenv-shaped, deliberately awkward: an unquoted value with spaces (legal
-  // for Node's dotenv, fatal under `source`), an inline comment, a quoted
-  // value containing `#`, an `export` prefix, and a `$` that must NOT expand.
-  writeFileSync(join(agent, ".env"), [
-    "# agent env",
-    `SLACK_USER_TOKEN=${SECRET}`,
-    "OTHER_VALUE=with spaces   # trailing comment",
-    'QUOTED="a # not a comment"',
-    "export EXPORTED=yes",
-    "LITERAL='$HOME stays literal'",
-    "",
-  ].join("\n"));
-  chmodSync(join(agent, ".env"), 0o600);
-  writeFileSync(join(bin, "launchctl"), `#!/bin/bash\necho "launchctl $*" >> "${log}"\nexit 0\n`);
-  chmodSync(join(bin, "launchctl"), 0o755);
-  return { root, agent, home, bin, log };
-}
-
-const env = (fx, extra = {}) => ({ HOME: fx.home, PATH: `${fx.bin}:/usr/bin:/bin`, ...extra });
-const plistPath = (fx) => join(fx.home, "Library", "LaunchAgents", "ai.maestro.ivy-poller.plist");
-
-// --- static ------------------------------------------------------------------
-
-test("install.sh no longer greps SLACK_USER_TOKEN nor seds XML", () => {
-  assert.ok(!/SLACK_USER_TOKEN/.test(installSrc), "install.sh must not read the Slack token");
-  assert.ok(!/sed -i/.test(installSrc), "install.sh must not edit the rendered plist in place");
-  assert.match(installSrc, /chmod 600/, "the plist must be chmod 600");
-});
-
-test("the template runs the wrapper, not node directly, and carries no env secrets", () => {
-  assert.match(templateSrc, /launchd-poller-wrapper\.sh/);
-  assert.ok(!/SLACK_USER_TOKEN/.test(templateSrc));
-  assert.ok(!/\{\{NODE_BIN\}\}/.test(templateSrc), "node is resolved by the wrapper, not templated into the plist");
-});
-
-// --- install.sh --------------------------------------------------------------
-
-test("install.sh renders a 0600 plist running the wrapper with no secret in it", () => {
-  const fx = fixture();
-  try {
-    const r = spawnSync("/bin/bash", [join(fx.agent, "scripts", "poller-launchd", "install.sh")], { encoding: "utf8", env: env(fx) });
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    const p = plistPath(fx);
-    assert.ok(existsSync(p), "plist must be installed under ~/Library/LaunchAgents");
-    const body = readFileSync(p, "utf8");
-    assert.ok(!body.includes(SECRET), "the Slack token must not be in the plist");
-    assert.ok(!/SLACK_USER_TOKEN/.test(body));
-    assert.match(body, /<string>ai\.maestro\.ivy-poller<\/string>/);
-    assert.match(body, new RegExp(`<string>${fx.agent.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/scripts/poller-launchd/launchd-poller-wrapper\\.sh</string>`));
-    assert.ok(!/\{\{[A-Z_]+\}\}/.test(body), `unresolved template tokens:\n${body}`);
-    assert.equal(statSync(p).mode & 0o777, 0o600, "plist must be 0600");
-    const calls = readFileSync(fx.log, "utf8");
-    assert.match(calls, /launchctl load .*ai\.maestro\.ivy-poller\.plist/);
-    assert.ok(!/SLACK_USER_TOKEN|Injected/.test(r.stdout), "install output must not mention the token");
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("install.sh is idempotent (re-run replaces the plist, still 0600)", () => {
-  const fx = fixture();
-  try {
-    const script = join(fx.agent, "scripts", "poller-launchd", "install.sh");
-    assert.equal(spawnSync("/bin/bash", [script], { encoding: "utf8", env: env(fx) }).status, 0);
-    // Simulate a previously-installed world-readable plist.
