@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/active-company.test.ts

@@ -1,188 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-
-import { seedActiveCompany } from "./active-company.js";
-
-let hqRoot: string | undefined;
-
-afterEach(() => {
-  if (hqRoot) {
-    fs.rmSync(hqRoot, { recursive: true, force: true });
-    hqRoot = undefined;
-  }
-});
-
-function makeHqRoot(): string {
-  return fs.mkdtempSync(path.join(os.tmpdir(), "hq-active-company-"));
-}
-
-function configPath(root: string): string {
-  return path.join(root, ".hq", "config.json");
-}
-
-function writeConfig(root: string, contents: string): string {
-  const p = configPath(root);
-  fs.mkdirSync(path.dirname(p), { recursive: true });
-  fs.writeFileSync(p, contents, "utf8");
-  return p;
-}
-
-function readConfig(root: string): Record<string, unknown> {
-  return JSON.parse(fs.readFileSync(configPath(root), "utf8")) as Record<string, unknown>;
-}
-
-describe("seedActiveCompany", () => {
-  it("seeds the single company when activeCompany is unset", () => {
-    hqRoot = makeHqRoot();
-    writeConfig(hqRoot, JSON.stringify({ someOtherSetting: true }));
-
-    expect(seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom"] })).toEqual({
-      written: true,
-      activeCompany: "boring-ecom",
-    });
-    expect(readConfig(hqRoot)).toEqual({
-      someOtherSetting: true,
-      activeCompany: "boring-ecom",
-    });
-  });
-
-  it("creates a missing config file", () => {
-    hqRoot = makeHqRoot();
-    expect(fs.existsSync(configPath(hqRoot))).toBe(false);
-
-    expect(seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom"] })).toEqual({
-      written: true,
-      activeCompany: "boring-ecom",
-    });
-    expect(readConfig(hqRoot)).toEqual({ activeCompany: "boring-ecom" });
-  });
-
-  it("no-ops on zero companies", () => {
-    hqRoot = makeHqRoot();
-    const before = writeConfig(hqRoot, JSON.stringify({ keep: 1 }));
-    const raw = fs.readFileSync(before, "utf8");
-
-    expect(seedActiveCompany({ hqRoot, companySlugs: [] })).toEqual({
-      written: false,
-      skippedReason: "no-companies",
-    });
-    expect(fs.readFileSync(before, "utf8")).toBe(raw);
-  });
-
-  // Two companies is a real choice. Guessing would route the user somewhere
-  // arbitrary, which is indistinguishable from a bug to the person it happens to.
-  it("no-ops on two or more companies rather than guessing", () => {
-    hqRoot = makeHqRoot();
-    const p = writeConfig(hqRoot, JSON.stringify({ keep: 1 }));
-    const raw = fs.readFileSync(p, "utf8");
-
-    expect(
-      seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom", "acme"] }),
-    ).toEqual({ written: false, skippedReason: "ambiguous" });
-    expect(fs.readFileSync(p, "utf8")).toBe(raw);
-  });
-
-  it("never overwrites an existing activeCompany", () => {
-    hqRoot = makeHqRoot();
-    const p = writeConfig(hqRoot, JSON.stringify({ activeCompany: "chosen-by-user" }));
-    const raw = fs.readFileSync(p, "utf8");
-
-    expect(seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom"] })).toEqual({
-      written: false,
-      skippedReason: "already-set",
-    });
-    expect(fs.readFileSync(p, "utf8")).toBe(raw);
-  });
-
-  // Even when the existing value names a company they have since left. Repairing
-  // that is a separate, user-visible decision — not something a sync should do
-  // silently underneath them.
-  it("never overwrites activeCompany even for a company the user has left", () => {
-    hqRoot = makeHqRoot();
-    writeConfig(hqRoot, JSON.stringify({ activeCompany: "former-employer" }));
-
-    expect(seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom"] })).toEqual({
-      written: false,
-      skippedReason: "already-set",
-    });
-    expect(readConfig(hqRoot).activeCompany).toBe("former-employer");
-  });
-
-  // sync-core's resolveActiveCompany falls back to `companySlug`, so a config
-  // carrying only that already HAS an effective answer. Writing activeCompany
-  // would silently re-route the user.
