@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/skill-telemetry.test.ts

@@ -1,1825 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { promises as fs } from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { createHash } from "node:crypto";
-import {
-  extractSkillEvents,
-  extractCodexSkillEvents,
-  extractCodexSkillToolEvents,
-  codexRowTurnId,
-  parseCodexSessionMeta,
-  collectAndSendSkillTelemetry,
-  computeSkillVersion,
-  MAX_DECODE_BYTES,
-  readFileRegion,
-} from "./skill-telemetry.js";
-import { encodeLocalVaultSegment } from "./local-path-codec.js";
-import type { SkillInvocationBatch } from "./vault-client.js";
-
-describe("extractSkillEvents", () => {
-  it("extracts a user-typed slash command with args", () => {
-    const row = {
-      type: "user",
-      sessionId: "sess-1",
-      timestamp: "2026-06-03T10:10:07.220Z",
-      cwd: "/home/ec2-user/hq",
-      uuid: "u-1",
-      message: {
-        role: "user",
-        content:
-          "<command-message>personal:worktree</command-message> <command-name>/personal:worktree</command-name> <command-args>pull latest</command-args>",
-      },
-    };
-    const events = extractSkillEvents(row);
-    expect(events).toEqual([
-      {
-        skill: "personal:worktree",
-        source: "typed",
-        sessionId: "sess-1",
-        timestamp: "2026-06-03T10:10:07.220Z",
-        cwd: "/home/ec2-user/hq",
-        uuid: "u-1",
-        hasArgs: true,
-      },
-    ]);
-  });
-
-  it("marks hasArgs false when command-args is absent or empty", () => {
-    const row = {
-      type: "user",
-      message: { role: "user", content: "<command-name>/deploy</command-name>" },
-    };
-    expect(extractSkillEvents(row)[0]).toMatchObject({ skill: "deploy", source: "typed", hasArgs: false });
-  });
-
-  it("extracts a model-invoked Skill tool_use using the block id for dedup", () => {
-    const row = {
-      type: "assistant",
-      sessionId: "sess-2",
-      timestamp: "2026-06-03T14:00:00.000Z",
-      cwd: "/home/ec2-user/hq",
-      uuid: "row-uuid",
-      message: {
-        role: "assistant",
-        content: [
-          { type: "text", text: "ok" },
-          { type: "tool_use", id: "toolu_abc", name: "Skill", input: { skill: "indigo:hello-world" } },
-        ],
-      },
-    };
-    expect(extractSkillEvents(row)).toEqual([
-      {
-        skill: "indigo:hello-world",
-        source: "model",
-        sessionId: "sess-2",
-        timestamp: "2026-06-03T14:00:00.000Z",
-        cwd: "/home/ec2-user/hq",
-        uuid: "toolu_abc",
-        hasArgs: false,
-      },
-    ]);
-  });
-
-  it("sets hasArgs true for a model invocation with args, without capturing the args text", () => {
-    const row = {
-      type: "assistant",
-      message: {
-        role: "assistant",
-        content: [{ type: "tool_use", name: "Skill", input: { skill: "code-review", args: "high" } }],
-      },
-    };
-    const ev = extractSkillEvents(row)[0];
-    expect(ev).toMatchObject({ skill: "code-review", source: "model", hasArgs: true });
-    // Privacy: raw args must never appear on the extracted event.
-    expect(JSON.stringify(ev)).not.toContain("high");
-  });
-
-  it("ignores non-Skill tool_use blocks and non-invocation rows", () => {
-    expect(
-      extractSkillEvents({
-        type: "assistant",
-        message: { role: "assistant", content: [{ type: "tool_use", name: "Bash", input: { command: "ls" } }] },
-      }),
-    ).toEqual([]);
-    expect(extractSkillEvents({ type: "user", message: { content: "just a normal message" } })).toEqual([]);
-    expect(extractSkillEvents(null)).toEqual([]);
-    expect(extractSkillEvents("nope")).toEqual([]);
-  });
-});
-
-describe("extractCodexSkillEvents (Codex CLI rollouts)", () => {
-  const ctx = { sessionId: "019ea34e-4a2b-7241-b8e3-1023abb57c6b", cwd: "/home/ec2-user/hq" };
-
-  it("extracts a typed slash skill from a user_message, attributing session ctx", () => {
-    const row = {
-      timestamp: "2026-06-07T18:17:57.722Z",
-      type: "event_msg",
-      payload: { type: "user_message", message: "/indigo:hello-world", images: [], local_images: [], text_elements: [] },
-    };
-    expect(extractCodexSkillEvents(row, ctx)).toEqual([
-      {
-        skill: "indigo:hello-world",
-        source: "typed",
-        sessionId: ctx.sessionId,
-        timestamp: "2026-06-07T18:17:57.722Z",
-        cwd: ctx.cwd,
-        uuid: `codex:${ctx.sessionId}:2026-06-07T18:17:57.722Z:indigo:hello-world`,
-        hasArgs: false,
-      },
-    ]);
-  });
-
-  it("sets hasArgs true when the command has trailing args, without leaking them", () => {
-    const row = {
-      timestamp: "2026-06-07T18:18:00.000Z",
-      type: "event_msg",
-      payload: { type: "user_message", message: "/indigo:signals refresh secret-arg-value" },
-    };
-    const ev = extractCodexSkillEvents(row, ctx)[0];
-    expect(ev).toMatchObject({ skill: "indigo:signals", source: "typed", hasArgs: true });
-    expect(JSON.stringify(ev)).not.toContain("secret-arg-value");
-  });
-
-  it("rejects file-path-like and non-command user messages", () => {
-    const mk = (message: string) => ({ type: "event_msg", payload: { type: "user_message", message } });
-    expect(extractCodexSkillEvents(mk("/etc/hosts please read this"), ctx)).toEqual([]);
-    expect(extractCodexSkillEvents(mk("just a normal prompt"), ctx)).toEqual([]);
-    expect(extractCodexSkillEvents(mk(""), ctx)).toEqual([]);
-  });
-
-  it("ignores non-user_message rows (session_meta, lifecycle, assistant)", () => {
-    expect(
-      extractCodexSkillEvents({ type: "session_meta", payload: { id: "x", cwd: "/y" } }, ctx),
-    ).toEqual([]);
-    expect(
-      extractCodexSkillEvents({ type: "event_msg", payload: { type: "task_started" } }, ctx),
-    ).toEqual([]);
-    // The duplicate `response_item` (role:user) Codex also writes must NOT
-    // double-count — only the `event_msg` user_message is the signal.
-    expect(
-      extractCodexSkillEvents(
-        { type: "response_item", payload: { type: "message", role: "user", content: [{ type: "input_text", text: "/indigo:hello-world" }] } },
-        ctx,
-      ),
-    ).toEqual([]);
-    expect(extractCodexSkillEvents(null, ctx)).toEqual([]);
-  });
-
-  it("omits the synthesized uuid when session ctx is missing (safe-fail)", () => {
-    const row = { timestamp: "2026-06-07T18:17:57.722Z", type: "event_msg", payload: { type: "user_message", message: "/deploy" } };
-    expect(extractCodexSkillEvents(row, {})[0]).toMatchObject({ skill: "deploy", source: "typed", uuid: undefined });
-  });
-
-  it("parseCodexSessionMeta reads id + cwd, and returns null for other rows", () => {
-    expect(
-      parseCodexSessionMeta({ type: "session_meta", payload: { id: "sess-x", cwd: "/home/ec2-user/hq", originator: "codex_exec" } }),
-    ).toEqual({ sessionId: "sess-x", cwd: "/home/ec2-user/hq" });
-    expect(parseCodexSessionMeta({ type: "event_msg", payload: {} })).toBeNull();
-    expect(parseCodexSessionMeta(null)).toBeNull();
-  });
-});
-
-describe("extractCodexSkillToolEvents (Codex model-driven SKILL.md reads)", () => {
-  const ctx = { sessionId: "sess-x", cwd: "/home/ec2-user/hq" };
-
-  // Codex surfaces a completed exec as `exec_command_end` with `command` as
-  // `["/bin/zsh","-lc","<cmd>"]`, a `turn_id`, the run `cwd`, and a `parsed_cmd`
-  // it tags `type: "read"` for inspection commands.