-    chmodSync(plistPath(fx), 0o644);
-    assert.equal(spawnSync("/bin/bash", [script], { encoding: "utf8", env: env(fx) }).status, 0);
-    assert.equal(statSync(plistPath(fx)).mode & 0o777, 0o600);
-    assert.match(readFileSync(fx.log, "utf8"), /launchctl unload/);
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-// --- wrapper -----------------------------------------------------------------
-
-test("launchd-poller-wrapper.sh sources .env and execs node on scripts/poller/index.mjs", () => {
-  const fx = fixture();
-  try {
-    const wrapper = join(fx.agent, "scripts", "poller-launchd", "launchd-poller-wrapper.sh");
-    assert.ok(existsSync(wrapper), "wrapper must exist");
-    // A stub node that reports what reached it.
-    const stubNode = join(fx.bin, "node");
-    writeFileSync(stubNode, `#!/bin/bash\necho "ARGV=$*"\necho "TOKEN=$SLACK_USER_TOKEN"\necho "OTHER=[$OTHER_VALUE]"\necho "QUOTED=[$QUOTED]"\necho "EXPORTED=[$EXPORTED]"\necho "LITERAL=[$LITERAL]"\necho "AGENT_ROOT=$AGENT_ROOT"\n`);
-    chmodSync(stubNode, 0o755);
-    const r = spawnSync("/bin/bash", [wrapper], { encoding: "utf8", env: env(fx, { MAESTRO_NODE_BIN: stubNode }) });
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    assert.match(r.stdout, new RegExp(`ARGV=.*scripts/poller/index\\.mjs`), `stdout:\n${r.stdout}`);
-    assert.match(r.stdout, new RegExp(`TOKEN=${SECRET}`), ".env must be sourced so the token reaches the poller");
-    assert.match(r.stdout, /OTHER=\[with spaces\]/, "unquoted value with spaces survives; inline comment stripped");
-    assert.match(r.stdout, /QUOTED=\[a # not a comment\]/, "a quoted value keeps its #");
-    assert.match(r.stdout, /EXPORTED=\[yes\]/, "`export KEY=` lines are accepted");
-    assert.match(r.stdout, /LITERAL=\[\$HOME stays literal\]/, "no expansion of $ inside values");
-    // The wrapper resolves AGENT_ROOT with `pwd -P` (macOS: /var → /private/var).
-    assert.match(r.stdout, new RegExp(`AGENT_ROOT=${realpathSync(fx.agent).replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`));
-    // The secret must never be echoed by the wrapper itself.
-    assert.ok(!r.stderr.includes(SECRET));
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("launchd-poller-wrapper.sh runs without a .env (fail-open)", () => {
-  const fx = fixture();
-  try {
-    rmSync(join(fx.agent, ".env"));
-    const stubNode = join(fx.bin, "node");
-    writeFileSync(stubNode, "#!/bin/bash\necho ok\n");
-    chmodSync(stubNode, 0o755);
-    const wrapper = join(fx.agent, "scripts", "poller-launchd", "launchd-poller-wrapper.sh");
-    const r = spawnSync("/bin/bash", [wrapper], { encoding: "utf8", env: env(fx, { MAESTRO_NODE_BIN: stubNode }) });
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-// --- review fixes (2026-09-08) ---------------------------------------------
-
-test("launchd-poller-wrapper.sh strips a trailing CR (CRLF .env) and never overrides a variable already in the environment (dotenv semantics)", () => {
-  const fx = fixture();
-  try {
-    writeFileSync(join(fx.agent, ".env"), `SLACK_USER_TOKEN=${SECRET}\r\nPRESET=from-dotenv\r\nOTHER_VALUE=plain\r\n`);
-    const stubNode = join(fx.bin, "node");
-    writeFileSync(stubNode, `#!/bin/bash\nprintf 'TOKEN=[%s]\\n' "$SLACK_USER_TOKEN"\nprintf 'PRESET=[%s]\\n' "$PRESET"\nprintf 'OTHER=[%s]\\n' "$OTHER_VALUE"\n`);