-  it("treats a legacy companySlug as already-set", () => {
-    hqRoot = makeHqRoot();
-    const p = writeConfig(hqRoot, JSON.stringify({ companySlug: "legacy-choice" }));
-    const raw = fs.readFileSync(p, "utf8");
-
-    expect(seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom"] })).toEqual({
-      written: false,
-      skippedReason: "already-set",
-    });
-    expect(fs.readFileSync(p, "utf8")).toBe(raw);
-  });
-
-  it("leaves malformed JSON untouched and reports a diagnostic", () => {
-    hqRoot = makeHqRoot();
-    const p = writeConfig(hqRoot, '{"activeCompany": "half-edited"');
-    const raw = fs.readFileSync(p, "utf8");
-    const diagnostics: Array<{ event: string }> = [];
-
-    expect(
-      seedActiveCompany({
-        hqRoot,
-        companySlugs: ["boring-ecom"],
-        reportDiagnostic: (d) => diagnostics.push(d),
-      }),
-    ).toEqual({ written: false, skippedReason: "unreadable-config" });
-
-    expect(fs.readFileSync(p, "utf8")).toBe(raw);
-    expect(diagnostics).toHaveLength(1);
-    expect(diagnostics[0].event).toBe("runner.active_company.config_malformed");
-  });
-
-  it("leaves a non-object config untouched", () => {
-    hqRoot = makeHqRoot();
-    const p = writeConfig(hqRoot, "[1, 2, 3]");
-    const raw = fs.readFileSync(p, "utf8");
-
-    expect(seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom"] })).toEqual({
-      written: false,
-      skippedReason: "unreadable-config",
-    });
-    expect(fs.readFileSync(p, "utf8")).toBe(raw);
-  });
-
-  it("preserves unknown keys and leaves no temp files behind", () => {
-    hqRoot = makeHqRoot();
-    writeConfig(
-      hqRoot,
-      JSON.stringify({ nested: { a: 1 }, list: [1, 2], flag: false }),
-    );
-
-    expect(seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom"] }).written).toBe(
-      true,
-    );
-    expect(readConfig(hqRoot)).toEqual({
-      nested: { a: 1 },
-      list: [1, 2],
-      flag: false,
-      activeCompany: "boring-ecom",
-    });
-    const strays = fs
-      .readdirSync(path.join(hqRoot, ".hq"))
-      .filter((f) => f.startsWith(".config-"));
-    expect(strays).toEqual([]);
-  });
-
-  it("collapses duplicate slugs — one company named twice is not ambiguous", () => {
-    hqRoot = makeHqRoot();
-    expect(
-      seedActiveCompany({ hqRoot, companySlugs: ["boring-ecom", "boring-ecom"] }),
-    ).toEqual({ written: true, activeCompany: "boring-ecom" });
-    expect(readConfig(hqRoot).activeCompany).toBe("boring-ecom");
-  });
-});

package/src/active-company.ts

@@ -1,168 +0,0 @@
-/**
- * Seed `activeCompany` in `.hq/config.json` for a joiner who has exactly one
- * cloud company.
- *
- * A newly invited member arrives with no local company routing at all. The
- * manifest reconciler restores their `companies/manifest.yaml` entry, but
- * nothing tells HQ which company is *current*, so they stay unrouted even
- * though membership resolved fine. When the answer is unambiguous — one company
- * and no existing choice — recording it is strictly better than leaving the
- * user to guess.
- *
- * Everything here is deliberately conservative. This runs unattended on every
- * sync, against a file the user also edits by hand, so the bar for writing is
- * "the answer cannot be wrong": never overwrite an existing choice, never guess
- * between two companies, and never clobber a file we could not parse.
