@indigoai-us/hq-cli 5.77.13 → 5.78.0

package/src/commands/mcp-registration.test.ts

@@ -1,2787 +0,0 @@
-/**
- * US-006 — safe-write core for user-global config merges.
- *
- * CRITICAL TEST SAFETY: every test runs against an ISOLATED tmpdir `home`
- * (`mkFakeHome()` -> a fresh `os.tmpdir()` subtree) passed explicitly via the
- * injectable `env: { home }` parameter. NOTHING here reads, writes, backs up, or
- * locks the developer's real ~/.claude.json, ~/.mcp.json, or ~/.codex/config.toml.
- * No test mutates `process.env.HOME`; isolation is by injection, not by env.
- */
-
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-
-// US-013 fault-injection seam: ESM forbids vi.spyOn on `fs` namespace exports, so
-// we mock the `fs` module with a FAITHFUL PASS-THROUGH that only deviates when a
-// hoisted control flag is set. Every existing test runs against the real fs (all
-// flags default to off); each US-013 fault test flips one flag inside a try/finally
-// and resets it, so the mock never affects any other test. `__fsFault` is declared
-// via vi.hoisted so the (hoisted) vi.mock factory can close over it.
-const __fsFault = vi.hoisted(() => ({
-  /** Throw ENOSPC at renameSync when the destination ends with this suffix ('' = off). */
-  failRenameSuffix: '' as string,
-  /** Throw EIO at the FIRST fsyncSync call, then pass through ('' = off). */
-  failFirstFsync: false,
-  /** When set, the verify-time re-read of a path ending with this suffix returns the
-   *  poisoned bytes instead of the real file (drives a verify-after-write failure
-   *  whose content would leak if the error echoed it). '' = off. */
-  poisonReadSuffix: '' as string,
-  /** The bytes poisonReadSuffix returns. */
-  poisonReadBytes: '' as string,
-  /** Only poison reads AFTER a write has happened (so the initial read parses). */
-  writeSeen: false,
-}));
-
-vi.mock('fs', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('fs')>();
-  return {
-    ...actual,
-    default: actual,
-    renameSync: (from: fs.PathLike, to: fs.PathLike) => {
-      if (__fsFault.failRenameSuffix && String(to).endsWith(__fsFault.failRenameSuffix)) {
-        const e = new Error('ENOSPC: no space left on device, rename') as NodeJS.ErrnoException;
-        e.code = 'ENOSPC';
-        throw e;
-      }
-      return actual.renameSync(from, to);
-    },
-    fsyncSync: (fd: number) => {
-      if (__fsFault.failFirstFsync) {
-        __fsFault.failFirstFsync = false;
-        const e = new Error('EIO: i/o error, fsync') as NodeJS.ErrnoException;
-        e.code = 'EIO';
-        throw e;
-      }
-      return actual.fsyncSync(fd);
-    },
-    writeSync: ((fd: number, ...rest: unknown[]) => {
-      __fsFault.writeSeen = true;
-      return (actual.writeSync as (f: number, ...r: unknown[]) => number)(fd, ...rest);
-    }) as typeof actual.writeSync,
-    readFileSync: ((p: fs.PathOrFileDescriptor, opts?: unknown) => {
-      if (
-        __fsFault.poisonReadSuffix &&
-        __fsFault.writeSeen &&
-        String(p).endsWith(__fsFault.poisonReadSuffix)
-      ) {
-        return __fsFault.poisonReadBytes as never;
-      }
-      return (actual.readFileSync as (q: unknown, o?: unknown) => unknown)(p, opts) as never;
-    }) as typeof actual.readFileSync,
-  };
-});
-
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { parse as parseToml } from 'smol-toml';
-
-import {
-  // primitives under test
-  writeConfigAtomic,
-  readConfigDoc,
-  acquireLock,
-  releaseLock,
-  lockPathFor,
-  backupConfig,
-  restoreFromBackup,
-  atomicReplace,
-  realpathOrSelf,
-  rescueStamp,
-  isCodexInstalled,
-  codexHome,
-  resolveEnv,
-  jsonFormat,
-  // error taxonomy
-  ConfigParseError,
-  ConfigPermissionError,
-  McpNameCollisionError,
-  PartialRegistrationError,
-  CodexNotInstalledError,
-  McpManifestError,
-  NotImplementedError,
-  McpRegistrationError,
-  registerMcpServers,
-  // US-007 — Claude/JSON emit surface
-  registerServer,
-  registerClaudeServer,
-  buildClaudeServerDef,
-  mergeClaudeServer,
-  serverDefsEqual,
-  assertValidServerName,
-  resolveSecretRefs,
-  redactSecrets,
-  hasSecretRef,
-  claudeConfigFormat,
-  claudeConfigPath,
-  MCP_SERVER_NAME_RE,
-  HQ_PACK_PROVENANCE_KEY,
-  SECRET_REDACTION,
-  // US-008 — Codex/TOML emit surface
-  registerCodexServer,
-  buildCodexServerDef,
-  buildCodexToolsTable,
-  mergeCodexServer,
-  appendCodexTable,
-  serializeOneCodexServer,
-  codexConfigFormat,
-  codexConfigPath,
-  CODEX_MCP_SERVERS_KEY,
-  // US-009 — uninstall un-registration surface
-  unregisterServer,
-  unregisterClaudeServer,
-  unregisterCodexServer,
-  unregisterMcpServers,
-  removeClaudeServer,
-  removeCodexServer,
-  claudeRemovalFormat,
-  codexRemovalFormat,
-  // US-013 — unhappy-path regression surface
-  sanitizeParserMessage,
-  mcpRegistryLogPath,
-  backupRoot,
-  type ConfigFormat,
-  type SafeWriteEnv,
-  type McpManifest,
-  type SecretResolver,
-  type CodexTomlDoc,
-} from './mcp-registration.js';
-
-// ---------------------------------------------------------------------------
-// Isolated-home sandbox + a representative Claude-style JSON format.
-// ---------------------------------------------------------------------------
-
-let home: string;
-let env: SafeWriteEnv;
-
-function mkFakeHome(): string {
-  // realpathSync so macOS /tmp -> /private/tmp doesn't break path equality.
-  return fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'hq-mcp-test-')));
-}
-
-beforeEach(() => {
-  home = mkFakeHome();
-  env = { home };
-});
-
-afterEach(() => {
-  fs.rmSync(home, { recursive: true, force: true });
-});
-
-/** A Claude-shaped format: doc is `{ mcpServers: { <name>: def } }`. */
-const claudeFormat: ConfigFormat<Record<string, unknown>> = {
-  parse: jsonFormat.parse,
-  serialize: jsonFormat.serialize,
-  emptyDoc: () => ({ mcpServers: {} }),
-  assertEntry(doc, name) {
-    const servers = (doc as { mcpServers?: Record<string, unknown> }).mcpServers;
-    if (!servers || typeof servers !== 'object' || !(name in servers)) {
-      throw new Error(`mcpServers.${name} missing`);
-    }
-  },
-};
-
-/** A merge fn that inserts/updates one server, with collision semantics. */
-function mergeServer(name: string, def: Record<string, unknown>) {
-  return (doc: Record<string, unknown>): Record<string, unknown> => {
-    const servers = { ...((doc.mcpServers as Record<string, unknown>) ?? {}) };
-    const existing = servers[name];
-    if (existing !== undefined) {
-      if (JSON.stringify(existing) === JSON.stringify(def)) {
-        return doc; // idempotent: equal def => no change.
-      }
-      throw new McpNameCollisionError(`server "${name}" already defined differently`);
-    }
-    servers[name] = def;
-    return { ...doc, mcpServers: servers };
-  };
-}
-
-const claudePath = () => path.join(home, '.claude.json');
-
-// ---------------------------------------------------------------------------
-// Error taxonomy
-// ---------------------------------------------------------------------------
-
-describe('US-006: named error taxonomy (no bare catch-all)', () => {
-  it('every error class is an McpRegistrationError with a stable code', () => {
-    const cases: [McpRegistrationError, string][] = [
-      [new ConfigParseError('x'), 'ConfigParseError'],
-      [new ConfigPermissionError('x'), 'ConfigPermissionError'],
-      [new McpNameCollisionError('x'), 'McpNameCollisionError'],
-      [new CodexNotInstalledError('x'), 'CodexNotInstalledError'],
-      [new McpManifestError('x'), 'McpManifestError'],
-      [new PartialRegistrationError('x'), 'PartialRegistrationError'],
-    ];
-    for (const [err, code] of cases) {
-      expect(err).toBeInstanceOf(McpRegistrationError);
-      expect(err).toBeInstanceOf(Error);
-      expect(err.code).toBe(code);
-      expect(err.name).toBe(code);
-    }
-  });
-
-  it('instanceof discriminates concrete subclasses', () => {
-    expect(new ConfigParseError('x')).toBeInstanceOf(ConfigParseError);
-    expect(new ConfigParseError('x')).not.toBeInstanceOf(ConfigPermissionError);
-  });
-
-  it('NotImplementedError remains an exported, well-formed named error (Codex emit lands US-008)', () => {
-    // US-007 wired the Claude/JSON emitter, so registerMcpServers no longer throws
-    // NotImplemented; but the class is retained for the Codex seam (US-008) and any
-    // future not-yet-wired emitter, and must keep its stable code + attribution.
-    const err = new NotImplementedError('codex emit pending', 'US-008');
-    expect(err).toBeInstanceOf(Error);
-    expect(err.code).toBe('NotImplemented');
-    expect(err.story).toBe('US-008');
-    expect(err.name).toBe('NotImplementedError');
-  });
-
-  it('registerMcpServers without a manifest loader fails loud with a named McpManifestError', () => {
-    // US-007: the seam is real now. Without payload context (no loadManifest) it is
-    // a programmer error, surfaced as a named error — never a silent no-op, never a
-    // NotImplemented throw — and it touches NO config (the check precedes all IO).
-    expect(() => registerMcpServers('hq-pack-test', ['vyg'])).toThrow(McpManifestError);
-    try {
-      registerMcpServers('hq-pack-test', ['vyg']);
-    } catch (e) {
-      expect((e as McpManifestError).code).toBe('McpManifestError');
-      expect((e as Error).message).toMatch(/loadManifest/);
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// resolveEnv + base-path injection
-// ---------------------------------------------------------------------------
-
-describe('US-006: injectable base paths (test isolation requirement)', () => {
-  it('resolveEnv uses the injected home, not os.homedir()', () => {
-    expect(resolveEnv({ home }).home).toBe(home);
-    expect(resolveEnv({ home }).home).not.toBe(os.homedir());
-  });
-
-  it('isCodexInstalled is false when ~/.codex is absent and never fabricates it', () => {
-    expect(isCodexInstalled(env)).toBe(false);
-    expect(fs.existsSync(codexHome(env))).toBe(false); // not created as a side effect.
-  });
-
-  it('isCodexInstalled is true only when ~/.codex is a real directory', () => {
-    fs.mkdirSync(codexHome(env), { recursive: true });
-    expect(isCodexInstalled(env)).toBe(true);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Read path — the SHADOW cases (§6.2)
-// ---------------------------------------------------------------------------
-
-describe('US-006: read path shadow cases', () => {
-  it('SHADOW A — ENOENT yields the empty doc, existed=false', () => {
-    const res = readConfigDoc(claudePath(), claudeFormat);
-    expect(res.existed).toBe(false);
-    expect(res.doc).toEqual({ mcpServers: {} });
-  });
-
-  it('SHADOW B — 0-byte file yields the empty doc', () => {
-    fs.writeFileSync(claudePath(), '');
-    const res = readConfigDoc(claudePath(), claudeFormat);
-    expect(res.existed).toBe(false);
-    expect(res.doc).toEqual({ mcpServers: {} });
-  });
-
-  it('SHADOW B — whitespace-only file yields the empty doc', () => {
-    fs.writeFileSync(claudePath(), '   \n\t  \n');
-    const res = readConfigDoc(claudePath(), claudeFormat);
-    expect(res.existed).toBe(false);
-  });
-
-  it('SHADOW C — non-empty parse error throws ConfigParseError (never regenerate)', () => {
-    fs.writeFileSync(claudePath(), '{ this is not json ');
-    expect(() => readConfigDoc(claudePath(), claudeFormat)).toThrow(ConfigParseError);
-  });
-
-  it('SHADOW C — a top-level JSON array is a parse error (must be an object)', () => {
-    fs.writeFileSync(claudePath(), '[1,2,3]');
-    expect(() => readConfigDoc(claudePath(), claudeFormat)).toThrow(ConfigParseError);
-  });
-
-  it('SHADOW D — a directory at the target path throws ConfigPermissionError', () => {
-    fs.mkdirSync(claudePath()); // reading a dir as a file => EISDIR.
-    expect(() => readConfigDoc(claudePath(), claudeFormat)).toThrow(ConfigPermissionError);
-  });
-
-  it('a valid non-empty file parses with existed=true', () => {
-    fs.writeFileSync(claudePath(), JSON.stringify({ mcpServers: { figma: { type: 'http' } } }));
-    const res = readConfigDoc(claudePath(), claudeFormat);
-    expect(res.existed).toBe(true);
-    expect(res.doc).toEqual({ mcpServers: { figma: { type: 'http' } } });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Atomic write + realpath/symlink discipline
-// ---------------------------------------------------------------------------
-
-describe('US-006: atomic write + realpath/symlink', () => {
-  it('atomicReplace writes mode 0600 and leaves no temp litter', () => {
-    const f = path.join(home, 'cfg.json');
-    atomicReplace(f, '{"a":1}\n');
-    expect(fs.readFileSync(f, 'utf-8')).toBe('{"a":1}\n');
-    expect(fs.statSync(f).mode & 0o777).toBe(0o600);
-    expect(fs.readdirSync(home).filter((n) => n.includes('.tmp.'))).toEqual([]);
-  });
-
-  it('realpathOrSelf resolves a symlink to its target file', () => {
-    const realFile = path.join(home, 'real.json');
-    const link = path.join(home, 'link.json');
-    fs.writeFileSync(realFile, '{}');
-    fs.symlinkSync(realFile, link);
-    expect(realpathOrSelf(link)).toBe(realFile);
-  });
-
-  it('realpathOrSelf on a BROKEN link returns the dangling target, never the link', () => {
-    const missing = path.join(home, 'missing.json');
-    const link = path.join(home, 'broken.json');
-    fs.symlinkSync(missing, link);
-    // Resolves to the (absent) target, so a write lands on the target — not the link.
-    expect(realpathOrSelf(link)).toBe(missing);
-    expect(fs.lstatSync(link).isSymbolicLink()).toBe(true); // link untouched.
-  });
-
-  it('realpathOrSelf follows a partially-broken symlink CHAIN to the final target', () => {
-    const missing = path.join(home, 'final-missing.json');
-    const link2 = path.join(home, 'link2.json');
-    const link1 = path.join(home, 'link1.json');
-    fs.symlinkSync(missing, link2); // link2 -> missing (dangling)
-    fs.symlinkSync(link2, link1); // link1 -> link2 -> missing
-    // Must resolve all the way to the final dangling target, NOT stop at link2.
-    expect(realpathOrSelf(link1)).toBe(missing);
-    expect(fs.lstatSync(link1).isSymbolicLink()).toBe(true);
-    expect(fs.lstatSync(link2).isSymbolicLink()).toBe(true);
-  });
-
-  it('realpathOrSelf does not infinite-loop on a cyclic broken chain', () => {
-    const a = path.join(home, 'cyc-a.json');
-    const b = path.join(home, 'cyc-b.json');
-    fs.symlinkSync(b, a); // a -> b
-    fs.symlinkSync(a, b); // b -> a (cycle)
-    // Depth-guarded: returns SOME path without hanging or throwing.
-    expect(() => realpathOrSelf(a)).not.toThrow();
-  });
-
-  it('writes through a ~/.mcp.json-style symlink onto the RESOLVED file, never the link', () => {
-    const realFile = path.join(home, '.mcp.real.json');
-    const link = path.join(home, '.mcp.json');
-    fs.writeFileSync(realFile, JSON.stringify({ mcpServers: { figma: { type: 'http' } } }));
-    fs.symlinkSync(realFile, link);
-
-    writeConfigAtomic({
-      target: link,
-      pack: 'hq-pack-test',
-      format: claudeFormat,
-      merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-      assertName: 'vyg',
-      env,
-    });
-
-    // The link is STILL a symlink (not replaced by a regular file).
-    expect(fs.lstatSync(link).isSymbolicLink()).toBe(true);
-    // The resolved file carries both the pre-existing and the new server.