-  function execEnd(cmd: string, over: Record<string, unknown> = {}) {
-    return {
-      timestamp: "2026-04-27T07:51:30.395Z",
-      type: "event_msg",
-      payload: {
-        type: "exec_command_end",
-        call_id: "call_1",
-        turn_id: "turn-A",
-        command: ["/bin/zsh", "-lc", cmd],
-        cwd: "/home/ec2-user/hq",
-        parsed_cmd: [{ type: "read", cmd }],
-        ...over,
-      },
-    };
-  }
-
-  it("extracts a skill load from a sed read of SKILL.md, tagged source:model", () => {
-    const ev = extractCodexSkillToolEvents(
-      execEnd("sed -n '1,240p' .agents/skills/learn/SKILL.md"),
-      ctx,
-    );
-    expect(ev).toEqual([
-      {
-        skill: "learn",
-        source: "model",
-        sessionId: "sess-x",
-        timestamp: "2026-04-27T07:51:30.395Z",
-        cwd: "/home/ec2-user/hq",
-        uuid: "codex:skill:sess-x:turn-A:learn",
-        hasArgs: false,
-      },
-    ]);
-  });
-
-  it("captures the directory above SKILL.md as the skill name, even when nested (bridge layout)", () => {
-    const ev = extractCodexSkillToolEvents(
-      execEnd("rg -n description /Users/me/.codex/skills/hq/indigo:hello-world/SKILL.md"),
-      ctx,
-    )[0];
-    // skills/hq/<name>/SKILL.md → <name>, not "hq".
-    expect(ev.skill).toBe("indigo:hello-world");
-    expect(ev.source).toBe("model");
-  });
-
-  it("reconstructs <slug>:<name> when reading a company skill's real path", () => {
-    // Codex loads a company skill by reading companies/<slug>/skills/<name>/
-    // SKILL.md; the slug must be recovered so the run attributes to the company
-    // rather than being dropped to a bare, unattributed name.
-    const ev = extractCodexSkillToolEvents(
-      execEnd("sed -n '1,240p' companies/indigo/skills/signals/SKILL.md"),
-      ctx,
-    )[0];
-    expect(ev.skill).toBe("indigo:signals");
-    expect(ev.source).toBe("model");
-    // The dedup/idempotency uuid keys off the reconstructed token.
-    expect(ev.uuid).toBe("codex:skill:sess-x:turn-A:indigo:signals");
-  });
-
-  it("reconstructs the slug for any company and absolute path", () => {
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("cat /home/ec2-user/hq/companies/beta/skills/support/SKILL.md"),
-        ctx,
-      )[0].skill,
-    ).toBe("beta:support");
-    // Hyphenated slug + hyphenated skill name both survive.
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("rg -n x companies/indigo-auto/skills/call-prep-brief/SKILL.md"),
-        ctx,
-      )[0].skill,
-    ).toBe("indigo-auto:call-prep-brief");
-  });
-
-  it("leaves an already-namespaced symlink read untouched (no double prefix)", () => {
-    // Reading via the .claude/skills/<slug>:<name>/ symlink already carries the
-    // prefix in the captured directory — it must NOT get a second one.
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("cat .claude/skills/indigo:signals/SKILL.md"),
-        ctx,
-      )[0].skill,
-    ).toBe("indigo:signals");
-  });
-
-  it("does not fabricate a company prefix for a non-company skill", () => {
-    // A core skill read from its bare directory stays bare — the reconstruction
-    // only triggers on the companies/<slug>/skills/ shape.
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("cat .claude/skills/deploy/SKILL.md"),
-        ctx,
-      )[0].skill,
-    ).toBe("deploy");
-  });
-
-  it("matches normal Codex skill paths without backtracking ambiguity", () => {
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("cat /home/u/.claude/skills/hq/land/SKILL.md"),
-        ctx,
-      )[0].skill,
-    ).toBe("land");
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("cat /home/u/.claude/skills/a/b/c/SKILL.md"),
-        ctx,
-      )[0].skill,
-    ).toBe("c");
-  });
-
-  it("returns quickly for pathological non-matching skills paths", () => {
-    const cmd = "/home/u/.claude/skills/" + "a/".repeat(2000) + "z z";
-    const started = Date.now();
-    const events = extractCodexSkillToolEvents(execEnd(cmd), ctx);
-    const elapsedMs = Date.now() - started;
-    expect(events).toEqual([]);
-    expect(elapsedMs).toBeLessThan(200);
-  });
-
-  it("absolute and relative SKILL.md paths both resolve", () => {
-    expect(
-      extractCodexSkillToolEvents(execEnd("cat /abs/path/.agents/skills/quiz/SKILL.md"), ctx)[0].skill,
-    ).toBe("quiz");
-    expect(
-      extractCodexSkillToolEvents(execEnd("nl -ba .agents/skills/summary/SKILL.md"), ctx)[0].skill,
-    ).toBe("summary");
-  });
-
-  it("dedups a turn's repeated reads of the same skill via the shared seen set", () => {
-    const seen = new Set<string>();
-    const first = extractCodexSkillToolEvents(
-      execEnd("sed -n '1,240p' .agents/skills/learn/SKILL.md"),
-      ctx,
-      seen,
-    );
-    const second = extractCodexSkillToolEvents(
-      execEnd("rg -n 'frequency' .agents/skills/learn/SKILL.md"),
-      ctx,
-      seen,
-    );
-    expect(first).toHaveLength(1);
-    expect(second).toEqual([]); // same (session, turn, skill) → collapsed
-  });
-
-  it("does NOT dedup the same skill across different turns", () => {
-    const seen = new Set<string>();
-    const a = extractCodexSkillToolEvents(
-      execEnd("sed -n '1,240p' .agents/skills/learn/SKILL.md", { turn_id: "turn-A" }),
-      ctx,
-      seen,
-    );
-    const b = extractCodexSkillToolEvents(
-      execEnd("sed -n '1,240p' .agents/skills/learn/SKILL.md", { turn_id: "turn-B" }),
-      ctx,
-      seen,
-    );
-    expect(a).toHaveLength(1);
-    expect(b).toHaveLength(1);
-    expect(b[0].uuid).toBe("codex:skill:sess-x:turn-B:learn");
-  });
-
-  it("excludes edits: parsed_cmd not a read, or a write redirect into SKILL.md", () => {
-    // Codex classifies the exec as something other than a read.
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("apply_patch .agents/skills/learn/SKILL.md", { parsed_cmd: [{ type: "write" }] }),
-        ctx,
-      ),
-    ).toEqual([]);
-    // A shell write into the skill file, even with a read verb elsewhere.
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("cat tmp > .agents/skills/learn/SKILL.md", { parsed_cmd: undefined }),
-        ctx,
-      ),
-    ).toEqual([]);
-  });
-
-  it("prefers the row cwd, falling back to session ctx cwd", () => {
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("sed -n '1,5p' .agents/skills/learn/SKILL.md", { cwd: "/home/ec2-user/hq/sub" }),
-        ctx,
-      )[0].cwd,
-    ).toBe("/home/ec2-user/hq/sub");
-    expect(
-      extractCodexSkillToolEvents(
-        execEnd("sed -n '1,5p' .agents/skills/learn/SKILL.md", { cwd: undefined }),
-        ctx,
-      )[0].cwd,
-    ).toBe(ctx.cwd);
-  });
-
-  it("uuid falls back to timestamp without a turn_id, and is omitted without a session", () => {
-    const noTurn = extractCodexSkillToolEvents(
-      execEnd("sed -n '1,5p' .agents/skills/learn/SKILL.md", { turn_id: undefined }),
-      ctx,
-    )[0];
-    expect(noTurn.uuid).toBe("codex:skill:sess-x:2026-04-27T07:51:30.395Z:learn");
-    const noSession = extractCodexSkillToolEvents(
-      execEnd("sed -n '1,5p' .agents/skills/learn/SKILL.md"),
-      {},
-    )[0];
-    expect(noSession.uuid).toBeUndefined();
-  });
-
-  it("ignores non-exec rows and execs that touch no SKILL.md", () => {
-    expect(extractCodexSkillToolEvents(execEnd("sed -n '1,5p' src/index.ts"), ctx)).toEqual([]);
-    expect(
-      extractCodexSkillToolEvents({ type: "event_msg", payload: { type: "task_started" } }, ctx),
-    ).toEqual([]);
-    expect(
-      extractCodexSkillToolEvents({ type: "event_msg", payload: { type: "user_message", message: "/deploy" } }, ctx),
-    ).toEqual([]);
-    expect(extractCodexSkillToolEvents(null, ctx)).toEqual([]);
-  });
-
-  // The OTHER exec shape some Codex CLI versions emit (observed on 0.128): a
-  // `response_item` `function_call` named `exec_command`, with the command +
-  // workdir in `arguments` (a JSON string) and NO turn_id/parsed_cmd on the row.