- */
-
-import { randomUUID } from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-export interface SeedActiveCompanyOptions {
-  hqRoot: string;
-  /** Slugs of companies that reconciled successfully this run. */
-  companySlugs: readonly string[];
-  reportDiagnostic?: (diagnostic: {
-    event: string;
-    message: string;
-    err: unknown;
-    context: Record<string, unknown>;
-  }) => void;
-}
-
-export interface SeedActiveCompanyResult {
-  /** True only when `.hq/config.json` was actually written. */
-  written: boolean;
-  /** The slug that was seeded, when one was. */
-  activeCompany?: string;
-  /** Why nothing was written. Absent when `written` is true. */
-  skippedReason?:
-    | "ambiguous"
-    | "no-companies"
-    | "already-set"
-    | "unreadable-config"
-    | "write-failed";
-}
-
-interface HqConfig {
-  activeCompany?: unknown;
-  companySlug?: unknown;
-  [key: string]: unknown;
-}
-
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-  const proto = Object.getPrototypeOf(value) as object | null;
-  return proto === Object.prototype || proto === null;
-}
-
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.length > 0;
-}
-
-/**
- * Write `config` to `configPath` via temp-file + rename, so a reader never
- * observes a half-written config and a crash cannot truncate the original.
- */
-function writeConfigAtomically(configPath: string, config: HqConfig): void {
-  const dir = path.dirname(configPath);
-  fs.mkdirSync(dir, { recursive: true });
-  const temporaryPath = path.join(dir, `.config-${process.pid}-${randomUUID()}.json`);
-  try {
-    fs.writeFileSync(temporaryPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
-    fs.renameSync(temporaryPath, configPath);
-  } finally {
-    // The rename consumed the temp file on the success path; this only fires
-    // when writing or renaming threw, and must not mask the original error.
-    try {
-      fs.rmSync(temporaryPath, { force: true });
-    } catch {
-      // Best effort — a stray temp file is not worth failing a sync over.
-    }
-  }
-}
-
-/**
- * Seed `activeCompany` when — and only when — the answer is unambiguous.
- *
- * Never throws: the caller is a sync run whose exit code must not depend on
- * local routing convenience.
- */
-export function seedActiveCompany(
-  options: SeedActiveCompanyOptions,
-): SeedActiveCompanyResult {
-  const slugs = Array.from(new Set(options.companySlugs.filter(isNonEmptyString)));
-  if (slugs.length === 0) return { written: false, skippedReason: "no-companies" };
-  // Two or more companies is a genuine choice and belongs to the user. Picking
-  // one would route them somewhere arbitrary and look like a bug.
-  if (slugs.length > 1) return { written: false, skippedReason: "ambiguous" };
-
-  const activeCompany = slugs[0];
-  const configPath = path.join(options.hqRoot, ".hq", "config.json");
-
-  let config: HqConfig = {};
-  let raw: string | undefined;
-  try {
-    raw = fs.readFileSync(configPath, "utf8");
-  } catch (err) {
-    if ((err as NodeJS.ErrnoException).code !== "ENOENT") {
-      // An unreadable config is user state we cannot reason about. Leave it.
-      options.reportDiagnostic?.({
-        event: "runner.active_company.config_unreadable",
-        message: "could not read .hq/config.json; activeCompany not seeded",
-        err,
-        context: { configPath },
-      });
-      return { written: false, skippedReason: "unreadable-config" };
-    }
-  }
-
-  if (raw !== undefined) {
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(raw);
-    } catch (err) {
-      // Malformed JSON is almost always a half-finished hand edit. Overwriting
-      // it would destroy whatever the user was in the middle of doing.
-      options.reportDiagnostic?.({
-        event: "runner.active_company.config_malformed",
-        message: ".hq/config.json is not valid JSON; left untouched",
-        err,
-        context: { configPath },
-      });
-      return { written: false, skippedReason: "unreadable-config" };
-    }
-    if (!isPlainObject(parsed)) {
-      options.reportDiagnostic?.({
-        event: "runner.active_company.config_malformed",
-        message: ".hq/config.json is not a JSON object; left untouched",
-        err: undefined,
-        context: { configPath },
-      });
-      return { written: false, skippedReason: "unreadable-config" };
-    }
-    config = parsed;
-  }
-
-  // `companySlug` counts as already-set: sync-core resolves it as the active
-  // company when `activeCompany` is absent, so writing `activeCompany` here
-  // would silently re-route a user who already had an effective answer.