-    const after = JSON.parse(fs.readFileSync(realFile, 'utf-8'));
-    expect(after.mcpServers.figma).toEqual({ type: 'http' });
-    expect(after.mcpServers.vyg).toEqual({ type: 'http', url: 'https://mcp.vyg.app' });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Backup + restore (reuses the hq rescue pattern)
-// ---------------------------------------------------------------------------
-
-describe('US-006: backup + restore', () => {
-  it('rescueStamp is a UTC dash-time ISO-ish stamp', () => {
-    expect(rescueStamp(new Date(Date.UTC(2026, 5, 19, 1, 13, 59)))).toBe('2026-06-19T01-13-59Z');
-  });
-
-  it('backs up into ~/.hq/backups/mcp/<stamp>-<pack>/ before write, mode 0600', () => {
-    const f = claudePath();
-    fs.writeFileSync(f, JSON.stringify({ mcpServers: { figma: {} } }));
-    const dir = backupConfig(env, f, 'hq-pack-test', '2026-06-19T00-00-00Z');
-    expect(dir).toBe(path.join(home, '.hq', 'backups', 'mcp', '2026-06-19T00-00-00Z-hq-pack-test'));
-    const copy = path.join(dir, '.claude.json');
-    expect(JSON.parse(fs.readFileSync(copy, 'utf-8'))).toEqual({ mcpServers: { figma: {} } });
-    expect(fs.statSync(copy).mode & 0o777).toBe(0o600);
-  });
-
-  it('an absent target backs up an .absent marker; restore unlinks the target', () => {
-    const f = claudePath();
-    const dir = backupConfig(env, f, 'hq-pack-test', '2026-06-19T00-00-00Z');
-    expect(fs.existsSync(path.join(dir, '.absent'))).toBe(true);
-    // Create the file, then restore-from-absent removes it again.
-    fs.writeFileSync(f, '{}');
-    restoreFromBackup(f, dir);
-    expect(fs.existsSync(f)).toBe(false);
-  });
-
-  it('restore brings back the exact pre-write bytes', () => {
-    const f = claudePath();
-    const original = JSON.stringify({ mcpServers: { figma: { type: 'http' } } }, null, 2) + '\n';
-    fs.writeFileSync(f, original);
-    const dir = backupConfig(env, f, 'p', '2026-06-19T00-00-00Z');
-    fs.writeFileSync(f, '{"corrupted":true}');
-    restoreFromBackup(f, dir);
-    expect(fs.readFileSync(f, 'utf-8')).toBe(original);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Advisory lock
-// ---------------------------------------------------------------------------
-
-describe('US-006: advisory O_EXCL lock', () => {
-  it('lockPathFor collapses a leading dot: ~/.claude.json -> .claude.json.hqlock', () => {
-    expect(lockPathFor(path.join(home, '.claude.json'))).toBe(
-      path.join(home, '.claude.json.hqlock'),
-    );
-    expect(lockPathFor(path.join(home, 'plain.json'))).toBe(
-      path.join(home, '.plain.json.hqlock'),
-    );
-  });
-
-  it('acquire creates the lockfile; release removes it; release is idempotent', () => {
-    const f = claudePath();
-    const lock = acquireLock(f, { waitMs: 200 });
-    expect(fs.existsSync(lock.lockPath)).toBe(true);
-    releaseLock(lock);
-    expect(fs.existsSync(lock.lockPath)).toBe(false);
-    expect(() => releaseLock(lock)).not.toThrow(); // idempotent.
-  });
-
-  it('a held lock (alive PID) makes a second acquire ABORT rather than steal', () => {
-    const f = claudePath();
-    const first = acquireLock(f, { waitMs: 100 });
-    // Second acquire sees a live holder (this very PID) and times out -> abort.
-    expect(() =>
-      acquireLock(f, { waitMs: 80, pollMs: 10, isPidAlive: () => true }),
-    ).toThrow(ConfigPermissionError);
-    releaseLock(first);
-  });
-
-  it('a stale lock (dead PID, old mtime) is broken and re-acquired', () => {
-    const f = claudePath();
-    const lp = lockPathFor(f);
-    // Forge a stale lock: a dead PID, mtime far in the past.
-    fs.writeFileSync(lp, '999999\n2000-01-01T00:00:00Z\n', { mode: 0o600 });
-    const old = new Date(Date.now() - 60_000);
-    fs.utimesSync(lp, old, old);
-    const lock = acquireLock(f, { waitMs: 200, staleMs: 1000, isPidAlive: () => false });
-    expect(fs.existsSync(lock.lockPath)).toBe(true);
-    releaseLock(lock);
-  });
-
-  it('a fresh lock with a dead PID is NOT stolen (conservative TOCTOU guard)', () => {
-    const f = claudePath();
-    const lp = lockPathFor(f);
-    fs.writeFileSync(lp, '999999\n', { mode: 0o600 }); // fresh mtime, dead PID.
-    expect(() =>
-      acquireLock(f, { waitMs: 60, pollMs: 10, staleMs: 30_000, isPidAlive: () => false }),
-    ).toThrow(ConfigPermissionError);
-    fs.unlinkSync(lp);
-  });
-
-  it('stale-break is identity-safe: a fresh lock swapped in mid-decision is NOT unlinked', () => {
-    // Forge a stale lock, then make `now()` advance so the SAME lock looks stale,
-    // but have `isPidAlive` swap the lockfile for a NEW one right at the liveness
-    // check — emulating a third contender replacing it between our stat and unlink.
-    const f = claudePath();
-    const lp = lockPathFor(f);
-    fs.writeFileSync(lp, '999999\nstale\n', { mode: 0o600 });
-    const past = new Date(Date.now() - 60_000);
-    fs.utimesSync(lp, past, past);
-
-    let swapped = false;
-    const acq = () =>
-      acquireLock(f, {
-        waitMs: 40,
-        pollMs: 10,
-        staleMs: 1000,
-        isPidAlive: () => {
-          // On the first liveness probe, replace the stale lock with a fresh one
-          // (different inode) before the breaker can unlink it.
-          if (!swapped) {
-            swapped = true;
-            fs.unlinkSync(lp);
-            fs.writeFileSync(lp, `${process.pid}\nfresh\n`, { mode: 0o600 });
-          }
-          return false; // the (forged dead) PID is reported dead.
-        },
-      });
-    // The breaker must NOT unlink the fresh replacement (inode differs) -> it waits
-    // and aborts; the fresh lock survives.
-    expect(acq).toThrow(ConfigPermissionError);
-    expect(fs.existsSync(lp)).toBe(true);
-    // The surviving lock is the FRESH replacement, not the stale one we judged.
-    // Assert by CONTENT, not inode: Linux reuses a just-freed inode on the next
-    // create, so the fresh lock can share the stale lock's inode number — only the
-    // body (pid + "fresh") reliably distinguishes them across platforms.
-    expect(fs.readFileSync(lp, 'utf-8')).toContain('fresh');
-    fs.unlinkSync(lp);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// writeConfigAtomic — full path
-// ---------------------------------------------------------------------------
-
-describe('US-006: writeConfigAtomic merge semantics', () => {
-  it('inserts a new server into a fresh (ENOENT) config and creates a backup', () => {
-    const res = writeConfigAtomic({
-      target: claudePath(),
-      pack: 'hq-pack-test',
-      format: claudeFormat,
-      merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-      assertName: 'vyg',
-      env,
-    });
-    expect(res.changed).toBe(true);
-    const doc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(doc.mcpServers.vyg).toEqual({ type: 'http', url: 'https://mcp.vyg.app' });
-    expect(fs.existsSync(res.backupDir)).toBe(true);
-  });
-
-  it('PRESERVES existing non-HQ servers byte-for-byte (merge, never overwrite)', () => {
-    fs.writeFileSync(
-      claudePath(),
-      JSON.stringify({
-        mcpServers: {
-          figma: { type: 'http', url: 'http://localhost:3845/mcp' },
-          paper: { type: 'stdio', command: 'npx', args: ['mcp-remote'] },
-        },
-      }),
-    );
-    writeConfigAtomic({
-      target: claudePath(),
-      pack: 'hq-pack-test',
-      format: claudeFormat,
-      merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-      assertName: 'vyg',
-      env,
-    });
-    const doc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(doc.mcpServers.figma).toEqual({ type: 'http', url: 'http://localhost:3845/mcp' });
-    expect(doc.mcpServers.paper).toEqual({ type: 'stdio', command: 'npx', args: ['mcp-remote'] });
-    expect(doc.mcpServers.vyg).toBeDefined();
-  });
-
-  it('is idempotent — re-registering the same def is a no-op (changed:false)', () => {
-    const args = {
-      target: claudePath(),
-      pack: 'hq-pack-test',
-      format: claudeFormat,
-      merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-      assertName: 'vyg',
-      env,
-    };
-    const first = writeConfigAtomic(args);
-    expect(first.changed).toBe(true);
-    const before = fs.readFileSync(claudePath(), 'utf-8');
-    const second = writeConfigAtomic(args);
-    expect(second.changed).toBe(false);
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(before); // file untouched.
-  });
-
-  it('a differently-defined collision aborts with McpNameCollisionError, writes nothing', () => {
-    fs.writeFileSync(
-      claudePath(),
-      JSON.stringify({ mcpServers: { vyg: { type: 'http', url: 'https://OLD.example' } } }, null, 2) + '\n',
-    );
-    const before = fs.readFileSync(claudePath(), 'utf-8');
-    expect(() =>
-      writeConfigAtomic({
-        target: claudePath(),
-        pack: 'hq-pack-test',
-        format: claudeFormat,
-        merge: mergeServer('vyg', { type: 'http', url: 'https://NEW.example' }),
-        assertName: 'vyg',
-        env,
-      }),
-    ).toThrow(McpNameCollisionError);
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(before); // untouched.
-  });
-
-  it('releases the lock even when the merge aborts', () => {
-    fs.writeFileSync(
-      claudePath(),
-      JSON.stringify({ mcpServers: { vyg: { type: 'http', url: 'https://OLD' } } }),
-    );
-    try {
-      writeConfigAtomic({
-        target: claudePath(),
-        pack: 'p',
-        format: claudeFormat,
-        merge: mergeServer('vyg', { type: 'http', url: 'https://NEW' }),
-        assertName: 'vyg',
-        env,
-      });
-    } catch {
-      /* expected collision */
-    }
-    expect(fs.existsSync(lockPathFor(claudePath()))).toBe(false); // released in finally.
-  });
-
-  it('verify-after-write failure restores from backup and raises PartialRegistrationError', () => {
-    // A pathological format whose merge "succeeds" but assertEntry never confirms
-    // the entry — simulates a torn/partial write that verify must catch.
-    const original = JSON.stringify({ mcpServers: { figma: {} } }, null, 2) + '\n';
-    fs.writeFileSync(claudePath(), original);
-    const brokenVerify: ConfigFormat<Record<string, unknown>> = {
-      ...claudeFormat,
-      assertEntry() {
-        throw new Error('entry never confirmed (simulated torn write)');
-      },
-    };
-    expect(() =>
-      writeConfigAtomic({
-        target: claudePath(),
-        pack: 'p',
-        format: brokenVerify,
-        merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-        assertName: 'vyg',
-        env,
-      }),
-    ).toThrow(PartialRegistrationError);
-    // Original restored byte-for-byte.
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(original);
-  });
-
-  it('on verify failure the PartialRegistrationError carries the backupDir for recovery', () => {
-    const original = JSON.stringify({ mcpServers: { figma: {} } }, null, 2) + '\n';
-    fs.writeFileSync(claudePath(), original);
-    const brokenVerify: ConfigFormat<Record<string, unknown>> = {
-      ...claudeFormat,
-      assertEntry() {
-        throw new Error('simulated torn write');
-      },
-    };
-    try {
-      writeConfigAtomic({
-        target: claudePath(),
-        pack: 'p',
-        format: brokenVerify,
-        merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-        assertName: 'vyg',
-        env,
-      });
-      throw new Error('should have thrown');
-    } catch (e) {
-      expect(e).toBeInstanceOf(PartialRegistrationError);
-      const pe = e as PartialRegistrationError;
-      expect(pe.backupDir).toBeDefined();
-      expect(fs.existsSync(pe.backupDir!)).toBe(true);
-      // Message reflects a SUCCESSFUL restore (the happy restore path).
-      expect(pe.message).toMatch(/restored from backup/);
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// e2eTests from the PRD (US-006)
-// ---------------------------------------------------------------------------
-
-describe('US-006 e2e: PRD acceptance scenarios', () => {
-  it('e2e #1 — malformed existing config raises ConfigParseError and writes nothing', () => {
-    const f = claudePath();
-    const malformed = '{ "mcpServers": { "figma": }  <- hand-broken';
-    fs.writeFileSync(f, malformed);
-    expect(() =>
-      writeConfigAtomic({
-        target: f,
-        pack: 'hq-pack-test',
-        format: claudeFormat,
-        merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-        assertName: 'vyg',
-        env,
-      }),
-    ).toThrow(ConfigParseError);
-    // ORIGINAL preserved exactly — never regenerated from a template.
-    expect(fs.readFileSync(f, 'utf-8')).toBe(malformed);
-  });
-
-  it('e2e #2 — a write interrupted mid-flight leaves the original intact + a backup exists', () => {
-    // Simulate ENOSPC/SIGINT mid-write: the merge runs (so the backup is taken),
-    // then atomicReplace fails. We trigger the failure deterministically with a
-    // format whose serialize throws AFTER the backup but BEFORE the rename.
-    const f = claudePath();
-    const original = JSON.stringify({ mcpServers: { figma: { type: 'http' } } }, null, 2) + '\n';
-    fs.writeFileSync(f, original);
-
-    let backupSeen: string | undefined;
-    const explodeOnWrite: ConfigFormat<Record<string, unknown>> = {
-      ...claudeFormat,
-      serialize(doc) {
-        // First call (reading current) is fine; the merged serialize explodes,
-        // mimicking ENOSPC at the write boundary. Detect the merged doc by the
-        // presence of the new server.
-        const servers = (doc as { mcpServers?: Record<string, unknown> }).mcpServers ?? {};
-        if ('vyg' in servers) throw new Error('ENOSPC: no space left on device (simulated)');
-        return jsonFormat.serialize(doc);
-      },
-    };
-
-    expect(() =>
-      writeConfigAtomic({
-        target: f,
-        pack: 'hq-pack-test',
-        format: explodeOnWrite,
-        merge: (doc) => {
-          // capture that a backup was already taken before any write attempt
-          backupSeen = path.join(home, '.hq', 'backups', 'mcp');
-          return mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' })(doc);
-        },
-        assertName: 'vyg',
-        env,
-      }),
-    ).toThrow(/ENOSPC/);
-
-    // ORIGINAL file intact (the rename never happened).
-    expect(fs.readFileSync(f, 'utf-8')).toBe(original);
-    // A backup exists under ~/.hq/backups/mcp/.
-    expect(backupSeen && fs.existsSync(backupSeen)).toBe(true);
-    const backups = fs.readdirSync(path.join(home, '.hq', 'backups', 'mcp'));
-    expect(backups.length).toBeGreaterThan(0);
-    const copy = path.join(path.join(home, '.hq', 'backups', 'mcp'), backups[0]!, '.claude.json');
-    expect(fs.readFileSync(copy, 'utf-8')).toBe(original);
-    // No temp litter left behind.
-    expect(fs.readdirSync(home).filter((n) => n.includes('.tmp.'))).toEqual([]);
-    // Lock released.
-    expect(fs.existsSync(lockPathFor(f))).toBe(false);
-  });
-
-  it('e2e #3 — a concurrent register holding the lock makes the second wait/abort, first write preserved', () => {
-    const f = claudePath();
-    fs.writeFileSync(f, JSON.stringify({ mcpServers: { figma: { type: 'http' } } }));
-
-    // Writer 1 takes the lock and holds it (simulating an in-flight register).
-    const held = acquireLock(f, { waitMs: 100 });
-
-    // Writer 2 tries to register while the lock is held by a LIVE holder -> abort.
-    expect(() =>
-      writeConfigAtomic({
-        target: f,
-        pack: 'hq-pack-2',
-        format: claudeFormat,
-        merge: mergeServer('two', { type: 'http', url: 'https://two.example' }),
-        assertName: 'two',
-        env,
-        lock: { waitMs: 60, pollMs: 10, isPidAlive: () => true },
-      }),
-    ).toThrow(ConfigPermissionError);
-
-    // Writer 1's intended state is preserved — writer 2 never clobbered the file.
-    const doc = JSON.parse(fs.readFileSync(f, 'utf-8'));
-    expect(doc.mcpServers.figma).toBeDefined();
-    expect(doc.mcpServers.two).toBeUndefined(); // the aborted writer wrote nothing.
-
-    // Now writer 1 releases; a fresh register succeeds (no lost lock).