-  function fnCall(cmd: string, args: Record<string, unknown> = {}, over: Record<string, unknown> = {}) {
-    return {
-      timestamp: "2026-06-10T16:39:41.260Z",
-      type: "response_item",
-      payload: {
-        type: "function_call",
-        name: "exec_command",
-        call_id: "call_abc",
-        arguments: JSON.stringify({ cmd, workdir: "/home/ec2-user/hq", ...args }),
-        ...over,
-      },
-    };
-  }
-
-  it("extracts a skill load from the function_call exec shape, turn from ctx", () => {
-    const ev = extractCodexSkillToolEvents(
-      fnCall("sed -n '1,80p' .claude/skills/indigo:hello-world/SKILL.md"),
-      { ...ctx, turnId: "turn-Z" },
-    );
-    expect(ev).toEqual([
-      {
-        skill: "indigo:hello-world",
-        source: "model",
-        sessionId: "sess-x",
-        timestamp: "2026-06-10T16:39:41.260Z",
-        cwd: "/home/ec2-user/hq", // from arguments.workdir
-        uuid: "codex:skill:sess-x:turn-Z:indigo:hello-world",
-        hasArgs: false,
-      },
-    ]);
-  });
-
-  it("function_call: read-intent decided by command text (no parsed_cmd present)", () => {
-    // A read verb → counted.
-    expect(
-      extractCodexSkillToolEvents(fnCall("wc -l .claude/skills/quiz/SKILL.md"), ctx)[0].skill,
-    ).toBe("quiz");
-    // A write redirect into the skill file → excluded.
-    expect(
-      extractCodexSkillToolEvents(fnCall("printf x > .claude/skills/quiz/SKILL.md"), ctx),
-    ).toEqual([]);
-  });
-
-  it("function_call: ignores non-exec tool names (e.g. apply_patch edits)", () => {
-    expect(
-      extractCodexSkillToolEvents(
-        fnCall("anything", {}, { name: "apply_patch" }),
-        ctx,
-      ),
-    ).toEqual([]);
-  });
-
-  it("function_call: falls back to ctx.cwd when arguments has no workdir", () => {
-    expect(
-      extractCodexSkillToolEvents(
-        fnCall("sed -n '1,5p' .agents/skills/learn/SKILL.md", { workdir: undefined }),
-        ctx,
-      )[0].cwd,
-    ).toBe(ctx.cwd);
-  });
-
-  it("dedups across the two exec shapes within one turn (no double count)", () => {
-    const seen = new Set<string>();
-    // exec_command_end form for skill `learn` in turn-A …
-    const a = extractCodexSkillToolEvents(
-      execEnd("sed -n '1,240p' .agents/skills/learn/SKILL.md", { turn_id: "turn-A" }),
-      ctx,
-      seen,
-    );
-    // … then the function_call form for the same skill in the same turn.
-    const b = extractCodexSkillToolEvents(
-      fnCall("rg -n x .agents/skills/learn/SKILL.md"),
-      { ...ctx, turnId: "turn-A" },
-      seen,
-    );
-    expect(a).toHaveLength(1);
-    expect(b).toEqual([]); // same (session, turn, skill) → collapsed
-  });
-
-  it("codexRowTurnId reads turn_id from a row's payload, else undefined", () => {
-    expect(codexRowTurnId({ type: "turn_context", payload: { turn_id: "turn-9" } })).toBe("turn-9");
-    expect(codexRowTurnId({ type: "event_msg", payload: { type: "exec_command_end", turn_id: "turn-7" } })).toBe("turn-7");
-    expect(codexRowTurnId({ type: "response_item", payload: { type: "function_call" } })).toBeUndefined();
-    expect(codexRowTurnId(null)).toBeUndefined();
-  });
-});
-
-describe("collectAndSendSkillTelemetry — hqRoot scoping", () => {
-  function stubClient(captured: SkillInvocationBatch[]) {
-    return {
-      async getTelemetryOptIn() {
-        return { enabled: true, updatedAt: null };
-      },
-      async postSkillInvocations(batch: SkillInvocationBatch) {
-        captured.push(batch);
-        return { ok: true, written: batch.events.length, skipped: [] };
-      },
-    };
-  }
-
-  function row(obj: Record<string, unknown>): string {
-    return JSON.stringify(obj);
-  }
-
-  it("emits only invocations whose cwd equals hqRoot", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
-    const projects = path.join(tmp, "projects");
-    const hqRoot = "/home/ec2-user/hq";
-
-    // Project A — sessions run from the HQ root.
-    const dirA = path.join(projects, "-home-ec2-user-hq");
-    await fs.mkdir(dirA, { recursive: true });
-    await fs.writeFile(
-      path.join(dirA, "a.jsonl"),
-      [
-        row({ type: "user", sessionId: "s1", timestamp: "2026-06-03T10:00:00Z", cwd: hqRoot, uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }),
-        row({ type: "assistant", sessionId: "s1", timestamp: "2026-06-03T10:01:00Z", cwd: hqRoot, message: { role: "assistant", content: [{ type: "tool_use", id: "t1", name: "Skill", input: { skill: "indigo:hello-world" } }] } }),
-      ].join("\n") + "\n",
-      "utf-8",
-    );
-
-    // Project B — a different repo on the same machine. Must be excluded.
-    const dirB = path.join(projects, "-home-ec2-user-other");
-    await fs.mkdir(dirB, { recursive: true });
-    await fs.writeFile(
-      path.join(dirB, "b.jsonl"),
-      row({ type: "user", sessionId: "s2", timestamp: "2026-06-03T10:02:00Z", cwd: "/home/ec2-user/other", uuid: "u2", message: { role: "user", content: "<command-name>/secret-skill</command-name>" } }) + "\n",
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m-test",
-      installerVersion: "test",
-      hqRoot,
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    const skills = captured.flatMap((b) => b.events.map((e) => e.skill));
-    expect(result.eventsSent).toBe(2);
-    expect(skills.sort()).toEqual(["deploy", "indigo:hello-world"]);
-    // The other-repo invocation never leaves the machine.
-    expect(skills).not.toContain("secret-skill");
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("commits the cursor to EOF on a clean run — a rerun re-sends nothing", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(
-      path.join(dir, "s.jsonl"),
-      row({ type: "user", sessionId: "s1", timestamp: "2026-06-04T09:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }) + "\n",
-      "utf-8",
-    );
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    const client = stubClient(captured);
-
-    const r1 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, codexSessionsRoot: path.join(tmp, "codex"), cursorPath });
-    expect(r1.eventsSent).toBe(1);
-    const r2 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, codexSessionsRoot: path.join(tmp, "codex"), cursorPath });
-    expect(r2.eventsSent).toBe(0); // cursor at EOF → nothing re-sent
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("does NOT advance the cursor when the POST fails — re-sends on the next run", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(
-      path.join(dir, "s.jsonl"),
-      row({ type: "user", sessionId: "s1", timestamp: "2026-06-04T09:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }) + "\n",
-      "utf-8",
-    );
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    let failNext = true;
-    const client = {
-      async getTelemetryOptIn() {
-        return { enabled: true, updatedAt: null };
-      },
-      async postSkillInvocations(batch: SkillInvocationBatch) {
-        if (failNext) {
-          failNext = false;
-          throw new Error("network down");
-        }
-        captured.push(batch);
-        return { ok: true, written: batch.events.length, skipped: [] };
-      },
-    };
-
-    const r1 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, codexSessionsRoot: path.join(tmp, "codex"), cursorPath });
-    expect(r1.eventsSent).toBe(0); // post threw → nothing committed
-    expect(captured).toHaveLength(0);
-
-    const r2 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, codexSessionsRoot: path.join(tmp, "codex"), cursorPath });
-    expect(r2.eventsSent).toBe(1); // re-scanned from offset 0 and delivered
-    expect(captured.flatMap((b) => b.events.map((e) => e.skill))).toEqual(["deploy"]);
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("R-F19: bounds a single oversized sanitized skill row before POST", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-r-f19-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    const hugeSkill = `deploy-${"x".repeat(400_000)}`;
-    await fs.writeFile(
-      path.join(dir, "s.jsonl"),
-      row({
-        type: "user",
-        sessionId: "s-r-f19-singleton",
-        timestamp: "2026-06-19T11:00:00.000Z",
-        cwd: "/x",
-        uuid: "u-r-f19-singleton",
-        message: {
-          role: "user",
-          content: `<command-name>/${hugeSkill}</command-name>`,
-        },
-      }) + "\n",
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const logs: string[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath: path.join(tmp, "cursor.json"),
-      log: (msg) => logs.push(msg),
-    });
-
-    expect(result.eventsSent).toBe(1);
-    expect(captured).toHaveLength(1);
-    const wireSize = Buffer.byteLength(JSON.stringify(captured[0]), "utf-8");
-    expect(wireSize).toBeLessThanOrEqual(240 * 1024);
-    expect(captured[0].events[0].skill).not.toBe(hugeSkill);
-    expect(logs.some((line) => line.includes("oversized row truncated"))).toBe(
-      true,
-    );
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("R-F19: a failed earlier skill batch prevents cursor advancement past it", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-r-f19-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    const file = path.join(dir, "s.jsonl");
-    await fs.writeFile(
-      file,
-      Array.from({ length: 101 }, (_, i) =>
-        row({
-          type: "user",
-          sessionId: "s-r-f19-prefix",
-          timestamp: `2026-06-19T12:${String(Math.floor(i / 60)).padStart(2, "0")}:${String(i % 60).padStart(2, "0")}.000Z`,
-          cwd: "/x",
-          uuid: `u-r-f19-${i}`,
-          message: {
-            role: "user",
-            content: `<command-name>/skill-${i}</command-name>`,
-          },
-        }),
-      ).join("\n") + "\n",
-      "utf-8",
-    );
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    let calls = 0;
-    const client = {
-      async getTelemetryOptIn() {
-        return { enabled: true, updatedAt: null };
-      },
-      async postSkillInvocations(batch: SkillInvocationBatch) {
-        calls++;
-        if (calls === 1) throw new Error("first batch failed");
-        captured.push(batch);
-        return { ok: true, written: batch.events.length, skipped: [] };
-      },
-    };
-    const opts = {
-      client,
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath,
-    };
-
-    const first = await collectAndSendSkillTelemetry(opts);
-    expect(first.eventsSent).toBe(0);
-    expect(calls).toBe(1);
-    const cursorAfterFailure = JSON.parse(
-      await fs.readFile(cursorPath, "utf-8"),
-    ) as { files: Record<string, { offset: number }> };
-    expect(cursorAfterFailure.files[file]?.offset ?? 0).toBe(0);
-
-    const second = await collectAndSendSkillTelemetry(opts);
-    expect(second.eventsSent).toBe(101);
-    expect(captured.flatMap((b) => b.events.map((e) => e.skill))).toContain(
-      "skill-0",
-    );
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("picks up only newly-appended events on a later run (incremental offset)", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    const file = path.join(dir, "s.jsonl");
-    await fs.writeFile(
-      file,
-      row({ type: "user", sessionId: "s1", timestamp: "2026-06-04T09:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }) + "\n",
-      "utf-8",
-    );
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    const client = stubClient(captured);
-
-    await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, codexSessionsRoot: path.join(tmp, "codex"), cursorPath });
-
-    // New invocation appended after the first clean run.