-  if (isNonEmptyString(config.activeCompany) || isNonEmptyString(config.companySlug)) {
-    return { written: false, skippedReason: "already-set" };
-  }
-
-  try {
-    writeConfigAtomically(configPath, { ...config, activeCompany });
-  } catch (err) {
-    options.reportDiagnostic?.({
-      event: "runner.active_company.write_failed",
-      message: "failed to seed activeCompany in .hq/config.json",
-      err,
-      context: { configPath, activeCompany },
-    });
-    return { written: false, skippedReason: "write-failed" };
-  }
-
-  return { written: true, activeCompany };
-}

package/src/agent-codex-instructions.test.ts

@@ -1,332 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import {
-  composeCodexAgentsMd,
-  orderCapabilityFiles,
-  gatherCodexAgentSections,
-  materializeCodexAgents,
-  codexHomeDir,
-  CODEX_AGENTS_MARKER,
-  AGENT_CONTRACT_FILE,
-  AGENTS_PROFILE_REL,
-  AGENT_CAPABILITIES_REL,
-  type CodexSection,
-} from "./agent-codex-instructions.js";
-
-describe("composeCodexAgentsMd (pure)", () => {
-  it("returns empty string for no sections", () => {
-    expect(composeCodexAgentsMd([])).toBe("");
-  });
-
-  it("returns empty string when every section is whitespace-only", () => {
-    const sections: CodexSection[] = [
-      { name: "a", content: "   \n\t " },
-      { name: "b", content: "" },
-    ];
-    expect(composeCodexAgentsMd(sections)).toBe("");
-  });
-
-  it("emits the generated marker header then the joined body", () => {
-    const out = composeCodexAgentsMd([
-      { name: "profile", content: "I am the agent." },
-      { name: "contract", content: "Build your own tools." },
-    ]);
-    expect(out.startsWith(CODEX_AGENTS_MARKER)).toBe(true);
-    expect(out).toContain("I am the agent.");
-    expect(out).toContain("Build your own tools.");
-    // body sections separated by a blank line, trailing newline
-    expect(out).toContain("I am the agent.\n\nBuild your own tools.");
-    expect(out.endsWith("\n")).toBe(true);
-  });
-
-  it("trims sections and drops the empty ones", () => {
-    const out = composeCodexAgentsMd([
-      { name: "a", content: "\n\n  kept  \n\n" },
-      { name: "b", content: "   " },
-      { name: "c", content: "also" },
-    ]);
-    expect(out).toContain("kept\n\nalso");
-    expect(out).not.toMatch(/ {2}kept/);
-  });
-
-  it("is deterministic / carries no timestamp (idempotent bytes)", () => {
-    const sections = [{ name: "x", content: "stable" }];
-    expect(composeCodexAgentsMd(sections)).toBe(composeCodexAgentsMd(sections));
-  });
-});
-
-describe("orderCapabilityFiles (pure)", () => {
-  it("orders the contract first, then the rest alphabetically", () => {
-    expect(
-      orderCapabilityFiles(["slack.md", "zeta.md", AGENT_CONTRACT_FILE, "alpha.md"]),
-    ).toEqual([AGENT_CONTRACT_FILE, "alpha.md", "slack.md", "zeta.md"]);
-  });
-
-  it("drops non-markdown entries", () => {
-    expect(
-      orderCapabilityFiles([AGENT_CONTRACT_FILE, "_seed-allowlist.yaml", "notes.txt", "x.md"]),
-    ).toEqual([AGENT_CONTRACT_FILE, "x.md"]);
-  });
-
-  it("handles a missing contract gracefully", () => {
-    expect(orderCapabilityFiles(["b.md", "a.md"])).toEqual(["a.md", "b.md"]);
-  });
-});
-
-describe("gatherCodexAgentSections + materializeCodexAgents (IO)", () => {
-  let hqRoot: string;
-  let codexHome: string;
-  const capDir = () => path.join(hqRoot, AGENT_CAPABILITIES_REL);
-
-  beforeEach(() => {
-    const base = fs.mkdtempSync(path.join(os.tmpdir(), "hq-codex-test-"));