-    releaseLock(held);
-    const ok = writeConfigAtomic({
-      target: f,
-      pack: 'hq-pack-2',
-      format: claudeFormat,
-      merge: mergeServer('two', { type: 'http', url: 'https://two.example' }),
-      assertName: 'two',
-      env,
-      lock: { waitMs: 100 },
-    });
-    expect(ok.changed).toBe(true);
-    expect(JSON.parse(fs.readFileSync(f, 'utf-8')).mcpServers.two).toBeDefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Desired-state convergence (re-run safe from any state, incl. PARTIAL)
-// ---------------------------------------------------------------------------
-
-describe('US-006: desired-state convergence', () => {
-  it('re-running after a successful register converges to the same state (idempotent)', () => {
-    const args = {
-      target: claudePath(),
-      pack: 'hq-pack-test',
-      format: claudeFormat,
-      merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-      assertName: 'vyg',
-      env,
-    };
-    writeConfigAtomic(args);
-    const a = fs.readFileSync(claudePath(), 'utf-8');
-    writeConfigAtomic(args);
-    writeConfigAtomic(args);
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(a);
-  });
-
-  it('a PARTIAL state (server present in one surface only) self-heals on the missing surface', () => {
-    // Surface A already has the server; surface B does not. Re-running registers
-    // B without disturbing A — each surface is evaluated independently.
-    const a = path.join(home, '.claude.json');
-    const b = path.join(home, '.mcp.json');
-    const def = { type: 'http', url: 'https://mcp.vyg.app' };
-    fs.writeFileSync(a, JSON.stringify({ mcpServers: { vyg: def } }, null, 2) + '\n');
-    // B is absent (the partial surface).
-    const reA = writeConfigAtomic({
-      target: a, pack: 'p', format: claudeFormat, merge: mergeServer('vyg', def), assertName: 'vyg', env,
-    });
-    const reB = writeConfigAtomic({
-      target: b, pack: 'p', format: claudeFormat, merge: mergeServer('vyg', def), assertName: 'vyg', env,
-    });
-    expect(reA.changed).toBe(false); // A already converged.
-    expect(reB.changed).toBe(true); // B healed.
-    expect(JSON.parse(fs.readFileSync(b, 'utf-8')).mcpServers.vyg).toEqual(def);
-  });
-});
-
-// ===========================================================================
-// US-007 — Claude/JSON merge emit (consumes the US-006 safe-write core).
-// ===========================================================================
-
-/** A representative http manifest with a secret-by-reference Authorization header. */
-const VYG_MANIFEST: McpManifest = {
-  type: 'http',
-  url: 'https://mcp.vyg.app',
-  headers: { Authorization: 'Bearer ${secret:VYG_API_KEY}' },
-};
-
-/** Seed ~/.claude.json with the user's real-world non-HQ servers (figma + paper). */
-function seedClaudeWithFigmaPaper(): string {
-  const f = claudePath();
-  const doc = {
-    // a top-level non-mcp key that MUST survive untouched
-    userID: 'u-123',
-    mcpServers: {
-      figma: { type: 'http', url: 'http://localhost:3845/mcp' },
-      paper: { type: 'stdio', command: '/opt/homebrew/bin/npx', args: ['mcp-remote', 'http://127.0.0.1:29979/mcp'] },
-    },
-  };
-  fs.writeFileSync(f, JSON.stringify(doc, null, 2) + '\n');
-  return f;
-}
-
-describe('US-007: server name validation (^[a-z0-9_-]+$ before any JSON-key interpolation)', () => {
-  it('accepts valid names', () => {
-    for (const n of ['vyg', 'vyg-shopify', 'vyg_internal', 'a1', 'x-9_z']) {
-      expect(() => assertValidServerName(n)).not.toThrow();
-      expect(MCP_SERVER_NAME_RE.test(n)).toBe(true);
-    }
-  });
-
-  it('rejects names with uppercase, dots, slashes, spaces, or injection chars', () => {
-    for (const n of ['VYG', 'vyg.shop', 'a/b', 'a b', 'a"]', '__proto__.x', 'a\nb', '']) {
-      expect(() => assertValidServerName(n)).toThrow(McpManifestError);
-    }
-  });
-
-  it('registerClaudeServer rejects a bad name BEFORE touching any config (no IO, no backup)', () => {
-    expect(() =>
-      registerClaudeServer({ name: 'BAD NAME', manifest: { type: 'http', url: 'https://x' }, pack: 'p', env }),
-    ).toThrow(McpManifestError);
-    // No file, no backup dir created.
-    expect(fs.existsSync(claudePath())).toBe(false);
-    expect(fs.existsSync(path.join(home, '.hq', 'backups', 'mcp'))).toBe(false);
-  });
-});
-
-describe('US-007: ${secret:} resolution at emit (resolve-only, redact, never echo)', () => {
-  it('resolves a referenced secret and records it in the redaction sink', () => {
-    const sink = new Set<string>();
-    const out = resolveSecretRefs('Bearer ${secret:VYG_API_KEY}', () => 'FAKE-RESOLVED-SECRET-A', sink);
-    expect(out).toBe('Bearer FAKE-RESOLVED-SECRET-A');
-    expect(sink.has('FAKE-RESOLVED-SECRET-A')).toBe(true);
-  });
-
-  it('passes a no-reference string through untouched', () => {
-    const sink = new Set<string>();
-    expect(resolveSecretRefs('http://localhost/mcp', () => null, sink)).toBe('http://localhost/mcp');
-    expect(sink.size).toBe(0);
-  });
-
-  it('throws McpManifestError when a referenced secret cannot be resolved (refuse half-resolved)', () => {
-    const sink = new Set<string>();
-    expect(() => resolveSecretRefs('Bearer ${secret:MISSING}', () => null, sink)).toThrow(McpManifestError);
-  });
-
-  it('hasSecretRef detects a reference', () => {
-    expect(hasSecretRef('Bearer ${secret:VYG_API_KEY}')).toBe(true);
-    expect(hasSecretRef('Bearer literal-token')).toBe(false);
-  });
-
-  it('redactSecrets scrubs every resolved plaintext (longest-first, no partial unmask)', () => {
-    const secrets = new Set(['abc', 'abcdef']);
-    expect(redactSecrets('x abcdef y abc z', secrets)).toBe(`x ${SECRET_REDACTION} y ${SECRET_REDACTION} z`);
-  });
-
-  it('buildClaudeServerDef substitutes the secret into the header (the runtime needs the real value)', () => {
-    const sink = new Set<string>();
-    const def = buildClaudeServerDef(VYG_MANIFEST, 'hq-pack-vyg', () => 'FAKE-RESOLVED-SECRET-B', sink);
-    expect((def.headers as Record<string, string>).Authorization).toBe('Bearer FAKE-RESOLVED-SECRET-B');
-    expect(sink.has('FAKE-RESOLVED-SECRET-B')).toBe(true);
-  });
-});
-
-describe('US-007: provenance stamp (_hqPack so US-009 uninstall finds only our entries)', () => {
-  it('every emitted def carries _hqPack = the pack name', () => {
-    const def = buildClaudeServerDef(VYG_MANIFEST, 'hq-pack-vyg-shopify', () => 'k', new Set());
-    expect(def[HQ_PACK_PROVENANCE_KEY]).toBe('hq-pack-vyg-shopify');
-  });
-
-  it('the stamp lands in the written ~/.claude.json entry', () => {
-    registerClaudeServer({
-      name: 'vyg',
-      manifest: { type: 'http', url: 'https://mcp.vyg.app' },
-      pack: 'hq-pack-vyg-shopify',
-      env,
-    });
-    const doc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(doc.mcpServers.vyg._hqPack).toBe('hq-pack-vyg-shopify');
-  });
-
-  it('serverDefsEqual ignores _hqPack provenance + key order when comparing definitions', () => {
-    const a = { type: 'http', url: 'https://x', _hqPack: 'p1' };
-    const b = { url: 'https://x', type: 'http' }; // no stamp, different key order
-    expect(serverDefsEqual(a, b)).toBe(true);
-    const c = { type: 'http', url: 'https://DIFFERENT', _hqPack: 'p1' };
-    expect(serverDefsEqual(a, c)).toBe(false);
-  });
-});
-
-describe('US-007: registerClaudeServer — single PINNED surface merge', () => {
-  it('writes ONE mcpServers entry into top-level ~/.claude.json via the safe-write core', () => {
-    const res = registerClaudeServer({
-      name: 'vyg',
-      manifest: VYG_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-    expect(res.changed).toBe(true);
-    const doc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(doc.mcpServers.vyg.type).toBe('http');
-    expect(doc.mcpServers.vyg.url).toBe('https://mcp.vyg.app');
-    expect(doc.mcpServers.vyg.headers.Authorization).toBe('Bearer FAKE-RESOLVED-KEY');
-  });
-
-  it('creates mcpServers on a fresh {} ~/.claude.json without rewriting other top-level keys', () => {
-    fs.writeFileSync(claudePath(), JSON.stringify({ userID: 'u-1', tipsHistory: { a: 1 } }, null, 2) + '\n');
-    registerClaudeServer({ name: 'vyg', manifest: { type: 'http', url: 'https://mcp.vyg.app' }, pack: 'p', env });
-    const doc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(doc.userID).toBe('u-1'); // untouched
-    expect(doc.tipsHistory).toEqual({ a: 1 }); // untouched
-    expect(doc.mcpServers.vyg).toBeDefined();
-  });
-
-  it('the secret value is REDACTED from a verify-failure error message (never echoed)', () => {
-    // Force a verify failure by injecting an env whose home flips after write is
-    // impossible cheaply; instead drive redaction via a manifest whose secret would
-    // appear in an error. Use a collision path that echoes content is not available,
-    // so assert redaction directly: a collision error never contains the secret.
-    seedClaudeWithFigmaPaper();
-    const doc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    doc.mcpServers.vyg = { type: 'http', url: 'https://OLD.example', _hqPack: 'p' };
-    fs.writeFileSync(claudePath(), JSON.stringify(doc, null, 2) + '\n');
-    try {
-      registerClaudeServer({
-        name: 'vyg',
-        manifest: { type: 'http', url: 'https://NEW.example', headers: { Authorization: 'Bearer ${secret:VYG_API_KEY}' } },
-        pack: 'p',
-        resolveSecret: () => 'FAKE-SECRET-MUST-NOT-LEAK',
-        env,
-      });
-      throw new Error('should have thrown a collision');
-    } catch (e) {
-      expect(e).toBeInstanceOf(McpNameCollisionError);
-      expect((e as Error).message).not.toContain('FAKE-SECRET-MUST-NOT-LEAK');
-    }
-  });
-});
-
-describe('US-007 e2e: PRD acceptance scenarios', () => {
-  it('e2e #1 — clean ~/.claude.json (figma+paper): new server added, figma+paper byte-identical', () => {
-    const f = seedClaudeWithFigmaPaper();
-    const before = JSON.parse(fs.readFileSync(f, 'utf-8'));
-    const figmaBytes = JSON.stringify(before.mcpServers.figma);
-    const paperBytes = JSON.stringify(before.mcpServers.paper);
-
-    registerClaudeServer({
-      name: 'vyg',
-      manifest: VYG_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-
-    const after = JSON.parse(fs.readFileSync(f, 'utf-8'));
-    // New server present.
-    expect(after.mcpServers.vyg.url).toBe('https://mcp.vyg.app');
-    // figma + paper byte-identical (deep-equal of the serialized form).
-    expect(JSON.stringify(after.mcpServers.figma)).toBe(figmaBytes);
-    expect(JSON.stringify(after.mcpServers.paper)).toBe(paperBytes);
-    // The unrelated top-level key survives too.
-    expect(after.userID).toBe('u-123');
-  });
-
-  it('e2e #2 — already-registered: re-run adds NO duplicate (idempotent no-op)', () => {
-    const f = seedClaudeWithFigmaPaper();
-    const args = {
-      name: 'vyg',
-      manifest: VYG_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    };
-    const first = registerClaudeServer(args);
-    expect(first.changed).toBe(true);
-    const afterFirst = fs.readFileSync(f, 'utf-8');
-
-    const second = registerClaudeServer(args);
-    expect(second.changed).toBe(false); // no-op
-    expect(fs.readFileSync(f, 'utf-8')).toBe(afterFirst); // byte-for-byte unchanged
-
-    // Exactly one vyg entry (no duplicate keys possible in JSON, but assert count of servers).
-    const doc = JSON.parse(afterFirst);
-    expect(Object.keys(doc.mcpServers).sort()).toEqual(['figma', 'paper', 'vyg']);
-  });
-
-  it('e2e #3 — collision with a differently-defined server: abort without overwriting', () => {
-    const f = seedClaudeWithFigmaPaper();
-    // Pre-existing vyg with a DIFFERENT definition (user-owned, no provenance).
-    const doc = JSON.parse(fs.readFileSync(f, 'utf-8'));
-    doc.mcpServers.vyg = { type: 'http', url: 'https://USER-OWNED.example' };
-    const original = JSON.stringify(doc, null, 2) + '\n';
-    fs.writeFileSync(f, original);
-
-    expect(() =>
-      registerClaudeServer({
-        name: 'vyg',
-        manifest: { type: 'http', url: 'https://mcp.vyg.app' },
-        pack: 'hq-pack-vyg',
-        env,
-      }),
-    ).toThrow(McpNameCollisionError);
-
-    // File untouched — the user's vyg definition is intact, figma/paper intact.
-    expect(fs.readFileSync(f, 'utf-8')).toBe(original);
-  });
-
-  it('e2e #3b — re-registering an IDENTICAL def (provenance-ignored) is a no-op, not a collision', () => {
-    const f = seedClaudeWithFigmaPaper();
-    // Pre-existing vyg with the SAME meaningful def but NO provenance stamp.
-    const doc = JSON.parse(fs.readFileSync(f, 'utf-8'));
-    doc.mcpServers.vyg = { type: 'http', url: 'https://mcp.vyg.app' };
-    fs.writeFileSync(f, JSON.stringify(doc, null, 2) + '\n');
-
-    const res = registerClaudeServer({
-      name: 'vyg',
-      manifest: { type: 'http', url: 'https://mcp.vyg.app' },
-      pack: 'hq-pack-vyg',
-      env,
-    });
-    // Same meaningful def -> no-op (does NOT abort, does NOT re-stamp).
-    expect(res.changed).toBe(false);
-    const after = JSON.parse(fs.readFileSync(f, 'utf-8'));
-    expect(after.mcpServers.vyg._hqPack).toBeUndefined();
-  });
-});
-
-describe('US-007/US-008: registerServer fan-out (Claude always; Codex when ~/.codex exists)', () => {
-  it('registers the Claude surface and SKIPS Codex when ~/.codex is absent', () => {
-    const result = registerServer({
-      name: 'vyg',
-      manifest: VYG_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-    expect(result.claude.changed).toBe(true);
-    expect('skipped' in result.codex && result.codex.skipped).toBe(true);
-    expect((result.codex as { reason: string }).reason).toMatch(/Codex/);
-    // ~/.codex was NOT fabricated.
-    expect(fs.existsSync(codexHome(env))).toBe(false);
-  });
-
-  it('US-008: registers BOTH surfaces when ~/.codex EXISTS (Codex no longer skipped)', () => {
-    fs.mkdirSync(codexHome(env), { recursive: true });
-    const result = registerServer({
-      name: 'vyg',
-      manifest: VYG_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-    expect(result.claude.changed).toBe(true);
-    // Codex is now a real surface result (not a skip).
-    expect('skipped' in result.codex).toBe(false);
-    expect((result.codex as { changed: boolean }).changed).toBe(true);
-    // Codex config WAS written with the new table.