-    await fs.appendFile(
-      file,
-      row({ type: "assistant", sessionId: "s1", timestamp: "2026-06-04T09:05:00Z", cwd: "/x", message: { role: "assistant", content: [{ type: "tool_use", id: "t9", name: "Skill", input: { skill: "land" } }] } }) + "\n",
-      "utf-8",
-    );
-
-    const r2 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, codexSessionsRoot: path.join(tmp, "codex"), cursorPath });
-    expect(r2.eventsSent).toBe(1);
-    // Only the appended event — not the original — is re-sent.
-    const lastBatch = captured[captured.length - 1];
-    expect(lastBatch.events.map((e) => e.skill)).toEqual(["land"]);
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("HQ-DESKTOP-47: settles at complete UTF-8 lines and drains a bounded backlog without gaps", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-bounded-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    const file = path.join(dir, "s.jsonl");
-    const lines = [
-      row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T10:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }),
-      row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T10:01:00Z", cwd: "/x", uuid: "u2", message: { role: "user", content: "<command-name>/plán</command-name>" } }),
-      row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T10:02:00Z", cwd: "/x", uuid: "u3", message: { role: "user", content: "<command-name>/ship</command-name>" } }),
-    ];
-    await fs.writeFile(file, `${lines.join("\n")}\n`, "utf-8");
-
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    const client = stubClient(captured);
-    const base = {
-      client,
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath,
-    };
-    const cursorOffset = async (): Promise<number> => {
-      const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8")) as {
-        files: Record<string, { offset: number }>;
-      };
-      return cursor.files[file]?.offset ?? 0;
-    };
-
-    // Stop in the middle of the two-byte á. The first pass must commit only
-    // the preceding complete line rather than a character-counted position.
-    const accentOffset = lines[1].indexOf("á");
-    const firstBudget =
-      Buffer.byteLength(`${lines[0]}\n${lines[1].slice(0, accentOffset)}`, "utf-8") + 1;
-    const logs: string[] = [];
-    const first = await collectAndSendSkillTelemetry({
-      ...base,
-      maxScanBytesPerSource: firstBudget,
-      log: (message) => logs.push(message),
-    });
-    const afterFirst = await cursorOffset();
-    expect(first.eventsSent).toBe(1);
-    expect(afterFirst).toBe(Buffer.byteLength(`${lines[0]}\n`, "utf-8"));
-    expect(logs.some((message) => message.includes("scan budget reached"))).toBe(true);
-
-    // The second pass reaches the next complete line but not the third; the
-    // third drains the remainder. Together they must equal an unbounded scan.
-    const second = await collectAndSendSkillTelemetry({
-      ...base,
-      maxScanBytesPerSource: Buffer.byteLength(`${lines[1]}\n`, "utf-8") + 1,
-    });
-    const afterSecond = await cursorOffset();
-    const third = await collectAndSendSkillTelemetry({
-      ...base,
-      maxScanBytesPerSource: 1024 * 1024,
-    });
-    const afterThird = await cursorOffset();
-
-    expect(second.eventsSent).toBe(1);
-    expect(third.eventsSent).toBe(1);
-    expect(afterFirst).toBeLessThan(afterSecond);
-    expect(afterSecond).toBeLessThan(afterThird);
-    expect(afterThird).toBe(Buffer.byteLength(`${lines.join("\n")}\n`, "utf-8"));
-    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toEqual([
-      "deploy",
-      "plán",
-      "ship",
-    ]);
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("HQ-DESKTOP-47: a transcript below the injected budget keeps the one-pass EOF behaviour", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-small-budget-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    const file = path.join(dir, "s.jsonl");
-    const transcript = row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T11:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }) + "\n";
-    await fs.writeFile(file, transcript, "utf-8");
-
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath,
-      maxScanBytesPerSource: Buffer.byteLength(transcript, "utf-8") + 1,
-    });
-    const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8")) as {
-      files: Record<string, { offset: number }>;
-    };
-
-    expect(result.eventsSent).toBe(1);
-    expect(cursor.files[file]?.offset).toBe(Buffer.byteLength(transcript, "utf-8"));
-    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toEqual([
-      "deploy",
-    ]);
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("HQ-DESKTOP-47: a truncated bounded backlog resets to the replacement file", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-budget-rotate-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    const file = path.join(dir, "s.jsonl");
-    const oldLine = row({ type: "user", sessionId: "old", timestamp: "2026-08-02T12:00:00Z", cwd: "/x", uuid: "old-1", message: { role: "user", content: "<command-name>/deploy</command-name>" } });
-    const oldTail = row({ type: "user", sessionId: "old", timestamp: "2026-08-02T12:01:00Z", cwd: "/x", uuid: "old-2", message: { role: "user", content: "<command-name>/ship</command-name>" } });
-    await fs.writeFile(file, `${oldLine}\n${oldTail}\n`, "utf-8");
-
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    const base = {
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath,
-    };
-    await collectAndSendSkillTelemetry({
-      ...base,
-      maxScanBytesPerSource: Buffer.byteLength(`${oldLine}\n`, "utf-8") + 1,
-    });
-
-    const replacement = row({ type: "user", sessionId: "new", timestamp: "2026-08-02T12:02:00Z", cwd: "/x", uuid: "new-1", message: { role: "user", content: "<command-name>/land</command-name>" } }) + "\n";
-    expect(Buffer.byteLength(replacement, "utf-8")).toBeLessThan(
-      Buffer.byteLength(`${oldLine}\n`, "utf-8"),
-    );
-    await fs.writeFile(file, replacement, "utf-8");
-
-    const result = await collectAndSendSkillTelemetry({
-      ...base,
-      maxScanBytesPerSource: 1024 * 1024,
-    });
-    const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8")) as {
-      files: Record<string, { offset: number }>;
-    };
-
-    expect(result.eventsSent).toBe(1);
-    expect(cursor.files[file]?.offset).toBe(Buffer.byteLength(replacement, "utf-8"));
-    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toEqual([
-      "deploy",
-      "land",
-    ]);
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("HQ-DESKTOP-47: continues past a single JSONL record larger than the scan budget", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-large-line-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    const file = path.join(dir, "s.jsonl");
-    const oversized = row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T13:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: `<command-name>/deploy</command-name><command-args>${"x".repeat(900)}</command-args>` } });
-    const tail = row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T13:01:00Z", cwd: "/x", uuid: "u2", message: { role: "user", content: "<command-name>/land</command-name>" } });
-    await fs.writeFile(file, `${oversized}\n${tail}\n`, "utf-8");
-
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    const base = {
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath,
-      maxScanBytesPerSource: 128,
-    };
-    const offsets: number[] = [];
-    for (let pass = 0; pass < 12; pass++) {
-      await collectAndSendSkillTelemetry(base);
-      const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8")) as {
-        files: Record<string, { offset: number; pendingLine?: { scannedOffset: number } }>;
-      };
-      offsets.push(cursor.files[file]?.offset ?? 0);
-    }
-
-    expect(offsets.some((offset) => offset > 0)).toBe(true);
-    expect(offsets[0]).toBe(0); // first pass only discovers a partial record
-    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toEqual([
-      "deploy",
-      "land",
-    ]);
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("HQ-DESKTOP-47: rotates a shared runtime budget so a backlog cannot starve a later session", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-fair-"));