-    chmodSync(stubNode, 0o755);
-    const wrapper = join(fx.agent, "scripts", "poller-launchd", "launchd-poller-wrapper.sh");
-    const r = spawnSync("/bin/bash", [wrapper], { encoding: "utf8", env: env(fx, { MAESTRO_NODE_BIN: stubNode, PRESET: "from-env" }) });
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    assert.match(r.stdout, new RegExp(`TOKEN=\\[${SECRET}\\]`), `CR must be stripped:\n${JSON.stringify(r.stdout)}`);
-    assert.match(r.stdout, /PRESET=\[from-env\]/, "a variable already set in the environment wins (dotenv does not override)");
-    assert.match(r.stdout, /OTHER=\[plain\]/);
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-// migrate.sh — audit F6 follow-through for plists installed by the OLD install.sh
-// (SLACK_USER_TOKEN inline, mode 644). Re-renders the agent's own poller plist
-// through install.sh; a foreign agent's plist is only tightened to 0600.
-
-const migratePath = join(__dirname, "migrate.sh");
-const oldPlist = (label, secret) => `<?xml version="1.0" encoding="UTF-8"?>
-<plist version="1.0"><dict>
-  <key>Label</key><string>${label}</string>
-  <key>EnvironmentVariables</key><dict><key>SLACK_USER_TOKEN</key><string>${secret}</string></dict>
-</dict></plist>
-`;
-
-function migrateFixture() {
-  const fx = fixture();
-  copyFileSync(migratePath, join(fx.agent, "scripts", "poller-launchd", "migrate.sh"));
-  chmodSync(join(fx.agent, "scripts", "poller-launchd", "migrate.sh"), 0o755);
-  return fx;
-}
-
-test("migrate.sh re-renders an installed poller plist that carries SLACK_USER_TOKEN at 0644 — secret gone, 0600, job reloaded", () => {
-  const fx = migrateFixture();
-  try {
-    writeFileSync(plistPath(fx), oldPlist("ai.maestro.ivy-poller", SECRET));
-    chmodSync(plistPath(fx), 0o644);
-    const r = spawnSync("/bin/bash", [join(fx.agent, "scripts", "poller-launchd", "migrate.sh")], { encoding: "utf8", env: env(fx) });
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    const body = readFileSync(plistPath(fx), "utf8");
-    assert.ok(!body.includes(SECRET) && !/SLACK_USER_TOKEN/.test(body), "the secret must be gone from the plist");
-    assert.match(body, /launchd-poller-wrapper\.sh/, "must be the wrapper-based render");
-    assert.equal(statSync(plistPath(fx)).mode & 0o777, 0o600);
-    assert.match(readFileSync(fx.log, "utf8"), /launchctl load .*ai\.maestro\.ivy-poller\.plist/, "the job is reloaded on the new render");
-    assert.ok(!(r.stdout + r.stderr).includes(SECRET), "the migration must never echo the secret");
-    assert.match(r.stdout, /migrated|re-rendered/i);
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("migrate.sh is a no-op on a clean seat (no poller plist, or a wrapper-based 0600 one) and idempotent", () => {
-  const fx = migrateFixture();
-  try {
-    const script = join(fx.agent, "scripts", "poller-launchd", "migrate.sh");
-    // No poller plist at all.
-    let r = spawnSync("/bin/bash", [script], { encoding: "utf8", env: env(fx) });
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    assert.ok(!existsSync(fx.log), `nothing to do → no launchctl calls; got:\n${existsSync(fx.log) ? readFileSync(fx.log, "utf8") : ""}`);
-    // A current render.