-    const tomlPath = path.join(codexHome(env), 'config.toml');
-    expect(fs.existsSync(tomlPath)).toBe(true);
-    const doc = parseToml(fs.readFileSync(tomlPath, 'utf-8')) as Record<string, any>;
-    expect(doc.mcp_servers.vyg.url).toBe('https://mcp.vyg.app');
-    expect(doc.mcp_servers.vyg.headers.Authorization).toBe('Bearer FAKE-RESOLVED-KEY');
-  });
-});
-
-describe('US-007: registerMcpServers (the pack-install routing seam)', () => {
-  it('fans each declared server out via a caller-supplied manifest loader', () => {
-    const manifests: Record<string, McpManifest> = {
-      vyg: VYG_MANIFEST,
-    };
-    const results = registerMcpServers('hq-pack-vyg', ['vyg'], {
-      loadManifest: (n) => manifests[n]!,
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-    expect(results).toHaveLength(1);
-    expect(results[0]!.claude.changed).toBe(true);
-    const doc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(doc.mcpServers.vyg._hqPack).toBe('hq-pack-vyg');
-    expect(doc.mcpServers.vyg.headers.Authorization).toBe('Bearer FAKE-RESOLVED-KEY');
-  });
-
-  it('validates each server name before loading its manifest (injection guard)', () => {
-    const loader: SecretResolver = () => 'k';
-    expect(() =>
-      registerMcpServers('p', ['BAD/NAME'], { loadManifest: () => VYG_MANIFEST, resolveSecret: loader, env }),
-    ).toThrow(McpManifestError);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// US-012: HQ_DISABLE_MCP_REGISTRATION kill-switch
-//
-// With HQ_DISABLE_MCP_REGISTRATION=1, registerMcpServers short-circuits ALL MCP
-// registration: NO server is written to the sandbox ~/.claude.json (or ~/.codex),
-// a one-line skip NOTICE is produced on stderr, and the function returns cleanly
-// with empty results. The env is read off process.env (NOT the SafeWriteEnv home
-// injector), so we set/unset it around each test and restore in afterEach. As
-// always, the sandbox `home` tmpdir means the real ~/.claude.json is never touched.
-// ---------------------------------------------------------------------------
-
-describe('US-012: HQ_DISABLE_MCP_REGISTRATION kill-switch', () => {
-  let priorFlag: string | undefined;
-
-  beforeEach(() => {
-    priorFlag = process.env.HQ_DISABLE_MCP_REGISTRATION;
-  });
-
-  afterEach(() => {
-    // Restore the original env so no test leaks the kill-switch to its siblings.
-    if (priorFlag === undefined) {
-      delete process.env.HQ_DISABLE_MCP_REGISTRATION;
-    } else {
-      process.env.HQ_DISABLE_MCP_REGISTRATION = priorFlag;
-    }
-  });
-
-  it('skips ALL registration: no server written, empty results, one stderr notice', () => {
-    process.env.HQ_DISABLE_MCP_REGISTRATION = '1';
-    const writes: string[] = [];
-    const spy = vi
-      .spyOn(process.stderr, 'write')
-      .mockImplementation((chunk: string | Uint8Array): boolean => {
-        writes.push(typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf-8'));
-        return true;
-      });
-    try {
-      const results = registerMcpServers('hq-pack-vyg', ['vyg'], {
-        loadManifest: () => VYG_MANIFEST,
-        resolveSecret: () => 'FAKE-RESOLVED-KEY',
-        env,
-      });
-      // Returns cleanly with empty results — the "no servers registered" semantic.
-      expect(results).toEqual([]);
-      // No Claude config was written (kill-switch fired before any emit).
-      expect(fs.existsSync(claudePath())).toBe(false);
-      // Exactly one skip NOTICE, naming the kill-switch.
-      const notices = writes.filter((w) => /HQ_DISABLE_MCP_REGISTRATION/.test(w));
-      expect(notices).toHaveLength(1);
-      expect(notices[0]).toMatch(/MCP registration skipped \(HQ_DISABLE_MCP_REGISTRATION=1\)/);
-    } finally {
-      spy.mockRestore();
-    }
-  });
-
-  it('leaves a PRE-EXISTING claude config unchanged (no new server entry merged)', () => {
-    // Seed the sandbox with the user's real-world non-HQ servers, then assert the
-    // kill-switch leaves the file byte-for-byte unchanged (no vyg entry added).
-    const f = seedClaudeWithFigmaPaper();
-    const before = fs.readFileSync(f, 'utf-8');
-    process.env.HQ_DISABLE_MCP_REGISTRATION = '1';
-    const spy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
-    try {
-      const results = registerMcpServers('hq-pack-vyg', ['vyg'], {
-        loadManifest: () => VYG_MANIFEST,
-        resolveSecret: () => 'FAKE-RESOLVED-KEY',
-        env,
-      });
-      expect(results).toEqual([]);
-      const after = fs.readFileSync(f, 'utf-8');
-      expect(after).toBe(before);
-      const doc = JSON.parse(after);
-      expect(doc.mcpServers.vyg).toBeUndefined();
-      // Untouched non-HQ servers survive.
-      expect(doc.mcpServers.figma).toBeDefined();
-      expect(doc.mcpServers.paper).toBeDefined();
-    } finally {
-      spy.mockRestore();
-    }
-  });
-
-  it('fires the kill-switch BEFORE the loadManifest guard (operator never sees a manifest error)', () => {
-    // An operator who set the kill-switch must NOT hit a spurious McpManifestError
-    // even when no loadManifest is supplied — the operator condition wins.
-    process.env.HQ_DISABLE_MCP_REGISTRATION = '1';
-    const spy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
-    try {
-      const results = registerMcpServers('hq-pack-vyg', ['vyg']);
-      expect(results).toEqual([]);
-    } finally {
-      spy.mockRestore();
-    }
-  });
-
-  it('does NOT fire when the flag is unset/other value (normal registration proceeds)', () => {
-    delete process.env.HQ_DISABLE_MCP_REGISTRATION;
-    const results = registerMcpServers('hq-pack-vyg', ['vyg'], {
-      loadManifest: () => VYG_MANIFEST,
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-    expect(results).toHaveLength(1);
-    expect(results[0]!.claude.changed).toBe(true);
-    const doc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(doc.mcpServers.vyg._hqPack).toBe('hq-pack-vyg');
-  });
-});
-
-describe('US-007: claudeConfigFormat + path point at the PINNED single surface', () => {
-  it('claudeConfigPath resolves to ~/.claude.json under the injected home', () => {
-    expect(claudeConfigPath(env)).toBe(path.join(home, '.claude.json'));
-  });
-
-  it('claudeConfigFormat.assertEntry requires mcpServers.<name>', () => {
-    expect(() => claudeConfigFormat.assertEntry({ mcpServers: { vyg: {} } }, 'vyg')).not.toThrow();
-    expect(() => claudeConfigFormat.assertEntry({ mcpServers: {} }, 'vyg')).toThrow();
-    expect(() => claudeConfigFormat.assertEntry({}, 'vyg')).toThrow();
-  });
-
-  it('claudeConfigFormat.emptyDoc is {} (does NOT presume an mcpServers key)', () => {
-    expect(claudeConfigFormat.emptyDoc()).toEqual({});
-  });
-});
-
-// ===========================================================================
-// US-008 — Codex/TOML merge emit (consumes the US-006 safe-write core).
-//
-// CRITICAL TEST SAFETY (unchanged from US-006/007): every test runs against the
-// isolated tmpdir `home` and NEVER touches the developer's real
-// ~/.codex/config.toml. The Codex emit is gated on isCodexInstalled(env), so we
-// must `mkdir ~/.codex` under the fake home for the emitter to act.
-// ===========================================================================
-
-/** Path to the sandbox ~/.codex/config.toml. */
-const codexPath = () => codexConfigPath(env);
-
-/** Create the sandbox ~/.codex dir so the emitter does not first-class-skip. */
-function mkCodexHome(): void {
-  fs.mkdirSync(codexHome(env), { recursive: true });
-}
-
-/**
- * Seed ~/.codex/config.toml with a top-of-file comment, a `superhuman` server
- * (with an `.env` sub-table) and a `node_repl` server (with two
- * `.tools.<t>.approval_mode` sub-tables) — the exact fixture from PRD e2e #1.
- */
-function seedCodexSuperhumanNodeRepl(): string {
-  mkCodexHome();
-  const toml = `# Codex global config — hand-edited, DO NOT CLOBBER
-# (this comment block must survive a register)
-
-model = "gpt-5"
-
-[mcp_servers.superhuman]
-command = "npx"
-args = ["-y", "superhuman-mcp"]
-
-[mcp_servers.superhuman.env]
-SUPERHUMAN_TOKEN = "tok-abc"
-
-[mcp_servers.node_repl]
-command = "node"
-args = ["repl.js"]
-
-[mcp_servers.node_repl.tools.execute]
-approval_mode = "always"
-
-[mcp_servers.node_repl.tools.read]
-approval_mode = "never"
-`;
-  fs.writeFileSync(codexPath(), toml);
-  return codexPath();
-}
-
-describe('US-008: Codex config path + format point at the GLOBAL Codex surface', () => {
-  it('codexConfigPath is ~/.codex/config.toml (NOT a project file)', () => {
-    expect(codexConfigPath(env)).toBe(path.join(home, '.codex', 'config.toml'));
-  });
-
-  it('codexConfigFormat.assertEntry requires mcp_servers.<name>', () => {
-    const present: CodexTomlDoc = { value: { mcp_servers: { vyg: {} } }, originalText: null };
-    const absent: CodexTomlDoc = { value: { mcp_servers: {} }, originalText: null };
-    expect(() => codexConfigFormat.assertEntry(present, 'vyg')).not.toThrow();
-    expect(() => codexConfigFormat.assertEntry(absent, 'vyg')).toThrow();
-    expect(() => codexConfigFormat.assertEntry({ value: {}, originalText: null }, 'vyg')).toThrow();
-  });
-
-  it('codexConfigFormat.parse round-trips valid TOML and rejects malformed input', () => {
-    const ok = codexConfigFormat.parse('[mcp_servers.x]\ntype = "http"\nurl = "https://x"\n');
-    expect((ok.value.mcp_servers as any).x.url).toBe('https://x');
-    // Malformed TOML must throw (the substrate maps this to ConfigParseError).
-    expect(() => codexConfigFormat.parse('this = = is [[[ not toml')).toThrow();
-  });
-
-  it('CODEX_MCP_SERVERS_KEY is the mcp_servers super-table', () => {
-    expect(CODEX_MCP_SERVERS_KEY).toBe('mcp_servers');
-  });
-});
-
-describe('US-008: buildCodexServerDef (transport passthrough, secrets, provenance, approval_mode)', () => {
-  it('passes transport fields through and resolves ${secret:} into headers', () => {
-    const sink = new Set<string>();
-    const def = buildCodexServerDef(VYG_MANIFEST, 'hq-pack-vyg', () => 'FAKE-CODEX-KEY', sink);
-    expect(def.type).toBe('http');
-    expect(def.url).toBe('https://mcp.vyg.app');
-    expect((def.headers as Record<string, string>).Authorization).toBe('Bearer FAKE-CODEX-KEY');
-    expect(sink.has('FAKE-CODEX-KEY')).toBe(true);
-    expect(def[HQ_PACK_PROVENANCE_KEY]).toBe('hq-pack-vyg');
-  });
-
-  it('writes the per-tool approval_mode from the manifest where present', () => {
-    const manifest: McpManifest = {
-      type: 'http',
-      url: 'https://mcp.vyg.app',
-      tools: {
-        execute_query: { approval_mode: 'always' },
-        get_brand_info: { approval_mode: 'never' },
-        no_mode_tool: { something: 'else' }, // no approval_mode -> omitted
-      },
-    };
-    const def = buildCodexServerDef(manifest, 'p', () => 'k', new Set());
-    const tools = def.tools as Record<string, { approval_mode?: string }>;
-    expect(tools.execute_query.approval_mode).toBe('always');
-    expect(tools.get_brand_info.approval_mode).toBe('never');
-    expect(tools.no_mode_tool).toBeUndefined(); // only approval_mode tools emitted
-  });
-
-  it('omits the tools table entirely when no tool declares an approval_mode', () => {
-    expect(buildCodexToolsTable(undefined)).toBeUndefined();
-    expect(buildCodexToolsTable({})).toBeUndefined();
-    expect(buildCodexToolsTable({ t: { something: 'x' } as any })).toBeUndefined();
-    const def = buildCodexServerDef({ type: 'http', url: 'https://x' }, 'p', () => 'k', new Set());
-    expect(def.tools).toBeUndefined();
-  });
-});
-
-describe('US-008: appendCodexTable / serializeOneCodexServer (comment-preserving emit)', () => {
-  it('serializeOneCodexServer emits a single [mcp_servers.<name>] table', () => {
-    const out = serializeOneCodexServer('vyg', { type: 'http', url: 'https://x' });
-    expect(out).toContain('[mcp_servers.vyg]');
-    expect(out).toContain('url = "https://x"');
-    // Round-trips back to a value.
-    const re = parseToml(out) as any;
-    expect(re.mcp_servers.vyg.url).toBe('https://x');
-  });
-
-  it('appendCodexTable preserves the original bytes verbatim and adds the new table', () => {
-    const original = '# my comment\n[mcp_servers.a]\ntype = "http"\nurl = "https://a"\n';
-    const out = appendCodexTable(original, 'b', { type: 'http', url: 'https://b' });
-    // Original comment + table preserved byte-for-byte at the head.
-    expect(out.startsWith('# my comment\n[mcp_servers.a]')).toBe(true);
-    expect(out).toContain('# my comment');
-    // New table appended, whole thing re-parses with BOTH servers.
-    const re = parseToml(out) as any;
-    expect(Object.keys(re.mcp_servers).sort()).toEqual(['a', 'b']);
-    expect(re.mcp_servers.a.url).toBe('https://a'); // untouched
-    expect(re.mcp_servers.b.url).toBe('https://b'); // added
-  });
-
-  it('appendCodexTable on whitespace-only original emits just the block', () => {
-    const out = appendCodexTable('   \n\n', 'x', { type: 'http', url: 'https://x' });
-    expect(out.trimStart().startsWith('[mcp_servers.x]')).toBe(true);
-    expect(parseToml(out)).toBeTruthy();
-  });
-});
-
-describe('US-008: mergeCodexServer (insert / idempotent no-op / collision)', () => {
-  it('inserts an absent server and records a pending append', () => {
-    const doc: CodexTomlDoc = { value: {}, originalText: '# c\n' };
-    const next = mergeCodexServer('vyg', { type: 'http', url: 'https://x' })(doc);
-    expect((next.value.mcp_servers as any).vyg.url).toBe('https://x');
-    // serialize must append (comment preserved).
-    const text = codexConfigFormat.serialize(next);
-    expect(text).toContain('# c');
-    expect(text).toContain('[mcp_servers.vyg]');
-  });
-
-  it('is an idempotent no-op when the server is already present with an equal def', () => {
-    const def = { type: 'http', url: 'https://x', _hqPack: 'p' };
-    const original = serializeOneCodexServer('vyg', def);
-    const doc: CodexTomlDoc = { value: parseToml(original) as any, originalText: original };
-    const next = mergeCodexServer('vyg', { type: 'http', url: 'https://x' })(doc);
-    // Unchanged doc -> serialize reproduces the original text exactly.
-    expect(codexConfigFormat.serialize(next)).toBe(original);
-  });
-
-  it('throws McpNameCollisionError on a differently-defined existing server', () => {
-    const original = serializeOneCodexServer('vyg', { type: 'http', url: 'https://OLD' });
-    const doc: CodexTomlDoc = { value: parseToml(original) as any, originalText: original };
-    expect(() => mergeCodexServer('vyg', { type: 'http', url: 'https://NEW' })(doc)).toThrow(
-      McpNameCollisionError,
-    );
-  });
-});
-
-describe('US-008: registerCodexServer — Codex-absent skip + name validation', () => {
-  it('FIRST-CLASS SKIP when ~/.codex is absent (no crash, no fabrication)', () => {
-    const res = registerCodexServer({ name: 'vyg', manifest: VYG_MANIFEST, pack: 'p', resolveSecret: () => 'k', env });
-    expect('skipped' in res && res.skipped).toBe(true);
-    expect((res as { reason: string }).reason).toMatch(/Codex runtime absent/);
-    // ~/.codex was NOT created.
-    expect(fs.existsSync(codexHome(env))).toBe(false);
-    expect(fs.existsSync(codexPath())).toBe(false);
-  });
-
-  it('rejects a bad server name BEFORE any IO (no backup, no write)', () => {
-    mkCodexHome();
-    expect(() =>
-      registerCodexServer({ name: 'BAD NAME', manifest: VYG_MANIFEST, pack: 'p', env }),
-    ).toThrow(McpManifestError);
-    expect(fs.existsSync(codexPath())).toBe(false);
-    expect(fs.existsSync(path.join(home, '.hq', 'backups', 'mcp'))).toBe(false);
-  });
-
-  it('writes ONE [mcp_servers.<name>] table into a fresh config.toml when ~/.codex exists', () => {
-    mkCodexHome();
-    const res = registerCodexServer({
-      name: 'vyg',
-      manifest: VYG_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => 'FAKE-CODEX-KEY',
-      env,
-    });
-    expect('skipped' in res).toBe(false);
-    expect((res as { changed: boolean }).changed).toBe(true);
-    const doc = parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any;
-    expect(doc.mcp_servers.vyg.type).toBe('http');
-    expect(doc.mcp_servers.vyg.url).toBe('https://mcp.vyg.app');
-    expect(doc.mcp_servers.vyg.headers.Authorization).toBe('Bearer FAKE-CODEX-KEY');
-    expect(doc.mcp_servers.vyg._hqPack).toBe('hq-pack-vyg');
-  });
-
-  it('the secret value is REDACTED from a collision-error message (never echoed)', () => {
-    mkCodexHome();
-    // Pre-existing differently-defined vyg forces a collision on re-register.