-    const projects = path.join(tmp, "projects");
-    const backlogDir = path.join(projects, "a-backlog");
-    const currentDir = path.join(projects, "b-current");
-    await fs.mkdir(backlogDir, { recursive: true });
-    await fs.mkdir(currentDir, { recursive: true });
-    const backlogLine = row({ type: "user", sessionId: "old", timestamp: "2026-08-02T14:00:00Z", cwd: "/x", uuid: "old-1", message: { role: "user", content: "<command-name>/deploy</command-name>" } });
-    await fs.writeFile(
-      path.join(backlogDir, "old.jsonl"),
-      `${Array.from({ length: 4 }, () => backlogLine).join("\n")}\n`,
-      "utf-8",
-    );
-    await fs.writeFile(
-      path.join(currentDir, "current.jsonl"),
-      row({ type: "user", sessionId: "new", timestamp: "2026-08-02T14:01:00Z", cwd: "/x", uuid: "new-1", message: { role: "user", content: "<command-name>/land</command-name>" } }) + "\n",
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const cursorPath = path.join(tmp, "cursor.json");
-    const budget = Buffer.byteLength(`${backlogLine}\n`, "utf-8") + 1;
-    const base = {
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath,
-      maxScanBytesPerSource: budget,
-    };
-
-    await collectAndSendSkillTelemetry(base);
-    await collectAndSendSkillTelemetry(base);
-
-    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toContain(
-      "land",
-    );
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("captures every project when hqRoot is omitted", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-proj");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(
-      path.join(dir, "c.jsonl"),
-      row({ type: "user", sessionId: "s3", timestamp: "2026-06-03T10:03:00Z", cwd: "/anywhere", uuid: "u3", message: { role: "user", content: "<command-name>/anywhere-skill</command-name>" } }) + "\n",
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m-test",
-      installerVersion: "test",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    expect(result.eventsSent).toBe(1);
-    expect(captured[0].events[0].skill).toBe("anywhere-skill");
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  // ── Codex CLI rollouts ────────────────────────────────────────────────────
-
-  // Build a realistic Codex rollout: a leading session_meta, the environment
-  // boilerplate Codex writes (which must be ignored), then the typed commands.
-  function codexRollout(sessionId: string, cwd: string, messages: string[]): string {
-    const lines = [
-      row({ timestamp: "2026-06-07T18:16:56.480Z", type: "session_meta", payload: { id: sessionId, cwd, originator: "codex_exec", cli_version: "0.137.0", source: "exec" } }),
-      row({ timestamp: "2026-06-07T18:16:56.718Z", type: "response_item", payload: { type: "message", role: "user", content: [{ type: "input_text", text: "<environment_context>\n  <cwd>" + cwd + "</cwd>\n</environment_context>" }] } }),
-      ...messages.flatMap((message, i) => [
-        // Codex writes BOTH a response_item (role:user) and an event_msg for the
-        // same input; only the event_msg must be counted (no double-count).
-        row({ timestamp: `2026-06-07T18:17:0${i}.000Z`, type: "response_item", payload: { type: "message", role: "user", content: [{ type: "input_text", text: message }] } }),
-        row({ timestamp: `2026-06-07T18:17:0${i}.000Z`, type: "event_msg", payload: { type: "user_message", message, images: [], local_images: [], text_elements: [] } }),
-      ]),
-    ];
-    return lines.join("\n") + "\n";
-  }
-
-  it("captures Codex typed slash skills scoped to hqRoot, excluding other cwds + dupes", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-codex-"));
-    const codex = path.join(tmp, "sessions", "2026", "06", "07");
-    await fs.mkdir(codex, { recursive: true });
-    const hqRoot = "/home/ec2-user/hq";
-
-    await fs.writeFile(
-      path.join(codex, "rollout-2026-06-07T18-16-56-aaaa.jsonl"),
-      codexRollout("sess-codex-1", hqRoot, ["/indigo:hello-world", "/indigo:signals refresh"]),
-      "utf-8",
-    );
-    // A second rollout from a different repo — must be excluded by hqRoot scope.
-    await fs.writeFile(
-      path.join(codex, "rollout-2026-06-07T18-20-00-bbbb.jsonl"),
-      codexRollout("sess-codex-2", "/home/ec2-user/other", ["/secret-skill"]),
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: path.join(tmp, "no-claude"),
-      codexSessionsRoot: path.join(tmp, "sessions"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    const events = captured.flatMap((b) => b.events);
-    // No double-count from the duplicate response_item rows.
-    expect(result.eventsSent).toBe(2);
-    expect(events.map((e) => e.skill).sort()).toEqual(["indigo:hello-world", "indigo:signals"]);
-    // Codex invocations are recorded as the typed source.
-    expect(events.every((e) => e.source === "typed")).toBe(true);
-    // The other-repo Codex invocation never leaves the machine.
-    expect(events.map((e) => e.skill)).not.toContain("secret-skill");
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("captures Claude and Codex skills together in a single run", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-both-"));
-    const projects = path.join(tmp, "projects", "-home-ec2-user-hq");
-    const codex = path.join(tmp, "sessions", "2026", "06", "07");
-    await fs.mkdir(projects, { recursive: true });
-    await fs.mkdir(codex, { recursive: true });
-    const hqRoot = "/home/ec2-user/hq";
-
-    await fs.writeFile(
-      path.join(projects, "a.jsonl"),
-      row({ type: "assistant", sessionId: "s1", timestamp: "2026-06-07T10:00:00Z", cwd: hqRoot, message: { role: "assistant", content: [{ type: "tool_use", id: "t1", name: "Skill", input: { skill: "indigo:crm-management" } }] } }) + "\n",
-      "utf-8",
-    );
-    await fs.writeFile(
-      path.join(codex, "rollout-x.jsonl"),
-      codexRollout("sess-codex-1", hqRoot, ["/indigo:hello-world"]),
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: path.join(tmp, "projects"),
-      codexSessionsRoot: path.join(tmp, "sessions"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    expect(result.eventsSent).toBe(2);
-    const events = captured.flatMap((b) => b.events);
-    expect(events.find((e) => e.skill === "indigo:crm-management")?.source).toBe("model");
-    expect(events.find((e) => e.skill === "indigo:hello-world")?.source).toBe("typed");
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("reads Codex session ctx from the top on an incremental (cursor mid-file) run", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-incr-"));
-    const codex = path.join(tmp, "sessions", "2026", "06", "07");
-    await fs.mkdir(codex, { recursive: true });
-    const hqRoot = "/home/ec2-user/hq";
-    const file = path.join(codex, "rollout-incr.jsonl");
-
-    await fs.writeFile(file, codexRollout("sess-incr", hqRoot, ["/indigo:hello-world"]), "utf-8");
-    const cursorPath = path.join(tmp, "cursor.json");
-    const captured: SkillInvocationBatch[] = [];
-    const client = stubClient(captured);
-    const base = { client, machineId: "m", installerVersion: "t", hqRoot, claudeProjectsRoot: path.join(tmp, "no-claude"), codexSessionsRoot: path.join(tmp, "sessions"), cursorPath };
-
-    const r1 = await collectAndSendSkillTelemetry(base);
-    expect(r1.eventsSent).toBe(1);
-
-    // Append a new typed command AFTER the session_meta line. The cursor now
-    // sits mid-file, so the new event's cwd/sessionId must still come from the
-    // session_meta at the top — proving readCodexSessionContext reads offset 0.
-    await fs.appendFile(
-      file,
-      row({ timestamp: "2026-06-07T18:30:00.000Z", type: "event_msg", payload: { type: "user_message", message: "/indigo:action-items" } }) + "\n",
-      "utf-8",
-    );
-
-    const r2 = await collectAndSendSkillTelemetry(base);
-    expect(r2.eventsSent).toBe(1);
-    const last = captured[captured.length - 1].events[0];
-    expect(last.skill).toBe("indigo:action-items");
-    // cwd survived → it passed the hqRoot scope filter (would be dropped if the
-    // session_meta weren't re-read from the top on this mid-file run).