-    assert.equal(spawnSync("/bin/bash", [join(fx.agent, "scripts", "poller-launchd", "install.sh")], { encoding: "utf8", env: env(fx) }).status, 0);
-    rmSync(fx.log, { force: true });
-    r = spawnSync("/bin/bash", [script], { encoding: "utf8", env: env(fx) });
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    assert.ok(!existsSync(fx.log), "a clean plist is left alone (no unload/load churn)");
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});
-
-test("migrate.sh tightens a foreign agent's leaking poller plist to 0600 without re-rendering it", () => {
-  const fx = migrateFixture();
-  try {
-    const foreign = join(fx.home, "Library", "LaunchAgents", "ai.maestro.zed-poller.plist");
-    writeFileSync(foreign, oldPlist("ai.maestro.zed-poller", SECRET));
-    chmodSync(foreign, 0o644);
-    const r = spawnSync("/bin/bash", [join(fx.agent, "scripts", "poller-launchd", "migrate.sh")], { encoding: "utf8", env: env(fx) });
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-    assert.equal(statSync(foreign).mode & 0o777, 0o600, "at least no longer world-readable");
-    assert.ok(readFileSync(foreign, "utf8").includes(SECRET), "not ours to re-render (its agent dir is unknown)");
-    assert.match(r.stdout, /zed-poller/);
-    assert.match(r.stdout, /install\.sh/, "must say how to finish the migration from that agent's dir");
-    assert.ok(!(r.stdout + r.stderr).includes(SECRET));
-  } finally { rmSync(fx.root, { recursive: true, force: true }); }
-});

package/scripts/restore-from-backup.test.mjs

@@ -1,181 +0,0 @@
-/**
- * restore-from-backup.test.mjs — coverage for scripts/restore-from-backup.sh.
- *
- * Drives the script with --dry-run over a tmp fixture (a real .tar.gz of a fake
- * config/state/logs tree) and asserts:
- *   - `bash -n` is clean (no syntax errors)
- *   - --dry-run lists every restore step and the manual follow-ups
- *   - --dry-run touches NOTHING on disk (no dirs moved/created in the agent dir)
- *   - the required-arg + unknown-arg + help paths exit with the right codes
- *   - an encrypted (.gpg) archive surfaces the decrypt step in the plan
- *
- * No live decrypt / pairing happens — --dry-run prints the plan only.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import {
-  mkdtempSync,
-  mkdirSync,
-  writeFileSync,
-  readdirSync,
-  rmSync,
-  existsSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { spawnSync } from "node:child_process";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const SCRIPT = resolve(__dirname, "restore-from-backup.sh");
-
-/** Build a tmp dir + a real .tar.gz containing config/, state/, logs/. */
-function makeArchive() {
-  const root = mkdtempSync(join(tmpdir(), "restore-test-"));
-  const src = join(root, "src");
-  for (const d of ["config", "state", "logs"]) {
-    mkdirSync(join(src, d), { recursive: true });
-    writeFileSync(join(src, d, "marker.txt"), `restored-${d}\n`);
-  }
-  const archive = join(root, "backup.tar.gz");
-  const tar = spawnSync("tar", ["-czf", archive, "-C", src, "config", "state", "logs"], {
-    encoding: "utf-8",
-  });
-  assert.equal(tar.status, 0, `tar failed: ${tar.stderr}`);
-  return { root, archive };
-}
-
-function run(args, opts = {}) {
-  return spawnSync("bash", [SCRIPT, ...args], { encoding: "utf-8", ...opts });
-}
-
-function cleanup(p) {
-  rmSync(p, { recursive: true, force: true });
-}
-
-test("bash -n: the script has no syntax errors", () => {
-  const r = spawnSync("bash", ["-n", SCRIPT], { encoding: "utf-8" });
-  assert.equal(r.status, 0, `bash -n failed: ${r.stderr}`);
-});
-
-test("--dry-run lists every restore step and the manual follow-ups", () => {
-  const { root, archive } = makeArchive();
-  const agentDir = join(root, "agent");
-  mkdirSync(agentDir, { recursive: true });
-  try {
-    const r = run(["--archive", archive, "--agent-dir", agentDir, "--dry-run"]);
-    assert.equal(r.status, 0, `nonzero exit: ${r.stderr}`);
-    const out = r.stdout;
-
-    // The five numbered steps are all present.