-    fs.writeFileSync(codexPath(), serializeOneCodexServer('vyg', { type: 'http', url: 'https://OLD' }));
-    try {
-      registerCodexServer({
-        name: 'vyg',
-        manifest: { type: 'http', url: 'https://NEW', headers: { Authorization: 'Bearer ${secret:VYG_API_KEY}' } },
-        pack: 'p',
-        resolveSecret: () => 'FAKE-CODEX-SECRET-MUST-NOT-LEAK',
-        env,
-      });
-      throw new Error('should have thrown a collision');
-    } catch (e) {
-      expect(e).toBeInstanceOf(McpNameCollisionError);
-      expect((e as Error).message).not.toContain('FAKE-CODEX-SECRET-MUST-NOT-LEAK');
-    }
-  });
-
-  it('idempotent per surface: re-register is a byte-for-byte no-op', () => {
-    mkCodexHome();
-    const args = {
-      name: 'vyg',
-      manifest: VYG_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => 'FAKE-CODEX-KEY',
-      env,
-    };
-    const first = registerCodexServer(args);
-    expect((first as { changed: boolean }).changed).toBe(true);
-    const afterFirst = fs.readFileSync(codexPath(), 'utf-8');
-    const second = registerCodexServer(args);
-    expect((second as { changed: boolean }).changed).toBe(false);
-    expect(fs.readFileSync(codexPath(), 'utf-8')).toBe(afterFirst);
-  });
-
-  it('FAIL-CLOSED on a malformed existing config.toml (ConfigParseError, file preserved)', () => {
-    mkCodexHome();
-    const garbage = 'this is = = not [[[ valid toml at all\n';
-    fs.writeFileSync(codexPath(), garbage);
-    expect(() =>
-      registerCodexServer({ name: 'vyg', manifest: VYG_MANIFEST, pack: 'p', resolveSecret: () => 'k', env }),
-    ).toThrow(ConfigParseError);
-    // The original malformed file is left untouched (never clobbered/regenerated).
-    expect(fs.readFileSync(codexPath(), 'utf-8')).toBe(garbage);
-  });
-
-  it('writes per-tool approval_mode into the emitted table', () => {
-    mkCodexHome();
-    registerCodexServer({
-      name: 'vyg',
-      manifest: {
-        type: 'http',
-        url: 'https://mcp.vyg.app',
-        tools: { execute_query: { approval_mode: 'always' } },
-      },
-      pack: 'p',
-      env,
-    });
-    const doc = parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any;
-    expect(doc.mcp_servers.vyg.tools.execute_query.approval_mode).toBe('always');
-  });
-});
-
-describe('US-008 e2e: PRD acceptance scenarios', () => {
-  it('e2e #1 — superhuman + node_repl tables: new table added; existing tables + approval_mode sub-tables preserved', () => {
-    const f = seedCodexSuperhumanNodeRepl();
-    const before = fs.readFileSync(f, 'utf-8');
-
-    const result = registerServer({
-      name: 'vyg_shopify',
-      manifest: {
-        type: 'http',
-        url: 'https://mcp.vyg.app',
-        headers: { Authorization: 'Bearer ${secret:VYG_API_KEY}' },
-        tools: { execute_query: { approval_mode: 'always' } },
-      },
-      pack: 'hq-pack-vyg-shopify',
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-
-    // Both surfaces acted on (Claude registered, Codex registered).
-    expect(result.claude.changed).toBe(true);
-    expect('skipped' in result.codex).toBe(false);
-    expect((result.codex as { changed: boolean }).changed).toBe(true);
-
-    const after = fs.readFileSync(f, 'utf-8');
-    // The hand-edited comment block survived (comment preservation).
-    expect(after).toContain('# Codex global config — hand-edited, DO NOT CLOBBER');
-    // The original superhuman + node_repl blocks are preserved byte-for-byte at the head.
-    expect(after.startsWith(before.replace(/\s*$/, ''))).toBe(true);
-
-    const doc = parseToml(after) as any;
-    // New table added.
-    expect(doc.mcp_servers.vyg_shopify.url).toBe('https://mcp.vyg.app');
-    expect(doc.mcp_servers.vyg_shopify.headers.Authorization).toBe('Bearer FAKE-RESOLVED-KEY');
-    expect(doc.mcp_servers.vyg_shopify.tools.execute_query.approval_mode).toBe('always');
-    // Existing tables preserved.
-    expect(doc.mcp_servers.superhuman.command).toBe('npx');
-    // Existing .env sub-table preserved.
-    expect(doc.mcp_servers.superhuman.env.SUPERHUMAN_TOKEN).toBe('tok-abc');
-    // Existing .tools.<t>.approval_mode sub-tables preserved.
-    expect(doc.mcp_servers.node_repl.tools.execute.approval_mode).toBe('always');
-    expect(doc.mcp_servers.node_repl.tools.read.approval_mode).toBe('never');
-    // No secret on disk anywhere except the resolved header (which the runtime needs).
-    expect(after).not.toContain('${secret:VYG_API_KEY}'); // reference resolved at emit
-  });
-
-  it('e2e #2 — no ~/.codex dir: Codex emit skipped cleanly and Claude still registers', () => {
-    // No mkCodexHome() — ~/.codex is absent.
-    const result = registerServer({
-      name: 'vyg',
-      manifest: VYG_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-    // Claude registered.
-    expect(result.claude.changed).toBe(true);
-    const claudeDoc = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(claudeDoc.mcpServers.vyg.url).toBe('https://mcp.vyg.app');
-    // Codex skipped cleanly, ~/.codex NOT fabricated.
-    expect('skipped' in result.codex && result.codex.skipped).toBe(true);
-    expect(fs.existsSync(codexHome(env))).toBe(false);
-    expect(fs.existsSync(codexPath())).toBe(false);
-  });
-
-  it('e2e — registerMcpServers fans out to Codex too when ~/.codex exists', () => {
-    mkCodexHome();
-    const manifests: Record<string, McpManifest> = { vyg: VYG_MANIFEST };
-    const results = registerMcpServers('hq-pack-vyg', ['vyg'], {
-      loadManifest: (n) => manifests[n]!,
-      resolveSecret: () => 'FAKE-RESOLVED-KEY',
-      env,
-    });
-    expect(results).toHaveLength(1);
-    expect((results[0]!.codex as { changed: boolean }).changed).toBe(true);
-    const doc = parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any;
-    expect(doc.mcp_servers.vyg._hqPack).toBe('hq-pack-vyg');
-  });
-});
-
-// ===========================================================================
-// US-009 — Uninstall un-registration (provenance-scoped, no leak).
-//
-// CRITICAL TEST SAFETY (unchanged): every test runs against the isolated tmpdir
-// `home` and NEVER touches the developer's real ~/.claude.json / ~/.codex.
-//
-// The mirror of register: removal is PROVENANCE-SCOPED — only entries stamped with
-// THIS pack's `_hqPack` are removed; a same-named entry that is unstamped (user) or
-// stamped by another pack is SKIPPED-AND-WARNED, never deleted.
-// ===========================================================================
-
-describe('US-009: removeClaudeServer merge fn (provenance-scoped, surgical)', () => {
-  it('removes ONLY the matching-provenance entry, preserving siblings + top-level keys', () => {
-    const doc = {
-      userID: 'u-1', // a non-mcp top-level key that MUST survive
-      mcpServers: {
-        figma: { type: 'http', url: 'https://figma' }, // user-created (no stamp)
-        vyg: { type: 'http', url: 'https://vyg', _hqPack: 'hq-pack-vyg' }, // ours
-      },
-    };
-    const next = removeClaudeServer('vyg', 'hq-pack-vyg')(doc);
-    expect((next.mcpServers as any).vyg).toBeUndefined(); // removed
-    expect((next.mcpServers as any).figma.url).toBe('https://figma'); // sibling preserved
-    expect((next as any).userID).toBe('u-1'); // top-level key preserved
-  });
-
-  it('is an idempotent no-op when the server is ABSENT (returns the doc unchanged)', () => {
-    const doc = { mcpServers: { figma: { type: 'http', url: 'https://figma' } } };
-    expect(removeClaudeServer('vyg', 'hq-pack-vyg')(doc)).toBe(doc); // same ref => unchanged
-  });
-
-  it('SKIPS (leaves untouched) an entry whose provenance does NOT match this pack', () => {
-    const doc = { mcpServers: { vyg: { type: 'http', url: 'https://vyg', _hqPack: 'OTHER-PACK' } } };
-    expect(removeClaudeServer('vyg', 'hq-pack-vyg')(doc)).toBe(doc); // foreign => unchanged
-  });
-
-  it('SKIPS (leaves untouched) an UNSTAMPED (user-created) same-named entry — never bare name-match', () => {
-    const doc = { mcpServers: { vyg: { type: 'http', url: 'https://user-vyg' } } };
-    expect(removeClaudeServer('vyg', 'hq-pack-vyg')(doc)).toBe(doc); // unstamped => unchanged
-  });
-
-  it('leaves an empty mcpServers:{} after removing the last entry (round-trips, idempotent)', () => {
-    const doc = { mcpServers: { vyg: { type: 'http', _hqPack: 'p' } } };
-    const next = removeClaudeServer('vyg', 'p')(doc);
-    expect(next.mcpServers).toEqual({});
-  });
-});
-
-describe('US-009: claudeRemovalFormat.assertEntry asserts ABSENCE (inverted verify)', () => {
-  it('throws iff the entry is STILL present after removal; passes when absent', () => {
-    expect(() => claudeRemovalFormat.assertEntry({ mcpServers: { vyg: {} } }, 'vyg')).toThrow();
-    expect(() => claudeRemovalFormat.assertEntry({ mcpServers: {} }, 'vyg')).not.toThrow();
-    expect(() => claudeRemovalFormat.assertEntry({}, 'vyg')).not.toThrow();
-  });
-});
-
-describe('US-009: unregisterClaudeServer — provenance-scoped removal via writeConfigAtomic', () => {
-  it('removes our stamped entry and preserves the user\'s sibling + top-level keys byte-for-byte', () => {
-    // Seed a user figma/paper config, then register our vyg into it.
-    seedClaudeWithFigmaPaper();
-    registerClaudeServer({ name: 'vyg', manifest: { type: 'http', url: 'https://vyg' }, pack: 'hq-pack-vyg', env });
-    const beforeUserBlock = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(beforeUserBlock.mcpServers.vyg._hqPack).toBe('hq-pack-vyg');
-
-    const res = unregisterClaudeServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect(res.outcome).toBe('removed');
-    expect(res.changed).toBe(true);
-
-    const after = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(after.mcpServers.vyg).toBeUndefined(); // ours removed
-    expect(after.mcpServers.figma.url).toBe('http://localhost:3845/mcp'); // user sibling intact
-    expect(after.mcpServers.paper.command).toBe('/opt/homebrew/bin/npx'); // user sibling intact
-    expect(after.userID).toBe('u-123'); // unrelated top-level key intact
-  });
-
-  it('SKIPS-AND-WARNS on a same-named entry the user owns (unstamped) — never deletes it', () => {
-    // The user has their OWN `vyg` server (no _hqPack). Uninstalling our pack must NOT touch it.
-    const doc = { mcpServers: { vyg: { type: 'http', url: 'https://user-owned-vyg' } } };
-    fs.writeFileSync(claudePath(), JSON.stringify(doc, null, 2) + '\n');
-    const before = fs.readFileSync(claudePath(), 'utf-8');
-
-    const res = unregisterClaudeServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect(res.outcome).toBe('skipped-foreign');
-    expect(res.changed).toBe(false);
-    expect(res.reason).toMatch(/not owned by pack/);
-    // File untouched byte-for-byte.
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(before);
-  });
-
-  it('is a clean no-op (absent) when ~/.claude.json does not exist (never created)', () => {
-    const res = unregisterClaudeServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect(res.outcome).toBe('absent');
-    expect(res.changed).toBe(false);
-    expect(fs.existsSync(claudePath())).toBe(false); // not fabricated
-  });
-
-  it('is idempotent — a second uninstall of an already-removed server is a clean no-op', () => {
-    registerClaudeServer({ name: 'vyg', manifest: { type: 'http', url: 'https://vyg' }, pack: 'p', env });
-    expect(unregisterClaudeServer({ name: 'vyg', pack: 'p', env }).outcome).toBe('removed');
-    const second = unregisterClaudeServer({ name: 'vyg', pack: 'p', env });
-    expect(second.outcome).toBe('absent');
-    expect(second.changed).toBe(false);
-  });
-});
-
-describe('US-009: removeCodexServer + codexRemovalFormat (TOML, surgical, comment-drop on removal)', () => {
-  it('removes our table, preserving sibling tables + .tools.<t>.approval_mode sub-tables (DATA)', () => {
-    seedCodexSuperhumanNodeRepl();
-    // Register our own stamped server alongside the user's superhuman/node_repl.
-    registerCodexServer({
-      name: 'vyg',
-      manifest: { type: 'http', url: 'https://vyg' },
-      pack: 'hq-pack-vyg',
-      env,
-    });
-    const withVyg = parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any;
-    expect(withVyg.mcp_servers.vyg._hqPack).toBe('hq-pack-vyg');
-
-    const res = unregisterCodexServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect('skipped' in res).toBe(false);
-    expect((res as any).outcome).toBe('removed');
-
-    const after = parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any;
-    expect(after.mcp_servers.vyg).toBeUndefined(); // ours removed
-    // Sibling tables + their sub-tables preserved as DATA across the re-serialize.
-    expect(after.mcp_servers.superhuman.command).toBe('npx');
-    expect(after.mcp_servers.superhuman.env.SUPERHUMAN_TOKEN).toBe('tok-abc');
-    expect(after.mcp_servers.node_repl.tools.execute.approval_mode).toBe('always');
-    expect(after.mcp_servers.node_repl.tools.read.approval_mode).toBe('never');
-  });
-
-  it('SKIPS-AND-WARNS a foreign-stamped table and reproduces the file byte-for-byte (comments intact)', () => {
-    mkCodexHome();
-    // A table stamped by ANOTHER pack, plus a leading comment.
-    const original = '# keep this comment\n[mcp_servers.vyg]\ntype = "http"\nurl = "https://vyg"\n_hqPack = "OTHER-PACK"\n';
-    fs.writeFileSync(codexPath(), original);
-
-    const res = unregisterCodexServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect('skipped' in res).toBe(false);
-    expect((res as any).outcome).toBe('skipped-foreign');
-    // No write => original bytes (and the comment) preserved exactly.
-    expect(fs.readFileSync(codexPath(), 'utf-8')).toBe(original);
-  });
-
-  it('removeCodexServer is an idempotent no-op when the table is absent (originalText round-trips)', () => {
-    const original = '# c\n[mcp_servers.other]\ntype = "http"\nurl = "https://o"\n';
-    const doc: CodexTomlDoc = { value: parseToml(original) as any, originalText: original };
-    const next = removeCodexServer('vyg', 'p')(doc);
-    expect(codexRemovalFormat.serialize(next)).toBe(original); // unchanged => byte-for-byte
-  });
-
-  it('codexRemovalFormat.assertEntry asserts ABSENCE (inverted verify)', () => {
-    const present: CodexTomlDoc = { value: { mcp_servers: { vyg: {} } }, originalText: null };
-    const absent: CodexTomlDoc = { value: { mcp_servers: {} }, originalText: null };
-    expect(() => codexRemovalFormat.assertEntry(present, 'vyg')).toThrow();
-    expect(() => codexRemovalFormat.assertEntry(absent, 'vyg')).not.toThrow();
-  });
-});
-
-describe('US-009: unregisterCodexServer — Codex-absent first-class skip + idempotency', () => {
-  it('FIRST-CLASS SKIP when ~/.codex is absent (no crash, no fabrication)', () => {
-    const res = unregisterCodexServer({ name: 'vyg', pack: 'p', env });
-    expect('skipped' in res && res.skipped).toBe(true);
-    expect(fs.existsSync(codexHome(env))).toBe(false); // not fabricated
-  });
-
-  it('is a clean no-op (absent) when ~/.codex exists but config.toml does not', () => {
-    mkCodexHome();
-    const res = unregisterCodexServer({ name: 'vyg', pack: 'p', env });
-    expect('skipped' in res).toBe(false);
-    expect((res as any).outcome).toBe('absent');
-    expect(fs.existsSync(codexPath())).toBe(false); // not fabricated
-  });
-});
-
-describe('US-009: unregisterServer fan-out + unregisterMcpServers seam', () => {
-  it('unregisterServer removes from BOTH surfaces when Codex is present', () => {
-    seedClaudeWithFigmaPaper();
-    mkCodexHome();
-    registerServer({ name: 'vyg', manifest: { type: 'http', url: 'https://vyg' }, pack: 'hq-pack-vyg', env });
-    expect(JSON.parse(fs.readFileSync(claudePath(), 'utf-8')).mcpServers.vyg).toBeDefined();
-    expect((parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any).mcp_servers.vyg).toBeDefined();
-
-    const res = unregisterServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect(res.claude.outcome).toBe('removed');
-    expect('skipped' in res.codex).toBe(false);
-    expect((res.codex as any).outcome).toBe('removed');
-    // Both surfaces no longer carry vyg; the user's figma sibling survives.