-    expect(last.cwd).toBe(hqRoot);
-    expect(last.sessionId).toBe("sess-incr");
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  // A Codex rollout that drives a skill the way the model actually does: by
-  // reading its SKILL.md via exec_command. `reads` is a list of
-  // [skill, turnId, cmdTail] tuples turned into exec_command_end rows.
-  function codexModelRollout(
-    sessionId: string,
-    cwd: string,
-    reads: Array<[skill: string, turnId: string, extra?: Record<string, unknown>]>,
-  ): string {
-    const lines = [
-      row({ timestamp: "2026-06-08T10:00:00.000Z", type: "session_meta", payload: { id: sessionId, cwd, originator: "codex_exec" } }),
-      ...reads.map(([skill, turnId, extra], i) =>
-        row({
-          timestamp: `2026-06-08T10:0${i}:00.000Z`,
-          type: "event_msg",
-          payload: {
-            type: "exec_command_end",
-            call_id: `call_${i}`,
-            turn_id: turnId,
-            command: ["/bin/zsh", "-lc", `sed -n '1,240p' ${cwd}/.agents/skills/${skill}/SKILL.md`],
-            cwd,
-            parsed_cmd: [{ type: "read" }],
-            ...(extra ?? {}),
-          },
-        }),
-      ),
-    ];
-    return lines.join("\n") + "\n";
-  }
-
-  it("captures Codex model-driven skill loads, deduped per turn", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-codexmodel-"));
-    const codex = path.join(tmp, "sessions", "2026", "06", "08");
-    await fs.mkdir(codex, { recursive: true });
-    const hqRoot = "/home/ec2-user/hq";
-
-    await fs.writeFile(
-      path.join(codex, "rollout-model.jsonl"),
-      codexModelRollout("sess-model", hqRoot, [
-        ["learn", "turn-A"], // turn-A read #1
-        ["learn", "turn-A"], // turn-A read #2 — same turn+skill, must collapse
-        ["learn", "turn-B"], // turn-B — distinct turn, counts again
-        ["quiz", "turn-B"], // different skill, same turn — counts
-      ]),
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: path.join(tmp, "no-claude"),
-      codexSessionsRoot: path.join(tmp, "sessions"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    const events = captured.flatMap((b) => b.events);
-    // 4 reads → 3 events: the two turn-A `learn` reads collapse to one.
-    expect(result.eventsSent).toBe(3);
-    expect(events.every((e) => e.source === "model")).toBe(true);
-    expect(events.map((e) => `${e.skill}@${e.uuid}`).sort()).toEqual([
-      "learn@codex:skill:sess-model:turn-A:learn",
-      "learn@codex:skill:sess-model:turn-B:learn",
-      "quiz@codex:skill:sess-model:turn-B:quiz",
-    ]);
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("captures the function_call exec shape, attributing the turn from turn_context", async () => {
-    // Mirrors a real Codex 0.128 session: SKILL.md reads arrive as
-    // `response_item` `function_call` execs (no per-row turn_id), preceded by a
-    // `turn_context` that names the turn. The collector must thread that turn id.
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-fncall-"));
-    const codex = path.join(tmp, "sessions", "2026", "06", "10");
-    await fs.mkdir(codex, { recursive: true });
-    const hqRoot = "/home/ec2-user/hq";
-
-    const lines = [
-      row({ timestamp: "2026-06-10T16:38:32.000Z", type: "session_meta", payload: { id: "sess-fn", cwd: hqRoot, originator: "codex_exec" } }),
-      row({ timestamp: "2026-06-10T16:38:44.000Z", type: "turn_context", payload: { turn_id: "turn-1", cwd: hqRoot } }),
-      // Two reads of the same skill in turn-1 — the wc then the sed, as Codex does.
-      row({ timestamp: "2026-06-10T16:39:26.000Z", type: "response_item", payload: { type: "function_call", name: "exec_command", call_id: "c1", arguments: JSON.stringify({ cmd: "wc -l .claude/skills/indigo:hello-world/SKILL.md", workdir: hqRoot }) } }),
-      row({ timestamp: "2026-06-10T16:39:41.000Z", type: "response_item", payload: { type: "function_call", name: "exec_command", call_id: "c2", arguments: JSON.stringify({ cmd: "sed -n '1,80p' .claude/skills/indigo:hello-world/SKILL.md", workdir: hqRoot }) } }),
-    ].join("\n") + "\n";
-    await fs.writeFile(path.join(codex, "rollout-fn.jsonl"), lines, "utf-8");
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: path.join(tmp, "no-claude"),
-      codexSessionsRoot: path.join(tmp, "sessions"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    const events = captured.flatMap((b) => b.events);
-    // Two reads, one turn, one skill → exactly one event, attributed to turn-1.
-    expect(result.eventsSent).toBe(1);
-    expect(events[0]).toMatchObject({
-      skill: "indigo:hello-world",
-      source: "model",
-      cwd: hqRoot,
-      uuid: "codex:skill:sess-fn:turn-1:indigo:hello-world",
-    });
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("HQ-DESKTOP-47: preserves Codex turn dedup across a bounded resume", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-codex-budget-"));
-    const codex = path.join(tmp, "sessions", "2026", "08", "02");
-    await fs.mkdir(codex, { recursive: true });
-    const hqRoot = "/home/ec2-user/hq";
-    const lines = [
-      row({ timestamp: "2026-08-02T15:00:00.000Z", type: "session_meta", payload: { id: "sess-budget", cwd: hqRoot } }),
-      row({ timestamp: "2026-08-02T15:00:01.000Z", type: "turn_context", payload: { turn_id: "turn-budget", cwd: hqRoot } }),
-      row({ timestamp: "2026-08-02T15:00:02.000Z", type: "response_item", payload: { type: "function_call", name: "exec_command", arguments: JSON.stringify({ cmd: "sed -n '1,80p' .claude/skills/deploy/SKILL.md", workdir: hqRoot }) } }),
-      row({ timestamp: "2026-08-02T15:00:03.000Z", type: "response_item", payload: { type: "function_call", name: "exec_command", arguments: JSON.stringify({ cmd: "wc -l .claude/skills/deploy/SKILL.md", workdir: hqRoot }) } }),
-    ];
-    const file = path.join(codex, "rollout-budget.jsonl");
-    await fs.writeFile(file, `${lines.join("\n")}\n`, "utf-8");
-
-    const captured: SkillInvocationBatch[] = [];
-    const cursorPath = path.join(tmp, "cursor.json");
-    const base = {
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: path.join(tmp, "no-claude"),
-      codexSessionsRoot: path.join(tmp, "sessions"),
-      cursorPath,
-    };
-    // Commit the turn_context but stop in the next function_call row.
-    await collectAndSendSkillTelemetry({
-      ...base,
-      maxScanBytesPerSource: Buffer.byteLength(`${lines[0]}\n${lines[1]}\n`, "utf-8") + 1,
-    });
-    await collectAndSendSkillTelemetry({ ...base, maxScanBytesPerSource: 1024 * 1024 });
-    await collectAndSendSkillTelemetry({ ...base, maxScanBytesPerSource: 1024 * 1024 });
-
-    const events = captured.flatMap((batch) => batch.events);
-    expect(events).toHaveLength(1);
-    expect(events[0]).toMatchObject({
-      skill: "deploy",
-      uuid: "codex:skill:sess-budget:turn-budget:deploy",
-    });
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("does not count SKILL.md edits (apply_patch / write) as skill usage", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-edit-"));
-    const codex = path.join(tmp, "sessions", "2026", "06", "08");
-    await fs.mkdir(codex, { recursive: true });
-    const hqRoot = "/home/ec2-user/hq";
-
-    await fs.writeFile(
-      path.join(codex, "rollout-edit.jsonl"),
-      codexModelRollout("sess-edit", hqRoot, [
-        ["learn", "turn-A", { parsed_cmd: [{ type: "write" }] }], // an edit — excluded
-      ]),
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: path.join(tmp, "no-claude"),
-      codexSessionsRoot: path.join(tmp, "sessions"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    expect(result.eventsSent).toBe(0);
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("scope now counts skills run from HQ subfolders (worktrees), still excludes siblings", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-scope-"));
-    const projects = path.join(tmp, "projects");
-    const codex = path.join(tmp, "sessions", "2026", "06", "08");
-    await fs.mkdir(projects, { recursive: true });
-    await fs.mkdir(codex, { recursive: true });
-    const hqRoot = "/home/ec2-user/hq";
-    const worktree = `${hqRoot}/.claude/worktrees/wt1`;
-    const sibling = `${hqRoot}-other`; // shares the prefix but is a different repo
-
-    // Claude skill run from a worktree under the HQ root — newly counted.