-    assert.match(out, /Step 1\/5: validate \+ decrypt/);
-    assert.match(out, /Step 2\/5: unpack/);
-    assert.match(out, /Step 3\/5: restore the durable trees/);
-    assert.match(out, /Step 4\/5: re-establish org-server \(Cohort\) identity/);
-    assert.match(out, /Step 5\/5: remaining MANUAL steps/);
-
-    // Every tree the DEFAULT backup include set archives must also be a tree
-    // the restore puts back — otherwise the archive carries data the recovery
-    // silently leaves in the scratch dir. (lib/backup/policy.mjs
-    // DEFAULT_INCLUDE, plus logs/ which an operator may add explicitly.)
-    for (const dir of ["config", "state", "knowledge", "memory", "outputs", "logs", "\\.maestro"]) {
-      assert.match(out, new RegExp(`would restore ${dir}/`), `restore plan omits ${dir}/`);
-    }
-
-    // The irreducibly-manual follow-ups: secret recovery + cohort re-pair.
-    assert.match(out, /maestro secrets sync/);
-    assert.match(out, /cohort .* pair approve/);
-    assert.match(out, /resume-operations\.sh/);
-    assert.match(out, /init backup-replication/);
-
-    // Dry-run banner.
-    assert.match(out, /dry-run — nothing changed/);
-  } finally {
-    cleanup(root);
-  }
-});
-
-test("--dry-run touches NOTHING in the agent dir", () => {
-  const { root, archive } = makeArchive();
-  const agentDir = join(root, "agent");
-  mkdirSync(agentDir, { recursive: true });
-  // Seed an existing state/ to prove dry-run does not move it aside.
-  mkdirSync(join(agentDir, "state"), { recursive: true });
-  writeFileSync(join(agentDir, "state", "pre-existing.txt"), "keep me\n");
-  const before = readdirSync(agentDir).sort();
-  try {
-    const r = run(["--archive", archive, "--agent-dir", agentDir, "--dry-run"]);
-    assert.equal(r.status, 0);
-    const after = readdirSync(agentDir).sort();
-    assert.deepEqual(after, before, "dry-run must not create/move any dir");
-    // No .pre-restore.* backup was created.
-    assert.ok(
-      !after.some((n) => n.includes("pre-restore")),
-      "dry-run must not produce a pre-restore backup"
-    );
-    assert.ok(existsSync(join(agentDir, "state", "pre-existing.txt")), "pre-existing state untouched");
-  } finally {
-    cleanup(root);
-  }
-});
-
-test("encrypted (.gpg) archive surfaces the decrypt step in the dry-run plan", () => {
-  const root = mkdtempSync(join(tmpdir(), "restore-enc-"));
-  const agentDir = join(root, "agent");
-  mkdirSync(agentDir, { recursive: true });
-  try {
-    // A .gpg path need not exist for a dry-run rehearsal.