-    expect(JSON.parse(fs.readFileSync(claudePath(), 'utf-8')).mcpServers.vyg).toBeUndefined();
-    expect(JSON.parse(fs.readFileSync(claudePath(), 'utf-8')).mcpServers.figma).toBeDefined();
-    expect((parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any).mcp_servers.vyg).toBeUndefined();
-  });
-
-  it('unregisterMcpServers fans out over multiple names in order (no manifest loader needed)', () => {
-    registerClaudeServer({ name: 'vyg', manifest: { type: 'http', url: 'https://vyg' }, pack: 'p', env });
-    registerClaudeServer({ name: 'shopify', manifest: { type: 'http', url: 'https://shop' }, pack: 'p', env });
-    const results = unregisterMcpServers('p', ['vyg', 'shopify'], { env });
-    expect(results).toHaveLength(2);
-    expect(results[0]!.claude.outcome).toBe('removed');
-    expect(results[1]!.claude.outcome).toBe('removed');
-    const after = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(after.mcpServers).toEqual({}); // both removed
-  });
-});
-
-describe('US-009 e2e: PRD acceptance scenarios', () => {
-  it('e2e #1 — installed pack removed; a differently-named user server preserved byte-for-byte', () => {
-    // A co-located config: the user owns `figma`/`paper` (no stamp); we install `vyg`.
-    seedClaudeWithFigmaPaper();
-    registerClaudeServer({ name: 'vyg', manifest: { type: 'http', url: 'https://mcp.vyg.app' }, pack: 'hq-pack-vyg', env });
-
-    // Snapshot the user's own (figma/paper) entries to prove byte-for-byte preservation.
-    const userBefore = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    const figmaBefore = JSON.stringify(userBefore.mcpServers.figma);
-    const paperBefore = JSON.stringify(userBefore.mcpServers.paper);
-
-    const res = unregisterMcpServers('hq-pack-vyg', ['vyg'], { env });
-    expect(res[0]!.claude.outcome).toBe('removed'); // ONLY our provenance-stamped entry removed
-
-    const after = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(after.mcpServers.vyg).toBeUndefined(); // pack entry gone
-    // The user's differently-named servers are preserved byte-for-byte.
-    expect(JSON.stringify(after.mcpServers.figma)).toBe(figmaBefore);
-    expect(JSON.stringify(after.mcpServers.paper)).toBe(paperBefore);
-    expect(after.userID).toBe('u-123');
-  });
-
-  it('e2e #1 (strengthened) — pack A removed; SAME-NAMED user server + pack-B server BOTH preserved byte-for-byte', () => {
-    // The exact PRD scenario: an installed pack PLUS the user's OWN same-named server,
-    // PLUS a server installed by a DIFFERENT pack 'B'. Uninstalling pack A must remove
-    // ONLY A's provenance-stamped entry and leave the user's + B's untouched byte-for-byte.
-    //
-    // Names in play (all in ONE ~/.claude.json):
-    //   - `vyg`        : stamped `_hqPack: 'hq-pack-A'`   -> A owns it, MUST be removed.
-    //   - `vyg_user`   : user-created, NO `_hqPack`       -> the user's own same-shape
-    //                    server under a different name; MUST survive byte-for-byte.
-    //   - `vyg`-collision is impossible (one JSON key), so the "same-named user server"
-    //     guarantee is exercised separately below via the foreign-skip e2e. Here we also
-    //     stamp a B-owned server under its own name to prove cross-pack isolation.
-    //   - `shopify`    : stamped `_hqPack: 'hq-pack-B'`   -> B owns it, MUST survive.
-    //   - `figma`      : user-created (no stamp)          -> MUST survive byte-for-byte.
-    const doc = {
-      userID: 'u-xyz', // an unrelated top-level key that MUST survive untouched
-      tipsHistory: { seen: ['a', 'b'] }, // another untouched top-level key
-      mcpServers: {
-        figma: { type: 'http', url: 'http://localhost:3845/mcp' }, // user, unstamped
-        vyg_user: { type: 'http', url: 'https://user-owned.example' }, // user, unstamped
-        vyg: { type: 'http', url: 'https://mcp.vyg.app', _hqPack: 'hq-pack-A' }, // A owns
-        shopify: { type: 'http', url: 'https://mcp.shopify.app', _hqPack: 'hq-pack-B' }, // B owns
-      },
-    };
-    fs.writeFileSync(claudePath(), JSON.stringify(doc, null, 2) + '\n');
-
-    // Snapshot every entry we expect to survive, to prove BYTE-FOR-BYTE preservation.
-    const before = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    const figmaBytes = JSON.stringify(before.mcpServers.figma);
-    const vygUserBytes = JSON.stringify(before.mcpServers.vyg_user);
-    const shopifyBytes = JSON.stringify(before.mcpServers.shopify);
-
-    // Uninstall ONLY pack A.
-    const res = unregisterMcpServers('hq-pack-A', ['vyg'], { env });
-    expect(res[0]!.claude.outcome).toBe('removed'); // A's stamped entry removed
-
-    const after = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    // A's entry is GONE.
-    expect(after.mcpServers.vyg).toBeUndefined();
-    // The user's own server + pack B's server are preserved BYTE-FOR-BYTE.
-    expect(JSON.stringify(after.mcpServers.figma)).toBe(figmaBytes);
-    expect(JSON.stringify(after.mcpServers.vyg_user)).toBe(vygUserBytes);
-    expect(JSON.stringify(after.mcpServers.shopify)).toBe(shopifyBytes);
-    // B's provenance stamp is intact (we did not strip a foreign pack's marker).
-    expect(after.mcpServers.shopify._hqPack).toBe('hq-pack-B');
-    // Surrounding top-level keys are preserved untouched.
-    expect(after.userID).toBe('u-xyz');
-    expect(after.tipsHistory).toEqual({ seen: ['a', 'b'] });
-    // Exactly the expected key-set remains (A's `vyg` dropped, the other three kept).
-    expect(Object.keys(after.mcpServers).sort()).toEqual(['figma', 'shopify', 'vyg_user']);
-  });
-
-  it('e2e #1 (foreign skip-and-warn) — a SAME-NAMED user server is NOT deleted; outcome reports skipped-foreign', () => {
-    // The precise PRD guarantee: "ONLY the pack's provenance-stamped entry is removed
-    // and the user's is preserved." Here the user owns a server under the SAME name the
-    // pack would target, but it carries NO `_hqPack` (and we also exercise a DIFFERENT
-    // pack's stamp). Uninstalling pack A must skip-and-warn, never bare name-match delete.
-    const doc = {
-      mcpServers: {
-        // user owns `vyg` (no provenance) — must survive
-        vyg: { type: 'http', url: 'https://user-owned-vyg.example' },
-        // a sibling that pack B owns under the SAME name a different uninstall might hit
-        other: { type: 'http', url: 'https://b.example', _hqPack: 'hq-pack-B' },
-      },
-    };
-    const original = JSON.stringify(doc, null, 2) + '\n';
-    fs.writeFileSync(claudePath(), original);
-
-    // Uninstall pack A, which declares a `vyg` server — but the on-disk `vyg` is the
-    // user's, so it is NOT ours to remove.
-    const res = unregisterMcpServers('hq-pack-A', ['vyg'], { env });
-    expect(res[0]!.claude.outcome).toBe('skipped-foreign'); // warn, never removed
-    expect(res[0]!.claude.changed).toBe(false);
-    expect(res[0]!.claude.reason).toMatch(/not owned by pack/);
-
-    // The whole file is untouched byte-for-byte — the user's vyg and B's `other` survive.
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(original);
-  });
-
-  it('e2e (AC3 backup proof) — a real removal goes through writeConfigAtomic: a backup dir appears under ~/.hq/backups/mcp/', () => {
-    // AC3: removal must go through the safe-write core, which takes a backup BEFORE the
-    // write. We prove the removal PATH produced a backup (not re-testing the core's
-    // internals — US-006 owns those) by asserting a per-pack backup dir materializes.
-    seedClaudeWithFigmaPaper();
-    registerClaudeServer({ name: 'vyg', manifest: { type: 'http', url: 'https://vyg' }, pack: 'hq-pack-vyg', env });
-
-    const backupRoot = path.join(home, '.hq', 'backups', 'mcp');
-    const res = unregisterServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect(res.claude.outcome).toBe('removed');
-
-    // A backup directory now exists under ~/.hq/backups/mcp/, stamped with the pack.
-    expect(fs.existsSync(backupRoot)).toBe(true);
-    const backups = fs.readdirSync(backupRoot);
-    expect(backups.length).toBeGreaterThan(0);
-    // At least one backup dir is attributed to THIS pack (proves it went through the
-    // safe-write core's backup step on the removal write).
-    expect(backups.some((b) => b.endsWith('-hq-pack-vyg'))).toBe(true);
-    // The backup captured the PRE-removal bytes (vyg still present in the backed-up copy).
-    const packBackup = backups.find((b) => b.endsWith('-hq-pack-vyg'))!;
-    const backedUp = JSON.parse(
-      fs.readFileSync(path.join(backupRoot, packBackup, '.claude.json'), 'utf-8'),
-    );
-    expect(backedUp.mcpServers.vyg).toBeDefined(); // backup is the pre-write state
-  });
-
-  it('e2e (idempotency) — uninstall twice: the second run is a clean absent no-op that writes nothing new', () => {
-    seedClaudeWithFigmaPaper();
-    registerClaudeServer({ name: 'vyg', manifest: { type: 'http', url: 'https://vyg' }, pack: 'hq-pack-vyg', env });
-
-    // First uninstall removes our entry.
-    const first = unregisterMcpServers('hq-pack-vyg', ['vyg'], { env });
-    expect(first[0]!.claude.outcome).toBe('removed');
-    const afterFirst = fs.readFileSync(claudePath(), 'utf-8');
-
-    // Second uninstall: server already gone → absent, changed:false, byte-for-byte equal.
-    const second = unregisterMcpServers('hq-pack-vyg', ['vyg'], { env });
-    expect(second[0]!.claude.outcome).toBe('absent');
-    expect(second[0]!.claude.changed).toBe(false);
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(afterFirst); // nothing new written
-  });
-
-  it('e2e (Codex TOML surgical) — removes the pack table; sibling server + its .tools.<t>.approval_mode survive (DATA preserved)', () => {
-    // The Codex mirror of e2e #1: seed config.toml with the user's superhuman + node_repl
-    // (node_repl carries two .tools.<t>.approval_mode sub-tables), install OUR vyg, then
-    // uninstall. Our table must go; the OTHER servers' tables + approval_mode sub-tables
-    // must survive as DATA (comments may be dropped on a real removal — documented limit).
-    seedCodexSuperhumanNodeRepl();
-    registerCodexServer({ name: 'vyg', manifest: { type: 'http', url: 'https://vyg' }, pack: 'hq-pack-vyg', env });
-    expect((parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any).mcp_servers.vyg._hqPack).toBe('hq-pack-vyg');
-
-    const res = unregisterServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect('skipped' in res.codex).toBe(false);
-    expect((res.codex as { outcome: string }).outcome).toBe('removed');
-
-    const after = parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any;
-    expect(after.mcp_servers.vyg).toBeUndefined(); // ours removed
-    // Sibling server + its .env sub-table preserved as DATA.
-    expect(after.mcp_servers.superhuman.command).toBe('npx');
-    expect(after.mcp_servers.superhuman.env.SUPERHUMAN_TOKEN).toBe('tok-abc');
-    // The OTHER server's .tools.<t>.approval_mode sub-tables survive byte-for-byte (DATA).
-    expect(after.mcp_servers.node_repl.tools.execute.approval_mode).toBe('always');
-    expect(after.mcp_servers.node_repl.tools.read.approval_mode).toBe('never');
-  });
-
-  it('e2e (Codex TOML no-op) — a foreign/absent removal leaves config.toml byte-for-byte (comments incl.)', () => {
-    // The documented-limitation flip side of the surgical test: a NO-OP removal (the
-    // server is foreign-stamped, so NOT ours) takes NO write, so the original bytes —
-    // INCLUDING comments — are preserved exactly. (Only a REAL removal drops comments.)
-    mkCodexHome();
-    const original =
-      '# hand-edited Codex config — comments MUST survive a no-op uninstall\n' +
-      'model = "gpt-5"\n\n' +
-      '[mcp_servers.vyg]\n' +
-      'type = "http"\n' +
-      'url = "https://vyg"\n' +
-      '_hqPack = "hq-pack-OTHER"\n'; // owned by a DIFFERENT pack
-    fs.writeFileSync(codexPath(), original);
-
-    // Uninstall pack A: the on-disk vyg is foreign → skip-and-warn, no write.
-    const res = unregisterServer({ name: 'vyg', pack: 'hq-pack-A', env });
-    expect('skipped' in res.codex).toBe(false);
-    expect((res.codex as { outcome: string }).outcome).toBe('skipped-foreign');
-    // Byte-for-byte preserved, comments intact.
-    expect(fs.readFileSync(codexPath(), 'utf-8')).toBe(original);
-  });
-
-  it('e2e #2 — uninstall on a Codex-less host: Claude entry removed, Codex skipped cleanly (no crash, no fabricated ~/.codex)', () => {
-    // No mkCodexHome() — ~/.codex is absent.
-    registerClaudeServer({ name: 'vyg', manifest: VYG_MANIFEST, pack: 'hq-pack-vyg', resolveSecret: () => 'k', env });
-
-    const res = unregisterServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    // Claude entry removed.
-    expect(res.claude.outcome).toBe('removed');
-    expect(JSON.parse(fs.readFileSync(claudePath(), 'utf-8')).mcpServers.vyg).toBeUndefined();
-    // Codex skipped cleanly; ~/.codex NOT fabricated.
-    expect('skipped' in res.codex && res.codex.skipped).toBe(true);
-    expect(fs.existsSync(codexHome(env))).toBe(false);
-    expect(fs.existsSync(codexPath())).toBe(false);
-  });
-});
-
-// ===========================================================================
-// US-013 — REGRESSION SUITE: the unhappy paths (the M1 gate).
-//
-// US-006..US-012 shipped the dual-runtime MCP registration substrate with
-// HAPPY-path coverage. US-013 adds the FAILURE-PATH coverage the review demanded:
-// crash/partial-write atomicity, refuse-don't-clobber on malformed config, name
-// injection, symlink+0600 preservation, the SECRET-SENTINEL no-leak grep (incl.
-// the CONFIRMED smol-toml ConfigParseError source-context leak — found + fixed),
-// Codex-absent host, per-surface heal after a partial register, old-CLI/new-host
-// skew, version-floor refusal, and the install prompt content assertion.
-//
-// CRITICAL TEST SAFETY (unchanged): every test runs against the isolated tmpdir
-// `home` via the shared `env: { home }` injection and the beforeEach/afterEach
-// sandbox — NOTHING here touches the developer's real ~/.claude.json,
-// ~/.mcp.json, or ~/.codex/config.toml.
-//
-// SENTINEL CHOICE: header secrets use `HQ_SECRET_SENTINEL_*` plaintexts that do
-// NOT match common secret-scanner patterns (NOT `sk-...`, NOT a `Bearer `-prefixed
-// token) so the pre-commit detect-secrets hook does not flag the test fixtures.
-// ===========================================================================
-
-/** A secret-scanner-safe sentinel for the value being REGISTERED in this op. */
-const SENTINEL_REGISTERING = 'HQ_SECRET_SENTINEL_d4e5f6a7b8c9';
-/** A DISTINCT sentinel standing in for a PRE-EXISTING on-disk secret (the leak driver). */
-const SENTINEL_PREEXISTING = 'HQ_SECRET_SENTINEL_PREEXISTING_9a8b7c6d5e4f';
-
-/** A manifest whose Authorization header resolves to the registering sentinel. */
-const SENTINEL_MANIFEST: McpManifest = {
-  type: 'http',
-  url: 'https://mcp.vyg.app',
-  // The `${secret:}` ref resolves to SENTINEL_REGISTERING via the injected resolver.