-    hqRoot = path.join(base, "hq");
-    codexHome = path.join(base, ".codex");
-    fs.mkdirSync(capDir(), { recursive: true });
-  });
-
-  afterEach(() => {
-    try {
-      fs.rmSync(path.dirname(hqRoot), { recursive: true, force: true });
-    } catch {
-      /* best-effort cleanup */
-    }
-  });
-
-  const seedProfile = (s: string) =>
-    fs.writeFileSync(path.join(hqRoot, AGENTS_PROFILE_REL), s);
-  const seedCap = (name: string, s: string) =>
-    fs.writeFileSync(path.join(capDir(), name), s);
-
-  it("gathers profile + contract + others in the right order", () => {
-    fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-    seedProfile("PROFILE briefing");
-    seedCap("slack.md", "SLACK doc");
-    seedCap(AGENT_CONTRACT_FILE, "CONTRACT body");
-
-    const sections = gatherCodexAgentSections(hqRoot);
-    expect(sections.map((s) => s.name)).toEqual([
-      AGENTS_PROFILE_REL,
-      `${AGENT_CAPABILITIES_REL}/${AGENT_CONTRACT_FILE}`,
-      `${AGENT_CAPABILITIES_REL}/slack.md`,
-    ]);
-  });
-
-  it("writes ~/.codex/AGENTS.md with contract ahead of other capabilities", () => {
-    seedCap(AGENT_CONTRACT_FILE, "CONTRACT body");
-    seedCap("slack.md", "SLACK doc");
-
-    const res = materializeCodexAgents({ hqRoot, codexHome });
-    expect(res.written).toBe(true);
-    expect(res.sectionCount).toBe(2);
-
-    const written = fs.readFileSync(path.join(codexHome, "AGENTS.md"), "utf8");
-    expect(written.startsWith(CODEX_AGENTS_MARKER)).toBe(true);
-    expect(written.indexOf("CONTRACT body")).toBeLessThan(
-      written.indexOf("SLACK doc"),
-    );
-  });
-
-  it("SKIPS (no write, no delete) when the overlay is empty — never destructive", () => {
-    // Pre-existing materialized file from a prior good sync.
-    fs.mkdirSync(codexHome, { recursive: true });
-    const existing = `${CODEX_AGENTS_MARKER} prior -->\n\nPRIOR CONTENT\n`;
-    fs.writeFileSync(path.join(codexHome, "AGENTS.md"), existing);
-
-    // Overlay is empty (transient unsynced tree).
-    const res = materializeCodexAgents({ hqRoot, codexHome });
-    expect(res.written).toBe(false);
-    expect(res.skippedReason).toBe("empty-overlay");
-    // The previously-materialized file is left intact.
-    expect(fs.readFileSync(path.join(codexHome, "AGENTS.md"), "utf8")).toBe(
-      existing,
-    );
-  });
-
-  it("creates the codex home dir if missing", () => {
-    seedCap(AGENT_CONTRACT_FILE, "CONTRACT body");
-    expect(fs.existsSync(codexHome)).toBe(false);
-    const res = materializeCodexAgents({ hqRoot, codexHome });
-    expect(res.written).toBe(true);
-    expect(fs.existsSync(path.join(codexHome, "AGENTS.md"))).toBe(true);
-  });
-
-  it("is idempotent — two runs produce byte-identical output", () => {
-    seedCap(AGENT_CONTRACT_FILE, "CONTRACT body");
-    seedCap("slack.md", "SLACK doc");
-    materializeCodexAgents({ hqRoot, codexHome });
-    const first = fs.readFileSync(path.join(codexHome, "AGENTS.md"), "utf8");
-    materializeCodexAgents({ hqRoot, codexHome });
-    const second = fs.readFileSync(path.join(codexHome, "AGENTS.md"), "utf8");
-    expect(second).toBe(first);
-  });
-
-  it("never throws on an unreadable hq-root (returns error result)", () => {
-    const res = materializeCodexAgents({
-      hqRoot: path.join(hqRoot, "does-not-exist"),
-      codexHome,
-    });
-    expect(res.written).toBe(false);
-    // No capability dir → empty overlay → skip (not a hard error).