-    const dirWt = path.join(projects, "wt");
-    await fs.mkdir(dirWt, { recursive: true });
-    await fs.writeFile(
-      path.join(dirWt, "wt.jsonl"),
-      row({ type: "assistant", sessionId: "s-wt", timestamp: "2026-06-08T10:00:00Z", cwd: worktree, message: { role: "assistant", content: [{ type: "tool_use", id: "t1", name: "Skill", input: { skill: "handoff" } }] } }) + "\n",
-      "utf-8",
-    );
-    // Claude skill run from a sibling repo sharing the prefix — must stay excluded.
-    const dirSib = path.join(projects, "sib");
-    await fs.mkdir(dirSib, { recursive: true });
-    await fs.writeFile(
-      path.join(dirSib, "sib.jsonl"),
-      row({ type: "assistant", sessionId: "s-sib", timestamp: "2026-06-08T10:01:00Z", cwd: sibling, message: { role: "assistant", content: [{ type: "tool_use", id: "t2", name: "Skill", input: { skill: "sibling-skill" } }] } }) + "\n",
-      "utf-8",
-    );
-    // Codex model load from a worktree under the HQ root — newly counted.
-    await fs.writeFile(
-      path.join(codex, "rollout-wt.jsonl"),
-      codexModelRollout("sess-wt", worktree, [["quiz", "turn-A"]]),
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "sessions"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    const skills = captured.flatMap((b) => b.events.map((e) => e.skill)).sort();
-    expect(result.eventsSent).toBe(2);
-    expect(skills).toEqual(["handoff", "quiz"]);
-    expect(skills).not.toContain("sibling-skill");
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-});
-
-// ── companyUid edge attribution (US-002) ────────────────────────────────────────
-
-describe("collectAndSendSkillTelemetry — companyUid attribution", () => {
-  const COMPANY_UID = "cmp_01INDIGOSKILL";
-
-  function stubClient(captured: SkillInvocationBatch[]) {
-    return {
-      async getTelemetryOptIn() {
-        return { enabled: true, updatedAt: null };
-      },
-      async postSkillInvocations(batch: SkillInvocationBatch) {
-        captured.push(batch);
-        return { ok: true, written: batch.events.length, skipped: [] };
-      },
-    };
-  }
-
-  function row(obj: Record<string, unknown>): string {
-    return JSON.stringify(obj);
-  }
-
-  /** Write a manifest mapping `repos/private/hq-cloud` → COMPANY_UID under hqRoot. */
-  async function writeManifest(hqRoot: string): Promise<void> {
-    await fs.mkdir(path.join(hqRoot, "companies"), { recursive: true });
-    await fs.writeFile(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      `companies:\n  indigo:\n    repos:\n      - repos/private/hq-cloud\n    cloud_uid: ${COMPANY_UID}\n`,
-      "utf-8",
-    );
-  }
-
-  it("stamps companyUid when cwd is inside a company repo, omits it otherwise", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-co-"));
-    const hqRoot = tmp; // real dir so the manifest's repo path resolves under it
-    await writeManifest(hqRoot);
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-
-    const inRepo = path.join(hqRoot, "repos/private/hq-cloud");
-    const atRoot = hqRoot; // inside scope, but not inside any mapped repo
-    await fs.writeFile(
-      path.join(dir, "s.jsonl"),
-      [
-        // Core skill, cwd inside the company repo → attributed by cwd.
-        row({ type: "user", sessionId: "s1", timestamp: "2026-06-10T10:00:00Z", cwd: inRepo, uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }),
-        // Company skill `indigo:hello-world` run at hqRoot (maps to no repo) →
-        // attributed by SKILL NAMESPACE to the indigo company, regardless of cwd.
-        row({ type: "assistant", sessionId: "s1", timestamp: "2026-06-10T10:01:00Z", cwd: atRoot, message: { role: "assistant", content: [{ type: "tool_use", id: "t1", name: "Skill", input: { skill: "indigo:hello-world" } }] } }),
-        // Core skill at hqRoot (no company repo, no namespace) → unattributed.
-        row({ type: "user", sessionId: "s1", timestamp: "2026-06-10T10:02:00Z", cwd: atRoot, uuid: "u3", message: { role: "user", content: "<command-name>/handoff</command-name>" } }),
-      ].join("\n") + "\n",
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    expect(result.eventsSent).toBe(3);
-    const events = captured.flatMap((b) => b.events);
-    const bySkill = new Map(events.map((e) => [e.skill, e]));
-    // Core skill attributed by its cwd (inside the company repo).
-    expect(bySkill.get("deploy")!.companyUid).toBe(COMPANY_UID);
-    // Company skill attributed by its namespace, even though cwd maps to no repo.
-    expect(bySkill.get("indigo:hello-world")!.companyUid).toBe(COMPANY_UID);
-    // Core skill at hqRoot with no owning repo → stays unattributed.
-    expect("companyUid" in bySkill.get("handoff")!).toBe(false);
-    // Never the reserved sentinel.
-    for (const e of events) expect(e.companyUid).not.toBe("unattributed");
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("parses the manifest once per run (cache), not per event", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-cache-"));
-    const hqRoot = tmp;
-    await writeManifest(hqRoot);
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    const inRepo = path.join(hqRoot, "repos/private/hq-cloud");
-    await fs.writeFile(
-      path.join(dir, "s.jsonl"),
-      Array.from({ length: 4 }, (_, i) =>
-        row({ type: "user", sessionId: "s1", timestamp: `2026-06-10T10:0${i}:00Z`, cwd: inRepo, uuid: `u${i}`, message: { role: "user", content: "<command-name>/deploy</command-name>" } }),
-      ).join("\n") + "\n",
-      "utf-8",
-    );
-
-    const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
-    const realReadFile = fs.readFile;
-    let manifestReads = 0;
-    const spy = vi
-      .spyOn(fs, "readFile")
-      .mockImplementation((async (p: Parameters<typeof realReadFile>[0], ...rest: unknown[]) => {
-        if (typeof p === "string" && p === manifestPath) manifestReads++;
-        // @ts-expect-error pass-through to the real implementation
-        return realReadFile(p, ...rest);
-      }) as typeof realReadFile);
-
-    const captured: SkillInvocationBatch[] = [];
-    try {
-      await collectAndSendSkillTelemetry({
-        client: stubClient(captured),
-        machineId: "m",
-        installerVersion: "t",
-        hqRoot,
-        claudeProjectsRoot: projects,
-        codexSessionsRoot: path.join(tmp, "codex"),
-        cursorPath: path.join(tmp, "cursor.json"),
-      });
-    } finally {
-      spy.mockRestore();
-    }
-
-    expect(manifestReads).toBe(1);
-    const events = captured.flatMap((b) => b.events);
-    expect(events).toHaveLength(4);
-    for (const e of events) expect(e.companyUid).toBe(COMPANY_UID);
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-});
-
-describe("readFileRegion — HQ-SYNC-WEB-15 (SIGABRT on >2GiB single read)", () => {
-  const INT32_MAX = 2 ** 31 - 1;
-
-  it("keeps the skill scanner's decode ceiling below V8's fatal 2 GiB boundary", () => {
-    expect(MAX_DECODE_BYTES).toBeLessThan(2 ** 31);
-  });
-
-  it("never issues a single read whose length exceeds Int32, even for a multi-GiB region", async () => {
-    // The original code did `fh.read(buf, 0, currentSize - offset, offset)` in
-    // one shot. Once a session log's unread tail passed ~2 GiB, the length
-    // argument was no longer an Int32, so Node's native fs.read asserted
-    // (`args[3]->IsInt32()`) and SIGABRT'd the whole runner. Simulate a 3 GiB
-    // region with a recording fake handle (no real allocation) and prove every
-    // native read length stays within Int32.
-    const THREE_GIB = 3 * 1024 * 1024 * 1024;
-    const lengths: number[] = [];
-    let cursor = 0;
-    const fakeFh = {
-      read: vi.fn(
-        async (_buf: Buffer, _off: number, length: number, position: number) => {
-          lengths.push(length);
-          expect(position).toBe(cursor); // contiguous, in order
-          cursor += length;
-          return { bytesRead: length };
-        },
-      ),
-    };
-
-    const total = await readFileRegion(
-      fakeFh as unknown as Parameters<typeof readFileRegion>[0],
-      Buffer.alloc(0), // recording fake never touches the buffer
-      0,
-      THREE_GIB,
-    );
-
-    expect(total).toBe(THREE_GIB);
-    expect(lengths.length).toBeGreaterThan(1); // it actually chunked
-    for (const len of lengths) {
-      expect(len).toBeGreaterThan(0);
-      expect(len).toBeLessThanOrEqual(INT32_MAX);
-    }
-    expect(lengths.reduce((a, b) => a + b, 0)).toBe(THREE_GIB);
-  });
-
-  it("reads an entire real region correctly across multiple chunks", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "readregion-"));
-    const filePath = path.join(tmp, "data.bin");
-    const payload = Buffer.from("abcdefghijklmnopqrstuvwxyz0123456789", "utf-8");
-    await fs.writeFile(filePath, payload);
-
-    const fh = await fs.open(filePath, "r");
-    try {
-      const buf = Buffer.alloc(payload.length);
-      // Tiny chunk size forces the loop to iterate many times.