-  headers: { Authorization: 'Token ${secret:VYG_API_KEY}' },
-};
-
-/** Resolve VYG_API_KEY -> the registering sentinel; everything else -> null. */
-const sentinelResolver: SecretResolver = (n) =>
-  n === 'VYG_API_KEY' ? SENTINEL_REGISTERING : null;
-
-// ---------------------------------------------------------------------------
-// Criterion 1 — Crash/partial-write atomicity per file (kill-mid-write, ENOSPC).
-//
-// Inject a write failure DURING the atomic write for BOTH the Claude (JSON) and
-// Codex (TOML) surfaces and assert: (a) the ORIGINAL file is intact byte-for-byte,
-// (b) a backup exists under ~/.hq/backups/mcp/. We mock the fs layer (rename /
-// fsync / write) with vi.spyOn — we NEVER actually fill the disk.
-// ---------------------------------------------------------------------------
-
-describe('US-013: crash/partial-write atomicity (ENOSPC mid-write) — Claude surface', () => {
-  afterEach(() => {
-    __fsFault.failRenameSuffix = '';
-    __fsFault.failFirstFsync = false;
-  });
-
-  it('a rename failure mid-write leaves ~/.claude.json byte-for-byte intact + a backup exists', () => {
-    const original = seedClaudeWithFigmaPaper();
-    const beforeBytes = fs.readFileSync(original, 'utf-8');
-
-    // Inject an ENOSPC at the atomic rename (the commit step of atomicReplace).
-    __fsFault.failRenameSuffix = '.claude.json';
-    try {
-      expect(() =>
-        registerClaudeServer({
-          name: 'vyg',
-          manifest: SENTINEL_MANIFEST,
-          pack: 'hq-pack-vyg',
-          resolveSecret: sentinelResolver,
-          env,
-          stamp: '2026-06-19T00-00-00Z',
-        }),
-      ).toThrow(); // the injected ENOSPC propagates (the write could not commit).
-    } finally {
-      __fsFault.failRenameSuffix = '';
-    }
-
-    // ORIGINAL preserved byte-for-byte — the crash left the file wholly intact.
-    expect(fs.readFileSync(original, 'utf-8')).toBe(beforeBytes);
-    // The pre-write backup exists under ~/.hq/backups/mcp/.
-    const backupDir = path.join(backupRoot(env), '2026-06-19T00-00-00Z-hq-pack-vyg');
-    expect(fs.existsSync(backupDir)).toBe(true);
-    expect(fs.readFileSync(path.join(backupDir, '.claude.json'), 'utf-8')).toBe(beforeBytes);
-    // No temp litter left behind by the failed write.
-    expect(fs.readdirSync(home).filter((n) => n.includes('.tmp.'))).toEqual([]);
-  });
-
-  it('an fsync failure mid-write also aborts cleanly with the original intact', () => {
-    const original = seedClaudeWithFigmaPaper();
-    const beforeBytes = fs.readFileSync(original, 'utf-8');
-
-    // Fail at the durability fsync of the temp file (before the rename commits).
-    __fsFault.failFirstFsync = true;
-    try {
-      expect(() =>
-        registerClaudeServer({ name: 'vyg', manifest: SENTINEL_MANIFEST, pack: 'p', resolveSecret: sentinelResolver, env }),
-      ).toThrow();
-    } finally {
-      __fsFault.failFirstFsync = false;
-    }
-
-    // Original wholly intact; no torn write.
-    expect(fs.readFileSync(original, 'utf-8')).toBe(beforeBytes);
-    expect(fs.readdirSync(home).filter((n) => n.includes('.tmp.'))).toEqual([]);
-  });
-});
-
-describe('US-013: crash/partial-write atomicity (ENOSPC mid-write) — Codex surface', () => {
-  afterEach(() => {
-    __fsFault.failRenameSuffix = '';
-  });
-
-  it('a rename failure mid-write leaves ~/.codex/config.toml byte-for-byte intact + a backup exists', () => {
-    const target = seedCodexSuperhumanNodeRepl();
-    const beforeBytes = fs.readFileSync(target, 'utf-8');
-
-    __fsFault.failRenameSuffix = 'config.toml';
-    try {
-      expect(() =>
-        registerCodexServer({
-          name: 'vyg',
-          manifest: SENTINEL_MANIFEST,
-          pack: 'hq-pack-vyg',
-          resolveSecret: sentinelResolver,
-          env,
-          stamp: '2026-06-19T00-00-00Z',
-        }),
-      ).toThrow();
-    } finally {
-      __fsFault.failRenameSuffix = '';
-    }
-
-    // ORIGINAL config.toml preserved byte-for-byte (comments + every table).
-    expect(fs.readFileSync(target, 'utf-8')).toBe(beforeBytes);
-    const backupDir = path.join(backupRoot(env), '2026-06-19T00-00-00Z-hq-pack-vyg');
-    expect(fs.existsSync(backupDir)).toBe(true);
-    expect(fs.readFileSync(path.join(backupDir, 'config.toml'), 'utf-8')).toBe(beforeBytes);
-    expect(fs.readdirSync(codexHome(env)).filter((n) => n.includes('.tmp.'))).toEqual([]);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 2 — Malformed existing config -> refuse-don't-clobber (BOTH surfaces).
-//
-// A non-empty UNPARSEABLE ~/.claude.json AND a non-empty UNPARSEABLE
-// ~/.codex/config.toml each cause ConfigParseError and the ORIGINAL bytes are
-// preserved (nothing written, never regenerated-from-template).
-// ---------------------------------------------------------------------------
-
-describe('US-013: malformed existing config -> refuse-don\'t-clobber', () => {
-  it('Claude: an unparseable ~/.claude.json raises ConfigParseError and is preserved byte-for-byte', () => {
-    const f = claudePath();
-    const malformed = '{ "mcpServers": { "figma": <-- hand-broken, not JSON\n';
-    fs.writeFileSync(f, malformed);
-
-    expect(() =>
-      registerClaudeServer({ name: 'vyg', manifest: VYG_MANIFEST, pack: 'p', resolveSecret: () => 'k', env }),
-    ).toThrow(ConfigParseError);
-
-    // Untouched — never regenerated from a template, never clobbered.
-    expect(fs.readFileSync(f, 'utf-8')).toBe(malformed);
-  });
-
-  it('Codex: an unparseable ~/.codex/config.toml raises ConfigParseError and is preserved byte-for-byte', () => {
-    mkCodexHome();
-    const f = codexPath();
-    const malformed = 'this is = = not [[[ valid toml at all\n';
-    fs.writeFileSync(f, malformed);
-
-    expect(() =>
-      registerCodexServer({ name: 'vyg', manifest: VYG_MANIFEST, pack: 'p', resolveSecret: () => 'k', env }),
-    ).toThrow(ConfigParseError);
-
-    expect(fs.readFileSync(f, 'utf-8')).toBe(malformed);
-  });
-
-  it('the register fan-out aborts the WHOLE op on a malformed Claude config (no Codex write either)', () => {
-    mkCodexHome(); // Codex present, but Claude is emitted FIRST and aborts.
-    const cf = claudePath();
-    const malformed = 'not json {{{';
-    fs.writeFileSync(cf, malformed);
-
-    expect(() =>
-      registerServer({ name: 'vyg', manifest: VYG_MANIFEST, pack: 'p', resolveSecret: () => 'k', env }),
-    ).toThrow(ConfigParseError);
-
-    // Claude untouched; Codex config never created (the abort came before the Codex arm).
-    expect(fs.readFileSync(cf, 'utf-8')).toBe(malformed);
-    expect(fs.existsSync(codexPath())).toBe(false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 3 — Server-name TOML-header / JSON-key INJECTION.
-//
-// Names carrying injection payloads must be REJECTED by assertValidServerName
-// (charset ^[a-z0-9_-]+$) BEFORE any interpolation/IO, and a rejected name must
-// write NOTHING to either config.
-// ---------------------------------------------------------------------------
-
-describe('US-013: server-name injection is rejected before any interpolation/IO', () => {
-  const INJECTION_NAMES = [
-    'evil"]\n[mcp_servers.injected', // TOML table-header injection
-    'a.b', // dotted key (TOML sub-table / JSON traversal)
-    'x][y', // bracket injection
-    '"; rm -rf', // shell-ish + quote
-    'a\nb', // newline
-    'a]b',
-    'a[b',
-    'a"b',
-    'a=b',
-    'has space',
-    'UPPER',
-    '__proto__', // prototype-pollution-shaped (also has no dots, but uppercase-free; still — underscores allowed, so this one IS valid charset-wise)
-  ];
-
-  it('assertValidServerName rejects every injection payload (charset gate)', () => {
-    for (const n of INJECTION_NAMES) {
-      if (n === '__proto__') {
-        // `__proto__` is charset-valid (lowercase + underscores) — it is NOT an
-        // injection at the NAME-charset layer. Documented here so the list is honest:
-        // the JSON-key safety for `__proto__` is handled by object-spread merge
-        // semantics, not the name gate. Assert it PASSES the charset gate.
-        expect(() => assertValidServerName(n)).not.toThrow();
-        continue;
-      }
-      expect(() => assertValidServerName(n)).toThrow(McpManifestError);
-    }
-  });
-
-  it('a TOML-header-injection name writes NOTHING to either config (Codex present)', () => {
-    mkCodexHome();
-    const evil = 'evil"]\n[mcp_servers.injected';
-    expect(() =>
-      registerServer({ name: evil, manifest: VYG_MANIFEST, pack: 'p', resolveSecret: () => 'k', env }),
-    ).toThrow(McpManifestError);
-
-    // Neither config created, no backup taken — the gate is BEFORE all IO.
-    expect(fs.existsSync(claudePath())).toBe(false);
-    expect(fs.existsSync(codexPath())).toBe(false);
-    expect(fs.existsSync(backupRoot(env))).toBe(false);
-  });
-
-  it('registerMcpServers rejects an injection name at the seam (before loadManifest is even called for it)', () => {
-    let loaded = false;
-    expect(() =>
-      registerMcpServers('p', ['x][y'], {
-        loadManifest: () => {
-          loaded = true;
-          return VYG_MANIFEST;
-        },
-        env,
-      }),
-    ).toThrow(McpManifestError);
-    expect(loaded).toBe(false); // name validated before the manifest is loaded.
-    expect(fs.existsSync(claudePath())).toBe(false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 4 — ~/.mcp.json symlink + 0600 preservation.
-//
-// Seed ~/.mcp.json as a SYMLINK to a real file, register, and assert: (a) the
-// rename lands on the REALPATH target (the symlink stays a symlink), (b) the
-// resolved file's mode stays 0600.
-// ---------------------------------------------------------------------------
-
-describe('US-013: ~/.mcp.json symlink + 0600 mode preservation', () => {
-  it('registers THROUGH the symlink onto the realpath and keeps the link a symlink at 0600', () => {
-    const realFile = path.join(home, '.mcp.real.json');
-    const link = path.join(home, '.mcp.json');
-    fs.writeFileSync(
-      realFile,
-      JSON.stringify({ mcpServers: { figma: { type: 'http', url: 'http://localhost:3845/mcp' } } }, null, 2) + '\n',
-      { mode: 0o600 },
-    );
-    fs.chmodSync(realFile, 0o600);
-    fs.symlinkSync(realFile, link);
-
-    writeConfigAtomic({
-      target: link,
-      pack: 'hq-pack-test',
-      format: claudeFormat,
-      merge: mergeServer('vyg', { type: 'http', url: 'https://mcp.vyg.app' }),
-      assertName: 'vyg',
-      env,
-    });
-
-    // (a) The link is STILL a symlink (the rename did NOT replace it with a file).
-    expect(fs.lstatSync(link).isSymbolicLink()).toBe(true);
-    expect(fs.realpathSync(link)).toBe(realFile);
-    // The resolved file carries both servers (merge landed on the realpath).
-    const after = JSON.parse(fs.readFileSync(realFile, 'utf-8'));
-    expect(after.mcpServers.figma).toBeDefined();
-    expect(after.mcpServers.vyg).toEqual({ type: 'http', url: 'https://mcp.vyg.app' });
-    // (b) The RESOLVED file's mode is preserved at 0600 after the atomic replace.
-    expect(fs.statSync(realFile).mode & 0o777).toBe(0o600);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 5 — header-value-NEVER-in-stdout: the SECRET-SENTINEL grep test, and
-// the CONFIRMED smol-toml ConfigParseError source-context leak (found + FIXED).
-//
-// THE most important test. A header resolves to a known SENTINEL plaintext. We
-// capture EVERYTHING (return value, error message, audit log, stdout, stderr) and
-// assert the sentinel appears in EXACTLY ONE place: the runtime config files (the
-// documented accepted cleartext-at-rest risk). It must NEVER appear in a return
-// value, an error message, the audit log, stdout, or stderr.
-// ---------------------------------------------------------------------------
-
-/** Run `fn`, capturing all stdout/stderr/console output as one string. */
-function captureAllOutput(fn: () => void): { out: string; thrown: Error | null } {
-  const chunks: string[] = [];
-  const sink = (c: unknown): boolean => {
-    chunks.push(typeof c === 'string' ? c : String(c));
-    return true;
-  };
-  const stdoutSpy = vi.spyOn(process.stdout, 'write').mockImplementation(sink as never);
-  const stderrSpy = vi.spyOn(process.stderr, 'write').mockImplementation(sink as never);
-  const logSpy = vi.spyOn(console, 'log').mockImplementation((...a) => chunks.push(a.join(' ')));
-  const errSpy = vi.spyOn(console, 'error').mockImplementation((...a) => chunks.push(a.join(' ')));
-  const warnSpy = vi.spyOn(console, 'warn').mockImplementation((...a) => chunks.push(a.join(' ')));
-  let thrown: Error | null = null;
-  try {
-    fn();
-  } catch (e) {
-    thrown = e as Error;
-  } finally {
-    stdoutSpy.mockRestore();
-    stderrSpy.mockRestore();
-    logSpy.mockRestore();
-    errSpy.mockRestore();
-    warnSpy.mockRestore();
-  }
-  return { out: chunks.join(''), thrown };
-}
-
-describe('US-013: secret sentinel appears ONLY in the runtime config, never in output/logs/errors', () => {
-  it('register (Claude + Codex): sentinel ONLY in config files; absent from return, audit log, stdout, stderr', () => {
-    mkCodexHome();
-    let result: ReturnType<typeof registerServer> | undefined;
-    const { out, thrown } = captureAllOutput(() => {
-      result = registerServer({
-        name: 'vyg',
-        manifest: SENTINEL_MANIFEST,
-        pack: 'hq-pack-vyg',
-        resolveSecret: sentinelResolver,
-        env,
-      });
-    });
-    expect(thrown).toBeNull();
-
-    // 1. The sentinel IS in the runtime config files (accepted cleartext-at-rest).
-    const claudeRaw = fs.readFileSync(claudePath(), 'utf-8');
-    const codexRaw = fs.readFileSync(codexPath(), 'utf-8');
-    expect(claudeRaw).toContain(SENTINEL_REGISTERING);
-    expect(codexRaw).toContain(SENTINEL_REGISTERING);
-
-    // 2. The sentinel is NOT in the return value (JSON-serialized).
-    expect(JSON.stringify(result)).not.toContain(SENTINEL_REGISTERING);
-
-    // 3. The sentinel is NOT in the audit log.
-    const log = fs.readFileSync(mcpRegistryLogPath(env), 'utf-8');
-    expect(log).not.toContain(SENTINEL_REGISTERING);
-    // Sanity: the audit log DID record the register (target is the url, not a header).
-    expect(log).toContain('https://mcp.vyg.app');
-
-    // 4. The sentinel is NOT in ANY captured stdout/stderr/console output.
-    expect(out).not.toContain(SENTINEL_REGISTERING);
-  });
-
-  it('a verify-after-write failure error message is redacted of the registering sentinel', () => {
-    // Force verify-after-write to fail by poisoning the verify re-read so it returns
-    // garbage that EMBEDS the registering sentinel. A naive verify-error echo would
-    // leak it; registerCodexServer's catch runs redactSecrets(secretSink), and the
-    // registering sentinel IS in secretSink, so it must be scrubbed from message+out.