-    const r = run(["--archive", join(root, "backup.tar.gz.gpg"), "--agent-dir", agentDir, "--dry-run"]);
-    assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stdout, /encrypted: yes/);
-    assert.match(r.stdout, /client-side decrypt required/);
-    assert.match(r.stdout, /DRY-RUN: gpg .*--decrypt/);
-  } finally {
-    cleanup(root);
-  }
-});
-
-test("missing --archive exits 2 with usage", () => {
-  const r = run(["--dry-run"]);
-  assert.equal(r.status, 2);
-  assert.match(r.stderr, /--archive is required/);
-});
-
-test("unknown argument exits 2", () => {
-  const r = run(["--archive", "x", "--bogus"]);
-  assert.equal(r.status, 2);
-  assert.match(r.stderr, /unknown argument/);
-});
-
-test("--help exits 0 and prints usage", () => {
-  const r = run(["--help"]);
-  assert.equal(r.status, 0);
-  assert.match(r.stdout, /dead-Mac-mini restore/);
-});
-
-test("a real (non-dry) restore is idempotent: re-run preserves the prior restore", () => {
-  const { root, archive } = makeArchive();
-  const agentDir = join(root, "agent");
-  mkdirSync(agentDir, { recursive: true });
-  try {
-    // First restore.
-    const r1 = run(["--archive", archive, "--agent-dir", agentDir]);
-    assert.equal(r1.status, 0, `first restore failed: ${r1.stderr}`);
-    assert.ok(existsSync(join(agentDir, "state", "marker.txt")), "state restored");
-    assert.ok(existsSync(join(agentDir, "config", "marker.txt")), "config restored");
-    assert.ok(existsSync(join(agentDir, "logs", "marker.txt")), "logs restored");
-
-    // Second restore must not fail and must preserve the prior dirs aside.
-    const r2 = run(["--archive", archive, "--agent-dir", agentDir]);
-    assert.equal(r2.status, 0, `second restore failed: ${r2.stderr}`);
-    const after = readdirSync(agentDir);
-    assert.ok(
-      after.some((n) => n.startsWith("state.pre-restore.")),
-      "re-run preserved the prior state/ as a timestamped backup"
-    );
-    assert.ok(existsSync(join(agentDir, "state", "marker.txt")), "state restored again");
-  } finally {
-    cleanup(root);
-  }
-});

package/scripts/session/feed.test.mjs

@@ -1,196 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync, utimesSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve, dirname, basename } from "node:path";
-import { fileURLToPath } from "node:url";
-import { spawnSync } from "node:child_process";
-
-import { createFeed, parseFeedArgs } from "./feed.mjs";
-import { inboxItemToYaml } from "../poller/utils.mjs";
-import { newMainSession, saveMainSession } from "../../lib/session/identity.mjs";
-import { sessionPaths } from "../../lib/session/config.mjs";
-import { parseHeartbeat } from "../../lib/session/liveness.mjs";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const FEED = resolve(__dirname, "feed.mjs");
-const T0 = Date.parse("2026-09-08T10:00:00Z");
-const UUID = "11111111-2222-4333-8444-555555555555";
-
-function makeAgent() {
-  const root = mkdtempSync(join(tmpdir(), "maestro-feed-"));
-  mkdirSync(join(root, "config"), { recursive: true });
-  writeFileSync(join(root, "config", "agent.json"), JSON.stringify({ firstName: "Olivia" }));
-  saveMainSession(root, { ...newMainSession({ now: T0, uuid: () => UUID }), resumes: 1 });
-  return root;
-}
-
-function writeItem(root, id, over = {}) {
-  const dir = join(root, "state", "inbox", "cohort");
-  mkdirSync(dir, { recursive: true });
-  const p = join(dir, `2026-09-08T09-59-00-000Z-${id}.yaml`);
-  writeFileSync(p, inboxItemToYaml({
-    id, service: "cohort", channel: "dm/casey", channel_id: "ch_1", sender: "Casey", sender_privilege: "ceo",