-      const read = await readFileRegion(fh, buf, 0, payload.length, 7);
-      expect(read).toBe(payload.length);
-      expect(buf.equals(payload)).toBe(true);
-    } finally {
-      await fh.close();
-    }
-
-    // Reading a sub-region from an offset also lands correctly.
-    const fh2 = await fs.open(filePath, "r");
-    try {
-      const buf = Buffer.alloc(10);
-      const read = await readFileRegion(fh2, buf, 5, 10, 4);
-      expect(read).toBe(10);
-      expect(buf.toString("utf-8")).toBe(payload.toString("utf-8", 5, 15));
-    } finally {
-      await fh2.close();
-    }
-
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("stops cleanly on a short/zero read (file truncated since stat)", async () => {
-    // Ask for 100 bytes but the file only holds 30: the handle yields bytes up
-    // to what's left, then signals EOF with a 0-byte read.
-    let remaining = 30;
-    const fakeFh = {
-      read: vi.fn(async (_b: Buffer, _o: number, length: number) => {
-        const n = Math.min(length, remaining);
-        remaining -= n;
-        return { bytesRead: n };
-      }),
-    };
-    const got = await readFileRegion(
-      fakeFh as unknown as Parameters<typeof readFileRegion>[0],
-      Buffer.alloc(0),
-      0,
-      100,
-      8,
-    );
-    expect(got).toBe(30);
-  });
-});
-
-describe("computeSkillVersion (US-015)", () => {
-  function sha256(bytes: string): string {
-    return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
-  }
-
-  it("hashes .claude/skills/<skill>/SKILL.md to a sha256:<hex> marker", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-ver-"));
-    const body = "---\nname: deploy\n---\nDeploy things.\n";
-    const dir = path.join(tmp, ".claude", "skills", "deploy");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(path.join(dir, "SKILL.md"), body, "utf-8");
-
-    expect(await computeSkillVersion(tmp, "deploy")).toBe(sha256(body));
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("resolves a namespaced skill by its full invocation name (colon in dir name)", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-ver-"));
-    const body = "hello world skill\n";
-    const dir = path.join(tmp, ".claude", "skills", "indigo:hello-world");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(path.join(dir, "SKILL.md"), body, "utf-8");
-
-    expect(await computeSkillVersion(tmp, "indigo:hello-world")).toBe(sha256(body));
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("resolves an ALREADY-ENCODED local segment without double-encoding (win32 Codex path capture)", async () => {
-    // Codex telemetry extraction captures the on-disk wrapper name from a
-    // win32 path (`indigo%3Ahello-world`); encoding that again would look
-    // under `indigo%253A...` and miss. Normalization decodes to canonical
-    // first, then re-encodes for THIS host.
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-ver-"));
-    const body = "encoded-name skill";
-    const hostDirName = encodeLocalVaultSegment("indigo:hello-world");
-    const dir = path.join(tmp, ".claude", "skills", hostDirName);
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(path.join(dir, "SKILL.md"), body, "utf-8");
-
-    expect(await computeSkillVersion(tmp, "indigo%3Ahello-world")).toBe(sha256(body));
-    // A decoded separator can never smuggle past the traversal guard.
-    expect(await computeSkillVersion(tmp, "a%2Fb")).toBeUndefined();
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("falls back to .agents/skills/ (Codex bridge layout)", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-ver-"));
-    const body = "codex-bridged skill\n";
-    const dir = path.join(tmp, ".agents", "skills", "learn");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(path.join(dir, "SKILL.md"), body, "utf-8");
-
-    expect(await computeSkillVersion(tmp, "learn")).toBe(sha256(body));
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("returns undefined for a missing hqRoot, a missing file, or a traversal attempt", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-ver-"));
-    expect(await computeSkillVersion(undefined, "deploy")).toBeUndefined();
-    expect(await computeSkillVersion(tmp, "does-not-exist")).toBeUndefined();
-    // Path-traversal / separator-bearing names never map to a SKILL.md here.
-    expect(await computeSkillVersion(tmp, "../../etc/passwd")).toBeUndefined();
-    expect(await computeSkillVersion(tmp, "a/b")).toBeUndefined();
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-});
-
-describe("collectAndSendSkillTelemetry — skillVersion emission (US-015)", () => {
-  function stubClient(captured: SkillInvocationBatch[]) {
-    return {
-      async getTelemetryOptIn() {
-        return { enabled: true, updatedAt: null };
-      },
-      async postSkillInvocations(batch: SkillInvocationBatch) {
-        captured.push(batch);
-        return { ok: true, written: batch.events.length, skipped: [] };
-      },
-    };
-  }
-  function row(obj: Record<string, unknown>): string {
-    return JSON.stringify(obj);
-  }
-
-  it("stamps the SKILL.md content hash onto the shipped event", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-ver-emit-"));
-    // hqRoot IS the session cwd, so the invocation passes the scope filter and
-    // the resolver can find the skill under hqRoot/.claude/skills.
-    const hqRoot = path.join(tmp, "hq");
-    const skillBody = "---\nname: deploy\n---\nDeploy.\n";
-    const skillDir = path.join(hqRoot, ".claude", "skills", "deploy");
-    await fs.mkdir(skillDir, { recursive: true });
-    await fs.writeFile(path.join(skillDir, "SKILL.md"), skillBody, "utf-8");
-
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-hq");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(
-      path.join(dir, "s.jsonl"),
-      row({
-        type: "user",
-        sessionId: "s1",
-        timestamp: "2026-07-09T09:00:00Z",
-        cwd: hqRoot,
-        uuid: "u1",
-        message: { role: "user", content: "<command-name>/deploy</command-name>" },
-      }) + "\n",
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      hqRoot,
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    expect(result.eventsSent).toBe(1);
-    const ev = captured[0].events[0];
-    expect(ev.skill).toBe("deploy");
-    expect(ev.skillVersion).toBe(
-      `sha256:${createHash("sha256").update(skillBody).digest("hex")}`,
-    );
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("emits the injected resolver's marker (wiring is decoupled from disk)", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-ver-inj-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(
-      path.join(dir, "s.jsonl"),
-      row({
-        type: "assistant",
-        sessionId: "s2",
-        timestamp: "2026-07-09T10:00:00Z",
-        cwd: "/x",
-        message: {
-          role: "assistant",
-          content: [{ type: "tool_use", id: "t1", name: "Skill", input: { skill: "code-review" } }],
-        },
-      }) + "\n",
-      "utf-8",
-    );
-
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath: path.join(tmp, "cursor.json"),
-      resolveSkillVersion: (skill) => `sha256:stub-for-${skill}`,
-    });
-
-    expect(result.eventsSent).toBe(1);
-    expect(captured[0].events[0].skillVersion).toBe("sha256:stub-for-code-review");
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-
-  it("omits skillVersion when the SKILL.md can't be resolved (additive/back-compat)", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-ver-none-"));
-    const projects = path.join(tmp, "projects");
-    const dir = path.join(projects, "-p");
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(
-      path.join(dir, "s.jsonl"),
-      row({
-        type: "user",
-        sessionId: "s3",
-        timestamp: "2026-07-09T11:00:00Z",
-        cwd: "/x",
-        uuid: "u3",
-        message: { role: "user", content: "<command-name>/unknown-skill</command-name>" },
-      }) + "\n",
-      "utf-8",
-    );
-
-    // No hqRoot → the default resolver can't locate any SKILL.md → field omitted.
-    const captured: SkillInvocationBatch[] = [];
-    const result = await collectAndSendSkillTelemetry({
-      client: stubClient(captured),
-      machineId: "m",
-      installerVersion: "t",
-      claudeProjectsRoot: projects,
-      codexSessionsRoot: path.join(tmp, "codex"),
-      cursorPath: path.join(tmp, "cursor.json"),
-    });
-
-    expect(result.eventsSent).toBe(1);
-    expect("skillVersion" in captured[0].events[0]).toBe(false);
-    await fs.rm(tmp, { recursive: true, force: true });
-  });
-});