-    mkCodexHome();
-    __fsFault.writeSeen = false;
-    __fsFault.poisonReadSuffix = 'config.toml';
-    __fsFault.poisonReadBytes = `garbage ${SENTINEL_REGISTERING} not real toml = =`;
-    let thrown: Error | null = null;
-    let out = '';
-    try {
-      const cap = captureAllOutput(() => {
-        registerCodexServer({
-          name: 'vyg',
-          manifest: SENTINEL_MANIFEST,
-          pack: 'p',
-          resolveSecret: sentinelResolver,
-          env,
-        });
-      });
-      thrown = cap.thrown;
-      out = cap.out;
-    } finally {
-      __fsFault.poisonReadSuffix = '';
-      __fsFault.poisonReadBytes = '';
-      __fsFault.writeSeen = false;
-    }
-
-    // It threw (verify failed on the poisoned re-read) and the message is redacted.
-    expect(thrown).not.toBeNull();
-    expect(thrown!.message).not.toContain(SENTINEL_REGISTERING);
-    expect(out).not.toContain(SENTINEL_REGISTERING);
-  });
-});
-
-describe('US-013 ADVERSARIAL: smol-toml ConfigParseError source-context leak (FOUND + FIXED)', () => {
-  it('sanitizeParserMessage strips the smol-toml numbered source-context snippet', () => {
-    // The exact shape smol-toml emits: a structural reason, a blank line, then
-    // numbered source lines (which embed file bytes incl. secrets) + a caret.
-    const raw =
-      'Invalid TOML document: only letter, numbers, dashes and underscores are allowed in keys\n\n' +
-      `3:  token = "${SENTINEL_PREEXISTING}"\n` +
-      '4:  broken line here = = [[[ not toml\n' +
-      '    ^\n';
-    const sanitized = sanitizeParserMessage(raw);
-    // The structural reason survives; the secret-bearing source snippet does NOT.
-    expect(sanitized).toContain('Invalid TOML document');
-    expect(sanitized).not.toContain(SENTINEL_PREEXISTING);
-    expect(sanitized).not.toMatch(/^\s*\d+:\s/m); // no numbered source line survived.
-  });
-
-  it('registerCodexServer on a malformed-but-SECRET-bearing config does NOT leak the pre-existing on-disk secret', () => {
-    // Seed ~/.codex/config.toml with a PRE-EXISTING secret on a line, and make the
-    // file malformed NEAR it so smol-toml's error embeds that source line. The
-    // pre-existing secret is a DISTINCT sentinel from the one being registered, so
-    // the register-path redactSecrets(secretSink) CANNOT scrub it (secretSink holds
-    // only the currently-registering secret). Before the fix this leaked; now the
-    // ConfigParseError message is sanitized at the construction site.
-    mkCodexHome();
-    const malformedWithSecret =
-      '[mcp_servers.existing]\n' +
-      'type = "http"\n' +
-      `token = "${SENTINEL_PREEXISTING}"\n` +
-      'broken line here = = [[[ not toml\n';
-    fs.writeFileSync(codexPath(), malformedWithSecret);
-
-    let caught: Error | null = null;
-    const { out } = captureAllOutput(() => {
-      try {
-        registerCodexServer({
-          name: 'vyg',
-          manifest: SENTINEL_MANIFEST,
-          pack: 'p',
-          resolveSecret: sentinelResolver,
-          env,
-        });
-      } catch (e) {
-        caught = e as Error;
-      }
-    });
-
-    // It correctly ABORTED with the named ConfigParseError (never clobbered).
-    expect(caught).toBeInstanceOf(ConfigParseError);
-    // THE LEAK ASSERTION: the pre-existing on-disk secret must NOT appear in the
-    // error message (nor in any emitted output).
-    expect(caught!.message).not.toContain(SENTINEL_PREEXISTING);
-    expect(out).not.toContain(SENTINEL_PREEXISTING);
-    // The structural reason is still useful (it names the parse failure).
-    expect(caught!.message).toMatch(/not valid and would be clobbered/);
-    // The file is preserved byte-for-byte (refuse-don't-clobber still holds).
-    expect(fs.readFileSync(codexPath(), 'utf-8')).toBe(malformedWithSecret);
-  });
-
-  it('CONTRAST — JSON.parse errors never embed file content (Claude surface was already safe)', () => {
-    // Documents the asymmetry the fix is scoped to: JSON.parse does NOT echo source
-    // bytes, so a malformed-but-secret-bearing ~/.claude.json never leaked. We still
-    // assert it to lock the behavior.
-    const malformedWithSecret =
-      `{ "mcpServers": { "existing": { "token": "${SENTINEL_PREEXISTING}" } } broken`;
-    fs.writeFileSync(claudePath(), malformedWithSecret);
-    let caught: Error | null = null;
-    try {
-      registerClaudeServer({ name: 'vyg', manifest: SENTINEL_MANIFEST, pack: 'p', resolveSecret: sentinelResolver, env });
-    } catch (e) {
-      caught = e as Error;
-    }
-    expect(caught).toBeInstanceOf(ConfigParseError);
-    expect(caught!.message).not.toContain(SENTINEL_PREEXISTING);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 6 — Codex-absent host (register + uninstall).
-//
-// No ~/.codex dir -> register wires Claude and FIRST-CLASS-SKIPS Codex (no crash,
-// no fabrication); unregister likewise removes Claude and skips Codex. ~/.codex is
-// never created.
-// ---------------------------------------------------------------------------
-
-describe('US-013: Codex-absent host first-class skip (register + uninstall, never fabricates ~/.codex)', () => {
-  it('register: Claude wired, Codex skipped, ~/.codex never created', () => {
-    const result = registerServer({
-      name: 'vyg',
-      manifest: SENTINEL_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: sentinelResolver,
-      env,
-    });
-    expect(result.claude.changed).toBe(true);
-    expect('skipped' in result.codex && result.codex.skipped).toBe(true);
-    expect(fs.existsSync(codexHome(env))).toBe(false);
-    expect(fs.existsSync(codexPath())).toBe(false);
-  });
-
-  it('uninstall: Claude removed, Codex skipped, ~/.codex still never created', () => {
-    registerServer({ name: 'vyg', manifest: SENTINEL_MANIFEST, pack: 'hq-pack-vyg', resolveSecret: sentinelResolver, env });
-    expect(fs.existsSync(codexHome(env))).toBe(false); // confirm still absent post-register.
-
-    const res = unregisterServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect(res.claude.outcome).toBe('removed');
-    expect('skipped' in res.codex && res.codex.skipped).toBe(true);
-    expect(fs.existsSync(codexHome(env))).toBe(false);
-    expect(fs.existsSync(codexPath())).toBe(false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 7 — partial state (Claude written, Codex emit threw) -> per-surface
-// heal on re-run. Drive a partial state, re-run, assert ONLY the missing Codex
-// surface is healed (Claude entry unchanged, no duplicate).
-// ---------------------------------------------------------------------------
-
-describe('US-013: per-surface heal after a partial register (Codex failed, Claude succeeded)', () => {
-  afterEach(() => {
-    __fsFault.failRenameSuffix = '';
-  });
-
-  it('re-running after a Codex-only failure self-heals ONLY the Codex surface', () => {
-    mkCodexHome();
-    const args = {
-      name: 'vyg',
-      manifest: SENTINEL_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: sentinelResolver,
-      env,
-    };
-
-    // First run: make the CODEX write fail (rename throws) AFTER Claude is written.
-    // registerServer emits Claude first, then Codex — so Claude commits, Codex throws.
-    __fsFault.failRenameSuffix = 'config.toml';
-    expect(() => registerServer(args)).toThrow(); // Codex arm threw.
-    __fsFault.failRenameSuffix = '';
-
-    // PARTIAL state: Claude has vyg, Codex does NOT.
-    const claudeAfter1 = JSON.parse(fs.readFileSync(claudePath(), 'utf-8'));
-    expect(claudeAfter1.mcpServers.vyg).toBeDefined();
-    expect(fs.existsSync(codexPath())).toBe(false);
-    const claudeBytesAfter1 = fs.readFileSync(claudePath(), 'utf-8');
-
-    // Re-run with the Codex write now allowed to succeed (desired-state convergence).
-    const healed = registerServer(args);
-
-    // Claude is an idempotent NO-OP (unchanged, no duplicate); Codex is now healed.
-    expect(healed.claude.changed).toBe(false);
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(claudeBytesAfter1);
-    expect('skipped' in healed.codex).toBe(false);
-    expect((healed.codex as { changed: boolean }).changed).toBe(true);
-    const codexDoc = parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any;
-    expect(codexDoc.mcp_servers.vyg.url).toBe('https://mcp.vyg.app');
-    // Claude still has exactly ONE vyg entry (no duplication across the re-run).
-    expect(Object.keys(JSON.parse(fs.readFileSync(claudePath(), 'utf-8')).mcpServers)).toEqual(['vyg']);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 8 — old-CLI/new-host skew -> CLEAR named error (not a TypeError).
-//
-// A new-host config shape the old CLI can't read (an unknown `contributes` key the
-// old CONTRIBUTION_TABLE doesn't have — e.g. a future `mcp`-adjacent key) must
-// surface a CLEAR named error BEFORE the unguarded payloadFor() lookup that would
-// otherwise TypeError on an undefined table row. The guard lives in
-// validateManifest (pack-install) — `contributes.<key> is not a known contribution
-// type` — which is reached before payloadFor.
-// ---------------------------------------------------------------------------
-
-describe('US-013: old-CLI/new-host skew surfaces a clear error, never a raw TypeError', () => {
-  it('an unknown contributes key (new-host shape) is rejected with a clear named error before payloadFor TypeErrors', async () => {
-    const { validateManifest } = await import('./pack-install.js');
-    const { mkdtempSync, writeFileSync } = fs;
-    const dir = fs.realpathSync(mkdtempSync(path.join(os.tmpdir(), 'hq-skew-')));
-    try {
-      // A pack manifest that uses a contributes key this (old) CLI's table lacks.
-      writeFileSync(
-        path.join(dir, 'package.yaml'),
-        [
-          'name: hq-pack-future',
-          'version: 1.0.0',
-          'publisher: "@acme"',
-          'access: public',
-          'requires:',
-          '  hqCore: ">=15.1.0"',
-          'contributes:',
-          '  futuristic_surface:', // NOT in CONTRIBUTION_TABLE on this CLI
-          '    - thing',
-        ].join('\n'),
-      );
-      let caught: Error | null = null;
-      try {
-        validateManifest(dir, '15.1.0');
-      } catch (e) {
-        caught = e as Error;
-      }
-      expect(caught).not.toBeNull();
-      // It is a CLEAR, structural message — NOT a raw "Cannot read properties of
-      // undefined" TypeError from an unguarded table lookup.
-      expect(caught!.message).toMatch(/not a known contribution type/);
-      expect(caught!.message).not.toMatch(/Cannot read propert|is not a function|undefined is not/);
-      expect(caught).not.toBeInstanceOf(TypeError);
-    } finally {
-      fs.rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 9 — version-floor refusal (MCP pack on a too-old host).
-//
-// The US-012 floor lives in pack-install.test.ts (validateManifest `does not
-// satisfy pack requirement`). We add ONE focused US-013 assertion here to keep the
-// gate self-contained (NOT a wholesale duplicate): a `>15.0.16`/`>=15.1.0` pack on
-// an older host is refused with a floor message, NOT a TypeError.
-// ---------------------------------------------------------------------------
-
-describe('US-013: MCP-pack version-floor refusal on a too-old host (not a TypeError)', () => {
-  it('a pack requiring >=15.1.0 is refused on a 15.0.16 host with a clear floor message', async () => {
-    const { validateManifest } = await import('./pack-install.js');
-    const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'hq-floor-')));
-    try {
-      // A minimal MCP-bearing pack with a real mcp manifest so validate gets that far.
-      fs.mkdirSync(path.join(dir, 'mcp'), { recursive: true });
-      fs.writeFileSync(
-        path.join(dir, 'mcp', 'vyg.json'),
-        JSON.stringify({ type: 'http', url: 'https://mcp.vyg.app', headers: { Authorization: 'Bearer ${secret:VYG_API_KEY}' } }),
-      );
-      fs.writeFileSync(
-        path.join(dir, 'package.yaml'),
-        [
-          'name: hq-pack-vyg',
-          'version: 1.0.0',
-          'publisher: "@acme"',
-          'access: public',
-          'requires:',
-          '  hqCore: ">=15.1.0"',
-          'contributes:',
-          '  mcp:',
-          '    - vyg',
-        ].join('\n'),
-      );
-      let caught: Error | null = null;
-      try {
-        validateManifest(dir, '15.0.16');
-      } catch (e) {
-        caught = e as Error;
-      }
-      expect(caught).not.toBeNull();
-      expect(caught!.message).toMatch(/does not satisfy pack requirement/);
-      expect(caught!.message).toMatch(/>=15\.1\.0/);
-      expect(caught).not.toBeInstanceOf(TypeError);
-    } finally {
-      fs.rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Criterion 10 — install-prompt content: the FULL url appears, NO secret appears.
-//
-// US-010 (pack-install renderMcpServerLine / confirmMcp) already covers this. We
-// add a sentinel-grep variant against renderMcpServerLine to STRENGTHEN the gate:
-// the rendered line shows the full url and never the resolved secret value.
-// ---------------------------------------------------------------------------
-
-describe('US-013: install trust prompt shows the full url and never a secret (sentinel grep)', () => {
-  it('renderMcpServerLine discloses the url and redacts the header value, even a literal sentinel', async () => {
-    const { renderMcpServerLine } = await import('./pack-install.js');
-    const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'hq-prompt-')));
-    try {
-      fs.mkdirSync(path.join(dir, 'mcp'), { recursive: true });
-      // A manifest with a LITERAL sentinel in the header value (worst case — even a
-      // non-${secret:} literal must be scrubbed by the defense-in-depth redaction).
-      fs.writeFileSync(
-        path.join(dir, 'mcp', 'vyg.json'),
-        JSON.stringify({
-          type: 'http',
-          url: 'https://mcp.vyg.app/sentinel-path',
-          headers: { Authorization: `Token ${SENTINEL_REGISTERING}` },
-        }),
-      );
-      const line = renderMcpServerLine(dir, 'vyg');
-      // FULL url disclosed verbatim (typosquat eyeballing).
-      expect(line).toContain('https://mcp.vyg.app/sentinel-path');
-      // The header KEY may show, but the sentinel VALUE must be redacted out.
-      expect(line).not.toContain(SENTINEL_REGISTERING);
-    } finally {
-      fs.rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// PLUS — consolidated happy-path smoke (register->both, idempotent, collision,
-// uninstall->both). The full per-story coverage lives in US-007/008/009; this is a
-// single end-to-end smoke that the gate stays green, not a 100-line duplicate.
-// ---------------------------------------------------------------------------
-
-describe('US-013: happy-path smoke (register->both runtimes, idempotent, collision, uninstall->both)', () => {
-  it('register fans out to both runtimes; re-install is a no-op; uninstall removes from both', () => {
-    mkCodexHome();
-    const args = {
-      name: 'vyg',
-      manifest: SENTINEL_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: sentinelResolver,
-      env,
-    };
-
-    // register -> both runtimes.
-    const r1 = registerServer(args);
-    expect(r1.claude.changed).toBe(true);
-    expect((r1.codex as { changed: boolean }).changed).toBe(true);
-    expect(JSON.parse(fs.readFileSync(claudePath(), 'utf-8')).mcpServers.vyg).toBeDefined();
-    expect((parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any).mcp_servers.vyg).toBeDefined();
-
-    // idempotent re-install -> byte-for-byte no-op on both.
-    const claudeBytes = fs.readFileSync(claudePath(), 'utf-8');
-    const codexBytes = fs.readFileSync(codexPath(), 'utf-8');
-    const r2 = registerServer(args);
-    expect(r2.claude.changed).toBe(false);
-    expect((r2.codex as { changed: boolean }).changed).toBe(false);
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(claudeBytes);
-    expect(fs.readFileSync(codexPath(), 'utf-8')).toBe(codexBytes);
-
-    // collision (def differs) -> abort, no clobber.
-    expect(() =>
-      registerServer({
-        ...args,
-        manifest: { type: 'http', url: 'https://DIFFERENT.example' },
-        resolveSecret: () => null,
-      }),
-    ).toThrow(McpNameCollisionError);
-    expect(fs.readFileSync(claudePath(), 'utf-8')).toBe(claudeBytes); // unchanged.
-
-    // uninstall -> removed from both.
-    const u = unregisterServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-    expect(u.claude.outcome).toBe('removed');
-    expect((u.codex as { outcome: string }).outcome).toBe('removed');
-    expect(JSON.parse(fs.readFileSync(claudePath(), 'utf-8')).mcpServers.vyg).toBeUndefined();
-    expect((parseToml(fs.readFileSync(codexPath(), 'utf-8')) as any).mcp_servers?.vyg).toBeUndefined();
-  });
-});