-    expect(res.skippedReason).toBe("empty-overlay");
-  });
-});
-
-describe("materializeCodexAgents — hardening (security + failure modes)", () => {
-  let base: string;
-  let hqRoot: string;
-  let codexHome: string;
-  const capDir = () => path.join(hqRoot, AGENT_CAPABILITIES_REL);
-
-  beforeEach(() => {
-    base = fs.mkdtempSync(path.join(os.tmpdir(), "hq-codex-harden-"));
-    hqRoot = path.join(base, "hq");
-    codexHome = path.join(base, ".codex");
-    fs.mkdirSync(capDir(), { recursive: true });
-  });
-  afterEach(() => {
-    vi.restoreAllMocks();
-    try {
-      fs.rmSync(base, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
-  });
-
-  it("does NOT follow a symlinked capability file (no out-of-tree exfiltration)", () => {
-    // A secret outside the overlay; a symlink inside capDir pointing at it.
-    const secret = path.join(base, "secret.txt");
-    fs.writeFileSync(secret, "TOP-SECRET-CREDENTIAL");
-    fs.writeFileSync(path.join(capDir(), AGENT_CONTRACT_FILE), "CONTRACT body");
-    fs.symlinkSync(secret, path.join(capDir(), "escape.md"));
-
-    const sections = gatherCodexAgentSections(hqRoot);
-    // The symlink is skipped; only the real contract file is gathered.
-    expect(sections.map((s) => s.name)).toEqual([
-      `${AGENT_CAPABILITIES_REL}/${AGENT_CONTRACT_FILE}`,
-    ]);
-
-    const res = materializeCodexAgents({ hqRoot, codexHome });
-    const written = fs.readFileSync(path.join(codexHome, "AGENTS.md"), "utf8");
-    expect(written).not.toContain("TOP-SECRET-CREDENTIAL");
-    expect(res.sectionCount).toBe(1);
-  });
-
-  it("skips a symlinked capability DIR (no descent through a symlinked capDir)", () => {
-    // Replace capDir with a symlink to an external dir containing a real .md.
-    const external = path.join(base, "external-caps");
-    fs.mkdirSync(external, { recursive: true });
-    fs.writeFileSync(path.join(external, AGENT_CONTRACT_FILE), "EXTERNAL body");
-    fs.rmSync(capDir(), { recursive: true, force: true });
-    fs.symlinkSync(external, capDir());
-
-    const sections = gatherCodexAgentSections(hqRoot);
-    expect(sections).toEqual([]);
-  });
-
-  it("refuses to clobber a SYMLINK target (preserves it; distinct skip reason)", () => {
-    fs.writeFileSync(path.join(capDir(), AGENT_CONTRACT_FILE), "CONTRACT body");
-    fs.mkdirSync(codexHome, { recursive: true });
-    const realTarget = path.join(base, "managed-agents.md");
-    fs.writeFileSync(realTarget, "MANAGED BY DOTFILES");
-    fs.symlinkSync(realTarget, path.join(codexHome, "AGENTS.md"));
-
-    const res = materializeCodexAgents({ hqRoot, codexHome });
-    expect(res.written).toBe(false);
-    expect(res.skippedReason).toBe("target-not-regular-file");
-    // The symlink is intact and still points at the managed file.