-    timestamp: "2026-09-08T09:59:00.000Z", subject: "Cohort message", content: `hello ${id}`, thread_id: "", raw_ref: `cohort:ch_1:${id}`, ...over,
-  }));
-  return p;
-}
-
-test("parseFeedArgs", () => {
-  assert.deepEqual(parseFeedArgs([]), { once: false });
-  assert.deepEqual(parseFeedArgs(["--once"]), { once: true });
-});
-
-test("createFeed: tick emits new inbox items + handoffs + directives as objects, persists the seen-set, and beats", () => {
-  const root = makeAgent();
-  try {
-    const itemPath = writeItem(root, "m1");
-    const paths = sessionPaths(root);
-    mkdirSync(paths.handoffsDir, { recursive: true });
-    writeFileSync(join(paths.handoffsDir, "t-1.json"), JSON.stringify({ tickId: "t-1", cadence: "morning-brief", promptPath: "/p", enqueuedAt: "x" }));
-    writeFileSync(paths.restartRequestedFile, "");
-
-    const lines = [];
-    let t = T0;
-    const feed = createFeed({ agentRoot: root, config: { services: ["cohort"] }, now: () => t, emit: (o) => lines.push(o), pid: 4242, ppid: 4241, pidAlive: () => false });
-    feed.tick();
-    assert.deepEqual(lines.map((l) => [l.type, l.id || l.action]), [["inbound", "m1"], ["handoff", "t-1"], ["directive", "restart"], ["directive", "daemon-stale"]]);
-    const inbound = lines[0];
-    assert.equal(inbound.path, itemPath);
-    assert.equal(inbound.preview, "hello m1");
-    assert.equal(inbound.channelName, "dm/casey");
-    assert.ok(existsSync(paths.feedSeenFile));
-    const seen = JSON.parse(readFileSync(paths.feedSeenFile, "utf8"));
-    assert.equal(seen.seq, 4);
-
-    // Heartbeat carries the stable session id and the <first>-main name.
-    feed.beat();
-    const hb = parseHeartbeat(readFileSync(paths.heartbeatFile, "utf8"));
-    assert.equal(hb.pid, 4242);
-    assert.equal(hb.ppid, 4241);
-    assert.equal(hb.sessionId, UUID);
-    assert.equal(hb.name, "olivia-main");
-    assert.equal(hb.ts, "2026-09-08T10:00:00.000Z");
-
-    // Second tick: nothing new; a second feed instance (Monitor restart) replays nothing either.
-    t += 1000;
-    lines.length = 0;
-    feed.tick();
-    assert.deepEqual(lines, []);
-    const feed2 = createFeed({ agentRoot: root, config: { services: ["cohort"] }, now: () => t, emit: (o) => lines.push(o), pidAlive: () => false });
-    feed2.tick();
-    assert.deepEqual(lines, []);
-
-    // A new item and a daemon coming alive (fresh health file) — only the item is emitted.
-    writeItem(root, "m2");
-    mkdirSync(dirname(paths.daemonHealthFile), { recursive: true });
-    writeFileSync(paths.daemonHealthFile, "updated: now\n");
-    utimesSync(paths.daemonHealthFile, new Date(t), new Date(t));
-    feed2.tick();
-    assert.deepEqual(lines.map((l) => [l.type, l.id]), [["inbound", "m2"]]);
-    assert.equal(lines[0].seq, 5);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("createFeed: claimed (.dispatched) and processed items are not emitted; a re-opened item is", () => {
-  const root = makeAgent();
-  try {
-    const p = writeItem(root, "m1");
-    const lines = [];
-    const feed = createFeed({ agentRoot: root, config: { services: ["cohort"] }, now: () => T0, emit: (o) => lines.push(o), pidAlive: () => true });
-    feed.tick();
-    assert.equal(lines.filter((l) => l.type === "inbound").length, 1);
-    // Claimed by the session → renamed; nothing re-emitted.
-    const claimed = p + ".dispatched";
-    writeFileSync(claimed, readFileSync(p));
-    rmSync(p);
-    lines.length = 0;
-    feed.tick();
-    assert.deepEqual(lines, []);
-    // Assurance sweep re-opens it → re-emitted once.