-    expect(fs.lstatSync(path.join(codexHome, "AGENTS.md")).isSymbolicLink()).toBe(
-      true,
-    );
-    expect(fs.readFileSync(realTarget, "utf8")).toBe("MANAGED BY DOTFILES");
-  });
-
-  it("refuses when the target is a DIRECTORY (no EISDIR crash, distinct reason)", () => {
-    fs.writeFileSync(path.join(capDir(), AGENT_CONTRACT_FILE), "CONTRACT body");
-    fs.mkdirSync(path.join(codexHome, "AGENTS.md"), { recursive: true });
-
-    const res = materializeCodexAgents({ hqRoot, codexHome });
-    expect(res.written).toBe(false);
-    expect(res.skippedReason).toBe("target-not-regular-file");
-    expect(fs.statSync(path.join(codexHome, "AGENTS.md")).isDirectory()).toBe(true);
-  });
-
-  it("returns an error result and leaves no .hq-tmp orphan when the write fails", () => {
-    // Root ignores mode bits, so this deterministic perms-based failure only
-    // holds for a non-root user (agent boxes + CI run non-root).
-    if (typeof process.getuid === "function" && process.getuid() === 0) return;
-    fs.writeFileSync(path.join(capDir(), AGENT_CONTRACT_FILE), "CONTRACT body");
-    // Read-only codex home → the temp write inside it fails (EACCES). The
-    // write+rename block's catch must unlink any temp before rethrowing, so no
-    // `*.hq-tmp` is left behind.
-    fs.mkdirSync(codexHome, { recursive: true });
-    fs.chmodSync(codexHome, 0o500);
-    try {
-      const res = materializeCodexAgents({ hqRoot, codexHome });
-      expect(res.written).toBe(false);
-      expect(res.skippedReason).toBe("error");
-      const leftovers = fs
-        .readdirSync(codexHome)
-        .filter((f) => f.endsWith(".hq-tmp"));
-      expect(leftovers).toEqual([]);
-    } finally {
-      fs.chmodSync(codexHome, 0o700); // restore so afterEach cleanup works
-    }
-  });
-
-  it("writes the file with owner-only perms (0o600)", () => {
-    fs.writeFileSync(path.join(capDir(), AGENT_CONTRACT_FILE), "CONTRACT body");
-    materializeCodexAgents({ hqRoot, codexHome });
-    const mode = fs.statSync(path.join(codexHome, "AGENTS.md")).mode & 0o777;
-    expect(mode).toBe(0o600);
-  });
-
-  it("emits a distinct event when the overlay is empty but a prior file exists", () => {
-    fs.mkdirSync(codexHome, { recursive: true });
-    fs.writeFileSync(path.join(codexHome, "AGENTS.md"), "PRIOR\n");
-    const events: string[] = [];
-    const res = materializeCodexAgents({
-      hqRoot, // capDir empty, no profile → empty overlay
-      codexHome,
-      log: (e) => events.push(e.event),
-    });
-    expect(res.skippedReason).toBe("empty-overlay");
-    expect(events).toContain(
-      "runner.agent_codex_instructions.skipped_empty_target_exists",
-    );
-    // Prior file left intact.
-    expect(fs.readFileSync(path.join(codexHome, "AGENTS.md"), "utf8")).toBe(
-      "PRIOR\n",
-    );
-  });
-});
-
-describe("codexHomeDir (CODEX_HOME validation)", () => {
-  const orig = process.env.CODEX_HOME;
-  afterEach(() => {
-    if (orig === undefined) delete process.env.CODEX_HOME;
-    else process.env.CODEX_HOME = orig;
-  });
-
-  it("defaults to ~/.codex when CODEX_HOME is unset", () => {
-    delete process.env.CODEX_HOME;
-    expect(codexHomeDir()).toBe(path.join(os.homedir(), ".codex"));
-  });
-
-  it("honors an absolute CODEX_HOME with no traversal", () => {
-    process.env.CODEX_HOME = "/var/lib/agent-codex";
-    expect(codexHomeDir()).toBe("/var/lib/agent-codex");
-  });
-
-  it("rejects a relative CODEX_HOME (falls back to ~/.codex)", () => {
-    process.env.CODEX_HOME = "relative/codex";
-    expect(codexHomeDir()).toBe(path.join(os.homedir(), ".codex"));
-  });
-
-  it("rejects a traversing CODEX_HOME (falls back to ~/.codex)", () => {
-    process.env.CODEX_HOME = "/tmp/../../etc";
-    expect(codexHomeDir()).toBe(path.join(os.homedir(), ".codex"));
-  });
-});