-    writeFileSync(p, readFileSync(claimed));
-    rmSync(claimed);
-    feed.tick();
-    assert.equal(lines.length, 1);
-    assert.equal(lines[0].id, "m1");
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("createFeed: an already-seen inbox item is stat-only — its body is not re-read every tick (O(backlog) reads)", () => {
-  const root = makeAgent();
-  try {
-    for (let i = 0; i < 5; i++) writeItem(root, `m${i}`);
-    const reads = [];
-    const fs = { readFileSync: (p, enc) => { reads.push(String(p)); return readFileSync(p, enc); } };
-    const lines = [];
-    const feed = createFeed({ agentRoot: root, config: { services: ["cohort"] }, now: () => T0, emit: (o) => lines.push(o), pidAlive: () => true, fs });
-    feed.tick();
-    assert.equal(lines.filter((l) => l.type === "inbound").length, 5);
-    const firstPassBodies = reads.filter((p) => p.includes("/state/inbox/cohort/")).length;
-    assert.equal(firstPassBodies, 5);
-    reads.length = 0;
-    feed.tick();
-    feed.tick();
-    assert.equal(reads.filter((p) => p.includes("/state/inbox/cohort/")).length, 0, "seen items must not be read again");
-    // A new item lands: only it is read.
-    writeItem(root, "m9");
-    reads.length = 0;
-    feed.tick();
-    assert.deepEqual(reads.filter((p) => p.includes("/state/inbox/cohort/")).map((p) => basename(p)), ["2026-09-08T09-59-00-000Z-m9.yaml"]);
-    assert.equal(lines.filter((l) => l.type === "inbound").length, 6);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("createFeed: tickSafely never throws — a throwing emitter (closed stdout) costs one tick and a stderr line", () => {
-  const root = makeAgent();
-  try {
-    writeItem(root, "m1");
-    const logs = [];
-    const feed = createFeed({ agentRoot: root, config: { services: ["cohort"] }, now: () => T0, emit: () => { throw new Error("EPIPE"); }, log: (l) => logs.push(l), pidAlive: () => true });
-    assert.throws(() => feed.tick(), /EPIPE/);
-    assert.deepEqual(feed.tickSafely(), []);
-    assert.ok(logs.some((l) => /tick failed/.test(l) && /EPIPE/.test(l)));
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("createFeed: a missing inbox dir, a missing daemon, a missing main-session file — all fail open", () => {
-  const root = mkdtempSync(join(tmpdir(), "maestro-feed-bare-"));
-  try {
-    const lines = [];
-    const feed = createFeed({ agentRoot: root, config: { services: ["cohort", "slack"] }, now: () => T0, emit: (o) => lines.push(o), pidAlive: () => false });
-    assert.doesNotThrow(() => feed.tick());
-    assert.deepEqual(lines.map((l) => l.action), ["daemon-stale"]);
-    assert.deepEqual(feed.beat(), { ok: true });
-    const hb = parseHeartbeat(readFileSync(sessionPaths(root).heartbeatFile, "utf8"));
-    assert.equal(hb.sessionId, null);
-    // No config at all → the directory-name derivation the plist generator uses.
-    assert.equal(hb.name, `${basename(root)}-main`);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("feed.mjs --once: stdout is JSON lines only, nothing else", () => {
-  const root = makeAgent();
-  try {
-    writeItem(root, "m1");
-    const r = spawnSync(process.execPath, [FEED, "--once"], { env: { ...process.env, AGENT_ROOT: root, AGENT_DIR: root }, encoding: "utf8", timeout: 20_000 });
-    assert.equal(r.status, 0, r.stderr);
-    const lines = r.stdout.split("\n").filter(Boolean);
-    assert.ok(lines.length >= 1, "expected at least the inbound line");
-    const parsed = lines.map((l) => JSON.parse(l));
-    assert.equal(parsed[0].type, "inbound");
-    assert.equal(parsed[0].id, "m1");
-    assert.ok(existsSync(sessionPaths(root).heartbeatFile), "heartbeat written by --once");
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});